skillgauntlet 1.3.4 → 1.3.6

package/bin/skillgauntlet.js

@@ -20,7 +20,7 @@ import { renderResult } from '../lib/chart.js';
 import { makeProgress } from '../lib/progress.js';
 import { setLang, detectLang, errorText, t } from '../lib/i18n.js';
 import { resolveBin, backend, backendFor, usesOwnDeepseek, setNativeModels, HOSTS, checkModel, draftQueries, draftQuality, runTrial, requireHost, pingHost, setHostBin, binInstalled } from '../lib/trial.js';
-import { HOST_CLI, searchHost, installCommand, installHost, LOGIN, loginCommand } from '../lib/findhost.js';
+import { HOST_CLI, searchHost, installCommand, installHost, userInstallDir, LOGIN, loginCommand } from '../lib/findhost.js';
 import { launchSpec } from '../lib/spawn.js';
 import { ensureTool } from '../lib/github.js';
 import { spawnSync as runLogin } from 'node:child_process';
@@ -71,6 +71,8 @@ async function fixMissingHost(hostId, err) {
     return true;
   }
   if (pick.install) {
+    const userDir = userInstallDir();
+    if (userDir) say(`\n${t('hostInstallUserDir', { dir: userDir })}`);
     say(`\n${t('hostInstalling', { host: label })}`);
     try { installHost(hostId); } catch (e) {
       say(t('hostInstallFailed', { why: e.message }));

package/lib/findhost.js

@@ -23,6 +23,10 @@ function npmGlobalDir() {
   } catch { return null; }
 }
 
+function isFileTarget(p) {
+  try { return fs.statSync(p).isFile(); } catch { return false; }
+}
+
 function listDir(dir) {
   try { return fs.readdirSync(dir, { withFileTypes: true }); } catch { return []; }
 }
@@ -31,7 +35,9 @@ function listDir(dir) {
 function inDir(dir, bin) {
   const out = [];
   for (const e of listDir(dir)) {
-    if (!e.isFile()) continue;
+    // npm links a global package's command into <prefix>/bin as a symlink, and a Dirent for a symlink is not a file:
+    // following it is what finds a host installed with `--prefix`. A link must lead to a file.
+    if (!e.isFile() && !(e.isSymbolicLink() && isFileTarget(path.join(dir, e.name)))) continue;
     const base = e.name.toLowerCase();
     const exact = base === bin || base.startsWith(`${bin}.`);
     // a Windows release asset keeps its platform suffix (codewhale-windows-x64.exe); only a real exe counts for those.
@@ -73,11 +79,34 @@ export function searchHost(host, dirs = searchDirs()) {
 // Codewhale's package has an install script, and npm only runs install scripts it has been told to allow. The
 // allowance is given for this one command (--allow-scripts) rather than written into the user's npm config.
 const INSTALL_FLAGS = { codewhale: ' --allow-scripts=codewhale' };
-export const installCommand = (host) => (HOST_CLI[host]?.pkg ? `npm install -g ${HOST_CLI[host].pkg}${INSTALL_FLAGS[host] || ''}` : null);
+// A system npm (Debian, Ubuntu, Fedora ...) keeps its global packages under /usr, which an ordinary user cannot write,
+// so `npm install -g` ends in EACCES. Where that is so the install goes to the user's own ~/.local (its bin folder is
+// already searched for host CLIs) and needs no sudo and no password. Asked once and remembered.
+let prefixWritable = null;
+export function npmPrefixWritable() {
+  if (prefixWritable !== null) return prefixWritable;
+  if (process.platform === 'win32') return (prefixWritable = true);
+  try {
+    const prefix = execSync('npm prefix -g', { encoding: 'utf8', timeout: 15000, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    const modules = path.join(prefix, 'lib', 'node_modules');
+    fs.accessSync(fs.existsSync(modules) ? modules : prefix, fs.constants.W_OK);
+    prefixWritable = true;
+  } catch { prefixWritable = false; }
+  return prefixWritable;
+}
+export const userPrefix = () => path.join(os.homedir(), '.local');
+// The folder the host will be installed into when the system one is not writable, else null.
+export const userInstallDir = ({ writable = npmPrefixWritable() } = {}) => (writable ? null : userPrefix());
+
+export function installCommand(host, { writable = npmPrefixWritable() } = {}) {
+  if (!HOST_CLI[host]?.pkg) return null;
+  const base = `npm install -g ${HOST_CLI[host].pkg}${INSTALL_FLAGS[host] || ''}`;
+  return writable ? base : `${base} --prefix "${userPrefix()}"`;
+}
 
 // Runs the npm install with its output on the user's terminal. Throws with a short reason on failure.
-export function installHost(host, run = (cmd) => execSync(cmd, { stdio: 'inherit' })) {
-  const cmd = installCommand(host);
+export function installHost(host, run = (cmd) => execSync(cmd, { stdio: 'inherit' }), opts = {}) {
+  const cmd = installCommand(host, opts);
   if (!cmd) throw new Error('no installer for this host');
   try { run(cmd); } catch (err) { throw new Error(String(err.message || err).split(/\r?\n/)[0]); }
 }

package/lib/i18n.js

@@ -167,6 +167,7 @@ const MESSAGES = {
     prNeedsReview: '没有自动合并，已转给维护者审核（常见原因：GitHub 账号注册不满 30 天，或今天已提交超过 5 条）。你不需要再做什么：{url}',
     prTimeout: '等了 {m} 分钟还没合并，PR 还在：{url}，之后随时在浏览器里看。',
     toolSudo: '这一步要用管理员权限安装：下面可能会让你输入这台电脑的登录密码（输入时不会显示字符，输完按回车）。',
+    hostInstallUserDir: '这台电脑的 npm 全局目录你没有写权限（装到系统目录要 sudo），所以会装到你自己的目录：{dir}，不需要 sudo 和密码。',
     modelUnknown: '{host} 的模型清单里没有“{model}”。它现在支持：{list}。请重新选一个，或选“默认模型”。',
     updateAvail: '有新版本 {latest}（你现在用的是 {current}）。',
     updateQ: '要更新吗？',
@@ -599,6 +600,7 @@ const MESSAGES = {
     prNeedsReview: 'It was not merged automatically and has gone to a maintainer for review (common reasons: the GitHub account is under 30 days old, or more than 5 submissions today). You need do nothing more: {url}',
     prTimeout: 'Waited {m} minutes and it is not merged yet. The pull request is still there: {url}; look any time in the browser.',
     toolSudo: 'This install needs administrator rights: you may be asked for this computer\'s password below (nothing is shown as you type; press enter when done).',
+    hostInstallUserDir: 'You cannot write to this computer\'s global npm folder (installing there needs sudo), so it is installed into your own folder instead: {dir}. No sudo or password is needed.',
     modelUnknown: '{host} does not list a model called "{model}". It currently supports: {list}. Pick another, or choose the default model.',
     updateAvail: 'A newer version {latest} is available (you are on {current}).',
     updateQ: 'Update?',
@@ -1079,6 +1081,7 @@ Layer 0 always runs first: it is free, and it disqualifies most problems before
     prNeedsReview: '自動マージされず、メンテナーのレビューに回りました（主な理由：GitHub アカウントが作成 30 日未満、または本日 5 件を超える提出）。これ以上の操作は不要です：{url}',
     prTimeout: '{m} 分待ちましたがまだマージされていません。プルリクエストは残っています：{url}。いつでもブラウザで確認できます。',
     toolSudo: 'このインストールには管理者権限が必要です。このコンピューターのパスワードの入力を求められることがあります（入力中は何も表示されません。入力後に Enter）。',
+    hostInstallUserDir: 'このコンピューターのグローバル npm フォルダには書き込めません（sudo が必要）。代わりにあなた自身のフォルダ {dir} にインストールします。sudo もパスワードも不要です。',
     modelUnknown: '{host} のモデル一覧に「{model}」はありません。現在対応：{list}。別のものを選ぶか、既定のモデルを選んでください。',
     updateAvail: '新しいバージョン {latest} があります（現在は {current}）。',
     updateQ: '更新しますか？',

package/lib/spawn.js

@@ -57,9 +57,13 @@ function findJsEntry(bin, name) {
   return candidates.find((p) => { try { return fs.statSync(p).isFile(); } catch { return false; } });
 }
 
-export function runnerFor(bin, name = path.basename(bin).replace(/\.(cmd|bat|exe)$/i, '')) {
+export function runnerFor(bin, name = path.basename(bin).replace(/\.(cmd|bat|exe)$/i, ''), platform = process.platform) {
   if (looksLikeJs(bin)) return { cmd: process.execPath, prefix: [bin], shell: false };
   if (/\.exe$/i.test(bin)) return { cmd: bin, prefix: [], shell: false };
+  // Outside Windows a command is run directly (its shebang picks the interpreter), never through a shell: the prompt
+  // holds text from the skill under test, and the cmd.exe-style quoting below means nothing to sh, where $( ) and
+  // backticks in that text would run.
+  if (platform !== 'win32' && !/\.(cmd|bat)$/i.test(bin)) return { cmd: bin, prefix: [], shell: false };
   const entry = findJsEntry(bin, name);
   if (entry) return { cmd: process.execPath, prefix: [entry], shell: false };
   return { cmd: bin, prefix: [], shell: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillgauntlet",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "description": "Check an agent skill before you install it: context cost, permission surface, code risk, instruction hijacking, description quality, trigger rate and gain.",
   "type": "module",
   "bin": {