firegoat 0.9.2 → 0.9.4

package/README.md

@@ -47,7 +47,7 @@ tests:
       - run: grep -q '"command":"acme deploy' "$FIREGOAT_SESSION"
 ```
 
-Whatever `setup` writes to `$FIREGOAT_OUT` is first on the agent's `PATH`.
+Whatever `setup` writes to `$FIREGOAT_OUT` is first on the agent's `PATH`. That only helps for binaries called by bare name: if users run your CLI via `npx`/`uvx`, pack and install it like the npm example, or `npx` fetches the registry release.
 
 ### Can an agent find the right package from my docs alone?
 

package/dist/cli.js

@@ -6947,7 +6947,7 @@ var require_public_api = __commonJS(function(exports) {
 // package.json
 var package_default = {
   name: "firegoat",
-  version: "0.9.2",
+  version: "0.9.4",
   repository: {
     type: "git",
     url: "git+https://github.com/firegoat-ai/firegoat-cli.git"
@@ -7250,12 +7250,15 @@ async function runClaude(opts) {
       return;
     }
   });
-  const init = events[0];
-  if (init?.type !== "system" || init.subtype !== "init")
+  const init = events.find((e) => e?.type === "system" && e.subtype === "init");
+  if (!init) {
+    const said = stdout.trim().split(`
+`)[0]?.slice(0, 300);
     return {
       ok: false,
-      reason: `claude did not start a session (exit ${exited.code ?? "by signal"}), see stderr.txt`
+      reason: `claude did not start a session (exit ${exited.code ?? "by signal"})${said ? `: ${said}` : ", see stderr.txt"}`
     };
+  }
   const sessionId = String(init.session_id);
   const result = events.findLast((e) => e?.type === "result");
   if (exited.timedOut)
@@ -7274,7 +7277,7 @@ async function runClaude(opts) {
   if (result.is_error === true || result.subtype !== "success")
     return {
       ok: false,
-      reason: `claude result is an error (subtype=${result.subtype})`,
+      reason: `claude result is an error (subtype=${result.subtype})${result.result ? `: ${result.result.slice(0, 300)}` : ""}`,
       result,
       sessionId
     };
@@ -7557,6 +7560,15 @@ function findSession(configDir, sessionId) {
   }
   return null;
 }
+function usage(r) {
+  const parts = [];
+  if (r.cost !== null)
+    parts.push(`$${r.cost.toFixed(2)}`);
+  if (r.num_turns !== null)
+    parts.push(`${r.num_turns} turns`);
+  parts.push(`${Math.round(r.duration_ms / 1000)}s`);
+  return parts.join(", ");
+}
 function newRunId() {
   const ts = new Date().toISOString().replace(/\.\d+Z$/, "Z").replace(/[-:]/g, "");
   return `${ts}-${randomBytes(2).toString("hex")}`;
@@ -7690,6 +7702,7 @@ async function evalCommand(args, root) {
   const firegoatDir = ensureFiregoatDir(root);
   const configDir = join3(firegoatDir, ".claude");
   mkdirSync2(configDir, { recursive: true });
+  say(process.env.ANTHROPIC_API_KEY ? "auth: ANTHROPIC_API_KEY (claude bills the API key; unset it to use your claude login)" : "auth: your claude login");
   const loginProblem = checkLogin({
     bin: claudePath,
     env: claudeEnv(configDir),
@@ -7733,7 +7746,7 @@ async function evalCommand(args, root) {
         vars
       });
       results.push(r);
-      say(`${r.status.toUpperCase()} ${r.test}#${r.n} ${r.reason}`);
+      say(`${r.status.toUpperCase()} ${r.test}#${r.n} ${r.reason} (${usage(r)})`);
     }
   const totals = { pass: 0, fail: 0, error: 0 };
   for (const r of results)
@@ -7741,8 +7754,9 @@ async function evalCommand(args, root) {
   const doc = { runId, runsDir: runDir, totals, runs: results };
   writeFileSync2(join3(runDir, "summary.json"), `${JSON.stringify(doc, null, 2)}
 `);
+  const cost = results.reduce((sum, r) => sum + (r.cost ?? 0), 0);
   say(`
-${totals.pass} passed, ${totals.fail} failed, ${totals.error} not graded (${results.length} runs)`);
+${totals.pass} passed, ${totals.fail} failed, ${totals.error} not graded (${results.length} runs, $${cost.toFixed(2)})`);
   say(`runs: ${runDir} (end_goal is for you to judge: see run.json per run)`);
   if (opts.json)
     console.log(JSON.stringify(doc, null, 2));
@@ -7787,8 +7801,10 @@ runs: 1
 # setup: uv build --wheel --out-dir "$FIREGOAT_OUT"
 # workdir_setup: uv venv && uv pip install "$FIREGOAT_OUT"/*.whl
 #
-# a CLI binary:
+# a CLI binary users call by bare name (on PATH as is):
 # setup: go build -o "$FIREGOAT_OUT/mycli" ./cmd/mycli
+# (an npm/pypi CLI that users run via npx/uvx: pack + install it as above instead;
+# a binary on PATH does not stop "npx mycli" from fetching the registry release)
 #
 # Helper files (scripts, sample data) go in .firegoat/fixtures/ (committed), not inline here.
 # setup runs in this folder, so: setup: cp -R .firegoat/fixtures/. "$FIREGOAT_OUT"
@@ -7871,18 +7887,28 @@ ${INIT_HELP}`);
     const r = spawnSync2("npx", ["-y", ...SKILLS_ARGV], {
       cwd,
       env,
-      stdio: "inherit"
+      stdio: interactive ? "inherit" : "pipe",
+      encoding: "utf8"
     });
     if (r.error || r.status !== 0) {
+      if (!interactive)
+        process.stderr.write(`${r.stdout ?? ""}${r.stderr ?? ""}`);
       console.error(`firegoat init: installing the skills failed (${r.error?.message ?? `exit ${r.status}`}). Run it yourself: npx ${SKILLS_ARGV.join(" ")}`);
       return EXIT.notGraded;
     }
+    console.log("installed skills firegoat-onboarding, suggesting-eval-prompts in .claude/skills/");
+    const ignored = spawnSync2("git", ["check-ignore", "-q", ".claude/skills"], {
+      cwd
+    });
+    if (ignored.status === 0)
+      console.error("warning: git ignores .claude/skills, so teammates and CI won't get the skills. Commit them with: git add -f .claude/skills");
   }
-  console.log(`
+  console.log(interactive ? `
 Paste this into your coding agent:
 
 ${AGENT_PROMPT}
-`);
+` : `
+Prompt for your coding agent: ${AGENT_PROMPT}`);
   if (interactive && copyToClipboard(AGENT_PROMPT))
     console.log("\x1B[32mPrompt copied!\x1B[0m");
   return EXIT.pass;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "firegoat",
-	"version": "0.9.2",
+	"version": "0.9.4",
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/firegoat-ai/firegoat-cli.git"