@nggaigc/cli 0.1.37 → 0.1.39

package/dist/bundle.js

@@ -47,7 +47,7 @@ export async function verifyBundle(input) {
             !exactKeys(manifestValue, manifestKeys) ||
             manifestValue.schemaVersion !== "nggaigc-plugin-package/v1" ||
             manifestValue.artifactId !== "plugin.nggaigc" ||
-            manifestValue.version !== "1.1.36" ||
+            manifestValue.version !== "1.1.38" ||
             manifestValue.artifactPath !==
                 `packages/plugins/nggaigc-plugin-${manifestValue.version}.zip` ||
             typeof manifestValue.sourceCommit !== "string" ||

package/dist/independent-skill.js

@@ -304,6 +304,55 @@ function storedZipEntries(input) {
         fail("PACKAGE_VERIFICATION_FAILED");
     return result;
 }
+function packageFileType(value) {
+    if (value === "SKILL.md" ||
+        /^references\/[A-Za-z0-9._/-]+\.(md|json)$/.test(value))
+        return "document";
+    if (/^assets\/[A-Za-z0-9._/-]+\.png$/.test(value))
+        return "png";
+    return undefined;
+}
+function validStaticPng(input) {
+    const bytes = Buffer.from(input);
+    if (bytes.length < 45 ||
+        !bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        return false;
+    let cursor = 8;
+    let chunks = 0;
+    let hasImageData = false;
+    while (cursor + 12 <= bytes.length) {
+        const length = bytes.readUInt32BE(cursor);
+        const end = cursor + 12 + length;
+        if (end > bytes.length)
+            return false;
+        const type = bytes.subarray(cursor + 4, cursor + 8);
+        if (!/^[A-Za-z]{4}$/.test(type.toString("ascii")))
+            return false;
+        if (crc32(bytes.subarray(cursor + 4, cursor + 8 + length)) !==
+            bytes.readUInt32BE(cursor + 8 + length))
+            return false;
+        const name = type.toString("ascii");
+        if (chunks === 0) {
+            if (name !== "IHDR" ||
+                length !== 13 ||
+                bytes.readUInt32BE(cursor + 8) === 0 ||
+                bytes.readUInt32BE(cursor + 12) === 0 ||
+                bytes[cursor + 18] !== 0 ||
+                bytes[cursor + 19] !== 0 ||
+                (bytes[cursor + 20] !== 0 && bytes[cursor + 20] !== 1))
+                return false;
+        }
+        if (name === "acTL" || name === "fcTL" || name === "fdAT")
+            return false;
+        if (name === "IDAT")
+            hasImageData = true;
+        if (name === "IEND")
+            return length === 0 && hasImageData && end === bytes.length;
+        chunks++;
+        cursor = end;
+    }
+    return false;
+}
 function decodePackage(bytes, entry, trust) {
     const metadata = entry.manifest.package;
     if (bytes.length !== metadata.sizeBytes ||
@@ -361,8 +410,7 @@ function decodePackage(bytes, entry, trust) {
             file.path
                 .split("/")
                 .some((part) => !part || part === "." || part === ".." || /[. ]$/.test(part)) ||
-            !(file.path === "SKILL.md" ||
-                /^references\/[A-Za-z0-9._/-]+\.(md|json)$/.test(file.path)))
+            !packageFileType(file.path))
             fail("PACKAGE_VERIFICATION_FAILED");
         const folded = file.path.toLowerCase();
         if (seen.has(folded) ||
@@ -377,7 +425,8 @@ function decodePackage(bytes, entry, trust) {
         total += content.length;
         if (total > MAX_PACKAGE_BYTES ||
             content.length !== file.sizeBytes ||
-            sha256(content) !== file.sha256)
+            sha256(content) !== file.sha256 ||
+            (packageFileType(file.path) === "png" && !validStaticPng(content)))
             fail("PACKAGE_VERIFICATION_FAILED");
     }
     if (!seen.has("skill.md") || archive.size !== payload.files.length + 1)
@@ -461,8 +510,7 @@ async function existingReceipt(target, entry, trust) {
             ].sort()))
             return false;
         for (const [name, digest] of Object.entries(receipt.files)) {
-            if (!(name === "SKILL.md" ||
-                /^references\/[A-Za-z0-9._/-]+\.(md|json)$/.test(name)) ||
+            if (!packageFileType(name) ||
                 name.split("/").some((part) => part === "." || part === ".."))
                 return false;
             const file = path.join(target, ...name.split("/"));

package/dist/install.js

@@ -8,7 +8,7 @@ import { CliError, fixedErrorCode } from "./errors.js";
 function defaultBundle() {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     return {
-        archive: path.join(vendor, "nggaigc-plugin-1.1.36.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.38.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     };

package/dist/skill-command.js

@@ -15,7 +15,7 @@ function record(value) {
 async function productionDependencies(codexHome) {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     const bundle = await verifyBundle({
-        archive: path.join(vendor, "nggaigc-plugin-1.1.36.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.38.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nggaigc/cli",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Secure one-command NGGAIGC Skill installer for Codex.",
   "type": "module",
   "bin": {

package/vendor/manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": "nggaigc-plugin-package/v1",
   "artifactId": "plugin.nggaigc",
-  "version": "1.1.36",
-  "sourceCommit": "6f8b05505e5823d90d962be2d7b7ff1913d19d62",
-  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.36.zip",
-  "sha256": "3221ab354d9ac540ab54133faabf2561913afa989bb92bbba22dfca456b02ba8",
-  "sizeBytes": 483026,
+  "version": "1.1.38",
+  "sourceCommit": "9510ed872ea6a4ae2747fe759f093700a865a199",
+  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.38.zip",
+  "sha256": "f62d297058c9647a1e7a429e0851ff076ac2266dee817d33a1c923704f9459bd",
+  "sizeBytes": 483669,
   "fileCount": 24,
   "platforms": [
     "win32-x64",
@@ -13,7 +13,7 @@
     "darwin-arm64"
   ],
   "files": {
-    ".codex-plugin/plugin.json": "04bf483961519381a5a6ead9dbf8d6c5c7fd9cc947fd5c12c7750233ab3b7dfa",
+    ".codex-plugin/plugin.json": "b63e76c4b5bcc7d4c6870585e5dfa45087767ad639ce38a8aca46b15a9b0e342",
     "installer/install.cjs": "a0c94ed71edf4cd7eb4a66609a4dcf73049abbd14aa273ee65b9b3029be2da2b",
     "installer/legacy-root-digests.json": "922552646a5aa6cff8616c372912a37b1d5f263351206b85785ed9b2eae31641",
     "installer/signed-pair-1.1.16.json": "ccb22a90302cc5c9c585067ebc211a27b0c9d8a177c2740a5678a58a3d70bfe9",
@@ -25,23 +25,23 @@
     "migration/seedream-1.1.3/SKILL.md": "5c5cf3c2d99376f246425e873c5566436ed528256372ac3208abb60364c4517c",
     "skills/nggaigc/agents/openai.yaml": "8936d97b9821e687e224e9349cc42be2ee5fc20988562efffbcb70080aedf87c",
     "skills/nggaigc/references/catalog-and-updates.md": "f6eee93f5f009f381c4e729cb129176e976edd4ec5c0990c300ac6096dd4ea83",
-    "skills/nggaigc/references/source.json": "f26725c09d456b5dd41fd7dab1e817ce6d64ab934ad7122eae4774c60ba87092",
+    "skills/nggaigc/references/source.json": "5f25202735e47df97fc95b2f7278ea46277d62c718b69a245e69f46b3e36430e",
     "skills/nggaigc/scripts/api_client.mjs": "bf3c671cec24e8ec80d227fdc7ce79c8051fddd21b80df67837ec724f1d8c0ae",
-    "skills/nggaigc/scripts/api_package.mjs": "30a712aed56d4767d8d200921528aa5b9d7778cc6f0f3886622cbe41550128e5",
-    "skills/nggaigc/scripts/bootstrap-public.json": "310df7aed701a622adca110dc04a19d4aec81468d5f0e7a7fcd0bb5e1336f35d",
-    "skills/nggaigc/scripts/launch-ngg-client.cjs": "8af1c1dca84660d0913557568442f7c6aab5fe3dec3f28c9adbeecfd7fcb836b",
+    "skills/nggaigc/scripts/api_package.mjs": "86ea20f08e74d19fe146edd29ea374240d2594c1ff1e9682d7918ced1ff6a51c",
+    "skills/nggaigc/scripts/bootstrap-public.json": "eafd308e30582098b9422123992194b8d0e87ab373472995f4e240734e329cd0",
+    "skills/nggaigc/scripts/launch-ngg-client.cjs": "645bab6956539d2d63aa8d6a21d6446cdb1ebf3b1f174cb9ec7bf4b76e7496d9",
     "skills/nggaigc/scripts/macos-keychain": "b0bdf29d14219d38ca18c7e5c599deb0daa8c8ac70b0babbc7d4fb23673079ec",
     "skills/nggaigc/scripts/macos-keychain.swift": "1b57e74fde66c824fe970547dd8ca0883a3334c34c065e85a8a2a90d4556a7f5",
-    "skills/nggaigc/scripts/ngg_client.mjs": "7eb08a5daa15fbf269c9f06cadddc13f549fb24a223d4b7c1126e3b81c945989",
-    "skills/nggaigc/scripts/ngg-session.mjs": "6ea1f8eb3381a3952dd4236a582ebaa99db27b1a74f2154514c6473e2df3a913",
+    "skills/nggaigc/scripts/ngg_client.mjs": "bea0bbc681d582420a891abb62f72283ffe5094f2428475043cff7b7c2782d8b",
+    "skills/nggaigc/scripts/ngg-session.mjs": "b15f924bb6bc2dc5c4dfdc4fcff40db2e4e5e7525b59c57f4709ab416b7e6be5",
     "skills/nggaigc/scripts/supported-platforms.json": "ec8b0754c489e04534a1d9880dd6664ba9c5bcd07789e06d138e0923f23575ff",
     "skills/nggaigc/scripts/windows-credential.ps1": "80d470fb0c9473d26bd599cafa9f1c2ad69056d4a835888ddcbb5c1548f9d059",
-    "skills/nggaigc/SKILL.md": "a76a0d418e65db91c2f5c1dce09b5878bee32856f06e05a9843b7bfbeade113f"
+    "skills/nggaigc/SKILL.md": "8128d8c38ec8051a664082f36c65e566a96d3a1927f40d5cf638dc928500fe03"
   },
   "signature": {
     "algorithm": "ed25519",
     "keyId": "ngg-signing-skill-release-1",
     "scope": "artifact-bytes",
-    "value": "ZeLYQwGGsvYXbAtK2AvmR/DzBnU685/Ldm/62HGN+R/jChZAVa6RbSCdshahT/L1pgorZqE2TMdoU0qPLeJdDQ=="
+    "value": "RR82intdBjioMS/q0sKy8kamHve7htCxlG0UpiiA7ayHeIfoiDLKLPKmaJjFfsv5NMPZYpPVijLW0liO4JxvAg=="
   }
 }