opencode-agent-skill 7.7.0 → 9.0.0

package/scripts/eval-live.mjs

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs"
+import { existsSync } from "node:fs"
 import { cp, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises"
 import os from "node:os"
 import path from "node:path"
@@ -7,9 +7,11 @@ import { fileURLToPath } from "node:url"
 import { installResources } from "../lib/installer.mjs"
 import { copyCurrentOpenCodeAuth } from "../lib/eval-auth.mjs"
 import { parseOpenCodeTelemetry } from "../lib/eval-telemetry.mjs"
+import { evalModeOrder } from "../lib/eval-order.mjs"
 import { buildOpenCodeRunArgs, parseOpenCodeMajor } from "../lib/opencode-compat.mjs"
 import { snapshotWorkspace, diffWorkspaceSnapshots } from "../lib/workspace-snapshot.mjs"
 import { runProcess } from "../lib/process-runner.mjs"
+import { resolveWindowsCommand } from "../lib/windows-shim.mjs"
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
 const args = process.argv.slice(2)
@@ -35,69 +37,39 @@ function positiveInt(value, fallback) {
   return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback
 }
 
-function findWindowsCommand(name) {
-  if (path.isAbsolute(name) && existsSync(name)) return name
-  const result = spawnSync("where", [name], { encoding: "utf8" })
-  if (result.status !== 0 || !result.stdout) return null
-  const matches = result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
-  return matches.find((item) => /\.(exe|cmd|bat)$/i.test(item)) || matches[0] || null
-}
-
-function quoteCmd(value) {
-  if (/^[A-Za-z0-9_@%+=:,./\\-]+$/.test(value)) return value
-  return '"' + value.replaceAll('"', '""') + '"'
-}
-
-function findNodeShimEntry(cmdPath) {
-  const dir = path.dirname(cmdPath)
-  let shim = ""
-  try {
-    shim = readFileSync(cmdPath, "utf8")
-  } catch {
-    return null
-  }
-  const match = shim.match(/node_modules[\\/][^\s"]+?\.(?:js|mjs)/gi)?.at(-1)
-  if (!match) return null
-  const entry = path.resolve(dir, match)
-  return existsSync(entry) ? entry : null
-}
 
 function runCommand(executable, commandArgs, options = {}) {
   if (process.platform !== "win32") {
     return spawnSync(executable, commandArgs, options)
   }
 
-  const resolved = findWindowsCommand(executable)
+  const resolved = resolveWindowsCommand(executable)
   if (!resolved) {
-    return { status: 127, stdout: "", stderr: "Command not found: " + executable }
-  }
-
-  if (/\.(cmd|bat)$/i.test(resolved)) {
-    const entry = findNodeShimEntry(resolved)
-    if (entry) return spawnSync(process.execPath, [entry, ...commandArgs], options)
-
-    const line = [resolved, ...commandArgs].map(quoteCmd).join(" ")
-    return spawnSync(
-      process.env.ComSpec || "cmd.exe",
-      ["/d", "/s", "/c", line],
-      options,
-    )
+    return {
+      status: 127,
+      stdout: "",
+      stderr: "No safely executable Windows command found for: " + executable,
+    }
   }
 
-  return spawnSync(resolved, commandArgs, options)
+  return spawnSync(
+    resolved.executable,
+    [...resolved.argsPrefix, ...commandArgs],
+    options,
+  )
 }
 
 
 function runAsyncCommand(executable, commandArgs, options = {}) {
   if (process.platform !== "win32") return runProcess(executable, commandArgs, options)
 
-  const resolved = findWindowsCommand(executable)
+  const resolved = resolveWindowsCommand(executable)
   if (!resolved) {
     return Promise.resolve({
       status: 127,
       signal: null,
       stdout: "",
-      stderr: "Command not found: " + executable,
+      stderr: "No safely executable Windows command found for: " + executable,
       durationMs: 0,
       timedOut: false,
       idleTimedOut: false,
@@ -105,14 +77,11 @@ function runAsyncCommand(executable, commandArgs, options = {}) {
     })
   }
 
-  if (/\.(cmd|bat)$/i.test(resolved)) {
-    const entry = findNodeShimEntry(resolved)
-    if (entry) return runProcess(process.execPath, [entry, ...commandArgs], options)
-    const line = [resolved, ...commandArgs].map(quoteCmd).join(" ")
-    return runProcess(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", line], options)
-  }
-
-  return runProcess(resolved, commandArgs, options)
+  return runProcess(
+    resolved.executable,
+    [...resolved.argsPrefix, ...commandArgs],
+    options,
+  )
 }
 
 function excerpt(value, limit = 12000) {
@@ -145,6 +114,10 @@ async function inspectLongOrchestration(workspace) {
         slug: entry.name,
         taskCount: Array.isArray(plan.tasks) ? plan.tasks.length : 0,
         planApproved: state.planApproval?.status === "passed",
+        structuredPlanReceipt:
+          state.planApproval?.receipt?.kind === "plan-verification" &&
+          state.planApproval?.receipt?.verdict === "PASS" &&
+          state.planApproval?.receipt?.planHash === state.planHash,
         attemptedTasks: tasks.filter((task) => Number(task.attempts || 0) > 0).length,
         completedTasks: tasks.filter((task) => task.status === "completed").length,
         receiptBackedTasks: plannedIDs.filter((id) => receiptBackedTasks.has(id)).length,
@@ -152,6 +125,10 @@ async function inspectLongOrchestration(workspace) {
           ? plannedIDs.filter((id) => receiptBackedTasks.has(id)).length / plannedIDs.length
           : 0,
         integrationPassed: state.integrationVerification?.status === "PASS",
+        structuredIntegrationReceipt:
+          state.integrationVerification?.receipt?.kind === "integration-verification" &&
+          state.integrationVerification?.receipt?.verdict === "PASS" &&
+          state.integrationVerification?.receipt?.workspaceFingerprint === state.integrationVerification?.fingerprint,
         integrationEvidence: evidenceTasks.has("__integration_verification__"),
         finalizedEvidence: evidenceTasks.has("__integration__"),
         completed: state.status === "completed",
@@ -159,10 +136,12 @@ async function inspectLongOrchestration(workspace) {
       item.valid =
         item.taskCount >= 2 &&
         item.planApproved &&
+        item.structuredPlanReceipt &&
         item.attemptedTasks === item.taskCount &&
         item.completedTasks === item.taskCount &&
         item.receiptBackedTasks === item.taskCount &&
         item.integrationPassed &&
+        item.structuredIntegrationReceipt &&
         item.integrationEvidence &&
         item.finalizedEvidence &&
         item.completed
@@ -193,7 +172,7 @@ const heartbeatMs = positiveInt(argValue("--heartbeat-ms"), 30_000)
 const suiteRoot = path.join(root, "evals", suiteName)
 
 if (!model) {
-  console.error("Usage: node scripts/eval-live.mjs --model provider/model [--suite live|long] [--variant high] [--trials N] [--task id] [--mode baseline|ues|both] [--auth env-only|current] [--output-dir path] [--keep] [--timeout-ms N] [--idle-timeout-ms N] [--heartbeat-ms N]")
+  console.error("Usage: node scripts/eval-live.mjs --model provider/model [--suite live|long|polyglot] [--variant high] [--trials N] [--task id] [--mode baseline|ues|both] [--auth env-only|current] [--output-dir path] [--keep] [--timeout-ms N] [--idle-timeout-ms N] [--heartbeat-ms N]")
   console.error("You can also set UES_EVAL_MODEL and UES_EVAL_VARIANT.")
   process.exit(2)
 }
@@ -221,8 +200,8 @@ if (parsedOpenCodeMajor === null) {
   console.warn("[eval] could not parse OpenCode version; using the conservative OpenCode 1.x invocation.")
 }
 
-if (!["live", "long"].includes(suiteName)) {
-  console.error("--suite must be live or long")
+if (!["live", "long", "polyglot"].includes(suiteName)) {
+  console.error("--suite must be live, long, or polyglot")
   process.exit(2)
 }
 
@@ -246,11 +225,12 @@ const results = []
 const oldConfigDir = process.env.OPENCODE_CONFIG_DIR
 
 try {
-  for (const task of tasks) {
+  for (const [taskIndex, task] of tasks.entries()) {
     if (interrupted) break
-    for (const mode of modes) {
+    for (let trial = 1; trial <= trials; trial += 1) {
       if (interrupted) break
-      for (let trial = 1; trial <= trials; trial += 1) {
+      const trialModes = evalModeOrder(requestedMode, taskIndex, trial)
+      for (const mode of trialModes) {
         if (interrupted) break
         const isolatedRoot = path.join(runRoot, task.id + "-" + mode + "-" + trial)
         const workspace = path.join(isolatedRoot, "workspace")
@@ -419,6 +399,7 @@ await writeFile(
       opencodeVersion,
       opencodeMajor,
       modes,
+      ordering: requestedMode === "both" ? "counterbalanced-task-trial" : "single-mode",
       summary,
       results,
     },

package/scripts/eval-matrix.mjs

@@ -0,0 +1,155 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process"
+import { mkdir, readdir, readFile, writeFile } from "node:fs/promises"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+import { summarizeEvalResults } from "../lib/eval-report.mjs"
+import { pairedBenchmarkConfidence } from "../lib/benchmark-confidence.mjs"
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
+const args = process.argv.slice(2)
+
+function argValue(name, fallback = null) {
+  const index = args.indexOf(name)
+  return index >= 0 && index + 1 < args.length ? args[index + 1] : fallback
+}
+function has(name) { return args.includes(name) }
+function positiveInt(value, fallback) {
+  const parsed = Number.parseInt(value || "", 10)
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback
+}
+
+const model = argValue("--model", process.env.UES_EVAL_MODEL)
+const variant = argValue("--variant", process.env.UES_EVAL_VARIANT)
+const trials = Math.min(positiveInt(argValue("--trials"), 3), 10)
+const auth = argValue("--auth", "current")
+const outputDir = path.resolve(argValue("--output-dir", path.join(process.cwd(), ".ues-evals", "matrix")))
+const timeoutMs = positiveInt(argValue("--timeout-ms"), 20 * 60_000)
+const idleTimeoutMs = positiveInt(argValue("--idle-timeout-ms"), 5 * 60_000)
+const heartbeatMs = positiveInt(argValue("--heartbeat-ms"), 30_000)
+const onlyLong = has("--long-only")
+const onlyLive = has("--standard-only")
+const onlyPolyglot = has("--polyglot-only")
+const withoutPolyglot = has("--without-polyglot")
+const requireConfidence = has("--require-confidence")
+
+if (!model) {
+  console.error("Usage: node scripts/eval-matrix.mjs --model provider/model [--trials 3] [--auth current|env-only] [--variant high] [--without-polyglot|--long-only|--standard-only|--polyglot-only]")
+  process.exit(2)
+}
+const exclusiveCount = [onlyLong, onlyLive, onlyPolyglot].filter(Boolean).length
+if (exclusiveCount > 1) {
+  console.error("--long-only, --standard-only and --polyglot-only are mutually exclusive")
+  process.exit(2)
+}
+
+await mkdir(outputDir, { recursive: true })
+const suites = onlyLong
+  ? ["long"]
+  : onlyLive
+    ? ["live"]
+    : onlyPolyglot
+      ? ["polyglot"]
+      : withoutPolyglot
+        ? ["long", "live"]
+        : ["long", "live", "polyglot"]
+const startedAt = new Date().toISOString()
+const before = new Set(await readdir(outputDir).catch(() => []))
+
+for (const suite of suites) {
+  const command = [
+    path.join(root, "scripts", "eval-live.mjs"),
+    "--suite", suite,
+    "--model", model,
+    "--mode", "both",
+    "--trials", String(trials),
+    "--auth", auth,
+    "--output-dir", outputDir,
+    "--timeout-ms", String(timeoutMs),
+    "--idle-timeout-ms", String(idleTimeoutMs),
+    "--heartbeat-ms", String(heartbeatMs),
+  ]
+  if (variant) command.push("--variant", variant)
+
+  console.log("\n[matrix] Running " + suite + " suite: " + trials + " trial(s) per task per mode")
+  const result = spawnSync(process.execPath, command, { cwd: process.cwd(), stdio: "inherit" })
+  if ((result.status ?? 1) !== 0) {
+    console.error("[matrix] " + suite + " suite failed with exit code " + (result.status ?? 1))
+    process.exit(result.status ?? 1)
+  }
+}
+
+const after = await readdir(outputDir)
+const created = after
+  .filter((name) => name.endsWith(".json") && !before.has(name))
+  .sort()
+
+const runs = []
+const results = []
+for (const name of created) {
+  const file = path.join(outputDir, name)
+  const payload = JSON.parse(await readFile(file, "utf8"))
+  if (!suites.includes(payload.suite) || payload.model !== model) continue
+  runs.push({
+    file: name,
+    suite: payload.suite,
+    suiteVersion: payload.suiteVersion,
+    trials: payload.trials,
+    results: payload.results?.length || 0,
+  })
+  results.push(...(payload.results || []).map((item) => ({ ...item, suite: payload.suite })))
+}
+
+const expectedPerMode = suites.reduce((sum, suite) => {
+  if (suite === "long") return sum + 5 * trials
+  if (suite === "live") return sum + 20 * trials
+  if (suite === "polyglot") return sum + 8 * trials
+  return sum
+}, 0)
+const baselineCount = results.filter((item) => item.mode === "baseline").length
+const uesCount = results.filter((item) => item.mode === "ues").length
+const coverageComplete = baselineCount === expectedPerMode && uesCount === expectedPerMode
+const summary = summarizeEvalResults(results)
+const confidence = pairedBenchmarkConfidence(results)
+
+const report = {
+  schemaVersion: 1,
+  kind: "ues-benchmark-matrix",
+  startedAt,
+  finishedAt: new Date().toISOString(),
+  model,
+  variant: variant || null,
+  trials,
+  auth,
+  suites,
+  expectedPerMode,
+  baselineCount,
+  uesCount,
+  coverageComplete,
+  runs,
+  pairedResults: results.map((item) => ({
+    suite: item.suite || null,
+    task: item.task,
+    trial: item.trial,
+    mode: item.mode,
+    passed: item.passed === true,
+    durationMs: item.durationMs ?? null,
+    telemetry: item.telemetry?.costSamples > 0 ? { cost: item.telemetry.cost } : {},
+  })),
+  summary,
+  confidence,
+}
+const stamp = new Date().toISOString().replace(/[:.]/g, "-")
+const reportFile = path.join(outputDir, "matrix-summary-" + stamp + ".json")
+await writeFile(reportFile, JSON.stringify(report, null, 2) + "\n", "utf8")
+
+console.log("\n[matrix] Benchmark matrix summary")
+console.log("- baseline: " + (summary.modes.baseline?.passed || 0) + "/" + (summary.modes.baseline?.total || 0))
+console.log("- UES: " + (summary.modes.ues?.passed || 0) + "/" + (summary.modes.ues?.total || 0))
+console.log("- pass-rate delta: " + (summary.passRateDelta == null ? "n/a" : (summary.passRateDelta * 100).toFixed(1) + " pp"))
+console.log("- coverage: " + (coverageComplete ? "COMPLETE" : "INCOMPLETE"))
+console.log("- paired confidence: " + (confidence.promotionEligible ? "SUPPORTED" : "NOT YET SUPPORTED") + " (pairs=" + confidence.pairs + ", p=" + confidence.pValue.toFixed(4) + ")")
+console.log("- confidence gate: " + (requireConfidence ? "REQUIRED" : "report-only"))
+console.log("- report: " + reportFile)
+
+if (!coverageComplete || (requireConfidence && !confidence.promotionEligible)) process.exitCode = 1

package/scripts/smoke-packed-install.mjs

@@ -105,7 +105,7 @@ try {
   assert.ok(existsSync(routerPlugin), "v2 router plugin was not installed from packed package")
   assert.ok(existsSync(path.join(configDir, "plugins", "ues-router", "router.js")), "v2 router helper was not installed from packed package")
   assert.ok(existsSync(path.join(configDir, "plugins", "ues-router", "safety.js")), "v2 router safety gate was not installed from packed package")
-  assert.ok(existsSync(path.join(configDir, "plugins", "ues-router", "capabilities.js")), "v7 router capability probe was not installed from packed package")
+  assert.ok(existsSync(path.join(configDir, "plugins", "ues-router", "capabilities.js")), "v8 router capability probe was not installed from packed package")
   const routerSource = await readFile(routerPlugin, "utf8")
   assert.match(routerSource, /name: "dispatch_task"/)
   assert.match(routerSource, /ctx\.session\.create/)
@@ -113,12 +113,15 @@ try {
   assert.match(routerSource, /ctx\.session\.switchModel/)
   assert.match(routerSource, /name: "capabilities"/)
   assert.match(routerSource, /name: "task_policy"/)
+  assert.match(routerSource, /name: "cancel_task"/)
+  assert.match(routerSource, /name: "recover_task"/)
+  assert.match(routerSource, /ctx\.session\.interrupt/)
   const reviewer = await readFile(path.join(configDir, "agents", "ues-reviewer.md"), "utf8")
   assert.match(reviewer, /permissions:/)
   assert.doesNotMatch(reviewer, /^permission:/m)
 
   for (const name of ["ues-codebase-mapper.md", "ues-plan-checker.md", "ues-executor.md", "ues-integration-verifier.md"]) {
-    assert.ok(existsSync(path.join(configDir, "agents", name)), "missing packed V6 subagent " + name)
+    assert.ok(existsSync(path.join(configDir, "agents", name)), "missing packed V8 subagent " + name)
   }
   const executor = await readFile(path.join(configDir, "agents", "ues-executor.md"), "utf8")
   assert.match(executor, /permissions:/)
@@ -136,7 +139,7 @@ try {
   const planFile = path.join(temp, "PLAN.json")
   await writeFile(planFile, JSON.stringify({
     schemaVersion: 1,
-    goal: "Packed V6 smoke",
+    goal: "Packed V8 smoke",
     tasks: [{
       id: "T1",
       title: "Smoke",
@@ -157,12 +160,24 @@ try {
   requireSuccess(graph, "ocskill task-graph from packed copy")
   assert.match(graph.stdout, /"valid": true/)
 
-  const workInit = spawnSync(process.execPath, [cli, "work", "init", "packed-smoke", temp, "--goal", "Packed V6 work smoke"], {
+  const workInit = spawnSync(process.execPath, [cli, "work", "init", "packed-smoke", temp, "--goal", "Packed V8 work smoke"], {
     cwd: temp,
     env,
     encoding: "utf8",
   })
   requireSuccess(workInit, "ocskill work init from packed copy")
+  assert.ok(
+    existsSync(path.join(temp, ".ues-work", "packed-smoke", "EVENTS.jsonl")),
+    "packed V8 work item did not create EVENTS.jsonl",
+  )
+
+  const workEvents = spawnSync(process.execPath, [cli, "work", "events", "packed-smoke", temp], {
+    cwd: temp,
+    env,
+    encoding: "utf8",
+  })
+  requireSuccess(workEvents, "ocskill work events from packed copy")
+  assert.match(workEvents.stdout, /"work\.init"/)
 
   const workPlan = spawnSync(process.execPath, [cli, "work", "plan", "packed-smoke", planFile, temp], {
     cwd: temp,
@@ -266,6 +281,125 @@ try {
   requireSuccess(workFinalize, "ocskill work finalize from packed copy")
   assert.match(workFinalize.stdout, /"status": "completed"/)
 
+  const strictPlanFile = path.join(temp, "STRICT-PLAN.json")
+  await writeFile(strictPlanFile, JSON.stringify({
+    schemaVersion: 1,
+    goal: "Packed V8 strict evidence smoke",
+    tasks: [
+      {
+        id: "S1",
+        title: "Strict one",
+        summary: "Exercise structured plan/task evidence",
+        files: { modify: ["src/one.js"] },
+        dependsOn: [],
+        acceptance: ["S1 is verified"],
+        verification: ["node --version"],
+        risk: "medium",
+      },
+      {
+        id: "S2",
+        title: "Strict two",
+        summary: "Exercise structured integration evidence",
+        files: { modify: ["src/two.js"] },
+        dependsOn: ["S1"],
+        acceptance: ["S2 is verified"],
+        verification: ["node --version"],
+        risk: "medium",
+      },
+    ],
+  }, null, 2) + "\n", "utf8")
+
+  requireSuccess(
+    spawnSync(process.execPath, [cli, "work", "init", "packed-strict", temp, "--goal", "Packed V8 strict evidence smoke"], {
+      cwd: temp, env, encoding: "utf8",
+    }),
+    "strict work init from packed copy",
+  )
+  requireSuccess(
+    spawnSync(process.execPath, [cli, "work", "plan", "packed-strict", strictPlanFile, temp], {
+      cwd: temp, env, encoding: "utf8",
+    }),
+    "strict work plan from packed copy",
+  )
+
+  const plainStrictApproval = spawnSync(process.execPath, [
+    cli, "work", "approve-plan", "packed-strict", temp, "--evidence", "plain PASS",
+  ], { cwd: temp, env, encoding: "utf8" })
+  assert.notEqual(plainStrictApproval.status, 0)
+  assert.match(plainStrictApproval.stderr, /structured plan-verification receipt/)
+
+  const strictPlanReceipt = path.join(temp, ".ues-work", "packed-strict", "reports", "plan-receipt.json")
+  requireSuccess(
+    spawnSync(process.execPath, [
+      cli, "work", "gate-receipt", "packed-strict", "plan", temp,
+      "--verifier", "ues-plan-checker",
+      "--evidence", "strict plan PASS",
+      "--out", strictPlanReceipt,
+    ], { cwd: temp, env, encoding: "utf8" }),
+    "strict plan receipt from packed copy",
+  )
+  requireSuccess(
+    spawnSync(process.execPath, [
+      cli, "work", "approve-plan", "packed-strict", temp,
+      "--evidence", "strict plan PASS",
+      "--receipt-file", strictPlanReceipt,
+    ], { cwd: temp, env, encoding: "utf8" }),
+    "strict plan approval from packed copy",
+  )
+
+  for (const taskID of ["S1", "S2"]) {
+    const strictStart = spawnSync(process.execPath, [cli, "work", "start", "packed-strict", taskID, temp], {
+      cwd: temp, env, encoding: "utf8",
+    })
+    requireSuccess(strictStart, "strict " + taskID + " start from packed copy")
+    const strictStarted = JSON.parse(strictStart.stdout)
+    const runId = strictStarted.record.runId
+
+    requireSuccess(
+      spawnSync(process.execPath, [
+        cli, "work", "verify-command", "packed-strict", taskID, temp,
+        "--run-id", runId,
+        "--", process.execPath, "--version",
+      ], { cwd: temp, env, encoding: "utf8" }),
+      "strict " + taskID + " verification from packed copy",
+    )
+    requireSuccess(
+      spawnSync(process.execPath, [
+        cli, "work", "complete", "packed-strict", taskID, temp,
+        "--run-id", runId,
+        "--evidence", taskID + " verification PASS",
+      ], { cwd: temp, env, encoding: "utf8" }),
+      "strict " + taskID + " completion from packed copy",
+    )
+  }
+
+  const strictIntegrationReceipt = path.join(temp, ".ues-work", "packed-strict", "reports", "integration-receipt.json")
+  requireSuccess(
+    spawnSync(process.execPath, [
+      cli, "work", "gate-receipt", "packed-strict", "integration", temp,
+      "--verifier", "ues-integration-verifier",
+      "--verdict", "PASS",
+      "--evidence", "strict integration PASS",
+      "--out", strictIntegrationReceipt,
+    ], { cwd: temp, env, encoding: "utf8" }),
+    "strict integration receipt from packed copy",
+  )
+  requireSuccess(
+    spawnSync(process.execPath, [
+      cli, "work", "verify-integration", "packed-strict", temp,
+      "--verdict", "PASS",
+      "--evidence", "strict integration PASS",
+      "--receipt-file", strictIntegrationReceipt,
+    ], { cwd: temp, env, encoding: "utf8" }),
+    "strict integration verification from packed copy",
+  )
+  const strictFinalize = spawnSync(process.execPath, [
+    cli, "work", "finalize", "packed-strict", temp,
+    "--evidence", "strict final acceptance PASS",
+  ], { cwd: temp, env, encoding: "utf8" })
+  requireSuccess(strictFinalize, "strict finalization from packed copy")
+  assert.match(strictFinalize.stdout, /"status": "completed"/)
+
   const adaptivePolicy = spawnSync(process.execPath, [
     cli, "task-policy",
     "Refactor the entire repository authentication schema migration and public API contracts",

package/scripts/smoke-plain-install.mjs

@@ -0,0 +1,91 @@
+import assert from "node:assert/strict"
+import { existsSync } from "node:fs"
+import { mkdir, mkdtemp, readFile, readdir, realpath, rm } from "node:fs/promises"
+import { spawnSync } from "node:child_process"
+import os from "node:os"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
+const packageJson = JSON.parse(await readFile(path.join(repoRoot, "package.json"), "utf8"))
+const packageName = packageJson.name
+
+function runNpm(args, options = {}) {
+  const common = {
+    cwd: options.cwd ?? repoRoot,
+    env: options.env ?? process.env,
+    encoding: "utf8",
+  }
+  const npmExecPath = process.env.npm_execpath
+  if (npmExecPath && existsSync(npmExecPath)) {
+    return spawnSync(process.execPath, [npmExecPath, ...args], common)
+  }
+  return spawnSync("npm", args, { ...common, shell: process.platform === "win32" })
+}
+
+function requireSuccess(result, label) {
+  if (result.status === 0) return
+  throw new Error(
+    label + " failed with exit code " + (result.status ?? "unknown") + "\n" +
+    [result.stdout, result.stderr].filter(Boolean).join("\n"),
+  )
+}
+
+const temp = await mkdtemp(path.join(os.tmpdir(), "ocskill-plain-install-"))
+const packDir = path.join(temp, "pack")
+const prefix = path.join(temp, "prefix")
+const configDir = path.join(temp, "opencode")
+
+try {
+  await mkdir(packDir, { recursive: true })
+  const pack = runNpm(["pack", "--pack-destination", packDir])
+  requireSuccess(pack, "npm pack")
+  const tarballs = (await readdir(packDir)).filter((name) => name.endsWith(".tgz"))
+  assert.equal(tarballs.length, 1)
+
+  const npmVersionRun = runNpm(["--version"], { cwd: temp })
+  requireSuccess(npmVersionRun, "npm --version")
+  const npmVersion = npmVersionRun.stdout.trim()
+  const npmMajor = Number.parseInt(npmVersion.split(".")[0], 10)
+
+  // Intentionally mirrors the user's exact install shape: no --allow-scripts.
+  const install = runNpm(["install", "-g", tarballs.map((name) => path.join(packDir, name))[0], "--prefix", prefix], {
+    cwd: temp,
+    env: { ...process.env, OPENCODE_CONFIG_DIR: configDir, UES_OPENCODE_MAJOR: "2" },
+  })
+  requireSuccess(install, "plain global install")
+
+  const root = runNpm(["root", "-g", "--prefix", prefix], { cwd: temp })
+  requireSuccess(root, "npm root -g")
+  const packageDir = path.join(root.stdout.trim(), ...packageName.split("/"))
+  assert.equal((await realpath(packageDir)).toLowerCase() === (await realpath(repoRoot)).toLowerCase(), false)
+
+  const cli = path.join(packageDir, "bin", "ocskill.mjs")
+  assert.ok(existsSync(cli), "plain install did not install the ocskill CLI")
+
+  const stateFile = path.join(configDir, ".ues", "state.json")
+  const autoSynced = existsSync(stateFile)
+  assert.equal(
+    autoSynced,
+    true,
+    "plain npm install installed the CLI but did not auto-sync OpenCode resources; one-command installation is not release-safe",
+  )
+
+  const state = JSON.parse(await readFile(stateFile, "utf8"))
+  assert.equal(state.package, packageName)
+  assert.ok(state.skills.length >= 39)
+  assert.ok(state.commands.length >= 11)
+  assert.ok(state.agents.length >= 10)
+
+  console.log(
+    "Plain npm install compatibility smoke passed for " + packageName + "@" + packageJson.version +
+    ": npm " + npmVersion + ", lifecycle auto-sync=" + autoSynced +
+    ", final resources=" + state.skills.length + "/" + state.commands.length + "/" + state.agents.length + ".",
+  )
+
+  if (Number.isFinite(npmMajor) && npmMajor >= 11) {
+    console.warn("[smoke] npm 11+ completed the one-command install and resource auto-sync contract.")
+  }
+} finally {
+  await rm(temp, { recursive: true, force: true })
+}

package/scripts/validate-live-suite.mjs

@@ -8,8 +8,8 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
 const args = process.argv.slice(2)
 const suiteIndex = args.indexOf("--suite")
 const suiteName = suiteIndex >= 0 ? args[suiteIndex + 1] : "live"
-if (!["live", "long"].includes(suiteName)) {
-  console.error("--suite must be live or long")
+if (!["live", "long", "polyglot"].includes(suiteName)) {
+  console.error("--suite must be live, long or polyglot")
   process.exit(2)
 }
 const suiteRoot = path.join(root, "evals", suiteName)
@@ -17,7 +17,7 @@ const suite = JSON.parse(await readFile(path.join(suiteRoot, "tasks.json"), "utf
 const errors = []
 const ids = new Set()
 
-const minimumTasks = suiteName === "long" ? 5 : 20
+const minimumTasks = suiteName === "long" ? 5 : suiteName === "polyglot" ? 8 : 20
 if (!Array.isArray(suite.tasks) || suite.tasks.length < minimumTasks) {
   errors.push(suiteName + " eval suite must contain at least " + minimumTasks + " tasks")
 }