car-runtime 0.4.3 → 0.4.5

package/install.js

@@ -6,6 +6,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const http = require('node:http');
 const https = require('node:https');
 const { pipeline } = require('node:stream/promises');
 
@@ -37,7 +38,10 @@ function pkgVersion() {
 
 function get(url) {
   return new Promise((resolve, reject) => {
-    const req = https.get(
+    // Select transport by scheme. Production URLs are always https; http is
+    // supported so CAR_RUNTIME_DOWNLOAD_BASE can point at a local mirror / test.
+    const mod = url.startsWith('http://') ? http : https;
+    const req = mod.get(
       url,
       { headers: { 'user-agent': `car-runtime-install/${pkgVersion()}` } },
       (res) => {
@@ -93,9 +97,10 @@ async function main() {
         `Place ${name} manually in ${__dirname} or set CAR_RUNTIME_SKIP_DOWNLOAD=1 ` +
         `and ensure the binary is resolvable at require-time.`,
     );
-    // Exit 0 so `npm install` doesn't fail the whole project — the require()
-    // in index.js will surface a clear error if the binary is missing.
-    process.exit(0);
+    // Exit non-zero so `npm install` fails loudly instead of silently producing
+    // a broken package. CAR_RUNTIME_SKIP_DOWNLOAD=1 remains the escape hatch
+    // for air-gapped installs; see the opt-out branch above.
+    process.exit(1);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "car-runtime",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Common Agent Runtime — a deterministic execution layer for AI agents",
   "main": "index.js",
   "types": "index.d.ts",
@@ -38,7 +38,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "install": "node install.js || true"
+    "install": "node install.js"
   },
   "license": "SEE LICENSE IN LICENSE",
   "private": false