premanmcp 0.10.6 → 0.11.0

package/bin/verify.js

@@ -18,6 +18,7 @@
  * unless the repository has explicitly opted into blocking.
  */
 
+import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -25,7 +26,7 @@ import path from "node:path";
 import { changedFilesForPush, readChangedFiles, readPushRefsFromStdin, repoRoot } from "./changed.js";
 import { resolveLocalTarget } from "./detect.js";
 import { createReporter } from "./progress.js";
-import { backendUrl, callBackendJson, cliInvocation, makeArgs, resolveApiKey } from "./shared.js";
+import { backendUrl, callBackendJson, cliInvocation, makeArgs, nowMs, resolveApiKey } from "./shared.js";
 
 export const VERIFY_HELP = `
 Verify options:
@@ -42,6 +43,10 @@ Verify options:
 const DEFAULT_TIMEOUT_SECONDS = 120;
 const REQUEST_TIMEOUT_MS = 10_000;
 const CONCURRENCY = 6;
+const INVENTORY_PAGE_SIZE = 200;
+const INVENTORY_MAX_ENDPOINTS = 2000;
+// POST /projects/{id}/api-runs rejects more than this (schemas.pulse.MAX_UPLOAD_RUNS).
+const UPLOAD_BATCH_SIZE = 200;
 const READ_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 // Never fired automatically even against loopback: a destructive verb that
 // happens to point at a real datastore is not made safe by the port being local.
@@ -55,10 +60,6 @@ const REPO_CONFIG = ".preman.json";
 // push — the exact failure the advisory guarantee exists to prevent.
 export const BLOCK_EXIT_CODE = 97;
 
-function nowMs() {
-  return Number(process.hrtime.bigint() / 1000000n);
-}
-
 function originLabel() {
   const raw = `${os.hostname() || "local"}`.toLowerCase();
   const cleaned = raw.replace(/[^a-z0-9._-]/g, "-").replace(/^[^a-z0-9]+/, "");
@@ -103,7 +104,7 @@ async function runCase(baseUrl, endpoint, { batchId }) {
       client_run_id: `${batchId}:${method}:${endpoint.path_template || endpoint.path}`,
       method,
       url: target,
-      status: "errored",
+      status: "error",
       http_status: null,
       latency_ms: nowMs() - t0,
       error_message: aborted ? `timed out after ${REQUEST_TIMEOUT_MS}ms` : String(error?.message || error),
@@ -201,7 +202,7 @@ async function runGeneratedCase(testCase, { batchId, endpoint }) {
       endpoint: `${endpoint.method} ${endpoint.path}`,
       method,
       url: testCase.url,
-      status: "errored",
+      status: "error",
       http_status: null,
       latency_ms: nowMs() - t0,
       error_message: aborted ? `timed out after ${REQUEST_TIMEOUT_MS}ms` : String(error?.message || error),
@@ -239,19 +240,66 @@ async function safeCall(args, method, routePath, options) {
 }
 
 async function fetchInventory(args, token) {
-  const result = await safeCall(args, "POST", "/mcp/call-tool", {
-    token,
-    json: { tool: "get_endpoints", arguments: { format: "json" } },
-  });
-  if (!result.ok) return { endpoints: [], error: result.detail || `status ${result.status_code}` };
-
-  const payload = result.result ?? result.data ?? result;
-  const endpoints =
-    payload?.endpoints ||
-    payload?.result?.endpoints ||
-    (Array.isArray(payload) ? payload : []) ||
-    [];
-  return { endpoints: Array.isArray(endpoints) ? endpoints : [] };
+  const endpoints = [];
+  for (let offset = 0; offset < INVENTORY_MAX_ENDPOINTS; offset += INVENTORY_PAGE_SIZE) {
+    const result = await safeCall(args, "POST", "/mcp/call-tool", {
+      token,
+      json: {
+        tool: "get_endpoints",
+        arguments: { format: "json", limit: INVENTORY_PAGE_SIZE, offset },
+      },
+    });
+    if (!result.ok) {
+      return {
+        endpoints,
+        error: result.detail || `status ${result.status_code}`,
+      };
+    }
+
+    const payload = result.result ?? result.data ?? result;
+    const page =
+      payload?.endpoints ||
+      payload?.result?.endpoints ||
+      (Array.isArray(payload) ? payload : []) ||
+      [];
+    const rows = Array.isArray(page) ? page : [];
+    endpoints.push(...rows);
+    const pagination = payload?.pagination || payload?.result?.pagination;
+    if (!pagination?.has_more || rows.length === 0) break;
+    if (offset + INVENTORY_PAGE_SIZE >= INVENTORY_MAX_ENDPOINTS) {
+      return {
+        endpoints,
+        error: `endpoint inventory exceeds the ${INVENTORY_MAX_ENDPOINTS}-endpoint verification limit`,
+        incomplete: true,
+      };
+    }
+  }
+  return { endpoints };
+}
+
+async function uploadRuns(args, { token, projectId, batchId, runs }) {
+  if (!projectId || !runs.length) return { inserted: 0, error: null };
+  let inserted = 0;
+  for (let offset = 0; offset < runs.length; offset += UPLOAD_BATCH_SIZE) {
+    const chunk = runs.slice(offset, offset + UPLOAD_BATCH_SIZE);
+    const upload = await safeCall(args, "POST", `/projects/${projectId}/api-runs`, {
+      token,
+      json: {
+        origin: "local",
+        origin_label: originLabel(),
+        source: "ci",
+        batch_id: batchId,
+        batch_label: "pre-push verify",
+        runs: chunk,
+      },
+    });
+    if (!upload.ok) {
+      const detail = upload.detail || (upload.status_code ? `HTTP ${upload.status_code}` : "request failed");
+      return { inserted, error: `verification results were not uploaded: ${detail}` };
+    }
+    inserted += Number(upload.inserted || 0);
+  }
+  return { inserted, error: null };
 }
 
 function selectMethods(args) {
@@ -390,7 +438,7 @@ async function runPlan(
     stream: asJson ? process.stderr : process.stdout,
     live: asJson ? false : undefined,
   });
-  const batchId = `prepush-${Date.now().toString(36)}`;
+  const batchId = randomUUID();
   const changes = plan.changes || [];
 
   if (!asJson) {
@@ -449,21 +497,8 @@ async function runPlan(
   );
   const removed = changes.filter((c) => c.change_type === "removed");
 
-  let uploaded = 0;
-  if (projectId && completed.length) {
-    const upload = await safeCall(args, "POST", `/projects/${projectId}/api-runs`, {
-      token,
-      json: {
-        origin: "local",
-        origin_label: originLabel(),
-        source: "ci",
-        batch_id: batchId,
-        batch_label: "pre-push verify",
-        runs: completed,
-      },
-    });
-    if (upload.ok) uploaded = Number(upload.inserted || 0);
-  }
+  const upload = await uploadRuns(args, { token, projectId, batchId, runs: completed });
+  const uploaded = upload.inserted;
 
   const gate = blockOnBreaking(args, root);
   const shouldBlock = gate.blocking && (breaking.length > 0 || removed.length > 0);
@@ -479,6 +514,7 @@ async function runPlan(
     }
     if (withheld) reporter.line(`[preman] ${withheld} mutating case${withheld === 1 ? "" : "s"} withheld`);
     if (uploaded) reporter.line(`[preman] uploaded ${uploaded} run${uploaded === 1 ? "" : "s"}`);
+    if (upload.error) reporter.line(`[preman] ${upload.error}`);
     if (shouldBlock) {
       reporter.line(`[preman] blocking this push (${gate.from}). Set PREMAN_SKIP_HOOK=1 to override.`);
     } else if (breaking.length || removed.length) {
@@ -518,6 +554,7 @@ async function runPlan(
       error: r.error_message || null,
     })),
     uploaded,
+    upload_error: upload.error,
     // Advisory unless the repository opted in. `advisory` only flattens an
     // unexpected throw; a deliberate block has to survive it.
     exitCode: shouldBlock ? BLOCK_EXIT_CODE : 0,
@@ -589,7 +626,8 @@ async function runVerify(args) {
   }
 
   const extraPorts = args.value("--port", "") ? [args.value("--port", "")] : [];
-  const resolved = await resolveLocalTarget([...planEndpoints, ...endpoints], {
+  const confirmationEndpoints = planEndpoints.length ? planEndpoints : endpoints;
+  const resolved = await resolveLocalTarget(confirmationEndpoints, {
     extraPorts,
     timeoutMs: 2000,
   });
@@ -605,6 +643,7 @@ async function runVerify(args) {
 
   const target = resolved.target;
   const policy = selectMethods(args);
+  const targetInventory = resolved.inventory || endpoints;
 
   if (planned.plan?.selected?.length) {
     return finish(
@@ -623,7 +662,7 @@ async function runVerify(args) {
     );
   }
 
-  const selected = endpoints.filter((ep) => {
+  const selected = targetInventory.filter((ep) => {
     const method = String(ep.method || "GET").toUpperCase();
     if (READ_METHODS.has(method)) return true;
     if (DESTRUCTIVE_METHODS.has(method)) return false;
@@ -638,7 +677,7 @@ async function runVerify(args) {
     );
   }
 
-  const batchId = `prepush-${Date.now().toString(36)}`;
+  const batchId = randomUUID();
   const runs = await runPool(
     selected,
     (endpoint) =>
@@ -650,21 +689,8 @@ async function runVerify(args) {
   const completed = runs.filter(Boolean);
   const failed = completed.filter((r) => r.status !== "passed");
 
-  let uploaded = 0;
-  if (projectId && completed.length) {
-    const upload = await safeCall(args, "POST", `/projects/${projectId}/api-runs`, {
-      token,
-      json: {
-        origin: "local",
-        origin_label: originLabel(),
-        source: "ci",
-        batch_id: batchId,
-        batch_label: "pre-push verify",
-        runs: completed,
-      },
-    });
-    if (upload.ok) uploaded = Number(upload.inserted || 0);
-  }
+  const upload = await uploadRuns(args, { token, projectId, batchId, runs: completed });
+  const uploaded = upload.inserted;
 
   const outcome = {
     state: failed.length ? "failed" : "passed",
@@ -678,6 +704,7 @@ async function runVerify(args) {
       error: r.error_message || null,
     })),
     uploaded,
+    upload_error: upload.error,
     // Advisory by construction: a real failure still reports zero so the push
     // proceeds. The report is the product, not the gate.
     exitCode: 0,
@@ -695,6 +722,7 @@ async function runVerify(args) {
       process.stdout.write(`[preman] all ${completed.length} endpoints healthy\n`);
     }
     if (uploaded) process.stdout.write(`[preman] uploaded ${uploaded} run${uploaded === 1 ? "" : "s"}\n`);
+    if (upload.error) process.stdout.write(`[preman] ${upload.error}\n`);
   }
 
   return finish({ ...outcome, message: null });

package/dist/server.js

@@ -381,7 +381,8 @@ export function createServer() {
             "",
             "## Tool taxonomy",
             "- **Read tools** (no side effects): get_endpoints, get_coverage, detect_drift, preman_status, list_collections, get_collection, list_runs",
-            "- **Action tools** (execute tests / mutate state): test_api, generate_tests, generate_endpoint_tests, run_stress_test, import_collection, test_endpoint_by_id, register_discovered_endpoints, run_tests, delete_collection",
+            "- **Action tools** (execute tests / mutate state): test_api, generate_tests, generate_endpoint_tests, run_stress_test, start_test_campaign, import_collection, test_endpoint_by_id, register_discovered_endpoints, run_tests, delete_collection",
+            "- **Create-then-delete contracts**: propose_lifecycle_contracts (propose a POST/DELETE pairing), approve_lifecycle_contracts (user decision — ask first)",
             "- **MCP conversion tools**: discover_endpoints_from_codebase, verify_endpoints_live, mcp_preview (returns inline two-pane panel), mcp_deploy, mcp_list_deployed, mcp_mint_consumer_token, mcp_revoke_consumer_token",
             "- **Auth (API key / PreMan)**: preman_create_api_key (JWT -> saved pm_live_ key), preman_login, preman_login_complete, preman_logout",
             "- **Auth (app JWT — email/OTP/password on your API)**: user_auth_start_signup, user_auth_signup, user_auth_verify_otp, user_auth_login, user_auth_needs_password, user_auth_resend_otp, user_auth_forgot_password, user_auth_set_password, user_auth_me, user_auth_change_password, user_auth_delete_account (HTTP to PREMAN_BACKEND /auth/*; no pm_live_ key required)",
@@ -393,9 +394,11 @@ export function createServer() {
             "- 'preview my MCP before deploying': mcp_preview (read-only). 'actually deploy': mcp_deploy.",
             "- 'test the login endpoint' / 'hit POST /auth/login with body': test_api with the full URL. Use test_endpoint_by_id ONLY when the user references a saved endpoint by id/uuid.",
             "- 'import my Postman/OpenAPI/Bruno/curl collection': import_collection.",
+            "- 'migrate / move / switch from Postman', 'bring my Postman workspace over': migrate_from_postman — it imports AND creates scheduled suites, environments and alerts in one call. Prefer it over import_collection whenever the user frames this as leaving Postman.",
             "- 'generate tests for endpoint X' / 'write unit tests for X and run them': generate_endpoint_tests (set include_code=true and write the returned code_artifacts to disk when the user wants test files).",
             "- 'stress / load test X': run_stress_test. Read-only unless the user explicitly authorises writes — never set allow_writes yourself.",
-            "- After discover_endpoints_from_codebase, call register_discovered_endpoints with the JSON array it asked for, then verify_endpoints_live to confirm they respond.",
+            "- After discover_endpoints_from_codebase, call register_discovered_endpoints with the JSON array it asked for. That streams endpoints to the Playground and starts a read-safe test campaign. Then verify_endpoints_live if you need a live probe.",
+            "- 'why aren't my POSTs tested?' / 'test the creates too': POSTs are skipped because nothing undoes them. Read the code, pair each POST with the DELETE that reverses it via propose_lifecycle_contracts, then ask the user to approve. Approve once and every campaign creates and deletes a real record. Never call approve_lifecycle_contracts without the user saying yes.",
             "- App-auth flows (signup, OTP, login, change_password) live under the user_auth_* tools and do not need an pm_live_ key.",
             "- PREMAN_BACKEND / backend_url is the PreMan control plane. It is NOT the target API upstream for a generated MCP unless the user's own API is PreMan. Prefer base_url from verify_endpoints_live results.",
             "",
@@ -410,6 +413,7 @@ export function createServer() {
             "2. **Import then generate**: import_collection (Postman/OpenAPI/curl) -> generate_tests -> test_api to run them.",
             '3. **Coverage audit**: get_coverage on a collection -> generate_tests(coverage_level="comprehensive") for gaps.',
             "4. **Drift detection**: detect_drift with a collection + base_url -> test_api on drifted endpoints.",
+            "5. **Postman migration**: migrate_from_postman -> review next_steps (base URLs, secrets needing values) -> re-run with activate=true -> failures open fix tasks you collect with preman_get_fix_task.",
             "",
             "## Auth",
             "PreMan API tools (get_endpoints, test_api, …) need an pm_live_ key. Preferred no-browser flow: user_auth_start_signup -> user_auth_set_password -> preman_create_api_key, or user_auth_login -> preman_create_api_key. Browser fallback: preman_login -> preman_login_complete.",
@@ -539,7 +543,7 @@ export function createServer() {
         }
     });
     // ── register_discovered_endpoints ─────────────────────────────────
-    server.tool("register_discovered_endpoints", "Save discovered endpoints into PreMan and set them up as runnable requests. Use after discover_endpoints_from_codebase with the JSON array its brief asked you to build; then call verify_endpoints_live to confirm they respond.", {
+    server.tool("register_discovered_endpoints", "Save discovered endpoints into PreMan, stream them to the Playground, and start a read-safe test campaign. Use after discover_endpoints_from_codebase. Mutating endpoints stay skipped until start_test_campaign(allow_writes=true).", {
         endpoints: z.array(z.record(z.any())).optional().describe("Discovery-shaped endpoint objects (method, path_template, schemas, confidence, …); max 100"),
         endpoint_ids: z.array(z.string()).optional().describe("Alternatively, existing registry ids to set up as runnable requests"),
         project_id: z.string().optional().describe("Scope registration to a project"),
@@ -548,12 +552,64 @@ export function createServer() {
     }, async (args) => {
         try {
             const result = await callBackend("register_discovered_endpoints", args);
-            return withFrontendUrl(result, "/endpoints");
+            return withFrontendUrl(result, "/try");
         }
         catch (e) {
             return toolError(e.message, inferErrorCode(e.message), {
                 next_actions: ["Run discover_endpoints_from_codebase first and pass its endpoints array here."],
-                related_tools: ["discover_endpoints_from_codebase", "verify_endpoints_live"],
+                related_tools: ["discover_endpoints_from_codebase", "start_test_campaign", "verify_endpoints_live"],
+            });
+        }
+    });
+    server.tool("start_test_campaign", "Fan out tests across registered endpoints: functional scenarios, GET-only stress, and security-lite negatives (missing auth / empty body). Read-only by default. Not a scanner or exploit runner.", {
+        endpoint_ids: z.array(z.string()).optional().describe("Registry ids from register_discovered_endpoints"),
+        allow_writes: z.boolean().optional().default(false).describe("Permit POST/PUT/PATCH functional jobs; DELETE stays skipped"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("start_test_campaign", args);
+            return withFrontendUrl(result, "/try");
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: ["Call register_discovered_endpoints first, then pass its endpoint_ids."],
+                related_tools: ["register_discovered_endpoints", "get_endpoints"],
+            });
+        }
+    });
+    // ── create-then-delete contracts ──────────────────────────────────
+    server.tool("propose_lifecycle_contracts", "Propose that a POST be tested for real by deleting what it creates. You read the customer's routes and response models, so you know which DELETE undoes which POST and where the new id appears. PreMan re-checks eligibility itself: billing-, auth- and notification-shaped creates are always rejected because a DELETE cannot claw back money or unsend an email. Proposals do nothing until the user approves them.", {
+        contracts: z
+            .array(z.object({
+            create_endpoint_id: z.string().describe("Registry id of the POST"),
+            cleanup_endpoint_id: z.string().describe("Registry id of the DELETE that undoes it"),
+            id_source: z.string().optional().describe("Where the new id sits in the create response, e.g. 'json.id' or 'json.data.id'"),
+            evidence: z.string().optional().describe("Why this pairing is correct (route/model you read)"),
+        }))
+            .describe("Pairings to propose; max 100"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("propose_lifecycle_contracts", args);
+            return withFrontendUrl(result, "/try");
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: ["Register the endpoints first so both ids exist, then propose the pairing."],
+                related_tools: ["register_discovered_endpoints", "approve_lifecycle_contracts"],
+            });
+        }
+    });
+    server.tool("approve_lifecycle_contracts", "Approve (or reject) create-then-delete contracts. ASK THE USER FIRST — never approve on their behalf. An approved create runs for real on every campaign from then on, teardown included; the teardown is scoped to the id that run just created and can never delete anything else.", {
+        contract_ids: z.array(z.string()).describe("Ids from propose_lifecycle_contracts or register_discovered_endpoints' lifecycle_proposals"),
+        approve: z.boolean().optional().default(true).describe("False records a rejection so the pairing stops being re-proposed"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("approve_lifecycle_contracts", args);
+            return withFrontendUrl(result, "/try");
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: ["Confirm with the user which POST endpoints they want exercised for real, then retry."],
+                related_tools: ["propose_lifecycle_contracts", "start_test_campaign"],
             });
         }
     });
@@ -665,6 +721,57 @@ export function createServer() {
             });
         }
     });
+    // ── migrate_from_postman ──────────────────────────────────────────
+    server.tool("migrate_from_postman", "Move a Postman collection into PreMan, fully wired, in one call. Converts the collection keeping the assertions its pm.test blocks declared, splits the environment into shared variables and encrypted secrets, and creates one scheduled test suite per request seeded from those assertions. Suites are created switched OFF; pass activate=true to start them and attach alert rules so a failing check opens a fix task. Returns next_steps — the honest list of what still needs a human.", {
+        content: z.string().optional().describe("Raw Postman collection export (v2.x JSON)"),
+        collection_id: z.string().optional().describe("Pull from a connected Postman workspace instead of pasting content"),
+        environment: z.string().optional().describe("Raw Postman environment export (JSON)"),
+        name: z.string().optional().describe("Override the collection name"),
+        project_id: z.string().optional().describe("Scope the migration to a project"),
+        activate: z.boolean().optional().default(false).describe("Start the suites and create alert rules. Leave false to review first."),
+        channel_ids: z.array(z.string()).optional().describe("Alert channels to notify. Empty still records events and opens fix tasks."),
+        autofix_enabled: z.boolean().optional().default(false).describe("Let a failure dispatch to the coding agent automatically"),
+        include_yaml: z.boolean().optional().default(false).describe("Include the full .ot.yaml string (default false to save tokens)"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("migrate_from_postman", args);
+            const collectionId = result?.collection_id ?? "";
+            const dashPath = collectionId ? `/collections?id=${collectionId}` : "/collections";
+            emitActivity("navigate", { path: dashPath });
+            emitActivity("data_refresh", { scope: "collections" });
+            return withFrontendUrl({ ...result, ...agentSessionPayload(dashPath) }, dashPath);
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: [
+                    "Provide either content (a Postman v2.x export) or collection_id from a connected Postman workspace.",
+                    "Connect a workspace at /integrations/postman/connect to use collection_id.",
+                ],
+                related_tools: ["import_collection", "get_endpoints"],
+            });
+        }
+    });
+    // ── recover_assertions ────────────────────────────────────────────
+    server.tool("recover_assertions", "Hand back assertions you translated from a Postman script PreMan could not read. An import's migration_report lists every dropped pm.test block with the script attached under entries[].source — read that JavaScript, convert what it checks, and call this. The assertion lands on the collection endpoint, its workbench request and the scheduled suite, so the next run grades it. Each assertion accepts: status (int or '2xx'), status_not (int), response_time_ms ('< 500'), json_paths ({'json.id': 7}, or 'exists' to require a field).", {
+        collection_id: z.string().describe("The collection the import created"),
+        endpoint_id: z.string().describe("entries[].endpoint_id from the migration report (or the endpoint name)"),
+        assertions: z.array(z.record(z.any())).describe("The converted assertions"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("recover_assertions", args);
+            emitActivity("data_refresh", { scope: "collections" });
+            return { content: [{ type: "text", text: JSON.stringify(result) }] };
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: [
+                    "Check collection_id and endpoint_id against the migration_report entries.",
+                    "Each assertion must use the documented fields: status, status_not, response_time_ms, json_paths.",
+                ],
+                related_tools: ["get_collection", "migrate_from_postman"],
+            });
+        }
+    });
     // ── detect_drift ──────────────────────────────────────────────────
     server.tool("detect_drift", "Detect spec drift by comparing live API responses against a collection spec. Returns a list of drift alerts per endpoint with expected vs actual differences.", {
         base_url: z.string().describe("Base URL to test against (e.g. https://api.example.com)"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "0.10.6",
+  "version": "0.11.0",
   "description": "Turn APIs into agent-callable MCP tools with auth, testing, and audit logs",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "open-mcp-preview-in-cursor": "node scripts/open-cursor-preview.mjs",
     "test": "npm run build && npm run test:connect && npm run test:node",
     "test:connect": "node scripts/smoke-connect.mjs",
-    "test:node": "node --test --test-timeout=90000 scripts/smoke-launcher-config.mjs scripts/smoke-runner.mjs scripts/smoke-repo-config.mjs scripts/smoke-onboard.mjs scripts/smoke-local-detect.mjs scripts/smoke-prepush-hook.mjs scripts/smoke-cli-identity.mjs scripts/smoke-runner-heartbeat.mjs scripts/smoke-verify-prepush.mjs scripts/smoke-push-diff.mjs scripts/smoke-progress-reporter.mjs scripts/smoke-verify-plan.mjs scripts/smoke-install-desktop.mjs scripts/smoke-api-tools.mjs scripts/smoke-bin-scope.mjs"
+    "test:node": "node --test --test-timeout=90000 scripts/smoke-account.mjs scripts/smoke-cli-entrypoint.mjs scripts/smoke-launcher-config.mjs scripts/smoke-runner.mjs scripts/smoke-repo-config.mjs scripts/smoke-onboard.mjs scripts/smoke-local-detect.mjs scripts/smoke-prepush-hook.mjs scripts/smoke-cli-identity.mjs scripts/smoke-runner-heartbeat.mjs scripts/smoke-verify-prepush.mjs scripts/smoke-push-diff.mjs scripts/smoke-progress-reporter.mjs scripts/smoke-verify-plan.mjs scripts/smoke-install-desktop.mjs scripts/smoke-api-tools.mjs scripts/smoke-tests-workbench.mjs scripts/smoke-bin-scope.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^0.1.0",