co-maintainer 0.4.13 → 0.5.0-beta.1

package/dist/src/store/cache_db.d.ts

@@ -2,3 +2,7 @@ export declare function cacheGet(namespace: string, key: string): Promise<string
 export declare function cacheSet(namespace: string, key: string, value: string): Promise<void>;
 export declare function cacheDelete(namespace: string, key: string): Promise<void>;
 export declare function cacheDeletePrefix(namespace: string, prefix: string): Promise<void>;
+/** Every value under `namespace` whose key starts with `prefix`, newest first.
+ * `recordAiCost` keys each job `${repo}:${uuid}`, so the probe estimate reads
+ * a repository's own job history without a second index to keep in sync. */
+export declare function cacheValues(namespace: string, prefix: string): Promise<string[]>;

package/dist/src/store/cache_db.js

@@ -1,11 +1,17 @@
 import { Database } from "./sqlite.js";
 import { cacheDbPath, getCacheDir } from "../config.js";
 import { mkdirSync } from "../util/runtime.js";
-let initialized = false;
+/** Paths whose schema this process has already created. Keyed by path rather
+ * than a single boolean: `cacheDbPath()` reads the environment at call time
+ * and tests point it at a temp directory, so a process-level flag would skip
+ * `CREATE TABLE` for the second path and every query would then fail with
+ * `no such table: cache`. */
+const initialized = new Set();
 function openDatabase() {
     mkdirSync(`${getCacheDir()}/co-maintainer`, { recursive: true });
-    const db = new Database(cacheDbPath());
-    if (!initialized) {
+    const path = cacheDbPath();
+    const db = new Database(path);
+    if (!initialized.has(path)) {
         db.exec(`
       CREATE TABLE IF NOT EXISTS cache (
         namespace TEXT NOT NULL,
@@ -15,7 +21,7 @@ function openDatabase() {
         PRIMARY KEY (namespace, cache_key)
       )
     `);
-        initialized = true;
+        initialized.add(path);
     }
     return db;
 }
@@ -61,3 +67,20 @@ export async function cacheDeletePrefix(namespace, prefix) {
         db.close();
     }
 }
+/** Every value under `namespace` whose key starts with `prefix`, newest first.
+ * `recordAiCost` keys each job `${repo}:${uuid}`, so the probe estimate reads
+ * a repository's own job history without a second index to keep in sync. */
+export async function cacheValues(namespace, prefix) {
+    const db = openDatabase();
+    try {
+        return db
+            .prepare(`SELECT value FROM cache
+         WHERE namespace = ? AND cache_key LIKE ?
+         ORDER BY updated_at DESC`)
+            .all(namespace, `${prefix}%`)
+            .map((row) => row.value);
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/src/store/deliveries.d.ts

@@ -10,3 +10,10 @@ export declare function recordDelivery(row: {
 }): void;
 export declare function hasDelivery(deliveryId: string): boolean;
 export declare function listSkipped(repo?: string): DeliveryRow[];
+/** The newest delivery for one repository, whatever its outcome, so a repo
+ * page can say when GitHub last reached it instead of showing nothing. */
+export declare function lastDeliveryForRepo(repo: string): DeliveryRow | undefined;
+/** The newest delivery of any kind, for the setup checklist's webhook step:
+ * it answers "has GitHub ever reached this server" rather than "for which
+ * repo". */
+export declare function lastDelivery(): DeliveryRow | undefined;

package/dist/src/store/deliveries.js

@@ -21,3 +21,18 @@ export function listSkipped(repo) {
     const db = getAppDb().prepare(`SELECT * FROM deliveries ${where} ORDER BY received_at DESC`);
     return repo ? db.all(repo) : db.all();
 }
+/** The newest delivery for one repository, whatever its outcome, so a repo
+ * page can say when GitHub last reached it instead of showing nothing. */
+export function lastDeliveryForRepo(repo) {
+    return getAppDb()
+        .prepare(`SELECT * FROM deliveries WHERE repo = ? ORDER BY received_at DESC LIMIT 1`)
+        .get(repo);
+}
+/** The newest delivery of any kind, for the setup checklist's webhook step:
+ * it answers "has GitHub ever reached this server" rather than "for which
+ * repo". */
+export function lastDelivery() {
+    return getAppDb()
+        .prepare(`SELECT * FROM deliveries ORDER BY received_at DESC LIMIT 1`)
+        .get();
+}

package/dist/src/tools/codegraph.d.ts

@@ -23,6 +23,36 @@ export type EnsureOptions = {
     /** Overrides `process.exit`, for tests. */
     exit?: (code: number) => never;
 };
+/** codegraph ships a small launcher plus a per-platform binary (an
+ * `optionalDependencies` split), so the download a user is about to accept is
+ * the platform package, not the tiny launcher. Measured from the npm registry
+ * for {@link CODEGRAPH_VERSION}: ~249 MB unpacked on win32-x64. Kept as a
+ * rounded figure because it moves between releases and the point is the order
+ * of magnitude, not the exact byte count. */
+export declare const CODEGRAPH_APPROX_SIZE = "~250 MB";
+/** A prompt may only be shown when there is a human on the other end of stdin
+ * *and* stdout, and no CI marker. A closed stdin (`</dev/null`), a piped
+ * output, or `CI=1` must all take the non-interactive path: asking then would
+ * hang on a question nobody can answer (F01). `stdout` is checked because a
+ * prompt printed into a pipe is invisible.
+ *
+ * `streams` is injectable so the tests can stand in for a TTY without a real
+ * terminal. */
+export declare function canPrompt(streams?: {
+    stdin?: {
+        isTTY?: boolean;
+    };
+    stdout?: {
+        isTTY?: boolean;
+    };
+}, env?: Record<string, string | undefined>): boolean;
+/** The one line a non-interactive run prints instead of asking (F01). It names
+ * the reason and both ways forward, so a CI log explains itself. */
+export declare function skippedNotice(version?: string): string;
+/** What the install prompt says: the package and version, where it comes from,
+ * what it is for, the approximate size, and the exact directory. A bare
+ * "Install ...? [y/N]" left the user guessing (F01). */
+export declare function installPrompt(version: string, root: string): string;
 export declare function runCommand(command: string, args: string[]): Promise<CommandResult>;
 /** One version per directory, so several can sit side by side and an upgrade
  * never half-overwrites a working install. */

package/dist/src/tools/codegraph.js

@@ -7,6 +7,41 @@ import { askConfirm } from "../cli/prompt.js";
  * someone else's machine. Raise it, adjust whatever reads the output, done. */
 export const CODEGRAPH_VERSION = "1.6.0";
 export const CODEGRAPH_PACKAGE = "@colbymchenry/codegraph";
+/** codegraph ships a small launcher plus a per-platform binary (an
+ * `optionalDependencies` split), so the download a user is about to accept is
+ * the platform package, not the tiny launcher. Measured from the npm registry
+ * for {@link CODEGRAPH_VERSION}: ~249 MB unpacked on win32-x64. Kept as a
+ * rounded figure because it moves between releases and the point is the order
+ * of magnitude, not the exact byte count. */
+export const CODEGRAPH_APPROX_SIZE = "~250 MB";
+/** A prompt may only be shown when there is a human on the other end of stdin
+ * *and* stdout, and no CI marker. A closed stdin (`</dev/null`), a piped
+ * output, or `CI=1` must all take the non-interactive path: asking then would
+ * hang on a question nobody can answer (F01). `stdout` is checked because a
+ * prompt printed into a pipe is invisible.
+ *
+ * `streams` is injectable so the tests can stand in for a TTY without a real
+ * terminal. */
+export function canPrompt(streams = {
+    stdin: process.stdin,
+    stdout: process.stdout,
+}, env = process.env) {
+    return (streams.stdin?.isTTY === true && streams.stdout?.isTTY === true && !env.CI);
+}
+/** The one line a non-interactive run prints instead of asking (F01). It names
+ * the reason and both ways forward, so a CI log explains itself. */
+export function skippedNotice(version = CODEGRAPH_VERSION) {
+    return (`codegraph ${version} is not installed, reviewing without it. ` +
+        "Pass --allow-tool-install to install it, or --disable-codegraph to skip this notice.");
+}
+/** What the install prompt says: the package and version, where it comes from,
+ * what it is for, the approximate size, and the exact directory. A bare
+ * "Install ...? [y/N]" left the user guessing (F01). */
+export function installPrompt(version, root) {
+    return (`co-maintainer uses codegraph ${version} (${CODEGRAPH_PACKAGE} from npm, ${CODEGRAPH_APPROX_SIZE}) ` +
+        "to follow calls between files while reviewing.\n" +
+        `Install it into ${versionDir(version, root)} (your global PATH is not touched)?`);
+}
 export async function runCommand(command, args) {
     // Windows resolves npm and other shims through the shell, not as bare exes.
     const windows = isWindows();
@@ -84,7 +119,9 @@ export async function ensureCodegraph(options = {}) {
     const root = options.root ?? toolsDir();
     const run = options.run ?? runCommand;
     const log = options.log ?? ((message) => console.log(message));
-    const interactive = options.interactive ?? process.stdin.isTTY === true;
+    // `canPrompt` is the single source of truth for "may we ask": stdin and
+    // stdout must both be a TTY and `CI` must be unset.
+    const interactive = options.interactive ?? canPrompt();
     // Annotated so TypeScript can see the calls below never return and keeps the
     // `Presence` narrowing intact.
     const exit = options.exit ?? process.exit;
@@ -97,17 +134,18 @@ export async function ensureCodegraph(options = {}) {
     }
     if (!options.allowInstall) {
         if (!interactive) {
-            log(`[codegraph] co-maintainer needs codegraph ${CODEGRAPH_VERSION} to index the repository.\n` +
-                `Run it with --allow-tool-install, or install it yourself:\n  ${installHint(CODEGRAPH_VERSION, root)}`);
+            // This path exits rather than continuing, so it must not say "reviewing
+            // without it"; it says how to proceed.
+            log(`[codegraph] codegraph ${CODEGRAPH_VERSION} is not installed.\n` +
+                `Run with --allow-tool-install, or install it yourself:\n  ${installHint(CODEGRAPH_VERSION, root)}`);
             exit(1);
         }
         const confirm = options.confirm ?? defaultConfirm;
         // `defaultConfirm` is async, so an unawaited call is always truthy and the
         // user's "no" was silently ignored. Await it before deciding.
-        const approved = await confirm(`co-maintainer needs codegraph ${CODEGRAPH_VERSION} to index the repository.\n` +
-            `Install it into ${versionDir(CODEGRAPH_VERSION, root)} (your global PATH is not touched)?`);
+        const approved = await confirm(installPrompt(CODEGRAPH_VERSION, root));
         if (!approved) {
-            log("[codegraph] declined; nothing was installed");
+            log("[codegraph] declined. Nothing was installed");
             exit(1);
         }
     }
@@ -132,7 +170,7 @@ export async function ensureCodegraphForReview(options = {}) {
     const root = options.root ?? toolsDir();
     const run = options.run ?? runCommand;
     const log = options.log ?? ((message) => console.error(message));
-    const interactive = options.interactive ?? process.stdin.isTTY === true;
+    const interactive = options.interactive ?? canPrompt();
     const present = await detect(CODEGRAPH_VERSION, root, run);
     if (present.state === "ok")
         return { path: present.path };
@@ -140,15 +178,14 @@ export async function ensureCodegraphForReview(options = {}) {
         log(`[codegraph] expected ${CODEGRAPH_VERSION} but found ${present.version}; reinstalling`);
     }
     if (!options.allowInstall) {
+        // Non-interactive: do not ask, review without it. The caller logs the
+        // reason, so the run continues instead of hanging or exiting (F01).
         if (!interactive) {
-            return {
-                reason: `codegraph ${CODEGRAPH_VERSION} is not installed (use --allow-tool-install)`,
-            };
+            return { reason: skippedNotice() };
         }
         const confirm = options.confirm ?? defaultConfirm;
         // Same as `ensureCodegraph`: an unawaited async confirm is always truthy.
-        const approved = await confirm(`co-maintainer needs codegraph ${CODEGRAPH_VERSION} to index this repository.\n` +
-            `Install into ${versionDir(CODEGRAPH_VERSION, root)}?`);
+        const approved = await confirm(installPrompt(CODEGRAPH_VERSION, root));
         if (!approved)
             return { reason: "codegraph install declined" };
     }

package/dist/src/types.d.ts

@@ -43,6 +43,12 @@ export type Options = {
     maxPrMonths?: number;
     maxPullRequestChangeLines?: number;
     maxComments?: number;
+    /** `probe --run`: after printing the plan, run the recommended init in the
+     * same process (CORE-24). */
+    run?: boolean;
+    /** How a review decides a blocking finding (CORE-41). `model` keeps the
+     * 0.4.13 behavior, `severity` uses a fixed P0/P1 threshold. */
+    reviewBlocking?: "model" | "severity";
 };
 export type GitHubClient = {
     request<T>(endpoint: string): Promise<T>;
@@ -77,6 +83,10 @@ export type AiRequest = {
     tools?: Json[];
     maxTokens: number;
     job: string;
+    /** A JSON schema the response must satisfy, sent as OpenRouter's
+     * `response_format`. Providers without structured output ignore it, so the
+     * model is also asked for a fenced JSON block in the prompt (CORE-40). */
+    responseFormat?: Json;
     reasoningEffort?: "max" | "xhigh" | "high" | "medium" | "low" | "none";
 };
 export type AiResponse = {

package/dist/src/util/log.d.ts

@@ -6,6 +6,9 @@ type Sink = (phase: string, message: string) => void;
 export declare function withCliLogsToStderr<T>(fn: () => Promise<T>): Promise<T>;
 export declare function withLogSink<T>(sink: Sink, fn: () => Promise<T>): Promise<T>;
 export declare function log(phase: string, message: string): void;
+/** True inside a dashboard job (one wrapped with `withLogSink`), where a
+ * diagnostic line belongs in the job log rather than the server's terminal. */
+export declare function hasLogSink(): boolean;
 export declare function startHeartbeat(phase: string | (() => string)): () => void;
 export declare function timed<T>(label: string, enabled: boolean, operation: () => Promise<T>): Promise<T>;
 export {};

package/dist/src/util/log.js

@@ -21,12 +21,24 @@ export function log(phase, message) {
     else
         console.log(`[${phase}] ${message}`);
 }
+/** True inside a dashboard job (one wrapped with `withLogSink`), where a
+ * diagnostic line belongs in the job log rather than the server's terminal. */
+export function hasLogSink() {
+    return sinkStorage.getStore() !== undefined;
+}
 export function startHeartbeat(phase) {
     const started = Date.now();
     const label = () => (typeof phase === "function" ? phase() : phase);
     const timer = setInterval(() => {
         log("progress", `still running ${label()} · ${Math.round((Date.now() - started) / 1000)}s elapsed`);
     }, 15_000);
+    // Never keep the process alive on its own (CORE-11). A long operation holds
+    // the loop open through its own pending async work (a fetch, a child), so the
+    // heartbeat still fires; but once that work is gone the timer must not be the
+    // reason the process cannot drain and apply its exit code. Every call site
+    // used to clear this by hand on the success path only, so any thrown error
+    // leaked it and the CLI hung instead of exiting.
+    timer.unref();
     return () => clearInterval(timer);
 }
 export async function timed(label, enabled, operation) {

package/dist/src/util/run_summary.d.ts

@@ -0,0 +1,33 @@
+/** The one-line cost and time summary every AI command ends with (CORE-26).
+ *
+ * F18: the JSON already carried `usage.costUsd` and a duration, but the human
+ * output had neither and `init` printed no total at all, so the only place to
+ * see what a run cost was the OpenRouter dashboard. This renders the same
+ * numbers as a single stderr line:
+ *
+ *   `Done in 21.0s · 3,125 in, 1,308 out tokens · $0.0016`
+ *
+ * stdout is untouched; this is progress/diagnostic output, and mixing it into
+ * stdout would corrupt `--json` and any piped text. When the provider does not
+ * report a cost the dollar field is `cost unknown` rather than `$0.0000`.
+ */
+import type { AiMetrics } from "../services/setup.ts";
+export type RunSummary = {
+    /** Wall-clock milliseconds, or null when only the AI time is known. */
+    durationMs: number | null;
+    tokensIn: number;
+    tokensOut: number;
+    /** `null` when any call left the cost unknown, matching `usage.costUsd`. */
+    costUsd: number | null;
+};
+/** `21.0s`, `1.3s`, `2m 03s`; one decimal below a minute, whole seconds above. */
+export declare function formatDuration(ms: number): string;
+/** The whole line, without a trailing newline. */
+export declare function formatRunSummary(summary: RunSummary): string;
+/** Formats and writes the summary. To stderr for the CLI; inside a dashboard
+ * job (no stderr) it goes to the job log instead. It prints even when the run
+ * made no AI call, because a cache-hit `sync` that cost nothing is a fact the
+ * user asked for, not a reason to stay silent. */
+export declare function printRunSummary(summary: RunSummary): void;
+/** The metrics half of a summary, so call sites do not repeat the spread. */
+export declare function summaryFromMetrics(metrics: AiMetrics, durationMs: number | null): RunSummary;

package/dist/src/util/run_summary.js

@@ -0,0 +1,47 @@
+import { hasLogSink, log } from "./log.js";
+/** `3,125` — grouped the way the numbers read in the docs. */
+function group(value) {
+    return Math.round(value).toLocaleString("en-US");
+}
+/** `21.0s`, `1.3s`, `2m 03s`; one decimal below a minute, whole seconds above. */
+export function formatDuration(ms) {
+    const seconds = ms / 1000;
+    if (seconds < 60)
+        return `${seconds.toFixed(1)}s`;
+    const whole = Math.round(seconds);
+    const minutes = Math.floor(whole / 60);
+    const rest = whole % 60;
+    return `${minutes}m ${String(rest).padStart(2, "0")}s`;
+}
+/** The whole line, without a trailing newline. */
+export function formatRunSummary(summary) {
+    const parts = [];
+    if (summary.durationMs !== null) {
+        parts.push(`Done in ${formatDuration(summary.durationMs)}`);
+    }
+    parts.push(`${group(summary.tokensIn)} in, ${group(summary.tokensOut)} out tokens`);
+    parts.push(summary.costUsd === null
+        ? "cost unknown"
+        : `$${summary.costUsd.toFixed(4)}`);
+    return parts.join(" · ");
+}
+/** Formats and writes the summary. To stderr for the CLI; inside a dashboard
+ * job (no stderr) it goes to the job log instead. It prints even when the run
+ * made no AI call, because a cache-hit `sync` that cost nothing is a fact the
+ * user asked for, not a reason to stay silent. */
+export function printRunSummary(summary) {
+    const line = formatRunSummary(summary);
+    if (hasLogSink())
+        log("done", line);
+    else
+        console.error(line);
+}
+/** The metrics half of a summary, so call sites do not repeat the spread. */
+export function summaryFromMetrics(metrics, durationMs) {
+    return {
+        durationMs,
+        tokensIn: metrics.tokensIn,
+        tokensOut: metrics.tokensOut,
+        costUsd: metrics.costKnown ? metrics.cost : null,
+    };
+}

package/dist/src/util/webhook_reachability.d.ts

@@ -0,0 +1,11 @@
+/** Why GitHub cannot deliver webhooks to this URL, or `undefined` when the
+ * host looks reachable from the public internet.
+ *
+ * `serve` accepts any absolute http(s) URL because a single-label internal
+ * host (Docker Compose, k8s) or an IPv6 literal is legitimate for other
+ * callers. For GitHub's webhook deliveries they are not: localhost and the
+ * private ranges below are unreachable from outside, and a fresh install
+ * defaults to `http://localhost:<port>/github/webhook`, so the most common
+ * first-run mistake is silent otherwise. This only classifies the host, it
+ * never rejects a URL: `set` and `serve` keep accepting them. */
+export declare function webhookReachabilityProblem(webhookUrl: string): string | undefined;

package/dist/src/util/webhook_reachability.js

@@ -0,0 +1,64 @@
+/** Why GitHub cannot deliver webhooks to this URL, or `undefined` when the
+ * host looks reachable from the public internet.
+ *
+ * `serve` accepts any absolute http(s) URL because a single-label internal
+ * host (Docker Compose, k8s) or an IPv6 literal is legitimate for other
+ * callers. For GitHub's webhook deliveries they are not: localhost and the
+ * private ranges below are unreachable from outside, and a fresh install
+ * defaults to `http://localhost:<port>/github/webhook`, so the most common
+ * first-run mistake is silent otherwise. This only classifies the host, it
+ * never rejects a URL: `set` and `serve` keep accepting them. */
+export function webhookReachabilityProblem(webhookUrl) {
+    let host;
+    try {
+        host = new URL(webhookUrl).hostname;
+    }
+    catch {
+        return "The webhook URL is not a valid absolute URL.";
+    }
+    // `URL` keeps IPv6 literals in brackets.
+    const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    const lower = bare.toLowerCase();
+    if (lower === "localhost" || lower.endsWith(".localhost")) {
+        return "localhost only resolves on the machine running serve.";
+    }
+    if (lower === "0.0.0.0" || lower === "::" || lower === "::1") {
+        return `${bare} only resolves on the machine running serve.`;
+    }
+    if (lower.startsWith("127.")) {
+        return "A loopback address only resolves on the machine running serve.";
+    }
+    if (isPrivateIpv4(lower)) {
+        return `${bare} is a private network address, not one GitHub can route to.`;
+    }
+    if (isPrivateIpv6(lower)) {
+        return `${bare} is a private network address, not one GitHub can route to.`;
+    }
+    return undefined;
+}
+function isPrivateIpv4(host) {
+    const parts = host.split(".");
+    if (parts.length !== 4)
+        return false;
+    const octets = parts.map((part) => Number(part));
+    if (octets.some((value) => !Number.isInteger(value) || value < 0 || value > 255)) {
+        return false;
+    }
+    const [a, b] = octets;
+    if (a === 10)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    // Link-local, as in the 169.254.169.254 metadata address.
+    if (a === 169 && b === 254)
+        return true;
+    return false;
+}
+function isPrivateIpv6(host) {
+    if (!host.includes(":"))
+        return false;
+    // Unique local (fc00::/7) and link-local (fe80::/10).
+    return /^f[cd]/.test(host) || /^fe[89ab]/.test(host);
+}

package/package.json

@@ -1,23 +1,23 @@
 {
   "name": "co-maintainer",
-  "version": "0.4.13",
-  "description": "Analyzes a GitHub repository and writes repository-specific contribution guidance.",
+  "version": "0.5.0-beta.1",
+  "description": "An imitator of yours, A PR review tool like co-maintainer.",
+  "keywords": [
+    "ai",
+    "code-review",
+    "github",
+    "maintainer",
+    "pull-request"
+  ],
+  "homepage": "https://co-maintainer.com",
+  "bugs": {
+    "url": "https://github.com/GroophyLifefor/co-maintainer/issues"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/GroophyLifefor/co-maintainer"
   },
-  "homepage": "https://github.com/GroophyLifefor/co-maintainer#readme",
-  "bugs": {
-    "url": "https://github.com/GroophyLifefor/co-maintainer/issues"
-  },
-  "keywords": [
-    "github",
-    "pull-request",
-    "code-review",
-    "maintainer",
-    "ai"
-  ],
   "bin": {
     "co-maintainer": "dist/main.js"
   },
@@ -34,7 +34,7 @@
     "build": "npm run assets:embed && tsc -p tsconfig.build.json",
     "assets:embed": "node scripts/embed_assets.mjs",
     "prepack": "npm run build",
-    "test": "node --test \"src/**/*.test.ts\" \"benchmark/**/*.test.ts\"",
+    "test": "node --test \"src/**/*.test.ts\" \"scripts/**/*.test.ts\" \"benchmark/**/*.test.ts\"",
     "check": "tsc --noEmit",
     "lint": "oxlint",
     "fmt": "oxfmt --write .",
@@ -43,6 +43,7 @@
     "probe": "node main.ts probe",
     "init": "node main.ts init",
     "remake": "node main.ts remake",
+    "sync": "node main.ts sync",
     "review": "node main.ts review",
     "serve": "node main.ts serve",
     "bench": "node benchmark/core_v2/run.ts",
@@ -52,7 +53,11 @@
     "swe-prbench-prepare": "node benchmark/swe-prbench/prepare_dataset.ts",
     "e2e": "node scripts/e2e.ts",
     "review-local-e2e": "node scripts/review_local_e2e.ts",
-    "docs:build": "node scripts/build_docs.ts"
+    "docs:build": "node scripts/build_docs.ts",
+    "pack:smoke": "node scripts/pack_smoke.ts",
+    "downgrade:check": "node scripts/downgrade_check.ts",
+    "dx:scenario": "node scripts/dx_scenario.ts",
+    "dashboard:smoke": "node scripts/dashboard_smoke.ts"
   },
   "dependencies": {
     "marked": "^15.0.7"
@@ -61,6 +66,7 @@
     "@types/node": "^24.0.0",
     "oxfmt": "^0.68.0",
     "oxlint": "^1.83.0",
+    "playwright": "^1.63.0",
     "typescript": "^5.7.0"
   },
   "engines": {