@zerozhang-giza/kdl-agent 0.1.0-beta.1 → 0.1.0-beta.3

package/CHANGELOG.md

@@ -2,7 +2,23 @@
 
 ## 未发布
 
-- npm 按平台下载安装器、SHA256 与版本校验、同版本 Skill 安装向导；首个候选版本 `0.1.0-beta.1`。
+## 0.1.0-beta.3 - 2026-09-10
+
+- 增加匿名新版检查、确认后同步升级 CLI/Skill 的 npm update 入口，保留登录配置和失败恢复。
+- tag 流程经五平台验活和环境审批后自动公开 Release 并派发 npm；重复发布校验固定候选，冲突停止。
+
+## 0.1.0-beta.2 - 2026-09-10
+
+- GitHub Release 与 npm 已公开，五平台安装验证通过；首次实际 Trusted Publishing/OIDC 发行成功，registry 包与固定候选一致并提供 provenance。
+- 新增代理 Basic 鉴权与白名单只读命令，明确订单 API 密钥和代理连接凭据的区别。
+- 统一 Gateway 错误信封、字段级校验和 Retry-After 提示，补齐 HTTPS 连接指南与配套 Skill。
+- 安装下载增加有限重试与半包清理，支持 KDL_AGENT_DOWNLOAD_TIMEOUT_MS；永久错误不重试，失败提供网络排查入口。
+- 更新已公开的 beta 安装入口、发行证据、Trusted Publisher 配置与 latest 标签限制说明。
+
+## 0.1.0-beta.1 - 2026-09-10
+
+- GitHub Release 与 npm 已公开；五平台安装烟测、匿名 npm 精确版本/beta 向导与 Codex Skill 实装通过。
+- npm 按平台下载安装器、SHA256 与版本校验、同版本 Skill 安装向导。
 - 个人 npm 包 `@zerozhang-giza/kdl-agent`，终端命令保持 `kdl-agent`；升级、回退及卸载保留 `.kdl`。
 - GoReleaser 候选、来源绑定检查、公开安装/API/Skill 文档与安装器回归。
 - npm 打包允许清单同时验证文件缺失和意外夹带，包含同版本更新记录。

package/README.md

@@ -8,15 +8,15 @@
 
 ## npm 安装
 
-需要 Node.js 22.14+ 和用户可写的 npm 全局目录。首个预发行目标为 `0.1.0-beta.1`，仅在同版本 GitHub Release 与 npm 发布完成后可安装：
+需要 Node.js 22.14+ 和用户可写的 npm 全局目录。配套版本 `0.1.0-beta.3` 的发行结果见 [npm](https://www.npmjs.com/package/@zerozhang-giza/kdl-agent/v/0.1.0-beta.3) 和 [GitHub Release](https://github.com/gizaZerozhang/kdl-agent-cli/releases/tag/v0.1.0-beta.3)：
 
 ```bash
-npx @zerozhang-giza/kdl-agent@0.1.0-beta.1 install
+npx @zerozhang-giza/kdl-agent@0.1.0-beta.3 install
 ```
 
-向导安装 CLI 与同版本 Skill，然后引导本机隐藏输入凭证并验证首次只读查询。Agent 自动安装使用 `install --yes --agent codex --no-login`，由用户在本地终端完成登录。仅安装 CLI 可执行 `npm install -g @zerozhang-giza/kdl-agent@0.1.0-beta.1`。
+向导安装 CLI 与同版本 Skill，然后引导本机隐藏输入凭证并验证首次只读查询。Agent 自动安装使用 `install --yes --agent codex --no-login`，由用户在本地终端完成登录。仅安装 CLI 可执行 `npm install -g @zerozhang-giza/kdl-agent@0.1.0-beta.3`。
 
-npm 包按平台下载 GitHub Release 原生二进制并验证内置 SHA256。beta 的 macOS 程序未签名/公证；最低系统和真实业务仍待专项验收。安装、升级、回退与卸载见[安装指南](./docs/install.md)，维护者见[发行操作](./docs/releasing.md)。
+npm 包按平台下载 GitHub Release 原生二进制并验证内置 SHA256。当前请显式指定 beta 版本或 `@beta`；npm 自动附加的 `latest` 仍指向该预发行版，不代表稳定就绪。beta 的 macOS 程序未签名/公证；最低系统和真实业务仍待专项验收。安装、升级、回退与卸载见[安装指南](./docs/install.md)，维护者见[发行操作](./docs/releasing.md)。
 
 ## 从源码构建
 

package/SHA256SUMS

@@ -1,12 +1,12 @@
-bf6110f2fa1ac45f66c3d07833408114a7b464564c7ee7dde88f421bddee0054  BUILD.json
-25762eecaae5a0b7a316faf8c9ace8ee7b7a841916ae874683152a620dc21264  api-guide.md
-8b8529f293422dde91ac23cf388c171f557eb1ab806596cece6e97fe75ce1487  cli-guide.md
-9ce97e29116c224343a32b5402a588ed74e306d6b66fd525a3b6fa82c373724e  install.md
-2245321a97bf8e504499bc97efc62cc9d55084cdbade0e3299a8e4224921be4a  kdl-agent-skill.zip
-6134119e18c2150c37a5f67e38b30eadc41d700c07bb1cc531c320650dd7bdbd  kdl-agent_0.1.0-beta.1_darwin_amd64.tar.gz
-444baaaebf7a4ef2a7d478603086ca35bd4a4d2e5029ef1d8254585eb7be95fd  kdl-agent_0.1.0-beta.1_darwin_arm64.tar.gz
-fcdffeaf5d9db4bdb16f4eb5bbdb457f3db851b2816d0d127276f5c0c650cbcc  kdl-agent_0.1.0-beta.1_linux_amd64.tar.gz
-9456ade4ddad1c8e7af7c6d018541165b3a68682c1290619c4b6c33c72aefe8c  kdl-agent_0.1.0-beta.1_linux_arm64.tar.gz
-561f597fe475891ede81b337a243345749d5465d2b32e7f737df7d575111d619  kdl-agent_0.1.0-beta.1_windows_amd64.zip
+c137d2d90fbcfff703f9bbce6215690e1e22c15eb513afbd47dc141b29510bbe  BUILD.json
+dfbfb2350f131474ae69f6862e1fbedab8afcb0fe154d3bc55df01057fca7785  api-guide.md
+56cae14d0fff44d867275806126b7a90bd1d399d08ac41826d3df96eafaa3f9a  cli-guide.md
+5dbf7cef1797457ae91b67b2d8ef619c6f9c19477dc7ae3a2fc7c70f85bdc995  install.md
+7f0e934259d96e8c541af62b47f3baa863f964c5a8185d80c62902020034997b  kdl-agent-skill.zip
+f7e89f716ac88879802374acaeed9954cc83cc95e528cf734312a1daabfe6bbc  kdl-agent_0.1.0-beta.3_darwin_amd64.tar.gz
+1871774881bf1821a1ec64371e276121480d56ab697d39ce08d1c237579b1430  kdl-agent_0.1.0-beta.3_darwin_arm64.tar.gz
+5b2f8a2450c560be269d4e4f3d087a419cca54bab6acaed3723a42c3019527c0  kdl-agent_0.1.0-beta.3_linux_amd64.tar.gz
+47fc0affd2c8c4776be8827528330b6c70af4f5120c5255d8ba3347f9eaff2b7  kdl-agent_0.1.0-beta.3_linux_arm64.tar.gz
+32cc0f58e2096d28e3147f0b10a89b4f97bb90a2d64442181d8161355878e853  kdl-agent_0.1.0-beta.3_windows_amd64.zip
 95a9aae626b807cd97b95fb73ff0207c72a88c10c936fc73da5a25fa4af14d10  openapi.yaml
-6773ea828c0e4d021b6aaaf903a72e763fc4c034f68f35fcdd0cc3cf6ea1b035  release-notes.md
+8ef746e7d7f54b599c15f57941436e95f9a3688d7301c29b4418f1234e4d6de5  release-notes.md

package/package.json

@@ -1,20 +1,50 @@
 {
   "name": "@zerozhang-giza/kdl-agent",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.3",
   "description": "快代理 CLI：账户与订单查询、授权操作及代理便利命令",
   "license": "MIT",
-  "engines": { "node": ">=22.14.0" },
-  "bin": { "kdl-agent": "scripts/run.cjs" },
-  "repository": { "type": "git", "url": "git+https://github.com/gizaZerozhang/kdl-agent-cli.git" },
-  "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },
-  "files": ["scripts/runtime", "scripts/run.cjs", "scripts/install.cjs", "scripts/wizard.cjs", "scripts/verify-package.cjs", "SHA256SUMS", "release.json", "CHANGELOG.md", "THIRD_PARTY_NOTICES.txt"],
+  "engines": {
+    "node": ">=22.14.0"
+  },
+  "bin": {
+    "kdl-agent": "scripts/run.cjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gizaZerozhang/kdl-agent-cli.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "files": [
+    "scripts/runtime",
+    "scripts/run.cjs",
+    "scripts/install.cjs",
+    "scripts/wizard.cjs",
+    "scripts/verify-package.cjs",
+    "SHA256SUMS",
+    "release.json",
+    "CHANGELOG.md",
+    "THIRD_PARTY_NOTICES.txt"
+  ],
   "scripts": {
     "postinstall": "node scripts/install.cjs",
     "prepack": "node scripts/verify-package.cjs",
     "test": "node --test tests/*.test.cjs",
     "release:prepare": "node scripts/prepare-package.cjs"
   },
-  "dependencies": { "https-proxy-agent": "7.0.6", "tar": "7.5.22", "yauzl": "3.4.0" },
-  "devDependencies": { "yazl": "3.3.1" },
-  "kdl": { "command": "kdl-agent", "skill": "kdl-agent", "skillsPackage": "skills@1.5.25" }
+  "dependencies": {
+    "https-proxy-agent": "7.0.6",
+    "tar": "7.5.22",
+    "yauzl": "3.4.0"
+  },
+  "devDependencies": {
+    "yazl": "3.3.1"
+  },
+  "kdl": {
+    "command": "kdl-agent",
+    "skill": "kdl-agent",
+    "skillsPackage": "skills@1.5.25"
+  }
 }

package/release.json

@@ -1,8 +1,8 @@
 {
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.3",
   "repository": "gizaZerozhang/kdl-agent-cli",
-  "commit": "a50bc08164a9ab11a8f9d8b5435eb3553fcdeed8",
+  "commit": "75934e505a6355bbe71b3db998c3026f6f8ff318",
   "dirty": false,
   "macosSigned": false,
-  "sha256": "856588de2e6e97c166f8c0a1573a1ef97c747db9df132e3f9ee5c3a95e1061e9"
+  "sha256": "ff499485dbb890557f07637e58bc74b03f394411a7c2b4aa11c28188e4498c69"
 }

package/scripts/install.cjs

@@ -4,6 +4,7 @@
 if (process.env.npm_command !== 'exec') {
   require('./runtime/install.cjs').ensureInstalled().catch(error => {
     console.error(`安装失败：${error.message}`);
+    console.error('检查 HTTPS_PROXY 或设置 KDL_AGENT_DOWNLOAD_TIMEOUT_MS 后重新运行安装；GitHub 不可达时可从同版本 Release 手动安装并核对 SHA256。');
     process.exitCode = 1;
   });
 }

package/scripts/run.cjs

@@ -4,6 +4,7 @@ const { spawn } = require('node:child_process');
 async function main() {
   const args = process.argv.slice(2);
   if (args[0] === 'install') return require('./wizard.cjs').main(args.slice(1));
+  if (args[0] === 'update' && args[1] !== 'check') return require('./wizard.cjs').main(args.slice(1), { mode: 'update' });
   const binary = await require('./runtime/install.cjs').ensureInstalled();
   const child = spawn(binary, args, { stdio: 'inherit' });
   for (const signal of ['SIGINT', 'SIGTERM']) process.on(signal, () => child.kill(signal));

package/scripts/runtime/install.cjs

@@ -49,23 +49,30 @@ function allowedURL(raw) {
   return url;
 }
 
-async function download(raw, destination, redirects = 0) {
+function downloadTimeout() {
+  const raw = process.env.KDL_AGENT_DOWNLOAD_TIMEOUT_MS || '60000';
+  if (!/^\d+$/.test(raw) || Number(raw) < 1000 || Number(raw) > 600000) throw new Error('KDL_AGENT_DOWNLOAD_TIMEOUT_MS 必须为 1000–600000 毫秒');
+  return Number(raw);
+}
+
+async function downloadOnce(raw, destination, redirects = 0) {
   const url = allowedURL(raw);
+  const timeout = downloadTimeout();
   if (redirects > 5) throw new Error('下载重定向次数过多');
   const proxy = process.env.HTTPS_PROXY || process.env.https_proxy;
   const response = await new Promise((resolve, reject) => {
     const request = https.get(url, { agent: proxy ? new HttpsProxyAgent(proxy) : undefined, headers: { 'User-Agent': 'kdl-agent-installer' } }, resolve);
-    request.setTimeout(60000, () => request.destroy(new Error('下载超时，请检查网络或 HTTPS_PROXY')));
+    request.setTimeout(timeout, () => request.destroy(Object.assign(new Error('下载超时，请检查网络或 HTTPS_PROXY'), { code: 'ETIMEDOUT' })));
     request.on('error', reject);
   });
   if ([301, 302, 303, 307, 308].includes(response.statusCode)) {
     response.resume();
     if (!response.headers.location) throw new Error('下载重定向缺少地址');
-    return download(new URL(response.headers.location, url).href, destination, redirects + 1);
+    return downloadOnce(new URL(response.headers.location, url).href, destination, redirects + 1);
   }
   if (response.statusCode !== 200) {
     response.resume();
-    throw new Error(`下载失败 HTTP ${response.statusCode}；请核对版本及 Release 是否公开`);
+    throw Object.assign(new Error(`下载失败 HTTP ${response.statusCode}；请核对版本及 Release 是否公开`), { statusCode: response.statusCode });
   }
   let size = 0;
   const limit = new Transform({ transform(chunk, encoding, callback) {
@@ -75,6 +82,21 @@ async function download(raw, destination, redirects = 0) {
   await pipeline(response, limit, fs.createWriteStream(destination, { flags: 'wx', mode: 0o600 }));
 }
 
+// 仅重试临时下载故障；校验、解压与替换仍由安装事务执行一次。
+async function download(raw, destination, { attempt = downloadOnce, sleep = ms => new Promise(resolve => setTimeout(resolve, ms)) } = {}) {
+  allowedURL(raw);
+  downloadTimeout();
+  if (fs.existsSync(destination)) throw new Error('下载目标已存在');
+  for (let retry = 0; ; retry++) {
+    try { return await attempt(raw, destination); } catch (error) {
+      fs.rmSync(destination, { force: true });
+      const transient = ['ETIMEDOUT', 'ECONNRESET', 'ECONNREFUSED', 'EAI_AGAIN', 'ERR_STREAM_PREMATURE_CLOSE'].includes(error.code) || [408, 500, 502, 503, 504].includes(error.statusCode);
+      if (!transient || retry >= 2) throw error;
+      await sleep(1000 * 2 ** retry);
+    }
+  }
+}
+
 async function hashFile(file) {
   const hash = crypto.createHash('sha256');
   for await (const chunk of fs.createReadStream(file)) hash.update(chunk);

package/scripts/wizard.cjs

@@ -31,8 +31,22 @@ function parse(args) {
   return options;
 }
 
-async function main(args, { run = command, install = ensureInstalled, readConfig = config, checkBinary = verifyBinary, tty = process.stdin.isTTY } = {}) {
+async function confirmUpdate() {
+  const prompt = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try { return /^y(es)?$/i.test((await prompt.question('确认升级 CLI 与同版本 Skill？[y/N] ')).trim()); }
+  finally { prompt.close(); }
+}
+
+async function main(args, { run = command, install = ensureInstalled, readConfig = config, checkBinary = verifyBinary, tty = process.stdin.isTTY, mode = 'install', confirm = confirmUpdate } = {}) {
   const options = parse(args);
+  if (mode === 'update') {
+    options.noLogin = true;
+    if (options.help) {
+      console.log('同步升级 CLI 与同版本 Skill\n检查新版：kdl-agent update check --format json\n用法：npx --yes @zerozhang-giza/kdl-agent@<目标版本> update --agent codex [--yes]\n默认询问确认；非交互必须显式 --yes。保留登录配置，Skill 失败时重复同一命令修复。');
+      return;
+    }
+    if (options.noSkills) throw new Error('同步升级不能跳过 Skill；请移除 --no-skills');
+  }
   if (options.help) {
     console.log('安装快代理 CLI 与同版本 Skill\n\n用法：npx <包名>@<版本> install [--yes] [--agent codex] [--no-login] [--no-skills]\n\n--yes 非交互安装；安装 Skill 时须指定 --agent\n--no-login 仅安装，稍后在本地终端执行 kdl-agent auth login\n--no-skills 跳过 Skill，适用于直接使用 CLI\n升级或回退：使用目标版本再次运行；卸载 npm 包保留 .kdl 与 Skill。');
     return;
@@ -42,6 +56,7 @@ async function main(args, { run = command, install = ensureInstalled, readConfig
   const { pkg, repository } = readConfig();
   if (!/^@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/.test(pkg.name)) throw new Error('npm 包名尚未绑定');
   console.log(`目标版本：${pkg.name}@${pkg.version}`);
+  if (mode === 'update' && !options.yes && !await confirm()) { console.log('已取消升级，保留现有 CLI 与 Skill。'); return; }
   console.log('正在下载并校验原生程序...');
   await install();
   const prefixResult = run('npm', ['prefix', '-g'], { timeout: 15000 });
@@ -76,7 +91,7 @@ async function main(args, { run = command, install = ensureInstalled, readConfig
     if (result.status !== 0) throw new Error('CLI 已安装，Skill 安装未完成；重新运行此向导重试，已安装 CLI 将跳过');
     console.log('Skill：已安装；目标 Agent 可能需要刷新会话');
   } else console.log('Skill：按要求跳过');
-  if (options.noLogin) { console.log('登录：按要求跳过；用户稍后在本地终端执行 kdl-agent auth login 和 kdl-agent auth status'); return; }
+  if (options.noLogin) { console.log(mode === 'update' ? '升级完成，登录配置保持不变；请核对 kdl-agent --version，并刷新 Agent 会话。' : '登录：按要求跳过；用户稍后在本地终端执行 kdl-agent auth login 和 kdl-agent auth status'); return; }
   let status = run(binary, ['auth', 'status', '--format', 'json'], { timeout: 25000 });
   if (status.status !== 0) {
     if (!tty) throw new Error('CLI/Skill 已安装，登录待用户在本地终端完成：kdl-agent auth login');