@@ -129,23 +129,12 @@ jobs:
           install-deps: false
 
       # The selector is fail-open and advisory (GitHub CI stays authoritative),
-      # so the gate only guards the derivation model. Invoked directly with no
-      # deps, mirroring the layering guard.
-      #
-      # Kept as an inline `node` invocation rather than `pnpm check:affected:test`
-      # deliberately (#1462): R8's zero-dep-job closure check (scripts/layering/
-      # zero-dep-jobs.ts) discovers each zero-dep job's entry scripts by matching
-      # literal `scripts/**/*.test.ts` paths inside the `run:` block. A bare pnpm
-      # script name has no such path, so the scan would find zero entries and
-      # check.ts fails closed on that (`no entry script was found in its run
-      # steps`) rather than silently exempting the job — see the model.test.ts
-      # case "a job with no recognizable entry script is reported rather than
-      # exempted". pnpm itself is provisioned regardless of this choice; R8
-      # polices `pnpm install`, not the invocation style, so this is not a
-      # `pnpm install` for the job — the entry-detection regex is the actual
-      # constraint here.
+      # so the gate only guards the derivation model. Invoked with no deps,
+      # mirroring the layering guard. R8 (scripts/layering/zero-dep-jobs.ts)
+      # resolves this bare pnpm script name back to package.json's own command
+      # to find its entry scripts, so this is not a `pnpm install` for the job.
       - name: Check affected-selector model
-        run: node --experimental-strip-types --test scripts/check-affected/model.test.ts scripts/check-affected/run.test.ts
+        run: pnpm check:affected:test
 
   maestro-conformance:
     name: Maestro Conformance Oracle
 
@@ -125,7 +125,7 @@ jobs:
       # burning its budget) — outcome parity alone cannot see that.
       - name: Run differential
         run: |
-          node --experimental-strip-types scripts/maestro-conformance/differential/run.ts \
+          pnpm maestro:conformance:differential \
             --platform ios \
             --out-dir "${{ github.workspace }}/.tmp/conformance-differential" \
             --trace-root "${{ github.workspace }}/.agent-device" \
 
@@ -104,7 +104,7 @@ jobs:
       - name: Run Linux replay smoke test
         run: |
           pnpm clean:daemon
-          node --experimental-strip-types src/bin.ts test test/integration/replays/linux \
+          pnpm test:replay:linux \
             --retries 2 \
             --report-junit test/artifacts/replays-linux.junit.xml
 
 
@@ -50,7 +50,7 @@ jobs:
         run: pnpm build:macos-helper
 
       - name: Run macOS integration test
-        run: node --experimental-strip-types src/bin.ts test test/integration/replays/macos --retries 2 --report-junit test/artifacts/replays-macos.junit.xml
+        run: pnpm test:replay:macos --retries 2 --report-junit test/artifacts/replays-macos.junit.xml
 
       - name: Upload macOS artifacts
         if: always()
 
@@ -69,7 +69,7 @@ jobs:
 
       - name: Run iOS command perf benchmark
         run: |
-          node --experimental-strip-types scripts/perf/run.ts \
+          pnpm perf \
             --platform ios \
             --device "iPhone 17 Pro" \
             --n "$PERF_ROUNDS" --warmup 1 \
@@ -116,7 +116,7 @@ jobs:
             adb -s emulator-5554 shell settings put global window_animation_scale 0 || true;
             adb -s emulator-5554 shell settings put global transition_animation_scale 0 || true;
             adb -s emulator-5554 shell settings put global animator_duration_scale 0 || true;
-            node --experimental-strip-types scripts/perf/run.ts --platform android --serial emulator-5554 --n "$PERF_ROUNDS" --warmup 1 --out-dir "$GITHUB_WORKSPACE/perf-results"
+            pnpm perf:android --serial emulator-5554 --n "$PERF_ROUNDS" --warmup 1 --out-dir "$GITHUB_WORKSPACE/perf-results"
 
       - name: Upload Android perf report
         if: always()
 
@@ -55,7 +55,7 @@ jobs:
         shell: bash
 
       - name: Check MCP metadata sync
-        run: node scripts/sync-mcp-metadata.mjs --check
+        run: pnpm check:mcp-metadata
 
       - name: Install mcp-publisher
         run: |
 
@@ -111,7 +111,7 @@ jobs:
           profile: pixel_7
           target: google_apis_playstore
           emulator-options: -no-window -gpu swiftshader_indirect -no-snapshot -noaudio -no-boot-anim -no-metrics
-          script: node --experimental-strip-types src/bin.ts test test/integration/replays/android --retries 2 --report-junit test/artifacts/replays-android.junit.xml
+          script: pnpm test:replay:android --retries 2 --report-junit test/artifacts/replays-android.junit.xml
 
       - name: Upload Android artifacts
         if: always()
@@ -160,13 +160,13 @@ jobs:
           pnpm clean:daemon
 
       - name: Run iOS simulator replay suite
-        run: node --experimental-strip-types src/bin.ts test test/integration/replays/ios/simulator --retries 2 --artifacts-dir test/artifacts/replays-ios-simulator --report-junit test/artifacts/replays-ios-simulator.junit.xml
+        run: pnpm test:replay:ios --retries 2 --artifacts-dir test/artifacts/replays-ios-simulator --report-junit test/artifacts/replays-ios-simulator.junit.xml
 
       - name: Run iOS physical device replay suite
         if: env.IOS_UDID != ''
         env:
           IOS_UDID: ${{ vars.IOS_UDID }}
-        run: node --experimental-strip-types src/bin.ts test test/integration/replays/ios/device --udid "$IOS_UDID" --retries 2 --artifacts-dir test/artifacts/replays-ios-device --report-junit test/artifacts/replays-ios-device.junit.xml
+        run: pnpm test:replay:ios-device --udid "$IOS_UDID" --retries 2 --artifacts-dir test/artifacts/replays-ios-device --report-junit test/artifacts/replays-ios-device.junit.xml
 
       - name: Upload iOS artifacts
         if: always()
@@ -204,7 +204,7 @@ jobs:
         run: pnpm build:macos-helper
 
       - name: Run macOS replay suite
-        run: node --experimental-strip-types src/bin.ts test test/integration/replays/macos --retries 2 --report-junit test/artifacts/replays-macos.junit.xml
+        run: pnpm test:replay:macos --retries 2 --report-junit test/artifacts/replays-macos.junit.xml
 
       - name: Upload macOS artifacts
         if: always()
 
@@ -71,7 +71,7 @@ jobs:
           git checkout --detach "${{ github.event.pull_request.head.sha }}"
           pnpm install --frozen-lockfile
           pnpm build
-          node scripts/size-report.mjs \
+          pnpm size \
             --compare /tmp/agent-device-size-base.json \
             --startup-runs 7 \
             --json .tmp/size-report.json \
@@ -84,4 +84,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: node scripts/size-report.mjs --post-comment .tmp/size-report.md
+        run: pnpm size --post-comment .tmp/size-report.md
@@ -452,9 +452,13 @@ function checkZeroDepJobs(): Violation[] {
       .split('\n')
       .filter(Boolean),
   );
+  const packageJson = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8')) as {
+    scripts?: Record<string, string>;
+  };
+  const packageScripts = new Map(Object.entries(packageJson.scripts ?? {}));
 
   const violations: Violation[] = [];
-  for (const job of zeroDepJobs(workflows, fileExists)) {
+  for (const job of zeroDepJobs(workflows, fileExists, packageScripts)) {
     // Fail closed: a zero-dep job whose commands the entry scan cannot recognize would
     // otherwise be silently exempt from the rule it is the whole reason for.
     if (job.entries.length === 0) {
 
@@ -332,6 +332,66 @@ test('a job with no recognizable entry script is reported rather than exempted',
   assert.deepEqual(jobs, [{ workflow: 'w.yml', job: 'zero-dep', entries: [] }]);
 });
 
+test('a bare pnpm script name resolves through package.json to its entry scripts', () => {
+  // The workflow names no path at all — only the pnpm script name package.json maps to the
+  // real command. A zero-dep job may call its script this way (#1462) without R8 losing the
+  // entries it needs to check: the resolution reads the same paths out of the mapped command.
+  const workflow = `
+name: CI
+jobs:
+  zero-dep:
+    steps:
+      - uses: ./.github/actions/setup-node-pnpm
+        with:
+          install-deps: false
+      - run: pnpm check:affected:test
+`;
+  const present = new Set([
+    'scripts/check-affected/model.test.ts',
+    'scripts/check-affected/run.test.ts',
+  ]);
+  const packageScripts = new Map([
+    [
+      'check:affected:test',
+      'node --experimental-strip-types --test scripts/check-affected/model.test.ts scripts/check-affected/run.test.ts',
+    ],
+  ]);
+  const jobs = zeroDepJobs(
+    new Map([['w.yml', workflow]]),
+    (file) => present.has(file),
+    packageScripts,
+  );
+  assert.deepEqual(jobs, [
+    {
+      workflow: 'w.yml',
+      job: 'zero-dep',
+      entries: ['scripts/check-affected/model.test.ts', 'scripts/check-affected/run.test.ts'],
+    },
+  ]);
+});
+
+test('a pnpm word that names no real package.json script resolves to nothing', () => {
+  // `pnpm install` (or any other non-script pnpm subcommand) must not be treated as a script
+  // name just because it follows `pnpm` — it is absent from packageScripts, same as a shell
+  // word that merely looks like a path is absent from the tree.
+  const workflow = `
+name: CI
+jobs:
+  zero-dep:
+    steps:
+      - uses: ./.github/actions/setup-node-pnpm
+        with:
+          install-deps: false
+      - run: pnpm install --frozen-lockfile
+`;
+  const jobs = zeroDepJobs(
+    new Map([['w.yml', workflow]]),
+    () => true,
+    new Map([['check:affected:test', 'node scripts/check-affected/run.test.ts']]),
+  );
+  assert.deepEqual(jobs, [{ workflow: 'w.yml', job: 'zero-dep', entries: [] }]);
+});
+
 test('a package import anywhere in a zero-dep closure is rejected, builtins are not', () => {
   const tree = new Map([
     [
@@ -394,10 +454,13 @@ test("the repo's own zero-dep jobs resolve without node_modules", () => {
       : null;
   };
   const exists = (file: string): boolean => read(file) !== null;
+  const packageJson = JSON.parse(read('package.json')!) as { scripts?: Record<string, string> };
+  const packageScripts = new Map(Object.entries(packageJson.scripts ?? {}));
 
   const jobs = zeroDepJobs(
     new Map([['.github/workflows/ci.yml', read('.github/workflows/ci.yml')!]]),
     exists,
+    packageScripts,
   );
   assert.ok(jobs.length > 0, 'expected ci.yml to still declare at least one zero-dep job');
   for (const job of jobs) {