skalpel 3.4.19 → 4.0.0

package/postinstall/index.js

@@ -1,277 +0,0 @@
-#!/usr/bin/env node
-// Postinstall wizard.
-//
-// 5-step flow per SPEC.md §9.6:
-//   1. detect-prior — probe configDir for prior install
-//   2. sign-in     — `skalpel login` (or hint to run it)
-//   3. service-register — render + load launchd / systemd / Task
-//   4. env-inject  — managed-block edit of shell rc files
-//   5. launch      — print next-step hint
-//
-// Dry-run: SKALPEL_INSTALL_DRY_RUN=1 (env) or --dry-run (argv) makes
-// the wizard log every action it would take and write nothing.
-//
-// Idempotence: the wizard is safe to re-run. Each step replaces or
-// skips rather than duplicating.
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-
-const colors = require('../npm-bin/colors');
-const log = require('./lib/log');
-const paths = require('./lib/paths');
-const detectPrior = require('./lib/detect-prior');
-const signIn = require('./lib/sign-in');
-const serviceRegister = require('./lib/service-register');
-const envInject = require('./lib/env-inject');
-const launch = require('./lib/launch');
-const caInstall = require('./lib/ca-install');
-const prosumerHooks = require('./lib/prosumer-hooks');
-
-function printStyledSuccess() {
-  if (!process.stdout.isTTY) return;
-  const colored = !process.env.NO_COLOR;
-  const platformLabel = `${process.platform}-${process.arch}`;
-  const check = colored ? colors.theme.mint('✓') : '✓';
-  const text = colored
-    ? colors.theme.text(` skalpel installed for ${platformLabel}`)
-    : ` skalpel installed for ${platformLabel}`;
-  process.stdout.write(`${check}${text}\n`);
-}
-
-function parseArgs(argv) {
-  const out = {
-    dryRun: false,
-    skipBundle: false,
-    verbose: false,
-  };
-  for (const a of argv.slice(2)) {
-    switch (a) {
-      case '--dry-run':
-        out.dryRun = true;
-        break;
-      case '--verbose':
-        out.verbose = true;
-        break;
-      case '--skip-bundle':
-        out.skipBundle = true;
-        break;
-      case '--help':
-      case '-h':
-        out.help = true;
-        break;
-      default:
-        // Unknown args are ignored for npm-postinstall robustness;
-        // the user's npm CLI may pass extra flags.
-        break;
-    }
-  }
-  if (process.env.SKALPEL_INSTALL_DRY_RUN === '1') {
-    out.dryRun = true;
-  }
-  return out;
-}
-
-function helpText() {
-  return [
-    'skalpel postinstall wizard',
-    '',
-    'usage: node postinstall/index.js [--dry-run] [--verbose]',
-    '',
-    'Run automatically by npm install. The wizard performs:',
-    '  1. detect-prior          probe configDir for an existing install',
-    '  2. behavior-hooks        stage the local graph hook runtime',
-    '  3. sign-in               start `skalpel login` (or hint at it)',
-    '  4. service-register      register the per-OS daemon entry',
-    '  5. ca-install            install the local interception CA',
-    '  6. shell-activation      defer wrapping until `skalpel setup`',
-    '  7. launch                print the run-skalpel hint',
-    '',
-    'Uninstall is owned by the Go binary now — run `skalpel uninstall`',
-    'or `npx skalpel uninstall` to reverse this wizard.',
-    '',
-    'Dry-run mode (SKALPEL_INSTALL_DRY_RUN=1 or --dry-run) makes every',
-    'step log what it would do and write nothing.',
-  ].join('\n');
-}
-
-async function runCAInstallStep(opts) {
-  // Resolve CA path by spawning the just-installed `skalpel ca-path`.
-  // (The Go binary is on PATH by the time postinstall runs; see
-  // npm-bin/skalpel.js for the resolver.)
-  const cp = require('child_process');
-  let caPath = '';
-  try {
-    const out = cp.spawnSync('skalpel', ['ca-path'], {
-      stdio: ['ignore', 'pipe', 'pipe'],
-      timeout: 5_000,
-    });
-    if (out.status === 0) {
-      caPath = String(out.stdout || '').trim();
-    }
-  } catch (_) {
-    // ignored — fall through to deferred-no-ca branch
-  }
-  if (!caPath) {
-    log.warn('ca-install: could not resolve `skalpel ca-path`; deferring trust-store install to first login');
-    return { ok: false, reason: 'no-binary' };
-  }
-  if (opts.dryRun) {
-    log.info(`ca-install: dry-run; would install ${caPath} into OS trust store`);
-    return { ok: true, skipped: true, reason: 'dry-run' };
-  }
-  return caInstall.installDaemonCA(caPath);
-}
-
-async function main(argv) {
-  const opts = parseArgs(argv);
-  if (opts.help) {
-    process.stdout.write(`${helpText()}\n`);
-    return 0;
-  }
-
-  // npx mode: skip the install wizard. The wizard's service-register
-  // step would bake the npx cache path (~/.npm/_npx/<hash>/...) into
-  // the OS service unit, and that path is evicted by npx's cache GC.
-  // Exit 0 instead of 1 so npm install completes and the binary
-  // becomes invokable. (Uninstall is owned by the Go binary now and
-  // is unaffected.)
-  if (paths.isNpxInvocation()) {
-    log.info(
-      'npx mode detected — skipping install wizard (service-register / ' +
-      'env-inject would bake transient npx cache paths into your system).'
-    );
-    log.info(
-      'For a persistent install with daemon-on-boot and shell env vars, ' +
-      'run: `npm install -g skalpel`'
-    );
-    return 0;
-  }
-
-  const total = 7;
-  const mode = opts.dryRun ? 'dry-run' : 'live';
-  log.info(`postinstall wizard starting (${mode} install) on ${process.platform}`);
-
-  // B28: classify failures. Critical = re-throw and exit 0 (we do
-  // not want npm install to abort, but the operator should know).
-  // Warning = collect and log at end.
-  const allWarnings = [];
-
-  let prior = false;
-  let critical = null;
-  try {
-    log.step(1, total, 'detect-prior', 'probing configDir');
-    const r = detectPrior.run({ dryRun: opts.dryRun });
-    prior = r.prior;
-
-    log.step(2, total, 'behavior-hooks', 'staging CLI-owned runtime');
-    try {
-      const hooks = prosumerHooks.stageAndHeal({ dryRun: opts.dryRun });
-      if (hooks.healed) {
-        log.info('behavior-hooks: refreshed an existing skalpel hook installation');
-      } else if (hooks.statuslineManaged) {
-        log.info(
-          'behavior-hooks: runtime staged; Claude status line enabled at 0.0h; ' +
-          'prompt hooks activate automatically after `skalpel login`'
-        );
-      } else {
-        log.info('behavior-hooks: runtime staged; hooks activate automatically after `skalpel login`');
-      }
-    } catch (err) {
-      log.warn(`behavior-hooks: ${err.message}; continuing`);
-      allWarnings.push(`behavior-hooks: ${err.message}`);
-    }
-
-    log.step(3, total, 'sign-in', prior ? 'skipping (prior auth)' : 'browser flow');
-    // sign-in is non-critical: a missing dispatcher / login failure
-    // is recoverable — user can run `skalpel login` later.
-    try {
-      const sr = signIn.run({ dryRun: opts.dryRun, prior });
-      if (sr && sr.error) {
-        allWarnings.push(`sign-in: ${sr.error}`);
-      }
-    } catch (err) {
-      log.warn(`sign-in: ${err.message}; continuing`);
-      allWarnings.push(`sign-in: ${err.message}`);
-    }
-
-    log.step(4, total, 'service-register', `OS=${process.platform}`);
-    // service-register is critical: a stale service unit is a real
-    // problem at boot. Errors propagate to the catch block below.
-    const sr = serviceRegister.run({ dryRun: opts.dryRun }) || {};
-    if (Array.isArray(sr.warnings) && sr.warnings.length) {
-      allWarnings.push(...sr.warnings);
-    }
-
-    log.step(5, total, 'ca-install', `trust store on ${process.platform}`);
-    // ca-install is NON-CRITICAL: declined prompts or missing sudo must NOT
-    // fail postinstall. The deferred-install sentinel ensures first
-    // `skalpel login` / `codex` invocation retries the trust install.
-    try {
-      const caRes = await runCAInstallStep(opts);
-      if (caRes && !caRes.ok && caRes.reason) {
-        allWarnings.push(`ca-install: ${caRes.reason}`);
-      }
-    } catch (err) {
-      log.warn(`ca-install: ${err.message}; continuing`);
-      allWarnings.push(`ca-install: ${err.message}`);
-    }
-
-    // Step 5 — shell activation is OPT-IN (incident 2026-07-05). A global
-    // `npm install -g skalpel` must NOT modify the user's shell rc files. That
-    // was the blast radius of the incident: the managed block exported
-    // ANTHROPIC_BASE_URL into every shell and broke Claude Code, and even a
-    // poison-free wrapper is too invasive to write into a user's shell without
-    // consent for an agent harness. The daemon registered in step 3 sits IDLE
-    // and intercepts nothing until the user explicitly opts in with
-    // `skalpel setup`, which wraps the detected agents (setupCore -> the same
-    // managed block, now poison-free). Set SKALPEL_ACTIVATE_SHELL=1 to restore
-    // the old auto-wrap-on-install behavior.
-    if (process.env.SKALPEL_ACTIVATE_SHELL === '1') {
-      log.step(6, total, 'env-inject', 'managed-block edit per shell (SKALPEL_ACTIVATE_SHELL=1)');
-      envInject.run({ dryRun: opts.dryRun });
-    } else {
-      log.step(6, total, 'shell-activation', 'deferred — opt-in via `skalpel setup`');
-      log.info('Shell integration is opt-in. Run `skalpel setup` to route Claude/Codex through skalpel.');
-    }
-
-    log.step(7, total, 'launch', 'next-step hint');
-    launch.run({ dryRun: opts.dryRun });
-  } catch (err) {
-    critical = err;
-    log.error(`postinstall failed: ${err.message}`);
-    if (opts.verbose) {
-      process.stderr.write(`${err.stack}\n`);
-    }
-  }
-
-  if (allWarnings.length) {
-    log.warn(`postinstall wizard finished (${mode}) with ${allWarnings.length} warning(s):`);
-    for (const w of allWarnings) {
-      log.warn(`  - ${w}`);
-    }
-  } else if (!critical) {
-    log.info(`postinstall wizard finished (${mode})`);
-    if (!opts.dryRun) {
-      printStyledSuccess();
-    }
-  }
-  // Always exit 0 so npm install does not abort. The user can
-  // re-run `skalpel install` if a critical step failed.
-  return 0;
-}
-
-if (require.main === module) {
-  Promise.resolve(main(process.argv)).then(
-    (code) => process.exit(code || 0),
-    (err) => {
-      log.error(`postinstall crashed: ${err && err.stack ? err.stack : err}`);
-      // Wizard contract: exit 0 even on crash so npm install never aborts.
-      process.exit(0);
-    }
-  );
-}
-
-module.exports = { main, parseArgs };

package/postinstall/index.test.js

@@ -1,147 +0,0 @@
-#!/usr/bin/env node
-// Postinstall wizard regression — exercises the entry-point shipped
-// to every `npm install skalpel` user. Tests run under Node's built-in
-// `node --test` runner (stdlib only; matches the convention set by
-// postinstall/lib/rc-edit.test.js).
-//
-// Scope (closes GAP-5):
-//   - parseArgs maps flags, env-var dry-run, and help correctly
-//   - dry-run install completes with exit 0 and writes nothing
-//   - re-running dry-run install is idempotent (no observable drift)
-//   - --help returns 0 and prints usage
-//
-// We exercise the wizard as a child process so the existing entry-
-// point IIFE in index.js does not need to be refactored; tests stay
-// hermetic by setting SKALPEL_INSTALL_DRY_RUN=1 and forcing all
-// service / rc paths to writable t.TempDir() so a regression cannot
-// touch a developer's real shell rc.
-
-'use strict';
-
-const { test } = require('node:test');
-const assert = require('node:assert/strict');
-const { spawnSync } = require('node:child_process');
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-
-const indexPath = path.join(__dirname, 'index.js');
-
-function mkTempEnv() {
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'skalpel-postinstall-test-'));
-  const xdgConfig = path.join(home, '.config');
-  fs.mkdirSync(xdgConfig, { recursive: true });
-  return {
-    HOME: home,
-    USERPROFILE: home,
-    XDG_CONFIG_HOME: xdgConfig,
-    SKALPEL_INSTALL_DRY_RUN: '1',
-    SKALPEL_BIN_DIR: path.join(home, 'bin'),
-    NO_COLOR: '1',
-    PATH: process.env.PATH || '',
-    // Force npx detection off so the wizard reaches its full step
-    // sequence rather than short-circuiting.
-    npm_config_user_agent: 'npm/test',
-  };
-}
-
-function runWizard(extraArgs = []) {
-  const env = mkTempEnv();
-  return spawnSync(process.execPath, [indexPath, ...extraArgs], {
-    env,
-    encoding: 'utf8',
-    timeout: 15_000,
-  });
-}
-
-test('parseArgs maps short and long flags', () => {
-  // require()-time evaluation must not run the IIFE: index.js gates
-  // it with `if (require.main === module)`, so require() is safe.
-  const mod = require('./index');
-  assert.equal(typeof mod.parseArgs, 'function', 'parseArgs export missing');
-  const dry = mod.parseArgs(['node', 'index.js', '--dry-run']);
-  assert.equal(dry.dryRun, true);
-  const help = mod.parseArgs(['node', 'index.js', '-h']);
-  assert.equal(help.help, true);
-  const verbose = mod.parseArgs(['node', 'index.js', '--verbose']);
-  assert.equal(verbose.verbose, true);
-  const skipBundle = mod.parseArgs(['node', 'index.js', '--skip-bundle']);
-  assert.equal(skipBundle.skipBundle, true);
-});
-
-test('SKALPEL_INSTALL_DRY_RUN=1 forces dry-run even without --dry-run', () => {
-  const prev = process.env.SKALPEL_INSTALL_DRY_RUN;
-  process.env.SKALPEL_INSTALL_DRY_RUN = '1';
-  try {
-    const mod = require('./index');
-    const opts = mod.parseArgs(['node', 'index.js']);
-    assert.equal(opts.dryRun, true);
-  } finally {
-    if (prev === undefined) delete process.env.SKALPEL_INSTALL_DRY_RUN;
-    else process.env.SKALPEL_INSTALL_DRY_RUN = prev;
-  }
-});
-
-test('--help exits 0 and prints usage', () => {
-  const r = runWizard(['--help']);
-  assert.equal(r.status, 0, `stderr: ${r.stderr}`);
-  assert.match(r.stdout, /postinstall wizard/i);
-  assert.match(r.stdout, /usage:/i);
-});
-
-test('dry-run install completes with exit 0', () => {
-  const r = runWizard(['--dry-run']);
-  // Wizard contract: even on critical step failure, return 0 so npm
-  // install never aborts. Tests assert the *invariant*, not the path.
-  assert.equal(r.status, 0, `non-zero exit: stderr=${r.stderr}\nstdout=${r.stdout}`);
-});
-
-test('dry-run install is idempotent: second run mirrors first', () => {
-  // Same temp HOME both runs; the wizard should not leave behind
-  // state that perturbs the second run. We compare exit codes; output
-  // diffs are tolerated because timestamps / random suffixes vary.
-  const env = mkTempEnv();
-  function once() {
-    return spawnSync(process.execPath, [indexPath, '--dry-run'], {
-      env,
-      encoding: 'utf8',
-      timeout: 15_000,
-    });
-  }
-  const r1 = once();
-  const r2 = once();
-  assert.equal(r1.status, 0, `first run: stderr=${r1.stderr}`);
-  assert.equal(r2.status, 0, `second run: stderr=${r2.stderr}`);
-});
-
-test('dry-run install does not write to HOME', () => {
-  const env = mkTempEnv();
-  const home = env.HOME;
-  // Capture initial file inventory.
-  function snapshot(dir) {
-    const acc = [];
-    (function walk(p) {
-      let entries;
-      try { entries = fs.readdirSync(p, { withFileTypes: true }); }
-      catch { return; }
-      for (const e of entries) {
-        const full = path.join(p, e.name);
-        acc.push(full);
-        if (e.isDirectory()) walk(full);
-      }
-    })(dir);
-    return acc.sort();
-  }
-  const before = snapshot(home);
-  spawnSync(process.execPath, [indexPath, '--dry-run'], {
-    env,
-    encoding: 'utf8',
-    timeout: 15_000,
-  });
-  const after = snapshot(home);
-  // Dry-run must not create *new* files in HOME beyond what mkTempEnv
-  // pre-seeded (.config). Any drift is a regression on the dry-run
-  // contract.
-  const added = after.filter((p) => !before.includes(p));
-  assert.deepEqual(added, [], `dry-run wrote files: ${added.join(', ')}`);
-});

package/postinstall/launchd/com.skalpel.skalpeld.plist.tmpl

@@ -1,46 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
-                       "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>                      <string>ai.skalpel.daemon</string>
-
-  <key>ProgramArguments</key>
-  <array>
-    <string>{{BIN}}/skalpeld</string>
-    <string>--service-mode</string>
-  </array>
-
-  <key>RunAtLoad</key>                  <true/>
-  <!-- Unconditional KeepAlive: launchd restarts the daemon after any
-       exit (clean or otherwise), respecting ThrottleInterval. The
-       previous conditional form (SuccessfulExit=false + Crashed=true)
-       did NOT restart after a graceful SIGTERM drain that exits with
-       status 0 — the daemon stayed dead until some unrelated XPC nudge
-       eventually woke launchd up (observed gaps of 1-25 min on the
-       test machine), breaking Claude Code sessions routed through the
-       proxy for that whole window. Uninstall continues to work via
-       `launchctl unload`, which bypasses KeepAlive entirely. -->
-  <key>KeepAlive</key>                  <true/>
-
-  <key>ThrottleInterval</key>           <integer>10</integer>
-
-  <key>StandardOutPath</key>            <string>{{CONFIG_DIR}}/logs/skalpeld.log</string>
-  <key>StandardErrorPath</key>          <string>{{CONFIG_DIR}}/logs/skalpeld.log</string>
-
-  <key>WorkingDirectory</key>           <string>{{HOME}}</string>
-
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>SKALPEL_CONFIG_DIR</key>       <string>{{CONFIG_DIR}}</string>
-    <key>HOME</key>                     <string>{{HOME}}</string>
-    <key>USER</key>                     <string>{{USER}}</string>
-  </dict>
-
-  <key>ProcessType</key>                <string>Interactive</string>
-  <!-- audit-2026-05-09 §6 LOW: dropped LimitLoadToSessionType=Aqua so
-       the daemon also loads under headless macOS sessions (CI runners
-       driving via SSH land in LoginWindow / Background sessions; the
-       Aqua restriction blocked load there). -->
-</dict>
-</plist>