@uinaf/skillcheck 1.4.1 → 1.5.1

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { lintSkills } from "./lint.js";
 import { encodeRunNamePart, generateRun, requiredEvalPackages, resolvePackageDir, runNameFor } from "./scenario.js";
+import { lintSkills } from "./lint.js";
 import { execFileSync, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
@@ -61,12 +61,13 @@ function parseArgs(argv) {
 function resolveRoot(flags) {
 	return path.resolve(flags.get("--root") ?? process.cwd());
 }
-function stateDirs(root) {
+function stateDirs(root, uid = process.getuid?.()) {
 	const base = path.join(root, ".skillcheck");
 	const id = createHash("sha256").update(path.resolve(root)).digest("hex").slice(0, 12);
+	const owner = uid === void 0 ? "" : `${uid}-`;
 	return {
 		results: path.join(base, "results"),
-		scratch: path.join(fs.realpathSync(os.tmpdir()), `skillcheck-${id}`),
+		scratch: path.join(fs.realpathSync(os.tmpdir()), `skillcheck-${owner}${id}`),
 		scorecards: path.join(base, "scorecards")
 	};
 }
@@ -137,7 +138,7 @@ function assertUniformConfig(entries, allowMixed) {
 	for (const [harness, configs] of byHarness) if (configs.size > 1) throw new Error(`${harness} results span multiple run configurations (${[...configs.values()].map(describeConfig).join("; ")}); rerun them to match or pass --allow-mixed`);
 }
 function ensureEvalPackages(opts) {
-	const missing = requiredEvalPackages(opts, process.env.ANTHROPIC_API_KEY !== void 0).filter((pkg) => resolvePackageDir(pkg) === void 0);
+	const missing = requiredEvalPackages(opts, Boolean(process.env.ANTHROPIC_API_KEY)).filter((pkg) => resolvePackageDir(pkg) === void 0);
 	if (missing.length === 0) return;
 	const peers = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8")).peerDependencies ?? {};
 	const specs = missing.map((pkg) => `"${pkg}@${peers[pkg] ?? "latest"}"`).join(" ");

package/dist/grok-provider.js

@@ -89,8 +89,10 @@ var GrokProvider = class {
 					cost = event.total_cost_usd;
 				}
 			};
+			child.stdout?.setEncoding("utf8");
+			child.stderr?.setEncoding("utf8");
 			child.stdout?.on("data", (chunk) => {
-				stdout += chunk.toString("utf8");
+				stdout += chunk;
 				if (stdout.length > OUTPUT_CAP) {
 					stop("grok event stream exceeded limit");
 					return;
@@ -103,7 +105,7 @@ var GrokProvider = class {
 				}
 			});
 			child.stderr?.on("data", (chunk) => {
-				stderr = (stderr + chunk.toString("utf8")).slice(-4e3);
+				stderr = (stderr + chunk).slice(-4e3);
 			});
 			child.on("error", (cause) => {
 				error ??= `grok could not start: ${cause.message}`;

package/dist/lint.js

@@ -1,3 +1,4 @@
+import { FILE_BLOCK } from "./scenario.js";
 import fs from "node:fs";
 import path from "node:path";
 //#region src/lint.ts
@@ -61,19 +62,36 @@ function lintSkill(dir, root, errors) {
 function lintSkills(root) {
 	const roots = ["skills", ...fs.globSync("cli/*/skills", { cwd: root })].map((r) => path.join(root, r));
 	const errors = [];
-	let count = 0;
+	const skills = [];
 	for (const dir of roots) {
 		if (!fs.existsSync(dir)) continue;
 		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
 			if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
 			lintSkill(path.join(dir, entry.name), root, errors);
-			count++;
+			skills.push(path.join(dir, entry.name));
 		}
 	}
+	lintTasks(skills, root, errors);
 	return {
 		errors,
-		count
+		count: skills.length
 	};
 }
+function lintTasks(skills, root, errors) {
+	const names = skills.map((dir) => path.basename(dir));
+	for (const dir of skills) {
+		const evals = path.join(dir, "evals");
+		if (!fs.existsSync(evals)) continue;
+		for (const scenario of fs.readdirSync(evals, { withFileTypes: true })) {
+			const file = path.join(evals, scenario.name, "task.md");
+			if (!scenario.isDirectory() || !fs.existsSync(file)) continue;
+			const text = fs.readFileSync(file, "utf8").replace(FILE_BLOCK, "");
+			for (const name of names) {
+				const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+				if (new RegExp(`(?<![\\w-])${escaped}(?![\\w-])`, "i").test(text)) errors.push(`${path.relative(root, file)}: task names skill ${name}`);
+			}
+		}
+	}
+}
 //#endregion
 export { lintSkills };

package/dist/scenario.js

@@ -4,6 +4,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 //#region src/scenario.ts
+const FILE_BLOCK = /^=+ FILE: (.+?) =+\n([\s\S]*?)\n=+ END FILE =+$/gm;
 const DEFAULT_CLAUDE_AGENT = "claude-opus-5";
 function loadScenario(scenarioDir) {
 	const match = scenarioDir.match(/skills\/([^/]+)\/evals\/([^/]+)$/);
@@ -15,7 +16,7 @@ function loadScenario(scenarioDir) {
 	if (criteria.skill_use !== void 0 && criteria.skill_use !== "required" && criteria.skill_use !== "optional") throw new Error(`skill_use must be "required" or "optional" in ${scenarioDir}`);
 	for (const item of criteria.checklist) if (!(typeof item?.name === "string" && item.name.trim() !== "" && typeof item?.description === "string" && item.description.trim() !== "" && Number.isFinite(item?.max_score) && item.max_score > 0)) throw new Error(`invalid checklist item in ${scenarioDir}: ${JSON.stringify(item)}`);
 	const files = [];
-	const task = taskMd.replace(/^=+ FILE: (.+?) =+\n([\s\S]*?)\n=+ END FILE =+$/gm, (_, name, content) => {
+	const task = taskMd.replace(FILE_BLOCK, (_, name, content) => {
 		files.push({
 			name: name.trim(),
 			content: content + "\n"
@@ -322,4 +323,4 @@ function generateRun(scenarioDir, opts, paths) {
 	};
 }
 //#endregion
-export { DEFAULT_CLAUDE_AGENT, buildConfig, encodeRunNamePart, generateRun, isHiddenSkill, loadScenario, materialize, privateCodexHome, requiredEvalPackages, resolvePackageDir, runNameFor, sdkNodeModulesDir, stripHiddenFlag, trialLabel };
+export { DEFAULT_CLAUDE_AGENT, FILE_BLOCK, buildConfig, encodeRunNamePart, generateRun, isHiddenSkill, loadScenario, materialize, privateCodexHome, requiredEvalPackages, resolvePackageDir, runNameFor, sdkNodeModulesDir, stripHiddenFlag, trialLabel };

package/docs/adoption.md

@@ -10,7 +10,9 @@ pnpm add -D @uinaf/skillcheck
 ```
 
 Runners that install with `--ignore-scripts` are fine: the package ships
-compiled ESM and has no install, prepare, or postinstall script.
+compiled ESM and has no install or postinstall script. Its `prepare` script
+only wires this repository's own commit hook; package managers do not run it
+for a registry install.
 
 ```json
 { "scripts": { "skills:lint": "skillcheck lint" } }
@@ -25,6 +27,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: "24"
@@ -33,7 +36,8 @@ jobs:
 ```
 
 The job needs no secrets and no network beyond the install. Node 24 is the
-floor.
+floor. `pnpm/action-setup` installs the pnpm version pinned in the repo's
+`packageManager` field; hosted runners do not ship pnpm.
 
 Run it through the script rather than a bare `npx skillcheck`: the script
 resolves the version the repo pinned, and `npx` would resolve the latest one on

package/docs/releasing.md

@@ -5,15 +5,13 @@
 A push to `main` runs one workflow, `.github/workflows/release.yml`:
 
 ```text
-verify ──┐
-         ├──> release   npm publish, OIDC + uinaf-ci  (release environment)
-scan ────┘
+verify ──> release   npm publish, OIDC + uinaf-ci  (release environment)
 ```
 
-`verify` and `scan` are the shared gate: `verify` is called from `verify.yml`,
-and `scan` calls the shared scan in `uinaf/.github`, the same one `scan.yml`
-runs for pull requests. Keep it that way: a second copy of the gate on a push-to-`main` workflow
-races this one over the same commit.
+`verify` is the one gate, called from `verify.yml`; its last step runs the
+shared push-time scan from `uinaf/.github` over the pushed range. Keep it that
+way: a second copy of the gate on a push-to-`main` workflow races this one over
+the same commit.
 
 The file name `release.yml` is load-bearing. See below.
 

package/docs/scenarios.md

@@ -35,6 +35,7 @@ own examiner or embed generated dependencies.
 
 Write the task the way a user would write it. Do not name the skill, describe
 its steps, or hint at the checklist: routing is part of what is being measured.
+`skillcheck lint` rejects a task whose prose names any skill in the root.
 
 ## criteria.json
 
@@ -108,7 +109,7 @@ frontmatter block; body text mentioning the key does not count.
 ## The workdir
 
 Per run, under a scratch directory in the system temp dir
-(`skillcheck-<hash of the root>/<name>/trial-<n>/`), rebuilt from scratch each
+(`skillcheck-<uid>-<hash of the root>/<name>/trial-<n>/`), rebuilt from scratch each
 time. It stays outside the root so the agent cannot reach the skill's source,
 its evals, or the repository's own agent guidance. The skill under test is installed where the harness discovers skills:
 `.claude/skills/<skill>/`, plus `.agents/skills/<skill>/` on codex, or

package/docs/usage.md

@@ -20,6 +20,9 @@ Checks each `<root>/skills/<skill>/`:
 - `disable-model-invocation`, when present, is the bare YAML boolean `true`.
   A quoted `"true"` is an error
 - Relative links in the body resolve on disk
+- No eval `task.md` names a skill from the root, outside its inline input
+  files. A named skill gives routing away, and a no-skill control can read
+  the operator's installed copy
 
 Code spans and fenced blocks are stripped before links are checked, so example
 links never fail. External schemes and `#anchors` pass. Dot-directories under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uinaf/skillcheck",
-  "version": "1.4.1",
+  "version": "1.5.1",
   "description": "Lint and eval harness for agent skills",
   "homepage": "https://github.com/uinaf/skillcheck#readme",
   "bugs": {
@@ -66,5 +66,5 @@
   "engines": {
     "node": ">=24"
   },
-  "packageManager": "pnpm@12.4.2"
+  "packageManager": "pnpm@12.5.1"
 }