skalpel 3.4.19 → 4.0.0

package/README.md

@@ -1,51 +1,43 @@
 # skalpel
 
-Skalpel is the local proxy and terminal UI for coding agents — Cursor, Claude Code, Codex, and others. It runs as two binaries on your machine: `skalpel`, a Bubble Tea TUI configurator, and `skalpeld`, the local daemon that intercepts agent traffic, applies engines, and forwards to upstream providers. The two ship as a single npm package and are always installed together.
+Behavioral graph for AI-assisted coding. Learns how you work from your Claude Code + Codex history and
+steers the model in real time — off the loops, re-explains, and re-fixes that eat your day.
 
-## Install and first run
-
-After signing up at [skalpel.ai](https://skalpel.ai):
-
-```
-npx skalpel login
-```
-
-`npx skalpel login` materializes both binaries and runs a browser-loopback sign-in against Cognito. A successful login writes the Cognito JWT bundle, idempotently activates the managed Claude Code and Codex behavior hooks, and starts or resumes intent-graph learning; browser login then opens the TUI so progress is visible. To install persistently:
-
-```
+```bash
 npm install -g skalpel
+skalpel            # sign in with Google → build your graph → see your insights → you're live
 ```
 
-Both `skalpel` and `skalpeld` are placed on your `PATH`. Then run:
+## What it does
 
-```
-skalpel
-```
+- **`skalpel`** (or the postinstall nudge) runs the onboarding: red-banner wordmark → **Sign in with
+  Google** (AWS-hosted, no localhost) → **builds your graph** (async, live progress) → **reveals your
+  insights** (your hours, rework %, signature trap, biggest time-sink) → wires the hooks → you're live.
+- After that, every prompt in Claude Code / Codex pulls your own behavioral graph via a fast hook, and a
+  status line shows time saved. Silent when it has nothing to say.
 
-to open the guided first-run walkthrough (brand banner, step-by-step setup, sign-in handoff, and toggle tips).
+## Architecture (pure node — no daemon, no binary)
 
-Note: npm may hide lifecycle-script output; if you want to see install wizard logs during `npm install`, use:
+The client is ~30-line hooks that call the **hosted graph** (`graph.skalpel.ai`, a Python engine on
+AWS). No engine, no Python, no per-OS binary on your machine — it rides Claude Code's own Node runtime,
+so it's cross-platform for free. This supersedes the retired Go daemon client (`skalpeld`); the
+postinstall retires any leftover daemon on upgrade.
 
-```
-npm install -g skalpel --foreground-scripts
-```
+- `skalpel-setup.mjs` — the `skalpel` bin: the onboarding flow.
+- `login.mjs` — Google sign-in via the AWS-hosted OAuth callback.
+- `install.mjs` — wires the hooks into Claude Code + Codex (idempotent, non-clobbering).
+- `skalpel-hook.mjs` / `skalpel-hook-session.mjs` — the per-turn + session hooks.
+- `skalpel-statusline.mjs` — the status line.
+- `auth.mjs` — refresh-capable identity (Google id_token, refreshed through AWS).
 
-For details on what gets installed where, per-OS service registration, updates, and uninstall, see [INSTALL.md](./INSTALL.md).
+## Auth
 
-## Subcommands
+Google OAuth, brokered entirely through AWS: the browser redirects to `graph.skalpel.ai/oauth/callback`,
+the server exchanges the code (holding the client secret), and the CLI polls for the finished token. The
+Google client secret never ships in the package.
 
-`skalpel` accepts a small set of subcommands:
+## Uninstall
 
-- `skalpel` — launch the Bubble Tea TUI (default).
-- `skalpel login` — sign in, heal behavior hooks, and start/resume intent-graph learning.
-- `skalpel setup` — repair optional external-shell wrappers and behavior hooks; not required for normal login/TUI onboarding.
-- `skalpel logout` — revoke the active session (best-effort) and delete `auth.json`; supports `--yes` to skip the `[y/N]` confirm.
-- `skalpel uninstall` — clean up skalpel state on this machine.
-- `skalpel --version` / `skalpel --help` — utilities.
-
-## Links
-
-- Homepage: https://skalpel.ai
-- Documentation: see `INSTALL.md` and `SPEC.md` in this repo
-- Issues: https://github.com/skalpelai/Skalpelai_Client/issues
-- License: Apache-2.0 (see [LICENSE](./LICENSE))
+```bash
+skalpel uninstall     # removes the hooks from Claude Code + Codex
+```

package/auth.mjs

@@ -0,0 +1,179 @@
+// auth.mjs - shared hosted-hook identity from the canonical skalpel CLI login.
+// There is deliberately no hook-owned auth file and no Supabase fallback: `skalpel login`
+// is the only account plane for the globally installed product.
+import { readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const DASHBOARD_API = process.env.SKALPEL_DASHBOARD_API || "https://cli.skalpel.ai";
+const REFRESH_TIMEOUT_MS = 2000;
+// Direct Cognito refresh (public app client — no secret). The old `${DASHBOARD_API}/v1/auth/refresh`
+// route is gone (404s), which silently expired every hook; refresh straight against Cognito instead.
+const COGNITO_TOKEN_URL =
+  process.env.SKALPEL_COGNITO_TOKEN_URL ||
+  "https://skalpel-prod.auth.us-west-2.amazoncognito.com/oauth2/token";
+const COGNITO_CLIENT_ID = process.env.SKALPEL_COGNITO_CLIENT_ID || "2gfil041fv9u58jemc7l5u2pht";
+const GRAPH_API = process.env.SKALPEL_API || "https://graph.skalpel.ai";
+
+function cliAuthPath() {
+  if (process.env.SKALPEL_CONFIG_DIR) return join(process.env.SKALPEL_CONFIG_DIR, "auth.json");
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA || join(homedir(), "AppData", "Roaming");
+    return join(appData, "skalpel", "auth.json");
+  }
+  if (process.platform === "darwin") {
+    return join(homedir(), "Library", "Application Support", "skalpel", "auth.json");
+  }
+  const configHome = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(configHome, "skalpel", "auth.json");
+}
+
+function loadCliAuth() {
+  try {
+    const auth = JSON.parse(readFileSync(cliAuthPath(), "utf8"));
+    const hasGoogle = typeof auth?.google?.id_token === "string" && auth.google.id_token;
+    const hasCognito = typeof auth?.cognito?.id_token === "string" && auth.cognito.id_token;
+    return hasGoogle || hasCognito ? auth : null;
+  } catch {
+    return null;
+  }
+}
+
+// Refresh a Google id_token THROUGH the graph service (server holds the client secret) — the CLI
+// never ships a Google secret. Returns { id_token, expires_in } or null.
+async function googleRefresh(refreshToken) {
+  if (!refreshToken) return null;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), REFRESH_TIMEOUT_MS);
+  try {
+    const r = await fetch(`${GRAPH_API}/oauth/refresh`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ refresh_token: refreshToken }),
+      signal: ctrl.signal,
+    });
+    if (!r.ok) return null;
+    const t = await r.json();
+    return t && typeof t.id_token === "string" ? t : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function decodeJwtPayload(token) {
+  try {
+    const part = token.split(".")[1];
+    const padded = part + "=".repeat((4 - (part.length % 4)) % 4);
+    return JSON.parse(
+      Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(),
+    );
+  } catch {
+    return null;
+  }
+}
+
+function toEpochSeconds(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value > 1e12 ? Math.floor(value / 1000) : value;
+  }
+  if (typeof value === "string") {
+    const millis = Date.parse(value);
+    return Number.isFinite(millis) ? Math.floor(millis / 1000) : null;
+  }
+  return null;
+}
+
+async function refreshTokens(refreshToken) {
+  if (!refreshToken) return null;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), REFRESH_TIMEOUT_MS);
+  try {
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: COGNITO_CLIENT_ID,
+      refresh_token: refreshToken,
+    });
+    const response = await fetch(COGNITO_TOKEN_URL, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body,
+      signal: ctrl.signal,
+    });
+    if (!response.ok) return null;
+    const t = await response.json();
+    return t && typeof t.access_token === "string" ? t : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// Persist a refreshed token set back into auth.json so the next hook reuses it instead of
+// re-refreshing every turn. Best-effort — a write failure never blocks the hook.
+function persistTokens(auth, t) {
+  try {
+    auth.cognito = {
+      ...auth.cognito,
+      access_token: t.access_token,
+      id_token: t.id_token || auth.cognito.id_token,
+      expires_at: new Date(Date.now() + (Number(t.expires_in) || 3600) * 1000).toISOString(),
+    };
+    writeFileSync(cliAuthPath(), JSON.stringify(auth));
+  } catch {
+    /* never block on a persist failure */
+  }
+}
+
+export async function identity() {
+  if (process.env.SKALPEL_USER) return { uid: process.env.SKALPEL_USER, token: null };
+
+  const auth = loadCliAuth();
+  if (!auth) return { uid: null, token: null };
+
+  // Google is the account plane (from `skalpel login`). Send the Google id_token; the server verifies
+  // it (aud-pinned) and keys the graph by the verified email. Refresh through AWS (/oauth/refresh) so
+  // no Google secret ever ships in the hook.
+  if (auth.google?.id_token) {
+    let idt = auth.google.id_token;
+    const gexp = toEpochSeconds(auth.google.expires_at) ?? decodeJwtPayload(idt)?.exp ?? null;
+    if (gexp !== null && gexp - Math.floor(Date.now() / 1000) < 60) {
+      const t = await googleRefresh(auth.google.refresh_token);
+      if (t) {
+        idt = t.id_token;
+        try {
+          auth.google.id_token = idt;
+          auth.google.expires_at = new Date(
+            Date.now() + (Number(t.expires_in) || 3600) * 1000,
+          ).toISOString();
+          writeFileSync(cliAuthPath(), JSON.stringify(auth));
+        } catch {
+          /* never block on persist */
+        }
+      } else {
+        idt = null; // refresh failed — fall through to the Cognito bridge
+      }
+    }
+    if (idt) {
+      const uid = auth.google.sub || auth.google.email || decodeJwtPayload(idt)?.sub || null;
+      return { uid, token: idt };
+    }
+  }
+
+  // The hosted graph verifies the ACCESS token (Cognito /oauth2/userInfo -> email; an id_token is
+  // rejected there). Send the access token; the server keys the graph by the verified email.
+  let access = auth.cognito.access_token;
+  const claims = decodeJwtPayload(access);
+  const expiresAt = toEpochSeconds(auth.cognito.expires_at) ?? claims?.exp ?? null;
+  if (!access || (expiresAt !== null && expiresAt - Math.floor(Date.now() / 1000) < 60)) {
+    const t = await refreshTokens(auth.cognito.refresh_token);
+    if (!t) return { uid: null, token: null };
+    access = t.access_token;
+    persistTokens(auth, t);
+  }
+
+  const uid = decodeJwtPayload(access)?.sub ?? auth.subject?.user_id ?? null;
+  return uid ? { uid, token: access } : { uid: null, token: null };
+}

package/{prosumer-hooks/bootstrap.mjs → bootstrap.mjs}

@@ -29,10 +29,7 @@ const STATE_PATH = join(DIR, "bootstrap.json");
 const LOCK_PATH = join(DIR, "bootstrap.lock");
 const FORCE = process.argv.includes("--force");
 const LOOKBACK_DAYS = Math.max(1, Number.parseInt(process.env.SKALPEL_LOOKBACK_DAYS || "30", 10));
-const MIN_USER_TURNS = Math.max(
-  1,
-  Number.parseInt(process.env.SKALPEL_MIN_USER_TURNS || "5", 10),
-);
+const MIN_USER_TURNS = Math.max(1, Number.parseInt(process.env.SKALPEL_MIN_USER_TURNS || "5", 10));
 const MAX_SESSIONS = Math.max(
   1,
   Number.parseInt(process.env.SKALPEL_MAX_UPLOAD_SESSIONS || "20", 10),
@@ -443,13 +440,17 @@ async function ingestAndFinish(files, auth, runStartMs) {
     sessions,
     last_ingest_at: new Date(runStartMs).toISOString(),
   });
-  emit("complete", `Learned from ${sessions} session${sessions === 1 ? "" : "s"}`, { terminal: true, sessions });
+  emit("complete", `Learned from ${sessions} session${sessions === 1 ? "" : "s"}`, {
+    terminal: true,
+    sessions,
+  });
   return sessions;
 }
 
 async function main() {
   const auth = await identity();
-  if (!auth.uid || !auth.token) throw new Error("sign in with `skalpel login` before learning history");
+  if (!auth.uid || !auth.token)
+    throw new Error("sign in with `skalpel login` before learning history");
 
   const prior = readState();
   const runStartMs = Date.now();
@@ -488,7 +489,10 @@ async function main() {
       sessions,
       last_ingest_at: new Date(runStartMs).toISOString(),
     });
-    emit("complete", `Learned from ${sessions} session${sessions === 1 ? "" : "s"}`, { terminal: true, sessions });
+    emit("complete", `Learned from ${sessions} session${sessions === 1 ? "" : "s"}`, {
+      terminal: true,
+      sessions,
+    });
     return;
   }
 
@@ -522,7 +526,9 @@ async function run() {
   await main()
     .catch((error) => {
       const prior = readState();
-      const message = String(error?.message || error).replace(/[\r\n\t]+/g, " ").slice(0, 240);
+      const message = String(error?.message || error)
+        .replace(/[\r\n\t]+/g, " ")
+        .slice(0, 240);
       writeState({ ...prior, state: "failed", error: message });
       emit("failed", message, {
         terminal: true,

package/{prosumer-hooks/incremental-ingest.mjs → incremental-ingest.mjs}

@@ -137,7 +137,10 @@ function writeLedger(home, ledger) {
   const entries = Object.entries(ledger.keys || {})
     .sort((a, b) => String(b[1]).localeCompare(String(a[1])))
     .slice(0, MAX_DELIVERED_KEYS);
-  writeAtomic(join(outboxDir(home), LEDGER_FILE), { version: 1, keys: Object.fromEntries(entries) });
+  writeAtomic(join(outboxDir(home), LEDGER_FILE), {
+    version: 1,
+    keys: Object.fromEntries(entries),
+  });
 }
 
 function markDelivered(home, item, now) {
@@ -232,15 +235,7 @@ function scheduleTerminalRetry(home, item, status, now, insightFn) {
 }
 
 async function pollAcceptedJob(home, item, auth, options, deadline) {
-  const {
-    api,
-    fetchFn,
-    insightFn,
-    now,
-    pollIntervalMs,
-    requestTimeoutMs,
-    sleepFn,
-  } = options;
+  const { api, fetchFn, insightFn, now, pollIntervalMs, requestTimeoutMs, sleepFn } = options;
   const statusURL = `${api}/ingest/status?job_id=${encodeURIComponent(item.job_id)}`;
   for (;;) {
     let response;

package/{prosumer-hooks/install.mjs → install.mjs}

@@ -72,8 +72,7 @@ const sessionEndRuntime =
   process.env.SKALPEL_HOOK_BIN && PKG_DIR !== HOOKS_DIR
     ? join(PKG_DIR, "skalpel-hook-session-end.mjs")
     : SESSION_END_FILE;
-const SESSION_END_CMD =
-  process.env.SKALPEL_HOOK_SESSION_END_BIN || `node ${sessionEndRuntime}`;
+const SESSION_END_CMD = process.env.SKALPEL_HOOK_SESSION_END_BIN || `node ${sessionEndRuntime}`;
 const STATUSLINE_CMD = process.env.SKALPEL_STATUSLINE_BIN || `node ${STATUSLINE_FILE}`;
 const CLAUDE = join(homedir(), ".claude", "settings.json");
 const CODEX_DIR = join(homedir(), ".codex");
@@ -93,10 +92,7 @@ const HOOKS = [
 // Claude Code supports a once-per-session SessionEnd event and native background command hooks.
 // Codex currently supports neither SessionEnd nor async command hooks, so its honest fallback is
 // the existing next-launch history scan; do not write an inert Codex hook and claim parity.
-const CLAUDE_HOOKS = [
-  ...HOOKS,
-  ["SessionEnd", markerOf(SESSION_END_CMD), SESSION_END_CMD],
-];
+const CLAUDE_HOOKS = [...HOOKS, ["SessionEnd", markerOf(SESSION_END_CMD), SESSION_END_CMD]];
 
 function readJson(p) {
   let raw;
@@ -357,9 +353,10 @@ function claudeMd() {
     const startIdx = stripped.indexOf(start);
     const endIdx = stripped.indexOf(end);
     if (startIdx !== -1 && endIdx !== -1 && endIdx >= startIdx) {
-      stripped = (
-        stripped.slice(0, startIdx) + stripped.slice(endIdx + end.length)
-      ).replace(/\n{3,}/g, "\n\n");
+      stripped = (stripped.slice(0, startIdx) + stripped.slice(endIdx + end.length)).replace(
+        /\n{3,}/g,
+        "\n\n",
+      );
       had = true;
     }
   }

package/login.mjs

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+// skalpel login — Sign in with Google, fully through AWS (no localhost).
+//   this CLI → browser → Google → https://graph.skalpel.ai/oauth/callback (AWS) → we poll AWS for
+//   the token → save it. The server holds the client secret and does the code exchange; we only ever
+//   see the finished Google id_token. Branded onboarding reproduces the original prosumer `setup.mjs`
+//   red block wordmark 1:1. Run: `node skalpel-login.mjs`.
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+
+const API = process.env.SKALPEL_API || "https://graph.skalpel.ai";
+const CLIENT_ID =
+  process.env.SKALPEL_GOOGLE_CLIENT_ID ||
+  "717225126942-6kp72hm7snalbvi3fgl5llmsshm0c8o2.apps.googleusercontent.com";
+const REDIRECT_URI = `${API}/oauth/callback`;
+const SCOPE = "openid email profile";
+
+// ── brand (from the original prosumer setup.mjs — 1:1) ────────────────────
+const R = "\x1b[38;2;233;38;31m", // skalpel red
+  G = "\x1b[38;2;124;184;108m", // success green
+  D = "\x1b[2m",
+  B = "\x1b[1m",
+  X = "\x1b[0m";
+const isTTY = process.stdout.isTTY && !process.env.CI;
+
+function banner() {
+  console.log(`
+${R}   ███████╗██╗  ██╗ █████╗ ██╗     ██████╗ ███████╗██╗
+   ██╔════╝██║ ██╔╝██╔══██╗██║     ██╔══██╗██╔════╝██║
+   ███████╗█████╔╝ ███████║██║     ██████╔╝█████╗  ██║
+   ╚════██║██╔═██╗ ██╔══██║██║     ██╔═══╝ ██╔══╝  ██║
+   ███████║██║  ██╗██║  ██║███████╗██║     ███████╗███████╗
+   ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝     ╚══════╝╚══════╝${X}`);
+  console.log(`\n   ${D}your AI coding sessions, learned — and steered in real time${X}\n`);
+}
+
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+
+function authPath() {
+  if (process.env.SKALPEL_CONFIG_DIR) return join(process.env.SKALPEL_CONFIG_DIR, "auth.json");
+  if (process.platform === "win32")
+    return join(
+      process.env.APPDATA || join(homedir(), "AppData", "Roaming"),
+      "skalpel",
+      "auth.json",
+    );
+  if (process.platform === "darwin")
+    return join(homedir(), "Library", "Application Support", "skalpel", "auth.json");
+  return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "skalpel", "auth.json");
+}
+
+function openBrowser(url) {
+  const cmd =
+    process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    spawn(cmd, [url], {
+      stdio: "ignore",
+      detached: true,
+      shell: process.platform === "win32",
+    }).unref();
+  } catch {
+    /* manual-paste fallback below */
+  }
+}
+
+function decodeJwt(token) {
+  try {
+    const p = token.split(".")[1];
+    const padded = p + "=".repeat((4 - (p.length % 4)) % 4);
+    return JSON.parse(
+      Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(),
+    );
+  } catch {
+    return {};
+  }
+}
+
+async function main() {
+  banner();
+  const state = randomBytes(32).toString("hex");
+  const authUrl =
+    `https://accounts.google.com/o/oauth2/v2/auth?` +
+    new URLSearchParams({
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT_URI,
+      response_type: "code",
+      scope: SCOPE,
+      state,
+      access_type: "offline",
+      prompt: "consent",
+      include_granted_scopes: "true",
+    }).toString();
+
+  console.log(`   ${B}Sign in with Google${X}${D} — opening your browser…${X}`);
+  console.log(`   ${D}if it doesn't open, paste this:${X}`);
+  console.log(`   ${D}${authUrl}${X}\n`);
+  openBrowser(authUrl);
+
+  // Poll the AWS callback store for our state until the token lands (or ~3 min), red spinner.
+  if (isTTY) process.stdout.write("\x1b[?25l"); // hide cursor
+  const deadline = Date.now() + 180_000;
+  let payload = null;
+  let i = 0;
+  while (Date.now() < deadline) {
+    if (isTTY)
+      process.stdout.write(
+        `\r\x1b[2K   ${R}${FRAMES[i++ % FRAMES.length]}${X} waiting for sign-in…`,
+      );
+    await new Promise((r) => setTimeout(r, 250));
+    if (i % 8 !== 0) continue; // spin ~250ms, poll ~2s
+    try {
+      const r = await fetch(`${API}/oauth/token?state=${encodeURIComponent(state)}`);
+      if (r.ok) {
+        const j = await r.json();
+        if (j && j.id_token) {
+          payload = j;
+          break;
+        }
+      }
+    } catch {
+      /* transient — keep polling */
+    }
+  }
+  if (isTTY) process.stdout.write(`\r\x1b[2K`);
+  if (!payload) {
+    console.log(
+      `   ${R}✗${X} timed out waiting for sign-in. Run \`skalpel login\` again.${isTTY ? "\x1b[?25h" : ""}`,
+    );
+    process.exit(1);
+  }
+
+  const claims = decodeJwt(payload.id_token);
+  const p = authPath();
+  mkdirSync(dirname(p), { recursive: true });
+  let auth = {};
+  try {
+    auth = JSON.parse(readFileSync(p, "utf8"));
+  } catch {
+    /* fresh */
+  }
+  auth.google = {
+    id_token: payload.id_token,
+    refresh_token: payload.refresh_token || auth.google?.refresh_token || null,
+    expires_at: new Date(Date.now() + (Number(payload.expires_in) || 3600) * 1000).toISOString(),
+    email: claims.email || null,
+    sub: claims.sub || null,
+  };
+  auth.subject = { ...(auth.subject || {}), email: claims.email || auth.subject?.email };
+  writeFileSync(p, JSON.stringify(auth, null, 2));
+
+  console.log(`   ${G}✓${X} signed in as ${B}${claims.email || "your Google account"}${X}`);
+  console.log(`   ${G}✓${X} skalpel is live`);
+  console.log(
+    `   ${D}your next Claude Code prompt is steered by your own behavioral graph${X}\n${isTTY ? "\x1b[?25h" : ""}`,
+  );
+  process.exit(0);
+}
+
+main().catch((e) => {
+  console.log(`   ${R}✗${X} login error: ${D}${e?.message || String(e)}${X}\x1b[?25h`);
+  process.exit(1);
+});

package/package.json

@@ -1,68 +1,28 @@
 {
   "name": "skalpel",
-  "version": "3.4.19",
-  "description": "Skalpel — local proxy and TUI for coding agents (skalpel + skalpeld bundle).",
-  "license": "Apache-2.0",
-  "homepage": "https://skalpel.ai",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/skalpelai/Skalpelai_Client.git"
-  },
-  "bugs": {
-    "url": "https://github.com/skalpelai/Skalpelai_Client/issues"
-  },
-  "author": "SkalpelAI Inc.",
-  "keywords": [
-    "coding-agent",
-    "proxy",
-    "tui",
-    "claude",
-    "cursor",
-    "codex"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
+  "version": "4.0.0",
+  "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
+  "type": "module",
   "bin": {
-    "skalpel": "npm-bin/skalpel.js",
-    "skalpeld": "npm-bin/skalpeld.js"
+    "skalpel": "skalpel-setup.mjs"
   },
   "scripts": {
-    "preinstall": "node postinstall/preinstall.js",
-    "postinstall": "node postinstall/index.js",
-    "preuninstall": "node postinstall/uninstall.js",
-    "test": "node postinstall/lib/run-tests.js && node npm-bin/skalpel.bug-0039.test.js",
-    "test:rc-edit": "node postinstall/lib/rc-edit.test.js",
-    "test:postinstall": "node --test postinstall/index.test.js",
-    "test:preinstall": "node --test postinstall/preinstall.test.js",
-    "test:bug-0039": "node npm-bin/skalpel.bug-0039.test.js"
+    "postinstall": "node postinstall.mjs || true"
   },
   "files": [
-    "npm-bin/",
-    "postinstall/",
-    "prosumer-hooks/",
-    "design-tokens.json",
-    "INSTALL.md",
-    "README.md",
-    "LICENSE"
+    "*.mjs",
+    "README.md"
   ],
-  "dependencies": {
-    "picocolors": "^1.1.1"
+  "engines": {
+    "node": ">=18"
   },
-  "os": [
-    "darwin",
-    "linux",
-    "win32"
-  ],
-  "cpu": [
-    "arm64",
-    "x64"
+  "keywords": [
+    "claude-code",
+    "codex",
+    "ai",
+    "productivity",
+    "behavioral-analytics"
   ],
-  "optionalDependencies": {
-    "@skalpelai/skalpel-darwin-arm64": "3.4.19",
-    "@skalpelai/skalpel-darwin-x64": "3.4.19",
-    "@skalpelai/skalpel-linux-arm64": "3.4.19",
-    "@skalpelai/skalpel-linux-x64": "3.4.19",
-    "@skalpelai/skalpel-win32-x64": "3.4.19"
-  }
+  "license": "UNLICENSED",
+  "homepage": "https://skalpel.ai"
 }