release: 将 beta 提升到 main（v1.3.0，118 提交 / 886 文件）

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -64,6 +64,10 @@ jobs:
         timeout-minutes: 10
         continue-on-error: true
 
+      - name: Run Node integration smoke tests
+        run: npm run test:node
+        timeout-minutes: 15
+
       - name: Generate coverage report
         run: >
           npm run test:coverage -- --runInBand --forceExit --testPathPatterns="tests/unit/"
@@ -99,7 +103,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6

.github/workflows/docker-build.yml

@@ -31,25 +31,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to Docker Hub
         if: github.event_name != 'pull_request' && secrets.DOCKER_USERNAME
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -116,7 +116,7 @@ jobs:
 
       - name: Generate artifact attestation
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build.outputs.digest }}

.github/workflows/publish-npm.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -67,7 +67,7 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           generate_release_notes: true
           files: "*.tgz"

.workflow/.csv-wave/20260520-plan-rikune-iteration/context.md

@@ -0,0 +1,19 @@
+# Maestro Execute Session
+
+Session: 20260520-plan-rikune-iteration
+Completed at: 2026-05-20T15:09:33.2621209+08:00
+
+## Summary
+
+Implemented all 7 Maestro tasks in 3 waves for Rikune agent reliability.
+
+## Verification
+
+- `npm test -- --runTestsByPath tests/unit/analysis-evidence.test.ts tests/unit/tool-readiness.test.ts tests/unit/tool-help.test.ts tests/unit/tools-discover.test.ts tests/unit/runtime-debug-session.test.ts tests/unit/dynamic-runtime-status.test.ts tests/unit/core/plugin-orchestrator.test.ts tests/unit/plugin-contracts.test.ts tests/unit/report-summarize-compact.test.ts tests/unit/api/dashboard-api.test.ts tests/unit/golden-fixtures.test.ts tests/integration/workflow.test.ts`
+- `npm test -- --runTestsByPath tests/unit/report-summarize.test.ts tests/unit/report-generate.test.ts tests/unit/packages/plugin-sdk.test.ts tests/unit/core/plugin-system/builtin-contract.test.ts tests/unit/core/plugin-system/system-deps.test.ts tests/unit/report-summarize-compact.test.ts tests/unit/api/dashboard-api.test.ts`
+- `npm run typecheck`
+- `python -m pytest workers`
+
+## Results
+
+All 7 tasks completed. See `.summaries/` for per-task notes and `results.csv` for machine-readable status.

.workflow/.csv-wave/20260520-plan-rikune-iteration/discoveries.ndjson

@@ -0,0 +1,3 @@
+{"ts":"2026-05-20T14:30:57.4784434+08:00","worker":"codex-root","type":"existing_pattern","data":{"name":"Staged analysis pipeline","file":"src/workflows/analyze-pipeline.ts","description":"workflow.analyze.start/status/promote manage persisted runs and queued stage work.","usage":"Use as the core golden path for agent-facing analysis."}}
+{"ts":"2026-05-20T14:30:57.4784434+08:00","worker":"codex-root","type":"existing_pattern","data":{"name":"Progressive tool surface","file":"src/tools/tools-discover.ts","description":"tools.discover activates plugin categories, findings, file types, or plugin IDs.","usage":"Use as navigation layer for broad plugin set."}}
+{"ts":"2026-05-20T14:30:57.4784434+08:00","worker":"codex-root","type":"existing_pattern","data":{"name":"Canonical evidence state","file":"src/analysis/analysis-evidence.ts","description":"Evidence utilities classify fresh, reused, partial, stale, missing, and deferred evidence states.","usage":"Extend for provenance and report visibility."}}

.workflow/.csv-wave/20260520-plan-rikune-iteration/results.csv

@@ -0,0 +1,8 @@
+id,title,status,findings,error
+"TASK-001","Stabilize the agent golden path workflow","completed","Golden path guidance and evidence state implemented; focused tests pass.",""
+"TASK-002","Improve progressive tool discovery and readiness guidance","completed","Role-aware discovery/readiness/help metadata implemented; focused tests pass.",""
+"TASK-003","Unify evidence provenance and confidence envelopes","completed","Evidence provenance summaries implemented; focused tests pass.",""
+"TASK-004","Model dynamic runtime work as explicit sessions","completed","Runtime session state machine and dynamic execution semantics implemented; focused tests pass.",""
+"TASK-005","Add plugin quality gates and readiness contracts","completed","Non-blocking plugin quality warnings implemented; focused tests pass.",""
+"TASK-006","Improve report and dashboard consumption of staged results","completed","Compact report/dashboard stage and provenance digest implemented; focused tests pass.",""
+"TASK-007","Build a golden sample regression corpus and degraded-environment tests","completed","Safe fixture manifest/docs/tests implemented; worker pytest passes.",""

.workflow/.csv-wave/20260520-plan-rikune-iteration/tasks.csv

@@ -0,0 +1,8 @@
+id,title,description,exploration_focus,deps,context_from,wave,status,findings,error
+"TASK-001","Stabilize the agent golden path workflow","Golden path workflow guidance and evidence state","workflow.analyze start/status/promote","","","1","completed","Added artifact/report next tools and backend_preview evidence state; workflow integration coverage passes.",""
+"TASK-002","Improve progressive tool discovery and readiness guidance","Role-aware tool surface metadata","tools.discover/tool.readiness/tool.help","","","1","completed","Added specialist/expert/runtime_gated roles and preferred primary tool metadata across discovery/readiness/help.",""
+"TASK-003","Unify evidence provenance and confidence envelopes","Evidence provenance summary","analysis evidence state","","","1","completed","Added provenance summary to fresh/reused/partial/missing/deferred evidence states with validation paths.",""
+"TASK-004","Model dynamic runtime work as explicit sessions","Runtime session lifecycle","runtime debug session and dynamic stages","TASK-001;TASK-003","TASK-001;TASK-003","2","completed","Added explicit runtime debug state machine and dynamic execution_semantics actual_mode fields.",""
+"TASK-005","Add plugin quality gates and readiness contracts","Plugin quality diagnostics","plugin SDK/orchestrator/list/dashboard","TASK-002","TASK-002","2","completed","Added non-blocking PluginQualityWarning contract and exposed warning counts/details.",""
+"TASK-006","Improve report and dashboard consumption of staged results","Compact staged reporting","report.summarize and dashboard API","TASK-001;TASK-003","TASK-001;TASK-003","2","completed","Added stage_summary and provenance_digest to reports and dashboard run views.",""
+"TASK-007","Build a golden sample regression corpus and degraded-environment tests","Safe regression corpus","tests/fixtures, workflow tests, worker tests","TASK-001;TASK-002;TASK-003;TASK-004;TASK-005;TASK-006","TASK-001;TASK-002;TASK-003;TASK-004;TASK-005;TASK-006","3","completed","Added safe golden fixture manifest/docs/test and fixed worker fixture regressions; pytest workers passes.",""

.workflow/.csv-wave/20260521-plan-next-rikune-plugin-sdk-iteration/context.md

@@ -0,0 +1,44 @@
+# Plan Generation Summary
+
+Phase: `next-rikune-plugin-sdk-iteration`
+
+Scratch plan directory: `.workflow/scratch/20260521-plan-next-rikune-plugin-sdk-iteration`
+
+Generated artifacts:
+
+- `plan.json`
+- `.task/TASK-001.json`
+- `.task/TASK-002.json`
+- `.task/TASK-003.json`
+- `.task/TASK-004.json`
+- `.task/TASK-005.json`
+- `.task/TASK-006.json`
+- `.task/TASK-007.json`
+
+Plan shape:
+
+- Complexity: high
+- Task count: 7
+- Wave count: 4
+- Focus: plugin extension, `@rikune/plugin-sdk`, manifest/runtime contracts, quality gates, developer experience, tests/fixtures, backward compatibility.
+
+Exploration context consumed:
+
+- E1 architecture: SDK public contract, core orchestrator, runtime bridge, progressive tool surface, runtime contract.
+- E2 implementation: `definePlugin`, `defineTool`, `defineManifestPlugin`, validation helpers, Zod passthrough schemas, built-in plugin registration patterns, docs/scaffold references.
+- E3 integration: shared runtime contract before SDK/API, then discovery/orchestrator/runtime bridge, runtime-node toolkit, user-facing `plugin.list`, `tools.discover`, `tool.readiness`, `tool.help`.
+- E4 risks: SDK beta breakage, external plugin import trust boundary, dynamic tools without runtime contracts, Docker/live runtime CI cost, hidden structured-output regressions.
+
+Recommended artifact registration, if the orchestrating process chooses to update state later:
+
+```json
+{
+  "id": "PLN-20260521-next-rikune-plugin-sdk-iteration",
+  "type": "plan",
+  "scope": "standalone",
+  "path": ".workflow/scratch/20260521-plan-next-rikune-plugin-sdk-iteration",
+  "status": "completed"
+}
+```
+
+This worker intentionally did not modify `.workflow/state.json`, `.workflow/.maestro/`, source files, formatting output, or `package-lock.json`.

.workflow/.csv-wave/20260521-plan-next-rikune-plugin-sdk-iteration/discoveries.ndjson

@@ -0,0 +1 @@
+{"ts":"2026-05-21T23:50:00+08:00","worker":"session","type":"tech_stack","data":{"framework":"TypeScript MCP monorepo","language":"TypeScript","tools":["Jest","ts-jest","turbo","zod","@modelcontextprotocol/sdk"],"packages":["@rikune/plugin-sdk","@rikune/shared","@rikune/runtime-node"]}}

.workflow/.csv-wave/20260521-plan-next-rikune-plugin-sdk-iteration/results.csv

@@ -0,0 +1,6 @@
+id,title,description,exploration_focus,deps,context_from,wave,status,findings,error
+"E1","Architecture Exploration","Explore how the next Rikune plugin expansion and @rikune/plugin-sdk iteration should fit the current architecture. Map plugin manager, SDK package, manifest/runtime contract, runtime-node/shared links, discovery/loading, registry surfaces, and integration boundaries. Read only; do not modify source.","architecture","","","1","completed","Architecture is SDK public contract + core orchestrator + runtime bridge. Key files: packages/plugin-sdk/src/index.ts, src/plugins/sdk.ts, src/core/plugin-system/discovery.ts, src/core/plugin-orchestrator.ts, src/core/plugin-runtime-bridge.ts, src/core/tool-surface-manager.ts, src/tools/plugin-list.ts, src/tools/tools-discover.ts, src/tools/tool-readiness.ts, packages/shared/src/runtime-contract.ts, packages/runtime-node/src/router.ts. Plan should keep definePlugin and manifest-backed tracks compatible, strengthen runtime contract/schema/readiness, and preserve progressive surface behavior.",""
+"E2","Implementation Exploration","Explore implementation patterns and 3+ references for built-in plugins, SDK exports, schema usage, runtime declarations, tests, docs, and script tooling. Identify concrete conventions to preserve. Read only; do not modify source.","implementation","","","1","completed","SDK exports Plugin/ToolDefinition/definePlugin/defineTool/defineManifestPlugin/validatePlugin/validateTool helpers; schemas use Zod and passthrough for forward compatibility. Built-ins typically hand-write src/plugins/<id>/index.ts with register(), executionDomain, surfaceRules, systemDeps/resources/configSchema, and tool handlers. Runtime contracts use shared ToolRuntimeContract. Quality references include tests/unit/core/plugin-system/builtin-contract.test.ts, tests/unit/packages/plugin-sdk.test.ts, tests/unit/plugin-contracts.test.ts. Docs/scripts to update: docs/PLUGINS.md, packages/plugin-sdk/README.md, scripts/create-plugin.js.",""
+"E3","Integration Exploration","Explore integration points for SDK API/manifest/runtime contract changes: plugin discovery/orchestrator/runtime bridge/tool registry/readiness/help/list/runtime-node/shared/package exports/docs/tests. Identify touched file groups and dependency order. Read only; do not modify source.","integration","","","1","completed","Dependency order should be shared runtime-contract -> plugin-sdk schema/API/exports -> discovery/orchestrator/runtime bridge quality and registration -> runtime-node toolkit manifest/inventory capabilities -> user-facing plugin.list/tools.discover/tool.readiness/tool.help -> docs and create-plugin -> tests/fixtures. New SDK or manifest fields must update structured outputs and keep src/plugins/sdk.ts compatible. Runtime-node capability and analyzer readiness both derive from ToolDefinition.runtime handler/type matching.",""
+"E4","Risk Exploration","Explore risks for plugin extension directions, quality gates, developer experience, fixtures, backward compatibility, security/runtime isolation, CI cost, and migration. Identify gates and mitigations. Read only; do not modify source.","risk","","","1","completed","Main risks: breaking SDK beta users, untrusted external plugin import, dynamic tools without runtime contracts, expensive Docker/live runtime validation in default CI, and hidden quality regressions in plugin.list/readiness/discover. Mitigations: optional/passthrough manifest fields, compatibility re-export, qualityWarnings before hard gates, passive readiness, safe synthetic fixtures, focused jest/typecheck gate, explicit live-runtime opt-in, and manifest fixtures for valid/invalid/duplicate/missing handler/systemDeps/runtime cases.",""
+"P1","Plan Generation","Consume all exploration findings and produce an executable task/wave plan for the next Rikune iteration focused on plugin extension and @rikune/plugin-sdk. Generate plan.json and .task/TASK-*.json in the scratch directory. Planning only; do not modify source.","planning","E1;E2;E3;E4","E1;E2;E3;E4","2","completed","Generated .workflow/scratch/20260521-plan-next-rikune-plugin-sdk-iteration/plan.json plus 7 TASK files across 4 waves. Plan covers SDK/runtime contract baseline, manifest discovery and quality warnings, runtime readiness propagation, safe fixtures, manifest pilot, DX scaffold/docs, and backward compatibility guard.",""

.workflow/.csv-wave/20260521-plan-next-rikune-plugin-sdk-iteration/tasks.csv

@@ -0,0 +1,6 @@
+id,title,description,exploration_focus,deps,context_from,wave,status,findings,error
+"E1","Architecture Exploration","Explore how the next Rikune plugin expansion and @rikune/plugin-sdk iteration should fit the current architecture. Map plugin manager, SDK package, manifest/runtime contract, runtime-node/shared links, discovery/loading, registry surfaces, and integration boundaries. Read only; do not modify source.","architecture","","","1","completed","Architecture is SDK public contract + core orchestrator + runtime bridge. Key files: packages/plugin-sdk/src/index.ts, src/plugins/sdk.ts, src/core/plugin-system/discovery.ts, src/core/plugin-orchestrator.ts, src/core/plugin-runtime-bridge.ts, src/core/tool-surface-manager.ts, src/tools/plugin-list.ts, src/tools/tools-discover.ts, src/tools/tool-readiness.ts, packages/shared/src/runtime-contract.ts, packages/runtime-node/src/router.ts. Plan should keep definePlugin and manifest-backed tracks compatible, strengthen runtime contract/schema/readiness, and preserve progressive surface behavior.",""
+"E2","Implementation Exploration","Explore implementation patterns and 3+ references for built-in plugins, SDK exports, schema usage, runtime declarations, tests, docs, and script tooling. Identify concrete conventions to preserve. Read only; do not modify source.","implementation","","","1","completed","SDK exports Plugin/ToolDefinition/definePlugin/defineTool/defineManifestPlugin/validatePlugin/validateTool helpers; schemas use Zod and passthrough for forward compatibility. Built-ins typically hand-write src/plugins/<id>/index.ts with register(), executionDomain, surfaceRules, systemDeps/resources/configSchema, and tool handlers. Runtime contracts use shared ToolRuntimeContract. Quality references include tests/unit/core/plugin-system/builtin-contract.test.ts, tests/unit/packages/plugin-sdk.test.ts, tests/unit/plugin-contracts.test.ts. Docs/scripts to update: docs/PLUGINS.md, packages/plugin-sdk/README.md, scripts/create-plugin.js.",""
+"E3","Integration Exploration","Explore integration points for SDK API/manifest/runtime contract changes: plugin discovery/orchestrator/runtime bridge/tool registry/readiness/help/list/runtime-node/shared/package exports/docs/tests. Identify touched file groups and dependency order. Read only; do not modify source.","integration","","","1","completed","Dependency order should be shared runtime-contract -> plugin-sdk schema/API/exports -> discovery/orchestrator/runtime bridge quality and registration -> runtime-node toolkit manifest/inventory capabilities -> user-facing plugin.list/tools.discover/tool.readiness/tool.help -> docs and create-plugin -> tests/fixtures. New SDK or manifest fields must update structured outputs and keep src/plugins/sdk.ts compatible. Runtime-node capability and analyzer readiness both derive from ToolDefinition.runtime handler/type matching.",""
+"E4","Risk Exploration","Explore risks for plugin extension directions, quality gates, developer experience, fixtures, backward compatibility, security/runtime isolation, CI cost, and migration. Identify gates and mitigations. Read only; do not modify source.","risk","","","1","completed","Main risks: breaking SDK beta users, untrusted external plugin import, dynamic tools without runtime contracts, expensive Docker/live runtime validation in default CI, and hidden quality regressions in plugin.list/readiness/discover. Mitigations: optional/passthrough manifest fields, compatibility re-export, qualityWarnings before hard gates, passive readiness, safe synthetic fixtures, focused jest/typecheck gate, explicit live-runtime opt-in, and manifest fixtures for valid/invalid/duplicate/missing handler/systemDeps/runtime cases.",""
+"P1","Plan Generation","Consume all exploration findings and produce an executable task/wave plan for the next Rikune iteration focused on plugin extension and @rikune/plugin-sdk. Generate plan.json and .task/TASK-*.json in the scratch directory. Planning only; do not modify source.","planning","E1;E2;E3;E4","E1;E2;E3;E4","2","completed","Generated .workflow/scratch/20260521-plan-next-rikune-plugin-sdk-iteration/plan.json plus 7 TASK files across 4 waves. Plan covers SDK/runtime contract baseline, manifest discovery and quality warnings, runtime readiness propagation, safe fixtures, manifest pilot, DX scaffold/docs, and backward compatibility guard.",""