[rogerchappel]

Summary

• validate the top-level package.json and scripts shapes before command discovery
• reject non-string script values with manifest, script name, and exact evidence line
• wrap JSON parsing errors with the offending manifest path
• document fail-closed malformed-manifest behavior

Commits

• 4e40bfe fix: validate package script manifests
• ab21ee7 docs: explain malformed manifest failures

Verification

• npm ci
• npm test (23/23 passing)
• npm run release:check
• package smoke (25 packed files and installed CLI checks)
• git diff --check origin/main...HEAD
• author and committer identity checked for every commit

Scope

3 files changed, 78 insertions, 2 deletions. Existing nested-workspace discovery and exact package-script evidence regressions remain green.

[rogerchappel]

Automated merge note

Triage class: auto-merge

Summary: Validates malformed package manifests and non-string script commands before generating incomplete command maps, with focused scan/CLI regression coverage and documentation (3 files, +78/-2).

Checks run: GitHub CI Repository hygiene and release dry-run completed SUCCESS; worker npm ci, npm test (23/23), and npm run release:check passed (typecheck, build, smoke, package smoke); final git diff --check origin/main...HEAD passed; commit identities verified.

Rebased/CI-repaired: No.

Verified head SHA: ab21ee783a02ffc68b88bb67df5e02e4b33232ee.