skalpel 4.0.42 → 4.0.43

package/anchor-shadow.mjs

@@ -187,18 +187,30 @@ export function detectShipStatusSpiral(turns) {
 // (2) reconstructTarget — pull the concrete anchor from recent turns + repo context. Returns a STRUCTURED
 // target or null (null = "not confidently reconstructable" → the caller logs a miss and does NOT fire).
 // ---------------------------------------------------------------------------------------------------
+// The context passed in (recentContextText) is joined OLDEST→NEWEST, so a plain non-global .exec() would
+// return the STALEST match. A ship-status probe must target the claim the user is doubting NOW — so scan
+// ALL matches globally and keep the LAST (most-recent) valid one, not the first (a stale PR/URL from many
+// turns ago).
 function findPr(text) {
   // "#123", "PR 123", "PR#123", "pull/123", "pull request 123"
-  const m = /(?:\bpr\s*#?\s*|\bpull(?:\s*request)?\s*#?\s*|\/pull\/|#)(\d{1,6})\b/i.exec(text);
-  if (!m) return null;
-  const n = Number(m[1]);
-  return Number.isInteger(n) && n > 0 && n < 1e7 ? n : null;
+  const re = /(?:\bpr\s*#?\s*|\bpull(?:\s*request)?\s*#?\s*|\/pull\/|#)(\d{1,6})\b/gi;
+  let last = null;
+  let m;
+  while ((m = re.exec(text))) {
+    const n = Number(m[1]);
+    if (Number.isInteger(n) && n > 0 && n < 1e7) last = n;
+  }
+  return last;
 }
 function findUrl(text) {
-  const m = /\bhttps?:\/\/[^\s'")<>`]+/i.exec(text);
-  if (!m) return null;
-  let url = m[0].replace(/[.,);]+$/, ""); // trim trailing punctuation from prose
-  return isSafeUrl(url) ? url : null;
+  const re = /\bhttps?:\/\/[^\s'")<>`]+/gi;
+  let last = null;
+  let m;
+  while ((m = re.exec(text))) {
+    const url = m[0].replace(/[.,);]+$/, ""); // trim trailing punctuation from prose
+    if (isSafeUrl(url)) last = url;
+  }
+  return last;
 }
 function findSha(text) {
   // Prefer a sha that appears near commit-ish words; otherwise the longest lone hex token in [7,40].

package/autopsy.mjs

@@ -49,6 +49,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import readline from "node:readline";
+import { fileURLToPath } from "node:url";
 
 const HOME = os.homedir();
 const PROJECTS_DIR = path.join(HOME, ".claude", "projects");
@@ -212,10 +213,23 @@ function extractAnchors(text) {
   return out;
 }
 
-function span(text, at, len) {
+// Captured transcript prose + tool output become quoted/shareable snippets via span() and vb(). Strip ESC
+// + other C0 control chars so a hostile log line can't inject ANSI/CSI/OSC escapes (color, cursor moves,
+// title/clipboard spoofing) into the receipt or a paste of it. redact() still runs on top for PII on the
+// shareable surfaces; this is the terminal-safety layer beneath it (same defense as card.mjs `clean`).
+export function stripCtrl(s) {
+  return (
+    String(s == null ? "" : s)
+      // eslint-disable-next-line no-control-regex
+      .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+      // eslint-disable-next-line no-control-regex
+      .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ")
+  ); // other control chars (incl. ESC/BEL) → space
+}
+export function span(text, at, len) {
   const a = Math.max(0, at - SPAN),
     b = Math.min(text.length, at + len + SPAN);
-  return text.slice(a, b).replace(/\s+/g, " ").trim().slice(0, 200);
+  return stripCtrl(text.slice(a, b)).replace(/\s+/g, " ").trim().slice(0, 200);
 }
 
 // ~/.claude/projects encodes cwd as a dash-flattened path. Every vendor's project root is normalized to
@@ -1282,7 +1296,7 @@ async function main() {
         const full = t.text || t.toolErrText || "";
         const pos = full.toLowerCase().indexOf(rec.anchor.toLowerCase());
         return pos < 0
-          ? full.replace(/\s+/g, " ").trim().slice(0, 200)
+          ? stripCtrl(full).replace(/\s+/g, " ").trim().slice(0, 200)
           : span(full, pos, rec.anchor.length);
       };
       cellC.push({
@@ -1618,8 +1632,24 @@ function renderFooter(P, presentVendors) {
   P();
 }
 
-main().catch((e) => {
-  // fail closed and quiet: never crash a user's terminal, never invent output.
-  process.stderr.write(`skalpel autopsy: ${e && e.message ? e.message : e}\n`);
-  process.exit(0);
-});
+// CLI guard: run the autopsy only when executed directly (`node autopsy.mjs`), never on import — so tests
+// and siblings can import helpers (span/stripCtrl) without triggering a full disk scan. autopsy is always
+// launched as a subprocess (`spawnSync node autopsy.mjs`), so direct-run behavior is unchanged. Mirrors the
+// isMain idiom in verify-shadow.mjs / ledger.mjs.
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  main().catch((e) => {
+    // fail closed and quiet: never crash a user's terminal, never invent output.
+    process.stderr.write(`skalpel autopsy: ${e && e.message ? e.message : e}\n`);
+    process.exit(0);
+  });
+}

package/catches.mjs

@@ -215,17 +215,39 @@ function indexResults(entries) {
 // result (we never ran the process, so there is no live err). This keeps HARNESS_ERROR vs GENUINE_FAIL
 // identical to the live shadow: a timeout / command-not-found / missing-script is harness noise and is
 // NEVER counted as a lie.
+// A real Claude/Anthropic tool_result block is {tool_use_id, content, is_error} — it carries NO structured
+// exit_code field (only Codex rollouts, normalized in loadCodexEntries, synthesize one). So indexResults
+// hands us exitCode=null for EVERY Claude result, which made the numeric-exit-code branch below dead for
+// Claude: a 127/126 harness failure fell through to `{code:1}` and cried wolf as a GENUINE_FAIL, and a real
+// non-zero exit Claude didn't flag via is_error was silently dropped as PASS. For a Claude proof the code
+// lives in the recorded text — but read it ONLY from the LEADING line. Claude Code prepends the failing
+// process's outcome as the first line of the Bash tool_result ("Exit code 1\n…", verified across real
+// transcripts: 142/142 non-zero-exit results start with "Exit code N"; a PASSING command has no such line).
+// An UNANCHORED full-body scan would misread an unrelated "exit code N" the command itself printed — a
+// grep/cat of source, a pasted CI log like "##[error]Process completed with exit code 123." — and cry wolf
+// on a genuinely-passing proof. Anchoring to the first line reads the real outcome and nothing else.
+function exitCodeFromText(text) {
+  const firstLine = String(text || "").split("\n", 1)[0];
+  const m = firstLine.match(/^\s*exit(?:ed)?(?:\s+with)?\s+(?:code|status)\s+(\d{1,3})\b/i);
+  if (!m) return null;
+  const n = Number.parseInt(m[1], 10);
+  return Number.isFinite(n) ? n : null;
+}
 function classifyRecorded({ isError, exitCode, text }) {
-  if (exitCode === 0) return "PASS";
-  if (exitCode == null && !isError) return "PASS"; // no failure signal recorded → treat as pass (never invent)
   const ev = String(text || "");
+  // Prefer the structured exit code (Codex); else recover a real code from the text (Claude). This makes
+  // the numeric-exit-code branch reachable for Claude, so 127/126 route to HARNESS_ERROR (no cry-wolf) and
+  // a textual non-zero exit is caught even when is_error wasn't set.
+  const code = typeof exitCode === "number" ? exitCode : exitCodeFromText(ev);
+  if (code === 0) return "PASS";
+  if (code == null && !isError) return "PASS"; // no failure signal at all → never invent a lie
   let err;
   if (/\btimed?\s*out\b|timeout after|\bSIGKILL\b|\bSIGTERM\b/i.test(ev)) {
     err = { killed: true, signal: "SIGTERM" }; // classifyOutcome → HARNESS_ERROR
-  } else if (typeof exitCode === "number" && exitCode !== 0) {
-    err = { code: exitCode }; // real recorded non-zero exit (127/126 → HARNESS_ERROR in classifyOutcome)
+  } else if (typeof code === "number" && code !== 0) {
+    err = { code }; // real recorded non-zero exit (127/126 → HARNESS_ERROR in classifyOutcome)
   } else {
-    err = { code: 1 }; // Claude is_error with no numeric code → generic non-zero
+    err = { code: 1 }; // is_error flagged but no numeric code recorded → generic non-zero
   }
   return classifyOutcome(err, ev);
 }
@@ -315,8 +337,16 @@ export function runScan() {
 }
 
 // ---------- (6) render the honest report ----------
+// claim_text / proof_command / evidence are UNTRUSTED captured strings (agent transcript + test output)
+// rendered straight to a live terminal. Strip ESC + other C0 control chars FIRST (same defense as
+// card.mjs / analytics.mjs `clean`) so a hostile transcript row can't inject ANSI/CSI/OSC escapes
+// (color, cursor moves, title/clipboard spoofing) — then collapse whitespace and cap length.
 function clip(s, n) {
   const t = String(s || "")
+    // eslint-disable-next-line no-control-regex
+    .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ") // other control chars (incl. ESC/BEL) → space
     .replace(/\s+/g, " ")
     .trim();
   return t.length > n ? t.slice(0, n - 1) + "…" : t;
@@ -348,7 +378,11 @@ export function renderReport({ scanned, catches }) {
     return L.join("\n");
   }
 
-  const cmds = [...new Set(catches.map((c) => c.proof_command.split(/\s+/).slice(0, 3).join(" ")))];
+  // clip() here too: the headline command phrase is built from the untrusted proof_command and rendered
+  // to the terminal, so it needs the same ESC/control-char stripping as the receipt bodies below.
+  const cmds = [
+    ...new Set(catches.map((c) => clip(c.proof_command, 64).split(/\s+/).slice(0, 3).join(" "))),
+  ];
   const cmdPhrase = cmds.length === 1 ? `\`${cmds[0]}\`` : "its own test/build";
   L.push("");
   L.push(`  skalpel scanned ${N} of your recent sessions and found`);

package/incremental-ingest.mjs

@@ -215,11 +215,23 @@ async function sleep(ms) {
   await new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
 }
 
-async function request(fetchFn, url, init, timeoutMs) {
+// fetch() resolves as soon as the response HEADERS arrive; the BODY then streams separately. Clearing the
+// abort timer the instant fetch() resolves (the old `finally`) left every body read — `res.json()` at the
+// call sites — with NO deadline, so a slow or hung response body could stall the drain loop forever. Keep
+// the timer armed and read the FULL body HERE, under the same timeout; hand callers a tiny response-like
+// shim exposing only what they use (status, ok, json()). A stalled body now aborts and rejects instead of
+// hanging. Callers only ever read status/ok and `await response.json().catch(...)`, so the shim suffices.
+export async function request(fetchFn, url, init, timeoutMs) {
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), timeoutMs);
   try {
-    return await fetchFn(url, { ...init, signal: ctrl.signal });
+    const res = await fetchFn(url, { ...init, signal: ctrl.signal });
+    const body = await res.text(); // fully consume the body while the timeout is still armed
+    return {
+      status: res.status,
+      ok: res.ok,
+      json: async () => JSON.parse(body), // async so callers' `.json().catch(...)` catches parse errors
+    };
   } finally {
     clearTimeout(timer);
   }

package/ledger.mjs

@@ -106,8 +106,10 @@ function firstGreater(sorted, x) {
 // even in a tampered log its own ts equals t0, which the strict `> t0` search already excludes — so the
 // self-skip was a no-op and omitting it changes nothing (proven by the equivalence fixtures).
 // opts.excludeNullSession — when true, a false row with a null session yields null (the statusline's
-// Finding-3 guard). ledger.mjs's own view keeps the historical behavior (null-session rows CAN pair with
-// other null-session rows) by leaving it false, so its results stay byte-identical to the old code.
+// Finding-3 guard). Both live views (ledger.mjs AND the statusline) now pass it true: a NULL session
+// carries no real identity, so `(r.session ?? null) === (falseRow.session ?? null)` would read null===null
+// and pair a caught-false row with an UNRELATED null-session PASS of the same proof — a bogus, cross-
+// attributed fix delta. Requiring a real session id to measure a fix is the honest floor.
 export function buildFixDeltas(rows, { excludeNullSession = false } = {}) {
   const index = new Map(); // (session ?? null) → Map<proof_command, ascending ts[]>
   for (const r of rows || []) {
@@ -180,7 +182,10 @@ export function buildLedger(rows) {
   const falseEntries = entries.filter((e) => e.verdict === "FALSE");
   // Attach the MEASURED fix delta where — and only where — a real later same-proof PASS exists. ONE index
   // pass (buildFixDeltas) then a binary-search per false row: O(n log n), not the old O(falseCount × rows).
-  const fixDeltaFor = buildFixDeltas(rows || []);
+  // excludeNullSession: a caught-false row with a NULL session can't be tied to a fix (null carries no
+  // identity), so it never cross-attributes another null-session run's PASS — the same guard the statusline
+  // sibling applies. Count-only for such rows, never a fabricated delta.
+  const fixDeltaFor = buildFixDeltas(rows || [], { excludeNullSession: true });
   for (const e of falseEntries) {
     const d = fixDeltaFor(e._row);
     e.fix_delta_ms = d ? d.ms : null;
@@ -198,8 +203,16 @@ export function buildLedger(rows) {
 }
 
 // ---------- (4) render ----------
+// claim_text / proof_command / evidence are UNTRUSTED captured strings (agent transcript + test output)
+// rendered straight to a live terminal. Strip ESC + other C0 control chars FIRST (same defense as
+// card.mjs / analytics.mjs `clean`) so a tampered/hostile log row can't inject ANSI/CSI/OSC escapes
+// (color, cursor moves, title/clipboard spoofing) — then collapse whitespace and cap length.
 function clip(s, n) {
   const t = String(s || "")
+    // eslint-disable-next-line no-control-regex
+    .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ") // other control chars (incl. ESC/BEL) → space
     .replace(/\s+/g, " ")
     .trim();
   return t.length > n ? t.slice(0, n - 1) + "…" : t;

package/login.mjs

@@ -4,11 +4,12 @@
 //   the token → save it. The server holds the client secret and does the code exchange; we only ever
 //   see the finished Google id_token. Branded onboarding reproduces the original prosumer `setup.mjs`
 //   red block wordmark 1:1. Run: `node skalpel-login.mjs`.
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
 
 const API = process.env.SKALPEL_API || "https://graph.skalpel.ai";
 const CLIENT_ID =
@@ -51,15 +52,38 @@ function authPath() {
   return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "skalpel", "auth.json");
 }
 
+// Build the spawn recipe to open a URL in the default browser, safely, per-platform. Windows is the sharp
+// edge: `start` is a cmd builtin (so it needs cmd.exe), and the OAuth URL is full of `&` param separators.
+// The old path — spawn("start", [url], { shell: true }) — let cmd SPLIT the URL on its unquoted `&`, so
+// sign-in silently broke (URL truncated at the first `&`) and any `&<token>` ran as a separate command
+// (injection surface). Here we spawn cmd.exe with NO shell and windowsVerbatimArguments, quoting the URL
+// ourselves so cmd treats the whole thing as one literal token. `'""'` is start's window title — it must be
+// a LITERAL empty quote-pair (a zero-length JS string would contribute 0 chars to the verbatim command
+// line, so start would consume the URL itself as the title and never open the browser). Any stray
+// double-quote in the URL is stripped so it can't break out of its quotes (URLSearchParams never emits one
+// anyway). macOS/Linux never use a shell, so their URL already rides as a single argv entry — unchanged.
+export function browserOpenCommand(url, platform = process.platform) {
+  if (platform === "win32") {
+    const safe = String(url).replace(/"/g, "");
+    return {
+      cmd: "cmd.exe",
+      args: ["/c", "start", '""', `"${safe}"`],
+      opts: {
+        stdio: "ignore",
+        detached: true,
+        windowsHide: true,
+        windowsVerbatimArguments: true,
+      },
+    };
+  }
+  const cmd = platform === "darwin" ? "open" : "xdg-open";
+  return { cmd, args: [url], opts: { stdio: "ignore", detached: true } };
+}
+
 function openBrowser(url) {
-  const cmd =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
-    spawn(cmd, [url], {
-      stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32",
-    }).unref();
+    const { cmd, args, opts } = browserOpenCommand(url);
+    spawn(cmd, args, opts).unref();
   } catch {
     /* manual-paste fallback below */
   }
@@ -158,7 +182,23 @@ async function main() {
   process.exit(0);
 }
 
-main().catch((e) => {
-  console.log(`   ${R}✗${X} login error: ${D}${e?.message || String(e)}${X}\x1b[?25h`);
-  process.exit(1);
-});
+// CLI guard: run the sign-in flow only when executed directly (`node login.mjs`, how skalpel-setup.mjs
+// always spawns it), never on import — so browserOpenCommand can be imported/tested without launching a
+// real OAuth flow. Mirrors the isMain idiom in verify-shadow.mjs / ledger.mjs.
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+
+if (isMain) {
+  main().catch((e) => {
+    console.log(`   ${R}✗${X} login error: ${D}${e?.message || String(e)}${X}\x1b[?25h`);
+    process.exit(1);
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.42",
+  "version": "4.0.43",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {