@stacksjs/defaults 0.70.366 → 0.70.368

package/ai/skills/stacks-browse/SKILL.md

@@ -45,6 +45,11 @@ you to `brew install --cask chromium` or set `BROWSE_BROWSER`.
 - Docs: `http://localhost:3005`
 - API: `http://localhost:3008`
 
+For headless dashboard QA, start the server with
+`STACKS_NO_NATIVE=1 ./buddy dev --dashboard`. Never point `CRAFT_BIN` at a
+missing file to suppress the native window because invalid binary overrides are
+configuration errors.
+
 > Pages with an open HMR/SSE connection never reach "network idle"; the driver waits for
 > the load event (with a timeout) plus a short settle, so it won't hang on the dev server.
 
@@ -133,7 +138,10 @@ diagnostics without printing every visited path or overflowing element.
 
 When testing a Stacks app, check:
 - **Dashboard routes** — admin pages rendering? (`localhost:3002`)
-- **API health** — `GET localhost:3008/health` returns ok?
+- **API health** — `GET localhost:3008/api/health` returns ok? (`/api/health`, not
+  `/health`: the probe is mounted under `/api` so it cannot collide with a page of
+  the same name, and the API port answers `/api` only - every other path is a 404
+  there by design, so point page checks at the frontend instead.)
 - **Auth flow** — `/login`, `/register`
 - **CMS/blog** — `/blog`, post detail pages, `/blog/feed.xml`, `/blog/sitemap.xml`
 - **STX components** — do custom components render server-side?

package/ai/skills/stacks-dashboard/SKILL.md

@@ -111,12 +111,60 @@ inject message HTML into the dashboard document.
 - `/deployments/{id}` - one persisted Deployment model record
 
 The deployment page composes `DeploymentList`, `DeploymentTable`,
-`DeployScript`, and `LiveTerminalOutput`. Script reads and atomic writes use
+`DeploymentPreviewDialog`, `DeployScript`, and `LiveTerminalOutput`. The
+Preview action first collects the environment and optional domain, then calls
+the guarded `POST /api/dashboard/deployments/preview` Action. That Action runs
+the native `buddy deploy --dry-run --json` planner and returns its versioned,
+non-mutating plan. The dialog renders the ordered operations and resolved sites
+before the user may continue to the separate real deployment confirmation.
+Script reads and atomic writes use
 `GET|PUT /api/dashboard/deployments/script`. The terminal uses
 `GET /api/dashboard/deployments/terminal` and pauses polling while the document
 is hidden. Do not create separate `/deployments/scripts` or
 `/deployments/live-terminal` pages.
 
+Deployment recovery uses `POST /api/dashboard/deployments/rollback/preview`
+followed by `POST /api/dashboard/deployments/rollback`. The preview must run
+the native `buddy deploy:rollback --dry-run` path successfully, and execution
+must re-run that preview, compare its revision, and require the typed target
+environment confirmation. Never implement rollback by editing release links,
+restarting services directly, or guessing a prior release from Deployment
+model rows. Deployment rows are application history. Preserved releases and
+activation are owned by ts-cloud.
+
+### Operations control plane
+
+The Operations sidebar entry deliberately remains one item. Section navigation
+lives in `Dashboard/Operations/OperationsNavigation.stx`:
+
+- `/operations/changes` - unified change review, active work, release approvals
+- `/operations/scheduler` - registered task runs and persisted pause state
+- `/operations/recovery` - destinations, policies, recovery points, restore drills
+- `/operations/migrations` - model diff, schema effects, ledger reconciliation
+- `/operations/incidents` - native alerts, health rules, ownership, silence state
+- `/operations/audit` - append-only operator events and correlations
+
+Operational state belongs in the ts-cloud control plane initialized by
+`Operations/control-plane.ts`. Use its stores for durable operations, events,
+releases, approvals, alerts, backups, actors, and environments. Do not create a
+parallel dashboard-only JSON file or duplicate those entities in application
+models. Application domain records still follow the normal `app/Models` and
+`useApi` convention. Use dashboard Actions for aggregate operational views and
+guard every route in `dashboard-api.ts`.
+
+Every mutating operator action must resolve the authenticated actor and append
+or correlate a control-plane event. Use `trackOperatorOperation()` for bounded
+synchronous work and the native durable queue for long-running backup, restore,
+or provider work. Empty states must reflect real absence of configuration or
+events. Never seed operational pages with sample incidents, releases, backups,
+or health data.
+
+Migration execution must start from `previewPendingMigrations()`, audit the
+ledger against live schema effects, hash the reviewed plan, and recheck it
+immediately before `buddy migrate`. Only `reconcileMigrationLedger()` may
+repair provable ledger drift. Partial and unverifiable migrations require human
+review and must not be silently recorded.
+
 ### Utilities
 - `/health`, `/insights`, `/logs` - operational health and logs
 - `/servers`, `/serverless`, `/realtime` - runtime infrastructure

package/ai/skills/stacks-deploy/SKILL.md

@@ -16,6 +16,23 @@ The deployment workflow for Stacks applications.
 buddy deploy
 ```
 
+Preview the complete environment-aware plan before changing anything:
+
+```bash
+buddy deploy --dry-run
+buddy deploy --dry-run --env staging
+buddy deploy --dry-run --site docs
+buddy deploy --dry-run --json
+```
+
+The preview uses the same environment transformation and ts-cloud site
+classification as a real deploy. It reports the ordered validation,
+infrastructure, build, package, release, runtime, gateway, DNS, TLS, and
+optional container operations. It exits before prerequisite setup, builds,
+packaging, hooks, provider calls, persistence, DNS, TLS, or service restarts.
+The JSON form emits a versioned `STACKS_DEPLOY_PREVIEW_JSON=` line for API and
+tool consumers.
+
 ## Deployment Prerequisites
 
 1. **AWS credentials configured**: `buddy configure:aws`
@@ -87,6 +104,7 @@ buddy deploy
 
 ```bash
 buddy deploy                  # deploy to cloud
+buddy deploy --dry-run        # preview without changing anything
 buddy cloud --diff            # preview infrastructure changes before deploying
 buddy cloud --ssh             # SSH into deployed server
 buddy cloud:remove            # tear down infrastructure

package/ai/skills/stacks-desktop/SKILL.md

@@ -23,8 +23,17 @@ Craft window. `buddy build:desktop` compiles a small Stacks launcher and places
 the launcher, pinned Craft runtime, manifest, provenance, and checksums in
 `storage/framework/desktop-dist`.
 
-Set `CRAFT_BIN` to an executable Craft binary in CI or when Craft is not checked
-out at `~/Code/Tools/craft`.
+Craft is normally installed through pantry and resolved from PATH. Set
+`CRAFT_BIN` to an explicit compiled native binary in CI or local Craft
+development. When testing local SDK source as well, set `CRAFT_SDK_SRC` to its
+`src/index.ts` entry. Set `STACKS_NO_NATIVE=1` only when a deliberately web-only
+dashboard process is required, such as headless browser QA. A missing
+`CRAFT_BIN` is an error and is never treated as a headless flag.
+
+Native development windows load the dashboard through its loopback HTTP
+origin. Keep pretty HTTPS domains for browser access. WKWebView does not assume
+that a developer's local certificate authority is trusted, and a failed TLS
+navigation otherwise appears as a blank native window.
 
 ## API
 

package/ai/skills/stacks-stx/SKILL.md

@@ -91,6 +91,30 @@ STX signals are callable. Read with `count()`, replace with
 `count.update(value => value + 1)`. Do not use Vue-style `.value` access in
 STX templates or `resources/functions`.
 
+### Client loop conditionals
+
+Attribute loops create a client-owned scope. Their item and index aliases may
+be used with either reactive attribute conditionals or STX block conditionals.
+The compiler promotes a block chain that reads those aliases into one reactive
+runtime chain:
+
+```html
+<template :for="(field, index) in fields()">
+  @if(field.editable)
+    <input x-model="drafts[field.key]">
+  @elseif(index === 0)
+    <span>First read-only field</span>
+  @else
+    <span>{{ field.value }}</span>
+  @endif
+</template>
+```
+
+Loop aliases are scoped to the owning element and inherited by nested client
+loops. A condition outside that element remains server-owned. Do not mix a
+server context value into a client loop chain. Serialize the value into client
+state when the browser must reevaluate it.
+
 ### Native form binding
 
 Use `x-model` for two-way form state instead of pairing `:value` with a
@@ -260,6 +284,7 @@ await addLayout('admin', { nav: true, footer: true })
 - **Server-to-client values are explicit** - a JSON-serializable top-level value exported by `<script server>` can be referenced by name in `<script client>`. STX serializes only referenced values and never overwrites a client-owned declaration
 - **`storage/framework/stx/`** — stx build cache and the generated route manifest. `config/ui.ts` sets stx's `stateDir` here, so nothing lands in the project root. Gitignored; safe to delete
 - **Reactivity is signal-based** - use callable `state()` and `derived()` signals, not Vue-style `ref()` or `.value`
+- **Client loop conditions** - `@if` chains that read `:for` or `@for` aliases compile into scoped runtime chains; aliases do not leak outside the loop element
 - **Component tag case is semantic** - `<Input v-model:value="query">` is a paired component, while lowercase `<input v-model="query">` is a native void element. Keep component tags PascalCase, including names that collide with native elements
 - **Structural DOM timing** - use `nextTick()` with `useRef()` after opening reactive markup
 - **Crosswind for styling** — use utility classes, not inline styles

package/app/Actions/Dashboard/Deployments/CreateDeployment.ts

@@ -5,7 +5,8 @@ import process from 'node:process'
 import { Deployment } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
 import { dashboardOperationalError, dashboardOperationalIssue } from '../dashboard-response'
-import { booleanValue, deploymentCommandArgs } from './deployment-input'
+import { booleanValue, deploymentCommandArgs, deploymentPreviewCommandArgs } from './deployment-input'
+import { runDeploymentPreview } from './deployment-preview'
 
 function gitValue(args: string[]): string {
   const result = Bun.spawnSync(['git', ...args], {
@@ -26,8 +27,35 @@ export default new Action({
 
   async handle(request: RequestInstance) {
     const dryRun = booleanValue(request.get('dryRun') || request.get('dry_run'))
+    if (dryRun) {
+      let previewArgs: string[]
+      try {
+        previewArgs = deploymentPreviewCommandArgs({
+          environment: request.get('environment') || request.get('env'),
+          domain: request.get('domain'),
+        })
+      }
+      catch (error) {
+        return response.json({
+          success: false,
+          message: error instanceof Error ? error.message : 'Deployment preview input is invalid.',
+        }, { status: 422 })
+      }
+
+      try {
+        return {
+          success: true,
+          plan: await runDeploymentPreview(previewArgs),
+          message: 'Deployment preview generated.',
+        }
+      }
+      catch (error) {
+        return dashboardOperationalError(error, 'Deployment preview could not be generated.', 'CreateDeployment.preview', 500)
+      }
+    }
+
     const confirmed = booleanValue(request.get('confirmed'))
-    if (!dryRun && !confirmed) {
+    if (!confirmed) {
       return response.json({
         success: false,
         confirmationRequired: true,
@@ -40,7 +68,6 @@ export default new Action({
       args = deploymentCommandArgs({
         environment: request.get('environment') || request.get('env'),
         domain: request.get('domain'),
-        dryRun,
       })
     }
     catch (error) {
@@ -50,22 +77,20 @@ export default new Action({
       }, { status: 422 })
     }
 
-    let deployment: Awaited<ReturnType<typeof Deployment.create>> | null = null
+    let deployment: Awaited<ReturnType<typeof Deployment.create>>
     const startedAt = Date.now()
-    if (!dryRun) {
-      try {
-        deployment = await Deployment.create({
-          commitHash: gitValue(['rev-parse', '--short=12', 'HEAD']),
-          commitMessage: gitValue(['log', '-1', '--pretty=%s']),
-          branch: gitValue(['branch', '--show-current']),
-          status: 'running',
-          environment: args[2],
-          author: gitValue(['log', '-1', '--pretty=%an <%ae>']),
-        })
-      }
-      catch (error) {
-        return dashboardOperationalError(error, 'Deployment record could not be created.', 'CreateDeployment.record', 500)
-      }
+    try {
+      deployment = await Deployment.create({
+        commitHash: gitValue(['rev-parse', '--short=12', 'HEAD']),
+        commitMessage: gitValue(['log', '-1', '--pretty=%s']),
+        branch: gitValue(['branch', '--show-current']),
+        status: 'running',
+        environment: args[2],
+        author: gitValue(['log', '-1', '--pretty=%an <%ae>']),
+      })
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Deployment record could not be created.', 'CreateDeployment.record', 500)
     }
 
     let child: ReturnType<typeof Bun.spawn>
@@ -78,42 +103,37 @@ export default new Action({
       child.unref()
     }
     catch (error) {
-      if (deployment) {
-        try {
-          await deployment.update({
-            status: 'failed',
-            duration: 0,
-            errorLog: 'Deployment process could not be started.',
-          })
-        }
-        catch (updateError) {
-          dashboardOperationalIssue(updateError, 'Deployment failure status could not be recorded.', 'CreateDeployment.failureRecord')
-        }
+      try {
+        await deployment.update({
+          status: 'failed',
+          duration: 0,
+          errorLog: 'Deployment process could not be started.',
+        })
+      }
+      catch (updateError) {
+        dashboardOperationalIssue(updateError, 'Deployment failure status could not be recorded.', 'CreateDeployment.failureRecord')
       }
       return dashboardOperationalError(error, 'Deployment process could not be started.', 'CreateDeployment.process', 500)
     }
 
-    if (deployment) {
-      const record = deployment
-      void child.exited
-        .then(async (exitCode) => {
-          await record.update({
-            status: exitCode === 0 ? 'success' : 'failed',
-            duration: Math.max(0, Math.round((Date.now() - startedAt) / 1000)),
-            errorLog: exitCode === 0 ? '' : `buddy deploy exited with code ${exitCode}`,
-          })
-        })
-        .catch((error) => {
-          dashboardOperationalIssue(error, 'Deployment completion could not be recorded.', 'CreateDeployment.completionRecord')
+    void child.exited
+      .then(async (exitCode) => {
+        await deployment.update({
+          status: exitCode === 0 ? 'success' : 'failed',
+          duration: Math.max(0, Math.round((Date.now() - startedAt) / 1000)),
+          errorLog: exitCode === 0 ? '' : `buddy deploy exited with code ${exitCode}`,
         })
-    }
+      })
+      .catch((error) => {
+        dashboardOperationalIssue(error, 'Deployment completion could not be recorded.', 'CreateDeployment.completionRecord')
+      })
 
     return {
       success: true,
       pid: child.pid,
       command: ['./buddy', ...args],
-      deployment: deployment?.toJSON() || null,
-      message: dryRun ? 'Deployment preview started.' : 'Deployment started.',
+      deployment: deployment.toJSON(),
+      message: 'Deployment started.',
     }
   },
 })

package/app/Actions/Dashboard/Deployments/CreateDeploymentRollback.ts

@@ -0,0 +1,26 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { trackOperatorOperation } from '../Operations/control-plane'
+import { stringValue } from '../Operations/recovery-input'
+import { deploymentRollbackInput, DeploymentRollbackError, executeDeploymentRollback } from './deployment-rollback'
+
+export default new Action({
+  name: 'CreateDeploymentRollback',
+  description: 'Executes a previously reviewed deployment rollback and records the operator action.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request: RequestInstance) {
+    const body = request.all() as Record<string, unknown>
+    try {
+      const input = deploymentRollbackInput(body)
+      const tracked = await trackOperatorOperation(request, 'dashboard.deployments.rollback', input, () => executeDeploymentRollback(input, stringValue(body.revision), stringValue(body.confirmation)))
+      return { success: true, ...tracked.result, operation: tracked.operation }
+    }
+    catch (error) {
+      if (error instanceof DeploymentRollbackError)
+        return response.json({ message: error.message }, 409)
+      throw error
+    }
+  },
+})

package/app/Actions/Dashboard/Deployments/PreviewDeployment.ts

@@ -0,0 +1,39 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
+import { deploymentPreviewCommandArgs } from './deployment-input'
+import { runDeploymentPreview } from './deployment-preview'
+
+export default new Action({
+  name: 'PreviewDeployment',
+  description: 'Builds a non-mutating deployment plan from the native Buddy deploy pipeline.',
+  method: 'POST',
+  apiResponse: true,
+
+  async handle(request: RequestInstance) {
+    let args: string[]
+    try {
+      args = deploymentPreviewCommandArgs({
+        environment: request.get('environment') || request.get('env'),
+        domain: request.get('domain'),
+      })
+    }
+    catch (error) {
+      return response.json({
+        success: false,
+        message: error instanceof Error ? error.message : 'Deployment preview input is invalid.',
+      }, { status: 422 })
+    }
+
+    try {
+      return {
+        success: true,
+        plan: await runDeploymentPreview(args),
+      }
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Deployment preview could not be generated.', 'PreviewDeployment', 500)
+    }
+  },
+})

package/app/Actions/Dashboard/Deployments/PreviewDeploymentRollback.ts

@@ -0,0 +1,22 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
+import { deploymentRollbackInput, DeploymentRollbackError, previewDeploymentRollback } from './deployment-rollback'
+
+export default new Action({
+  name: 'PreviewDeploymentRollback',
+  description: 'Builds and validates a native deployment rollback plan without changing the active release.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request: RequestInstance) {
+    try {
+      return { success: true, plan: await previewDeploymentRollback(deploymentRollbackInput(request.all() as Record<string, unknown>)) }
+    }
+    catch (error) {
+      if (error instanceof DeploymentRollbackError)
+        return response.json({ message: error.message }, 409)
+      return dashboardOperationalError(error, 'Deployment rollback could not be previewed.', 'PreviewDeploymentRollback')
+    }
+  },
+})

package/app/Actions/Dashboard/Deployments/deployment-input.test.ts

@@ -3,6 +3,7 @@ import {
   averageRecordedDuration,
   booleanValue,
   deploymentCommandArgs,
+  deploymentPreviewCommandArgs,
   tailLines,
 } from './deployment-input'
 
@@ -19,7 +20,6 @@ describe('dashboard deployment inputs', () => {
     expect(deploymentCommandArgs({
       environment: 'staging',
       domain: 'app.example.com',
-      dryRun: true,
     })).toEqual([
       'deploy',
       '--env',
@@ -28,7 +28,6 @@ describe('dashboard deployment inputs', () => {
       '--yes',
       '--domain',
       'app.example.com',
-      '--dry-run',
     ])
   })
 
@@ -37,6 +36,17 @@ describe('dashboard deployment inputs', () => {
     expect(() => deploymentCommandArgs({ domain: 'not a domain' })).toThrow()
   })
 
+  it('builds a non-mutating machine-readable preview command', () => {
+    expect(deploymentPreviewCommandArgs({ environment: 'staging' })).toEqual([
+      'deploy',
+      '--env',
+      'staging',
+      '--dry-run',
+      '--json',
+      '--no-interaction',
+    ])
+  })
+
   it('aggregates only recorded durations', () => {
     expect(averageRecordedDuration([record(30), record('90'), record(null), record('bad')])).toBe(60)
     expect(averageRecordedDuration([record('bad')])).toBeNull()

package/app/Actions/Dashboard/Deployments/deployment-input.ts

@@ -1,7 +1,6 @@
 export interface DeploymentCommandInput {
   environment?: unknown
   domain?: unknown
-  dryRun?: unknown
 }
 
 export interface DeploymentRecordLike {
@@ -24,11 +23,14 @@ export function deploymentCommandArgs(input: DeploymentCommandInput): string[] {
       throw new Error('Domain must be a valid DNS name.')
     args.push('--domain', domain)
   }
-  if (booleanValue(input.dryRun))
-    args.push('--dry-run')
   return args
 }
 
+export function deploymentPreviewCommandArgs(input: DeploymentCommandInput): string[] {
+  const args = deploymentCommandArgs(input)
+  return [...args.filter(arg => arg !== '--no-interaction' && arg !== '--yes'), '--dry-run', '--json', '--no-interaction']
+}
+
 export function averageRecordedDuration(records: DeploymentRecordLike[]): number | null {
   const durations = records
     .map(record => record.get('duration'))

package/app/Actions/Dashboard/Deployments/deployment-preview.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'bun:test'
+import type { DeploymentPreview } from '@stacksjs/types'
+import { parseDeploymentPreview } from './deployment-preview'
+
+const plan: DeploymentPreview = {
+  version: 1,
+  dryRun: true,
+  project: { name: 'Acme', slug: 'acme' },
+  provider: 'hetzner',
+  mode: 'server',
+  environment: 'production',
+  region: 'us-east-1',
+  target: { site: null, domain: null, attachTo: null },
+  sites: [],
+  operations: [],
+  warnings: [],
+}
+
+describe('dashboard deployment preview process', () => {
+  it('extracts the versioned contract from Buddy output', () => {
+    const output = `[env] loaded\nSTACKS_DEPLOY_PREVIEW_JSON=${JSON.stringify(plan)}\n`
+    expect(parseDeploymentPreview(output)).toEqual(plan)
+  })
+
+  it('rejects missing and malformed preview contracts', () => {
+    expect(() => parseDeploymentPreview('ordinary output')).toThrow('did not return')
+    expect(() => parseDeploymentPreview('STACKS_DEPLOY_PREVIEW_JSON={}')).toThrow('invalid')
+  })
+})

package/app/Actions/Dashboard/Deployments/deployment-preview.ts

@@ -0,0 +1,41 @@
+import type { DeploymentPreview } from '@stacksjs/types'
+import { join } from 'node:path'
+import process from 'node:process'
+
+const previewPrefix = 'STACKS_DEPLOY_PREVIEW_JSON='
+
+export function parseDeploymentPreview(output: string): DeploymentPreview {
+  const line = output.split(/\r?\n/).find(entry => entry.startsWith(previewPrefix))
+  if (!line)
+    throw new Error('Buddy did not return a deployment preview contract.')
+
+  const plan = JSON.parse(line.slice(previewPrefix.length)) as DeploymentPreview
+  if (plan.version !== 1 || plan.dryRun !== true || !Array.isArray(plan.operations) || !Array.isArray(plan.sites))
+    throw new Error('Buddy returned an invalid deployment preview contract.')
+  return plan
+}
+
+export async function runDeploymentPreview(args: string[], timeoutMs = 30_000): Promise<DeploymentPreview> {
+  const child = Bun.spawn([join(process.cwd(), 'buddy'), ...args], {
+    cwd: process.cwd(),
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+  const stdoutPromise = new Response(child.stdout).text()
+  const stderrPromise = new Response(child.stderr).text()
+  let timeout: ReturnType<typeof setTimeout> | undefined
+  const exitPromise = Promise.race([
+    child.exited,
+    new Promise<never>((_resolve, reject) => {
+      timeout = setTimeout(() => {
+        child.kill()
+        reject(new Error(`Deployment preview timed out after ${timeoutMs}ms.`))
+      }, timeoutMs)
+    }),
+  ])
+  const [exitCode, stdout, stderr] = await Promise.all([exitPromise, stdoutPromise, stderrPromise])
+    .finally(() => clearTimeout(timeout))
+  if (exitCode !== 0)
+    throw new Error(stderr.trim() || `buddy deploy preview exited with code ${exitCode}`)
+  return parseDeploymentPreview(stdout)
+}

package/app/Actions/Dashboard/Deployments/deployment-rollback.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'bun:test'
+import { deploymentRollbackInput } from './deployment-rollback'
+
+describe('deployment rollback input', () => {
+  it('normalizes a scoped rollback target', () => {
+    expect(deploymentRollbackInput({ environment: 'Staging', site: 'Dashboard', release: 'Release-42' })).toEqual({
+      environment: 'staging',
+      site: 'dashboard',
+      release: 'release-42',
+    })
+  })
+
+  it('rejects shell syntax instead of forwarding it', () => {
+    expect(() => deploymentRollbackInput({ environment: 'production; echo unsafe' })).toThrow()
+  })
+})