bookmark-bridge 2.0.0 → 2.0.2

package/README.md

@@ -129,6 +129,7 @@ The v2 server is available on the npm `native` channel. The standard
    permission prompt. If setup fails, the extension stays in Legacy mode.
 3. Run `bridge_status` from your MCP client to confirm the connection.
 
+The Native npm package contains the prebuilt servers and their checksums.
 The first server startup installs the native host in a user data directory
 outside the npm cache and registers it with Chrome. Chrome launches that host
 when the extension connects. The host and the MCP process communicate over an

package/bin/bookmark-bridge.mjs

@@ -1,13 +1,11 @@
 #!/usr/bin/env node
-// Fetches the prebuilt server for this platform on first run, then hands over to
-// it. An MCP client launches this over stdio, so nothing may be written to
+// Verifies and unpacks the bundled server, then hands over to it.
+// An MCP client launches this over stdio, so nothing may be written to
 // stdout that is not protocol: progress goes to stderr.
 import {spawn} from 'node:child_process';
 import {createHash} from 'node:crypto';
-import {createWriteStream} from 'node:fs';
 import {chmod, mkdir, mkdtemp, readFile, rename, rm, stat} from 'node:fs/promises';
 import {dirname, join} from 'node:path';
-import {pipeline} from 'node:stream/promises';
 import {fileURLToPath} from 'node:url';
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -35,7 +33,7 @@ if (!target) {
   die(`no prebuilt server for ${key}. Build from source: https://github.com/${REPO}`);
 }
 
-// Cached per version, so upgrading the package fetches a matching server rather
+// Cached per version, so upgrading the package unpacks a matching server rather
 // than silently reusing an old one.
 const cacheDir = join(here, '..', '.bin', pkg.version);
 const binary = join(cacheDir, `bookmark-bridge${EXE}`);
@@ -44,38 +42,20 @@ async function exists(path) {
   try { await stat(path); return true; } catch { return false; }
 }
 
-async function fetchOrDie(url, what) {
-  const res = await fetch(url, {redirect: 'follow'});
-  if (!res.ok) die(`could not download ${what} (HTTP ${res.status})\n  ${url}`);
-  return res;
-}
-
 async function install() {
-  const tag = `v${pkg.version}`;
+  const assets = join(here, '..', 'release-assets');
   const name = `bookmark-bridge-${target}.tar.gz`;
-  const base = `https://github.com/${REPO}/releases/download/${tag}`;
-
-  process.stderr.write(`bookmark-bridge: fetching ${tag} for ${key}\n`);
-  const sums = (await (await fetchOrDie(`${base}/SHA256SUMS`, 'checksums')).text());
-  const line = sums.split('\n').find((l) => l.trim().endsWith(name));
-  if (!line) die(`no checksum published for ${name} in ${tag}`);
-  const expected = line.trim().split(/\s+/)[0];
+  const sums = await readFile(join(assets, 'SHA256SUMS'), 'utf8');
+  const expected = sums.split('\n').map(line => line.trim().split(/\s+/))
+    .find(([, file]) => file === name)?.[0];
+  if (!expected) throw new Error(`no checksum bundled for ${name}`);
+  const archive = join(assets, name);
+  const actual = createHash('sha256').update(await readFile(archive)).digest('hex');
+  if (actual !== expected) throw new Error(`checksum mismatch for ${name}`);
 
   await mkdir(dirname(cacheDir), {recursive: true});
   const staging = await mkdtemp(join(dirname(cacheDir), '.install-'));
-  const archive = join(staging, name);
   try {
-    await pipeline(
-      (await fetchOrDie(`${base}/${name}`, 'the server')).body,
-      createWriteStream(archive),
-    );
-
-    // Never run a binary that does not match what the release published.
-    const actual = createHash('sha256').update(await readFile(archive)).digest('hex');
-    if (actual !== expected) {
-      die(`checksum mismatch for ${name}\n  expected ${expected}\n  got      ${actual}`);
-    }
-
     await new Promise((resolve, reject) => {
       const tar = spawn('tar', ['-xzf', archive, '-C', staging], {stdio: 'inherit'});
       tar.on('error', reject);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bookmark-bridge",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Chrome bookmarks as MCP tools, with every change recorded in git so it can be rolled back",
   "license": "MIT",
   "repository": {
@@ -13,10 +13,11 @@
   },
   "files": [
     "bin/",
+    "release-assets/",
     "README.md"
   ],
   "scripts": {
-    "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'native') { console.error('Publish this version with npm publish --tag native.'); process.exit(1); }\""
+    "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'native' || !require('fs').existsSync('release-assets/SHA256SUMS')) { console.error('Publish the bundled release with npm publish --tag native.'); process.exit(1); }\""
   },
   "publishConfig": {
     "tag": "native"

package/release-assets/SHA256SUMS

@@ -0,0 +1,5 @@
+af0dc501199feb693a68cc1d433499e67a633f495fbce1e6f43c5e165f6b99a3  bookmark-bridge-aarch64-apple-darwin.tar.gz
+35968f8114af290d81638e97d5482c23457b0b72c5a6004eabec78a3739a13c8  bookmark-bridge-aarch64-unknown-linux-gnu.tar.gz
+67fae0592491c25bbb8caca61630dd4213d26fe83e09e2f03bf75a130c70efd6  bookmark-bridge-x86_64-apple-darwin.tar.gz
+d443279e1a1380f442b69df9c86072d40bb5980d550aba8050e6c84aa3fcf184  bookmark-bridge-x86_64-pc-windows-msvc.tar.gz
+3cc3b1480fd7fb6a39d7407d48bf528debe1216791bade50f1e95cfd5dd237b9  bookmark-bridge-x86_64-unknown-linux-gnu.tar.gz