release-skill 0.9.7 → 0.9.8

package/src/commands/post-release-local.mjs

@@ -35,7 +35,7 @@ const SAFE_ENV_KEYS = Object.freeze([
   'PATH', 'HOME', 'USER', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM', 'TMPDIR',
   'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'http_proxy', 'https_proxy', 'no_proxy',
   'SSL_CERT_FILE', 'SSL_CERT_DIR', 'NODE_EXTRA_CA_CERTS',
-  'CLAUDE_CONFIG_DIR', 'CODEX_HOME', 'KIMI_CONFIG_DIR',
+  'CLAUDE_CONFIG_DIR', 'CODEX_HOME', 'KIMI_CODE_HOME',
   'CODEBUDDY_CONFIG_DIR', 'WORKBUDDY_CONFIG_DIR',
 ]);
 const CODEBUDDY_PLUGIN_LIST_ARGS = Object.freeze(['plugin', 'list', '--json']);
@@ -422,7 +422,7 @@ function hostEnvironment(host, { kimiHome } = {}) {
     env.CODEBUDDY_CONFIG_DIR = join(env.HOME, '.workbuddy');
     env.WORKBUDDY_CONFIG_DIR = join(env.HOME, '.workbuddy');
   }
-  if (host === 'kimi' && kimiHome) env.KIMI_CONFIG_DIR = kimiHome;
+  if (host === 'kimi' && kimiHome) env.KIMI_CODE_HOME = kimiHome;
   return env;
 }
 
@@ -647,6 +647,67 @@ function normalizeGitSource(source) {
     .replace(/\/$/u, '');
 }
 
+function parseFrozenRemoteRef(target, stdout) {
+  const directRefs = new Map();
+  const peeledRefs = new Map();
+  const expected = target.marketplaceRef;
+  const allowedDirect = expected.startsWith('refs/')
+    ? new Set([expected])
+    : new Set([`refs/heads/${expected}`, `refs/tags/${expected}`]);
+  for (const line of String(stdout ?? '').split(/\r?\n/u)) {
+    if (line.length === 0) continue;
+    const match = /^([a-f0-9]{40})\t([^\s]+)$/u.exec(line);
+    if (!match) throw new Error('git ls-remote returned an invalid line');
+    const [, commit, remoteRef] = match;
+    const peeled = remoteRef.endsWith('^{}');
+    const direct = peeled ? remoteRef.slice(0, -3) : remoteRef;
+    if (!allowedDirect.has(direct)) {
+      throw new Error(`git ls-remote returned an unexpected ref ${remoteRef}`);
+    }
+    const destination = peeled ? peeledRefs : directRefs;
+    const previous = destination.get(direct);
+    if (previous && previous !== commit) {
+      throw new Error(`git ls-remote returned conflicting values for ${remoteRef}`);
+    }
+    destination.set(direct, commit);
+  }
+  const resolved = [...allowedDirect]
+    .filter((remoteRef) => directRefs.has(remoteRef) || peeledRefs.has(remoteRef))
+    .map((remoteRef) => peeledRefs.get(remoteRef) ?? directRefs.get(remoteRef));
+  return {
+    found: resolved.length > 0,
+    exact: resolved.length > 0 && resolved.every((commit) => commit === target.marketplaceCommit),
+  };
+}
+
+async function preflightStructuredMarketplace(target, env, run) {
+  try {
+    const observed = await run('git', [
+      'ls-remote', '--exit-code', `https://${target.githubHost}/${target.marketplaceRepo}.git`,
+      target.marketplaceRef, `${target.marketplaceRef}^{}`,
+    ], { env, timeout: 30_000 });
+    const remote = parseFrozenRemoteRef(target, observed.stdout);
+    if (!remote.found) {
+      return {
+        ok: false,
+        reason: `${target.host} frozen marketplace ref ${target.marketplaceRef} is missing`,
+      };
+    }
+    if (!remote.exact) {
+      return {
+        ok: false,
+        reason: `${target.host} frozen marketplace ref ${target.marketplaceRef} does not resolve to ${target.marketplaceCommit}`,
+      };
+    }
+    return { ok: true };
+  } catch (error) {
+    return {
+      ok: false,
+      reason: `${target.host} could not prove the frozen marketplace ref: ${error?.message ?? String(error)}`,
+    };
+  }
+}
+
 async function observeMarketplace(target, command, env, run) {
   const listed = await run(command, ['plugin', 'marketplace', 'list', '--json'], { env });
   const parsed = parseJson(listed.stdout, `${target.host} marketplace list`);
@@ -835,6 +896,11 @@ async function runStructuredUpdate(target, detected, run, {
     return { status: 'ALREADY_CURRENT', version: target.version };
   }
 
+  if (!before.marketplace.exact) {
+    const preflight = await preflightStructuredMarketplace(target, env, run);
+    if (!preflight.ok) return { status: 'MANUAL_REQUIRED', reason: preflight.reason };
+  }
+
   const marketplaceRebound = await bindStructuredMarketplace(target, command, env, run, before);
   const current = target.host === 'claude' && marketplaceRebound
     ? await observeStructuredTarget(target, command, env, run)
@@ -898,49 +964,205 @@ function parseCodeBuddyRemoteObservation(target, stdout) {
 
 function kimiExpectProgram({ removePlugin } = {}) {
   const removeCommand = removePlugin
-    ? `send -- "/plugins remove $removePlugin\\r"
+    ? `submitCommand "/plugins remove $removePlugin"
 expect {
   -nocase -re {(remove|delete|uninstall).*(confirm|sure)|(confirm|sure).*(remove|delete|uninstall)} {
     expect {
-      -ex $removePlugin { send -- "\\033\\[B\\r" }
-      timeout { exit 95 }
-      eof { exit 96 }
+      -ex $removePlugin {
+        send -- "\\033\\[B"
+        send -- "\\033\\[13u"
+      }
+      timeout { failTimeout remove-confirmation 125 127 }
+      eof { failEof remove-confirmation 126 }
+    }
+    expect {
+      -nocase -re {Trust this folder\\?} { directoryTrust }
+      -re $promptPattern {}
+      timeout { failTimeout remove-prompt 128 130 }
+      eof { failEof remove-prompt 129 }
     }
-    expect -re $promptPattern
   }
   -re $promptPattern {}
-  timeout { exit 93 }
-  eof { exit 94 }
+  -nocase -re {Trust this folder\\?} { directoryTrust }
+  timeout { failTimeout remove-dialog 122 124 }
+  eof { failEof remove-dialog 123 }
 }
 `
     : '';
-  return `set timeout 180
-foreach variable {RELEASE_SKILL_KIMI_COMMAND RELEASE_SKILL_KIMI_INSTALL_URL RELEASE_SKILL_KIMI_REMOVE_PLUGIN} {
+  return `set timeout 240
+foreach variable {RELEASE_SKILL_KIMI_COMMAND RELEASE_SKILL_KIMI_INSTALL_URL RELEASE_SKILL_KIMI_REMOVE_PLUGIN RELEASE_SKILL_KIMI_EXPECTED_REPO RELEASE_SKILL_KIMI_EXPECTED_TAG} {
   if {![info exists env($variable)]} { exit 90 }
 }
 set kimiCommand $env(RELEASE_SKILL_KIMI_COMMAND)
 set installUrl $env(RELEASE_SKILL_KIMI_INSTALL_URL)
 set removePlugin $env(RELEASE_SKILL_KIMI_REMOVE_PLUGIN)
-set promptPattern {(?:(?:^|\\r|\\n)> |(?:^|\\r|\\n)(?:\\033\\[[0-9;?]*[ -/]*[@-~])*│[ \\t]*>[ \\t]*│(?:\\033\\[[0-9;?]*[ -/]*[@-~])*)(?![^\\n]|\\n)}
+set expectedRepo $env(RELEASE_SKILL_KIMI_EXPECTED_REPO)
+set expectedTag $env(RELEASE_SKILL_KIMI_EXPECTED_TAG)
+set promptPattern {(?:(?:^|\\r|\\n)> (?:\\r*\\n|$)|(?:^|\\r|\\n)(?:(?:\\033\\[[0-9;?]*[ -/]*[@-~])|\\033\\][^\\x07]*\\x07|[ \\t])*│[^\\r\\n]*>[^\\r\\n]*│(?:(?:\\033\\[[0-9;?]*[ -/]*[@-~])|\\033\\][^\\x07]*\\x07|[ \\t])*(?:\\r*\\n|$))}
+
+proc cleanScreen {value} {
+  regsub -all {\\033\\[[0-9;?]*[ -/]*[@-~]} $value {} value
+  regsub -all {\\033\\][^\\x07]*\\x07} $value {} value
+  regsub -all {\\r} $value {} value
+  return $value
+}
+
+proc compactScreen {value} {
+  set value [cleanScreen $value]
+  regsub -all {[[:space:]]+} $value {} value
+  return [string tolower $value]
+}
+
+proc extractPluginTrustDialog {value} {
+  set cleaned [cleanScreen $value]
+  set lowered [string tolower $cleaned]
+  set dialogStart -1
+  foreach marker {"install third-party plugin " "trust and install from "} {
+    set markerStart [string last $marker $lowered]
+    if {$markerStart > $dialogStart} { set dialogStart $markerStart }
+  }
+  if {$dialogStart < 0} { return "" }
+  return [string range $cleaned $dialogStart end]
+}
+
+proc failTimeout {state timeoutCode unknownCode} {
+  global expect_out
+  set buffer ""
+  if {[info exists expect_out(buffer)]} { set buffer [string trim [cleanScreen $expect_out(buffer)]] }
+  if {$buffer ne ""} {
+    puts stderr "KIMI_TUI_STATE:$state:unknown"
+    exit $unknownCode
+  }
+  puts stderr "KIMI_TUI_STATE:$state:timeout"
+  exit $timeoutCode
+}
+
+proc failEof {state code} {
+  puts stderr "KIMI_TUI_STATE:$state:eof"
+  exit $code
+}
+
+proc directoryTrust {} {
+  puts stderr "KIMI_TUI_STATE:directory-trust:manual-required"
+  exit 80
+}
+
+proc submitCommand {command} {
+  send -- "\\033\\[200~"
+  send -- $command
+  send -- "\\033\\[201~"
+  send -- "\\033\\[13u"
+}
+
 spawn $kimiCommand
-expect -re $promptPattern
-${removeCommand}send -- "/plugins install $installUrl\\r"
+if {[catch {exec stty columns 240 rows 60 < $spawn_out(slave,name)} resizeError]} {
+  puts stderr "KIMI_TUI_STATE:terminal-size:failed"
+  exit 131
+}
 expect {
-  -nocase -re {trust and install} {
-    expect {
-      -ex $installUrl { send -- "\\033\\[B\\r" }
-      timeout { exit 97 }
-      eof { exit 98 }
+  -nocase -re {Trust this folder\\?} { directoryTrust }
+  -re $promptPattern {}
+  timeout { failTimeout initial-prompt 101 103 }
+  eof { failEof initial-prompt 102 }
+}
+${removeCommand}submitCommand "/plugins install $installUrl"
+set dialogBuffer ""
+expect {
+  -nocase -re {Trust this folder\\?} { directoryTrust }
+  -nocase -re {(?:Install third-party plugin|Trust and install from)[ \\t]} {
+    append dialogBuffer $expect_out(buffer)
+  }
+  timeout { failTimeout plugin-trust-anchor 104 106 }
+  eof { failEof plugin-trust-anchor 105 }
+}
+expect {
+  -nocase -re {Trust this folder\\?} { directoryTrust }
+  -nocase -re {❯[^\\r\\n]*(?:Exit|Cancel|Trust and install)} {
+    append dialogBuffer $expect_out(buffer)
+  }
+  -re {❯[^\\r\\n]*\\r*\\n} {
+    puts stderr "KIMI_TUI_STATE:plugin-trust-selected-row:unknown"
+    exit 134
+  }
+  timeout {
+    puts stderr "KIMI_TUI_STATE:plugin-trust-selected-row:timeout"
+    exit 132
+  }
+  eof { failEof plugin-trust-selected-row 133 }
+}
+
+set dialog [extractPluginTrustDialog $dialogBuffer]
+if {$dialog eq ""} {
+  puts stderr "KIMI_TUI_STATE:plugin-trust:dialog-unknown"
+  exit 113
+}
+set compactDialog [compactScreen $dialog]
+if {[string first [string tolower [compactScreen $expectedRepo]] $compactDialog] < 0} {
+  puts stderr "KIMI_TUI_STATE:plugin-trust:repo-mismatch"
+  exit 111
+}
+if {[string first [string tolower [compactScreen $expectedTag]] $compactDialog] < 0} {
+  puts stderr "KIMI_TUI_STATE:plugin-trust:tag-mismatch"
+  exit 112
+}
+if {[regexp -nocase {(^|\\n)[^\\n]*❯[^\\n]*trust and install} $dialog]} {
+  send -- "\\033\\[13u"
+} elseif {[regexp -nocase {(^|\\n)[^\\n]*❯[^\\n]*(cancel|exit)} $dialog]} {
+  send -- "\\033\\[B"
+  expect {
+    -nocase -re {Trust this folder\\?} { directoryTrust }
+    -nocase -re {❯[^\\r\\n]*Trust and install} {}
+    -re {❯[^\\r\\n]*\\r*\\n} {
+      puts stderr "KIMI_TUI_STATE:plugin-trust-confirm-selection:unknown"
+      exit 109
     }
+    timeout { failTimeout plugin-trust-confirm-selection 107 109 }
+    eof { failEof plugin-trust-confirm-selection 108 }
   }
-  timeout { exit 91 }
-  eof { exit 92 }
+  send -- "\\033\\[13u"
+} else {
+  puts stderr "KIMI_TUI_STATE:plugin-trust:selection-unknown"
+  exit 113
+}
+
+expect {
+  -nocase -re {Trust this folder\\?} { directoryTrust }
+  -nocase -re {Install finished[^\\r\\n]*see details below\\.} {}
+  -nocase -re {Installing plugin from[^\\r\\n]*(?:\\r|\\n)} {
+    exp_continue -continue_timer
+  }
+  -nocase -re {Install failed:[^\\r\\n]*} {
+    puts stderr "KIMI_TUI_STATE:install-result:failed"
+    exit 135
+  }
+  -nocase -re {(^|\\r|\\n)Install[^\\r\\n]*\\r*\\n} {
+    puts stderr "KIMI_TUI_STATE:install-result:unknown"
+    exit 138
+  }
+  timeout {
+    puts stderr "KIMI_TUI_STATE:install-result:timeout"
+    exit 136
+  }
+  eof { failEof install-result 137 }
+}
+expect {
+  -nocase -re {Trust this folder\\?} { directoryTrust }
+  -re $promptPattern {}
+  timeout { failTimeout post-install-prompt 114 116 }
+  eof { failEof post-install-prompt 115 }
+}
+submitCommand "/reload"
+expect {
+  -nocase -re {Trust this folder\\?} { directoryTrust }
+  -re $promptPattern {}
+  timeout { failTimeout reload-prompt 117 119 }
+  eof { failEof reload-prompt 118 }
+}
+submitCommand "/exit"
+expect {
+  eof { puts stderr "KIMI_TUI_STATE:exit-eof:eof" }
+  timeout { failTimeout exit-eof 120 121 }
 }
-expect -re $promptPattern
-send -- "/reload\\r"
-expect -re $promptPattern
-send -- "/exit\\r"
-expect eof
 `;
 }
 
@@ -1018,7 +1240,7 @@ async function runKimiUpdate(target, detected, run, kimiHome, {
     });
     return { status: 'ALREADY_CURRENT', version: target.version };
   }
-  await withTemporaryWorkspace(async (workspace) => {
+  const tuiOutcome = await withTemporaryWorkspace(async (workspace) => {
     const checkout = join(workspace.root, 'plugin');
     await run('git', [
       'clone', '--depth', '1', '--branch', target.pluginTag, '--single-branch',
@@ -1033,18 +1255,31 @@ async function runKimiUpdate(target, detected, run, kimiHome, {
     }
     const installUrl = `https://github.com/${target.pluginRepo}/releases/tag/${target.pluginTag}`;
     const removePlugin = before.source === 'legacy' ? target.plugin : '';
-    await run(detected.expectCommand, ['-c', kimiExpectProgram({
-      ...(removePlugin ? { removePlugin } : {}),
-    })], {
-      timeout: 240_000,
-      env: {
-        ...env,
-        RELEASE_SKILL_KIMI_COMMAND: detected.command,
-        RELEASE_SKILL_KIMI_INSTALL_URL: installUrl,
-        RELEASE_SKILL_KIMI_REMOVE_PLUGIN: removePlugin,
-      },
-    });
+    try {
+      await run(detected.expectCommand, ['-c', kimiExpectProgram({
+        ...(removePlugin ? { removePlugin } : {}),
+      })], {
+        timeout: Math.max(300_000, target.timeoutMs),
+        env: {
+          ...env,
+          RELEASE_SKILL_KIMI_COMMAND: detected.command,
+          RELEASE_SKILL_KIMI_INSTALL_URL: installUrl,
+          RELEASE_SKILL_KIMI_REMOVE_PLUGIN: removePlugin,
+          RELEASE_SKILL_KIMI_EXPECTED_REPO: `https://github.com/${target.pluginRepo}`,
+          RELEASE_SKILL_KIMI_EXPECTED_TAG: target.pluginTag,
+        },
+      });
+    } catch (error) {
+      if (error?.exitStatus === 80) {
+        return {
+          status: 'MANUAL_REQUIRED',
+          reason: 'Kimi requires folder trust; release-finish did not confirm the folder or continue installation',
+        };
+      }
+      throw error;
+    }
   }, { prefix: 'release-skill-kimi-update-' });
+  if (tuiOutcome) return tuiOutcome;
   const after = await observeKimiTarget(target, kimiHome, run);
   if (!after.exact) throw new Error('Kimi did not report the frozen plugin identity after TUI installation');
   await verifyStructuredInstalledPayload({
@@ -1098,7 +1333,7 @@ async function updateLocalHostPluginsInternal({
   kimiHome,
   verifyInstalledPayload = verifyInstalledMarketplacePayload,
 } = {}) {
-  const effectiveKimiHome = kimiHome ?? process.env.KIMI_CONFIG_DIR ?? join(homedir(), '.kimi-code');
+  const effectiveKimiHome = kimiHome ?? process.env.KIMI_CODE_HOME ?? join(homedir(), '.kimi-code');
   const checklist = derivePostReleaseChecklist(plan, { postVerifyComplete: true });
   if (confirmPlanDigest !== plan.digest) {
     throw new Error('plan digest confirmation does not match the frozen release plan');

package/src/commands/ship.mjs

@@ -8,6 +8,7 @@ import {
   effectiveHookRequiresApproval,
   normalizePostPublishView,
   postPublishActionId,
+  requiresPostPublishDistribution,
 } from '../core/postpublish.mjs';
 import {
   derivePostReleaseChecklist,
@@ -652,13 +653,10 @@ export async function advanceShip(options = {}, injected = {}) {
 
   if (state.status === 'PUBLISHED' || state.status === 'NEEDS_MANUAL_ATTESTATIONS') {
     // Step 1: Check if postPublish requires distribution.
-    // Hooks-only declarations (no targets) still route through distribute.
-    // §4.3 unified normalization: v3 empty arrays carry no distribute work;
-    // legacy absent postPublish resolves to the same empty view.
+    // Only targets and distribute-phase hooks route through distribute;
+    // phase:postVerify hooks belong to their independent post-VERIFIED run.
     const plan = JSON.parse(await readFile(state.planPath, 'utf8'));
-    const hasDistributeWork = normalizePostPublishView(plan).some((declaration) =>
-      (declaration.targets?.length ?? 0) > 0 || (declaration.hooks?.length ?? 0) > 0);
-    const needsDistribution = hasDistributeWork;
+    const needsDistribution = requiresPostPublishDistribution(plan);
     if (needsDistribution && deps.distributeRelease) {
       state.status = 'DISTRIBUTING';
       await writeJsonAtomic(statePath, state);

package/src/commands/verify.mjs

@@ -23,7 +23,11 @@ import { resolveContained } from 'skill-family-harness-node';
 const execFile = promisify(execFileCb);
 
 import { validatePlan, computePlanDigest, validatePlanActionCompleteness } from '../core/plan.mjs';
-import { normalizePostPublishView, postPublishActionId } from '../core/postpublish.mjs';
+import {
+  normalizePostPublishView,
+  postPublishActionId,
+  requiresPostPublishDistribution,
+} from '../core/postpublish.mjs';
 import { createEvidenceWriter } from '../core/evidence.mjs';
 import { readRunRecovery } from '../core/recovery.mjs';
 import {
@@ -1230,15 +1234,11 @@ export async function verifyRelease(options) {
 
     // =======================================================================
     // Step 2b: Check for postPublish distribution requirement.
-    // v0.6.3 R1: the gate triggers on targets OR hooks declarations, and a
-    // PARTIAL distribute run passes only through the blocksVerified:false
+    // The gate triggers only when targets or distribute-phase hooks exist.
+    // A PARTIAL distribute run passes only through the blocksVerified:false
     // exemption path (evaluateDistributeGateRun) — warned, never silent.
     // =======================================================================
-    // §4.3 unified normalization: v3 empty arrays mean no distribution
-    // requirement; legacy absent postPublish resolves to the same empty view.
-    const postPublishDeclarations = normalizePostPublishView(plan);
-    const requiresDistribution = postPublishDeclarations.some((declaration) =>
-      (declaration.targets?.length ?? 0) > 0 || (declaration.hooks?.length ?? 0) > 0);
+    const requiresDistribution = requiresPostPublishDistribution(plan);
     if (requiresDistribution) {
       await evidence.append({ phase: 'verify', step: 'distribute-run-discovery', status: 'started' });
 

package/src/core/postpublish.mjs

@@ -547,6 +547,30 @@ export function normalizePostPublishView(plan) {
   );
 }
 
+/**
+ * Decide whether a frozen plan has work for the distribute phase.
+ *
+ * A declaration requires distribute when it contains at least one legacy
+ * target, an explicit phase:distribute hook, or a hook whose omitted phase
+ * keeps the existing distribute default. phase:postVerify hooks belong only
+ * to the independent postVerify run and must not allocate an empty
+ * distribute predecessor.
+ *
+ * This is the single release-domain authority used by ship, verify, and
+ * recovery. Shape compatibility remains owned by normalizePostPublishView.
+ *
+ * @param {object} plan - Frozen release plan.
+ * @returns {boolean} Whether distribute must precede verify.
+ */
+export function requiresPostPublishDistribution(plan) {
+  return normalizePostPublishView(plan).some((declaration) => (
+    (declaration.targets?.length ?? 0) > 0
+    || (declaration.hooks ?? []).some((hook) => (
+      hook.phase === undefined || hook.phase === 'distribute'
+    ))
+  ));
+}
+
 /**
  * Array-level domain validation: every EXPLICIT hooks[].id must be unique
  * across the whole declaration array (multi-release-unit postPublish v3,

package/src/core/recovery.mjs

@@ -33,7 +33,12 @@ import { validatePlan, computePlanDigest, assertImmutablePlanAuthority } from '.
 import { validateApproval, validateApprovalRecordSchema, assertImmutableApprovalAuthority, computeApprovalDigest } from './approval.mjs';
 import { isMarketplaceAction } from './checkpoints.mjs';
 import { ReleaseError, GATE_FAILED } from './errors.mjs';
-import { effectiveHookRequiresApproval, normalizePostPublishView, postPublishActionId } from './postpublish.mjs';
+import {
+  effectiveHookRequiresApproval,
+  normalizePostPublishView,
+  postPublishActionId,
+  requiresPostPublishDistribution,
+} from './postpublish.mjs';
 import { assertPostPublishApprovalAuthority, validatePostPublishApproval } from './postpublish-approval.mjs';
 
 /** Remote errors alone are insufficient to select a safe recovery phase. */
@@ -274,11 +279,8 @@ export async function readRunRecovery(runPath, options = {}) {
       }
     } else if (['publish', 'reconcile'].includes(command)) {
       if (run.status === 'PUBLISHED') {
-        // §4.3 unified normalization: v3 empty arrays mean no distribute work
-        // at all; only declarations carrying targets or hooks require the
-        // distribution phase.
-        const needsDistribution = normalizePostPublishView(plan).some((declaration) =>
-          (declaration.targets?.length ?? 0) > 0 || (declaration.hooks?.length ?? 0) > 0);
+        // phase:postVerify hooks do not create an empty distribute predecessor.
+        const needsDistribution = requiresPostPublishDistribution(plan);
         code = needsDistribution ? 'DISTRIBUTE' : 'VERIFY';
       } else if (run.status === 'PARTIAL') {
         code = 'RECONCILE';