tribunal-kit 5.8.4 → 6.0.0

package/bin/mcp-server.js

@@ -7,8 +7,8 @@
  * over standard I/O, allowing AI clients (Cursor, Windsurf, Claude) to natively
  * invoke tribunal checks.
  *
- * PERF: Commands are loaded in-process via require() — no child process spawn.
- * This eliminates ~200-500ms overhead per tool call that spawnSync introduced.
+ * In-process tools load reusable modules directly. Commands that depend on a
+ * standalone CLI process remain isolated deliberately.
  *
  * Protocol: MCP 2024-11-05 over JSON-RPC 2.0 / stdio
  */
@@ -18,7 +18,7 @@ const { spawnSync } = require("child_process");
 
 const PKG = require(path.resolve(__dirname, "../package.json"));
 
-// Timeout for spawned processes (30 seconds) — only used for Rust binary calls
+// Timeout for intentionally isolated child processes (30 seconds).
 const SPAWN_TIMEOUT_MS = 30000;
 
 // Minimal JSON-RPC 2.0 over stdio
@@ -31,61 +31,60 @@ const rl = readline.createInterface({
 });
 
 /**
- * Run the validate command via the Rust binary (if available) or JS fallback.
- * This is the only command that still benefits from process spawn (Rust speed).
+ * Run the workspace integrity audit without invoking the CLI schema validator.
+ * The MCP audit is about Tribunal assets, while `tk validate` validates one
+ * explicitly supplied payload and schema.
  */
-function runValidateCommand() {
-  const os = require("os");
+function runTribunalAudit() {
   const fs = require("fs");
-  const isWindows = os.platform() === "win32";
-  const ext = isWindows ? ".exe" : "";
-  const platform = os.platform();
-  const arch = os.arch();
-
-  // Try Rust binary first
-  const pkgName = `@tribunal-kit/core-${platform}-${arch}`;
-  let binPath = null;
-  try {
-    const pkgPath = require.resolve(`${pkgName}/package.json`);
-    const candidatePath = path.resolve(
-      path.dirname(pkgPath),
-      `bin/tribunal-core${ext}`,
-    );
-    if (fs.existsSync(candidatePath)) binPath = candidatePath;
-  } catch (_) {}
-  if (!binPath) {
-    const devPath = path.resolve(
-      __dirname,
-      "..",
-      "target",
-      "release",
-      `tribunal-core${ext}`,
-    );
-    if (fs.existsSync(devPath)) binPath = devPath;
-  }
+  const projectRoot = process.cwd();
+  const manifestScript = path.join(
+    projectRoot,
+    ".agent",
+    "scripts",
+    "integrity_manifest.js",
+  );
 
-  if (binPath) {
-    const result = spawnSync(binPath, ["validate"], {
-      encoding: "utf8",
-      timeout: SPAWN_TIMEOUT_MS,
-    });
-    return result.stdout || result.stderr || "No output";
+  if (!fs.existsSync(manifestScript)) {
+    return "Error: .agent/scripts/integrity_manifest.js was not found. Run `tk init` first.";
   }
 
-  // JS fallback — in-process
-  return "Validate command requires the Rust binary. Run: cargo build --release";
+  try {
+    const { generateManifest } = require(manifestScript);
+    const manifest = generateManifest(projectRoot);
+    if (manifest.error) return `Error: ${manifest.error}`;
+
+    const { integrity } = manifest;
+    const lines = [
+      "Tribunal audit complete.",
+      `Agents: ${manifest.agents.total} (${manifest.agents.reviewer_count} reviewers)`,
+      `Skills: ${manifest.skills.total}`,
+      `Scripts: ${manifest.scripts.total}`,
+      `Workflows: ${manifest.workflows.total}`,
+      `References: ${integrity.total_references}; phantom references: ${integrity.phantom_references}`,
+      `Count claims: ${integrity.total_claims}; invalid claims: ${integrity.invalid_claims}`,
+    ];
+
+    if (integrity.phantom_references > 0 || integrity.invalid_claims > 0) {
+      lines.push("Audit found integrity issues; run `tk guardrail --scan` for remediation details.");
+    } else {
+      lines.push("All discovered references and global asset-count claims are valid.");
+    }
+    return lines.join("\n");
+  } catch (error) {
+    return `Audit failed: ${error.message}`;
+  }
 }
 
 /**
- * Search case law — loaded in-process for zero-spawn latency.
+ * Search case law in an isolated process because its CLI owns persistent state.
  */
 function searchCaseLaw(query) {
   const caseLawScript = path.resolve(
     __dirname,
     "../.agent/scripts/case_law_manager.js",
   );
-  // We still spawn for case_law_manager since it's a standalone script
-  // that modifies global state, but we use spawn with minimal overhead
+  // case_law_manager is a standalone stateful CLI, so retain its process boundary.
   const result = spawnSync(
     process.execPath,
     [caseLawScript, "search-cases", "--query", query],
@@ -94,6 +93,10 @@ function searchCaseLaw(query) {
       timeout: SPAWN_TIMEOUT_MS,
     },
   );
+  if (result.error) {
+    if (result.error.code === "ETIMEDOUT") return "Error: Case law search timed out (exceeded 30s limit)";
+    return `Error executing case law search: ${result.error.message}`;
+  }
   return result.stdout || result.stderr || "No results";
 }
 
@@ -108,12 +111,27 @@ function stripBoilerplate(text) {
 }
 
 function handleRequest(req) {
+  if (req.method === "notifications/initialized" || req.method === "notifications/cancelled") {
+    return null;
+  }
+  if (req.method === "ping") {
+    return {};
+  }
+  if (req.method === "resources/list") {
+    return { resources: [] };
+  }
+  if (req.method === "prompts/list") {
+    return { prompts: [] };
+  }
+
   // MCP spec: method names follow path-style convention
   if (req.method === "initialize") {
     return {
       protocolVersion: "2024-11-05",
       capabilities: {
         tools: {},
+        resources: { subscribe: false, listChanged: false },
+        prompts: { listChanged: false },
       },
       serverInfo: {
         name: "tribunal-kit-mcp",
@@ -301,7 +319,7 @@ function handleRequest(req) {
     }
 
     if (toolName === "run_tribunal_audit") {
-      const text = runValidateCommand();
+      const text = runTribunalAudit();
       return { content: [{ type: "text", text }] };
     }
 
@@ -365,10 +383,12 @@ function handleRequest(req) {
     if (toolName === "get_tribunal_agent") {
       const fs = require("fs");
       const name = req.params?.arguments?.name;
-      if (!name) throw { code: -32602, message: "Missing argument: name" };
-      const path = require("path");
+      if (!name || typeof name !== "string") throw { code: -32602, message: "Missing or invalid argument: name (string)" };
       const sanitizedName = path.basename(name);
-      const agentPath = path.join(process.cwd(), ".agent", "agents", `${sanitizedName}.md`);
+      const agentsDir = path.resolve(process.cwd(), ".agent", "agents");
+      const agentPath = path.resolve(agentsDir, `${sanitizedName}.md`);
+      // Path containment: ensure resolved path stays within agents directory
+      if (!agentPath.startsWith(agentsDir)) throw { code: -32602, message: "Invalid agent name: path traversal detected" };
       if (!fs.existsSync(agentPath)) return { content: [{ type: "text", text: `Agent '${sanitizedName}' not found.` }] };
       const text = fs.readFileSync(agentPath, "utf8");
       return { content: [{ type: "text", text: stripBoilerplate(text) }] };
@@ -385,10 +405,12 @@ function handleRequest(req) {
     if (toolName === "get_tribunal_skill") {
       const fs = require("fs");
       const name = req.params?.arguments?.name;
-      if (!name) throw { code: -32602, message: "Missing argument: name" };
-      const path = require("path");
+      if (!name || typeof name !== "string") throw { code: -32602, message: "Missing or invalid argument: name (string)" };
       const sanitizedName = path.basename(name);
-      const skillPath = path.join(process.cwd(), ".agent", "skills", sanitizedName, "SKILL.md");
+      const skillsDir = path.resolve(process.cwd(), ".agent", "skills");
+      const skillPath = path.resolve(skillsDir, sanitizedName, "SKILL.md");
+      // Path containment: ensure resolved path stays within skills directory
+      if (!skillPath.startsWith(skillsDir)) throw { code: -32602, message: "Invalid skill name: path traversal detected" };
       if (!fs.existsSync(skillPath)) return { content: [{ type: "text", text: `Skill '${sanitizedName}' not found.` }] };
       const text = fs.readFileSync(skillPath, "utf8");
       return { content: [{ type: "text", text: stripBoilerplate(text) }] };
@@ -408,7 +430,8 @@ function handleRequest(req) {
       }
 
       try {
-        const { broker } = require("../.agent/scripts/context_broker.js");
+        const brokerScript = path.join(agentDest, "scripts", "context_broker.js");
+        const { broker } = require(brokerScript);
         const brokerResult = broker(task, files, model, agentDest);
         return { content: [{ type: "text", text: stripBoilerplate(brokerResult.promptText) }] };
       } catch (e) {
@@ -499,7 +522,42 @@ function handleRequest(req) {
   throw { code: -32601, message: `Unknown method: ${req.method}` };
 }
 
+function processSingleRequest(req) {
+  try {
+    const result = handleRequest(req);
+    // If it's a notification, do not send a response
+    if (req.id === undefined || req.id === null) {
+      return null;
+    }
+    return { jsonrpc: "2.0", id: req.id, result };
+  } catch (e) {
+    const code = e && typeof e.code === "number" ? e.code : -32603;
+    const message = e && e.message ? e.message : "Internal server error";
+    if (req.id === undefined || req.id === null) {
+      return {
+        jsonrpc: "2.0",
+        id: null,
+        error: { code, message },
+      };
+    }
+    return {
+      jsonrpc: "2.0",
+      id: req.id,
+      error: { code, message },
+    };
+  }
+}
+
 rl.on("line", (line) => {
+  if (line.length > 1048576) { // 1MB limit
+    const errorRes = {
+      jsonrpc: "2.0",
+      id: null,
+      error: { code: -32700, message: "Parse error: input line too long (exceeds 1MB limit)" },
+    };
+    console.log(JSON.stringify(errorRes));
+    return;
+  }
   if (!line.trim()) return;
 
   let req;
@@ -516,31 +574,22 @@ rl.on("line", (line) => {
     return;
   }
 
-  try {
-    const result = handleRequest(req);
-    const res = { jsonrpc: "2.0", id: req.id, result };
-    console.log(JSON.stringify(res));
-
-    // After initialize, send the initialized notification per MCP spec
-    if (req.method === "initialize") {
-      console.log(
-        JSON.stringify({
-          jsonrpc: "2.0",
-          method: "notifications/initialized",
-          params: {},
-        }),
-      );
+  if (Array.isArray(req)) {
+    const responses = [];
+    for (const singleReq of req) {
+      const response = processSingleRequest(singleReq);
+      if (response) {
+        responses.push(response);
+      }
+    }
+    if (responses.length > 0) {
+      console.log(JSON.stringify(responses));
+    }
+  } else {
+    const response = processSingleRequest(req);
+    if (response) {
+      console.log(JSON.stringify(response));
     }
-  } catch (e) {
-    // Send proper JSON-RPC error response
-    const code = e && typeof e.code === "number" ? e.code : -32603;
-    const message = e && e.message ? e.message : "Internal server error";
-    const errorRes = {
-      jsonrpc: "2.0",
-      id: req.id || null,
-      error: { code, message },
-    };
-    console.log(JSON.stringify(errorRes));
   }
 });
 
@@ -548,5 +597,6 @@ if (process.env.NODE_ENV === "test") {
   module.exports = {
     handleRequest,
     stripBoilerplate,
+    runTribunalAudit,
   };
 }

package/bin/wrapper.js

@@ -21,8 +21,14 @@ const RUST_COMMANDS = new Set([
   "hook",
   "uninstall",
   "memory",
+  "min-context",
+  "dag-schedule",
+  "context-compress",
+  "context-broker",
+  "optimize-step",
 ]);
 
+
 // Determine the path to the compiled Rust binary
 // In a full production release, this checks optionalDependencies in node_modules
 // For development, it checks the local target/release folder
@@ -30,6 +36,11 @@ function getBinaryPath() {
   if (process.env.TRIBUNAL_FORCE_JS === "1") {
     return null;
   }
+
+  if (process.env.TRIBUNAL_CORE_PATH && fs.existsSync(process.env.TRIBUNAL_CORE_PATH)) {
+    return process.env.TRIBUNAL_CORE_PATH;
+  }
+
   const isWindows = os.platform() === "win32";
   const ext = isWindows ? ".exe" : "";
   const platform = os.platform();
@@ -38,46 +49,62 @@ function getBinaryPath() {
   // First, try production resolution (from optionalDependencies)
   const pkgName = `@tribunal-kit/core-${platform}-${arch}`;
   try {
-    // Try to resolve the binary from the optional dependency package
     const pkgPath = require.resolve(`${pkgName}/package.json`);
-    const binPath = path.resolve(
-      path.dirname(pkgPath),
-      `bin/tribunal-core${ext}`,
-    );
+    const pkgDir = path.dirname(pkgPath);
+    const binPath = path.resolve(pkgDir, `bin/tribunal-core${ext}`);
     if (fs.existsSync(binPath)) {
       return binPath;
     }
+    const rootBinPath = path.resolve(pkgDir, `tribunal-core${ext}`);
+    if (fs.existsSync(rootBinPath)) {
+      return rootBinPath;
+    }
   } catch {
     // Package not found, ignore and fall back to local dev targets
   }
 
-  // Second, try to find the binary compiled from crates/core/Cargo.toml (Local dev)
-  const devPath = path.resolve(
-    __dirname,
-    "..",
-    "target",
-    "release",
-    `tribunal-core${ext}`,
-  );
-  if (fs.existsSync(devPath)) {
-    return devPath;
+  // Second, try to find the binary in local dev target directories
+  const candidatePaths = [
+    path.resolve(__dirname, "..", "target", "release", `tribunal-core${ext}`),
+    path.resolve(__dirname, "..", "target", "debug", `tribunal-core${ext}`),
+    path.resolve(__dirname, "..", "..", "target", "release", `tribunal-core${ext}`),
+    path.resolve(__dirname, "..", "..", "target", "debug", `tribunal-core${ext}`),
+    path.resolve(process.cwd(), "target", "release", `tribunal-core${ext}`),
+    path.resolve(process.cwd(), "target", "debug", `tribunal-core${ext}`),
+    path.resolve(process.cwd(), "tribunal-kit", "target", "release", `tribunal-core${ext}`),
+    path.resolve(process.cwd(), "tribunal-kit", "target", "debug", `tribunal-core${ext}`),
+  ];
+
+  for (const candidate of candidatePaths) {
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
   }
 
-  // Third, try target/debug (if they ran `cargo build` instead of `--release`)
-  const debugPath = path.resolve(
-    __dirname,
-    "..",
-    "target",
-    "debug",
-    `tribunal-core${ext}`,
-  );
-  if (fs.existsSync(debugPath)) {
-    return debugPath;
+  // Third, attempt on-demand compilation if Cargo.toml exists locally and cargo is installed
+  const cargoTomlPath = path.resolve(__dirname, "..", "Cargo.toml");
+  if (fs.existsSync(cargoTomlPath)) {
+    try {
+      const buildResult = spawnSync("cargo", ["build", "--release"], {
+        cwd: path.resolve(__dirname, ".."),
+        stdio: "ignore",
+        timeout: 60000,
+      });
+      if (buildResult.status === 0) {
+        const releasePath = candidatePaths[0];
+        if (fs.existsSync(releasePath)) {
+          return releasePath;
+        }
+      }
+    } catch {
+      // cargo not available or build failed, fallback gracefully
+    }
   }
 
   return null;
 }
 
+
 function runRustBinary(binPath, args) {
   const stdio = [
     "inherit",
@@ -90,10 +117,13 @@ function runRustBinary(binPath, args) {
   });
 
   if (result.error) {
-    console.error(
-      `\x1b[91m✖ Failed to execute Rust engine:\x1b[0m ${result.error.message}`,
+    // Graceful degradation: fall back to JS engine instead of hard-crashing.
+    // Spawn errors include missing binaries, permission denied, corrupted
+    // executables, missing shared libraries, and OS-level exec failures.
+    console.warn(
+      `\x1b[93m⚠ Rust engine failed (${result.error.code || result.error.message}). Falling back to JS engine.\x1b[0m`,
     );
-    process.exit(1);
+    return false; // Signal caller to fall back
   }
 
   process.exit(result.status || 0);
@@ -103,7 +133,10 @@ function runLegacyFallback() {
   // Use the modular dist/ CLI with lazy-loaded commands for faster cold-start.
   // Each command module is require()'d only when invoked (~70% fewer files loaded).
   const { main } = require("../dist/cli.js");
-  main();
+  main().catch((err) => {
+    console.error(`\x1b[91m✖ Fatal Error:\x1b[0m ${err.message || err}`);
+    process.exit(1);
+  });
 }
 
 function main() {
@@ -125,8 +158,11 @@ function main() {
 
       // Route to Rust engine
       // console.log('\x1b[90m⚡ Executing via Rust Core Engine\x1b[0m');
-      runRustBinary(binPath, args);
-      return;
+      const rustResult = runRustBinary(binPath, args);
+      if (rustResult !== false) {
+        return; // Rust engine handled it (process.exit was called)
+      }
+      // rustResult === false means spawn error; fall through to JS fallback
     } else {
       // Warn if Rust command was requested but binary is missing
       console.warn(

package/dist/cli.js

@@ -106,6 +106,11 @@ function cmdHelp(quiet = false) {
     (0, logger_1.log)(cmd('compile', 'Compile rules into a static instruction file for terminal agents'));
     (0, logger_1.log)(cmd('memory', '4-Type Taxonomy Persistent Memory Engine (store, recall, gc, stats, export)'));
     (0, logger_1.log)(cmd('optimize-skill', 'Optimize project skills actively using SkillOpt validation gates'));
+    (0, logger_1.log)(cmd('validate', 'Validate a JSON payload against a Tribunal schema'));
+    (0, logger_1.log)(cmd('min-context', 'Remove empty lines from a context file'));
+    (0, logger_1.log)(cmd('dag-schedule', 'Compute parallel execution waves from task dependencies'));
+    (0, logger_1.log)(cmd('context-compress', 'Compress a context file while retaining VERIFY comments'));
+    (0, logger_1.log)(cmd('optimize-step', 'Apply bounded SkillOpt edits from a JSON payload'));
     (0, logger_1.log)(cmd('guardrail', 'Validate .agent/ integrity (phantom refs, count mismatches, drift)'));
     (0, logger_1.log)(cmd('uninstall', 'Remove .agent/ folder from project'));
     console.log();
@@ -242,6 +247,11 @@ async function runWithUpdateCheck(command, flags) {
             await cmdMarathon(flags, process.argv, quiet);
             break;
         }
+        case 'minimal': {
+            const cmdMinimal = loadCmd('./commands/minimal', 'cmdMinimal');
+            cmdMinimal(flags, quiet);
+            break;
+        }
         case 'compile': {
             const cmdCompile = loadCmd('./commands/compile', 'cmdCompile');
             await cmdCompile(flags, quiet);
@@ -267,6 +277,31 @@ async function runWithUpdateCheck(command, flags) {
             await cmdGuardrail(flags, process.argv, quiet);
             break;
         }
+        case 'validate': {
+            const cmdValidate = loadCmd('./commands/validate', 'cmdValidate');
+            cmdValidate(flags, process.argv, quiet);
+            break;
+        }
+        case 'min-context': {
+            const cmdMinContext = loadCmd('./commands/native', 'cmdMinContext');
+            cmdMinContext(process.argv, quiet);
+            break;
+        }
+        case 'dag-schedule': {
+            const cmdDagSchedule = loadCmd('./commands/native', 'cmdDagSchedule');
+            cmdDagSchedule(process.argv, quiet);
+            break;
+        }
+        case 'context-compress': {
+            const cmdContextCompress = loadCmd('./commands/native', 'cmdContextCompress');
+            cmdContextCompress(process.argv, quiet);
+            break;
+        }
+        case 'optimize-step': {
+            const cmdOptimizeStep = loadCmd('./commands/native', 'cmdOptimizeStep');
+            cmdOptimizeStep(process.argv, quiet);
+            break;
+        }
         case 'help':
         case '--help':
         case '-h':
@@ -287,5 +322,8 @@ async function main() {
     await runWithUpdateCheck(command, flags);
 }
 if (require.main === module) {
-    main();
+    main().catch(err => {
+        console.error(`\x1b[91m✖ Fatal Error:\x1b[0m ${err.message || err}`);
+        process.exit(1);
+    });
 }

package/dist/commands/compile.js

@@ -74,6 +74,13 @@ async function cmdCompile(flags, quiet) {
         if (flags.target === "claude") targetFile = ".claude.json";
     }
     
+    const byteLength = Buffer.byteLength(compiledContext, "utf-8");
+    const mbSize = byteLength / (1024 * 1024);
+    if (mbSize > 5.0 && !quiet) {
+        const { warn } = require("../utils/logger");
+        warn(`Compiled context is very large (~${mbSize.toFixed(2)} MB). This might overload some LLM context windows.`);
+    }
+
     const outputPath = path.join(cwd, targetFile);
     fs.writeFileSync(outputPath, compiledContext, "utf-8");
     

package/dist/commands/context.js

@@ -19,11 +19,16 @@ function cmdContext(flags, processArgs) {
         console.error('Usage: npx tribunal-kit context <target_file>');
         process.exit(1);
     }
-    const targetFile = args[0].replace(/\\/g, '/');
-    const snapshotName = targetFile.replace(/[\\\/]/g, '__') + '.json';
+    const resolvedTarget = path_1.default.resolve(targetDir, args[0]);
+    const relativePath = path_1.default.relative(targetDir, resolvedTarget).replace(/\\/g, '/');
+    if (relativePath.startsWith('../') || relativePath === '..' || path_1.default.isAbsolute(relativePath)) {
+        console.error('  \x1b[91m✖\x1b[0m File must be within the project directory: ' + args[0]);
+        process.exit(1);
+    }
+    const snapshotName = relativePath.replace(/[\\\/]/g, '__') + '.json';
     const snapshotPath = path_1.default.join(agentDest, 'history', 'snapshots', snapshotName);
     if (!fs_1.default.existsSync(snapshotPath)) {
-        console.error('  \x1b[91m✖\x1b[0m Context Snapshot not found for: ' + targetFile);
+        console.error('  \x1b[91m✖\x1b[0m Context Snapshot not found for: ' + args[0]);
         console.log('    Run: npx tribunal-kit graph  (to generate snapshots)');
         process.exit(1);
     }

package/dist/commands/graph.js

@@ -23,8 +23,14 @@ async function cmdGraph(flags, quiet = false) {
         await (0, helpers_1.runShellAsync)(`node "${builderScript}"`, { stdio: 'inherit', cwd: targetDir });
         await (0, helpers_1.runShellAsync)(`node "${visualizerScript}"`, { stdio: 'inherit', cwd: targetDir });
         (0, logger_1.log)(`  ${(0, logger_1.c)('cyan', '▸')} Opening visualizer in browser...`);
-        const opener = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open';
-        await (0, helpers_1.runShellAsync)(`${opener} "${htmlFile}"`, { stdio: 'ignore' });
+        const child_process = require('child_process');
+        if (process.platform === 'win32') {
+            child_process.spawn('cmd.exe', ['/c', 'start', '', htmlFile], { stdio: 'ignore', detached: true }).unref();
+        } else if (process.platform === 'darwin') {
+            child_process.spawn('open', [htmlFile], { stdio: 'ignore', detached: true }).unref();
+        } else {
+            child_process.spawn('xdg-open', [htmlFile], { stdio: 'ignore', detached: true }).unref();
+        }
     }
     catch (e) {
         if (e instanceof Error) {

package/dist/commands/init.js

@@ -26,13 +26,22 @@ const CORE_AGENTS = new Set([
     'explorer-agent.md',
     'project-planner.md',
     'test-engineer.md',
+    'ui-ux-auditor.md',
+    'ui-visual-auditor.md',
+    'accessibility-reviewer.md',
+    'ux-reviewer.md',
+    'visual-reviewer.md',
+    'interaction-reviewer.md',
+    'anti-pattern-reviewer.md',
+    'product-reviewer.md',
 ]);
 // Core skills to install in --minimal mode
 const CORE_SKILLS = new Set([
     'clean-code', 'architecture', 'testing-patterns', 'systematic-debugging',
     'frontend-design', 'database-design', 'api-patterns', 'nodejs-best-practices',
     'vulnerability-scanner', 'typescript-advanced', 'python-pro', 'nextjs-react-expert',
-    'react-specialist', 'performance-profiling', 'lint-and-validate',
+    'react-specialist', 'performance-profiling', 'lint-and-validate', 'ui-ux-pro-max',
+    'ui-reasoning-engine', 'product-aware-heuristics', 'web-design-guidelines',
 ]);
 async function cmdInit(flags, quiet = false) {
     const agentSrc = (0, helpers_1.getKitAgent)();
@@ -267,12 +276,13 @@ async function cmdInit(flags, quiet = false) {
             console.log(drawRow('  Next Steps:', (0, logger_1.c)('gray', '  Next Steps:')));
             console.log(stepRow('/generate', 'Generate code with reviews'));
             console.log(stepRow('/review', 'Audit existing code for issues'));
-            console.log(stepRow('/tribunal-full', 'Run all 20 reviewers in parallel'));
+            console.log(stepRow('/tribunal-full', 'Run all 21 reviewers in parallel'));
             console.log(drawRow('', ''));
             console.log(`  ${(0, logger_1.c)(borderCol, '└' + '─'.repeat(W) + '┘')}`);
             console.log();
             (0, logger_1.log)(`  ${(0, logger_1.c)('gray', '✦ Generating IDE bridge files...')}`);
             await generateIDEBridges(targetDir, agentDest, dryRun, isMinimal);
+            await scaffoldDesignSystem(targetDir, agentSrc, dryRun);
         }
         console.log();
     }
@@ -375,4 +385,29 @@ ${rulesContent}
     await Promise.all(bridges.map(b => writeBridge(b.path, b.content, b.label)));
     console.log();
 }
+async function scaffoldDesignSystem(targetDir, agentSrc, dryRun = false) {
+    const designMdSrc = path_1.default.join(agentSrc, 'templates', 'DESIGN.md');
+    const designTokensSrc = path_1.default.join(agentSrc, 'templates', 'design-tokens.json');
+    const designMdDest = path_1.default.join(targetDir, 'DESIGN.md');
+    const designTokensDest = path_1.default.join(targetDir, 'design-tokens.json');
+
+    const copyIfMissing = async (src, dest, label) => {
+        if (!fs_1.default.existsSync(src)) return;
+        if (fs_1.default.existsSync(dest)) {
+            (0, logger_1.dbg)(`  skip (exists): ${path_1.default.basename(dest)}`);
+            return;
+        }
+        if (dryRun) {
+            (0, logger_1.dbg)(`  would create: ${dest}`);
+            return;
+        }
+        await fs_1.default.promises.copyFile(src, dest);
+        (0, logger_1.ok)(`${label} → ${(0, logger_1.c)('gray', path_1.default.relative(targetDir, dest))}`);
+    };
+
+    await copyIfMissing(designMdSrc, designMdDest, 'DESIGN.md System');
+    await copyIfMissing(designTokensSrc, designTokensDest, 'Design Tokens');
+}
+exports.CORE_AGENTS = CORE_AGENTS;
+exports.CORE_SKILLS = CORE_SKILLS;