godpowers 2.0.0 → 2.1.0

package/lib/intent.js

@@ -10,6 +10,16 @@
 
 const fs = require('fs');
 const path = require('path');
+const asyncFs = require('./fs-async');
+
+/**
+ * @typedef {Object} IntentDocument
+ * @property {string} apiVersion Expected to be `godpowers/v1`.
+ * @property {string} kind Expected to be `Project`.
+ * @property {{ name: string, description?: string }} metadata Project metadata.
+ * @property {string} mode Project mode.
+ * @property {string} scale Project scale.
+ */
 
 function intentPath(projectRoot) {
   return path.join(projectRoot, '.godpowers', 'intent.yaml');
@@ -21,6 +31,9 @@ function intentPath(projectRoot) {
  * Minimal YAML parser: handles the subset our schema uses
  * (key: value, nested objects, arrays of strings, booleans).
  * For full YAML, agents should use a real parser.
+ *
+ * @param {string} projectRoot
+ * @returns {IntentDocument|null}
  */
 function read(projectRoot) {
   const file = intentPath(projectRoot);
@@ -29,6 +42,26 @@ function read(projectRoot) {
   return parseSimpleYaml(content);
 }
 
+/**
+ * @param {string} projectRoot
+ * @returns {Promise<IntentDocument|null>}
+ */
+async function readAsync(projectRoot) {
+  const file = intentPath(projectRoot);
+  if (!(await asyncFs.exists(file))) return null;
+  const content = await asyncFs.fs.readFile(file, 'utf8');
+  return parseSimpleYaml(content);
+}
+
+/**
+ * Reject keys that would mutate the Object prototype chain. intent.yaml and
+ * extension manifests are untrusted input, so a key like `__proto__` must
+ * never be assigned during parsing.
+ */
+function isUnsafeKey(key) {
+  return key === '__proto__' || key === 'constructor' || key === 'prototype';
+}
+
 /**
  * Parse a simple YAML subset. Just enough for intent.yaml structure.
  * Real-world: replace with `yaml` npm package when we add deps.
@@ -41,17 +74,7 @@ function parseSimpleYaml(content) {
   for (let i = 0; i < lines.length; i++) {
     let line = lines[i];
     if (!line.trim() || line.trim().startsWith('#')) continue;
-    // Strip inline comments (but not # inside quotes)
-    const hashIdx = line.indexOf(' #');
-    if (hashIdx !== -1) {
-      // Make sure the # isn't inside a quoted string
-      const before = line.slice(0, hashIdx);
-      const dquoteCount = (before.match(/"/g) || []).length;
-      const squoteCount = (before.match(/'/g) || []).length;
-      if (dquoteCount % 2 === 0 && squoteCount % 2 === 0) {
-        line = before;
-      }
-    }
+    line = stripInlineComment(line);
 
     const indent = line.length - line.trimStart().length;
     const trimmed = line.trim();
@@ -66,7 +89,7 @@ function parseSimpleYaml(content) {
       const rest = trimmed.slice(2);
       // If the rest is a quoted string, treat as simple value (don't split on colon)
       const isQuotedSimple = /^"[^"]*"$|^'[^']*'$/.test(rest.trim());
-      const restColonIdx = isQuotedSimple ? -1 : rest.indexOf(':');
+      const restColonIdx = isQuotedSimple ? -1 : findUnquotedColon(rest);
 
       // Ensure parent is array
       if (!Array.isArray(parent.__items__)) {
@@ -79,6 +102,7 @@ function parseSimpleYaml(content) {
       } else {
         // List of objects: "- key: value"
         const itemKey = rest.slice(0, restColonIdx).trim();
+        if (isUnsafeKey(itemKey)) continue;
         const itemVal = rest.slice(restColonIdx + 1).trim();
         const newObj = {};
         if (itemVal) {
@@ -97,9 +121,10 @@ function parseSimpleYaml(content) {
       continue;
     }
 
-    const colonIdx = trimmed.indexOf(':');
+    const colonIdx = findUnquotedColon(trimmed);
     if (colonIdx === -1) continue;
     const key = trimmed.slice(0, colonIdx).trim();
+    if (isUnsafeKey(key)) continue;
     const valueStr = trimmed.slice(colonIdx + 1).trim();
 
     if (!valueStr) {
@@ -150,21 +175,91 @@ function readBlockScalar(lines, startIndex, parentIndent, folded) {
 }
 
 function parseValue(str) {
+  str = str.trim();
   if (str === 'true') return true;
   if (str === 'false') return false;
   if (str === 'null' || str === '~') return null;
   if (/^-?\d+$/.test(str)) return parseInt(str, 10);
   if (/^-?\d+\.\d+$/.test(str)) return parseFloat(str);
-  if (/^".*"$/.test(str) || /^'.*'$/.test(str)) return str.slice(1, -1);
+  if (/^".*"$/.test(str)) {
+    try {
+      return JSON.parse(str);
+    } catch (e) {
+      return str.slice(1, -1);
+    }
+  }
+  if (/^'.*'$/.test(str)) return str.slice(1, -1).replace(/''/g, "'");
   // Inline array: [/god-mode, /god-foo]
   if (/^\[.*\]$/.test(str)) {
     const inner = str.slice(1, -1).trim();
     if (!inner) return [];
-    return inner.split(',').map(s => parseValue(s.trim()));
+    return splitInlineArray(inner).map(s => parseValue(s.trim()));
   }
   return str;
 }
 
+function stripInlineComment(line) {
+  let quote = null;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (quote) {
+      if (ch === quote && line[i - 1] !== '\\') quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === '#' && (i === 0 || /\s/.test(line[i - 1]))) {
+      return line.slice(0, i).trimEnd();
+    }
+  }
+  return line;
+}
+
+function findUnquotedColon(text) {
+  let quote = null;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === quote && text[i - 1] !== '\\') quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === ':') return i;
+  }
+  return -1;
+}
+
+function splitInlineArray(text) {
+  const parts = [];
+  let quote = null;
+  let depth = 0;
+  let start = 0;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === quote && text[i - 1] !== '\\') quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === '[') depth++;
+    if (ch === ']') depth--;
+    if (ch === ',' && depth === 0) {
+      parts.push(text.slice(start, i));
+      start = i + 1;
+    }
+  }
+  parts.push(text.slice(start));
+  return parts;
+}
+
 function cleanArrays(obj) {
   if (Array.isArray(obj)) return obj.map(cleanArrays);
   if (obj && typeof obj === 'object') {
@@ -206,4 +301,4 @@ function validate(intent) {
   return errors;
 }
 
-module.exports = { read, get, validate, intentPath, parseSimpleYaml };
+module.exports = { read, readAsync, get, validate, intentPath, parseSimpleYaml };

package/lib/release-surface-sync.js

@@ -51,6 +51,13 @@ function readJson(projectRoot, relPath) {
   }
 }
 
+function releaseGateText(projectRoot, pkg) {
+  return [
+    JSON.stringify((pkg && pkg.scripts) || {}),
+    read(projectRoot, 'scripts/run-tests.js')
+  ].join('\n');
+}
+
 function addCheck(checks, id, status, relPath, message, opts = {}) {
   checks.push({
     area: 'release-surface',
@@ -114,7 +121,7 @@ function detect(projectRoot) {
     );
   }
 
-  const scriptsText = JSON.stringify(pkg.scripts || {});
+  const scriptsText = releaseGateText(projectRoot, pkg);
   for (const required of REQUIRED_RELEASE_TESTS) {
     const ok = scriptsText.includes(required);
     addCheck(

package/lib/repo-surface-sync.js

@@ -88,6 +88,13 @@ function readJson(projectRoot, relPath) {
   }
 }
 
+function releaseGateText(projectRoot, pkg) {
+  return [
+    JSON.stringify((pkg && pkg.scripts) || {}),
+    read(projectRoot, 'scripts/run-tests.js')
+  ].join('\n');
+}
+
 function routeForSkill(skillPath) {
   const base = path.basename(skillPath, '.md');
   return `routing/${base}.yaml`;
@@ -364,7 +371,7 @@ function extensionChecks(projectRoot) {
 function suiteChecks(projectRoot) {
   const checks = [];
   const pkg = readJson(projectRoot, 'package.json') || {};
-  const scriptsText = JSON.stringify(pkg.scripts || {});
+  const scriptsText = releaseGateText(projectRoot, pkg);
   const roadmap = read(projectRoot, 'docs/ROADMAP.md');
   const suiteCommands = [
     'god-suite-init',
@@ -433,7 +440,7 @@ function suiteChecks(projectRoot) {
 function dogfoodChecks(projectRoot) {
   const checks = [];
   const pkg = readJson(projectRoot, 'package.json') || {};
-  const scriptsText = JSON.stringify(pkg.scripts || {});
+  const scriptsText = releaseGateText(projectRoot, pkg);
   const scenarios = [
     'fixtures/dogfood/half-migrated-gsd/manifest.json',
     'fixtures/dogfood/host-degraded/manifest.json',

package/lib/review-required.js

@@ -23,7 +23,7 @@ const fs = require('fs');
 const path = require('path');
 
 function filePath(projectRoot) {
-  return path.join(projectRoot, 'REVIEW-REQUIRED.md');
+  return path.join(projectRoot, '.godpowers', 'REVIEW-REQUIRED.md');
 }
 
 function rejectedPath(projectRoot) {
@@ -41,6 +41,7 @@ function rejectedPath(projectRoot) {
  */
 function appendBatch(projectRoot, batch) {
   const file = filePath(projectRoot);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
   const ts = new Date().toISOString();
   const id = `${ts.replace(/[:.]/g, '-')}-${batch.source}`;
 

package/lib/router.js

@@ -98,7 +98,9 @@ function evaluateCheck(check, projectRoot) {
   // file:path
   if (check.startsWith('file:')) {
     const filePath = check.slice(5).trim();
-    return fs.existsSync(path.join(projectRoot, filePath));
+    const resolved = resolveProjectRelative(projectRoot, filePath);
+    if (!resolved) return false;
+    return fs.existsSync(resolved);
   }
 
   // state:dotted.path == value
@@ -109,7 +111,10 @@ function evaluateCheck(check, projectRoot) {
     const [, dottedPath, expected] = match;
     const s = state.read(projectRoot);
     if (!s) return false;
-    const actual = dottedPath.split('.').reduce((acc, k) => (acc ? acc[k] : undefined), s.tiers || s);
+    const actual = dottedPath.split('.').reduce((acc, k) => {
+      if (!acc || k === '__proto__' || k === 'constructor' || k === 'prototype') return undefined;
+      return acc[k];
+    }, s.tiers || s);
     return actual === expected || actual === parseValue(expected);
   }
 
@@ -126,7 +131,11 @@ function evaluateCheck(check, projectRoot) {
     return !fs.existsSync(path.join(projectRoot, '.godpowers'));
   }
 
-  // unknown check: assume satisfied to not block legitimate work
+  // Unknown check predicate: log a warning but assume satisfied to avoid
+  // blocking legitimate work from an outdated or unrecognized routing file.
+  if (typeof process !== 'undefined' && process.env.GODPOWERS_DEBUG) {
+    console.warn(`[router] unknown check predicate, assuming satisfied: ${check}`);
+  }
   return true;
 }
 
@@ -139,6 +148,16 @@ function parseValue(s) {
   return s;
 }
 
+function resolveProjectRelative(projectRoot, relPath) {
+  if (!projectRoot || !relPath) return null;
+  if (path.isAbsolute(relPath) || relPath.includes('\0')) return null;
+
+  const root = path.resolve(projectRoot);
+  const resolved = path.resolve(root, relPath);
+  if (resolved === root || resolved.startsWith(root + path.sep)) return resolved;
+  return null;
+}
+
 /**
  * Get the recommended next command after a successful run.
  * If conditional-next is declared, evaluates each branch's condition
@@ -354,6 +373,7 @@ module.exports = {
   getSpawnedAgents,
   suggestNext,
   evaluateCheck,
+  resolveProjectRelative,
   detectSafeSyncBlocker,
   hasNoCriticalFindings,
   clearCache

package/lib/skill-surface.js

@@ -0,0 +1,42 @@
+const fs = require('fs');
+const path = require('path');
+
+function parseFrontmatter(text) {
+  if (!text.startsWith('---\n')) return {};
+  const end = text.indexOf('\n---', 4);
+  if (end === -1) return {};
+  const out = {};
+  for (const line of text.slice(4, end).split('\n')) {
+    const match = line.match(/^([a-zA-Z0-9_-]+):\s*(.*)$/);
+    if (match) out[match[1]] = match[2].replace(/^["']|["']$/g, '');
+  }
+  return out;
+}
+
+function listSkills(rootDir = path.join(__dirname, '..', 'skills')) {
+  return fs.readdirSync(rootDir)
+    .filter((file) => /^god.*\.md$/.test(file))
+    .sort()
+    .map((file) => {
+      const full = path.join(rootDir, file);
+      const text = fs.readFileSync(full, 'utf8');
+      const frontmatter = parseFrontmatter(text);
+      return {
+        file,
+        command: `/${path.basename(file, '.md')}`,
+        name: frontmatter.name || path.basename(file, '.md'),
+        description: frontmatter.description || '',
+        path: full
+      };
+    });
+}
+
+function commandNames(rootDir) {
+  return listSkills(rootDir).map((skill) => skill.command);
+}
+
+module.exports = {
+  parseFrontmatter,
+  listSkills,
+  commandNames
+};

package/lib/state-lock.js

@@ -27,6 +27,16 @@
  *   isStale(lock, nowMs?) -> bool
  *   reclaim(projectRoot, holder) -> { reclaimed: bool, previousHolder? }
  *   scopesConflict(a, b) -> bool
+ *
+ * Limitations:
+ *   This lock is COOPERATIVE and ADVISORY. acquire() performs a non-atomic
+ *   read-then-write of state.json, so two separate OS processes that race can
+ *   both observe "no lock" and both proceed. It reliably serializes
+ *   well-behaved in-process callers (the common single-developer case) but is
+ *   NOT a cross-process mutex, and withLock() therefore guarantees mutual
+ *   exclusion only within one process. If true multi-process exclusion is ever
+ *   required, replace the acquire step with an atomic primitive such as an
+ *   fs.mkdir lock directory or an O_EXCL (wx) lockfile.
  */
 
 const fs = require('fs');

package/lib/state.js

@@ -8,6 +8,7 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const asyncFs = require('./fs-async');
 
 const STATE_VERSION = '1.0.0';
 const COMPLETE_STATUSES = new Set(['done', 'imported', 'skipped', 'not-required']);
@@ -34,6 +35,22 @@ const SUBSTEP_LABELS = {
   harden: 'Harden'
 };
 
+/**
+ * @typedef {Object} GodpowersState
+ * @property {string} $schema State schema URL.
+ * @property {string} version State schema version.
+ * @property {{ name: string, started?: string }} project Project identity.
+ * @property {Record<string, Record<string, Object>>} tiers Tier and sub-step state.
+ */
+
+/**
+ * @typedef {Object} ProgressStep
+ * @property {string} tierKey Tier key such as `tier-1`.
+ * @property {string} subStepKey Sub-step key such as `prd`.
+ * @property {string} status Sub-step status.
+ * @property {number} ordinal One-based step position.
+ */
+
 function statePath(projectRoot) {
   return path.join(projectRoot, '.godpowers', 'state.json');
 }
@@ -57,18 +74,46 @@ function tierComparator(a, b) {
 }
 
 /**
- * Read state.json from a project. Returns null if not initialized.
+ * Read state.json from a project.
+ *
+ * @param {string} projectRoot
+ * @returns {GodpowersState|null}
  */
 function read(projectRoot) {
   const file = statePath(projectRoot);
   if (!fs.existsSync(file)) return null;
-  return JSON.parse(fs.readFileSync(file, 'utf8'));
+  const raw = fs.readFileSync(file, 'utf8');
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    throw new Error(
+      `Corrupt state file at ${file}: ${e.message}. ` +
+      `Fix the JSON or remove the file to let Godpowers reinitialize it.`
+    );
+  }
 }
 
 /**
- * Write state.json to a project. Validates basic structure.
+ * Async state.json reader for callers that should not block the event loop.
+ *
+ * @param {string} projectRoot
+ * @returns {Promise<GodpowersState|null>}
  */
-function write(projectRoot, state) {
+async function readAsync(projectRoot) {
+  const file = statePath(projectRoot);
+  if (!(await asyncFs.exists(file))) return null;
+  const raw = await asyncFs.fs.readFile(file, 'utf8');
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    throw new Error(
+      `Corrupt state file at ${file}: ${e.message}. ` +
+      `Fix the JSON or remove the file to let Godpowers reinitialize it.`
+    );
+  }
+}
+
+function normalizeForWrite(state) {
   if (!state || typeof state !== 'object') {
     throw new Error('state must be an object');
   }
@@ -78,6 +123,18 @@ function write(projectRoot, state) {
     throw new Error('state.project.name is required');
   }
   if (!state.tiers) state.tiers = {};
+  return state;
+}
+
+/**
+ * Write state.json to a project. Validates basic structure.
+ *
+ * @param {string} projectRoot
+ * @param {GodpowersState} state
+ * @returns {GodpowersState}
+ */
+function write(projectRoot, state) {
+  normalizeForWrite(state);
 
   const file = statePath(projectRoot);
   fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -86,10 +143,19 @@ function write(projectRoot, state) {
 }
 
 /**
- * Initialize a new state.json for a project.
+ * Async state.json writer with the same validation contract as write().
+ *
+ * @param {string} projectRoot
+ * @param {GodpowersState} state
+ * @returns {Promise<GodpowersState>}
  */
-function init(projectRoot, projectName, opts = {}) {
-  const state = {
+async function writeAsync(projectRoot, state) {
+  normalizeForWrite(state);
+  return asyncFs.writeJson(statePath(projectRoot), state);
+}
+
+function createInitialState(projectName, opts = {}) {
+  return {
     $schema: 'https://godpowers.dev/schema/state.v1.json',
     version: STATE_VERSION,
     project: {
@@ -128,7 +194,17 @@ function init(projectRoot, projectName, opts = {}) {
     'yolo-decisions': [],
     ...opts
   };
-  return write(projectRoot, state);
+}
+
+/**
+ * Initialize a new state.json for a project.
+ */
+function init(projectRoot, projectName, opts = {}) {
+  return write(projectRoot, createInitialState(projectName, opts));
+}
+
+async function initAsync(projectRoot, projectName, opts = {}) {
+  return writeAsync(projectRoot, createInitialState(projectName, opts));
 }
 
 /**
@@ -147,6 +223,19 @@ function updateSubStep(projectRoot, tierKey, subStepKey, updates) {
   return state.tiers[tierKey][subStepKey];
 }
 
+async function updateSubStepAsync(projectRoot, tierKey, subStepKey, updates) {
+  const state = await readAsync(projectRoot);
+  if (!state) throw new Error('state.json not found');
+  if (!state.tiers[tierKey]) throw new Error(`Tier not found: ${tierKey}`);
+  state.tiers[tierKey][subStepKey] = {
+    ...(state.tiers[tierKey][subStepKey] || {}),
+    ...updates,
+    updated: new Date().toISOString()
+  };
+  await writeAsync(projectRoot, state);
+  return state.tiers[tierKey][subStepKey];
+}
+
 /**
  * Hash a file. Used for artifact-hash tracking.
  */
@@ -271,9 +360,13 @@ function renderProgressLine(summary) {
 
 module.exports = {
   read,
+  readAsync,
   write,
+  writeAsync,
   init,
+  initAsync,
   updateSubStep,
+  updateSubStepAsync,
   hashFile,
   detectDrift,
   statePath,

package/lib/workflow-runner.js

@@ -19,9 +19,9 @@
  *
  * Public API:
  *   loadByName(workflowName, opts?) -> workflow object
- *   plan(workflow, ctx?) -> { steps: [...], waves: [...], summary }
+ *   plan(workflow, ctx?) -> WorkflowPlan
  *   writePlan(projectRoot, runId, plan) -> path
- *   readPlan(projectRoot, runId) -> plan | null
+ *   readPlan(projectRoot, runId) -> serialized plan | null
  *   listWorkflows(opts?) -> [{ name, version, description, file }]
  */
 
@@ -29,6 +29,26 @@ const fs = require('fs');
 const path = require('path');
 
 const parser = require('./workflow-parser');
+const asyncFs = require('./fs-async');
+const agentRefs = require('./agent-refs');
+
+/**
+ * @typedef {Object} WorkflowPlanStep
+ * @property {string} jobKey Workflow job key.
+ * @property {string} agent Validated agent name.
+ * @property {string} agentRange SemVer range declared by the workflow.
+ * @property {string} agentContractVersion Runtime agent contract version.
+ * @property {string|null} tier Tier label such as `tier-2`.
+ * @property {string[]} needs Dependency job keys.
+ */
+
+/**
+ * @typedef {Object} WorkflowPlan
+ * @property {{ name: string, version: string, description?: string }} workflow
+ * @property {WorkflowPlanStep[]} steps
+ * @property {string[][]} waves Parallel execution waves.
+ * @property {string} summary Human-readable plan summary.
+ */
 
 function workflowsDir(opts) {
   if (opts && opts.dir) return opts.dir;
@@ -102,9 +122,12 @@ function plan(workflow, ctx = {}) {
   for (const wave of waves) {
     for (const jobKey of wave) {
       const job = workflow.jobs[jobKey] || {};
+      const ref = agentRefs.assertAgentRef(job.uses);
       steps.push({
         jobKey,
-        agent: extractAgent(job.uses),
+        agent: ref.agent,
+        agentRange: ref.range,
+        agentContractVersion: ref.contractVersion,
         tier: job.tier != null ? `tier-${job.tier}` : null,
         needs: parser.normalizeNeeds(job.needs),
         uses: job.uses,
@@ -133,8 +156,7 @@ function plan(workflow, ctx = {}) {
 
 function extractAgent(uses) {
   if (!uses) return null;
-  const m = String(uses).match(/^([a-z][a-z0-9-]*)/);
-  return m ? m[1] : uses;
+  return agentRefs.parseAgentRef(uses).agent;
 }
 
 function formatSummary(workflow, waves, steps) {
@@ -169,6 +191,13 @@ function writePlan(projectRoot, runId, planObj) {
   return file;
 }
 
+async function writePlanAsync(projectRoot, runId, planObj) {
+  const file = path.join(projectRoot, '.godpowers', 'runs', runId, 'plan.yaml');
+  await asyncFs.fs.mkdir(path.dirname(file), { recursive: true });
+  await asyncFs.fs.writeFile(file, serializePlan(planObj));
+  return file;
+}
+
 function serializePlan(p) {
   // YAML-ish hand-roll, paired with our minimal parser
   const lines = [];
@@ -214,12 +243,20 @@ function readPlan(projectRoot, runId) {
   return fs.readFileSync(file, 'utf8');
 }
 
+async function readPlanAsync(projectRoot, runId) {
+  const file = path.join(projectRoot, '.godpowers', 'runs', runId, 'plan.yaml');
+  if (!(await asyncFs.exists(file))) return null;
+  return asyncFs.fs.readFile(file, 'utf8');
+}
+
 module.exports = {
   workflowsDir,
   listWorkflows,
   loadByName,
   plan,
   writePlan,
+  writePlanAsync,
   readPlan,
+  readPlanAsync,
   serializePlan
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "godpowers",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "AI-powered development system: 110 slash commands and 40 specialist agents that take a project from raw idea to hardened production. Runs inside Claude Code, Codex, Cursor, Windsurf, Gemini, and 10+ other AI coding tools.",
   "bin": {
     "godpowers": "./bin/install.js"
   },
   "scripts": {
-    "test": "node scripts/validate-skills.js && node scripts/test-doc-surface-counts.js && node scripts/test-quick-proof.js && bash scripts/smoke.sh && node scripts/test-runtime.js && node scripts/test-router.js && node scripts/test-recipes.js && node scripts/test-context-writer.js && node scripts/test-pillars.js && node scripts/test-artifact-linter.js && node scripts/test-artifact-diff.js && node scripts/test-design-foundation.js && node scripts/test-linkage.js && node scripts/test-impact.js && node scripts/test-reverse-sync.js && node scripts/test-planning-systems.js && node scripts/test-feature-awareness.js && node scripts/test-repo-doc-sync.js && node scripts/test-repo-surface-sync.js && node scripts/test-automation-surface-sync.js && node scripts/test-host-capabilities.js && node scripts/test-extension-authoring.js && node scripts/test-dogfood-runner.js && node scripts/test-integration.js && node scripts/test-cross-artifact.js && node scripts/test-awesome-design.js && node scripts/test-skillui-bridge.js && node scripts/test-runtime-verification.js && node scripts/test-agent-browser.js && node scripts/test-mode-d.js && node scripts/test-runtime-heuristics.js && node scripts/test-agent-validator.js && node scripts/test-story-validator.js && node scripts/test-state.js && node scripts/test-dashboard.js && node scripts/test-automation-providers.js && node scripts/test-intent.js && node scripts/test-events.js && node scripts/test-golden-artifacts.js && node scripts/test-install-smoke.js && node scripts/test-checkpoint.js && node scripts/test-extensions.js && node scripts/test-event-reader.js && node scripts/test-state-lock.js && node scripts/test-cost-saver.js && node scripts/test-budget-onoff.js && node scripts/test-workflow-runner.js && npm run test:e2e && node scripts/test-otel-exporter.js && node scripts/test-extensions-publish.js",
+    "test": "node scripts/run-tests.js",
     "prepublishOnly": "npm run release:check",
     "validate-skills": "node scripts/validate-skills.js",
     "test:surface": "node scripts/test-doc-surface-counts.js",
@@ -24,7 +24,8 @@
     "test:e2e": "node tests/integration/full-arc.test.js",
     "test:audit": "npm audit --omit=dev && git diff --check && npm run test:surface",
     "pack:check": "node scripts/check-package-contents.js",
-    "release:check": "npm test && npm run test:audit && npm run pack:check"
+    "release:check": "npm test && npm run test:audit && npm run pack:check",
+    "lint": "node scripts/static-check.js"
   },
   "keywords": [
     "ai",