@nggaigc/cli 0.1.16 → 0.1.17

package/README.md

@@ -8,6 +8,6 @@ npx --yes @nggaigc/cli@latest install
 
 安装器会先验证内置 Plugin 的 Ed25519 签名、归档哈希和逐文件哈希，再原子安装 Skill。首次运行会打开 NGGAIGC 浏览器授权页；浏览器仅接收短期连接挑战，安装器通过内存中的独立轮询凭据获取连接结果，设备凭据只通过标准输入进入操作系统受保护的凭据存储（Windows Credential Manager 或 macOS Keychain）。安装器不接受 API Key、授权码或设备凭据参数，也不从环境变量读取这些值。
 
-本源码的 CLI 0.1.16 / Plugin 1.1.18 是待整合验收与正式签名的候选，不代表当前 `@latest`。候选保留 Windows x64/arm64 与 Apple 芯片 Mac arm64 声明，使用本机 Node.js 22.x（22.13 起）或 24.x，不下载或内嵌 Node.js。Windows PowerShell 5.1 默认 `Restricted` 时，安装器仅为受信凭据辅助脚本的子进程指定 `RemoteSigned`；不修改系统或用户执行策略。安装成功但连接失败会明确分开报告，无需重装；由于系统 URL 处理器退出码不能证明浏览器窗口已显示，安装器会同时给出短期一次性手动授权链接。
+本源码的 CLI 0.1.17 / Plugin 1.1.18 是待整合验收与正式签名的候选，不代表当前 `@latest`。候选保留 Windows x64/arm64 与 Apple 芯片 Mac arm64 声明，使用本机 Node.js 22.x（22.13 起）或 24.x，不下载或内嵌 Node.js。Windows PowerShell 5.1 默认 `Restricted` 时，安装器仅为受信凭据辅助脚本的子进程指定 `RemoteSigned`；不修改系统或用户执行策略。安装成功但连接失败会明确分开报告，无需重装；由于系统 URL 处理器退出码不能证明浏览器窗口已显示，安装器会同时给出短期一次性手动授权链接。
 
 macOS arm64 辅助程序沿用已编译并通过完整性校验的产物；本次 Windows 修复未进行 Mac 实机回归。Intel Mac 不在支持范围内。签名和 registry 读回前，不要将本候选标为已发布。

package/dist/independent-skill.js

@@ -381,6 +381,16 @@ async function existingReceipt(target, entry, trust) {
         const facts = await lstat(target);
         if (!facts.isDirectory() || facts.isSymbolicLink())
             fail("INSTALL_CONFLICT");
+        for (const [name, maximum] of [
+            [".nggaigc-package.json", 65536],
+            [".nggaigc-package.bin", MAX_PACKAGE_BYTES],
+        ]) {
+            const metadata = await lstat(path.join(target, name));
+            if (!metadata.isFile() ||
+                metadata.isSymbolicLink() ||
+                metadata.size > maximum)
+                return false;
+        }
         const value = JSON.parse(await readFile(path.join(target, ".nggaigc-package.json"), "utf8"));
         if (!record(value) ||
             typeof value.id !== "string" ||
@@ -485,6 +495,184 @@ async function download(entry, releaseId, origin, fetcher) {
         fail("PACKAGE_DOWNLOAD_FAILED");
     return bytes;
 }
+/** Historical authenticity cannot grant start/rollback eligibility. The active
+ * catalog and online admission remain the only source of new-start authority. */
+async function replacementEntry(directory, id, options) {
+    let receipt;
+    try {
+        const facts = await lstat(directory);
+        if (!facts.isDirectory() || facts.isSymbolicLink())
+            fail("INSTALL_CONFLICT");
+        const receiptFacts = await lstat(path.join(directory, ".nggaigc-package.json"));
+        if (!receiptFacts.isFile() ||
+            receiptFacts.isSymbolicLink() ||
+            receiptFacts.size > 65536)
+            fail("INSTALL_CONFLICT");
+        const value = JSON.parse(await readFile(path.join(directory, ".nggaigc-package.json"), "utf8"));
+        if (!record(value) ||
+            value.id !== id ||
+            typeof value.version !== "string" ||
+            !VERSION.test(value.version) ||
+            typeof value.manifestSha256 !== "string" ||
+            !DIGEST.test(value.manifestSha256))
+            fail("INSTALL_CONFLICT");
+        receipt = value;
+    }
+    catch {
+        fail("INSTALL_CONFLICT");
+    }
+    const current = options.index.entries.filter((entry) => entry.id === id && entry.version === receipt.version);
+    if (current.length) {
+        if (current.length === 1 && current[0].state === "disabled")
+            fail("HISTORICAL_VERSION_BLOCKED");
+        if (current.length !== 1)
+            fail("INSTALL_CONFLICT");
+        if (!(await existingReceipt(directory, current[0], options.trust)))
+            fail("INSTALL_CONFLICT");
+        return current[0];
+    }
+    const origin = options.origin ?? "https://api.nggaigc.com/";
+    if (origin !== "https://api.nggaigc.com/" &&
+        origin !== "https://api.nggaigc.com")
+        fail("PACKAGE_SOURCE_REJECTED");
+    const url = new URL(`/v1/skill-packages/${encodeURIComponent(id)}/${encodeURIComponent(receipt.version)}/verification`, origin);
+    url.searchParams.set("manifestSha256", receipt.manifestSha256);
+    let value;
+    try {
+        const response = await (options.fetcher ?? fetch)(url, {
+            method: "GET",
+            redirect: "error",
+            credentials: "omit",
+            cache: "no-store",
+            signal: AbortSignal.timeout(15000),
+        });
+        if (response.status === 410 &&
+            !response.redirected &&
+            response.url === url.href)
+            fail("HISTORICAL_VERSION_BLOCKED");
+        if (!response.ok ||
+            response.redirected ||
+            response.url !== url.href ||
+            Number(response.headers.get("content-length") ?? 0) > 16384)
+            fail("HISTORICAL_VERIFICATION_UNAVAILABLE");
+        const reader = response.body?.getReader();
+        if (!reader)
+            fail("HISTORICAL_VERIFICATION_UNAVAILABLE");
+        const chunks = [];
+        let size = 0;
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > 16384)
+                    fail("HISTORICAL_VERIFICATION_UNAVAILABLE");
+                chunks.push(chunk.value);
+            }
+        }
+        finally {
+            await reader.cancel();
+        }
+        value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch (error) {
+        if (error instanceof IndependentSkillError)
+            throw error;
+        fail("HISTORICAL_VERIFICATION_UNAVAILABLE");
+    }
+    if (!record(value) ||
+        value.schemaVersion !== "nggaigc-skill-verification/v1" ||
+        value.scope !== "replacement-verification" ||
+        value.status !== "verified-published" ||
+        value.id !== id ||
+        value.version !== receipt.version ||
+        value.manifestSha256 !== receipt.manifestSha256 ||
+        !record(value.package))
+        fail("HISTORICAL_VERIFICATION_UNAVAILABLE");
+    const pkg = value.package;
+    if (typeof pkg.sha256 !== "string" ||
+        !DIGEST.test(pkg.sha256) ||
+        !Number.isSafeInteger(pkg.sizeBytes) ||
+        pkg.sizeBytes < 1 ||
+        pkg.sizeBytes > MAX_PACKAGE_BYTES ||
+        !record(pkg.signature) ||
+        pkg.signature.algorithm !== "ed25519" ||
+        typeof pkg.signature.keyId !== "string" ||
+        typeof pkg.signature.value !== "string" ||
+        !record(pkg.compatibility) ||
+        !record(pkg.compatibility.rootSkill) ||
+        !record(pkg.compatibility.platform))
+        fail("HISTORICAL_VERIFICATION_UNAVAILABLE");
+    const entry = {
+        id,
+        version: value.version,
+        manifestSha256: value.manifestSha256,
+        state: "superseded",
+        manifest: {
+            id,
+            version: value.version,
+            lifecycle: { status: "published" },
+            requires: [],
+            package: pkg,
+        },
+    };
+    // Never trust a locally editable receipt as file ownership evidence: the cached
+    // ZIP must verify against the pinned signing key, and EVERY installed file.
+    if (!(await existingReceipt(directory, entry, options.trust)))
+        fail("INSTALL_CONFLICT");
+    return entry;
+}
+async function acquireInstallLock(lock) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            const handle = await open(lock, "wx", 0o600);
+            await handle.writeFile(JSON.stringify({ schemaVersion: 1, pid: process.pid }));
+            await handle.sync();
+            return handle;
+        }
+        catch {
+            // Only our positively identified, dead-owner locks may be recovered. Legacy
+            // empty locks, malformed state and permission errors remain fail-closed.
+            if (attempt)
+                fail("INSTALL_BUSY");
+            let reclaim;
+            try {
+                // Serialize reclaimers so one cannot unlink a newly acquired live lock
+                // after another has recovered the dead owner.
+                reclaim = await open(`${lock}.reclaim`, "wx", 0o600);
+                const facts = await lstat(lock);
+                if (!facts.isFile() || facts.isSymbolicLink() || facts.size > 1024)
+                    fail("INSTALL_BUSY");
+                const state = JSON.parse(await readFile(lock, "utf8"));
+                if (!record(state) ||
+                    state.schemaVersion !== 1 ||
+                    !Number.isSafeInteger(state.pid) ||
+                    state.pid <= 0)
+                    fail("INSTALL_BUSY");
+                try {
+                    process.kill(state.pid, 0);
+                    fail("INSTALL_BUSY");
+                }
+                catch (error) {
+                    if (!record(error) || error.code !== "ESRCH")
+                        fail("INSTALL_BUSY");
+                }
+                await rm(lock);
+            }
+            catch {
+                fail("INSTALL_BUSY");
+            }
+            finally {
+                if (reclaim) {
+                    await reclaim.close();
+                    await rm(`${lock}.reclaim`);
+                }
+            }
+        }
+    }
+    return fail("INSTALL_BUSY");
+}
 export async function prepareIndependentSkill(options) {
     const ordered = resolve(options.index, options.skillId, options.skillVersion, options.rootSkillVersion, options.platformVersion);
     if (!path.isAbsolute(options.codexHome))
@@ -505,33 +693,17 @@ export async function prepareIndependentSkill(options) {
             fail("INSTALL_CONFLICT");
         const target = path.join(skillsRoot, slug);
         const lock = path.join(stateRoot, `.nggaigc-${slug}.lock`);
-        let handle;
-        try {
-            handle = await open(lock, "wx", 0o600);
-        }
-        catch {
-            fail("INSTALL_BUSY");
-        }
+        const handle = await acquireInstallLock(lock);
         try {
             const backup = path.join(stateRoot, `.nggaigc-backup-${slug}`);
             if ((await lstat(backup).then(() => true, () => false)) &&
                 !(await lstat(target).then(() => true, () => false))) {
-                let version;
                 try {
-                    const receipt = JSON.parse(await readFile(path.join(backup, ".nggaigc-package.json"), "utf8"));
-                    if (!record(receipt) || typeof receipt.version !== "string")
-                        fail("ROLLBACK_PENDING");
-                    version = receipt.version;
+                    await replacementEntry(backup, entry.id, options);
                 }
                 catch {
                     fail("ROLLBACK_PENDING");
                 }
-                const previous = options.index.entries.find((candidate) => candidate.id === entry.id &&
-                    candidate.version === version &&
-                    candidate.state === "active");
-                if (!previous ||
-                    !(await existingReceipt(backup, previous, options.trust)))
-                    fail("ROLLBACK_PENDING");
                 await rename(backup, target);
             }
             if (await existingReceipt(target, entry, options.trust)) {
@@ -560,26 +732,13 @@ export async function prepareIndependentSkill(options) {
                 });
                 const targetExists = await lstat(target).then(() => true, () => false);
                 if (targetExists) {
-                    let oldReceipt;
-                    try {
-                        const value = JSON.parse(await readFile(path.join(target, ".nggaigc-package.json"), "utf8"));
-                        if (!record(value) ||
-                            typeof value.id !== "string" ||
-                            typeof value.version !== "string")
-                            fail("INSTALL_CONFLICT");
-                        oldReceipt = { id: value.id, version: value.version };
+                    await replacementEntry(target, entry.id, options);
+                    if (await lstat(backup).then(() => true, () => false)) {
+                        // Retain exactly the immediately previous verified version. Do not
+                        // delete a tampered/unowned backup merely to make an update succeed.
+                        await replacementEntry(backup, entry.id, options);
+                        await rm(backup, { recursive: true });
                     }
-                    catch {
-                        fail("INSTALL_CONFLICT");
-                    }
-                    const oldEntry = options.index.entries.find((candidate) => candidate.id === oldReceipt.id &&
-                        candidate.version === oldReceipt.version);
-                    if (oldReceipt.id !== entry.id ||
-                        !oldEntry ||
-                        !(await existingReceipt(target, oldEntry, options.trust)))
-                        fail("INSTALL_CONFLICT");
-                    if (await lstat(backup).then(() => true, () => false))
-                        fail("ROLLBACK_PENDING");
                     await rename(target, backup);
                 }
                 try {
@@ -669,13 +828,7 @@ export async function rollbackIndependentSkill(options) {
     const target = path.join(skillsRoot, slug);
     const backup = path.join(stateRoot, `.nggaigc-backup-${slug}`);
     const lock = path.join(stateRoot, `.nggaigc-${slug}.lock`);
-    let handle;
-    try {
-        handle = await open(lock, "wx", 0o600);
-    }
-    catch {
-        fail("INSTALL_BUSY");
-    }
+    const handle = await acquireInstallLock(lock);
     const retired = path.join(stateRoot, `.nggaigc-retired-${slug}-${randomUUID()}`);
     try {
         if (!(await existingReceipt(target, current, options.trust)) ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nggaigc/cli",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Secure one-command NGGAIGC Skill installer for Codex.",
   "type": "module",
   "bin": {
@@ -22,12 +22,11 @@
     "x64",
     "arm64"
   ],
+  "license": "UNLICENSED",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "prepack": "tsc -p tsconfig.build.json && node scripts/stage-assets.mjs",
     "test": "vitest run src --exclude 'src/windows-secure-store.integration.test.ts'",
     "test:credential:os": "tsc -p tsconfig.build.json && vitest run src/windows-secure-store.integration.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit"
-  },
-  "license": "UNLICENSED"
-}
+  }
+}

package/dist/archive.test.js

@@ -1,168 +0,0 @@
-import { createHash } from "node:crypto";
-import { lstat, mkdir, mkdtemp, readFile, rm, symlink, writeFile, } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { deflateRawSync } from "node:zlib";
-import { afterEach, describe, expect, it } from "vitest";
-import { crc32, decodeArchive, safeArchivePath } from "./archive.js";
-import { extractBundle, verifyExtractedBundle } from "./bundle.js";
-const roots = [];
-async function temporary() {
-    const root = await mkdtemp(path.join(os.tmpdir(), "nggaigc-cli-archive-test-"));
-    roots.push(root);
-    return root;
-}
-afterEach(async () => {
-    for (const root of roots.splice(0))
-        await rm(root, { recursive: true, force: true });
-});
-function zip(entries) {
-    const locals = [];
-    const centrals = [];
-    let offset = 0;
-    for (const entry of entries) {
-        const name = Buffer.from(entry.name);
-        const bytes = Buffer.from(entry.text ?? "payload");
-        const method = entry.method ?? 8;
-        const compressed = method === 0 ? bytes : deflateRawSync(bytes);
-        const crc = crc32(bytes);
-        const flags = 0x800 | (entry.descriptor ? 8 : 0);
-        const local = Buffer.alloc(30);
-        local.writeUInt32LE(0x04034b50);
-        local.writeUInt16LE(20, 4);
-        local.writeUInt16LE(flags, 6);
-        local.writeUInt16LE(method, 8);
-        if (!entry.descriptor) {
-            local.writeUInt32LE(crc, 14);
-            local.writeUInt32LE(compressed.length, 18);
-            local.writeUInt32LE(bytes.length, 22);
-        }
-        local.writeUInt16LE(name.length, 26);
-        const descriptor = Buffer.alloc(entry.descriptor ? 16 : 0);
-        if (entry.descriptor) {
-            descriptor.writeUInt32LE(0x08074b50);
-            descriptor.writeUInt32LE(crc, 4);
-            descriptor.writeUInt32LE(compressed.length, 8);
-            descriptor.writeUInt32LE(bytes.length, 12);
-        }
-        const central = Buffer.alloc(46);
-        central.writeUInt32LE(0x02014b50);
-        central.writeUInt16LE(0x314, 4);
-        central.writeUInt16LE(20, 6);
-        central.writeUInt16LE(flags, 8);
-        central.writeUInt16LE(method, 10);
-        central.writeUInt32LE(crc, 16);
-        central.writeUInt32LE(compressed.length, 20);
-        central.writeUInt32LE(bytes.length, 24);
-        central.writeUInt16LE(name.length, 28);
-        central.writeUInt32LE(((entry.mode ?? 0o100644) << 16) >>> 0, 38);
-        central.writeUInt32LE(offset, 42);
-        locals.push(local, name, compressed, descriptor);
-        centrals.push(central, name);
-        offset +=
-            local.length + name.length + compressed.length + descriptor.length;
-    }
-    const central = Buffer.concat(centrals);
-    const end = Buffer.alloc(22);
-    end.writeUInt32LE(0x06054b50);
-    end.writeUInt16LE(entries.length, 8);
-    end.writeUInt16LE(entries.length, 10);
-    end.writeUInt32LE(central.length, 12);
-    end.writeUInt32LE(offset, 16);
-    return Buffer.concat([...locals, central, end]);
-}
-describe("bounded portable ZIP extraction", () => {
-    for (const method of [0, 8])
-        for (const descriptor of [false, true]) {
-            it(`extracts method ${method}, descriptor ${descriptor}, with exact hashes`, async () => {
-                const root = await temporary();
-                const archive = path.join(root, "plugin.zip");
-                const content = zip([
-                    { name: "skills/你好.txt", text: "hello", method, descriptor },
-                ]);
-                await writeFile(archive, content);
-                await extractBundle(archive, path.join(root, "extracted"), createHash("sha256").update(content).digest("hex"));
-                await verifyExtractedBundle(path.join(root, "extracted"), {
-                    "skills/你好.txt": createHash("sha256").update("hello").digest("hex"),
-                });
-            });
-        }
-    for (const name of [
-        "../escape",
-        "/absolute",
-        "C:/escape",
-        "file:stream",
-        "a\\b",
-        "a/../b",
-        "a//b",
-        "CON",
-        "nul.txt",
-        "a. ",
-        "a/COM1",
-        "e\u0301.txt",
-        "a\0b",
-    ]) {
-        it(`rejects unsafe path ${JSON.stringify(name)}`, () => {
-            expect(safeArchivePath(name)).toBe(false);
-            expect(() => decodeArchive(zip([{ name }]))).toThrow();
-        });
-    }
-    it("rejects symlinks, devices, unexpected executable and setuid files", () => {
-        for (const mode of [0o120777, 0o020600, 0o100755, 0o104644])
-            expect(() => decodeArchive(zip([{ name: "escape", mode }]))).toThrow();
-    });
-    it("preserves execute permission only for the approved native helper", async () => {
-        const root = await temporary();
-        const name = "skills/nggaigc/scripts/macos-keychain";
-        const content = zip([{ name, mode: 0o100755 }]);
-        expect(decodeArchive(content)[0]?.executable).toBe(true);
-        await writeFile(path.join(root, "plugin.zip"), content);
-        await extractBundle(path.join(root, "plugin.zip"), path.join(root, "extracted"));
-        if (process.platform !== "win32")
-            expect((await lstat(path.join(root, "extracted", name))).mode & 0o777).toBe(0o755);
-    });
-    it("rejects case-colliding names and file/directory collisions", () => {
-        for (const names of [
-            ["a", "A"],
-            ["a", "a/b"],
-            ["a/b", "A"],
-        ])
-            expect(() => decodeArchive(zip(names.map((name) => ({ name }))))).toThrow();
-    });
-    it("rejects corrupt data, local-name mismatch, oversized output and truncation", () => {
-        const clean = zip([{ name: "a", method: 0 }]);
-        const corrupt = Buffer.from(clean);
-        corrupt[31] = 0;
-        const mismatch = Buffer.from(clean);
-        mismatch[30] = 98;
-        const oversized = Buffer.from(clean);
-        const central = oversized.readUInt32LE(oversized.length - 6);
-        oversized.writeUInt32LE(65 * 1024 * 1024, central + 24);
-        for (const bytes of [corrupt, mismatch, oversized, clean.subarray(0, -1)])
-            expect(() => decodeArchive(bytes)).toThrow();
-    });
-    it("rejects changed archive digest before writing any destination", async () => {
-        const root = await temporary();
-        await writeFile(path.join(root, "plugin.zip"), zip([{ name: "a" }]));
-        await expect(extractBundle(path.join(root, "plugin.zip"), path.join(root, "out"), "0".repeat(64))).rejects.toMatchObject({ code: "ARCHIVE_EXTRACTION_FAILED" });
-        await expect(lstat(path.join(root, "out"))).rejects.toMatchObject({
-            code: "ENOENT",
-        });
-    });
-    it("never merges into or overwrites an existing destination", async () => {
-        const root = await temporary();
-        await mkdir(path.join(root, "out"));
-        await writeFile(path.join(root, "out", "a"), "original");
-        await writeFile(path.join(root, "plugin.zip"), zip([{ name: "a" }]));
-        await expect(extractBundle(path.join(root, "plugin.zip"), path.join(root, "out"))).rejects.toMatchObject({ code: "ARCHIVE_EXTRACTION_FAILED" });
-        expect(await readFile(path.join(root, "out", "a"), "utf8")).toBe("original");
-    });
-    it("rejects a linked destination parent", async () => {
-        const root = await temporary();
-        await mkdir(path.join(root, "actual"));
-        await symlink(path.join(root, "actual"), path.join(root, "link"), process.platform === "win32" ? "junction" : "dir");
-        await writeFile(path.join(root, "plugin.zip"), zip([{ name: "a" }]));
-        await expect(extractBundle(path.join(root, "plugin.zip"), path.join(root, "link", "out"))).rejects.toMatchObject({ code: "ARCHIVE_EXTRACTION_FAILED" });
-        await expect(lstat(path.join(root, "actual", "out"))).rejects.toMatchObject({ code: "ENOENT" });
-    });
-});

package/dist/bin.test.js

@@ -1,99 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { main } from "./bin.js";
-import { CliError } from "./errors.js";
-describe("candidate npm Skill command entry", () => {
-    it("offers the short-lived manual URL even when browser dispatch reports success", async () => {
-        const output = [];
-        const code = await main(["install"], {
-            install: (options) => {
-                const launcherOptions = options?.launcherOptionsFactory?.({});
-                const manualLink = launcherOptions?.browserManualLink;
-                manualLink?.("https://example.invalid/connect-codex?challenge=once");
-                return Promise.resolve({
-                    status: "connected",
-                    installation: "installed",
-                    version: "1.1.16",
-                });
-            },
-            output: (line) => output.push(line),
-        });
-        expect(code).toBe(0);
-        expect(output.join("")).toContain("如果没有看到授权网页");
-        expect(output.join("")).toContain("challenge=once");
-    });
-    it("reports verified installation separately from a blocked device connection", async () => {
-        const output = [];
-        const errors = [];
-        const code = await main(["install"], {
-            install: (options) => {
-                options?.reporter?.("installing");
-                return Promise.resolve({
-                    status: "installed-unconnected",
-                    installation: "installed",
-                    version: "1.1.16",
-                    connectionError: "POWERSHELL_EXECUTION_POLICY_BLOCKED",
-                });
-            },
-            output: (line) => output.push(line),
-            error: (line) => errors.push(line),
-        });
-        expect(code).toBe(2);
-        expect(output.join("")).toContain("正在安全安装");
-        expect(errors.join("")).toContain("文件已安装，但设备尚未连接");
-        expect(errors.join("")).toContain("脚本执行受到系统或组织策略限制");
-        expect(errors.join("")).not.toContain("重新运行安装命令");
-    });
-    it("uses a failing installer exit code only for an actual installation rejection", async () => {
-        const errors = [];
-        const code = await main(["install"], {
-            install: () => Promise.reject(new CliError("PACKAGE_VERIFICATION_FAILED")),
-            error: (line) => errors.push(line),
-        });
-        expect(code).toBe(1);
-        expect(errors).toEqual(["安装包签名或完整性验证失败，已停止安装。\n"]);
-        expect(errors.join("")).not.toContain("PACKAGE_VERIFICATION_FAILED");
-    });
-    it("dispatches a public ability identity to the generic start path and returns only a verified path", async () => {
-        const output = [];
-        const errors = [];
-        const calls = [];
-        const code = await main(["start-skill", "skill.local-marker", "1.0.0"], {
-            startSkill: (id, version) => {
-                calls.push([id, version]);
-                return Promise.resolve({
-                    id,
-                    version: version,
-                    skillPath: "C:/isolated/skills/local-marker/SKILL.md",
-                    reused: false,
-                });
-            },
-            output: (line) => output.push(line),
-            error: (line) => errors.push(line),
-        });
-        expect(code).toBe(0);
-        expect(calls).toEqual([["skill.local-marker", "1.0.0"]]);
-        expect(JSON.parse(output[0])).toEqual({
-            status: "ready",
-            id: "skill.local-marker",
-            version: "1.0.0",
-            skillPath: "C:/isolated/skills/local-marker/SKILL.md",
-            reused: false,
-        });
-        expect(errors).toEqual([]);
-    });
-    it("does not expose raw exceptions or accept extra command arguments", async () => {
-        const errors = [];
-        expect(await main(["start-skill", "skill.local-marker"], {
-            startSkill: () => Promise.reject(new Error("private error and token")),
-            error: (line) => errors.push(line),
-        })).toBe(1);
-        expect(JSON.parse(errors[0])).toEqual({
-            error: { code: "SKILL_START_UNAVAILABLE" },
-        });
-        expect(errors[0]).not.toContain("private error");
-        expect(await main(["start-skill", "skill.local-marker", "1.0.0", "secret"], {
-            error: (line) => errors.push(line),
-        })).toBe(1);
-        expect(errors[1]).toContain("命令格式无效");
-    });
-});