release-skill 0.1.4 → 0.1.5

package/src/commands/prepare.mjs

@@ -690,6 +690,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       const claudeDist = (unit.distributions ?? []).find((d) => d.type === 'claude-plugin');
       if (claudeDist) {
         const identity = marketplaceIdentity(claudeDist);
+        const claudeTimeoutMs = Number.isInteger(claudeDist.timeoutMs) ? claudeDist.timeoutMs : 300000;
         actions.push({
           id: `claude-marketplace-install-${unit.id}`,
           type: 'claude-marketplace-install',
@@ -702,6 +703,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             repo: unit.publicRepo,
             version,
             entrySkill: identity.entrySkill,
+            timeoutMs: claudeTimeoutMs,
           },
           expected: {
             installed: true,
@@ -716,6 +718,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       const codexDist = (unit.distributions ?? []).find((d) => d.type === 'codex-plugin');
       if (codexDist) {
         const identity = marketplaceIdentity(codexDist);
+        const codexTimeoutMs = Number.isInteger(codexDist.timeoutMs) ? codexDist.timeoutMs : 300000;
         actions.push({
           id: `codex-marketplace-install-${unit.id}`,
           type: 'codex-marketplace-install',
@@ -728,6 +731,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             repo: unit.publicRepo,
             version,
             entrySkill: identity.entrySkill,
+            timeoutMs: codexTimeoutMs,
           },
           expected: {
             installed: true,
@@ -884,6 +888,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
     const claudeDist = (unit.distributions ?? []).find((d) => d.type === 'claude-plugin');
     if (claudeDist) {
       const identity = marketplaceIdentity(claudeDist);
+      const claudeTimeoutMs = Number.isInteger(claudeDist.timeoutMs) ? claudeDist.timeoutMs : 300000;
       actions.push({
         id: `claude-marketplace-install-${unit.id}`,
         type: 'claude-marketplace-install',
@@ -899,6 +904,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           entrySkill: identity.entrySkill,
           snapshotPath: asset.snapshotPath,
           manifestDigest: asset.manifestDigest,
+          timeoutMs: claudeTimeoutMs,
         },
         expected: {
           installed: true,
@@ -918,6 +924,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
     const codexDist = (unit.distributions ?? []).find((d) => d.type === 'codex-plugin');
     if (codexDist) {
       const identity = marketplaceIdentity(codexDist);
+      const codexTimeoutMs = Number.isInteger(codexDist.timeoutMs) ? codexDist.timeoutMs : 300000;
       actions.push({
         id: `codex-marketplace-install-${unit.id}`,
         type: 'codex-marketplace-install',
@@ -933,6 +940,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           entrySkill: identity.entrySkill,
           snapshotPath: asset.snapshotPath,
           manifestDigest: asset.manifestDigest,
+          timeoutMs: codexTimeoutMs,
         },
         expected: {
           installed: true,

package/src/commands/reconcile.mjs

@@ -222,7 +222,10 @@ export async function reconcileRelease(options) {
     // =======================================================================
     await evidence.append({ phase: 'safety-gate', gate: 'action-completeness', status: 'started' });
 
-    const completenessResult = validatePlanActionCompleteness(plan);
+    // Use legacyCompatibility: old PARTIAL plans (pre-v0.1.5) lack
+    // parameters.timeoutMs. Reconcile must still pass these plans,
+    // while strict mode (prepare/approve/publish) rejects them.
+    const completenessResult = validatePlanActionCompleteness(plan, { legacyCompatibility: true });
     if (!completenessResult.passed) {
       await evidence.append({
         phase: 'safety-gate',

package/src/commands/verify.mjs

@@ -669,7 +669,10 @@ export async function verifyRelease(options) {
     }
 
     // Validate plan action completeness before checkpoint mapping
-    const completenessResult = validatePlanActionCompleteness(plan);
+    // Use legacyCompatibility: old plans (pre-v0.1.5) lack
+    // parameters.timeoutMs. Verify must still pass these plans,
+    // while strict mode (prepare/approve/publish) rejects them.
+    const completenessResult = validatePlanActionCompleteness(plan, { legacyCompatibility: true });
     if (!completenessResult.passed) {
       throw new ReleaseError(
         GATE_FAILED,

package/src/core/plan.mjs

@@ -312,9 +312,13 @@ const REQUIRED_ACTION_TYPES = ['push-snapshot', 'create-tag', 'github-release'];
  * (e.g. v0.0.10 must not match expected version 0.0.1).
  *
  * @param {object} plan - A validated release plan object.
+ * @param {object} [options]
+ * @param {boolean} [options.legacyCompatibility] - When true, relax
+ *   timeoutMs requirement for old plans (reconcile/verify paths).
+ *   New prepare/approve/publish must not set this flag.
  * @returns {{ passed: boolean, details: { failures: string[], expectedCount: number, actualCount: number } }}
  */
-export function validatePlanActionCompleteness(plan) {
+export function validatePlanActionCompleteness(plan, options = {}) {
   const failures = [];
 
   if (!plan || typeof plan !== 'object') {
@@ -670,6 +674,33 @@ export function validatePlanActionCompleteness(plan) {
           _checkRequired(action, 'parameters.ref', action.parameters?.ref, expectedTag, unitId, failures);
           _checkRequired(action, 'parameters.manifestDigest', action.parameters?.manifestDigest, frozen?.manifestDigest, unitId, failures);
         }
+        // timeoutMs is mandatory for all marketplace install actions.
+        // Legacy plans (pre-v0.1.5) lack this field; legacyCompatibility
+        // relaxes the check for reconcile/verify paths only, and only when
+        // the property is genuinely absent (undefined). An explicit null is
+        // NOT "absent" -- it is an invalid value and always fails closed,
+        // like strings or out-of-range numbers, even in legacyCompatibility.
+        {
+          const raw = action.parameters?.timeoutMs;
+          if (raw === undefined) {
+            if (!options.legacyCompatibility) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs is missing, expected a valid timeout (30000-900000)`,
+              );
+            }
+          } else {
+            // Field is present -- always validate range/type, even in legacy mode
+            if (typeof raw !== 'number' || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`,
+              );
+            } else if (raw < 30000 || raw > 900000) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be between 30000 and 900000, got: ${raw}`,
+              );
+            }
+          }
+        }
 
         // Expected checks
         _checkRequired(action, 'expected.installed', action.expected?.installed, true, unitId, failures);
@@ -746,6 +777,33 @@ export function validatePlanActionCompleteness(plan) {
           _checkRequired(action, 'parameters.ref', action.parameters?.ref, expectedTag, unitId, failures);
           _checkRequired(action, 'parameters.manifestDigest', action.parameters?.manifestDigest, frozen?.manifestDigest, unitId, failures);
         }
+        // timeoutMs is mandatory for all marketplace install actions.
+        // Legacy plans (pre-v0.1.5) lack this field; legacyCompatibility
+        // relaxes the check for reconcile/verify paths only, and only when
+        // the property is genuinely absent (undefined). An explicit null is
+        // NOT "absent" -- it is an invalid value and always fails closed,
+        // like strings or out-of-range numbers, even in legacyCompatibility.
+        {
+          const raw = action.parameters?.timeoutMs;
+          if (raw === undefined) {
+            if (!options.legacyCompatibility) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs is missing, expected a valid timeout (30000-900000)`,
+              );
+            }
+          } else {
+            // Field is present -- always validate range/type, even in legacy mode
+            if (typeof raw !== 'number' || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`,
+              );
+            } else if (raw < 30000 || raw > 900000) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be between 30000 and 900000, got: ${raw}`,
+              );
+            }
+          }
+        }
 
         // Expected checks
         _checkRequired(action, 'expected.installed', action.expected?.installed, true, unitId, failures);