release-skill 0.2.6 → 0.2.8

package/src/commands/setup.mjs

@@ -24,6 +24,7 @@ import addFormats from 'ajv-formats';
 import { canonicalJson, sha256Hex } from '../core/digest.mjs';
 import { acquireProjectLock } from '../artifacts/project-lock.mjs';
 import { getPlatform, PLATFORMS } from '../platforms/registry.mjs';
+import { checkNpmEntryClosure } from '../npm/npm-entry-closure.mjs';
 import {
   CONFIG_EXISTS,
   CONFIG_INVALID,
@@ -201,6 +202,8 @@ function summarizeLegacyReleaseConfig(value, path) {
       tagPrefix: optionalString(repo.tagPrefix),
       npmPackage: optionalString(repo.npmPackage),
       npmPackageDeclared: Object.hasOwn(repo, 'npmPackage'),
+      npmRequiredPathCandidates: stringList(repo.npmRequiredPackagePaths),
+      npmRequiredPathsDeclared: Object.hasOwn(repo, 'npmRequiredPackagePaths'),
       docsSource: optionalString(repo.docsSource),
       requiredPathCandidates: stringList(repo.requiredPackagePaths),
       snapshotCommands: Array.isArray(repo.snapshotCommands) ? repo.snapshotCommands : [],
@@ -223,6 +226,8 @@ function summarizeLegacyReleaseConfig(value, path) {
       npmPackageDeclared: plugins.some((plugin) => (
         plugin && typeof plugin === 'object' && !Array.isArray(plugin) && Object.hasOwn(plugin, 'npmPackage')
       )),
+      npmRequiredPathCandidates: stringList(value.npmRequiredPackagePaths),
+      npmRequiredPathsDeclared: Object.hasOwn(value, 'npmRequiredPackagePaths'),
       docsSource: null,
       requiredPathCandidates: stringList(value.requiredPaths),
       snapshotCommands: Array.isArray(value.snapshotCommands) ? value.snapshotCommands : [],
@@ -467,6 +472,111 @@ async function discoverUnitGit(unitAbsDir, parentRoot) {
   };
 }
 
+async function pathIsGitIgnored(unitAbsDir, target) {
+  // --no-index also classifies generated paths that do not exist yet.
+  try {
+    await execFile('git', ['check-ignore', '--no-index', '--quiet', '--', target], {
+      cwd: unitAbsDir,
+      shell: false,
+      timeout: 5000,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function classifyNpmEntryCandidate(unitAbsDir, target, trackedFiles) {
+  const tracked = trackedFiles.includes(target);
+  const ignored = await pathIsGitIgnored(unitAbsDir, target);
+  let stat = null;
+  try {
+    stat = await lstat(join(unitAbsDir, target));
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  const exists = stat !== null;
+  const regular = stat?.isFile() === true && stat?.isSymbolicLink() !== true;
+  const state = exists && !regular
+    ? 'NON_REGULAR'
+    : exists && tracked
+      ? 'TRACKED_PRESENT'
+      : exists && ignored
+        ? 'IGNORED_PRESENT'
+        : exists
+          ? 'UNTRACKED_PRESENT'
+          : ignored
+            ? 'IGNORED_MISSING'
+            : 'MISSING';
+  return { path: target, state, exists, tracked, ignored };
+}
+
+async function discoverNpmEntryCandidates(root, pkg, matchingLegacyUnits, unitGitEntry) {
+  const emptyIndex = new Map();
+  const semantic = checkNpmEntryClosure(pkg.entryManifest, emptyIndex);
+  const byPath = new Map();
+  const add = (target, source) => {
+    const current = byPath.get(target) ?? { path: target, sources: new Set() };
+    current.sources.add(source);
+    byPath.set(target, current);
+  };
+  for (const entry of semantic.entries) add(entry.target, `package.json:${entry.field}`);
+
+  const diagnostics = [
+    ...semantic.errors
+      .filter((error) => error.reason !== 'entry_missing')
+      .map((error) => ({ code: 'NPM_ENTRY_DECLARATION_INVALID', ...error })),
+    ...semantic.diagnostics.map((diagnostic) => ({
+      code: 'NPM_ENTRY_WILDCARD_REQUIRES_REVIEW',
+      ...diagnostic,
+    })),
+  ];
+  const declaredLegacyPaths = new Set();
+  const legacyCoverageDeclared = matchingLegacyUnits.some((unit) => unit.npmRequiredPathsDeclared);
+  for (const legacy of matchingLegacyUnits) {
+    for (const target of legacy.npmRequiredPathCandidates) {
+      const checked = checkNpmEntryClosure({ main: target }, emptyIndex);
+      const normalized = checked.entries[0]?.target;
+      if (!normalized) {
+        diagnostics.push({
+          code: 'LEGACY_NPM_REQUIRED_PATH_INVALID',
+          path: target,
+          reason: checked.errors[0]?.reason ?? 'invalid_path',
+        });
+        continue;
+      }
+      declaredLegacyPaths.add(normalized);
+      add(normalized, 'public-release.json:npmRequiredPackagePaths');
+    }
+  }
+  if (legacyCoverageDeclared) {
+    for (const entry of semantic.entries) {
+      if (!declaredLegacyPaths.has(entry.target)) {
+        diagnostics.push({
+          code: 'LEGACY_NPM_ENTRY_COVERAGE_MISSING',
+          path: entry.target,
+          field: entry.field,
+        });
+      }
+    }
+  }
+
+  const unitAbsDir = resolve(root, pkg.directory);
+  const candidates = [];
+  for (const item of [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path))) {
+    candidates.push({
+      ...await classifyNpmEntryCandidate(
+        unitAbsDir,
+        item.path,
+        unitGitEntry?.trackedFiles ?? [],
+      ),
+      sources: [...item.sources].sort(),
+    });
+  }
+  diagnostics.sort((a, b) => canonicalJson(a).localeCompare(canonicalJson(b)));
+  return { candidates, diagnostics };
+}
+
 async function discoverFacts(root) {
   const files = await walkDiscoveryFiles(root);
   const packageFiles = files.filter((path) => (
@@ -494,6 +604,11 @@ async function discoverFacts(root) {
       private: pkg.private === true,
       repository: parseGithubRepo(pkg.repository),
       publishRegistry: typeof pkg.publishConfig?.registry === 'string' ? pkg.publishConfig.registry : null,
+      entryManifest: Object.fromEntries(
+        ['bin', 'main', 'module', 'types', 'typings', 'exports']
+          .filter((field) => Object.hasOwn(pkg, field))
+          .map((field) => [field, pkg[field]]),
+      ),
       files: Array.isArray(pkg.files) ? pkg.files.filter((item) => typeof item === 'string').sort() : [],
       scripts: Object.fromEntries(Object.entries(pkg.scripts ?? {})
         .filter(([, value]) => typeof value === 'string')
@@ -557,6 +672,22 @@ async function discoverFacts(root) {
   for (const pkg of packages) {
     const unitAbsDir = resolve(root, pkg.directory);
     unitGit[pkg.directory] = await discoverUnitGit(unitAbsDir, root);
+    const inferredId = safeUnitId(pkg, pkg.directory);
+    const matchingLegacyUnits = legacyReleaseConfigs
+      .flatMap((config) => config.releaseUnits)
+      .filter((unit) => (
+        unit.id === inferredId ||
+        unit.source === pkg.directory ||
+        unit.source === dirname(pkg.path)
+      ));
+    const npmDiscovery = await discoverNpmEntryCandidates(
+      root,
+      pkg,
+      matchingLegacyUnits,
+      unitGit[pkg.directory],
+    );
+    pkg.npmEntryCandidates = npmDiscovery.candidates;
+    pkg.npmEntryDiagnostics = npmDiscovery.diagnostics;
   }
 
   return { git, packages, manifests, skills, legacyReleaseConfigs, fileDigests, unitGit };
@@ -871,6 +1002,8 @@ function buildCandidates(facts) {
       publicFileMappingCandidates: mappingResult.mappings,
       publicFileMappingConflicts: mappingResult.conflicts,
       requiredPublicFileCandidates,
+      npmEntryCandidates: pkg.npmEntryCandidates ?? [],
+      npmEntryDiagnostics: pkg.npmEntryDiagnostics ?? [],
       entrySkillCandidates: entrySkillCandidatesForUnit(facts, pkg, id),
       ...(hasAuthorityConflict ? {
         authorityConflict: {
@@ -1027,6 +1160,24 @@ function buildRecommendedProposal(facts, candidates) {
         assumptions,
       };
     }
+    if (
+      unit.distributionCandidates.includes('npm') &&
+      (
+        (unit.npmEntryCandidates ?? []).some((candidate) => candidate.state !== 'TRACKED_PRESENT') ||
+        (unit.npmEntryDiagnostics ?? []).length > 0
+      )
+    ) {
+      return {
+        answers: null,
+        conflicts: [{
+          code: 'NPM_ENTRY_REVIEW_REQUIRED',
+          unit: unit.id,
+          candidates: unit.npmEntryCandidates,
+          diagnostics: unit.npmEntryDiagnostics,
+        }],
+        assumptions,
+      };
+    }
 
     // Infer npm publisher: prefer legacy owner, then parse from repo slug
     const repoOwner = publicRepo.includes('/') ? publicRepo.split('/')[0] : null;
@@ -1245,6 +1396,15 @@ function buildDecisionsRequired(candidates, localOnly) {
       id: `unit:${unit.id}:distributions-and-files`,
       description: `逐项确认渠道 ${JSON.stringify(unit.distributionCandidates)}、公开文件边界和 requiredPublicFiles；候选不是授权。`,
     });
+    if (
+      (unit.npmEntryCandidates ?? []).length > 0 ||
+      (unit.npmEntryDiagnostics ?? []).length > 0
+    ) {
+      decisions.push({
+        id: `unit:${unit.id}:npm-entry-closure`,
+        description: '审阅 package.json 入口及旧 npmRequiredPackagePaths 的 tracked/untracked/ignored/missing 状态；setup 只报告候选，不自动写入 publicFiles 或 requiredPublicFiles。',
+      });
+    }
   }
   decisions.push({
     id: 'verification-gates',
@@ -1271,6 +1431,8 @@ function buildCompactSummary(report) {
       distributionCandidates: [...unit.distributionCandidates].sort(),
       publicFileMappingCount: (unit.publicFileMappingCandidates ?? []).length,
       requiredPublicFileCount: (unit.requiredPublicFileCandidates ?? []).length,
+      npmEntryCandidates: unit.npmEntryCandidates ?? [],
+      npmEntryDiagnostics: unit.npmEntryDiagnostics ?? [],
     })),
     gateCandidates: (report.gateCandidates ?? []).map((gate) => ({
       id: gate.id,
@@ -1519,6 +1681,12 @@ export async function setupProject({ root, answersPath, write = false, confirmSe
           ...(unconfiguredGateCandidateIds.length > 0
             ? ['存在未配置的验证候选；逐项审阅副作用后决定是否人工注册。']
             : []),
+          ...(candidates.units.some((unit) => (
+            (unit.npmEntryCandidates ?? []).some((candidate) => candidate.state !== 'TRACKED_PRESENT') ||
+            (unit.npmEntryDiagnostics ?? []).length > 0
+          ))
+            ? ['npm 入口候选存在未跟踪、被忽略、缺失、非普通文件或声明覆盖疑点；人工增量修复配置或构建流程，setup 不自动改写。']
+            : []),
         ],
       },
       recommendedGateIds: [],

package/src/commands/verify.mjs

@@ -63,6 +63,10 @@ import {
   shouldSkipVerification,
   INSTALLATION_CONTRACT_ALGORITHM_VERSION,
 } from '../core/installation-contract.mjs';
+import {
+  buildDirectoryFileIndex,
+  checkNpmEntryClosure,
+} from '../npm/npm-entry-closure.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -294,6 +298,30 @@ export async function runSmokeTest(plan, root, options = {}) {
       }
 
       const pkgRoot = join(installDir, 'node_modules', pkgName);
+
+      // Entry closure check: verify all declared entry points (bin, main,
+      // module, types, typings, exports) exist as regular files in the
+      // installed package. This catches incident-class tarballs where
+      // name/version are correct but distribution files are missing.
+      {
+        const dirIndex = await buildDirectoryFileIndex(pkgRoot);
+        const closureResult = checkNpmEntryClosure(installedPkg, dirIndex);
+        if (closureResult.errors.length > 0) {
+          return {
+            passed: false,
+            details: {
+              gate: 'npm-entry-closure',
+              error: `npm entry closure check failed for ${packageAtVersion}: ${closureResult.errors.map((e) => e.message).join('; ')}`,
+              packageAtVersion,
+              unitId,
+              entries: closureResult.entries,
+              errors: closureResult.errors,
+              diagnostics: closureResult.diagnostics,
+            },
+          };
+        }
+      }
+
       if (plan.skillResourceClosure) {
         const expectedUnitReceipt = plan.skillResourceClosure.unitReceipts
           .find((item) => item.unitId === unitId);
@@ -1225,7 +1253,6 @@ export async function verifyRelease(options) {
                   }
                 : {
                     HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
-                    KIMI_CODE_HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
                   },
         }));
       } else {

package/src/core/config.mjs

@@ -23,6 +23,7 @@ import Ajv from 'ajv';
 import addFormats from 'ajv-formats';
 import { canonicalJson, sha256Hex } from './digest.mjs';
 import { ReleaseError, CONFIG_INVALID } from './errors.mjs';
+import { validatePublicSurfaceGlob } from './public-surface.mjs';
 import { canonicalPublicPath, publicPathCollisionKey } from '../snapshot/public-path.mjs';
 import { isReservedReleaseControlPath } from './baseline.mjs';
 import { readTrustedPackageResource } from './trusted-resource.mjs';
@@ -294,6 +295,53 @@ export async function loadProjectConfig({ root, configPath } = {}) {
       );
     }
 
+    // Validate expected public-surface roots and the deliberately small glob
+    // language before generic schema validation so diagnostics identify the
+    // exact unit, scan root, and pattern.
+    const surface = unit.expectedPublicSurface;
+    if (surface && typeof surface === 'object' && Array.isArray(surface.scanRoots)) {
+      for (const [rootIndex, scanRoot] of surface.scanRoots.entries()) {
+        if (!scanRoot || typeof scanRoot !== 'object') continue;
+        if (typeof scanRoot.root === 'string') {
+          try {
+            canonicalPublicPath(scanRoot.root, { allowDot: true });
+          } catch (err) {
+            throw new ReleaseError(
+              CONFIG_INVALID,
+              `unit "${unit.id}" has invalid expectedPublicSurface scan root: ${err.message}`,
+              {
+                unitId: unit.id,
+                rootIndex,
+                root: scanRoot.root,
+                field: 'expectedPublicSurface.scanRoots[].root',
+              },
+            );
+          }
+        }
+        for (const field of ['include', 'exclude']) {
+          if (!Array.isArray(scanRoot[field])) continue;
+          for (const pattern of scanRoot[field]) {
+            if (typeof pattern !== 'string') continue;
+            try {
+              validatePublicSurfaceGlob(pattern);
+            } catch (err) {
+              throw new ReleaseError(
+                CONFIG_INVALID,
+                `unit "${unit.id}" has invalid expectedPublicSurface ${field} glob: ${err.message}`,
+                {
+                  unitId: unit.id,
+                  rootIndex,
+                  pattern,
+                  field: `expectedPublicSurface.scanRoots[].${field}`,
+                  reason: err.details?.reason ?? 'PUBLIC_SURFACE_GLOB_INVALID',
+                },
+              );
+            }
+          }
+        }
+      }
+    }
+
     // Validate publicFiles[].from and .to
     if (Array.isArray(unit.publicFiles)) {
       for (const mapping of unit.publicFiles) {