GoLive refuses apply without a plan and without --yes. 5 of 5 tests in 11.5 s

mikehasa/golive-skill is an agent skill and Node CLI that takes an agent-built product live on your own hosting, database, domain, email and payment accounts through detect, plan, approve, apply and verify. We pinned golive@0.1.0-alpha.9 and tested the approve step. On October 14, 2026 the report passed 5 of 5 tests in 11.5 s, and apply refused twice, once without a plan id and once with a plan id but no --yes. --yes is a command-line flag, and an agent with a shell can type it.

The catch

GoLive's approval check is a usage check inside the CLI. Both refusals exit 1 with error code usage, and nothing in the CLI can tell whether a person or an agent passed --yes. The lab adds two guards around that. The ship-with-approval skill tells the agent to stop after plan and show the plan to a human. And test/no-yes-in-repo.test.ts scans the repo's scripts, workflows and skills for any golive apply line that carries an approval flag, so CI fails if someone wires approval into automation.

Neither guard stops a live agent session that decides to run the command anyway. If your agent has a shell on a machine with your provider credentials, put the real stop in a sandbox or a permission rule outside GoLive. The CLI is also an alpha release, so pin it and re-run the tests when you upgrade.

What we ran (keyless)

bash scripts/fetch-upstream.sh
bun install
bun run typecheck
bun run check:skills
bun test
bun run report

From reports/golive-approval.json, run on October 14, 2026:

The five tests cover the whole approval path. One runs golive version --json and checks the version, the release ref v0.1.0-alpha.9 and bundle digest e7bc6549…. One runs detect, init and plan against a fixture app in a temp home, checks for a 12-character hex planId, and checks that planning created no credential or key files in that home. Two cover the refusals, with these messages:

apply needs --plan <planId> (from `plan` or `teardown`, approved by the human)
refusing to write without --yes (the human must approve the plan first)

The fifth is the repo scan for approval flags. The upstream vitest cohort and the Node 20 runtime smoke have their own scripts (bash scripts/upstream-ci.sh, bash scripts/run-upstream-runtime-smoke.sh), and this report does not include their results.

How it is wired

This gate sits at the far end of the pipeline, after the code merged, at the point where the product touches real accounts. The agent runs golive detect --json, golive init --stack hosting=vercel --json and golive plan --json, then stops and hands over the planId. A human reads the plan and runs apply with that id and --yes, plus any DNS, live or destroy confirmations the plan asks for, then runs golive verify. CI runs only the refusal paths and never deploys.

Minilab (open source)

Upstream is mikehasa/golive-skill (1,280 stars, MIT, TypeScript, as of October 14, 2026), pinned at 8fd3d8e9. Clone the lab, run bash scripts/fetch-upstream.sh, bun install and bun run report, and read reports/golive-approval.md for the same numbers in prose.

bash scripts/fetch-upstream.sh && bun install && bun run report