Refresh reconnect send address and guard prebuilts

install.sh

@@ -268,6 +268,40 @@ verify_archive_checksum() {
   fi
 }
 
+expected_archive_version() {
+  url="$1"
+  case "$url" in
+    */releases/download/v*/*)
+      tag="${url#*/releases/download/v}"
+      tag="${tag%%/*}"
+      printf '%s\n' "$tag"
+      return 0
+      ;;
+  esac
+  if [ -z "$binary_url" ] && [ -z "$binary_base" ] && [ "$binary_version" != "latest" ]; then
+    printf '%s\n' "${binary_version#v}"
+    return 0
+  fi
+  return 1
+}
+
+verify_archive_version() {
+  extract_dir="$1"
+  url="$2"
+  expected="$(expected_archive_version "$url" || true)"
+  [ -n "$expected" ] || return 0
+  version_file="$(find "$extract_dir" -type f -name VERSION 2>/dev/null | sed -n '1p')"
+  if [ -z "$version_file" ]; then
+    echo "prebuilt archive missing VERSION for $url" >&2
+    return 1
+  fi
+  actual="$(tr -d '\r\n' <"$version_file")"
+  if [ "$actual" != "$expected" ]; then
+    echo "prebuilt archive version mismatch for $url: expected $expected, got $actual" >&2
+    return 1
+  fi
+}
+
 try_install_prebuilt() {
   download_url="$(release_latest_tag_download_url || release_download_url)" || return 1
   tmpdir="$(mktemp -d)"
@@ -291,6 +325,7 @@ try_install_prebuilt() {
     echo "prebuilt archive could not be extracted: $download_url" >&2
     return 1
   fi
+  verify_archive_version "$tmpdir/extract" "$download_url" || return 1
   install_extracted_binary "$tmpdir/extract" dosh-client "$bindir/dosh-client" || return 1
   ln -sf dosh-client "$bindir/dosh"
   if [ "$role" = "server" ] || [ "$role" = "both" ]; then