skalpel 3.0.0 → 3.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Skalpel — local proxy and TUI for coding agents (skalpel + skalpeld bundle).",
   "license": "Apache-2.0",
   "homepage": "https://skalpel.ai",
@@ -54,10 +54,10 @@
     "x64"
   ],
   "optionalDependencies": {
-    "@skalpelai/skalpel-darwin-arm64": "3.0.0",
-    "@skalpelai/skalpel-darwin-x64": "3.0.0",
-    "@skalpelai/skalpel-linux-arm64": "3.0.0",
-    "@skalpelai/skalpel-linux-x64": "3.0.0",
-    "@skalpelai/skalpel-win32-x64": "3.0.0"
+    "@skalpelai/skalpel-darwin-arm64": "3.0.2",
+    "@skalpelai/skalpel-darwin-x64": "3.0.2",
+    "@skalpelai/skalpel-linux-arm64": "3.0.2",
+    "@skalpelai/skalpel-linux-x64": "3.0.2",
+    "@skalpelai/skalpel-win32-x64": "3.0.2"
   }
 }

package/postinstall/lib/detect-prior.js

@@ -1,13 +1,19 @@
 // Step 1: detect prior install.
 //
-// SPEC.md §9.6 — read <configDir>/auth.json existence, config.toml
-// existence, and presence of LaunchAgent / systemd unit / Task. If any
-// of these are present, the wizard short-circuits and the TUI is
-// launched directly.
+// v3.0.1 fix: `prior` now means specifically "user has auth state" —
+// i.e. auth.json exists. v3.0.0 treated any of {auth.json, config.toml,
+// lock file, service registration} as "prior" and skipped sign-in.
+// That meant once a machine had ever installed skalpel, the systemd /
+// launchd unit file persists outside configDir; every subsequent
+// `npm install skalpel` would skip sign-in forever, and the user
+// could never get logged in via the install flow on re-install.
 //
-// We also check the lock file (which the daemon writes) so an active
-// install with running daemon is detected even if config.toml hasn't
-// been written yet.
+// The other probes (config.toml / lock file / service registration)
+// are informational only — they get reported in the log but no longer
+// gate sign-in. SPEC.md §9.6: a fresh user with no auth.json must
+// always be offered the sign-in step, regardless of mechanical
+// install state (service units, rc snippets) that survived a prior
+// install.
 
 'use strict';
 
@@ -26,14 +32,15 @@ function fileExists(p) {
 
 function run({ dryRun }) {
   const probes = [
-    { label: 'auth.json', path: paths.authFile() },
-    { label: 'config.toml', path: paths.configToml() },
-    { label: 'lock file', path: paths.lockFile() },
-    { label: 'service registration', path: paths.servicePath() },
+    { label: 'auth.json', path: paths.authFile(), gatesPrior: true },
+    { label: 'config.toml', path: paths.configToml(), gatesPrior: false },
+    { label: 'lock file', path: paths.lockFile(), gatesPrior: false },
+    { label: 'service registration', path: paths.servicePath(), gatesPrior: false },
   ];
 
   const findings = probes.map((p) => ({ ...p, exists: fileExists(p.path) }));
-  const prior = findings.some((f) => f.exists);
+  // `prior` reflects only auth.json existence — see header comment.
+  const prior = findings.some((f) => f.gatesPrior && f.exists);
 
   if (dryRun) {
     log.dryRun(`step 1 detect-prior: would probe ${findings.length} paths`);
@@ -44,7 +51,11 @@ function run({ dryRun }) {
     );
   }
 
-  log.info(prior ? 'detected prior install' : 'no prior install detected');
+  log.info(
+    prior
+      ? 'detected prior auth (auth.json present) — sign-in will skip'
+      : 'no prior auth detected — sign-in will run'
+  );
   return { prior, findings };
 }
 

package/postinstall/lib/paths.js

@@ -96,13 +96,63 @@ function isNpxInvocation() {
   return false;
 }
 
-// Where the platform binary lives once optionalDependencies installed it.
+// Where the platform binary lives once optionalDependencies installed
+// it. v3.0.1 fix: previously this returned the GLOBAL-install path
+// (`$HOME/.local/bin/<name>` on Linux, `/usr/local/bin/<name>` on
+// macOS, `$HOME/AppData/Local/skalpel/<name>.exe` on Windows). That
+// path is only correct for `npm install -g skalpel`. For local
+// installs (`npm install skalpel` from any non-package directory)
+// the binary lives at `node_modules/@skalpelai/skalpel-<plat>/bin/
+// <name>` — the optionalDependencies-resolved sub-package's bin/.
+//
+// The right resolution is the same one npm-bin/skalpel.js already
+// uses for runtime dispatch: `require.resolve` against the platform
+// sub-package's package.json, then join with `bin/<name>{,.exe}`.
+// This works uniformly for global, local, and npx-cached installs
+// because node's module resolver walks up node_modules trees the
+// same way in all three contexts.
+//
+// We fall back to the legacy global-install paths if require.resolve
+// fails, so behaviour on a real global install stays unchanged.
+function platformPackageName() {
+  // Map process.platform-process.arch → @skalpelai/skalpel-<npm-plat>.
+  // Mirrors PLATFORM_PACKAGES in npm-bin/skalpel.js.
+  const key = `${process.platform}-${process.arch}`;
+  const map = {
+    'darwin-arm64': '@skalpelai/skalpel-darwin-arm64',
+    'darwin-x64': '@skalpelai/skalpel-darwin-x64',
+    'linux-arm64': '@skalpelai/skalpel-linux-arm64',
+    'linux-x64': '@skalpelai/skalpel-linux-x64',
+    'win32-x64': '@skalpelai/skalpel-win32-x64',
+  };
+  return map[key] || null;
+}
+
 function binPath(name) {
   if (isNpxInvocation()) {
     throw new Error(
       'Skalpel does not support `npx skalpel` — please run `npm i -g @skalpelai/skalpel` instead.'
     );
   }
+  const exe = process.platform === 'win32' ? `${name}.exe` : name;
+
+  // Preferred: resolve via the platform sub-package's package.json.
+  // Works for global, local, and any other npm-managed install context.
+  const pkgName = platformPackageName();
+  if (pkgName) {
+    try {
+      const pkgRoot = path.dirname(require.resolve(`${pkgName}/package.json`));
+      return path.join(pkgRoot, 'bin', exe);
+    } catch (_err) {
+      // fall through to legacy paths below
+    }
+  }
+
+  // Fallback: legacy hardcoded global-install paths. Reached only on
+  // a misinstall (no @skalpelai/skalpel-<plat> sub-package in the
+  // resolution tree) — service-register will then error with the
+  // legacy "binary missing at <path>" message which is at least a
+  // recognisable signature.
   const h = home();
   const npmPrefix = process.env.npm_config_prefix;
   validatePath(npmPrefix, 'npm_config_prefix');