chore(release): v2026.3.2.1 (#7)

* fix: security hardening and cleanup

- Add checksum verification to install.sh (SHA256, optional strict mode)
- Fix regex injection in envOrDotEnv() via key escaping (billing.ts, mcp.ts)
- Use timing-safe comparison for bearer token auth (mcp.ts)
- Remove unused --system flag from analyze command
- Deduplicate SKILL.md config fields

* chore(release): v2026.3.2.1

Author: 0xNyk

SKILL.md

@@ -28,10 +28,7 @@ credentials:
     required: false
 required_env_vars:
   - X_BEARER_TOKEN
-requiredEnvVars:
-  - X_BEARER_TOKEN
 primary_credential: X_BEARER_TOKEN
-primaryCredential: X_BEARER_TOKEN
 security:
   always: false
   autonomous: false

install.sh

@@ -45,6 +45,49 @@ main() {
   local tarball="${tmpdir}/xint.tar.gz"
   curl -fsSL "$tarball_url" -o "$tarball"
 
+  # Checksum verification
+  local checksums_url="https://github.com/${OWNER}/${REPO}/releases/download/${version}/checksums.txt"
+  local checksums_file="${tmpdir}/checksums.txt"
+  if curl -fsSL "$checksums_url" -o "$checksums_file" 2>/dev/null; then
+    local asset_name
+    asset_name="$(basename "$tarball_url")"
+    local expected
+    expected="$(awk -v name="$asset_name" '$0 ~ name {print $1; exit}' "$checksums_file" || true)"
+    if [[ -n "$expected" ]]; then
+      local actual=""
+      if command -v sha256sum >/dev/null 2>&1; then
+        actual="$(sha256sum "$tarball" | awk '{print $1}')"
+      elif command -v shasum >/dev/null 2>&1; then
+        actual="$(shasum -a 256 "$tarball" | awk '{print $1}')"
+      fi
+      if [[ -n "$actual" ]]; then
+        if [[ "$actual" != "$expected" ]]; then
+          echo "error: checksum mismatch for $asset_name" >&2
+          exit 1
+        fi
+        echo "==> Checksum verified"
+      else
+        if [[ "${XINT_INSTALL_REQUIRE_CHECKSUM:-0}" == "1" ]]; then
+          echo "error: checksum required but neither sha256sum nor shasum is available" >&2
+          exit 1
+        fi
+        echo "==> Checksum tool unavailable; skipping verification"
+      fi
+    else
+      if [[ "${XINT_INSTALL_REQUIRE_CHECKSUM:-0}" == "1" ]]; then
+        echo "error: checksum required but no entry found in checksums.txt" >&2
+        exit 1
+      fi
+      echo "==> Checksums file present but no entry for $asset_name; skipping verification"
+    fi
+  else
+    if [[ "${XINT_INSTALL_REQUIRE_CHECKSUM:-0}" == "1" ]]; then
+      echo "error: checksum required but checksums.txt not found in release" >&2
+      exit 1
+    fi
+    echo "==> No checksums.txt in release; skipping checksum verification"
+  fi
+
   echo "==> Extracting"
   tar -xzf "$tarball" -C "$tmpdir"
   local src_dir

lib/billing.ts

@@ -11,7 +11,8 @@ function envOrDotEnv(key: string): string | undefined {
   try {
     const envPath = join(import.meta.dir, "..", ".env");
     const raw = readFileSync(envPath, "utf-8");
-    const match = raw.match(new RegExp(`^${key}=["']?([^"'\\n]+)`, "m"));
+    const safeKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const match = raw.match(new RegExp(`^${safeKey}=["']?([^"'\\n]+)`, "m"));
     if (match?.[1]) return match[1].trim();
   } catch {
     // no-op; fall back to runtime env/defaults

lib/grok.ts

@@ -359,7 +359,6 @@ function estimateCost(
 
 export async function cmdAnalyze(args: string[]): Promise<void> {
   let model = DEFAULT_MODEL;
-  let systemPrompt: string | undefined;
   let tweetFile: string | undefined;
   let pipeMode = false;
   let imageUrl: string | undefined;
@@ -377,13 +376,6 @@ export async function cmdAnalyze(args: string[]): Promise<void> {
           process.exit(1);
         }
         break;
-      case "--system":
-        systemPrompt = args[++i];
-        if (!systemPrompt) {
-          console.error("Error: --system requires a prompt string");
-          process.exit(1);
-        }
-        break;
       case "--tweets":
         tweetFile = args[++i];
         if (!tweetFile) {
@@ -447,7 +439,7 @@ export async function cmdAnalyze(args: string[]): Promise<void> {
       const messages: GrokMessage[] = [
         {
           role: "system",
-          content: systemPrompt || GENERAL_ANALYST_SYSTEM,
+          content: GENERAL_ANALYST_SYSTEM,
         },
         { role: "user", content: query },
       ];
@@ -526,7 +518,6 @@ Usage: xint analyze <query>           Ask Grok a question
 
 Options:
   --model <name>     Model: grok-3, grok-3-mini (default), grok-2, grok-2-vision
-  --system <prompt>  Custom system prompt
   --tweets <file>    Path to JSON file containing tweets
   --pipe             Read tweet JSON from stdin
   --image, -i <url> Image URL to analyze with Grok Vision

lib/mcp.ts

@@ -9,6 +9,7 @@ import { checkBudget } from "./costs";
 import { recordCommandResult } from "./reliability";
 import { readFileSync } from "fs";
 import { join } from "path";
+import { timingSafeEqual } from "crypto";
 import { createMcpToolHandlers, type MCPToolHandler, type ToolExecutionResult } from "./mcp_dispatcher";
 
 type PolicyMode = "read_only" | "engagement" | "moderation";
@@ -38,7 +39,8 @@ function envOrDotEnv(key: string): string | undefined {
   try {
     const envPath = join(import.meta.dir, "..", ".env");
     const raw = readFileSync(envPath, "utf-8");
-    const m = raw.match(new RegExp(`^${key}=["']?([^"'\\n]+)`, "m"));
+    const safeKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const m = raw.match(new RegExp(`^${safeKey}=["']?([^"'\\n]+)`, "m"));
     if (m?.[1]) return m[1].trim();
   } catch {}
   return undefined;
@@ -664,7 +666,11 @@ async function runStdio(options: MCPServerOptions) {
 
 function hasValidBearerToken(authHeader: string | undefined, expectedToken: string): boolean {
   if (!authHeader || !authHeader.startsWith("Bearer ")) return false;
-  return authHeader.slice("Bearer ".length).trim() === expectedToken;
+  const provided = authHeader.slice("Bearer ".length).trim();
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expectedToken);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
 }
 
 async function runSSE(port: number, options: MCPSSEServerOptions) {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "xint",
-  "version": "2026.2.24",
+  "version": "2026.3.2.1",
   "author": "Nyk",
   "repository": {
     "type": "git",