firegoat 0.27.0 → 0.28.0

package/README.md

@@ -16,7 +16,7 @@ When you run `firegoat eval`, you get visibility into how agents use your produc
 npx firegoat@latest init
 ```
 
-Then paste the prompt it prints into your agent, and let it set up the evals that point agents at your product. Then run them and see the results:
+In a terminal it asks where to install the firegoat-onboarding skill (global by default); run by an agent, it installs it into this repo's `.claude/skills/`. Then paste the prompt it prints into your agent, and let it set up the evals that point agents at your product. Then run them and see the results:
 
 ```bash
 npx firegoat@latest eval

package/dist/cli.js

@@ -6947,7 +6947,7 @@ var require_public_api = __commonJS(function(exports) {
 // package.json
 var package_default = {
   name: "firegoat",
-  version: "0.27.0",
+  version: "0.28.0",
   repository: {
     type: "git",
     url: "git+https://github.com/firegoat-ai/firegoat-cli.git"
@@ -7078,6 +7078,7 @@ function steps(events) {
         if (b.type === "tool_use")
           out.push({
             kind: "tool_call",
+            id: typeof b.id === "string" ? b.id : null,
             name: typeof b.name === "string" ? b.name : "",
             input: typeof b.input === "object" && b.input !== null ? b.input : null
           });
@@ -7089,6 +7090,7 @@ function steps(events) {
         if (b.type === "tool_result")
           out.push({
             kind: "tool_result",
+            callId: typeof b.tool_use_id === "string" ? b.tool_use_id : null,
             isError: b.is_error === true,
             text: resultText(b.content).trimEnd()
           });
@@ -7208,6 +7210,7 @@ var claude = {
   bin: "claude",
   installHint: "Install Claude Code (https://claude.com/claude-code) or pass --harness-bin PATH.",
   configDirName: ".claude",
+  argsKey: "claude_args",
   reservedArgs: [
     [["-p", "--print", ...FLAGS.filter((f) => f.startsWith("-"))], SET],
     [["--model"], "choose the model with top-level model: (or eval --model)"],
@@ -7216,7 +7219,7 @@ var claude = {
       "every run is a fresh session"
     ]
   ],
-  uploads: true,
+  claudeSessionFile: true,
   args: ({ prompt, model, extraArgs }) => [
     "-p",
     prompt,
@@ -7343,24 +7346,27 @@ function itemInput(item) {
 function steps2(events) {
   const out = [];
   const started = new Set;
-  for (const e of events) {
+  for (const [i, e] of events.entries()) {
     const item = e?.item;
     if (!item)
       continue;
+    const id = typeof item.id === "string" ? item.id : `event_${i}`;
     if (item.type === "command_execution") {
       const call = {
         kind: "tool_call",
+        id,
         name: "shell",
         input: { command: unwrapShell(str(item.command)) }
       };
       if (e?.type === "item.started") {
-        started.add(item.id);
+        started.add(id);
         out.push(call);
       } else if (e?.type === "item.completed") {
-        if (item.id === undefined || !started.has(item.id))
+        if (!started.has(id))
           out.push(call);
         out.push({
           kind: "tool_result",
+          callId: id,
           isError: item.exit_code !== 0,
           text: str(item.aggregated_output).trimEnd()
         });
@@ -7375,6 +7381,7 @@ function steps2(events) {
     } else if (item.type !== "reasoning" && item.type !== "error")
       out.push({
         kind: "tool_call",
+        id,
         name: str(item.type),
         input: itemInput(item)
       });
@@ -7523,6 +7530,7 @@ var codex = {
   bin: "codex",
   installHint: "Install Codex CLI (https://github.com/openai/codex) or pass --harness-bin PATH.",
   configDirName: ".codex",
+  argsKey: "codex_args",
   reservedArgs: [
     [[...FLAGS2, "-C", "--cd"], "firegoat sets it for every run"],
     [
@@ -7532,7 +7540,7 @@ var codex = {
     [["resume", "fork"], "every run is a fresh session"],
     [["--ephemeral"], "firegoat reads the session file codex saves"]
   ],
-  uploads: false,
+  claudeSessionFile: false,
   args: ({ prompt, model, extraArgs, cwd }) => [
     "exec",
     ...FLAGS2,
@@ -7629,6 +7637,7 @@ function toolResult(b) {
 `) : "";
   return {
     kind: "tool_result",
+    callId: typeof b.tool_use_id === "string" ? b.tool_use_id : null,
     isError: b.is_error === true || failed,
     text: text.trimEnd()
   };
@@ -7641,6 +7650,7 @@ function steps3(events) {
         if (b.type === "tool_use")
           out.push({
             kind: "tool_call",
+            id: typeof b.id === "string" ? b.id : null,
             name: typeof b.name === "string" ? b.name : "",
             input: isObject(b.input) ? b.input : null
           });
@@ -7791,6 +7801,7 @@ var grok = {
   bin: BIN,
   installHint: "Install grok (curl -fsSL https://x.ai/cli/install.sh | bash) or pass --harness-bin PATH.",
   configDirName: ".grok",
+  argsKey: "grok_args",
   reservedArgs: [
     [
       [
@@ -7826,7 +7837,7 @@ var grok = {
       "every run is a fresh session"
     ]
   ],
-  uploads: false,
+  claudeSessionFile: false,
   args: ({ prompt, model, extraArgs }) => [
     "-p",
     prompt,
@@ -7912,7 +7923,7 @@ function parseConfig(text) {
     "cleanup",
     "vars",
     "env",
-    "harness_args",
+    ...ARGS_KEYS,
     "tests"
   ]);
   const runs = posInt(raw.runs, "runs", 1);
@@ -7927,7 +7938,7 @@ function parseConfig(text) {
   const cleanup = commands(raw.cleanup, "cleanup", RUN_PLACEHOLDERS);
   const vars = parseVars(raw.vars);
   const env = parseEnv(raw.env, "env");
-  const harnessArgs = parseHarnessArgs(raw.harness_args, "harness_args");
+  const harnessArgs = parseAllHarnessArgs(raw, "");
   if (!Array.isArray(raw.tests) || raw.tests.length === 0)
     fail("tests", "must be a non-empty list");
   const names = new Set;
@@ -7944,7 +7955,7 @@ function parseConfig(text) {
       "env",
       "install",
       "cleanup",
-      "harness_args"
+      ...ARGS_KEYS
     ]);
     const name = str2(t.name, `${p}.name`);
     if (!NAME.test(name))
@@ -7974,10 +7985,7 @@ function parseConfig(text) {
       env: { ...env, ...parseEnv(t.env, `${p}.env`) },
       install: commands(t.install, `${p}.install`, RUN_PLACEHOLDERS),
       cleanup: commands(t.cleanup, `${p}.cleanup`, RUN_PLACEHOLDERS),
-      harnessArgs: [
-        ...harnessArgs,
-        ...parseHarnessArgs(t.harness_args, `${p}.harness_args`)
-      ]
+      harnessArgs: mergeHarnessArgs(harnessArgs, parseAllHarnessArgs(t, `${p}.`))
     };
   });
   return {
@@ -8020,26 +8028,35 @@ function nameList(raw, key, what) {
     return name;
   });
 }
-function parseHarnessArgs(raw, path) {
+var ARGS_KEYS = [...HARNESSES.values()].map((h) => h.argsKey);
+function parseAllHarnessArgs(raw, prefix) {
+  const out = {};
+  for (const h of HARNESSES.values())
+    out[h.name] = parseHarnessArgs(raw[h.argsKey], `${prefix}${h.argsKey}`, h);
+  return out;
+}
+function mergeHarnessArgs(top, test) {
+  const out = {};
+  for (const name of HARNESSES.keys())
+    out[name] = [...top[name] ?? [], ...test[name] ?? []];
+  return out;
+}
+function parseHarnessArgs(raw, path, harness) {
   if (raw === undefined)
     return [];
   if (!Array.isArray(raw))
-    fail(path, "must be a list of harness arguments, one per entry, e.g. [--chrome]");
+    fail(path, `must be a list of ${harness.name} arguments, one per entry, e.g. [--flag, value]`);
   return raw.map((a, i) => {
     const p = `${path}[${i}]`;
     const arg = str2(a, p);
     checkPlaceholders(arg, p, RUN_PLACEHOLDERS);
+    for (const [flags, why] of harness.reservedArgs)
+      for (const f of flags)
+        if (arg === f || arg.startsWith(`${f}=`))
+          fail(p, `${f} is not allowed for ${harness.name}: ${why}`);
     return { arg, path: p };
   });
 }
-function checkHarnessArgs(tests, harness) {
-  for (const t of tests)
-    for (const { arg, path } of t.harnessArgs)
-      for (const [flags, why] of harness.reservedArgs)
-        for (const f of flags)
-          if (arg === f || arg.startsWith(`${f}=`))
-            fail(path, `${f} is not allowed for ${harness.name}: ${why}`);
-}
 var VAR_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function parseVars(raw) {
   if (raw === undefined)
@@ -8157,9 +8174,9 @@ import {
   appendFileSync,
   createWriteStream as createWriteStream2,
   mkdirSync as mkdirSync5,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
-import { basename as basename3, delimiter as delimiter2, join as join10 } from "node:path";
+import { basename as basename2, delimiter as delimiter2, join as join10 } from "node:path";
 
 // src/agent-dirs.ts
 import { createHash, randomInt } from "node:crypto";
@@ -8796,19 +8813,22 @@ turns it off; FIREGOAT_TELEMETRY accepts only 0 or 1.
 
 ${EXIT_CODES}`;
 }
-var INIT_HELP = `Usage: firegoat init [--force] [--local-skills | --no-skills] [--no-login]
+var INIT_HELP = `Usage: firegoat init [--force] [--local-skills | --global-skills | --no-skills]
+                     [--no-login]
 
 In the current folder: creates .firegoat/ and a starter firegoat.yaml, installs the
-firegoat-onboarding skill globally, into ~/.claude/skills/ (npx skills add
-firegoat-ai/skills -g; in a terminal it asks: global, this repo, or none), offers
-firegoat login (in a terminal only; otherwise prints how), then prints a prompt to
+firegoat-onboarding skill (npx skills add firegoat-ai/skills; in a terminal it asks:
+global into ~/.claude/skills/, this repo, or none; otherwise, e.g. run by a coding
+agent, it installs into this repo's .claude/skills/), offers firegoat login (in a terminal only; otherwise prints how), then prints a prompt to
 paste into your coding agent. .firegoat/ holds local run output and ignores itself
 in git. Keep test fixtures (helper scripts, sample data) in fixtures/ next to
 firegoat.yaml, committed.
 
   --force          Replace an existing firegoat.yaml
-  --local-skills   Install the skill into this repo's .claude/skills/ instead
-                   (commit it so teammates and CI get it), without asking
+  --local-skills   Install the skill into this repo's .claude/skills/ (commit it
+                   so teammates and CI get it), without asking
+  --global-skills  Install the skill into ~/.claude/skills/ (skills add -g),
+                   without asking
   --no-skills      Don't install the skill
   --no-login       Don't offer firegoat login
 
@@ -8856,27 +8876,33 @@ firegoat.yaml reference:
                               tool that keeps state in ~ starts fresh in each
                               run. Only a tool that ignores HOME needs its own
                               var, e.g. MYTOOL_HOME: "$FIREGOAT_HOME/.mytool"
-  harness_args: [<arg>, ...]  Extra harness arguments, after firegoat's own flags
-                              and --model (for codex, before the prompt), to
-                              every selected harness. Each entry is one
-                              argument, passed as-is (no shell splitting):
-                              claude: [--chrome] (Claude in Chrome, for tests
-                              that need a browser), [--plugin-dir, ./plugins/x],
-                              --mcp-config, --agents, --append-system-prompt;
-                              codex: [-c, key=value], --enable, --add-dir.
+  claude_args: [<arg>, ...]   Extra claude-code arguments, after firegoat's own
+                              flags and --model. Each entry is one argument,
+                              passed as-is (no shell splitting): [--chrome]
+                              (Claude in Chrome, for tests that need a browser),
+                              [--plugin-dir, ./plugins/x], --mcp-config,
+                              --agents, --append-system-prompt
+  codex_args: [<arg>, ...]    Extra codex-cli arguments, before the prompt:
+                              [-c, key=value], --enable, --add-dir
+  grok_args: [<arg>, ...]     Extra grok-cli arguments, after firegoat's flags.
+                              Each key goes to its harness only. A key for a
+                              harness this eval doesn't run is checked but not
+                              used, so one firegoat.yaml can carry args for
+                              every --harness.
                               Entries expand like env: values
                               ($FIREGOAT_WORKDIR, $FIREGOAT_HOME, $FIREGOAT_OUT,
                               {{vars.KEY}}, {{run.*}}); run.json harnessArgs has
-                              the result. Flags firegoat sets are errors, also
-                              as --flag=value. claude-code: -p, --print,
-                              --output-format, --verbose, --setting-sources,
-                              --strict-mcp-config, --disable-slash-commands,
+                              the run's harness's result. Flags firegoat sets
+                              are errors, also as --flag=value. claude_args:
+                              -p, --print, --output-format, --verbose,
+                              --setting-sources, --strict-mcp-config,
+                              --disable-slash-commands,
                               --dangerously-skip-permissions, --model (use
                               model:), --session-id, --resume, -r, --continue,
-                              -c. codex-cli: --json, --skip-git-repo-check,
+                              -c. codex_args: --json, --skip-git-repo-check,
                               --dangerously-bypass-approvals-and-sandbox, -C,
                               --cd, -m, --model (use model:), resume, fork,
-                              --ephemeral. grok-cli: -p, --single,
+                              --ephemeral. grok_args: -p, --single,
                               --prompt-file, --prompt-json, --output-format,
                               --json-schema, --always-approve,
                               --permission-mode, --no-auto-update, --cwd, -w,
@@ -8894,7 +8920,8 @@ firegoat.yaml reference:
       env: {NAME: value}      Optional, on top of the top-level env:
       install: <sh> | [...]   Optional, runs after the top-level install
       cleanup: <sh> | [...]   Optional, runs before the top-level cleanup
-      harness_args: [...]     Optional, after the top-level harness_args
+      claude_args: [...]      Optional, after the top-level claude_args (same
+                              for codex_args, grok_args)
 
   Step order: build once per eval; then per run: install (top-level, then the
   test's), the agent, checks, cleanup (the test's, then top-level).
@@ -8930,7 +8957,7 @@ firegoat.yaml reference:
   so the agent's commands see them too.
 
 Testing an MCP server: commit its config as fixtures/mcp.json, copy it in build:
-and pass it with harness_args (claude-code). Only the configs you pass load: --strict-mcp-config
+and pass it with claude_args. Only the configs you pass load: --strict-mcp-config
 is always on. An MCP server inherits claude's env, which keeps your real HOME
 (claude's login is there), so set the server's HOME to the run's home, or it
 writes to yours. claude gets $FIREGOAT_HOME, $FIREGOAT_WORKDIR and $FIREGOAT_OUT
@@ -8941,7 +8968,7 @@ relative paths in it are from the run's folder, claude's cwd:
       "env": {"HOME": "\${FIREGOAT_HOME}"}}}}
   firegoat.yaml:
     build: cp -R fixtures/. "$FIREGOAT_OUT"
-    harness_args: [--mcp-config, $FIREGOAT_OUT/mcp.json]
+    claude_args: [--mcp-config, $FIREGOAT_OUT/mcp.json]
 
 Example:
   build: npm pack --pack-destination "$FIREGOAT_OUT"
@@ -8964,7 +8991,7 @@ Example:
         Get an acme API key from the acme dashboard (I'm logged in in Chrome) and put
         it in .env as ACME_API_KEY.
       end_goal: .env holds a key copied from the dashboard, not a made-up one.
-      harness_args: [--chrome]
+      claude_args: [--chrome]
 
 init also says that firegoat sends anonymous usage stats; FIREGOAT_TELEMETRY=0
 (or DO_NOT_TRACK=1) turns them off. Fields: firegoat --help, Telemetry.
@@ -8973,7 +9000,7 @@ Exit codes: 0 done, 1 the firegoat login failed (the files stay), 2 the skill
 install failed, 3 usage error.`;
 var LOGIN_HELP = `Usage: firegoat login
 
-Logs in to firegoat.ai so eval uploads each run's claude session there as a private
+Logs in to firegoat.ai so eval uploads each run's session there as a private
 trace (you share it from its page). OAuth device flow: prints a URL and a code (and
 opens the browser in a terminal); approve it there, and the trace key is saved to
 ~/.firegoat/credentials.json (mode 0600). The key is never passed to the agent,
@@ -8983,7 +9010,9 @@ read ~/.firegoat, and a FIREGOAT_API_KEY in firegoat's own process env (ps eww,
 your own traces; revoke it on the firegoat.ai traces page.
 
 What eval uploads per run: session.jsonl (prompts, tool calls and outputs, file
-contents: possibly secrets from your env or repo), checks.txt and stderr.txt (check
+contents: possibly secrets from your env or repo; claude's own session file, or for
+codex and grok one in claude's format made from the run's stream, the run dir's
+session.jsonl), checks.txt and stderr.txt (check
 output, which sees vars:). firegoat.ai masks secrets when showing a trace but stores
 the text as sent. eval --no-upload keeps a run local.
 
@@ -9040,7 +9069,7 @@ the run's folder.
 
 claude runs on its own login (or ANTHROPIC_API_KEY if set, as claude always does)
 with a fresh config dir, ~/.firegoat/runs/<hash>/.claude: none of your settings,
-CLAUDE.md, plugins, skills or MCP servers (harness_args: in firegoat.yaml adds
+CLAUDE.md, plugins, skills or MCP servers (claude_args: in firegoat.yaml adds
 claude flags, e.g. --chrome or --plugin-dir). claude saves its session there. There
 is no sandbox: the agent can still reach the rest of your machine, including the
 repo, if it goes looking.
@@ -9050,9 +9079,10 @@ fresh CODEX_HOME, ~/.firegoat/runs/<hash>/.codex, holding a link to your codex l
 (~/.codex/auth.json, or $CODEX_HOME/auth.json; run codex login first), and with
 -c project_doc_max_bytes=0: no AGENTS.md, config.toml, skills or plugins of
 yours. codex's own HOME is the run's home (below), also for its Read/Write. It
-saves its session (rollout) under that CODEX_HOME's sessions/. firegoat.ai doesn't
-read codex sessions yet: those runs are not uploaded. codex reports no turns or
-cost; its model comes from the session file.
+saves its session (rollout) under that CODEX_HOME's sessions/. firegoat.ai reads
+claude's session format: the upload is the run dir's session.jsonl, made from the
+--json stream. codex reports no turns or cost; its model comes from the session
+file.
 
 grok-cli runs ~/.grok/bin/grok (where grok's installer puts it; never a grok on
 PATH, which may be a wrapper such as cmux's: a #! script is refused) as grok -p
@@ -9064,8 +9094,8 @@ your real one it loads Claude Code's skills, plugins, MCP servers and hooks. eva
 refuses a login that expires within 5 minutes (run grok -p hi once to refresh it):
 a refresh inside a run would replace the link with a file, which the next eval
 asks you to move back over ~/.grok/auth.json. The session is a directory,
-$GROK_HOME/sessions/<cwd>/<id>/ ($FIREGOAT_SESSION). firegoat.ai doesn't read
-grok sessions yet: those runs are not uploaded.
+$GROK_HOME/sessions/<cwd>/<id>/ ($FIREGOAT_SESSION). Like codex's, its upload is
+the run dir's session.jsonl, made from the stream in claude's session format.
 
 Every run gets its own HOME, ~/.firegoat/runs/<hash>/<random>/home next to work
 (with XDG_CONFIG_HOME, XDG_CACHE_HOME, XDG_DATA_HOME, XDG_STATE_HOME inside it), as
@@ -9112,7 +9142,8 @@ firegoat.yaml, fixtures and build: stay in the current folder.
   --dry-run          Check firegoat.yaml as eval would (test names, --var,
                      --model, --harness, missing vars), print each planned
                      run ("<test>#<n> [harness model]" with its install, checks
-                     and cleanup counts and rendered harness_args, paths under
+                     and cleanup counts and its harness's rendered args
+                     (claude_args, ...), paths under
                      ~/.firegoat/runs/<hash>/<random>/) and exit 0. Builds
                      nothing, starts no agent, uploads nothing, writes no
                      files. Config errors
@@ -9150,12 +9181,16 @@ Output: .firegoat/runs/<runId>/
   <test>/<n>/run.json     One run: status and reason (from the checks), harness,
                           model (asked for, or null) and reportedModel (what
                           the harness reported running, or null), harnessArgs
-                          (harness_args passed), prompt, end_goal,
+                          (its harness's claude_args/codex_args/grok_args
+                          passed, expanded), prompt, end_goal,
                           checks [{run, code}], cleanup [{run, code}],
                           leftover [{pid, command}] (processes stopped after
                           cleanup), and paths: dir (this folder), workdir, home
                           (the run's HOME; both real paths, under ~/.firegoat),
-                          transcript, session (the harness's session file), stderr,
+                          transcript, session (the harness's session file),
+                          claudeSession (the session.jsonl uploaded: claude's
+                          own file, else <test>/<n>/session.jsonl made from the
+                          stream) and sessionId (its id, the trace's), stderr,
                           checksLog, cleanupLog; startedAt; upload ({status: "uploaded",
                           url} | {status: "failed", error} | {status:
                           "skipped", reason}, null when not uploading)
@@ -9334,6 +9369,544 @@ async function stopLeftovers(opts) {
   return leftover;
 }
 
+// src/session.ts
+import { randomUUID } from "node:crypto";
+import { writeFileSync as writeFileSync3 } from "node:fs";
+
+// src/atif.ts
+var MAX_BLOCK_CHARS = 50000;
+function flattenContent(value) {
+  if (typeof value === "string")
+    return value;
+  if (Array.isArray(value)) {
+    return value.map((item) => {
+      if (typeof item === "string")
+        return item;
+      if (item && typeof item === "object") {
+        const obj = item;
+        if (typeof obj.text === "string")
+          return obj.text;
+        if (typeof obj.content === "string")
+          return obj.content;
+      }
+      return JSON.stringify(item);
+    }).join(`
+`);
+  }
+  if (value == null)
+    return "";
+  return JSON.stringify(value);
+}
+function cap(text) {
+  return text.length > MAX_BLOCK_CHARS ? text.slice(0, MAX_BLOCK_CHARS) : text;
+}
+function shellQuote2(path) {
+  return `'${path.replace(/'/g, `'\\''`)}'`;
+}
+var CAPPED_STRING_FIELDS = [
+  "content",
+  "old_string",
+  "new_string",
+  "command",
+  "input"
+];
+function capToolInput(args) {
+  const input = args ?? {};
+  const serialized = JSON.stringify(input);
+  if (serialized.length <= MAX_BLOCK_CHARS)
+    return input;
+  if (input && typeof input === "object") {
+    const obj = input;
+    const capped = {};
+    for (const [key, value] of Object.entries(obj)) {
+      if (CAPPED_STRING_FIELDS.includes(key) && typeof value === "string") {
+        capped[key] = cap(value);
+      } else if (key === "edits" && Array.isArray(value)) {
+        capped[key] = value.map((edit) => edit && typeof edit === "object" ? {
+          ...edit,
+          old_string: typeof edit.old_string === "string" ? cap(edit.old_string) : edit.old_string,
+          new_string: typeof edit.new_string === "string" ? cap(edit.new_string) : edit.new_string
+        } : edit);
+      } else {
+        capped[key] = value;
+      }
+    }
+    if (JSON.stringify(capped).length <= MAX_BLOCK_CHARS)
+      return capped;
+  }
+  return { _truncated: serialized.slice(0, MAX_BLOCK_CHARS) };
+}
+var PATCH_FILE_MARKERS = [
+  { re: /^\*\*\* Update File: (.+)$/, op: "modify" },
+  { re: /^\*\*\* Add File: (.+)$/, op: "add" },
+  { re: /^\*\*\* Delete File: (.+)$/, op: "delete" }
+];
+function parseCodexPatch(patch) {
+  if (typeof patch !== "string" || patch.length === 0)
+    return null;
+  const lines = patch.split(`
+`);
+  const sections = [];
+  let current = null;
+  for (const line of lines) {
+    if (line === "*** Begin Patch")
+      continue;
+    if (line === "*** End Patch")
+      break;
+    const marker = PATCH_FILE_MARKERS.map((m) => ({
+      m,
+      hit: line.match(m.re)
+    })).find((x) => x.hit);
+    if (marker) {
+      current = {
+        op: marker.m.op,
+        path: marker.hit[1],
+        body: []
+      };
+      sections.push(current);
+      continue;
+    }
+    const move = line.match(/^\*\*\* Move to: (.+)$/);
+    if (move && current) {
+      current.renameTo = move[1];
+      continue;
+    }
+    if (line.startsWith("*** "))
+      continue;
+    if (current)
+      current.body.push(line);
+  }
+  if (sections.length === 0)
+    return null;
+  return sections;
+}
+function reconstructHunk(hunkLines) {
+  const oldLines = [];
+  const newLines = [];
+  for (const line of hunkLines) {
+    const marker = line[0];
+    if (marker === "-") {
+      oldLines.push(line.slice(1));
+    } else if (marker === "+") {
+      newLines.push(line.slice(1));
+    } else if (marker === " ") {
+      oldLines.push(line.slice(1));
+      newLines.push(line.slice(1));
+    } else if (line === "") {
+      oldLines.push("");
+      newLines.push("");
+    }
+  }
+  return { old_string: oldLines.join(`
+`), new_string: newLines.join(`
+`) };
+}
+function splitHunks(body) {
+  const hunks = [];
+  let current = null;
+  for (const line of body) {
+    if (line.startsWith("@@")) {
+      current = [];
+      hunks.push(current);
+      continue;
+    }
+    if (current)
+      current.push(line);
+  }
+  return hunks.filter((h) => h.length > 0);
+}
+function sectionToBlock(section) {
+  if (section.op === "delete") {
+    return [
+      {
+        name: "Bash",
+        input: { command: `rm -f -- ${shellQuote2(section.path)}` }
+      }
+    ];
+  }
+  if (section.op === "add") {
+    const content = section.body.filter((l) => l.startsWith("+")).map((l) => l.slice(1)).join(`
+`);
+    return [{ name: "Write", input: { file_path: section.path, content } }];
+  }
+  const targetPath = section.renameTo ?? section.path;
+  const rename = section.renameTo ? [
+    {
+      name: "Bash",
+      input: {
+        command: `mv -- ${shellQuote2(section.path)} ${shellQuote2(section.renameTo)}`
+      }
+    }
+  ] : [];
+  const edits = splitHunks(section.body).map(reconstructHunk);
+  if (edits.length === 0)
+    return rename;
+  const [only] = edits;
+  if (edits.length === 1 && only) {
+    return [
+      ...rename,
+      {
+        name: "Edit",
+        input: {
+          file_path: targetPath,
+          old_string: only.old_string,
+          new_string: only.new_string
+        }
+      }
+    ];
+  }
+  return [
+    ...rename,
+    { name: "MultiEdit", input: { file_path: targetPath, edits } }
+  ];
+}
+var str3 = (v) => typeof v === "string";
+function withReadRange(input, a) {
+  if (typeof a.offset === "number")
+    input.offset = a.offset;
+  if (typeof a.limit === "number")
+    input.limit = a.limit;
+  return input;
+}
+var TOOL_TRANSFORMS = {
+  shellToolCall: (a) => str3(a.command) ? { name: "Bash", input: { command: a.command } } : null,
+  readToolCall: (a) => str3(a.path) ? { name: "Read", input: { file_path: a.path } } : null,
+  editToolCall: (a) => str3(a.path) ? {
+    name: "Write",
+    input: { file_path: a.path, content: a.streamContent }
+  } : null,
+  globToolCall: (a) => str3(a.globPattern) ? {
+    name: "Glob",
+    input: { pattern: a.globPattern, path: a.targetDirectory }
+  } : null,
+  grepToolCall: (a) => str3(a.pattern) ? { name: "Grep", input: { pattern: a.pattern, path: a.path } } : null,
+  webFetchToolCall: (a) => str3(a.url) ? { name: "WebFetch", input: { url: a.url } } : null,
+  webSearchToolCall: (a) => str3(a.searchTerm) ? { name: "WebSearch", input: { query: a.searchTerm } } : null,
+  bash: (a) => str3(a.command) ? { name: "Bash", input: { command: a.command } } : null,
+  glob: (a) => str3(a.pattern) ? { name: "Glob", input: { pattern: a.pattern, path: a.path } } : null,
+  grep: (a) => str3(a.pattern) ? { name: "Grep", input: { pattern: a.pattern, path: a.path } } : null,
+  webfetch: (a) => str3(a.url) ? { name: "WebFetch", input: { url: a.url } } : null,
+  todowrite: (a) => Array.isArray(a.todos) ? {
+    name: "TodoWrite",
+    input: {
+      todos: a.todos.map((t) => ({
+        content: t.content,
+        status: t.status
+      }))
+    }
+  } : null,
+  read: (a) => {
+    const filePath = str3(a.filePath) ? a.filePath : str3(a.path) ? a.path : null;
+    return filePath ? { name: "Read", input: withReadRange({ file_path: filePath }, a) } : null;
+  },
+  exec: (a) => str3(a.command) ? { name: "Bash", input: { command: a.command } } : null,
+  write: (a) => str3(a.path) ? { name: "Write", input: { file_path: a.path, content: a.content } } : null,
+  edit: (a) => {
+    if (!str3(a.path) || !Array.isArray(a.edits) || a.edits.length === 0)
+      return null;
+    if (a.edits.length === 1) {
+      const e = a.edits[0];
+      return {
+        name: "Edit",
+        input: {
+          file_path: a.path,
+          old_string: e.oldText,
+          new_string: e.newText
+        }
+      };
+    }
+    return {
+      name: "MultiEdit",
+      input: {
+        file_path: a.path,
+        edits: a.edits.map((e) => ({
+          old_string: e.oldText,
+          new_string: e.newText
+        }))
+      }
+    };
+  },
+  web_fetch: (a) => str3(a.url) ? { name: "WebFetch", input: { url: a.url } } : null,
+  update_plan: (a) => Array.isArray(a.plan) ? {
+    name: "TodoWrite",
+    input: {
+      todos: a.plan.map((p) => ({
+        content: p.step,
+        status: p.status
+      }))
+    }
+  } : null,
+  shell: (a) => str3(a.command) && (a.action === undefined || a.action === "run") ? { name: "Bash", input: { command: a.command } } : null,
+  read_file: (a) => {
+    if (!str3(a.path))
+      return null;
+    const input = { file_path: a.path };
+    if (typeof a.start_line === "number")
+      input.offset = a.start_line;
+    if (typeof a.line_count === "number")
+      input.limit = a.line_count;
+    return { name: "Read", input };
+  },
+  write_file: (a) => str3(a.path) ? { name: "Write", input: { file_path: a.path, content: a.content } } : null,
+  edit_file: (a) => str3(a.path) ? {
+    name: "Edit",
+    input: {
+      file_path: a.path,
+      old_string: a.old_string,
+      new_string: a.new_string
+    }
+  } : null,
+  glob_files: (a) => str3(a.pattern) ? { name: "Glob", input: { pattern: a.pattern, path: a.path } } : null,
+  grep_files: (a) => str3(a.pattern) ? { name: "Grep", input: { pattern: a.pattern, path: a.path } } : null,
+  exa_search: (a) => str3(a.query) ? { name: "WebSearch", input: { query: a.query } } : null
+};
+function normalizeToolCall(functionName, args) {
+  const obj = args && typeof args === "object" ? args : null;
+  if (functionName === "exec_command" && obj && "cmd" in obj) {
+    const { cmd, ...rest } = obj;
+    return [{ name: "Bash", input: { ...rest, command: cmd } }];
+  }
+  if (functionName === "apply_patch" && obj) {
+    const rawPatch = obj.input ?? obj.patchText;
+    const sections = parseCodexPatch(rawPatch);
+    if (sections) {
+      const blocks = sections.flatMap(sectionToBlock);
+      if (blocks.length > 0)
+        return blocks;
+    }
+    return [{ name: functionName, input: args }];
+  }
+  if (functionName === "web_search_call" && obj) {
+    const actionType = obj.action_type;
+    if (actionType === "open_page")
+      return [{ name: "WebFetch", input: obj }];
+    if (actionType === "search") {
+      if ("query" in obj && typeof obj.query === "string")
+        return [{ name: "WebSearch", input: obj }];
+      const altKey = ["queries", "q", "search_query"].find((k) => (k in obj));
+      if (altKey) {
+        const { [altKey]: raw, ...rest } = obj;
+        const query = Array.isArray(raw) ? raw.find((q) => typeof q === "string") : raw;
+        if (typeof query !== "string")
+          return [{ name: functionName, input: args }];
+        const preserved = Array.isArray(raw) ? { queries: raw } : {};
+        return [{ name: "WebSearch", input: { ...rest, ...preserved, query } }];
+      }
+      return [{ name: functionName, input: args }];
+    }
+    return [{ name: functionName, input: args }];
+  }
+  if (functionName && functionName in TOOL_TRANSFORMS && obj) {
+    const block = TOOL_TRANSFORMS[functionName](obj);
+    if (block)
+      return [block];
+  }
+  return [{ name: functionName, input: args }];
+}
+function toolCallId(tc, step, index) {
+  if (tc.tool_call_id)
+    return tc.tool_call_id;
+  return `call_${step.step_id}_${tc.function_name ?? "tool"}_${index}`;
+}
+var HARBOR_PLACEHOLDER_MESSAGES = new Set([
+  "(tool use)",
+  "(no assistant text)"
+]);
+function isExecutedRestatement(message, toolCalls) {
+  const trimmed = message.trimStart();
+  if (!trimmed.startsWith("Executed "))
+    return false;
+  const rest = trimmed.slice("Executed ".length);
+  return toolCalls.some((tc) => tc.function_name && rest.startsWith(tc.function_name));
+}
+var ENVELOPE_META = [
+  /^Chunk ID:/,
+  /^Wall time:/,
+  /^Original token count:/,
+  /^Process exited with code /,
+  /^Exit code:/
+];
+function stripCodexResultEnvelope(content) {
+  const lines = content.split(`
+`);
+  const outputIdx = lines.findIndex((l) => l === "Output:");
+  if (outputIdx === -1)
+    return content;
+  const preamble = lines.slice(0, outputIdx);
+  if (!preamble.some((l) => ENVELOPE_META.some((re) => re.test(l))))
+    return content;
+  let exitCode = 0;
+  for (const line of preamble) {
+    const m = line.match(/^(?:Process exited with code|Exit code:) (\d+)$/);
+    if (m)
+      exitCode = Number(m[1]);
+  }
+  const output = lines.slice(outputIdx + 1).join(`
+`);
+  return exitCode === 0 ? output : `[exit code ${exitCode}]
+${output}`;
+}
+function convertAtifToSession(trajectory) {
+  if (!Array.isArray(trajectory?.steps)) {
+    throw new Error("atif: the trajectory has no steps array");
+  }
+  const events = [];
+  for (const step of trajectory.steps) {
+    if (step.source === "system")
+      continue;
+    if (step.source === "user") {
+      const userText = flattenContent(step.message);
+      if (userText.includes("<environment_context>"))
+        continue;
+      events.push({
+        uuid: `atif-${step.step_id}-user`,
+        type: "user",
+        timestamp: step.timestamp,
+        message: { role: "user", content: cap(userText) }
+      });
+      continue;
+    }
+    if (step.source !== "agent")
+      continue;
+    const toolCalls = step.tool_calls ?? [];
+    const blocks = [];
+    const reasoning = flattenContent(step.reasoning_content);
+    if (reasoning)
+      blocks.push({ type: "thinking", thinking: cap(reasoning) });
+    const messageText = flattenContent(step.message);
+    if (messageText && !isExecutedRestatement(messageText, toolCalls) && !HARBOR_PLACEHOLDER_MESSAGES.has(messageText.trim())) {
+      blocks.push({ type: "text", text: cap(messageText) });
+    }
+    const toolUseIds = [];
+    for (let i = 0;i < toolCalls.length; i++) {
+      const tc = toolCalls[i];
+      const id = toolCallId(tc, step, i);
+      toolUseIds.push(id);
+      const split = normalizeToolCall(tc.function_name, tc.arguments);
+      split.forEach(({ name, input }, k) => {
+        const isLast = k === split.length - 1;
+        blocks.push({
+          type: "tool_use",
+          id: isLast ? id : `${id}__patch${k}`,
+          name,
+          input: capToolInput(input)
+        });
+      });
+    }
+    if (blocks.length > 0) {
+      events.push({
+        uuid: `atif-${step.step_id}-assistant`,
+        type: "assistant",
+        timestamp: step.timestamp,
+        message: {
+          id: `atif-step-${step.step_id}`,
+          role: "assistant",
+          model: step.model_name,
+          content: blocks
+        }
+      });
+    }
+    const results = step.observation?.results;
+    if (results && results.length > 0) {
+      const resultBlocks = results.map((result, i) => {
+        const content = result.subagent_trajectory_ref ? `[subagent trajectory: ${result.subagent_trajectory_ref}]` : stripCodexResultEnvelope(flattenContent(result.content));
+        return {
+          type: "tool_result",
+          tool_use_id: result.source_call_id || toolUseIds[i] || `call_${step.step_id}_result${i}`,
+          content: cap(content)
+        };
+      });
+      events.push({
+        uuid: `atif-${step.step_id}-results`,
+        type: "user",
+        timestamp: step.timestamp,
+        message: { role: "user", content: resultBlocks }
+      });
+    }
+  }
+  return events;
+}
+
+// src/session.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function convertedSessionId(harnessId) {
+  return UUID.test(harnessId) ? harnessId.toLowerCase() : randomUUID();
+}
+function toTrajectory(t) {
+  const steps = [{ step_id: 1, source: "user", message: t.prompt }];
+  const agent = (fields) => {
+    const step = {
+      step_id: steps.length + 1,
+      source: "agent",
+      message: "",
+      ...t.model === null ? {} : { model_name: t.model },
+      ...fields
+    };
+    steps.push(step);
+    return step;
+  };
+  const calls = new Map;
+  const failed = new Set;
+  let lastText = null;
+  for (const s of t.steps) {
+    if (s.kind === "text") {
+      agent({ message: s.text });
+      lastText = s.text;
+    } else if (s.kind === "tool_call") {
+      const id = s.id ?? `firegoat_call_${steps.length + 1}`;
+      const step = agent({
+        tool_calls: [
+          { tool_call_id: id, function_name: s.name, arguments: s.input }
+        ]
+      });
+      calls.set(id, step);
+    } else {
+      const call = s.callId === null ? undefined : calls.get(s.callId);
+      const id = s.callId ?? `firegoat_result_${steps.length + 1}`;
+      const result = { source_call_id: id, content: s.text };
+      if (!call)
+        agent({ observation: { results: [result] } });
+      else if (call.observation)
+        call.observation.results.push(result);
+      else
+        call.observation = { results: [result] };
+      if (s.isError)
+        failed.add(id);
+    }
+  }
+  if (t.final !== "" && t.final !== lastText)
+    agent({ message: t.final });
+  return {
+    trajectory: {
+      schema_version: "ATIF-v1.6",
+      session_id: t.sessionId,
+      agent: {
+        name: t.harness,
+        ...t.version === null ? {} : { version: t.version },
+        ...t.model === null ? {} : { model_name: t.model }
+      },
+      steps
+    },
+    failed
+  };
+}
+function toClaudeSession(t) {
+  const { trajectory, failed } = toTrajectory(t);
+  return convertAtifToSession(trajectory).map((e) => {
+    const content = e.message?.content;
+    if (Array.isArray(content)) {
+      for (const b of content)
+        if (b.type === "tool_result" && failed.has(b.tool_use_id))
+          b.is_error = true;
+    }
+    return { ...e, sessionId: t.sessionId };
+  });
+}
+function writeClaudeSession(path, t) {
+  writeFileSync3(path, toClaudeSession(t).map((e) => `${JSON.stringify(e)}
+`).join(""));
+}
+
 // src/steps.ts
 import { createWriteStream } from "node:fs";
 var STEP_TIMEOUT_MS = 600000;
@@ -9468,7 +10041,7 @@ async function sendTelemetry(event, exitCode, startedAt) {
 }
 
 // src/transcript.ts
-import { readdirSync as readdirSync5, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { readdirSync as readdirSync5, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join8, relative } from "node:path";
 var OUTPUT_LINES = 15;
 var OUTPUT_CHARS = 1500;
@@ -9552,7 +10125,7 @@ ${indent(truncate(s.text, OUTPUT_LINES, OUTPUT_CHARS))}` : `    → ${status}`);
     out.pop();
   out.push("", "## final answer", final ? prose(final) : "(none)");
   out.push("", "## files in the workdir", ...workdirFiles(opts.workdir));
-  writeFileSync3(opts.path, `${out.join(`
+  writeFileSync4(opts.path, `${out.join(`
 `)}
 `);
 }
@@ -9857,11 +10430,9 @@ function ttyUI(out, opts) {
 
 // src/upload.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
-import { basename as basename2 } from "node:path";
 var MAX_FILE = 20 * 1024 * 1024;
 var MAX_CHECKS = 200;
 var MAX_TEXT = 8192;
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var FILES = ["session.jsonl", "checks.txt", "stderr.txt"];
 function clip(s, max, marker) {
   return s.length > max ? `${s.slice(0, max - marker.length)}${marker}` : s;
@@ -9918,9 +10489,11 @@ async function put(name, entry, bytes) {
     throw new ApiError(`PUT ${name} ${r.status}`, r.status);
 }
 async function uploadRun(t, r) {
-  if (!r.session)
+  if (!r.claudeSession)
     return { status: "skipped", reason: "No session file" };
-  const sessionId = basename2(r.session, ".jsonl");
+  const { sessionId } = r;
+  if (sessionId === null)
+    throw new Error(`run ${r.test}#${r.n} has a session file but no session id`);
   if (!UUID.test(sessionId))
     return {
       status: "failed",
@@ -9932,7 +10505,7 @@ async function uploadRun(t, r) {
       error: `${r.checks.length} checks, the upload takes at most ${MAX_CHECKS}`
     };
   const paths = {
-    "session.jsonl": r.session,
+    "session.jsonl": r.claudeSession,
     "checks.txt": r.checksLog,
     "stderr.txt": r.stderr
   };
@@ -9973,6 +10546,7 @@ async function uploadRun(t, r) {
       num_turns: r.num_turns,
       cost: r.cost,
       duration_ms: r.duration_ms,
+      harness: r.harness,
       model,
       ...git && { git }
     },
@@ -10122,7 +10696,7 @@ function newRunId() {
   return `${ts}-${randomBytes2(2).toString("hex")}`;
 }
 function writeRunJson(r) {
-  writeFileSync4(join10(r.dir, "run.json"), `${JSON.stringify(r, null, 2)}
+  writeFileSync5(join10(r.dir, "run.json"), `${JSON.stringify(r, null, 2)}
 `);
 }
 async function uploadPreflight(opts, ui, project, runGroup, git) {
@@ -10173,8 +10747,8 @@ function runFill(runId, n, testName, out, agentDir) {
     FIREGOAT_HOME: join10(agentDir, "home")
   };
 }
-function renderHarnessArgs(test, vars, fill) {
-  return test.harnessArgs.map((a) => renderValue(a.arg, vars, fill, a.path));
+function renderHarnessArgs(test, harness, vars, fill) {
+  return (test.harnessArgs[harness] ?? []).map((a) => renderValue(a.arg, vars, fill, a.path));
 }
 function renderSteps(what, commands, vars, fill) {
   return commands.map((c, i) => renderStep(c, vars, fill, `${what}[${i}]`));
@@ -10211,7 +10785,7 @@ function dryRun(opts) {
     renderEnv(test.env, opts.vars, fill);
     return {
       ...p,
-      harnessArgs: renderHarnessArgs(test, opts.vars, fill),
+      harnessArgs: renderHarnessArgs(test, p.harness, opts.vars, fill),
       ...renderRunSteps(test, opts.config, opts.vars, fill)
     };
   });
@@ -10223,7 +10797,7 @@ function dryRun(opts) {
   const count = (n, what) => `${n} ${what}${n === 1 ? "" : "s"}`;
   opts.say(`Dry run: ${count(runs.length, "run")}, build ${count(opts.config.build.length, "step")}. Nothing was started.`);
   for (const r of runs)
-    opts.say(`${r.test}#${r.n}${runTag(opts.showHarness ? r.harness : null, r.model)} install ${r.install.length}, checks ${r.checks.length}, cleanup ${r.cleanup.length}${r.harnessArgs.length > 0 ? `, harness_args ${JSON.stringify(r.harnessArgs)}` : ""}`);
+    opts.say(`${r.test}#${r.n}${runTag(opts.showHarness ? r.harness : null, r.model)} install ${r.install.length}, checks ${r.checks.length}, cleanup ${r.cleanup.length}${r.harnessArgs.length > 0 ? `, ${HARNESSES.get(r.harness).argsKey} ${JSON.stringify(r.harnessArgs)}` : ""}`);
 }
 async function runOne(opts) {
   const { test, n } = opts;
@@ -10243,7 +10817,7 @@ async function runOne(opts) {
     harness: opts.harness.name,
     model: opts.model,
     reportedModel: null,
-    harnessArgs: renderHarnessArgs(test, opts.vars, fill),
+    harnessArgs: renderHarnessArgs(test, opts.harness.name, opts.vars, fill),
     status: "error",
     reason: "",
     prompt: render(test.prompt, opts.vars),
@@ -10253,6 +10827,8 @@ async function runOne(opts) {
     workdir,
     home,
     session: null,
+    claudeSession: null,
+    sessionId: null,
     transcript: join10(dir, "transcript.txt"),
     stderr: join10(dir, "stderr.txt"),
     checksLog: join10(dir, "checks.txt"),
@@ -10341,6 +10917,24 @@ async function attempt(opts, r, steps, env, stepEnv, homeEnvFile, agent) {
   if (outcome.sessionId)
     r.session = harness.findSession(opts.configDir, outcome.sessionId);
   r.reportedModel = outcome.reportedModel ?? (r.session && harness.sessionModel ? harness.sessionModel(r.session) : null);
+  if (r.session && outcome.sessionId) {
+    if (harness.claudeSessionFile) {
+      r.claudeSession = r.session;
+      r.sessionId = outcome.sessionId;
+    } else {
+      r.sessionId = convertedSessionId(outcome.sessionId);
+      r.claudeSession = join10(dir, "session.jsonl");
+      writeClaudeSession(r.claudeSession, {
+        sessionId: r.sessionId,
+        harness: harness.name,
+        version: outcome.version,
+        model: r.reportedModel,
+        prompt: r.prompt,
+        steps: outcome.steps,
+        final: outcome.final
+      });
+    }
+  }
   const about = [
     opts.shownHarness,
     opts.model === null ? null : `model ${opts.model}`
@@ -10390,9 +10984,6 @@ async function attempt(opts, r, steps, env, stepEnv, homeEnvFile, agent) {
     test.checks.length === 0 ? "no script checks" : `${r.checks.length}/${r.checks.length} checks passed`
   ];
 }
-function notUploaded(h) {
-  return `firegoat.ai doesn't read ${h.name} sessions yet: its runs stay local`;
-}
 var MAX_LISTED_URLS = 5;
 function uploadedSummary(origin, results, runDir) {
   const urls = results.flatMap((r) => r.upload?.status === "uploaded" ? [r.upload.url] : []);
@@ -10431,7 +11022,7 @@ async function evalCommand(args, root) {
   const say = opts.json ? console.error : console.log;
   const stream = opts.json ? process.stderr : process.stdout;
   const ui = stream.isTTY ? ttyUI(stream, {
-    project: basename3(root),
+    project: basename2(root),
     version: package_default.version,
     color: !process.env.NO_COLOR
   }) : plainUI(say);
@@ -10460,14 +11051,6 @@ async function evalCommand(args, root) {
     return fatal(EXIT.usage, `--harness-bin needs exactly one harness, this eval runs ${harnessNames.length} (${harnessNames.join(", ")}): pick one with --harness`, "usage");
   const harnesses = harnessNames.map((h) => HARNESSES.get(h));
   const showHarness = showsHarness(harnessNames);
-  try {
-    for (const h of harnesses)
-      checkHarnessArgs(tests, h);
-  } catch (e) {
-    if (e instanceof ConfigError)
-      return fatal(EXIT.usage, e.message, "config");
-    throw e;
-  }
   evalStats({
     testCount: tests.length,
     runCount: tests.length * runs * Math.max(models.length, 1) * harnesses.length,
@@ -10480,7 +11063,7 @@ async function evalCommand(args, root) {
       t.prompt,
       ...t.checks.map((c) => c.run),
       ...Object.values(t.env),
-      ...t.harnessArgs.map((a) => a.arg),
+      ...harnessNames.flatMap((h) => (t.harnessArgs[h] ?? []).map((a) => a.arg)),
       ...t.install,
       ...t.cleanup
     ]).concat(config.build, config.install, config.cleanup).flatMap(varRefs).filter((k) => !(k in vars)))
@@ -10552,15 +11135,10 @@ async function evalCommand(args, root) {
   const runId = newRunId();
   let upload;
   try {
-    const pre = await uploadPreflight(opts, ui, basename3(repo?.mainCheckout ?? repo?.toplevel ?? root), runId, repo?.info ?? null);
+    const pre = await uploadPreflight(opts, ui, basename2(repo?.mainCheckout ?? repo?.toplevel ?? root), runId, repo?.info ?? null);
     if (pre && "exitCode" in pre)
       return fatal(pre.exitCode, pre.error, pre.code);
     upload = pre;
-    if (upload) {
-      for (const h of harnesses)
-        if (!h.uploads)
-          ui.note(notUploaded(h));
-    }
   } catch (e) {
     if (e instanceof ConfigError)
       return fatal(EXIT.usage, e.message, "config");
@@ -10645,10 +11223,7 @@ async function evalCommand(args, root) {
       command: undefined
     });
     ui.update();
-    if (upload && !harness.uploads) {
-      r.upload = { status: "skipped", reason: notUploaded(harness) };
-      writeRunJson(r);
-    } else if (upload) {
+    if (upload) {
       row.upload = "uploading";
       ui.update();
       r.upload = await uploadRun(upload, r);
@@ -10694,7 +11269,7 @@ async function evalCommand(args, root) {
     status,
     exitCode
   };
-  writeFileSync4(join10(runDir, "summary.json"), `${JSON.stringify(doc, null, 2)}
+  writeFileSync5(join10(runDir, "summary.json"), `${JSON.stringify(doc, null, 2)}
 `);
   appendFileSync(join10(runsRoot, "index.jsonl"), `${JSON.stringify({
     runId,
@@ -11011,8 +11586,8 @@ firegoat ${package_default.version}` : `firegoat ${package_default.version}`,
 
 // src/init.ts
 import { spawn as spawn4, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename4, join as join11 } from "node:path";
+import { existsSync as existsSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename3, join as join11 } from "node:path";
 
 // src/login.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -11023,7 +11598,7 @@ var FORM = { "Content-Type": "application/x-www-form-urlencoded" };
 var UPLOADS_ON = "Eval uploads each session to firegoat.ai as a private trace; --no-upload keeps runs local.";
 var UPLOAD_NOTICE = `${UPLOADS_ON} A session holds prompts, tool outputs and file contents: possibly secrets from your env or repo. The agent runs as you and can read ~/.firegoat (and a FIREGOAT_API_KEY in firegoat's own process env).`;
 var TERMS = "By logging in, you agree to the firegoat.ai Terms of Service (https://firegoat.ai/terms) and Privacy Policy (https://firegoat.ai/privacy).";
-function str3(o, k, step) {
+function str4(o, k, step) {
   const v = o?.[k];
   if (typeof v !== "string" || v === "")
     throw new ApiError(`${step}: response has no ${k}`);
@@ -11054,9 +11629,9 @@ async function loginFlow(show, interactive) {
   });
   if (cfg.status !== 200)
     throw replyError(cfgStep, cfg);
-  const clientId = str3(cfg.json, "client_id", cfgStep);
-  const deviceUrl = assertSafeUrl(str3(cfg.json, "device_authorization_endpoint", cfgStep), "device_authorization_endpoint");
-  const tokenUrl = assertSafeUrl(str3(cfg.json, "token_endpoint", cfgStep), "token_endpoint");
+  const clientId = str4(cfg.json, "client_id", cfgStep);
+  const deviceUrl = assertSafeUrl(str4(cfg.json, "device_authorization_endpoint", cfgStep), "device_authorization_endpoint");
+  const tokenUrl = assertSafeUrl(str4(cfg.json, "token_endpoint", cfgStep), "token_endpoint");
   if (tokenUrl.origin !== origin)
     throw new ApiError(`token_endpoint must be on ${origin}, got ${printable(tokenUrl.origin, 100)}`);
   const devStep = "Device authorization";
@@ -11065,16 +11640,19 @@ async function loginFlow(show, interactive) {
     url: deviceUrl,
     method: "POST",
     headers: FORM,
-    body: new URLSearchParams({ client_id: clientId }).toString(),
+    body: new URLSearchParams({
+      client_id: clientId,
+      scope: "openid profile email"
+    }).toString(),
     timeoutMs: TIMEOUT_MS3
   });
   if (dev.status !== 200)
     throw replyError(devStep, dev);
-  const deviceCode = str3(dev.json, "device_code", devStep);
-  const userCode = str3(dev.json, "user_code", devStep);
+  const deviceCode = str4(dev.json, "device_code", devStep);
+  const userCode = str4(dev.json, "user_code", devStep);
   if (!/^[A-Za-z0-9-]{1,64}$/.test(userCode))
     throw new ApiError(`${devStep}: user_code has unexpected characters`);
-  const pageRaw = typeof dev.json?.verification_uri_complete === "string" ? dev.json.verification_uri_complete : str3(dev.json, "verification_uri", devStep);
+  const pageRaw = typeof dev.json?.verification_uri_complete === "string" ? dev.json.verification_uri_complete : str4(dev.json, "verification_uri", devStep);
   const page = assertSafeUrl(pageRaw, "verification_uri");
   if (page.protocol !== "https:" || pageRaw.startsWith("-"))
     throw new ApiError("verification_uri must be https");
@@ -11376,6 +11954,11 @@ runs: 1
 #   MYTOOL_HOME: "$FIREGOAT_HOME/.mytool"
 #   UV_FIND_LINKS: "$FIREGOAT_OUT"
 
+# Optional: extra arguments for one harness, after firegoat's own flags, one per
+# entry: claude_args, codex_args, grok_args. A test can add its own. E.g. Claude in
+# Chrome, for tests that need a browser:
+# claude_args: [--chrome]
+
 # Optional: values for {{vars.KEY}} in prompts, checks and build/install/cleanup
 # steps (pasted in as-is, unquoted); eval --var KEY=value overrides them. Steps
 # and checks also get each one as an env var ("$KEY": safe for any value).
@@ -11532,8 +12115,7 @@ ${UPLOADS_ON}` : LOGIN_HINT);
 }
 async function initCommand(args, cwd) {
   let force = false;
-  let noSkills = false;
-  let localSkills = false;
+  const skillFlags = [];
   let login = true;
   for (const a of args) {
     if (a === "--help" || a === "-h") {
@@ -11543,9 +12125,11 @@ async function initCommand(args, cwd) {
     if (a === "--force" || a === "-f")
       force = true;
     else if (a === "--no-skills")
-      noSkills = true;
+      skillFlags.push({ flag: a, scope: "none" });
     else if (a === "--local-skills")
-      localSkills = true;
+      skillFlags.push({ flag: a, scope: "local" });
+    else if (a === "--global-skills")
+      skillFlags.push({ flag: a, scope: "global" });
     else if (a === "--no-login")
       login = false;
     else {
@@ -11555,15 +12139,17 @@ ${INIT_HELP}`);
       return EXIT.usage;
     }
   }
-  if (noSkills && localSkills) {
-    console.error(`firegoat init: --no-skills and --local-skills contradict each other: pass one
+  const flags = [...new Set(skillFlags.map((f) => f.flag))];
+  if (flags.length > 1) {
+    console.error(`firegoat init: ${flags.join(" and ")} contradict each other: pass one
 
 ${INIT_HELP}`);
     return EXIT.usage;
   }
-  let scope = noSkills ? "none" : localSkills ? "local" : "global";
-  initSkills(scope);
   const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const asked = skillFlags[0] === undefined && interactive;
+  let scope = skillFlags[0]?.scope ?? (interactive ? "global" : "local");
+  initSkills(scope);
   const color = interactive && !process.env.NO_COLOR;
   const paint = (code, text) => color ? `\x1B[${code}m${text}\x1B[0m` : text;
   const width = Math.min(process.stdout.columns || 80, 80);
@@ -11578,7 +12164,7 @@ ${INIT_HELP}`);
   const configPath = join11(cwd, CONFIG_FILE);
   const keep = existsSync6(configPath) && !force;
   if (!keep)
-    writeFileSync5(configPath, template(basename4(cwd)));
+    writeFileSync6(configPath, template(basename3(cwd)));
   if (ui) {
     console.log(ui.done(1, CONFIG_FILE, keep ? "Kept (--force replaces it)" : "Created"));
     ui.gap();
@@ -11588,7 +12174,7 @@ ${INIT_HELP}`);
   const skill = "firegoat-onboarding skill";
   const block = liveBlock();
   ui?.gap();
-  if (ui && !noSkills && !localSkills) {
+  if (ui && asked) {
     const picked = await ui.ask(block, 3, "Install the firegoat-onboarding skill", [
       ["Global", skillsDir("global")],
       ["This repo", `${skillsDir("local")} (commit it for your team)`],

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "firegoat",
-	"version": "0.27.0",
+	"version": "0.28.0",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/firegoat-ai/firegoat-cli.git"