tachograph 0.1.1 → 0.2.0

package/asset.js

@@ -23,10 +23,29 @@ function assetFor(platform, arch) {
   };
 }
 
+// tagFor normalizes a package version to its release tag (v-prefixed).
+function tagFor(version) {
+  return version.startsWith("v") ? version : `v${version}`;
+}
+
 // downloadURL builds the GitHub release download URL for a version + asset.
 function downloadURL(version, asset) {
-  const tag = version.startsWith("v") ? version : `v${version}`;
-  return `https://github.com/kosako/tachograph/releases/download/${tag}/${asset}`;
+  return `https://github.com/kosako/tachograph/releases/download/${tagFor(version)}/${asset}`;
+}
+
+// checksumsURL is the GoReleaser checksums.txt for the matching release.
+function checksumsURL(version) {
+  return `https://github.com/kosako/tachograph/releases/download/${tagFor(version)}/checksums.txt`;
+}
+
+// checksumFor parses GoReleaser's "<sha256>  <filename>" lines and returns the
+// hex digest for asset, or null when it isn't listed.
+function checksumFor(text, asset) {
+  for (const line of text.split("\n")) {
+    const [hash, name] = line.trim().split(/\s+/);
+    if (name === asset && hash) return hash;
+  }
+  return null;
 }
 
-module.exports = { assetFor, downloadURL, PLATFORMS, ARCHES };
+module.exports = { assetFor, downloadURL, checksumsURL, checksumFor, PLATFORMS, ARCHES };

package/install.js

@@ -9,8 +9,9 @@
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
+const crypto = require("crypto");
 const { execFileSync } = require("child_process");
-const { assetFor, downloadURL } = require("./asset");
+const { assetFor, downloadURL, checksumsURL, checksumFor } = require("./asset");
 
 const { version } = require("./package.json");
 const binDir = path.join(__dirname, "bin");
@@ -25,6 +26,22 @@ async function main() {
   }
   const buf = Buffer.from(await res.arrayBuffer());
 
+  // Verify the archive against GoReleaser's published checksums.txt before
+  // extracting and running it, so a corrupted/tampered/partial download is
+  // caught rather than executed.
+  const sums = await fetch(checksumsURL(version), { redirect: "follow" });
+  if (!sums.ok) {
+    throw new Error(`checksums download failed: ${sums.status} ${sums.statusText}`);
+  }
+  const want = checksumFor(await sums.text(), asset);
+  if (!want) {
+    throw new Error(`no checksum listed for ${asset}`);
+  }
+  const got = crypto.createHash("sha256").update(buf).digest("hex");
+  if (got !== want) {
+    throw new Error(`checksum mismatch for ${asset}: expected ${want}, got ${got}`);
+  }
+
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "tacho-"));
   const archive = path.join(tmp, asset);
   fs.writeFileSync(archive, buf);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tachograph",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "A compact instrument cluster for your coding agents (Claude Code / Codex). Shows model, rate-limit usage, and context at a glance.",
   "keywords": [
     "claude-code",