merge: resolve conflicts with main (careful/freeze/guard/unfreeze skills)

Merged main which added /careful, /freeze, /guard, /unfreeze skills,
analytics tracking, proactive suggest phrases, and dirty-tree handling.
Resolved conflicts by keeping both sides: codex + new safety skills in
template list, deduplicated proactive config in preamble, merged trigger
phrase tests with proactive phrase tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

test/analytics.test.ts

@@ -0,0 +1,277 @@
+import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import { parseJSONL, filterByPeriod, formatReport } from '../scripts/analytics';
+import type { AnalyticsEvent } from '../scripts/analytics';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { execSync } from 'child_process';
+
+const TMP_DIR = path.join(os.tmpdir(), 'analytics-test');
+const SCRIPT = path.resolve(import.meta.dir, '../scripts/analytics.ts');
+
+function writeTempJSONL(name: string, lines: string[]): string {
+  fs.mkdirSync(TMP_DIR, { recursive: true });
+  const p = path.join(TMP_DIR, name);
+  fs.writeFileSync(p, lines.join('\n') + '\n');
+  return p;
+}
+
+/**
+ * Run the analytics script with a custom JSONL file by overriding the path.
+ * We test the exported functions directly for unit tests, and use this
+ * helper for integration-style checks.
+ */
+function runScript(jsonlPath: string | null, extraArgs: string = ''): string {
+  // We test via the exported functions; for CLI integration we read the file
+  // and run the pipeline manually to avoid needing to override the hardcoded path.
+  if (jsonlPath === null) {
+    return 'No analytics data found.';
+  }
+  if (!fs.existsSync(jsonlPath)) {
+    return 'No analytics data found.';
+  }
+  const content = fs.readFileSync(jsonlPath, 'utf-8').trim();
+  if (!content) {
+    return 'No analytics data found.';
+  }
+  const events = parseJSONL(content);
+  if (events.length === 0) {
+    return 'No analytics data found.';
+  }
+  // Parse period from extraArgs
+  let period = 'all';
+  const match = extraArgs.match(/--period\s+(\S+)/);
+  if (match) period = match[1];
+  const filtered = filterByPeriod(events, period);
+  return formatReport(filtered, period);
+}
+
+beforeEach(() => {
+  fs.mkdirSync(TMP_DIR, { recursive: true });
+});
+
+afterEach(() => {
+  fs.rmSync(TMP_DIR, { recursive: true, force: true });
+});
+
+describe('parseJSONL', () => {
+  test('parses valid JSONL lines', () => {
+    const content = [
+      '{"skill":"ship","ts":"2026-03-18T15:30:00Z","repo":"my-app"}',
+      '{"skill":"qa","ts":"2026-03-18T16:00:00Z","repo":"my-api"}',
+    ].join('\n');
+    const events = parseJSONL(content);
+    expect(events).toHaveLength(2);
+    expect(events[0].skill).toBe('ship');
+    expect(events[1].skill).toBe('qa');
+  });
+
+  test('skips malformed lines', () => {
+    const content = [
+      '{"skill":"ship","ts":"2026-03-18T15:30:00Z","repo":"my-app"}',
+      'not valid json',
+      '{broken',
+      '',
+      '{"skill":"qa","ts":"2026-03-18T16:00:00Z","repo":"my-api"}',
+    ].join('\n');
+    const events = parseJSONL(content);
+    expect(events).toHaveLength(2);
+    expect(events[0].skill).toBe('ship');
+    expect(events[1].skill).toBe('qa');
+  });
+
+  test('returns empty array for empty string', () => {
+    expect(parseJSONL('')).toHaveLength(0);
+  });
+
+  test('skips objects missing ts field', () => {
+    const content = '{"skill":"ship","repo":"my-app"}\n';
+    const events = parseJSONL(content);
+    expect(events).toHaveLength(0);
+  });
+});
+
+describe('filterByPeriod', () => {
+  const now = new Date();
+  const daysAgo = (n: number) => new Date(now.getTime() - n * 24 * 60 * 60 * 1000).toISOString();
+
+  const events: AnalyticsEvent[] = [
+    { skill: 'ship', ts: daysAgo(1), repo: 'app' },
+    { skill: 'qa', ts: daysAgo(3), repo: 'app' },
+    { skill: 'review', ts: daysAgo(10), repo: 'app' },
+    { skill: 'retro', ts: daysAgo(40), repo: 'app' },
+  ];
+
+  test('period "all" returns all events', () => {
+    expect(filterByPeriod(events, 'all')).toHaveLength(4);
+  });
+
+  test('period "7d" returns only last 7 days', () => {
+    const filtered = filterByPeriod(events, '7d');
+    expect(filtered).toHaveLength(2);
+    expect(filtered[0].skill).toBe('ship');
+    expect(filtered[1].skill).toBe('qa');
+  });
+
+  test('period "30d" returns last 30 days', () => {
+    const filtered = filterByPeriod(events, '30d');
+    expect(filtered).toHaveLength(3);
+  });
+
+  test('invalid period string returns all events', () => {
+    expect(filterByPeriod(events, 'bogus')).toHaveLength(4);
+  });
+});
+
+describe('formatReport', () => {
+  test('includes header and period label', () => {
+    const report = formatReport([], 'all');
+    expect(report).toContain('gstack skill usage analytics');
+    expect(report).toContain('Period: all time');
+  });
+
+  test('shows "last 7 days" for 7d period', () => {
+    const report = formatReport([], '7d');
+    expect(report).toContain('Period: last 7 days');
+  });
+
+  test('shows "last 30 days" for 30d period', () => {
+    const report = formatReport([], '30d');
+    expect(report).toContain('Period: last 30 days');
+  });
+
+  test('counts skill invocations correctly', () => {
+    const events: AnalyticsEvent[] = [
+      { skill: 'ship', ts: '2026-03-18T15:30:00Z', repo: 'app' },
+      { skill: 'ship', ts: '2026-03-18T16:00:00Z', repo: 'app' },
+      { skill: 'qa', ts: '2026-03-18T16:30:00Z', repo: 'app' },
+    ];
+    const report = formatReport(events);
+    expect(report).toContain('/ship');
+    expect(report).toContain('2 invocations');
+    expect(report).toContain('/qa');
+    expect(report).toContain('1 invocation');
+  });
+
+  test('groups by repo', () => {
+    const events: AnalyticsEvent[] = [
+      { skill: 'ship', ts: '2026-03-18T15:30:00Z', repo: 'app-a' },
+      { skill: 'qa', ts: '2026-03-18T16:00:00Z', repo: 'app-a' },
+      { skill: 'ship', ts: '2026-03-18T16:30:00Z', repo: 'app-b' },
+    ];
+    const report = formatReport(events);
+    expect(report).toContain('app-a: ship(1) qa(1)');
+    expect(report).toContain('app-b: ship(1)');
+  });
+
+  test('counts hook fire events separately', () => {
+    const events: AnalyticsEvent[] = [
+      { skill: 'ship', ts: '2026-03-18T15:30:00Z', repo: 'app' },
+      { skill: 'careful', ts: '2026-03-18T16:00:00Z', repo: 'app', event: 'hook_fire', pattern: 'rm_recursive' },
+      { skill: 'careful', ts: '2026-03-18T16:30:00Z', repo: 'app', event: 'hook_fire', pattern: 'rm_recursive' },
+      { skill: 'careful', ts: '2026-03-18T17:00:00Z', repo: 'app', event: 'hook_fire', pattern: 'git_force_push' },
+    ];
+    const report = formatReport(events);
+    expect(report).toContain('Safety Hook Events');
+    expect(report).toContain('rm_recursive');
+    expect(report).toContain('2 fires');
+    expect(report).toContain('git_force_push');
+    expect(report).toContain('1 fire');
+    expect(report).toContain('Total: 1 skill invocation, 3 hook fires');
+  });
+
+  test('handles mixed events correctly', () => {
+    const events: AnalyticsEvent[] = [
+      { skill: 'ship', ts: '2026-03-18T15:30:00Z', repo: 'my-app' },
+      { skill: 'ship', ts: '2026-03-18T15:35:00Z', repo: 'my-app' },
+      { skill: 'qa', ts: '2026-03-18T16:00:00Z', repo: 'my-api' },
+      { skill: 'careful', ts: '2026-03-18T16:30:00Z', repo: 'my-app', event: 'hook_fire', pattern: 'rm_recursive' },
+    ];
+    const report = formatReport(events);
+    // Skills counted correctly (hook_fire events excluded from skill counts)
+    expect(report).toContain('Total: 3 skill invocations, 1 hook fire');
+    // Both sections present
+    expect(report).toContain('Top Skills');
+    expect(report).toContain('Safety Hook Events');
+    expect(report).toContain('By Repo');
+  });
+});
+
+describe('integration via runScript helper', () => {
+  test('missing file → "No analytics data found."', () => {
+    const output = runScript(path.join(TMP_DIR, 'nonexistent.jsonl'));
+    expect(output).toBe('No analytics data found.');
+  });
+
+  test('null path → "No analytics data found."', () => {
+    const output = runScript(null);
+    expect(output).toBe('No analytics data found.');
+  });
+
+  test('empty file → "No analytics data found."', () => {
+    const p = writeTempJSONL('empty.jsonl', ['']);
+    // Overwrite with truly empty content
+    fs.writeFileSync(p, '');
+    const output = runScript(p);
+    expect(output).toBe('No analytics data found.');
+  });
+
+  test('all malformed lines → "No analytics data found."', () => {
+    const p = writeTempJSONL('bad.jsonl', [
+      'not json',
+      '{broken',
+      '42',
+    ]);
+    const output = runScript(p);
+    expect(output).toBe('No analytics data found.');
+  });
+
+  test('normal aggregation produces correct output', () => {
+    const p = writeTempJSONL('normal.jsonl', [
+      '{"skill":"ship","ts":"2026-03-18T15:30:00Z","repo":"my-app"}',
+      '{"skill":"ship","ts":"2026-03-18T15:35:00Z","repo":"my-app"}',
+      '{"skill":"qa","ts":"2026-03-18T16:00:00Z","repo":"my-app"}',
+      '{"skill":"review","ts":"2026-03-18T16:30:00Z","repo":"my-api"}',
+    ]);
+    const output = runScript(p);
+    expect(output).toContain('/ship');
+    expect(output).toContain('2 invocations');
+    expect(output).toContain('/qa');
+    expect(output).toContain('1 invocation');
+    expect(output).toContain('/review');
+    expect(output).toContain('Total: 4 skill invocations, 0 hook fires');
+  });
+
+  test('period filtering (7d) only includes recent entries', () => {
+    const now = new Date();
+    const recent = new Date(now.getTime() - 2 * 24 * 60 * 60 * 1000).toISOString();
+    const old = new Date(now.getTime() - 20 * 24 * 60 * 60 * 1000).toISOString();
+
+    const p = writeTempJSONL('period.jsonl', [
+      `{"skill":"ship","ts":"${recent}","repo":"app"}`,
+      `{"skill":"qa","ts":"${old}","repo":"app"}`,
+    ]);
+    const output = runScript(p, '--period 7d');
+    expect(output).toContain('Period: last 7 days');
+    expect(output).toContain('/ship');
+    expect(output).toContain('Total: 1 skill invocation, 0 hook fires');
+    // qa should be filtered out
+    expect(output).not.toContain('/qa');
+  });
+
+  test('hook fire events counted in full pipeline', () => {
+    const p = writeTempJSONL('hooks.jsonl', [
+      '{"skill":"ship","ts":"2026-03-18T15:30:00Z","repo":"app"}',
+      '{"event":"hook_fire","skill":"careful","pattern":"rm_recursive","ts":"2026-03-18T16:00:00Z","repo":"app"}',
+      '{"event":"hook_fire","skill":"careful","pattern":"rm_recursive","ts":"2026-03-18T16:30:00Z","repo":"app"}',
+      '{"event":"hook_fire","skill":"careful","pattern":"git_force_push","ts":"2026-03-18T17:00:00Z","repo":"app"}',
+    ]);
+    const output = runScript(p);
+    expect(output).toContain('Safety Hook Events');
+    expect(output).toContain('rm_recursive');
+    expect(output).toContain('2 fires');
+    expect(output).toContain('git_force_push');
+    expect(output).toContain('1 fire');
+    expect(output).toContain('Total: 1 skill invocation, 3 hook fires');
+  });
+});

test/gen-skill-docs.test.ts

@@ -72,6 +72,11 @@ describe('gen-skill-docs', () => {
     { dir: 'plan-design-review', name: 'plan-design-review' },
     { dir: 'design-review', name: 'design-review' },
     { dir: 'design-consultation', name: 'design-consultation' },
+    { dir: 'document-release', name: 'document-release' },
+    { dir: 'careful', name: 'careful' },
+    { dir: 'freeze', name: 'freeze' },
+    { dir: 'guard', name: 'guard' },
+    { dir: 'unfreeze', name: 'unfreeze' },
   ];
 
   test('every skill has a SKILL.md.tmpl template', () => {
@@ -161,6 +166,26 @@ describe('gen-skill-docs', () => {
     expect(content).toContain('plain English');
   });
 
+  test('generated SKILL.md contains telemetry line', () => {
+    const content = fs.readFileSync(path.join(ROOT, 'SKILL.md'), 'utf-8');
+    expect(content).toContain('skill-usage.jsonl');
+    expect(content).toContain('~/.gstack/analytics');
+  });
+
+  test('preamble-using skills have correct skill name in telemetry', () => {
+    const PREAMBLE_SKILLS = [
+      { dir: '.', name: 'gstack' },
+      { dir: 'ship', name: 'ship' },
+      { dir: 'review', name: 'review' },
+      { dir: 'qa', name: 'qa' },
+      { dir: 'retro', name: 'retro' },
+    ];
+    for (const skill of PREAMBLE_SKILLS) {
+      const content = fs.readFileSync(path.join(ROOT, skill.dir, 'SKILL.md'), 'utf-8');
+      expect(content).toContain(`"skill":"${skill.name}"`);
+    }
+  });
+
   test('qa and qa-only templates use QA_METHODOLOGY placeholder', () => {
     const qaTmpl = fs.readFileSync(path.join(ROOT, 'qa', 'SKILL.md.tmpl'), 'utf-8');
     expect(qaTmpl).toContain('{{QA_METHODOLOGY}}');

test/helpers/touchfiles.ts

@@ -93,6 +93,19 @@ export const E2E_TOUCHFILES: Record<string, string[]> = {
 
   // gstack-upgrade
   'gstack-upgrade-happy-path': ['gstack-upgrade/**'],
+
+  // Skill routing — journey-stage tests (depend on ALL skill descriptions)
+  'journey-ideation':       ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-plan-eng':       ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-think-bigger':   ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-debug':          ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-qa':             ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-code-review':    ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-ship':           ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-docs':           ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-retro':          ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-design-system':  ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
+  'journey-visual-qa':      ['*/SKILL.md.tmpl', 'SKILL.md.tmpl', 'scripts/gen-skill-docs.ts'],
 };
 
 /**

test/hook-scripts.test.ts

@@ -0,0 +1,373 @@
+import { describe, test, expect } from 'bun:test';
+import { spawnSync } from 'child_process';
+import * as path from 'path';
+import * as fs from 'fs';
+import * as os from 'os';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+const CAREFUL_SCRIPT = path.join(ROOT, 'careful', 'bin', 'check-careful.sh');
+const FREEZE_SCRIPT = path.join(ROOT, 'freeze', 'bin', 'check-freeze.sh');
+
+function runHook(scriptPath: string, input: object, env?: Record<string, string>): { exitCode: number; output: any; raw: string } {
+  const result = spawnSync('bash', [scriptPath], {
+    input: JSON.stringify(input),
+    stdio: ['pipe', 'pipe', 'pipe'],
+    env: { ...process.env, ...env },
+    timeout: 5000,
+  });
+  const raw = result.stdout.toString().trim();
+  let output: any = {};
+  try {
+    output = JSON.parse(raw);
+  } catch {}
+  return { exitCode: result.status ?? 1, output, raw };
+}
+
+function runHookRaw(scriptPath: string, rawInput: string, env?: Record<string, string>): { exitCode: number; output: any; raw: string } {
+  const result = spawnSync('bash', [scriptPath], {
+    input: rawInput,
+    stdio: ['pipe', 'pipe', 'pipe'],
+    env: { ...process.env, ...env },
+    timeout: 5000,
+  });
+  const raw = result.stdout.toString().trim();
+  let output: any = {};
+  try {
+    output = JSON.parse(raw);
+  } catch {}
+  return { exitCode: result.status ?? 1, output, raw };
+}
+
+function carefulInput(command: string) {
+  return { tool_input: { command } };
+}
+
+function freezeInput(filePath: string) {
+  return { tool_input: { file_path: filePath } };
+}
+
+function withFreezeDir(freezePath: string, fn: (stateDir: string) => void) {
+  const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-freeze-test-'));
+  fs.writeFileSync(path.join(stateDir, 'freeze-dir.txt'), freezePath);
+  try {
+    fn(stateDir);
+  } finally {
+    fs.rmSync(stateDir, { recursive: true, force: true });
+  }
+}
+
+// Detect whether the safe-rm-targets regex works on this platform.
+// macOS sed -E does not support \s, so the safe exception check fails there.
+function detectSafeRmWorks(): boolean {
+  const { output } = runHook(CAREFUL_SCRIPT, carefulInput('rm -rf node_modules'));
+  return output.permissionDecision === undefined;
+}
+
+// ============================================================
+// check-careful.sh tests
+// ============================================================
+describe('check-careful.sh', () => {
+
+  // --- Destructive rm commands ---
+
+  describe('rm -rf / rm -r', () => {
+    test('rm -rf /var/data warns with recursive delete message', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('rm -rf /var/data'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('recursive delete');
+    });
+
+    test('rm -r ./some-dir warns', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('rm -r ./some-dir'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('recursive delete');
+    });
+
+    test('rm -rf node_modules allows (safe exception)', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('rm -rf node_modules'));
+      expect(exitCode).toBe(0);
+      if (detectSafeRmWorks()) {
+        // GNU sed: safe exception triggers, allows through
+        expect(output.permissionDecision).toBeUndefined();
+      } else {
+        // macOS sed: safe exception regex uses \\s which is unsupported,
+        // so the safe-targets check fails and the command warns
+        expect(output.permissionDecision).toBe('ask');
+      }
+    });
+
+    test('rm -rf .next dist allows (multiple safe targets)', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('rm -rf .next dist'));
+      expect(exitCode).toBe(0);
+      if (detectSafeRmWorks()) {
+        expect(output.permissionDecision).toBeUndefined();
+      } else {
+        expect(output.permissionDecision).toBe('ask');
+      }
+    });
+
+    test('rm -rf node_modules /var/data warns (mixed safe+unsafe)', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('rm -rf node_modules /var/data'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('recursive delete');
+    });
+  });
+
+  // --- SQL destructive commands ---
+  // Note: SQL commands that contain embedded double quotes (e.g., psql -c "DROP TABLE")
+  // get their command value truncated by the grep-based JSON extractor because \"
+  // terminates the [^"]* match. We use commands WITHOUT embedded quotes so the grep
+  // extraction works and the SQL keywords are visible to the pattern matcher.
+
+  describe('SQL destructive commands', () => {
+    test('psql DROP TABLE warns with DROP in message', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('psql -c DROP TABLE users;'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('DROP');
+    });
+
+    test('mysql drop database warns (case insensitive)', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('mysql -e drop database mydb'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message.toLowerCase()).toContain('drop');
+    });
+
+    test('psql TRUNCATE warns', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('psql -c TRUNCATE orders;'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('TRUNCATE');
+    });
+  });
+
+  // --- Git destructive commands ---
+
+  describe('git destructive commands', () => {
+    test('git push --force warns with force-push', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git push --force origin main'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('force-push');
+    });
+
+    test('git push -f warns', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git push -f origin main'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('force-push');
+    });
+
+    test('git reset --hard warns with uncommitted', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git reset --hard HEAD~3'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('uncommitted');
+    });
+
+    test('git checkout . warns', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git checkout .'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('uncommitted');
+    });
+
+    test('git restore . warns', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git restore .'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('uncommitted');
+    });
+  });
+
+  // --- Container / infra destructive commands ---
+
+  describe('container and infra commands', () => {
+    test('kubectl delete warns with kubectl in message', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('kubectl delete pod my-pod'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('kubectl');
+    });
+
+    test('docker rm -f warns', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('docker rm -f container123'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('Docker');
+    });
+
+    test('docker system prune -a warns', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('docker system prune -a'));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('Docker');
+    });
+  });
+
+  // --- Safe commands ---
+
+  describe('safe commands allow without warning', () => {
+    const safeCmds = [
+      'ls -la',
+      'git status',
+      'npm install',
+      'cat README.md',
+      'echo hello',
+    ];
+
+    for (const cmd of safeCmds) {
+      test(`"${cmd}" allows`, () => {
+        const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput(cmd));
+        expect(exitCode).toBe(0);
+        expect(output.permissionDecision).toBeUndefined();
+      });
+    }
+  });
+
+  // --- Edge cases ---
+
+  describe('edge cases', () => {
+    test('empty command allows gracefully', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput(''));
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBeUndefined();
+    });
+
+    test('missing command field allows gracefully', () => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, { tool_input: {} });
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBeUndefined();
+    });
+
+    test('malformed JSON input allows gracefully (exit 0, output {})', () => {
+      const { exitCode, raw } = runHookRaw(CAREFUL_SCRIPT, 'this is not json at all{{{{');
+      expect(exitCode).toBe(0);
+      expect(raw).toBe('{}');
+    });
+
+    test('Python fallback: grep fails on multiline JSON, Python parses it', () => {
+      // Construct JSON where "command": and the value are on separate lines.
+      // grep works line-by-line, so it cannot match "command"..."value" across lines.
+      // This forces CMD to be empty, triggering the Python fallback which handles
+      // the full JSON correctly.
+      const rawJson = '{"tool_input":{"command":\n"rm -rf /tmp/important"}}';
+      const { exitCode, output } = runHookRaw(CAREFUL_SCRIPT, rawJson);
+      expect(exitCode).toBe(0);
+      expect(output.permissionDecision).toBe('ask');
+      expect(output.message).toContain('recursive delete');
+    });
+  });
+});
+
+// ============================================================
+// check-freeze.sh tests
+// ============================================================
+describe('check-freeze.sh', () => {
+
+  describe('edits inside freeze boundary', () => {
+    test('edit inside freeze boundary allows', () => {
+      withFreezeDir('/Users/dev/project/src/', (stateDir) => {
+        const { exitCode, output } = runHook(
+          FREEZE_SCRIPT,
+          freezeInput('/Users/dev/project/src/index.ts'),
+          { CLAUDE_PLUGIN_DATA: stateDir },
+        );
+        expect(exitCode).toBe(0);
+        expect(output.permissionDecision).toBeUndefined();
+      });
+    });
+
+    test('edit in subdirectory of freeze path allows', () => {
+      withFreezeDir('/Users/dev/project/src/', (stateDir) => {
+        const { exitCode, output } = runHook(
+          FREEZE_SCRIPT,
+          freezeInput('/Users/dev/project/src/components/Button.tsx'),
+          { CLAUDE_PLUGIN_DATA: stateDir },
+        );
+        expect(exitCode).toBe(0);
+        expect(output.permissionDecision).toBeUndefined();
+      });
+    });
+  });
+
+  describe('edits outside freeze boundary', () => {
+    test('edit outside freeze boundary denies', () => {
+      withFreezeDir('/Users/dev/project/src/', (stateDir) => {
+        const { exitCode, output } = runHook(
+          FREEZE_SCRIPT,
+          freezeInput('/Users/dev/other-project/index.ts'),
+          { CLAUDE_PLUGIN_DATA: stateDir },
+        );
+        expect(exitCode).toBe(0);
+        expect(output.permissionDecision).toBe('deny');
+        expect(output.message).toContain('freeze');
+        expect(output.message).toContain('outside');
+      });
+    });
+
+    test('write outside freeze boundary denies', () => {
+      withFreezeDir('/Users/dev/project/src/', (stateDir) => {
+        const { exitCode, output } = runHook(
+          FREEZE_SCRIPT,
+          freezeInput('/etc/hosts'),
+          { CLAUDE_PLUGIN_DATA: stateDir },
+        );
+        expect(exitCode).toBe(0);
+        expect(output.permissionDecision).toBe('deny');
+        expect(output.message).toContain('freeze');
+        expect(output.message).toContain('outside');
+      });
+    });
+  });
+
+  describe('trailing slash prevents prefix confusion', () => {
+    test('freeze at /src/ denies /src-old/ (trailing slash prevents prefix match)', () => {
+      withFreezeDir('/Users/dev/project/src/', (stateDir) => {
+        const { exitCode, output } = runHook(
+          FREEZE_SCRIPT,
+          freezeInput('/Users/dev/project/src-old/index.ts'),
+          { CLAUDE_PLUGIN_DATA: stateDir },
+        );
+        expect(exitCode).toBe(0);
+        expect(output.permissionDecision).toBe('deny');
+        expect(output.message).toContain('outside');
+      });
+    });
+  });
+
+  describe('no freeze file exists', () => {
+    test('allows everything when no freeze file present', () => {
+      const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-freeze-test-'));
+      try {
+        const { exitCode, output } = runHook(
+          FREEZE_SCRIPT,
+          freezeInput('/anywhere/at/all.ts'),
+          { CLAUDE_PLUGIN_DATA: stateDir },
+        );
+        expect(exitCode).toBe(0);
+        expect(output.permissionDecision).toBeUndefined();
+      } finally {
+        fs.rmSync(stateDir, { recursive: true, force: true });
+      }
+    });
+  });
+
+  describe('edge cases', () => {
+    test('missing file_path field allows gracefully', () => {
+      withFreezeDir('/Users/dev/project/src/', (stateDir) => {
+        const { exitCode, output } = runHook(
+          FREEZE_SCRIPT,
+          { tool_input: {} },
+          { CLAUDE_PLUGIN_DATA: stateDir },
+        );
+        expect(exitCode).toBe(0);
+        expect(output.permissionDecision).toBeUndefined();
+      });
+    });
+  });
+});

test/skill-routing-e2e.test.ts

@@ -0,0 +1,605 @@
+import { describe, test, expect, afterAll } from 'bun:test';
+import { runSkillTest } from './helpers/session-runner';
+import type { SkillTestResult } from './helpers/session-runner';
+import { EvalCollector } from './helpers/eval-store';
+import type { EvalTestEntry } from './helpers/eval-store';
+import { selectTests, detectBaseBranch, getChangedFiles, E2E_TOUCHFILES, GLOBAL_TOUCHFILES } from './helpers/touchfiles';
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+
+// Skip unless EVALS=1.
+const evalsEnabled = !!process.env.EVALS;
+const describeE2E = evalsEnabled ? describe : describe.skip;
+
+// Eval result collector
+const evalCollector = evalsEnabled ? new EvalCollector('e2e-routing') : null;
+
+// Unique run ID for this session
+const runId = new Date().toISOString().replace(/[:.]/g, '').replace('T', '-').slice(0, 15);
+
+// --- Diff-based test selection ---
+// Journey routing tests use E2E_TOUCHFILES (entries prefixed 'journey-' in touchfiles.ts).
+let selectedTests: string[] | null = null;
+
+if (evalsEnabled && !process.env.EVALS_ALL) {
+  const baseBranch = process.env.EVALS_BASE
+    || detectBaseBranch(ROOT)
+    || 'main';
+  const changedFiles = getChangedFiles(baseBranch, ROOT);
+
+  if (changedFiles.length > 0) {
+    const selection = selectTests(changedFiles, E2E_TOUCHFILES, GLOBAL_TOUCHFILES);
+    selectedTests = selection.selected;
+    process.stderr.write(`\nRouting E2E selection (${selection.reason}): ${selection.selected.length}/${Object.keys(E2E_TOUCHFILES).length} tests\n`);
+    if (selection.skipped.length > 0) {
+      process.stderr.write(`  Skipped: ${selection.skipped.join(', ')}\n`);
+    }
+    process.stderr.write('\n');
+  }
+}
+
+// --- Helper functions ---
+
+/** Copy all SKILL.md files into tmpDir/.claude/skills/gstack/ for auto-discovery */
+function installSkills(tmpDir: string) {
+  const skillDirs = [
+    '', // root gstack SKILL.md
+    'qa', 'qa-only', 'ship', 'review', 'plan-ceo-review', 'plan-eng-review',
+    'plan-design-review', 'design-review', 'design-consultation', 'retro',
+    'document-release', 'debug', 'office-hours', 'browse', 'setup-browser-cookies',
+    'gstack-upgrade', 'humanizer',
+  ];
+
+  for (const skill of skillDirs) {
+    const srcPath = path.join(ROOT, skill, 'SKILL.md');
+    if (!fs.existsSync(srcPath)) continue;
+
+    const destDir = skill
+      ? path.join(tmpDir, '.claude', 'skills', 'gstack', skill)
+      : path.join(tmpDir, '.claude', 'skills', 'gstack');
+    fs.mkdirSync(destDir, { recursive: true });
+    fs.copyFileSync(srcPath, path.join(destDir, 'SKILL.md'));
+  }
+}
+
+/** Init a git repo with config */
+function initGitRepo(dir: string) {
+  const run = (cmd: string, args: string[]) =>
+    spawnSync(cmd, args, { cwd: dir, stdio: 'pipe', timeout: 5000 });
+  run('git', ['init']);
+  run('git', ['config', 'user.email', 'test@test.com']);
+  run('git', ['config', 'user.name', 'Test']);
+}
+
+function logCost(label: string, result: { costEstimate: { turnsUsed: number; estimatedTokens: number; estimatedCost: number }; duration: number }) {
+  const { turnsUsed, estimatedTokens, estimatedCost } = result.costEstimate;
+  const durationSec = Math.round(result.duration / 1000);
+  console.log(`${label}: $${estimatedCost.toFixed(2)} (${turnsUsed} turns, ${(estimatedTokens / 1000).toFixed(1)}k tokens, ${durationSec}s)`);
+}
+
+function recordRouting(name: string, result: SkillTestResult, expectedSkill: string, actualSkill: string | undefined) {
+  evalCollector?.addTest({
+    name,
+    suite: 'Skill Routing E2E',
+    tier: 'e2e',
+    passed: actualSkill === expectedSkill,
+    duration_ms: result.duration,
+    cost_usd: result.costEstimate.estimatedCost,
+    transcript: result.transcript,
+    output: result.output?.slice(0, 2000),
+    turns_used: result.costEstimate.turnsUsed,
+    exit_reason: result.exitReason,
+  });
+}
+
+// --- Tests ---
+
+describeE2E('Skill Routing E2E — Developer Journey', () => {
+  afterAll(() => {
+    evalCollector?.finalize();
+  });
+
+  test('journey-ideation', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-ideation-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+      fs.writeFileSync(path.join(tmpDir, 'README.md'), '# New Project\n');
+      spawnSync('git', ['add', '.'], { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+      spawnSync('git', ['commit', '-m', 'initial'], { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      const testName = 'journey-ideation';
+      const expectedSkill = 'office-hours';
+      const result = await runSkillTest({
+        prompt: "I've been thinking about building a waitlist management tool for restaurants. The existing solutions are expensive and overcomplicated. I want something simple — a tablet app where hosts can add parties, see wait times, and text customers when their table is ready. Help me think through whether this is worth building and what the key design decisions are.",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-plan-eng', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-plan-eng-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+      fs.writeFileSync(path.join(tmpDir, 'plan.md'), `# Waitlist App Architecture
+
+## Components
+- REST API (Express.js)
+- PostgreSQL database
+- React frontend
+- SMS integration (Twilio)
+
+## Data Model
+- restaurants (id, name, settings)
+- parties (id, restaurant_id, name, size, phone, status, created_at)
+- wait_estimates (id, restaurant_id, avg_wait_minutes)
+
+## API Endpoints
+- POST /api/parties - add party to waitlist
+- GET /api/parties - list current waitlist
+- PATCH /api/parties/:id/status - update party status
+- GET /api/estimate - get current wait estimate
+`);
+      spawnSync('git', ['add', '.'], { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+      spawnSync('git', ['commit', '-m', 'initial'], { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      const testName = 'journey-plan-eng';
+      const expectedSkill = 'plan-eng-review';
+      const result = await runSkillTest({
+        prompt: "I wrote up a plan for the waitlist app in plan.md. Can you take a look at the architecture and make sure I'm not missing any edge cases or failure modes before I start coding?",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-think-bigger', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-think-bigger-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+      fs.writeFileSync(path.join(tmpDir, 'plan.md'), `# Waitlist App Architecture
+
+## Components
+- REST API (Express.js)
+- PostgreSQL database
+- React frontend
+- SMS integration (Twilio)
+
+## Data Model
+- restaurants (id, name, settings)
+- parties (id, restaurant_id, name, size, phone, status, created_at)
+- wait_estimates (id, restaurant_id, avg_wait_minutes)
+
+## API Endpoints
+- POST /api/parties - add party to waitlist
+- GET /api/parties - list current waitlist
+- PATCH /api/parties/:id/status - update party status
+- GET /api/estimate - get current wait estimate
+`);
+      spawnSync('git', ['add', '.'], { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+      spawnSync('git', ['commit', '-m', 'initial'], { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      const testName = 'journey-think-bigger';
+      const expectedSkill = 'plan-ceo-review';
+      const result = await runSkillTest({
+        prompt: "Actually, looking at this plan again, I feel like we're thinking too small. We're just doing waitlists but what about the whole restaurant guest experience? Is there a bigger opportunity here we should go after?",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 120_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 180_000);
+
+  test('journey-debug', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-debug-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+
+      const run = (cmd: string, args: string[]) =>
+        spawnSync(cmd, args, { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      fs.mkdirSync(path.join(tmpDir, 'src'), { recursive: true });
+      fs.writeFileSync(path.join(tmpDir, 'src/api.ts'), `
+import express from 'express';
+const app = express();
+
+app.get('/api/waitlist', async (req, res) => {
+  const db = req.app.locals.db;
+  const parties = await db.query('SELECT * FROM parties WHERE status = $1', ['waiting']);
+  res.json(parties.rows);
+});
+
+export default app;
+`);
+      fs.writeFileSync(path.join(tmpDir, 'error.log'), `
+[2026-03-18T10:23:45Z] ERROR: GET /api/waitlist - 500 Internal Server Error
+  TypeError: Cannot read properties of undefined (reading 'query')
+    at /src/api.ts:5:32
+    at Layer.handle [as handle_request] (/node_modules/express/lib/router/layer.js:95:5)
+[2026-03-18T10:23:46Z] ERROR: GET /api/waitlist - 500 Internal Server Error
+  TypeError: Cannot read properties of undefined (reading 'query')
+`);
+
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'initial']);
+      run('git', ['checkout', '-b', 'feature/waitlist-api']);
+
+      const testName = 'journey-debug';
+      const expectedSkill = 'debug';
+      const result = await runSkillTest({
+        prompt: "The GET /api/waitlist endpoint was working fine yesterday but now it's returning 500 errors. The tests are passing locally but the endpoint fails when I hit it with curl. Can you figure out what's going on?",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-qa', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-qa-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+
+      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ name: 'waitlist-app', scripts: { dev: 'next dev' } }, null, 2));
+      fs.mkdirSync(path.join(tmpDir, 'src'), { recursive: true });
+      fs.writeFileSync(path.join(tmpDir, 'src/index.html'), '<html><body><h1>Waitlist App</h1></body></html>');
+      spawnSync('git', ['add', '.'], { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+      spawnSync('git', ['commit', '-m', 'initial'], { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      const testName = 'journey-qa';
+      const expectedSkill = 'qa';
+      const alternateSkills = ['qa-only', 'browse'];
+      const result = await runSkillTest({
+        prompt: "I think the app is mostly working now. Can you go through the site and test everything — find any bugs and fix them?",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+      const acceptable = [expectedSkill, ...alternateSkills];
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect(acceptable, `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-code-review', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-code-review-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+
+      const run = (cmd: string, args: string[]) =>
+        spawnSync(cmd, args, { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      fs.writeFileSync(path.join(tmpDir, 'app.ts'), '// base\n');
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'initial']);
+      run('git', ['checkout', '-b', 'feature/add-waitlist']);
+      fs.writeFileSync(path.join(tmpDir, 'app.ts'), '// updated with waitlist feature\nimport { WaitlistService } from "./waitlist";\n');
+      fs.writeFileSync(path.join(tmpDir, 'waitlist.ts'), 'export class WaitlistService {\n  async addParty(name: string, size: number) {\n    // TODO: implement\n  }\n}\n');
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'feat: add waitlist service']);
+
+      const testName = 'journey-code-review';
+      const expectedSkill = 'review';
+      const result = await runSkillTest({
+        prompt: "I'm about to merge this into main. Can you look over my changes and flag anything risky before I land it?",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-ship', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-ship-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+
+      const run = (cmd: string, args: string[]) =>
+        spawnSync(cmd, args, { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      fs.writeFileSync(path.join(tmpDir, 'app.ts'), '// base\n');
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'initial']);
+      run('git', ['checkout', '-b', 'feature/waitlist']);
+      fs.writeFileSync(path.join(tmpDir, 'app.ts'), '// waitlist feature\n');
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'feat: waitlist']);
+
+      const testName = 'journey-ship';
+      const expectedSkill = 'ship';
+      const result = await runSkillTest({
+        prompt: "This looks good. Let's get it deployed — push the code up and create a PR.",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-docs', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-docs-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+
+      const run = (cmd: string, args: string[]) =>
+        spawnSync(cmd, args, { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      fs.writeFileSync(path.join(tmpDir, 'README.md'), '# Waitlist App\nA simple waitlist management tool.\n');
+      fs.mkdirSync(path.join(tmpDir, 'src'), { recursive: true });
+      fs.writeFileSync(path.join(tmpDir, 'src/api.ts'), '// API code\n');
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'feat: ship waitlist feature']);
+
+      const testName = 'journey-docs';
+      const expectedSkill = 'document-release';
+      const result = await runSkillTest({
+        prompt: "We just shipped the waitlist feature. Can you go through the README and any other docs and make sure they match what we actually built?",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-retro', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-retro-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+
+      const run = (cmd: string, args: string[]) =>
+        spawnSync(cmd, args, { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      fs.writeFileSync(path.join(tmpDir, 'api.ts'), 'export function getParties() { return []; }\n');
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'feat: add parties API', '--date', '2026-03-12T09:30:00']);
+
+      fs.writeFileSync(path.join(tmpDir, 'ui.tsx'), 'export function WaitlistView() { return <div>Waitlist</div>; }\n');
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'feat: add waitlist UI', '--date', '2026-03-13T14:00:00']);
+
+      fs.writeFileSync(path.join(tmpDir, 'README.md'), '# Waitlist App\n');
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'docs: add README', '--date', '2026-03-14T16:00:00']);
+
+      const testName = 'journey-retro';
+      const expectedSkill = 'retro';
+      const result = await runSkillTest({
+        prompt: "It's Friday. What did we ship this week? I want to do a quick retrospective on what the team accomplished.",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-design-system', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-design-system-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+
+      const run = (cmd: string, args: string[]) =>
+        spawnSync(cmd, args, { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ name: 'waitlist-app' }, null, 2));
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'initial']);
+
+      const testName = 'journey-design-system';
+      const expectedSkill = 'design-consultation';
+      const result = await runSkillTest({
+        prompt: "Before we build the UI, I want to establish a design system — typography, colors, spacing, the whole thing. Can you put together brand guidelines for this project?",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+
+  test('journey-visual-qa', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'routing-visual-qa-'));
+    try {
+      initGitRepo(tmpDir);
+      installSkills(tmpDir);
+
+      const run = (cmd: string, args: string[]) =>
+        spawnSync(cmd, args, { cwd: tmpDir, stdio: 'pipe', timeout: 5000 });
+
+      fs.mkdirSync(path.join(tmpDir, 'src'), { recursive: true });
+      fs.writeFileSync(path.join(tmpDir, 'src/styles.css'), `
+body { font-family: sans-serif; }
+.header { font-size: 24px; margin: 20px; }
+.card { padding: 16px; margin: 8px; border: 1px solid #ccc; }
+.button { background: #007bff; color: white; padding: 10px 20px; }
+`);
+      fs.writeFileSync(path.join(tmpDir, 'src/index.html'), `
+<html>
+<head><link rel="stylesheet" href="styles.css"></head>
+<body>
+  <div class="header">Waitlist</div>
+  <div class="card">Party of 4 - Smith</div>
+  <div class="card">Party of 2 - Jones</div>
+</body>
+</html>
+`);
+      run('git', ['add', '.']);
+      run('git', ['commit', '-m', 'initial UI']);
+
+      const testName = 'journey-visual-qa';
+      const expectedSkill = 'design-review';
+      const result = await runSkillTest({
+        prompt: "Something looks off on the site. The spacing between sections is inconsistent and the font sizes don't feel right. Can you audit the visual design and fix anything that doesn't look polished?",
+        workingDirectory: tmpDir,
+        maxTurns: 5,
+        allowedTools: ['Skill', 'Read', 'Bash', 'Glob', 'Grep'],
+        timeout: 60_000,
+        testName,
+        runId,
+      });
+
+      const skillCalls = result.toolCalls.filter(tc => tc.tool === 'Skill');
+      const actualSkill = skillCalls.length > 0 ? skillCalls[0]?.input?.skill : undefined;
+
+      logCost(`journey: ${testName}`, result);
+      recordRouting(testName, result, expectedSkill, actualSkill);
+
+      expect(skillCalls.length, `Expected Skill tool to be called but got 0 calls. Claude may have answered directly without invoking a skill. Tool calls: ${result.toolCalls.map(tc => tc.tool).join(', ')}`).toBeGreaterThan(0);
+      expect([expectedSkill], `Expected skill ${expectedSkill} but got ${actualSkill}`).toContain(actualSkill);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 90_000);
+});

test/skill-validation.test.ts

@@ -1215,10 +1215,11 @@ describe('Codex skill', () => {
 });
 
 // --- Trigger phrase validation ---
-// Ensures all user-facing skills have "Use when" trigger phrases in their description
-// frontmatter, so Claude Code's skill selector can route natural language to the right skill.
 
 describe('Skill trigger phrases', () => {
+  // Skills that must have "Use when" trigger phrases in their description.
+  // Excluded: root gstack (browser tool), gstack-upgrade (gstack-specific),
+  // humanizer (text tool)
   const SKILLS_REQUIRING_TRIGGERS = [
     'qa', 'qa-only', 'ship', 'review', 'debug', 'office-hours',
     'plan-ceo-review', 'plan-eng-review', 'plan-design-review',
@@ -1231,11 +1232,28 @@ describe('Skill trigger phrases', () => {
       const skillPath = path.join(ROOT, skill, 'SKILL.md');
       if (!fs.existsSync(skillPath)) return;
       const content = fs.readFileSync(skillPath, 'utf-8');
-      // Extract frontmatter (between --- markers)
-      const match = content.match(/^---\n([\s\S]*?)\n---/);
-      expect(match).toBeTruthy();
-      const frontmatter = match![1];
-      expect(frontmatter.toLowerCase()).toContain('use when');
+      // Extract description from frontmatter
+      const frontmatterEnd = content.indexOf('---', 4);
+      const frontmatter = content.slice(0, frontmatterEnd);
+      expect(frontmatter).toMatch(/Use when/i);
+    });
+  }
+
+  // Skills with proactive triggers should have "Proactively suggest" in description
+  const SKILLS_REQUIRING_PROACTIVE = [
+    'qa', 'qa-only', 'ship', 'review', 'debug', 'office-hours',
+    'plan-ceo-review', 'plan-eng-review', 'plan-design-review',
+    'design-review', 'design-consultation', 'retro', 'document-release',
+  ];
+
+  for (const skill of SKILLS_REQUIRING_PROACTIVE) {
+    test(`${skill}/SKILL.md has "Proactively suggest" phrase`, () => {
+      const skillPath = path.join(ROOT, skill, 'SKILL.md');
+      if (!fs.existsSync(skillPath)) return;
+      const content = fs.readFileSync(skillPath, 'utf-8');
+      const frontmatterEnd = content.indexOf('---', 4);
+      const frontmatter = content.slice(0, frontmatterEnd);
+      expect(frontmatter).toMatch(/Proactively suggest/i);
     });
   }
 });

test/touchfiles.test.ts

@@ -115,7 +115,8 @@ describe('selectTests', () => {
     expect(result.selected).toContain('plan-ceo-review-selective');
     expect(result.selected).toContain('retro');
     expect(result.selected).toContain('retro-base-branch');
-    expect(result.selected.length).toBe(4);
+    // Also selects journey routing tests (*/SKILL.md.tmpl matches retro/SKILL.md.tmpl)
+    expect(result.selected.length).toBeGreaterThanOrEqual(4);
   });
 
   test('works with LLM_JUDGE_TOUCHFILES', () => {
@@ -125,13 +126,15 @@ describe('selectTests', () => {
     expect(result.selected.length).toBe(2);
   });
 
-  test('SKILL.md.tmpl root template only selects root-dependent tests', () => {
+  test('SKILL.md.tmpl root template selects root-dependent tests and routing tests', () => {
     const result = selectTests(['SKILL.md.tmpl'], E2E_TOUCHFILES);
     // Should select the 7 tests that depend on root SKILL.md
     expect(result.selected).toContain('skillmd-setup-discovery');
     expect(result.selected).toContain('contributor-mode');
     expect(result.selected).toContain('session-awareness');
-    // Should NOT select unrelated tests
+    // Also selects journey routing tests (SKILL.md.tmpl in their touchfiles)
+    expect(result.selected).toContain('journey-ideation');
+    // Should NOT select unrelated non-routing tests
     expect(result.selected).not.toContain('plan-ceo-review');
     expect(result.selected).not.toContain('retro');
   });