fix(installer): fail closed on missing Node.js integrity evidence

[LivXue]

Summary

Both installers verify the private Node.js runtime against the
release's SHASUMS256.txt before running it, but each let the download
through whenever the check could not be made. This makes every such
case stop before extraction.

Measured on main before this change, running the real functions
against a fake nodejs.org that serves one release at exact URLs:

Case	install.sh	install.ps1
digest matches	installed	installed
digest mismatch	aborted	installed ("continuing")
SHASUMS256.txt unreachable	installed	installed
package not listed	installed	installed
no sha256sum or shasum	installed	n/a (Get-FileHash)

After it, every row but the first stops with its own reason and a
hint to install Node.js >= 22 with npm and re-run; the installer then
uses that Node instead of downloading one.

• install.sh: the three warn-and-continue branches become die,
  each removing the staged download first. Hashing goes through the
  existing sha256_of helper.
• install.ps1: Fail raises under the script's
  $ErrorActionPreference = "Stop", and the mismatch Fail sat
  inside the try whose catch printed "Could not verify Node
  checksum; continuing". Only the fetch stays inside that try now.
  The fetch also passes -UseBasicParsing, so Windows PowerShell 5.1
  without the IE engine is refused for missing evidence only, never
  for a parser it lacks.
• The optional Chinese font for deck preview counted an empty digest
  (no hash tool) as a match. It now compares the digest directly, as
  the LibreOffice download already did, so an unchecked face is
  skipped with the existing warning and the install carries on.

Unchanged and out of scope: the uv bootstrap (astral.sh) and the raven
wheels are not hash-pinned, and SHASUMS256.txt comes from the same
origin as the tarball over HTTPS, so its signature is not checked.

Context: requirement 1 of the external review in
WenyuChiou/awesome-agentic-ai-zh#289.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

Run in a worktree. The head 902e351 sits on 3632e6040; the six
commits main gained while this branch was in flight touch none of the
three files it changes. The test-first and mutation runs below were
taken before that rebase, on 5be9698a1; the full suite and the
installer test file (with pwsh) were re-run at the head.

uv run --frozen --all-extras pytest tests/test_install_script.py -k "node_download or cannot_be_hashed"
PATH=<pwsh 7.6.5>:$PATH uv run --frozen --all-extras pytest tests/test_install_script.py -k windows_node_download
PATH=<pwsh 7.6.5>:$PATH uv run --frozen --all-extras pytest tests/test_install_script.py --idle-ceiling-strict
PATH=<pwsh 7.6.5>:$PATH uv run --frozen --all-extras pytest -q

• Tests first, against the unmodified scripts: the first command gave
  4 failed (install.sh unreachable, not listed, no hash tool; the font
  with no hash tool) while the mismatch and matching cases passed. The
  second gave 3 failed (mismatch, unreachable, not listed) and 1
  passed. After the change both selections pass.

• One-construct mutations of install.sh against the new tests:
  dropping the no-hash-tool refusal, the not-listed refusal, the
  unreachable refusal, the staged-download cleanup, or the font's
  direct comparison each turned exactly one test red; a control that
  skips extraction turned the matching-digest test red.

• The installer test file under --idle-ceiling-strict: 54 passed,
  1 failed; without pwsh, 50 passed, 4 skipped, 1 failed. The failure
  is test_resolve_node_dir_answers_each_case_it_exists_for, which
  fails the same way on the base on this machine: its fixture PATH
  includes /usr/bin, which holds an npm here. It stubs
  provision_private_node, so this change cannot reach it.

• Full suite at the head, pwsh on PATH: 27560 passed, 7 failed, 115
  skipped in 350.94 s. The seven are this machine's standing failures
  on main: five proxy tests in
  tests/test_config_update_providers.py (the shell carries a proxy),
  the node-dir test above, and one that fails when run as root:
  tests/test_subagent_node_runtime.py::test_what_cannot_be_read_names_nothing

• Live network: the extracted install.sh functions provisioned
  v22.23.3 from nodejs.org, verified it against the published
  SHASUMS256.txt, ran it, and left no staged download, in 6 s.

• dash -n and bash -n on install.sh: clean. The PowerShell
  parser over install.ps1 on this branch and on the base: 0 errors
  each. ruff check and ruff format --check on the test file:
  clean.

• Not verified here: install.ps1 has not run on Windows, and
  -UseBasicParsing matters only to Windows PowerShell 5.1, which no
  test exercises. CI does not close that gap: the two installer jobs
  find Node v22.23.3 already on their runners, so neither reaches the
  private-Node download this change touches.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

No user-facing doc describes the checksum behaviour, so none changed.

Risk

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

A machine without Node.js >= 22 that cannot fetch the release's
SHASUMS256.txt, or that has neither sha256sum nor shasum, used to get
an unverified runtime with a warning; it now gets an error and the
hint above. A system Node >= 22 never downloads anything and is
unaffected. On the build-time path (a system node without npm) the
download was already subshelled or caught, so a refusal there skips
the TUI and page builds with the existing warning rather than ending
the install. The font step changes only on a machine with no hash
tool. Both scripts are served from main, so the change reaches new
installs at merge, and reverting this commit rolls it back the same
way.

Related Issues

N/A in this repository. External:
WenyuChiou/awesome-agentic-ai-zh#289 (requirement 1, once a tagged
release carries this).

[gloryfromca]

No blockers; this can merge as far as I am concerned.

I reviewed the refreshed github/main...HEAD diff, the direct and fallback callers of private Node provisioning on both platforms, and the introducing history. The new paths fail before extraction when checksum evidence is unavailable, absent, or mismatched; the PowerShell catch boundary also no longer swallows Fail. I found no weakened tests or backward-compatibility regression.

Coverage included the repository rules (AGENTS.md and its CLAUDE.md alias), the full diff, callers, history, compatibility, test quality, and architecture constraints; the runtime/TUI domain boundaries are not implicated by these installer-only changes.

Verification: uv run pytest tests/test_install_script.py -x passed with 51 passed and 4 skipped. The skipped cases require PowerShell, which is unavailable in this environment, so I reviewed that path statically. sh -n install.sh, the source-language checker, Ruff check and format check for the changed test file, and git diff --check all passed. The initial test attempt stopped in an unrelated autouse fixture because the fresh environment lacked the workspace plugin; after uv sync --all-packages, the unchanged test command passed.

[ZuyiZhou]

Approved at 902e351. Read the diff: both installers now stop before extraction when SHASUMS256.txt cannot be fetched, does not list the package, or no hash tool is present; the PowerShell mismatch Fail now sits outside the try/catch; the font step compares the digest directly. install.sh at this head passes sh -n and bash -n. All CI checks are green at this head. Not rerun here: the test suite, and install.ps1 on Windows (the description says so too).