release-skill 0.1.4 → 0.1.6

package/skills-src/release-publish/SKILL.md

@@ -17,7 +17,9 @@ description: 从已批准且摘要确认的生产计划发布冻结 Git branch/t
 不得把沙箱通过描述成真实发布成功。
 
 只发布 `prepare --production` 封存的 Git object 和 npm tarball，不从活动工作区重新
-打包，不生成或覆盖 README。远端 branch/tag/Release/npm version 已存在、查询不确定、
+打包，不生成或覆盖 README，也永不隐式刷新工作树中的发布文档；
+遇到 `RELEASE_DOCS_STALE` 或文档陈旧只能回到 `docs refresh` → 人工审阅 → 提交 →
+重新 prepare。远端 branch/tag/Release/npm version 已存在、查询不确定、
 认证失败或摘要漂移时，在全局预检阶段停止并交给人工。禁止覆盖、删除和自动回滚；
 新建 ref 的 create-only CAS（`--force-with-lease=<ref>:`）只断言目标不存在，不授权覆盖。
 

package/skills-src/release-reconcile/SKILL.md

@@ -19,7 +19,7 @@ marketplace 隔离消费者 checkpoint，但只恢复到 `PUBLISHED`；最终 np
 
 ## 职责与边界
 
-查询远端实际状态，对照冻结计划识别一致/不一致检查点。已成功的步骤幂等跳过，只重试安全且未完成的步骤。远端冲突时停止并要求人工决策。不删除远端资源。`--run` 必需；重试需 `--approval`。
+查询远端实际状态，对照冻结计划识别一致/不一致检查点。已成功的步骤幂等跳过，只重试安全且未完成的步骤。远端冲突时停止并要求人工决策。不删除远端资源。`--run` 必需；重试需 `--approval`。reconcile 永不隐式刷新工作树中的发布文档；陈旧文档只能回到 `docs refresh` → 人工审阅 → 提交 → 重新 prepare。
 
 **阶段通过规则**: 本阶段的通过只能由 CLI exit code 0 和结构化状态码 `PUBLISHED` 确认。随后必须以 reconcile 返回的新 `runPath` 执行 verify；只有 verify 的 `VERIFIED` 才是完整终态。
 

package/src/adapters/plugin-marketplace.mjs

@@ -185,6 +185,42 @@ function validateMarketplaceParams(params) {
 }
 
 
+/**
+ * Resolve and validate the frozen timeoutMs from the expanded adapter action.
+ *
+ * The publish/reconcile/verify call path expands plan actions as
+ * `{ actionType, ...action.parameters }`, so `parameters.timeoutMs` in the
+ * plan becomes `action.timeoutMs` at the adapter level. This function reads
+ * from the top-level action, not from a nested `parameters` sub-object.
+ *
+ * Rules:
+ * - Missing field (undefined): returns 300000 default (legacy compatibility).
+ * - Present but null/invalid (null, string, NaN, Infinity, non-integer,
+ *   out of range): fail-closed, throws.
+ * - Valid integer in [30000, 900000]: returns the value as-is.
+ *
+ * @param {object} action - The expanded adapter action (top-level).
+ * @returns {number} Validated timeout in milliseconds.
+ * @throws {Error} If the value is present but invalid.
+ */
+function resolveTimeoutMs(action) {
+  const raw = action?.timeoutMs;
+  if (raw === undefined) {
+    return 300000;
+  }
+  if (raw === null || typeof raw !== 'number' || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+    throw new Error(
+      `action.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`,
+    );
+  }
+  if (raw < 30000 || raw > 900000) {
+    throw new Error(
+      `action.timeoutMs must be between 30000 and 900000, got: ${raw}`,
+    );
+  }
+  return raw;
+}
+
 /**
  * Run a CLI command using execFile (never shell: true).
  */
@@ -792,6 +828,23 @@ export function createPluginMarketplaceAdapter(deps = {}) {
           };
           // Ensure real HOME/CODEX_HOME don't leak back (already overridden above)
 
+          // Resolve frozen timeoutMs from the expanded action (top-level,
+          // not action.parameters -- the publish/reconcile/verify call path
+          // expands plan action as { actionType, ...action.parameters }).
+          // Default to 300000 for old plans that lack the field.
+          // Fail closed on invalid values (null, non-integer, non-finite,
+          // out of range).
+          let frozenTimeoutMs;
+          try {
+            frozenTimeoutMs = resolveTimeoutMs(action);
+          } catch (timeoutErr) {
+            return createResult({
+              actionType,
+              status: ActionStatus.EXECUTE_FAILED,
+              error: timeoutErr.message,
+            });
+          }
+
           // Step 1: Add marketplace
           const ref = action.ref ?? `v${action.version}`;
           let addOutput;
@@ -799,7 +852,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             ? ['plugin', 'marketplace', 'add', `${action.repo}@${ref}`]
             : ['plugin', 'marketplace', 'add', action.repo, '--ref', ref, '--json'];
           try {
-            const addResult = await exec(cliCmd, marketplaceArgs, { env, cwd: context.root });
+            const addResult = await exec(cliCmd, marketplaceArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             if (consumer === 'codex') {
               try {
                 addOutput = JSON.parse(addResult.stdout);
@@ -839,7 +892,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             ? ['plugin', 'install', `${action.plugin}@${action.marketplace}`]
             : ['plugin', 'add', `${action.plugin}@${action.marketplace}`, '--json'];
           try {
-            const installResult = await exec(cliCmd, installArgs, { env, cwd: context.root });
+            const installResult = await exec(cliCmd, installArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             if (consumer === 'codex') {
               try {
                 installOutput = JSON.parse(installResult.stdout);
@@ -1053,6 +1106,20 @@ export function createPluginMarketplaceAdapter(deps = {}) {
               : { HOME: isolatedHome, CODEX_HOME: isolatedHome }),
           };
 
+          // Resolve frozen timeoutMs from the expanded action (top-level).
+          // Default to 300000 for old plans. Fail closed on invalid values.
+          let frozenTimeoutMs;
+          try {
+            frozenTimeoutMs = resolveTimeoutMs(action);
+          } catch (timeoutErr) {
+            return createResult({
+              actionType,
+              status: ActionStatus.OBSERVED,
+              observation: { installed: false, error: timeoutErr.message },
+              error: timeoutErr.message,
+            });
+          }
+
           // Read execute evidence — mandatory for observe validation
           let evidence = null;
           try {
@@ -1095,7 +1162,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
 
           let listOutput;
           try {
-            const result = await exec(cliCmd, listArgs, { env, cwd: context.root });
+            const result = await exec(cliCmd, listArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             listOutput = JSON.parse(result.stdout);
           } catch (listErr) {
             return createResult({