@zaip-ai/cli 2.2.0 → 3.0.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/github-deploy-contract.test.mjs

@@ -17,7 +17,7 @@ test("explicit Git publication verbs select the guarded deploy skill", async ()
   assert.doesNotMatch(skill, /standing automatic deployment|activate it automatically/);
   assert.match(openai, /\$zaip-skill-github-deploy/);
   assert.match(openai, /fa.a deploy/);
-  assert.match(core, /deploy.*seleciona/);
+  assert.match(core, /seleciona/);
 });
 
 test("deploy guidance preserves the canonical Task subject and Git-only boundary", async () => {
@@ -28,7 +28,7 @@ test("deploy guidance preserves the canonical Task subject and Git-only boundary
   assert.ok(skill.includes("[CODEX|CLAUDE] [P:XXXX] [S:XXXX] [T:XXXX] <Task title>"));
   assert.match(skill, /exclusively `CODEX` or `CLAUDE`; `AUTO` is not part/);
   assert.match(skill, /Git-only publication/);
-  assert.match(workflow, /formar commits funcionais apenas do diff pretendido\/evidenciado/);
+  assert.match(workflow, /commitar o diff evidenciado com pathspecs explícitos/);
 });
 
 test("faça deploy authorizes the complete selected worktree with safety gates", async () => {
@@ -51,3 +51,26 @@ test("deploy permission and reconciliation remain explicit and recoverable", asy
   assert.match(skill, /Restore with `git stash apply`/);
   assert.match(openai, /worktree selecionado inteiro como escopo autorizado/);
 });
+
+test("workflow retains the explicit publication routing contract", async () => {
+  const workflow = await readFile(resolve(root, "rules", "workflow.md"), "utf8");
+  assert.match(workflow, /deploy\|push\|publicar.*autoriza.*\$zaip-skill-github-deploy/);
+});
+
+test("release guidance requires reviewed categorized notes and published-body readback", async () => {
+  const [skill, identity, notes, validator] = await Promise.all([
+    readFile(resolve(skillRoot, "SKILL.md"), "utf8"),
+    readFile(resolve(skillRoot, "references", "release-identity.md"), "utf8"),
+    readFile(resolve(skillRoot, "references", "release-notes.md"), "utf8"),
+    readFile(resolve(skillRoot, "scripts", "validate-release-notes.mjs"), "utf8"),
+  ]);
+  assert.match(skill, /Never use `--generate-notes`/);
+  assert.match(identity, /--notes-file <reviewed-notes\.md>/);
+  assert.match(identity, /--notes-file <reviewed-notes\.md>.*Never use `--generate-notes`/);
+  assert.match(notes, /exact previous Release tag/);
+  assert.match(notes, /Novidades \(feat\)/);
+  assert.match(notes, /Read the release back after creation/);
+  assert.match(validator, /compare-only/);
+  assert.match(validator, /exactly cover the changed Git range/);
+  assert.match(validator, /immutable 40-character candidate SHA/);
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/github-readiness-api.test.mjs

@@ -0,0 +1,134 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { createServer } from "node:http";
+import { resolve } from "node:path";
+import test from "node:test";
+
+const script = resolve(import.meta.dirname, "github-readiness.mjs"),
+  sha = "a".repeat(40),
+  repo = "owner/repo",
+  path = ".github/workflows/zaip-github-release.yml";
+async function invoke(runs, jobs, checks = ["unit"], branch) {
+  const server = createServer((req, res) => {
+    const url = new URL(req.url, "http://x"),
+      page = Number(url.searchParams.get("page") ?? 1);
+    let body;
+    if (url.pathname.endsWith("/actions/runs")) body = { workflow_runs: page === 1 ? runs : [] };
+    else if (url.pathname.includes("/jobs"))
+      body = { jobs: page === 1 ? jobs.slice(0, 100) : jobs.slice(100) };
+    else body = {};
+    res.setHeader("content-type", "application/json");
+    res.end(JSON.stringify(body));
+  });
+  await new Promise((ok) => server.listen(0, "127.0.0.1", ok));
+  try {
+    const port = server.address().port;
+    const out = await new Promise((done, reject) => {
+      const child = spawn(
+        process.execPath,
+        [
+          script,
+          "--sha",
+          sha,
+          "--repository",
+          repo,
+          "--checks-json",
+          JSON.stringify(checks),
+          ...(branch ? ["--branch", branch] : []),
+          "--api-url",
+          `http://127.0.0.1:${port}`,
+        ],
+        { env: { ...process.env, GITHUB_TOKEN: "test" }, stdio: ["ignore", "pipe", "pipe"] },
+      );
+      let stdout = "",
+        stderr = "";
+      child.stdout.on("data", (x) => (stdout += x));
+      child.stderr.on("data", (x) => (stderr += x));
+      child.once("error", reject);
+      child.once("close", (status) => done({ status, stdout, stderr }));
+    });
+    return { status: out.status, json: JSON.parse(out.stdout) };
+  } finally {
+    await new Promise((ok) => server.close(ok));
+  }
+}
+const run = (id, attempt, conclusion = "success", overrides = {}) => ({
+  id,
+  run_attempt: attempt,
+  created_at: `2026-09-07T00:0${id}:00Z`,
+  head_sha: sha,
+  head_repository: { full_name: repo },
+  path,
+  status: "completed",
+  conclusion,
+  ...overrides,
+});
+test("blocks latest failed or pending rerun even if an older run passed", async () => {
+  for (const latest of [
+    run(2, 2, "failure"),
+    run(2, 2, null, { status: "in_progress", conclusion: null }),
+  ]) {
+    const out = await invoke(
+      [run(1, 1), latest],
+      [{ name: "unit", status: "completed", conclusion: "success" }],
+    );
+    assert.equal(out.status, 2);
+    assert.equal(out.json.reason, "latest_expected_run_not_success");
+  }
+});
+test("rejects foreign origin and wrong workflow path", async () => {
+  for (const invalid of [
+    run(2, 2, "success", { head_repository: { full_name: "evil/repo" } }),
+    run(2, 2, "success", { path: ".github/workflows/other.yml" }),
+  ]) {
+    const out = await invoke(
+      [invalid],
+      [{ name: "unit", status: "completed", conclusion: "success" }],
+    );
+    assert.equal(out.status, 2);
+    assert.equal(out.json.reason, "same_sha_expected_workflow_missing");
+  }
+});
+
+test("a recently rerun older workflow cannot hide behind a newer successful run", async () => {
+  for (const status of ["completed", "in_progress"]) {
+    const latestAttempt = run(1, 2, status === "completed" ? "failure" : null, {
+      status,
+      updated_at: "2026-09-07T00:03:00Z",
+    });
+    const out = await invoke(
+      [latestAttempt, run(2, 1)],
+      [{ name: "unit", status: "completed", conclusion: "success" }],
+    );
+    assert.equal(out.status, 2);
+    assert.equal(out.json.run_id, 1);
+    assert.equal(out.json.run_attempt, 2);
+    assert.equal(out.json.reason, "latest_expected_run_not_success");
+  }
+});
+test("paginates more than one hundred jobs for the selected run attempt", async () => {
+  const jobs = Array.from({ length: 100 }, (_, i) => ({
+    name: `other-${i}`,
+    status: "completed",
+    conclusion: "success",
+  }));
+  jobs.push({ name: "unit", status: "completed", conclusion: "success" });
+  const out = await invoke([run(2, 2)], jobs);
+  assert.equal(out.status, 0);
+  assert.equal(out.json.ready, true);
+});
+
+test("an unrelated branch run cannot mask the required release branch qualification", async () => {
+  const out = await invoke(
+    [
+      run(1, 1, "success", { head_branch: "beta" }),
+      run(2, 1, "success", { head_branch: "feature" }),
+    ],
+    [{ name: "unit", status: "completed", conclusion: "success" }],
+    ["unit"],
+    "beta",
+  );
+  assert.equal(out.status, 0);
+  assert.equal(out.json.ready, true);
+  assert.equal(out.json.run_id, 1);
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/github-readiness.mjs

@@ -0,0 +1,98 @@
+import { parseArgs } from "node:util";
+
+const { values } = parseArgs({
+  options: {
+    sha: { type: "string" },
+    repository: { type: "string" },
+    branch: { type: "string" },
+    "checks-json": { type: "string" },
+    "api-url": { type: "string", default: process.env.GITHUB_API_URL ?? "https://api.github.com" },
+    token: { type: "string", default: process.env.GITHUB_TOKEN },
+    "workflow-path": { type: "string", default: ".github/workflows/zaip-github-release.yml" },
+  },
+  strict: true,
+});
+const sha = values.sha ?? "",
+  repository = values.repository ?? "";
+if (!/^[a-f0-9]{40}$/i.test(sha)) throw Error("--sha must be an exact 40 character SHA");
+if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository))
+  throw Error("--repository must be owner/repository");
+let required;
+try {
+  required = JSON.parse(values["checks-json"] ?? "[]");
+} catch {
+  throw Error("--checks-json must be JSON");
+}
+if (!Array.isArray(required) || !required.every((x) => typeof x === "string" && x))
+  throw Error("--checks-json must be a JSON array of nonempty check names");
+const result = {
+  schemaVersion: 1,
+  repository,
+  sha,
+  required_checks: required,
+  ready: false,
+  reason: "required_checks_missing",
+  run_id: null,
+  run_attempt: null,
+};
+if (!required.length) {
+  console.log(JSON.stringify(result));
+  process.exitCode = 2;
+} else {
+  if (!values.token) throw Error("GITHUB_TOKEN is required to query readiness");
+  const api = values["api-url"].replace(/\/$/, "");
+  const headers = {
+    accept: "application/vnd.github+json",
+    authorization: `Bearer ${values.token}`,
+  };
+  const get = async (path) => {
+    const r = await fetch(`${api}${path}`, { headers });
+    if (!r.ok) throw Error("GitHub readiness query failed");
+    return r.json();
+  };
+  const pages = async (path) => {
+    let all = [];
+    for (let page = 1; ; page++) {
+      const body = await get(`${path}${path.includes("?") ? "&" : "?"}per_page=100&page=${page}`);
+      const items = body.workflow_runs ?? body.jobs ?? [];
+      all = all.concat(items);
+      if (items.length < 100) return all;
+    }
+  };
+  const runs = await pages(`/repos/${repository}/actions/runs?head_sha=${sha}`);
+  const expected = runs
+    .filter(
+      (r) =>
+        r.head_repository?.full_name === repository &&
+        r.head_sha === sha &&
+        (!values.branch || r.head_branch === values.branch) &&
+        r.path === values["workflow-path"],
+    )
+    .sort(
+      (a, b) =>
+        Date.parse(b.updated_at ?? b.created_at) - Date.parse(a.updated_at ?? a.created_at) ||
+        b.id - a.id,
+    )[0];
+  if (!expected) {
+    result.reason = "same_sha_expected_workflow_missing";
+  } else {
+    result.run_id = expected.id;
+    result.run_attempt = expected.run_attempt;
+    if (expected.status !== "completed" || expected.conclusion !== "success") {
+      result.reason = "latest_expected_run_not_success";
+    } else {
+      const jobs = await pages(
+        `/repos/${repository}/actions/runs/${expected.id}/attempts/${expected.run_attempt}/jobs`,
+      );
+      const matched = new Map(jobs.map((j) => [j.name, j]));
+      const good = required.every(
+        (name) =>
+          matched.get(name)?.status === "completed" && matched.get(name)?.conclusion === "success",
+      );
+      result.ready = good;
+      result.reason = good ? "ready" : "required_job_not_success";
+    }
+  }
+  console.log(JSON.stringify(result));
+  if (!result.ready) process.exitCode = 2;
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/github-readiness.test.mjs

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import test from "node:test";
+
+const script = resolve(import.meta.dirname, "github-readiness.mjs");
+test("defaults to not ready without configured checks", () => {
+  const output = spawnSync(
+    process.execPath,
+    [script, "--sha", "a".repeat(40), "--repository", "zaip-ai/zaip-aios", "--checks-json", "[]"],
+    { encoding: "utf8" },
+  );
+  assert.equal(output.status, 2);
+  assert.equal(JSON.parse(output.stdout).ready, false);
+  assert.equal(JSON.parse(output.stdout).reason, "required_checks_missing");
+});
+test("rejects an invalid repository before querying GitHub", () => {
+  const output = spawnSync(
+    process.execPath,
+    [script, "--sha", "a".repeat(40), "--repository", "foreign", "--checks-json", '["unit"]'],
+    { encoding: "utf8" },
+  );
+  assert.notEqual(output.status, 0);
+  assert.match(output.stderr, /owner\/repository/);
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/install-github-readiness-workflow.mjs

@@ -0,0 +1,159 @@
+import { lstat, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, relative, resolve } from "node:path";
+import { parseArgs } from "node:util";
+
+const { values } = parseArgs({
+  options: {
+    repository: { type: "string" },
+    "checks-json": { type: "string" },
+    "commands-json": { type: "string" },
+    "package-manager": { type: "string", default: "auto" },
+    "node-version": { type: "string", default: "22" },
+    "pnpm-version": { type: "string" },
+    output: { type: "string" },
+  },
+  strict: true,
+});
+if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(values.repository ?? "")) {
+  throw new Error("--repository must be owner/repository");
+}
+const checks = stringArray("checks-json");
+const commands = stringArray("commands-json");
+if (checks.length !== 1 || checks[0].length > 100 || /[\r\n]|\$\{\{/.test(checks[0])) {
+  throw new Error(
+    "The generated workflow uses one aggregate check; supply one check name. All commands run in that job.",
+  );
+}
+if (!/^\d+(?:\.\d+){0,2}$/.test(values["node-version"])) {
+  throw new Error("--node-version must be a numeric Node version");
+}
+const root = resolve(process.cwd());
+const workflowDirectory = resolve(root, ".github/workflows");
+const output = resolve(root, values.output ?? ".github/workflows/zaip-github-release.yml");
+if (dirname(output) !== workflowDirectory || !/\.ya?ml$/.test(output)) {
+  throw new Error(
+    "Workflow output must be a YAML file directly inside this project's .github/workflows",
+  );
+}
+for (const path of [root, resolve(root, ".github"), workflowDirectory]) {
+  const entry = await stat(path);
+  if (entry && (entry.isSymbolicLink() || !entry.isDirectory())) {
+    throw new Error("Refusing a symlinked or non-directory workflow parent");
+  }
+}
+const existing = await stat(output);
+if (existing && (existing.isSymbolicLink() || !existing.isFile())) {
+  throw new Error("Refusing a symlinked or non-file workflow target");
+}
+const npmLock = await stat(resolve(root, "package-lock.json"));
+const pnpmLock = await stat(resolve(root, "pnpm-lock.yaml"));
+let manager = values["package-manager"];
+if (manager === "auto") {
+  if (npmLock && pnpmLock)
+    throw new Error("Multiple lockfiles found; choose --package-manager explicitly");
+  manager = pnpmLock ? "pnpm" : npmLock ? "npm" : "none";
+  if (manager === "none" && (await stat(resolve(root, "package.json")))) {
+    throw new Error(
+      "Node projects need a lockfile; use --package-manager none only with explicit custom setup commands",
+    );
+  }
+}
+if (!["npm", "pnpm", "none"].includes(manager))
+  throw new Error("--package-manager must be auto, npm, pnpm or none");
+const lock = manager === "npm" ? npmLock : pnpmLock;
+if (manager !== "none" && (!lock?.isFile() || lock.isSymbolicLink())) {
+  throw new Error(
+    "The selected package manager needs a regular lockfile committed with the workflow",
+  );
+}
+const setup = [];
+if (manager === "pnpm") {
+  const metadata = JSON.parse(await readFile(resolve(root, "package.json"), "utf8"));
+  const pnpmVersion =
+    values["pnpm-version"] ??
+    /^pnpm@(\d+\.\d+\.\d+)(?:\+.*)?$/.exec(metadata.packageManager ?? "")?.[1];
+  if (!/^\d+\.\d+\.\d+$/.test(pnpmVersion ?? "")) {
+    throw new Error("Pin pnpm in package.json packageManager or pass --pnpm-version N.N.N");
+  }
+  setup.push(
+    "      - uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d",
+    "        with:",
+    "          version: " + JSON.stringify(pnpmVersion),
+  );
+}
+if (manager !== "none") {
+  setup.push(
+    "      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020",
+    "        with:",
+    "          node-version: " + JSON.stringify(values["node-version"]),
+    "          cache: " + manager,
+    "          cache-dependency-path: " +
+      (manager === "npm" ? "package-lock.json" : "pnpm-lock.yaml"),
+    "      - run: " + (manager === "npm" ? "npm ci" : "pnpm install --frozen-lockfile"),
+  );
+}
+const source = [
+  "# Generated by ZAIP GitHub-only setup; project-owned after creation.",
+  "name: ZAIP GitHub release readiness",
+  "on: [push, pull_request, workflow_dispatch]",
+  "concurrency:",
+  "  group: zaip-release-${{ github.ref }}",
+  "  cancel-in-progress: true",
+  "permissions:",
+  "  contents: read",
+  "jobs:",
+  "  validate:",
+  "    name: " + JSON.stringify(checks[0]),
+  "    runs-on: ubuntu-latest",
+  "    timeout-minutes: 20",
+  "    steps:",
+  "      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683",
+  "        with:",
+  "          persist-credentials: false",
+  ...setup,
+  ...commands.map((command) => "      - run: " + JSON.stringify(command)),
+  "",
+].join("\n");
+const identical = existing && (await readFile(output, "utf8")) === source;
+if (existing && !identical)
+  throw new Error(
+    "Refusing to overwrite an existing consumer workflow; review and adapt it explicitly",
+  );
+if (!identical) {
+  await mkdir(workflowDirectory, { recursive: true });
+  await writeFile(output, source, { flag: "wx" });
+}
+process.stdout.write(
+  JSON.stringify({
+    schemaVersion: 1,
+    changed: !identical,
+    output,
+    repository: values.repository,
+    workflow_path: relative(root, output).replaceAll("\\", "/"),
+    required_checks: checks,
+    package_manager: manager,
+  }) + "\n",
+);
+
+function stringArray(name) {
+  let parsed;
+  try {
+    parsed = JSON.parse(values[name] ?? "");
+  } catch {
+    throw new Error("--" + name + " must be JSON");
+  }
+  if (
+    !Array.isArray(parsed) ||
+    parsed.length === 0 ||
+    !parsed.every((item) => typeof item === "string" && item.trim())
+  ) {
+    throw new Error("--" + name + " must be a nonempty JSON string array");
+  }
+  return parsed;
+}
+async function stat(path) {
+  return lstat(path).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/install-github-readiness-workflow.test.mjs

@@ -0,0 +1,160 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import test from "node:test";
+import { parseDocument } from "yaml";
+
+const script = resolve(import.meta.dirname, "install-github-readiness-workflow.mjs");
+const workflow = ".github/workflows/zaip-github-release.yml";
+
+function invoke(root, extra = []) {
+  return spawnSync(
+    process.execPath,
+    [
+      script,
+      "--repository",
+      "owner/repo",
+      "--checks-json",
+      '["quality"]',
+      "--commands-json",
+      '["npm run lint","npm test"]',
+      ...extra,
+    ],
+    { cwd: root, encoding: "utf8", windowsHide: true },
+  );
+}
+async function fixture(run) {
+  const root = await mkdtemp(join(tmpdir(), "zaip-workflow-"));
+  try {
+    await run(root);
+  } finally {
+    assert.equal(dirname(resolve(root)), resolve(tmpdir()));
+    await rm(root, { recursive: true, force: true });
+  }
+}
+async function npmProject(root) {
+  await writeFile(join(root, "package.json"), JSON.stringify({ private: true }));
+  await writeFile(join(root, "package-lock.json"), "{}");
+}
+async function document(root) {
+  const source = await readFile(join(root, workflow), "utf8");
+  const parsed = parseDocument(source);
+  assert.equal(parsed.errors.length, 0);
+  return { source, data: parsed.toJS() };
+}
+
+test("creates runnable cached npm checks in one job without a circular readiness job", async () => {
+  await fixture(async (root) => {
+    await npmProject(root);
+    const result = invoke(root);
+    assert.equal(result.status, 0, result.stderr);
+    assert.deepEqual(JSON.parse(result.stdout).required_checks, ["quality"]);
+    const { data, source } = await document(root);
+    assert.deepEqual(Object.keys(data.jobs), ["validate"]);
+    assert.equal(data.jobs.validate.name, "quality");
+    assert.deepEqual(
+      data.jobs.validate.steps.filter((step) => step.run).map((step) => step.run),
+      ["npm ci", "npm run lint", "npm test"],
+    );
+    const setup = data.jobs.validate.steps.find((step) =>
+      step.uses?.startsWith("actions/setup-node@"),
+    );
+    assert.equal(setup.with.cache, "npm");
+    assert.equal(setup.with["cache-dependency-path"], "package-lock.json");
+    assert.equal(data.concurrency["cancel-in-progress"], true);
+    assert.deepEqual(data.permissions, { contents: "read" });
+    assert.doesNotMatch(source, /npm publish|--run-json|GITHUB_TOKEN/);
+    const again = invoke(root);
+    assert.equal(again.status, 0, again.stderr);
+    assert.equal(JSON.parse(again.stdout).changed, false);
+    assert.equal((await document(root)).source, source);
+  });
+});
+
+test("preserves a custom workflow and rejects a conflicting reconfiguration", async () => {
+  await fixture(async (root) => {
+    await npmProject(root);
+    await mkdir(join(root, ".github/workflows"), { recursive: true });
+    const original = "# project owned\n";
+    await writeFile(join(root, workflow), original);
+    const result = invoke(root);
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /Refusing to overwrite/);
+    assert.equal(await readFile(join(root, workflow), "utf8"), original);
+  });
+});
+
+test("uses pinned pnpm and the pnpm lockfile for setup and installation", async () => {
+  await fixture(async (root) => {
+    await writeFile(join(root, "package.json"), JSON.stringify({ packageManager: "pnpm@11.12.0" }));
+    await writeFile(join(root, "pnpm-lock.yaml"), "lockfileVersion: '9.0'\n");
+    const result = invoke(root, ["--commands-json", '["pnpm test"]']);
+    assert.equal(result.status, 0, result.stderr);
+    const { data } = await document(root);
+    const steps = data.jobs.validate.steps;
+    assert.equal(
+      steps.find((step) => step.uses?.startsWith("pnpm/action-setup@")).with.version,
+      "11.12.0",
+    );
+    assert.equal(
+      steps.find((step) => step.uses?.startsWith("actions/setup-node@")).with.cache,
+      "pnpm",
+    );
+    assert.deepEqual(
+      steps.filter((step) => step.run).map((step) => step.run),
+      ["pnpm install --frozen-lockfile", "pnpm test"],
+    );
+  });
+});
+
+test("supports projects without Node and rejects unconfigured or ambiguous Node setup", async () => {
+  await fixture(async (root) => {
+    const result = invoke(root, ["--commands-json", '["git diff --check"]']);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(JSON.parse(result.stdout).package_manager, "none");
+    assert.deepEqual(
+      (await document(root)).data.jobs.validate.steps
+        .filter((step) => step.run)
+        .map((step) => step.run),
+      ["git diff --check"],
+    );
+  });
+  await fixture(async (root) => {
+    await writeFile(join(root, "package.json"), "{}");
+    assert.match(invoke(root).stderr, /need a lockfile/);
+    await writeFile(join(root, "package-lock.json"), "{}");
+    await writeFile(join(root, "pnpm-lock.yaml"), "");
+    assert.match(invoke(root).stderr, /Multiple lockfiles/);
+  });
+});
+
+test("rejects invalid check mappings, blank commands and output outside the project", async () => {
+  await fixture(async (root) => {
+    for (const args of [
+      ["--checks-json", '["lint","unit"]'],
+      ["--commands-json", '[" "]'],
+      ["--output", "../escaped.yml"],
+    ])
+      assert.notEqual(invoke(root, args).status, 0);
+  });
+});
+
+test("refuses a symlinked ancestor before writing outside the project", async () => {
+  await fixture(async (root) => {
+    const outside = join(root, "external");
+    await mkdir(outside);
+    await symlink(
+      outside,
+      join(root, ".github"),
+      process.platform === "win32" ? "junction" : "dir",
+    );
+    const result = invoke(root);
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /symlinked/);
+    await assert.rejects(readFile(join(outside, "workflows/zaip-github-release.yml")), {
+      code: "ENOENT",
+    });
+  });
+});