skalpel 3.0.12 → 3.0.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "3.0.12",
+  "version": "3.0.14",
   "description": "Skalpel — local proxy and TUI for coding agents (skalpel + skalpeld bundle).",
   "license": "Apache-2.0",
   "homepage": "https://skalpel.ai",
@@ -53,10 +53,10 @@
     "x64"
   ],
   "optionalDependencies": {
-    "@skalpelai/skalpel-darwin-arm64": "3.0.12",
-    "@skalpelai/skalpel-darwin-x64": "3.0.12",
-    "@skalpelai/skalpel-linux-arm64": "3.0.12",
-    "@skalpelai/skalpel-linux-x64": "3.0.12",
-    "@skalpelai/skalpel-win32-x64": "3.0.12"
+    "@skalpelai/skalpel-darwin-arm64": "3.0.14",
+    "@skalpelai/skalpel-darwin-x64": "3.0.14",
+    "@skalpelai/skalpel-linux-arm64": "3.0.14",
+    "@skalpelai/skalpel-linux-x64": "3.0.14",
+    "@skalpelai/skalpel-win32-x64": "3.0.14"
   }
 }

package/postinstall/lib/sign-in.js

@@ -46,53 +46,35 @@ function resolveDispatcher() {
 
 function run({ dryRun, prior }) {
   if (prior) {
-    log.info('sign-in: prior auth.json detected — skipping browser flow');
+    log.info('sign-in: prior auth.json detected — skipping');
     return { skipped: true };
   }
 
-  const dispatcher = resolveDispatcher();
-
+  // Per UX request 2026-05-14: postinstall must NOT pop a browser
+  // unprompted. The first-time-user contract is now:
+  //   1. npm install completes silently (no auto-launched browser).
+  //   2. Postinstall prints "all set — run `skalpel` to open the TUI".
+  //   3. On first `skalpel` invocation, the TUI detects missing
+  //      auth.json and renders an in-TUI sign-in gate (press Enter
+  //      to open the browser, q to quit). See the runTUI auth gate
+  //      in cmd/skalpel/main.go.
+  //
+  // We keep this module's surface unchanged so postinstall/index.js
+  // does not need to special-case the deferred path; we just return
+  // `skipped: true` whether or not auth exists.
+  log.info('sign-in: deferred — first `skalpel` launch will gate sign-in');
   if (dryRun) {
-    log.dryRun(
-      `step 2 sign-in: would exec \`node ${dispatcher || '<dispatcher-missing>'} login\` ` +
-      '(loopback browser flow with manual-paste fallback)'
-    );
-    return { skipped: false, dryRun: true };
-  }
-
-  if (!dispatcher) {
-    log.warn(
-      'sign-in: dispatch shim not resolvable; user must run `skalpel login` ' +
-      'manually after install'
-    );
-    return { skipped: true, reason: 'no-dispatcher' };
+    log.dryRun('step 2 sign-in: would defer (no postinstall browser pop)');
+    return { skipped: true, dryRun: true, deferred: true };
   }
-
-  // B6: actually spawn `skalpel login`. The subprocess opens the
-  // browser, waits for the loopback callback, and writes auth.json.
-  // We propagate stdio so the user can see the prompt; we cap at
-  // SIGN_IN_TIMEOUT_MS so a runaway hang does not block npm install.
-  log.info(
-    'sign-in: launching `skalpel login` (loopback browser flow); ' +
-    `timeout ${Math.round(SIGN_IN_TIMEOUT_MS / 1000)}s`
-  );
-  const r = spawnSync(process.execPath, [dispatcher, 'login'], {
-    stdio: 'inherit',
-    timeout: SIGN_IN_TIMEOUT_MS,
-  });
-  if (r.error) {
-    log.warn(`sign-in: spawn error: ${r.error.message}; user can re-run \`skalpel login\``);
-    return { skipped: false, error: r.error.message };
-  }
-  if (r.status !== 0) {
-    log.warn(
-      `sign-in: \`skalpel login\` exited ${r.status}; user can re-run after install ` +
-      `(config dir: ${paths.configDir()})`
-    );
-    return { skipped: false, exitCode: r.status };
-  }
-  log.info(`sign-in: ok (config dir: ${paths.configDir()})`);
-  return { skipped: false, ok: true };
+  return { skipped: true, deferred: true };
 }
 
+// resolveDispatcher and SIGN_IN_TIMEOUT_MS are retained at module
+// scope (used by no callers today) so the spawn-on-install behaviour
+// can be reinstated with a single edit if the deferred-auth UX needs
+// to be reverted.
+void resolveDispatcher;
+void SIGN_IN_TIMEOUT_MS;
+
 module.exports = { run, resolveDispatcher };