auriga-cli 1.20.4 → 1.20.6

package/README.md

@@ -11,7 +11,7 @@ This repo itself is a fully configured harness project. You can clone it to see
 | Module | Description |
 |---|---|
 | **Workflow** | `CLAUDE.md` auriga workflow: requirement clarification -> TDD -> Review, Harness principles, Subagent usage guide |
-| **Skills** | External development process skills — brainstorming, systematic-debugging, TDD, verification, planning, playwright |
+| **Skills** | External development process skills — systematic-debugging, TDD, verification, planning, playwright (spec authoring ships as the `spec-design` skill inside the `auriga-workflow-skills` plugin) |
 | **Recommended Skills** | Optional utility skills (e.g. `codex-agent`, `claude-code-agent`) you can add on top of the workflow skills |
 | **Plugins** | Recommended Claude Code and Codex plugins — skill-creator, claude-md-management, codex, auriga-go, auriga-git-guards, auriga-workflow-skills, auriga-notify, session-instructions-loader, deep-review |
 | **Hooks** | Legacy Claude Code hook installer. No repo-owned hooks are currently exposed here; `notify` ships as the `auriga-notify` plugin. |
@@ -96,7 +96,6 @@ Installs selected skills via `npx skills add`, targeting both Claude Code and Co
 
 | Skill | Source | Description |
 |---|---|---|
-| brainstorming | [obra/superpowers](https://github.com/obra/superpowers) | Requirement clarification and design exploration |
 | systematic-debugging | [obra/superpowers](https://github.com/obra/superpowers) | Systematic debugging — find root cause before fixing |
 | test-driven-development | [obra/superpowers](https://github.com/obra/superpowers) | Test-driven development workflow |
 | verification-before-completion | [obra/superpowers](https://github.com/obra/superpowers) | Pre-completion verification — evidence before assertions |
@@ -120,7 +119,7 @@ Supports both project and global installation scopes.
 
 ### Plugins
 
-Installs selected plugins for Claude Code, Codex, or both. Claude Code uses `claude plugins install` and honors `--scope project|user`; Codex uses `codex plugin marketplace add` and enables selected plugins in `~/.codex/config.toml`.
+Installs selected plugins for Claude Code, Codex, or both. Claude Code uses `claude plugins install` and honors `--scope project|user`; Codex uses `codex plugin marketplace add/upgrade` (the right one is picked by reading `~/.codex/config.toml`) and enables selected plugins in `~/.codex/config.toml`.
 
 Examples:
 
@@ -139,7 +138,7 @@ npx -y auriga-cli install plugins --agent both --plugin auriga-git-guards
 | codex | Claude Code | Codex cross-model collaboration |
 | auriga-go | Claude Code / Codex | Workflow autopilot for the auriga workflow. Reminder-based navigation across the `CLAUDE.md` phases. Bundles two skills: `auriga-go` (description-based NL trigger + `/auriga-go`) and `/goalify` (plans an autonomous goal from a spec or work-in-progress and dispatches it via Claude Code's built-in `/goal` command). |
 | auriga-git-guards | Claude Code / Codex | Three git-lifecycle guardrails plus the bundled `git-workflow` skill. Hooks: `commit-reminder` (PostToolUse on `Edit` / `Write` / `MultiEdit` in Claude Code and on `apply_patch` — Codex's canonical file-edit `tool_name` — so it fires in both runtimes → when uncommitted diff vs `HEAD` exceeds 200 lines or 8 files and the last reminder was ≥ 60 s ago, inject a nudge to commit at the next semantic boundary), `pr-create-guard` (PostToolUse on `gh pr create` → fetch the new PR's body via `gh pr view` and inject headings + TODO counts as `additionalContext` so the Agent can self-verify the five-element PR description: scope / acceptance criteria / design decisions / risks / remaining TODOs), and `pr-ready-guard` (PreToolUse on `gh pr ready` → block on stray planning docs at `findings.md` / `progress.md` / `task_plan.md` / `docs/superpowers/specs/*.md`, unfinalized active specs in `docs/specs/*.md`, or unpushed commits; otherwise inject the body snapshot). The two PostToolUse hooks reach full Claude Code / Codex parity; Codex currently fails open on `pr-ready-guard`'s PreToolUse `additionalContext` informational path (block path identical). |
-| auriga-workflow-skills | Claude Code / Codex | Bundles the auriga-owned workflow execution skills: `incremental-impl`, `test-designer`, and `session-compound`. Installed by default through the plugin path instead of `install skills`. |
+| auriga-workflow-skills | Claude Code / Codex | Bundles the auriga-owned workflow execution skills: `incremental-impl`, `test-designer`, `session-compound`, and `spec-design`. Installed by default through the plugin path instead of `install skills`. |
 | auriga-notify *(opt-in)* | Claude Code | macOS native notification plugin for Claude Code `Notification` events. Focus-aware sound-only mode, click-to-activate, per-project notification grouping, and migrated `config.json` / `icon.png` support. Not installed by `install --all`; install explicitly with `install plugins --plugin auriga-notify`. |
 | session-instructions-loader | Codex | Codex-only SessionStart plugin that injects ancestor `AGENTS.md` files plus repo-configured extra instruction files. |
 | deep-review | Claude Code / Codex | Multi-dimensional PR review orchestrator — dispatches parallel reviewers (spec-conformance, correctness, test-quality, docs-sync, plus conditional robustness/UX/performance/structure/code-quality/skill-plugin-quality) and synthesizes findings into an actionable punch list. Bundles a companion `reviewer-creator` skill for scaffolding project-level custom reviewers under `docs/rules/review/`. Drives the formal-review phase in `CLAUDE.md`. |

package/README.zh-CN.md

@@ -11,7 +11,7 @@
 | 模块 | 说明 |
 |---|---|
 | **Workflow** | `CLAUDE.md` 里的 auriga 工作流：需求澄清 → TDD → Review，Harness 原则，Subagent 使用指南 |
-| **Skills** | 外部开发流程 skills —— brainstorming、systematic-debugging、TDD、verification、planning、playwright |
+| **Skills** | 外部开发流程 skills —— systematic-debugging、TDD、verification、planning、playwright（spec 撰写由 `auriga-workflow-skills` 插件内的 `spec-design` skill 提供）|
 | **Recommended Skills** | 可选的工具类 skills（如 `codex-agent`、`claude-code-agent`），在 workflow skills 之外按需追加 |
 | **Plugins** | 推荐的 Claude Code 和 Codex 插件 —— skill-creator、claude-md-management、codex、auriga-go、auriga-git-guards、auriga-workflow-skills、auriga-notify、session-instructions-loader、deep-review |
 | **Hooks** | 传统 Claude Code hook 安装器。目前没有仓库自维护 hook 暴露在这里；`notify` 已迁移为 `auriga-notify` 插件。 |
@@ -96,7 +96,6 @@ npx auriga-cli
 
 | Skill | 来源 | 说明 |
 |---|---|---|
-| brainstorming | [obra/superpowers](https://github.com/obra/superpowers) | 需求澄清与设计探索 |
 | systematic-debugging | [obra/superpowers](https://github.com/obra/superpowers) | 系统化调试，先找根因再修复 |
 | test-driven-development | [obra/superpowers](https://github.com/obra/superpowers) | 测试驱动开发流程 |
 | verification-before-completion | [obra/superpowers](https://github.com/obra/superpowers) | 完成前验证，用证据说话 |
@@ -120,7 +119,7 @@ npx auriga-cli
 
 ### Plugins
 
-可以把选中的插件安装到 Claude Code、Codex 或两者都装。Claude Code 路径使用 `claude plugins install`，并遵守 `--scope project|user`；Codex 路径使用 `codex plugin marketplace add`，并在 `~/.codex/config.toml` 里启用选中的插件。
+可以把选中的插件安装到 Claude Code、Codex 或两者都装。Claude Code 路径使用 `claude plugins install`，并遵守 `--scope project|user`；Codex 路径根据 `~/.codex/config.toml` 中是否已注册同名 marketplace 自动选择 `codex plugin marketplace add` 或 `upgrade`，并在 `~/.codex/config.toml` 里启用选中的插件。
 
 示例：
 
@@ -139,7 +138,7 @@ npx -y auriga-cli install plugins --agent both --plugin auriga-git-guards
 | codex | Claude Code | Codex 跨模型协作 |
 | auriga-go | Claude Code / Codex | auriga 工作流的自动驾驶：按 `CLAUDE.md` 的 phase 做 reminder-based 导航。内置两个 skill：`auriga-go`（按 description 的自然语言触发 + `/auriga-go` slash command）和 `/goalify`（根据 spec 或当前进展 plan 出 goal，并通过 Claude Code 内置的 `/goal` 命令分发执行）。 |
 | auriga-git-guards | Claude Code / Codex | 三个 git-lifecycle guardrail + 内置 `git-workflow` skill。Hooks：`commit-reminder`（Claude Code 下 PostToolUse 匹配 `Edit` / `Write` / `MultiEdit`，Codex 下匹配 `apply_patch`（Codex 文件编辑 canonical `tool_name`），两个 runtime 都触发 —— 未提交 diff 对比 `HEAD` 超过 200 行或 8 个文件，且距上次提醒 ≥ 60 s 时，注入提醒让 Agent 在下一个语义边界 commit）、`pr-create-guard`（`gh pr create` 的 PostToolUse —— 通过 `gh pr view` 拉真实 PR body，扫 `^##` / `^###` headings 并统计 `- [ ]` / `- [x]` 注入 `additionalContext`，让 Agent 对照五要素：scope / acceptance criteria / design decisions / risks / remaining TODOs）、`pr-ready-guard`（`gh pr ready` 的 PreToolUse —— 仅按结构信号拦截：游离 `findings.md` / `progress.md` / `task_plan.md` / `docs/superpowers/specs/*.md`、`docs/specs/*.md` 内未结案的活跃 spec、未 push commits；放行时注入 body 快照）。两个 PostToolUse hook 在 Claude Code / Codex 上完全对齐；Codex 仅对 `pr-ready-guard` 的 PreToolUse `additionalContext` 信息路径 fail-open（block 路径两边一致）。 |
-| auriga-workflow-skills | Claude Code / Codex | 打包 auriga 自维护的工作流执行 skills：`incremental-impl`、`test-designer`、`session-compound`。默认通过插件路径安装，不再通过 `install skills` 作为独立条目安装。 |
+| auriga-workflow-skills | Claude Code / Codex | 打包 auriga 自维护的工作流执行 skills：`incremental-impl`、`test-designer`、`session-compound`、`spec-design`。默认通过插件路径安装，不再通过 `install skills` 作为独立条目安装。 |
 | auriga-notify *(opt-in)* | Claude Code | Claude Code `Notification` 事件的 macOS 原生通知插件。支持焦点感知仅提示音、点击唤起终端、按项目分组通知，并迁移旧 `config.json` / `icon.png`。不随 `install --all` 默认安装，需要显式执行 `install plugins --plugin auriga-notify`。 |
 | session-instructions-loader | Codex | Codex-only SessionStart 插件，注入上层目录的 `AGENTS.md` 和仓库配置的额外 instruction 文件。 |
 | deep-review | Claude Code / Codex | 多维度 PR review 编排器 —— 并行派发各维度 reviewer（spec-conformance、correctness、test-quality、docs-sync，以及条件触发的 robustness/UX/performance/structure/code-quality/skill-plugin-quality），汇总成 punch list。同包内打包了 `reviewer-creator` skill，用于在 `docs/rules/review/` 下生成项目级自定义 reviewer。承担 `CLAUDE.md` 中的正式评审职责。 |

package/dist/catalog.json

@@ -1,10 +1,6 @@
 {
-  "generatedAt": "2026-05-14T14:34:30.876Z",
+  "generatedAt": "2026-05-15T08:06:41.771Z",
   "workflowSkills": [
-    {
-      "name": "brainstorming",
-      "description": "You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation."
-    },
     {
       "name": "planning-with-files",
       "description": "Implements Manus-style file-based planning to organize and track progress on complex tasks. Creates task_plan.md, findings.md, and progress.md. Use when asked to plan out, break down, or organize a multi-step project, research task, or any work requiring 5+ tool calls. Supports automatic session recovery after /clear."
@@ -79,7 +75,7 @@
     },
     {
       "name": "auriga-workflow-skills",
-      "description": "(Claude/Codex) Bundles the auriga-owned workflow execution skills: incremental-impl, test-designer, and session-compound. Dual-Agent compatible (Claude Code + Codex).",
+      "description": "(Claude/Codex) Bundles the auriga-owned workflow execution skills: incremental-impl, test-designer, session-compound, and spec-design. Dual-Agent compatible (Claude Code + Codex).",
       "agents": [
         "claude",
         "codex"

package/dist/cli.js

@@ -800,7 +800,7 @@ async function runLegacyMenu() {
         message: "Select module types to install:",
         choices: [
             { name: "Workflow — CLAUDE.md + AGENTS.md", value: "workflow", checked: true },
-            { name: "Skills — Development process skills (brainstorming, TDD, debugging...)", value: "skills", checked: true },
+            { name: "Skills — Development process skills (TDD, debugging, verification, planning...)", value: "skills", checked: true },
             { name: "Recommended Skills — Extra utility skills (claude-code-agent, codex-agent...)", value: "recommended", checked: true },
             { name: "Plugins — Claude Code / Codex plugins (skill-creator, codex, auriga-go...)", value: "plugins", checked: true },
             { name: "Hooks — Claude Code hooks (notifications, etc.)", value: "hooks", checked: true },

package/dist/guide.js

@@ -68,7 +68,7 @@ the legacy hooks category is currently empty; recommended skills are NOT include
 
 Targeted — single category, picking from the catalog surfaced in Step 2:
   ${cmd("npx -y auriga-cli install workflow --lang en")}
-  ${cmd("npx -y auriga-cli install skills --skill brainstorming test-driven-development")}
+  ${cmd("npx -y auriga-cli install skills --skill systematic-debugging test-driven-development")}
   ${cmd("npx -y auriga-cli install plugins --plugin skill-creator codex --scope user")}
   ${cmd("npx -y auriga-cli install plugins --agent codex --plugin session-instructions-loader")}
 

package/dist/plugins.js

@@ -422,18 +422,30 @@ function runPostInstallMigration(pluginName, opts, runtimes) {
         migrateLegacyNotifyConfig(opts);
     }
 }
-function codexMarketplaceAddCommand(packageRoot) {
-    if (process.env.DEV === "1") {
-        return `codex plugin marketplace add ${shellQuote(packageRoot)}`;
-    }
-    return "codex plugin marketplace add https://github.com/Ben2pc/auriga-cli.git";
+// Source string Codex CLI records in `~/.codex/config.toml`
+// `[marketplaces.<name>].source` after `marketplace add` succeeds. Used for
+// exact-string compare against the registered marketplace's source to detect
+// same-name-different-source hijack attempts before running `upgrade`.
+function codexLocalMarketplaceSource(packageRoot) {
+    if (process.env.DEV === "1")
+        return packageRoot;
+    return "https://github.com/Ben2pc/auriga-cli.git";
 }
-function codexExternalMarketplaceAddCommand(source) {
+function codexExternalMarketplaceSource(source) {
     // `source` is validated by validateExtraPluginConfigs against
     // MARKETPLACE_SOURCE_RE (alphanumerics + `._/-`) — no shell metachars
-    // can reach this string. URL form deliberately mirrors
-    // codexMarketplaceAddCommand's hardcoded production branch.
-    return `codex plugin marketplace add https://github.com/${source}.git`;
+    // can reach this string.
+    return `https://github.com/${source}.git`;
+}
+function codexMarketplaceAddCommand(packageRoot) {
+    const source = codexLocalMarketplaceSource(packageRoot);
+    // DEV-mode local paths may contain spaces; URLs need no shell quoting.
+    return process.env.DEV === "1"
+        ? `codex plugin marketplace add ${shellQuote(source)}`
+        : `codex plugin marketplace add ${source}`;
+}
+function codexExternalMarketplaceAddCommand(source) {
+    return `codex plugin marketplace add ${codexExternalMarketplaceSource(source)}`;
 }
 function codexMarketplaceUpgradeCommand(marketplaceName) {
     return `codex plugin marketplace upgrade ${shellQuote(marketplaceName)}`;
@@ -449,13 +461,36 @@ function commandErrorText(error) {
         parts.push(String(withOutput.stderr));
     return parts.join("\n");
 }
-function escapeRegex(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function isCodexMarketplaceAlreadyAdded(error, marketplaceName) {
-    const text = commandErrorText(error);
-    const marketplacePattern = new RegExp(`marketplace ['"]?${escapeRegex(marketplaceName)}['"]? is already added`, "i");
-    return marketplacePattern.test(text);
+// Codex CLI records every added marketplace as `[marketplaces.<name>]` in
+// `~/.codex/config.toml` with a `source` field. Returns that stored source
+// for an exact-string compare against the source we would `add`, or null
+// when the marketplace isn't registered or the entry is malformed.
+//
+// Why config.toml is the authoritative signal: Codex's `add` command is
+// silently idempotent for an already-added marketplace (exit 0, prints to
+// stdout, no error), so we can't detect already-added by catching an
+// `add` failure. The stored source also lets us guard against same-name
+// hijack — a fork registered under our marketplace name would be invisible
+// to a presence-only check.
+function readCodexMarketplaceSource(marketplaceName) {
+    const configPath = path.join(codexHome(), "config.toml");
+    if (!fs.existsSync(configPath))
+        return null;
+    try {
+        const parsed = parseToml(fs.readFileSync(configPath, "utf-8"));
+        const marketplaces = parsed.marketplaces;
+        if (typeof marketplaces !== "object" || marketplaces === null || Array.isArray(marketplaces)) {
+            return null;
+        }
+        const entry = marketplaces[marketplaceName];
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+            return null;
+        const source = entry.source;
+        return typeof source === "string" ? source : null;
+    }
+    catch {
+        return null;
+    }
 }
 function isCodexMarketplaceDifferentSource(error) {
     return /already added from a different source/i.test(commandErrorText(error));
@@ -616,34 +651,45 @@ function enableCodexPluginConfig(configPath, pluginKeys, needsPluginHooks) {
     const content = minimalContent ?? buildCodexPluginConfigToml(originalContent, configPath, pluginKeys, needsPluginHooks);
     atomicWriteFile(configPath, content.endsWith("\n") ? content : `${content}\n`);
 }
-async function addCodexMarketplaceWithRetry(marketplaceName, addCommand, opts, marketplaceExecOpts, failures) {
+async function addCodexMarketplaceWithRetry(marketplaceName, addCommand, expectedSource, opts, marketplaceExecOpts, failures) {
+    const registeredSource = readCodexMarketplaceSource(marketplaceName);
+    if (registeredSource !== null) {
+        if (registeredSource !== expectedSource) {
+            // Supply-chain guard: a same-name marketplace pointing at a different
+            // source (e.g. a fork URL) must not be silently `upgrade`d — its
+            // content would be cached under our name and consumed downstream.
+            const msg = `Codex marketplace ${marketplaceName} is already added from a different source`;
+            log.error(`${msg}\n  registered: ${registeredSource}\n  expected:   ${expectedSource}`);
+            failures.push(msg);
+            return;
+        }
+        try {
+            exec(codexMarketplaceUpgradeCommand(marketplaceName), marketplaceExecOpts);
+            log.ok(`Codex marketplace ${marketplaceName} upgraded`);
+        }
+        catch (e) {
+            // Surface the underlying upgrade error so a 6-month-out reader
+            // can tell apart ENOENT / network / auth / git failures.
+            log.error(`Failed to upgrade Codex marketplace: ${marketplaceName}\n${commandErrorText(e)}`);
+            failures.push(`codex marketplace ${marketplaceName}`);
+        }
+        return;
+    }
     try {
         exec(addCommand, marketplaceExecOpts);
         log.ok(`Codex marketplace ${marketplaceName} added`);
-        return;
     }
     catch (e) {
         if (isCodexMarketplaceDifferentSource(e)) {
+            // Defense-in-depth: config.toml didn't claim the name but Codex CLI
+            // refused with "different source" — rare divergence between Codex
+            // internal state and config.toml.
             const msg = `Codex marketplace ${marketplaceName} is already added from a different source`;
             log.error(`${msg}\n${commandErrorText(e)}`);
             failures.push(msg);
             return;
         }
-        if (isCodexMarketplaceAlreadyAdded(e, marketplaceName)) {
-            try {
-                exec(codexMarketplaceUpgradeCommand(marketplaceName), marketplaceExecOpts);
-                log.ok(`Codex marketplace ${marketplaceName} upgraded`);
-                return;
-            }
-            catch (upgradeErr) {
-                // Surface the underlying upgrade error so a 6-month-out reader
-                // can tell apart ENOENT / network / auth / git failures.
-                log.error(`Failed to upgrade Codex marketplace: ${marketplaceName}\n${commandErrorText(upgradeErr)}`);
-                failures.push(`codex marketplace ${marketplaceName}`);
-                return;
-            }
-        }
-        // Same: surface the add error rather than masking ENOENT / network / auth.
+        // Surface the add error rather than masking ENOENT / network / auth.
         log.error(`Failed to add Codex marketplace: ${marketplaceName}\n${commandErrorText(e)}`);
         failures.push(`codex marketplace ${marketplaceName}`);
     }
@@ -726,7 +772,7 @@ async function installCodexPlugins(packageRoot, opts) {
         ? { inherit: true }
         : undefined;
     if (localMarketplace) {
-        await addCodexMarketplaceWithRetry(localMarketplace.name, codexMarketplaceAddCommand(packageRoot), opts, marketplaceExecOpts, failures);
+        await addCodexMarketplaceWithRetry(localMarketplace.name, codexMarketplaceAddCommand(packageRoot), codexLocalMarketplaceSource(packageRoot), opts, marketplaceExecOpts, failures);
     }
     // Dedupe external marketplaces by name — multiple plugins from the same
     // upstream share a single `marketplace add` call.
@@ -735,7 +781,7 @@ async function installCodexPlugins(packageRoot, opts) {
         uniqueExternalMarketplaces.set(p.marketplace.name, p.marketplace);
     }
     for (const mp of uniqueExternalMarketplaces.values()) {
-        await addCodexMarketplaceWithRetry(mp.name, codexExternalMarketplaceAddCommand(mp.source), opts, marketplaceExecOpts, failures);
+        await addCodexMarketplaceWithRetry(mp.name, codexExternalMarketplaceAddCommand(mp.source), codexExternalMarketplaceSource(mp.source), opts, marketplaceExecOpts, failures);
     }
     if (failures.length === 0) {
         const localMarketplaceContentRoot = localMarketplace

package/dist/skills.js

@@ -7,7 +7,6 @@ import { atomicWriteFile, exec, execAsync, log, withEsc } from "./utils.js";
 // directly references. Anything else in skills-lock.json is surfaced via
 // installRecommendedSkills as an opt-in utility.
 export const WORKFLOW_SKILLS = [
-    "brainstorming",
     "planning-with-files",
     "playwright-cli",
     "systematic-debugging",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auriga-cli",
-  "version": "1.20.4",
+  "version": "1.20.6",
   "description": "Interactive CLI to install Claude Code harness modules (Workflow, Skills, Recommended Skills, Plugins, Hooks)",
   "license": "MIT",
   "repository": {
@@ -25,8 +25,8 @@
     "dev": "tsc --watch",
     "start": "node dist/cli.js",
     "pretest": "npm run build",
-    "test": "tsc -p tsconfig.test.json && DEV=1 node --test --experimental-test-module-mocks dist-test/tests/hooks.test.js dist-test/tests/hooks-uninstall.test.js dist-test/tests/skills.test.js dist-test/tests/skills-uninstall.test.js dist-test/tests/catalog.test.js dist-test/tests/cli-parse.test.js dist-test/tests/install-nontty.test.js dist-test/tests/plugins.test.js dist-test/tests/plugins-uninstall.test.js dist-test/tests/content-fetch.test.js dist-test/tests/utils.test.js dist-test/tests/guide.test.js dist-test/tests/validators.test.js dist-test/tests/entrypoint.test.js dist-test/tests/state.test.js dist-test/tests/server.test.js dist-test/tests/server-auth.test.js dist-test/tests/server-apply.test.js dist-test/tests/apply-handlers.test.js dist-test/tests/ui-fetch.test.js dist-test/tests/workflow-install.test.js dist-test/tests/workflow-uninstall.test.js dist-test/tests/tarball-shape.test.js",
-    "test:watch": "tsc -p tsconfig.test.json --watch & node --test --watch --experimental-test-module-mocks dist-test/tests/hooks.test.js dist-test/tests/hooks-uninstall.test.js dist-test/tests/skills.test.js dist-test/tests/skills-uninstall.test.js dist-test/tests/catalog.test.js dist-test/tests/cli-parse.test.js dist-test/tests/install-nontty.test.js dist-test/tests/plugins.test.js dist-test/tests/plugins-uninstall.test.js dist-test/tests/content-fetch.test.js dist-test/tests/utils.test.js dist-test/tests/guide.test.js dist-test/tests/validators.test.js dist-test/tests/entrypoint.test.js dist-test/tests/state.test.js dist-test/tests/server.test.js dist-test/tests/server-auth.test.js dist-test/tests/server-apply.test.js dist-test/tests/apply-handlers.test.js dist-test/tests/ui-fetch.test.js dist-test/tests/workflow-install.test.js dist-test/tests/workflow-uninstall.test.js dist-test/tests/tarball-shape.test.js",
+    "test": "tsc -p tsconfig.test.json && DEV=1 node --test --experimental-test-module-mocks dist-test/tests/hooks.test.js dist-test/tests/hooks-uninstall.test.js dist-test/tests/skills.test.js dist-test/tests/skills-uninstall.test.js dist-test/tests/catalog.test.js dist-test/tests/cli-parse.test.js dist-test/tests/install-nontty.test.js dist-test/tests/plugins.test.js dist-test/tests/plugins-uninstall.test.js dist-test/tests/content-fetch.test.js dist-test/tests/utils.test.js dist-test/tests/guide.test.js dist-test/tests/validators.test.js dist-test/tests/entrypoint.test.js dist-test/tests/state.test.js dist-test/tests/server.test.js dist-test/tests/server-auth.test.js dist-test/tests/server-apply.test.js dist-test/tests/apply-handlers.test.js dist-test/tests/ui-fetch.test.js dist-test/tests/workflow-install.test.js dist-test/tests/workflow-uninstall.test.js dist-test/tests/tarball-shape.test.js dist-test/tests/spec-design.test.js",
+    "test:watch": "tsc -p tsconfig.test.json --watch & node --test --watch --experimental-test-module-mocks dist-test/tests/hooks.test.js dist-test/tests/hooks-uninstall.test.js dist-test/tests/skills.test.js dist-test/tests/skills-uninstall.test.js dist-test/tests/catalog.test.js dist-test/tests/cli-parse.test.js dist-test/tests/install-nontty.test.js dist-test/tests/plugins.test.js dist-test/tests/plugins-uninstall.test.js dist-test/tests/content-fetch.test.js dist-test/tests/utils.test.js dist-test/tests/guide.test.js dist-test/tests/validators.test.js dist-test/tests/entrypoint.test.js dist-test/tests/state.test.js dist-test/tests/server.test.js dist-test/tests/server-auth.test.js dist-test/tests/server-apply.test.js dist-test/tests/apply-handlers.test.js dist-test/tests/ui-fetch.test.js dist-test/tests/workflow-install.test.js dist-test/tests/workflow-uninstall.test.js dist-test/tests/tarball-shape.test.js dist-test/tests/spec-design.test.js",
     "pretest:e2e": "npm run build",
     "test:e2e": "tsc -p tsconfig.test.json && node --test dist-test/tests/e2e-install.test.js",
     "pretest:web-ui-e2e": "npm run build && npm --prefix ui ci && npm --prefix ui run build",