release-skill 0.1.3 → 0.1.5

package/src/artifacts/policy.mjs

@@ -10,7 +10,6 @@
  */
 
 import { readFile } from 'node:fs/promises';
-import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
 import YAML from 'yaml';
@@ -22,21 +21,19 @@ import {
   PATH_UNSAFE,
 } from '../core/errors.mjs';
 import { canonicalArtifactPath } from './path-key.mjs';
+import { readTrustedPackageResourceSync } from '../core/trusted-resource.mjs';
 
 // ---------------------------------------------------------------------------
 // Schema validation
 // ---------------------------------------------------------------------------
 
-const POLICY_SCHEMA_PATH = new URL(
-  '../../schemas/artifact-policy.schema.json',
-  import.meta.url,
-);
-
 const ajv = new Ajv({ allErrors: true, strict: false });
 addFormats(ajv);
 
 // Compile schema once at module load (synchronous).
-const _validate = ajv.compile(JSON.parse(readFileSync(POLICY_SCHEMA_PATH, 'utf8')));
+const _validate = ajv.compile(JSON.parse(readTrustedPackageResourceSync(
+  'schemas/artifact-policy.schema.json',
+).toString('utf8')));
 
 /**
  * Validate a policy object against the artifact-policy JSON Schema.

package/src/artifacts/safe-fs-backend-internal.mjs

@@ -10,10 +10,10 @@
 
 import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { realpath } from 'node:fs/promises';
 import { readFileSync, realpathSync, lstatSync } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
 
 import {
   ReleaseError,
@@ -25,17 +25,71 @@ import {
 // Constants
 // ---------------------------------------------------------------------------
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const DEFAULT_ADDON_REL = '../../native/safe-write/build/Release/safe_write.node';
-const PREBUILDS_REL = '../../native/safe-write/prebuilds.json';
+// Keep this internal loader self-contained. Besides making the native trust
+// boundary auditable, this lets isolated consumers test/copy it together with
+// errors.mjs only. In the bundle the banner supplies __bundlePkgRoot; in source
+// mode the module's own URL deterministically identifies the package root.
+const PKG_ROOT = typeof __bundlePkgRoot !== 'undefined'
+  ? __bundlePkgRoot
+  : resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+const NATIVE_BASE = resolve(PKG_ROOT, 'native/safe-write');
+const PREBUILDS_PATH = resolve(NATIVE_BASE, 'prebuilds.json');
+const PREBUILDS_RESOURCE = 'native/safe-write/prebuilds.json';
+const DEFAULT_ADDON_PATH = resolve(NATIVE_BASE, 'build/Release/safe_write.node');
 
 const EXPECTED_EXPORTS = Object.freeze([
   'openRoot', 'openDir', 'readEntry', 'readFile',
   'createTemp', 'rename', 'abortTemp', 'mkdir', 'rmdir', 'unlink', 'chmod', 'fsync', 'close',
 ]);
 
+function failPrebuildManifest(reason, message = 'prebuilds manifest not readable') {
+  throw new ReleaseError(
+    SAFE_WRITE_UNAVAILABLE,
+    message,
+    { resource: PREBUILDS_RESOURCE, reason },
+  );
+}
+
+function readTrustedPrebuildManifest() {
+  let lexicalStat;
+  try {
+    lexicalStat = lstatSync(PREBUILDS_PATH, { bigint: true });
+  } catch {
+    failPrebuildManifest('MISSING');
+  }
+
+  if (lexicalStat.isSymbolicLink()) {
+    failPrebuildManifest('SYMLINK', 'prebuilds manifest must not be a symlink');
+  }
+  if (!lexicalStat.isFile()) {
+    failPrebuildManifest('NOT_REGULAR_FILE', 'prebuilds manifest is not a regular file');
+  }
+  if (lexicalStat.nlink !== 1n) {
+    failPrebuildManifest('UNEXPECTED_HARDLINK_COUNT', 'prebuilds manifest has invalid nlink count');
+  }
+
+  let physicalBase;
+  let physicalManifest;
+  try {
+    physicalBase = realpathSync(NATIVE_BASE);
+    physicalManifest = realpathSync(PREBUILDS_PATH);
+  } catch {
+    failPrebuildManifest('REALPATH_FAILED');
+  }
+  if (!physicalManifest.startsWith(physicalBase + '/') && physicalManifest !== physicalBase) {
+    failPrebuildManifest(
+      'PHYSICAL_PATH_ESCAPE',
+      'prebuilds manifest physical path escapes base directory',
+    );
+  }
+
+  try {
+    return JSON.parse(readFileSync(physicalManifest, 'utf8'));
+  } catch {
+    failPrebuildManifest('READ_FAILED');
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Error sanitization
 // ---------------------------------------------------------------------------
@@ -58,7 +112,7 @@ function sanitizeError(err) {
  * Returns the verified physical path on success, or null on failure.
  */
 function isWithinPackageBuildDir(addonPath) {
-  const buildDir = resolve(__dirname, '../../native/safe-write/build/');
+  const buildDir = resolve(NATIVE_BASE, 'build/');
   const resolved = resolve(addonPath);
   if (!resolved.startsWith(buildDir + '/') && resolved !== buildDir) {
     return null;
@@ -106,8 +160,8 @@ function validateManifestEntry(entry, key) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, `manifest entry missing exports for ${key}`);
   }
 
-  const resolved = resolve(__dirname, '../../native/safe-write', entry.path);
-  const baseDir = resolve(__dirname, '../../native/safe-write/');
+  const resolved = resolve(NATIVE_BASE, entry.path);
+  const baseDir = NATIVE_BASE;
   if (!resolved.startsWith(baseDir + '/') && resolved !== baseDir) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, `manifest path escapes base directory for ${key}`);
   }
@@ -126,7 +180,8 @@ function validateManifestEntry(entry, key) {
 
 function requireAddon(addonPath) {
   try {
-    const require = createRequire(import.meta.url);
+    // Use PKG_ROOT-relative resolution so bundled mode can find the addon.
+    const require = createRequire(resolve(PKG_ROOT, 'package.json'));
     return require(addonPath);
   } catch (err) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, sanitizeError(err));
@@ -149,14 +204,7 @@ function requireAddon(addonPath) {
 
 export function readStableAddon(options = {}) {
   const hooks = options._hooks || {};
-
-  const prebuildsPath = resolve(__dirname, PREBUILDS_REL);
-  let manifest;
-  try {
-    manifest = JSON.parse(readFileSync(prebuildsPath, 'utf8'));
-  } catch {
-    throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'prebuilds manifest not readable');
-  }
+  const manifest = readTrustedPrebuildManifest();
 
   if (!manifest.prebuilds || typeof manifest.prebuilds !== 'object') {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'prebuilds manifest has invalid structure');
@@ -174,7 +222,7 @@ export function readStableAddon(options = {}) {
   validateManifestEntry(entry, key);
 
   // Resolve lexical candidate path
-  const addonFile = resolve(__dirname, '../../native/safe-write', entry.path);
+  const addonFile = resolve(NATIVE_BASE, entry.path);
 
   // Step 1: lstat LEXICAL path FIRST — reject symlink, non-regular, nlink!=1
   // Must lstat the original path to detect symlinks; lstat on a resolved path
@@ -207,7 +255,7 @@ export function readStableAddon(options = {}) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'prebuilt addon not accessible');
   }
 
-  const nativeBaseDir = realpathSync(resolve(__dirname, '../../native/safe-write/'));
+  const nativeBaseDir = realpathSync(NATIVE_BASE);
   if (!physicalAddonFile.startsWith(nativeBaseDir + '/') && physicalAddonFile !== nativeBaseDir) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'prebuilt addon physical path escapes base directory');
   }
@@ -305,7 +353,7 @@ export function loadNativeAddon(addonPath) {
 
   // 2. Development mode
   if (process.env.RELEASE_SKILL_NATIVE_DEV === '1') {
-    const devPath = resolve(__dirname, DEFAULT_ADDON_REL);
+    const devPath = DEFAULT_ADDON_PATH;
     const physicalPath = isWithinPackageBuildDir(devPath);
     if (!physicalPath) {
       throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, 'dev addon path is outside build directory');

package/src/commands/prepare.mjs

@@ -37,6 +37,7 @@ import {
   buildFrozenGitRepository,
   buildFrozenNpmTarball,
   computeFrozenSnapshot,
+  normalizeGitTimestamp,
   sealFrozenSnapshot,
 } from '../snapshot/frozen.mjs';
 import { ReleaseError, GATE_FAILED, CONFIG_INVALID, FORBIDDEN_CONTENT_DETECTED } from '../core/errors.mjs';
@@ -514,7 +515,11 @@ async function buildProductionAssets(
   runDir,
   unitBaselineResults,
   buildGitRepository = buildFrozenGitRepository,
+  freezeTimestamp,
 ) {
+  // The plan freeze timestamp is sampled exactly once by prepareRelease.
+  // Every unit reuses this single value; the wall clock is never re-read.
+  const canonicalFreezeTimestamp = normalizeGitTimestamp(freezeTimestamp, 'plan freeze timestamp');
   for (const { unit } of unitResults) {
     const npmDistribution = (unit.distributions ?? []).find((distribution) => distribution.type === 'npm');
     if (npmDistribution && !['public', 'restricted'].includes(npmDistribution.access)) {
@@ -561,6 +566,7 @@ async function buildProductionAssets(
       version,
       expectedSnapshotDigest: sealed.digest,
       parent,
+      commitTimestamp: canonicalFreezeTimestamp,
     });
 
     let npm = null;
@@ -586,6 +592,7 @@ async function buildProductionAssets(
       gitObjectDir: relative(root, repositoryDir),
       commit: git.commit,
       tree: git.tree,
+      commitTimestamp: canonicalFreezeTimestamp,
       branchStrategy,
       ...(git.parentCommit ? { parentCommit: git.parentCommit } : {}),
       branch,
@@ -683,6 +690,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       const claudeDist = (unit.distributions ?? []).find((d) => d.type === 'claude-plugin');
       if (claudeDist) {
         const identity = marketplaceIdentity(claudeDist);
+        const claudeTimeoutMs = Number.isInteger(claudeDist.timeoutMs) ? claudeDist.timeoutMs : 300000;
         actions.push({
           id: `claude-marketplace-install-${unit.id}`,
           type: 'claude-marketplace-install',
@@ -695,6 +703,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             repo: unit.publicRepo,
             version,
             entrySkill: identity.entrySkill,
+            timeoutMs: claudeTimeoutMs,
           },
           expected: {
             installed: true,
@@ -709,6 +718,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       const codexDist = (unit.distributions ?? []).find((d) => d.type === 'codex-plugin');
       if (codexDist) {
         const identity = marketplaceIdentity(codexDist);
+        const codexTimeoutMs = Number.isInteger(codexDist.timeoutMs) ? codexDist.timeoutMs : 300000;
         actions.push({
           id: `codex-marketplace-install-${unit.id}`,
           type: 'codex-marketplace-install',
@@ -721,6 +731,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             repo: unit.publicRepo,
             version,
             entrySkill: identity.entrySkill,
+            timeoutMs: codexTimeoutMs,
           },
           expected: {
             installed: true,
@@ -877,6 +888,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
     const claudeDist = (unit.distributions ?? []).find((d) => d.type === 'claude-plugin');
     if (claudeDist) {
       const identity = marketplaceIdentity(claudeDist);
+      const claudeTimeoutMs = Number.isInteger(claudeDist.timeoutMs) ? claudeDist.timeoutMs : 300000;
       actions.push({
         id: `claude-marketplace-install-${unit.id}`,
         type: 'claude-marketplace-install',
@@ -892,6 +904,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           entrySkill: identity.entrySkill,
           snapshotPath: asset.snapshotPath,
           manifestDigest: asset.manifestDigest,
+          timeoutMs: claudeTimeoutMs,
         },
         expected: {
           installed: true,
@@ -911,6 +924,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
     const codexDist = (unit.distributions ?? []).find((d) => d.type === 'codex-plugin');
     if (codexDist) {
       const identity = marketplaceIdentity(codexDist);
+      const codexTimeoutMs = Number.isInteger(codexDist.timeoutMs) ? codexDist.timeoutMs : 300000;
       actions.push({
         id: `codex-marketplace-install-${unit.id}`,
         type: 'codex-marketplace-install',
@@ -926,6 +940,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           entrySkill: identity.entrySkill,
           snapshotPath: asset.snapshotPath,
           manifestDigest: asset.manifestDigest,
+          timeoutMs: codexTimeoutMs,
         },
         expected: {
           installed: true,
@@ -1443,6 +1458,18 @@ export async function prepareRelease(options) {
     // --- Step 7: Build plan object ---
     await evidence.append({ phase: 'plan-assembly', status: 'started' });
 
+    // Production plans sample their freeze timestamp exactly once, before the
+    // first frozen Git object exists. This single canonical value becomes
+    // GIT_AUTHOR_DATE/GIT_COMMITTER_DATE for every unit's frozen commit,
+    // every unit's frozenSnapshot.commitTimestamp, and plan.createdAt. It is
+    // thereby bound by the plan digest and the approval record; publish,
+    // retry, and reconcile consume it from the frozen plan and never re-read
+    // the wall clock. A missing or invalid injected value fails closed here,
+    // before any Git write.
+    const freezeTimestamp = production
+      ? normalizeGitTimestamp(clock ? clock() : new Date().toISOString(), 'plan freeze timestamp')
+      : null;
+
     const productionAssets = production
       ? await buildProductionAssets(
           unitResults,
@@ -1451,6 +1478,7 @@ export async function prepareRelease(options) {
           runDir,
           unitBaselineResults,
           options.buildFrozenGitRepositoryFn ?? buildFrozenGitRepository,
+          freezeTimestamp,
         )
       : null;
 
@@ -1474,6 +1502,7 @@ export async function prepareRelease(options) {
             branchStrategy: productionAssets[idx].branchStrategy,
             commit: productionAssets[idx].commit,
             tree: productionAssets[idx].tree,
+            commitTimestamp: productionAssets[idx].commitTimestamp,
             ...(productionAssets[idx].parentCommit
               ? { parentCommit: productionAssets[idx].parentCommit }
               : {}),
@@ -1512,7 +1541,7 @@ export async function prepareRelease(options) {
       } : {}),
       units,
       externalActions,
-      createdAt: (clock ? clock() : new Date().toISOString()),
+      createdAt: production ? freezeTimestamp : (clock ? clock() : new Date().toISOString()),
     };
 
     await evidence.append({

package/src/commands/publish.mjs

@@ -389,6 +389,7 @@ export async function publishRelease(options) {
           gitObjectDir: frozen.gitObjectDir,
           commit: frozen.commit,
           tree: frozen.tree,
+          commitTimestamp: frozen.commitTimestamp,
         });
         assertInsideAssetRoot(assetRoot, git.gitDir, 'frozen git object directory');
         if (frozen.npm) {

package/src/commands/reconcile.mjs

@@ -222,7 +222,10 @@ export async function reconcileRelease(options) {
     // =======================================================================
     await evidence.append({ phase: 'safety-gate', gate: 'action-completeness', status: 'started' });
 
-    const completenessResult = validatePlanActionCompleteness(plan);
+    // Use legacyCompatibility: old PARTIAL plans (pre-v0.1.5) lack
+    // parameters.timeoutMs. Reconcile must still pass these plans,
+    // while strict mode (prepare/approve/publish) rejects them.
+    const completenessResult = validatePlanActionCompleteness(plan, { legacyCompatibility: true });
     if (!completenessResult.passed) {
       await evidence.append({
         phase: 'safety-gate',