skalpel 4.0.42 → 4.0.44

package/anchor-shadow.mjs

@@ -187,18 +187,30 @@ export function detectShipStatusSpiral(turns) {
 // (2) reconstructTarget — pull the concrete anchor from recent turns + repo context. Returns a STRUCTURED
 // target or null (null = "not confidently reconstructable" → the caller logs a miss and does NOT fire).
 // ---------------------------------------------------------------------------------------------------
+// The context passed in (recentContextText) is joined OLDEST→NEWEST, so a plain non-global .exec() would
+// return the STALEST match. A ship-status probe must target the claim the user is doubting NOW — so scan
+// ALL matches globally and keep the LAST (most-recent) valid one, not the first (a stale PR/URL from many
+// turns ago).
 function findPr(text) {
   // "#123", "PR 123", "PR#123", "pull/123", "pull request 123"
-  const m = /(?:\bpr\s*#?\s*|\bpull(?:\s*request)?\s*#?\s*|\/pull\/|#)(\d{1,6})\b/i.exec(text);
-  if (!m) return null;
-  const n = Number(m[1]);
-  return Number.isInteger(n) && n > 0 && n < 1e7 ? n : null;
+  const re = /(?:\bpr\s*#?\s*|\bpull(?:\s*request)?\s*#?\s*|\/pull\/|#)(\d{1,6})\b/gi;
+  let last = null;
+  let m;
+  while ((m = re.exec(text))) {
+    const n = Number(m[1]);
+    if (Number.isInteger(n) && n > 0 && n < 1e7) last = n;
+  }
+  return last;
 }
 function findUrl(text) {
-  const m = /\bhttps?:\/\/[^\s'")<>`]+/i.exec(text);
-  if (!m) return null;
-  let url = m[0].replace(/[.,);]+$/, ""); // trim trailing punctuation from prose
-  return isSafeUrl(url) ? url : null;
+  const re = /\bhttps?:\/\/[^\s'")<>`]+/gi;
+  let last = null;
+  let m;
+  while ((m = re.exec(text))) {
+    const url = m[0].replace(/[.,);]+$/, ""); // trim trailing punctuation from prose
+    if (isSafeUrl(url)) last = url;
+  }
+  return last;
 }
 function findSha(text) {
   // Prefer a sha that appears near commit-ish words; otherwise the longest lone hex token in [7,40].

package/autopsy.mjs

@@ -49,6 +49,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import readline from "node:readline";
+import { fileURLToPath } from "node:url";
 
 const HOME = os.homedir();
 const PROJECTS_DIR = path.join(HOME, ".claude", "projects");
@@ -212,10 +213,23 @@ function extractAnchors(text) {
   return out;
 }
 
-function span(text, at, len) {
+// Captured transcript prose + tool output become quoted/shareable snippets via span() and vb(). Strip ESC
+// + other C0 control chars so a hostile log line can't inject ANSI/CSI/OSC escapes (color, cursor moves,
+// title/clipboard spoofing) into the receipt or a paste of it. redact() still runs on top for PII on the
+// shareable surfaces; this is the terminal-safety layer beneath it (same defense as card.mjs `clean`).
+export function stripCtrl(s) {
+  return (
+    String(s == null ? "" : s)
+      // eslint-disable-next-line no-control-regex
+      .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+      // eslint-disable-next-line no-control-regex
+      .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ")
+  ); // other control chars (incl. ESC/BEL) → space
+}
+export function span(text, at, len) {
   const a = Math.max(0, at - SPAN),
     b = Math.min(text.length, at + len + SPAN);
-  return text.slice(a, b).replace(/\s+/g, " ").trim().slice(0, 200);
+  return stripCtrl(text.slice(a, b)).replace(/\s+/g, " ").trim().slice(0, 200);
 }
 
 // ~/.claude/projects encodes cwd as a dash-flattened path. Every vendor's project root is normalized to
@@ -1282,7 +1296,7 @@ async function main() {
         const full = t.text || t.toolErrText || "";
         const pos = full.toLowerCase().indexOf(rec.anchor.toLowerCase());
         return pos < 0
-          ? full.replace(/\s+/g, " ").trim().slice(0, 200)
+          ? stripCtrl(full).replace(/\s+/g, " ").trim().slice(0, 200)
           : span(full, pos, rec.anchor.length);
       };
       cellC.push({
@@ -1618,8 +1632,24 @@ function renderFooter(P, presentVendors) {
   P();
 }
 
-main().catch((e) => {
-  // fail closed and quiet: never crash a user's terminal, never invent output.
-  process.stderr.write(`skalpel autopsy: ${e && e.message ? e.message : e}\n`);
-  process.exit(0);
-});
+// CLI guard: run the autopsy only when executed directly (`node autopsy.mjs`), never on import — so tests
+// and siblings can import helpers (span/stripCtrl) without triggering a full disk scan. autopsy is always
+// launched as a subprocess (`spawnSync node autopsy.mjs`), so direct-run behavior is unchanged. Mirrors the
+// isMain idiom in verify-shadow.mjs / ledger.mjs.
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  main().catch((e) => {
+    // fail closed and quiet: never crash a user's terminal, never invent output.
+    process.stderr.write(`skalpel autopsy: ${e && e.message ? e.message : e}\n`);
+    process.exit(0);
+  });
+}

package/catches.mjs

@@ -215,17 +215,39 @@ function indexResults(entries) {
 // result (we never ran the process, so there is no live err). This keeps HARNESS_ERROR vs GENUINE_FAIL
 // identical to the live shadow: a timeout / command-not-found / missing-script is harness noise and is
 // NEVER counted as a lie.
+// A real Claude/Anthropic tool_result block is {tool_use_id, content, is_error} — it carries NO structured
+// exit_code field (only Codex rollouts, normalized in loadCodexEntries, synthesize one). So indexResults
+// hands us exitCode=null for EVERY Claude result, which made the numeric-exit-code branch below dead for
+// Claude: a 127/126 harness failure fell through to `{code:1}` and cried wolf as a GENUINE_FAIL, and a real
+// non-zero exit Claude didn't flag via is_error was silently dropped as PASS. For a Claude proof the code
+// lives in the recorded text — but read it ONLY from the LEADING line. Claude Code prepends the failing
+// process's outcome as the first line of the Bash tool_result ("Exit code 1\n…", verified across real
+// transcripts: 142/142 non-zero-exit results start with "Exit code N"; a PASSING command has no such line).
+// An UNANCHORED full-body scan would misread an unrelated "exit code N" the command itself printed — a
+// grep/cat of source, a pasted CI log like "##[error]Process completed with exit code 123." — and cry wolf
+// on a genuinely-passing proof. Anchoring to the first line reads the real outcome and nothing else.
+function exitCodeFromText(text) {
+  const firstLine = String(text || "").split("\n", 1)[0];
+  const m = firstLine.match(/^\s*exit(?:ed)?(?:\s+with)?\s+(?:code|status)\s+(\d{1,3})\b/i);
+  if (!m) return null;
+  const n = Number.parseInt(m[1], 10);
+  return Number.isFinite(n) ? n : null;
+}
 function classifyRecorded({ isError, exitCode, text }) {
-  if (exitCode === 0) return "PASS";
-  if (exitCode == null && !isError) return "PASS"; // no failure signal recorded → treat as pass (never invent)
   const ev = String(text || "");
+  // Prefer the structured exit code (Codex); else recover a real code from the text (Claude). This makes
+  // the numeric-exit-code branch reachable for Claude, so 127/126 route to HARNESS_ERROR (no cry-wolf) and
+  // a textual non-zero exit is caught even when is_error wasn't set.
+  const code = typeof exitCode === "number" ? exitCode : exitCodeFromText(ev);
+  if (code === 0) return "PASS";
+  if (code == null && !isError) return "PASS"; // no failure signal at all → never invent a lie
   let err;
   if (/\btimed?\s*out\b|timeout after|\bSIGKILL\b|\bSIGTERM\b/i.test(ev)) {
     err = { killed: true, signal: "SIGTERM" }; // classifyOutcome → HARNESS_ERROR
-  } else if (typeof exitCode === "number" && exitCode !== 0) {
-    err = { code: exitCode }; // real recorded non-zero exit (127/126 → HARNESS_ERROR in classifyOutcome)
+  } else if (typeof code === "number" && code !== 0) {
+    err = { code }; // real recorded non-zero exit (127/126 → HARNESS_ERROR in classifyOutcome)
   } else {
-    err = { code: 1 }; // Claude is_error with no numeric code → generic non-zero
+    err = { code: 1 }; // is_error flagged but no numeric code recorded → generic non-zero
   }
   return classifyOutcome(err, ev);
 }
@@ -315,8 +337,16 @@ export function runScan() {
 }
 
 // ---------- (6) render the honest report ----------
+// claim_text / proof_command / evidence are UNTRUSTED captured strings (agent transcript + test output)
+// rendered straight to a live terminal. Strip ESC + other C0 control chars FIRST (same defense as
+// card.mjs / analytics.mjs `clean`) so a hostile transcript row can't inject ANSI/CSI/OSC escapes
+// (color, cursor moves, title/clipboard spoofing) — then collapse whitespace and cap length.
 function clip(s, n) {
   const t = String(s || "")
+    // eslint-disable-next-line no-control-regex
+    .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ") // other control chars (incl. ESC/BEL) → space
     .replace(/\s+/g, " ")
     .trim();
   return t.length > n ? t.slice(0, n - 1) + "…" : t;
@@ -348,7 +378,11 @@ export function renderReport({ scanned, catches }) {
     return L.join("\n");
   }
 
-  const cmds = [...new Set(catches.map((c) => c.proof_command.split(/\s+/).slice(0, 3).join(" ")))];
+  // clip() here too: the headline command phrase is built from the untrusted proof_command and rendered
+  // to the terminal, so it needs the same ESC/control-char stripping as the receipt bodies below.
+  const cmds = [
+    ...new Set(catches.map((c) => clip(c.proof_command, 64).split(/\s+/).slice(0, 3).join(" "))),
+  ];
   const cmdPhrase = cmds.length === 1 ? `\`${cmds[0]}\`` : "its own test/build";
   L.push("");
   L.push(`  skalpel scanned ${N} of your recent sessions and found`);

package/incremental-ingest.mjs

@@ -215,11 +215,23 @@ async function sleep(ms) {
   await new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
 }
 
-async function request(fetchFn, url, init, timeoutMs) {
+// fetch() resolves as soon as the response HEADERS arrive; the BODY then streams separately. Clearing the
+// abort timer the instant fetch() resolves (the old `finally`) left every body read — `res.json()` at the
+// call sites — with NO deadline, so a slow or hung response body could stall the drain loop forever. Keep
+// the timer armed and read the FULL body HERE, under the same timeout; hand callers a tiny response-like
+// shim exposing only what they use (status, ok, json()). A stalled body now aborts and rejects instead of
+// hanging. Callers only ever read status/ok and `await response.json().catch(...)`, so the shim suffices.
+export async function request(fetchFn, url, init, timeoutMs) {
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), timeoutMs);
   try {
-    return await fetchFn(url, { ...init, signal: ctrl.signal });
+    const res = await fetchFn(url, { ...init, signal: ctrl.signal });
+    const body = await res.text(); // fully consume the body while the timeout is still armed
+    return {
+      status: res.status,
+      ok: res.ok,
+      json: async () => JSON.parse(body), // async so callers' `.json().catch(...)` catches parse errors
+    };
   } finally {
     clearTimeout(timer);
   }

package/ledger.mjs

@@ -106,8 +106,10 @@ function firstGreater(sorted, x) {
 // even in a tampered log its own ts equals t0, which the strict `> t0` search already excludes — so the
 // self-skip was a no-op and omitting it changes nothing (proven by the equivalence fixtures).
 // opts.excludeNullSession — when true, a false row with a null session yields null (the statusline's
-// Finding-3 guard). ledger.mjs's own view keeps the historical behavior (null-session rows CAN pair with
-// other null-session rows) by leaving it false, so its results stay byte-identical to the old code.
+// Finding-3 guard). Both live views (ledger.mjs AND the statusline) now pass it true: a NULL session
+// carries no real identity, so `(r.session ?? null) === (falseRow.session ?? null)` would read null===null
+// and pair a caught-false row with an UNRELATED null-session PASS of the same proof — a bogus, cross-
+// attributed fix delta. Requiring a real session id to measure a fix is the honest floor.
 export function buildFixDeltas(rows, { excludeNullSession = false } = {}) {
   const index = new Map(); // (session ?? null) → Map<proof_command, ascending ts[]>
   for (const r of rows || []) {
@@ -180,7 +182,10 @@ export function buildLedger(rows) {
   const falseEntries = entries.filter((e) => e.verdict === "FALSE");
   // Attach the MEASURED fix delta where — and only where — a real later same-proof PASS exists. ONE index
   // pass (buildFixDeltas) then a binary-search per false row: O(n log n), not the old O(falseCount × rows).
-  const fixDeltaFor = buildFixDeltas(rows || []);
+  // excludeNullSession: a caught-false row with a NULL session can't be tied to a fix (null carries no
+  // identity), so it never cross-attributes another null-session run's PASS — the same guard the statusline
+  // sibling applies. Count-only for such rows, never a fabricated delta.
+  const fixDeltaFor = buildFixDeltas(rows || [], { excludeNullSession: true });
   for (const e of falseEntries) {
     const d = fixDeltaFor(e._row);
     e.fix_delta_ms = d ? d.ms : null;
@@ -198,8 +203,16 @@ export function buildLedger(rows) {
 }
 
 // ---------- (4) render ----------
+// claim_text / proof_command / evidence are UNTRUSTED captured strings (agent transcript + test output)
+// rendered straight to a live terminal. Strip ESC + other C0 control chars FIRST (same defense as
+// card.mjs / analytics.mjs `clean`) so a tampered/hostile log row can't inject ANSI/CSI/OSC escapes
+// (color, cursor moves, title/clipboard spoofing) — then collapse whitespace and cap length.
 function clip(s, n) {
   const t = String(s || "")
+    // eslint-disable-next-line no-control-regex
+    .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "") // ANSI CSI sequences
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ") // other control chars (incl. ESC/BEL) → space
     .replace(/\s+/g, " ")
     .trim();
   return t.length > n ? t.slice(0, n - 1) + "…" : t;

package/login.mjs

@@ -4,11 +4,12 @@
 //   the token → save it. The server holds the client secret and does the code exchange; we only ever
 //   see the finished Google id_token. Branded onboarding reproduces the original prosumer `setup.mjs`
 //   red block wordmark 1:1. Run: `node skalpel-login.mjs`.
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
 
 const API = process.env.SKALPEL_API || "https://graph.skalpel.ai";
 const CLIENT_ID =
@@ -51,15 +52,38 @@ function authPath() {
   return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "skalpel", "auth.json");
 }
 
+// Build the spawn recipe to open a URL in the default browser, safely, per-platform. Windows is the sharp
+// edge: `start` is a cmd builtin (so it needs cmd.exe), and the OAuth URL is full of `&` param separators.
+// The old path — spawn("start", [url], { shell: true }) — let cmd SPLIT the URL on its unquoted `&`, so
+// sign-in silently broke (URL truncated at the first `&`) and any `&<token>` ran as a separate command
+// (injection surface). Here we spawn cmd.exe with NO shell and windowsVerbatimArguments, quoting the URL
+// ourselves so cmd treats the whole thing as one literal token. `'""'` is start's window title — it must be
+// a LITERAL empty quote-pair (a zero-length JS string would contribute 0 chars to the verbatim command
+// line, so start would consume the URL itself as the title and never open the browser). Any stray
+// double-quote in the URL is stripped so it can't break out of its quotes (URLSearchParams never emits one
+// anyway). macOS/Linux never use a shell, so their URL already rides as a single argv entry — unchanged.
+export function browserOpenCommand(url, platform = process.platform) {
+  if (platform === "win32") {
+    const safe = String(url).replace(/"/g, "");
+    return {
+      cmd: "cmd.exe",
+      args: ["/c", "start", '""', `"${safe}"`],
+      opts: {
+        stdio: "ignore",
+        detached: true,
+        windowsHide: true,
+        windowsVerbatimArguments: true,
+      },
+    };
+  }
+  const cmd = platform === "darwin" ? "open" : "xdg-open";
+  return { cmd, args: [url], opts: { stdio: "ignore", detached: true } };
+}
+
 function openBrowser(url) {
-  const cmd =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
-    spawn(cmd, [url], {
-      stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32",
-    }).unref();
+    const { cmd, args, opts } = browserOpenCommand(url);
+    spawn(cmd, args, opts).unref();
   } catch {
     /* manual-paste fallback below */
   }
@@ -158,7 +182,23 @@ async function main() {
   process.exit(0);
 }
 
-main().catch((e) => {
-  console.log(`   ${R}✗${X} login error: ${D}${e?.message || String(e)}${X}\x1b[?25h`);
-  process.exit(1);
-});
+// CLI guard: run the sign-in flow only when executed directly (`node login.mjs`, how skalpel-setup.mjs
+// always spawns it), never on import — so browserOpenCommand can be imported/tested without launching a
+// real OAuth flow. Mirrors the isMain idiom in verify-shadow.mjs / ledger.mjs.
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+
+if (isMain) {
+  main().catch((e) => {
+    console.log(`   ${R}✗${X} login error: ${D}${e?.message || String(e)}${X}\x1b[?25h`);
+    process.exit(1);
+  });
+}

package/metrics.mjs

@@ -3,20 +3,54 @@
 // the file (a live-mutated counter file WOULD lose increments under that race). record() never throws
 // and never blocks — telemetry must not be able to break a fail-open hook.
 //
+// BOUNDED: this file was previously append-only with no cap, so it grew without limit — one row every
+// turn, forever, for every user. record() now trims the file back to the last LOG_KEEP_LINES rows once
+// it crosses LOG_MAX_BYTES (same rotate-in-place discipline as verify-shadow.log's appendShadowLog),
+// so on-disk growth is bounded. stats.mjs folds whatever rows remain, so a trim only drops the oldest
+// telemetry — never breaks the reader.
+//
 // Read it back with:  node ~/.skalpel/hooks/stats.mjs
-import { appendFileSync, mkdirSync } from "node:fs";
+import {
+  appendFileSync,
+  mkdirSync,
+  statSync,
+  readFileSync,
+  writeFileSync,
+  renameSync,
+} from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
 const DIR = join(homedir(), ".skalpel");
 export const METRICS_PATH = join(DIR, "metrics.ndjson");
 
+// Cap the telemetry file: trim to the last LOG_KEEP_LINES rows once it exceeds LOG_MAX_BYTES.
+const LOG_MAX_BYTES = 1024 * 1024; // 1 MiB
+const LOG_KEEP_LINES = 5000;
+
 // outcome ∈ inject | silent | server_error | abort | fetch_error | skipped | budget_spent
 // `abort` == the fetch hit our deadline == a graph cold-start hit (the whole diagnosis).
 // ms == wall-clock of the network call (null for skipped / pre-network exits).
 export function record(event, outcome, ms) {
   try {
     mkdirSync(DIR, { recursive: true });
+    // Bound the file BEFORE appending: once it crosses the cap, keep only the newest rows. The trim is
+    // atomic (tmp + rename) and wrapped so a rotation failure still falls through to the append. A
+    // per-pid tmp keeps concurrent trims from colliding on one temp path.
+    try {
+      if (statSync(METRICS_PATH).size > LOG_MAX_BYTES) {
+        const kept = readFileSync(METRICS_PATH, "utf8")
+          .trim()
+          .split("\n")
+          .filter(Boolean)
+          .slice(-LOG_KEEP_LINES);
+        const tmp = `${METRICS_PATH}.${process.pid}.tmp`;
+        writeFileSync(tmp, kept.join("\n") + "\n");
+        renameSync(tmp, METRICS_PATH);
+      }
+    } catch {
+      /* no file yet, or a trim race — still append below */
+    }
     appendFileSync(
       METRICS_PATH,
       JSON.stringify({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.42",
+  "version": "4.0.44",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-hook.mjs

@@ -8,9 +8,22 @@
 //   {"hooks":{"UserPromptSubmit":[{"type":"command","command":"node /path/to/skalpel-hook.mjs"}]}}
 // Config: SKALPEL_API (default https://graph.skalpel.ai). Identity comes from the Google sign-in
 // saved by `skalpel-prosumer login` (~/.skalpel/auth.json); SKALPEL_USER overrides for dev.
-import { readFileSync, writeFileSync, renameSync, appendFileSync, mkdirSync } from "node:fs";
+import {
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  appendFileSync,
+  mkdirSync,
+  openSync,
+  writeSync,
+  closeSync,
+  statSync,
+  rmSync,
+  realpathSync,
+} from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { identity } from "./auth.mjs";
 import { record } from "./metrics.mjs";
 import { recordInsight, cleanText, verifySpawnArmed } from "./insights.mjs";
@@ -230,8 +243,8 @@ function writeSteer(label, type, wt, id) {
 //   suppress[key] : true         — "fewer like this"    -> stop firing this steer type/trap for me
 //   verbose[key]  : true         — "tell me more…"      -> expand this trap's steer when it fires
 //   score[type]   : {up,down}    — implicit + explicit usefulness, for future gating
-const PREFS_PATH = join(homedir(), ".skalpel", "prefs.json");
-function readPrefs() {
+export const PREFS_PATH = join(homedir(), ".skalpel", "prefs.json");
+export function readPrefs() {
   const base = { muted_session: false, suppress: {}, verbose: {}, score: {}, stats: {} };
   try {
     return { ...base, ...JSON.parse(readFileSync(PREFS_PATH, "utf8")) };
@@ -264,10 +277,11 @@ function ignoredByAdherence(prefs, type) {
   const st = prefs.stats && prefs.stats[type];
   return !!(st && st.shown >= 6 && st.acted / st.shown < 0.2);
 }
-function writePrefs(p) {
+export function writePrefs(p) {
   try {
     mkdirSync(join(homedir(), ".skalpel"), { recursive: true });
-    const tmp = `${PREFS_PATH}.tmp`;
+    // Per-pid tmp so two concurrent writers can't tear each other's temp file before the rename commit.
+    const tmp = `${PREFS_PATH}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify(p));
     renameSync(tmp, PREFS_PATH);
   } catch {
@@ -275,6 +289,89 @@ function writePrefs(p) {
   }
 }
 
+// ---- LOST-UPDATE FIX (prefs.json) --------------------------------------------------------------------
+// Every hook used to readPrefs() at the TOP of the turn, then await identity()+/retrieve (seconds), then
+// write that SAME in-memory object back at the end. During that long window a concurrent hook could mute
+// / suppress / record feedback — and this hook's end-of-turn write, carrying its stale snapshot, silently
+// CLOBBERED it (a user's "mute" or "fewer like this" just vanished). The fix is a race-safe read-modify-
+// write: serialize writers on a tiny cross-process lock, RE-READ prefs fresh immediately before writing,
+// apply only the intended field mutation to THAT fresh copy, then atomic-write. So a concurrent update
+// that landed during our await window is merged in, never overwritten. FAIL-OPEN throughout: prefs are a
+// bonus — a missed lock or a bad mutator degrades to a best-effort write and NEVER breaks the hook.
+const PREFS_LOCK_PATH = `${PREFS_PATH}.lock`;
+const PREFS_LOCK_STALE_MS = 10_000; // a hook that died holding the lock is reclaimed after this
+const PREFS_LOCK_SPIN_MS = 250; // bounded wait; real contention (a double-fire) clears in sub-ms
+
+// Synchronous sleep with no busy-spin (Atomics.wait on a throwaway buffer). Keeps the RMW critical
+// section short without pulling the hot path into async just for a lock.
+function sleepMs(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    /* SharedArrayBuffer unavailable — fall through; the spin just polls a touch faster */
+  }
+}
+
+// Acquire the prefs lock via an atomic exclusive create (O_EXCL "wx"): exactly one racer wins, the rest
+// back off and retry within a bounded budget; a stale lock (dead holder) is reclaimed by mtime. Returns
+// true if held (caller must releasePrefsLock), false if it gave up (caller still does a best-effort write).
+function acquirePrefsLock() {
+  const deadline = Date.now() + PREFS_LOCK_SPIN_MS;
+  for (;;) {
+    try {
+      const fd = openSync(PREFS_LOCK_PATH, "wx");
+      try {
+        writeSync(fd, String(process.pid));
+      } finally {
+        closeSync(fd);
+      }
+      return true;
+    } catch (e) {
+      if (e && e.code === "EEXIST") {
+        try {
+          const st = statSync(PREFS_LOCK_PATH);
+          if (Date.now() - st.mtimeMs >= PREFS_LOCK_STALE_MS) {
+            rmSync(PREFS_LOCK_PATH, { force: true }); // stale holder — reclaim, then retry the create
+            continue;
+          }
+        } catch {
+          continue; // lock vanished (just released) — retry immediately
+        }
+      } else {
+        return false; // unexpected error → don't spin; caller falls back to an unlocked write
+      }
+    }
+    if (Date.now() >= deadline) return false;
+    sleepMs(2);
+  }
+}
+function releasePrefsLock() {
+  try {
+    rmSync(PREFS_LOCK_PATH, { force: true });
+  } catch {
+    /* best-effort — a stale lock self-expires after PREFS_LOCK_STALE_MS */
+  }
+}
+
+// Race-safe prefs mutation. Under the lock: re-read fresh, apply `mutate(fresh)`, atomic-write. `mutate`
+// receives the on-disk state so its change is merged onto whatever concurrent hooks have persisted — the
+// caller must NOT rely on a snapshot read earlier in the turn. Returns the written object. Never throws.
+export function updatePrefs(mutate) {
+  const locked = acquirePrefsLock();
+  try {
+    const fresh = readPrefs();
+    try {
+      mutate(fresh);
+    } catch {
+      /* a mutator bug must never break the hook */
+    }
+    writePrefs(fresh);
+    return fresh;
+  } finally {
+    if (locked) releasePrefsLock();
+  }
+}
+
 // Parse a control PHRASE aimed at skalpel out of the user's prompt — the explicit feedback channel,
 // captured natively through the prompt (no button UI needed; this IS the harness wrapping). Returns
 // {action} or null. Deliberately narrow so normal prose never trips it: the word "skalpel", or a
@@ -353,51 +450,64 @@ function logSessionEvent(ev) {
 function applyControl(action, prefs) {
   const last = readSteer();
   const key = last.type ? (last.wt ? `${last.type}:${last.wt}` : last.type) : null;
-  const bump = (dir) => {
+  // A mutation is applied to a prefs object `P`; the score bump reads+writes P (not the outer snapshot).
+  const bump = (P, dir) => {
     if (!last.type) return;
-    const sc = prefs.score[last.type] || { up: 0, down: 0 };
+    const sc = P.score[last.type] || { up: 0, down: 0 };
     sc[dir] += 1;
-    prefs.score[last.type] = sc;
+    P.score[last.type] = sc;
+  };
+  // Apply the SAME field mutation to (a) the in-memory `prefs` so THIS turn's downstream gating sees it,
+  // and (b) the on-disk prefs via the race-safe read-modify-write so a concurrent hook's update isn't
+  // clobbered. The disk copy is re-read fresh inside updatePrefs, so each object is mutated once from its
+  // own base (set-once flags stay idempotent; a score bump lands exactly once on disk).
+  const persist = (m) => {
+    m(prefs);
+    updatePrefs(m);
   };
   if (action === "mute") {
-    prefs.muted_session = true;
-    writePrefs(prefs);
+    persist((P) => {
+      P.muted_session = true;
+    });
     return (
       "[skalpel — the user asked to MUTE skalpel for this session. Acknowledge in ONE short line " +
       "(“🔬 skalpel · muted for this session — I'll stay quiet”) and surface NO steers the rest of this session.]"
     );
   }
   if (action === "unmute") {
-    prefs.muted_session = false;
-    writePrefs(prefs);
+    persist((P) => {
+      P.muted_session = false;
+    });
     return "[skalpel — the user re-enabled skalpel. Acknowledge in one short line and continue.]";
   }
   if (action === "fewer") {
-    if (key) prefs.suppress[key] = true;
-    bump("down");
-    writePrefs(prefs);
+    persist((P) => {
+      if (key) P.suppress[key] = true;
+      bump(P, "down");
+    });
     return (
       `[skalpel — the user wants FEWER steers like the last one${last.wt ? ` (${last.wt})` : ""}. ` +
       "Acknowledge in one line (“🔬 skalpel · got it — easing off those”); skalpel will stop firing that trap for them.]"
     );
   }
   if (action === "more") {
-    if (key) prefs.verbose[key] = true;
-    writePrefs(prefs);
+    persist((P) => {
+      if (key) P.verbose[key] = true;
+    });
     return (
       `[skalpel — the user wants MORE detail whenever they hit this${last.wt ? ` ${last.wt}` : ""} trap. ` +
       "Acknowledge briefly, and from now on EXPAND that steer: name the shape, the count, and the way out.]"
     );
   }
   if (action === "up") {
-    bump("up");
-    writePrefs(prefs);
+    persist((P) => bump(P, "up"));
     return null; // positive signal — just record it; no need to make the model announce anything
   }
   if (action === "down") {
-    if (key) prefs.suppress[key] = true;
-    bump("down");
-    writePrefs(prefs);
+    persist((P) => {
+      if (key) P.suppress[key] = true;
+      bump(P, "down");
+    });
     return "[skalpel — the user found the last steer unhelpful. Acknowledge briefly; skalpel will ease off that one.]";
   }
   return null;
@@ -438,8 +548,13 @@ function pushTraj(cls) {
 }
 
 // local debug trail — proves the hook RAN (in any session), and what it decided. Fail-safe.
+// OPT-IN ONLY. The old guard (`=== "0"` → skip) meant the log was written on EVERY hook invocation for
+// EVERY user unless they explicitly set SKALPEL_DEBUG=0 — an unbounded ~/.skalpel/hook.log growing one
+// entry per turn, forever, that nobody asked for. dbg now writes ONLY when SKALPEL_DEBUG is explicitly
+// enabled (any value other than the off sentinels), so the default install produces no hook.log at all.
 function dbg(msg) {
-  if (process.env.SKALPEL_DEBUG === "0") return;
+  const flag = process.env.SKALPEL_DEBUG;
+  if (!flag || flag === "0" || flag === "false" || flag === "off") return; // default OFF — no log leak
   try {
     const p = join(homedir(), ".skalpel");
     mkdirSync(p, { recursive: true });
@@ -690,8 +805,14 @@ async function main() {
         // off (a break-out this turn). Accretes per steer-type; the gate above reads it next time. This is
         // categorical revealed-preference data, not a number shown to the user.
         const paid = brokeOut;
-        const adh = recordAdherence(prefs, prevSteer, steerWt, paid);
-        writePrefs(prefs);
+        // Race-safe write: this is the end-of-turn write that follows the long identity()+/retrieve await,
+        // so it must NOT persist the stale `prefs` snapshot read at the top of the turn (that clobbered a
+        // concurrent hook's mute/suppress). Re-read fresh inside updatePrefs and apply the adherence
+        // increment to THAT, merging in whatever landed during our await window.
+        let adh = null;
+        updatePrefs((fresh) => {
+          adh = recordAdherence(fresh, prevSteer, steerWt, paid);
+        });
         // ADHERENCE INSIGHT ROW (data, not display — no `display` field): the same judgment, exported
         // for the TUI's rail, joined to the prior steer by its minted id. followed = the n+1 credit
         // landed; ignored = you stayed on the very work-type the steer pushed you off AND no credit;
@@ -788,6 +909,22 @@ async function main() {
   }
 }
 
-main()
-  .then(() => process.exit(0))
-  .catch(() => process.exit(0));
+// Run main() only when invoked as the hook (node skalpel-hook.mjs), never on import. Importing the module
+// (the prefs concurrency test) must not read fd 0 or emit hook output. Robust main detection mirrors
+// verify-shadow.mjs / skalpel-setup.mjs: compare REAL paths, not a hand-built file:// URL (a home dir with
+// a space breaks `new URL("file://"+path)`). Any error → treat as not-main (safe: a test import stays inert).
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  main()
+    .then(() => process.exit(0))
+    .catch(() => process.exit(0));
+}

package/verify-races.test.mjs

@@ -0,0 +1,182 @@
+// verify-races.test.mjs — regression tests for the core-engine race/growth fixes (fix/core-engine-races):
+//   • classifyOutcome no longer misclassifies a GENUINE fail whose OWN output contains a harness phrase
+//   • acquireLock is single-flight under a CONCURRENT burst (O_EXCL, not statSync→writeFileSync TOCTOU)
+//   • updatePrefs is a race-safe read-modify-write (a concurrent mute/suppress is merged, never clobbered)
+//   • metrics.ndjson is bounded (rotate-in-place), not unbounded
+// HOME-isolated (import "./_test-home.mjs" FIRST) so nothing here reads/clobbers a real ~/.skalpel.
+import "./_test-home.mjs";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  utimesSync,
+} from "node:fs";
+import { tmpdir, homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { classifyOutcome, acquireLock } from "./verify-shadow.mjs";
+import { updatePrefs, readPrefs, writePrefs } from "./skalpel-hook.mjs";
+import { record, METRICS_PATH } from "./metrics.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+// ---- Bug 4: classifyOutcome — a genuine fail's OWN output containing a harness phrase is NOT quarantined
+test("classifyOutcome — a GENUINE fail that MENTIONS 'command not found' stays GENUINE_FAIL", () => {
+  const genuine =
+    `FAIL src/cli.test.js\n` +
+    `  ● prints a helpful error for an unknown subcommand\n` +
+    `    Expected substring: "command not found"\n` +
+    `    Received string:    "unknown option"\n` +
+    `  1 failed`;
+  assert.equal(classifyOutcome({ code: 1 }, genuine), "GENUINE_FAIL");
+  const genuine2 = `AssertionError: expected error to include "no such file or directory"\n  1 failing`;
+  assert.equal(classifyOutcome({ code: 1 }, genuine2), "GENUINE_FAIL");
+});
+
+test("classifyOutcome — a REAL harness break is STILL HARNESS_ERROR (true positives preserved)", () => {
+  assert.equal(classifyOutcome({ code: 1 }, "bash: pytest: command not found"), "HARNESS_ERROR");
+  assert.equal(classifyOutcome({ code: 1 }, "sh: 1: eslint: not found"), "HARNESS_ERROR");
+  assert.equal(classifyOutcome({ code: 1 }, 'npm error Missing script: "test"'), "HARNESS_ERROR");
+  assert.equal(
+    classifyOutcome({ code: 1 }, "Error: ENOENT: no such file or directory, open 'x'"),
+    "HARNESS_ERROR",
+  );
+  assert.equal(
+    classifyOutcome({ code: 1 }, "browserType.launch: Executable doesn't exist at /ms-playwright"),
+    "HARNESS_ERROR",
+  );
+});
+
+// ---- Bug 3: acquireLock — exactly ONE holder under a concurrent burst (the TOCTOU is closed) ----
+test("acquireLock — a concurrent burst yields EXACTLY ONE holder (no double-acquire)", () => {
+  const home = mkdtempSync(join(tmpdir(), "skalpel-lockrace-"));
+  mkdirSync(join(home, ".skalpel"), { recursive: true });
+  const worker = join(home, "w.mjs");
+  writeFileSync(
+    worker,
+    `import { acquireLock } from ${JSON.stringify(join(HERE, "verify-shadow.mjs"))};\n` +
+      `const START = Number(process.env.START_MS);\n` +
+      `while (Date.now() < START) {}\n` +
+      `process.stdout.write(acquireLock() ? "ACQUIRED" : "denied");\n`,
+  );
+  const N = 40;
+  const START_MS = Date.now() + 400;
+  const kids = [];
+  for (let i = 0; i < N; i++) {
+    kids.push(
+      spawn("node", [worker], {
+        env: { ...process.env, HOME: home, USERPROFILE: home, START_MS: String(START_MS) },
+        stdio: ["ignore", "pipe", "ignore"],
+      }),
+    );
+  }
+  const outs = kids.map(
+    (c) =>
+      new Promise((res) => {
+        let o = "";
+        c.stdout.on("data", (d) => (o += d));
+        c.on("exit", () => res(o));
+      }),
+  );
+  return Promise.all(outs).then((results) => {
+    const acquired = results.filter((r) => r.includes("ACQUIRED")).length;
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(acquired, 1, `expected exactly 1 holder, got ${acquired}`);
+  });
+});
+
+test("acquireLock — respects a fresh lock, reclaims a stale one", () => {
+  const dir = join(homedir(), ".skalpel");
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(dir, { recursive: true });
+  const LOCK = join(dir, "verify-shadow.lock");
+  assert.equal(acquireLock(), true, "first acquire creates the lock");
+  assert.equal(acquireLock(), false, "a fresh lock is respected (no re-acquire)");
+  // Backdate the lock past the 90s stale window → a reclaim is allowed.
+  const old = Date.now() / 1000 - 200;
+  utimesSync(LOCK, old, old);
+  assert.equal(acquireLock(), true, "a stale lock is reclaimed");
+  rmSync(dir, { recursive: true, force: true });
+});
+
+// ---- Bug 1: updatePrefs — re-read + merge, so a concurrent update is never clobbered ----
+test("updatePrefs — merges a concurrent mute instead of clobbering it with a stale snapshot", () => {
+  rmSync(join(homedir(), ".skalpel"), { recursive: true, force: true });
+  mkdirSync(join(homedir(), ".skalpel"), { recursive: true });
+  writePrefs({ muted_session: false, suppress: {}, verbose: {}, score: {}, stats: {} });
+  // The hook read a stale snapshot at the top of its turn:
+  const stale = readPrefs();
+  assert.equal(stale.muted_session, false);
+  // …then a CONCURRENT hook muted the session (persisted to disk) during the await window:
+  writePrefs({ ...stale, muted_session: true });
+  // …now the first hook's end-of-turn write goes through updatePrefs, which re-reads fresh + merges:
+  updatePrefs((f) => {
+    f.suppress["SINK:refine"] = true;
+  });
+  const after = readPrefs();
+  assert.equal(after.muted_session, true, "the concurrent mute survived (not clobbered)");
+  assert.equal(after.suppress["SINK:refine"], true, "our own suppress landed too");
+});
+
+test("updatePrefs — 50 concurrent distinct-key writers lose NONE", () => {
+  const home = mkdtempSync(join(tmpdir(), "skalpel-keys-"));
+  mkdirSync(join(home, ".skalpel"), { recursive: true });
+  writeFileSync(
+    join(home, ".skalpel", "prefs.json"),
+    JSON.stringify({ muted_session: false, suppress: {}, verbose: {}, score: {}, stats: {} }),
+  );
+  const worker = join(home, "kw.mjs");
+  writeFileSync(
+    worker,
+    `import { updatePrefs } from ${JSON.stringify(join(HERE, "skalpel-hook.mjs"))};\n` +
+      `const i = Number(process.env.KEY_I);\n` +
+      `const START = Number(process.env.START_MS);\n` +
+      `while (Date.now() < START) {}\n` +
+      `updatePrefs((P) => { P.suppress["k" + i] = true; });\n`,
+  );
+  const N = 50;
+  const START_MS = Date.now() + 500;
+  const kids = [];
+  for (let i = 0; i < N; i++) {
+    kids.push(
+      new Promise((res) => {
+        const c = spawn("node", [worker], {
+          env: {
+            ...process.env,
+            HOME: home,
+            USERPROFILE: home,
+            KEY_I: String(i),
+            START_MS: String(START_MS),
+          },
+          stdio: "ignore",
+        });
+        c.on("exit", res);
+      }),
+    );
+  }
+  return Promise.all(kids).then(() => {
+    const suppress =
+      JSON.parse(readFileSync(join(home, ".skalpel", "prefs.json"), "utf8")).suppress || {};
+    let survived = 0;
+    for (let i = 0; i < N; i++) if (suppress["k" + i] === true) survived++;
+    rmSync(home, { recursive: true, force: true });
+    assert.equal(survived, N, `expected all ${N} keys, got ${survived}`);
+  });
+});
+
+// ---- Bug 5: metrics.ndjson is bounded (rotate-in-place), not unbounded ----
+test("record — metrics.ndjson stays bounded under a heavy write load", () => {
+  rmSync(METRICS_PATH, { force: true });
+  for (let i = 0; i < 30000; i++) record("prompt", i % 2 ? "inject" : "silent", 1800);
+  const size = statSync(METRICS_PATH).size;
+  assert.ok(size <= 1024 * 1024, `metrics.ndjson should be <= 1 MiB, was ${size} bytes`);
+  // …and it's still valid NDJSON the reader can fold (last line parses).
+  const lines = readFileSync(METRICS_PATH, "utf8").trim().split("\n").filter(Boolean);
+  assert.doesNotThrow(() => JSON.parse(lines[lines.length - 1]));
+});

package/verify-shadow.mjs

@@ -54,6 +54,9 @@ import {
   renameSync,
   statSync,
   rmSync,
+  openSync,
+  writeSync,
+  closeSync,
 } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -575,10 +578,25 @@ export function classifyOutcome(err, evidence) {
   // tool binary/runtime that simply isn't installed (a Playwright browser not downloaded — "Executable
   // doesn't exist" / "download new browsers"). Surfacing any of these would cry wolf on setup state, so
   // they are HARNESS_ERROR, never counted as a lie.
+  //
+  // ANCHORED, not a bare substring scan. The old test was `/…command not found…/.test(evidence)` over the
+  // WHOLE tail, so a GENUINE test failure whose OWN output merely CONTAINS one of these phrases (a test
+  // asserting on a shell error message, e.g. Expected substring: "command not found") was misread as
+  // HARNESS_ERROR and its real catch silently DROPPED — the money case, and an easy way for an adversarial
+  // agent to dodge us by printing the phrase. Each signature now anchors to the LINE SHAPE a broken proof
+  // actually emits (a tool/errno prefix + line boundaries), so an embedded/quoted mention no longer trips.
+  const ev = String(evidence || "");
   if (
-    /\bno such file or directory\b|\bENOENT\b|\bcommand not found\b|missing script|no [a-z:-]{1,24} script|npm err!.*missing script|executable doesn'?t exist|download new browsers/i.test(
-      String(evidence || ""),
-    )
+    // shell "command not found" / "not found": the phrase ENDS a line whose leading `<cmd>: ` is the
+    // shell's own prefix — `bash: pytest: command not found`, `sh: 1: eslint: not found`.
+    /(^|\n)[^\n]*: (?:command not found|not found)[ \t]*(\n|$)/i.test(ev) ||
+    // errno string in its real `<path>: No such file or directory` shape, or Node's ENOENT code token.
+    /(^|\n)[^\n]*: no such file or directory[ \t]*(\n|$)/i.test(ev) ||
+    /\bENOENT\b/.test(ev) ||
+    // npm / pnpm / yarn missing-script — their exact `Missing script:` wording (with the colon).
+    /\bmissing script:/i.test(ev) ||
+    // Playwright browser binary not installed — a setup-state error, never the agent's code failing.
+    /executable doesn'?t exist|download new browsers/i.test(ev)
   )
     return "HARNESS_ERROR";
   return "GENUINE_FAIL"; // a real non-zero exit from the test/build/lint itself
@@ -739,19 +757,51 @@ function markVerified(sig, cursorPath = LAST_PATH) {
 }
 
 // Single-flight: only one shadow re-run at a time (a burst of prompts must not spawn parallel test runs).
-function acquireLock() {
+// The old body did `statSync(LOCK_PATH)` then an UNCONDITIONAL `writeFileSync` — a TOCTOU hole: when no
+// lock file existed (the common case), N concurrent shadows all saw "no lock" and all wrote it, so ALL
+// "acquired" and ran parallel test re-runs. The atomic primitive is an EXCLUSIVE create (O_EXCL via the
+// "wx" flag): exactly one racer's create can win; every other gets EEXIST and backs off. Stale-lock
+// takeover (a shadow that died holding it) is preserved, but done through the same exclusive create so
+// two reclaimers can't both win. FAIL-OPEN: any unexpected error resolves to "not acquired" (no re-run).
+// Exported for the concurrency test (proves exactly-one-holder under a burst). Never throws.
+export function acquireLock() {
   try {
     mkdirSync(DIR, { recursive: true });
+  } catch {
+    return false;
+  }
+  // Atomic exclusive create — the win/lose decision is the create itself, not a prior stat.
+  try {
+    const fd = openSync(LOCK_PATH, "wx");
     try {
-      const st = statSync(LOCK_PATH);
-      if (Date.now() - st.mtimeMs < LOCK_STALE_MS) return false; // fresh lock held
-    } catch {
-      /* no lock yet */
+      writeSync(fd, String(process.pid));
+    } finally {
+      closeSync(fd);
+    }
+    return true;
+  } catch (e) {
+    if (!e || e.code !== "EEXIST") return false; // not a contention error → fail-open, no lock
+  }
+  // A lock already exists. Take it over ONLY if it is STALE (holder died/hung > LOCK_STALE_MS ago); an
+  // actively-held fresh lock is respected (return false). Reclaim through the SAME exclusive create so
+  // only one reclaimer wins even if several fire at once.
+  try {
+    const st = statSync(LOCK_PATH);
+    if (Date.now() - st.mtimeMs < LOCK_STALE_MS) return false; // fresh — respect the active holder
+  } catch {
+    /* vanished between EEXIST and stat (just released) — fall through and try to claim it */
+  }
+  try {
+    rmSync(LOCK_PATH, { force: true });
+    const fd = openSync(LOCK_PATH, "wx");
+    try {
+      writeSync(fd, String(process.pid));
+    } finally {
+      closeSync(fd);
     }
-    writeFileSync(LOCK_PATH, String(process.pid));
     return true;
   } catch {
-    return false;
+    return false; // another reclaimer re-created it first — they hold it
   }
 }
 function releaseLock() {