devrites 3.0.6 → 3.0.7

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.0.7](https://github.com/ViktorsBaikers/DevRites/compare/v3.0.6...v3.0.7) (2026-07-22)
+
+### Fixed
+
+* **installer:** harden binary acquisition ([7534198](https://github.com/ViktorsBaikers/DevRites/commit/7534198dd3f6a29f065fe715e763e02bdc8a71c0))
+
 ## [3.0.6](https://github.com/ViktorsBaikers/DevRites/compare/v3.0.5...v3.0.6) (2026-07-22)
 
 ### Fixed

package/README.md

@@ -21,7 +21,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.0.6`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.0.6): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.0.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.0.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 
@@ -297,7 +297,9 @@ configured engine or a local `engine/devrites-engine`, can download a
 checksummed release binary, can build a temporary engine from the local Go
 source, and finally falls back to an existing `devrites-engine` on `PATH`. Use `--no-binary` or
 `DEVRITES_NO_BINARY=1` if you do not want the installer to keep the shared
-binary outside the project.
+binary outside the project. `devrites-engine update` also prefers the
+checksummed platform release binary and only builds from source as a fallback,
+without reading Git metadata from the target project.
 
 Workflow state is read through the engine rather than shell injection. The
 installer never writes `defaultMode: bypassPermissions`. Skills use networked

package/engine/internal/install/install.go

@@ -16,6 +16,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"slices"
 	"sort"
 	"strings"
@@ -30,6 +31,7 @@ import (
 
 const ManifestName = devritespaths.ManifestName
 const defaultRepo = "ViktorsBaikers/DevRites"
+const githubBaseURL = "https://github.com"
 
 type Mode string
 
@@ -69,15 +71,17 @@ type stats struct {
 }
 
 type runner struct {
-	opts      Options
-	target    string
-	payload   string
-	payloadFS fs.FS
-	source    string
-	manifest  []string
-	records   map[string]string
-	prev      map[string]bool
-	stats     stats
+	opts             Options
+	target           string
+	payload          string
+	payloadFS        fs.FS
+	source           string
+	manifest         []string
+	records          map[string]string
+	prev             map[string]bool
+	stats            stats
+	releaseBinaryTag string
+	preparedBinary   string
 }
 
 func DefaultOptions(mode Mode) Options {
@@ -849,7 +853,20 @@ func runUpdate(opts Options) error {
 	if opts.DryRun {
 		next.DryRun = true
 	}
-	return Apply(next)
+	r, err := newRunner(next)
+	if err != nil {
+		return fmt.Errorf("prepare installer: %w", err)
+	}
+	r.releaseBinaryTag = latestTag
+	if next.WithBinary && os.Getenv("DEVRITES_NO_BINARY") != "1" && !next.DryRun {
+		staged, cleanup, err := r.acquireBinary(latestTag, githubBaseURL)
+		if err != nil {
+			return fmt.Errorf("prepare engine binary: %w", err)
+		}
+		defer cleanup()
+		r.preparedBinary = staged
+	}
+	return r.install()
 }
 
 func resolveUpdateTag(opts Options) (string, error) {
@@ -1297,24 +1314,24 @@ func (r *runner) installBinary() error {
 			return nil
 		}
 	}
-	staged, cleanup, err := r.acquireBinary(tag)
-	if err != nil {
-		fmt.Fprintf(r.opts.Stderr, "warning: engine binary: %v - hooks fail open until you install it.\n", err)
-		return nil
+	staged, cleanup := r.preparedBinary, func() {}
+	if staged == "" {
+		var err error
+		staged, cleanup, err = r.acquireBinary(tag, githubBaseURL)
+		if err != nil {
+			return r.binaryInstallFailure(err)
+		}
 	}
 	defer cleanup()
 	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
-		fmt.Fprintf(r.opts.Stderr, "warning: engine binary: %v - hooks fail open until you install it.\n", err)
-		return nil
+		return r.binaryInstallFailure(err)
 	}
 	data, err := os.ReadFile(staged)
 	if err != nil {
-		fmt.Fprintf(r.opts.Stderr, "warning: engine binary: %v - hooks fail open until you install it.\n", err)
-		return nil
+		return r.binaryInstallFailure(err)
 	}
 	if err := fsutil.WriteFileAtomic(dest, data, 0o755); err != nil {
-		fmt.Fprintf(r.opts.Stderr, "warning: engine binary: %v - hooks fail open until you install it.\n", err)
-		return nil
+		return r.binaryInstallFailure(err)
 	}
 	_ = os.Chmod(dest, 0o755)
 	fmt.Fprintf(r.opts.Stdout, "  engine binary: installed %s\n", dest)
@@ -1324,12 +1341,23 @@ func (r *runner) installBinary() error {
 	return nil
 }
 
-func (r *runner) acquireBinary(tag string) (string, func(), error) {
+func (r *runner) binaryInstallFailure(err error) error {
+	if r.preparedBinary != "" {
+		return err
+	}
+	fmt.Fprintf(r.opts.Stderr, "warning: engine binary: %v - hooks fail open until you install it.\n", err)
+	return nil
+}
+
+func (r *runner) acquireBinary(tag, baseURL string) (string, func(), error) {
 	if v := os.Getenv("DEVRITES_ENGINE_CLI"); v != "" {
 		if exists(v) {
-			return v, func() {}, nil
+			if r.releaseBinaryTag == "" || strings.TrimPrefix(engineVersion(v), "v") == strings.TrimPrefix(r.releaseBinaryTag, "v") {
+				return v, func() {}, nil
+			}
+		} else {
+			return "", func() {}, fmt.Errorf("DEVRITES_ENGINE_CLI points to a missing binary: %s", v)
 		}
-		return "", func() {}, fmt.Errorf("DEVRITES_ENGINE_CLI points to a missing binary: %s", v)
 	}
 	tmp, err := os.MkdirTemp("", "devrites-engine-*")
 	if err != nil {
@@ -1337,19 +1365,60 @@ func (r *runner) acquireBinary(tag string) (string, func(), error) {
 	}
 	cleanup := func() { _ = os.RemoveAll(tmp) }
 	staged := filepath.Join(tmp, "devrites-engine")
+	var releaseErr error
+	if r.releaseBinaryTag != "" && os.Getenv("DEVRITES_UPDATE_BUNDLE") == "" {
+		repo := os.Getenv("DEVRITES_REPO")
+		if repo == "" {
+			repo = defaultRepo
+		}
+		downloaded, err := downloadReleaseBinary(baseURL, repo, r.releaseBinaryTag, staged)
+		if err == nil {
+			return staged, cleanup, nil
+		}
+		if downloaded {
+			return "", cleanup, err
+		}
+		releaseErr = err
+	}
 	if r.source != "" && exists(filepath.Join(r.source, "engine", "go.mod")) {
 		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 		defer cancel()
-		cmd := exec.CommandContext(ctx, "go", "build", "-trimpath", "-ldflags", "-s -w -X github.com/devrites/devrites/internal/version.Version="+tag, "-o", staged, ".")
+		cmd := exec.CommandContext(ctx, "go", "build", "-buildvcs=false", "-trimpath", "-ldflags", "-s -w -X github.com/devrites/devrites/internal/version.Version="+tag, "-o", staged, ".")
 		cmd.Dir = filepath.Join(r.source, "engine")
 		if out, err := cmd.CombinedOutput(); err != nil {
+			if releaseErr != nil {
+				return "", cleanup, fmt.Errorf("could not download release binary: %v; source fallback failed: %w: %s", releaseErr, err, strings.TrimSpace(string(out)))
+			}
 			return "", cleanup, fmt.Errorf("could not build from source: %w: %s", err, strings.TrimSpace(string(out)))
 		}
 		return staged, cleanup, nil
 	}
+	if releaseErr != nil {
+		return "", cleanup, fmt.Errorf("could not obtain a binary: %v; no Go source fallback", releaseErr)
+	}
 	return "", cleanup, fmt.Errorf("could not obtain a binary (no DEVRITES_ENGINE_CLI handoff, no Go source)")
 }
 
+func downloadReleaseBinary(baseURL, repo, tag, dest string) (bool, error) {
+	asset := fmt.Sprintf("devrites-%s-%s", runtime.GOOS, runtime.GOARCH)
+	if runtime.GOOS == "windows" {
+		asset += ".exe"
+	}
+	url := fmt.Sprintf("%s/%s/releases/download/%s/%s", strings.TrimRight(baseURL, "/"), repo, tag, asset)
+	if err := iohooks.DownloadFile(url, dest); err != nil {
+		return false, fmt.Errorf("download %s: %w", asset, err)
+	}
+	sumPath := dest + ".sha256"
+	defer os.Remove(sumPath)
+	if err := iohooks.DownloadFile(url+".sha256", sumPath); err != nil {
+		return true, fmt.Errorf("could not verify release binary %s: missing checksum: %w", asset, err)
+	}
+	if err := verifySHA256(dest, sumPath); err != nil {
+		return true, fmt.Errorf("could not verify release binary %s: %w", asset, err)
+	}
+	return true, nil
+}
+
 func (r *runner) removeBinary() error {
 	if r.opts.KeepBinary {
 		fmt.Fprintln(r.opts.Stdout, "  kept the global devrites-engine binary (--keep-binary).")

package/engine/internal/install/install_test.go

@@ -4,9 +4,12 @@ import (
 	"archive/tar"
 	"bytes"
 	"compress/gzip"
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"io/fs"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -347,6 +350,111 @@ func TestInstallBinaryUsesEngineHandoff(t *testing.T) {
 	}
 }
 
+func TestAcquireBinaryBuildsWithoutVCSMetadata(t *testing.T) {
+	t.Setenv("DEVRITES_ENGINE_CLI", "")
+	t.Setenv("DEVRITES_UPDATE_BUNDLE", "")
+	t.Setenv("GOFLAGS", "-buildvcs=true")
+	source := t.TempDir()
+	if err := os.Mkdir(filepath.Join(source, ".git"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	testutil.WriteFile(t, filepath.Join(source, "engine", "go.mod"), "module github.com/devrites/devrites\n\ngo 1.23\n")
+	testutil.WriteFile(t, filepath.Join(source, "engine", "main.go"), "package main\nfunc main() {}\n")
+
+	r := runner{source: source}
+	staged, cleanup, err := r.acquireBinary("v1.2.3", githubBaseURL)
+	defer cleanup()
+	if err != nil {
+		t.Fatalf("acquireBinary with unavailable VCS metadata: %v", err)
+	}
+	if !exists(staged) {
+		t.Fatalf("acquireBinary did not build %s", staged)
+	}
+}
+
+func TestAcquireBinaryPrefersVerifiedReleaseOverStaleHandoff(t *testing.T) {
+	stale := filepath.Join(t.TempDir(), "devrites-engine")
+	testutil.WriteExecutable(t, stale, "#!/bin/sh\nif [ \"$1\" = version ]; then echo v1.2.2; fi\n")
+	t.Setenv("DEVRITES_ENGINE_CLI", stale)
+	t.Setenv("DEVRITES_UPDATE_BUNDLE", "")
+	t.Setenv("DEVRITES_REPO", "owner/repo")
+	tag := "v1.2.3"
+	asset := fmt.Sprintf("devrites-%s-%s", runtime.GOOS, runtime.GOARCH)
+	if runtime.GOOS == "windows" {
+		asset += ".exe"
+	}
+	path := "/owner/repo/releases/download/" + tag + "/" + asset
+	body := []byte("verified release binary")
+	sum := fmt.Sprintf("%x  %s\n", sha256.Sum256(body), asset)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		switch req.URL.Path {
+		case path:
+			_, _ = w.Write(body)
+		case path + ".sha256":
+			_, _ = w.Write([]byte(sum))
+		default:
+			http.NotFound(w, req)
+		}
+	}))
+	defer server.Close()
+
+	r := runner{releaseBinaryTag: tag}
+	staged, cleanup, err := r.acquireBinary(tag, server.URL)
+	defer cleanup()
+	if err != nil {
+		t.Fatalf("acquire verified release binary: %v", err)
+	}
+	got, err := os.ReadFile(staged)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, body) {
+		t.Fatalf("acquired binary = %q, want %q", got, body)
+	}
+}
+
+func TestAcquireBinaryRejectsReleaseChecksumMismatch(t *testing.T) {
+	t.Setenv("DEVRITES_ENGINE_CLI", "")
+	t.Setenv("DEVRITES_UPDATE_BUNDLE", "")
+	t.Setenv("DEVRITES_REPO", "owner/repo")
+	tag := "v1.2.3"
+	source := t.TempDir()
+	testutil.WriteFile(t, filepath.Join(source, "engine", "go.mod"), "module github.com/devrites/devrites\n\ngo 1.23\n")
+	testutil.WriteFile(t, filepath.Join(source, "engine", "main.go"), "package main\nfunc main() {}\n")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		if strings.HasSuffix(req.URL.Path, ".sha256") {
+			_, _ = w.Write([]byte("deadbeef\n"))
+			return
+		}
+		_, _ = w.Write([]byte("tampered release binary"))
+	}))
+	defer server.Close()
+
+	r := runner{source: source, releaseBinaryTag: tag}
+	_, cleanup, err := r.acquireBinary(tag, server.URL)
+	defer cleanup()
+	if err == nil || !strings.Contains(err.Error(), "checksum mismatch") {
+		t.Fatalf("acquireBinary error = %v, want checksum mismatch", err)
+	}
+}
+
+func TestInstallBinaryFailsWhenPreparedUpdateCannotBeWritten(t *testing.T) {
+	prepared := filepath.Join(t.TempDir(), "devrites-engine")
+	testutil.WriteExecutable(t, prepared, "#!/bin/sh\n")
+	blocked := filepath.Join(t.TempDir(), "not-a-directory")
+	testutil.WriteFile(t, blocked, "file\n")
+	t.Setenv("DEVRITES_BIN_DIR", filepath.Join(blocked, "bin"))
+	t.Setenv("DEVRITES_REF", "v1.2.3")
+
+	r := runner{
+		opts:           DefaultOptions(ModeInstall),
+		preparedBinary: prepared,
+	}
+	if err := r.installBinary(); err == nil {
+		t.Fatal("installBinary accepted a prepared update it could not write")
+	}
+}
+
 func TestInstallBinaryWarnsWhenHooksCannotResolveEngine(t *testing.T) {
 	payload := testPayload(t)
 	target := t.TempDir()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.0.6",
+  "version": "3.0.7",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",