skalpel 4.0.21 → 4.0.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.21",
+  "version": "4.0.23",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/stats.mjs

@@ -63,9 +63,8 @@ for (const ev of Object.keys(counts)) {
   }
   const L = lat[ev] || [];
   if (L.length) {
-    console.log(
-      `    latency        p50=${pct(L, 50)}ms  p95=${pct(L, 95)}ms  max=${Math.max(...L)}ms`,
-    );
+    const maxMs = L.reduce((a, b) => (b > a ? b : a), -Infinity);
+    console.log(`    latency        p50=${pct(L, 50)}ms  p95=${pct(L, 95)}ms  max=${maxMs}ms`);
   }
   console.log(
     `    → inject rate ${((100 * ok) / n).toFixed(1)}%   cold-abort rate ${((100 * cold) / n).toFixed(1)}%\n`,

package/verify-shadow.mjs

@@ -139,7 +139,14 @@ function pmPositionals(args) {
   return pos;
 }
 
+// SHARP-5: `--node-options` (npm/pnpm/yarn config flag) is passed through to the lifecycle script's
+// node as NODE_OPTIONS, so `--node-options=--require <any>.js` loads attacker JS before the test runs —
+// arbitrary code execution, exactly the SHARP-2 class but via the PM itself. shell:false does NOT help
+// (the PM applies the flag). Refuse the whole invocation if it appears, in any `=`/space form.
+const NODE_OPTIONS_FLAG = /^--node-options(=|$)/;
+
 function validatePM(base, args) {
+  if (args.some((x) => NODE_OPTIONS_FLAG.test(x))) return false; // SHARP-5
   const pos = pmPositionals(args);
   if (!pos.length) return false;
   const p0 = pos[0];
@@ -161,6 +168,7 @@ function validateNPX(args) {
   // plain `npx <allowed-tool> [value-less flags]` is a proof.
   for (const a of args) {
     if (/^(-p|--package|-c|--call)(=|$)/.test(a)) return false;
+    if (NODE_OPTIONS_FLAG.test(a)) return false; // SHARP-5: npx also forwards --node-options → NODE_OPTIONS
   }
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
@@ -482,7 +490,10 @@ export function rerunProof({ cmd, args, cwd }) {
           maxBuffer: MAX_OUTPUT_BYTES,
           windowsHide: true,
           shell: false, // RED LINE: never a shell
-          env: process.env,
+          // SHARP-5 (defense in depth): neutralize NODE_OPTIONS so neither a `--node-options` flag the
+          // allowlist somehow let through, nor an inherited NODE_OPTIONS in the parent env, can inject a
+          // `--require <attacker>.js` into the proof tool's node process.
+          env: { ...process.env, NODE_OPTIONS: "" },
         },
         (err, stdout, stderr) => {
           const tail = (String(stdout || "") + String(stderr || "")).replace(/\s+$/, "");