firegoat 0.16.0 → 0.17.0

package/README.md

@@ -7,19 +7,21 @@ Status: early. See `plan.md`.
 ## Quickstart
 
 ```bash
-npx firegoat init     # creates firegoat.yaml and .firegoat/, installs the firegoat-onboarding skill, copies a prompt for your agent
-# edit firegoat.yaml (or paste the prompt into your coding agent and let it)
-npx firegoat eval     # runs your claude on each test, in .firegoat/runs/<runId>/<test>/<n>/work
+npx firegoat init     # Creates firegoat.yaml and .firegoat/, installs the firegoat-onboarding skill, copies a prompt for your agent
+# Edit firegoat.yaml (or paste the prompt into your coding agent and let it)
+npx firegoat eval     # Runs your claude on each test, in .firegoat/runs/<runId>/<test>/<n>/work
 ```
 
 That's it: two commands. `claude` must be installed and logged in (run `claude` once).
 
+`init` installs the firegoat-onboarding skill globally, into `~/.claude/skills/` (in a terminal it asks: global, this repo, or none). `--local-skills` puts it in this repo's `.claude/skills/` instead (commit it so teammates and CI get it); `--no-skills` skips it.
+
 ## Upload to firegoat.ai
 
 ```bash
-npx firegoat login    # device flow: open the URL, enter the code; key saved to ~/.firegoat/credentials.json (0600)
-npx firegoat eval     # now also uploads each run as a private trace and prints its URL
-npx firegoat logout   # forgets the login (revoke the key itself on the firegoat.ai traces page)
+npx firegoat login    # Device flow: open the URL, enter the code; key saved to ~/.firegoat/credentials.json (0600)
+npx firegoat eval     # Now also uploads each run as a private trace and prints its URL
+npx firegoat logout   # Forgets the login (revoke the key itself on the firegoat.ai traces page)
 ```
 
 Logging in means agreeing to the firegoat.ai [Terms of Service](https://firegoat.ai/terms) and [Privacy Policy](https://firegoat.ai/privacy); login says so before showing the code. `init` offers the login in a terminal (`--no-login` skips it). In CI, set `FIREGOAT_API_KEY=fire_...` instead. `eval --no-upload` keeps runs local; without a key, runs stay local and eval says so in one line.
@@ -27,7 +29,7 @@ Logging in means agreeing to the firegoat.ai [Terms of Service](https://firegoat
 - Per run, eval uploads claude's session (`session.jsonl`: prompts, tool calls and outputs, file contents, so possibly secrets from your env or repo), `checks.txt` and `stderr.txt` (check output sees `vars:`), plus the run's test, status, checks, the model asked for and the one claude reported, and (in a git repo) the branch, commit and whether the tree was dirty. firegoat.ai masks secrets when it shows a trace, but stores what was sent. Traces start private; you share one from its page.
 - Before any run, eval checks the key (`GET /api/traces/me`) and prints `Uploading sessions to <origin> as <email>`: a key answered with 401/403 exits 3; any other failure (unreachable, 429, 5xx, a wrong `FIREGOAT_BASE_URL` path) exits 2.
 - Each run prints `✓ <test>#<n> <url>` or `✗ <test>#<n> Upload failed: <why>`, and `run.json` / `summary.json` get `upload` (`{status: "uploaded", url}`, `{status: "failed", error}`, `{status: "skipped", reason}`, or null when not uploading). A failed upload never changes a run's status or eval's exit code (0/1/2 stay the eval's verdict); eval ends with `N uploads failed` on stderr. Each file may be at most 20 MiB: a bigger one fails that run's upload. Runs without a session file are skipped.
-- The key is never passed to the agent, setup, workdir_setup or checks (every `FIREGOAT_*` var is removed from their env), is never written to run files, and goes only to the base URL's origin, never through a redirect; presigned upload URLs get no auth header. But there is no sandbox: the agent runs as you, so it can read `~/.firegoat/credentials.json`, and with `FIREGOAT_API_KEY` it can read the key from firegoat's own process environment (`ps eww $PPID`, `/proc/<pid>/environ`), which no program can scrub. In CI, use a dedicated key and revoke it if a run looks off. The key can only upload and read your own traces.
+- The key is never passed to the agent, build, install or checks (every `FIREGOAT_*` var is removed from their env), is never written to run files, and goes only to the base URL's origin, never through a redirect; presigned upload URLs get no auth header. But there is no sandbox: the agent runs as you, so it can read `~/.firegoat/credentials.json`, and with `FIREGOAT_API_KEY` it can read the key from firegoat's own process environment (`ps eww $PPID`, `/proc/<pid>/environ`), which no program can scrub. In CI, use a dedicated key and revoke it if a run looks off. The key can only upload and read your own traces.
 - `FIREGOAT_BASE_URL` (default `https://firegoat.ai/evals`) points firegoat elsewhere: https only, http only for `localhost` / `127.0.0.1`. A saved login only works for the base URL it was made for.
 
 ## Examples
@@ -35,8 +37,8 @@ Logging in means agreeing to the firegoat.ai [Terms of Service](https://firegoat
 ### Can an agent get started with my npm package?
 
 ```yaml
-setup: npm pack --pack-destination "$FIREGOAT_OUT"
-workdir_setup: npm init -y >/dev/null && npm install "$FIREGOAT_OUT"/*.tgz
+build: npm pack --pack-destination "$FIREGOAT_OUT"
+install: npm init -y >/dev/null && npm install "$FIREGOAT_OUT"/*.tgz
 tests:
   - name: quickstart
     prompt: >-
@@ -47,12 +49,12 @@ tests:
       - run: grep -qE 'evt_[A-Za-z0-9]+' "$FIREGOAT_TRANSCRIPT"
 ```
 
-`setup` builds your package once; `workdir_setup` installs that build into each fresh folder, so the agent uses your local code, not the registry.
+`build` builds your package once; `install` installs that build into each fresh folder, so the agent uses your local code, not the registry.
 
 ### Does my CLI make sense to an agent?
 
 ```yaml
-setup: go build -o "$FIREGOAT_OUT/acme" ./cmd/acme
+build: go build -o "$FIREGOAT_OUT/acme" ./cmd/acme
 tests:
   - name: deploy
     prompt: Deploy the hello-world template to a preview environment with the acme CLI and print the URL.
@@ -61,7 +63,7 @@ tests:
       - run: grep -q '\$ acme deploy' "$FIREGOAT_TRANSCRIPT"
 ```
 
-Whatever `setup` writes to `$FIREGOAT_OUT` is first on the agent's `PATH`. That only helps for binaries called by bare name: if users run your CLI via `npx`/`uvx`, pack and install it like the npm example, or `npx` fetches the registry release.
+Whatever `build` writes to `$FIREGOAT_OUT` is first on the agent's `PATH`. That only helps for binaries called by bare name: if users run your CLI via `npx`/`uvx`, pack and install it like the npm example, or `npx` fetches the registry release.
 
 ### Can an agent find the right package from my docs alone?
 
@@ -80,8 +82,8 @@ tests:
 
 ```yaml
 runs: 3
-setup: uv build --wheel --out-dir "$FIREGOAT_OUT"
-workdir_setup: uv venv && uv pip install "$FIREGOAT_OUT"/*.whl
+build: uv build --wheel --out-dir "$FIREGOAT_OUT"
+install: uv venv && uv pip install "$FIREGOAT_OUT"/*.whl
 tests:
   - name: sandbox-hello
     prompt: >-
@@ -115,41 +117,43 @@ tests:
 
 ```yaml
 env:
-  ACME_HOME: "/tmp/acme-{{run.id}}-{{run.n}}"   # sessions/config never collide across runs
+  ACME_HOME: "/tmp/acme-{{run.id}}-{{run.n}}"   # Sessions/config never collide across runs
   ACME_TELEMETRY: "off"
-  UV_FIND_LINKS: "$FIREGOAT_OUT"                # resolve the wheel setup built
+  UV_FIND_LINKS: "$FIREGOAT_OUT"                # Resolve the wheel build: made
 tests:
   - name: login
     prompt: Log in to acme with the CLI and print the current user.
     end_goal: The agent completes acme's login flow and prints the user.
     env:
-      ACME_BETA_LOGIN: "1"                        # this test only, on top of env:
+      ACME_BETA_LOGIN: "1"                        # This test only, on top of env:
     checks:
       - run: ls "$ACME_HOME"/sessions | grep -q .
 ```
 
-`env:` goes to the agent, and to `workdir_setup` and checks of the same run, so checks see the same values. Placeholders: `{{vars.KEY}}`, `{{run.id}}` (the eval's run id), `{{run.n}}` (1..runs, or 1..runs×models), `{{test.name}}`, and `$FIREGOAT_OUT` / `$FIREGOAT_WORKDIR` (also `${...}`), the same dirs `setup`, `workdir_setup` and checks see. There is no other `$` expansion: `$HOME` stays the literal text `$HOME`. `setup` runs once, before any run: it gets only the top-level entries that use nothing but `{{vars.*}}`, `{{run.id}}` and `$FIREGOAT_OUT`. Values are strings (quote numbers). `PATH`, `CLAUDE_CONFIG_DIR` and `FIREGOAT_*` are firegoat's and can't be set; `ANTHROPIC_MODEL` neither: choose the model with `model:`.
+`env:` goes to the agent, and to `install` and checks of the same run, so checks see the same values. Placeholders: `{{vars.KEY}}`, `{{run.id}}` (the eval's run id), `{{run.n}}` (1..runs, or 1..runs×models), `{{test.name}}`, and `$FIREGOAT_OUT` / `$FIREGOAT_WORKDIR` (also `${...}`), the same dirs `build`, `install` and checks see. There is no other `$` expansion: `$HOME` stays the literal text `$HOME`. `build` runs once, before any run: it gets only the top-level entries that use nothing but `{{vars.*}}`, `{{run.id}}` and `$FIREGOAT_OUT`. Values are strings (quote numbers). `PATH`, `CLAUDE_CONFIG_DIR` and `FIREGOAT_*` are firegoat's and can't be set; `ANTHROPIC_MODEL` neither: choose the model with `model:`.
+
+Setting `HOME`: on macOS claude reads its login from `$HOME/Library`, so with a per-run `HOME` every run says "Not logged in" unless `install` runs `ln -s <real home>/Library "$HOME/Library"`. Get the real home in `build`, which doesn't get entries using `{{test.name}}` or `{{run.n}}` (e.g. `build: echo "$HOME" > "$FIREGOAT_OUT/.real-home"`).
 
 ## What eval does
 
 - claude runs on its own login (or `ANTHROPIC_API_KEY`, if set) with `CLAUDE_CONFIG_DIR=.firegoat/.claude` and `--setting-sources "" --strict-mcp-config --disable-slash-commands`: none of your settings, CLAUDE.md, plugins, skills or MCP servers. claude saves its session there, in its own format.
-- No sandbox: the agent's folder is inside `.firegoat/runs/`, and it can reach the rest of your machine. In `.firegoat/`, git ignores everything except `fixtures/`: keep test fixtures (scripts, sample data) in `.firegoat/fixtures/` and commit them with `firegoat.yaml`.
-- In a linked git worktree (`git worktree add`), `.firegoat/runs/` and `.firegoat/.claude/` are in the main checkout, so runs (and their session files) survive `git worktree remove`; `firegoat.yaml`, fixtures and `setup:` stay in the worktree. Each `summary.json` records `dir` (where eval ran) and `git: {branch, commit, dirty}`, and `.firegoat/runs/index.jsonl` gets one line per eval (`runId, startedAt, dir, branch, commit, passed, failed, notGraded, cost, uploaded, uploadFailed`) to tell runs from different branches apart.
-- The agent gets your environment plus `env:`, never `vars:`. Vars that npm/npx set for firegoat itself (`npm_config_*`, `npm_lifecycle_*`, `npm_package_*`, `npm_execpath`, `npm_node_execpath`, `npm_command`, `INIT_CWD`) are removed from every env firegoat starts (agent, setup, workdir_setup, checks): `npx -y firegoat` sets `npm_config_yes=true`, which would make the agent's `npm init` / `npx create-*` skip their prompts. Set one under `env:` to keep it. Every `FIREGOAT_*` var firegoat was started with (`FIREGOAT_API_KEY` above all) is removed too.
+- No sandbox: the agent's folder is inside `.firegoat/runs/`, and it can reach the rest of your machine. In `.firegoat/`, git ignores everything except `fixtures/` and its own `.gitignore`: keep test fixtures (scripts, sample data) in `.firegoat/fixtures/` and commit them and `.firegoat/.gitignore` with `firegoat.yaml`.
+- In a linked git worktree (`git worktree add`), `.firegoat/runs/` and `.firegoat/.claude/` are in the main checkout, so runs (and their session files) survive `git worktree remove`; `firegoat.yaml`, fixtures and `build:` stay in the worktree. Each `summary.json` records `dir` (where eval ran) and `git: {branch, commit, dirty}`, and `.firegoat/runs/index.jsonl` gets one line per eval (`runId, startedAt, dir, branch, commit, passed, failed, notGraded, cost, uploaded, uploadFailed`) to tell runs from different branches apart.
+- The agent gets your environment plus `env:`, never `vars:`. Vars that npm/npx set for firegoat itself (`npm_config_*`, `npm_lifecycle_*`, `npm_package_*`, `npm_execpath`, `npm_node_execpath`, `npm_command`, `INIT_CWD`) are removed from every env firegoat starts (agent, build, install, checks): `npx -y firegoat` sets `npm_config_yes=true`, which would make the agent's `npm init` / `npx create-*` skip their prompts. Set one under `env:` to keep it. Every `FIREGOAT_*` var firegoat was started with (`FIREGOAT_API_KEY` above all) is removed too.
 - Runs (tests × models × `runs`) go 4 at a time, each in its own folder with its own session; `--parallel N` changes that, `--parallel 1` runs them one after another. `summary.json` lists them in `firegoat.yaml` order.
 - Script checks run in the agent's folder afterwards and set the exit code. `end_goal` is not graded by firegoat: it's for you, or your coding agent, to judge from `run.json`, the session and the folder.
-- Output per run, in `.firegoat/runs/<runId>/<test>/<n>/`: `transcript.txt` (each tool call with its command and short output, the final answer, files made; checks get it as `$FIREGOAT_TRANSCRIPT`), `run.json` (status, prompt, end_goal, check results, paths), `work/`, logs. Read the transcript to judge `end_goal`; claude's full session file is ~50x larger. `summary.json` covers the whole eval; `--json` prints it.
+- Output per run, in `.firegoat/runs/<runId>/<test>/<n>/`: `transcript.txt` (each tool call with its command and short output, the final answer, files made; checks get it as `$FIREGOAT_TRANSCRIPT`; greppable line by line: every line of a shell call starts with `[n] $ `, every line of the agent's text and final answer with `agent: `, output is indented, so `grep -E '^\[[0-9]+\] \$ .*npm install'` matches only commands, also inside heredocs and multi-line scripts), `run.json` (status, prompt, end_goal, check results, paths), `work/`, logs. Read the transcript to judge `end_goal`; claude's full session file is ~50x larger. `summary.json` covers the whole eval; `--json` prints it.
 
-`firegoat.yaml` keys: `runs`, `model`, `setup`, `workdir_setup`, `vars`, `env`, and `tests` (`name`, `prompt`, `end_goal`, `checks`, `timeout`, `env`). Unknown keys are errors. Full reference: `npx firegoat init --help`.
+`firegoat.yaml` keys: `runs`, `model`, `build`, `install`, `vars`, `env`, and `tests` (`name`, `prompt`, `end_goal`, `checks`, `timeout`, `env`). Unknown keys are errors. Full reference: `npx firegoat init --help`.
 
 Want a plain `npm i acme-sdk` to get your build, with no hint in the prompt? See [`examples/local-npm-registry`](examples/local-npm-registry/README.md).
 
 | exit code | meaning |
 |---|---|
-| 0 | every run's checks passed |
-| 1 | a check failed |
-| 2 | at least one run was not graded (claude missing or logged out, crash, timeout, setup failed); wins over 1 |
-| 3 | usage or config error (including firegoat.ai rejecting the upload key) |
+| 0 | Every run's checks passed |
+| 1 | A check failed |
+| 2 | At least one run was not graded (claude missing or logged out, crash, timeout, build failed); wins over 1 |
+| 3 | Usage or config error (including firegoat.ai rejecting the upload key) |
 
 Upload failures don't change the exit code.
 
@@ -168,6 +172,6 @@ It goes to the firegoat team with the firegoat version, your OS and node version
 ```bash
 bun install
 bun run format
-bun test                     # e2e: packs the package and drives the installed bin
-FIREGOAT_E2E_REAL=1 bun test # also runs one eval against your real claude
+bun test                     # End-to-end: packs the package and drives the installed bin
+FIREGOAT_E2E_REAL=1 bun test # Also runs one eval against your real claude
 ```

package/dist/cli.js

@@ -6947,7 +6947,7 @@ var require_public_api = __commonJS(function(exports) {
 // package.json
 var package_default = {
   name: "firegoat",
-  version: "0.16.0",
+  version: "0.17.0",
   repository: {
     type: "git",
     url: "git+https://github.com/firegoat-ai/firegoat-cli.git"
@@ -7076,16 +7076,16 @@ function parseConfig(text) {
   onlyKeys(raw, "(root)", [
     "runs",
     "model",
-    "setup",
-    "workdir_setup",
+    "build",
+    "install",
     "vars",
     "env",
     "tests"
   ]);
   const runs = posInt(raw.runs, "runs", 1);
   const models = parseModels(raw.model);
-  const setup = commands(raw.setup, "setup");
-  const workdirSetup = commands(raw.workdir_setup, "workdir_setup");
+  const build = commands(raw.build, "build");
+  const install = commands(raw.install, "install");
   const vars = parseVars(raw.vars);
   const env = parseEnv(raw.env, "env");
   if (!Array.isArray(raw.tests) || raw.tests.length === 0)
@@ -7125,8 +7125,8 @@ function parseConfig(text) {
   return {
     runs,
     models,
-    setup,
-    workdirSetup,
+    build,
+    install,
     vars,
     env,
     tests
@@ -7236,7 +7236,7 @@ function render(text, vars) {
   return text.replace(PLACEHOLDER, (_, key) => {
     const v = vars[key];
     if (v === undefined)
-      throw new ConfigError(`no value for {{vars.${key}}}`);
+      throw new ConfigError(`No value for {{vars.${key}}}`);
     return v;
   });
 }
@@ -7735,6 +7735,7 @@ var EXIT = { pass: 0, fail: 1, notGraded: 2, usage: 3 };
 import { mkdirSync as mkdirSync2, writeFileSync } from "node:fs";
 import { join as join2 } from "node:path";
 var GITIGNORE = `*
+!.gitignore
 !fixtures/
 !fixtures/**
 `;
@@ -7803,11 +7804,11 @@ function gitRepo(dir) {
 
 // src/help.ts
 var EXIT_CODES = `Exit codes:
-  0  every run's script checks passed
-  1  a script check failed
-  2  at least one run was not graded (claude missing or logged out, crash, timeout,
-     setup failed); wins over 1
-  3  usage or config error (bad flag, unknown test, invalid or missing firegoat.yaml,
+  0  Every run's script checks passed
+  1  A script check failed
+  2  At least one run was not graded (claude missing or logged out, crash, timeout,
+     build failed); wins over 1
+  3  Usage or config error (bad flag, unknown test, invalid or missing firegoat.yaml,
      firegoat.ai answered 401/403 for the upload key); any other failure of
      that key check exits 2
   Upload failures don't change the exit code.`;
@@ -7816,74 +7817,85 @@ function topHelp(version) {
 folder, with none of your claude config; firegoat saves the session and runs your
 script checks.
 
-  npx firegoat init     create firegoat.yaml and .firegoat/, install the skill
-  npx firegoat eval     run the tests (claude must be logged in: run \`claude\` once)
+  npx firegoat init     Create firegoat.yaml and .firegoat/, install the skill
+  npx firegoat eval     Run the tests (claude must be logged in: run \`claude\` once)
   npx firegoat login    Log in to firegoat.ai: eval then uploads each session there
   npx firegoat logout   Forget that login
-  npx firegoat feedback "<what got in the way>"   tell the firegoat team
+  npx firegoat feedback "<what got in the way>"   Tell the firegoat team
 
 Typical flow for a coding agent driving firegoat:
-  1. read npx firegoat init --help, then edit firegoat.yaml
+  1. Read npx firegoat init --help, then edit firegoat.yaml
   2. npx firegoat eval --json
-  3. judge each run's end_goal from its run.json, session and workdir: firegoat only
+  3. Judge each run's end_goal from its run.json, session and workdir: firegoat only
      runs the script checks
 
 Run firegoat <command> --help for details and examples.
 
 ${EXIT_CODES}`;
 }
-var INIT_HELP = `Usage: firegoat init [--force] [--no-skills] [--no-login]
+var INIT_HELP = `Usage: firegoat init [--force] [--local-skills | --no-skills] [--no-login]
 
 In the current folder: creates .firegoat/ and a starter firegoat.yaml, installs the
-firegoat-onboarding skill into .claude/skills/ (npx skills
-add firegoat-ai/skills; asks first in a terminal), offers firegoat login (in a
-terminal only; otherwise prints how), then prints a prompt to paste into
-your coding agent. In .firegoat/, git ignores everything but fixtures/: keep test fixtures
-(helper scripts, sample data) in .firegoat/fixtures/ and commit them.
-
-  --force       replace an existing firegoat.yaml
-  --no-skills   don't install the skill
-  --no-login    Don't offer firegoat login
+firegoat-onboarding skill globally, into ~/.claude/skills/ (npx skills add
+firegoat-ai/skills -g; in a terminal it asks: global, this repo, or none), offers
+firegoat login (in a terminal only; otherwise prints how), then prints a prompt to
+paste into your coding agent. In .firegoat/, git ignores everything but fixtures/
+and the .gitignore: keep test fixtures (helper scripts, sample data) in
+.firegoat/fixtures/ and commit them, and .firegoat/.gitignore, with firegoat.yaml.
+
+  --force          Replace an existing firegoat.yaml
+  --local-skills   Install the skill into this repo's .claude/skills/ instead
+                   (commit it so teammates and CI get it), without asking
+  --no-skills      Don't install the skill
+  --no-login       Don't offer firegoat login
 
 firegoat.yaml reference:
-  runs: 1                     runs per test
+  runs: 1                     Runs per test
   model: <name> | [<name>, ...]
                               claude --model; a list runs every test runs times
                               per model (n counts 1..runs x models). Unset: no
                               --model, claude's default. eval --model overrides
-  setup: <sh> | [<sh>, ...]   once per eval, in this folder; what it writes to
+  build: <sh> | [<sh>, ...]   Once per eval, in this folder; what it writes to
                               $FIREGOAT_OUT is first on the agent's PATH
-  workdir_setup: <sh> | [...] in each fresh folder before the agent starts
-  vars: {KEY: value}          defaults for {{vars.KEY}} in prompts and checks;
+  install: <sh> | [<sh>, ...] In each fresh folder, before the agent starts
+  vars: {KEY: value}          Defaults for {{vars.KEY}} in prompts and checks;
                               --var KEY=value overrides
-  env: {NAME: value}          env vars for the agent, and for workdir_setup and
+  env: {NAME: value}          Env vars for the agent, and for install and
                               checks of the same run; values are strings and can
                               use {{vars.KEY}}, {{run.id}}, {{run.n}},
                               {{test.name}}, $FIREGOAT_OUT, $FIREGOAT_WORKDIR
                               (no other $ expansion: $HOME stays literal).
-                              setup gets only the entries that use nothing but
+                              The build step gets only the entries that use only
                               {{vars.*}}, {{run.id}} and $FIREGOAT_OUT.
                               PATH, CLAUDE_CONFIG_DIR, FIREGOAT_* and
                               ANTHROPIC_MODEL (use model:) are reserved.
                               Runs go 4 at a time: give a tool with a global home
                               a per-run one (or use eval --parallel 1), e.g.
                     MYTOOL_HOME: "/tmp/mytool-{{run.id}}-{{test.name}}-{{run.n}}"
+                              Setting HOME: on macOS claude reads its login from
+                              $HOME/Library, so a per-run HOME needs
+                              ln -s <real home>/Library "$HOME/Library" in
+                              install (get the real home in build, which
+                              doesn't get entries using {{test.name}}/{{run.n}}).
   tests:
-    - name: quickstart        letters, digits, '.', '_', '-'; unique
-      prompt: ...             what a user would ask the agent; one concrete outcome
-      end_goal: ...           what is true when the problem is solved; not graded by
+    - name: quickstart        Letters, digits, '.', '_', '-'; unique
+      prompt: ...             What a user would ask the agent; one concrete outcome
+      end_goal: ...           What is true when the problem is solved; not graded by
                               firegoat, handed to you to judge
-      checks:                 optional shell commands, run in the agent's folder
-        - run: ...            afterwards; exit 0 = pass; they set eval's exit code
-      timeout: 600            optional, seconds
-      env: {NAME: value}      optional, on top of the top-level env:
+      checks:                 Optional shell commands, run in the agent's folder
+        - run: ...            Afterwards; exit 0 = pass; they set eval's exit code
+      timeout: 600            Optional, seconds
+      env: {NAME: value}      Optional, on top of the top-level env:
 
   Unknown keys are errors. Keep helper files out of firegoat.yaml: put them in
-  .firegoat/fixtures/ and copy them in setup or workdir_setup. setup, workdir_setup and checks get the vars as env vars,
-  plus $FIREGOAT_OUT and $FIREGOAT_WORKDIR. Checks also get $FIREGOAT_TRANSCRIPT, a short
-  plain-text transcript ("[1] $ <command>" per shell call, "[2] Write <path>", then
-  each output), and
-  $FIREGOAT_SESSION (claude's full session file, JSON lines).
+  .firegoat/fixtures/ and copy them in build or install. The build and install
+  commands and the checks get the vars as env vars, plus $FIREGOAT_OUT and
+  $FIREGOAT_WORKDIR. Checks also get $FIREGOAT_TRANSCRIPT, a short plain-text
+  transcript, greppable line by line: "[1] $ <command>" on every line of a shell
+  call (one line per line of the command, same n), "[2] Write <path>" for other
+  tools, each output indented, and "agent: " on every line of the agent's text and
+  final answer. So '^\\[[0-9]+\\] \\$ .*foo' matches only commands. Checks also
+  get $FIREGOAT_SESSION (claude's full session file, JSON lines).
 
   The agent never gets vars, only env:. The vars npm/npx set for firegoat itself
   (npm_config_*, npm_lifecycle_*, npm_package_*, npm_execpath, npm_node_execpath,
@@ -7892,8 +7904,8 @@ firegoat.yaml reference:
   (FIREGOAT_API_KEY above all) firegoat itself was started with.
 
 Example:
-  setup: npm pack --pack-destination "$FIREGOAT_OUT"
-  workdir_setup: npm init -y >/dev/null && npm install "$FIREGOAT_OUT"/*.tgz
+  build: npm pack --pack-destination "$FIREGOAT_OUT"
+  install: npm init -y >/dev/null && npm install "$FIREGOAT_OUT"/*.tgz
   tests:
     - name: first-call
       prompt: >-
@@ -7916,7 +7928,7 @@ Logs in to firegoat.ai so eval uploads each run's claude session there as a priv
 trace (you share it from its page). OAuth device flow: prints a URL and a code (and
 opens the browser in a terminal); approve it there, and the trace key is saved to
 ~/.firegoat/credentials.json (mode 0600). The key is never passed to the agent,
-setup, workdir_setup or checks, but the agent runs as you, without a sandbox: it can
+build, install or checks, but the agent runs as you, without a sandbox: it can
 read ~/.firegoat, and a FIREGOAT_API_KEY in firegoat's own process env (ps eww,
 /proc/<pid>/environ). Use a dedicated key in CI. The key can only upload and read
 your own traces; revoke it on the firegoat.ai traces page.
@@ -7947,7 +7959,7 @@ var EVAL_HELP = `Usage: firegoat eval [test..] [--runs N] [--model NAME].. [--pa
                      [--var KEY=value].. [--json] [--no-upload] [--claude-bin PATH]
 
 Runs each test in firegoat.yaml (in the current folder): your claude gets the prompt
-in a fresh, empty folder, .firegoat/runs/<runId>/<test>/<n>/work, with setup:'s
+in a fresh, empty folder, .firegoat/runs/<runId>/<test>/<n>/work, with build:'s
 outputs on PATH. Then the test's checks run in that folder.
 
 claude runs on its own login (or ANTHROPIC_API_KEY if set, as claude always does)
@@ -7957,20 +7969,21 @@ sandbox: the agent can reach the rest of your machine, including the repo.
 
 In a linked git worktree (git worktree add), .firegoat/runs/ and .firegoat/.claude
 live in the main checkout instead, so runs outlive the worktree; firegoat.yaml,
-fixtures and setup: stay in the current folder.
+fixtures and build: stay in the current folder.
 
-  test..             only these tests (by name)
-  --runs N           runs per test (overrides runs: in firegoat.yaml)
+  test..             Only these tests (by name)
+  --runs N           Runs per test (overrides runs: in firegoat.yaml)
   --model NAME       claude --model, replacing model: in firegoat.yaml; repeat it
                      (--model a --model b) to run each test runs times per model
-  --parallel N       runs at once (default 4; 1 runs them one after another).
+  --parallel N       Runs at once (default 4; 1 runs them one after another).
                      Tools with global on-disk state collide: give each run its
                      own home via env: ({{run.id}}-{{test.name}}-{{run.n}}) or use 1
-  --var KEY=value    fills {{vars.KEY}}; env for setup, workdir_setup and checks
-  --json             the summary as JSON on stdout (or {error, exitCode} if eval
+  --var KEY=value    Fills {{vars.KEY}}; env for build, install and checks
+  --json             The summary as JSON on stdout (or {error, exitCode} if eval
                      stops early); progress goes to stderr
   --no-upload        Keep runs local even when logged in to firegoat.ai
-  --claude-bin PATH  claude binary (env FIREGOAT_CLAUDE_BIN; default: claude on PATH)
+  --claude-bin PATH  Path to claude (env FIREGOAT_CLAUDE_BIN; default: claude on
+                     PATH)
 
 Upload: after firegoat login (or with FIREGOAT_API_KEY), each run's claude session,
 checks.txt and stderr.txt go to firegoat.ai as a private trace, and its URL is
@@ -7983,13 +7996,13 @@ Runs without a session file are not uploaded. FIREGOAT_BASE_URL points elsewhere
 (default https://firegoat.ai/evals). See firegoat login --help.
 
 Output: .firegoat/runs/<runId>/
-  summary.json            every run, plus totals, dir (where eval ran),
+  summary.json            Every run, plus totals, dir (where eval ran),
                           git {branch, commit, dirty} (no git outside a repo)
                           and upload {origin, email} (null when not uploading)
-  ../index.jsonl          one line per eval: runId, startedAt, dir, branch,
+  ../index.jsonl          One line per eval: runId, startedAt, dir, branch,
                           commit, passed, failed, notGraded, cost, uploaded,
                           uploadFailed
-  <test>/<n>/run.json     one run: status and reason (from the checks), model
+  <test>/<n>/run.json     One run: status and reason (from the checks), model
                           (asked for, or null) and claudeModel (what claude's
                           init line reported), prompt, end_goal,
                           checks [{run, code}], and paths: workdir,
@@ -7997,19 +8010,21 @@ Output: .firegoat/runs/<runId>/
                           checksLog; startedAt; upload ({status: "uploaded",
                           url} | {status: "failed", error} | {status:
                           "skipped", reason}, null when not uploading)
-  <test>/<n>/transcript.txt  what the agent did: each tool call with its command,
-                          short output, its final answer, files it made
-  setup.txt, <test>/<n>/workdir_setup.txt, checks.txt   logs
+  <test>/<n>/transcript.txt  What the agent did: each tool call with its command
+                          ("[n] $ " on every line of a shell call), short output
+                          (indented), its text and final answer ("agent: " on
+                          every line), files it made
+  build.txt, <test>/<n>/install.txt, checks.txt   Logs
 
 Grading: firegoat runs only the script checks; they set the exit code. end_goal is
 yours to judge: read transcript.txt first (a few KB); the session file has everything
 (often 50x larger).
 
 Examples:
-  npx firegoat eval --json                  all tests, JSON summary on stdout
-  npx firegoat eval quickstart --runs 3     one test, three runs
+  npx firegoat eval --json                  All tests, JSON summary on stdout
+  npx firegoat eval quickstart --runs 3     One test, three runs
   npx firegoat eval --model claude-haiku-5-5 --model claude-sonnet-5-5
-                                            each test on both models
+                                            Each test on both models
   npx firegoat eval --var SHA=$(git rev-parse HEAD)
 
 A run can take minutes (default timeout 600s per test).
@@ -8022,8 +8037,8 @@ firegoat confused you, failed you or cost you tokens, say so here: one concrete
 title, then what you ran and what happened in --body (- reads stdin).
 
   "<title>"     8-200 characters, e.g. "eval hid claude's spend-limit error"
-  --body TEXT   details: commands, output, what you expected
-  --type        bug, feature_request or feedback (default)
+  --body TEXT   Details: commands, output, what you expected
+  --type        One of bug, feature_request or feedback (default)
 
 Sent along: the firegoat version, your OS and node version, and which agent you are
 (claude-code/codex/cursor, from the environment). Don't include secrets: a report that
@@ -8037,7 +8052,7 @@ Example:
 
 Exit codes: 0 sent, 2 the service failed (or rate limit), 3 usage error.`;
 
-// src/setup.ts
+// src/steps.ts
 import { createWriteStream } from "node:fs";
 var STEP_TIMEOUT_MS = 600000;
 async function runSteps(opts) {
@@ -8077,18 +8092,20 @@ function truncate(text, maxLines, maxChars) {
   return out.length < text.length ? `${out}
 … (${text.length - out.length} more chars)` : out;
 }
-function indent(text) {
+function prefixLines(prefix, text) {
   return text.split(`
-`).map((l) => `    ${l}`).join(`
+`).map((l) => `${prefix}${l}`).join(`
 `);
 }
-function describeCall(name, input) {
+var indent = (text) => prefixLines("    ", text);
+var prose = (text) => prefixLines("agent: ", text);
+function describeCall(step, name, input) {
   if (typeof input.command === "string")
-    return `$ ${input.command}`;
+    return prefixLines(`[${step}] $ `, input.command);
   for (const key of ["file_path", "path", "url", "pattern", "query"])
     if (typeof input[key] === "string")
-      return `${name} ${input[key]}`;
-  return `${name} ${truncate(JSON.stringify(input), 1, 300)}`;
+      return `[${step}] ${name} ${input[key]}`;
+  return `[${step}] ${name} ${truncate(JSON.stringify(input), 1, 300)}`;
 }
 function resultText(content) {
   if (typeof content === "string")
@@ -8125,10 +8142,10 @@ function writeTranscript(opts) {
     if (e?.type === "assistant")
       for (const b of content) {
         if (b.type === "tool_use")
-          out.push(`[${++step}] ${describeCall(String(b.name), b.input ?? {})}`);
+          out.push(describeCall(++step, String(b.name), b.input ?? {}));
         else if (b.type === "text" && typeof b.text === "string") {
           lastText = out.length;
-          out.push(`agent: ${truncate(b.text, 30, TEXT_CHARS)}`);
+          out.push(prose(truncate(b.text, 30, TEXT_CHARS)));
         }
       }
     else if (e?.type === "user")
@@ -8143,9 +8160,9 @@ ${indent(truncate(text, OUTPUT_LINES, OUTPUT_CHARS))}` : `    → ${status}`);
     else if (e?.type === "result" && typeof e.result === "string")
       final = e.result;
   }
-  if (lastText === out.length - 1 && final && out[lastText] === `agent: ${truncate(final, 30, TEXT_CHARS)}`)
+  if (lastText === out.length - 1 && final && out[lastText] === prose(truncate(final, 30, TEXT_CHARS)))
     out.pop();
-  out.push("", "## final answer", final || "(none)");
+  out.push("", "## final answer", final ? prose(final) : "(none)");
   out.push("", "## files in the workdir", ...workdirFiles(opts.workdir));
   writeFileSync2(opts.path, `${out.join(`
 `)}
@@ -8243,13 +8260,13 @@ function plainUI(write) {
   const printed = new Set;
   const uploadPrinted = new Set;
   return {
-    auth: (text) => write(`auth: ${text}`),
+    auth: (text) => write(`Auth: ${text}`),
     note: write,
-    setup: (state, seconds) => {
+    build: (state, seconds) => {
       if (state === "running")
-        write("setup...");
+        write("Build...");
       else if (state === "fail")
-        write(`setup failed (${seconds}s)`);
+        write(`Build failed (${seconds}s)`);
     },
     runs: (r) => {
       rows = r;
@@ -8277,14 +8294,14 @@ function plainUI(write) {
       const tr = tier(all);
       write("");
       write(`${c.pass} passed, ${c.fail} failed, ${c.error} not graded (${all.length} runs, $${t.cost.toFixed(2)})${tr ? `, tier ${tr}` : ""}`);
-      write(`runs: ${runsDir} (end_goal is for you to judge: read <test>/<n>/transcript.txt)`);
+      write(`Runs: ${runsDir} (end_goal is for you to judge: read <test>/<n>/transcript.txt)`);
     }
   };
 }
 function ttyUI(out, opts) {
   const p = painter(opts.color);
   let rows = [];
-  let setup = null;
+  let build = null;
   let authText = "";
   const notes = [];
   let frame = 0;
@@ -8301,9 +8318,9 @@ function ttyUI(out, opts) {
       case "error":
         return p(C.amber, "NOT GRADED");
       case "running":
-        return p(C.ember, "running   ");
+        return p(C.ember, "Running   ");
       default:
-        return p(C.gray, "queued    ");
+        return p(C.gray, "Queued    ");
     }
   };
   const glyph = (r) => {
@@ -8331,12 +8348,12 @@ function ttyUI(out, opts) {
       rule
     ];
     if (authText)
-      out.push(p(C.gray, `  auth  ${authText}`));
+      out.push(p(C.gray, `  Auth  ${authText}`));
     for (const n of notes)
       out.push(p(C.gray, `  ${cut(n, w - 2)}`));
-    if (setup) {
-      const mark = setup.state === "ok" ? p(C.green, "✓") : setup.state === "fail" ? p(C.red, "✗") : p(C.ember, SPIN[frame % SPIN.length]);
-      out.push(`  ${setup.state === "running" ? p(C.ember, "◐") : p(C.green, "●")}  setup${" ".repeat(Math.max(1, w - 20))}${mark}${setup.seconds !== undefined ? ` ${setup.seconds}s` : ""}`);
+    if (build) {
+      const mark = build.state === "ok" ? p(C.green, "✓") : build.state === "fail" ? p(C.red, "✗") : p(C.ember, SPIN[frame % SPIN.length]);
+      out.push(`  ${build.state === "running" ? p(C.ember, "◐") : p(C.green, "●")}  Build${" ".repeat(Math.max(1, w - 20))}${mark}${build.seconds !== undefined ? ` ${build.seconds}s` : ""}`);
     }
     const modelCols = Math.min(24, Math.max(0, ...rows.map((r) => r.model?.length ?? 0)));
     rows.forEach((r, i) => {
@@ -8346,7 +8363,7 @@ function ttyUI(out, opts) {
       const model = modelCols > 0 ? ` ${p(C.cyan, cut(r.model ?? "", modelCols).padEnd(modelCols))}` : "";
       let detail = "";
       if (r.state === "running")
-        detail = p(C.gray, `turn ${r.turns}`);
+        detail = p(C.gray, `Turn ${r.turns}`);
       else if (r.state === "pass" || r.state === "fail")
         detail = `${checksPassed(r).padEnd(11)} ${p(C.gray, usage(r))}`;
       else if (r.state === "error")
@@ -8381,11 +8398,11 @@ function ttyUI(out, opts) {
     const goated = c.pass === rows.length && rows.length > 0;
     const tally = `${c.pass} PASS · ${c.fail} FAIL · ${c.error} NOT GRADED`;
     const left = goated ? `${rows.length}/${rows.length} runs passed their checks` : tally;
-    const right = goated ? `GOATED · tier ${tr}` : tr ? `tier ${tr}` : "";
+    const right = goated ? `GOATED · tier ${tr}` : tr ? `Tier ${tr}` : "";
     out.push(`  ${goated ? p(C.green, left) : left}${" ".repeat(Math.max(2, w - left.length - right.length - 3))}${goated ? p(C.ember, right) : right}`);
-    out.push(p(C.gray, `  total $${t.cost.toFixed(2)} · ${t.turns} turns · ${duration(finished.seconds)}`));
-    out.push(p(C.gray, `  runs  ${shortPath(finished.runsDir)}/`));
-    out.push(`  checks are a score, not the verdict: judge each end_goal from ${p(C.cyan, "<test>/<n>/transcript.txt")}`);
+    out.push(p(C.gray, `  Total $${t.cost.toFixed(2)} · ${t.turns} turns · ${duration(finished.seconds)}`));
+    out.push(p(C.gray, `  Runs  ${shortPath(finished.runsDir)}/`));
+    out.push(`  Checks are a score, not the verdict: judge each end_goal from ${p(C.cyan, "<test>/<n>/transcript.txt")}`);
     return out;
   };
   const rowsOf = (line) => {
@@ -8413,8 +8430,8 @@ function ttyUI(out, opts) {
     note: (text) => {
       notes.push(text);
     },
-    setup: (state, seconds) => {
-      setup = { state, seconds };
+    build: (state, seconds) => {
+      build = { state, seconds };
       render();
     },
     runs: (r) => {
@@ -8668,7 +8685,7 @@ function parseArgs(args) {
     } else if (flag === "--claude-bin")
       opts.claudeBin = value();
     else if (a.startsWith("-"))
-      throw new UsageError(`unknown flag: ${a}`);
+      throw new UsageError(`Unknown flag: ${a}`);
     else
       opts.names.push(a);
   }
@@ -8772,13 +8789,13 @@ async function runOne(opts) {
     FIREGOAT_WORKDIR: workdir
   });
   const stepEnv = { ...opts.stepEnv, ...env, FIREGOAT_WORKDIR: workdir };
-  if (opts.workdirSetup.length > 0) {
+  if (opts.install.length > 0) {
     const error = await runSteps({
-      what: "workdir_setup",
-      commands: opts.workdirSetup,
+      what: "install",
+      commands: opts.install,
       cwd: workdir,
       env: stepEnv,
-      logPath: join5(dir, "workdir_setup.txt")
+      logPath: join5(dir, "install.txt")
     });
     if (error)
       return done("error", `not graded: ${error}`);
@@ -8869,7 +8886,7 @@ async function evalCommand(args, root) {
     const known = new Set(tests.map((t) => t.name));
     const unknown = opts.names.filter((n) => !known.has(n));
     if (unknown.length > 0)
-      return fatal(EXIT.usage, `unknown test ${unknown.map((n) => JSON.stringify(n)).join(", ")} (known: ${[...known].join(", ")})`);
+      return fatal(EXIT.usage, `Unknown test ${unknown.map((n) => JSON.stringify(n)).join(", ")} (known: ${[...known].join(", ")})`);
     tests = tests.filter((t) => opts.names.includes(t.name));
   }
   const runs = opts.runs ?? config.runs;
@@ -8883,10 +8900,10 @@ async function evalCommand(args, root) {
     ]).flatMap(varRefs).filter((k) => !(k in vars)))
   ];
   if (missing.length > 0)
-    return fatal(EXIT.usage, `no value for ${missing.map((k) => `{{vars.${k}}}`).join(", ")}: pass --var ${missing[0]}=... or set it under vars: in firegoat.yaml`);
+    return fatal(EXIT.usage, `No value for ${missing.map((k) => `{{vars.${k}}}`).join(", ")}: pass --var ${missing[0]}=... or set it under vars: in firegoat.yaml`);
   const claudePath = resolveBin(opts.claudeBin);
   if (!claudePath)
-    return fatal(EXIT.notGraded, `not graded: claude binary ${JSON.stringify(opts.claudeBin)} not found. Install Claude Code (https://claude.com/claude-code) or pass --claude-bin PATH / FIREGOAT_CLAUDE_BIN.`);
+    return fatal(EXIT.notGraded, `Not graded: claude binary ${JSON.stringify(opts.claudeBin)} not found. Install Claude Code (https://claude.com/claude-code) or pass --claude-bin PATH / FIREGOAT_CLAUDE_BIN.`);
   let repo;
   try {
     repo = gitRepo(root);
@@ -8903,7 +8920,7 @@ async function evalCommand(args, root) {
     cwd: root
   });
   if (loginProblem)
-    return fatal(EXIT.notGraded, `not graded: ${loginProblem}`);
+    return fatal(EXIT.notGraded, `Not graded: ${loginProblem}`);
   const evalStarted = Date.now();
   const runId = newRunId();
   let upload;
@@ -8935,23 +8952,23 @@ async function evalCommand(args, root) {
     state: "queued",
     turns: 0
   }))));
-  if (config.setup.length > 0) {
-    const setupStarted = Date.now();
-    ui.setup("running");
+  if (config.build.length > 0) {
+    const buildStarted = Date.now();
+    ui.build("running");
     const error = await runSteps({
-      what: "setup",
-      commands: config.setup,
+      what: "build",
+      commands: config.build,
       cwd: root,
       env: {
         ...stepEnv,
         ...renderEnv(Object.fromEntries(Object.entries(config.env).filter(([, v]) => isEvalLevel(v))), vars, { "run.id": runId, FIREGOAT_OUT: out })
       },
-      logPath: join5(runDir, "setup.txt")
+      logPath: join5(runDir, "build.txt")
     });
-    const secs = Math.round((Date.now() - setupStarted) / 1000);
-    ui.setup(error ? "fail" : "ok", secs);
+    const secs = Math.round((Date.now() - buildStarted) / 1000);
+    ui.build(error ? "fail" : "ok", secs);
     if (error)
-      return fatal(EXIT.notGraded, `not graded: ${error}`);
+      return fatal(EXIT.notGraded, `Not graded: ${error}`);
   }
   ui.runs(rows);
   const results = new Array(rows.length);
@@ -8982,7 +8999,7 @@ async function evalCommand(args, root) {
       runDir,
       claudeBin: claudePath,
       configDir,
-      workdirSetup: config.workdirSetup,
+      install: config.install,
       out,
       stepEnv,
       vars
@@ -9282,7 +9299,7 @@ async function feedbackCommand(args) {
           throw new Error(`--type must be one of ${TYPES.join(", ")}, got ${v}`);
         type = v;
       } else if (a.startsWith("-"))
-        throw new Error(`unknown flag: ${a}`);
+        throw new Error(`Unknown flag: ${a}`);
       else
         titleParts.push(a);
     } catch (e) {
@@ -9292,7 +9309,7 @@ async function feedbackCommand(args) {
   }
   const title = titleParts.join(" ").trim();
   if (title.length < 8 || title.length > 200) {
-    console.error(`firegoat feedback: the title must be 8-200 characters (got ${title.length})`);
+    console.error(`firegoat feedback: The title must be 8-200 characters (got ${title.length})`);
     return EXIT.usage;
   }
   const client = new FeedbackClient({ domain: "firegoat.ai" });
@@ -9310,7 +9327,7 @@ firegoat ${package_default.version}` : `firegoat ${package_default.version}`,
         nodeVersion: process.version
       }
     });
-    console.log(`sent ${type} ${id} to the firegoat team${similarCount > 0 ? ` (${similarCount} similar report${similarCount === 1 ? "" : "s"} already)` : ""}. thanks.`);
+    console.log(`Sent ${type} ${id} to the firegoat team${similarCount > 0 ? ` (${similarCount} similar report${similarCount === 1 ? "" : "s"} already)` : ""}. Thanks.`);
     return EXIT.pass;
   } catch (e) {
     if (e instanceof FeedbackError) {
@@ -9516,6 +9533,12 @@ var SKILLS_ARGV = [
   "--copy",
   "-y"
 ];
+function skillsDir(scope) {
+  if (scope === "local")
+    return ".claude/skills/";
+  const config = process.env.CLAUDE_CONFIG_DIR?.trim();
+  return config ? `${join6(config, "skills")}/` : "~/.claude/skills/";
+}
 function template(product) {
   return `# firegoat.yaml: evals for how well coding agents use ${product}.
 # Each test runs your claude in an empty folder (.firegoat/runs/...) with \`prompt\`
@@ -9529,27 +9552,27 @@ runs: 1
 # model: [claude-haiku-5-5, claude-sonnet-5-5]
 
 # Optional: test your local build instead of the published package.
-# setup: runs once per eval, here; what it writes to $FIREGOAT_OUT is put on the
-# agent's PATH. workdir_setup: runs in each fresh folder before the agent starts.
+# build: runs once per eval, here; what it writes to $FIREGOAT_OUT is put on the
+# agent's PATH. install: runs in each fresh folder before the agent starts.
 #
-# npm:
-# setup: npm pack --pack-destination "$FIREGOAT_OUT"
-# workdir_setup: npm init -y >/dev/null && npm install "$FIREGOAT_OUT"/*.tgz
+# For npm:
+# build: npm pack --pack-destination "$FIREGOAT_OUT"
+# install: npm init -y >/dev/null && npm install "$FIREGOAT_OUT"/*.tgz
 #
-# python:
-# setup: uv build --wheel --out-dir "$FIREGOAT_OUT"
-# workdir_setup: uv venv && uv pip install "$FIREGOAT_OUT"/*.whl
+# For python:
+# build: uv build --wheel --out-dir "$FIREGOAT_OUT"
+# install: uv venv && uv pip install "$FIREGOAT_OUT"/*.whl
 #
-# a CLI binary users call by bare name (on PATH as is):
-# setup: go build -o "$FIREGOAT_OUT/mycli" ./cmd/mycli
-# (an npm/pypi CLI that users run via npx/uvx: pack + install it as above instead;
+# For a CLI binary users call by bare name (on PATH as is):
+# build: go build -o "$FIREGOAT_OUT/mycli" ./cmd/mycli
+# (An npm/pypi CLI that users run via npx/uvx: pack + install it as above instead;
 # a binary on PATH does not stop "npx mycli" from fetching the registry release)
 #
 # Helper files (scripts, sample data) go in .firegoat/fixtures/ (committed), not inline here.
-# setup runs in this folder, so: setup: cp -R .firegoat/fixtures/. "$FIREGOAT_OUT"
-# then e.g. workdir_setup: cp "$FIREGOAT_OUT/wizard.mjs" .
+# The build step runs in this folder, so: build: cp -R .firegoat/fixtures/. "$FIREGOAT_OUT"
+# Then e.g. install: cp "$FIREGOAT_OUT/wizard.mjs" .
 
-# Optional: env vars for the agent (and for workdir_setup and checks of the same
+# Optional: env vars for the agent (and for install and checks of the same
 # run). The agent gets none of vars:, only these. Placeholders: {{vars.KEY}},
 # {{run.id}}, {{run.n}}, {{test.name}}, and $FIREGOAT_OUT / $FIREGOAT_WORKDIR (no
 # other $ expansion: $HOME stays literal). A test can add its own env:.
@@ -9590,15 +9613,30 @@ function copyToClipboard(text) {
     return !r.error && r.status === 0;
   });
 }
-async function askYes(question) {
+async function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const a = (await rl.question(`${question} [Y/n] `)).trim();
-    return a === "" || /^y(es)?$/i.test(a);
+    return (await rl.question(question)).trim();
   } finally {
     rl.close();
   }
 }
+async function askYes(question) {
+  const a = await ask(`${question} [Y/n] `);
+  return a === "" || /^y(es)?$/i.test(a);
+}
+async function askScope(question) {
+  for (;; ) {
+    const a = await ask(`${question} [G/l/n] `);
+    if (a === "" || /^g(lobal)?$/i.test(a))
+      return "global";
+    if (/^l(ocal)?$/i.test(a))
+      return "local";
+    if (/^no?$/i.test(a))
+      return "none";
+    process.stdout.write("\x1B[1A\x1B[2K");
+  }
+}
 var LOGIN_HINT = "Runs stay local: npx firegoat login uploads them to firegoat.ai";
 async function loginStep(interactive, done, paint) {
   const label = "firegoat.ai login";
@@ -9634,7 +9672,8 @@ async function loginStep(interactive, done, paint) {
 }
 async function initCommand(args, cwd) {
   let force = false;
-  let skills = true;
+  let noSkills = false;
+  let localSkills = false;
   let login = true;
   for (const a of args) {
     if (a === "--help" || a === "-h") {
@@ -9644,16 +9683,25 @@ async function initCommand(args, cwd) {
     if (a === "--force" || a === "-f")
       force = true;
     else if (a === "--no-skills")
-      skills = false;
+      noSkills = true;
+    else if (a === "--local-skills")
+      localSkills = true;
     else if (a === "--no-login")
       login = false;
     else {
-      console.error(`firegoat init: unknown argument: ${a}
+      console.error(`firegoat init: Unknown argument: ${a}
 
 ${INIT_HELP}`);
       return EXIT.usage;
     }
   }
+  if (noSkills && localSkills) {
+    console.error(`firegoat init: --no-skills and --local-skills contradict each other: pass one
+
+${INIT_HELP}`);
+    return EXIT.usage;
+  }
+  let scope = noSkills ? "none" : localSkills ? "local" : "global";
   const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
   const color = interactive && !process.env.NO_COLOR;
   const paint = (code, text) => color ? `\x1B[${code}m${text}\x1B[0m` : text;
@@ -9671,21 +9719,24 @@ ${INIT_HELP}`);
   if (!keep)
     writeFileSync4(configPath, template(basename4(cwd)));
   if (interactive) {
-    step(1, CONFIG_FILE, keep ? "kept (--force replaces it)" : "created");
+    step(1, CONFIG_FILE, keep ? "Kept (--force replaces it)" : "Created");
     console.log(paint("90", "  │"));
-    step(2, ".firegoat/", "ready");
+    step(2, ".firegoat/", "Ready");
   } else
-    console.log(keep ? `kept ${CONFIG_FILE} (--force replaces it)` : `wrote ${CONFIG_FILE}: edit the quickstart test to fit your users`);
-  if (skills && interactive) {
+    console.log(keep ? `Kept ${CONFIG_FILE} (--force replaces it)` : `Wrote ${CONFIG_FILE}: edit the quickstart test to fit your users`);
+  if (interactive && !noSkills)
     console.log(paint("90", "  │"));
-    skills = await askYes(`  ${paint("38;5;208", "◉")}  ${paint("90", "03")}  Install the firegoat-onboarding skill?`);
+  if (interactive && !noSkills && !localSkills) {
+    scope = await askScope(`  ${paint("38;5;208", "◉")}  ${paint("90", "03")}  Install the firegoat-onboarding skill globally (~/.claude/skills) or in this repo (.claude/skills)?`);
     process.stdout.write("\x1B[1A\x1B[2K");
   }
-  if (skills) {
+  if (scope !== "none") {
+    const argv = [...SKILLS_ARGV, ...scope === "global" ? ["-g"] : []];
+    const where = skillsDir(scope);
     if (!interactive)
-      console.log(`installing skills: npx ${SKILLS_ARGV.join(" ")}`);
+      console.log(`Installing the skill: npx ${argv.join(" ")}`);
     const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => k !== "npm_config_package" && !k.startsWith("FIREGOAT_")));
-    const r = spawnSync3("npx", ["-y", ...SKILLS_ARGV], {
+    const r = spawnSync3("npx", ["-y", ...argv], {
       cwd,
       env,
       stdio: "pipe",
@@ -9693,21 +9744,21 @@ ${INIT_HELP}`);
     });
     if (r.error || r.status !== 0) {
       process.stderr.write(`${r.stdout ?? ""}${r.stderr ?? ""}`);
-      console.error(`firegoat init: installing the skill failed (${r.error?.message ?? `exit ${r.status}`}). Run it yourself: npx ${SKILLS_ARGV.join(" ")}`);
+      console.error(`firegoat init: Installing the skill failed (${r.error?.message ?? `exit ${r.status}`}). Run it yourself: npx ${argv.join(" ")}`);
       return EXIT.notGraded;
     }
     if (interactive)
-      step(3, "firegoat-onboarding skill", "installed → .claude/skills/");
+      step(3, "firegoat-onboarding skill", `Installed → ${where}`);
     else
-      console.log("installed skill firegoat-onboarding in .claude/skills/");
-    const ignored = spawnSync3("git", ["check-ignore", "-q", ".claude/skills"], {
+      console.log(`Installed skill firegoat-onboarding in ${where}`);
+    const ignored = scope === "local" && spawnSync3("git", ["check-ignore", "-q", ".claude/skills"], {
       cwd,
       env: hostEnv()
-    });
-    if (ignored.status === 0)
-      console.error("warning: git ignores .claude/skills, so teammates and CI won't get the skill. Commit them with: git add -f .claude/skills");
+    }).status === 0;
+    if (ignored)
+      console.error("Warning: git ignores .claude/skills, so teammates and CI won't get the skill. Commit them with: git add -f .claude/skills");
   } else if (interactive)
-    step(3, "firegoat-onboarding skill", "skipped");
+    step(3, "firegoat-onboarding skill", "Skipped");
   if (login) {
     if (interactive)
       console.log(paint("90", "  │"));
@@ -9721,12 +9772,12 @@ Prompt for your coding agent: ${AGENT_PROMPT}`);
     return EXIT.pass;
   }
   console.log(rule);
-  console.log(`  next: hand this to your coding agent
+  console.log(`  Next: hand this to your coding agent
 `);
   console.log(AGENT_PROMPT);
   console.log("");
   const copied = copyToClipboard(AGENT_PROMPT);
-  console.log(`  ${copied ? `${paint("32", "✓ Prompt copied!")}   ` : ""}then: ${paint("36", "npx firegoat eval")}`);
+  console.log(`  ${copied ? `${paint("32", "✓ Prompt copied!")}   ` : ""}Then: ${paint("36", "npx firegoat eval")}`);
   return EXIT.pass;
 }
 
@@ -9754,7 +9805,7 @@ async function main(argv) {
     case "logout":
       return logoutCommand(rest);
     default:
-      console.error(`unknown command: ${cmd}
+      console.error(`Unknown command: ${cmd}
 
 ${topHelp(package_default.version)}`);
       return EXIT.usage;
@@ -9767,7 +9818,7 @@ main(process.argv.slice(2)).then((code) => process.exit(code), (err) => {
   }
   if (err?.code === "ABORT_ERR") {
     console.error(`
-aborted`);
+Aborted.`);
     process.exit(130);
   }
   console.error(err);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "firegoat",
-	"version": "0.16.0",
+	"version": "0.17.0",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/firegoat-ai/firegoat-cli.git"