skalpel 4.0.18 → 4.0.20

package/install.mjs

@@ -60,6 +60,8 @@ function stageHookRuntime() {
   copyFileSync(join(PKG_DIR, "incremental-ingest.mjs"), join(HOOKS_DIR, "incremental-ingest.mjs"));
   copyFileSync(join(PKG_DIR, "skalpel-hook-session-end.mjs"), SESSION_END_FILE);
   copyFileSync(join(PKG_DIR, "skalpel-statusline.mjs"), STATUSLINE_FILE);
+  copyFileSync(join(PKG_DIR, "transcript.mjs"), join(HOOKS_DIR, "transcript.mjs")); // hooks import ./transcript.mjs (bounded tail read)
+  copyFileSync(join(PKG_DIR, "verify-shadow.mjs"), join(HOOKS_DIR, "verify-shadow.mjs")); // claim-verification SHADOW worker (spawned by skalpel-hook.mjs)
   copyFileSync(join(PKG_DIR, "auth.mjs"), join(HOOKS_DIR, "auth.mjs")); // hooks import ./auth.mjs
   copyFileSync(join(PKG_DIR, "metrics.mjs"), join(HOOKS_DIR, "metrics.mjs")); // hooks import ./metrics.mjs
   copyFileSync(join(PKG_DIR, "stats.mjs"), join(HOOKS_DIR, "stats.mjs")); // `node ~/.skalpel/hooks/stats.mjs`
@@ -236,8 +238,17 @@ function tomlMark(event, marker) {
   return `${TOML_MARK} ${event} ${marker}`;
 }
 
+// Serialize a value into a TOML basic string. The wired command is `node "<path>"` — it ALWAYS
+// contains double quotes, and on Windows the path is `C:\Users\First Last\...` full of backslashes.
+// A raw `command = "${command}"` embeds those quotes unescaped (the string closes early) AND leaves
+// backslashes as TOML escape sequences (`\U`, `\F`, `\.` are invalid) — either way the WHOLE
+// config.toml fails to parse, so Codex drops all of the user's hooks. Escape `\` first, then `"`.
+function tomlString(value) {
+  return `"${String(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+
 function tomlBlock(event, marker, command) {
-  return `\n${tomlMark(event, marker)}\n[[hooks.${event}]]\n[[hooks.${event}.hooks]]\ntype = "command"\ncommand = "${command}"\ntimeout = 8\n`;
+  return `\n${tomlMark(event, marker)}\n[[hooks.${event}]]\n[[hooks.${event}.hooks]]\ntype = "command"\ncommand = ${tomlString(command)}\ntimeout = 8\n`;
 }
 
 function stripManagedTomlBlocks(txt) {
@@ -451,6 +462,9 @@ function cleanupLocalData() {
     "client.json",
     "doctor.log",
     "hook.log",
+    "verify-shadow.log",
+    "verify-last.json",
+    "verify-shadow.lock",
   ]) {
     rm(join(SKALPEL_DIR, f), f);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.18",
+  "version": "4.0.20",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-hook.mjs

@@ -418,6 +418,32 @@ async function main() {
   const fromCodex = process.env.CODEX_HOME || payload.transcript_path?.includes(".codex");
   const harness = fromClaude ? "claude" : fromCodex ? "codex" : null;
 
+  // CLAIM-VERIFICATION SHADOW (v0, DARK behind SKALPEL_VERIFY_SHADOW=1). When the agent's LAST turn
+  // CLAIMED success ("done / tests pass / fixed"), a DETACHED worker reconstructs the session's OWN most
+  // recent test/build/typecheck/lint command and RE-RUNs it out-of-band to log the real PASS/FAIL the
+  // agent can't forge. LOG ONLY — it writes nothing to this hook's stdout and never blocks the turn (the
+  // re-run, up to 60s, lives in a separate unref'd process). Wrapped so it can never affect the injection.
+  if (process.env.SKALPEL_VERIFY_SHADOW === "1" && payload.transcript_path) {
+    try {
+      const { spawn } = await import("node:child_process");
+      const { fileURLToPath } = await import("node:url");
+      const worker = fileURLToPath(new URL("./verify-shadow.mjs", import.meta.url));
+      const child = spawn(process.execPath, [worker, "--run"], {
+        detached: true,
+        stdio: "ignore",
+        env: {
+          ...process.env,
+          SKALPEL_VERIFY_TRANSCRIPT: payload.transcript_path,
+          SKALPEL_VERIFY_SESSION: String(sessionId || ""),
+          SKALPEL_VERIFY_CWD: payload.cwd || process.cwd(),
+        },
+      });
+      child.unref();
+    } catch {
+      /* the shadow is a bonus; a spawn failure must never touch the hook's output */
+    }
+  }
+
   if (!isRealPrompt(query)) {
     dbg("  -> skipped (not a real prompt)");
     record("prompt", "skipped", null);

package/skalpel-setup.mjs

@@ -51,7 +51,15 @@ const isMain =
 // you in and wired hooks into Claude Code and Codex, having been asked only to print a version.
 // Unknown input must never install. Guarded on isMain so importing this module (install.test.mjs
 // pulls in userTurnCount) can never exit the test runner.
-const KNOWN_SUBS = new Set(["setup", "login", "logout", "uninstall", "autopsy", "__build"]);
+const KNOWN_SUBS = new Set([
+  "setup",
+  "login",
+  "logout",
+  "uninstall",
+  "autopsy",
+  "__build",
+  "__verify-report",
+]);
 const VALUE_FLAGS = new Set(["--api", "--user"]);
 // Boolean flags that take no value. `--purge` on `uninstall` also removes auth + all local data.
 const BOOL_FLAGS = new Set(["--purge"]);
@@ -858,6 +866,14 @@ async function main() {
     spawnSync("node", [join(__dir, "autopsy.mjs"), ...argv.slice(1)], { stdio: "inherit" });
     return;
   }
+  // `skalpel __verify-report` — the claim-verification SHADOW instrument: reads the local
+  // verify-shadow.log and prints the three numbers (claim fire-rate, proof-reconstruction rate, and the
+  // headline MISMATCH rate = how often the agent claimed done but its OWN proof, re-run, failed).
+  // Local, read-only; never signs in, never touches the network.
+  if (sub === "__verify-report") {
+    spawnSync("node", [join(__dir, "verify-shadow.mjs"), "--report"], { stdio: "inherit" });
+    return;
+  }
   // Persist --api/--user to ~/.skalpel/client.json so the hooks can read them without shell-env
   // plumbing (env vars SKALPEL_API / SKALPEL_USER still win at hook runtime).
   if (apiFlag || userFlag) {

package/verify-shadow.mjs

@@ -0,0 +1,804 @@
+#!/usr/bin/env node
+// verify-shadow.mjs — SHADOW claim-verification (v0, DARK by default behind SKALPEL_VERIFY_SHADOW=1).
+//
+// THE PROBLEM: your agent is both the executor AND the reporter of its own work, so when it says
+// "done / tests pass / fixed / it works" nothing independent ever re-checks. skalpel closes that loop:
+// when the agent's last turn CLAIMS success, we reconstruct the PROOF the agent itself ran (its most
+// recent test/build/typecheck/lint command, pulled from the session's OWN prior Bash tool calls — never
+// invented), RE-RUN it out-of-band, and record the real PASS/FAIL the agent cannot forge. The money
+// metric is the MISMATCH rate: how often the agent claimed success but its own proof, re-run, FAILS.
+//
+// SHADOW: this LOGS ONLY. It never injects into the model, never blocks or slows a turn, never writes
+// or deploys anything. The per-turn hook launches it DETACHED (see skalpel-hook.mjs) so the user's turn
+// is never delayed by the (up to 60s) re-run.
+//
+// HARD RED LINES (enforced by construction below):
+//   1. ALLOWLIST ONLY. Only test/build/typecheck/lint binaries re-run (npm/pnpm/yarn test|build|run,
+//      npx tsc|jest|vitest|eslint|biome, pytest, cargo test|build|check|clippy, go test|build|vet,
+//      tsc, jest, vitest, eslint, biome, ruff, mypy, pyright, python -m <allowlisted>). Anything else
+//      is REFUSED. The command never comes from prompt/claim CONTENT — only from the session's own
+//      prior Bash tool_use commands.
+//   2. execFile, NEVER a shell. Args are passed as a literal ARGUMENT ARRAY; there is no shell to
+//      interpret metacharacters, so a crafted string can never be executed as a command. shell:false.
+//   3. HARD TIMEOUT (~60s), bounded output, single-flight lock. FAIL-OPEN: any error → log-or-skip,
+//      never throw, never affect the hook.
+//   4. LOCAL ONLY. Imports only node: core; opens no socket; logs to ~/.skalpel/verify-shadow.log.
+//   5. NO FABRICATED NUMBERS. pass_fail is the real process exit code; evidence is the real tail output.
+import {
+  appendFileSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  statSync,
+  rmSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+import { tailLines } from "./transcript.mjs";
+
+const DIR = join(homedir(), ".skalpel");
+export const VERIFY_LOG_PATH = join(DIR, "verify-shadow.log");
+const LAST_PATH = join(DIR, "verify-last.json");
+const LOCK_PATH = join(DIR, "verify-shadow.lock");
+
+// Re-run budget + read caps. The re-run is out-of-band (detached), so it is NOT on the hook deadline —
+// but it still gets a hard ceiling so a hung test process can never live forever.
+const RERUN_TIMEOUT_MS = 60_000;
+const MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+// The proof command lives near the end of the transcript (the agent runs tests, then claims done). A
+// generous tail is fine here (off the hot path); still bounded so a multi-GB transcript can't OOM us.
+const TRANSCRIPT_TAIL_BYTES = 2 * 1024 * 1024;
+const LOCK_STALE_MS = 90_000;
+
+// ======================= (1) completion-claim detection =======================
+// A deliberately broad lexicon: this is an INSTRUMENT, and the MISMATCH metric is computed only among
+// turns where a proof actually re-ran, so a loose claim match cannot fabricate a "lie" — it can only
+// trigger an honest re-run that PASSES. Recall over precision here is the right trade.
+const CLAIM_RE = new RegExp(
+  [
+    "\\b(all\\s+)?tests?\\s+(are\\s+)?(now\\s+)?(pass|passing|passed|passes|green)\\b",
+    "\\ball\\s+green\\b",
+    "\\bbuild\\s+(passes|passed|succeeds|succeeded|is\\s+green|works|clean)\\b",
+    "\\bbuilds?\\s+(successfully|clean(ly)?)\\b",
+    "\\btypechecks?\\s+(pass(es|ed)?|clean(ly)?)\\b",
+    "\\b(it|that|this|everything)\\s+should\\s+work\\s+now\\b",
+    "\\bworks\\s+now\\b",
+    "\\b(this|that)\\s+should\\s+(fix|resolve|do\\s+it)\\b",
+    "\\b(i('|’)ve|i\\s+have)\\s+(fixed|implemented|resolved|completed|added|finished)\\b",
+    "\\b(now\\s+)?(fixed|implemented|resolved|completed|merged|verified)\\b",
+    "\\b(all\\s+)?done\\b",
+    "\\ball\\s+set\\b",
+    "\\bgood\\s+to\\s+go\\b",
+    "\\bready\\s+(to\\s+(go|merge|ship|review)|now)\\b",
+    "\\blgtm\\b",
+    "\\bpasses?\\s+(now|cleanly)\\b",
+  ].join("|"),
+  "i",
+);
+
+// detectCompletionClaim(text) -> { claim:bool, text:<the claim line, <=120c> }
+export function detectCompletionClaim(text) {
+  const s = typeof text === "string" ? text : "";
+  if (!s.trim()) return { claim: false, text: "" };
+  if (!CLAIM_RE.test(s)) return { claim: false, text: "" };
+  // Prefer the specific line that carries the claim (nicer log evidence than the whole turn).
+  let claimLine = s;
+  for (const line of s.split(/\r?\n/)) {
+    if (CLAIM_RE.test(line)) {
+      claimLine = line.trim();
+      break;
+    }
+  }
+  return { claim: true, text: claimLine.replace(/\s+/g, " ").trim().slice(0, 120) };
+}
+
+// ======================= allowlist (safety-critical) =======================
+// Strip a leading path + a Windows .exe/.cmd suffix so `/usr/local/bin/npx` and `npm.cmd` match by base.
+function cmdBase(cmd) {
+  return String(cmd || "")
+    .split(/[/\\]/)
+    .pop()
+    .replace(/\.(exe|cmd|bat|ps1)$/i, "");
+}
+
+const NODE_PM = new Set(["npm", "pnpm", "yarn"]);
+const JS_TOOLS = new Set(["jest", "vitest", "tsc", "eslint", "biome"]);
+const PY_TOOLS = new Set(["pytest", "ruff", "mypy", "pyright"]);
+const NPX_ALLOWED = new Set(["tsc", "jest", "vitest", "eslint", "biome", "playwright"]);
+const CARGO_SUBS = new Set(["test", "build", "check", "clippy", "nextest"]);
+const GO_SUBS = new Set(["test", "build", "vet"]);
+const PY_M_MODULES = new Set(["pytest", "mypy", "ruff", "unittest", "pyright"]);
+// Allowed npm/pnpm/yarn `run <script>` (and pnpm/yarn shorthand) — test/build/typecheck/lint families only.
+const PM_RUN_SCRIPTS =
+  /^(test|build|typecheck|type-check|tsc|lint|check|check:[\w:-]+|ci|unit|e2e|vitest|jest)$/;
+const PM_VALUE_FLAGS = new Set([
+  "--filter",
+  "-C",
+  "--prefix",
+  "--dir",
+  "-w",
+  "--workspace",
+  "--workspace-root",
+]);
+
+function pmPositionals(args) {
+  const pos = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("-")) {
+      if (PM_VALUE_FLAGS.has(a) && !a.includes("=")) i++; // its value is not a positional
+      continue;
+    }
+    pos.push(a);
+  }
+  return pos;
+}
+
+function validatePM(base, args) {
+  const pos = pmPositionals(args);
+  if (!pos.length) return false;
+  const p0 = pos[0];
+  if (base === "npm") {
+    if (p0 === "test" || p0 === "t") return true;
+    if (p0 === "run" || p0 === "run-script") return !!pos[1] && PM_RUN_SCRIPTS.test(pos[1]);
+    return false; // npm has no bare-script shorthand
+  }
+  // pnpm / yarn
+  if (p0 === "test" || p0 === "build") return true;
+  if (p0 === "run") return !!pos[1] && PM_RUN_SCRIPTS.test(pos[1]);
+  return PM_RUN_SCRIPTS.test(p0); // `pnpm typecheck` / `yarn lint` shorthand
+}
+
+function validateNPX(args) {
+  // SHARP-2: `-p/--package` fetch + INSTALL an arbitrary package (its postinstall script = code
+  // execution) and `-c/--call` execute an arbitrary string. Neither may appear in a proof re-run —
+  // refuse the whole invocation if present (in any `-p x`, `-p=x`, or `--package=x` form). Only a
+  // plain `npx <allowed-tool> [value-less flags]` is a proof.
+  for (const a of args) {
+    if (/^(-p|--package|-c|--call)(=|$)/.test(a)) return false;
+  }
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("-")) continue; // remaining flags are value-less/safe
+    if (/[/\\]/.test(a)) return false; // SHARP-1: the tool npx runs must also be a bare name
+    return NPX_ALLOWED.has(cmdBase(a)); // first positional is the tool npx runs
+  }
+  return false;
+}
+
+function firstSubcommand(args) {
+  for (const a of args) {
+    if (a.startsWith("-") || a.startsWith("+")) continue; // skip flags + cargo toolchain (+nightly)
+    return a;
+  }
+  return null;
+}
+
+function validatePythonM(args) {
+  // SHARP-4 (CRITICAL): `python -c '<code>'` runs INLINE ARBITRARY CODE — and `python -c '…' -m pytest`
+  // slips past a naive `-m` check because python takes the FIRST run-option (-c wins, -m becomes argv).
+  // Refuse any -c, and require -m to be the first run-target (nothing but flags may precede it).
+  if (args.includes("-c")) return false;
+  const mi = args.indexOf("-m");
+  if (mi < 0) return false;
+  for (let i = 0; i < mi; i++) if (!args[i].startsWith("-")) return false; // no script/path before -m
+  return PY_M_MODULES.has(cmdBase(args[mi + 1] || ""));
+}
+
+// SHARP-4: reject flags that point an allowed tool at a manifest/config/tree the attacker chose OUTSIDE
+// the re-run cwd (an absolute path or a `..` escape). Those files are executed as code by the tool
+// (package.json scripts, Cargo build.rs, eslint/jest/vitest config JS). In-tree RELATIVE paths stay
+// allowed; the residual "re-run the session's OWN in-tree project code" is inherent + accepted (dark).
+const TREE_REDIRECT_FLAG = /^(--config|--manifest-path|--prefix|--project|--dir|-C|-c|-p)$/;
+function isPathEscape(v) {
+  return (
+    typeof v === "string" &&
+    v !== "" &&
+    (path.isAbsolute(expandHome(v)) || v.split(/[/\\]/).includes(".."))
+  );
+}
+function argsRedirectOutOfTree(args) {
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    const eq = a.startsWith("-") ? a.indexOf("=") : -1;
+    if (eq > 0) {
+      if (TREE_REDIRECT_FLAG.test(a.slice(0, eq)) && isPathEscape(a.slice(eq + 1))) return true;
+    } else if (TREE_REDIRECT_FLAG.test(a) && isPathEscape(args[i + 1] || "")) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// isAllowedProof(cmd, args) — the single gate every re-run must clear. Returns true ONLY for a
+// test/build/typecheck/lint invocation. Everything else is refused.
+export function isAllowedProof(cmd, args) {
+  const raw = String(cmd || "");
+  // SHARP-1: only a BARE, PATH-resolved command name may re-run. A path-qualified cmd
+  // (./npm, /tmp/evil/jest, node_modules/.bin/vitest) can resolve to a binary planted in an
+  // attacker-influenced cwd while still matching an allowed BASENAME — a basename check is not
+  // enough. Refuse anything containing a path separator so only the real PATH tool executes.
+  if (!raw || /[/\\]/.test(raw)) return false;
+  const base = cmdBase(raw);
+  const a = Array.isArray(args) ? args : [];
+  if (argsRedirectOutOfTree(a)) return false; // SHARP-4: no out-of-tree manifest/config/prefix redirect
+  if (NODE_PM.has(base)) return validatePM(base, a);
+  if (base === "npx") return validateNPX(a);
+  if (JS_TOOLS.has(base) || PY_TOOLS.has(base)) return true; // the binary itself is a proof tool
+  if (base === "cargo") return CARGO_SUBS.has(firstSubcommand(a));
+  if (base === "go") {
+    // SHARP-4 (HIGH): -exec/-toolexec/-vettool run an ARBITRARY external program during test/build/vet.
+    if (a.some((x) => /^--?(exec|toolexec|vettool)(=|$)/.test(x))) return false;
+    return GO_SUBS.has(firstSubcommand(a));
+  }
+  if (base === "python" || /^python3(\.\d+)?$/.test(base)) return validatePythonM(a);
+  return false;
+}
+
+// ======================= (2) proof reconstruction =======================
+// Quote-aware tokenizer that ALSO splits on unquoted shell operators (&&, ||, ;, |, &, newline). Used
+// only to LOCATE an allowlisted invocation inside a real shell command — never to execute. Redirections
+// are left as ordinary tokens and stripped in cleanSegment. Returns an array of segments (token arrays).
+function splitSegments(command) {
+  const segments = [];
+  let seg = [];
+  let cur = "";
+  let has = false;
+  let q = null; // "'" or '"'
+  const endTok = () => {
+    if (has) {
+      seg.push(cur);
+      cur = "";
+      has = false;
+    }
+  };
+  const endSeg = () => {
+    endTok();
+    if (seg.length) segments.push(seg);
+    seg = [];
+  };
+  const src = String(command);
+  for (let i = 0; i < src.length; i++) {
+    const ch = src[i];
+    if (q) {
+      if (ch === q) q = null;
+      else if (ch === "\\" && q === '"' && i + 1 < src.length) cur += src[++i];
+      else cur += ch;
+      has = true;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      q = ch;
+      has = true;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < src.length) {
+      cur += src[++i];
+      has = true;
+      continue;
+    }
+    if (ch === "\n" || ch === ";") {
+      endSeg();
+      continue;
+    }
+    if (ch === "&") {
+      if (src[i + 1] === "&") i++;
+      endSeg();
+      continue;
+    }
+    if (ch === "|") {
+      if (src[i + 1] === "|") i++;
+      endSeg();
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      endTok();
+      continue;
+    }
+    cur += ch;
+    has = true;
+  }
+  endSeg();
+  return segments;
+}
+
+// Strip leading `VAR=value` env-assignments and redirection tokens (`2>&1`, `>out`, `>` `file`, …).
+function cleanSegment(tokens) {
+  let i = 0;
+  while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i++; // env prefix
+  const rest = tokens.slice(i);
+  const out = [];
+  for (let j = 0; j < rest.length; j++) {
+    const t = rest[j];
+    if (/^(\d+)?[<>]{1,2}$/.test(t)) {
+      j++; // bare redirection operator — also drop its target filename
+      continue;
+    }
+    if (/^(\d+)?[<>]/.test(t)) continue; // self-contained redirection: 2>&1, 2>/dev/null, >out.txt
+    if (t === "&") continue;
+    out.push(t);
+  }
+  return out;
+}
+
+// Expand only $HOME / ${HOME} / a leading ~ (safe, no shell). Other $VARs are left literal → if the dir
+// doesn't exist the re-run fails open (logged), never executes anything.
+function expandHome(p) {
+  let s = String(p);
+  s = s.replace(/\$\{HOME\}|\$HOME/g, homedir());
+  if (s === "~" || s.startsWith("~/")) s = homedir() + s.slice(1);
+  return s;
+}
+
+function resolveCd(baseCwd, dir) {
+  const d = expandHome(dir);
+  return path.isAbsolute(d) ? path.normalize(d) : path.resolve(baseCwd || process.cwd(), d);
+}
+
+// parseCommandForProof(command, baseCwd) -> { cmd, args, cwd } | null
+// Walks the segments of ONE shell command; honors a leading `cd <dir>` (sets the re-run cwd) and returns
+// the first allowlisted invocation found. Args are the cleaned literal tokens (no shell interpretation).
+export function parseCommandForProof(command, baseCwd) {
+  if (!command || typeof command !== "string") return null;
+  let cwd = baseCwd || process.cwd();
+  for (const rawTokens of splitSegments(command)) {
+    const toks = cleanSegment(rawTokens);
+    if (!toks.length) continue;
+    if (toks[0] === "cd" && toks[1]) {
+      cwd = resolveCd(cwd, toks[1]);
+      continue; // the actual proof command is a later segment
+    }
+    const cmd = toks[0];
+    const args = toks.slice(1, 65).map((t) => String(t).slice(0, 4096)); // bound arg count + length
+    if (isAllowedProof(cmd, args)) return { cmd, args, cwd };
+  }
+  return null;
+}
+
+// Pull the Bash command strings from one Claude transcript entry (assistant message with tool_use Bash).
+// Carries the tool_use `id` so a later tool_result can be matched back to it (SHARP-3 denial check).
+function bashCommandsFromEntry(entry) {
+  const out = [];
+  const c = entry?.message?.content;
+  if (!Array.isArray(c)) return out;
+  for (const b of c) {
+    if (b && b.type === "tool_use" && b.name === "Bash" && typeof b.input?.command === "string") {
+      out.push({ command: b.input.command, cwd: entry.cwd || null, id: b.id || null });
+    }
+  }
+  return out;
+}
+
+// SHARP-3: a tool_result whose text says the user DENIED / interrupted the tool — the command never
+// actually executed, so we must not re-run it out-of-band. Deliberately narrow to Claude Code's real
+// rejection/interrupt sentinels. NOTE: a command that RAN and exited non-zero is NOT a denial — its
+// tool_result carries the real test output, and those failures are exactly the mismatches we DO re-run.
+// ANCHORED to the START of the result: a Claude Code denial/interrupt result BEGINS with one of these
+// sentinels. Anchoring is critical — an unanchored match would fire on ordinary test OUTPUT that merely
+// CONTAINS "user denied"/"cancelled by user" (e.g. Skalpel's own auth tests), silently discarding a real
+// failing-proof mismatch (the money case) and letting an adversarial agent print such a line to dodge us.
+const DENIAL_RE =
+  /^\s*(\[request interrupted by user|the user doesn'?t want to (proceed|take this action)|tool use was rejected|operation (was )?(interrupted|aborted|cancell?ed) by (the )?user)/i;
+
+function resultTextOf(block) {
+  const c = block?.content;
+  if (typeof c === "string") return c;
+  if (Array.isArray(c)) return c.map((x) => (typeof x === "string" ? x : x?.text || "")).join(" ");
+  return "";
+}
+
+// Set of tool_use ids whose result was a user denial/interrupt (never executed) — skipped as proofs.
+function deniedToolUseIds(entries) {
+  const denied = new Set();
+  for (const e of entries) {
+    const c = e?.message?.content;
+    if (!Array.isArray(c)) continue;
+    for (const b of c) {
+      if (b && b.type === "tool_result" && b.tool_use_id && DENIAL_RE.test(resultTextOf(b))) {
+        denied.add(b.tool_use_id);
+      }
+    }
+  }
+  return denied;
+}
+
+// reconstructProof(entries, cwd) -> { cmd, args, cwd } | null
+// The MOST RECENT test/build/typecheck/lint command the session actually ran. Scans newest→oldest; the
+// entry's own recorded cwd is the base (a `cd` inside the command still overrides it). SHARP-3: a
+// command the user DENIED (never ran) is skipped — we only re-run what the session actually executed.
+export function reconstructProof(entries, cwd) {
+  const list = Array.isArray(entries) ? entries : [];
+  const denied = deniedToolUseIds(list);
+  for (let i = list.length - 1; i >= 0; i--) {
+    const cmds = bashCommandsFromEntry(list[i]);
+    for (let k = cmds.length - 1; k >= 0; k--) {
+      // SHARP-3: skip a user-DENIED command. If a tool_use has an id, skip iff that id was denied.
+      // If it has NO id we can't link it to a result — so if the transcript contains ANY denial we
+      // conservatively skip (can't prove this wasn't the denied one). Real Claude Code tool_uses
+      // always carry an id, so this only bites pathological/synthetic transcripts.
+      const id = cmds[k].id;
+      if (id ? denied.has(id) : denied.size > 0) continue;
+      const proof = parseCommandForProof(cmds[k].command, cmds[k].cwd || cwd);
+      if (proof) return proof;
+    }
+  }
+  return null;
+}
+
+// Classify a re-run into PASS / GENUINE_FAIL / HARNESS_ERROR. This is what keeps the money metric HONEST:
+// only a GENUINE_FAIL (the test/build itself ran and reported failure) may count as "the agent lied".
+// A HARNESS_ERROR (timeout, missing binary/script, wrong cwd — the PROOF machinery broke, not the code)
+// must NEVER be shown as a lie. Real-data measurement showed 6/6 raw "mismatches" were harness noise
+// (a 3-min lint timeout, a missing lint script, a wrong-cwd eslint) — counting those would cry wolf and
+// burn the whole point of an honesty product.
+function classifyOutcome(err, evidence) {
+  if (!err) return "PASS";
+  if (err.killed || err.signal === "SIGTERM") return "HARNESS_ERROR"; // hit the timeout
+  if (err.code === "ENOENT") return "HARNESS_ERROR"; // binary/cwd does not exist
+  const exit = typeof err.code === "number" ? err.code : null;
+  if (exit === 127 || exit === 126) return "HARNESS_ERROR"; // command not found / not executable
+  if (
+    /\bno such file or directory\b|\bENOENT\b|\bcommand not found\b|missing script|no [a-z:-]{1,24} script|npm err!.*missing script/i.test(
+      String(evidence || ""),
+    )
+  )
+    return "HARNESS_ERROR"; // the proof harness itself is broken, not the work
+  return "GENUINE_FAIL"; // a real non-zero exit from the test/build/lint itself
+}
+
+// ======================= (3) re-run the proof =======================
+// rerunProof({cmd,args,cwd}) -> Promise<{ pass, outcome, evidence, refused? }>
+// outcome ∈ {PASS, GENUINE_FAIL, HARNESS_ERROR, REFUSED}. execFile with an ARGUMENT ARRAY and NO shell.
+// Re-validates the allowlist (defense in depth). Never throws.
+export function rerunProof({ cmd, args, cwd }) {
+  const a = Array.isArray(args) ? args : [];
+  if (!isAllowedProof(cmd, a)) {
+    return Promise.resolve({
+      pass: false,
+      outcome: "REFUSED",
+      refused: true,
+      evidence: "refused: not on allowlist",
+    });
+  }
+  return new Promise((resolve) => {
+    let done = false;
+    const finish = (r) => {
+      if (done) return;
+      done = true;
+      resolve(r);
+    };
+    try {
+      execFile(
+        cmd,
+        a,
+        {
+          cwd: cwd || process.cwd(),
+          timeout: RERUN_TIMEOUT_MS,
+          maxBuffer: MAX_OUTPUT_BYTES,
+          windowsHide: true,
+          shell: false, // RED LINE: never a shell
+          env: process.env,
+        },
+        (err, stdout, stderr) => {
+          const tail = (String(stdout || "") + String(stderr || "")).replace(/\s+$/, "");
+          let evidence = tail.slice(-200) || (err ? String(err.message).slice(-200) : "");
+          if (!err) return finish({ pass: true, outcome: "PASS", evidence });
+          if (err.killed || err.signal === "SIGTERM")
+            evidence = `timeout after ${RERUN_TIMEOUT_MS}ms; ${evidence}`.slice(-200);
+          const outcome = classifyOutcome(err, evidence);
+          return finish({
+            pass: false,
+            outcome,
+            evidence: evidence || String(err.message).slice(-200),
+          });
+        },
+      );
+    } catch (e) {
+      finish({
+        pass: false,
+        outcome: "HARNESS_ERROR",
+        evidence: `spawn error: ${String(e && e.message).slice(-180)}`,
+      });
+    }
+  });
+}
+
+// ======================= (4) wire it: shadow-log a claim turn =======================
+function readEntries(transcriptPath) {
+  try {
+    const lines = tailLines(transcriptPath, TRANSCRIPT_TAIL_BYTES);
+    const entries = [];
+    for (const line of lines) {
+      try {
+        entries.push(JSON.parse(line));
+      } catch {
+        /* partial/garbage line — skip */
+      }
+    }
+    return entries;
+  } catch {
+    return [];
+  }
+}
+
+// The agent's LAST assistant prose (the claim lives here). Concatenates text blocks of the final
+// assistant turn found scanning newest→oldest.
+function lastAssistantText(entries) {
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const e = entries[i];
+    if (e?.type !== "assistant" && e?.message?.role !== "assistant") continue;
+    const c = e?.message?.content;
+    let text = "";
+    if (typeof c === "string") text = c;
+    else if (Array.isArray(c))
+      text = c
+        .filter((b) => b && b.type === "text")
+        .map((b) => b.text || "")
+        .join(" ");
+    text = text.trim();
+    if (text) return text;
+  }
+  return "";
+}
+
+function djb2(s) {
+  let h = 5381;
+  for (let i = 0; i < s.length; i++) h = ((h << 5) + h + s.charCodeAt(i)) & 0xffffffff;
+  return (h >>> 0).toString(36);
+}
+
+// Dedup: don't re-run the same (session, claim) twice — guards double hook fires and repeated prompts
+// that still see the same prior assistant turn. Best-effort; a miss just means one extra honest re-run.
+function alreadyVerified(sig) {
+  try {
+    return JSON.parse(readFileSync(LAST_PATH, "utf8"))?.sig === sig;
+  } catch {
+    return false;
+  }
+}
+function markVerified(sig) {
+  try {
+    mkdirSync(DIR, { recursive: true });
+    const tmp = `${LAST_PATH}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ sig, ts: Date.now() }));
+    renameSync(tmp, LAST_PATH);
+  } catch {
+    /* dedup is a bonus */
+  }
+}
+
+// Single-flight: only one shadow re-run at a time (a burst of prompts must not spawn parallel test runs).
+function acquireLock() {
+  try {
+    mkdirSync(DIR, { recursive: true });
+    try {
+      const st = statSync(LOCK_PATH);
+      if (Date.now() - st.mtimeMs < LOCK_STALE_MS) return false; // fresh lock held
+    } catch {
+      /* no lock yet */
+    }
+    writeFileSync(LOCK_PATH, String(process.pid));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function releaseLock() {
+  try {
+    rmSync(LOCK_PATH, { force: true });
+  } catch {
+    /* best-effort — a stale lock self-expires after LOCK_STALE_MS */
+  }
+}
+
+const LOG_MAX_BYTES = 1024 * 1024;
+const LOG_KEEP_LINES = 500;
+function appendShadowLog(row) {
+  try {
+    mkdirSync(DIR, { recursive: true });
+    try {
+      if (statSync(VERIFY_LOG_PATH).size > LOG_MAX_BYTES) {
+        const kept = readFileSync(VERIFY_LOG_PATH, "utf8")
+          .trim()
+          .split("\n")
+          .filter(Boolean)
+          .slice(-LOG_KEEP_LINES);
+        const tmp = `${VERIFY_LOG_PATH}.tmp`;
+        writeFileSync(tmp, kept.join("\n") + "\n");
+        renameSync(tmp, VERIFY_LOG_PATH);
+      }
+    } catch {
+      /* no file yet or trim failed — still append */
+    }
+    appendFileSync(VERIFY_LOG_PATH, JSON.stringify(row) + "\n");
+  } catch {
+    /* never throw from the shadow path */
+  }
+}
+
+// recordVerifyShadow({transcriptPath, session, cwd}) — the wired entry. On (claim + reconstructable
+// proof) it re-runs the proof and appends one shadow row. LOG ONLY. Never injects, never throws.
+export async function recordVerifyShadow({ transcriptPath, session, cwd }) {
+  try {
+    if (!transcriptPath) return;
+    const entries = readEntries(transcriptPath);
+    if (!entries.length) return;
+    const { claim, text } = detectCompletionClaim(lastAssistantText(entries));
+    if (!claim) return; // no claim this turn → nothing to verify (keeps the log claim-only)
+
+    const sig = `${session || ""}|${djb2(text)}`;
+    if (alreadyVerified(sig)) return;
+
+    const proof = reconstructProof(entries, cwd);
+    // No re-runnable proof existed — still record the claim so the analyzer can compute the
+    // proof-reconstruction success rate (claims WITH a proof / all claims).
+    if (!proof) {
+      markVerified(sig);
+      appendShadowLog({
+        ts: new Date().toISOString(),
+        session: session || null,
+        claim_text: text,
+        proof_command: null,
+        pass_fail: null,
+        mismatch: false,
+        evidence: "",
+      });
+      return;
+    }
+
+    // A proof exists → re-run it, but only one at a time.
+    if (!acquireLock()) return; // another shadow run is in flight; skip (fail-open, no pile-up)
+    let result;
+    try {
+      result = await rerunProof(proof);
+    } finally {
+      releaseLock();
+    }
+    markVerified(sig);
+    const outcome = result.outcome || (result.pass ? "PASS" : "GENUINE_FAIL");
+    // pass_fail is PASS/FAIL for a real run; HARNESS_ERROR is neither (the proof machinery broke, not
+    // the work) so it is NOT counted in the mismatch metric — only a GENUINE_FAIL is "the agent lied".
+    const pass_fail =
+      outcome === "PASS" ? "PASS" : outcome === "GENUINE_FAIL" ? "FAIL" : "HARNESS_ERROR";
+    appendShadowLog({
+      ts: new Date().toISOString(),
+      session: session || null,
+      claim_text: text,
+      proof_command: [proof.cmd, ...proof.args].join(" ").slice(0, 200),
+      pass_fail,
+      outcome,
+      mismatch: claim && outcome === "GENUINE_FAIL", // THE money metric: claimed done, own test REALLY failed
+      evidence: String(result.evidence || "").slice(0, 200),
+    });
+  } catch {
+    /* SHADOW: any failure is swallowed — this must never affect the hook or the turn */
+  }
+}
+
+// ======================= analyzer: `skalpel __verify-report` =======================
+// Reads verify-shadow.log (+ metrics.ndjson for the total-turn denominator) and prints the three
+// instrument numbers. Returns the report string (also used by tests).
+export function renderVerifyReport() {
+  let rows = [];
+  try {
+    rows = readFileSync(VERIFY_LOG_PATH, "utf8")
+      .trim()
+      .split("\n")
+      .filter(Boolean)
+      .map((l) => {
+        try {
+          return JSON.parse(l);
+        } catch {
+          return null;
+        }
+      })
+      .filter(Boolean);
+  } catch {
+    return `no claim-verification shadow data yet (${VERIFY_LOG_PATH})\n\nEnable the shadow with SKALPEL_VERIFY_SHADOW=1, then keep coding — every turn your agent claims "done / tests pass" gets its own proof re-run and logged here.`;
+  }
+
+  const claims = rows.length;
+  const withProof = rows.filter((r) => r.proof_command).length;
+  // Genuine re-runs only (PASS or a real test FAIL). HARNESS_ERROR rows (timeout, missing script, wrong
+  // cwd) are EXCLUDED from the mismatch denominator — the proof machinery broke, not the agent's work.
+  const reran = rows.filter((r) => r.pass_fail === "PASS" || r.pass_fail === "FAIL").length;
+  const harnessErrors = rows.filter(
+    (r) => r.pass_fail === "HARNESS_ERROR" || r.outcome === "HARNESS_ERROR",
+  ).length;
+  const mismatches = rows.filter((r) => r.mismatch === true).length;
+
+  // Denominator for claim fire-rate: total prompt turns the hook saw (metrics.ndjson prompt events).
+  let promptTurns = 0;
+  try {
+    for (const l of readFileSync(join(DIR, "metrics.ndjson"), "utf8").trim().split("\n")) {
+      try {
+        if (JSON.parse(l)?.event === "prompt") promptTurns++;
+      } catch {
+        /* skip */
+      }
+    }
+  } catch {
+    /* no metrics — claim fire-rate denominator unknown */
+  }
+
+  const pct = (n, d) => (d > 0 ? `${((100 * n) / d).toFixed(1)}%` : "n/a");
+  const L = [];
+  L.push("");
+  L.push("skalpel — claim-verification SHADOW (does the agent's own proof back up its claim?)");
+  L.push("─".repeat(72));
+  L.push(`  claim turns logged                 ${claims}`);
+  L.push(
+    `  (1) claim fire-rate                ${pct(claims, promptTurns)}   ${claims}/${promptTurns || "?"} prompt turns claimed success`,
+  );
+  L.push(
+    `  (2) proof-reconstruction rate      ${pct(withProof, claims)}   ${withProof}/${claims} claims had a re-runnable proof`,
+  );
+  L.push(
+    `  (3) MISMATCH rate                  ${pct(mismatches, reran)}   ${mismatches}/${reran} re-run proofs GENUINELY failed after a success claim`,
+  );
+  L.push(
+    `      (excluded: ${harnessErrors} harness error(s) — timeout/missing-script/wrong-cwd, not counted as a lie)`,
+  );
+  L.push("─".repeat(72));
+  L.push(
+    `      ${mismatches} time(s) the agent claimed done but its own proof, re-run, did NOT pass.`,
+  );
+  // Show the most recent few mismatches concretely (the receipt).
+  const recentMismatch = rows
+    .filter((r) => r.mismatch)
+    .slice(-3)
+    .reverse();
+  if (recentMismatch.length) {
+    L.push("");
+    L.push("  recent mismatches:");
+    for (const r of recentMismatch) {
+      L.push(`    • claim: ${String(r.claim_text || "").slice(0, 68)}`);
+      L.push(`      proof: ${String(r.proof_command || "").slice(0, 68)}  → FAIL`);
+      if (r.evidence) L.push(`      ${String(r.evidence).slice(0, 68)}`);
+    }
+  }
+  L.push("");
+  L.push(
+    "  SHADOW mode: logged locally only — never injected into the model, never blocks a turn.",
+  );
+  L.push("");
+  return L.join("\n");
+}
+
+// CLI: `node verify-shadow.mjs --run`  → detached worker launched by the per-turn hook.
+//      `node verify-shadow.mjs --report`→ print the instrument (also reachable via `skalpel __verify-report`).
+// Robust main detection (mirrors skalpel-setup.mjs): compare REAL paths, not a hand-built file:// URL —
+// the staged path lives under the home dir, which on macOS/Windows can contain a space that would break
+// `new URL("file://"+path)` and wrongly disable the CLI. Importing this module (tests) never trips it.
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  const arg = process.argv[2];
+  if (arg === "--report") {
+    process.stdout.write(renderVerifyReport() + "\n");
+    process.exit(0);
+  } else if (arg === "--run") {
+    recordVerifyShadow({
+      transcriptPath: process.env.SKALPEL_VERIFY_TRANSCRIPT || null,
+      session: process.env.SKALPEL_VERIFY_SESSION || null,
+      cwd: process.env.SKALPEL_VERIFY_CWD || process.cwd(),
+    })
+      .then(() => process.exit(0))
+      .catch(() => process.exit(0));
+  } else {
+    process.exit(0);
+  }
+}