@dsh-workbench/module-tools 1.1.14-beta.1 → 1.1.14

package/README.md

@@ -8,7 +8,7 @@
 ```bash
 pnpm exec dsh-wb-module init my-unit                    # 建骨架（唯一模板，已默认）
 pnpm build        # dist/host.js + 套了 loader 壳的 client.js
-pnpm check        # 十三条判据
+pnpm check        # 十四条判据
 pnpm design check # 设计底稿有没有空格、README 有没有落后
 ```
 
@@ -50,7 +50,7 @@ pnpm design check # 设计底稿有没有空格、README 有没有落后
 | `dsh-wb-module init <unit> [--dir <目录>] [--template diy] [--description "一句话"]` | 建模块骨架（只有 `diy` 一个模板，也是默认） |
 | `dsh-wb-module market-init <git 地址\|目录> [--ref <分支>] [--path <索引路径>]` | 初始化市场索引仓库：写 `market/` + README，推首个 commit |
 | `dsh-wb-module build` | 出 `dist/host.js`（单文件 ESM）与 `client.js`（套 loader 壳） |
-| `dsh-wb-module check [--only <判据>] [--package <包名或 unit>]` | 十三条判据；`--only` 单跑，也当查询口用；`--package` 只报这个模块的问题（见下）；`--list [--json\|--markdown]` 只列判据元数据 |
+| `dsh-wb-module check [--only <判据>] [--package <包名或 unit>]` | 十四条判据；`--only` 单跑，也当查询口用；`--package` 只报这个模块的问题（见下）；`--list [--json\|--markdown]` 只列判据元数据 |
 | `dsh-wb-module lint [--fix]` | 用模块自己那份 `eslint.config.mjs`；`--fix` 写回文件 |
 | `dsh-wb-module sync` | 按清单生成 `src/declared-tools.ts`，按 `design.json` 的 `key + recipe` 生成 `src/datasource.ts` |
 | `dsh-wb-module design <init\|check\|render\|accept>` | 设计底稿：填、查空格、生成 README、验收打勾 |
@@ -68,7 +68,7 @@ pnpm design check # 设计底稿有没有空格、README 有没有落后
 「我这个模块绿」不等于「工作区绿」。门禁 / 发布 / release 不要带它。要只让判据看见一个包，
 用环境变量 `DSH_WB_ROOT=<包目录>`（工具链自己的自检就是这么隔离的）。
 
-## 十三条判据
+## 十四条判据
 
 `dsh-wb-module check` 一次跑完，三态输出：`✔ 通过` / `○ 不适用` / `✖ 不过`；有任何不过就退出 1。
 
@@ -81,6 +81,7 @@ pnpm design check # 设计底稿有没有空格、README 有没有落后
 | `protocol` | manifest | dsh.workbench 的 apiVersion、静态半形状与未知键 |
 | `bundles` | build | 宿主产物不含浏览器侧、浏览器产物不内联外壳 CSS 与夹具 |
 | `source` | source | 零注释、包与运行时入口分开、不手写进程/锁/原子写 |
+| `seam` | source | 子进程只走 deps.seam 门面；不取原始 shell / 不裸 child_process；清单 writes 与请求一致 |
 | `arch` | source | 模块自己的层序、运行时边界与设计系统配置 |
 | `lint` | source | 模块自己的 eslint.config.mjs 与规则集 |
 | `primitives` | build | dsh 包只从 kit 取，模块自己声明 external |
@@ -101,6 +102,22 @@ pnpm design check # 设计底稿有没有空格、README 有没有落后
 现存违规收在各自的豁免表里，是棘轮：迁一处删一行，表里已经不再命中的行也会当场报红。
 判据**故意窄** —— 模块自己用 div 拼一张不借槽类的表单不判，判宽了就是每次改界面都先撞门禁。
 
+### `seam`：模块只走执行缝门面
+
+模块在宿主侧起子进程，只能走外壳放进 `mount(deps)` 的门面 `deps.seam`。判据查三件事：
+
+- 宿主侧可达的源码里不许出现 `runShell` / `shellOf`、`ctx.get('shell')` / `ctx.get('workbenchShell')` /
+  `ctx.get('seam')`、`node:child_process` / `child_process`；
+- `dsh.workbench.host.writes` 只认 `"unit"` / `"workspace"` 两档（`protocol` 判据也查形状，这里再兜一次）；
+- 源码里以 `scope: 'unit'` / `scope: 'workspace'` 请求的档，清单 `host.writes` 里必须有。
+
+修法：清单里写 `"host": { "inject": [], "writes": ["unit"] }`，代码里
+`deps.seam?.run({ scope: 'unit', command })`。`unit` 档可写 `<运行时根>/units/<unit>/`（模块自己的数据目录，
+`HOME` 与 npm/pnpm 缓存也注入在那里），`workspace` 档写当前会话工作区、还要带上会话对象；
+不写 `writes` = 不给门面（`deps.seam` 是 `undefined`）。模块宿主代码与外壳同进程 —— 这层是
+**约定 + 门禁 + 归因**，不是安全边界。完整写法见
+[BUILD.md](../core/skills/workbench-module-diy/BUILD.md) §5。
+
 ### `arch`：模块包的分层方言
 
 卡片一复杂就往 `src/client.tsx` 里堆，宿主侧顺手 import 一个组件（`dist/host.js` 在 Node 里

package/bin/dsh-wb-module.mjs

@@ -79,6 +79,8 @@ const RELEASE_HELP = `
   --index auto|none|<目录|git 地址>                     发布后要更新的索引源
   --index-source <id> --index-ref <分支> --index-path <索引路径> --index-policy artifacts-in-repo|catalog-only
   --resume                                              上次中断后接着发（用记录里的出口与版本）
+  --workspace-only                                      只做写工作区那几步（构建/检查/提交），索引与产物流给 --index-only
+  --index-only                                          接着 --workspace-only 的记录只做产品侧（索引/发布/产物）
   --dry-run --verify --yes --json`;
 
 const MARKET_INIT_HELP = `
@@ -97,7 +99,7 @@ release --changelog-note "这一版改了什么"（文件不在会先建）。`;
 
 const COMMANDS = {
   build: '出 dist/host.js（单文件 ESM）与 client.js（套 loader 壳）',
-  check: '十三条判据；--only 单跑，也当查询口用；--list 只列判据元数据',
+  check: '十四条判据；--only 单跑，也当查询口用；--list 只列判据元数据',
   init: '建模块骨架（--dir / --template diy / --description；只有 diy 一个模板）',
   'market-init': '初始化市场索引仓库（写 market/ 与 README，推首个 commit）',
   design: '设计底稿：init 填 / check 查空格 / render 生成 README / accept 打勾',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-workbench/module-tools",
-  "version": "1.1.14-beta.1",
+  "version": "1.1.14",
   "description": "模块包的构建与门禁工具：build（单文件 ESM 宿主侧 + 套 loader 壳的浏览器侧）、check（契约/产物边界/源码边界/卡片渲染）。模块包不再各带一份构建脚本。",
   "license": "MIT",
   "type": "module",
@@ -33,7 +33,7 @@
     "semver": "^7.8.5",
     "typescript": "5.9.3",
     "typescript-eslint": "^8.71.0",
-    "@dsh-workbench/shared": "1.1.14-beta.1"
+    "@dsh-workbench/shared": "1.1.14"
   },
   "repository": {
     "type": "git",

package/src/check.mjs

@@ -25,6 +25,12 @@ export const CHECKS = {
     layer: 'source',
     load: () => import('./checks/source.mjs'),
   },
+  seam: {
+    title: '模块执行缝（写入域）',
+    summary: '子进程只走 deps.seam 门面；不取原始 shell / 不裸 child_process；清单 writes 与请求一致',
+    layer: 'source',
+    load: () => import('./checks/seam.mjs'),
+  },
   arch: {
     title: '模块架构（分层 / 边界 / 设计系统）',
     summary: '模块自己的层序、运行时边界与设计系统配置',

package/src/checks/seam.mjs

@@ -0,0 +1,134 @@
+import { readFileSync } from 'node:fs';
+import { relative } from 'node:path';
+
+import { discoverModulePackages } from '../discover.mjs';
+import { reachableFrom } from './source.mjs';
+
+export const title = '模块执行缝（写入域）';
+
+const SCOPE_USE = /scope\s*:\s*['"](unit|workspace)['"]/g;
+
+const RAW_SEAM = [
+  { pattern: /\brunShell\b/, what: '用了原始 shell 的 runShell（导入或调用）' },
+  { pattern: /\bshellOf\b/, what: '用了原始 shell 的 shellOf（导入或调用）' },
+  {
+    pattern: /ctx\s*\.\s*get\s*\(\s*['"`](shell|workbenchShell|seam)['"`]/,
+    what: '从外壳服务里取了原始执行缝',
+  },
+  { pattern: /['"](?:node:)?child_process['"]/, what: '直接引了 child_process' },
+  { pattern: /['"]execa['"]/, what: '直接引了 execa（模块不许自己起进程）' },
+  { pattern: /kind\s*:\s*['"]host['"]/, what: '请求了宿主写入域（模块只有 unit / workspace 两档）' },
+];
+
+const SEAM_FIX =
+  '模块起子进程只走门面：mount(deps) 里的 `deps.seam.run({ scope: "unit" | "workspace", command })`，' +
+  '清单里用 `dsh.workbench.host.writes` 声明要哪几档（写法见 `@dsh-workbench/core` 的 ' +
+  '`skills/workbench-module-diy/BUILD.md`）';
+
+const WRITE_SCOPES = ['unit', 'workspace'];
+
+function lineOf(text, index) {
+  return text.slice(0, index).split('\n').length;
+}
+
+function isRecord(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+export function rawSeamProblemsOf(name, rel, text) {
+  const problems = [];
+  for (const entry of RAW_SEAM) {
+    const match = entry.pattern.exec(text);
+    if (match === null) continue;
+    problems.push(`${name}: ${rel}:${lineOf(text, match.index)} ${entry.what} —— ${SEAM_FIX}`);
+  }
+  return problems;
+}
+
+export function declaredWritesOf(workbench) {
+  const host = isRecord(workbench) ? workbench.host : undefined;
+  const writes = isRecord(host) ? host.writes : undefined;
+  return new Set(Array.isArray(writes) ? writes.filter((scope) => WRITE_SCOPES.includes(scope)) : []);
+}
+
+export function declaredWritesProblemsOf(name, workbench) {
+  const host = isRecord(workbench) ? workbench.host : undefined;
+  if (!isRecord(host) || host.writes === undefined) return [];
+  const writes = host.writes;
+  if (!Array.isArray(writes)) {
+    return [
+      `${name}: dsh.workbench.host.writes 要是一串写入域（"unit" / "workspace"），` +
+        `现在是 ${JSON.stringify(writes)}`,
+    ];
+  }
+  const outside = writes.filter((scope) => !WRITE_SCOPES.includes(scope));
+  if (outside.length === 0) return [];
+  return [
+    `${name}: dsh.workbench.host.writes 里有不认的写入域 ` +
+      `${outside.map((scope) => JSON.stringify(scope)).join(' / ')} —— ` +
+      '只认 "unit"（模块自己的数据目录，<运行时根>/units/<unit>）与 "workspace"（当前会话工作区）两档；' +
+      '模块拿不到产品域与任意路径，别写别的名字（不写 = 不给执行缝门面）',
+  ];
+}
+
+export function writesUseProblemsOf(name, rel, text, declared) {
+  if (!/\bseam\b/.test(text)) return [];
+  const problems = [];
+  const seen = new Set();
+  for (const match of text.matchAll(SCOPE_USE)) {
+    const scope = match[1];
+    if (seen.has(scope) || declared.has(scope)) continue;
+    seen.add(scope);
+    problems.push(
+      `${name}: ${rel}:${lineOf(text, match.index)} 请求了 ${scope} 档，但清单 ` +
+        `dsh.workbench.host.writes 没声明它 —— 外壳不会把门面交给这个模块（deps.seam 是 undefined）：` +
+        `清单里补 "writes": ["${scope}"]，或这一档别请求`,
+    );
+  }
+  return problems;
+}
+
+export async function run() {
+  const modulePackages = discoverModulePackages({ root: process.cwd() });
+  const problems = [];
+  let scanned = 0;
+  let scannedUnits = 0;
+  let seamUnits = 0;
+
+  for (const pkg of modulePackages) {
+    const name = pkg.manifest.name;
+    const workbench = pkg.manifest.dsh?.workbench;
+    problems.push(...declaredWritesProblemsOf(name, workbench));
+    const declared = declaredWritesOf(workbench);
+    if (declared.size > 0) seamUnits += 1;
+    const hostFace = pkg.manifest.dsh?.workbenchFaces?.host;
+    if (typeof hostFace !== 'string') continue;
+    const unit = typeof workbench?.unit === 'string' ? workbench.unit : '';
+    scannedUnits += 1;
+    for (const file of reachableFrom(pkg.dir, unit, hostFace)) {
+      const text = readFileSync(file, 'utf8');
+      const rel = relative(pkg.dir, file);
+      scanned += 1;
+      problems.push(...rawSeamProblemsOf(name, rel, text));
+      problems.push(...writesUseProblemsOf(name, rel, text, declared));
+    }
+  }
+
+  if (modulePackages.length === 0) {
+    return {
+      status: 'skip',
+      notes: ['没有模块包（没有声明 dsh.workbench 的包）—— 没有执行缝用法要查'],
+      problems: [],
+    };
+  }
+  if (problems.length > 0) return { status: 'fail', notes: [], problems };
+  return {
+    status: 'pass',
+    notes: [
+      `${modulePackages.length} 个模块包 · ${scannedUnits} 个宿主面 · ${scanned} 个宿主侧源文件 · ` +
+        `${seamUnits} 个模块声明了写入域（不取原始 shell / 不裸 child_process；` +
+        '请求的写入域都在清单里）',
+    ],
+    problems: [],
+  };
+}

package/src/checks/source.mjs

@@ -173,7 +173,7 @@ function resolveLocal(pkgDir, unit, fromFile, specifier) {
   return undefined;
 }
 
-function reachableFrom(pkgDir, unit, entry) {
+export function reachableFrom(pkgDir, unit, entry) {
   const seen = new Set();
   const start = join(pkgDir, entry);
   if (!existsSync(start)) return seen;

package/src/release-util.mjs

@@ -81,6 +81,8 @@ export function dshHomeOf(home) {
 }
 
 export function workbenchRootOf(home) {
+  const staging = process.env.DSH_WB_RELEASE_HOME?.trim();
+  if (staging !== undefined && staging !== '') return staging;
   const configured = process.env.DSH_WORKBENCH_HOME?.trim();
   if (configured !== undefined && configured !== '') return configured;
   return join(dshHomeOf(home), 'workbench');

package/src/release.mjs

@@ -151,6 +151,27 @@ function titleIn(segment, key) {
   return match === null ? '' : match[1].trim();
 }
 
+function writeStateKeepingRun(home, unit, value) {
+  const existing = readState(home, unit);
+  const valueRun = value !== null && typeof value === 'object' ? value.run : undefined;
+  const run = valueRun ?? existing?.run;
+  writeState(home, unit, run === undefined ? value : { ...value, run });
+}
+
+function stopSummaryOf(target, manifest, version, changes, changelog, labels) {
+  return {
+    ok: true,
+    stop: 'workspace-only',
+    target,
+    name: manifest.name,
+    version,
+    changes,
+    ...(labels.length === 0 ? {} : { labels }),
+    ...(changelog === undefined ? {} : { changelog }),
+    install: '',
+  };
+}
+
 export function cardTitleFromMessages(root, unit) {
   if (unit === '') return undefined;
   const key = `${unit}.cardTitle`;
@@ -254,6 +275,9 @@ export async function runRelease({
   const json = hasFlag(args, '--json');
   const dryRun = hasFlag(args, '--dry-run');
   const verify = hasFlag(args, '--verify');
+  const workspaceOnly = hasFlag(args, '--workspace-only');
+  const indexOnly = hasFlag(args, '--index-only');
+  if (workspaceOnly && indexOnly) throw new ReleaseError('--workspace-only 与 --index-only 不能同时用');
   const askedAuthor = argValue(args, '--author');
   const explicitAuthor = askedAuthor === undefined ? undefined : askedAuthor.trim();
   if (askedAuthor !== undefined && (explicitAuthor === '' || /[\r\n]/u.test(explicitAuthor))) {
@@ -277,9 +301,12 @@ export async function runRelease({
     throw new ReleaseError('package.json 里没有 version');
   }
   const earlyState = readState(home, unit);
-  const resume = hasFlag(args, '--resume');
-  const journal = resume ? resumableState(home, unit) : undefined;
-  if (resume && journal === undefined) {
+  const resume = hasFlag(args, '--resume') || indexOnly;
+  const journal = indexOnly ? readState(home, unit) : resume ? resumableState(home, unit) : undefined;
+  if (indexOnly && (journal === undefined || journal.run === undefined)) {
+    throw new ReleaseError('没有可续跑的发布记录 —— 先正常发一次');
+  }
+  if (resume && !indexOnly && journal === undefined) {
     throw new ReleaseError('没有可续跑的发布记录 —— 去掉 --resume 正常发一次');
   }
   const askedTarget = argValue(args, '--target');
@@ -291,7 +318,9 @@ export async function runRelease({
   const resumeTarget = resume && askedTarget === undefined ? journal?.target : undefined;
   const needPlan = !verify || stateTarget === 'market' || askedTarget === 'market';
   let indexPlan;
-  if (needPlan) {
+  if (indexOnly) {
+    indexPlan = journal?.run?.indexPlan;
+  } else if (needPlan) {
     try {
       indexPlan = resolveIndexPlan({ args, home, exec });
     } catch (error) {
@@ -306,10 +335,17 @@ export async function runRelease({
   if (resume && indexPlan === undefined && journal?.run?.indexPlan !== undefined) {
     indexPlan = journal.run.indexPlan;
   }
-  const target = resumeTarget ?? stateTarget ?? targetOf(root, manifest, args, indexPlan);
+  const target = indexOnly
+    ? typeof journal?.target === 'string'
+      ? journal.target
+      : (() => {
+          throw new ReleaseError('发布记录里没有出口 —— 重新发一次');
+        })()
+    : (resumeTarget ?? stateTarget ?? targetOf(root, manifest, args, indexPlan));
   if (target === 'local') {
     const summary = {
       ok: true,
+      ...(workspaceOnly ? { stop: 'workspace-only' } : {}),
       target: 'local',
       name: manifest.name,
       version: manifest.version,
@@ -324,7 +360,7 @@ export async function runRelease({
   const labelsForIndex = labels.length > 0 ? labels : labelsOfManifest(manifest);
   const labelsChange = verify || labels.length === 0 ? undefined : `标签 ← ${labels.join(' · ')}`;
   const explicitApplied = explicitAuthor !== undefined && !verify && !dryRun;
-  if (explicitApplied) {
+  if (explicitApplied && !indexOnly) {
     manifest.author = explicitAuthor;
     writeManifest(root, manifest);
   }
@@ -396,13 +432,13 @@ export async function runRelease({
     return summary;
   }
   const authorChange = explicitAuthor === undefined ? authored.change : 'author ← --author';
-  if (!explicitApplied && !verify && !dryRun && authored.author !== undefined) {
+  if (!explicitApplied && !indexOnly && !verify && !dryRun && authored.author !== undefined) {
     manifest.author = authored.author;
     writeManifest(root, manifest);
   }
   const publisher = authorTextOf(manifest);
   const writesIndex = indexPlan !== undefined && target !== 'local' && target !== 'tarball';
-  if (!verify && !dryRun && writesIndex) {
+  if (!workspaceOnly && !verify && !dryRun && writesIndex) {
     if (publisher === '') throw new ReleaseError(missingPublisherText());
     let claim;
     try {
@@ -417,7 +453,7 @@ export async function runRelease({
       throw new ReleaseError(claimProblemText(manifest.name, claim, unit));
     }
   }
-  const frozenVersion = resume && typeof journal?.version === 'string' ? journal.version : undefined;
+  const frozenVersion = (resume || indexOnly) && typeof journal?.version === 'string' ? journal.version : undefined;
   const info =
     target === 'market'
       ? { target: 'market', kind: 'market', url: indexPlan.source.url }
@@ -440,18 +476,20 @@ export async function runRelease({
     }
     return frozenVersion ?? nextVersion(manifest.version, askedVersion, () => false);
   };
-  const releaseVersion = verify ? undefined : targetVersionOf();
-  const changelogProblem = verify || dryRun ? undefined : changelogProblemOf(root, releaseVersion);
-  if (changelogProblem !== undefined && changelogNote === '') {
+  const releaseVersion = indexOnly ? frozenVersion : verify ? undefined : targetVersionOf();
+  if (indexOnly && releaseVersion === undefined) throw new ReleaseError('发布记录里没有版本号 —— 重新发一次');
+  const changelogProblem = verify || dryRun || indexOnly ? undefined : changelogProblemOf(root, releaseVersion);
+  if (!indexOnly && changelogProblem !== undefined && changelogNote === '') {
     throw new NeedsUser('changelog', changelogProblem.reason, changelogProblem.command, {
       target,
       version: releaseVersion,
     });
   }
   const fingerprint = artifactFingerprintOf(root);
-  const resumeMatchesTree = resume && frozenVersion !== undefined && journal?.run?.fingerprint === fingerprint;
+  const resumeMatchesTree =
+    resume && frozenVersion !== undefined && (indexOnly || journal?.run?.fingerprint === fingerprint);
   const tracking = !verify && !dryRun;
-  if (tracking) {
+  if (tracking && !indexOnly) {
     startRun(home, unit, {
       target,
       name: manifest.name,
@@ -686,7 +724,7 @@ export async function runRelease({
   }
   const earlyLicense = info.kind === 'registry' ? licenseOf(root, manifest, target, args) : undefined;
   if (info.kind === 'registry') checkLogin(exec, info);
-  const changelog = dryRun
+  const changelog = dryRun || indexOnly
     ? undefined
     : applyChangelog(root, {
         version: releaseVersion,
@@ -694,7 +732,7 @@ export async function runRelease({
         note: changelogNote,
         date: changelogDate(),
       });
-  if (!dryRun && changelog === undefined) {
+  if (!indexOnly && !dryRun && changelog === undefined) {
     const problem = changelogProblemOf(root, releaseVersion);
     throw new NeedsUser(
       'changelog',
@@ -739,6 +777,13 @@ export async function runRelease({
     const next = { ...manifest, version };
     const cardTitle = cardTitleFromMessages(root, unit);
     const titled = cardTitle === undefined ? next : { ...next, title: cardTitle };
+    if (workspaceOnly) {
+      writeManifest(root, next);
+      if (tracking) advanceRun(home, unit, { phase: 'workspace', fingerprint: artifactFingerprintOf(root) });
+      const stopSummary = stopSummaryOf(target, next, version, changesOf(version), changelogReport, labels);
+      emit(out, json, stopSummary);
+      return stopSummary;
+    }
     const index = updateMarketIndex({
       plan: indexPlan,
       root,
@@ -782,11 +827,11 @@ export async function runRelease({
         ...(index.branch === undefined ? {} : { branch: index.branch }),
       });
     }
-    writeManifest(root, next);
+    if (!indexOnly) writeManifest(root, next);
     const path = index.path ?? marketArtifactPath(manifest.name);
     const install = marketInstallOf(index.url, index.commit, path);
     const journalNow = tracking ? readState(home, unit)?.run : undefined;
-    writeState(home, unit, {
+    writeStateKeepingRun(home, unit, {
       target: 'market',
       name: next.name,
       version,
@@ -828,17 +873,22 @@ export async function runRelease({
     }
     if (!resumeMatchesTree) runCliStage(exec, root, ['check'], stageOptions);
     const next = { ...manifest, version };
-    writeManifest(root, next);
+    if (!indexOnly) writeManifest(root, next);
     if (tracking) advanceRun(home, unit, { phase: 'version', version, fingerprint: artifactFingerprintOf(root) });
-    writeState(home, unit, stateOf(info, next, version, 'intent'));
+    writeStateKeepingRun(home, unit, stateOf(info, next, version, 'intent'));
+    if (workspaceOnly) {
+      const stopSummary = stopSummaryOf(target, next, version, changesOf(version), changelogReport, labels);
+      emit(out, json, stopSummary);
+      return stopSummary;
+    }
     let packed = false;
     try {
       const file = packTarball(exec, info, version);
       packed = true;
-      writeState(home, unit, { ...stateOf(info, next, version, 'published'), file });
+      writeStateKeepingRun(home, unit, { ...stateOf(info, next, version, 'published'), file });
       const packedFiles = localFiles(exec, root);
       checkPublished(packedFiles);
-      writeState(home, unit, { ...stateOf(info, next, version, 'verified'), file });
+      writeStateKeepingRun(home, unit, { ...stateOf(info, next, version, 'verified'), file });
       if (tracking) finishRun(home, unit, { version });
       summary.file = file;
       summary.files = packedFiles;
@@ -847,7 +897,7 @@ export async function runRelease({
       return summary;
     } catch (error) {
       if (!packed) {
-        writeManifest(root, manifest);
+        if (!indexOnly) writeManifest(root, manifest);
         if (tracking) {
           interruptRun(home, unit, { code: 'tarball', text: String(error?.message ?? error) });
         } else {
@@ -881,19 +931,46 @@ export async function runRelease({
     }
     if (!resumeMatchesTree) runCliStage(exec, root, ['check'], stageOptions);
     const next = { ...manifest, version };
-    writeManifest(root, next);
+    if (!indexOnly) writeManifest(root, next);
     if (tracking) advanceRun(home, unit, { phase: 'version', version, fingerprint: artifactFingerprintOf(root) });
-    writeState(home, unit, stateOf(info, next, version, 'intent'));
+    writeStateKeepingRun(home, unit, stateOf(info, next, version, 'intent'));
+    if (indexOnly) {
+      const state = readState(home, unit);
+      const checked = verifyGit(exec, info, version);
+      summary.files = checked.files;
+      summary.git.commit = checked.commit;
+      summary.market = indexOf(next, version, {
+        git: { url: info.url, commit: checked.commit, path: info.packagePath },
+      });
+      writeStateKeepingRun(home, unit, {
+        ...stateOf(info, next, version, 'verified'),
+        commit: checked.commit,
+        ...(tracking
+          ? { run: { ...(state?.run ?? {}), state: 'done', phase: 'done', updatedAt: new Date().toISOString() } }
+          : {}),
+      });
+      emit(out, json, summary);
+      return summary;
+    }
     const progress = { committed: false };
     try {
       const commit = gitCommitOf(exec, info, version, capture, progress, identityOf(next));
-      writeState(home, unit, { ...stateOf(info, next, version, 'committed'), commit });
+      writeStateKeepingRun(home, unit, { ...stateOf(info, next, version, 'committed'), commit });
       gitPushOf(exec, info, version, capture);
       const checked = verifyGit(exec, info, version);
-      writeState(home, unit, {
+      writeStateKeepingRun(home, unit, {
         ...stateOf(info, next, version, 'verified'),
         commit: checked.commit,
       });
+      if (workspaceOnly) {
+        const stopSummary = {
+          ...stopSummaryOf(target, next, version, changesOf(version), changelogReport, labels),
+          files: checked.files,
+          git: { url: info.url, tag: info.tagOf(version), commit: checked.commit },
+        };
+        emit(out, json, stopSummary);
+        return stopSummary;
+      }
       if (tracking) finishRun(home, unit, { version });
       summary.files = checked.files;
       summary.git.commit = checked.commit;
@@ -965,12 +1042,17 @@ export async function runRelease({
     emit(out, json, summary);
     return summary;
   }
-  writeManifest(root, next);
+  if (!indexOnly) writeManifest(root, next);
   if (tracking) advanceRun(home, unit, { phase: 'version', version, fingerprint: artifactFingerprintOf(root) });
   let published = false;
   try {
     if (!resumeMatchesTree) runCliStage(exec, root, ['check'], stageOptions);
-    writeState(home, unit, stateOf(info, next, version, 'intent'));
+    writeStateKeepingRun(home, unit, stateOf(info, next, version, 'intent'));
+    if (workspaceOnly) {
+      const stopSummary = stopSummaryOf(target, next, version, changes, changelogReport, labels);
+      emit(out, json, stopSummary);
+      return stopSummary;
+    }
     publishRegistry(exec, root, info, next, version);
     published = true;
     const files = verifyRegistry(exec, info, next.name, version);
@@ -993,14 +1075,14 @@ export async function runRelease({
     return summary;
   } catch (error) {
     if (!published && !(error instanceof NeedsUser && error.step === 'otp')) {
-      writeManifest(root, original);
+      if (!indexOnly) writeManifest(root, original);
       if (tracking) {
         interruptRun(home, unit, { code: 'registry', text: String(error?.message ?? error) });
       } else {
         removeState(home, unit);
       }
     }
-    if (published) writeState(home, unit, stateOf(info, next, version, 'published'));
+    if (published) writeStateKeepingRun(home, unit, stateOf(info, next, version, 'published'));
     throw error;
   }
 }