whitemagic-mcp 9.1.6 → 9.1.7

package/bin/cli.mjs

@@ -1,80 +1,32 @@
 #!/usr/bin/env node
 /**
  * whitemagic-mcp — installs and runs the `wm` binary from the GitHub
- * releases, with checksum verification. `npx whitemagic-mcp serve` is
- * the MCP entrypoint. No dependencies; Node 18+ global fetch.
+ * releases, with checksum verification and a self-verifying cache.
+ * `npx whitemagic-mcp serve` is the MCP entrypoint. No dependencies;
+ * Node 18+ global fetch.
  *
  * Version contract: package version tracks the release tag (9.1.4 -> v9.1.4).
  * Override the tag with WHITEMAGIC_RELEASE (e.g. "v9").
+ *
+ * All install failures (network, checksum, cache, unsupported platform)
+ * terminate with a one-line human message — never a raw Node stack
+ * (2026-09-15 audit).
  */
-import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { homedir, platform, arch, tmpdir } from "node:os";
-import { join } from "node:path";
+import { readFileSync } from "node:fs";
+import { platform } from "node:os";
 import { spawnSync } from "node:child_process";
+import { ensureBinary } from "./lib.mjs";
 
 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
-const TAG = process.env.WHITEMAGIC_RELEASE ?? `v${pkg.version}`;
-const REPO = "lbailey94/whitemagic";
-const BASE = `https://github.com/${REPO}/releases/download/${TAG}`;
-
-function assetFor() {
-  const p = platform(), a = arch();
-  if (p === "linux" && a === "x64") return "wm-linux-x86_64-musl";
-  if (p === "darwin" && a === "arm64") return "wm-macos-aarch64";
-  if (p === "darwin" && a === "x64") return "wm-macos-x86_64";
-  if (p === "win32" && a === "x64") return "wm-windows-x86_64.exe";
-  return null;
-}
-
-async function fetchTo(url, dest) {
-  const res = await fetch(url, { redirect: "follow" });
-  if (!res.ok) throw new Error(`HTTP ${res.status} for ${url}`);
-  writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
-}
-
-async function ensureBinary() {
-  const asset = assetFor();
-  if (!asset) {
-    console.error(`whitemagic-mcp: no release asset for ${platform()}/${arch()} yet.`);
-    console.error(`Install from source instead: https://github.com/${REPO}#install`);
-    process.exit(1);
-  }
-  const cached = join(
-    process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache"),
-    "whitemagic",
-    "bin",
-    TAG,
-    asset,
-  );
-  if (existsSync(cached)) return cached;
 
-  console.error(`whitemagic-mcp: fetching ${TAG}/${asset} ...`);
-  const binDir = join(
-    process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache"),
-    "whitemagic",
-    "bin",
-    TAG,
-  );
-  mkdirSync(binDir, { recursive: true });
-  const tmp = mkdtempSync(join(tmpdir(), "wm-dl-"));
-  try {
-    await fetchTo(`${BASE}/${asset}`, join(tmp, asset));
-    await fetchTo(`${BASE}/${asset}.sha256`, join(tmp, `${asset}.sha256`));
-    const expected = readFileSync(join(tmp, `${asset}.sha256`), "utf8").trim().split(/\s+/)[0];
-    const actual = createHash("sha256").update(readFileSync(join(tmp, asset))).digest("hex");
-    if (expected !== actual) {
-      throw new Error(`checksum mismatch for ${asset}\n  expected ${expected}\n  actual   ${actual}`);
-    }
-    writeFileSync(cached, readFileSync(join(tmp, asset)));
-    chmodSync(cached, 0o755);
-    return cached;
-  } finally {
-    rmSync(tmp, { recursive: true, force: true });
-  }
+let bin;
+try {
+  bin = await ensureBinary({ pkgVersion: pkg.version });
+} catch (err) {
+  console.error(`whitemagic-mcp: ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
 }
 
-const bin = await ensureBinary();
 const isWin = platform() === "win32";
 const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit", shell: isWin });
 process.exit(result.status ?? 1);

package/bin/lib.mjs

@@ -0,0 +1,155 @@
+/**
+ * whitemagic-mcp launcher library — release-asset resolution, atomic
+ * download + checksum verification, and self-healing binary cache.
+ *
+ * Extracted from bin/cli.mjs so the install path is unit-testable
+ * (2026-09-15 audit: raw stacks on network/checksum failures; cached
+ * binaries were trusted without re-hashing; downloads were written
+ * in place instead of atomically).
+ */
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir, platform, arch, tmpdir } from "node:os";
+import { join } from "node:path";
+
+export const REPO = "lbailey94/whitemagic";
+const SHA256_RE = /^[0-9a-f]{64}$/i;
+
+export function releaseTag(pkgVersion, env = process.env) {
+  return env.WHITEMAGIC_RELEASE ?? `v${pkgVersion}`;
+}
+
+export function assetFor(p = platform(), a = arch()) {
+  if (p === "linux" && a === "x64") return "wm-linux-x86_64-musl";
+  if (p === "darwin" && a === "arm64") return "wm-macos-aarch64";
+  if (p === "darwin" && a === "x64") return "wm-macos-x86_64";
+  if (p === "win32" && a === "x64") return "wm-windows-x86_64.exe";
+  return null;
+}
+
+export function defaultCacheRoot(env = process.env) {
+  return env.XDG_CACHE_HOME ?? join(homedir(), ".cache");
+}
+
+export function cachedBinaryPath(asset, tag, cacheRoot = defaultCacheRoot()) {
+  return join(cacheRoot, "whitemagic", "bin", tag, asset);
+}
+
+function sidecarFor(cached) {
+  return `${cached}.sha256`;
+}
+
+export function digestFile(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+/**
+ * A cache entry counts only when the binary re-hashes to the digest the
+ * launcher recorded when it verified the download. A truncated or tampered
+ * cache thus FAILS verification and is re-acquired instead of being
+ * executed blindly.
+ */
+export function cacheIsValid(cached) {
+  const sidecar = sidecarFor(cached);
+  if (!existsSync(cached) || !existsSync(sidecar)) return false;
+  let expected;
+  try {
+    expected = readFileSync(sidecar, "utf8").trim();
+  } catch {
+    return false;
+  }
+  if (!SHA256_RE.test(expected)) return false;
+  try {
+    return digestFile(cached) === expected;
+  } catch {
+    return false;
+  }
+}
+
+export async function fetchTo(url, dest, fetchImpl) {
+  let res;
+  try {
+    res = await fetchImpl(url, { redirect: "follow" });
+  } catch (err) {
+    const cause = err?.cause?.code ?? err?.code ?? err?.message ?? "unknown";
+    throw new Error(
+      `network error fetching ${url} (${cause}) — check your connection, or pin a release with WHITEMAGIC_RELEASE`,
+    );
+  }
+  if (!res.ok) {
+    throw new Error(
+      `HTTP ${res.status} fetching ${url} — that release asset may be missing; check https://github.com/${REPO}/releases`,
+    );
+  }
+  writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
+}
+
+/**
+ * Ensure a verified `wm` binary for this platform exists in the cache and
+ * return its path. Fresh downloads go temp -> checksum -> chmod -> rename;
+ * a cache entry that fails re-verification is replaced (self-healing).
+ */
+export async function ensureBinary({
+  fetchImpl = fetch,
+  cacheRoot = defaultCacheRoot(),
+  tag,
+  pkgVersion,
+  p = platform(),
+  a = arch(),
+  log = console.error,
+} = {}) {
+  const resolvedTag = tag ?? releaseTag(pkgVersion);
+  const asset = assetFor(p, a);
+  if (!asset) {
+    throw new Error(
+      `no release asset for ${p}/${a} yet — install from source: https://github.com/${REPO}#install`,
+    );
+  }
+  const cached = cachedBinaryPath(asset, resolvedTag, cacheRoot);
+  if (cacheIsValid(cached)) return cached;
+  if (existsSync(cached)) {
+    log("whitemagic-mcp: cached binary failed verification — re-downloading.");
+  }
+
+  log(`whitemagic-mcp: fetching ${resolvedTag}/${asset} ...`);
+  const binDir = join(cacheRoot, "whitemagic", "bin", resolvedTag);
+  mkdirSync(binDir, { recursive: true });
+  // Stage INSIDE the cache dir so the final rename is atomic (a /tmp staging
+  // dir can live on another filesystem, where rename fails with EXDEV).
+  const tmp = mkdtempSync(join(binDir, ".download-"));
+  try {
+    const tmpBin = join(tmp, asset);
+    const tmpSha = join(tmp, `${asset}.sha256`);
+    await fetchTo(`${BASE_URL(resolvedTag)}/${asset}`, tmpBin, fetchImpl);
+    await fetchTo(`${BASE_URL(resolvedTag)}/${asset}.sha256`, tmpSha, fetchImpl);
+    const expected = (readFileSync(tmpSha, "utf8").trim().split(/\s+/)[0] ?? "").toLowerCase();
+    if (!SHA256_RE.test(expected)) {
+      throw new Error(`release checksum for ${asset} is malformed — refusing to install it`);
+    }
+    const actual = digestFile(tmpBin);
+    if (actual !== expected) {
+      throw new Error(
+        `checksum mismatch for ${asset} (expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…) — the download may be corrupted; retry`,
+      );
+    }
+    chmodSync(tmpBin, 0o755);
+    renameSync(tmpBin, cached);
+    writeFileSync(sidecarFor(cached), `${expected}\n`);
+    return cached;
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+export function BASE_URL(tag) {
+  return `https://github.com/${REPO}/releases/download/${tag}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whitemagic-mcp",
-  "version": "9.1.6",
+  "version": "9.1.7",
   "description": "WhiteMagic MCP server \u2014 local-first memory and session continuity for AI coding agents. Installs and runs the wm binary; no telemetry by default, no cloud.",
   "license": "MIT",
   "bin": {
@@ -30,5 +30,8 @@
   },
   "homepage": "https://whitemagic.dev",
   "bugs": "https://github.com/lbailey94/whitemagic/issues",
-  "mcpName": "io.github.lbailey94/whitemagic-mcp"
+  "mcpName": "io.github.lbailey94/whitemagic-mcp",
+  "scripts": {
+    "test": "node --test"
+  }
 }