skalpel 4.0.4 → 4.0.6

package/install.mjs

@@ -67,14 +67,17 @@ if (!uninstall && !process.env.SKALPEL_HOOK_BIN) {
 
 // The wired command. Defaults to the staged absolute `node <path>`; SKALPEL_HOOK_BIN /
 // SKALPEL_HOOK_SESSION_BIN still override (dev, or a deliberate global-bin install).
-const CMD = process.env.SKALPEL_HOOK_BIN || `node ${HOOK_FILE}`;
-const SESSION_CMD = process.env.SKALPEL_HOOK_SESSION_BIN || `node ${SESSION_FILE}`;
+// QUOTE the path: on Windows the staged path is `C:\Users\First Last\.skalpel\hooks\…`, and an
+// UNQUOTED `node <path>` splits at the space so node gets `C:\Users\First` → ERR_MODULE_NOT_FOUND
+// (the esm/resolve crash on every hook). Double-quotes are safe on Windows cmd/PowerShell AND POSIX.
+const CMD = process.env.SKALPEL_HOOK_BIN || `node "${HOOK_FILE}"`;
+const SESSION_CMD = process.env.SKALPEL_HOOK_SESSION_BIN || `node "${SESSION_FILE}"`;
 const sessionEndRuntime =
   process.env.SKALPEL_HOOK_BIN && PKG_DIR !== HOOKS_DIR
     ? join(PKG_DIR, "skalpel-hook-session-end.mjs")
     : SESSION_END_FILE;
-const SESSION_END_CMD = process.env.SKALPEL_HOOK_SESSION_END_BIN || `node ${sessionEndRuntime}`;
-const STATUSLINE_CMD = process.env.SKALPEL_STATUSLINE_BIN || `node ${STATUSLINE_FILE}`;
+const SESSION_END_CMD = process.env.SKALPEL_HOOK_SESSION_END_BIN || `node "${sessionEndRuntime}"`;
+const STATUSLINE_CMD = process.env.SKALPEL_STATUSLINE_BIN || `node "${STATUSLINE_FILE}"`;
 const CLAUDE = join(homedir(), ".claude", "settings.json");
 const CODEX_DIR = join(homedir(), ".codex");
 const CODEX = join(CODEX_DIR, "hooks.json");
@@ -83,6 +86,8 @@ const CODEX_TOML = join(CODEX_DIR, "config.toml"); // Codex reads hooks from con
 // installer wired, including bare-bin names and absolute `node <path>` commands.
 const markerOf = (cmd) =>
   cmd
+    .replace(/"/g, "") // tolerate the quoted `node "<path>"` form (Windows-safe) — strip quotes first
+    .trim()
     .split(/[/\\]/)
     .pop()
     .replace(/\.(mjs|js|exe)$/, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/postinstall.mjs

@@ -57,8 +57,26 @@ function stageStatusline() {
   }
 }
 
+// If this postinstall ran under `sudo npm install -g`, we're root but a REAL user invoked it — so
+// anything we just created in their HOME (the staged ~/.skalpel) is root-owned, a landmine for the
+// later non-root `skalpel` (that's Ryaan's EACCES on copyfile into ~/.skalpel/hooks). Chown it back to
+// the invoking user so the sudo install path isn't left broken.
+function fixSudoOwnership() {
+  try {
+    if (process.platform === "win32") return; // no uid / sudo model
+    if (typeof process.getuid !== "function" || process.getuid() !== 0) return; // not root — nothing to undo
+    const uid = process.env.SUDO_UID;
+    if (!uid) return; // genuinely root (not via sudo) — don't touch their files
+    const gid = process.env.SUDO_GID || uid;
+    spawnSync("chown", ["-R", `${uid}:${gid}`, join(homedir(), ".skalpel")], q);
+  } catch {
+    /* best-effort — worst case the user runs `sudo chown -R $(whoami) ~/.skalpel` themselves */
+  }
+}
+
 retireLegacyDaemon();
 stageStatusline();
+fixSudoOwnership();
 
 // A quiet nudge — the real onboarding (Google sign-in → build graph → insights) runs on `skalpel`.
 if (process.stdout.isTTY && !process.env.CI) {