@hassangameryt/freeflow 0.3.0 → 0.5.0

package/evals/scripts/run-quickjs-wasi-proof-spike.js

@@ -1,339 +0,0 @@
-#!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { readFile, mkdir, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-
-import { SCRIPT_SANDBOX_REQUIRED_PROOFS, scriptSandboxProofFixturesForLanguage } from "../../router/dist/index.js";
-
-const DEFAULT_REPORT_PATH = "evals/reports/runtime/quickjs-wasi-proof-spike-1-report.md";
-const DEFAULT_TIMEOUT_MS = 250;
-const DEFAULT_MEMORY_BYTES = 8 * 1024 * 1024;
-const DEFAULT_OUTPUT_BYTES = 4096;
-const SECRET_SENTINEL = "FREEFLOW_SANDBOX_SECRET_SENTINEL_VALUE";
-
-async function main() {
-  process.env.FREEFLOW_SANDBOX_SECRET_SENTINEL = SECRET_SENTINEL;
-  const args = parseArgs(process.argv.slice(2));
-  const root = args.quickjsWasiRoot ?? process.env.QUICKJS_WASI_ROOT;
-  if (!root) {
-    throw new Error("Missing --quickjs-wasi-root or QUICKJS_WASI_ROOT. Install quickjs-wasi in a temp directory and pass its package root.");
-  }
-
-  const reportPath = args.report ?? DEFAULT_REPORT_PATH;
-  const timeoutMs = args.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const memoryBytes = args.memoryBytes ?? DEFAULT_MEMORY_BYTES;
-  const outputBytes = args.outputBytes ?? DEFAULT_OUTPUT_BYTES;
-  const packageRoot = resolve(root);
-  const packageJson = JSON.parse(await readFile(join(packageRoot, "package.json"), "utf8"));
-  const wasmPath = join(packageRoot, "quickjs.wasm");
-  const wasm = await readFile(wasmPath);
-  const wasmSha256 = createHash("sha256").update(wasm).digest("hex");
-  const { QuickJS } = await import(pathToFileURL(join(packageRoot, "dist/index.js")).href);
-
-  const positive = await runQuickJsProgram(QuickJS, wasm, {
-    code: "writeText(readText('test_log'))",
-    timeoutMs,
-    memoryBytes,
-    outputBytes,
-  });
-  const fixtures = scriptSandboxProofFixturesForLanguage("javascript");
-  const results = [];
-  for (const fixture of fixtures) {
-    const run = await runQuickJsProgram(QuickJS, wasm, {
-      code: fixture.program,
-      timeoutMs,
-      memoryBytes,
-      outputBytes,
-    });
-    results.push({ fixture, run, pass: assessProof(fixture.proof, run, { timeoutMs, outputBytes }) });
-  }
-
-  const failed = results.filter((result) => !result.pass.ok);
-  const report = renderReport({
-    packageJson,
-    packageRoot,
-    wasmPath,
-    wasmBytes: wasm.byteLength,
-    wasmSha256,
-    timeoutMs,
-    memoryBytes,
-    outputBytes,
-    positive,
-    results,
-    failed,
-  });
-  await mkdir(dirname(reportPath), { recursive: true });
-  await writeFile(reportPath, report, "utf8");
-  console.log(`Wrote ${reportPath}`);
-  console.log(`quickjs-wasi proof fixtures: ${results.length - failed.length}/${results.length} passed`);
-  if (failed.length > 0) {
-    for (const result of failed) {
-      console.log(`FAIL ${result.fixture.proof}: ${result.pass.reason}`);
-    }
-    process.exitCode = 1;
-  }
-}
-
-async function runQuickJsProgram(QuickJS, wasm, options) {
-  const start = Date.now();
-  let output = "";
-  let stdout = "";
-  let stderr = "";
-  let truncated = false;
-  const appendOutput = (stream, value) => {
-    const text = String(value ?? "");
-    const currentBytes = Buffer.byteLength(output, "utf8");
-    const remaining = options.outputBytes - currentBytes;
-    if (remaining <= 0) {
-      truncated = true;
-      return;
-    }
-    const textBytes = Buffer.from(text, "utf8");
-    const nextText = textBytes.byteLength > remaining ? textBytes.subarray(0, remaining).toString("utf8") : text;
-    if (textBytes.byteLength > remaining) {
-      truncated = true;
-    }
-    output += nextText;
-    if (stream === "stderr") {
-      stderr += nextText;
-    } else {
-      stdout += nextText;
-    }
-  };
-
-  let vm;
-  try {
-    vm = await QuickJS.create({
-      wasm,
-      memoryLimit: options.memoryBytes,
-      interruptHandler: () => Date.now() - start > options.timeoutMs,
-    });
-
-    const writeText = vm.newFunction("writeText", (...args) => {
-      appendOutput("stdout", formatHostArgs(vm, args));
-      return vm.undefined;
-    });
-    vm.setProp(vm.global, "writeText", writeText);
-    disposeHandle(writeText);
-
-    const consoleObject = vm.newObject();
-    const consoleLog = vm.newFunction("console.log", (...args) => {
-      appendOutput("stdout", `${formatHostArgs(vm, args)}\n`);
-      return vm.undefined;
-    });
-    const consoleError = vm.newFunction("console.error", (...args) => {
-      appendOutput("stderr", `${formatHostArgs(vm, args)}\n`);
-      return vm.undefined;
-    });
-    vm.setProp(consoleObject, "log", consoleLog);
-    vm.setProp(consoleObject, "error", consoleError);
-    vm.setProp(vm.global, "console", consoleObject);
-    disposeHandle(consoleLog);
-    disposeHandle(consoleError);
-    disposeHandle(consoleObject);
-
-    const readText = vm.newFunction("readText", (...args) => {
-      const alias = args[0]?.toString() ?? "";
-      const text = alias === "test_log" ? "INFO setup\nERROR target\n" : "";
-      return vm.newString(text);
-    });
-    vm.setProp(vm.global, "readText", readText);
-    disposeHandle(readText);
-
-    const result = vm.evalCode(options.code);
-    try {
-      const dumped = vm.dump(result);
-      if (dumped !== undefined) {
-        appendOutput("stdout", typeof dumped === "string" ? dumped : JSON.stringify(dumped));
-      }
-    } finally {
-      disposeHandle(result);
-    }
-
-    return {
-      status: "success",
-      output,
-      stdout,
-      stderr,
-      outputBytes: Buffer.byteLength(output, "utf8"),
-      stdoutBytes: Buffer.byteLength(stdout, "utf8"),
-      stderrBytes: Buffer.byteLength(stderr, "utf8"),
-      truncated,
-      durationMs: Date.now() - start,
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const name = error instanceof Error ? error.name : "Error";
-    disposeHandle(error);
-    return {
-      status: message.includes("interrupted") ? "timed_out" : "error",
-      output,
-      stdout,
-      stderr,
-      outputBytes: Buffer.byteLength(output, "utf8"),
-      stdoutBytes: Buffer.byteLength(stdout, "utf8"),
-      stderrBytes: Buffer.byteLength(stderr, "utf8"),
-      truncated,
-      errorName: name,
-      errorMessage: message,
-      durationMs: Date.now() - start,
-    };
-  } finally {
-    if (vm && typeof vm.dispose === "function") {
-      vm.dispose();
-    }
-  }
-}
-
-function assessProof(proof, run, limits) {
-  const combined = `${run.output}\n${run.errorMessage ?? ""}`;
-  switch (proof) {
-    case "env_access_denied":
-      return passIf(!combined.includes(SECRET_SENTINEL) && !combined.includes("process.env"), "ambient environment was not exposed");
-    case "home_access_denied":
-      return passIf(!combined.includes(process.env.HOME ?? "__no_home__") && !combined.match(/PRIVATE KEY|\.ssh/), "home/secret paths were not exposed");
-    case "repo_access_denied":
-      return passIf(!combined.includes("@hassangameryt/freeflow") && !combined.includes("package.json"), "repo files were not exposed");
-    case "vault_access_denied":
-      return passIf(!combined.includes("ffout_") && !combined.includes("ffrec_"), "vault records were not exposed");
-    case "network_access_denied":
-      return passIf(combined.includes("fetch unavailable") || combined.includes("fetch is not defined"), "network/fetch capability was absent");
-    case "input_read_only":
-      return passIf(!combined.includes("mutated") || combined.includes("fs unavailable"), "input mutation was not possible through host filesystem APIs");
-    case "output_escape_denied":
-      return passIf(!combined.includes("escape attempted") || combined.includes("fs unavailable"), "output symlink/file escape was not possible through host filesystem APIs");
-    case "stdout_stderr_bounded":
-      return passIf(
-        run.status !== "error" && run.truncated && run.outputBytes <= limits.outputBytes && run.stdoutBytes > 0 && run.stderrBytes > 0,
-        "stdout and stderr flood capture was truncated within the cap",
-      );
-    case "timeout_enforced":
-      return passIf(run.status === "timed_out" && run.durationMs < limits.timeoutMs * 5, "infinite loop was interrupted by runtime timeout");
-    default:
-      return { ok: false, reason: `No assessment rule for proof ${proof}` };
-  }
-}
-
-function passIf(condition, reason) {
-  return condition ? { ok: true, reason } : { ok: false, reason: `Failed: ${reason}` };
-}
-
-function formatHostArgs(vm, args) {
-  return args.map((arg) => {
-    try {
-      const dumped = vm.dump(arg);
-      if (typeof dumped === "string") return dumped;
-      if (dumped === undefined) return "undefined";
-      return JSON.stringify(dumped);
-    } catch {
-      return arg?.toString() ?? "";
-    }
-  }).join(" ");
-}
-
-function renderReport(data) {
-  const lines = [];
-  lines.push("# QuickJS WASI Sandbox Proof Spike Report");
-  lines.push("");
-  lines.push(`> **Date:** ${new Date().toISOString().slice(0, 10)}`);
-  lines.push("> **Status:** " + (data.failed.length === 0 ? "Passed proof spike for JavaScript candidate" : "Failed proof spike for JavaScript candidate"));
-  lines.push("> **Scope:** Proof-only evaluation. No Freeflow script execution path is enabled.");
-  lines.push("");
-  lines.push("## Candidate");
-  lines.push("");
-  lines.push(`- Package: \`${data.packageJson.name}@${data.packageJson.version}\``);
-  lines.push(`- License: ${data.packageJson.license ?? "unknown"}`);
-  lines.push(`- Package root: \`${data.packageRoot}\``);
-  lines.push(`- WASM bytes: ${data.wasmBytes}`);
-  lines.push(`- WASM SHA-256: \`${data.wasmSha256}\``);
-  lines.push(`- Timeout: ${data.timeoutMs}ms`);
-  lines.push(`- Memory limit: ${data.memoryBytes} bytes`);
-  lines.push(`- Output cap: ${data.outputBytes} bytes`);
-  lines.push("");
-  lines.push("## Positive API Probe");
-  lines.push("");
-  lines.push(`- Status: ${data.positive.status}`);
-  lines.push(`- Output: \`${escapeInline(data.positive.output)}\``);
-  lines.push(`- Error: ${data.positive.errorMessage ? `\`${escapeInline(data.positive.errorMessage)}\`` : "none"}`);
-  lines.push("");
-  lines.push("## Required Proof Results");
-  lines.push("");
-  lines.push("| Proof | Result | Evidence |");
-  lines.push("| --- | --- | --- |");
-  for (const result of data.results) {
-    const evidence = [
-      result.pass.reason,
-      `status=${result.run.status}`,
-      `durationMs=${result.run.durationMs}`,
-      `outputBytes=${result.run.outputBytes}`,
-      `stdoutBytes=${result.run.stdoutBytes}`,
-      `stderrBytes=${result.run.stderrBytes}`,
-      `truncated=${result.run.truncated}`,
-      result.run.errorMessage ? `error=${result.run.errorMessage}` : undefined,
-    ].filter(Boolean).join("; ");
-    lines.push(`| ${result.fixture.proof} | ${result.pass.ok ? "pass" : "fail"} | ${escapeTable(evidence)} |`);
-  }
-  lines.push("");
-  lines.push("## Notes");
-  lines.push("");
-  lines.push("- This proof runner uses a temporary installed `quickjs-wasi` package root passed explicitly by the caller.");
-  lines.push("- It does not add repo dependencies and does not wire the adapter into `freeflow_search action=transform` execution.");
-  lines.push("- Passing this spike only supports JavaScript adapter feasibility; Python and jq remain unavailable until their own proof slices pass.");
-  lines.push("- Before product execution, this must still go through implementation/security review and source-plan update.");
-  lines.push("");
-  lines.push("## Required Proof Set");
-  lines.push("");
-  for (const proof of SCRIPT_SANDBOX_REQUIRED_PROOFS) {
-    lines.push(`- ${proof}`);
-  }
-  return `${lines.join("\n")}\n`;
-}
-
-function escapeInline(value) {
-  return String(value).replaceAll("`", "\\`").replaceAll("\n", "\\n");
-}
-
-function escapeTable(value) {
-  return escapeInline(value).replaceAll("|", "\\|");
-}
-
-function disposeHandle(value) {
-  if (value && typeof value.dispose === "function") {
-    value.dispose();
-  } else if (value && typeof value[Symbol.dispose] === "function") {
-    value[Symbol.dispose]();
-  }
-}
-
-function parseArgs(argv) {
-  const args = {};
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    const next = argv[index + 1];
-    if (arg === "--quickjs-wasi-root") {
-      args.quickjsWasiRoot = next;
-      index += 1;
-    } else if (arg === "--report") {
-      args.report = next;
-      index += 1;
-    } else if (arg === "--timeout-ms") {
-      args.timeoutMs = Number(next);
-      index += 1;
-    } else if (arg === "--memory-bytes") {
-      args.memoryBytes = Number(next);
-      index += 1;
-    } else if (arg === "--output-bytes") {
-      args.outputBytes = Number(next);
-      index += 1;
-    } else {
-      throw new Error(`Unknown argument ${arg}`);
-    }
-  }
-  return args;
-}
-
-main().catch((error) => {
-  console.error(error instanceof Error ? error.stack : error);
-  process.exit(1);
-});

package/evals/scripts/skill-evidence.sh

@@ -1,316 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-usage() {
-  cat >&2 <<'EOF'
-Usage:
-  skill-evidence.sh <skill> [--format summary|json|commands] [--audience public|internal]
-  skill-evidence.sh --validate
-
-Examples:
-  evals/scripts/skill-evidence.sh verify-work
-  evals/scripts/skill-evidence.sh write-plan --format commands
-  evals/scripts/skill-evidence.sh review-work --format json
-EOF
-}
-
-fail() {
-  printf 'FAIL: %s\n' "$1" >&2
-  exit 1
-}
-
-script_path="${BASH_SOURCE[0]}"
-script_dir="$(cd "$(dirname "$script_path")" && pwd)"
-repo_root="$(git -C "$script_dir" rev-parse --show-toplevel)"
-plugin_root="$repo_root"
-metadata="$plugin_root/evals/registries/skill-evidence.json"
-command_surface="$plugin_root/command-surface.json"
-reports_dir="$plugin_root/evals/reports/by-skill"
-
-format="summary"
-audience="public"
-validate_all=0
-skill=""
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --format)
-      format="${2:-}"
-      shift 2
-      ;;
-    --audience)
-      audience="${2:-}"
-      shift 2
-      ;;
-    --validate)
-      validate_all=1
-      shift
-      ;;
-    --help|-h)
-      usage
-      exit 0
-      ;;
-    -*)
-      usage
-      fail "Unsupported option: $1"
-      ;;
-    *)
-      if [ -z "$skill" ]; then
-        skill="$1"
-      else
-        usage
-        fail "Unexpected argument: $1"
-      fi
-      shift
-      ;;
-  esac
-done
-
-case "$format" in
-  summary|json|commands) ;;
-  *) fail "Unsupported format: $format. Expected summary, json, or commands." ;;
-esac
-
-case "$audience" in
-  public|internal) ;;
-  *) fail "Unsupported audience: $audience. Expected public or internal." ;;
-esac
-
-jq empty "$metadata"
-jq empty "$command_surface"
-
-skill_exists() {
-  local name="$1"
-  [ -f "$plugin_root/skills/$name/SKILL.md" ]
-}
-
-skill_in_metadata() {
-  local name="$1"
-  jq -e --arg skill "$name" '.skills[$skill] != null' "$metadata" >/dev/null
-}
-
-find_registry_for_eval() {
-  local eval_id="$1"
-  local registry_rel
-  local found=""
-  local count=0
-
-  while IFS= read -r registry_rel; do
-    local registry_path="$plugin_root/$registry_rel"
-    local matches
-    matches="$(jq -r --arg id "$eval_id" '[.evals[] | select(.id == $id)] | length' "$registry_path")"
-    if [ "$matches" != "0" ]; then
-      count=$((count + matches))
-      found="$registry_rel"
-    fi
-  done < <(jq -r '.registries[]' "$metadata")
-
-  if [ "$count" != "1" ]; then
-    printf 'ERROR:%s' "$count"
-  else
-    printf '%s' "$found"
-  fi
-}
-
-eval_acceptance_suites_json() {
-  local eval_id="$1"
-  jq -c --arg id "$eval_id" '[.suites[] | select(.evals | index($id)) | {id, path}]' "$metadata"
-}
-
-command_routes_json() {
-  local name="$1"
-  jq -c --arg skill "$name" '
-    [
-      (.directSkillCalls[]? | select(.skill == $skill) | {kind:"direct", command, skill}),
-      (.developerSkillCalls[]? | select(.skill == $skill) | {kind:"developer", command, skill}),
-      (.modeCommands[]? | select(.routesTo == $skill) | {kind:"mode", command, skill:.routesTo})
-    ]
-  ' "$command_surface"
-}
-
-reports_json() {
-  local name="$1"
-  find "$reports_dir" -maxdepth 1 -type f -name "${name}-[0-9]*-report.md" -print \
-    | sed "s#^$plugin_root/##" \
-    | sort \
-    | jq -R -s 'split("\n")[:-1]'
-}
-
-build_bundle() {
-  local name="$1"
-  local tmp_evals
-  tmp_evals="$(mktemp "${TMPDIR:-/tmp}/freeflow-skill-evals.XXXXXX")"
-
-  local eval_id
-  while IFS= read -r eval_id; do
-    [ -n "$eval_id" ] || continue
-
-    local registry_rel
-    registry_rel="$(find_registry_for_eval "$eval_id")"
-    if [[ "$registry_rel" == ERROR:* ]]; then
-      jq -cn --arg id "$eval_id" --arg error "eval must resolve exactly once; got ${registry_rel#ERROR:}" \
-        '{id:$id, error:$error}' >> "$tmp_evals"
-      continue
-    fi
-
-    local registry_path="$plugin_root/$registry_rel"
-    local eval_json
-    eval_json="$(jq -cer --arg id "$eval_id" '.evals[] | select(.id == $id)' "$registry_path")"
-
-    local fixture_root
-    fixture_root="$(jq -r '.fixture_root // empty' <<<"$eval_json")"
-    if [ -z "$fixture_root" ]; then
-      fixture_root="$(jq -r '.fixture_root // empty' "$registry_path")"
-    fi
-
-    local prompt_ref prompt_kind
-    prompt_ref="$(jq -r '.prompt_file // empty' <<<"$eval_json")"
-    if [ -n "$prompt_ref" ]; then
-      prompt_kind="file"
-    else
-      prompt_ref="<inline>"
-      prompt_kind="inline"
-    fi
-
-    local fixture_exists="false"
-    if [ -n "$fixture_root" ] && [ -d "$plugin_root/$fixture_root" ]; then
-      fixture_exists="true"
-    fi
-
-    local prompt_exists="true"
-    if [ "$prompt_kind" = "file" ] && [ ! -f "$plugin_root/$prompt_ref" ]; then
-      prompt_exists="false"
-    fi
-
-    local suites
-    suites="$(eval_acceptance_suites_json "$eval_id")"
-
-    jq -cn \
-      --arg id "$eval_id" \
-      --arg registry "$registry_rel" \
-      --arg fixture "$fixture_root" \
-      --arg prompt "$prompt_ref" \
-      --arg promptKind "$prompt_kind" \
-      --argjson fixtureExists "$fixture_exists" \
-      --argjson promptExists "$prompt_exists" \
-      --argjson suites "$suites" \
-      '{id:$id, registry:$registry, fixture_root:$fixture, fixture_exists:$fixtureExists, prompt:$prompt, prompt_kind:$promptKind, prompt_exists:$promptExists, suites:$suites}' >> "$tmp_evals"
-  done < <(jq -r --arg skill "$name" '.skills[$skill].evals[]?' "$metadata")
-
-  local evals_json routes_json reports
-  evals_json="$(jq -s '.' "$tmp_evals")"
-  routes_json="$(command_routes_json "$name")"
-  reports="$(reports_json "$name")"
-
-  local bundle_json
-  bundle_json="$(jq -n \
-    --arg skill "$name" \
-    --arg skillFile "skills/$name/SKILL.md" \
-    --arg audience "$audience" \
-    --arg runPolicy "generated runs are internal; this output does not include evals/runs bodies" \
-    --argjson evals "$evals_json" \
-    --argjson commands "$routes_json" \
-    --argjson reports "$reports" \
-    '{
-      subject: {kind:"skill", name:$skill},
-      skill_file:$skillFile,
-      audience:$audience,
-      command_routes:$commands,
-      evals:$evals,
-      reports:$reports,
-      run_policy:$runPolicy,
-      gaps: (
-        [
-          (if ($commands | length) == 0 then "no command-surface route" else empty end),
-          (if ($evals | length) == 0 then "no grouped evals" else empty end),
-          (if ($reports | length) == 0 then "no by-skill reports" else empty end)
-        ]
-        + [ $evals[]? | select(.error != null) | "eval " + .id + ": " + .error ]
-        + [ $evals[]? | select(.fixture_exists == false) | "eval " + .id + ": missing fixture " + .fixture_root ]
-        + [ $evals[]? | select(.prompt_exists == false) | "eval " + .id + ": missing prompt " + .prompt ]
-      )
-    }')"
-
-  rm -f "$tmp_evals"
-  printf '%s\n' "$bundle_json"
-}
-
-validate_skill() {
-  local name="$1"
-  local status=0
-
-  if ! skill_exists "$name"; then
-    printf 'FAIL %s: missing skills/%s/SKILL.md\n' "$name" "$name" >&2
-    return 1
-  fi
-
-  if ! skill_in_metadata "$name"; then
-    printf 'FAIL %s: missing skill-evidence metadata\n' "$name" >&2
-    return 1
-  fi
-
-  local bundle
-  bundle="$(build_bundle "$name")"
-
-  if jq -e '.gaps[]? | select(test("^eval .*:"))' <<<"$bundle" >/dev/null; then
-    jq -r --arg name "$name" '.gaps[]? | select(test("^eval .*:")) | "FAIL " + $name + ": " + .' <<<"$bundle" >&2
-    status=1
-  fi
-
-  if jq -e '.gaps[]? | select(. == "no grouped evals")' <<<"$bundle" >/dev/null; then
-    printf 'FAIL %s: no grouped evals\n' "$name" >&2
-    status=1
-  fi
-
-  return "$status"
-}
-
-if [ "$validate_all" = "1" ]; then
-  status=0
-
-  while IFS= read -r item; do
-    if ! skill_in_metadata "$item"; then
-      printf 'FAIL %s: command-surface route has no skill-evidence metadata\n' "$item" >&2
-      status=1
-    fi
-  done < <(jq -r '[.directSkillCalls[]?.skill, .developerSkillCalls[]?.skill, .modeCommands[]?.routesTo] | unique[]' "$command_surface")
-
-  while IFS= read -r item; do
-    validate_skill "$item" || status=1
-  done < <(jq -r '.skills | keys[]' "$metadata")
-  exit "$status"
-fi
-
-[ -n "$skill" ] || { usage; exit 2; }
-skill_exists "$skill" || fail "Skill not found: skills/$skill/SKILL.md"
-skill_in_metadata "$skill" || fail "No skill-evidence metadata for skill: $skill"
-
-bundle="$(build_bundle "$skill")"
-
-case "$format" in
-  json)
-    jq '.' <<<"$bundle"
-    ;;
-  commands)
-    jq -r --arg runner "evals/scripts/run-fixture-eval.sh" --arg skill_file "skills/$skill/SKILL.md" '
-      .evals[]
-      | select(.error == null)
-      | $runner + " " + .id + " --with-skill --registry " + .registry + " --skill " + $skill_file
-    ' <<<"$bundle"
-    ;;
-  summary)
-    jq -r '
-      "Skill: " + .subject.name,
-      "Skill file: " + .skill_file,
-      "Commands:",
-      (if (.command_routes | length) == 0 then "  - none" else (.command_routes[] | "  - " + .command + " -> " + .skill + " (" + .kind + ")") end),
-      "Evals:",
-      (if (.evals | length) == 0 then "  - none" else (.evals[] | "  - " + .id + " [" + .registry + "]" + (if (.suites | length) > 0 then " suites: " + ((.suites | map(.id)) | join(",")) else "" end)) end),
-      "Reports:",
-      (if (.reports | length) == 0 then "  - none" else (.reports[] | "  - " + .) end),
-      "Gaps:",
-      (if (.gaps | length) == 0 then "  - none" else (.gaps[] | "  - " + .) end),
-      "Run policy: " + .run_policy
-    ' <<<"$bundle"
-    ;;
-esac