fix: update ZIP EOCD comment_length when signing MCPB files (#194)

The signMcpbFile function appended a signature block to the ZIP file but
did not update the EOCD comment_length field. Strict ZIP parsers (like
Claude Desktop's) rejected these files because the declared comment
length didn't account for the appended signature data.

Now scans backwards for the EOCD magic bytes, reads the current
comment_length, and adds the signature block length before concatenating.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/node/sign.ts

@@ -89,8 +89,20 @@ export function signMcpbFile(
   // Create signature block with PKCS#7 data
   const signatureBlock = createSignatureBlock(pkcs7Signature);
 
+  // Update ZIP EOCD comment_length to include signature block
+  // This ensures strict ZIP parsers accept the signed file
+  const updatedContent = Buffer.from(mcpbContent);
+  const eocdOffset = findEocdOffset(updatedContent);
+  if (eocdOffset !== -1) {
+    const currentCommentLength = updatedContent.readUInt16LE(eocdOffset + 20);
+    updatedContent.writeUInt16LE(
+      currentCommentLength + signatureBlock.length,
+      eocdOffset + 20,
+    );
+  }
+
   // Append signature block to MCPB file
-  const signedContent = Buffer.concat([mcpbContent, signatureBlock]);
+  const signedContent = Buffer.concat([updatedContent, signatureBlock]);
   writeFileSync(mcpbPath, signedContent);
 }
 
@@ -218,6 +230,20 @@ export async function verifyMcpbFile(
   }
 }
 
+/**
+ * Finds the offset of the ZIP End of Central Directory record
+ * by scanning backwards for the EOCD magic bytes (0x06054b50)
+ */
+function findEocdOffset(buffer: Buffer): number {
+  // EOCD is at least 22 bytes, scan backwards from the end
+  for (let i = buffer.length - 22; i >= 0; i--) {
+    if (buffer.readUInt32LE(i) === 0x06054b50) {
+      return i;
+    }
+  }
+  return -1;
+}
+
 /**
  * Creates a signature block buffer with PKCS#7 signature
  */