release-skill 0.1.8 → 0.1.10

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.1.8",
+      "version": "0.1.10",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.1.8.",
+      "Prepare a release plan for version 0.1.10.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.1.10 locale=en baseline=sha256:ec4dbf3f44f1295d9af20e0fbf1ced4341d9b65d0c93598104e228244e33fa2b -->
+## [0.1.10] - 2026-07-24
+
+v0.1.10 fixes the codex marketplace install verification failure caused by the codex CLI materializing a `.codex-plugin/migrated-command-skills/` subtree (commands migrated to skill format) in the plugin install root at install time. That consumer-owned transport metadata is now exempted alongside the root `.git` checkout, and the frozen snapshot exclusion list supports multi-segment relative path prefixes while single-segment root-only behavior is unchanged. The sealed snapshot digest, release plan schema, and prepare-side freezing are unchanged, so already-frozen plans reconcile without re-approval. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
+
+### Fixed
+
+- **Codex `migrated-command-skills` transport exemption**: the codex CLI
+  converts plugin `commands/` into skill format at install time and writes the
+  result under `.codex-plugin/migrated-command-skills/` in the install root.
+  That consumer-owned subtree is not part of the published payload, so the
+  whole-tree comparison failed every real codex marketplace install; the
+  codex consumer transport exemptions widen from `['.git']` to
+  `['.git', '.codex-plugin/migrated-command-skills']`. Claude (`.in_use`) and
+  Kimi (`.git`) exemptions are unchanged, and the exemption deliberately
+  never widens to `.codex-plugin/*` or arbitrary extra files. Verified
+  against a real flow-architect install: the installed tree is byte-identical
+  to the frozen snapshot except for the migrated-command-skills directory.
+  Already-frozen plans reconcile unchanged because the sealed digest, plan
+  schema, and prepare-side freezing are untouched.
+- **Multi-segment snapshot exclusions, fail-closed**:
+  `computeFrozenSnapshot`'s `excludeRootEntries` now accepts multi-segment
+  relative path prefixes naming an exact excluded subtree (required for the
+  `.codex-plugin/migrated-command-skills` exemption); single-segment entries
+  keep the historical root-only matching. Malformed entries (non-string,
+  absolute, `..`, backslash) fail closed: a bad exclusion list is a caller
+  bug, not transport metadata.
+- **Regression coverage**: new protocol-level tests cover the root-layout
+  codex execute→observe→verify cycle with the CLI-generated
+  migrated-command-skills tree present, including byte-tamper and extra-file
+  negatives that must still fail closed.
+<!-- release-skill:changelog:end version=0.1.10 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.1.9 locale=en baseline=sha256:409f940c03e2d6fd41d33659b246b3d4b622918b4ac5a3a711d83aa09740ef11 -->
+## [0.1.9] - 2026-07-23
+
+v0.1.9 fixes a structural marketplace install verification failure: consumer installs that declare a plugin `source` subdirectory (e.g. `./adapters/claude`) now bind the installed payload to the declared subtree of the sealed whole-unit snapshot, and Claude's root `.in_use` marker is exempted as consumer-owned transport metadata. The sealed snapshot digest, release plan schema, and prepare-side freezing are unchanged, so already-frozen plans reconcile without re-approval. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
+
+### Fixed
+
+- **Marketplace payload binding for subdirectory source layouts**: consumer
+  marketplaces may declare a plugin `source` subdirectory such as
+  `./adapters/claude`; the consumer CLI then installs only that subtree while
+  the sealed authority is the whole unit snapshot. Install verification now
+  revalidates the sealed whole-snapshot digest, re-reads the declared source
+  from the marketplace manifest inside the digest-verified snapshot entries,
+  and binds the installed payload to that prefix-stripped subtree. Root
+  layouts and Kimi keep the whole-tree comparison. This resolves the
+  flow-architect v0.4.1 and v0.5.0 PARTIAL marketplace install failures;
+  already-frozen plans reconcile unchanged because the sealed digest, plan
+  schema, and prepare-side freezing are untouched.
+- **Claude `.in_use` transport marker exemption**: the Claude CLI writes an
+  empty `.in_use` marker into the plugin install root; it is now exempted as
+  consumer-owned transport metadata alongside the existing Codex/Kimi `.git`
+  exemption, through a single shared exclusion helper that also backs the
+  observe-time diagnostic fallback. Exemptions remain root-only: nested
+  markers, extra payload, byte tampering, and sealed authority tampering
+  still fail closed.
+- **Regression coverage**: new protocol-level fake-CLI tests cover the
+  subdirectory claude cycle with `.in_use` (including byte-tamper,
+  extra-file, missing-file, `.git`-not-exempt, and nested-marker negatives),
+  fail-closed manifest anomalies (duplicate plugin entry, wrong marketplace
+  name, empty source projection), root-layout claude with `.in_use`, and a
+  codex subdirectory variant.
+<!-- release-skill:changelog:end version=0.1.9 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.1.8 locale=en baseline=sha256:1e1a0af9d5807bceb7af1eae88b726f67e6811dba4db579fd625c07f3bdbca89 -->
 ## [0.1.8] - 2026-07-23
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.1.8 -->
+<!-- release-skill:release-version: 0.1.10 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -68,7 +68,7 @@ as a version-pinned **manual** install plus trusted observation/attestation:
    default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.8
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.10
    /plugins reload
    ```
 
@@ -83,10 +83,10 @@ as a version-pinned **manual** install plus trusted observation/attestation:
 {
   "consumer": "kimi",
   "plugin": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "entrySkill": "release-help",
   "repo": "ifoohoo/release-skill",
-  "ref": "release-skill-v0.1.8",
+  "ref": "release-skill-v0.1.10",
   "installPath": "<kimiCodeHome>/plugins/managed/release-skill",
   "planDigest": "<64-hex frozen plan digest>",
   "payloadDigest": "<64-hex frozen snapshot payload digest>",

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.1.8 -->
+<!-- release-skill:release-version: 0.1.10 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -62,7 +62,7 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
    它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.8
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.10
    /plugins reload
    ```
 
@@ -76,10 +76,10 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
 {
   "consumer": "kimi",
   "plugin": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "entrySkill": "release-help",
   "repo": "ifoohoo/release-skill",
-  "ref": "release-skill-v0.1.8",
+  "ref": "release-skill-v0.1.10",
   "installPath": "<kimiCodeHome>/plugins/managed/release-skill",
   "planDigest": "<64 位十六进制冻结计划摘要>",
   "payloadDigest": "<64 位十六进制冻结快照载荷摘要>",

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.1.8 -->
+<!-- release-skill:release-version: 0.1.10 -->
 Release preparation for Claude Code, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -11,29 +11,41 @@ reviewed artifacts first and publishes those same artifacts later; it does not
 regenerate a README or re-pack the live workspace at the last step.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.1.8** (2026-07-23)
-
-v0.1.8 adds Kimi Code as a first-class plugin host without rewriting the already-published v0.1.7 artifacts. Kimi delivery uses a generated self-contained adapter and a fail-closed, plan-bound manual installation attestation because Kimi Code has no scriptable non-interactive plugin installation interface. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
-
-**Changed**
-
-- **Kimi Code plugin delivery and verification**: v0.1.8 adds the root
-  `.kimi-plugin/plugin.json`, a generated self-contained `adapters/kimi/` bundle,
-  and public installation guidance. Because Kimi Code exposes no scriptable
-  non-interactive plugin installation interface, production publish emits a
-  version-pinned manual installation requirement and enters `PARTIAL`; an
-  isolated `KIMI_CODE_HOME` installation and a trusted attestation bound
-  independently to the frozen plan digest and payload digest are required before
-  `reconcile` can reach `PUBLISHED` and `verify` can reach `VERIFIED`.
-- **Immutable v0.1.7 history preserved**: the existing v0.1.7 Git tag,
-  GitHub Release, npm version, and public commit remain untouched. The v0.1.8
-  production plan binds the published v0.1.7 commit
-  `fe5897456d4166a2ec60e99405836b122562b80d` as its previous public baseline.
+**0.1.10** (2026-07-24)
+
+v0.1.10 fixes the codex marketplace install verification failure caused by the codex CLI materializing a `.codex-plugin/migrated-command-skills/` subtree (commands migrated to skill format) in the plugin install root at install time. That consumer-owned transport metadata is now exempted alongside the root `.git` checkout, and the frozen snapshot exclusion list supports multi-segment relative path prefixes while single-segment root-only behavior is unchanged. The sealed snapshot digest, release plan schema, and prepare-side freezing are unchanged, so already-frozen plans reconcile without re-approval. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
+
+**Fixed**
+
+- **Codex `migrated-command-skills` transport exemption**: the codex CLI
+  converts plugin `commands/` into skill format at install time and writes the
+  result under `.codex-plugin/migrated-command-skills/` in the install root.
+  That consumer-owned subtree is not part of the published payload, so the
+  whole-tree comparison failed every real codex marketplace install; the
+  codex consumer transport exemptions widen from `['.git']` to
+  `['.git', '.codex-plugin/migrated-command-skills']`. Claude (`.in_use`) and
+  Kimi (`.git`) exemptions are unchanged, and the exemption deliberately
+  never widens to `.codex-plugin/*` or arbitrary extra files. Verified
+  against a real flow-architect install: the installed tree is byte-identical
+  to the frozen snapshot except for the migrated-command-skills directory.
+  Already-frozen plans reconcile unchanged because the sealed digest, plan
+  schema, and prepare-side freezing are untouched.
+- **Multi-segment snapshot exclusions, fail-closed**:
+  `computeFrozenSnapshot`'s `excludeRootEntries` now accepts multi-segment
+  relative path prefixes naming an exact excluded subtree (required for the
+  `.codex-plugin/migrated-command-skills` exemption); single-segment entries
+  keep the historical root-only matching. Malformed entries (non-string,
+  absolute, `..`, backslash) fail closed: a bad exclusion list is a caller
+  bug, not transport metadata.
+- **Regression coverage**: new protocol-level tests cover the root-layout
+  codex execute→observe→verify cycle with the CLI-generated
+  migrated-command-skills tree present, including byte-tamper and extra-file
+  negatives that must still fail closed.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.1.8 is the current release (v0.1.7 previously held
-> published status before the Kimi Code distribution was added).
+> **Current boundary:** v0.1.10 is the current release (v0.1.9 previously held
+> published status before the codex migrated-command-skills fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
 > production-verified milestone — followed by
 > exact npm installation and Claude/Codex consumer installation verification
@@ -50,7 +62,7 @@ v0.1.8 adds Kimi Code as a first-class plugin host without rewriting the already
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.1.8 is the current
+> **Production path verified since the v0.1.1 milestone; v0.1.9 is the current
 > release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >

package/README.zh-CN.md

@@ -2,31 +2,39 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.1.8 -->
+<!-- release-skill:release-version: 0.1.10 -->
 面向 Claude Code、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它先冻结并供人工审阅，再从同一份冻结产物发布，不会在最后一步重新生成 README、重新打包当前工作区或覆盖人工内容。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.1.8** (2026-07-23)
-
-v0.1.8 在不改写已经公开的 v0.1.7 制品的前提下，新增对 Kimi Code 一等插件宿主的支持。由于 Kimi Code 没有可脚本化的非交互插件安装接口，Kimi 分发采用生成的自包含适配器，以及失败关闭、绑定冻结计划的人工安装证明。npm 包名（`release-skill`）、发布身份（`publisher: mzdbxqh`）、公开仓库（`ifoohoo/release-skill`）与公司维护主体均保持不变。
-
-**变更**
-
-- **Kimi Code 插件分发与验证**：v0.1.8 新增根
-  `.kimi-plugin/plugin.json`、生成的自包含 `adapters/kimi/` 适配器和公开安装说明。
-  由于 Kimi Code 没有可脚本化的非交互插件安装接口，生产发布会生成版本钉死的人工
-  安装要求并进入 `PARTIAL`；操作者必须在隔离的 `KIMI_CODE_HOME` 中完成安装，并
-  提供分别绑定冻结计划摘要和载荷摘要的可信证明，之后 `reconcile` 才能进入
-  `PUBLISHED`，`verify` 才能进入 `VERIFIED`。
-- **保留不可变的 v0.1.7 历史**：既有 v0.1.7 Git 标签、GitHub Release、npm
-  版本与公开提交均不改写。v0.1.8 生产计划以已公开的 v0.1.7 提交
-  `fe5897456d4166a2ec60e99405836b122562b80d` 作为前序公开基线。
+**0.1.10** (2026-07-24)
+
+v0.1.10 修复 codex marketplace 安装校验失败：codex CLI 安装时会在插件安装根目录生成 `.codex-plugin/migrated-command-skills/` 子树（commands 迁移为 skill 格式的产物）。这部分消费者所有的传输元数据现在与根目录 `.git` 检出一样获得豁免；冻结快照排除清单扩展支持多段相对路径前缀，单段行为保持不变。密封快照摘要、发布计划 schema 与 prepare 冻结均未改动，已冻结计划无需重新审批即可 reconcile。npm 包名（`release-skill`）、发布身份（`publisher: mzdbxqh`）、公开仓库（`ifoohoo/release-skill`）与公司维护主体保持不变。
+
+**修复**
+
+- **Codex `migrated-command-skills` 传输豁免**：codex CLI 安装时会把插件
+  `commands/` 转换为 skill 格式并写入安装根目录的
+  `.codex-plugin/migrated-command-skills/`。该消费者所有的子树不属于已发布
+  载荷，导致整树比较在每次真实 codex marketplace 安装中失败；codex 消费者
+  传输豁免从 `['.git']` 扩为 `['.git', '.codex-plugin/migrated-command-skills']`。
+  Claude（`.in_use`）与 Kimi（`.git`）豁免不变，且豁免刻意不扩大为
+  `.codex-plugin/*` 或任意多余文件。flow-architect 真实安装实测验证：除
+  migrated-command-skills 目录外，安装内容与冻结快照逐字节一致。密封摘要、
+  计划 schema 与 prepare 冻结均未改动，已冻结计划可以不变地 reconcile 收口。
+- **多段快照排除，失败关闭**：`computeFrozenSnapshot` 的
+  `excludeRootEntries` 现在接受多段相对路径前缀，命名一个精确排除的子树
+  （`.codex-plugin/migrated-command-skills` 豁免所必需）；单段条目保持历史
+  的根直接子项匹配。畸形条目（非字符串、绝对路径、`..`、反斜杠）失败关闭：
+  错误的排除清单是调用方 bug，不是传输元数据。
+- **回归覆盖**：新增协议级测试覆盖带 CLI 生成 migrated-command-skills 树的
+  根布局 codex execute→observe→verify 完整链路，包含必须仍然失败关闭的字节
+  篡改与多余文件负例。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.1.8 是当前发布版本（v0.1.7 曾处于已发布、待独立验证状态）。
+> **当前边界：** v0.1.10 是当前发布版本（v0.1.9 曾处于已发布、待独立验证状态）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；“当前发布版本”与“首次生产验证里程碑”
@@ -39,7 +47,7 @@ v0.1.8 在不改写已经公开的 v0.1.7 制品的前提下，新增对 Kimi Co
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.1.8 是当前发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.1.9 是当前发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.1.8",
+      "version": "0.1.10",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.8"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.10"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -17816,7 +17816,8 @@ var init_baseline = __esm({
       ".release-skill/lock",
       ".release-skill/lock-audit",
       ".release-skill/runs",
-      ".release-skill/transactions"
+      ".release-skill/transactions",
+      ".release-skill/kimi-attestations"
     ];
     RESERVED_CONTROL_PREFIXES = [
       ...CONTROL_PLANE_PREFIXES,
@@ -19013,14 +19014,30 @@ async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries = [] } =
     throw frozenError("frozen snapshot root must be a real directory");
   }
   const entries = [];
-  const excluded = new Set(excludeRootEntries);
+  const excludedRootNames = /* @__PURE__ */ new Set();
+  const excludedPathPrefixes = [];
+  for (const entry of excludeRootEntries) {
+    if (typeof entry !== "string") {
+      throw frozenError("frozen snapshot exclusion entries must be strings");
+    }
+    const segments = entry.split("/").filter((segment) => segment !== "" && segment !== ".");
+    if (segments.length === 0 || entry.startsWith("/") || entry.includes("\\") || segments.some((segment) => segment === "..")) {
+      throw frozenError(`frozen snapshot exclusion entry is not a safe relative path: ${JSON.stringify(entry)}`);
+    }
+    if (segments.length === 1) {
+      excludedRootNames.add(segments[0]);
+    } else {
+      excludedPathPrefixes.push(segments.join("/"));
+    }
+  }
   async function walk(dir) {
     const children = await readdir3(dir, { withFileTypes: true });
     children.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const child of children) {
-      if (dir === root && excluded.has(child.name)) continue;
+      if (dir === root && excludedRootNames.has(child.name)) continue;
       const absolute = join3(dir, child.name);
       const rel = relative7(root, absolute).split("\\").join("/");
+      if (excludedPathPrefixes.some((prefix) => rel === prefix || rel.startsWith(`${prefix}/`))) continue;
       const st = await lstat5(absolute);
       if (st.isSymbolicLink()) {
         throw frozenError(`frozen snapshot contains symlink: ${rel}`);
@@ -76930,6 +76947,50 @@ function transportPayload(entries) {
     contentDigest
   }));
 }
+function consumerTransportExclusions(consumer) {
+  if (consumer === "claude") return [".in_use"];
+  if (consumer === "codex") return [".git", ".codex-plugin/migrated-command-skills"];
+  if (consumer === "kimi") return [".git"];
+  return [];
+}
+function extractDeclaredPluginSource(consumer, entry) {
+  const rawSource = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
+  if (typeof rawSource !== "string" || rawSource.length === 0) {
+    throw new Error(`marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`);
+  }
+  if (rawSource.startsWith("/") || rawSource.includes("..") || rawSource.includes("\\") || /^https?:\/\//i.test(rawSource)) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  const segments = rawSource.split("/").filter((segment) => segment !== "" && segment !== ".");
+  if (segments.some((segment) => segment === "..")) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  return segments.length === 0 ? "." : segments.join("/");
+}
+async function resolveInstalledPayloadSubpath(snapshotDir, sourceEntries, action, consumer) {
+  if (consumer === "kimi") return ".";
+  const marketplaceRelative = consumer === "claude" ? ".claude-plugin/marketplace.json" : ".agents/plugins/marketplace.json";
+  const anchored = sourceEntries.some((entry) => entry.type === "file" && entry.path === marketplaceRelative);
+  if (!anchored) {
+    throw new Error(`frozen snapshot is missing the marketplace manifest ${marketplaceRelative}`);
+  }
+  const result = await validateManifestFile(resolve19(snapshotDir, marketplaceRelative), ["name", "plugins"]);
+  if (!result.valid) {
+    throw new Error(`frozen snapshot ${marketplaceRelative} invalid: ${result.error}`);
+  }
+  if (result.manifest.name !== action.marketplace) {
+    throw new Error(`marketplace manifest name "${result.manifest.name}" does not match action marketplace "${action.marketplace}"`);
+  }
+  const plugins = result.manifest.plugins;
+  if (!Array.isArray(plugins)) {
+    throw new Error(`${marketplaceRelative} must have a plugins[] array`);
+  }
+  const matches = plugins.filter((entry) => entry.name === action.plugin);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one plugins[] entry with name "${action.plugin}", found ${matches.length}`);
+  }
+  return extractDeclaredPluginSource(consumer, matches[0]);
+}
 async function verifyInstalledMarketplacePayload(action, context, installPath, consumer) {
   const sourcePath = await resolveFrozenPath(
     context.root,
@@ -76940,10 +77001,21 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
   if (sourceSnapshot.digest !== action.manifestDigest) {
     throw new Error("frozen marketplace snapshot digest no longer matches the plan");
   }
+  const payloadSubpath = await resolveInstalledPayloadSubpath(
+    sourcePath,
+    sourceSnapshot.entries,
+    action,
+    consumer
+  );
+  const prefix = payloadSubpath === "." ? null : `${payloadSubpath}/`;
+  const authorityEntries = prefix === null ? sourceSnapshot.entries : sourceSnapshot.entries.filter((entry) => entry.path.startsWith(prefix)).map((entry) => ({ ...entry, path: entry.path.slice(prefix.length) }));
+  if (authorityEntries.length === 0) {
+    throw new Error("frozen snapshot contains no payload under the declared marketplace source");
+  }
   const installedSnapshot = await computeFrozenSnapshot(installPath, {
-    excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+    excludeRootEntries: consumerTransportExclusions(consumer)
   });
-  if (JSON.stringify(transportPayload(sourceSnapshot.entries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
+  if (JSON.stringify(transportPayload(authorityEntries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
     throw new Error("installed marketplace payload differs in path, bytes, size, or non-write mode bits");
   }
   return action.manifestDigest;
@@ -77643,19 +77715,14 @@ function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
             const entry = pluginEntry[0];
-            const sourcePath = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
-            if (typeof sourcePath !== "string" || sourcePath.length === 0) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`
-              });
-            }
-            if (sourcePath.startsWith("/") || sourcePath.includes("..") || sourcePath.includes("\\") || /^https?:\/\//i.test(sourcePath)) {
+            let sourcePath;
+            try {
+              sourcePath = extractDeclaredPluginSource(consumer, entry);
+            } catch (sourceErr) {
               return createResult({
                 actionType,
                 status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source "${sourcePath}" is not a safe relative path`
+                error: sourceErr.message
               });
             }
             const sourceDirAbs = resolve19(snapshotDirReal, sourcePath);
@@ -78578,7 +78645,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           } catch (digestErr) {
             try {
               const installedSnapshot = await computeFrozenSnapshot(installPath, {
-                excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+                excludeRootEntries: consumerTransportExclusions(consumer)
               });
               manifestDigest = installedSnapshot.digest;
             } catch {
@@ -78744,6 +78811,9 @@ var init_plugin_marketplace = __esm({
     execFile9 = promisify10(execFileCb10);
     NAME4 = "plugin-marketplace";
     __name(transportPayload, "transportPayload");
+    __name(consumerTransportExclusions, "consumerTransportExclusions");
+    __name(extractDeclaredPluginSource, "extractDeclaredPluginSource");
+    __name(resolveInstalledPayloadSubpath, "resolveInstalledPayloadSubpath");
     __name(verifyInstalledMarketplacePayload, "verifyInstalledMarketplacePayload");
     __name(writeEvidenceAtomic, "writeEvidenceAtomic");
     KIMI_REQUIREMENT_FILE = "release-skill-kimi-manual-install.json";

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.1.8.",
+      "Prepare a release plan for version 0.1.10.",
       "Help me understand the release workflow."
     ]
   }