theseus/package.json
Local Dev 3e3b2c2b8b fix(theseus/updater): verify manifest SHA-256 before arming install
The in-app updater fetched the setup .exe via
session.defaultSession.downloadURL and marked updateDownloadState="ready"
on any DownloadItem `done` with state === "completed", then handed
that path to install-update-now to spawn. No hash check against the
manifest — the same manifest that already carries a SHA-256 per file
and that the Ariadne addon updater verifies at ariadneDownloadInstaller
in this same file.

Consequence: a mid-stream truncation the runtime swallowed as
"completed" (a wrong Content-Length, a CDN cache truncation, an
interrupted TLS session, a corrupted mirror) armed install of a
half-file. install-update-now then ran the corrupt setup silently,
NSIS integrity check failed, uninstaller wiped the app first, and
Theseus was gone with nothing to click.

Now the completion handler streams the saved file through
crypto.createHash("sha256"), compares against updateAvailable.setupHash
from the manifest (already captured in checkForUpdate), and refuses to
arm install on mismatch — deletes the corrupt file and marks the
download failed so the retry loop can pick a fresh one up.

Companion fix to 0.3.32's --updated /S --force-run flags. Both
symptoms landed users in the same "browser vanished" state; 0.3.32
covered the spawn-side, this covers the download-side.
2026-09-08 19:52:15 +02:00

139 lines
3.5 KiB
JSON

{
"name": "theseus-navigator",
"version": "0.3.33",
"description": "Theseus Navigator — a browser that follows the thread. By Silent Mode, a Deviant project.",
"author": "Silent Mode",
"main": "main.js",
"type": "commonjs",
"scripts": {
"start": "electron .",
"resolve-test": "node resolve-test.mjs",
"dist": "electron-builder --win nsis portable"
},
"dependencies": {
"@bitcoinerlab/secp256k1": "^1.2.0",
"@noble/curves": "^2.0.1",
"@noble/hashes": "^2.0.1",
"@scure/bip32": "^2.0.1",
"bip32": "^4.0.0",
"bip39": "^3.1.0",
"bitcoinjs-lib": "^6.1.7",
"ecpair": "^2.1.0",
"fetch-socks": "^1.3.3",
"nostr-tools": "^2.10.4",
"psl": "^1.15.0",
"socks-proxy-agent": "^10.1.0",
"ws": "^8.18.0"
},
"devDependencies": {
"electron": "^33.0.0",
"electron-builder": "^25.1.8"
},
"build": {
"appId": "st.silentmode.theseus",
"productName": "Theseus Navigator",
"artifactName": "TheseusNavigator-${version}-${arch}.${ext}",
"directories": {
"output": "dist-public"
},
"asar": true,
"files": [
"main.js",
"preload.js",
"chrome.html",
"home.html",
"settings.html",
"settings-preload.js",
"popover.html",
"popover-preload.js",
"engine-picker.html",
"engine-picker-preload.js",
"downloads.html",
"downloads-preload.js",
"address-picker.html",
"address-picker-preload.js",
"pw-fill.html",
"pw-fill-preload.js",
"home-preload.js",
"error.html",
"error-preload.js",
"sidebar-preload.js",
"approval-preload.js",
"approval.html",
"addon-inject-preload.js",
"addon-tab-preload.js",
"addons-host.js",
"addon-updater.js",
"addon-update-pubkeys.js",
"link-status.html",
"link-status-preload.js",
"collision.html",
"collision-preload.js",
"messages.html",
"messages-preload.js",
"bcnr-preload.js",
"bcnr-origin.js",
"lib/**/*",
"package.json",
"node_modules/**/*",
"!**/*.md",
"!**/*.map",
"!tor${/*}",
"!dist-public${/*}",
"!resolve-test.mjs",
"!*PROMPT.md"
],
"extraResources": [
{
"from": "tor",
"to": "tor"
},
{
"from": "../Argus/src/lib/resolver-web.js",
"to": "resolver-web.mjs"
},
{
"from": "../Argus/src/lib/password-vault.js",
"to": "password-vault.mjs"
},
{
"from": "lib/hermes.js",
"to": "lib/hermes.mjs"
},
{
"from": "snapshots/bns-name-snapshot.json",
"to": "bns-name-snapshot.json"
},
{
"from": "bundled-addons",
"to": "bundled-addons"
},
{
"from": "build/icon.ico",
"to": "icon.ico"
}
],
"win": {
"icon": "build/icon.ico",
"target": [
"nsis",
"portable"
]
},
"nsis": {
"oneClick": false,
"perMachine": false,
"allowToChangeInstallationDirectory": true,
"artifactName": "TheseusNavigator-Setup-${version}.${ext}",
"installerIcon": "build/icon.ico",
"uninstallerIcon": "build/icon.ico",
"installerHeaderIcon": "build/icon.ico",
"installerSidebar": "build/installerSidebar.bmp",
"uninstallerSidebar": "build/uninstallerSidebar.bmp",
"installerHeader": "build/installerHeader.bmp"
},
"portable": {
"artifactName": "TheseusNavigator-${version}-portable.${ext}"
}
}
}