juggernaut-bedrock 4.0.0 → 4.0.1

package/install.js

@@ -3,11 +3,16 @@
 const https = require("https");
 const fs = require("fs");
 const path = require("path");
-const os = require("os");
+const { Readable } = require("stream");
 const crypto = require("crypto");
 
 const REPO = "jpvelasco/juggernaut";
 const BIN_DIR = path.join(__dirname, "bin");
+const ALLOWED_HOSTS = new Set([
+  "github.com",
+  "api.github.com",
+  "release-assets.githubusercontent.com"
+]);
 
 function getPlatform() {
   const osMap = { darwin: "darwin", linux: "linux", win32: "windows" };
@@ -20,12 +25,23 @@ function getPlatform() {
   return { os: p, arch: a, platform: `${p}_${a}` };
 }
 
-function httpsGet(url) {
+function httpsGetBuffer(url) {
+  const parsed = new URL(url);
+  if (!ALLOWED_HOSTS.has(parsed.hostname)) {
+    throw new Error(`URL host not allowed: ${parsed.hostname}`);
+  }
   return new Promise((resolve, reject) => {
     https
       .get(url, { headers: { "User-Agent": "juggernaut-npm-installer/1.0" } }, (res) => {
         if (res.statusCode === 301 || res.statusCode === 302) {
-          return httpsGet(res.headers.location).then(resolve).catch(reject);
+          const location = res.headers.location;
+          const redirectParsed = new URL(location);
+          if (!ALLOWED_HOSTS.has(redirectParsed.hostname)) {
+            reject(new Error(`Redirect host not allowed: ${redirectParsed.hostname}`));
+            return;
+          }
+          httpsGetBuffer(location).then(resolve).catch(reject);
+          return;
         }
         const chunks = [];
         res.on("data", (chunk) => chunks.push(chunk));
@@ -36,27 +52,8 @@ function httpsGet(url) {
   });
 }
 
-function downloadFile(url, dest) {
-  return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(dest);
-    function fetch(fetchUrl) {
-      https
-        .get(fetchUrl, { headers: { "User-Agent": "juggernaut-npm-installer/1.0" } }, (res) => {
-          if (res.statusCode === 301 || res.statusCode === 302) {
-            return fetch(res.headers.location);
-          }
-          res.pipe(file);
-          file.on("finish", () => file.close(resolve));
-          file.on("error", reject);
-        })
-        .on("error", reject);
-    }
-    fetch(url);
-  });
-}
-
 async function getLatestVersion() {
-  const data = await httpsGet(`https://api.github.com/repos/${REPO}/releases/latest`);
+  const data = await httpsGetBuffer(`https://api.github.com/repos/${REPO}/releases/latest`);
   const release = JSON.parse(data.toString());
   return release.tag_name.replace(/^v/, "");
 }
@@ -68,49 +65,33 @@ async function main() {
   const archive = `juggernaut_${platform}.${ext}`;
   const baseUrl = `https://github.com/${REPO}/releases/download/v${version}`;
 
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "juggernaut-"));
-  const archivePath = path.join(tmp, archive);
-  const checksumPath = path.join(tmp, "checksums.txt");
-
-  try {
-    console.log(`Downloading Juggernaut v${version} (${platform})...`);
-    await downloadFile(`${baseUrl}/${archive}`, archivePath);
-    await downloadFile(`${baseUrl}/checksums.txt`, checksumPath);
-
-    // Verify checksum.
-    const checksums = fs.readFileSync(checksumPath, "utf8");
-    const line = checksums.split("\n").find((l) => l.includes(archive));
-    if (!line) throw new Error(`Checksum not found for ${archive}`);
-    const expected = line.trim().split(/\s+/)[0].toLowerCase();
-    const actual = crypto
-      .createHash("sha256")
-      .update(fs.readFileSync(archivePath))
-      .digest("hex")
-      .toLowerCase();
-    if (actual !== expected) {
-      throw new Error(`Checksum mismatch for ${archive}\n  expected: ${expected}\n  got:      ${actual}`);
-    }
+  console.log(`Downloading Juggernaut v${version} (${platform})...`);
+  const archiveBuf = await httpsGetBuffer(`${baseUrl}/${archive}`);
+  const checksumsBuf = await httpsGetBuffer(`${baseUrl}/checksums.txt`);
 
-    fs.mkdirSync(BIN_DIR, { recursive: true });
-
-    if (ext === "zip") {
-      const AdmZip = require("adm-zip");
-      const zip = new AdmZip(archivePath);
-      zip.extractEntryTo("juggernaut.exe", BIN_DIR, false, true);
-    } else {
-      const tar = require("tar");
-      await tar.x({ file: archivePath, cwd: BIN_DIR });
-      fs.chmodSync(path.join(BIN_DIR, "juggernaut"), 0o755);
-    }
+  const checksums = checksumsBuf.toString("utf8");
+  const line = checksums.split("\n").find((l) => l.includes(archive));
+  if (!line) throw new Error(`Checksum not found for ${archive}`);
+  const expected = line.trim().split(/\s+/)[0].toLowerCase();
+  const actual = crypto.createHash("sha256").update(archiveBuf).digest("hex").toLowerCase();
+  if (actual !== expected) {
+    throw new Error(`Checksum mismatch for ${archive}\n  expected: ${expected}\n  got:      ${actual}`);
+  }
 
-    console.log(`Juggernaut v${version} installed successfully.`);
-    console.log(`Run: juggernaut apply`);
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
+  if (ext === "zip") {
+    const AdmZip = require("adm-zip");
+    const zip = new AdmZip(archiveBuf);
+    zip.extractEntryTo("juggernaut.exe", BIN_DIR, false, true);
+  } else {
+    const tar = require("tar");
+    await tar.x({ cwd: BIN_DIR, mode: 0o700, strict: true }, Readable.from(archiveBuf));
   }
+
+  console.log(`Juggernaut v${version} installed successfully.`);
+  console.log(`Run: juggernaut apply`);
 }
 
 main().catch((err) => {
   console.error("Installation failed:", err.message);
   process.exit(1);
-});
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "juggernaut-bedrock",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Configure Claude Code to use Amazon Bedrock — cross-platform installer",
   "bin": {
     "juggernaut": "./bin/juggernaut"
@@ -9,8 +9,8 @@
     "postinstall": "node install.js"
   },
   "dependencies": {
-    "tar": "^6.0.0",
-    "adm-zip": "^0.5.0"
+    "tar": "7.5.16",
+    "adm-zip": "0.5.17"
   },
   "os": ["darwin", "linux", "win32"],
   "cpu": ["x64", "arm64"],