@nggaigc/cli 0.1.43 → 0.1.45

package/README.md

@@ -1,6 +1,6 @@
 # @nggaigc/cli
 
-NGGAIGC Codex Skill 的一命令安装器。
+NGGAIGC Skill 的受信安装器，默认安装目标仍为 Codex。
 
 ```powershell
 npx --yes @nggaigc/cli@latest install
@@ -11,3 +11,23 @@ npx --yes @nggaigc/cli@latest install
 CLI 保留 macOS npm symlink 入口与 packed-TGZ launcher 检查，并验证随包的已签名 Plugin；实际版本以包内签名清单为准。支持 Windows x64/arm64 与 Apple 芯片 Mac arm64，使用本机 Node.js 22.x（22.13 起）或 24.x，不下载或内嵌 Node.js。Windows PowerShell 5.1 默认 `Restricted` 时，安装器仅为受信凭据辅助脚本的子进程指定 `RemoteSigned`；不修改系统或用户执行策略。安装成功但连接失败会明确分开报告，无需重装；由于系统 URL 处理器退出码不能证明浏览器窗口已显示，安装器会同时给出短期一次性手动授权链接。
 
 macOS arm64 辅助程序沿用已签名 Plugin 中通过完整性校验的字节；Intel Mac 不在支持范围内。实际公开版本和 `@latest` 状态以 npm registry 为准，Apple Silicon 真机验收需单独进行。
+
+## 跨 Agent 目标（0.1.45 起）
+
+下列目标参数与 `client` 桥要求 CLI 0.1.45 或更高版本。旧版本不支持新参数；`@latest` 的实际可用版本以 npm registry 与对应签名制品为准。
+
+```text
+npx --yes @nggaigc/cli@latest install --agent workbuddy
+npx --yes @nggaigc/cli@latest install --agent universal --no-login
+npx --yes @nggaigc/cli@latest install --skills-dir "/absolute/project/.codebuddy/skills" --no-login
+npx --yes @nggaigc/cli@latest start-skill skill.<id> [version] --skills-dir "/absolute/project/.codebuddy/skills"
+npx --yes @nggaigc/cli@latest client --skills-dir "/absolute/project/.codebuddy/skills" -- <原command> <原args>
+```
+
+`install`、`start-skill` 和 `client` 支持互斥的 `--agent codex|workbuddy|universal` 或 `--skills-dir <绝对目录>`。未指定目标时仍安装至 Codex 的 `CODEX_HOME/skills`，未设置 `CODEX_HOME` 时为 `~/.codex/skills`。WorkBuddy 使用官方兼容配置目录 `~/.codebuddy/skills`；universal 使用 `~/.agents/skills`，不保证所有 Agent 自动识别。明确目录可用于宿主项目级技能路径。`--no-login` 仅跳过安装后的登录，不绕过签名、哈希、路径检查或后续鉴权。
+
+根 Skill 按实际读取的 `SKILL.md` 定位父目录及其上一级 `skillsDirectory`；后续升级与 `start-skill` 显式使用同一目录。准备回执增加 `skillsDirectory`、`rootLauncherPath`，保留 `preparedSkills`；宿主应显式读取返回的真实路径。独立包的原客户端调用使用回执的受信根启动器；`client` 是同目录根包验签桥，保留原命令／参数，不增加 API 专用业务分支。安装新包不证明当前宿主热加载，必要时开启新会话。
+
+本地技能包导入可能复制文件，需核导入后的实际路径和独立包同级关系。交互使用宿主可用的提问工具或当前聊天，交付使用宿主可用的媒体／附件能力；不依赖 Codex 专用工具。切换宿主继续复用当前系统用户的系统凭证库和任务历史，不迁移凭据、不要求重新粘贴密钥。资金、权限与未知结果同幂等键恢复规则不变。
+
+此功能不增加 Linux、Intel Mac 支持，也不代表已接入或认证 WorkBuddy 官方连接器市场；现有系统、Node.js 与正式发布门禁保持适用。

package/dist/bundle.js

@@ -47,7 +47,7 @@ export async function verifyBundle(input) {
             !exactKeys(manifestValue, manifestKeys) ||
             manifestValue.schemaVersion !== "nggaigc-plugin-package/v1" ||
             manifestValue.artifactId !== "plugin.nggaigc" ||
-            manifestValue.version !== "1.1.42" ||
+            manifestValue.version !== "1.1.44" ||
             manifestValue.artifactPath !==
                 `packages/plugins/nggaigc-plugin-${manifestValue.version}.zip` ||
             typeof manifestValue.sourceCommit !== "string" ||

package/dist/independent-skill.js

@@ -1,6 +1,7 @@
 import { createHash, createPublicKey, randomUUID, verify } from "node:crypto";
-import { open, lstat, mkdir, readFile, readdir, rename, rm, writeFile, } from "node:fs/promises";
+import { open, lstat, mkdir, readFile, readdir, realpath, rename, rm, writeFile, } from "node:fs/promises";
 import path from "node:path";
+import { resolveSkillLocation, stateDirectoryForSkills, } from "./skill-location.js";
 const ID = /^skill\.[a-z0-9][a-z0-9.-]{0,79}$/;
 const VERSION = /^\d+\.\d+\.\d+$/;
 const DIGEST = /^[a-f0-9]{64}$/;
@@ -17,6 +18,33 @@ export class IndependentSkillError extends Error {
 function fail(code) {
     throw new IndependentSkillError(code);
 }
+async function independentLocation(options, create = false) {
+    // Missing programmatic arguments must not select the user's real home.
+    if (options.codexHome === undefined &&
+        options.skillsDirectory === undefined &&
+        options.agent === undefined)
+        fail("INSTALL_PATH_UNSAFE");
+    try {
+        const selected = resolveSkillLocation(options).skillsDirectory;
+        if (await hasLinkedPathComponent(selected, create))
+            fail("INSTALL_PATH_UNSAFE");
+        if (create)
+            await mkdir(selected, { recursive: true });
+        // One physical target must use one journal, including case aliases on
+        // case-insensitive disks. Check links before resolving the actual casing.
+        const skillsDirectory = await realpath(selected);
+        const legacyDirectory = await realpath(path.join(path.dirname(skillsDirectory), "skills")).catch(() => null);
+        return {
+            skillsDirectory,
+            stateDirectory: legacyDirectory === skillsDirectory
+                ? path.join(path.dirname(skillsDirectory), ".nggaigc-managed")
+                : stateDirectoryForSkills(skillsDirectory),
+        };
+    }
+    catch {
+        return fail("INSTALL_PATH_UNSAFE");
+    }
+}
 async function hasLinkedPathComponent(value, allowMissing = false) {
     const absolute = path.resolve(value);
     const root = path.parse(absolute).root;
@@ -795,10 +823,7 @@ async function acquireInstallLock(lock) {
 }
 export async function prepareIndependentSkill(options) {
     const ordered = resolve(options.index, options.skillId, options.skillVersion, options.rootSkillVersion, options.platformVersion);
-    if (!path.isAbsolute(options.codexHome))
-        fail("INSTALL_PATH_UNSAFE");
-    const skillsRoot = path.join(options.codexHome, "skills");
-    const stateRoot = path.join(options.codexHome, ".nggaigc-managed");
+    const { skillsDirectory: skillsRoot, stateDirectory: stateRoot } = await independentLocation(options, true);
     if (await hasLinkedPathComponent(skillsRoot, true).catch(() => true))
         fail("INSTALL_PATH_UNSAFE");
     if (await hasLinkedPathComponent(stateRoot, true).catch(() => true))
@@ -943,10 +968,7 @@ export async function rollbackIndependentSkill(options) {
         entry.version === options.installedVersion);
     if (!current)
         fail("ROLLBACK_UNAVAILABLE");
-    if (!path.isAbsolute(options.codexHome))
-        fail("INSTALL_PATH_UNSAFE");
-    const skillsRoot = path.join(options.codexHome, "skills");
-    const stateRoot = path.join(options.codexHome, ".nggaigc-managed");
+    const { skillsDirectory: skillsRoot, stateDirectory: stateRoot } = await independentLocation(options);
     if (await hasLinkedPathComponent(skillsRoot).catch(() => true))
         fail("INSTALL_PATH_UNSAFE");
     if (await hasLinkedPathComponent(stateRoot).catch(() => true))

package/dist/install.js

@@ -5,10 +5,11 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { extractBundle, verifyBundle, verifyExtractedBundle, verifyInstalledSkill, } from "./bundle.js";
 import { CliError, fixedErrorCode } from "./errors.js";
+import { resolveSkillLocation, } from "./skill-location.js";
 function defaultBundle() {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     return {
-        archive: path.join(vendor, "nggaigc-plugin-1.1.42.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.44.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     };
@@ -59,11 +60,11 @@ async function installedVersion(target) {
         return undefined;
     }
 }
-async function installSkill(installer, source, profile, codexHome, expectedVersion, bundleFiles) {
-    const target = path.join(codexHome, "skills", "nggaigc");
+async function installSkill(installer, source, profile, skillsDirectory, expectedVersion, bundleFiles) {
+    const target = path.join(skillsDirectory, "nggaigc");
     try {
         const result = await installer.main(["install", "--profile", profile], {
-            codexHome,
+            skillsDirectory,
             source,
         });
         if (result.status !== "installed" || result.version !== expectedVersion)
@@ -84,7 +85,7 @@ async function installSkill(installer, source, profile, codexHome, expectedVersi
     }
     try {
         const result = await installer.main(["update", "--profile", profile], {
-            codexHome,
+            skillsDirectory,
             source,
         });
         if (result.status !== "updated" || result.version !== expectedVersion)
@@ -180,9 +181,7 @@ function assertDisposableRoot(value, expectedParent) {
 export async function runInstall(options = {}) {
     validateRuntime(options.platform ?? process.platform, options.architecture ?? process.arch);
     const profile = safeProfile(options.profile ?? os.homedir());
-    const codexHome = safeProfile(options.codexHome ??
-        (options.profile ? undefined : process.env.CODEX_HOME) ??
-        path.join(profile, ".codex"));
+    const { skillsDirectory } = resolveSkillLocation(options);
     const report = options.reporter ?? (() => undefined);
     report("verifying");
     const bundle = await verifyBundle(options.bundle ?? defaultBundle());
@@ -200,8 +199,10 @@ export async function runInstall(options = {}) {
         const installer = require(path.join(extracted, "installer", "install.cjs"));
         if (!installer || typeof installer.main !== "function")
             throw new CliError("INSTALLATION_FAILED");
-        const installation = await installSkill(installer, path.join(extracted, "skills", "nggaigc"), profile, codexHome, bundle.version, bundle.files);
-        const installedScripts = path.join(codexHome, "skills", "nggaigc", "scripts");
+        const installation = await installSkill(installer, path.join(extracted, "skills", "nggaigc"), profile, skillsDirectory, bundle.version, bundle.files);
+        const installedScripts = path.join(skillsDirectory, "nggaigc", "scripts");
+        if (options.connect === false)
+            return { status: "installed", installation, version: bundle.version };
         const launcher = require(path.join(installedScripts, "launch-ngg-client.cjs"));
         if (!launcher ||
             typeof launcher.main !== "function" ||

package/dist/main.js

@@ -1,6 +1,8 @@
+import path from "node:path";
 import { CliError, fixedErrorCode } from "./errors.js";
 import { runInstall } from "./install.js";
-import { runSkillStartCommand, } from "./skill-command.js";
+import { runSkillStartCommand, runClientCommand, } from "./skill-command.js";
+import { parseSkillLocation, resolveSkillLocation } from "./skill-location.js";
 const messages = {
     authorizing: "浏览器已成功启动，请在 NGGAIGC 页面确认连接…",
     connected: "NGGAIGC Skill 已安装，设备连接验证成功。",
@@ -11,14 +13,14 @@ const messages = {
 };
 const errorMessages = {
     ARCHIVE_EXTRACTION_FAILED: "安装包无法安全解压，请稍后重试。",
-    BROWSER_AUTHORIZATION_FAILED: "网页授权未完成；请在新 Codex 任务中调用 NGGAIGC 继续连接，无需重装。",
-    BROWSER_OPEN_FAILED: "系统未能打开默认浏览器，也无法提供手动授权入口；请在新 Codex 任务中调用 NGGAIGC 重试连接，无需重装。",
-    CONNECTION_VERIFICATION_FAILED: "设备连接验证未完成；请在新 Codex 任务中检查连接状态，无需重装。",
+    BROWSER_AUTHORIZATION_FAILED: "网页授权未完成；请在当前 Agent 中调用 NGGAIGC 继续连接，无需重装。",
+    BROWSER_OPEN_FAILED: "系统未能打开默认浏览器，也无法提供手动授权入口；请在当前 Agent 中调用 NGGAIGC 重试连接，无需重装。",
+    CONNECTION_VERIFICATION_FAILED: "设备连接验证未完成；请在当前 Agent 中检查连接状态，无需重装。",
     POWERSHELL_EXECUTION_POLICY_BLOCKED: "Windows 脚本执行受到系统或组织策略限制，设备连接未完成。安装器没有更改执行策略。",
     INSTALLATION_FAILED: "本地安装未完成，请检查现有文件状态后重试。",
     SKILL_PAIR_UPGRADE_REQUIRED: "检测到无法安全配套迁移的本地 Seedream Skill，已停止升级。请保留旧 Skill 和任务文件并联系支持。",
     SKILL_PAIR_RECOVERY_REQUIRED: "检测到本地组合安装中断或目录变化，已停止自动操作。请保留相关目录和任务文件并联系支持。",
-    INVALID_INPUT: "命令格式无效。请使用 install，或 start-skill skill.<id> [version]。",
+    INVALID_INPUT: "命令格式无效。使用 --help 查看 install、start-skill 和 client 的目录选项。",
     PACKAGE_VERIFICATION_FAILED: "安装包签名或完整性验证失败，已停止安装。",
     RUNTIME_UNSUPPORTED: "请使用 Node.js 22.x（22.13 起）或 24.x 版本。",
     UNSUPPORTED_PLATFORM: "当前系统或架构尚未获得此签名安装包支持，请使用已支持的平台。",
@@ -26,9 +28,59 @@ const errorMessages = {
 export async function main(args, runtime = {}) {
     const output = runtime.output ?? ((line) => process.stdout.write(line));
     const errorOutput = runtime.error ?? ((line) => process.stderr.write(line));
-    if (args[0] === "start-skill" && (args.length === 2 || args.length === 3)) {
+    if (args.length === 1 && ["--help", "-h", "help"].includes(args[0])) {
+        output([
+            "NGGAIGC CLI",
+            "install [--agent codex|workbuddy|universal | --skills-dir <absolute-directory>] [--no-login]",
+            "start-skill skill.<id> [version] [--agent codex|workbuddy|universal | --skills-dir <absolute-directory>]",
+            "client [--agent codex|workbuddy|universal | --skills-dir <absolute-directory>] -- <command> [arguments]",
+            "Default: Codex (existing CODEX_HOME is preserved). WorkBuddy: ~/.codebuddy/skills; universal: ~/.agents/skills.",
+            "Use the same target for install and subsequent commands. --no-login installs verified files without opening a browser.",
+            "client examples: -- status, -- login, -- account-status, -- workflows, -- history, -- disconnect",
+            "",
+        ].join("\n"));
+        return 0;
+    }
+    if (args[0] === "client") {
+        const controller = new AbortController();
+        const interrupt = () => controller.abort();
+        try {
+            const separator = args.indexOf("--");
+            if (separator < 1 || separator === args.length - 1)
+                throw new CliError("INVALID_INPUT");
+            const { location, positional } = parseSkillLocation(args.slice(1, separator));
+            if (positional.length)
+                throw new CliError("INVALID_INPUT");
+            process.once("SIGINT", interrupt);
+            const result = await (runtime.client ?? runClientCommand)(args.slice(separator + 1), location, {
+                signal: controller.signal,
+                browserManualLink: (url) => errorOutput(`如果没有看到授权网页，请在本机浏览器打开此一次性链接；不要转发或保存：\n${url}\n`),
+                browserFallback: (url) => errorOutput(`浏览器未能自动打开，请在本机手动打开此一次性链接；不要转发或保存：\n${url}\n`),
+            });
+            output(`${JSON.stringify(result)}\n`);
+            return 0;
+        }
+        catch (error) {
+            errorOutput(`${JSON.stringify({ error: { code: fixedErrorCode(error) ?? "CLIENT_UNAVAILABLE" } })}\n`);
+            return 1;
+        }
+        finally {
+            process.off("SIGINT", interrupt);
+        }
+    }
+    let parsed;
+    try {
+        parsed = parseSkillLocation(args.slice(1));
+    }
+    catch {
+        errorOutput(`${errorMessages.INVALID_INPUT}\n`);
+        return 1;
+    }
+    const parameters = parsed.positional;
+    if (args[0] === "start-skill" &&
+        (parameters.length === 1 || parameters.length === 2)) {
         try {
-            const result = await (runtime.startSkill ?? runSkillStartCommand)(args[1], args[2], runtime.skillOptions);
+            const result = await (runtime.startSkill ?? runSkillStartCommand)(parameters[0], parameters[1], { ...runtime.skillOptions, ...parsed.location });
             output(`${JSON.stringify({ status: "ready", ...result })}\n`);
             return 0;
         }
@@ -38,12 +90,16 @@ export async function main(args, runtime = {}) {
             return 1;
         }
     }
-    if (args.length !== 1 || args[0] !== "install") {
+    if (args[0] !== "install" ||
+        !(parameters.length === 0 ||
+            (parameters.length === 1 && parameters[0] === "--no-login"))) {
         errorOutput(`${errorMessages.INVALID_INPUT}\n`);
         return 1;
     }
     try {
         const result = await (runtime.install ?? runInstall)({
+            ...parsed.location,
+            ...(parameters[0] === "--no-login" ? { connect: false } : {}),
             reporter: (event) => output(`${messages[event]}\n`),
             launcherOptionsFactory: () => ({
                 browserManualLink: (url) => {
@@ -57,9 +113,14 @@ export async function main(args, runtime = {}) {
             }),
         });
         if (result.status === "installed-unconnected") {
-            errorOutput(`NGGAIGC Skill ${result.version} 文件已${result.installation === "unchanged" ? "存在" : "安装"}，但设备尚未连接。${errorMessages[result.connectionError] ?? "请在新 Codex 任务中检查连接状态。"}\n`);
+            errorOutput(`NGGAIGC Skill ${result.version} 文件已${result.installation === "unchanged" ? "存在" : "安装"}，但设备尚未连接。${errorMessages[result.connectionError] ?? "请在当前 Agent 中检查连接状态。"}\n`);
             return 2;
         }
+        if (result.status === "installed" ||
+            Object.keys(parsed.location).length > 0) {
+            const { skillsDirectory } = resolveSkillLocation(parsed.location);
+            output(`${JSON.stringify({ ...result, skillsDirectory, skillPath: path.join(skillsDirectory, "nggaigc", "SKILL.md") })}\n`);
+        }
         return 0;
     }
     catch (error) {

package/dist/skill-command.js

@@ -1,9 +1,9 @@
 import { createHash, createPublicKey } from "node:crypto";
 import { readFile, realpath } from "node:fs/promises";
 import { createRequire } from "node:module";
-import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { resolveSkillLocation, } from "./skill-location.js";
 import { trustedKeyId, trustedKeySpkiSha256, verifyBundle, verifyInstalledSkill, } from "./bundle.js";
 import { IndependentSkillError, projectActiveSkillCatalog, startIndependentSkill, } from "./independent-skill.js";
 function fail(code) {
@@ -12,14 +12,14 @@ function fail(code) {
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-async function productionDependencies(codexHome) {
+export async function productionDependencies(skillsDirectory) {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     const bundle = await verifyBundle({
-        archive: path.join(vendor, "nggaigc-plugin-1.1.42.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.44.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     });
-    const root = path.join(codexHome, "skills", "nggaigc");
+    const root = path.join(skillsDirectory, "nggaigc");
     await verifyInstalledSkill(root, bundle.files);
     const source = JSON.parse(await readFile(path.join(root, "references", "source.json"), "utf8"));
     if (!record(source) ||
@@ -58,24 +58,28 @@ async function productionDependencies(codexHome) {
         rootSkillVersion: source.version,
     };
 }
+/** Generic bridge only: the verified launcher owns command and API contracts. */
+export async function runClientCommand(args, options = {}, launcherOptions = {}) {
+    if (args.length === 0)
+        fail("INVALID_INPUT");
+    const { skillsDirectory } = resolveSkillLocation(options);
+    const { launcher } = await productionDependencies(skillsDirectory);
+    return launcher.main(args, launcherOptions);
+}
 /** Candidate npm entry: active catalog → server admission → verified local Skill path. */
 export async function runSkillStartCommand(skillId, skillVersion, options = {}) {
     if (!/^skill\.[a-z0-9][a-z0-9.-]{0,79}$/.test(skillId) ||
         (skillVersion !== undefined && !/^\d+\.\d+\.\d+$/.test(skillVersion)))
         fail("INVALID_INPUT");
-    const configuredCodexHome = path.resolve(options.codexHome ??
-        process.env.CODEX_HOME ??
-        path.join(os.homedir(), ".codex"));
-    if (!path.isAbsolute(configuredCodexHome))
-        fail("INSTALL_PATH_UNSAFE");
-    const codexHome = process.platform === "win32"
-        ? await realpath(configuredCodexHome).catch((error) => record(error) && error.code === "ENOENT"
-            ? configuredCodexHome
+    const configuredDirectory = resolveSkillLocation(options).skillsDirectory;
+    const skillsDirectory = process.platform === "win32"
+        ? await realpath(configuredDirectory).catch((error) => record(error) && error.code === "ENOENT"
+            ? configuredDirectory
             : fail("INSTALL_PATH_UNSAFE"))
-        : configuredCodexHome;
+        : configuredDirectory;
     const production = options.launcher && options.trust && options.rootSkillVersion
         ? null
-        : await productionDependencies(codexHome);
+        : await productionDependencies(skillsDirectory);
     const launcher = options.launcher ?? production.launcher;
     const trust = options.trust ?? production.trust;
     const rootSkillVersion = options.rootSkillVersion ?? production.rootSkillVersion;
@@ -96,13 +100,13 @@ export async function runSkillStartCommand(skillId, skillVersion, options = {})
     if (matches.length !== 1)
         fail("SKILL_UNAVAILABLE");
     const selected = matches[0];
-    return startIndependentSkill({
+    const result = await startIndependentSkill({
         index,
         skillId: selected.id,
         skillVersion: selected.version,
         rootSkillVersion,
         platformVersion,
-        codexHome,
+        skillsDirectory,
         trust,
         fetcher: options.fetcher,
         admit: async (identity) => {
@@ -117,4 +121,9 @@ export async function runSkillStartCommand(skillId, skillVersion, options = {})
             return answer;
         },
     });
+    return {
+        ...result,
+        skillsDirectory,
+        rootLauncherPath: path.join(skillsDirectory, "nggaigc", "scripts", "launch-ngg-client.cjs"),
+    };
 }

package/dist/skill-location.js

@@ -0,0 +1,69 @@
+import os from "node:os";
+import path from "node:path";
+import { CliError } from "./errors.js";
+export function absoluteDirectory(value) {
+    if (!path.isAbsolute(value) || /[\0\r\n]/u.test(value))
+        throw new CliError("INVALID_INPUT");
+    const resolved = path.resolve(value);
+    if (resolved === path.parse(resolved).root)
+        throw new CliError("INVALID_INPUT");
+    return resolved;
+}
+export function stateDirectoryForSkills(skillsDirectory) {
+    // Preserve existing */skills journals. Other targets use a different leaf:
+    // /x and /x/skills must never share backups or installation locks.
+    return path.basename(skillsDirectory) === "skills"
+        ? path.join(path.dirname(skillsDirectory), ".nggaigc-managed")
+        : path.join(skillsDirectory, ".nggaigc-managed", "custom-target");
+}
+/** One explicit location for root installation and every dependent Skill. */
+export function resolveSkillLocation(options = {}, environment = process.env) {
+    if ([options.agent, options.skillsDirectory, options.codexHome].filter((value) => value !== undefined).length > 1)
+        throw new CliError("INVALID_INPUT");
+    if (options.skillsDirectory !== undefined) {
+        const skillsDirectory = absoluteDirectory(options.skillsDirectory);
+        return {
+            skillsDirectory,
+            stateDirectory: stateDirectoryForSkills(skillsDirectory),
+        };
+    }
+    const profile = absoluteDirectory(options.profile ?? os.homedir());
+    const agent = options.agent ?? "codex";
+    if (!["codex", "workbuddy", "universal"].includes(agent))
+        throw new CliError("INVALID_INPUT");
+    const home = absoluteDirectory(options.codexHome ??
+        (agent === "codex"
+            ? ((options.profile === undefined
+                ? environment.CODEX_HOME
+                : undefined) ?? path.join(profile, ".codex"))
+            : path.join(profile, agent === "workbuddy" ? ".codebuddy" : ".agents")));
+    return {
+        skillsDirectory: path.join(home, "skills"),
+        // Explicit and named-host calls for the same directory share one journal.
+        stateDirectory: stateDirectoryForSkills(path.join(home, "skills")),
+    };
+}
+export function parseSkillLocation(args) {
+    const location = {};
+    const positional = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const value = args[index];
+        if (value !== "--agent" && value !== "--skills-dir") {
+            positional.push(value);
+            continue;
+        }
+        if (location.agent !== undefined || location.skillsDirectory !== undefined)
+            throw new CliError("INVALID_INPUT");
+        const argument = args[++index];
+        if (!argument || argument.startsWith("--"))
+            throw new CliError("INVALID_INPUT");
+        if (value === "--agent") {
+            if (!["codex", "workbuddy", "universal"].includes(argument))
+                throw new CliError("INVALID_INPUT");
+            location.agent = argument;
+        }
+        else
+            location.skillsDirectory = absoluteDirectory(argument);
+    }
+    return { location, positional };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nggaigc/cli",
-  "version": "0.1.43",
-  "description": "Secure one-command NGGAIGC Skill installer for Codex.",
+  "version": "0.1.45",
+  "description": "Secure NGGAIGC Skill installer for Codex, WorkBuddy and compatible agents.",
   "type": "module",
   "bin": {
     "nggaigc": "dist/bin.js"

package/vendor/manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": "nggaigc-plugin-package/v1",
   "artifactId": "plugin.nggaigc",
-  "version": "1.1.42",
-  "sourceCommit": "27582fb9f56276e7f80f2681795fb70a35d5f547",
-  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.42.zip",
-  "sha256": "d7520abf2754fcc48e663b42a581c222591af33d8de099015ca9aed17ff22a7e",
-  "sizeBytes": 493914,
+  "version": "1.1.44",
+  "sourceCommit": "daa6585bd3c9c57b77a92ac452a866566efe546c",
+  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.44.zip",
+  "sha256": "d3e9c98a65df60f9ffb6426e60341a3c621a62e1779a172f6d7939023be7fb16",
+  "sizeBytes": 498924,
   "fileCount": 24,
   "platforms": [
     "win32-x64",
@@ -13,8 +13,8 @@
     "darwin-arm64"
   ],
   "files": {
-    ".codex-plugin/plugin.json": "8bb8627e1a56f869d77811358c0223d990439dea64fefea6aaeb6b9c3edb8971",
-    "installer/install.cjs": "a0c94ed71edf4cd7eb4a66609a4dcf73049abbd14aa273ee65b9b3029be2da2b",
+    ".codex-plugin/plugin.json": "44ffcd18f569942856d9b955dacca52dd7559972ba7e42ca5c875084b7c36bb8",
+    "installer/install.cjs": "76f4ed73233fd39900fb0bedbc434dea39e52e6b6b4622f3fd388a5ca09c6f62",
     "installer/legacy-root-digests.json": "922552646a5aa6cff8616c372912a37b1d5f263351206b85785ed9b2eae31641",
     "installer/signed-pair-1.1.16.json": "ccb22a90302cc5c9c585067ebc211a27b0c9d8a177c2740a5678a58a3d70bfe9",
     "installer/signed-pair-1.1.17.json": "a3697506c929aaa085a6d994fc3a1b9a87e522ec6e1e32f3f760e6a534effa2b",
@@ -24,24 +24,24 @@
     "migration/seedream-1.1.3/scripts/seedream.mjs": "dcc6af4d945790d9dfd7fac21c60934759d7ac2576a14507d0299f4833942a96",
     "migration/seedream-1.1.3/SKILL.md": "5c5cf3c2d99376f246425e873c5566436ed528256372ac3208abb60364c4517c",
     "skills/nggaigc/agents/openai.yaml": "8936d97b9821e687e224e9349cc42be2ee5fc20988562efffbcb70080aedf87c",
-    "skills/nggaigc/references/catalog-and-updates.md": "d02773256fc4d2324415942bdc64593e768a49a4124f22eb7d3f74797f934c1e",
-    "skills/nggaigc/references/source.json": "02cb7319bdb554391d96fa292910b41e26bfc3ed78cab12cb283d94870399769",
+    "skills/nggaigc/references/catalog-and-updates.md": "990abe5d4e6d34283ad957a372e1892fda2dc1620aa2fb6c5adca28ad3727d89",
+    "skills/nggaigc/references/source.json": "49025cea97197ff8644448fe35d54addc2f27154f8dfeb7791099badcba28ee8",
     "skills/nggaigc/scripts/api_client.mjs": "e16bf750a297ef7e88e4843d2fba9c33b412a66516bfe76822d7deec6c153069",
-    "skills/nggaigc/scripts/api_package.mjs": "59fe904544a474ee9803bb390f1f60d9ab0c0ff2efb0539653e966fe01770147",
-    "skills/nggaigc/scripts/bootstrap-public.json": "421e13235116fd515dc9b861f12ad9ea1ae4acc65aa96f893f40397d94ac8f6c",
-    "skills/nggaigc/scripts/launch-ngg-client.cjs": "17a9d33636b849413a1dca0ead1373f341a746ff2fcb7f55d33fbb67f3cd87fc",
+    "skills/nggaigc/scripts/api_package.mjs": "6beee22aed770cbf501abe6d1d9d252f7a53893eeb9b6399bd26c4ef68470d5a",
+    "skills/nggaigc/scripts/bootstrap-public.json": "67bc46ee22771782b2186613ecb5ef04ec813e2ce68d5365eb42012703edad94",
+    "skills/nggaigc/scripts/launch-ngg-client.cjs": "c9295fa3838015d0614cb663a1419e3965ed673b87bba42856828ef8bcf1ade9",
     "skills/nggaigc/scripts/macos-keychain": "b0bdf29d14219d38ca18c7e5c599deb0daa8c8ac70b0babbc7d4fb23673079ec",
     "skills/nggaigc/scripts/macos-keychain.swift": "1b57e74fde66c824fe970547dd8ca0883a3334c34c065e85a8a2a90d4556a7f5",
-    "skills/nggaigc/scripts/ngg_client.mjs": "fd32ab06fd7cac41a4a7de69f13048f1668393aa580e1ed4692fc8befa58be6d",
-    "skills/nggaigc/scripts/ngg-session.mjs": "7bc7b192709c7a955c97f7bbb394de5ef2b0db8533315226fbb7e45a8d7f141a",
+    "skills/nggaigc/scripts/ngg_client.mjs": "9a8bcb2557dbcb8d8d97c6a930c22ca6833bbfbdbffa742ab6dd0bf00799ee4c",
+    "skills/nggaigc/scripts/ngg-session.mjs": "4ab35bae06c02a5825d36a8d860273ed9c512f9ee40debd7f8cf32c50fc9d94f",
     "skills/nggaigc/scripts/supported-platforms.json": "ec8b0754c489e04534a1d9880dd6664ba9c5bcd07789e06d138e0923f23575ff",
     "skills/nggaigc/scripts/windows-credential.ps1": "80d470fb0c9473d26bd599cafa9f1c2ad69056d4a835888ddcbb5c1548f9d059",
-    "skills/nggaigc/SKILL.md": "f6ccf3c685cb118ec6ec495da344a5e57ca69ea84d3e5d1f7cd817e5a594a52e"
+    "skills/nggaigc/SKILL.md": "7985e5c6543d56bfb16502f050b2e24bd59172346f6cba3e159b1d1e8a923e52"
   },
   "signature": {
     "algorithm": "ed25519",
     "keyId": "ngg-signing-skill-release-1",
     "scope": "artifact-bytes",
-    "value": "cu1FYhgq1p+AtEI8drzD4FzFThrif2/ib4xFrfa2RMTVQxWbH1W8JflClYC7PpH4ntkMIStYCamR/fjRIhkuDA=="
+    "value": "zWO1/CE7wHcX6+KPdluqCzsmbqUp8xy4piqj/Znj7ZpnfZJCMJnfqxn5Nc9G/mjDW1Yqznigg39bs78LrED5BA=="
   }
 }