watchmen-cli 1.1.4 → 1.1.7

package/install.js

@@ -5,10 +5,16 @@ const https = require("https");
 const http = require("http");
 const fs = require("fs");
 const path = require("path");
+const crypto = require("crypto");
 const { execSync } = require("child_process");
 
 const VERSION = require("./package.json").version;
+// Versioned URL first (exact-pin, immune to CDN drift on the latest alias);
+// fall back to /latest/ when the versioned path 404s (e.g. release mid-promote).
+// Either way, the binary's reported version is asserted against VERSION below.
 const DOWNLOAD_BASE = "https://releases.trywatchmen.cloud/download/community";
+const VERSIONED_URL_TMPL = (slug) => `${DOWNLOAD_BASE}/${VERSION}/${slug}`;
+const LATEST_URL_TMPL    = (slug) => `${DOWNLOAD_BASE}/${slug}`;
 
 // 60s connect timeout, 120s total — covers slow connections without hanging forever
 const CONNECT_TIMEOUT_MS = 60_000;
@@ -146,12 +152,23 @@ async function main() {
     }
   }
 
-  const url = `${DOWNLOAD_BASE}/${platformSlug}`;
+  const versionedUrl = VERSIONED_URL_TMPL(platformSlug);
+  const latestUrl    = LATEST_URL_TMPL(platformSlug);
 
   console.log(`\n  WatchmenCLI v${VERSION} — ${platformKey}`);
-  console.log(`  ${url}\n`);
 
-  const binary = await download(url);
+  let binary;
+  let sourceUrl;
+  try {
+    console.log(`  ${versionedUrl}`);
+    binary = await download(versionedUrl);
+    sourceUrl = versionedUrl;
+  } catch (err) {
+    console.log(`  (versioned URL unavailable: ${err.message.split("\n")[0]})`);
+    console.log(`  falling back to: ${latestUrl}\n`);
+    binary = await download(latestUrl);
+    sourceUrl = latestUrl;
+  }
 
   // Validate minimum binary size (real binaries are >5MB)
   if (binary.length < 1024 * 1024) {
@@ -162,6 +179,32 @@ async function main() {
     );
   }
 
+  // SHA-256 verify against the .sha256 sibling published alongside the binary.
+  // Missing sibling is a warning (older releases don't publish it), not fatal.
+  const binaryDigest = crypto.createHash("sha256").update(binary).digest("hex");
+  try {
+    const shaUrl = sourceUrl + ".sha256";
+    const shaBytes = await download(shaUrl);
+    const expectedDigest = shaBytes.toString("utf8").trim().split(/\s+/)[0].toLowerCase();
+    if (expectedDigest && /^[0-9a-f]{64}$/.test(expectedDigest)) {
+      if (expectedDigest !== binaryDigest) {
+        throw new Error(
+          `SHA-256 mismatch:\n` +
+          `  expected: ${expectedDigest}\n` +
+          `  got:      ${binaryDigest}\n` +
+          `  source:   ${sourceUrl}\n` +
+          `Install aborted. Try: npm cache clean --force && npm install -g watchmen-cli`
+        );
+      }
+      console.log(`  SHA-256 verified: ${binaryDigest.slice(0, 16)}...`);
+    } else {
+      console.warn(`  (SHA-256 file present but unparseable; continuing without verification)`);
+    }
+  } catch (err) {
+    if (err.message && err.message.startsWith("SHA-256 mismatch")) throw err;
+    console.warn(`  (SHA-256 sibling unavailable — continuing without verification: ${err.message.split("\n")[0]})`);
+  }
+
   // Write binary
   fs.mkdirSync(binDir, { recursive: true });
   fs.writeFileSync(binPath, binary);
@@ -171,11 +214,28 @@ async function main() {
     fs.chmodSync(binPath, 0o755);
   }
 
-  // Verify the binary runs
+  // The downloaded binary must report the same version as the npm package.
+  // Fail-closed on mismatch: the /latest/ fallback could otherwise serve
+  // a stale version during a mid-promote window.
   try {
-    execSync(`"${binPath}" version`, { encoding: "utf8", timeout: 10_000 });
-    console.log(`  Installed successfully: ${binPath}\n`);
+    const reported = execSync(`"${binPath}" version`, { encoding: "utf8", timeout: 10_000 });
+    const reportedMatch = reported.match(/(\d+\.\d+\.\d+)/);
+    const reportedVersion = reportedMatch ? reportedMatch[1] : null;
+    if (reportedVersion && reportedVersion !== VERSION) {
+      // Delete the bad binary so rerunning `npm install` actually retries
+      try { fs.unlinkSync(binPath); } catch {}
+      throw new Error(
+        `Downloaded binary reports version ${reportedVersion}, but npm package is ${VERSION}.\n` +
+        `  This means the release pipeline has drift between dist-tag and served binary.\n` +
+        `  Source: ${sourceUrl}\n` +
+        `  Install aborted. This is almost certainly a transient CDN cache issue —\n` +
+        `  try again in a few minutes, or: npm cache clean --force && npm install -g watchmen-cli`
+      );
+    }
+    console.log(`  Installed successfully: ${binPath}`);
+    console.log(`  Reports: ${reported.split("\n")[0]}\n`);
   } catch (err) {
+    if (err.message && err.message.includes("reports version")) throw err;
     console.warn(
       `  Warning: binary installed but verification failed.\n` +
       `  Path: ${binPath}\n` +
@@ -186,6 +246,22 @@ async function main() {
 
 main().catch((err) => {
   console.error(`\n  Failed to install wm: ${err.message}\n`);
+  // On Linux/macOS permission errors, suggest the user-local npm prefix
+  // (most users don't have sudo-npm configured).
+  if (/EACCES|EPERM|permission denied/i.test(err.message || "") && process.platform !== "win32") {
+    console.error(
+      `  Looks like a permissions problem. On Linux/macOS without sudo, npm's\n` +
+      `  global install path is root-owned. The sustainable fix is a user-local\n` +
+      `  prefix:\n` +
+      `\n` +
+      `    mkdir -p ~/.npm-global\n` +
+      `    npm config set prefix ~/.npm-global\n` +
+      `    echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.bashrc   # or ~/.zshrc\n` +
+      `    source ~/.bashrc\n` +
+      `    npm install -g watchmen-cli@${VERSION}\n` +
+      `\n`
+    );
+  }
   console.error(
     `  Troubleshooting:\n` +
     `    1. Check your internet connection\n` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmen-cli",
-  "version": "1.1.4",
+  "version": "1.1.7",
   "description": "Capture, compare, and transfer your complete development environment",
   "main": "install.js",
   "keywords": [