完整的固定包命令（2026-10-09 审阅，与英文指南同一份脚本）
前提：Linux（x86_64 或 aarch64）+ Bash，以及 curl、sha256sum（GNU coreutils）、tar 与 python3；请在一次性主机上运行。
set -euo pipefail
ENTRY_SHA='35155b7fc3612da582334a7edb7f5790ee641d41fa4e9e6203dd09ee6f1791f7' # sha256 of the entry script reviewed on 2026-10-09
curl -fL https://monkeycode-ai.com/online/install -o monkeycode-install.sh
echo "$ENTRY_SHA monkeycode-install.sh" | sha256sum -c - # a changed entry script stops here
case "$(uname -m)" in # your recorded checksums are the pin
x86_64) ARCH=amd64; PKG_SHA='6dd439a994920e435137101a8953ec0843131110f07eb6ef48877c98d05344c4' ;;
aarch64|arm64) ARCH=arm64; PKG_SHA='ad42bf3ed93a651fb98652374ae44bd870b29288beed04e8cd28c8d2d18e1d35' ;;
*) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;;
esac
case "$ARCH" in # plain case keeps this runnable on older Bash
amd64) PKG_URL="$(grep -E '^AMD64_URL=' monkeycode-install.sh | head -n1 | cut -d= -f2- | tr -d '"')" ;;
arm64) PKG_URL="$(grep -E '^ARM64_URL=' monkeycode-install.sh | head -n1 | cut -d= -f2- | tr -d '"')" ;;
esac
[ -n "$PKG_URL" ] || { echo "the entry script declares no package URL" >&2; exit 1; }
curl -fL "$PKG_URL" -o "monkeycode-online-linux-$ARCH.tgz"
echo "$PKG_SHA monkeycode-online-linux-$ARCH.tgz" | sha256sum -c - # mismatch stops before anything is unpacked
tar -xzf "monkeycode-online-linux-$ARCH.tgz"
python3 - "$ARCH" "monkeycode-online-linux-$ARCH/manifest.json" <<'PY'
import hashlib, json, os, sys
arch, path = sys.argv[1], sys.argv[2]
m = json.load(open(path))
assert m['version'] == 'v261009', m['version']
assert m['arch'] == arch, m['arch']
compose = os.path.join(os.path.dirname(path), 'docker-compose.yml')
assert hashlib.sha256(open(compose, 'rb').read()).hexdigest() == m['compose_sha256']
print('manifest ok:', m['version'], m['arch'], m['commit'])
PY
# review the extracted files, then run the installer on a disposable host
cd "monkeycode-online-linux-$ARCH" && sudo ./install.sh
顺序：入口脚本校验 → 按 uname -m 选择架构 → 包校验 → manifest（版本、架构、compose_sha256）→ 人工审阅解出的文件 → 安装。入口脚本、架构或包校验失败会在解压前以非零退出；manifest 校验在解压之后，失败时停止、不运行安装器。校验和是本站的独立实测，不是厂商签名。发布包固定了 release 标识、compose 文件与其声明的 base-resources 校验和，但不冻结全部在线依赖（镜像按 tag 引用，运行中仍会下载资源）。 2026-10-09 审阅的 v261009: amd64 sha256 6dd439a994920e435137101a8953ec0843131110f07eb6ef48877c98d05344c4, arm64 sha256 ad42bf3ed93a651fb98652374ae44bd870b29288beed04e8cd28c8d2d18e1d35, entry script sha256 35155b7fc3612da582334a7edb7f5790ee641d41fa4e9e6203dd09ee6f1791f7.
