rauta-ai 0.5.0 → 0.5.102

package/bin/rauta-ai.js

@@ -266,10 +266,20 @@ async function fetchArtifact(url) {
  * Look for `<artifact>.sha256` beside the binary. Returns the hex digest, or
  * null when none is published.
  *
- * Degrading to null rather than failing is deliberate and temporary: no
- * `.sha256` file is published today (scripts/build-cli.sh does not emit one),
- * so hard-failing here would break every install the moment this ships. Once
- * the build publishes checksums, absence becomes worth escalating.
+ * scripts/build-cli.sh now emits one beside every artifact it publishes,
+ * including the back-compat version directories, so on a current deploy this
+ * returns a digest and the caller verifies for real.
+ *
+ * Degrading to null rather than failing is still deliberate, for one release
+ * more. A shim published BEFORE the build emitted checksums is pinned to its
+ * own /cli/<version>/ directory, and hard-failing here would break those
+ * installs on the one path they cannot update from. Once no live shim predates
+ * the change, absence becomes worth escalating to a refusal.
+ *
+ * That escalation matters more than it sounds: an unverified download is how a
+ * 2048-byte file full of 'B' came to be installed as the binary on the
+ * maintainer's own machine (found 2026-08-12), where it had been silently
+ * failing every session-start hook with nothing anywhere reporting it.
  */
 async function publishedChecksum(url) {
   let res;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rauta-ai",
-  "version": "0.5.0",
+  "version": "0.5.102",
   "description": "CLI for Rauta (rauta.ai) \u2014 GPU infrastructure, compared in public. Canonical install: `npx rauta-ai`. Interim package name while unscoped `rauta` awaits npm similarity clearance. Sign up, connect provider keys (BYOK), buy prepaid credits, provision GPUs, and track AI spend from your terminal.",
   "bin": {
     "rauta-ai": "bin/rauta-ai.js",