v2: remove bundled third-party binaries and switch to verified on-demand installs

[NitayRabi]

Summary

Ship the security posture change directly in v2.0.0 without a v1 transition release.

In v2, this package should stop checking in and publishing third-party binaries, and instead resolve them at runtime from official vendor sources with verification.

Users who require the current fully offline behavior can pin to v1.x.

Motivation

Today the package includes third-party artifacts in the repo and npm package:

• the Interactive Brokers Client Portal Gateway JAR / gateway bundle
• a bundled Java runtime

That creates an unnecessary trust and maintenance burden:

• no clean chain of trust for vendor binaries committed here
• harder human review of updates to opaque binary blobs
• larger npm payloads and more repository churn
• ongoing responsibility to redistribute and maintain artifacts we do not own

This issue is the v2 umbrella for addressing #62 and #63.

Decision

Make this a breaking change in v2.0.0 rather than introducing a v1 transition.

Rationale:

• the install/runtime contract changes materially
• security posture improves immediately
• semver stays honest
• users who need the old model can remain on v1.x

Proposed v2 behavior

Distribution

• remove checked-in IB Gateway binary artifacts from the repo
• remove checked-in bundled Java runtime artifacts from the repo
• stop publishing those artifacts in the npm package
• publish only MCP code, config/templates, and installer logic

Runtime resolution

On startup:

1. Prefer user-managed dependencies if present
   • IB_GATEWAY_DIR
   • IB_JAVA_HOME / JAVA_HOME
   • system java if supported by the runtime checks
2. If required dependencies are missing, lazily install them on demand
   • download IB Gateway from official Interactive Brokers distribution
   • download Java runtime from an official pinned vendor source
3. Verify every downloaded artifact before use
   • pinned sha256
   • explicit version manifest in the repo
4. Store downloaded artifacts outside the package/repo directory
   • e.g. ~/.cache/interactive-brokers-mcp or platform-appropriate equivalent
5. Extract atomically and reuse on subsequent runs

Controls

• support disabling downloads entirely, e.g. IB_DOWNLOADS_DISABLED=true
• fail with a clear error if dependencies are missing and downloads are disabled
• emit clear logs about what is being downloaded, from where, and where it is installed

User impact

New default in v2

npx interactive-brokers-mcp remains one command, but first run may:

• require network access
• take longer
• create a local cache/install directory
• fail if vendor download endpoints are unavailable or blocked

That is still a contract change, which is why this should be a major release.

Fully offline users

Users who require the current behavior can:

• pin to interactive-brokers-mcp@1
• or preinstall/manage Java and IB Gateway themselves and disable downloads in v2

[doctorpangloss]

i think you can do a cli command to download the ib gateway and jre, with inline sha256 hashes. the transparency is useful even though i think npm is capable / does the same thing. then, offline users can use your Dockerfile, built here, which you fully control (i.e., if you ever need to scan or revoke the full stack, you can)