skillgauntlet 1.3.5 → 1.3.6

package/lib/findhost.js

@@ -23,6 +23,10 @@ function npmGlobalDir() {
   } catch { return null; }
 }
 
+function isFileTarget(p) {
+  try { return fs.statSync(p).isFile(); } catch { return false; }
+}
+
 function listDir(dir) {
   try { return fs.readdirSync(dir, { withFileTypes: true }); } catch { return []; }
 }
@@ -31,7 +35,9 @@ function listDir(dir) {
 function inDir(dir, bin) {
   const out = [];
   for (const e of listDir(dir)) {
-    if (!e.isFile()) continue;
+    // npm links a global package's command into <prefix>/bin as a symlink, and a Dirent for a symlink is not a file:
+    // following it is what finds a host installed with `--prefix`. A link must lead to a file.
+    if (!e.isFile() && !(e.isSymbolicLink() && isFileTarget(path.join(dir, e.name)))) continue;
     const base = e.name.toLowerCase();
     const exact = base === bin || base.startsWith(`${bin}.`);
     // a Windows release asset keeps its platform suffix (codewhale-windows-x64.exe); only a real exe counts for those.

package/lib/spawn.js

@@ -57,9 +57,13 @@ function findJsEntry(bin, name) {
   return candidates.find((p) => { try { return fs.statSync(p).isFile(); } catch { return false; } });
 }
 
-export function runnerFor(bin, name = path.basename(bin).replace(/\.(cmd|bat|exe)$/i, '')) {
+export function runnerFor(bin, name = path.basename(bin).replace(/\.(cmd|bat|exe)$/i, ''), platform = process.platform) {
   if (looksLikeJs(bin)) return { cmd: process.execPath, prefix: [bin], shell: false };
   if (/\.exe$/i.test(bin)) return { cmd: bin, prefix: [], shell: false };
+  // Outside Windows a command is run directly (its shebang picks the interpreter), never through a shell: the prompt
+  // holds text from the skill under test, and the cmd.exe-style quoting below means nothing to sh, where $( ) and
+  // backticks in that text would run.
+  if (platform !== 'win32' && !/\.(cmd|bat)$/i.test(bin)) return { cmd: bin, prefix: [], shell: false };
   const entry = findJsEntry(bin, name);
   if (entry) return { cmd: process.execPath, prefix: [entry], shell: false };
   return { cmd: bin, prefix: [], shell: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillgauntlet",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "Check an agent skill before you install it: context cost, permission surface, code risk, instruction hijacking, description quality, trigger rate and gain.",
   "type": "module",
   "bin": {