@uinaf/skillcheck 0.5.2 → 0.5.4

package/dist/cli.js

@@ -61,6 +61,7 @@ function stateDirs(root) {
 function runOptions(flags) {
 	const harness = flags.get("--harness") ?? "claude";
 	if (harness !== "claude" && harness !== "codex" && harness !== "cursor") fail(`--harness must be claude, codex, or cursor, got ${harness}`);
+	if (flags.has("--max-turns") && harness !== "claude") fail("--max-turns is only supported with --harness claude");
 	const agent = flags.get("--agent");
 	const judgeModel = flags.get("--judge") ?? "claude-opus-5";
 	const judgeEffort = flags.get("--judge-effort");

package/docs/releasing.md

@@ -6,7 +6,7 @@ A push to `main` runs one workflow, `.github/workflows/release.yml`:
 
 ```text
 verify ──┐
-         ├──> release   npm publish, OIDC + uinaf-releaser  (release environment)
+         ├──> release   npm publish, OIDC + uinaf-ci  (release environment)
 scan ────┘
 ```
 
@@ -20,15 +20,15 @@ The file name `release.yml` is load-bearing. See below.
 ## npm
 
 `@uinaf/skillcheck` publishes from `.github/workflows/release.yml` via npm
-Trusted Publishing (OIDC) and the `uinaf-releaser` GitHub App. There is no npm
+Trusted Publishing (OIDC) and the `uinaf-ci` GitHub App. There is no npm
 token in this repository, in its environments, or in the organization.
 
 Required on the `release` GitHub Environment:
 
-| Name                            | Kind   | Purpose                                     |
-| ------------------------------- | ------ | ------------------------------------------- |
-| `UINAF_RELEASE_APP_CLIENT_ID`   | var    | GitHub App client id for the releaser bot   |
-| `UINAF_RELEASE_APP_PRIVATE_KEY` | secret | GitHub App private key for the releaser bot |
+| Name                       | Kind   | Purpose                                     |
+| -------------------------- | ------ | ------------------------------------------- |
+| `UINAF_CI_APP_CLIENT_ID`   | var    | GitHub App client id for the releaser bot   |
+| `UINAF_CI_APP_PRIVATE_KEY` | secret | GitHub App private key for the releaser bot |
 
 The trusted publisher on npmjs.com is registered by **file path**, so
 `.github/workflows/release.yml` cannot be renamed or moved without editing that
@@ -40,6 +40,7 @@ Deleting the `release` environment deletes both rows above with it, and there is
 no repo-level fallback: `create-github-app-token` then runs with empty inputs
 and the job fails at that step. The private key cannot be read back from
 GitHub; recreating it means generating a new one in the App settings.
+The App private key lives on the `release` Environment; the shared release-npm job binds that Environment, so GitHub substitutes the Environment value for the secret named in `release.yml`.
 
 ## Version history
 
@@ -48,11 +49,20 @@ history continues from `v0.1.3`; `v0.1.0`–`v0.1.3` are the legacy git-install
 tags and are never deleted or moved.
 
 During preparation, `@semantic-release/npm` stages the released `package.json`
-version and `@jno21/semantic-release-github-commit` commits it to `main` through
-GitHub's API as the authenticated App. GitHub signs that commit, and the release
-tag points to it. The `[skip ci]` marker on that commit is what stops a release
+version and `scripts/release-commit.ts` commits it through GitHub's signed
+`createCommitOnBranch` API as the authenticated App. The checkout and expected
+branch head are the verified workflow event SHA. GitHub atomically rejects the
+write if `main` has advanced; a successful response is fetched by its immutable
+commit SHA. The plugin checks its parent, unchanged source, and exact prepared
+manifest before semantic-release tags it. Only the package version may change. The `[skip ci]` marker on that commit is what stops a release
 from releasing itself.
 
+If GitHub accepts the commit but fetching or validating it fails, preparation
+stops before tagging or publishing. Inspect that commit's parent, tree, version
+and verified signature, plus existing tags, npm versions and GitHub Releases,
+before recovery. Reconcile only missing publication steps from the validated
+commit; do not create another version or move an existing tag to hide failure.
+
 Check what the next version would be without publishing anything:
 
 ```sh
@@ -61,7 +71,7 @@ pnpm dlx semantic-release --dry-run --no-ci
 
 ## The artifact
 
-`dist/` is generated and untracked. `prepublishOnly` runs `pnpm run verify`,
+`dist/` is generated and untracked. `prepublishOnly` runs `pnpm run verify:full`,
 which builds it, so the tarball is always packed from a tree that just passed
 the gate. `files` is `dist`, `docs`, `README.md`, `LICENSE`.
 

package/docs/usage.md

@@ -32,7 +32,8 @@ clean, 1 with findings.
 
 ```sh
 skillcheck run skills/<skill>/evals/<scenario>
-skillcheck run <scenario-dir> --agent MODEL --judge MODEL --harness codex --max-turns 80
+skillcheck run <scenario-dir> --agent MODEL --judge MODEL --harness codex
+skillcheck run <scenario-dir> --harness claude --max-turns 80
 ```
 
 Materializes the scenario into `<root>/.skillcheck/scratch/<name>/workdir`,
@@ -47,8 +48,9 @@ message, and writes no provenance sidecar. It is never reported as
 `FAIL score=0.0000`; only a real judged verdict can fail a run.
 
 Defaults: `--harness claude`, agent `claude-opus-5`, judge `claude-opus-5`,
-`--max-turns 50`. On the codex and cursor harnesses, omitting `--agent` leaves
-the model to that CLI's own default.
+and a Claude agent limit of 50 turns. `--max-turns` changes that limit only for
+Claude; passing it with `codex` or `cursor` fails before the eval starts. On
+those harnesses, omitting `--agent` leaves the model to that CLI's own default.
 
 `--harness cursor` drives the scenario through the Cursor Agent CLI
 (`cursor-agent` on PATH) with the skill installed under `.cursor/skills/`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uinaf/skillcheck",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Lint and eval harness for agent skills",
   "homepage": "https://github.com/uinaf/skillcheck#readme",
   "bugs": {