@model-go/cli 0.1.3 → 0.1.5-rc.1

package/README.md

@@ -44,7 +44,7 @@ The CLI talks to a named environment. Two are built in:
 | Env    | Base URL                     |
 | ------ | ---------------------------- |
 | `cn`   | `https://api.modelgo.com`    |
-| `intl` | `https://api.modelgo.global` |
+| `intl` | `https://api.modelgo.ai` |
 
 The active environment defaults to `cn`. Switch it, or register your own:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@model-go/cli",
-  "version": "0.1.3",
+  "version": "0.1.5-rc.1",
   "description": "The official CLI for modelgo. Pairs with AI agent skills so AI agents can operate modelgo on your behalf.",
   "bin": {
     "modelgo": "scripts/run.js"
@@ -17,7 +17,6 @@
     "scripts/install.js",
     "scripts/install-wizard.js",
     "scripts/run.js",
-    "checksums.txt",
     "LICENSE",
     "README.md"
   ],

package/scripts/install-wizard.js

@@ -34,6 +34,15 @@ const messages = {
     done:          "安装完成！\n试试跟你的 AI 工具（Claude Code、Codex 等）说：\"用 modelgo 跟我打个招呼\"",
     cancelled:     "安装已取消",
     nonTtyHint:    "非交互模式，已完成 npm 全局安装 + skills 安装。",
+    envPrompt:     "请选择环境 / Select environment",
+    envCN:         "国内（api.modelgo.com）",
+    envIntl:       "国际（api.modelgo.ai）",
+    envDone:       "已切换到 %s 环境",
+    envFail:       "环境切换失败，可稍后运行: modelgo env use %s",
+    authPrompt:    "现在登录 modelgo 吗？（将通过浏览器授权，也可稍后再登录）",
+    authDone:      "登录成功",
+    authSkip:      "已跳过登录。稍后运行: modelgo auth login",
+    authFail:      "登录失败，可稍后运行: modelgo auth login",
   },
   en: {
     setup:         "Setting up modelgo CLI...",
@@ -49,6 +58,15 @@ const messages = {
     done:          "You are all set!\nTry asking your AI tool (Claude Code, Codex, etc.): \"Have modelgo say hello to me\"",
     cancelled:     "Installation cancelled",
     nonTtyHint:    "Non-interactive mode. Completed global install + skills install.",
+    envPrompt:     "Select environment",
+    envCN:         "China (api.modelgo.com)",
+    envIntl:       "International (api.modelgo.ai)",
+    envDone:       "Switched to %s environment",
+    envFail:       "Failed to switch env. Run later: modelgo env use %s",
+    authPrompt:    "Log in to modelgo now? (browser authorization; you can also log in later)",
+    authDone:      "Logged in",
+    authSkip:      "Skipped login. Run later: modelgo auth login",
+    authFail:      "Login failed. Run later: modelgo auth login",
   },
 };
 
@@ -200,6 +218,42 @@ async function stepInstallSkills(msg, isInteractive) {
   }
 }
 
+async function stepSelectEnv(msg) {
+  const env = handleCancel(
+    await p.select({
+      message: msg.envPrompt,
+      options: [
+        { value: "cn", label: msg.envCN },
+        { value: "intl", label: msg.envIntl },
+      ],
+    }),
+    msg
+  );
+  try {
+    // `modelgo` is on PATH after the global install in stepInstallGlobally.
+    runSilent("modelgo", ["env", "use", env], { timeout: 15000 });
+    p.log.success(fmt(msg.envDone, env));
+  } catch (_) {
+    p.log.warn(fmt(msg.envFail, env));
+  }
+}
+
+async function stepAuthLogin(msg) {
+  const wantLogin = handleCancel(await p.confirm({ message: msg.authPrompt }), msg);
+  if (!wantLogin) {
+    p.log.info(msg.authSkip);
+    return;
+  }
+  try {
+    // `auth login` prints a verification URL and blocks polling until the user
+    // approves in the browser — inherit stdio so the URL and progress show.
+    execCmd("modelgo", ["auth", "login"], { stdio: "inherit" });
+    p.log.success(msg.authDone);
+  } catch (_) {
+    p.log.warn(msg.authFail);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
@@ -213,6 +267,8 @@ async function main() {
     p.intro(msg.setup);
     await stepInstallGlobally(msg, isInteractive);
     await stepInstallSkills(msg, isInteractive);
+    await stepSelectEnv(msg);
+    await stepAuthLogin(msg);
     p.outro(msg.done);
   } else {
     console.log(msg.setup);

package/scripts/install.js

@@ -31,6 +31,13 @@ const ext = isWindows ? ".zip" : ".tar.gz";
 const archiveName = `${NAME}-${VERSION}-${platform}-${arch}${ext}`;
 const GITHUB_URL = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
 
+// checksums.txt is published by goreleaser alongside the release artifacts.
+// We fetch it from the release at install time rather than bundling it in the
+// npm package: a bundled copy generated locally (goreleaser --snapshot) can
+// never match the CI-built release artifacts' names or SHAs.
+const CHECKSUMS_NAME = "checksums.txt";
+const GITHUB_CHECKSUMS_URL = `https://github.com/${REPO}/releases/download/v${VERSION}/${CHECKSUMS_NAME}`;
+
 const binDir = path.join(__dirname, "..", "bin");
 const dest = path.join(binDir, NAME + (isWindows ? ".exe" : ""));
 
@@ -184,6 +191,21 @@ function download(url, destPath) {
   execFileSync("curl", args, { stdio: ["ignore", "ignore", "pipe"] });
 }
 
+// Try each URL in order, returning once one succeeds. Throws the last error if
+// all fail.
+function downloadFirst(urls, destPath) {
+  let lastErr;
+  for (const url of urls) {
+    try {
+      download(url, destPath);
+      return;
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  throw lastErr;
+}
+
 function extractZipWindows(archivePath, destDir) {
   const psOpts = ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command"];
   const psStdio = ["ignore", "inherit", "inherit"];
@@ -228,20 +250,33 @@ function install() {
   const archivePath = path.join(tmpDir, archiveName);
 
   try {
-    let lastErr;
-    let downloaded = false;
-    for (const url of downloadUrls) {
-      try {
-        download(url, archivePath);
-        downloaded = true;
-        break;
-      } catch (e) {
-        lastErr = e;
-      }
+    downloadFirst(downloadUrls, archivePath);
+
+    // Fetch the authoritative checksums.txt from the same release (GitHub
+    // first, then mirrors). If it can't be fetched (restricted network),
+    // skip verification rather than block the install — the binary itself
+    // came from an allowlisted host over HTTPS.
+    const checksumsUrls = [
+      GITHUB_CHECKSUMS_URL,
+      ...resolveMirrorUrls(process.env, CHECKSUMS_NAME, VERSION),
+    ];
+    for (const u of checksumsUrls) ALLOWED_HOSTS.add(new URL(u).hostname);
+    const checksumsPath = path.join(tmpDir, CHECKSUMS_NAME);
+    let checksumsFetched = true;
+    try {
+      downloadFirst(checksumsUrls, checksumsPath);
+    } catch (e) {
+      checksumsFetched = false;
+      console.error(
+        `[WARN] could not fetch ${CHECKSUMS_NAME} from release ` +
+        `(${e.message}); skipping checksum verification`
+      );
     }
-    if (!downloaded) throw lastErr;
-
-    const expectedHash = getExpectedChecksum(archiveName);
+    // A fetched-but-incomplete checksums.txt is a real integrity problem and
+    // must fail loudly, so parse outside the network try/catch above.
+    const expectedHash = checksumsFetched
+      ? getExpectedChecksum(archiveName, tmpDir)
+      : null;
     verifyChecksum(archivePath, expectedHash);
 
     if (isWindows) {

package/checksums.txt

@@ -1,6 +0,0 @@
-d2301f86bdccb4225e959062382d20108eaac2ce023456f306485b8addcacacc  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-darwin-amd64.tar.gz
-88480f50f971139c72866d73a69a67368a08a260c96b71e04add4eb7d6676ecf  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-darwin-arm64.tar.gz
-9bc1719a182e3b996a793491775fd501da419a6c526d2b8a7cb2e72479cd9e1c  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-linux-amd64.tar.gz
-534554cb7b7fff278260b4e030fcbe30a0029c146d46980493a1d902e65c7669  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-linux-arm64.tar.gz
-13cfa7761480b595fab0e1c3400c299013d29eaca3643282f2817b872b7d89d1  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-windows-amd64.zip
-3d57522bf6cfaeaded3ea3b6db4cf4afd8ddd4f0fbf0bcea71241531898a939c  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-windows-arm64.zip