release-skill 0.6.0 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/references/05-evidence-and-errors.md

@@ -32,6 +32,7 @@
 | `NOT_DEFAULT` | 配置分支不是远端实际默认分支 | 默认分支在 prepare 后改变，或配置错误 | 人工确认远端默认分支，更新配置并重新 prepare |
 | `CONTENT_MISMATCH` | 远端默认分支缺少冻结源码内容 | README、版本源、公开映射输入的内容或 mode 不一致 | 人工 merge/adopt/reject；接受的内容进入默认分支后重试 publish |
 | `DIRTY_SOURCE_INPUT` | 源码输入闭包存在未提交变化 | `publicFiles.from` 或 `version.source` 有 staged、unstaged、untracked 变化 | 提交或撤销这些具体输入的变化后重新 prepare；无关 dirty 不受影响 |
+| `BUNDLE_STALE` | bundle 与其源码输入失步（fail-closed 前置门禁） | `bin/release-skill.bundle.mjs` 内嵌的源码摘要与当前 `src/` 摘要不一致，或 bundle/内嵌摘要缺失；在 prepare 加载 config 后的早期阶段检测，任何 workflow 均不可豁免 | 按错误提示在 release-skill 包根运行 `node scripts/build-bundle.mjs`（或 `pnpm build`）重建 bundle 后重新 prepare |
 
 **动作状态码** (adapter execute/observe/verify):
 

package/schemas/release-plan.schema.json

@@ -863,6 +863,13 @@
               "findingCount": {
                 "const": 0
               },
+              "preparedAt": {
+                "type": ["string", "null"],
+                "description": "Deterministic freeze timestamp of the prepare run that produced this receipt (production: the baseline HEAD commit committer date in canonical UTC form; non-production: null). Never a wall-clock sample, so identical sources freeze byte-identical receipts."
+              },
+              "exitCode": {
+                "const": 0
+              },
               "receiptDigest": {
                 "type": "string",
                 "pattern": "^[a-f0-9]{64}$"
@@ -877,6 +884,8 @@
               "referenceCount",
               "sourceOnlyCount",
               "findingCount",
+              "preparedAt",
+              "exitCode",
               "receiptDigest"
             ]
           }

package/schemas/release-project.schema.json

@@ -873,6 +873,14 @@
           },
           "uniqueItems": true,
           "description": "Root-relative globs declaring the hook's full input set (source, scripts, config, lockfiles). The cache key fingerprints the content of every matched file; a glob that matches nothing fails closed. Must cover ALL inputs or the cache can return a false hit."
+        },
+        "testSelection": {
+          "type": "string",
+          "enum": [
+            "full",
+            "incremental"
+          ],
+          "description": "Only meaningful for the test hook: which test selection the hook command runs. Absence or 'full' means the hook runs the full suite, which prepare's built-in full-test freeze gate requires before the plan digest is computed. 'incremental' is reserved for a future preflight mode and is rejected at freeze time ('incremental selection is not allowed at freeze time'). Built-in gate; cannot be disabled by project overlays."
         }
       }
     },

package/scripts/build-bundle.mjs

@@ -21,6 +21,7 @@ import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
+import { computeBundleSourceDigest } from '../src/core/bundle-freshness.mjs';
 
 const CHECK_MODE = process.argv.includes('--check');
 
@@ -38,7 +39,12 @@ const OUTFILE = join(PKG_ROOT, 'bin', 'release-skill.bundle.mjs');
 // dependency: the Claude and Codex adapter closures ship the bundle at a
 // different depth with no package.json next to it, while the npm closure does.
 // Reading package.json here (build input) keeps the output deterministic.
-function buildBanner(pkgIdentity) {
+//
+// __bundleSourceDigest is the build-time digest of the bundle's source inputs
+// (src/, skills-src/, bin/release-skill-cli.mjs, package.json — algorithm in
+// src/core/bundle-freshness.mjs). prepare's BUNDLE_STALE gate recomputes the
+// digest and fails closed on any mismatch (2026-08-18 investigation §4.2).
+function buildBanner(pkgIdentity, sourceDigest) {
   return `\
 // --- release-skill bundle (deterministic build) ---
 // Compute package root from the bundle's own file location (import.meta.url).
@@ -51,6 +57,8 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
 const __bundlePkg = Object.freeze(${JSON.stringify(pkgIdentity)});
+// Build-time source digest for the BUNDLE_STALE freshness gate (see above).
+const __bundleSourceDigest = "${sourceDigest}";
 `;
 }
 
@@ -164,7 +172,8 @@ async function buildBundle() {
   }
 
   const pkgJson = JSON.parse(await readFile(join(PKG_ROOT, 'package.json'), 'utf-8'));
-  const banner = buildBanner({ name: pkgJson.name, version: pkgJson.version });
+  const sourceDigest = await computeBundleSourceDigest(PKG_ROOT);
+  const banner = buildBanner({ name: pkgJson.name, version: pkgJson.version }, sourceDigest);
 
   const identity = Object.freeze({ name: pkgJson.name, version: pkgJson.version });
 

package/scripts/sync-public-files.mjs

@@ -232,6 +232,9 @@ async function collectEntries(packageRoot) {
   //                           a distribution artifact; the shipped bundle
   //                           inlines the adopted capability — matches the npm
   //                           pack closure contract)
+  //    - .release-skill/     (local release runtime state — runs, plans, locks;
+  //                           not in the package.json files whitelist, so it is
+  //                           never part of the npm pack closure)
   const baseFiles = allFiles.filter((f) => {
     if (f.startsWith('adapters/')) return false;
     if (f.startsWith('test/')) return false;
@@ -240,6 +243,7 @@ async function collectEntries(packageRoot) {
     if (f.startsWith('native/') && f.includes('/build/')) return false;
     if (f.startsWith('scripts/')) return false;
     if (f.startsWith('vendor/')) return false;
+    if (f.startsWith('.release-skill/')) return false;
     return true;
   });
 

package/src/commands/lineage.mjs

@@ -27,7 +27,7 @@
  * @module commands/lineage
  */
 
-import { execFile as execFileCb } from 'node:child_process';
+import { execFile as execFileCb, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 
 const execFile = promisify(execFileCb);
@@ -132,6 +132,50 @@ async function git(root, args, options = {}) {
   return stdout.trim();
 }
 
+/**
+ * Run a git command and return RAW stdout (no trimming). Trailing bytes are
+ * significant for `cat-file commit` output: the message tail (trailing
+ * whitespace / blank lines) must survive untouched.
+ */
+async function gitRaw(root, args, options = {}) {
+  const { stdout } = await execFile('git', args, {
+    cwd: root,
+    encoding: 'utf8',
+    maxBuffer: 64 * 1024 * 1024,
+    ...options,
+  });
+  return stdout;
+}
+
+/**
+ * Parse a commit ident line — the value of an `author`/`committer` header in
+ * the raw commit object — of the canonical form `Name <email> ts tz`.
+ *
+ * The anchored regex uses a greedy `.*` so the LAST ` <email> ts tz` group at
+ * the end of the line wins: names containing spaces (or even '<'/'>' — legal
+ * in stored objects) still resolve correctly. This replaces the broken
+ * `split(/\s+>/)` parsing, which never matched a legal ident line (there is
+ * no whitespace before '>') and silently produced name=<entire line>,
+ * email='' — corrupting identities written by `commit-tree` during rebuild
+ * (SFA field report 2026-08-18).
+ *
+ * @param {string} line - e.g. `乌龙 <2505468+mzdbxqh@users.noreply.github.com> 1785824474 +0000`
+ * @returns {{ name: string, email: string, ts: string, tz: string }}
+ * @throws {Error} when the line is not a valid ident line. Fail-closed:
+ *   rebuild must never fabricate or silently write an empty identity.
+ */
+export function parseCommitIdent(line) {
+  if (typeof line !== 'string') {
+    throw new Error(`commit ident line must be a string, got ${typeof line}`);
+  }
+  const match = line.match(/^(.*) <([^>]*)> (\d+) ([+-]\d{4})$/);
+  if (!match) {
+    throw new Error(`unparseable commit ident line (fail-closed): "${line}"`);
+  }
+  const [, name, email, ts, tz] = match;
+  return { name, email, ts, tz };
+}
+
 /**
  * List all tags with their commit SHAs.
  *
@@ -201,45 +245,44 @@ export async function objectExists(root, sha) {
 /**
  * Read the raw commit object and extract identity/date fields.
  *
+ * The cat-file output is NOT trimmed: the header block and the message are
+ * split at the first blank line and the message tail bytes (trailing
+ * whitespace / blank lines) are preserved exactly, so a rebuilt commit can
+ * carry byte-identical message bytes.
+ *
  * @param {string} root - repository root
  * @param {string} commitSha - commit SHA
  * @returns {Promise<{ message: string, author: { name: string, email: string, date: string }, committer: { name: string, email: string, date: string } }>}
+ * @throws {Error} when the object is malformed or an ident line does not
+ *   parse (fail-closed — never fabricate or silently write empty identity).
  */
 export async function readCommitMeta(root, commitSha) {
-  const raw = await git(root, ['cat-file', 'commit', commitSha]);
-  const lines = raw.split('\n');
+  const raw = await gitRaw(root, ['cat-file', 'commit', commitSha]);
+  const separator = raw.indexOf('\n\n');
+  if (separator === -1) {
+    throw new Error(`malformed commit object ${commitSha}: missing header/message separator`);
+  }
+  const message = raw.slice(separator + 2);
   const headers = {};
-  const messageLines = [];
-  let inBody = false;
-  for (const line of lines) {
-    if (inBody) {
-      messageLines.push(line);
-      continue;
-    }
-    if (line === '') {
-      inBody = true;
-      continue;
-    }
-    const colon = line.indexOf(' ');
-    if (colon === -1) continue;
-    const key = line.slice(0, colon);
-    const value = line.slice(colon + 1);
-    headers[key] = value;
+  for (const line of raw.slice(0, separator).split('\n')) {
+    if (line.startsWith(' ')) continue; // continuation line (e.g. gpgsig)
+    const space = line.indexOf(' ');
+    if (space === -1) continue;
+    headers[line.slice(0, space)] = line.slice(space + 1);
   }
-  const message = messageLines.join('\n');
-  const authorParts = (headers.author ?? '').split(/\s+>/);
-  const committerParts = (headers.committer ?? '').split(/\s+>/);
+  const author = parseCommitIdent(headers.author ?? '');
+  const committer = parseCommitIdent(headers.committer ?? '');
   return {
     message,
     author: {
-      name: authorParts[0] ?? '',
-      email: (authorParts[1] ?? '').replace(/^</, '').replace(/\d+ [+-]\d{4}$/, '').trim(),
-      date: (headers.author ?? '').match(/(\d+ [+-]\d{4})$/)?.[1] ?? '',
+      name: author.name,
+      email: author.email,
+      date: `${author.ts} ${author.tz}`,
     },
     committer: {
-      name: committerParts[0] ?? '',
-      email: (committerParts[1] ?? '').replace(/^</, '').replace(/\d+ [+-]\d{4}$/, '').trim(),
-      date: (headers.committer ?? '').match(/(\d+ [+-]\d{4})$/)?.[1] ?? '',
+      name: committer.name,
+      email: committer.email,
+      date: `${committer.ts} ${committer.tz}`,
     },
   };
 }
@@ -384,20 +427,25 @@ export async function analyzeLineage(root) {
  * Create a rebuilt commit object with `commit-tree`, preserving the original
  * author/committer identity and dates via environment variables.
  *
+ * The message is delivered via stdin (`-F -`) rather than `-m`: `commit-tree
+ * -m` strips trailing blank lines, while stdin preserves the original message
+ * bytes exactly (including trailing whitespace), so a rebuilt node can be
+ * byte-identical to the original commit.
+ *
  * Writes ONLY a commit object into the local object database. Never writes a
  * ref and never pushes.
  *
  * @param {string} root - repository root
  * @param {string} treeSha - tree hash for the rebuilt commit
  * @param {string|null} parentSha - parent commit (null → chain root)
- * @param {string} message - commit message
+ * @param {string} message - commit message (exact bytes)
  * @param {{ author: {name: string, email: string, date: string}, committer: {name: string, email: string, date: string} }} identity
  * @returns {Promise<string>} rebuilt commit SHA
  */
 export async function createRebuiltCommit(root, treeSha, parentSha, message, identity) {
   const args = ['commit-tree', treeSha];
   if (parentSha) args.push('-p', parentSha);
-  args.push('-m', message);
+  args.push('-F', '-');
   const env = {
     ...process.env,
     GIT_AUTHOR_NAME: identity.author.name,
@@ -407,8 +455,29 @@ export async function createRebuiltCommit(root, treeSha, parentSha, message, ide
     GIT_COMMITTER_EMAIL: identity.committer.email,
     GIT_COMMITTER_DATE: identity.committer.date,
   };
-  const { stdout } = await execFile('git', args, { cwd: root, encoding: 'utf8', env });
-  return stdout.trim();
+  // Async execFile has no stdin-input support (options.input would be ignored
+  // and the child would hang waiting on an open stdin), so spawn is used to
+  // deliver the exact message bytes on stdin.
+  return new Promise((resolvePromise, rejectPromise) => {
+    const child = spawn('git', args, { cwd: root, env });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => { stdout += chunk; });
+    child.stderr.on('data', (chunk) => { stderr += chunk; });
+    child.on('error', rejectPromise);
+    child.on('close', (code) => {
+      if (code !== 0) {
+        rejectPromise(new Error(`git commit-tree failed (exit ${code}): ${stderr.trim()}`));
+        return;
+      }
+      resolvePromise(stdout.trim());
+    });
+    child.stdin.on('error', () => {}); // EPIPE after early exit is reported via close
+    child.stdin.write(message);
+    child.stdin.end();
+  });
 }
 
 /**