skalpel 4.0.36 → 4.0.37

package/autopsy.mjs

@@ -275,6 +275,7 @@ function parseClaudeSession(file, rootDir) {
       turns.push({
         session_id: sessionId,
         root: rootDir,
+        rootRaw: typeof o.cwd === "string" && o.cwd ? o.cwd : null, // real cwd for same-file identity
         role,
         turn_idx: idx++,
         ts: o.timestamp || null,
@@ -365,6 +366,7 @@ function parseCodexSession(file) {
   const turns = raw.map((t, idx) => ({
     session_id: sessionId,
     root: rootDir,
+    rootRaw: cwd || null, // real cwd from session_meta.payload.cwd for same-file identity
     role: t.role,
     turn_idx: idx,
     ts: t.ts,
@@ -696,18 +698,22 @@ function projTail(root) {
 // SAME ACTUAL FILE — not a shared basename. Returns a normalized absolute path, or null when the
 // mention cannot be pinned to a real file:
 //   • absolute path in the text        → that path IS the identity (works across every vendor).
-//   • relative path WITH a directory    → resolved against the session's project root (cwd), but ONLY
-//                                         when that root is a real project (never the home catch-all,
-//                                         and never Cursor's rootless bubbles) — otherwise unknowable.
+//   • relative path WITH a directory    → resolved against the session's RAW project cwd (rootRaw), but
+//                                         ONLY when that cwd is known and is a real project (never the
+//                                         home catch-all, and never Cursor's rootless bubbles) —
+//                                         otherwise unknowable.
 //   • bare basename (no directory)      → null. A basename alone can never prove same-file.
-function resolveFileIdentity(rawPath, abs, root) {
+// NOTE: identity MUST anchor on the raw, undecoded cwd — never decodeRoot(), whose lossy `-`→`/`
+// round-trip can fabricate a path that is not on disk (a hyphen in a real dir name becomes a
+// separator) or false-join two distinct projects whose decoded forms collide. decodeRoot stays for
+// DISPLAY labels only.
+function resolveFileIdentity(rawPath, abs, rootRaw) {
   if (!rawPath) return null;
   if (abs) return path.posix.normalize("/" + rawPath.replace(/^\/+/, ""));
   if (!rawPath.includes("/")) return null; // bare basename — not a same-file proof
   if (/^\.\.?\//.test(rawPath)) return null; // "./x" or "../x": ambiguous relative to an unknown subdir
-  const base = decodeRoot(root); // "" when root is null (Cursor) or unknown
-  if (!base || base === HOME) return null; // no real project root to anchor a relative path against
-  return path.posix.normalize(base.replace(/\/+$/, "") + "/" + rawPath);
+  if (!rootRaw || rootRaw === HOME) return null; // cwd unknown (Cursor/Aider) or home catch-all — unknowable
+  return path.posix.normalize(rootRaw.replace(/\/+$/, "") + "/" + rawPath);
 }
 // Detect any email (incl. TLDs truncated by the 200-char span slice, e.g. "name@host.c" or "name@host").
 const EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9][A-Za-z0-9.-]*/g;
@@ -1073,7 +1079,7 @@ async function main() {
         if (errOnly && !kind.startsWith("err")) continue;
         // ---- same-file identity index (message text only; tool output is skipped above) ----
         if (kind === "sym:file") {
-          const identity = resolveFileIdentity(ex.rawPath, ex.abs, turn.root);
+          const identity = resolveFileIdentity(ex.rawPath, ex.abs, turn.rootRaw);
           if (identity) {
             if (!filePathMap.has(identity))
               filePathMap.set(identity, { basename: anchor, byTool: new Map() });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.36",
+  "version": "4.0.37",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/reveal.mjs

@@ -8,9 +8,10 @@
 // Tone: this is the first time the user is seeing what skalpel learned about them, so the note directs
 // the model to TEACH them their own pattern in plain, warm English — never the internal notation, never
 // a stats dump.
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { REVEAL_PATH, revealEnabled, cleanText } from "./insights.mjs";
 
 export function graphReadyNote() {
   const p = join(homedir(), ".skalpel", "insights-ready.json");
@@ -78,3 +79,83 @@ export function graphReadyNote() {
     `actually asked. Keep the whole thing short and human.]`
   );
 }
+
+// ---- verify catch: the AGENT-facing half of the opt-in "aha catch" (SKALPEL_VERIFY_REVEAL) ----------
+//
+// verify-shadow.mjs re-runs the agent's OWN cited proof out of band; on a GENUINE_FAIL mismatch (it
+// claimed "done", its own test/build REALLY failed) it writes ~/.skalpel/verify-reveal.json. The
+// statusline renders that catch as an AMBIENT line the USER can miss within its TTL. This surfaces the
+// SAME catch to the AGENT deterministically, in the NEXT turn's additionalContext, so the model corrects
+// itself instead of standing by a false "done" — the mechanical nudge, not a line someone has to notice.
+//
+// The notified marker: the reveal file records the ts of the failing re-run; we remember the last ts we
+// told the agent about so each distinct catch fires EXACTLY ONCE. It therefore persists across turns until
+// it is injected once OR verify-shadow retracts the reveal on a later PASS — never a 90s TTL that lapses
+// unseen. Scoped to the SAME session that produced the claim, so a stale cross-session catch never fires.
+const NOTIFIED_PATH = join(homedir(), ".skalpel", "verify-reveal-notified.json");
+
+// verifyCatchNote(env, sessionId) -> the bracketed model directive, or null.
+// HONESTY RED LINES (mirrors verify-shadow's reveal): every word traces to the REAL reveal record —
+// the real claim text, the real reconstructed proof command, the real captured failure tail, and a
+// failing COUNT only when the runner actually printed one (r.fail_count is null otherwise). NO fabricated
+// numbers. HARNESS_ERROR (timeout / missing script / wrong cwd) never reaches the reveal file, so this
+// never cries wolf. GATED on SKALPEL_VERIFY_REVEAL: OFF (default) → returns null BEFORE touching disk, so
+// the hook's additionalContext stays byte-identical. Fail-open: any error → null.
+export function verifyCatchNote(env, sessionId) {
+  try {
+    if (!revealEnabled(env)) return null; // opt-in; default OFF → byte-identical, no disk touch
+    let r;
+    try {
+      r = JSON.parse(readFileSync(REVEAL_PATH, "utf8"));
+    } catch {
+      return null; // no catch pending
+    }
+    if (!r || typeof r !== "object" || !r.ts) return null;
+    // Only tell the AGENT about a catch from ITS OWN session — never a stale cross-session one.
+    const sid = sessionId ? String(sessionId) : "";
+    if (!sid || !r.session || String(r.session) !== sid) return null;
+    // Fire at most once per distinct catch (keyed by the failing re-run's ts).
+    try {
+      if (JSON.parse(readFileSync(NOTIFIED_PATH, "utf8"))?.ts === r.ts) return null;
+    } catch {
+      /* no marker yet — first time we've seen this catch */
+    }
+    // Record that we've now notified the agent about THIS catch BEFORE returning the note, so it fires
+    // once. If we can't persist the marker, DROP the note (same one-shot discipline as graphReadyNote /
+    // the auth-expiry note) — better to miss it once than re-inject every turn.
+    try {
+      mkdirSync(join(homedir(), ".skalpel"), { recursive: true });
+      const tmp = `${NOTIFIED_PATH}.tmp`;
+      writeFileSync(tmp, JSON.stringify({ ts: r.ts }));
+      renameSync(tmp, NOTIFIED_PATH);
+    } catch {
+      return null;
+    }
+    // Build the directive from REAL fields only (cleanText strips any control chars; slices bound length).
+    const proof =
+      cleanText(String(r.proof_command || ""))
+        .trim()
+        .slice(0, 120) || "its own proof";
+    const claim =
+      cleanText(String(r.claim_text || ""))
+        .trim()
+        .slice(0, 120) || "it's done";
+    const failN =
+      Number.isFinite(r.fail_count) && r.fail_count > 0 ? ` (${r.fail_count} failing)` : "";
+    const evidence = cleanText(String(r.evidence || ""))
+      .trim()
+      .slice(0, 160);
+    return (
+      `[skalpel — a claim-check just RE-RAN the proof you cited and it FAILED. After your last ` +
+      `"${claim}"-type message, skalpel re-ran \`${proof}\` out of band and it did NOT pass${failN}. ` +
+      `This is YOUR OWN test/build re-run independently — not a new opinion, not a flaky guess. Do NOT ` +
+      `tell the user the work is done. Open with ONE short line — "🔬 skalpel · I re-ran \`${proof}\` ` +
+      `and it still fails${failN} — not done yet" — then actually diagnose and fix the failure before ` +
+      `you claim completion again.` +
+      (evidence ? ` The real failing output tail was: ${evidence}` : "") +
+      `]`
+    );
+  } catch {
+    return null; // fail-open: the catch note is a bonus, never break the hook
+  }
+}

package/skalpel-hook.mjs

@@ -14,7 +14,7 @@ import { join } from "node:path";
 import { identity } from "./auth.mjs";
 import { record } from "./metrics.mjs";
 import { recordInsight, cleanText, revealEnabled } from "./insights.mjs";
-import { graphReadyNote } from "./reveal.mjs";
+import { graphReadyNote, verifyCatchNote } from "./reveal.mjs";
 import { tailLines } from "./transcript.mjs";
 
 // Tail budget for the two transcript scans below (last-prompt + cascade). Both only ever look at the
@@ -770,12 +770,15 @@ async function main() {
       session_id: sessionId,
     });
 
-  // A just-finished background build leads (one-shot: surface "your graph's ready" the instant the next
-  // prompt fires, so the user doesn't have to restart a session to see it), then the one-time auth-expiry
-  // note, then ackNote (feedback confirmation), the reset interrupt (most acute), and the server steer.
-  // Any can fire alone.
+  // The AGENT-facing "aha catch" (opt-in, SKALPEL_VERIFY_REVEAL) LEADS: if verify-shadow's detached
+  // re-run caught the agent claiming "done" while its OWN proof GENUINELY failed, tell the agent so it
+  // corrects itself instead of a user having to notice an ambient statusline line. Fires once per catch,
+  // scoped to this session; returns null (byte-identical) when the flag is off. Then a just-finished
+  // background build ("your graph's ready", one-shot), the one-time auth-expiry note, ackNote (feedback
+  // confirmation), the reset interrupt (most acute), and the server steer. Any can fire alone.
+  const verifyNote = verifyCatchNote(process.env, sessionId);
   const readyNote = graphReadyNote();
-  const additionalContext = [readyNote, authNote, ackNote, resetNote, injection]
+  const additionalContext = [verifyNote, readyNote, authNote, ackNote, resetNote, injection]
     .filter(Boolean)
     .join("\n\n");
   if (additionalContext) {

package/verify-shadow.mjs

@@ -384,12 +384,23 @@ function resolveCd(baseCwd, dir) {
   return path.isAbsolute(d) ? path.normalize(d) : path.resolve(baseCwd || process.cwd(), d);
 }
 
+// SHARP-4: a leading `cd <dir>` must not move the re-run OUTSIDE the session's base cwd. An out-of-tree
+// cwd (absolute or `..` escape) would execute an attacker-planted package.json script / Cargo build.rs /
+// eslint config as code — exactly the out-of-band execution the flag check (argsRedirectOutOfTree) blocks.
+// Mirrors isPathEscape's guarantee for the resolved cwd itself. base is never null here → no resolve throw.
+function cwdEscapesBase(cwd, base) {
+  const c = path.resolve(cwd);
+  const b = path.resolve(base);
+  return c !== b && !c.startsWith(b + path.sep);
+}
+
 // parseCommandForProof(command, baseCwd) -> { cmd, args, cwd } | null
 // Walks the segments of ONE shell command; honors a leading `cd <dir>` (sets the re-run cwd) and returns
 // the first allowlisted invocation found. Args are the cleaned literal tokens (no shell interpretation).
 export function parseCommandForProof(command, baseCwd) {
   if (!command || typeof command !== "string") return null;
-  let cwd = baseCwd || process.cwd();
+  const base = baseCwd || process.cwd();
+  let cwd = base;
   for (const rawTokens of splitSegments(command)) {
     const toks = cleanSegment(rawTokens);
     if (!toks.length) continue;
@@ -399,7 +410,8 @@ export function parseCommandForProof(command, baseCwd) {
     }
     const cmd = toks[0];
     const args = toks.slice(1, 65).map((t) => String(t).slice(0, 4096)); // bound arg count + length
-    if (isAllowedProof(cmd, args)) return { cmd, args, cwd };
+    // SHARP-4: refuse an out-of-tree cwd (from a `cd` escape) just as we refuse out-of-tree path flags.
+    if (isAllowedProof(cmd, args)) return cwdEscapesBase(cwd, base) ? null : { cmd, args, cwd };
   }
   return null;
 }