skalpel 3.3.2 → 3.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "3.3.2",
+  "version": "3.3.4",
   "description": "Skalpel — local proxy and TUI for coding agents (skalpel + skalpeld bundle).",
   "license": "Apache-2.0",
   "homepage": "https://skalpel.ai",
@@ -58,10 +58,10 @@
     "x64"
   ],
   "optionalDependencies": {
-    "@skalpelai/skalpel-darwin-arm64": "3.3.2",
-    "@skalpelai/skalpel-darwin-x64": "3.3.2",
-    "@skalpelai/skalpel-linux-arm64": "3.3.2",
-    "@skalpelai/skalpel-linux-x64": "3.3.2",
-    "@skalpelai/skalpel-win32-x64": "3.3.2"
+    "@skalpelai/skalpel-darwin-arm64": "3.3.4",
+    "@skalpelai/skalpel-darwin-x64": "3.3.4",
+    "@skalpelai/skalpel-linux-arm64": "3.3.4",
+    "@skalpelai/skalpel-linux-x64": "3.3.4",
+    "@skalpelai/skalpel-win32-x64": "3.3.4"
   }
 }

package/postinstall/index.js

@@ -198,10 +198,23 @@ async function main(argv) {
       allWarnings.push(`ca-install: ${err.message}`);
     }
 
-    log.step(5, total, 'env-inject', 'managed-block edit per shell');
-    // env-inject is critical: missing managed block means agents
-    // never see the proxy URL. Errors propagate.
-    envInject.run({ dryRun: opts.dryRun });
+    // Step 5 — shell activation is OPT-IN (incident 2026-07-05). A global
+    // `npm install -g skalpel` must NOT modify the user's shell rc files. That
+    // was the blast radius of the incident: the managed block exported
+    // ANTHROPIC_BASE_URL into every shell and broke Claude Code, and even a
+    // poison-free wrapper is too invasive to write into a user's shell without
+    // consent for an agent harness. The daemon registered in step 3 sits IDLE
+    // and intercepts nothing until the user explicitly opts in with
+    // `skalpel setup`, which wraps the detected agents (setupCore -> the same
+    // managed block, now poison-free). Set SKALPEL_ACTIVATE_SHELL=1 to restore
+    // the old auto-wrap-on-install behavior.
+    if (process.env.SKALPEL_ACTIVATE_SHELL === '1') {
+      log.step(5, total, 'env-inject', 'managed-block edit per shell (SKALPEL_ACTIVATE_SHELL=1)');
+      envInject.run({ dryRun: opts.dryRun });
+    } else {
+      log.step(5, total, 'shell-activation', 'deferred — opt-in via `skalpel setup`');
+      log.info('Shell integration is opt-in. Run `skalpel setup` to route Claude/Codex through skalpel.');
+    }
 
     log.step(6, total, 'launch', 'next-step hint');
     launch.run({ dryRun: opts.dryRun });

package/postinstall/lib/integrations.js

@@ -1,20 +1,30 @@
 'use strict';
 
-// envBlockValues defines the five vars the managed rc-block exports so
-// agents see the daemon's loopback proxy. Under the MITM Codex regime
-// (Option A) the Codex wrapper no longer needs SKALPEL_CODEX_* base-URL
-// vars — `skalpel codex-exec` sets HTTPS_PROXY at exec time and the
-// daemon TLS-terminates chatgpt.com:443 directly.
+// envBlockValues returns the env vars the managed rc-block should export
+// GLOBALLY (into every shell). Under the MITM regime this is now EMPTY, and
+// that is load-bearing, not an oversight:
+//
+//   The old base-URL regime exported ANTHROPIC_BASE_URL/_API_URL (+ OpenAI
+//   base vars) = http://127.0.0.1:<port> into every shell so agents routed
+//   through the loopback proxy. That globally rewired Claude/Codex's provider
+//   endpoint. When the daemon was down/unhealthy/removed, Claude hit a non-
+//   first-party host -> Connection error -> synthetic "Not logged in", and any
+//   Claude process that inherited the var WITHOUT going through the claude()
+//   shell wrapper (a subprocess, an IDE, `command claude`) could not self-heal.
+//   That broke real Claude Code sessions (incident 2026-07-05).
+//
+//   MITM does NOT need any of these. Interception is per-launch: `skalpel
+//   claude-exec` / `codex-exec` set HTTPS_PROXY + NODE_EXTRA_CA_CERTS at exec
+//   time and explicitly UNSET ANTHROPIC_BASE_URL/_API_URL (see cmd/skalpel/
+//   claude_exec.go). So NOTHING routing-related belongs in the global rc block.
+//   Returning {} means the managed block carries only the fail-open wrappers,
+//   and a bare/subprocess Claude is never poisoned — it talks to Anthropic
+//   directly, which is the correct default.
+//
+// `port` is retained in the signature for call-site compatibility.
 function envBlockValues(port) {
-  const p = String(port || 7878);
-  const root = `http://127.0.0.1:${p}`;
-  return {
-    ANTHROPIC_API_URL: root,
-    ANTHROPIC_BASE_URL: root,
-    OPENAI_BASE_URL: `${root}/v1`,
-    OPENAI_API_BASE: `${root}/v1`,
-    SKALPEL_PROXY_URL: root,
-  };
+  void port;
+  return {};
 }
 
 const claudeCode = {

package/postinstall/lib/rc-edit.test.js

@@ -72,8 +72,12 @@ function run() {
         1,
         'managed block end marker must appear exactly once'
       );
-      assert.ok(after.includes('export ANTHROPIC_API_URL="http://127.0.0.1:7878"'));
-      assert.ok(after.includes('export OPENAI_BASE_URL="http://127.0.0.1:7878/v1"'));
+      // MITM regime (incident 2026-07-05): the managed block must NEVER
+      // globally export a base-URL / proxy var. Interception is per-launch via
+      // claude-exec/codex-exec; the block carries only the fail-open wrappers.
+      assert.ok(!after.includes('127.0.0.1:7878'), 'no loopback proxy URL is exported globally');
+      assert.ok(!after.includes('export ANTHROPIC_BASE_URL'), 'ANTHROPIC_BASE_URL is never globally exported');
+      assert.ok(after.includes('claude-exec'), 'the fail-open claude wrapper is still installed');
       assert.ok(after.includes('# user content'), 'user content preserved');
       assert.ok(after.includes('export FOO=bar'), 'user export preserved');
     } finally {
@@ -106,7 +110,8 @@ function run() {
       rc.applyBlock({ shell: 'fish', file, env });
       const after = fs.readFileSync(file, 'utf8');
       assert.strictEqual(countMatches(after, rc.FENCE_BEGIN_POSIX), 1);
-      assert.ok(after.includes('set -gx ANTHROPIC_API_URL'));
+      assert.ok(!after.includes('set -gx ANTHROPIC_API_URL'), 'MITM: no global base-URL export in fish');
+      assert.ok(!after.includes('127.0.0.1:7878'), 'MITM: no loopback proxy URL exported in fish');
       assert.ok(after.includes('# fish prelude'), 'fish prelude preserved');
     } finally {
       fs.unlinkSync(file);
@@ -123,23 +128,27 @@ function run() {
       const after = fs.readFileSync(file, 'utf8');
       assert.strictEqual(countMatches(after, rc.FENCE_BEGIN_PS), 1);
       assert.strictEqual(countMatches(after, rc.FENCE_END_PS), 1);
-      assert.ok(after.includes("$env:ANTHROPIC_API_URL = 'http://127.0.0.1:7878'"));
+      assert.ok(!after.includes("127.0.0.1:7878"), 'MITM: no base-URL export in the powershell block');
     } finally {
       fs.unlinkSync(file);
     }
   });
 
-  test('TestRcEdit_Replaces_When_Port_Changes', () => {
+  test('TestRcEdit_Block_Is_Port_Independent_Under_MITM', () => {
+    // Under MITM the managed block exports NO base-URL var, so the proxy port
+    // never appears in it — the port lives in the daemon config, not the shell
+    // env. Changing the port is therefore a no-op for the rc block. (This test
+    // replaces the old TestRcEdit_Replaces_When_Port_Changes, whose premise —
+    // the port being baked into a global export — was the 2026-07-05 poison.)
     const file = tmpFile('rcedit-port');
     fs.writeFileSync(file, '');
     try {
       rc.applyBlock({ shell: 'bash', file, env: rc.envBlockValues(7878) });
       const r2 = rc.applyBlock({ shell: 'bash', file, env: rc.envBlockValues(9999) });
-      assert.strictEqual(r2.changed, true, 'changing port should rewrite');
+      assert.strictEqual(r2.changed, false, 'block is port-independent (no URL is exported)');
       const after = fs.readFileSync(file, 'utf8');
       assert.strictEqual(countMatches(after, rc.FENCE_BEGIN_POSIX), 1);
-      assert.ok(after.includes('http://127.0.0.1:9999'));
-      assert.ok(!after.includes('http://127.0.0.1:7878'));
+      assert.ok(!after.includes('127.0.0.1'), 'no loopback URL anywhere in the managed block');
     } finally {
       fs.unlinkSync(file);
     }