skillgauntlet 1.3.6 → 1.3.8

package/lib/github.js

@@ -110,16 +110,28 @@ export async function ensureTool(tool, { exec = quiet, run = live, pick, out, pl
 export const signedIn = (exec = quiet) => { try { exec('gh', ['auth', 'status']); return true; } catch { return false; } };
 
 // The GitHub sign-in: the CLI's own browser flow (it shows a one-time code and opens the browser after enter).
+// The arguments of the browser sign-in for the installed gh. `-p https` (the git protocol) exists only in newer versions;
+// the gh in an older Ubuntu's own repositories rejects it ("unknown shorthand flag: 'p'"), so it is added only when this
+// gh lists it, and otherwise gh asks that one question itself.
+export function loginArgs(exec = quiet) {
+  let help = '';
+  try { help = String(exec('gh', ['auth', 'login', '--help'])); } catch (err) { help = `${err.stdout || ''}${err.stderr || ''}`; }
+  const args = ['auth', 'login', '-h', 'github.com', '-w'];
+  return /--git-protocol/.test(help) ? [...args, '-p', 'https'] : args;
+}
+
 export async function ensureSignedIn({ exec = quiet, run = live, pick, out } = {}) {
   while (!signedIn(exec)) {
     out(`\n${t('ghLoginNeeded')}`);
+    const args = loginArgs(exec);
     const choice = await pick(t('ghLoginQ'), [
-      { label: t('ghLoginNow'), hint: t('toolRuns', { cmd: 'gh auth login -h github.com -p https -w' }), value: 'now' },
+      { label: t('ghLoginNow'), hint: t('toolRuns', { cmd: `gh ${args.join(' ')}` }), value: 'now' },
       { label: t('ghLoginSkip'), value: 'skip' },
     ], 1);
     if (choice !== 'now') return false;
     out(`\n${t('ghLoginHint')}\n`);
-    run('gh', ['auth', 'login', '-h', 'github.com', '-p', 'https', '-w']);
+    const r = run('gh', args);
+    if (r?.error || (r && r.status != null && r.status !== 0)) out(`\n${t('ghLoginFailed')}`);
   }
   return true;
 }

package/lib/i18n.js

@@ -168,6 +168,7 @@ const MESSAGES = {
     prTimeout: '等了 {m} 分钟还没合并，PR 还在：{url}，之后随时在浏览器里看。',
     toolSudo: '这一步要用管理员权限安装：下面可能会让你输入这台电脑的登录密码（输入时不会显示字符，输完按回车）。',
     hostInstallUserDir: '这台电脑的 npm 全局目录你没有写权限（装到系统目录要 sudo），所以会装到你自己的目录：{dir}，不需要 sudo 和密码。',
+    ghLoginFailed: '登录没有完成（上面是 gh 自己的提示）。可以再试一次，或先选“先不登录”，之后自己运行 gh auth login。',
     modelUnknown: '{host} 的模型清单里没有“{model}”。它现在支持：{list}。请重新选一个，或选“默认模型”。',
     updateAvail: '有新版本 {latest}（你现在用的是 {current}）。',
     updateQ: '要更新吗？',
@@ -601,6 +602,7 @@ const MESSAGES = {
     prTimeout: 'Waited {m} minutes and it is not merged yet. The pull request is still there: {url}; look any time in the browser.',
     toolSudo: 'This install needs administrator rights: you may be asked for this computer\'s password below (nothing is shown as you type; press enter when done).',
     hostInstallUserDir: 'You cannot write to this computer\'s global npm folder (installing there needs sudo), so it is installed into your own folder instead: {dir}. No sudo or password is needed.',
+    ghLoginFailed: 'The sign-in did not finish (gh\'s own message is above). Try again, or choose "Not now" and run gh auth login yourself later.',
     modelUnknown: '{host} does not list a model called "{model}". It currently supports: {list}. Pick another, or choose the default model.',
     updateAvail: 'A newer version {latest} is available (you are on {current}).',
     updateQ: 'Update?',
@@ -1082,6 +1084,7 @@ Layer 0 always runs first: it is free, and it disqualifies most problems before
     prTimeout: '{m} 分待ちましたがまだマージされていません。プルリクエストは残っています：{url}。いつでもブラウザで確認できます。',
     toolSudo: 'このインストールには管理者権限が必要です。このコンピューターのパスワードの入力を求められることがあります（入力中は何も表示されません。入力後に Enter）。',
     hostInstallUserDir: 'このコンピューターのグローバル npm フォルダには書き込めません（sudo が必要）。代わりにあなた自身のフォルダ {dir} にインストールします。sudo もパスワードも不要です。',
+    ghLoginFailed: 'サインインが完了しませんでした（上は gh 自身のメッセージです）。もう一度試すか、「今はしない」を選んで後で gh auth login を実行してください。',
     modelUnknown: '{host} のモデル一覧に「{model}」はありません。現在対応：{list}。別のものを選ぶか、既定のモデルを選んでください。',
     updateAvail: '新しいバージョン {latest} があります（現在は {current}）。',
     updateQ: '更新しますか？',

package/lib/submit.js

@@ -92,15 +92,36 @@ function prBody(pkg) {
   ].join('\n');
 }
 
+// A fork that was just created is not always cloneable at once; try a few times, a few seconds apart.
+function cloneWithRetry(exec, url, dir, { tries = 5, waitMs = 3000 } = {}) {
+  let last;
+  for (let i = 0; i < tries; i += 1) {
+    try {
+      exec('git', ['clone', '--depth', '1', '-c', 'credential.helper=', '-c', 'credential.https://github.com.helper=!gh auth git-credential', url, dir]);
+      return;
+    } catch (err) {
+      last = err;
+      fs.rmSync(dir, { recursive: true, force: true });
+      if (i < tries - 1) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, waitMs);
+    }
+  }
+  throw last;
+}
+
 // Fork, branch, commit, push, open. Every GitHub call goes through `exec` so tests can fake them.
-export function openPullRequest({ pkgDir, pkg, gh, exec = defaultExec, say: out = say }) {
+export function openPullRequest({ pkgDir, pkg, gh, exec = defaultExec, say: out = say, cloneWait = 3000 }) {
   const work = fs.mkdtempSync(path.join(os.tmpdir(), 'sg-pr-'));
   try {
     out(t('submitForking', { upstream: UPSTREAM }));
     exec('gh', ['repo', 'fork', UPSTREAM, '--clone=false']);
     out(t('submitPreparing'));
     const repoDir = path.join(work, 'repo');
-    exec('git', ['clone', '--depth', '1', `https://github.com/${UPSTREAM}.git`, repoDir]);
+    const forkUrl = `https://github.com/${gh.user}/${UPSTREAM.split('/')[1]}.git`;
+    // The branch is made from the contributor's own fork, not from upstream's main. A fork made before upstream gained
+    // workflow files lacks them, and pushing a branch built on upstream's main would then "create" those workflows in
+    // the fork, which GitHub refuses for a token without the `workflow` scope (the default gh sign-in has none). A branch
+    // made on the fork adds only the submission, and the pull request's diff against upstream is still just that.
+    cloneWithRetry(exec, forkUrl, repoDir, { waitMs: cloneWait });
     const g = (...a) => exec('git', ['-C', repoDir, ...a]);
     const branch = `submit/${slug(pkg.files.meta.skill)}-${pkg.files.meta.submission.host.id}-${pkg.path[2].split('-')[0].toLowerCase()}`;
     g('checkout', '-b', branch);
@@ -115,8 +136,7 @@ export function openPullRequest({ pkgDir, pkg, gh, exec = defaultExec, say: out
     const ident = ['-c', `user.name=${gh.user}`, '-c', `user.email=${gh.id}+${gh.user}@users.noreply.github.com`];
     g(...ident, 'commit', '-q', '-F', msg);
     out(t('submitPushing'));
-    g('remote', 'add', 'fork', `https://github.com/${gh.user}/${UPSTREAM.split('/')[1]}.git`);
-    g('-c', 'credential.helper=', '-c', 'credential.https://github.com.helper=!gh auth git-credential', 'push', '-q', 'fork', branch);
+    g('-c', 'credential.helper=', '-c', 'credential.https://github.com.helper=!gh auth git-credential', 'push', '-q', 'origin', branch);
     out(t('submitOpening'));
     const body = path.join(work, 'body.md');
     fs.writeFileSync(body, prBody(pkg));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillgauntlet",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "description": "Check an agent skill before you install it: context cost, permission surface, code risk, instruction hijacking, description quality, trigger rate and gain.",
   "type": "module",
   "bin": {