release: v0.4.0

Author: loong10k

.agents/plugins/marketplace.json

@@ -16,7 +16,7 @@
         "authentication": "ON_USE"
       },
       "category": "Developer Tools",
-      "version": "0.3.8",
+      "version": "0.4.0",
       "description": "Cross-language code lint enforcement for AI coding assistants (ZCode, Claude Code, Codex CLI, Kimi Code): Java, Rust, TypeScript, Python. PostToolUse hook auto-runs the native linter on every AI-written file and blocks on failure in strict mode.",
       "icon": "https://raw.githubusercontent.com/partme-ai/partme-codeguard-plugin/main/assets/official-logo.png",
       "interface": {

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codeguard",
-  "version": "0.3.8+codex.20260919",
+  "version": "0.4.0+codex.20260919",
   "description": "Cross-language code lint enforcement for AI coding assistants (ZCode, Claude Code, Codex CLI, Kimi Code): Java, Rust, TypeScript, Python. PostToolUse hook auto-runs the native linter on every AI-written file and blocks on failure in strict mode.",
   "author": {
     "name": "Full Stack Skills / PartMe.AI",

.github/workflows/skills-check.yml

@@ -0,0 +1,47 @@
+name: skills-check
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  vendor-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - name: Verify vendored skills match the lockfile digests
+        run: python3 scripts/vendor/skill_vendor.py check --offline
+      - name: Verify lockfile pins still match upstream refs and content
+        run: python3 scripts/vendor/skill_vendor.py check
+      - name: Exercise vendor mutation and preservation behavior
+        run: python3 -m unittest tests/test_skill_vendor.py -v
+      - name: Reject direct edits to externally managed skills
+        if: github.event_name == 'pull_request'
+        run: |
+          changed="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD")"
+          CHANGED="$changed" python3 - <<'PY'
+          import json
+          import os
+          import sys
+
+          changed = {line for line in os.environ["CHANGED"].splitlines() if line}
+          if "skills.lock.json" in changed:
+              raise SystemExit(0)
+          lock = json.load(open("skills.lock.json", encoding="utf-8"))
+          prefixes = {
+              f"{source['dest'].rstrip('/')}/{name}/"
+              for source in lock["sources"]
+              for name in source["skills"]
+          }
+          bypassed = sorted(path for path in changed if any(path.startswith(prefix) for prefix in prefixes))
+          if bypassed:
+              print("::error::Externally managed skills changed without skills.lock.json: " + ", ".join(bypassed))
+              print("Edit codeguard-skills, release a new tag, then run scripts/vendor/skill_vendor.py update.")
+              sys.exit(1)
+          PY

.github/workflows/skills-sync.yml

@@ -0,0 +1,56 @@
+name: skills-sync
+
+on:
+  repository_dispatch:
+    types: [skills-updated]
+  schedule:
+    - cron: "41 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.SKILLS_SYNC_TOKEN || secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          token: ${{ secrets.SKILLS_SYNC_TOKEN || secrets.GITHUB_TOKEN }}
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - name: Vendor skills from pinned sources
+        run: python3 scripts/vendor/skill_vendor.py update
+      - name: Verify the fresh snapshot
+        run: python3 scripts/vendor/skill_vendor.py check
+      - name: Push a sync branch when the snapshot changed
+        id: push
+        run: |
+          if git diff --quiet && git diff --cached --quiet; then
+            echo "vendored skills already current; nothing to sync"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B chore/skills-sync
+          git add skills/ skills.lock.json
+          git commit -m "chore: sync vendored skills from codeguard-skills"
+          git push --force-with-lease origin chore/skills-sync
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+      - name: Open the sync PR if none exists
+        if: steps.push.outputs.changed == 'true'
+        run: |
+          if gh pr view chore/skills-sync >/dev/null 2>&1; then
+            echo "sync PR already open; branch updated"
+            exit 0
+          fi
+          gh pr create \
+            --title "chore: sync vendored Codeguard skills" \
+            --body "Automated refresh of the checksummed skill snapshot from skills.lock.json. Externally managed skills come from full-stack-skills/codeguard-skills; unlisted plugin-local skills are preserved." \
+            --head chore/skills-sync --base main \
+            --label skills-sync

.zcode-plugin/plugin.json

@@ -5,7 +5,7 @@
     "en": "CodeGuard",
     "zh-CN": "代码规范检查"
   },
-  "version": "0.3.8",
+  "version": "0.4.0",
   "description": "Cross-language code lint enforcement for AI coding assistants (ZCode, Claude Code, Codex CLI, Kimi Code): Java, Rust, TypeScript, Python. PostToolUse hook auto-runs the native linter on every AI-written file and blocks on failure in strict mode.",
   "description_i18n": {
     "en": "Cross-language code lint enforcement. PostToolUse hook auto-runs the language-specific linter on every AI-written file; failed lint blocks further writes when strict_mode is on. Ships ready-to-go .pre-commit-config.yaml templates for Java/Rust/TypeScript/Python.",

AGENTS.md

@@ -1,5 +1,13 @@
 # AGENTS.md — 代码规范守卫
 
+## 技能来源边界（强制）
+
+- `skills.lock.json` 中列出的技能以 `full-stack-skills/codeguard-skills` 为事实源；不得直接编辑插件内对应目录。
+- 更新受管技能时，先在外部技能仓完成修改、TRACE 评估和不可变 tag，再更新 lock ref，执行 `python3 scripts/vendor/skill_vendor.py update`。
+- 提交前必须执行 `python3 scripts/vendor/skill_vendor.py check --offline` 和在线 `check`。
+- 只有插件内部定制技能可以在本仓 `skills/` 直接维护，并且必须不出现在 `skills.lock.json` 中；vendor 工具会保留这些目录。
+- Hooks、linters、commands、MCP 配置和可执行脚本仍由插件仓维护。
+
 ## 版本升级要求（强制，AI 必须遵守）
 
 任何代码改动——无论大小——都必须 bump 版本并发布。PartMe.AI 插件市场

README.md

@@ -65,7 +65,7 @@ AI code that passes lint on first try
 |---|---|
 | Plugin ID | `partme-codeguard-plugin` |
 | Hosts | ZCode, Claude Code, Codex CLI, Kimi Code |
-| Current version | `0.2.0` |
+| Current version | `0.4.0` |
 | ZCode manifest | `.zcode-plugin/plugin.json` |
 | Codex manifest | `.codex-plugin/plugin.json` |
 | MCP server | `python3 scripts/run_check.py --mcp` (stdio JSON-RPC) |
@@ -95,9 +95,17 @@ Beyond linting, codeguard ships standalone governance skills sourced from the te
 
 The commit gate is pre-wired in the pre-commit template (`stages: [commit-msg]`); branch and security skills guide the AI during branch creation, interface development, and pre-merge review.
 
-### Skill architecture
+### External skill source
 
-All 18 skills follow a unified authoring standard abstracted from [rust-skills](https://github.com/full-stack-skills/rust-skills): a lean `SKILL.md` (trigger metadata, capability boundaries, workflow, gotchas) plus `references/` for progressive disclosure of deep material. The standard is documented in [docs/CODEGUARD_SKILLS_SPEC.md](docs/CODEGUARD_SKILLS_SPEC.md). Skills cross-route to each other (e.g. the main entry routes deep Java questions to the java-skills repository, commit format to codeguard-git-commit).
+The 68 portable skills are authored in [full-stack-skills/codeguard-skills](https://github.com/full-stack-skills/codeguard-skills), not independently inside this plugin. This repository vendors the complete `v0.1.0` snapshot so installed plugins work offline:
+
+- `skills.lock.json` pins the upstream repository, immutable tag, resolved commit, managed skill names, and per-skill SHA-256 digests.
+- `python3 scripts/vendor/skill_vendor.py update` refreshes only the skill names listed in the lock.
+- `python3 scripts/vendor/skill_vendor.py check --offline` verifies the packaged snapshot; omit `--offline` to verify the upstream ref and content too.
+- Do not directly edit a locked skill directory. Change and release `codeguard-skills`, update the lock ref, then run the vendor update.
+- Plugin-specific skills may remain under `skills/` only when they are intentionally absent from `skills.lock.json`; the vendor leaves those directories untouched.
+
+Hooks, linters, commands, MCP wiring, and executable scripts remain plugin-owned. The authoring standard is documented in [docs/CODEGUARD_SKILLS_SPEC.md](docs/CODEGUARD_SKILLS_SPEC.md).
 
 ## Capabilities and boundaries
 
@@ -211,8 +219,10 @@ partme-codeguard-plugin/
 ├── scripts/
 │   ├── detect_lang.py            # language detection + linter command table (shared)
 │   ├── run_check.py              # main CLI: detect + run all linters + report
-│   └── fix.py                    # auto-fix CLI
-├── skills/                       # 68 SKILL.md (main + init + 22 languages + 2 git + 3 security + planned-language skeletons)
+│   ├── fix.py                    # auto-fix CLI
+│   └── vendor/skill_vendor.py    # lock-driven external skill vendor/check
+├── skills.lock.json              # upstream tag/commit + managed skills + SHA-256 digests
+├── skills/                       # 68 vendored skills from codeguard-skills v0.1.0
 │   ├── codeguard/                # main entry
 │   ├── codeguard-init/           # one-line bootstrap
 │   ├── codeguard-{java,rust,typescript,python}/

README.zh-CN.md

@@ -65,7 +65,7 @@ AI 一次写出就过 lint 的代码
 |---|---|
 | 插件 ID | `partme-codeguard-plugin` |
 | 宿主 | ZCode、Claude Code、Codex CLI、Kimi Code |
-| 当前版本 | `0.2.0` |
+| 当前版本 | `0.4.0` |
 | ZCode manifest | `.zcode-plugin/plugin.json` |
 | Codex manifest | `.codex-plugin/plugin.json` |
 | MCP 服务 | `python3 scripts/run_check.py --mcp`（stdio JSON-RPC） |
@@ -81,6 +81,18 @@ AI 一次写出就过 lint 的代码
 | **Stable**（53 种，默认强制） | Java、Rust、TypeScript/JavaScript、Python、Go、C#、Kotlin、Swift、PHP、Ruby、Scala、Shell、Dockerfile、YAML、Elixir、CSS/SCSS、Markdown、SQL、TOML、HTML、Protobuf、Terraform/OpenTofu、Nix、Dart、Solidity、Ansible、Perl、Groovy、Clojure、PowerShell、Zig、Nim、Crystal、Julia（仅格式化）、Pascal（仅格式化）、Elm、Lua、Luau、C++（clang-tidy）、Objective-C、CUDA、GraphQL、VB.NET、Erlang、R、CFML 等，详见 LANGUAGES.md |
 | **Planned**（4 种，无独立 CLI linter） | Metal、ArkTS（HarmonyOS）、COBOL、Liquid（theme-check 待接通） |
 
+## 外部技能来源
+
+68 个可复用技能统一在 [full-stack-skills/codeguard-skills](https://github.com/full-stack-skills/codeguard-skills) 编写，插件不再维护一份独立手写副本。为保证插件安装后离线可用，本仓库 vendor 了完整的 `v0.1.0` 快照：
+
+- `skills.lock.json` 固定上游仓库、不可变 tag、解析后的 commit、受管技能清单与逐技能 SHA-256。
+- `python3 scripts/vendor/skill_vendor.py update` 只刷新 lock 中列出的技能。
+- `python3 scripts/vendor/skill_vendor.py check --offline` 校验插件内快照；去掉 `--offline` 还会校验上游 ref 与内容。
+- 不得直接修改 lock 管理的技能目录。应先在 `codeguard-skills` 修改并发布，再更新 lock ref 并执行 vendor update。
+- 只有插件内部定制技能可以直接保留在 `skills/`，且必须明确不列入 `skills.lock.json`；vendor 不会删除或覆盖这些目录。
+
+Hooks、linters、commands、MCP 接线和可执行脚本仍由插件仓负责。
+
 ## 能力与边界
 
 ### 已支持
@@ -192,8 +204,10 @@ partme-codeguard-plugin/
 ├── scripts/
 │   ├── detect_lang.py            # 语言检测 + linter 命令表（共享）
 │   ├── run_check.py              # 主 CLI：检测 + 跑全量 + 报告
-│   └── fix.py                    # 自动修复 CLI
-├── skills/                       # 68 个 SKILL.md（主入口 + init + 22 语言强制 + 2 Git + 3 安全 + planned 语言骨架）
+│   ├── fix.py                    # 自动修复 CLI
+│   └── vendor/skill_vendor.py    # lock 驱动的外部技能 vendor/check
+├── skills.lock.json              # 上游 tag/commit + 受管技能 + SHA-256
+├── skills/                       # 从 codeguard-skills v0.1.0 vendor 的 68 个技能
 │   ├── codeguard/                # 主入口
 │   ├── codeguard-init/           # 一行接入
 │   ├── codeguard-{java,rust,typescript,python}/

docs/CODEGUARD_SKILLS_SPEC.md

@@ -1,8 +1,8 @@
 # codeguard 技能编写标准（CODEGUARD_SKILLS_SPEC）
 
-> **文档说明**：定义 partme-codeguard-plugin 内置技能（skills/）的抽象标准与结构规范。标准从 [rust-skills](https://github.com/full-stack-skills/rust-skills) 抽象而来，并结合 codeguard「门禁型插件」的定位做了裁剪。
+> **文档说明**：定义 Codeguard 技能的抽象标准与结构规范。可复用技能的事实源是 [full-stack-skills/codeguard-skills](https://github.com/full-stack-skills/codeguard-skills)；插件内 `skills/` 是由 `skills.lock.json` 固定并校验的离线 vendor 快照。
 >
-> **版本**：V1.0　**最后更新**：2026-09-18
+> **版本**：V1.1　**最后更新**：2026-09-19
 
 ---
 
@@ -21,6 +21,17 @@ skills/codeguard-java/
 
 核心思想（学自 rust-skills）：**SKILL.md 保持精瘦可一次读完，深度资料放 references/ 按需加载**——让 AI 快速拿到 80% 高频规则，需要 20% 深度时再展开。
 
+### 1.1 所有权与发布边界
+
+| 内容 | 事实源 | 修改方式 |
+|---|---|---|
+| 可复用 Codeguard 技能 | `full-stack-skills/codeguard-skills` | 在外部仓修改、评估、发布新 tag，再更新插件 lock |
+| 插件离线技能快照 | 本仓 `skills/` 中被 lock 列出的目录 | 只允许由 `scripts/vendor/skill_vendor.py update` 生成 |
+| 插件内部定制技能 | 本仓 `skills/` 中未被 lock 列出的目录 | 可在插件仓直接维护，vendor 会保留 |
+| Hooks、linters、commands、MCP、运行脚本 | `codeguard-plugin` | 在插件仓开发、测试和发布 |
+
+禁止直接修改 lock 管理的技能目录，否则离线/在线 vendor check 会失败。
+
 ## 2. SKILL.md 结构规范（九段式）
 
 ```markdown
@@ -82,7 +93,7 @@ description: |
 | 族 | 技能 | 职责 |
 |---|---|---|
 | **元** | codeguard（主入口）、codeguard-init | 全局路由、项目接入 |
-| **语言族**（11） | codeguard-{java,rust,typescript,python,go,csharp,kotlin,swift,php,ruby,scala} | 各语言 lint/format 门禁与规范速查 |
+| **语言/文件族**（57） | codeguard-{java,rust,typescript,python,...} | 53 个 stable 与 4 个 planned 的 lint/format 门禁及规范速查 |
 | **Git 治理族**（2） | codeguard-git-branch、codeguard-git-commit | 分支模型门禁、提交格式门禁 |
 | **安全治理族**（3） | codeguard-security-{code,api,data} | 泄露/CVE、越权/上传、加密/脱敏/等保密评 |
 
@@ -91,7 +102,18 @@ description: |
 - 语言的**深度语言问题**（语法、框架、库用法）→ 路由到对应语言技能仓（如 full-stack-skills/java-skills）
 - codeguard 只负责「规范门禁」：lint/format/安全检查/提交与分支治理
 
-## 4. 结构升级路线
+## 4. Vendor 工作流
+
+```bash
+# 上游发布新不可变 tag 后，先更新 skills.lock.json 中的 ref
+python3 scripts/vendor/skill_vendor.py update
+python3 scripts/vendor/skill_vendor.py check --offline
+python3 scripts/vendor/skill_vendor.py check
+```
+
+`update` 只替换 lock 中列出的目录，不会触碰未列出的插件内部定制技能。CI 同时执行离线与在线校验，并拒绝未同步 lock 的受管技能直接编辑。
+
+## 5. 结构升级路线
 
 | 阶段 | 状态 | 说明 |
 |---|---|---|
@@ -102,4 +124,4 @@ description: |
 
 ---
 
-**文档版本**：V1.0　**状态**：✅ 生效
+**文档版本**：V1.1　**状态**：✅ 生效

docs/LANGUAGES.md

@@ -83,7 +83,7 @@
 
 1. `scripts/languages.json` 注册表加一条语言定义（id/extensions/markers/lint/format/status）。
 2. `linters/<lang>/` 放配置模板。
-3. `skills/codeguard-<lang>/SKILL.md` 写规范速查（frontmatter `name` == 目录名）。
-4. 重跑 `python3 scripts/gen_language_docs.py` 同步本文档。
-5. `python3 scripts/detect_lang.py <项目>` 冒烟验证。
-
+3. 在外部 `full-stack-skills/codeguard-skills` 新增或更新 `skills/codeguard-<lang>/`，完成 lint、TRACE 评估并发布不可变 tag。
+4. 更新插件 `skills.lock.json` 的 ref 和技能清单，运行 `python3 scripts/vendor/skill_vendor.py update`。
+5. 重跑 `python3 scripts/gen_language_docs.py` 同步本文档。
+6. 执行 vendor 离线/在线检查，并用 `python3 scripts/detect_lang.py <项目>` 冒烟验证。