@databricks-solutions/lakebase-scm-utils 0.2.43 → 0.2.45

package/dist/scripts/lakebase/scm-reconcile-tier.cli.cjs

@@ -77731,16 +77731,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_node_child_process2.execFile)("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {
@@ -79270,8 +79287,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.43".length > 0) {
-    cached = "0.2.43";
+  if ("0.2.45".length > 0) {
+    cached = "0.2.45";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/scm-reconcile-tier.cli.js

@@ -208,16 +208,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {
@@ -371,8 +388,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.43".length > 0) {
-    cached = "0.2.43";
+  if ("0.2.45".length > 0) {
+    cached = "0.2.45";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/scm-recover-orphans.cli.cjs

@@ -77849,16 +77849,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_node_child_process2.execFile)("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {

package/dist/scripts/lakebase/scm-recover-orphans.cli.js

@@ -321,16 +321,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {

package/dist/scripts/util/index.cjs

@@ -1659,8 +1659,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.43".length > 0) {
-    cached = "0.2.43";
+  if ("0.2.45".length > 0) {
+    cached = "0.2.45";
     return cached;
   }
   cached = "unknown";
@@ -1928,16 +1928,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process2.execFile)("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 
 // scripts/github/secrets.ts
 init_cjs_shims();

package/dist/scripts/util/index.js

@@ -1630,8 +1630,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.43".length > 0) {
-    cached = "0.2.43";
+  if ("0.2.45".length > 0) {
+    cached = "0.2.45";
     return cached;
   }
   cached = "unknown";
@@ -1899,16 +1899,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 
 // scripts/github/secrets.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@databricks-solutions/lakebase-scm-utils",
-  "version": "0.2.43",
+  "version": "0.2.45",
   "description": "Lakebase SCM + substrate engine: database branching, paired-branch SCM workflows, connection/credential minting, schema migration, project scaffold + deploy primitives, and the git/github utility layer. Extracted from consort for portable, standalone consumption by lakebase-scm-extension and the SFTDD orchestration.",
   "type": "module",
   "private": false,

package/scripts/lakebase/databricks-cli.ts

@@ -36,6 +36,11 @@ export interface DatabricksCliOptions {
    *  subcommand. Set this for version/help probes so they work regardless of
    *  DATABRICKS_CONFIG_PROFILE. */
   noProfile?: boolean;
+  /** Data to feed on the child's STDIN (async path only). Used to keep a
+   *  credential OFF the command line: pass the secret in a `--json @/dev/stdin`
+   *  body here instead of as a `--string-value <cred>` argv element, so it never
+   *  appears in the process table / `ps`. */
+  input?: string;
 }
 
 /** A `databricks` CLI call failed. Message: `databricks <args> failed: <msg>\nstderr: <stderr>`. */
@@ -203,17 +208,52 @@ export function classifyDatabricksError(err: unknown, argv: string[], profile: s
 /** Run the `databricks` CLI (async), returning stdout. */
 export async function runDatabricks(args: string[], opts: DatabricksCliOptions = {}): Promise<string> {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault,
-    });
+    if (opts.input !== undefined) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
 
+/**
+ * Run `databricks` feeding `input` on STDIN, so a credential can travel in a
+ * `--json @/dev/stdin` body instead of a `--string-value <cred>` argv element
+ * that leaks into the process table. Buffers stdout/stderr and shapes
+ * the result like execFileP so classifyDatabricksError reads it uniformly.
+ *
+ * The stdin write is GUARDED: a child that exits/rejects the body before we finish
+ * writing raises EPIPE on the pipe, which is an UNHANDLED 'error' (crash) unless we
+ * listen for it. We swallow the pipe error and let the child's own exit code + stderr
+ * be the verdict (guard the write against EPIPE).
+ */
+function execDatabricksWithStdin(
+  argv: string[],
+  input: string,
+  env: NodeJS.ProcessEnv,
+  timeout: number,
+): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        (err as { stdout?: string; stderr?: string }).stdout = String(stdout ?? "");
+        (err as { stdout?: string; stderr?: string }).stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve(String(stdout ?? ""));
+    });
+    // Guard the pipe: without this an EPIPE (child gone before we finish) is an
+    // uncaught exception; the child's exit/stderr is the real verdict.
+    child.stdin?.on("error", () => {});
+    child.stdin?.end(input);
+  });
+}
+
 /** Run the `databricks` CLI (sync), returning stdout. */
 export function runDatabricksSync(args: string[], opts: DatabricksCliOptions = {}): string {
   const { argv, env, profile } = buildInvocation(args, opts);

package/scripts/lakebase/doctor.ts

@@ -628,7 +628,7 @@ function checkWorkflowDrift(projectDir: string): CheckResult {
       status: "warn",
       message: `Scaffolded workflows drift from kit: ${drifted} drifted, ${missing} missing`,
       detail: { files: report.files.map((f) => ({ name: f.name, status: f.status })) },
-      hint: "Inspect via the lakebase_workflow_drift MCP tool (or detectWorkflowDrift import). Refresh manually until updateWorkflows lands.",
+      hint: "Refresh with updateWorkflows (or the lakebase_workflow_drift MCP tool). A stale merge.yml calling 'lakebase-schema-migrate apply' (not 'apply-tier') makes the promote's migrate-target fail on the tier guard; the scm-merge promote also self-heals drifted workflows onto the PR head before merging.",
     };
   } catch (err) {
     return {

package/scripts/lakebase/runner-setup.ts

@@ -271,8 +271,24 @@ export async function setupRunner(args: SetupRunnerArgs): Promise<RunnerInfo> {
   if (needsConfig) {
     report("Registering runner with GitHub...");
     const regToken = await createRegistrationToken(args.fullRepoName);
-    cp.execSync(
-      `./config.sh --url "https://github.com/${args.fullRepoName}" --token "${regToken}" --name "${name}" --labels self-hosted --unattended --replace`,
+    // Invoke config.sh with an argv array (execFileSync), NOT a shell-interpolated
+    // string (execSync). config.sh is GitHub's runner binary and only accepts the
+    // registration token as `--token <tok>`, so the token is unavoidably on its argv
+    // (a full off-`ps` fix would need the JIT-runner API — disproportionate for a
+    // SHORT-LIVED (~1h) reg token). But dropping the `/bin/sh -c` wrapper removes the
+    // extra shell process that also carried the token, closes the shell-trace /
+    // process-accounting exposure, and eliminates any shell-injection surface on the
+    // interpolated url/name.
+    cp.execFileSync(
+      "./config.sh",
+      [
+        "--url", `https://github.com/${args.fullRepoName}`,
+        "--token", regToken,
+        "--name", name,
+        "--labels", "self-hosted",
+        "--unattended",
+        "--replace",
+      ],
       { cwd: dir, timeout: KIT_TIMEOUTS.cliLong }
     );
   }

package/scripts/lakebase/scm-merge.ts

@@ -20,7 +20,9 @@ import { getOwnerRepo } from "../git/remote.js";
 import { pollUntil } from "../util/poll-until.js";
 import { exec } from "../util/exec.js";
 import { getCurrentBranch } from "../git/inspect.js";
+import { pushCurrentBranchForPr } from "../git/sync.js";
 import { resolveGitBase } from "./scm-git-base.js";
+import { detectWorkflowDrift, updateWorkflows } from "./workflow-drift.js";
 
 /**
  * Fast-forward the local tier ref to origin/<tier> after a remote merge, WITHOUT
@@ -149,6 +151,21 @@ export interface MergeArgs {
    * already on the parent branch after the merge).
    */
   localMigrateFallback?: () => Promise<{ ok: boolean; detail?: string }>;
+  /**
+   * Pre-merge workflow self-heal. Bumping SCM_UTILS_REF upgrades the CLI (e.g.
+   * the tier-migration guard) but leaves a scaffolded project's committed
+   * `.github/workflows/*.yml` at their older shape — so the promote's
+   * `migrate-target` can run a stale `lakebase-schema-migrate apply` against the
+   * parent TIER, which the guard refuses (CI red, cleanup skipped). This step
+   * refreshes drifted workflow files to the pinned template (so the promote uses
+   * `apply-tier`) and commits+pushes them onto the PR head BEFORE the merge, so
+   * the merge commit carries the corrected workflow and the triggered `<tier>
+   * Merge` run passes. BEST-EFFORT: it never blocks the merge — a detect/refresh/
+   * push failure is recorded as a warning and the merge proceeds (the local
+   * migrate fallback still keeps git and schema in sync). Defaults to the built-in
+   * implementation ({@link defaultRefreshPromoteWorkflows}); injected in tests.
+   */
+  refreshWorkflows?: () => Promise<{ refreshed: boolean; detail?: string }>;
 }
 
 export interface MergeResult {
@@ -221,6 +238,43 @@ function shaMigratePredicate(
   };
 }
 
+/**
+ * Built-in {@link MergeArgs.refreshWorkflows}. Refreshes drifted scaffolded
+ * `.github/workflows/*.yml` to the pinned template and commits + pushes them onto
+ * the PR head, so the merge commit carries the corrected promote workflow (the
+ * `migrate-target` step's `lakebase-schema-migrate apply-tier`) and the triggered
+ * `<tier> Merge` run passes instead of failing on the tier guard. No-op when
+ * nothing drifted. Scoped to `.github/workflows` so it never sweeps unrelated
+ * working-tree changes. Callers invoke it BEST-EFFORT — a failure here must never
+ * block the merge (the local migrate fallback still keeps git + schema in sync).
+ */
+export async function defaultRefreshPromoteWorkflows(
+  projectDir: string,
+): Promise<{ refreshed: boolean; detail?: string }> {
+  const drift = detectWorkflowDrift({ projectDir });
+  // Only self-heal a stale EXISTING workflow (drifted). A project with no
+  // scaffolded workflows at all (all "missing") is not the stale-apply case, so
+  // the promote never scaffolds files it doesn't own.
+  const touched = drift.files.filter((f) => f.status === "drifted").map((f) => f.name);
+  if (touched.length === 0) return { refreshed: false };
+  const result = updateWorkflows({ projectDir });
+  if (!result.changed) return { refreshed: false };
+  await exec(`git add ${shellEscape(".github/workflows")}`, { cwd: projectDir, timeout: 10_000 });
+  const staged = await exec("git diff --cached --name-only -- .github/workflows", {
+    cwd: projectDir,
+    timeout: 10_000,
+  });
+  if (!staged.trim()) return { refreshed: false };
+  await exec(
+    `git commit -m ${shellEscape(
+      "chore(ci): refresh scaffolded workflows to pinned substrate (promote uses apply-tier)",
+    )} -- .github/workflows`,
+    { cwd: projectDir, timeout: 15_000 },
+  );
+  await pushCurrentBranchForPr({ cwd: projectDir });
+  return { refreshed: true, detail: `refreshed + pushed ${touched.join(", ") || "workflow(s)"} onto the PR head` };
+}
+
 export async function mergeFeature(args: MergeArgs): Promise<MergeResult> {
   const current = readWorkflowState(args.projectDir);
   if (!current) {
@@ -297,6 +351,31 @@ export async function mergeFeature(args: MergeArgs): Promise<MergeResult> {
     authVerified = true;
   }
 
+  // ─── Pre-merge workflow self-heal ───
+  // A scaffolded project's committed workflows can lag the pinned substrate ref
+  // (SCM_UTILS_REF bumped, workflow files not regenerated), so the promote's
+  // migrate-target runs a stale `lakebase-schema-migrate apply` against the parent
+  // TIER, which the guard refuses (CI red, cleanup skipped). Refresh drifted
+  // workflows onto the PR head BEFORE the merge so the merge commit carries the
+  // corrected `apply-tier` step. BEST-EFFORT: never blocks the merge.
+  // Runs regardless of waitMigrate: the promote workflow triggers on the tier
+  // push either way, so a stale merge.yml fails CI whether or not the caller waits.
+  const preflightNotes: string[] = [];
+  {
+    const refresh = args.refreshWorkflows ?? (() => defaultRefreshPromoteWorkflows(args.projectDir));
+    try {
+      const r = await refresh();
+      if (r.refreshed) {
+        preflightNotes.push(`Refreshed stale CI workflows before merge${r.detail ? ` (${r.detail})` : ""}.`);
+      }
+    } catch (err) {
+      preflightNotes.push(
+        `Workflow self-heal skipped (${err instanceof Error ? err.message : String(err)}); if the promote's ` +
+          `migrate-target fails on the tier guard, refresh .github/workflows (merge.yml must call 'lakebase-schema-migrate apply-tier').`,
+      );
+    }
+  }
+
   let paired: Awaited<ReturnType<typeof mergePairedPullRequest>>;
   try {
     paired = await mergePairedPullRequest({
@@ -312,7 +391,7 @@ export async function mergeFeature(args: MergeArgs): Promise<MergeResult> {
     );
   }
 
-  const warnings: string[] = [...paired.warnings];
+  const warnings: string[] = [...preflightNotes, ...paired.warnings];
   let localBranchDeleted = false;
   let headAfter = current.branch;
   if (!args.skipLocalCleanup) {

package/scripts/lakebase/secret-auth.ts

@@ -100,10 +100,17 @@ export async function ensureLakebaseSecretAuth(
     throw new Error("databricks tokens create returned no token_value");
   }
 
-  // 3. Store the PAT
-  await runDatabricks(["secrets", "put-secret", scopeName, keyName, "--string-value", pat], {
+  // 3. Store the PAT. Feed the secret in a `--json @/dev/stdin` body (via opts.input)
+  //    rather than a `--string-value <pat>` argv element, so the 90-day user PAT never
+  //    appears in the process table / `ps`. The JSON MUST use `string_value`
+  //    (not bytes_value): bare stdin would flip the CLI to a base64 `bytes_value` field,
+  //    which the app then cannot read back as its Lakebase password at runtime. `pat` is
+  //    already validated non-empty above, so the empty-stdin "silent success on no value"
+  //    trap cannot occur here.
+  await runDatabricks(["secrets", "put-secret", "--json", "@/dev/stdin"], {
     profile,
     timeout: timeoutMs,
+    input: JSON.stringify({ scope: scopeName, key: keyName, string_value: pat }),
   });
 
   // 4. ACL (best-effort)

package/templates/project/common/scripts/run-tests.sh

@@ -176,6 +176,16 @@ if [ "$#" -eq 0 ] && [ -f "$REPO_ROOT/client/package.json" ]; then
       ( cd "$REPO_ROOT/client" && npm install --include=dev )
     fi
   fi
+  # Strict typecheck BEFORE the tests, matching CI. CI builds the client with
+  # `tsc --noEmit && vite build` (strict), but the local test lanes run vitest +
+  # Playwright against the Vite dev server, which does NOT strict-typecheck the whole
+  # app — so a cross-story type regression (a later story making a field REQUIRED,
+  # breaking an earlier story's construction of that type) passed the local honest-GREEN
+  # + deploy feature-verify and was caught ONLY by CI, after promote. Run the SAME strict
+  # typecheck here so local GREEN matches CI. `--if-present` no-ops on an older scaffold
+  # with no `typecheck` script; a type error fails the run (set -e), exactly like a test.
+  echo "Running client strict typecheck (tsc --noEmit, matching CI's build)..."
+  ( cd "$REPO_ROOT/client" && npm run typecheck --if-present )
   echo "Running client unit tests (Vitest)..."
   ( cd "$REPO_ROOT/client" && npm test )
 fi