flower-trellis 0.2.0 → 0.2.2

package/README.md

@@ -108,16 +108,57 @@ flower banner → 平台多选菜单 → Trellis 原生交互(模板 / monorepo
 
 ## 开发
 
+skill-garden 强化包源以 **git submodule** 形式挂在 `vendor/skill-garden`,克隆时需一并拉取:
+
+```bash
+# 首次克隆(连同 submodule)
+git clone --recurse-submodules https://github.com/SilentFlower/flower-trellis.git
+
+# 已普通克隆过、vendor/skill-garden 为空时补拉
+git submodule update --init --recursive
+```
+
 ```bash
 npm install                                    # 安装依赖
-npm run sync                                   # 从 skill-garden 同步强化包快照到 enhancements/
+npm run sync                                   # 从 vendor/skill-garden 同步强化包快照到 enhancements/
 node bin/flower-trellis.js init -u you --target /tmp/test-project   # 本地试跑(勿在本仓库根直接 init)
 ```
 
-修改强化包后务必重新 `npm run sync`,再发布新版本。
+> `npm run sync` 默认从 submodule `vendor/skill-garden` 读取;可用环境变量 `SKILL_GARDEN_DIR=/path/to/skill-garden` 覆盖到外部副本(旧布局逃生通道)。
+
+**更新强化包**(skill-garden 有新提交时,先动 pin 再重建快照):
+
+```bash
+cd vendor/skill-garden && git fetch && git checkout origin/main && cd ../..
+git add vendor/skill-garden            # 登记新的 submodule pin
+npm run sync                           # 重建 enhancements/ 快照(sourceCommit 跟随新 pin)
+git add enhancements && git commit -m "chore: 更新强化包快照到 <sha>"
+```
 
 > **维护约束**:`workflow.md` 的旧块清理依赖 `src/lib/workflow-inject.js` 中硬编码的 sentinel 名单。修改现有块的内容无需改动名单;但当 skill-garden **新增一种 workflow 块类型**(新的 `BEGIN/END` 名)时,必须同步更新该名单,否则旧块无法被清除。
 
+## 发布
+
+采用「本地把关 + CI 发布」的混合流程,版本更新内容以 `CHANGELOG.md`(由 Conventional Commits 自动生成)为唯一来源:
+
+```bash
+# 1) 本地:按约定式提交自动定版本号 + 写 CHANGELOG + 打 tag(不 push、不 publish)
+npm run release          # = check-snapshot(校验快照一致)+ commit-and-tag-version
+npm run release:dry      # 仅预览版本号与 CHANGELOG,不落盘
+
+# 2) 检查 CHANGELOG / package.json 版本 diff,确认无误后连 tag 一起推送
+git push --follow-tags origin main
+```
+
+推送 `vX.Y.Z` tag 后,GitHub Actions(`.github/workflows/release.yml`)自动完成:
+
+- **`npm publish`** —— 经 npm **OIDC Trusted Publishing** 发布,自动带 provenance 来源证明,**无需** `NPM_TOKEN`。
+- **`gh release create`** —— 创建 GitHub Release,notes 取自 `CHANGELOG.md` 对应版本段(与 CHANGELOG 同源)。
+
+> **一次性前置**:首次发布前需在 [npmjs.com](https://www.npmjs.com) 的本包设置里配置 **Trusted Publisher**,绑定 `SilentFlower/flower-trellis` 仓库与 `release.yml`,否则 OIDC 发布会失败。
+>
+> **发布前自检**:`npm run release` 会先跑 `scripts/check-snapshot.mjs`,确保 `enhancements/` 快照与 `vendor/skill-garden` 当前 pin 一致且已提交,杜绝发布陈旧快照。
+
 ## 相关项目
 
 | 项目 | 作用 |

package/enhancements/0.6/overrides/workflow-states/no_task.md

@@ -3,4 +3,6 @@ HIGHEST PRIORITY SKILL-GARDEN STATE GUARD (no_task):
 Creating/resuming a task is not implementation permission.
 After PRD ready and task started, next implementation action = `trellis-route(implement)`.
 If no active task exists, scan `.trellis/tasks/*/task.json` once per session for in-progress tasks with `last_push_snapshot`; surface completed_steps + next_step and suggest rebinding the active task before resuming.
+Do NOT use the harness built-in plan mode (`EnterPlanMode` / `ExitPlanMode`) as a substitute for this gate. Planning is Trellis-only: classify the turn, ask for task-creation consent, then `trellis-brainstorm` for complex work.
+If the turn is a meta edit to Trellis itself (Trellis tracking would be overkill), say so and ask to skip Trellis — never silently swap built-in plan mode in for the consent gate.
 <!-- END skill-garden workflow-state no_task v0.6 -->

package/enhancements/0.6/overrides/workflow.md

@@ -29,18 +29,20 @@ Check routing has no 4h preference file. Before `trellis-check`, `trellis-check-
 
 #### Finish-work Bookkeeping Guard
 
-`session_auto_commit` only controls script-managed bookkeeping commits for Trellis task archives and workspace journals. It does not disable Phase 3.4 code-work commits that the user explicitly confirms.
+`session_auto_commit` governs ONLY the script-managed bookkeeping commits that `task.py archive` and `add_session.py` make for their own files (`.trellis/tasks/**` archive moves and `.trellis/workspace/**` journal/index). It is NOT a global auto-commit switch, and it has NO authority over code commits.
 
-If `.trellis/config.yaml` contains `session_auto_commit: false`, finish-work must treat archive and journal writes as disk-only bookkeeping:
+Code commits always belong to Phase 3.4: the agent drafts the batched commit plan and commits only after the user confirms — in EVERY case, whether `session_auto_commit` is `true` or `false`. Never treat `session_auto_commit: true` as permission to auto-commit code, to skip the Phase 3.4 confirmation prompt, or to commit any path outside the two scripts' own bookkeeping files. The two are independent: this switch never decides whether code is committed, and it never decides whether to ask first.
+
+When `session_auto_commit: true` (the default): `task.py archive` produces a `chore(task): archive ...` commit and `add_session.py` produces a `chore: record journal` commit, each touching only its own bookkeeping files. Code stays dirty for the Phase 3.4 plan.
+
+When `.trellis/config.yaml` sets `session_auto_commit: false`, finish-work must treat archive and journal writes as disk-only bookkeeping:
 
 - Running `python3 ./.trellis/scripts/task.py archive <task>` may move task files, but must not be described as producing a `chore(task): archive ...` commit.
 - Running `python3 ./.trellis/scripts/add_session.py ...` may write workspace journal/index files, but must not be described as producing a `chore: record journal` commit.
 - Do not run a compensating `git add` / `git commit` for `.trellis/tasks/**` or `.trellis/workspace/**` just because those scripts skipped auto-commit.
 - Report the resulting `.trellis/tasks/**` and `.trellis/workspace/**` dirty paths to the user as bookkeeping changes for manual review.
 
-Phase 3.4 code-work commits are unchanged. If code files from the task are dirty, the agent may still present the normal one-shot commit plan and commit only after the user confirms.
-
-This guard only prevents archive/journal bookkeeping commits from being forced when `session_auto_commit: false`.
+This guard scopes `session_auto_commit` to the two bookkeeping commits above; Phase 3.4 code-work commits stay confirmation-gated regardless of its value.
 
 #### Push Progress Recovery / Snapshot
 

package/enhancements/MANIFEST.json

@@ -1,7 +1,7 @@
 {
-  "syncedAt": "2026-06-08T15:47:02.818Z",
-  "syncedFrom": "/root/project/skill-garden/.trellis",
-  "sourceCommit": "824727cb279202c65bb653529fc84f5e135c25e2",
+  "syncedAt": "2026-06-08T17:00:12.577Z",
+  "syncedFrom": "vendor/skill-garden/.trellis",
+  "sourceCommit": "1dcf26869e7c90be0777ebe3448501f340e05b45",
   "variants": {
     "old": {
       "claudeSkills": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flower-trellis",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "一键安装/升级 Trellis 并自动融合 skill-garden 强化包(默认 Claude + agents)",
   "type": "module",
   "bin": {
@@ -26,7 +26,9 @@
   ],
   "scripts": {
     "sync": "node scripts/sync-enhancements.mjs",
-    "prepublishOnly": "node scripts/sync-enhancements.mjs"
+    "prepublishOnly": "node scripts/sync-enhancements.mjs",
+    "release": "node scripts/check-snapshot.mjs && commit-and-tag-version",
+    "release:dry": "commit-and-tag-version --dry-run"
   },
   "keywords": [
     "trellis",
@@ -36,5 +38,16 @@
     "claude",
     "cli"
   ],
-  "license": "MIT"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SilentFlower/flower-trellis.git"
+  },
+  "bugs": {
+    "url": "https://github.com/SilentFlower/flower-trellis/issues"
+  },
+  "homepage": "https://github.com/SilentFlower/flower-trellis#readme",
+  "license": "MIT",
+  "devDependencies": {
+    "commit-and-tag-version": "^12.7.3"
+  }
 }