axstack 0.31.0 → 0.33.0

package/skills/axstack/scripts/dispatch-plan.js

@@ -1,10 +1,11 @@
-import { readFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 
-const flags = ['--role', '--roles', '--capabilities', '--picker', '--kind', '--verify'];
+const flags = ['--role', '--roles', '--capabilities', '--picker', '--kind', '--verify', '--out'];
 const nonempty = (value) => typeof value === 'string' && value.trim().length > 0;
 const help = `Usage: bun dispatch-plan.js --role <id> --roles <roles.json>
   --capabilities <saved.json> --picker <picker.json> --kind task|launch
-  [--verify <configuration.json>]
+  [--verify <configuration.json>] [--out <report.json>]
+Example: bun dispatch-plan.js --role axstack-author --roles roles.json --capabilities capabilities.json --picker picker.json --kind launch
 
 --role          Role ID from the supplied snapshot
 --roles         Installed-style roles.json (version 1, roles array)
@@ -12,9 +13,13 @@ const help = `Usage: bun dispatch-plan.js --role <id> --roles <roles.json>
 --picker        Saved picker JSON; uses chosenInstanceId
 --kind          task emits target; launch emits modelSelection
 --verify        Compare t3_thread_configuration JSON; print MATCH or each mismatch
+--out           Write full JSON here and print input/path/omitted-count summary
 --help          Show all flags and exit codes
 
-Read-only: reads supplied JSON, spawns adjacent resolve-models.js, writes stdout/stderr.
+Read-only inputs: reads supplied JSON, spawns adjacent resolve-models.js, writes stdout/stderr.
+Writes only the caller's --out path when supplied; no retained state.
+Results name input paths. Plan output over 4096 bytes requires --out.
+Large verification retains its exit code, prints mismatches and advises --out on stderr.
 Never dispatches or changes snapshots. Reuse recorded exact model pins as given.
 Exit codes: 0 ok, 1 error, 2 hold (including incomplete read-back).
 `;
@@ -27,20 +32,23 @@ function argumentsFrom(args) {
   const options = {};
   for (let i = 0; i < args.length; i += 2) {
     const flag = args[i];
-    if (!flags.includes(flag)) throw new Error(`unexpected argument ${flag}`);
+    if (!flags.includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
     const value = args[i + 1];
-    if (!nonempty(value) || value.startsWith('--')) throw new Error(`expected value after ${flag}`);
-    if (flag in options) throw new Error(`duplicate argument ${flag}`);
+    if (!nonempty(value) || value.startsWith('--')) throw new Error(`expected value after ${flag}; pass ${flag} <value>`);
+    if (flag in options) throw new Error(`duplicate argument ${flag}; pass it once`);
     options[flag] = value;
   }
-  for (const flag of flags.filter((flag) => flag !== '--verify')) {
-    if (!options[flag]) throw new Error(`expected ${flag}`);
+  for (const flag of flags.filter((flag) => !['--verify', '--out'].includes(flag))) {
+    if (!options[flag]) throw new Error(`expected ${flag}; pass ${flag} <value>`);
   }
-  if (!['task', 'launch'].includes(options['--kind'])) throw new Error('expected --kind task|launch');
+  if (!['task', 'launch'].includes(options['--kind'])) throw new Error('expected --kind task|launch; pass --kind task or --kind launch');
   return options;
 }
 
-const readJSON = (path) => JSON.parse(readFileSync(path, 'utf8'));
+function readJSON(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); }
+  catch (error) { throw new Error(`${error.message}; pass a readable, valid JSON file: ${path}`); }
+}
 
 function normalizedOptions(options) {
   const entries = Array.isArray(options) ? options.map((option) => [option?.id, option?.value])
@@ -68,19 +76,36 @@ function verify(configuration, instanceId, provider, model, options) {
   compare('options', options, selection?.options,
     normalizedOptions(options) === normalizedOptions(selection?.options));
   compare('runtimeMode', 'full-access', configuration?.runtimeMode);
-  console.log(mismatches.length ? mismatches.join('\n') : 'MATCH');
-  return mismatches.length ? 2 : 0;
+  return mismatches;
 }
 
-function main() {
-  if (process.argv.slice(2).includes('--help')) {
-    process.stdout.write(help);
+function plan(argv, io) {
+  if (argv.includes('--help')) {
+    io.stdout(help);
     return 0;
   }
-  const args = argumentsFrom(process.argv.slice(2));
+  const args = argumentsFrom(argv);
+  const inputs = Object.fromEntries(Object.entries(args).filter(([flag]) => flag !== '--out').map(([flag, value]) => [flag.slice(2), value]));
+  const emit = (result) => {
+    const full = { inputs, ...result };
+    const inline = result.mismatches
+      ? `${JSON.stringify({ inputs })}\n${result.mismatches.join('\n') || 'MATCH'}\n` : `${JSON.stringify(full)}\n`;
+    if (!args['--out']) {
+      if (new TextEncoder().encode(inline).length > 4096) {
+        if (!result.mismatches) throw new Error('large output; pass --out <report.json> to save full JSON');
+        io.stderr('Large verification output; pass --out <path>.json for the full list\n');
+      }
+      io.stdout(inline);
+      return;
+    }
+    try { writeFileSync(args['--out'], `${JSON.stringify(full, null, 2)}\n`); }
+    catch (error) { throw new Error(`${error.message}; pass --out <writable report.json path>`); }
+    io.stdout(`${JSON.stringify({ inputs, reportPath: args['--out'],
+      omittedPayloadFields: Object.keys(result).length, omittedMismatches: result.mismatches?.length ?? 0 })}\n`);
+  };
   const snapshot = readJSON(args['--roles']);
   if (snapshot?.version !== 1 || !Array.isArray(snapshot.roles)) {
-    throw new Error('roles snapshot must have version 1 and a roles array');
+    throw new Error('roles snapshot must have version 1 and a roles array; pass --roles <valid roles.json>');
   }
   const roles = snapshot.roles.filter((role) => role?.id === args['--role']);
   if (roles.length !== 1) hold(`role ${args['--role']} unavailable or ambiguous`);
@@ -100,7 +125,7 @@ function main() {
   const resolved = Bun.spawnSync([process.execPath, `${import.meta.dir}/resolve-models.js`,
     '--provider', role.provider, '--capabilities', args['--capabilities'],
     '--effort', role.thinkingOptionId, ...modelArgs], { stdout: 'pipe', stderr: 'pipe' });
-  if (resolved.stderr.length) process.stderr.write(resolved.stderr);
+  if (resolved.stderr.length) io.stderr(resolved.stderr.toString());
   if (resolved.exitCode !== 0) return resolved.exitCode === 1 ? 2 : 1;
   const { model, effortOption, providerInstanceId } = JSON.parse(resolved.stdout.toString());
   const chosen = readJSON(args['--capabilities']).providers
@@ -117,18 +142,22 @@ function main() {
   }
   const options = effortOption ? [effortOption] : [];
   if (args['--verify']) {
-    return verify(readJSON(args['--verify']), picker.chosenInstanceId, providerInstanceId, model, options);
+    const mismatches = verify(readJSON(args['--verify']), picker.chosenInstanceId, providerInstanceId, model, options);
+    emit({ mismatches });
+    return mismatches.length ? 2 : 0;
   }
   const selection = { [args['--kind'] === 'launch' ? 'instanceId' : 'providerInstanceId']: picker.chosenInstanceId,
     model, options };
-  console.log(JSON.stringify({ [args['--kind'] === 'launch' ? 'modelSelection' : 'target']: selection,
-    runtimeMode: 'full-access' }));
+  emit({ [args['--kind'] === 'launch' ? 'modelSelection' : 'target']: selection, runtimeMode: 'full-access' });
   return 0;
 }
 
-try {
-  process.exitCode = main();
-} catch (error) {
-  console.error(`dispatch-plan ${error.exitCode === 2 ? 'hold' : 'error'}: ${error.message}`);
-  process.exitCode = error.exitCode ?? 1;
+export function main(argv, io = { stdout: (text) => process.stdout.write(text), stderr: (text) => process.stderr.write(text) }) {
+  try { return plan(argv, io); }
+  catch (error) {
+    io.stderr(`dispatch-plan ${error.exitCode === 2 ? 'hold' : 'error'}: ${error.message}\n`);
+    return error.exitCode ?? 1;
+  }
 }
+
+if (import.meta.main) process.exitCode = main(process.argv.slice(2));

package/skills/axstack/scripts/pr-shape.js

@@ -0,0 +1,134 @@
+import { existsSync } from 'node:fs';
+
+const lockfiles = ['bun.lock', 'bun.lockb', 'package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock'];
+const help = `Usage: bun scripts/pr-shape.js --base <ref> --head <ref>
+Example: bun scripts/pr-shape.js --base main --head HEAD
+
+--base  Required actual PR base (parent branch for a stacked child)
+--head  Required candidate commit or branch
+--help  Show flags, example, bucket definitions and exit codes
+
+Read-only Git; writes nothing, retains no state. Prints a bounded JSON summary:
+input refs and resolved SHAs, merge-base, full additions/deletions, rename and
+binary counts, and overlapping lockfile/generated buckets, with status and
+reproducing argv plus calculation instructions. No path inventory is emitted.
+Lockfiles match these exact basenames at any depth: ${lockfiles.join(', ')}.
+Generated means linguist-generated set or true in .gitattributes at the head;
+uses the destination path for renames. Unset, false and unspecified are excluded.
+Ignores system/global attributes; local info/attributes causes an unknown bucket.
+Never subtract buckets; formatter-only changes require manual disclosure.
+No cohesion or approval verdict. Exit codes: 0 measured, 1 input/Git error,
+2 incomplete (no merge-base or unavailable committed-attribute evidence).
+`;
+
+function optionsFrom(argv) {
+  const options = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    const flag = argv[i];
+    if (!['--base', '--head'].includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
+    const value = argv[i + 1];
+    if (!value || value.startsWith('-')) throw new Error(`missing ref; pass ${flag} <commit-or-branch>`);
+    if (flag in options) throw new Error(`duplicate ${flag}; pass it once`);
+    options[flag] = value;
+  }
+  for (const flag of ['--base', '--head']) {
+    if (!options[flag]) throw new Error(`missing ref; pass ${flag} <commit-or-branch>`);
+  }
+  return options;
+}
+
+const command = (...args) => ['git', '--no-optional-locks', '-c', 'core.attributesFile=/dev/null', ...args];
+function run(argv, input) {
+  const result = Bun.spawnSync(argv, { stdin: input === undefined ? 'ignore' : new TextEncoder().encode(input),
+    stdout: 'pipe', stderr: 'pipe', env: { ...process.env, GIT_ATTR_NOSYSTEM: '1' } });
+  return { code: result.exitCode, stdout: result.stdout.toString(), stderr: result.stderr.toString() };
+}
+
+function numstat(text) {
+  const tokens = text.split('\0');
+  const rows = [];
+  for (let i = 0; i < tokens.length - 1; i++) {
+    const firstTab = tokens[i].indexOf('\t'), secondTab = tokens[i].indexOf('\t', firstTab + 1);
+    const added = tokens[i].slice(0, firstTab), deleted = tokens[i].slice(firstTab + 1, secondTab);
+    let path = tokens[i].slice(secondTab + 1);
+    const renamed = path === '';
+    if (renamed) { i++; path = tokens[++i]; } // -z rename: empty path, old path, new path.
+    rows.push({ path, renamed, binary: added === '-', additions: added === '-' ? 0 : Number(added),
+      deletions: deleted === '-' ? 0 : Number(deleted) });
+  }
+  return rows;
+}
+
+function summarize(rows, evidence) {
+  return { status: 'pass', files: rows.length,
+    additions: rows.reduce((sum, row) => sum + row.additions, 0),
+    deletions: rows.reduce((sum, row) => sum + row.deletions, 0),
+    renames: rows.filter((row) => row.renamed).length,
+    binaries: rows.filter((row) => row.binary).length,
+    evidence: { ...evidence, calculations: {
+      files: 'count selected numstat records', additions: 'sum numeric column 1 of selected records',
+      deletions: 'sum numeric column 2 of selected records',
+      renames: 'count selected -z records with empty path followed by old/new NUL paths',
+      binaries: 'count selected records with - in both numeric columns (no estimated lines)',
+    } } };
+}
+
+export function main(argv, io = { stdout: (text) => process.stdout.write(text), stderr: (text) => process.stderr.write(text) }) {
+  try {
+    if (argv.includes('--help')) { io.stdout(help); return 0; }
+    const options = optionsFrom(argv);
+    const root = run(command('rev-parse', '--show-toplevel'));
+    if (root.code) throw new Error('run this helper from a Git checkout');
+    const repo = root.stdout.replace(/\n$/, '');
+    const gitCommand = (...args) => command('-C', repo, ...args);
+    const resolve = (flag) => {
+      const result = run(gitCommand('rev-parse', '--verify', '--end-of-options', `${options[flag]}^{commit}`));
+      if (result.code) throw new Error(`unresolved ${flag}; pass ${flag} <existing-commit-or-branch>`);
+      return result.stdout.trim();
+    };
+    const inputs = { repo, baseRef: options['--base'], headRef: options['--head'], base: resolve('--base'), head: resolve('--head') };
+    const mergeCommand = gitCommand('merge-base', inputs.base, inputs.head);
+    const merge = run(mergeCommand);
+    if (merge.code) {
+      const unknown = { status: 'unknown', evidence: { commands: [mergeCommand], reason: merge.stderr.trim() || 'no common ancestor' } };
+      io.stdout(`${JSON.stringify({ inputs, mergeBase: { ...unknown, value: null }, totals: unknown,
+        buckets: { lockfiles: unknown, generated: unknown } })}\n`);
+      return 2;
+    }
+    const mergeBase = merge.stdout.trim();
+    const diffCommand = gitCommand('diff', '-M', '--no-relative', '--no-ext-diff', '--no-textconv', '--numstat', '-z', `${mergeBase}..${inputs.head}`, '--');
+    const diff = run(diffCommand);
+    if (diff.code) throw new Error(`diff unavailable; verify --base and --head refer to readable commits: ${diff.stderr.trim()}`);
+    const rows = numstat(diff.stdout);
+    const attrCommand = gitCommand('check-attr', `--source=${inputs.head}`, '--stdin', '-z', 'linguist-generated');
+    const attrEvidence = { commands: [diffCommand, attrCommand], environment: { GIT_ATTR_NOSYSTEM: '1' },
+      stdin: 'feed check-attr the NUL-separated destination paths from the full numstat records',
+      select: 'destination paths whose head linguist-generated value is set or true; never filter diff pathspecs' };
+    const infoPath = run(gitCommand('rev-parse', '--path-format=absolute', '--git-path', 'info/attributes')).stdout.replace(/\n$/, '');
+    // Git still reads info/attributes with --source; do not claim these are committed facts.
+    const attrs = existsSync(infoPath) ? null : run(attrCommand, rows.map((row) => row.path).join('\0') + (rows.length ? '\0' : ''));
+    let generated;
+    if (!attrs || attrs.code) {
+      generated = { status: 'unknown', evidence: { ...attrEvidence,
+        reason: !attrs ? `local attribute override exists: ${infoPath}` : `committed attributes unavailable: ${attrs.stderr.trim()}` } };
+    } else {
+      const values = attrs.stdout.split('\0'), paths = new Set();
+      for (let i = 0; i < values.length - 1; i += 3) {
+        if (['set', 'true'].includes(values[i + 2])) paths.add(values[i]);
+      }
+      generated = summarize(rows.filter((row) => paths.has(row.path)), attrEvidence);
+    }
+    io.stdout(`${JSON.stringify({ inputs, mergeBase: { status: 'pass', value: mergeBase, evidence: { commands: [mergeCommand] } },
+      totals: summarize(rows, { commands: [diffCommand], select: 'all records; no exclusions' }),
+      buckets: { lockfiles: summarize(rows.filter((row) => lockfiles.includes(row.path.split('/').at(-1))),
+        { commands: [diffCommand], select: 'destination basename is exactly one of lockfileNames', lockfileNames: lockfiles }), generated },
+      disclosures: 'Buckets may overlap. Never subtract them from totals. Formatter-only changes require manual disclosure; cohesion is a manual judgment.',
+    })}\n`);
+    return generated.status === 'unknown' ? 2 : 0;
+  } catch (error) {
+    io.stderr(`pr-shape error: ${error.message}\n`);
+    return 1;
+  }
+}
+
+if (import.meta.main) process.exitCode = main(process.argv.slice(2));

package/skills/axstack/scripts/readiness-run.js

@@ -0,0 +1,161 @@
+import { chmodSync, closeSync, lstatSync, mkdirSync, mkdtempSync, openSync, realpathSync, rmSync, writeFileSync, writeSync } from 'node:fs';
+
+const installs = {
+  bun: ['install', '--frozen-lockfile'], npm: ['ci'],
+  pnpm: ['install', '--frozen-lockfile'], yarn: ['install', '--immutable'],
+};
+const groups = [['env.build', ['build']], ['testing.test', ['test']], ['testing.lint-typecheck', ['lint', 'typecheck']]];
+const drainGraceMs = 200;
+// No shell interpolation, and the wrapper preserves the command's allowlisted env.
+const networkWrapper = `const ip = Bun.spawnSync([process.argv[1], 'link', 'set', 'lo', 'up'], { stdin: 'ignore', stdout: 'inherit', stderr: 'inherit' });
+if (ip.exitCode !== 0) process.exit(ip.exitCode || 1);
+const command = Bun.spawn(process.argv.slice(2), { stdin: 'ignore', stdout: 'inherit', stderr: 'inherit' });
+process.exit(await command.exited);`;
+
+function killGroup(proc) {
+  try { process.kill(-proc.pid, 'SIGKILL'); }
+  catch (error) { if (error.code !== 'ESRCH') throw error; }
+}
+
+async function runCommand(commands, paths, kind, argv, cwd, env, limits, state, spawnArgv = argv) {
+  const started = performance.now();
+  const step = { kind, argv, spawnArgv, exitCode: null, durationMs: 0, logPath: `${paths.evidence}/${crypto.randomUUID()}-${kind}.log`, timedOut: false, logBytes: 0, omittedBytes: 0, logIncomplete: false };
+  step.receiptPath = `${step.logPath.slice(0, -4)}.json`;
+  commands.push(step);
+  const fd = openSync(step.logPath, 'wx', 0o600);
+  let proc;
+  let timer;
+  let graceTimer;
+  let logging = true;
+  const readers = [];
+  function log(chunk) {
+    if (!logging) return;
+    const kept = Math.min(chunk.length, limits.logBytes - step.logBytes);
+    if (kept) writeSync(fd, chunk.subarray(0, kept));
+    step.logBytes += kept;
+    step.omittedBytes += chunk.length - kept;
+  }
+  async function drain(reader) {
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) return;
+        log(value);
+      }
+    } catch (error) {
+      if (logging) { step.error = error.message; killGroup(proc); }
+    }
+  }
+  try {
+    proc = Bun.spawn(spawnArgv, { cwd, env, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe', detached: true });
+    state.active = proc;
+    readers.push(proc.stdout.getReader(), proc.stderr.getReader());
+    const drained = Promise.all(readers.map(drain));
+    const exited = proc.exited.then((code) => {
+      if (logging) step.exitCode = code;
+      clearTimeout(timer);
+      killGroup(proc);
+    });
+    const timeout = new Promise((resolve) => {
+      timer = setTimeout(() => { step.timedOut = true; killGroup(proc); resolve(); }, limits.timeoutMs);
+    });
+    await Promise.race([exited, timeout]);
+    const complete = await Promise.race([
+      Promise.all([exited, drained]).then(() => true),
+      new Promise((resolve) => { graceTimer = setTimeout(() => resolve(false), drainGraceMs); }),
+    ]);
+    step.logIncomplete = !complete;
+  } catch (error) {
+    step.error = error.message;
+    log(new TextEncoder().encode(error.message));
+  } finally {
+    clearTimeout(timer);
+    clearTimeout(graceTimer);
+    logging = false;
+    if (proc) killGroup(proc);
+    // Cancel without another EOF wait. Escaped writers may retain the other pipe end forever.
+    for (const reader of readers) reader.cancel().then(() => reader.releaseLock()).catch(() => {});
+    state.active = null;
+    closeSync(fd);
+    step.durationMs = Math.round(performance.now() - started);
+    writeFileSync(step.receiptPath, `${JSON.stringify(step, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+  }
+  return step;
+}
+
+export async function executeDeclared(repo, revision, paths, criteria, manager, pkg, limits) {
+  const pending = groups.filter(([id]) => criteria.find((item) => item.id === id).reason === 'not run');
+  const commands = [];
+  const result = { commands, network: 'not isolated', descendants: 'not contained' };
+  if (!pending.length) return result;
+  mkdirSync(paths.evidence, { recursive: true, mode: 0o700 });
+  let scratch;
+  const state = { active: null, signal: null };
+  const interrupt = (signal) => { state.signal = signal; if (state.active) killGroup(state.active); };
+  const sigint = () => interrupt('SIGINT');
+  const sigterm = () => interrupt('SIGTERM');
+  process.on('SIGINT', sigint);
+  process.on('SIGTERM', sigterm);
+  try {
+    const home = realpathSync(process.env.HOME || '/root');
+    let temp = realpathSync(process.env.TMPDIR || '/tmp');
+    if (temp === home || temp.startsWith(`${home}/`)) temp = realpathSync('/tmp');
+    if (temp === home || temp.startsWith(`${home}/`)) throw new Error('no scratch directory outside HOME; set TMPDIR to an owned temp directory');
+    scratch = mkdtempSync(`${temp}/axstack-readiness-`);
+    chmodSync(scratch, 0o700);
+    if (lstatSync(scratch).uid !== process.getuid()) throw new Error('scratch directory is not owned');
+    result.scratch = scratch;
+    const env = { PATH: process.env.PATH || '/usr/bin:/bin', LANG: process.env.LANG || 'C.UTF-8', CI: '1', HOME: scratch, TMPDIR: scratch };
+    const cwd = `${scratch}/repo`;
+    const unshare = Bun.which('unshare');
+    const ip = Bun.which('ip');
+    const pidFlags = ['--pid', '--fork', '--kill-child'];
+    const contained = (argv) => [unshare, '-r', ...pidFlags, ...argv];
+    const isolated = (argv) => [unshare, '-rn', ...(result.descendants === 'contained' ? pidFlags : []), process.execPath, '-e', networkWrapper, ip, ...argv];
+    const run = async (kind, argv, directory = scratch, spawnArgv) => {
+      if (state.signal) throw new Error(`interrupted by ${state.signal}`);
+      const step = await runCommand(commands, paths, kind, argv, directory, env, limits, state, spawnArgv ?? (result.descendants === 'contained' ? contained(argv) : argv));
+      if (state.signal) throw new Error(`interrupted by ${state.signal}; see ${step.logPath}`);
+      return step;
+    };
+    if (unshare) {
+      const probe = await run('descendant-probe', contained(['/bin/true']));
+      if (probe.exitCode === 0 && !probe.timedOut && !probe.error) result.descendants = 'contained';
+    }
+    if (unshare && ip) {
+      const argv = isolated(['/bin/true']);
+      const probe = await run('network-probe', argv, scratch, argv);
+      if (probe.exitCode === 0 && !probe.timedOut && !probe.error) result.network = 'isolated';
+    }
+    const git = ['git', '--no-optional-locks', '-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false'];
+    const clone = await run('clone', [...git, 'clone', '--no-hardlinks', '--no-checkout', '--', realpathSync(repo), cwd], scratch);
+    if (clone.exitCode !== 0 || clone.timedOut) throw new Error(`clone failed; see ${clone.logPath}`);
+    const checkout = await run('checkout', [...git, '-C', cwd, 'checkout', '--detach', revision], scratch);
+    if (checkout.exitCode !== 0 || checkout.timedOut) throw new Error(`checkout failed; see ${checkout.logPath}`);
+    const install = await run('install', [manager.name, ...installs[manager.name]], cwd);
+    if (install.exitCode !== 0 || install.timedOut) {
+      for (const [id] of pending) Object.assign(criteria.find((item) => item.id === id), { reason: 'install failed', evidence: [install.logPath] });
+      return result;
+    }
+    for (const [id, names] of pending) {
+      const steps = [];
+      for (const name of names.filter((name) => typeof pkg.scripts?.[name] === 'string' && pkg.scripts[name].trim())) {
+        const argv = [manager.name, ...(manager.name === 'pnpm' ? ['--config.enable-pre-post-scripts=false'] : []), 'run', name];
+        steps.push(await run('script', argv, cwd, result.network === 'isolated' ? isolated(argv) : undefined));
+      }
+      const passed = steps.every((step) => step.exitCode === 0 && !step.timedOut && !step.error);
+      Object.assign(criteria.find((item) => item.id === id), { status: passed ? 'pass' : 'fail', reason: steps.some((step) => step.timedOut) ? 'timeout' : passed ? '' : 'command failed', evidence: steps.map((step) => step.logPath) });
+    }
+  } catch (error) {
+    result.error = error.message;
+    for (const [id] of pending) Object.assign(criteria.find((item) => item.id === id), { status: 'unknown', reason: 'execution unavailable', evidence: [error.message] });
+  } finally {
+    process.off('SIGINT', sigint);
+    process.off('SIGTERM', sigterm);
+    if (scratch) {
+      try { rmSync(scratch, { recursive: true }); }
+      catch (error) { result.error = `scratch removal failed: ${scratch}: ${error.message}`; }
+    }
+  }
+  return result;
+}