release-skill 0.2.4 → 0.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/references/.render-manifest.json

@@ -10,8 +10,8 @@
       "bytes": 8840
     },
     "02-project-config.md": {
-      "digest": "1e3c10fb4598aa6406b9d7cb4fdab2f663c3dad017dce88098b9e79868796806",
-      "bytes": 16514
+      "digest": "0cff13ebb270f3515290e0ce60b91303143777d1a4948db28cf2c69612ceff8e",
+      "bytes": 19029
     },
     "03-readme-quality.md": {
       "digest": "d74e41052592443ebbd450d0ace5f9b9b19c7a94db50f952b17c1c5a4c5dc230",
@@ -22,8 +22,8 @@
       "bytes": 4682
     },
     "05-evidence-and-errors.md": {
-      "digest": "00039b9bd3724f40ec084b366103f1b84a2b599c5e884f23904d337f4c193661",
-      "bytes": 8484
+      "digest": "ebcb4940ff2a25ce6945c3b11cfcafe751f4a1f515276b7e021717ea5844eebf",
+      "bytes": 9688
     },
     "06-adapter-contract.md": {
       "digest": "39f0271bc06eae38dade518ece8f7e16a18f53099a433e3ae07e9d20ff7a142e",

package/references/02-project-config.md

@@ -23,8 +23,9 @@ apiVersion: release-skill/v1
 kind: ReleaseProject
 
 project:
-  name: <string>            # 项目标识，必填
-  defaultBranch: <string>   # 默认分支，必填
+  name: <string>                 # 项目标识，必填
+  defaultBranch: <string>        # workspace 远端默认分支，必填；不限定为 main
+  sourceRepository: <owner/repo> # workspace 源仓库；生产发布必填
 
 releaseUnits:               # 发布单元数组，至少 1 个
   - id: <string>            # 唯一标识
@@ -125,6 +126,31 @@ human-owned 权威源，然后重新 prepare、审阅并 approve；后续环节
 
 旧的 `policy.requiredPublicFiles` 已不支持。加载器必须返回 `CONFIG_INVALID`，并引导迁移到各自的 `releaseUnits[].requiredPublicFiles`。
 
+### 3.1.1 Workspace 源码权威内容闭包
+
+`project.sourceRepository` 标识承载当前 workspace 人工源文件的 GitHub
+`owner/repo`，它与各发布单元的 `publicRepo` 不是同一概念；多个发布单元可以投影到不同
+公开仓库，但它们仍可共享一个 workspace 源仓库。`project.defaultBranch` 表示该源仓库的
+真实远端默认分支，可以是 `main`、`master`、`develop`、`trunk` 或其他明确名称。
+setup 只在 workspace Git remotes 唯一一致时提出候选；缺失或冲突时要求人工裁决，不保存
+`auto`。
+
+生产 prepare 在 hooks 完成后，从所有 `publicFiles.from`（目录递归展开）和每个 unit 的
+`version.source` 计算源码输入闭包，冻结 workspace 相对路径、内容 SHA-256 和 Git mode。
+只有闭包内 staged、unstaged 或 untracked 的文件会阻断 prepare；无关 dirty 文件不阻断。
+离线 prepare 明确记录 `unobserved-offline`，远端内容的强制比较留在 publish。
+
+production publish 在任何 adapter `execute` 前，从
+`sourceRepository/defaultBranch` 读取冻结路径集合，先确认配置分支仍是远端实际默认分支，
+再比较内容和 mode。判定只依赖内容闭包，不依赖 commit ancestry，因此普通 merge、
+squash、rebase 和默认分支上的无关后续提交可以通过；冲突解决或 revert 丢失 README、
+版本源或其他公开输入会按具体路径失败关闭。系统不会自动 merge、rebase、切分支、push
+或创建 PR。
+
+通过后，publish 写入与 plan digest 绑定的源码权威收据；PARTIAL 经 reconcile 恢复时继承
+并重新校验该收据。verify 只消费这份冻结收据，不在发布完成后用可变默认分支重新判定历史
+发布。
+
 ### 3.2 公开分支策略
 
 - `create-release-branch`：目标分支必须不存在；创建独立 release 分支，冻结提交没有父提交。

package/references/05-evidence-and-errors.md

@@ -26,6 +26,12 @@
 | `RELEASE_DOCS_CONFLICT` | 目标文档存在人工冲突 | 非受管同版本 CHANGELOG 条目、受管标记缺失/重复/损坏、版本标记非唯一 | 人工修复目标并保留人工修改后重新演练 |
 | `RELEASE_DOCS_REFRESH_STALE` | 写入确认绑定的候选已变化 | 演练后说明源或目标发生变化，仍用旧 `refreshDigest` 写入 | 重新演练取得新的 `refreshDigest` 并重新确认 |
 | `RELEASE_DOCS_STALE` | prepare 检测到发布文档未刷新 | 说明源已更新但 README/CHANGELOG 受管内容未同步 | `docs refresh` 演练 → 确认写入 → 审阅提交 → 重新 prepare |
+| `CONFIG_MISSING` | 生产源码权威配置缺失 | 缺少明确的 `project.sourceRepository` 或 `project.defaultBranch` | 补充经人工确认的 workspace 源仓库与默认分支后重新 prepare |
+| `REMOTE_UNAVAILABLE` | 无法可靠读取 workspace 源仓库 | 网络、认证或远端协议错误导致默认分支内容不可观察 | 修复网络或认证后基于同一冻结计划重试；不得猜测成功 |
+| `REF_MISSING` | 配置的远端默认分支不存在 | `refs/heads/<defaultBranch>` 不存在 | 核对真实分支名并重新 prepare |
+| `NOT_DEFAULT` | 配置分支不是远端实际默认分支 | 默认分支在 prepare 后改变，或配置错误 | 人工确认远端默认分支，更新配置并重新 prepare |
+| `CONTENT_MISMATCH` | 远端默认分支缺少冻结源码内容 | README、版本源、公开映射输入的内容或 mode 不一致 | 人工 merge/adopt/reject；接受的内容进入默认分支后重试 publish |
+| `DIRTY_SOURCE_INPUT` | 源码输入闭包存在未提交变化 | `publicFiles.from` 或 `version.source` 有 staged、unstaged、untracked 变化 | 提交或撤销这些具体输入的变化后重新 prepare；无关 dirty 不受影响 |
 
 ---
 

package/schemas/.render-manifest.json

@@ -22,16 +22,16 @@
       "bytes": 2390
     },
     "release-plan.schema.json": {
-      "digest": "d7869cdb335618754eb787fe352c4c1775c799900f3bb926197c51359699a648",
-      "bytes": 24088
+      "digest": "01c96659223918b5ce0e2d0d01d1ce5095baeb056de401babb8928add4d2a221",
+      "bytes": 35256
     },
     "release-project.schema.json": {
-      "digest": "53efe202fc5e2bf63c8d846cf4d50648991163b270536c1450c4be44e45d4b93",
-      "bytes": 25761
+      "digest": "a3d46be1e1e8105103a505c6d58d14f3733c8da91ab8289e097ffd259bf1cd93",
+      "bytes": 30982
     },
     "release-run.schema.json": {
-      "digest": "f453845fd2aab02c7b0812b1f62fd1ab7fa37104b8e752914906551c0e8c2637",
-      "bytes": 8959
+      "digest": "bf3c8fb4ca2fc078272a45a6ee6bf663fd2420a722b2f995dbaabf2635e2179e",
+      "bytes": 14824
     }
   }
 }

package/schemas/release-plan.schema.json

@@ -815,6 +815,97 @@
       "minLength": 1,
       "description": "Digest of the project configuration at plan freeze time"
     },
+    "skillResourceClosure": {
+      "type": "object",
+      "description": "Skill resource closure gate receipts from prepare phase (per-unit bound)",
+      "additionalProperties": false,
+      "properties": {
+        "unitReceipts": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "unitId": {
+                "type": "string",
+                "minLength": 1
+              },
+              "checkerVersion": {
+                "type": "string",
+                "minLength": 1
+              },
+              "inputDigest": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "surfaceCount": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "skillCount": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "referenceCount": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "sourceOnlyCount": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "findingCount": {
+                "const": 0
+              },
+              "receiptDigest": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              }
+            },
+            "required": [
+              "unitId",
+              "checkerVersion",
+              "inputDigest",
+              "surfaceCount",
+              "skillCount",
+              "referenceCount",
+              "sourceOnlyCount",
+              "findingCount",
+              "receiptDigest"
+            ]
+          }
+        },
+        "checkerVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "totalSkillCount": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "totalReferenceCount": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "totalSourceOnlyCount": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "totalFindingCount": {
+          "type": "integer",
+          "minimum": 0
+        }
+      },
+      "required": [
+        "unitReceipts",
+        "checkerVersion",
+        "totalSkillCount",
+        "totalReferenceCount",
+        "totalSourceOnlyCount",
+        "totalFindingCount"
+      ]
+    },
     "verificationGates": {
       "type": "array",
       "items": {
@@ -901,6 +992,73 @@
       "type": "string",
       "minLength": 1
     },
+    "sourceAuthority": {
+      "type": "object",
+      "description": "Source authority content closure gate binding: proves frozen source inputs exist in the workspace remote default branch",
+      "required": [
+        "sourceRepository",
+        "defaultBranch",
+        "entries",
+        "inputDigest",
+        "algorithmVersion"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "sourceRepository": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$",
+          "description": "GitHub owner/repo of the workspace source repository"
+        },
+        "defaultBranch": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Workspace remote default branch name"
+        },
+        "entries": {
+          "type": "array",
+          "minItems": 1,
+          "description": "Frozen workspace-relative source inputs compared with the remote default branch",
+          "items": {
+            "type": "object",
+            "required": [
+              "path",
+              "digest",
+              "mode"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "path": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$"
+              },
+              "digest": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$"
+              },
+              "mode": {
+                "type": "string",
+                "enum": [
+                  "100644",
+                  "100755"
+                ]
+              }
+            }
+          }
+        },
+        "inputDigest": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$",
+          "description": "SHA-256 digest of the deterministic source-input closure"
+        },
+        "algorithmVersion": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Source-input closure algorithm version"
+        }
+      }
+    },
     "waivers": {
       "type": "array",
       "items": {

package/schemas/release-project.schema.json

@@ -35,6 +35,12 @@
         "defaultBranch": {
           "type": "string",
           "minLength": 1
+        },
+        "sourceRepository": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$",
+          "description": "GitHub owner/repo of the workspace source repository for source authority content gate"
         }
       }
     },

package/schemas/release-run.schema.json

@@ -227,6 +227,71 @@
         }
       }
     },
+    "sourceAuthorityReceipts": {
+      "type": "array",
+      "description": "Source authority content closure receipts: one per publish run proving remote content matches frozen inputs",
+      "items": {
+        "type": "object",
+        "required": [
+          "sourceRepository",
+          "defaultBranch",
+          "inputDigest",
+          "algorithmVersion",
+          "entryCount",
+          "planDigest",
+          "verifiedAt",
+          "result"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "sourceRepository": {
+            "type": "string",
+            "minLength": 1
+          },
+          "defaultBranch": {
+            "type": "string",
+            "minLength": 1
+          },
+          "inputDigest": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "algorithmVersion": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "entryCount": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "planDigest": {
+            "type": "string",
+            "minLength": 1
+          },
+          "verifiedAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "result": {
+            "type": "string",
+            "enum": [
+              "CONSISTENT",
+              "MISMATCH"
+            ]
+          },
+          "observedCommit": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{40,64}$"
+          },
+          "mismatchedPaths": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    },
     "consumerVerificationReceipts": {
       "type": "array",
       "description": "消费端验证收据，每个 marketplace action 一条记录",
@@ -366,6 +431,91 @@
           }
         }
       }
+    },
+    "skillResourceClosureReceipts": {
+      "type": "array",
+      "description": "Per-surface skill resource closure verification receipts from verify phase",
+      "items": {
+        "type": "object",
+        "required": [
+          "host",
+          "distribution",
+          "unitId",
+          "checkerVersion",
+          "inputDigest",
+          "surfaceCount",
+          "skillCount",
+          "referenceCount",
+          "sourceOnlyCount",
+          "findingCount",
+          "receiptDigest",
+          "checkedAt",
+          "exitCode"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "host": {
+            "type": "string",
+            "minLength": 1
+          },
+          "unitId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "distribution": {
+            "type": "string",
+            "enum": [
+              "npm",
+              "claude-plugin",
+              "codex-plugin",
+              "kimi-plugin",
+              "codebuddy-plugin"
+            ]
+          },
+          "actionId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "checkerVersion": {
+            "type": "string",
+            "minLength": 1
+          },
+          "inputDigest": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "surfaceCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "skillCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "referenceCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "sourceOnlyCount": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "findingCount": {
+            "const": 0
+          },
+          "receiptDigest": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "checkedAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "exitCode": {
+            "const": 0
+          }
+        }
+      }
     }
   },
   "allOf": [

package/scripts/sync-public-files.mjs

@@ -208,9 +208,9 @@ function buildRequiredPublicFilesYaml(entries, indent = 6) {
 // Entry collection
 // ---------------------------------------------------------------------------
 
-async function collectEntries() {
+async function collectEntries(packageRoot) {
   // 1. Scan all files in the package directory
-  const allFiles = await scanFiles(PKG_ROOT);
+  const allFiles = await scanFiles(packageRoot);
   const allSet = new Set(allFiles);
 
   // 2. Build the adapter exclusion set (all files under adapters/)
@@ -303,8 +303,8 @@ async function collectEntries() {
 // Check / write
 // ---------------------------------------------------------------------------
 
-async function readProjectYaml() {
-  return await readFile(PROJECT_YAML, 'utf8');
+async function readProjectYaml(projectPath) {
+  return await readFile(projectPath, 'utf8');
 }
 
 function extractExistingEntries(yamlText, key) {
@@ -369,18 +369,29 @@ function replaceArrayInYaml(yamlText, key, newContent) {
  *
  * @param {object} options
  * @param {string} options.packageDir - Package directory.
+ * @param {string} [options.projectPath] - Project config path. Defaults to the
+ * real workspace config; tests may provide an isolated copy.
  * @param {boolean} [options.check] - Read-only drift detection.
  * @returns {Promise<{mode: string, clean?: boolean, diff?: object}>}
  */
-export async function syncPublicFiles({ packageDir, check = false } = {}) {
+export async function syncPublicFiles({
+  packageDir,
+  projectPath = PROJECT_YAML,
+  check = false,
+} = {}) {
   if (typeof packageDir !== 'string' || packageDir.length === 0) {
     const err = new Error('sync-public-files: packageDir is required');
     err.code = 'SYNC_PUBLIC_FILES_INVALID_ARGUMENT';
     throw err;
   }
+  if (typeof projectPath !== 'string' || projectPath.length === 0) {
+    const err = new Error('sync-public-files: projectPath must be a non-empty string');
+    err.code = 'SYNC_PUBLIC_FILES_INVALID_ARGUMENT';
+    throw err;
+  }
 
-  const entries = await collectEntries();
-  const yamlText = await readProjectYaml();
+  const entries = await collectEntries(packageDir);
+  const yamlText = await readProjectYaml(projectPath);
 
   const existingPublic = extractExistingEntries(yamlText, 'publicFiles');
   const existingRequired = extractExistingEntries(yamlText, 'requiredPublicFiles');
@@ -422,10 +433,10 @@ export async function syncPublicFiles({ packageDir, check = false } = {}) {
   let newYaml = replaceArrayInYaml(yamlText, 'publicFiles', publicYaml);
   newYaml = replaceArrayInYaml(newYaml, 'requiredPublicFiles', requiredYaml);
 
-  await writeFile(PROJECT_YAML, newYaml, 'utf8');
+  await writeFile(projectPath, newYaml, 'utf8');
 
   // Verify write
-  const reread = await readFile(PROJECT_YAML, 'utf8');
+  const reread = await readFile(projectPath, 'utf8');
   if (reread !== newYaml) {
     const err = new Error('sync-public-files: post-write verification failed');
     err.code = 'SYNC_PUBLIC_FILES_WRITE_VERIFY_FAILED';

package/src/adapters/plugin-marketplace.mjs

@@ -2882,6 +2882,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
 
             // 使用归一化后的 attestation（兼容旧格式）
             const normalizedAttestation = attestationCheck.normalized;
+            const requiresInstalledClosure = Boolean(context.plan?.skillResourceClosure);
 
             // 统一人工判定：如果结果是 failed，直接返回失败
             if (normalizedAttestation.result === 'failed') {
@@ -2901,7 +2902,19 @@ export function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
 
+            if (requiresInstalledClosure && !normalizedAttestation.installPath) {
+              return createResult({
+                actionType,
+                status: ActionStatus.OBSERVED,
+                observation: {
+                  installed: false,
+                  error: 'kimi attestation installPath is required by the skill resource closure gate',
+                },
+              });
+            }
+
             // installPath 验证：必须在 managed root 内，不得逃逸，不得是符号链接
+            let verifiedInstallPath = null;
             if (normalizedAttestation.installPath) {
               const managedRoot = resolve(attestationDir, 'kimi-home', 'plugins', 'managed');
               const installPathAbs = resolve(normalizedAttestation.installPath);
@@ -2967,18 +2980,19 @@ export function createPluginMarketplaceAdapter(deps = {}) {
                   },
                 });
               }
+              verifiedInstallPath = installPathReal;
             }
 
             // 载荷绑定验证：旧格式含 installPath 时必须绑定冻结载荷并失败关闭。
             // 身份、版本、载荷、市场来源不一致绝不能被人工 passed 覆盖。
             let manifestDigest = action.manifestDigest;
             let payloadBinding = null;
-            if (normalizedAttestation.installPath) {
+            if (verifiedInstallPath) {
               try {
                 payloadBinding = await verifyInstalledMarketplacePayload(
                   action,
                   context,
-                  normalizedAttestation.installPath,
+                  verifiedInstallPath,
                   consumer,
                 );
                 manifestDigest = payloadBinding.manifestDigest;
@@ -3019,6 +3033,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
                 entrySkillFound: true,
                 manifestDigest,
                 planDigest: boundPlanDigest,
+                ...(verifiedInstallPath ? { installPath: verifiedInstallPath } : {}),
                 ...extraInstalledPathsAudit(payloadBinding),
               },
             });
@@ -3129,6 +3144,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
 
             // 使用归一化后的 attestation（兼容旧格式）
             const normalizedAttestation = attestationCheck.normalized;
+            const requiresInstalledClosure = Boolean(context.plan?.skillResourceClosure);
 
             // 统一人工判定：如果结果是 failed，直接返回失败
             if (normalizedAttestation.result === 'failed') {
@@ -3148,7 +3164,69 @@ export function createPluginMarketplaceAdapter(deps = {}) {
               });
             }
 
-            // 统一人工判定：返回人工确认成功（不再进行自动化验证）
+            let verifiedInstallPath = null;
+            if (requiresInstalledClosure) {
+              if (!normalizedAttestation.installPath) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: {
+                    installed: false,
+                    error: 'codebuddy attestation installPath is required by the skill resource closure gate',
+                  },
+                });
+              }
+              if (!['desktop', 'cli'].includes(normalizedAttestation.installChannel)) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: {
+                    installed: false,
+                    error: 'codebuddy attestation installChannel must be "desktop" or "cli" when the skill resource closure gate is active',
+                  },
+                });
+              }
+              const normalizedPath = normalizedAttestation.installPath.replaceAll('\\', '/');
+              const expectedSuffix = `.workbuddy/plugins/marketplaces/${CODEBUDDY_MARKETPLACE_NAME}/plugins/${action.plugin}`;
+              if (!normalizedPath.endsWith(expectedSuffix)) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: {
+                    installed: false,
+                    error: `codebuddy attestation installPath must end with "${expectedSuffix}"`,
+                  },
+                });
+              }
+              const installPathAbs = resolve(normalizedAttestation.installPath);
+              let lexicalStat;
+              try {
+                lexicalStat = await lstat(installPathAbs);
+              } catch {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: {
+                    installed: false,
+                    error: `codebuddy attestation installPath does not exist: ${normalizedAttestation.installPath}`,
+                  },
+                });
+              }
+              if (lexicalStat.isSymbolicLink() || !lexicalStat.isDirectory()) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: {
+                    installed: false,
+                    error: 'codebuddy attestation installPath must be a real directory, not a symlink',
+                  },
+                });
+              }
+              verifiedInstallPath = await realpath(installPathAbs);
+            }
+
+            // 人工结果仍裁决不可自动化的安装步骤；新资源闭包计划另外
+            // 暴露已校验的真实安装目录，供 verify 的内置只读门禁扫描。
             return createResult({
               actionType,
               status: ActionStatus.OBSERVED,
@@ -3167,6 +3245,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
                 entrySkillFound: true,
                 manifestDigest: action.manifestDigest,
                 planDigest: boundPlanDigest,
+                ...(verifiedInstallPath ? { installPath: verifiedInstallPath } : {}),
               },
             });
           }