diff --git a/tests/clean.bats b/tests/clean.bats
index 6e4646b..e41ca19 100644
--- a/tests/clean.bats
+++ b/tests/clean.bats
@@ -55,6 +55,39 @@ EOF
 
     run env HOME="$HOME" "$PROJECT_ROOT/mole" clean --dry-run
     [ "$status" -eq 0 ]
-    [[ "$output" == *"Protected: 1"* ]]
+    [[ "$output" == *"Protected"* ]]
     [ -f "$HOME/Library/Caches/WhitelistedApp/data.tmp" ]
 }
+
+@test "mo clean protects Maven repository by default" {
+    mkdir -p "$HOME/.m2/repository/org/example"
+    echo "dependency" > "$HOME/.m2/repository/org/example/lib.jar"
+
+    run env HOME="$HOME" "$PROJECT_ROOT/mole" clean --dry-run
+    [ "$status" -eq 0 ]
+    [ -f "$HOME/.m2/repository/org/example/lib.jar" ]
+    [[ "$output" != *"Maven repository cache"* ]]
+}
+
+@test "mo clean respects MO_BREW_TIMEOUT environment variable" {
+    if ! command -v brew > /dev/null 2>&1; then
+        skip "Homebrew not installed"
+    fi
+
+    run env HOME="$HOME" MO_BREW_TIMEOUT=5 "$PROJECT_ROOT/bin/clean.sh" --dry-run
+    [ "$status" -eq 0 ]
+}
+
+@test "FINDER_METADATA_SENTINEL in whitelist protects .DS_Store files" {
+    mkdir -p "$HOME/Documents"
+    touch "$HOME/Documents/.DS_Store"
+
+    cat > "$HOME/.config/mole/whitelist" << EOF
+FINDER_METADATA_SENTINEL
+EOF
+
+    run env HOME="$HOME" "$PROJECT_ROOT/mole" clean --dry-run
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"protected by whitelist"* ]]
+    [ -f "$HOME/Documents/.DS_Store" ]
+}
diff --git a/tests/cli.bats b/tests/cli.bats
index ac0d910..6a08a8d 100644
--- a/tests/cli.bats
+++ b/tests/cli.bats
@@ -50,3 +50,18 @@ setup() {
     [ "$status" -eq 0 ]
     [[ "$output" == *"Touch ID"* ]]
 }
+
+@test "mo optimize shows available optimization categories" {
+    run env HOME="$HOME" "$PROJECT_ROOT/mole" optimize
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"System"* ]] || [[ "$output" == *"optimization"* ]]
+}
+
+@test "mo analyze validates binary exists" {
+    if [[ -f "$PROJECT_ROOT/bin/analyze-go" ]]; then
+        run env HOME="$HOME" "$PROJECT_ROOT/mole" analyze --help
+        [ "$status" -eq 0 ]
+    else
+        skip "analyze-go binary not built"
+    fi
+}
diff --git a/tests/common.bats b/tests/common.bats
index ea607ef..e9d059a 100644
--- a/tests/common.bats
+++ b/tests/common.bats
@@ -171,3 +171,37 @@ EOF
     [[ "$joined" == *" third "* ]]
     rm -f "$output_file" "$output_file.sorted"
 }
+
+@test "should_protect_data protects system and critical apps" {
+    # System apps should be protected
+    result=$(HOME="$HOME" bash --noprofile --norc -c "source '$PROJECT_ROOT/lib/common.sh'; should_protect_data 'com.apple.Safari' && echo 'protected' || echo 'not-protected'")
+    [ "$result" = "protected" ]
+
+    # Critical network apps should be protected
+    result=$(HOME="$HOME" bash --noprofile --norc -c "source '$PROJECT_ROOT/lib/common.sh'; should_protect_data 'com.clash.app' && echo 'protected' || echo 'not-protected'")
+    [ "$result" = "protected" ]
+
+    # Regular apps should not be protected
+    result=$(HOME="$HOME" bash --noprofile --norc -c "source '$PROJECT_ROOT/lib/common.sh'; should_protect_data 'com.example.RegularApp' && echo 'protected' || echo 'not-protected'")
+    [ "$result" = "not-protected" ]
+}
+
+@test "print_summary_block formats output correctly" {
+    result=$(HOME="$HOME" bash --noprofile --norc -c "source '$PROJECT_ROOT/lib/common.sh'; print_summary_block 'success' 'Test Summary' 'Detail 1' 'Detail 2'")
+    [[ "$result" == *"Test Summary"* ]]
+    [[ "$result" == *"Detail 1"* ]]
+    [[ "$result" == *"Detail 2"* ]]
+}
+
+@test "start_inline_spinner and stop_inline_spinner work in non-TTY" {
+    # Should not hang in non-interactive mode
+    result=$(HOME="$HOME" bash --noprofile --norc << 'EOF'
+source "$PROJECT_ROOT/lib/common.sh"
+MOLE_SPINNER_PREFIX="  " start_inline_spinner "Testing..."
+sleep 0.1
+stop_inline_spinner
+echo "done"
+EOF
+)
+    [[ "$result" == *"done"* ]]
+}
diff --git a/tests/scripts.bats b/tests/scripts.bats
new file mode 100644
index 0000000..395127a
--- /dev/null
+++ b/tests/scripts.bats
@@ -0,0 +1,105 @@
+#!/usr/bin/env bats
+
+setup_file() {
+    PROJECT_ROOT="$(cd "${BATS_TEST_DIRNAME}/.." && pwd)"
+    export PROJECT_ROOT
+
+    ORIGINAL_HOME="${HOME:-}"
+    export ORIGINAL_HOME
+
+    HOME="$(mktemp -d "${BATS_TEST_DIRNAME}/tmp-scripts-home.XXXXXX")"
+    export HOME
+
+    mkdir -p "$HOME"
+}
+
+teardown_file() {
+    rm -rf "$HOME"
+    if [[ -n "${ORIGINAL_HOME:-}" ]]; then
+        export HOME="$ORIGINAL_HOME"
+    fi
+}
+
+setup() {
+    export TERM="dumb"
+    rm -rf "${HOME:?}"/*
+    mkdir -p "$HOME"
+}
+
+@test "format.sh --check validates script formatting" {
+    if ! command -v shfmt > /dev/null 2>&1; then
+        skip "shfmt not installed"
+    fi
+
+    run "$PROJECT_ROOT/scripts/format.sh" --check
+    # May pass or fail depending on formatting, but should not error
+    [[ "$status" -eq 0 || "$status" -eq 1 ]]
+}
+
+@test "format.sh --help shows usage information" {
+    run "$PROJECT_ROOT/scripts/format.sh" --help
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Usage"* ]]
+}
+
+@test "check.sh runs all quality checks" {
+    run "$PROJECT_ROOT/scripts/check.sh"
+    # May pass or fail, but should complete
+    [[ "$status" -eq 0 || "$status" -eq 1 ]]
+    [[ "$output" == *"Quality Checks"* ]]
+}
+
+@test "build-analyze.sh detects missing Go toolchain" {
+    if command -v go > /dev/null 2>&1; then
+        skip "Go is installed, cannot test missing toolchain"
+    fi
+
+    run "$PROJECT_ROOT/scripts/build-analyze.sh"
+    [ "$status" -ne 0 ]
+    [[ "$output" == *"Go not installed"* ]]
+}
+
+@test "build-analyze.sh shows version and build time" {
+    if ! command -v go > /dev/null 2>&1; then
+        skip "Go not installed"
+    fi
+
+    run "$PROJECT_ROOT/scripts/build-analyze.sh"
+    [[ "$output" == *"Version:"* ]]
+    [[ "$output" == *"Build time:"* ]]
+}
+
+@test "setup-quick-launchers.sh detects mole binary" {
+    # Create a fake mole binary
+    mkdir -p "$HOME/.local/bin"
+    cat > "$HOME/.local/bin/mole" << 'EOF'
+#!/bin/bash
+echo "fake mole"
+EOF
+    chmod +x "$HOME/.local/bin/mole"
+
+    run env HOME="$HOME" PATH="$HOME/.local/bin:$PATH" "$PROJECT_ROOT/scripts/setup-quick-launchers.sh"
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Detected Mole binary"* ]]
+}
+
+@test "setup-quick-launchers.sh creates Raycast scripts" {
+    if [[ ! -d "$HOME/Library/Application Support/Raycast" ]]; then
+        mkdir -p "$HOME/Library/Application Support/Raycast/script-commands"
+    fi
+
+    # Create a fake mole binary
+    mkdir -p "$HOME/.local/bin"
+    cat > "$HOME/.local/bin/mole" << 'EOF'
+#!/bin/bash
+echo "fake mole"
+EOF
+    chmod +x "$HOME/.local/bin/mole"
+
+    run env HOME="$HOME" PATH="$HOME/.local/bin:$PATH" "$PROJECT_ROOT/scripts/setup-quick-launchers.sh"
+    [ "$status" -eq 0 ]
+
+    # Check if scripts were created
+    [[ -f "$HOME/Library/Application Support/Raycast/script-commands/mole-clean.sh" ]] || \
+    [[ -f "$HOME/Documents/Raycast/Scripts/mole-clean.sh" ]]
+}