skalpel 4.0.41 → 4.0.43

package/_test-home.mjs

@@ -0,0 +1,18 @@
+// _test-home.mjs — TEST-ONLY isolation shim. Imported FIRST (before any client module) by every test
+// that touches ~/.skalpel, so os.homedir() resolves to a throwaway temp dir and the suite can never read
+// or clobber the developer's real ~/.skalpel. ESM evaluates imports depth-first in source order, so a test
+// that does `import "./_test-home.mjs"` before `import "./insights.mjs"` guarantees HOME is redirected
+// BEFORE insights.mjs binds its DIR = join(homedir(), ".skalpel") at module load. Not a test file itself.
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const home = mkdtempSync(join(tmpdir(), "skalpel-verify-test-"));
+process.env.HOME = home;
+process.env.USERPROFILE = home; // Windows
+// Never let a stray dev env var arm/disarm the resolver mid-test — each test sets these explicitly.
+delete process.env.SKALPEL_VERIFY_REVEAL;
+delete process.env.SKALPEL_VERIFY_SHADOW;
+
+export const TEST_HOME = home;
+export const SKALPEL_DIR = join(home, ".skalpel");

package/anchor-shadow.mjs

@@ -187,18 +187,30 @@ export function detectShipStatusSpiral(turns) {
 // (2) reconstructTarget — pull the concrete anchor from recent turns + repo context. Returns a STRUCTURED
 // target or null (null = "not confidently reconstructable" → the caller logs a miss and does NOT fire).
 // ---------------------------------------------------------------------------------------------------
+// The context passed in (recentContextText) is joined OLDEST→NEWEST, so a plain non-global .exec() would
+// return the STALEST match. A ship-status probe must target the claim the user is doubting NOW — so scan
+// ALL matches globally and keep the LAST (most-recent) valid one, not the first (a stale PR/URL from many
+// turns ago).
 function findPr(text) {
   // "#123", "PR 123", "PR#123", "pull/123", "pull request 123"
-  const m = /(?:\bpr\s*#?\s*|\bpull(?:\s*request)?\s*#?\s*|\/pull\/|#)(\d{1,6})\b/i.exec(text);
-  if (!m) return null;
-  const n = Number(m[1]);
-  return Number.isInteger(n) && n > 0 && n < 1e7 ? n : null;
+  const re = /(?:\bpr\s*#?\s*|\bpull(?:\s*request)?\s*#?\s*|\/pull\/|#)(\d{1,6})\b/gi;
+  let last = null;
+  let m;
+  while ((m = re.exec(text))) {
+    const n = Number(m[1]);
+    if (Number.isInteger(n) && n > 0 && n < 1e7) last = n;
+  }
+  return last;
 }
 function findUrl(text) {
-  const m = /\bhttps?:\/\/[^\s'")<>`]+/i.exec(text);
-  if (!m) return null;
-  let url = m[0].replace(/[.,);]+$/, ""); // trim trailing punctuation from prose
-  return isSafeUrl(url) ? url : null;
+  const re = /\bhttps?:\/\/[^\s'")<>`]+/gi;
+  let last = null;
+  let m;
+  while ((m = re.exec(text))) {
+    const url = m[0].replace(/[.,);]+$/, ""); // trim trailing punctuation from prose
+    if (isSafeUrl(url)) last = url;
+  }
+  return last;
 }
 function findSha(text) {
   // Prefer a sha that appears near commit-ish words; otherwise the longest lone hex token in [7,40].

package/autopsy.mjs

@@ -49,6 +49,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import readline from "node:readline";
+import { fileURLToPath } from "node:url";
 
 const HOME = os.homedir();
 const PROJECTS_DIR = path.join(HOME, ".claude", "projects");
@@ -212,10 +213,23 @@ function extractAnchors(text) {
   return out;
 }
 
-function span(text, at, len) {
+// Captured transcript prose + tool output become quoted/shareable snippets via span() and vb(). Strip ESC
+// + other C0 control chars so a hostile log line can't inject ANSI/CSI/OSC escapes (color, cursor moves,
+// title/clipboard spoofing) into the receipt or a paste of it. redact() still runs on top for PII on the
+// shareable surfaces; this is the terminal-safety layer beneath it (same defense as card.mjs `clean`).
+export function stripCtrl(s) {
+  return (
+    String(s == null ? "" : s)
+      // eslint-disable-next-line no-control-regex
+      .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+      // eslint-disable-next-line no-control-regex
+      .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ")
+  ); // other control chars (incl. ESC/BEL) → space
+}
+export function span(text, at, len) {
   const a = Math.max(0, at - SPAN),
     b = Math.min(text.length, at + len + SPAN);
-  return text.slice(a, b).replace(/\s+/g, " ").trim().slice(0, 200);
+  return stripCtrl(text.slice(a, b)).replace(/\s+/g, " ").trim().slice(0, 200);
 }
 
 // ~/.claude/projects encodes cwd as a dash-flattened path. Every vendor's project root is normalized to
@@ -1282,7 +1296,7 @@ async function main() {
         const full = t.text || t.toolErrText || "";
         const pos = full.toLowerCase().indexOf(rec.anchor.toLowerCase());
         return pos < 0
-          ? full.replace(/\s+/g, " ").trim().slice(0, 200)
+          ? stripCtrl(full).replace(/\s+/g, " ").trim().slice(0, 200)
           : span(full, pos, rec.anchor.length);
       };
       cellC.push({
@@ -1618,8 +1632,24 @@ function renderFooter(P, presentVendors) {
   P();
 }
 
-main().catch((e) => {
-  // fail closed and quiet: never crash a user's terminal, never invent output.
-  process.stderr.write(`skalpel autopsy: ${e && e.message ? e.message : e}\n`);
-  process.exit(0);
-});
+// CLI guard: run the autopsy only when executed directly (`node autopsy.mjs`), never on import — so tests
+// and siblings can import helpers (span/stripCtrl) without triggering a full disk scan. autopsy is always
+// launched as a subprocess (`spawnSync node autopsy.mjs`), so direct-run behavior is unchanged. Mirrors the
+// isMain idiom in verify-shadow.mjs / ledger.mjs.
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  main().catch((e) => {
+    // fail closed and quiet: never crash a user's terminal, never invent output.
+    process.stderr.write(`skalpel autopsy: ${e && e.message ? e.message : e}\n`);
+    process.exit(0);
+  });
+}

package/catches.mjs

@@ -215,17 +215,39 @@ function indexResults(entries) {
 // result (we never ran the process, so there is no live err). This keeps HARNESS_ERROR vs GENUINE_FAIL
 // identical to the live shadow: a timeout / command-not-found / missing-script is harness noise and is
 // NEVER counted as a lie.
+// A real Claude/Anthropic tool_result block is {tool_use_id, content, is_error} — it carries NO structured
+// exit_code field (only Codex rollouts, normalized in loadCodexEntries, synthesize one). So indexResults
+// hands us exitCode=null for EVERY Claude result, which made the numeric-exit-code branch below dead for
+// Claude: a 127/126 harness failure fell through to `{code:1}` and cried wolf as a GENUINE_FAIL, and a real
+// non-zero exit Claude didn't flag via is_error was silently dropped as PASS. For a Claude proof the code
+// lives in the recorded text — but read it ONLY from the LEADING line. Claude Code prepends the failing
+// process's outcome as the first line of the Bash tool_result ("Exit code 1\n…", verified across real
+// transcripts: 142/142 non-zero-exit results start with "Exit code N"; a PASSING command has no such line).
+// An UNANCHORED full-body scan would misread an unrelated "exit code N" the command itself printed — a
+// grep/cat of source, a pasted CI log like "##[error]Process completed with exit code 123." — and cry wolf
+// on a genuinely-passing proof. Anchoring to the first line reads the real outcome and nothing else.
+function exitCodeFromText(text) {
+  const firstLine = String(text || "").split("\n", 1)[0];
+  const m = firstLine.match(/^\s*exit(?:ed)?(?:\s+with)?\s+(?:code|status)\s+(\d{1,3})\b/i);
+  if (!m) return null;
+  const n = Number.parseInt(m[1], 10);
+  return Number.isFinite(n) ? n : null;
+}
 function classifyRecorded({ isError, exitCode, text }) {
-  if (exitCode === 0) return "PASS";
-  if (exitCode == null && !isError) return "PASS"; // no failure signal recorded → treat as pass (never invent)
   const ev = String(text || "");
+  // Prefer the structured exit code (Codex); else recover a real code from the text (Claude). This makes
+  // the numeric-exit-code branch reachable for Claude, so 127/126 route to HARNESS_ERROR (no cry-wolf) and
+  // a textual non-zero exit is caught even when is_error wasn't set.
+  const code = typeof exitCode === "number" ? exitCode : exitCodeFromText(ev);
+  if (code === 0) return "PASS";
+  if (code == null && !isError) return "PASS"; // no failure signal at all → never invent a lie
   let err;
   if (/\btimed?\s*out\b|timeout after|\bSIGKILL\b|\bSIGTERM\b/i.test(ev)) {
     err = { killed: true, signal: "SIGTERM" }; // classifyOutcome → HARNESS_ERROR
-  } else if (typeof exitCode === "number" && exitCode !== 0) {
-    err = { code: exitCode }; // real recorded non-zero exit (127/126 → HARNESS_ERROR in classifyOutcome)
+  } else if (typeof code === "number" && code !== 0) {
+    err = { code }; // real recorded non-zero exit (127/126 → HARNESS_ERROR in classifyOutcome)
   } else {
-    err = { code: 1 }; // Claude is_error with no numeric code → generic non-zero
+    err = { code: 1 }; // is_error flagged but no numeric code recorded → generic non-zero
   }
   return classifyOutcome(err, ev);
 }
@@ -315,8 +337,16 @@ export function runScan() {
 }
 
 // ---------- (6) render the honest report ----------
+// claim_text / proof_command / evidence are UNTRUSTED captured strings (agent transcript + test output)
+// rendered straight to a live terminal. Strip ESC + other C0 control chars FIRST (same defense as
+// card.mjs / analytics.mjs `clean`) so a hostile transcript row can't inject ANSI/CSI/OSC escapes
+// (color, cursor moves, title/clipboard spoofing) — then collapse whitespace and cap length.
 function clip(s, n) {
   const t = String(s || "")
+    // eslint-disable-next-line no-control-regex
+    .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ") // other control chars (incl. ESC/BEL) → space
     .replace(/\s+/g, " ")
     .trim();
   return t.length > n ? t.slice(0, n - 1) + "…" : t;
@@ -348,7 +378,11 @@ export function renderReport({ scanned, catches }) {
     return L.join("\n");
   }
 
-  const cmds = [...new Set(catches.map((c) => c.proof_command.split(/\s+/).slice(0, 3).join(" ")))];
+  // clip() here too: the headline command phrase is built from the untrusted proof_command and rendered
+  // to the terminal, so it needs the same ESC/control-char stripping as the receipt bodies below.
+  const cmds = [
+    ...new Set(catches.map((c) => clip(c.proof_command, 64).split(/\s+/).slice(0, 3).join(" "))),
+  ];
   const cmdPhrase = cmds.length === 1 ? `\`${cmds[0]}\`` : "its own test/build";
   L.push("");
   L.push(`  skalpel scanned ${N} of your recent sessions and found`);

package/incremental-ingest.mjs

@@ -215,11 +215,23 @@ async function sleep(ms) {
   await new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
 }
 
-async function request(fetchFn, url, init, timeoutMs) {
+// fetch() resolves as soon as the response HEADERS arrive; the BODY then streams separately. Clearing the
+// abort timer the instant fetch() resolves (the old `finally`) left every body read — `res.json()` at the
+// call sites — with NO deadline, so a slow or hung response body could stall the drain loop forever. Keep
+// the timer armed and read the FULL body HERE, under the same timeout; hand callers a tiny response-like
+// shim exposing only what they use (status, ok, json()). A stalled body now aborts and rejects instead of
+// hanging. Callers only ever read status/ok and `await response.json().catch(...)`, so the shim suffices.
+export async function request(fetchFn, url, init, timeoutMs) {
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), timeoutMs);
   try {
-    return await fetchFn(url, { ...init, signal: ctrl.signal });
+    const res = await fetchFn(url, { ...init, signal: ctrl.signal });
+    const body = await res.text(); // fully consume the body while the timeout is still armed
+    return {
+      status: res.status,
+      ok: res.ok,
+      json: async () => JSON.parse(body), // async so callers' `.json().catch(...)` catches parse errors
+    };
   } finally {
     clearTimeout(timer);
   }

package/insights.mjs

@@ -17,6 +17,9 @@ import { join } from "node:path";
 
 const DIR = join(homedir(), ".skalpel");
 export const INSIGHTS_PATH = join(DIR, "insights.ndjson");
+// The persisted client config `skalpel setup` writes (api/user/verify). Read HERE too so the ONE arming
+// resolver can consult the consented `verify` key without any writer/reader plumbing.
+export const CLIENT_JSON_PATH = join(DIR, "client.json");
 
 // ---- verify-reveal: the opt-in "aha catch" surface — single source for the flag + the state-file path.
 // The reveal is WRITTEN by verify-shadow.mjs (the detached proof re-runner, when the agent claimed
@@ -30,10 +33,188 @@ export const REVEAL_PATH = join(DIR, "verify-reveal.json");
 // rare red catch land like a thunderclap — without a stream of honest verified stamps a lone red reads as
 // noise, not a verdict. Path single-sourced HERE alongside REVEAL_PATH so writer + reader never drift.
 export const VERDICT_PATH = join(DIR, "verify-verdict.json");
-// SKALPEL_VERIFY_REVEAL is OPT-IN and OFF BY DEFAULT. Unset / "" / "0" / "off" / "false" / "no" → DARK
-// (byte-identical to the shadow-only behavior). Only an explicit truthy value arms the visible reveal.
+// ---- THE ONE ARMING RESOLVER (single source of truth) --------------------------------------------
+// The "aha catch" is OPT-IN and OFF BY DEFAULT. Arming is resolved by ONE function everyone reads —
+// the hook spawn gate, the statusline reveal, verify-shadow's surfacing, and reveal.mjs's agent note —
+// so writer, reader, and gate can never drift. PRECEDENCE:
+//   1. ENV OVERRIDE (dev/CI): SKALPEL_VERIFY_REVEAL, explicit on OR off, always wins.
+//   2. CONSENTED CONFIG: ~/.skalpel/client.json "verify" key ("on"/"off"), written by `skalpel setup`.
+//   3. DEFAULT OFF — an absent config + unset env is DARK, byte-identical to the shadow-only baseline.
+// Only an explicit consented "on" (or a dev env override) arms it; existing installs stay dark.
+const ARM_TRUTHY = /^(1|true|on|yes)$/i;
+const ARM_FALSY = /^(0|false|off|no)$/i;
+// parseArmToken(v) → true (armed) | false (disarmed) | null (no opinion — unset/blank/unrecognized).
+export function parseArmToken(v) {
+  const s = String(v ?? "").trim();
+  if (ARM_TRUTHY.test(s)) return true;
+  if (ARM_FALSY.test(s)) return false;
+  return null;
+}
+// verifyConfigArmed() → the persisted consent from client.json's "verify" key, or null if unset/unreadable.
+// Fail-open: any read/parse error → null (no opinion → falls through to DEFAULT OFF). Never throws.
+export function verifyConfigArmed() {
+  try {
+    return parseArmToken(JSON.parse(readFileSync(CLIENT_JSON_PATH, "utf8"))?.verify);
+  } catch {
+    return null;
+  }
+}
+// revealEnabled(env) — is the USER-VISIBLE reveal armed? env override > consented config > default off.
+// SKALPEL_VERIFY_SHADOW is deliberately NOT consulted here: it arms only the DARK log-only shadow (no
+// reveal); the spawn gate ORs it in separately (verifySpawnArmed). Wrapped so it can never throw.
 export function revealEnabled(env) {
-  return /^(1|true|on|yes)$/i.test(String((env || {}).SKALPEL_VERIFY_REVEAL || "").trim());
+  try {
+    const envOverride = parseArmToken((env || {}).SKALPEL_VERIFY_REVEAL);
+    if (envOverride !== null) return envOverride; // 1) dev/CI env override wins
+    const cfg = verifyConfigArmed();
+    if (cfg !== null) return cfg; // 2) consented config
+  } catch {
+    /* fall through to default */
+  }
+  return false; // 3) DEFAULT OFF
+}
+// verifySpawnArmed(env) — should the per-turn hook SPAWN the detached shadow worker at all? True when the
+// reveal is armed OR the dev log-only shadow (SKALPEL_VERIFY_SHADOW=1) is set. This is the single gate the
+// hook reads; it stays byte-identical to the prior inline `SHADOW==="1" || revealEnabled(env)` when the
+// config is absent, so no existing install starts spawning.
+export function verifySpawnArmed(env) {
+  try {
+    if (String((env || {}).SKALPEL_VERIFY_SHADOW || "").trim() === "1") return true;
+    return revealEnabled(env);
+  } catch {
+    return false;
+  }
+}
+
+// ---- FALSE-ACCUSATION SAFEGUARDS: adjudication ledger + derived auto-darken -----------------------
+// A "was this right?" flight recorder. `skalpel yes|no` appends ONE row here keyed to the most-recent
+// reveal; precision = right/(right+wrong) is derived from these rows, never a stored number that can lie.
+export const ADJUDICATIONS_PATH = join(DIR, "verify-adjudications.ndjson");
+// Every reveal actually SURFACED to the user is logged here (append-only) so `skalpel yes|no` can key an
+// adjudication to the real reveal it saw, and the field-proof report can count real fires.
+export const REVEALS_LOG_PATH = join(DIR, "verify-reveals.ndjson");
+// Session-scoped suppression: a `skalpel no` writes the (session, proof) here so that proof never
+// re-accuses for the rest of THAT session (matched by session id → a new session is never suppressed).
+export const SUPPRESS_PATH = join(DIR, "verify-suppressed.ndjson");
+
+// Auto-darken thresholds. If adjudicated precision < 90% over >= 10 adjudications, the LIVE red reveal
+// self-darkens (derived from these rows every read — NOT a stored flag) and falls back to `skalpel catches`.
+export const AUTO_DARKEN_MIN_ADJ = 10;
+export const AUTO_DARKEN_MIN_PRECISION = 0.9;
+
+// proofSig(s) — normalize a proof command for stable suppression matching (collapse whitespace, bound).
+export function proofSig(s) {
+  return String(s ?? "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 200);
+}
+
+function readNdjson(path, cap = 5000) {
+  try {
+    const rows = readFileSync(path, "utf8").trim().split("\n").filter(Boolean);
+    const out = [];
+    for (const l of rows.slice(-cap)) {
+      try {
+        out.push(JSON.parse(l));
+      } catch {
+        /* skip a partial/garbage line */
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
+
+// adjudicationStats() → { right, wrong, total, precision } from the REAL adjudication rows. precision is
+// right/(right+wrong) or null when there are none. Only "yes"/"no" verdicts count. Never throws.
+export function adjudicationStats() {
+  let right = 0;
+  let wrong = 0;
+  for (const r of readNdjson(ADJUDICATIONS_PATH)) {
+    if (r && r.verdict === "yes") right++;
+    else if (r && r.verdict === "no") wrong++;
+  }
+  const total = right + wrong;
+  return { right, wrong, total, precision: total > 0 ? right / total : null };
+}
+
+// autoDarkened() → is the live red reveal auto-paused? DERIVED from the adjudication rows every call (never
+// a stored boolean): true only once there are >= AUTO_DARKEN_MIN_ADJ adjudications AND precision < 90%.
+// Fail-open: any error → false (stay live — a broken read must never silently darken the catch).
+export function autoDarkened() {
+  try {
+    const { total, precision } = adjudicationStats();
+    return (
+      total >= AUTO_DARKEN_MIN_ADJ && precision !== null && precision < AUTO_DARKEN_MIN_PRECISION
+    );
+  } catch {
+    return false;
+  }
+}
+
+function appendNdjson(path, row) {
+  try {
+    mkdirSync(DIR, { recursive: true });
+    appendFileSync(path, JSON.stringify(row) + "\n");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// appendAdjudication(row) — ONE flight-recorder row (verdict yes/no, keyed to a reveal). Never throws.
+export function appendAdjudication(row) {
+  return appendNdjson(ADJUDICATIONS_PATH, { ts: new Date().toISOString(), ...row });
+}
+
+// appendRevealLog(row) — record a reveal that was actually SHOWN to the user (append-only, bounded).
+export function appendRevealLog(row) {
+  return appendNdjson(REVEALS_LOG_PATH, { ts: new Date().toISOString(), ...row });
+}
+
+// lastReveal() — the most-recent reveal actually shown (the row `skalpel yes|no` adjudicates). Null if none.
+export function lastReveal() {
+  const rows = readNdjson(REVEALS_LOG_PATH);
+  return rows.length ? rows[rows.length - 1] : null;
+}
+
+// suppressProof(session, proof) — after a `skalpel no`, stop this proof re-accusing for the rest of the
+// session. Requires a real session id (a null-session suppression would over-suppress). Never throws.
+export function suppressProof(session, proof) {
+  const sid = session ? String(session) : "";
+  const sig = proofSig(proof);
+  if (!sid || !sig) return false;
+  return appendNdjson(SUPPRESS_PATH, { ts: new Date().toISOString(), session: sid, proof: sig });
+}
+
+// isProofSuppressed(session, proof) — has this (session, proof) been marked "no" this session? Both sides
+// must have a real session id and they must match, plus the normalized proof must match. Fail-open → false.
+export function isProofSuppressed(session, proof) {
+  try {
+    const sid = session ? String(session) : "";
+    const sig = proofSig(proof);
+    if (!sid || !sig) return false;
+    for (const r of readNdjson(SUPPRESS_PATH)) {
+      if (r && String(r.session || "") === sid && proofSig(r.proof) === sig) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+// verifyArmedAt() — the real ISO timestamp `verify` was last turned ON (recorded in client.json at consent
+// time), as a Date, or null. Used only for the honest "armed N days" line — a recorded fact, not a metric.
+export function verifyArmedAt() {
+  try {
+    const t = JSON.parse(readFileSync(CLIENT_JSON_PATH, "utf8"))?.verify_armed_at;
+    const d = t ? new Date(t) : null;
+    return d && Number.isFinite(d.getTime()) ? d : null;
+  } catch {
+    return null;
+  }
 }
 
 // Unlike metrics.ndjson (write-only telemetry, uncapped), this file is READ by a TUI every render —

package/ledger.mjs

@@ -106,8 +106,10 @@ function firstGreater(sorted, x) {
 // even in a tampered log its own ts equals t0, which the strict `> t0` search already excludes — so the
 // self-skip was a no-op and omitting it changes nothing (proven by the equivalence fixtures).
 // opts.excludeNullSession — when true, a false row with a null session yields null (the statusline's
-// Finding-3 guard). ledger.mjs's own view keeps the historical behavior (null-session rows CAN pair with
-// other null-session rows) by leaving it false, so its results stay byte-identical to the old code.
+// Finding-3 guard). Both live views (ledger.mjs AND the statusline) now pass it true: a NULL session
+// carries no real identity, so `(r.session ?? null) === (falseRow.session ?? null)` would read null===null
+// and pair a caught-false row with an UNRELATED null-session PASS of the same proof — a bogus, cross-
+// attributed fix delta. Requiring a real session id to measure a fix is the honest floor.
 export function buildFixDeltas(rows, { excludeNullSession = false } = {}) {
   const index = new Map(); // (session ?? null) → Map<proof_command, ascending ts[]>
   for (const r of rows || []) {
@@ -180,7 +182,10 @@ export function buildLedger(rows) {
   const falseEntries = entries.filter((e) => e.verdict === "FALSE");
   // Attach the MEASURED fix delta where — and only where — a real later same-proof PASS exists. ONE index
   // pass (buildFixDeltas) then a binary-search per false row: O(n log n), not the old O(falseCount × rows).
-  const fixDeltaFor = buildFixDeltas(rows || []);
+  // excludeNullSession: a caught-false row with a NULL session can't be tied to a fix (null carries no
+  // identity), so it never cross-attributes another null-session run's PASS — the same guard the statusline
+  // sibling applies. Count-only for such rows, never a fabricated delta.
+  const fixDeltaFor = buildFixDeltas(rows || [], { excludeNullSession: true });
   for (const e of falseEntries) {
     const d = fixDeltaFor(e._row);
     e.fix_delta_ms = d ? d.ms : null;
@@ -198,8 +203,16 @@ export function buildLedger(rows) {
 }
 
 // ---------- (4) render ----------
+// claim_text / proof_command / evidence are UNTRUSTED captured strings (agent transcript + test output)
+// rendered straight to a live terminal. Strip ESC + other C0 control chars FIRST (same defense as
+// card.mjs / analytics.mjs `clean`) so a tampered/hostile log row can't inject ANSI/CSI/OSC escapes
+// (color, cursor moves, title/clipboard spoofing) — then collapse whitespace and cap length.
 function clip(s, n) {
   const t = String(s || "")
+    // eslint-disable-next-line no-control-regex
+    .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ") // other control chars (incl. ESC/BEL) → space
     .replace(/\s+/g, " ")
     .trim();
   return t.length > n ? t.slice(0, n - 1) + "…" : t;

package/login.mjs

@@ -4,11 +4,12 @@
 //   the token → save it. The server holds the client secret and does the code exchange; we only ever
 //   see the finished Google id_token. Branded onboarding reproduces the original prosumer `setup.mjs`
 //   red block wordmark 1:1. Run: `node skalpel-login.mjs`.
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
 
 const API = process.env.SKALPEL_API || "https://graph.skalpel.ai";
 const CLIENT_ID =
@@ -51,15 +52,38 @@ function authPath() {
   return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "skalpel", "auth.json");
 }
 
+// Build the spawn recipe to open a URL in the default browser, safely, per-platform. Windows is the sharp
+// edge: `start` is a cmd builtin (so it needs cmd.exe), and the OAuth URL is full of `&` param separators.
+// The old path — spawn("start", [url], { shell: true }) — let cmd SPLIT the URL on its unquoted `&`, so
+// sign-in silently broke (URL truncated at the first `&`) and any `&<token>` ran as a separate command
+// (injection surface). Here we spawn cmd.exe with NO shell and windowsVerbatimArguments, quoting the URL
+// ourselves so cmd treats the whole thing as one literal token. `'""'` is start's window title — it must be
+// a LITERAL empty quote-pair (a zero-length JS string would contribute 0 chars to the verbatim command
+// line, so start would consume the URL itself as the title and never open the browser). Any stray
+// double-quote in the URL is stripped so it can't break out of its quotes (URLSearchParams never emits one
+// anyway). macOS/Linux never use a shell, so their URL already rides as a single argv entry — unchanged.
+export function browserOpenCommand(url, platform = process.platform) {
+  if (platform === "win32") {
+    const safe = String(url).replace(/"/g, "");
+    return {
+      cmd: "cmd.exe",
+      args: ["/c", "start", '""', `"${safe}"`],
+      opts: {
+        stdio: "ignore",
+        detached: true,
+        windowsHide: true,
+        windowsVerbatimArguments: true,
+      },
+    };
+  }
+  const cmd = platform === "darwin" ? "open" : "xdg-open";
+  return { cmd, args: [url], opts: { stdio: "ignore", detached: true } };
+}
+
 function openBrowser(url) {
-  const cmd =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
-    spawn(cmd, [url], {
-      stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32",
-    }).unref();
+    const { cmd, args, opts } = browserOpenCommand(url);
+    spawn(cmd, args, opts).unref();
   } catch {
     /* manual-paste fallback below */
   }
@@ -158,7 +182,23 @@ async function main() {
   process.exit(0);
 }
 
-main().catch((e) => {
-  console.log(`   ${R}✗${X} login error: ${D}${e?.message || String(e)}${X}\x1b[?25h`);
-  process.exit(1);
-});
+// CLI guard: run the sign-in flow only when executed directly (`node login.mjs`, how skalpel-setup.mjs
+// always spawns it), never on import — so browserOpenCommand can be imported/tested without launching a
+// real OAuth flow. Mirrors the isMain idiom in verify-shadow.mjs / ledger.mjs.
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+
+if (isMain) {
+  main().catch((e) => {
+    console.log(`   ${R}✗${X} login error: ${D}${e?.message || String(e)}${X}\x1b[?25h`);
+    process.exit(1);
+  });
+}