@zaip-ai/cli 6.3.0 → 7.5.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-auth.mjs

@@ -0,0 +1,400 @@
+import { runCommand } from "./git-command.mjs";
+
+export { runCommand } from "./git-command.mjs";
+
+import { randomUUID } from "node:crypto";
+import { chmodSync, copyFileSync, existsSync, lstatSync, readdirSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import { normalizeGitConfigPath as normalize } from "./git-config-paths.mjs";
+import { assertSafeGitDestination } from "./git-destination.mjs";
+
+export { assertSafeGitDestination } from "./git-destination.mjs";
+
+const fail = (message) => {
+  throw new Error(message);
+};
+const portable = (value) => value.replaceAll("\\", "/");
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+export const ghHelper = "!gh auth git-credential";
+export function sameGitDestination(left, right) {
+  assertSafeGitDestination(left);
+  assertSafeGitDestination(right);
+  if (left === right) return true;
+  try {
+    return githubTarget(left).toLowerCase() === githubTarget(right).toLowerCase();
+  } catch {
+    return false;
+  }
+}
+/** Read effective destinations, not merely the first configured push URL. */
+export function assertBoundedGitPush(
+  repository,
+  { expectedUrl, remote = "origin", run = runCommand, env = process.env } = {},
+) {
+  if (remote !== "origin") fail("Only the contract-bound origin remote is authorized");
+  const read = (args, missing = false) => {
+    const result = run("git", args, repository, env);
+    if (missing && result.status === 1) return "";
+    if (result.error || result.status !== 0)
+      fail("Unable to verify bounded Git publication configuration");
+    return (result.stdout ?? "").trim();
+  };
+  const urls = (args) => read(args).split(/\r?\n/).filter(Boolean);
+  const push = urls(["remote", "get-url", "--push", "--all", remote]);
+  const fetch = urls(["remote", "get-url", "--all", remote]);
+  if (
+    push.length !== 1 ||
+    fetch.length !== 1 ||
+    !sameGitDestination(push[0], fetch[0]) ||
+    (expectedUrl && push[0] !== expectedUrl)
+  )
+    fail("Publication requires exactly one contract-bound fetch/push destination");
+  for (const key of ["push.followTags", "push.recurseSubmodules", "remote.origin.mirror"]) {
+    const value = read(["config", "--get", key], true).toLowerCase();
+    if (value && !["false", "no", "off", "0"].includes(value))
+      fail(`Implicit ${key} is outside the bounded publication contract`);
+  }
+  const pushOptions = run("git", ["config", "--get-all", "push.pushOption"], repository, env);
+  if (pushOptions.error || ![0, 1].includes(pushOptions.status))
+    fail("Unable to verify implicit Git push options");
+  if (pushOptions.status === 0)
+    fail("Implicit push options are outside the bounded publication contract");
+  return push[0];
+}
+
+function regular(path) {
+  if (!existsSync(path)) return false;
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || !stat.isFile())
+    fail("SSH candidate must be a regular file, not a link");
+  return true;
+}
+function directories(base) {
+  return [
+    base,
+    resolve(base, ".ssh"),
+    resolve(base, "ssh"),
+    resolve(base, ".agents/private/state/ssh"),
+  ].filter((path) => {
+    if (!existsSync(path)) return false;
+    if (realpathSync(path) !== resolve(path))
+      fail("SSH discovery directory redirects outside its declared path");
+    return lstatSync(path).isDirectory();
+  });
+}
+export function configuredIdentity(command, repository) {
+  const match = /(?:^|\s)-i(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/.exec(command);
+  if (!match) return null;
+  const value = match[1] ?? match[2] ?? match[3];
+  if (/[\r\n\0]/.test(value) || value.startsWith("~"))
+    fail("SSH identity must use an unambiguous absolute or repository-relative path");
+  return resolve(repository, value);
+}
+/** Only filenames/stat metadata; never read private-key or dotenv contents. */
+export function discoverIdentity(repository, configured = null, configuredTier = null) {
+  const root = realpathSync(repository);
+  for (const [tier, base] of [
+    ["repository", root],
+    ["parent", dirname(root)],
+  ]) {
+    const candidates = new Set();
+    const dirs = directories(base);
+    if (configured && (configuredTier === tier || dirs.includes(dirname(configured)))) {
+      if (!regular(configured))
+        fail("Configured folder SSH identity is missing; repair it before fallback");
+      candidates.add(configured);
+    }
+    for (const dir of dirs)
+      for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const name = entry.name.endsWith(".pub")
+          ? entry.name.slice(0, -4)
+          : /^(id_ed25519|id_ecdsa|id_rsa|id_ed25519_sk|id_ecdsa_sk)$/.test(entry.name)
+            ? entry.name
+            : null;
+        if (name && regular(resolve(dir, name))) candidates.add(resolve(dir, name));
+      }
+    if (!candidates.size) continue;
+    const key =
+      configured && candidates.has(configured)
+        ? configured
+        : candidates.size === 1
+          ? [...candidates][0]
+          : null;
+    if (!key)
+      fail(`Multiple SSH keys in ${tier}; select one with repository-local core.sshCommand -i`);
+    return { method: "ssh", source: tier, identity_file: key };
+  }
+  if (configured)
+    fail(
+      "Existing SSH identity is outside repository/parent discovery scope; reconcile explicitly",
+    );
+  return { method: "github-cli", source: "fallback", identity_file: null };
+}
+// Follow only an explicit local or exact repository/parent includeIf reference.
+// The key can remain in a protected home directory; no home directory is scanned.
+function configuredFolder(invoke, root) {
+  const origin = invoke("git", ["config", "--show-origin", "--get", "core.sshCommand"]);
+  if (origin.status === 1) return null;
+  if (origin.status !== 0 || origin.error) fail("Unable to inspect SSH configuration origin");
+  const source = (origin.stdout ?? "").split("\t")[0];
+  if (!source.startsWith("file:")) fail("SSH configuration must have a file origin");
+  const path = (value, base = root) => {
+    if (value.startsWith('"')) value = JSON.parse(value);
+    return resolve(base, value.startsWith("~/") ? resolve(homedir(), value.slice(2)) : value);
+  };
+  const sourcePath = path(source.slice(5));
+  for (const name of ["config", "config.worktree"]) {
+    const local = invoke("git", ["rev-parse", "--git-path", name]);
+    if (local.status !== 0 || local.error) fail("Unable to resolve local Git configuration");
+    if (normalize(sourcePath) === normalize(path(local.stdout.trim()))) return "repository";
+  }
+  const includes = invoke("git", [
+    "config",
+    "--show-origin",
+    "--get-regexp",
+    "^includeIf\\..*\\.path$",
+  ]);
+  if (includes.error || ![0, 1].includes(includes.status))
+    fail("Unable to inspect folder SSH configuration");
+  for (const line of (includes.stdout ?? "").split(/\r?\n/)) {
+    const match = /^file:(.+)\tincludeif\.(gitdir\/i|gitdir):(.+)\.path (.+)$/i.exec(line);
+    if (!match) continue;
+    const base = dirname(path(match[1]));
+    if (normalize(path(match[4], base)) !== normalize(sourcePath)) continue;
+    if (/[*?]/.test(match[3])) continue;
+    const condition = path(match[3], base);
+    const insensitive = match[2].toLowerCase() === "gitdir/i";
+    for (const [tier, folder] of [
+      ["repository", root],
+      ["parent", dirname(root)],
+    ]) {
+      // Trailing slash is required for directory-descendant matching in Git.
+      if (
+        /[\\/]$/.test(match[3]) &&
+        normalize(condition, insensitive) === normalize(folder, insensitive)
+      )
+        return tier;
+    }
+  }
+  return null;
+}
+export function githubTarget(url) {
+  const match =
+    /^(?:https:\/\/github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:)([A-Za-z0-9][A-Za-z0-9-]*)\/([A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(
+      url,
+    );
+  if (!match || [".", ".."].includes(match[2]))
+    fail("Expected an uncredentialed github.com remote; resolve SSH aliases explicitly first");
+  return `${match[1]}/${match[2]}`;
+}
+export function prepareDeployAuth(
+  repository,
+  { remote = "origin", apply = false, run = runCommand, env = process.env, sshOnly = false } = {},
+) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(remote)) fail("Invalid remote name");
+  for (const key of ["GIT_SSH", "GIT_SSH_COMMAND", "GIT_CONFIG_COUNT", "GIT_CONFIG_PARAMETERS"])
+    if (env[key]?.trim()) fail(`${key} conflicts with deterministic deploy authentication`);
+  const invoke = (command, args) => run(command, args, repository, env);
+  const checked = (command, args, label) => {
+    const r = invoke(command, args);
+    if (r.status !== 0 || r.error) fail(label);
+    return (r.stdout ?? "").trim();
+  };
+  const git = (args) =>
+    checked("git", args, `Git ${args.slice(0, 2).join(" ")} authentication configuration failed`);
+  const root = git(["rev-parse", "--show-toplevel"]);
+  if (realpathSync(root) !== realpathSync(repository)) fail("Use the repository root");
+  const push = git(["remote", "get-url", "--push", remote]);
+  const fetch = git(["remote", "get-url", remote]);
+  const pushUrls = git(["remote", "get-url", "--push", "--all", remote])
+    .split(/\r?\n/)
+    .filter(Boolean);
+  const fetchUrls = git(["remote", "get-url", "--all", remote]).split(/\r?\n/).filter(Boolean);
+  if (
+    pushUrls.length !== 1 ||
+    fetchUrls.length !== 1 ||
+    pushUrls[0] !== push ||
+    fetchUrls[0] !== fetch
+  )
+    fail("Deploy authentication requires exactly one fetch and push URL");
+  const resolveTarget = (url) => {
+    const alias = /^git@([A-Za-z0-9][A-Za-z0-9.-]*):(.+)$/.exec(url);
+    if (alias && alias[1] !== "github.com") {
+      const settings = checked("ssh", ["-G", `git@${alias[1]}`], "SSH alias resolution failed");
+      if (
+        !/^hostname github\.com\s*$/im.test(settings) ||
+        !/^user git\s*$/im.test(settings) ||
+        /^(?:proxycommand|proxyjump) (?!none\s*$)\S+/im.test(settings)
+      )
+        fail("SSH alias destination is not direct github.com");
+      return githubTarget(`git@github.com:${alias[2]}`);
+    }
+    return githubTarget(url);
+  };
+  const target = resolveTarget(push);
+  if (resolveTarget(fetch) !== target) fail("Fetch and push identify different repositories");
+  const current = invoke("git", ["config", "--get", "core.sshCommand"]);
+  if (current.error || ![0, 1].includes(current.status))
+    fail("Unable to inspect SSH configuration");
+  const selected = resolveSetupAuth(root, { run, env });
+  if (sshOnly && selected.method !== "ssh")
+    fail(
+      "SSH-only deployment requires a configured folder SSH identity; GitHub CLI/HTTPS fallback is forbidden",
+    );
+  const url =
+    selected.method === "ssh" ? `git@github.com:${target}.git` : `https://github.com/${target}.git`;
+  const command = selected.ssh_command;
+  const plan = { ...selected, target, remote, url, ssh_command: command, applied: false };
+  if (!apply) return plan;
+  if (selected.method === "ssh") {
+    const rel = relative(root, selected.identity_file);
+    if (!rel.startsWith("..") && !isAbsolute(rel)) {
+      const tracked = invoke("git", ["ls-files", "--error-unmatch", "--", portable(rel)]);
+      if (tracked.status === 0)
+        fail(
+          "Private SSH identity is tracked; remove the exposure through a separate reviewed recovery",
+        );
+      if (invoke("git", ["check-ignore", "--quiet", "--", portable(rel)]).status !== 0)
+        fail("Ignore the repository SSH identity before deploy setup; never stage it");
+    }
+  } else
+    checked(
+      "gh",
+      ["auth", "status", "--hostname", "github.com"],
+      "GitHub CLI authentication unavailable; run gh auth login",
+    );
+  const authArgs = deployAuthGitArguments(selected);
+  const probe = run("git", [...authArgs, "ls-remote", "--symref", url, "HEAD"], root, {
+    ...env,
+    GIT_TERMINAL_PROMPT: "0",
+    GCM_INTERACTIVE: "Never",
+  });
+  if (probe.status !== 0 || probe.error)
+    fail(
+      `Selected ${selected.method} cannot read the target repository; no identity fallback was attempted`,
+    );
+  const helpers = invoke("git", ["config", "--get-all", "credential.https://github.com.helper"]);
+  const configured = command
+    ? (current.stdout ?? "").trim() === command
+    : (helpers.stdout ?? "")
+        .replaceAll("\r", "")
+        .split("\n")
+        .filter((v, i, a) => i < a.length - 1 || v !== "")
+        .slice(-2)
+        .join("\n") === `\n${ghHelper}`;
+  if (configured && push === url && fetch === url) return { ...plan, applied: false, reused: true };
+  const config = resolve(root, git(["rev-parse", "--git-path", "config"]));
+  const backup = `${config}.zaip-auth-${randomUUID()}.bak`;
+  // Keep the existing config locally for recovery; never print its contents.
+  copyFileSync(config, backup);
+  chmodSync(backup, 0o600);
+  if (command) git(["config", "--local", "core.sshCommand", command]);
+  else {
+    git(["config", "--local", "--replace-all", "credential.https://github.com.helper", ""]);
+    git(["config", "--local", "--add", "credential.https://github.com.helper", ghHelper]);
+  }
+  git(["remote", "set-url", remote, url]);
+  git(["remote", "set-url", "--push", remote, url]);
+  return { ...plan, applied: true, backup };
+}
+
+/** Resolve transport before a new repository has an origin; no remote creation or mutation. */
+export function resolveSetupAuth(repository, { run = runCommand, env = process.env } = {}) {
+  for (const key of [
+    "GIT_SSH",
+    "GIT_SSH_COMMAND",
+    "GIT_CONFIG_COUNT",
+    "GIT_CONFIG_PARAMETERS",
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+  ])
+    if (env[key]?.trim()) fail(`${key} conflicts with deterministic deploy authentication`);
+  const root = realpathSync(repository);
+  const invoke = (command, args) => run(command, args, root, env);
+  const current = invoke("git", ["config", "--get", "core.sshCommand"]);
+  if (current.error || ![0, 1].includes(current.status))
+    fail("Unable to inspect SSH configuration");
+  const identity = configuredIdentity((current.stdout ?? "").trim(), root);
+  const selected = discoverIdentity(
+    root,
+    identity,
+    identity ? configuredFolder(invoke, root) : null,
+  );
+  return {
+    ...selected,
+    ssh_command:
+      selected.method === "ssh"
+        ? `ssh -i ${quote(portable(selected.identity_file))} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes -o ConnectTimeout=10`
+        : null,
+  };
+}
+
+export function deployAuthGitArguments(selection) {
+  return selection.ssh_command
+    ? ["-c", `core.sshCommand=${selection.ssh_command}`]
+    : [
+        "-c",
+        "credential.https://github.com.helper=",
+        "-c",
+        `credential.https://github.com.helper=${ghHelper}`,
+      ];
+}
+
+/** Read-only publication gate: preparation must already match the deterministic selection. */
+export function assertPreparedDeployAuth(repository, options = {}) {
+  const run = options.run ?? runCommand;
+  const env = options.env ?? process.env;
+  const plan = prepareDeployAuth(repository, { ...options, apply: false, run, env });
+  const read = (args) => {
+    const result = run("git", args, repository, env);
+    if (result.status !== 0 || result.error)
+      fail("Prepared deploy authentication could not be verified");
+    return result.stdout.replaceAll("\r", "").trimEnd();
+  };
+  if (
+    read(["remote", "get-url", plan.remote]) !== plan.url ||
+    read(["remote", "get-url", "--push", plan.remote]) !== plan.url
+  )
+    fail("Prepare the selected deploy authentication before publication");
+  if (plan.method === "ssh") {
+    if (read(["config", "--get", "core.sshCommand"]) !== plan.ssh_command)
+      fail("Prepare the selected folder SSH identity before publication");
+  } else {
+    if (
+      read(["config", "--get-all", "credential.https://github.com.helper"])
+        .split("\n")
+        .slice(-2)
+        .join("\n") !== `\n${ghHelper}`
+    )
+      fail("Prepare the scoped GitHub CLI credential helper before publication");
+    const auth = run("gh", ["auth", "status", "--hostname", "github.com"], repository, env);
+    if (auth.status !== 0 || auth.error) fail("GitHub CLI authentication unavailable");
+  }
+  return plan;
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const { values } = parseArgs({
+      options: {
+        repository: { type: "string", default: "." },
+        remote: { type: "string", default: "origin" },
+        apply: { type: "boolean", default: false },
+        "ssh-only": { type: "boolean", default: false },
+      },
+      strict: true,
+    });
+    console.log(
+      JSON.stringify(
+        prepareDeployAuth(resolve(values.repository), { ...values, sshOnly: values["ssh-only"] }),
+        null,
+        2,
+      ),
+    );
+  } catch (error) {
+    console.error(`Deploy authentication: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-auth.test.mjs

@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import {
+  assertPreparedDeployAuth,
+  discoverIdentity,
+  ghHelper,
+  githubTarget,
+  prepareDeployAuth,
+} from "./deploy-auth.mjs";
+
+test("publication accepts only the prepared priority transport and rejects later key/config drift", () => {
+  const f = fixture();
+  assert.throws(
+    () => assertPreparedDeployAuth(f.root, { run: f.run, env: {} }),
+    /Prepared|Prepare/,
+  );
+  prepareDeployAuth(f.root, { run: f.run, env: {}, apply: true });
+  assert.equal(assertPreparedDeployAuth(f.root, { run: f.run, env: {} }).method, "github-cli");
+  f.key(f.root);
+  assert.throws(() => assertPreparedDeployAuth(f.root, { run: f.run, env: {} }), /Prepare/);
+  f.git("config", "--local", "core.sshCommand", "ssh -i missing");
+  assert.throws(() => assertPreparedDeployAuth(f.root, { run: f.run, env: {} }));
+});
+
+function fixture() {
+  const parent = mkdtempSync(join(tmpdir(), "zaip-auth-")),
+    root = join(parent, "project");
+  mkdirSync(root);
+  const git = (...args) => {
+    const r = spawnSync("git", args, {
+      cwd: root,
+      encoding: "utf8",
+      windowsHide: true,
+      env: {
+        ...process.env,
+        GIT_CONFIG_GLOBAL: join(parent, "empty-global"),
+        GIT_CONFIG_NOSYSTEM: "1",
+      },
+    });
+    assert.equal(r.status, 0, r.stderr);
+    return r.stdout.trim();
+  };
+  git("init");
+  git("remote", "add", "origin", "https://github.com/example/project.git");
+  const events = [];
+  const run = (cmd, args, cwd, env) => {
+    events.push([cmd, ...args]);
+    if (cmd === "gh") return { status: 0, stdout: "" };
+    if (cmd === "ssh")
+      return { status: 0, stdout: "hostname github.com\nuser git\nproxycommand none\n" };
+    if (args.includes("ls-remote"))
+      return { status: 0, stdout: `ref: refs/heads/main\tHEAD\n${"a".repeat(40)}\tHEAD\n` };
+    return spawnSync(cmd, args, {
+      cwd,
+      env: { ...env, GIT_CONFIG_GLOBAL: join(parent, "empty-global"), GIT_CONFIG_NOSYSTEM: "1" },
+      encoding: "utf8",
+      windowsHide: true,
+    });
+  };
+  const key = (base, name = "id_ed25519") => {
+    mkdirSync(join(base, ".ssh"), { recursive: true });
+    const path = join(base, ".ssh", name);
+    writeFileSync(path, "fixture-not-a-private-key");
+    return path;
+  };
+  return { parent, root, git, events, run, key };
+}
+test("repository key wins over parent and configured parent; no private content required", () => {
+  const f = fixture(),
+    parent = f.key(f.parent),
+    repo = f.key(f.root);
+  assert.equal(discoverIdentity(f.root, parent).identity_file, repo);
+  assert.equal(discoverIdentity(f.root).source, "repository");
+});
+test("parent key, ambiguity, configured choice, missing configured key and bounded discovery", () => {
+  const f = fixture(),
+    one = f.key(f.parent),
+    two = f.key(f.parent, "id_rsa");
+  assert.throws(() => discoverIdentity(f.root), /Multiple SSH/);
+  assert.equal(discoverIdentity(f.root, two).identity_file, two);
+  assert.throws(() => discoverIdentity(f.root, join(f.root, "missing")), /missing/);
+  const clean = fixture();
+  mkdirSync(join(clean.parent, "sibling"));
+  clean.key(join(clean.parent, "sibling"));
+  assert.equal(discoverIdentity(clean.root).method, "github-cli");
+  assert.equal(discoverIdentity(f.root, one).source, "parent");
+});
+test("dry resolver is local and never probes or writes; rejects malformed targets/overrides", () => {
+  const f = fixture(),
+    before = readFileSync(join(f.root, ".git/config"), "utf8");
+  assert.equal(prepareDeployAuth(f.root, { run: f.run, env: {} }).method, "github-cli");
+  assert(!f.events.some((e) => e[0] === "gh" || e.includes("ls-remote")));
+  assert.equal(readFileSync(join(f.root, ".git/config"), "utf8"), before);
+  assert.throws(
+    () => prepareDeployAuth(f.root, { run: f.run, env: { GIT_SSH_COMMAND: "bad" } }),
+    /conflicts/,
+  );
+  for (const url of [
+    "https://token@github.com/a/b",
+    "https://evil.invalid/a/b",
+    "git@github.com:a/../b",
+    "https://github.com/a/b?x=y",
+  ])
+    assert.throws(() => githubTarget(url));
+});
+test("no key configures gh locally, keeps owner and commit identity, repeat is idempotent", () => {
+  const f = fixture();
+  f.git("config", "user.name", "Fixture Author");
+  const result = prepareDeployAuth(f.root, { apply: true, run: f.run, env: {} });
+  assert.equal(result.method, "github-cli");
+  assert(result.applied);
+  assert.equal(f.git("config", "--get", "user.name"), "Fixture Author");
+  assert.equal(f.git("config", "--get-all", "credential.https://github.com.helper"), ghHelper);
+  assert.equal(
+    f.git("remote", "get-url", "--push", "origin"),
+    "https://github.com/example/project.git",
+  );
+  const backups = readdirSync(join(f.root, ".git")).filter((n) => n.includes("zaip-auth"));
+  assert(prepareDeployAuth(f.root, { apply: true, run: f.run, env: {} }).reused);
+  assert.deepEqual(
+    readdirSync(join(f.root, ".git")).filter((n) => n.includes("zaip-auth")),
+    backups,
+  );
+});
+test("parent SSH prepares local Git without gh; failed probe never falls back or writes", () => {
+  const f = fixture();
+  const key = f.key(f.parent);
+  const before = readFileSync(join(f.root, ".git/config"), "utf8");
+  const deny = (cmd, args, cwd, env) =>
+    args.includes("ls-remote")
+      ? { status: 1, stderr: "do not print this" }
+      : f.run(cmd, args, cwd, env);
+  assert.throws(
+    () => prepareDeployAuth(f.root, { apply: true, run: deny, env: {} }),
+    /no identity fallback/,
+  );
+  assert.equal(readFileSync(join(f.root, ".git/config"), "utf8"), before);
+  assert(!f.events.some((e) => e[0] === "gh"));
+  const result = prepareDeployAuth(f.root, { apply: true, run: f.run, env: {} });
+  assert.equal(result.identity_file, key);
+  assert.match(f.git("config", "--local", "--get", "core.sshCommand"), /StrictHostKeyChecking=yes/);
+  assert.equal(f.git("remote", "get-url", "origin"), "git@github.com:example/project.git");
+  assert(prepareDeployAuth(f.root, { apply: true, run: f.run, env: {} }).reused);
+});
+test("refuses unignored/tracked repository key and preserves target mismatch", () => {
+  const f = fixture();
+  f.key(f.root);
+  assert.throws(() => prepareDeployAuth(f.root, { apply: true, run: f.run, env: {} }), /Ignore/);
+  writeFileSync(join(f.root, ".git/info/exclude"), ".ssh/\n");
+  assert(prepareDeployAuth(f.root, { apply: true, run: f.run, env: {} }).applied);
+  f.git("remote", "set-url", "--push", "origin", "git@github.com:other/project.git");
+  assert.throws(
+    () => prepareDeployAuth(f.root, { apply: true, run: f.run, env: {} }),
+    /different repositories/,
+  );
+});
+
+test("explicit local external key is retained without scanning home; global unscoped key is refused", () => {
+  const f = fixture();
+  const outside = mkdtempSync(join(tmpdir(), "zaip-auth-external-"));
+  const key = f.key(outside);
+  f.git("config", "--local", "core.sshCommand", `ssh -i "${key}" -o IdentitiesOnly=yes`);
+  assert.equal(prepareDeployAuth(f.root, { run: f.run, env: {} }).identity_file, key);
+  f.git("config", "--unset", "core.sshCommand");
+  writeFileSync(
+    join(f.parent, "empty-global"),
+    `[core]\nsshCommand = ssh -i '${key.replaceAll("\\", "/")}'\n`,
+  );
+  assert.throws(() => prepareDeployAuth(f.root, { run: f.run, env: {} }), /outside/);
+});
+
+test("matching parent includeIf preserves explicit external key; repository key still wins", () => {
+  const f = fixture();
+  const outside = mkdtempSync(join(tmpdir(), "zaip-auth-include-"));
+  const key = f.key(outside);
+  const included = join(outside, "folder-config");
+  writeFileSync(included, `[core]\nsshCommand = ssh -i '${key.replaceAll("\\", "/")}'\n`);
+  writeFileSync(
+    join(f.parent, "empty-global"),
+    `[includeIf "gitdir/i:${f.parent.replaceAll("\\", "/")}/"]\npath = ${included.replaceAll("\\", "/")}\n`,
+  );
+  const result = prepareDeployAuth(f.root, { run: f.run, env: {} });
+  assert.equal(result.source, "parent");
+  assert.equal(result.identity_file, key);
+  assert.equal(prepareDeployAuth(f.root, { run: f.run, env: {} }).applied, false);
+  const repositoryKey = f.key(f.root);
+  assert.equal(prepareDeployAuth(f.root, { run: f.run, env: {} }).identity_file, repositoryKey);
+});