@hassangameryt/freeflow 0.1.0 → 0.3.0

package/evals/scripts/run-quickjs-wasi-proof-spike.js

@@ -0,0 +1,339 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readFile, mkdir, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { SCRIPT_SANDBOX_REQUIRED_PROOFS, scriptSandboxProofFixturesForLanguage } from "../../router/dist/index.js";
+
+const DEFAULT_REPORT_PATH = "evals/reports/runtime/quickjs-wasi-proof-spike-1-report.md";
+const DEFAULT_TIMEOUT_MS = 250;
+const DEFAULT_MEMORY_BYTES = 8 * 1024 * 1024;
+const DEFAULT_OUTPUT_BYTES = 4096;
+const SECRET_SENTINEL = "FREEFLOW_SANDBOX_SECRET_SENTINEL_VALUE";
+
+async function main() {
+  process.env.FREEFLOW_SANDBOX_SECRET_SENTINEL = SECRET_SENTINEL;
+  const args = parseArgs(process.argv.slice(2));
+  const root = args.quickjsWasiRoot ?? process.env.QUICKJS_WASI_ROOT;
+  if (!root) {
+    throw new Error("Missing --quickjs-wasi-root or QUICKJS_WASI_ROOT. Install quickjs-wasi in a temp directory and pass its package root.");
+  }
+
+  const reportPath = args.report ?? DEFAULT_REPORT_PATH;
+  const timeoutMs = args.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const memoryBytes = args.memoryBytes ?? DEFAULT_MEMORY_BYTES;
+  const outputBytes = args.outputBytes ?? DEFAULT_OUTPUT_BYTES;
+  const packageRoot = resolve(root);
+  const packageJson = JSON.parse(await readFile(join(packageRoot, "package.json"), "utf8"));
+  const wasmPath = join(packageRoot, "quickjs.wasm");
+  const wasm = await readFile(wasmPath);
+  const wasmSha256 = createHash("sha256").update(wasm).digest("hex");
+  const { QuickJS } = await import(pathToFileURL(join(packageRoot, "dist/index.js")).href);
+
+  const positive = await runQuickJsProgram(QuickJS, wasm, {
+    code: "writeText(readText('test_log'))",
+    timeoutMs,
+    memoryBytes,
+    outputBytes,
+  });
+  const fixtures = scriptSandboxProofFixturesForLanguage("javascript");
+  const results = [];
+  for (const fixture of fixtures) {
+    const run = await runQuickJsProgram(QuickJS, wasm, {
+      code: fixture.program,
+      timeoutMs,
+      memoryBytes,
+      outputBytes,
+    });
+    results.push({ fixture, run, pass: assessProof(fixture.proof, run, { timeoutMs, outputBytes }) });
+  }
+
+  const failed = results.filter((result) => !result.pass.ok);
+  const report = renderReport({
+    packageJson,
+    packageRoot,
+    wasmPath,
+    wasmBytes: wasm.byteLength,
+    wasmSha256,
+    timeoutMs,
+    memoryBytes,
+    outputBytes,
+    positive,
+    results,
+    failed,
+  });
+  await mkdir(dirname(reportPath), { recursive: true });
+  await writeFile(reportPath, report, "utf8");
+  console.log(`Wrote ${reportPath}`);
+  console.log(`quickjs-wasi proof fixtures: ${results.length - failed.length}/${results.length} passed`);
+  if (failed.length > 0) {
+    for (const result of failed) {
+      console.log(`FAIL ${result.fixture.proof}: ${result.pass.reason}`);
+    }
+    process.exitCode = 1;
+  }
+}
+
+async function runQuickJsProgram(QuickJS, wasm, options) {
+  const start = Date.now();
+  let output = "";
+  let stdout = "";
+  let stderr = "";
+  let truncated = false;
+  const appendOutput = (stream, value) => {
+    const text = String(value ?? "");
+    const currentBytes = Buffer.byteLength(output, "utf8");
+    const remaining = options.outputBytes - currentBytes;
+    if (remaining <= 0) {
+      truncated = true;
+      return;
+    }
+    const textBytes = Buffer.from(text, "utf8");
+    const nextText = textBytes.byteLength > remaining ? textBytes.subarray(0, remaining).toString("utf8") : text;
+    if (textBytes.byteLength > remaining) {
+      truncated = true;
+    }
+    output += nextText;
+    if (stream === "stderr") {
+      stderr += nextText;
+    } else {
+      stdout += nextText;
+    }
+  };
+
+  let vm;
+  try {
+    vm = await QuickJS.create({
+      wasm,
+      memoryLimit: options.memoryBytes,
+      interruptHandler: () => Date.now() - start > options.timeoutMs,
+    });
+
+    const writeText = vm.newFunction("writeText", (...args) => {
+      appendOutput("stdout", formatHostArgs(vm, args));
+      return vm.undefined;
+    });
+    vm.setProp(vm.global, "writeText", writeText);
+    disposeHandle(writeText);
+
+    const consoleObject = vm.newObject();
+    const consoleLog = vm.newFunction("console.log", (...args) => {
+      appendOutput("stdout", `${formatHostArgs(vm, args)}\n`);
+      return vm.undefined;
+    });
+    const consoleError = vm.newFunction("console.error", (...args) => {
+      appendOutput("stderr", `${formatHostArgs(vm, args)}\n`);
+      return vm.undefined;
+    });
+    vm.setProp(consoleObject, "log", consoleLog);
+    vm.setProp(consoleObject, "error", consoleError);
+    vm.setProp(vm.global, "console", consoleObject);
+    disposeHandle(consoleLog);
+    disposeHandle(consoleError);
+    disposeHandle(consoleObject);
+
+    const readText = vm.newFunction("readText", (...args) => {
+      const alias = args[0]?.toString() ?? "";
+      const text = alias === "test_log" ? "INFO setup\nERROR target\n" : "";
+      return vm.newString(text);
+    });
+    vm.setProp(vm.global, "readText", readText);
+    disposeHandle(readText);
+
+    const result = vm.evalCode(options.code);
+    try {
+      const dumped = vm.dump(result);
+      if (dumped !== undefined) {
+        appendOutput("stdout", typeof dumped === "string" ? dumped : JSON.stringify(dumped));
+      }
+    } finally {
+      disposeHandle(result);
+    }
+
+    return {
+      status: "success",
+      output,
+      stdout,
+      stderr,
+      outputBytes: Buffer.byteLength(output, "utf8"),
+      stdoutBytes: Buffer.byteLength(stdout, "utf8"),
+      stderrBytes: Buffer.byteLength(stderr, "utf8"),
+      truncated,
+      durationMs: Date.now() - start,
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const name = error instanceof Error ? error.name : "Error";
+    disposeHandle(error);
+    return {
+      status: message.includes("interrupted") ? "timed_out" : "error",
+      output,
+      stdout,
+      stderr,
+      outputBytes: Buffer.byteLength(output, "utf8"),
+      stdoutBytes: Buffer.byteLength(stdout, "utf8"),
+      stderrBytes: Buffer.byteLength(stderr, "utf8"),
+      truncated,
+      errorName: name,
+      errorMessage: message,
+      durationMs: Date.now() - start,
+    };
+  } finally {
+    if (vm && typeof vm.dispose === "function") {
+      vm.dispose();
+    }
+  }
+}
+
+function assessProof(proof, run, limits) {
+  const combined = `${run.output}\n${run.errorMessage ?? ""}`;
+  switch (proof) {
+    case "env_access_denied":
+      return passIf(!combined.includes(SECRET_SENTINEL) && !combined.includes("process.env"), "ambient environment was not exposed");
+    case "home_access_denied":
+      return passIf(!combined.includes(process.env.HOME ?? "__no_home__") && !combined.match(/PRIVATE KEY|\.ssh/), "home/secret paths were not exposed");
+    case "repo_access_denied":
+      return passIf(!combined.includes("@hassangameryt/freeflow") && !combined.includes("package.json"), "repo files were not exposed");
+    case "vault_access_denied":
+      return passIf(!combined.includes("ffout_") && !combined.includes("ffrec_"), "vault records were not exposed");
+    case "network_access_denied":
+      return passIf(combined.includes("fetch unavailable") || combined.includes("fetch is not defined"), "network/fetch capability was absent");
+    case "input_read_only":
+      return passIf(!combined.includes("mutated") || combined.includes("fs unavailable"), "input mutation was not possible through host filesystem APIs");
+    case "output_escape_denied":
+      return passIf(!combined.includes("escape attempted") || combined.includes("fs unavailable"), "output symlink/file escape was not possible through host filesystem APIs");
+    case "stdout_stderr_bounded":
+      return passIf(
+        run.status !== "error" && run.truncated && run.outputBytes <= limits.outputBytes && run.stdoutBytes > 0 && run.stderrBytes > 0,
+        "stdout and stderr flood capture was truncated within the cap",
+      );
+    case "timeout_enforced":
+      return passIf(run.status === "timed_out" && run.durationMs < limits.timeoutMs * 5, "infinite loop was interrupted by runtime timeout");
+    default:
+      return { ok: false, reason: `No assessment rule for proof ${proof}` };
+  }
+}
+
+function passIf(condition, reason) {
+  return condition ? { ok: true, reason } : { ok: false, reason: `Failed: ${reason}` };
+}
+
+function formatHostArgs(vm, args) {
+  return args.map((arg) => {
+    try {
+      const dumped = vm.dump(arg);
+      if (typeof dumped === "string") return dumped;
+      if (dumped === undefined) return "undefined";
+      return JSON.stringify(dumped);
+    } catch {
+      return arg?.toString() ?? "";
+    }
+  }).join(" ");
+}
+
+function renderReport(data) {
+  const lines = [];
+  lines.push("# QuickJS WASI Sandbox Proof Spike Report");
+  lines.push("");
+  lines.push(`> **Date:** ${new Date().toISOString().slice(0, 10)}`);
+  lines.push("> **Status:** " + (data.failed.length === 0 ? "Passed proof spike for JavaScript candidate" : "Failed proof spike for JavaScript candidate"));
+  lines.push("> **Scope:** Proof-only evaluation. No Freeflow script execution path is enabled.");
+  lines.push("");
+  lines.push("## Candidate");
+  lines.push("");
+  lines.push(`- Package: \`${data.packageJson.name}@${data.packageJson.version}\``);
+  lines.push(`- License: ${data.packageJson.license ?? "unknown"}`);
+  lines.push(`- Package root: \`${data.packageRoot}\``);
+  lines.push(`- WASM bytes: ${data.wasmBytes}`);
+  lines.push(`- WASM SHA-256: \`${data.wasmSha256}\``);
+  lines.push(`- Timeout: ${data.timeoutMs}ms`);
+  lines.push(`- Memory limit: ${data.memoryBytes} bytes`);
+  lines.push(`- Output cap: ${data.outputBytes} bytes`);
+  lines.push("");
+  lines.push("## Positive API Probe");
+  lines.push("");
+  lines.push(`- Status: ${data.positive.status}`);
+  lines.push(`- Output: \`${escapeInline(data.positive.output)}\``);
+  lines.push(`- Error: ${data.positive.errorMessage ? `\`${escapeInline(data.positive.errorMessage)}\`` : "none"}`);
+  lines.push("");
+  lines.push("## Required Proof Results");
+  lines.push("");
+  lines.push("| Proof | Result | Evidence |");
+  lines.push("| --- | --- | --- |");
+  for (const result of data.results) {
+    const evidence = [
+      result.pass.reason,
+      `status=${result.run.status}`,
+      `durationMs=${result.run.durationMs}`,
+      `outputBytes=${result.run.outputBytes}`,
+      `stdoutBytes=${result.run.stdoutBytes}`,
+      `stderrBytes=${result.run.stderrBytes}`,
+      `truncated=${result.run.truncated}`,
+      result.run.errorMessage ? `error=${result.run.errorMessage}` : undefined,
+    ].filter(Boolean).join("; ");
+    lines.push(`| ${result.fixture.proof} | ${result.pass.ok ? "pass" : "fail"} | ${escapeTable(evidence)} |`);
+  }
+  lines.push("");
+  lines.push("## Notes");
+  lines.push("");
+  lines.push("- This proof runner uses a temporary installed `quickjs-wasi` package root passed explicitly by the caller.");
+  lines.push("- It does not add repo dependencies and does not wire the adapter into `freeflow_search action=transform` execution.");
+  lines.push("- Passing this spike only supports JavaScript adapter feasibility; Python and jq remain unavailable until their own proof slices pass.");
+  lines.push("- Before product execution, this must still go through implementation/security review and source-plan update.");
+  lines.push("");
+  lines.push("## Required Proof Set");
+  lines.push("");
+  for (const proof of SCRIPT_SANDBOX_REQUIRED_PROOFS) {
+    lines.push(`- ${proof}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+function escapeInline(value) {
+  return String(value).replaceAll("`", "\\`").replaceAll("\n", "\\n");
+}
+
+function escapeTable(value) {
+  return escapeInline(value).replaceAll("|", "\\|");
+}
+
+function disposeHandle(value) {
+  if (value && typeof value.dispose === "function") {
+    value.dispose();
+  } else if (value && typeof value[Symbol.dispose] === "function") {
+    value[Symbol.dispose]();
+  }
+}
+
+function parseArgs(argv) {
+  const args = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    const next = argv[index + 1];
+    if (arg === "--quickjs-wasi-root") {
+      args.quickjsWasiRoot = next;
+      index += 1;
+    } else if (arg === "--report") {
+      args.report = next;
+      index += 1;
+    } else if (arg === "--timeout-ms") {
+      args.timeoutMs = Number(next);
+      index += 1;
+    } else if (arg === "--memory-bytes") {
+      args.memoryBytes = Number(next);
+      index += 1;
+    } else if (arg === "--output-bytes") {
+      args.outputBytes = Number(next);
+      index += 1;
+    } else {
+      throw new Error(`Unknown argument ${arg}`);
+    }
+  }
+  return args;
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.stack : error);
+  process.exit(1);
+});

package/evals/scripts/skill-evidence.sh

@@ -0,0 +1,316 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'EOF'
+Usage:
+  skill-evidence.sh <skill> [--format summary|json|commands] [--audience public|internal]
+  skill-evidence.sh --validate
+
+Examples:
+  evals/scripts/skill-evidence.sh verify-work
+  evals/scripts/skill-evidence.sh write-plan --format commands
+  evals/scripts/skill-evidence.sh review-work --format json
+EOF
+}
+
+fail() {
+  printf 'FAIL: %s\n' "$1" >&2
+  exit 1
+}
+
+script_path="${BASH_SOURCE[0]}"
+script_dir="$(cd "$(dirname "$script_path")" && pwd)"
+repo_root="$(git -C "$script_dir" rev-parse --show-toplevel)"
+plugin_root="$repo_root"
+metadata="$plugin_root/evals/registries/skill-evidence.json"
+command_surface="$plugin_root/command-surface.json"
+reports_dir="$plugin_root/evals/reports/by-skill"
+
+format="summary"
+audience="public"
+validate_all=0
+skill=""
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --format)
+      format="${2:-}"
+      shift 2
+      ;;
+    --audience)
+      audience="${2:-}"
+      shift 2
+      ;;
+    --validate)
+      validate_all=1
+      shift
+      ;;
+    --help|-h)
+      usage
+      exit 0
+      ;;
+    -*)
+      usage
+      fail "Unsupported option: $1"
+      ;;
+    *)
+      if [ -z "$skill" ]; then
+        skill="$1"
+      else
+        usage
+        fail "Unexpected argument: $1"
+      fi
+      shift
+      ;;
+  esac
+done
+
+case "$format" in
+  summary|json|commands) ;;
+  *) fail "Unsupported format: $format. Expected summary, json, or commands." ;;
+esac
+
+case "$audience" in
+  public|internal) ;;
+  *) fail "Unsupported audience: $audience. Expected public or internal." ;;
+esac
+
+jq empty "$metadata"
+jq empty "$command_surface"
+
+skill_exists() {
+  local name="$1"
+  [ -f "$plugin_root/skills/$name/SKILL.md" ]
+}
+
+skill_in_metadata() {
+  local name="$1"
+  jq -e --arg skill "$name" '.skills[$skill] != null' "$metadata" >/dev/null
+}
+
+find_registry_for_eval() {
+  local eval_id="$1"
+  local registry_rel
+  local found=""
+  local count=0
+
+  while IFS= read -r registry_rel; do
+    local registry_path="$plugin_root/$registry_rel"
+    local matches
+    matches="$(jq -r --arg id "$eval_id" '[.evals[] | select(.id == $id)] | length' "$registry_path")"
+    if [ "$matches" != "0" ]; then
+      count=$((count + matches))
+      found="$registry_rel"
+    fi
+  done < <(jq -r '.registries[]' "$metadata")
+
+  if [ "$count" != "1" ]; then
+    printf 'ERROR:%s' "$count"
+  else
+    printf '%s' "$found"
+  fi
+}
+
+eval_acceptance_suites_json() {
+  local eval_id="$1"
+  jq -c --arg id "$eval_id" '[.suites[] | select(.evals | index($id)) | {id, path}]' "$metadata"
+}
+
+command_routes_json() {
+  local name="$1"
+  jq -c --arg skill "$name" '
+    [
+      (.directSkillCalls[]? | select(.skill == $skill) | {kind:"direct", command, skill}),
+      (.developerSkillCalls[]? | select(.skill == $skill) | {kind:"developer", command, skill}),
+      (.modeCommands[]? | select(.routesTo == $skill) | {kind:"mode", command, skill:.routesTo})
+    ]
+  ' "$command_surface"
+}
+
+reports_json() {
+  local name="$1"
+  find "$reports_dir" -maxdepth 1 -type f -name "${name}-[0-9]*-report.md" -print \
+    | sed "s#^$plugin_root/##" \
+    | sort \
+    | jq -R -s 'split("\n")[:-1]'
+}
+
+build_bundle() {
+  local name="$1"
+  local tmp_evals
+  tmp_evals="$(mktemp "${TMPDIR:-/tmp}/freeflow-skill-evals.XXXXXX")"
+
+  local eval_id
+  while IFS= read -r eval_id; do
+    [ -n "$eval_id" ] || continue
+
+    local registry_rel
+    registry_rel="$(find_registry_for_eval "$eval_id")"
+    if [[ "$registry_rel" == ERROR:* ]]; then
+      jq -cn --arg id "$eval_id" --arg error "eval must resolve exactly once; got ${registry_rel#ERROR:}" \
+        '{id:$id, error:$error}' >> "$tmp_evals"
+      continue
+    fi
+
+    local registry_path="$plugin_root/$registry_rel"
+    local eval_json
+    eval_json="$(jq -cer --arg id "$eval_id" '.evals[] | select(.id == $id)' "$registry_path")"
+
+    local fixture_root
+    fixture_root="$(jq -r '.fixture_root // empty' <<<"$eval_json")"
+    if [ -z "$fixture_root" ]; then
+      fixture_root="$(jq -r '.fixture_root // empty' "$registry_path")"
+    fi
+
+    local prompt_ref prompt_kind
+    prompt_ref="$(jq -r '.prompt_file // empty' <<<"$eval_json")"
+    if [ -n "$prompt_ref" ]; then
+      prompt_kind="file"
+    else
+      prompt_ref="<inline>"
+      prompt_kind="inline"
+    fi
+
+    local fixture_exists="false"
+    if [ -n "$fixture_root" ] && [ -d "$plugin_root/$fixture_root" ]; then
+      fixture_exists="true"
+    fi
+
+    local prompt_exists="true"
+    if [ "$prompt_kind" = "file" ] && [ ! -f "$plugin_root/$prompt_ref" ]; then
+      prompt_exists="false"
+    fi
+
+    local suites
+    suites="$(eval_acceptance_suites_json "$eval_id")"
+
+    jq -cn \
+      --arg id "$eval_id" \
+      --arg registry "$registry_rel" \
+      --arg fixture "$fixture_root" \
+      --arg prompt "$prompt_ref" \
+      --arg promptKind "$prompt_kind" \
+      --argjson fixtureExists "$fixture_exists" \
+      --argjson promptExists "$prompt_exists" \
+      --argjson suites "$suites" \
+      '{id:$id, registry:$registry, fixture_root:$fixture, fixture_exists:$fixtureExists, prompt:$prompt, prompt_kind:$promptKind, prompt_exists:$promptExists, suites:$suites}' >> "$tmp_evals"
+  done < <(jq -r --arg skill "$name" '.skills[$skill].evals[]?' "$metadata")
+
+  local evals_json routes_json reports
+  evals_json="$(jq -s '.' "$tmp_evals")"
+  routes_json="$(command_routes_json "$name")"
+  reports="$(reports_json "$name")"
+
+  local bundle_json
+  bundle_json="$(jq -n \
+    --arg skill "$name" \
+    --arg skillFile "skills/$name/SKILL.md" \
+    --arg audience "$audience" \
+    --arg runPolicy "generated runs are internal; this output does not include evals/runs bodies" \
+    --argjson evals "$evals_json" \
+    --argjson commands "$routes_json" \
+    --argjson reports "$reports" \
+    '{
+      subject: {kind:"skill", name:$skill},
+      skill_file:$skillFile,
+      audience:$audience,
+      command_routes:$commands,
+      evals:$evals,
+      reports:$reports,
+      run_policy:$runPolicy,
+      gaps: (
+        [
+          (if ($commands | length) == 0 then "no command-surface route" else empty end),
+          (if ($evals | length) == 0 then "no grouped evals" else empty end),
+          (if ($reports | length) == 0 then "no by-skill reports" else empty end)
+        ]
+        + [ $evals[]? | select(.error != null) | "eval " + .id + ": " + .error ]
+        + [ $evals[]? | select(.fixture_exists == false) | "eval " + .id + ": missing fixture " + .fixture_root ]
+        + [ $evals[]? | select(.prompt_exists == false) | "eval " + .id + ": missing prompt " + .prompt ]
+      )
+    }')"
+
+  rm -f "$tmp_evals"
+  printf '%s\n' "$bundle_json"
+}
+
+validate_skill() {
+  local name="$1"
+  local status=0
+
+  if ! skill_exists "$name"; then
+    printf 'FAIL %s: missing skills/%s/SKILL.md\n' "$name" "$name" >&2
+    return 1
+  fi
+
+  if ! skill_in_metadata "$name"; then
+    printf 'FAIL %s: missing skill-evidence metadata\n' "$name" >&2
+    return 1
+  fi
+
+  local bundle
+  bundle="$(build_bundle "$name")"
+
+  if jq -e '.gaps[]? | select(test("^eval .*:"))' <<<"$bundle" >/dev/null; then
+    jq -r --arg name "$name" '.gaps[]? | select(test("^eval .*:")) | "FAIL " + $name + ": " + .' <<<"$bundle" >&2
+    status=1
+  fi
+
+  if jq -e '.gaps[]? | select(. == "no grouped evals")' <<<"$bundle" >/dev/null; then
+    printf 'FAIL %s: no grouped evals\n' "$name" >&2
+    status=1
+  fi
+
+  return "$status"
+}
+
+if [ "$validate_all" = "1" ]; then
+  status=0
+
+  while IFS= read -r item; do
+    if ! skill_in_metadata "$item"; then
+      printf 'FAIL %s: command-surface route has no skill-evidence metadata\n' "$item" >&2
+      status=1
+    fi
+  done < <(jq -r '[.directSkillCalls[]?.skill, .developerSkillCalls[]?.skill, .modeCommands[]?.routesTo] | unique[]' "$command_surface")
+
+  while IFS= read -r item; do
+    validate_skill "$item" || status=1
+  done < <(jq -r '.skills | keys[]' "$metadata")
+  exit "$status"
+fi
+
+[ -n "$skill" ] || { usage; exit 2; }
+skill_exists "$skill" || fail "Skill not found: skills/$skill/SKILL.md"
+skill_in_metadata "$skill" || fail "No skill-evidence metadata for skill: $skill"
+
+bundle="$(build_bundle "$skill")"
+
+case "$format" in
+  json)
+    jq '.' <<<"$bundle"
+    ;;
+  commands)
+    jq -r --arg runner "evals/scripts/run-fixture-eval.sh" --arg skill_file "skills/$skill/SKILL.md" '
+      .evals[]
+      | select(.error == null)
+      | $runner + " " + .id + " --with-skill --registry " + .registry + " --skill " + $skill_file
+    ' <<<"$bundle"
+    ;;
+  summary)
+    jq -r '
+      "Skill: " + .subject.name,
+      "Skill file: " + .skill_file,
+      "Commands:",
+      (if (.command_routes | length) == 0 then "  - none" else (.command_routes[] | "  - " + .command + " -> " + .skill + " (" + .kind + ")") end),
+      "Evals:",
+      (if (.evals | length) == 0 then "  - none" else (.evals[] | "  - " + .id + " [" + .registry + "]" + (if (.suites | length) > 0 then " suites: " + ((.suites | map(.id)) | join(",")) else "" end)) end),
+      "Reports:",
+      (if (.reports | length) == 0 then "  - none" else (.reports[] | "  - " + .) end),
+      "Gaps:",
+      (if (.gaps | length) == 0 then "  - none" else (.gaps[] | "  - " + .) end),
+      "Run policy: " + .run_policy
+    ' <<<"$bundle"
+    ;;
+esac