@akira-tl/forgerelay 0.10.1 → 0.10.3

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [0.10.3] - 2026-09-06
+
+### Added
+
+- Added first-class `cmd.exe` execution for Agent commands and Hooks with explicit cmd shell identity, editable cmd Instructions, Windows-native quoting/escaping guidance, and package-level `.cmd` launcher acceptance.
+- Added Windows cmd PTY/ConPTY lifecycle coverage for stdin, resize, background completion, timeout, interrupt, durable output, Unicode, exit codes, and child-process-tree cleanup without introducing a separate Windows Process Manager.
+
+### Fixed
+
+- Preserved raw `cmd.exe /S /C` command-line quoting through node-pty by using the Windows pre-escaped CommandLine path for interactive cmd sessions, preventing ConPTY from rewriting quoted commands and exit semantics.
+
+## [0.10.2] - 2026-09-06
+
+### Added
+
+- Added first-class Windows PowerShell 5.1 (`powershell.exe`) execution for Agent commands, Hooks, pipe/PTY sessions, shell identity guidance, and packaged Windows acceptance while preserving PowerShell 5.1-specific syntax and quoting semantics.
+
+### Fixed
+
+- Hardened the Windows ConPTY lifecycle used by PowerShell runtimes: process-tree interruption no longer passes unsupported Windows signals, leaked ConPTY input/output resources are released after exit, and Windows PowerShell text I/O is normalized to UTF-8 so PTY completion, Unicode output, durable output, and child cleanup complete reliably.
+
 ## [0.10.1] - 2026-09-05
 
 ### Added

package/README.md

@@ -295,9 +295,10 @@ See [Security Model](docs/security.md) for the full boundary and threat model.
 | --- | --- | --- |
 | Linux | Supported | Requires Node, npm, Git, and Bash. |
 | macOS | Supported | Requires Node, npm, Git, and Bash. |
-| Windows with PowerShell 7 (`pwsh`) | Supported | Agent commands and Hooks use one native `pwsh` runtime without loading the user profile. |
+| Windows with PowerShell 7 (`pwsh`) | Supported | Agent commands, Hooks, and PTY execution use one native `pwsh` runtime without loading the user profile. |
+| Windows with Windows PowerShell 5.1 (`powershell.exe`) | Supported | Agent commands, Hooks, and PTY execution use the selected 5.1 runtime with 5.1-specific syntax guidance. |
+| Windows with `cmd.exe` | Supported for Agent commands and Hooks | ForgeRelay preserves cmd syntax and reports the selected runtime explicitly; PTY/packaged-launcher lifecycle coverage is completed separately. |
 | Windows with Git Bash, WSL, MSYS2, or Cygwin Bash | Supported | Bash remains available as a compatibility path. |
-| Windows PowerShell 5.1 (`powershell.exe`) or `cmd.exe` only | Not supported yet | These runtimes are separate follow-up stages. |
 
 You can check the local runtime with:
 

package/capabilities/shell-processes/GUIDE.md

@@ -48,6 +48,6 @@ PTY 依赖 optional `node-pty`。缺少该依赖时 ForgeRelay 会明确报错
 
 ## Platform notes
 
-ForgeRelay 在 Windows 上支持 PowerShell 7 (`pwsh`) 作为原生 Command Shell Runtime；非 TTY Agent 命令与 Hooks 使用同一个 `pwsh`，禁止加载用户 profile，PTY 也复用同一 executable。公共工具名仍保留为 `bash` 以兼容 Host contract，实际命令语言以 ForgeRelay 报告的 Command Shell Runtime 为准。Windows PowerShell 5.1 (`powershell.exe`) 与 `cmd.exe` 仍属于后续 runtime 阶段；Git Bash、WSL、MSYS2 或 Cygwin Bash 仍可作为 Bash 兼容路径。用 `forgerelay doctor` 检查当前 shell identity、version 与 executable。
+ForgeRelay 在 Windows 上原生支持 PowerShell 7 (`pwsh`) 与 Windows PowerShell 5.1 (`powershell.exe`) 的 Agent、Hook 和 PTY 执行，也支持 `cmd.exe` 作为 Agent 命令与 Hook 的一等 Command Shell Runtime。Agent 命令与 Hooks 始终复用已选择的 runtime，不会为了兼容性静默切换到 Bash 或 PowerShell；PowerShell runtime 不加载用户 profile。公共工具名仍保留为 `bash` 以兼容 Host contract，实际命令语言以 ForgeRelay 报告的 Command Shell Runtime 为准。`cmd.exe` 的 PTY/ConPTY 与 packaged `.cmd` launcher lifecycle 属于下一阶段验收，不应由本阶段的非 TTY 支持推断。Git Bash、WSL、MSYS2 或 Cygwin Bash 仍可作为 Bash 兼容路径。用 `forgerelay doctor` 检查当前 shell identity、version 与 executable。
 
 Shell 可以作为用户开发任务的一部分修改普通项目文件，但始终受 ForgeRelay core mutation/safety contract 约束。涉及 privileged OS files、credentials、configuration 或外部硬件持久写入时，不要用本指南替代 core authorization/safety 规则。

package/dist/mcp/process/process-platform.js

@@ -27,6 +27,10 @@ export function resolveShellCommandForRuntime(command, runtime, options = {}) {
                 // cmd.exe /S applies special quote stripping, so the whole command must
                 // be wrapped even when the executable inside it is already quoted.
                 args: ["/d", "/s", "/c", `"${command}"`],
+                // node-pty accepts a pre-escaped Windows CommandLine string. Passing the
+                // cmd arguments as string[] makes node-pty escape embedded quotes using
+                // CommandLineToArgvW rules, which changes cmd.exe /S /C semantics.
+                ...(options.interactive ? { ptyCommandLine: `/d /s /c "${command}"` } : {}),
                 windowsVerbatimArguments: true,
             };
         case "bash":
@@ -46,11 +50,29 @@ export function resolveShellCommandForRuntime(command, runtime, options = {}) {
                     command,
                 ],
             };
-        case "fish":
         case "powershell":
+            return {
+                executable: runtime.executable,
+                args: [
+                    "-NoLogo",
+                    "-NoProfile",
+                    ...(options.interactive ? [] : ["-NonInteractive"]),
+                    "-Command",
+                    windowsPowerShellUtf8Command(command),
+                ],
+            };
+        case "fish":
             throw new Error(`Command shell runtime ${runtime.family} is identified but native execution support is not enabled in this release stage. ForgeRelay will not silently execute the command through another shell.`);
     }
 }
+function windowsPowerShellUtf8Command(command) {
+    return [
+        "[Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false)",
+        "[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)",
+        "$OutputEncoding = [Console]::OutputEncoding",
+        command,
+    ].join("; ");
+}
 export function terminateProcessTree(child, signal, detached, runtime = defaultProcessTreeRuntime) {
     if (runtime.platform === "win32" && child.pid) {
         if (runtime.killWindowsTree(child.pid))
@@ -68,3 +90,40 @@ export function terminateProcessTree(child, signal, detached, runtime = defaultP
     }
     child.kill(signal);
 }
+export function releasePtyProcessResources(pty, platform = process.platform) {
+    if (platform !== "win32")
+        return;
+    // node-pty 1.1.0 leaves ConPTY resources referenced after exit: the input
+    // PipeWrap is not destroyed (microsoft/node-pty#947), and the system-ConPTY
+    // natural-exit path does not dispose its conout worker. Keep both workarounds
+    // at the PTY boundary so the shared ProcessManager stays platform-neutral.
+    const agent = pty._agent;
+    try {
+        agent?._conoutSocketWorker?.dispose?.();
+    }
+    catch {
+        // The worker may already be disposing after an explicit PTY kill.
+    }
+    const inputSocket = agent?.inSocket;
+    if (!inputSocket || inputSocket.destroyed || typeof inputSocket.destroy !== "function")
+        return;
+    try {
+        inputSocket.destroy();
+    }
+    catch {
+        // Completion must remain observable even if node-pty already released it.
+    }
+}
+export function terminatePtyProcessTree(pty, signal, runtime = defaultProcessTreeRuntime) {
+    if (runtime.platform === "win32") {
+        runtime.killWindowsTree(pty.pid);
+        try {
+            pty.kill();
+        }
+        catch {
+            // The PTY may already have completed after tree termination.
+        }
+        return;
+    }
+    pty.kill(signal);
+}

package/dist/mcp/process/process-sessions.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { resolveShellCommandForRuntime, terminateProcessTree } from "./process-platform.js";
+import { releasePtyProcessResources, resolveShellCommandForRuntime, terminateProcessTree, terminatePtyProcessTree } from "./process-platform.js";
 import { resolveCompatibilityCommandShellRuntime, snapshotCommandShellRuntime } from "../../runtime/shell/command-shell-runtime.js";
 const DEFAULT_EXEC_YIELD_MS = 10_000;
 const DEFAULT_INTERACTIVE_YIELD_MS = 250;
@@ -240,7 +240,7 @@ export class ProcessManager {
         const processEntry = this.createProcess(input);
         this.processes.set(processEntry.id, processEntry);
         try {
-            if (input.tty && process.platform !== "win32")
+            if (input.tty)
                 await this.startPty(processEntry, input);
             else
                 this.startPipe(processEntry, input);
@@ -455,7 +455,6 @@ export class ProcessManager {
         processEntry.process = {
             write: (data) => child.stdin.write(data),
             kill: (signal = "SIGTERM") => terminateProcessTree(child, signal, detached),
-            resize: input.tty ? () => undefined : undefined,
         };
         child.stdout.on("data", (data) => this.append(processEntry, "stdout", data));
         child.stderr.on("data", (data) => this.append(processEntry, "stderr", data));
@@ -471,30 +470,25 @@ export class ProcessManager {
             throw new Error("PTY support requires the optional node-pty dependency.");
         }
         const shell = resolveShellCommandForRuntime(input.command, this.commandShellRuntime, { interactive: true });
-        let pty;
-        try {
-            pty = nodePty.spawn(shell.executable, shell.args, {
-                cwd: input.cwd,
-                env: processEnvironment({
-                    workspaceId: input.workspaceId,
-                    workspaceRoot: input.workspaceRoot,
-                    codexCi: input.codexCi,
-                }),
-                name: "xterm-256color",
-                cols: processEntry.columns,
-                rows: processEntry.rows,
-            });
-        }
-        catch (error) {
-            throw error;
-        }
+        const pty = nodePty.spawn(shell.executable, shell.ptyCommandLine ?? shell.args, {
+            cwd: input.cwd,
+            env: processEnvironment({
+                workspaceId: input.workspaceId,
+                workspaceRoot: input.workspaceRoot,
+                codexCi: input.codexCi,
+            }),
+            name: "xterm-256color",
+            cols: processEntry.columns,
+            rows: processEntry.rows,
+        });
         processEntry.process = {
             write: (data) => pty.write(data),
-            kill: (signal) => pty.kill(signal),
+            kill: (signal = "SIGTERM") => terminatePtyProcessTree(pty, signal),
             resize: (columns, rows) => pty.resize(columns, rows),
         };
         pty.onData((data) => this.append(processEntry, "pty", data));
         pty.onExit(({ exitCode, signal }) => {
+            releasePtyProcessResources(pty);
             this.finish(processEntry, exitCode, signal === 0 ? undefined : String(signal));
         });
     }

package/dist/runtime/shell/command-shell-runtime.js

@@ -45,7 +45,7 @@ export function resolveConfiguredCommandShellRuntime(preference, platform = proc
             runtime = resolveCommandShellRuntime({ recordedFallback });
         }
     }
-    return enrichConfiguredCommandShellRuntime(runtime, metadata.probePowerShell7Version ?? probePowerShell7Version);
+    return enrichConfiguredCommandShellRuntime(runtime, metadata.probePowerShell7Version ?? probePowerShell7Version, metadata.probeWindowsPowerShellVersion ?? probeWindowsPowerShellVersion);
 }
 export function resolveCompatibilityCommandShellRuntime(platform = process.platform, environment = process.env) {
     if (platform === "win32") {
@@ -129,39 +129,67 @@ export function formatCommandShellRuntime(runtime) {
 export function snapshotCommandShellRuntime(runtime) {
     return { ...runtime, capabilities: [...runtime.capabilities] };
 }
-function enrichConfiguredCommandShellRuntime(runtime, powerShell7VersionProbe) {
-    if (runtime.family !== "pwsh")
-        return runtime;
-    const version = powerShell7VersionProbe(runtime.executable).trim();
-    const major = Number.parseInt(version.split(".", 1)[0] ?? "", 10);
-    if (!version || !Number.isInteger(major)) {
-        throw new Error(`Unable to determine PowerShell 7 version from ${runtime.executable}.`);
+function enrichConfiguredCommandShellRuntime(runtime, powerShell7VersionProbe, windowsPowerShellVersionProbe) {
+    if (runtime.family === "pwsh") {
+        const version = powerShell7VersionProbe(runtime.executable).trim();
+        const major = Number.parseInt(version.split(".", 1)[0] ?? "", 10);
+        if (!version || !Number.isInteger(major)) {
+            throw new Error(`Unable to determine PowerShell 7 version from ${runtime.executable}.`);
+        }
+        if (major < 7) {
+            throw new Error(`Configured pwsh runtime must be PowerShell 7 or newer; detected ${version} at ${runtime.executable}.`);
+        }
+        return {
+            ...runtime,
+            version,
+            capabilities: Array.from(new Set([
+                ...runtime.capabilities,
+                "profile-isolation",
+                "pipeline-chain-operators",
+            ])),
+        };
     }
-    if (major < 7) {
-        throw new Error(`Configured pwsh runtime must be PowerShell 7 or newer; detected ${version} at ${runtime.executable}.`);
+    if (runtime.family === "powershell") {
+        const version = windowsPowerShellVersionProbe(runtime.executable).trim();
+        const [majorText, minorText] = version.split(".", 3);
+        const major = Number.parseInt(majorText ?? "", 10);
+        const minor = Number.parseInt(minorText ?? "", 10);
+        if (!version || !Number.isInteger(major) || !Number.isInteger(minor)) {
+            throw new Error(`Unable to determine Windows PowerShell version from ${runtime.executable}.`);
+        }
+        if (major !== 5 || minor !== 1) {
+            throw new Error(`Configured powershell runtime must be Windows PowerShell 5.1; detected ${version} at ${runtime.executable}. ForgeRelay will not substitute pwsh for the selected runtime.`);
+        }
+        return {
+            ...runtime,
+            version,
+            capabilities: Array.from(new Set([
+                ...runtime.capabilities,
+                "profile-isolation",
+                "powershell-5.1",
+            ])),
+        };
     }
-    return {
-        ...runtime,
-        version,
-        capabilities: Array.from(new Set([
-            ...runtime.capabilities,
-            "profile-isolation",
-            "pipeline-chain-operators",
-        ])),
-    };
+    return runtime;
 }
 function probePowerShell7Version(executable) {
+    return probePowerShellVersion(executable, "PowerShell 7");
+}
+function probeWindowsPowerShellVersion(executable) {
+    return probePowerShellVersion(executable, "Windows PowerShell");
+}
+function probePowerShellVersion(executable, label) {
     const result = spawnSync(executable, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", "$PSVersionTable.PSVersion.ToString()"], { encoding: "utf8", windowsHide: true, timeout: 5_000 });
     if (result.error) {
-        throw new Error(`Unable to query PowerShell 7 version from ${executable}: ${result.error.message}`);
+        throw new Error(`Unable to query ${label} version from ${executable}: ${result.error.message}`);
     }
     if (result.status !== 0) {
         const detail = result.stderr?.trim();
-        throw new Error(`Unable to query PowerShell 7 version from ${executable}: exited with code ${result.status ?? "unknown"}${detail ? `: ${detail}` : ""}.`);
+        throw new Error(`Unable to query ${label} version from ${executable}: exited with code ${result.status ?? "unknown"}${detail ? `: ${detail}` : ""}.`);
     }
     const version = result.stdout?.trim();
     if (!version)
-        throw new Error(`Unable to query PowerShell 7 version from ${executable}: no version was reported.`);
+        throw new Error(`Unable to query ${label} version from ${executable}: no version was reported.`);
     return version;
 }
 export function commandShellAgentInstruction(runtime) {
@@ -173,6 +201,11 @@ export function commandShellAgentInstruction(runtime) {
         `Executable: ${runtime.executable}.`,
         `Selection source: ${runtime.source}.`,
         "Write shell commands for this runtime rather than assuming Bash syntax.",
+        ...(runtime.family === "powershell"
+            ? ["Windows PowerShell 5.1 does not support PowerShell 7 pipeline-chain operators && or ||."]
+            : runtime.family === "cmd"
+                ? ["cmd.exe uses %NAME% environment expansion and %ERRORLEVEL% process status. Do not emit PowerShell or Bash syntax unless explicitly launching those shells as child processes."]
+                : []),
     ].join(" ");
 }
 function runtimeFromSelection(selection, source) {

package/dist/server.js

@@ -124,7 +124,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         };
     };
     const toolDescriptions = buildToolDescriptions(config);
-    const hooks = new HookRunner(config.hooks, config.logging, process.env, (workspaceId, result) => attachCompletedProcessNotices(processSessions, workspaceId, result, (snapshot) => recordBashCompletion(activityLifecycle, bashOutputStore, snapshot.outputId)));
+    const hooks = new HookRunner(config.hooks, config.logging, process.env, (workspaceId, result) => attachCompletedProcessNotices(processSessions, workspaceId, result, (snapshot) => recordBashCompletion(activityLifecycle, bashOutputStore, snapshot.outputId)), config.commandShellRuntime);
     const incomingArtifactRegistry = new IncomingArtifactAdapterRegistry(incomingArtifactAdapters);
     const artifactDownloadAvailable = config.artifactsEnabled && isArtifactDownloadSupportedPlatform();
     const reviewChangesAvailable = config.widgets === "changes";

package/dist/subagents/sessions/execution.js

@@ -13,7 +13,7 @@ export async function executeSubagentRun(config, input, providerRunner = runSuba
         if (record.activeRun?.id !== input.runId) {
             throw new Error(`Subagent Run ${input.runId} is not active for Session ${record.id}.`);
         }
-        const hooks = new HookRunner(config.hooks, config.logging);
+        const hooks = new HookRunner(config.hooks, config.logging, process.env, undefined, config.commandShellRuntime);
         const hookInvocation = {
             workspaceId: record.workspaceId,
             workspaceRoot: record.workspaceRoot,

package/docs/gotchas.md

@@ -162,10 +162,7 @@ ForgeRelay does not intentionally leave the source checkout in a merge-conflict
 
 ## Windows shell commands fail
 
-ForgeRelay supports PowerShell 7 (`pwsh`) as a native Windows Command Shell Runtime.
-Agent commands and Hooks share that runtime and do not load the user PowerShell profile.
-Windows PowerShell 5.1 (`powershell.exe`) and `cmd.exe` remain separate follow-up runtimes.
-Git Bash, WSL, MSYS2, and Cygwin Bash also remain supported compatibility paths.
+ForgeRelay supports PowerShell 7 (`pwsh`) and Windows PowerShell 5.1 (`powershell.exe`) as native Windows Command Shell Runtimes. Agent commands and Hooks share the selected runtime and PowerShell execution does not load the user profile. `cmd.exe` is also a first-class Agent/Hook runtime: use `%NAME%`, `%ERRORLEVEL%`, cmd quoting/chaining/redirection, and `^` escaping rather than silently substituting PowerShell or Bash syntax. cmd PTY/ConPTY and packaged `.cmd` launcher lifecycle coverage is completed separately. Git Bash, WSL, MSYS2, and Cygwin Bash remain supported compatibility paths.
 
 Check the selected runtime with:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",
@@ -43,6 +43,8 @@
     "traffic:audit": "node --import tsx scripts/debug/traffic/traffic-audit.mjs",
     "lsp:interop": "node scripts/lsp/interop.mjs",
     "pwsh:accept": "node scripts/ci/pwsh-acceptance.mjs",
+    "powershell51:accept": "node scripts/ci/powershell51-acceptance.mjs",
+    "cmd:accept": "node scripts/ci/cmd-acceptance.mjs",
     "wiki:check": "node scripts/wiki/sync.mjs check",
     "wiki:publish": "node scripts/wiki/sync.mjs publish",
     "architecture:check": "node scripts/ci/architecture.mjs",
@@ -53,7 +55,7 @@
     "release:push-ready": "node scripts/release/push-ready.mjs",
     "postinstall": "node scripts/fix-node-pty-permissions.mjs",
     "start": "node dist/cli.js serve",
-    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/workspaces/relay/tests/recovery.test.ts && tsx src/workspaces/relay/tests/checkpoint.test.ts && tsx src/runtime/config/config.test.ts && tsx src/runtime/instructions/powershell-skill.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/runtime/state/runtime-lease.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/mcp/server/workspace/workspace-recovery.test.ts && tsx src/mcp/server/workspace/workspace-checkpoint.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/maintenance.test.ts && tsx src/cli/maintenance-prune.test.ts && tsx src/cli/cli.test.ts",
+    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/workspaces/relay/tests/recovery.test.ts && tsx src/workspaces/relay/tests/checkpoint.test.ts && tsx src/runtime/config/config.test.ts && tsx src/runtime/shell/command-shell-runtime.test.ts && tsx src/runtime/instructions/shell-instructions.test.ts && tsx src/runtime/instructions/powershell-skill.test.ts && tsx src/cli/shell/setup.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/runtime/state/runtime-lease.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/mcp/server/operations/hooks.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/mcp/server/workspace/workspace-recovery.test.ts && tsx src/mcp/server/workspace/workspace-checkpoint.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/maintenance.test.ts && tsx src/cli/maintenance-prune.test.ts && tsx src/cli/cli.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "release:check": "node scripts/release-version.mjs check",
     "release:tag-check": "node scripts/release-version.mjs tag",