@zaip-ai/cli 5.1.0 → 5.3.0

package/dist/services/adapters.d.ts

@@ -1,6 +1,6 @@
 import { type PublicAgentCatalog } from "./agent-adapters.js";
 export { isManagedAdapter } from "./managed-adapter.js";
-export declare const ADAPTERS_VERSION = "5.1.0";
+export declare const ADAPTERS_VERSION = "5.3.0";
 export interface AdapterFile {
     path: string;
     content: string;

package/dist/services/adapters.js

@@ -11,7 +11,7 @@ export { isManagedAdapter } from "./managed-adapter.js";
 import { CODEX_GITHUB_DEPLOY_RULES, CODEX_SECURITY_RULES } from "./codex-rules.js";
 import { codexWindowsHookCommand } from "./codex-windows-hook-command.js";
 import { applyTransactionalChanges, assertSafeDestination } from "./transactional-files.js";
-export const ADAPTERS_VERSION = "5.1.0";
+export const ADAPTERS_VERSION = "5.3.0";
 const ROOT_GUIDANCE = `# ZAIP-AIOS
 
 Read \`.agents/config/project.yaml\` first. Apply ZAIP only for literal boolean \`zaip.enabled: true\`, except framework maintenance or \`zaip enable\`. \`AGENTS.md\` is a bootstrap; canonical guidance lives in \`.agents/\`.

package/dist/services/codex-literal-read-sequence-template.d.ts

@@ -0,0 +1,2 @@
+export declare const CODEX_LITERAL_READ_SEQUENCE: string;
+//# sourceMappingURL=codex-literal-read-sequence-template.d.ts.map

package/dist/services/codex-literal-read-sequence-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-literal-read-sequence-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-literal-read-sequence-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QAyFvC,CAAC"}

package/dist/services/codex-literal-read-sequence-template.js

@@ -0,0 +1,91 @@
+export const CODEX_LITERAL_READ_SEQUENCE = String.raw `export function createLiteralReadSequence({ shellSyntax, tokenizeLiteralCommand }) {
+// Recognize only literal read-only pipelines/sequences. Quoted search text is data,
+// not a PowerShell alias (for example the AC prefix in acceptance-criterion IDs).
+function isLiteralGitRead(values) {
+  if (!/^(?:git|git\.exe)$/i.test(values[0])) return false;
+  // Deliberately narrow: only the fixed fsmonitor=false override, no aliases, routing, pagers, external diff,
+  // textconv, output files, or mutating subcommands in a read sequence.
+  const args = values.slice(1);
+  if (args.shift() !== "--no-pager" || args.shift() !== "-c" || args.shift() !== "core.fsmonitor=false") return false;
+  const subcommand = args.shift();
+  if (!["status", "log", "rev-parse", "diff"].includes(subcommand)) return false;
+  if (["diff", "log"].includes(subcommand) && !["--no-ext-diff", "--no-textconv"].every(flag => args.includes(flag))) return false;
+  if (subcommand === "log" && !["--no-patch", "--no-show-signature"].every(flag => args.includes(flag))) return false;
+  if (subcommand === "diff" && !["--name-only", "--name-status", "--stat", "--check"].some(flag => args.includes(flag))) return false;
+  const options = {
+    status: /^(?:-s|-b|--short|--branch|--porcelain(?:=v?[12])?|--untracked-files(?:=(?:no|normal|all))?|--ignored(?:=(?:traditional|matching|no))?)$/,
+    log: /^(?:--no-ext-diff|--no-textconv|--no-patch|--no-show-signature|--oneline|--all|--decorate(?:=(?:short|full|no))?|--no-decorate|--date-order|--topo-order|--reverse|--no-merges|--merges|--max-count=\d+|-\d+|--format=(?:%H|%h|%s|%H%x09%s))$/,
+    "rev-parse": /^(?:--show-toplevel|--git-common-dir|--absolute-git-dir|--is-inside-work-tree|--show-prefix|--verify|--short(?:=\d+)?|--symbolic-full-name|--abbrev-ref|--end-of-options)$/,
+    diff: /^(?:--name-only|--name-status|--stat|--check|--cached|--staged|--no-ext-diff|--no-textconv|--exit-code|--quiet)$/,
+  };
+  return args.every(value => value.startsWith("-") ? options[subcommand].test(value) :
+    // Plain revisions/pathspecs only; shell syntax was already parsed separately.
+    /^[A-Za-z0-9_./@~^:\\-]+$/.test(value));
+}
+function isLiteralReadSequence(command) {
+  const syntax = shellSyntax(command);
+  if (syntax.interpolation || syntax.redirection || syntax.grouping) return false;
+  const parts = [];
+  let start = 0, quote = null;
+  for (let index = 0; index < command.length; index++) {
+    const char = command[index];
+    if (quote !== null) {
+      if (char === quote) {
+        if (quote === "'" && command[index + 1] === "'" && process.platform === "win32") index++;
+        else quote = null;
+      }
+    } else if (char === "'" || char === '"') quote = char;
+    else if (char === ";" || char === "|") { parts.push(command.slice(start, index)); start = index + 1; }
+  }
+  if (quote !== null) return false;
+  parts.push(command.slice(start));
+  return parts.every(part => {
+    const values = tokenizeLiteralCommand(part);
+    if (!values?.length) return false;
+    if (isLiteralGitRead(values)) return true;
+    if (/^Get-Item$/i.test(values[0])) {
+      const args = values.slice(1);
+      const path = args[0] === "-LiteralPath" ? args[1] : args[0];
+      return args.length === (args[0] === "-LiteralPath" ? 2 : 1) &&
+        !!path && !/^(?:[a-z][\w-]*:)(?![\/])/i.test(path) && !/[*?]/.test(path);
+    }
+    if (/^Select-Object$/i.test(values[0])) {
+      const args = values.slice(1);
+      const metadata = /^(?:Name|FullName|Length|LastWriteTime|LastWriteTimeUtc|CreationTime|Attributes|IsReadOnly|LinkType|Target)(?:,(?:Name|FullName|Length|LastWriteTime|LastWriteTimeUtc|CreationTime|Attributes|IsReadOnly|LinkType|Target))*$/i;
+      const slice = args.length > 0 && args.length % 2 === 0 && args.every((value, index) =>
+        index % 2 === 0 ? /^(?:-First|-Last|-Skip)$/i.test(value) : /^\d+$/.test(value));
+      return slice ||
+        (args.length === 2 && args[0] === "-ExpandProperty" && args[1] === "Target") ||
+        (args.length === 2 && args[0] === "-Property" && metadata.test(args[1])) ||
+        (args.length === 1 && metadata.test(args[0]));
+    }
+    if (/^Select-String$/i.test(values[0])) {
+      const flags = /^(?:-SimpleMatch|-CaseSensitive|-Quiet|-List|-AllMatches|-NotMatch|-Raw)$/i;
+      const valued = /^(?:-Pattern|-Path|-LiteralPath|-Context|-Encoding)$/i;
+      for (let index = 1; index < values.length; index++) {
+        const value = values[index];
+        if (flags.test(value)) continue;
+        if (valued.test(value) && values[index + 1] !== undefined) { index++; continue; }
+        return false;
+      }
+      return values.length > 1;
+    }
+    if (/^(?:gh|gh\.exe)$/i.test(values[0])) {
+      if (!["run", "release"].includes(values[1]) || values[2] !== "view") return false;
+      const args = values.slice(3);
+      if (args[0] && /^[A-Za-z0-9._-]+$/.test(args[0]) && !args[0].startsWith("-")) args.shift();
+      for (let index = 0; index < args.length; index += 2) {
+        if (!["--json", "--jq"].includes(args[index]) || !args[index + 1]) return false;
+      }
+      return true;
+    }
+    if (/^(?:Get-Content|Measure-Object)$/i.test(values[0])) return true;
+    if (!/^(?:rg|rg\.exe)$/i.test(values[0])) return false;
+    return !values.slice(1).some(value => /^--(?:pre|hostname-bin)(?:=|$)/i.test(value));
+  });
+}
+
+return isLiteralReadSequence;
+}
+`;
+//# sourceMappingURL=codex-literal-read-sequence-template.js.map

package/dist/services/codex-literal-read-sequence-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-literal-read-sequence-template.js","sourceRoot":"","sources":["../../src/services/codex-literal-read-sequence-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyFpD,CAAC"}

package/dist/services/codex-native-tool-authority-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-native-tool-authority-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gCAAgC,QA0QT,CAAC"}
+{"version":3,"file":"codex-native-tool-authority-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gCAAgC,QAiRT,CAAC"}

package/dist/services/codex-native-tool-authority-template.js

@@ -1,5 +1,7 @@
 import { CODEX_VALIDATION_RUNTIME_SUPPORT } from "./codex-validation-runtime-template.js";
-export const CODEX_NATIVE_TOOL_AUTHORITY_HOOK = String.raw `import { execFileSync } from "node:child_process";
+export const CODEX_NATIVE_TOOL_AUTHORITY_HOOK = String.raw `import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const executeGit = promisify(execFile);
 import { createHash } from "node:crypto";
 import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
@@ -223,16 +225,21 @@ export async function hasCurrentTaskOrchestratorRun(event, installedRoot, bounde
 }
 
 /** A Task's product writer is claimed centrally before any edit. */
-function isolatedGitMatchesClaim(repositoryRoot, authorityRoot, claim) {
-  const git = (root, args) => execFileSync("git", ["-C", root, ...args], {
-    encoding: "utf8", windowsHide: true, timeout: 15000,
-    env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^(GIT_|NODE_OPTIONS$)/i.test(key))),
-  }).trim();
-  if (resolve(git(repositoryRoot, ["rev-parse", "--show-toplevel"])) !== resolve(repositoryRoot) ||
-      git(repositoryRoot, ["branch", "--show-current"]) !== claim.branch) return false;
-  const head = git(repositoryRoot, ["rev-parse", "HEAD"]);
-  if (head !== git(authorityRoot, ["rev-parse", claim.branch])) return false;
-  return git(authorityRoot, ["worktree", "list", "--porcelain"]).split(/\r?\n\r?\n/).some(block => {
+async function isolatedGitMatchesClaim(repositoryRoot, authorityRoot, claim) {
+  const deadline = performance.now() + 3500;
+  const git = async (root, args) => {
+    const remaining = Math.floor(deadline - performance.now());
+    if (remaining <= 0) throw new Error("writer_validation_budget_exhausted");
+    return (await executeGit("git", ["-C", root, ...args], {
+      encoding: "utf8", windowsHide: true, timeout: Math.min(1500, remaining), maxBuffer: 1048576,
+      env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^(GIT_|NODE_OPTIONS$)/i.test(key))),
+    })).stdout.trim();
+  };
+  if (resolve(await git(repositoryRoot, ["rev-parse", "--show-toplevel"])) !== resolve(repositoryRoot) ||
+      await git(repositoryRoot, ["branch", "--show-current"]) !== claim.branch) return false;
+  const head = await git(repositoryRoot, ["rev-parse", "HEAD"]);
+  if (head !== await git(authorityRoot, ["rev-parse", claim.branch])) return false;
+  return (await git(authorityRoot, ["worktree", "list", "--porcelain"])).split(/\r?\n\r?\n/).some(block => {
     const lines = block.split(/\r?\n/);
     return lines.some(line => line.startsWith("worktree ") && resolve(line.slice(9)) === resolve(repositoryRoot)) &&
       lines.includes("HEAD " + head) && lines.includes("branch refs/heads/" + claim.branch);
@@ -261,7 +268,7 @@ export async function hasClaimedTaskWriter(event, repositoryRoot, boundedRead, d
       typeof isolated.branch === "string" && isolated.branch.startsWith("codex/") &&
       resolve(isolated.path) === resolve(repositoryRoot) &&
       resolve(isolated.canonical_workspace) === resolve(authorityRoot) &&
-      isolatedGitMatchesClaim(repositoryRoot, authorityRoot, isolated);
+      await isolatedGitMatchesClaim(repositoryRoot, authorityRoot, isolated);
   } catch { return false; }
 }
 ` + CODEX_VALIDATION_RUNTIME_SUPPORT;

package/dist/services/codex-native-tool-authority-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-native-tool-authority-template.js","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyQX,GAAG,gCAAgC,CAAC"}
+{"version":3,"file":"codex-native-tool-authority-template.js","sourceRoot":"","sources":["../../src/services/codex-native-tool-authority-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgRX,GAAG,gCAAgC,CAAC"}

package/dist/services/codex-pre-tool-hook-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,QA+mB/B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,QAknB/B,CAAC"}

package/dist/services/codex-pre-tool-hook-template.js

@@ -5,9 +5,9 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
-import { captureCliTurn, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, gitInvocation, inside, isLiteralReadSequence, parseHookEvent, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
+import { captureCliTurn, createHookBudget, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, gitInvocation, inside, isLiteralReadSequence, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
 import { createCloudValidators } from "./zaip-pre-tool-cloud.mjs";
-const execute = promisify(execFile);
+const { execute, parseEvent } = createHookBudget(promisify(execFile));
 const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
 const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
 const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
@@ -133,8 +133,8 @@ const destructivePatterns = [
   },
 ];
 
-function deny(reason) {
-  activation?.recordActivation(repositoryRoot, event, "denied");
+function deny(reason, record = true) {
+  if (record) activation?.recordActivation(repositoryRoot, event, "denied");
   writeSync(
     1,
     JSON.stringify({
@@ -195,7 +195,7 @@ async function validateExplicitFilesystemReferences(command, cwd, reviewedPaths
   if (homeReferencePattern.test(checked)) {
     deny("Direct user-profile path references are blocked; use repository-scoped paths.");
   }
-  if (credentialReferencePattern.test(checked) || sensitiveEnvironmentPattern.test(checked)) {
+  if (credentialReferencePattern.test(checked.replace(/[;|&()]/g, " ")) || sensitiveEnvironmentPattern.test(checked)) {
     deny("Direct credential and secret access is blocked.");
   }
   if (/\b(?:Get-ChildItem|gci|dir|Get-Item|gi)(?:\s+-(?:LiteralPath|Path))?\s+(?:Env|Variable|Function|Alias):|\b(?:printenv|set)\s*$/i.test(checked) || /GetEnvironmentVariables\s*\(/i.test(checked)) {
@@ -214,8 +214,11 @@ async function validateExplicitFilesystemReferences(command, cwd, reviewedPaths
     if (jsonPath) { if (path.includes("\\") || !isWithinRepository(resolve(path))) deny("Explicit filesystem path escapes the repository boundary."); continue; }
     if (path.includes("\\") || !isWithinRepository(resolve(path)) || (match[2] && before && !(/\s/.test(before) || before === "=" || jsonPath)) || (after && !/\s/.test(after) && !jsonPath)) deny("Explicit operating-system paths outside the repository are blocked.");
   }
-  if (process.platform === "win32" && /(?:^|[\s"'=(,])\\(?!\\)[^\s\\/"'<>|;]+(?:\\[^\s"'<>|;]+|\.[A-Za-z0-9]{1,10})/.test(checked)) {
-    deny("Drive-rooted filesystem paths outside the repository are blocked.");
+  if (process.platform === "win32") {
+    for (const match of checked.matchAll(/(?:^|[\s"'=(,])(\\(?!\\)[^\s\\/"'<>|;]+(?:\\[^\s"'<>|;]+|\.[A-Za-z0-9]{1,10}))/g)) {
+      if (principalFullAccess) { await assertCanonicalLiteralPath(match[1], cwd); continue; }
+      deny("Drive-rooted filesystem paths outside the repository are blocked.");
+    }
   }
   for (const candidate of explicitPathCandidates(checked)) {
     if (principalFullAccess) { await assertCanonicalLiteralPath(candidate, cwd); continue; }
@@ -535,7 +538,7 @@ let raw = "";
 for await (const chunk of process.stdin) raw += chunk;
 
 let event;
-event = parseHookEvent(raw, deny);
+event = parseEvent(raw, deny);
 
 const toolInput = event?.tool_input;
 const candidateWorkdir = typeof toolInput?.workdir === "string" && isAbsolute(toolInput.workdir) ? toolInput.workdir : event.cwd;

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0W3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqQ5B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6W3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqQ5B,CAAC"}

package/dist/services/codex-pre-tool-host-context-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-host-context-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-host-context-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC,QAyI5C,CAAC"}
+{"version":3,"file":"codex-pre-tool-host-context-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-host-context-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gCAAgC,QAyK5C,CAAC"}

package/dist/services/codex-pre-tool-host-context-template.js

@@ -1,3 +1,4 @@
+import { CODEX_LITERAL_READ_SEQUENCE } from "./codex-literal-read-sequence-template.js";
 export const CODEX_PRE_TOOL_HOST_CONTEXT_HOOK = String.raw `import { execFile } from "node:child_process";
 import { lstat, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, resolve, toNamespacedPath } from "node:path";
@@ -5,7 +6,28 @@ import { promisify } from "node:util";
 const execute = promisify(execFile);
 const pathIdentity = value => process.platform === "win32" ? toNamespacedPath(resolve(value)).toLowerCase() : resolve(value);
 
+export function createHookBudget(executeFile) {
+  const deadline = performance.now() + 6500;
+  return {
+    execute(file, args, options = {}) {
+      const remaining = Math.floor(deadline - performance.now());
+      if (remaining <= 0) throw new Error("Hook validation budget exhausted; inspect the slow dependency before retrying.");
+      return executeFile(file, args, { ...options, timeout: Math.min(options.timeout ?? remaining, remaining) });
+    },
+    parseEvent(raw, deny) {
+      let event; try { event = JSON.parse(raw); } catch { deny("Malformed hook input was rejected."); }
+      // Headroom for the Windows launcher; a stalled dependency never grants authority.
+      const timer = setTimeout(() => deny("Hook validation budget exhausted. Inspect the slow Git/filesystem dependency before retrying; authorization was not granted.", false), Math.max(1, deadline - performance.now()));
+      timer.unref();
+      return event;
+    },
+  };
+}
+
 export function createHostContext({ inside, readBoundedCanonicalText }) {
+// One hook invocation only: never reuse filesystem authority across tool calls.
+const roots = new Map();
+const deadline = performance.now() + 6000;
 /** Project configuration selects ZAIP policy; the host still enforces effective ACLs. */
 async function configuredPermissionProfile(installedRoot) {
   const restricted = { filesystem: false, network: false };
@@ -82,6 +104,11 @@ async function configuredPermissionProfile(installedRoot) {
 }
 
 async function selectHookRepositoryRoot(installedRoot, cwd) {
+  const key = JSON.stringify([installedRoot, cwd]);
+  if (!roots.has(key)) roots.set(key, resolveHookRepositoryRoot(installedRoot, cwd));
+  return roots.get(key);
+}
+async function resolveHookRepositoryRoot(installedRoot, cwd) {
   if (typeof cwd !== "string") throw new Error("Tool execution without a workspace is blocked.");
   const physicalCwd = await realpath(cwd).catch(() => null);
   if (!physicalCwd || pathIdentity(physicalCwd) !== pathIdentity(cwd)) {
@@ -95,13 +122,18 @@ async function selectHookRepositoryRoot(installedRoot, cwd) {
     if (cursor.toLowerCase() === installedRoot.toLowerCase()) return installedRoot;
   }
   try {
-    const git = async (path, ...args) => (await execute("git", ["-C", path, ...args], {
-      encoding: "utf8", windowsHide: true, timeout: 5000, maxBuffer: 1048576,
-    })).stdout.trim();
+    const git = async (path, ...args) => {
+      const remaining = Math.floor(deadline - performance.now());
+      if (remaining <= 0) throw new Error("workspace_validation_budget_exhausted");
+      return (await execute("git", ["-C", path, ...args], {
+        encoding: "utf8", windowsHide: true, timeout: Math.min(2000, remaining), maxBuffer: 1048576,
+      })).stdout.trim();
+    };
     const primary = await git(installedRoot, "rev-parse", "--show-toplevel");
     if ((await realpath(primary)).toLowerCase() !== installedRoot.toLowerCase()) throw new Error("primary_not_root");
     const worktrees = await git(installedRoot, "worktree", "list", "--porcelain", "-z");
     const registered = worktrees.split("\0").filter(line => line.startsWith("worktree ")).map(line => line.slice(9));
+    if (!registered.some(path => inside(cwd, resolve(path)))) throw new Error("worktree_not_registered");
     const candidate = await realpath(await git(cwd, "rev-parse", "--show-toplevel"));
     if (!registered.some(path => resolve(path).toLowerCase() === candidate.toLowerCase()) || !inside(cwd, candidate)) {
       throw new Error("worktree_not_registered");
@@ -135,5 +167,6 @@ async function selectHookExecutionWorkspace(installedRoot, event, allowExternal
 
 return { configuredPermissionProfile, selectHookRepositoryRoot, selectHookExecutionWorkspace };
 }
+${CODEX_LITERAL_READ_SEQUENCE}
 `;
 //# sourceMappingURL=codex-pre-tool-host-context-template.js.map

package/dist/services/codex-pre-tool-host-context-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-host-context-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-host-context-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyIzD,CAAC"}
+{"version":3,"file":"codex-pre-tool-host-context-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-host-context-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAExF,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwKxD,2BAA2B;CAC5B,CAAC"}

package/dist/services/codex-pre-tool-support-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-support-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QAqXvC,CAAC"}
+{"version":3,"file":"codex-pre-tool-support-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QA8UvC,CAAC"}

package/dist/services/codex-pre-tool-support-template.js

@@ -1,7 +1,7 @@
 export const CODEX_PRE_TOOL_SUPPORT_HOOK = String.raw `import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, toNamespacedPath } from "node:path";
 import { homedir } from "node:os";
-import { createHostContext } from "./zaip-pre-tool-host-context.mjs";
+import { createHostContext, createLiteralReadSequence } from "./zaip-pre-tool-host-context.mjs";
 import { createCliTurnCapture } from "./zaip-pre-tool-cli-capture.mjs";
 export { readAuthorityRunRecords, checkDestructivePatterns, configuredDeploymentBranches } from "./zaip-native-tool-authority.mjs";
 const pathIdentity = value => process.platform === "win32" ? toNamespacedPath(resolve(value)).toLowerCase() : resolve(value);
@@ -24,6 +24,8 @@ export function parseHookEvent(raw, deny) {
   catch { deny("Malformed hook input was rejected."); }
 }
 
+export { createHookBudget } from "./zaip-pre-tool-host-context.mjs";
+
 export const { configuredPermissionProfile, selectHookRepositoryRoot, selectHookExecutionWorkspace } = createHostContext({ inside, readBoundedCanonicalText });
 
 export function tokenizeLiteralCommand(command) {
@@ -97,48 +99,7 @@ export function requiresShellMutationRun(command, tokens, cwd, repositoryRoot) {
   return (tokens && isSedMutation(tokens)) || shellMutationPattern.test(command) || syntax.redirection;
 }
 
-// Recognize only literal read-only pipelines/sequences. Quoted search text is data,
-// not a PowerShell alias (for example the AC prefix in acceptance-criterion IDs).
-export function isLiteralReadSequence(command) {
-  const syntax = shellSyntax(command);
-  if (syntax.interpolation || syntax.redirection || syntax.grouping) return false;
-  const parts = [];
-  let start = 0, quote = null;
-  for (let index = 0; index < command.length; index++) {
-    const char = command[index];
-    if (quote !== null) {
-      if (char === quote) {
-        if (quote === "'" && command[index + 1] === "'" && process.platform === "win32") index++;
-        else quote = null;
-      }
-    } else if (char === "'" || char === '"') quote = char;
-    else if (char === ";" || char === "|") { parts.push(command.slice(start, index)); start = index + 1; }
-  }
-  if (quote !== null) return false;
-  parts.push(command.slice(start));
-  return parts.every(part => {
-    const values = tokenizeLiteralCommand(part);
-    if (!values?.length) return false;
-    if (/^Get-Item$/i.test(values[0])) {
-      const args = values.slice(1);
-      const path = args[0] === "-LiteralPath" ? args[1] : args[0];
-      return args.length === (args[0] === "-LiteralPath" ? 2 : 1) &&
-        !!path && !/^(?:[a-z][\w-]*:)(?![\/])/i.test(path) && !/[*?]/.test(path);
-    }
-    if (/^Select-Object$/i.test(values[0])) {
-      const args = values.slice(1);
-      const metadata = /^(?:Name|FullName|Length|LastWriteTime|LastWriteTimeUtc|CreationTime|Attributes|IsReadOnly|LinkType|Target)(?:,(?:Name|FullName|Length|LastWriteTime|LastWriteTimeUtc|CreationTime|Attributes|IsReadOnly|LinkType|Target))*$/i;
-      return (args.length === 2 && args[0] === "-First" && /^\d+$/.test(args[1])) ||
-        (args.length === 2 && args[0] === "-ExpandProperty" && args[1] === "Target") ||
-        (args.length === 2 && args[0] === "-Property" && metadata.test(args[1])) ||
-        (args.length === 1 && metadata.test(args[0]));
-    }
-    if (/^(?:Get-Content|Measure-Object)$/i.test(values[0])) return true;
-    if (!/^(?:rg|rg\.exe)$/i.test(values[0])) return false;
-    return !values.slice(1).some(value => /^--(?:pre|hostname-bin)(?:=|$)/i.test(value));
-  });
-}
-
+export const isLiteralReadSequence = createLiteralReadSequence({ shellSyntax, tokenizeLiteralCommand });
 function isSedMutation(tokens) {
   const executable = ((tokens[0] ?? "").split(/[\\/]/).pop() ?? "").replace(/\.(?:exe|cmd|bat)$/i, "");
   return /^sed$/i.test(executable) && tokens.slice(1).some((token) =>

package/dist/services/codex-pre-tool-support-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqXpD,CAAC"}
+{"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8UpD,CAAC"}

package/dist/services/codex-windows-hook-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-windows-hook-command.d.ts","sourceRoot":"","sources":["../../src/services/codex-windows-hook-command.ts"],"names":[],"mappings":"AAEA,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAQpF"}
+{"version":3,"file":"codex-windows-hook-command.d.ts","sourceRoot":"","sources":["../../src/services/codex-windows-hook-command.ts"],"names":[],"mappings":"AAEA,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CA2BpF"}

package/dist/services/codex-windows-hook-command.js

@@ -3,10 +3,29 @@ import { resolve } from "node:path";
 export function codexWindowsHookCommand(hook, workspaceRoot) {
     if (!/^zaip-[a-z-]+\.mjs$/.test(hook))
         throw new Error(`Invalid ZAIP hook name: ${hook}`);
-    const literalRoot = workspaceRoot === undefined
+    const search = workspaceRoot === undefined
         ? "(Get-Location)"
         : `'${resolve(workspaceRoot).replaceAll("'", "''")}'`;
-    const script = `$ProgressPreference = 'SilentlyContinue'; $search = ${literalRoot}; $git = $null; while ($search) { $candidate = Join-Path $search '.local/git/cmd/git.exe'; if (Test-Path -LiteralPath $candidate -PathType Leaf) { $git = $candidate; break }; $parent = Split-Path -Path $search -Parent; if (!$parent -or $parent -eq $search) { break }; $search = $parent }; if (!$git) { $git = (Get-Command git -ErrorAction SilentlyContinue).Source }; if (!$git) { exit 0 }; $root = & $git rev-parse --show-toplevel 2>$null; if ($LASTEXITCODE -ne 0 -or !$root) { exit 0 }; $hook = Join-Path $root '.codex/hooks/${hook}'; if (!(Test-Path -LiteralPath $hook -PathType Leaf)) { exit 0 }; & node $hook; exit $LASTEXITCODE`;
+    const script = [
+        "$ProgressPreference = 'SilentlyContinue'",
+        `$search = ${search}`,
+        "$git = $null",
+        "while ($search) { $candidate = Join-Path $search '.local/git/cmd/git.exe'; if (Test-Path -LiteralPath $candidate -PathType Leaf) { $git = $candidate; break }; $parent = Split-Path -Path $search -Parent; if (!$parent -or $parent -eq $search) { break }; $search = $parent }",
+        "if (!$git) { $git = (Get-Command git -ErrorAction SilentlyContinue).Source }",
+        "if (!$git) { exit 0 }",
+        "$probe = New-Object System.Diagnostics.Process",
+        "$probe.StartInfo.FileName = $git",
+        "$probe.StartInfo.Arguments = 'rev-parse --show-toplevel'",
+        "$probe.StartInfo.UseShellExecute = $false",
+        "$probe.StartInfo.CreateNoWindow = $true",
+        "$probe.StartInfo.RedirectStandardOutput = $true",
+        "$probe.StartInfo.RedirectStandardError = $true",
+        "try { if (!$probe.Start()) { throw 'git discovery failed' }; $output = $probe.StandardOutput.ReadToEndAsync(); $errors = $probe.StandardError.ReadToEndAsync(); if (!$probe.WaitForExit(1500)) { $probe.Kill(); [Console]::Error.WriteLine('ZAIP hook: Git discovery exceeded 1500ms; retry after checking Git availability.'); exit 2 }; $root = $output.GetAwaiter().GetResult().Trim(); if ($probe.ExitCode -ne 0 -or !$root) { exit 0 } } catch { [Console]::Error.WriteLine('ZAIP hook: Git discovery failed.'); exit 2 } finally { $probe.Dispose() }",
+        `$hook = Join-Path $root '.codex/hooks/${hook}'`,
+        "if (!(Test-Path -LiteralPath $hook -PathType Leaf)) { exit 0 }",
+        "& node $hook",
+        "exit $LASTEXITCODE",
+    ].join("; ");
     return `powershell -NoProfile -NonInteractive -EncodedCommand ${Buffer.from(script, "utf16le").toString("base64")}`;
 }
 //# sourceMappingURL=codex-windows-hook-command.js.map

package/dist/services/codex-windows-hook-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-windows-hook-command.js","sourceRoot":"","sources":["../../src/services/codex-windows-hook-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,aAAsB;IAC1E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,WAAW,GACf,aAAa,KAAK,SAAS;QACzB,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;IAC1D,MAAM,MAAM,GAAG,uDAAuD,WAAW,ihBAAihB,IAAI,qGAAqG,CAAC;IAC5sB,OAAO,yDAAyD,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtH,CAAC"}
+{"version":3,"file":"codex-windows-hook-command.js","sourceRoot":"","sources":["../../src/services/codex-windows-hook-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,aAAsB;IAC1E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GACV,aAAa,KAAK,SAAS;QACzB,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;IAC1D,MAAM,MAAM,GAAG;QACb,0CAA0C;QAC1C,aAAa,MAAM,EAAE;QACrB,cAAc;QACd,iRAAiR;QACjR,8EAA8E;QAC9E,uBAAuB;QACvB,gDAAgD;QAChD,kCAAkC;QAClC,0DAA0D;QAC1D,2CAA2C;QAC3C,yCAAyC;QACzC,iDAAiD;QACjD,gDAAgD;QAChD,6hBAA6hB;QAC7hB,yCAAyC,IAAI,GAAG;QAChD,gEAAgE;QAChE,cAAc;QACd,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,yDAAyD,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaip-ai/cli",
-  "version": "5.1.0",
+  "version": "5.3.0",
   "description": "CLI oficial para instalar e configurar o ZAIP-AIOS em qualquer repositório",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/templates/.agents/README-ENG.md

@@ -12,6 +12,29 @@ test reuse, content-based Dashboard builds and separate npm confirmation.
 Authorized maintenance suspends governance while keeping telemetry active;
 governance is restored and hooks are checked when maintenance ends.
 
+The [hook repair guide](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/hooks-leitura-e-orcamento.md) describes
+permitted Git read sequences, validation time budgets, and retained protections.
+Git read sequences use `git --no-pager -c core.fsmonitor=false` and the documented
+safe options; Git mutations still require separate commands.
+
+The [v5.2 reliability plan](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v52-confiabilidade-e-eficiencia.md)
+records bounded Git discovery in the Windows launcher, observation recovery
+after maintenance, thread-scoped Run queries, and validation cache measurements.
+Evidence distinguishes local tests, independent review, and package publication.
+
+The [v5.3 governance and recovery contract](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v53-governanca-e-retomada.md)
+defines recovery for published Task-first deliveries, Run continuity,
+authenticated remote resumption, and criteria for measuring actual test savings.
+Legacy failure reconciliation uses complete signed reruns, preserves history,
+and prevents resolved failures from imposing indefinite retests. It does not
+waive impact checks or turn an unverified installation into a cache HIT.
+Literal audit queries using `Select-String`, numeric `Select-Object` slices,
+and `gh run view`/`gh release view` are reads; interpolation, remote writes,
+redirection, and secret access retain their controls.
+On Windows, rooted paths used by the principal in `zaip-aios-full-access` undergo
+canonical validation; literal search patterns are not blocked merely because
+they contain a backslash. Traversal and protected destinations remain denied.
+
 > **Source, candidate, and publication:** this README describes the checkout's
 > contracts and features. The [evolution matrix](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v50-documentacao-editorial.md)
 > identifies implementation and evidence. Local qualification, consumer hook

package/templates/.agents/README.md

@@ -12,6 +12,30 @@ o reuso conservador de testes, o build do Dashboard por conteúdo e a confirmaç
 separada do npm. Manutenção autorizada suspende a governança com telemetria ativa;
 ao terminar, a governança é reativada e os hooks são verificados.
 
+O [guia de correção dos hooks](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/hooks-leitura-e-orcamento.md) descreve
+as sequências Git de leitura permitidas, os limites de tempo da validação e as
+proteções preservadas. Sequências Git de leitura usam o prefixo
+`git --no-pager -c core.fsmonitor=false` e as opções seguras documentadas;
+alterações Git continuam exigindo comandos separados.
+
+O [plano de confiabilidade da v5.2](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v52-confiabilidade-e-eficiencia.md)
+registra a descoberta Git limitada no launcher Windows, a retomada da observação
+após manutenção, a consulta de Runs por chat e a medição do cache de validação.
+As evidências distinguem testes locais, revisão e publicação do pacote.
+
+O [contrato de governança e retomada da v5.3](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v53-governanca-e-retomada.md)
+define a recuperação de entregas Task-first publicadas, a continuidade de Runs,
+a retomada remota autenticada e os critérios para medir economia real de testes.
+A reconciliação de falhas antigas usa reexecuções completas e assinadas, preserva
+o histórico e evita que uma falha já resolvida imponha retestes indefinidamente.
+Isso não dispensa os testes por impacto nem transforma uma instalação não verificada em HIT.
+Consultas literais de auditoria com `Select-String`, recortes numéricos de
+`Select-Object` e `gh run view`/`gh release view` são leituras; interpolação,
+escrita remota, redirecionamento e acesso a segredos conservam seus controles.
+No Windows, caminhos rooted do principal em `zaip-aios-full-access` passam pela
+validação canônica; padrões literais de busca não causam bloqueio apenas por
+conter uma barra invertida. Travessia e destinos protegidos continuam recusados.
+
 > **Fonte, candidato e publicação:** este README descreve os contratos e recursos
 > do checkout. A [matriz de evolução](https://github.com/zaip-ai/zaip-aios/blob/main/docs/quality/v50-documentacao-editorial.md)
 > identifica a implementação e suas provas. Qualificação local, ativação dos

package/templates/.agents/config/agents/discovery.json

@@ -1,5 +1,5 @@
 {
-  "_zaip_managed": "zaip-managed generated-do-not-edit source=agent-discovery version=5.1.0 sha256=3def7a2b43c1a751f8e68754ef94cb107a80b5d26e11f065af2b4cc145fc8897",
+  "_zaip_managed": "zaip-managed generated-do-not-edit source=agent-discovery version=5.3.0 sha256=3def7a2b43c1a751f8e68754ef94cb107a80b5d26e11f065af2b4cc145fc8897",
   "schema_version": 1,
   "source": {
     "path": ".agents/config/agents/catalog.yaml",