skalpel 4.0.14 → 4.0.16

package/incremental-ingest.mjs

@@ -32,6 +32,7 @@ const ITEM_VERSION = 1;
 const MAX_TRANSCRIPT_BYTES = 90 * 1024 * 1024;
 const MAX_DELIVERED_KEYS = 2048;
 const MAX_TERMINAL_RETRIES = 3;
+const MAX_VANISHED_RESUBMITS = 1;
 const LOCK_STALE_MS = 2 * 60 * 1000;
 const DEFAULT_REQUEST_TIMEOUT_MS = 8_000;
 const DEFAULT_WORK_BUDGET_MS = 45_000;
@@ -125,8 +126,16 @@ function baseKey(sessionID, transcript) {
     .digest("hex");
 }
 
+// The idempotency key is a STABLE CONTENT ADDRESS: item.key is the sha256 of (session id + full
+// transcript), so the SAME content produces the SAME key across every retry and generation. A retry
+// of an already-accepted transcript therefore dedups server-side and can never mint a duplicate
+// job/session or re-judge at Gemini cost. The key rotates ONLY when the server EXPLICITLY discards
+// the payload and asks for a fresh operation (requires_replay -> replay_epoch bump); ordinary retries
+// (network, error, 404-after-accept) must keep the key fixed. Generation still drives retry backoff,
+// but no longer leaks into the key.
 function idempotencyKey(item) {
-  return `session-end:${item.key}:${item.generation || 0}`;
+  const epoch = item.replay_epoch || 0;
+  return epoch > 0 ? `session-end:${item.key}:replay${epoch}` : `session-end:${item.key}`;
 }
 
 function readLedger(home) {
@@ -227,6 +236,10 @@ function scheduleTerminalRetry(home, item, status, now, doctorFn) {
   item.server_state = status.state || "error";
   item.last_error = String(status.error || "graph job failed").slice(0, 240);
   item.generation = nextGeneration;
+  // Only a server that EXPLICITLY discarded the payload needs a fresh operation key. Every other
+  // failure re-sends the identical content and must reuse the stable content-addressed key so the
+  // server can dedup it — otherwise a retry duplicates the session and re-judges at full cost.
+  if (status.requires_replay === true) item.replay_epoch = (item.replay_epoch || 0) + 1;
   item.next_poll_at = null;
   item.updated_at = new Date(now()).toISOString();
   if (nextGeneration <= MAX_TERMINAL_RETRIES) {
@@ -254,6 +267,45 @@ function scheduleTerminalRetry(home, item, status, now, doctorFn) {
   );
 }
 
+// A job that was ACCEPTED (the server issued a job_id) whose /ingest/status now 404s. Per the server
+// contract a mid-poll 404 means the job most likely COMPLETED and was evicted from the ephemeral job
+// store — the acceptance already gave us at-least-once delivery upstream. Because the idempotency key
+// is now a stable content address, a bounded re-submit is guaranteed non-duplicating (the server
+// dedups it on the same key), so we try ONE safe re-submit and then treat the content as delivered
+// rather than re-judging forever at full Gemini cost or risking a duplicate. This path is reached
+// ONLY for content that already reached the server; genuinely-never-accepted content has no job_id
+// and never lands here, so at-least-once is preserved for it separately.
+function handleVanishedJob(home, item, auth, now, doctorFn) {
+  const attempt = (item.not_found_count || 0) + 1;
+  item.not_found_count = attempt;
+  item.last_job_id = item.job_id || item.last_job_id || null;
+  item.user_id = item.user_id || auth.uid;
+  item.updated_at = new Date(now()).toISOString();
+  if (attempt > MAX_VANISHED_RESUBMITS) {
+    item.state = "delivered_assumed";
+    saveItem(home, item);
+    doctorFn(
+      home,
+      `job ${item.last_job_id} for key ${item.key} 404'd ${attempt}x after accept; ` +
+        "acceptance = at-least-once delivered, so recording as delivered and NOT re-sending",
+    );
+    markDelivered(home, item, now);
+    return "done";
+  }
+  item.job_id = null;
+  item.state = "resubmit_queued";
+  item.next_poll_at = null;
+  item.next_attempt_at = now() + retryDelayMs(attempt);
+  saveItem(home, item);
+  doctorFn(
+    home,
+    `job ${item.last_job_id} for key ${item.key} 404'd after accept ` +
+      `(attempt ${attempt}/${MAX_VANISHED_RESUBMITS}); one safe re-submit queued with ` +
+      `stable idempotency-key ${idempotencyKey(item)}`,
+  );
+  return "retry";
+}
+
 async function pollAcceptedJob(home, item, auth, options, deadline) {
   const { api, fetchFn, doctorFn, now, pollIntervalMs, requestTimeoutMs, sleepFn } = options;
   const statusURL = `${api}/ingest/status?job_id=${encodeURIComponent(item.job_id)}`;
@@ -278,8 +330,7 @@ async function pollAcceptedJob(home, item, auth, options, deadline) {
       return "pending";
     }
     if (response.status === 404) {
-      scheduleTerminalRetry(home, item, { state: "error", error: "job not found" }, now, doctorFn);
-      return "retry";
+      return handleVanishedJob(home, item, auth, now, doctorFn);
     }
     if (!response.ok) {
       item.state = `status_http_${response.status}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.14",
+  "version": "4.0.16",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-setup.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// setup — the automatic install flow (`skalpel-prosumer setup`, also npm postinstall). Prints the
+// setup — the automatic install flow (`skalpel setup`, also npm postinstall). Prints the
 // banner, signs you in with Google (once), reads your last 30 days of Claude Code / Codex history,
 // UPLOADS it to the hosted graph (the server judges + builds — the client stays engine-free), wires
 // the two hooks into Claude Code + Codex, and reports "you're live". Skips in CI / non-TTY (override:
@@ -22,8 +22,8 @@ import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { identity as authIdentity, cliAuthPath } from "./auth.mjs";
 
-// CLI (the `skalpel-prosumer` bin): `skalpel-prosumer setup [--api https://graph.skalpel.ai]
-// [--user <id>]`, plus `skalpel-prosumer uninstall` and `skalpel-prosumer login`. A bare invocation
+// CLI (the `skalpel` bin): `skalpel setup [--api https://graph.skalpel.ai]
+// [--user <id>]`, plus `skalpel uninstall` and `skalpel login`. A bare invocation
 // (npm postinstall) keeps the TTY-gated flow below.
 const argv = process.argv.slice(2);
 const sub = argv[0] && !argv[0].startsWith("-") ? argv[0] : null;
@@ -55,14 +55,14 @@ const KNOWN_SUBS = new Set(["setup", "login", "logout", "uninstall", "autopsy",
 const VALUE_FLAGS = new Set(["--api", "--user"]);
 // Boolean flags that take no value. `--purge` on `uninstall` also removes auth + all local data.
 const BOOL_FLAGS = new Set(["--purge"]);
-const USAGE = `skalpel-prosumer — connect your coding history to your behavioral graph
+const USAGE = `skalpel — connect your coding history to your behavioral graph
 
 usage:
-  skalpel-prosumer [setup] [--api <url>] [--user <id>]   sign in, learn your history, wire the hooks
-  skalpel-prosumer login                                 (re-)run the Google sign-in
-  skalpel-prosumer logout                                clear the saved session
-  skalpel-prosumer autopsy                               local, read-only receipt of your verified patterns
-  skalpel-prosumer uninstall [--purge]                   remove the hooks + local data from this machine
+  skalpel [setup] [--api <url>] [--user <id>]   sign in, learn your history, wire the hooks
+  skalpel login                                 (re-)run the Google sign-in
+  skalpel logout                                clear the saved session
+  skalpel autopsy                               local, read-only receipt of your verified patterns
+  skalpel uninstall [--purge]                   remove the hooks + local data from this machine
 
 options:
   --api <url>    point at a different graph server
@@ -325,7 +325,7 @@ function promptLaunch(targets) {
   const launchers = (targets || []).filter((entry) => !!entry?.command);
   if (!launchers.length) {
     console.log(`
-   ${D}No AI launcher was found on PATH. Re-run ${X}skalpel-prosumer setup${D} after installing Claude Code or Codex.${X}
+   ${D}No AI launcher was found on PATH. Re-run ${X}skalpel setup${D} after installing Claude Code or Codex.${X}
 `);
     return Promise.resolve();
   }
@@ -810,12 +810,12 @@ async function main() {
     spawnSync("node", [join(__dir, "install.mjs"), ...passthrough], { stdio: "inherit" });
     return;
   }
-  // `skalpel-prosumer login` — just run the sign-in flow (also invoked automatically by setup).
+  // `skalpel login` — just run the sign-in flow (also invoked automatically by setup).
   if (sub === "login") {
     spawnSync("node", [join(__dir, "login.mjs")], { stdio: "inherit" });
     return;
   }
-  // `skalpel-prosumer logout` — clear the saved Google session so the next run signs in fresh.
+  // `skalpel logout` — clear the saved Google session so the next run signs in fresh.
   // (Setup skips the sign-in when a valid ~/.skalpel/auth.json exists — this is how you force a new
   // account / a real Google popup.)
   if (sub === "logout") {
@@ -886,7 +886,7 @@ async function main() {
     id = await identity();
     if (!id) {
       console.log(
-        `\n   ${D}Not signed in — run ${X}skalpel-prosumer login${D} then re-run to build your graph.${X}\n`,
+        `\n   ${D}Not signed in — run ${X}skalpel login${D} then re-run to build your graph.${X}\n`,
       );
       return;
     }
@@ -967,7 +967,7 @@ async function main() {
         `Couldn't build your graph${err ? ` (${String(err.message || err).slice(0, 40)})` : ""}`,
       );
       console.log(
-        `\n   ${D}Hooks are wired and fail open. Re-run ${X}skalpel-prosumer setup${D} to try building again.${X}\n`,
+        `\n   ${D}Hooks are wired and fail open. Re-run ${X}skalpel setup${D} to try building again.${X}\n`,
       );
     }
   } else if (files.length) {