From ac7c11e7513aac1309ad55122c91858cca94f116 Mon Sep 17 00:00:00 2001
From: Hunter Bown <hmbown@gmail.com>
Date: Fri, 1 May 2026 01:15:50 -0500
Subject: [PATCH] fix(npm): trust local version marker; only fetch checksum
 manifest when downloading
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The wrapper re-downloaded the SHA-256 manifest from the GitHub release on every
invocation of `deepseek` / `deepseek-tui`, so any GitHub flake, captive portal,
proxy, or offline state broke every command — not just install.

Now ensureBinary returns immediately when the binary exists and its `.version`
marker matches. The manifest fetch is lazy and only runs when a download is
actually needed (first install or DEEPSEEK_TUI_FORCE_DOWNLOAD=1).

Bumps wrapper to 0.8.2; deepseekBinaryVersion stays on 0.8.1 (no new Rust
release required).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 npm/deepseek-tui/package.json       |  2 +-
 npm/deepseek-tui/scripts/install.js | 17 ++++++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/npm/deepseek-tui/package.json b/npm/deepseek-tui/package.json
index bd05009d..57169b6c 100644
--- a/npm/deepseek-tui/package.json
+++ b/npm/deepseek-tui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "deepseek-tui",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "deepseekBinaryVersion": "0.8.1",
   "description": "Install and run deepseek and deepseek-tui binaries from GitHub release artifacts.",
   "author": "Hmbown",
diff --git a/npm/deepseek-tui/scripts/install.js b/npm/deepseek-tui/scripts/install.js
index 0afae017..e1d8ba5a 100644
--- a/npm/deepseek-tui/scripts/install.js
+++ b/npm/deepseek-tui/scripts/install.js
@@ -135,7 +135,7 @@ async function loadChecksums(version, repo) {
   return parseChecksumManifest(await downloadText(checksumManifestUrl(version, repo)));
 }
 
-async function ensureBinary(targetPath, assetName, version, repo, checksums) {
+async function ensureBinary(targetPath, assetName, version, repo, getChecksums) {
   const marker = `${targetPath}.version`;
   const downloadIfNeeded =
     process.env.DEEPSEEK_TUI_FORCE_DOWNLOAD === "1" || process.env.DEEPSEEK_FORCE_DOWNLOAD === "1";
@@ -144,11 +144,11 @@ async function ensureBinary(targetPath, assetName, version, repo, checksums) {
     if (existing) {
       const markerVersion = await readLocalVersion(marker);
       if (markerVersion === String(version)) {
-        await verifyChecksum(targetPath, assetName, checksums);
         return targetPath;
       }
     }
   }
+  const checksums = await getChecksums();
   const url = releaseAssetUrl(assetName, version, repo);
   const destination = `${targetPath}.${process.pid}.${Date.now()}.download`;
   await download(url, destination);
@@ -175,11 +175,18 @@ async function run() {
   const paths = binaryPaths();
   const releaseDir = releaseBinaryDirectory();
   await mkdir(releaseDir, { recursive: true });
-  const checksums = await loadChecksums(version, repo);
+
+  let checksumsPromise;
+  const getChecksums = () => {
+    if (!checksumsPromise) {
+      checksumsPromise = loadChecksums(version, repo);
+    }
+    return checksumsPromise;
+  };
 
   await Promise.all([
-    ensureBinary(paths.deepseek.target, paths.deepseek.asset, version, repo, checksums),
-    ensureBinary(paths.tui.target, paths.tui.asset, version, repo, checksums),
+    ensureBinary(paths.deepseek.target, paths.deepseek.asset, version, repo, getChecksums),
+    ensureBinary(paths.tui.target, paths.tui.asset, version, repo, getChecksums),
   ]);
 }