release-skill 0.2.9 → 0.4.0

package/src/core/git-transport.mjs

@@ -0,0 +1,93 @@
+import { execFile as execFileCb } from 'node:child_process';
+import { promisify } from 'node:util';
+
+import { ReleaseError, REMOTE_UNAVAILABLE, REMOTE_CONFLICT } from './errors.mjs';
+
+const execFile = promisify(execFileCb);
+
+function urls(repo, host) {
+  if (typeof repo !== 'string' || !/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(repo)) {
+    throw new ReleaseError(REMOTE_UNAVAILABLE, 'git transport preflight requires owner/name repositories');
+  }
+  const safeHost = host ?? 'github.com';
+  if (!/^[A-Za-z0-9.-]+$/.test(safeHost)) {
+    throw new ReleaseError(REMOTE_UNAVAILABLE, 'git transport preflight requires a safe GitHub hostname');
+  }
+  return {
+    https: `https://${safeHost}/${repo}.git`,
+    ssh: `git@${safeHost}:${repo}.git`,
+  };
+}
+
+function identity(stdout) {
+  const lines = String(stdout).trim().split('\n').filter(Boolean);
+  const head = lines.find((line) => /^[a-f0-9]{40,64}\s+HEAD$/.test(line.trim()));
+  const symref = lines.find((line) => line.startsWith('ref: '));
+  return `${symref ?? ''}\n${head ?? ''}`;
+}
+
+export async function preflightGitTransports(plan, options = {}) {
+  const exec = options.exec ?? ((command, args, execOptions) => execFile(command, args, execOptions));
+  const repositories = new Map();
+  for (const action of plan.externalActions ?? []) {
+    const repo = action.parameters?.repo;
+    if (!repo) continue;
+    const host = action.parameters?.githubHost ?? 'github.com';
+    repositories.set(`${host}/${repo}`, { repo, host });
+  }
+  const observations = [];
+  for (const { repo, host } of repositories.values()) {
+    const candidates = urls(repo, host);
+    const observation = { repo, host };
+    for (const transport of ['https', 'ssh']) {
+      try {
+        const { stdout } = await exec(
+          'git',
+          ['ls-remote', '--symref', candidates[transport], 'HEAD'],
+          { shell: false, encoding: 'utf8', timeout: 30_000 },
+        );
+        observation[transport] = {
+          status: 'available',
+          identity: identity(stdout),
+        };
+      } catch (error) {
+        observation[transport] = {
+          status: 'unavailable',
+          error: error.message,
+        };
+      }
+    }
+    if (observation.https.status === 'unavailable' && observation.ssh.status === 'unavailable') {
+      throw new ReleaseError(
+        REMOTE_UNAVAILABLE,
+        `neither HTTPS nor SSH can read ${repo}`,
+        { repository: repo, transports: observation },
+      );
+    }
+    if (
+      observation.https.status === 'available'
+      && observation.ssh.status === 'available'
+      && observation.https.identity !== observation.ssh.identity
+    ) {
+      throw new ReleaseError(
+        REMOTE_CONFLICT,
+        `HTTPS and SSH resolve different remote identities for ${repo}`,
+        { repository: repo },
+      );
+    }
+    observations.push(observation);
+  }
+  const transport = observations.some((entry) => entry.https.status === 'unavailable')
+    ? 'ssh'
+    : 'https';
+  if (
+    transport === 'ssh'
+    && observations.some((entry) => entry.ssh.status !== 'available')
+  ) {
+    throw new ReleaseError(
+      REMOTE_UNAVAILABLE,
+      'no single safe Git transport is available for every release repository',
+    );
+  }
+  return { transport, repositories: observations };
+}

package/src/core/release-metadata.mjs

@@ -0,0 +1,105 @@
+import { lstat, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import YAML from 'yaml';
+
+import { ReleaseError, CONFIG_INVALID, GATE_FAILED } from './errors.mjs';
+
+function assertOid(value, label) {
+  if (typeof value !== 'string' || !/^[a-f0-9]{40,64}$/.test(value)) {
+    throw new ReleaseError(GATE_FAILED, `${label} is not a full Git object id`);
+  }
+}
+
+/**
+ * After VERIFIED, advance the project-only previous-public baseline to the
+ * exact public commit already frozen, published and verified. This prepares
+ * the next release without asking maintainers to copy commits from terminal
+ * output. It never edits public files or performs remote writes.
+ */
+export async function updatePreviousPublicBaselines(options = {}) {
+  const root = resolve(options.root ?? process.cwd());
+  const planPath = resolve(options.planPath ?? '');
+  const configPath = resolve(root, '.release-skill', 'project.yaml');
+  let plan;
+  let configRaw;
+  let configStat;
+  try {
+    [plan, configRaw, configStat] = await Promise.all([
+      readFile(planPath, 'utf8').then(JSON.parse),
+      readFile(configPath, 'utf8'),
+      lstat(configPath),
+    ]);
+  } catch (error) {
+    throw new ReleaseError(
+      CONFIG_INVALID,
+      `cannot load release metadata authorities: ${error.message}`,
+    );
+  }
+  if (!configStat.isFile() || configStat.isSymbolicLink()) {
+    throw new ReleaseError(CONFIG_INVALID, 'project config must be a regular non-symlink file');
+  }
+
+  const doc = YAML.parseDocument(configRaw, { uniqueKeys: true });
+  if (doc.errors.length > 0) {
+    throw new ReleaseError(CONFIG_INVALID, `project config YAML is invalid: ${doc.errors[0].message}`);
+  }
+  const releaseUnits = doc.get('releaseUnits', true);
+  if (!YAML.isSeq(releaseUnits)) {
+    throw new ReleaseError(CONFIG_INVALID, 'project config releaseUnits must be a sequence');
+  }
+  const configUnits = new Map();
+  for (const node of releaseUnits.items) {
+    const id = node?.get?.('id');
+    if (typeof id === 'string') configUnits.set(id, node);
+  }
+
+  const updates = [];
+  for (const unit of plan.units ?? []) {
+    const configUnit = configUnits.get(unit.id);
+    if (!configUnit) {
+      throw new ReleaseError(CONFIG_INVALID, `frozen unit "${unit.id}" is absent from project config`);
+    }
+    const frozen = unit.frozenSnapshot;
+    assertOid(frozen?.commit, `unit "${unit.id}" frozen commit`);
+    assertOid(frozen?.tree, `unit "${unit.id}" frozen tree`);
+    if (!/^[a-f0-9]{64}$/.test(frozen?.manifestDigest ?? '')) {
+      throw new ReleaseError(GATE_FAILED, `unit "${unit.id}" frozen manifest digest is invalid`);
+    }
+    const old = configUnit.get('previousPublicBaseline', true)?.toJSON?.() ?? {};
+    const next = {
+      mode: 'bound',
+      repo: old.repo ?? unit.publicRepo,
+      ref: old.ref ?? `refs/heads/${frozen.branch}`,
+      commit: frozen.commit,
+      tree: frozen.tree,
+      manifestDigest: frozen.manifestDigest,
+    };
+    if (!next.repo || !next.ref) {
+      throw new ReleaseError(GATE_FAILED, `unit "${unit.id}" cannot derive its next public baseline identity`);
+    }
+    configUnit.set('previousPublicBaseline', next);
+    updates.push({
+      id: unit.id,
+      previousCommit: old.commit ?? null,
+      commit: frozen.commit,
+    });
+  }
+
+  const nextRaw = doc.toString();
+  if (nextRaw === configRaw) {
+    return { status: 'UNCHANGED', configPath, units: updates };
+  }
+  const tempPath = `${configPath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    await writeFile(tempPath, nextRaw, {
+      encoding: 'utf8',
+      mode: configStat.mode & 0o777,
+      flag: 'wx',
+    });
+    await rename(tempPath, configPath);
+  } catch (error) {
+    await rm(tempPath, { force: true }).catch(() => {});
+    throw new ReleaseError(CONFIG_INVALID, `cannot update project release metadata: ${error.message}`);
+  }
+  return { status: 'UPDATED', configPath, units: updates };
+}

package/src/core/skill-resource-closure.mjs

@@ -275,10 +275,16 @@ export function evaluateConsumerSkillResourceClosureReceipts(plan, receipts) {
     'kimi-plugin',
     'codebuddy-plugin',
   ]);
+  // When plan declares humanConsumersStrategy: 'manualFollowUps', Kimi/CodeBuddy
+  // are non-blocking manual follow-up tasks and are not verified by the system.
+  // Exclude them from the expected receipt set.
+  const humanConsumerTypes = plan.humanConsumersStrategy === 'manualFollowUps'
+    ? new Set(['kimi-plugin', 'codebuddy-plugin'])
+    : new Set();
   const expectedKeys = [];
   for (const unit of plan.units ?? []) {
     for (const distribution of unit.distributions ?? []) {
-      if (supported.has(distribution.type)) {
+      if (supported.has(distribution.type) && !humanConsumerTypes.has(distribution.type)) {
         expectedKeys.push(`${unit.id}:${distribution.type}`);
       }
     }