skillgauntlet 1.1.0 → 1.1.1

package/bin/skillgauntlet.js

@@ -14,7 +14,7 @@ import { openRun, querySetHash } from '../lib/runs.js';
 import { DEPTHS, estimate } from '../lib/depth.js';
 import { ask, choose, select, confirm, say, closeUi } from '../lib/ui.js';
 import { setLang, detectLang, errorText, t } from '../lib/i18n.js';
-import { resolveBin, backend, backendFor, isDeepseekModel, HOSTS, checkModel, draftQueries, draftQuality, runTrial } from '../lib/trial.js';
+import { resolveBin, backend, backendFor, isDeepseekModel, HOSTS, checkModel, draftQueries, draftQuality, runTrial, requireHost } from '../lib/trial.js';
 import { runGain } from '../lib/gain.js';
 import { ERROR_STREAK_STOP, executeTrials, finishRun, resumeRun } from '../lib/execute.js';
 
@@ -40,6 +40,7 @@ function writeOut(skillDir, name, md, sc) {
 }
 
 async function runTriggerLayer({ skillDir, skillName, depth, model, host = 'claude-code' }) {
+  requireHost(host);
   const bin = resolveBin(HOSTS[host].bin);
   const cacheFile = cacheFileFor(skillDir, depth);
   const want = { perClause: depth.perClause, negatives: depth.negatives, skillFingerprint: fingerprint(skillDir) };
@@ -171,6 +172,7 @@ async function cmdResume(args) {
   const full = path.resolve(dir);
   const runMeta = JSON.parse(fs.readFileSync(path.join(full, 'meta.json'), 'utf8'));
   const runHost = runMeta.host || 'claude-code';
+  requireHost(runHost);
   const result = await resumeRun({
     dir: full,
     bin: resolveBin((HOSTS[runHost] || HOSTS['claude-code']).bin),
@@ -387,7 +389,7 @@ async function interactive() {
           skillDir: target.dir, skillName: target.name, depth, model, host: { claude: 'claude-code', codebuddy: 'codebuddy', codewhale: 'codewhale' }[host],
         });
       } catch (err) {
-        say(`  ${t('trialFail', { err: err.message })}`);
+        say(`  ${t('trialFail', { err: errorText(err) })}`);
       }
       if (host === 'claude' && depth.layers.includes('gain')) {
         say(`  ${t('gainNote')}`);

package/lib/gain.js

@@ -21,6 +21,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { launchSpec } from './spawn.js';
+import { narrowEnv } from './trial.js';
 
 const HERE = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const CONTRACT_DIR = path.join(HERE, 'contracts');
@@ -36,8 +38,8 @@ function copyDir(src, dst) {
   }
 }
 
-export function loadContracts(skillName) {
-  const file = path.join(CONTRACT_DIR, `${skillName}.json`);
+export function loadContracts(skillName, dir = CONTRACT_DIR) {
+  const file = path.join(dir, `${skillName}.json`);
   if (!fs.existsSync(file)) return null;
   return JSON.parse(fs.readFileSync(file, 'utf8'));
 }
@@ -111,8 +113,10 @@ function runTask({ bin, model, task, skillDir, skillName, timeout }) {
   if (model) args.push('--model', model);
 
   return new Promise((resolve) => {
-    const child = spawn(bin, args, {
-      cwd: tmp, shell: /\.(cmd|bat)$/i.test(bin), env: process.env, windowsHide: true,
+    // Not through a shell: cmd.exe would re-split the prompt on spaces (see spawn.js).
+    const launch = launchSpec(bin, args, 'claude');
+    const child = spawn(launch.cmd, launch.args, {
+      cwd: tmp, shell: launch.shell, env: narrowEnv(), windowsHide: true, stdio: 'ignore',
     });
     const timer = setTimeout(() => {
       try {
@@ -128,8 +132,8 @@ function runTask({ bin, model, task, skillDir, skillName, timeout }) {
   });
 }
 
-export async function runGain({ bin, skillDir, skillName, model, timeout = 600, onProgress }) {
-  const spec = loadContracts(skillName);
+export async function runGain({ bin, skillDir, skillName, model, timeout = 600, onProgress, contractDir }) {
+  const spec = loadContracts(skillName, contractDir);
   const hasContracts = spec?.contracts?.length || spec?.tasks?.some((t) => t.contracts?.length);
   if (!spec || !hasContracts || !spec.tasks?.length) {
     return { measurable: false, reasonKey: 'gain.noContracts' };

package/lib/i18n.js

@@ -124,6 +124,10 @@ const MESSAGES = {
 
 层 0 总是最先跑：它免费，能在你花钱之前筛掉大部分问题。`,
     modelRemap: '后端 {host} 会静默改写 Anthropic 模型名，"{model}" 测的不是你指定的模型；请传该后端自己的模型名',
+    hostMissing: '没有找到宿主 {host}（PATH 里没有 {bin}）。{how}；也可以重新运行并选择其他宿主（Claude Code、CodeBuddy、Codewhale、Codex）。',
+    installCodebuddy: '安装方法：npm install -g @tencent-ai/codebuddy-code',
+    installCodewhale: '安装方法：从官方发布页下载单文件 exe，改名为 codewhale.exe 并放进 PATH',
+    installClaude: '安装方法：npm install -g @anthropic-ai/claude-code',
 
     // ---- report: shared ----
     'report.path': '路径：',
@@ -364,6 +368,10 @@ Layers
 
 Layer 0 always runs first: it is free, and it disqualifies most problems before you pay.`,
     modelRemap: 'backend {host} remaps Anthropic model names, so "{model}" would test a different model; pass that backend\'s own model id',
+    hostMissing: 'Host {host} was not found ({bin} is not on PATH). {how}, or run again and pick another host (Claude Code, CodeBuddy, Codewhale, Codex).',
+    installCodebuddy: 'To install: npm install -g @tencent-ai/codebuddy-code',
+    installCodewhale: 'To install: download the single exe from the official release page, rename it codewhale.exe and put it on PATH',
+    installClaude: 'To install: npm install -g @anthropic-ai/claude-code',
 
     'report.path': 'Path: ',
     'report.skillMd': 'SKILL.md: {chars} chars ≈ {tokens} tokens; description {desc} chars',
@@ -580,6 +588,10 @@ Layer 0 always runs first: it is free, and it disqualifies most problems before
     inputEnded: '入力が終了しました',
     err: 'エラー：{msg}',
     modelRemap: 'バックエンド {host} は Anthropic のモデル名を黙って書き換えるため、「{model}」では指定したモデルをテストできません。そのバックエンド自身のモデル名を指定してください',
+    hostMissing: 'ホスト {host} が見つかりません（PATH に {bin} がありません）。{how}。または、もう一度実行して別のホスト（Claude Code、CodeBuddy、Codewhale、Codex）を選んでください。',
+    installCodebuddy: 'インストール方法：npm install -g @tencent-ai/codebuddy-code',
+    installCodewhale: 'インストール方法：公式リリースページから単体 exe をダウンロードし、codewhale.exe に改名して PATH に置いてください',
+    installClaude: 'インストール方法：npm install -g @anthropic-ai/claude-code',
     badSource: 'このアドレスを解釈できません：{spec}（ローカルディレクトリか owner/repo を指定してください）',
     noSkillUnder: '{target} の下に SKILL.md が見つかりません',
     resumeUsage: '使い方：skillgauntlet resume <実行ディレクトリ> [--model M] [--runs N] [--max-explore N]',
@@ -741,7 +753,8 @@ export function t(key, vars = {}) {
 
 // An error either carries a message key (translated) or is plain text from the runtime.
 export function errorText(err) {
-  return err.messageKey ? t(err.messageKey, err.vars) : err.message;
+  if (!err.messageKey) return err.message;
+  return t(err.messageKey, err.howKey ? { ...err.vars, how: t(err.howKey) } : err.vars);
 }
 
 // Comma-separated word list from the table, e.g. the accepted yes answers.

package/lib/trial.js

@@ -80,6 +80,29 @@ export function resolveBin(name) {
     || name;
 }
 
+// Whether a host CLI can be found on PATH at all. resolveBin falls back to the bare name, which on Windows
+// ends in cmd.exe's "not recognized" (or a spawn ENOENT) deep inside a trial; this asks up front.
+export function binInstalled(name) {
+  try {
+    execFileSync(process.platform === 'win32' ? 'where' : 'which', [name], { stdio: 'ignore' });
+    return true;
+  } catch { return false; }
+}
+
+const HOST_NAME = { 'claude-code': 'Claude Code', codebuddy: 'CodeBuddy', codewhale: 'Codewhale' };
+const INSTALL_HINT = { 'claude-code': 'installClaude', codebuddy: 'installCodebuddy', codewhale: 'installCodewhale' };
+
+// Throws an error with a translatable message when the host's CLI is not installed.
+export function requireHost(host, probe = binInstalled) {
+  const spec = HOSTS[host];
+  if (!spec || probe(spec.bin)) return;
+  const err = new Error(`host ${host} not found: ${spec.bin} is not on PATH`);
+  err.messageKey = 'hostMissing';
+  err.vars = { host: HOST_NAME[host] || host, bin: spec.bin };
+  err.howKey = INSTALL_HINT[host];
+  throw err;
+}
+
 // Variables a host (the Claude desktop app, the Agent SDK, an outer Claude Code session) sets for its own
 // child processes. A trial inherits them otherwise, and they change what the model under test sees: under
 // the desktop app the CLI adds Artifact, ArtifactComments and ArtifactData to the tool list, and the model
@@ -100,6 +123,25 @@ export function trialEnv(env = process.env) {
   return out;
 }
 
+// An allow-list environment for runs where the model executes code (the gain layer): the host CLI gets what
+// it needs to start and authenticate and nothing else, so an unrelated token in the user's shell is not
+// reachable from a task. Names match case-insensitively (Windows spells it Path).
+const ENV_ALLOW = new Set(['PATH', 'HOME', 'USERPROFILE', 'HOMEDRIVE', 'HOMEPATH', 'APPDATA', 'LOCALAPPDATA',
+  'PROGRAMDATA', 'PROGRAMFILES', 'PROGRAMFILES(X86)', 'SYSTEMROOT', 'SYSTEMDRIVE', 'WINDIR', 'COMSPEC', 'PATHEXT',
+  'TEMP', 'TMP', 'TMPDIR', 'USER', 'USERNAME', 'LOGNAME', 'SHELL', 'LANG', 'LC_ALL', 'TERM', 'TZ', 'OS',
+  'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME', 'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'ALL_PROXY',
+  'SSL_CERT_FILE', 'NODE_EXTRA_CA_CERTS', 'CLOUD_ML_REGION', 'DEEPSEEK_API_KEY']);
+const ENV_ALLOW_PREFIX = ['ANTHROPIC_', 'AWS_', 'GOOGLE_', 'CODEBUDDY_'];
+
+export function narrowEnv(env = process.env) {
+  const out = {};
+  for (const [k, v] of Object.entries(trialEnv(env))) {
+    const u = k.toUpperCase();
+    if (ENV_ALLOW.has(u) || ENV_ALLOW_PREFIX.some((p) => u.startsWith(p)) || HOST_ENV_KEEP.has(k)) out[k] = v;
+  }
+  return out;
+}
+
 function backendHost() {
   const url = process.env.ANTHROPIC_BASE_URL;
   if (!url) return 'anthropic';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillgauntlet",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Check an agent skill before you install it: context cost, permission surface, code risk, instruction hijacking, description quality, trigger rate and gain.",
   "type": "module",
   "bin": {