release: v0.5.0

Author: loong10k

.agents/plugins/marketplace.json

@@ -16,7 +16,7 @@
         "authentication": "ON_USE"
       },
       "category": "Developer Tools",
-      "version": "0.4.0",
+      "version": "0.5.0",
       "description": "Cross-language code lint enforcement for AI coding assistants (ZCode, Claude Code, Codex CLI, Kimi Code): Java, Rust, TypeScript, Python. PostToolUse hook auto-runs the native linter on every AI-written file and blocks on failure in strict mode.",
       "icon": "https://raw.githubusercontent.com/partme-ai/partme-codeguard-plugin/main/assets/official-logo.png",
       "interface": {

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codeguard",
-  "version": "0.4.0+codex.20260919",
+  "version": "0.5.0+codex.20260919",
   "description": "Cross-language code lint enforcement for AI coding assistants (ZCode, Claude Code, Codex CLI, Kimi Code): Java, Rust, TypeScript, Python. PostToolUse hook auto-runs the native linter on every AI-written file and blocks on failure in strict mode.",
   "author": {
     "name": "Full Stack Skills / PartMe.AI",

.github/workflows/skills-sync.yml

@@ -6,6 +6,15 @@ on:
   schedule:
     - cron: "41 3 * * *"
   workflow_dispatch:
+    inputs:
+      ref:
+        description: Optional immutable codeguard-skills release tag
+        required: false
+        type: string
+      sha:
+        description: Required peeled commit SHA when ref is provided
+        required: false
+        type: string
 
 permissions:
   contents: write
@@ -16,6 +25,8 @@ jobs:
     runs-on: ubuntu-latest
     env:
       GH_TOKEN: ${{ secrets.SKILLS_SYNC_TOKEN || secrets.GITHUB_TOKEN }}
+      REQUESTED_REF: ${{ github.event.client_payload.ref || inputs.ref }}
+      REQUESTED_SHA: ${{ github.event.client_payload.sha || inputs.sha }}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
@@ -24,7 +35,18 @@ jobs:
         with:
           python-version: "3.12"
       - name: Vendor skills from pinned sources
-        run: python3 scripts/vendor/skill_vendor.py update
+        shell: bash
+        run: |
+          arguments=(update)
+          if [[ -n "$REQUESTED_REF" || -n "$REQUESTED_SHA" ]]; then
+            if [[ -z "$REQUESTED_REF" || -z "$REQUESTED_SHA" ]]; then
+              echo "::error::Both ref and sha are required for a release upgrade"
+              exit 1
+            fi
+            arguments+=(--source-ref "codeguard-skills=$REQUESTED_REF")
+            arguments+=(--expected-sha "codeguard-skills=$REQUESTED_SHA")
+          fi
+          python3 scripts/vendor/skill_vendor.py "${arguments[@]}"
       - name: Verify the fresh snapshot
         run: python3 scripts/vendor/skill_vendor.py check
       - name: Push a sync branch when the snapshot changed
@@ -39,7 +61,7 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -B chore/skills-sync
           git add skills/ skills.lock.json
-          git commit -m "chore: sync vendored skills from codeguard-skills"
+          git commit -m "chore: sync vendored skills from codeguard-skills ${REQUESTED_REF:-current-lock}"
           git push --force-with-lease origin chore/skills-sync
           echo "changed=true" >> "$GITHUB_OUTPUT"
       - name: Open the sync PR if none exists
@@ -50,7 +72,7 @@ jobs:
             exit 0
           fi
           gh pr create \
-            --title "chore: sync vendored Codeguard skills" \
-            --body "Automated refresh of the checksummed skill snapshot from skills.lock.json. Externally managed skills come from full-stack-skills/codeguard-skills; unlisted plugin-local skills are preserved." \
+            --title "chore: sync vendored Codeguard skills ${REQUESTED_REF:-current-lock}" \
+            --body "Automated refresh of the checksummed skill snapshot from skills.lock.json. Requested release: ${REQUESTED_REF:-current lock}; expected commit: ${REQUESTED_SHA:-already pinned}. Externally managed skills come from full-stack-skills/codeguard-skills; plugin-local exceptions must be declared in plugin-local-skills.json." \
             --head chore/skills-sync --base main \
             --label skills-sync

.zcode-plugin/plugin.json

@@ -5,7 +5,7 @@
     "en": "CodeGuard",
     "zh-CN": "代码规范检查"
   },
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Cross-language code lint enforcement for AI coding assistants (ZCode, Claude Code, Codex CLI, Kimi Code): Java, Rust, TypeScript, Python. PostToolUse hook auto-runs the native linter on every AI-written file and blocks on failure in strict mode.",
   "description_i18n": {
     "en": "Cross-language code lint enforcement. PostToolUse hook auto-runs the language-specific linter on every AI-written file; failed lint blocks further writes when strict_mode is on. Ships ready-to-go .pre-commit-config.yaml templates for Java/Rust/TypeScript/Python.",

AGENTS.md

@@ -5,7 +5,7 @@
 - `skills.lock.json` 中列出的技能以 `full-stack-skills/codeguard-skills` 为事实源；不得直接编辑插件内对应目录。
 - 更新受管技能时，先在外部技能仓完成修改、TRACE 评估和不可变 tag，再更新 lock ref，执行 `python3 scripts/vendor/skill_vendor.py update`。
 - 提交前必须执行 `python3 scripts/vendor/skill_vendor.py check --offline` 和在线 `check`。
-- 只有插件内部定制技能可以在本仓 `skills/` 直接维护，并且必须不出现在 `skills.lock.json` 中；vendor 工具会保留这些目录。
+- 只有插件内部定制技能可以在本仓 `skills/` 直接维护，并且必须不出现在 `skills.lock.json` 中、必须显式登记到 `plugin-local-skills.json`；vendor 工具会保留这些目录并拒绝未声明目录。
 - Hooks、linters、commands、MCP 配置和可执行脚本仍由插件仓维护。
 
 ## 版本升级要求（强制，AI 必须遵守）

README.md

@@ -65,7 +65,7 @@ AI code that passes lint on first try
 |---|---|
 | Plugin ID | `partme-codeguard-plugin` |
 | Hosts | ZCode, Claude Code, Codex CLI, Kimi Code |
-| Current version | `0.4.0` |
+| Current version | `0.5.0` |
 | ZCode manifest | `.zcode-plugin/plugin.json` |
 | Codex manifest | `.codex-plugin/plugin.json` |
 | MCP server | `python3 scripts/run_check.py --mcp` (stdio JSON-RPC) |
@@ -103,7 +103,7 @@ The 68 portable skills are authored in [full-stack-skills/codeguard-skills](http
 - `python3 scripts/vendor/skill_vendor.py update` refreshes only the skill names listed in the lock.
 - `python3 scripts/vendor/skill_vendor.py check --offline` verifies the packaged snapshot; omit `--offline` to verify the upstream ref and content too.
 - Do not directly edit a locked skill directory. Change and release `codeguard-skills`, update the lock ref, then run the vendor update.
-- Plugin-specific skills may remain under `skills/` only when they are intentionally absent from `skills.lock.json`; the vendor leaves those directories untouched.
+- Plugin-specific skills may remain under `skills/` only when they are intentionally absent from `skills.lock.json` and explicitly listed in `plugin-local-skills.json`; the vendor preserves declared directories and rejects undeclared exceptions.
 
 Hooks, linters, commands, MCP wiring, and executable scripts remain plugin-owned. The authoring standard is documented in [docs/CODEGUARD_SKILLS_SPEC.md](docs/CODEGUARD_SKILLS_SPEC.md).
 
@@ -222,6 +222,7 @@ partme-codeguard-plugin/
 │   ├── fix.py                    # auto-fix CLI
 │   └── vendor/skill_vendor.py    # lock-driven external skill vendor/check
 ├── skills.lock.json              # upstream tag/commit + managed skills + SHA-256 digests
+├── plugin-local-skills.json      # explicit plugin-only skill exceptions (currently empty)
 ├── skills/                       # 68 vendored skills from codeguard-skills v0.1.0
 │   ├── codeguard/                # main entry
 │   ├── codeguard-init/           # one-line bootstrap

README.zh-CN.md

@@ -65,7 +65,7 @@ AI 一次写出就过 lint 的代码
 |---|---|
 | 插件 ID | `partme-codeguard-plugin` |
 | 宿主 | ZCode、Claude Code、Codex CLI、Kimi Code |
-| 当前版本 | `0.4.0` |
+| 当前版本 | `0.5.0` |
 | ZCode manifest | `.zcode-plugin/plugin.json` |
 | Codex manifest | `.codex-plugin/plugin.json` |
 | MCP 服务 | `python3 scripts/run_check.py --mcp`（stdio JSON-RPC） |
@@ -89,7 +89,7 @@ AI 一次写出就过 lint 的代码
 - `python3 scripts/vendor/skill_vendor.py update` 只刷新 lock 中列出的技能。
 - `python3 scripts/vendor/skill_vendor.py check --offline` 校验插件内快照；去掉 `--offline` 还会校验上游 ref 与内容。
 - 不得直接修改 lock 管理的技能目录。应先在 `codeguard-skills` 修改并发布，再更新 lock ref 并执行 vendor update。
-- 只有插件内部定制技能可以直接保留在 `skills/`，且必须明确不列入 `skills.lock.json`；vendor 不会删除或覆盖这些目录。
+- 只有插件内部定制技能可以直接保留在 `skills/`，且必须明确不列入 `skills.lock.json`、显式登记到 `plugin-local-skills.json`；vendor 会保留已声明目录并拒绝未声明例外。
 
 Hooks、linters、commands、MCP 接线和可执行脚本仍由插件仓负责。
 
@@ -207,6 +207,7 @@ partme-codeguard-plugin/
 │   ├── fix.py                    # 自动修复 CLI
 │   └── vendor/skill_vendor.py    # lock 驱动的外部技能 vendor/check
 ├── skills.lock.json              # 上游 tag/commit + 受管技能 + SHA-256
+├── plugin-local-skills.json      # 插件专属技能显式例外清单（当前为空）
 ├── skills/                       # 从 codeguard-skills v0.1.0 vendor 的 68 个技能
 │   ├── codeguard/                # 主入口
 │   ├── codeguard-init/           # 一行接入

docs/CODEGUARD_SKILLS_SPEC.md

@@ -27,7 +27,7 @@ skills/codeguard-java/
 |---|---|---|
 | 可复用 Codeguard 技能 | `full-stack-skills/codeguard-skills` | 在外部仓修改、评估、发布新 tag，再更新插件 lock |
 | 插件离线技能快照 | 本仓 `skills/` 中被 lock 列出的目录 | 只允许由 `scripts/vendor/skill_vendor.py update` 生成 |
-| 插件内部定制技能 | 本仓 `skills/` 中未被 lock 列出的目录 | 可在插件仓直接维护，vendor 会保留 |
+| 插件内部定制技能 | 本仓 `skills/` 中未被 lock 列出、但在 `plugin-local-skills.json` 显式登记的目录 | 可在插件仓直接维护，vendor 会保留；未登记目录会被拒绝 |
 | Hooks、linters、commands、MCP、运行脚本 | `codeguard-plugin` | 在插件仓开发、测试和发布 |
 
 禁止直接修改 lock 管理的技能目录，否则离线/在线 vendor check 会失败。

kimi.plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codeguard",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Cross-language code lint enforcement for AI coding assistants (ZCode, Claude Code, Codex CLI, Kimi Code): Java, Rust, TypeScript, Python. PostToolUse hook auto-runs the native linter on every AI-written file and blocks on failure in strict mode.",
   "author": {
     "name": "Full Stack Skills / PartMe.AI"

plugin-local-skills.json

@@ -0,0 +1,5 @@
+{
+  "version": 1,
+  "dest": "skills/",
+  "skills": []
+}