@nggaigc/cli 0.1.12 → 0.1.13

package/README.md

@@ -8,6 +8,6 @@ npx --yes @nggaigc/cli@latest install
 
 安装器会先验证内置 Plugin 的 Ed25519 签名、归档哈希和逐文件哈希，再原子安装 Skill。首次运行会打开 NGGAIGC 浏览器授权页；浏览器仅接收短期连接挑战，安装器通过内存中的独立轮询凭据获取连接结果，设备凭据只通过标准输入进入操作系统受保护的凭据存储（Windows Credential Manager 或 macOS Keychain）。安装器不接受 API Key、授权码或设备凭据参数，也不从环境变量读取这些值。
 
-已发布的 0.1.10 安装器仍仅支持 Windows x64/arm64。此源码中的 0.1.12 / Plugin 1.1.14 是尚未签名、尚未发布的测试候选；候选计划保持 Windows x64/arm64，并增加 Apple 芯片 Mac arm64，使用本机 Node.js 22.x（22.13 起）或 24.x，不下载或内嵌 Node.js。
+目前线上版本为 CLI 0.1.12 / Plugin 1.1.14。本源码的 CLI 0.1.13 / Plugin 1.1.15 是待签名和发布的修复候选：保留 Windows x64/arm64 与 Apple 芯片 Mac arm64 声明，使用本机 Node.js 22.x（22.13 起）或 24.x，不下载或内嵌 Node.js。Windows PowerShell 5.1 默认 `Restricted` 时，安装器仅为受信凭据辅助脚本的子进程指定 `RemoteSigned`；不修改系统或用户执行策略。安装成功但连接失败会明确分开报告，无需重装；默认浏览器未打开时会在本地终端给出短期手动授权链接。
 
-macOS 适配仍需在真实 M3 Mac 编译并核验 Keychain helper，再制作新签名 Plugin 与单一 CLI 包；旧 Windows-only 签名归档不会被重标为 Mac 兼容。Intel Mac 不在本候选声明范围内，也没有实机验收。不要将本候选版本替换为公开安装命令或 npm `latest`。
+macOS arm64 辅助程序沿用已编译并通过完整性校验的产物；本次 Windows 修复未进行 Mac 实机回归。Intel Mac 不在支持范围内。签名和 registry 读回前，不要将本候选标为已发布。

package/dist/bin.js

@@ -9,13 +9,15 @@ const messages = {
     connected: "NGGAIGC Skill 已安装，设备连接验证成功。",
     installing: "正在安全安装已签名的 NGGAIGC Skill…",
     launching: "正在请求系统打开默认浏览器…",
+    "manual-authorizing": "请在手动打开的网页中完成授权，安装器正在等待结果…",
     verifying: "正在验证 NGGAIGC 签名安装包…",
 };
 const errorMessages = {
     ARCHIVE_EXTRACTION_FAILED: "安装包无法安全解压，请稍后重试。",
-    BROWSER_AUTHORIZATION_FAILED: "浏览器授权未完成，请重新运行安装命令。",
-    BROWSER_OPEN_FAILED: "系统未能打开默认浏览器。请确认已设置可用的默认浏览器，然后重新运行安装命令；本次连接未完成。",
-    CONNECTION_VERIFICATION_FAILED: "设备连接验证失败，请重新运行安装命令。",
+    BROWSER_AUTHORIZATION_FAILED: "网页授权未完成；请在新 Codex 任务中调用 NGGAIGC 继续连接，无需重装。",
+    BROWSER_OPEN_FAILED: "系统未能打开默认浏览器，也无法提供手动授权入口；请在新 Codex 任务中调用 NGGAIGC 重试连接，无需重装。",
+    CONNECTION_VERIFICATION_FAILED: "设备连接验证未完成；请在新 Codex 任务中检查连接状态，无需重装。",
+    POWERSHELL_EXECUTION_POLICY_BLOCKED: "Windows 脚本执行受到系统或组织策略限制，设备连接未完成。安装器没有更改执行策略。",
     INSTALLATION_FAILED: "本地安装未完成，请检查现有文件状态后重试。",
     SKILL_PAIR_UPGRADE_REQUIRED: "检测到无法安全配套迁移的本地 Seedream Skill，已停止升级。请保留旧 Skill 和任务文件并联系支持。",
     SKILL_PAIR_RECOVERY_REQUIRED: "检测到本地组合安装中断或目录变化，已停止自动操作。请保留相关目录和任务文件并联系支持。",
@@ -44,9 +46,20 @@ export async function main(args, runtime = {}) {
         return 1;
     }
     try {
-        await runInstall({
+        const result = await (runtime.install ?? runInstall)({
             reporter: (event) => output(`${messages[event]}\n`),
+            launcherOptionsFactory: () => ({
+                browserFallback: (url) => {
+                    // This is a short-lived, single-use browser challenge, not the device
+                    // credential. Keep it in the local terminal only; never persist it.
+                    output(`默认浏览器未能自动打开。请勿分享以下一次性链接，请尽快手动打开：\n${url}\n`);
+                },
+            }),
         });
+        if (result.status === "installed-unconnected") {
+            errorOutput(`NGGAIGC Skill ${result.version} 文件已${result.installation === "unchanged" ? "存在" : "安装"}，但设备尚未连接。${errorMessages[result.connectionError] ?? "请在新 Codex 任务中检查连接状态。"}\n`);
+            return 2;
+        }
         return 0;
     }
     catch (error) {

package/dist/bundle.js

@@ -47,7 +47,7 @@ export async function verifyBundle(input) {
             !exactKeys(manifestValue, manifestKeys) ||
             manifestValue.schemaVersion !== "nggaigc-plugin-package/v1" ||
             manifestValue.artifactId !== "plugin.nggaigc" ||
-            manifestValue.version !== "1.1.14" ||
+            manifestValue.version !== "1.1.15" ||
             manifestValue.artifactPath !==
                 `packages/plugins/nggaigc-plugin-${manifestValue.version}.zip` ||
             typeof manifestValue.sourceCommit !== "string" ||

package/dist/install.js

@@ -8,7 +8,7 @@ import { CliError, fixedErrorCode } from "./errors.js";
 function defaultBundle() {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     return {
-        archive: path.join(vendor, "nggaigc-plugin-1.1.14.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.15.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     };
@@ -115,6 +115,8 @@ async function connect(launcher, options, report, probe) {
     catch (error) {
         if (!probe && fixedErrorCode(error) === "SETUP_REQUIRED")
             configured = false;
+        else if (fixedErrorCode(error) === "POWERSHELL_EXECUTION_POLICY_BLOCKED")
+            throw new CliError("POWERSHELL_EXECUTION_POLICY_BLOCKED");
         else
             throw new CliError("CONNECTION_VERIFICATION_FAILED");
     }
@@ -127,6 +129,9 @@ async function connect(launcher, options, report, probe) {
             const upstreamBrowserOpened = typeof options?.browserOpened === "function"
                 ? options.browserOpened
                 : undefined;
+            const upstreamBrowserFallback = typeof options?.browserFallback === "function"
+                ? options.browserFallback
+                : undefined;
             const upstreamSignal = options?.signal;
             const result = await launcher.main(["login"], {
                 ...options,
@@ -137,6 +142,12 @@ async function connect(launcher, options, report, probe) {
                     upstreamBrowserOpened?.();
                     report("authorizing");
                 },
+                browserFallback: upstreamBrowserFallback
+                    ? async (url) => {
+                        await upstreamBrowserFallback(url);
+                        report("manual-authorizing");
+                    }
+                    : undefined,
             });
             if (result === null ||
                 typeof result !== "object" ||
@@ -147,6 +158,8 @@ async function connect(launcher, options, report, probe) {
         catch (error) {
             if (fixedErrorCode(error) === "BROWSER_OPEN_FAILED")
                 throw new CliError("BROWSER_OPEN_FAILED");
+            if (fixedErrorCode(error) === "POWERSHELL_EXECUTION_POLICY_BLOCKED")
+                throw new CliError("POWERSHELL_EXECUTION_POLICY_BLOCKED");
             throw new CliError("BROWSER_AUTHORIZATION_FAILED");
         }
         finally {
@@ -192,8 +205,20 @@ export async function runInstall(options = {}) {
             typeof launcher.main !== "function" ||
             typeof launcher.LauncherError !== "function")
             throw new CliError("INSTALLATION_FAILED");
-        await connect(launcher, options.launcherOptionsFactory?.(launcher), report, options.connectionProbe);
-        return { status: "connected", installation, version: bundle.version };
+        try {
+            await connect(launcher, options.launcherOptionsFactory?.(launcher), report, options.connectionProbe);
+            return { status: "connected", installation, version: bundle.version };
+        }
+        catch (error) {
+            if (!(error instanceof CliError))
+                throw error;
+            return {
+                status: "installed-unconnected",
+                installation,
+                version: bundle.version,
+                connectionError: error.code,
+            };
+        }
     }
     finally {
         assertDisposableRoot(temporary, temporaryParent);

package/dist/skill-command.js

@@ -15,7 +15,7 @@ function record(value) {
 async function productionDependencies(codexHome) {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     const bundle = await verifyBundle({
-        archive: path.join(vendor, "nggaigc-plugin-1.1.14.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.15.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nggaigc/cli",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Secure one-command NGGAIGC Skill installer for Codex.",
   "type": "module",
   "bin": {

package/vendor/manifest.json

@@ -1,32 +1,36 @@
 {
   "schemaVersion": "nggaigc-plugin-package/v1",
   "artifactId": "plugin.nggaigc",
-  "version": "1.1.14",
-  "sourceCommit": "d7e68a4311bfc9c34cff1419197906417b50c6ec",
-  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.14.zip",
-  "sha256": "3610b002a56703534a4975c506f2e90a9d589a671ce42a4557d4282d1d6852aa",
-  "sizeBytes": 337385,
+  "version": "1.1.15",
+  "sourceCommit": "c62957847daec8e60105d31e083a1309c8dd5846",
+  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.15.zip",
+  "sha256": "ef47a2e18e55eb21512f094796cacda1915056cd09d88b04c89e2074537d9d22",
+  "sizeBytes": 339122,
   "fileCount": 20,
-  "platforms": ["win32-x64", "win32-arm64", "darwin-arm64"],
+  "platforms": [
+    "win32-x64",
+    "win32-arm64",
+    "darwin-arm64"
+  ],
   "files": {
-    ".codex-plugin/plugin.json": "35d8cde373c830a9dd8ebf4616d8c8b32f62034c8ae9a4c0df710c5e094041bc",
-    "installer/install.cjs": "69e4c8a6b54c0393c4b3186a14ca29ccc2915997ac05b379549128ffa9e3fc93",
+    ".codex-plugin/plugin.json": "0e7bbafaf6cab9f7eb5f7836c6579f7544c236e1de678b825922c87b6cb4c781",
+    "installer/install.cjs": "73d2c16f2a3697007576835bd9b87ea0ecc4c9b7d9616db1b70c45c1350a4f41",
     "installer/legacy-root-digests.json": "922552646a5aa6cff8616c372912a37b1d5f263351206b85785ed9b2eae31641",
-    "migration/seedream-1.1.1/SKILL.md": "c45ee501af0b28ca9e66c81a75827ca83dfa6c7420cfd142952512a1fccc2c37",
+    "migration/seedream-1.1.1/SKILL.md": "a1b49a9440443547c65f3dd4a77efc61feffcc53f1462084a5512c67af83d18c",
     "migration/seedream-1.1.1/agents/openai.yaml": "3cbf034ddccd64a7972acd37e7433683a3944f3d8c7b5bdccbbd70e517bf5a8c",
-    "migration/seedream-1.1.1/references/image-generation.md": "b27a8ac38099d3aea4ad00351887437e3d79c537e318a463108fb017d05b838e",
+    "migration/seedream-1.1.1/references/image-generation.md": "a69a9ae3e1e42bdeb5e8a168ec598cc8e1af9caa1d50a76732bd85d47283f2ca",
     "migration/seedream-1.1.1/references/source.json": "fb89c461b7ef587ebd8e9ceaa7b3128d0766f2004ee437c261c0d5ec25a31ce8",
-    "migration/seedream-1.1.1/scripts/seedream.mjs": "195e0e8eaca0b62c7e89262a05bfc27fa8caa9d59d5ea6418ec3a72239ee2ad5",
+    "migration/seedream-1.1.1/scripts/seedream.mjs": "67334b3de175c47f994448723a946c87fcd56f4ef1882206346b44e301a82054",
     "skills/nggaigc/SKILL.md": "935970e818e5a60839c5f68738889f22eaae4fc85a0c4bf9a0a89f0571d17403",
     "skills/nggaigc/agents/openai.yaml": "8936d97b9821e687e224e9349cc42be2ee5fc20988562efffbcb70080aedf87c",
     "skills/nggaigc/references/catalog-and-updates.md": "638357c1d7a5170dc4a0ce635a08e148ef440f69ce51251bc2a053b0871589a9",
-    "skills/nggaigc/references/source.json": "7c69604cd85211e2d4ba15a79b81ab81e08caf5808f94b20af972e3e475377fc",
-    "skills/nggaigc/scripts/bootstrap-public.json": "78670a0a52ee878cc66107c282fcdda35e6d3ad372a8aacaf5986fd773bf3d43",
-    "skills/nggaigc/scripts/launch-ngg-client.cjs": "c2f76f3fc10796904158a4b56d6d0a43581b3e4b7583837a8aed44f0c727eb84",
+    "skills/nggaigc/references/source.json": "73d451f17beb6e4dcbee7a03f0d77d3b4c60a0660d4d8d108abe1ddd9dda9884",
+    "skills/nggaigc/scripts/bootstrap-public.json": "adff59ac1ee2347b43d49f679f9e5f5073d594cfaea374788c63a747ad7047e3",
+    "skills/nggaigc/scripts/launch-ngg-client.cjs": "2afb99bcbc2cbbb90372a3853e69f38d6d21188d35e221c2c685df012edc5434",
     "skills/nggaigc/scripts/macos-keychain": "b0bdf29d14219d38ca18c7e5c599deb0daa8c8ac70b0babbc7d4fb23673079ec",
     "skills/nggaigc/scripts/macos-keychain.swift": "1b57e74fde66c824fe970547dd8ca0883a3334c34c065e85a8a2a90d4556a7f5",
-    "skills/nggaigc/scripts/ngg-session.mjs": "8904c71d66cef8140bb758bbfa0d3cea429ffa3a20fef1c871bcaa530243b698",
-    "skills/nggaigc/scripts/ngg_client.mjs": "588722bcc25a127a53d8f84e37f59c97f03963f67e55fa64773e6fd8eec4aa57",
+    "skills/nggaigc/scripts/ngg-session.mjs": "b97506546f049f0f5a2fb8f585ab66136485aae88f4bffa0c24ec672837935dc",
+    "skills/nggaigc/scripts/ngg_client.mjs": "3775891ddc4ed344358bbd0af8cfc403cee226ca9a12c383c701e84264079b4d",
     "skills/nggaigc/scripts/supported-platforms.json": "ec8b0754c489e04534a1d9880dd6664ba9c5bcd07789e06d138e0923f23575ff",
     "skills/nggaigc/scripts/windows-credential.ps1": "ce097f2a8601664522fcfa8c9505243439ff786a45f15a1dba702b8f9b13dab1"
   },
@@ -34,6 +38,6 @@
     "algorithm": "ed25519",
     "keyId": "ngg-signing-skill-release-1",
     "scope": "artifact-bytes",
-    "value": "RUaaTuzklZJdr2Mj7OAkWZ703UVkj77q7+GPjVBugivClX/86fMLf2ugqEEEjpxLxTPItqS7J1piN53VFyf0DA=="
+    "value": "k8qg2D/I4XxwQ4YDroE3sVH7C2IlSusEoxeoEVuUwZmyb3O2Q5+jl6P+s+LWDFD2hi8S8xbAiruLb2G4kivXBA=="
   }
 }