@meyverick/agentic 5.0.2 → 5.1.0

package/AGENTS.md

@@ -181,7 +181,7 @@ stale_after: 2027-08-15
 - **QMD** (Hybrid Search & Local Memory): Project-local index only — `qmd init` at repo root → `<repo>/.qmd/` (gitignored); NEVER create or populate a global/shared index, never fall back to one. Mode select: exact terms/titles/headings/symbols → `qmd search '"<phrase>"' --json -n 10 -c <collection>` (BM25, no LLM); concept/paraphrase → `qmd query $'intent: <goal + what to avoid>\nlex: <anchors>\nvec: <paraphrase>' --json -n 10` (author the fields yourself — never paste raw request text). Retrieve before claiming: `qmd get "#id:from:count"` / `qmd multi-get "<ids>" --json` (never pipe `sed`/`head`/`tail`). Maintenance [CRITICAL] mutations → `qmd update && qmd embed --chunk-strategy auto`; health `qmd status`; depth `.agents/skills/qmd-research/` (query grammar · filters · index upkeep).
 - **Context7** (External Framework Intelligence): Trigger [CRITICAL] generating third-party setup/config or touching frameworks/packages (SvelteKit, Tailwind, SQLx, ts-rs, miniplex, Threlte, babylonjs, PixiJS, Phaser, Axum, Rayon, candle, tauri, grammY, `@telegram-apps/sdk`) → autonomous Context7 → prevent hallucinated outdated training data. Flow: `resolve-library-id(name, query)` → `/org/project` ID → `query-docs(id, full_query)` → SOTA patterns. Append explicit versions to queries. Priority Context7 > web search. Bypass for internal business logic.
 - **check** (Workspace Gate Verification): Textbook and diagnostic manual for `./scripts/check.sh` gates. Consult `.agents/skills/check/SKILL.md` when executing check-gates, configuring the 6-slot harness (pointers, secrets, native lanes, tracked compile-time assets, clean-clone sandbox, smoke), or diagnosing and self-healing gate failures.
-- **Skill Engineering** (`./.agents/skills/`): Utilization [CRITICAL] task initiation → scan `./.agents/skills/` → evaluate `description` frontmatters → load `SKILL.md` if relevant. Creation: extract recurring gotchas/workflows into `skills/<name>/SKILL.md` (action gerund, Validation Loops, Plan-Validate-Execute, `references/` offload for progressive disclosure). Anatomy [CRITICAL] frontmatter per the Agent Skills spec (`name` + `description` required; `license` · `compatibility` · `metadata` · `allowed-tools` optional — OKF provenance `type`/`generated` is for documents, §7), `description` <1024 chars imperative "Use this skill when...". Script bundling: self-contained (Bun `.mjs`/single-file Go/PEP 723), idempotent, structured JSON/CSV, ZERO prompts. Ad-hoc spikes [CRITICAL] candid debug scripts / pre-implementation endpoint tests / quick API validation → self-contained `.mjs` via `bun <file>.mjs` (native top-level await+fetch, zero setup). Eval-driven evolution: generate `evals/evals.json`, measure baseline vs with-skill (pass rate/tokens/duration) → optimize `SKILL.md`.
+- **Skill Engineering** (`./.agents/skills/`): Utilization [CRITICAL] task initiation → scan `./.agents/skills/` → evaluate `description` frontmatters → load `SKILL.md` if relevant. Creation: extract recurring gotchas/workflows into `skills/<name>/SKILL.md` (action gerund, Validation Loops, Plan-Validate-Execute, `references/` offload for progressive disclosure). Anatomy [CRITICAL] frontmatter per the Agent Skills spec (`name` + `description` required; `license` · `compatibility` · `metadata` · `allowed-tools` optional — OKF provenance `type`/`generated` is for documents, §7), `description` <1024 chars imperative "Use this skill when...". Script bundling: self-contained (Bun `.ts`/single-file Go/PEP 723), idempotent, structured JSON/CSV, ZERO prompts. Ad-hoc spikes [CRITICAL] candid debug scripts / pre-implementation endpoint tests / quick API validation → self-contained `.ts` via `bun <file>.ts` (native top-level await+fetch, zero setup). Eval-driven evolution: generate `evals/evals.json`, measure baseline vs with-skill (pass rate/tokens/duration) → optimize `SKILL.md`.
 
 ## 9. Exploration & Discovery Stance
 

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [5.1.0] - 2026-09-28
+
+### Added
+
+- **openspec-pi-apply skill** (`add-openspec-pi-apply-skill`): 10th shipped skill — delegate OpenSpec change task implementation to a headless pi worker agent via JSON-RPC (`scripts/pi-rpc-apply.ts`), providing live streaming, automated event loop triage, and non-blocking background task orchestration
+
+### Changed
+
+- **Consumer scripts migrated to Bun TypeScript** (`migrate-consumer-scripts-to-bun-ts`): convert all 9 consumer scripts across `scripts/` and skill packages to self-contained, typed Bun `.ts` (`check-deps.ts`, `git-dl.ts`, `validate-frontmatter.ts`, `validate-structure.ts`, `validate-routing.ts`, `audit-antipatterns.ts`, `run-cold-eval.ts`, `compute-benchmark.ts`, `scaffold-skill.ts`) with `#!/usr/bin/env bun` shebangs, eliminating language fragmentation
+- **CI validator runners modernized**: update `project/.github/workflows/quality.yml` to execute validators natively with `bun run`
+- **Package scripts and binaries aligned**: update `project/package.json` `scripts` and `bin` to reference `.ts` entrypoints
+- **Agent directives standardized on Bun TypeScript**: update `AGENTS.md` (root and submodule) §8 to mandate self-contained Bun `.ts` (`bun <file>.ts`) for script bundling and ad-hoc spikes
+- **Skill creation and evals alignment**: update `create-skill` instructions, references, template assets, and eval suites (`evals.json`) to reference `.ts` validators and scripts
+- Total shipped skills increased from 9 to 10
+
 ## [5.0.2] - 2026-09-23
 
 ### Changed

package/README.md

@@ -10,7 +10,7 @@ bunx @meyverick/agentic
 
 *(or via GitHub direct: `bunx github:meyverick/agentic`)*
 
-Installs 9 skills into your project's `.agents/skills/`, distributes utility scripts into `./scripts/`, writes a provenance manifest, and creates `openspec/reports/`.
+Installs 10 skills into your project's `.agents/skills/`, distributes utility scripts into `./scripts/`, writes a provenance manifest, and creates `openspec/reports/`.
 
 ## Skills
 
@@ -23,6 +23,7 @@ Installs 9 skills into your project's `.agents/skills/`, distributes utility scr
 | okf-docs | Author OKF v0.2-compliant documents — ADRs, module docs, decision records — with mandatory provenance frontmatter and mechanical validation |
 | openspec-harden | Harden an existing OpenSpec change for cold application — enrich artifacts with concrete file paths, code blocks, and verify steps |
 | openspec-learn | Analyze reports in `./openspec/reports/` and generate OpenSpec proposals for skill/prompt improvements |
+| openspec-pi-apply | Delegate OpenSpec change task implementation to a headless pi worker agent via JSON-RPC |
 | openspec-report | Generate self-reflection (meditation) reports from archived OpenSpec changes |
 | qmd-research | Research project markdown and specifications using local QMD hybrid search, and maintain index collections |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meyverick/agentic",
-  "version": "5.0.2",
+  "version": "5.1.0",
   "description": "AI agent skills and prompts for pi.dev",
   "publishConfig": {
     "access": "public"
@@ -18,13 +18,13 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "check-deps": "./scripts/check-deps.mjs",
-    "git-dl": "./scripts/git-dl.mjs"
+    "check-deps": "./scripts/check-deps.ts",
+    "git-dl": "./scripts/git-dl.ts"
   },
   "bin": {
     "agentic": "install.ts",
-    "check-deps": "scripts/check-deps.mjs",
-    "git-dl": "scripts/git-dl.mjs"
+    "check-deps": "scripts/check-deps.ts",
+    "git-dl": "scripts/git-dl.ts"
   },
   "keywords": [
     "ai",

package/scripts/{check-deps.mjs → check-deps.ts}

@@ -17,6 +17,7 @@ const colors = {
 };
 
 const USER_AGENT = 'agentic-dep-checker/1.0 (https://github.com/meyverick/agentic)';
+const isHelp = process.argv.includes('--help') || process.argv.includes('-h');
 const includeReferences = process.argv.includes('--all') || process.argv.includes('--references');
 const isJson = process.argv.includes('--json');
 
@@ -36,9 +37,72 @@ const IGNORED_DIRS = new Set([
   ...(includeReferences ? [] : ['references'])
 ]);
 
-async function asyncPool(limit, items, iteratorFn) {
-  const ret = [];
-  const executing = new Set();
+interface ScanResults {
+  cargo: string[];
+  npm: string[];
+  lockFiles: string[];
+  toolchains: string[];
+}
+
+interface ToolchainItem {
+  name: string;
+  version: string;
+}
+
+interface CargoDependency {
+  name: string;
+  version: string;
+  git: string | null;
+  section: string;
+}
+
+interface SemverDiff {
+  status: 'UP_TO_DATE' | 'MINOR_PATCH' | 'MAJOR_BREAKING' | 'UNKNOWN';
+  reason?: string;
+}
+
+interface JsonReport {
+  summary: {
+    totalChecked: number;
+    upToDate: number;
+    minorPatch: number;
+    majorBreaking: number;
+  };
+  toolchains: Array<{
+    name: string;
+    current: string;
+    latest: string | null;
+    status: string;
+    reason: string | null;
+  }>;
+  rustModules: Array<{
+    file: string;
+    dependencies: Array<{
+      name: string;
+      declaredVersion: string;
+      resolvedVersion: string;
+      latest: string | null;
+      status: string;
+      reason: string | null;
+      section: string;
+    }>;
+  }>;
+  npmModules: Array<{
+    file: string;
+    dependencies: Array<{
+      name: string;
+      declaredVersion: string;
+      latest: string | null;
+      status: string;
+      reason: string | null;
+      type: string;
+    }>;
+  }>;
+}
+
+async function asyncPool<T, R>(limit: number, items: T[], iteratorFn: (item: T) => Promise<R>): Promise<R[]> {
+  const ret: Promise<R>[] = [];
+  const executing = new Set<Promise<R>>();
   for (const item of items) {
     const p = Promise.resolve().then(() => iteratorFn(item));
     ret.push(p);
@@ -52,10 +116,10 @@ async function asyncPool(limit, items, iteratorFn) {
   return Promise.all(ret);
 }
 
-async function scanFiles(dir) {
-  const results = { cargo: [], npm: [], lockFiles: [], toolchains: [] };
+async function scanFiles(dir: string): Promise<ScanResults> {
+  const results: ScanResults = { cargo: [], npm: [], lockFiles: [], toolchains: [] };
 
-  async function walk(currentDir) {
+  async function walk(currentDir: string): Promise<void> {
     const entries = await readdir(currentDir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       const fullPath = join(currentDir, entry.name);
@@ -84,8 +148,12 @@ async function scanFiles(dir) {
   return results;
 }
 
-async function detectToolchains(toolchainFiles, cargoFiles, npmFiles) {
-  let rustVersion = null;
+async function detectToolchains(
+  toolchainFiles: string[],
+  cargoFiles: string[],
+  npmFiles: string[]
+): Promise<ToolchainItem[]> {
+  let rustVersion: string | null = null;
 
   for (const tf of toolchainFiles) {
     try {
@@ -119,14 +187,14 @@ async function detectToolchains(toolchainFiles, cargoFiles, npmFiles) {
     } catch {}
   }
 
-  let cargoVersion = null;
+  let cargoVersion: string | null = null;
   try {
     const out = execSync('cargo --version', { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] });
     const m = out.match(/cargo\s+([0-9]+\.[0-9]+\.[0-9]+)/);
     if (m) cargoVersion = m[1];
   } catch {}
 
-  let bunVersion = null;
+  let bunVersion: string | null = null;
   for (const nf of npmFiles) {
     try {
       const pkg = JSON.parse(await readFile(nf, 'utf8'));
@@ -150,7 +218,7 @@ async function detectToolchains(toolchainFiles, cargoFiles, npmFiles) {
     } catch {}
   }
 
-  const items = [];
+  const items: ToolchainItem[] = [];
   if (rustVersion) {
     items.push({ name: 'rust', version: rustVersion });
   }
@@ -164,7 +232,7 @@ async function detectToolchains(toolchainFiles, cargoFiles, npmFiles) {
   return items;
 }
 
-async function fetchLatestToolchain() {
+async function fetchLatestToolchain(): Promise<string | null> {
   try {
     const res = await fetch('https://static.rust-lang.org/dist/channel-rust-stable.toml', {
       headers: { 'User-Agent': USER_AGENT }
@@ -178,8 +246,8 @@ async function fetchLatestToolchain() {
   }
 }
 
-async function parseCargoLocks(lockFiles) {
-  const lockedVersions = new Map();
+async function parseCargoLocks(lockFiles: string[]): Promise<Map<string, string[]>> {
+  const lockedVersions = new Map<string, string[]>();
   for (const lockPath of lockFiles) {
     try {
       const content = await readFile(lockPath, 'utf8');
@@ -193,7 +261,7 @@ async function parseCargoLocks(lockFiles) {
           if (!lockedVersions.has(name)) {
             lockedVersions.set(name, []);
           }
-          lockedVersions.get(name).push(ver);
+          lockedVersions.get(name)!.push(ver);
         }
       }
     } catch {}
@@ -201,7 +269,7 @@ async function parseCargoLocks(lockFiles) {
   return lockedVersions;
 }
 
-function resolveLockedVersion(name, declaredVer, lockedMap) {
+function resolveLockedVersion(name: string, declaredVer: string, lockedMap: Map<string, string[]>): string {
   const versions = lockedMap.get(name);
   if (!versions || versions.length === 0) return declaredVer;
   if (versions.length === 1) return versions[0];
@@ -220,7 +288,7 @@ function resolveLockedVersion(name, declaredVer, lockedMap) {
   return matched || versions[0];
 }
 
-function getCrateIndexPath(crateName) {
+function getCrateIndexPath(crateName: string): string {
   const name = crateName.toLowerCase();
   if (name.length === 1) return `1/${name}`;
   if (name.length === 2) return `2/${name}`;
@@ -228,9 +296,7 @@ function getCrateIndexPath(crateName) {
   return `${name.slice(0, 2)}/${name.slice(2, 4)}/${name}`;
 }
 
-async function fetchLatestCrate(crateName) {
-  let version = null;
-
+async function fetchLatestCrate(crateName: string): Promise<{ version: string | null }> {
   try {
     const indexPath = getCrateIndexPath(crateName);
     const indexRes = await fetch(`https://index.crates.io/${indexPath}`, {
@@ -244,27 +310,26 @@ async function fetchLatestCrate(crateName) {
         try {
           const entry = JSON.parse(lines[i]);
           if (!entry.yanked) {
-            version = entry.vers;
-            break;
+            return { version: entry.vers };
           }
         } catch {}
       }
     }
 
-    return { version };
+    return { version: null };
   } catch {
     return { version: null };
   }
 }
 
-async function fetchLatestNpm(pkgName) {
+async function fetchLatestNpm(pkgName: string): Promise<{ version: string | null }> {
   try {
     const encoded = pkgName.startsWith('@')
       ? `@${encodeURIComponent(pkgName.slice(1))}`
       : encodeURIComponent(pkgName);
     const res = await fetch(`https://registry.npmjs.org/${encoded}`);
     if (!res.ok) return { version: null };
-    const data = await res.json();
+    const data = (await res.json()) as { 'dist-tags'?: { latest?: string }; versions?: Record<string, unknown> };
     const version = data['dist-tags']?.latest ?? Object.keys(data.versions || {}).pop() ?? null;
     return { version };
   } catch {
@@ -272,10 +337,10 @@ async function fetchLatestNpm(pkgName) {
   }
 }
 
-function parseCargoDependencies(content) {
-  const deps = [];
+function parseCargoDependencies(content: string): CargoDependency[] {
+  const deps: CargoDependency[] = [];
   const lines = content.split('\n');
-  let currentSection = null;
+  let currentSection: string | null = null;
 
   for (const line of lines) {
     const trimmed = line.trim();
@@ -298,8 +363,8 @@ function parseCargoDependencies(content) {
       if (depMatch) {
         const name = depMatch[1];
         const val = depMatch[2];
-        let version = null;
-        let git = null;
+        let version: string | null = null;
+        let git: string | null = null;
 
         if (val.startsWith('"')) {
           version = val.split('"')[1];
@@ -320,7 +385,7 @@ function parseCargoDependencies(content) {
   return deps;
 }
 
-function getSemverDiff(declared, latest) {
+function getSemverDiff(declared: string, latest: string | null): SemverDiff {
   if (!latest) return { status: 'UNKNOWN' };
 
   const cleanDeclared = declared.replace(/^[\^~>=<]+/, '').trim();
@@ -345,7 +410,22 @@ function getSemverDiff(declared, latest) {
   return { status: 'MINOR_PATCH', reason: `${cleanDeclared} -> ${latest}` };
 }
 
-async function main() {
+function printUsage(): void {
+  console.log(`Usage: bun check-deps.ts [options] [target-dir]
+
+Options:
+  --all, --references  Include scanning of references directories
+  --json               Output machine-readable JSON report
+  -h, --help           Show this help message
+`);
+}
+
+async function main(): Promise<void> {
+  if (isHelp) {
+    printUsage();
+    process.exit(0);
+  }
+
   if (!isJson) {
     console.log(`${colors.bold}${colors.cyan}================================================================${colors.reset}`);
     console.log(`${colors.bold}${colors.cyan}  Agentic - Dependency Freshness Verifier                       ${colors.reset}`);
@@ -362,13 +442,8 @@ async function main() {
   let totalMinorPatch = 0;
   let totalMajorBreaking = 0;
 
-  const jsonReport = {
-    summary: {
-      totalChecked: 0,
-      upToDate: 0,
-      minorPatch: 0,
-      majorBreaking: 0
-    },
+  const jsonReport: JsonReport = {
+    summary: { totalChecked: 0, upToDate: 0, minorPatch: 0, majorBreaking: 0 },
     toolchains: [],
     rustModules: [],
     npmModules: []
@@ -376,9 +451,7 @@ async function main() {
 
   // 1. Toolchains (Rust, Cargo, Bun)
   if (toolchainItems.length > 0) {
-    if (!isJson) {
-      console.log(`${colors.bold}${colors.blue}⚙ Toolchains: Rust, Cargo & Bun${colors.reset}`);
-    }
+    if (!isJson) console.log(`${colors.bold}${colors.blue}⚙ Toolchains: Rust, Cargo & Bun${colors.reset}`);
     const latestRust = await fetchLatestToolchain();
     const { version: latestBun } = await fetchLatestNpm('bun');
 
@@ -424,17 +497,12 @@ async function main() {
     const deps = parseCargoDependencies(content);
 
     if (deps.length === 0) continue;
+    if (!isJson) console.log(`${colors.bold}${colors.blue}📦 Rust Module: ${relPath}${colors.reset}`);
 
-    if (!isJson) {
-      console.log(`${colors.bold}${colors.blue}📦 Rust Module: ${relPath}${colors.reset}`);
-    }
-
-    const currentModule = { file: relPath, dependencies: [] };
+    const currentModule: JsonReport['rustModules'][number] = { file: relPath, dependencies: [] };
 
     const results = await asyncPool(10, deps, async (dep) => {
-      if (dep.git) {
-        return { ...dep, latest: 'git' };
-      }
+      if (dep.git) return { ...dep, latest: 'git' };
       const { version: latest } = await fetchLatestCrate(dep.name);
       return { ...dep, latest };
     });
@@ -482,14 +550,14 @@ async function main() {
   for (const npmPath of npm) {
     const relPath = relative(rootDir, npmPath);
     const raw = await readFile(npmPath, 'utf8');
-    let pkgJson = {};
+    let pkgJson: { dependencies?: Record<string, string>; devDependencies?: Record<string, string> } = {};
     try {
       pkgJson = JSON.parse(raw);
     } catch {
       continue;
     }
 
-    const allDeps = [];
+    const allDeps: Array<{ name: string; version: string; type: string }> = [];
     if (pkgJson.dependencies) {
       for (const [name, version] of Object.entries(pkgJson.dependencies)) {
         if (!version.startsWith('workspace:')) {
@@ -506,12 +574,9 @@ async function main() {
     }
 
     if (allDeps.length === 0) continue;
+    if (!isJson) console.log(`${colors.bold}${colors.magenta}🌐 NPM/Web Module: ${relPath}${colors.reset}`);
 
-    if (!isJson) {
-      console.log(`${colors.bold}${colors.magenta}🌐 NPM/Web Module: ${relPath}${colors.reset}`);
-    }
-
-    const currentModule = { file: relPath, dependencies: [] };
+    const currentModule: JsonReport['npmModules'][number] = { file: relPath, dependencies: [] };
 
     const results = await asyncPool(10, allDeps, async (dep) => {
       const { version: latest } = await fetchLatestNpm(dep.name);
@@ -577,11 +642,11 @@ async function main() {
   }
 }
 
-main().catch((err) => {
+main().catch((err: Error) => {
   if (isJson) {
     console.error(JSON.stringify({ error: err.message }));
   } else {
     console.error('Error running dependency check:', err);
   }
   process.exit(1);
-});
+});

package/scripts/{git-dl.mjs → git-dl.ts}

@@ -3,18 +3,19 @@ import { execFileSync, spawn } from 'node:child_process';
 import { mkdir, rm } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { Readable } from 'node:stream';
+import type { ReadableStream as WebReadableStream } from 'node:stream/web';
 
 const input = process.argv[2];
 
 if (input === '-h' || input === '--help') {
-  console.log('Usage: git-dl.mjs <owner/repo|url> [target-dir]');
+  console.log('Usage: git-dl.ts <owner/repo|url> [target-dir]');
   console.log('Default target-dir: references/<repo>');
   process.exit(0);
 }
 
 if (!input) {
   console.error('Error: Provide a GitHub URL or owner/repo');
-  console.error('Usage: git-dl.mjs <owner/repo|url> [target-dir]');
+  console.error('Usage: git-dl.ts <owner/repo|url> [target-dir]');
   console.error('Default target-dir: references/<repo>');
   process.exit(1);
 }
@@ -37,22 +38,23 @@ const defaultDir = join('references', basename(repo));
 const dir = process.argv[3] || defaultDir;
 
 // Resolve the latest tag via git ls-remote (version sorted, handles prefixes and monorepos)
-let lsOutput;
+let lsOutput: string;
 try {
   lsOutput = execFileSync(
     'git',
     ['ls-remote', '--tags', '--refs', '--sort=v:refname', `https://github.com/${repo}.git`],
     { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
   );
-} catch (err) {
-  const errMsg = err.stderr ? err.stderr.trim() : err.message;
+} catch (err: unknown) {
+  const execErr = err as { stderr?: Buffer | string; message: string };
+  const errMsg = execErr.stderr ? execErr.stderr.toString().trim() : execErr.message;
   console.error(`Error: Failed to query tags for '${repo}': ${errMsg}`);
   process.exit(1);
 }
 
 const lines = lsOutput.trim().split('\n').filter(Boolean);
 const lastLine = lines[lines.length - 1];
-let rawTag = null;
+let rawTag: string | null = null;
 if (lastLine) {
   const parts = lastLine.split(/\s+/);
   if (parts.length >= 2) {
@@ -77,12 +79,12 @@ const res = await fetch(tarballUrl, {
   }
 });
 
-if (!res.ok) {
+if (!res.ok || !res.body) {
   console.error(`Error: Failed to download tarball from ${tarballUrl} (${res.status} ${res.statusText})`);
   process.exit(1);
 }
 
-await new Promise((resolve, reject) => {
+await new Promise<void>((resolve, reject) => {
   const tar = spawn('tar', ['-xz', '-C', dir, '--strip-components=1'], {
     stdio: ['pipe', 'inherit', 'inherit']
   });
@@ -93,7 +95,7 @@ await new Promise((resolve, reject) => {
     else reject(new Error(`tar extraction exited with code ${code}`));
   });
 
-  Readable.fromWeb(res.body).pipe(tar.stdin);
+  Readable.fromWeb(res.body as unknown as WebReadableStream).pipe(tar.stdin);
 });
 
 const displayDir = dir.startsWith('/') || dir.startsWith('.') ? dir : `./${dir}`;

package/skills/create-skill/SKILL.md

@@ -32,7 +32,7 @@ Create new Agent Skills from problem descriptions or instruction files. Fully au
 
 When the user wants to build a new skill:
 
-1. Run `scripts/scaffold-skill.mjs <skill-name>` to create skeleton in `./project/skills/`
+1. Run `scripts/scaffold-skill.ts <skill-name>` to create skeleton in `./project/skills/`
 2. Follow the workflow below to fill in content
 3. Skill ships when Phase 7 completes
 
@@ -95,7 +95,7 @@ Determine:
    - Tier 2 (SKILL.md body): <1500 tokens
    - Tier 3 (references/): on-demand only
 4. **Components**: Persona / instructions / templates / data (not omnibus) — see `references/component-decomposition.md` (Level 2).
-5. **Scripts**: Reusable logic to bundle (.mjs, cold/isolated, relative paths only)
+5. **Scripts**: Reusable logic to bundle (.ts, cold/isolated, relative paths only)
 6. **Eval strategy**: Test cases, assertions, near-miss negatives, baseline comparison
 7. **Activation boundary**: Define what triggers and what does NOT trigger
 8. **Runtime contract**: Required runtimes (bun/node/python), timeout_seconds, output_format (json)
@@ -104,7 +104,7 @@ Determine:
 
 ### Phase 3: Authoring
 
-1. **Scaffold**: `scripts/scaffold-skill.mjs <name>` → creates directory + SKILL.md skeleton
+1. **Scaffold**: `scripts/scaffold-skill.ts <name>` → creates directory + SKILL.md skeleton
 2. **Frontmatter**: name, description (imperative, specific, "Use when... Do NOT use when..."), positive_triggers (min 3), anti_triggers (min 2), allowed-tools, compatibility, runtime
 3. **SKILL.md body sections** (in order):
    - Activation Boundary: explicit trigger/exclusion lists
@@ -114,7 +114,7 @@ Determine:
    - Contrast: `| Before (old) | After (new) | Why different |` table when proposal carries `Contrast:` hint (e.g., `C# null → Rust Option`); keep distinct from routing
    - Anti-examples: `Do NOT: <before>` → `Do: <after>` with Why, when proposal carries `Anti-example:` hint from report's Concrete Gotcha; body content, NOT frontmatter `anti_triggers`
    - Tiered depth: Level 1 basics inline, Level 2 advanced behind `references/<topic>.md` (cap one file per skill)
-4. **Scripts**: Generate if clearly reusable (.mjs, self-contained, relative paths via import.meta.url, JSON output only)
+4. **Scripts**: Generate if clearly reusable (.ts, self-contained, relative paths via import.meta.url, JSON output only)
 5. **References**: Domain-specific docs, loaded on-demand — **Tiered depth:** Level 1 basics inline in SKILL.md, Level 2 advanced behind `references/<topic>.md`; cap at one `references/` file per skill; link explicitly from SKILL.md
 6. **Templates**: Output shapes, examples
 7. **Single source**: Define each rule ONCE, reference everywhere else
@@ -126,7 +126,7 @@ Determine:
 
 **Step 1: Structural validation**
 ```bash
-scripts/validate-structure.mjs <skill-dir>
+scripts/validate-structure.ts <skill-dir>
 ```
 Checks: name format, description format, directory structure, file references, positive_triggers (min 3), anti_triggers (min 2), "Use when" phrasing, "Do NOT use when" phrasing, no compound intent, no hardcoded paths, runtime declared when scripts exist.
 
@@ -134,7 +134,7 @@ Checks: name format, description format, directory structure, file references, p
 
 **Step 2: Semantic routing validation**
 ```bash
-scripts/validate-routing.mjs <skill-dir>
+scripts/validate-routing.ts <skill-dir>
 ```
 Checks: positive_triggers coverage, anti_triggers coverage, description-body alignment, single-responsibility verification.
 
@@ -149,7 +149,7 @@ Agent assesses:
 
 **Step 4: Antipattern self-audit**
 ```bash
-scripts/audit-antipatterns.mjs <skill-dir>
+scripts/audit-antipatterns.ts <skill-dir>
 ```
 Checks: phantom tools, duplicated invariants, passive-voice triggers, prose bloat, single-file omnibus, vague success bars, multi-domain descriptions (A17), missing activation boundary (A18), hardcoded paths (A19), context budget violation (A20).
 
@@ -161,14 +161,14 @@ Self-correct any issues before proceeding.
 
 **Step 6: Compute benchmarks**
 ```bash
-scripts/compute-benchmark.mjs <eval-dir>
+scripts/compute-benchmark.ts <eval-dir>
 ```
 
 **Step 6b: Cold-agent behavioral proof (mandatory)**
 ```bash
-scripts/run-cold-eval.mjs <skill-dir>
+scripts/run-cold-eval.ts <skill-dir>
 ```
-Runs `evals/evals.json` cold A/B (without vs with skill), computes `d = sign(with - baseline)`, `m = |with - baseline|`, emits unified envelope `{target, pass, checks, summary}` + `behavioral: {at, baseline, with_skill, d, m, ship}` (30s timeout, JSON only). Writes `evals/benchmark.json` with `stage: behavioral` block (`{at, baseline, with_skill, d, m, ship}`) replacing `pending_cold_agent_run`; record outputs in creation session. Reuses `compute-benchmark.mjs` logic; no network, deterministic.
+Runs `evals/evals.json` cold A/B (without vs with skill), computes `d = sign(with - baseline)`, `m = |with - baseline|`, emits unified envelope `{target, pass, checks, summary}` + `behavioral: {at, baseline, with_skill, d, m, ship}` (30s timeout, JSON only). Writes `evals/benchmark.json` with `stage: behavioral` block (`{at, baseline, with_skill, d, m, ship}`) replacing `pending_cold_agent_run`; record outputs in creation session. Reuses `compute-benchmark.ts` logic; no network, deterministic.
 
 **Step 7: Calculate quality score**
 ```
@@ -176,7 +176,7 @@ d = direction (+1 if with_skill > baseline, -1 if lower, 0 if equal)
 m = magnitude = |with_skill_pass_rate - baseline_pass_rate|
 quality_score = d × m
 ```
-Ship gate: d must be +1 AND m must be >= 0.2 (20% improvement over baseline) — now proven by `run-cold-eval.mjs` behavioral block.
+Ship gate: d must be +1 AND m must be >= 0.2 (20% improvement over baseline) — now proven by `run-cold-eval.ts` behavioral block.
 
 **Step 8: Iterate**
 If quality insufficient:
@@ -208,12 +208,12 @@ If false positives occur:
 3. Re-test
 
 **Step 5: Final validation**
-Run `scripts/validate-structure.mjs` and `scripts/validate-routing.mjs` again after changes.
+Run `scripts/validate-structure.ts` and `scripts/validate-routing.ts` again after changes.
 
 ### Phase 7: Ship
 
-1. **Final structural validation — HARD GATE**: run `scripts/validate-structure.mjs` and `scripts/validate-routing.mjs`; both MUST report pass with outputs recorded. If either fails, the skill is NOT presented for approval — self-correct and re-run until both pass.
-2. **Behavioral proof — HARD GATE (fail-closed)**: run `scripts/run-cold-eval.mjs <skill-dir>`; `d == +1 AND m >= 0.2` required with outputs recorded. If fails, emit `FAIL: m < 0.2 — not worth context cost` with validator + behavioral outputs, loop to Optimization (revise description/instructions) and re-run; never present for approval without behavioral pass.
+1. **Final structural validation — HARD GATE**: run `scripts/validate-structure.ts` and `scripts/validate-routing.ts`; both MUST report pass with outputs recorded. If either fails, the skill is NOT presented for approval — self-correct and re-run until both pass.
+2. **Behavioral proof — HARD GATE (fail-closed)**: run `scripts/run-cold-eval.ts <skill-dir>`; `d == +1 AND m >= 0.2` required with outputs recorded. If fails, emit `FAIL: m < 0.2 — not worth context cost` with validator + behavioral outputs, loop to Optimization (revise description/instructions) and re-run; never present for approval without behavioral pass.
 3. **Portability certificate**: verify no hardcoded paths, runtime deps declared, timeout bounds set, output contract defined
 4. **Present summary**: what skill does, tier achieved, eval results, trigger rate, quality score (d × m) + behavioral `d×m`
 5. **Wait for user approval**
@@ -257,7 +257,7 @@ runtime:
 - **Anti-triggers +31.8% precision**: Frontmatter `anti_triggers` min 2, plus body `Anti-examples` distinct from routing.
 - **Progressive disclosure**: Tier 1 <50, Tier 2 <1500, Tier 3 on-demand — see `references/component-decomposition.md`.
 - **Single-responsibility**: One sentence without `and`, else split.
-- **Validation + behavioral gate is fail-closed**: `validate-structure` + `validate-routing` + `run-cold-eval.mjs` (`d=+1,m≥0.2`) mandatory; `m<0.2` blocks Ship.
+- **Validation + behavioral gate is fail-closed**: `validate-structure` + `validate-routing` + `run-cold-eval.ts` (`d=+1,m≥0.2`) mandatory; `m<0.2` blocks Ship.
 - **Fragility**: Mutation strict, read-only loose, creative low — see `references/fragility-matching.md`.
 - **No hardcoded paths**: Relative via `import.meta.url`; no `.pi`/`.agents` in scripts.
 
@@ -269,7 +269,7 @@ runtime:
 /skill-create csv-analyzer
 # 1. Discovery: Q "analyze CSV" → positive_triggers 3, anti_triggers 2
 # 2. Design: scope atomic, fragility read-only=loose (see fragility-matching.md)
-# 3. Scaffold: scripts/scaffold-skill.mjs csv-analyzer
+# 3. Scaffold: scripts/scaffold-skill.ts csv-analyzer
 # 4. Author SKILL.md with Contrast/Anti-examples, Tiered depth
 # 5. Validate routing+structure + run-cold-eval (d×m≥0.2)
 # 6. Ship when both gates pass

package/skills/create-skill/assets/templates/SKILL.md.template

@@ -114,5 +114,5 @@ Why: {{anti_why}}
 
 ## Author Self-Check (final step before declaring this skill complete)
 
-Run `scripts/validate-structure.mjs <this-skill-dir>` and `scripts/validate-routing.mjs <this-skill-dir>`.
+Run `scripts/validate-structure.ts <this-skill-dir>` and `scripts/validate-routing.ts <this-skill-dir>`.
 Both MUST report pass with outputs recorded in the creation record. Failing either = skill not complete.