@nggaigc/cli 0.1.48 → 0.1.50

package/README.md

@@ -39,3 +39,25 @@ npx --yes @nggaigc/cli@latest client --skills-dir "/absolute/project/.codebuddy/
 本地技能包导入可能复制文件，需核导入后的实际路径和独立包同级关系。交互使用宿主可用的提问工具或当前聊天，交付使用宿主可用的媒体／附件能力；不依赖 Codex 专用工具。切换宿主继续复用当前系统用户的系统凭证库和任务历史，不迁移凭据、不要求重新粘贴密钥。资金、权限与未知结果同幂等键恢复规则不变。
 
 此功能不增加 Linux、Intel Mac 支持，也不代表已接入或认证 WorkBuddy 官方连接器市场；现有系统、Node.js 与正式发布门禁保持适用。
+
+## 受信本地 Python 工具文件合同（开发候选）
+
+纯文档包继续使用 `ngg-skill-package/v1`，原结构及字节生成规则不变。本地工具包使用内部元数据 `schemaVersion: "ngg-skill-package/v2"`；ZIP中的元数据文件名仍为 `skill-package.v1.json`。正式发布时须把该包的root/platform最低兼容版本绑定到实际支持v2的新版根包及CLI；本节不指定尚未冻结的发布版本。
+
+v2须声明以下有限元数据：
+
+```json
+{
+  "localTools": {
+    "kind": "python",
+    "entrypoints": ["scripts/run.py"],
+    "runtimeLock": "references/runtime-lock.json"
+  }
+}
+```
+
+仅此声明允许额外交付直接位于 `scripts/` 的Python源文件（文件名为ASCII字母/数字开头，后接字母、数字、下划线或连字符及`.py`）。入口必须存在且不重复；内部模块无需列作入口。全部源文件仍须列入已签名的逐文件清单，`executable=false`。不接受shell、pyc、任意YAML、嵌套脚本目录或根级runtime-lock。
+
+运行清单是已签名的 `references/runtime-lock.json`，至少有 `schemaVersion: 1`及`files`路径到SHA256的映射。每个打包Python文件必须与其中同路径摘要一致；清单中不能出现未打包的scripts文件，也不能自引用运行清单。文档及同级依赖的摘要可继续由独立工具按自身范围复核；安装器不执行或解释其业务规则。
+
+安装、复用、API合同加载和回滚只验证/交付字节，**不会执行Python、安装解释器/FFmpeg或调用付费服务**。工作流按实际阶段检查宿主依赖并明确调用已声明入口。全部既有签名、逐文件摘要、安全ZIP、32文件/4MiB、路径检查、原子替换及回滚规则继续生效。旧v1 loader明确拒绝v2；不能给旧包加脚本但保留v1声明，或把源码改成文档后缀绕过规则。

package/dist/bundle.js

@@ -47,7 +47,7 @@ export async function verifyBundle(input) {
             !exactKeys(manifestValue, manifestKeys) ||
             manifestValue.schemaVersion !== "nggaigc-plugin-package/v1" ||
             manifestValue.artifactId !== "plugin.nggaigc" ||
-            manifestValue.version !== "1.1.46" ||
+            manifestValue.version !== "1.1.48" ||
             manifestValue.artifactPath !==
                 `packages/plugins/nggaigc-plugin-${manifestValue.version}.zip` ||
             typeof manifestValue.sourceCommit !== "string" ||

package/dist/independent-skill.js

@@ -345,7 +345,8 @@ function storedZipEntries(input) {
             localOffset + 30 > centralOffset)
             fail("PACKAGE_VERIFICATION_FAILED");
         const unixMode = externalAttributes >>> 16;
-        if (unixMode !== 0 && (unixMode & 0xf000) !== 0x8000)
+        if (unixMode !== 0 &&
+            ((unixMode & 0xf000) !== 0x8000 || (unixMode & 0o111) !== 0))
             fail("PACKAGE_VERIFICATION_FAILED");
         const nameBytes = bytes.subarray(cursor + 46, cursor + 46 + nameLength);
         let name;
@@ -382,12 +383,60 @@ function storedZipEntries(input) {
         fail("PACKAGE_VERIFICATION_FAILED");
     return result;
 }
-function packageFileType(value) {
+const PYTHON_SCRIPT = /^scripts\/[A-Za-z0-9][A-Za-z0-9_-]*\.py$/;
+const PYTHON_RUNTIME_LOCK = "references/runtime-lock.json";
+function validLocalPythonTools(value, paths) {
+    if (!record(value) ||
+        !exactKeys(value, ["kind", "entrypoints", "runtimeLock"]) ||
+        value.kind !== "python" ||
+        value.runtimeLock !== PYTHON_RUNTIME_LOCK ||
+        !paths.includes(PYTHON_RUNTIME_LOCK) ||
+        !Array.isArray(value.entrypoints) ||
+        value.entrypoints.length < 1 ||
+        value.entrypoints.length > MAX_FILES)
+        return false;
+    const seen = new Set();
+    for (const entry of value.entrypoints) {
+        if (typeof entry !== "string" ||
+            !PYTHON_SCRIPT.test(entry) ||
+            !paths.includes(entry) ||
+            seen.has(entry.toLowerCase()))
+            return false;
+        seen.add(entry.toLowerCase());
+    }
+    return true;
+}
+function validLocalPythonRuntimeLock(bytes, files) {
+    try {
+        const lock = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        if (!record(lock) ||
+            lock.schemaVersion !== 1 ||
+            !record(lock.files) ||
+            Object.hasOwn(lock.files, PYTHON_RUNTIME_LOCK) ||
+            Object.values(lock.files).some((value) => typeof value !== "string" || !DIGEST.test(value)))
+            return false;
+        const locked = lock.files;
+        return (files
+            .filter((file) => PYTHON_SCRIPT.test(file.path))
+            .every((file) => locked[file.path] === file.sha256) &&
+            Object.keys(locked)
+                .filter((name) => name.startsWith("scripts/"))
+                .every((name) => files.some((file) => PYTHON_SCRIPT.test(file.path) &&
+                file.path === name &&
+                file.sha256 === locked[name])));
+    }
+    catch {
+        return false;
+    }
+}
+function packageFileType(value, localPython = false) {
     if (value === "SKILL.md" ||
         /^references\/[A-Za-z0-9._/-]+\.(md|json)$/.test(value))
         return "document";
     if (/^assets\/[A-Za-z0-9._/-]+\.png$/.test(value))
         return "png";
+    if (localPython && PYTHON_SCRIPT.test(value))
+        return "python";
     return undefined;
 }
 function validStaticPng(input) {
@@ -459,8 +508,9 @@ function decodePackage(bytes, entry, trust) {
     catch {
         fail("PACKAGE_VERIFICATION_FAILED");
     }
+    const localPython = payload?.schemaVersion === "ngg-skill-package/v2";
     if (!record(payload) ||
-        payload.schemaVersion !== "ngg-skill-package/v1" ||
+        (!localPython && payload.schemaVersion !== "ngg-skill-package/v1") ||
         payload.artifactId !== entry.id ||
         payload.packageVersion !== entry.version ||
         canonical(payload.compatibility) !== canonical(metadata.compatibility) ||
@@ -473,8 +523,12 @@ function decodePackage(bytes, entry, trust) {
             "packageVersion",
             "compatibility",
             "files",
+            ...(localPython ? ["localTools"] : []),
         ]))
         fail("PACKAGE_VERIFICATION_FAILED");
+    if (localPython &&
+        !validLocalPythonTools(payload.localTools, payload.files.map((file) => file?.path)))
+        fail("PACKAGE_VERIFICATION_FAILED");
     const seen = new Set();
     let total = 0;
     for (const file of payload.files) {
@@ -490,7 +544,7 @@ function decodePackage(bytes, entry, trust) {
             file.path
                 .split("/")
                 .some((part) => !part || part === "." || part === ".." || /[. ]$/.test(part)) ||
-            !packageFileType(file.path))
+            !packageFileType(file.path, localPython))
             fail("PACKAGE_VERIFICATION_FAILED");
         const folded = file.path.toLowerCase();
         if (seen.has(folded) ||
@@ -511,6 +565,9 @@ function decodePackage(bytes, entry, trust) {
     }
     if (!seen.has("skill.md") || archive.size !== payload.files.length + 1)
         fail("PACKAGE_VERIFICATION_FAILED");
+    if (localPython &&
+        !validLocalPythonRuntimeLock(archive.get(PYTHON_RUNTIME_LOCK), payload.files))
+        fail("PACKAGE_VERIFICATION_FAILED");
     return payload.files.map((file) => ({
         path: file.path,
         sha256: file.sha256,
@@ -565,6 +622,9 @@ async function existingReceipt(target, entry, trust) {
     try {
         const packageBytes = await readFile(path.join(target, ".nggaigc-package.bin"));
         const signedFiles = decodePackage(packageBytes, entry, trust);
+        // The signed archive's versioned verifier already checked each file type
+        // and local-tools declaration. Never infer Python permission from receipt data.
+        const signedPaths = new Set(signedFiles.map((file) => file.path));
         if (JSON.stringify(Object.fromEntries(signedFiles.map((file) => [file.path, file.sha256]))) !== JSON.stringify(receipt.files))
             return false;
         const names = [];
@@ -590,7 +650,7 @@ async function existingReceipt(target, entry, trust) {
             ].sort()))
             return false;
         for (const [name, digest] of Object.entries(receipt.files)) {
-            if (!packageFileType(name) ||
+            if (!signedPaths.has(name) ||
                 name.split("/").some((part) => part === "." || part === ".."))
                 return false;
             const file = path.join(target, ...name.split("/"));

package/dist/install.js

@@ -9,7 +9,7 @@ import { resolveSkillLocation, } from "./skill-location.js";
 function defaultBundle() {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     return {
-        archive: path.join(vendor, "nggaigc-plugin-1.1.46.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.48.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     };

package/dist/skill-command.js

@@ -15,7 +15,7 @@ function record(value) {
 export async function productionDependencies(skillsDirectory) {
     const vendor = fileURLToPath(new URL("../vendor/", import.meta.url));
     const bundle = await verifyBundle({
-        archive: path.join(vendor, "nggaigc-plugin-1.1.46.zip"),
+        archive: path.join(vendor, "nggaigc-plugin-1.1.48.zip"),
         manifest: path.join(vendor, "manifest.json"),
         trust: path.join(vendor, "trusted-keys.json"),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nggaigc/cli",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "description": "Secure NGGAIGC Skill installer for Codex, WorkBuddy and compatible agents.",
   "type": "module",
   "bin": {

package/vendor/manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": "nggaigc-plugin-package/v1",
   "artifactId": "plugin.nggaigc",
-  "version": "1.1.46",
-  "sourceCommit": "890744f5f9d7687c8edb182b78a308f883495109",
-  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.46.zip",
-  "sha256": "9e419880e02ad7e578708e36ced067f75a073f9f0fac19a35041607b60571489",
-  "sizeBytes": 502681,
+  "version": "1.1.48",
+  "sourceCommit": "17038f7181c59b72b968866e68547f248069a3c5",
+  "artifactPath": "packages/plugins/nggaigc-plugin-1.1.48.zip",
+  "sha256": "92831457de7bd2f3e60ccd3805c4b7846ec32df7fd255b6b552dee225a83acc3",
+  "sizeBytes": 508669,
   "fileCount": 24,
   "platforms": [
     "win32-x64",
@@ -13,7 +13,7 @@
     "darwin-arm64"
   ],
   "files": {
-    ".codex-plugin/plugin.json": "41aa7f0e7d6769b1fef20e103390a1e1ad404f0ea43db80000026231a82b6076",
+    ".codex-plugin/plugin.json": "54daccc21f12195f2c44a1cd049e10bff5a73fa6daba245e201b3affe2e1ad7d",
     "installer/install.cjs": "76f4ed73233fd39900fb0bedbc434dea39e52e6b6b4622f3fd388a5ca09c6f62",
     "installer/legacy-root-digests.json": "922552646a5aa6cff8616c372912a37b1d5f263351206b85785ed9b2eae31641",
     "installer/signed-pair-1.1.16.json": "ccb22a90302cc5c9c585067ebc211a27b0c9d8a177c2740a5678a58a3d70bfe9",
@@ -25,23 +25,23 @@
     "migration/seedream-1.1.3/SKILL.md": "5c5cf3c2d99376f246425e873c5566436ed528256372ac3208abb60364c4517c",
     "skills/nggaigc/agents/openai.yaml": "8936d97b9821e687e224e9349cc42be2ee5fc20988562efffbcb70080aedf87c",
     "skills/nggaigc/references/catalog-and-updates.md": "a43bee94a480aa2bf0b1e7038cee6f27fb86d2bd8fa88a28a63678963d7c1530",
-    "skills/nggaigc/references/source.json": "7a1409d6cad2a629191a0f57ff0dc5a0ff956cf9d6e045174f6d33bdd7f576c4",
+    "skills/nggaigc/references/source.json": "5fb7443d94c522a22cd03e508bb8b1bb2c6f67983b719ce85f5bf88bef2f01d0",
     "skills/nggaigc/scripts/api_client.mjs": "e16bf750a297ef7e88e4843d2fba9c33b412a66516bfe76822d7deec6c153069",
-    "skills/nggaigc/scripts/api_package.mjs": "6beee22aed770cbf501abe6d1d9d252f7a53893eeb9b6399bd26c4ef68470d5a",
-    "skills/nggaigc/scripts/bootstrap-public.json": "1f713cba932651902d4e14073bc8da5e2eb3d219ae50ee6ae3d00e1469435e2a",
-    "skills/nggaigc/scripts/launch-ngg-client.cjs": "898d29a42ebddee6ab6e17765f3f56e2e4d588d23d3878592dfe20ea82a99b17",
+    "skills/nggaigc/scripts/api_package.mjs": "824ea8f935e2c3aec7ad5ea5c6ad043f1b77ccd9918c86687a9bd61558954fe4",
+    "skills/nggaigc/scripts/bootstrap-public.json": "6d0a7d79ae4364fb5fba5786d87417732af6f559e32592373031daf24db078d2",
+    "skills/nggaigc/scripts/launch-ngg-client.cjs": "4f4786c2e70fbac8e24fa2de1ba02aa713d68d3f36773f4c7c242f91364a005e",
     "skills/nggaigc/scripts/macos-keychain": "b0bdf29d14219d38ca18c7e5c599deb0daa8c8ac70b0babbc7d4fb23673079ec",
     "skills/nggaigc/scripts/macos-keychain.swift": "1b57e74fde66c824fe970547dd8ca0883a3334c34c065e85a8a2a90d4556a7f5",
-    "skills/nggaigc/scripts/ngg_client.mjs": "5534b95177394a6a12d2f205f3ab5884d39412b4b13622c372d66b945d07b715",
-    "skills/nggaigc/scripts/ngg-session.mjs": "678be2fd81166a884f0b4a3515042e350658d46779ee16bf9d976dacd32ad9a9",
+    "skills/nggaigc/scripts/ngg_client.mjs": "254f36fad2e0fb600c91b9ae22e8f35cfd602fbb36c25ef56ab494436a2e4a77",
+    "skills/nggaigc/scripts/ngg-session.mjs": "026a1d9d480712ee3e2f4d505e1448e78001800c88025cd048658b38d3c040ce",
     "skills/nggaigc/scripts/supported-platforms.json": "ec8b0754c489e04534a1d9880dd6664ba9c5bcd07789e06d138e0923f23575ff",
-    "skills/nggaigc/scripts/windows-credential.ps1": "80d470fb0c9473d26bd599cafa9f1c2ad69056d4a835888ddcbb5c1548f9d059",
+    "skills/nggaigc/scripts/windows-credential.ps1": "641888d8c6016bb84f18df19315322ed802c5709fbe5209250eaf1b0ce498aec",
     "skills/nggaigc/SKILL.md": "8cb3eb8a03cf144ce15fa01d7d342495c2b11ba0f6a0cf61a493e1e43c83a11f"
   },
   "signature": {
     "algorithm": "ed25519",
     "keyId": "ngg-signing-skill-release-1",
     "scope": "artifact-bytes",
-    "value": "ZUj0GmKZYNe+4wgBznW3BKBBNoSErTVlIB8MgqQvEe27Pnc2MsKepzkMVGGhd6GpGsqaukdD3gENuOhiclpsDg=="
+    "value": "FQ+2ziXnms95GTjoiJcdjVxekqOjSBcsfpZrGh+0IKCChqXt18AZi59WSPRDfhdM1BQO8AEiqZtM1ge5gI+JDA=="
   }
 }