fix(installer): Ship runtime libs in npm package

Include tools/lib in the published npm files whitelist so the npx installer can resolve symlink-safety at runtime. Add a regression test that checks npm pack --dry-run --json for the expected packaged files.

Fixes #315

Co-Authored-By: Claude <noreply@anthropic.com>

tools/scripts/tests/npm_package_contents.test.js

@@ -0,0 +1,34 @@
+const assert = require("assert");
+const { spawnSync } = require("child_process");
+const path = require("path");
+
+const repoRoot = path.resolve(__dirname, "..", "..", "..");
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+
+function runNpmPackDryRunJson() {
+  const result = spawnSync(npmCommand, ["pack", "--dry-run", "--json"], {
+    cwd: repoRoot,
+    encoding: "utf8",
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  if (typeof result.status !== "number" || result.status !== 0) {
+    throw new Error(result.stderr.trim() || "npm pack --dry-run --json failed");
+  }
+
+  return JSON.parse(result.stdout);
+}
+
+const packOutput = runNpmPackDryRunJson();
+assert.ok(Array.isArray(packOutput) && packOutput.length > 0, "npm pack should return package metadata");
+
+const packagedFiles = new Set(packOutput[0].files.map((file) => file.path));
+
+assert.ok(packagedFiles.has("tools/bin/install.js"), "published package must include tools/bin/install.js");
+assert.ok(
+  packagedFiles.has("tools/lib/symlink-safety.js"),
+  "published package must include tools/lib/symlink-safety.js",
+);

tools/scripts/tests/run-test-suite.js

@@ -9,6 +9,7 @@ const TOOL_SCRIPTS = path.join("tools", "scripts");
 const TOOL_TESTS = path.join(TOOL_SCRIPTS, "tests");
 const LOCAL_TEST_COMMANDS = [
   [path.join(TOOL_TESTS, "jetski_gemini_loader.test.js")],
+  [path.join(TOOL_TESTS, "npm_package_contents.test.js")],
   [path.join(TOOL_TESTS, "validate_skills_headings.test.js")],
   [path.join(TOOL_TESTS, "workflow_contracts.test.js")],
   [path.join(TOOL_TESTS, "docs_security_content.test.js")],