release-skill 0.7.1 → 0.7.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.7.1",
+      "version": "0.7.2",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.7.1.",
+      "Prepare a release plan for version 0.7.2.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.7.2 locale=en baseline=sha256:2d5868f216a43f817df4db597c239ab7db305398dba7af1ffe555b47105dbe75 -->
+## [0.7.2] - 2026-08-22
+
+v0.7.2 fixes native safe-fs loading from generated host adapters whose installation roots intentionally omit package.json.
+
+### Fixed
+
+- **Adapter-safe native loader anchor**: the bundled runtime now anchors createRequire() to the shipped CLI entry shared by source and adapter layouts. Claude, Codex, Kimi, and WorkBuddy adapters can load their packaged native safe-fs addon without relying on a root package manifest.
+<!-- release-skill:changelog:end version=0.7.2 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.7.1 locale=en baseline=sha256:9f86def686489f30d89bb67884dfd8c44ee1d48b5d0cf5efabba44f87998d7d4 -->
 ## [0.7.1] - 2026-08-22
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.7.1 -->
+<!-- release-skill:release-version: 0.7.2 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.1
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.2
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.7.1 -->
+<!-- release-skill:release-version: 0.7.2 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.1
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.7.2
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.7.1 -->
+<!-- release-skill:release-version: 0.7.2 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,17 +14,17 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.1** (2026-08-22)
+**0.7.2** (2026-08-22)
 
-v0.7.1 fixes a leakage-scan false positive that blocked generated JSON Schema validators containing POSIX-like JSON Pointer segments.
+v0.7.2 fixes native safe-fs loading from generated host adapters whose installation roots intentionally omit package.json.
 
 **Fixed**
 
-- **Context-aware POSIX path detection**: the snapshot leakage scanner no longer treats JSON Pointer property segments or ordinary URL paths as machine-local absolute paths. Concrete Linux root, home, and user-home paths remain release-blocking findings.
+- **Adapter-safe native loader anchor**: the bundled runtime now anchors createRequire() to the shipped CLI entry shared by source and adapter layouts. Claude, Codex, Kimi, and WorkBuddy adapters can load their packaged native safe-fs addon without relying on a root package manifest.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.7.1 is the current source candidate; v0.6.3 remains
+> **Current boundary:** v0.7.2 is the current source candidate; v0.7.1 remains
 > the latest published release. v0.4.1 was an earlier published milestone;
 > v0.2.2 previously held published status before the platform verification
 > convergence fix was added.
@@ -44,8 +44,8 @@ v0.7.1 fixes a leakage-scan false positive that blocked generated JSON Schema va
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.7.1 is the current
-> source candidate and v0.6.3 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
+> **Production path verified since the v0.1.1 milestone; v0.7.2 is the current
+> source candidate and v0.7.1 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
 > **Start here:**

package/README.zh-CN.md

@@ -2,23 +2,23 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.7.1 -->
+<!-- release-skill:release-version: 0.7.2 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.1** (2026-08-22)
+**0.7.2** (2026-08-22)
 
-v0.7.1 修复了泄漏扫描误报：生成的 JSON Schema 校验器包含形似 POSIX 路径的 JSON Pointer 时，不再被错误阻断。
+v0.7.2 修复了宿主适配器的 native safe-fs 加载问题：适配器安装根目录按设计不包含 package.json，现在也能正常加载。
 
 **修复**
 
-- **按上下文识别 POSIX 路径**：快照泄漏扫描不再把 JSON Pointer 属性片段或普通 URL 路径当成本机绝对路径；真实的 Linux root、home 和用户主目录路径仍会阻断发布。
+- **适配器可用的原生加载锚点**：bundled runtime 现在把 createRequire() 锚定到源码包和适配器都会携带的 CLI 入口。Claude、Codex、Kimi 和 WorkBuddy 适配器无需依赖根 package.json，也能加载随包分发的 native safe-fs 插件。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.7.1 是当前源码候选，v0.6.3 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.7.2 是当前源码候选，v0.7.1 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -31,7 +31,7 @@ v0.7.1 修复了泄漏扫描误报：生成的 JSON Schema 校验器包含形似
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.1 是当前源码候选，v0.6.3 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.2 是当前源码候选，v0.7.1 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.7.1",
+      "version": "0.7.2",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.1"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.2"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "71df85a039086a78d5b4a7586cd88bcd7b2887dca8d07341be0bc6463f26d005";
+const __bundleSourceDigest = "151b10d546755e2b693a841c27569302a499a5424861834dfb8ec05138dca3b8";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -32285,7 +32285,7 @@ var init_report = __esm({
     init_closure();
     init_errors2();
     init_validation();
-    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.1" });
+    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.2" });
     REPORT_RENDERER_VERSION = PACKAGE_META.version;
     SUPPORTED_REPORT_LOCALES = Object.freeze(["zh-CN", "en-US"]);
     EXECUTION_STATUSES = Object.freeze([
@@ -38737,7 +38737,7 @@ function validateManifestEntry(entry, key) {
 }
 function requireAddon(addonPath) {
   try {
-    const require2 = createRequire(resolve9(PKG_ROOT2, "package.json"));
+    const require2 = createRequire(resolve9(PKG_ROOT2, "bin/release-skill.mjs"));
     return require2(addonPath);
   } catch (err) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, sanitizeError(err));

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.7.1.",
+      "Prepare a release plan for version 0.7.2.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.1"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.2"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "71df85a039086a78d5b4a7586cd88bcd7b2887dca8d07341be0bc6463f26d005";
+const __bundleSourceDigest = "151b10d546755e2b693a841c27569302a499a5424861834dfb8ec05138dca3b8";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -32285,7 +32285,7 @@ var init_report = __esm({
     init_closure();
     init_errors2();
     init_validation();
-    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.1" });
+    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.2" });
     REPORT_RENDERER_VERSION = PACKAGE_META.version;
     SUPPORTED_REPORT_LOCALES = Object.freeze(["zh-CN", "en-US"]);
     EXECUTION_STATUSES = Object.freeze([
@@ -38737,7 +38737,7 @@ function validateManifestEntry(entry, key) {
 }
 function requireAddon(addonPath) {
   try {
-    const require2 = createRequire(resolve9(PKG_ROOT2, "package.json"));
+    const require2 = createRequire(resolve9(PKG_ROOT2, "bin/release-skill.mjs"));
     return require2(addonPath);
   } catch (err) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, sanitizeError(err));

package/adapters/kimi/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/kimi/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.1"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.2"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "71df85a039086a78d5b4a7586cd88bcd7b2887dca8d07341be0bc6463f26d005";
+const __bundleSourceDigest = "151b10d546755e2b693a841c27569302a499a5424861834dfb8ec05138dca3b8";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -32285,7 +32285,7 @@ var init_report = __esm({
     init_closure();
     init_errors2();
     init_validation();
-    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.1" });
+    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.2" });
     REPORT_RENDERER_VERSION = PACKAGE_META.version;
     SUPPORTED_REPORT_LOCALES = Object.freeze(["zh-CN", "en-US"]);
     EXECUTION_STATUSES = Object.freeze([
@@ -38737,7 +38737,7 @@ function validateManifestEntry(entry, key) {
 }
 function requireAddon(addonPath) {
   try {
-    const require2 = createRequire(resolve9(PKG_ROOT2, "package.json"));
+    const require2 = createRequire(resolve9(PKG_ROOT2, "bin/release-skill.mjs"));
     return require2(addonPath);
   } catch (err) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, sanitizeError(err));

package/adapters/workbuddy/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/workbuddy/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.1"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.2"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "71df85a039086a78d5b4a7586cd88bcd7b2887dca8d07341be0bc6463f26d005";
+const __bundleSourceDigest = "151b10d546755e2b693a841c27569302a499a5424861834dfb8ec05138dca3b8";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -32285,7 +32285,7 @@ var init_report = __esm({
     init_closure();
     init_errors2();
     init_validation();
-    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.1" });
+    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.2" });
     REPORT_RENDERER_VERSION = PACKAGE_META.version;
     SUPPORTED_REPORT_LOCALES = Object.freeze(["zh-CN", "en-US"]);
     EXECUTION_STATUSES = Object.freeze([
@@ -38737,7 +38737,7 @@ function validateManifestEntry(entry, key) {
 }
 function requireAddon(addonPath) {
   try {
-    const require2 = createRequire(resolve9(PKG_ROOT2, "package.json"));
+    const require2 = createRequire(resolve9(PKG_ROOT2, "bin/release-skill.mjs"));
     return require2(addonPath);
   } catch (err) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, sanitizeError(err));

package/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.1"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.7.2"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "71df85a039086a78d5b4a7586cd88bcd7b2887dca8d07341be0bc6463f26d005";
+const __bundleSourceDigest = "151b10d546755e2b693a841c27569302a499a5424861834dfb8ec05138dca3b8";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -32285,7 +32285,7 @@ var init_report = __esm({
     init_closure();
     init_errors2();
     init_validation();
-    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.1" });
+    PACKAGE_META = Object.freeze({ "name": "release-skill", "version": "0.7.2" });
     REPORT_RENDERER_VERSION = PACKAGE_META.version;
     SUPPORTED_REPORT_LOCALES = Object.freeze(["zh-CN", "en-US"]);
     EXECUTION_STATUSES = Object.freeze([
@@ -38737,7 +38737,7 @@ function validateManifestEntry(entry, key) {
 }
 function requireAddon(addonPath) {
   try {
-    const require2 = createRequire(resolve9(PKG_ROOT2, "package.json"));
+    const require2 = createRequire(resolve9(PKG_ROOT2, "bin/release-skill.mjs"));
     return require2(addonPath);
   } catch (err) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, sanitizeError(err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/platform-manifest.json

@@ -2,11 +2,11 @@
   "schemaVersion": "1.0.0",
   "platformId": "release-skill",
   "platformName": "release-skill Plugin Platform",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "logicalRoot": "skills-src/",
   "logicalRootDigest": "3767fc36f42ca561f5e839cea7b7e5bc16d08c47867b5bd6086f25efd0cb0f06",
   "projectionDigest": "419f7f9601015459956e10aae74f42240ab2ac248238ff7494f3e761643d1749",
-  "projectionId": "release-skill:platform:0.7.1",
+  "projectionId": "release-skill:platform:0.7.2",
   "manifestRequired": true,
   "projectionSources": {
     "skills-src-root": {

package/src/artifacts/safe-fs-backend-internal.mjs

@@ -180,8 +180,9 @@ function validateManifestEntry(entry, key) {
 
 function requireAddon(addonPath) {
   try {
-    // Use PKG_ROOT-relative resolution so bundled mode can find the addon.
-    const require = createRequire(resolve(PKG_ROOT, 'package.json'));
+    // Anchor require() to a file present in both the source package and every
+    // generated adapter. Adapter roots intentionally do not ship package.json.
+    const require = createRequire(resolve(PKG_ROOT, 'bin/release-skill.mjs'));
     return require(addonPath);
   } catch (err) {
     throw new ReleaseError(SAFE_WRITE_UNAVAILABLE, sanitizeError(err));