@akira-tl/forgerelay 1.1.2 → 1.2.0

package/scripts/ci/gates/acceptance-artifact.mjs

@@ -0,0 +1,66 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync } from "node:fs";
+import { resolve } from "node:path";
+
+export function resolveAcceptancePrefix(repoRoot) {
+  const configuredPrefix = process.env.FORGERELAY_ACCEPTANCE_PREFIX?.trim();
+  return configuredPrefix ? resolve(repoRoot, configuredPrefix) : undefined;
+}
+
+export function resolveAcceptanceTarball({ repoRoot, artifactDir, npmCli }) {
+  const configuredTarball = process.env.FORGERELAY_ACCEPTANCE_TARBALL?.trim();
+  const configuredDir = process.env.FORGERELAY_ACCEPTANCE_ARTIFACT_DIR?.trim();
+  if (configuredTarball && configuredDir) {
+    throw new Error("Set only one of FORGERELAY_ACCEPTANCE_TARBALL or FORGERELAY_ACCEPTANCE_ARTIFACT_DIR.");
+  }
+
+  if (configuredTarball) {
+    const tarball = resolve(repoRoot, configuredTarball);
+    assertTarball(tarball, "configured acceptance tarball");
+    console.log(`Using prebuilt npm artifact: ${tarball}`);
+    return tarball;
+  }
+
+  if (configuredDir) {
+    const directory = resolve(repoRoot, configuredDir);
+    const packages = existsSync(directory)
+      ? readdirSync(directory).filter((name) => name.endsWith(".tgz"))
+      : [];
+    if (packages.length !== 1) {
+      throw new Error(
+        `Acceptance artifact directory must contain exactly one .tgz package; found ${packages.length}: ${directory}`,
+      );
+    }
+    const tarball = resolve(directory, packages[0]);
+    assertTarball(tarball, "downloaded acceptance tarball");
+    console.log(`Using prebuilt npm artifact: ${tarball}`);
+    return tarball;
+  }
+
+  const result = spawnSync(
+    process.execPath,
+    [npmCli, "pack", "--json", "--pack-destination", artifactDir],
+    {
+      cwd: repoRoot,
+      env: process.env,
+      encoding: "utf8",
+      windowsHide: true,
+      shell: false,
+    },
+  );
+  if (result.error || result.status !== 0) {
+    throw new Error(`npm pack failed: ${result.error?.message ?? result.stderr ?? result.stdout ?? result.status}`);
+  }
+  const report = JSON.parse(result.stdout);
+  const filename = report?.[0]?.filename;
+  if (!filename) throw new Error(`npm pack did not report a package filename: ${result.stdout}`);
+  const tarball = resolve(artifactDir, filename);
+  assertTarball(tarball, "locally packed acceptance tarball");
+  return tarball;
+}
+
+function assertTarball(tarball, label) {
+  if (!tarball.endsWith(".tgz") || !existsSync(tarball)) {
+    throw new Error(`${label} is missing or is not an npm .tgz artifact: ${tarball}`);
+  }
+}

package/scripts/ci/gates/core-contract.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+
+const npmCli = process.env.npm_execpath;
+if (!npmCli) throw new Error("ci:contract must run through npm so npm_execpath is available");
+
+console.log(`Core CI contract: ${process.platform}/${process.arch} ${process.version}`);
+runNpm(["--version"], "npm version");
+runNpm(["run", "config:schema:check"], "Config schemas");
+runNpm(["run", "architecture:check"], "Architecture");
+runNpm(["run", "release:check"], "Release metadata");
+runNpm(["run", "typecheck"], "Typecheck");
+console.log("Core CI contract passed.");
+
+function runNpm(args, label) {
+  console.log(`\n== ${label} ==`);
+  const result = spawnSync(process.execPath, [npmCli, ...args], {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: "inherit",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`${label} failed with exit ${result.status ?? "unknown"}`);
+}

package/scripts/ci/gates/platform-tests.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+
+const npmCli = process.env.npm_execpath;
+if (!npmCli) throw new Error("ci:platform-tests must run through npm so npm_execpath is available");
+
+const tests = [
+  "src/cli/mcp/diagnostics.test.ts",
+  "src/runtime/shell/command-shell-runtime.test.ts",
+  "src/runtime/state/lock/file-lock.test.ts",
+  "src/runtime/state/runtime-lease.test.ts",
+  "src/runtime/state/db/migrations.test.ts",
+  "src/mcp/process/process-platform.test.ts",
+  "src/mcp/process/process-sessions.test.ts",
+  "src/mcp/filesystem/roots.test.ts",
+  "src/mcp/filesystem/file-mutations.test.ts",
+  "src/workspaces/state/workspace-store.test.ts",
+  "src/workspaces.test.ts",
+  "src/workspaces/conversation-checkout.test.ts",
+  "src/workspaces/conversation-worktree.test.ts",
+  "src/workspaces/git/worktree-recovery.test.ts",
+];
+
+console.log(`Platform-sensitive CI tests: ${process.platform}/${process.arch} (${tests.length} files).`);
+for (const path of tests) {
+  console.log(`\n== ${path} ==`);
+  const result = spawnSync(process.execPath, [npmCli, "exec", "--", "tsx", path], {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: "inherit",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`Platform-sensitive test failed with exit ${result.status ?? "unknown"}: ${path}`);
+}
+console.log("Platform-sensitive CI tests passed.");

package/scripts/ci/gates/prepare-windows-product.mjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { resolveAcceptancePrefix, resolveAcceptanceTarball } from "./acceptance-artifact.mjs";
+
+if (process.platform !== "win32") {
+  console.log("Prepared Windows product install skipped outside Windows.");
+  process.exit(0);
+}
+
+const npmCli = process.env.npm_execpath;
+if (!npmCli) throw new Error("Windows product preparation must run through npm so npm_execpath is available");
+
+const repoRoot = process.cwd();
+const prefix = resolveAcceptancePrefix(repoRoot);
+if (!prefix) {
+  throw new Error("FORGERELAY_ACCEPTANCE_PREFIX is required for the shared Windows product install.");
+}
+
+rmSync(prefix, { recursive: true, force: true });
+await mkdir(prefix, { recursive: true });
+const artifactDir = join(prefix, ".artifact-fallback");
+await mkdir(artifactDir, { recursive: true });
+const tarball = resolveAcceptanceTarball({ repoRoot, artifactDir, npmCli });
+
+const install = spawnSync(
+  process.execPath,
+  [npmCli, "install", "--global", "--prefix", prefix, "--no-audit", "--no-fund", tarball],
+  {
+    cwd: repoRoot,
+    env: process.env,
+    encoding: "utf8",
+    windowsHide: true,
+    shell: false,
+    timeout: 240_000,
+  },
+);
+if (install.error || install.status !== 0) {
+  throw new Error(
+    `Shared Windows product install failed: ${install.error?.message ?? install.stderr ?? install.stdout ?? install.status}`,
+  );
+}
+
+const installedRoot = join(prefix, "node_modules", "@akira-tl", "forgerelay");
+for (const expected of [
+  join(installedRoot, "dist", "cli.js"),
+  join(prefix, "forgerelay.cmd"),
+  join(prefix, "forgerelay.ps1"),
+]) {
+  assert.ok(existsSync(expected), `Prepared Windows product install is missing: ${expected}`);
+}
+
+console.log(`Prepared shared Windows product install from ${tarball} at ${prefix}.`);

package/scripts/ci/gates/test-shard.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+
+import { readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+
+const npmCli = process.env.npm_execpath;
+if (!npmCli) throw new Error("ci:test-shard must run through npm so npm_execpath is available");
+
+const shard = process.argv[2];
+const allowed = new Set(["runtime-config", "workspace-mcp", "lsp", "subagent-ui-cli"]);
+if (!allowed.has(shard)) {
+  throw new Error(`Unknown CI test shard '${shard ?? ""}'. Expected one of: ${[...allowed].join(", ")}`);
+}
+
+const repoRoot = process.cwd();
+const pkg = JSON.parse(readFileSync(resolve(repoRoot, "package.json"), "utf8"));
+const commands = String(pkg.scripts?.test ?? "").split(" && ").filter(Boolean);
+if (commands.length === 0) throw new Error("package.json test script did not contain any commands");
+
+const selected = commands.filter((command) => classify(command) === shard);
+if (selected.length === 0) throw new Error(`CI test shard '${shard}' is empty`);
+
+console.log(`CI test shard ${shard}: ${selected.length}/${commands.length} test commands.`);
+for (const command of selected) runCommand(command);
+console.log(`CI test shard ${shard} passed.`);
+
+function classify(command) {
+  if (command === "npm run build:app") return "workspace-mcp";
+  if (command.includes("src/lsp/")) return "lsp";
+  if (
+    command.includes("src/workspaces/")
+    || command.includes("src/workspaces.test")
+    || command.includes("src/mcp/")
+    || command.includes("src/activity/")
+  ) return "workspace-mcp";
+  if (command.includes("src/runtime/") || command.startsWith("node --test scripts/")) {
+    return "runtime-config";
+  }
+  return "subagent-ui-cli";
+}
+
+function runCommand(command) {
+  console.log(`\n== ${command} ==`);
+  let executable;
+  let args;
+  if (command.startsWith("node --test ")) {
+    executable = process.execPath;
+    args = ["--test", ...command.slice("node --test ".length).split(" ").filter(Boolean)];
+  } else if (command.startsWith("tsx ")) {
+    executable = process.execPath;
+    args = [npmCli, "exec", "--", "tsx", ...command.slice(4).split(" ").filter(Boolean)];
+  } else if (command.startsWith("npm run ")) {
+    executable = process.execPath;
+    args = [npmCli, "run", command.slice("npm run ".length).trim()];
+  } else {
+    throw new Error(`Unsupported command in package.json test script: ${command}`);
+  }
+
+  const result = spawnSync(executable, args, {
+    cwd: repoRoot,
+    env: process.env,
+    stdio: "inherit",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`CI test shard '${shard}' command failed with exit ${result.status ?? "unknown"}: ${command}`);
+  }
+}

package/scripts/ci/powershell51-acceptance.mjs

@@ -6,6 +6,7 @@ import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { resolveAcceptancePrefix, resolveAcceptanceTarball } from "./gates/acceptance-artifact.mjs";
 
 if (process.platform !== "win32") {
   console.log("Windows PowerShell 5.1 packaged acceptance skipped outside Windows.");
@@ -362,7 +363,8 @@ async function exerciseHookRuntime(runtime) {
 
 async function exercisePackagedPowerShellShim(powershell, expectedVersion) {
   const artifactDir = join(root, "artifact");
-  const prefix = join(root, "prefix");
+  const sharedPrefix = resolveAcceptancePrefix(process.cwd());
+  const prefix = sharedPrefix ?? join(root, "prefix");
   const configDir = join(root, "config");
   const stateDir = join(root, "state");
   await Promise.all([
@@ -372,14 +374,12 @@ async function exercisePackagedPowerShellShim(powershell, expectedVersion) {
     mkdir(stateDir, { recursive: true }),
   ]);
 
-  const packed = runNpm(["pack", "--json", "--pack-destination", artifactDir]);
-  const packResult = JSON.parse(packed.stdout);
-  const filename = packResult?.[0]?.filename;
-  if (!filename) throw new Error(`npm pack did not report a package filename: ${packed.stdout}`);
-  const tarball = join(artifactDir, filename);
-  assert.ok(existsSync(tarball), `packed artifact is missing: ${tarball}`);
-
-  runNpm(["install", "--global", "--prefix", prefix, tarball]);
+  if (!sharedPrefix) {
+    const tarball = resolveAcceptanceTarball({ repoRoot: process.cwd(), artifactDir, npmCli });
+    runNpm(["install", "--global", "--prefix", prefix, tarball]);
+  } else {
+    console.log(`Using prepared acceptance install: ${prefix}`);
+  }
   const shim = join(prefix, "forgerelay.ps1");
   assert.ok(existsSync(shim), `npm did not create the PowerShell launcher shim: ${shim}`);
 

package/scripts/ci/pwsh-acceptance.mjs

@@ -6,6 +6,7 @@ import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { resolveAcceptancePrefix, resolveAcceptanceTarball } from "./gates/acceptance-artifact.mjs";
 
 if (process.platform !== "win32") {
   console.log("PowerShell 7 packaged acceptance skipped outside Windows.");
@@ -338,7 +339,8 @@ async function exerciseHookRuntime(runtime) {
 
 async function exercisePackagedPowerShellShim(pwsh, expectedVersion) {
   const artifactDir = join(root, "artifact");
-  const prefix = join(root, "prefix");
+  const sharedPrefix = resolveAcceptancePrefix(process.cwd());
+  const prefix = sharedPrefix ?? join(root, "prefix");
   const configDir = join(root, "config");
   const stateDir = join(root, "state");
   await Promise.all([
@@ -348,14 +350,12 @@ async function exercisePackagedPowerShellShim(pwsh, expectedVersion) {
     mkdir(stateDir, { recursive: true }),
   ]);
 
-  const packed = runNpm(["pack", "--json", "--pack-destination", artifactDir]);
-  const packResult = JSON.parse(packed.stdout);
-  const filename = packResult?.[0]?.filename;
-  if (!filename) throw new Error(`npm pack did not report a package filename: ${packed.stdout}`);
-  const tarball = join(artifactDir, filename);
-  assert.ok(existsSync(tarball), `packed artifact is missing: ${tarball}`);
-
-  runNpm(["install", "--global", "--prefix", prefix, tarball]);
+  if (!sharedPrefix) {
+    const tarball = resolveAcceptanceTarball({ repoRoot: process.cwd(), artifactDir, npmCli });
+    runNpm(["install", "--global", "--prefix", prefix, tarball]);
+  } else {
+    console.log(`Using prepared acceptance install: ${prefix}`);
+  }
   const shim = join(prefix, "forgerelay.ps1");
   assert.ok(existsSync(shim), `npm did not create the PowerShell launcher shim: ${shim}`);
 

package/scripts/ci/verify.mjs

@@ -9,11 +9,13 @@ if (!npmCli) {
 
 console.log(`CI environment: ${process.platform}/${process.arch} ${process.version}`);
 runNpm(["--version"], "npm version");
+runNpm(["run", "config:schema:check"], "Config schemas");
 runNpm(["run", "architecture:check"], "Architecture");
 runNpm(["run", "release:check"], "Release metadata");
 runNpm(["run", "typecheck"], "Typecheck");
 runNpm(["test"], "Full test suite");
 runNpm(["run", "build"], "Build");
+runNpm(["run", "config:product-accept"], "Config v2 packaged product acceptance");
 if (process.platform === "win32") runNpm(["run", "pwsh:accept"], "PowerShell 7 packaged acceptance");
 // The traffic audit is an end-to-end wire-budget check, not a platform feature
 // matrix. Run it once on Linux so regressions are gated without tripling the

package/scripts/ci/windows-product-acceptance.mjs

@@ -7,6 +7,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawnSync } from "node:child_process";
+import { resolveAcceptancePrefix, resolveAcceptanceTarball } from "./gates/acceptance-artifact.mjs";
 
 if (process.platform !== "win32") {
   console.log("Windows packaged product acceptance skipped outside Windows.");
@@ -22,7 +23,8 @@ const root = await import("node:fs/promises").then(({ mkdtemp }) =>
 
 try {
   const artifactDir = join(root, "artifact");
-  const prefix = join(root, "prefix");
+  const sharedPrefix = resolveAcceptancePrefix(process.cwd());
+  const prefix = sharedPrefix ?? join(root, "prefix");
   const projectRoot = join(root, "project");
   await Promise.all([
     mkdir(artifactDir, { recursive: true }),
@@ -31,14 +33,12 @@ try {
   ]);
   await writeFile(join(projectRoot, "README.md"), "Windows product acceptance workspace\n", "utf8");
 
-  const packed = runNpm(["pack", "--json", "--pack-destination", artifactDir]);
-  const packResult = JSON.parse(packed.stdout);
-  const filename = packResult?.[0]?.filename;
-  if (!filename) throw new Error(`npm pack did not report a package filename: ${packed.stdout}`);
-  const tarball = join(artifactDir, filename);
-  assert.ok(existsSync(tarball), `packed artifact is missing: ${tarball}`);
-
-  runNpm(["install", "--global", "--prefix", prefix, tarball]);
+  if (!sharedPrefix) {
+    const tarball = resolveAcceptanceTarball({ repoRoot: process.cwd(), artifactDir, npmCli });
+    runNpm(["install", "--global", "--prefix", prefix, tarball]);
+  } else {
+    console.log(`Using prepared acceptance install: ${prefix}`);
+  }
   const shim = join(prefix, "forgerelay.cmd");
   assert.ok(existsSync(shim), `npm did not create the Windows launcher shim: ${shim}`);
 
@@ -105,7 +105,6 @@ async function exercisePackagedRuntime({ family, executable, doctorIdentity, roo
         executable,
       },
       shellInstructions: true,
-      skillsEnabled: false,
     }, null, 2),
     "utf8",
   );

package/scripts/config/schema-text.mjs

@@ -0,0 +1,4 @@
+export function generatedSchemaTextMatches(actual, expected) {
+  if (typeof actual !== "string") return false;
+  return actual.replaceAll("\r\n", "\n") === expected;
+}

package/scripts/config/schema-text.test.mjs

@@ -0,0 +1,18 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { generatedSchemaTextMatches } from "./schema-text.mjs";
+
+test("generated schema freshness accepts CRLF checkout line endings", () => {
+  const expected = "{\n  \"title\": \"Config\"\n}\n";
+  const windowsCheckout = expected.replaceAll("\n", "\r\n");
+
+  assert.equal(generatedSchemaTextMatches(windowsCheckout, expected), true);
+});
+
+test("generated schema freshness still rejects semantic content changes", () => {
+  const expected = "{\n  \"title\": \"Config\"\n}\n";
+  const changed = "{\r\n  \"title\": \"Changed\"\r\n}\r\n";
+
+  assert.equal(generatedSchemaTextMatches(changed, expected), false);
+  assert.equal(generatedSchemaTextMatches(undefined, expected), false);
+});

package/scripts/config/schema.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+
+import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CONFIG_DEFINITION_CATALOG } from "../../src/runtime/config/definition/catalog.ts";
+import { generateConfigSchemaFiles } from "../../src/runtime/config/definition/schema.ts";
+import { generatedSchemaTextMatches } from "./schema-text.mjs";
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+const command = process.argv[2] ?? "check";
+const generated = generateConfigSchemaFiles(CONFIG_DEFINITION_CATALOG)
+  .map((entry) => ({
+    ...entry,
+    content: `${JSON.stringify(entry.schema, null, 2)}\n`,
+  }))
+  .sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+
+if (command === "write") {
+  for (const entry of generated) {
+    const path = resolve(repoRoot, entry.relativePath);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, entry.content, "utf8");
+  }
+  await removeStaleCurrentMajorSchemas();
+  console.log(`Generated ${generated.length} Config System v1 schema files.`);
+} else if (command === "check") {
+  const mismatches = [];
+  for (const entry of generated) {
+    const path = resolve(repoRoot, entry.relativePath);
+    let actual;
+    try {
+      actual = await readFile(path, "utf8");
+    } catch {
+      actual = undefined;
+    }
+    if (!generatedSchemaTextMatches(actual, entry.content)) mismatches.push(entry.relativePath);
+  }
+  const expected = new Set(generated.map((entry) => entry.relativePath));
+  for (const path of await currentMajorSchemaPaths()) {
+    if (!expected.has(path)) mismatches.push(path);
+  }
+  if (mismatches.length > 0) {
+    console.error("Generated Config schemas are out of date:");
+    for (const path of [...new Set(mismatches)].sort()) console.error(`- ${path}`);
+    console.error("Run: npm run config:schema:generate");
+    process.exit(1);
+  }
+  console.log(`Config schema check passed: ${generated.length} generated v1 schema files are current.`);
+} else {
+  throw new Error(`Unknown schema command ${JSON.stringify(command)}; expected check or write.`);
+}
+
+async function removeStaleCurrentMajorSchemas() {
+  const expected = new Set(generated.map((entry) => entry.relativePath));
+  const { rm } = await import("node:fs/promises");
+  for (const relativePath of await currentMajorSchemaPaths()) {
+    if (!expected.has(relativePath)) await rm(resolve(repoRoot, relativePath));
+  }
+}
+
+async function currentMajorSchemaPaths() {
+  const directory = resolve(repoRoot, "schemas/v1");
+  let names;
+  try {
+    names = await readdir(directory);
+  } catch {
+    return [];
+  }
+  return names
+    .filter((name) => name.endsWith(".schema.json"))
+    .map((name) => `schemas/v1/${name}`)
+    .sort();
+}

package/scripts/lsp/interop.mjs

@@ -3,6 +3,7 @@ import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CodeIntelligenceManager } from "../../dist/lsp/runtime/manager.js";
+import { ConfigRuntime } from "../../dist/runtime/config/runtime/config-runtime.js";
 import { findExecutable, probeExecutable } from "./interop-support.mjs";
 
 const repoRoot = resolve(fileURLToPath(new URL("../..", import.meta.url)));
@@ -121,8 +122,10 @@ for (const fixture of fixtures) {
 
   const root = join(interopRoot, fixture.id);
   fixture.setup(root);
+  const configDir = join(root, ".forgerelay-user");
+  mkdirSync(configDir, { recursive: true });
   const manager = new CodeIntelligenceManager(
-    { languageServers: {} },
+    { configDir, configRuntime: new ConfigRuntime() },
     {
       startTimeoutMs: 30_000,
       requestTimeoutMs: 30_000,

package/scripts/release/pack.mjs

@@ -9,23 +9,27 @@ if (!npmCli) {
   throw new Error("release:pack must be launched through npm so npm_execpath is available");
 }
 
-const outputDir = resolve(process.cwd(), process.env.RELEASE_ARTIFACT_DIR ?? ".release-artifacts");
+const repoRoot = process.cwd();
+const outputDir = resolve(repoRoot, process.env.RELEASE_ARTIFACT_DIR ?? ".release-artifacts");
 rmSync(outputDir, { recursive: true, force: true });
 mkdirSync(outputDir, { recursive: true });
 
 const result = spawnSync(
   process.execPath,
-  [npmCli, "pack", "--pack-destination", outputDir],
+  [npmCli, "pack", "--json", "--pack-destination", outputDir],
   {
-    cwd: process.cwd(),
+    cwd: repoRoot,
     env: process.env,
-    stdio: "inherit",
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
     shell: false,
   },
 );
+if (result.stderr) process.stderr.write(result.stderr);
 if (result.error) throw result.error;
 if (result.status !== 0) {
+  if (result.stdout) process.stdout.write(result.stdout);
   throw new Error(`npm pack failed with exit ${result.status ?? "unknown"}`);
 }
 
@@ -33,4 +37,60 @@ const packages = readdirSync(outputDir).filter((name) => name.endsWith(".tgz"));
 if (packages.length !== 1) {
   throw new Error(`release:pack expected exactly one .tgz artifact, found ${packages.length}`);
 }
+
+const report = parsePackReport(result.stdout);
+const packagedPaths = new Set(report.files.map((file) => file.path));
+const expectedSchemas = readdirSync(resolve(repoRoot, "schemas", "v1"))
+  .filter((name) => name.endsWith(".schema.json"))
+  .map((name) => `schemas/v1/${name}`)
+  .sort();
+if (expectedSchemas.length === 0) {
+  throw new Error("release:pack expected at least one generated Config System v1 schema");
+}
+const missingSchemas = expectedSchemas.filter((path) => !packagedPaths.has(path));
+if (missingSchemas.length > 0) {
+  throw new Error(`release:pack omitted generated Config schemas: ${missingSchemas.join(", ")}`);
+}
+
+const expectedRuntimeResources = [
+  "dist/cli.js",
+  ...collectPackageFiles(resolve(repoRoot, "templates"), "templates"),
+  ...collectPackageFiles(resolve(repoRoot, "capabilities"), "capabilities"),
+].sort();
+const missingRuntimeResources = expectedRuntimeResources.filter((path) => !packagedPaths.has(path));
+if (missingRuntimeResources.length > 0) {
+  throw new Error(
+    `release:pack omitted ForgeRelay-owned runtime resources: ${missingRuntimeResources.join(", ")}`,
+  );
+}
+
 console.log(`Verified npm artifact: ${packages[0]}`);
+console.log(`Verified packaged Config schemas: ${expectedSchemas.join(", ")}`);
+console.log(`Verified packaged ForgeRelay-owned runtime resources: ${expectedRuntimeResources.join(", ")}`);
+
+function collectPackageFiles(directory, prefix) {
+  const files = [];
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const relative = `${prefix}/${entry.name}`;
+    if (entry.isDirectory()) {
+      files.push(...collectPackageFiles(resolve(directory, entry.name), relative));
+    } else if (entry.isFile()) {
+      files.push(relative);
+    }
+  }
+  return files;
+}
+
+function parsePackReport(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`npm pack did not return valid JSON metadata: ${reason}`);
+  }
+  if (!Array.isArray(parsed) || parsed.length !== 1 || !Array.isArray(parsed[0]?.files)) {
+    throw new Error("npm pack returned an unexpected JSON report");
+  }
+  return parsed[0];
+}