@zaip-ai/cli 6.3.0 → 7.5.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/guarded-commits.mjs

@@ -4,7 +4,10 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 import { commands, configuredBranch, run } from "./consumer-release-preparation.mjs";
+import { assertBoundedGitPush } from "./deploy-auth.mjs";
 import { readDeploymentInput, verifyContract } from "./deploy-contract.mjs";
+import { publicationPushArguments } from "./git-push-target.mjs";
+import { runGitOnlyPublicationChecks } from "./publication-proof-schema.mjs";
 
 const here = dirname(fileURLToPath(import.meta.url));
 const git = (root, args) =>
@@ -82,23 +85,120 @@ export async function criticalTaskInRange(root, sha, remote = "origin") {
  * it never allocates a version, calls gh release or obtains npm publication credentials. */
 export async function guardedCommits(input, operations = {}) {
   const root = resolve(input.repository);
-  const readInput = operations.readInput ?? readDeploymentInput;
   const checkIdentity = operations.identity ?? identity;
   const branchFor = operations.branchFor ?? configuredBranch;
   const checkCommands = commands(input.checks);
-  assert(/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(input.remote ?? "origin"), "Invalid remote name");
-  const initial = await readInput(root, input.request);
+  assert(
+    (input.remote ?? "origin") === "origin",
+    "Only the contract-bound origin remote is authorized",
+  );
+  const readCurrent = async () => {
+    const options = {
+      condition: input.plan.condition,
+      source_run_id: input.authorizationRun ?? input.plan.authorization?.source_run_id,
+      scope: input.scope ?? input.plan.destination?.scope,
+    };
+    const current = await readDeploymentInput(root, input.request, options);
+    if (operations.readInput) await operations.readInput(root, input.request, options);
+    return current;
+  };
+  const initial = await readCurrent();
   verifyContract(input.plan, initial, "commits", input.dryRun ? input.plan.phase : "publish");
+  assert(
+    input.plan.project_restrictions?.constraints.validation_environment !== "production-only",
+    "publication_validation_capability_missing: direct production validation requires a separately evidenced environment-bound adapter",
+  );
+  const checkDestination = () => {
+    assertBoundedGitPush(root, { expectedUrl: initial.identity.origin });
+    operations.destination?.();
+  };
+  checkDestination();
+  if (input.plan.condition)
+    assert(
+      input.plan.condition.commit_sha === input.sha,
+      "Conditional publication is bound to a different candidate",
+    );
+  if (input.plan.candidate)
+    assert(
+      input.plan.candidate.sha === input.sha,
+      "Publication is bound to a different native candidate",
+    );
+  if (input.plan.destination)
+    assert(
+      input.plan.destination.remote === (input.remote ?? "origin") &&
+        input.plan.destination.branch === input.branch &&
+        input.plan.destination.scope ===
+          (input.scope ?? (input.plan.kind === "builder" ? "framework" : "frontend")),
+      "Publication destination differs from its native contract",
+    );
   assert(input.plan.phase === "publish" || input.dryRun, "Preparation never sends commits");
+  if (input.plan.kind === "builder") {
+    const scope = input.scope ?? "framework";
+    assert(
+      scope === "framework" && input.branch === "main",
+      "Builder commits require framework/main",
+    );
+    const preflightArgs = [
+      resolve(here, "preflight.mjs"),
+      "--prepare-auth",
+      "--repository",
+      root,
+      "--remote",
+      input.remote ?? "origin",
+      "--scope",
+      scope,
+      "--branch",
+      input.branch,
+      ...(input.plan.channel_constraints?.git_transport === "ssh-only" ? ["--ssh-only"] : []),
+    ];
+    const recheck = async () => {
+      checkDestination();
+      verifyContract(input.plan, await readCurrent(), "commits", input.plan.phase);
+      checkIdentity(root, input.sha);
+      const target = JSON.parse(
+        execFileSync(process.execPath, [...preflightArgs, "--resolve-branch"], {
+          cwd: root,
+          encoding: "utf8",
+          windowsHide: true,
+          timeout: 30000,
+        }),
+      );
+      assert(target.configured_branch === "main", "Configured framework branch changed");
+    };
+    checkIdentity(root, input.sha);
+    const delivery = await import(
+      pathToFileURL(resolve(root, "scripts/builder-commit-delivery.mjs")).href
+    );
+    return delivery.deliverBuilderCommits(
+      { ...input, repository: root, scope },
+      {
+        ...operations,
+        recheck: operations.recheck ?? recheck,
+        preflight:
+          operations.preflight ??
+          (() =>
+            execFileSync(process.execPath, preflightArgs, {
+              cwd: root,
+              windowsHide: true,
+              stdio: "inherit",
+              timeout: 60000,
+            })),
+      },
+    );
+  }
   const branch = await branchFor(root, input.scope ?? "frontend");
   assert(branch === input.branch, "Target must match the current project branch");
   checkIdentity(root, input.sha);
-  await (operations.checks ?? ((items) => run(items, root, "scoped commit validation")))(
-    checkCommands,
-  );
+  await (
+    operations.checks ??
+    (initial.nativeAuthority?.git_only
+      ? (items) => runGitOnlyPublicationChecks(root, input.sha, items)
+      : (items) => run(items, root, "scoped commit validation"))
+  )(checkCommands);
   checkIdentity(root, input.sha);
   const recheck = async () => {
-    verifyContract(input.plan, await readInput(root, input.request), "commits", input.plan.phase);
+    checkDestination();
+    verifyContract(input.plan, await readCurrent(), "commits", input.plan.phase);
     assert(
       (await branchFor(root, input.scope ?? "frontend")) === branch,
       "Configured target changed",
@@ -114,6 +214,7 @@ export async function guardedCommits(input, operations = {}) {
         process.execPath,
         [
           resolve(here, "preflight.mjs"),
+          "--prepare-auth",
           "--repository",
           root,
           "--remote",
@@ -122,80 +223,63 @@ export async function guardedCommits(input, operations = {}) {
           input.scope ?? "frontend",
           "--branch",
           branch,
+          ...(input.plan.channel_constraints?.git_transport === "ssh-only" ? ["--ssh-only"] : []),
         ],
         { cwd: root, windowsHide: true, stdio: "inherit" },
       ))
   )();
   await recheck();
-  const critical =
-    input.plan.kind === "builder" &&
-    (await (operations.isCritical ?? criticalTaskInRange)(
-      root,
-      input.sha,
-      input.remote ?? "origin",
-    ));
-  // Portable callers can supply both gates; otherwise load the real gate before push.
-  const candidateGate =
-    critical && (!operations.qualifyPreMain || !operations.verifyMainCi)
-      ? await import(pathToFileURL(resolve(root, "scripts/remote-candidate-gate.mjs")).href)
-      : null;
-  if (critical) {
-    await (operations.qualifyPreMain ?? candidateGate.qualifyLocalCandidate)({
-      repository: root,
-      sha: input.sha,
-      kind: "critical",
-      remote: input.remote ?? "origin",
-    });
-    await recheck();
-  }
   const refspec = `${input.sha}:refs/heads/${branch}`;
+  const destinationUrl = initial.identity.origin;
+  const gitArgs = publicationPushArguments(root, {
+    url: destinationUrl,
+    sha: input.sha,
+    ref: `refs/heads/${branch}`,
+  });
   await (
     operations.push ??
     (() =>
-      execFileSync("git", ["push", input.remote ?? "origin", refspec], {
+      execFileSync("git", gitArgs, {
         cwd: root,
         windowsHide: true,
         stdio: "inherit",
       }))
-  )({ repository: root, refspec });
+  )({ repository: root, refspec, gitArgs, destinationUrl });
   const remoteSha = await (
     operations.remoteSha ??
-    (() =>
-      git(root, ["ls-remote", input.remote ?? "origin", `refs/heads/${branch}`]).split(/\s+/)[0])
+    (() => git(root, ["ls-remote", "--", destinationUrl, `refs/heads/${branch}`]).split(/\s+/)[0])
   )();
   assert(
     remoteSha === input.sha.toLowerCase(),
     "Remote SHA does not match the delivered candidate",
   );
-  if (critical) {
-    await (operations.verifyMainCi ?? candidateGate.waitMainCandidate)({
-      repository: root,
-      sha: input.sha,
-      kind: "critical",
-      remote: input.remote ?? "origin",
-    });
-  }
   return { mode: "commits", verified: true, pushed: true, release: false, sha: input.sha };
 }
-async function main() {
+export async function main() {
   const { values } = parseArgs({
     strict: true,
     options: {
       repository: { type: "string", default: "." },
       sha: { type: "string" },
       branch: { type: "string" },
-      scope: { type: "string", default: "frontend" },
+      scope: { type: "string" },
       remote: { type: "string", default: "origin" },
       "request-file": { type: "string" },
       "plan-file": { type: "string" },
       "checks-file": { type: "string" },
+      "evidence-map-file": { type: "string" },
+      "local-catalog-receipt-file": { type: "string" },
       "dry-run": { type: "boolean", default: false },
+      "authorization-run": { type: "string" },
+      "codex-hook-id": { type: "string" },
+      "codex-hook-thread": { type: "string" },
     },
   });
   for (const field of ["sha", "branch", "request-file", "plan-file", "checks-file"])
     assert(values[field], `--${field} is required`);
   const result = await guardedCommits({
     repository: values.repository,
+    authorizationRun: values["authorization-run"],
     sha: values.sha,
     branch: values.branch,
     scope: values.scope,
@@ -204,6 +288,12 @@ async function main() {
     request: await readFile(resolve(values["request-file"]), "utf8"),
     plan: JSON.parse(await readFile(resolve(values["plan-file"]), "utf8")),
     checks: JSON.parse(await readFile(resolve(values["checks-file"]), "utf8")),
+    evidenceMap: values["evidence-map-file"]
+      ? JSON.parse(await readFile(resolve(values["evidence-map-file"]), "utf8"))
+      : undefined,
+    localCatalogReceipt: values["local-catalog-receipt-file"]
+      ? JSON.parse(await readFile(resolve(values["local-catalog-receipt-file"]), "utf8"))
+      : undefined,
   });
   process.stdout.write(`${JSON.stringify(result)}\n`);
 }

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight-options.mjs

@@ -0,0 +1,50 @@
+export function parseArguments(arguments_) {
+  const parsed = {
+    repository: ".",
+    remote: "origin",
+    branch: null,
+    timeout: 15_000,
+    resolveBranch: false,
+    scope: null,
+    prepareAuth: false,
+    sshOnly: false,
+  };
+  for (let index = 0; index < arguments_.length; index += 1) {
+    const argument = arguments_[index];
+    if (argument === "--resolve-branch") parsed.resolveBranch = true;
+    else if (argument === "--prepare-auth") parsed.prepareAuth = true;
+    else if (argument === "--ssh-only") parsed.sshOnly = true;
+    else if (argument === "--scope") parsed.scope = requiredValue(arguments_, ++index, argument);
+    else if (argument === "--repository")
+      parsed.repository = requiredValue(arguments_, ++index, argument);
+    else if (argument === "--remote") parsed.remote = requiredValue(arguments_, ++index, argument);
+    else if (argument === "--branch") parsed.branch = requiredValue(arguments_, ++index, argument);
+    else if (argument === "--timeout-ms") {
+      parsed.timeout = Number(requiredValue(arguments_, ++index, argument));
+    } else if (argument === "--help") {
+      process.stdout.write(
+        "Usage: preflight.mjs [--repository PATH] [--remote NAME] [--branch CONFIGURED_BRANCH] [--resolve-branch] [--prepare-auth] [--ssh-only] [--timeout-ms 1000..60000]\n",
+      );
+      process.exit(0);
+    } else fail(`unknown argument: ${argument}`);
+  }
+  if (!Number.isInteger(parsed.timeout) || parsed.timeout < 1_000 || parsed.timeout > 60_000) {
+    fail("--timeout-ms must be an integer from 1000 to 60000");
+  }
+  if (
+    parsed.scope !== null &&
+    !["framework", "frontend", "backend", "database"].includes(parsed.scope)
+  )
+    fail("--scope must be framework, frontend, backend or database");
+  return parsed;
+}
+
+function requiredValue(arguments_, index, option) {
+  const value = arguments_[index];
+  if (!value || value.startsWith("--")) fail(`${option} requires a value`);
+  return value;
+}
+
+function fail(message) {
+  throw new Error(message);
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight-worktree.test.mjs

@@ -0,0 +1,52 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+
+test("linked worktree accepts exact common and worktree SSH configuration without network", () => {
+  const parent = mkdtempSync(join(tmpdir(), "zaip-preflight-worktree-"));
+  const root = join(parent, "repo"),
+    worktree = join(parent, "worktree");
+  const env = {
+    ...process.env,
+    GIT_CONFIG_GLOBAL: join(parent, "empty-global"),
+    GIT_CONFIG_NOSYSTEM: "1",
+  };
+  const git = (cwd, ...args) => {
+    const result = spawnSync("git", args, { cwd, env, encoding: "utf8", windowsHide: true });
+    assert.equal(result.status, 0, result.stderr);
+    return result.stdout.trim();
+  };
+  try {
+    mkdirSync(root);
+    git(root, "init", "-b", "main");
+    git(root, "config", "user.name", "Fixture");
+    git(root, "config", "user.email", "fixture@example.invalid");
+    git(root, "commit", "--allow-empty", "-m", "fixture");
+    git(root, "worktree", "add", "--detach", worktree);
+    git(root, "remote", "add", "origin", "git@github.com:fixture/project.git");
+    const key = join(parent, "fixture-key");
+    writeFileSync(key, "synthetic fixture only");
+    const ssh = join(parent, "no-network.cjs");
+    writeFileSync(ssh, 'process.stderr.write("ZAIP_NO_NETWORK_FIXTURE\\n");process.exit(73);');
+    const command = `"${process.execPath.replaceAll("\\", "/")}" "${ssh.replaceAll("\\", "/")}" -i "${key.replaceAll("\\", "/")}"`;
+    for (const mode of ["common", "worktree"]) {
+      if (mode === "worktree") {
+        git(root, "config", "extensions.worktreeConfig", "true");
+        git(worktree, "config", "--worktree", "core.sshCommand", command);
+      } else git(root, "config", "core.sshCommand", command);
+      const result = spawnSync(
+        process.execPath,
+        [join(import.meta.dirname, "preflight.mjs"), "--repository", worktree],
+        { env, encoding: "utf8", windowsHide: true },
+      );
+      assert.notEqual(result.status, 0);
+      assert.doesNotMatch(result.stderr, /not repository-local|outside repository\/parent/);
+      assert.match(result.stderr, /ZAIP_NO_NETWORK_FIXTURE/);
+    }
+  } finally {
+    rmSync(parent, { recursive: true, force: true });
+  }
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs

@@ -3,8 +3,12 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { dirname, isAbsolute, resolve } from "node:path";
+import { assertApplicationContent } from "./application-content.mjs";
+import { ghHelper, prepareDeployAuth } from "./deploy-auth.mjs";
 import { isCanonicalMainBuilder, isFrameworkRepository } from "./framework-identity.mjs";
+import { sameGitConfigPath as samePath } from "./git-config-paths.mjs";
+import { parseArguments } from "./preflight-options.mjs";
 import { parseDocument } from "./yaml-parser.mjs";
 
 const options = parseArguments(process.argv.slice(2));
@@ -20,7 +24,7 @@ try {
     fail("--scope framework is reserved for the canonical @zaip-ai/aios framework repository");
   const configuredBranch = deployment[scope];
   if (scope === "frontend" || scope === "backend")
-    assertApplicationContent(repository, configuredBranch);
+    assertApplicationContent(repository, configuredBranch, git);
   if (options.branch !== null && options.branch !== configuredBranch) {
     fail(
       `caller branch ${options.branch} conflicts with configured deploy.branch ${configuredBranch}`,
@@ -38,30 +42,69 @@ try {
     if (process.env[variable]?.trim()) fail(`${variable} overrides folder-scoped Git SSH config`);
   }
 
+  const authentication = prepareDeployAuth(repository, {
+    remote: options.remote,
+    apply: options.prepareAuth,
+    sshOnly: options.sshOnly,
+  });
   const pushUrl = git(repository, ["remote", "get-url", "--push", options.remote]).trim();
-  if (!isSshUrl(pushUrl)) fail(`remote ${options.remote} push URL is not SSH: ${pushUrl}`);
 
   const name = requiredConfig(repository, "user.name");
   const email = requiredConfig(repository, "user.email");
-  const sshCommand = requiredConfig(repository, "core.sshCommand");
-  const sshSource = configPath(sshCommand.origin, repository);
-  if (!isFolderScoped(repository, gitDirectory, sshSource)) {
-    fail(
-      `core.sshCommand is not repository-local or loaded by a matching includeIf gitdir: ${sshCommand.origin}`,
+  let sshDetails = null;
+  if (authentication.method === "ssh") {
+    if (!isSshUrl(pushUrl))
+      fail("SSH identity found; run deploy-auth.mjs --apply before preflight");
+    const sshCommand = requiredConfig(repository, "core.sshCommand");
+    const sshSource = configPath(sshCommand.origin, repository);
+    if (!isFolderScoped(repository, gitDirectory, sshSource)) {
+      fail(
+        `core.sshCommand is not repository-local or loaded by a matching includeIf gitdir: ${sshCommand.origin}`,
+      );
+    }
+
+    const identityArgument = /(?:^|\s)-i(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/.exec(
+      sshCommand.value,
+    );
+    if (!identityArgument)
+      fail("folder-scoped core.sshCommand does not declare an -i identity file");
+    const identityFile = resolveConfigPath(
+      identityArgument[1] ?? identityArgument[2] ?? identityArgument[3],
+      repository,
     );
+    if (!existsSync(identityFile))
+      fail(`folder-scoped SSH identity file does not exist: ${identityFile}`);
+    if (!samePath(identityFile, authentication.identity_file))
+      fail(
+        "Configured SSH key does not match repository/parent priority; run deploy-auth.mjs --apply",
+      );
+    sshDetails = {
+      folder_scoped: true,
+      config_source: sshCommand.origin,
+      identity_file: identityFile,
+      process_override: false,
+    };
+  } else {
+    if (!pushUrl.startsWith("https://github.com/"))
+      fail("No folder SSH key; run deploy-auth.mjs --apply for GitHub CLI transport");
+    const helpers = git(repository, [
+      "config",
+      "--get-all",
+      "credential.https://github.com.helper",
+    ]);
+    if (!helpers.replaceAll("\r", "").endsWith(`\n${ghHelper}\n`))
+      fail(
+        "GitHub CLI credential helper must be repository-local with a preceding reset; run deploy-auth.mjs --apply",
+      );
+    const auth = spawnSync("gh", ["auth", "status", "--hostname", "github.com"], {
+      cwd: repository,
+      encoding: "utf8",
+      windowsHide: true,
+      timeout: options.timeout,
+    });
+    if (auth.status !== 0 || auth.error) fail("GitHub CLI authentication unavailable");
   }
 
-  const identityArgument = /(?:^|\s)-i(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/.exec(
-    sshCommand.value,
-  );
-  if (!identityArgument) fail("folder-scoped core.sshCommand does not declare an -i identity file");
-  const identityFile = resolveConfigPath(
-    identityArgument[1] ?? identityArgument[2] ?? identityArgument[3],
-    repository,
-  );
-  if (!existsSync(identityFile))
-    fail(`folder-scoped SSH identity file does not exist: ${identityFile}`);
-
   const remoteOutput = git(repository, ["ls-remote", "--symref", options.remote, "HEAD"], {
     timeout: options.timeout,
     env: {
@@ -99,12 +142,8 @@ try {
           name: name.value,
           email: email.value,
         },
-        ssh: {
-          folder_scoped: true,
-          config_source: sshCommand.origin,
-          identity_file: identityFile,
-          process_override: false,
-        },
+        authentication: { method: authentication.method, source: authentication.source },
+        ssh: sshDetails,
       },
       null,
       2,
@@ -117,43 +156,6 @@ try {
   process.exitCode = 1;
 }
 
-function parseArguments(arguments_) {
-  const parsed = {
-    repository: ".",
-    remote: "origin",
-    branch: null,
-    timeout: 15_000,
-    resolveBranch: false,
-    scope: null,
-  };
-  for (let index = 0; index < arguments_.length; index += 1) {
-    const argument = arguments_[index];
-    if (argument === "--resolve-branch") parsed.resolveBranch = true;
-    else if (argument === "--scope") parsed.scope = requiredValue(arguments_, ++index, argument);
-    else if (argument === "--repository")
-      parsed.repository = requiredValue(arguments_, ++index, argument);
-    else if (argument === "--remote") parsed.remote = requiredValue(arguments_, ++index, argument);
-    else if (argument === "--branch") parsed.branch = requiredValue(arguments_, ++index, argument);
-    else if (argument === "--timeout-ms") {
-      parsed.timeout = Number(requiredValue(arguments_, ++index, argument));
-    } else if (argument === "--help") {
-      process.stdout.write(
-        "Usage: preflight.mjs [--repository PATH] [--remote NAME] [--branch CONFIGURED_BRANCH] [--resolve-branch] [--timeout-ms 1000..60000]\n",
-      );
-      process.exit(0);
-    } else fail(`unknown argument: ${argument}`);
-  }
-  if (!Number.isInteger(parsed.timeout) || parsed.timeout < 1_000 || parsed.timeout > 60_000) {
-    fail("--timeout-ms must be an integer from 1000 to 60000");
-  }
-  if (
-    parsed.scope !== null &&
-    !["framework", "frontend", "backend", "database"].includes(parsed.scope)
-  )
-    fail("--scope must be framework, frontend, backend or database");
-  return parsed;
-}
-
 function configuredDeployment(repository) {
   const configPath = resolve(repository, ".agents/config/project.yaml");
   if (!existsSync(configPath))
@@ -274,52 +276,6 @@ function isValidBranch(repository, branch) {
   );
 }
 
-function assertApplicationContent(repository, targetBranch) {
-  const remote = git(repository, ["rev-parse", "--verify", `refs/remotes/origin/${targetBranch}`], {
-    allowFailure: true,
-  }).trim();
-  const committed = remote
-    ? git(repository, ["diff", "--name-only", `${remote}..HEAD`], { allowFailure: true })
-    : git(repository, ["ls-tree", "-r", "--name-only", "HEAD"], { allowFailure: true });
-  const changed = git(repository, ["diff", "--name-only", "HEAD"], { allowFailure: true });
-  const untracked = git(repository, ["ls-files", "--others", "--exclude-standard"], {
-    allowFailure: true,
-  });
-  const names = [
-    ...new Set(
-      [committed, changed, untracked].flatMap((value) => value.split(/\r?\n/).filter(Boolean)),
-    ),
-  ];
-  if (names.some((name) => /(^|\/)supabase\/migrations\/|migration.*\.sql$/i.test(name)))
-    fail("application deploy cannot include database migrations");
-  for (const name of names) {
-    if (/^(?:\.agents\/|docs\/|README(?:-[A-Z]+)?\.md$)/i.test(name)) continue;
-    if (/^packages\/cli\/src\/database-migration-policy(?:\.test)?\.[cm]?[jt]sx?$/i.test(name))
-      continue;
-    if (!/\.(?:[cm]?[jt]sx?|py|rb|go|ya?ml)$/i.test(name)) continue;
-    const path = resolve(repository, name);
-    const contents = [
-      git(repository, ["show", `HEAD:${name}`], { allowFailure: true }),
-      git(repository, ["show", `:${name}`], { allowFailure: true }),
-      existsSync(path) ? readFileSync(path, "utf8") : "",
-    ];
-    if (
-      contents.some((content) =>
-        /(?:service_role\s*=\s*[^\s'"`]+|SUPABASE_SERVICE_ROLE_KEY\s*=|apply_migration\s*\(|\b(?:supabase\s+)?db\s+push\b|startup\s+migration\s*[:=])/i.test(
-          content,
-        ),
-      )
-    )
-      fail("application deploy cannot include database admin credentials or migration bypasses");
-  }
-}
-
-function requiredValue(arguments_, index, option) {
-  const value = arguments_[index];
-  if (!value || value.startsWith("--")) fail(`${option} requires a value`);
-  return value;
-}
-
 function git(repository, arguments_, settings = {}) {
   const result = spawnSync("git", ["-C", repository, ...arguments_], {
     encoding: "utf8",
@@ -329,6 +285,7 @@ function git(repository, arguments_, settings = {}) {
   });
   if (result.error) fail(`${formatGit(arguments_)}: ${result.error.message}`);
   if (result.status !== 0) {
+    if (settings.allowedExitCodes?.includes(result.status)) return null;
     if (settings.allowFailure) return "";
     const detail = (result.stderr || result.stdout || `exit ${result.status}`).trim();
     fail(`${formatGit(arguments_)}: ${detail}`);
@@ -346,7 +303,11 @@ function requiredConfig(repository, key) {
 }
 
 function isFolderScoped(repository, gitDirectory, sshSource) {
-  if (isWithin(sshSource, gitDirectory)) return true;
+  // Resolve exact common/worktree config files, never whole Git directories.
+  for (const name of ["config", "config.worktree"]) {
+    const configuredPath = git(repository, ["rev-parse", "--git-path", name]).trim();
+    if (samePath(sshSource, resolve(repository, configuredPath))) return true;
+  }
   const output = git(
     repository,
     ["config", "--show-origin", "--get-regexp", "^includeIf\\..*\\.path$"],
@@ -420,16 +381,6 @@ function unquote(value) {
   }
 }
 
-function isWithin(candidate, parent) {
-  const path = relative(resolve(parent), resolve(candidate));
-  return path === "" || (!path.startsWith("..") && !isAbsolute(path));
-}
-
-function samePath(left, right) {
-  const normalize = (value) => portable(resolve(value)).toLowerCase();
-  return normalize(left) === normalize(right);
-}
-
 function portable(value) {
   return value.replace(/\\/g, "/");
 }

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.test.mjs

@@ -15,7 +15,17 @@ test("standalone consumer resolves fresh project targets without node_modules",
     const scripts = join(root, ".agents/skills/zaip-skill-github-deploy/scripts");
     mkdirSync(scripts, { recursive: true });
     mkdirSync(join(root, ".agents/config"), { recursive: true });
-    for (const file of ["preflight.mjs", "yaml-parser.mjs", "framework-identity.mjs"])
+    for (const file of [
+      "preflight.mjs",
+      "preflight-options.mjs",
+      "deploy-auth.mjs",
+      "git-command.mjs",
+      "git-config-paths.mjs",
+      "git-destination.mjs",
+      "application-content.mjs",
+      "yaml-parser.mjs",
+      "framework-identity.mjs",
+    ])
       copyFileSync(join(import.meta.dirname, file), join(scripts, file));
     const run = (...args) =>
       spawnSync(process.execPath, [join(scripts, "preflight.mjs"), "--repository", root, ...args], {