release-skill 0.1.8 → 0.1.9

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.1.8",
+      "version": "0.1.9",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.1.8.",
+      "Prepare a release plan for version 0.1.9.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.1.9 locale=en baseline=sha256:409f940c03e2d6fd41d33659b246b3d4b622918b4ac5a3a711d83aa09740ef11 -->
+## [0.1.9] - 2026-07-23
+
+v0.1.9 fixes a structural marketplace install verification failure: consumer installs that declare a plugin `source` subdirectory (e.g. `./adapters/claude`) now bind the installed payload to the declared subtree of the sealed whole-unit snapshot, and Claude's root `.in_use` marker is exempted as consumer-owned transport metadata. The sealed snapshot digest, release plan schema, and prepare-side freezing are unchanged, so already-frozen plans reconcile without re-approval. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
+
+### Fixed
+
+- **Marketplace payload binding for subdirectory source layouts**: consumer
+  marketplaces may declare a plugin `source` subdirectory such as
+  `./adapters/claude`; the consumer CLI then installs only that subtree while
+  the sealed authority is the whole unit snapshot. Install verification now
+  revalidates the sealed whole-snapshot digest, re-reads the declared source
+  from the marketplace manifest inside the digest-verified snapshot entries,
+  and binds the installed payload to that prefix-stripped subtree. Root
+  layouts and Kimi keep the whole-tree comparison. This resolves the
+  flow-architect v0.4.1 and v0.5.0 PARTIAL marketplace install failures;
+  already-frozen plans reconcile unchanged because the sealed digest, plan
+  schema, and prepare-side freezing are untouched.
+- **Claude `.in_use` transport marker exemption**: the Claude CLI writes an
+  empty `.in_use` marker into the plugin install root; it is now exempted as
+  consumer-owned transport metadata alongside the existing Codex/Kimi `.git`
+  exemption, through a single shared exclusion helper that also backs the
+  observe-time diagnostic fallback. Exemptions remain root-only: nested
+  markers, extra payload, byte tampering, and sealed authority tampering
+  still fail closed.
+- **Regression coverage**: new protocol-level fake-CLI tests cover the
+  subdirectory claude cycle with `.in_use` (including byte-tamper,
+  extra-file, missing-file, `.git`-not-exempt, and nested-marker negatives),
+  fail-closed manifest anomalies (duplicate plugin entry, wrong marketplace
+  name, empty source projection), root-layout claude with `.in_use`, and a
+  codex subdirectory variant.
+<!-- release-skill:changelog:end version=0.1.9 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.1.8 locale=en baseline=sha256:1e1a0af9d5807bceb7af1eae88b726f67e6811dba4db579fd625c07f3bdbca89 -->
 ## [0.1.8] - 2026-07-23
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.1.8 -->
+<!-- release-skill:release-version: 0.1.9 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -68,7 +68,7 @@ as a version-pinned **manual** install plus trusted observation/attestation:
    default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.8
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.9
    /plugins reload
    ```
 
@@ -83,10 +83,10 @@ as a version-pinned **manual** install plus trusted observation/attestation:
 {
   "consumer": "kimi",
   "plugin": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "entrySkill": "release-help",
   "repo": "ifoohoo/release-skill",
-  "ref": "release-skill-v0.1.8",
+  "ref": "release-skill-v0.1.9",
   "installPath": "<kimiCodeHome>/plugins/managed/release-skill",
   "planDigest": "<64-hex frozen plan digest>",
   "payloadDigest": "<64-hex frozen snapshot payload digest>",

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.1.8 -->
+<!-- release-skill:release-version: 0.1.9 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -62,7 +62,7 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
    它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.8
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.1.9
    /plugins reload
    ```
 
@@ -76,10 +76,10 @@ release-skill 把 Kimi 安装建模为“版本钉死的手动安装 + 可信观
 {
   "consumer": "kimi",
   "plugin": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "entrySkill": "release-help",
   "repo": "ifoohoo/release-skill",
-  "ref": "release-skill-v0.1.8",
+  "ref": "release-skill-v0.1.9",
   "installPath": "<kimiCodeHome>/plugins/managed/release-skill",
   "planDigest": "<64 位十六进制冻结计划摘要>",
   "payloadDigest": "<64 位十六进制冻结快照载荷摘要>",

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.1.8 -->
+<!-- release-skill:release-version: 0.1.9 -->
 Release preparation for Claude Code, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -11,29 +11,41 @@ reviewed artifacts first and publishes those same artifacts later; it does not
 regenerate a README or re-pack the live workspace at the last step.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.1.8** (2026-07-23)
-
-v0.1.8 adds Kimi Code as a first-class plugin host without rewriting the already-published v0.1.7 artifacts. Kimi delivery uses a generated self-contained adapter and a fail-closed, plan-bound manual installation attestation because Kimi Code has no scriptable non-interactive plugin installation interface. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
-
-**Changed**
-
-- **Kimi Code plugin delivery and verification**: v0.1.8 adds the root
-  `.kimi-plugin/plugin.json`, a generated self-contained `adapters/kimi/` bundle,
-  and public installation guidance. Because Kimi Code exposes no scriptable
-  non-interactive plugin installation interface, production publish emits a
-  version-pinned manual installation requirement and enters `PARTIAL`; an
-  isolated `KIMI_CODE_HOME` installation and a trusted attestation bound
-  independently to the frozen plan digest and payload digest are required before
-  `reconcile` can reach `PUBLISHED` and `verify` can reach `VERIFIED`.
-- **Immutable v0.1.7 history preserved**: the existing v0.1.7 Git tag,
-  GitHub Release, npm version, and public commit remain untouched. The v0.1.8
-  production plan binds the published v0.1.7 commit
-  `fe5897456d4166a2ec60e99405836b122562b80d` as its previous public baseline.
+**0.1.9** (2026-07-23)
+
+v0.1.9 fixes a structural marketplace install verification failure: consumer installs that declare a plugin `source` subdirectory (e.g. `./adapters/claude`) now bind the installed payload to the declared subtree of the sealed whole-unit snapshot, and Claude's root `.in_use` marker is exempted as consumer-owned transport metadata. The sealed snapshot digest, release plan schema, and prepare-side freezing are unchanged, so already-frozen plans reconcile without re-approval. The npm package name (`release-skill`), publishing identity (`publisher: mzdbxqh`), public repository (`ifoohoo/release-skill`), and corporate maintainer remain unchanged.
+
+**Fixed**
+
+- **Marketplace payload binding for subdirectory source layouts**: consumer
+  marketplaces may declare a plugin `source` subdirectory such as
+  `./adapters/claude`; the consumer CLI then installs only that subtree while
+  the sealed authority is the whole unit snapshot. Install verification now
+  revalidates the sealed whole-snapshot digest, re-reads the declared source
+  from the marketplace manifest inside the digest-verified snapshot entries,
+  and binds the installed payload to that prefix-stripped subtree. Root
+  layouts and Kimi keep the whole-tree comparison. This resolves the
+  flow-architect v0.4.1 and v0.5.0 PARTIAL marketplace install failures;
+  already-frozen plans reconcile unchanged because the sealed digest, plan
+  schema, and prepare-side freezing are untouched.
+- **Claude `.in_use` transport marker exemption**: the Claude CLI writes an
+  empty `.in_use` marker into the plugin install root; it is now exempted as
+  consumer-owned transport metadata alongside the existing Codex/Kimi `.git`
+  exemption, through a single shared exclusion helper that also backs the
+  observe-time diagnostic fallback. Exemptions remain root-only: nested
+  markers, extra payload, byte tampering, and sealed authority tampering
+  still fail closed.
+- **Regression coverage**: new protocol-level fake-CLI tests cover the
+  subdirectory claude cycle with `.in_use` (including byte-tamper,
+  extra-file, missing-file, `.git`-not-exempt, and nested-marker negatives),
+  fail-closed manifest anomalies (duplicate plugin entry, wrong marketplace
+  name, empty source projection), root-layout claude with `.in_use`, and a
+  codex subdirectory variant.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.1.8 is the current release (v0.1.7 previously held
-> published status before the Kimi Code distribution was added).
+> **Current boundary:** v0.1.9 is the current release (v0.1.8 previously held
+> published status before the marketplace payload binding fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
 > production-verified milestone — followed by
 > exact npm installation and Claude/Codex consumer installation verification
@@ -50,7 +62,7 @@ v0.1.8 adds Kimi Code as a first-class plugin host without rewriting the already
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.1.8 is the current
+> **Production path verified since the v0.1.1 milestone; v0.1.9 is the current
 > release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >

package/README.zh-CN.md

@@ -2,31 +2,37 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.1.8 -->
+<!-- release-skill:release-version: 0.1.9 -->
 面向 Claude Code、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它先冻结并供人工审阅，再从同一份冻结产物发布，不会在最后一步重新生成 README、重新打包当前工作区或覆盖人工内容。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.1.8** (2026-07-23)
-
-v0.1.8 在不改写已经公开的 v0.1.7 制品的前提下，新增对 Kimi Code 一等插件宿主的支持。由于 Kimi Code 没有可脚本化的非交互插件安装接口，Kimi 分发采用生成的自包含适配器，以及失败关闭、绑定冻结计划的人工安装证明。npm 包名（`release-skill`）、发布身份（`publisher: mzdbxqh`）、公开仓库（`ifoohoo/release-skill`）与公司维护主体均保持不变。
-
-**变更**
-
-- **Kimi Code 插件分发与验证**：v0.1.8 新增根
-  `.kimi-plugin/plugin.json`、生成的自包含 `adapters/kimi/` 适配器和公开安装说明。
-  由于 Kimi Code 没有可脚本化的非交互插件安装接口，生产发布会生成版本钉死的人工
-  安装要求并进入 `PARTIAL`；操作者必须在隔离的 `KIMI_CODE_HOME` 中完成安装，并
-  提供分别绑定冻结计划摘要和载荷摘要的可信证明，之后 `reconcile` 才能进入
-  `PUBLISHED`，`verify` 才能进入 `VERIFIED`。
-- **保留不可变的 v0.1.7 历史**：既有 v0.1.7 Git 标签、GitHub Release、npm
-  版本与公开提交均不改写。v0.1.8 生产计划以已公开的 v0.1.7 提交
-  `fe5897456d4166a2ec60e99405836b122562b80d` 作为前序公开基线。
+**0.1.9** (2026-07-23)
+
+v0.1.9 修复一个结构性的 marketplace 安装校验失败：声明插件 `source` 子目录（如 `./adapters/claude`）的消费者安装现在能把安装载荷绑定到密封整 unit 快照中声明的子树，Claude 根目录 `.in_use` 标记作为消费者所有的传输元数据获得豁免。密封快照摘要、发布计划 schema 与 prepare 冻结均未改动，已冻结计划无需重新审批即可 reconcile。npm 包名（`release-skill`）、发布身份（`publisher: mzdbxqh`）、公开仓库（`ifoohoo/release-skill`）与公司维护主体保持不变。
+
+**修复**
+
+- **子目录 source 布局的 marketplace 载荷绑定**：消费者清单可以声明
+  `./adapters/claude` 这样的插件 `source` 子目录，此时消费者 CLI 只安装该子树，
+  而密封权威是整个 unit 快照。安装校验现在先重验密封整快照摘要，再从摘要已验证
+  的快照条目内部读取清单声明的 source，并把安装载荷绑定到剥离前缀后的子树；
+  根布局与 Kimi 保持整树比较。这解决了 flow-architect v0.4.1 与 v0.5.0 的
+  marketplace 安装 PARTIAL 失败；密封摘要、计划 schema 与 prepare 冻结均未改动，
+  已冻结计划可以不变地 reconcile 收口。
+- **Claude `.in_use` 传输标记豁免**：Claude CLI 会在插件安装根目录写入空的
+  `.in_use` 标记，现在与既有的 Codex/Kimi `.git` 豁免一样作为消费者所有的传输
+  元数据豁免，并统一为单一共享 helper（observe 诊断回退同样复用）。豁免仅限根
+  直接子项：嵌套标记、多余载荷、字节篡改与密封权威篡改仍然失败关闭。
+- **回归覆盖**：新增协议级 fake-CLI 测试覆盖带 `.in_use` 的子目录 claude
+  完整链路（含字节篡改、多余文件、缺失文件、`.git` 不豁免与嵌套标记负例）、
+  失败关闭的清单异常（重复插件条目、marketplace 名不符、空 source 投影）、
+  带 `.in_use` 的根布局 claude，以及 codex 子目录变体。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.1.8 是当前发布版本（v0.1.7 曾处于已发布、待独立验证状态）。
+> **当前边界：** v0.1.9 是当前发布版本（v0.1.8 曾处于已发布、待独立验证状态）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；“当前发布版本”与“首次生产验证里程碑”
@@ -39,7 +45,7 @@ v0.1.8 在不改写已经公开的 v0.1.7 制品的前提下，新增对 Kimi Co
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.1.8 是当前发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.1.9 是当前发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.1.8",
+      "version": "0.1.9",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
     }
   ]

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.8"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.9"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -76930,6 +76930,49 @@ function transportPayload(entries) {
     contentDigest
   }));
 }
+function consumerTransportExclusions(consumer) {
+  if (consumer === "claude") return [".in_use"];
+  if (consumer === "codex" || consumer === "kimi") return [".git"];
+  return [];
+}
+function extractDeclaredPluginSource(consumer, entry) {
+  const rawSource = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
+  if (typeof rawSource !== "string" || rawSource.length === 0) {
+    throw new Error(`marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`);
+  }
+  if (rawSource.startsWith("/") || rawSource.includes("..") || rawSource.includes("\\") || /^https?:\/\//i.test(rawSource)) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  const segments = rawSource.split("/").filter((segment) => segment !== "" && segment !== ".");
+  if (segments.some((segment) => segment === "..")) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  return segments.length === 0 ? "." : segments.join("/");
+}
+async function resolveInstalledPayloadSubpath(snapshotDir, sourceEntries, action, consumer) {
+  if (consumer === "kimi") return ".";
+  const marketplaceRelative = consumer === "claude" ? ".claude-plugin/marketplace.json" : ".agents/plugins/marketplace.json";
+  const anchored = sourceEntries.some((entry) => entry.type === "file" && entry.path === marketplaceRelative);
+  if (!anchored) {
+    throw new Error(`frozen snapshot is missing the marketplace manifest ${marketplaceRelative}`);
+  }
+  const result = await validateManifestFile(resolve19(snapshotDir, marketplaceRelative), ["name", "plugins"]);
+  if (!result.valid) {
+    throw new Error(`frozen snapshot ${marketplaceRelative} invalid: ${result.error}`);
+  }
+  if (result.manifest.name !== action.marketplace) {
+    throw new Error(`marketplace manifest name "${result.manifest.name}" does not match action marketplace "${action.marketplace}"`);
+  }
+  const plugins = result.manifest.plugins;
+  if (!Array.isArray(plugins)) {
+    throw new Error(`${marketplaceRelative} must have a plugins[] array`);
+  }
+  const matches = plugins.filter((entry) => entry.name === action.plugin);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one plugins[] entry with name "${action.plugin}", found ${matches.length}`);
+  }
+  return extractDeclaredPluginSource(consumer, matches[0]);
+}
 async function verifyInstalledMarketplacePayload(action, context, installPath, consumer) {
   const sourcePath = await resolveFrozenPath(
     context.root,
@@ -76940,10 +76983,21 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
   if (sourceSnapshot.digest !== action.manifestDigest) {
     throw new Error("frozen marketplace snapshot digest no longer matches the plan");
   }
+  const payloadSubpath = await resolveInstalledPayloadSubpath(
+    sourcePath,
+    sourceSnapshot.entries,
+    action,
+    consumer
+  );
+  const prefix = payloadSubpath === "." ? null : `${payloadSubpath}/`;
+  const authorityEntries = prefix === null ? sourceSnapshot.entries : sourceSnapshot.entries.filter((entry) => entry.path.startsWith(prefix)).map((entry) => ({ ...entry, path: entry.path.slice(prefix.length) }));
+  if (authorityEntries.length === 0) {
+    throw new Error("frozen snapshot contains no payload under the declared marketplace source");
+  }
   const installedSnapshot = await computeFrozenSnapshot(installPath, {
-    excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+    excludeRootEntries: consumerTransportExclusions(consumer)
   });
-  if (JSON.stringify(transportPayload(sourceSnapshot.entries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
+  if (JSON.stringify(transportPayload(authorityEntries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
     throw new Error("installed marketplace payload differs in path, bytes, size, or non-write mode bits");
   }
   return action.manifestDigest;
@@ -77643,19 +77697,14 @@ function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
             const entry = pluginEntry[0];
-            const sourcePath = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
-            if (typeof sourcePath !== "string" || sourcePath.length === 0) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`
-              });
-            }
-            if (sourcePath.startsWith("/") || sourcePath.includes("..") || sourcePath.includes("\\") || /^https?:\/\//i.test(sourcePath)) {
+            let sourcePath;
+            try {
+              sourcePath = extractDeclaredPluginSource(consumer, entry);
+            } catch (sourceErr) {
               return createResult({
                 actionType,
                 status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source "${sourcePath}" is not a safe relative path`
+                error: sourceErr.message
               });
             }
             const sourceDirAbs = resolve19(snapshotDirReal, sourcePath);
@@ -78578,7 +78627,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           } catch (digestErr) {
             try {
               const installedSnapshot = await computeFrozenSnapshot(installPath, {
-                excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+                excludeRootEntries: consumerTransportExclusions(consumer)
               });
               manifestDigest = installedSnapshot.digest;
             } catch {
@@ -78744,6 +78793,9 @@ var init_plugin_marketplace = __esm({
     execFile9 = promisify10(execFileCb10);
     NAME4 = "plugin-marketplace";
     __name(transportPayload, "transportPayload");
+    __name(consumerTransportExclusions, "consumerTransportExclusions");
+    __name(extractDeclaredPluginSource, "extractDeclaredPluginSource");
+    __name(resolveInstalledPayloadSubpath, "resolveInstalledPayloadSubpath");
     __name(verifyInstalledMarketplacePayload, "verifyInstalledMarketplacePayload");
     __name(writeEvidenceAtomic, "writeEvidenceAtomic");
     KIMI_REQUIREMENT_FILE = "release-skill-kimi-manual-install.json";

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.1.8.",
+      "Prepare a release plan for version 0.1.9.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.8"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.9"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -76930,6 +76930,49 @@ function transportPayload(entries) {
     contentDigest
   }));
 }
+function consumerTransportExclusions(consumer) {
+  if (consumer === "claude") return [".in_use"];
+  if (consumer === "codex" || consumer === "kimi") return [".git"];
+  return [];
+}
+function extractDeclaredPluginSource(consumer, entry) {
+  const rawSource = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
+  if (typeof rawSource !== "string" || rawSource.length === 0) {
+    throw new Error(`marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`);
+  }
+  if (rawSource.startsWith("/") || rawSource.includes("..") || rawSource.includes("\\") || /^https?:\/\//i.test(rawSource)) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  const segments = rawSource.split("/").filter((segment) => segment !== "" && segment !== ".");
+  if (segments.some((segment) => segment === "..")) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  return segments.length === 0 ? "." : segments.join("/");
+}
+async function resolveInstalledPayloadSubpath(snapshotDir, sourceEntries, action, consumer) {
+  if (consumer === "kimi") return ".";
+  const marketplaceRelative = consumer === "claude" ? ".claude-plugin/marketplace.json" : ".agents/plugins/marketplace.json";
+  const anchored = sourceEntries.some((entry) => entry.type === "file" && entry.path === marketplaceRelative);
+  if (!anchored) {
+    throw new Error(`frozen snapshot is missing the marketplace manifest ${marketplaceRelative}`);
+  }
+  const result = await validateManifestFile(resolve19(snapshotDir, marketplaceRelative), ["name", "plugins"]);
+  if (!result.valid) {
+    throw new Error(`frozen snapshot ${marketplaceRelative} invalid: ${result.error}`);
+  }
+  if (result.manifest.name !== action.marketplace) {
+    throw new Error(`marketplace manifest name "${result.manifest.name}" does not match action marketplace "${action.marketplace}"`);
+  }
+  const plugins = result.manifest.plugins;
+  if (!Array.isArray(plugins)) {
+    throw new Error(`${marketplaceRelative} must have a plugins[] array`);
+  }
+  const matches = plugins.filter((entry) => entry.name === action.plugin);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one plugins[] entry with name "${action.plugin}", found ${matches.length}`);
+  }
+  return extractDeclaredPluginSource(consumer, matches[0]);
+}
 async function verifyInstalledMarketplacePayload(action, context, installPath, consumer) {
   const sourcePath = await resolveFrozenPath(
     context.root,
@@ -76940,10 +76983,21 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
   if (sourceSnapshot.digest !== action.manifestDigest) {
     throw new Error("frozen marketplace snapshot digest no longer matches the plan");
   }
+  const payloadSubpath = await resolveInstalledPayloadSubpath(
+    sourcePath,
+    sourceSnapshot.entries,
+    action,
+    consumer
+  );
+  const prefix = payloadSubpath === "." ? null : `${payloadSubpath}/`;
+  const authorityEntries = prefix === null ? sourceSnapshot.entries : sourceSnapshot.entries.filter((entry) => entry.path.startsWith(prefix)).map((entry) => ({ ...entry, path: entry.path.slice(prefix.length) }));
+  if (authorityEntries.length === 0) {
+    throw new Error("frozen snapshot contains no payload under the declared marketplace source");
+  }
   const installedSnapshot = await computeFrozenSnapshot(installPath, {
-    excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+    excludeRootEntries: consumerTransportExclusions(consumer)
   });
-  if (JSON.stringify(transportPayload(sourceSnapshot.entries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
+  if (JSON.stringify(transportPayload(authorityEntries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
     throw new Error("installed marketplace payload differs in path, bytes, size, or non-write mode bits");
   }
   return action.manifestDigest;
@@ -77643,19 +77697,14 @@ function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
             const entry = pluginEntry[0];
-            const sourcePath = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
-            if (typeof sourcePath !== "string" || sourcePath.length === 0) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`
-              });
-            }
-            if (sourcePath.startsWith("/") || sourcePath.includes("..") || sourcePath.includes("\\") || /^https?:\/\//i.test(sourcePath)) {
+            let sourcePath;
+            try {
+              sourcePath = extractDeclaredPluginSource(consumer, entry);
+            } catch (sourceErr) {
               return createResult({
                 actionType,
                 status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source "${sourcePath}" is not a safe relative path`
+                error: sourceErr.message
               });
             }
             const sourceDirAbs = resolve19(snapshotDirReal, sourcePath);
@@ -78578,7 +78627,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           } catch (digestErr) {
             try {
               const installedSnapshot = await computeFrozenSnapshot(installPath, {
-                excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+                excludeRootEntries: consumerTransportExclusions(consumer)
               });
               manifestDigest = installedSnapshot.digest;
             } catch {
@@ -78744,6 +78793,9 @@ var init_plugin_marketplace = __esm({
     execFile9 = promisify10(execFileCb10);
     NAME4 = "plugin-marketplace";
     __name(transportPayload, "transportPayload");
+    __name(consumerTransportExclusions, "consumerTransportExclusions");
+    __name(extractDeclaredPluginSource, "extractDeclaredPluginSource");
+    __name(resolveInstalledPayloadSubpath, "resolveInstalledPayloadSubpath");
     __name(verifyInstalledMarketplacePayload, "verifyInstalledMarketplacePayload");
     __name(writeEvidenceAtomic, "writeEvidenceAtomic");
     KIMI_REQUIREMENT_FILE = "release-skill-kimi-manual-install.json";

package/adapters/kimi/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/kimi/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.8"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.9"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -76930,6 +76930,49 @@ function transportPayload(entries) {
     contentDigest
   }));
 }
+function consumerTransportExclusions(consumer) {
+  if (consumer === "claude") return [".in_use"];
+  if (consumer === "codex" || consumer === "kimi") return [".git"];
+  return [];
+}
+function extractDeclaredPluginSource(consumer, entry) {
+  const rawSource = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
+  if (typeof rawSource !== "string" || rawSource.length === 0) {
+    throw new Error(`marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`);
+  }
+  if (rawSource.startsWith("/") || rawSource.includes("..") || rawSource.includes("\\") || /^https?:\/\//i.test(rawSource)) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  const segments = rawSource.split("/").filter((segment) => segment !== "" && segment !== ".");
+  if (segments.some((segment) => segment === "..")) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  return segments.length === 0 ? "." : segments.join("/");
+}
+async function resolveInstalledPayloadSubpath(snapshotDir, sourceEntries, action, consumer) {
+  if (consumer === "kimi") return ".";
+  const marketplaceRelative = consumer === "claude" ? ".claude-plugin/marketplace.json" : ".agents/plugins/marketplace.json";
+  const anchored = sourceEntries.some((entry) => entry.type === "file" && entry.path === marketplaceRelative);
+  if (!anchored) {
+    throw new Error(`frozen snapshot is missing the marketplace manifest ${marketplaceRelative}`);
+  }
+  const result = await validateManifestFile(resolve19(snapshotDir, marketplaceRelative), ["name", "plugins"]);
+  if (!result.valid) {
+    throw new Error(`frozen snapshot ${marketplaceRelative} invalid: ${result.error}`);
+  }
+  if (result.manifest.name !== action.marketplace) {
+    throw new Error(`marketplace manifest name "${result.manifest.name}" does not match action marketplace "${action.marketplace}"`);
+  }
+  const plugins = result.manifest.plugins;
+  if (!Array.isArray(plugins)) {
+    throw new Error(`${marketplaceRelative} must have a plugins[] array`);
+  }
+  const matches = plugins.filter((entry) => entry.name === action.plugin);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one plugins[] entry with name "${action.plugin}", found ${matches.length}`);
+  }
+  return extractDeclaredPluginSource(consumer, matches[0]);
+}
 async function verifyInstalledMarketplacePayload(action, context, installPath, consumer) {
   const sourcePath = await resolveFrozenPath(
     context.root,
@@ -76940,10 +76983,21 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
   if (sourceSnapshot.digest !== action.manifestDigest) {
     throw new Error("frozen marketplace snapshot digest no longer matches the plan");
   }
+  const payloadSubpath = await resolveInstalledPayloadSubpath(
+    sourcePath,
+    sourceSnapshot.entries,
+    action,
+    consumer
+  );
+  const prefix = payloadSubpath === "." ? null : `${payloadSubpath}/`;
+  const authorityEntries = prefix === null ? sourceSnapshot.entries : sourceSnapshot.entries.filter((entry) => entry.path.startsWith(prefix)).map((entry) => ({ ...entry, path: entry.path.slice(prefix.length) }));
+  if (authorityEntries.length === 0) {
+    throw new Error("frozen snapshot contains no payload under the declared marketplace source");
+  }
   const installedSnapshot = await computeFrozenSnapshot(installPath, {
-    excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+    excludeRootEntries: consumerTransportExclusions(consumer)
   });
-  if (JSON.stringify(transportPayload(sourceSnapshot.entries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
+  if (JSON.stringify(transportPayload(authorityEntries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
     throw new Error("installed marketplace payload differs in path, bytes, size, or non-write mode bits");
   }
   return action.manifestDigest;
@@ -77643,19 +77697,14 @@ function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
             const entry = pluginEntry[0];
-            const sourcePath = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
-            if (typeof sourcePath !== "string" || sourcePath.length === 0) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`
-              });
-            }
-            if (sourcePath.startsWith("/") || sourcePath.includes("..") || sourcePath.includes("\\") || /^https?:\/\//i.test(sourcePath)) {
+            let sourcePath;
+            try {
+              sourcePath = extractDeclaredPluginSource(consumer, entry);
+            } catch (sourceErr) {
               return createResult({
                 actionType,
                 status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source "${sourcePath}" is not a safe relative path`
+                error: sourceErr.message
               });
             }
             const sourceDirAbs = resolve19(snapshotDirReal, sourcePath);
@@ -78578,7 +78627,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           } catch (digestErr) {
             try {
               const installedSnapshot = await computeFrozenSnapshot(installPath, {
-                excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+                excludeRootEntries: consumerTransportExclusions(consumer)
               });
               manifestDigest = installedSnapshot.digest;
             } catch {
@@ -78744,6 +78793,9 @@ var init_plugin_marketplace = __esm({
     execFile9 = promisify10(execFileCb10);
     NAME4 = "plugin-marketplace";
     __name(transportPayload, "transportPayload");
+    __name(consumerTransportExclusions, "consumerTransportExclusions");
+    __name(extractDeclaredPluginSource, "extractDeclaredPluginSource");
+    __name(resolveInstalledPayloadSubpath, "resolveInstalledPayloadSubpath");
     __name(verifyInstalledMarketplacePayload, "verifyInstalledMarketplacePayload");
     __name(writeEvidenceAtomic, "writeEvidenceAtomic");
     KIMI_REQUIREMENT_FILE = "release-skill-kimi-manual-install.json";

package/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.8"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.1.9"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -76930,6 +76930,49 @@ function transportPayload(entries) {
     contentDigest
   }));
 }
+function consumerTransportExclusions(consumer) {
+  if (consumer === "claude") return [".in_use"];
+  if (consumer === "codex" || consumer === "kimi") return [".git"];
+  return [];
+}
+function extractDeclaredPluginSource(consumer, entry) {
+  const rawSource = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
+  if (typeof rawSource !== "string" || rawSource.length === 0) {
+    throw new Error(`marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`);
+  }
+  if (rawSource.startsWith("/") || rawSource.includes("..") || rawSource.includes("\\") || /^https?:\/\//i.test(rawSource)) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  const segments = rawSource.split("/").filter((segment) => segment !== "" && segment !== ".");
+  if (segments.some((segment) => segment === "..")) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  return segments.length === 0 ? "." : segments.join("/");
+}
+async function resolveInstalledPayloadSubpath(snapshotDir, sourceEntries, action, consumer) {
+  if (consumer === "kimi") return ".";
+  const marketplaceRelative = consumer === "claude" ? ".claude-plugin/marketplace.json" : ".agents/plugins/marketplace.json";
+  const anchored = sourceEntries.some((entry) => entry.type === "file" && entry.path === marketplaceRelative);
+  if (!anchored) {
+    throw new Error(`frozen snapshot is missing the marketplace manifest ${marketplaceRelative}`);
+  }
+  const result = await validateManifestFile(resolve19(snapshotDir, marketplaceRelative), ["name", "plugins"]);
+  if (!result.valid) {
+    throw new Error(`frozen snapshot ${marketplaceRelative} invalid: ${result.error}`);
+  }
+  if (result.manifest.name !== action.marketplace) {
+    throw new Error(`marketplace manifest name "${result.manifest.name}" does not match action marketplace "${action.marketplace}"`);
+  }
+  const plugins = result.manifest.plugins;
+  if (!Array.isArray(plugins)) {
+    throw new Error(`${marketplaceRelative} must have a plugins[] array`);
+  }
+  const matches = plugins.filter((entry) => entry.name === action.plugin);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one plugins[] entry with name "${action.plugin}", found ${matches.length}`);
+  }
+  return extractDeclaredPluginSource(consumer, matches[0]);
+}
 async function verifyInstalledMarketplacePayload(action, context, installPath, consumer) {
   const sourcePath = await resolveFrozenPath(
     context.root,
@@ -76940,10 +76983,21 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
   if (sourceSnapshot.digest !== action.manifestDigest) {
     throw new Error("frozen marketplace snapshot digest no longer matches the plan");
   }
+  const payloadSubpath = await resolveInstalledPayloadSubpath(
+    sourcePath,
+    sourceSnapshot.entries,
+    action,
+    consumer
+  );
+  const prefix = payloadSubpath === "." ? null : `${payloadSubpath}/`;
+  const authorityEntries = prefix === null ? sourceSnapshot.entries : sourceSnapshot.entries.filter((entry) => entry.path.startsWith(prefix)).map((entry) => ({ ...entry, path: entry.path.slice(prefix.length) }));
+  if (authorityEntries.length === 0) {
+    throw new Error("frozen snapshot contains no payload under the declared marketplace source");
+  }
   const installedSnapshot = await computeFrozenSnapshot(installPath, {
-    excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+    excludeRootEntries: consumerTransportExclusions(consumer)
   });
-  if (JSON.stringify(transportPayload(sourceSnapshot.entries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
+  if (JSON.stringify(transportPayload(authorityEntries)) !== JSON.stringify(transportPayload(installedSnapshot.entries))) {
     throw new Error("installed marketplace payload differs in path, bytes, size, or non-write mode bits");
   }
   return action.manifestDigest;
@@ -77643,19 +77697,14 @@ function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
             const entry = pluginEntry[0];
-            const sourcePath = consumer === "claude" ? entry.source : entry.source?.source === "local" ? entry.source?.path : null;
-            if (typeof sourcePath !== "string" || sourcePath.length === 0) {
-              return createResult({
-                actionType,
-                status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source must be a non-empty relative path${consumer === "codex" ? ' (object with source:"local")' : ""}, got ${JSON.stringify(entry.source)}`
-              });
-            }
-            if (sourcePath.startsWith("/") || sourcePath.includes("..") || sourcePath.includes("\\") || /^https?:\/\//i.test(sourcePath)) {
+            let sourcePath;
+            try {
+              sourcePath = extractDeclaredPluginSource(consumer, entry);
+            } catch (sourceErr) {
               return createResult({
                 actionType,
                 status: ActionStatus.PREFLIGHT_FAILED,
-                error: `marketplace plugin entry source "${sourcePath}" is not a safe relative path`
+                error: sourceErr.message
               });
             }
             const sourceDirAbs = resolve19(snapshotDirReal, sourcePath);
@@ -78578,7 +78627,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           } catch (digestErr) {
             try {
               const installedSnapshot = await computeFrozenSnapshot(installPath, {
-                excludeRootEntries: consumer === "codex" || consumer === "kimi" ? [".git"] : []
+                excludeRootEntries: consumerTransportExclusions(consumer)
               });
               manifestDigest = installedSnapshot.digest;
             } catch {
@@ -78744,6 +78793,9 @@ var init_plugin_marketplace = __esm({
     execFile9 = promisify10(execFileCb10);
     NAME4 = "plugin-marketplace";
     __name(transportPayload, "transportPayload");
+    __name(consumerTransportExclusions, "consumerTransportExclusions");
+    __name(extractDeclaredPluginSource, "extractDeclaredPluginSource");
+    __name(resolveInstalledPayloadSubpath, "resolveInstalledPayloadSubpath");
     __name(verifyInstalledMarketplacePayload, "verifyInstalledMarketplacePayload");
     __name(writeEvidenceAtomic, "writeEvidenceAtomic");
     KIMI_REQUIREMENT_FILE = "release-skill-kimi-manual-install.json";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/src/adapters/plugin-marketplace.mjs

@@ -48,6 +48,93 @@ function transportPayload(entries) {
   }));
 }
 
+// Consumer-owned transport metadata written into the plugin install root
+// that is not part of the published payload. Codex checks out the
+// repository (root `.git` metadata); Claude marks in-use plugin checkouts
+// with an empty root `.in_use` marker. Exclusions apply to root entries
+// only; all payload paths keep the fail-closed file checks.
+function consumerTransportExclusions(consumer) {
+  if (consumer === 'claude') return ['.in_use'];
+  if (consumer === 'codex' || consumer === 'kimi') return ['.git'];
+  return [];
+}
+
+/**
+ * Extract the marketplace plugin entry's declared source as a validated,
+ * normalized snapshot-relative subpath ("." for root layouts).
+ *
+ * The rejection set is preserved verbatim from the preflight safety checks:
+ * non-empty string, no absolute paths, no ".." traversal (substring check,
+ * deliberately stricter than per-segment), no backslashes, no remote URLs.
+ * Normalization runs AFTER validation and collapses "./", ".", and trailing
+ * slashes. Throws with the preflight's exact error messages.
+ */
+function extractDeclaredPluginSource(consumer, entry) {
+  const rawSource = consumer === 'claude'
+    ? entry.source
+    : entry.source?.source === 'local' ? entry.source?.path : null;
+  if (typeof rawSource !== 'string' || rawSource.length === 0) {
+    throw new Error(`marketplace plugin entry source must be a non-empty relative path${consumer === 'codex' ? ' (object with source:"local")' : ''}, got ${JSON.stringify(entry.source)}`);
+  }
+  if (
+    rawSource.startsWith('/') ||
+    rawSource.includes('..') ||
+    rawSource.includes('\\') ||
+    /^https?:\/\//i.test(rawSource)
+  ) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  const segments = rawSource.split('/').filter((segment) => segment !== '' && segment !== '.');
+  // Redundant post-normalization invariant: ".." was already rejected by the
+  // substring check above; fail closed if it ever survives normalization.
+  if (segments.some((segment) => segment === '..')) {
+    throw new Error(`marketplace plugin entry source "${rawSource}" is not a safe relative path`);
+  }
+  return segments.length === 0 ? '.' : segments.join('/');
+}
+
+/**
+ * Resolve the payload subpath the consumer CLI installs for this action,
+ * read from the marketplace manifest inside the digest-verified frozen
+ * snapshot. Returns "." when the whole snapshot is the installed payload
+ * (root layouts, and kimi which has no marketplace manifest).
+ *
+ * Throws (fail closed) if the manifest is absent from the verified entries,
+ * unreadable, names a different marketplace, or does not declare exactly
+ * one plugins[] entry for action.plugin. The manifest itself lives inside
+ * the digest-sealed snapshot, so the declared subpath is authority-bound:
+ * tampering with it fails the snapshot digest revalidation first.
+ */
+async function resolveInstalledPayloadSubpath(snapshotDir, sourceEntries, action, consumer) {
+  if (consumer === 'kimi') return '.';
+  const marketplaceRelative = consumer === 'claude'
+    ? '.claude-plugin/marketplace.json'
+    : '.agents/plugins/marketplace.json';
+  // Anchor the manifest read to the digest-verified entry walk: the target
+  // must be one of the regular files that already passed the fail-closed
+  // read checks (O_NOFOLLOW, single link, before/after stat stability).
+  const anchored = sourceEntries.some((entry) => entry.type === 'file' && entry.path === marketplaceRelative);
+  if (!anchored) {
+    throw new Error(`frozen snapshot is missing the marketplace manifest ${marketplaceRelative}`);
+  }
+  const result = await validateManifestFile(resolve(snapshotDir, marketplaceRelative), ['name', 'plugins']);
+  if (!result.valid) {
+    throw new Error(`frozen snapshot ${marketplaceRelative} invalid: ${result.error}`);
+  }
+  if (result.manifest.name !== action.marketplace) {
+    throw new Error(`marketplace manifest name "${result.manifest.name}" does not match action marketplace "${action.marketplace}"`);
+  }
+  const plugins = result.manifest.plugins;
+  if (!Array.isArray(plugins)) {
+    throw new Error(`${marketplaceRelative} must have a plugins[] array`);
+  }
+  const matches = plugins.filter((entry) => entry.name === action.plugin);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one plugins[] entry with name "${action.plugin}", found ${matches.length}`);
+  }
+  return extractDeclaredPluginSource(consumer, matches[0]);
+}
+
 async function verifyInstalledMarketplacePayload(action, context, installPath, consumer) {
   const sourcePath = await resolveFrozenPath(
     context.root,
@@ -58,11 +145,34 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
   if (sourceSnapshot.digest !== action.manifestDigest) {
     throw new Error('frozen marketplace snapshot digest no longer matches the plan');
   }
+  // Consumer marketplaces install only the plugin entry's declared source
+  // subtree (e.g. "./adapters/claude"), not the whole unit snapshot. The
+  // sealed whole-snapshot digest above remains the authority; bind the
+  // installed payload to that snapshot's declared subtree. Root layouts
+  // and kimi keep the whole-tree comparison ("." subpath, no filtering).
+  const payloadSubpath = await resolveInstalledPayloadSubpath(
+    sourcePath,
+    sourceSnapshot.entries,
+    action,
+    consumer,
+  );
+  const prefix = payloadSubpath === '.' ? null : `${payloadSubpath}/`;
+  const authorityEntries = prefix === null
+    ? sourceSnapshot.entries
+    : sourceSnapshot.entries
+        // The trailing slash keeps sibling directories (e.g.
+        // "adapters/claude-x") out of the comparison set. Prefix removal on
+        // a path-sorted array is order-preserving, so no re-sort is needed.
+        .filter((entry) => entry.path.startsWith(prefix))
+        .map((entry) => ({ ...entry, path: entry.path.slice(prefix.length) }));
+  if (authorityEntries.length === 0) {
+    throw new Error('frozen snapshot contains no payload under the declared marketplace source');
+  }
   const installedSnapshot = await computeFrozenSnapshot(installPath, {
-    excludeRootEntries: consumer === 'codex' || consumer === 'kimi' ? ['.git'] : [],
+    excludeRootEntries: consumerTransportExclusions(consumer),
   });
   if (
-    JSON.stringify(transportPayload(sourceSnapshot.entries))
+    JSON.stringify(transportPayload(authorityEntries))
     !== JSON.stringify(transportPayload(installedSnapshot.entries))
   ) {
     throw new Error('installed marketplace payload differs in path, bytes, size, or non-write mode bits');
@@ -1139,27 +1249,17 @@ export function createPluginMarketplaceAdapter(deps = {}) {
           // Entry source must be a safe relative path within the snapshot.
           // Accepts "./" (root-level), "./adapters/claude" (subdirectory),
           // etc. Rejects absolute paths, ".." traversal, remote URLs, and
-          // empty strings.
-          const sourcePath = consumer === 'claude'
-            ? entry.source
-            : entry.source?.source === 'local' ? entry.source?.path : null;
-          if (typeof sourcePath !== 'string' || sourcePath.length === 0) {
-            return createResult({
-              actionType,
-              status: ActionStatus.PREFLIGHT_FAILED,
-              error: `marketplace plugin entry source must be a non-empty relative path${consumer === 'codex' ? ' (object with source:"local")' : ''}, got ${JSON.stringify(entry.source)}`,
-            });
-          }
-          if (
-            sourcePath.startsWith('/') ||
-            sourcePath.includes('..') ||
-            sourcePath.includes('\\') ||
-            /^https?:\/\//i.test(sourcePath)
-          ) {
+          // empty strings. Normalized to "." for root layouts; the same
+          // helper backs verify-side payload subtree resolution, so both
+          // paths can never drift apart.
+          let sourcePath;
+          try {
+            sourcePath = extractDeclaredPluginSource(consumer, entry);
+          } catch (sourceErr) {
             return createResult({
               actionType,
               status: ActionStatus.PREFLIGHT_FAILED,
-              error: `marketplace plugin entry source "${sourcePath}" is not a safe relative path`,
+              error: sourceErr.message,
             });
           }
           // Verify the declared source directory exists and contains the
@@ -2290,7 +2390,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             // is returned and verify therefore fails closed.
             try {
               const installedSnapshot = await computeFrozenSnapshot(installPath, {
-                excludeRootEntries: consumer === 'codex' || consumer === 'kimi' ? ['.git'] : [],
+                excludeRootEntries: consumerTransportExclusions(consumer),
               });
               manifestDigest = installedSnapshot.digest;
             } catch {

package/src/snapshot/frozen.mjs

@@ -82,9 +82,10 @@ async function readStableRegularFile(filePath, displayPath) {
  * Compute the canonical snapshot digest.
  *
  * `excludeRootEntries` is reserved for consumer-owned transport metadata
- * that is not part of the published payload (currently Codex's root `.git`
- * checkout metadata). Exclusions only apply to direct children of the root;
- * all payload paths retain the normal fail-closed file checks.
+ * that is not part of the published payload: Codex's root `.git` checkout
+ * metadata and Claude's root `.in_use` in-use plugin marker. Exclusions
+ * only apply to direct children of the root; all payload paths retain the
+ * normal fail-closed file checks.
  */
 export async function computeFrozenSnapshot(snapshotDir, { excludeRootEntries = [] } = {}) {
   const root = await realpath(snapshotDir);