@uinaf/skillcheck 1.5.0 → 1.5.1

package/dist/cli.js

@@ -61,12 +61,13 @@ function parseArgs(argv) {
 function resolveRoot(flags) {
 	return path.resolve(flags.get("--root") ?? process.cwd());
 }
-function stateDirs(root) {
+function stateDirs(root, uid = process.getuid?.()) {
 	const base = path.join(root, ".skillcheck");
 	const id = createHash("sha256").update(path.resolve(root)).digest("hex").slice(0, 12);
+	const owner = uid === void 0 ? "" : `${uid}-`;
 	return {
 		results: path.join(base, "results"),
-		scratch: path.join(fs.realpathSync(os.tmpdir()), `skillcheck-${id}`),
+		scratch: path.join(fs.realpathSync(os.tmpdir()), `skillcheck-${owner}${id}`),
 		scorecards: path.join(base, "scorecards")
 	};
 }
@@ -137,7 +138,7 @@ function assertUniformConfig(entries, allowMixed) {
 	for (const [harness, configs] of byHarness) if (configs.size > 1) throw new Error(`${harness} results span multiple run configurations (${[...configs.values()].map(describeConfig).join("; ")}); rerun them to match or pass --allow-mixed`);
 }
 function ensureEvalPackages(opts) {
-	const missing = requiredEvalPackages(opts, process.env.ANTHROPIC_API_KEY !== void 0).filter((pkg) => resolvePackageDir(pkg) === void 0);
+	const missing = requiredEvalPackages(opts, Boolean(process.env.ANTHROPIC_API_KEY)).filter((pkg) => resolvePackageDir(pkg) === void 0);
 	if (missing.length === 0) return;
 	const peers = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8")).peerDependencies ?? {};
 	const specs = missing.map((pkg) => `"${pkg}@${peers[pkg] ?? "latest"}"`).join(" ");

package/dist/grok-provider.js

@@ -89,8 +89,10 @@ var GrokProvider = class {
 					cost = event.total_cost_usd;
 				}
 			};
+			child.stdout?.setEncoding("utf8");
+			child.stderr?.setEncoding("utf8");
 			child.stdout?.on("data", (chunk) => {
-				stdout += chunk.toString("utf8");
+				stdout += chunk;
 				if (stdout.length > OUTPUT_CAP) {
 					stop("grok event stream exceeded limit");
 					return;
@@ -103,7 +105,7 @@ var GrokProvider = class {
 				}
 			});
 			child.stderr?.on("data", (chunk) => {
-				stderr = (stderr + chunk.toString("utf8")).slice(-4e3);
+				stderr = (stderr + chunk).slice(-4e3);
 			});
 			child.on("error", (cause) => {
 				error ??= `grok could not start: ${cause.message}`;

package/docs/adoption.md

@@ -10,7 +10,9 @@ pnpm add -D @uinaf/skillcheck
 ```
 
 Runners that install with `--ignore-scripts` are fine: the package ships
-compiled ESM and has no install, prepare, or postinstall script.
+compiled ESM and has no install or postinstall script. Its `prepare` script
+only wires this repository's own commit hook; package managers do not run it
+for a registry install.
 
 ```json
 { "scripts": { "skills:lint": "skillcheck lint" } }
@@ -25,6 +27,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: "24"
@@ -33,7 +36,8 @@ jobs:
 ```
 
 The job needs no secrets and no network beyond the install. Node 24 is the
-floor.
+floor. `pnpm/action-setup` installs the pnpm version pinned in the repo's
+`packageManager` field; hosted runners do not ship pnpm.
 
 Run it through the script rather than a bare `npx skillcheck`: the script
 resolves the version the repo pinned, and `npx` would resolve the latest one on

package/docs/releasing.md

@@ -5,15 +5,13 @@
 A push to `main` runs one workflow, `.github/workflows/release.yml`:
 
 ```text
-verify ──┐
-         ├──> release   npm publish, OIDC + uinaf-ci  (release environment)
-scan ────┘
+verify ──> release   npm publish, OIDC + uinaf-ci  (release environment)
 ```
 
-`verify` and `scan` are the shared gate: `verify` is called from `verify.yml`,
-and `scan` calls the shared scan in `uinaf/.github`, the same one `scan.yml`
-runs for pull requests. Keep it that way: a second copy of the gate on a push-to-`main` workflow
-races this one over the same commit.
+`verify` is the one gate, called from `verify.yml`; its last step runs the
+shared push-time scan from `uinaf/.github` over the pushed range. Keep it that
+way: a second copy of the gate on a push-to-`main` workflow races this one over
+the same commit.
 
 The file name `release.yml` is load-bearing. See below.
 

package/docs/scenarios.md

@@ -109,7 +109,7 @@ frontmatter block; body text mentioning the key does not count.
 ## The workdir
 
 Per run, under a scratch directory in the system temp dir
-(`skillcheck-<hash of the root>/<name>/trial-<n>/`), rebuilt from scratch each
+(`skillcheck-<uid>-<hash of the root>/<name>/trial-<n>/`), rebuilt from scratch each
 time. It stays outside the root so the agent cannot reach the skill's source,
 its evals, or the repository's own agent guidance. The skill under test is installed where the harness discovers skills:
 `.claude/skills/<skill>/`, plus `.agents/skills/<skill>/` on codex, or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uinaf/skillcheck",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Lint and eval harness for agent skills",
   "homepage": "https://github.com/uinaf/skillcheck#readme",
   "bugs": {
@@ -66,5 +66,5 @@
   "engines": {
     "node": ">=24"
   },
-  "packageManager": "pnpm@12.4.2"
+  "packageManager": "pnpm@12.5.1"
 }