chore: align dev tooling with stage monorepo

.agents/agents/frontend-error-fixer.md

@@ -41,12 +41,12 @@ You are an expert frontend debugging specialist with deep knowledge of modern we
    - Preserve existing functionality while fixing the issue
    - Add proper error handling where it's missing
    - Ensure TypeScript types are correct and explicit
-   - Follow the project's established patterns (2-space indentation per Biome config, specific naming conventions)
+   - Follow the project's established patterns (tabs for JS/TS, spaces for JSON, per Biome config; specific naming conventions)
 
 5. **Verification**:
    - Confirm the error is resolved
    - Check for any new errors introduced by the fix
-   - Ensure the build passes with `npm run build` (CLI) and `npm run build:web` (web UI), and that `npx tsc --noEmit` is clean
+   - Ensure the build passes with `pnpm build` (CLI) and `pnpm build:web` (web UI), and that `pnpm typecheck` is clean
    - Test the affected functionality
 
 **Common Error Patterns You Handle:**

.claude/agents/auto-error-resolver.md

@@ -15,7 +15,7 @@ You are a specialized TypeScript error resolution agent. Your primary job is to
 
 2. **Reproduce locally**:
    - Run `npx tsc --noEmit` (root) and `npx tsc --noEmit -p web/tsconfig.json` (web UI)
-   - For runtime errors during dev, run `npm run dev:web` and watch the Vite output
+   - For runtime errors during dev, run `pnpm dev:web` and watch the Vite output
 
 3. **Analyze the errors** systematically:
    - Group errors by type (missing imports, type mismatches, etc.)
@@ -80,7 +80,7 @@ npx tsc --noEmit -p web/tsconfig.json # web UI
 
 ## TypeScript Commands
 
-This is a single npm package with two `tsconfig.json` files:
+This is a single Node package (managed with pnpm) with two `tsconfig.json` files:
 - **CLI / src**: `npx tsc --noEmit` (root tsconfig)
 - **Web UI**: `npx tsc --noEmit -p web/tsconfig.json`
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Summary
+<!-- What changed and why -->
+
+## Changes
+-
+
+## Testing
+<!-- How was this tested? -->
+
+## Screenshots
+<!-- If applicable, delete otherwise -->

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    name: CI
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check Drizzle migrations are up to date
+        run: |
+          pnpm db:generate
+          git diff --exit-code drizzle/ || (echo "::error::Drizzle migrations are out of date. Run 'pnpm db:generate' and commit." && exit 1)
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Type check
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: |
+          pnpm build
+          pnpm build:web

.gitignore

@@ -1,150 +1,33 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
-
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-*.lcov
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
+# Dependencies
+node_modules
 
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directories
-node_modules/
-jspm_packages/
-
-# Snowpack dependency directory (https://snowpack.dev/)
-web_modules/
+# Build output
+dist
+web-dist
 
-# TypeScript cache
+# TypeScript incremental builds
 *.tsbuildinfo
 
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
+# Vite
+.vite
+vite.config.*.timestamp-*
 
-# Optional stylelint cache
-.stylelintcache
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
+# Test coverage
+coverage
 
-# dotenv environment variable files
+# Environment / secrets
 .env
 .env.*
 !.env.example
+*.pem
 
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
-# Next.js build output
-.next
-out
-
-# Nuxt.js build / generate output
-.nuxt
-dist
-.output
-
-# Gatsby files
-.cache/
-# Comment in the public line in if your project uses Gatsby and not Next.js
-# https://nextjs.org/blog/next-9-1#public-directory-support
-# public
-
-# vuepress build output
-.vuepress/dist
-
-# vuepress v2.x temp directory
-.temp
-
-# Sveltekit cache directory
-.svelte-kit/
-
-# vitepress build output
-**/.vitepress/dist
-
-# vitepress cache directory
-**/.vitepress/cache
-
-# Docusaurus cache and generated files
-.docusaurus
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
-
-# Firebase cache directory
-.firebase/
-
-# TernJS port file
-.tern-port
-
-# Stores VSCode versions used for testing VSCode extensions
-.vscode-test
-
-# pnpm
-.pnpm-store
-
-# yarn v3
-.pnp.*
-.yarn/*
-!.yarn/patches
-!.yarn/plugins
-!.yarn/releases
-!.yarn/sdks
-!.yarn/versions
-
-# Vite files
-vite.config.js.timestamp-*
-vite.config.ts.timestamp-*
-.vite/
+# Logs
+*.log
+.pnpm-debug.log*
 
-# Stage CLI SPA build output (shipped via npm `files`)
-web-dist/
+# OS
+.DS_Store
 
-# claude
+# Claude Code
 .claude/scheduled_tasks.lock
 .claude/settings.local.json

.husky/pre-commit

@@ -0,0 +1 @@
+pnpm exec lint-staged

AGENTS.md

@@ -5,21 +5,23 @@ This file provides guidance to coding agents working in this repository, includi
 ## Build & Development Commands
 
 ```bash
-npm install             # Install dependencies
-npm run dev:web         # Start the web UI in Vite dev mode
-npm run build           # Bundle the CLI with tsdown into dist/
-npm run build:web       # Build the web UI with Vite into web-dist/
-npm run test            # Run tests (Vitest)
-npm run lint            # Biome linting
-npm run format          # Format code with Biome
-npx tsc --noEmit        # TypeScript checking (root tsconfig)
-npx tsc --noEmit -p web/tsconfig.json  # TypeScript checking for the web app
+pnpm install            # Install dependencies (also installs husky pre-commit hook)
+pnpm dev:web            # Start the web UI in Vite dev mode
+pnpm build              # Bundle the CLI with tsdown into dist/
+pnpm build:web          # Build the web UI with Vite into web-dist/
+pnpm test               # Run tests (Vitest)
+pnpm lint               # Biome check (lint + format) — fails on warnings
+pnpm lint:fix           # Biome check with auto-fix
+pnpm format             # Format code with Biome
+pnpm typecheck          # tsc --noEmit for both root and web tsconfigs
 ```
 
+The package manager is pinned via `packageManager` in `package.json`. Use `corepack enable` if pnpm isn't on your PATH.
+
 ### Database (Drizzle ORM + SQLite)
 
 ```bash
-npm run db:generate     # Generate a new migration into drizzle/ from schema changes
+pnpm db:generate        # Generate a new migration into drizzle/ from schema changes
 ```
 
 The CLI uses an embedded SQLite database via `better-sqlite3`. There is no separate dev database to start — `getDb()` opens (or creates) the local SQLite file and runs pending migrations on first use.
@@ -88,14 +90,16 @@ Vite app with React 19, Tailwind 4, and shadcn/ui (new-york style, zinc base, lu
 
 ## Code Style (Biome)
 
-- Spaces for indentation (width 2)
+- Tabs for indentation (JS/TS), spaces for JSON
 - Line width: 100 characters
 - Double quotes, semicolons required, trailing commas everywhere
 - `noUnusedImports: error` / `noUnusedVariables: error`
-- `useImportType: error` — use type imports/exports
-- `noExplicitAny: warn` and `noNonNullAssertion: warn` — treat warnings as failures in PRs
+- `useImportType: error` / `useExportType: error` — use type imports/exports
+- `noExplicitAny: error` and `noFocusedTests: error`
+- `noConsole: warn` (allowing `console.error`/`console.warn`) — treat warnings as failures in PRs
+- `organizeImports` runs on save/format
 
-There are no pre-commit hooks configured; run `npm run lint` and `npm run test` yourself before pushing.
+A `pre-commit` hook (husky + lint-staged) runs `biome check --write` against staged files. Run `pnpm lint`, `pnpm typecheck`, and `pnpm test` locally before pushing.
 
 ## Package Naming
 
@@ -114,7 +118,7 @@ This is a single-package repo published as `stagereview`. The CLI binary is `sta
 ## Git & Commit Workflow
 
 - When executing a plan, commit incrementally — one logical unit of work per commit, not one giant commit at the end.
-- Before every push, run `npx tsc --noEmit && npm run lint && npm run test` locally and ensure all checks pass. Never push with failing CI.
+- Before every push, run `pnpm typecheck && pnpm lint && pnpm test` locally and ensure all checks pass. Never push with failing CI.
 
 ## Implementation Quality
 

TESTING.md

@@ -13,7 +13,7 @@ This is stage-cli's canonical testing policy. All testing decisions — by human
 
 ### 1. Static Analysis
 
-TypeScript strict mode (`strict: true`, `noUncheckedIndexedAccess: true`, `verbatimModuleSyntax: true`) + Biome. Free. Run `npx tsc --noEmit` and `npm run lint` before pushing.
+TypeScript strict mode (`strict: true`, `noUncheckedIndexedAccess: true`, `verbatimModuleSyntax: true`) + Biome. Free. Run `pnpm typecheck` and `pnpm lint` before pushing.
 
 ### 2. Route / Server Integration Tests