skillgauntlet 1.3.4 → 1.3.5

package/bin/skillgauntlet.js

@@ -20,7 +20,7 @@ import { renderResult } from '../lib/chart.js';
 import { makeProgress } from '../lib/progress.js';
 import { setLang, detectLang, errorText, t } from '../lib/i18n.js';
 import { resolveBin, backend, backendFor, usesOwnDeepseek, setNativeModels, HOSTS, checkModel, draftQueries, draftQuality, runTrial, requireHost, pingHost, setHostBin, binInstalled } from '../lib/trial.js';
-import { HOST_CLI, searchHost, installCommand, installHost, LOGIN, loginCommand } from '../lib/findhost.js';
+import { HOST_CLI, searchHost, installCommand, installHost, userInstallDir, LOGIN, loginCommand } from '../lib/findhost.js';
 import { launchSpec } from '../lib/spawn.js';
 import { ensureTool } from '../lib/github.js';
 import { spawnSync as runLogin } from 'node:child_process';
@@ -71,6 +71,8 @@ async function fixMissingHost(hostId, err) {
     return true;
   }
   if (pick.install) {
+    const userDir = userInstallDir();
+    if (userDir) say(`\n${t('hostInstallUserDir', { dir: userDir })}`);
     say(`\n${t('hostInstalling', { host: label })}`);
     try { installHost(hostId); } catch (e) {
       say(t('hostInstallFailed', { why: e.message }));

package/lib/findhost.js

@@ -73,11 +73,34 @@ export function searchHost(host, dirs = searchDirs()) {
 // Codewhale's package has an install script, and npm only runs install scripts it has been told to allow. The
 // allowance is given for this one command (--allow-scripts) rather than written into the user's npm config.
 const INSTALL_FLAGS = { codewhale: ' --allow-scripts=codewhale' };
-export const installCommand = (host) => (HOST_CLI[host]?.pkg ? `npm install -g ${HOST_CLI[host].pkg}${INSTALL_FLAGS[host] || ''}` : null);
+// A system npm (Debian, Ubuntu, Fedora ...) keeps its global packages under /usr, which an ordinary user cannot write,
+// so `npm install -g` ends in EACCES. Where that is so the install goes to the user's own ~/.local (its bin folder is
+// already searched for host CLIs) and needs no sudo and no password. Asked once and remembered.
+let prefixWritable = null;
+export function npmPrefixWritable() {
+  if (prefixWritable !== null) return prefixWritable;
+  if (process.platform === 'win32') return (prefixWritable = true);
+  try {
+    const prefix = execSync('npm prefix -g', { encoding: 'utf8', timeout: 15000, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    const modules = path.join(prefix, 'lib', 'node_modules');
+    fs.accessSync(fs.existsSync(modules) ? modules : prefix, fs.constants.W_OK);
+    prefixWritable = true;
+  } catch { prefixWritable = false; }
+  return prefixWritable;
+}
+export const userPrefix = () => path.join(os.homedir(), '.local');
+// The folder the host will be installed into when the system one is not writable, else null.
+export const userInstallDir = ({ writable = npmPrefixWritable() } = {}) => (writable ? null : userPrefix());
+
+export function installCommand(host, { writable = npmPrefixWritable() } = {}) {
+  if (!HOST_CLI[host]?.pkg) return null;
+  const base = `npm install -g ${HOST_CLI[host].pkg}${INSTALL_FLAGS[host] || ''}`;
+  return writable ? base : `${base} --prefix "${userPrefix()}"`;
+}
 
 // Runs the npm install with its output on the user's terminal. Throws with a short reason on failure.
-export function installHost(host, run = (cmd) => execSync(cmd, { stdio: 'inherit' })) {
-  const cmd = installCommand(host);
+export function installHost(host, run = (cmd) => execSync(cmd, { stdio: 'inherit' }), opts = {}) {
+  const cmd = installCommand(host, opts);
   if (!cmd) throw new Error('no installer for this host');
   try { run(cmd); } catch (err) { throw new Error(String(err.message || err).split(/\r?\n/)[0]); }
 }

package/lib/i18n.js

@@ -167,6 +167,7 @@ const MESSAGES = {
     prNeedsReview: '没有自动合并，已转给维护者审核（常见原因：GitHub 账号注册不满 30 天，或今天已提交超过 5 条）。你不需要再做什么：{url}',
     prTimeout: '等了 {m} 分钟还没合并，PR 还在：{url}，之后随时在浏览器里看。',
     toolSudo: '这一步要用管理员权限安装：下面可能会让你输入这台电脑的登录密码（输入时不会显示字符，输完按回车）。',
+    hostInstallUserDir: '这台电脑的 npm 全局目录你没有写权限（装到系统目录要 sudo），所以会装到你自己的目录：{dir}，不需要 sudo 和密码。',
     modelUnknown: '{host} 的模型清单里没有“{model}”。它现在支持：{list}。请重新选一个，或选“默认模型”。',
     updateAvail: '有新版本 {latest}（你现在用的是 {current}）。',
     updateQ: '要更新吗？',
@@ -599,6 +600,7 @@ const MESSAGES = {
     prNeedsReview: 'It was not merged automatically and has gone to a maintainer for review (common reasons: the GitHub account is under 30 days old, or more than 5 submissions today). You need do nothing more: {url}',
     prTimeout: 'Waited {m} minutes and it is not merged yet. The pull request is still there: {url}; look any time in the browser.',
     toolSudo: 'This install needs administrator rights: you may be asked for this computer\'s password below (nothing is shown as you type; press enter when done).',
+    hostInstallUserDir: 'You cannot write to this computer\'s global npm folder (installing there needs sudo), so it is installed into your own folder instead: {dir}. No sudo or password is needed.',
     modelUnknown: '{host} does not list a model called "{model}". It currently supports: {list}. Pick another, or choose the default model.',
     updateAvail: 'A newer version {latest} is available (you are on {current}).',
     updateQ: 'Update?',
@@ -1079,6 +1081,7 @@ Layer 0 always runs first: it is free, and it disqualifies most problems before
     prNeedsReview: '自動マージされず、メンテナーのレビューに回りました（主な理由：GitHub アカウントが作成 30 日未満、または本日 5 件を超える提出）。これ以上の操作は不要です：{url}',
     prTimeout: '{m} 分待ちましたがまだマージされていません。プルリクエストは残っています：{url}。いつでもブラウザで確認できます。',
     toolSudo: 'このインストールには管理者権限が必要です。このコンピューターのパスワードの入力を求められることがあります（入力中は何も表示されません。入力後に Enter）。',
+    hostInstallUserDir: 'このコンピューターのグローバル npm フォルダには書き込めません（sudo が必要）。代わりにあなた自身のフォルダ {dir} にインストールします。sudo もパスワードも不要です。',
     modelUnknown: '{host} のモデル一覧に「{model}」はありません。現在対応：{list}。別のものを選ぶか、既定のモデルを選んでください。',
     updateAvail: '新しいバージョン {latest} があります（現在は {current}）。',
     updateQ: '更新しますか？',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillgauntlet",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "Check an agent skill before you install it: context cost, permission surface, code risk, instruction hijacking, description quality, trigger rate and gain.",
   "type": "module",
   "bin": {