skalpel 3.4.6 → 3.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "3.4.6",
+  "version": "3.4.7",
   "description": "Skalpel — local proxy and TUI for coding agents (skalpel + skalpeld bundle).",
   "license": "Apache-2.0",
   "homepage": "https://skalpel.ai",
@@ -40,6 +40,7 @@
   "files": [
     "npm-bin/",
     "postinstall/",
+    "prosumer-hooks/",
     "design-tokens.json",
     "INSTALL.md",
     "README.md",
@@ -58,10 +59,10 @@
     "x64"
   ],
   "optionalDependencies": {
-    "@skalpelai/skalpel-darwin-arm64": "3.4.6",
-    "@skalpelai/skalpel-darwin-x64": "3.4.6",
-    "@skalpelai/skalpel-linux-arm64": "3.4.6",
-    "@skalpelai/skalpel-linux-x64": "3.4.6",
-    "@skalpelai/skalpel-win32-x64": "3.4.6"
+    "@skalpelai/skalpel-darwin-arm64": "3.4.7",
+    "@skalpelai/skalpel-darwin-x64": "3.4.7",
+    "@skalpelai/skalpel-linux-arm64": "3.4.7",
+    "@skalpelai/skalpel-linux-x64": "3.4.7",
+    "@skalpelai/skalpel-win32-x64": "3.4.7"
   }
 }

package/postinstall/index.js

@@ -28,6 +28,7 @@ const serviceRegister = require('./lib/service-register');
 const envInject = require('./lib/env-inject');
 const launch = require('./lib/launch');
 const caInstall = require('./lib/ca-install');
+const prosumerHooks = require('./lib/prosumer-hooks');
 
 function printStyledSuccess() {
   if (!process.stdout.isTTY) return;
@@ -81,10 +82,12 @@ function helpText() {
     '',
     'Run automatically by npm install. The wizard performs:',
     '  1. detect-prior          probe configDir for an existing install',
-    '  2. sign-in               start `skalpel login` (or hint at it)',
-    '  3. service-register      register the per-OS daemon entry',
-    '  4. env-inject            update shell rc managed-block',
-    '  5. launch                print the run-skalpel hint',
+    '  2. behavior-hooks        stage the local graph hook runtime',
+    '  3. sign-in               start `skalpel login` (or hint at it)',
+    '  4. service-register      register the per-OS daemon entry',
+    '  5. ca-install            install the local interception CA',
+    '  6. shell-activation      defer wrapping until `skalpel setup`',
+    '  7. launch                print the run-skalpel hint',
     '',
     'Uninstall is owned by the Go binary now — run `skalpel uninstall`',
     'or `npx skalpel uninstall` to reverse this wizard.',
@@ -147,7 +150,7 @@ async function main(argv) {
     return 0;
   }
 
-  const total = 6;
+  const total = 7;
   const mode = opts.dryRun ? 'dry-run' : 'live';
   log.info(`postinstall wizard starting (${mode} install) on ${process.platform}`);
 
@@ -163,7 +166,20 @@ async function main(argv) {
     const r = detectPrior.run({ dryRun: opts.dryRun });
     prior = r.prior;
 
-    log.step(2, total, 'sign-in', prior ? 'skipping (prior auth)' : 'browser flow');
+    log.step(2, total, 'behavior-hooks', 'staging CLI-owned runtime');
+    try {
+      const hooks = prosumerHooks.stageAndHeal({ dryRun: opts.dryRun });
+      if (hooks.healed) {
+        log.info('behavior-hooks: refreshed an existing skalpel hook installation');
+      } else {
+        log.info('behavior-hooks: runtime staged; activation remains opt-in via `skalpel setup`');
+      }
+    } catch (err) {
+      log.warn(`behavior-hooks: ${err.message}; continuing`);
+      allWarnings.push(`behavior-hooks: ${err.message}`);
+    }
+
+    log.step(3, total, 'sign-in', prior ? 'skipping (prior auth)' : 'browser flow');
     // sign-in is non-critical: a missing dispatcher / login failure
     // is recoverable — user can run `skalpel login` later.
     try {
@@ -176,7 +192,7 @@ async function main(argv) {
       allWarnings.push(`sign-in: ${err.message}`);
     }
 
-    log.step(3, total, 'service-register', `OS=${process.platform}`);
+    log.step(4, total, 'service-register', `OS=${process.platform}`);
     // service-register is critical: a stale service unit is a real
     // problem at boot. Errors propagate to the catch block below.
     const sr = serviceRegister.run({ dryRun: opts.dryRun }) || {};
@@ -184,7 +200,7 @@ async function main(argv) {
       allWarnings.push(...sr.warnings);
     }
 
-    log.step(4, total, 'ca-install', `trust store on ${process.platform}`);
+    log.step(5, total, 'ca-install', `trust store on ${process.platform}`);
     // ca-install is NON-CRITICAL: declined prompts or missing sudo must NOT
     // fail postinstall. The deferred-install sentinel ensures first
     // `skalpel login` / `codex` invocation retries the trust install.
@@ -209,14 +225,14 @@ async function main(argv) {
     // managed block, now poison-free). Set SKALPEL_ACTIVATE_SHELL=1 to restore
     // the old auto-wrap-on-install behavior.
     if (process.env.SKALPEL_ACTIVATE_SHELL === '1') {
-      log.step(5, total, 'env-inject', 'managed-block edit per shell (SKALPEL_ACTIVATE_SHELL=1)');
+      log.step(6, total, 'env-inject', 'managed-block edit per shell (SKALPEL_ACTIVATE_SHELL=1)');
       envInject.run({ dryRun: opts.dryRun });
     } else {
-      log.step(5, total, 'shell-activation', 'deferred — opt-in via `skalpel setup`');
+      log.step(6, total, 'shell-activation', 'deferred — opt-in via `skalpel setup`');
       log.info('Shell integration is opt-in. Run `skalpel setup` to route Claude/Codex through skalpel.');
     }
 
-    log.step(6, total, 'launch', 'next-step hint');
+    log.step(7, total, 'launch', 'next-step hint');
     launch.run({ dryRun: opts.dryRun });
   } catch (err) {
     critical = err;

package/postinstall/lib/prosumer-hooks.js

@@ -0,0 +1,111 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const RUNTIME_FILES = [
+  'auth.mjs',
+  'bootstrap.mjs',
+  'insights.mjs',
+  'metrics.mjs',
+  'stats.mjs',
+  'skalpel-hook.mjs',
+  'skalpel-hook-session.mjs',
+  'skalpel-statusline.mjs',
+  'install.mjs',
+];
+
+const MANAGED_COMMAND = /skalpel-(?:prosumer-)?(?:hook(?:-session)?|statusline)/;
+
+function runtimeDir() {
+  return path.join(os.homedir(), '.skalpel', 'hooks');
+}
+
+function sourceDir() {
+  return path.resolve(__dirname, '..', '..', 'prosumer-hooks');
+}
+
+function readText(file) {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch (_) {
+    return '';
+  }
+}
+
+function hasManagedInstall() {
+  const home = os.homedir();
+  return [
+    path.join(home, '.claude', 'settings.json'),
+    path.join(home, '.claude', 'CLAUDE.md'),
+    path.join(home, '.codex', 'config.toml'),
+    path.join(home, '.codex', 'hooks.json'),
+  ].some((file) => MANAGED_COMMAND.test(readText(file)));
+}
+
+function copyRuntime() {
+  const srcDir = sourceDir();
+  const dstDir = runtimeDir();
+  fs.mkdirSync(dstDir, { recursive: true, mode: 0o700 });
+  for (const name of RUNTIME_FILES) {
+    const src = path.join(srcDir, name);
+    const dst = path.join(dstDir, name);
+    const tmp = `${dst}.tmp-${process.pid}`;
+    try {
+      fs.copyFileSync(src, tmp);
+      fs.renameSync(tmp, dst);
+    } finally {
+      try {
+        fs.unlinkSync(tmp);
+      } catch (_) {
+        // The rename consumed the temporary file.
+      }
+    }
+  }
+}
+
+function runInstaller(args, stdio = 'inherit') {
+  const staged = path.join(runtimeDir(), 'install.mjs');
+  const installer = fs.existsSync(staged) ? staged : path.join(sourceDir(), 'install.mjs');
+  const result = spawnSync(process.execPath, [installer, ...args], { stdio });
+  if (result.error) throw result.error;
+  if (typeof result.status === 'number' && result.status !== 0) {
+    throw new Error(`hook installer exited ${result.status}`);
+  }
+}
+
+function stageAndHeal({ dryRun = false } = {}) {
+  const heal = hasManagedInstall();
+  if (dryRun) return { staged: false, healed: false, wouldHeal: heal };
+  copyRuntime();
+  if (heal) runInstaller([]);
+  return { staged: true, healed: heal };
+}
+
+function uninstall({ removeRuntime = true } = {}) {
+  let error = null;
+  try {
+    runInstaller(['--uninstall']);
+  } catch (err) {
+    error = err;
+  }
+  if (removeRuntime) {
+    for (const name of RUNTIME_FILES) {
+      try {
+        fs.unlinkSync(path.join(runtimeDir(), name));
+      } catch (_) {
+        // Missing files are already clean.
+      }
+    }
+    try {
+      fs.rmdirSync(runtimeDir());
+    } catch (_) {
+      // Preserve the directory when it contains user-owned files.
+    }
+  }
+  if (error) throw error;
+}
+
+module.exports = { stageAndHeal, uninstall };

package/postinstall/uninstall.js

@@ -26,6 +26,7 @@
 const path = require('path');
 const fs = require('fs');
 const { spawnSync } = require('child_process');
+const prosumerHooks = require('./lib/prosumer-hooks');
 
 const PLATFORM_PACKAGES = {
   'darwin-arm64': '@skalpelai/skalpel-darwin-arm64',
@@ -65,6 +66,13 @@ function findBinary() {
   if (process.env.SKALPEL_NO_PREUNINSTALL) {
     return;
   }
+  try {
+    prosumerHooks.uninstall({ removeRuntime: true });
+  } catch (err) {
+    process.stderr.write(
+      `[skalpel] preuninstall: behavior-hook cleanup failed: ${err.message}; continuing.\n`
+    );
+  }
   const bin = findBinary();
   if (!bin) {
     process.stderr.write(

package/prosumer-hooks/auth.mjs

@@ -0,0 +1,93 @@
+// auth.mjs - shared hosted-hook identity from the canonical skalpel CLI login.
+// There is deliberately no hook-owned auth file and no Supabase fallback: `skalpel login`
+// is the only account plane for the globally installed product.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const DASHBOARD_API = process.env.SKALPEL_DASHBOARD_API || "https://cli.skalpel.ai";
+const REFRESH_TIMEOUT_MS = 2000;
+
+function cliAuthPath() {
+  if (process.env.SKALPEL_CONFIG_DIR) return join(process.env.SKALPEL_CONFIG_DIR, "auth.json");
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA || join(homedir(), "AppData", "Roaming");
+    return join(appData, "skalpel", "auth.json");
+  }
+  if (process.platform === "darwin") {
+    return join(homedir(), "Library", "Application Support", "skalpel", "auth.json");
+  }
+  const configHome = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(configHome, "skalpel", "auth.json");
+}
+
+function loadCliAuth() {
+  try {
+    const auth = JSON.parse(readFileSync(cliAuthPath(), "utf8"));
+    return typeof auth?.cognito?.id_token === "string" && auth.cognito.id_token ? auth : null;
+  } catch {
+    return null;
+  }
+}
+
+function decodeJwtPayload(token) {
+  try {
+    const part = token.split(".")[1];
+    const padded = part + "=".repeat((4 - (part.length % 4)) % 4);
+    return JSON.parse(
+      Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(),
+    );
+  } catch {
+    return null;
+  }
+}
+
+function toEpochSeconds(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value > 1e12 ? Math.floor(value / 1000) : value;
+  }
+  if (typeof value === "string") {
+    const millis = Date.parse(value);
+    return Number.isFinite(millis) ? Math.floor(millis / 1000) : null;
+  }
+  return null;
+}
+
+async function refreshIDToken(refreshToken) {
+  if (!refreshToken) return null;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), REFRESH_TIMEOUT_MS);
+  try {
+    const response = await fetch(`${DASHBOARD_API}/v1/auth/refresh`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ refresh_token: refreshToken }),
+      signal: ctrl.signal,
+    });
+    if (!response.ok) return null;
+    const tokens = await response.json();
+    return typeof tokens?.id_token === "string" ? tokens.id_token : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function identity() {
+  if (process.env.SKALPEL_USER) return { uid: process.env.SKALPEL_USER, token: null };
+
+  const auth = loadCliAuth();
+  if (!auth) return { uid: null, token: null };
+
+  let idToken = auth.cognito.id_token;
+  const claims = decodeJwtPayload(idToken);
+  const expiresAt = toEpochSeconds(auth.cognito.expires_at) ?? claims?.exp ?? null;
+  if (expiresAt !== null && expiresAt - Math.floor(Date.now() / 1000) < 60) {
+    idToken = await refreshIDToken(auth.cognito.refresh_token);
+    if (!idToken) return { uid: null, token: null };
+  }
+
+  const uid = decodeJwtPayload(idToken)?.sub ?? auth.subject?.user_id ?? null;
+  return uid ? { uid, token: idToken } : { uid: null, token: null };
+}