skalpel 4.0.5 → 4.0.7

package/README.md

@@ -4,13 +4,18 @@ Behavioral graph for AI-assisted coding. Learns how you work from your Claude Co
 steers the model in real time — off the loops, re-explains, and re-fixes that eat your day.
 
 ```bash
-npm install -g skalpel
-skalpel            # sign in with Google → build your graph → see your insights → you're live
+npx skalpel@latest   # sign in with Google → build your graph → see your insights → you're live
 ```
 
+That's it — no global install. `npx` fetches the latest and runs the one-time setup (which copies
+the hooks into `~/.skalpel` so they persist afterward). It sidesteps every machine-specific install
+failure: no global-bin `PATH` to configure, no `sudo`, and it's always the newest version — so a
+stale copy can never leave you on old code. Prefer a permanent install? `npm install -g skalpel`
+still works and behaves identically.
+
 ## What it does
 
-- **`skalpel`** (or the postinstall nudge) runs the onboarding: red-banner wordmark → **Sign in with
+- **`npx skalpel@latest`** (or `skalpel` after a global install) runs the onboarding: red-banner wordmark → **Sign in with
   Google** (AWS-hosted, no localhost) → **builds your graph** (async, live progress) → **reveals your
   insights** (your hours, rework %, signature trap, biggest time-sink) → wires the hooks → you're live.
 - After that, every prompt in Claude Code / Codex pulls your own behavioral graph via a fast hook, and a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.5",
+  "version": "4.0.7",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/postinstall.mjs

@@ -57,8 +57,26 @@ function stageStatusline() {
   }
 }
 
+// If this postinstall ran under `sudo npm install -g`, we're root but a REAL user invoked it — so
+// anything we just created in their HOME (the staged ~/.skalpel) is root-owned, a landmine for the
+// later non-root `skalpel` (that's Ryaan's EACCES on copyfile into ~/.skalpel/hooks). Chown it back to
+// the invoking user so the sudo install path isn't left broken.
+function fixSudoOwnership() {
+  try {
+    if (process.platform === "win32") return; // no uid / sudo model
+    if (typeof process.getuid !== "function" || process.getuid() !== 0) return; // not root — nothing to undo
+    const uid = process.env.SUDO_UID;
+    if (!uid) return; // genuinely root (not via sudo) — don't touch their files
+    const gid = process.env.SUDO_GID || uid;
+    spawnSync("chown", ["-R", `${uid}:${gid}`, join(homedir(), ".skalpel")], q);
+  } catch {
+    /* best-effort — worst case the user runs `sudo chown -R $(whoami) ~/.skalpel` themselves */
+  }
+}
+
 retireLegacyDaemon();
 stageStatusline();
+fixSudoOwnership();
 
 // A quiet nudge — the real onboarding (Google sign-in → build graph → insights) runs on `skalpel`.
 if (process.stdout.isTTY && !process.env.CI) {

package/skalpel-setup.mjs

@@ -727,6 +727,48 @@ async function revealInsights(report) {
   );
 }
 
+// Self-heal preflight. The install failures friends hit were never our code — they were the MACHINE:
+// a ~/.skalpel left root-owned by a past `sudo npm i -g` (so we can't stage hooks into it), or a Node
+// too old for the hook runtime. Catch both HERE with a one-line fix instead of a cryptic EACCES stack
+// trace five calls deep. Runs only on the setup path (login/logout/uninstall return before this).
+function preflight() {
+  const major = Number.parseInt(process.versions.node.split(".")[0], 10);
+  if (major < 18) {
+    console.error(
+      `   ${R}✗${X} skalpel needs Node 18+ — you have ${process.versions.node}. Update Node, then re-run.`,
+    );
+    process.exit(1);
+  }
+  const dir = join(homedir(), ".skalpel");
+  try {
+    mkdirSync(dir, { recursive: true });
+    accessSync(dir, constants.W_OK);
+    return; // writable — good to go
+  } catch {
+    /* not writable — try to self-heal, then re-check below */
+  }
+  // If we're root via `sudo` (SUDO_UID set), hand ownership back to the real user so the later
+  // non-root hook writes don't EACCES. On Windows there's no uid model — getuid is undefined, skip.
+  if (typeof process.getuid === "function" && process.getuid() === 0 && process.env.SUDO_UID) {
+    spawnSync(
+      "chown",
+      ["-R", `${process.env.SUDO_UID}:${process.env.SUDO_GID || process.env.SUDO_UID}`, dir],
+      { stdio: "ignore" },
+    );
+  }
+  try {
+    accessSync(dir, constants.W_OK);
+  } catch {
+    const who = process.env.USER || process.env.LOGNAME || "$(whoami)";
+    console.error(
+      `   ${R}✗${X} ~/.skalpel isn't writable — a past \`sudo\` install left it root-owned.\n` +
+        `     One line fixes it, then re-run:\n\n` +
+        `       ${B}sudo chown -R ${who} ~/.skalpel${X}\n`,
+    );
+    process.exit(1);
+  }
+}
+
 async function main() {
   if (sub === "uninstall") {
     spawnSync("node", [join(__dir, "install.mjs"), "--uninstall"], { stdio: "inherit" });
@@ -766,6 +808,7 @@ async function main() {
     mkdirSync(cfgDir, { recursive: true });
     writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));
   }
+  preflight(); // fail fast + fixable if the machine can't take the install (root-owned dir / old Node)
   banner();
 
   // 1) SIGN IN with Google (once). SKALPEL_USER (dev) or an existing ~/.skalpel/auth.json skips it.