@webority/ensemble 0.5.15 → 0.5.17

package/bin/ensemble.js

@@ -9,7 +9,7 @@ const core = require('../lib/core');
 // Bus subcommands are handled by the internal `ensemble-runtime` binary; the Node CLI forwards argv
 // through to it (inherited stdio, same exit code) so users type only one command: `ensemble <sub>`.
 const BUS_SUBCOMMANDS = new Set([
-  'send', 'who', 'read', 'reply', 'label', 'hook', 'mcp', 'register', 'detach', 'ask',
+  'send', 'who', 'read', 'watch', 'reply', 'label', 'hook', 'mcp', 'register', 'detach', 'ask',
   'rooms', 'room-create', 'room-send', 'room-messages', 'room-add', 'room-remove',
 ]);
 

package/lib/core.js

@@ -4,6 +4,7 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const https = require('https');
+const crypto = require('crypto');
 const { spawn, spawnSync } = require('child_process');
 
 const HOME = os.homedir();
@@ -69,6 +70,47 @@ function downloadTo(url, dest) {
   });
 }
 
+// SHA-256 of a file on disk (hex). Used to verify CDN / package payloads against manifest.json.
+function sha256File(filePath) {
+  const hash = crypto.createHash('sha256');
+  hash.update(fs.readFileSync(filePath));
+  return hash.digest('hex');
+}
+
+// Fetch the release manifest from the same origin as binaries (DL_BASE/manifest.json).
+// Shape: { "version": "x.y.z", "files": { "ensemble-runtime-win-x64.exe": "<sha256hex>", ... } }
+// ENSEMBLE_DL_BASE is treated as trusted-only: CDN installs fail closed without a matching entry.
+async function fetchReleaseManifest() {
+  const url = DL_BASE.replace(/\/$/, '') + '/manifest.json';
+  try {
+    const res = await request('GET', url, {}, null);
+    if (res.status !== 200) {
+      return { ok: false, reason: 'HTTP ' + res.status + ' for ' + url };
+    }
+    const body = JSON.parse(res.body);
+    if (!body || typeof body !== 'object' || !body.files || typeof body.files !== 'object') {
+      return { ok: false, reason: 'manifest.json missing files map' };
+    }
+    return { ok: true, manifest: body };
+  } catch (e) {
+    return { ok: false, reason: e && e.message ? e.message : String(e) };
+  }
+}
+
+// Verify tmp against the expected hex from the manifest. Throws on mismatch / missing entry.
+function verifyBinarySha256(tmpPath, expectedHex, logicalName) {
+  if (!expectedHex || typeof expectedHex !== 'string') {
+    throw new Error('no SHA-256 in manifest for ' + logicalName +
+      ' — refuse to place an unverified binary from ' + DL_BASE);
+  }
+  const actual = sha256File(tmpPath);
+  if (actual.toLowerCase() !== expectedHex.trim().toLowerCase()) {
+    throw new Error('SHA-256 mismatch for ' + logicalName +
+      ' (expected ' + expectedHex.trim().toLowerCase() + ', got ' + actual +
+      '). Refusing to place — CDN/package may be compromised or stale.');
+  }
+}
+
 // Throws (not die) so the npm postinstall can catch and not fail the whole install on an
 // unsupported OS; the CLI dispatcher catches the throw and prints it cleanly.
 function assertSupported() {
@@ -300,24 +342,62 @@ async function ensureBinaries(opts) {
     { src: pkgDir && path.join(pkgDir, 'ensemble-runtime' + pf.exe), cdn: 'ensemble-runtime-' + pf.key + pf.exe, dest: runtimePath },
     { src: pkgDir && path.join(pkgDir, 'Ensemble.Runner' + pf.exe), cdn: 'ensemble-runner-' + pf.key + pf.exe, dest: runnerPath },
   ];
+
+  // CDN path requires a SHA-256 manifest (fail closed). npm package copies also verify when the
+  // manifest lists the file (npm integrity is not a substitute for a published release hash).
+  // ENSEMBLE_DL_BASE is trusted-only as the origin of both binaries and manifest.json.
+  let manifestFiles = null;
+  const needsCdn = targets.some((t) => shouldRefreshBinary(t.dest, t.src, force) && !(t.src && isUsableBinary(t.src)));
+  const needsAny = targets.some((t) => shouldRefreshBinary(t.dest, t.src, force));
+  if (needsAny) {
+    const fetched = await fetchReleaseManifest();
+    if (fetched.ok) {
+      manifestFiles = fetched.manifest.files;
+    } else if (needsCdn) {
+      throw new Error('CDN install refused: could not load SHA-256 manifest from ' +
+        DL_BASE.replace(/\/$/, '') + '/manifest.json (' + fetched.reason +
+        '). Publish manifest.json next to the binaries, or install via npm platform packages.');
+    } else {
+      warn('manifest.json unavailable (' + fetched.reason +
+        ') — placing npm package binaries without SHA-256 verify. Publish a release manifest for full integrity.');
+    }
+  }
+
   let runnerRefreshed = false;
   for (const t of targets) {
     if (!shouldRefreshBinary(t.dest, t.src, force)) continue;
     // Write to a temp then atomically place onto dest — placeBinary tolerates a Windows lock on the
     // running runner (rename-aside), so an upgrade never fails just because the daemon is up.
     const tmp = t.dest + '.new';
-    if (t.src && isUsableBinary(t.src)) {
+    const fromNpm = !!(t.src && isUsableBinary(t.src));
+    if (fromNpm) {
       log('  installing ' + path.basename(t.dest) + ' from npm package …');
       fs.copyFileSync(t.src, tmp);
     } else {
       log('  downloading ' + t.cdn + ' …');
-      await downloadTo(DL_BASE + '/' + t.cdn, tmp);
+      await downloadTo(DL_BASE.replace(/\/$/, '') + '/' + t.cdn, tmp);
     }
     if (!isUsableBinary(tmp)) {
       try { fs.unlinkSync(tmp); } catch (_) { /* ignore */ }
       throw new Error('installed binary looks corrupt or too small: ' + t.dest +
         ' (expected ≥ ' + MIN_BINARY_BYTES + ' bytes). Check CDN / platform package.');
     }
+    // Integrity: CDN always requires a matching hash. npm package verifies when the release
+    // manifest lists this cdn key (same bytes as the published artifact).
+    if (manifestFiles) {
+      const expected = manifestFiles[t.cdn];
+      if (!fromNpm || expected) {
+        try {
+          verifyBinarySha256(tmp, expected, t.cdn);
+        } catch (e) {
+          try { fs.unlinkSync(tmp); } catch (_) { /* ignore */ }
+          throw e;
+        }
+      }
+    } else if (!fromNpm) {
+      try { fs.unlinkSync(tmp); } catch (_) { /* ignore */ }
+      throw new Error('CDN install refused: no SHA-256 for ' + t.cdn);
+    }
     placeBinary(tmp, t.dest);
     if (t.dest === runnerPath) runnerRefreshed = true;
     if (pf.os !== 'windows') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webority/ensemble",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "Connect this machine to Ensemble — runs the local agent runner and wires the ensemble session bus so your coding sessions talk (per-org, isolated).",
   "bin": {
     "ensemble": "bin/ensemble.js"
@@ -12,11 +12,11 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@webority/ensemble-darwin-arm64": "0.5.15",
-    "@webority/ensemble-darwin-x64": "0.5.15",
-    "@webority/ensemble-linux-arm64": "0.5.15",
-    "@webority/ensemble-linux-x64": "0.5.15",
-    "@webority/ensemble-win-x64": "0.5.15"
+    "@webority/ensemble-darwin-arm64": "0.5.17",
+    "@webority/ensemble-darwin-x64": "0.5.17",
+    "@webority/ensemble-linux-arm64": "0.5.17",
+    "@webority/ensemble-linux-x64": "0.5.17",
+    "@webority/ensemble-win-x64": "0.5.17"
   },
   "files": [
     "bin",