release-skill 0.9.20 → 0.9.22

package/adapters/kimi/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.20"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.22"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "826d7969c27d91224343a3853edb9e1611a07ba4dfe0ab65661f8e7b45bb8738";
+const __bundleSourceDigest = "45eaf443ea0ae412317287ca2fa661303666663c304c4691330b5ea1e700881d";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -134642,14 +134642,9 @@ function hubTargets(plan) {
     if (!local) return [];
     const hub = { ...local.hub, githubHost: local.hub.githubHost ?? "github.com" };
     const unit = (plan.units ?? []).find((candidate) => candidate.id === declaration.unitId);
-    const tag = (plan.externalActions ?? []).find((action) => action.type === "create-tag" && action.unitId === declaration.unitId)?.parameters?.tag;
-    const manualInstruction = {
-      claude: "Use Claude\u2019s existing marketplace management entry.",
-      codex: "Use Codex\u2019s existing marketplace management entry.",
-      kimi: `Use the frozen GitHub Release${tag ? ` (${tag})` : ""} and the existing manual confirmation path; Kimi has no marketplace index.`,
-      codebuddy: "Handle manually; CodeBuddy cannot pin a Hub ref in this flow.",
-      workbuddy: "Handle manually; WorkBuddy cannot pin a Hub ref in this flow (it follows the CodeBuddy manual boundary)."
-    };
+    const tagActions = (plan.externalActions ?? []).filter((action) => action.type === "create-tag" && action.unitId === declaration.unitId);
+    const tagIdentity = tagActions[0]?.parameters;
+    const tag = tagIdentity?.tag;
     return local.hosts.map((host) => {
       if (host === "cursor") {
         return {
@@ -134687,15 +134682,25 @@ function hubTargets(plan) {
       }
       return {
         targetKind: "hub-backed",
-        executionMode: "manual",
+        executionMode: "executable",
         unitId: declaration.unitId,
         host,
         plugin: local.plugin,
         version: unit?.targetVersion,
         hub,
-        message: `${manualInstruction[host]} Install or upgrade ${local.plugin} from Hub ${hub.name}; release-skill does not execute or probe this action.`,
-        ...unit?.publicRepo ? { publicRepo: unit.publicRepo } : {},
-        ...tag ? { frozenTag: tag } : {}
+        marketplace: hub.name,
+        marketplaceRepo: hub.repo,
+        marketplaceRef: hub.ref,
+        githubHost: tagIdentity?.githubHost ?? "github.com",
+        pluginRepo: unit?.publicRepo,
+        pluginCommit: unit?.frozenSnapshot?.commit,
+        pluginTag: tag,
+        frozenTag: tag,
+        snapshotPath: unit?.frozenSnapshot?.path,
+        manifestDigest: unit?.frozenSnapshot?.manifestDigest,
+        timeoutMs: 3e5,
+        message: host === "kimi" ? `Install the frozen GitHub Release ${tag} through Kimi's controlled terminal interface.` : `Update ${local.plugin} from the existing ${hub.name} marketplace and verify the frozen payload.`,
+        ...tagActions.length !== 1 || tagIdentity?.repo !== unit?.publicRepo || tagIdentity?.commit !== unit?.frozenSnapshot?.commit || tagIdentity?.version !== unit?.targetVersion ? { invalidFrozenIdentity: true } : {}
       };
     });
   });
@@ -134707,18 +134712,19 @@ function mergePostReleaseTargets(executableTargets, manualTargets) {
     const existing = byIdentity.get(key);
     if (existing && existing.targetKind === "hub-backed" && target.targetKind === "hub-backed") {
       const sameHub = ["name", "githubHost", "repo", "ref"].every((field) => existing.hub[field] === target.hub[field]);
-      if (!sameHub) throw new Error(`post-release target identity conflict for ${target.unitId}/${target.host}/${target.plugin}`);
+      const samePlugin = ["version", "pluginRepo", "pluginTag", "pluginCommit", "snapshotPath", "manifestDigest"].every((field) => existing[field] === target[field]);
+      if (!sameHub || !samePlugin) throw new Error(`post-release target identity conflict for ${target.unitId}/${target.host}/${target.plugin}`);
       continue;
     }
-    const hubMatchesExecutable = /* @__PURE__ */ __name((hub, executable) => executable.marketplace === hub.name && executable.marketplaceRepo === hub.repo && executable.marketplaceRef === hub.ref && executable.githubHost === hub.githubHost, "hubMatchesExecutable");
+    const hubMatchesExecutable = /* @__PURE__ */ __name((hub, executable, hubTarget) => executable.marketplace === hub.name && executable.marketplaceRepo === hub.repo && executable.marketplaceRef === hub.ref && executable.githubHost === hub.githubHost && executable.pluginRepo === hubTarget.pluginRepo && executable.pluginTag === hubTarget.pluginTag && executable.pluginCommit === hubTarget.pluginCommit, "hubMatchesExecutable");
     if (existing && existing.targetKind !== "hub-backed" && target.targetKind === "hub-backed") {
-      if (!hubMatchesExecutable(target.hub, existing)) {
+      if (!hubMatchesExecutable(target.hub, existing, target)) {
         throw new Error(`post-release target identity conflict for ${target.unitId}/${target.host}/${target.plugin}`);
       }
       continue;
     }
     if (existing && existing.targetKind === "hub-backed" && target.targetKind !== "hub-backed") {
-      if (!hubMatchesExecutable(existing.hub, target)) {
+      if (!hubMatchesExecutable(existing.hub, target, existing)) {
         throw new Error(`post-release target identity conflict for ${target.unitId}/${target.host}/${target.plugin}`);
       }
       byIdentity.set(key, target);
@@ -134732,6 +134738,13 @@ function mergePostReleaseTargets(executableTargets, manualTargets) {
   return [...byIdentity.values()].sort((left, right) => left.host.localeCompare(right.host) || left.unitId.localeCompare(right.unitId) || left.plugin.localeCompare(right.plugin));
 }
 function assertExecutableTarget(target) {
+  if (target.targetKind === "hub-backed") {
+    assertQoderExecutableTarget(target);
+    if (target.invalidFrozenIdentity || typeof target.pluginTag !== "string" || !target.pluginTag || !/^[\w.-]+\/[\w.-]+$/u.test(target.pluginRepo) || !/^[\w.-]+\/[\w.-]+$/u.test(target.hub.repo) || !target.hub.ref?.startsWith("refs/heads/")) {
+      throw new Error(`local host update target has inconsistent frozen source identity for ${target.unitId}`);
+    }
+    return;
+  }
   for (const field of [
     "actionId",
     "unitId",
@@ -134817,6 +134830,9 @@ function derivePostReleaseChecklist(plan, {
   const units = plan.units ?? [];
   const uncovered = units.filter((unit) => !BRANCH_ACTION_INCLUDED.has(unit.productionConfig?.branchStrategy));
   const declaredHubTargets = hubTargets(plan);
+  for (const target of declaredHubTargets) {
+    if (target.targetKind === "hub-backed" && target.host !== "qoder") assertExecutableTarget(target);
+  }
   const executableTargets = [
     ...pluginTargets(plan),
     ...declaredHubTargets.filter((target) => target.executionMode === "executable")
@@ -135104,10 +135120,10 @@ function isCodeBuddyResidualEnvelope(error) {
   return envelope?.ok === false && envelope.exitStatus === 124 && envelope.processStatus === "TERMINATED" && envelope.terminationReason === "child_exit" && envelope.watchdogReason === "residual_process_group" && evidence?.childExitCode === 0 && (evidence.childSignal === null || evidence.childSignal === void 0) && evidence.residualGroupCleanupCompleted === true && evidence.forcedKill === false && evidence.outputLimitExceeded === null && Array.isArray(signals) && signals.length === 1 && signal?.signal === "SIGTERM" && signal.requestedMode === "process_group" && signal.successfulMode === "process_group";
 }
 function isCodeBuddyReadCommand(target, command2, args2) {
-  return target.host === "codebuddy" && (command2 === "codebuddy" || command2 === "cbc" || command2 === CODEBUDDY_MACOS_PATH) && Array.isArray(args2) && (args2.every((value, index) => value === CODEBUDDY_PLUGIN_LIST_ARGS[index]) && args2.length === CODEBUDDY_PLUGIN_LIST_ARGS.length || args2.every((value, index) => value === CODEBUDDY_MARKETPLACE_LIST_ARGS[index]) && args2.length === CODEBUDDY_MARKETPLACE_LIST_ARGS.length);
+  return (target.host === "codebuddy" || target.host === "workbuddy") && (command2 === "codebuddy" || command2 === "cbc" || command2 === CODEBUDDY_MACOS_PATH) && Array.isArray(args2) && (args2.every((value, index) => value === CODEBUDDY_PLUGIN_LIST_ARGS[index]) && args2.length === CODEBUDDY_PLUGIN_LIST_ARGS.length || args2.every((value, index) => value === CODEBUDDY_MARKETPLACE_LIST_ARGS[index]) && args2.length === CODEBUDDY_MARKETPLACE_LIST_ARGS.length);
 }
 function isCodeBuddyWriteCommand(target, command2, args2, kind) {
-  if (target.host !== "codebuddy" || !["codebuddy", "cbc", CODEBUDDY_MACOS_PATH].includes(command2)) return false;
+  if (!["codebuddy", "workbuddy"].includes(target.host) || !["codebuddy", "cbc", CODEBUDDY_MACOS_PATH].includes(command2)) return false;
   const expected = kind === "marketplace-update" ? ["plugin", "marketplace", "update", target.marketplace] : ["plugin", "update", `${target.plugin}@${target.marketplace}`, "--scope", "user"];
   return Array.isArray(args2) && args2.length === expected.length && args2.every((value, index) => value === expected[index]);
 }
@@ -135125,14 +135141,14 @@ async function runCodeBuddyRead(target, command2, args2, label, env, run6) {
     };
   }
 }
-function exactCodeBuddyMarketplaceObservation(target, stdout) {
+function exactCodeBuddyMarketplaceObservation(target, stdout, { acceptedTypes = ["git"] } = {}) {
   const parsed = parseJson2(stdout, `${target.host} marketplace list`);
   if (!Array.isArray(parsed)) throw new Error(`${target.host} marketplace list did not return an array`);
   const matches = parsed.filter((entry) => entry?.name === target.marketplace);
   if (matches.length !== 1) {
     throw new Error(`${target.host} marketplace list did not contain exactly one ${target.marketplace}`);
   }
-  if (matches[0].type !== "git") {
+  if (!acceptedTypes.includes(matches[0].type)) {
     throw new Error(`${target.host} marketplace ${target.marketplace} is not a git marketplace`);
   }
   return { installed: true, exact: true, found: matches[0] };
@@ -135428,10 +135444,15 @@ async function observeMarketplace(target, command2, env, run6) {
   const parsed = parseJson2(listed.stdout, `${target.host} marketplace list`);
   const entries = target.host === "claude" ? parsed : parsed?.marketplaces;
   if (!Array.isArray(entries)) throw new Error(`${target.host} marketplace list has an invalid shape`);
-  const found = entries.find((entry) => entry?.name === target.marketplace);
+  const matches = entries.filter((entry) => entry?.name === target.marketplace);
+  if (target.targetKind === "hub-backed" && matches.length > 1) {
+    throw new Error(`${target.host} marketplace list returned conflicting entries for ${target.marketplace}`);
+  }
+  const found = matches[0];
   if (!found) return { installed: false };
   const source = target.host === "claude" ? found.repo : found.marketplaceSource?.source;
-  if (normalizeGitSource(source) !== normalizeGitSource(target.marketplaceRepo)) {
+  const observedSource = target.targetKind === "hub-backed" ? normalizeHubGitSource(source, target.hub.githubHost) : normalizeGitSource(source);
+  if (observedSource !== normalizeGitSource(target.marketplaceRepo)) {
     throw new Error(`${target.host} marketplace ${target.marketplace} does not point to ${target.marketplaceRepo}`);
   }
   const root = target.host === "claude" ? found.installLocation : found.root;
@@ -135471,6 +135492,14 @@ async function bindStructuredMarketplace(target, command2, env, run6, observed)
   return true;
 }
 function actionParametersForTarget(plan, target) {
+  if (target.targetKind === "hub-backed") {
+    return {
+      snapshotPath: target.snapshotPath,
+      manifestDigest: target.manifestDigest,
+      payloadContract: "external-marketplace-v1",
+      marketplaceLocation: "external"
+    };
+  }
   const action = (plan.externalActions ?? []).find((candidate) => candidate.id === target.actionId);
   if (!action || action.type !== target.actionType || action.unitId !== target.unitId) {
     throw new Error(`local host update target ${target.actionId} has no matching frozen action`);
@@ -135494,14 +135523,164 @@ async function verifyStructuredInstalledPayload({
     target.host
   );
 }
+async function assertHubHostEntry(target, marketplaceRoot) {
+  const codex = target.host === "codex";
+  const indexPath = codex ? ".agents/plugins/marketplace.json" : target.host === "claude" ? ".claude-plugin/marketplace.json" : ".codebuddy-plugin/marketplace.json";
+  const index = parseJson2(await readFileContained(marketplaceRoot, indexPath, { encoding: "utf8" }), `${target.host} Hub index`);
+  const matches = index?.plugins?.filter((entry2) => entry2?.name === target.plugin);
+  if (index?.name !== target.marketplace || !Array.isArray(matches) || matches.length !== 1) {
+    throw new Error(`${target.host} Hub index must contain exactly one frozen plugin entry`);
+  }
+  const entry = matches[0];
+  const source = entry.source;
+  const repo = codex ? normalizeHubGitSource(source?.url, target.githubHost) : source?.repo;
+  if (source?.source !== (codex ? "url" : "github") || repo !== target.pluginRepo || source?.sha !== target.pluginCommit || source?.ref !== (codex ? `refs/tags/${target.pluginTag}` : target.pluginTag) || !codex && entry.version !== target.version || entry.version !== void 0 && entry.version !== target.version) {
+    throw new Error(`${target.host} Hub entry does not match the frozen repository, tag, commit and version`);
+  }
+}
+async function observeHubCheckout(target, checkout, env, run6) {
+  const remote = await run6("git", ["-C", checkout, "remote", "get-url", "origin"], { env, timeout: 3e4 });
+  if (normalizeHubGitSource(remote.stdout.trim(), target.hub.githubHost) !== target.hub.repo) {
+    throw new Error(`${target.host} marketplace checkout does not match the declared Hub repository`);
+  }
+  if (target.host !== "codex") {
+    const branch = await run6("git", ["-C", checkout, "symbolic-ref", "HEAD"], { env, timeout: 3e4 });
+    if (branch.stdout.trim() !== target.hub.ref) throw new Error(`${target.host} marketplace checkout does not match the declared Hub branch`);
+  }
+  const head = await run6("git", ["-C", checkout, "rev-parse", "HEAD"], { env, timeout: 3e4 });
+  const commit = head.stdout.trim();
+  if (!/^[a-f0-9]{40}$/u.test(commit)) throw new Error(`${target.host} Hub checkout has no exact commit`);
+  return commit;
+}
+async function observeHubMarketplace(target, command2, env, run6) {
+  if (target.host === "claude" || target.host === "codex") {
+    const observed = await observeMarketplace(target, command2, env, run6);
+    if (!observed.installed) return observed;
+    return { ...observed, commit: await observeHubCheckout(target, observed.root, env, run6) };
+  }
+  const codeBuddyFamily = target.host === "codebuddy" || target.host === "workbuddy";
+  const listed = codeBuddyFamily ? (await runCodeBuddyRead(target, command2, CODEBUDDY_MARKETPLACE_LIST_ARGS, "codebuddy marketplace list", env, run6)).output : await run6(command2, [...CODEBUDDY_MARKETPLACE_LIST_ARGS], { env });
+  const entries = parseJson2(listed.stdout, `${target.host} marketplace list`);
+  if (!Array.isArray(entries)) throw new Error(`${target.host} marketplace list did not return an array`);
+  if (!entries.some((entry) => entry?.name === target.marketplace)) return { installed: false };
+  exactCodeBuddyMarketplaceObservation(target, listed.stdout, { acceptedTypes: ["git", "github"] });
+  const root = await resolveContained(env.CODEBUDDY_CONFIG_DIR, `plugins/marketplaces/${target.marketplace}`);
+  return { installed: true, root, commit: await observeHubCheckout(target, root, env, run6) };
+}
+async function runHubStructuredUpdate(target, detected, run6, { plan, root, verifyInstalledPayload }) {
+  const env = hostEnvironment(target.host);
+  const codeBuddy = target.host === "codebuddy" || target.host === "workbuddy";
+  const readPlugin = /* @__PURE__ */ __name(async () => {
+    const output = codeBuddy ? (await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, "codebuddy plugin list", env, run6)).output : await run6(detected.command, ["plugin", "list", "--json"], { env });
+    const listed = parseJson2(output.stdout, `${target.host} plugin list`);
+    const entries = target.host === "codex" ? listed?.installed : listed;
+    if (Array.isArray(entries) && entries.filter((entry) => (target.host === "codex" ? entry?.pluginId : entry?.id) === `${target.plugin}@${target.marketplace}`).length > 1) throw new Error(`${target.host} plugin list returned conflicting entries`);
+    const observed = exactPluginObservation(target, output.stdout);
+    if (observed.installed) {
+      if (codeBuddy && observed.exact) {
+        observed.installPath = await resolveContained(env.CODEBUDDY_CONFIG_DIR, `plugins/cache/${target.marketplace}/${target.plugin}/${target.version}`);
+      } else if (target.host === "codex") {
+        observed.installPath = observed.found.installedPath;
+        const source = observed.found.source;
+        if (source?.source !== "git" || normalizeHubGitSource(source.url, target.githubHost) !== target.pluginRepo) {
+          throw new Error("codex installed plugin does not point to the frozen public repository");
+        }
+        if (source.sha !== target.pluginCommit || source.ref !== `refs/tags/${target.pluginTag}`) observed.exact = false;
+      }
+      if (observed.found.gitCommitSha !== void 0 && observed.found.gitCommitSha !== target.pluginCommit) observed.exact = false;
+    }
+    return observed;
+  }, "readPlugin");
+  const beforeMarket = await observeHubMarketplace(target, detected.command, env, run6);
+  if (!beforeMarket.installed) return { status: "MANUAL_REQUIRED", reason: `${target.host} declared Hub marketplace is not installed; no marketplace was added` };
+  const before = await readPlugin();
+  if (before.exact && before.installPath) {
+    await assertHubHostEntry(target, beforeMarket.root);
+    await verifyStructuredInstalledPayload({ plan, root, target, installPath: before.installPath, verifyInstalledPayload });
+    return { status: "ALREADY_CURRENT", version: target.version };
+  }
+  if (codeBuddy && !before.installed) return { status: "MANUAL_REQUIRED", reason: `${target.host} target plugin is not installed; no initial installation was performed` };
+  const hubCommit = await withTemporaryWorkspace(async (workspace) => {
+    const checkout = join29(workspace.root, "hub");
+    await run6("git", [
+      "clone",
+      "--depth",
+      "1",
+      "--branch",
+      target.hub.ref.slice("refs/heads/".length),
+      "--single-branch",
+      `https://${target.hub.githubHost}/${target.hub.repo}.git`,
+      checkout
+    ], { env, timeout: target.timeoutMs });
+    const commit = await observeHubCheckout(target, checkout, env, run6);
+    await assertHubHostEntry(target, checkout);
+    return commit;
+  }, { prefix: "release-skill-hub-update-" });
+  if (target.host === "codex") {
+    await bindStructuredMarketplace(
+      { ...target, marketplaceCommit: hubCommit },
+      detected.command,
+      env,
+      run6,
+      { marketplace: { ...beforeMarket, exact: beforeMarket.commit === hubCommit } }
+    );
+  } else {
+    try {
+      await run6(detected.command, ["plugin", "marketplace", "update", target.marketplace], { env, timeout: target.timeoutMs });
+    } catch (error) {
+      if (!isCodeBuddyWriteCommand(target, detected.command, ["plugin", "marketplace", "update", target.marketplace], "marketplace-update") || !isCodeBuddyResidualEnvelope(error)) throw error;
+    }
+  }
+  const refreshed = await observeHubMarketplace(target, detected.command, env, run6);
+  if (!refreshed.installed || refreshed.commit !== hubCommit) throw new Error(`${target.host} Hub branch moved during marketplace refresh`);
+  await assertHubHostEntry(target, refreshed.root);
+  if (codeBuddy) {
+    const remote = await run6("git", ["ls-remote", "--exit-code", `https://${target.hub.githubHost}/${target.hub.repo}.git`, target.hub.ref], { env, timeout: 3e4 });
+    if (!parseFrozenRemoteRef({ ...target, marketplaceCommit: hubCommit }, remote.stdout).exact) {
+      throw new Error(`${target.host} Hub branch moved before plugin update`);
+    }
+  }
+  const current = await readPlugin();
+  const selector = `${target.plugin}@${target.marketplace}`;
+  let installPath;
+  if (target.host === "codex") {
+    if (current.installed) await run6(detected.command, ["plugin", "remove", selector, "--json"], { env });
+    const installed = await run6(detected.command, getPlatform("codex").cli.install(target.plugin, target.marketplace), { env, timeout: target.timeoutMs });
+    const extracted = getPlatform("codex").strategy.extractInstallPath({ execEvidence: { installOutput: parseJson2(installed.stdout, "codex plugin install") } });
+    if (!extracted.ok) throw new Error(extracted.error);
+    installPath = extracted.installPath;
+  } else {
+    const args2 = codeBuddy || current.installed ? ["plugin", "update", selector, "--scope", "user", ...target.host === "claude" ? ["--yes"] : []] : getPlatform("claude").cli.install(target.plugin, target.marketplace);
+    try {
+      await run6(detected.command, args2, { env, timeout: target.timeoutMs });
+    } catch (error) {
+      if (!isCodeBuddyWriteCommand(target, detected.command, args2, "plugin-update") || !isCodeBuddyResidualEnvelope(error)) throw error;
+    }
+  }
+  const after = await readPlugin();
+  if (!after.exact) throw new Error(`${target.host} did not install the frozen plugin identity`);
+  const finalMarket = await observeHubMarketplace(target, detected.command, env, run6);
+  if (!finalMarket.installed || finalMarket.commit !== hubCommit) throw new Error(`${target.host} Hub checkout changed during plugin update`);
+  await assertHubHostEntry(target, finalMarket.root);
+  await verifyStructuredInstalledPayload({ plan, root, target, installPath: installPath ?? after.installPath, verifyInstalledPayload });
+  return { status: "UPDATED", version: target.version, restartRequired: true };
+}
 async function runStructuredUpdate(target, detected, run6, {
   plan,
   root,
   verifyInstalledPayload
 }) {
+  if (target.targetKind === "hub-backed") return runHubStructuredUpdate(target, detected, run6, { plan, root, verifyInstalledPayload });
   if (target.host === "codebuddy" || target.host === "workbuddy") {
     const env2 = hostEnvironment(target.host);
-    const listedObservation = target.host === "codebuddy" ? await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, `${target.host} plugin list`, env2, run6) : { output: await run6(detected.command, [...CODEBUDDY_PLUGIN_LIST_ARGS], { env: env2 }), recovered: false };
+    const listedObservation = await runCodeBuddyRead(
+      target,
+      detected.command,
+      CODEBUDDY_PLUGIN_LIST_ARGS,
+      `${target.host} plugin list`,
+      env2,
+      run6
+    );
     const listed = listedObservation.output;
     const observed = exactPluginObservation(target, listed.stdout);
     if (target.sourceForm !== "bundled-family" || target.pluginRepo !== target.marketplaceRepo || target.pluginCommit !== target.marketplaceCommit) {
@@ -135584,7 +135763,14 @@ async function runStructuredUpdate(target, detected, run6, {
       pluginRecovered = true;
     }
     if (!pluginRecovered) {
-      const afterList = target.host === "codebuddy" ? await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, `${target.host} plugin list`, env2, run6) : { output: await run6(detected.command, [...CODEBUDDY_PLUGIN_LIST_ARGS], { env: env2 }), recovered: false };
+      const afterList = await runCodeBuddyRead(
+        target,
+        detected.command,
+        CODEBUDDY_PLUGIN_LIST_ARGS,
+        `${target.host} plugin list`,
+        env2,
+        run6
+      );
       after2 = exactPluginObservation(target, afterList.output.stdout);
     }
     if (!after2.exact) throw new Error(`${target.host} did not update to the frozen plugin identity`);
@@ -136339,6 +136525,9 @@ async function updateLocalHostPluginsInternal({
         results.push({ host: target.host, unitId: target.unitId, ...outcome2 });
         continue;
       }
+      if (target.targetKind === "hub-backed" && target.host !== "qoder") {
+        await verifyFrozenSnapshot({ root, snapshotPath: target.snapshotPath, expectedDigest: target.manifestDigest });
+      }
       const detected = await detect(target.host);
       if (!detected?.available) {
         results.push({
@@ -136410,9 +136599,11 @@ var init_post_release_local = __esm({
       "TMPDIR",
       "HTTP_PROXY",
       "HTTPS_PROXY",
+      "ALL_PROXY",
       "NO_PROXY",
       "http_proxy",
       "https_proxy",
+      "all_proxy",
       "no_proxy",
       "SSL_CERT_FILE",
       "SSL_CERT_DIR",
@@ -136475,6 +136666,10 @@ var init_post_release_local = __esm({
     __name(bindStructuredMarketplace, "bindStructuredMarketplace");
     __name(actionParametersForTarget, "actionParametersForTarget");
     __name(verifyStructuredInstalledPayload, "verifyStructuredInstalledPayload");
+    __name(assertHubHostEntry, "assertHubHostEntry");
+    __name(observeHubCheckout, "observeHubCheckout");
+    __name(observeHubMarketplace, "observeHubMarketplace");
+    __name(runHubStructuredUpdate, "runHubStructuredUpdate");
     __name(runStructuredUpdate, "runStructuredUpdate");
     __name(parseCodeBuddyRemoteObservation, "parseCodeBuddyRemoteObservation");
     __name(kimiExpectProgram, "kimiExpectProgram");

package/adapters/kimi/skills/release-finish/SKILL.md

@@ -45,7 +45,7 @@ node "$RELEASE_SKILL_LOCAL_FINISH_ENTRY" \
 
 1. `merge.promptRequired=false` 时，发布工作流已经推进或初始化目标分支，不再询问合并。
 2. `merge.promptRequired=true` 时，向用户说明尚未覆盖的发布分支，并询问是否需要合并。用户同意后，先只读核对源分支、目标分支、工作区状态和项目既有合并方式，再用明确的分支名执行；本脚本不猜分支，也不自动推送。
-3. `choose-local-hosts` 出现时，列出计划覆盖的宿主，询问是否更新本机插件。Hub-backed 目标必须显示其声明的 Hub、插件和宿主。Qoder 是其中唯一可执行的 Hub-backed 目标；Claude/Codex 使用现有 marketplace 管理入口，Kimi 使用冻结 GitHub Release 和现有人工确认路径，CodeBuddy/WorkBuddy 明确人工处理且不能固定 Hub ref。后续“用户同意更新”段适用于 `available=true` 的 executable externalActions 目标和 Qoder Hub 目标，其余 Hub-backed 目标仍为人工入口。分支决定和宿主选择可以一次问完。
+3. `choose-local-hosts` 出现时，列出计划覆盖的宿主，询问是否更新本机插件。由 Hub 分发的目标必须显示声明的 Hub、插件和宿主。Claude、Codex、Kimi、CodeBuddy、WorkBuddy 和 Qoder 均为可执行目标，只有用户已选择且冻结身份检查通过时才更新。旧计划中由真实安装动作派生的目标继续使用原路径；身份一致的重复目标只执行一次。分支决定和宿主选择可以一次问完。
 4. 用户明确不处理本机宿主时，向同一命令加入 `--skip-local-hosts`。该选择会显示地跳过宿主更新、加载和 setup，不得与 `--hosts` 或 `--update-local-hosts` 同时使用。
 
 ## postVerify 提案送达边界
@@ -74,11 +74,13 @@ node "$RELEASE_SKILL_LOCAL_FINISH_ENTRY" \
 
 只传用户选择且计划声明的宿主。Cursor 选择方式见下节；其他宿主 CLI 不存在时返回 `SKIPPED_NOT_INSTALLED`。各宿主按以下规则处理：
 
-- Claude 或 Codex 只有在市场需要重绑时，才会在该宿主第一条写命令之前只读查询冻结的市场仓库、引用和提交。远端不可达、引用缺失或提交不一致时返回 `MANUAL_REQUIRED`，该宿主不执行市场或插件写入；其他已选宿主继续处理。精确当前安装仍核对真实载荷，但不强制联网。
+- Claude/Codex 的 Hub 目标只使用已经登记的同源市场。升级前先读取声明的 Hub 分支，并核对宿主专用索引中的插件仓库、标签、提交及存在的版本字段。刷新市场后再次核对实际目录和条目，再执行原有更新或重装命令。Claude 精确当前安装会离线核对真实载荷；Codex 列表不提供安装根时，仍须正式重装，从安装输出取得 `installedPath` 后核对载荷。旧安装动作继续使用冻结市场引用预检；远端不可达或引用不符时返回 `MANUAL_REQUIRED`。每个宿主单独保留结果，失败不会中断其他已选宿主。
 - Kimi 的精确当前安装会在返回 `ALREADY_CURRENT` 前核对真实载荷；发生安装或迁移时，只在操作完成后核对结果。配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、用户主目录下的 `.kimi-code`，TUI 与安装后观察使用同一根。release-finish 当前只采用并验证 Kimi Code 的受控终端交互界面（TUI）路径，并把 TUI 工作目录固定为 `--root` 指定的当前发布项目。用户已确认冻结计划、显式选择更新且 `--hosts` 包含 `kimi` 时，流程读取完整的初始 `Trust this folder?` 对话框，要求其中只有一个正向项 `Trust this folder` 和一个选中项。正向项已经选中时不发送方向键，直接确认；已知拒绝项选中时，按它与正向项的相对位置移动一次，重新读取完整对话框并确认正向项已选中，然后才提交。插件命令发出后再次出现目录信任、界面或选中项未知、正向项缺失或重复、移动后无法确认、超时或提前退出时，该宿主失败并停止后续安装步骤。若后续 Kimi 版本出现新的可复现界面差异，先记录 Kimi 版本、可见选项、选中项及选项关系；这些事实足以唯一确认当前目录、正向信任项和选择结果时，在最近测试补回归与兼容并继续，目录身份或选项语义不明时仍停止并交回主会话。插件信任仍先清理 ANSI/OSC 控制序列和软换行，再分别核对冻结仓库与标签；只有选中 `Trust and install` 才提交并重新加载。包名、版本、发布标签、已安装修订号和受管安装根必须与冻结计划一致；`.git` 只提供附加诊断，不是通过条件。旧的本地路径安装会在同一 TUI 会话中先移除，再按发布标签安装。
-- CodeBuddy/WorkBuddy 只处理同一 bundled-family 插件和市场。CodeBuddy 仅探测全局 `codebuddy`/`cbc`，由收尾脚本把 `CODEBUDDY_CONFIG_DIR` 固定为有效 `HOME`（环境未提供时取操作系统用户主目录）下名为 `.codebuddy` 的目录；WorkBuddy 仅在 macOS 探测 WorkBuddy 应用内嵌 CLI，由收尾脚本把 `CODEBUDDY_CONFIG_DIR` 与 `WORKBUDDY_CONFIG_DIR` 同时固定为有效 `HOME` 下名为 `.workbuddy` 的目录，绝不把两者互作回退。只有冻结标签与计划声明的可变分支都从同一远端解析到冻结提交时，才调用正式市场更新和插件更新命令；完成后重新读取安装列表，并精确核对唯一条目的市场、版本和修订号。目标未安装、来源不符、远端不可访问或身份不一致时返回 `MANUAL_REQUIRED`，不修改宿主。非 macOS 的 WorkBuddy 返回 `SKIPPED_UNSUPPORTED_PLATFORM`。
+- CodeBuddy/WorkBuddy 只升级既有安装，不自动首装。CodeBuddy 仅探测全局 `codebuddy`/`cbc`，配置根固定为有效 `HOME` 下的 `.codebuddy`；WorkBuddy 仅在 macOS 探测应用内嵌 CLI，配置根固定为有效 `HOME` 下的 `.workbuddy`，两者不互作回退。Hub 目标先核对各自 `plugins/marketplaces/<hub>` 的远端和分支，再核对 `.codebuddy-plugin/marketplace.json` 条目。刷新市场后确认远端分支未漂移，才更新插件；最后核对列表中的版本、`gitCommitSha` 和 `plugins/cache/<hub>/<plugin>/<version>` 的完整载荷。旧 bundled-family 目标继续要求插件标签和市场分支均指向冻结提交。非 macOS 的 WorkBuddy 返回 `SKIPPED_UNSUPPORTED_PLATFORM`。
 - Qoder 先用 `qoder plugins marketplace list --json` 核对计划声明的 Hub 名称、仓库、分支和本机 checkout，再用 `qoder plugins list --json` 核对唯一插件条目的市场、`scope=user`、版本与 `installPath`。目标市场或插件未安装时返回 `MANUAL_REQUIRED`，不添加市场，也不执行首次安装。旧版已安装时，只运行 `qoder plugins marketplace update <name>` 和 `qoder plugins update <plugin@marketplace> --scope user`。市场刷新后、插件更新前，必须从 Hub 的 `marketplace.json` 核对目标条目的 `source.url` 和 `source.sha`；操作后从真实 `installPath` 核对 Qoder manifest、完整声明载荷和冻结来源。市场可能在检查与更新之间变化，事后身份不符时报告失败，不自动降级、卸载或覆盖。
 
+Kimi 不使用只有仓库 URL 的 Hub 文件证明标签或提交。它先克隆冻结发布标签并核对提交，再进入既有终端交互流程；启动进程保留 `http_proxy`、`https_proxy` 和 `all_proxy`。
+
 任何宿主失败都保留其他宿主的实际结果，不把失败冒充成功。Cursor 只在本次交换映射可确认且备份迁移失败时恢复自己的原目录。
 
 完成后报告每个宿主的安装状态。Qoder 返回 `UPDATED` 只表示安装载荷已经更新；启动新会话或执行 `/plugins reload` 并核对实际加载版本后，才能报告新版已加载。本机结果只记录收尾事实，不改变发布状态。

package/adapters/kimi/skills/release-help/SKILL.md

@@ -35,9 +35,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.20 候选边界
+## 0.9.22 候选边界
 
-当前 0.9.20 候选精确消费 Foundation 0.21.0 的公开包根 API。0.9.20 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.22 候选精确消费 Foundation 0.21.0 的公开包根 API。0.9.22 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/adapters/qoder/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.20",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"