firegoat 0.6.0 → 0.8.0

package/README.md

@@ -2,7 +2,7 @@
 
 Local-first AX evals: how well coding agents use your SDK, CLI, API and docs.
 
-Status: early (v0.6). See `plan.md`.
+Status: early (v0.8). See `plan.md`.
 
 ## Use
 
@@ -37,6 +37,8 @@ Then say so in the prompt: "The package is already installed from the build unde
 - Checks also get `$FIREGOAT_OUT` (the run's copy).
 - A failed `setup:` or `workdir_setup:` means not graded (exit 2); logs are `.firegoat/runs/<runId>/setup.txt` and `<test>/<n>/workdir_setup.txt`.
 
+Want the agent to run a plain `npm i acme-sdk` (or `pip install`) and still get your build, with no hint in the prompt? See the recipe in [`examples/local-npm-registry`](examples/local-npm-registry/README.md): a throwaway local registry started from `setup:`.
+
 ### How the agent signs in
 
 `firegoat init` asks (or pass `--auth`):
@@ -59,14 +61,20 @@ A probe checks the sandbox before every run; if it does not hold, the run is not
 
 Off macOS there is no sandbox yet: run inside a throwaway container and pass `--host`.
 
-`eval` saves each run's transcript to `.firegoat/runs/<runId>/<test>/<n>/session.jsonl` and a `summary.json`, then runs the test's `checks` in the agent's folder. Nothing is uploaded. `firegoat.yaml` is looked up in the current directory, then parents up to the git root.
+`eval` saves each run's transcript to `.firegoat/runs/<runId>/<test>/<n>/session.jsonl`, runs the test's `checks` in the agent's folder, and writes `run.json` per run plus `summary.json` (prompt, end_goal, check results, paths). Nothing is uploaded.
+
+### Grading: your agent judges the end goal
+
+firegoat runs only the script checks; they set the exit code. Each test's `end_goal` is handed over, not graded: whoever drives firegoat (usually your coding agent) judges it with its own process from `npx firegoat eval --json` / `run.json`, the transcript and the workdir. firegoat records no verdict beyond the checks.
+
+Every command has `--help` written for an agent; start with `npx firegoat --help`. `firegoat.yaml` is looked up in the current directory, then parents up to the git root.
 
 Exit codes:
 
 | code | meaning |
 |---|---|
-| 0 | every run passed |
-| 1 | a goal or check failed |
+| 0 | every run's script checks passed |
+| 1 | a script check failed |
 | 2 | at least one run was not graded (claude missing, auth, crash, timeout); wins over 1 |
 | 3 | usage or config error (bad flag, unknown test, invalid or missing `firegoat.yaml`) |
 

package/dist/cli.js

@@ -6947,7 +6947,7 @@ var require_public_api = __commonJS(function(exports) {
 // package.json
 var package_default = {
   name: "firegoat",
-  version: "0.6.0",
+  version: "0.8.0",
   repository: {
     type: "git",
     url: "git+https://github.com/team2027/firegoat-cli.git"
@@ -7208,11 +7208,157 @@ function resolveAuth(env) {
 // src/exit.ts
 var EXIT = { pass: 0, fail: 1, notGraded: 2, usage: 3 };
 
+// src/help.ts
+var EXIT_CODES = `Exit codes:
+  0  every run's script checks passed
+  1  a script check failed
+  2  at least one run was not graded (claude missing or logged out, crash, timeout,
+     setup failed); wins over 1
+  3  usage or config error (bad flag, unknown test, invalid or missing firegoat.yaml)`;
+function topHelp(version) {
+  return `firegoat ${version}: local AX evals. A coding agent gets one prompt in a fresh,
+sandboxed folder; firegoat records the transcript and runs your script checks.
+
+Typical flow (for an agent driving firegoat on behalf of a human):
+  1. npx firegoat init --yes          write firegoat.yaml (read: npx firegoat init --help)
+  2. edit firegoat.yaml               real user problems as prompts, an end_goal, checks
+  3. ask the human to run once:       npx firegoat claude login   (opens a browser)
+  4. npx firegoat eval --json         run the tests; JSON summary on stdout
+  5. judge each run's end_goal yourself, from its run.json, transcript and
+     workdir: firegoat only runs the script checks
+
+Commands:
+  init           write firegoat.yaml; choose how the agent signs in
+  claude login   sign claude in to firegoat's own config dir (interactive, once)
+  eval           run the tests
+  open           open (or --print) a run's folder
+
+Run firegoat <command> --help for details and examples.
+
+${EXIT_CODES}`;
+}
+var INIT_HELP = `Usage: firegoat init [--yes] [--force] [--skills] [--auth claude|api-key]
+
+Writes firegoat.yaml in the current folder with starter tests from what the repo
+ships (package.json, pyproject.toml, go.mod, Cargo.toml, README), and adds
+.firegoat/ to .gitignore. Edit the tests afterwards; they are templates.
+
+  --yes, -y       don't ask questions (default when stdin is not a terminal)
+  --force, -f     overwrite an existing firegoat.yaml
+  --skills        also run: npx skills add team2027/skills --skill firegoat-onboarding
+                  --skill suggesting-eval-prompts (into .claude/skills/)
+  --auth claude   the agent signs in with a Claude login: runs \`firegoat claude login\`
+                  (interactive: a human must complete it in the browser)
+  --auth api-key  the agent signs in with an Anthropic API key, read from stdin when
+                  piped (else asked for without echo) and stored in
+                  ~/.firegoat/anthropic-api-key (mode 0600), never in the repo
+                  Without --auth, init asks (unless --yes). In CI, ANTHROPIC_API_KEY in
+                  the env wins.
+
+firegoat.yaml reference:
+  agents: [claude-code]       only claude-code for now
+  runs: 1                     runs per test
+  setup: <sh> | [<sh>, ...]   once per eval, in the repo, on the host; whatever it
+                              writes to $FIREGOAT_OUT is copied into each run and put
+                              first on the agent's PATH
+  workdir_setup: <sh> | [...] in each fresh workdir before the agent starts
+                              (env: $FIREGOAT_OUT, $FIREGOAT_WORKDIR, vars)
+  vars: {KEY: value}          defaults for {{vars.KEY}}; --var KEY=value overrides
+  tests:
+    - name: quickstart        letters, digits, '.', '_', '-'; unique
+      prompt: ...             what a user would ask the agent; one concrete outcome
+      end_goal: ...           what is true when the problem is solved; not graded by
+                              firegoat, handed to you (goal: is a deprecated alias)
+      checks:                 optional shell commands, run in the workdir after the
+        - run: ...            agent; exit 0 = pass; they set eval's exit code
+      timeout: 600            optional, seconds
+
+  The agent's folder has no repo files. Checks get $FIREGOAT_WORKDIR,
+  $FIREGOAT_SESSION (stream-json transcript), $FIREGOAT_OUT and the vars.
+  end_goal is not graded by firegoat: it is handed to the caller to judge.
+
+Example:
+  setup: npm pack --pack-destination "$FIREGOAT_OUT"
+  workdir_setup: npm init -y >/dev/null && npm install "$FIREGOAT_OUT"/*.tgz
+  tests:
+    - name: first-call
+      prompt: >-
+        Using the acme SDK (already installed from the build under test), send a test
+        event and print the event id. Credentials are in ACME_API_KEY. Keep it minimal.
+      end_goal: >-
+        A script sends one event with the SDK's client (not raw HTTP) and prints its
+        id, without installing acme from the registry.
+      checks:
+        - run: grep -qE 'evt_[A-Za-z0-9]+' "$FIREGOAT_SESSION"
+        - run: |
+            ! grep -Eq 'npm (install|i) [^"]*acme' "$FIREGOAT_SESSION"
+
+Next: npx firegoat claude login (a human, once), then npx firegoat eval.
+
+Exit codes: 0 done, 2 the skills install or claude login failed, 3 usage error.`;
+var EVAL_HELP = `Usage: firegoat eval [test..] [--runs N] [--var KEY=value].. [--json] [--host]
+                     [--claude-bin PATH]
+
+Runs each test headless: claude gets the prompt in a fresh folder outside the repo,
+sandboxed on macOS (it can't read your home dir or the repo), with setup:'s outputs
+on PATH. Then the test's script checks run in that folder.
+
+  test..             only these tests (by name)
+  --runs N           runs per test (overrides runs: in firegoat.yaml)
+  --var KEY=value    fills {{vars.KEY}}; env for setup, workdir_setup and checks
+  --json             the summary as JSON on stdout; progress goes to stderr
+  --host             no sandbox (required off macOS; use a throwaway container)
+  --claude-bin PATH  claude binary (env FIREGOAT_CLAUDE_BIN; default: claude on PATH)
+
+Sign-in: the one chosen in firegoat init (Claude login or stored API key); in CI,
+ANTHROPIC_API_KEY from the env. eval prints which. Not logged in = exit 2 with the
+command to run.
+
+Output: .firegoat/runs/<runId>/
+  summary.json            every run, plus totals and a grading hint
+  <test>/<n>/run.json     one run: test, n, status and reason (from the checks),
+                          prompt, end_goal, checks [{run, code}], and paths:
+                          dir, workdir, session, stderr, checksLog
+  <test>/<n>/session.jsonl  the agent's transcript, stream-json (one event per line)
+  setup.txt, <test>/<n>/workdir_setup.txt, checks.txt   logs
+
+Grading: firegoat runs only the script checks; they set the exit code. end_goal is
+yours to judge, with your own process. session.jsonl is stream-json: the
+last line has type "result" with the agent's final message; tool calls are
+"tool_use" items in "assistant" messages; tool output is in "user" messages.
+
+Examples:
+  npx firegoat eval --json                  all tests, JSON summary on stdout
+  npx firegoat eval quickstart --runs 3     one test, three runs
+  npx firegoat eval --var SHA=$(git rev-parse HEAD)
+
+firegoat.yaml is looked up in the current folder, then parents up to the git root.
+A run can take minutes (default timeout 600s per test).
+
+${EXIT_CODES}`;
+var OPEN_HELP = `Usage: firegoat open [runId] [--print]
+
+Opens a run's folder (.firegoat/runs/<runId>/) with the system opener; the latest
+run by default. --print only prints the path (use this from an agent).
+
+Exit codes: 0 done, 2 the opener failed, 3 no such run.`;
+var CLAUDE_LOGIN_HELP = `Usage: firegoat claude login [--claude-bin PATH]
+
+Signs claude in to firegoat's own config dir (~/.firegoat/claude), once per machine.
+Evals then run on that login, never your ~/.claude. Interactive: it opens a browser,
+so an agent should ask the human to run it. \`firegoat login\` is a deprecated alias.
+
+Exit codes: 0 logged in, 2 claude missing or the login failed, 3 usage error.`;
+
 // src/claude-login.ts
 function claudeLoginCommand(args) {
   let claudeBin = process.env.FIREGOAT_CLAUDE_BIN || "claude";
   for (let i = 0;i < args.length; i++) {
     const a = args[i];
+    if (a === "--help" || a === "-h") {
+      console.log(CLAUDE_LOGIN_HELP);
+      return EXIT.pass;
+    }
     if (a === "--claude-bin" && args[i + 1] !== undefined)
       claudeBin = args[++i];
     else if (a.startsWith("--claude-bin="))
@@ -7363,16 +7509,21 @@ function parseConfig(text, warn = console.error) {
       const cp = `${p}.checks[${j}]`;
       if (!isRecord(c))
         fail(cp, "must be a mapping");
-      if ("judge" in c) {
-        warn(`${CONFIG_FILE}: ${cp}: judge checks need upload, which v1 does not do; skipped`);
-        return;
-      }
+      if ("judge" in c)
+        fail(`${cp}.judge`, "plain-language checks were removed; put the criteria in end_goal (your agent judges it) or write a run: check");
       checks.push({ run: str(c.run, `${cp}.run`) });
     });
+    if (t.rubric !== undefined)
+      fail(`${p}.rubric`, "was removed in firegoat 0.8.0; put the criteria in end_goal");
+    if (t.goal !== undefined && t.end_goal !== undefined)
+      fail(`${p}.goal`, "use end_goal only (goal is its deprecated name)");
+    if (t.goal !== undefined)
+      warn(`${CONFIG_FILE}: ${p}.goal is deprecated; rename it to end_goal`);
+    const endGoalKey = t.goal !== undefined ? "goal" : "end_goal";
     return {
       name,
       prompt: str(t.prompt, `${p}.prompt`),
-      goal: str(t.goal, `${p}.goal`),
+      end_goal: str(t[endGoalKey], `${p}.${endGoalKey}`),
       checks,
       timeout: posInt(t.timeout, `${p}.timeout`, DEFAULT_TIMEOUT)
     };
@@ -7790,6 +7941,30 @@ function resolveBin(bin) {
 
 // src/eval.ts
 var CHECK_TIMEOUT_MS = 120000;
+var GRADING_HINT = "firegoat ran only the script checks. Each run's end_goal is for the caller to judge, from its session (stream-json transcript) and workdir.";
+function blankRun(test, n, dir, prompt) {
+  return {
+    test: test.name,
+    n,
+    status: "error",
+    reason: "",
+    prompt,
+    end_goal: test.end_goal,
+    checks: [],
+    dir,
+    workdir: null,
+    session: join6(dir, "session.jsonl"),
+    stderr: join6(dir, "stderr.txt"),
+    checksLog: join6(dir, "checks.txt"),
+    num_turns: null,
+    cost: null,
+    duration_ms: 0
+  };
+}
+function writeRunJson(r) {
+  writeFileSync2(join6(r.dir, "run.json"), `${JSON.stringify(r, null, 2)}
+`);
+}
 
 class UsageError extends Error {
 }
@@ -7874,23 +8049,13 @@ async function runOne(opts) {
   const started = Date.now();
   const dir = join6(opts.runDir, test.name, String(n));
   mkdirSync5(dir, { recursive: true });
-  const session = join6(dir, "session.jsonl");
-  const summary = {
-    test: test.name,
-    n,
-    status: "error",
-    reason: "",
-    workdir: null,
-    session,
-    checks: [],
-    num_turns: null,
-    cost: null,
-    duration_ms: 0
-  };
+  const summary = blankRun(test, n, dir, render(test.prompt, opts.vars));
+  const session = summary.session;
   const done = (status, reason) => {
     summary.status = status;
     summary.reason = reason;
     summary.duration_ms = Date.now() - started;
+    writeRunJson(summary);
     return summary;
   };
   const { runRoot, workdir } = newRunRoot(`${test.name}-${n}`);
@@ -7923,10 +8088,10 @@ async function runOne(opts) {
     keySource: opts.auth.method === "api-key" ? "ANTHROPIC_API_KEY" : "none",
     profile: sandbox.profile,
     bin: opts.claudeBin,
-    prompt: render(test.prompt, opts.vars),
+    prompt: summary.prompt,
     cwd: workdir,
     sessionPath: session,
-    stderrPath: join6(dir, "stderr.txt"),
+    stderrPath: summary.stderr,
     timeoutMs: test.timeout * 1000
   });
   if (outcome.result) {
@@ -7935,11 +8100,9 @@ async function runOne(opts) {
   }
   if (!outcome.ok)
     return done("error", `not graded: ${outcome.reason}`);
-  if (test.checks.length === 0) {
-    opts.warn(`warning: ${test.name} has no checks, so its goal is unverified; counted as pass`);
-    return done("pass", "no checks (goal unverified)");
-  }
-  const log = createWriteStream3(join6(dir, "checks.txt"));
+  if (test.checks.length === 0)
+    return done("pass", "no script checks; end_goal is for the caller to judge");
+  const log = createWriteStream3(summary.checksLog);
   const env = {
     ...process.env,
     ...hostEnv,
@@ -7961,7 +8124,7 @@ async function runOne(opts) {
   } finally {
     await new Promise((r) => log.end(r));
   }
-  summary.checks = results.map((r) => ({ run: r.run, code: r.code }));
+  summary.checks = results.map((r) => r.error === undefined ? { run: r.run, code: r.code } : { run: r.run, code: r.code, error: r.error });
   const broken = results.find((r) => r.notStarted);
   if (broken)
     return done("error", `not graded: check ${broken.run}: ${broken.error}`);
@@ -7971,6 +8134,10 @@ async function runOne(opts) {
   return done("pass", `${results.length}/${results.length} checks passed`);
 }
 async function evalCommand(args, cwd) {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(EVAL_HELP);
+    return EXIT.pass;
+  }
   let opts;
   try {
     opts = parseArgs(args);
@@ -8079,6 +8246,7 @@ async function evalCommand(args, cwd) {
       runsDir: runDir,
       isolation: opts.host ? "host" : "seatbelt",
       auth: auth.method,
+      grading: GRADING_HINT,
       totals,
       runs: results
     };
@@ -8103,18 +8271,11 @@ async function evalCommand(args, cwd) {
           warn
         });
       } catch (e) {
-        r = {
-          test: test.name,
-          n,
-          status: "error",
-          reason: `not graded: firegoat crashed: ${e.message}`,
-          workdir: null,
-          session: join6(runDir, test.name, String(n), "session.jsonl"),
-          checks: [],
-          num_turns: null,
-          cost: null,
-          duration_ms: 0
-        };
+        const dir = join6(runDir, test.name, String(n));
+        mkdirSync5(dir, { recursive: true });
+        r = blankRun(test, n, dir, test.prompt);
+        r.reason = `not graded: firegoat crashed: ${e.message}`;
+        writeRunJson(r);
       }
       results.push(r);
       writeSummary();
@@ -8126,6 +8287,7 @@ async function evalCommand(args, cwd) {
   say(`
 ${pass} passed, ${fail} failed, ${error} not graded (${results.length} runs)`);
   say(`runs: ${runDir}`);
+  say(`end_goal is not graded by firegoat; per run: ${join6(runDir, "<test>", "<n>", "run.json")}`);
   if (opts.json)
     console.log(JSON.stringify(doc, null, 2));
   return error > 0 ? EXIT.notGraded : fail > 0 ? EXIT.fail : EXIT.pass;
@@ -8137,17 +8299,6 @@ import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync
 import { basename as basename2, join as join7 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 import { Writable } from "node:stream";
-var INIT_USAGE = `Usage: firegoat init [--yes] [--force] [--skills] [--auth claude|api-key]
-
-  --yes, -y     don't ask questions (default when stdin is not a terminal)
-  --force, -f   overwrite an existing ${CONFIG_FILE}
-  --skills      install the firegoat-onboarding and suggesting-eval-prompts skills
-                into .claude/skills/ (npx skills add team2027/skills)
-  --auth claude   how the agent signs in: run \`firegoat claude login\` (your Claude plan)
-  --auth api-key  store an Anthropic API key for firegoat only (~/.firegoat, mode 0600),
-                  read from stdin when piped, else asked for without echo
-                Without --auth, init asks (unless --yes). In CI, ANTHROPIC_API_KEY in env wins.
-`;
 var SKILLS = ["firegoat-onboarding", "suggesting-eval-prompts"];
 var SKILLS_ARGV = [
   "skills",
@@ -8266,7 +8417,7 @@ function templates(p) {
     out.push({
       name: "cli-first-run",
       prompt: `I just heard about the \`${p.bin}\` command-line tool from ${p.name} and want to see it actually do something useful. Use it for one basic real task and save what it prints to cli-output.txt. Keep it minimal. Use only ${docs} as a guide.`,
-      goal: `cli-output.txt exists and holds real output from running \`${p.bin}\`, not an install log or an error.`,
+      end_goal: `cli-output.txt exists and holds real output from running \`${p.bin}\`, not an install log or an error.`,
       checks: [
         "test -s cli-output.txt",
         "! grep -qiE 'command not found|not recognized|ENOENT' cli-output.txt"
@@ -8277,7 +8428,7 @@ function templates(p) {
     out.push({
       name: "quickstart",
       prompt: `I want to use ${p.name} in a new ${LANG[p.ecosystem]} project. Get the smallest working example going: a program that uses ${p.name} to do one real thing, then run it and save what it prints to output.txt. Keep it minimal. Use only ${docs} as a guide.`,
-      goal: `A program in the workdir uses ${p.name}, runs without errors, and its output is saved in output.txt.`,
+      end_goal: `A program in the workdir uses ${p.name}, runs without errors, and its output is saved in output.txt.`,
       checks: [
         "test -s output.txt",
         `grep -rqsF ${GREP_EXCLUDES} -- ${sq(importName(p))} .`
@@ -8288,7 +8439,7 @@ function templates(p) {
     out.push({
       name: "quickstart",
       prompt: `I want to try ${p.name}. Follow its quickstart in a new project, get the smallest example working, then run it and save what it prints to output.txt. Keep it minimal. Use only ${docs} as a guide.`,
-      goal: `The ${p.name} quickstart example runs without errors and its output is saved in output.txt.`,
+      end_goal: `The ${p.name} quickstart example runs without errors and its output is saved in output.txt.`,
       checks: ["test -s output.txt"]
     });
   }
@@ -8337,7 +8488,7 @@ function renderYaml(p, tests) {
     "tests:"
   ];
   for (const t of tests) {
-    lines.push(`  - name: ${t.name}  # letters, digits, '.', '_' and '-'`, "    # What a user would ask the agent. Edit this.", "    prompt: >-", block(t.prompt, "      "), "    # One sentence that is true when the user's problem is solved.", "    goal: >-", block(t.goal, "      "), "    # Shell commands run in the agent's workdir afterwards; exit 0 = pass.", "    checks:", ...t.checks.map((c) => `      - run: ${JSON.stringify(c)}`), "    # Seconds before the agent run is stopped.", "    timeout: 600");
+    lines.push(`  - name: ${t.name}  # letters, digits, '.', '_' and '-'`, "    # What a user would ask the agent. Edit this.", "    prompt: >-", block(t.prompt, "      "), "    # One sentence that is true when the user's problem is solved. Not graded by", "    # firegoat: it goes to your agent (eval --json, run.json) to judge.", "    end_goal: >-", block(t.end_goal, "      "), "    # Shell commands run in the agent's workdir afterwards; exit 0 = pass.", "    checks:", ...t.checks.map((c) => `      - run: ${JSON.stringify(c)}`), "    # Seconds before the agent run is stopped.", "    timeout: 600");
   }
   return `${lines.join(`
 `)}
@@ -8484,12 +8635,12 @@ async function initCommand(args, cwd) {
         break;
       case "--help":
       case "-h":
-        console.log(INIT_USAGE);
+        console.log(INIT_HELP);
         return 0;
       default:
         console.error(`firegoat init: unknown argument: ${a}
 
-${INIT_USAGE}`);
+${INIT_HELP}`);
         return EXIT.usage;
     }
   }
@@ -8545,6 +8696,10 @@ function openCommand(args, cwd) {
   let print = false;
   const ids = [];
   for (const a of args) {
+    if (a === "--help" || a === "-h") {
+      console.log(OPEN_HELP);
+      return EXIT.pass;
+    }
     if (a === "--print")
       print = true;
     else if (a.startsWith("-")) {
@@ -8582,33 +8737,6 @@ function openCommand(args, cwd) {
 }
 
 // src/cli.ts
-var USAGE = `firegoat ${package_default.version}: local-first AX evals
-
-Usage:
-  firegoat init [--yes] [--force] [--skills] [--auth claude|api-key]
-                                               write firegoat.yaml, choose how the agent signs in
-  firegoat claude login [--claude-bin PATH]   sign claude in to firegoat's own config dir (once)
-  firegoat eval [test..] [--runs N] [--var KEY=value].. [--json] [--host] [--claude-bin PATH]
-                                               run evals with claude in a sandboxed fresh workdir
-  firegoat open [runId] [--print]              open a run's folder (default: the latest)
-  firegoat --version
-
-eval options:
-  test..             only run these tests (by name)
-  --runs N           runs per test (overrides runs: in firegoat.yaml)
-  --var KEY=value    fills {{vars.KEY}} in prompts and checks; env for setup, workdir_setup and checks
-  --json             JSON summary on stdout, progress on stderr
-  --host             no sandbox (needed off macOS; use a throwaway container)
-  --claude-bin PATH  claude binary to run (env: FIREGOAT_CLAUDE_BIN; default: claude on PATH)
-
-firegoat.yaml is looked up in the current dir, then parents up to the git root.
-
-Exit codes:
-  0  every run passed
-  1  a goal or check failed
-  2  at least one run was not graded (claude missing, auth, crash, timeout); wins over 1
-  3  usage or config error (bad flag, unknown test, invalid or missing firegoat.yaml)
-`;
 async function main(argv) {
   const [cmd, ...rest] = argv;
   switch (cmd) {
@@ -8619,14 +8747,20 @@ async function main(argv) {
     case undefined:
     case "--help":
     case "-h":
-      console.log(USAGE);
+      console.log(topHelp(package_default.version));
       return 0;
     case "init":
       return initCommand(rest, process.cwd());
     case "claude":
       if (rest[0] === "login")
         return claudeLoginCommand(rest.slice(1));
-      console.error(`usage: firegoat claude login [--claude-bin PATH]`);
+      if (rest[0] === "--help" || rest[0] === "-h") {
+        console.log(CLAUDE_LOGIN_HELP);
+        return 0;
+      }
+      console.error(`firegoat claude: unknown subcommand
+
+${CLAUDE_LOGIN_HELP}`);
       return EXIT.usage;
     case "login":
       console.error("firegoat login is deprecated for the Claude sign-in: use `firegoat claude login`");
@@ -8638,7 +8772,7 @@ async function main(argv) {
     default:
       console.error(`unknown command: ${cmd}
 
-${USAGE}`);
+${topHelp(package_default.version)}`);
       return EXIT.usage;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "firegoat",
-	"version": "0.6.0",
+	"version": "0.8.0",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/team2027/firegoat-cli.git"