skalpel 4.0.40 → 4.0.42

package/_test-home.mjs

@@ -0,0 +1,18 @@
+// _test-home.mjs — TEST-ONLY isolation shim. Imported FIRST (before any client module) by every test
+// that touches ~/.skalpel, so os.homedir() resolves to a throwaway temp dir and the suite can never read
+// or clobber the developer's real ~/.skalpel. ESM evaluates imports depth-first in source order, so a test
+// that does `import "./_test-home.mjs"` before `import "./insights.mjs"` guarantees HOME is redirected
+// BEFORE insights.mjs binds its DIR = join(homedir(), ".skalpel") at module load. Not a test file itself.
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const home = mkdtempSync(join(tmpdir(), "skalpel-verify-test-"));
+process.env.HOME = home;
+process.env.USERPROFILE = home; // Windows
+// Never let a stray dev env var arm/disarm the resolver mid-test — each test sets these explicitly.
+delete process.env.SKALPEL_VERIFY_REVEAL;
+delete process.env.SKALPEL_VERIFY_SHADOW;
+
+export const TEST_HOME = home;
+export const SKALPEL_DIR = join(home, ".skalpel");

package/insights.mjs

@@ -17,6 +17,9 @@ import { join } from "node:path";
 
 const DIR = join(homedir(), ".skalpel");
 export const INSIGHTS_PATH = join(DIR, "insights.ndjson");
+// The persisted client config `skalpel setup` writes (api/user/verify). Read HERE too so the ONE arming
+// resolver can consult the consented `verify` key without any writer/reader plumbing.
+export const CLIENT_JSON_PATH = join(DIR, "client.json");
 
 // ---- verify-reveal: the opt-in "aha catch" surface — single source for the flag + the state-file path.
 // The reveal is WRITTEN by verify-shadow.mjs (the detached proof re-runner, when the agent claimed
@@ -30,10 +33,188 @@ export const REVEAL_PATH = join(DIR, "verify-reveal.json");
 // rare red catch land like a thunderclap — without a stream of honest verified stamps a lone red reads as
 // noise, not a verdict. Path single-sourced HERE alongside REVEAL_PATH so writer + reader never drift.
 export const VERDICT_PATH = join(DIR, "verify-verdict.json");
-// SKALPEL_VERIFY_REVEAL is OPT-IN and OFF BY DEFAULT. Unset / "" / "0" / "off" / "false" / "no" → DARK
-// (byte-identical to the shadow-only behavior). Only an explicit truthy value arms the visible reveal.
+// ---- THE ONE ARMING RESOLVER (single source of truth) --------------------------------------------
+// The "aha catch" is OPT-IN and OFF BY DEFAULT. Arming is resolved by ONE function everyone reads —
+// the hook spawn gate, the statusline reveal, verify-shadow's surfacing, and reveal.mjs's agent note —
+// so writer, reader, and gate can never drift. PRECEDENCE:
+//   1. ENV OVERRIDE (dev/CI): SKALPEL_VERIFY_REVEAL, explicit on OR off, always wins.
+//   2. CONSENTED CONFIG: ~/.skalpel/client.json "verify" key ("on"/"off"), written by `skalpel setup`.
+//   3. DEFAULT OFF — an absent config + unset env is DARK, byte-identical to the shadow-only baseline.
+// Only an explicit consented "on" (or a dev env override) arms it; existing installs stay dark.
+const ARM_TRUTHY = /^(1|true|on|yes)$/i;
+const ARM_FALSY = /^(0|false|off|no)$/i;
+// parseArmToken(v) → true (armed) | false (disarmed) | null (no opinion — unset/blank/unrecognized).
+export function parseArmToken(v) {
+  const s = String(v ?? "").trim();
+  if (ARM_TRUTHY.test(s)) return true;
+  if (ARM_FALSY.test(s)) return false;
+  return null;
+}
+// verifyConfigArmed() → the persisted consent from client.json's "verify" key, or null if unset/unreadable.
+// Fail-open: any read/parse error → null (no opinion → falls through to DEFAULT OFF). Never throws.
+export function verifyConfigArmed() {
+  try {
+    return parseArmToken(JSON.parse(readFileSync(CLIENT_JSON_PATH, "utf8"))?.verify);
+  } catch {
+    return null;
+  }
+}
+// revealEnabled(env) — is the USER-VISIBLE reveal armed? env override > consented config > default off.
+// SKALPEL_VERIFY_SHADOW is deliberately NOT consulted here: it arms only the DARK log-only shadow (no
+// reveal); the spawn gate ORs it in separately (verifySpawnArmed). Wrapped so it can never throw.
 export function revealEnabled(env) {
-  return /^(1|true|on|yes)$/i.test(String((env || {}).SKALPEL_VERIFY_REVEAL || "").trim());
+  try {
+    const envOverride = parseArmToken((env || {}).SKALPEL_VERIFY_REVEAL);
+    if (envOverride !== null) return envOverride; // 1) dev/CI env override wins
+    const cfg = verifyConfigArmed();
+    if (cfg !== null) return cfg; // 2) consented config
+  } catch {
+    /* fall through to default */
+  }
+  return false; // 3) DEFAULT OFF
+}
+// verifySpawnArmed(env) — should the per-turn hook SPAWN the detached shadow worker at all? True when the
+// reveal is armed OR the dev log-only shadow (SKALPEL_VERIFY_SHADOW=1) is set. This is the single gate the
+// hook reads; it stays byte-identical to the prior inline `SHADOW==="1" || revealEnabled(env)` when the
+// config is absent, so no existing install starts spawning.
+export function verifySpawnArmed(env) {
+  try {
+    if (String((env || {}).SKALPEL_VERIFY_SHADOW || "").trim() === "1") return true;
+    return revealEnabled(env);
+  } catch {
+    return false;
+  }
+}
+
+// ---- FALSE-ACCUSATION SAFEGUARDS: adjudication ledger + derived auto-darken -----------------------
+// A "was this right?" flight recorder. `skalpel yes|no` appends ONE row here keyed to the most-recent
+// reveal; precision = right/(right+wrong) is derived from these rows, never a stored number that can lie.
+export const ADJUDICATIONS_PATH = join(DIR, "verify-adjudications.ndjson");
+// Every reveal actually SURFACED to the user is logged here (append-only) so `skalpel yes|no` can key an
+// adjudication to the real reveal it saw, and the field-proof report can count real fires.
+export const REVEALS_LOG_PATH = join(DIR, "verify-reveals.ndjson");
+// Session-scoped suppression: a `skalpel no` writes the (session, proof) here so that proof never
+// re-accuses for the rest of THAT session (matched by session id → a new session is never suppressed).
+export const SUPPRESS_PATH = join(DIR, "verify-suppressed.ndjson");
+
+// Auto-darken thresholds. If adjudicated precision < 90% over >= 10 adjudications, the LIVE red reveal
+// self-darkens (derived from these rows every read — NOT a stored flag) and falls back to `skalpel catches`.
+export const AUTO_DARKEN_MIN_ADJ = 10;
+export const AUTO_DARKEN_MIN_PRECISION = 0.9;
+
+// proofSig(s) — normalize a proof command for stable suppression matching (collapse whitespace, bound).
+export function proofSig(s) {
+  return String(s ?? "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 200);
+}
+
+function readNdjson(path, cap = 5000) {
+  try {
+    const rows = readFileSync(path, "utf8").trim().split("\n").filter(Boolean);
+    const out = [];
+    for (const l of rows.slice(-cap)) {
+      try {
+        out.push(JSON.parse(l));
+      } catch {
+        /* skip a partial/garbage line */
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
+
+// adjudicationStats() → { right, wrong, total, precision } from the REAL adjudication rows. precision is
+// right/(right+wrong) or null when there are none. Only "yes"/"no" verdicts count. Never throws.
+export function adjudicationStats() {
+  let right = 0;
+  let wrong = 0;
+  for (const r of readNdjson(ADJUDICATIONS_PATH)) {
+    if (r && r.verdict === "yes") right++;
+    else if (r && r.verdict === "no") wrong++;
+  }
+  const total = right + wrong;
+  return { right, wrong, total, precision: total > 0 ? right / total : null };
+}
+
+// autoDarkened() → is the live red reveal auto-paused? DERIVED from the adjudication rows every call (never
+// a stored boolean): true only once there are >= AUTO_DARKEN_MIN_ADJ adjudications AND precision < 90%.
+// Fail-open: any error → false (stay live — a broken read must never silently darken the catch).
+export function autoDarkened() {
+  try {
+    const { total, precision } = adjudicationStats();
+    return (
+      total >= AUTO_DARKEN_MIN_ADJ && precision !== null && precision < AUTO_DARKEN_MIN_PRECISION
+    );
+  } catch {
+    return false;
+  }
+}
+
+function appendNdjson(path, row) {
+  try {
+    mkdirSync(DIR, { recursive: true });
+    appendFileSync(path, JSON.stringify(row) + "\n");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// appendAdjudication(row) — ONE flight-recorder row (verdict yes/no, keyed to a reveal). Never throws.
+export function appendAdjudication(row) {
+  return appendNdjson(ADJUDICATIONS_PATH, { ts: new Date().toISOString(), ...row });
+}
+
+// appendRevealLog(row) — record a reveal that was actually SHOWN to the user (append-only, bounded).
+export function appendRevealLog(row) {
+  return appendNdjson(REVEALS_LOG_PATH, { ts: new Date().toISOString(), ...row });
+}
+
+// lastReveal() — the most-recent reveal actually shown (the row `skalpel yes|no` adjudicates). Null if none.
+export function lastReveal() {
+  const rows = readNdjson(REVEALS_LOG_PATH);
+  return rows.length ? rows[rows.length - 1] : null;
+}
+
+// suppressProof(session, proof) — after a `skalpel no`, stop this proof re-accusing for the rest of the
+// session. Requires a real session id (a null-session suppression would over-suppress). Never throws.
+export function suppressProof(session, proof) {
+  const sid = session ? String(session) : "";
+  const sig = proofSig(proof);
+  if (!sid || !sig) return false;
+  return appendNdjson(SUPPRESS_PATH, { ts: new Date().toISOString(), session: sid, proof: sig });
+}
+
+// isProofSuppressed(session, proof) — has this (session, proof) been marked "no" this session? Both sides
+// must have a real session id and they must match, plus the normalized proof must match. Fail-open → false.
+export function isProofSuppressed(session, proof) {
+  try {
+    const sid = session ? String(session) : "";
+    const sig = proofSig(proof);
+    if (!sid || !sig) return false;
+    for (const r of readNdjson(SUPPRESS_PATH)) {
+      if (r && String(r.session || "") === sid && proofSig(r.proof) === sig) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+// verifyArmedAt() — the real ISO timestamp `verify` was last turned ON (recorded in client.json at consent
+// time), as a Date, or null. Used only for the honest "armed N days" line — a recorded fact, not a metric.
+export function verifyArmedAt() {
+  try {
+    const t = JSON.parse(readFileSync(CLIENT_JSON_PATH, "utf8"))?.verify_armed_at;
+    const d = t ? new Date(t) : null;
+    return d && Number.isFinite(d.getTime()) ? d : null;
+  } catch {
+    return null;
+  }
 }
 
 // Unlike metrics.ndjson (write-only telemetry, uncapped), this file is READ by a TUI every render —

package/install.mjs

@@ -8,6 +8,7 @@ import {
   mkdirSync,
   existsSync,
   copyFileSync,
+  renameSync,
   rmSync,
   readdirSync,
 } from "node:fs";
@@ -42,40 +43,95 @@ const SESSION_FILE = join(HOOKS_DIR, "skalpel-hook-session.mjs");
 const SESSION_END_FILE = join(HOOKS_DIR, "skalpel-hook-session-end.mjs");
 const STATUSLINE_FILE = join(HOOKS_DIR, "skalpel-statusline.mjs");
 
-// Copy the hook runtime (the two entrypoints + their shared auth.mjs) into ~/.skalpel/hooks so the
-// wired absolute path is always valid. Overwrites on every install so upgrades refresh the code.
+// The COMPLETE import closure that must live in ~/.skalpel/hooks: the CLI entrypoints Claude Code /
+// Codex are wired to, plus every module those entrypoints (transitively) import. A hook wired to an
+// absolute path whose imported module is absent crashes on EVERY invocation with
+// `SyntaxError: ... does not provide an export named ...` / ERR_MODULE_NOT_FOUND — the exact
+// 0.3.12–0.3.16 bug shape. Keep this list a superset of the closure of skalpel-hook.mjs /
+// skalpel-hook-session.mjs / skalpel-hook-session-end.mjs / skalpel-statusline.mjs (see the trailing
+// note on each line for who imports it). Order is irrelevant now — staging is atomic (all files land
+// in a temp dir; the temp dir is only swapped into place after every copy succeeds).
+const RUNTIME_FILES = [
+  "insights.mjs", // hooks + statusline + reveal + verify-shadow import ./insights.mjs
+  "reveal.mjs", // both prompt/session hooks import ./reveal.mjs
+  "transcript.mjs", // skalpel-hook + skalpel-statusline + verify-shadow import ./transcript.mjs (tailLines)
+  "skalpel-hook.mjs", // UserPromptSubmit entrypoint (wired)
+  "skalpel-hook-session.mjs", // SessionStart entrypoint (wired)
+  "incremental-ingest.mjs", // skalpel-hook-session-end.mjs imports ./incremental-ingest.mjs
+  "skalpel-hook-session-end.mjs", // SessionEnd entrypoint (wired)
+  "skalpel-statusline.mjs", // statusLine entrypoint (wired)
+  "anchor-shadow.mjs", // verify-shadow.mjs (staged worker) imports ./anchor-shadow.mjs — probe primitives
+  "verify-shadow.mjs", // claim-verification SHADOW worker (spawned by skalpel-hook.mjs)
+  "auth.mjs", // hooks import ./auth.mjs
+  "metrics.mjs", // hooks import ./metrics.mjs
+  "stats.mjs", // `node ~/.skalpel/hooks/stats.mjs` — local read-only accumulator
+  "autopsy.mjs", // `node ~/.skalpel/hooks/autopsy.mjs` — local read-only receipt
+];
+
+// Stage the hook runtime into ~/.skalpel/hooks so the wired absolute path is always valid, ATOMICALLY:
+// copy the whole closure into a fresh temp dir and only swap it into place after EVERY copy succeeds.
+// This is the fix for the partial-upgrade fail-open: the old in-place overwrite copied the new
+// skalpel-hook.mjs BEFORE its auth.mjs/metrics.mjs, so a mid-copy I/O failure on an UPGRADE (hooks
+// already wired to the stable path) left the NEW hook next to the OLD auth at the live path — every
+// turn then crashed with a missing-export SyntaxError, and the all-or-nothing guard below only
+// refused to WIRE, never rolled back the already-clobbered files. With atomic staging a failed copy
+// leaves the EXISTING hooks dir 100% intact.
 function stageHookRuntime() {
   // Login and setup repair paths invoke the already-staged copy. Avoid copying a file onto itself.
   if (PKG_DIR === HOOKS_DIR) return;
-  mkdirSync(HOOKS_DIR, { recursive: true });
-  // insights.mjs is staged BEFORE the entrypoints that import it — a mid-copy ENOENT
-  // must not leave a wired hook missing its import (auth/metrics staging order predates
-  // this rule and is guarded by the all-or-nothing check below instead).
-  // a hook entrypoint staged without a module it imports — the exact 0.3.12–0.3.16 bug shape.
-  copyFileSync(join(PKG_DIR, "insights.mjs"), join(HOOKS_DIR, "insights.mjs")); // hooks import ./insights.mjs
-  copyFileSync(join(PKG_DIR, "reveal.mjs"), join(HOOKS_DIR, "reveal.mjs")); // both hooks import ./reveal.mjs
-  copyFileSync(join(PKG_DIR, "transcript.mjs"), join(HOOKS_DIR, "transcript.mjs")); // skalpel-hook + skalpel-statusline + verify-shadow + anchor-shadow import ./transcript.mjs (tailLines)
-  copyFileSync(join(PKG_DIR, "skalpel-hook.mjs"), HOOK_FILE);
-  copyFileSync(join(PKG_DIR, "skalpel-hook-session.mjs"), SESSION_FILE);
-  copyFileSync(join(PKG_DIR, "incremental-ingest.mjs"), join(HOOKS_DIR, "incremental-ingest.mjs"));
-  copyFileSync(join(PKG_DIR, "skalpel-hook-session-end.mjs"), SESSION_END_FILE);
-  copyFileSync(join(PKG_DIR, "skalpel-statusline.mjs"), STATUSLINE_FILE);
-  copyFileSync(join(PKG_DIR, "anchor-shadow.mjs"), join(HOOKS_DIR, "anchor-shadow.mjs")); // verify-shadow.mjs (staged worker) imports ./anchor-shadow.mjs — probe primitives; staged BEFORE verify-shadow.mjs
-  copyFileSync(join(PKG_DIR, "verify-shadow.mjs"), join(HOOKS_DIR, "verify-shadow.mjs")); // claim-verification SHADOW worker (spawned by skalpel-hook.mjs)
-  copyFileSync(join(PKG_DIR, "auth.mjs"), join(HOOKS_DIR, "auth.mjs")); // hooks import ./auth.mjs
-  copyFileSync(join(PKG_DIR, "metrics.mjs"), join(HOOKS_DIR, "metrics.mjs")); // hooks import ./metrics.mjs
-  copyFileSync(join(PKG_DIR, "stats.mjs"), join(HOOKS_DIR, "stats.mjs")); // `node ~/.skalpel/hooks/stats.mjs`
-  copyFileSync(join(PKG_DIR, "autopsy.mjs"), join(HOOKS_DIR, "autopsy.mjs")); // `node ~/.skalpel/hooks/autopsy.mjs` — local read-only receipt
+  const SKALPEL_DIR = dirname(HOOKS_DIR); // ~/.skalpel — staging/backup are siblings of hooks so every
+  const stagingDir = join(SKALPEL_DIR, `hooks.staging-${process.pid}`); // rename below is same-filesystem
+  const backupDir = join(SKALPEL_DIR, `hooks.bak-${process.pid}`); // (atomic) and never crosses devices.
+
+  // 1) Copy the WHOLE closure into a fresh temp dir. Scoped to THIS pid so a concurrent installer's
+  //    staging-<otherpid> is never disturbed; drop any leftover from a crashed prior run of this pid.
+  rmSync(stagingDir, { recursive: true, force: true });
+  mkdirSync(stagingDir, { recursive: true });
+  try {
+    for (const name of RUNTIME_FILES) {
+      copyFileSync(join(PKG_DIR, name), join(stagingDir, name));
+    }
+  } catch (e) {
+    // A copy failed part-way (incomplete tarball / disk error). The LIVE hooks dir was never touched —
+    // clean up the partial staging dir and rethrow so the caller refuses to wire.
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw e;
+  }
+
+  // 2) All copies succeeded — swap staging into place. rename can't overwrite a non-empty dir, so move
+  //    the old dir aside first, move the new one in, then delete the old. Both renames are same-device
+  //    (siblings under ~/.skalpel), so each is atomic. On ANY failure — including the old dir being
+  //    locked (Windows) so it can't even be moved aside — clean up the staging dir, and if we already
+  //    moved the old dir aside, roll it back so the wired path is never left without a hooks dir.
+  rmSync(backupDir, { recursive: true, force: true }); // stale bak from a crashed prior same-pid run
+  const hadLive = existsSync(HOOKS_DIR);
+  try {
+    if (hadLive) renameSync(HOOKS_DIR, backupDir);
+    renameSync(stagingDir, HOOKS_DIR);
+  } catch (e) {
+    if (hadLive && !existsSync(HOOKS_DIR) && existsSync(backupDir)) {
+      try {
+        renameSync(backupDir, HOOKS_DIR); // restore the previous working install
+      } catch {
+        /* rollback best-effort; the original is still recoverable at backupDir */
+      }
+    }
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw e;
+  }
+  // Swap done. Dropping the old dir is best-effort: a failure here only leaves a stale hooks.bak-<pid>,
+  // never a broken wired path.
+  rmSync(backupDir, { recursive: true, force: true });
 }
 if (!uninstall && !process.env.SKALPEL_HOOK_BIN) {
   try {
     stageHookRuntime();
   } catch (e) {
-    // Staging is all-or-nothing. A missing source file means the tarball is incomplete (a file this
-    // installer copies was left out of package.json "files"), and copyFileSync throws part-way
-    // through — so the *later* copies never run and the hooks are staged without the auth.mjs /
-    // metrics.mjs they import. Wiring absolute paths at that point yields hooks that crash on every
-    // prompt. Refuse to wire instead; a loud failure beats a silent no-op.
+    // Staging is atomic and all-or-nothing. A missing source file means the tarball is incomplete (a
+    // file this installer copies was left out of package.json "files"); any copy error aborts staging
+    // with the EXISTING hooks dir left fully intact (never a half-updated dir at the wired path).
+    // Wiring on top of a failed stage would risk hooks that crash on every prompt — so refuse to wire
+    // instead; a loud failure beats a silent no-op.
     console.error(`skalpel: could not stage hook runtime: ${e.message}`);
     console.error("skalpel: hooks were NOT wired.");
     process.exit(1);
@@ -222,7 +278,12 @@ function claude() {
   } else if (statuslineOnly) {
     return "preserved"; // a custom status line wins; do not rewrite unrelated Claude settings
   }
-  writeJson(CLAUDE, d);
+  // Only write when we actually added, refreshed, or removed one of OUR entries (mirrors codexToml's
+  // `if (hadToml) write` guard). Never CREATE a settings.json — nor re-serialize/churn an existing one
+  // — when there was nothing to do: an `uninstall` on a machine that never had our hooks leaves the
+  // file exactly as it was (or absent). Install always changes something here, so this only suppresses
+  // the no-op write.
+  if (installed || refreshed || removed) writeJson(CLAUDE, d);
   if (uninstall) return removed ? "removed" : "absent";
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
@@ -378,8 +439,15 @@ function codexJson() {
       installed += 1;
     }
   }
+  if (uninstall) {
+    // Never CREATE ~/.codex/hooks.json during an uninstall — only rewrite it when we actually stripped
+    // one of our blocks from an existing file (mirrors codexToml's hadToml guard). A machine whose
+    // ~/.codex has no hooks.json (or none of ours) has nothing to clean up, so writing here would drop
+    // a stray file behind an operation that's supposed to leave the machine clean.
+    if (removed) writeJson(CODEX, d);
+    return removed ? "removed" : "absent";
+  }
   writeJson(CODEX, d);
-  if (uninstall) return removed ? "removed" : "absent";
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
 

package/mutation-check.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+// mutation-check.mjs — mutation testing for the CRITICAL LOGIC: detectCompletionClaim (incl. the negation
+// guard), classifyOutcome, classifyConfirm, plus the false-accusation safeguards shipUrlPass (URL
+// reachability) and hasMutatingFlag (non-idempotent re-run guard). For each mutation we flip ONE key
+// predicate/branch in verify-shadow.mjs and re-run the pure-function suite (verify-core.test.mjs) against
+// the mutated copy. A mutation the suite still PASSES is a SURVIVOR (a test gap). Gate: survivors must be
+// 0. Run: `node mutation-check.mjs`.
+import { cpSync, mkdtempSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const TARGET = "verify-shadow.mjs";
+const SUITE = "verify-core.test.mjs";
+
+// Each mutation: a UNIQUE substring in verify-shadow.mjs and the flipped version. Every one MUST be caught
+// by at least one assertion in verify-core.test.mjs.
+const MUTATIONS = [
+  // ---- detectCompletionClaim (incl. the negation/hedge guard, Fix 2) ----
+  {
+    fn: "detectCompletionClaim",
+    find: 'if (!CLAIM_RE.test(s)) return { claim: false, text: "" };',
+    replace: 'if (CLAIM_RE.test(s)) return { claim: false, text: "" };',
+  },
+  {
+    fn: "detectCompletionClaim",
+    find: "if (!l || !CLAIM_RE.test(l)) continue;",
+    replace: "if (!l || CLAIM_RE.test(l)) continue;",
+  },
+  {
+    fn: "detectCompletionClaim",
+    find: "if (NEGATION_RE.test(l)) continue; // negated/hedged → not a completion claim",
+    replace: "if (!NEGATION_RE.test(l)) continue; // negated/hedged → not a completion claim",
+  },
+  {
+    fn: "detectCompletionClaim",
+    find: 'if (NEGATION_RE.test(s)) return { claim: false, text: "" };',
+    replace: 'if (!NEGATION_RE.test(s)) return { claim: false, text: "" };',
+  },
+  // ---- shipUrlPass (Fix 1: URL false-red safeguard) ----
+  {
+    fn: "shipUrlPass",
+    find: "if (urlResponded(ev1)) return true;",
+    replace: "if (urlResponded(ev1)) return false;",
+  },
+  {
+    fn: "shipUrlPass",
+    find: "  if (urlResponded(ev2)) return true;\n  return false;",
+    replace: "  if (urlResponded(ev2)) return true;\n  return true;",
+  },
+  // ---- hasMutatingFlag (Fix 3: non-idempotent re-run guard) ----
+  {
+    fn: "hasMutatingFlag",
+    find: "if (a.some((x) => MUTATING_FLAG.test(String(x)))) return true;",
+    replace: "if (a.some((x) => MUTATING_FLAG.test(String(x)))) return false;",
+  },
+  // ---- classifyOutcome ----
+  {
+    fn: "classifyOutcome",
+    find: 'if (!err) return "PASS";',
+    replace: 'if (err) return "PASS";',
+  },
+  {
+    fn: "classifyOutcome",
+    find: 'if (err.killed || err.signal === "SIGTERM") return "HARNESS_ERROR"; // hit the timeout',
+    replace: 'if (err.killed && err.signal === "SIGTERM") return "PASS"; // hit the timeout',
+  },
+  {
+    fn: "classifyOutcome",
+    find: 'if (exit === 127 || exit === 126) return "HARNESS_ERROR"; // command not found / not executable',
+    replace:
+      'if (exit === 127 && exit === 126) return "HARNESS_ERROR"; // command not found / not executable',
+  },
+  {
+    fn: "classifyOutcome",
+    find: 'return "GENUINE_FAIL"; // a real non-zero exit from the test/build/lint itself',
+    replace: 'return "HARNESS_ERROR"; // a real non-zero exit from the test/build/lint itself',
+  },
+  // ---- classifyConfirm (the flake-confirm state machine) ----
+  {
+    fn: "classifyConfirm",
+    find: 'const needsConfirm = firstOutcome === "GENUINE_FAIL";',
+    replace: 'const needsConfirm = firstOutcome !== "GENUINE_FAIL";',
+  },
+  {
+    fn: "classifyConfirm",
+    find: 'const confirmedFail = needsConfirm && confirmOutcome === "GENUINE_FAIL";',
+    replace: 'const confirmedFail = needsConfirm || confirmOutcome === "GENUINE_FAIL";',
+  },
+  {
+    fn: "classifyConfirm",
+    find: 'const confirmedFail = needsConfirm && confirmOutcome === "GENUINE_FAIL";',
+    replace: 'const confirmedFail = needsConfirm && confirmOutcome !== "GENUINE_FAIL";',
+  },
+  {
+    fn: "classifyConfirm",
+    find: "const unconfirmedFail = needsConfirm && !confirmedFail;",
+    replace: "const unconfirmedFail = needsConfirm && confirmedFail;",
+  },
+];
+
+const workRoot = mkdtempSync(join(tmpdir(), "skalpel-mutants-"));
+cpSync(HERE, join(workRoot, "src"), {
+  recursive: true,
+  filter: (s) => !s.includes("node_modules"),
+});
+const dir = join(workRoot, "src");
+const targetPath = join(dir, TARGET);
+const pristine = readFileSync(targetPath, "utf8");
+
+function runSuite() {
+  const r = spawnSync("node", ["--test", SUITE], { cwd: dir, encoding: "utf8" });
+  return r.status; // 0 = suite passed (mutant SURVIVED); non-zero = suite failed (mutant KILLED)
+}
+
+// Baseline: the pristine copy must pass, else the harness itself is broken.
+if (runSuite() !== 0) {
+  console.error(
+    "BASELINE FAIL: verify-core.test.mjs does not pass on the pristine copy — aborting.",
+  );
+  process.exit(2);
+}
+
+let survivors = 0;
+let missing = 0;
+const results = [];
+for (const m of MUTATIONS) {
+  const count = pristine.split(m.find).length - 1;
+  if (count !== 1) {
+    missing++;
+    results.push(`  ✗ MUTATION TARGET NOT UNIQUE (${count}×) [${m.fn}] ${m.find.slice(0, 50)}…`);
+    continue;
+  }
+  writeFileSync(targetPath, pristine.replace(m.find, m.replace));
+  const killed = runSuite() !== 0;
+  writeFileSync(targetPath, pristine); // restore
+  if (killed) {
+    results.push(`  ✓ killed   [${m.fn}] ${m.find.slice(0, 52)}…`);
+  } else {
+    survivors++;
+    results.push(`  ☠ SURVIVED [${m.fn}] ${m.find.slice(0, 52)}…`);
+  }
+}
+
+rmSync(workRoot, { recursive: true, force: true });
+console.log(results.join("\n"));
+console.log(
+  `\nmutants: ${MUTATIONS.length}   killed: ${MUTATIONS.length - survivors - missing}   survivors: ${survivors}   target-errors: ${missing}`,
+);
+if (survivors === 0 && missing === 0) {
+  console.log(
+    "MUTATION GATE: survivors = 0 on the critical + false-accusation-safeguard functions ✓",
+  );
+  process.exit(0);
+}
+process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.40",
+  "version": "4.0.42",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/postinstall.mjs

@@ -48,12 +48,37 @@ function retireLegacyDaemon() {
 
 function stageStatusline() {
   try {
-    // --statusline-only: stage the read-only indicator, do NOT wire prompt/session hooks yet.
-    spawnSync(process.execPath, [join(DIR, "install.mjs"), "--statusline-only"], {
+    // --statusline-only: stage the read-only indicator, do NOT wire prompt/session hooks yet. NOTE:
+    // this still runs the FULL hook-runtime staging inside install.mjs — so if staging genuinely fails
+    // (an incomplete package, a mid-copy I/O error) install.mjs exits non-zero. We MUST read that
+    // status: an unattended `npm install/update -g` upgrade that hits a staging failure would otherwise
+    // leave a broken/stale runtime with postinstall exiting 0 — a failure masquerading as success.
+    const r = spawnSync(process.execPath, [join(DIR, "install.mjs"), "--statusline-only"], {
       stdio: "inherit",
     });
-  } catch {
-    /* fail-open */
+    if (r.error || r.status !== 0) {
+      // Surface it LOUDLY (stderr), but keep the fail-open posture: package.json wraps postinstall in
+      // `|| true`, so npm install itself is never bricked — the user still gets the package and can
+      // repair with `skalpel setup`. A first install where hooks aren't wired yet does NOT reach here:
+      // install.mjs only exits non-zero on a real staging failure, not on a clean statusline-only stage.
+      const detail = r.error
+        ? r.error.message
+        : r.signal
+          ? `killed by ${r.signal}`
+          : `exit code ${r.status}`;
+      process.stderr.write(
+        `\n  skalpel: WARNING — hook staging failed (${detail}). Hooks/status line may be missing or ` +
+          `stale. Run \x1b[1mskalpel setup\x1b[22m to repair.\n\n`,
+      );
+      process.exitCode = 1; // record the failure; package.json's `|| true` keeps npm install green
+      return false;
+    }
+    return true;
+  } catch (e) {
+    // spawn itself failed (couldn't launch node at all) — still surface, still fail-open.
+    process.stderr.write(`\n  skalpel: WARNING — could not run the installer (${e.message}).\n\n`);
+    process.exitCode = 1;
+    return false;
   }
 }
 
@@ -75,11 +100,13 @@ function fixSudoOwnership() {
 }
 
 retireLegacyDaemon();
-stageStatusline();
+const stagingOk = stageStatusline();
 fixSudoOwnership();
 
 // A quiet nudge — the real onboarding (Google sign-in → build graph → insights) runs on `skalpel`.
-if (process.stdout.isTTY && !process.env.CI) {
+// Suppressed when staging failed: the warning above is the honest signal, and a cheerful
+// "installed" line under it would read as success.
+if (stagingOk && process.stdout.isTTY && !process.env.CI) {
   process.stdout.write(
     "\n  skalpel installed. Run \x1b[1mskalpel\x1b[22m to sign in and build your graph.\n\n",
   );

package/skalpel-hook.mjs

@@ -13,7 +13,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { identity } from "./auth.mjs";
 import { record } from "./metrics.mjs";
-import { recordInsight, cleanText, revealEnabled } from "./insights.mjs";
+import { recordInsight, cleanText, verifySpawnArmed } from "./insights.mjs";
 import { graphReadyNote, verifyCatchNote } from "./reveal.mjs";
 import { tailLines } from "./transcript.mjs";
 
@@ -510,13 +510,11 @@ async function main() {
   // recent test/build/typecheck/lint command and RE-RUNs it out-of-band to log the real PASS/FAIL the
   // agent can't forge. LOG ONLY — it writes nothing to this hook's stdout and never blocks the turn (the
   // re-run, up to 60s, lives in a separate unref'd process). Wrapped so it can never affect the injection.
-  // SKALPEL_VERIFY_REVEAL (the opt-in "aha catch" surface) ALSO arms the re-run — one flag turns on both
-  // the detection and its user-visible reveal. When BOTH are off (the default) this branch is skipped and
-  // the hook's stdout is byte-identical to before; the spawn is detached with stdio ignored regardless.
-  if (
-    (process.env.SKALPEL_VERIFY_SHADOW === "1" || revealEnabled(process.env)) &&
-    payload.transcript_path
-  ) {
+  // ARMING is resolved by the ONE shared resolver (verifySpawnArmed): the consented `verify:"on"` in
+  // client.json OR a dev env override (SKALPEL_VERIFY_SHADOW=1 / SKALPEL_VERIFY_REVEAL). When arming
+  // resolves OFF (the default for every existing install — env unset + config off/absent) this branch is
+  // skipped and the hook's stdout is byte-identical to before; the spawn is detached with stdio ignored.
+  if (verifySpawnArmed(process.env) && payload.transcript_path) {
     try {
       const { spawn } = await import("node:child_process");
       const { fileURLToPath } = await import("node:url");