xkat-cli 1.1.6 → 1.1.7

package/README.md

@@ -55,6 +55,10 @@ xKat Agent includes the following safeguards:
    domains are accepted.
 3. **Audit log**: Every connection attempt and file-change event is recorded
    locally with a timestamp.
+4. **Binary Integrity Check**: During installation, the postinstall script downloads
+   the platform-specific prebuilt Rust binary over HTTPS and cryptographically
+   verifies its hash (SHA-256) against a build-time checksum manifest to prevent
+   MITM, tampering, or supply chain injection.
 
 ## Releasing (maintainers)
 

package/bin/checksums.json

@@ -0,0 +1,7 @@
+{
+  "xkat-agent-macos-aarch64": "1b34b5fa60c2097d034f5ae45ca5dcb67bfc1ad9ee67c4b84dd2be0c33debb0e",
+  "xkat-agent-macos-x64": "ffe1da9a5fe4c04976c9cbd527795d17647b6c7cc6597f5dd72bd23931301b6b",
+  "xkat-agent-linux-x64": "0963c85e9e92e36d157c69f7bd1a51285743ec3a41be71908f543b064e697e93",
+  "xkat-agent-linux-aarch64": "30e2c06adb61ad5e1e0ef77584a72a525201222e68049d2568084340c5f7bbc1",
+  "xkat-agent-win-x64.exe": "ec9a5b4c0b08db139fd7861df7de900b94d5f41577621780e99b8ce4ea40e9d3"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xkat-cli",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "description": "xKat Agent - an AI agent that securely connects your browser to your machine",
   "main": "bin/xkat-cli.js",
   "bin": {

package/scripts/generate-checksums.js

@@ -0,0 +1,42 @@
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+// The artifacts directory is created by actions/download-artifact at the repository root
+const artifactsDir = path.resolve(__dirname, '../../..', 'artifacts');
+const destFile = path.resolve(__dirname, '..', 'bin', 'checksums.json');
+
+const targets = [
+  'xkat-agent-macos-aarch64',
+  'xkat-agent-macos-x64',
+  'xkat-agent-linux-x64',
+  'xkat-agent-linux-aarch64',
+  'xkat-agent-win-x64.exe',
+];
+
+const checksums = {};
+
+console.log(`🔍 Scanning for artifacts in: ${artifactsDir}`);
+
+for (const target of targets) {
+  // In upload-r2/download-artifact, each artifact is downloaded into its own folder:
+  // artifacts/<artifact-name>/<artifact-name>
+  const filePath = path.join(artifactsDir, target, target);
+  if (!fs.existsSync(filePath)) {
+    console.error(`❌ Missing artifact for target ${target} at ${filePath}`);
+    process.exit(1);
+  }
+  const fileBuffer = fs.readFileSync(filePath);
+  const hash = crypto.createHash('sha256').update(fileBuffer).digest('hex');
+  checksums[target] = hash;
+  console.log(`✅ Calculated hash for ${target}: ${hash}`);
+}
+
+// Make sure the destination directory exists
+const destDir = path.dirname(destFile);
+if (!fs.existsSync(destDir)) {
+  fs.mkdirSync(destDir, { recursive: true });
+}
+
+fs.writeFileSync(destFile, JSON.stringify(checksums, null, 2));
+console.log(`✅ Generated checksums manifest: ${destFile}`);

package/scripts/install.js

@@ -7,6 +7,7 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const https = require('https');
+const crypto = require('crypto');
 
 // Version is the single source of truth from package.json, so a release bump
 // (npm version patch) automatically points install at the matching R2 folder.
@@ -28,6 +29,16 @@ function getPlatformTarget() {
   return map[`${platform}-${arch}`] || null;
 }
 
+function calculateSha256(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('data', (data) => hash.update(data));
+    stream.on('end', () => resolve(hash.digest('hex')));
+    stream.on('error', (err) => reject(err));
+  });
+}
+
 async function main() {
   const target = getPlatformTarget();
 
@@ -40,10 +51,35 @@ async function main() {
   const binDir = path.join(__dirname, '..', 'binaries');
   const destPath = path.join(binDir, target);
 
-  // Skip if already downloaded
+  // Load checksums manifest if it exists
+  const checksumsPath = path.join(__dirname, '..', 'bin', 'checksums.json');
+  let expectedHash = null;
+  if (fs.existsSync(checksumsPath)) {
+    try {
+      const checksums = JSON.parse(fs.readFileSync(checksumsPath, 'utf8'));
+      expectedHash = checksums[target] || null;
+    } catch (e) {
+      console.warn(`⚠️  Failed to parse checksums manifest: ${e.message}`);
+    }
+  }
+
+  // Skip if already downloaded and verified
   if (fs.existsSync(destPath)) {
-    console.log(`✅ xkat-agent binary already present: ${target}`);
-    return;
+    if (expectedHash) {
+      try {
+        const currentHash = await calculateSha256(destPath);
+        if (currentHash === expectedHash) {
+          console.log(`✅ xkat-agent binary already present and verified: ${target}`);
+          return;
+        }
+        console.log(`⚠️  Hash mismatch for existing binary. Re-downloading...`);
+      } catch (err) {
+        console.log(`⚠️  Failed to verify existing binary hash: ${err.message}. Re-downloading...`);
+      }
+    } else {
+      console.log(`✅ xkat-agent binary already present: ${target}`);
+      return;
+    }
   }
 
   console.log(`📥 Downloading xkat-agent... (${target})`);
@@ -57,6 +93,18 @@ async function main() {
 
   try {
     await downloadFile(url, destPath);
+
+    // Verify integrity after download
+    if (expectedHash) {
+      const downloadedHash = await calculateSha256(destPath);
+      if (downloadedHash !== expectedHash) {
+        // Remove corrupted/tampered file
+        try { fs.unlinkSync(destPath); } catch (_) {}
+        throw new Error(`Integrity check failed: expected ${expectedHash}, got ${downloadedHash}`);
+      }
+      console.log(`✅ Integrity verified: SHA-256 match`);
+    }
+
     // Grant execute permission (Unix only)
     if (os.platform() !== 'win32') {
       fs.chmodSync(destPath, 0o755);