feat(companion): include checksums in release bundle artifacts

src/cli/companion.test.ts

@@ -94,6 +94,7 @@ const {
     manifestPath: `${input.outputDir}/companion.bootstrap.json`,
     launcherPath: `${input.outputDir}/run-companion.sh`,
     readmePath: `${input.outputDir}/README.md`,
+    checksumsPath: `${input.outputDir}/CHECKSUMS.sha256`,
   }));
 
   return {

src/cli/companion.ts

@@ -360,6 +360,7 @@ export async function runCompanionSession(options: CompanionCommandOptions): Pro
     console.log(`- Manifest: ${result.manifestPath}`);
     console.log(`- Launcher: ${result.launcherPath}`);
     console.log(`- README: ${result.readmePath}`);
+    console.log(`- Checksums: ${result.checksumsPath}`);
     return;
   }
 

src/companion/releaseBundle.test.ts

@@ -48,6 +48,7 @@ describe('writeCompanionReleaseBundle', () => {
     const manifestRaw = await readFile(result.manifestPath, 'utf8');
     const launcherRaw = await readFile(result.launcherPath, 'utf8');
     const readmeRaw = await readFile(result.readmePath, 'utf8');
+    const checksumsRaw = await readFile(result.checksumsPath, 'utf8');
     const launcherStat = await stat(result.launcherPath);
 
     expect(JSON.parse(manifestRaw)).toMatchObject({
@@ -58,6 +59,9 @@ describe('writeCompanionReleaseBundle', () => {
     expect(launcherRaw).toContain('--push-token');
     expect(launcherRaw).toContain('--latitude');
     expect(readmeRaw).toContain('Flynn Companion Release Bundle');
+    expect(checksumsRaw).toContain('companion.bootstrap.json');
+    expect(checksumsRaw).toContain('run-companion.sh');
+    expect(checksumsRaw).toContain('README.md');
     expect((launcherStat.mode & 0o111) !== 0).toBe(true);
 
     await rm(tempDir, { recursive: true, force: true });

src/companion/releaseBundle.ts

@@ -1,4 +1,5 @@
 import { chmod, mkdir, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import type { CompanionBootstrapManifest } from './bootstrapManifest.js';
 
 export interface WriteCompanionReleaseBundleInput {
@@ -11,6 +12,7 @@ export interface WriteCompanionReleaseBundleResult {
   manifestPath: string;
   launcherPath: string;
   readmePath: string;
+  checksumsPath: string;
 }
 
 function shSingleQuote(value: string): string {
@@ -142,20 +144,27 @@ export async function writeCompanionReleaseBundle(
   const manifestPath = `${input.outputDir}/companion.bootstrap.json`;
   const launcherPath = `${input.outputDir}/run-companion.sh`;
   const readmePath = `${input.outputDir}/README.md`;
+  const checksumsPath = `${input.outputDir}/CHECKSUMS.sha256`;
+  const manifestBody = `${JSON.stringify(input.manifest, null, 2)}\n`;
+  const launcherBody = createLauncherScript(input.manifest);
+  const readmeBody = createReadme(input.manifest);
 
-  await writeFile(
-    manifestPath,
-    `${JSON.stringify(input.manifest, null, 2)}\n`,
-    'utf8',
-  );
-  await writeFile(launcherPath, createLauncherScript(input.manifest), 'utf8');
+  await writeFile(manifestPath, manifestBody, 'utf8');
+  await writeFile(launcherPath, launcherBody, 'utf8');
   await chmod(launcherPath, 0o755);
-  await writeFile(readmePath, createReadme(input.manifest), 'utf8');
+  await writeFile(readmePath, readmeBody, 'utf8');
+  const checksums = [
+    [createHash('sha256').update(manifestBody, 'utf8').digest('hex'), 'companion.bootstrap.json'],
+    [createHash('sha256').update(launcherBody, 'utf8').digest('hex'), 'run-companion.sh'],
+    [createHash('sha256').update(readmeBody, 'utf8').digest('hex'), 'README.md'],
+  ].map(([hash, name]) => `${hash}  ${name}`).join('\n');
+  await writeFile(checksumsPath, `${checksums}\n`, 'utf8');
 
   return {
     outputDir: input.outputDir,
     manifestPath,
     launcherPath,
     readmePath,
+    checksumsPath,
   };
 }