mirror of
https://github.com/microsoft/SkillOpt.git
synced 2026-08-03 07:02:46 +08:00
f76df89475
Addresses 8 further Copilot inline findings across 04d3b65/4c2aa21: - pytest_runs: drop the trivially-overwritable .count sidecar; derive the count from nonce-tagged log lines (per-run os.urandom nonce). Documented honestly as tamper-EVIDENT, not tamper-proof, since an unsandboxed agent runs as the same OS user; harness_test_passes (parent re-runs the tests) remains the authoritative unforgeable gate. - Refuse SKILLOPT_HOST_AUTH=1 together with SKILLOPT_SANDBOX: host ~/.claude is not mounted, so the credential symlinks would dangle and auth silently fail. - Raise on an unknown --scenario instead of returning an empty score=0 result that looks like a real evaluation. - POSIX guard: the bash shims + claude/git shell-out are POSIX-only; raise a clear error on non-POSIX hosts rather than failing obscurely. - CLI: catch git CalledProcessError / ValueError / RuntimeError so missing git/claude, bad SHA, and unknown scenarios exit non-zero with a message instead of dumping a traceback. - Clarify that superpowers_version is a reporting label; the checkout is controlled solely by pinned_sha (--sha). - Smoke sanitizer: also redact /tmp workspace paths and soften the "no host paths" claim to best-effort. Tests: 49 focused, full suite 309 passed / 6 skipped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>