skalpel 4.0.22 → 4.0.24

package/install.mjs

@@ -299,13 +299,17 @@ function stripManagedTomlBlocks(txt) {
 
 function codexToml() {
   if (!existsSync(CODEX_DIR)) return "no-codex";
-  const txt = existsSync(CODEX_TOML) ? readFileSync(CODEX_TOML, "utf8") : "";
+  const hadToml = existsSync(CODEX_TOML);
+  const txt = hadToml ? readFileSync(CODEX_TOML, "utf8") : "";
   // Strip current managed blocks and older unmanaged skalpel blocks, so setup heals stale Codex
   // configs that still point at bare PATH commands from pre-staged installs.
   const stripped = stripManagedTomlBlocks(txt);
   let next = stripped.text.replace(/\n{3,}/g, "\n\n").trimEnd();
   if (uninstall) {
-    writeFileSync(CODEX_TOML, next + "\n");
+    // Only rewrite a config.toml that already existed — never CREATE one during an uninstall. A user
+    // with ~/.codex but no config.toml has nothing of ours to strip, so writing `next + "\n"` here
+    // would leave a stray 1-byte file behind an operation that's supposed to clean up.
+    if (hadToml) writeFileSync(CODEX_TOML, next + "\n");
     return stripped.removed ? "removed" : "absent";
   }
   mkdirSync(CODEX_DIR, { recursive: true });
@@ -450,6 +454,7 @@ function cleanupLocalData() {
   rm(join(SKALPEL_DIR, "hooks"), "staged hooks");
   rm(join(SKALPEL_DIR, "ingest-outbox"), "raw transcript snapshots (ingest-outbox)");
   for (const f of [
+    "stats.json", // legacy "time saved" accumulator — nothing writes it now, but old installs left one
     "session.json",
     "steer.json",
     "traj.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.22",
+  "version": "4.0.24",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-setup.mjs

@@ -30,7 +30,9 @@ const argv = process.argv.slice(2);
 const sub = argv[0] && !argv[0].startsWith("-") ? argv[0] : null;
 const flagOf = (name) => {
   const i = argv.indexOf(name);
-  return i >= 0 && argv[i + 1] ? argv[i + 1] : null;
+  // A flag-looking next token is a missing value, not the value — never swallow it (would poison
+  // client.json and let `--api --version` fall through to a full install).
+  return i >= 0 && argv[i + 1] && !argv[i + 1].startsWith("-") ? argv[i + 1] : null;
 };
 const apiFlag = flagOf("--api");
 const userFlag = flagOf("--user");
@@ -92,7 +94,9 @@ function validateArgv() {
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (VALUE_FLAGS.has(a)) {
-      i++; // its value is not a token to validate
+      // Only skip a real value; a following flag (-v/--version/--help/unknown) is a missing value
+      // and must still be validated/handled, not eaten.
+      if (argv[i + 1] && !argv[i + 1].startsWith("-")) i++;
       continue;
     }
     if (a === "-v" || a === "--version") {

package/stats.mjs

@@ -63,9 +63,8 @@ for (const ev of Object.keys(counts)) {
   }
   const L = lat[ev] || [];
   if (L.length) {
-    console.log(
-      `    latency        p50=${pct(L, 50)}ms  p95=${pct(L, 95)}ms  max=${Math.max(...L)}ms`,
-    );
+    const maxMs = L.reduce((a, b) => (b > a ? b : a), -Infinity);
+    console.log(`    latency        p50=${pct(L, 50)}ms  p95=${pct(L, 95)}ms  max=${maxMs}ms`);
   }
   console.log(
     `    → inject rate ${((100 * ok) / n).toFixed(1)}%   cold-abort rate ${((100 * cold) / n).toFixed(1)}%\n`,