chore(voc): prepare 0.3.34 release candidate

claude-code/claude-code-voc-intelligence/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "voc-intelligence",
   "description": "VOC intelligence skills for Claude Code: end-to-end VOC business workflows, Xiaohongshu and Douyin trend reports, live social VOC collection, Fmode Doubao image analysis, token/recharge checks, evidence-card outputs, prioritized issue pools, single-problem deep dives, competitor maps, 7-day content plans, VOC-backed speaking script co-creation, boss/operator action plans, and multi-turn memory.",
-  "version": "0.3.33",
+  "version": "0.3.34",
   "author": {
     "name": "nkkj-BrainHack"
   }

claude-code/claude-code-voc-intelligence/docs/voc-cost-metering-and-balance-implementation-spec.md

@@ -2358,3 +2358,23 @@ Studio 已有 `/balance`、Token 免登录、NewAPI 余额、支付二维码、
 2. 在余额正常的测试账户完成一次小额原有支付链路回归：`AccountLog.isVerified`、云函数划拨成功、NewAPI quota 增加一次、Balance 刷新可见。
 3. 使用已有检查点续跑，确认已完成业务键的 `fetchCalls=0`；完成后将 P0 账户级支付门禁标记为通过。
 4. P1 仍为历史批处理 Skill 规划适配、跨会话自动唤醒、更多媒体入口覆盖和报价偏差校准。
+
+### 21.33 2026-09-05 技能包 0.3.34 发布候选验收
+
+本轮只推进技能包交付，不执行真实 npm 发布。版本字段已在 `package.json`、`package-lock.json`、`.claude-plugin/plugin.json`、`skill-package-manifest.json` 和 MCP server 中统一为 `0.3.34`。
+
+| 检查项 | 结果 | 证据/结论 |
+| --- | --- | --- |
+| 索引审计 | 通过 | `audit:index` issues=0；11 个 Skill、19 个 MCP 工具，版本一致。 |
+| ZIP 构建 | 通过 | `npm run claude-voc:build`；`dist/claude-code-voc-intelligence.zip` 共 169 个文件。 |
+| 包级全量验收 | 通过 | `claude-voc:acceptance` 覆盖样例、证据卡、本地媒体、偏好记忆、MCP、安装器和 workspace。 |
+| 计费与成本 smoke | 通过 | billing、cost estimate、budget、trend/checkpoint、request shaping、media、cross-industry、MCP 全部通过。 |
+| npm tarball | 通过 | `dist/npm/vocmarket-voc-skill-0.3.34.tgz`，166 个文件，npm 安装、npx 安装和 workspace 安装 smoke 全通过。 |
+| 发布元数据 | 通过 | `npm publish --dry-run --access public --ignore-scripts` 成功；公网查询确认 `0.3.34` 尚未占用。 |
+| 旧路径与媒体策略 | 通过 | VOC 402 只返回 Tokenized Balance/显式二维码；媒体只写本地 `assets/`，不调用线上 Storage 上传链路。 |
+
+发布时使用 `Get-FileHash -Algorithm SHA256` 计算 ZIP 和 npm tarball 的校验值；由于本规格文档会随包发布，不在包内固化自身哈希，最终值以构建完成后的命令输出为准。
+
+#### 发布门禁
+
+技能包已达到可发布状态。真实发布仍需具备 npm 登录或 `NPM_TOKEN`，执行根目录 `npm run claude-voc:npm-publish`；发布后运行 `npm view @vocmarket/voc-skill@0.3.34 version --registry=https://registry.npmjs.org/` 和 `npx --yes @vocmarket/voc-skill@0.3.34 workspace --smoke` 完成线上验证。fmode-studio、future-server 的生产发布不属于本轮 npm 包发布动作。

claude-code/claude-code-voc-intelligence/mcp/src/server.js

@@ -66,7 +66,7 @@ function normalizeToolResult(result = {}) {
 function createServer() {
   const server = new McpServer({
     name: 'voc-intelligence',
-    version: '0.3.33'
+    version: '0.3.34'
   });
 
   server.registerTool(

claude-code/claude-code-voc-intelligence/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@vocmarket/voc-skill",
-  "version": "0.3.33",
+  "version": "0.3.34",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@vocmarket/voc-skill",
-      "version": "0.3.33",
+      "version": "0.3.34",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
         "zod": "^4.4.3"

claude-code/claude-code-voc-intelligence/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vocmarket/voc-skill",
-  "version": "0.3.33",
+  "version": "0.3.34",
   "description": "Claude Code VOC intelligence skills for Xiaohongshu and Douyin trend reports, live social VOC collection, Fmode image analysis, single-issue deep dives, boss/operator action plans, and multi-turn memory.",
   "type": "commonjs",
   "bin": {

claude-code/claude-code-voc-intelligence/skill-package-manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-voc-intelligence",
-  "version": "0.3.33",
+  "version": "0.3.34",
   "capabilities": {
     "summary": "三类情报源同源接入：①社媒内容 ②国内电商+创作者情报 ③海外选品。统一 search→doc→call、鉴权计费一致。",
     "channels": [

dist/claude-code-voc-intelligence-suite-manifest.json

@@ -1,9 +1,9 @@
 {
   "name": "claude-code-voc-intelligence",
-  "version": "0.3.33",
-  "generatedAt": "2026-09-05T04:23:42.586Z",
+  "version": "0.3.34",
+  "generatedAt": "2026-09-05T12:19:51.689Z",
   "packageZip": "dist/claude-code-voc-intelligence.zip",
-  "packageZipBytes": 593524,
+  "packageZipBytes": 596082,
   "plugin": "voc-intelligence",
   "skills": [
     "xiaohongshu-trend-intelligence",

dist/npm/claude-code-voc-npm-package-manifest.json

@@ -1,10 +1,10 @@
 {
   "name": "@vocmarket/voc-skill",
-  "version": "0.3.33",
-  "generatedAt": "2026-09-03T03:12:13.888Z",
-  "tarball": "dist/npm/vocmarket-voc-skill-0.3.33.tgz",
-  "tarballBytes": 472945,
-  "unpackedBytes": 2590864,
+  "version": "0.3.34",
+  "generatedAt": "2026-09-05T12:21:45.324Z",
+  "tarball": "dist/npm/vocmarket-voc-skill-0.3.34.tgz",
+  "tarballBytes": 478342,
+  "unpackedBytes": 2607507,
   "entryCount": 166,
   "installCommands": [
     "npm install -g @vocmarket/voc-skill",
@@ -15,5 +15,5 @@
   "tested": true,
   "npxTested": true,
   "workspaceTested": true,
-  "published": true
+  "published": false
 }

release/npm/claude-code-voc-intelligence/README.md

@@ -106,9 +106,11 @@ npm publish <tgz> --access public
 
 ## 当前发布状态
 
-- 当前 npm latest：`@vocmarket/voc-skill@0.3.15`
-- 本地 dist zip/tgz manifest 已重建到 `0.3.15`
-- 已验证：`npm view @vocmarket/voc-skill name version dist-tags.latest` 返回 `0.3.15`
+- 当前 npm latest：`@vocmarket/voc-skill@0.3.33`
+- 本地发布候选：`@vocmarket/voc-skill@0.3.34`（尚未执行真实 publish）
+- 本地 dist zip/tgz manifest 已重建到 `0.3.34`
+- 已验证：`npm view @vocmarket/voc-skill version dist-tags.latest` 返回 `0.3.33`；`0.3.34` 当前未占用
+- 已验证：`npm publish --dry-run --access public --ignore-scripts` 成功，包内 166 个文件
 - 已验证：`npm exec --yes --package @vocmarket/voc-skill@latest -- claude-voc workspace --smoke`
 - 已迁移提示：旧包 `@gangvy/claude-code-voc-intelligence@*` 已标记为 deprecated，提示改用 `@vocmarket/voc-skill`。
 - 已新增：`npm run claude-voc:acceptance` 一键发布前验收，借鉴 `tihao-sop` 的 workspace 安装断言方式。

scripts/deploy/claude-code-voc-intelligence-suite.js

@@ -13,12 +13,13 @@ const PACKAGE_ID = 'claude-code-voc-intelligence';
 const NPM_PACKAGE_NAME = '@vocmarket/voc-skill';
 const PACKAGE_ZIP = path.join(DIST_DIR, `${PACKAGE_ID}.zip`);
 const DIST_MANIFEST = path.join(DIST_DIR, `${PACKAGE_ID}-suite-manifest.json`);
-const TEMP_ROOT = path.join(os.tmpdir(), 'claude-code-voc-pkg', PACKAGE_ID);
+const TEMP_ROOT = path.join(os.tmpdir(), 'claude-code-voc-pkg', `${PACKAGE_ID}-${process.pid}-${Date.now()}`);
 const TEST_ROOT = path.join(os.tmpdir(), 'claude-code-voc-pkg-test', PACKAGE_ID);
 const CDN_PREFIX = 'x/claude-code-skills/packages';
 const CDN_KEY = `${CDN_PREFIX}/${PACKAGE_ID}.zip`;
 const CDN_DOMAIN = 'https://repos.fmode.cn';
 const BUCKET = 'nova-repos';
+const { auditIndex } = require(path.join(SUITE_DIR, 'scripts', 'audit-index.js'));
 
 const REQUIRED_FILES = [
   'SKILL.md',
@@ -67,6 +68,7 @@ const REQUIRED_FILES = [
 const EXCLUDED_DIRS = new Set([
   'node_modules',
   'memory',
+  'output',
   'outputs',
   '.npm-cache-acceptance',
   '.tmp',
@@ -131,16 +133,16 @@ function readJson(filePath) {
 }
 
 function copyDirRecursive(srcDir, destDir) {
-  ensureDir(destDir);
   let count = 0;
   for (const entry of fs.readdirSync(srcDir, { withFileTypes: true })) {
     if (entry.isDirectory() && EXCLUDED_DIRS.has(entry.name)) continue;
-    if (entry.isFile() && EXCLUDED_FILES.has(entry.name)) continue;
+    if (entry.isFile() && (EXCLUDED_FILES.has(entry.name) || /\.bak-[^/\\]+$/i.test(entry.name))) continue;
     const src = path.join(srcDir, entry.name);
     const dest = path.join(destDir, entry.name);
     if (entry.isDirectory()) {
       count += copyDirRecursive(src, dest);
     } else if (entry.isFile()) {
+      ensureDir(destDir);
       ensureDir(path.dirname(dest));
       fs.copyFileSync(src, dest);
       count++;
@@ -204,6 +206,8 @@ function validateSuite() {
   const manifest = readJson(MANIFEST_PATH);
   const mcpJson = readJson(path.join(SUITE_DIR, '.mcp.json'));
   const rootSkill = fs.readFileSync(path.join(SUITE_DIR, 'SKILL.md'), 'utf8');
+  const indexAudit = auditIndex(SUITE_DIR);
+  if (indexAudit.status !== 'ok') missing.push(...indexAudit.issues.map(issue => `index audit: ${issue}`));
   if (packageJson.name !== NPM_PACKAGE_NAME) missing.push('package.json:name mismatch');
   if (pluginJson.name !== 'voc-intelligence') missing.push('.claude-plugin/plugin.json:name mismatch');
   if (!/^description:\s*\S.+$/m.test(rootSkill)) missing.push('SKILL.md missing description');

scripts/deploy/claude-code-voc-npm-package.js

@@ -12,6 +12,7 @@ const DIST_MANIFEST = path.join(DIST_DIR, 'claude-code-voc-npm-package-manifest.
 const PACKAGE_NAME = '@vocmarket/voc-skill';
 const BIN_NAME = 'claude-voc';
 const TEST_ROOT = path.join(os.tmpdir(), 'claude-code-voc-npm-test', String(process.pid));
+const { auditIndex } = require(path.join(SUITE_DIR, 'scripts', 'audit-index.js'));
 
 function parseArgs(argv) {
   const opts = {
@@ -127,6 +128,10 @@ function validatePackage() {
   if (missing.length) {
     throw new Error(`missing files:\n${missing.map(item => `  - ${item}`).join('\n')}`);
   }
+  const indexAudit = auditIndex(SUITE_DIR);
+  if (indexAudit.status !== 'ok') {
+    throw new Error(`skill package index audit failed:\n${indexAudit.issues.map(item => `  - ${item}`).join('\n')}`);
+  }
   console.log(`  ok: ${packageJson.name}@${packageJson.version}`);
   return packageJson;
 }
@@ -255,15 +260,10 @@ function publishTarball(tarball) {
     env.NODE_AUTH_TOKEN = token;
   }
   run('npm', ['publish', tarball, '--access', 'public'], PROJECT_ROOT, { env });
-  ensurePublicAccess(env);
   verifyPublishedPublic();
   console.log('  ok: published and visible on npm registry');
 }
 
-function ensurePublicAccess(env = process.env) {
-  run('npm', ['access', 'set', 'status=public', PACKAGE_NAME, '--registry=https://registry.npmjs.org/'], PROJECT_ROOT, { env });
-}
-
 function verifyPublishedPublic() {
   const version = readJson(path.join(SUITE_DIR, 'package.json')).version;
   const args = ['view', `${PACKAGE_NAME}@${version}`, 'version', '--registry=https://registry.npmjs.org/'];