diff --git a/framework/cli/cmd/inproc_audit_test.go b/framework/cli/cmd/inproc_audit_test.go
new file mode 100644
index 0000000..4f2f545
--- /dev/null
+++ b/framework/cli/cmd/inproc_audit_test.go
@@ -0,0 +1,93 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/izo/ulk/internal/installer"
+)
+
+// TestRunAuditReportWritesJSON exercises runAuditReport directly with a
+// tmpdir as cwd so the .ulk-reports/ folder is created in isolation.
+func TestRunAuditReportWritesJSON(t *testing.T) {
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	tmp := t.TempDir()
+	_ = os.Chdir(tmp)
+
+	state := &installer.State{
+		Version: "test",
+		Modules: map[string]bool{"vps": true, "statusline": false},
+	}
+	out := captureStdout(func() {
+		err := runAuditReport(state, "/fake/source", "/fake/claude", true)
+		if err != nil {
+			t.Fatalf("audit failed: %v", err)
+		}
+	})
+
+	// Output must mention the file path and counters.
+	if !strings.Contains(out, "[audit-only]") {
+		t.Errorf("expected audit-only marker, got: %s", out)
+	}
+	if !strings.Contains(out, "first run: true") {
+		t.Errorf("expected first run marker, got: %s", out)
+	}
+
+	// File should exist under .ulk-reports/audit-*.json.
+	entries, err := os.ReadDir(filepath.Join(tmp, ".ulk-reports"))
+	if err != nil {
+		t.Fatalf("audit dir not created: %v", err)
+	}
+	if len(entries) == 0 {
+		t.Error("expected at least one audit-*.json file")
+	}
+	for _, e := range entries {
+		if !strings.HasPrefix(e.Name(), "audit-") || !strings.HasSuffix(e.Name(), ".json") {
+			t.Errorf("unexpected file in .ulk-reports: %s", e.Name())
+		}
+	}
+}
+
+// TestRunAuditReportManagedAgentsBranch exercises the ma-audit prefix +
+// collectManagedAgentsInfo call path when the managed-agents module is on.
+func TestRunAuditReportManagedAgentsBranch(t *testing.T) {
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	tmp := t.TempDir()
+	_ = os.Chdir(tmp)
+
+	state := &installer.State{
+		Version: "test",
+		Modules: map[string]bool{"managed-agents": true},
+	}
+	out := captureStdout(func() {
+		_ = runAuditReport(state, "/fake/source", "/fake/claude", false)
+	})
+	if !strings.Contains(out, "ma agents") {
+		t.Errorf("expected ma agents counter, got: %s", out)
+	}
+
+	entries, _ := os.ReadDir(filepath.Join(tmp, ".ulk-reports"))
+	foundMA := false
+	for _, e := range entries {
+		if strings.HasPrefix(e.Name(), "ma-audit-") {
+			foundMA = true
+			break
+		}
+	}
+	if !foundMA {
+		t.Errorf("expected ma-audit-*.json prefix, got: %v", entries)
+	}
+}
+
+// TestCollectManagedAgentsInfoMissingDir falls into the "no agents" branch
+// when the source dir doesn't contain framework/managed-agents/orchestrators.
+func TestCollectManagedAgentsInfoMissingDir(t *testing.T) {
+	info := collectManagedAgentsInfo("/nonexistent")
+	if info == nil {
+		t.Skip("nil result allowed when source missing — no panic is the success criterion")
+	}
+}
diff --git a/framework/cli/cmd/inproc_install_deps_test.go b/framework/cli/cmd/inproc_install_deps_test.go
new file mode 100644
index 0000000..8720eb0
--- /dev/null
+++ b/framework/cli/cmd/inproc_install_deps_test.go
@@ -0,0 +1,110 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+func TestRunInstallDepsSourceMissing(t *testing.T) {
+	t.Setenv("ULK_SOURCE", "/definitely-nowhere-xyz")
+	c := &cobra.Command{Use: "install-deps"}
+	c.Flags().Bool("required", false, "")
+	c.Flags().Bool("recommended", false, "")
+	c.Flags().Bool("all", false, "")
+	c.Flags().Bool("yes", false, "")
+	c.Flags().String("source", "", "")
+	_ = c.Flags().Set("source", "/nonexistent/dir")
+
+	err := runInstallDeps(c, nil)
+	if err == nil {
+		t.Fatal("expected error for missing source dir")
+	}
+	if !strings.Contains(err.Error(), "cannot locate ulk source") {
+		t.Errorf("error must point to source dir issue, got: %v", err)
+	}
+}
+
+func TestRunInstallDepsRegistryMissing(t *testing.T) {
+	tmp := t.TempDir()
+	// Make it look like an ulk source dir (has framework/commands).
+	_ = os.MkdirAll(filepath.Join(tmp, "framework", "commands"), 0755)
+
+	c := &cobra.Command{Use: "install-deps"}
+	c.Flags().Bool("required", false, "")
+	c.Flags().Bool("recommended", false, "")
+	c.Flags().Bool("all", false, "")
+	c.Flags().Bool("yes", false, "")
+	c.Flags().String("source", "", "")
+	_ = c.Flags().Set("source", tmp)
+
+	err := runInstallDeps(c, nil)
+	if err == nil {
+		t.Fatal("expected error for missing cli-registry.json")
+	}
+	if !strings.Contains(err.Error(), "cli-registry.json") {
+		t.Errorf("error must mention cli-registry.json, got: %v", err)
+	}
+}
+
+func TestRunInstallDepsEmptyFilter(t *testing.T) {
+	tmp := t.TempDir()
+	_ = os.MkdirAll(filepath.Join(tmp, "framework", "commands"), 0755)
+	_ = os.MkdirAll(filepath.Join(tmp, "framework", "tools"), 0755)
+
+	// Registry with only optional tools — neither --required nor default
+	// selects them, so the priority filter returns empty.
+	regJSON := `{"version":"1","tools":[
+        {"name":"x","command":"x","priority":"optional",
+         "install":{"macos":"true","linux":"true"}}]}`
+	regPath := filepath.Join(tmp, "framework", "tools", "cli-registry.json")
+	_ = os.WriteFile(regPath, []byte(regJSON), 0644)
+
+	c := &cobra.Command{Use: "install-deps"}
+	c.Flags().Bool("required", false, "")
+	c.Flags().Bool("recommended", false, "")
+	c.Flags().Bool("all", false, "")
+	c.Flags().Bool("yes", false, "")
+	c.Flags().String("source", "", "")
+	_ = c.Flags().Set("source", tmp)
+	_ = c.Flags().Set("required", "true")
+
+	out := captureStdout(func() {
+		_ = runInstallDeps(c, nil)
+	})
+	if !strings.Contains(out, "No tools match") {
+		t.Errorf("expected 'No tools match' message, got: %s", out)
+	}
+}
+
+func TestRunInstallDepsAllPresent(t *testing.T) {
+	tmp := t.TempDir()
+	_ = os.MkdirAll(filepath.Join(tmp, "framework", "commands"), 0755)
+	_ = os.MkdirAll(filepath.Join(tmp, "framework", "tools"), 0755)
+
+	// Tool whose `command` definitely exists on every supported platform: sh.
+	regJSON := `{"version":"1","tools":[
+        {"name":"sh","command":"sh","priority":"required",
+         "install":{"macos":"echo present","linux":"echo present"}}]}`
+	regPath := filepath.Join(tmp, "framework", "tools", "cli-registry.json")
+	_ = os.WriteFile(regPath, []byte(regJSON), 0644)
+
+	c := &cobra.Command{Use: "install-deps"}
+	c.Flags().Bool("required", false, "")
+	c.Flags().Bool("recommended", false, "")
+	c.Flags().Bool("all", false, "")
+	c.Flags().Bool("yes", false, "")
+	c.Flags().String("source", "", "")
+	_ = c.Flags().Set("source", tmp)
+	_ = c.Flags().Set("required", "true")
+
+	out := captureStdout(func() {
+		_ = runInstallDeps(c, nil)
+	})
+	if !strings.Contains(out, "already installed") {
+		t.Errorf("expected 'already installed' message when all tools present, got: %s", out)
+	}
+}
diff --git a/framework/cli/cmd/inproc_install_test.go b/framework/cli/cmd/inproc_install_test.go
new file mode 100644
index 0000000..e59a7d8
--- /dev/null
+++ b/framework/cli/cmd/inproc_install_test.go
@@ -0,0 +1,67 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// TestRunInstallSourceMissing exercises the early "cannot locate source"
+// branch of runInstall via the existing installCmd (which already has all
+// flags registered, no need to re-mirror them).
+func TestRunInstallSourceMissing(t *testing.T) {
+	t.Setenv("ULK_SOURCE", "/definitely-nowhere")
+	t.Setenv("HOME", t.TempDir())
+
+	// Force resolveSourceDir to fail by overriding --source AND moving cwd
+	// somewhere with no framework/commands.
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	_ = os.Chdir(t.TempDir())
+
+	_ = installCmd.Flags().Set("source", "/nonexistent/path")
+	defer func() { _ = installCmd.Flags().Set("source", "") }()
+
+	err := runInstall(installCmd, nil)
+	if err == nil {
+		t.Fatal("expected error when source dir cannot be located")
+	}
+	if !strings.Contains(err.Error(), "cannot locate ulk source") {
+		t.Errorf("error must mention source dir, got: %v", err)
+	}
+}
+
+// TestRunInstallDryRunInProcess covers ~50 lines of runInstall by exercising
+// the parseFlags → resolveSourceDir → loadOrNewState → applyFlags →
+// applyProfile → printModules path. We make the cwd look like an ulk repo
+// source by creating framework/commands, and force --dry-run + --no-tui to
+// avoid the wizard and any actual writes.
+func TestRunInstallDryRunInProcess(t *testing.T) {
+	tmp := t.TempDir()
+	_ = os.MkdirAll(filepath.Join(tmp, "framework", "commands"), 0755)
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_SOURCE", tmp)
+	t.Setenv("ULK_HOME", filepath.Join(tmp, ".ulk-fake"))
+
+	// All install flags are pre-registered on installCmd via init().
+	_ = installCmd.Flags().Set("dry-run", "true")
+	_ = installCmd.Flags().Set("no-tui", "true")
+	defer func() {
+		_ = installCmd.Flags().Set("dry-run", "false")
+		_ = installCmd.Flags().Set("no-tui", "false")
+	}()
+
+	out := captureStdout(func() {
+		err := runInstall(installCmd, nil)
+		if err != nil {
+			t.Fatalf("dry-run install failed: %v", err)
+		}
+	})
+	if !strings.Contains(out, "[dry-run]") {
+		t.Errorf("expected dry-run banner, got: %s", out)
+	}
+	if !strings.Contains(out, "Modules:") {
+		t.Errorf("expected printModules output, got: %s", out)
+	}
+}
diff --git a/framework/cli/cmd/inproc_test.go b/framework/cli/cmd/inproc_test.go
new file mode 100644
index 0000000..28bff12
--- /dev/null
+++ b/framework/cli/cmd/inproc_test.go
@@ -0,0 +1,162 @@
+package cmd
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+// In-process invocation of cobra RunE handlers. Unlike integration_test.go
+// (which spawns the binary via os/exec and gets no Go coverage credit),
+// these tests count toward the cmd package coverage.
+
+// captureStdout runs fn while redirecting fd 1.
+func captureStdout(fn func()) string {
+	old := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+	fn()
+	_ = w.Close()
+	os.Stdout = old
+	var buf bytes.Buffer
+	_, _ = io.Copy(&buf, r)
+	return buf.String()
+}
+
+// ── runDoctor (no install) ──────────────────────────────────────────────────
+
+func TestRunDoctorNoInstall(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_HOME", "/nonexistent")
+	c := &cobra.Command{Use: "doctor"}
+	c.Flags().Bool("fix", false, "")
+	c.Flags().Bool("json", false, "")
+
+	var out string
+	err := error(nil)
+	out = captureStdout(func() {
+		err = runDoctor(c, nil)
+	})
+	// runDoctor exits non-zero when there are unfixed issues — that's expected
+	// without an install. We assert on output content, not on err.
+	_ = err
+	if !strings.Contains(out, "state.json readable") {
+		t.Errorf("expected state.json check in output, got: %s", out)
+	}
+	if !strings.Contains(out, "passed") || !strings.Contains(out, "failed") {
+		t.Errorf("expected pass/fail summary, got: %s", out)
+	}
+}
+
+func TestRunDoctorJSONNoInstall(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_HOME", "/nonexistent")
+	c := &cobra.Command{Use: "doctor"}
+	c.Flags().Bool("fix", false, "")
+	c.Flags().Bool("json", false, "")
+	_ = c.Flags().Set("json", "true")
+
+	out := captureStdout(func() {
+		_ = runDoctor(c, nil)
+	})
+	// JSON output must contain at least the keys.
+	for _, key := range []string{`"pass"`, `"fail"`, `"fixed"`} {
+		if !strings.Contains(out, key) {
+			t.Errorf("missing JSON key %s in output: %s", key, out)
+		}
+	}
+	// Plain-text labels must NOT appear in --json mode.
+	if strings.Contains(out, "Run `ulk doctor --fix`") {
+		t.Errorf("JSON mode leaked plain-text helper line: %s", out)
+	}
+}
+
+// ── runStatus (no install) ──────────────────────────────────────────────────
+
+func TestRunStatusNoInstall(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_HOME", "/nonexistent")
+	c := &cobra.Command{Use: "status"}
+	c.Flags().Bool("json", false, "")
+
+	out := captureStdout(func() {
+		_ = runStatus(c, nil)
+	})
+	if !strings.Contains(out, "ulk is not installed") {
+		t.Errorf("expected not-installed text, got: %s", out)
+	}
+}
+
+func TestRunStatusJSONNoInstall(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_HOME", "/nonexistent")
+	c := &cobra.Command{Use: "status"}
+	c.Flags().Bool("json", false, "")
+	_ = c.Flags().Set("json", "true")
+
+	out := captureStdout(func() {
+		_ = runStatus(c, nil)
+	})
+	if !strings.Contains(out, `"installed":false`) {
+		t.Errorf("expected JSON {\"installed\":false}, got: %s", out)
+	}
+}
+
+// ── runCheck ────────────────────────────────────────────────────────────────
+
+func TestRunCheckPlainTextDoesNotPanic(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	c := &cobra.Command{Use: "check"}
+	c.Flags().Bool("impact", false, "")
+	c.Flags().String("source", "", "")
+	c.Flags().Bool("json", false, "")
+
+	out := captureStdout(func() {
+		_ = runCheck(c, nil)
+	})
+	if !strings.Contains(out, "CLI Tools:") {
+		t.Errorf("expected CLI Tools header, got: %s", out)
+	}
+	// Each entry begins with ✓ or ○.
+	if !strings.ContainsAny(out, "✓○") {
+		t.Errorf("expected ✓ or ○ markers, got: %s", out)
+	}
+}
+
+func TestRunCheckJSON(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	c := &cobra.Command{Use: "check"}
+	c.Flags().Bool("impact", false, "")
+	c.Flags().String("source", "", "")
+	c.Flags().Bool("json", false, "")
+	_ = c.Flags().Set("json", "true")
+
+	out := captureStdout(func() {
+		_ = runCheck(c, nil)
+	})
+	for _, key := range []string{`"found"`, `"total"`, `"tools"`} {
+		if !strings.Contains(out, key) {
+			t.Errorf("missing JSON key %s in output: %s", key, out)
+		}
+	}
+}
+
+// ── runVerify (no install) ──────────────────────────────────────────────────
+
+func TestRunVerifyNoInstall(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_HOME", "/nonexistent")
+	out := captureStdout(func() {
+		_ = runVerify(nil, nil)
+	})
+	if !strings.Contains(out, "Verifying installation") {
+		t.Errorf("expected verifying header, got: %s", out)
+	}
+	if !strings.Contains(out, "passed") || !strings.Contains(out, "failed") {
+		t.Errorf("expected pass/fail summary, got: %s", out)
+	}
+}
diff --git a/framework/cli/cmd/install_deps_test.go b/framework/cli/cmd/install_deps_test.go
new file mode 100644
index 0000000..09085c7
--- /dev/null
+++ b/framework/cli/cmd/install_deps_test.go
@@ -0,0 +1,99 @@
+package cmd
+
+import (
+	"runtime"
+	"testing"
+
+	"github.com/izo/ulk/internal/registry"
+)
+
+func sampleRegistry() *registry.CLIRegistry {
+	return &registry.CLIRegistry{
+		Version: "test",
+		Tools: []registry.CLITool{
+			{Name: "rtk", Command: "rtk", Priority: "required",
+				Install: registry.CLIInstall{MacOS: "brew install rtk", Linux: "curl ... | sh"}},
+			{Name: "pandoc", Command: "pandoc", Priority: "required",
+				Install: registry.CLIInstall{MacOS: "brew install pandoc", Linux: "apt install pandoc"}},
+			{Name: "gh", Command: "gh", Priority: "recommended",
+				Install: registry.CLIInstall{MacOS: "brew install gh", Linux: "apt install gh"}},
+			{Name: "neonctl", Command: "neonctl", Priority: "optional",
+				Install: registry.CLIInstall{MacOS: "npm install -g neonctl", Linux: "npm install -g neonctl"}},
+		},
+	}
+}
+
+// ── filterByPriority ────────────────────────────────────────────────────────
+
+func TestFilterByPriorityAll(t *testing.T) {
+	got := filterByPriority(sampleRegistry(), false, false, true)
+	if len(got) != 4 {
+		t.Errorf("--all must return every tool, got %d", len(got))
+	}
+}
+
+func TestFilterByPriorityOnlyRequired(t *testing.T) {
+	got := filterByPriority(sampleRegistry(), true, false, false)
+	if len(got) != 2 {
+		t.Fatalf("only-required must return required tools, got %d", len(got))
+	}
+	for _, t2 := range got {
+		if t2.Priority != "required" {
+			t.Errorf("only-required leaked %s (priority=%s)", t2.Name, t2.Priority)
+		}
+	}
+}
+
+func TestFilterByPriorityWithRecommended(t *testing.T) {
+	got := filterByPriority(sampleRegistry(), false, true, false)
+	if len(got) != 3 {
+		t.Errorf("with-recommended must include required + recommended (3), got %d", len(got))
+	}
+}
+
+func TestFilterByPriorityDefault(t *testing.T) {
+	// No flags → required + recommended (same as withRecommended).
+	got := filterByPriority(sampleRegistry(), false, false, false)
+	if len(got) != 3 {
+		t.Errorf("default must return required+recommended (3), got %d", len(got))
+	}
+	for _, t2 := range got {
+		if t2.Priority == "optional" {
+			t.Errorf("default must not include optional, got %s", t2.Name)
+		}
+	}
+}
+
+// ── installCmdFor ───────────────────────────────────────────────────────────
+
+func TestInstallCmdForCurrentPlatform(t *testing.T) {
+	tool := registry.CLITool{
+		Install: registry.CLIInstall{
+			MacOS: "brew install foo",
+			Linux: "apt install foo",
+		},
+	}
+	got := installCmdFor(tool)
+	switch runtime.GOOS {
+	case "darwin":
+		if got != "brew install foo" {
+			t.Errorf("on darwin expected MacOS install, got %q", got)
+		}
+	case "linux":
+		if got != "apt install foo" {
+			t.Errorf("on linux expected Linux install, got %q", got)
+		}
+	default:
+		// Other GOOS (windows etc.) returns Linux as fallback per implementation.
+		if got != "apt install foo" {
+			t.Errorf("on %s expected linux fallback, got %q", runtime.GOOS, got)
+		}
+	}
+}
+
+func TestInstallCmdForEmpty(t *testing.T) {
+	tool := registry.CLITool{}
+	if got := installCmdFor(tool); got != "" {
+		t.Errorf("expected empty install command for empty tool, got %q", got)
+	}
+}
diff --git a/framework/cli/cmd/install_helpers_test.go b/framework/cli/cmd/install_helpers_test.go
new file mode 100644
index 0000000..d092b7e
--- /dev/null
+++ b/framework/cli/cmd/install_helpers_test.go
@@ -0,0 +1,219 @@
+package cmd
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/izo/ulk/internal/installer"
+	"github.com/spf13/cobra"
+)
+
+// ── countEnabledModules ─────────────────────────────────────────────────────
+
+func TestCountEnabledModulesEmpty(t *testing.T) {
+	state := &installer.State{Modules: map[string]bool{}}
+	if got := countEnabledModules(state); got != 0 {
+		t.Errorf("expected 0, got %d", got)
+	}
+}
+
+func TestCountEnabledModulesMixed(t *testing.T) {
+	state := &installer.State{Modules: map[string]bool{
+		"vps":         true,
+		"memory-loop": false,
+		"statusline":  true,
+		"sentinel":    false,
+		"hue":         true,
+	}}
+	if got := countEnabledModules(state); got != 3 {
+		t.Errorf("expected 3 enabled, got %d", got)
+	}
+}
+
+// ── resolveClaudeDir ────────────────────────────────────────────────────────
+
+func TestResolveClaudeDirEnvOverride(t *testing.T) {
+	t.Setenv("CLAUDE_DIR", "/tmp/test-claude")
+	got, err := resolveClaudeDir()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "/tmp/test-claude" {
+		t.Errorf("env override ignored, got %q", got)
+	}
+}
+
+func TestResolveClaudeDirDefault(t *testing.T) {
+	t.Setenv("CLAUDE_DIR", "")
+	got, err := resolveClaudeDir()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.HasSuffix(got, "/.claude") {
+		t.Errorf("default must end with /.claude, got %q", got)
+	}
+}
+
+// ── validateSourceDir ───────────────────────────────────────────────────────
+
+func TestValidateSourceDirOK(t *testing.T) {
+	dir := t.TempDir()
+	_ = os.MkdirAll(filepath.Join(dir, "framework", "commands"), 0755)
+	got, err := validateSourceDir(dir)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != dir {
+		t.Errorf("expected %q, got %q", dir, got)
+	}
+}
+
+func TestValidateSourceDirFails(t *testing.T) {
+	dir := t.TempDir() // no framework/commands subdir
+	_, err := validateSourceDir(dir)
+	if err == nil {
+		t.Fatal("expected error for dir without framework/commands")
+	}
+	if !strings.Contains(err.Error(), "framework/commands") {
+		t.Errorf("error must mention framework/commands, got %v", err)
+	}
+}
+
+// ── parseInstallFlags ───────────────────────────────────────────────────────
+
+func registeredCmd() *cobra.Command {
+	c := &cobra.Command{Use: "install"}
+	f := c.Flags()
+	// Mirror the subset we care about — same flag names as install.go init().
+	for _, name := range []string{
+		"with-vps", "with-teams", "with-figma-mcp", "with-addy-skills", "with-a11y-skills",
+		"with-obsidian-skills", "with-nothing-design", "with-memory-loop", "with-xavier-hook",
+		"with-cli-telemetry", "with-cwb-app-icon", "with-managed-agents", "with-hue-skill",
+		"with-caveman-skill", "with-caveman-output-skill", "with-logo-generator-skill",
+		"with-accountability", "with-context-mode", "with-refusal-scope", "with-sentinel",
+		"with-statusline", "with-faru", "with-kami-skill", "with-code-graph",
+		"with-cloud-clis", "with-database-clis", "with-security-clis", "with-notif-clis",
+		"with-container-clis", "with-monitoring-clis", "with-ai-clis", "with-doc-clis",
+		"with-data-clis", "with-design-clis", "with-devops-clis", "with-mobile-clis",
+		"dry-run", "no-tui", "fast", "wizard", "audit-only",
+	} {
+		f.Bool(name, false, "")
+	}
+	f.String("profile", "", "")
+	f.String("source", "", "")
+	return c
+}
+
+func TestParseInstallFlagsDefaults(t *testing.T) {
+	c := registeredCmd()
+	flags, err := parseInstallFlags(c)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if flags.dryRun || flags.noTUI || flags.withVPS || flags.fast {
+		t.Errorf("expected all flags false by default, got %+v", flags)
+	}
+	if flags.profile != "" || flags.source != "" {
+		t.Errorf("expected empty profile/source, got %q / %q", flags.profile, flags.source)
+	}
+}
+
+func TestParseInstallFlagsBoolsPropagate(t *testing.T) {
+	c := registeredCmd()
+	if err := c.Flags().Set("with-vps", "true"); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.Flags().Set("with-statusline", "true"); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.Flags().Set("dry-run", "true"); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.Flags().Set("profile", "ios"); err != nil {
+		t.Fatal(err)
+	}
+	flags, err := parseInstallFlags(c)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !flags.withVPS || !flags.withStatusline || !flags.dryRun {
+		t.Errorf("bool flags not propagated, got %+v", flags)
+	}
+	if flags.profile != "ios" {
+		t.Errorf("profile not propagated, got %q", flags.profile)
+	}
+}
+
+// ── printModules ────────────────────────────────────────────────────────────
+
+func TestPrintModulesOutputsAll(t *testing.T) {
+	state := &installer.State{Modules: map[string]bool{
+		"vps":        true,
+		"statusline": false,
+	}}
+
+	// Capture stdout — printModules writes to fmt.Print*.
+	old := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+	printModules(state)
+	_ = w.Close()
+	os.Stdout = old
+
+	var buf bytes.Buffer
+	_, _ = io.Copy(&buf, r)
+	out := buf.String()
+
+	if !strings.Contains(out, "Modules:") {
+		t.Errorf("missing header, got %q", out)
+	}
+	// There must be at least one ✓ and one ○ given mixed input plus the
+	// installer.All catalogue ; we check for both glyphs.
+	if !strings.Contains(out, "✓") {
+		t.Errorf("no enabled marker found, got %q", out)
+	}
+	if !strings.Contains(out, "○") {
+		t.Errorf("no disabled marker found, got %q", out)
+	}
+}
+
+// ── printProgress ───────────────────────────────────────────────────────────
+
+func TestPrintProgress(t *testing.T) {
+	old := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+	printProgress("step1", "doing X")
+	_ = w.Close()
+	os.Stdout = old
+	var buf bytes.Buffer
+	_, _ = io.Copy(&buf, r)
+	out := buf.String()
+	if !strings.Contains(out, "step1") || !strings.Contains(out, "doing X") {
+		t.Errorf("printProgress output missing fields, got %q", out)
+	}
+}
+
+// ── loadOrNewState ──────────────────────────────────────────────────────────
+
+func TestLoadOrNewStateNew(t *testing.T) {
+	// Force installer.Load to fail by pointing HOME at an empty tmpdir.
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("ULK_HOME", tmp+"/.ulk-nonexistent")
+
+	state, isNew := loadOrNewState(installFlags{}, "/tmp/claude")
+	if state == nil {
+		t.Fatal("expected non-nil state")
+	}
+	if !isNew {
+		t.Errorf("expected isNew=true on missing state.json")
+	}
+	if state.Modules == nil {
+		t.Errorf("new state must have non-nil Modules map")
+	}
+}
diff --git a/framework/cli/cmd/ma_provision_test.go b/framework/cli/cmd/ma_provision_test.go
new file mode 100644
index 0000000..f2cec78
--- /dev/null
+++ b/framework/cli/cmd/ma_provision_test.go
@@ -0,0 +1,124 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+// TestRunMAProvisionDryRun exercises the bulk of runMAProvision without
+// touching the real Anthropic API. Setup:
+//   1. cd into a tmp dir
+//   2. seed framework/managed-agents/<name>.agent.yaml with priority agent
+//   3. set --dry-run so we never POST
+func TestRunMAProvisionDryRun(t *testing.T) {
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	tmp := t.TempDir()
+	_ = os.Chdir(tmp)
+	t.Setenv("ANTHROPIC_API_KEY", "")
+
+	maDir := filepath.Join(tmp, "framework", "managed-agents")
+	_ = os.MkdirAll(maDir, 0755)
+	// One priority agent + one non-priority agent (filtered out).
+	_ = os.WriteFile(filepath.Join(maDir, "ed209.agent.yaml"), []byte(
+		`name: ed209
+description: 'Security audit'
+model: claude-opus-4-7
+tools:
+  - bash
+`), 0644)
+	_ = os.WriteFile(filepath.Join(maDir, "noisy.agent.yaml"), []byte(
+		`name: noisy
+description: 'Should be filtered out'
+`), 0644)
+
+	c := &cobra.Command{Use: "ma-provision"}
+	c.Flags().Bool("dry-run", false, "")
+	c.Flags().String("agent", "", "")
+	_ = c.Flags().Set("dry-run", "true")
+
+	out := captureStdout(func() {
+		err := runMAProvision(c, nil)
+		if err != nil {
+			t.Fatalf("dry-run provision must succeed, got %v", err)
+		}
+	})
+
+	if !strings.Contains(out, "[dry-run]") {
+		t.Errorf("expected dry-run banner, got: %s", out)
+	}
+	if !strings.Contains(out, "ed209") {
+		t.Errorf("priority agent ed209 must appear, got: %s", out)
+	}
+	if strings.Contains(out, "noisy") {
+		t.Errorf("non-priority agent should be filtered, got: %s", out)
+	}
+}
+
+// TestRunMAProvisionAgentFilter forces the --agent path which bypasses the
+// priority filter and considers any agent matching by name.
+func TestRunMAProvisionAgentFilter(t *testing.T) {
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	tmp := t.TempDir()
+	_ = os.Chdir(tmp)
+	t.Setenv("ANTHROPIC_API_KEY", "")
+
+	maDir := filepath.Join(tmp, "framework", "managed-agents")
+	_ = os.MkdirAll(maDir, 0755)
+	_ = os.WriteFile(filepath.Join(maDir, "myagent.agent.yaml"), []byte(
+		`name: myagent
+description: 'Custom'
+`), 0644)
+
+	c := &cobra.Command{Use: "ma-provision"}
+	c.Flags().Bool("dry-run", false, "")
+	c.Flags().String("agent", "", "")
+	_ = c.Flags().Set("dry-run", "true")
+	_ = c.Flags().Set("agent", "myagent")
+
+	out := captureStdout(func() {
+		_ = runMAProvision(c, nil)
+	})
+	if !strings.Contains(out, "myagent") {
+		t.Errorf("expected myagent in dry-run output, got: %s", out)
+	}
+}
+
+// TestRunMAProvisionAlreadyProvisioned exercises the "already provisioned"
+// branch by pre-seeding ids.json with the agent's id.
+func TestRunMAProvisionAlreadyProvisioned(t *testing.T) {
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	tmp := t.TempDir()
+	_ = os.Chdir(tmp)
+	t.Setenv("ANTHROPIC_API_KEY", "")
+
+	maDir := filepath.Join(tmp, "framework", "managed-agents")
+	_ = os.MkdirAll(maDir, 0755)
+	_ = os.WriteFile(filepath.Join(maDir, "ed209.agent.yaml"), []byte(`name: ed209`), 0644)
+
+	idsDir := filepath.Join(tmp, ".ulk", "managed-agents")
+	_ = os.MkdirAll(idsDir, 0755)
+	_ = os.WriteFile(filepath.Join(idsDir, "ids.json"),
+		[]byte(`{"agents":{"ed209":"agent_existing_id_42"}}`), 0644)
+
+	c := &cobra.Command{Use: "ma-provision"}
+	c.Flags().Bool("dry-run", false, "")
+	c.Flags().String("agent", "", "")
+	_ = c.Flags().Set("dry-run", "true")
+
+	out := captureStdout(func() {
+		_ = runMAProvision(c, nil)
+	})
+	if !strings.Contains(out, "already provisioned") {
+		t.Errorf("expected already-provisioned message, got: %s", out)
+	}
+	if !strings.Contains(out, "agent_existing_id_42") {
+		t.Errorf("expected existing id in output, got: %s", out)
+	}
+}
diff --git a/framework/cli/cmd/ma_runtime_test.go b/framework/cli/cmd/ma_runtime_test.go
new file mode 100644
index 0000000..2709e6f
--- /dev/null
+++ b/framework/cli/cmd/ma_runtime_test.go
@@ -0,0 +1,155 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+// ── runMA error paths ───────────────────────────────────────────────────────
+
+func TestRunMANoAPIKey(t *testing.T) {
+	t.Setenv("ANTHROPIC_API_KEY", "")
+	c := &cobra.Command{Use: "ma"}
+	err := runMA(c, []string{"agent-name", "hello"})
+	if err == nil {
+		t.Fatal("expected error when ANTHROPIC_API_KEY missing")
+	}
+	if !strings.Contains(err.Error(), "ANTHROPIC_API_KEY") {
+		t.Errorf("wrong error message: %v", err)
+	}
+}
+
+func TestRunMAListNoAPIKey(t *testing.T) {
+	t.Setenv("ANTHROPIC_API_KEY", "")
+	err := runMAList(nil)
+	if err == nil {
+		t.Fatal("expected error when ANTHROPIC_API_KEY missing")
+	}
+	if !strings.Contains(err.Error(), "ANTHROPIC_API_KEY") {
+		t.Errorf("wrong error message: %v", err)
+	}
+}
+
+func TestRunMAProvisionNoAPIKey(t *testing.T) {
+	t.Setenv("ANTHROPIC_API_KEY", "")
+	c := &cobra.Command{Use: "ma-provision"}
+	c.Flags().Bool("dry-run", false, "")
+	c.Flags().String("source", "", "")
+	err := runMAProvision(c, nil)
+	// Non-dry-run + no key => error.
+	if err == nil {
+		t.Fatal("expected error when ANTHROPIC_API_KEY missing and not --dry-run")
+	}
+}
+
+// ── loadAgentIDFromFile ─────────────────────────────────────────────────────
+
+func TestLoadAgentIDFromFileMissing(t *testing.T) {
+	// Run from a tmpdir so .ulk/managed-agents/ids.json certainly doesn't exist.
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	_ = os.Chdir(t.TempDir())
+
+	_, err := loadAgentIDFromFile("anything")
+	if err == nil {
+		t.Fatal("expected error when ids.json missing")
+	}
+	if !strings.Contains(err.Error(), "ids.json not found") {
+		t.Errorf("wrong error: %v", err)
+	}
+}
+
+func TestLoadAgentIDFromFileMalformed(t *testing.T) {
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	tmp := t.TempDir()
+	_ = os.Chdir(tmp)
+	_ = os.MkdirAll(filepath.Join(tmp, ".ulk", "managed-agents"), 0755)
+	_ = os.WriteFile(filepath.Join(tmp, ".ulk", "managed-agents", "ids.json"),
+		[]byte(`{not valid json`), 0644)
+	_, err := loadAgentIDFromFile("anything")
+	if err == nil {
+		t.Fatal("expected error for malformed JSON")
+	}
+}
+
+func TestLoadAgentIDFromFileKnownAgent(t *testing.T) {
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	tmp := t.TempDir()
+	_ = os.Chdir(tmp)
+	_ = os.MkdirAll(filepath.Join(tmp, ".ulk", "managed-agents"), 0755)
+	_ = os.WriteFile(
+		filepath.Join(tmp, ".ulk", "managed-agents", "ids.json"),
+		[]byte(`{"agents":{"sargeras":"agent_xyz"}}`),
+		0644,
+	)
+	id, err := loadAgentIDFromFile("sargeras")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != "agent_xyz" {
+		t.Errorf("expected agent_xyz, got %q", id)
+	}
+}
+
+func TestLoadAgentIDFromFileUnknownAgent(t *testing.T) {
+	prev, _ := os.Getwd()
+	defer os.Chdir(prev) //nolint:errcheck
+	tmp := t.TempDir()
+	_ = os.Chdir(tmp)
+	_ = os.MkdirAll(filepath.Join(tmp, ".ulk", "managed-agents"), 0755)
+	_ = os.WriteFile(
+		filepath.Join(tmp, ".ulk", "managed-agents", "ids.json"),
+		[]byte(`{"agents":{"a":"id_a"}}`),
+		0644,
+	)
+	_, err := loadAgentIDFromFile("nonexistent")
+	if err == nil {
+		t.Fatal("expected error for unknown agent name")
+	}
+}
+
+// ── parseSSEStream ──────────────────────────────────────────────────────────
+
+func TestParseSSEStreamHandlesAllEventTypes(t *testing.T) {
+	body := `data: {"type":"session.created","agent":{"session_id":"s1"}}
+data: {"type":"text_delta","text":"hello "}
+data: {"type":"text_delta","text":"world"}
+data: comment-line-without-prefix
+data:
+data: [DONE]
+data: {"type":"agent.stop","stop_reason":"end_turn"}
+data: {malformed json line}
+`
+	out := captureStdout(func() {
+		err := parseSSEStream(strings.NewReader(body))
+		if err != nil {
+			t.Fatalf("parse error: %v", err)
+		}
+	})
+	// Combined "hello world" must be on stdout (text_delta events).
+	if !strings.Contains(out, "hello world") {
+		t.Errorf("expected 'hello world' on stdout, got %q", out)
+	}
+}
+
+func TestParseSSEStreamEmptyInput(t *testing.T) {
+	if err := parseSSEStream(strings.NewReader("")); err != nil {
+		t.Errorf("empty stream must not error, got %v", err)
+	}
+}
+
+// ── maAPIRequest (network failure path) ─────────────────────────────────────
+
+func TestMAAPIRequestBadEndpoint(t *testing.T) {
+	// Call with an unreachable endpoint & empty key — should fail at HTTP layer.
+	_, err := maAPIRequest("GET", "/nonexistent-path-test", "", nil)
+	if err == nil {
+		t.Skip("API request unexpectedly succeeded — environment may have HTTP intercept")
+	}
+}
diff --git a/framework/cli/cmd/ma_test.go b/framework/cli/cmd/ma_test.go
new file mode 100644
index 0000000..3321795
--- /dev/null
+++ b/framework/cli/cmd/ma_test.go
@@ -0,0 +1,175 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// ── parseAgentYAMLFile ──────────────────────────────────────────────────────
+
+func writeYAML(t *testing.T, content string) string {
+	t.Helper()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "agent.agent.yaml")
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	return path
+}
+
+func TestParseAgentYAMLBasic(t *testing.T) {
+	path := writeYAML(t, `name: ed209
+description: 'Security audit'
+model: claude-opus-4-7
+environment: ulk-audit
+system: |
+  You are an auditor.
+  Be thorough.
+tools:
+  - bash
+  - web_search
+`)
+	ag, err := parseAgentYAMLFile(path)
+	if err != nil {
+		t.Fatalf("parse error: %v", err)
+	}
+	if ag.name != "ed209" {
+		t.Errorf("name: got %q", ag.name)
+	}
+	if ag.description != "Security audit" {
+		t.Errorf("description must strip quotes, got %q", ag.description)
+	}
+	if ag.model != "claude-opus-4-7" {
+		t.Errorf("model: got %q", ag.model)
+	}
+	if ag.environment != "ulk-audit" {
+		t.Errorf("environment: got %q", ag.environment)
+	}
+	if !strings.Contains(ag.system, "You are an auditor") {
+		t.Errorf("system body lost, got %q", ag.system)
+	}
+	if !strings.Contains(ag.system, "Be thorough") {
+		t.Errorf("system body must include all lines, got %q", ag.system)
+	}
+	if len(ag.tools) != 2 || ag.tools[0] != "bash" || ag.tools[1] != "web_search" {
+		t.Errorf("tools: got %v", ag.tools)
+	}
+}
+
+func TestParseAgentYAMLIgnoresComments(t *testing.T) {
+	path := writeYAML(t, `# top comment
+name: minimal
+# another comment
+description: 'just a name'
+`)
+	ag, err := parseAgentYAMLFile(path)
+	if err != nil {
+		t.Fatalf("parse error: %v", err)
+	}
+	if ag.name != "minimal" {
+		t.Errorf("name: got %q", ag.name)
+	}
+}
+
+func TestParseAgentYAMLDoubleQuotedDescription(t *testing.T) {
+	path := writeYAML(t, `name: agent
+description: "quoted with double"
+`)
+	ag, _ := parseAgentYAMLFile(path)
+	if ag.description != "quoted with double" {
+		t.Errorf("description must strip double quotes, got %q", ag.description)
+	}
+}
+
+func TestParseAgentYAMLMissingFile(t *testing.T) {
+	_, err := parseAgentYAMLFile("/nonexistent/agent.yaml")
+	if err == nil {
+		t.Fatal("expected error for missing file")
+	}
+}
+
+// ── collectAgentYAMLs ───────────────────────────────────────────────────────
+
+func TestCollectAgentYAMLsRecurses(t *testing.T) {
+	root := t.TempDir()
+	mustWrite := func(rel, body string) {
+		full := filepath.Join(root, rel)
+		_ = os.MkdirAll(filepath.Dir(full), 0755)
+		if err := os.WriteFile(full, []byte(body), 0644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	mustWrite("a.agent.yaml", "name: a")
+	mustWrite("nested/b.agent.yaml", "name: b")
+	mustWrite("nested/deep/c.agent.yaml", "name: c")
+	mustWrite("nested/not-an-agent.txt", "")
+	mustWrite(".hidden/d.agent.yaml", "name: d") // hidden dir must be skipped
+
+	files := collectAgentYAMLs(root)
+	if len(files) != 3 {
+		t.Fatalf("expected 3 .agent.yaml files (skip hidden + non-yaml), got %d: %v", len(files), files)
+	}
+}
+
+func TestCollectAgentYAMLsMissingDir(t *testing.T) {
+	files := collectAgentYAMLs("/nonexistent/path")
+	if len(files) != 0 {
+		t.Errorf("missing dir must return empty, got %v", files)
+	}
+}
+
+// ── buildMAPayload ──────────────────────────────────────────────────────────
+
+func TestBuildMAPayloadDefaults(t *testing.T) {
+	ag := &agentYAML{name: "a", description: "d"} // no model, no env, no tools
+	p := buildMAPayload(ag)
+	if p.Model != "claude-sonnet-4-6" {
+		t.Errorf("default model expected claude-sonnet-4-6, got %q", p.Model)
+	}
+	if p.Environment != "ulk-audit" {
+		t.Errorf("default environment expected ulk-audit, got %q", p.Environment)
+	}
+	if len(p.Tools) != 0 {
+		t.Errorf("no tools means empty, got %v", p.Tools)
+	}
+}
+
+func TestBuildMAPayloadKnownTools(t *testing.T) {
+	ag := &agentYAML{
+		name:  "a",
+		tools: []string{"bash", "web_search", "computer", "unknown_tool"},
+	}
+	p := buildMAPayload(ag)
+	// 3 known tools mapped, "unknown_tool" silently dropped.
+	if len(p.Tools) != 3 {
+		t.Fatalf("expected 3 mapped tools, got %d (%v)", len(p.Tools), p.Tools)
+	}
+	types := []string{p.Tools[0]["type"], p.Tools[1]["type"], p.Tools[2]["type"]}
+	want := map[string]bool{"bash": true, "web_search": true, "computer": true}
+	for _, ty := range types {
+		if !want[ty] {
+			t.Errorf("unexpected tool type %q", ty)
+		}
+	}
+}
+
+func TestBuildMAPayloadTrimsSystem(t *testing.T) {
+	ag := &agentYAML{name: "a", system: "  \n  Hello  \n  "}
+	p := buildMAPayload(ag)
+	if p.SystemPrompt != "Hello" {
+		t.Errorf("system prompt must be trimmed, got %q", p.SystemPrompt)
+	}
+}
+
+func TestBuildMAPayloadCustomModelAndEnv(t *testing.T) {
+	ag := &agentYAML{name: "a", model: "claude-opus-4-7", environment: "prod"}
+	p := buildMAPayload(ag)
+	if p.Model != "claude-opus-4-7" {
+		t.Errorf("custom model lost, got %q", p.Model)
+	}
+	if p.Environment != "prod" {
+		t.Errorf("custom env lost, got %q", p.Environment)
+	}
+}
diff --git a/framework/cli/cmd/selfupdate_test.go b/framework/cli/cmd/selfupdate_test.go
new file mode 100644
index 0000000..52b156b
--- /dev/null
+++ b/framework/cli/cmd/selfupdate_test.go
@@ -0,0 +1,167 @@
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// ── binaryAssetName ─────────────────────────────────────────────────────────
+
+func TestBinaryAssetNameStripsLeadingV(t *testing.T) {
+	got := binaryAssetName("v6.4.2")
+	if !strings.HasPrefix(got, "ulk_6.4.2_") {
+		t.Errorf("expected leading 'v' to be stripped, got %q", got)
+	}
+}
+
+func TestBinaryAssetNameNoLeadingV(t *testing.T) {
+	got := binaryAssetName("6.4.2")
+	if !strings.HasPrefix(got, "ulk_6.4.2_") {
+		t.Errorf("expected version 6.4.2, got %q", got)
+	}
+}
+
+func TestBinaryAssetNamePlatformSuffix(t *testing.T) {
+	got := binaryAssetName("v1.0.0")
+
+	// goreleaser uses "Darwin"/"Linux" capitalised + x86_64 (instead of amd64).
+	switch runtime.GOOS {
+	case "darwin":
+		if !strings.Contains(got, "Darwin") {
+			t.Errorf("missing Darwin in %q", got)
+		}
+	case "linux":
+		if !strings.Contains(got, "Linux") {
+			t.Errorf("missing Linux in %q", got)
+		}
+	case "windows":
+		if !strings.HasSuffix(got, ".zip") {
+			t.Errorf("expected .zip on windows, got %q", got)
+		}
+	}
+
+	if runtime.GOARCH == "amd64" && !strings.Contains(got, "x86_64") {
+		t.Errorf("amd64 must be reported as x86_64, got %q", got)
+	}
+}
+
+// ── assetURL ────────────────────────────────────────────────────────────────
+
+func TestAssetURLFound(t *testing.T) {
+	rel := &ghRelease{
+		TagName: "v1.0.0",
+		Assets: []struct {
+			Name               string `json:"name"`
+			BrowserDownloadURL string `json:"browser_download_url"`
+		}{
+			{Name: "a.tar.gz", BrowserDownloadURL: "https://example.com/a.tar.gz"},
+			{Name: "b.zip", BrowserDownloadURL: "https://example.com/b.zip"},
+		},
+	}
+	if got := assetURL(rel, "b.zip"); got != "https://example.com/b.zip" {
+		t.Errorf("expected b.zip url, got %q", got)
+	}
+}
+
+func TestAssetURLNotFoundReturnsEmpty(t *testing.T) {
+	rel := &ghRelease{TagName: "v1.0.0"}
+	if got := assetURL(rel, "missing"); got != "" {
+		t.Errorf("expected empty string for missing asset, got %q", got)
+	}
+}
+
+// ── httpGet ─────────────────────────────────────────────────────────────────
+
+func TestHTTPGet200(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte("hello"))
+	}))
+	defer srv.Close()
+
+	body, err := httpGet(srv.URL)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(body) != "hello" {
+		t.Errorf("expected 'hello', got %q", string(body))
+	}
+}
+
+func TestHTTPGetNon200(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	_, err := httpGet(srv.URL)
+	if err == nil {
+		t.Fatal("expected error for HTTP 404")
+	}
+	if !strings.Contains(err.Error(), "404") {
+		t.Errorf("error must mention status code, got %v", err)
+	}
+}
+
+// ── fetchExpectedHash ───────────────────────────────────────────────────────
+
+func TestFetchExpectedHashFromChecksumsFile(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(
+			"abc123  ulk_1.0.0_Darwin_x86_64.tar.gz\n" +
+				"def456  ulk_1.0.0_Linux_x86_64.tar.gz\n"))
+	}))
+	defer srv.Close()
+
+	rel := &ghRelease{
+		Assets: []struct {
+			Name               string `json:"name"`
+			BrowserDownloadURL string `json:"browser_download_url"`
+		}{
+			{Name: "checksums.txt", BrowserDownloadURL: srv.URL},
+		},
+	}
+	hash, err := fetchExpectedHash(rel, "ulk_1.0.0_Darwin_x86_64.tar.gz")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if hash != "abc123" {
+		t.Errorf("expected abc123, got %q", hash)
+	}
+}
+
+func TestFetchExpectedHashNoChecksumsFile(t *testing.T) {
+	rel := &ghRelease{} // no assets
+	hash, err := fetchExpectedHash(rel, "anything")
+	if err != nil {
+		t.Fatalf("checksums.txt absent must NOT be an error, got %v", err)
+	}
+	if hash != "" {
+		t.Errorf("expected empty hash when checksums.txt missing, got %q", hash)
+	}
+}
+
+func TestFetchExpectedHashAssetNotListed(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte("abc123  some-other-asset.tar.gz\n"))
+	}))
+	defer srv.Close()
+
+	rel := &ghRelease{
+		Assets: []struct {
+			Name               string `json:"name"`
+			BrowserDownloadURL string `json:"browser_download_url"`
+		}{
+			{Name: "checksums.txt", BrowserDownloadURL: srv.URL},
+		},
+	}
+	hash, err := fetchExpectedHash(rel, "missing-asset.tar.gz")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if hash != "" {
+		t.Errorf("expected empty when asset not listed in checksums.txt, got %q", hash)
+	}
+}
diff --git a/framework/cli/cmd/short_runners_test.go b/framework/cli/cmd/short_runners_test.go
new file mode 100644
index 0000000..3d7f57c
--- /dev/null
+++ b/framework/cli/cmd/short_runners_test.go
@@ -0,0 +1,74 @@
+package cmd
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+// These tests exercise the early "no installation" branches of the short
+// command runners (runMigrate / runRollback / runUpdate). They are valuable
+// not for production correctness — that's covered by integration tests —
+// but for unit-level coverage of the error-path code that survives the
+// `go test -coverprofile` instrumentation.
+
+func mkCobraCmd(boolFlags []string) *cobra.Command {
+	c := &cobra.Command{Use: "x"}
+	for _, name := range boolFlags {
+		c.Flags().Bool(name, false, "")
+	}
+	c.Flags().String("source", "", "")
+	return c
+}
+
+func TestRunMigrateNoInstall(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_HOME", "/nonexistent")
+	c := mkCobraCmd([]string{"dry-run"})
+	err := runMigrate(c, nil)
+	if err == nil {
+		t.Fatal("expected error when state.json missing")
+	}
+	if !strings.Contains(err.Error(), "state.json not found") {
+		t.Errorf("error must mention missing state.json, got %v", err)
+	}
+}
+
+func TestRunRollbackNoInstall(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_HOME", "/nonexistent")
+	c := mkCobraCmd([]string{"dry-run"})
+	err := runRollback(c, nil)
+	if err == nil {
+		t.Fatal("expected error when state.json missing")
+	}
+	if !strings.Contains(err.Error(), "state.json not found") {
+		t.Errorf("error must mention missing state.json, got %v", err)
+	}
+}
+
+func TestRunUpdateNoInstall(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("ULK_HOME", "/nonexistent")
+	c := mkCobraCmd([]string{"check", "force"})
+	err := runUpdate(c, nil)
+	if err == nil {
+		t.Fatal("expected error when state.json missing")
+	}
+	if !strings.Contains(err.Error(), "no installation found") {
+		t.Errorf("error must mention missing installation, got %v", err)
+	}
+}
+
+// allKeys helper from update.go — pure func, easy to verify.
+func TestAllKeys(t *testing.T) {
+	got := allKeys(map[string]string{"a": "1", "b": "2", "c": "3"})
+	if len(got) != 3 {
+		t.Errorf("expected 3 keys, got %d (%v)", len(got), got)
+	}
+	got = allKeys(nil)
+	if len(got) != 0 {
+		t.Errorf("nil map must yield empty slice, got %v", got)
+	}
+}
diff --git a/framework/cli/cmd/uninstall_runtime_test.go b/framework/cli/cmd/uninstall_runtime_test.go
new file mode 100644
index 0000000..59fa185
--- /dev/null
+++ b/framework/cli/cmd/uninstall_runtime_test.go
@@ -0,0 +1,61 @@
+package cmd
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+// runUninstall has 4 early-error branches that didn't have unit coverage
+// (uninstall_test.go covers the helpers but not the dispatcher).
+
+func mkUninstallCmd() *cobra.Command {
+	c := &cobra.Command{Use: "uninstall"}
+	c.Flags().String("module", "", "")
+	c.Flags().Bool("all", false, "")
+	return c
+}
+
+func TestRunUninstallNoFlagsErrors(t *testing.T) {
+	c := mkUninstallCmd()
+	err := runUninstall(c, nil)
+	if err == nil {
+		t.Fatal("expected error when neither --module nor --all is set")
+	}
+	if !strings.Contains(err.Error(), "--module") || !strings.Contains(err.Error(), "--all") {
+		t.Errorf("error must hint at both flags, got: %v", err)
+	}
+}
+
+func TestRunUninstallBothFlagsErrors(t *testing.T) {
+	c := mkUninstallCmd()
+	_ = c.Flags().Set("module", "vps")
+	_ = c.Flags().Set("all", "true")
+	err := runUninstall(c, nil)
+	if err == nil {
+		t.Fatal("expected error when both --module and --all set")
+	}
+	if !strings.Contains(err.Error(), "mutually exclusive") {
+		t.Errorf("error must mention mutual exclusion, got: %v", err)
+	}
+}
+
+// TestRunUninstallAllOnEmptyClaude exercises the uninstallAll path against
+// an empty claudeDir (HOME points to tmp). It must succeed (idempotent
+// uninstall on a non-existent install is a no-op, not an error).
+func TestRunUninstallAllOnEmptyClaude(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("CLAUDE_DIR", "")
+	t.Setenv("ULK_HOME", tmp+"/.ulk-empty")
+
+	c := mkUninstallCmd()
+	_ = c.Flags().Set("all", "true")
+	out := captureStdout(func() {
+		_ = runUninstall(c, nil)
+	})
+	// uninstallAll prints a summary line ; we only check that the command
+	// reached the dispatcher without panicking.
+	_ = out
+}
diff --git a/framework/cli/internal/config/hooks_extra_test.go b/framework/cli/internal/config/hooks_extra_test.go
new file mode 100644
index 0000000..13d20a5
--- /dev/null
+++ b/framework/cli/internal/config/hooks_extra_test.go
@@ -0,0 +1,105 @@
+package config
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// ── InjectStatusLine ────────────────────────────────────────────────────────
+
+func TestInjectStatusLineCreatesNew(t *testing.T) {
+	dir := t.TempDir()
+	settings := filepath.Join(dir, "settings.json")
+	script := "/path/to/statusline.sh"
+
+	if err := InjectStatusLine(settings, script); err != nil {
+		t.Fatalf("inject: %v", err)
+	}
+
+	raw, err := os.ReadFile(settings)
+	if err != nil {
+		t.Fatalf("read: %v", err)
+	}
+	var got map[string]any
+	_ = json.Unmarshal(raw, &got)
+
+	sl, ok := got["statusLine"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected statusLine object, got: %v", got)
+	}
+	// Implementation prefixes with "bash " — assert containment, not equality.
+	cmd, _ := sl["command"].(string)
+	if !strings.Contains(cmd, script) {
+		t.Errorf("command must contain script path, got %q", cmd)
+	}
+}
+
+func TestInjectStatusLineUpdatesExisting(t *testing.T) {
+	dir := t.TempDir()
+	settings := filepath.Join(dir, "settings.json")
+	_ = os.WriteFile(settings, []byte(`{"theme":"dark","statusLine":{"command":"/old/path","type":"command"}}`), 0644)
+
+	if err := InjectStatusLine(settings, "/new/path"); err != nil {
+		t.Fatalf("inject: %v", err)
+	}
+
+	raw, _ := os.ReadFile(settings)
+	if !strings.Contains(string(raw), "/new/path") {
+		t.Errorf("new path not written, got: %s", raw)
+	}
+	if !strings.Contains(string(raw), `"theme"`) {
+		t.Errorf("existing keys lost, got: %s", raw)
+	}
+}
+
+// ── SetEnvVar ───────────────────────────────────────────────────────────────
+
+func TestSetEnvVarCreatesNew(t *testing.T) {
+	dir := t.TempDir()
+	settings := filepath.Join(dir, "settings.local.json")
+	if err := SetEnvVar(settings, "FOO", "bar"); err != nil {
+		t.Fatalf("set: %v", err)
+	}
+	raw, _ := os.ReadFile(settings)
+	var got map[string]any
+	_ = json.Unmarshal(raw, &got)
+	envBlock, _ := got["env"].(map[string]any)
+	if envBlock["FOO"] != "bar" {
+		t.Errorf("FOO not set, got: %v", got)
+	}
+}
+
+func TestSetEnvVarMergesIntoExisting(t *testing.T) {
+	dir := t.TempDir()
+	settings := filepath.Join(dir, "settings.local.json")
+	_ = os.WriteFile(settings, []byte(`{"env":{"OLD":"keep"}}`), 0644)
+	if err := SetEnvVar(settings, "NEW", "hello"); err != nil {
+		t.Fatalf("set: %v", err)
+	}
+	raw, _ := os.ReadFile(settings)
+	if !strings.Contains(string(raw), `"OLD"`) {
+		t.Errorf("OLD env var lost, got: %s", raw)
+	}
+	if !strings.Contains(string(raw), `"NEW"`) {
+		t.Errorf("NEW env var missing, got: %s", raw)
+	}
+}
+
+func TestSetEnvVarOverwrites(t *testing.T) {
+	dir := t.TempDir()
+	settings := filepath.Join(dir, "settings.local.json")
+	_ = os.WriteFile(settings, []byte(`{"env":{"K":"v1"}}`), 0644)
+	if err := SetEnvVar(settings, "K", "v2"); err != nil {
+		t.Fatalf("set: %v", err)
+	}
+	raw, _ := os.ReadFile(settings)
+	if !strings.Contains(string(raw), `"v2"`) {
+		t.Errorf("override failed, got: %s", raw)
+	}
+	if strings.Contains(string(raw), `"v1"`) {
+		t.Errorf("old value not replaced, got: %s", raw)
+	}
+}
diff --git a/framework/cli/internal/installer/modules_install_test.go b/framework/cli/internal/installer/modules_install_test.go
new file mode 100644
index 0000000..493f41f
--- /dev/null
+++ b/framework/cli/internal/installer/modules_install_test.go
@@ -0,0 +1,278 @@
+package installer
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// captureCtx returns a dry-run installer context that records progress calls.
+func captureCtx(t *testing.T) (*Context, *[]string) {
+	t.Helper()
+	tmp := t.TempDir()
+	dst := filepath.Join(tmp, "claude")
+	src := filepath.Join(tmp, "ulk")
+	_ = os.MkdirAll(dst, 0755)
+	_ = os.MkdirAll(filepath.Join(src, "framework", "tools"), 0755)
+	logs := []string{}
+	ctx := &Context{
+		SourceDir: src,
+		ClaudeDir: dst,
+		SkillsDir: filepath.Join(dst, "skills"),
+		HooksDir:  filepath.Join(dst, "hooks"),
+		DryRun:    true,
+		Progress: func(step, detail string) {
+			logs = append(logs, step+": "+detail)
+		},
+		Result: &Result{},
+	}
+	return ctx, &logs
+}
+
+// ── BundleModule ────────────────────────────────────────────────────────────
+
+func TestBundleModuleMissingRegistryIsNoOp(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	m := &BundleModule{
+		base:       base{key: "test-bundle", label: "test"},
+		categories: []string{"container"},
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("missing registry must not error, got %v", err)
+	}
+	joined := strings.Join(*logs, "\n")
+	if !strings.Contains(joined, "registre introuvable") {
+		t.Errorf("expected registry-missing message, got logs: %v", *logs)
+	}
+}
+
+func TestBundleModuleEmptyCategoryIsNoOp(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	// Write a valid registry but no tools matching.
+	regPath := filepath.Join(ctx.SourceDir, registryRelPath)
+	_ = os.WriteFile(regPath, []byte(`{"version":"1","tools":[{"name":"x","command":"x","category":"other"}]}`), 0644)
+	m := &BundleModule{
+		base:       base{key: "test-bundle", label: "test"},
+		categories: []string{"container"},
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "aucun outil") {
+		t.Errorf("expected 'aucun outil' message, got logs: %v", *logs)
+	}
+}
+
+func TestBundleModuleDryRunSkipsExec(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	regPath := filepath.Join(ctx.SourceDir, registryRelPath)
+	_ = os.WriteFile(regPath, []byte(`{
+  "version":"1",
+  "tools":[{
+    "name":"definitely-missing-tool-xyz","command":"definitely-missing-tool-xyz",
+    "category":"container",
+    "install":{"macos":"echo skipped","linux":"echo skipped"}
+  }]
+}`), 0644)
+	m := &BundleModule{
+		base:       base{key: "test-bundle", label: "test"},
+		categories: []string{"container"},
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("dry-run must not error, got %v", err)
+	}
+	joined := strings.Join(*logs, "\n")
+	if !strings.Contains(joined, "[dry-run]") || !strings.Contains(joined, "skipped") {
+		t.Errorf("expected dry-run trace, got %v", *logs)
+	}
+}
+
+// ── ExternalModule ──────────────────────────────────────────────────────────
+
+func TestExternalModuleMessageOnly(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	m := &ExternalModule{
+		base:    base{key: "msg", label: "msg"},
+		msgOnly: true,
+		message: "install manually via brew",
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "install manually") {
+		t.Errorf("message not logged, got %v", *logs)
+	}
+}
+
+func TestExternalModuleMissingDepHint(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	m := &ExternalModule{
+		base:    base{key: "ext", label: "ext"},
+		dep:     "definitely-missing-cli-xyz",
+		runCmd:  []string{"echo", "hi"},
+		message: "missing dep",
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "missing dep") {
+		t.Errorf("dep-miss hint not logged, got %v", *logs)
+	}
+}
+
+func TestExternalModuleDryRunSkipsExec(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	// No dep required → goes straight to DryRun branch.
+	m := &ExternalModule{
+		base:   base{key: "ext", label: "ext"},
+		runCmd: []string{"sh", "-c", "echo dry-run"},
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "[dry-run]") {
+		t.Errorf("expected dry-run trace, got %v", *logs)
+	}
+}
+
+func TestExternalModuleUninstallIsNoOp(t *testing.T) {
+	ctx, _ := captureCtx(t)
+	m := &ExternalModule{base: base{key: "ext", label: "ext"}}
+	if err := m.Uninstall(ctx); err != nil {
+		t.Errorf("Uninstall must be a no-op, got %v", err)
+	}
+}
+
+// ── MCPModule ───────────────────────────────────────────────────────────────
+
+func TestMCPModuleDryRun(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	m := &MCPModule{
+		base:      base{key: "mcp", label: "mcp"},
+		mcpName:   "figma",
+		transport: "http",
+		mcpURL:    "https://mcp.figma.com/mcp",
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "[dry-run]") {
+		t.Errorf("expected dry-run trace, got %v", *logs)
+	}
+}
+
+// ── ConfigModule ────────────────────────────────────────────────────────────
+
+func TestConfigModuleScriptMissing(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	m := &ConfigModule{
+		base:      base{key: "cfg", label: "cfg"},
+		scriptSrc: "missing-script.sh",
+		scriptDst: "missing-script.sh",
+	}
+	// Disable DryRun so we hit the "script introuvable" branch immediately.
+	ctx.DryRun = false
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "introuvable") {
+		t.Errorf("expected 'introuvable' message, got %v", *logs)
+	}
+}
+
+func TestConfigModuleDryRunWithScript(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	// Place a script in the SourceDir so the existence check passes.
+	scriptSrc := filepath.Join(ctx.SourceDir, "framework", "tools", "myhook.sh")
+	_ = os.WriteFile(scriptSrc, []byte("#!/bin/sh\necho ok\n"), 0644)
+	m := &ConfigModule{
+		base:      base{key: "cfg", label: "cfg"},
+		scriptSrc: "myhook.sh",
+		scriptDst: "hooks/myhook.sh",
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "[dry-run]") {
+		t.Errorf("expected dry-run trace, got %v", *logs)
+	}
+}
+
+func TestConfigModuleUninstallNoScriptIsNoOp(t *testing.T) {
+	ctx, _ := captureCtx(t)
+	m := &ConfigModule{base: base{key: "cfg", label: "cfg"}} // no scriptDst
+	if err := m.Uninstall(ctx); err != nil {
+		t.Errorf("uninstall must be a no-op without scriptDst, got %v", err)
+	}
+}
+
+// ── HookModule ──────────────────────────────────────────────────────────────
+
+func TestHookModuleScriptMissing(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	m := &HookModule{
+		base:      base{key: "h", label: "h"},
+		scriptSrc: "missing-hook.sh",
+		configSrc: "missing-fixture.json",
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("missing script must not error, got %v", err)
+	}
+	joined := strings.Join(*logs, "\n")
+	if !strings.Contains(joined, "introuvable") {
+		t.Errorf("expected 'introuvable' message, got: %v", *logs)
+	}
+}
+
+func TestHookModuleConfigMissing(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	// configSrc not present in .claude/hooks-examples/ → fixture missing branch.
+	m := &HookModule{
+		base:      base{key: "h", label: "h"},
+		configSrc: "missing-fixture.json",
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("missing fixture must not error, got %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "fixture introuvable") {
+		t.Errorf("expected 'fixture introuvable' message, got: %v", *logs)
+	}
+}
+
+func TestHookModuleDryRun(t *testing.T) {
+	ctx, logs := captureCtx(t)
+	// Place a fixture so the existence check passes.
+	fixtureDir := filepath.Join(ctx.SourceDir, ".claude", "hooks-examples")
+	_ = os.MkdirAll(fixtureDir, 0755)
+	_ = os.WriteFile(filepath.Join(fixtureDir, "myhook.json"), []byte(`{"hooks":{}}`), 0644)
+	m := &HookModule{
+		base:      base{key: "h", label: "h"},
+		configSrc: "myhook.json",
+	}
+	if err := m.Install(ctx); err != nil {
+		t.Fatalf("dry-run must not error, got %v", err)
+	}
+	if !strings.Contains(strings.Join(*logs, "\n"), "[dry-run]") {
+		t.Errorf("expected dry-run banner, got: %v", *logs)
+	}
+}
+
+func TestHookModuleUninstallScriptCleanup(t *testing.T) {
+	ctx, _ := captureCtx(t)
+	// Pre-create a hook script so removeAll has something to delete.
+	_ = os.MkdirAll(ctx.HooksDir, 0755)
+	scriptPath := filepath.Join(ctx.HooksDir, "to-remove.sh")
+	_ = os.WriteFile(scriptPath, []byte("#!/bin/sh\n"), 0755)
+	m := &HookModule{
+		base:      base{key: "h", label: "h"},
+		scriptSrc: "to-remove.sh",
+	}
+	ctx.DryRun = false
+	if err := m.Uninstall(ctx); err != nil {
+		t.Errorf("uninstall: %v", err)
+	}
+	if _, err := os.Stat(scriptPath); err == nil {
+		t.Errorf("hook script must be removed, still exists at %s", scriptPath)
+	}
+}
diff --git a/framework/cli/internal/registry/cli_tools_test.go b/framework/cli/internal/registry/cli_tools_test.go
new file mode 100644
index 0000000..51a99b7
--- /dev/null
+++ b/framework/cli/internal/registry/cli_tools_test.go
@@ -0,0 +1,80 @@
+package registry
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeRegistry(t *testing.T, body string) string {
+	t.Helper()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "cli-registry.json")
+	if err := os.WriteFile(path, []byte(body), 0644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func TestLoadCLIRegistryParsesValidFile(t *testing.T) {
+	path := writeRegistry(t, `{
+  "version": "1.0",
+  "tools": [
+    {"id": "rtk", "name": "RTK", "command": "rtk", "priority": "required",
+     "category": "core",
+     "install": {"macos": "brew install rtk", "linux": "curl ... | sh"}}
+  ]
+}`)
+	r, err := LoadCLIRegistry(path)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if r.Version != "1.0" {
+		t.Errorf("version: got %q", r.Version)
+	}
+	if len(r.Tools) != 1 || r.Tools[0].Name != "RTK" {
+		t.Fatalf("tools not parsed: %+v", r.Tools)
+	}
+	if r.Tools[0].Install.MacOS != "brew install rtk" {
+		t.Errorf("install.macos lost: %q", r.Tools[0].Install.MacOS)
+	}
+}
+
+func TestLoadCLIRegistryMissingFile(t *testing.T) {
+	_, err := LoadCLIRegistry("/nonexistent/cli-registry.json")
+	if err == nil {
+		t.Fatal("expected error for missing file")
+	}
+}
+
+func TestLoadCLIRegistryMalformedJSON(t *testing.T) {
+	path := writeRegistry(t, `{not valid json`)
+	_, err := LoadCLIRegistry(path)
+	if err == nil {
+		t.Fatal("expected error for malformed JSON")
+	}
+}
+
+func TestByCategoriesFiltersAndDedups(t *testing.T) {
+	r := &CLIRegistry{Tools: []CLITool{
+		{Command: "docker", Category: "container"},
+		{Command: "kubectl", Category: "container"},
+		{Command: "node", Category: "runtime"},
+		{Command: "docker", Category: "devops"},   // duplicate command
+	}}
+
+	got := r.ByCategories("container")
+	if len(got) != 2 {
+		t.Fatalf("expected 2 container tools, got %d", len(got))
+	}
+
+	got = r.ByCategories("container", "devops")
+	if len(got) != 2 {
+		t.Errorf("dedup by command failed (expected 2 unique), got %d (%v)", len(got), got)
+	}
+
+	got = r.ByCategories("nonexistent")
+	if len(got) != 0 {
+		t.Errorf("unknown category must return empty, got %v", got)
+	}
+}
diff --git a/framework/cli/tui/screens_test.go b/framework/cli/tui/screens_test.go
new file mode 100644
index 0000000..c1abe5d
--- /dev/null
+++ b/framework/cli/tui/screens_test.go
@@ -0,0 +1,60 @@
+package tui
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"strings"
+	"testing"
+)
+
+// Output capture (these helpers print directly to fmt.Print*).
+
+func captureOut(fn func()) string {
+	old := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+	fn()
+	_ = w.Close()
+	os.Stdout = old
+	var buf bytes.Buffer
+	_, _ = io.Copy(&buf, r)
+	return buf.String()
+}
+
+func TestPrintSplashShowsVersionAndCount(t *testing.T) {
+	out := captureOut(func() { PrintSplash("v6.4.2", 12) })
+	if !strings.Contains(out, "6.4.2") {
+		t.Errorf("splash must include version, got: %s", out)
+	}
+	// The number of modules should appear (somewhere) in the meta line.
+	if !strings.Contains(out, "12") {
+		t.Errorf("splash must include module count, got: %s", out)
+	}
+}
+
+func TestPrintFastHeader(t *testing.T) {
+	out := captureOut(func() { PrintFastHeader("v6.4.2", 8) })
+	if !strings.Contains(out, "6.4.2") {
+		t.Errorf("fast header must include version, got: %s", out)
+	}
+	if !strings.Contains(out, "8") {
+		t.Errorf("fast header must include module count, got: %s", out)
+	}
+}
+
+func TestPrintDoneReportsCounts(t *testing.T) {
+	r := DoneResult{
+		Commands: 12,
+		Agents:   85,
+		Skills:   21,
+		Modules:  4,
+		Version:  "v6.4.2",
+	}
+	out := captureOut(func() { PrintDone(r) })
+	for _, want := range []string{"12 commandes", "85 agents", "21 skills", "4 modules"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("done screen missing %q in output: %s", want, out)
+		}
+	}
+}