pan-wizard 3.8.0 → 3.12.0

package/pan-wizard-core/bin/lib/worktree.cjs

@@ -0,0 +1,123 @@
+/**
+ * Worktree — branch-per-agent isolation for the bot army (ADR-0033).
+ *
+ * The Build squad parallelizes by giving each builder its own git worktree
+ * on its own `army/<task>` branch, so concurrent agents never touch the same
+ * working tree or the same file. Generalizes the worktree primitive proven in
+ * whatif.cjs; the army campaign command drives it. Zero deps, synchronous,
+ * cross-platform (delegates to execGit).
+ */
+
+'use strict';
+
+const path = require('path');
+const { execGit, isGitRepo, toPosix, generateSlugInternal, output, error } = require('./core.cjs');
+
+const ARMY_BRANCH_PREFIX = 'army/';
+
+/**
+ * Create an isolated worktree + branch for one army task.
+ * @param {string} cwd - main project root
+ * @param {string} task - free-text task name (slugified for branch/path)
+ * @param {Object} [opts] - { base: ref (default 'HEAD'), worktree_root }
+ * @returns {{worktree_path, branch, base}|{error}}
+ */
+function createTaskWorktree(cwd, task, opts) {
+  if (!task || !String(task).trim()) return { error: 'task name required' };
+  if (!isGitRepo(cwd)) return { error: 'Not a git repo — branch-per-agent requires git worktree support' };
+
+  const slug = generateSlugInternal(String(task)).slice(0, 40);
+  const branch = `${ARMY_BRANCH_PREFIX}${slug}`;
+  const worktreeRoot = opts?.worktree_root
+    || path.join(path.dirname(path.resolve(cwd)), `pan-army-${slug}`);
+  const base = opts?.base || 'HEAD';
+
+  const result = execGit(cwd, ['worktree', 'add', '-b', branch, worktreeRoot, base]);
+  if (result.exitCode !== 0) {
+    return { error: `git worktree add failed: ${result.stderr}` };
+  }
+  return { worktree_path: toPosix(worktreeRoot), branch, base };
+}
+
+/**
+ * Remove an army worktree + its branch. Best-effort; warnings surfaced.
+ * @returns {{removed: true, warnings: string[]}|{error}}
+ */
+function removeTaskWorktree(cwd, worktreePath, branch, opts) {
+  if (!isGitRepo(cwd)) return { error: 'Not a git repo' };
+  const warnings = [];
+  const rmArgs = ['worktree', 'remove'];
+  if (opts?.force === true) rmArgs.push('--force');
+  rmArgs.push(worktreePath);
+  const rm = execGit(cwd, rmArgs);
+  if (rm.exitCode !== 0) warnings.push(`worktree remove: ${rm.stderr.trim()}`);
+
+  if (branch) {
+    // Only delete branches we created (army/ prefix), and only if not checked out.
+    if (branch.startsWith(ARMY_BRANCH_PREFIX)) {
+      const del = execGit(cwd, ['branch', '-D', branch]);
+      if (del.exitCode !== 0) warnings.push(`branch -D ${branch}: ${del.stderr.trim()}`);
+    } else {
+      warnings.push(`refused to delete non-army branch ${branch}`);
+    }
+  }
+  return { removed: true, warnings };
+}
+
+/**
+ * List the army worktrees currently registered (army/ branches only).
+ * Parses `git worktree list --porcelain`.
+ * @returns {Array<{worktree, branch}>}
+ */
+function listArmyWorktrees(cwd) {
+  if (!isGitRepo(cwd)) return [];
+  const r = execGit(cwd, ['worktree', 'list', '--porcelain']);
+  if (r.exitCode !== 0) return [];
+  const out = [];
+  let current = {};
+  for (const line of r.stdout.split(/\r?\n/)) {
+    if (line.startsWith('worktree ')) {
+      current = { worktree: toPosix(line.slice('worktree '.length).trim()) };
+    } else if (line.startsWith('branch ')) {
+      const ref = line.slice('branch '.length).trim().replace('refs/heads/', '');
+      current.branch = ref;
+      if (ref.startsWith(ARMY_BRANCH_PREFIX)) out.push({ ...current });
+    } else if (line === '') {
+      current = {};
+    }
+  }
+  return out;
+}
+
+// ─── CLI ─────────────────────────────────────────────────────────────────────
+
+function cmdWorktreeList(cwd, raw) {
+  const trees = listArmyWorktrees(cwd);
+  const human = trees.length
+    ? trees.map(t => `${t.branch}  →  ${t.worktree}`).join('\n')
+    : 'No army worktrees';
+  output({ worktrees: trees, count: trees.length }, raw, human);
+}
+
+function cmdWorktreeCreate(cwd, task, raw, opts) {
+  const r = createTaskWorktree(cwd, task, opts);
+  if (r.error) return error(r.error);
+  output(r, raw, `${r.branch} → ${r.worktree_path}`);
+}
+
+function cmdWorktreeRemove(cwd, worktreePath, branch, raw, opts) {
+  if (!worktreePath) return error('worktree path required');
+  const r = removeTaskWorktree(cwd, worktreePath, branch, opts);
+  if (r.error) return error(r.error);
+  output(r, raw, r.warnings.length ? r.warnings.join('\n') : 'removed');
+}
+
+module.exports = {
+  ARMY_BRANCH_PREFIX,
+  createTaskWorktree,
+  removeTaskWorktree,
+  listArmyWorktrees,
+  cmdWorktreeList,
+  cmdWorktreeCreate,
+  cmdWorktreeRemove,
+};

package/pan-wizard-core/bin/pan-tools.cjs

@@ -147,6 +147,7 @@
  * Pre-Flight & Dashboard:
  *   preflight [phase|batch]            Validate execution prerequisites
  *   dashboard                          Aggregated project status overview
+ *   hud [--out f] [--open] [--stdout]  Single-page HTML army + project dashboard
  *
  * Session Learnings:
  *   learnings extract                  Extract patterns from session data
@@ -856,6 +857,16 @@ async function main() {
       break;
     }
 
+    case 'hud': {
+      const hud = require('./lib/hud.cjs');
+      hud.cmdHud(cwd, {
+        out: getArgValue(args, '--out'),
+        open: args.includes('--open'),
+        stdout: args.includes('--stdout'),
+      }, raw);
+      break;
+    }
+
     case 'learnings': {
       const subcommand = args[1];
       if (subcommand === 'extract') {
@@ -1039,6 +1050,73 @@ async function main() {
       break;
     }
 
+    case 'models': {
+      const subcommand = args[1];
+      if (subcommand === 'check' || !subcommand) {
+        cost.cmdModelsCheck(raw);
+      } else {
+        error('Unknown models subcommand. Available: check');
+      }
+      break;
+    }
+
+    case 'squad': {
+      const squads = require('./lib/squads.cjs');
+      const subcommand = args[1];
+      if (subcommand === 'list' || !subcommand) {
+        squads.cmdSquadList(raw);
+      } else if (subcommand === 'show') {
+        squads.cmdSquadShow(args[2], raw);
+      } else {
+        error('Unknown squad subcommand. Available: list, show');
+      }
+      break;
+    }
+
+    case 'worktree': {
+      const worktree = require('./lib/worktree.cjs');
+      const subcommand = args[1];
+      if (subcommand === 'list' || !subcommand) {
+        worktree.cmdWorktreeList(cwd, raw);
+      } else if (subcommand === 'create') {
+        worktree.cmdWorktreeCreate(cwd, args[2], raw, { base: getArgValue(args, '--base') });
+      } else if (subcommand === 'remove') {
+        worktree.cmdWorktreeRemove(cwd, args[2], getArgValue(args, '--branch'), raw, { force: args.includes('--force') });
+      } else {
+        error('Unknown worktree subcommand. Available: list, create, remove');
+      }
+      break;
+    }
+
+    case 'campaign': {
+      const campaign = require('./lib/campaign.cjs');
+      const subcommand = args[1];
+      if (subcommand === 'schedule') {
+        const budget = getArgValue(args, '--daily-budget');
+        campaign.cmdCampaignSchedule(cwd, {
+          goal: getArgValue(args, '--goal'),
+          source: getArgValue(args, '--source'),
+          cadence: getArgValue(args, '--cadence', 'daily'),
+          daily_budget: budget != null ? Number(budget) : undefined,
+          enabled: args.includes('--disable') ? false : undefined,
+          paused: args.includes('--pause') ? true : (args.includes('--resume') ? false : undefined),
+        }, raw);
+      } else if (subcommand === 'status' || !subcommand) {
+        campaign.cmdCampaignStatus(cwd, raw);
+      } else if (subcommand === 'due') {
+        campaign.cmdCampaignDue(cwd, raw);
+      } else if (subcommand === 'record-run') {
+        const r = campaign.recordRun(cwd, {
+          items_landed: Number(getArgValue(args, '--items', 0)),
+          points_used: Number(getArgValue(args, '--points', 0)),
+        });
+        if (r.error) { error(r.error); } else { output(r, raw, `recorded · next ${r.next_due}`); }
+      } else {
+        error('Unknown campaign subcommand. Available: schedule, status, due, record-run');
+      }
+      break;
+    }
+
     case 'bus': {
       const subcommand = args[1];
       if (subcommand === 'publish') {

package/pan-wizard-core/learnings/universal/autonomous-loop.md

@@ -0,0 +1,56 @@
+---
+topic: autonomous-loop
+last_updated: 2026-06-12T00:00:00.000Z
+patterns:
+  - id: P-310
+    summary: Autonomous build loops should fan out research and verify in parallel but keep implement/build a single serial step, then seal with one clean build at loop end
+    promoted_at: 2026-06-12T00:00:00.000Z
+    source_experiments: [montyhall-focus-loop]
+---
+
+# Autonomous Loop (AI-derived)
+
+> Hand-promoted from a downstream `/focus-loop` campaign command (MontyHall compiler project) and generalized in ADR-0031. Patterns are **advisory** — orchestrators weight them against current context.
+
+## P-310 — Parallel-research → single-serial-build → parallel-verify, then clean-seal
+
+**Evidence:** A backlog-driven autonomous loop that landed many items per run converged on this shape (the "cc#67/cc#68" discipline): research and verification are read-only and parallelize cheaply via the Workflow tool, but the implement/build step mutates shared state and must be a *single* serial actor. Per-item incremental commits twice produced cross-item orphans — a symbol defined only in an uncommitted file, or a combined state that didn't build clean — which only a from-scratch build at loop end caught.
+
+**Rule:** For any pick → build → verify → commit → repeat loop:
+
+1. **Fan out research in parallel** (read-only agents): map the substrate, scope the honest-partial boundary, probe for support. Mutate nothing.
+2. **Implement/build is exactly ONE serial actor** — never inside a `parallel()`. If the project's build trees corrupt under concurrency, enforce at-most-one-builder across the whole loop (a per-project opt-in, not a universal law).
+3. **Fan out verify in parallel** (read-only) over the already-built tree: correctness / security / honesty lenses.
+4. **Commit-quality gates:** a *staging-miss guard* (no implementer-touched file left unstaged — never `git add -A`, never a hand-picked subset) and an *orphan audit* (HEAD references no symbol defined only in an uncommitted file).
+5. **Clean-build seal once at loop end:** per-item builds are incremental for speed; a single from-scratch build + full verification after the last item catches cross-item orphans the incremental builds hid.
+6. **Rank the backlog from the CURRENT document** (value/effort), never a frozen ID list, so the order never goes stale; honest-partial aggressively and strike only what landed.
+
+**Applies in:** `/pan:focus-auto` (`--source backlog`, `--parallel-research`/`--parallel-verify`/`--clean-seal`; ADR-0031), any Workflow-orchestrated build campaign, hierarchical exec (`pan-conductor`).
+
+## P-330 — Scale agents into a coordinated army with squads, worktree isolation, and a human-gated ship
+
+**Evidence:** The bot-army model (ADR-0032/0033) showed the durable shape for running a whole-project goal across many agents: a delegation-only coordinator (never codes) fans work to role-scoped *squads* (architecture/build/quality/release), the build squad parallelizes by giving each agent its own branch + git worktree (so concurrent builders never touch the same file), quality is adversarial and read-only, and the path to a protected branch is a human-approved gate, not a bot merge.
+
+**Rule:** When scaling beyond a single agent:
+
+1. **Coordinator delegates, never codes** — its tools are delegation-only; it plans, decomposes, and routes to squads, then aggregates tight summaries.
+2. **Group agents into role-scoped squads with least-privilege tools** — design read-only, build read/write, quality read-only/adversarial, release always-ask. Resolve the roster from data, not hardcoded prompt lists.
+3. **Parallelize by isolation, not by hope** — one branch + worktree per concurrent builder; never two agents in one tree. Serialize builds only where the build tree corrupts under concurrency (a per-project opt-in).
+4. **The mutating boundary is human-gated** — merging to a protected branch is `always-ask`; recovery is revert / previous tag, never force-push or history rewrite.
+5. **The harness scales with the army, not after it** — depth caps, spawn/budget ceilings, and an abort kill-switch checked before every spawn are mandatory; a longer loop must not relax a single cap. Power and safety are the same investment.
+
+**Applies in:** `/pan:army` (ADR-0033), `pan-conductor` campaign mode, `squads.cjs` / `worktree.cjs`, any multi-agent delivery.
+
+## P-340 — Schedule autonomy as a due-check the host fires, not a daemon you embed
+
+**Evidence:** Making the army run over days (ADR-0034) surfaced the right boundary for a prompt-driven tool that lives inside a host session: it cannot wake itself while the session is closed, and pretending to (an embedded scheduler/daemon spawning agents in the background) is both a false promise and a security surface. The durable design split ownership — PAN owns the schedule *descriptor* and the *decision whether a run is due*; the host scheduler owns *firing* it.
+
+**Rule:** For "run X automatically over time" in a session-bound agent:
+
+1. **Persist a schedule descriptor, not a timer** — cadence, next-due, per-day budget, enabled/paused — in project state.
+2. **Expose a cheap, side-effect-free `due` check** the external trigger polls; make the *reason* explicit (`not_yet` / `paused` / `budget_exhausted_today` / `due`) so skips are auditable.
+3. **Let the host fire it** — cron / routines / a session loop / a next-open nudge — rather than embedding a background daemon.
+4. **Resume from persisted state**, advancing next-due and accruing per-day spend on each run; cap the day, not just the run.
+5. **Never let a schedule lower an irreversible-action gate** — scheduled or not, the human approves the merge. Autonomy extends up to the irreversible step, never through it.
+
+**Applies in:** `campaign.cjs` + `/pan:army --schedule` (ADR-0034), any cron/`/loop`-driven PAN automation, the self-improvement loop on a cadence.

package/pan-wizard-core/workflows/plan-phase.md

@@ -511,6 +511,17 @@ Offer: 1) Force proceed, 2) Provide guidance and retry, 3) Abandon
 
 ## 13. Present Final Status
 
+**Sync state.md first** — without this, state.md says "Ready to plan" until the
+first plan's summary lands, and `/pan:progress`/`preflight` read a stale picture:
+
+```bash
+node ~/.claude/pan-wizard-core/bin/pan-tools.cjs state update "Status" "Ready to execute"
+node ~/.claude/pan-wizard-core/bin/pan-tools.cjs state update "Current Plan" "1"
+node ~/.claude/pan-wizard-core/bin/pan-tools.cjs state update "Total Plans in Phase" "${PLAN_COUNT}"
+node ~/.claude/pan-wizard-core/bin/pan-tools.cjs state update "Last Activity" "$(node ~/.claude/pan-wizard-core/bin/pan-tools.cjs current-timestamp date --raw)"
+node ~/.claude/pan-wizard-core/bin/pan-tools.cjs state update "Last Activity Description" "Phase ${PHASE_NUMBER} planned — ${PLAN_COUNT} plans created"
+```
+
 Route to `<offer_next>` OR `auto_advance` depending on flags/config.
 
 **Circular optimization — log plan creation:**

package/scripts/build-plugin.js

@@ -0,0 +1,105 @@
+/**
+ * Build the PAN Wizard Claude Code plugin (ecosystem review item: plugin
+ * distribution, first slice). Emits a self-contained plugin directory at
+ * dist/pan-wizard-plugin/ following the verified plugin layout:
+ *
+ *   .claude-plugin/plugin.json    manifest (metadata; components auto-discover)
+ *   commands/pan/*.md             command markdown (Claude flavor)
+ *   agents/pan-*.md               agent definitions
+ *   hooks/hooks.json              PAN hooks with ${CLAUDE_PLUGIN_ROOT} paths
+ *   hooks/pan-*.js                hook scripts
+ *   pan-wizard-core/              dispatcher + modules + workflows + templates
+ *
+ * Distribution status: built ALONGSIDE the loose-file installer. Marketplace
+ * publishing is gated on one live verification — whether ${CLAUDE_PLUGIN_ROOT}
+ * expands inside command markdown content (documented for hook/MCP configs
+ * only). Until then, content references core paths relative to the plugin
+ * root, which matches the documented plugin working layout.
+ *
+ * Usage: node scripts/build-plugin.js  (or npm run build:plugin)
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.join(__dirname, '..');
+const OUT = path.join(ROOT, 'dist', 'pan-wizard-plugin');
+const pkg = require(path.join(ROOT, 'package.json'));
+const lib = require(path.join(ROOT, 'bin', 'install-lib.cjs'));
+
+// Plugin-relative prefix used inside markdown content. Hook/MCP configs get
+// the documented ${CLAUDE_PLUGIN_ROOT} form via buildPluginHooksConfig().
+const CONTENT_PREFIX = '${CLAUDE_PLUGIN_ROOT}/';
+
+function rewriteContent(content) {
+  return content
+    .replace(/~\/\.claude\/pan-wizard-core\//g, `${CONTENT_PREFIX}pan-wizard-core/`)
+    .replace(/\.\/\.claude\/pan-wizard-core\//g, `${CONTENT_PREFIX}pan-wizard-core/`)
+    .replace(/~\/\.claude\/agents\//g, `${CONTENT_PREFIX}agents/`)
+    .replace(/\.\/\.claude\/agents\//g, `${CONTENT_PREFIX}agents/`)
+    .replace(/~\/\.claude\//g, CONTENT_PREFIX)
+    .replace(/\.\/\.claude\//g, CONTENT_PREFIX);
+}
+
+function copyTree(srcDir, destDir, transformMd) {
+  fs.mkdirSync(destDir, { recursive: true });
+  for (const entry of fs.readdirSync(srcDir, { withFileTypes: true })) {
+    const srcPath = path.join(srcDir, entry.name);
+    const destPath = path.join(destDir, entry.name);
+    if (entry.isDirectory()) {
+      copyTree(srcPath, destPath, transformMd);
+    } else if (transformMd && entry.name.endsWith('.md')) {
+      fs.writeFileSync(destPath, transformMd(fs.readFileSync(srcPath, 'utf8')));
+    } else {
+      fs.copyFileSync(srcPath, destPath);
+    }
+  }
+}
+
+function main() {
+  // Clean output
+  fs.rmSync(OUT, { recursive: true, force: true });
+  fs.mkdirSync(path.join(OUT, '.claude-plugin'), { recursive: true });
+
+  // 1. Manifest
+  fs.writeFileSync(
+    path.join(OUT, '.claude-plugin', 'plugin.json'),
+    JSON.stringify(lib.buildPluginManifest(pkg), null, 2) + '\n'
+  );
+
+  // 2. Commands (Claude flavor, plugin-root-relative paths)
+  copyTree(path.join(ROOT, 'commands', 'pan'), path.join(OUT, 'commands', 'pan'), rewriteContent);
+
+  // 3. Agents
+  copyTree(path.join(ROOT, 'agents'), path.join(OUT, 'agents'), rewriteContent);
+
+  // 4. Hooks: config + scripts
+  fs.mkdirSync(path.join(OUT, 'hooks'), { recursive: true });
+  fs.writeFileSync(
+    path.join(OUT, 'hooks', 'hooks.json'),
+    JSON.stringify(lib.buildPluginHooksConfig(), null, 2) + '\n'
+  );
+  const hooksDist = path.join(ROOT, 'hooks', 'dist');
+  if (fs.existsSync(hooksDist)) {
+    for (const f of fs.readdirSync(hooksDist).filter(n => n.endsWith('.js'))) {
+      fs.copyFileSync(path.join(hooksDist, f), path.join(OUT, 'hooks', f));
+    }
+  }
+
+  // 5. Core (strip source-only internal learnings, same policy as the installer)
+  copyTree(path.join(ROOT, 'pan-wizard-core'), path.join(OUT, 'pan-wizard-core'), rewriteContent);
+  fs.rmSync(path.join(OUT, 'pan-wizard-core', 'learnings', 'internal'), { recursive: true, force: true });
+  fs.writeFileSync(path.join(OUT, 'pan-wizard-core', 'VERSION'), pkg.version);
+
+  // Sanity report
+  const count = (p) => { try { return fs.readdirSync(p).length; } catch { return 0; } };
+  console.log('PAN plugin built at', path.relative(ROOT, OUT));
+  console.log('  commands/pan:', count(path.join(OUT, 'commands', 'pan')));
+  console.log('  agents:', count(path.join(OUT, 'agents')));
+  console.log('  hooks:', count(path.join(OUT, 'hooks')));
+  console.log('  version:', pkg.version);
+}
+
+main();

package/scripts/install-git-hooks.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * install-git-hooks.js
+ *
+ * Points this repo's git at `scripts/git-hooks/` instead of the per-clone
+ * `.git/hooks/` directory. Run automatically by the `prepare` npm script,
+ * which fires on `npm install` inside the source repo.
+ *
+ * Why this exists:
+ *   `.git/hooks/` is per-clone (never committed). Without this, every fresh
+ *   clone of PAN Wizard would have to manually `cp scripts/git-hooks/pre-commit
+ *   .git/hooks/` to get the gitleaks pre-commit scan. With `core.hooksPath`
+ *   set to the tracked `scripts/git-hooks/` directory, the hook is active
+ *   the moment you finish `npm install`.
+ *
+ * No-op when not in a git working tree (e.g., the package is being installed
+ * as a dependency in someone else's `node_modules/`, where there's no `.git`).
+ *
+ * Safe to re-run.
+ */
+
+'use strict';
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const HOOKS_DIR = 'scripts/git-hooks';
+
+// 1. Are we in a git working tree? If not, this is a downstream install —
+//    do nothing.
+const gitDir = path.join(REPO_ROOT, '.git');
+if (!fs.existsSync(gitDir)) {
+  // Silent no-op for downstream consumers. Their `node_modules/pan-wizard/`
+  // doesn't have its own .git directory.
+  process.exit(0);
+}
+
+// 2. Set core.hooksPath. Idempotent — overwrites any previous value.
+try {
+  execFileSync('git', ['config', '--local', 'core.hooksPath', HOOKS_DIR], {
+    cwd: REPO_ROOT,
+    stdio: 'inherit',
+  });
+} catch (err) {
+  // If `git` isn't on PATH or the config write fails, warn but don't fail
+  // the install. The user can run this manually later.
+  console.warn(`[install-git-hooks] could not set core.hooksPath: ${err.message}`);
+  process.exit(0);
+}
+
+// 3. Confirm the hook file is executable on Unix. On Windows the bit doesn't
+//    matter — Git Bash treats `.sh` and shebanged scripts as executable.
+const hookFile = path.join(REPO_ROOT, HOOKS_DIR, 'pre-commit');
+if (process.platform !== 'win32') {
+  try {
+    fs.chmodSync(hookFile, 0o755);
+  } catch {
+    // Best effort.
+  }
+}
+
+console.error(`[install-git-hooks] core.hooksPath → ${HOOKS_DIR} (gitleaks pre-commit active)`);

package/scripts/release-check.js

@@ -100,6 +100,17 @@ process.stderr.write('\n[release-check] Gate 4/6: doc-lint counts docs/\n');
   }
 }
 
+
+// npm runs lifecycle scripts (prepare) before pack; any of their stdout noise
+// lands ahead of the --json payload. npm pretty-prints the JSON array starting
+// on its own line — parse from there.
+function parseNpmJson(stdout) {
+  try { return JSON.parse(stdout); } catch { /* fall through to extraction */ }
+  const m = stdout.search(/^[[{]s*$/m);
+  if (m === -1) throw new Error('no JSON payload found in npm output');
+  return JSON.parse(stdout.slice(m));
+}
+
 // Gate 5: npm pack dry-run
 process.stderr.write('\n[release-check] Gate 5/6: npm pack --dry-run\n');
 {
@@ -111,7 +122,7 @@ process.stderr.write('\n[release-check] Gate 5/6: npm pack --dry-run\n');
   }
   // Parse the JSON output to check size
   try {
-    const parsed = JSON.parse(r.stdout);
+    const parsed = parseNpmJson(r.stdout);
     const entry = Array.isArray(parsed) ? parsed[0] : parsed;
     const size = entry.size || 0;
     const fileCount = entry.files ? entry.files.length : 0;
@@ -139,7 +150,7 @@ if (SKIP_SMOKE) {
       logGate('smoke install (pack)', false, `exit ${pack.status}`);
       process.exit(1);
     }
-    const packJson = JSON.parse(pack.stdout);
+    const packJson = parseNpmJson(pack.stdout);
     const tarball = path.join(tmpDir, packJson[0].filename);
     if (!fs.existsSync(tarball)) {
       logGate('smoke install (pack)', false, `tarball not found at ${tarball}`);