nasde-toolkit 0.3.2__tar.gz → 0.3.3__tar.gz

{nasde_toolkit-0.3.2 → nasde_toolkit-0.3.3}/.claude/skills/nasde-benchmark-creator/SKILL.md

@@ -14,6 +14,52 @@ description: |
 
 Create and configure coding agent benchmarks for evaluation with `nasde`. A benchmark is a set of coding tasks that AI agents solve inside isolated Docker containers, scored both by functional tests (pass/fail) and by an LLM-as-a-Judge architecture assessment.
 
+## Critical: line endings on Windows (read this first)
+
+Benchmark scripts execute inside **Linux** sandboxes (Docker, Daytona). If `tests/test.sh`, `solution/solve.sh`, or `environment/Dockerfile` are checked out with **CRLF** line endings (the Windows git default when `core.autocrlf=true` and there is no `.gitattributes`), every trial fails immediately with:
+
+```
+bash: line 1: /tests/test.sh: cannot execute: required file not found
+```
+
+…because the kernel reads the shebang as `#!/bin/bash\r` and tries to execute a non-existent `/bin/bash\r`. The agent finishes its work, but the verifier never runs and Harbor reports `RewardFileNotFoundError`.
+
+**Mitigation (always do this for a new benchmark — `nasde init` does it for you, but verify):**
+
+1. The benchmark repo MUST have a `.gitattributes` file enforcing LF for shell scripts and Dockerfiles. The minimum content:
+   ```gitattributes
+   * text=auto eol=lf
+   *.sh        text eol=lf
+   *.bash      text eol=lf
+   Dockerfile  text eol=lf
+   *.dockerfile text eol=lf
+   docker-compose.yaml text eol=lf
+   docker-compose.yml  text eol=lf
+
+   *.ps1       text eol=crlf
+   *.bat       text eol=crlf
+   *.cmd       text eol=crlf
+   ```
+   `nasde init` writes this automatically. If you are adding a benchmark to an existing repo without `.gitattributes`, create one before adding any task.
+
+2. When **writing** `.sh` or `Dockerfile` content programmatically on Windows, write with explicit LF — not `path.write_text(content)` (which translates `\n`→`\r\n` on Windows), but `path.write_text(content, encoding="utf-8", newline="")` or open the file in binary mode.
+
+3. After committing on Windows for the first time, run:
+   ```bash
+   git add --renormalize .
+   git commit -m "normalize line endings"
+   ```
+   to fix any files that landed before `.gitattributes` was in place.
+
+4. Sanity check before pushing a new task:
+   ```bash
+   file tasks/<task>/tests/test.sh
+   # MUST say "with LF line terminators" or omit line-terminator info entirely.
+   # If it says "with CRLF line terminators" — fix it (`sed -i 's/\r$//' file`).
+   ```
+
+This applies equally when you're **adding tasks to a benchmark someone else created** — if their repo has no `.gitattributes` and you're on Windows, your contribution will silently break for them on Linux CI and vice versa.
+
 ## Step 1: Understand what to evaluate
 
 Before creating files, clarify with the user:
@@ -116,6 +162,8 @@ What the agent must NOT do (e.g., don't modify existing tests).
 
 ### environment/Dockerfile (required)
 
+> **Reminder for Windows authors:** the Dockerfile and any helper scripts it `COPY`s in must have LF line endings — Docker tolerates CRLF in some commands but not in `RUN` shell snippets, and any shell script copied with CRLF will hit the same shebang failure as `test.sh`.
+
 ```dockerfile
 FROM <base-image>
 
@@ -137,6 +185,8 @@ The Dockerfile MUST be self-contained — the agent starts working immediately.
 
 ### tests/test.sh (required — Harbor verifier)
 
+> **Reminder for Windows authors:** this file MUST be saved with LF line endings. See "Critical: line endings on Windows" at the top of this skill. CRLF here = `bash: required file not found` and a wasted trial.
+
 ```bash
 #!/bin/bash
 cd /app
@@ -319,3 +369,11 @@ Before running with a real agent:
    ```bash
    nasde run --variant vanilla --tasks <task-name> --without-eval -C .
    ```
+
+4. **Final pre-flight on Windows authors** — verify no CRLF leaked in:
+   ```bash
+   find tasks -name '*.sh' -exec sh -c 'file "$1" | grep -q CRLF && echo "BAD: $1"' _ {} \;
+   find tasks -name 'Dockerfile' -exec sh -c 'file "$1" | grep -q CRLF && echo "BAD: $1"' _ {} \;
+   # Both should print nothing.
+   ```
+   If anything prints, fix with `sed -i 's/\r$//' <file>` and re-commit.

{nasde_toolkit-0.3.2 → nasde_toolkit-0.3.3}/.claude/skills/nasde-benchmark-from-history/SKILL.md

@@ -19,6 +19,15 @@ Generate NASDE benchmark tasks by mining git history. You analyze commits, diffs
 - An existing NASDE benchmark project (run `nasde init` first, or use the `nasde-benchmark-creator` skill)
 - If the benchmark project doesn't exist yet, create it first — this skill generates tasks, not the project scaffold
 
+## Critical: line endings on Windows (read this first)
+
+When generating `tests/test.sh`, `solution/solve.sh`, or `environment/Dockerfile` on a Windows host, write them with **LF** line endings or every trial fails with `bash: required file not found` (the kernel reads `#!/bin/bash\r` as the shebang). See the full explanation and `.gitattributes` template in the `nasde-benchmark-creator` skill.
+
+Quick rules:
+- The benchmark project MUST have a `.gitattributes` enforcing `*.sh text eol=lf` and `Dockerfile text eol=lf`. `nasde init` creates this. If the existing project lacks it, **create `.gitattributes` before generating any task files**.
+- When writing files programmatically, use `path.write_text(content, encoding="utf-8", newline="")` — never the bare default which translates `\n`→`\r\n` on Windows.
+- Sanity-check after generation: `find tasks/<new-task> -name '*.sh' -o -name 'Dockerfile' | xargs file | grep CRLF` should print nothing.
+
 ## Step 1: Identify the source repository and commit range
 
 Ask the user:

{nasde_toolkit-0.3.2 → nasde_toolkit-0.3.3}/.claude/skills/nasde-benchmark-from-public-repos/SKILL.md

@@ -19,6 +19,15 @@ Build a diverse NASDE benchmark by curating tasks from multiple public GitHub re
 - A clear description of the skill being evaluated (what it does, what kinds of tasks it helps with)
 - Internet access (to browse and clone public repositories)
 
+## Critical: line endings on Windows (read this first)
+
+When generating `tests/test.sh`, `solution/solve.sh`, or `environment/Dockerfile` on a Windows host, write them with **LF** line endings or every trial fails with `bash: required file not found` (the kernel reads `#!/bin/bash\r` as the shebang). See the full explanation and `.gitattributes` template in the `nasde-benchmark-creator` skill.
+
+Quick rules:
+- The benchmark project MUST have a `.gitattributes` enforcing `*.sh text eol=lf` and `Dockerfile text eol=lf`. `nasde init` creates this. If the existing project lacks it, **create `.gitattributes` before generating any task files**.
+- When writing files programmatically, use `path.write_text(content, encoding="utf-8", newline="")` — never the bare default which translates `\n`→`\r\n` on Windows.
+- Sanity-check after generation: `find tasks/<new-task> -name '*.sh' -o -name 'Dockerfile' | xargs file | grep CRLF` should print nothing.
+
 ## Step 1: Understand the skill under test
 
 Ask the user:

{nasde_toolkit-0.3.2 → nasde_toolkit-0.3.3}/.claude/skills/nasde-benchmark-runner/SKILL.md

@@ -17,69 +17,95 @@ Run coding agent benchmarks with `nasde` and verify results. The two-stage pipel
 
 ## Authentication setup
 
-Before running any benchmark, set up authentication tokens. Both are needed for cross-agent benchmarks.
+Before running any benchmark, set up authentication tokens for the agents you plan to run. Both OS and auth method matter — pick the right command per row.
 
-### Claude Code (OAuth token from subscription)
+### Step 1 — Ask the user which auth they prefer
 
-```bash
-source scripts/export_oauth_token.sh
-```
+**Always ask the user before running, never assume.** Two questions:
 
-This extracts `CLAUDE_CODE_OAUTH_TOKEN` from macOS Keychain (written by `claude` CLI login). Required for both Claude agent runs AND assessment evaluation (which spawns the `claude` CLI as a subprocess when `[evaluation] backend = "claude"`).
+1. **Which agents will you run?** (Claude / Codex / Gemini, any combination)
+2. **For each agent, OAuth (subscription) or API key (per-token billing)?** Default recommendation: OAuth where available — no per-token cost, no env vars to manage.
 
-Alternatively, set `ANTHROPIC_API_KEY` for API billing.
+Then detect their OS and pick the matching script row from the table below. On Windows, also ask whether they're in **PowerShell** or **WSL** (cmd.exe is not directly supported — see "Windows: cmd.exe" below).
 
-### Codex (ChatGPT subscription or API key)
+### Where the auth scripts live
 
-**Option 1: ChatGPT subscription (OAuth)** — uses ChatGPT Plus/Pro/Business plan credits, no per-token API cost:
+The OAuth scripts ship inside this skill. After `nasde install-skills` they are at:
 
-```bash
-codex login                                # one-time: authenticate via ChatGPT
-source scripts/export_codex_oauth_token.sh # validate tokens are present
-```
+- **User scope** (default): `~/.claude/skills/nasde-benchmark-runner/scripts/` (macOS/Linux/WSL) or `%USERPROFILE%\.claude\skills\nasde-benchmark-runner\scripts\` (Windows PowerShell)
+- **Project scope**: `<project>/.claude/skills/nasde-benchmark-runner/scripts/` (if installed with `nasde install-skills --scope project`)
+- **Editable nasde checkout** (devs only): `<repo>/scripts/` — same files, mirrored from the skill bundle
 
-NASDE auto-detects `~/.codex/auth.json` with `auth_mode: "chatgpt"` and injects OAuth tokens into the sandbox. No env vars needed.
+Below, `<SKILL_SCRIPTS>` is shorthand for whichever absolute path applies. Resolve it once, then substitute it in every command. Verify the path with `ls <SKILL_SCRIPTS>` before telling the user to source anything — if the directory is missing, they need to run `nasde install-skills` first.
 
-**Option 2: API key** — billed per-token through OpenAI Platform:
+### Step 2 — Run the right script per agent × OS
 
-```bash
-export $(grep CODEX_API_KEY .env)
-```
+Priority order: **Claude → Codex → Gemini.** Claude is required even for non-Claude variants when `[evaluation] backend = "claude"` (default), because the assessment evaluator spawns `claude` CLI as a subprocess.
 
-Or set directly: `export CODEX_API_KEY=sk-proj-...`
+#### Claude Code
 
-API key always takes priority over OAuth when both are present.
+| OS / shell | OAuth (subscription) | API key |
+|---|---|---|
+| macOS | `source <SKILL_SCRIPTS>/export_oauth_token.sh` (reads Keychain entry "Claude Code-credentials") | `export ANTHROPIC_API_KEY=sk-ant-...` |
+| Linux | `source <SKILL_SCRIPTS>/export_oauth_token.sh` (reads `~/.claude/.credentials.json`) | `export ANTHROPIC_API_KEY=sk-ant-...` |
+| Windows PowerShell | `. <SKILL_SCRIPTS>\export_oauth_token.ps1` (reads `%USERPROFILE%\.claude\.credentials.json`) | `$env:ANTHROPIC_API_KEY = 'sk-ant-...'` |
+| Windows WSL (Ubuntu) | `source <SKILL_SCRIPTS>/export_oauth_token.sh` (Linux path; resolve `<SKILL_SCRIPTS>` from your WSL home, not the Windows host's) | `export ANTHROPIC_API_KEY=sk-ant-...` |
 
-### Gemini CLI (Google account or API key)
+Prerequisite for OAuth: `claude` CLI installed and `claude` ran once to log in.
 
-**Option 1: Google account OAuth** — uses Google account credits, no per-token API cost:
+The script exports `CLAUDE_CODE_OAUTH_TOKEN`. This is required for both Claude variant runs AND assessment evaluation (when `[evaluation] backend = "claude"` — the default).
 
-```bash
-gemini login                                # one-time: authenticate via Google account
-source scripts/export_gemini_oauth_token.sh # validate tokens are present
-```
+#### Codex
 
-NASDE auto-detects `~/.gemini/oauth_creds.json` and injects OAuth credentials into the sandbox. No env vars needed.
+| OS / shell | OAuth (ChatGPT subscription) | API key |
+|---|---|---|
+| macOS | `codex login` once, then `source <SKILL_SCRIPTS>/export_codex_oauth_token.sh` | `export CODEX_API_KEY=sk-proj-...` (or `OPENAI_API_KEY`) |
+| Linux | `codex login` once, then `source <SKILL_SCRIPTS>/export_codex_oauth_token.sh` | `export CODEX_API_KEY=sk-proj-...` |
+| Windows PowerShell | `codex login` once, then `. <SKILL_SCRIPTS>\export_codex_oauth_token.ps1` | `$env:CODEX_API_KEY = 'sk-proj-...'` |
+| Windows WSL (Ubuntu) | `codex login` once, then `source <SKILL_SCRIPTS>/export_codex_oauth_token.sh` | `export CODEX_API_KEY=sk-proj-...` |
 
-**Option 2: API key** — billed through Google AI Studio or Vertex AI:
+The OAuth scripts only **validate** `~/.codex/auth.json` (or `%USERPROFILE%\.codex\auth.json`) — Harbor injects the file into the sandbox automatically. API key always takes priority over OAuth when both are present.
 
-```bash
-export GEMINI_API_KEY=your-key
-```
+#### Gemini CLI
 
-Or for Vertex AI: `export GOOGLE_API_KEY=your-key` + `export GOOGLE_CLOUD_PROJECT=your-project`
+| OS / shell | OAuth (Google account) | API key |
+|---|---|---|
+| macOS | `gemini login` once, then `source <SKILL_SCRIPTS>/export_gemini_oauth_token.sh` | `export GEMINI_API_KEY=...` |
+| Linux | `gemini login` once, then `source <SKILL_SCRIPTS>/export_gemini_oauth_token.sh` | `export GEMINI_API_KEY=...` |
+| Windows PowerShell | `gemini login` once, then `. <SKILL_SCRIPTS>\export_gemini_oauth_token.ps1` | `$env:GEMINI_API_KEY = '...'` |
+| Windows WSL (Ubuntu) | `gemini login` once, then `source <SKILL_SCRIPTS>/export_gemini_oauth_token.sh` | `export GEMINI_API_KEY=...` |
 
-API key always takes priority over OAuth when both are present.
+The OAuth scripts export `GEMINI_OAUTH_CREDS` (the raw JSON) — `ConfigurableGemini` reads that env var and injects credentials into the sandbox. API key always takes priority over OAuth.
 
 ### Combined setup for cross-agent runs
 
+Resolve `<SKILL_SCRIPTS>` first, then run all three.
+
+**macOS / Linux / Windows WSL:**
 ```bash
-source scripts/export_oauth_token.sh         # Claude (subscription)
-# Codex: either codex login (subscription) or:
-export $(grep CODEX_API_KEY .env)            # Codex (API key)
-source scripts/export_gemini_oauth_token.sh  # Gemini (Google account)
+SKILL_SCRIPTS=~/.claude/skills/nasde-benchmark-runner/scripts   # adjust if --scope project
+source $SKILL_SCRIPTS/export_oauth_token.sh         # Claude (subscription)
+source $SKILL_SCRIPTS/export_codex_oauth_token.sh   # Codex (subscription) — or: export CODEX_API_KEY=...
+source $SKILL_SCRIPTS/export_gemini_oauth_token.sh  # Gemini (Google account) — or: export GEMINI_API_KEY=...
+```
+
+**Windows PowerShell:**
+```powershell
+$SkillScripts = "$env:USERPROFILE\.claude\skills\nasde-benchmark-runner\scripts"
+. "$SkillScripts\export_oauth_token.ps1"
+. "$SkillScripts\export_codex_oauth_token.ps1"
+. "$SkillScripts\export_gemini_oauth_token.ps1"
 ```
 
+### Windows: cmd.exe
+
+cmd.exe is **not supported directly** — `.ps1` requires PowerShell, `.sh` requires bash. Two workarounds:
+
+1. **Open PowerShell** (`powershell.exe`) and dot-source the `.ps1` script. This is the simplest path on a vanilla Windows install.
+2. **Use WSL** (`wsl -d Ubuntu`) and source the `.sh` script. This is the recommended path if you also want Docker Desktop with the WSL2 backend, which is the most common dev setup.
+
+If a user is in cmd.exe, point them to one of these two — don't try to extract the token manually.
+
 ## Running benchmarks
 
 All commands assume `-C` points to the benchmark project directory.
@@ -118,7 +144,7 @@ nasde run --variant baseline -C path/to/benchmark --without-eval
 
 ### Parallel runs (multiple variants)
 
-Running multiple variants simultaneously is safe — each job directory includes a unique random suffix to prevent collisions:
+**Do not use `--all-variants` when you want parallelism.** `--all-variants` runs variants **sequentially** in a single process (one variant after another). To run two or more variants in parallel, launch separate `nasde run` processes with `&` and `wait` — each job directory gets a unique random suffix, so concurrent runs are collision-safe:
 
 ```bash
 nasde run --variant vanilla --tasks my-task -C path/to/benchmark &
@@ -126,6 +152,8 @@ nasde run --variant guided --tasks my-task -C path/to/benchmark &
 wait
 ```
 
+Use `--all-variants` only when you want one variant after another (e.g. to limit total resource use, or when running Claude variants where parallel runs risk Docker OOM — see warning below).
+
 For deterministic job names, use `--job-suffix`:
 
 ```bash

nasde_toolkit-0.3.3/.claude/skills/nasde-benchmark-runner/scripts/export_codex_oauth_token.ps1

@@ -0,0 +1,61 @@
+# Validate Codex OAuth auth.json for ChatGPT subscription-based authentication.
+#
+# Windows-equivalent of scripts/export_codex_oauth_token.sh.
+#
+# Dot-source this script before running nasde to verify your ChatGPT
+# subscription credentials:
+#
+#     . .\scripts\export_codex_oauth_token.ps1
+#     nasde run --variant codex-vanilla -C my-benchmark
+#
+# Prerequisites: run `codex login` to authenticate via ChatGPT.
+# Reads %USERPROFILE%\.codex\auth.json. NASDE injects this file into the
+# sandbox automatically — this script only validates it.
+
+$ErrorActionPreference = 'Stop'
+
+$authPath = Join-Path $env:USERPROFILE '.codex\auth.json'
+
+if (-not (Test-Path $authPath)) {
+    Write-Error "$authPath not found. Run 'codex login' to authenticate via ChatGPT subscription."
+    return
+}
+
+try {
+    $auth = Get-Content $authPath -Raw | ConvertFrom-Json
+} catch {
+    Write-Error "Failed to parse $authPath : $_"
+    return
+}
+
+if ($auth.auth_mode -ne 'chatgpt') {
+    Write-Error "auth_mode is '$($auth.auth_mode)', expected 'chatgpt'. Run 'codex login' to authenticate via ChatGPT subscription."
+    return
+}
+
+$accessToken = $auth.tokens.access_token
+if ([string]::IsNullOrEmpty($accessToken)) {
+    Write-Error "access_token is empty in $authPath. Run 'codex login' to re-authenticate."
+    return
+}
+
+# Decode JWT payload (middle segment) to read exp claim. Pad base64url to
+# multiple of 4 with '=' before decoding.
+try {
+    $payloadSegment = $accessToken.Split('.')[1]
+    $padded = $payloadSegment.Replace('-', '+').Replace('_', '/')
+    switch ($padded.Length % 4) { 2 { $padded += '==' } 3 { $padded += '=' } }
+    $payloadJson = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($padded))
+    $exp = ($payloadJson | ConvertFrom-Json).exp
+} catch {
+    $exp = 0
+}
+
+$now = [int][double]::Parse((Get-Date -UFormat %s))
+if ($exp -gt 0 -and $now -gt $exp) {
+    Write-Warning "access_token expired. Run 'codex login' to refresh."
+    Write-Warning "Proceeding anyway -- Codex CLI may auto-refresh via refresh_token."
+}
+
+$preview = $accessToken.Substring(0, [Math]::Min(20, $accessToken.Length))
+Write-Host "OK Codex OAuth validated (auth_mode=chatgpt, token=$preview...)" -ForegroundColor Green

nasde_toolkit-0.3.3/.claude/skills/nasde-benchmark-runner/scripts/export_gemini_oauth_token.ps1

@@ -0,0 +1,59 @@
+# Export Gemini CLI OAuth credentials for subscription-based authentication.
+#
+# Windows-equivalent of scripts/export_gemini_oauth_token.sh.
+#
+# Dot-source this script before running nasde to authenticate via your
+# Google account instead of GEMINI_API_KEY:
+#
+#     . .\scripts\export_gemini_oauth_token.ps1
+#     nasde run --variant gemini-vanilla -C my-benchmark
+#
+# Prerequisites: run `gemini login` to authenticate via Google.
+# Reads %USERPROFILE%\.gemini\oauth_creds.json and exports the raw JSON as
+# $env:GEMINI_OAUTH_CREDS. ConfigurableGemini injects this into the sandbox.
+
+$ErrorActionPreference = 'Stop'
+
+$credPath = Join-Path $env:USERPROFILE '.gemini\oauth_creds.json'
+
+if (-not (Test-Path $credPath)) {
+    Write-Error "$credPath not found. Run 'gemini login' to authenticate via Google."
+    return
+}
+
+try {
+    $rawJson = Get-Content $credPath -Raw
+    $parsed = $rawJson | ConvertFrom-Json
+} catch {
+    Write-Error "$credPath does not contain valid JSON credentials: $_"
+    return
+}
+
+if (-not $parsed) {
+    Write-Error "$credPath contains empty credentials."
+    return
+}
+
+$accessToken = $parsed.access_token
+if (-not [string]::IsNullOrEmpty($accessToken)) {
+    try {
+        $payloadSegment = $accessToken.Split('.')[1]
+        $padded = $payloadSegment.Replace('-', '+').Replace('_', '/')
+        switch ($padded.Length % 4) { 2 { $padded += '==' } 3 { $padded += '=' } }
+        $payloadJson = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($padded))
+        $exp = ($payloadJson | ConvertFrom-Json).exp
+    } catch {
+        $exp = 0
+    }
+
+    $now = [int][double]::Parse((Get-Date -UFormat %s))
+    if ($exp -gt 0 -and $now -gt $exp) {
+        Write-Warning "access_token appears expired. Run 'gemini login' to refresh."
+        Write-Warning "Proceeding anyway -- Gemini CLI may auto-refresh via refresh_token."
+    }
+}
+
+$env:GEMINI_OAUTH_CREDS = $rawJson
+
+$preview = $rawJson.Substring(0, [Math]::Min(20, $rawJson.Length))
+Write-Host "OK GEMINI_OAUTH_CREDS exported ($preview...)" -ForegroundColor Green

nasde_toolkit-0.3.3/.claude/skills/nasde-benchmark-runner/scripts/export_oauth_token.ps1

@@ -0,0 +1,40 @@
+# Extract Claude Code OAuth token from %USERPROFILE%\.claude\.credentials.json
+# and export it as $env:CLAUDE_CODE_OAUTH_TOKEN.
+#
+# Windows-equivalent of scripts/export_oauth_token.sh (which reads the macOS
+# Keychain). On Windows, Claude Code stores credentials as plain JSON.
+#
+# Dot-source this script before running nasde so the env var persists in the
+# current PowerShell session:
+#
+#     . .\scripts\export_oauth_token.ps1
+#     nasde run --variant baseline -C my-benchmark
+#
+# Running without dot-source (.\scripts\export_oauth_token.ps1) sets the var
+# only inside the script's child scope and it disappears on return.
+
+$ErrorActionPreference = 'Stop'
+
+$credPath = Join-Path $env:USERPROFILE '.claude\.credentials.json'
+
+if (-not (Test-Path $credPath)) {
+    Write-Error "Could not find '$credPath'. Run 'claude' CLI and log in first."
+    return
+}
+
+try {
+    $token = (Get-Content $credPath -Raw | ConvertFrom-Json).claudeAiOauth.accessToken
+} catch {
+    Write-Error "Failed to parse OAuth token from '$credPath': $_"
+    return
+}
+
+if ([string]::IsNullOrEmpty($token)) {
+    Write-Error "claudeAiOauth.accessToken is empty in '$credPath'."
+    return
+}
+
+$env:CLAUDE_CODE_OAUTH_TOKEN = $token
+
+$preview = $token.Substring(0, [Math]::Min(20, $token.Length))
+Write-Host "OK CLAUDE_CODE_OAUTH_TOKEN exported ($preview...)" -ForegroundColor Green

nasde_toolkit-0.3.3/.claude/skills/nasde-benchmark-runner/scripts/export_oauth_token.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# Extract Claude Code OAuth token and export it as CLAUDE_CODE_OAUTH_TOKEN.
+#
+# Source this script before running nasde to authenticate via your
+# Claude Pro/Max subscription instead of ANTHROPIC_API_KEY:
+#
+#   source scripts/export_oauth_token.sh
+#   nasde run --variant baseline -C my-benchmark
+#
+# Storage backend depends on OS:
+#   - macOS: Keychain entry "Claude Code-credentials" (written by `claude` CLI)
+#   - Linux: plain JSON at ~/.claude/.credentials.json
+# Windows users: see scripts/export_oauth_token.ps1 (PowerShell).
+
+# NOTE: Do NOT use `set -e` here -- this script is sourced into the user's
+# shell, so errexit would persist and kill the terminal on any later non-zero
+# exit code. Each command already has its own `|| { ... }` error handling.
+
+_raw_creds=""
+
+if command -v security >/dev/null 2>&1; then
+    _raw_creds="$(security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null)"
+fi
+
+if [ -z "$_raw_creds" ] && [ -f "$HOME/.claude/.credentials.json" ]; then
+    _raw_creds="$(cat "$HOME/.claude/.credentials.json")"
+fi
+
+if [ -z "$_raw_creds" ]; then
+    echo "ERROR: Could not read Claude Code credentials." >&2
+    echo "  - macOS: keychain entry 'Claude Code-credentials' missing" >&2
+    echo "  - Linux: ~/.claude/.credentials.json missing" >&2
+    echo "Run 'claude' CLI and log in first." >&2
+    return 1 2>/dev/null || exit 1
+fi
+
+CLAUDE_CODE_OAUTH_TOKEN="$(echo "$_raw_creds" | python3 -c "import sys,json; print(json.load(sys.stdin)['claudeAiOauth']['accessToken'])")" || {
+    echo "ERROR: Failed to parse OAuth token from Claude credentials." >&2
+    return 1 2>/dev/null || exit 1
+}
+export CLAUDE_CODE_OAUTH_TOKEN
+
+unset _raw_creds
+
+echo "✓ CLAUDE_CODE_OAUTH_TOKEN exported (${CLAUDE_CODE_OAUTH_TOKEN:0:20}...)"

nasde_toolkit-0.3.3/.gitattributes

@@ -0,0 +1,46 @@
+# Default: let Git detect text vs binary, force LF in working tree.
+# Critical: shell scripts and Dockerfiles MUST be LF — they are executed by
+# Linux interpreters in benchmark sandboxes (Daytona, Docker). CRLF causes
+# `bash: required file not found` because the shebang becomes `#!/bin/bash\r`.
+* text=auto eol=lf
+
+# Source code that runs in Linux containers / cross-platform tooling: force LF.
+*.sh        text eol=lf
+*.bash      text eol=lf
+*.py        text eol=lf
+Dockerfile  text eol=lf
+*.dockerfile text eol=lf
+docker-compose.yaml text eol=lf
+docker-compose.yml  text eol=lf
+*.toml      text eol=lf
+*.yaml      text eol=lf
+*.yml       text eol=lf
+*.json      text eol=lf
+*.md        text eol=lf
+Makefile    text eol=lf
+*.mk        text eol=lf
+
+# PowerShell expects CRLF on Windows. Keep as-is so PS5.1 parses cleanly.
+*.ps1       text eol=crlf
+*.psd1      text eol=crlf
+*.psm1      text eol=crlf
+
+# Windows batch files require CRLF.
+*.bat       text eol=crlf
+*.cmd       text eol=crlf
+
+# Binary assets: never touch line endings.
+*.png       binary
+*.jpg       binary
+*.jpeg      binary
+*.gif       binary
+*.ico       binary
+*.pdf       binary
+*.zip       binary
+*.gz        binary
+*.tgz       binary
+*.tar       binary
+*.whl       binary
+*.so        binary
+*.dll       binary
+*.exe       binary