skalpel 3.4.15 → 3.4.16

package/INSTALL.md

@@ -42,8 +42,9 @@ Post-W4 (OAuth port): first run is a guided TUI walkthrough plus browser-loopbac
 1. The user installs (`npm install -g skalpel`) and runs `skalpel`.
 2. If `auth.json` is missing, `skalpel` renders a branded walkthrough in-terminal: daemon status, sign-in requirement, CA trust behavior, wrapper scope (new sessions only), and quick toggles (`skalpel off` / `skalpel on`).
 3. On Enter, `skalpel` opens a browser to the Skalpel hosted-UI sign-in page (Cognito), waits on a loopback HTTP callback, and validates the signed envelope returned by the callback.
-4. On a verified envelope, the daemon writes `auth.json` to the per-OS configuration directory (per `SPEC.md` §7). The file is owned by the user with `0600` permissions and carries the Cognito JWT bundle (access_token, refresh_token, expires_at).
-5. The TUI auto-launches into the Dashboard. Once the daemon is reachable, the app surfaces live status and tabs (Dashboard / Engines / Account) with the first-run intro banner.
+4. On a verified envelope, the CLI writes `auth.json` to the per-OS configuration directory (per `SPEC.md` §7). The file is owned by the user with `0600` permissions and carries the Cognito JWT bundle (access_token, refresh_token, expires_at).
+5. Login idempotently enables the `behavior_graph` actuator and installs or refreshes the managed Claude Code and Codex prompt/session hooks. This does not depend on `skalpel setup` or on a live daemon.
+6. Browser/paste login auto-launches the TUI and starts or resumes exactly one intent-graph worker, with progress on the Dashboard. Activation login stays TUI-free and launches the same worker in the background.
 
 This flow corresponds to Journey 1 — First launch, fresh authentication — in `SPEC.md`. That narrative describes what the user feels at each step; this document describes what the install machinery actually does.
 
@@ -61,18 +62,18 @@ The `&& npm install -g` step puts `skalpel` on your PATH so shell wrappers from
 
 The shell wrappers — and the `skalpel active` / `skalpel inactive` indicator each new `claude` / `codex` session prints — **require a persistent global install** (`npm install -g skalpel`). The wrapper block is gated on `command -v skalpel`, so a block written while only an ephemeral `npx` binary is on PATH never activates. If you run only the `npx … login --activation` step (without the global install), harness setup detects that no persistent `skalpel` is on PATH and **tells you to run `npm install -g skalpel@latest`** instead of silently writing an inert block. Run the global install, then `skalpel setup` (or restart your shell), and the indicator appears.
 
-`login --activation` is **auth-only with respect to the TUI**: it claims the token, writes `auth.json`, and never launches the TUI (the magic flow is a deliberate terminal handoff). Before exiting it chains directly into harness setup so the single pasted command also walks the user through wrapping their coding agents: in an interactive terminal it runs the same detection + checkbox prompt as `skalpel setup`; in a non-interactive shell (CI, piped) it only prints what it detected and points at `skalpel setup`, never editing shell startup files unattended. Browser-loopback `skalpel login` is unchanged and still lands the user on the dashboard.
+`login --activation` is **auth-only with respect to the TUI**: it claims the token, writes `auth.json`, heals behavior hooks, starts or resumes graph learning in the background, and never launches the TUI (the magic flow is a deliberate terminal handoff). External-shell wrapping remains a separate consent boundary: in an interactive terminal activation offers the same detection + checkbox prompt as `skalpel setup`; in a non-interactive shell (CI, piped) it only prints what it detected and points at `skalpel setup`, never editing shell startup files unattended. Browser-loopback `skalpel login` still lands the user on the dashboard and shows graph progress there.
 
 A user who independently runs `npm install -g skalpel` is still supported: `postinstall` prints a best-effort pointer to `https://skalpel.ai/signup`, and the first `skalpel` run repeats that pointer where output is guaranteed.
 
 When Claude Code is already present, the persistent install also registers Skalpel's local,
 read-only `statusLine` command. It is visible immediately as `~0.0h saved` and grows only from
-confirmed savings. This does **not** opt the user into prompt/session hooks: those remain disabled
-until the explicit `skalpel setup` flow below. An existing custom Claude status line is preserved.
+confirmed savings. Install alone does **not** opt the user into prompt/session hooks; the first
+successful `skalpel login` activates them. An existing custom Claude status line is preserved.
 
-### `skalpel setup` — detect and wrap coding agents
+### `skalpel setup` — repair wrappers and behavior hooks
 
-Harness setup runs automatically at the tail of `login --activation` (see above), and is also available as a standalone command for re-running later or for `npm install -g` users. `skalpel setup` detects which coding-agent harnesses are installed (cross-platform on Linux, Windows, and macOS) via PATH and per-user config probes:
+Normal authentication, hook activation, and graph learning require no setup command. `skalpel setup` remains as an explicit recovery/advanced command for re-running optional external-shell wrapping and repairing managed hooks. Harness wrapping is also offered interactively at the tail of `login --activation` (see above). `skalpel setup` detects which coding-agent harnesses are installed (cross-platform on Linux, Windows, and macOS) via PATH and per-user config probes:
 
 - **Claude Code** and **Codex CLI** — detected and wrappable.
 - **Cursor** — detected for display only (no Skalpel wrapper today).

package/README.md

@@ -10,7 +10,7 @@ After signing up at [skalpel.ai](https://skalpel.ai):
 npx skalpel login
 ```
 
-`npx skalpel login` materializes both binaries and runs a browser-loopback sign-in against Cognito; the daemon writes the Cognito JWT bundle to `auth.json` and the next `skalpel` launch lands you on the Engines tab. To install persistently:
+`npx skalpel login` materializes both binaries and runs a browser-loopback sign-in against Cognito. A successful login writes the Cognito JWT bundle, idempotently activates the managed Claude Code and Codex behavior hooks, and starts or resumes intent-graph learning; browser login then opens the TUI so progress is visible. To install persistently:
 
 ```
 npm install -g skalpel
@@ -37,7 +37,8 @@ For details on what gets installed where, per-OS service registration, updates,
 `skalpel` accepts a small set of subcommands:
 
 - `skalpel` — launch the Bubble Tea TUI (default).
-- `skalpel login` — browser-loopback sign-in; writes `auth.json`.
+- `skalpel login` — sign in, heal behavior hooks, and start/resume intent-graph learning.
+- `skalpel setup` — repair optional external-shell wrappers and behavior hooks; not required for normal login/TUI onboarding.
 - `skalpel logout` — revoke the active session (best-effort) and delete `auth.json`; supports `--yes` to skip the `[y/N]` confirm.
 - `skalpel uninstall` — clean up skalpel state on this machine.
 - `skalpel --version` / `skalpel --help` — utilities.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "3.4.15",
+  "version": "3.4.16",
   "description": "Skalpel — local proxy and TUI for coding agents (skalpel + skalpeld bundle).",
   "license": "Apache-2.0",
   "homepage": "https://skalpel.ai",
@@ -59,10 +59,10 @@
     "x64"
   ],
   "optionalDependencies": {
-    "@skalpelai/skalpel-darwin-arm64": "3.4.15",
-    "@skalpelai/skalpel-darwin-x64": "3.4.15",
-    "@skalpelai/skalpel-linux-arm64": "3.4.15",
-    "@skalpelai/skalpel-linux-x64": "3.4.15",
-    "@skalpelai/skalpel-win32-x64": "3.4.15"
+    "@skalpelai/skalpel-darwin-arm64": "3.4.16",
+    "@skalpelai/skalpel-darwin-x64": "3.4.16",
+    "@skalpelai/skalpel-linux-arm64": "3.4.16",
+    "@skalpelai/skalpel-linux-x64": "3.4.16",
+    "@skalpelai/skalpel-win32-x64": "3.4.16"
   }
 }

package/postinstall/index.js

@@ -174,10 +174,10 @@ async function main(argv) {
       } else if (hooks.statuslineManaged) {
         log.info(
           'behavior-hooks: runtime staged; Claude status line enabled at 0.0h; ' +
-          'prompt hooks remain opt-in via `skalpel setup`'
+          'prompt hooks activate automatically after `skalpel login`'
         );
       } else {
-        log.info('behavior-hooks: runtime staged; activation remains opt-in via `skalpel setup`');
+        log.info('behavior-hooks: runtime staged; hooks activate automatically after `skalpel login`');
       }
     } catch (err) {
       log.warn(`behavior-hooks: ${err.message}; continuing`);

package/postinstall/lib/prosumer-hooks.test.js

@@ -12,6 +12,7 @@ const { spawnSync } = require('child_process');
 
 const hooksLib = path.join(__dirname, 'prosumer-hooks.js');
 const statusline = path.resolve(__dirname, '..', '..', 'prosumer-hooks', 'skalpel-statusline.mjs');
+const bootstrap = path.resolve(__dirname, '..', '..', 'prosumer-hooks', 'bootstrap.mjs');
 const packageJson = path.resolve(__dirname, '..', '..', 'package.json');
 
 let pass = 0;
@@ -65,6 +66,11 @@ function settings(home) {
   return JSON.parse(fs.readFileSync(path.join(home, '.claude', 'settings.json'), 'utf8'));
 }
 
+function fakeJwt(claims) {
+  const encode = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
+  return `${encode({ alg: 'none' })}.${encode(claims)}.test-signature`;
+}
+
 function run() {
   process.stdout.write('prosumer-hooks tests:\n');
 
@@ -100,6 +106,49 @@ function run() {
     assert.ok(fs.existsSync(statusline), 'status-line source is missing from the packaged directory');
   });
 
+  test('graph bootstrap never owns or mutates behavior hooks', () => {
+    const home = tempHome({ claude: true });
+    try {
+      const configDir = path.join(home, '.config', 'skalpel');
+      fs.mkdirSync(configDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(configDir, 'auth.json'),
+        JSON.stringify({
+          subject: { user_id: 'user-123' },
+          cognito: {
+            id_token: fakeJwt({ sub: 'user-123', exp: 4_102_444_800 }),
+            refresh_token: 'unused',
+            expires_at: '2100-01-01T00:00:00Z',
+          },
+        }),
+      );
+      const result = spawnSync(process.execPath, [bootstrap], {
+        env: {
+          ...childEnv(home),
+          SKALPEL_CONFIG_DIR: configDir,
+          SKALPEL_USER: '',
+        },
+        encoding: 'utf8',
+        timeout: 10_000,
+      });
+      assert.strictEqual(result.status, 0, result.stderr);
+      const rows = result.stdout
+        .trim()
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => JSON.parse(line));
+      assert.ok(rows.some((row) => row.state === 'complete'), result.stdout);
+      assert.ok(!rows.some((row) => row.state === 'wiring'), result.stdout);
+      assert.strictEqual(
+        fs.existsSync(path.join(home, '.claude', 'settings.json')),
+        false,
+        'graph-only worker must not install hooks; successful login owns that mutation',
+      );
+    } finally {
+      fs.rmSync(home, { recursive: true, force: true });
+    }
+  });
+
   test('fresh npm-style staging registers only the Claude status line', () => {
     const home = tempHome({ claude: true });
     try {

package/prosumer-hooks/bootstrap.mjs

@@ -17,10 +17,8 @@ import {
   writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { basename, join } from "node:path";
 import { createInterface } from "node:readline";
-import { fileURLToPath } from "node:url";
-import { spawnSync } from "node:child_process";
 import { gzipSync } from "node:zlib";
 import { identity } from "./auth.mjs";
 import { recordInsight } from "./insights.mjs";
@@ -28,7 +26,6 @@ import { recordInsight } from "./insights.mjs";
 const DIR = join(homedir(), ".skalpel");
 const STATE_PATH = join(DIR, "bootstrap.json");
 const LOCK_PATH = join(DIR, "bootstrap.lock");
-const HERE = dirname(fileURLToPath(import.meta.url));
 const FORCE = process.argv.includes("--force");
 const LOOKBACK_DAYS = Math.max(1, Number.parseInt(process.env.SKALPEL_LOOKBACK_DAYS || "30", 10));
 const MIN_USER_TURNS = Math.max(
@@ -367,10 +364,6 @@ async function main() {
     return;
   }
 
-  emit("wiring", "Wiring hooks into Claude Code + Codex");
-  const wired = spawnSync(process.execPath, [join(HERE, "install.mjs")], { stdio: "ignore" });
-  if (wired.error || wired.status !== 0) throw new Error("could not activate coding-agent hooks");
-
   if (prior.user_id === auth.uid && prior.job_id && prior.state !== "done") {
     emit("resuming", "Resuming the existing graph build");
     const sessions = await pollJob(prior.job_id, auth.uid, auth.token);

package/prosumer-hooks/install.mjs

@@ -9,7 +9,8 @@ import { fileURLToPath } from "node:url";
 
 const uninstall = process.argv.includes("--uninstall");
 // npm postinstall uses this mode to make the local, read-only status indicator visible without
-// opting the user into prompt/session hooks. `skalpel setup` still runs the full installer.
+// opting the user into prompt/session hooks. A successful `skalpel login` runs the full installer;
+// `skalpel setup` remains an explicit repair path.
 const statuslineOnly = !uninstall && process.argv.includes("--statusline-only");
 
 // Where this installer's own files live — the globally-installed package, a source checkout, OR the
@@ -30,7 +31,7 @@ const STATUSLINE_FILE = join(HOOKS_DIR, "skalpel-statusline.mjs");
 // Copy the hook runtime (the two entrypoints + their shared auth.mjs) into ~/.skalpel/hooks so the
 // wired absolute path is always valid. Overwrites on every install so upgrades refresh the code.
 function stageHookRuntime() {
-  // `skalpel setup` invokes the already-staged copy. Avoid copying a file onto itself.
+  // Login and setup repair paths invoke the already-staged copy. Avoid copying a file onto itself.
   if (PKG_DIR === HOOKS_DIR) return;
   mkdirSync(HOOKS_DIR, { recursive: true });
   // insights.mjs is staged BEFORE the entrypoints that import it — a mid-copy ENOENT
@@ -358,7 +359,7 @@ if (statuslineOnly) {
   console.log(
     claudeResult === "preserved"
       ? "custom Claude status line preserved."
-      : "installed. Behavior hooks remain opt-in via `skalpel setup`.",
+      : "installed. Behavior hooks activate automatically after `skalpel login`.",
   );
 } else {
   console.log(