code-review

# Pake Code Review Adapter Use Waza `/check` for the generic review method. This adapter adds Pake-specific commands, hard stops, and artifact rules. ## Pake-Specific Hard Stops - [ ] Changes under `bin/` rebuild and commit `dist/cli.js` with `pnpm run cli:build`. - [ ] Any `package.json` change (Rollup inlines the whole manifest, dependency bumps included) rebuilds and commits `dist/cli.js`. - [ ] Release version bumps keep `package.json`, `src-tauri/Cargo.toml`, `src-tauri/Cargo.lock`, and `src-tauri/tauri.conf.json` in sync. - [ ] npm release workflow changes preserve Trusted Publishing: `.github/workflows/npm-publish.yml`, `id-token: write`, canonical `git+https://github.com/tw93/Pake.git`, and `scripts/check-release-version.mjs`. - [ ] Release/status changes keep npm registry, GitHub Release/assets, workflow run state, and issue closeout as separate truth surfaces. - [ ] `workflow_dispatch` release logic does not infer the release tag from `headBranch`, run title, or compare UI; use an explicit tag/ref and verify the package `gitHead`. - [ ] Any new user-visible CLI flag, alias, or help variant carries an explicit justification for why existing options or defaults cannot cover it (maintainer sign-off, not inferred). - [ ] No new `tauriConf: any` or other untyped config objects; use `PakeTauriConfig`. - [ ] No user-reachable `panic!` or `.unwrap()` on config, CLI, or event paths. - [ ] Silent `catch {}` blocks surface the real error through `logger.warn`. - [ ] New helper in `bin/utils/` or `bin/helpers/` has a matching `tests/unit/<basename>.test.ts`. - [ ] Binary parsers have a round-trip test, not only builder assertions. - [ ] Linux WebKit/AppImage runtime flag changes keep the default conservative, add or update tests for the decision logic, and update `docs/faq*.md` when users need a fallback command. - [ ] macOS `--new-window`, auth URL, or frame-link changes (`auth.js`, `event.js`, `frame_links.js`, `link_policy.js`) run `node tests/browser/popup-routing.mjs` with an installed Playwright runtime; see AGENTS.md Current Risk Areas for why classifier-only unit tests do not prove routing. ## Quick Review Commands ```bash # Get PR diff gh pr diff # Format check pnpm run format:check # Run unit tests (fast, sub-second) npx vitest run # Full suite without the slow real build pnpm test -- --no-build # Build CLI and catch TypeScript errors pnpm run cli:build # Popup/auth routing probe: manual only, needs a Playwright runtime # (tests/browser/*.mjs are outside vitest and Playwright is not a devDependency) node tests/browser/popup-routing.mjs ``` ## Review Output Format Follow Waza `/check`: findings first, ordered by severity, with tight file/line references.