release-skill 0.7.6 → 0.7.8

package/adapters/workbuddy/schemas/.render-manifest.json

@@ -26,16 +26,16 @@
       "bytes": 1744
     },
     "release-plan.schema.json": {
-      "digest": "48b7755dfbeee88ccf78c3200000ab2f5dd06db42bc7b423aed0f81a91cc0418",
-      "bytes": 54672
+      "digest": "3d24cb908cdfbfd5d89551b7c6fed5140f6f1448b9920f114264291ca4cf1c52",
+      "bytes": 55905
     },
     "release-project.schema.json": {
-      "digest": "cc2061799c3a0dd6daea940148e3497b7a4ae8cafb987bf51de7c34c1fed921d",
-      "bytes": 46932
+      "digest": "b0ba3c46692622f734a80d3f4e3904180bbfd1096ca2d9b6d6fd957917e96f73",
+      "bytes": 47688
     },
     "release-run.schema.json": {
-      "digest": "9755a8caa58dd02509ac8e6f869aec5e74d8ae3f7339a3f944977bfad7b729ad",
-      "bytes": 17897
+      "digest": "4a041b8f6488e7d61b7eb271ebdbc2e043731df41c4437783ef63e77f664c192",
+      "bytes": 19002
     }
   }
 }

package/adapters/workbuddy/schemas/release-plan.schema.json

@@ -53,6 +53,53 @@
         }
       }
     },
+    "publicSourceAuthorityReceipt": {
+      "type": "object",
+      "required": [
+        "coordinatorUnitId",
+        "subjectUnitIds",
+        "asset"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "coordinatorUnitId": {
+          "type": "string",
+          "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+        },
+        "subjectUnitIds": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+          }
+        },
+        "asset": {
+          "type": "object",
+          "required": [
+            "name",
+            "path",
+            "sha256"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "name": {
+              "const": "source-authority-receipt.json"
+            },
+            "path": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$"
+            },
+            "sha256": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            }
+          }
+        }
+      }
+    },
     "baseline": {
       "type": "object",
       "required": [

package/adapters/workbuddy/schemas/release-project.schema.json

@@ -44,6 +44,30 @@
         }
       }
     },
+    "publicSourceAuthorityReceipt": {
+      "type": "object",
+      "description": "Optional public source-authority receipt uploaded to one coordinator GitHub Release after all subject npm tarballs are frozen.",
+      "required": [
+        "coordinatorUnitId",
+        "subjectUnitIds"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "coordinatorUnitId": {
+          "type": "string",
+          "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+        },
+        "subjectUnitIds": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^(?!\\.{1,2}$)[A-Za-z0-9][A-Za-z0-9._-]*$"
+          }
+        }
+      }
+    },
     "releaseUnits": {
       "type": "array",
       "minItems": 1,

package/adapters/workbuddy/schemas/release-run.schema.json

@@ -199,6 +199,11 @@
               },
               "url": {
                 "type": "string"
+              },
+              "integrity": {
+                "type": "string",
+                "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
+                "description": "Observed npm dist.integrity when an already-consistent npm publish is skipped"
               }
             }
           },
@@ -280,7 +285,42 @@
             "minimum": 0,
             "description": "写入目标的载荷文件数"
           }
-        }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "remoteRef": {
+                  "type": "object",
+                  "required": [
+                    "integrity"
+                  ]
+                }
+              },
+              "required": [
+                "remoteRef"
+              ]
+            },
+            "then": {
+              "properties": {
+                "actionType": {
+                  "const": "npm-publish"
+                },
+                "status": {
+                  "const": "skipped"
+                },
+                "preObserve": {
+                  "const": "CONSISTENT"
+                }
+              },
+              "required": [
+                "actionType",
+                "status",
+                "preObserve"
+              ]
+            }
+          }
+        ]
       }
     },
     "sourceAuthorityReceipts": {

package/adapters/workbuddy/skills/release-prepare/SKILL.md

@@ -33,6 +33,10 @@ description: Freeze an immutable release plan with local configuration, document
 
 若用户明确要求 GitHub+npm 生产发布，加入 `--production`。该模式还会封存独立
 Git commit/tree 和 npm tarball，并把路径、SHA/integrity、branch/tag 写入计划。
+配置声明 `publicSourceAuthorityReceipt` 时，prepare 必须在所有 subject npm tarball
+冻结后生成 `source-authority-receipt.json`，并把该文件的路径与 SHA-256 绑定到
+coordinator unit 的 `github-release` action。该能力不支持非生产 prepare；不得手工
+补写 receipt 或把私有 plan/run 字段复制进公开文件。
 每个 npm tarball 在计划落盘前必须静态验证 `package.json` 的具体
 `bin`/`main`/`module`/`types`/`typings`/`exports` 入口均为 tarball 内普通文件；
 该门禁不依赖项目是否配置 `requiredPublicFiles` 或 `smokeBin`。通配符 exports 不做

package/bin/release-skill-cli.mjs

@@ -7,6 +7,23 @@ import { parseNodeMajor, meetsMinimum, computeReadinessStatus } from '../src/cor
 import { registerPathRedactor } from '../src/core/errors.mjs';
 import { redactSensitivePaths } from '../src/core/redact.mjs';
 
+// Process output errors can be emitted immediately after a large console
+// write, before command routing reaches its exit path. Guard both streams at
+// module initialization so EPIPE and other destination failures cannot become
+// uncaught exceptions that replace the command's selected business exit code.
+const outputStreamStates = new WeakMap();
+
+function guardOutputStream(stream) {
+  const state = { failed: false };
+  outputStreamStates.set(stream, state);
+  stream.on('error', () => {
+    state.failed = true;
+  });
+}
+
+guardOutputStream(process.stdout);
+guardOutputStream(process.stderr);
+
 // Install the path-redaction choke point eagerly and synchronously (static
 // imports, no top-level await) so every ReleaseError constructed on any
 // command path is redacted from the very first statement — in source mode and
@@ -21,6 +38,58 @@ const execFile = promisify(execFileCb);
 
 const COMMANDS = new Set(['help', 'setup', 'assess', 'prepare', 'approve', 'publish', 'reconcile', 'verify', 'ship', 'attest', 'hooks', 'artifacts', 'docs', 'distribute', 'route', 'lineage']);
 
+/**
+ * Wait until writes already queued on a process output stream have reached
+ * the underlying destination. Stream failures do not replace the command's
+ * previously selected exit code.
+ *
+ * @param {NodeJS.WriteStream} stream
+ * @returns {Promise<void>}
+ */
+function flushOutputStream(stream) {
+  if (
+    !stream?.writable
+    || stream.destroyed
+    || stream.writableEnded
+    || outputStreamStates.get(stream)?.failed
+  ) {
+    return Promise.resolve();
+  }
+  return new Promise((resolveFlush) => {
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      stream.off('error', finish);
+      resolveFlush();
+    };
+    stream.once('error', finish);
+    try {
+      // The callback runs after this empty write and every earlier console
+      // write have been flushed. This also covers a stream waiting for drain.
+      stream.write('', finish);
+    } catch {
+      finish();
+    }
+  });
+}
+
+/**
+ * Preserve CLI exit semantics while preventing buffered stdout/stderr from
+ * being discarded by process.exit().
+ *
+ * @param {number} exitCode
+ * @returns {Promise<never>}
+ */
+async function exitAfterFlush(exitCode) {
+  process.exitCode = exitCode;
+  await Promise.all([
+    flushOutputStream(process.stdout),
+    flushOutputStream(process.stderr),
+  ]);
+  process.exit(exitCode);
+}
+
 /**
  * Check if a command is available and get its version.
  *
@@ -346,7 +415,7 @@ if (!command && (args.includes('--version') || args.includes('-v'))) {
   } else {
     console.log(pkg.version);
   }
-  process.exit(0);
+  await exitAfterFlush(0);
 }
 
 if (!command || command === 'help') {
@@ -442,10 +511,10 @@ if (!command || command === 'help') {
     // availability is informational and never blocks release readiness.
 
     console.log(JSON.stringify(output, null, 2));
-    process.exit(readiness.status === 'READY' ? 0 : 1);
+    await exitAfterFlush(readiness.status === 'READY' ? 0 : 1);
   } else {
     printHelp();
-    process.exit(0);
+    await exitAfterFlush(0);
   }
 }
 
@@ -461,7 +530,7 @@ if (!COMMANDS.has(command)) {
     console.error(`Error: Unknown command '${command}'`);
     console.error('Run "release-skill help" for available commands.');
   }
-  process.exit(2);
+  await exitAfterFlush(2);
 }
 
 // --- Setup command routing ---
@@ -513,7 +582,7 @@ if (command === 'setup') {
         if (report.next) console.log(`Next: ${report.next}`);
       }
       const okStatuses = ['HOOKS_PROPOSAL_READY', 'HOOKS_APPENDED', 'HOOKS_NO_CHANGE', 'postpublish-discovery'];
-      process.exit(okStatuses.includes(report.status ?? report.mode) ? 0 : 2);
+      await exitAfterFlush(okStatuses.includes(report.status ?? report.mode) ? 0 : 2);
     } catch (err) {
       if (hasJson) {
         console.log(JSON.stringify({
@@ -525,7 +594,7 @@ if (command === 'setup') {
       } else {
         console.error(`Error: ${err.message}`);
       }
-      process.exit(err.exitCode ?? 1);
+      await exitAfterFlush(err.exitCode ?? 1);
     }
   }
 
@@ -540,7 +609,7 @@ if (command === 'setup') {
       if (report.configPath) console.log(`Config: ${report.configPath}`);
       if (report.next) console.log(`Next: ${report.next}`);
     }
-    process.exit(['READY_TO_WRITE', 'CONFIG_CREATED', 'ALREADY_CONFIGURED'].includes(report.status) ? 0 : 2);
+    await exitAfterFlush(['READY_TO_WRITE', 'CONFIG_CREATED', 'ALREADY_CONFIGURED'].includes(report.status) ? 0 : 2);
   } catch (err) {
     if (hasJson) {
       console.log(JSON.stringify({
@@ -552,7 +621,7 @@ if (command === 'setup') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -575,7 +644,7 @@ if (command === 'assess') {
       console.log(report.summary);
     }
 
-    process.exit(report.status === 'ASSESSED' ? 0 : 1);
+    await exitAfterFlush(report.status === 'ASSESSED' ? 0 : 1);
   } catch (err) {
     if (hasJson) {
       const errOutput = {
@@ -588,7 +657,7 @@ if (command === 'assess') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -601,7 +670,7 @@ if (command === 'hooks') {
     const message = 'hooks requires subcommand: hooks validate';
     if (hasJson) console.log(JSON.stringify({ error: 'MISSING_PARAMETERS', message }));
     else console.error(`Error: ${message}`);
-    process.exit(1);
+    await exitAfterFlush(1);
   }
   try {
     const { validateDeclaredHooks } = await import('../src/commands/hooks.mjs');
@@ -616,7 +685,7 @@ if (command === 'hooks') {
       console.log(`Declared hooks: ${result.status}`);
       console.log(`Reusable receipt evidence: ${result.evidenceDir}`);
     }
-    process.exit(0);
+    await exitAfterFlush(0);
   } catch (err) {
     if (hasJson) {
       console.log(JSON.stringify({
@@ -626,7 +695,7 @@ if (command === 'hooks') {
         exitCode: err.exitCode ?? 1,
       }));
     } else console.error(`Error: ${err.message}`);
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -710,7 +779,7 @@ if (command === 'ship') {
         console.log(`Manual requirement [${requirement.platform}]: ${requirement.requirementPath}`);
       }
     }
-    process.exit(0);
+    await exitAfterFlush(0);
   } catch (err) {
     if (hasJson) {
       console.log(JSON.stringify({
@@ -722,7 +791,7 @@ if (command === 'ship') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -752,7 +821,7 @@ if (command === 'attest') {
       console.log(`Bound plan digest: ${result.planDigest}`);
       console.log(`Receipt: ${result.attestationPath}`);
     }
-    process.exit(0);
+    await exitAfterFlush(0);
   } catch (err) {
     if (hasJson) {
       console.log(JSON.stringify({
@@ -764,7 +833,7 @@ if (command === 'attest') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -869,7 +938,7 @@ if (command === 'prepare') {
       }
     }
 
-    process.exit(0);
+    await exitAfterFlush(0);
   } catch (err) {
     if (hasJson) {
       const errOutput = {
@@ -882,7 +951,7 @@ if (command === 'prepare') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -909,7 +978,7 @@ if (command === 'approve') {
     } else {
       console.error(`Error: ${msg}`);
     }
-    process.exit(1);
+    await exitAfterFlush(1);
   }
 
   // --- Checkpoint-level postPublish hook approval (v0.6.3 R1, review N-6) ---
@@ -935,7 +1004,7 @@ if (command === 'approve') {
           console.log(`  ${key}: ${typeof value === 'object' ? JSON.stringify(value) : value}`);
         }
       }
-      process.exit(0);
+      await exitAfterFlush(0);
     } catch (err) {
       if (hasJson) {
         console.log(JSON.stringify({
@@ -946,7 +1015,7 @@ if (command === 'approve') {
       } else {
         console.error(`Error: ${err.message}`);
       }
-      process.exit(err.exitCode ?? 1);
+      await exitAfterFlush(err.exitCode ?? 1);
     }
   }
 
@@ -979,7 +1048,7 @@ if (command === 'approve') {
       console.log(`Expires at: ${record.expiresAt}`);
     }
 
-    process.exit(0);
+    await exitAfterFlush(0);
   } catch (err) {
     if (hasJson) {
       const errOutput = {
@@ -991,7 +1060,7 @@ if (command === 'approve') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -1015,7 +1084,7 @@ if (command === 'reconcile') {
     } else {
       console.error(`Error: ${msg}`);
     }
-    process.exit(1);
+    await exitAfterFlush(1);
   }
 
   try {
@@ -1050,7 +1119,7 @@ if (command === 'reconcile') {
       }
     }
 
-    process.exit(result.status === 'PUBLISHED' ? 0 : 1);
+    await exitAfterFlush(result.status === 'PUBLISHED' ? 0 : 1);
   } catch (err) {
     if (hasJson) {
       const errOutput = {
@@ -1062,7 +1131,7 @@ if (command === 'reconcile') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -1085,7 +1154,7 @@ if (command === 'verify') {
     } else {
       console.error(`Error: ${msg}`);
     }
-    process.exit(1);
+    await exitAfterFlush(1);
   }
 
   try {
@@ -1127,7 +1196,7 @@ if (command === 'verify') {
       }
     }
 
-    process.exit(result.status === 'VERIFIED' ? 0 : 1);
+    await exitAfterFlush(result.status === 'VERIFIED' ? 0 : 1);
   } catch (err) {
     if (hasJson) {
       const errOutput = {
@@ -1139,7 +1208,7 @@ if (command === 'verify') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -1161,7 +1230,7 @@ if (command === 'publish') {
     } else {
       console.error(`Error: ${msg}`);
     }
-    process.exit(1);
+    await exitAfterFlush(1);
   }
 
   try {
@@ -1196,7 +1265,7 @@ if (command === 'publish') {
       }
     }
 
-    process.exit(result.status === 'PUBLISHED' ? 0 : 1);
+    await exitAfterFlush(result.status === 'PUBLISHED' ? 0 : 1);
   } catch (err) {
     if (hasJson) {
       const errOutput = {
@@ -1208,7 +1277,7 @@ if (command === 'publish') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -1242,7 +1311,7 @@ if (command === 'artifacts') {
       'BASE_UNAVAILABLE', 'POLICY_INVALID', 'PATH_UNSAFE',
       'CONFLICT', 'DIRTY_SCOPE_CONFLICT',
     ]);
-    process.exit(blockingStatuses.has(result.status) ? 1 : 0);
+    await exitAfterFlush(blockingStatuses.has(result.status) ? 1 : 0);
   } catch (err) {
     if (hasJson) {
       const errOutput = {
@@ -1259,7 +1328,7 @@ if (command === 'artifacts') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -1369,7 +1438,7 @@ if (command === 'docs') {
       }
     }
 
-    process.exit(0);
+    await exitAfterFlush(0);
   } catch (err) {
     // docs parameter errors must surface the stable JSON error shape even in
     // text mode (CLI parameter validation precedes any service I/O).
@@ -1379,7 +1448,7 @@ if (command === 'docs') {
       details: err.details ?? {},
       exitCode: err.exitCode ?? 1,
     }));
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -1426,7 +1495,7 @@ if (command === 'distribute') {
         console.log(`    write-downstream: ${preset.writeDownstream}; target optional: ${preset.targetOptional}; status: ${status}`);
       }
     }
-    process.exit(0);
+    await exitAfterFlush(0);
   }
 
   // Handle --help explicitly
@@ -1468,7 +1537,7 @@ Description:
     } else {
       console.log(helpText);
     }
-    process.exit(0);
+    await exitAfterFlush(0);
   }
 
   if (!planPath || !runPath || !approvalPath) {
@@ -1478,7 +1547,7 @@ Description:
     } else {
       console.error(`Error: ${msg}`);
     }
-    process.exit(1);
+    await exitAfterFlush(1);
   }
 
   try {
@@ -1522,7 +1591,7 @@ Description:
       }
     }
 
-    process.exit(result.status === 'DISTRIBUTED' ? 0 : 1);
+    await exitAfterFlush(result.status === 'DISTRIBUTED' ? 0 : 1);
   } catch (err) {
     if (hasJson) {
       const errOutput = {
@@ -1535,7 +1604,7 @@ Description:
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -1558,7 +1627,7 @@ if (command === 'route') {
       }
     }
 
-    process.exit(result.exitCode ?? 0);
+    await exitAfterFlush(result.exitCode ?? 0);
   } catch (err) {
     if (hasJson) {
       console.log(JSON.stringify({
@@ -1570,7 +1639,7 @@ if (command === 'route') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
@@ -1592,7 +1661,7 @@ if (command === 'lineage') {
       }
     }
 
-    process.exit(result.status === 'ERROR' ? 1 : 0);
+    await exitAfterFlush(result.status === 'ERROR' ? 1 : 0);
   } catch (err) {
     if (hasJson) {
       console.log(JSON.stringify({
@@ -1604,10 +1673,10 @@ if (command === 'lineage') {
     } else {
       console.error(`Error: ${err.message}`);
     }
-    process.exit(err.exitCode ?? 1);
+    await exitAfterFlush(err.exitCode ?? 1);
   }
 }
 
 // Placeholder: remaining commands will be wired in later commands
 console.error(`Command '${command}' is not yet implemented.`);
-process.exit(1);
+await exitAfterFlush(1);