deuk-agent-flow 4.0.19

package/scripts/lint-rules.mjs

@@ -0,0 +1,186 @@
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+
+const RULE_CHECKS = [
+  {
+    code: "DR-KERNEL-01",
+    message: "Compact kernel must keep ticket-first and tool-contract invariants at the top of the core rules.",
+    test: (rules) => /## Compact Kernel/i.test(rules)
+      && /Tools own detail/i.test(rules)
+      && /No ticket, no writes/i.test(rules)
+      && /User requirements are ticket-first/i.test(rules)
+      && /Existing-ticket close actions are not new-ticket triggers/i.test(rules)
+      && /cause, analysis, and design\/approach/i.test(rules)
+      && /approval or correction creates another ticket update loop/i.test(rules)
+      && /reopen and review the durable ticket body/i.test(rules)
+      && /wait for explicit user approval/i.test(rules)
+      && /Every phase must request and satisfy the tool-provided contract/i.test(rules)
+      && /Phase state has two records/i.test(rules)
+      && /deuk-agent-flow ticket guard/i.test(rules)
+      && /explicit approval validated by `deuk-agent-flow ticket guard`/i.test(rules)
+      && /Verification is mandatory/i.test(rules)
+      && /Completion reports go in the ticket first/i.test(rules)
+      && /terse TDW feedback only/i.test(rules)
+      && /never bypass ticket, scope, generated-file, or verification gates/i.test(rules)
+      && /Shortcut regression guard/i.test(rules)
+      && /temporary passes, bypasses, semantic shrinkage, and language-specific patch branches/i.test(rules)
+      && /Shared-contract guard/i.test(rules)
+      && /Ticket creation failures are hard stops/i.test(rules)
+      && /do not call `set_workflow_context`/i.test(rules)
+  },
+  {
+    code: "DR-TOKEN-01",
+    message: "Low-token mode must stay quiet and compact.",
+    test: (rules) => /Silent-by-default is mandatory/i.test(rules)
+      && /Keep chat compact/i.test(rules)
+      && /Final answers must be short but complete enough/i.test(rules)
+      && /Commentary surface map/i.test(rules)
+      && /Running-surface contract/i.test(rules)
+      && /CLI running-output contract/i.test(rules)
+      && /must not print narrative labels, usage reminders, `file:\/\/` links, or progress text/i.test(rules)
+      && /Shared interrupt contract/i.test(rules)
+      && /When the user complains about verbosity, chatter, progress reports, or over-explaining/i.test(rules)
+      && /Do not switch into meta labeling, terminology lessons, or general explanation/i.test(rules)
+      && /짧게|매우 짧게|한 줄로|간단히/i.test(rules)
+      && /one-sentence or bullet-only/i.test(rules)
+      && /avoid repeating them in chat/i.test(rules)
+  },
+  {
+    code: "DR-PRIORITY-01",
+    message: "Rules must define pointer/core/project instruction precedence.",
+    test: (rules) => /## 0\. Priority/i.test(rules)
+      && /Global DeukAgentFlow pointer/i.test(rules)
+      && /Local generated pointer\/spoke/i.test(rules)
+      && /core-rules\/AGENTS\.md/i.test(rules)
+      && /PROJECT_RULE\.md/i.test(rules)
+  },
+  {
+    code: "DR-BOOT-01",
+    message: "Boot sequence must load core rules, project rules, and ticket context.",
+    test: (rules) => /Boot Sequence \(run once\)/i.test(rules)
+      && /Read this file \(AGENTS\.md\)/i.test(rules)
+      && /Read `PROJECT_RULE\.md`/i.test(rules)
+      && /ticket-start line, reopen and review the durable ticket body, and stop while approval is pending/i.test(rules)
+      && /approval\/correction in the ticket/i.test(rules)
+      && /deuk-agent-flow ticket guard --topic <id> --ticket-started --ticket-reviewed --approval approved/i.test(rules)
+      && /set_workflow_context\(project, ticket_id, phase\)/i.test(rules)
+      && /explicit user approval/i.test(rules)
+  },
+  {
+    code: "DR-TICKET-01",
+    message: "First-turn and discovery behavior must stay ticket-first.",
+    test: (rules) => /First-Turn Invariant/i.test(rules)
+      && /Ticket Discovery \(1-CALL RULE\)/i.test(rules)
+      && /create the ticket first/i.test(rules)
+      && /reopen and review the durable ticket body/i.test(rules)
+      && /wait for explicit user approval/i.test(rules)
+      && /update the ticket with that new input/i.test(rules)
+      && /If that correction arrives during `approved_execution`, `command_running`, or `search_running`, treat it as an immediate interrupt/i.test(rules)
+      && /If the user asks only for commit\/report\/archive\/close/i.test(rules)
+      && /reuse that ticket and continue through Phase 4/i.test(rules)
+      && /create a new ticket only if the user adds new implementation, new investigation, or a broader scope/i.test(rules)
+      && /deuk-agent-flow ticket guard --ticket-started --ticket-reviewed --approval approved/i.test(rules)
+      && /do not run repo inspection commands/i.test(rules)
+      && /deuk-agent-flow ticket create` or `deuk-agent-flow ticket use/i.test(rules)
+      && /Do not start with `git status`, `rg`, `find`, diffs, or broad help output/i.test(rules)
+      && /Do not use `deuk-agent-flow ticket list` for discovery/i.test(rules)
+  },
+  {
+    code: "DR-CHANGE-01",
+    message: "Phase contract must require tool-provided requirements and block shortcuts.",
+    test: (rules) => /Phase Contract/i.test(rules)
+      && /complete requirement bundle/i.test(rules)
+      && /Required ticket fields\/tasks/i.test(rules)
+      && /Scope boundaries, generated\/source mapping/i.test(rules)
+      && /Do not invent a shortcut/i.test(rules)
+  },
+  {
+    code: "DR-LIFECYCLE-01",
+    message: "Lifecycle must cover phases, durable records, and compact chat.",
+    test: (rules) => /Ticket Lifecycle/i.test(rules)
+      && /Phase 0/i.test(rules)
+      && /Phase 4/i.test(rules)
+      && /cause, analysis, design\/approach/i.test(rules)
+      && /findings, hypotheses, scope, compact plan, and phase contract/i.test(rules)
+      && /verification outcome, completion report, residual risk, and a follow-up decision/i.test(rules)
+      && /Keep chat compact once the ticket carries the durable record/i.test(rules)
+  },
+  {
+    code: "DR-GATE-01",
+    message: "Hard stops must block missing contracts, unsafe scope, and premature execution.",
+    test: (rules) => /Hard Stops/i.test(rules)
+      && /missing phase contract/i.test(rules)
+      && /generated\/source uncertainty/i.test(rules)
+      && /shared-interface changes/i.test(rules)
+      && /Stop for shortcut regressions/i.test(rules)
+      && /verification that proves only the workaround instead of the shared contract/i.test(rules)
+      && /repo inspection started before ticket selection or creation/i.test(rules)
+      && /same TDW failure family appears twice/i.test(rules)
+      && /read-only until the ticket records findings/i.test(rules)
+  },
+  {
+    code: "DR-HALT-01",
+    message: "Kernel must still define halt conditions and file guards.",
+    test: (rules) => /Hard Stops/i.test(rules)
+      && /generated\/source uncertainty/i.test(rules)
+      && /missing tests/i.test(rules)
+  },
+  {
+    code: "DR-CHURN-01",
+    message: "Repeated symptom fixes must trigger stabilization instead of ticket churn.",
+    test: (rules) => /Hard Stops/i.test(rules)
+      && /stabilization or root-cause ticket/i.test(rules)
+      && /same failure family/i.test(rules)
+  },
+  {
+    code: "DR-CLI-01",
+    message: "Tool delegation and CLI ownership must stay explicit.",
+    test: (rules) => /Tool Delegation/i.test(rules)
+      && /Use `rg`\/`rg --files` first/i.test(rules)
+      && /Use MCP\/RAG only when local evidence is insufficient/i.test(rules)
+      && /Let CLI own lifecycle enforcement, claim checks, reports, and audits/i.test(rules)
+      && /AgentFlow Skill Status/i.test(rules)
+      && /deuk-agent-flow skill list/i.test(rules)
+      && /rules audit/i.test(rules)
+  }
+];
+
+export function auditRules(cwd = process.cwd()) {
+  const rulesPath = join(cwd, "core-rules", "AGENTS.md");
+  if (!existsSync(rulesPath)) {
+    return {
+      ok: false,
+      path: rulesPath,
+      violations: [{ code: "DR-RULES-00", message: "core-rules/AGENTS.md not found" }]
+    };
+  }
+
+  const rules = readFileSync(rulesPath, "utf8");
+  const violations = RULE_CHECKS
+    .filter((check) => !check.test(rules))
+    .map(({ code, message }) => ({ code, message }));
+
+  return { ok: violations.length === 0, path: rulesPath, violations };
+}
+
+export function runRulesAudit(opts = {}) {
+  const result = auditRules(opts.cwd || process.cwd());
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else if (opts.compact) {
+    console.log(result.ok ? "rules:audit ok" : `rules:audit failed ${result.violations.length}`);
+  } else if (result.ok) {
+    console.log("rules:audit ok");
+  } else {
+    console.error("rules:audit failed");
+    for (const violation of result.violations) {
+      console.error(`${violation.code}: ${violation.message}`);
+    }
+  }
+
+  if (!result.ok) {
+    throw new Error(`rules audit failed: ${result.violations.map((v) => v.code).join(", ")}`);
+  }
+
+  return result;
+}

package/scripts/merge-logic.mjs

@@ -0,0 +1,44 @@
+import {
+  existsSync,
+  readFileSync,
+} from "fs";
+import { join } from "path";
+
+export const DEFAULT_TAG = "DeukAgentFlow";
+
+export function readBundleAgents(bundleRoot) {
+  const p = join(bundleRoot, "core-rules", "AGENTS.md");
+  if (!existsSync(p)) {
+    throw new Error("Bundle AGENTS.md missing: " + p);
+  }
+  return readFileSync(p, "utf8");
+}
+
+export function removeTaggedBlock(content, begin, end) {
+  const i = content.indexOf(begin);
+  if (i === -1) {
+    return { ok: false, reason: "begin not found" };
+  }
+  if (end === null) {
+    let blockStart = i;
+    const prevText = content.slice(0, i);
+    const hrIndex = prevText.lastIndexOf("---");
+    if (hrIndex !== -1 && prevText.slice(hrIndex).trim() === "") {
+        blockStart = hrIndex;
+    }
+    let next = content.slice(0, blockStart).trimEnd() + "\n";
+    return { ok: true, content: next };
+  }
+  
+  const j = content.indexOf(end, i + begin.length);
+  if (j === -1) {
+    return { ok: false, reason: "end not found" };
+  }
+  const afterEnd = j + end.length;
+  let next = content.slice(0, i) + content.slice(afterEnd);
+  next = next.replace(/\n{3,}/g, "\n\n").replace(/^\n+/, "").trimEnd();
+  if (next.length) {
+    next += "\n";
+  }
+  return { ok: true, content: next };
+}

package/scripts/plan-parser.mjs

@@ -0,0 +1,53 @@
+/**
+ * Generic Markdown Plan Parser
+ * 
+ * Supports various AI Agent Plan formats (Antigravity, Copilot, etc.)
+ * Extracts basic ticket fields (title, summary, tasks) and body.
+ */
+
+export function parseGenericMarkdownPlan(content) {
+  const lines = content.split('\n');
+  
+  // 1. Title: First H1
+  const h1Line = lines.find(l => /^# /.test(l));
+  const title = h1Line ? h1Line.replace(/^# /, '').trim() : '';
+
+  // 2. Summary: Text between H1 and the first --- or ##
+  const h1Idx = h1Line ? lines.indexOf(h1Line) : -1;
+  let summaryLines = [];
+  for (let i = h1Idx + 1; i < lines.length; i++) {
+    if (/^---$/.test(lines[i].trim()) || /^## /.test(lines[i])) break;
+    if (lines[i].trim()) summaryLines.push(lines[i].trim());
+  }
+  const summary = summaryLines.join(' ').slice(0, 200);
+
+  // 3. Tasks: Collect all checklist items
+  const tasks = lines
+    .filter(l => /^\s*- \[[ x/]\]/.test(l))
+    .map(l => l.replace(/^\s*- \[[ x/]\]\s*/, '').trim());
+
+  return { title, summary, tasks, body: content };
+}
+
+/**
+ * Detect agent type from plan path
+ */
+export function detectAgentFromPath(planPath) {
+  if (planPath.includes('.gemini')) return 'antigravity';
+  if (planPath.includes('copilot') || planPath.includes('.codex')) return 'copilot';
+  if (planPath.includes('.cursor')) return 'cursor';
+  if (planPath.includes('.claude')) return 'claude';
+  return 'generic';
+}
+
+export const PLAN_PARSERS = {
+  'antigravity': parseGenericMarkdownPlan,
+  'copilot': parseGenericMarkdownPlan,
+  'generic': parseGenericMarkdownPlan
+};
+
+export function parsePlan(planPath, content) {
+  const agent = detectAgentFromPath(planPath);
+  const parser = PLAN_PARSERS[agent] || parseGenericMarkdownPlan;
+  return parser(content);
+}

package/scripts/publish-dual-npm.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import { spawnSync } from "child_process";
+import { fileURLToPath } from "url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const rootDir = join(__dirname, "..");
+const aliasDir = join(rootDir, "packages", "deuk-agent-rule");
+
+export function buildAliasPackageJson(rootPkg, currentAliasPkg = {}) {
+  const version = rootPkg.version;
+  return {
+    ...currentAliasPkg,
+    name: "deuk-agent-rule",
+    version,
+    description: "Compatibility wrapper for legacy deuk-agent-rule installs.",
+    keywords: [
+      "agents-md",
+      "agent-flow",
+      "agent-workflow",
+      "ai-guardrails",
+      "agent-guardrails",
+      "deuk-family",
+    ],
+    license: rootPkg.license || currentAliasPkg.license || "Apache-2.0",
+    repository: rootPkg.repository,
+    bugs: rootPkg.bugs,
+    homepage: rootPkg.homepage,
+    files: ["bin/**/*", "README.md"],
+    bin: {
+      "deuk-agent-rule": "./bin/deuk-agent-rule.js",
+      deukagentrule: "./bin/deuk-agent-rule.js",
+    },
+    engines: rootPkg.engines || currentAliasPkg.engines || { node: ">=18" },
+    dependencies: {
+      "deuk-agent-flow": version,
+    },
+  };
+}
+
+function readJson(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+
+function writeJson(path, value) {
+  writeFileSync(path, JSON.stringify(value, null, 2) + "\n", "utf8");
+}
+
+function run(command, args, cwd) {
+  const shown = [command, ...args].join(" ");
+  console.log(`\n$ ${shown}`);
+  const result = spawnSync(command, args, { cwd, stdio: "inherit" });
+  if (result.status !== 0) {
+    process.exit(result.status || 1);
+  }
+}
+
+export function syncAliasPackageJson(paths = {}) {
+  const rootPackagePath = paths.rootPackagePath || join(rootDir, "package.json");
+  const aliasPackagePath = paths.aliasPackagePath || join(aliasDir, "package.json");
+  const rootPkg = readJson(rootPackagePath);
+  const aliasPkg = readJson(aliasPackagePath);
+  const nextAliasPkg = buildAliasPackageJson(rootPkg, aliasPkg);
+  writeJson(aliasPackagePath, nextAliasPkg);
+  return nextAliasPkg;
+}
+
+function parseArgs(argv) {
+  const opts = {
+    dryRun: false,
+    access: "public",
+    tag: null,
+    otp: null,
+    skipTests: false,
+    skipSmoke: false,
+    aliasOnly: false,
+  };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--dry-run") opts.dryRun = true;
+    else if (arg === "--skip-tests") opts.skipTests = true;
+    else if (arg === "--skip-smoke") opts.skipSmoke = true;
+    else if (arg === "--alias-only") opts.aliasOnly = true;
+    else if (arg === "--access") opts.access = argv[++i];
+    else if (arg === "--tag") opts.tag = argv[++i];
+    else if (arg === "--otp") opts.otp = argv[++i];
+    else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  return opts;
+}
+
+function publishArgs(opts) {
+  const args = ["publish", "--access", opts.access, "--ignore-scripts"];
+  if (opts.tag) args.push("--tag", opts.tag);
+  if (opts.otp) args.push("--otp", opts.otp);
+  if (opts.dryRun) args.push("--dry-run");
+  return args;
+}
+
+export function main(argv = process.argv.slice(2)) {
+  if (process.env.npm_command === "publish" && process.env.npm_lifecycle_event === "publish") {
+    console.log("Skipping scripts.publish during npm publish lifecycle.");
+    return;
+  }
+
+  const opts = parseArgs(argv);
+  const aliasPkg = syncAliasPackageJson();
+
+  const packageLabel = opts.aliasOnly ? "deuk-agent-rule" : "deuk-agent-flow and deuk-agent-rule";
+  console.log(`Publishing ${packageLabel} at ${aliasPkg.version}`);
+  if (opts.dryRun) {
+    console.log("Dry-run mode: npm will build and validate packages without registry writes.");
+  }
+
+  if (!opts.skipTests) {
+    run("npm", ["test"], rootDir);
+  }
+  if (!opts.skipSmoke) {
+    run("node", ["scripts/smoke-npm-local.mjs"], rootDir);
+  }
+
+  const args = publishArgs(opts);
+  if (!opts.aliasOnly) {
+    run("npm", args, rootDir);
+  }
+  run("npm", args, aliasDir);
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  try {
+    main();
+  } catch (error) {
+    console.error(error.message);
+    process.exit(1);
+  }
+}

package/scripts/smoke-npm-docker.mjs

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "fs";
+import { join, resolve } from "path";
+import { spawnSync } from "child_process";
+import { tmpdir } from "os";
+
+const rootDir = resolve(new URL("..", import.meta.url).pathname);
+const aliasDir = join(rootDir, "packages", "deuk-agent-rule");
+const workDir = mkdtempSync(join(tmpdir(), "deuk-agent-flow-docker-smoke-"));
+
+function run(command, args, cwd, opts = {}) {
+  const shown = [command, ...args].join(" ");
+  console.log(`\n$ ${shown}`);
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    stdio: opts.capture ? "pipe" : "inherit",
+  });
+  if (result.status !== 0) {
+    if (opts.capture) {
+      if (result.stdout) process.stdout.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+    }
+    throw new Error(`command failed: ${shown}`);
+  }
+  return result;
+}
+
+function readJson(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+
+function pack(cwd) {
+  const result = run("npm", ["pack", "--json", "--pack-destination", workDir], cwd, { capture: true });
+  const rows = JSON.parse(result.stdout);
+  const filename = rows[0]?.filename;
+  if (!filename) throw new Error(`npm pack did not return a filename for ${cwd}`);
+  const tarball = join(workDir, filename);
+  if (!existsSync(tarball)) throw new Error(`packed tarball missing: ${tarball}`);
+  return filename;
+}
+
+try {
+  const rootPkg = readJson(join(rootDir, "package.json"));
+  const aliasPkg = readJson(join(aliasDir, "package.json"));
+
+  if (rootPkg.name !== "deuk-agent-flow") {
+    throw new Error(`expected root package deuk-agent-flow, got ${rootPkg.name}`);
+  }
+  if (aliasPkg.name !== "deuk-agent-rule") {
+    throw new Error(`expected legacy package deuk-agent-rule, got ${aliasPkg.name}`);
+  }
+  if (aliasPkg.dependencies?.["deuk-agent-flow"] !== rootPkg.version) {
+    throw new Error(`deuk-agent-rule must depend on deuk-agent-flow@${rootPkg.version}`);
+  }
+
+  const flowTarball = pack(rootDir);
+  const ruleTarball = pack(aliasDir);
+  const image = process.env.DEUK_SMOKE_NODE_IMAGE || "node:20-bookworm";
+  const keepDir = Boolean(process.env.DEUK_KEEP_SMOKE_DIR);
+
+  console.log(`\nSmoke sandbox: ${workDir}`);
+  console.log(`Docker image: ${image}`);
+
+  const script = [
+    "set -eu",
+    "node --version",
+    "npm --version",
+    "mkdir -p /tmp/consumer",
+    "npm install -g /pkg/" + flowTarball + " /pkg/" + ruleTarball,
+    "command -v deuk-agent-flow",
+    "command -v deuk-agent-rule",
+    "deuk-agent-flow --help >/tmp/deuk-agent-flow-help.txt",
+    "deuk-agent-rule --help >/tmp/deuk-agent-rule-help.txt",
+    "cd /tmp/consumer",
+    "mkdir -p .codex",
+    "deuk-agent-flow init --non-interactive --workflow execute --docs-language ko --agents skip",
+    "test -f .codex/AGENTS.md",
+    "test -f PROJECT_RULE.md",
+    "test -d .deuk-agent",
+    "test -d .deuk-agent/templates",
+    "test -d .deuk-agent/skill-templates",
+  ].join("\n");
+
+  run("docker", [
+    "run",
+    "--rm",
+    "-v",
+    `${workDir}:/pkg:ro`,
+    image,
+    "bash",
+    "-lc",
+    script,
+  ], rootDir);
+
+  console.log("\nDocker npm smoke ok");
+  if (keepDir) console.log(`Kept smoke sandbox: ${workDir}`);
+} finally {
+  if (!process.env.DEUK_KEEP_SMOKE_DIR) {
+    rmSync(workDir, { recursive: true, force: true });
+  }
+}

package/scripts/smoke-npm-local.mjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "fs";
+import { delimiter, join, resolve } from "path";
+import { spawnSync } from "child_process";
+import { tmpdir } from "os";
+
+const rootDir = resolve(new URL("..", import.meta.url).pathname);
+const aliasDir = join(rootDir, "packages", "deuk-agent-rule");
+const workDir = mkdtempSync(join(tmpdir(), "deuk-agent-flow-local-smoke-"));
+const prefixDir = join(workDir, "prefix");
+
+function run(command, args, cwd, opts = {}) {
+  const shown = [command, ...args].join(" ");
+  console.log(`\n$ ${shown}`);
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    env: opts.env || process.env,
+    stdio: opts.capture ? "pipe" : "inherit",
+  });
+  if (result.status !== 0) {
+    if (opts.capture) {
+      if (result.stdout) process.stdout.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+    }
+    throw new Error(`command failed: ${shown}`);
+  }
+  return result;
+}
+
+function readJson(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+
+function pack(cwd, expected) {
+  const result = run("npm", ["pack", "--json", "--pack-destination", workDir], cwd, { capture: true });
+  const rows = JSON.parse(result.stdout);
+  const row = rows[0];
+  const filename = row?.filename;
+  if (!filename) throw new Error(`npm pack did not return a filename for ${cwd}`);
+  const tarball = join(workDir, filename);
+  if (!existsSync(tarball)) throw new Error(`packed tarball missing: ${tarball}`);
+
+  const fileSet = new Set((row.files || []).map(file => file.path));
+  for (const path of expected.files) {
+    if (!fileSet.has(path)) throw new Error(`${expected.name} tarball missing required file: ${path}`);
+  }
+  return { filename, tarball };
+}
+
+function globalBinDir(prefix) {
+  return process.platform === "win32" ? prefix : join(prefix, "bin");
+}
+
+function assertGlobalCommand(binDir, name) {
+  const script = process.platform === "win32" ? join(binDir, `${name}.cmd`) : join(binDir, name);
+  if (!existsSync(script)) throw new Error(`global command shim missing: ${script}`);
+  if (process.platform !== "win32") {
+    const mode = statSync(script).mode;
+    if ((mode & 0o111) === 0) throw new Error(`global command is not executable: ${script}`);
+  }
+}
+
+try {
+  const rootPkg = readJson(join(rootDir, "package.json"));
+  const aliasPkg = readJson(join(aliasDir, "package.json"));
+  if (aliasPkg.dependencies?.["deuk-agent-flow"] !== rootPkg.version) {
+    throw new Error(`deuk-agent-rule must depend on deuk-agent-flow@${rootPkg.version}`);
+  }
+
+  const flow = pack(rootDir, {
+    name: "deuk-agent-flow",
+    files: [
+      "bin/deuk-agent-flow.js",
+      "bin/deuk-agent-rule.js",
+      "scripts/cli.mjs",
+      "scripts/cli-ticket-commands.mjs",
+      "scripts/lint-md.mjs",
+      "scripts/lint-rules.mjs",
+      "package.json",
+    ],
+  });
+  const rule = pack(aliasDir, {
+    name: "deuk-agent-rule",
+    files: [
+      "bin/deuk-agent-rule.js",
+      "package.json",
+      "README.md",
+    ],
+  });
+
+  run("npm", ["install", "-g", "--prefix", prefixDir, flow.tarball, rule.tarball], rootDir);
+
+  const binDir = globalBinDir(prefixDir);
+  const pathEnv = [binDir, process.env.PATH || ""].join(delimiter);
+  const env = { ...process.env, PATH: pathEnv };
+
+  for (const command of ["deuk-agent-flow", "deukagentflow", "deuk-agent-rule", "deukagentrule"]) {
+    assertGlobalCommand(binDir, command);
+    run(command, ["--help"], rootDir, { env, capture: true });
+  }
+
+  console.log(`\nLocal npm install smoke ok (${process.platform})`);
+  console.log(`Checked tarballs: ${flow.filename}, ${rule.filename}`);
+} finally {
+  if (!process.env.DEUK_KEEP_SMOKE_DIR) {
+    rmSync(workDir, { recursive: true, force: true });
+  }
+}