skalpel 4.0.40 → 4.0.41

package/install.mjs

@@ -8,6 +8,7 @@ import {
   mkdirSync,
   existsSync,
   copyFileSync,
+  renameSync,
   rmSync,
   readdirSync,
 } from "node:fs";
@@ -42,40 +43,95 @@ const SESSION_FILE = join(HOOKS_DIR, "skalpel-hook-session.mjs");
 const SESSION_END_FILE = join(HOOKS_DIR, "skalpel-hook-session-end.mjs");
 const STATUSLINE_FILE = join(HOOKS_DIR, "skalpel-statusline.mjs");
 
-// Copy the hook runtime (the two entrypoints + their shared auth.mjs) into ~/.skalpel/hooks so the
-// wired absolute path is always valid. Overwrites on every install so upgrades refresh the code.
+// The COMPLETE import closure that must live in ~/.skalpel/hooks: the CLI entrypoints Claude Code /
+// Codex are wired to, plus every module those entrypoints (transitively) import. A hook wired to an
+// absolute path whose imported module is absent crashes on EVERY invocation with
+// `SyntaxError: ... does not provide an export named ...` / ERR_MODULE_NOT_FOUND — the exact
+// 0.3.12–0.3.16 bug shape. Keep this list a superset of the closure of skalpel-hook.mjs /
+// skalpel-hook-session.mjs / skalpel-hook-session-end.mjs / skalpel-statusline.mjs (see the trailing
+// note on each line for who imports it). Order is irrelevant now — staging is atomic (all files land
+// in a temp dir; the temp dir is only swapped into place after every copy succeeds).
+const RUNTIME_FILES = [
+  "insights.mjs", // hooks + statusline + reveal + verify-shadow import ./insights.mjs
+  "reveal.mjs", // both prompt/session hooks import ./reveal.mjs
+  "transcript.mjs", // skalpel-hook + skalpel-statusline + verify-shadow import ./transcript.mjs (tailLines)
+  "skalpel-hook.mjs", // UserPromptSubmit entrypoint (wired)
+  "skalpel-hook-session.mjs", // SessionStart entrypoint (wired)
+  "incremental-ingest.mjs", // skalpel-hook-session-end.mjs imports ./incremental-ingest.mjs
+  "skalpel-hook-session-end.mjs", // SessionEnd entrypoint (wired)
+  "skalpel-statusline.mjs", // statusLine entrypoint (wired)
+  "anchor-shadow.mjs", // verify-shadow.mjs (staged worker) imports ./anchor-shadow.mjs — probe primitives
+  "verify-shadow.mjs", // claim-verification SHADOW worker (spawned by skalpel-hook.mjs)
+  "auth.mjs", // hooks import ./auth.mjs
+  "metrics.mjs", // hooks import ./metrics.mjs
+  "stats.mjs", // `node ~/.skalpel/hooks/stats.mjs` — local read-only accumulator
+  "autopsy.mjs", // `node ~/.skalpel/hooks/autopsy.mjs` — local read-only receipt
+];
+
+// Stage the hook runtime into ~/.skalpel/hooks so the wired absolute path is always valid, ATOMICALLY:
+// copy the whole closure into a fresh temp dir and only swap it into place after EVERY copy succeeds.
+// This is the fix for the partial-upgrade fail-open: the old in-place overwrite copied the new
+// skalpel-hook.mjs BEFORE its auth.mjs/metrics.mjs, so a mid-copy I/O failure on an UPGRADE (hooks
+// already wired to the stable path) left the NEW hook next to the OLD auth at the live path — every
+// turn then crashed with a missing-export SyntaxError, and the all-or-nothing guard below only
+// refused to WIRE, never rolled back the already-clobbered files. With atomic staging a failed copy
+// leaves the EXISTING hooks dir 100% intact.
 function stageHookRuntime() {
   // Login and setup repair paths invoke the already-staged copy. Avoid copying a file onto itself.
   if (PKG_DIR === HOOKS_DIR) return;
-  mkdirSync(HOOKS_DIR, { recursive: true });
-  // insights.mjs is staged BEFORE the entrypoints that import it — a mid-copy ENOENT
-  // must not leave a wired hook missing its import (auth/metrics staging order predates
-  // this rule and is guarded by the all-or-nothing check below instead).
-  // a hook entrypoint staged without a module it imports — the exact 0.3.12–0.3.16 bug shape.
-  copyFileSync(join(PKG_DIR, "insights.mjs"), join(HOOKS_DIR, "insights.mjs")); // hooks import ./insights.mjs
-  copyFileSync(join(PKG_DIR, "reveal.mjs"), join(HOOKS_DIR, "reveal.mjs")); // both hooks import ./reveal.mjs
-  copyFileSync(join(PKG_DIR, "transcript.mjs"), join(HOOKS_DIR, "transcript.mjs")); // skalpel-hook + skalpel-statusline + verify-shadow + anchor-shadow import ./transcript.mjs (tailLines)
-  copyFileSync(join(PKG_DIR, "skalpel-hook.mjs"), HOOK_FILE);
-  copyFileSync(join(PKG_DIR, "skalpel-hook-session.mjs"), SESSION_FILE);
-  copyFileSync(join(PKG_DIR, "incremental-ingest.mjs"), join(HOOKS_DIR, "incremental-ingest.mjs"));
-  copyFileSync(join(PKG_DIR, "skalpel-hook-session-end.mjs"), SESSION_END_FILE);
-  copyFileSync(join(PKG_DIR, "skalpel-statusline.mjs"), STATUSLINE_FILE);
-  copyFileSync(join(PKG_DIR, "anchor-shadow.mjs"), join(HOOKS_DIR, "anchor-shadow.mjs")); // verify-shadow.mjs (staged worker) imports ./anchor-shadow.mjs — probe primitives; staged BEFORE verify-shadow.mjs
-  copyFileSync(join(PKG_DIR, "verify-shadow.mjs"), join(HOOKS_DIR, "verify-shadow.mjs")); // claim-verification SHADOW worker (spawned by skalpel-hook.mjs)
-  copyFileSync(join(PKG_DIR, "auth.mjs"), join(HOOKS_DIR, "auth.mjs")); // hooks import ./auth.mjs
-  copyFileSync(join(PKG_DIR, "metrics.mjs"), join(HOOKS_DIR, "metrics.mjs")); // hooks import ./metrics.mjs
-  copyFileSync(join(PKG_DIR, "stats.mjs"), join(HOOKS_DIR, "stats.mjs")); // `node ~/.skalpel/hooks/stats.mjs`
-  copyFileSync(join(PKG_DIR, "autopsy.mjs"), join(HOOKS_DIR, "autopsy.mjs")); // `node ~/.skalpel/hooks/autopsy.mjs` — local read-only receipt
+  const SKALPEL_DIR = dirname(HOOKS_DIR); // ~/.skalpel — staging/backup are siblings of hooks so every
+  const stagingDir = join(SKALPEL_DIR, `hooks.staging-${process.pid}`); // rename below is same-filesystem
+  const backupDir = join(SKALPEL_DIR, `hooks.bak-${process.pid}`); // (atomic) and never crosses devices.
+
+  // 1) Copy the WHOLE closure into a fresh temp dir. Scoped to THIS pid so a concurrent installer's
+  //    staging-<otherpid> is never disturbed; drop any leftover from a crashed prior run of this pid.
+  rmSync(stagingDir, { recursive: true, force: true });
+  mkdirSync(stagingDir, { recursive: true });
+  try {
+    for (const name of RUNTIME_FILES) {
+      copyFileSync(join(PKG_DIR, name), join(stagingDir, name));
+    }
+  } catch (e) {
+    // A copy failed part-way (incomplete tarball / disk error). The LIVE hooks dir was never touched —
+    // clean up the partial staging dir and rethrow so the caller refuses to wire.
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw e;
+  }
+
+  // 2) All copies succeeded — swap staging into place. rename can't overwrite a non-empty dir, so move
+  //    the old dir aside first, move the new one in, then delete the old. Both renames are same-device
+  //    (siblings under ~/.skalpel), so each is atomic. On ANY failure — including the old dir being
+  //    locked (Windows) so it can't even be moved aside — clean up the staging dir, and if we already
+  //    moved the old dir aside, roll it back so the wired path is never left without a hooks dir.
+  rmSync(backupDir, { recursive: true, force: true }); // stale bak from a crashed prior same-pid run
+  const hadLive = existsSync(HOOKS_DIR);
+  try {
+    if (hadLive) renameSync(HOOKS_DIR, backupDir);
+    renameSync(stagingDir, HOOKS_DIR);
+  } catch (e) {
+    if (hadLive && !existsSync(HOOKS_DIR) && existsSync(backupDir)) {
+      try {
+        renameSync(backupDir, HOOKS_DIR); // restore the previous working install
+      } catch {
+        /* rollback best-effort; the original is still recoverable at backupDir */
+      }
+    }
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw e;
+  }
+  // Swap done. Dropping the old dir is best-effort: a failure here only leaves a stale hooks.bak-<pid>,
+  // never a broken wired path.
+  rmSync(backupDir, { recursive: true, force: true });
 }
 if (!uninstall && !process.env.SKALPEL_HOOK_BIN) {
   try {
     stageHookRuntime();
   } catch (e) {
-    // Staging is all-or-nothing. A missing source file means the tarball is incomplete (a file this
-    // installer copies was left out of package.json "files"), and copyFileSync throws part-way
-    // through — so the *later* copies never run and the hooks are staged without the auth.mjs /
-    // metrics.mjs they import. Wiring absolute paths at that point yields hooks that crash on every
-    // prompt. Refuse to wire instead; a loud failure beats a silent no-op.
+    // Staging is atomic and all-or-nothing. A missing source file means the tarball is incomplete (a
+    // file this installer copies was left out of package.json "files"); any copy error aborts staging
+    // with the EXISTING hooks dir left fully intact (never a half-updated dir at the wired path).
+    // Wiring on top of a failed stage would risk hooks that crash on every prompt — so refuse to wire
+    // instead; a loud failure beats a silent no-op.
     console.error(`skalpel: could not stage hook runtime: ${e.message}`);
     console.error("skalpel: hooks were NOT wired.");
     process.exit(1);
@@ -222,7 +278,12 @@ function claude() {
   } else if (statuslineOnly) {
     return "preserved"; // a custom status line wins; do not rewrite unrelated Claude settings
   }
-  writeJson(CLAUDE, d);
+  // Only write when we actually added, refreshed, or removed one of OUR entries (mirrors codexToml's
+  // `if (hadToml) write` guard). Never CREATE a settings.json — nor re-serialize/churn an existing one
+  // — when there was nothing to do: an `uninstall` on a machine that never had our hooks leaves the
+  // file exactly as it was (or absent). Install always changes something here, so this only suppresses
+  // the no-op write.
+  if (installed || refreshed || removed) writeJson(CLAUDE, d);
   if (uninstall) return removed ? "removed" : "absent";
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
@@ -378,8 +439,15 @@ function codexJson() {
       installed += 1;
     }
   }
+  if (uninstall) {
+    // Never CREATE ~/.codex/hooks.json during an uninstall — only rewrite it when we actually stripped
+    // one of our blocks from an existing file (mirrors codexToml's hadToml guard). A machine whose
+    // ~/.codex has no hooks.json (or none of ours) has nothing to clean up, so writing here would drop
+    // a stray file behind an operation that's supposed to leave the machine clean.
+    if (removed) writeJson(CODEX, d);
+    return removed ? "removed" : "absent";
+  }
   writeJson(CODEX, d);
-  if (uninstall) return removed ? "removed" : "absent";
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.40",
+  "version": "4.0.41",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/postinstall.mjs

@@ -48,12 +48,37 @@ function retireLegacyDaemon() {
 
 function stageStatusline() {
   try {
-    // --statusline-only: stage the read-only indicator, do NOT wire prompt/session hooks yet.
-    spawnSync(process.execPath, [join(DIR, "install.mjs"), "--statusline-only"], {
+    // --statusline-only: stage the read-only indicator, do NOT wire prompt/session hooks yet. NOTE:
+    // this still runs the FULL hook-runtime staging inside install.mjs — so if staging genuinely fails
+    // (an incomplete package, a mid-copy I/O error) install.mjs exits non-zero. We MUST read that
+    // status: an unattended `npm install/update -g` upgrade that hits a staging failure would otherwise
+    // leave a broken/stale runtime with postinstall exiting 0 — a failure masquerading as success.
+    const r = spawnSync(process.execPath, [join(DIR, "install.mjs"), "--statusline-only"], {
       stdio: "inherit",
     });
-  } catch {
-    /* fail-open */
+    if (r.error || r.status !== 0) {
+      // Surface it LOUDLY (stderr), but keep the fail-open posture: package.json wraps postinstall in
+      // `|| true`, so npm install itself is never bricked — the user still gets the package and can
+      // repair with `skalpel setup`. A first install where hooks aren't wired yet does NOT reach here:
+      // install.mjs only exits non-zero on a real staging failure, not on a clean statusline-only stage.
+      const detail = r.error
+        ? r.error.message
+        : r.signal
+          ? `killed by ${r.signal}`
+          : `exit code ${r.status}`;
+      process.stderr.write(
+        `\n  skalpel: WARNING — hook staging failed (${detail}). Hooks/status line may be missing or ` +
+          `stale. Run \x1b[1mskalpel setup\x1b[22m to repair.\n\n`,
+      );
+      process.exitCode = 1; // record the failure; package.json's `|| true` keeps npm install green
+      return false;
+    }
+    return true;
+  } catch (e) {
+    // spawn itself failed (couldn't launch node at all) — still surface, still fail-open.
+    process.stderr.write(`\n  skalpel: WARNING — could not run the installer (${e.message}).\n\n`);
+    process.exitCode = 1;
+    return false;
   }
 }
 
@@ -75,11 +100,13 @@ function fixSudoOwnership() {
 }
 
 retireLegacyDaemon();
-stageStatusline();
+const stagingOk = stageStatusline();
 fixSudoOwnership();
 
 // A quiet nudge — the real onboarding (Google sign-in → build graph → insights) runs on `skalpel`.
-if (process.stdout.isTTY && !process.env.CI) {
+// Suppressed when staging failed: the warning above is the honest signal, and a cheerful
+// "installed" line under it would read as success.
+if (stagingOk && process.stdout.isTTY && !process.env.CI) {
   process.stdout.write(
     "\n  skalpel installed. Run \x1b[1mskalpel\x1b[22m to sign in and build your graph.\n\n",
   );