deltara 0.26.1 → 0.27.0

package/bin/deltara.js

@@ -1,9 +1,13 @@
 #!/usr/bin/env node
 // Thin wrapper that spawns the platform-specific Deltara binary.
-// The binary is pre-extracted (PyInstaller --onedir), so no System V
-// semaphore is needed at runtime — works cleanly inside Codex sandbox.
+//
+// 0.27.0+ — integrity guard: verifies the shipped binary's SHA-256 matches
+// the hash recorded in integrity.json at build time. If the binary on disk
+// has been tampered with (post-install file swap, corrupted install, etc.),
+// the wrapper aborts BEFORE executing so a trojaned binary cannot run.
 
 const { spawn } = require("child_process");
+const { createHash } = require("crypto");
 const path = require("path");
 const fs = require("fs");
 const os = require("os");
@@ -26,6 +30,49 @@ if (!fs.existsSync(binPath)) {
   process.exit(1);
 }
 
+// ── Binary integrity check (0.27.0+) ────────────────────────────────
+// Computes SHA-256 of the binary on disk and compares against the hash
+// recorded during build. A mismatch means:
+//   - The binary was modified after npm install (malware, IDE plugin, etc.)
+//   - The install partially failed and left a truncated file
+//   - A file-system corruption event touched the bits
+// In any of these cases, the safe action is to abort. Telling the user to
+// reinstall is the correct remediation — npm pulls a fresh signed tarball
+// whose hash the wrapper will verify again.
+try {
+  const integrityPath = path.join(__dirname, "integrity.json");
+  if (fs.existsSync(integrityPath)) {
+    const integrity = JSON.parse(fs.readFileSync(integrityPath, "utf-8"));
+    const expectedHash = integrity && integrity[binName];
+    if (expectedHash && expectedHash.startsWith("sha256:")) {
+      const expected = expectedHash.slice(7);
+      const actual = createHash("sha256")
+        .update(fs.readFileSync(binPath))
+        .digest("hex");
+      if (actual !== expected) {
+        console.error("deltara: binary integrity check FAILED");
+        console.error(`  expected sha256: ${expected.slice(0, 16)}...${expected.slice(-16)}`);
+        console.error(`  actual   sha256: ${actual.slice(0, 16)}...${actual.slice(-16)}`);
+        console.error();
+        console.error("The deltara binary on disk does not match the hash recorded");
+        console.error("at build time. This could mean the binary was tampered with,");
+        console.error("or the install is corrupted. Reinstall to fix:");
+        console.error();
+        console.error("  npm install -g deltara");
+        process.exit(1);
+      }
+    }
+    // Missing/malformed integrity.json → treat as non-fatal warning in case
+    // someone is running from a dev build. The Worker's binary-attestation
+    // HMAC still gates every request, so a bad binary without integrity.json
+    // can't actually reach sensitive endpoints.
+  }
+} catch (err) {
+  console.error(`deltara: integrity check error — ${err.message}`);
+  console.error("Aborting for safety. Reinstall: npm install -g deltara");
+  process.exit(1);
+}
+
 // ── Ensure binary is executable ─────────────────────────────────────
 try {
   fs.chmodSync(binPath, 0o755);

package/bin/integrity.json

@@ -0,0 +1,5 @@
+{
+  "deltara": "sha256:443fef0073bf4ba8ab45ae07d2d46cb601718deb2f30e78e4716cbcb21cce960",
+  "generated_at": "2026-04-24T06:25:22Z",
+  "version": "0.27.0"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deltara",
-  "version": "0.26.1",
+  "version": "0.27.0",
   "description": "Multi-agent research pipelines \u2014 run deep research from your terminal",
   "bin": {
     "deltara": "bin/deltara.js"