kimi-webbridge-dsh 1.3.2 → 1.4.1

package/README.md

@@ -2,22 +2,6 @@
 
 Kimi WebBridge 的 dsh 插件：通过本机 kimi-webbridge 守护进程（`127.0.0.1:10086`）驱动用户的真实浏览器（保留登录态与 Cookie）。注册一个模型工具 `kimi_webbridge`，覆盖导航、点击、输入、读取页面（accessibility tree + @e 引用）、截图、JS 求值、CDP、网络、上传、PDF 导出、标签页与会话管理。
 
-## 功能
-
-| 能力 | 说明 |
-|---|---|
-| 浏览真实页面 | 在用户已登录的浏览器中导航、点击、填表、滚动 |
-| 读页面 | `snapshot` 返回 accessibility tree 与 `@e` 元素引用 |
-| 截图 / 导出 PDF | 结果写入本地文件，返回路径 |
-| JS 求值 / CDP | `evaluate`（页面上下文）、`cdp`（chrome.debugger 直通） |
-| 网络 / 上传 | 请求捕获与文件上传 |
-| 会话分组 | 一个任务 = 一个 session = 一个标签页组，可一键清理 |
-
-## 依赖
-
-- **浏览器扩展**：需安装并连接 Kimi WebBridge 浏览器扩展 —— 从 [Chrome Web Store](https://chromewebstore.google.com/detail/kimi-webbridge/fldmhceldgbpfpkbgopacenieobmligc) 安装（`kimi-webbridge status` 显示 `extension_connected: true`；扩展版本应与守护进程一致）。
-- **守护进程**：无需预装。插件在守护进程不可达时会自动启动它；二进制缺失时会自动从官方 CDN（cdn.kimi.com，与官方安装器同源）下载安装——全程无需手动运行任何安装命令。
-
 ## 安装（一次性，零手工配置）
 
 ```powershell
@@ -39,6 +23,47 @@ dsh web
 - **截图返回文件路径**：用 read 工具打开查看。
 - **守护进程不可达**：工具会自动启动；二进制缺失时自动从官方 CDN 下载安装。
 
+## 依赖
+
+- **浏览器扩展**：需安装并连接 Kimi WebBridge 浏览器扩展 —— 从 [Chrome Web Store](https://chromewebstore.google.com/detail/kimi-webbridge/fldmhceldgbpfpkbgopacenieobmligc) 安装（`kimi-webbridge status` 显示 `extension_connected: true`；扩展版本应与守护进程一致）。
+- **守护进程**：无需预装。插件在守护进程不可达时会自动启动它；二进制缺失时会自动从官方 CDN（cdn.kimi.com，与官方安装器同源）下载安装——全程无需手动运行任何安装命令。
+
+### 跨平台支持
+
+插件根据运行时硬件自动选择并下载对应的守护进程二进制（含 SHA-256 校验，与官方清单核对后才安装）：
+
+| 平台 | 二进制 | 存档哈希（v1.11.6） |
+|---|---|---|
+| Windows x64 | `windows-amd64.exe` | `e085991e…90520` |
+| macOS arm64 | `darwin-arm64` | `46fe401e…c9930` |
+| macOS x64 | `darwin-amd64` | `edd1b126…e1ec54` |
+| Linux arm64 | `linux-arm64` | `b1b139bf…b7923d` |
+| Linux x64 | `linux-amd64` | `5c6eaf79…0150d` |
+
+不支持的平台组合会明确报错并提示手动安装。
+
+### 守护进程二进制位置
+
+下载到用户目录（与官方安装器路径一致，无需管理员权限；按用户隔离）：
+
+| 平台 | 最终路径 |
+|---|---|
+| Windows | `%USERPROFILE%\.kimi-webbridge\bin\kimi-webbridge.exe` |
+| macOS / Linux | `~/.kimi-webbridge/bin/kimi-webbridge`（自动 `chmod 755`） |
+
+下载流程：先落盘为临时文件（`kimi-webbridge(.exe).tmp-{pid}-{时间戳}`）→ SHA-256 与官方清单核对 → 匹配才重命名为最终路径；不匹配则删除临时文件并中止，任何未验证的二进制都不会留在磁盘。该路径与官方安装器 / `kimi-webbridge upgrade` 命令完全一致，插件、官方工具共用同一份守护进程。
+
+## 功能
+
+| 能力 | 说明 |
+|---|---|
+| 浏览真实页面 | 在用户已登录的浏览器中导航、点击、填表、滚动 |
+| 读页面 | `snapshot` 返回 accessibility tree 与 `@e` 元素引用 |
+| 截图 / 导出 PDF | 结果写入本地文件，返回路径 |
+| JS 求值 / CDP | `evaluate`（页面上下文）、`cdp`（chrome.debugger 直通） |
+| 网络 / 上传 | 请求捕获与文件上传 |
+| 会话分组 | 一个任务 = 一个 session = 一个标签页组，可一键清理 |
+
 ## 配置（可选）
 
 在 profile 的用户补丁层（`~/.dsh/profiles/web/cordis.patch.yml`）按 id 覆盖配置（替换整份 config，未给出的键取默认值）：
@@ -55,7 +80,7 @@ dsh web
 | `baseUrl` | `http://127.0.0.1:10086` | 守护进程地址 |
 | `requestTimeoutMs` | `120000` | 单次请求超时（毫秒） |
 | `autoStartDaemon` | `true` | 守护进程未运行时自动启动 |
-| `autoInstallDaemon` | `true` | 二进制缺失时自动从官方 CDN 下载安装（关闭后需手动运行 `irm https://cdn.kimi.com/webbridge/install.ps1 | iex`） |
+| `autoInstallDaemon` | `true` | 二进制缺失时自动从官方 CDN 下载安装（关闭后需手动[从官方安装](https://www.kimi.ai/products/kimi-webbridge)） |
 | `daemonVersion` | `latest` | 自动安装时的版本（可固定如 `0.3.0`） |
 
 ## 移除

package/lib/index.js

@@ -2,8 +2,9 @@ import z from "@deepseek-ai/schemastery";
 import { TOOL_ABORTED, defineTool } from "@deepseek-ai/dsh-tools";
 import { HarnessError } from "@deepseek-ai/dsh-llm";
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { createWriteStream, existsSync } from "node:fs";
-import { chmod, mkdir, rename } from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, rm } from "node:fs/promises";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { homedir } from "node:os";
@@ -90,6 +91,19 @@ function releasePlatform() {
   return null;
 }
 
+/**
+ * Platform-aware manual-install hint shown when auto-install is disabled or fails.
+ * Windows users get the PowerShell one-liner; macOS/Linux users get the bash one-liner.
+ * @returns a short human-readable install instruction.
+ */
+function manualInstallHint() {
+  const page = "https://www.kimi.ai/products/kimi-webbridge";
+  if (process.platform === "win32") {
+    return `run \"irm https://cdn.kimi.com/webbridge/install.ps1 | iex\" in PowerShell (or install from ${page})`;
+  }
+  return `run \"curl -fsSL https://cdn.kimi.com/webbridge/install.sh | bash\" (or install from ${page})`;
+}
+
 /**
  * One HTTP JSON round-trip with a timeout and caller-abort support.
  * @param url - absolute URL.
@@ -194,22 +208,50 @@ function downloadFile(url, dest, { timeoutMs, maxRedirects = 3 } = {}) {
 
 /**
  * Download the daemon binary from the official CDN into ~/.kimi-webbridge/bin.
+ *
  * The URL layout mirrors the official installer: {CDN}/{version}/releases/kimi-webbridge-{platform}.
- * @returns { bin, url } on success.
+ * The platform is derived from the runtime hardware (see releasePlatform), so the
+ * correct binary for Windows / macOS / Linux is fetched automatically.
+ *
+ * When the release manifest (version.json) for the same version is available, the
+ * downloaded binary is verified against its published SHA-256 before being installed;
+ * a mismatch aborts the install and removes the file, so an unexpected binary can
+ * never land on disk.
+ *
+ * @returns { bin, url, sha256 } on success (sha256 is the manifest digest, or null when the manifest is unavailable).
  */
 async function installDaemonBinary({ version, timeoutMs }) {
   const platform = releasePlatform();
   if (platform === null) {
     throw new Error(`unsupported platform ${process.platform}-${process.arch} — install the daemon manually (see https://www.kimi.com/zh-cn/features/webbridge)`);
   }
+  const manifestKey = platform.endsWith(".exe") ? platform.slice(0, -4) : platform;
   const bin = daemonBinPath();
   await mkdir(dirname(bin), { recursive: true });
-  const url = `${CDN_BASE}/${encodeURIComponent(version)}/releases/kimi-webbridge-${platform}`;
+  const base = `${CDN_BASE}/${encodeURIComponent(version)}`;
+  const url = `${base}/releases/kimi-webbridge-${platform}`;
+  // Best-effort: fetch the release manifest for the expected SHA-256.
+  let expectedSha = null;
+  try {
+    const manifest = await httpJson(`${base}/version.json`, { method: "GET", timeoutMs });
+    if (manifest.status >= 200 && manifest.status < 300 && manifest.body !== null && typeof manifest.body === "object") {
+      expectedSha = manifest.body?.binaries?.[manifestKey]?.sha256 ?? null;
+    }
+  } catch {
+    // Manifest unavailable (e.g. old pinned version) — install without checksum.
+  }
   const tmp = `${bin}.tmp-${process.pid}-${Date.now()}`;
   await downloadFile(url, tmp, { timeoutMs });
+  if (expectedSha !== null) {
+    const actual = createHash("sha256").update(await readFile(tmp)).digest("hex");
+    if (actual !== expectedSha) {
+      await rm(tmp, { force: true });
+      throw new Error(`downloaded binary SHA-256 mismatch for ${platform}: expected ${expectedSha}, got ${actual}`);
+    }
+  }
   await rename(tmp, bin);
   if (process.platform !== "win32") await chmod(bin, 0o755);
-  return { bin, url };
+  return { bin, url, sha256: expectedSha };
 }
 
 /** Start the daemon detached (idempotent — no-ops when port 10086 is already bound). */
@@ -326,13 +368,13 @@ function apply(ctx, config = {}) {
         const notes = [];
         if (!existsSync(daemonBinPath())) {
           if (!autoInstallDaemon) {
-            throw new Error(`kimi-webbridge: daemon binary not found at ${daemonBinPath()} and autoInstallDaemon is disabled. Install it with: irm https://cdn.kimi.com/webbridge/install.ps1 | iex`);
+            throw new Error(`kimi-webbridge: daemon binary not found at ${daemonBinPath()} and autoInstallDaemon is disabled. Install it manually: ${manualInstallHint()}`);
           }
           try {
             const { url } = await installDaemonBinary({ version: daemonVersion, timeoutMs: requestTimeoutMs });
             notes.push(`installed daemon from ${url}`);
           } catch (installError) {
-            throw new Error(`kimi-webbridge: daemon binary missing and auto-install failed: ${installError?.message ?? installError}. Install it manually: irm https://cdn.kimi.com/webbridge/install.ps1 | iex`);
+            throw new Error(`kimi-webbridge: daemon binary missing and auto-install failed: ${installError?.message ?? installError}. Install it manually: ${manualInstallHint()}`);
           }
         }
         if (autoStartDaemon) {
@@ -341,7 +383,7 @@ function apply(ctx, config = {}) {
             result = await attempt();
           } catch (retryError) {
             const hint = notes.length > 0 ? " " + notes.join("; ") + "." : "";
-            throw new Error(`kimi-webbridge: daemon at ${baseUrl} still unreachable after starting it.${hint} Check ~/.kimi-webbridge/logs/daemon.log or reinstall: irm https://cdn.kimi.com/webbridge/install.ps1 | iex`);
+            throw new Error(`kimi-webbridge: daemon at ${baseUrl} still unreachable after starting it.${hint} Check ~/.kimi-webbridge/logs/daemon.log, or reinstall: ${manualInstallHint()}`);
           }
         } else {
           throw new Error(`kimi-webbridge: daemon at ${baseUrl} is not running and autoStartDaemon is disabled. Start it with: ${daemonBinPath()} start`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi-webbridge-dsh",
   "description": "Kimi WebBridge plugin for dsh: drive the user's real browser (their login sessions) through the local kimi-webbridge daemon at 127.0.0.1:10086. Registers a single kimi_webbridge tool covering navigate, click, fill, snapshot, screenshot, evaluate, cdp, network, upload, save_as_pdf, tab and session management.",
-  "version": "1.3.2",
+  "version": "1.4.1",
   "license": "MIT",
   "type": "module",
   "keywords": [