release-skill 0.2.9 → 0.3.0

package/src/commands/verify.mjs

@@ -43,6 +43,7 @@ import {
   GATE_FAILED,
   CONFIG_MISSING,
   POST_PUBLISH_VERIFY_FAILED,
+  CONSUMER_VERIFICATION_DEFERRED,
 } from '../core/errors.mjs';
 import { verifySourceAuthorityReceipt } from '../core/source-authority.mjs';
 import { assertTransition, PUBLISHED, VERIFIED } from '../core/state-machine.mjs';
@@ -67,6 +68,20 @@ import {
   buildDirectoryFileIndex,
   checkNpmEntryClosure,
 } from '../npm/npm-entry-closure.mjs';
+import {
+  KIMI_ATTESTATION_FILE,
+  KIMI_REQUIREMENT_FILE,
+  kimiAuthorityDir,
+  resolveBoundPlanDigest,
+  validateKimiAttestation,
+} from '../platforms/kimi.mjs';
+import {
+  CODEBUDDY_ATTESTATION_FILE,
+  CODEBUDDY_REQUIREMENT_FILE,
+  codebuddyAuthorityDir,
+  resolveCodeBuddyBoundPlanDigest,
+  validateCodeBuddyAttestation,
+} from '../platforms/codebuddy.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -120,6 +135,103 @@ function isValidDigest(digest) {
   return typeof digest === 'string' && /^[a-f0-9]{64}$/.test(digest);
 }
 
+/**
+ * Generate every manual consumer requirement before any expensive automatic
+ * consumer install starts. This turns a sequence of "install Kimi, rerun,
+ * then discover CodeBuddy" failures into one actionable response.
+ */
+async function collectMissingManualAttestations({
+  actions,
+  adapterRegistry,
+  plan,
+  root,
+  runDir,
+  clockFn,
+}) {
+  const manual = actions.filter((action) => (
+    action.type === 'kimi-marketplace-install'
+    || action.type === 'codebuddy-marketplace-install'
+  ));
+  if (manual.length === 0) return [];
+
+  const missing = [];
+  for (const action of manual) {
+    const adapterActionType = ADAPTER_ACTION_TYPE_MAP[action.type];
+    const adapter = adapterRegistry.getAdapter(adapterActionType);
+    // Tests and embedders may intentionally register a fully automatic
+    // adapter for these action types. Only the real platform adapter owns the
+    // interactive manual-install protocol and its stable authority files.
+    if (adapter.name !== 'plugin-marketplace') continue;
+    const context = {
+      externalWritesAuthorized: false,
+      isolatedConsumerWritesAuthorized: true,
+      plan,
+      baseline: plan.baseline,
+      root,
+      runDir,
+    };
+    const actionInput = { actionType: adapterActionType, ...action.parameters };
+    const preflight = await adapter.preflight(actionInput, context);
+    if (preflight.status !== 'PREFLIGHT_PASSED') {
+      throw new ReleaseError(
+        POST_PUBLISH_VERIFY_FAILED,
+        `manual consumer preflight did not pass for action "${action.id}": ${preflight.error}`,
+        { actionId: action.id, platform: action.type.split('-')[0] },
+      );
+    }
+    const executed = await adapter.execute(actionInput, context);
+    if (executed.status !== 'EXECUTED') {
+      throw new ReleaseError(
+        POST_PUBLISH_VERIFY_FAILED,
+        `cannot generate manual consumer requirement for action "${action.id}": ${executed.error}`,
+        { actionId: action.id, platform: action.type.split('-')[0] },
+      );
+    }
+
+    const isKimi = action.type === 'kimi-marketplace-install';
+    const planDigest = isKimi
+      ? resolveBoundPlanDigest(context)
+      : await resolveCodeBuddyBoundPlanDigest(context);
+    const authorityDir = isKimi
+      ? kimiAuthorityDir(context, planDigest, action.parameters.plugin)
+      : codebuddyAuthorityDir(context, planDigest, action.parameters.plugin);
+    const requirementPath = join(
+      authorityDir,
+      isKimi ? KIMI_REQUIREMENT_FILE : CODEBUDDY_REQUIREMENT_FILE,
+    );
+    const attestationPath = join(
+      authorityDir,
+      isKimi ? KIMI_ATTESTATION_FILE : CODEBUDDY_ATTESTATION_FILE,
+    );
+
+    let valid = false;
+    let reason = 'attestation file is missing';
+    try {
+      const attestation = JSON.parse(await readFile(attestationPath, 'utf8'));
+      const validation = isKimi
+        ? validateKimiAttestation(attestation, action.parameters, clockFn(), planDigest)
+        : validateCodeBuddyAttestation(attestation, action.parameters, clockFn(), planDigest);
+      valid = validation.valid;
+      reason = validation.error;
+    } catch (error) {
+      if (error?.code !== 'ENOENT') reason = `attestation cannot be read: ${error.message}`;
+    }
+    if (!valid) {
+      missing.push({
+        actionId: action.id,
+        platform: isKimi ? 'kimi' : 'codebuddy',
+        plugin: action.parameters.plugin,
+        version: action.parameters.version,
+        planDigest,
+        requirementPath,
+        attestationPath,
+        reason,
+      });
+    }
+  }
+  return missing;
+}
+
 // ---------------------------------------------------------------------------
 // Smoke test
 // ---------------------------------------------------------------------------
@@ -1000,7 +1112,33 @@ export async function verifyRelease(options) {
       }
     }
 
-    for (const action of actions) {
+    const missingManualAttestations = await collectMissingManualAttestations({
+      actions,
+      adapterRegistry,
+      plan,
+      root,
+      runDir,
+      clockFn,
+    });
+    if (missingManualAttestations.length > 0) {
+      await evidence.append({
+        phase: 'verify',
+        step: 'manual-attestations',
+        status: 'needs-input',
+        requirements: missingManualAttestations,
+      });
+      throw new ReleaseError(
+        CONSUMER_VERIFICATION_DEFERRED,
+        `${missingManualAttestations.length} manual consumer attestation(s) are required`,
+        { requirements: missingManualAttestations },
+      );
+    }
+
+    // Every action is identity-bound and adapters receive read-only or
+    // per-action isolated consumer paths. Run independent checks concurrently;
+    // the evidence writer serializes append operations and result arrays are
+    // sorted afterwards for deterministic receipts.
+    const actionResults = await Promise.allSettled(actions.map(async (action) => {
       const adapterActionType = ADAPTER_ACTION_TYPE_MAP[action.type];
 
       // Skip meta-checkpoints
@@ -1011,7 +1149,7 @@ export async function verifyRelease(options) {
           status: 'SKIPPED',
           reason: 'meta-checkpoint',
         });
-        continue;
+        return;
       }
 
       let adapter;
@@ -1142,7 +1280,7 @@ export async function verifyRelease(options) {
               installationContractDigest: currentDigest,
             });
 
-            continue;
+            return;
           }
         }
 
@@ -1305,7 +1443,12 @@ export async function verifyRelease(options) {
           );
         }
       }
-    }
+    }));
+    adapterChecks.sort((a, b) => a.actionId.localeCompare(b.actionId));
+    consumerVerificationReceipts.sort((a, b) => a.actionId.localeCompare(b.actionId));
+    consumerGateResults.sort((a, b) => a.id.localeCompare(b.id));
+    const rejectedAction = actionResults.find((result) => result.status === 'rejected');
+    if (rejectedAction) throw rejectedAction.reason;
 
     await evidence.append({ phase: 'verify', step: 'adapter-verify', status: 'completed' });
 

package/src/core/git-transport.mjs

@@ -0,0 +1,93 @@
+import { execFile as execFileCb } from 'node:child_process';
+import { promisify } from 'node:util';
+
+import { ReleaseError, REMOTE_UNAVAILABLE, REMOTE_CONFLICT } from './errors.mjs';
+
+const execFile = promisify(execFileCb);
+
+function urls(repo, host) {
+  if (typeof repo !== 'string' || !/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(repo)) {
+    throw new ReleaseError(REMOTE_UNAVAILABLE, 'git transport preflight requires owner/name repositories');
+  }
+  const safeHost = host ?? 'github.com';
+  if (!/^[A-Za-z0-9.-]+$/.test(safeHost)) {
+    throw new ReleaseError(REMOTE_UNAVAILABLE, 'git transport preflight requires a safe GitHub hostname');
+  }
+  return {
+    https: `https://${safeHost}/${repo}.git`,
+    ssh: `git@${safeHost}:${repo}.git`,
+  };
+}
+
+function identity(stdout) {
+  const lines = String(stdout).trim().split('\n').filter(Boolean);
+  const head = lines.find((line) => /^[a-f0-9]{40,64}\s+HEAD$/.test(line.trim()));
+  const symref = lines.find((line) => line.startsWith('ref: '));
+  return `${symref ?? ''}\n${head ?? ''}`;
+}
+
+export async function preflightGitTransports(plan, options = {}) {
+  const exec = options.exec ?? ((command, args, execOptions) => execFile(command, args, execOptions));
+  const repositories = new Map();
+  for (const action of plan.externalActions ?? []) {
+    const repo = action.parameters?.repo;
+    if (!repo) continue;
+    const host = action.parameters?.githubHost ?? 'github.com';
+    repositories.set(`${host}/${repo}`, { repo, host });
+  }
+  const observations = [];
+  for (const { repo, host } of repositories.values()) {
+    const candidates = urls(repo, host);
+    const observation = { repo, host };
+    for (const transport of ['https', 'ssh']) {
+      try {
+        const { stdout } = await exec(
+          'git',
+          ['ls-remote', '--symref', candidates[transport], 'HEAD'],
+          { shell: false, encoding: 'utf8', timeout: 30_000 },
+        );
+        observation[transport] = {
+          status: 'available',
+          identity: identity(stdout),
+        };
+      } catch (error) {
+        observation[transport] = {
+          status: 'unavailable',
+          error: error.message,
+        };
+      }
+    }
+    if (observation.https.status === 'unavailable' && observation.ssh.status === 'unavailable') {
+      throw new ReleaseError(
+        REMOTE_UNAVAILABLE,
+        `neither HTTPS nor SSH can read ${repo}`,
+        { repository: repo, transports: observation },
+      );
+    }
+    if (
+      observation.https.status === 'available'
+      && observation.ssh.status === 'available'
+      && observation.https.identity !== observation.ssh.identity
+    ) {
+      throw new ReleaseError(
+        REMOTE_CONFLICT,
+        `HTTPS and SSH resolve different remote identities for ${repo}`,
+        { repository: repo },
+      );
+    }
+    observations.push(observation);
+  }
+  const transport = observations.some((entry) => entry.https.status === 'unavailable')
+    ? 'ssh'
+    : 'https';
+  if (
+    transport === 'ssh'
+    && observations.some((entry) => entry.ssh.status !== 'available')
+  ) {
+    throw new ReleaseError(
+      REMOTE_UNAVAILABLE,
+      'no single safe Git transport is available for every release repository',
+    );
+  }
+  return { transport, repositories: observations };
+}

package/src/core/release-metadata.mjs

@@ -0,0 +1,105 @@
+import { lstat, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import YAML from 'yaml';
+
+import { ReleaseError, CONFIG_INVALID, GATE_FAILED } from './errors.mjs';
+
+function assertOid(value, label) {
+  if (typeof value !== 'string' || !/^[a-f0-9]{40,64}$/.test(value)) {
+    throw new ReleaseError(GATE_FAILED, `${label} is not a full Git object id`);
+  }
+}
+
+/**
+ * After VERIFIED, advance the project-only previous-public baseline to the
+ * exact public commit already frozen, published and verified. This prepares
+ * the next release without asking maintainers to copy commits from terminal
+ * output. It never edits public files or performs remote writes.
+ */
+export async function updatePreviousPublicBaselines(options = {}) {
+  const root = resolve(options.root ?? process.cwd());
+  const planPath = resolve(options.planPath ?? '');
+  const configPath = resolve(root, '.release-skill', 'project.yaml');
+  let plan;
+  let configRaw;
+  let configStat;
+  try {
+    [plan, configRaw, configStat] = await Promise.all([
+      readFile(planPath, 'utf8').then(JSON.parse),
+      readFile(configPath, 'utf8'),
+      lstat(configPath),
+    ]);
+  } catch (error) {
+    throw new ReleaseError(
+      CONFIG_INVALID,
+      `cannot load release metadata authorities: ${error.message}`,
+    );
+  }
+  if (!configStat.isFile() || configStat.isSymbolicLink()) {
+    throw new ReleaseError(CONFIG_INVALID, 'project config must be a regular non-symlink file');
+  }
+
+  const doc = YAML.parseDocument(configRaw, { uniqueKeys: true });
+  if (doc.errors.length > 0) {
+    throw new ReleaseError(CONFIG_INVALID, `project config YAML is invalid: ${doc.errors[0].message}`);
+  }
+  const releaseUnits = doc.get('releaseUnits', true);
+  if (!YAML.isSeq(releaseUnits)) {
+    throw new ReleaseError(CONFIG_INVALID, 'project config releaseUnits must be a sequence');
+  }
+  const configUnits = new Map();
+  for (const node of releaseUnits.items) {
+    const id = node?.get?.('id');
+    if (typeof id === 'string') configUnits.set(id, node);
+  }
+
+  const updates = [];
+  for (const unit of plan.units ?? []) {
+    const configUnit = configUnits.get(unit.id);
+    if (!configUnit) {
+      throw new ReleaseError(CONFIG_INVALID, `frozen unit "${unit.id}" is absent from project config`);
+    }
+    const frozen = unit.frozenSnapshot;
+    assertOid(frozen?.commit, `unit "${unit.id}" frozen commit`);
+    assertOid(frozen?.tree, `unit "${unit.id}" frozen tree`);
+    if (!/^[a-f0-9]{64}$/.test(frozen?.manifestDigest ?? '')) {
+      throw new ReleaseError(GATE_FAILED, `unit "${unit.id}" frozen manifest digest is invalid`);
+    }
+    const old = configUnit.get('previousPublicBaseline', true)?.toJSON?.() ?? {};
+    const next = {
+      mode: 'bound',
+      repo: old.repo ?? unit.publicRepo,
+      ref: old.ref ?? `refs/heads/${frozen.branch}`,
+      commit: frozen.commit,
+      tree: frozen.tree,
+      manifestDigest: frozen.manifestDigest,
+    };
+    if (!next.repo || !next.ref) {
+      throw new ReleaseError(GATE_FAILED, `unit "${unit.id}" cannot derive its next public baseline identity`);
+    }
+    configUnit.set('previousPublicBaseline', next);
+    updates.push({
+      id: unit.id,
+      previousCommit: old.commit ?? null,
+      commit: frozen.commit,
+    });
+  }
+
+  const nextRaw = doc.toString();
+  if (nextRaw === configRaw) {
+    return { status: 'UNCHANGED', configPath, units: updates };
+  }
+  const tempPath = `${configPath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    await writeFile(tempPath, nextRaw, {
+      encoding: 'utf8',
+      mode: configStat.mode & 0o777,
+      flag: 'wx',
+    });
+    await rename(tempPath, configPath);
+  } catch (error) {
+    await rm(tempPath, { force: true }).catch(() => {});
+    throw new ReleaseError(CONFIG_INVALID, `cannot update project release metadata: ${error.message}`);
+  }
+  return { status: 'UPDATED', configPath, units: updates };
+}