release-skill 0.9.21 → 0.9.22

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.21.",
+      "Prepare a release plan for version 0.9.22.",
       "Help me understand the release workflow."
     ]
   }

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.22 locale=en baseline=sha256:5b9ca7ff99b3d072831f4f114ff4830f6d76540f7c5262fd1deb97eaec9d0a57 -->
+## [0.9.22] - 2026-09-17
+
+0.9.22 is a local source candidate that fixes two failures found during the real-host rollout of 0.9.21. CodeBuddy and WorkBuddy keep the same frozen Hub identity and installed-payload checks. Foundation dependencies remain pinned to 0.21.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Hub publication remains a compare-and-swap operation. A partial Hub publication is never rolled back or force-pushed automatically.
+- A Hub marketplace reported as github is accepted only on the Hub-backed CodeBuddy/WorkBuddy path. The updater still verifies the checkout origin, branch, HEAD, host-specific index, installed revision, and complete frozen payload.
+- WorkBuddy reuses the existing strict residual_process_group envelope only when the child exited successfully and Foundation reports the exact cleanup evidence. Any field mismatch fails closed before later writes.
+
+### Changed
+
+- Skill Family Hub remains the central marketplace, and its release entry continues to use the existing GitHub Git Data API after release verification.
+
+### Fixed
+
+- CodeBuddy 2.148.0 can now update an existing Hub plugin when its official marketplace list reports type github instead of type git.
+- WorkBuddy can complete the same existing-plugin update when its embedded CodeBuddy CLI exits successfully but leaves a process group that Foundation has already terminated and verified.
+
+### Upgrade Notes
+
+Upgrade from 0.9.21 before running local host finishing for CodeBuddy or WorkBuddy. No configuration migration is required. Remove the old release-skill standalone marketplace; use the ifoohoo/skill-family-hub repository and Hub-qualified plugin id release-skill@skill-family-hub. Reload or restart each updated host before claiming that 0.9.22 is loaded.
+<!-- release-skill:changelog:end version=0.9.22 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.21 locale=en baseline=sha256:90f61122ebbbe5f53bc95be7049aaaab4401e19cc805e76be525e9a74bf0a360 -->
 ## [0.9.21] - 2026-09-17
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.21 -->
+<!-- release-skill:release-version: 0.9.22 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -125,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.21
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.22
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.21 -->
+<!-- release-skill:release-version: 0.9.22 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -113,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.21
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.22
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.21 -->
+<!-- release-skill:release-version: 0.9.22 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,16 +14,15 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.21** (2026-09-17)
+**0.9.22** (2026-09-17)
 
-0.9.21 is a local source candidate that enables automatic local updates for Claude, Codex, Kimi, CodeBuddy, and WorkBuddy when the frozen plan declares a Hub source. Qoder and Cursor retain their existing paths. Foundation dependencies remain pinned to 0.21.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.22 is a local source candidate that fixes two failures found during the real-host rollout of 0.9.21. CodeBuddy and WorkBuddy keep the same frozen Hub identity and installed-payload checks. Foundation dependencies remain pinned to 0.21.0. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
 - Hub publication remains a compare-and-swap operation. A partial Hub publication is never rolled back or force-pushed automatically.
-- CodeBuddy and WorkBuddy only upgrade existing installations and reject a Hub branch that moves before plugin update.
-- Kimi uses the frozen GitHub Release; its repository-only Hub entry is not treated as tag or commit evidence.
-- Completed postVerify lineage, host selection, plan-digest confirmation, and full installed-payload verification remain required. Host failures preserve the results of other selected hosts.
+- A Hub marketplace reported as github is accepted only on the Hub-backed CodeBuddy/WorkBuddy path. The updater still verifies the checkout origin, branch, HEAD, host-specific index, installed revision, and complete frozen payload.
+- WorkBuddy reuses the existing strict residual_process_group envelope only when the child exited successfully and Foundation reports the exact cleanup evidence. Any field mismatch fails closed before later writes.
 
 **Changed**
 
@@ -31,17 +30,16 @@ report stays in a temporary session directory.
 
 **Fixed**
 
-- Hub-only plans now produce executable local host targets without recreating legacy installation actions or distributions.
-- Claude, Codex, CodeBuddy, and WorkBuddy verify their host-specific Hub entries and installed payloads against the frozen release identity.
-- Kimi retains http_proxy, https_proxy, and all_proxy in the process that performs its controlled terminal installation.
+- CodeBuddy 2.148.0 can now update an existing Hub plugin when its official marketplace list reports type github instead of type git.
+- WorkBuddy can complete the same existing-plugin update when its embedded CodeBuddy CLI exits successfully but leaves a process group that Foundation has already terminated and verified.
 
 **Upgrade Notes**
 
-Upgrade from 0.9.20 to automate the five previously manual Hub-backed hosts. No configuration migration is required. Remove the old release-skill standalone marketplace; use the ifoohoo/skill-family-hub repository and Hub-qualified plugin id release-skill@skill-family-hub. Claude can verify an exact current installation offline. Codex performs its existing remove/install flow when its list does not provide an installation root. Installed does not mean loaded: reload or restart the host and confirm the loaded version.
+Upgrade from 0.9.21 before running local host finishing for CodeBuddy or WorkBuddy. No configuration migration is required. Remove the old release-skill standalone marketplace; use the ifoohoo/skill-family-hub repository and Hub-qualified plugin id release-skill@skill-family-hub. Reload or restart each updated host before claiming that 0.9.22 is loaded.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.21 is the current source candidate. This README
+> **Current boundary:** v0.9.22 is the current source candidate. This README
 > records intended scope and verification boundaries; it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -65,7 +63,7 @@ Upgrade from 0.9.20 to automate the five previously manual Hub-backed hosts. No
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.9.21 is the current
+> **Production path verified since the v0.1.1 milestone; v0.9.22 is the current
 > source candidate. Its README does not establish publication,
 > consumer-installation verification, or independent acceptance.**
 > The npm-installed CLI is the supported user entry. Source checkout
@@ -94,7 +92,7 @@ checkpoints remain intact and use matching-version recovery. Evidence v1 stays
 read-only; v2 uses a closed top level with phase extensions in `details`.
 Summaries and recovery suggestions are diagnostic, never publication authority.
 
-The current 0.9.21 candidate includes the narrow R-05 Hook cache v2 consumer
+The current 0.9.22 candidate includes the narrow R-05 Hook cache v2 consumer
 path, the public `postverify` path, and the stable isolated install-tree record
 path (A2/A3). It also adds the explicit-input `verify-records` command and a
 self-contained Qoder projection, first-class Cursor packaging, and the
@@ -879,7 +877,7 @@ run. The core prepare, publish, and verify workflow remains cross-platform.
 A release unit may also declare `postPublish.localHostUpdate` for a plugin that
 is delivered through a project-selected Hub by a `postVerify` hook. After that
 hook reaches `DISTRIBUTED`, `ship`, `verify`, `post-release`, and
-`release-finish` display the declared Hub, plugin, and hosts. Version 0.9.21
+`release-finish` display the declared Hub, plugin, and hosts. Version 0.9.22
 makes Claude, Codex, Kimi, CodeBuddy, WorkBuddy, and Qoder executable after
 explicit host selection and plan-digest confirmation. Claude and Codex require
 an existing matching Hub marketplace and verify its host-specific entry before

package/README.zh-CN.md

@@ -2,22 +2,21 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.21 -->
+<!-- release-skill:release-version: 0.9.22 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.21** (2026-09-17)
+**0.9.22** (2026-09-17)
 
-0.9.21 是一个本地源码候选，补齐冻结计划声明 Hub 来源后，Claude、Codex、Kimi、CodeBuddy 和 WorkBuddy 的本机自动更新。Qoder 与 Cursor 保留原有路径。Foundation 依赖继续固定为 0.21.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.22 是一个本地源码候选，修复 0.9.21 真实宿主收尾暴露的两处问题。CodeBuddy 与 WorkBuddy 继续使用同一份冻结 Hub 身份和安装载荷检查。Foundation 依赖保持固定为 0.21.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
 - Hub 发布继续绑定已观察的分支头执行比较后写入。部分发布时不回滚、不覆盖已经成功的远端步骤。
-- CodeBuddy 与 WorkBuddy 只升级既有安装；插件写入前发现 Hub 分支漂移时停止。
-- Kimi 直接使用冻结 GitHub Release，不把只有仓库 URL 的 Hub 条目作为标签或提交证据。
-- 继续要求完整 postVerify 谱系、用户选择宿主、确认计划摘要和完整载荷验证。单个宿主失败时保留其他已选宿主的实际结果。
+- 只有 Hub-backed CodeBuddy/WorkBuddy 路径接受 github 市场类型。更新器仍核对 checkout 的 origin、分支、HEAD、宿主专用索引、安装修订号和完整冻结载荷。
+- WorkBuddy 只复用现有的严格 residual_process_group 信封。子进程必须成功退出，Foundation 也必须返回精确的清理证据；任一字段不符时，在后续写入前失败关闭。
 
 **变更**
 
@@ -25,17 +24,16 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 
 **修复**
 
-- 仅声明 Hub 的计划现在可以生成可执行宿主目标，不再需要旧安装动作或旧宿主 distribution。
-- Claude、Codex、CodeBuddy 和 WorkBuddy 按各自 Hub 索引核对冻结发布身份，并比较实际安装载荷。
-- Kimi 终端安装进程保留 http_proxy、https_proxy 和 all_proxy 三个代理变量。
+- CodeBuddy 2.148.0 的官方市场列表返回 github 类型时，现在可以继续更新既有 Hub 插件。
+- WorkBuddy 的内嵌 CodeBuddy CLI 成功退出，且 Foundation 已清理并验证残留进程组时，现在可以完成同一条既有插件更新路径。
 
 **升级说明**
 
-从 0.9.20 升级后，原先只能人工处理的五个 Hub 宿主可自动更新，无需迁移配置。请移除独立的 `release-skill` 市场，改用 ifoohoo/skill-family-hub 仓库与 Hub 限定插件名 release-skill@skill-family-hub。Claude 可以离线复验精确当前安装；Codex 列表不提供安装根时继续使用既有卸载再安装流程。安装完成不代表会话已加载新版，仍需重新加载或重启宿主并确认版本。
+执行 CodeBuddy 或 WorkBuddy 本机宿主收尾前，请从 0.9.21 升级到 0.9.22，无需迁移配置。请移除独立的 `release-skill` 市场，改用 ifoohoo/skill-family-hub 仓库与 Hub 限定插件名 release-skill@skill-family-hub。更新后必须重新加载或重启宿主，确认实际加载 0.9.22 后再报告完成。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.21 只是当前源码候选。本 README 记录预期范围与验证边界，
+> **当前边界：** v0.9.22 只是当前源码候选。本 README 记录预期范围与验证边界，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -51,7 +49,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.21 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.22 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -69,7 +67,7 @@ marketplace 委托目标工作区发布的边界不变。
 
 旧 production 计划缺少 `sourceAuthority` 时，在外部写入前拒绝。未发生外部写入的计划必须重新 prepare 并批准新摘要，不能补写旧计划或迁移批准。已有 `PARTIAL` 保留检查点，走匹配版本的恢复路径。evidence v1 只读；v2 顶层封闭，阶段扩展放在 `details`。摘要和恢复建议只作诊断，不构成发布权威。
 
-当前 0.9.21 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
+当前 0.9.22 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
 路径和稳定隔离安装树记录路径（A2/A3），并增加只接受显式输入的 `verify-records`
 命令、自包含 Qoder 投影、Cursor 正式打包，以及基于 Foundation 的宿主核验桥。
 Skill Family Hub 仍是唯一市场来源。
@@ -735,7 +733,7 @@ verify run；核心 prepare、publish、verify 流程仍跨平台。
 
 如果插件由项目选定的 Hub 通过 `postVerify` Hook 交付，发布单元还可以声明
 `postPublish.localHostUpdate`。Hook 达到 `DISTRIBUTED` 后，`ship`、`verify`、
-`post-release` 和 `release-finish` 会显示声明中的 Hub、插件和宿主。0.9.21 让 Claude、
+`post-release` 和 `release-finish` 会显示声明中的 Hub、插件和宿主。0.9.22 让 Claude、
 Codex、Kimi、CodeBuddy、WorkBuddy 和 Qoder 在用户选择宿主并确认计划摘要后进入执行。
 Claude 和 Codex 要求已有同源 Hub 市场，并在插件写入前核对宿主专用条目。CodeBuddy
 与 WorkBuddy 只升级既有安装，刷新市场后再次检查 Hub 分支是否漂移。Kimi 使用冻结

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.21"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.22"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "250625e18d802aeb764f43f469e6addbee46fa1b1a9fe1b672f1ccb8c98c0a81";
+const __bundleSourceDigest = "45eaf443ea0ae412317287ca2fa661303666663c304c4691330b5ea1e700881d";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -135120,10 +135120,10 @@ function isCodeBuddyResidualEnvelope(error) {
   return envelope?.ok === false && envelope.exitStatus === 124 && envelope.processStatus === "TERMINATED" && envelope.terminationReason === "child_exit" && envelope.watchdogReason === "residual_process_group" && evidence?.childExitCode === 0 && (evidence.childSignal === null || evidence.childSignal === void 0) && evidence.residualGroupCleanupCompleted === true && evidence.forcedKill === false && evidence.outputLimitExceeded === null && Array.isArray(signals) && signals.length === 1 && signal?.signal === "SIGTERM" && signal.requestedMode === "process_group" && signal.successfulMode === "process_group";
 }
 function isCodeBuddyReadCommand(target, command2, args2) {
-  return target.host === "codebuddy" && (command2 === "codebuddy" || command2 === "cbc" || command2 === CODEBUDDY_MACOS_PATH) && Array.isArray(args2) && (args2.every((value, index) => value === CODEBUDDY_PLUGIN_LIST_ARGS[index]) && args2.length === CODEBUDDY_PLUGIN_LIST_ARGS.length || args2.every((value, index) => value === CODEBUDDY_MARKETPLACE_LIST_ARGS[index]) && args2.length === CODEBUDDY_MARKETPLACE_LIST_ARGS.length);
+  return (target.host === "codebuddy" || target.host === "workbuddy") && (command2 === "codebuddy" || command2 === "cbc" || command2 === CODEBUDDY_MACOS_PATH) && Array.isArray(args2) && (args2.every((value, index) => value === CODEBUDDY_PLUGIN_LIST_ARGS[index]) && args2.length === CODEBUDDY_PLUGIN_LIST_ARGS.length || args2.every((value, index) => value === CODEBUDDY_MARKETPLACE_LIST_ARGS[index]) && args2.length === CODEBUDDY_MARKETPLACE_LIST_ARGS.length);
 }
 function isCodeBuddyWriteCommand(target, command2, args2, kind) {
-  if (target.host !== "codebuddy" || !["codebuddy", "cbc", CODEBUDDY_MACOS_PATH].includes(command2)) return false;
+  if (!["codebuddy", "workbuddy"].includes(target.host) || !["codebuddy", "cbc", CODEBUDDY_MACOS_PATH].includes(command2)) return false;
   const expected = kind === "marketplace-update" ? ["plugin", "marketplace", "update", target.marketplace] : ["plugin", "update", `${target.plugin}@${target.marketplace}`, "--scope", "user"];
   return Array.isArray(args2) && args2.length === expected.length && args2.every((value, index) => value === expected[index]);
 }
@@ -135141,14 +135141,14 @@ async function runCodeBuddyRead(target, command2, args2, label, env, run6) {
     };
   }
 }
-function exactCodeBuddyMarketplaceObservation(target, stdout) {
+function exactCodeBuddyMarketplaceObservation(target, stdout, { acceptedTypes = ["git"] } = {}) {
   const parsed = parseJson2(stdout, `${target.host} marketplace list`);
   if (!Array.isArray(parsed)) throw new Error(`${target.host} marketplace list did not return an array`);
   const matches = parsed.filter((entry) => entry?.name === target.marketplace);
   if (matches.length !== 1) {
     throw new Error(`${target.host} marketplace list did not contain exactly one ${target.marketplace}`);
   }
-  if (matches[0].type !== "git") {
+  if (!acceptedTypes.includes(matches[0].type)) {
     throw new Error(`${target.host} marketplace ${target.marketplace} is not a git marketplace`);
   }
   return { installed: true, exact: true, found: matches[0] };
@@ -135558,11 +135558,12 @@ async function observeHubMarketplace(target, command2, env, run6) {
     if (!observed.installed) return observed;
     return { ...observed, commit: await observeHubCheckout(target, observed.root, env, run6) };
   }
-  const listed = target.host === "codebuddy" ? (await runCodeBuddyRead(target, command2, CODEBUDDY_MARKETPLACE_LIST_ARGS, "codebuddy marketplace list", env, run6)).output : await run6(command2, [...CODEBUDDY_MARKETPLACE_LIST_ARGS], { env });
+  const codeBuddyFamily = target.host === "codebuddy" || target.host === "workbuddy";
+  const listed = codeBuddyFamily ? (await runCodeBuddyRead(target, command2, CODEBUDDY_MARKETPLACE_LIST_ARGS, "codebuddy marketplace list", env, run6)).output : await run6(command2, [...CODEBUDDY_MARKETPLACE_LIST_ARGS], { env });
   const entries = parseJson2(listed.stdout, `${target.host} marketplace list`);
   if (!Array.isArray(entries)) throw new Error(`${target.host} marketplace list did not return an array`);
   if (!entries.some((entry) => entry?.name === target.marketplace)) return { installed: false };
-  exactCodeBuddyMarketplaceObservation(target, listed.stdout);
+  exactCodeBuddyMarketplaceObservation(target, listed.stdout, { acceptedTypes: ["git", "github"] });
   const root = await resolveContained(env.CODEBUDDY_CONFIG_DIR, `plugins/marketplaces/${target.marketplace}`);
   return { installed: true, root, commit: await observeHubCheckout(target, root, env, run6) };
 }
@@ -135570,7 +135571,7 @@ async function runHubStructuredUpdate(target, detected, run6, { plan, root, veri
   const env = hostEnvironment(target.host);
   const codeBuddy = target.host === "codebuddy" || target.host === "workbuddy";
   const readPlugin = /* @__PURE__ */ __name(async () => {
-    const output = target.host === "codebuddy" ? (await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, "codebuddy plugin list", env, run6)).output : await run6(detected.command, ["plugin", "list", "--json"], { env });
+    const output = codeBuddy ? (await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, "codebuddy plugin list", env, run6)).output : await run6(detected.command, ["plugin", "list", "--json"], { env });
     const listed = parseJson2(output.stdout, `${target.host} plugin list`);
     const entries = target.host === "codex" ? listed?.installed : listed;
     if (Array.isArray(entries) && entries.filter((entry) => (target.host === "codex" ? entry?.pluginId : entry?.id) === `${target.plugin}@${target.marketplace}`).length > 1) throw new Error(`${target.host} plugin list returned conflicting entries`);
@@ -135672,7 +135673,14 @@ async function runStructuredUpdate(target, detected, run6, {
   if (target.targetKind === "hub-backed") return runHubStructuredUpdate(target, detected, run6, { plan, root, verifyInstalledPayload });
   if (target.host === "codebuddy" || target.host === "workbuddy") {
     const env2 = hostEnvironment(target.host);
-    const listedObservation = target.host === "codebuddy" ? await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, `${target.host} plugin list`, env2, run6) : { output: await run6(detected.command, [...CODEBUDDY_PLUGIN_LIST_ARGS], { env: env2 }), recovered: false };
+    const listedObservation = await runCodeBuddyRead(
+      target,
+      detected.command,
+      CODEBUDDY_PLUGIN_LIST_ARGS,
+      `${target.host} plugin list`,
+      env2,
+      run6
+    );
     const listed = listedObservation.output;
     const observed = exactPluginObservation(target, listed.stdout);
     if (target.sourceForm !== "bundled-family" || target.pluginRepo !== target.marketplaceRepo || target.pluginCommit !== target.marketplaceCommit) {
@@ -135755,7 +135763,14 @@ async function runStructuredUpdate(target, detected, run6, {
       pluginRecovered = true;
     }
     if (!pluginRecovered) {
-      const afterList = target.host === "codebuddy" ? await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, `${target.host} plugin list`, env2, run6) : { output: await run6(detected.command, [...CODEBUDDY_PLUGIN_LIST_ARGS], { env: env2 }), recovered: false };
+      const afterList = await runCodeBuddyRead(
+        target,
+        detected.command,
+        CODEBUDDY_PLUGIN_LIST_ARGS,
+        `${target.host} plugin list`,
+        env2,
+        run6
+      );
       after2 = exactPluginObservation(target, afterList.output.stdout);
     }
     if (!after2.exact) throw new Error(`${target.host} did not update to the frozen plugin identity`);

package/adapters/claude/skills/release-help/SKILL.md

@@ -28,9 +28,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.21 候选边界
+## 0.9.22 候选边界
 
-当前 0.9.21 候选精确消费 Foundation 0.21.0 的公开包根 API。0.9.21 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.22 候选精确消费 Foundation 0.21.0 的公开包根 API。0.9.22 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.21.",
+      "Prepare a release plan for version 0.9.22.",
       "Help me understand the release workflow."
     ]
   }

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.21"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.22"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "250625e18d802aeb764f43f469e6addbee46fa1b1a9fe1b672f1ccb8c98c0a81";
+const __bundleSourceDigest = "45eaf443ea0ae412317287ca2fa661303666663c304c4691330b5ea1e700881d";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -135120,10 +135120,10 @@ function isCodeBuddyResidualEnvelope(error) {
   return envelope?.ok === false && envelope.exitStatus === 124 && envelope.processStatus === "TERMINATED" && envelope.terminationReason === "child_exit" && envelope.watchdogReason === "residual_process_group" && evidence?.childExitCode === 0 && (evidence.childSignal === null || evidence.childSignal === void 0) && evidence.residualGroupCleanupCompleted === true && evidence.forcedKill === false && evidence.outputLimitExceeded === null && Array.isArray(signals) && signals.length === 1 && signal?.signal === "SIGTERM" && signal.requestedMode === "process_group" && signal.successfulMode === "process_group";
 }
 function isCodeBuddyReadCommand(target, command2, args2) {
-  return target.host === "codebuddy" && (command2 === "codebuddy" || command2 === "cbc" || command2 === CODEBUDDY_MACOS_PATH) && Array.isArray(args2) && (args2.every((value, index) => value === CODEBUDDY_PLUGIN_LIST_ARGS[index]) && args2.length === CODEBUDDY_PLUGIN_LIST_ARGS.length || args2.every((value, index) => value === CODEBUDDY_MARKETPLACE_LIST_ARGS[index]) && args2.length === CODEBUDDY_MARKETPLACE_LIST_ARGS.length);
+  return (target.host === "codebuddy" || target.host === "workbuddy") && (command2 === "codebuddy" || command2 === "cbc" || command2 === CODEBUDDY_MACOS_PATH) && Array.isArray(args2) && (args2.every((value, index) => value === CODEBUDDY_PLUGIN_LIST_ARGS[index]) && args2.length === CODEBUDDY_PLUGIN_LIST_ARGS.length || args2.every((value, index) => value === CODEBUDDY_MARKETPLACE_LIST_ARGS[index]) && args2.length === CODEBUDDY_MARKETPLACE_LIST_ARGS.length);
 }
 function isCodeBuddyWriteCommand(target, command2, args2, kind) {
-  if (target.host !== "codebuddy" || !["codebuddy", "cbc", CODEBUDDY_MACOS_PATH].includes(command2)) return false;
+  if (!["codebuddy", "workbuddy"].includes(target.host) || !["codebuddy", "cbc", CODEBUDDY_MACOS_PATH].includes(command2)) return false;
   const expected = kind === "marketplace-update" ? ["plugin", "marketplace", "update", target.marketplace] : ["plugin", "update", `${target.plugin}@${target.marketplace}`, "--scope", "user"];
   return Array.isArray(args2) && args2.length === expected.length && args2.every((value, index) => value === expected[index]);
 }
@@ -135141,14 +135141,14 @@ async function runCodeBuddyRead(target, command2, args2, label, env, run6) {
     };
   }
 }
-function exactCodeBuddyMarketplaceObservation(target, stdout) {
+function exactCodeBuddyMarketplaceObservation(target, stdout, { acceptedTypes = ["git"] } = {}) {
   const parsed = parseJson2(stdout, `${target.host} marketplace list`);
   if (!Array.isArray(parsed)) throw new Error(`${target.host} marketplace list did not return an array`);
   const matches = parsed.filter((entry) => entry?.name === target.marketplace);
   if (matches.length !== 1) {
     throw new Error(`${target.host} marketplace list did not contain exactly one ${target.marketplace}`);
   }
-  if (matches[0].type !== "git") {
+  if (!acceptedTypes.includes(matches[0].type)) {
     throw new Error(`${target.host} marketplace ${target.marketplace} is not a git marketplace`);
   }
   return { installed: true, exact: true, found: matches[0] };
@@ -135558,11 +135558,12 @@ async function observeHubMarketplace(target, command2, env, run6) {
     if (!observed.installed) return observed;
     return { ...observed, commit: await observeHubCheckout(target, observed.root, env, run6) };
   }
-  const listed = target.host === "codebuddy" ? (await runCodeBuddyRead(target, command2, CODEBUDDY_MARKETPLACE_LIST_ARGS, "codebuddy marketplace list", env, run6)).output : await run6(command2, [...CODEBUDDY_MARKETPLACE_LIST_ARGS], { env });
+  const codeBuddyFamily = target.host === "codebuddy" || target.host === "workbuddy";
+  const listed = codeBuddyFamily ? (await runCodeBuddyRead(target, command2, CODEBUDDY_MARKETPLACE_LIST_ARGS, "codebuddy marketplace list", env, run6)).output : await run6(command2, [...CODEBUDDY_MARKETPLACE_LIST_ARGS], { env });
   const entries = parseJson2(listed.stdout, `${target.host} marketplace list`);
   if (!Array.isArray(entries)) throw new Error(`${target.host} marketplace list did not return an array`);
   if (!entries.some((entry) => entry?.name === target.marketplace)) return { installed: false };
-  exactCodeBuddyMarketplaceObservation(target, listed.stdout);
+  exactCodeBuddyMarketplaceObservation(target, listed.stdout, { acceptedTypes: ["git", "github"] });
   const root = await resolveContained(env.CODEBUDDY_CONFIG_DIR, `plugins/marketplaces/${target.marketplace}`);
   return { installed: true, root, commit: await observeHubCheckout(target, root, env, run6) };
 }
@@ -135570,7 +135571,7 @@ async function runHubStructuredUpdate(target, detected, run6, { plan, root, veri
   const env = hostEnvironment(target.host);
   const codeBuddy = target.host === "codebuddy" || target.host === "workbuddy";
   const readPlugin = /* @__PURE__ */ __name(async () => {
-    const output = target.host === "codebuddy" ? (await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, "codebuddy plugin list", env, run6)).output : await run6(detected.command, ["plugin", "list", "--json"], { env });
+    const output = codeBuddy ? (await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, "codebuddy plugin list", env, run6)).output : await run6(detected.command, ["plugin", "list", "--json"], { env });
     const listed = parseJson2(output.stdout, `${target.host} plugin list`);
     const entries = target.host === "codex" ? listed?.installed : listed;
     if (Array.isArray(entries) && entries.filter((entry) => (target.host === "codex" ? entry?.pluginId : entry?.id) === `${target.plugin}@${target.marketplace}`).length > 1) throw new Error(`${target.host} plugin list returned conflicting entries`);
@@ -135672,7 +135673,14 @@ async function runStructuredUpdate(target, detected, run6, {
   if (target.targetKind === "hub-backed") return runHubStructuredUpdate(target, detected, run6, { plan, root, verifyInstalledPayload });
   if (target.host === "codebuddy" || target.host === "workbuddy") {
     const env2 = hostEnvironment(target.host);
-    const listedObservation = target.host === "codebuddy" ? await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, `${target.host} plugin list`, env2, run6) : { output: await run6(detected.command, [...CODEBUDDY_PLUGIN_LIST_ARGS], { env: env2 }), recovered: false };
+    const listedObservation = await runCodeBuddyRead(
+      target,
+      detected.command,
+      CODEBUDDY_PLUGIN_LIST_ARGS,
+      `${target.host} plugin list`,
+      env2,
+      run6
+    );
     const listed = listedObservation.output;
     const observed = exactPluginObservation(target, listed.stdout);
     if (target.sourceForm !== "bundled-family" || target.pluginRepo !== target.marketplaceRepo || target.pluginCommit !== target.marketplaceCommit) {
@@ -135755,7 +135763,14 @@ async function runStructuredUpdate(target, detected, run6, {
       pluginRecovered = true;
     }
     if (!pluginRecovered) {
-      const afterList = target.host === "codebuddy" ? await runCodeBuddyRead(target, detected.command, CODEBUDDY_PLUGIN_LIST_ARGS, `${target.host} plugin list`, env2, run6) : { output: await run6(detected.command, [...CODEBUDDY_PLUGIN_LIST_ARGS], { env: env2 }), recovered: false };
+      const afterList = await runCodeBuddyRead(
+        target,
+        detected.command,
+        CODEBUDDY_PLUGIN_LIST_ARGS,
+        `${target.host} plugin list`,
+        env2,
+        run6
+      );
       after2 = exactPluginObservation(target, afterList.output.stdout);
     }
     if (!after2.exact) throw new Error(`${target.host} did not update to the frozen plugin identity`);

package/adapters/codex/skills/release-help/SKILL.md

@@ -35,9 +35,9 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.21 候选边界
+## 0.9.22 候选边界
 
-当前 0.9.21 候选精确消费 Foundation 0.21.0 的公开包根 API。0.9.21 仍是源码候选，不能从本说明推断已批准、发布或验证。
+当前 0.9.22 候选精确消费 Foundation 0.21.0 的公开包根 API。0.9.22 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 冻结前，`prepare` 或新建 `ship` 状态可重复传入 `--unit <id>`；不传则选择全部单元。延期单元不进入计划，也不获得发布状态。完整配置、生成物新鲜度和顶层 Hook 仍覆盖全项目；`publicSourceAuthorityReceipt` 的 coordinator 与 subjects 必须共同选择。冻结后以 `plan.units` 为唯一范围，publish、reconcile、verify、distribute 不再接受 `--unit`。
 

package/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.21",
+  "version": "0.9.22",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"