@zaip-ai/cli 2.2.0 → 3.0.0

package/dist/services/codex-conversation-lifecycle-hook.js

@@ -1,29 +1,169 @@
-export const CODEX_CONVERSATION_LIFECYCLE_HOOK = String.raw `import { existsSync, readFileSync, writeSync } from "node:fs";
-import { promises as fs } from "node:fs";
+export const CODEX_CONVERSATION_LIFECYCLE_HOOK = String.raw `import { writeSync } from "node:fs";
+import { lstat, open, readFile, realpath, mkdir, rename, writeFile, appendFile, unlink } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-const root=resolve(dirname(fileURLToPath(import.meta.url)),"..","..");
-const local=resolve(root,".local","hooks");
-let raw=""; for await (const chunk of process.stdin) raw+=chunk;
-let eventName=null;
-try { const event=JSON.parse(raw); eventName=text(event.hook_event_name); const session=text(event.session_id),turn=text(event.turn_id),transcript=text(event.transcript_path);
-  if(!enabled()||!inside(text(event.cwd))||!session||!turn){ respond(eventName); process.exit(0); }
-  const cli=[resolve(root,"packages","cli","dist","index.js"),resolve(root,".agents","runtime","bin","zaip.mjs")].find(existsSync); if(!cli){diagnostic("cli_not_found",{});respond(eventName);process.exit(0);}
-  // Prompt submission is context-only. An early intake would claim the host
-  // turn and block an explicit same-turn new-work command.
-  if(eventName==="Stop"){ const started=await invoke(cli,["conversation","start","--intent","conversation","--json"],session,turn,transcript); const value=json(started.stdout); const run=runId(started.stdout); if(started.code===0&&run&&value?.task===null){ const status=await terminalAfterStop(transcript,session,turn); if(status!==null){ const result=await invoke(cli,["conversation","finish","--run",run,"--summary","Codex host turn completed","--status",status,"--json"],session,turn,transcript); if(result.code!==0) diagnostic("finish_deferred",{code:result.code}); } else diagnostic("transcript_pending",{turn_id:turn,attempts:3}); } else if(started.code===0&&!run) diagnostic("start_invalid_result",{}); else if(started.code!==0) diagnostic("start_failed",{code:started.code}); }
-  respond(eventName);
-} catch(error) { diagnostic("hook_exception",{error:error instanceof Error?error.message:String(error)}); respond(eventName); }
-function enabled(){ try{return /zaip:\s*\r?\n\s*enabled:\s*true\s*(?:\r?\n|$)/.test(readFileSync(resolve(root,".agents","config","project.yaml"),"utf8"));}catch{return false;} }
-function inside(cwd){if(!cwd)return false;const scoped=relative(root,resolve(cwd));return scoped===""||(!scoped.startsWith("..")&&!isAbsolute(scoped));}
-function text(value){if(typeof value!=="string")return null;const normalized=value.trim();return normalized.length>0&&normalized.length<=4096?normalized:null;}
-async function terminal(path,session,turn){if(!path||!isAbsolute(path))return null;try{const content=await fs.readFile(path,"utf8");let trusted=false;for(const line of content.split(/\r?\n/)){try{const item=JSON.parse(line),p=item?.payload;if(item?.type==="session_meta")trusted=p?.id===session||p?.session_id===session;if(trusted&&p?.turn_id===turn&&p?.type==="task_complete")return p?.status==="cancelled"?"cancelled":p?.status==="failed"||p?.error!==undefined?"failed":"completed";}catch{}}return null;}catch{return null;}}
-async function terminalAfterStop(path,session,turn){for(const delay of [0,250,750]){if(delay)await new Promise(done=>setTimeout(done,delay));const status=await terminal(path,session,turn);if(status!==null)return status;}return null;}
-function invoke(cli,args,session,turn,transcript){return new Promise(done=>{const child=spawn(process.execPath,[cli,...args],{cwd:root,windowsHide:true,env:{...process.env,CODEX_THREAD_ID:session,CODEX_TURN_ID:turn,CODEX_TRANSCRIPT_PATH:transcript??""},stdio:["ignore","pipe","pipe"]});let stdout="",stderr="",settled=false;const finish=code=>{if(settled)return;settled=true;clearTimeout(timer);done({code,stdout,stderr});};child.stdout.on("data",c=>stdout=(stdout+String(c)).slice(0,262144));child.stderr.on("data",c=>stderr=(stderr+String(c)).slice(0,8192));child.once("error",()=>finish(1));child.once("close",code=>finish(code??1));const timer=setTimeout(()=>{child.kill();finish(1);},60000);});}
-function json(stdout){try{return JSON.parse(stdout);}catch{return null;}}
-function runId(stdout){const value=json(stdout);const id=value?.run?.run_id??value?.run?.id;return typeof id==="string"?id:null;}
-function diagnostic(code,detail){fs.mkdir(local,{recursive:true}).then(()=>fs.appendFile(resolve(local,"codex-conversation.ndjson"),JSON.stringify({code,detail,at:new Date().toISOString()})+"\n")).catch(()=>{});}
-function respond(name){if(name==="Stop")writeSync(1,JSON.stringify({hookSpecificOutput:{hookEventName:"Stop"}})+"\n");}
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const local = resolve(root, ".local/hooks");
+const deadline = Date.now() + 8000;
+const readChunkBytes = 1024 * 1024, maxLineBytes = 8 * 1024 * 1024, maxReadBytes = 16 * 1024 * 1024;
+const hash = value => createHash("sha256").update(value).digest("hex");
+const parse = value => { try { return JSON.parse(value); } catch { return null; } };
+const text = value => typeof value === "string" && value.length > 0 && value.length <= 4096 ? value : null;
+const inside = path => { const p = relative(root, resolve(path)); return p === "" || (!p.startsWith("..") && !isAbsolute(p)); };
+let raw = ""; for await (const chunk of process.stdin) raw += chunk;
+const event = parse(raw), session = text(event?.session_id), turn = text(event?.turn_id);
+let receipt, receiptPath, lease;
+function reply(pending = false) {
+  const result = { hookSpecificOutput: { hookEventName: "Stop" } };
+  // One continuation at most. Persistent failures remain an explicit durable pending event.
+  if (pending && event?.stop_hook_active !== true) Object.assign(result, { decision: "block", reason: "ZAIP closure or telemetry is pending. Retry this exact turn using its durable Stop receipt; do not report Task completion before canonical closure." });
+  writeSync(1, JSON.stringify(result) + "\n");
+}
+async function save(path, value) {
+  await mkdir(dirname(path), { recursive: true });
+  const temporary = path + ".tmp-" + randomUUID();
+  await writeFile(temporary, JSON.stringify(value) + "\n", { flag: "wx", mode: 0o600 });
+  for (let retry = 0; ; retry++) {
+    try { await rename(temporary, path); break; }
+    catch (error) { if (!["EPERM", "EACCES", "EBUSY"].includes(error.code) || retry >= 5) throw error; await new Promise(done => setTimeout(done, 20 * (retry + 1))); }
+  }
+}
+async function note(code) {
+  await mkdir(local, { recursive: true });
+  await appendFile(resolve(local, "codex-conversation.ndjson"), JSON.stringify({ code, session, turn, at: new Date().toISOString() }) + "\n");
+}
+async function acquire(path) {
+  try { const h = await open(path, "wx"); await h.writeFile(JSON.stringify({ pid: process.pid })); return h; }
+  catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const old = parse(await readFile(path, "utf8").catch(() => ""));
+    if (!Number.isSafeInteger(old?.pid) || old.pid <= 0) return null;
+    try { process.kill(old.pid, 0); return null; } catch (failure) { if (failure.code !== "ESRCH") return null; }
+    await unlink(path).catch(() => {});
+    try { const h = await open(path, "wx"); await h.writeFile(JSON.stringify({ pid: process.pid })); return h; } catch { return null; }
+  }
+}
+function signature(stat) { return { dev: stat.dev, ino: stat.ino, birthtime_ms: stat.birthtimeMs, size: stat.size, mtime_ms: stat.mtimeMs, ctime_ms: stat.ctimeMs }; }
+async function bytes(handle, offset, length) { const b = Buffer.alloc(length); const read = await handle.read(b, 0, length, offset); return b.subarray(0, read.bytesRead); }
+function proof(offset, line) { return { offset, length: line.length, sha256: hash(line) }; }
+function sessionOf(row) { return row?.type === "session_meta" ? row.payload?.id ?? row.payload?.session_id : row?.payload?.type === "session_meta" ? row.payload.id ?? row.payload.session_id : null; }
+async function terminal(path) {
+  if (!path || !isAbsolute(path)) throw new Error("transcript_missing");
+  const link = await lstat(path);
+  if (!link.isFile() || link.isSymbolicLink() || (await realpath(path)).toLowerCase() !== resolve(path).toLowerCase()) throw new Error("transcript_unsafe");
+  const h = await open(path, "r");
+  try {
+    const stat = await h.stat(), sig = signature(stat), prior = receipt.cursor;
+    let same = prior?.path === path && prior.dev === sig.dev && prior.ino === sig.ino && prior.birthtime_ms === sig.birthtime_ms && prior.size <= sig.size && prior.offset <= sig.size;
+    if (same && prior.size === sig.size && (prior.mtime_ms !== sig.mtime_ms || prior.ctime_ms !== sig.ctime_ms)) same = false;
+    if (same && prior.anchor) same = hash(await bytes(h, prior.anchor.offset, prior.anchor.length)) === prior.anchor.sha256;
+    if (same && prior.session_proof) same = hash(await bytes(h, prior.session_proof.offset, prior.session_proof.length)) === prior.session_proof.sha256;
+    let offset = same ? prior.offset : 0, trusted = same && prior.trusted === true;
+    let sessionProof = same ? prior.session_proof : null, terminalProof = same ? prior.terminal_proof : null, status = same ? prior.terminal_status : null;
+    let readBytes = 0, scanOffset = offset, lineOffset = offset, lineBytes = 0, lineParts = [];
+    const consume = line => {
+      const row = parse(line.toString("utf8"));
+      if (!row && line.toString("utf8").trim()) throw new Error("transcript_invalid_jsonl");
+      const foundSession = sessionOf(row);
+      if (foundSession !== null) {
+        if (lineOffset !== 0 || foundSession !== session) throw new Error("transcript_session_mismatch");
+        trusted = true; sessionProof = proof(lineOffset, line);
+      }
+      const p = row?.payload;
+      if (trusted && p?.type === "task_complete" && p.turn_id === turn) {
+        status = p.status === "cancelled" ? "cancelled" : p.status === "failed" || p.error != null ? "failed" : "completed";
+        terminalProof = proof(lineOffset, line);
+      }
+    };
+    while (scanOffset < sig.size && Date.now() < deadline - 1500 && readBytes < maxReadBytes) {
+      const buffer = await bytes(h, scanOffset, Math.min(readChunkBytes, sig.size - scanOffset, maxReadBytes - readBytes)); readBytes += buffer.length;
+      let partStart = 0;
+      for (let i = 0; i < buffer.length; i++) {
+        if (buffer[i] !== 10) continue;
+        const part = buffer.subarray(partStart, i + 1); lineBytes += part.length;
+        if (lineBytes > maxLineBytes) throw new Error("transcript_line_too_large");
+        lineParts.push(part);
+        const line = lineParts.length === 1 ? lineParts[0] : Buffer.concat(lineParts, lineBytes);
+        consume(line);
+        lineOffset = scanOffset + i + 1; offset = lineOffset; lineBytes = 0; lineParts = []; partStart = i + 1;
+      }
+      if (partStart < buffer.length) {
+        const part = buffer.subarray(partStart); lineBytes += part.length;
+        if (lineBytes > maxLineBytes) throw new Error("transcript_line_too_large");
+        lineParts.push(part);
+      }
+      scanOffset += buffer.length; // A partial tail advances only the scan, never the durable cursor.
+    }
+    const after = signature(await h.stat());
+    if (JSON.stringify(sig) !== JSON.stringify(after)) throw new Error("transcript_changed_during_read");
+    const anchorOffset = Math.max(0, offset - 256), anchor = proof(anchorOffset, await bytes(h, anchorOffset, offset - anchorOffset));
+    receipt.cursor = { path, ...sig, offset, trusted, session_proof: sessionProof, terminal_proof: terminalProof, terminal_status: status, anchor };
+    receipt.bytes_read = (receipt.bytes_read ?? 0) + readBytes;
+    receipt.observed_at = new Date().toISOString();
+    await save(receiptPath, receipt);
+    return trusted && terminalProof ? status : null;
+  } finally { await h.close(); }
+}
+function call(cli, args, path) {
+  return new Promise(done => {
+    const remaining = deadline - Date.now() - 150;
+    if (remaining <= 0) return done({ code: 1, out: "", timeout: true });
+    const child = spawn(process.execPath, [cli, ...args, "--workspace", root, "--json"], { cwd: root, windowsHide: true, env: { ...process.env, CODEX_THREAD_ID: session, CODEX_TURN_ID: turn, CODEX_TRANSCRIPT_PATH: path ?? "" }, stdio: ["ignore", "pipe", "ignore"] });
+    let out = "", settled = false;
+    const finish = (code, timeout = false) => { if (settled) return; settled = true; clearTimeout(timer); done({ code, out, timeout }); };
+    const timer = setTimeout(() => { child.kill(); finish(1, true); }, remaining);
+    child.stdout.on("data", data => { out = (out + String(data)).slice(0, 262144); });
+    child.once("error", () => finish(1)); child.once("close", code => finish(code ?? 1));
+  });
+}
+try {
+  const config = await readFile(resolve(root, ".agents/config/project.yaml"), "utf8");
+  if (event?.hook_event_name !== "Stop" || !session || !turn || !text(event.cwd) || !inside(event.cwd) || !/zaip:\s*\r?\n\s*enabled:\s*true\s*(?:\r?\n|$)/.test(config)) { reply(); process.exit(0); }
+  await mkdir(local, { recursive: true });
+  receiptPath = resolve(local, "stop-" + hash(JSON.stringify([session, turn])) + ".json");
+  lease = await acquire(receiptPath + ".lock");
+  if (!lease) { await note("stop_worker_busy"); reply(true); process.exit(0); }
+  const old = parse(await readFile(receiptPath, "utf8").catch(() => ""));
+  receipt = old?.schema_version === 1 && old.session_id === session && old.turn_id === turn ? old : { schema_version: 1, session_id: session, turn_id: turn, state: "pending", attempts: 0 };
+  receipt.event = { hook_event_name: "Stop", cwd: root, session_id: session, turn_id: turn, transcript_path: text(event.transcript_path), stop_hook_active: true };
+  if (receipt.state === "persisted") { reply(); } else {
+    receipt.attempts += 1; receipt.state = "pending"; await save(receiptPath, receipt);
+    let status = null;
+    for (const delay of [0, 250, 750]) { if (delay) await new Promise(r => setTimeout(r, delay)); status = await terminal(text(event.transcript_path)); if (status) break; }
+    if (!status) throw new Error("transcript_pending");
+    const cli = resolve(root, ".agents/runtime/bin/zaip.mjs");
+    const correlationKey = hash(JSON.stringify(["codex", session, turn, null, null]));
+    const correlation = parse(await readFile(resolve(root, ".local/codex-telemetry-spool/v1/correlations", correlationKey + ".json"), "utf8").catch(() => ""));
+    let intake;
+    if (correlation?.schema_version === 1 && correlation.thread_id === session && correlation.turn_id === turn && correlation.agent_path === null && typeof correlation.run_id === "string") {
+      intake = { run: { run_id: correlation.run_id }, task: correlation.task_id === null ? null : { id: correlation.task_id } };
+    } else {
+      const started = await call(cli, ["conversation", "start", "--intent", "conversation"], text(event.transcript_path));
+      if (started.code !== 0) throw new Error("start_pending");
+      intake = parse(started.out);
+    }
+    const run = intake?.run?.run_id;
+    if (typeof run !== "string" || (intake.task !== null && typeof intake.task?.id !== "string")) throw new Error("start_pending");
+    receipt.run_id = run; await save(receiptPath, receipt);
+    const result = await call(cli, ["subagent", "reconcile-stop", "--session", session, "--turn", turn], text(event.transcript_path));
+    const outcome = parse(result.out);
+    const terminalStates = ["completed", "blocked", "failed", "cancelled"];
+    const closed = intake.task === null
+      ? outcome?.run?.id === run && terminalStates.includes(outcome.run.status) && typeof outcome.run.finished_at === "string"
+      : outcome?.status === "closed" && outcome.parent_run_id === run && outcome.reconciliation?.tasks?.some(task => task.id === intake.task.id && terminalStates.includes(task.status));
+    if (result.code !== 0 || !closed) throw new Error("closure_pending");
+    if (intake.task !== null) {
+      const usage = await call(cli, ["run", "usage", run, "--disable-codex-raw"], text(event.transcript_path));
+      if (usage.code !== 0 || parse(usage.out) === null) throw new Error("telemetry_pending");
+    }
+    receipt.state = "persisted"; receipt.persisted_at = new Date().toISOString(); receipt.error = null;
+    await save(receiptPath, receipt); reply();
+  }
+} catch (error) {
+  if (receipt && receiptPath) { receipt.state = "pending"; receipt.error = String(error.message ?? error); await save(receiptPath, receipt).catch(() => {}); }
+  await note(String(error.message ?? error)).catch(() => {}); reply(true);
+} finally { if (lease) { await lease.close(); await unlink(receiptPath + ".lock").catch(() => {}); } }
 `;
 //# sourceMappingURL=codex-conversation-lifecycle-hook.js.map

package/dist/services/codex-conversation-lifecycle-hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-conversation-lifecycle-hook.js","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B1D,CAAC"}
+{"version":3,"file":"codex-conversation-lifecycle-hook.js","sourceRoot":"","sources":["../../src/services/codex-conversation-lifecycle-hook.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuK1D,CAAC"}

package/dist/services/codex-pre-tool-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,QAqtB/B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,QA+xB/B,CAAC"}

package/dist/services/codex-pre-tool-hook-template.js

@@ -1,8 +1,12 @@
-export const CODEX_PRE_TOOL_HOOK = String.raw `import { writeSync } from "node:fs";
-import { lstat, readFile, readdir, realpath } from "node:fs/promises";
+export const CODEX_PRE_TOOL_HOOK = String.raw `import { execFile } from "node:child_process";
+import { writeSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { promisify } from "node:util";
 
+const execute = promisify(execFile);
 const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const deletionCommandPattern = /\b(?:Remove-Item|rm|rmdir|rd|del|erase)\b/i;
 const allowedExplicitNetworkHosts = new Set([
@@ -212,7 +216,7 @@ function validateInlineExecution(command) {
   }
 }
 
-function validateGitPublication(command) {
+async function validateGitPublication(command) {
   const tokens = tokenizeLiteralCommand(command);
   if (tokens === null) {
     if (/(?:^|[;&|]\s*)git(?:\.exe)?\b/i.test(command)) {
@@ -257,17 +261,83 @@ function validateGitPublication(command) {
     deny("Remote, SSH, and credential configuration changes are blocked.");
   }
   if (subcommand !== "push") return;
-  const branch =
-    arguments_.length === 2 && arguments_[0] === "origin"
-      ? arguments_[1]
-      : arguments_.length === 3 && arguments_[0] === "-u" && arguments_[1] === "origin"
-        ? arguments_[2]
-        : null;
-  if (branch === null || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch)) {
-    deny("Git publication must use an explicit valid branch on origin.");
+  const deployment = await configuredDeploymentBranches();
+  const requested = arguments_[1]?.match(/^HEAD:refs\/heads\/(.+)$/)?.[1];
+  if (arguments_.length !== 2 || arguments_[0] !== "origin" || !requested || !deployment.applicationBranches.includes(requested)) {
+    deny(
+      "Automated application publication is restricted to configured deploy.frontend.branch or deploy.backend.branch (" + deployment.applicationBranches.join(", ") +
+        "); database migrations are beta-only and use the migration request workflow. " +
+        "deploy.production_branch " + deployment.productionBranch + " requires human promotion.",
+    );
+  }
+  const scopes = Object.entries(deployment.scopeBranches).filter(([, branch]) => branch === requested).map(([scope]) => scope);
+  if (scopes.length === 0) deny("A Git push must resolve to a configured application scope.");
+  try {
+    await execute(process.execPath, [resolve(repositoryRoot, ".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs"), "--repository", repositoryRoot, "--scope", scopes[0], "--resolve-branch", "--branch", requested], { cwd: repositoryRoot, encoding: "utf8", windowsHide: true });
+  } catch (error) {
+    deny("Application publication content preflight failed: " + (error?.stderr?.trim() || error?.message || "unknown failure"));
   }
 }
 
+async function configuredDeploymentBranches() {
+  const defaults = { applicationBranches: ["beta"], scopeBranches: { frontend: "beta", backend: "beta" }, productionBranch: "main" };
+  let source;
+  try {
+    source = await readFile(resolve(repositoryRoot, ".agents/config/project.yaml"), "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return defaults;
+    deny("Could not read project.yaml deploy policy.");
+  }
+  let document;
+  try {
+    const parser = await import(
+      pathToFileURL(
+        resolve(repositoryRoot, ".agents/skills/zaip-skill-github-deploy/scripts/yaml-parser.mjs"),
+      ).href,
+    );
+    document = parser.parseDocument(source, { strict: true, uniqueKeys: true });
+  } catch {
+    deny("Canonical deploy YAML parser is unavailable.");
+  }
+  if (document.errors.length > 0) deny("project.yaml deploy policy is malformed.");
+  const config = document.toJS();
+  if (config === null || typeof config !== "object" || Array.isArray(config)) {
+    deny("project.yaml must contain a mapping.");
+  }
+  const deploy = config.deploy;
+  if (deploy === undefined) return defaults;
+  if (deploy === null || typeof deploy !== "object" || Array.isArray(deploy)) {
+    deny("project.yaml deploy must be a mapping.");
+  }
+  if (!Object.keys(deploy).every((key) => ["branch", "production_branch", "allow_production", "frontend", "backend", "database"].includes(key))) {
+    deny("project.yaml deploy has unsupported keys.");
+  }
+  for (const key of ["frontend", "backend", "database"]) {
+    if (deploy[key] !== undefined && (deploy[key] === null || typeof deploy[key] !== "object" || Array.isArray(deploy[key]) || !Object.keys(deploy[key]).every((nested) => nested === "branch"))) deny("project.yaml deploy scope is invalid.");
+  }
+  const productionBranch = Object.hasOwn(deploy, "production_branch")
+    ? deploy.production_branch
+    : defaults.productionBranch;
+  const frontend = deploy.frontend !== undefined && Object.hasOwn(deploy.frontend, "branch") ? deploy.frontend.branch : "beta";
+  const backend = deploy.backend !== undefined && Object.hasOwn(deploy.backend, "branch") ? deploy.backend.branch : "beta";
+  const database = deploy.database !== undefined && Object.hasOwn(deploy.database, "branch") ? deploy.database.branch : "beta";
+  if (database !== "beta") deny("project.yaml deploy.database.branch must be beta.");
+  if (
+    !isSafeBranchName(frontend) ||
+    !isSafeBranchName(backend) ||
+    !isSafeBranchName(productionBranch) ||
+    (frontend !== "main" && frontend === productionBranch) ||
+    (backend !== "main" && backend === productionBranch)
+  ) {
+    deny("project.yaml application deploy policy is invalid.");
+  }
+  return { applicationBranches: [...new Set([frontend, backend])], scopeBranches: { frontend, backend }, productionBranch };
+}
+
+function isSafeBranchName(branch) {
+  return typeof branch === "string" && branch.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch) && !branch.includes("..") && !branch.includes("//") && !branch.includes("@{") && !branch.endsWith(".") && !branch.endsWith("/") && !branch.split("/").some((segment) => segment.startsWith(".") || segment.endsWith(".lock"));
+}
+
 function gitInvocation(tokens) {
   if (tokens === null || !/^(?:git|git\.exe)$/i.test(tokens[0] ?? "")) return null;
   let index = 1;
@@ -609,7 +679,7 @@ function validatePatch(command) {
   }
 }
 
-const lifecycleExemptPathPattern = /(?:^|\/)(?:\.git|node_modules|dist|build|coverage|tmp|temp|\.cache)(?:\/|$)|^\.agents\/records\/|^\.zaip-aios\/local\//i;
+const lifecycleExemptPathPattern = /^(?:\.agents\/records|\.local)\//;
 const shellMutationPattern = /\b(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|git\s+apply|npm\s+version|pnpm\s+version)\b/i;
 
 function patchPaths(command) {
@@ -624,69 +694,73 @@ function requiresOrchestratorRun(event, command) {
     return paths.length === 0 || paths.some((path) => !lifecycleExemptPathPattern.test(path));
   }
   if (event.tool_name === "Edit" || event.tool_name === "Write") {
-    return !lifecycleExemptPathPattern.test(command.replaceAll("\\", "/"));
+    return !lifecycleExemptPathPattern.test(repositoryPath(resolve(event.cwd ?? repositoryRoot, command)));
   }
-  return shellMutationPattern.test(command);
-}
-
-async function runRecordPaths(root) {
-  const paths = [];
-  async function visit(directory) {
-    let entries;
-    try {
-      entries = await readdir(directory, { withFileTypes: true });
-    } catch {
-      return;
+  // Only single literal writes claim exemptions; compound commands remain gated.
+  const tokens = tokenizeLiteralCommand(command);
+  if (tokens && /^(?:Set-Content|Add-Content)$/i.test(tokens[0]) && !/[$%<>*?{}\[\]]/.test(command)) {
+    const options = new Map();
+    let valid = true;
+    for (let i = 1; i < tokens.length; i += 2) {
+      const flag = tokens[i].toLowerCase(), value = tokens[i + 1];
+      if (!["-literalpath", "-value", "-encoding"].includes(flag) || value === undefined || options.has(flag)) { valid = false; break; }
+      options.set(flag, value);
     }
-    for (const entry of entries) {
-      const path = resolve(directory, entry.name);
-      if (entry.isDirectory()) await visit(path);
-      else if (entry.isFile() && entry.name.endsWith(".jsonl")) paths.push(path);
+    if (valid && options.has("-literalpath") && options.has("-value")) {
+      const path = repositoryPath(resolve(event.cwd ?? repositoryRoot, options.get("-literalpath")));
+      if (lifecycleExemptPathPattern.test(path)) return false;
     }
   }
-  await visit(root);
-  return paths;
+  return shellMutationPattern.test(command);
 }
 
-async function hasCurrentTaskOrchestratorRun() {
-  const threadId = process.env.CODEX_THREAD_ID;
-  const turnId = process.env.CODEX_TURN_ID;
-  if (!threadId || !turnId) return false;
-  const root = resolve(repositoryRoot, ".agents", "records", "runs");
-  for (const path of await runRecordPaths(root)) {
-    let records;
-    try {
-      records = (await readFile(path, "utf8"))
-        .split(/\r?\n/)
-        .filter(Boolean)
-        .map((line) => JSON.parse(line));
-    } catch {
-      continue;
-    }
-    const started = records.find((record) => record.type === "run.started");
-    if (
-      started?.client_thread_id !== threadId ||
-      started?.client_turn_id !== turnId ||
-      started?.phase !== "execution" ||
-      typeof started?.task_id !== "string"
-    ) {
-      continue;
+async function boundedCanonicalText(path, maximumBytes) {
+  const info = await lstat(path);
+  if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) throw new Error("Unsafe Run lookup file");
+  const physical = await realpath(path);
+  if (!isWithinRepository(physical) || physical.toLowerCase() !== resolve(path).toLowerCase()) throw new Error("Run lookup must not follow links");
+  return readFile(path, "utf8");
+}
+
+async function hasCurrentTaskOrchestratorRun(event) {
+  const threadId = event.session_id ?? process.env.CODEX_THREAD_ID;
+  const turnId = event.turn_id ?? process.env.CODEX_TURN_ID;
+  if (typeof threadId !== "string" || typeof turnId !== "string" || !threadId || !turnId) return false;
+  if ((event.session_id && process.env.CODEX_THREAD_ID && event.session_id !== process.env.CODEX_THREAD_ID) ||
+      (event.turn_id && process.env.CODEX_TURN_ID && event.turn_id !== process.env.CODEX_TURN_ID)) return false;
+  try {
+    // Same identity contract as persistCodexTelemetryCorrelation; no history scan.
+    const digest = createHash("sha256").update(JSON.stringify(["codex", threadId, turnId, null, null])).digest("hex");
+    const correlation = JSON.parse(await boundedCanonicalText(resolve(repositoryRoot, ".local/codex-telemetry-spool/v1/correlations", digest + ".json"), 65536));
+    const id = correlation.run_id;
+    const dated = typeof id === "string" ? /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{4}$/.exec(id) : null;
+    if (!dated || correlation.schema_version !== 1 || correlation.thread_id !== threadId || correlation.turn_id !== turnId || correlation.agent_path !== null) return false;
+    const candidates = [
+      ".agents/records/runs/" + dated[1] + "/" + dated[2] + "/" + id + ".jsonl",
+      ".agents/records/runs/" + dated[1] + "/" + dated[2] + "/" + dated[3] + "/" + id + ".jsonl",
+      ".agents/data/runs/" + dated[1] + "/" + dated[2] + "/" + dated[3] + "/" + id + ".jsonl",
+      ".local/runs/" + dated[1] + "/" + dated[2] + "/" + id + ".jsonl",
+    ];
+    let selected = null;
+    for (const candidate of candidates) {
+      try {
+        const source = await boundedCanonicalText(resolve(repositoryRoot, candidate), 8388608);
+        if (selected !== null) return false; // Ambiguous migration state is never authority.
+        selected = source;
+      } catch (error) { if (error.code !== "ENOENT") return false; }
     }
-    const role =
-      started.run_role === "owner"
-        ? "orchestrator"
-        : started.run_role === "contributor"
-          ? "subagent"
-          : (started.run_role ?? (started.parent_run_id ? "subagent" : "orchestrator"));
-    if (
-      role === "orchestrator" &&
-      started.parent_run_id === null &&
-      started.entrypoint === "task" &&
-      !records.some((record) => record.type === "run.finished")
-    )
-      return true;
-  }
-  return false;
+    if (selected === null || !selected.endsWith("\n")) return false;
+    const records = selected.split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+    const started = records[0];
+    if (records.some((record, i) => record.run_id !== id || record.sequence !== i + 1 || record.schema_version !== 2)) return false;
+    return started?.type === "run.started" && started.client_thread_id === threadId && started.client_turn_id === turnId &&
+      ["codex", "codex-desktop"].includes(started.client) && started.phase === "execution" &&
+      typeof started.task_id === "string" && started.task_id.startsWith("TASK-") &&
+      typeof started.execution_id === "string" && started.execution_id.startsWith("EXEC-") &&
+      started.agent === "agent-orchestrator" && started.run_role === "orchestrator" && started.parent_run_id === null && started.entrypoint === "task" &&
+      correlation.task_id === started.task_id && correlation.execution_id === started.execution_id &&
+      !records.some(record => record.type === "run.finished");
+  } catch { return false; }
 }
 
 let raw = "";
@@ -706,15 +780,15 @@ if (typeof event.cwd !== "string" || !isWithinRepository(event.cwd)) {
 const command = event?.tool_input?.command;
 if (typeof command !== "string") deny("A matched tool call without a command was rejected.");
 
-if (requiresOrchestratorRun(event, command) && !(await hasCurrentTaskOrchestratorRun())) {
-  deny("Persistent mutation requires an active execution Run owning a Task for this Codex turn.");
+if (requiresOrchestratorRun(event, command) && !(await hasCurrentTaskOrchestratorRun(event))) {
+  deny("Persistent mutation requires the exact active Task Run and its verified thread/turn correlation. Capture or reconcile this turn before retrying; no global Task fallback is allowed.");
 }
 
 if (event.tool_name === "apply_patch") validatePatch(command);
 else {
   validateExplicitFilesystemReferences(command, event.cwd);
   validateInlineExecution(command);
-  validateGitPublication(command);
+  await validateGitPublication(command);
   await validateCloudRunner(command);
   validateDirectCloudProviderMutation(command);
   validateExplicitNetwork(command);

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqtB5C,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+xB5C,CAAC"}

package/dist/services/codex-rules.d.ts

@@ -1,3 +1,3 @@
-export declare const CODEX_GITHUB_DEPLOY_RULES = "# GitHub-only publication commands that may cross the workspace sandbox without prompting.\n# Only an explicit deploy request activates the ZAIP deploy skill. Its bounded flow may reconcile\n# the branch resolved fresh from project.yaml deploy.branch and form evidenced functional commits\n# with explicit pathspecs. The fallback is main only when that file or key is absent.\n\nprefix_rule(\n    pattern = [\"node\", \".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs\"],\n    decision = \"allow\",\n    justification = \"Run the sanitized, repository-owned folder-scoped SSH preflight.\",\n    match = [\"node .agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs --repository . --remote origin\"],\n    not_match = [\"node scripts/other.mjs\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"fetch\"],\n    decision = \"allow\",\n    justification = \"Fetch the configured GitHub remote once before checking the configured deploy branch.\",\n    match = [\"git fetch origin\"],\n    not_match = [\"git pull origin\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"add\", \"--\"],\n    decision = \"allow\",\n    justification = \"Stage only an evidenced functional group with explicit pathspecs during an authorized deploy.\",\n    match = [\"git add -- README.md\", \"git add -- packages/core/src/example.ts\"],\n    not_match = [\"git add -A\", \"git add --all\", \"git add .\", \"git add -u\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"commit\", \"-m\"],\n    decision = \"allow\",\n    justification = \"Create an evidenced functional commit without rewriting history during an authorized deploy.\",\n    match = ['git commit -m \"[CODEX] Atualizar contrato de deploy\"'],\n    not_match = [\"git commit --amend -m repair\", \"git commit --no-verify -m repair\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"stash\", \"push\", \"--include-untracked\"],\n    decision = \"allow\",\n    justification = \"Preserve the selected deploy diff without dropping history.\",\n    match = [\"git stash push --include-untracked -m deploy-preserve\"],\n    not_match = [\"git stash drop\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"stash\", \"apply\"],\n    decision = \"allow\",\n    justification = \"Reapply the preserved selected deploy diff.\",\n    match = [\"git stash apply\"],\n    not_match = [\"git stash drop\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"push\"],\n    decision = \"allow\",\n    justification = \"Publish only deploy.branch with an explicit refspec after ZAIP preflight.\",\n    match = [\"git push origin HEAD:refs/heads/main\"],\n    not_match = [\"git pull\", \"ssh -i key git@github.com\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"ls-remote\"],\n    decision = \"allow\",\n    justification = \"Verify GitHub connectivity and the exact remote branch hash.\",\n    match = [\"git ls-remote origin refs/heads/main\"],\n    not_match = [\"git remote set-url origin git@github.com:other/repo.git\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"auth\", \"status\"],\n    decision = \"allow\",\n    justification = \"Inspect GitHub CLI authentication without changing credentials.\",\n    match = [\"gh auth status\"],\n    not_match = [\"gh auth login\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"run\", [\"list\", \"view\", \"watch\"]],\n    decision = \"allow\",\n    justification = \"Observe GitHub Actions checks for the just-pushed commit.\",\n    match = [\"gh run list\", \"gh run view 123\", \"gh run watch 123\"],\n    not_match = [\"gh run cancel 123\", \"gh run delete 123\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"pr\", [\"view\", \"checks\"]],\n    decision = \"allow\",\n    justification = \"Read pull-request metadata and required checks for the current repository.\",\n    match = [\"gh pr view\", \"gh pr checks\"],\n    not_match = [\"gh pr create\", \"gh pr merge\"],\n)\n";
+export declare const CODEX_GITHUB_DEPLOY_RULES = "# GitHub-only publication commands that may cross the workspace sandbox without prompting.\n# Only an explicit deploy request activates the ZAIP deploy skill. Its bounded flow may reconcile\n# the branch resolved fresh from project.yaml deploy.branch and form evidenced functional commits\n# with explicit pathspecs. The validation fallback is beta; production defaults to main and is human-promoted.\n\nprefix_rule(\n    pattern = [\"node\", \".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs\"],\n    decision = \"allow\",\n    justification = \"Run the sanitized, repository-owned folder-scoped SSH preflight.\",\n    match = [\"node .agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs --repository . --remote origin\"],\n    not_match = [\"node scripts/other.mjs\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"fetch\"],\n    decision = \"allow\",\n    justification = \"Fetch the configured GitHub remote once before checking the configured deploy branch.\",\n    match = [\"git fetch origin\"],\n    not_match = [\"git pull origin\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"add\", \"--\"],\n    decision = \"allow\",\n    justification = \"Stage only an evidenced functional group with explicit pathspecs during an authorized deploy.\",\n    match = [\"git add -- README.md\", \"git add -- packages/core/src/example.ts\"],\n    not_match = [\"git add -A\", \"git add --all\", \"git add .\", \"git add -u\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"commit\", \"-m\"],\n    decision = \"allow\",\n    justification = \"Create an evidenced functional commit without rewriting history during an authorized deploy.\",\n    match = ['git commit -m \"[CODEX] Atualizar contrato de deploy\"'],\n    not_match = [\"git commit --amend -m repair\", \"git commit --no-verify -m repair\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"stash\", \"push\", \"--include-untracked\"],\n    decision = \"allow\",\n    justification = \"Preserve the selected deploy diff without dropping history.\",\n    match = [\"git stash push --include-untracked -m deploy-preserve\"],\n    not_match = [\"git stash drop\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"stash\", \"apply\"],\n    decision = \"allow\",\n    justification = \"Reapply the preserved selected deploy diff.\",\n    match = [\"git stash apply\"],\n    not_match = [\"git stash drop\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"push\"],\n    decision = \"allow\",\n    justification = \"Publish only deploy.branch with an explicit refspec after ZAIP preflight.\",\n    match = [\"git push origin HEAD:refs/heads/beta\"],\n    not_match = [\"git pull\", \"ssh -i key git@github.com\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"ls-remote\"],\n    decision = \"allow\",\n    justification = \"Verify GitHub connectivity and the exact remote branch hash.\",\n    match = [\"git ls-remote origin refs/heads/beta\"],\n    not_match = [\"git remote set-url origin git@github.com:other/repo.git\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"auth\", \"status\"],\n    decision = \"allow\",\n    justification = \"Inspect GitHub CLI authentication without changing credentials.\",\n    match = [\"gh auth status\"],\n    not_match = [\"gh auth login\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"run\", [\"list\", \"view\", \"watch\"]],\n    decision = \"allow\",\n    justification = \"Observe GitHub Actions checks for the just-pushed commit.\",\n    match = [\"gh run list\", \"gh run view 123\", \"gh run watch 123\"],\n    not_match = [\"gh run cancel 123\", \"gh run delete 123\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"pr\", [\"view\", \"checks\"]],\n    decision = \"allow\",\n    justification = \"Read pull-request metadata and required checks for the current repository.\",\n    match = [\"gh pr view\", \"gh pr checks\"],\n    not_match = [\"gh pr create\", \"gh pr merge\"],\n)\n";
 export declare const CODEX_SECURITY_RULES = "# Fail-closed defense in depth for commands that must never prompt or execute.\n# Native permission profiles, repository instructions, and these forbidden rules form the active boundary.\n\nprefix_rule(\n    pattern = [\"git\", [\"clean\", \"reset\", \"restore\"]],\n    decision = \"forbidden\",\n    justification = \"Use non-destructive Git inspection and an explicit file-level patch instead.\",\n    match = [\"git reset --hard\", \"git clean -fd\", \"git restore README.md\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", [\"-c\", \"--config\", \"--config-env\", \"--git-dir\", \"--work-tree\", \"--namespace\"]],\n    decision = \"forbidden\",\n    justification = \"Git configuration and repository-routing overrides can bypass the managed safety hook.\",\n    match = [\"git -c core.hooksPath=/tmp/empty commit -m bypass\", \"git --config core.hooksPath=/tmp/empty commit -m bypass\"],\n)\n\nprefix_rule(\n    pattern = [[\"reg\", \"reg.exe\", \"schtasks\", \"schtasks.exe\", \"sc\", \"sc.exe\", \"diskpart\", \"format\", \"bcdedit\", \"fsutil\", \"takeown\", \"icacls\"]],\n    decision = \"forbidden\",\n    justification = \"Operating-system persistence, disk, service, ownership, and ACL changes are outside repository scope.\",\n    match = [\"reg add HKCU\\Software\\Example\", \"schtasks /create /tn example\", \"diskpart\"],\n)\n\nprefix_rule(\n    pattern = [[\"runas\", \"sudo\", \"gsudo\"]],\n    decision = \"forbidden\",\n    justification = \"Privilege escalation is never allowed from ZAIP repository work.\",\n    match = [\"runas /user:Administrator cmd\", \"sudo rm -rf /\"],\n)\n\nprefix_rule(\n    pattern = [[\"winget\", \"choco\", \"scoop\"]],\n    decision = \"forbidden\",\n    justification = \"System package management is outside repository scope; use project-local dependencies.\",\n    match = [\"winget install Git.Git\", \"choco upgrade nodejs\", \"scoop install jq\"],\n)\n\nprefix_rule(\n    pattern = [[\"ssh\", \"scp\", \"sftp\", \"rsync\", \"ftp\", \"telnet\", \"nc\", \"ncat\"]],\n    decision = \"forbidden\",\n    justification = \"Use the repository-owned GitHub deploy preflight and Git commands instead of direct remote clients.\",\n    match = [\"ssh host\", \"scp file host:/tmp\", \"nc -l 4444\"],\n)\n";
 //# sourceMappingURL=codex-rules.d.ts.map

package/dist/services/codex-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-rules.d.ts","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,myHA4FrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,otEA4ChC,CAAC"}
+{"version":3,"file":"codex-rules.d.ts","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,4zHA4FrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,otEA4ChC,CAAC"}

package/dist/services/codex-rules.js

@@ -1,7 +1,7 @@
 export const CODEX_GITHUB_DEPLOY_RULES = `# GitHub-only publication commands that may cross the workspace sandbox without prompting.
 # Only an explicit deploy request activates the ZAIP deploy skill. Its bounded flow may reconcile
 # the branch resolved fresh from project.yaml deploy.branch and form evidenced functional commits
-# with explicit pathspecs. The fallback is main only when that file or key is absent.
+# with explicit pathspecs. The validation fallback is beta; production defaults to main and is human-promoted.
 
 prefix_rule(
     pattern = ["node", ".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs"],
@@ -55,7 +55,7 @@ prefix_rule(
     pattern = ["git", "push"],
     decision = "allow",
     justification = "Publish only deploy.branch with an explicit refspec after ZAIP preflight.",
-    match = ["git push origin HEAD:refs/heads/main"],
+    match = ["git push origin HEAD:refs/heads/beta"],
     not_match = ["git pull", "ssh -i key git@github.com"],
 )
 
@@ -63,7 +63,7 @@ prefix_rule(
     pattern = ["git", "ls-remote"],
     decision = "allow",
     justification = "Verify GitHub connectivity and the exact remote branch hash.",
-    match = ["git ls-remote origin refs/heads/main"],
+    match = ["git ls-remote origin refs/heads/beta"],
     not_match = ["git remote set-url origin git@github.com:other/repo.git"],
 )