fix: address CR findings — bump script, test runner, temp cleanup

- bump-version.mjs: reject duplicate versions (use --force to override),
  auto git-add manifest.json + versions.json for npm version hook
- run-tests.mjs: use execFileSync to handle paths with spaces
- test-setup.js: clean up esbuild temp directory on process exit

Change-Id: I44410b550d09487dd7f5e30a8f9385a2c500252a

scripts/bump-version.mjs

@@ -4,15 +4,17 @@
  * Usage: node scripts/bump-version.mjs <version>
  * Example: node scripts/bump-version.mjs 1.0.8
  */
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const version = process.argv[2];
+const force = process.argv.includes('--force');
 
 if (!version || !/^\d+\.\d+\.\d+$/.test(version)) {
-  console.error('Usage: node scripts/bump-version.mjs <version>');
+  console.error('Usage: node scripts/bump-version.mjs <version> [--force]');
   console.error('Example: node scripts/bump-version.mjs 1.0.8');
   process.exit(1);
 }
@@ -23,6 +25,11 @@ const versionsPath = path.join(root, 'versions.json');
 const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
 const versions = JSON.parse(fs.readFileSync(versionsPath, 'utf8'));
 
+if (versions[version] !== undefined && !force) {
+  console.error(`Version ${version} already exists in versions.json. Use --force to override.`);
+  process.exit(1);
+}
+
 const oldVersion = manifest.version;
 manifest.version = version;
 versions[version] = manifest.minAppVersion;
@@ -30,5 +37,12 @@ versions[version] = manifest.minAppVersion;
 fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, '\t') + '\n');
 fs.writeFileSync(versionsPath, JSON.stringify(versions, null, '\t') + '\n');
 
+// Stage files so npm version hook includes them in the auto-commit.
+try {
+  execFileSync('git', ['add', manifestPath, versionsPath], { cwd: root });
+} catch (_) {
+  // Not in a git repo or git not available — skip staging.
+}
+
 console.log(`Bumped version: ${oldVersion} → ${version}`);
 console.log(`Updated: manifest.json, versions.json`);

scripts/run-tests.mjs

@@ -1,4 +1,4 @@
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { readdirSync } from 'fs';
 import { join } from 'path';
 
@@ -9,9 +9,9 @@ const files = readdirSync(testsDir)
 
 let failed = 0;
 for (const file of files) {
-  const path = join(testsDir, file);
+  const filePath = join(testsDir, file);
   try {
-    execSync(`node ${path}`, { stdio: 'inherit' });
+    execFileSync('node', [filePath], { stdio: 'inherit' });
   } catch {
     failed++;
   }

tests/test-setup.js

@@ -26,6 +26,15 @@ esbuild.buildSync({
 
 const t = require(outfile);
 
+// Clean up temp bundle on process exit.
+process.on('exit', () => {
+  try {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  } catch (_) {
+    // Best-effort cleanup.
+  }
+});
+
 function openAiCardsResponse(cards) {
   const json = {
     choices: [