skalpel 4.0.16 → 4.0.18

package/insights.mjs

@@ -30,7 +30,7 @@ const KEEP_LINES = 400;
 // compromised upstream string can't smuggle OSC/CSI sequences (clipboard writes, title spoofing)
 // toward anyone's terminal. Newlines collapse to spaces (one record = one NDJSON line of prose).
 const MAX_TEXT = 2000;
-function cleanText(v) {
+export function cleanText(v) {
   if (typeof v !== "string") return v;
   // eslint-disable-next-line no-control-regex
   const flat = v.replace(/[\r\n\t]+/g, " ").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");

package/install.mjs

@@ -54,6 +54,7 @@ function stageHookRuntime() {
   // a hook entrypoint staged without a module it imports — the exact 0.3.12–0.3.16 bug shape.
   copyFileSync(join(PKG_DIR, "insights.mjs"), join(HOOKS_DIR, "insights.mjs")); // hooks import ./insights.mjs
   copyFileSync(join(PKG_DIR, "reveal.mjs"), join(HOOKS_DIR, "reveal.mjs")); // both hooks import ./reveal.mjs
+  copyFileSync(join(PKG_DIR, "transcript.mjs"), join(HOOKS_DIR, "transcript.mjs")); // skalpel-hook.mjs + skalpel-statusline.mjs import ./transcript.mjs (tailLines)
   copyFileSync(join(PKG_DIR, "skalpel-hook.mjs"), HOOK_FILE);
   copyFileSync(join(PKG_DIR, "skalpel-hook-session.mjs"), SESSION_FILE);
   copyFileSync(join(PKG_DIR, "incremental-ingest.mjs"), join(HOOKS_DIR, "incremental-ingest.mjs"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.16",
+  "version": "4.0.18",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-hook.mjs

@@ -13,8 +13,14 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { identity } from "./auth.mjs";
 import { record } from "./metrics.mjs";
-import { recordInsight } from "./insights.mjs";
+import { recordInsight, cleanText } from "./insights.mjs";
 import { graphReadyNote } from "./reveal.mjs";
+import { tailLines } from "./transcript.mjs";
+
+// Tail budget for the two transcript scans below (last-prompt + cascade). Both only ever look at the
+// final handful of user turns, so 256 KiB of tail is ample — and it keeps the read constant-ish instead
+// of unbounded, so it fits inside the hook's single fail-open deadline even on a multi-GB transcript.
+const TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 
 // Config precedence: env > ~/.skalpel/client.json (written by `skalpel-prosumer setup`) > default.
 function fileCfg() {
@@ -38,7 +44,9 @@ const DEADLINE_MS = 4500;
 function lastUserPrompt(payload) {
   if (payload.prompt) return String(payload.prompt);
   try {
-    const lines = readFileSync(payload.transcript_path, "utf8").trim().split("\n");
+    // Bounded tail read: the last user turn lives at the end of the transcript, so scanning the tail
+    // finds it without slurping a multi-GB file (no size/time ceiling would violate the hook deadline).
+    const lines = tailLines(payload.transcript_path, TRANSCRIPT_TAIL_BYTES);
     for (let i = lines.length - 1; i >= 0; i--) {
       const e = JSON.parse(lines[i]);
       if (e.type === "user" || e.role === "user") {
@@ -76,7 +84,10 @@ const _CORRECTION =
 function detectCascade(payload) {
   try {
     if (!payload.transcript_path) return 0;
-    const lines = readFileSync(payload.transcript_path, "utf8").trim().split("\n");
+    // Bounded tail read (256 KiB) — this runs EVERY turn, BEFORE the fetch deadline is armed, so an
+    // unbounded slurp here had zero time budget and could stall the prompt for seconds on a big/synced
+    // transcript. The cascade scan only needs the last 6 user turns, which live in the tail.
+    const lines = tailLines(payload.transcript_path, TRANSCRIPT_TAIL_BYTES);
     let signals = 0;
     let userTurns = 0;
     for (let i = lines.length - 1; i >= 0 && userTurns < 6; i--) {
@@ -155,10 +166,14 @@ function writeSteer(label, type, wt, id) {
   try {
     mkdirSync(join(homedir(), ".skalpel"), { recursive: true });
     const tmp = `${STEER_PATH}.tmp`;
+    // `label` is the hosted graph's server-controlled string; the statusline writes it RAW to the live
+    // terminal. Strip C0/C1/ESC/DEL and cap length at write time (same cleanText the insights path uses)
+    // so a compromised/hostile upstream can't smuggle OSC/CSI escapes (title spoof, screen clear) here.
+    const safeLabel = label ? cleanText(String(label)) : null;
     writeFileSync(
       tmp,
       JSON.stringify({
-        label: label || null,
+        label: safeLabel || null,
         type: type || null,
         wt: wt || null,
         id: id || null,

package/skalpel-statusline.mjs

@@ -7,9 +7,11 @@
 //     that verifiably happened, or
 //   • the current steer's plain-English label (what skalpel is doing now) — a description, not a number.
 // A clean session prints NOTHING. Fail-open: any error → print nothing, exit 0. Never blocks the bar.
-import { closeSync, fstatSync, openSync, readFileSync, readSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { tailLines } from "./transcript.mjs";
+import { cleanText } from "./insights.mjs";
 
 const CYAN = "\x1b[36m";
 const BOLD = "\x1b[1m";
@@ -30,37 +32,6 @@ function readPayload() {
   }
 }
 
-// Read only the TAIL of a (possibly large) transcript — the status bar re-renders often, so we never
-// slurp a multi-MB file. Drop the partial first line so JSON.parse only ever sees whole records.
-function tailLines(path, maxBytes) {
-  let fd;
-  try {
-    fd = openSync(path, "r");
-    const size = fstatSync(fd).size;
-    const start = Math.max(0, size - maxBytes);
-    const len = size - start;
-    if (len <= 0) return [];
-    const buf = Buffer.allocUnsafe(len);
-    readSync(fd, buf, 0, len, start);
-    let text = buf.toString("utf8");
-    if (start > 0) {
-      const nl = text.indexOf("\n");
-      if (nl >= 0) text = text.slice(nl + 1);
-    }
-    return text.split("\n").filter(Boolean);
-  } catch {
-    return [];
-  } finally {
-    if (fd !== undefined) {
-      try {
-        closeSync(fd);
-      } catch {
-        /* already closed */
-      }
-    }
-  }
-}
-
 // The re-ask signal, counted from disk: over the last few user turns of THIS session's transcript, how
 // many times did the user INTERRUPT ("[Request interrupted by user]") or fire a short CORRECTION ("no",
 // "still wrong", "that's not it"). Mirrors the per-turn hook's own cascade detector so the number the
@@ -106,7 +77,11 @@ function steerLabel() {
   try {
     const st = JSON.parse(readFileSync(join(homedir(), ".skalpel", "steer.json"), "utf8"));
     const label = st && typeof st === "object" ? st.label : null;
-    return typeof label === "string" && label.trim() ? label.trim() : null;
+    // steer.json's label originates from the hosted graph (server-controlled). The hook sanitizes it at
+    // write time, but this string is about to be written RAW to the live terminal (not JSON-escaped like
+    // the hook's additionalContext), so strip any C0/C1/ESC/DEL + cap length here too — last-line defense.
+    const clean = typeof label === "string" ? cleanText(label).trim() : null;
+    return clean ? clean : null;
   } catch {
     return null;
   }

package/transcript.mjs

@@ -0,0 +1,39 @@
+// transcript.mjs — shared bounded transcript read. Both the per-turn hook and the statusline scan the
+// last few user turns of a (possibly multi-GB) JSONL transcript. A full `readFileSync` has no size or
+// time ceiling — on a long session, a big pasted diff, or a cloud-synced home dir (iCloud/Dropbox
+// placeholder hydration) it can stall for seconds, blowing the hook's single fail-open deadline. This
+// reads ONLY the tail: seek to the last `maxBytes`, drop the partial first line so JSON.parse only ever
+// sees whole records. Constant-ish read time regardless of transcript size. Never throws.
+import { closeSync, fstatSync, openSync, readSync } from "node:fs";
+
+// Read only the TAIL of a (possibly large) transcript. Returns whole lines (partial first line dropped
+// when we didn't start at byte 0), newest content last. On any error → [] (fail-open, same as a slurp
+// that threw). 256 KiB is proven sufficient for the last-6-user-turns scan the callers do.
+export function tailLines(path, maxBytes) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const size = fstatSync(fd).size;
+    const start = Math.max(0, size - maxBytes);
+    const len = size - start;
+    if (len <= 0) return [];
+    const buf = Buffer.allocUnsafe(len);
+    readSync(fd, buf, 0, len, start);
+    let text = buf.toString("utf8");
+    if (start > 0) {
+      const nl = text.indexOf("\n");
+      if (nl >= 0) text = text.slice(nl + 1);
+    }
+    return text.split("\n").filter(Boolean);
+  } catch {
+    return [];
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        /* already closed */
+      }
+    }
+  }
+}