Files
gstack/scripts/skill-check.ts
T
Garry TanandOpenAI Codex 4a3c6a8a3c v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)
* feat(cso): add verified audits and replayable repair bundles

* fix(cso): harden qualification and setup boundaries

* fix(cso): assemble security canaries at runtime

* fix(cso): bound release proof and maintenance work

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): require complete evaluation reports

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): replay expired snapshots from supplied source

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): synchronize DNS cancellation assertion

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore(ship): exempt repository owner from liveness proof

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): make recheck retention overlap deterministic

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: bump version and changelog (v1.85.0.0)

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass native release gates

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.86.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): resolve rechecks by finding

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.87.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass macOS and Windows release gates

Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): harden native verification gates

* fix(cso): refine Windows native diagnostics

* test(cso): isolate Windows Git startup failure

* test(cso): stabilize Windows native diagnostics

* fix(cso): support hardened Git on Windows

* fix(cso): close final verification gaps

* test(cso): bound cold Docker fixture setup

* fix(cso): restore cross-platform free-suite gates

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>
2026-09-14 15:14:58 -07:00

159 lines
6.0 KiB
TypeScript

#!/usr/bin/env bun
/**
* skill:check — Health summary for all SKILL.md files.
*
* Reports:
* - Command validation (valid/invalid/snapshot errors)
* - Template coverage (which SKILL.md files have .tmpl sources)
* - Freshness check (generated files match committed files)
*/
import { validateSkill } from '../test/helpers/skill-parser';
import { discoverTemplates, discoverSkillFiles } from './discover-skills';
import * as fs from 'fs';
import * as path from 'path';
import { execSync } from 'child_process';
import { ALL_HOST_CONFIGS, getExternalHosts, getHostConfig } from '../hosts/index';
const ROOT = path.resolve(import.meta.dir, '..');
const ROOT_REALPATH = fs.realpathSync(ROOT);
const CLAUDE_SKIPS = new Set(getHostConfig('claude').generation.skipSkills ?? []);
function isRepoRootSymlink(candidateDir: string): boolean {
try {
return fs.realpathSync(candidateDir) === ROOT_REALPATH;
} catch {
return false;
}
}
// Find all SKILL.md files (dynamic discovery — no hardcoded list)
const SKILL_FILES = discoverSkillFiles(ROOT);
let hasErrors = false;
// ─── Skills ─────────────────────────────────────────────────
console.log(' Skills:');
for (const file of SKILL_FILES) {
const fullPath = path.join(ROOT, file);
const result = validateSkill(fullPath);
if (result.warnings.length > 0) {
console.log(` \u26a0\ufe0f ${file.padEnd(30)}${result.warnings.join(', ')}`);
continue;
}
const totalValid = result.valid.length;
const totalInvalid = result.invalid.length;
const totalSnapErrors = result.snapshotFlagErrors.length;
if (totalInvalid > 0 || totalSnapErrors > 0) {
hasErrors = true;
console.log(` \u274c ${file.padEnd(30)}${totalValid} valid, ${totalInvalid} invalid, ${totalSnapErrors} snapshot errors`);
for (const inv of result.invalid) {
console.log(` line ${inv.line}: unknown command '${inv.command}'`);
}
for (const se of result.snapshotFlagErrors) {
console.log(` line ${se.command.line}: ${se.error}`);
}
} else {
console.log(` \u2705 ${file.padEnd(30)}${totalValid} commands, all valid`);
}
}
// ─── Templates ──────────────────────────────────────────────
console.log('\n Templates:');
const TEMPLATES = discoverTemplates(ROOT);
for (const { tmpl, output } of TEMPLATES) {
// Source-root outputs are Claude Code renders; own-harness wrappers are absent.
if ((getHostConfig('claude').generation.skipSkills ?? []).includes(path.basename(path.dirname(tmpl)))) continue;
const tmplPath = path.join(ROOT, tmpl);
const outPath = path.join(ROOT, output);
if (!fs.existsSync(tmplPath)) {
console.log(` \u26a0\ufe0f ${output.padEnd(30)} — no template`);
continue;
}
if (!fs.existsSync(outPath)) {
const skillDir = output === 'SKILL.md' ? '' : output.split('/')[0];
if (CLAUDE_SKIPS.has(skillDir)) {
console.log(` - ${output.padEnd(30)} — intentionally omitted for Claude Code`);
continue;
}
hasErrors = true;
console.log(` \u274c ${output.padEnd(30)} — generated file missing! Run: bun run gen:skill-docs`);
continue;
}
console.log(` \u2705 ${tmpl.padEnd(30)} \u2192 ${output}`);
}
// Skills without templates
for (const file of SKILL_FILES) {
const tmplPath = path.join(ROOT, file + '.tmpl');
if (!fs.existsSync(tmplPath) && !TEMPLATES.some(t => t.output === file)) {
console.log(` \u26a0\ufe0f ${file.padEnd(30)} — no template (OK if no $B commands)`);
}
}
// ─── External Host Skills (config-driven) ───────────────────
for (const hostConfig of getExternalHosts()) {
const hostDir = path.join(ROOT, hostConfig.hostSubdir, 'skills');
if (fs.existsSync(hostDir)) {
console.log(`\n ${hostConfig.displayName} Skills (${hostConfig.hostSubdir}/skills/):`);
const dirs = fs.readdirSync(hostDir).sort();
let count = 0;
let missing = 0;
for (const dir of dirs) {
const skillDir = path.join(hostDir, dir);
if (isRepoRootSymlink(skillDir)) {
console.log(` - ${dir.padEnd(30)} — sidecar symlink, skipped`);
continue;
}
const skillMd = path.join(skillDir, 'SKILL.md');
if (fs.existsSync(skillMd)) {
count++;
const content = fs.readFileSync(skillMd, 'utf-8');
const hasClaude = content.includes('.claude/skills');
if (hasClaude) {
hasErrors = true;
console.log(` \u274c ${dir.padEnd(30)} — contains .claude/skills reference`);
} else {
console.log(` \u2705 ${dir.padEnd(30)} — OK`);
}
} else {
missing++;
hasErrors = true;
console.log(` \u274c ${dir.padEnd(30)} — SKILL.md missing`);
}
}
console.log(` Total: ${count} skills, ${missing} missing`);
} else {
console.log(`\n ${hostConfig.displayName} Skills: ${hostConfig.hostSubdir}/skills/ not found (run: bun run gen:skill-docs --host ${hostConfig.name})`);
}
}
// ─── Freshness (config-driven) ──────────────────────────────
for (const hostConfig of ALL_HOST_CONFIGS) {
const hostFlag = hostConfig.name === 'claude' ? '' : ` --host ${hostConfig.name}`;
console.log(`\n Freshness (${hostConfig.displayName}):`);
try {
execSync(`bun run scripts/gen-skill-docs.ts${hostFlag} --dry-run`, { cwd: ROOT, stdio: 'pipe' });
console.log(` \u2705 All ${hostConfig.displayName} generated files are fresh`);
} catch (err: any) {
hasErrors = true;
const output = err.stdout?.toString() || '';
console.log(` \u274c ${hostConfig.displayName} generated files are stale:`);
for (const line of output.split('\n').filter((l: string) => l.startsWith('STALE'))) {
console.log(` ${line}`);
}
console.log(` Run: bun run gen:skill-docs${hostFlag}`);
}
}
console.log('');
process.exit(hasErrors ? 1 : 0);