@zaip-ai/cli 6.2.0 → 7.5.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/project-restrictions.mjs

@@ -0,0 +1,201 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { join, resolve } from "node:path";
+
+const POLICY = ".agents/config/publication-restrictions.json";
+const LIMIT = 256 * 1024;
+const choices = Object.freeze({
+  git_transport: "ssh-only",
+  github_api: "forbidden",
+  release: "forbidden",
+  sql: "forbidden",
+  validation_environment: "production-only",
+});
+const assert = (value, message) => {
+  if (!value) throw new Error(message);
+};
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export const POLICY_PATH = ".agents/config/deploy-policy.json";
+export const DEFAULT_POLICY = Object.freeze({
+  schema_version: 1,
+  default_mode: "auto",
+  default_scope: "current-work",
+});
+
+export function validatePolicy(policy = DEFAULT_POLICY) {
+  assert(policy && typeof policy === "object" && !Array.isArray(policy), "Invalid deploy policy");
+  assert(
+    Object.keys(policy).every((k) =>
+      ["schema_version", "default_mode", "default_scope"].includes(k),
+    ),
+    "Unsupported deploy policy field",
+  );
+  assert(
+    policy.schema_version === 1 &&
+      ["auto", "commits", "release"].includes(policy.default_mode) &&
+      policy.default_scope === "current-work",
+    "Invalid deploy policy; scope must be current-work",
+  );
+  return { ...policy };
+}
+const identity = (path) =>
+  process.platform === "win32" ? resolve(path).toLowerCase() : resolve(path);
+const object = (value) =>
+  value !== null &&
+  typeof value === "object" &&
+  !Array.isArray(value) &&
+  [null, Object.prototype].includes(Object.getPrototypeOf(value));
+const freeze = (value) => Object.freeze(value);
+
+/** Neutral values impose no additional restriction. No value can grant an action. */
+export function validateProjectRestrictions(policy) {
+  if (policy === undefined) policy = { schema_version: 1 };
+  assert(
+    object(policy) &&
+      Object.keys(policy).every((key) =>
+        ["schema_version", "constraints", "rule_sources"].includes(key),
+      ) &&
+      policy.schema_version === 1,
+    "Invalid publication restrictions policy",
+  );
+  const input = policy.constraints === undefined ? {} : policy.constraints;
+  assert(
+    object(input) && Object.keys(input).every((key) => Object.hasOwn(choices, key)),
+    "Unsupported publication restriction constraint",
+  );
+  const constraints = {};
+  for (const [key, restricted] of Object.entries(choices)) {
+    const value = Object.hasOwn(input, key) ? input[key] : "default";
+    assert(
+      value === "default" || value === restricted,
+      `Invalid deny-only publication constraint: ${key}`,
+    );
+    constraints[key] = value;
+  }
+  const refs = policy.rule_sources === undefined ? [] : policy.rule_sources;
+  assert(
+    Array.isArray(refs) && refs.length <= 32,
+    "Publication Rule references exceed the bounded limit",
+  );
+  const seen = new Set();
+  const rule_sources = refs.map((ref) => {
+    assert(
+      object(ref) &&
+        Object.keys(ref).length === 2 &&
+        Object.hasOwn(ref, "path") &&
+        Object.hasOwn(ref, "sha256"),
+      "Invalid publication Rule reference",
+    );
+    assert(
+      typeof ref.path === "string" &&
+        ref.path.length <= 240 &&
+        /^\.agents\/rules\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+\.md$/.test(ref.path),
+      "Unsafe publication Rule reference path",
+    );
+    assert(
+      typeof ref.sha256 === "string" && /^[a-f0-9]{64}$/.test(ref.sha256),
+      "Invalid publication Rule digest",
+    );
+    const key = process.platform === "win32" ? ref.path.toLowerCase() : ref.path;
+    assert(!seen.has(key), "Duplicate publication Rule reference");
+    seen.add(key);
+    return freeze({ path: ref.path, sha256: ref.sha256 });
+  });
+  return freeze({ constraints: freeze(constraints), rule_sources: freeze(rule_sources) });
+}
+
+// JSON.parse establishes syntax; this second pass rejects ambiguous duplicate keys.
+function parsePolicy(bytes) {
+  const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  const parsed = JSON.parse(text),
+    stack = [];
+  const tokens = /"(?:\\[\s\S]|[^"\\])*"|[{}[\]:,]/g;
+  for (const match of text.matchAll(tokens)) {
+    const token = match[0];
+    if (token === "{") stack.push(new Set());
+    else if (token === "[") stack.push(null);
+    else if (token === "}" || token === "]") stack.pop();
+    else if (token.startsWith('"') && /^\s*:/.test(text.slice(match.index + token.length))) {
+      const keys = stack.at(-1),
+        key = JSON.parse(token);
+      assert(keys instanceof Set && !keys.has(key), "Duplicate publication policy object key");
+      keys.add(key);
+    }
+  }
+  return parsed;
+}
+
+async function physicalFile(root, relative, optional = false) {
+  const segments = relative.split("/");
+  let path = root;
+  for (const [index, segment] of segments.entries()) {
+    path = join(path, segment);
+    let info;
+    try {
+      info = await lstat(path);
+    } catch (error) {
+      if (optional && error?.code === "ENOENT") return null;
+      throw error;
+    }
+    assert(!info.isSymbolicLink(), "Publication restriction paths cannot follow links");
+    if (index < segments.length - 1)
+      assert(info.isDirectory(), "Publication restriction ancestor must be a directory");
+    else {
+      assert(
+        info.isFile() && info.nlink === 1 && info.size <= LIMIT,
+        "Publication restriction must be a bounded physical file without aliases",
+      );
+      assert(
+        identity(await realpath(path)) === identity(path),
+        "Publication restriction physical path changed",
+      );
+      return { path, info };
+    }
+  }
+}
+
+async function boundedRead(root, path, optional = false) {
+  const before = await physicalFile(root, path, optional);
+  if (!before) return null;
+  const bytes = await readFile(before.path);
+  assert(bytes.length <= LIMIT, "Publication restriction exceeds bounded file size");
+  const after = await physicalFile(root, path);
+  assert(
+    before.info.dev === after.info.dev &&
+      before.info.ino === after.info.ino &&
+      before.info.size === after.info.size &&
+      before.info.mtimeMs === after.info.mtimeMs &&
+      before.info.ctimeMs === after.info.ctimeMs,
+    "Publication restriction changed while reading",
+  );
+  return bytes;
+}
+
+/** Re-read on every publication recheck. Missing policy is explicit and never means human authorization. */
+export async function readProjectRestrictions(repository) {
+  const root = resolve(repository),
+    info = await lstat(root);
+  assert(
+    info.isDirectory() &&
+      !info.isSymbolicLink() &&
+      identity(await realpath(root)) === identity(root),
+    "Publication restrictions require a physical repository root",
+  );
+  const bytes = await boundedRead(root, POLICY, true);
+  const normalized = validateProjectRestrictions(bytes === null ? undefined : parsePolicy(bytes));
+  for (const ref of normalized.rule_sources) {
+    const rule = await boundedRead(root, ref.path);
+    assert(
+      digest(rule) === ref.sha256,
+      "Publication Rule digest changed; refresh the reviewed policy before publishing",
+    );
+  }
+  // Detect policy drift during Rule verification rather than return a mixed snapshot.
+  const verified = await boundedRead(root, POLICY, true);
+  assert(
+    (bytes === null && verified === null) ||
+      (bytes !== null && verified !== null && bytes.equals(verified)),
+    "Publication restrictions changed during verification",
+  );
+  return freeze({ ...normalized, policy_sha256: bytes === null ? null : digest(bytes) });
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/project-restrictions.test.mjs

@@ -0,0 +1,154 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { link, mkdir, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import test from "node:test";
+import { readProjectRestrictions, validateProjectRestrictions } from "./project-restrictions.mjs";
+
+const hash = (text) => createHash("sha256").update(text).digest("hex");
+async function fixture(t) {
+  const root = await mkdtemp(join(tmpdir(), "zaip-restrictions-"));
+  t.after(() => rm(root, { recursive: true, force: true, maxRetries: 5 }));
+  const write = async (path, value) => {
+    const target = join(root, path);
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(target, value);
+    return target;
+  };
+  const policy = (value) =>
+    write(
+      ".agents/config/publication-restrictions.json",
+      typeof value === "string" || Buffer.isBuffer(value) ? value : JSON.stringify(value),
+    );
+  return { root, write, policy };
+}
+
+test("missing policy is explicitly neutral, frozen and grants nothing", async (t) => {
+  const f = await fixture(t),
+    result = await readProjectRestrictions(f.root);
+  assert.equal(result.policy_sha256, null);
+  assert.deepEqual(result.rule_sources, []);
+  assert.ok(Object.values(result.constraints).every((value) => value === "default"));
+  assert.ok(Object.isFrozen(result) && Object.isFrozen(result.constraints));
+  assert.deepEqual(validateProjectRestrictions().constraints, result.constraints);
+});
+
+test("strict deny-only constraints normalize without interpreting Rule prose", () => {
+  const constraints = {
+    git_transport: "ssh-only",
+    github_api: "forbidden",
+    release: "forbidden",
+    sql: "forbidden",
+    validation_environment: "production-only",
+  };
+  assert.deepEqual(
+    validateProjectRestrictions({ schema_version: 1, constraints }).constraints,
+    constraints,
+  );
+  for (const policy of [
+    null,
+    [],
+    {},
+    { schema_version: 2 },
+    { schema_version: 1, grant: true },
+    { schema_version: 1, constraints: { sql: "allowed" } },
+    { schema_version: 1, constraints: { deploy: "authorized" } },
+    { schema_version: 1, constraints: null },
+  ])
+    assert.throws(() => validateProjectRestrictions(policy));
+});
+
+test("hashes actual raw policy and revalidates exact Rule bytes on each read", async (t) => {
+  const f = await fixture(t),
+    rule = "# SSH only\n",
+    ref = { path: ".agents/rules/publication.md", sha256: hash(rule) };
+  await f.write(ref.path, rule);
+  const input = {
+    schema_version: 1,
+    constraints: { git_transport: "ssh-only" },
+    rule_sources: [ref],
+  };
+  const raw = JSON.stringify(input);
+  await f.policy(raw);
+  const first = await readProjectRestrictions(f.root);
+  assert.equal(first.policy_sha256, hash(raw));
+  assert.deepEqual(first.rule_sources, [ref]);
+  await f.policy(`${raw}\n`);
+  assert.notEqual((await readProjectRestrictions(f.root)).policy_sha256, first.policy_sha256);
+  await f.write(ref.path, `${rule}Changed\n`);
+  await assert.rejects(readProjectRestrictions(f.root), /digest changed/);
+});
+
+test("rejects traversal, foreign paths, duplicate refs and malformed digests", () => {
+  for (const path of [
+    "../secret",
+    ".agents/rules/../../secret.md",
+    "C:/secret.md",
+    ".agents/rules/link/../rule.md",
+    ".agents\\rules\\rule.md",
+    ".agents/config/rule.md",
+  ])
+    assert.throws(() =>
+      validateProjectRestrictions({
+        schema_version: 1,
+        rule_sources: [{ path, sha256: "a".repeat(64) }],
+      }),
+    );
+  const ref = { path: ".agents/rules/a.md", sha256: "a".repeat(64) };
+  assert.throws(() => validateProjectRestrictions({ schema_version: 1, rule_sources: [ref, ref] }));
+  assert.throws(() =>
+    validateProjectRestrictions({ schema_version: 1, rule_sources: [{ ...ref, sha256: "bad" }] }),
+  );
+  assert.throws(() =>
+    validateProjectRestrictions({ schema_version: 1, rule_sources: Array(33).fill(ref) }),
+  );
+});
+
+test("rejects ambiguous JSON, invalid UTF8 and oversized policy or Rule files", async (t) => {
+  const f = await fixture(t);
+  for (const raw of [
+    '{"schema_version":1,"schema_version":1}',
+    '{"schema_version":1,"constraints":{"sql":"forbidden","sql":"default"}}',
+    "{",
+  ]) {
+    await f.policy(raw);
+    await assert.rejects(readProjectRestrictions(f.root));
+  }
+  await f.policy(Buffer.from([0xff]));
+  await assert.rejects(readProjectRestrictions(f.root));
+  await f.policy(" ".repeat(256 * 1024 + 1));
+  await assert.rejects(readProjectRestrictions(f.root), /bounded/);
+  const path = ".agents/rules/large.md",
+    rule = "a".repeat(256 * 1024 + 1);
+  await f.write(path, rule);
+  await f.policy({ schema_version: 1, rule_sources: [{ path, sha256: hash(rule) }] });
+  await assert.rejects(readProjectRestrictions(f.root), /bounded/);
+});
+
+test("refuses hardlinked policy and Rule files", async (t) => {
+  const f = await fixture(t),
+    policy = await f.policy({ schema_version: 1 });
+  await link(policy, join(f.root, "policy-alias.json"));
+  await assert.rejects(readProjectRestrictions(f.root), /aliases/);
+  await rm(join(f.root, "policy-alias.json"));
+  const path = ".agents/rules/policy.md",
+    text = "Rule\n",
+    rule = await f.write(path, text);
+  await f.policy({ schema_version: 1, rule_sources: [{ path, sha256: hash(text) }] });
+  await link(rule, join(f.root, "rule-alias.md"));
+  await assert.rejects(readProjectRestrictions(f.root), /aliases/);
+});
+
+test("refuses symlinked ancestors instead of reading outside the repository", async (t) => {
+  const f = await fixture(t),
+    outside = await fixture(t);
+  await outside.write("publication-restrictions.json", '{"schema_version":1}');
+  await mkdir(join(f.root, ".agents"));
+  await symlink(
+    outside.root,
+    join(f.root, ".agents/config"),
+    process.platform === "win32" ? "junction" : "dir",
+  );
+  await assert.rejects(readProjectRestrictions(f.root), /links/);
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/publication-authority-callbacks.test.mjs

@@ -0,0 +1,46 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { resolveDeployment } from "./deploy-contract.mjs";
+import { guardedCommits } from "./guarded-commits.mjs";
+
+test("injected reads and destination callbacks cannot authorize a commit publication effect", async () => {
+  const root = await mkdtemp(join(tmpdir(), "zaip-publication-callback-"));
+  let effects = 0;
+  execFileSync("git", ["init", "--quiet"], { cwd: root, windowsHide: true });
+  const current = {
+    request: "Faça deploy.",
+    identity: { origin: "git@github.com:fixture/project.git", rootName: "fixture" },
+  };
+  const input = {
+    repository: root,
+    request: current.request,
+    plan: resolveDeployment(current),
+    sha: "a".repeat(40),
+    branch: "main",
+    checks: [{ command: "node", args: ["harness.mjs"] }],
+  };
+  try {
+    await assert.rejects(
+      guardedCommits(input, {
+        readInput: async () => current,
+        destination: () => {},
+        identity: () => {},
+        branchFor: () => "main",
+        checks: async () => {},
+        preflight: async () => {},
+        push: async () => {
+          effects++;
+          throw Error("fixture_reached_push_without_native_authority");
+        },
+      }),
+      /publication_native_capability_missing|exact_source_run|required.*native/i,
+    );
+    assert.equal(effects, 0);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/publication-conditions.mjs

@@ -0,0 +1,193 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { inspectPublicationIntent } from "./publication-intent.mjs";
+import { unsupportedConditionReason } from "./publication-plan-refusal.mjs";
+import {
+  assertNativePublicationAuthority,
+  parsePublicationValidation,
+  readPublicationCanonicalRecord,
+  readPublicationCanonicalRun,
+} from "./publication-proof-schema.mjs";
+import { parseDocument } from "./yaml-parser.mjs";
+
+const verified = new WeakSet();
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const canonical = (value) => value.replace(/\r\n?/g, "\n").trim().normalize("NFC");
+const fail = (reason) => {
+  throw Error(`publication_condition_${reason}`);
+};
+const identity = (path) =>
+  process.platform === "win32" ? resolve(path).toLowerCase() : resolve(path);
+
+/** Loads exact canonical locators; JSON input can name evidence, never assert success. */
+export async function resolvePublicationCondition(repository, request, locator, nativeAuthority) {
+  const inspection = inspectPublicationIntent(request);
+  if (inspection.condition === null) {
+    if (locator) fail("unexpected");
+    return undefined;
+  }
+  if (inspection.condition !== "tests_passed") fail(unsupportedConditionReason(request));
+  if (!locator) fail("proof_required");
+  assertNativePublicationAuthority(nativeAuthority, request);
+  if (locator.authorization_run_id !== nativeAuthority.source_run_id) fail("authority_mismatch");
+  const root = realpathSync(repository);
+  const git = (args) =>
+    execFileSync("git", args, {
+      cwd: root,
+      encoding: "utf8",
+      windowsHide: true,
+      timeout: 15000,
+    }).trim();
+  if (identity(git(["rev-parse", "--show-toplevel"])) !== identity(root))
+    fail("repository_mismatch");
+  const read = (path, sourceRoot) => {
+    const absolute = resolve(sourceRoot, path),
+      scope = relative(sourceRoot, absolute),
+      stat = lstatSync(absolute);
+    if (
+      isAbsolute(scope) ||
+      scope.startsWith("..") ||
+      !stat.isFile() ||
+      stat.isSymbolicLink() ||
+      stat.size > 1048576 ||
+      identity(realpathSync(absolute)) !== identity(absolute)
+    )
+      fail("unsafe_evidence");
+    return readFileSync(absolute, "utf8");
+  };
+  const metadata = (path, sourceRoot) => {
+    const text = read(path, sourceRoot).replace(/\r\n/g, "\n"),
+      front = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(text);
+    if (!front) fail("invalid_evidence");
+    const document = parseDocument(front[1], { strict: true, uniqueKeys: true });
+    if (document.errors.length) fail("invalid_evidence");
+    return { value: document.toJS(), text };
+  };
+  const task = (await readPublicationCanonicalRecord(root, "task", locator.task_id)).value;
+  if (
+    task.id !== locator.task_id ||
+    task.schema_version !== 2 ||
+    !["executing", "verifying", "blocked"].includes(task.status)
+  )
+    fail("task_mismatch");
+  const changeRecord = await readPublicationCanonicalRecord(root, "change", task.change_id);
+  const changePath = dirname(changeRecord.path).replaceAll("\\", "/"),
+    executionId = task.plan_ref?.execution_id ?? task.prepared_plan?.execution_id;
+  const change = changeRecord.value;
+  if (
+    change.schema_version !== 2 ||
+    change.id !== task.change_id ||
+    !["executing", "verifying"].includes(change.status) ||
+    !change.task_ids?.includes(task.id)
+  )
+    fail("change_mismatch");
+  const execution = (await readPublicationCanonicalRecord(root, "execution", executionId)).value;
+  if (
+    execution.schema_version !== 2 ||
+    execution.id !== executionId ||
+    execution.kind !== "delivery" ||
+    !["running", "verifying", "blocked"].includes(execution.status) ||
+    !execution.dag?.nodes?.some(
+      (node) => node.task_id === task.id && node.change_id === task.change_id,
+    )
+  )
+    fail("execution_mismatch");
+  if (!/^TEST-[A-Z0-9]+(?:-[A-Z0-9]+)*$/.test(locator.validation_id ?? "")) fail("invalid_locator");
+  const evidence = metadata(
+      `${changePath}/artifacts/tests/${locator.validation_id}.md`,
+      changeRecord.source_root,
+    ),
+    artifact = parsePublicationValidation(evidence.value),
+    candidate = artifact.candidate_execution;
+  if (
+    artifact.schema_version !== 2 ||
+    artifact.id !== locator.validation_id ||
+    artifact.kind !== "test" ||
+    artifact.status !== "passed" ||
+    artifact.task_id !== task.id ||
+    artifact.change_id !== task.change_id ||
+    artifact.execution_id !== executionId ||
+    !candidate ||
+    candidate.protocol !== "committed_node_harness_v1" ||
+    candidate.exit_code !== 0 ||
+    !Array.isArray(artifact.acceptance_ids) ||
+    !Array.isArray(task.acceptance_ids) ||
+    !task.acceptance_ids.length ||
+    !task.acceptance_ids.every((id) => artifact.acceptance_ids.includes(id)) ||
+    !Number.isFinite(Date.parse(artifact.executed_at)) ||
+    Date.parse(artifact.executed_at) > Date.now() ||
+    (task.started_at && Date.parse(artifact.executed_at) < Date.parse(task.started_at))
+  )
+    fail("evidence_mismatch");
+  const author = await readPublicationCanonicalRun(root, artifact.run_id),
+    authority = await readPublicationCanonicalRun(root, locator.authorization_run_id);
+  const currentAuthority = await readPublicationCanonicalRun(root, nativeAuthority.current_run_id);
+  if (
+    authority.start.client_thread_id !== nativeAuthority.client_thread_id ||
+    authority.start.client_turn_id !== nativeAuthority.client_turn_id ||
+    authority.start.attribution_status !== "attributed"
+  )
+    fail("host_context");
+  for (const value of [author.start, authority.start, currentAuthority.start])
+    if (
+      value.task_id !== task.id ||
+      value.change_id !== task.change_id ||
+      value.execution_id !== executionId
+    )
+      fail("run_mismatch");
+  if (
+    (author.terminal && author.terminal.status !== "completed") ||
+    currentAuthority.terminal ||
+    currentAuthority.finalizing ||
+    (authority.terminal && nativeAuthority.current_run_id === nativeAuthority.source_run_id) ||
+    authority.start.parent_run_id !== null ||
+    authority.start.run_role !== "orchestrator" ||
+    authority.start.execution_kind !== "delivery" ||
+    canonical(authority.start.direct_execution_authorization ?? "") !== canonical(request)
+  )
+    fail("authority_mismatch");
+  const sha = git(["rev-parse", "HEAD"]);
+  if (
+    sha !== artifact.commit_sha ||
+    sha !== candidate.commit_sha ||
+    git(["rev-parse", "HEAD^{tree}"]) !== candidate.tree_sha ||
+    !candidate.harness_path ||
+    git(["rev-parse", `HEAD:${candidate.harness_path}`]) !== candidate.harness_blob_sha
+  )
+    fail("candidate_drift");
+  const changed = [
+    git(["diff", "--no-ext-diff", "--no-textconv", "--name-only", "HEAD", "--"]),
+    git(["ls-files", "--others", "--exclude-standard"]),
+  ]
+    .join("\n")
+    .split(/\r?\n/)
+    .filter(Boolean);
+  if (changed.some((path) => !path.startsWith(".agents/records/") && !path.startsWith(".local/")))
+    fail("candidate_drift");
+  const proof = Object.freeze({
+    repository: root,
+    action: inspection.action,
+    request_sha256: hash(canonical(request)),
+    task_id: task.id,
+    validation_id: artifact.id,
+    authorization_run_id: authority.start.run_id,
+    validation_sha256: hash(evidence.text),
+    commit_sha: sha,
+  });
+  verified.add(proof);
+  return proof;
+}
+
+export function provenPublicationAction(request, proof) {
+  const inspection = inspectPublicationIntent(request);
+  if (inspection.condition === "unsupported") fail(unsupportedConditionReason(request));
+  if (inspection.condition === null) {
+    if (proof) fail("unexpected");
+    return request;
+  }
+  if (!proof || !verified.has(proof) || proof.request_sha256 !== hash(canonical(request)))
+    fail("proof_required");
+  return proof.action;
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/publication-intent.mjs

@@ -0,0 +1,76 @@
+// Generated from packages/core/src/authorization/publication-intent.ts; sha256=72ffe2de36705c3947d4f7436dad1f853318741eb7c97741dadb2533aeb595ec
+/** Intent only: this parser never proves a condition or grants publication. */
+export function inspectPublicationIntent(source) {
+  const text = source
+    .normalize("NFKD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .toLowerCase()
+    .replace(/\s+/g, " ")
+    .trim();
+  const bounded = "se (?:os )?testes (?:passarem|forem aprovados)";
+  const prefix = new RegExp(`^${bounded},?\\s+(.+)$`).exec(text);
+  const suffix = new RegExp(`^(.+?),?\\s+${bounded}[.!]?$`).exec(text);
+  const action = prefix?.[1] ?? suffix?.[1] ?? text;
+  // An idempotent request names both distribution surfaces and repeats the
+  // exact release in its imperative. Unknown conditions and scopes stay closed.
+  const incomplete =
+    /^se a v((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)) ainda nao foi publicada no github ou no npm,\s*(?:(?:faca os ajustes necessarios|remova os bloqueios|mude o que for necessario para corrigir problemas de deploy)(?:,\s*| e ))*(?:faca (?:o )?deploy|garanta que seja finalizado o deploy) da v\1[.!]?$/.exec(
+      text,
+    );
+  const idempotentCheck =
+    /^(?:revise|verifique|confira) se (?:ja )?foi feito (?:o )?deploy, caso contrario faca deploy(?: (?:da|de) v?(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))?[.!]?$/.test(
+      text,
+    ) ||
+    /^(?:revise|verifique|confira) se (?:ja )?foi feito (?:o )?deploy (?:da|de) v?(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)[.!] se ainda nao, faca os ajustes necessarios para realizar o deploy corretamente[.!] garanta que o deploy seja feito[.!]?$/.test(
+      text,
+    );
+  const explanatorySuffix = /^faca deploy e explique quando devo pedir release[.!]?$/.test(text);
+  // This exact existing review imperative asks whether adjustments were made;
+  // its "se" is not a conditional grant. Any added condition breaks the match.
+  const reviewedAdjustments =
+    /^revise se todos os ajustes foram realizados corretamente, faca os ajustes finais e publique na versao (?:0|[1-9]\d*)\.(?:0|[1-9]\d*)[.!]?$/.test(
+      text,
+    );
+  const condition =
+    prefix || suffix
+      ? "tests_passed"
+      : /\b(?:se|if|quando|caso|desde que|a menos que|unless|after|when|once|provided|assuming|apos|depois|condicionado)\b/.test(
+            text,
+          ) &&
+          !idempotentCheck &&
+          !incomplete &&
+          !reviewedAdjustments &&
+          !explanatorySuffix
+        ? "unsupported"
+        : null;
+  // A no-release override still allows the separate commits-only route.
+  const restricted = action.replace(
+    /\b(?:nao\s+(?:publique|publicar)|sem\s+publicar)\s+(?:(?:um|uma|o|a|novo|nova)\s+)*release\b/g,
+    "",
+  );
+  const publicationDenied =
+    /\b(?:nao|nunca|jamais|never|do not|dont|don't)\s+(?:(?:faca|fazer|faz|realize|execute|efetue|de|do|perform)\s+)?(?:o\s+)?(?:deploy|push|commit|publique|publicar|publish|publication|envie|suba)\b|\bsem\s+(?:fazer\s+)?(?:o\s+)?(?:deploy|push|commit|publicar|publicacao)\b/.test(
+      restricted,
+    );
+  const directPublication =
+    /^resolva\s+tudo\s+(?:o\s+)?que\s+e\s+(?:preciso|necessario)\s+ate\s+fazer\s+(?:o\s+)?deploy\s+(?:da|de)\s+v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)[.!]?$/.test(
+      action,
+    ) ||
+    /^(?:(?:por favor|please),?\s+)?(?:(?:pode|favor)\s+)?(?:(?:faca|fazer|faz|realize|execute|do)\s+)?(?:o\s+)?(?:deploy|push|commit|publique|publicar|publish|envie|release)\b/.test(
+      action,
+    );
+  const untrusted =
+    source.includes("?") ||
+    /[`"'“”<>]/.test(source) ||
+    /\b(?:disse|citou|exemplo|quoted|said|talvez|maybe|hipoteticamente|hypothetically)\b/.test(
+      text,
+    );
+  return {
+    action,
+    condition,
+    publicationDenied,
+    directPublication,
+    untrusted,
+    ...(incomplete ? { incompleteReleaseVersion: incomplete[1] } : {}),
+  };
+}