bookmark-bridge 2.0.0 → 2.0.3

package/README.md

@@ -121,14 +121,20 @@ extension's storage. `BOOKMARK_BRIDGE_PORT` changes the port.
 The v2 server is available on the npm `native` channel. The standard
 `bookmark-bridge` command still installs the legacy server.
 
-1. In your MCP client, change the command arguments from `-y bookmark-bridge`
+1. Open `chrome://extensions` and check the Bridgey extension version. Native
+   Messaging requires **2.0.0 or later**. If you have an older version, keep
+   using the legacy MCP command or [load the unpacked extension](#unpacked-development-extension)
+   before changing your MCP configuration.
+2. In your MCP client, change the command arguments from `-y bookmark-bridge`
    to `-y bookmark-bridge@native`, then restart its MCP connection. With Claude
    Code, the command for a new entry is
    `claude mcp add bookmark-bridge -- npx -y bookmark-bridge@native`.
-2. Open Bridgey's popup and choose **Native Messaging**. Approve Chrome's
+3. Open Bridgey's popup and choose **Native Messaging**. Approve Chrome's
    permission prompt. If setup fails, the extension stays in Legacy mode.
-3. Run `bridge_status` from your MCP client to confirm the connection.
+   Restore the legacy MCP command to reconnect.
+4. Run `bridge_status` from your MCP client to confirm the connection.
 
+The Native npm package contains the prebuilt servers and their checksums.
 The first server startup installs the native host in a user data directory
 outside the npm cache and registers it with Chrome. Chrome launches that host
 when the extension connects. The host and the MCP process communicate over an
@@ -139,14 +145,19 @@ Bridgey serves one Native Messaging browser profile at a time. Each profile's
 v2 snapshots live under `native-v2/<profileId>` inside the existing history
 state directory. Legacy snapshots remain available in Legacy mode.
 
-To switch back, choose **Legacy (WebSocket)** in the popup, restore the MCP
-command arguments to `-y bookmark-bridge`, and restart its MCP connection.
+To switch back, choose **Legacy (WebSocket)** if the popup shows a mode
+selector, restore the MCP command arguments to `-y bookmark-bridge`, and
+restart its MCP connection.
 Restarting Chrome or reconnecting the popup refreshes the browser connection.
 Restart the MCP connection after updating the server to refresh its tool list.
 
-For an unpacked development extension, build the v2 binary and run
-`bookmark-bridge register-native <extension-id>` with that binary before
-selecting Native Messaging. It remembers the ID alongside the published one.
+### Unpacked development extension
+
+At `chrome://extensions`, enable Developer mode and load the `extension/`
+directory from this repository at `v2.0.0` or later. Copy the unpacked
+extension's ID and run `npx -y bookmark-bridge@native register-native <extension-id>`
+before selecting Native Messaging. The host remembers this ID alongside the
+published one.
 On macOS and Linux, set `BOOKMARK_BRIDGE_CHROME_USER_DATA_DIR` to the absolute
 user data directory when registering for a Chrome test profile outside the
 default location.

package/bin/bookmark-bridge.mjs

@@ -1,13 +1,11 @@
 #!/usr/bin/env node
-// Fetches the prebuilt server for this platform on first run, then hands over to
-// it. An MCP client launches this over stdio, so nothing may be written to
+// Verifies and unpacks the bundled server, then hands over to it.
+// An MCP client launches this over stdio, so nothing may be written to
 // stdout that is not protocol: progress goes to stderr.
 import {spawn} from 'node:child_process';
 import {createHash} from 'node:crypto';
-import {createWriteStream} from 'node:fs';
 import {chmod, mkdir, mkdtemp, readFile, rename, rm, stat} from 'node:fs/promises';
 import {dirname, join} from 'node:path';
-import {pipeline} from 'node:stream/promises';
 import {fileURLToPath} from 'node:url';
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -35,7 +33,7 @@ if (!target) {
   die(`no prebuilt server for ${key}. Build from source: https://github.com/${REPO}`);
 }
 
-// Cached per version, so upgrading the package fetches a matching server rather
+// Cached per version, so upgrading the package unpacks a matching server rather
 // than silently reusing an old one.
 const cacheDir = join(here, '..', '.bin', pkg.version);
 const binary = join(cacheDir, `bookmark-bridge${EXE}`);
@@ -44,38 +42,20 @@ async function exists(path) {
   try { await stat(path); return true; } catch { return false; }
 }
 
-async function fetchOrDie(url, what) {
-  const res = await fetch(url, {redirect: 'follow'});
-  if (!res.ok) die(`could not download ${what} (HTTP ${res.status})\n  ${url}`);
-  return res;
-}
-
 async function install() {
-  const tag = `v${pkg.version}`;
+  const assets = join(here, '..', 'release-assets');
   const name = `bookmark-bridge-${target}.tar.gz`;
-  const base = `https://github.com/${REPO}/releases/download/${tag}`;
-
-  process.stderr.write(`bookmark-bridge: fetching ${tag} for ${key}\n`);
-  const sums = (await (await fetchOrDie(`${base}/SHA256SUMS`, 'checksums')).text());
-  const line = sums.split('\n').find((l) => l.trim().endsWith(name));
-  if (!line) die(`no checksum published for ${name} in ${tag}`);
-  const expected = line.trim().split(/\s+/)[0];
+  const sums = await readFile(join(assets, 'SHA256SUMS'), 'utf8');
+  const expected = sums.split('\n').map(line => line.trim().split(/\s+/))
+    .find(([, file]) => file === name)?.[0];
+  if (!expected) throw new Error(`no checksum bundled for ${name}`);
+  const archive = join(assets, name);
+  const actual = createHash('sha256').update(await readFile(archive)).digest('hex');
+  if (actual !== expected) throw new Error(`checksum mismatch for ${name}`);
 
   await mkdir(dirname(cacheDir), {recursive: true});
   const staging = await mkdtemp(join(dirname(cacheDir), '.install-'));
-  const archive = join(staging, name);
   try {
-    await pipeline(
-      (await fetchOrDie(`${base}/${name}`, 'the server')).body,
-      createWriteStream(archive),
-    );
-
-    // Never run a binary that does not match what the release published.
-    const actual = createHash('sha256').update(await readFile(archive)).digest('hex');
-    if (actual !== expected) {
-      die(`checksum mismatch for ${name}\n  expected ${expected}\n  got      ${actual}`);
-    }
-
     await new Promise((resolve, reject) => {
       const tar = spawn('tar', ['-xzf', archive, '-C', staging], {stdio: 'inherit'});
       tar.on('error', reject);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bookmark-bridge",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "description": "Chrome bookmarks as MCP tools, with every change recorded in git so it can be rolled back",
   "license": "MIT",
   "repository": {
@@ -13,10 +13,11 @@
   },
   "files": [
     "bin/",
+    "release-assets/",
     "README.md"
   ],
   "scripts": {
-    "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'native') { console.error('Publish this version with npm publish --tag native.'); process.exit(1); }\""
+    "prepublishOnly": "node -e \"if (process.env.npm_config_tag !== 'native' || !require('fs').existsSync('release-assets/SHA256SUMS')) { console.error('Publish the bundled release with npm publish --tag native.'); process.exit(1); }\""
   },
   "publishConfig": {
     "tag": "native"

package/release-assets/SHA256SUMS

@@ -0,0 +1,5 @@
+a55375e6a1e8fd9cfb4aaa595a594ae62d8e4c5047dccda59c9631a3a7a5b1fc  bookmark-bridge-aarch64-apple-darwin.tar.gz
+ee37b2bf74d9670bef55b0464ce880272d63b76cafe16f501be4cd53fedb7b55  bookmark-bridge-aarch64-unknown-linux-gnu.tar.gz
+944b198396dc0becdfe926e83f5f71130329eb2241e337b416bccf7b5be1251e  bookmark-bridge-x86_64-apple-darwin.tar.gz
+2df2e9704ba897d96f0b8466d1e20256ef3d30afe2a61103ec69339f6d6420a6  bookmark-bridge-x86_64-pc-windows-msvc.tar.gz
+4fdd3d39d3560fad4749dbd9208698a39b3c8b6d232f4a9f2c91ab53175b6116  bookmark-bridge-x86_64-unknown-linux-gnu.tar.gz