cowork-flow 1.7.1 → 1.7.2

package/CHANGELOG.md

@@ -5,6 +5,19 @@
 ### Added
 
 
+## [1.7.2] - 2026-10-04
+
+### Added
+
+- GitHub 现在会在收到 `v*` tag 推送时自动发布 npm：`.github/workflows/publish.yml` 新增 `push: tags` 触发器与按 tag 归一的 `concurrency` 锁（同一 tag 的重复触发串行化而非并发抢发），`scripts/release.sh --no-publish` 改为推送分支与 tag 并把发布交给 CI，`gh release create` 降级为可选的 Release 说明入口。推送 tag 即发布，无需再手工建 Release。
+
+### Fixed
+
+- 修复 tag 推送通道的空转：`verify-ubuntu` / `verify-windows` / `publish` 三个 job 的触发条件此前只认 `release` 事件和 `inputs.ref`，`on: push: tags` 触发工作流后三个 job 会被全部跳过——运行显示绿色却不会发布任何内容。三个门禁现在都放行 push 事件；Ubuntu 与 Windows 双平台验证仍是发布的硬前置。新增 `test/package.test.js` 断言锁住这一行为。
+- npm 发布改用 **Trusted Publishing**（OIDC）：publish job 声明 `id-token: write`，用 GitHub OIDC token 换取短期 npm 凭据，仓库不再保存长期 token。OIDC 交换需要 npm ≥ 11.5.1，而 Node 20 自带 npm 10，因此仅 publish job 改跑 Node 24（两个验证 job 保持 Node 20，与 `engines` 声明一致）。`setup-node` 保留 `registry-url` 以便 npm 读到 registry 后发起交换，但不提供 `NODE_AUTH_TOKEN`——占位符保持未解析，npm 先试交换、失败才回退。此前用 `NPM_TOKEN` secret 时，账号开启双因素认证会导致 CI 发布以 `EOTP` 失败。
+- `package.json` 的 `bin` 路径去掉 `./` 前缀：npm 发布时会自动清理并告警，导致 tarball 里的 package.json 与源码不一致。
+- Qoder 插件 hook 不再由宿主解析 `python`：改为 **Node 传输 shim**（`command: "node"` + `hooks/inject-context.mjs`），与 ZCode 插件同形态。修前在没有 `python` 命令的机器上（macOS 12.3+、只装 `python3` 的发行版），hook 以 `spawn python ENOENT` 静默失败，SessionStart / UserPromptSubmit 注入从未发生，日志里只有 `Non-blocking hook error(s) … Continuing execution`；Windows 上则依赖 `python.exe` 恰好在 PATH，商店版 Python 等环境同样哑。新 shim 由宿主必备的 Node 运行，内置 `COWORK_FLOW_PYTHON → python3 → python → py -3` 探测链自行定位项目运行时解释器，探测不到时保持 fail-open（exit 0）。升级动作：`cwf host add qoder --force` 刷新插件缓存后重启 Qoder。ZCode 的 `.js` shim（ESM 语法）在安装目录无 `package.json` 时依赖 Node ≥23 的语法探测，仓库声明的最低 Node 20 上会崩溃，建议后续同样改 `.mjs`——本次未动 ZCode。
+
 ## [1.7.1] - 2026-09-30
 
 ### Fixed
@@ -269,7 +282,8 @@
 
 此版本未保留本地条目正文，详情见 [GitHub Release](https://github.com/fishlikewater/cowork-flow/releases/tag/v0.0.47)。
 
-[Unreleased]: https://github.com/fishlikewater/cowork-flow/compare/v1.7.1...HEAD
+[Unreleased]: https://github.com/fishlikewater/cowork-flow/compare/v1.7.2...HEAD
+[1.7.2]: https://github.com/fishlikewater/cowork-flow/compare/v1.7.1...v1.7.2
 [1.7.1]: https://github.com/fishlikewater/cowork-flow/compare/v1.7.0...v1.7.1
 [1.7.0]: https://github.com/fishlikewater/cowork-flow/compare/v1.6.0...v1.7.0
 [1.6.0]: https://github.com/fishlikewater/cowork-flow/compare/v1.5.0...v1.6.0

package/docs/release.md

@@ -36,7 +36,7 @@ npm run test:template:full
 | `npm run release` | 发布 patch 版本 |
 | `npm run release -- minor` | 发布 minor 版本 |
 | `npm run release -- --version 0.1.0` | 使用指定版本号，跳过自动 bump |
-| `npm run release -- minor --no-publish` | 完成版本、提交和 tag，但不执行 `npm publish` |
+| `npm run release -- minor --no-publish` | 完成版本、提交和 tag，推送 commit 与 tag，但不执行 `npm publish`；由 CI 发布 |
 | `npm run release -- --dry-run` | 运行发布前检查，停在版本 bump 之前 |
 
 `--dry-run` 不是只读命令。它会先要求 Git 工作树和暂存区干净，再执行 `source:refresh` 和 `sync --force`，因此可能刷新仓库中被忽略的运行副本，并临时覆盖后恢复 `AGENTS.md`。它不会改版本文件、提交、打 tag 或发布；如果检查开始时已有本地修改，脚本会在任何刷新前停止。
@@ -48,7 +48,7 @@ npm run test:template:full
 1. 确认工作树和更新日志符合预期。
 2. 运行 `npm run release:check` 和 `git diff --check`。
 3. 稳定性改动按上一节重复模板测试。
-4. 运行 `npm run release -- <release-type>`；CI 通道使用 `--no-publish`。
+4. 运行 `npm run release -- <release-type>`；CI 通道使用 `--no-publish`，它会把 tag 推给 CI。
 5. 脚本同步 `package.json`、lockfile、`template/.cowork-flow/.version` 和所有随包插件清单。
 6. 检查提交与 tag，再按下面的 CI 通道发布。
 
@@ -58,25 +58,34 @@ npm run test:template:full
 
 推荐让 GitHub Actions 执行 `npm publish`：
 
-1. 在本地运行 `npm run release -- <release-type> --no-publish`，完成检查、版本、提交和 tag。
-2. 先推送分支，再显式推送 tag：
+1. 在本地运行 `npm run release -- <release-type> --no-publish`。脚本完成检查、版本、提交和 tag，然后推送分支与 tag：
 
    ```bash
    git push
    git push origin v<v>
    ```
 
-3. 创建 GitHub Release：
+2. 推送 tag 即触发 `.github/workflows/publish.yml`。工作流等待 Ubuntu 和 Windows 验证通过后，只从已存在的 `v<version>` tag 发布，并核对 tag、`package.json` 与 `template/.cowork-flow/.version` 的版本一致。
+
+3. 需要给这个 tag 写 Release 说明时，再手动创建（不是发布的必要步骤）：
 
    ```bash
    gh release create v<v>
    ```
 
-4. `.github/workflows/publish.yml` 等待 Ubuntu 和 Windows 验证通过后，只从已存在的 `v<version>` tag 发布，并核对 tag、`package.json` 与 `template/.cowork-flow/.version` 的版本一致。
-
 不要在 tag 尚未存在于远端时运行 `gh release create`，否则 GitHub 可能从默认分支最新提交创建 tag，把发布指向错误提交。
 
-PR 和发布使用同一套 core 门禁。只有 publish job 能读取 `NPM_TOKEN`，测试 job 不接触发布凭据。
+同一 tag 的重复触发会被 concurrency 锁串行化，不会并发抢发；如果该版本已经发到 npm，重复运行会在 `npm publish` 阶段被 npm 拒绝，这是预期行为。上一次 CI 失败需要重发时，用 `workflow_dispatch` 指定同一个 tag 重跑即可。
+
+PR 和发布使用同一套 core 门禁。
+
+发布凭据走 **Trusted Publishing**：publish job 声明 `id-token: write`，把 GitHub OIDC token 交给 npm 换取短期凭据，仓库里不保存长期 token。登记在 npm 包页面（Settings → Trusted Publishers），声明仓库 `fishlikewater/cowork-flow` 与 workflow 文件 `publish.yml`。
+
+该交换由 npm CLI 实现（11.5.1 起），而 Node 20 自带 npm 10，因此**只有 publish job 跑在 Node 24**；两个验证 job 仍用 Node 20，与 `package.json` 声明的 `engines` 保持一致。
+
+publish job 的 `setup-node` **保留 `registry-url`**，但不提供 `NODE_AUTH_TOKEN`。npm 需要在 `.npmrc` 里读到 registry 才会发起 OIDC 交换——去掉它，发布会在未接触令牌端点的情况下直接以 `ENEEDAUTH` 失败。`setup-node` 写入的 `${NODE_AUTH_TOKEN}` 占位符则**故意不解析**：npm 会带着这个空凭据先尝试交换，只有交换被拒时才回退到它。
+
+早期版本用 `NPM_TOKEN` secret。若账号开启双因素认证，classic token 无法完成交互式 OTP，CI 发布会以 `EOTP` 失败——这也是改用 Trusted Publishing 的原因。验证 job（Ubuntu / Windows）不接触任何发布凭据，只跑 `release:check`。
 
 ## 维护者命令
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "CLI for installing and maintaining cowork-flow collaboration templates.",
   "keywords": [
     "ai-agent",
@@ -30,8 +30,8 @@
   },
   "type": "module",
   "bin": {
-    "cwf": "./bin/cowork-flow.js",
-    "cowork-flow": "./bin/cowork-flow.js"
+    "cwf": "bin/cowork-flow.js",
+    "cowork-flow": "bin/cowork-flow.js"
   },
   "files": [
     "bin",

package/presets/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 Claude Code。",
   "displayName": "Cowork Flow",
   "author": {

package/presets/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 Codex。",
   "author": {
     "name": "fishlikewater",

package/presets/kimi-code/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 Kimi Code。",
   "author": {
     "name": "fishlikewater",

package/presets/qoder/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 Qoder。",
   "displayName": "Cowork Flow",
   "author": {

package/presets/qoder/hooks/hooks.json

@@ -5,9 +5,9 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python",
+            "command": "node",
             "args": [
-              "${QODER_PLUGIN_ROOT}/hooks/inject-context.py"
+              "${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs"
             ],
             "timeout": 30,
             "statusMessage": "cowork-flow: 注入工作流状态"
@@ -20,9 +20,9 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python",
+            "command": "node",
             "args": [
-              "${QODER_PLUGIN_ROOT}/hooks/inject-context.py"
+              "${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs"
             ],
             "timeout": 30,
             "statusMessage": "cowork-flow: 注入工作流状态"
@@ -36,9 +36,9 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python",
+            "command": "node",
             "args": [
-              "${QODER_PLUGIN_ROOT}/hooks/inject-context.py"
+              "${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs"
             ],
             "timeout": 30,
             "statusMessage": "cowork-flow: 规范自查"

package/presets/qoder/hooks/inject-context.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+/**
+ * cowork-flow Qoder plugin hook — transport shim.
+ *
+ * Workflow facts (workflow-state, contract digest, decision
+ * anchor, stage contract, scope/spec edits) come from the
+ * Python source
+ * <scripts>/adapters/host/inject.py; this shim does
+ * transport only:
+ *   1. project resolution from the hook payload (`cwd`),
+ *      then QODER_PROJECT_DIR / QODER_WORKING_DIR;
+ *   2. interpreter location, COWORK_FLOW_PYTHON -> python3
+ *      -> python -> py -3 — the hook runs under the host's
+ *      process PATH, which is not the user's login shell;
+ *   3. stdin passthrough to inject.py --host qoder, with
+ *      stdout forwarded and a failing project runtime
+ *      absorbed (exit 0, reason on stderr) — Qoder refuses
+ *      the prompt on a non-zero hook exit, and the hook is
+ *      machine-level, so it may meet a project runtime
+ *      older than itself.
+ *
+ * Deliberately named .mjs: the installed plugin cache has
+ * no package.json, so a plain .js entry point is parsed as
+ * CommonJS there and an `import` file would only load on
+ * Node versions that auto-detect module syntax.
+ */
+
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { spawnSync } from "child_process";
+
+const HOST = "qoder";
+const DIR_WORKFLOW = ".cowork-flow";
+// hooks.json grants 30s per event.
+const SPAWN_TIMEOUT_MS = 25000;
+
+function readHookInput() {
+  if (process.stdin.isTTY) return { raw: "", parsed: {} };
+  let raw = "";
+  try {
+    raw = readFileSync(0, "utf8");
+  } catch {
+    return { raw: "", parsed: {} };
+  }
+  try {
+    // Tolerate a UTF-8 BOM and surrounding whitespace: the payload is
+    // forwarded verbatim either way, only the parse needs it clean.
+    const parsed = JSON.parse(raw.replace(/^\uFEFF/, "").trim());
+    return { raw, parsed: parsed && typeof parsed === "object" ? parsed : {} };
+  } catch {
+    return { raw, parsed: {} };
+  }
+}
+
+function findWorkflowRoot(startDir) {
+  if (typeof startDir !== "string" || !startDir.trim()) return null;
+  let current;
+  try {
+    current = resolve(startDir);
+  } catch {
+    return null;
+  }
+  for (;;) {
+    if (existsSync(join(current, DIR_WORKFLOW))) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function findProjectRoot(parsedInput) {
+  const candidates = [
+    parsedInput?.cwd,
+    process.env.QODER_PROJECT_DIR,
+    process.env.QODER_WORKING_DIR,
+    process.cwd(),
+  ];
+  for (const candidate of candidates) {
+    const root = findWorkflowRoot(candidate);
+    if (root) return root;
+  }
+  return null;
+}
+
+function pythonCandidates() {
+  const list = [];
+  const env = (process.env.COWORK_FLOW_PYTHON || "").trim();
+  if (env) list.push([env]);
+  list.push(["python3"], ["python"]);
+  if (process.platform === "win32") list.push(["py", "-3"]);
+  return list;
+}
+
+function main() {
+  if (
+    process.env.COWORK_FLOW_HOOKS === "0" ||
+    process.env.COWORK_FLOW_DISABLE_HOOKS === "1"
+  ) {
+    process.exit(0);
+  }
+
+  const { raw, parsed } = readHookInput();
+  const root = findProjectRoot(parsed);
+  if (!root) process.exit(0);
+  const injectScript = join(
+    root,
+    DIR_WORKFLOW,
+    "scripts",
+    "adapters",
+    "host",
+    "inject.py"
+  );
+  if (!existsSync(injectScript)) process.exit(0);
+
+  for (const candidate of pythonCandidates()) {
+    let result;
+    try {
+      result = spawnSync(
+        candidate[0],
+        [...candidate.slice(1), injectScript, "--host", HOST],
+        {
+          input: raw,
+          cwd: root,
+          timeout: SPAWN_TIMEOUT_MS,
+          encoding: "utf8",
+          windowsHide: true,
+        }
+      );
+    } catch {
+      continue;
+    }
+    if (result.error || result.status === null) continue;
+    if (result.stdout) process.stdout.write(result.stdout);
+    if (result.stderr) process.stderr.write(result.stderr);
+    // The interpreter ran; its exit status is the project runtime's verdict,
+    // not ours. Forwarding it would let a stale project copy fail the event
+    // this hook only decorates.
+    if (result.status !== 0) {
+      process.stderr.write(
+        `cowork-flow qoder hook: inject.py exited ${result.status}; skipping injection\n`
+      );
+    }
+    process.exit(0);
+  }
+  // No interpreter could run the entry: stay silent rather
+  // than break the host's event stream (fail-open).
+  process.exit(0);
+}
+
+main();

package/presets/zcode/.zcode-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 ZCode。",
   "author": {
     "name": "fishlikewater",

package/template/.cowork-flow/.version

@@ -1 +1 @@
-1.7.1
+1.7.2

package/template/.cowork-flow/spec/contracts/context-injection.md

@@ -23,7 +23,7 @@ would make the digest self-referential).
 | opencode | plugin `experimental.chat.system.transform` + `shell.env` | system-prompt section push / env object |
 | dsh | preset plugin system-prompt section | named section, replace semantics |
 | kimi-code | user-level `config.toml` (`$KIMI_CODE_HOME`, default `~/.kimi-code/`) `[[hooks]]` row on `UserPromptSubmit` → shim (`cowork-flow-inject.mjs`) → `inject.py --host kimi-code` | bare-text stdout appended to the prompt context, no `hookSpecificOutput` envelope |
-| qoder | machine-level plugin `hooks/hooks.json` (`${QODER_PLUGIN_ROOT}/hooks/inject-context.py`) → project `.cowork-flow/scripts/.../inject.py --host qoder`, stdout JSON | `hookSpecificOutput.{hookEventName, additionalContext}` plus a top-level `systemMessage` (a CLI-visible trace; the model context is unchanged); `PostToolUse` is not blockable there, so the edit advisory rides `additionalContext` on exit 0 |
+| qoder | machine-level plugin `hooks/hooks.json` (node, `${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs`) → project `.cowork-flow/scripts/.../inject.py --host qoder`, stdout JSON | `hookSpecificOutput.{hookEventName, additionalContext}` plus a top-level `systemMessage` (a CLI-visible trace; the model context is unchanged); `PostToolUse` is not blockable there, so the edit advisory rides `additionalContext` on exit 0 |
 
 The qoder row carries one delta beyond the shared envelope: `systemMessage`,
 emitted only on the two injecting events (`SessionStart`, `UserPromptSubmit`)

package/template/skills/runtime-health/scripts/doctor.py

@@ -984,7 +984,7 @@ def check_qoder_plugin(repo_root: Path) -> list[dict[str, str]]:
             "manifest is on disk there; the host cannot load a missing payload",
             "cwf host add qoder --force",
         )
-    for relative in ("hooks/hooks.json", "hooks/inject-context.py"):
+    for relative in ("hooks/hooks.json", "hooks/inject-context.mjs"):
         if not (install_path / relative).is_file():
             return _qoder_warning(
                 "PLUGIN-PAYLOAD-INCOMPLETE",

package/presets/qoder/hooks/inject-context.py

@@ -1,122 +0,0 @@
-#!/usr/bin/env python3
-"""Qoder plugin hook entry: locate the project runtime and forward the payload.
-
-Installed into the Qoder plugin cache, so this file is never next to the
-project it serves. The project is therefore resolved from the hook payload
-(`cwd`) rather than from a module-relative path, and the renderers stay in the
-project's own `.cowork-flow/scripts` — one copy of the injection logic per
-repository, never a stale second copy in the plugin cache.
-
-Fail-open by design: outside a cowork-flow project, or when the project's own
-runtime fails, this exits 0 with no injection. The hook is machine-level, so it
-meets project runtimes older than itself; Qoder refuses the prompt on a
-non-zero hook exit, and a stale project copy must never do that.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-HOST = "qoder"
-WORKFLOW_DIR = ".cowork-flow"
-INJECT_RELPATH = ("scripts", "adapters", "host", "inject.py")
-
-
-def _payload_cwd(raw: bytes) -> str | None:
-    if not raw.strip():
-        return None
-    try:
-        payload = json.loads(raw.decode("utf-8-sig"))
-    except (UnicodeDecodeError, ValueError):
-        return None
-    if isinstance(payload, dict):
-        cwd = payload.get("cwd")
-        if isinstance(cwd, str) and cwd.strip():
-            return cwd
-    return None
-
-
-def find_workflow_root(start: str | None) -> Path | None:
-    if not start:
-        return None
-    try:
-        current = Path(start).resolve()
-    except OSError:
-        return None
-    while True:
-        if (current / WORKFLOW_DIR).is_dir():
-            return current
-        parent = current.parent
-        if parent == current:
-            return None
-        current = parent
-
-
-def resolve_root(raw: bytes) -> Path | None:
-    candidates = [
-        _payload_cwd(raw),
-        os.environ.get("QODER_PROJECT_DIR"),
-        os.environ.get("QODER_WORKING_DIR"),
-        os.getcwd(),
-    ]
-    for candidate in candidates:
-        root = find_workflow_root(candidate)
-        if root is not None:
-            return root
-    return None
-
-
-def resolve_inject(root: Path) -> Path | None:
-    inject = root.joinpath(WORKFLOW_DIR, *INJECT_RELPATH)
-    return inject if inject.is_file() else None
-
-
-def main() -> int:
-    if (
-        os.environ.get("COWORK_FLOW_HOOKS") == "0"
-        or os.environ.get("COWORK_FLOW_DISABLE_HOOKS") == "1"
-    ):
-        return 0
-
-    raw = sys.stdin.buffer.read()
-    root = resolve_root(raw)
-    if root is None:
-        return 0
-    inject = resolve_inject(root)
-    if inject is None:
-        return 0
-
-    # The hook is already running under a Python 3 interpreter, so the only
-    # reason to override it is an explicit COWORK_FLOW_PYTHON; sys.executable
-    # keeps the hook working where `python` is not on PATH at all.
-    interpreter = (os.environ.get("COWORK_FLOW_PYTHON") or "").strip() or sys.executable
-    try:
-        completed = subprocess.run(
-            [interpreter, str(inject), "--host", HOST],
-            input=raw,
-            cwd=str(root),
-            timeout=25,
-        )
-    except OSError as error:
-        print(f"cowork-flow qoder hook: {error}", file=sys.stderr)
-        return 0
-    except subprocess.TimeoutExpired:
-        print("cowork-flow qoder hook: inject timed out", file=sys.stderr)
-        return 0
-    if completed.returncode != 0:
-        # Never propagate: Qoder counts a non-zero exit on SessionStart and
-        # UserPromptSubmit as a blocking hook failure. Keep the reason in the
-        # run log and leave the event alone.
-        print(
-            f"cowork-flow qoder hook: inject.py exited {completed.returncode}; skipping injection",
-            file=sys.stderr,
-        )
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())