argus-reviewer-e2e 0.4.0 → 0.4.2

package/dist/onboarding/scaffold.js

@@ -0,0 +1,174 @@
+/**
+ * Pure scaffold generator shared by `argus-reviewer init` and `init --pr`
+ * (and, later, the App's onboarding Worker, so the surfaces cannot drift).
+ * No I/O, no config execution, no environment reads. Workflow templates keep
+ * `persist-credentials: false`, a pinned action SHA, least-privilege
+ * `permissions`, and never `pull_request_target`.
+ */
+/**
+ * The one place the user-facing action pin lives. Bump it here (and the golden
+ * fixtures) on release; see RELEASING.md. v0.4.0 and v0.4.1 ship an action.yml
+ * GitHub cannot parse, so never pin to them.
+ */
+export const ACTION_PIN_SHA = 'dbf4b7f669507402d527cb0e350285ca56129448';
+export const ACTION_PIN_TAG = 'v0.4.2';
+const ACTION_PIN = `${ACTION_PIN_SHA} # ${ACTION_PIN_TAG}`;
+export function initConfig(a0Host) {
+    // R19 — a detected Agent Zero host earns a labeled suggestion, never an
+    // enabled lane: `verify --a0` is explicit opt-in per run, and completed
+    // delegations cap at inconclusive (self-reported evidence).
+    const a0Block = a0Host !== undefined
+        ? `
+  // Optional: Agent Zero detected at ${a0Host}. Nothing below runs unless
+  // you ask for it — both stays commented until you opt in deliberately.
+  //   a0: { url: ${JSON.stringify(a0Host)} },  // enables \`verify --a0\` (self-reported, unmetered)
+  //   heal: 'a0',                             // escalates a failed heal to the A0 host
+`
+        : '';
+    return `import { defineConfig } from 'argus-reviewer-e2e'
+
+export default defineConfig({
+  // The app under test. command boots it (omit if it is already running);
+  // argus-reviewer polls url until it responds before running tests.
+  target: {
+    command: 'npm run dev',
+    url: 'http://localhost:3000',
+    readyTimeoutMs: 30_000,
+  },
+  // Hard per-run cap on vision-model spend (USD). Steps replayed from the
+  // fingerprint cache cost $0 regardless of this cap.
+  budgetUsd: 1,
+  testsDir: 'tests/argus',
+  // Exploratory lane: after the test loop, a bounded agent pass probes the
+  // app itself — same-origin navigation, clicks, invalid input — while taps
+  // capture console errors, page errors, and failed requests. Findings
+  // render as 'observed' — evidence only, never verdict-changing.
+  // maxSteps caps acts per run; budgetUsd caps explore model spend (falls
+  // back to budgetUsd). Point it at disposable targets only — clicks and
+  // form submits have real side effects.
+  // explore: { enabled: true, maxSteps: 20, budgetUsd: 0.25 },${a0Block}
+})
+`;
+}
+export const INIT_TEST = `test('home renders', async (td) => {
+  const ok = await td.assert('the page rendered without obvious errors')
+  if (!ok) throw new Error('home did not render')
+})
+`;
+export const INIT_WORKFLOW = `name: argus-reviewer
+
+on:
+  pull_request:
+    # 'labeled' lets a maintainer re-trigger with the argus-probe label when
+    # sandbox probes are enabled for fork PRs.
+    types: [opened, synchronize, reopened, labeled]
+
+jobs:
+  argus:
+    runs-on: ubuntu-latest
+    # 'labeled' fires on EVERY label — only argus-probe is the fork-gate
+    # signal worth a full review run.
+    if: github.event.action != 'labeled' || github.event.label.name == 'argus-probe'
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+      checks: write
+      statuses: write
+    steps:
+      # persist-credentials: false keeps the GITHUB_TOKEN out of .git/config —
+      # the probe sandbox masks .git regardless, but don't store it at all.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: \${{ github.event.pull_request.head.sha || github.sha }}
+      # Optional verdict-as-review: let Argus submit APPROVE / REQUEST_CHANGES
+      # so require_approving_reviews counts it. GITHUB_TOKEN cannot approve, so
+      # create + install your own GitHub App (docs/github-app.md), set the
+      # ARGUS_APP_ID variable and ARGUS_APP_PRIVATE_KEY secret, then uncomment:
+      #      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+      #        id: argus-app
+      #        with:
+      #          app-id: \${{ vars.ARGUS_APP_ID }}
+      #          private-key: \${{ secrets.ARGUS_APP_PRIVATE_KEY }}
+      # and pass approval-token plus its evidence inputs to the action below:
+      #          approval-token: \${{ steps.argus-app.outputs.token }}
+      #          approval-evidence: 'npm test'   # command the approval stands on
+      #          approval-check: 'test'          # check-run name, green on head SHA
+      - uses: duketopceo/Argus/action@@@ACTION_PIN@@
+        with:
+          openrouter-api-key: \${{ secrets.OPENROUTER_API_KEY }}
+`.replace('@@ACTION_PIN@@', ACTION_PIN);
+export const INIT_MENTION_WORKFLOW = `name: argus-mention
+
+# @argus mention commands on PR comments — '@argus review', '@argus
+# record "<flow>"', '@argus persist', '@argus help'. issue_comment is
+# strictly more privileged than pull_request (secrets + write token are
+# present), so the checkout below deliberately resolves the BASE ref —
+# never the PR head. Argus reviews the head diff over the API.
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  argus-mention:
+    runs-on: ubuntu-latest
+    if: github.event.issue.pull_request && startsWith(github.event.comment.body, '@argus')
+    permissions:
+      # contents: write — '@argus persist' commits reproduced probes to an
+      # argus/ branch via the git/refs + contents APIs and opens a PR.
+      contents: write
+      issues: write
+      pull-requests: write
+      checks: write
+      statuses: write
+    steps:
+      # No 'ref' — the default checkout resolves the base branch. persist
+      # writes via the API, so checkout credentials stay disabled.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      # Record commands need the app's dependencies to boot its target.
+      # Uncomment if you use '@argus record':
+      # - run: npm ci
+      - uses: duketopceo/Argus/action@@@ACTION_PIN@@
+        with:
+          openrouter-api-key: \${{ secrets.OPENROUTER_API_KEY }}
+      # '@argus record' uploads the generated test + flow cache as an
+      # artifact — committing to a PR branch is intentionally not done.
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: contains(github.event.comment.body, 'record')
+        with:
+          name: argus-recorded-flow
+          path: |
+            tests/argus/
+            .argus-reviewer-cache/
+          if-no-files-found: ignore
+`.replace('@@ACTION_PIN@@', ACTION_PIN);
+export const CONFIG_PATH = 'argus-reviewer.config.ts';
+/** The files `init` writes, in write order. */
+export function renderScaffold(opts) {
+    const files = [
+        { path: 'tests/argus/smoke.test.ts', content: INIT_TEST },
+        { path: '.github/workflows/argus-reviewer.yml', content: INIT_WORKFLOW },
+        { path: '.github/workflows/argus-mention.yml', content: INIT_MENTION_WORKFLOW },
+    ];
+    if (opts.includeConfig)
+        files.unshift({ path: CONFIG_PATH, content: initConfig(opts.a0Host) });
+    return files;
+}
+/**
+ * "What runs and what it costs": what is sent to the provider, the default
+ * budget, and the stop path. Kept verbatim (DESIGN 7.8). `budgetUsd` comes
+ * from the caller's resolved defaults so it cannot go stale here.
+ */
+export function scaffoldChecklist(budgetUsd) {
+    return [
+        'What runs and what it costs:',
+        '  sent to provider  PR diffs, page screenshots/DOM snapshots, and',
+        '                    review prompts — via your OpenRouter key (BYOK)',
+        `  default budget    $${budgetUsd}/run cap (budgetUsd); cached replay costs $0`,
+        '  how to stop       Ctrl+C locally; in CI remove the workflow file',
+        '                    or delete the OPENROUTER_API_KEY secret',
+    ];
+}

package/dist/pipeline/budget.d.ts

@@ -10,3 +10,16 @@ export declare function overLimit(spentUsd: number, limitUsd: number): boolean;
 export declare function addProviderCalls(budget: BudgetSummary, calls: CallCost[] | undefined): BudgetSummary;
 export declare function addA0Task(budget: BudgetSummary, elapsedMs: number, metered: boolean): BudgetSummary;
 export declare function budgetCanSpend(budget: BudgetSummary, nextCostUsd: number): boolean;
+export declare function estimateRequestCostUsd(req: {
+    messages: unknown;
+    schema?: unknown;
+}): number;
+/**
+ * How many leading requests of a batch fit in the remaining budget. A batch
+ * cannot be cancelled once submitted, so the guard sizes it up front.
+ * `limitUsd` undefined = unlimited.
+ */
+export declare function affordableBatchPrefix(requests: ReadonlyArray<{
+    messages: unknown;
+    schema?: unknown;
+}>, limitUsd: number | undefined, spentUsd: number): number;

package/dist/pipeline/budget.js

@@ -46,3 +46,37 @@ export function budgetCanSpend(budget, nextCostUsd) {
         (budget.limitUsd === undefined ||
             budget.spentUsd + nextCostUsd <= budget.limitUsd + USD_EPSILON));
 }
+/**
+ * Conservative per-request cost ceiling (USD) used ONLY where a paid call
+ * cannot be stopped mid-flight (batch submission). Argus has no live price
+ * table, so this prices tokens at a deliberately high blended rate (well above
+ * the default review models) and reserves a fixed output allowance. Real
+ * spend is metered from provider usage; this only decides whether to submit.
+ */
+const EST_INPUT_USD_PER_TOKEN = 3 / 1_000_000;
+const EST_OUTPUT_USD_PER_TOKEN = 12 / 1_000_000;
+const EST_OUTPUT_TOKENS = 4_000;
+const EST_CHARS_PER_TOKEN = 3;
+export function estimateRequestCostUsd(req) {
+    const chars = JSON.stringify(req.messages ?? '').length + JSON.stringify(req.schema ?? '').length;
+    const inputTokens = Math.ceil(chars / EST_CHARS_PER_TOKEN);
+    return inputTokens * EST_INPUT_USD_PER_TOKEN + EST_OUTPUT_TOKENS * EST_OUTPUT_USD_PER_TOKEN;
+}
+/**
+ * How many leading requests of a batch fit in the remaining budget. A batch
+ * cannot be cancelled once submitted, so the guard sizes it up front.
+ * `limitUsd` undefined = unlimited.
+ */
+export function affordableBatchPrefix(requests, limitUsd, spentUsd) {
+    if (limitUsd === undefined)
+        return requests.length;
+    let projected = spentUsd;
+    let n = 0;
+    for (const r of requests) {
+        projected += estimateRequestCostUsd(r);
+        if (projected > limitUsd + USD_EPSILON)
+            break;
+        n++;
+    }
+    return n;
+}

package/dist/review/chunks.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Chunk planning for large PRs.
+ *
+ * A diff over the per-call token target is reviewed in several model calls
+ * instead of one oversized (or truncated) prompt. Files are grouped by
+ * directory so a chunk reads as one area of the change, and a single patch
+ * larger than the target is split at hunk boundaries. Every chunk records
+ * which files it carries so a partial review can say what it did not cover.
+ */
+export declare const CHUNK_TOKEN_TARGET = 6000;
+export interface ChunkFile {
+    filename: string;
+    patch?: string;
+}
+export interface PlannedChunk {
+    /** Prompt text for this chunk. */
+    text: string;
+    /** Files with content in this chunk (a split file appears in each part). */
+    files: string[];
+}
+export declare function planChunks(files: ChunkFile[], contexts?: Record<string, string>, targetTokens?: number): PlannedChunk[];

package/dist/review/chunks.js

@@ -0,0 +1,96 @@
+/**
+ * Chunk planning for large PRs.
+ *
+ * A diff over the per-call token target is reviewed in several model calls
+ * instead of one oversized (or truncated) prompt. Files are grouped by
+ * directory so a chunk reads as one area of the change, and a single patch
+ * larger than the target is split at hunk boundaries. Every chunk records
+ * which files it carries so a partial review can say what it did not cover.
+ */
+export const CHUNK_TOKEN_TARGET = 6000;
+const CHUNK_FILE_OVERHEAD = 100;
+const tokensOf = (s) => Math.ceil(s.length / 4);
+function dirOf(filename) {
+    const i = filename.lastIndexOf('/');
+    return i < 0 ? '' : filename.slice(0, i);
+}
+/** Stable group-by-directory; groups keep first-appearance order. */
+function groupByDir(files) {
+    const groups = new Map();
+    for (const f of files) {
+        const d = dirOf(f.filename);
+        const g = groups.get(d);
+        if (g === undefined)
+            groups.set(d, [f]);
+        else
+            g.push(f);
+    }
+    return [...groups.values()].flat();
+}
+/** Split a patch at `@@` hunk starts into parts that each fit `budgetTokens`. */
+function splitPatch(patch, budgetTokens) {
+    const firstHunk = patch.search(/^@@/m);
+    if (firstHunk < 0)
+        return [patch];
+    const header = patch.slice(0, firstHunk);
+    const hunks = patch.slice(firstHunk).split(/^(?=@@)/m);
+    const parts = [];
+    let cur = header;
+    for (const h of hunks) {
+        if (cur !== header && tokensOf(cur) + tokensOf(h) > budgetTokens) {
+            parts.push(cur);
+            cur = header;
+        }
+        cur += h;
+    }
+    if (cur !== header)
+        parts.push(cur);
+    return parts;
+}
+export function planChunks(files, contexts = {}, targetTokens = CHUNK_TOKEN_TARGET) {
+    const units = [];
+    for (const f of groupByDir(files)) {
+        const patch = f.patch ?? '';
+        const ctxBlock = contexts[f.filename];
+        const ctxTokens = ctxBlock === undefined ? 0 : tokensOf(ctxBlock);
+        const section = (label, body) => {
+            const head = ctxBlock === undefined ? `### ${label}` : `### ${label}\n${ctxBlock}`;
+            return `${head}\n\`\`\`diff\n${body}\n\`\`\``;
+        };
+        const whole = tokensOf(patch) + ctxTokens + CHUNK_FILE_OVERHEAD;
+        if (whole <= targetTokens) {
+            units.push({ filename: f.filename, text: section(f.filename, patch), tokens: whole });
+            continue;
+        }
+        const parts = splitPatch(patch, Math.max(1, targetTokens - ctxTokens - CHUNK_FILE_OVERHEAD));
+        parts.forEach((p, i) => {
+            const label = parts.length > 1 ? `${f.filename} (part ${i + 1}/${parts.length})` : f.filename;
+            units.push({
+                filename: f.filename,
+                text: section(label, p),
+                tokens: tokensOf(p) + ctxTokens + CHUNK_FILE_OVERHEAD,
+            });
+        });
+    }
+    const chunks = [];
+    let cur = [];
+    let curTokens = 0;
+    const flush = () => {
+        if (cur.length === 0)
+            return;
+        chunks.push({
+            text: cur.map((u) => u.text).join('\n\n'),
+            files: [...new Set(cur.map((u) => u.filename))],
+        });
+        cur = [];
+        curTokens = 0;
+    };
+    for (const u of units) {
+        if (cur.length > 0 && curTokens + u.tokens > targetTokens)
+            flush();
+        cur.push(u);
+        curTokens += u.tokens;
+    }
+    flush();
+    return chunks;
+}

package/dist/vision/openrouter.d.ts

@@ -18,6 +18,24 @@ export interface JsonSchema {
     schema: Record<string, unknown>;
     strict?: boolean;
 }
+/** One request inside an async batch; `customId` maps the result back. */
+export interface BatchRequest {
+    customId: string;
+    messages: Message[];
+    schema?: JsonSchema;
+    provider?: ProviderRules;
+}
+/** Exactly one of `result` / `error` is set. */
+export interface BatchItemResult {
+    customId: string;
+    result?: {
+        id: string;
+        content: string;
+        cost: CallCost;
+        model: string;
+    };
+    error?: string;
+}
 export interface OpenRouterClientOptions {
     apiKey: string;
     fetch?: typeof fetch;
@@ -48,7 +66,7 @@ export declare class OpenRouterClient {
     private _fetch;
     private _timeoutMs;
     private _trace;
-    private _headers;
+    private _extraHeaders;
     private _onCall;
     constructor(opts: OpenRouterClientOptions);
     private _request;
@@ -65,9 +83,27 @@ export declare class OpenRouterClient {
         cost: CallCost;
         model: string;
     }>;
+    /**
+     * Async Batch API: submit every request in one POST, poll until a terminal
+     * status, and map the inline results back by `custom_id`. Throws when the
+     * batch fails/expires/cancels or the poll deadline passes — callers fall
+     * back to realtime. A per-request error is returned, not thrown.
+     * `endpoint` and `model` are serialized before `requests`.
+     */
+    completeBatch(opts: {
+        /** Base slug; a trailing `:batch` variant suffix is stripped. */
+        model: string;
+        requests: BatchRequest[];
+        kind?: CallKind;
+        pollIntervalMs?: number;
+        /** Total time to wait for a terminal status before throwing. */
+        deadlineMs: number;
+    }): Promise<BatchItemResult[]>;
     reconcile(id: string): Promise<{
         costUsd: number;
     }>;
+    private _buildBody;
+    private _requestHeaders;
     private _tryComplete;
     private _toApiMessages;
     private _extractContent;

package/dist/vision/openrouter.js

@@ -7,12 +7,15 @@ import { makeCallCost } from './cost.js';
  * review job for 90+ minutes on one socket.
  */
 const REQUEST_TIMEOUT_MS = 120_000;
+const BATCH_TERMINAL = new Set(['completed', 'failed', 'expired', 'cancelled']);
+/** Default poll cadence; a real batch probe took about six minutes. */
+const BATCH_POLL_INTERVAL_MS = 10_000;
 export class OpenRouterClient {
     _apiKey;
     _fetch;
     _timeoutMs;
     _trace;
-    _headers;
+    _extraHeaders;
     _onCall;
     constructor(opts) {
         if (!opts.apiKey) {
@@ -22,7 +25,7 @@ export class OpenRouterClient {
         this._fetch = opts.fetch ?? globalThis.fetch;
         this._timeoutMs = opts.timeoutMs ?? REQUEST_TIMEOUT_MS;
         this._trace = opts.trace;
-        this._headers = opts.headers;
+        this._extraHeaders = opts.headers;
         this._onCall = opts.onCall;
     }
     _request(url, init) {
@@ -80,6 +83,97 @@ export class OpenRouterClient {
         }
         throw new Error(`${prefix}: ${errors.map((e) => e.message).join('; ')}`);
     }
+    /**
+     * Async Batch API: submit every request in one POST, poll until a terminal
+     * status, and map the inline results back by `custom_id`. Throws when the
+     * batch fails/expires/cancels or the poll deadline passes — callers fall
+     * back to realtime. A per-request error is returned, not thrown.
+     * `endpoint` and `model` are serialized before `requests`.
+     */
+    async completeBatch(opts) {
+        const kind = opts.kind ?? 'code';
+        const model = opts.model.replace(/:batch$/, '');
+        const submit = {
+            endpoint: '/v1/chat/completions',
+            model,
+            requests: opts.requests.map((r) => ({
+                custom_id: r.customId,
+                body: this._buildBody({
+                    model,
+                    messages: r.messages,
+                    ...(r.schema !== undefined ? { schema: r.schema } : {}),
+                    ...(r.provider !== undefined ? { provider: r.provider } : {}),
+                }),
+            })),
+        };
+        const started = Date.now();
+        const post = await this._request('https://openrouter.ai/api/v1/batches', {
+            method: 'POST',
+            headers: this._requestHeaders(),
+            body: JSON.stringify(submit),
+        });
+        if (!post.ok) {
+            throw (classifyHttpStatus(post.status, post.headers) ??
+                new Error(`OpenRouter batch submit failed: ${post.status} ${post.statusText}`));
+        }
+        let batch = unwrapBatch(await post.json());
+        const id = batch.id;
+        if (typeof id !== 'string' || id === '')
+            throw new Error('OpenRouter batch submit returned no id');
+        const interval = opts.pollIntervalMs ?? BATCH_POLL_INTERVAL_MS;
+        while (!BATCH_TERMINAL.has(String(batch.status))) {
+            if (Date.now() - started + interval > opts.deadlineMs) {
+                throw new Error(`OpenRouter batch ${id} not finished at the ${Math.round(opts.deadlineMs / 1000)}s poll deadline (status ${String(batch.status)})`);
+            }
+            await new Promise((r) => setTimeout(r, interval));
+            const res = await this._request(`https://openrouter.ai/api/v1/batches/${encodeURIComponent(id)}`, {
+                method: 'GET',
+                headers: this._requestHeaders(),
+            });
+            if (!res.ok) {
+                throw (classifyHttpStatus(res.status, res.headers) ??
+                    new Error(`OpenRouter batch poll failed: ${res.status} ${res.statusText}`));
+            }
+            batch = unwrapBatch(await res.json());
+        }
+        if (batch.status !== 'completed') {
+            throw new Error(`OpenRouter batch ${id} ended ${String(batch.status)}`);
+        }
+        const byId = new Map();
+        for (const row of Array.isArray(batch.results) ? batch.results : []) {
+            const r = row;
+            if (typeof r.custom_id === 'string')
+                byId.set(r.custom_id, r);
+        }
+        return opts.requests.map((req) => {
+            const row = byId.get(req.customId);
+            if (row === undefined)
+                return { customId: req.customId, error: 'no result returned for request' };
+            if (row.error !== undefined && row.error !== null) {
+                const e = row.error;
+                return { customId: req.customId, error: typeof e.message === 'string' ? e.message : JSON.stringify(row.error) };
+            }
+            // Tolerate both a bare completion and a {status_code, body} envelope.
+            const raw = row.response;
+            const response = (raw?.body !== undefined && typeof raw.body === 'object' ? raw.body : raw);
+            if (response === undefined || response.usage === undefined || !Array.isArray(response.choices)) {
+                return { customId: req.customId, error: 'malformed batch response' };
+            }
+            const cost = makeCallCost(response, kind);
+            this._onCall?.({
+                id: response.id,
+                model: response.model,
+                kind,
+                costUsd: cost.costUsd,
+                tokens: cost.tokens,
+                ...(this._trace ? { trace: this._trace } : {}),
+            });
+            return {
+                customId: req.customId,
+                result: { id: response.id, content: this._extractContent(response), cost, model: response.model },
+            };
+        });
+    }
     async reconcile(id) {
         const res = await this._request(`https://openrouter.ai/api/v1/generation?id=${encodeURIComponent(id)}`, {
             method: 'GET',
@@ -92,7 +186,7 @@ export class OpenRouterClient {
         const total = data.data?.total_cost ?? data.total_cost ?? 0;
         return { costUsd: total };
     }
-    async _tryComplete(req) {
+    _buildBody(req) {
         const body = {
             model: req.model,
             messages: this._toApiMessages(req.messages),
@@ -116,13 +210,20 @@ export class OpenRouterClient {
         if (this._trace) {
             body.trace = this._trace;
         }
-        const headers = {
+        return body;
+    }
+    _requestHeaders() {
+        return {
             Authorization: `Bearer ${this._apiKey}`,
             'Content-Type': 'application/json',
             'X-Title': 'argus-reviewer',
             'X-OpenRouter-Metadata': 'enabled',
-            ...(this._headers ?? {}),
+            ...(this._extraHeaders ?? {}),
         };
+    }
+    async _tryComplete(req) {
+        const body = this._buildBody(req);
+        const headers = this._requestHeaders();
         const res = await this._request('https://openrouter.ai/api/v1/chat/completions', {
             method: 'POST',
             headers,
@@ -158,3 +259,8 @@ export class OpenRouterClient {
         return '';
     }
 }
+function unwrapBatch(json) {
+    const o = (json ?? {});
+    const inner = o.data !== undefined && typeof o.data === 'object' && o.data !== null ? o.data : o;
+    return inner;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "argus-reviewer-e2e",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "argus-reviewer — open-source vision-model E2E testing harness. Record, replay, heal, and assert with any OpenRouter model under a hard budget cap.",
   "type": "module",
   "license": "MIT",
@@ -36,6 +36,7 @@
     "build": "tsc -p tsconfig.build.json",
     "check:dist": "test -z \"$(git status --porcelain -- dist/)\" && test -z \"$(git ls-files --others --ignored --exclude-standard -- dist/)\"",
     "test": "vitest run",
+    "test:tmp-leaks": "node scripts/check-tmp-leaks.mjs",
     "test:watch": "vitest",
     "lint": "eslint .",
     "format": "prettier --write .",