release-skill 0.6.1 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/schemas/release-plan.schema.json

@@ -863,6 +863,13 @@
               "findingCount": {
                 "const": 0
               },
+              "preparedAt": {
+                "type": ["string", "null"],
+                "description": "Deterministic freeze timestamp of the prepare run that produced this receipt (production: the baseline HEAD commit committer date in canonical UTC form; non-production: null). Never a wall-clock sample, so identical sources freeze byte-identical receipts."
+              },
+              "exitCode": {
+                "const": 0
+              },
               "receiptDigest": {
                 "type": "string",
                 "pattern": "^[a-f0-9]{64}$"
@@ -877,6 +884,8 @@
               "referenceCount",
               "sourceOnlyCount",
               "findingCount",
+              "preparedAt",
+              "exitCode",
               "receiptDigest"
             ]
           }

package/src/commands/lineage.mjs

@@ -27,7 +27,7 @@
  * @module commands/lineage
  */
 
-import { execFile as execFileCb } from 'node:child_process';
+import { execFile as execFileCb, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 
 const execFile = promisify(execFileCb);
@@ -132,6 +132,50 @@ async function git(root, args, options = {}) {
   return stdout.trim();
 }
 
+/**
+ * Run a git command and return RAW stdout (no trimming). Trailing bytes are
+ * significant for `cat-file commit` output: the message tail (trailing
+ * whitespace / blank lines) must survive untouched.
+ */
+async function gitRaw(root, args, options = {}) {
+  const { stdout } = await execFile('git', args, {
+    cwd: root,
+    encoding: 'utf8',
+    maxBuffer: 64 * 1024 * 1024,
+    ...options,
+  });
+  return stdout;
+}
+
+/**
+ * Parse a commit ident line — the value of an `author`/`committer` header in
+ * the raw commit object — of the canonical form `Name <email> ts tz`.
+ *
+ * The anchored regex uses a greedy `.*` so the LAST ` <email> ts tz` group at
+ * the end of the line wins: names containing spaces (or even '<'/'>' — legal
+ * in stored objects) still resolve correctly. This replaces the broken
+ * `split(/\s+>/)` parsing, which never matched a legal ident line (there is
+ * no whitespace before '>') and silently produced name=<entire line>,
+ * email='' — corrupting identities written by `commit-tree` during rebuild
+ * (SFA field report 2026-08-18).
+ *
+ * @param {string} line - e.g. `乌龙 <2505468+mzdbxqh@users.noreply.github.com> 1785824474 +0000`
+ * @returns {{ name: string, email: string, ts: string, tz: string }}
+ * @throws {Error} when the line is not a valid ident line. Fail-closed:
+ *   rebuild must never fabricate or silently write an empty identity.
+ */
+export function parseCommitIdent(line) {
+  if (typeof line !== 'string') {
+    throw new Error(`commit ident line must be a string, got ${typeof line}`);
+  }
+  const match = line.match(/^(.*) <([^>]*)> (\d+) ([+-]\d{4})$/);
+  if (!match) {
+    throw new Error(`unparseable commit ident line (fail-closed): "${line}"`);
+  }
+  const [, name, email, ts, tz] = match;
+  return { name, email, ts, tz };
+}
+
 /**
  * List all tags with their commit SHAs.
  *
@@ -201,45 +245,44 @@ export async function objectExists(root, sha) {
 /**
  * Read the raw commit object and extract identity/date fields.
  *
+ * The cat-file output is NOT trimmed: the header block and the message are
+ * split at the first blank line and the message tail bytes (trailing
+ * whitespace / blank lines) are preserved exactly, so a rebuilt commit can
+ * carry byte-identical message bytes.
+ *
  * @param {string} root - repository root
  * @param {string} commitSha - commit SHA
  * @returns {Promise<{ message: string, author: { name: string, email: string, date: string }, committer: { name: string, email: string, date: string } }>}
+ * @throws {Error} when the object is malformed or an ident line does not
+ *   parse (fail-closed — never fabricate or silently write empty identity).
  */
 export async function readCommitMeta(root, commitSha) {
-  const raw = await git(root, ['cat-file', 'commit', commitSha]);
-  const lines = raw.split('\n');
+  const raw = await gitRaw(root, ['cat-file', 'commit', commitSha]);
+  const separator = raw.indexOf('\n\n');
+  if (separator === -1) {
+    throw new Error(`malformed commit object ${commitSha}: missing header/message separator`);
+  }
+  const message = raw.slice(separator + 2);
   const headers = {};
-  const messageLines = [];
-  let inBody = false;
-  for (const line of lines) {
-    if (inBody) {
-      messageLines.push(line);
-      continue;
-    }
-    if (line === '') {
-      inBody = true;
-      continue;
-    }
-    const colon = line.indexOf(' ');
-    if (colon === -1) continue;
-    const key = line.slice(0, colon);
-    const value = line.slice(colon + 1);
-    headers[key] = value;
+  for (const line of raw.slice(0, separator).split('\n')) {
+    if (line.startsWith(' ')) continue; // continuation line (e.g. gpgsig)
+    const space = line.indexOf(' ');
+    if (space === -1) continue;
+    headers[line.slice(0, space)] = line.slice(space + 1);
   }
-  const message = messageLines.join('\n');
-  const authorParts = (headers.author ?? '').split(/\s+>/);
-  const committerParts = (headers.committer ?? '').split(/\s+>/);
+  const author = parseCommitIdent(headers.author ?? '');
+  const committer = parseCommitIdent(headers.committer ?? '');
   return {
     message,
     author: {
-      name: authorParts[0] ?? '',
-      email: (authorParts[1] ?? '').replace(/^</, '').replace(/\d+ [+-]\d{4}$/, '').trim(),
-      date: (headers.author ?? '').match(/(\d+ [+-]\d{4})$/)?.[1] ?? '',
+      name: author.name,
+      email: author.email,
+      date: `${author.ts} ${author.tz}`,
     },
     committer: {
-      name: committerParts[0] ?? '',
-      email: (committerParts[1] ?? '').replace(/^</, '').replace(/\d+ [+-]\d{4}$/, '').trim(),
-      date: (headers.committer ?? '').match(/(\d+ [+-]\d{4})$/)?.[1] ?? '',
+      name: committer.name,
+      email: committer.email,
+      date: `${committer.ts} ${committer.tz}`,
     },
   };
 }
@@ -384,20 +427,25 @@ export async function analyzeLineage(root) {
  * Create a rebuilt commit object with `commit-tree`, preserving the original
  * author/committer identity and dates via environment variables.
  *
+ * The message is delivered via stdin (`-F -`) rather than `-m`: `commit-tree
+ * -m` strips trailing blank lines, while stdin preserves the original message
+ * bytes exactly (including trailing whitespace), so a rebuilt node can be
+ * byte-identical to the original commit.
+ *
  * Writes ONLY a commit object into the local object database. Never writes a
  * ref and never pushes.
  *
  * @param {string} root - repository root
  * @param {string} treeSha - tree hash for the rebuilt commit
  * @param {string|null} parentSha - parent commit (null → chain root)
- * @param {string} message - commit message
+ * @param {string} message - commit message (exact bytes)
  * @param {{ author: {name: string, email: string, date: string}, committer: {name: string, email: string, date: string} }} identity
  * @returns {Promise<string>} rebuilt commit SHA
  */
 export async function createRebuiltCommit(root, treeSha, parentSha, message, identity) {
   const args = ['commit-tree', treeSha];
   if (parentSha) args.push('-p', parentSha);
-  args.push('-m', message);
+  args.push('-F', '-');
   const env = {
     ...process.env,
     GIT_AUTHOR_NAME: identity.author.name,
@@ -407,8 +455,29 @@ export async function createRebuiltCommit(root, treeSha, parentSha, message, ide
     GIT_COMMITTER_EMAIL: identity.committer.email,
     GIT_COMMITTER_DATE: identity.committer.date,
   };
-  const { stdout } = await execFile('git', args, { cwd: root, encoding: 'utf8', env });
-  return stdout.trim();
+  // Async execFile has no stdin-input support (options.input would be ignored
+  // and the child would hang waiting on an open stdin), so spawn is used to
+  // deliver the exact message bytes on stdin.
+  return new Promise((resolvePromise, rejectPromise) => {
+    const child = spawn('git', args, { cwd: root, env });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => { stdout += chunk; });
+    child.stderr.on('data', (chunk) => { stderr += chunk; });
+    child.on('error', rejectPromise);
+    child.on('close', (code) => {
+      if (code !== 0) {
+        rejectPromise(new Error(`git commit-tree failed (exit ${code}): ${stderr.trim()}`));
+        return;
+      }
+      resolvePromise(stdout.trim());
+    });
+    child.stdin.on('error', () => {}); // EPIPE after early exit is reported via close
+    child.stdin.write(message);
+    child.stdin.end();
+  });
 }
 
 /**

package/src/commands/prepare.mjs

@@ -41,6 +41,7 @@ import {
   CHECKER_VERSION as SKILL_RESOURCE_CHECKER_VERSION,
   checkSkillResourceClosure,
   createSkillResourceClosureReceipt,
+  evaluateDeclaredHostSurfaceCoverage,
 } from '../core/skill-resource-closure.mjs';
 import { buildPublicStaging } from '../snapshot/public-map.mjs';
 import { resolveUnitScopedPath } from '../snapshot/public-path.mjs';
@@ -2858,7 +2859,16 @@ export async function prepareRelease(options) {
           host: 'root',
         });
 
-        const receipt = createSkillResourceClosureReceipt(closureResult, { unitId: unit.id });
+        // G5: bind execution time + exit code into the frozen receipt.
+        // preparedAt reuses this prepare's deterministic freeze timestamp
+        // (production: the baseline HEAD commit committer date; otherwise
+        // null) — never a wall-clock sample — so identical sources freeze
+        // byte-identical receipts on every re-prepare.
+        const receipt = createSkillResourceClosureReceipt(closureResult, {
+          unitId: unit.id,
+          preparedAt: freezeTimestamp ?? null,
+          exitCode: 0,
+        });
         skillResourceClosureResults.push(receipt);
 
         if (closureResult.findings.length > 0) {
@@ -2873,6 +2883,9 @@ export async function prepareRelease(options) {
               reference: f.reference,
               classification: f.classification,
               code: f.code,
+              // D4: RESOURCE_DRIFT findings localize via references (the
+              // finding's own skill/line stay null for a cross-surface drift).
+              ...(f.references ? { references: f.references } : {}),
             })),
           });
           throw new ReleaseError(
@@ -2886,6 +2899,47 @@ export async function prepareRelease(options) {
           );
         }
 
+        // G4: every declared plugin distribution must be backed by a host
+        // surface in the frozen snapshot with at least one skill. If
+        // publicFiles drops an adapter tree, that host surface is silently
+        // absent from the receipt — fail closed here instead of shipping a
+        // unit whose declared host never entered the closure gate.
+        // Expected host names are the adapter directory names declared by the
+        // platform registry (buildAdapter.name, asserted non-empty by
+        // assertRegistry); codebuddy-plugin keeps the historical `workbuddy`
+        // adapter directory name there. npm-only units declare no plugin
+        // hosts and skip.
+        const expectedHosts = (unit.distributions ?? [])
+          .map((distribution) => PLATFORMS.find((platform) => platform.distributionType === distribution.type))
+          .filter(Boolean)
+          .map((platform) => platform.buildAdapter.name);
+        const hostCoverage = evaluateDeclaredHostSurfaceCoverage(
+          expectedHosts,
+          closureResult.surfaces,
+        );
+        if (!hostCoverage.passed) {
+          await evidence.append({
+            phase: 'skill-resource-closure',
+            status: 'blocking',
+            unitId: unit.id,
+            reason: 'declared-host-surface-missing',
+            missingHosts: hostCoverage.missing,
+          });
+          throw new ReleaseError(
+            GATE_FAILED,
+            `skill resource closure gate failed for unit "${unit.id}": declared host surface(s) missing or empty: ${hostCoverage.missing.map((item) => item.host).join(', ')}`,
+            {
+              unitId: unit.id,
+              missingHosts: hostCoverage.missing,
+              observedSurfaces: closureResult.surfaces.map((surface) => ({
+                id: surface.id,
+                host: surface.host,
+                skillCount: surface.skillCount,
+              })),
+            },
+          );
+        }
+
         await evidence.append({
           phase: 'skill-resource-closure',
           status: 'completed',
@@ -2895,6 +2949,10 @@ export async function prepareRelease(options) {
           skillCount: receipt.skillCount,
           referenceCount: closureResult.referenceCount,
           sourceOnlyCount: closureResult.sourceOnlyCount,
+          // D2: per-reference exemption detail for approval/audit review —
+          // evidence-layer only; the receipt object (and its digest binding)
+          // is intentionally left unchanged.
+          sourceOnlyReferences: closureResult.sourceOnlyReferences,
           findingCount: 0,
           receiptDigest: closureResult.receiptDigest,
         });

package/src/commands/publish.mjs

@@ -652,7 +652,16 @@ export async function publishRelease(options) {
             { unitId, findings: closureResult.findings },
           );
         }
-        const observed = createSkillResourceClosureReceipt(closureResult, { unitId });
+        // G5: preparedAt/exitCode are record-layer fields frozen by prepare
+        // (bound by the plan digest); they cannot be recomputed from the
+        // snapshot, so the recheck carries them forward from the expected
+        // receipt and the strict comparison below verifies every re-derivable
+        // field against the frozen snapshot.
+        const observed = createSkillResourceClosureReceipt(closureResult, {
+          unitId,
+          preparedAt: expected.preparedAt ?? null,
+          exitCode: expected.exitCode ?? 0,
+        });
         assertSkillResourceClosureReceipt(expected, observed, `unit "${unitId}"`);
       }