@zaip-ai/cli 4.6.0 → 4.8.0

package/templates/.agents/runtime/checksums.sha256

@@ -1,11 +1,11 @@
 b146bd0c7c60b1ab43c4f71e0b1d2262c6df6da6f7053a0425f834ccb77a6b48  LICENSE
 bc02cba77e8d51e5c580f43668863dc868eda66f1ff663bfaa49fcf3ca16320e  THIRD_PARTY_NOTICES.md
-656cd3a27fe3b73475a1fc9becaf4a4d06d25b482904d8dab14429787a23657d  VERSION
-1b9ca0345ddf81e610cf6c3daa4a7e47bd3cf91a8c8736ced553d75d4b36bacf  bin/zaip.mjs
-8ef65e53d200e13b2ef54a75a7157f83ca8d0255b66441c54a14e740a6b7428f  manifest.json
+4938ef88cd76dd7f6297a3d1d0c57af9c8e420e9359e778f3fc3725a8781af0a  VERSION
+20260ddb4f0a306d1ef52bb67b0ad4eb5e6edbdf0af0c1db5e6084b101b15490  bin/zaip.mjs
+78f229de87d67490a9bbec827e21be6c3c01a19cc1ad26af9bca781e6a0f559b  manifest.json
 7f89219d7c567c82a51679ad136d84364bded7ac659492537e125d33b1d58a7a  migrations/001-layout-v1.json
 5f8c48b286d0b44d8fbb57a9a5d009a8a500439aa3148d750b8f193f72995c9f  migrations/002-layout-v2.json
 33c98d5dc506bba4b8b3ca612706d9eb05ef13d9e03c33a4f9e65ca7804be9d1  pnpm-lock.sha256
-4e899971412e69503e536252c32c3dbc7dbdd7bc2f27c5ff0197a29d3b73f5f4  provenance.json
-44e836088ebfb3d5a8c7ba26379ec5804f66fca31729bcf4f742f76f235ed198  sbom.cdx.json
+d7459fa9108cc5cf7974c46daba9b02d1fa36a6f059c0eefcc8a5ce6ba2a4184  provenance.json
+5dcd790db0a223a246bc742f6b96bb13e7f93be9495267b0f49de603f770d80f  sbom.cdx.json
 b3ffedf9e146be802a15b4009f33e031dec3071ca1525e12c67606fd964a3067  schemas/contracts.schema.json

package/templates/.agents/runtime/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "zaip-aios",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "node": ">=22",
   "files": [
     "LICENSE",

package/templates/.agents/runtime/provenance.json

@@ -2,10 +2,10 @@
   "schema_version": 1,
   "statement_type": "self_reported_build_integrity",
   "authenticity": "unverified",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "source_origin": "zaip-aios:local-build",
   "lockfile_sha256": "03d08e5bbb198d74014ea4a806fcdeb350db23ec2bf0c2886a2265066555d418",
-  "sbom_sha256": "44e836088ebfb3d5a8c7ba26379ec5804f66fca31729bcf4f742f76f235ed198",
-  "runtime_sha256": "69f4abae0878976691b791b4de9e5e1e5dedfa465417cf17a52c27cb4c62f33f",
-  "statement_sha256": "baa0bc2195c9c65c50bd8d857d9fa8ee05785467e49fce2718e3e2e811b3a903"
+  "sbom_sha256": "5dcd790db0a223a246bc742f6b96bb13e7f93be9495267b0f49de603f770d80f",
+  "runtime_sha256": "adb2086da9e7f21c2f9041c50a60ab5f9780e38bc7b51f7f7f3d7b00c07adddf",
+  "statement_sha256": "5b480f8fb89b356e35dd20faa6cdff0304e276856bad0049f1466d22ddb538ac"
 }

package/templates/.agents/runtime/sbom.cdx.json

@@ -6,7 +6,7 @@
     "component": {
       "type": "application",
       "name": "zaip-aios",
-      "version": "4.6.0"
+      "version": "4.8.0"
     }
   },
   "components": [

package/templates/.agents/skills/zaip-skill-github-deploy/SKILL.md

@@ -57,4 +57,6 @@ Give a brief chat result with the delivered mode, branch/SHA, Release link when
 
 For the verified framework builder, release delivery requires `.agents/config/release-cycle.json` frozen at the version being released, a clean candidate SHA, remote `main` as its ancestor, and no stale branch/worktree. Every owner SPEC DAG predecessor must be completed. The sole open exception is the critical release-only Task coordinator delegated from the owner SPEC/Execution/macro Run; its exact lineage, predecessor states and candidate records are authenticated at freeze, audit and advance. Other current-release Task/PRD/SPEC work blocks. `scripts/local-release-deploy.mjs` runs fixed local checks at the exact SHA without creating a remote candidate branch. It then pushes only `main` and waits for the exact successful `main` push run of `pre-main-candidate.yml` before publishing a Release. A critical framework commit follows the same branch-free sequence through `guarded-commits.mjs`. Failed local checks block the push; failed or unavailable remote CI blocks Release publication and requires repair on `main`.
 
+When the same authorized direct Task root implements the product repair and release, the explicit integrated coordinator mode in `$zaip-skill-release-qualification` can freeze while that Task and Run are active. It keeps the clean exact-SHA, only-main, no-other-work, independent validation and publication gates. Record this selection in the frozen cycle; it does not create a second Task or client turn.
+
 After a published release, use `node scripts/release-cycle-gate.mjs advance --repository ROOT --from N.N --to NEXT --sha CANDIDATE --ci-run-id RUN_ID` while the release coordinator remains active. This checks remote main, tag, published Release, exact successful CI, local branch/worktree cleanup and owner lineage before recording the transition. Bind Evidence to that immutable candidate, close Task and SPEC, then make one metadata-only closure commit. `node scripts/local-release-deploy.mjs push-closure --repository ROOT --expected-repository zaip-ai/zaip-aios --branch main --version N.N --published-sha CANDIDATE --closure-sha CLOSURE --expected-remote-sha CANDIDATE --metadata-paths-file REVIEWED_JSON` verifies tag, public Release, npm, the candidate's recorded exact CI run, one descendant metadata commit, exact remote main and only-main before pushing; it waits for CI on the closure SHA. The reviewed JSON is an array of exact changed metadata paths, including causal telemetry when present. `--metadata-paths EXACT,PATHS` is available for a short list. Do not retag or treat local lifecycle closure as remotely published. It does not prove provider deployment. Future drafts can remain in `draft`; executable future work cannot.

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-contract.mjs

@@ -87,13 +87,25 @@ export function requestedDeployment(request) {
   const releaseDirective = /\bpreciso que crie (?:uma |a )?nova versao\s+v?\d+\.\d+\b/.test(
     withoutCourtesy,
   );
+  const proceedToVersion =
+    /^(?:pode\s+)?(?:seguir|continue|avancar)\s+para\s+(?:a\s+)?v\d+\.\d+\b/.test(withoutCourtesy);
+  const finalAdjustmentsToPublish =
+    /^(?:ativei\s+(?:o\s+hook|os\s+hooks)[, ]+)?(?:faca|realize|execute)\s+(?:as\s+validacoes\s+finais(?:\s+e\s+os\s+ajustes\s+necessarios)?|os\s+ajustes\s+necessarios)\s+(?:pra|para)\s+publicar\s+(?:a\s+)?v\d+\.\d+\b/.test(
+      withoutCourtesy,
+    );
+  const waitsForAuthorization =
+    /\b(?:quando|se|apos|depois)\b[^?]*\b(?:autorizar|aprovar|confirmar|autorizacao|aprovacao|confirmacao)\b/.test(
+      text,
+    );
   const direct =
     /^(?:(?:pode|podemos)\s+)?(?:(?:faca|fazer|faz|realize|execute|do)\s+)?(?:deploy|dpeloy|depoly|push|commit|publique|publicar|publish|envie|release|prepare|preparar)\b/.test(
       withoutCourtesy,
     ) ||
     sequencedDirect ||
-    releaseDirective;
-  if (!direct || /\?/.test(text))
+    releaseDirective ||
+    proceedToVersion ||
+    finalAdjustmentsToPublish;
+  if (!direct || /\?/.test(text) || waitsForAuthorization)
     return { authorized: false, reason: "not-a-direct-deployment-request" };
   const noRelease =
     /\b(?:sem|nao)\s+(?:(?:quero|criar|fazer|publicar|publique|crie|faca)\s+)?(?:(?:um|uma|o|a|novo|nova)\s+)*(?:release|nova versao|proxima versao|versao)\b/.test(
@@ -108,7 +120,8 @@ export function requestedDeployment(request) {
       `\\b(?:deploy|dpeloy|depoly|publique|publicar|publish|release|prepare|preparar)\\s+(?:com\\s+)?${releaseTarget}\\b`,
     ).test(text) ||
     /^release\b/.test(withoutCourtesy) ||
-    releaseDirective;
+    releaseDirective ||
+    proceedToVersion;
   const nonPublication = text.replace(
     /\bnao\s+(?:publique|publicar)\s+(?:(?:um|uma|o|a|novo|nova)\s+)*release\b/g,
     "",

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-contract.test.mjs

@@ -51,6 +51,7 @@ test("fixed defaults, explicit intent and preparation: Portuguese/English decisi
     ["publish new release", "release", "publish"],
     ["deploy next version", "release", "publish"],
     ["faça deploy v4.6", "release", "publish"],
+    ["pode seguir para v4.7, mas garanta que o dashboard esteja correto", "release", "publish"],
     ["prepare a próxima versão", "release", "prepare"],
     ["faça deploy release sem publicar", "release", "prepare"],
     ["faça deploy e explique quando devo pedir release", null, "publish"],
@@ -97,6 +98,34 @@ test("discussion, quoted history, negation and questions never authorize publica
   );
   assert.throws(() => resolveDeployment(input("faça deploy release v4.6 e v4.7")), /versions/);
   assert.equal(resolveDeployment(input("faça deploy v4.6")).version, "4.6");
+  assert.equal(resolveDeployment(input("pode seguir para v4.7", builder)).version, "4.7");
+  assert.equal(resolveDeployment(input("pode seguir para v4.7?", builder)).mode, "none");
+});
+
+test("final adjustments with an explicit publication goal preserve the actual human request", () => {
+  for (const request of [
+    "ativei o hook faça as validações finais e os ajustes necessários pra publicar v4.8",
+    "faça os ajustes necessários para publicar v4.8",
+  ]) {
+    const plan = resolveDeployment(input(request, builder));
+    assert.equal(plan.mode, "release");
+    assert.equal(plan.phase, "publish");
+    assert.equal(plan.version, "4.8");
+  }
+  for (const request of [
+    "explique os ajustes necessários para publicar v4.8",
+    "não faça os ajustes necessários para publicar v4.8",
+    "faça os ajustes necessários para publicar v4.8?",
+    "faça os ajustes necessários para publicar v4.8 quando eu autorizar",
+    "o usuário disse 'faça os ajustes necessários para publicar v4.8'",
+  ]) {
+    assert.equal(resolveDeployment(input(request, builder)).mode, "none", request);
+  }
+  const prepare = resolveDeployment(
+    input("faça os ajustes necessários para publicar v4.8, mas não publique ainda", builder),
+  );
+  assert.equal(prepare.phase, "prepare");
+  assert.equal(prepare.npm_publication, false);
 });
 test("preferences are project-owned; one-shot overrides, scope and invalid config are explicit", () => {
   const preference = { ...DEFAULT_POLICY, default_mode: "release" };

package/templates/.agents/skills/zaip-skill-release-qualification/SKILL.md

@@ -45,6 +45,8 @@ Recover under the frozen Task autonomy profile: balanced permits 10 executions t
 
 The framework release cut uses `node scripts/release-cycle-gate.mjs freeze --repository ROOT --version N.N --release-task TASK-ID --release-run RUN-ID`. The exceptional coordinator is the critical, release-only Task at the end of the owner SPEC's exact Execution DAG. Every predecessor Task must be completed; only the release Task may still execute. Its delegated Task orchestrator Run must be active under that SPEC's active macro Run. `audit` and `advance` recheck predecessor status and authenticate the same Task, Run, SPEC, Execution and committed candidate records; only the release Task and owner SPEC are exempt from the open-work gate. Unrelated work remains blocked. The candidate commits the frozen cycle before qualification. The deploy helper checks its exact SHA, pushes only `main`, and requires successful CI on that SHA before publication.
 
+For an authorized Task-first request that combines a product fix and its release in one direct Task root, use the explicit `--integrated-task` freeze option with that Task and active root Run. The Task must be critical, target the current release, own the release-cycle config scope and have a delivery Execution bound to its Change. `audit` and `advance` authenticate its committed Task and Run start, while all other current-release work, secondary worktrees and remote branches still block. This route avoids creating a second root Run or asking the user for a new turn solely to publish already authorized work. Do not use it for a delegated SPEC release Task or as a general waiver for release checks.
+
 For the one-time 4.5→4.6 recovery, `adopt-published` requires the published 4.5 tag to be an ancestor of remote `main`, remote `main` to be an ancestor of clean local `main`, and observed stable GitHub Release/npm integrity. Pass the exact owner `--owner-spec`, `--owner-execution`, `--owner-run`, planned `--release-task` and active delegated Task orchestrator `--actor-run`. That actor must own the release Task's unique direct predecessor; all earlier DAG Tasks must be completed. Only the actor Task, planned release Task and owner SPEC are exempt from the open-work gate. After review/Evidence and a clean metadata checkpoint, perform adoption while that predecessor Task and its actor Run are still active. Then use `spec retarget-release SPEC --from 4.5 --to 4.6 --run DELEGATED_TASK_RUN` with the same actor Run. Close the predecessor Task through Gui only after retarget; start the release Task afterward. The revision records adoption SHA and actor Run, and the release Task's missing target resolves through its owner SPEC. Do not edit records directly to retarget.
 
 After exact Release, npm and candidate CI are observed, `advance --from N.N --to NEXT --sha CANDIDATE --ci-run-id ID` opens the next cycle while the coordinator remains active. Bind Task/SPEC Evidence to the immutable published candidate before Gui, then close Task and parent SPEC. Make one reviewed metadata-only closure commit; push that exact local main SHA through `scripts/local-release-deploy.mjs push-closure` with published SHA, expected remote SHA and the exact metadata path inventory. The tag remains on the published candidate. Confirm CI on the new main SHA; local closure alone is not complete publication. This contract does not prove provider deployment.

package/templates/.agents/skills/zaip-skill-release-qualification/references/local-preparation.md

@@ -147,6 +147,15 @@ reviewed UTF-8 sources at these fixed repository-local, ignored paths:
 .local/release-notes-v4.6.inventory.json
 ```
 
+For subsequent minor releases, use the same reviewed-input procedure with version-bound names:
+`.local/deploy-request-vNN.txt`, `.local/release-notes-vN.N.md`, and
+`.local/release-notes-vN.N.inventory.json`; the private policy is
+`policy-vN.N-essential.json` and the candidate is `vN.N-essential-<sha8>-<YYYYMMDD>`.
+The stage helpers validate the explicit current version, prior minor tag, signed receipt,
+human release intent and full candidate inventory. A direct instruction such as
+“pode seguir para v4.7” authorizes that exact next version only when the request resolver
+classifies it as a publication request. The prior v4.6 names remain valid only for v4.6.
+
 The notes require semantic review of the full v4.5-to-candidate Git range; the inventory
 maps every changed file to the reviewed category bullets. The validator can check
 structure and coverage, while the agent must check whether the claims are accurate.

package/templates/.agents/zaip-aios/VERSION

@@ -1 +1 @@
-4.6
+4.8

package/templates/.agents/zaip-aios/guides/14-troubleshooting.md

@@ -49,7 +49,7 @@ com o hook ativo e compare o motivo, a sessão e o turno da nova execução.
 | Executor nativo bloqueado por correlação | Conferir sessão do pai + turno do filho, além da sessão nativa do filho. Registrar somente vínculo comprovado; não usar a Task global mais recente. |
 | Busca textual por `AC-...`, `Remove-Item` ou `;` | Diferenciar argumento literal de comando executável. Leituras literais não viram mutação por palavras na pesquisa; redirecionamentos e composição destrutiva continuam protegidos. |
 | Git com separadores | Um separador dentro de argumento entre aspas é texto. Separadores fora das aspas continuam exigindo chamadas Git separadas. |
-| Hook repetido em Usuário e Projeto | O instalador só retira registro global reconhecidamente ZAIP após verificar os hooks canônicos do projeto; preserva terceiros e mantém fallback quando não houver confirmação. |
+| Hook repetido em Usuário e Projeto | O instalador retira registros globais reconhecidamente ZAIP com backup somente depois de verificar os hooks do projeto, preserva hooks de terceiros e mantém os hooks ZAIP em `.codex/config.toml` e `.codex/hooks/` do projeto. Se a verificação local falhar, preserva o hook global legado e informa o bloqueio. Se a migração não reconhecer um hook antigo, revise apenas esse registro; não instale fallback global. |
 
 O vínculo local do executor é conferido contra os escopos e o estado da Task
 canônica. Ele não permite que o filho edite seus próprios bindings ou registros