@webpresso/agent-kit 0.21.4 → 0.23.0

package/dist/esm/cli/commands/blueprint/router.js

@@ -5,8 +5,9 @@ import { parseBlueprintForDb } from '#db/parser/blueprint-db-parser';
 import { blueprintToSpecKit } from '#export/spec-kit/index';
 import { getProjectRoot } from '#cli/utils';
 import { resolveBlueprintRoot } from '#utils/blueprint-root';
+import { getBlueprintDocumentPaths } from '#utils/document-paths.js';
 import { applyBlueprintLifecycleToFile, BlueprintCreationService, BlueprintService, complexitySchema, relativeBlueprintSlug, parseBlueprint, planStatusSchema, runBlueprintAudit, resolveBlueprintFile, serializeBlueprint, validateAllTasksDone, } from '#local';
-import { resolvePackageAsset } from '#utils/package-assets';
+import { resolvePackageAssetPreferred } from '#utils/package-assets';
 import { describeBlueprintExecutionRuntime, buildBlueprintLaunchSpec, buildStoppedRuntimeEvidence, controlBlueprintExecution, initializeBlueprintExecutionProgressBridge, launchBlueprintExecution, persistBlueprintExecutionArtifacts, persistBlueprintExecutionMetadata, recordLaunchFailure, reconcileBlueprintRuntimeSnapshot, readBlueprintExecutionState, syncBlueprintExecutionProgress, writeBlueprintRuntimeSnapshot, } from './execution.js';
 import { advanceTask as advanceTaskMutation, finalizeBlueprint as finalizeBlueprintMutation, promoteBlueprint as promoteBlueprintMutation, } from './mutations.js';
 import { BlueprintAuditFailedError, executeBlueprintSubcommand } from './router-dispatch.js';
@@ -40,7 +41,10 @@ function assertBlueprintCanMoveToStatus(blueprint, nextStatus) {
  * when the lookup fails in unrelated contexts (e.g. `wp --help`).
  */
 function resolveRepoBlueprintTemplatePath() {
-    return resolvePackageAsset('docs/templates/blueprint.md');
+    return resolvePackageAssetPreferred([
+        'docs/templates/blueprint.md',
+        'catalog/docs/templates/blueprint.md',
+    ]);
 }
 function todayIsoDate() {
     return new Date().toISOString().split('T')[0] ?? new Date().toISOString();
@@ -306,10 +310,12 @@ export async function moveBlueprint(slug, status, options = {}) {
     const projectRoot = resolveProjectRoot(options.projectRoot);
     const nextStatus = normalizeBlueprintStatus(status);
     const location = await resolveBlueprintLocation(slug, projectRoot);
+    const isFlatFile = path.basename(location.path) !== '_overview.md';
     const sourceDir = path.dirname(location.path);
-    const targetDir = path.join(resolveBlueprintRoot(projectRoot), nextStatus, relativeBlueprintSlug(location.slug));
-    const targetPath = path.join(targetDir, '_overview.md');
-    if (sourceDir === targetDir && location.blueprint.status === nextStatus) {
+    const targetPaths = getBlueprintDocumentPaths(resolveBlueprintRoot(projectRoot), nextStatus, relativeBlueprintSlug(location.slug));
+    const targetDir = targetPaths.directory;
+    const targetPath = isFlatFile ? targetPaths.flat : targetPaths.folder;
+    if (location.path === targetPath && location.blueprint.status === nextStatus) {
         return {
             fromPath: location.path,
             fromStatus: location.blueprint.status,
@@ -325,18 +331,18 @@ export async function moveBlueprint(slug, status, options = {}) {
         throw new Error('Blueprint move is recovery-only. Use wp blueprint start/task/finalize for normal lifecycle changes, or pass --force-recovery.');
     }
     assertBlueprintCanMoveToStatus(location.blueprint, nextStatus);
-    if (sourceDir !== targetDir) {
-        await mkdir(path.dirname(targetDir), { recursive: true });
-        await rename(sourceDir, targetDir);
+    if (location.path !== targetPath) {
+        await mkdir(path.dirname(targetPath), { recursive: true });
+        await rename(isFlatFile ? location.path : sourceDir, isFlatFile ? targetPath : targetDir);
     }
     const updated = await writeBlueprintWithStatus(targetPath, location.blueprint, nextStatus);
     return {
         fromPath: location.path,
         fromStatus: location.blueprint.status,
-        message: sourceDir === targetDir
+        message: location.path === targetPath
             ? `Updated blueprint ${location.slug} to ${nextStatus}.`
             : `Moved blueprint ${location.slug} to ${nextStatus}.`,
-        moved: sourceDir !== targetDir,
+        moved: location.path !== targetPath,
         slug: location.slug,
         toPath: targetPath,
         toStatus: nextStatus,

package/dist/esm/cli/commands/blueprint/template-resolver.js

@@ -1,12 +1,16 @@
 import { readdirSync } from 'node:fs';
 import path from 'node:path';
-import { resolvePackageAsset } from '#utils/package-assets.js';
+import { resolvePackageAssetPreferred } from '#utils/package-assets.js';
 /**
- * Default templates directory: docs/templates/ resolved relative to the
- * package root (same strategy as resolveRepoBlueprintTemplatePath in router.ts).
+ * Default templates directory: docs/templates/ in a source checkout, falling
+ * back to the shipped catalog/docs/templates/ in the published package (same
+ * strategy as resolveRepoBlueprintTemplatePath in router.ts).
  */
 function defaultTemplatesDir() {
-    return path.dirname(resolvePackageAsset('docs/templates/blueprint.md'));
+    return path.dirname(resolvePackageAssetPreferred([
+        'docs/templates/blueprint.md',
+        'catalog/docs/templates/blueprint.md',
+    ]));
 }
 /**
  * List available templates from `templatesDir` (defaults to docs/templates/).

package/dist/esm/cli/commands/hook.d.ts

@@ -0,0 +1,8 @@
+import type { CAC } from 'cac';
+declare const HOOK_NAMES: readonly ["pretool-guard", "post-tool", "stop-qa", "guard-switch", "sessionstart-routing"];
+export type HookName = (typeof HOOK_NAMES)[number];
+export declare function isHookName(value: string): value is HookName;
+export declare function runHookCommand(name: string): Promise<void>;
+export declare function registerHookCommand(cli: CAC): void;
+export {};
+//# sourceMappingURL=hook.d.ts.map

package/dist/esm/cli/commands/hook.js

@@ -0,0 +1,47 @@
+const HOOK_NAMES = [
+    'pretool-guard',
+    'post-tool',
+    'stop-qa',
+    'guard-switch',
+    'sessionstart-routing',
+];
+const HOOK_HANDLERS = {
+    'pretool-guard': async () => {
+        const { main } = await import('#hooks/pretool-guard/index');
+        await main();
+    },
+    'post-tool': async () => {
+        const { main } = await import('#hooks/post-tool/lint-after-edit');
+        await main();
+    },
+    'stop-qa': async () => {
+        const { main } = await import('#hooks/stop/qa-changed-files');
+        await main();
+    },
+    'guard-switch': async () => {
+        const { main } = await import('#hooks/guard-switch/index');
+        await main();
+    },
+    'sessionstart-routing': async () => {
+        const { main } = await import('#hooks/sessionstart/index');
+        await main();
+    },
+};
+export function isHookName(value) {
+    return value in HOOK_HANDLERS;
+}
+export async function runHookCommand(name) {
+    if (!isHookName(name)) {
+        throw new Error(`Unknown hook "${name}". Expected one of: ${HOOK_NAMES.join(', ')}`);
+    }
+    await HOOK_HANDLERS[name]();
+}
+export function registerHookCommand(cli) {
+    cli
+        .command('hook <name>', 'Run an internal plugin hook entrypoint')
+        .action(async (name) => {
+        await runHookCommand(name);
+        return 0;
+    });
+}
+//# sourceMappingURL=hook.js.map

package/dist/esm/cli/commands/init/host-visibility.js

@@ -5,6 +5,8 @@ export const AGENT_HOSTS = ['codex', 'claude', 'opencode'];
 export const REQUIRED_CORE_CAPABILITIES = ['verify', 'plan-refine'];
 export const VISIBILITY_STATUSES = ['visible-now', 'visible-after-restart', 'not-visible'];
 export function parseAgentHosts(value) {
+    if (value?.trim() === 'none')
+        return [];
     if (!value || value.trim().length === 0 || value.trim() === 'all')
         return [...AGENT_HOSTS];
     const out = [];
@@ -19,7 +21,7 @@ export function parseAgentHosts(value) {
             unknown.push(token);
     }
     if (unknown.length > 0) {
-        throw new Error(`Unknown host(s): ${unknown.join(', ')}. Expected one of: ${AGENT_HOSTS.join(', ')}, all.`);
+        throw new Error(`Unknown host(s): ${unknown.join(', ')}. Expected one of: ${AGENT_HOSTS.join(', ')}, all, none.`);
     }
     return [...new Set(out)];
 }
@@ -54,7 +56,7 @@ export function hostSkillRoots(repoRoot, host, homeDir = homedir()) {
     }
 }
 export function auditHostSkillVisibility(input) {
-    const selectedHosts = input.hosts && input.hosts.length > 0 ? [...input.hosts] : [...AGENT_HOSTS];
+    const selectedHosts = input.hosts ? [...input.hosts] : [...AGENT_HOSTS];
     const requiredCapabilities = input.requiredCapabilities && input.requiredCapabilities.length > 0
         ? [...input.requiredCapabilities]
         : [...REQUIRED_CORE_CAPABILITIES];

package/dist/esm/cli/commands/init/index.js

@@ -6,7 +6,7 @@
  * config keys, and generated surfaces it owns while leaving consumer-owned
  * divergent files untouched unless `--overwrite` is passed.
  */
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { isTelemetryEnabled, reportTthw } from '#telemetry/setup-tthw';
@@ -26,10 +26,11 @@ import { GENERATED_PATHS_BLOCK, patchGitignore } from './gitignore-patcher.js';
 import { scaffoldAgentsMd } from './scaffold-agents-md.js';
 import { scaffoldBlueprints } from './scaffold-blueprints.js';
 import { scaffoldDocs } from './scaffold-docs.js';
-import { scaffoldBaseKit } from './scaffold-base-kit.js';
+import { BASE_KIT_QUALITY_TARGETS, collectRuntimeContractGuidance, scaffoldBaseKit, } from './scaffold-base-kit.js';
 import { scaffoldMonorepoNav } from './scaffold-monorepo-nav.js';
 import { REQUIRED_CORE_CAPABILITIES, auditHostSkillVisibility, parseAgentHosts, serializeHostVisibility, summarizeHostVisibility, } from './host-visibility.js';
 import { scaffoldAgentHooks, trustCodexWebpressoHooksForRepo, trustCodexPresetHooksForUser, } from './scaffolders/agent-hooks/index.js';
+import { ensureAgentKitGlobal } from './scaffolders/agent-kit-global/index.js';
 import { scaffoldAuditHooks } from './scaffolders/audit-hooks/index.js';
 import { ensureClaudeCodeUserPlugin } from './scaffolders/claude-plugin/index.js';
 import { scaffoldClaudeRules } from './scaffolders/claude-rules/index.js';
@@ -103,6 +104,31 @@ function inferBlueprintsDirOverride(repoRoot, existingConfig) {
     }
     return relativePath;
 }
+function readPackageJsonSafe(repoRoot) {
+    const packageJsonPath = join(repoRoot, 'package.json');
+    if (!existsSync(packageJsonPath)) {
+        return null;
+    }
+    try {
+        return JSON.parse(readFileSync(packageJsonPath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function printRuntimeContractGuidance(packageJson) {
+    const guidance = collectRuntimeContractGuidance(packageJson);
+    console.log('\nRuntime-owned tooling contract:');
+    console.log('  wp now owns execution for test, e2e, lint, format, and typecheck.');
+    console.log('  Keep local dependencies that your tests, configs, or tsconfig types import directly.');
+    if (guidance.keepLocalAuthoringDeps.length > 0) {
+        console.log(`  Keep local authoring deps when imported directly: ${guidance.keepLocalAuthoringDeps.join(', ')}`);
+    }
+    if (guidance.reviewForRemovalDeps.length > 0) {
+        console.log(`  Review execution-only deps for removal if they only powered local binaries: ${guidance.reviewForRemovalDeps.join(', ')}`);
+    }
+    console.log('  Do not blanket-remove devDependencies just because wp can execute the tool.');
+}
 export async function runInit(flags) {
     const startMs = Date.now();
     const cwd = flags.cwd ?? process.cwd();
@@ -470,6 +496,37 @@ export async function runInit(flags) {
                 console.log(`  codex webpresso mcp: ⚠ no install root found (checked ${webpressoMcpResult.checked.length} paths). Install webpresso globally (\`bun add -g webpresso\`) or via the Claude plugin to wire up codex MCP.`);
                 break;
         }
+        // Self-update the ONE globally-distributed agent-kit binary (PATH `wp`,
+        // plugin MCP, hooks all resolve to it), mirroring omx/omc/codex/claude.
+        // Non-fatal: a failed refresh never fails consumer setup, and it skips
+        // cleanly on a source/git clone, on `WP_SKIP_AUTO_INSTALL=1`, and in CI.
+        if (isCiEnvironment) {
+            console.log('  agent-kit global: - skipped (CI environment)');
+        }
+        else {
+            const agentKitGlobalResult = ensureAgentKitGlobal({ options });
+            switch (agentKitGlobalResult.kind) {
+                case 'agent-kit-global-updated':
+                    console.log('  agent-kit global: ✓ refreshed via vp install -g');
+                    break;
+                case 'agent-kit-global-skipped-dry-run':
+                    console.log('  agent-kit global: skipped (--dry-run)');
+                    break;
+                case 'agent-kit-global-skipped-opt-out':
+                    console.log('  agent-kit global: skipped (WP_SKIP_AUTO_INSTALL=1)');
+                    break;
+                case 'agent-kit-global-skipped-source-clone':
+                    console.log(`  agent-kit global: - skipped (running from source clone ${agentKitGlobalResult.repoRoot})`);
+                    break;
+                case 'agent-kit-global-skipped-no-vp':
+                    console.warn(`  agent-kit global: ⚠ ${agentKitGlobalResult.hint}`);
+                    break;
+                case 'agent-kit-global-failed':
+                    console.warn(`  agent-kit global: ⚠ \`${agentKitGlobalResult.command.join(' ')}\` exited with ${agentKitGlobalResult.exitCode}; ` +
+                        'the existing global binary is unchanged. Re-run `wp setup` once the registry is reachable.');
+                    break;
+            }
+        }
         const claudePluginResult = ensureClaudeCodeUserPlugin({
             options,
             packageRoot,
@@ -612,6 +669,14 @@ export async function runInit(flags) {
         console.log(`  drifted:         ${summary.drifted}`);
         if (options.dryRun)
             console.log(`  would-change:    ${summary['skipped-dry']}`);
+        if (tier3Selection.includes('base-kit')) {
+            const qualityTargets = new Set(BASE_KIT_QUALITY_TARGETS);
+            const qualityResults = baseKitResults.filter((result) => qualityTargets.has(relative(consumer.repoRoot, result.targetPath).replaceAll('\\', '/')));
+            const qualityCreated = qualityResults.filter((result) => result.action === 'created').length;
+            const qualityPreserved = qualityResults.filter((result) => result.action === 'identical').length;
+            const qualityDryRun = qualityResults.filter((result) => result.action === 'skipped-dry').length;
+            console.log(`  repo quality scaffold: ${options.dryRun ? `${qualityDryRun} would be created` : `${qualityCreated} created, ${qualityPreserved} preserved`}`);
+        }
         if (summary.drifted > 0) {
             console.log('\n  Note: some consumer-owned files exist with different content and were left unchanged.\n' +
                 '  Review the drift or re-run with `--overwrite` to force eligible managed files.');
@@ -629,8 +694,13 @@ export async function runInit(flags) {
             };
             writeConfig(consumer.repoRoot, config);
             console.log('\nHost skill visibility:');
-            for (const line of summarizeHostVisibility(consumer.repoRoot, visibilityAudit)) {
-                console.log(line);
+            if (visibilityAudit.selectedHosts.length === 0) {
+                console.log('  hosts: - skipped (--host none)');
+            }
+            else {
+                for (const line of summarizeHostVisibility(consumer.repoRoot, visibilityAudit)) {
+                    console.log(line);
+                }
             }
             const missing = visibilityAudit.results.filter((result) => result.status === 'not-visible');
             if (missing.length > 0) {
@@ -659,7 +729,10 @@ export async function runInit(flags) {
                 }
             }
         }
-        console.log('\nwp init: done.');
+        printRuntimeContractGuidance(options.dryRun
+            ? consumer.packageJson
+            : (readPackageJsonSafe(consumer.repoRoot) ?? consumer.packageJson));
+        console.log('\nwp init: setup phases finished.');
         if (omxFailure === 'not-found')
             return EXIT_SETUP_FAIL;
         if (omxFailure === 'spawn-failed')
@@ -698,7 +771,7 @@ export async function runInit(flags) {
         if (!options.dryRun) {
             console.log([
                 '',
-                '✅ Setup complete.',
+                '✅ Setup complete for the verified phases above.',
                 '',
                 '  Next: wp blueprint new "your first task"',
                 '        wp gain          # token savings after your first session',
@@ -730,7 +803,7 @@ export function registerInitCommand(cli, commandName = 'init') {
         .command(commandName, description)
         .option('--with <skills>', withHelp)
         .option('--without <skills>', withoutHelp)
-        .option('--host <hosts>', 'Comma-separated host targets: codex, claude, opencode, all')
+        .option('--host <hosts>', 'Comma-separated host targets: codex, claude, opencode, all, none')
         .option('--all', 'Install every skill (Tier-1 + Tier-2 + all Tier-3)')
         .option('--overwrite', 'Force full-file replacement for eligible managed files (default: reconcile owned content and preserve divergent consumer files)')
         .option('--dry-run', 'Show what would change without writing anything')

package/dist/esm/cli/commands/init/scaffold-base-kit.d.ts

@@ -5,5 +5,17 @@ export interface ScaffoldBaseKitInput {
     options: MergeOptions;
     globalInstall?: boolean;
 }
+export interface RuntimeContractGuidance {
+    keepLocalAuthoringDeps: string[];
+    reviewForRemovalDeps: string[];
+}
+interface PackageJsonLike {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    [key: string]: unknown;
+}
+export declare function collectRuntimeContractGuidance(packageJson: PackageJsonLike | null | undefined): RuntimeContractGuidance;
+export declare const BASE_KIT_QUALITY_TARGETS: string[];
 export declare function scaffoldBaseKit(input: ScaffoldBaseKitInput): MergeResult[];
+export {};
 //# sourceMappingURL=scaffold-base-kit.d.ts.map

package/dist/esm/cli/commands/init/scaffold-base-kit.js

@@ -1,6 +1,30 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { writeFileMerged } from './merge.js';
+const AUTHORING_TIME_DEPENDENCIES = [
+    'vitest',
+    '@playwright/test',
+    '@testing-library/jest-dom',
+    'typescript',
+];
+const EXECUTION_ONLY_REVIEW_DEPENDENCIES = [
+    'oxlint',
+    'oxfmt',
+    'prettier',
+    'markdownlint-cli2',
+    'stryker',
+];
+export function collectRuntimeContractGuidance(packageJson) {
+    const deps = {
+        ...readDependencyBucket(packageJson?.['dependencies']),
+        ...readDependencyBucket(packageJson?.['devDependencies']),
+    };
+    const installed = new Set(Object.keys(deps));
+    return {
+        keepLocalAuthoringDeps: AUTHORING_TIME_DEPENDENCIES.filter((name) => installed.has(name)),
+        reviewForRemovalDeps: EXECUTION_ONLY_REVIEW_DEPENDENCIES.filter((name) => installed.has(name)),
+    };
+}
 /** Template files relative to `catalog/base-kit/`, and their target paths relative to repoRoot. */
 const TEMPLATE_MAP = [
     ['.editorconfig.tmpl', '.editorconfig'],
@@ -18,6 +42,19 @@ const TEMPLATE_MAP = [
     ['test/.gitkeep.tmpl', 'test/.gitkeep'],
     ['e2e/.gitkeep.tmpl', 'e2e/.gitkeep'],
 ];
+/** Consumer-owned quality scaffold: create for fresh repos, never clobber. */
+const QUALITY_BOOTSTRAP_ONLY_MAP = [
+    ['tsconfig.json.tmpl', 'tsconfig.json'],
+    ['vitest.config.ts.tmpl', 'vitest.config.ts'],
+    ['oxlint.config.ts.tmpl', 'oxlint.config.ts'],
+    ['stryker.config.ts.tmpl', 'stryker.config.ts'],
+    ['playwright.config.ts.tmpl', 'playwright.config.ts'],
+    ['src/quality-sample.ts.tmpl', 'src/quality-sample.ts'],
+    ['src/quality-sample.test.ts.tmpl', 'src/quality-sample.test.ts'],
+    ['e2e/fixtures/smoke.html.tmpl', 'e2e/fixtures/smoke.html'],
+    ['e2e/smoke.spec.ts.tmpl', 'e2e/smoke.spec.ts'],
+];
+export const BASE_KIT_QUALITY_TARGETS = QUALITY_BOOTSTRAP_ONLY_MAP.map(([, targetRel]) => targetRel);
 /**
  * Bootstrap-only templates: the scaffolder writes them when absent (so a
  * fresh repo gets sane defaults) but NEVER overwrites them once they exist
@@ -75,35 +112,85 @@ function mergePackageJson(repoRoot, options, globalInstall = false) {
     const hasVerifySecrets = typeof scripts['verify:secrets'] === 'string';
     const hasSecretQuarantineAudit = typeof scripts['audit:secret-provider-quarantine'] === 'string';
     const hasPrepareScript = typeof scripts['prepare'] === 'string';
-    const verifyPathsScript = 'WP_SKIP_UPDATE_CHECK=1 wp audit absolute-path-policy --root .';
+    const hasLintScript = typeof scripts['lint'] === 'string';
+    const hasTypecheckScript = typeof scripts['typecheck'] === 'string';
+    const hasTestScript = typeof scripts['test'] === 'string' && !isNpmInitPlaceholderTestScript(scripts['test']);
+    const hasMutationScript = typeof scripts['mutation'] === 'string';
+    const hasTestMutationScript = typeof scripts['test:mutation'] === 'string';
+    const hasE2eScript = typeof scripts['e2e'] === 'string';
+    const hasQaScript = typeof scripts['qa'] === 'string';
+    const verifyPathsScript = 'wp audit absolute-path-policy --root .';
     const verifySecretsScript = 'bun scripts/check-no-dev-vars.ts';
     const secretQuarantineAuditScript = 'bun scripts/audit-secret-provider-quarantine.ts';
+    const lintScript = 'wp lint src e2e *.config.ts';
+    const typecheckScript = 'wp typecheck';
+    const testScript = 'wp test --file vitest.config.ts';
+    const mutationScript = 'wp test --mutation';
+    const testMutationScript = 'stryker run stryker.config.ts';
+    const e2eScript = 'wp e2e --config playwright.config.ts';
+    const qaScript = [
+        'wp lint src e2e *.config.ts',
+        'wp typecheck',
+        'wp test --file vitest.config.ts',
+        'wp test --mutation',
+        'wp e2e --config playwright.config.ts',
+    ].join(' && ');
     const devDeps = (pkg['devDependencies'] ?? {});
-    const hasAgentKitDevDep = typeof devDeps['webpresso'] === 'string';
-    const shouldSkipSelfInstall = packageName === 'webpresso';
+    const hasAgentKitDevDep = typeof devDeps['@webpresso/agent-kit'] === 'string';
+    const hasLegacyAgentKitDevDep = typeof devDeps['webpresso'] === 'string';
+    const shouldSkipSelfInstall = packageName === '@webpresso/agent-kit' || packageName === 'webpresso';
     const shouldManageAgentKitAsGlobal = globalInstall && !shouldSkipSelfInstall;
+    const requiredAuthoringDeps = {
+        '@playwright/test': 'latest',
+        '@stryker-mutator/core': 'latest',
+        '@stryker-mutator/vitest-runner': 'latest',
+        '@types/node': 'latest',
+        typescript: 'latest',
+        vitest: 'latest',
+    };
     if (alreadyHasEngines &&
         alreadyHasPm &&
-        (shouldSkipSelfInstall || shouldManageAgentKitAsGlobal || hasAgentKitDevDep) &&
+        (shouldSkipSelfInstall ||
+            shouldManageAgentKitAsGlobal ||
+            hasAgentKitDevDep ||
+            hasLegacyAgentKitDevDep) &&
+        Object.keys(requiredAuthoringDeps).every((name) => typeof devDeps[name] === 'string') &&
         (shouldSkipSelfInstall || hasSetupAgent) &&
         (shouldSkipSelfInstall || hasVerifyPaths) &&
         (shouldSkipSelfInstall || hasVerifySecrets) &&
         (shouldSkipSelfInstall || hasSecretQuarantineAudit) &&
-        (shouldSkipSelfInstall || hasPrepareScript)) {
+        (shouldSkipSelfInstall || hasPrepareScript) &&
+        hasLintScript &&
+        hasTypecheckScript &&
+        hasTestScript &&
+        hasMutationScript &&
+        hasTestMutationScript &&
+        hasE2eScript &&
+        hasQaScript) {
         return { targetPath: pkgPath, action: 'identical' };
     }
     pkg['engines'] = { ...existing, node: engines.node };
     if (!alreadyHasPm)
         pkg['packageManager'] = packageManager;
+    if (typeof pkg['type'] !== 'string')
+        pkg['type'] = 'module';
     // Ensure husky is in devDependencies so `vp exec husky init` works
     if (!devDeps['husky']) {
         devDeps['husky'] = '^9.0.0';
     }
-    if (!shouldSkipSelfInstall && !shouldManageAgentKitAsGlobal && !hasAgentKitDevDep) {
+    if (!shouldSkipSelfInstall &&
+        !shouldManageAgentKitAsGlobal &&
+        !hasAgentKitDevDep &&
+        !hasLegacyAgentKitDevDep) {
         // Keep consumers on the currently published dist-tag rather than a
         // repo-internal path. Do not wire this through `prepare`: `wp` is not
         // reliably on PATH during `vp install`, so `setup:agent` stays opt-in.
-        devDeps['webpresso'] = 'latest';
+        devDeps['@webpresso/agent-kit'] = 'latest';
+    }
+    for (const [name, version] of Object.entries(requiredAuthoringDeps)) {
+        if (!devDeps[name]) {
+            devDeps[name] = version;
+        }
     }
     pkg['devDependencies'] = devDeps;
     if (!shouldSkipSelfInstall && !hasSetupAgent) {
@@ -121,6 +208,27 @@ function mergePackageJson(repoRoot, options, globalInstall = false) {
     if (!shouldSkipSelfInstall && !hasPrepareScript) {
         scripts['prepare'] = 'husky';
     }
+    if (!hasLintScript) {
+        scripts['lint'] = lintScript;
+    }
+    if (!hasTypecheckScript) {
+        scripts['typecheck'] = typecheckScript;
+    }
+    if (!hasTestScript) {
+        scripts['test'] = testScript;
+    }
+    if (!hasMutationScript) {
+        scripts['mutation'] = mutationScript;
+    }
+    if (!hasTestMutationScript) {
+        scripts['test:mutation'] = testMutationScript;
+    }
+    if (!hasE2eScript) {
+        scripts['e2e'] = e2eScript;
+    }
+    if (!hasQaScript) {
+        scripts['qa'] = qaScript;
+    }
     if (Object.keys(scripts).length > 0) {
         pkg['scripts'] = scripts;
     }
@@ -161,6 +269,24 @@ export function scaffoldBaseKit(input) {
         writeFileSync(targetPath, content);
         results.push({ targetPath, action: 'created' });
     }
+    for (const [tmplRel, targetRel] of QUALITY_BOOTSTRAP_ONLY_MAP) {
+        const tmplPath = join(baseKitDir, tmplRel);
+        if (!existsSync(tmplPath))
+            continue;
+        const targetPath = join(repoRoot, targetRel);
+        if (existsSync(targetPath)) {
+            results.push({ targetPath, action: 'identical' });
+            continue;
+        }
+        const content = readFileSync(tmplPath, 'utf8');
+        if (options.dryRun) {
+            results.push({ targetPath, action: 'skipped-dry' });
+            continue;
+        }
+        mkdirSync(dirname(targetPath), { recursive: true });
+        writeFileSync(targetPath, content);
+        results.push({ targetPath, action: 'created' });
+    }
     // Make husky hook files executable
     if (!options.dryRun) {
         for (const [tmplRel, targetRel] of TEMPLATE_MAP) {
@@ -180,4 +306,13 @@ export function scaffoldBaseKit(input) {
     results.push(mergePackageJson(repoRoot, options, globalInstall));
     return results;
 }
+function readDependencyBucket(value) {
+    if (!value || typeof value !== 'object') {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[0] === 'string' && typeof entry[1] === 'string'));
+}
+function isNpmInitPlaceholderTestScript(value) {
+    return /^echo ['"]?Error: no test specified['"]? && exit 1$/u.test(value.trim());
+}
 //# sourceMappingURL=scaffold-base-kit.js.map

package/dist/esm/cli/commands/init/scaffolders/agent-hooks/codex-ownership.js

@@ -10,6 +10,8 @@ export const KNOWN_WEBPRESSO_CODEX_BINS = [
 const KNOWN_WEBPRESSO_CODEX_BIN_SET = new Set(KNOWN_WEBPRESSO_CODEX_BINS);
 const NODE_MODULES_BIN_PATTERN = /^(?:\.\/|\/.*\/)?node_modules\/\.bin\/([\w-]+)$/u;
 const GUARDED_NODE_MODULES_BIN_PATTERN = /^\[ -x (["']?)((?:\.\/|\/.*\/)?node_modules\/\.bin\/([\w-]+))\1 \] && \1\2\1 \|\| (?:true|printf .+)$/u;
+const MANAGED_LAUNCHER_PATTERN = /^(?:["']?)((?:\.\/|\/.*\/)?\.codex\/managed-hooks\/((?:wp|ak)-[\w-]+)\.sh)(?:["']?)$/u;
+const GUARDED_MANAGED_LAUNCHER_PATTERN = /^\[ -x (["']?)((?:\.\/|\/.*\/)?\.codex\/managed-hooks\/((?:wp|ak)-[\w-]+)\.sh)\1 \] && \1\2\1 \|\| (?:true|printf .+)$/u;
 export function isWebpressoOwnedCodexHook(metadata, expectedSourcePaths) {
     if (!isObject(metadata))
         return false;
@@ -46,8 +48,14 @@ function extractDirectNodeModulesBin(command) {
     const match = NODE_MODULES_BIN_PATTERN.exec(normalizedCommand);
     if (match?.[1])
         return match[1];
+    const managedLauncherMatch = MANAGED_LAUNCHER_PATTERN.exec(normalizedCommand);
+    if (managedLauncherMatch?.[2])
+        return managedLauncherMatch[2];
     const guardedMatch = GUARDED_NODE_MODULES_BIN_PATTERN.exec(command.trim());
-    return guardedMatch?.[3] ?? null;
+    if (guardedMatch?.[3])
+        return guardedMatch[3];
+    const guardedManagedLauncherMatch = GUARDED_MANAGED_LAUNCHER_PATTERN.exec(command.trim());
+    return guardedManagedLauncherMatch?.[3] ?? null;
 }
 function stripSingleShellQuotePair(value) {
     if (value.length < 2)