skalpel 4.0.13 → 4.0.15

package/auth.mjs

@@ -15,7 +15,11 @@ const COGNITO_TOKEN_URL =
 const COGNITO_CLIENT_ID = process.env.SKALPEL_COGNITO_CLIENT_ID || "2gfil041fv9u58jemc7l5u2pht";
 const GRAPH_API = process.env.SKALPEL_API || "https://graph.skalpel.ai";
 
-function cliAuthPath() {
+// Exported so `skalpel logout` / `skalpel uninstall --purge` remove the session from the SAME
+// platform path this module reads it from (macOS Application Support, XDG on Linux, APPDATA on
+// Windows) — never a divergent guess. This is only a path resolver: it touches no token-exchange
+// or verification logic.
+export function cliAuthPath() {
   if (process.env.SKALPEL_CONFIG_DIR) return join(process.env.SKALPEL_CONFIG_DIR, "auth.json");
   if (process.platform === "win32") {
     const appData = process.env.APPDATA || join(homedir(), "AppData", "Roaming");

package/incremental-ingest.mjs

@@ -32,6 +32,7 @@ const ITEM_VERSION = 1;
 const MAX_TRANSCRIPT_BYTES = 90 * 1024 * 1024;
 const MAX_DELIVERED_KEYS = 2048;
 const MAX_TERMINAL_RETRIES = 3;
+const MAX_VANISHED_RESUBMITS = 1;
 const LOCK_STALE_MS = 2 * 60 * 1000;
 const DEFAULT_REQUEST_TIMEOUT_MS = 8_000;
 const DEFAULT_WORK_BUDGET_MS = 45_000;
@@ -125,8 +126,16 @@ function baseKey(sessionID, transcript) {
     .digest("hex");
 }
 
+// The idempotency key is a STABLE CONTENT ADDRESS: item.key is the sha256 of (session id + full
+// transcript), so the SAME content produces the SAME key across every retry and generation. A retry
+// of an already-accepted transcript therefore dedups server-side and can never mint a duplicate
+// job/session or re-judge at Gemini cost. The key rotates ONLY when the server EXPLICITLY discards
+// the payload and asks for a fresh operation (requires_replay -> replay_epoch bump); ordinary retries
+// (network, error, 404-after-accept) must keep the key fixed. Generation still drives retry backoff,
+// but no longer leaks into the key.
 function idempotencyKey(item) {
-  return `session-end:${item.key}:${item.generation || 0}`;
+  const epoch = item.replay_epoch || 0;
+  return epoch > 0 ? `session-end:${item.key}:replay${epoch}` : `session-end:${item.key}`;
 }
 
 function readLedger(home) {
@@ -227,6 +236,10 @@ function scheduleTerminalRetry(home, item, status, now, doctorFn) {
   item.server_state = status.state || "error";
   item.last_error = String(status.error || "graph job failed").slice(0, 240);
   item.generation = nextGeneration;
+  // Only a server that EXPLICITLY discarded the payload needs a fresh operation key. Every other
+  // failure re-sends the identical content and must reuse the stable content-addressed key so the
+  // server can dedup it — otherwise a retry duplicates the session and re-judges at full cost.
+  if (status.requires_replay === true) item.replay_epoch = (item.replay_epoch || 0) + 1;
   item.next_poll_at = null;
   item.updated_at = new Date(now()).toISOString();
   if (nextGeneration <= MAX_TERMINAL_RETRIES) {
@@ -254,6 +267,45 @@ function scheduleTerminalRetry(home, item, status, now, doctorFn) {
   );
 }
 
+// A job that was ACCEPTED (the server issued a job_id) whose /ingest/status now 404s. Per the server
+// contract a mid-poll 404 means the job most likely COMPLETED and was evicted from the ephemeral job
+// store — the acceptance already gave us at-least-once delivery upstream. Because the idempotency key
+// is now a stable content address, a bounded re-submit is guaranteed non-duplicating (the server
+// dedups it on the same key), so we try ONE safe re-submit and then treat the content as delivered
+// rather than re-judging forever at full Gemini cost or risking a duplicate. This path is reached
+// ONLY for content that already reached the server; genuinely-never-accepted content has no job_id
+// and never lands here, so at-least-once is preserved for it separately.
+function handleVanishedJob(home, item, auth, now, doctorFn) {
+  const attempt = (item.not_found_count || 0) + 1;
+  item.not_found_count = attempt;
+  item.last_job_id = item.job_id || item.last_job_id || null;
+  item.user_id = item.user_id || auth.uid;
+  item.updated_at = new Date(now()).toISOString();
+  if (attempt > MAX_VANISHED_RESUBMITS) {
+    item.state = "delivered_assumed";
+    saveItem(home, item);
+    doctorFn(
+      home,
+      `job ${item.last_job_id} for key ${item.key} 404'd ${attempt}x after accept; ` +
+        "acceptance = at-least-once delivered, so recording as delivered and NOT re-sending",
+    );
+    markDelivered(home, item, now);
+    return "done";
+  }
+  item.job_id = null;
+  item.state = "resubmit_queued";
+  item.next_poll_at = null;
+  item.next_attempt_at = now() + retryDelayMs(attempt);
+  saveItem(home, item);
+  doctorFn(
+    home,
+    `job ${item.last_job_id} for key ${item.key} 404'd after accept ` +
+      `(attempt ${attempt}/${MAX_VANISHED_RESUBMITS}); one safe re-submit queued with ` +
+      `stable idempotency-key ${idempotencyKey(item)}`,
+  );
+  return "retry";
+}
+
 async function pollAcceptedJob(home, item, auth, options, deadline) {
   const { api, fetchFn, doctorFn, now, pollIntervalMs, requestTimeoutMs, sleepFn } = options;
   const statusURL = `${api}/ingest/status?job_id=${encodeURIComponent(item.job_id)}`;
@@ -278,8 +330,7 @@ async function pollAcceptedJob(home, item, auth, options, deadline) {
       return "pending";
     }
     if (response.status === 404) {
-      scheduleTerminalRetry(home, item, { state: "error", error: "job not found" }, now, doctorFn);
-      return "retry";
+      return handleVanishedJob(home, item, auth, now, doctorFn);
     }
     if (!response.ok) {
       item.state = `status_http_${response.status}`;

package/install.mjs

@@ -2,12 +2,25 @@
 // install.mjs — wire the hosted skalpel behavior hook into Claude Code AND Codex. Pure Node,
 // idempotent, and non-clobbering:
 // preserves any existing hooks/settings, refreshes ours in place. Run: `node install.mjs` (or --uninstall).
-import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync } from "node:fs";
+import {
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  existsSync,
+  copyFileSync,
+  rmSync,
+  readdirSync,
+} from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { cliAuthPath } from "./auth.mjs";
 
 const uninstall = process.argv.includes("--uninstall");
+// `--purge` (only meaningful with --uninstall): additionally delete the saved session + ALL local
+// skalpel data so an uninstalled machine has nothing left — important because skalpel uploads
+// transcripts and a user must be able to verify no residue remains.
+const purge = process.argv.includes("--purge");
 // npm postinstall uses this mode to make the local, read-only status indicator visible without
 // opting the user into prompt/session hooks. A successful `skalpel login` runs the full installer;
 // `skalpel setup` remains an explicit repair path.
@@ -141,7 +154,11 @@ function isOurs(c, marker) {
   ];
   return markers.some((candidate) => {
     const escaped = candidate.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return new RegExp(`(^|[/\\\\\\s])${escaped}(\\.mjs|\\.js|\\.exe)?($|\\s)`).test(c);
+    // Boundaries must accept a QUOTE too: the installer writes the Windows-safe quoted form
+    // `node "<path>/skalpel-hook.mjs"`, so the marker is bounded by `/` before and `"` after. The
+    // old class only allowed path-sep/whitespace/end, so it NEVER matched a quoted command — uninstall
+    // left the hooks wired and re-install appended duplicate groups. Allow `"` and `'` on both sides.
+    return new RegExp(`(^|[/\\\\"'\\s])${escaped}(\\.mjs|\\.js|\\.exe)?($|["'\\s])`).test(c);
   });
 }
 
@@ -380,6 +397,75 @@ function claudeMd() {
   return had ? "refreshed" : "installed";
 }
 
+// After the hooks are UNWIRED (settings.json / CLAUDE.md / Codex — handled above), remove the local
+// data skalpel staged and accumulated so an uninstall leaves the machine clean. Plain uninstall keeps
+// the saved auth (so `--purge` is the deliberate "forget me entirely" step); --purge removes auth +
+// the whole ~/.skalpel tree. Returns a short human summary of what was cleaned.
+function cleanupLocalData() {
+  const SKALPEL_DIR = join(homedir(), ".skalpel");
+  const cleaned = [];
+  const rm = (target, label) => {
+    // Never delete a directory that contains the currently-running installer (defensive — install.mjs
+    // is never staged into ~/.skalpel, but guard anyway so a self-hosted layout can't self-destruct).
+    if (
+      PKG_DIR === target ||
+      PKG_DIR.startsWith(target + "/") ||
+      PKG_DIR.startsWith(target + "\\")
+    ) {
+      return;
+    }
+    if (!existsSync(target)) return;
+    try {
+      rmSync(target, { recursive: true, force: true });
+      cleaned.push(label);
+    } catch {
+      /* best-effort — a locked/again-absent path never fails the uninstall */
+    }
+  };
+
+  if (purge) {
+    // Forget-me-entirely: the saved session at the PLATFORM path (macOS Application Support / XDG /
+    // APPDATA — resolved by auth.mjs so it matches exactly where login wrote it) + the whole tree.
+    rm(cliAuthPath(), "auth (session token)");
+    rm(SKALPEL_DIR, "~/.skalpel (all local data)");
+    return cleaned;
+  }
+
+  // Plain uninstall: remove staged hooks + the raw transcript snapshots + all local state/logs, but
+  // KEEP the saved auth (that's what `--purge` is for). List every file skalpel writes under ~/.skalpel
+  // so nothing is silently left behind; auth.json (legacy local location) is deliberately preserved.
+  rm(join(SKALPEL_DIR, "hooks"), "staged hooks");
+  rm(join(SKALPEL_DIR, "ingest-outbox"), "raw transcript snapshots (ingest-outbox)");
+  for (const f of [
+    "session.json",
+    "steer.json",
+    "traj.json",
+    "pending.json",
+    "prefs.json",
+    "insights.ndjson",
+    "insights-ready.json",
+    "metrics.ndjson",
+    "bootstrap.json",
+    "bootstrap.lock",
+    "client.json",
+    "doctor.log",
+    "hook.log",
+  ]) {
+    rm(join(SKALPEL_DIR, f), f);
+  }
+  if (cleaned.length)
+    cleaned.push("(auth kept — run `skalpel uninstall --purge` to remove it too)");
+  // Tidy: if nothing but an empty shell remains, drop the directory. Preserve it if auth.json is still
+  // there (legacy local session) so the kept-auth promise holds.
+  try {
+    if (existsSync(SKALPEL_DIR) && readdirSync(SKALPEL_DIR).length === 0)
+      rmSync(SKALPEL_DIR, { force: true, recursive: true });
+  } catch {
+    /* leave the dir if we can't inspect it */
+  }
+  return cleaned;
+}
+
 const claudeResult = claude();
 if (statuslineOnly) {
   console.log(`skalpel statusline (${STATUSLINE_CMD}) → claude: ${claudeResult}`);
@@ -392,9 +478,20 @@ if (statuslineOnly) {
   console.log(
     `skalpel hook (${uninstall ? "uninstall" : CMD}) → claude: ${claudeResult} · claude.md: ${claudeMd()} · codex(config.toml): ${codexToml()} · codex(hooks.json): ${codexJson()}`,
   );
-  console.log(
-    uninstall
-      ? "uninstalled."
-      : `installed. Hooks run from ${HOOKS_DIR} and use the canonical skalpel Cognito login.`,
-  );
+  if (uninstall) {
+    const cleaned = cleanupLocalData();
+    if (cleaned.length) console.log(`removed: ${cleaned.join(", ")}.`);
+    if (purge) {
+      // Honest note: there is no server-side data-deletion endpoint yet. Don't imply we called one.
+      console.log(
+        "note: local data removed. skalpel has no self-serve server-side deletion endpoint yet — " +
+          "to delete the transcripts already uploaded to the graph, email privacy@skalpel.ai.",
+      );
+    }
+    console.log("uninstalled.");
+  } else {
+    console.log(
+      `installed. Hooks run from ${HOOKS_DIR} and use the canonical skalpel Cognito login.`,
+    );
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.13",
+  "version": "4.0.15",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-setup.mjs

@@ -20,7 +20,7 @@ import { join, dirname, delimiter, sep as pathSep } from "node:path";
 import { createInterface, emitKeypressEvents } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
-import { identity as authIdentity } from "./auth.mjs";
+import { identity as authIdentity, cliAuthPath } from "./auth.mjs";
 
 // CLI (the `skalpel-prosumer` bin): `skalpel-prosumer setup [--api https://graph.skalpel.ai]
 // [--user <id>]`, plus `skalpel-prosumer uninstall` and `skalpel-prosumer login`. A bare invocation
@@ -53,6 +53,8 @@ const isMain =
 // pulls in userTurnCount) can never exit the test runner.
 const KNOWN_SUBS = new Set(["setup", "login", "logout", "uninstall", "autopsy", "__build"]);
 const VALUE_FLAGS = new Set(["--api", "--user"]);
+// Boolean flags that take no value. `--purge` on `uninstall` also removes auth + all local data.
+const BOOL_FLAGS = new Set(["--purge"]);
 const USAGE = `skalpel-prosumer — connect your coding history to your behavioral graph
 
 usage:
@@ -60,11 +62,12 @@ usage:
   skalpel-prosumer login                                 (re-)run the Google sign-in
   skalpel-prosumer logout                                clear the saved session
   skalpel-prosumer autopsy                               local, read-only receipt of your verified patterns
-  skalpel-prosumer uninstall                             remove the hooks from Claude Code + Codex
+  skalpel-prosumer uninstall [--purge]                   remove the hooks + local data from this machine
 
 options:
   --api <url>    point at a different graph server
   --user <id>    dev-only identity override
+  --purge        on uninstall, also delete the saved session + ALL local skalpel data (~/.skalpel)
   -v, --version  print the version and exit
   -h, --help     print this help and exit`;
 
@@ -91,6 +94,7 @@ function validateArgv() {
       console.log(USAGE);
       process.exit(0);
     }
+    if (BOOL_FLAGS.has(a)) continue; // valueless flag (e.g. `uninstall --purge`)
     if (a.startsWith("-")) {
       console.error(`skalpel: unknown option \`${a}\`\n\n${USAGE}`);
       process.exit(2);
@@ -802,7 +806,8 @@ function preflight() {
 
 async function main() {
   if (sub === "uninstall") {
-    spawnSync("node", [join(__dir, "install.mjs"), "--uninstall"], { stdio: "inherit" });
+    const passthrough = argv.includes("--purge") ? ["--uninstall", "--purge"] : ["--uninstall"];
+    spawnSync("node", [join(__dir, "install.mjs"), ...passthrough], { stdio: "inherit" });
     return;
   }
   // `skalpel-prosumer login` — just run the sign-in flow (also invoked automatically by setup).
@@ -816,7 +821,30 @@ async function main() {
   if (sub === "logout") {
     try {
       const { rmSync } = await import("node:fs");
-      rmSync(join(homedir(), ".skalpel", "auth.json"), { force: true });
+      // The real session written by `skalpel login` / read by auth.mjs lives at the PLATFORM path
+      // (macOS Application Support, XDG on Linux, APPDATA on Windows) — NOT ~/.skalpel/auth.json.
+      // Delete it via auth.mjs's own resolver so we hit exactly where the session lives; the old
+      // code only unlinked the legacy ~/.skalpel/auth.json, so the next run silently re-authed.
+      const platformAuth = cliAuthPath();
+      rmSync(platformAuth, { force: true });
+      rmSync(join(homedir(), ".skalpel", "auth.json"), { force: true }); // legacy location, if present
+      // Clear the live per-session steering state + first-run bootstrap state so a subsequent login
+      // (possibly a different account) starts clean. Historical telemetry (metrics/insights ndjson)
+      // and config/prefs are left alone — `skalpel uninstall` owns those.
+      const skalpelDir = join(homedir(), ".skalpel");
+      for (const f of [
+        "session.json",
+        "steer.json",
+        "traj.json",
+        "pending.json",
+        "bootstrap.json",
+        "bootstrap.lock",
+        "insights-ready.json",
+      ]) {
+        rmSync(join(skalpelDir, f), { force: true });
+      }
+      // No persistent local proxy/daemon ships with this client (the legacy Go `skalpeld` is retired
+      // by postinstall.mjs). Clearing bootstrap.lock above releases any stuck first-run build lock.
       console.log(`   ${G}✓${X} Signed out. Next run will prompt for Google sign-in.\n`);
     } catch (e) {
       console.log(`   Could not sign out: ${String(e.message || e)}\n`);