skalpel 4.0.51 → 4.0.53

package/analytics.mjs

@@ -264,7 +264,7 @@ export function renderStatic(data) {
     L.push("");
     L.push('  nothing caught yet — keep coding, I\'ll log every "done" your agent claims.');
     L.push("");
-    L.push("  Enable the shadow with SKALPEL_VERIFY_SHADOW=1; every completion claim gets its own");
+    L.push("  Arm the live catch with `skalpel verify on`; every completion claim gets its own");
     L.push("  proof re-run and appended to the local ledger. Nothing here is ever estimated.");
     L.push("");
     return L.join("\n");
@@ -377,7 +377,7 @@ function listLines(data, cols, rows, state) {
     );
     L.push("");
     L.push(
-      `  ${DIM}Enable the shadow with ${RESET}${BOLD}SKALPEL_VERIFY_SHADOW=1${RESET}${DIM} — every completion claim gets its${RESET}`,
+      `  ${DIM}Arm the live catch with ${RESET}${BOLD}skalpel verify on${RESET}${DIM} — every completion claim gets its${RESET}`,
     );
     L.push(
       `  ${DIM}own proof re-run and appended locally. Nothing here is ever estimated.${RESET}`,

package/card.mjs

@@ -296,9 +296,7 @@ function renderNoCatch({ id }) {
     `  ${D}and skalpel re-ran its OWN proof and it genuinely FAILED. Nothing is invented.${X}`,
   );
   L.push("");
-  L.push(
-    `  ${D}Turn the live shadow on with ${X}${B}SKALPEL_VERIFY_SHADOW=1${X}${D}, keep coding, and${X}`,
-  );
+  L.push(`  ${D}Arm the live catch with ${X}${B}skalpel verify on${X}${D}, keep coding, and${X}`);
   L.push(`  ${D}run ${X}${B}skalpel card${X}${D} again the next time a claim doesn't hold up.${X}`);
   L.push("");
   return L.join("\n");

package/install.mjs

@@ -195,9 +195,32 @@ function readJson(p) {
     return null; // signal "do not write" to callers
   }
 }
+// Abbreviate a home-rooted path to `~/…` for the user-facing repair hint (so it reads `~/.claude`,
+// not a long absolute path).
+function homeTilde(p) {
+  const h = homedir();
+  return p === h || p.startsWith(h + "/") || p.startsWith(h + "\\") ? "~" + p.slice(h.length) : p;
+}
+// Write a config file DEFENSIVELY. A read-only / permission-denied target — a root-owned ~/.claude
+// left behind by an earlier `sudo` install, an MDM-locked home — must NOT throw and abort the whole
+// installer (that would leave ZERO working hooks). Instead surface ONE clear repair line and return
+// the OS error code so the caller can report `failed:<code>` and STILL attempt every other target.
+// Returns null on success. mkdir is inside the try so a read-only PARENT dir is caught too, never
+// left as an uncaught throw.
+function safeWrite(p, data) {
+  try {
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, data);
+    return null;
+  } catch (e) {
+    console.error(
+      `skalpel: could not write ${homeTilde(p)}: ${e.message} — run: sudo chown -R $(whoami) ${homeTilde(dirname(p))}`,
+    );
+    return e.code || "write-failed";
+  }
+}
 function writeJson(p, o) {
-  mkdirSync(dirname(p), { recursive: true });
-  writeFileSync(p, JSON.stringify(o, null, 2));
+  return safeWrite(p, JSON.stringify(o, null, 2));
 }
 function isOurs(c, marker) {
   if (typeof c !== "string") return false;
@@ -284,7 +307,10 @@ function claude() {
   // — when there was nothing to do: an `uninstall` on a machine that never had our hooks leaves the
   // file exactly as it was (or absent). Install always changes something here, so this only suppresses
   // the no-op write.
-  if (installed || refreshed || removed) writeJson(CLAUDE, d);
+  if (installed || refreshed || removed) {
+    const err = writeJson(CLAUDE, d);
+    if (err) return `failed:${err}`; // read-only ~/.claude — reported, never thrown
+  }
   if (uninstall) return removed ? "removed" : "absent";
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
@@ -404,14 +430,18 @@ function codexToml() {
     // Only rewrite a config.toml that already existed — never CREATE one during an uninstall. A user
     // with ~/.codex but no config.toml has nothing of ours to strip, so writing `next + "\n"` here
     // would leave a stray 1-byte file behind an operation that's supposed to clean up.
-    if (hadToml) writeFileSync(CODEX_TOML, next + "\n");
+    if (hadToml) {
+      const err = safeWrite(CODEX_TOML, next + "\n");
+      if (err) return `failed:${err}`;
+    }
     return stripped.removed ? "removed" : "absent";
   }
   mkdirSync(CODEX_DIR, { recursive: true });
   for (const [event, marker, command] of HOOKS) {
     next += "\n" + tomlBlock(event, marker, command);
   }
-  writeFileSync(CODEX_TOML, next + "\n");
+  const err = safeWrite(CODEX_TOML, next + "\n");
+  if (err) return `failed:${err}`;
   return stripped.removed ? "refreshed" : "installed";
 }
 
@@ -445,10 +475,14 @@ function codexJson() {
     // one of our blocks from an existing file (mirrors codexToml's hadToml guard). A machine whose
     // ~/.codex has no hooks.json (or none of ours) has nothing to clean up, so writing here would drop
     // a stray file behind an operation that's supposed to leave the machine clean.
-    if (removed) writeJson(CODEX, d);
+    if (removed) {
+      const err = writeJson(CODEX, d);
+      if (err) return `failed:${err}`;
+    }
     return removed ? "removed" : "absent";
   }
-  writeJson(CODEX, d);
+  const err = writeJson(CODEX, d);
+  if (err) return `failed:${err}`;
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
 
@@ -505,14 +539,17 @@ function claudeMd() {
   }
   if (uninstall) {
     if (!had) return "absent";
-    writeFileSync(CLAUDE_MD, stripped.trimEnd() + "\n");
+    const err = safeWrite(CLAUDE_MD, stripped.trimEnd() + "\n");
+    if (err) return `failed:${err}`;
     return "removed";
   }
   const next = stripped.trimEnd()
     ? `${stripped.trimEnd()}\n\n${CLAUDE_MD_BLOCK}\n`
     : `${CLAUDE_MD_BLOCK}\n`;
-  mkdirSync(dirname(CLAUDE_MD), { recursive: true });
-  writeFileSync(CLAUDE_MD, next);
+  // safeWrite mkdirs dirname(CLAUDE_MD) inside its try, so a read-only ~/.claude is caught here too
+  // (a bare mkdirSync would throw uncaught before the write).
+  const err = safeWrite(CLAUDE_MD, next);
+  if (err) return `failed:${err}`;
   return had ? "refreshed" : "installed";
 }
 
@@ -590,17 +627,33 @@ function cleanupLocalData() {
   return cleaned;
 }
 
+// A target that could not be written returns `failed:<code>` (see safeWrite). Detect it so we never
+// print a clean success over a partial wire.
+const isFailure = (s) => typeof s === "string" && s.startsWith("failed:");
 const claudeResult = claude();
 if (statuslineOnly) {
   console.log(`skalpel statusline (${STATUSLINE_CMD}) → claude: ${claudeResult}`);
-  console.log(
-    claudeResult === "preserved"
-      ? "custom Claude status line preserved."
-      : "installed. Behavior hooks activate automatically after `skalpel login`.",
-  );
+  if (isFailure(claudeResult)) {
+    // Read-only ~/.claude (root-owned after a sudo install, MDM lock). Don't claim the status line
+    // installed; exit non-zero so postinstall's staging check surfaces its WARNING + repair path.
+    console.log(
+      "status line NOT installed — could not write ~/.claude/settings.json (see the error above). " +
+        "Fix the permissions shown, then run `skalpel setup`.",
+    );
+    process.exitCode = 1;
+  } else {
+    console.log(
+      claudeResult === "preserved"
+        ? "custom Claude status line preserved."
+        : "installed. Behavior hooks activate automatically after `skalpel login`.",
+    );
+  }
 } else {
+  const claudeMdResult = claudeMd();
+  const codexTomlResult = codexToml();
+  const codexJsonResult = codexJson();
   console.log(
-    `skalpel hook (${uninstall ? "uninstall" : CMD}) → claude: ${claudeResult} · claude.md: ${claudeMd()} · codex(config.toml): ${codexToml()} · codex(hooks.json): ${codexJson()}`,
+    `skalpel hook (${uninstall ? "uninstall" : CMD}) → claude: ${claudeResult} · claude.md: ${claudeMdResult} · codex(config.toml): ${codexTomlResult} · codex(hooks.json): ${codexJsonResult}`,
   );
   if (uninstall) {
     const cleaned = cleanupLocalData();
@@ -614,8 +667,22 @@ if (statuslineOnly) {
     }
     console.log("uninstalled.");
   } else {
-    console.log(
-      `installed. Hooks run from ${HOOKS_DIR} and use the canonical skalpel Cognito login.`,
+    // Downgrade the success summary if ANY target could not be written (read-only/permission-denied
+    // ~/.claude). One failed target never aborts the others — but never print a clean "installed."
+    // over a partial wire. When nothing failed, the success line below is byte-identical to before.
+    const failed = [claudeResult, claudeMdResult, codexTomlResult, codexJsonResult].filter(
+      isFailure,
     );
+    if (failed.length) {
+      console.log(
+        `install incomplete — ${failed.length} target(s) could not be written (see the error line(s) above). ` +
+          "Fix the permissions shown, then run `skalpel setup`.",
+      );
+      process.exitCode = 1;
+    } else {
+      console.log(
+        `installed. Hooks run from ${HOOKS_DIR} and use the canonical skalpel Cognito login.`,
+      );
+    }
   }
 }

package/ledger.mjs

@@ -246,7 +246,7 @@ export function renderLedger(ledger, { logPath = VERIFY_LOG_PATH } = {}) {
     L.push("");
     L.push("  No claim-verification history yet on this machine.");
     L.push(
-      "  Enable the shadow with SKALPEL_VERIFY_SHADOW=1, then keep coding — every turn your agent",
+      "  Arm the live catch with `skalpel verify on`, then keep coding — every turn your agent",
     );
     L.push('  claims "done / tests pass" gets its own proof re-run and appended to the ledger.');
     L.push("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.51",
+  "version": "4.0.53",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/postinstall.mjs

@@ -6,7 +6,7 @@
 //      the user runs `skalpel` (login → full install), so a bare `npm i -g` never silently starts
 //      reading prompts.
 import { spawnSync } from "node:child_process";
-import { rmSync } from "node:fs";
+import { rmSync, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -93,7 +93,18 @@ function fixSudoOwnership() {
     const uid = process.env.SUDO_UID;
     if (!uid) return; // genuinely root (not via sudo) — don't touch their files
     const gid = process.env.SUDO_GID || uid;
-    spawnSync("chown", ["-R", `${uid}:${gid}`, join(homedir(), ".skalpel")], q);
+    // Chown back EVERYTHING the sudo install may have created/written as root in the invoking user's
+    // HOME — not just ~/.skalpel. The `install --statusline-only` run above writes ~/.claude
+    // (settings.json / CLAUDE.md) and can touch ~/.codex; if those stay root-owned, the next non-root
+    // `skalpel` (or Claude Code itself) dies EACCES on them. Guard each with existsSync so we only
+    // chown what actually exists.
+    for (const dir of [
+      join(homedir(), ".skalpel"),
+      join(homedir(), ".claude"),
+      join(homedir(), ".codex"),
+    ]) {
+      if (existsSync(dir)) spawnSync("chown", ["-R", `${uid}:${gid}`, dir], q);
+    }
   } catch {
     /* best-effort — worst case the user runs `sudo chown -R $(whoami) ~/.skalpel` themselves */
   }

package/skalpel-hook.mjs

@@ -93,8 +93,18 @@ function isRealPrompt(q) {
 // interrupt markers + rapid corrections ("no", "still wrong", "that's not it"). The felt "you've cut
 // me off twice, let's reset" — the one steer you can't self-catch, and it's purely local + cheap.
 const _CORRECTION =
-  /^(no\b|nope|that'?s not|not what|still\b|again\b|wrong\b|i said|i meant|wtf|tf\b|why (is|are|does|isn|do)|ugh|c'?mon|cmon|bruh)/i;
-function detectCascade(payload) {
+  /^(no\b|nope|that'?s not|not what|still\b|again\b|wrong\b|i said|i meant|wtf|tf\b|ugh|c'?mon|cmon|bruh)/i;
+// A ^-anchored _CORRECTION match is only a REAL interrupt signal when the turn is a SHORT standalone
+// reaction ("no", "nope wrong", "still broken") — NOT an ordinary debugging prompt whose prose merely
+// OPENS with one of those words ("still seeing the error after the refresh because…", "why is the auth
+// middleware rejecting valid tokens?"). Gating on shape (<= 4 words OR < 30 chars) is what stops the
+// cascade interrupt from false-firing on healthy debugging turns. Explicit "[Request interrupted by
+// user]" markers stay counted unconditionally (a hard signal) — this gate is only for prose corrections.
+// NOTE: kept BYTE-IDENTICAL with skalpel-statusline.mjs's CORRECTION gate so the two never drift.
+function isShortReaction(trimmed) {
+  return trimmed.length < 30 || trimmed.split(/\s+/).length <= 4;
+}
+export function detectCascade(payload) {
   try {
     if (!payload.transcript_path) return 0;
     // Bounded tail read (256 KiB) — this runs EVERY turn, BEFORE the fetch deadline is armed, so an
@@ -123,7 +133,10 @@ function detectCascade(payload) {
       if (/\[Request interrupted by user\]/i.test(text)) signals++; // you cut it off
       if (e.type === "user" || e.role === "user") {
         userTurns++;
-        if (_CORRECTION.test(text.trim())) signals++; // you re-corrected
+        const trimmed = text.trim();
+        // A correction counts only as a SHORT standalone reaction — not a long prompt that merely opens
+        // with "still"/"again"/"no"/… (ordinary debugging phrasing). See isShortReaction above.
+        if (isShortReaction(trimmed) && _CORRECTION.test(trimmed)) signals++; // you re-corrected
       }
     }
     return signals;
@@ -376,7 +389,7 @@ export function updatePrefs(mutate) {
 // captured natively through the prompt (no button UI needed; this IS the harness wrapping). Returns
 // {action} or null. Deliberately narrow so normal prose never trips it: the word "skalpel", or a
 // short standalone reaction right after a steer fired.
-function parseControl(q) {
+export function parseControl(q) {
   const t = (q || "").trim().toLowerCase();
   if (t.length > 60) return null; // a real coding prompt, not a reaction
   const mentionsUs = /\bskalpel\b/.test(t);
@@ -407,12 +420,19 @@ function parseControl(q) {
       pure("(?:fewer|less|stop) (?:of )?(?:these|this|that|like this|steers?)|fewer like this"))
   )
     return { action: "fewer" };
-  if (/\b(tell me more|more detail|expand|go deeper|more on this|explain the trap)\b/.test(t))
+  if (
+    /\b(tell me more|more detail|expand|go deeper|more on this|explain the trap)\b/.test(t) &&
+    (mentionsUs || pure("tell me more|more detail|expand|go deeper|more on this|explain the trap"))
+  )
     return { action: "more" };
   if (
     /\b(that('?s| was)? (helpful|useful|good|great)|nice catch|good (call|catch)|helped|love (this|that)|👍)\b/.test(
       t,
-    )
+    ) &&
+    (mentionsUs ||
+      pure(
+        "that(?:'?s| was)? (?:helpful|useful|good|great)|nice catch|good (?:call|catch)|helped|love (?:this|that)|👍",
+      ))
   )
     return { action: "up" };
   if (/\b(not (helpful|useful)|wrong|useless|👎|off base|missed)\b/.test(t) && mentionsUs)

package/skalpel-setup.mjs

@@ -77,10 +77,10 @@ const KNOWN_SUBS = new Set([
 const VALUE_FLAGS = new Set(["--api", "--user"]);
 // Boolean flags that take no value. `--purge` on `uninstall` also removes auth + all local data.
 const BOOL_FLAGS = new Set(["--purge"]);
-const USAGE = `skalpel — connect your coding history to your behavioral graph
+const USAGE = `skalpel — your AI says "done." skalpel re-runs its own tests and shows you the truth.
 
 usage:
-  skalpel [setup] [--api <url>] [--user <id>]   sign in, learn your history, wire the hooks
+  skalpel [setup] [--api <url>] [--user <id>]   set up the catch: scan your history, wire the live check
   skalpel login                                 (re-)run the Google sign-in
   skalpel logout                                clear the saved session
   skalpel autopsy                               local, read-only receipt of your verified patterns
@@ -273,7 +273,9 @@ ${R}   ███████╗██╗  ██╗ █████╗ ██╗
    ╚════██║██╔═██╗ ██╔══██║██║     ██╔═══╝ ██╔══╝  ██║
    ███████║██║  ██╗██║  ██║███████╗██║     ███████╗███████╗
    ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝     ╚══════╝╚══════╝${X}`);
-  console.log(`\n   ${D}your AI coding sessions, learned — and steered in real time${X}\n`);
+  console.log(
+    `\n   ${D}when your AI says "done," skalpel re-runs its own tests — and tells you the truth${X}\n`,
+  );
 }
 
 const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];

package/skalpel-statusline.mjs

@@ -85,7 +85,17 @@ function readPayload() {
 // "still wrong", "that's not it"). Mirrors the per-turn hook's own cascade detector so the number the
 // bar shows is the same one the hook acts on — and it is a COUNT of real events, not a time estimate.
 const CORRECTION =
-  /^(no\b|nope|that'?s not|not what|still\b|again\b|wrong\b|i said|i meant|wtf|tf\b|why (is|are|does|isn|do)|ugh|c'?mon|cmon|bruh)/i;
+  /^(no\b|nope|that'?s not|not what|still\b|again\b|wrong\b|i said|i meant|wtf|tf\b|ugh|c'?mon|cmon|bruh)/i;
+// A ^-anchored CORRECTION match is only a REAL interrupt signal when the turn is a SHORT standalone
+// reaction ("no", "nope wrong", "still broken") — NOT an ordinary debugging prompt whose prose merely
+// OPENS with one of those words ("still seeing the error after the refresh because…", "why is the auth
+// middleware rejecting valid tokens?"). Gating on shape (<= 4 words OR < 30 chars) is what stops the
+// re-ask count from false-firing on healthy debugging turns. Explicit "[Request interrupted by
+// user]" markers stay counted unconditionally (a hard signal) — this gate is only for prose corrections.
+// NOTE: kept BYTE-IDENTICAL with skalpel-hook.mjs's _CORRECTION gate so the two never drift.
+function isShortReaction(trimmed) {
+  return trimmed.length < 30 || trimmed.split(/\s+/).length <= 4;
+}
 function reaskCount(transcriptPath) {
   if (!transcriptPath) return 0;
   const lines = tailLines(transcriptPath, 256 * 1024);
@@ -112,7 +122,10 @@ function reaskCount(transcriptPath) {
     if (/\[Request interrupted by user\]/i.test(text)) signals++;
     if (e.type === "user" || e.role === "user") {
       userTurns++;
-      if (CORRECTION.test(text.trim())) signals++;
+      const trimmed = text.trim();
+      // A correction counts only as a SHORT standalone reaction — not a long prompt that merely opens
+      // with "still"/"again"/"no"/… (ordinary debugging phrasing). See isShortReaction above.
+      if (isShortReaction(trimmed) && CORRECTION.test(trimmed)) signals++;
     }
   }
   return signals;