@nggaigc/cli 0.1.40 → 0.1.42

package/dist/bundle.js

@@ -47,7 +47,7 @@ export async function verifyBundle(input) {
             !exactKeys(manifestValue, manifestKeys) ||
             manifestValue.schemaVersion !== "nggaigc-plugin-package/v1" ||
             manifestValue.artifactId !== "plugin.nggaigc" ||
-            manifestValue.version !== "1.1.39" ||
+            manifestValue.version !== "1.1.41" ||
             manifestValue.artifactPath !==
                 `packages/plugins/nggaigc-plugin-${manifestValue.version}.zip` ||
             typeof manifestValue.sourceCommit !== "string" ||

package/dist/independent-skill.js

@@ -76,6 +76,68 @@ function resolve(index, id, version, rootVersion, platformVersion) {
         fail("CATALOG_INVALID");
     const state = new Map();
     const ordered = [];
+    const visitDependencies = (dependencies, projected = false) => {
+        if (!Array.isArray(dependencies) || dependencies.length > 16)
+            fail("DEPENDENCY_INVALID");
+        const unique = new Set();
+        for (const dependency of dependencies) {
+            if (!record(dependency) ||
+                typeof dependency.id !== "string" ||
+                typeof dependency.version !== "string" ||
+                !VERSION.test(dependency.version) ||
+                (!projected &&
+                    (dependency.required !== true ||
+                        !["skill", "capability"].includes(dependency.kind))))
+                fail("DEPENDENCY_INVALID");
+            const kind = projected || dependency.kind === "skill" ? "skill" : "capability";
+            const key = `${kind}:${dependency.id}@${dependency.version}`;
+            if (unique.has(key))
+                fail("DEPENDENCY_INVALID");
+            unique.add(key);
+            if (kind === "skill")
+                visit(dependency.id, dependency.version);
+            else
+                visitCapability(dependency.id, dependency.version);
+        }
+    };
+    const visitCapability = (capabilityId, requiredVersion) => {
+        if (!/^capability\.[a-z0-9][a-z0-9.-]{0,79}$/.test(capabilityId))
+            fail("DEPENDENCY_INVALID");
+        const matches = index.catalogEntries?.filter((entry) => entry.kind === "capability" &&
+            entry.id === capabilityId &&
+            entry.version === requiredVersion);
+        if (matches?.length !== 1)
+            fail("DEPENDENCY_UNAVAILABLE");
+        const entry = matches[0];
+        const key = `capability:${capabilityId}@${requiredVersion}`;
+        if (state.get(key) === "visiting")
+            fail("DEPENDENCY_CYCLE");
+        if (state.get(key) === "done")
+            return;
+        const manifest = entry.manifest;
+        if (!record(manifest) ||
+            manifest.kind !== "capability" ||
+            manifest.id !== capabilityId ||
+            manifest.version !== requiredVersion ||
+            !record(manifest.lifecycle) ||
+            manifest.lifecycle.status !== "published" ||
+            typeof entry.manifestSha256 !== "string" ||
+            !DIGEST.test(entry.manifestSha256) ||
+            sha256(canonical(manifest)) !== entry.manifestSha256)
+            fail("CATALOG_INVALID");
+        const compatibility = manifest.compatibility;
+        if (!record(compatibility) ||
+            !record(compatibility.platform) ||
+            typeof compatibility.platform.minimum !== "string" ||
+            typeof compatibility.platform.maximumExclusive !== "string" ||
+            !compatible(platformVersion, compatibility.platform))
+            fail("PACKAGE_INCOMPATIBLE");
+        if (state.size >= 32)
+            fail("DEPENDENCY_INVALID");
+        state.set(key, "visiting");
+        visitDependencies(manifest.dependencies);
+        state.set(key, "done");
+    };
     const visit = (skillId, requiredVersion) => {
         if (!ID.test(skillId))
             fail("CATALOG_INVALID");
@@ -84,7 +146,7 @@ function resolve(index, id, version, rootVersion, platformVersion) {
         if (matches.length !== 1)
             fail("DEPENDENCY_UNAVAILABLE");
         const entry = matches[0];
-        const key = `${entry.id}@${entry.version}`;
+        const key = `skill:${entry.id}@${entry.version}`;
         if (state.get(key) === "visiting")
             fail("DEPENDENCY_CYCLE");
         if (state.get(key) === "done")
@@ -105,18 +167,13 @@ function resolve(index, id, version, rootVersion, platformVersion) {
             !compatible(rootVersion, metadata.compatibility.rootSkill) ||
             !compatible(platformVersion, metadata.compatibility.platform))
             fail("PACKAGE_INCOMPATIBLE");
-        const dependencies = entry.manifest.requires;
-        if (!Array.isArray(dependencies) ||
-            dependencies.length > 16 ||
-            !dependencies.every((item) => record(item) &&
-                typeof item.id === "string" &&
-                typeof item.version === "string" &&
-                VERSION.test(item.version)) ||
-            ordered.length + state.size > 32)
+        if (state.size >= 32)
             fail("DEPENDENCY_INVALID");
         state.set(key, "visiting");
-        for (const dependency of dependencies)
-            visit(dependency.id, dependency.version);
+        const sourceDependencies = index.catalogEntries
+            ? entry.sourceManifest?.dependencies
+            : undefined;
+        visitDependencies(sourceDependencies ?? entry.manifest.requires, sourceDependencies === undefined);
         state.set(key, "done");
         ordered.push(entry);
     };
@@ -187,14 +244,6 @@ export function projectActiveSkillCatalog(snapshot) {
                 typeof dependency.version !== "string" ||
                 dependency.required !== true)
                 fail("DEPENDENCY_INVALID");
-            const matches = publicEntries.filter((candidate) => candidate.kind === dependency.kind &&
-                candidate.id === dependency.id &&
-                candidate.version === dependency.version &&
-                record(candidate.manifest) &&
-                record(candidate.manifest.lifecycle) &&
-                candidate.manifest.lifecycle.status === "published");
-            if (matches.length !== 1)
-                fail("DEPENDENCY_UNAVAILABLE");
             if (dependency.kind === "skill")
                 requires.push({ id: dependency.id, version: dependency.version });
             else if (dependency.kind !== "capability")
@@ -224,6 +273,7 @@ export function projectActiveSkillCatalog(snapshot) {
         schemaVersion: "nggaigc-independent-skill-index/v1",
         releaseId: snapshot.releaseId,
         entries,
+        catalogEntries: publicEntries,
     };
 }
 function storedZipEntries(input) {
@@ -315,7 +365,9 @@ function packageFileType(value) {
 function validStaticPng(input) {
     const bytes = Buffer.from(input);
     if (bytes.length < 45 ||
-        !bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        !bytes
+            .subarray(0, 8)
+            .equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
         return false;
     let cursor = 8;
     let chunks = 0;
@@ -759,6 +811,7 @@ export async function prepareIndependentSkill(options) {
         fail("INSTALL_PATH_UNSAFE");
     const fetcher = options.fetcher ?? fetch;
     let result;
+    const preparedSkills = [];
     for (const entry of ordered) {
         const slug = entry.id.slice("skill.".length);
         if (slug === "nggaigc")
@@ -785,6 +838,7 @@ export async function prepareIndependentSkill(options) {
                     skillPath: path.join(target, "SKILL.md"),
                     reused: true,
                 };
+                preparedSkills.push(result);
                 continue;
             }
             const bytes = await download(entry, options.index.releaseId, options.origin ?? "https://api.nggaigc.com/", fetcher);
@@ -842,6 +896,7 @@ export async function prepareIndependentSkill(options) {
                     skillPath: path.join(target, "SKILL.md"),
                     reused: false,
                 };
+                preparedSkills.push(result);
             }
             finally {
                 await rm(stage, { recursive: true, force: true });
@@ -852,7 +907,7 @@ export async function prepareIndependentSkill(options) {
             await rm(lock, { force: true });
         }
     }
-    return result;
+    return { ...result, preparedSkills };
 }
 /** Official start path: online server admission must precede any local preparation. */
 export async function startIndependentSkill(options) {

package/dist/install.js

@@ -8,7 +8,7 @@ import { CliError, fixedErrorCode } from "./errors.js";
 function defaultBundle() {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     return {
-        archive: path.join(vendor, "nggaigc-plugin-1.1.39.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.41.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     };

package/dist/skill-command.js

@@ -15,7 +15,7 @@ function record(value) {
 async function productionDependencies(codexHome) {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     const bundle = await verifyBundle({
-        archive: path.join(vendor, "nggaigc-plugin-1.1.39.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.41.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nggaigc/cli",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "description": "Secure one-command NGGAIGC Skill installer for Codex.",
   "type": "module",
   "bin": {

package/vendor/manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": "nggaigc-plugin-package/v1",
   "artifactId": "plugin.nggaigc",
-  "version": "1.1.39",
-  "sourceCommit": "770deaebd8c50d389420148ebcdbc28d6516e4eb",
-  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.39.zip",
-  "sha256": "5b9f9e8bd863b6587387ab04db847df2c270c64baa9a69b65b71b8ee80d236de",
-  "sizeBytes": 485465,
+  "version": "1.1.41",
+  "sourceCommit": "2b1c96010bd572ba2639c9eb68accadee8358c77",
+  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.41.zip",
+  "sha256": "6f61843f956767517192ef142a9155aca5c07949a30ce9a50072c1c4a4483396",
+  "sizeBytes": 486916,
   "fileCount": 24,
   "platforms": [
     "win32-x64",
@@ -13,7 +13,7 @@
     "darwin-arm64"
   ],
   "files": {
-    ".codex-plugin/plugin.json": "9b5a5a97017565ada98c4a41f5fa79f93f2f972489ed4d216a98a366ebd612eb",
+    ".codex-plugin/plugin.json": "76a1379c3bb048cce6eab41a44a27a1a9457682f0ffb2552bae70c7c47b24e73",
     "installer/install.cjs": "a0c94ed71edf4cd7eb4a66609a4dcf73049abbd14aa273ee65b9b3029be2da2b",
     "installer/legacy-root-digests.json": "922552646a5aa6cff8616c372912a37b1d5f263351206b85785ed9b2eae31641",
     "installer/signed-pair-1.1.16.json": "ccb22a90302cc5c9c585067ebc211a27b0c9d8a177c2740a5678a58a3d70bfe9",
@@ -24,24 +24,24 @@
     "migration/seedream-1.1.3/scripts/seedream.mjs": "dcc6af4d945790d9dfd7fac21c60934759d7ac2576a14507d0299f4833942a96",
     "migration/seedream-1.1.3/SKILL.md": "5c5cf3c2d99376f246425e873c5566436ed528256372ac3208abb60364c4517c",
     "skills/nggaigc/agents/openai.yaml": "8936d97b9821e687e224e9349cc42be2ee5fc20988562efffbcb70080aedf87c",
-    "skills/nggaigc/references/catalog-and-updates.md": "f6eee93f5f009f381c4e729cb129176e976edd4ec5c0990c300ac6096dd4ea83",
-    "skills/nggaigc/references/source.json": "78628a84a27ed234c96462351cc1663c8ae8d3ef2345fa396ed152545a3aec60",
+    "skills/nggaigc/references/catalog-and-updates.md": "d02773256fc4d2324415942bdc64593e768a49a4124f22eb7d3f74797f934c1e",
+    "skills/nggaigc/references/source.json": "d5792b6cca1440514ad294a2e7ceff34df52cfaf833eecf8d6e4edc56c16817f",
     "skills/nggaigc/scripts/api_client.mjs": "bf3c671cec24e8ec80d227fdc7ce79c8051fddd21b80df67837ec724f1d8c0ae",
     "skills/nggaigc/scripts/api_package.mjs": "880e3df0a2f750933c343f0393626d9a5b6e8ecac0622f171da2295c11d7655c",
-    "skills/nggaigc/scripts/bootstrap-public.json": "5452d0e77bdca7226664b27242fb856d1564d6ed20d8c86f0e12179373359924",
-    "skills/nggaigc/scripts/launch-ngg-client.cjs": "c4fe67117d1cb05e605a07c64294aa3b17861dd49b4c3db0fd62376501f7adba",
+    "skills/nggaigc/scripts/bootstrap-public.json": "b6bdee2accfbb23ee97c7434460cd822d56328d3e440c4d167b13cbdecc7b819",
+    "skills/nggaigc/scripts/launch-ngg-client.cjs": "645577f46057674f52c716de9740d9a851973bcc1dc427e14d144d88b1fd2887",
     "skills/nggaigc/scripts/macos-keychain": "b0bdf29d14219d38ca18c7e5c599deb0daa8c8ac70b0babbc7d4fb23673079ec",
     "skills/nggaigc/scripts/macos-keychain.swift": "1b57e74fde66c824fe970547dd8ca0883a3334c34c065e85a8a2a90d4556a7f5",
-    "skills/nggaigc/scripts/ngg_client.mjs": "1db706db152ec94bd628acf3031dfaec3493e6b60bb12b19a1846fa5dd3e30d7",
-    "skills/nggaigc/scripts/ngg-session.mjs": "1ccb868b9398432de9e846063bb080498af7a248d51cec34d256a8759c0bfbc7",
+    "skills/nggaigc/scripts/ngg_client.mjs": "aff899042271fd191ba30e55669c4463536daa8132095b77464e1714b97bccb5",
+    "skills/nggaigc/scripts/ngg-session.mjs": "2e7bf37e74ec14db6ab2d76fb181751d665c6df6696d6a77d1d9a7ace1daad9d",
     "skills/nggaigc/scripts/supported-platforms.json": "ec8b0754c489e04534a1d9880dd6664ba9c5bcd07789e06d138e0923f23575ff",
     "skills/nggaigc/scripts/windows-credential.ps1": "80d470fb0c9473d26bd599cafa9f1c2ad69056d4a835888ddcbb5c1548f9d059",
-    "skills/nggaigc/SKILL.md": "8128d8c38ec8051a664082f36c65e566a96d3a1927f40d5cf638dc928500fe03"
+    "skills/nggaigc/SKILL.md": "f6ccf3c685cb118ec6ec495da344a5e57ca69ea84d3e5d1f7cd817e5a594a52e"
   },
   "signature": {
     "algorithm": "ed25519",
     "keyId": "ngg-signing-skill-release-1",
     "scope": "artifact-bytes",
-    "value": "M4KsGUOCa2NBYWB6WZKzzeqlSBqcfsN+xVb+WvnXzAjEUfD1FN2soBlyNE/FBfGPv/LsVDJU26ZSU76PKD9oBA=="
+    "value": "v1dT1VZ0sNRCPFOoawgyI/ZlLcF53LbNpVbm2d4BSYM/CPqvvOA2av4mr+zTmzRGOi8VN2ZMLhxoEkreVbFgDg=="
   }
 }