feat(package-manager): add comprehensive hash verification for packageManager field (#195)

Support Corepack-style packageManager format with integrity hashes:
- Parse format: package@version+algorithm.hash (e.g., yarn@1.22.22+sha512.abc...)
- Support multiple hash algorithms: SHA1, SHA224, SHA256, SHA512
- Verify downloaded package integrity against expected hash
- Re-verify cached packages when hash is provided
- Add proper error handling for hash mismatches

This ensures package manager binaries are authentic and haven't been tampered with,
improving security for monorepo installations.

Examples:
- yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e
- pnpm@8.15.0+sha256.1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
- npm@10.5.0+sha1.abcd1234567890abcdef1234567890abcdef1234

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: fengmk2

Cargo.lock

@@ -56,6 +56,7 @@ fspy_shared_unix = { path = "crates/fspy_shared_unix" }
 futures = "0.3.31"
 futures-core = "0.3.31"
 futures-util = "0.3.31"
+hex = "0.4.3"
 httpmock = "0.7"
 indoc = "2.0.5"
 itertools = "0.14.0"
@@ -77,6 +78,7 @@ serde = "1.0.219"
 serde_json = "1.0.140"
 serde_yml = "0.0.12"
 serial_test = "3.2.0"
+sha1 = "0.10.6"
 sha2 = "0.10.9"
 shell-escape = "0.1.5"
 supports-color = "3.0.1"

Cargo.toml

@@ -21,6 +21,6 @@ serde_json = { workspace = true }
 serde_yml = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
-wax = { workspace = true }
 vite_path = { workspace = true }
 vite_str = { workspace = true }
+wax = { workspace = true }

crates/vite_error/Cargo.toml

@@ -153,6 +153,15 @@ pub enum Error {
     #[error("User cancelled by Ctrl+C")]
     UserCancelled,
 
+    #[error("Hash mismatch: expected {expected}, got {actual}")]
+    HashMismatch { expected: Str, actual: Str },
+
+    #[error("Invalid hash format: {0}")]
+    InvalidHashFormat(Str),
+
+    #[error("Unsupported hash algorithm: {0}")]
+    UnsupportedHashAlgorithm(Str),
+
     #[error(transparent)]
     AnyhowError(#[from] anyhow::Error),
 }

crates/vite_error/src/lib.rs

@@ -13,6 +13,7 @@ backon = { workspace = true }
 directories = { workspace = true }
 flate2 = { workspace = true }
 futures-util = { workspace = true }
+hex = { workspace = true }
 indoc = { workspace = true }
 pathdiff = { workspace = true }
 petgraph = { workspace = true, features = ["serde-1"] }
@@ -23,6 +24,8 @@ serde = { workspace = true, features = ["derive"] }
 # use `preserve_order` feature to preserve the order of the fields in `package.json`
 serde_json = { workspace = true, features = ["preserve_order"] }
 serde_yml = { workspace = true }
+sha1 = { workspace = true }
+sha2 = { workspace = true }
 tar = { workspace = true }
 tempfile = { workspace = true }
 tokio = { workspace = true, features = ["full"] }