skalpel 4.0.39 → 4.0.41

package/eval-harness.mjs

@@ -25,6 +25,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 
 // ───────────────────────────── tunables (UNCALIBRATED defaults) ─────────────────────────────
 // These thresholds are NOT tuned against a human gold set unless one is supplied via --gold.
@@ -1117,9 +1118,22 @@ function main() {
   console.log("═".repeat(90));
 }
 
-const isMain =
-  process.argv[1] &&
-  path.resolve(process.argv[1]) === path.resolve(new URL(import.meta.url).pathname);
+// Robust main detection (mirrors verify-shadow.mjs / skalpel-setup.mjs): compare REAL paths via
+// realpathSync, not a hand-built path.resolve(url.pathname). On Windows, `new URL(import.meta.url)
+// .pathname` yields "/C:/Users/..." (a leading slash BEFORE the drive letter); path.resolve() on that
+// string produces "\C:\Users\..." — a different string than path.resolve(process.argv[1])'s
+// "C:\Users\...". isMain then silently evaluates false, so `node eval-harness.mjs <dir>` (the CLI's
+// entire purpose) does nothing at all on Windows: no usage, no report, no error, exit 0.
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
 if (isMain) main();
 
 export { V1_onset, V2_cue, V3_repeat, FIRE_ALWAYS, FIRE_NEVER, calibrate };

package/install.mjs

@@ -8,6 +8,7 @@ import {
   mkdirSync,
   existsSync,
   copyFileSync,
+  renameSync,
   rmSync,
   readdirSync,
 } from "node:fs";
@@ -42,40 +43,95 @@ const SESSION_FILE = join(HOOKS_DIR, "skalpel-hook-session.mjs");
 const SESSION_END_FILE = join(HOOKS_DIR, "skalpel-hook-session-end.mjs");
 const STATUSLINE_FILE = join(HOOKS_DIR, "skalpel-statusline.mjs");
 
-// Copy the hook runtime (the two entrypoints + their shared auth.mjs) into ~/.skalpel/hooks so the
-// wired absolute path is always valid. Overwrites on every install so upgrades refresh the code.
+// The COMPLETE import closure that must live in ~/.skalpel/hooks: the CLI entrypoints Claude Code /
+// Codex are wired to, plus every module those entrypoints (transitively) import. A hook wired to an
+// absolute path whose imported module is absent crashes on EVERY invocation with
+// `SyntaxError: ... does not provide an export named ...` / ERR_MODULE_NOT_FOUND — the exact
+// 0.3.12–0.3.16 bug shape. Keep this list a superset of the closure of skalpel-hook.mjs /
+// skalpel-hook-session.mjs / skalpel-hook-session-end.mjs / skalpel-statusline.mjs (see the trailing
+// note on each line for who imports it). Order is irrelevant now — staging is atomic (all files land
+// in a temp dir; the temp dir is only swapped into place after every copy succeeds).
+const RUNTIME_FILES = [
+  "insights.mjs", // hooks + statusline + reveal + verify-shadow import ./insights.mjs
+  "reveal.mjs", // both prompt/session hooks import ./reveal.mjs
+  "transcript.mjs", // skalpel-hook + skalpel-statusline + verify-shadow import ./transcript.mjs (tailLines)
+  "skalpel-hook.mjs", // UserPromptSubmit entrypoint (wired)
+  "skalpel-hook-session.mjs", // SessionStart entrypoint (wired)
+  "incremental-ingest.mjs", // skalpel-hook-session-end.mjs imports ./incremental-ingest.mjs
+  "skalpel-hook-session-end.mjs", // SessionEnd entrypoint (wired)
+  "skalpel-statusline.mjs", // statusLine entrypoint (wired)
+  "anchor-shadow.mjs", // verify-shadow.mjs (staged worker) imports ./anchor-shadow.mjs — probe primitives
+  "verify-shadow.mjs", // claim-verification SHADOW worker (spawned by skalpel-hook.mjs)
+  "auth.mjs", // hooks import ./auth.mjs
+  "metrics.mjs", // hooks import ./metrics.mjs
+  "stats.mjs", // `node ~/.skalpel/hooks/stats.mjs` — local read-only accumulator
+  "autopsy.mjs", // `node ~/.skalpel/hooks/autopsy.mjs` — local read-only receipt
+];
+
+// Stage the hook runtime into ~/.skalpel/hooks so the wired absolute path is always valid, ATOMICALLY:
+// copy the whole closure into a fresh temp dir and only swap it into place after EVERY copy succeeds.
+// This is the fix for the partial-upgrade fail-open: the old in-place overwrite copied the new
+// skalpel-hook.mjs BEFORE its auth.mjs/metrics.mjs, so a mid-copy I/O failure on an UPGRADE (hooks
+// already wired to the stable path) left the NEW hook next to the OLD auth at the live path — every
+// turn then crashed with a missing-export SyntaxError, and the all-or-nothing guard below only
+// refused to WIRE, never rolled back the already-clobbered files. With atomic staging a failed copy
+// leaves the EXISTING hooks dir 100% intact.
 function stageHookRuntime() {
   // Login and setup repair paths invoke the already-staged copy. Avoid copying a file onto itself.
   if (PKG_DIR === HOOKS_DIR) return;
-  mkdirSync(HOOKS_DIR, { recursive: true });
-  // insights.mjs is staged BEFORE the entrypoints that import it — a mid-copy ENOENT
-  // must not leave a wired hook missing its import (auth/metrics staging order predates
-  // this rule and is guarded by the all-or-nothing check below instead).
-  // a hook entrypoint staged without a module it imports — the exact 0.3.12–0.3.16 bug shape.
-  copyFileSync(join(PKG_DIR, "insights.mjs"), join(HOOKS_DIR, "insights.mjs")); // hooks import ./insights.mjs
-  copyFileSync(join(PKG_DIR, "reveal.mjs"), join(HOOKS_DIR, "reveal.mjs")); // both hooks import ./reveal.mjs
-  copyFileSync(join(PKG_DIR, "transcript.mjs"), join(HOOKS_DIR, "transcript.mjs")); // skalpel-hook + skalpel-statusline + verify-shadow + anchor-shadow import ./transcript.mjs (tailLines)
-  copyFileSync(join(PKG_DIR, "skalpel-hook.mjs"), HOOK_FILE);
-  copyFileSync(join(PKG_DIR, "skalpel-hook-session.mjs"), SESSION_FILE);
-  copyFileSync(join(PKG_DIR, "incremental-ingest.mjs"), join(HOOKS_DIR, "incremental-ingest.mjs"));
-  copyFileSync(join(PKG_DIR, "skalpel-hook-session-end.mjs"), SESSION_END_FILE);
-  copyFileSync(join(PKG_DIR, "skalpel-statusline.mjs"), STATUSLINE_FILE);
-  copyFileSync(join(PKG_DIR, "anchor-shadow.mjs"), join(HOOKS_DIR, "anchor-shadow.mjs")); // verify-shadow.mjs (staged worker) imports ./anchor-shadow.mjs — probe primitives; staged BEFORE verify-shadow.mjs
-  copyFileSync(join(PKG_DIR, "verify-shadow.mjs"), join(HOOKS_DIR, "verify-shadow.mjs")); // claim-verification SHADOW worker (spawned by skalpel-hook.mjs)
-  copyFileSync(join(PKG_DIR, "auth.mjs"), join(HOOKS_DIR, "auth.mjs")); // hooks import ./auth.mjs
-  copyFileSync(join(PKG_DIR, "metrics.mjs"), join(HOOKS_DIR, "metrics.mjs")); // hooks import ./metrics.mjs
-  copyFileSync(join(PKG_DIR, "stats.mjs"), join(HOOKS_DIR, "stats.mjs")); // `node ~/.skalpel/hooks/stats.mjs`
-  copyFileSync(join(PKG_DIR, "autopsy.mjs"), join(HOOKS_DIR, "autopsy.mjs")); // `node ~/.skalpel/hooks/autopsy.mjs` — local read-only receipt
+  const SKALPEL_DIR = dirname(HOOKS_DIR); // ~/.skalpel — staging/backup are siblings of hooks so every
+  const stagingDir = join(SKALPEL_DIR, `hooks.staging-${process.pid}`); // rename below is same-filesystem
+  const backupDir = join(SKALPEL_DIR, `hooks.bak-${process.pid}`); // (atomic) and never crosses devices.
+
+  // 1) Copy the WHOLE closure into a fresh temp dir. Scoped to THIS pid so a concurrent installer's
+  //    staging-<otherpid> is never disturbed; drop any leftover from a crashed prior run of this pid.
+  rmSync(stagingDir, { recursive: true, force: true });
+  mkdirSync(stagingDir, { recursive: true });
+  try {
+    for (const name of RUNTIME_FILES) {
+      copyFileSync(join(PKG_DIR, name), join(stagingDir, name));
+    }
+  } catch (e) {
+    // A copy failed part-way (incomplete tarball / disk error). The LIVE hooks dir was never touched —
+    // clean up the partial staging dir and rethrow so the caller refuses to wire.
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw e;
+  }
+
+  // 2) All copies succeeded — swap staging into place. rename can't overwrite a non-empty dir, so move
+  //    the old dir aside first, move the new one in, then delete the old. Both renames are same-device
+  //    (siblings under ~/.skalpel), so each is atomic. On ANY failure — including the old dir being
+  //    locked (Windows) so it can't even be moved aside — clean up the staging dir, and if we already
+  //    moved the old dir aside, roll it back so the wired path is never left without a hooks dir.
+  rmSync(backupDir, { recursive: true, force: true }); // stale bak from a crashed prior same-pid run
+  const hadLive = existsSync(HOOKS_DIR);
+  try {
+    if (hadLive) renameSync(HOOKS_DIR, backupDir);
+    renameSync(stagingDir, HOOKS_DIR);
+  } catch (e) {
+    if (hadLive && !existsSync(HOOKS_DIR) && existsSync(backupDir)) {
+      try {
+        renameSync(backupDir, HOOKS_DIR); // restore the previous working install
+      } catch {
+        /* rollback best-effort; the original is still recoverable at backupDir */
+      }
+    }
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw e;
+  }
+  // Swap done. Dropping the old dir is best-effort: a failure here only leaves a stale hooks.bak-<pid>,
+  // never a broken wired path.
+  rmSync(backupDir, { recursive: true, force: true });
 }
 if (!uninstall && !process.env.SKALPEL_HOOK_BIN) {
   try {
     stageHookRuntime();
   } catch (e) {
-    // Staging is all-or-nothing. A missing source file means the tarball is incomplete (a file this
-    // installer copies was left out of package.json "files"), and copyFileSync throws part-way
-    // through — so the *later* copies never run and the hooks are staged without the auth.mjs /
-    // metrics.mjs they import. Wiring absolute paths at that point yields hooks that crash on every
-    // prompt. Refuse to wire instead; a loud failure beats a silent no-op.
+    // Staging is atomic and all-or-nothing. A missing source file means the tarball is incomplete (a
+    // file this installer copies was left out of package.json "files"); any copy error aborts staging
+    // with the EXISTING hooks dir left fully intact (never a half-updated dir at the wired path).
+    // Wiring on top of a failed stage would risk hooks that crash on every prompt — so refuse to wire
+    // instead; a loud failure beats a silent no-op.
     console.error(`skalpel: could not stage hook runtime: ${e.message}`);
     console.error("skalpel: hooks were NOT wired.");
     process.exit(1);
@@ -222,7 +278,12 @@ function claude() {
   } else if (statuslineOnly) {
     return "preserved"; // a custom status line wins; do not rewrite unrelated Claude settings
   }
-  writeJson(CLAUDE, d);
+  // Only write when we actually added, refreshed, or removed one of OUR entries (mirrors codexToml's
+  // `if (hadToml) write` guard). Never CREATE a settings.json — nor re-serialize/churn an existing one
+  // — when there was nothing to do: an `uninstall` on a machine that never had our hooks leaves the
+  // file exactly as it was (or absent). Install always changes something here, so this only suppresses
+  // the no-op write.
+  if (installed || refreshed || removed) writeJson(CLAUDE, d);
   if (uninstall) return removed ? "removed" : "absent";
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
@@ -378,8 +439,15 @@ function codexJson() {
       installed += 1;
     }
   }
+  if (uninstall) {
+    // Never CREATE ~/.codex/hooks.json during an uninstall — only rewrite it when we actually stripped
+    // one of our blocks from an existing file (mirrors codexToml's hadToml guard). A machine whose
+    // ~/.codex has no hooks.json (or none of ours) has nothing to clean up, so writing here would drop
+    // a stray file behind an operation that's supposed to leave the machine clean.
+    if (removed) writeJson(CODEX, d);
+    return removed ? "removed" : "absent";
+  }
   writeJson(CODEX, d);
-  if (uninstall) return removed ? "removed" : "absent";
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.39",
+  "version": "4.0.41",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/postinstall.mjs

@@ -48,12 +48,37 @@ function retireLegacyDaemon() {
 
 function stageStatusline() {
   try {
-    // --statusline-only: stage the read-only indicator, do NOT wire prompt/session hooks yet.
-    spawnSync(process.execPath, [join(DIR, "install.mjs"), "--statusline-only"], {
+    // --statusline-only: stage the read-only indicator, do NOT wire prompt/session hooks yet. NOTE:
+    // this still runs the FULL hook-runtime staging inside install.mjs — so if staging genuinely fails
+    // (an incomplete package, a mid-copy I/O error) install.mjs exits non-zero. We MUST read that
+    // status: an unattended `npm install/update -g` upgrade that hits a staging failure would otherwise
+    // leave a broken/stale runtime with postinstall exiting 0 — a failure masquerading as success.
+    const r = spawnSync(process.execPath, [join(DIR, "install.mjs"), "--statusline-only"], {
       stdio: "inherit",
     });
-  } catch {
-    /* fail-open */
+    if (r.error || r.status !== 0) {
+      // Surface it LOUDLY (stderr), but keep the fail-open posture: package.json wraps postinstall in
+      // `|| true`, so npm install itself is never bricked — the user still gets the package and can
+      // repair with `skalpel setup`. A first install where hooks aren't wired yet does NOT reach here:
+      // install.mjs only exits non-zero on a real staging failure, not on a clean statusline-only stage.
+      const detail = r.error
+        ? r.error.message
+        : r.signal
+          ? `killed by ${r.signal}`
+          : `exit code ${r.status}`;
+      process.stderr.write(
+        `\n  skalpel: WARNING — hook staging failed (${detail}). Hooks/status line may be missing or ` +
+          `stale. Run \x1b[1mskalpel setup\x1b[22m to repair.\n\n`,
+      );
+      process.exitCode = 1; // record the failure; package.json's `|| true` keeps npm install green
+      return false;
+    }
+    return true;
+  } catch (e) {
+    // spawn itself failed (couldn't launch node at all) — still surface, still fail-open.
+    process.stderr.write(`\n  skalpel: WARNING — could not run the installer (${e.message}).\n\n`);
+    process.exitCode = 1;
+    return false;
   }
 }
 
@@ -75,11 +100,13 @@ function fixSudoOwnership() {
 }
 
 retireLegacyDaemon();
-stageStatusline();
+const stagingOk = stageStatusline();
 fixSudoOwnership();
 
 // A quiet nudge — the real onboarding (Google sign-in → build graph → insights) runs on `skalpel`.
-if (process.stdout.isTTY && !process.env.CI) {
+// Suppressed when staging failed: the warning above is the honest signal, and a cheerful
+// "installed" line under it would read as success.
+if (stagingOk && process.stdout.isTTY && !process.env.CI) {
   process.stdout.write(
     "\n  skalpel installed. Run \x1b[1mskalpel\x1b[22m to sign in and build your graph.\n\n",
   );

package/skalpel-statusline.mjs

@@ -139,10 +139,17 @@ function steerLabel() {
 // line (fresh + honest — the statusline never invents it, it only renders what the re-run recorded) or
 // null. Auto-clears when stale (past the TTL) so an old catch can't wallpaper the bar. GATED entirely on
 // SKALPEL_VERIFY_REVEAL: when off, this is never called and the bar is byte-identical to the baseline.
-function revealNote() {
+function revealNote(sessionId) {
   try {
     const r = JSON.parse(readFileSync(REVEAL_PATH, "utf8"));
     if (!r || typeof r.line !== "string" || !r.line.trim()) return null;
+    // SESSION SCOPING: verify-reveal.json is a single shared path across every concurrent Claude Code
+    // session (multiple tabs/worktrees). Without this check, this pane would show — and misattribute to
+    // "your agent" — a catch that actually came from a DIFFERENT session's transcript. Only skip when
+    // BOTH sides know their session and they disagree; an unknown session on either side stays permissive.
+    // NOT deleted here (unlike the stale-TTL branch below) — it may still be the right reveal for whichever
+    // session actually owns it.
+    if (r.session && sessionId && r.session !== sessionId) return null;
     const age = Date.now() - Date.parse(r.ts);
     if (!Number.isFinite(age) || age > REVEAL_TTL_MS) {
       try {
@@ -361,7 +368,7 @@ function main() {
   // SKALPEL_VERIFY_REVEAL — when off (the default) this branch never runs and the bar is byte-identical to
   // the always-on baseline below.
   if (revealEnabled(process.env)) {
-    const reveal = revealNote();
+    const reveal = revealNote(payload.session_id);
     if (reveal) {
       process.stdout.write(`${BOLD}${reveal}${RESET}`);
       return;

package/verify-shadow.mjs

@@ -877,9 +877,23 @@ function writeReveal(row) {
   }
 }
 
-// clearReveal() — retract a prior catch (the agent actually fixed it: a later proof re-run PASSED).
-function clearReveal() {
+// clearReveal(session) — retract a prior catch (the agent actually fixed it: a later proof re-run
+// PASSED). SESSION-SCOPED: verify-reveal.json is a single shared path under ~/.skalpel, read/written by
+// every concurrent Claude Code session (multiple tabs/worktrees is a normal prosumer workflow). Without
+// this guard, session B's PASSING proof would silently wipe out session A's still-unresolved GENUINE_FAIL
+// reveal — the user in session A would never see the catch they hadn't gotten to yet, and session B gets
+// credit for "fixing" something it never touched. Only refuse to clear when BOTH sides know their session
+// and they disagree; an unknown session on either side stays permissive (matches prior single-session
+// behavior, and a manual/CLI-driven re-run with no session context still self-heals as before).
+function clearReveal(session) {
   try {
+    let existing = null;
+    try {
+      existing = JSON.parse(readFileSync(REVEAL_PATH, "utf8"));
+    } catch {
+      /* no reveal file, or unreadable — nothing to protect; fall through to the (idempotent) remove */
+    }
+    if (existing && existing.session && session && existing.session !== session) return; // not ours
     rmSync(REVEAL_PATH, { force: true });
   } catch {
     /* stale reveal self-expires via the statusline's TTL anyway */
@@ -946,7 +960,7 @@ function maybeSurfaceReveal(row) {
         session: row.session || null,
       });
     } else if (isPass) {
-      clearReveal(); // resolved — don't wallpaper a catch the agent already fixed
+      clearReveal(row.session || null); // resolved — don't wallpaper a catch the agent already fixed
       // The green VERDICT stamp is #612's TEST-pass path only: its line ("re-ran `<proof>`, exit 0") is a
       // real test re-run receipt. A ship SHIP_OK (read-only probe came back positive) has no re-run and no
       // proof_command, so it must NOT borrow that wording — it only clears any prior catch (as #611 did).