release-skill 0.1.8 → 0.1.10

package/src/adapters/plugin-marketplace.mjs

@@ -48,6 +48,99 @@ function transportPayload(entries) {
   }));
 }
 
+// Consumer-owned transport metadata written into the plugin install root
+// that is not part of the published payload. Codex checks out the
+// repository (root `.git` metadata) and materializes migrated command
+// skills under `.codex-plugin/migrated-command-skills/` (the CLI converts
+// plugin commands/ into skill format at install time); Claude marks in-use
+// plugin checkouts with an empty root `.in_use` marker. Single-segment
+// exclusions apply to root entries only; the multi-segment exclusion names
+// the exact CLI-generated subtree. All other payload paths keep the
+// fail-closed file checks — the exemption must never widen to
+// ".codex-plugin/*" or arbitrary extra files.
+function consumerTransportExclusions(consumer) {
+  if (consumer === 'claude') return ['.in_use'];
+  if (consumer === 'codex') return ['.git', '.codex-plugin/migrated-command-skills'];
+  if (consumer === 'kimi') return ['.git'];
+  return [];
+}
+
+/**
+ * Extract the marketplace plugin entry's declared source as a validated,
+ * normalized snapshot-relative subpath ("." for root layouts).
+ *
+ * The rejection set is preserved verbatim from the preflight safety checks:
+ * non-empty string, no absolute paths, no ".." traversal (substring check,
+ * deliberately stricter than per-segment), no backslashes, no remote URLs.
+ * Normalization runs AFTER validation and collapses "./", ".", and trailing
+ * slashes. Throws with the preflight's exact error messages.
+ */
+function extractDeclaredPluginSource(consumer, entry) {
+  const rawSource = consumer === 'claude'
+    ? entry.source
+    : entry.source?.source === 'local' ? entry.source?.path : null;
+  if (typeof rawSource !== 'string' || rawSource.length === 0) {
+    throw new Error(`marketplace plugin entry source must be a non-empty relative path${consumer === 'codex' ? ' (object with source:"local")' : ''}, got ${JSON.stringify(entry.source)}`);
+  }
+  if (
+    rawSource.startsWith('/') ||
+    rawSource.includes('..') ||
+    rawSource.includes('\\') ||
+    /^https?:\/\//i.test(rawSource)
+  ) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  const segments = rawSource.split('/').filter((segment) => segment !== '' && segment !== '.');
+  // Redundant post-normalization invariant: ".." was already rejected by the
+  // substring check above; fail closed if it ever survives normalization.
+  if (segments.some((segment) => segment === '..')) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  return segments.length === 0 ? '.' : segments.join('/');
+}
+
+/**
+ * Resolve the payload subpath the consumer CLI installs for this action,
+ * read from the marketplace manifest inside the digest-verified frozen
+ * snapshot. Returns "." when the whole snapshot is the installed payload
+ * (root layouts, and kimi which has no marketplace manifest).
+ *
+ * Throws (fail closed) if the manifest is absent from the verified entries,
+ * unreadable, names a different marketplace, or does not declare exactly
+ * one plugins[] entry for action.plugin. The manifest itself lives inside
+ * the digest-sealed snapshot, so the declared subpath is authority-bound:
+ * tampering with it fails the snapshot digest revalidation first.
+ */
+async function resolveInstalledPayloadSubpath(snapshotDir, sourceEntries, action, consumer) {
+  if (consumer === 'kimi') return '.';
+  const marketplaceRelative = consumer === 'claude'
+    ? '.claude-plugin/marketplace.json'
+    : '.agents/plugins/marketplace.json';
+  // Anchor the manifest read to the digest-verified entry walk: the target
+  // must be one of the regular files that already passed the fail-closed
+  // read checks (O_NOFOLLOW, single link, before/after stat stability).
+  const anchored = sourceEntries.some((entry) => entry.type === 'file' && entry.path === marketplaceRelative);
+  if (!anchored) {
+    throw new Error(`frozen snapshot is missing the marketplace manifest ${marketplaceRelative}`);
+  }
+  const result = await validateManifestFile(resolve(snapshotDir, marketplaceRelative), ['name', 'plugins']);
+  if (!result.valid) {
+    throw new Error(`frozen snapshot ${marketplaceRelative} invalid: ${result.error}`);
+  }
+  if (result.manifest.name !== action.marketplace) {
+    throw new Error(`marketplace manifest name "${result.manifest.name}" does not match action marketplace "${action.marketplace}"`);
+  }
+  const plugins = result.manifest.plugins;
+  if (!Array.isArray(plugins)) {
+    throw new Error(`${marketplaceRelative} must have a plugins[] array`);
+  }
+  const matches = plugins.filter((entry) => entry.name === action.plugin);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one plugins[] entry with name "${action.plugin}", found ${matches.length}`);
+  }
+  return extractDeclaredPluginSource(consumer, matches[0]);
+}
+
 async function verifyInstalledMarketplacePayload(action, context, installPath, consumer) {
   const sourcePath = await resolveFrozenPath(
     context.root,
@@ -58,11 +151,34 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
   if (sourceSnapshot.digest !== action.manifestDigest) {
     throw new Error('frozen marketplace snapshot digest no longer matches the plan');
   }
+  // Consumer marketplaces install only the plugin entry's declared source
+  // subtree (e.g. "./adapters/claude"), not the whole unit snapshot. The
+  // sealed whole-snapshot digest above remains the authority; bind the
+  // installed payload to that snapshot's declared subtree. Root layouts
+  // and kimi keep the whole-tree comparison ("." subpath, no filtering).
+  const payloadSubpath = await resolveInstalledPayloadSubpath(
+    sourcePath,
+    sourceSnapshot.entries,
+    action,
+    consumer,
+  );
+  const prefix = payloadSubpath === '.' ? null : `${payloadSubpath}/`;
+  const authorityEntries = prefix === null
+    ? sourceSnapshot.entries
+    : sourceSnapshot.entries
+        // The trailing slash keeps sibling directories (e.g.
+        // "adapters/claude-x") out of the comparison set. Prefix removal on
+        // a path-sorted array is order-preserving, so no re-sort is needed.
+        .filter((entry) => entry.path.startsWith(prefix))
+        .map((entry) => ({ ...entry, path: entry.path.slice(prefix.length) }));
+  if (authorityEntries.length === 0) {
+    throw new Error('frozen snapshot contains no payload under the declared marketplace source');
+  }
   const installedSnapshot = await computeFrozenSnapshot(installPath, {
-    excludeRootEntries: consumer === 'codex' || consumer === 'kimi' ? ['.git'] : [],
+    excludeRootEntries: consumerTransportExclusions(consumer),
   });
   if (
-    JSON.stringify(transportPayload(sourceSnapshot.entries))
+    JSON.stringify(transportPayload(authorityEntries))
     !== JSON.stringify(transportPayload(installedSnapshot.entries))
   ) {
     throw new Error('installed marketplace payload differs in path, bytes, size, or non-write mode bits');
@@ -1139,27 +1255,17 @@ export function createPluginMarketplaceAdapter(deps = {}) {
           // Entry source must be a safe relative path within the snapshot.
           // Accepts "./" (root-level), "./adapters/claude" (subdirectory),
           // etc. Rejects absolute paths, ".." traversal, remote URLs, and
-          // empty strings.
-          const sourcePath = consumer === 'claude'
-            ? entry.source
-            : entry.source?.source === 'local' ? entry.source?.path : null;
-          if (typeof sourcePath !== 'string' || sourcePath.length === 0) {
-            return createResult({
-              actionType,
-              status: ActionStatus.PREFLIGHT_FAILED,
-              error: `marketplace plugin entry source must be a non-empty relative path${consumer === 'codex' ? ' (object with source:"local")' : ''}, got ${JSON.stringify(entry.source)}`,
-            });
-          }
-          if (
-            sourcePath.startsWith('/') ||
-            sourcePath.includes('..') ||
-            sourcePath.includes('\\') ||
-            /^https?:\/\//i.test(sourcePath)
-          ) {
+          // empty strings. Normalized to "." for root layouts; the same
+          // helper backs verify-side payload subtree resolution, so both
+          // paths can never drift apart.
+          let sourcePath;
+          try {
+            sourcePath = extractDeclaredPluginSource(consumer, entry);
+          } catch (sourceErr) {
             return createResult({
               actionType,
               status: ActionStatus.PREFLIGHT_FAILED,
-              error: `marketplace plugin entry source "${sourcePath}" is not a safe relative path`,
+              error: sourceErr.message,
             });
           }
           // Verify the declared source directory exists and contains the
@@ -2290,7 +2396,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             // is returned and verify therefore fails closed.
             try {
               const installedSnapshot = await computeFrozenSnapshot(installPath, {
-                excludeRootEntries: consumer === 'codex' || consumer === 'kimi' ? ['.git'] : [],
+                excludeRootEntries: consumerTransportExclusions(consumer),
               });
               manifestDigest = installedSnapshot.digest;
             } catch {

package/src/core/baseline.mjs

@@ -17,6 +17,16 @@ const execFile = promisify(execFileCb);
  * use reserved prefixes; immutable plans and approvals use exact digest-shaped
  * paths so arbitrary files under similarly named directories remain visible.
  *
+ * `kimi-attestations` holds Kimi's closure-protocol lifecycle artifacts:
+ * the manual installation requirement that publish/reconcile itself emits
+ * for a PARTIAL kimi checkpoint, and the human-written attestation that is
+ * the designed closure input (independently bound to planDigest,
+ * payloadDigest, exact version/tag, install path, responsible person, and
+ * expiry). Neither is publishable source or project configuration — they
+ * never enter the frozen snapshot — so excluding them keeps reconcile's own
+ * requirement output and the flow-required attestation from invalidating
+ * the baseline of every subsequent reconcile.
+ *
  * `project.yaml` is intentionally **not** listed — changes to project
  * configuration must always cause a baseline drift.
  */
@@ -27,6 +37,7 @@ const CONTROL_PLANE_PREFIXES = [
   '.release-skill/lock-audit',
   '.release-skill/runs',
   '.release-skill/transactions',
+  '.release-skill/kimi-attestations',
 ];
 const RESERVED_CONTROL_PREFIXES = [
   ...CONTROL_PLANE_PREFIXES,

package/src/snapshot/frozen.mjs

@@ -82,9 +82,15 @@ async function readStableRegularFile(filePath, displayPath) {
  * Compute the canonical snapshot digest.
  *
  * `excludeRootEntries` is reserved for consumer-owned transport metadata
- * that is not part of the published payload (currently Codex's root `.git`
- * checkout metadata). Exclusions only apply to direct children of the root;
- * all payload paths retain the normal fail-closed file checks.
+ * that is not part of the published payload: Codex's root `.git` checkout
+ * metadata, Codex's CLI-generated `.codex-plugin/migrated-command-skills/`
+ * subtree, and Claude's root `.in_use` in-use plugin marker. Single-segment
+ * entries only match direct children of the root (historical behavior);
+ * multi-segment entries name an exact relative path whose subtree is
+ * skipped. Every other payload path retains the normal fail-closed file
+ * checks — the exemption must never widen to whole directories or
+ * arbitrary extra files. Malformed entries (absolute, "..", backslash)
+ * fail closed: a bad exclusion list is a caller bug, not transport metadata.
  */
 export async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries = [] } = {}) {
   const root = await realpath(snapshotDir);
@@ -94,14 +100,33 @@ export async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries =
   }
 
   const entries = [];
-  const excluded = new Set(excludeRootEntries);
+  const excludedRootNames = new Set();
+  const excludedPathPrefixes = [];
+  for (const entry of excludeRootEntries) {
+    if (typeof entry !== 'string') {
+      throw frozenError('frozen snapshot exclusion entries must be strings');
+    }
+    const segments = entry.split('/').filter((segment) => segment !== '' && segment !== '.');
+    if (
+      segments.length === 0 || entry.startsWith('/') || entry.includes('\\') ||
+      segments.some((segment) => segment === '..')
+    ) {
+      throw frozenError(`frozen snapshot exclusion entry is not a safe relative path: ${JSON.stringify(entry)}`);
+    }
+    if (segments.length === 1) {
+      excludedRootNames.add(segments[0]);
+    } else {
+      excludedPathPrefixes.push(segments.join('/'));
+    }
+  }
   async function walk(dir) {
     const children = await readdir(dir, { withFileTypes: true });
     children.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
     for (const child of children) {
-      if (dir === root && excluded.has(child.name)) continue;
+      if (dir === root && excludedRootNames.has(child.name)) continue;
       const absolute = join(dir, child.name);
       const rel = relative(root, absolute).split('\\').join('/');
+      if (excludedPathPrefixes.some((prefix) => rel === prefix || rel.startsWith(`${prefix}/`))) continue;
       const st = await lstat(absolute);
       if (st.isSymbolicLink()) {
         throw frozenError(`frozen snapshot contains symlink: ${rel}`);