@nggaigc/cli 0.1.10 → 0.1.12

package/dist/install.js

@@ -8,7 +8,7 @@ import { CliError, fixedErrorCode } from "./errors.js";
 function defaultBundle() {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     return {
-        archive: path.join(vendor, "nggaigc-plugin-1.1.11.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.14.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     };
@@ -17,9 +17,10 @@ function validateRuntime(platform, architecture) {
     const [major, minor] = process.versions.node.split(".").map(Number);
     if (!((major === 22 && (minor ?? 0) >= 13) || major === 24))
         throw new CliError("RUNTIME_UNSUPPORTED");
-    if (platform !== "win32")
+    if (platform !== "win32" && platform !== "darwin")
         throw new CliError("UNSUPPORTED_PLATFORM");
-    if (architecture !== "x64" && architecture !== "arm64")
+    if ((platform === "darwin" && architecture !== "arm64") ||
+        (platform === "win32" && architecture !== "x64" && architecture !== "arm64"))
         throw new CliError("UNSUPPORTED_PLATFORM");
 }
 function safeProfile(value) {
@@ -27,6 +28,14 @@ function safeProfile(value) {
         throw new CliError("INVALID_INPUT");
     return path.resolve(value);
 }
+function installationError(error) {
+    const code = fixedErrorCode(error);
+    if (["SKILL_PAIR_UPGRADE_REQUIRED", "SKILL_PAIR_UNSAFE"].includes(code ?? ""))
+        return new CliError("SKILL_PAIR_UPGRADE_REQUIRED");
+    if (["SKILL_PAIR_RECOVERY_REQUIRED", "SKILL_PAIR_SOURCE_INVALID"].includes(code ?? ""))
+        return new CliError("SKILL_PAIR_RECOVERY_REQUIRED");
+    return new CliError("INSTALLATION_FAILED");
+}
 async function installedVersion(target) {
     try {
         const marker = JSON.parse(await readFile(path.join(target, ".nggaigc-install.json"), "utf8"));
@@ -64,7 +73,7 @@ async function installSkill(installer, source, profile, codexHome, expectedVersi
     }
     catch (error) {
         if (fixedErrorCode(error) !== "ALREADY_INSTALLED")
-            throw new CliError("INSTALLATION_FAILED");
+            throw installationError(error);
     }
     const currentVersion = await installedVersion(target);
     if (!currentVersion)
@@ -83,8 +92,8 @@ async function installSkill(installer, source, profile, codexHome, expectedVersi
         await verifyInstalledSkill(target, bundleFiles);
         return "updated";
     }
-    catch {
-        throw new CliError("INSTALLATION_FAILED");
+    catch (error) {
+        throw installationError(error);
     }
 }
 async function connect(launcher, options, report, probe) {
@@ -162,12 +171,14 @@ export async function runInstall(options = {}) {
     const report = options.reporter ?? (() => undefined);
     report("verifying");
     const bundle = await verifyBundle(options.bundle ?? defaultBundle());
+    if (!bundle.platforms.includes(`${options.platform ?? process.platform}-${options.architecture ?? process.arch}`))
+        throw new CliError("UNSUPPORTED_PLATFORM");
     const temporaryParent = path.resolve(options.temporaryRoot ?? os.tmpdir());
     const temporary = await mkdtemp(path.join(temporaryParent, "nggaigc-cli-"));
     assertDisposableRoot(temporary, temporaryParent);
     try {
         const extracted = path.join(temporary, "plugin");
-        await extractBundle(bundle.archive, extracted);
+        await extractBundle(bundle.archive, extracted, bundle.sha256);
         await verifyExtractedBundle(extracted, bundle.files);
         report("installing");
         const require = createRequire(import.meta.url);

package/dist/skill-command.js

@@ -0,0 +1,115 @@
+import { createHash, createPublicKey } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { trustedKeyId, trustedKeySpkiSha256, verifyBundle, verifyInstalledSkill, } from "./bundle.js";
+import { IndependentSkillError, projectActiveSkillCatalog, startIndependentSkill, } from "./independent-skill.js";
+function fail(code) {
+    throw new IndependentSkillError(code);
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function productionDependencies(codexHome) {
+    const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
+    const bundle = await verifyBundle({
+        archive: path.join(vendor, "nggaigc-plugin-1.1.14.zip"),
+        manifest: path.join(vendor, "manifest.json"),
+        trust: path.join(vendor, "trusted-keys.json"),
+    });
+    const root = path.join(codexHome, "skills", "nggaigc");
+    await verifyInstalledSkill(root, bundle.files);
+    const source = JSON.parse(await readFile(path.join(root, "references", "source.json"), "utf8"));
+    if (!record(source) ||
+        source.id !== "skill.nggaigc" ||
+        typeof source.version !== "string" ||
+        !/^\d+\.\d+\.\d+$/.test(source.version) ||
+        source.clientProtocol !== 1)
+        fail("ROOT_UNAVAILABLE");
+    const keys = JSON.parse(await readFile(path.join(vendor, "trusted-keys.json"), "utf8"));
+    if (!record(keys) ||
+        keys.schemaVersion !== "ngg-trusted-package-keys/v1" ||
+        !Array.isArray(keys.keys))
+        fail("TRUST_UNAVAILABLE");
+    const match = keys.keys.find((key) => record(key) &&
+        key.keyId === trustedKeyId &&
+        typeof key.publicKeyPem === "string");
+    if (!record(match) || typeof match.publicKeyPem !== "string")
+        fail("TRUST_UNAVAILABLE");
+    const key = createPublicKey(match.publicKeyPem);
+    const fingerprint = createHash("sha256")
+        .update(key.export({ type: "spki", format: "der" }))
+        .digest("hex");
+    if (fingerprint !== trustedKeySpkiSha256)
+        fail("TRUST_UNAVAILABLE");
+    const require = createRequire(import.meta.url);
+    const launcher = require(path.join(root, "scripts", "launch-ngg-client.cjs"));
+    if (!record(launcher) || typeof launcher.main !== "function")
+        fail("ROOT_UNAVAILABLE");
+    return {
+        launcher: launcher,
+        trust: {
+            keyId: trustedKeyId,
+            publicKeyPem: match.publicKeyPem,
+            spkiSha256: fingerprint,
+        },
+        rootSkillVersion: source.version,
+    };
+}
+/** Candidate npm entry: active catalog → server admission → verified local Skill path. */
+export async function runSkillStartCommand(skillId, skillVersion, options = {}) {
+    if (!/^skill\.[a-z0-9][a-z0-9.-]{0,79}$/.test(skillId) ||
+        (skillVersion !== undefined && !/^\d+\.\d+\.\d+$/.test(skillVersion)))
+        fail("INVALID_INPUT");
+    const codexHome = path.resolve(options.codexHome ??
+        process.env.CODEX_HOME ??
+        path.join(os.homedir(), ".codex"));
+    if (!path.isAbsolute(codexHome))
+        fail("INSTALL_PATH_UNSAFE");
+    const production = options.launcher && options.trust && options.rootSkillVersion
+        ? null
+        : await productionDependencies(codexHome);
+    const launcher = options.launcher ?? production.launcher;
+    const trust = options.trust ?? production.trust;
+    const rootSkillVersion = options.rootSkillVersion ?? production.rootSkillVersion;
+    const platformVersion = options.platformVersion ??
+        JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8")).version;
+    let snapshot;
+    try {
+        snapshot = await launcher.main(["catalog-snapshot"]);
+    }
+    catch {
+        fail("CATALOG_UNAVAILABLE");
+    }
+    const index = projectActiveSkillCatalog(snapshot);
+    const matches = index.entries.filter((entry) => entry.id === skillId &&
+        entry.state === "active" &&
+        entry.sourceManifest?.role === "independent_skill" &&
+        (skillVersion === undefined || entry.version === skillVersion));
+    if (matches.length !== 1)
+        fail("SKILL_UNAVAILABLE");
+    const selected = matches[0];
+    return startIndependentSkill({
+        index,
+        skillId: selected.id,
+        skillVersion: selected.version,
+        rootSkillVersion,
+        platformVersion,
+        codexHome,
+        trust,
+        fetcher: options.fetcher,
+        admit: async (identity) => {
+            const answer = await launcher.main([
+                "skill-admit",
+                identity.kind,
+                identity.id,
+                identity.version,
+                identity.manifestSha256,
+                identity.releaseId,
+            ]);
+            return answer;
+        },
+    });
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nggaigc/cli",
-  "version": "0.1.10",
-  "description": "Secure one-command NGGAIGC Skill installer for Codex on Windows.",
+  "version": "0.1.12",
+  "description": "Secure one-command NGGAIGC Skill installer for Codex.",
   "type": "module",
   "bin": {
     "nggaigc": "dist/bin.js"
@@ -15,18 +15,18 @@
     "node": ">=22.13.0 <23 || >=24.0.0 <25"
   },
   "os": [
-    "win32"
+    "win32",
+    "darwin"
   ],
   "cpu": [
     "x64",
     "arm64"
   ],
+  "license": "UNLICENSED",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "prepack": "tsc -p tsconfig.build.json && node scripts/stage-assets.mjs",
     "test": "vitest run src --exclude 'src/windows-secure-store.integration.test.ts'",
     "test:credential:os": "tsc -p tsconfig.build.json && vitest run src/windows-secure-store.integration.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit"
-  },
-  "license": "UNLICENSED"
-}
+  }
+}

package/vendor/manifest.json

@@ -1,33 +1,39 @@
 {
   "schemaVersion": "nggaigc-plugin-package/v1",
   "artifactId": "plugin.nggaigc",
-  "version": "1.1.11",
-  "sourceCommit": "8140d08b8361a46f6b2df6e18fab2343b80e1e8c",
-  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.11.zip",
-  "sha256": "0bfd5f96468b3bf380e8620c1f425638f82c025561d957f456585b9b4762aa89",
-  "sizeBytes": 125253,
-  "fileCount": 11,
-  "platforms": [
-    "win32-x64",
-    "win32-arm64"
-  ],
+  "version": "1.1.14",
+  "sourceCommit": "d7e68a4311bfc9c34cff1419197906417b50c6ec",
+  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.14.zip",
+  "sha256": "3610b002a56703534a4975c506f2e90a9d589a671ce42a4557d4282d1d6852aa",
+  "sizeBytes": 337385,
+  "fileCount": 20,
+  "platforms": ["win32-x64", "win32-arm64", "darwin-arm64"],
   "files": {
-    ".codex-plugin/plugin.json": "b9e38baab4fb64421058eb4ef50680ff59679bfe56488a0b13b49785430f7a0b",
-    "installer/install.cjs": "34f4196d59a911f983311b0a79192b23112cdeeb5455cb57609f121bb3e55ea8",
+    ".codex-plugin/plugin.json": "35d8cde373c830a9dd8ebf4616d8c8b32f62034c8ae9a4c0df710c5e094041bc",
+    "installer/install.cjs": "69e4c8a6b54c0393c4b3186a14ca29ccc2915997ac05b379549128ffa9e3fc93",
+    "installer/legacy-root-digests.json": "922552646a5aa6cff8616c372912a37b1d5f263351206b85785ed9b2eae31641",
+    "migration/seedream-1.1.1/SKILL.md": "c45ee501af0b28ca9e66c81a75827ca83dfa6c7420cfd142952512a1fccc2c37",
+    "migration/seedream-1.1.1/agents/openai.yaml": "3cbf034ddccd64a7972acd37e7433683a3944f3d8c7b5bdccbbd70e517bf5a8c",
+    "migration/seedream-1.1.1/references/image-generation.md": "b27a8ac38099d3aea4ad00351887437e3d79c537e318a463108fb017d05b838e",
+    "migration/seedream-1.1.1/references/source.json": "fb89c461b7ef587ebd8e9ceaa7b3128d0766f2004ee437c261c0d5ec25a31ce8",
+    "migration/seedream-1.1.1/scripts/seedream.mjs": "195e0e8eaca0b62c7e89262a05bfc27fa8caa9d59d5ea6418ec3a72239ee2ad5",
+    "skills/nggaigc/SKILL.md": "935970e818e5a60839c5f68738889f22eaae4fc85a0c4bf9a0a89f0571d17403",
     "skills/nggaigc/agents/openai.yaml": "8936d97b9821e687e224e9349cc42be2ee5fc20988562efffbcb70080aedf87c",
-    "skills/nggaigc/references/catalog-and-updates.md": "415116b71650282322ef37407d12799a5292ea2d60e9e0d2f8a6346c1c86c1d4",
-    "skills/nggaigc/references/source.json": "bcf6e14101db192ff9079c788df131c6b94ccd6d5abfd667dfc8c838b7d6dc1e",
-    "skills/nggaigc/scripts/bootstrap-public.json": "743d7e79ff50dce837475841cda075ff33bb4e4fa32ee5771aa68e47e10b546a",
-    "skills/nggaigc/scripts/launch-ngg-client.cjs": "dc4587a196c0fba4daa00124034b4726ec099eb78d48c926bd2622ed9faa551b",
-    "skills/nggaigc/scripts/ngg_client.mjs": "b375237938a3c99339d0efaa31a0df7503651a87f5e02d3cef795e15d3d72245",
-    "skills/nggaigc/scripts/ngg-session.mjs": "6d535b051b71204847865c0f0130d3dd44fc0ad003b1be85f5e37e1040aada37",
-    "skills/nggaigc/scripts/windows-credential.ps1": "ce097f2a8601664522fcfa8c9505243439ff786a45f15a1dba702b8f9b13dab1",
-    "skills/nggaigc/SKILL.md": "4dc2709af3022c34772eebadb98f36cde5d141fde59dfa9a0e0559535ae56f54"
+    "skills/nggaigc/references/catalog-and-updates.md": "638357c1d7a5170dc4a0ce635a08e148ef440f69ce51251bc2a053b0871589a9",
+    "skills/nggaigc/references/source.json": "7c69604cd85211e2d4ba15a79b81ab81e08caf5808f94b20af972e3e475377fc",
+    "skills/nggaigc/scripts/bootstrap-public.json": "78670a0a52ee878cc66107c282fcdda35e6d3ad372a8aacaf5986fd773bf3d43",
+    "skills/nggaigc/scripts/launch-ngg-client.cjs": "c2f76f3fc10796904158a4b56d6d0a43581b3e4b7583837a8aed44f0c727eb84",
+    "skills/nggaigc/scripts/macos-keychain": "b0bdf29d14219d38ca18c7e5c599deb0daa8c8ac70b0babbc7d4fb23673079ec",
+    "skills/nggaigc/scripts/macos-keychain.swift": "1b57e74fde66c824fe970547dd8ca0883a3334c34c065e85a8a2a90d4556a7f5",
+    "skills/nggaigc/scripts/ngg-session.mjs": "8904c71d66cef8140bb758bbfa0d3cea429ffa3a20fef1c871bcaa530243b698",
+    "skills/nggaigc/scripts/ngg_client.mjs": "588722bcc25a127a53d8f84e37f59c97f03963f67e55fa64773e6fd8eec4aa57",
+    "skills/nggaigc/scripts/supported-platforms.json": "ec8b0754c489e04534a1d9880dd6664ba9c5bcd07789e06d138e0923f23575ff",
+    "skills/nggaigc/scripts/windows-credential.ps1": "ce097f2a8601664522fcfa8c9505243439ff786a45f15a1dba702b8f9b13dab1"
   },
   "signature": {
     "algorithm": "ed25519",
     "keyId": "ngg-signing-skill-release-1",
     "scope": "artifact-bytes",
-    "value": "LUKadwdAcUeqqRqp5aE3kH1GiIObpIqhkEXFpNXdrYi9cNYoVDyIF5pItmDHd9tnDq1KS38jluQf/m6StwnlCA=="
+    "value": "RUaaTuzklZJdr2Mj7OAkWZ703UVkj77q7+GPjVBugivClX/86fMLf2ugqEEEjpxLxTPItqS7J1piN53VFyf0DA=="
   }
 }