release-skill 0.4.1 → 0.4.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.4.1",
+      "version": "0.4.2",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.4.1.",
+      "Prepare a release plan for version 0.4.2.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.4.2 locale=en baseline=sha256:b8676f90eb68c93e40f84ff16de18a8c472e6a06e321bcc25895799e9e6f3896 -->
+## [0.4.2] - 2026-08-12
+
+v0.4.2 makes the CodeBuddy consumer marketplace configurable per distribution instead of hardcoding a single marketplace, so CodeBuddy plugin distributions can target a project-declared marketplace source.
+
+### Changed
+
+- **Plan schema**: production plans carry the resolved codebuddy marketplace coordinates so approval and publish review the exact marketplace target.
+
+### Fixed
+
+- **Configurable CodeBuddy marketplace**: codebuddy-plugin distributions now accept `marketplace` and `marketplaceSource` in project configuration, and prepare threads both values into the consumer install action instead of assuming a fixed marketplace.
+<!-- release-skill:changelog:end version=0.4.2 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.4.1 locale=en baseline=sha256:e2ccb5ddfef6c5e00b047bbf4fa009f5f5c10b003aa2254756f6f9b73a9b3346 -->
 ## [0.4.1] - 2026-08-03
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.4.1 -->
+<!-- release-skill:release-version: 0.4.2 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.4.1
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.4.2
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.4.1 -->
+<!-- release-skill:release-version: 0.4.2 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.4.1
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.4.2
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.4.1 -->
+<!-- release-skill:release-version: 0.4.2 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,19 +14,21 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.4.1** (2026-08-03)
+**0.4.2** (2026-08-12)
 
-v0.4.1 is the unreleased source candidate that migrates release-skill to Apache License 2.0 and aligns public author metadata while preserving repository ownership and historical attribution.
+v0.4.2 makes the CodeBuddy consumer marketplace configurable per distribution instead of hardcoding a single marketplace, so CodeBuddy plugin distributions can target a project-declared marketplace source.
 
 **Changed**
 
-- **Open-source license**: package, plugin manifests, README, LICENSE, and NOTICE now consistently use Apache-2.0.
-- **Identity separation**: project author and developer metadata names 广州市风荷科技有限公司, while the `ifoohoo` repository and Marketplace owner coordinates remain unchanged.
-- **Historical attribution**: existing contributor and company copyright notices remain; metadata and license changes do not assert a copyright transfer.
+- **Plan schema**: production plans carry the resolved codebuddy marketplace coordinates so approval and publish review the exact marketplace target.
+
+**Fixed**
+
+- **Configurable CodeBuddy marketplace**: codebuddy-plugin distributions now accept `marketplace` and `marketplaceSource` in project configuration, and prepare threads both values into the consumer install action instead of assuming a fixed marketplace.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.4.1 is the current source candidate; v0.4.0 remains
+> **Current boundary:** v0.4.2 is the current source candidate; v0.4.1 remains
 > the latest published release (v0.2.2 previously held
 > published status before the platform verification convergence fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
@@ -45,8 +47,8 @@ v0.4.1 is the unreleased source candidate that migrates release-skill to Apache
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.4.1 is the current
-> source candidate and v0.4.0 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
+> **Production path verified since the v0.1.1 milestone; v0.4.2 is the current
+> source candidate and v0.4.1 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
 > **Start here:**
@@ -501,6 +503,11 @@ verification is automated. Kimi Code and CodeBuddy/WorkBuddy are returned as
 `manualFollowUps` with `verifiedBySystem: false`; their completion is not a
 condition for the automated release to reach `VERIFIED`.
 
+A `codebuddy-plugin` distribution may optionally declare `marketplace` (and
+`marketplaceSource`, the URL consumers use to add the marketplace) to override
+the default unified marketplace `artifact-skill-set`; undeclared distributions
+keep the default and produce byte-identical frozen plans.
+
 For every npm distribution, `prepare` statically checks the exact packed
 tarball against concrete `package.json` entry targets. `publish` and
 `reconcile` repeat the same check on the frozen tarball before any remote

package/README.zh-CN.md

@@ -2,25 +2,27 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.4.1 -->
+<!-- release-skill:release-version: 0.4.2 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.4.1** (2026-08-03)
+**0.4.2** (2026-08-12)
 
-v0.4.1 是尚未发布的源码候选：将 release-skill 调整为 Apache License 2.0，并统一公开作者元数据，同时保留仓库 owner 与历史归属。
+v0.4.2 将 CodeBuddy 消费者市场改为按分发渠道可配置，不再硬编码单一市场，CodeBuddy 插件分发可以指向项目声明的市场来源。
 
 **变更**
 
-- **开源许可证**：package、插件清单、README、LICENSE 与 NOTICE 统一使用 Apache-2.0。
-- **身份分层**：项目作者和开发者字段使用广州市风荷科技有限公司，`ifoohoo` 仓库与 Marketplace owner 坐标保持不变。
-- **历史归属**：继续保留贡献者和公司的既有版权声明；元数据与许可证变化不声明版权转让。
+- **计划模式**：生产计划携带解析后的 CodeBuddy 市场坐标，审批与发布时可核对确切的市场目标。
+
+**修复**
+
+- **CodeBuddy 市场可配置**：codebuddy-plugin 分发在项目配置中接受 `marketplace` 与 `marketplaceSource`，prepare 将两个值透传进消费者安装动作，不再假定固定市场。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.4.1 是当前源码候选，v0.4.0 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.4.2 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -33,7 +35,7 @@ v0.4.1 是尚未发布的源码候选：将 release-skill 调整为 Apache Licen
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.4.1 是当前源码候选，v0.4.0 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.4.2 是当前源码候选，v0.4.1 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -449,6 +451,8 @@ hook 在 `prepare` 调用时运行，命令调用本身即授权执行。gate
 
 每个适配器闭包都自带 CLI、skills 和 schemas 副本，安装后无需外部依赖即可运行。Claude/Codex 验证是自动化的；Kimi Code 和 CodeBuddy/WorkBuddy 以 `manualFollowUps` 返回并标记 `verifiedBySystem: false`，其完成情况不阻塞自动发布进入 `VERIFIED`。
 
+`codebuddy-plugin` 分发可以可选地声明 `marketplace`（以及 `marketplaceSource`，即消费者添加市场所用的 URL）来覆盖默认统一市场 `artifact-skill-set`；未声明的分发保持默认值，冻结计划字节不变。
+
 每个 npm 分发在 `prepare` 时都会针对精确封装的 tarball 静态校验
 `package.json` 声明的具体入口。`publish` 与 `reconcile` 在任何远端动作前对同一
 冻结 tarball 重复校验，`verify` 则在允许进入 `VERIFIED` 前对精确安装目录重复校验。

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.4.1",
+      "version": "0.4.2",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,7 +9,7 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.4.1"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.4.2"});
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -17400,6 +17400,19 @@ function normalizePlanForDigest2(plan) {
   }
   return normalized;
 }
+function resolveCodeBuddyMarketplace(action) {
+  const marketplace = action?.marketplace ?? CODEBUDDY_MARKETPLACE_NAME;
+  if (typeof marketplace !== "string" || marketplace.length === 0) {
+    throw new Error(`codebuddy marketplace must be a non-empty string when declared, got ${JSON.stringify(action?.marketplace)}`);
+  }
+  return marketplace;
+}
+function resolveCodeBuddyMarketplaceSource(action) {
+  if (action?.marketplace === void 0 || action?.marketplace === null) {
+    return CODEBUDDY_MARKETPLACE_SOURCE;
+  }
+  return typeof action.marketplaceSource === "string" && action.marketplaceSource.length > 0 ? action.marketplaceSource : null;
+}
 async function resolveCodeBuddyBoundPlanDigest(context) {
   const plan = context?.plan;
   if (!plan || typeof plan !== "object" || Array.isArray(plan)) {
@@ -17440,12 +17453,14 @@ function buildCodeBuddyManualInstructions({
   version,
   ref,
   attestationDir,
-  requiresInstalledClosure
+  requiresInstalledClosure,
+  marketplace,
+  marketplaceSource
 }) {
   return [
     `CodeBuddy/WorkBuddy \u63D2\u4EF6\u5B89\u88C5\u65E0\u6CD5\u9501\u5B9A\u51BB\u7ED3 ref\uFF08codebuddy CLI marketplace add/install \u6CA1\u6709 ref \u9009\u9879\uFF0C\u8DDF\u8E2A\u9ED8\u8BA4\u5206\u652F\uFF09\uFF0C\u56E0\u6B64\u5B89\u88C5\u662F\u9700\u8981\u4EBA\u5DE5\u7ED3\u679C\u8BC1\u660E\u7684\u624B\u52A8\u6B65\u9AA4\u3002`,
     `1) publish \u5B8C\u6210\u6240\u6709\u8FDC\u7AEF\u5199\u5165\u540E\u8FDB\u5165 PUBLISHED \u72B6\u6001\uFF08\u81EA\u52A8\u5316 Git \u5206\u652F/\u6807\u7B7E\u3001npm \u548C GitHub Release \u5199\u5165\u5DF2\u5B8C\u6210\uFF09\u3002\u6B64 codebuddy \u68C0\u67E5\u70B9\u6807\u8BB0\u4E3A\u9700\u8981\u4EBA\u5DE5\u5B89\u88C5\u3002`,
-    `2) \u4ECE\u7EDF\u4E00\u5E02\u573A "${CODEBUDDY_MARKETPLACE_NAME}" (${CODEBUDDY_MARKETPLACE_SOURCE}) \u5B89\u88C5 release-skill\u3002\u786E\u8BA4\u5B89\u88C5\u7684\u63D2\u4EF6\u7248\u672C\u7B49\u4E8E\u51BB\u7ED3\u7248\u672C ${version}\u3002`,
+    `2) \u4ECE\u7EDF\u4E00\u5E02\u573A "${marketplace}"${marketplaceSource ? ` (${marketplaceSource})` : ""} \u5B89\u88C5 ${plugin}\u3002\u786E\u8BA4\u5B89\u88C5\u7684\u63D2\u4EF6\u7248\u672C\u7B49\u4E8E\u51BB\u7ED3\u7248\u672C ${version}\u3002`,
     `3) \u5C06\u4EBA\u5DE5\u7ED3\u679C JSON \u5199\u5165: ${attestationDir}/${CODEBUDDY_ATTESTATION_FILE}`,
     `   \u5FC5\u586B\u5B57\u6BB5: platform="codebuddy", version, planDigest\uFF08\u51BB\u7ED3\u8BA1\u5212\u6458\u8981\uFF09, result("passed" \u6216 "failed"), actor\uFF08\u786E\u8BA4\u4EBA\uFF09, confirmedAt\uFF08ISO 8601 \u65F6\u95F4\u6233\uFF09${requiresInstalledClosure ? '\uFF0CinstallChannel("desktop" \u6216 "cli")\uFF0CinstallPath\uFF08\u5B9E\u9645\u5B89\u88C5\u540E\u7684\u63D2\u4EF6\u76EE\u5F55\uFF09' : ""}`,
     `   \u53EF\u9009\u5B57\u6BB5: note\uFF08\u5907\u6CE8\uFF09`,
@@ -17509,12 +17524,29 @@ function validateCodeBuddyAttestation(attestation, action, isoNow, boundPlanDige
       return { valid: false, error: 'codebuddy attestation installPath must not contain path traversal ("..")', normalized: null };
     }
     if (normalized.installChannel === "cli") {
-      const expectedSuffix = `.workbuddy/plugins/marketplaces/${CODEBUDDY_MARKETPLACE_NAME}/plugins/${action.plugin}`;
+      let resolvedMarketplace;
+      try {
+        resolvedMarketplace = resolveCodeBuddyMarketplace(action);
+      } catch (resolveErr) {
+        return { valid: false, error: resolveErr.message, normalized: null };
+      }
+      const expectedSuffix = `.workbuddy/plugins/marketplaces/${resolvedMarketplace}/plugins/${action.plugin}`;
       if (!normalized.installPath.endsWith(expectedSuffix)) {
         return { valid: false, error: `codebuddy CLI attestation installPath must end with "${expectedSuffix}", got "${normalized.installPath}"`, normalized: null };
       }
     }
   }
+  if (normalized.marketplace !== void 0) {
+    let resolvedMarketplace;
+    try {
+      resolvedMarketplace = resolveCodeBuddyMarketplace(action);
+    } catch (resolveErr) {
+      return { valid: false, error: resolveErr.message, normalized: null };
+    }
+    if (normalized.marketplace !== resolvedMarketplace) {
+      return { valid: false, error: `codebuddy attestation marketplace "${normalized.marketplace}" does not match the resolved marketplace "${resolvedMarketplace}"`, normalized: null };
+    }
+  }
   if (normalized.result !== "passed" && normalized.result !== "failed") {
     return { valid: false, error: `codebuddy attestation result "${normalized.result}" must be "passed" or "failed"`, normalized: null };
   }
@@ -17607,6 +17639,17 @@ async function executeCodeBuddyManualRequirement(action, context) {
     });
   }
   const ref = action.ref ?? `v${action.version}`;
+  let marketplace;
+  try {
+    marketplace = resolveCodeBuddyMarketplace(action);
+  } catch (marketplaceErr) {
+    return createResult({
+      actionType,
+      status: ActionStatus.EXECUTE_FAILED,
+      error: marketplaceErr.message
+    });
+  }
+  const marketplaceSource = resolveCodeBuddyMarketplaceSource(action);
   let attestationDir;
   try {
     attestationDir = codebuddyAuthorityDir(context, planDigest, action.plugin);
@@ -17622,7 +17665,9 @@ async function executeCodeBuddyManualRequirement(action, context) {
     version: action.version,
     ref,
     attestationDir,
-    requiresInstalledClosure: Boolean(context.plan?.skillResourceClosure)
+    requiresInstalledClosure: Boolean(context.plan?.skillResourceClosure),
+    marketplace,
+    marketplaceSource
   });
   const requirement = {
     kind: "codebuddy-manual-install-requirement",
@@ -17632,6 +17677,8 @@ async function executeCodeBuddyManualRequirement(action, context) {
     repo: action.repo,
     ref,
     entrySkill: action.entrySkill,
+    marketplace,
+    ...marketplaceSource ? { marketplaceSource } : {},
     planDigest,
     attestationDir,
     attestationFile: CODEBUDDY_ATTESTATION_FILE,
@@ -17644,7 +17691,7 @@ async function executeCodeBuddyManualRequirement(action, context) {
       confirmedAt: "<ISO 8601 timestamp>",
       ...context.plan?.skillResourceClosure ? {
         installChannel: '<"desktop" or "cli">',
-        installPath: `<actual .workbuddy/plugins/marketplaces/${CODEBUDDY_MARKETPLACE_NAME}/plugins/${action.plugin} directory>`
+        installPath: `<actual .workbuddy/plugins/marketplaces/${marketplace}/plugins/${action.plugin} directory>`
       } : {},
       note: "<optional note>"
     },
@@ -17736,6 +17783,8 @@ var init_codebuddy = __esm({
     CODEBUDDY_ATTESTATION_FILE = "release-skill-codebuddy-attestation.json";
     CODEBUDDY_MARKETPLACE_NAME = "artifact-skill-set";
     CODEBUDDY_MARKETPLACE_SOURCE = "https://github.com/ifoohoo/artifact-skill-set";
+    __name(resolveCodeBuddyMarketplace, "resolveCodeBuddyMarketplace");
+    __name(resolveCodeBuddyMarketplaceSource, "resolveCodeBuddyMarketplaceSource");
     CODEBUDDY_PLUGIN_MANIFEST_RELATIVE = join4(".codebuddy-plugin", "plugin.json");
     CODEBUDDY_MAX_ATTESTATION_VALIDITY_MS = 24 * 60 * 60 * 1e3;
     __name(resolveCodeBuddyBoundPlanDigest, "resolveCodeBuddyBoundPlanDigest");
@@ -18465,9 +18514,10 @@ var init_registry = __esm({
         marketplace: ".claude-plugin/marketplace.json"
       }),
       marketplaceSourceForm: null,
-      // codebuddy installs from a unified marketplace but carries no marketplace
-      // identity in the action (the marketplace is a fixed constant in
-      // ./codebuddy.mjs); the entry-version binding does not apply (null = N/A).
+      // codebuddy installs from a unified marketplace whose identity is optional
+      // on the action: a distribution may declare `marketplace` to override the
+      // default constant in ./codebuddy.mjs (resolveCodeBuddyMarketplace); the
+      // entry-version binding does not apply either way (null = N/A).
       marketplaceEntryCarriesVersion: null,
       // codebuddy has no marketplace add that can pin a frozen ref (attestation
       // loop instead), so the marketplace ref form does not apply (null = N/A).
@@ -74267,15 +74317,16 @@ function createPluginMarketplaceAdapter(deps = {}) {
             try {
               attestation = JSON.parse(await readFile18(resolve21(attestationDir, CODEBUDDY_ATTESTATION_FILE), "utf8"));
             } catch {
+              const marketplaceSource = resolveCodeBuddyMarketplaceSource(action);
               return createResult({
                 actionType,
                 status: ActionStatus.OBSERVED,
                 observation: {
                   installed: false,
                   manualInstallRequired: true,
-                  marketplaceSource: CODEBUDDY_MARKETPLACE_SOURCE,
+                  ...marketplaceSource ? { marketplaceSource } : {},
                   attestationDir,
-                  error: `codebuddy attestation is missing; write ${resolve21(attestationDir, CODEBUDDY_ATTESTATION_FILE)} after the manual install (marketplace ${CODEBUDDY_MARKETPLACE_SOURCE})`
+                  error: `codebuddy attestation is missing; write ${resolve21(attestationDir, CODEBUDDY_ATTESTATION_FILE)} after the manual install${marketplaceSource ? ` (marketplace ${marketplaceSource})` : ""}`
                 }
               });
             }
@@ -74328,7 +74379,17 @@ function createPluginMarketplaceAdapter(deps = {}) {
                 });
               }
               const normalizedPath = normalizedAttestation.installPath.replaceAll("\\", "/");
-              const expectedSuffix = `.workbuddy/plugins/marketplaces/${CODEBUDDY_MARKETPLACE_NAME}/plugins/${action.plugin}`;
+              let resolvedMarketplace;
+              try {
+                resolvedMarketplace = resolveCodeBuddyMarketplace(action);
+              } catch (resolveErr) {
+                return createResult({
+                  actionType,
+                  status: ActionStatus.OBSERVED,
+                  observation: { installed: false, error: resolveErr.message }
+                });
+              }
+              const expectedSuffix = `.workbuddy/plugins/marketplaces/${resolvedMarketplace}/plugins/${action.plugin}`;
               if (!normalizedPath.endsWith(expectedSuffix)) {
                 return createResult({
                   actionType,
@@ -80887,7 +80948,6 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets, e
       for (const platform of PLATFORMS) {
         const dist = frozenUnitDists ? frozenUnitDists.find((d) => d.type === platform.distributionType) : (unit.distributions ?? []).find((d) => d.type === platform.distributionType);
         if (!dist) continue;
-        const requiresMarketplace = platform.schemaRequiredFields.includes("marketplace");
         const timeoutMs = Number.isInteger(dist.timeoutMs) ? dist.timeoutMs : 3e5;
         const externalMarketplace = dist.marketplaceRepo !== void 0 && dist.marketplaceRepo !== null;
         const marketplaceSourceType = dist.marketplaceSourceType ?? (externalMarketplace ? "standalone-index" : "bundled-family");
@@ -80921,7 +80981,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets, e
           parameters: {
             consumer: platform.id,
             plugin: dist.plugin,
-            ...requiresMarketplace ? { marketplace: dist.marketplace } : {},
+            ...dist.marketplace !== void 0 ? { marketplace: dist.marketplace } : {},
+            ...dist.marketplaceSource !== void 0 ? { marketplaceSource: dist.marketplaceSource } : {},
             repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
             version,
             entrySkill: dist.entrySkill,
@@ -80948,7 +81009,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets, e
           expected: {
             installed: true,
             plugin: dist.plugin,
-            ...requiresMarketplace ? { marketplace: dist.marketplace } : {},
+            ...dist.marketplace !== void 0 ? { marketplace: dist.marketplace } : {},
+            ...dist.marketplaceSource !== void 0 ? { marketplaceSource: dist.marketplaceSource } : {},
             version,
             entrySkill: dist.entrySkill,
             ...externalMarketplace ? { marketplaceLocation: "external", repo: dist.marketplaceRepo } : {}
@@ -81085,7 +81147,6 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets, e
     for (const platform of PLATFORMS) {
       const dist = frozenUnitDists ? frozenUnitDists.find((d) => d.type === platform.distributionType) : (unit.distributions ?? []).find((d) => d.type === platform.distributionType);
       if (!dist) continue;
-      const requiresMarketplace = platform.schemaRequiredFields.includes("marketplace");
       const timeoutMs = Number.isInteger(dist.timeoutMs) ? dist.timeoutMs : 3e5;
       const externalMarketplace = dist.marketplaceRepo !== void 0 && dist.marketplaceRepo !== null;
       const freeze = externalMarketplace ? externalFreezes.get(`${unit.id} ${dist.type}`) : null;
@@ -81119,7 +81180,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets, e
         parameters: {
           consumer: platform.id,
           plugin: dist.plugin,
-          ...requiresMarketplace ? { marketplace: dist.marketplace } : {},
+          ...dist.marketplace !== void 0 ? { marketplace: dist.marketplace } : {},
+          ...dist.marketplaceSource !== void 0 ? { marketplaceSource: dist.marketplaceSource } : {},
           repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
           ref: externalMarketplace ? freeze.ref : resolvedTag,
           version: unitVersion,
@@ -81158,7 +81220,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets, e
           installed: true,
           consumer: platform.id,
           plugin: dist.plugin,
-          ...requiresMarketplace ? { marketplace: dist.marketplace } : {},
+          ...dist.marketplace !== void 0 ? { marketplace: dist.marketplace } : {},
+          ...dist.marketplaceSource !== void 0 ? { marketplaceSource: dist.marketplaceSource } : {},
           repo: externalMarketplace ? dist.marketplaceRepo : unit.publicRepo,
           version: unitVersion,
           ref: externalMarketplace ? freeze.ref : resolvedTag,

package/adapters/claude/schemas/release-plan.schema.json

@@ -398,6 +398,11 @@
                   "minLength": 1,
                   "pattern": "^[a-z0-9][a-z0-9._-]*$"
                 },
+                "marketplaceSource": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "消费者添加统一市场所用的来源 URL（如 codebuddy plugin marketplace add）；可选，仅在可知时声明"
+                },
                 "marketplaceRepo": {
                   "type": "string",
                   "pattern": "^[a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._-]*$",

package/adapters/claude/schemas/release-project.schema.json

@@ -191,6 +191,11 @@
                   "minLength": 1,
                   "pattern": "^[a-z0-9][a-z0-9._-]*$"
                 },
+                "marketplaceSource": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "消费者添加统一市场所用的来源 URL（如 codebuddy plugin marketplace add）；可选，仅在可知时声明"
+                },
                 "marketplaceRepo": {
                   "type": "string",
                   "pattern": "^[a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._-]*$",

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.4.1.",
+      "Prepare a release plan for version 0.4.2.",
       "Help me understand the release workflow."
     ]
   }