kimi-webbridge-dsh 1.3.1 → 1.4.0

package/README.md

@@ -18,6 +18,20 @@ Kimi WebBridge 的 dsh 插件：通过本机 kimi-webbridge 守护进程（`127.
 - **浏览器扩展**：需安装并连接 Kimi WebBridge 浏览器扩展 —— 从 [Chrome Web Store](https://chromewebstore.google.com/detail/kimi-webbridge/fldmhceldgbpfpkbgopacenieobmligc) 安装（`kimi-webbridge status` 显示 `extension_connected: true`；扩展版本应与守护进程一致）。
 - **守护进程**：无需预装。插件在守护进程不可达时会自动启动它；二进制缺失时会自动从官方 CDN（cdn.kimi.com，与官方安装器同源）下载安装——全程无需手动运行任何安装命令。
 
+### 跨平台支持
+
+插件根据运行时硬件自动选择并下载对应的守护进程二进制（含 SHA-256 校验，与官方清单核对后才安装）：
+
+| 平台 | 二进制 | 存档哈希（v1.11.6） |
+|---|---|---|
+| Windows x64 | `windows-amd64.exe` | `e085991e…90520` |
+| macOS arm64 | `darwin-arm64` | `46fe401e…c9930` |
+| macOS x64 | `darwin-amd64` | `edd1b126…e1ec54` |
+| Linux arm64 | `linux-arm64` | `b1b139bf…b7923d` |
+| Linux x64 | `linux-amd64` | `5c6eaf79…0150d` |
+
+不支持的平台组合会明确报错并提示手动安装。
+
 ## 安装（一次性，零手工配置）
 
 ```powershell

package/lib/index.js

@@ -2,8 +2,9 @@ import z from "@deepseek-ai/schemastery";
 import { TOOL_ABORTED, defineTool } from "@deepseek-ai/dsh-tools";
 import { HarnessError } from "@deepseek-ai/dsh-llm";
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { createWriteStream, existsSync } from "node:fs";
-import { chmod, mkdir, rename } from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, rm } from "node:fs/promises";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { homedir } from "node:os";
@@ -194,22 +195,50 @@ function downloadFile(url, dest, { timeoutMs, maxRedirects = 3 } = {}) {
 
 /**
  * Download the daemon binary from the official CDN into ~/.kimi-webbridge/bin.
+ *
  * The URL layout mirrors the official installer: {CDN}/{version}/releases/kimi-webbridge-{platform}.
- * @returns { bin, url } on success.
+ * The platform is derived from the runtime hardware (see releasePlatform), so the
+ * correct binary for Windows / macOS / Linux is fetched automatically.
+ *
+ * When the release manifest (version.json) for the same version is available, the
+ * downloaded binary is verified against its published SHA-256 before being installed;
+ * a mismatch aborts the install and removes the file, so an unexpected binary can
+ * never land on disk.
+ *
+ * @returns { bin, url, sha256 } on success (sha256 is the manifest digest, or null when the manifest is unavailable).
  */
 async function installDaemonBinary({ version, timeoutMs }) {
   const platform = releasePlatform();
   if (platform === null) {
     throw new Error(`unsupported platform ${process.platform}-${process.arch} — install the daemon manually (see https://www.kimi.com/zh-cn/features/webbridge)`);
   }
+  const manifestKey = platform.endsWith(".exe") ? platform.slice(0, -4) : platform;
   const bin = daemonBinPath();
   await mkdir(dirname(bin), { recursive: true });
-  const url = `${CDN_BASE}/${encodeURIComponent(version)}/releases/kimi-webbridge-${platform}`;
+  const base = `${CDN_BASE}/${encodeURIComponent(version)}`;
+  const url = `${base}/releases/kimi-webbridge-${platform}`;
+  // Best-effort: fetch the release manifest for the expected SHA-256.
+  let expectedSha = null;
+  try {
+    const manifest = await httpJson(`${base}/version.json`, { method: "GET", timeoutMs });
+    if (manifest.status >= 200 && manifest.status < 300 && manifest.body !== null && typeof manifest.body === "object") {
+      expectedSha = manifest.body?.binaries?.[manifestKey]?.sha256 ?? null;
+    }
+  } catch {
+    // Manifest unavailable (e.g. old pinned version) — install without checksum.
+  }
   const tmp = `${bin}.tmp-${process.pid}-${Date.now()}`;
   await downloadFile(url, tmp, { timeoutMs });
+  if (expectedSha !== null) {
+    const actual = createHash("sha256").update(await readFile(tmp)).digest("hex");
+    if (actual !== expectedSha) {
+      await rm(tmp, { force: true });
+      throw new Error(`downloaded binary SHA-256 mismatch for ${platform}: expected ${expectedSha}, got ${actual}`);
+    }
+  }
   await rename(tmp, bin);
   if (process.platform !== "win32") await chmod(bin, 0o755);
-  return { bin, url };
+  return { bin, url, sha256: expectedSha };
 }
 
 /** Start the daemon detached (idempotent — no-ops when port 10086 is already bound). */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi-webbridge-dsh",
   "description": "Kimi WebBridge plugin for dsh: drive the user's real browser (their login sessions) through the local kimi-webbridge daemon at 127.0.0.1:10086. Registers a single kimi_webbridge tool covering navigate, click, fill, snapshot, screenshot, evaluate, cdp, network, upload, save_as_pdf, tab and session management.",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "license": "MIT",
   "type": "module",
   "keywords": [
@@ -34,9 +34,11 @@
     "README.md",
     "cordis.patch.yml"
   ],
+  "peerDependencies": {
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.7 <0.2.0",
+    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.7 <0.2.0"
+  },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.1",
-    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2"
+    "@deepseek-ai/schemastery": "^3.18.1"
   }
 }