aiox-core 5.0.7 → 5.0.8

package/packages/installer/src/wizard/index.js

@@ -22,7 +22,13 @@ const {
 const { setLanguage, t } = require('./i18n');
 const yaml = require('js-yaml');
 const { showWelcome, showCompletion, showCancellation } = require('./feedback');
-const { generateIDEConfigs, showSuccessSummary, copySkillFiles, copyExtraCommandFiles } = require('./ide-config-generator');
+const {
+  generateIDEConfigs,
+  showSuccessSummary,
+  copySkillFiles,
+  generateCodexSkills,
+  copyExtraCommandFiles,
+} = require('./ide-config-generator');
 const {
   configureEnvironment,
 } = require('../config/configure-environment');
@@ -30,6 +36,7 @@ const {
   installDependencies,
 } = require('../installer/dependency-installer');
 const { commandSync, commandValidate } = require('../../../../.aiox-core/infrastructure/scripts/ide-sync/index');
+const { syncSkills: syncCodexSkills } = require('../../../../.aiox-core/infrastructure/scripts/codex-skills-sync/index');
 const {
   installAioxCore,
   hasPackageJson,
@@ -329,12 +336,43 @@ async function runWizard(options = {}) {
       }
     }
 
+    if (options.dryRun) {
+      const preview = {
+        dryRun: true,
+        projectType: answers.projectType,
+        selectedIDEs: answers.selectedIDEs || [],
+        selectedTechPreset: answers.selectedTechPreset || 'none',
+        steps: [
+          'install-aiox-core',
+          'generate-ide-configs',
+          'generate-boundary-rules',
+          'copy-skills-and-commands',
+          'run-ide-sync',
+          'bootstrap-entity-registry',
+          'configure-environment',
+          'install-dependencies',
+          'validate-installation',
+        ],
+      };
+
+      if (!options.quiet) {
+        console.log('\n🧪 Dry run mode');
+        console.log('   No files will be modified.');
+        console.log(`   Project type: ${preview.projectType}`);
+        console.log(`   IDEs: ${preview.selectedIDEs.length > 0 ? preview.selectedIDEs.join(', ') : 'none'}`);
+        console.log(`   Tech preset: ${preview.selectedTechPreset}`);
+      }
+
+      return preview;
+    }
+
     // Story 1.4: Install AIOX core framework (agents, tasks, workflows, templates)
     console.log('\n📦 Installing AIOX core framework...');
     let aioxCoreResult = null;
     try {
       aioxCoreResult = await installAioxCore({
         targetDir: process.cwd(),
+        projectType: answers.projectType || 'greenfield',
         onProgress: (_status) => {
           // Silent progress - spinner handles feedback
         },
@@ -522,6 +560,24 @@ async function runWizard(options = {}) {
       answers.skillsCopied = 0;
     }
 
+    // Local-first Codex flow: generate project-local /skills activators automatically
+    if ((answers.selectedIDEs || []).includes('codex')) {
+      console.log('\n🧠 Generating Codex skills...');
+      try {
+        const codexSkillsResult = generateCodexSkills(process.cwd());
+        if (codexSkillsResult.skipped) {
+          console.log('   ℹ️  Codex skills: canonical agent source not found (skipped)');
+        } else {
+          console.log(`✅ Codex skills: ${codexSkillsResult.count} generated`);
+        }
+        answers.codexSkillsGenerated = codexSkillsResult.count;
+        answers.codexSkillsSkipped = codexSkillsResult.skipped;
+      } catch (error) {
+        console.warn(`⚠️  Codex skills generation failed: ${error.message}`);
+        answers.codexSkillsGenerated = 0;
+      }
+    }
+
     // Story INS-4.3: Copy extra commands (Gap #12)
     console.log('\n📋 Copying extra commands...');
     try {
@@ -554,7 +610,7 @@ async function runWizard(options = {}) {
       try {
         await commandValidate({ quiet: true });
         answers.ideSyncValidation = 'pass';
-      } catch (validateError) {
+      } catch (_validateError) {
         answers.ideSyncValidation = 'drift';
       } finally {
         console.log = _origLog;
@@ -570,6 +626,23 @@ async function runWizard(options = {}) {
       process.chdir(savedCwd);
     }
 
+    // ACORE-SKILLS.7: Generate Codex local skills in installed projects.
+    console.log('\n🧩 Running Codex skills sync...');
+    try {
+      const codexSkillsResult = syncCodexSkills({
+        sourceDir: path.join(targetProjectRoot, '.aiox-core', 'development', 'agents'),
+        localSkillsDir: path.join(targetProjectRoot, '.codex', 'skills'),
+        dryRun: false,
+      });
+      answers.codexSkillsStatus = 'synced';
+      answers.codexSkillsGenerated = codexSkillsResult.generated;
+      console.log(`✅ Codex skills: ${codexSkillsResult.generated} generated`);
+    } catch (codexSkillsError) {
+      console.warn(`⚠️  Codex skills sync failed: ${codexSkillsError.message} — run 'npm run sync:skills:codex' post-install`);
+      answers.codexSkillsStatus = 'failed';
+      answers.codexSkillsGenerated = 0;
+    }
+
     // Story INS-4.6: Entity Registry Bootstrap — populate entity-registry.yaml on install
     // Story INS-4.12: Fix module resolution + bootstrap timing
     // Bootstrap runs AFTER .aiox-core deps are installed (aiox-core-installer.js:324-345)
@@ -722,38 +795,44 @@ async function runWizard(options = {}) {
           console.error(`  ${depsResult.errorMessage}`);
           console.error(`  Solution: ${depsResult.solution}`);
 
-          // Ask user if they want to retry
-          const { retryDeps } = await inquirer.prompt([
-            {
-              type: 'confirm',
-              name: 'retryDeps',
-              message: 'Retry dependency installation?',
-              default: true,
-            },
-          ]);
-
-          if (retryDeps) {
-            // Recursive retry with exponential backoff (built into installDependencies)
-            const retryResult = await installDependencies({
-              packageManager: answers.packageManager,
-              projectPath: projectPath,
-            });
-
-            if (retryResult.success) {
-              console.log(`\n✅ Dependencies installed with ${retryResult.packageManager}!`);
-              answers.depsInstalled = true;
-              answers.depsResult = retryResult;
+          if (options.quiet || options.ci || process.env.CI === '1') {
+            answers.depsInstalled = false;
+            answers.depsResult = depsResult;
+            console.log('\n⚠️  Skipping dependency retry in non-interactive mode.');
+          } else {
+            // Ask user if they want to retry
+            const { retryDeps } = await inquirer.prompt([
+              {
+                type: 'confirm',
+                name: 'retryDeps',
+                message: 'Retry dependency installation?',
+                default: true,
+              },
+            ]);
+
+            if (retryDeps) {
+              // Recursive retry with exponential backoff (built into installDependencies)
+              const retryResult = await installDependencies({
+                packageManager: answers.packageManager,
+                projectPath: projectPath,
+              });
+
+              if (retryResult.success) {
+                console.log(`\n✅ Dependencies installed with ${retryResult.packageManager}!`);
+                answers.depsInstalled = true;
+                answers.depsResult = retryResult;
+              } else {
+                console.log(
+                  '\n⚠️  Installation still failed. You can run `npm install` manually later.',
+                );
+                answers.depsInstalled = false;
+                answers.depsResult = retryResult;
+              }
             } else {
-              console.log(
-                '\n⚠️  Installation still failed. You can run `npm install` manually later.',
-              );
+              console.log('\n⚠️  Skipping dependency installation. Run manually with `npm install`.');
               answers.depsInstalled = false;
-              answers.depsResult = retryResult;
+              answers.depsResult = depsResult;
             }
-          } else {
-            console.log('\n⚠️  Skipping dependency installation. Run manually with `npm install`.');
-            answers.depsInstalled = false;
-            answers.depsResult = depsResult;
           }
         }
       } catch (error) {
@@ -910,6 +989,14 @@ async function runWizard(options = {}) {
     console.log('\n🔍 Validating installation...\n');
 
     try {
+      const expectedSkillDirs = [];
+      if ((answers.selectedIDEs || []).includes('claude-code')) {
+        expectedSkillDirs.push('.claude/skills');
+      }
+      if ((answers.selectedIDEs || []).includes('codex')) {
+        expectedSkillDirs.push(path.join('.codex', 'skills'));
+      }
+
       const validation = await validateInstallation(
         {
           files: {
@@ -917,6 +1004,7 @@ async function runWizard(options = {}) {
             env: '.env',
             coreConfig: '.aiox-core/core-config.yaml',
             mcpConfig: '.mcp.json',
+            skillDirs: expectedSkillDirs,
           },
           configs: {
             env: answers.envResult,

package/packages/installer/src/wizard/pro-setup.js

@@ -39,7 +39,7 @@ const LICENSE_SERVER_URL = process.env.AIOX_LICENSE_API_URL || 'https://aiox-lic
 /**
  * Inline License Client — lightweight HTTP client for pre-bootstrap license checks.
  *
- * Used when @aiox-fullstack/pro is not yet installed (first install scenario).
+ * Used when @aiox-squads/pro is not yet installed (first install scenario).
  * Implements the same interface subset as LicenseApiClient using Node.js native https.
  */
 class InlineLicenseClient {
@@ -57,12 +57,12 @@ class InlineLicenseClient {
    */
   _request(method, urlPath, body, headers = {}) {
     return new Promise((resolve, reject) => {
-      const https = require('https');
       const url = new URL(urlPath, this.baseUrl);
+      const transport = url.protocol === 'http:' ? require('http') : require('https');
 
       const options = {
         hostname: url.hostname,
-        port: url.port || 443,
+        port: url.port || (url.protocol === 'http:' ? 80 : 443),
         path: url.pathname + url.search,
         method,
         headers: {
@@ -73,7 +73,7 @@ class InlineLicenseClient {
         timeout: 15000,
       };
 
-      const req = https.request(options, (res) => {
+      const req = transport.request(options, (res) => {
         let data = '';
         res.on('data', (chunk) => { data += chunk; });
         res.on('end', () => {
@@ -135,10 +135,19 @@ class InlineLicenseClient {
    * Login with email and password.
    * @param {string} email
    * @param {string} password
-   * @returns {Promise<{sessionToken: string, emailVerified: boolean}>}
+   * @returns {Promise<{accessToken: string, sessionToken: string, emailVerified: boolean}>}
    */
   async login(email, password) {
-    return this._request('POST', '/api/v1/auth/login', { email, password });
+    return this._request('POST', '/api/v1/auth/login', { email, password })
+      .then((result) => {
+        const accessToken = result.accessToken || result.sessionToken;
+        return {
+          ...result,
+          accessToken,
+          // Backward-compatible alias for existing wizard flows.
+          sessionToken: accessToken,
+        };
+      });
   }
 
   /**
@@ -160,11 +169,17 @@ class InlineLicenseClient {
    */
   async activateByAuth(token, machineId, version) {
     return this._request('POST', '/api/v1/auth/activate-pro', {
+      accessToken: token,
       machineId,
       version,
+      aioxCoreVersion: version,
     }, {
+      // Preserve legacy compatibility with older server deployments.
       Authorization: `Bearer ${token}`,
-    });
+    }).then((result) => ({
+      ...result,
+      key: result.key || result.licenseKey,
+    }));
   }
 
   /**
@@ -175,8 +190,7 @@ class InlineLicenseClient {
    * @returns {Promise<Object>} Activation result
    */
   async activate(licenseKey, machineId, version) {
-    // Keep the inline fallback aligned with the runtime license client contract.
-    return this._request('POST', '/v1/license/activate', {
+    return this._request('POST', '/api/v1/licenses/activate', {
       key: licenseKey,
       machineId,
       version,
@@ -185,13 +199,32 @@ class InlineLicenseClient {
 
   /**
    * Check if user's email has been verified.
-   * @param {string} sessionToken - Session token
+   * @param {string} accessToken - Session token
    * @returns {Promise<{verified: boolean}>}
    */
-  async checkEmailVerified(sessionToken) {
-    return this._request('GET', '/api/v1/auth/email-verified', null, {
-      Authorization: `Bearer ${sessionToken}`,
-    });
+  async checkEmailVerified(accessToken) {
+    try {
+      const result = await this._request('POST', '/api/v1/auth/verify-status', {
+        accessToken,
+      });
+      return {
+        ...result,
+        verified: result.verified ?? result.emailVerified,
+      };
+    } catch (error) {
+      // Older server versions used GET /email-verified with bearer auth.
+      if (!error.message || !error.message.includes('HTTP 404')) {
+        throw error;
+      }
+
+      const result = await this._request('GET', '/api/v1/auth/email-verified', null, {
+        Authorization: `Bearer ${accessToken}`,
+      });
+      return {
+        ...result,
+        verified: result.verified ?? result.emailVerified,
+      };
+    }
   }
 
   /**
@@ -318,14 +351,14 @@ function showStep(current, total, label) {
  *
  * Resolution order:
  * 1. Relative path (framework-dev mode: ../../../../pro/license/{name})
- * 2. @aiox-fullstack/pro package (brownfield: node_modules/@aiox-fullstack/pro/license/{name})
+ * 2. @aiox-squads/pro package (brownfield: node_modules/@aiox-squads/pro/license/{name})
  * 3. Absolute path via aiox-core in node_modules (brownfield upgrade)
- * 4. Absolute path via @aiox-fullstack/pro in user project (npx context)
+ * 4. Absolute path via @aiox-squads/pro in user project (npx context)
  *
  * Path 4 is critical for npx execution: when running `npx aiox-core install`,
  * require() resolves from the npx temp directory, not process.cwd(). After
- * bootstrap installs @aiox-fullstack/pro in the user's project, only an
- * absolute path to process.cwd()/node_modules/@aiox-fullstack/pro/... works.
+ * bootstrap installs @aiox-squads/pro in the user's project, only an
+ * absolute path to process.cwd()/node_modules/@aiox-squads/pro/... works.
  *
  * @param {string} moduleName - Module filename without extension (e.g., 'license-api')
  * @returns {Object|null} Loaded module or null
@@ -354,8 +387,8 @@ function loadProModule(moduleName) {
     return frameworkModule;
   }
 
-  // 2. npm packages — try canonical then fallback
-  const npmScopes = ['@aiox-fullstack/pro', '@aios-fullstack/pro'];
+  // 2. npm packages — try canonical then fallbacks
+  const npmScopes = ['@aiox-squads/pro', '@aiox-fullstack/pro', '@aios-fullstack/pro'];
   for (const scope of npmScopes) {
     const requestPath = `${scope}/license/${moduleName}`;
     const loadedModule = tryRequire(requestPath);
@@ -373,7 +406,7 @@ function loadProModule(moduleName) {
 
   // 4. npm package in user project via absolute path (npx context — require resolves from
   //    temp dir, so we need absolute path to where bootstrap installed the package)
-  const absScopeDirs = ['@aiox-fullstack', '@aios-fullstack'];
+  const absScopeDirs = ['@aiox-squads', '@aiox-fullstack', '@aios-fullstack'];
   for (const scopeDir of absScopeDirs) {
     const absPath = path.join(process.cwd(), 'node_modules', scopeDir, 'pro', 'license', moduleName);
     const loadedModule = tryRequire(absPath);
@@ -459,7 +492,7 @@ function generateMachineId() {
 /**
  * Get a license API client instance.
  *
- * Prefers the full LicenseApiClient from @aiox-fullstack/pro when available.
+ * Prefers the full LicenseApiClient from @aiox-squads/pro when available.
  * Falls back to InlineLicenseClient (native https) for pre-bootstrap scenarios.
  *
  * @returns {Object} Client instance with isOnline, checkEmail, login, signup, activateByAuth
@@ -475,7 +508,7 @@ function getLicenseClient() {
     return new LicenseApiClient();
   }
 
-  // Fallback: use inline client for pre-bootstrap (no @aiox-fullstack/pro yet)
+  // Fallback: use inline client for pre-bootstrap (no @aiox-squads/pro yet)
   return new InlineLicenseClient();
 }
 
@@ -584,6 +617,63 @@ async function ensureKeyValidationParity(client, activationResult, machineId, ai
   }
 }
 
+/**
+ * Resolve the Pro content source directory.
+ *
+ * Priority:
+ * 1. Bundled pro/ content in the aiox-core checkout or package
+ * 2. Auto-initialize the git submodule when running from a source checkout
+ * 3. Installed @aiox-squads/pro package in the target project
+ *
+ * @param {string} targetDir - Project root directory
+ * @returns {{proSourceDir: string|null, bootstrapError?: string}} Resolution result
+ */
+function resolveProSourceDir(targetDir) {
+  const path = require('path');
+  const fs = require('fs');
+  const { execFileSync } = require('child_process');
+
+  const repoRoot = path.resolve(__dirname, '..', '..', '..', '..');
+  const bundledProDir = path.join(repoRoot, 'pro');
+  const npmProDirs = [
+    path.join(targetDir, 'node_modules', '@aiox-squads', 'pro'),
+    path.join(targetDir, 'node_modules', '@aiox-fullstack', 'pro'),
+    path.join(targetDir, 'node_modules', '@aios-fullstack', 'pro'),
+  ];
+  const bundledSquadsDir = path.join(bundledProDir, 'squads');
+  const gitmodulesPath = path.join(repoRoot, '.gitmodules');
+
+  if (fs.existsSync(bundledSquadsDir)) {
+    return { proSourceDir: bundledProDir };
+  }
+
+  if (fs.existsSync(gitmodulesPath) && fs.existsSync(bundledProDir)) {
+    try {
+      execFileSync('git', ['submodule', 'update', '--init', '--recursive', 'pro'], {
+        cwd: repoRoot,
+        stdio: 'ignore',
+      });
+
+      if (fs.existsSync(bundledSquadsDir)) {
+        return { proSourceDir: bundledProDir };
+      }
+    } catch (error) {
+      return {
+        proSourceDir: null,
+        bootstrapError: error.message || 'git submodule update failed',
+      };
+    }
+  }
+
+  for (const npmProDir of npmProDirs) {
+    if (fs.existsSync(npmProDir)) {
+      return { proSourceDir: npmProDir };
+    }
+  }
+
+  return { proSourceDir: null };
+}
+
 /**
  * Step 1: License Gate — authenticate and validate license.
  *
@@ -728,7 +818,7 @@ async function stepLicenseGateWithEmail() {
   let checkResult;
   try {
     checkResult = await client.checkEmail(trimmedEmail);
-  } catch (checkError) {
+  } catch (_checkError) {
     checkSpinner.info(t('proBuyerCheckUnavailable'));
     return fallbackAuthWithoutBuyerCheck(client, trimmedEmail);
   }
@@ -1431,32 +1521,12 @@ async function validateKeyWithApi(key) {
 async function stepInstallScaffold(targetDir, options = {}) {
   showStep(2, 3, t('proContentInstallation'));
 
-  const path = require('path');
-  const fs = require('fs');
-
-  // Resolve pro source directory from multiple locations:
-  // 1. Bundled in aiox-core package (pro/ submodule — npx and local dev)
-  // 2. npm package — canonical @aiox-fullstack/pro or fallback @aios-fullstack/pro
-  const bundledProDir = path.resolve(__dirname, '..', '..', '..', '..', 'pro');
-  const npmProCandidates = [
-    path.join(targetDir, 'node_modules', '@aiox-fullstack', 'pro'),
-    path.join(targetDir, 'node_modules', '@aios-fullstack', 'pro'),
-  ];
-
-  let proSourceDir;
-  if (fs.existsSync(bundledProDir) && fs.existsSync(path.join(bundledProDir, 'squads'))) {
-    proSourceDir = bundledProDir;
-  } else {
-    proSourceDir = npmProCandidates.find((candidate) => (
-      fs.existsSync(path.join(candidate, 'package.json'))
-      && fs.existsSync(path.join(candidate, 'squads'))
-    ));
-  }
+  const { proSourceDir, bootstrapError } = resolveProSourceDir(targetDir);
 
   if (!proSourceDir) {
     return {
       success: false,
-      error: t('proPackageNotFound'),
+      error: bootstrapError ? `${t('proPackageNotFound')} ${bootstrapError}` : t('proPackageNotFound'),
     };
   }
 
@@ -1610,7 +1680,7 @@ async function runProWizard(options = {}) {
     showProHeader();
   }
 
-  // Step 1: License Gate (uses InlineLicenseClient if @aiox-fullstack/pro not yet installed)
+  // Step 1: License Gate (uses InlineLicenseClient if @aiox-squads/pro not yet installed)
   const licenseResult = await stepLicenseGate({
     key: options.key || process.env.AIOX_PRO_KEY,
     email: options.email || process.env.AIOX_PRO_EMAIL,
@@ -1687,6 +1757,7 @@ module.exports = {
     loadLicenseCache,
     loadProScaffolder,
     getLicenseClient,
+    resolveProSourceDir,
     InlineLicenseClient,
     generateMachineId,
     persistLicenseCache,

package/packages/installer/src/wizard/validation/validators/dependency-validator.js

@@ -29,6 +29,7 @@ async function validateDependencies(depsContext = {}) {
     errors: [],
     warnings: [],
   };
+  const projectRoot = depsContext.projectPath || depsContext.targetDir || process.cwd();
 
   try {
     // Check if dependencies were installed (skip for greenfield with no deps defined)
@@ -43,8 +44,8 @@ async function validateDependencies(depsContext = {}) {
     }
 
     // Check node_modules existence
-    const nodeModulesPath = path.join(process.cwd(), 'node_modules');
-    const packageJsonPath = path.join(process.cwd(), 'package.json');
+    const nodeModulesPath = path.join(projectRoot, 'node_modules');
+    const packageJsonPath = path.join(projectRoot, 'package.json');
 
     // For greenfield projects, check if package.json has dependencies
     let hasDependencies = false;
@@ -92,13 +93,13 @@ async function validateDependencies(depsContext = {}) {
     });
 
     // Validate package.json integrity
-    await validatePackageJson(results);
+    await validatePackageJson(results, projectRoot);
 
-    // Check critical dependencies
-    await checkCriticalDependencies(results);
+    // Validate any explicit dependency contract supplied by the caller.
+    await checkRequiredDependencies(results, projectRoot, depsContext.requiredDependencies);
 
     // Run npm audit (non-blocking - warnings only)
-    await runSecurityAudit(results, depsContext.packageManager);
+    await runSecurityAudit(results, depsContext.packageManager, projectRoot);
 
     // Count installed packages
     await countInstalledPackages(results, nodeModulesPath);
@@ -121,8 +122,8 @@ async function validateDependencies(depsContext = {}) {
  * Validate package.json
  * @private
  */
-async function validatePackageJson(results) {
-  const packageJsonPath = 'package.json';
+async function validatePackageJson(results, projectRoot) {
+  const packageJsonPath = path.join(projectRoot, 'package.json');
 
   if (!fs.existsSync(packageJsonPath)) {
     results.errors.push({
@@ -165,22 +166,28 @@ async function validatePackageJson(results) {
 }
 
 /**
- * Check critical dependencies
+ * Check explicitly required dependencies for the target project.
+ *
+ * This validator is used against the installed project, not the installer
+ * workspace itself. A caller may provide a narrow manifest of packages that
+ * must exist after installation; when none is supplied we skip this check to
+ * avoid false warnings about the installer's own internal dependencies.
  * @private
  */
-async function checkCriticalDependencies(results) {
-  const criticalDeps = [
-    'inquirer',
-    'chalk',
-    'yaml',
-    'fs-extra',
-    '@clack/prompts',
-  ];
-
-  const nodeModulesPath = path.join(process.cwd(), 'node_modules');
+async function checkRequiredDependencies(results, projectRoot, requiredDependencies = []) {
+  if (!Array.isArray(requiredDependencies) || requiredDependencies.length === 0) {
+    results.checks.push({
+      component: 'Dependency Contract',
+      status: 'skipped',
+      message: 'No explicit required dependency manifest provided',
+    });
+    return;
+  }
+
+  const nodeModulesPath = path.join(projectRoot, 'node_modules');
   const missingDeps = [];
 
-  for (const dep of criticalDeps) {
+  for (const dep of requiredDependencies) {
     const depPath = path.join(nodeModulesPath, dep);
     if (!fs.existsSync(depPath)) {
       missingDeps.push(dep);
@@ -190,15 +197,15 @@ async function checkCriticalDependencies(results) {
   if (missingDeps.length > 0) {
     results.warnings.push({
       severity: 'high',
-      message: `Critical dependencies missing: ${missingDeps.join(', ')}`,
+      message: `Required dependencies missing: ${missingDeps.join(', ')}`,
       code: 'CRITICAL_DEPS_MISSING',
       solution: 'Re-run dependency installation',
     });
   } else {
     results.checks.push({
-      component: 'Critical Dependencies',
+      component: 'Dependency Contract',
       status: 'success',
-      message: `All ${criticalDeps.length} critical dependencies installed`,
+      message: `All ${requiredDependencies.length} required dependencies installed`,
     });
   }
 }
@@ -207,13 +214,13 @@ async function checkCriticalDependencies(results) {
  * Run security audit
  * @private
  */
-async function runSecurityAudit(results, packageManager = 'npm') {
+async function runSecurityAudit(results, packageManager = 'npm', projectRoot = process.cwd()) {
   try {
     const auditCommand = packageManager === 'yarn' ? 'yarn audit --json' : 'npm audit --json';
 
     const { stdout } = await execAsync(auditCommand, {
       timeout: 10000,
-      cwd: process.cwd(),
+      cwd: projectRoot,
     });
 
     let auditResults;

package/packages/installer/src/wizard/validation/validators/file-structure-validator.js

@@ -15,6 +15,7 @@ const fs = require('fs');
  * @param {string} fileContext.env - .env file path
  * @param {string} fileContext.coreConfig - core-config.yaml path
  * @param {string} fileContext.mcpConfig - .mcp.json path
+ * @param {Array<string>} fileContext.skillDirs - Skill directories expected after install
  * @returns {Promise<Object>} Validation result
  */
 async function validateFiles(fileContext = {}) {
@@ -51,6 +52,31 @@ async function validateFiles(fileContext = {}) {
       }
     }
 
+    if (fileContext.skillDirs && fileContext.skillDirs.length > 0) {
+      for (const skillDir of fileContext.skillDirs) {
+        const exists = fs.existsSync(skillDir);
+        const isDirectory = exists ? fs.statSync(skillDir).isDirectory() : false;
+        const check = {
+          component: 'Skills',
+          file: skillDir,
+          status: exists && isDirectory ? 'success' : 'failed',
+          message: exists && isDirectory ? 'Directory exists' : 'Directory missing',
+        };
+
+        results.checks.push(check);
+
+        if (!exists || !isDirectory) {
+          results.success = false;
+          results.errors.push({
+            severity: 'high',
+            message: `Expected skill directory missing: ${skillDir}`,
+            file: skillDir,
+            code: 'SKILL_DIR_MISSING',
+          });
+        }
+      }
+    }
+
     // Validate .env file (Story 1.6)
     const envPath = fileContext.env || '.env';
     const envExists = fs.existsSync(envPath);