openclaw-weiyuan-init 1.0.79 → 1.0.80

package/lib/commands.js

@@ -342,7 +342,7 @@ async function runInit(options) {
 
     spinner = ora('下载 weiyuan skill...').start();
     const zipPath = path.join(weiyuanPath, source.zipFilename);
-    const downloadSuccess = await downloadFile(source.downloadUrl, zipPath, spinner);
+    const downloadSuccess = await downloadFile(source.downloadUrl, zipPath, spinner, source.sha256 || '');
     if (!downloadSuccess) {
       spinner.fail('下载失败');
       throw new Error('下载失败');

package/lib/downloader.js

@@ -1,73 +1,104 @@
-const axios = require('axios');
-const fs = require('fs-extra');
-
-function trimSlash(url) {
-  return String(url || '').replace(/\/+$/, '');
-}
-
-function toZipFilename(downloadUrl) {
-  const clean = String(downloadUrl || '').split('?')[0].split('#')[0];
-  const parts = clean.split('/');
-  return parts[parts.length - 1] || 'weiyuan-openclaw-skill.zip';
-}
-
-async function resolvePackageSource({ downloadUrl, upgradeBaseUrl, spinner = null }) {
-  if (downloadUrl) {
-    return { downloadUrl, zipFilename: toZipFilename(downloadUrl), version: null, from: 'download_url' };
-  }
-
-  const base = trimSlash(upgradeBaseUrl);
-  const latestUrl = `${base}/LATEST_SKILL_VERSION.txt`;
-  const latestResp = await axios.get(latestUrl, { timeout: 10000 });
-  const version = String(latestResp.data || '').trim();
-  if (!version) {
-    throw new Error('empty_latest_version');
-  }
-  const zipFilename = `weiyuan-openclaw-skill-v${version}.zip`;
-  const resolvedDownloadUrl = `${base}/${zipFilename}`;
-  if (spinner) {
-    spinner.text = `已解析最新版本: v${version}`;
-  }
-  return { downloadUrl: resolvedDownloadUrl, zipFilename, version, from: 'latest_version' };
-}
-
-async function downloadFile(url, outputPath, spinner = null) {
-  try {
-    const response = await axios({
-      method: 'GET',
-      url: url,
-      responseType: 'stream',
-      timeout: 60000,
-      maxContentLength: Infinity,
-      maxBodyLength: Infinity
-    });
-
-    const totalLength = parseInt(response.headers['content-length'], 10);
-    let downloadedLength = 0;
-
-    const writer = fs.createWriteStream(outputPath);
-
-    response.data.on('data', (chunk) => {
-      downloadedLength += chunk.length;
-      if (spinner && totalLength) {
-        const percent = (downloadedLength / totalLength * 100).toFixed(1);
-        spinner.text = `下载中... ${percent}% (${(downloadedLength / 1024 / 1024).toFixed(1)}MB / ${(totalLength / 1024 / 1024).toFixed(1)}MB)`;
-      }
-    });
-
-    response.data.pipe(writer);
-
-    return new Promise((resolve, reject) => {
-      writer.on('finish', () => resolve(true));
-      writer.on('error', reject);
-      response.data.on('error', reject);
-    });
-  } catch (error) {
-    if (spinner) {
-      spinner.text = `下载失败: ${error.message}`;
-    }
-    return false;
-  }
-}
-
-module.exports = { downloadFile, resolvePackageSource };
+const axios = require('axios');
+const fs = require('fs-extra');
+const crypto = require('crypto');
+
+function trimSlash(url) {
+  return String(url || '').replace(/\/+$/, '');
+}
+
+function toZipFilename(downloadUrl) {
+  const clean = String(downloadUrl || '').split('?')[0].split('#')[0];
+  const parts = clean.split('/');
+  return parts[parts.length - 1] || 'weiyuan-openclaw-skill.zip';
+}
+
+async function resolvePackageSource({ downloadUrl, upgradeBaseUrl, spinner = null }) {
+  if (downloadUrl) {
+    return { downloadUrl, zipFilename: toZipFilename(downloadUrl), version: null, sha256: '', from: 'download_url' };
+  }
+
+  const base = trimSlash(upgradeBaseUrl);
+  const nonce = Date.now();
+  try {
+    const latestMetaUrl = `${base}/SKILL_LATEST.json?nocache=${nonce}`;
+    const latestMetaResp = await axios.get(latestMetaUrl, { timeout: 10000 });
+    const meta = latestMetaResp.data || {};
+    const version = String(meta.version || '').trim();
+    if (version) {
+      const zipFilename = String(meta.zipName || '').trim() || `weiyuan-openclaw-skill-v${version}.zip`;
+      const resolvedDownloadUrl = `${base}/${zipFilename}?nocache=${nonce}`;
+      const sha256 = String(meta.sha256 || '').trim().toLowerCase();
+      if (spinner) {
+        spinner.text = `已解析最新版本: v${version}`;
+      }
+      return { downloadUrl: resolvedDownloadUrl, zipFilename, version, sha256, from: 'latest_json' };
+    }
+  } catch (_e) {
+    // fallback to txt
+  }
+  const latestUrl = `${base}/LATEST_SKILL_VERSION.txt?nocache=${nonce}`;
+  const latestResp = await axios.get(latestUrl, { timeout: 10000 });
+  const version = String(latestResp.data || '').trim();
+  if (!version) throw new Error('empty_latest_version');
+  const zipFilename = `weiyuan-openclaw-skill-v${version}.zip`;
+  const resolvedDownloadUrl = `${base}/${zipFilename}?nocache=${nonce}`;
+  if (spinner) {
+    spinner.text = `已解析最新版本: v${version}`;
+  }
+  return { downloadUrl: resolvedDownloadUrl, zipFilename, version, sha256: '', from: 'latest_version' };
+}
+
+async function downloadFile(url, outputPath, spinner = null, expectedSha256 = '') {
+  try {
+    const response = await axios({
+      method: 'GET',
+      url: url,
+      responseType: 'stream',
+      timeout: 60000,
+      maxContentLength: Infinity,
+      maxBodyLength: Infinity
+    });
+
+    const totalLength = parseInt(response.headers['content-length'], 10);
+    let downloadedLength = 0;
+
+    const writer = fs.createWriteStream(outputPath);
+
+    response.data.on('data', (chunk) => {
+      downloadedLength += chunk.length;
+      if (spinner && totalLength) {
+        const percent = (downloadedLength / totalLength * 100).toFixed(1);
+        spinner.text = `下载中... ${percent}% (${(downloadedLength / 1024 / 1024).toFixed(1)}MB / ${(totalLength / 1024 / 1024).toFixed(1)}MB)`;
+      }
+    });
+
+    response.data.pipe(writer);
+
+    return new Promise((resolve, reject) => {
+      writer.on('finish', async () => {
+        try {
+          if (expectedSha256) {
+            const fileBuffer = await fs.readFile(outputPath);
+            const actualSha256 = crypto.createHash('sha256').update(fileBuffer).digest('hex').toLowerCase();
+            const expected = String(expectedSha256).toLowerCase();
+            if (actualSha256 !== expected) {
+              return reject(new Error(`skill_package_hash_mismatch expected=${expected} got=${actualSha256}`));
+            }
+          }
+          resolve(true);
+        } catch (hashErr) {
+          reject(hashErr);
+        }
+      });
+      writer.on('error', reject);
+      response.data.on('error', reject);
+    });
+  } catch (error) {
+    if (spinner) {
+      spinner.text = `下载失败: ${error.message}`;
+    }
+    return false;
+  }
+}
+
+module.exports = { downloadFile, resolvePackageSource };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-weiyuan-init",
-  "version": "1.0.79",
+  "version": "1.0.80",
   "description": "OpenClaw Weiyuan Skill 一键初始化工具",
   "main": "bin/cli.js",
   "bin": {