refactor(schema): unify registry-first delivery

internal/generator/outputguard/outputguard_test.go

@@ -0,0 +1,53 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+
+package outputguard
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestValidateRejectsHardLinkToProtectedDirectoryMember(t *testing.T) {
+	root := t.TempDir()
+	protectedDir := filepath.Join(root, "inputs")
+	if err := os.MkdirAll(protectedDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	member := filepath.Join(protectedDir, "reviewed.json")
+	if err := os.WriteFile(member, []byte(`{}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	hardLink := filepath.Join(root, "outside-link.json")
+	if err := os.Link(member, hardLink); err != nil {
+		t.Fatal(err)
+	}
+	err := Validate(root,
+		[]Input{{Name: "reviewed directory", Path: "inputs"}},
+		[]Target{{Name: "--output", Path: hardLink}},
+	)
+	if err == nil || !strings.Contains(err.Error(), "hard link to a member") {
+		t.Fatalf("Validate() error = %v", err)
+	}
+}
+
+func TestValidateRepoTargetAllowlist(t *testing.T) {
+	root := t.TempDir()
+	allowed := filepath.Join(root, "internal/cli/schema_catalog.json")
+	if err := os.MkdirAll(filepath.Dir(allowed), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateRepoTargetAllowlist(root, Target{Name: "--output", Path: allowed}, "internal/cli/schema_catalog.json"); err != nil {
+		t.Fatalf("canonical output rejected: %v", err)
+	}
+	err := ValidateRepoTargetAllowlist(root, Target{Name: "--output", Path: filepath.Join(root, "skills/mono/SKILL.md")}, "internal/cli/schema_catalog.json")
+	if err == nil || !strings.Contains(err.Error(), "not a canonical generated delivery target") {
+		t.Fatalf("repository source output error = %v", err)
+	}
+	outside := filepath.Join(t.TempDir(), "catalog.json")
+	if err := ValidateRepoTargetAllowlist(root, Target{Name: "--output", Path: outside}, "internal/cli/schema_catalog.json"); err != nil {
+		t.Fatalf("external temporary output rejected: %v", err)
+	}
+}