gm-plugkit 2.0.2562 → 2.0.2564

package/bootstrap-wasm-core.js

@@ -52,6 +52,18 @@ function clearBootstrapError() {
   } catch (_) {}
 }
 
+function failClosedMissingSha(version, artifactName, partialPath) {
+  try { fs.unlinkSync(partialPath); } catch (_) {}
+  const message = `no sha256 manifest entry for ${artifactName}: refusing to trust unverified download`;
+  writeBootstrapError({
+    expected_version: version,
+    cached_version: null,
+    error_phase: 'sha256-manifest-missing',
+    error_message: message,
+  });
+  return new Error(message);
+}
+
 function readVersionFile(wrapperDir) {
   const p = path.join(wrapperDir, 'plugkit.version');
   if (!fs.existsSync(p)) throw new Error(`plugkit.version not found at ${p}`);
@@ -226,6 +238,7 @@ module.exports = {
   resolveProjectRoot,
   writeBootstrapError,
   clearBootstrapError,
+  failClosedMissingSha,
   readVersionFile,
   readShaManifest,
   copyWasmToGmTools,

package/bootstrap.js

@@ -31,6 +31,7 @@ const {
   writeBootstrapError,
   clearBootstrapError,
   resolveInstalledWasmPath,
+  failClosedMissingSha,
 } = core;
 
 const LOCK_STALE_MS = 30 * 60 * 1000;
@@ -416,7 +417,8 @@ async function bootstrap(opts) {
       }
     }
 
-    if (expectedSha) {
+    if (!expectedSha) throw failClosedMissingSha(version, wasmName, partialPath);
+    {
       const got = await sha256OfFile(partialPath);
       if (got !== expectedSha) {
         try { fs.unlinkSync(partialPath); } catch (_) {}
@@ -428,8 +430,6 @@ async function bootstrap(opts) {
         throw new Error(`sha256 mismatch for ${wasmName}: expected ${expectedSha}, got ${got}`);
       }
       log('sha256 verified');
-    } else {
-      log('no sha256 manifest -- skipping verify');
     }
 
     try { fs.renameSync(partialPath, finalPath); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2562",
+  "version": "2.0.2564",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {