forge-workflow 0.1.0-beta.5 → 0.1.0-beta.6

package/lib/commands/ship.js

@@ -14,6 +14,7 @@ const path = require('node:path');
 
 const { fireAndForget } = require('../pr-monitor/reconcile-executor');
 const { getResolvedRuntimeGraph } = require('../core/runtime-graph');
+const { resolveBaseRemote, resolveBaseBranch } = require('../base-remote');
 
 const AUTO_SHEPHERD_RAIL = 'rail.auto_shepherd';
 
@@ -65,72 +66,6 @@ function getQuietGitExecOptions(cwd = process.cwd()) {
 	return { ...getGitExecOptions(cwd), stdio: 'pipe' };
 }
 
-function resolveRemoteHeadTarget(exec = execFileSync, cwd = process.cwd(), remoteName) {
-	try {
-		const symbolicRef = exec('git', ['symbolic-ref', `refs/remotes/${remoteName}/HEAD`], getQuietGitExecOptions(cwd)).trim();
-		if (!symbolicRef) {
-			return null;
-		}
-		exec('git', ['rev-parse', '--verify', symbolicRef], getQuietGitExecOptions(cwd));
-		return symbolicRef;
-	} catch (_error) {
-		return null;
-	}
-}
-
-function remoteHasTrackingBase(exec = execFileSync, cwd = process.cwd(), remoteName) {
-	if (resolveRemoteHeadTarget(exec, cwd, remoteName)) {
-		return true;
-	}
-
-	for (const candidate of ['main', 'master']) {
-		try {
-			exec('git', ['rev-parse', '--verify', `refs/remotes/${remoteName}/${candidate}`], getQuietGitExecOptions(cwd));
-			return true;
-		} catch (_error) {
-			// Probe next candidate.
-		}
-	}
-
-	return false;
-}
-
-function resolveBaseRemote(exec = execFileSync, cwd = process.cwd()) {
-	for (const candidate of ['upstream', 'origin']) {
-		try {
-			exec('git', ['remote', 'get-url', candidate], getQuietGitExecOptions(cwd));
-			if (remoteHasTrackingBase(exec, cwd, candidate)) {
-				return candidate;
-			}
-		} catch (_error) {
-			// Probe next candidate.
-		}
-	}
-
-	return 'origin';
-}
-
-function resolveBaseBranch(exec = execFileSync, cwd = process.cwd(), remoteName = resolveBaseRemote(exec, cwd)) {
-	const symbolicRef = resolveRemoteHeadTarget(exec, cwd, remoteName);
-	if (symbolicRef) {
-		const match = new RegExp(`^refs/remotes/${remoteName}/(.+)$`).exec(symbolicRef);
-		if (match && match[1]) {
-			return match[1];
-		}
-	}
-
-	for (const candidate of ['main', 'master']) {
-		try {
-			exec('git', ['rev-parse', '--verify', `refs/remotes/${remoteName}/${candidate}`], getQuietGitExecOptions(cwd));
-			return candidate;
-		} catch (_error) {
-			// Probe next candidate.
-		}
-	}
-
-	return 'master';
-}
-
 function refreshBaseReference(exec = execFileSync, cwd = process.cwd(), remoteName, baseBranch) {
 	exec(
 		'git',
@@ -457,10 +392,13 @@ function validatePRTitle(title) {
 
 async function createPR(options) { // NOSONAR S3776
 	const { title, body, dryRun = false, exec = execFileSync, cwd = process.cwd() } = options;
+	const gh = options.githubContext?.bound
+		? (args, runOptions) => options.githubContext.runGh(args, runOptions)
+		: (args, runOptions) => exec('gh', args, runOptions);
 	const titleValidation = validatePRTitle(title);
 	if (!titleValidation.valid) return { success: false, error: titleValidation.error };
 	try {
-		exec('gh', ['--version'], { ...getGhCheckOptions(), cwd });  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+		gh(['--version'], { ...getGhCheckOptions(), cwd });
 	} catch (error) {
 		if (isCommandNotFound(error)) {
 			return { success: false, error: 'GitHub CLI (gh) not found. Install from: https://cli.github.com/' };
@@ -495,7 +433,7 @@ async function createPR(options) { // NOSONAR S3776
 		return { success: true, message: '[DRY RUN] Would create PR with title: ' + title, prUrl: 'https://github.com/owner/repo/pull/1' };
 	}
 	try {
-		const result = exec('gh', ['pr', 'create', '--title', title, '--body', body], getGitExecOptions(cwd));  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+		const result = gh(['pr', 'create', '--title', title, '--body', body], getGitExecOptions(cwd));
 		const urlMatch = /https:\/\/github\.com\/[^\s]+/.exec(result);
 		const prUrl = urlMatch ? urlMatch[0] : null;
 		const numberMatch = /\/pull\/(\d+)/.exec(result);
@@ -585,7 +523,10 @@ async function executeShip(options) {
 			testScenarios,
 			coverage,
 		});
-		const result = await createPr({ title, body: prBody, dryRun });
+		const result = await createPr({
+			title, body: prBody, dryRun,
+			exec: options.exec, cwd: options.cwd || projectRoot, githubContext: options.githubContext,
+		});
 		if (!result.success) return result;
 		maybeTriggerShepherdAfterShip({ dryRun, projectRoot, fireAndForget: trigger });
 		return {
@@ -601,6 +542,7 @@ async function executeShip(options) {
 
 module.exports = {
 	name: 'ship',
+	githubAuth: true,
 	description: 'Create a pull request from validated feature work',
 	handler: async (args, flags = {}, projectRoot = process.cwd(), deps = {}) => {
 		const result = await executeShip({
@@ -609,6 +551,10 @@ module.exports = {
 			dryRun: Boolean(flags.dryRun || flags['--dry-run']),
 			projectRoot,
 			fireAndForget: deps.fireAndForget,
+			exec: deps.exec,
+			cwd: deps.cwd || projectRoot,
+			githubContext: deps.githubContext,
+			createPr: deps.createPr,
 		});
 		if (!result.success) {
 			return result;

package/lib/commands/skill.js

@@ -23,6 +23,7 @@ const { runBehavioralEvaluation } = require('../../scripts/lib/behavioral-eval-r
 const { resolveBehavioralEvaluation } = require('../../scripts/lib/behavioral-eval-runtime');
 const { loadPromotionEvidence } = require('../../scripts/lib/promotion-evidence-loader');
 const { scorePromotion } = require('../../scripts/lib/promotion-scorecard');
+const { createGithubContext } = require('../github-context');
 
 const BEHAVIORAL_TIERS = Object.freeze([30, 100, 300]);
 const BEHAVIORAL_TIER_VALUES = new Set(BEHAVIORAL_TIERS.map(String));
@@ -158,12 +159,19 @@ async function handleFullEval(rest, flags, projectRoot, opts) {
   let behavioralOptions = opts.behavioralOptions || {};
   if (!opts.runBehavioralEvaluation || opts.resolveBehavioralEvaluation) {
     const resolver = opts.resolveBehavioralEvaluation || resolveBehavioralEvaluation;
+    let githubContext;
+    try {
+      githubContext = (opts.prepareGithubContext || createGithubContext)(projectRoot);
+    } catch {
+      return { success: false, error: 'Unable to prepare GitHub account context. Run forge github status for guidance.' };
+    }
     const resolved = await resolver({
       projectRoot,
       skillName: name,
       skillPath: path.join(ctx.skillsDir, name, 'SKILL.md'),
       tier,
       env: opts.env || process.env,
+      ...(githubContext.bound ? { deps: { runGh: githubContext.runGh } } : {}),
     });
     if (!resolved.ok) return formatResult(scoreResult(resolved.result));
     behavioralOptions = { ...resolved.options, ...behavioralOptions };

package/lib/commands/team.js

@@ -1,7 +1,25 @@
 const { existsSync } = require('node:fs');
 const { execFileSync } = require('node:child_process');
 const path = require('node:path');
-const { getPackageRoot } = require('../package-root');
+const { getPackageRoot, isCompiledBinary } = require('../package-root');
+const { firstPositionalIndex, stripGlobalFlags } = require('../global-flags');
+
+function teamArguments(args) {
+  const subcommandIndex = firstPositionalIndex(args);
+  if (subcommandIndex === -1) return stripGlobalFlags(args);
+  const result = stripGlobalFlags(args.slice(0, subcommandIndex));
+  // Path is routing metadata anywhere; other flags after the subcommand belong to Team.
+  for (let index = subcommandIndex; index < args.length; index++) {
+    const arg = args[index];
+    if (arg.startsWith('--path=')) continue;
+    if (arg === '-p' || arg === '--path') {
+      if (args[index + 1] !== undefined && !args[index + 1].startsWith('-')) index++;
+    } else {
+      result.push(arg);
+    }
+  }
+  return result;
+}
 
 // Resolve bash binary from fixed, known locations only (no PATH search).
 // SonarCloud S4036: PATH must not be searched for OS commands.
@@ -22,28 +40,49 @@ function _resolveBash() {
   return '/usr/bin/bash';
 }
 
-function handleTeam(args) {
+function handleTeam(args, projectRoot = process.cwd(), deps = {}) {
   // Route through the asset root so `forge team` finds the script in BOTH channels:
   // the on-disk package (npm/npx) and a compiled binary (extracted embed dir).
-  const scriptPath = path.join(getPackageRoot(), 'scripts', 'forge-team', 'index.sh');
+  const packageRoot = getPackageRoot();
+  const scriptPath = path.join(packageRoot, 'scripts', 'forge-team', 'index.sh');
   const bashPath = _resolveBash();
+  const runFile = deps.execFileSync || execFileSync;
+  const options = { stdio: 'inherit' };
+  if (deps.githubContext?.bound) {
+    // Bash also runs Git/Forge/helpers. Only the re-entering gh bridge may resolve credentials.
+    const compiled = (deps.isCompiledBinary || isCompiledBinary)();
+    const env = { ...(deps.env || process.env) };
+    for (const key of Object.keys(env)) {
+      if (['gh_token', 'github_token', 'gh_host'].includes(key.toLowerCase())) delete env[key];
+    }
+    options.cwd = projectRoot;
+    options.env = {
+      ...env,
+      GH_CMD: path.join(packageRoot, 'scripts', 'github-context-bridge.sh').replaceAll('\\', '/'),
+      FORGE_GITHUB_RUNTIME: process.execPath.replaceAll('\\', '/'),
+      FORGE_GITHUB_ENTRY: compiled ? '' : path.join(packageRoot, 'bin', 'forge.js').replaceAll('\\', '/'),
+    };
+  }
 
   try {
-    execFileSync(bashPath, [scriptPath, ...args], {
-      stdio: 'inherit',
-    });
+    runFile(bashPath, [scriptPath, ...teamArguments(args)], options);
   } catch (err) {
     process.exit(err.status || 1);
   }
 }
 
-async function handler(args = []) {
-  handleTeam(args);
+async function handler(args, _flags, projectRoot, deps = {}) {
+  handleTeam(args || [], projectRoot, deps);
   return { success: true };
 }
 
 module.exports = {
   name: 'team',
+  githubAuth: (args = []) => {
+    const teamArgs = teamArguments(args);
+    return ['add', 'verify', 'sync', 'claim'].includes(teamArgs[0])
+      || (teamArgs[0] === 'workload' && teamArgs.slice(1).some(arg => arg.replace(/\r$/, '') === '--me'));
+  },
   description: 'Team coordination workflows and sync utilities',
   handler,
   handleTeam

package/lib/commands/test.js

@@ -32,6 +32,9 @@ const DIRECT_TEST_CANDIDATES = Object.freeze({
 		'test/cli-flags.test.js',
 		'test/forge-cli-registry.test.js',
 		'test/setup-runtime-flags.test.js',
+		'test/github-launcher.test.js',
+		'test/integration/github-account-context.test.js',
+		'test/structural/github-account-public-surface.test.js',
 	],
 	// The second CLI surface (command descriptions + shepherd wiring). Without an
 	// entry here it resolves to zero tests and pushes fall back to the full suite.
@@ -47,15 +50,143 @@ const DIRECT_TEST_CANDIDATES = Object.freeze({
 		'test/doc-assertions.test.js',
 		'test/scripts/doc-asserting-tests.test.js',
 	],
+	// The suites that assert the repo .gitignore's actual content. The path is
+	// already known to the classifier, so without candidates here it resolves
+	// zero tests and a one-line ignore addition pays the full-suite lane.
+	'.gitignore': [
+		'test/check-forge-token.test.js',
+		'test/cleanup/dropped-agent-config.test.js',
+		'test/coverage-config.test.js',
+		'test/eval/eval-history.test.js',
+		'test/freshness-token.test.js',
+		'test/mutation-config.test.js',
+		'test/test-dashboard.test.js',
+	],
 	'lib/lefthook-check.js': ['test/lefthook-check.test.js', 'test/runtime-health.test.js'],
 	'lib/runtime-health.js': ['test/runtime-health.test.js'],
 	// skill-eval hosts the accuracy-lint detectors (auditCommandDocumentation /
 	// auditRouterPrecision), so edits there must also run their detector suite.
 	'lib/skill-eval.js': ['test/skill-eval.test.js', 'test/skill-accuracy.test.js'],
+	// Schema is shared by every kernel authority; keep it on the full-suite lane.
+	'lib/kernel/schema.js': [],
+	// Migrations have consumers across the kernel; an empty mapping deliberately
+	// selects the full-suite lane, matching the shared SQLite driver.
+	'lib/kernel/migrations.js': [],
+	'lib/commands/shepherd.js': [
+		'test/commands/shepherd.test.js',
+		'test/commands/github-route-matrix.test.js',
+		'test/pr-monitor/arm-on-push.test.js',
+		'test/pr-monitor/shepherd-watch.test.js',
+		'test/pr-monitor/watch-owner-cutover.test.js',
+		'test/pr-monitor/watch-owner-launch-contention.test.js',
+		'test/pr-monitor/watch-owner-launch-gate.test.js',
+	],
+	'lib/commands/github.js': [
+		'test/commands/github.test.js',
+		'test/github-launcher.test.js',
+		'test/integration/github-account-context.test.js',
+	],
+	'lib/github-context.js': ['test/github-context.test.js', 'test/integration/github-account-context.test.js'],
+	'lib/commands/_registry.js': [
+		'test/commands/_registry.test.js',
+		'test/commands/_registry-github-context.test.js',
+	],
+	'lib/commands/pr.js': ['test/commands/pr.test.js', 'test/commands/github-route-matrix.test.js'],
+	'lib/commands/ship.js': ['test/commands/ship.test.js', 'test/commands/github-route-matrix.test.js'],
+	'lib/commands/merge.js': ['test/commands/merge.test.js', 'test/commands/github-route-matrix.test.js'],
+	'lib/commands/team.js': ['test/commands/team.test.js', 'test/commands/github-route-matrix.test.js'],
+	'lib/commands/clean.js': ['test/commands/clean.test.js', 'test/commands/github-route-matrix.test.js'],
+	'scripts/github-context-bridge.sh': ['test/commands/github-route-matrix.test.js'],
+	'lib/commands/push.js': ['test/commands/push.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'lib/commands/hooks.js': ['test/commands/hooks.test.js', 'test/hooks-session-start.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'lib/commands/serve.js': ['test/commands/serve.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'lib/commands/skill.js': ['test/commands/skill.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'scripts/lib/behavioral-eval-runtime.js': ['test/eval/behavioral-eval-runtime.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'web/dashboard/generate-snapshot.mjs': ['test/commands/github-indirect-routes.test.js'],
+	// The shared SQLite driver has more consumers than a bounded direct list can
+	// safely represent; its empty mapping deliberately selects the full-suite lane.
+	'lib/kernel/sqlite-driver.js': [],
+	'lib/pr-monitor/watch-owner.js': [
+		'test/pr-monitor/watch-owner.test.js',
+		'test/kernel/watch-owner-transaction.test.js',
+	],
+	'lib/pr-monitor/reconcile.js': [
+		'test/pr-monitor/reconcile.test.js',
+		'test/pr-monitor/reconcile-owner-authority.test.js',
+	],
+	'lib/pr-monitor/reconcile-executor.js': [
+		'test/commands/github-indirect-routes.test.js',
+		'test/pr-monitor/auto-trigger-containment.test.js',
+		'test/pr-monitor/reconcile-executor-owner-authority.test.js',
+		'test/pr-monitor/reconcile-executor.test.js',
+		'test/pr-monitor/reconcile-daemon-owner-authority.test.js',
+		'test/pr-monitor/reconcile-migration-gate.test.js',
+		'test/pr-monitor/watch-owner-launch-contention.test.js',
+		'test/windows-hide-background-spawns.test.js',
+	],
+	'lib/pr-monitor/watch.js': [
+		'test/pr-monitor/watch-owner-cutover.test.js',
+		'test/pr-monitor/watch.test.js',
+	],
+	'lib/pr-monitor/watch-lifecycle.js': [
+		'test/commands/github-indirect-routes.test.js',
+		'test/pr-monitor/watch-lifecycle.test.js',
+		'test/pr-monitor/watch-owner-launch-contention.test.js',
+		'test/pr-monitor/watch-owner-launch-gate.test.js',
+	],
+	'lib/pr-monitor/shepherd-lease.js': [
+		'test/pr-monitor/shepherd-lease.test.js',
+		'test/pr-monitor/shepherd-lease-election-only.test.js',
+	],
+	'lib/pr-monitor/monitor.js': [
+		'test/pr-monitor/monitor.test.js',
+		'test/pr-monitor/monitor-owner-signal.test.js',
+	],
 	'lib/upgrade-safety.js': ['test/commands/upgrade.test.js'],
 	'scripts/test.js': ['test/scripts/test-runner.test.js'],
+	// `bun.lock` is deliberately absent: a dependency change can break anything,
+	// so it stays on the full-suite lane.
+	// lefthook.yml is the repository's hook wiring, so this must also cover the
+	// suites that assert the individual pre-commit/pre-push commands exist.
+	'lefthook.yml': [
+		'test/lefthook-check.test.js',
+		'test/lefthook-wiring.test.js',
+		'test/commands/lefthook-user-config.test.js',
+		'test/branch-protection.test.js',
+		'test/commitlint.test.js',
+		'test/cross-platform-install.test.js',
+		'test/sync-d20-audit-script.test.js',
+	],
+	'eslint.config.js': ['test/lint-script.test.js'],
+	'.coderabbit.yaml': ['test/coderabbit-config.test.js'],
+	'.claude-plugin/marketplace.json': [
+		'test/activation/plugin-scaffold.test.js',
+		'test/plugin-catalog.test.js',
+	],
 });
 
+// Shared authority modules must run the full suite even when another changed file
+// resolves a targeted test. Keep this signal separate from test candidates: an
+// empty candidate list is not enough once a mapped consumer is also changed.
+const FULL_SUITE_REQUIRED_FILES = new Set([
+	'lib/kernel/schema.js',
+	'lib/kernel/migrations.js',
+	'lib/kernel/sqlite-driver.js',
+]);
+
+// Directory-level mappings for source trees that own a dedicated suite. Without
+// these a change under any of them resolves to zero tests and forces the full
+// suite (see hasZeroResolvedTests in scripts/test.js).
+const PREFIX_TEST_TARGETS = Object.freeze([
+	['validation/', ['test/validation/risk-manifest.test.js', 'test/validation/risk-manifest-generator.test.js']],
+	// `eval/corpus/` must come first: the corpus hash and manifest checks live in
+	// immutable-corpus, and eval-sets only reads `eval/commands/`.
+	['eval/corpus/', ['test/eval/immutable-corpus.test.js']],
+	['eval/', ['test/eval/eval-sets.test.js']],
+	['rules/', ['test/rules-sync.test.js', 'test/skill-dispatch-parity.test.js']],
+	['plugin/', ['test/activation/plugin-scaffold.test.js', 'test/plugin-catalog.test.js', 'test/release-readiness.test.js']],
+]);
+
 // Skill sources (canonical `skills/**` and the committed `.agents/skills/**` mirror)
 // map to the fast skill suite. This is what keeps a skills-only PR on the targeted
 // lane instead of the full ~1500-test suite. `skills-sync-drift` guards the mirror.
@@ -176,7 +307,9 @@ function getChangedFiles(execFileSync, options = {}) {
  * @returns {string[]} Array of test file paths (e.g. ['test/foo.test.js'])
  */
 function getAffectedTestFiles(projectRoot, execFileSync, fs = defaultFs, options = {}) {
-	const changedFiles = getChangedFiles(execFileSync, options);
+	const changedFiles = Array.isArray(options.changedFiles)
+		? options.changedFiles
+		: getChangedFiles(execFileSync, options);
 	const testFiles = new Set();
 	for (const file of changedFiles) {
 		for (const candidate of getTestCandidatesForChangedFile(file)) {
@@ -215,10 +348,24 @@ function getTestCandidatesForChangedFile(file) {
 		return [...SKILL_TEST_TARGETS];
 	}
 
+	// Maintainer-only contributor skills. They document the AGENTS.md product /
+	// maintainer split, so the docs-bleed gate is the suite that can catch a
+	// contradiction between them.
+	if (file.startsWith('.forge/contributor-skills/')) {
+		return ['test/structural/agents-docs-bleed.test.js'];
+	}
+
+	for (const [prefix, targets] of PREFIX_TEST_TARGETS) {
+		if (file.startsWith(prefix)) {
+			return [...targets];
+		}
+	}
+
 	if (file === 'README.md'
 		|| file === 'QUICKSTART.md'
 		|| file === 'CHANGELOG.md'
 		|| file === 'AGENTS.md'
+		|| file === 'CODING_STANDARDS.md'
 		|| file === 'DEVELOPMENT.md'
 		|| file === 'docs/INDEX.md'
 		|| file === 'docs/PROJECT_DESIGN.md'
@@ -226,7 +373,9 @@ function getTestCandidatesForChangedFile(file) {
 		|| file.startsWith('docs/guides/')
 		|| file.startsWith('docs/reference/')
 		|| file.startsWith('docs/work/')) {
-		return ['test/docs-consistency.test.js'];
+		return file === 'AGENTS.md'
+			? ['test/docs-consistency.test.js', 'test/structural/agents-docs-bleed.test.js']
+			: ['test/docs-consistency.test.js'];
 	}
 
 	if (file.startsWith('lib/') && file.endsWith('.js')) {
@@ -270,10 +419,15 @@ function getTestCandidatesForChangedFile(file) {
 	return [];
 }
 
+function isFullSuiteRequiredFile(file) {
+	return FULL_SUITE_REQUIRED_FILES.has(file);
+}
+
 module.exports = {
 	getChangedFiles,
 	getAffectedTestFiles,
 	getTestCandidatesForChangedFile,
+	isFullSuiteRequiredFile,
 	name: 'test',
 	description: 'Run tests with smart defaults (timeout, affected-only)',
 	usage: 'forge test [--affected]',
@@ -318,10 +472,15 @@ module.exports = {
 
 		// 4. --affected flag: find changed test files
 		if (flags['--affected'] || flags.affected) {
-			const affectedTests = getAffectedTestFiles(projectRoot, execFileSync, fs, {
+			const diffOptions = {
 				sinceUpstream: flags.sinceUpstream || flags['--since-upstream'],
+			};
+			const changedFiles = getChangedFiles(execFileSync, diffOptions);
+			const affectedTests = getAffectedTestFiles(projectRoot, execFileSync, fs, {
+				...diffOptions,
+				changedFiles,
 			});
-			if (affectedTests.length > 0) {
+			if (!changedFiles.some(isFullSuiteRequiredFile) && affectedTests.length > 0) {
 				testArgs = ['run', 'test', ...affectedTests];
 			}
 			// If no affected tests found, fall back to running all tests

package/lib/commands/validate.js

@@ -44,10 +44,12 @@ const CONFLICT_DIVIDER_PATTERN = /^=======$/;
 const CONFLICT_END_PATTERN = /^>>>>>>>.*$/;
 const GIT_CONFLICT_SCAN_MAX_BUFFER = 16 * 1024 * 1024;
 const VALIDATION_COMMAND_TIMEOUT_MS = 600000;
-const VALIDATION_COMMAND_TIMEOUT_MINUTES = Math.round(VALIDATION_COMMAND_TIMEOUT_MS / 60000);
+// Match the full-suite runner's measured headroom; its verbose output exceeds 1 MiB.
+const FULL_SUITE_TIMEOUT_MS = 25 * 60 * 1000;
+const FULL_SUITE_MAX_BUFFER = 16 * 1024 * 1024;
 
-function validationTimeoutMessage(label) {
-	return `${label} timed out after ${VALIDATION_COMMAND_TIMEOUT_MINUTES} minutes`;
+function validationTimeoutMessage(label, timeoutMs = VALIDATION_COMMAND_TIMEOUT_MS) {
+	return `${label} timed out after ${Math.round(timeoutMs / 60000)} minutes`;
 }
 
 function listConflictScanFiles(rootDir) {
@@ -80,8 +82,15 @@ function shouldSkipConflictScanPath(relativePath) {
 	));
 }
 
-function getExecOptions() {
-	return { encoding: 'utf8', cwd: process.cwd(), timeout: VALIDATION_COMMAND_TIMEOUT_MS };
+/** Build bounded process options, with extra headroom only for Forge's full suite. */
+function getExecOptions(rootDir = process.cwd(), fullSuite = false) {
+	const options = {
+		encoding: 'utf8',
+		cwd: rootDir,
+		timeout: fullSuite ? FULL_SUITE_TIMEOUT_MS : VALIDATION_COMMAND_TIMEOUT_MS,
+	};
+	if (fullSuite) options.maxBuffer = FULL_SUITE_MAX_BUFFER;
+	return options;
 }
 
 const ERROR_PATTERNS = {
@@ -130,7 +139,7 @@ function parseNumber(match, index = 1, defaultValue = 0) {
  */
 function getCheckStatus(check) {
 	if (!check) return null;
-	if (check.skipped) return 'SKIPPED';
+	if (check.skipped === true) return 'SKIPPED';
 	return check.success ? 'PASS' : 'FAIL';
 }
 
@@ -343,17 +352,18 @@ async function runTypeCheck() {
  * Run ESLint
  * Executes eslint . to check code quality
  *
+ * @param {typeof execFileSync} exec - Synchronous process runner
  * @returns {Promise<{success: boolean, duration: number, warnings?: number, errors?: number, message?: string}>} Lint result
  * @example
  * const result = await runLint();
  * console.log(`Warnings: ${result.warnings}, Errors: ${result.errors}`);
  */
-async function runLint() {
+async function runLint(exec = execFileSync) {
 	const startTime = Date.now();
 
 	try {
 		// Run eslint with no output (exit code determines success)
-		execFileSync('eslint', ['.'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+		exec('eslint', ['.'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
 
 		return {
 			success: true,
@@ -556,7 +566,7 @@ async function runSecurityScan() { // NOSONAR S3776
 
 /**
  * Run all tests
- * Executes bun test to run the test suite
+ * Uses Forge's full-suite runner when present, with raw Bun as an external-repository fallback
  *
  * @returns {Promise<{success: boolean, duration: number, passed: number, failed: number, total: number, message?: string}>} Test execution result
  * @example
@@ -565,6 +575,22 @@ async function runSecurityScan() { // NOSONAR S3776
  */
 function parseTestCounts(output) {
 	const text = String(output || '');
+	const aggregateMatches = [...text.matchAll(
+		/Full suite aggregate: status=(PASS|FAIL|INCOMPLETE) tests=(\d+) assertions=\d+ passed=(\d+) failed=(\d+) errors=(\d+) skipped=(\d+)/g,
+	)]; // NOSONAR S5852 - fixed tokens and bounded numeric fields
+	const aggregate = aggregateMatches.at(-1);
+	if (aggregate) {
+		const total = parseNumber(aggregate, 2);
+		return {
+			status: aggregate[1],
+			passed: parseNumber(aggregate, 3),
+			failed: parseNumber(aggregate, 4),
+			errors: parseNumber(aggregate, 5),
+			skipped: parseNumber(aggregate, 6),
+			total,
+			testsFound: total > 0,
+		};
+	}
 	const passed = parseNumber(/(\d+) pass/.exec(text));  // NOSONAR S5852 - bounded \d+ pattern
 	const failed = parseNumber(/(\d+) fail/.exec(text));  // NOSONAR S5852 - bounded \d+ pattern
 	const skipped = parseNumber(/(\d+) skip/.exec(text));  // NOSONAR S5852 - bounded \d+ pattern
@@ -573,13 +599,31 @@ function parseTestCounts(output) {
 	return { passed, failed, skipped, total, testsFound: total > 0 };
 }
 
-async function runAllTests(exec = execFileSync) {
+function isForgeCheckout(rootDir) {
+	try {
+		const manifest = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf8'));
+		return manifest.name === 'forge-workflow'
+			&& manifest.bin?.forge === 'bin/forge.js'
+			&& manifest.scripts?.['test:full:parallel'] === 'node scripts/test-full-suite.js'
+			&& fs.existsSync(path.join(rootDir, 'scripts', 'test-full-suite.js'));
+	} catch (error) {
+		if (error instanceof SyntaxError || error.code === 'ENOENT' || error.code === 'ENOTDIR') return false;
+		throw error;
+	}
+}
+
+async function runAllTests(exec = execFileSync, rootDir = process.cwd()) {
 	const startTime = Date.now();
+	const useFullSuite = isForgeCheckout(rootDir);
+	const command = useFullSuite ? 'node' : 'bun';
+	const args = useFullSuite ? ['scripts/test-full-suite.js'] : ['test', '--timeout', '30000'];
+	const execOptions = getExecOptions(rootDir, useFullSuite);
 
 	try {
-		const result = exec('bun', ['test', '--timeout', '30000'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+		const result = exec(command, args, execOptions);  // NOSONAR S4036 - fixed CLI commands, no user input, developer tool context
 
-		const { passed, failed, skipped, total, testsFound } = parseTestCounts(result);
+		const { status, passed, failed, errors = 0, skipped, total, testsFound } = parseTestCounts(result);
+		const success = failed === 0 && errors === 0 && (status === undefined || status === 'PASS');
 
 		// B2 (N1): a bun run that executes 0 tests must NEVER report PASS — that
 		// manufactures false confidence. Surface it as an explicit SKIP instead.
@@ -597,27 +641,27 @@ async function runAllTests(exec = execFileSync) {
 		}
 
 		return {
-			success: failed === 0,
+			success,
 			testsFound: true,
 			duration: Date.now() - startTime,
 			passed,
 			failed,
 			skipped,
 			total,
-			message: failed === 0
+			message: success
 				? `All ${total} tests passed`
-				: `${failed}/${total} tests failed`,
+				: `${failed + errors}/${total} tests failed`,
 		};
 	} catch (error) {
 		// Check for timeout
-		if (error.killed && error.signal === 'SIGTERM') {
+		if (error.code === 'ETIMEDOUT' || (error.killed && error.signal === 'SIGTERM')) {
 			return {
 				success: false,
 				duration: Date.now() - startTime,
 				passed: 0,
 				failed: 0,
 				total: 0,
-				message: validationTimeoutMessage('Test execution'),
+				message: validationTimeoutMessage('Test execution', execOptions.timeout),
 			};
 		}
 
@@ -631,7 +675,7 @@ async function runAllTests(exec = execFileSync) {
 				passed: 0,
 				failed: 0,
 				total: 0,
-				message: 'Tests skipped: bun test runner not found. Install bun to run tests.',
+				message: 'Tests skipped: test runner not found. Install Node.js and Bun to run tests.',
 			};
 		}
 
@@ -641,7 +685,7 @@ async function runAllTests(exec = execFileSync) {
 		const passed = counts.passed;
 		// bun exited non-zero: if the output shows no explicit failure count, treat
 		// it as at least one failure rather than swallowing the non-zero exit.
-		const failed = counts.failed > 0 ? counts.failed : Math.max(1, counts.failed);
+		const failed = counts.failed > 0 ? counts.failed : Math.max(1, counts.errors || 0);
 		const total = counts.total > 0 ? counts.total : passed + failed + counts.skipped;
 
 		return {
@@ -753,8 +797,8 @@ async function executeValidate(options = {}) { // NOSONAR S3776
 	// 4. Tests
 	if (!skip.includes(CHECK_TYPES.TESTS)) {
 		try {
-			checks.tests = await runAllTests();
-			if (!checks.tests.success && !checks.tests.skipped) {
+			checks.tests = await runAllTests(execFileSync, rootDir);
+			if (!checks.tests.success && checks.tests.skipped !== true) {
 				failedChecks.push(CHECK_TYPES.TESTS);
 				if (!continueOnError) {
 					return buildResult(checks, failedChecks, errors, startTime);