axstack 0.33.0 → 0.34.1

package/README.md

@@ -15,7 +15,7 @@ coordination. You can start at the phase you need.
 | Failure mode | How Axstack responds |
 | --- | --- |
 | Wrong thing built | Align rounds clarify the request; every brainstorm runs a light arena across configured families. Use judges only for Rung 2 hard-to-reverse choices. |
-| Nobody really reviewed it | Strict TDD checks behavior first; mixed authored review is cross-provider, and mixed peer review pairs Sol high with Opus low in isolated sessions at the exact revision. |
+| Nobody really reviewed it | Strict TDD checks behavior first; mixed authored review is cross-provider, and mixed peer review pairs Sol high with Opus medium in isolated sessions at the exact revision. |
 | Design rot | The design lens sketches boundaries before a build; Improve surfaces evidenced changes later. |
 | Agents left a mess | T3 makes delegation visible, one writer owns each PR, cleanup stays bounded, and watched own PRs merge under guarded rules. |
 
@@ -147,6 +147,24 @@ Eligible own PRs use guarded automatic merge; see [merge boundaries, exclusions,
 See [PR scope and sizing](skills/axstack/references/pr-shape.md) for candidate
 shape and [Releases](https://github.com/axatbhardwaj/axstack/releases) for release history.
 
+## Development
+
+```sh
+bun install --frozen-lockfile
+bun run lint
+bun run typecheck
+git config core.hooksPath .husky
+```
+
+The hook is opt-in per clone via `git config core.hooksPath .husky` and requires
+`bun install`. Without dev tools it prints a setup hint and skips the checks.
+The hook runs lint and typecheck only. Biome formatting is optional for editors
+or manual use; commits do not enforce formatting. TypeScript checks JavaScript
+in `src/` and `bin/` without emitting files. All tooling is development-only and
+is excluded from packed assets by `package.json.files`.
+Regenerate `bun.lock` with the minimum Bun version in `package.json.engines`
+(currently 1.3.14); newer Bun versions can write an incompatible lockfile format.
+
 ## License
 
 [MIT](LICENSE) © 2026 Axat Bhardwaj.

package/bin/axstack.js

@@ -26,7 +26,7 @@ function homeDir() {
   // Tilde expansion needs a known absolute home; with HOME missing, empty,
   // or relative the destination is unknown, so refuse even with --yes.
   const home = Bun.env.HOME;
-  if (!home || !home.startsWith('/')) {
+  if (!home?.startsWith('/')) {
     throw new Error('HOME is missing, empty, or not absolute; pass explicit paths instead of ~');
   }
   return home;
@@ -298,6 +298,13 @@ async function main() {
       const legacyCodexManifest = legacyCodexDir
         ? await readLegacySkillsManifest(legacyCodexDir)
         : null;
+      /**
+       * @type {Awaited<ReturnType<typeof installBundle>> & {
+       *   legacyCodex?: {removed: string[], preserved: string[], missing: string[], skipped?: boolean,
+       *     held?: boolean, failed?: boolean, failure?: boolean, reason?: string},
+       *   addedRoleIds?: string[], removedRoleIds?: string[], changedRoleModels?: string[], notes?: string[]
+       * }}
+       */
       const summary = await installBundle({
         bundleDir: flags.bundle ? resolve(flags.bundle) : PACKAGE_ROOT,
         skillsDir,

package/docs/workflows.md

@@ -119,11 +119,11 @@ role.
 
 | Preset | Author | Ordered peer reviewers | Astra / Opus advisers | Auditor |
 | --- | --- | --- | --- | --- |
-| `mixed` | Sol high | Sol high; Opus low | Astra high / Opus xhigh | Sonnet high + Sol high |
+| `mixed` | Sol high | Sol high; Opus medium | Astra high / Opus xhigh | Haiku xhigh + Sol high |
 | `codex-only` | Sol high | Sol high; Luna xhigh | Astra high / unavailable | Luna xhigh + Sol high |
 | `claude-only` | Opus medium | Opus medium; Sonnet high | unavailable / Opus xhigh | Sonnet high (Sol absent) |
 
-In `mixed` and `claude-only`, `axstack-auditor`, `axstack-research-requirements`,
+In `mixed` and `claude-only`, `axstack-research-requirements`,
 `axstack-research-code`, `axstack-research-web`, and `axstack-explore-execution`
 use the Claude Sonnet class at high effort. `axstack-explore-codebase` and
 `axstack-monitor` adopt Haiku 5.5 high, with class `haiku` and exact pin
@@ -131,6 +131,9 @@ use the Claude Sonnet class at high effort. `axstack-explore-codebase` and
 holds those roles without substitution. `codex-only` keeps its Codex
 assignments for those roles. Mixed web-google and X retain their source-specific
 Antigravity and Grok routes.
+The mixed `axstack-auditor` uses Haiku 5.5 xhigh, pinned to `claude-haiku-5-5`;
+missing that ID or xhigh effort holds without substitution. The mixed
+`axstack-explainer-review` uses Sol medium; `axstack-explainer` stays Sonnet high.
 The new `-sol` auditor, research-code, and explore-execution seats use Sol high
 in `mixed` and `codex-only`; `claude-only` records each as intentionally absent.
 Dispatch the base and Sol seats independently on the same brief, then reconcile
@@ -148,7 +151,7 @@ later installation changes without re-resolution.
 Peer roles use the stable IDs `axstack-reviewer-primary` and
 `axstack-reviewer-peer`; their provider/class mappings come only from the
 selected preset. The mixed cross-provider peer pair is Sol high followed by
-Opus low. The mixed peer coordinator and review-lane binding
+Opus medium. The mixed peer coordinator and review-lane binding
 `axstack-owner` uses Sol high and never reviews. `axstack-reviewer-secondary`
 is used in the authored mapping and, alongside `axstack-reviewer-primary`,
 in codebase findings mode.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.33.0",
+  "version": "0.34.1",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",
@@ -32,8 +32,15 @@
     "docs/*.md"
   ],
   "scripts": {
+    "lint": "biome lint . --error-on-warnings",
+    "typecheck": "bun node_modules/typescript/bin/tsc --noEmit --project jsconfig.json",
     "test": "bun test",
     "test:all": "bun test"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "devDependencies": {
+    "@biomejs/biome": "2.5.15",
+    "@types/bun": "1.4.2",
+    "typescript": "7.0.2"
+  }
 }

package/profiles/presets/mixed.json

@@ -43,7 +43,7 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "high",
-      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Opus low. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
       "modelClass": "sol"
     },
     {
@@ -51,7 +51,7 @@
       "name": "Axstack reviewer (secondary)",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "medium",
+      "thinkingOptionId": "high",
       "notes": "Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "opus"
     },
@@ -60,8 +60,8 @@
       "name": "Axstack reviewer (peer)",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "low",
-      "notes": "Second reviewer in the ordered mixed peer pair: Sol high followed by Opus low. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "thinkingOptionId": "medium",
+      "notes": "Second reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "opus"
     },
     {
@@ -150,9 +150,9 @@
       "name": "Axstack explainer reviewer",
       "provider": "codex",
       "modeId": "full-access",
-      "thinkingOptionId": "xhigh",
-      "notes": "Independent explanation reviewer: reviews consequential or complex claims, archify output, or on request. Checks the exact artifact for text and source fidelity. The rendered pass belongs to axstack-ui-verifier. Any artifact change invalidates its review. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution.",
-      "modelClass": "luna"
+      "thinkingOptionId": "medium",
+      "notes": "Independent Sol medium explanation reviewer: reviews consequential or complex claims, archify output, or on request. Checks the exact artifact for text and source fidelity. The rendered pass belongs to axstack-ui-verifier. Any artifact change invalidates its review. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution.",
+      "modelClass": "sol"
     },
     {
       "id": "axstack-ui-verifier",
@@ -206,9 +206,10 @@
       "name": "Axstack auditor",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "high",
-      "notes": "Sonnet high read-only end-of-run and checkpoint auditor. Collects scope and outcome evidence with counts and denominators and reports PASS, FAIL, or UNKNOWN without inventing numbers. Never edits, merges, activates, or audits itself. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "thinkingOptionId": "xhigh",
+      "notes": "Haiku 5.5 xhigh read-only end-of-run and checkpoint auditor. Collects scope and outcome evidence with counts and denominators and reports PASS, FAIL, or UNKNOWN without inventing numbers. Never edits, merges, activates, or audits itself. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or xhigh effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-auditor-sol",

package/skills/axstack/references/role-roster.md

@@ -7,12 +7,12 @@
   Only the recorded owning watch thread merges, including `axstack-owner`
   for authorized standalone maintenance. Other roles never acquire merge authority.
 - `axstack-reviewer-primary` and `axstack-reviewer-peer` are the ordered
-  peer pair. In `mixed`, the cross-provider pair is Sol high followed by Opus low.
+  peer pair. In `mixed`, the cross-provider pair is Sol high followed by Opus medium.
   Peer review uses both; authored review uses this table:
 
   | Preset | Author class | Reviewer (class/effort) |
   | --- | --- | --- |
-  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
   | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
   | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
   | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
@@ -24,15 +24,18 @@
   `axstack-auditor` audits; `axstack-checker` reports discrepancies.
 - `axstack-explainer` authors archify only on an explicit viewer request.
 - `axstack-explainer-review` reviews consequential or complex claims, archify
-  output, or on request.
+  output, or on request; `codex/sol` medium in mixed.
 - `axstack-diligence`: read-only [diligence checks](diligence.md) for every PR
   review round and bounded research, spec, ticket, receipt, and release claims.
 - `axstack-ui-verifier`: owns the inline page interaction pass under [UI checks](ui-verification.md)
   for every interactive page, bound to the exact bytes and SHA-256.
-- `axstack-auditor`/`axstack-research-requirements`/
+- `axstack-research-requirements`/
   `axstack-research-code`/`axstack-research-web`/
   `axstack-explore-execution`:
   `claude/sonnet` high in mixed/claude-only.
+- `axstack-auditor`: `claude/haiku` xhigh in mixed, pinned to
+  `claude-haiku-5-5`. Missing that exact model or xhigh effort holds without
+  substitution. `claude/sonnet` high in claude-only; `codex/luna` xhigh in codex-only.
 - `axstack-explore-codebase`/`axstack-monitor`: `claude/haiku` high in
   mixed/claude-only, pinned to `claude-haiku-5-5`. Missing that exact model
   or high effort holds these roles without substitution.
@@ -41,7 +44,7 @@
 - Sol pairs `axstack-auditor-sol`/`axstack-research-code-sol`/
   `axstack-explore-execution-sol`: `codex/sol` high in
   mixed/codex-only; intentionally absent in claude-only. Dispatch each
-  independently from its Sonnet seat on the same bounded brief without
+  independently from its base seat on the same bounded brief without
   cross-reading. The driver reconciles findings per claim, never averages.
   Record intentional absence and continue with Sonnet alone.
 - Optional seats: `axstack-arena-candidate-grok`,

package/skills/axstack/scripts/pr-digest.js

@@ -54,7 +54,7 @@ function fetchCurrent(args) {
 }
 
 function nodes(connection, field) {
-  if (!connection || connection.pageInfo?.hasNextPage !== false || !Array.isArray(connection.nodes)) {
+  if (connection?.pageInfo?.hasNextPage !== false || !Array.isArray(connection.nodes)) {
     throw new Error(`incomplete ${field} connection`);
   }
   return connection.nodes;

package/skills/axstack/scripts/readiness.js

@@ -89,12 +89,19 @@ const definitions = [
   ['security.pr-tests', 'Governance/Security'], ['security.status-checks', 'Governance/Security'], ['security.updates', 'Governance/Security'], ['security.secrets', 'Governance/Security'],
 ];
 
-function packageManager(files) {
+function packageManager(files, pkg) {
   const locks = [
     ['bun', ['bun.lock', 'bun.lockb']], ['npm', ['package-lock.json', 'npm-shrinkwrap.json']],
     ['pnpm', ['pnpm-lock.yaml']], ['yarn', ['yarn.lock']],
   ].filter(([, names]) => names.some(files.has));
-  if (!locks.length) return { reason: 'no lockfile' };
+  if (!locks.length) {
+    const dependencyFields = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies', 'bundledDependencies', 'bundleDependencies', 'workspaces'];
+    if (!files.has('pnpm-workspace.yaml') && dependencyFields.every((field) => !pkg?.[field] || Object.keys(pkg[field]).length === 0)) {
+      if (typeof pkg?.packageManager === 'string' && /^bun@[^@\s]+$/.test(pkg.packageManager)) return { name: 'bun', paths: ['package.json: packageManager'] };
+      if (pkg?.packageManager === undefined && typeof pkg?.engines?.bun === 'string' && pkg.engines.bun.trim()) return { name: 'bun', paths: ['package.json: engines.bun'] };
+    }
+    return { reason: 'no lockfile' };
+  }
   if (locks.length > 1) return { reason: 'ambiguous lockfile' };
   const [name, paths] = locks[0];
   if (name === 'yarn' && !/^__metadata:/m.test(files.read('yarn.lock'))) return { reason: 'unsupported package manager' };
@@ -150,7 +157,7 @@ function assess(files) {
   }
   configured('style.pre-commit', has(/(^|\/)(\.pre-commit-config\.ya?ml|lefthook\.ya?ml|\.lefthook\.ya?ml|\.husky\/pre-commit)$/).concat(pkg.husky?.hooks?.['pre-commit'] ? ['package.json'] : []));
   configured('env.lockfile', has(/^(bun\.lockb?|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock)$/));
-  const manager = packageManager(files);
+  const manager = packageManager(files, pkg);
   declaredCommands(files, pkg, manager, set, invalidPackage);
   configured('env.toolchain', has(/^(\.tool-versions|mise\.toml|\.mise\.toml|\.nvmrc|\.devcontainer\.json|\.devcontainer\/(devcontainer\.json|[^/]+\/devcontainer\.json))$/).concat(pkg.engines && Object.keys(pkg.engines).length ? ['package.json'] : []));
   configured('testing.files', has(/(^|\/)((tests?|__tests__)\/.*\.[cm]?[jt]sx?|[^/]+\.(test|spec)\.[cm]?[jt]sx?)$/));
@@ -168,7 +175,7 @@ function assess(files) {
       const steps = Object.values(workflow?.jobs ?? {}).flatMap((job) => job?.steps ?? []);
       const runs = steps.map((step) => step?.run).filter((run) => typeof run === 'string');
       if (steps.some((step) => typeof step?.uses === 'string' && /^github\/codeql-action\//.test(step.uses))) codeql.push(path);
-      const invokes = (run, name) => new RegExp(`(?:^|[\\n;&|])\\s*${name}\\s+${name === 'bun' ? 'run\\s+' : '(?:run\\s+)?'}test(?:\\s|[;&|]|$)`).test(run);
+      const invokes = (run, name) => new RegExp(`(?:^|[\\n;&|])\\s*${name}\\s+(?:run\\s+)?test(?:\\s|[;&|]|$)`).test(run);
       if (pr && runs.some((run) => ['bun', 'npm', 'pnpm', 'yarn'].some((name) => invokes(run, name)))) prCandidate = true;
       if (pr && manager.name && runs.some((run) => invokes(run, manager.name))) prTests = true;
     } catch { invalid = true; }
@@ -194,19 +201,43 @@ export function summarizePillars(criteria) {
   return result;
 }
 
+function parsePages(text) {
+  const pages = [];
+  let start = -1, depth = 0, quoted = false, escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (start < 0) {
+      if (/\s/.test(char)) continue;
+      if (char !== '{' && char !== '[') throw new Error('invalid gh page');
+      start = i;
+    }
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === '{' || char === '[') depth++;
+    else if (char === '}' || char === ']') depth--;
+    if (depth === 0) {
+      pages.push(JSON.parse(text.slice(start, i + 1)));
+      start = -1;
+    }
+  }
+  if (start >= 0 || !pages.length) throw new Error('incomplete gh response');
+  return pages;
+}
+
 function forgeStatus(origin) {
   const match = /^https:\/\/github\.com\/([\w.-]+\/[\w.-]+)$/.exec(origin);
   const evidence = [];
   const result = (status, reason) => ({ status, reason, evidence: evidence.length ? evidence : ['origin remote'] });
   if (!match) return result('unknown', 'no GitHub origin');
   function api(endpoint) {
-    const argv = [process.env.GH || 'gh', 'api', '--hostname', 'github.com', '--method', 'GET', '--paginate', '--slurp', endpoint];
-    evidence.push(`gh api --method GET --paginate --slurp ${endpoint}`);
+    const argv = [process.env.GH || 'gh', 'api', '--hostname', 'github.com', '--method', 'GET', '--paginate', endpoint];
+    evidence.push(`gh api --method GET --paginate ${endpoint}`);
     const response = Bun.spawnSync(argv, { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
     if (response.exitCode !== 0) throw new Error(response.stderr.toString().trim());
-    const pages = JSON.parse(response.stdout.toString());
-    if (!Array.isArray(pages) || !pages.length) throw new Error('incomplete gh response');
-    return pages;
+    return parsePages(response.stdout.toString());
   }
   try {
     const metadata = api(`repos/${match[1]}`);
@@ -268,7 +299,7 @@ async function report(args, paths) {
   if (args['--run']) {
     let pkg = {};
     try { pkg = JSON.parse(files.read('package.json') || '{}'); } catch { /* Static criteria already record invalid JSON. */ }
-    execution = await executeDeclared(repo, revision, paths, criteria, packageManager(files), pkg, {
+    execution = await executeDeclared(repo, revision, paths, criteria, packageManager(files, pkg), pkg, {
       timeoutMs: Number(args['--timeout-ms'] ?? 120000), logBytes: Number(args['--log-bytes'] ?? 1048576),
     });
     header.network = execution.network;

package/skills/axstack-audit/SKILL.md

@@ -28,8 +28,8 @@ immediately before an actual auditor profile or session dispatch. Ordinary
 audit reading and record writing do not load it, and the auditor never
 dispatches.
 
-Core owns the `axstack-auditor` profile (claude/sonnet high in
-mixed/claude-only; codex/luna xhigh in codex-only) and its invocation.
+Core owns the `axstack-auditor` profile (claude/haiku xhigh in mixed,
+claude/sonnet high in claude-only, codex/luna xhigh in codex-only) and its invocation.
 This skill governs what that auditor reads, measures, and proposes.
 Dispatch `axstack-auditor` and `axstack-auditor-sol` independently on the same
 bounded brief, without cross-reading. The driver reconciles findings per claim;
@@ -107,7 +107,7 @@ counts with denominators plus the evidence behind the count:
 
   | Preset | Author class | Reviewer (class/effort) |
   | --- | --- | --- |
-  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
   | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
   | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
   | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |

package/skills/axstack-review/SKILL.md

@@ -223,14 +223,14 @@ This section applies to peer and authored PR modes.
    - **Peer:** exactly two independent final reviewers,
      `axstack-reviewer-primary` and `axstack-reviewer-peer` from the routing snapshot.
      Send both the identical six-angle brief, with no first-pass cross-read or children.
-     The mixed peer pair is cross-provider (Sol high + Opus low), with independence
+     The mixed peer pair is cross-provider (Sol high + Opus medium), with independence
      still from separate sessions, the identical brief and an isolated first pass.
    - **Authored:** exactly one eligible independent reviewer from this complete
      mapping:
 
      | Preset | Actual author provider/class | Reviewer role (configured class/effort) |
      | --- | --- | --- |
-     | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+     | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
      | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
      | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
      | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |

package/src/archify.js

@@ -19,6 +19,7 @@ export function archifyGit(path, ...args) {
 
 function verifySha(record, actual) {
   if (actual === record.sha) return;
+  /** @type {Error & {code?: string}} */
   const error = new Error(`archify SHA mismatch: expected ${record.sha}, got ${actual}`);
   error.code = 'ARCHIFY_SHA_MISMATCH';
   throw error;
@@ -31,7 +32,8 @@ async function ownersSnapshot(path) {
   });
   if (st && (!st.isFile() || st.isSymbolicLink())) throw new Error(`unsafe archify owners file: ${path}`);
   const bytes = st ? await readFile(path) : null;
-  const owners = bytes ? JSON.parse(bytes) : [];
+  // JSON.parse coerces its argument to a string; preserve the existing Buffer coercion.
+  const owners = bytes ? /** @type {(text: {toString(): string}) => unknown} */ (JSON.parse)(bytes) : [];
   if (!Array.isArray(owners) || owners.some((owner) => typeof owner !== 'string' || !owner.startsWith('/'))) {
     throw new Error(`invalid archify owners file: ${path}`);
   }

package/src/claude-settings.js

@@ -184,7 +184,7 @@ export async function planUninstallClaudeSettings({ claude, skillsRoot, boundPat
   }
 
   const owned = sidecar.keys[CLAUDE_SETTING_PATH];
-  if (!owned || !owned.owners.includes(skillsRoot)) {
+  if (!owned?.owners.includes(skillsRoot)) {
     return {
       report: { status: 'skipped', reason: 'this skills directory does not own the Claude setting' },
       writes: [],

package/src/installer.js

@@ -179,7 +179,7 @@ function homeDir() {
   // aliased HOME) compare equal to canonicalized targets; an unresolvable
   // HOME also yields null and fails closed rather than bypassing the guard.
   const home = Bun.env.HOME;
-  if (!home || !home.startsWith('/')) return null;
+  if (!home?.startsWith('/')) return null;
   try {
     return realpathSync(home);
   } catch {
@@ -238,7 +238,7 @@ export async function validateBundle(bundleDir, selectedPreset = null) {
   if (skillsStat.isSymbolicLink() || !skillsStat.isDirectory()) {
     throw new Error('bundle skills/ must be a real directory, not a symlink');
   }
-  let entries = await readdir(skillsRoot, { withFileTypes: true });
+  const entries = await readdir(skillsRoot, { withFileTypes: true });
   // Symlinked (or non-directory) top-level skill entries must be rejected,
   // not silently skipped: Dirent.isDirectory() is false for symlinks.
   for (const entry of entries) {
@@ -380,6 +380,11 @@ async function walkSkills(dir, skillsRoot, out) {
 // never followed or truncated. After the rename, existing permissions are
 // preserved; new files take an explicit `mode` (e.g. 0600 for configs) or
 // the umask default. Guards pre-existing entries, not active races.
+/**
+ * @param {string} dest
+ * @param {string | Uint8Array} bytes
+ * @param {{mode?: number}} [options]
+ */
 export async function writeAtomic(dest, bytes, { mode } = {}) {
   await mkdir(dirname(dest), { recursive: true });
   let existingMode = null;
@@ -408,6 +413,7 @@ export async function writeAtomic(dest, bytes, { mode } = {}) {
   }
 }
 
+/** @param {Pick<InstallerOptions, 'skillsDir' | 'instructionsPath'>} [options] */
 export async function checkInstructionBinding({ skillsDir, instructionsPath } = {}) {
   if (!skillsDir) throw new Error('instruction check requires --skills-dir <dir> or --harness <name>');
   if (!instructionsPath) throw new Error('instruction check requires --instructions <file> or a supported harness');
@@ -467,6 +473,21 @@ async function assertFileSnapshot(dest, expected) {
   }
 }
 
+/**
+ * @typedef {{available: boolean, settingsPath?: string, skip?: boolean, reason?: string}} ClaudeOption
+ * @typedef {Object} InstallerOptions
+ * @property {string} [skillsDir]
+ * @property {string} [instructionsPath]
+ * @property {boolean} [force]
+ * @property {boolean} [yes]
+ * @property {ClaudeOption} [claude]
+ * @property {(message: string) => void} [log]
+ */
+
+/**
+ * @param {InstallerOptions & {bundleDir?: string, preset?: string, toolsDir?: string,
+ *   inheritedInstructions?: {path: string, hash: string}}} [options]
+ */
 export async function installBundle({
   bundleDir,
   skillsDir,
@@ -857,6 +878,7 @@ export async function installBundle({
   }
 }
 
+/** @param {InstallerOptions} [options] */
 export async function uninstallBundle({
   skillsDir,
   instructionsPath = null,
@@ -1110,6 +1132,10 @@ export async function uninstallBundle({
 // is present and byte-for-byte verified. This deliberately handles skill
 // payloads only: instruction files, Claude settings, and historical profile
 // ownership may belong to another harness and remain bound to the old manifest.
+/**
+ * @param {{canonicalSkillsDir?: string, legacySkillsDir?: string, yes?: boolean,
+ *   acceptedInstructionTransfer?: {path: string, legacyHash: string, canonicalHash: string}}} [options]
+ */
 export async function retireLegacySkills({
   canonicalSkillsDir,
   legacySkillsDir,

package/src/posixpath.js

@@ -65,7 +65,8 @@ export function resolveFrom(cwd, ...paths) {
 }
 
 export function resolve(...paths) {
-  return resolveFrom(Bun.cwd, ...paths);
+  // Bun.cwd is a runtime string missing from the current Bun declarations.
+  return resolveFrom(/** @type {typeof Bun & {cwd: string}} */ (Bun).cwd, ...paths);
 }
 
 export function relative(from, to) {

package/src/roles.js

@@ -18,7 +18,7 @@ export function deriveModelClass(model) {
 
 const AUTHORED_ROUTES = Object.freeze({
   mixed: {
-    'codex/sol': ['axstack-reviewer-secondary', 'claude/opus', 'medium'],
+    'codex/sol': ['axstack-reviewer-secondary', 'claude/opus', 'high'],
     'claude/opus': ['axstack-reviewer-primary', 'codex/sol', 'high'],
   },
   'codex-only': {