@zaip-ai/cli 6.3.0 → 7.6.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs

@@ -3,8 +3,12 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { dirname, isAbsolute, resolve } from "node:path";
+import { assertApplicationContent } from "./application-content.mjs";
+import { ghHelper, prepareDeployAuth } from "./deploy-auth.mjs";
 import { isCanonicalMainBuilder, isFrameworkRepository } from "./framework-identity.mjs";
+import { sameGitConfigPath as samePath } from "./git-config-paths.mjs";
+import { parseArguments } from "./preflight-options.mjs";
 import { parseDocument } from "./yaml-parser.mjs";
 
 const options = parseArguments(process.argv.slice(2));
@@ -20,7 +24,7 @@ try {
     fail("--scope framework is reserved for the canonical @zaip-ai/aios framework repository");
   const configuredBranch = deployment[scope];
   if (scope === "frontend" || scope === "backend")
-    assertApplicationContent(repository, configuredBranch);
+    assertApplicationContent(repository, configuredBranch, git);
   if (options.branch !== null && options.branch !== configuredBranch) {
     fail(
       `caller branch ${options.branch} conflicts with configured deploy.branch ${configuredBranch}`,
@@ -38,30 +42,69 @@ try {
     if (process.env[variable]?.trim()) fail(`${variable} overrides folder-scoped Git SSH config`);
   }
 
+  const authentication = prepareDeployAuth(repository, {
+    remote: options.remote,
+    apply: options.prepareAuth,
+    sshOnly: options.sshOnly,
+  });
   const pushUrl = git(repository, ["remote", "get-url", "--push", options.remote]).trim();
-  if (!isSshUrl(pushUrl)) fail(`remote ${options.remote} push URL is not SSH: ${pushUrl}`);
 
   const name = requiredConfig(repository, "user.name");
   const email = requiredConfig(repository, "user.email");
-  const sshCommand = requiredConfig(repository, "core.sshCommand");
-  const sshSource = configPath(sshCommand.origin, repository);
-  if (!isFolderScoped(repository, gitDirectory, sshSource)) {
-    fail(
-      `core.sshCommand is not repository-local or loaded by a matching includeIf gitdir: ${sshCommand.origin}`,
+  let sshDetails = null;
+  if (authentication.method === "ssh") {
+    if (!isSshUrl(pushUrl))
+      fail("SSH identity found; run deploy-auth.mjs --apply before preflight");
+    const sshCommand = requiredConfig(repository, "core.sshCommand");
+    const sshSource = configPath(sshCommand.origin, repository);
+    if (!isFolderScoped(repository, gitDirectory, sshSource)) {
+      fail(
+        `core.sshCommand is not repository-local or loaded by a matching includeIf gitdir: ${sshCommand.origin}`,
+      );
+    }
+
+    const identityArgument = /(?:^|\s)-i(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/.exec(
+      sshCommand.value,
+    );
+    if (!identityArgument)
+      fail("folder-scoped core.sshCommand does not declare an -i identity file");
+    const identityFile = resolveConfigPath(
+      identityArgument[1] ?? identityArgument[2] ?? identityArgument[3],
+      repository,
     );
+    if (!existsSync(identityFile))
+      fail(`folder-scoped SSH identity file does not exist: ${identityFile}`);
+    if (!samePath(identityFile, authentication.identity_file))
+      fail(
+        "Configured SSH key does not match repository/parent priority; run deploy-auth.mjs --apply",
+      );
+    sshDetails = {
+      folder_scoped: true,
+      config_source: sshCommand.origin,
+      identity_file: identityFile,
+      process_override: false,
+    };
+  } else {
+    if (!pushUrl.startsWith("https://github.com/"))
+      fail("No folder SSH key; run deploy-auth.mjs --apply for GitHub CLI transport");
+    const helpers = git(repository, [
+      "config",
+      "--get-all",
+      "credential.https://github.com.helper",
+    ]);
+    if (!helpers.replaceAll("\r", "").endsWith(`\n${ghHelper}\n`))
+      fail(
+        "GitHub CLI credential helper must be repository-local with a preceding reset; run deploy-auth.mjs --apply",
+      );
+    const auth = spawnSync("gh", ["auth", "status", "--hostname", "github.com"], {
+      cwd: repository,
+      encoding: "utf8",
+      windowsHide: true,
+      timeout: options.timeout,
+    });
+    if (auth.status !== 0 || auth.error) fail("GitHub CLI authentication unavailable");
   }
 
-  const identityArgument = /(?:^|\s)-i(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/.exec(
-    sshCommand.value,
-  );
-  if (!identityArgument) fail("folder-scoped core.sshCommand does not declare an -i identity file");
-  const identityFile = resolveConfigPath(
-    identityArgument[1] ?? identityArgument[2] ?? identityArgument[3],
-    repository,
-  );
-  if (!existsSync(identityFile))
-    fail(`folder-scoped SSH identity file does not exist: ${identityFile}`);
-
   const remoteOutput = git(repository, ["ls-remote", "--symref", options.remote, "HEAD"], {
     timeout: options.timeout,
     env: {
@@ -99,12 +142,8 @@ try {
           name: name.value,
           email: email.value,
         },
-        ssh: {
-          folder_scoped: true,
-          config_source: sshCommand.origin,
-          identity_file: identityFile,
-          process_override: false,
-        },
+        authentication: { method: authentication.method, source: authentication.source },
+        ssh: sshDetails,
       },
       null,
       2,
@@ -117,43 +156,6 @@ try {
   process.exitCode = 1;
 }
 
-function parseArguments(arguments_) {
-  const parsed = {
-    repository: ".",
-    remote: "origin",
-    branch: null,
-    timeout: 15_000,
-    resolveBranch: false,
-    scope: null,
-  };
-  for (let index = 0; index < arguments_.length; index += 1) {
-    const argument = arguments_[index];
-    if (argument === "--resolve-branch") parsed.resolveBranch = true;
-    else if (argument === "--scope") parsed.scope = requiredValue(arguments_, ++index, argument);
-    else if (argument === "--repository")
-      parsed.repository = requiredValue(arguments_, ++index, argument);
-    else if (argument === "--remote") parsed.remote = requiredValue(arguments_, ++index, argument);
-    else if (argument === "--branch") parsed.branch = requiredValue(arguments_, ++index, argument);
-    else if (argument === "--timeout-ms") {
-      parsed.timeout = Number(requiredValue(arguments_, ++index, argument));
-    } else if (argument === "--help") {
-      process.stdout.write(
-        "Usage: preflight.mjs [--repository PATH] [--remote NAME] [--branch CONFIGURED_BRANCH] [--resolve-branch] [--timeout-ms 1000..60000]\n",
-      );
-      process.exit(0);
-    } else fail(`unknown argument: ${argument}`);
-  }
-  if (!Number.isInteger(parsed.timeout) || parsed.timeout < 1_000 || parsed.timeout > 60_000) {
-    fail("--timeout-ms must be an integer from 1000 to 60000");
-  }
-  if (
-    parsed.scope !== null &&
-    !["framework", "frontend", "backend", "database"].includes(parsed.scope)
-  )
-    fail("--scope must be framework, frontend, backend or database");
-  return parsed;
-}
-
 function configuredDeployment(repository) {
   const configPath = resolve(repository, ".agents/config/project.yaml");
   if (!existsSync(configPath))
@@ -274,52 +276,6 @@ function isValidBranch(repository, branch) {
   );
 }
 
-function assertApplicationContent(repository, targetBranch) {
-  const remote = git(repository, ["rev-parse", "--verify", `refs/remotes/origin/${targetBranch}`], {
-    allowFailure: true,
-  }).trim();
-  const committed = remote
-    ? git(repository, ["diff", "--name-only", `${remote}..HEAD`], { allowFailure: true })
-    : git(repository, ["ls-tree", "-r", "--name-only", "HEAD"], { allowFailure: true });
-  const changed = git(repository, ["diff", "--name-only", "HEAD"], { allowFailure: true });
-  const untracked = git(repository, ["ls-files", "--others", "--exclude-standard"], {
-    allowFailure: true,
-  });
-  const names = [
-    ...new Set(
-      [committed, changed, untracked].flatMap((value) => value.split(/\r?\n/).filter(Boolean)),
-    ),
-  ];
-  if (names.some((name) => /(^|\/)supabase\/migrations\/|migration.*\.sql$/i.test(name)))
-    fail("application deploy cannot include database migrations");
-  for (const name of names) {
-    if (/^(?:\.agents\/|docs\/|README(?:-[A-Z]+)?\.md$)/i.test(name)) continue;
-    if (/^packages\/cli\/src\/database-migration-policy(?:\.test)?\.[cm]?[jt]sx?$/i.test(name))
-      continue;
-    if (!/\.(?:[cm]?[jt]sx?|py|rb|go|ya?ml)$/i.test(name)) continue;
-    const path = resolve(repository, name);
-    const contents = [
-      git(repository, ["show", `HEAD:${name}`], { allowFailure: true }),
-      git(repository, ["show", `:${name}`], { allowFailure: true }),
-      existsSync(path) ? readFileSync(path, "utf8") : "",
-    ];
-    if (
-      contents.some((content) =>
-        /(?:service_role\s*=\s*[^\s'"`]+|SUPABASE_SERVICE_ROLE_KEY\s*=|apply_migration\s*\(|\b(?:supabase\s+)?db\s+push\b|startup\s+migration\s*[:=])/i.test(
-          content,
-        ),
-      )
-    )
-      fail("application deploy cannot include database admin credentials or migration bypasses");
-  }
-}
-
-function requiredValue(arguments_, index, option) {
-  const value = arguments_[index];
-  if (!value || value.startsWith("--")) fail(`${option} requires a value`);
-  return value;
-}
-
 function git(repository, arguments_, settings = {}) {
   const result = spawnSync("git", ["-C", repository, ...arguments_], {
     encoding: "utf8",
@@ -329,6 +285,7 @@ function git(repository, arguments_, settings = {}) {
   });
   if (result.error) fail(`${formatGit(arguments_)}: ${result.error.message}`);
   if (result.status !== 0) {
+    if (settings.allowedExitCodes?.includes(result.status)) return null;
     if (settings.allowFailure) return "";
     const detail = (result.stderr || result.stdout || `exit ${result.status}`).trim();
     fail(`${formatGit(arguments_)}: ${detail}`);
@@ -346,7 +303,11 @@ function requiredConfig(repository, key) {
 }
 
 function isFolderScoped(repository, gitDirectory, sshSource) {
-  if (isWithin(sshSource, gitDirectory)) return true;
+  // Resolve exact common/worktree config files, never whole Git directories.
+  for (const name of ["config", "config.worktree"]) {
+    const configuredPath = git(repository, ["rev-parse", "--git-path", name]).trim();
+    if (samePath(sshSource, resolve(repository, configuredPath))) return true;
+  }
   const output = git(
     repository,
     ["config", "--show-origin", "--get-regexp", "^includeIf\\..*\\.path$"],
@@ -420,16 +381,6 @@ function unquote(value) {
   }
 }
 
-function isWithin(candidate, parent) {
-  const path = relative(resolve(parent), resolve(candidate));
-  return path === "" || (!path.startsWith("..") && !isAbsolute(path));
-}
-
-function samePath(left, right) {
-  const normalize = (value) => portable(resolve(value)).toLowerCase();
-  return normalize(left) === normalize(right);
-}
-
 function portable(value) {
   return value.replace(/\\/g, "/");
 }

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.test.mjs

@@ -15,7 +15,17 @@ test("standalone consumer resolves fresh project targets without node_modules",
     const scripts = join(root, ".agents/skills/zaip-skill-github-deploy/scripts");
     mkdirSync(scripts, { recursive: true });
     mkdirSync(join(root, ".agents/config"), { recursive: true });
-    for (const file of ["preflight.mjs", "yaml-parser.mjs", "framework-identity.mjs"])
+    for (const file of [
+      "preflight.mjs",
+      "preflight-options.mjs",
+      "deploy-auth.mjs",
+      "git-command.mjs",
+      "git-config-paths.mjs",
+      "git-destination.mjs",
+      "application-content.mjs",
+      "yaml-parser.mjs",
+      "framework-identity.mjs",
+    ])
       copyFileSync(join(import.meta.dirname, file), join(scripts, file));
     const run = (...args) =>
       spawnSync(process.execPath, [join(scripts, "preflight.mjs"), "--repository", root, ...args], {

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/project-restrictions.mjs

@@ -0,0 +1,201 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { join, resolve } from "node:path";
+
+const POLICY = ".agents/config/publication-restrictions.json";
+const LIMIT = 256 * 1024;
+const choices = Object.freeze({
+  git_transport: "ssh-only",
+  github_api: "forbidden",
+  release: "forbidden",
+  sql: "forbidden",
+  validation_environment: "production-only",
+});
+const assert = (value, message) => {
+  if (!value) throw new Error(message);
+};
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export const POLICY_PATH = ".agents/config/deploy-policy.json";
+export const DEFAULT_POLICY = Object.freeze({
+  schema_version: 1,
+  default_mode: "auto",
+  default_scope: "current-work",
+});
+
+export function validatePolicy(policy = DEFAULT_POLICY) {
+  assert(policy && typeof policy === "object" && !Array.isArray(policy), "Invalid deploy policy");
+  assert(
+    Object.keys(policy).every((k) =>
+      ["schema_version", "default_mode", "default_scope"].includes(k),
+    ),
+    "Unsupported deploy policy field",
+  );
+  assert(
+    policy.schema_version === 1 &&
+      ["auto", "commits", "release"].includes(policy.default_mode) &&
+      policy.default_scope === "current-work",
+    "Invalid deploy policy; scope must be current-work",
+  );
+  return { ...policy };
+}
+const identity = (path) =>
+  process.platform === "win32" ? resolve(path).toLowerCase() : resolve(path);
+const object = (value) =>
+  value !== null &&
+  typeof value === "object" &&
+  !Array.isArray(value) &&
+  [null, Object.prototype].includes(Object.getPrototypeOf(value));
+const freeze = (value) => Object.freeze(value);
+
+/** Neutral values impose no additional restriction. No value can grant an action. */
+export function validateProjectRestrictions(policy) {
+  if (policy === undefined) policy = { schema_version: 1 };
+  assert(
+    object(policy) &&
+      Object.keys(policy).every((key) =>
+        ["schema_version", "constraints", "rule_sources"].includes(key),
+      ) &&
+      policy.schema_version === 1,
+    "Invalid publication restrictions policy",
+  );
+  const input = policy.constraints === undefined ? {} : policy.constraints;
+  assert(
+    object(input) && Object.keys(input).every((key) => Object.hasOwn(choices, key)),
+    "Unsupported publication restriction constraint",
+  );
+  const constraints = {};
+  for (const [key, restricted] of Object.entries(choices)) {
+    const value = Object.hasOwn(input, key) ? input[key] : "default";
+    assert(
+      value === "default" || value === restricted,
+      `Invalid deny-only publication constraint: ${key}`,
+    );
+    constraints[key] = value;
+  }
+  const refs = policy.rule_sources === undefined ? [] : policy.rule_sources;
+  assert(
+    Array.isArray(refs) && refs.length <= 32,
+    "Publication Rule references exceed the bounded limit",
+  );
+  const seen = new Set();
+  const rule_sources = refs.map((ref) => {
+    assert(
+      object(ref) &&
+        Object.keys(ref).length === 2 &&
+        Object.hasOwn(ref, "path") &&
+        Object.hasOwn(ref, "sha256"),
+      "Invalid publication Rule reference",
+    );
+    assert(
+      typeof ref.path === "string" &&
+        ref.path.length <= 240 &&
+        /^\.agents\/rules\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+\.md$/.test(ref.path),
+      "Unsafe publication Rule reference path",
+    );
+    assert(
+      typeof ref.sha256 === "string" && /^[a-f0-9]{64}$/.test(ref.sha256),
+      "Invalid publication Rule digest",
+    );
+    const key = process.platform === "win32" ? ref.path.toLowerCase() : ref.path;
+    assert(!seen.has(key), "Duplicate publication Rule reference");
+    seen.add(key);
+    return freeze({ path: ref.path, sha256: ref.sha256 });
+  });
+  return freeze({ constraints: freeze(constraints), rule_sources: freeze(rule_sources) });
+}
+
+// JSON.parse establishes syntax; this second pass rejects ambiguous duplicate keys.
+function parsePolicy(bytes) {
+  const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  const parsed = JSON.parse(text),
+    stack = [];
+  const tokens = /"(?:\\[\s\S]|[^"\\])*"|[{}[\]:,]/g;
+  for (const match of text.matchAll(tokens)) {
+    const token = match[0];
+    if (token === "{") stack.push(new Set());
+    else if (token === "[") stack.push(null);
+    else if (token === "}" || token === "]") stack.pop();
+    else if (token.startsWith('"') && /^\s*:/.test(text.slice(match.index + token.length))) {
+      const keys = stack.at(-1),
+        key = JSON.parse(token);
+      assert(keys instanceof Set && !keys.has(key), "Duplicate publication policy object key");
+      keys.add(key);
+    }
+  }
+  return parsed;
+}
+
+async function physicalFile(root, relative, optional = false) {
+  const segments = relative.split("/");
+  let path = root;
+  for (const [index, segment] of segments.entries()) {
+    path = join(path, segment);
+    let info;
+    try {
+      info = await lstat(path);
+    } catch (error) {
+      if (optional && error?.code === "ENOENT") return null;
+      throw error;
+    }
+    assert(!info.isSymbolicLink(), "Publication restriction paths cannot follow links");
+    if (index < segments.length - 1)
+      assert(info.isDirectory(), "Publication restriction ancestor must be a directory");
+    else {
+      assert(
+        info.isFile() && info.nlink === 1 && info.size <= LIMIT,
+        "Publication restriction must be a bounded physical file without aliases",
+      );
+      assert(
+        identity(await realpath(path)) === identity(path),
+        "Publication restriction physical path changed",
+      );
+      return { path, info };
+    }
+  }
+}
+
+async function boundedRead(root, path, optional = false) {
+  const before = await physicalFile(root, path, optional);
+  if (!before) return null;
+  const bytes = await readFile(before.path);
+  assert(bytes.length <= LIMIT, "Publication restriction exceeds bounded file size");
+  const after = await physicalFile(root, path);
+  assert(
+    before.info.dev === after.info.dev &&
+      before.info.ino === after.info.ino &&
+      before.info.size === after.info.size &&
+      before.info.mtimeMs === after.info.mtimeMs &&
+      before.info.ctimeMs === after.info.ctimeMs,
+    "Publication restriction changed while reading",
+  );
+  return bytes;
+}
+
+/** Re-read on every publication recheck. Missing policy is explicit and never means human authorization. */
+export async function readProjectRestrictions(repository) {
+  const root = resolve(repository),
+    info = await lstat(root);
+  assert(
+    info.isDirectory() &&
+      !info.isSymbolicLink() &&
+      identity(await realpath(root)) === identity(root),
+    "Publication restrictions require a physical repository root",
+  );
+  const bytes = await boundedRead(root, POLICY, true);
+  const normalized = validateProjectRestrictions(bytes === null ? undefined : parsePolicy(bytes));
+  for (const ref of normalized.rule_sources) {
+    const rule = await boundedRead(root, ref.path);
+    assert(
+      digest(rule) === ref.sha256,
+      "Publication Rule digest changed; refresh the reviewed policy before publishing",
+    );
+  }
+  // Detect policy drift during Rule verification rather than return a mixed snapshot.
+  const verified = await boundedRead(root, POLICY, true);
+  assert(
+    (bytes === null && verified === null) ||
+      (bytes !== null && verified !== null && bytes.equals(verified)),
+    "Publication restrictions changed during verification",
+  );
+  return freeze({ ...normalized, policy_sha256: bytes === null ? null : digest(bytes) });
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/project-restrictions.test.mjs

@@ -0,0 +1,154 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { link, mkdir, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import test from "node:test";
+import { readProjectRestrictions, validateProjectRestrictions } from "./project-restrictions.mjs";
+
+const hash = (text) => createHash("sha256").update(text).digest("hex");
+async function fixture(t) {
+  const root = await mkdtemp(join(tmpdir(), "zaip-restrictions-"));
+  t.after(() => rm(root, { recursive: true, force: true, maxRetries: 5 }));
+  const write = async (path, value) => {
+    const target = join(root, path);
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(target, value);
+    return target;
+  };
+  const policy = (value) =>
+    write(
+      ".agents/config/publication-restrictions.json",
+      typeof value === "string" || Buffer.isBuffer(value) ? value : JSON.stringify(value),
+    );
+  return { root, write, policy };
+}
+
+test("missing policy is explicitly neutral, frozen and grants nothing", async (t) => {
+  const f = await fixture(t),
+    result = await readProjectRestrictions(f.root);
+  assert.equal(result.policy_sha256, null);
+  assert.deepEqual(result.rule_sources, []);
+  assert.ok(Object.values(result.constraints).every((value) => value === "default"));
+  assert.ok(Object.isFrozen(result) && Object.isFrozen(result.constraints));
+  assert.deepEqual(validateProjectRestrictions().constraints, result.constraints);
+});
+
+test("strict deny-only constraints normalize without interpreting Rule prose", () => {
+  const constraints = {
+    git_transport: "ssh-only",
+    github_api: "forbidden",
+    release: "forbidden",
+    sql: "forbidden",
+    validation_environment: "production-only",
+  };
+  assert.deepEqual(
+    validateProjectRestrictions({ schema_version: 1, constraints }).constraints,
+    constraints,
+  );
+  for (const policy of [
+    null,
+    [],
+    {},
+    { schema_version: 2 },
+    { schema_version: 1, grant: true },
+    { schema_version: 1, constraints: { sql: "allowed" } },
+    { schema_version: 1, constraints: { deploy: "authorized" } },
+    { schema_version: 1, constraints: null },
+  ])
+    assert.throws(() => validateProjectRestrictions(policy));
+});
+
+test("hashes actual raw policy and revalidates exact Rule bytes on each read", async (t) => {
+  const f = await fixture(t),
+    rule = "# SSH only\n",
+    ref = { path: ".agents/rules/publication.md", sha256: hash(rule) };
+  await f.write(ref.path, rule);
+  const input = {
+    schema_version: 1,
+    constraints: { git_transport: "ssh-only" },
+    rule_sources: [ref],
+  };
+  const raw = JSON.stringify(input);
+  await f.policy(raw);
+  const first = await readProjectRestrictions(f.root);
+  assert.equal(first.policy_sha256, hash(raw));
+  assert.deepEqual(first.rule_sources, [ref]);
+  await f.policy(`${raw}\n`);
+  assert.notEqual((await readProjectRestrictions(f.root)).policy_sha256, first.policy_sha256);
+  await f.write(ref.path, `${rule}Changed\n`);
+  await assert.rejects(readProjectRestrictions(f.root), /digest changed/);
+});
+
+test("rejects traversal, foreign paths, duplicate refs and malformed digests", () => {
+  for (const path of [
+    "../secret",
+    ".agents/rules/../../secret.md",
+    "C:/secret.md",
+    ".agents/rules/link/../rule.md",
+    ".agents\\rules\\rule.md",
+    ".agents/config/rule.md",
+  ])
+    assert.throws(() =>
+      validateProjectRestrictions({
+        schema_version: 1,
+        rule_sources: [{ path, sha256: "a".repeat(64) }],
+      }),
+    );
+  const ref = { path: ".agents/rules/a.md", sha256: "a".repeat(64) };
+  assert.throws(() => validateProjectRestrictions({ schema_version: 1, rule_sources: [ref, ref] }));
+  assert.throws(() =>
+    validateProjectRestrictions({ schema_version: 1, rule_sources: [{ ...ref, sha256: "bad" }] }),
+  );
+  assert.throws(() =>
+    validateProjectRestrictions({ schema_version: 1, rule_sources: Array(33).fill(ref) }),
+  );
+});
+
+test("rejects ambiguous JSON, invalid UTF8 and oversized policy or Rule files", async (t) => {
+  const f = await fixture(t);
+  for (const raw of [
+    '{"schema_version":1,"schema_version":1}',
+    '{"schema_version":1,"constraints":{"sql":"forbidden","sql":"default"}}',
+    "{",
+  ]) {
+    await f.policy(raw);
+    await assert.rejects(readProjectRestrictions(f.root));
+  }
+  await f.policy(Buffer.from([0xff]));
+  await assert.rejects(readProjectRestrictions(f.root));
+  await f.policy(" ".repeat(256 * 1024 + 1));
+  await assert.rejects(readProjectRestrictions(f.root), /bounded/);
+  const path = ".agents/rules/large.md",
+    rule = "a".repeat(256 * 1024 + 1);
+  await f.write(path, rule);
+  await f.policy({ schema_version: 1, rule_sources: [{ path, sha256: hash(rule) }] });
+  await assert.rejects(readProjectRestrictions(f.root), /bounded/);
+});
+
+test("refuses hardlinked policy and Rule files", async (t) => {
+  const f = await fixture(t),
+    policy = await f.policy({ schema_version: 1 });
+  await link(policy, join(f.root, "policy-alias.json"));
+  await assert.rejects(readProjectRestrictions(f.root), /aliases/);
+  await rm(join(f.root, "policy-alias.json"));
+  const path = ".agents/rules/policy.md",
+    text = "Rule\n",
+    rule = await f.write(path, text);
+  await f.policy({ schema_version: 1, rule_sources: [{ path, sha256: hash(text) }] });
+  await link(rule, join(f.root, "rule-alias.md"));
+  await assert.rejects(readProjectRestrictions(f.root), /aliases/);
+});
+
+test("refuses symlinked ancestors instead of reading outside the repository", async (t) => {
+  const f = await fixture(t),
+    outside = await fixture(t);
+  await outside.write("publication-restrictions.json", '{"schema_version":1}');
+  await mkdir(join(f.root, ".agents"));
+  await symlink(
+    outside.root,
+    join(f.root, ".agents/config"),
+    process.platform === "win32" ? "junction" : "dir",
+  );
+  await assert.rejects(readProjectRestrictions(f.root), /links/);
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/publication-authority-callbacks.test.mjs

@@ -0,0 +1,46 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { resolveDeployment } from "./deploy-contract.mjs";
+import { guardedCommits } from "./guarded-commits.mjs";
+
+test("injected reads and destination callbacks cannot authorize a commit publication effect", async () => {
+  const root = await mkdtemp(join(tmpdir(), "zaip-publication-callback-"));
+  let effects = 0;
+  execFileSync("git", ["init", "--quiet"], { cwd: root, windowsHide: true });
+  const current = {
+    request: "Faça deploy.",
+    identity: { origin: "git@github.com:fixture/project.git", rootName: "fixture" },
+  };
+  const input = {
+    repository: root,
+    request: current.request,
+    plan: resolveDeployment(current),
+    sha: "a".repeat(40),
+    branch: "main",
+    checks: [{ command: "node", args: ["harness.mjs"] }],
+  };
+  try {
+    await assert.rejects(
+      guardedCommits(input, {
+        readInput: async () => current,
+        destination: () => {},
+        identity: () => {},
+        branchFor: () => "main",
+        checks: async () => {},
+        preflight: async () => {},
+        push: async () => {
+          effects++;
+          throw Error("fixture_reached_push_without_native_authority");
+        },
+      }),
+      /publication_native_capability_missing|exact_source_run|required.*native/i,
+    );
+    assert.equal(effects, 0);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});