firegoat 0.26.0 → 0.28.0

package/dist/cli.js

@@ -6947,7 +6947,7 @@ var require_public_api = __commonJS(function(exports) {
 // package.json
 var package_default = {
   name: "firegoat",
-  version: "0.26.0",
+  version: "0.28.0",
   repository: {
     type: "git",
     url: "git+https://github.com/firegoat-ai/firegoat-cli.git"
@@ -7078,6 +7078,7 @@ function steps(events) {
         if (b.type === "tool_use")
           out.push({
             kind: "tool_call",
+            id: typeof b.id === "string" ? b.id : null,
             name: typeof b.name === "string" ? b.name : "",
             input: typeof b.input === "object" && b.input !== null ? b.input : null
           });
@@ -7089,6 +7090,7 @@ function steps(events) {
         if (b.type === "tool_result")
           out.push({
             kind: "tool_result",
+            callId: typeof b.tool_use_id === "string" ? b.tool_use_id : null,
             isError: b.is_error === true,
             text: resultText(b.content).trimEnd()
           });
@@ -7157,7 +7159,7 @@ function read(stdout, exited, timeoutMs) {
       reportedModel,
       version,
       ok: false,
-      reason: `claude result is an error (subtype=${result.subtype})${result.result ? `: ${result.result.slice(0, 300)}` : ""}`,
+      reason: `claude reported an error${result.subtype === undefined || result.subtype === "success" ? "" : ` (${result.subtype})`}${result.result ? `: ${result.result.slice(0, 300)}` : ""}`,
       sessionId
     };
   return { ...trace, reportedModel, version, ok: true, sessionId };
@@ -7208,6 +7210,7 @@ var claude = {
   bin: "claude",
   installHint: "Install Claude Code (https://claude.com/claude-code) or pass --harness-bin PATH.",
   configDirName: ".claude",
+  argsKey: "claude_args",
   reservedArgs: [
     [["-p", "--print", ...FLAGS.filter((f) => f.startsWith("-"))], SET],
     [["--model"], "choose the model with top-level model: (or eval --model)"],
@@ -7216,7 +7219,7 @@ var claude = {
       "every run is a fresh session"
     ]
   ],
-  uploads: true,
+  claudeSessionFile: true,
   args: ({ prompt, model, extraArgs }) => [
     "-p",
     prompt,
@@ -7231,6 +7234,7 @@ var claude = {
   }),
   authLabel: () => process.env.ANTHROPIC_API_KEY ? "ANTHROPIC_API_KEY (claude bills the API key; unset it to use your claude login)" : "your claude login",
   checkLogin,
+  isFinal: (line) => parse(line)?.type === "result",
   progress,
   read,
   sessionsDir: (configDir) => join(configDir, "projects"),
@@ -7342,24 +7346,27 @@ function itemInput(item) {
 function steps2(events) {
   const out = [];
   const started = new Set;
-  for (const e of events) {
+  for (const [i, e] of events.entries()) {
     const item = e?.item;
     if (!item)
       continue;
+    const id = typeof item.id === "string" ? item.id : `event_${i}`;
     if (item.type === "command_execution") {
       const call = {
         kind: "tool_call",
+        id,
         name: "shell",
         input: { command: unwrapShell(str(item.command)) }
       };
       if (e?.type === "item.started") {
-        started.add(item.id);
+        started.add(id);
         out.push(call);
       } else if (e?.type === "item.completed") {
-        if (item.id === undefined || !started.has(item.id))
+        if (!started.has(id))
           out.push(call);
         out.push({
           kind: "tool_result",
+          callId: id,
           isError: item.exit_code !== 0,
           text: str(item.aggregated_output).trimEnd()
         });
@@ -7374,6 +7381,7 @@ function steps2(events) {
     } else if (item.type !== "reasoning" && item.type !== "error")
       out.push({
         kind: "tool_call",
+        id,
         name: str(item.type),
         input: itemInput(item)
       });
@@ -7522,6 +7530,7 @@ var codex = {
   bin: "codex",
   installHint: "Install Codex CLI (https://github.com/openai/codex) or pass --harness-bin PATH.",
   configDirName: ".codex",
+  argsKey: "codex_args",
   reservedArgs: [
     [[...FLAGS2, "-C", "--cd"], "firegoat sets it for every run"],
     [
@@ -7531,7 +7540,7 @@ var codex = {
     [["resume", "fork"], "every run is a fresh session"],
     [["--ephemeral"], "firegoat reads the session file codex saves"]
   ],
-  uploads: false,
+  claudeSessionFile: false,
   args: ({ prompt, model, extraArgs, cwd }) => [
     "exec",
     ...FLAGS2,
@@ -7549,6 +7558,10 @@ var codex = {
   }),
   authLabel: () => `your codex login (${join3(userCodexHome(), "auth.json")})${process.env.CODEX_API_KEY ? "; CODEX_API_KEY is set and passes through" : ""}`,
   checkLogin: checkLogin2,
+  isFinal: (line) => {
+    const type = parse2(line)?.type;
+    return type === "turn.completed" || type === "turn.failed";
+  },
   progress: progress2,
   read: read2,
   sessionsDir: (configDir) => join3(configDir, "sessions"),
@@ -7624,6 +7637,7 @@ function toolResult(b) {
 `) : "";
   return {
     kind: "tool_result",
+    callId: typeof b.tool_use_id === "string" ? b.tool_use_id : null,
     isError: b.is_error === true || failed,
     text: text.trimEnd()
   };
@@ -7636,6 +7650,7 @@ function steps3(events) {
         if (b.type === "tool_use")
           out.push({
             kind: "tool_call",
+            id: typeof b.id === "string" ? b.id : null,
             name: typeof b.name === "string" ? b.name : "",
             input: isObject(b.input) ? b.input : null
           });
@@ -7653,7 +7668,7 @@ function steps3(events) {
 function resultError(result) {
   const errors = Array.isArray(result.errors) ? result.errors.filter((x) => typeof x === "string").join("; ") : "";
   const said = errors || result.result || "";
-  return `grok result is an error (subtype=${result.subtype})${said ? `: ${said.slice(0, 300)}` : ""}`;
+  return `grok reported an error${result.subtype === undefined || result.subtype === "success" ? "" : ` (${result.subtype})`}${said ? `: ${said.slice(0, 300)}` : ""}`;
 }
 function read3(stdout, exited, timeoutMs) {
   const events = stdout.split(`
@@ -7786,6 +7801,7 @@ var grok = {
   bin: BIN,
   installHint: "Install grok (curl -fsSL https://x.ai/cli/install.sh | bash) or pass --harness-bin PATH.",
   configDirName: ".grok",
+  argsKey: "grok_args",
   reservedArgs: [
     [
       [
@@ -7821,7 +7837,7 @@ var grok = {
       "every run is a fresh session"
     ]
   ],
-  uploads: false,
+  claudeSessionFile: false,
   args: ({ prompt, model, extraArgs }) => [
     "-p",
     prompt,
@@ -7836,6 +7852,7 @@ var grok = {
   }),
   authLabel: () => `your grok login (${USER_AUTH})`,
   checkLogin: checkLogin3,
+  isFinal: (line) => parse3(line)?.type === "result",
   progress: progress3,
   read: read3,
   sessionsDir: (configDir) => join4(configDir, "sessions"),
@@ -7906,7 +7923,7 @@ function parseConfig(text) {
     "cleanup",
     "vars",
     "env",
-    "harness_args",
+    ...ARGS_KEYS,
     "tests"
   ]);
   const runs = posInt(raw.runs, "runs", 1);
@@ -7921,7 +7938,7 @@ function parseConfig(text) {
   const cleanup = commands(raw.cleanup, "cleanup", RUN_PLACEHOLDERS);
   const vars = parseVars(raw.vars);
   const env = parseEnv(raw.env, "env");
-  const harnessArgs = parseHarnessArgs(raw.harness_args, "harness_args");
+  const harnessArgs = parseAllHarnessArgs(raw, "");
   if (!Array.isArray(raw.tests) || raw.tests.length === 0)
     fail("tests", "must be a non-empty list");
   const names = new Set;
@@ -7938,7 +7955,7 @@ function parseConfig(text) {
       "env",
       "install",
       "cleanup",
-      "harness_args"
+      ...ARGS_KEYS
     ]);
     const name = str2(t.name, `${p}.name`);
     if (!NAME.test(name))
@@ -7968,10 +7985,7 @@ function parseConfig(text) {
       env: { ...env, ...parseEnv(t.env, `${p}.env`) },
       install: commands(t.install, `${p}.install`, RUN_PLACEHOLDERS),
       cleanup: commands(t.cleanup, `${p}.cleanup`, RUN_PLACEHOLDERS),
-      harnessArgs: [
-        ...harnessArgs,
-        ...parseHarnessArgs(t.harness_args, `${p}.harness_args`)
-      ]
+      harnessArgs: mergeHarnessArgs(harnessArgs, parseAllHarnessArgs(t, `${p}.`))
     };
   });
   return {
@@ -8014,26 +8028,35 @@ function nameList(raw, key, what) {
     return name;
   });
 }
-function parseHarnessArgs(raw, path) {
+var ARGS_KEYS = [...HARNESSES.values()].map((h) => h.argsKey);
+function parseAllHarnessArgs(raw, prefix) {
+  const out = {};
+  for (const h of HARNESSES.values())
+    out[h.name] = parseHarnessArgs(raw[h.argsKey], `${prefix}${h.argsKey}`, h);
+  return out;
+}
+function mergeHarnessArgs(top, test) {
+  const out = {};
+  for (const name of HARNESSES.keys())
+    out[name] = [...top[name] ?? [], ...test[name] ?? []];
+  return out;
+}
+function parseHarnessArgs(raw, path, harness) {
   if (raw === undefined)
     return [];
   if (!Array.isArray(raw))
-    fail(path, "must be a list of harness arguments, one per entry, e.g. [--chrome]");
+    fail(path, `must be a list of ${harness.name} arguments, one per entry, e.g. [--flag, value]`);
   return raw.map((a, i) => {
     const p = `${path}[${i}]`;
     const arg = str2(a, p);
     checkPlaceholders(arg, p, RUN_PLACEHOLDERS);
+    for (const [flags, why] of harness.reservedArgs)
+      for (const f of flags)
+        if (arg === f || arg.startsWith(`${f}=`))
+          fail(p, `${f} is not allowed for ${harness.name}: ${why}`);
     return { arg, path: p };
   });
 }
-function checkHarnessArgs(tests, harness) {
-  for (const t of tests)
-    for (const { arg, path } of t.harnessArgs)
-      for (const [flags, why] of harness.reservedArgs)
-        for (const f of flags)
-          if (arg === f || arg.startsWith(`${f}=`))
-            fail(path, `${f} is not allowed for ${harness.name}: ${why}`);
-}
 var VAR_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function parseVars(raw) {
   if (raw === undefined)
@@ -8151,9 +8174,9 @@ import {
   appendFileSync,
   createWriteStream as createWriteStream2,
   mkdirSync as mkdirSync5,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
-import { basename as basename3, delimiter as delimiter2, join as join10 } from "node:path";
+import { basename as basename2, delimiter as delimiter2, join as join10 } from "node:path";
 
 // src/agent-dirs.ts
 import { createHash, randomInt } from "node:crypto";
@@ -8516,6 +8539,26 @@ var CLAUDE_AUTH = /^CLAUDE_CODE_(OAUTH_TOKEN|OAUTH_REFRESH_TOKEN|USE_[A-Z_]+|SKI
 function hostEnv() {
   return Object.fromEntries(Object.entries(process.env).filter(([k]) => !NPM_INJECTED.test(k) && !k.startsWith("FIREGOAT_") && (!CLAUDE_SESSION.test(k) || CLAUDE_AUTH.test(k))));
 }
+var GRACE_MS = 5000;
+var liveGroups = new Set;
+var signalsHooked = false;
+function hookSignals() {
+  if (signalsHooked)
+    return;
+  signalsHooked = true;
+  const onSignal = (signal) => {
+    for (const g of liveGroups)
+      try {
+        process.kill(-g, "SIGKILL");
+      } catch {}
+    process.kill(process.pid, signal);
+  };
+  for (const s of ["SIGINT", "SIGTERM", "SIGHUP"])
+    process.once(s, onSignal);
+}
+function forgetGroup(pgid) {
+  liveGroups.delete(pgid);
+}
 function processTree(pid) {
   const children = new Map;
   const ps = execFileSync("ps", ["-A", "-o", "pid=,ppid="], {
@@ -8533,7 +8576,11 @@ function processTree(pid) {
     tree.push(...children.get(tree[i]) ?? []);
   return tree;
 }
-function killTree(pid) {
+function killTree(pid, group) {
+  if (group)
+    try {
+      process.kill(-pid, "SIGKILL");
+    } catch {}
   let tree = [pid];
   let problem;
   try {
@@ -8549,18 +8596,27 @@ function killTree(pid) {
 }
 function run(opts) {
   return new Promise((resolve) => {
+    const detached = opts.detached === true;
+    if (detached)
+      hookSignals();
     const child = spawn(opts.cmd, opts.args, {
       cwd: opts.cwd,
       env: opts.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      detached
     });
+    if (child.pid !== undefined) {
+      if (detached)
+        liveGroups.add(child.pid);
+      opts.onSpawn?.(child.pid);
+    }
     let timedOut = false;
     let settled = false;
     const timer = setTimeout(() => {
       timedOut = true;
       if (child.pid === undefined)
         return;
-      const problem = killTree(child.pid);
+      const problem = killTree(child.pid, detached);
       if (problem)
         opts.onStderr(Buffer.from(`firegoat: timed out; could not list ${opts.cmd}'s child processes (${problem}), killed only ${opts.cmd}
 `));
@@ -8574,6 +8630,7 @@ function run(opts) {
     };
     child.stdout.on("data", opts.onStdout);
     child.stderr.on("data", opts.onStderr);
+    opts.finalSeen?.then(() => setTimeout(() => done({ code: null, timedOut: false, ended: true }), GRACE_MS).unref());
     child.on("error", (error) => done({ code: null, timedOut, error }));
     child.on("close", (code) => done({ code, timedOut }));
     child.on("exit", (code) => setTimeout(() => {
@@ -8666,41 +8723,54 @@ function gitRepo(dir) {
 async function runAgent(harness, opts) {
   let stdout = "";
   let pending = "";
+  let group;
+  let markFinal = () => {};
+  const finalSeen = new Promise((r) => {
+    markFinal = r;
+  });
   const exited = await run({
     cmd: opts.bin,
     args: harness.args(opts),
     cwd: opts.cwd,
     env: opts.env,
     timeoutMs: opts.timeoutMs,
+    detached: true,
+    finalSeen,
+    onSpawn: (pid) => {
+      group = pid;
+    },
     onStdout: (c) => {
       const text = c.toString();
       stdout += text;
-      if (!opts.onProgress)
-        return;
       pending += text;
       const lines = pending.split(`
 `);
       pending = lines.pop() ?? "";
       for (const line of lines) {
-        const p = harness.progress(line);
+        if (harness.isFinal(line))
+          markFinal();
+        const p = opts.onProgress && harness.progress(line);
         if (p)
-          opts.onProgress(p);
+          opts.onProgress?.(p);
       }
     },
     onStderr: (c) => opts.stderr.write(c)
   });
   if (exited.error)
     return {
-      ok: false,
-      reason: `could not start ${opts.bin}: ${exited.error.message}`,
-      steps: [],
-      final: "",
-      reportedModel: null,
-      version: null,
-      turns: null,
-      cost: null
+      group,
+      outcome: {
+        ok: false,
+        reason: `could not start ${opts.bin}: ${exited.error.message}`,
+        steps: [],
+        final: "",
+        reportedModel: null,
+        version: null,
+        turns: null,
+        cost: null
+      }
     };
-  return harness.read(stdout, exited, opts.timeoutMs);
+  return { group, outcome: harness.read(stdout, exited, opts.timeoutMs) };
 }
 
 // src/help.ts
@@ -8743,19 +8813,22 @@ turns it off; FIREGOAT_TELEMETRY accepts only 0 or 1.
 
 ${EXIT_CODES}`;
 }
-var INIT_HELP = `Usage: firegoat init [--force] [--local-skills | --no-skills] [--no-login]
+var INIT_HELP = `Usage: firegoat init [--force] [--local-skills | --global-skills | --no-skills]
+                     [--no-login]
 
 In the current folder: creates .firegoat/ and a starter firegoat.yaml, installs the
-firegoat-onboarding skill globally, into ~/.claude/skills/ (npx skills add
-firegoat-ai/skills -g; in a terminal it asks: global, this repo, or none), offers
-firegoat login (in a terminal only; otherwise prints how), then prints a prompt to
+firegoat-onboarding skill (npx skills add firegoat-ai/skills; in a terminal it asks:
+global into ~/.claude/skills/, this repo, or none; otherwise, e.g. run by a coding
+agent, it installs into this repo's .claude/skills/), offers firegoat login (in a terminal only; otherwise prints how), then prints a prompt to
 paste into your coding agent. .firegoat/ holds local run output and ignores itself
 in git. Keep test fixtures (helper scripts, sample data) in fixtures/ next to
 firegoat.yaml, committed.
 
   --force          Replace an existing firegoat.yaml
-  --local-skills   Install the skill into this repo's .claude/skills/ instead
-                   (commit it so teammates and CI get it), without asking
+  --local-skills   Install the skill into this repo's .claude/skills/ (commit it
+                   so teammates and CI get it), without asking
+  --global-skills  Install the skill into ~/.claude/skills/ (skills add -g),
+                   without asking
   --no-skills      Don't install the skill
   --no-login       Don't offer firegoat login
 
@@ -8778,8 +8851,10 @@ firegoat.yaml reference:
   install: <sh> | [<sh>, ...] In each fresh folder, before the agent starts; a
                               failure: that run is not graded
   cleanup: <sh> | [<sh>, ...] In each run's folder once the run is over: after the
-                              checks, and also after an error or timeout. Stops
-                              what the agent left running (servers, daemons).
+                              checks, and also after an error or timeout. For
+                              what lives outside the run (e.g. seeded data);
+                              processes the agent left running are stopped by
+                              firegoat after cleanup (see eval --help).
                               Every step runs; a failure is a warning (run.json
                               cleanup, <test>/<n>/cleanup.txt), never the verdict
   vars: {KEY: value}          Defaults for {{vars.KEY}} in prompts, checks and
@@ -8801,27 +8876,33 @@ firegoat.yaml reference:
                               tool that keeps state in ~ starts fresh in each
                               run. Only a tool that ignores HOME needs its own
                               var, e.g. MYTOOL_HOME: "$FIREGOAT_HOME/.mytool"
-  harness_args: [<arg>, ...]  Extra harness arguments, after firegoat's own flags
-                              and --model (for codex, before the prompt), to
-                              every selected harness. Each entry is one
-                              argument, passed as-is (no shell splitting):
-                              claude: [--chrome] (Claude in Chrome, for tests
-                              that need a browser), [--plugin-dir, ./plugins/x],
-                              --mcp-config, --agents, --append-system-prompt;
-                              codex: [-c, key=value], --enable, --add-dir.
+  claude_args: [<arg>, ...]   Extra claude-code arguments, after firegoat's own
+                              flags and --model. Each entry is one argument,
+                              passed as-is (no shell splitting): [--chrome]
+                              (Claude in Chrome, for tests that need a browser),
+                              [--plugin-dir, ./plugins/x], --mcp-config,
+                              --agents, --append-system-prompt
+  codex_args: [<arg>, ...]    Extra codex-cli arguments, before the prompt:
+                              [-c, key=value], --enable, --add-dir
+  grok_args: [<arg>, ...]     Extra grok-cli arguments, after firegoat's flags.
+                              Each key goes to its harness only. A key for a
+                              harness this eval doesn't run is checked but not
+                              used, so one firegoat.yaml can carry args for
+                              every --harness.
                               Entries expand like env: values
                               ($FIREGOAT_WORKDIR, $FIREGOAT_HOME, $FIREGOAT_OUT,
                               {{vars.KEY}}, {{run.*}}); run.json harnessArgs has
-                              the result. Flags firegoat sets are errors, also
-                              as --flag=value. claude-code: -p, --print,
-                              --output-format, --verbose, --setting-sources,
-                              --strict-mcp-config, --disable-slash-commands,
+                              the run's harness's result. Flags firegoat sets
+                              are errors, also as --flag=value. claude_args:
+                              -p, --print, --output-format, --verbose,
+                              --setting-sources, --strict-mcp-config,
+                              --disable-slash-commands,
                               --dangerously-skip-permissions, --model (use
                               model:), --session-id, --resume, -r, --continue,
-                              -c. codex-cli: --json, --skip-git-repo-check,
+                              -c. codex_args: --json, --skip-git-repo-check,
                               --dangerously-bypass-approvals-and-sandbox, -C,
                               --cd, -m, --model (use model:), resume, fork,
-                              --ephemeral. grok-cli: -p, --single,
+                              --ephemeral. grok_args: -p, --single,
                               --prompt-file, --prompt-json, --output-format,
                               --json-schema, --always-approve,
                               --permission-mode, --no-auto-update, --cwd, -w,
@@ -8839,7 +8920,8 @@ firegoat.yaml reference:
       env: {NAME: value}      Optional, on top of the top-level env:
       install: <sh> | [...]   Optional, runs after the top-level install
       cleanup: <sh> | [...]   Optional, runs before the top-level cleanup
-      harness_args: [...]     Optional, after the top-level harness_args
+      claude_args: [...]      Optional, after the top-level claude_args (same
+                              for codex_args, grok_args)
 
   Step order: build once per eval; then per run: install (top-level, then the
   test's), the agent, checks, cleanup (the test's, then top-level).
@@ -8875,7 +8957,7 @@ firegoat.yaml reference:
   so the agent's commands see them too.
 
 Testing an MCP server: commit its config as fixtures/mcp.json, copy it in build:
-and pass it with harness_args (claude-code). Only the configs you pass load: --strict-mcp-config
+and pass it with claude_args. Only the configs you pass load: --strict-mcp-config
 is always on. An MCP server inherits claude's env, which keeps your real HOME
 (claude's login is there), so set the server's HOME to the run's home, or it
 writes to yours. claude gets $FIREGOAT_HOME, $FIREGOAT_WORKDIR and $FIREGOAT_OUT
@@ -8886,12 +8968,11 @@ relative paths in it are from the run's folder, claude's cwd:
       "env": {"HOME": "\${FIREGOAT_HOME}"}}}}
   firegoat.yaml:
     build: cp -R fixtures/. "$FIREGOAT_OUT"
-    harness_args: [--mcp-config, $FIREGOAT_OUT/mcp.json]
+    claude_args: [--mcp-config, $FIREGOAT_OUT/mcp.json]
 
 Example:
   build: npm pack --pack-destination "$FIREGOAT_OUT"
   install: npm init -y >/dev/null && npm install "$FIREGOAT_OUT"/*.tgz
-  cleanup: pkill -f "$FIREGOAT_WORKDIR" || true
   tests:
     - name: first-call
       prompt: >-
@@ -8910,7 +8991,7 @@ Example:
         Get an acme API key from the acme dashboard (I'm logged in in Chrome) and put
         it in .env as ACME_API_KEY.
       end_goal: .env holds a key copied from the dashboard, not a made-up one.
-      harness_args: [--chrome]
+      claude_args: [--chrome]
 
 init also says that firegoat sends anonymous usage stats; FIREGOAT_TELEMETRY=0
 (or DO_NOT_TRACK=1) turns them off. Fields: firegoat --help, Telemetry.
@@ -8919,7 +9000,7 @@ Exit codes: 0 done, 1 the firegoat login failed (the files stay), 2 the skill
 install failed, 3 usage error.`;
 var LOGIN_HELP = `Usage: firegoat login
 
-Logs in to firegoat.ai so eval uploads each run's claude session there as a private
+Logs in to firegoat.ai so eval uploads each run's session there as a private
 trace (you share it from its page). OAuth device flow: prints a URL and a code (and
 opens the browser in a terminal); approve it there, and the trace key is saved to
 ~/.firegoat/credentials.json (mode 0600). The key is never passed to the agent,
@@ -8929,7 +9010,9 @@ read ~/.firegoat, and a FIREGOAT_API_KEY in firegoat's own process env (ps eww,
 your own traces; revoke it on the firegoat.ai traces page.
 
 What eval uploads per run: session.jsonl (prompts, tool calls and outputs, file
-contents: possibly secrets from your env or repo), checks.txt and stderr.txt (check
+contents: possibly secrets from your env or repo; claude's own session file, or for
+codex and grok one in claude's format made from the run's stream, the run dir's
+session.jsonl), checks.txt and stderr.txt (check
 output, which sees vars:). firegoat.ai masks secrets when showing a trace but stores
 the text as sent. eval --no-upload keeps a run local.
 
@@ -8973,9 +9056,20 @@ top-level). cleanup: runs whenever the folder exists, also after a failed instal
 a claude error or a timeout; a failing cleanup step prints a warning and never
 changes the run's status or the exit code.
 
+The agent's run ends with its final result (claude's and grok's result line,
+codex's turn.completed or turn.failed): a harness that hasn't exited 5s later
+(a server it started in the background keeps it alive) is left running, so the
+checks can still reach that server. After cleanup, firegoat stops whatever is
+still running from the run (SIGTERM, then SIGKILL after 2s): the harness's
+process group, every process below it, and every process whose working
+directory is inside the run's folder (lsof on macOS, /proc on Linux). They are
+listed in run.json leftover, with one warning per run; never the verdict. Not
+found: a daemon that left the group and changed its working directory out of
+the run's folder.
+
 claude runs on its own login (or ANTHROPIC_API_KEY if set, as claude always does)
 with a fresh config dir, ~/.firegoat/runs/<hash>/.claude: none of your settings,
-CLAUDE.md, plugins, skills or MCP servers (harness_args: in firegoat.yaml adds
+CLAUDE.md, plugins, skills or MCP servers (claude_args: in firegoat.yaml adds
 claude flags, e.g. --chrome or --plugin-dir). claude saves its session there. There
 is no sandbox: the agent can still reach the rest of your machine, including the
 repo, if it goes looking.
@@ -8985,9 +9079,10 @@ fresh CODEX_HOME, ~/.firegoat/runs/<hash>/.codex, holding a link to your codex l
 (~/.codex/auth.json, or $CODEX_HOME/auth.json; run codex login first), and with
 -c project_doc_max_bytes=0: no AGENTS.md, config.toml, skills or plugins of
 yours. codex's own HOME is the run's home (below), also for its Read/Write. It
-saves its session (rollout) under that CODEX_HOME's sessions/. firegoat.ai doesn't
-read codex sessions yet: those runs are not uploaded. codex reports no turns or
-cost; its model comes from the session file.
+saves its session (rollout) under that CODEX_HOME's sessions/. firegoat.ai reads
+claude's session format: the upload is the run dir's session.jsonl, made from the
+--json stream. codex reports no turns or cost; its model comes from the session
+file.
 
 grok-cli runs ~/.grok/bin/grok (where grok's installer puts it; never a grok on
 PATH, which may be a wrapper such as cmux's: a #! script is refused) as grok -p
@@ -8999,8 +9094,8 @@ your real one it loads Claude Code's skills, plugins, MCP servers and hooks. eva
 refuses a login that expires within 5 minutes (run grok -p hi once to refresh it):
 a refresh inside a run would replace the link with a file, which the next eval
 asks you to move back over ~/.grok/auth.json. The session is a directory,
-$GROK_HOME/sessions/<cwd>/<id>/ ($FIREGOAT_SESSION). firegoat.ai doesn't read
-grok sessions yet: those runs are not uploaded.
+$GROK_HOME/sessions/<cwd>/<id>/ ($FIREGOAT_SESSION). Like codex's, its upload is
+the run dir's session.jsonl, made from the stream in claude's session format.
 
 Every run gets its own HOME, ~/.firegoat/runs/<hash>/<random>/home next to work
 (with XDG_CONFIG_HOME, XDG_CACHE_HOME, XDG_DATA_HOME, XDG_STATE_HOME inside it), as
@@ -9047,7 +9142,8 @@ firegoat.yaml, fixtures and build: stay in the current folder.
   --dry-run          Check firegoat.yaml as eval would (test names, --var,
                      --model, --harness, missing vars), print each planned
                      run ("<test>#<n> [harness model]" with its install, checks
-                     and cleanup counts and rendered harness_args, paths under
+                     and cleanup counts and its harness's rendered args
+                     (claude_args, ...), paths under
                      ~/.firegoat/runs/<hash>/<random>/) and exit 0. Builds
                      nothing, starts no agent, uploads nothing, writes no
                      files. Config errors
@@ -9085,11 +9181,16 @@ Output: .firegoat/runs/<runId>/
   <test>/<n>/run.json     One run: status and reason (from the checks), harness,
                           model (asked for, or null) and reportedModel (what
                           the harness reported running, or null), harnessArgs
-                          (harness_args passed), prompt, end_goal,
+                          (its harness's claude_args/codex_args/grok_args
+                          passed, expanded), prompt, end_goal,
                           checks [{run, code}], cleanup [{run, code}],
-                          and paths: dir (this folder), workdir, home (the
-                          run's HOME; both real paths, under ~/.firegoat),
-                          transcript, session (the harness's session file), stderr,
+                          leftover [{pid, command}] (processes stopped after
+                          cleanup), and paths: dir (this folder), workdir, home
+                          (the run's HOME; both real paths, under ~/.firegoat),
+                          transcript, session (the harness's session file),
+                          claudeSession (the session.jsonl uploaded: claude's
+                          own file, else <test>/<n>/session.jsonl made from the
+                          stream) and sessionId (its id, the trace's), stderr,
                           checksLog, cleanupLog; startedAt; upload ({status: "uploaded",
                           url} | {status: "failed", error} | {status:
                           "skipped", reason}, null when not uploading)
@@ -9153,6 +9254,659 @@ Example:
 
 Exit codes: 0 sent, 2 the service failed (or rate limit), 3 usage error.`;
 
+// src/leftover.ts
+import { spawn as spawn2 } from "node:child_process";
+import { readdirSync as readdirSync4, readlinkSync as readlinkSync2, realpathSync as realpathSync2 } from "node:fs";
+var TERM_WAIT_MS = 2000;
+function output(cmd, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let out = "";
+    let err = "";
+    child.stdout.on("data", (c) => {
+      out += c;
+    });
+    child.stderr.on("data", (c) => {
+      err += c;
+    });
+    child.on("error", (e) => reject(new Error(`could not run ${cmd}: ${e.message}`)));
+    child.on("close", (code) => code === 0 || out !== "" ? resolve(out) : reject(new Error(`${cmd} exited ${code}: ${err.trim().slice(0, 300)}`)));
+  });
+}
+async function processes() {
+  const ps = await output("ps", [
+    "-A",
+    "-o",
+    "pid=,ppid=,pgid=,stat=,command="
+  ]);
+  const procs = [];
+  for (const line of ps.split(`
+`)) {
+    const m = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line);
+    if (!m || m[4]?.startsWith("Z"))
+      continue;
+    procs.push({
+      pid: Number(m[1]),
+      ppid: Number(m[2]),
+      pgid: Number(m[3]),
+      command: m[5] ?? ""
+    });
+  }
+  return procs;
+}
+async function cwdInside(dir) {
+  const inside = (p) => p === dir || p.startsWith(`${dir}/`);
+  if (process.platform === "linux") {
+    const pids = [];
+    for (const name of readdirSync4("/proc")) {
+      if (!/^\d+$/.test(name))
+        continue;
+      try {
+        if (inside(readlinkSync2(`/proc/${name}/cwd`)))
+          pids.push(Number(name));
+      } catch {}
+    }
+    return pids;
+  }
+  if (process.platform === "darwin") {
+    const pids = [];
+    let pid = 0;
+    for (const line of (await output("lsof", ["-d", "cwd", "-Fpn", "-w"])).split(`
+`)) {
+      if (line.startsWith("p"))
+        pid = Number(line.slice(1));
+      else if (line.startsWith("n") && inside(line.slice(1)))
+        pids.push(pid);
+    }
+    return pids;
+  }
+  throw new Error(`finding processes by cwd is not supported on ${process.platform}`);
+}
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function signal(pids, group, sig) {
+  for (const p of group === undefined ? pids : [...pids, -group])
+    try {
+      process.kill(p, sig);
+    } catch {}
+}
+async function stopLeftovers(opts) {
+  const workdir = realpathSync2(opts.workdir);
+  const [procs, inWorkdir] = await Promise.all([
+    processes(),
+    cwdInside(workdir)
+  ]);
+  const found = new Set(inWorkdir);
+  if (opts.group !== undefined) {
+    for (const p of procs)
+      if (p.pgid === opts.group)
+        found.add(p.pid);
+  }
+  for (let grew = true;grew; ) {
+    grew = false;
+    for (const p of procs)
+      if (found.has(p.ppid) && !found.has(p.pid)) {
+        found.add(p.pid);
+        grew = true;
+      }
+  }
+  found.delete(process.pid);
+  const leftover = procs.filter((p) => found.has(p.pid)).map((p) => ({ pid: p.pid, command: printable(p.command, 200) }));
+  const pids = leftover.map((l) => l.pid);
+  signal(pids, opts.group, "SIGTERM");
+  const deadline = Date.now() + TERM_WAIT_MS;
+  while (pids.some(alive) && Date.now() < deadline)
+    await new Promise((r) => setTimeout(r, 100));
+  signal(pids.filter(alive), opts.group, "SIGKILL");
+  if (opts.group !== undefined)
+    forgetGroup(opts.group);
+  return leftover;
+}
+
+// src/session.ts
+import { randomUUID } from "node:crypto";
+import { writeFileSync as writeFileSync3 } from "node:fs";
+
+// src/atif.ts
+var MAX_BLOCK_CHARS = 50000;
+function flattenContent(value) {
+  if (typeof value === "string")
+    return value;
+  if (Array.isArray(value)) {
+    return value.map((item) => {
+      if (typeof item === "string")
+        return item;
+      if (item && typeof item === "object") {
+        const obj = item;
+        if (typeof obj.text === "string")
+          return obj.text;
+        if (typeof obj.content === "string")
+          return obj.content;
+      }
+      return JSON.stringify(item);
+    }).join(`
+`);
+  }
+  if (value == null)
+    return "";
+  return JSON.stringify(value);
+}
+function cap(text) {
+  return text.length > MAX_BLOCK_CHARS ? text.slice(0, MAX_BLOCK_CHARS) : text;
+}
+function shellQuote2(path) {
+  return `'${path.replace(/'/g, `'\\''`)}'`;
+}
+var CAPPED_STRING_FIELDS = [
+  "content",
+  "old_string",
+  "new_string",
+  "command",
+  "input"
+];
+function capToolInput(args) {
+  const input = args ?? {};
+  const serialized = JSON.stringify(input);
+  if (serialized.length <= MAX_BLOCK_CHARS)
+    return input;
+  if (input && typeof input === "object") {
+    const obj = input;
+    const capped = {};
+    for (const [key, value] of Object.entries(obj)) {
+      if (CAPPED_STRING_FIELDS.includes(key) && typeof value === "string") {
+        capped[key] = cap(value);
+      } else if (key === "edits" && Array.isArray(value)) {
+        capped[key] = value.map((edit) => edit && typeof edit === "object" ? {
+          ...edit,
+          old_string: typeof edit.old_string === "string" ? cap(edit.old_string) : edit.old_string,
+          new_string: typeof edit.new_string === "string" ? cap(edit.new_string) : edit.new_string
+        } : edit);
+      } else {
+        capped[key] = value;
+      }
+    }
+    if (JSON.stringify(capped).length <= MAX_BLOCK_CHARS)
+      return capped;
+  }
+  return { _truncated: serialized.slice(0, MAX_BLOCK_CHARS) };
+}
+var PATCH_FILE_MARKERS = [
+  { re: /^\*\*\* Update File: (.+)$/, op: "modify" },
+  { re: /^\*\*\* Add File: (.+)$/, op: "add" },
+  { re: /^\*\*\* Delete File: (.+)$/, op: "delete" }
+];
+function parseCodexPatch(patch) {
+  if (typeof patch !== "string" || patch.length === 0)
+    return null;
+  const lines = patch.split(`
+`);
+  const sections = [];
+  let current = null;
+  for (const line of lines) {
+    if (line === "*** Begin Patch")
+      continue;
+    if (line === "*** End Patch")
+      break;
+    const marker = PATCH_FILE_MARKERS.map((m) => ({
+      m,
+      hit: line.match(m.re)
+    })).find((x) => x.hit);
+    if (marker) {
+      current = {
+        op: marker.m.op,
+        path: marker.hit[1],
+        body: []
+      };
+      sections.push(current);
+      continue;
+    }
+    const move = line.match(/^\*\*\* Move to: (.+)$/);
+    if (move && current) {
+      current.renameTo = move[1];
+      continue;
+    }
+    if (line.startsWith("*** "))
+      continue;
+    if (current)
+      current.body.push(line);
+  }
+  if (sections.length === 0)
+    return null;
+  return sections;
+}
+function reconstructHunk(hunkLines) {
+  const oldLines = [];
+  const newLines = [];
+  for (const line of hunkLines) {
+    const marker = line[0];
+    if (marker === "-") {
+      oldLines.push(line.slice(1));
+    } else if (marker === "+") {
+      newLines.push(line.slice(1));
+    } else if (marker === " ") {
+      oldLines.push(line.slice(1));
+      newLines.push(line.slice(1));
+    } else if (line === "") {
+      oldLines.push("");
+      newLines.push("");
+    }
+  }
+  return { old_string: oldLines.join(`
+`), new_string: newLines.join(`
+`) };
+}
+function splitHunks(body) {
+  const hunks = [];
+  let current = null;
+  for (const line of body) {
+    if (line.startsWith("@@")) {
+      current = [];
+      hunks.push(current);
+      continue;
+    }
+    if (current)
+      current.push(line);
+  }
+  return hunks.filter((h) => h.length > 0);
+}
+function sectionToBlock(section) {
+  if (section.op === "delete") {
+    return [
+      {
+        name: "Bash",
+        input: { command: `rm -f -- ${shellQuote2(section.path)}` }
+      }
+    ];
+  }
+  if (section.op === "add") {
+    const content = section.body.filter((l) => l.startsWith("+")).map((l) => l.slice(1)).join(`
+`);
+    return [{ name: "Write", input: { file_path: section.path, content } }];
+  }
+  const targetPath = section.renameTo ?? section.path;
+  const rename = section.renameTo ? [
+    {
+      name: "Bash",
+      input: {
+        command: `mv -- ${shellQuote2(section.path)} ${shellQuote2(section.renameTo)}`
+      }
+    }
+  ] : [];
+  const edits = splitHunks(section.body).map(reconstructHunk);
+  if (edits.length === 0)
+    return rename;
+  const [only] = edits;
+  if (edits.length === 1 && only) {
+    return [
+      ...rename,
+      {
+        name: "Edit",
+        input: {
+          file_path: targetPath,
+          old_string: only.old_string,
+          new_string: only.new_string
+        }
+      }
+    ];
+  }
+  return [
+    ...rename,
+    { name: "MultiEdit", input: { file_path: targetPath, edits } }
+  ];
+}
+var str3 = (v) => typeof v === "string";
+function withReadRange(input, a) {
+  if (typeof a.offset === "number")
+    input.offset = a.offset;
+  if (typeof a.limit === "number")
+    input.limit = a.limit;
+  return input;
+}
+var TOOL_TRANSFORMS = {
+  shellToolCall: (a) => str3(a.command) ? { name: "Bash", input: { command: a.command } } : null,
+  readToolCall: (a) => str3(a.path) ? { name: "Read", input: { file_path: a.path } } : null,
+  editToolCall: (a) => str3(a.path) ? {
+    name: "Write",
+    input: { file_path: a.path, content: a.streamContent }
+  } : null,
+  globToolCall: (a) => str3(a.globPattern) ? {
+    name: "Glob",
+    input: { pattern: a.globPattern, path: a.targetDirectory }
+  } : null,
+  grepToolCall: (a) => str3(a.pattern) ? { name: "Grep", input: { pattern: a.pattern, path: a.path } } : null,
+  webFetchToolCall: (a) => str3(a.url) ? { name: "WebFetch", input: { url: a.url } } : null,
+  webSearchToolCall: (a) => str3(a.searchTerm) ? { name: "WebSearch", input: { query: a.searchTerm } } : null,
+  bash: (a) => str3(a.command) ? { name: "Bash", input: { command: a.command } } : null,
+  glob: (a) => str3(a.pattern) ? { name: "Glob", input: { pattern: a.pattern, path: a.path } } : null,
+  grep: (a) => str3(a.pattern) ? { name: "Grep", input: { pattern: a.pattern, path: a.path } } : null,
+  webfetch: (a) => str3(a.url) ? { name: "WebFetch", input: { url: a.url } } : null,
+  todowrite: (a) => Array.isArray(a.todos) ? {
+    name: "TodoWrite",
+    input: {
+      todos: a.todos.map((t) => ({
+        content: t.content,
+        status: t.status
+      }))
+    }
+  } : null,
+  read: (a) => {
+    const filePath = str3(a.filePath) ? a.filePath : str3(a.path) ? a.path : null;
+    return filePath ? { name: "Read", input: withReadRange({ file_path: filePath }, a) } : null;
+  },
+  exec: (a) => str3(a.command) ? { name: "Bash", input: { command: a.command } } : null,
+  write: (a) => str3(a.path) ? { name: "Write", input: { file_path: a.path, content: a.content } } : null,
+  edit: (a) => {
+    if (!str3(a.path) || !Array.isArray(a.edits) || a.edits.length === 0)
+      return null;
+    if (a.edits.length === 1) {
+      const e = a.edits[0];
+      return {
+        name: "Edit",
+        input: {
+          file_path: a.path,
+          old_string: e.oldText,
+          new_string: e.newText
+        }
+      };
+    }
+    return {
+      name: "MultiEdit",
+      input: {
+        file_path: a.path,
+        edits: a.edits.map((e) => ({
+          old_string: e.oldText,
+          new_string: e.newText
+        }))
+      }
+    };
+  },
+  web_fetch: (a) => str3(a.url) ? { name: "WebFetch", input: { url: a.url } } : null,
+  update_plan: (a) => Array.isArray(a.plan) ? {
+    name: "TodoWrite",
+    input: {
+      todos: a.plan.map((p) => ({
+        content: p.step,
+        status: p.status
+      }))
+    }
+  } : null,
+  shell: (a) => str3(a.command) && (a.action === undefined || a.action === "run") ? { name: "Bash", input: { command: a.command } } : null,
+  read_file: (a) => {
+    if (!str3(a.path))
+      return null;
+    const input = { file_path: a.path };
+    if (typeof a.start_line === "number")
+      input.offset = a.start_line;
+    if (typeof a.line_count === "number")
+      input.limit = a.line_count;
+    return { name: "Read", input };
+  },
+  write_file: (a) => str3(a.path) ? { name: "Write", input: { file_path: a.path, content: a.content } } : null,
+  edit_file: (a) => str3(a.path) ? {
+    name: "Edit",
+    input: {
+      file_path: a.path,
+      old_string: a.old_string,
+      new_string: a.new_string
+    }
+  } : null,
+  glob_files: (a) => str3(a.pattern) ? { name: "Glob", input: { pattern: a.pattern, path: a.path } } : null,
+  grep_files: (a) => str3(a.pattern) ? { name: "Grep", input: { pattern: a.pattern, path: a.path } } : null,
+  exa_search: (a) => str3(a.query) ? { name: "WebSearch", input: { query: a.query } } : null
+};
+function normalizeToolCall(functionName, args) {
+  const obj = args && typeof args === "object" ? args : null;
+  if (functionName === "exec_command" && obj && "cmd" in obj) {
+    const { cmd, ...rest } = obj;
+    return [{ name: "Bash", input: { ...rest, command: cmd } }];
+  }
+  if (functionName === "apply_patch" && obj) {
+    const rawPatch = obj.input ?? obj.patchText;
+    const sections = parseCodexPatch(rawPatch);
+    if (sections) {
+      const blocks = sections.flatMap(sectionToBlock);
+      if (blocks.length > 0)
+        return blocks;
+    }
+    return [{ name: functionName, input: args }];
+  }
+  if (functionName === "web_search_call" && obj) {
+    const actionType = obj.action_type;
+    if (actionType === "open_page")
+      return [{ name: "WebFetch", input: obj }];
+    if (actionType === "search") {
+      if ("query" in obj && typeof obj.query === "string")
+        return [{ name: "WebSearch", input: obj }];
+      const altKey = ["queries", "q", "search_query"].find((k) => (k in obj));
+      if (altKey) {
+        const { [altKey]: raw, ...rest } = obj;
+        const query = Array.isArray(raw) ? raw.find((q) => typeof q === "string") : raw;
+        if (typeof query !== "string")
+          return [{ name: functionName, input: args }];
+        const preserved = Array.isArray(raw) ? { queries: raw } : {};
+        return [{ name: "WebSearch", input: { ...rest, ...preserved, query } }];
+      }
+      return [{ name: functionName, input: args }];
+    }
+    return [{ name: functionName, input: args }];
+  }
+  if (functionName && functionName in TOOL_TRANSFORMS && obj) {
+    const block = TOOL_TRANSFORMS[functionName](obj);
+    if (block)
+      return [block];
+  }
+  return [{ name: functionName, input: args }];
+}
+function toolCallId(tc, step, index) {
+  if (tc.tool_call_id)
+    return tc.tool_call_id;
+  return `call_${step.step_id}_${tc.function_name ?? "tool"}_${index}`;
+}
+var HARBOR_PLACEHOLDER_MESSAGES = new Set([
+  "(tool use)",
+  "(no assistant text)"
+]);
+function isExecutedRestatement(message, toolCalls) {
+  const trimmed = message.trimStart();
+  if (!trimmed.startsWith("Executed "))
+    return false;
+  const rest = trimmed.slice("Executed ".length);
+  return toolCalls.some((tc) => tc.function_name && rest.startsWith(tc.function_name));
+}
+var ENVELOPE_META = [
+  /^Chunk ID:/,
+  /^Wall time:/,
+  /^Original token count:/,
+  /^Process exited with code /,
+  /^Exit code:/
+];
+function stripCodexResultEnvelope(content) {
+  const lines = content.split(`
+`);
+  const outputIdx = lines.findIndex((l) => l === "Output:");
+  if (outputIdx === -1)
+    return content;
+  const preamble = lines.slice(0, outputIdx);
+  if (!preamble.some((l) => ENVELOPE_META.some((re) => re.test(l))))
+    return content;
+  let exitCode = 0;
+  for (const line of preamble) {
+    const m = line.match(/^(?:Process exited with code|Exit code:) (\d+)$/);
+    if (m)
+      exitCode = Number(m[1]);
+  }
+  const output = lines.slice(outputIdx + 1).join(`
+`);
+  return exitCode === 0 ? output : `[exit code ${exitCode}]
+${output}`;
+}
+function convertAtifToSession(trajectory) {
+  if (!Array.isArray(trajectory?.steps)) {
+    throw new Error("atif: the trajectory has no steps array");
+  }
+  const events = [];
+  for (const step of trajectory.steps) {
+    if (step.source === "system")
+      continue;
+    if (step.source === "user") {
+      const userText = flattenContent(step.message);
+      if (userText.includes("<environment_context>"))
+        continue;
+      events.push({
+        uuid: `atif-${step.step_id}-user`,
+        type: "user",
+        timestamp: step.timestamp,
+        message: { role: "user", content: cap(userText) }
+      });
+      continue;
+    }
+    if (step.source !== "agent")
+      continue;
+    const toolCalls = step.tool_calls ?? [];
+    const blocks = [];
+    const reasoning = flattenContent(step.reasoning_content);
+    if (reasoning)
+      blocks.push({ type: "thinking", thinking: cap(reasoning) });
+    const messageText = flattenContent(step.message);
+    if (messageText && !isExecutedRestatement(messageText, toolCalls) && !HARBOR_PLACEHOLDER_MESSAGES.has(messageText.trim())) {
+      blocks.push({ type: "text", text: cap(messageText) });
+    }
+    const toolUseIds = [];
+    for (let i = 0;i < toolCalls.length; i++) {
+      const tc = toolCalls[i];
+      const id = toolCallId(tc, step, i);
+      toolUseIds.push(id);
+      const split = normalizeToolCall(tc.function_name, tc.arguments);
+      split.forEach(({ name, input }, k) => {
+        const isLast = k === split.length - 1;
+        blocks.push({
+          type: "tool_use",
+          id: isLast ? id : `${id}__patch${k}`,
+          name,
+          input: capToolInput(input)
+        });
+      });
+    }
+    if (blocks.length > 0) {
+      events.push({
+        uuid: `atif-${step.step_id}-assistant`,
+        type: "assistant",
+        timestamp: step.timestamp,
+        message: {
+          id: `atif-step-${step.step_id}`,
+          role: "assistant",
+          model: step.model_name,
+          content: blocks
+        }
+      });
+    }
+    const results = step.observation?.results;
+    if (results && results.length > 0) {
+      const resultBlocks = results.map((result, i) => {
+        const content = result.subagent_trajectory_ref ? `[subagent trajectory: ${result.subagent_trajectory_ref}]` : stripCodexResultEnvelope(flattenContent(result.content));
+        return {
+          type: "tool_result",
+          tool_use_id: result.source_call_id || toolUseIds[i] || `call_${step.step_id}_result${i}`,
+          content: cap(content)
+        };
+      });
+      events.push({
+        uuid: `atif-${step.step_id}-results`,
+        type: "user",
+        timestamp: step.timestamp,
+        message: { role: "user", content: resultBlocks }
+      });
+    }
+  }
+  return events;
+}
+
+// src/session.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function convertedSessionId(harnessId) {
+  return UUID.test(harnessId) ? harnessId.toLowerCase() : randomUUID();
+}
+function toTrajectory(t) {
+  const steps = [{ step_id: 1, source: "user", message: t.prompt }];
+  const agent = (fields) => {
+    const step = {
+      step_id: steps.length + 1,
+      source: "agent",
+      message: "",
+      ...t.model === null ? {} : { model_name: t.model },
+      ...fields
+    };
+    steps.push(step);
+    return step;
+  };
+  const calls = new Map;
+  const failed = new Set;
+  let lastText = null;
+  for (const s of t.steps) {
+    if (s.kind === "text") {
+      agent({ message: s.text });
+      lastText = s.text;
+    } else if (s.kind === "tool_call") {
+      const id = s.id ?? `firegoat_call_${steps.length + 1}`;
+      const step = agent({
+        tool_calls: [
+          { tool_call_id: id, function_name: s.name, arguments: s.input }
+        ]
+      });
+      calls.set(id, step);
+    } else {
+      const call = s.callId === null ? undefined : calls.get(s.callId);
+      const id = s.callId ?? `firegoat_result_${steps.length + 1}`;
+      const result = { source_call_id: id, content: s.text };
+      if (!call)
+        agent({ observation: { results: [result] } });
+      else if (call.observation)
+        call.observation.results.push(result);
+      else
+        call.observation = { results: [result] };
+      if (s.isError)
+        failed.add(id);
+    }
+  }
+  if (t.final !== "" && t.final !== lastText)
+    agent({ message: t.final });
+  return {
+    trajectory: {
+      schema_version: "ATIF-v1.6",
+      session_id: t.sessionId,
+      agent: {
+        name: t.harness,
+        ...t.version === null ? {} : { version: t.version },
+        ...t.model === null ? {} : { model_name: t.model }
+      },
+      steps
+    },
+    failed
+  };
+}
+function toClaudeSession(t) {
+  const { trajectory, failed } = toTrajectory(t);
+  return convertAtifToSession(trajectory).map((e) => {
+    const content = e.message?.content;
+    if (Array.isArray(content)) {
+      for (const b of content)
+        if (b.type === "tool_result" && failed.has(b.tool_use_id))
+          b.is_error = true;
+    }
+    return { ...e, sessionId: t.sessionId };
+  });
+}
+function writeClaudeSession(path, t) {
+  writeFileSync3(path, toClaudeSession(t).map((e) => `${JSON.stringify(e)}
+`).join(""));
+}
+
 // src/steps.ts
 import { createWriteStream } from "node:fs";
 var STEP_TIMEOUT_MS = 600000;
@@ -9287,7 +10041,7 @@ async function sendTelemetry(event, exitCode, startedAt) {
 }
 
 // src/transcript.ts
-import { readdirSync as readdirSync4, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { readdirSync as readdirSync5, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join8, relative } from "node:path";
 var OUTPUT_LINES = 15;
 var OUTPUT_CHARS = 1500;
@@ -9337,7 +10091,7 @@ function describeToolCall(step, c) {
 function workdirFiles(dir) {
   const out = [];
   const walk = (d) => {
-    for (const name of readdirSync4(d)) {
+    for (const name of readdirSync5(d)) {
       if (SKIP_DIRS.has(name))
         continue;
       const p = join8(d, name);
@@ -9371,7 +10125,7 @@ ${indent(truncate(s.text, OUTPUT_LINES, OUTPUT_CHARS))}` : `    → ${status}`);
     out.pop();
   out.push("", "## final answer", final ? prose(final) : "(none)");
   out.push("", "## files in the workdir", ...workdirFiles(opts.workdir));
-  writeFileSync3(opts.path, `${out.join(`
+  writeFileSync4(opts.path, `${out.join(`
 `)}
 `);
 }
@@ -9420,7 +10174,7 @@ function runTag(harness, model) {
   return parts.length > 0 ? ` [${parts.join(" ")}]` : "";
 }
 function notGradedWhy(reason) {
-  const said = /claude result is an error \(subtype=[^)]*\): (.*)$/s.exec(reason);
+  const said = /claude reported an error(?: \([^)]*\))?: (.*)$/s.exec(reason);
   if (said)
     return `claude said: "${said[1]}"`;
   return reason.replace(/^not graded: /, "");
@@ -9676,11 +10430,9 @@ function ttyUI(out, opts) {
 
 // src/upload.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
-import { basename as basename2 } from "node:path";
 var MAX_FILE = 20 * 1024 * 1024;
 var MAX_CHECKS = 200;
 var MAX_TEXT = 8192;
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var FILES = ["session.jsonl", "checks.txt", "stderr.txt"];
 function clip(s, max, marker) {
   return s.length > max ? `${s.slice(0, max - marker.length)}${marker}` : s;
@@ -9737,9 +10489,11 @@ async function put(name, entry, bytes) {
     throw new ApiError(`PUT ${name} ${r.status}`, r.status);
 }
 async function uploadRun(t, r) {
-  if (!r.session)
+  if (!r.claudeSession)
     return { status: "skipped", reason: "No session file" };
-  const sessionId = basename2(r.session, ".jsonl");
+  const { sessionId } = r;
+  if (sessionId === null)
+    throw new Error(`run ${r.test}#${r.n} has a session file but no session id`);
   if (!UUID.test(sessionId))
     return {
       status: "failed",
@@ -9751,7 +10505,7 @@ async function uploadRun(t, r) {
       error: `${r.checks.length} checks, the upload takes at most ${MAX_CHECKS}`
     };
   const paths = {
-    "session.jsonl": r.session,
+    "session.jsonl": r.claudeSession,
     "checks.txt": r.checksLog,
     "stderr.txt": r.stderr
   };
@@ -9792,6 +10546,7 @@ async function uploadRun(t, r) {
       num_turns: r.num_turns,
       cost: r.cost,
       duration_ms: r.duration_ms,
+      harness: r.harness,
       model,
       ...git && { git }
     },
@@ -9941,7 +10696,7 @@ function newRunId() {
   return `${ts}-${randomBytes2(2).toString("hex")}`;
 }
 function writeRunJson(r) {
-  writeFileSync4(join10(r.dir, "run.json"), `${JSON.stringify(r, null, 2)}
+  writeFileSync5(join10(r.dir, "run.json"), `${JSON.stringify(r, null, 2)}
 `);
 }
 async function uploadPreflight(opts, ui, project, runGroup, git) {
@@ -9992,8 +10747,8 @@ function runFill(runId, n, testName, out, agentDir) {
     FIREGOAT_HOME: join10(agentDir, "home")
   };
 }
-function renderHarnessArgs(test, vars, fill) {
-  return test.harnessArgs.map((a) => renderValue(a.arg, vars, fill, a.path));
+function renderHarnessArgs(test, harness, vars, fill) {
+  return (test.harnessArgs[harness] ?? []).map((a) => renderValue(a.arg, vars, fill, a.path));
 }
 function renderSteps(what, commands, vars, fill) {
   return commands.map((c, i) => renderStep(c, vars, fill, `${what}[${i}]`));
@@ -10030,7 +10785,7 @@ function dryRun(opts) {
     renderEnv(test.env, opts.vars, fill);
     return {
       ...p,
-      harnessArgs: renderHarnessArgs(test, opts.vars, fill),
+      harnessArgs: renderHarnessArgs(test, p.harness, opts.vars, fill),
       ...renderRunSteps(test, opts.config, opts.vars, fill)
     };
   });
@@ -10042,7 +10797,7 @@ function dryRun(opts) {
   const count = (n, what) => `${n} ${what}${n === 1 ? "" : "s"}`;
   opts.say(`Dry run: ${count(runs.length, "run")}, build ${count(opts.config.build.length, "step")}. Nothing was started.`);
   for (const r of runs)
-    opts.say(`${r.test}#${r.n}${runTag(opts.showHarness ? r.harness : null, r.model)} install ${r.install.length}, checks ${r.checks.length}, cleanup ${r.cleanup.length}${r.harnessArgs.length > 0 ? `, harness_args ${JSON.stringify(r.harnessArgs)}` : ""}`);
+    opts.say(`${r.test}#${r.n}${runTag(opts.showHarness ? r.harness : null, r.model)} install ${r.install.length}, checks ${r.checks.length}, cleanup ${r.cleanup.length}${r.harnessArgs.length > 0 ? `, ${HARNESSES.get(r.harness).argsKey} ${JSON.stringify(r.harnessArgs)}` : ""}`);
 }
 async function runOne(opts) {
   const { test, n } = opts;
@@ -10062,7 +10817,7 @@ async function runOne(opts) {
     harness: opts.harness.name,
     model: opts.model,
     reportedModel: null,
-    harnessArgs: renderHarnessArgs(test, opts.vars, fill),
+    harnessArgs: renderHarnessArgs(test, opts.harness.name, opts.vars, fill),
     status: "error",
     reason: "",
     prompt: render(test.prompt, opts.vars),
@@ -10072,11 +10827,14 @@ async function runOne(opts) {
     workdir,
     home,
     session: null,
+    claudeSession: null,
+    sessionId: null,
     transcript: join10(dir, "transcript.txt"),
     stderr: join10(dir, "stderr.txt"),
     checksLog: join10(dir, "checks.txt"),
     cleanup: [],
     cleanupLog: join10(dir, "cleanup.txt"),
+    leftover: [],
     num_turns: null,
     cost: null,
     duration_ms: 0,
@@ -10094,7 +10852,8 @@ async function runOne(opts) {
     FIREGOAT_REPO: opts.repo
   };
   const steps = renderRunSteps(test, opts, opts.vars, fill);
-  const [status, reason] = await attempt(opts, r, steps, env, stepEnv, envFile);
+  const agent = {};
+  const [status, reason] = await attempt(opts, r, steps, env, stepEnv, envFile, agent);
   if (steps.cleanup.length > 0)
     r.cleanup = await runAllSteps({
       commands: steps.cleanup,
@@ -10102,6 +10861,7 @@ async function runOne(opts) {
       env: stepEnv,
       logPath: r.cleanupLog
     });
+  r.leftover = await stopLeftovers({ group: agent.group, workdir });
   r.status = status;
   r.reason = reason;
   r.duration_ms = Date.now() - started;
@@ -10111,7 +10871,7 @@ async function runOne(opts) {
 function withoutOldPwd(env) {
   return Object.fromEntries(Object.entries(env).filter(([k]) => k !== "OLDPWD"));
 }
-async function attempt(opts, r, steps, env, stepEnv, homeEnvFile) {
+async function attempt(opts, r, steps, env, stepEnv, homeEnvFile, agent) {
   const { test, n } = opts;
   const { dir, workdir } = r;
   if (steps.install.length > 0) {
@@ -10127,7 +10887,7 @@ async function attempt(opts, r, steps, env, stepEnv, homeEnvFile) {
   }
   const stderr = createWriteStream2(r.stderr);
   const { harness } = opts;
-  const outcome = await runAgent(harness, {
+  const { outcome, group } = await runAgent(harness, {
     bin: opts.bin,
     prompt: r.prompt,
     cwd: workdir,
@@ -10150,12 +10910,31 @@ async function attempt(opts, r, steps, env, stepEnv, homeEnvFile) {
     extraArgs: r.harnessArgs,
     onProgress: opts.onProgress
   });
+  agent.group = group;
   if (outcome.version !== null)
     evalStats({ claudeVersion: claudeVersion(outcome.version) });
   await new Promise((res) => stderr.end(res));
   if (outcome.sessionId)
     r.session = harness.findSession(opts.configDir, outcome.sessionId);
   r.reportedModel = outcome.reportedModel ?? (r.session && harness.sessionModel ? harness.sessionModel(r.session) : null);
+  if (r.session && outcome.sessionId) {
+    if (harness.claudeSessionFile) {
+      r.claudeSession = r.session;
+      r.sessionId = outcome.sessionId;
+    } else {
+      r.sessionId = convertedSessionId(outcome.sessionId);
+      r.claudeSession = join10(dir, "session.jsonl");
+      writeClaudeSession(r.claudeSession, {
+        sessionId: r.sessionId,
+        harness: harness.name,
+        version: outcome.version,
+        model: r.reportedModel,
+        prompt: r.prompt,
+        steps: outcome.steps,
+        final: outcome.final
+      });
+    }
+  }
   const about = [
     opts.shownHarness,
     opts.model === null ? null : `model ${opts.model}`
@@ -10205,9 +10984,6 @@ async function attempt(opts, r, steps, env, stepEnv, homeEnvFile) {
     test.checks.length === 0 ? "no script checks" : `${r.checks.length}/${r.checks.length} checks passed`
   ];
 }
-function notUploaded(h) {
-  return `firegoat.ai doesn't read ${h.name} sessions yet: its runs stay local`;
-}
 var MAX_LISTED_URLS = 5;
 function uploadedSummary(origin, results, runDir) {
   const urls = results.flatMap((r) => r.upload?.status === "uploaded" ? [r.upload.url] : []);
@@ -10246,7 +11022,7 @@ async function evalCommand(args, root) {
   const say = opts.json ? console.error : console.log;
   const stream = opts.json ? process.stderr : process.stdout;
   const ui = stream.isTTY ? ttyUI(stream, {
-    project: basename3(root),
+    project: basename2(root),
     version: package_default.version,
     color: !process.env.NO_COLOR
   }) : plainUI(say);
@@ -10275,14 +11051,6 @@ async function evalCommand(args, root) {
     return fatal(EXIT.usage, `--harness-bin needs exactly one harness, this eval runs ${harnessNames.length} (${harnessNames.join(", ")}): pick one with --harness`, "usage");
   const harnesses = harnessNames.map((h) => HARNESSES.get(h));
   const showHarness = showsHarness(harnessNames);
-  try {
-    for (const h of harnesses)
-      checkHarnessArgs(tests, h);
-  } catch (e) {
-    if (e instanceof ConfigError)
-      return fatal(EXIT.usage, e.message, "config");
-    throw e;
-  }
   evalStats({
     testCount: tests.length,
     runCount: tests.length * runs * Math.max(models.length, 1) * harnesses.length,
@@ -10295,7 +11063,7 @@ async function evalCommand(args, root) {
       t.prompt,
       ...t.checks.map((c) => c.run),
       ...Object.values(t.env),
-      ...t.harnessArgs.map((a) => a.arg),
+      ...harnessNames.flatMap((h) => (t.harnessArgs[h] ?? []).map((a) => a.arg)),
       ...t.install,
       ...t.cleanup
     ]).concat(config.build, config.install, config.cleanup).flatMap(varRefs).filter((k) => !(k in vars)))
@@ -10367,15 +11135,10 @@ async function evalCommand(args, root) {
   const runId = newRunId();
   let upload;
   try {
-    const pre = await uploadPreflight(opts, ui, basename3(repo?.mainCheckout ?? repo?.toplevel ?? root), runId, repo?.info ?? null);
+    const pre = await uploadPreflight(opts, ui, basename2(repo?.mainCheckout ?? repo?.toplevel ?? root), runId, repo?.info ?? null);
     if (pre && "exitCode" in pre)
       return fatal(pre.exitCode, pre.error, pre.code);
     upload = pre;
-    if (upload) {
-      for (const h of harnesses)
-        if (!h.uploads)
-          ui.note(notUploaded(h));
-    }
   } catch (e) {
     if (e instanceof ConfigError)
       return fatal(EXIT.usage, e.message, "config");
@@ -10460,10 +11223,7 @@ async function evalCommand(args, root) {
       command: undefined
     });
     ui.update();
-    if (upload && !harness.uploads) {
-      r.upload = { status: "skipped", reason: notUploaded(harness) };
-      writeRunJson(r);
-    } else if (upload) {
+    if (upload) {
       row.upload = "uploading";
       ui.update();
       r.upload = await uploadRun(upload, r);
@@ -10509,7 +11269,7 @@ async function evalCommand(args, root) {
     status,
     exitCode
   };
-  writeFileSync4(join10(runDir, "summary.json"), `${JSON.stringify(doc, null, 2)}
+  writeFileSync5(join10(runDir, "summary.json"), `${JSON.stringify(doc, null, 2)}
 `);
   appendFileSync(join10(runsRoot, "index.jsonl"), `${JSON.stringify({
     runId,
@@ -10538,6 +11298,9 @@ async function evalCommand(args, root) {
     for (const c of r.cleanup)
       if (c.code !== 0)
         console.error(`firegoat eval: Warning: ${r.test}#${r.n} cleanup failed (${c.error ?? `exit ${c.code}`}): ${c.run} (log: ${r.cleanupLog})`);
+  for (const r of results)
+    if (r.leftover.length > 0)
+      console.error(`firegoat eval: Warning: ${r.test}#${r.n} left ${r.leftover.length} process${r.leftover.length === 1 ? "" : "es"} running, stopped after cleanup: ${r.leftover.map((l) => `${l.pid} ${l.command}`).join("; ")} (run.json leftover)`);
   if (uploadsFailed > 0)
     console.error(`firegoat eval: ${uploadsFailed} upload${uploadsFailed === 1 ? "" : "s"} failed (each run's upload.error in summary.json)`);
   if (opts.json)
@@ -10822,12 +11585,12 @@ firegoat ${package_default.version}` : `firegoat ${package_default.version}`,
 }
 
 // src/init.ts
-import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename4, join as join11 } from "node:path";
+import { spawn as spawn4, spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename3, join as join11 } from "node:path";
 
 // src/login.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 var TIMEOUT_MS3 = 30000;
 var MAX_EXPIRES_S = 900;
 var MAX_INTERVAL_S = 60;
@@ -10835,7 +11598,7 @@ var FORM = { "Content-Type": "application/x-www-form-urlencoded" };
 var UPLOADS_ON = "Eval uploads each session to firegoat.ai as a private trace; --no-upload keeps runs local.";
 var UPLOAD_NOTICE = `${UPLOADS_ON} A session holds prompts, tool outputs and file contents: possibly secrets from your env or repo. The agent runs as you and can read ~/.firegoat (and a FIREGOAT_API_KEY in firegoat's own process env).`;
 var TERMS = "By logging in, you agree to the firegoat.ai Terms of Service (https://firegoat.ai/terms) and Privacy Policy (https://firegoat.ai/privacy).";
-function str3(o, k, step) {
+function str4(o, k, step) {
   const v = o?.[k];
   if (typeof v !== "string" || v === "")
     throw new ApiError(`${step}: response has no ${k}`);
@@ -10844,7 +11607,7 @@ function str3(o, k, step) {
 function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : "xdg-open";
   try {
-    const child = spawn2(cmd, [url], {
+    const child = spawn3(cmd, [url], {
       env: hostEnv(),
       stdio: "ignore",
       detached: true
@@ -10866,9 +11629,9 @@ async function loginFlow(show, interactive) {
   });
   if (cfg.status !== 200)
     throw replyError(cfgStep, cfg);
-  const clientId = str3(cfg.json, "client_id", cfgStep);
-  const deviceUrl = assertSafeUrl(str3(cfg.json, "device_authorization_endpoint", cfgStep), "device_authorization_endpoint");
-  const tokenUrl = assertSafeUrl(str3(cfg.json, "token_endpoint", cfgStep), "token_endpoint");
+  const clientId = str4(cfg.json, "client_id", cfgStep);
+  const deviceUrl = assertSafeUrl(str4(cfg.json, "device_authorization_endpoint", cfgStep), "device_authorization_endpoint");
+  const tokenUrl = assertSafeUrl(str4(cfg.json, "token_endpoint", cfgStep), "token_endpoint");
   if (tokenUrl.origin !== origin)
     throw new ApiError(`token_endpoint must be on ${origin}, got ${printable(tokenUrl.origin, 100)}`);
   const devStep = "Device authorization";
@@ -10877,16 +11640,19 @@ async function loginFlow(show, interactive) {
     url: deviceUrl,
     method: "POST",
     headers: FORM,
-    body: new URLSearchParams({ client_id: clientId }).toString(),
+    body: new URLSearchParams({
+      client_id: clientId,
+      scope: "openid profile email"
+    }).toString(),
     timeoutMs: TIMEOUT_MS3
   });
   if (dev.status !== 200)
     throw replyError(devStep, dev);
-  const deviceCode = str3(dev.json, "device_code", devStep);
-  const userCode = str3(dev.json, "user_code", devStep);
+  const deviceCode = str4(dev.json, "device_code", devStep);
+  const userCode = str4(dev.json, "user_code", devStep);
   if (!/^[A-Za-z0-9-]{1,64}$/.test(userCode))
     throw new ApiError(`${devStep}: user_code has unexpected characters`);
-  const pageRaw = typeof dev.json?.verification_uri_complete === "string" ? dev.json.verification_uri_complete : str3(dev.json, "verification_uri", devStep);
+  const pageRaw = typeof dev.json?.verification_uri_complete === "string" ? dev.json.verification_uri_complete : str4(dev.json, "verification_uri", devStep);
   const page = assertSafeUrl(pageRaw, "verification_uri");
   if (page.protocol !== "https:" || pageRaw.startsWith("-"))
     throw new ApiError("verification_uri must be https");
@@ -11168,10 +11934,12 @@ runs: 1
 # install: cp -R "$FIREGOAT_OUT/starter-app/." .
 
 # Optional: cleanup: runs in each run's folder once the run is over (after the
-# checks, also after an error or timeout), e.g. to stop a server the agent left
-# running. A failing cleanup step is a warning, never the verdict.
+# checks, also after an error or timeout), for what lives outside the run, e.g.
+# data install: seeded in a shared service. Servers the agent left running need
+# none: firegoat stops them after cleanup. A failing cleanup step is a warning,
+# never the verdict.
 # cleanup:
-#   - pkill -f "$FIREGOAT_WORKDIR" || true
+#   - acme db drop "eval-{{run.id}}-{{run.n}}" || true
 #
 # A test can add its own install: (after this one) and cleanup: (before this one).
 
@@ -11186,6 +11954,11 @@ runs: 1
 #   MYTOOL_HOME: "$FIREGOAT_HOME/.mytool"
 #   UV_FIND_LINKS: "$FIREGOAT_OUT"
 
+# Optional: extra arguments for one harness, after firegoat's own flags, one per
+# entry: claude_args, codex_args, grok_args. A test can add its own. E.g. Claude in
+# Chrome, for tests that need a browser:
+# claude_args: [--chrome]
+
 # Optional: values for {{vars.KEY}} in prompts, checks and build/install/cleanup
 # steps (pasted in as-is, unquoted); eval --var KEY=value overrides them. Steps
 # and checks also get each one as an env var ("$KEY": safe for any value).
@@ -11273,7 +12046,7 @@ class Timeline {
 }
 function runQuiet(cmd, args, opts) {
   return new Promise((resolve) => {
-    const child = spawn3(cmd, args, {
+    const child = spawn4(cmd, args, {
       ...opts,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -11342,8 +12115,7 @@ ${UPLOADS_ON}` : LOGIN_HINT);
 }
 async function initCommand(args, cwd) {
   let force = false;
-  let noSkills = false;
-  let localSkills = false;
+  const skillFlags = [];
   let login = true;
   for (const a of args) {
     if (a === "--help" || a === "-h") {
@@ -11353,9 +12125,11 @@ async function initCommand(args, cwd) {
     if (a === "--force" || a === "-f")
       force = true;
     else if (a === "--no-skills")
-      noSkills = true;
+      skillFlags.push({ flag: a, scope: "none" });
     else if (a === "--local-skills")
-      localSkills = true;
+      skillFlags.push({ flag: a, scope: "local" });
+    else if (a === "--global-skills")
+      skillFlags.push({ flag: a, scope: "global" });
     else if (a === "--no-login")
       login = false;
     else {
@@ -11365,15 +12139,17 @@ ${INIT_HELP}`);
       return EXIT.usage;
     }
   }
-  if (noSkills && localSkills) {
-    console.error(`firegoat init: --no-skills and --local-skills contradict each other: pass one
+  const flags = [...new Set(skillFlags.map((f) => f.flag))];
+  if (flags.length > 1) {
+    console.error(`firegoat init: ${flags.join(" and ")} contradict each other: pass one
 
 ${INIT_HELP}`);
     return EXIT.usage;
   }
-  let scope = noSkills ? "none" : localSkills ? "local" : "global";
-  initSkills(scope);
   const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const asked = skillFlags[0] === undefined && interactive;
+  let scope = skillFlags[0]?.scope ?? (interactive ? "global" : "local");
+  initSkills(scope);
   const color = interactive && !process.env.NO_COLOR;
   const paint = (code, text) => color ? `\x1B[${code}m${text}\x1B[0m` : text;
   const width = Math.min(process.stdout.columns || 80, 80);
@@ -11388,7 +12164,7 @@ ${INIT_HELP}`);
   const configPath = join11(cwd, CONFIG_FILE);
   const keep = existsSync6(configPath) && !force;
   if (!keep)
-    writeFileSync5(configPath, template(basename4(cwd)));
+    writeFileSync6(configPath, template(basename3(cwd)));
   if (ui) {
     console.log(ui.done(1, CONFIG_FILE, keep ? "Kept (--force replaces it)" : "Created"));
     ui.gap();
@@ -11398,7 +12174,7 @@ ${INIT_HELP}`);
   const skill = "firegoat-onboarding skill";
   const block = liveBlock();
   ui?.gap();
-  if (ui && !noSkills && !localSkills) {
+  if (ui && asked) {
     const picked = await ui.ask(block, 3, "Install the firegoat-onboarding skill", [
       ["Global", skillsDir("global")],
       ["This repo", `${skillsDir("local")} (commit it for your team)`],