semantiq-mcp 0.8.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semantiq-mcp",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Semantic code understanding for AI tools - One MCP Server for all AI coding assistants",
   "bin": {
     "semantiq": "bin/semantiq"

package/scripts/install.js

@@ -3,6 +3,7 @@
 const https = require('https');
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { execSync } = require('child_process');
 
 const VERSION = require('../package.json').version;
@@ -36,6 +37,11 @@ function downloadFile(url, dest) {
   return new Promise((resolve, reject) => {
     const file = fs.createWriteStream(dest);
 
+    const cleanup = () => {
+      file.close();
+      fs.unlink(dest, () => {});
+    };
+
     const request = (url) => {
       https.get(url, (response) => {
         if (response.statusCode === 302 || response.statusCode === 301) {
@@ -44,6 +50,7 @@ function downloadFile(url, dest) {
         }
 
         if (response.statusCode !== 200) {
+          cleanup();
           reject(new Error(`Failed to download: ${response.statusCode}`));
           return;
         }
@@ -53,6 +60,43 @@ function downloadFile(url, dest) {
           file.close();
           resolve();
         });
+        response.on('error', (err) => {
+          cleanup();
+          reject(err);
+        });
+      }).on('error', (err) => {
+        cleanup();
+        reject(err);
+      });
+    };
+
+    request(url);
+  });
+}
+
+// Download a small text resource (the .sha256 file) directly into memory,
+// following redirects. Rejects on any non-200 final status.
+function downloadText(url) {
+  return new Promise((resolve, reject) => {
+    const request = (url) => {
+      https.get(url, (response) => {
+        if (response.statusCode === 302 || response.statusCode === 301) {
+          request(response.headers.location);
+          return;
+        }
+
+        if (response.statusCode !== 200) {
+          reject(new Error(`Failed to download checksum: ${response.statusCode}`));
+          return;
+        }
+
+        let data = '';
+        response.setEncoding('utf8');
+        response.on('data', (chunk) => {
+          data += chunk;
+        });
+        response.on('end', () => resolve(data));
+        response.on('error', reject);
       }).on('error', reject);
     };
 
@@ -60,22 +104,74 @@ function downloadFile(url, dest) {
   });
 }
 
+function sha256File(filePath) {
+  const hash = crypto.createHash('sha256');
+  hash.update(fs.readFileSync(filePath));
+  return hash.digest('hex');
+}
+
+// The published .sha256 may be either a bare hex digest or the standard
+// `sha256sum` format: "<hex>  <filename>". Extract the leading hex token.
+function parseExpectedSha256(raw, archiveName) {
+  const tokens = raw.trim().split(/\s+/);
+  const hex = (tokens[0] || '').toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(hex)) {
+    throw new Error(`Malformed checksum file for ${archiveName}`);
+  }
+  return hex;
+}
+
 async function install() {
   const { target, isWindows } = getPlatform();
   const binName = isWindows ? 'semantiq.exe' : 'semantiq';
   const archiveName = `semantiq-v${VERSION}-${target}.tar.gz`;
   const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
+  const checksumUrl = `${url}.sha256`;
 
   const binDir = path.join(__dirname, '..', 'bin');
   const binPath = path.join(binDir, binName);
   const archivePath = path.join(binDir, archiveName);
 
+  // Best-effort removal of partial/untrusted artifacts.
+  const removeArtifacts = () => {
+    for (const p of [archivePath, binPath]) {
+      try {
+        if (fs.existsSync(p)) fs.unlinkSync(p);
+      } catch (_) {
+        // ignore
+      }
+    }
+  };
+
   console.log(`Downloading Semantiq v${VERSION} for ${target}...`);
 
   try {
     await downloadFile(url, archivePath);
 
-    // Extract
+    // Integrity verification: never extract/execute an unverified binary.
+    // The release CI publishes "<archive>.sha256" next to each artifact.
+    let expectedSha;
+    try {
+      const checksumRaw = await downloadText(checksumUrl);
+      expectedSha = parseExpectedSha256(checksumRaw, archiveName);
+    } catch (err) {
+      removeArtifacts();
+      throw new Error(
+        `Could not verify integrity (missing or unreadable ${archiveName}.sha256): ${err.message}`
+      );
+    }
+
+    const actualSha = sha256File(archivePath);
+    if (actualSha !== expectedSha) {
+      removeArtifacts();
+      throw new Error(
+        `Checksum mismatch for ${archiveName}\n  expected: ${expectedSha}\n  actual:   ${actualSha}`
+      );
+    }
+
+    console.log('Checksum verified.');
+
+    // Extract (verified archive only)
     if (isWindows) {
       execSync(`tar -xzf "${archivePath}" -C "${binDir}"`, { stdio: 'inherit' });
     } else {
@@ -88,6 +184,7 @@ async function install() {
 
     console.log('Semantiq installed successfully!');
   } catch (error) {
+    removeArtifacts();
     console.error('Failed to install Semantiq:', error.message);
     console.error('');
     console.error('Alternative installation methods:');