@nggaigc/cli 0.1.16 → 0.1.18

package/dist/install.test.js

@@ -1,264 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { existsSync } from "node:fs";
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { afterEach, describe, expect, it } from "vitest";
-import { verifyBundle } from "./bundle.js";
-import { CliError } from "./errors.js";
-import { runInstall } from "./install.js";
-const workspace = path.resolve(import.meta.dirname, "../../..");
-const bundle = {
-    archive: path.join(workspace, "packages/plugins/nggaigc-plugin-1.1.18.zip"),
-    manifest: path.join(workspace, "release/plugin-candidates/nggaigc-1.1.18/manifest.json"),
-    trust: path.join(workspace, "release/trust/skill-package-keys.v1.json"),
-};
-const supportedWindowsRuntime = {
-    platform: "win32",
-    architecture: "x64",
-};
-const signedCandidatePresent = existsSync(bundle.archive) && existsSync(bundle.manifest);
-const temporary = [];
-async function disposable(prefix) {
-    const value = await mkdtemp(path.join(os.tmpdir(), prefix));
-    temporary.push(value);
-    return value;
-}
-afterEach(async () => {
-    while (temporary.length) {
-        const value = temporary.pop();
-        if (value)
-            await rm(value, { recursive: true, force: true });
-    }
-});
-describe("platform boundary", () => {
-    it("does not claim untested Intel Mac support", async () => {
-        await expect(runInstall({ platform: "darwin", architecture: "x64", bundle })).rejects.toEqual(new CliError("UNSUPPORTED_PLATFORM"));
-    });
-});
-describe.skipIf(!signedCandidatePresent)("signed bundle", () => {
-    it("rejects relabelling signed metadata with unsupported Intel Mac support", async () => {
-        const root = await disposable("nggaigc-cli-manifest-");
-        const value = JSON.parse(await readFile(bundle.manifest, "utf8"));
-        value.platforms = [
-            "win32-x64",
-            "win32-arm64",
-            "darwin-x64",
-            "darwin-arm64",
-        ];
-        const manifest = path.join(root, "manifest.json");
-        await writeFile(manifest, JSON.stringify(value));
-        await expect(verifyBundle({ ...bundle, manifest })).rejects.toEqual(new CliError("PACKAGE_VERIFICATION_FAILED"));
-    });
-    it("verifies the accepted Plugin candidate", async () => {
-        await expect(verifyBundle(bundle)).resolves.toMatchObject({
-            version: "1.1.18",
-        });
-    });
-    it("fails closed when an archive byte changes", async () => {
-        const root = await disposable("nggaigc-cli-tamper-");
-        const changed = path.join(root, "plugin.zip");
-        const bytes = Buffer.from(await readFile(bundle.archive));
-        bytes[bytes.length - 1] = (bytes[bytes.length - 1] ?? 0) ^ 1;
-        await writeFile(changed, bytes);
-        await expect(verifyBundle({ ...bundle, archive: changed })).rejects.toEqual(new CliError("PACKAGE_VERIFICATION_FAILED"));
-    });
-});
-describe.skipIf(!signedCandidatePresent)("one-command installation", () => {
-    it("installs, completes the polling browser flow, and verifies connection", async () => {
-        const root = await disposable("nggaigc-cli-install-");
-        const profile = path.join(root, "profile");
-        const challenge = `ngg_chal_${randomBytes(32).toString("base64url")}`;
-        const pollingCredential = `ngg_poll_${randomBytes(32).toString("base64url")}`;
-        const credential = `ngg_v1_${randomBytes(32).toString("base64url")}`;
-        const epoch = randomBytes(16).toString("hex");
-        const events = [];
-        const observed = [];
-        let configured = false;
-        let exchanges = 0;
-        let browserOpens = 0;
-        const options = {
-            ...supportedWindowsRuntime,
-            bundle,
-            profile,
-            connectionProbe: () => Promise.resolve(configured),
-            reporter: (event) => events.push(event),
-            launcherOptionsFactory: (launcher) => ({
-                browserAuthorizationTimeoutMs: 5_000,
-                helperRunner: (_directory, operation, input) => {
-                    observed.push(operation);
-                    if (operation === "status" && !configured)
-                        throw new launcher.LauncherError("SETUP_REQUIRED");
-                    if (operation === "setup") {
-                        expect(Buffer.from(input ?? []).includes(Buffer.from(credential))).toBe(true);
-                        configured = true;
-                        return { status: "credential-stored", credentialEpoch: epoch };
-                    }
-                    return { status: operation === "status" ? "connected" : "ready" };
-                },
-                fetchImplementation: (url, request) => {
-                    exchanges += 1;
-                    expect(typeof request.body).toBe("string");
-                    const body = typeof request.body === "string" ? request.body : "{}";
-                    if (url.endsWith("/codex-device-authorization-challenges")) {
-                        expect(JSON.parse(body)).toMatchObject({
-                            displayName: "Codex on Windows",
-                        });
-                        return Response.json({
-                            schemaVersion: "nggaigc-device-authorization-poll/v1",
-                            authorizationId: "12345678-1234-4123-8123-123456789abc",
-                            challengeToken: challenge,
-                            pollingCredential,
-                            expiresAt: new Date(Date.now() + 60_000).toISOString(),
-                            intervalSeconds: 5,
-                        });
-                    }
-                    expect(url).toBe("https://api.nggaigc.com/v1/codex-device-authorization-results/poll");
-                    expect(JSON.parse(body)).toEqual({ pollingCredential });
-                    return Response.json({
-                        schemaVersion: "nggaigc-device-authorization-poll/v1",
-                        status: "connected",
-                        credential,
-                        device: {
-                            id: "12345678-1234-4123-8123-123456789abc",
-                            displayName: "Codex on Windows",
-                            credentialSuffix: credential.slice(-4),
-                            status: "active",
-                            createdAt: "2026-09-14T00:00:00.000Z",
-                            revokedAt: null,
-                            lastUsedAt: null,
-                        },
-                    });
-                },
-                browserOpener: (value) => {
-                    browserOpens += 1;
-                    const authorization = new URL(value);
-                    expect(authorization.origin).toBe("https://api.nggaigc.com");
-                    expect(authorization.pathname).toBe("/connect-codex");
-                    expect(authorization.searchParams.get("flow")).toBe("poll-v1");
-                    expect(authorization.searchParams.get("challenge")).toBe(challenge);
-                    expect(value).not.toContain("127.0.0.1");
-                    expect(value).not.toContain(pollingCredential);
-                    expect(value).not.toContain(credential);
-                    return Promise.resolve();
-                },
-            }),
-        };
-        await expect(runInstall(options)).resolves.toEqual({
-            status: "connected",
-            installation: "installed",
-            version: "1.1.18",
-        });
-        expect(events).toEqual([
-            "verifying",
-            "installing",
-            "launching",
-            "authorizing",
-            "connected",
-        ]);
-        expect(exchanges).toBe(2);
-        expect(browserOpens).toBe(1);
-        expect(observed).toContain("session");
-        events.length = 0;
-        await expect(runInstall(options)).resolves.toEqual({
-            status: "connected",
-            installation: "unchanged",
-            version: "1.1.18",
-        });
-        expect(events).toEqual(["verifying", "installing", "connected"]);
-        expect(exchanges).toBe(2);
-        expect(browserOpens).toBe(1);
-        const installed = path.join(profile, ".codex", "skills", "nggaigc");
-        expect(await readFile(path.join(installed, "SKILL.md"), "utf8")).toContain("name: nggaigc");
-        const output = JSON.stringify({ events, observed });
-        expect(output).not.toContain(challenge);
-        expect(output).not.toContain(pollingCredential);
-        expect(output).not.toContain(credential);
-        expect(process.argv.join("\n")).not.toContain(challenge);
-        expect(JSON.stringify(process.env)).not.toContain(challenge);
-        expect(JSON.stringify(process.env)).not.toContain(pollingCredential);
-        expect(JSON.stringify(process.env)).not.toContain(credential);
-    }, 60_000);
-    it("reports browser authorization only after Windows accepts the launch", async () => {
-        const root = await disposable("nggaigc-cli-browser-failure-");
-        const events = [];
-        const challenge = `ngg_chal_${randomBytes(32).toString("base64url")}`;
-        const pollingCredential = `ngg_poll_${randomBytes(32).toString("base64url")}`;
-        await expect(runInstall({
-            ...supportedWindowsRuntime,
-            bundle,
-            profile: path.join(root, "profile"),
-            connectionProbe: () => Promise.resolve(false),
-            reporter: (event) => events.push(event),
-            launcherOptionsFactory: (launcher) => ({
-                helperRunner: (_directory, operation) => {
-                    if (operation === "status")
-                        throw new launcher.LauncherError("SETUP_REQUIRED");
-                    return { status: "ready" };
-                },
-                fetchImplementation: (url) => url.endsWith("/codex-device-authorization-challenges")
-                    ? Response.json({
-                        schemaVersion: "nggaigc-device-authorization-poll/v1",
-                        authorizationId: "12345678-1234-4123-8123-123456789abc",
-                        challengeToken: challenge,
-                        pollingCredential,
-                        expiresAt: new Date(Date.now() + 60_000).toISOString(),
-                        intervalSeconds: 5,
-                    })
-                    : new Response(null, { status: 204 }),
-                browserOpener: () => {
-                    throw new launcher.LauncherError("BROWSER_OPEN_FAILED");
-                },
-            }),
-        })).resolves.toEqual({
-            status: "installed-unconnected",
-            installation: "installed",
-            version: "1.1.18",
-            connectionError: "BROWSER_OPEN_FAILED",
-        });
-        expect(events).toEqual(["verifying", "installing", "launching"]);
-    }, 60_000);
-    it("keeps verified files installed when Windows policy blocks connection", async () => {
-        const root = await disposable("nggaigc-cli-policy-blocked-");
-        const profile = path.join(root, "profile");
-        const events = [];
-        await expect(runInstall({
-            ...supportedWindowsRuntime,
-            bundle,
-            profile,
-            reporter: (event) => events.push(event),
-            connectionProbe: (launcher) => Promise.reject(new launcher.LauncherError("POWERSHELL_EXECUTION_POLICY_BLOCKED")),
-        })).resolves.toEqual({
-            status: "installed-unconnected",
-            installation: "installed",
-            version: "1.1.18",
-            connectionError: "POWERSHELL_EXECUTION_POLICY_BLOCKED",
-        });
-        expect(events).toEqual(["verifying", "installing"]);
-        expect(await readFile(path.join(profile, ".codex", "skills", "nggaigc", "SKILL.md"), "utf8")).toContain("name: nggaigc");
-    }, 60_000);
-    it("does not overwrite a modified managed installation", async () => {
-        const root = await disposable("nggaigc-cli-modified-");
-        const profile = path.join(root, "profile");
-        let configured = true;
-        const options = {
-            ...supportedWindowsRuntime,
-            bundle,
-            profile,
-            connectionProbe: () => Promise.resolve(configured),
-            launcherOptionsFactory: () => ({
-                helperRunner: (_directory, operation) => {
-                    if (operation === "status" && configured)
-                        return { status: "connected" };
-                    throw new Error("unexpected");
-                },
-            }),
-        };
-        await runInstall(options);
-        const skill = path.join(profile, ".codex", "skills", "nggaigc", "SKILL.md");
-        await writeFile(skill, "user-modified\n");
-        await expect(runInstall(options)).rejects.toEqual(new CliError("INSTALLATION_FAILED"));
-        expect(await readFile(skill, "utf8")).toBe("user-modified\n");
-        configured = false;
-    }, 60_000);
-});

package/dist/production-trust.test.js

@@ -1,53 +0,0 @@
-import { createHash, generateKeyPairSync, sign, verify } from "node:crypto";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { expect, it } from "vitest";
-import { trustedKeyId, verifyBundle } from "./bundle.js";
-it("the official fixed plugin verifier rejects an injected synthetic trust key", async () => {
-    const directory = await mkdtemp(path.join(os.tmpdir(), "nggaigc-production-trust-test-"));
-    try {
-        const pair = generateKeyPairSync("ed25519");
-        const key = pair.publicKey.export({
-            type: "spki",
-            format: "pem",
-        });
-        const archive = Buffer.from("synthetic-plugin-test-archive");
-        const manifest = {
-            schemaVersion: "nggaigc-plugin-package/v1",
-            artifactId: "plugin.nggaigc",
-            version: "1.1.16",
-            sourceCommit: "0".repeat(40),
-            artifactPath: "packages/plugins/nggaigc-plugin-1.1.16.zip",
-            sha256: createHash("sha256").update(archive).digest("hex"),
-            sizeBytes: archive.length,
-            fileCount: 1,
-            platforms: ["win32-x64", "win32-arm64", "darwin-arm64"],
-            files: { "skills/nggaigc/SKILL.md": "0".repeat(64) },
-            signature: {
-                algorithm: "ed25519",
-                keyId: trustedKeyId,
-                scope: "artifact-bytes",
-                value: sign(null, archive, pair.privateKey).toString("base64"),
-            },
-        };
-        expect(verify(null, archive, pair.publicKey, Buffer.from(manifest.signature.value, "base64"))).toBe(true);
-        const manifestPath = path.join(directory, "manifest.json");
-        const trustPath = path.join(directory, "trusted-keys.json");
-        const archivePath = path.join(directory, "nggaigc-plugin-1.1.16.zip");
-        await writeFile(manifestPath, JSON.stringify(manifest));
-        await writeFile(archivePath, archive);
-        await writeFile(trustPath, JSON.stringify({
-            schemaVersion: "ngg-trusted-package-keys/v1",
-            keys: [{ keyId: trustedKeyId, publicKeyPem: key.toString() }],
-        }));
-        await expect(verifyBundle({
-            archive: archivePath,
-            manifest: manifestPath,
-            trust: trustPath,
-        })).rejects.toMatchObject({ code: "PACKAGE_VERIFICATION_FAILED" });
-    }
-    finally {
-        await rm(directory, { recursive: true, force: true });
-    }
-});

package/dist/runtime.test.js

@@ -1,53 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { runInstall } from "./install.js";
-describe("CLI runtime admission before installation or connection", () => {
-    for (const [platform, architecture] of [
-        ["win32", "x64"],
-        ["win32", "arm64"],
-        ["darwin", "arm64"],
-    ]) {
-        it(`admits ${platform}/${architecture} before bundle verification`, async () => {
-            await expect(runInstall({ platform, architecture, profile: "relative" })).rejects.toMatchObject({ code: "INVALID_INPUT" });
-        });
-    }
-    for (const [platform, architecture] of [
-        ["linux", "x64"],
-        ["darwin", "x64"],
-        ["darwin", "ia32"],
-    ]) {
-        it(`rejects ${platform}/${architecture}`, async () => {
-            await expect(runInstall({ platform, architecture, profile: "relative" })).rejects.toMatchObject({ code: "UNSUPPORTED_PLATFORM" });
-        });
-    }
-    for (const [version, supported] of [
-        ["20.19.0", false],
-        ["22.0.0", false],
-        ["22.12.9", false],
-        ["22.13.0", true],
-        ["22.22.2", true],
-        ["23.0.0", false],
-        ["24.0.0", true],
-        ["24.16.0", true],
-        ["25.0.0", false],
-        ["26.0.0", false],
-    ]) {
-        it(`${supported ? "accepts" : "rejects"} Node ${version}`, async () => {
-            const original = Object.getOwnPropertyDescriptor(process.versions, "node");
-            Object.defineProperty(process.versions, "node", { value: version });
-            try {
-                // Invalid profile is checked immediately after runtime admission.
-                // No bundle extraction, filesystem writes, browser, or credential access.
-                await expect(runInstall({
-                    platform: "win32",
-                    architecture: "x64",
-                    profile: "relative",
-                })).rejects.toMatchObject({
-                    code: supported ? "INVALID_INPUT" : "RUNTIME_UNSUPPORTED",
-                });
-            }
-            finally {
-                Object.defineProperty(process.versions, "node", original);
-            }
-        });
-    }
-});

package/dist/seedream-root-compat.test.js

@@ -1,158 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return -- The signed historical .mjs client and loopback fixture are intentionally loaded dynamically. */
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { mkdtemp, readFile, rm } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-import { afterEach, test } from "vitest";
-import { decodeArchive, writeArchive } from "./archive.js";
-const repo = path.resolve(import.meta.dirname, "../../..");
-const temporary = [];
-afterEach(async () => {
-    await Promise.all(temporary.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
-});
-test("the new Seedream/root pair resumes an old pair's accepted task without a second charge", async () => {
-    const manifest = JSON.parse(await readFile(path.join(repo, "release/plugin-candidates/nggaigc-1.1.10/manifest.json"), "utf8"));
-    const zip = await readFile(path.join(repo, manifest.artifactPath));
-    assert.equal(createHash("sha256").update(zip).digest("hex"), manifest.sha256);
-    const entries = decodeArchive(zip);
-    const files = Object.fromEntries(entries
-        .filter((entry) => !entry.directory)
-        .map((entry) => [
-        entry.name,
-        createHash("sha256").update(entry.bytes).digest("hex"),
-    ]));
-    assert.deepEqual(files, manifest.files);
-    const oldFiles = entries
-        .filter((entry) => !entry.directory && entry.name.startsWith("skills/nggaigc/"))
-        .map((entry) => ({
-        ...entry,
-        name: entry.name.slice("skills/nggaigc/".length),
-    }));
-    const tmp = await mkdtemp(path.join(os.tmpdir(), "ngg-seedream-root-compat-"));
-    temporary.push(tmp);
-    const oldRoot = path.join(tmp, "old-root");
-    await writeArchive(oldFiles, oldRoot);
-    const oldWrapper = path.join(repo, "tests/skill-sources/fixtures/seedream-1.1.0");
-    assert.equal(createHash("sha256")
-        .update(await readFile(path.join(oldWrapper, "scripts/seedream.mjs")))
-        .digest("hex"), "27e0056bbe9fae35233b10247f13cc679747bb8fe1682b39d74e7ffa77a5a1fb");
-    assert.equal(createHash("sha256")
-        .update(await readFile(path.join(oldWrapper, "references/source.json")))
-        .digest("hex"), "78d1a03451b83dd31d83d5e9af88341a64a5b290f9a2e0c46abf368a6a7a5650");
-    const currentRoot = path.join(repo, "skill-sources/nggaigc");
-    const oldClient = await import(pathToFileURL(path.join(oldRoot, "scripts/ngg_client.mjs")).href);
-    const currentClient = await import(pathToFileURL(path.join(currentRoot, "scripts/ngg_client.mjs")).href);
-    for (const client of [oldClient, currentClient]) {
-        assert.equal(client.CLIENT_PROTOCOL, 1);
-        assert.deepEqual(client.IMAGE, {
-            id: "skill.seedream-5-lite.image-generation",
-            version: "1.1.0",
-            capability: "capability.seedream-5-lite.image-generation",
-        });
-    }
-    const fakeApiPath = path.join(repo, "tests/skill-sources/fake-api.mjs");
-    const wrapperPath = path.join(repo, "skill-sources/ngg-seedream-image/scripts/seedream.mjs");
-    const { createFakeApi } = await import(pathToFileURL(fakeApiPath).href);
-    const { runSeedream } = await import(pathToFileURL(wrapperPath).href);
-    const { runSeedream: runOldSeedream } = await import(pathToFileURL(path.join(oldWrapper, "scripts/seedream.mjs")).href);
-    const api = await createFakeApi({
-        clientRootVersion: "1.1.10",
-        clientSkillVersion: "1.1.0",
-        dropPosts: 1,
-    });
-    try {
-        const options = {
-            sessionProvider: api.sessionProvider,
-            stateDirectory: path.join(tmp, "state"),
-            allowLoopbackTest: true,
-            retryDelayMs: 0,
-            timeoutMs: 1000,
-            maxPolls: 8,
-        };
-        const old = (args) => runOldSeedream(args, { ...options, trustedRootDirectory: oldRoot });
-        const next = (args) => runSeedream(args, { ...options, trustedRootDirectory: currentRoot });
-        await assert.rejects(runSeedream(["preflight"], { trustedRootDirectory: oldRoot }), /SETUP_REQUIRED/);
-        assert.equal((await old(["preflight"])).clientProtocol, 1);
-        const quote = await old(["quote", "A paper landscape", "1"]);
-        assert.equal(quote.requiresPaidConsent, true);
-        assert.equal(api.events.filter((event) => event.method === "POST")
-            .length, 0);
-        await assert.rejects(old(["submit", quote.quoteId]), {
-            code: "PAID_CONSENT_REQUIRED",
-        });
-        const accepted = await old(["submit", quote.quoteId, "--confirm"]);
-        assert.ok(accepted.runId);
-        const posts = api.events.filter((event) => event.method === "POST");
-        assert.equal(posts.length, 2);
-        assert.equal(new Set(posts.map((event) => event.key)).size, 1);
-        assert.equal(api.runs.size, 1);
-        api.options.dropPosts = 4;
-        const uncertainQuote = await old([
-            "quote",
-            "Uncertain paper landscape",
-            "1",
-        ]);
-        await assert.rejects(old(["submit", uncertainQuote.quoteId, "--confirm"]), {
-            code: "NETWORK_UNCERTAIN",
-        });
-        const uncertainPosts = api.events.filter((event) => event.method === "POST" && event.key === uncertainQuote.quoteId);
-        assert.equal(uncertainPosts.length, 3);
-        assert.equal(api.runs.size, 2);
-        api.setClientRootVersion("1.1.18");
-        api.setClientSkillVersion("1.1.3");
-        await assert.rejects(runOldSeedream(["preflight"], { trustedRootDirectory: currentRoot }), /SETUP_REQUIRED/);
-        await assert.rejects(currentClient.runCommand(["quote", "unsafe mix", "1"], {
-            ...options,
-            imageSkillDirectory: oldWrapper,
-        }), { code: "NO_LOCAL_IMPLEMENTATION" });
-        assert.equal((await next(["preflight"])).clientProtocol, 1);
-        const resumed = await next(["resume", quote.quoteId]);
-        assert.equal(resumed.runId, accepted.runId);
-        const recovered = await next(["resume", uncertainQuote.quoteId]);
-        assert.ok(recovered.runId);
-        assert.notEqual(recovered.runId, accepted.runId);
-        assert.equal(api.events.filter((event) => event.method === "POST" && event.key === uncertainQuote.quoteId).length, 4);
-        const completed = await next(["poll", accepted.runId]);
-        assert.equal(completed.status, "succeeded");
-        assert.equal(completed.usage.chargedCredits, 40);
-        const saved = await next([
-            "save",
-            accepted.runId,
-            path.join(tmp, "images"),
-        ]);
-        assert.equal(saved.files.length, 1);
-        assert.deepEqual(await readFile(saved.files[0].path), api.png);
-        assert.equal(api.runs.size, 2);
-        const newQuote = await next(["quote", "Another paper landscape", "1"]);
-        const newAccepted = await next(["submit", newQuote.quoteId, "--confirm"]);
-        assert.notEqual(newAccepted.runId, accepted.runId);
-        assert.equal((await next(["poll", newAccepted.runId])).status, "succeeded");
-        const newSaved = await next([
-            "save",
-            newAccepted.runId,
-            path.join(tmp, "new-images"),
-        ]);
-        assert.equal(newSaved.files.length, 1);
-        assert.deepEqual(await readFile(newSaved.files[0].path), api.png);
-        assert.equal(api.runs.size, 3);
-        // Production may remove this Skill from the active catalog while a
-        // previously accepted historical run remains queued. Reads must survive.
-        api.options.missingSkill = true;
-        const postCount = api.events.filter((event) => event.method === "POST").length;
-        assert.equal((await next(["resume", quote.quoteId])).runId, accepted.runId);
-        assert.equal((await next(["poll", accepted.runId])).status, "succeeded");
-        assert.equal((await next(["save", accepted.runId, path.join(tmp, "images")])).files
-            .length, 1);
-        await assert.rejects(next(["quote", "No new catalog entry", "1"]), {
-            code: "NO_LOCAL_IMPLEMENTATION",
-        });
-        assert.equal(api.events.filter((event) => event.method === "POST")
-            .length, postCount);
-        assert.deepEqual(api.failures, []);
-    }
-    finally {
-        await api.close();
-    }
-}, 30_000);

package/dist/windows-secure-store.integration.test.js

@@ -1,122 +0,0 @@
-import { spawn } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { existsSync } from "node:fs";
-import { mkdtemp, rm } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { expect, it } from "vitest";
-import { extractBundle, verifyBundle, verifyExtractedBundle, } from "./bundle.js";
-const workspace = path.resolve(import.meta.dirname, "../../..");
-const bundleFiles = {
-    archive: path.join(workspace, "packages/plugins/nggaigc-plugin-1.1.16.zip"),
-    manifest: path.join(workspace, "release/plugin-candidates/nggaigc-1.1.16/manifest.json"),
-    trust: path.join(workspace, "release/trust/skill-package-keys.v1.json"),
-};
-const signedCandidatePresent = Object.values(bundleFiles).every((file) => existsSync(file));
-function frame(value) {
-    const payload = Buffer.from(JSON.stringify(value));
-    const result = Buffer.allocUnsafe(payload.length + 4);
-    result.writeUInt32BE(payload.length, 0);
-    payload.copy(result, 4);
-    payload.fill(0);
-    return result;
-}
-async function runHelper(distribution, target, operation, input, expectedEpoch) {
-    const executable = path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-    const args = [
-        "-NoLogo",
-        "-NoProfile",
-        "-NonInteractive",
-        "-File",
-        path.join(distribution, "windows-credential.ps1"),
-        "-Distribution",
-        distribution,
-        "-Operation",
-        operation,
-        "-NodePath",
-        process.execPath,
-        "-Target",
-        target,
-    ];
-    if (expectedEpoch)
-        args.push("-ExpectedEpoch", expectedEpoch);
-    const child = spawn(executable, args, {
-        windowsHide: true,
-        stdio: ["pipe", "pipe", "pipe"],
-        env: {
-            SystemRoot: process.env.SystemRoot,
-            LOCALAPPDATA: process.env.LOCALAPPDATA,
-            USERPROFILE: process.env.USERPROFILE,
-            PATH: process.env.PATH,
-        },
-    });
-    const stdout = [];
-    const stderr = [];
-    child.stdout.on("data", (value) => stdout.push(Buffer.from(value)));
-    child.stderr.on("data", (value) => stderr.push(Buffer.from(value)));
-    child.stdin.end(input);
-    const code = await new Promise((resolve, reject) => {
-        child.once("error", reject);
-        child.once("exit", (value) => resolve(value ?? 1));
-    });
-    return {
-        code,
-        stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: Buffer.concat(stderr).toString("utf8"),
-        spawnargs: child.spawnargs,
-    };
-}
-it.skipIf(process.platform !== "win32" || !signedCandidatePresent)("stores a synthetic credential in Windows Credential Manager without leakage", async () => {
-    const root = await mkdtemp(path.join(os.tmpdir(), "nggaigc-cli-os-"));
-    const target = `NGGAIGC/Codex/test-${randomBytes(16).toString("hex")}`;
-    const credential = `ngg_v1_${randomBytes(32).toString("base64url")}`;
-    const observed = [];
-    let epoch;
-    try {
-        const verified = await verifyBundle(bundleFiles);
-        const extracted = path.join(root, "plugin");
-        await extractBundle(verified.archive, extracted, verified.sha256);
-        await verifyExtractedBundle(extracted, verified.files);
-        const distribution = path.join(extracted, "skills", "nggaigc", "scripts");
-        const preflight = await runHelper(distribution, target, "preflight");
-        observed.push(preflight);
-        expect(preflight.code).toBe(0);
-        const credentialFrame = frame({
-            schemaVersion: "ngg-credential-input/v1",
-            origin: "https://api.nggaigc.com",
-            token: credential,
-        });
-        const setup = await runHelper(distribution, target, "setup", credentialFrame);
-        credentialFrame.fill(0);
-        observed.push(setup);
-        expect(setup.code).toBe(0);
-        epoch = /"credentialEpoch":"([a-f0-9]{32})"/.exec(setup.stdout)?.[1];
-        expect(epoch).toMatch(/^[a-f0-9]{32}$/);
-        const status = await runHelper(distribution, target, "status");
-        observed.push(status);
-        expect(status.code).toBe(0);
-        expect(status.stdout).toContain(`"credentialEpoch":"${epoch}"`);
-        const commandFrame = frame({
-            schemaVersion: "nggaigc-command/v1",
-            args: ["preflight"],
-        });
-        const session = await runHelper(distribution, target, "session", commandFrame);
-        commandFrame.fill(0);
-        observed.push(session);
-        expect(session.code).toBe(0);
-        expect(session.stdout).toContain('"clientProtocol":1');
-    }
-    finally {
-        if (epoch) {
-            const distribution = path.join(root, "plugin", "skills", "nggaigc", "scripts");
-            observed.push(await runHelper(distribution, target, "delete-exact", undefined, epoch));
-        }
-        await rm(root, { recursive: true, force: true });
-    }
-    const combined = observed
-        .flatMap((result) => [result.stdout, result.stderr, ...result.spawnargs])
-        .join("\n");
-    expect(combined).not.toContain(credential);
-    expect(JSON.stringify(process.env)).not.toContain(credential);
-    expect(observed.at(-1)?.code).toBe(0);
-}, 120_000);