release-skill 0.2.3 → 0.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/schemas/release-plan.schema.json

@@ -420,6 +420,95 @@
                 },
                 "smokeExpectedJson": {
                   "type": "object"
+                },
+                "installationContract": {
+                  "type": "object",
+                  "description": "可审计的安装契约规范对象",
+                  "additionalProperties": false,
+                  "properties": {
+                    "algorithmVersion": {
+                      "type": "integer",
+                      "minimum": 1
+                    },
+                    "distributionType": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "manifestRelativePath": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "normalizedManifest": {
+                      "type": "object"
+                    },
+                    "marketplaceSourceType": {
+                      "type": "string",
+                      "enum": [
+                        "bundled-family",
+                        "standalone-index"
+                      ]
+                    },
+                    "includeMarketplaceEntry": {
+                      "type": "boolean"
+                    },
+                    "marketplaceIndexRelativePath": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "normalizedSelectedEntry": {
+                      "type": "object"
+                    },
+                    "verificationRecipeVersion": {
+                      "type": "string",
+                      "minLength": 1
+                    }
+                  },
+                  "required": [
+                    "algorithmVersion",
+                    "distributionType",
+                    "manifestRelativePath",
+                    "normalizedManifest",
+                    "marketplaceSourceType",
+                    "includeMarketplaceEntry",
+                    "verificationRecipeVersion"
+                  ]
+                },
+                "installationContractDigest": {
+                  "type": "string",
+                  "pattern": "^[a-f0-9]{64}$",
+                  "description": "安装契约摘要，用于在远端状态未变化时跳过重复验证"
+                },
+                "marketplaceSourceType": {
+                  "type": "string",
+                  "enum": [
+                    "bundled-family",
+                    "standalone-index"
+                  ],
+                  "description": "市场来源类型：bundled-family（技能族自带市场文件）或 standalone-index（独立市场仓库）；每个平台每次发布只冻结一种来源"
+                },
+                "marketplaceCommitSha": {
+                  "type": "string",
+                  "pattern": "^[0-9a-f]{40}$",
+                  "description": "独立市场仓库冻结提交 SHA（standalone-index 专用）"
+                },
+                "marketplaceRef": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "独立市场仓库冻结引用（standalone-index 专用）"
+                },
+                "marketplaceIndexPath": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "独立市场索引相对路径（standalone-index 专用）"
+                },
+                "marketplaceName": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "独立市场名称（standalone-index 专用）"
+                },
+                "selectedEntry": {
+                  "type": "object",
+                  "description": "冻结的唯一选中市场条目（standalone-index 专用）"
                 }
               },
               "allOf": [
@@ -493,12 +582,35 @@
                     "properties": {
                       "type": {
                         "enum": [
+                          "claude-plugin",
+                          "codex-plugin",
                           "kimi-plugin",
                           "codebuddy-plugin"
                         ]
                       }
                     }
                   },
+                  "then": {}
+                },
+                {
+                  "if": {
+                    "properties": {
+                      "type": {
+                        "enum": [
+                          "claude-plugin",
+                          "codex-plugin",
+                          "kimi-plugin",
+                          "codebuddy-plugin"
+                        ]
+                      },
+                      "marketplaceSourceType": {
+                        "const": "bundled-family"
+                      }
+                    },
+                    "required": [
+                      "marketplaceSourceType"
+                    ]
+                  },
                   "then": {
                     "not": {
                       "required": [
@@ -507,6 +619,31 @@
                     }
                   }
                 },
+                {
+                  "if": {
+                    "properties": {
+                      "type": {
+                        "enum": [
+                          "claude-plugin",
+                          "codex-plugin",
+                          "kimi-plugin",
+                          "codebuddy-plugin"
+                        ]
+                      },
+                      "marketplaceSourceType": {
+                        "const": "standalone-index"
+                      }
+                    },
+                    "required": [
+                      "marketplaceSourceType"
+                    ]
+                  },
+                  "then": {
+                    "required": [
+                      "marketplaceRepo"
+                    ]
+                  }
+                },
                 {
                   "if": {
                     "required": [
@@ -678,6 +815,97 @@
       "minLength": 1,
       "description": "Digest of the project configuration at plan freeze time"
     },
+    "skillResourceClosure": {
+      "type": "object",
+      "description": "Skill resource closure gate receipts from prepare phase (per-unit bound)",
+      "additionalProperties": false,
+      "properties": {
+        "unitReceipts": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "unitId": {
+                "type": "string",
+                "minLength": 1
+              },
+              "checkerVersion": {
+                "type": "string",
+                "minLength": 1
+              },
+              "inputDigest": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "surfaceCount": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "skillCount": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "referenceCount": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "sourceOnlyCount": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "findingCount": {
+                "const": 0
+              },
+              "receiptDigest": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              }
+            },
+            "required": [
+              "unitId",
+              "checkerVersion",
+              "inputDigest",
+              "surfaceCount",
+              "skillCount",
+              "referenceCount",
+              "sourceOnlyCount",
+              "findingCount",
+              "receiptDigest"
+            ]
+          }
+        },
+        "checkerVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "totalSkillCount": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "totalReferenceCount": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "totalSourceOnlyCount": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "totalFindingCount": {
+          "type": "integer",
+          "minimum": 0
+        }
+      },
+      "required": [
+        "unitReceipts",
+        "checkerVersion",
+        "totalSkillCount",
+        "totalReferenceCount",
+        "totalSourceOnlyCount",
+        "totalFindingCount"
+      ]
+    },
     "verificationGates": {
       "type": "array",
       "items": {

package/schemas/release-project.schema.json

@@ -213,6 +213,20 @@
                   "minimum": 30000,
                   "maximum": 900000,
                   "description": "Timeout in milliseconds for plugin marketplace install commands (claude-plugin, codex-plugin). Kimi Code has no scriptable install command, so for kimi-plugin this bounds the read-only observation/verification only, not an install command. CodeBuddy/WorkBuddy has no scriptable install command that can pin a frozen ref, so for codebuddy-plugin this likewise bounds the read-only observation/verification only. Only valid for claude-plugin, codex-plugin, kimi-plugin, and codebuddy-plugin distributions."
+                },
+                "marketplaceSourceType": {
+                  "type": "string",
+                  "enum": [
+                    "bundled-family",
+                    "standalone-index"
+                  ],
+                  "description": "市场来源类型：bundled-family（技能族自带市场文件）或 standalone-index（独立市场仓库）；每个平台每次发布只冻结一种来源"
+                },
+                "marketplaceIndexPath": {
+                  "type": "string",
+                  "minLength": 1,
+                  "pattern": "^(?!/)(?!\\.\\/)(?!.*\\\\)(?!.*:)(?!\\.\\.(/|$))(?!\\.$)(?!.*\\/\\.\\.\\/)(?!.*\\/\\.\\.$)(?!.*\\/\\.\\/)(?!.*\\/\\/)(?!.*\\0)(?!.*\\/\\.$)(?!.*\\/$).*$",
+                  "description": "Bundled marketplace index relative path override；仅插件 distribution 允许"
                 }
               },
               "allOf": [
@@ -305,12 +319,39 @@
                     "properties": {
                       "type": {
                         "enum": [
+                          "claude-plugin",
+                          "codex-plugin",
                           "kimi-plugin",
                           "codebuddy-plugin"
                         ]
                       }
                     }
                   },
+                  "then": {
+                    "required": [
+                      "marketplaceSourceType"
+                    ]
+                  }
+                },
+                {
+                  "if": {
+                    "properties": {
+                      "type": {
+                        "enum": [
+                          "claude-plugin",
+                          "codex-plugin",
+                          "kimi-plugin",
+                          "codebuddy-plugin"
+                        ]
+                      },
+                      "marketplaceSourceType": {
+                        "const": "bundled-family"
+                      }
+                    },
+                    "required": [
+                      "marketplaceSourceType"
+                    ]
+                  },
                   "then": {
                     "not": {
                       "required": [
@@ -319,6 +360,58 @@
                     }
                   }
                 },
+                {
+                  "if": {
+                    "properties": {
+                      "type": {
+                        "enum": [
+                          "claude-plugin",
+                          "codex-plugin",
+                          "kimi-plugin",
+                          "codebuddy-plugin"
+                        ]
+                      },
+                      "marketplaceSourceType": {
+                        "const": "bundled-family"
+                      }
+                    },
+                    "required": [
+                      "marketplaceSourceType"
+                    ]
+                  },
+                  "then": {
+                    "not": {
+                      "required": [
+                        "marketplaceRepo"
+                      ]
+                    }
+                  }
+                },
+                {
+                  "if": {
+                    "properties": {
+                      "type": {
+                        "enum": [
+                          "claude-plugin",
+                          "codex-plugin",
+                          "kimi-plugin",
+                          "codebuddy-plugin"
+                        ]
+                      },
+                      "marketplaceSourceType": {
+                        "const": "standalone-index"
+                      }
+                    },
+                    "required": [
+                      "marketplaceSourceType"
+                    ]
+                  },
+                  "then": {
+                    "required": [
+                      "marketplaceRepo"
+                    ]
+                  }
+                },
                 {
                   "if": {
                     "required": [

package/schemas/release-run.schema.json

@@ -139,9 +139,13 @@
               "failed",
               "skipped",
               "pending",
-              "uncertain"
+              "uncertain",
+              "deferred",
+              "PASSED_AUTOMATIC",
+              "PASSED_MANUAL",
+              "NOT_REQUIRED_UNCHANGED"
             ],
-            "description": "Result status of this checkpoint (uncertain = started, result unknown)"
+            "description": "Result status of this checkpoint (uncertain = started, result unknown; deferred = marketplace action postponed to verify phase; PASSED_AUTOMATIC/PASSED_MANUAL/NOT_REQUIRED_UNCHANGED 为验证阶段专用状态)"
           },
           "preObserve": {
             "type": "string",
@@ -211,6 +215,70 @@
                 "type": "string"
               }
             }
+          },
+          "reason": {
+            "type": "string",
+            "description": "Stable reason code for deferred checkpoints (e.g. CONSUMER_VERIFICATION_DEFERRED)"
+          },
+          "phase": {
+            "type": "string",
+            "description": "Phase identifier for deferred checkpoints (e.g. post-publish-verification)"
+          }
+        }
+      }
+    },
+    "consumerVerificationReceipts": {
+      "type": "array",
+      "description": "消费端验证收据，每个 marketplace action 一条记录",
+      "items": {
+        "type": "object",
+        "required": [
+          "actionId",
+          "unitId",
+          "platform",
+          "result",
+          "installationContractDigest",
+          "algorithmVersion",
+          "planDigest",
+          "verifiedAt"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "actionId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "unitId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "platform": {
+            "type": "string",
+            "minLength": 1
+          },
+          "result": {
+            "type": "string",
+            "enum": [
+              "PASSED_AUTOMATIC",
+              "PASSED_MANUAL",
+              "NOT_REQUIRED_UNCHANGED"
+            ]
+          },
+          "installationContractDigest": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "algorithmVersion": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "planDigest": {
+            "type": "string",
+            "minLength": 1
+          },
+          "verifiedAt": {
+            "type": "string",
+            "format": "date-time"
           }
         }
       }
@@ -298,6 +366,91 @@
           }
         }
       }
+    },
+    "skillResourceClosureReceipts": {
+      "type": "array",
+      "description": "Per-surface skill resource closure verification receipts from verify phase",
+      "items": {
+        "type": "object",
+        "required": [
+          "host",
+          "distribution",
+          "unitId",
+          "checkerVersion",
+          "inputDigest",
+          "surfaceCount",
+          "skillCount",
+          "referenceCount",
+          "sourceOnlyCount",
+          "findingCount",
+          "receiptDigest",
+          "checkedAt",
+          "exitCode"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "host": {
+            "type": "string",
+            "minLength": 1
+          },
+          "unitId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "distribution": {
+            "type": "string",
+            "enum": [
+              "npm",
+              "claude-plugin",
+              "codex-plugin",
+              "kimi-plugin",
+              "codebuddy-plugin"
+            ]
+          },
+          "actionId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "checkerVersion": {
+            "type": "string",
+            "minLength": 1
+          },
+          "inputDigest": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "surfaceCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "skillCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "referenceCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "sourceOnlyCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "findingCount": {
+            "const": 0
+          },
+          "receiptDigest": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "checkedAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "exitCode": {
+            "const": 0
+          }
+        }
+      }
     }
   },
   "allOf": [

package/scripts/sync-public-files.mjs

@@ -208,9 +208,9 @@ function buildRequiredPublicFilesYaml(entries, indent = 6) {
 // Entry collection
 // ---------------------------------------------------------------------------
 
-async function collectEntries() {
+async function collectEntries(packageRoot) {
   // 1. Scan all files in the package directory
-  const allFiles = await scanFiles(PKG_ROOT);
+  const allFiles = await scanFiles(packageRoot);
   const allSet = new Set(allFiles);
 
   // 2. Build the adapter exclusion set (all files under adapters/)
@@ -303,8 +303,8 @@ async function collectEntries() {
 // Check / write
 // ---------------------------------------------------------------------------
 
-async function readProjectYaml() {
-  return await readFile(PROJECT_YAML, 'utf8');
+async function readProjectYaml(projectPath) {
+  return await readFile(projectPath, 'utf8');
 }
 
 function extractExistingEntries(yamlText, key) {
@@ -369,18 +369,29 @@ function replaceArrayInYaml(yamlText, key, newContent) {
  *
  * @param {object} options
  * @param {string} options.packageDir - Package directory.
+ * @param {string} [options.projectPath] - Project config path. Defaults to the
+ * real workspace config; tests may provide an isolated copy.
  * @param {boolean} [options.check] - Read-only drift detection.
  * @returns {Promise<{mode: string, clean?: boolean, diff?: object}>}
  */
-export async function syncPublicFiles({ packageDir, check = false } = {}) {
+export async function syncPublicFiles({
+  packageDir,
+  projectPath = PROJECT_YAML,
+  check = false,
+} = {}) {
   if (typeof packageDir !== 'string' || packageDir.length === 0) {
     const err = new Error('sync-public-files: packageDir is required');
     err.code = 'SYNC_PUBLIC_FILES_INVALID_ARGUMENT';
     throw err;
   }
+  if (typeof projectPath !== 'string' || projectPath.length === 0) {
+    const err = new Error('sync-public-files: projectPath must be a non-empty string');
+    err.code = 'SYNC_PUBLIC_FILES_INVALID_ARGUMENT';
+    throw err;
+  }
 
-  const entries = await collectEntries();
-  const yamlText = await readProjectYaml();
+  const entries = await collectEntries(packageDir);
+  const yamlText = await readProjectYaml(projectPath);
 
   const existingPublic = extractExistingEntries(yamlText, 'publicFiles');
   const existingRequired = extractExistingEntries(yamlText, 'requiredPublicFiles');
@@ -422,10 +433,10 @@ export async function syncPublicFiles({ packageDir, check = false } = {}) {
   let newYaml = replaceArrayInYaml(yamlText, 'publicFiles', publicYaml);
   newYaml = replaceArrayInYaml(newYaml, 'requiredPublicFiles', requiredYaml);
 
-  await writeFile(PROJECT_YAML, newYaml, 'utf8');
+  await writeFile(projectPath, newYaml, 'utf8');
 
   // Verify write
-  const reread = await readFile(PROJECT_YAML, 'utf8');
+  const reread = await readFile(projectPath, 'utf8');
   if (reread !== newYaml) {
     const err = new Error('sync-public-files: post-write verification failed');
     err.code = 'SYNC_PUBLIC_FILES_WRITE_VERIFY_FAILED';