diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9489cf0..ab3af47 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -181,20 +181,7 @@ jobs:
         run: cargo build --locked --profile release-ffi -p agent-desktop-ffi
 
       - name: FFI dylib-adjacent helper discovery smoke
-        run: |
-          STAGE=$(mktemp -d /tmp/agent-desktop-ffi-helper.XXXXXX)
-          trap 'rm -rf "$STAGE"' EXIT
-          cp target/release-ffi/libagent_desktop_ffi.dylib "$STAGE/"
-          cp target/release/agent-desktop-macos-helper "$STAGE/"
-          chmod +x "$STAGE/agent-desktop-macos-helper"
-          DYLIB_SHA=$(shasum -a 256 "$STAGE/libagent_desktop_ffi.dylib" | awk '{print $1}')
-          HELPER_SHA=$(shasum -a 256 "$STAGE/agent-desktop-macos-helper" | awk '{print $1}')
-          AD_DYLIB_PATH="$STAGE/libagent_desktop_ffi.dylib" \
-            AD_HEADER_PATH=crates/ffi/include/agent_desktop.h \
-            AD_EXPECT_MACOS_HELPER=1 \
-            python3 tests/ffi-python/smoke.py
-          test "$DYLIB_SHA" = "$(shasum -a 256 "$STAGE/libagent_desktop_ffi.dylib" | awk '{print $1}')"
-          test "$HELPER_SHA" = "$(shasum -a 256 "$STAGE/agent-desktop-macos-helper" | awk '{print $1}')"
+        run: scripts/ci-ffi-helper-discovery-smoke.sh
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -206,46 +193,7 @@ jobs:
           node scripts/check-npm-package.js
 
       - name: NPM wrapper smoke
-        run: |
-          case "$(uname -s)-$(uname -m)" in
-            Darwin-arm64) NAME=agent-desktop-darwin-arm64 ;;
-            Darwin-x86_64) NAME=agent-desktop-darwin-x64 ;;
-            *)
-              echo "Unsupported smoke-test platform: $(uname -s)-$(uname -m)"
-              exit 1
-              ;;
-          esac
-          HELPER_NAME=agent-desktop-macos-helper
-          trap 'rm -f "npm/bin/${NAME}" "npm/bin/${HELPER_NAME}"' EXIT
-          SOURCE=target/release/agent-desktop
-          HELPER_SOURCE=target/release/agent-desktop-macos-helper
-          SOURCE_SHA=$(shasum -a 256 "$SOURCE" | awk '{print $1}')
-          HELPER_SOURCE_SHA=$(shasum -a 256 "$HELPER_SOURCE" | awk '{print $1}')
-          cp "$SOURCE" "npm/bin/${NAME}"
-          cp "$HELPER_SOURCE" "npm/bin/${HELPER_NAME}"
-          chmod +x "npm/bin/${NAME}"
-          chmod +x "npm/bin/${HELPER_NAME}"
-          COPY_SHA=$(shasum -a 256 "npm/bin/${NAME}" | awk '{print $1}')
-          HELPER_COPY_SHA=$(shasum -a 256 "npm/bin/${HELPER_NAME}" | awk '{print $1}')
-          if [ "$SOURCE_SHA" != "$COPY_SHA" ] || [ "$HELPER_SOURCE_SHA" != "$HELPER_COPY_SHA" ]; then
-            echo "NPM smoke executable copy failed immutable identity verification" >&2
-            exit 1
-          fi
-          node npm/bin/agent-desktop.js version > /tmp/agent-desktop-version.json
-          node -e "
-            const out = require('fs').readFileSync('/tmp/agent-desktop-version.json', 'utf8');
-            const json = JSON.parse(out);
-            if (json.ok !== true || !json.data || typeof json.data.version !== 'string') {
-              throw new Error('agent-desktop npm wrapper did not return version JSON');
-            }
-          "
-          if [ "$SOURCE_SHA" != "$(shasum -a 256 "$SOURCE" | awk '{print $1}')" ] || \
-             [ "$COPY_SHA" != "$(shasum -a 256 "npm/bin/${NAME}" | awk '{print $1}')" ] || \
-             [ "$HELPER_SOURCE_SHA" != "$(shasum -a 256 "$HELPER_SOURCE" | awk '{print $1}')" ] || \
-             [ "$HELPER_COPY_SHA" != "$(shasum -a 256 "npm/bin/${HELPER_NAME}" | awk '{print $1}')" ]; then
-            echo "NPM smoke executable changed while it was executed" >&2
-            exit 1
-          fi
+        run: scripts/ci-npm-wrapper-smoke.sh
 
   ffi-python-smoke:
     name: FFI Python Smoke
diff --git a/scripts/ci-ffi-helper-discovery-smoke.sh b/scripts/ci-ffi-helper-discovery-smoke.sh
new file mode 100755
index 0000000..0f502e7
--- /dev/null
+++ b/scripts/ci-ffi-helper-discovery-smoke.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+STAGE=$(mktemp -d /tmp/agent-desktop-ffi-helper.XXXXXX)
+cp target/release-ffi/libagent_desktop_ffi.dylib "$STAGE/"
+cp target/release/agent-desktop-macos-helper "$STAGE/"
+chmod +x "$STAGE/agent-desktop-macos-helper"
+DYLIB_SHA=$(shasum -a 256 "$STAGE/libagent_desktop_ffi.dylib" | awk '{print $1}')
+HELPER_SHA=$(shasum -a 256 "$STAGE/agent-desktop-macos-helper" | awk '{print $1}')
+AD_DYLIB_PATH="$STAGE/libagent_desktop_ffi.dylib" \
+  AD_HEADER_PATH=crates/ffi/include/agent_desktop.h \
+  AD_EXPECT_MACOS_HELPER=1 \
+  python3 tests/ffi-python/smoke.py
+test "$DYLIB_SHA" = "$(shasum -a 256 "$STAGE/libagent_desktop_ffi.dylib" | awk '{print $1}')"
+test "$HELPER_SHA" = "$(shasum -a 256 "$STAGE/agent-desktop-macos-helper" | awk '{print $1}')"
diff --git a/scripts/ci-npm-wrapper-smoke.sh b/scripts/ci-npm-wrapper-smoke.sh
new file mode 100755
index 0000000..fb2521d
--- /dev/null
+++ b/scripts/ci-npm-wrapper-smoke.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+case "$(uname -s)-$(uname -m)" in
+  Darwin-arm64) NAME=agent-desktop-darwin-arm64 ;;
+  Darwin-x86_64) NAME=agent-desktop-darwin-x64 ;;
+  *)
+    echo "Unsupported smoke-test platform: $(uname -s)-$(uname -m)"
+    exit 1
+    ;;
+esac
+HELPER_NAME=agent-desktop-macos-helper
+SOURCE=target/release/agent-desktop
+HELPER_SOURCE=target/release/agent-desktop-macos-helper
+SOURCE_SHA=$(shasum -a 256 "$SOURCE" | awk '{print $1}')
+HELPER_SOURCE_SHA=$(shasum -a 256 "$HELPER_SOURCE" | awk '{print $1}')
+cp "$SOURCE" "npm/bin/${NAME}"
+cp "$HELPER_SOURCE" "npm/bin/${HELPER_NAME}"
+chmod +x "npm/bin/${NAME}"
+chmod +x "npm/bin/${HELPER_NAME}"
+COPY_SHA=$(shasum -a 256 "npm/bin/${NAME}" | awk '{print $1}')
+HELPER_COPY_SHA=$(shasum -a 256 "npm/bin/${HELPER_NAME}" | awk '{print $1}')
+if [ "$SOURCE_SHA" != "$COPY_SHA" ] || [ "$HELPER_SOURCE_SHA" != "$HELPER_COPY_SHA" ]; then
+  echo "NPM smoke executable copy failed immutable identity verification" >&2
+  exit 1
+fi
+node npm/bin/agent-desktop.js version > /tmp/agent-desktop-version.json
+node -e "
+  const out = require('fs').readFileSync('/tmp/agent-desktop-version.json', 'utf8');
+  const json = JSON.parse(out);
+  if (json.ok !== true || !json.data || typeof json.data.version !== 'string') {
+    throw new Error('agent-desktop npm wrapper did not return version JSON');
+  }
+"
+if [ "$SOURCE_SHA" != "$(shasum -a 256 "$SOURCE" | awk '{print $1}')" ] || \
+   [ "$COPY_SHA" != "$(shasum -a 256 "npm/bin/${NAME}" | awk '{print $1}')" ] || \
+   [ "$HELPER_SOURCE_SHA" != "$(shasum -a 256 "$HELPER_SOURCE" | awk '{print $1}')" ] || \
+   [ "$HELPER_COPY_SHA" != "$(shasum -a 256 "npm/bin/${HELPER_NAME}" | awk '{print $1}')" ]; then
+  echo "NPM smoke executable changed while it was executed" >&2
+  exit 1
+fi