release-skill 0.1.1 → 0.1.4

package/src/adapters/npm.mjs

@@ -1,12 +1,14 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { execFile as execFileCb, spawn } from 'node:child_process';
 import { gunzipSync } from 'node:zlib';
-import { createRequire } from 'node:module';
 import { promisify } from 'node:util';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { constants as fsConstants } from 'node:fs';
 import { chmod, lstat, mkdtemp, open, readFile, realpath, rm } from 'node:fs/promises';
 
+import libnpmpublish from 'libnpmpublish';
+import npmRegistryFetch from 'npm-registry-fetch';
+
 import {
   ActionStatus,
   ActionType,
@@ -67,20 +69,14 @@ async function run(command, args, options = {}) {
  * Authentication and registry options must be supplied explicitly by the
  * caller; errors are sanitized before they cross the adapter boundary.
  */
-let _libnpmpublish;
-let _npmRegistryFetch;
 async function defaultPublishTarballBuffer({ buffer, manifest, opts: publishOpts }) {
-  if (!_libnpmpublish) {
-    const require = createRequire(import.meta.url);
-    _libnpmpublish = require('libnpmpublish');
-  }
   const libOpts = {};
   if (publishOpts.registry) libOpts.registry = publishOpts.registry;
   if (publishOpts.token) libOpts.forceAuth = { token: publishOpts.token };
   if (publishOpts.access) libOpts.access = publishOpts.access;
   if (publishOpts.tag) libOpts.defaultTag = publishOpts.tag;
   if (publishOpts.provenance) libOpts.provenance = publishOpts.provenance;
-  return _libnpmpublish.publish(manifest, buffer, libOpts);
+  return libnpmpublish.publish(manifest, buffer, libOpts);
 }
 
 export function registryTokenKey(registry) {
@@ -144,11 +140,7 @@ export async function resolveNpmRegistryAuthToken(options) {
 
 async function defaultWhoamiWithToken({ registry, token, cwd, exec }) {
   try {
-    if (!_npmRegistryFetch) {
-      const require = createRequire(import.meta.url);
-      _npmRegistryFetch = require('npm-registry-fetch');
-    }
-    const result = await _npmRegistryFetch.json('/-/whoami', {
+    const result = await npmRegistryFetch.json('/-/whoami', {
       registry: `${normalizeRegistry(registry)}/`,
       forceAuth: { token },
       preferOnline: true,

package/src/adapters/plugin-marketplace.mjs

@@ -33,6 +33,43 @@ const execFile = promisify(execFileCb);
 
 const NAME = 'plugin-marketplace';
 
+function transportPayload(entries) {
+  return entries.map(({ path, type, mode, size, contentDigest }) => ({
+    path,
+    type,
+    // The local authority removes write bits when sealing. Git checkout and
+    // plugin installation restore owner-write permission, while preserving
+    // executable intent. Ignore only write bits; retain every other mode bit.
+    mode: mode & ~0o222,
+    size,
+    contentDigest,
+  }));
+}
+
+async function verifyInstalledMarketplacePayload(action, context, installPath, consumer) {
+  const sourcePath = await resolveFrozenPath(
+    context.root,
+    action.snapshotPath,
+    'frozen marketplace snapshot',
+  );
+  const sourceSnapshot = await computeFrozenSnapshot(sourcePath);
+  if (sourceSnapshot.digest !== action.manifestDigest) {
+    throw new Error('frozen marketplace snapshot digest no longer matches the plan');
+  }
+  const installedSnapshot = await computeFrozenSnapshot(installPath, {
+    excludeRootEntries: consumer === 'codex' ? ['.git'] : [],
+  });
+  if (
+    JSON.stringify(transportPayload(sourceSnapshot.entries))
+    !== JSON.stringify(transportPayload(installedSnapshot.entries))
+  ) {
+    throw new Error('installed marketplace payload differs in path, bytes, size, or non-write mode bits');
+  }
+  // This is not an expected-value backfill: the sealed authority digest was
+  // revalidated above and the installed payload was independently compared.
+  return action.manifestDigest;
+}
+
 async function writeEvidenceAtomic(filePath, value) {
   const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
   try {
@@ -386,26 +423,15 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             });
           }
 
-          // Verify marketplace files exist
-          const manifestRelative = consumer === 'claude'
-            ? '.claude-plugin/plugin.json'
-            : '.codex-plugin/plugin.json';
+          // Verify marketplace files exist.
+          // marketplace.json is at the snapshot root; plugin manifest is
+          // resolved relative to the entry's declared source path.
           const marketplaceRelative = consumer === 'claude'
             ? '.claude-plugin/marketplace.json'
             : '.agents/plugins/marketplace.json';
 
-          const manifestPath = resolve(snapshotDirReal, manifestRelative);
           const marketplacePath = resolve(snapshotDirReal, marketplaceRelative);
 
-          const manifestResult = await validateManifestFile(manifestPath, ['name', 'version']);
-          if (!manifestResult.valid) {
-            return createResult({
-              actionType,
-              status: ActionStatus.PREFLIGHT_FAILED,
-              error: `frozen snapshot ${manifestRelative} invalid: ${manifestResult.error}`,
-            });
-          }
-
           // marketplace.json must exist and have root name (no root version required)
           const marketplaceResult = await validateManifestFile(marketplacePath, ['name']);
           if (!marketplaceResult.valid) {
@@ -444,23 +470,70 @@ export function createPluginMarketplaceAdapter(deps = {}) {
           }
           const entry = pluginEntry[0];
 
-          // Entry source must be "./" (Claude: string, Codex: object with path "./")
-          if (consumer === 'claude') {
-            if (entry.source !== './') {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `Claude marketplace plugin entry source must be "./", got "${entry.source}"`,
-              });
-            }
-          } else {
-            if (entry.source?.source !== 'local' || entry.source?.path !== './') {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `Codex marketplace plugin entry source must be {source:"local",path:"./"}, got ${JSON.stringify(entry.source)}`,
-              });
-            }
+          // Entry source must be a safe relative path within the snapshot.
+          // Accepts "./" (root-level), "./adapters/claude" (subdirectory),
+          // etc. Rejects absolute paths, ".." traversal, remote URLs, and
+          // empty strings.
+          const sourcePath = consumer === 'claude'
+            ? entry.source
+            : entry.source?.source === 'local' ? entry.source?.path : null;
+          if (typeof sourcePath !== 'string' || sourcePath.length === 0) {
+            return createResult({
+              actionType,
+              status: ActionStatus.PREFLIGHT_FAILED,
+              error: `marketplace plugin entry source must be a non-empty relative path${consumer === 'codex' ? ' (object with source:"local")' : ''}, got ${JSON.stringify(entry.source)}`,
+            });
+          }
+          if (
+            sourcePath.startsWith('/') ||
+            sourcePath.includes('..') ||
+            sourcePath.includes('\\') ||
+            /^https?:\/\//i.test(sourcePath)
+          ) {
+            return createResult({
+              actionType,
+              status: ActionStatus.PREFLIGHT_FAILED,
+              error: `marketplace plugin entry source "${sourcePath}" is not a safe relative path`,
+            });
+          }
+          // Verify the declared source directory exists and contains the
+          // expected plugin manifest inside the frozen snapshot.
+          const sourceDirAbs = resolve(snapshotDirReal, sourcePath);
+          const sourceDirReal = await realpath(sourceDirAbs).catch(() => null);
+          if (!sourceDirReal) {
+            return createResult({
+              actionType,
+              status: ActionStatus.PREFLIGHT_FAILED,
+              error: `marketplace plugin entry source directory does not exist: ${sourcePath}`,
+            });
+          }
+          // Containment check: source must stay inside the snapshot
+          const sourceRelCheck = relative(snapshotDirReal, sourceDirReal);
+          if (sourceRelCheck.startsWith('..') || isAbsolute(sourceRelCheck)) {
+            return createResult({
+              actionType,
+              status: ActionStatus.PREFLIGHT_FAILED,
+              error: `marketplace plugin entry source "${sourcePath}" escapes the frozen snapshot`,
+            });
+          }
+
+          // Resolve plugin manifest relative to the declared source path.
+          // For root layouts (source: "./"), this resolves to
+          //   snapshot/.claude-plugin/plugin.json
+          // For subdirectory layouts (source: "./adapters/claude"), this resolves to
+          //   snapshot/adapters/claude/.claude-plugin/plugin.json
+          const manifestRelative = consumer === 'claude'
+            ? join(sourcePath, '.claude-plugin', 'plugin.json')
+            : join(sourcePath, '.codex-plugin', 'plugin.json');
+          const manifestPath = resolve(snapshotDirReal, manifestRelative);
+
+          const manifestResult = await validateManifestFile(manifestPath, ['name', 'version']);
+          if (!manifestResult.valid) {
+            return createResult({
+              actionType,
+              status: ActionStatus.PREFLIGHT_FAILED,
+              error: `frozen snapshot ${manifestRelative} invalid: ${manifestResult.error}`,
+            });
           }
 
           // Claude carries the version in the marketplace entry. Codex keeps
@@ -862,10 +935,12 @@ export function createPluginMarketplaceAdapter(deps = {}) {
           let executeManifestDigest = null;
           if (installPath) {
             try {
-              const { digest } = await computeFrozenSnapshot(installPath, {
-                excludeRootEntries: consumer === 'codex' ? ['.git'] : [],
-              });
-              executeManifestDigest = digest;
+              executeManifestDigest = await verifyInstalledMarketplacePayload(
+                action,
+                context,
+                installPath,
+                consumer,
+              );
             } catch {
               // Digest computation failure is caught at verify time
             }
@@ -1176,26 +1251,30 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             });
           }
 
-          // Compute real manifestDigest from installed content using frozen algorithm
+          // Bind the installed payload back to the sealed authority while
+          // normalizing only transport-restored write permission bits.
           let manifestDigest;
+          let manifestError = null;
           try {
-            // Codex retains a root .git checkout as consumer-owned transport
-            // metadata. It is not part of the published plugin payload.
-            const { digest } = await computeFrozenSnapshot(installPath, {
-              excludeRootEntries: consumer === 'codex' ? ['.git'] : [],
-            });
-            manifestDigest = digest;
+            manifestDigest = await verifyInstalledMarketplacePayload(
+              action,
+              context,
+              installPath,
+              consumer,
+            );
           } catch (digestErr) {
-            return createResult({
-              actionType,
-              status: ActionStatus.OBSERVED,
-              observation: {
-                installed: true,
-                installPath,
-                entrySkillFound: true,
-                error: `failed to compute manifestDigest: ${digestErr.message}`,
-              },
-            });
+            // Preserve independently observed fields for diagnostics. This
+            // raw digest is not accepted as plan authority because the error
+            // is returned and verify therefore fails closed.
+            try {
+              const installedSnapshot = await computeFrozenSnapshot(installPath, {
+                excludeRootEntries: consumer === 'codex' ? ['.git'] : [],
+              });
+              manifestDigest = installedSnapshot.digest;
+            } catch {
+              manifestDigest = undefined;
+            }
+            manifestError = `failed to bind manifestDigest to frozen authority: ${digestErr.message}`;
           }
 
           // Build observation with CLI-proven fields only (no action backfill)
@@ -1318,6 +1397,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             actionType,
             status: ActionStatus.OBSERVED,
             observation,
+            error: manifestError,
           });
         }
 

package/src/adapters/push-snapshot.mjs

@@ -54,6 +54,37 @@ function validateAction(action) {
   validateOid(action.commit, 'commit');
   validateOid(action.tree, 'tree');
   githubRepositoryUrl(action.repo, action.githubHost);
+
+  const validStrategies = ['create-release-branch', 'advance-existing-branch', 'initialize-default-branch'];
+  const strategy = action.branchStrategy ?? 'create-release-branch';
+  if (typeof strategy !== 'string' || !validStrategies.includes(strategy)) {
+    throw new Error(`branchStrategy must be one of: ${validStrategies.join(', ')}`);
+  }
+  if (strategy === 'advance-existing-branch' || strategy === 'initialize-default-branch') {
+    if (!action.parentCommit || typeof action.parentCommit !== 'string') {
+      throw new Error(`${strategy} requires parentCommit`);
+    }
+    validateOid(action.parentCommit, 'parentCommit');
+  }
+  if (strategy === 'advance-existing-branch') {
+    if (!action.expectedBaselineCommit || typeof action.expectedBaselineCommit !== 'string') {
+      throw new Error('advance-existing-branch requires expectedBaselineCommit');
+    }
+    validateOid(action.expectedBaselineCommit, 'expectedBaselineCommit');
+    if (action.expectedBaselineCommit !== action.parentCommit) {
+      throw new Error('advance-existing-branch expectedBaselineCommit must equal parentCommit');
+    }
+  }
+  if (strategy === 'create-release-branch' && (action.parentCommit || action.expectedBaselineCommit)) {
+    throw new Error('create-release-branch must not declare parentCommit or expectedBaselineCommit');
+  }
+
+  if (action.parentCommit != null && typeof action.parentCommit === 'string') {
+    validateOid(action.parentCommit, 'parentCommit');
+  }
+  if (action.expectedBaselineCommit != null && typeof action.expectedBaselineCommit === 'string') {
+    validateOid(action.expectedBaselineCommit, 'expectedBaselineCommit');
+  }
 }
 
 async function inspectLocalObjects(action, context, exec) {
@@ -62,6 +93,7 @@ async function inspectLocalObjects(action, context, exec) {
     gitObjectDir: action.gitObjectDir,
     commit: action.commit,
     tree: action.tree,
+    parentCommit: action.parentCommit,
     exec,
   });
   await exec('git', ['check-ref-format', `refs/heads/${action.branch}`], { shell: false });
@@ -91,12 +123,32 @@ export function createPushSnapshotAdapter(deps = {}) {
           ['ls-remote', '--heads', remoteUrl, `refs/heads/${action.branch}`],
           { shell: false },
         );
-        if (stdout.trim()) {
-          return createResult({
-            actionType: action.actionType,
-            status: ActionStatus.PREFLIGHT_FAILED,
-            error: `remote branch already exists: ${action.branch}; human intervention required`,
-          });
+        const remoteTip = stdout.trim().split(/\s+/)[0] ?? '';
+        const strategy = action.branchStrategy ?? 'create-release-branch';
+
+        if (strategy === 'advance-existing-branch') {
+          if (!remoteTip) {
+            return createResult({
+              actionType: action.actionType,
+              status: ActionStatus.PREFLIGHT_FAILED,
+              error: `advance-existing-branch requires remote branch to exist: ${action.branch}`,
+            });
+          }
+          if (remoteTip !== action.expectedBaselineCommit) {
+            return createResult({
+              actionType: action.actionType,
+              status: ActionStatus.PREFLIGHT_FAILED,
+              error: `remote branch tip mismatch: expected ${action.expectedBaselineCommit} but found ${remoteTip}`,
+            });
+          }
+        } else if (strategy === 'initialize-default-branch' || strategy === 'create-release-branch') {
+          if (remoteTip) {
+            return createResult({
+              actionType: action.actionType,
+              status: ActionStatus.PREFLIGHT_FAILED,
+              error: `remote branch already exists: ${action.branch}; human intervention required`,
+            });
+          }
         }
         return createResult({ actionType: action.actionType, status: ActionStatus.PREFLIGHT_PASSED });
       } catch (err) {
@@ -119,17 +171,32 @@ export function createPushSnapshotAdapter(deps = {}) {
         });
         const gitDir = await inspectLocalObjects(action, context, exec);
         const remoteUrl = githubRepositoryUrl(action.repo, action.githubHost);
-        await exec(
-          'git',
-          [
-            '--git-dir', gitDir,
-            'push',
-            `--force-with-lease=refs/heads/${action.branch}:`,
-            remoteUrl,
-            `${action.commit}:refs/heads/${action.branch}`,
-          ],
-          { shell: false },
-        );
+        const strategy = action.branchStrategy ?? 'create-release-branch';
+
+        if (strategy === 'advance-existing-branch') {
+          await exec(
+            'git',
+            [
+              '--git-dir', gitDir,
+              'push',
+              remoteUrl,
+              `${action.commit}:refs/heads/${action.branch}`,
+            ],
+            { shell: false },
+          );
+        } else {
+          await exec(
+            'git',
+            [
+              '--git-dir', gitDir,
+              'push',
+              `--force-with-lease=refs/heads/${action.branch}:`,
+              remoteUrl,
+              `${action.commit}:refs/heads/${action.branch}`,
+            ],
+            { shell: false },
+          );
+        }
         return createResult({ actionType: action.actionType, status: ActionStatus.EXECUTED });
       } catch (err) {
         return createResult({

package/src/artifacts/policy.mjs

@@ -10,7 +10,6 @@
  */
 
 import { readFile } from 'node:fs/promises';
-import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
 import YAML from 'yaml';
@@ -22,21 +21,19 @@ import {
   PATH_UNSAFE,
 } from '../core/errors.mjs';
 import { canonicalArtifactPath } from './path-key.mjs';
+import { readTrustedPackageResourceSync } from '../core/trusted-resource.mjs';
 
 // ---------------------------------------------------------------------------
 // Schema validation
 // ---------------------------------------------------------------------------
 
-const POLICY_SCHEMA_PATH = new URL(
-  '../../schemas/artifact-policy.schema.json',
-  import.meta.url,
-);
-
 const ajv = new Ajv({ allErrors: true, strict: false });
 addFormats(ajv);
 
 // Compile schema once at module load (synchronous).
-const _validate = ajv.compile(JSON.parse(readFileSync(POLICY_SCHEMA_PATH, 'utf8')));
+const _validate = ajv.compile(JSON.parse(readTrustedPackageResourceSync(
+  'schemas/artifact-policy.schema.json',
+).toString('utf8')));
 
 /**
  * Validate a policy object against the artifact-policy JSON Schema.

package/src/artifacts/safe-fs-backend-internal.mjs

@@ -10,10 +10,10 @@
 
 import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { realpath } from 'node:fs/promises';
 import { readFileSync, realpathSync, lstatSync } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
 
 import {
   ReleaseError,
@@ -25,17 +25,71 @@ import {
 // Constants
 // ---------------------------------------------------------------------------
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const DEFAULT_ADDON_REL = '../../native/safe-write/build/Release/safe_write.node';
-const PREBUILDS_REL = '../../native/safe-write/prebuilds.json';
+// Keep this internal loader self-contained. Besides making the native trust
+// boundary auditable, this lets isolated consumers test/copy it together with
+// errors.mjs only. In the bundle the banner supplies __bundlePkgRoot; in source
+// mode the module's own URL deterministically identifies the package root.
+const PKG_ROOT = typeof __bundlePkgRoot !== 'undefined'
+  ? __bundlePkgRoot
+  : resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+const NATIVE_BASE = resolve(PKG_ROOT, 'native/safe-write');
+const PREBUILDS_PATH = resolve(NATIVE_BASE, 'prebuilds.json');
+const PREBUILDS_RESOURCE = 'native/safe-write/prebuilds.json';
+const DEFAULT_ADDON_PATH = resolve(NATIVE_BASE, 'build/Release/safe_write.node');
 
 const EXPECTED_EXPORTS = Object.freeze([
   'openRoot', 'openDir', 'readEntry', 'readFile',
   'createTemp', 'rename', 'abortTemp', 'mkdir', 'rmdir', 'unlink', 'chmod', 'fsync', 'close',
 ]);
 
+function failPrebuildManifest(reason, message = 'prebuilds manifest not readable') {
+  throw new ReleaseError(
+    SAFE_WRITE_UNAVAILABLE,
+    message,
+    { resource: PREBUILDS_RESOURCE, reason },
+  );
+}
+
+function readTrustedPrebuildManifest() {
+  let lexicalStat;
+  try {
+    lexicalStat = lstatSync(PREBUILDS_PATH, { bigint: true });
+  } catch {
+    failPrebuildManifest('MISSING');
+  }
+
+  if (lexicalStat.isSymbolicLink()) {
+    failPrebuildManifest('SYMLINK', 'prebuilds manifest must not be a symlink');
+  }
+  if (!lexicalStat.isFile()) {
+    failPrebuildManifest('NOT_REGULAR_FILE', 'prebuilds manifest is not a regular file');
+  }
+  if (lexicalStat.nlink !== 1n) {
+    failPrebuildManifest('UNEXPECTED_HARDLINK_COUNT', 'prebuilds manifest has invalid nlink count');
+  }
+
+  let physicalBase;
+  let physicalManifest;
+  try {
+    physicalBase = realpathSync(NATIVE_BASE);
+    physicalManifest = realpathSync(PREBUILDS_PATH);
+  } catch {
+    failPrebuildManifest('REALPATH_FAILED');
+  }
+  if (!physicalManifest.startsWith(physicalBase + '/') && physicalManifest !== physicalBase) {
+    failPrebuildManifest(
+      'PHYSICAL_PATH_ESCAPE',
+      'prebuilds manifest physical path escapes base directory',
+    );
+  }
+
+  try {
+    return JSON.parse(readFileSync(physicalManifest, 'utf8'));
+  } catch {
+    failPrebuildManifest('READ_FAILED');
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Error sanitization
 // ---------------------------------------------------------------------------
@@ -58,7 +112,7 @@ function sanitizeError(err) {
  * Returns the verified physical path on success, or null on failure.
  */
 function isWithinPackageBuildDir(addonPath) {
-  const buildDir = resolve(__dirname, '../../native/safe-write/build/');
+  const buildDir = resolve(NATIVE_BASE, 'build/');
   const resolved = resolve(addonPath);
   if (!resolved.startsWith(buildDir + '/') && resolved !== buildDir) {
     return null;
@@ -106,8 +160,8 @@ function validateManifestEntry(entry, key) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, `manifest entry missing exports for ${key}`);
   }
 
-  const resolved = resolve(__dirname, '../../native/safe-write', entry.path);
-  const baseDir = resolve(__dirname, '../../native/safe-write/');
+  const resolved = resolve(NATIVE_BASE, entry.path);
+  const baseDir = NATIVE_BASE;
   if (!resolved.startsWith(baseDir + '/') && resolved !== baseDir) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, `manifest path escapes base directory for ${key}`);
   }
@@ -126,7 +180,8 @@ function validateManifestEntry(entry, key) {
 
 function requireAddon(addonPath) {
   try {
-    const require = createRequire(import.meta.url);
+    // Use PKG_ROOT-relative resolution so bundled mode can find the addon.
+    const require = createRequire(resolve(PKG_ROOT, 'package.json'));
     return require(addonPath);
   } catch (err) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, sanitizeError(err));
@@ -149,14 +204,7 @@ function requireAddon(addonPath) {
 
 export function readStableAddon(options = {}) {
   const hooks = options._hooks || {};
-
-  const prebuildsPath = resolve(__dirname, PREBUILDS_REL);
-  let manifest;
-  try {
-    manifest = JSON.parse(readFileSync(prebuildsPath, 'utf8'));
-  } catch {
-    throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'prebuilds manifest not readable');
-  }
+  const manifest = readTrustedPrebuildManifest();
 
   if (!manifest.prebuilds || typeof manifest.prebuilds !== 'object') {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'prebuilds manifest has invalid structure');
@@ -174,7 +222,7 @@ export function readStableAddon(options = {}) {
   validateManifestEntry(entry, key);
 
   // Resolve lexical candidate path
-  const addonFile = resolve(__dirname, '../../native/safe-write', entry.path);
+  const addonFile = resolve(NATIVE_BASE, entry.path);
 
   // Step 1: lstat LEXICAL path FIRST — reject symlink, non-regular, nlink!=1
   // Must lstat the original path to detect symlinks; lstat on a resolved path
@@ -207,7 +255,7 @@ export function readStableAddon(options = {}) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'prebuilt addon not accessible');
   }
 
-  const nativeBaseDir = realpathSync(resolve(__dirname, '../../native/safe-write/'));
+  const nativeBaseDir = realpathSync(NATIVE_BASE);
   if (!physicalAddonFile.startsWith(nativeBaseDir + '/') && physicalAddonFile !== nativeBaseDir) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'prebuilt addon physical path escapes base directory');
   }
@@ -305,7 +353,7 @@ export function loadNativeAddon(addonPath) {
 
   // 2. Development mode
   if (process.env.RELEASE_SKILL_NATIVE_DEV === '1') {
-    const devPath = resolve(__dirname, DEFAULT_ADDON_REL);
+    const devPath = DEFAULT_ADDON_PATH;
     const physicalPath = isWithinPackageBuildDir(devPath);
     if (!physicalPath) {
       throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'dev addon path is outside build directory');