@model-go/cli 0.1.2 → 0.1.4

package/README.md

@@ -2,7 +2,7 @@
 
 The official CLI for modelgo. Pairs with AI agent skills (Claude Code, Codex, Gemini CLI, etc.) so AI agents can operate modelgo on your behalf.
 
-> **v0 framework stage.** The demo `hello` command and device-flow `auth` commands are available. API key, usage, and model gateway commands are not wired up yet.
+> **v0 framework stage.** Device-flow `auth` commands are available. `modelgo pay request` supports anonymous x402 pay-per-call calls to model gateway APIs; API key management is not wired up yet.
 
 ## Install
 
@@ -17,9 +17,9 @@ This runs an interactive wizard that:
 
 After install, restart your AI agent (open a new chat / session) and try:
 
-> "Have modelgo say hello to me."
+> "Check my modelgo login status."
 
-Your AI should find the `modelgo-hello` skill and run `modelgo hello`.
+Your AI should find the `modelgo-shared` skill and run `modelgo auth status`.
 
 ## Direct commands
 
@@ -28,7 +28,8 @@ modelgo --version
 modelgo auth login
 modelgo auth status
 modelgo auth logout
-modelgo hello [--name NAME]
+modelgo pay methods
+modelgo pay request --env cn --path /v1/chat/completions --method POST --data '{"model":"gpt-4o","messages":[]}' --json
 modelgo --help
 ```
 
@@ -87,6 +88,16 @@ seeing the URL before the agent starts waiting.
 > `JSON.parse` the whole stream. With `--no-wait`, only the device-code object
 > is printed.
 
+### x402 pay-per-call model APIs
+
+Use `modelgo pay request` when the user wants to call a model API without logging in to ModelGo first. The CLI opts into the gateway x402 path with `X-Payment-Protocol: x402`.
+
+```bash
+modelgo pay request --env cn --path /v1/chat/completions --method POST --data '{"model":"gpt-4o","messages":[{"role":"user","content":"hello"}]}' --intent "调用 gpt-4o 完成聊天补全" --json
+```
+
+In the `cn` environment, if the gateway returns a 402 that advertises `alipay:*`, the CLI writes the `PAYMENT-REQUIRED` payload to a local file and returns a structured handoff for `alipay-payment-skill`. In `intl`, the CLI does not route to Alipay; it returns the advertised x402 options for a future non-Alipay rail.
+
 ## Upgrade
 
 Re-run the installer; it detects an out-of-date install and upgrades in place:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@model-go/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "The official CLI for modelgo. Pairs with AI agent skills so AI agents can operate modelgo on your behalf.",
   "bin": {
     "modelgo": "scripts/run.js"
@@ -8,13 +8,15 @@
   "scripts": {
     "postinstall": "node scripts/install.js",
     "test": "node --test scripts/__tests__/*.test.mjs",
-    "lint:skills": "node scripts/lint-skills.mjs"
+    "lint:skills": "node scripts/lint-skills.mjs",
+    "sync:skills": "node scripts/sync-skill-version.mjs",
+    "generate:reference": "node scripts/generate-reference.mjs",
+    "sync:skill-assets": "node scripts/generate-reference.mjs && node scripts/sync-skill-version.mjs"
   },
   "files": [
     "scripts/install.js",
     "scripts/install-wizard.js",
     "scripts/run.js",
-    "checksums.txt",
     "LICENSE",
     "README.md"
   ],

package/scripts/install.js

@@ -31,6 +31,13 @@ const ext = isWindows ? ".zip" : ".tar.gz";
 const archiveName = `${NAME}-${VERSION}-${platform}-${arch}${ext}`;
 const GITHUB_URL = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
 
+// checksums.txt is published by goreleaser alongside the release artifacts.
+// We fetch it from the release at install time rather than bundling it in the
+// npm package: a bundled copy generated locally (goreleaser --snapshot) can
+// never match the CI-built release artifacts' names or SHAs.
+const CHECKSUMS_NAME = "checksums.txt";
+const GITHUB_CHECKSUMS_URL = `https://github.com/${REPO}/releases/download/v${VERSION}/${CHECKSUMS_NAME}`;
+
 const binDir = path.join(__dirname, "..", "bin");
 const dest = path.join(binDir, NAME + (isWindows ? ".exe" : ""));
 
@@ -184,6 +191,21 @@ function download(url, destPath) {
   execFileSync("curl", args, { stdio: ["ignore", "ignore", "pipe"] });
 }
 
+// Try each URL in order, returning once one succeeds. Throws the last error if
+// all fail.
+function downloadFirst(urls, destPath) {
+  let lastErr;
+  for (const url of urls) {
+    try {
+      download(url, destPath);
+      return;
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  throw lastErr;
+}
+
 function extractZipWindows(archivePath, destDir) {
   const psOpts = ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command"];
   const psStdio = ["ignore", "inherit", "inherit"];
@@ -228,20 +250,33 @@ function install() {
   const archivePath = path.join(tmpDir, archiveName);
 
   try {
-    let lastErr;
-    let downloaded = false;
-    for (const url of downloadUrls) {
-      try {
-        download(url, archivePath);
-        downloaded = true;
-        break;
-      } catch (e) {
-        lastErr = e;
-      }
+    downloadFirst(downloadUrls, archivePath);
+
+    // Fetch the authoritative checksums.txt from the same release (GitHub
+    // first, then mirrors). If it can't be fetched (restricted network),
+    // skip verification rather than block the install — the binary itself
+    // came from an allowlisted host over HTTPS.
+    const checksumsUrls = [
+      GITHUB_CHECKSUMS_URL,
+      ...resolveMirrorUrls(process.env, CHECKSUMS_NAME, VERSION),
+    ];
+    for (const u of checksumsUrls) ALLOWED_HOSTS.add(new URL(u).hostname);
+    const checksumsPath = path.join(tmpDir, CHECKSUMS_NAME);
+    let checksumsFetched = true;
+    try {
+      downloadFirst(checksumsUrls, checksumsPath);
+    } catch (e) {
+      checksumsFetched = false;
+      console.error(
+        `[WARN] could not fetch ${CHECKSUMS_NAME} from release ` +
+        `(${e.message}); skipping checksum verification`
+      );
     }
-    if (!downloaded) throw lastErr;
-
-    const expectedHash = getExpectedChecksum(archiveName);
+    // A fetched-but-incomplete checksums.txt is a real integrity problem and
+    // must fail loudly, so parse outside the network try/catch above.
+    const expectedHash = checksumsFetched
+      ? getExpectedChecksum(archiveName, tmpDir)
+      : null;
     verifyChecksum(archivePath, expectedHash);
 
     if (isWindows) {

package/checksums.txt

@@ -1,6 +0,0 @@
-818fc80cdbb471fe9abd2373c30795f4a138f4be4c812cdb3d25148b71a131ed  modelgo-0.1.2-darwin-amd64.tar.gz
-cb981e35d3652d2b0e3d50c0f0eadfd8ee1497887d1e529f7630581c8cfb29e5  modelgo-0.1.2-darwin-arm64.tar.gz
-974822455dd0b423e91a096b00fb6d28750f42ceb982185a434d14d6396974dd  modelgo-0.1.2-linux-amd64.tar.gz
-f388c0e1d23df86a24650b7bcbd2424b5a232b81a0a3f7bb426ad31781fa1217  modelgo-0.1.2-linux-arm64.tar.gz
-5d96a2409132650dd4a98dcc8d1d0f44d519fde5de816550e53db7aba6ae629a  modelgo-0.1.2-windows-amd64.zip
-ea37a1341c87afd2f3cddfe5027a3e8203532cf5432b329c6caa8b4ce506cc05  modelgo-0.1.2-windows-arm64.zip