release-skill 0.7.2 → 0.7.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -78,9 +78,9 @@
     "ajv-formats": "3.0.1",
     "libnpmpublish": "11.1.0",
     "npm-registry-fetch": "18.0.2",
-    "skill-family-contracts": "0.8.0",
-    "skill-family-engineering-kit": "0.8.0",
-    "skill-family-harness-node": "0.8.0",
+    "skill-family-contracts": "0.8.1",
+    "skill-family-engineering-kit": "0.8.1",
+    "skill-family-harness-node": "0.8.1",
     "yaml": "2.9.0"
   },
   "devDependencies": {

package/platform-manifest.json

@@ -2,11 +2,11 @@
   "schemaVersion": "1.0.0",
   "platformId": "release-skill",
   "platformName": "release-skill Plugin Platform",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "logicalRoot": "skills-src/",
   "logicalRootDigest": "3767fc36f42ca561f5e839cea7b7e5bc16d08c47867b5bd6086f25efd0cb0f06",
   "projectionDigest": "419f7f9601015459956e10aae74f42240ab2ac248238ff7494f3e761643d1749",
-  "projectionId": "release-skill:platform:0.7.2",
+  "projectionId": "release-skill:platform:0.7.4",
   "manifestRequired": true,
   "projectionSources": {
     "skills-src-root": {

package/scripts/build-bundle.mjs

@@ -150,17 +150,6 @@ function verifyRuntimeReadsResolve(content, outDir) {
   return [...missing].sort();
 }
 
-// Inlined Foundation modules must not perform bundle-relative runtime reads
-// of files that adapter closures do not ship. skill-family-harness-node's
-// report.mjs reads its own package.json at module init
-// (readFileSync(new URL("../package.json", import.meta.url))); once inlined
-// into the bundle that read resolves next to the bundle and breaks in
-// adapter closures (which ship no package.json by design — the banner
-// injects __bundlePkg instead). Neutralize the read at build time with the
-// same injected package identity, fail-closed if Foundation changes shape.
-const REPORT_PACKAGE_META_READ_RE =
-  /JSON\.parse\(readFileSync\(new URL\("\.\.\/package\.json", import\.meta\.url\), "utf8"\)\)/;
-
 async function buildBundle() {
   // Dynamic import so the script works even if esbuild is not yet installed.
   let esbuild;
@@ -175,25 +164,6 @@ async function buildBundle() {
   const sourceDigest = await computeBundleSourceDigest(PKG_ROOT);
   const banner = buildBanner({ name: pkgJson.name, version: pkgJson.version }, sourceDigest);
 
-  const identity = Object.freeze({ name: pkgJson.name, version: pkgJson.version });
-
-  const identityPlugins = [{
-    name: 'inline-foundation-package-identity',
-    setup(build) {
-      build.onLoad({ filter: /skill-family-harness-node[\\/]src[\\/]report\.mjs$/ }, async (args) => {
-        const source = await readFile(args.path, 'utf-8');
-        const injected = source.replace(REPORT_PACKAGE_META_READ_RE, () =>
-          `Object.freeze(${JSON.stringify(identity)})`);
-        if (injected === source) {
-          throw new Error(
-            'build-bundle: could not neutralize Foundation report.mjs package.json read',
-          );
-        }
-        return { contents: injected, loader: 'js' };
-      });
-    },
-  }];
-
   const result = await esbuild.build({
     entryPoints: [ENTRY],
     absWorkingDir: PKG_ROOT,
@@ -203,7 +173,6 @@ async function buildBundle() {
     target: 'node22',
     outfile: OUTFILE,
     banner: { js: banner },
-    plugins: identityPlugins,
     // External: Node.js builtins, native addon loader, and the native addon itself.
     external: [
       'node:*',

package/src/core/skill-resource-closure.mjs

@@ -13,8 +13,9 @@ import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { canonicalJson, digestDocument } from 'skill-family-contracts';
 import { GATE_FAILED, ReleaseError } from './errors.mjs';
 import { computeFrozenSnapshot } from '../snapshot/frozen.mjs';
+import { resolveSkillProjectionSurfaceHost } from '../platforms/registry.mjs';
 
-export const CHECKER_VERSION = 'skill-resource-closure-v2';
+export const CHECKER_VERSION = 'skill-resource-closure-v3';
 
 const BARE_PREFIXES = ['references/', 'assets/', 'schemas/', 'examples/', 'scripts/'];
 const EXPLICIT_PREFIXES = [
@@ -32,6 +33,7 @@ const MACHINE_ABSOLUTE_PATTERN = /^(?:\/(?:Users|home|root|tmp|var|etc|opt)(?:\/
 // isPathToken, so prose words are never matched; fail-closed over silent miss.
 const HOME_DIRECTORY_PATTERN = /^(?:~|\$HOME|\$\{HOME\})\/.+/u;
 const ADAPTER_SURFACE_PATTERN = /^adapters\/([^/]+)$/u;
+const PLATFORM_SURFACE_PATTERN = /^platforms\/(.+)$/u;
 // G3: skill-local resource closure directories. Regular files inside these
 // directories (under a skill directory) must be referenced by a SKILL.md of
 // the same surface or they are reported as stale on adapter surfaces.
@@ -58,6 +60,7 @@ export const CLASSIFICATION = Object.freeze({
   OUT_OF_BOUNDS: 'out_of_bounds',
   RESOURCE_DRIFT: 'resource_drift',
   STALE_RESOURCE: 'stale_resource',
+  UNKNOWN_PLATFORM_SURFACE: 'unknown_platform_surface',
 });
 
 export const FINDING_CODE = Object.freeze({
@@ -71,6 +74,7 @@ export const FINDING_CODE = Object.freeze({
   SYMLINK_NOT_ALLOWED: 'SYMLINK_NOT_ALLOWED',
   RESOURCE_DRIFT: 'RESOURCE_DRIFT',
   STALE_RESOURCE: 'STALE_RESOURCE',
+  UNKNOWN_PLATFORM_SURFACE: 'UNKNOWN_PLATFORM_SURFACE',
 });
 
 function toPosix(value) {
@@ -281,8 +285,14 @@ async function collectRegularFiles(dir, results) {
 }
 
 function inferSurfaceHost(surfaceId, defaultHost) {
-  const match = ADAPTER_SURFACE_PATTERN.exec(surfaceId);
-  return match?.[1] ?? defaultHost;
+  const adapterMatch = ADAPTER_SURFACE_PATTERN.exec(surfaceId);
+  if (adapterMatch) return adapterMatch[1];
+  const platformMatch = PLATFORM_SURFACE_PATTERN.exec(surfaceId);
+  if (platformMatch) {
+    return resolveSkillProjectionSurfaceHost(surfaceId)
+      ?? `unknown-platform:${platformMatch[1]}`;
+  }
+  return defaultHost;
 }
 
 function receiptProjection(result) {
@@ -413,6 +423,7 @@ export async function checkSkillResourceClosure({
     const pluginRoot = resolvePluginRoot(skill, scanRoot);
     const surfaceId = relativeStable(scanRoot, pluginRoot);
     const surfaceHost = inferSurfaceHost(surfaceId, host);
+    const firstSkillOnSurface = !surfaceMap.has(surfaceId);
     const surface = surfaceMap.get(surfaceId) ?? {
       id: surfaceId,
       host: surfaceHost,
@@ -422,6 +433,21 @@ export async function checkSkillResourceClosure({
     };
     surface.skillCount += 1;
     surfaceMap.set(surfaceId, surface);
+    if (firstSkillOnSurface
+        && PLATFORM_SURFACE_PATTERN.test(surfaceId)
+        && resolveSkillProjectionSurfaceHost(surfaceId) === null) {
+      findings.push({
+        host: surfaceHost,
+        surface: surfaceId,
+        skill: null,
+        line: null,
+        reference: surfaceId,
+        classification: CLASSIFICATION.UNKNOWN_PLATFORM_SURFACE,
+        resolutionRoot: surfaceId,
+        resolvedTarget: surfaceId,
+        code: FINDING_CODE.UNKNOWN_PLATFORM_SURFACE,
+      });
+    }
     if (!skillsBySurface.has(surfaceId)) skillsBySurface.set(surfaceId, []);
     skillsBySurface.get(surfaceId).push(skill);
 

package/src/platforms/registry.mjs

@@ -134,6 +134,7 @@ function codexCrossValidateListEntry(found, action) {
 
 const CLAUDE = Object.freeze({
   id: 'claude',
+  skillProjectionSurface: 'platforms/claude-code',
   distributionType: 'claude-plugin',
   actionType: 'claude-marketplace-install',
   // Runtime adapter implementing this platform's marketplace-install action.
@@ -199,6 +200,7 @@ const CLAUDE = Object.freeze({
 
 const CODEX = Object.freeze({
   id: 'codex',
+  skillProjectionSurface: 'platforms/codex',
   distributionType: 'codex-plugin',
   actionType: 'codex-marketplace-install',
   adapter: 'plugin-marketplace',
@@ -260,6 +262,7 @@ const CODEX = Object.freeze({
 
 const KIMI = Object.freeze({
   id: 'kimi',
+  skillProjectionSurface: 'platforms/kimi-code',
   distributionType: 'kimi-plugin',
   actionType: 'kimi-marketplace-install',
   adapter: 'plugin-marketplace',
@@ -333,6 +336,7 @@ const KIMI = Object.freeze({
 // (distributionType/actionType/consumer) stays `codebuddy`.
 const CODEBUDDY = Object.freeze({
   id: 'codebuddy',
+  skillProjectionSurface: 'platforms/workbuddy',
   distributionType: 'codebuddy-plugin',
   actionType: 'codebuddy-marketplace-install',
   adapter: 'plugin-marketplace',
@@ -418,6 +422,7 @@ const VALID_REF_STRENGTHS = new Set(['commit-sha', 'name-ref', 'unfixable']);
 const VALID_OUTPUT_PROTOCOLS = new Set(['structured', 'text', 'none']);
 const VALID_IDENTITY_EVIDENCE = new Set(['list-record', 'install-output', 'filesystem-payload', 'human-attestation']);
 const VALID_DEGRADATION_POLICIES = new Set(['block', 'human-attestation', 'human-attestation-with-fallback']);
+const SKILL_PROJECTION_SURFACE_PATTERN = /^platforms\/[a-z0-9]+(?:-[a-z0-9]+)*$/u;
 
 /**
  * Look up a platform descriptor by id.
@@ -431,6 +436,20 @@ export function getPlatform(id) {
   return platform;
 }
 
+/**
+ * Resolve a declared skill projection surface to its public host name.
+ * The host is always derived from the descriptor's authoritative
+ * `buildAdapter.name`; unknown surfaces fail closed with `null`.
+ *
+ * @param {string} surfaceId
+ * @param {object[]} [registry]
+ * @returns {string|null}
+ */
+export function resolveSkillProjectionSurfaceHost(surfaceId, registry = PLATFORMS) {
+  const platform = registry.find((item) => item.skillProjectionSurface === surfaceId);
+  return platform?.buildAdapter?.name ?? null;
+}
+
 /**
  * Validate a registry (defaults to the module registry). Throws on the first
  * malformed description so a registry typo fails at import time.
@@ -439,6 +458,7 @@ export function getPlatform(id) {
  */
 export function assertRegistry(registry = PLATFORMS) {
   const seen = new Set();
+  const seenSkillProjectionSurfaces = new Set();
   for (const platform of registry) {
     const label = platform?.id ?? '<missing id>';
     if (typeof platform?.id !== 'string' || platform.id.length === 0) {
@@ -490,6 +510,17 @@ export function assertRegistry(registry = PLATFORMS) {
     if (typeof platform.buildAdapter.name !== 'string' || platform.buildAdapter.name.length === 0) {
       throw new Error(`platform registry: ${label} buildAdapter needs a non-empty name (its adapter directory name)`);
     }
+    if (typeof platform.skillProjectionSurface !== 'string'
+        || !SKILL_PROJECTION_SURFACE_PATTERN.test(platform.skillProjectionSurface)) {
+      throw new Error(`platform registry: ${label} skillProjectionSurface must match platforms/<slug>`);
+    }
+    if (seenSkillProjectionSurfaces.has(platform.skillProjectionSurface)) {
+      throw new Error(`platform registry: duplicate skillProjectionSurface "${platform.skillProjectionSurface}"; aliases must be unique`);
+    }
+    seenSkillProjectionSurfaces.add(platform.skillProjectionSurface);
+    if (resolveSkillProjectionSurfaceHost(platform.skillProjectionSurface, registry) !== platform.buildAdapter.name) {
+      throw new Error(`platform registry: ${label} skillProjectionSurface must map to buildAdapter.name`);
+    }
     if (!VALID_LIST_OUTPUTS.has(platform.jsonProtocol?.listOutput)) {
       throw new Error(`platform registry: ${label} has illegal jsonProtocol.listOutput "${platform.jsonProtocol?.listOutput}"`);
     }