@zaip-ai/cli 6.2.0 → 7.5.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deployment-request-preservation.test.mjs

@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { resolveDeployment } from "./deploy-contract.mjs";
+
+const identity = {
+  origin: "git@github.com:zaip-ai/zaip-aios.git",
+  rootName: "@zaip-ai/aios",
+  cliName: "@zaip-ai/cli",
+  rootVersion: "7.0.0",
+  cliVersion: "7.0.0",
+  workspaceVersion: "7.0.0",
+};
+const policy = { schema_version: 1, default_mode: "auto", default_scope: "current-work" };
+const resolve = (request) => resolveDeployment({ request, identity, policy });
+const correction =
+  "Envie a correção permanente ao remoto pelo fluxo governado, preservando a v7.0 publicada e as evidências. Reaproveite os testes aprovados e confirme que não ficaram pendências.";
+
+test("sending the audited correction preserves the published version without npm", () => {
+  const plan = resolve(correction);
+  assert.equal(plan.mode, "commits");
+  assert.equal(plan.phase, "publish");
+  assert.equal(plan.scope, "current-work");
+  assert.equal(plan.version, null);
+  assert.equal(plan.npm_publication, false);
+  assert.equal(plan.changes_preference, false);
+});
+
+test("negation, question, quote and pending authorization cannot send the correction", () => {
+  for (const request of [
+    `Não ${correction}`,
+    `${correction}?`,
+    `"${correction}"`,
+    `Se eu autorizar, ${correction}`,
+    `${correction} Quando eu confirmar.`,
+  ])
+    assert.equal(resolve(request).mode, "none", request);
+  const prepared = resolve(`${correction} Sem publicar.`);
+  assert.equal(prepared.phase, "prepare");
+  assert.equal(prepared.npm_publication, false);
+  assert.throws(() => resolve(`${correction} E publique a v7.1.`), /Conflicting/);
+});
+
+test("explicit implementation and release binds v7.1 without expanding file scope", () => {
+  const request = "pode implementar tudo isso e publicar a v7.1";
+  const plan = resolve(request);
+  assert.equal(plan.mode, "release");
+  assert.equal(plan.version, "7.1");
+  assert.equal(plan.phase, "publish");
+  assert.equal(plan.scope, "current-work");
+  assert.equal(plan.npm_publication, true);
+  for (const text of [
+    `${request}?`,
+    `não ${request}`,
+    `"${request}"`,
+    `${request} quando eu autorizar`,
+  ])
+    assert.equal(resolve(text).mode, "none", text);
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deployment-request.mjs

@@ -0,0 +1,291 @@
+import { inspectPublicationIntent } from "./publication-intent.mjs";
+export function assert(ok, message) {
+  if (!ok) throw new Error(message);
+}
+
+export const normalize = (value) =>
+  value
+    .normalize("NFKD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .toLowerCase()
+    .replace(/\s+/g, " ")
+    .trim();
+
+export function requestedDeployment(request) {
+  assert(
+    typeof request === "string" && request.length > 0 && request.length <= 8192,
+    "A bounded current human request is required",
+  );
+  const text = normalize(request);
+  const inspection = inspectPublicationIntent(request);
+  const preparationSuffix = /(?:sem publicar|nao publique(?: ainda)?)[.!]?$/;
+  const explicitPreparation =
+    preparationSuffix.test(inspection.action) &&
+    !inspectPublicationIntent(inspection.action.replace(preparationSuffix, "")).publicationDenied;
+  if (
+    inspection.untrusted ||
+    inspection.condition !== null ||
+    (inspection.publicationDenied &&
+      !explicitPreparation &&
+      !/^(?:pode\s+)?(?:prepare|preparar)\b/.test(inspection.action))
+  )
+    return {
+      authorized: false,
+      reason:
+        inspection.condition !== null
+          ? "publication-condition-proof-required"
+          : "not-a-direct-deployment-request",
+    };
+  // An explicitly named numeric patch keeps its separate signed patch route.
+  // Never truncate an ordinary release suffix into a minor version.
+  const ordinaryVersions = text.replace(
+    /\bpatch\s+v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?![\w.+-])/g,
+    "patch",
+  );
+  if (ordinaryVersions !== text && [...text.matchAll(/\bv?\d+\.\d+/g)].length !== 1)
+    return { authorized: false, reason: "conflicting-explicit-release-versions" };
+  if (/\bv\d+\.\d+(?:\.[a-z0-9_]|[-+][a-z0-9_]|[a-z_])/.test(ordinaryVersions))
+    return { authorized: false, reason: "unsupported-explicit-release-version" };
+  // Provenance and explicit human holds constrain every authorization route.
+  const quotedOrReported =
+    /[`"'“”]/.test(request) || /\b(?:disse|citou|exemplo|quoted|said)\b/.test(text);
+  const approvalHold =
+    /\b(?:ate|quando|se|apos|depois|aguard\w*|esper\w*|so|somente|apenas|depend\w*|condicion\w*)\b[^.!?]*\b(?:revis\w*|autor\w*|aprov\w*|confirm\w*)\b/.test(
+      text,
+    );
+  if (quotedOrReported || approvalHold)
+    return { authorized: false, reason: "not-a-direct-deployment-request" };
+  if (inspection.incompleteReleaseVersion)
+    return {
+      authorized: true,
+      override: "release",
+      version: inspection.incompleteReleaseVersion,
+      phase: "publish",
+      scope: "current-work",
+      completionOnly: true,
+    };
+  // Checking whether delivery already happened is the existing idempotency gate,
+  // not a pending human approval. Accept only this complete bounded instruction.
+  const verifyThenDeploy =
+    /^(?:revise|verifique|confira) se (?:ja )?foi feito (?:o )?deploy, caso contrario faca deploy(?: (?:da|de) v?((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)))?[.!]?$/.exec(
+      text,
+    ) ??
+    /^(?:revise|verifique|confira) se (?:ja )?foi feito (?:o )?deploy (?:da|de) v?((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))[.!] se ainda nao, faca os ajustes necessarios para realizar o deploy corretamente[.!] garanta que o deploy seja feito[.!]?$/.exec(
+      text,
+    );
+  const correctThenDeploy =
+    /^corrija isso e faca deploy (?:da|de) v?((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))[.!]?$/.exec(text);
+  if (verifyThenDeploy || correctThenDeploy) {
+    const version = (verifyThenDeploy ?? correctThenDeploy)[1] ?? null;
+    return {
+      authorized: true,
+      override: version === null ? null : "release",
+      version,
+      phase: "publish",
+      scope: "current-work",
+    };
+  }
+  const reviewedVisualPublication =
+    /^revise se todos os ajustes foram realizados corretamente, faca os ajustes finais e publique na versao ((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))[.!]?$/.exec(
+      text,
+    ) ??
+    /^execute a spec inteira ate publicar a v((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))[.!]?$/.exec(text);
+  if (reviewedVisualPublication)
+    return {
+      authorized: true,
+      override: "release",
+      version: reviewedVisualPublication[1],
+      phase: "publish",
+      scope: "current-work",
+    };
+  // A separate, literal imperative paragraph can authorize implementation and
+  // publication together. Do not rewrite the user's request or accept reported,
+  // quoted, conditional or merely mentioned publication language.
+  const implementAndPublish =
+    !/[`"'“”]/.test(request) &&
+    !/\b(?:disse|citou|exemplo|quoted|said)\b/.test(text) &&
+    !/\b(?:nao|nunca|jamais|sem|proibido|proibo|evite|aguarde)\b[^.!?]*\b(?:public\w*|publiqu\w*|release|deploy|versao)\b/.test(
+      text,
+    ) &&
+    !/\b(?:ate|quando|se|apos|depois)\b[^.!?]*\b(?:revis\w*|autor\w*|aprov\w*|confirm\w*)\b/.test(
+      text,
+    ) &&
+    !/\b(?:aguard\w*|esper\w*|so|somente|apenas|depend\w*|condicion\w*)\b[^.!?]*\b(?:revis\w*|autor\w*|aprov\w*|confirm\w*)\b/.test(
+      text,
+    ) &&
+    request
+      .split(/\r?\n|(?<=[.!])\s+/)
+      .map(normalize)
+      .some((line) =>
+        /^(?:(?:(?:faca|realize|execute)\s+(?:as mudancas necessarias|(?:todos os |os )(?:ajustes|ajuates)(?: necessarios)?|as melhorias|todos os testes)(?:\s+e\s+(?:todos os testes|as validacoes|os testes))?|pode (?:implementar|executar))\s+e\s+|depois\s+|apos\s+os\s+ajustes\s+e\s+(?:os\s+)?testes\s+)(?:publique|publica|publicar)\s+(?:(?:em|como)\s+)?(?:uma\s+|a\s+)?(?:(?:nova|proxima)\s+versao|v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?:\s+com\s+uma\s+versao\s+final\s+pronta\s+(?:para|pra)\s+producao)?[.!]?$/.test(
+          line,
+        ),
+      );
+  const continuationSentences = request.split(/\r?\n|(?<=[.!])\s+/).map(normalize);
+  const continuedPendingPublication =
+    !/\b(?:nao|nunca|jamais|sem|proibido|proibo|evite|aguarde)\b[^.!?]*\b(?:public\w*|publiqu\w*|release|deploy|versao)\b/.test(
+      text,
+    ) &&
+    !continuationSentences.some((line) => /^(?:se|quando|apos|depois)\b/.test(line)) &&
+    continuationSentences.some((line) =>
+      /^continue todas as tarefas pendentes ate a publicacao da v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)[.!]?$/.test(
+        line,
+      ),
+    );
+  const resumedSpecPublication =
+    /^pode retomar a execucao da spec ate finalizar todas as tasks e fazer publicacao deploy da v((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?: com release(?: e npm publicado)?)?$/.exec(
+      text,
+    );
+  if (resumedSpecPublication)
+    return {
+      authorized: true,
+      override: "release",
+      version: resumedSpecPublication[1],
+      phase: "publish",
+      scope: "current-work",
+    };
+  // Only a direct publication imperative is executable. References, questions and quoted
+  // historical instructions are not authority; unknown wording never upgrades the mode.
+  const withoutCourtesy = text.replace(/^(?:(?:ok|por favor|agora|please)[, ]+)+/, "");
+  const finalAdjustmentsAndPublish =
+    /^(?:faca|realize|execute)\s+(?:esses|os)\s+(?:ultimos\s+)?(?:ajustes|ajuates)(?:\s+necessarios)?\s+e\s+publique\s+(?:a\s+)?(?:versao\s+)?v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)[.!]?$/.test(
+      withoutCourtesy,
+    );
+  const sequencedDirect =
+    /^primeiro passo entao e corrigir\b[^\n?]*\bfazer merge\b[^\n?]*,\s*fazer deploy\b/.test(
+      withoutCourtesy,
+    ) && !/\b(?:nao|sem)\s+fazer deploy\b/.test(withoutCourtesy);
+  const releaseDirective =
+    /^(?:resolva essas pendencias,\s*)?preciso que crie (?:uma |a )?nova versao\s+v?\d+\.\d+\b/.test(
+      withoutCourtesy,
+    );
+  const proceedToVersion =
+    /^(?:pode\s+)?(?:seguir|continue|avancar)\s+para\s+(?:a\s+)?v\d+\.\d+\b/.test(withoutCourtesy);
+  const proceedWithPublication =
+    /^(?:pode\s+)?(?:seguir|continue|prosseguir)\s+com\s+a\s+publicacao\s+da\s+v\d+\.\d+(?:,\s*fazendo as verificacoes finais necessarias)?(?:[, ]+(?:e\s+)?sem atualizar (?:os\s+)?(?:projetos\s+)?consumidores)?[.!]?$/.test(
+      withoutCourtesy,
+    );
+  const finalAdjustmentsToPublish =
+    /^(?:ativei\s+(?:o\s+hook|os\s+hooks)[, ]+)?(?:faca|realize|execute)\s+(?:as\s+validacoes\s+finais(?:\s+e\s+os\s+ajustes\s+necessarios)?|(?:todos\s+)?os\s+ajustes\s+necessarios)\s+(?:pra|para)\s+publicar\s+(?:a\s+)?v\d+\.\d+\b/.test(
+      withoutCourtesy,
+    );
+  const unit = "zero|um|uma|dois|duas|tres|quatro|cinco|seis|sete|oito|nove";
+  const shortPublication = new RegExp(
+    `^(?:boa, boa\\.\\s*)?(?:eu\\s+)?quero publicar\\s+(?:(?:a\\s+)?versao\\s+)?(?:v?((?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*))|(${unit})\\s+ponto\\s+(${unit}))(?:,?\\s+sim)?\\.?$`,
+  ).exec(withoutCourtesy);
+  const unitValue = {
+    zero: "0",
+    um: "1",
+    uma: "1",
+    dois: "2",
+    duas: "2",
+    tres: "3",
+    quatro: "4",
+    cinco: "5",
+    seis: "6",
+    sete: "7",
+    oito: "8",
+    nove: "9",
+  };
+  const shortPublicationVersion = shortPublication
+    ? (shortPublication[1] ?? `${unitValue[shortPublication[2]]}.${unitValue[shortPublication[3]]}`)
+    : null;
+  const waitsForAuthorization =
+    /\b(?:quando|se|apos|depois)\b[^?]*\b(?:autorizar|aprovar|confirmar|autorizacao|aprovacao|confirmacao)\b/.test(
+      text,
+    );
+  const pendingWorkAndPublish =
+    /^(?:execute|conclua|finalize)\s+o\s+que(?:\s+que)?\s+ficou\s+pendente,\s*atualize\s+(?:as\s+)?documentacoes\s+e\s+publique\s+(?:a\s+)?(?:versao\s+)?v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)[.!]?$/.test(
+      withoutCourtesy,
+    );
+  const approvedAdjustmentsAndPublish =
+    /^pode\s+(?:criar\s+sim\s+e\s+finalize\s+os\s+ajustes\s+e\s+publique\s+(?:a\s+)?v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)|implementar\s+tudo\s+isso\s+e\s+publicar\s+(?:a\s+)?v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)|fazer\s+os\s+ajustes\s+e\s+publicar)[.!]?$/.test(
+      withoutCourtesy,
+    );
+  const finishPendingAndDeploy =
+    /^(?:execute|conclua|finalize)\s+tudo\s+(?:o\s+)?que\s+falta\s+e\s+faca\s+deploy[.!]?$/.test(
+      withoutCourtesy,
+    );
+  const direct =
+    inspection.directPublication ||
+    /^(?:(?:pode|podemos)\s+)?(?:(?:faca|fazer|faz|realize|execute|do)\s+)?(?:o\s+)?(?:deploy|dpeloy|depoly|push|commit|publique|publicar|publish|envie|release|prepare|preparar)\b/.test(
+      withoutCourtesy,
+    ) ||
+    sequencedDirect ||
+    releaseDirective ||
+    proceedToVersion ||
+    proceedWithPublication ||
+    finalAdjustmentsToPublish ||
+    finalAdjustmentsAndPublish ||
+    pendingWorkAndPublish ||
+    approvedAdjustmentsAndPublish ||
+    finishPendingAndDeploy ||
+    implementAndPublish ||
+    continuedPendingPublication ||
+    shortPublicationVersion !== null;
+  if (!direct || (/\?/.test(text) && !implementAndPublish) || waitsForAuthorization)
+    return { authorized: false, reason: "not-a-direct-deployment-request" };
+  // Sending a correction while preserving an already published version is a
+  // commit request. The historical version is not a new release target.
+  const preservePublishedCorrection =
+    /^envie\s+(?:a\s+)?correcao(?:\s+permanente)?\s+ao\s+remoto\b/.test(withoutCourtesy) &&
+    /\bpreservando\s+(?:a\s+)?v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\s+publicada\b/.test(text);
+  assert(
+    !preservePublishedCorrection ||
+      !/\b(?:publique|publicar|crie|criar)\s+(?:(?:a|uma|nova|proxima)\s+)*(?:v\d+\.\d+|release|versao)\b/.test(
+        text,
+      ),
+    "Conflicting publication instructions; no action is authorized",
+  );
+  const noRelease =
+    preservePublishedCorrection ||
+    /\b(?:sem|nao)\s+(?:(?:quero|criar|fazer|publicar|publique|crie|faca)\s+)?(?:(?:um|uma|o|a|novo|nova)\s+)*(?:release|nova versao|proxima versao|versao)\b/.test(
+      text,
+    ) ||
+    /\b(?:apenas|somente|so)\s+(?:(?:os|dos|o)\s+)?(?:commits?|push)\b/.test(text) ||
+    /\bdeploy\s+dos?\s+com{1,2}its?\s+na\s+versao\s+atual\b/.test(text);
+  const releaseTarget =
+    "(?:(?:do|da|de|um|uma|o|a|novo|nova|proximo|proxima|the|new|next)\\s+)*(?:release|versao|version|v\\d+\\.\\d+)";
+  const releaseMention =
+    new RegExp(
+      `\\b(?:deploy|dpeloy|depoly|publique|publicar|publish|release|prepare|preparar)\\s+(?:com\\s+)?${releaseTarget}\\b`,
+    ).test(text) ||
+    /^release\b/.test(withoutCourtesy) ||
+    releaseDirective ||
+    proceedToVersion ||
+    proceedWithPublication ||
+    implementAndPublish ||
+    continuedPendingPublication ||
+    shortPublicationVersion !== null;
+  const nonPublication = text.replace(
+    /\bnao\s+(?:publique|publicar)\s+(?:(?:um|uma|o|a|novo|nova)\s+)*release\b/g,
+    "",
+  );
+  const preparation =
+    /^(?:(?:pode)\s+)?(?:prepare|preparar)\b/.test(withoutCourtesy) ||
+    /\b(?:apenas|somente|so)\s+prepar/.test(text) ||
+    /\b(?:sem publicar|nao publique|nao publicar)\b/.test(nonPublication);
+  const contradictory =
+    noRelease && /\be\s+(?:publique|crie|faca)\s+(?:(?:um|o|novo)\s+)*release\b/.test(text);
+  assert(!contradictory, "Conflicting publication instructions; no action is authorized");
+  const pushOnly =
+    /^(?:(?:pode|podemos)\s+)?(?:(?:faca|fazer|faz|realize|execute|do)\s+)?(?:o\s+)?(?:push|commit)\b/.test(
+      withoutCourtesy,
+    );
+  const versions = [...text.matchAll(/\bv((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?!\d|\.\d)/g)].map(
+    (x) => x[1],
+  );
+  if (releaseDirective)
+    versions.push(/\bpreciso que crie (?:uma |a )?nova versao\s+v?(\d+\.\d+)\b/.exec(text)[1]);
+  if (shortPublicationVersion !== null) versions.push(shortPublicationVersion);
+  assert(new Set(versions).size <= 1, "Conflicting explicit release versions");
+  return {
+    authorized: true,
+    override: noRelease ? "commits" : releaseMention ? "release" : pushOnly ? "commits" : null,
+    version: !noRelease && releaseMention ? (versions[0] ?? null) : null,
+    phase: preparation ? "prepare" : "publish",
+    scope: /\b(?:deploy|push|publicar|publique)\s+(?:de\s+)?tudo\b/.test(text)
+      ? "all-worktree"
+      : "current-work",
+  };
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/git-command.mjs

@@ -0,0 +1,11 @@
+import { spawnSync } from "node:child_process";
+
+export function runCommand(command, args, root, env = process.env) {
+  return spawnSync(command, args, {
+    cwd: root,
+    env,
+    encoding: "utf8",
+    windowsHide: true,
+    timeout: 15000,
+  });
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/git-config-paths.mjs

@@ -0,0 +1,10 @@
+import { resolve } from "node:path";
+
+export function normalizeGitConfigPath(value, insensitive = process.platform === "win32") {
+  const path = resolve(value).replaceAll("\\", "/");
+  return insensitive ? path.toLowerCase() : path;
+}
+
+export function sameGitConfigPath(left, right) {
+  return normalizeGitConfigPath(left) === normalizeGitConfigPath(right);
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/git-destination.mjs

@@ -0,0 +1,21 @@
+// Generated from packages/core/src/authorization/git-destination.ts; sha256=2f4218556f96b33b75b533bd28445a71502add311172d03606d94d1500be0651
+function assertSafeGitDestination(value) {
+  if (typeof value !== "string" || !value || value.length > 4096 || [...value].some((char) => char.charCodeAt(0) < 32))
+    throw Error("Unsafe Git destination metadata");
+  if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(value)) {
+    let url;
+    try {
+      url = new URL(value);
+    } catch {
+      throw Error("Unsafe Git destination metadata");
+    }
+    const authority = value.slice(value.indexOf("://") + 3).split(/[/?#]/)[0] ?? "";
+    const userinfo = authority.includes("@") ? authority.slice(0, authority.lastIndexOf("@")) : null;
+    if (/[?#]/.test(value) || url.password || userinfo !== null && !(url.protocol === "ssh:" && userinfo === "git"))
+      throw Error("Unsafe Git destination metadata");
+  }
+  return value;
+}
+export {
+  assertSafeGitDestination
+};

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/git-push-target.mjs

@@ -0,0 +1,62 @@
+import { assertBoundedGitPush, assertSafeGitDestination, runCommand } from "./deploy-auth.mjs";
+
+/** Read-only final check; named origin is never used by the resulting push. */
+export function assertPublicationPushTarget(repository, { url, sha, ref }, options = {}) {
+  const run = options.run ?? runCommand;
+  const env = options.env ?? process.env;
+  assertSafeGitDestination(url);
+  if (
+    url.startsWith("-") ||
+    !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(sha) ||
+    typeof ref !== "string" ||
+    !ref.startsWith("refs/heads/")
+  )
+    throw Error("Invalid bounded publication target");
+  const read = (args) => {
+    const result = run("git", args, repository, env);
+    if (result.error || result.status !== 0)
+      throw Error("Unable to verify literal publication target");
+    return (result.stdout ?? "").trim();
+  };
+  read(["check-ref-format", ref]);
+  assertBoundedGitPush(repository, { expectedUrl: url, run, env });
+  // Both insteadOf and pushInsteadOf must leave the already resolved target
+  // unchanged. These metadata commands do not contact a remote or alter config.
+  const rewrites = run(
+    "git",
+    ["config", "--null", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"],
+    repository,
+    env,
+  );
+  if (rewrites.error || ![0, 1].includes(rewrites.status))
+    throw Error("Unable to verify Git URL rewrite configuration");
+  const rewritesLiteral = (rewrites.stdout ?? "")
+    .split("\0")
+    .filter(Boolean)
+    .some((record) => {
+      const separator = record.indexOf("\n");
+      if (separator < 0) throw Error("Unable to verify Git URL rewrite configuration");
+      return url.startsWith(record.slice(separator + 1));
+    });
+  if (read(["ls-remote", "--get-url", "--", url]) !== url || rewritesLiteral)
+    throw Error("Git URL rewriting changes the contract-bound literal destination");
+  return { url, sha, ref };
+}
+
+/** No SSH configuration override: preserve the verified folder identity.
+ * Call immediately before execution. Concurrent changes to global Git config
+ * after this last check remain outside an OS-atomic guarantee.
+ */
+export function publicationPushArguments(repository, target, options = {}) {
+  const { url, sha, ref } = assertPublicationPushTarget(repository, target, options);
+  return [
+    "-c",
+    "push.pushOption=",
+    "push",
+    "--no-follow-tags",
+    "--recurse-submodules=no",
+    "--",
+    url,
+    `${sha}:${ref}`,
+  ];
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/git-push-target.test.mjs

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { publicationPushArguments } from "./git-push-target.mjs";
+
+test("pins the exact local destination despite later named-remote, tag and option changes", () => {
+  const parent = mkdtempSync(join(tmpdir(), "zaip-pinned-push-"));
+  const root = join(parent, "repo"),
+    approved = join(parent, "approved.git"),
+    other = join(parent, "other.git");
+  const env = {
+    ...process.env,
+    GIT_CONFIG_GLOBAL: join(parent, "empty-global"),
+    GIT_CONFIG_NOSYSTEM: "1",
+  };
+  const git = (...args) =>
+    spawnSync("git", args, { cwd: root, env, encoding: "utf8", windowsHide: true });
+  const checked = (...args) => {
+    const result = git(...args);
+    assert.equal(result.status, 0, result.stderr);
+    return result.stdout.trim();
+  };
+  try {
+    mkdirSync(root);
+    checked("init", "-b", "main");
+    checked("config", "user.name", "Fixture");
+    checked("config", "user.email", "fixture@example.invalid");
+    checked("commit", "--allow-empty", "-m", "fixture");
+    checked("init", "--bare", approved);
+    checked("init", "--bare", other);
+    checked("remote", "add", "origin", approved);
+    const sha = checked("rev-parse", "HEAD"),
+      target = { url: approved, sha, ref: "refs/heads/main" };
+    const args = publicationPushArguments(root, target, {
+      env,
+      run: (command, argv) => {
+        const result = spawnSync(command, argv, {
+          cwd: root,
+          env,
+          encoding: "utf8",
+          windowsHide: true,
+        });
+        if (!argv.includes("config")) assert.equal(result.status, 0, result.stderr);
+        return result;
+      },
+    });
+    checked("remote", "set-url", "origin", other);
+    checked("tag", "-a", "extra-tag", "-m", "must not publish");
+    checked("config", "push.followTags", "true");
+    checked("config", "push.recurseSubmodules", "on-demand");
+    checked("config", "push.pushOption", "must-not-send");
+    // Bare receive without push-option support rejects even one empty option;
+    // successful push proves the empty command-scope value resets the list.
+    checked(...args);
+    assert.equal(checked("--git-dir", approved, "rev-parse", "refs/heads/main"), sha);
+    assert.equal(checked("--git-dir", approved, "tag", "--list"), "");
+    assert.notEqual(git("--git-dir", other, "rev-parse", "refs/heads/main").status, 0);
+    checked("remote", "set-url", "origin", approved);
+    checked("config", "--unset", "push.followTags");
+    checked("config", "--unset", "push.recurseSubmodules");
+    checked("config", "--unset-all", "push.pushOption");
+    checked("config", `url.${other}.pushInsteadOf`, approved);
+    assert.throws(() => publicationPushArguments(root, target, { env }), /rewrit|destination/);
+    assert.throws(
+      () => publicationPushArguments(root, { ...target, url: "-receive-pack=bad" }, { env }),
+      /Invalid/,
+    );
+    assert.throws(
+      () => publicationPushArguments(root, { ...target, ref: "refs/heads/a..b" }, { env }),
+      /verify/,
+    );
+  } finally {
+    rmSync(parent, { recursive: true, force: true, maxRetries: 3 });
+  }
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/github-deploy-contract.test.mjs

@@ -72,7 +72,7 @@ test("deploy guidance preserves canonical Task identity and builder-versus-consu
   assert.match(workflow, /Preserve trabalho, index, causalidade, SHA, integridade e autorização/);
 });
 
-test("framework deploy follows Release-triggered npm publication without claiming partial success", async () => {
+test("framework deploy retains manual npm publication without claiming partial success", async () => {
   const [skill, workflow, lock] = await Promise.all([
     readFile(resolve(skillRoot, "SKILL.md"), "utf8"),
     readFile(resolve(skillRoot, "references", "deployment-workflow.md"), "utf8"),
@@ -83,7 +83,9 @@ test("framework deploy follows Release-triggered npm publication without claimin
       resolve(root, "..", ".github", "workflows", "publish-cli.yml"),
       "utf8",
     );
-    assert.match(publishWorkflow, /release:\s*\n\s*types: \[published\]/);
+    assert.match(publishWorkflow, /^on:\s*\n\s{2}workflow_dispatch:/m);
+    assert.doesNotMatch(publishWorkflow, /^\s{2}(?:release|push):/m);
+    assert.match(publishWorkflow, /needs\.resolve-candidate\.outputs\.validation_mode != 'local'/);
     assert.match(publishWorkflow, /npm publish /);
   }
   assert.match(skill, /publish-cli\.yml.*registry version, dist-tag and integrity/s);