skalpel 4.0.52 → 4.0.54

package/install.mjs

@@ -195,9 +195,32 @@ function readJson(p) {
     return null; // signal "do not write" to callers
   }
 }
+// Abbreviate a home-rooted path to `~/…` for the user-facing repair hint (so it reads `~/.claude`,
+// not a long absolute path).
+function homeTilde(p) {
+  const h = homedir();
+  return p === h || p.startsWith(h + "/") || p.startsWith(h + "\\") ? "~" + p.slice(h.length) : p;
+}
+// Write a config file DEFENSIVELY. A read-only / permission-denied target — a root-owned ~/.claude
+// left behind by an earlier `sudo` install, an MDM-locked home — must NOT throw and abort the whole
+// installer (that would leave ZERO working hooks). Instead surface ONE clear repair line and return
+// the OS error code so the caller can report `failed:<code>` and STILL attempt every other target.
+// Returns null on success. mkdir is inside the try so a read-only PARENT dir is caught too, never
+// left as an uncaught throw.
+function safeWrite(p, data) {
+  try {
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, data);
+    return null;
+  } catch (e) {
+    console.error(
+      `skalpel: could not write ${homeTilde(p)}: ${e.message} — run: sudo chown -R $(whoami) ${homeTilde(dirname(p))}`,
+    );
+    return e.code || "write-failed";
+  }
+}
 function writeJson(p, o) {
-  mkdirSync(dirname(p), { recursive: true });
-  writeFileSync(p, JSON.stringify(o, null, 2));
+  return safeWrite(p, JSON.stringify(o, null, 2));
 }
 function isOurs(c, marker) {
   if (typeof c !== "string") return false;
@@ -284,7 +307,10 @@ function claude() {
   // — when there was nothing to do: an `uninstall` on a machine that never had our hooks leaves the
   // file exactly as it was (or absent). Install always changes something here, so this only suppresses
   // the no-op write.
-  if (installed || refreshed || removed) writeJson(CLAUDE, d);
+  if (installed || refreshed || removed) {
+    const err = writeJson(CLAUDE, d);
+    if (err) return `failed:${err}`; // read-only ~/.claude — reported, never thrown
+  }
   if (uninstall) return removed ? "removed" : "absent";
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
@@ -404,14 +430,18 @@ function codexToml() {
     // Only rewrite a config.toml that already existed — never CREATE one during an uninstall. A user
     // with ~/.codex but no config.toml has nothing of ours to strip, so writing `next + "\n"` here
     // would leave a stray 1-byte file behind an operation that's supposed to clean up.
-    if (hadToml) writeFileSync(CODEX_TOML, next + "\n");
+    if (hadToml) {
+      const err = safeWrite(CODEX_TOML, next + "\n");
+      if (err) return `failed:${err}`;
+    }
     return stripped.removed ? "removed" : "absent";
   }
   mkdirSync(CODEX_DIR, { recursive: true });
   for (const [event, marker, command] of HOOKS) {
     next += "\n" + tomlBlock(event, marker, command);
   }
-  writeFileSync(CODEX_TOML, next + "\n");
+  const err = safeWrite(CODEX_TOML, next + "\n");
+  if (err) return `failed:${err}`;
   return stripped.removed ? "refreshed" : "installed";
 }
 
@@ -445,10 +475,14 @@ function codexJson() {
     // one of our blocks from an existing file (mirrors codexToml's hadToml guard). A machine whose
     // ~/.codex has no hooks.json (or none of ours) has nothing to clean up, so writing here would drop
     // a stray file behind an operation that's supposed to leave the machine clean.
-    if (removed) writeJson(CODEX, d);
+    if (removed) {
+      const err = writeJson(CODEX, d);
+      if (err) return `failed:${err}`;
+    }
     return removed ? "removed" : "absent";
   }
-  writeJson(CODEX, d);
+  const err = writeJson(CODEX, d);
+  if (err) return `failed:${err}`;
   return installed ? "installed" : refreshed ? "refreshed" : "absent";
 }
 
@@ -505,14 +539,17 @@ function claudeMd() {
   }
   if (uninstall) {
     if (!had) return "absent";
-    writeFileSync(CLAUDE_MD, stripped.trimEnd() + "\n");
+    const err = safeWrite(CLAUDE_MD, stripped.trimEnd() + "\n");
+    if (err) return `failed:${err}`;
     return "removed";
   }
   const next = stripped.trimEnd()
     ? `${stripped.trimEnd()}\n\n${CLAUDE_MD_BLOCK}\n`
     : `${CLAUDE_MD_BLOCK}\n`;
-  mkdirSync(dirname(CLAUDE_MD), { recursive: true });
-  writeFileSync(CLAUDE_MD, next);
+  // safeWrite mkdirs dirname(CLAUDE_MD) inside its try, so a read-only ~/.claude is caught here too
+  // (a bare mkdirSync would throw uncaught before the write).
+  const err = safeWrite(CLAUDE_MD, next);
+  if (err) return `failed:${err}`;
   return had ? "refreshed" : "installed";
 }
 
@@ -590,17 +627,33 @@ function cleanupLocalData() {
   return cleaned;
 }
 
+// A target that could not be written returns `failed:<code>` (see safeWrite). Detect it so we never
+// print a clean success over a partial wire.
+const isFailure = (s) => typeof s === "string" && s.startsWith("failed:");
 const claudeResult = claude();
 if (statuslineOnly) {
   console.log(`skalpel statusline (${STATUSLINE_CMD}) → claude: ${claudeResult}`);
-  console.log(
-    claudeResult === "preserved"
-      ? "custom Claude status line preserved."
-      : "installed. Behavior hooks activate automatically after `skalpel login`.",
-  );
+  if (isFailure(claudeResult)) {
+    // Read-only ~/.claude (root-owned after a sudo install, MDM lock). Don't claim the status line
+    // installed; exit non-zero so postinstall's staging check surfaces its WARNING + repair path.
+    console.log(
+      "status line NOT installed — could not write ~/.claude/settings.json (see the error above). " +
+        "Fix the permissions shown, then run `skalpel setup`.",
+    );
+    process.exitCode = 1;
+  } else {
+    console.log(
+      claudeResult === "preserved"
+        ? "custom Claude status line preserved."
+        : "installed. Behavior hooks activate automatically after `skalpel login`.",
+    );
+  }
 } else {
+  const claudeMdResult = claudeMd();
+  const codexTomlResult = codexToml();
+  const codexJsonResult = codexJson();
   console.log(
-    `skalpel hook (${uninstall ? "uninstall" : CMD}) → claude: ${claudeResult} · claude.md: ${claudeMd()} · codex(config.toml): ${codexToml()} · codex(hooks.json): ${codexJson()}`,
+    `skalpel hook (${uninstall ? "uninstall" : CMD}) → claude: ${claudeResult} · claude.md: ${claudeMdResult} · codex(config.toml): ${codexTomlResult} · codex(hooks.json): ${codexJsonResult}`,
   );
   if (uninstall) {
     const cleaned = cleanupLocalData();
@@ -614,8 +667,22 @@ if (statuslineOnly) {
     }
     console.log("uninstalled.");
   } else {
-    console.log(
-      `installed. Hooks run from ${HOOKS_DIR} and use the canonical skalpel Cognito login.`,
+    // Downgrade the success summary if ANY target could not be written (read-only/permission-denied
+    // ~/.claude). One failed target never aborts the others — but never print a clean "installed."
+    // over a partial wire. When nothing failed, the success line below is byte-identical to before.
+    const failed = [claudeResult, claudeMdResult, codexTomlResult, codexJsonResult].filter(
+      isFailure,
     );
+    if (failed.length) {
+      console.log(
+        `install incomplete — ${failed.length} target(s) could not be written (see the error line(s) above). ` +
+          "Fix the permissions shown, then run `skalpel setup`.",
+      );
+      process.exitCode = 1;
+    } else {
+      console.log(
+        `installed. Hooks run from ${HOOKS_DIR} and use the canonical skalpel Cognito login.`,
+      );
+    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.52",
+  "version": "4.0.54",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/postinstall.mjs

@@ -6,7 +6,7 @@
 //      the user runs `skalpel` (login → full install), so a bare `npm i -g` never silently starts
 //      reading prompts.
 import { spawnSync } from "node:child_process";
-import { rmSync } from "node:fs";
+import { rmSync, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -93,7 +93,18 @@ function fixSudoOwnership() {
     const uid = process.env.SUDO_UID;
     if (!uid) return; // genuinely root (not via sudo) — don't touch their files
     const gid = process.env.SUDO_GID || uid;
-    spawnSync("chown", ["-R", `${uid}:${gid}`, join(homedir(), ".skalpel")], q);
+    // Chown back EVERYTHING the sudo install may have created/written as root in the invoking user's
+    // HOME — not just ~/.skalpel. The `install --statusline-only` run above writes ~/.claude
+    // (settings.json / CLAUDE.md) and can touch ~/.codex; if those stay root-owned, the next non-root
+    // `skalpel` (or Claude Code itself) dies EACCES on them. Guard each with existsSync so we only
+    // chown what actually exists.
+    for (const dir of [
+      join(homedir(), ".skalpel"),
+      join(homedir(), ".claude"),
+      join(homedir(), ".codex"),
+    ]) {
+      if (existsSync(dir)) spawnSync("chown", ["-R", `${uid}:${gid}`, dir], q);
+    }
   } catch {
     /* best-effort — worst case the user runs `sudo chown -R $(whoami) ~/.skalpel` themselves */
   }

package/skalpel-hook.mjs

@@ -93,8 +93,18 @@ function isRealPrompt(q) {
 // interrupt markers + rapid corrections ("no", "still wrong", "that's not it"). The felt "you've cut
 // me off twice, let's reset" — the one steer you can't self-catch, and it's purely local + cheap.
 const _CORRECTION =
-  /^(no\b|nope|that'?s not|not what|still\b|again\b|wrong\b|i said|i meant|wtf|tf\b|why (is|are|does|isn|do)|ugh|c'?mon|cmon|bruh)/i;
-function detectCascade(payload) {
+  /^(no\b|nope|that'?s not|not what|still\b|again\b|wrong\b|i said|i meant|wtf|tf\b|ugh|c'?mon|cmon|bruh)/i;
+// A ^-anchored _CORRECTION match is only a REAL interrupt signal when the turn is a SHORT standalone
+// reaction ("no", "nope wrong", "still broken") — NOT an ordinary debugging prompt whose prose merely
+// OPENS with one of those words ("still seeing the error after the refresh because…", "why is the auth
+// middleware rejecting valid tokens?"). Gating on shape (<= 4 words OR < 30 chars) is what stops the
+// cascade interrupt from false-firing on healthy debugging turns. Explicit "[Request interrupted by
+// user]" markers stay counted unconditionally (a hard signal) — this gate is only for prose corrections.
+// NOTE: kept BYTE-IDENTICAL with skalpel-statusline.mjs's CORRECTION gate so the two never drift.
+function isShortReaction(trimmed) {
+  return trimmed.length < 30 || trimmed.split(/\s+/).length <= 4;
+}
+export function detectCascade(payload) {
   try {
     if (!payload.transcript_path) return 0;
     // Bounded tail read (256 KiB) — this runs EVERY turn, BEFORE the fetch deadline is armed, so an
@@ -123,7 +133,10 @@ function detectCascade(payload) {
       if (/\[Request interrupted by user\]/i.test(text)) signals++; // you cut it off
       if (e.type === "user" || e.role === "user") {
         userTurns++;
-        if (_CORRECTION.test(text.trim())) signals++; // you re-corrected
+        const trimmed = text.trim();
+        // A correction counts only as a SHORT standalone reaction — not a long prompt that merely opens
+        // with "still"/"again"/"no"/… (ordinary debugging phrasing). See isShortReaction above.
+        if (isShortReaction(trimmed) && _CORRECTION.test(trimmed)) signals++; // you re-corrected
       }
     }
     return signals;
@@ -376,7 +389,7 @@ export function updatePrefs(mutate) {
 // captured natively through the prompt (no button UI needed; this IS the harness wrapping). Returns
 // {action} or null. Deliberately narrow so normal prose never trips it: the word "skalpel", or a
 // short standalone reaction right after a steer fired.
-function parseControl(q) {
+export function parseControl(q) {
   const t = (q || "").trim().toLowerCase();
   if (t.length > 60) return null; // a real coding prompt, not a reaction
   const mentionsUs = /\bskalpel\b/.test(t);
@@ -407,12 +420,19 @@ function parseControl(q) {
       pure("(?:fewer|less|stop) (?:of )?(?:these|this|that|like this|steers?)|fewer like this"))
   )
     return { action: "fewer" };
-  if (/\b(tell me more|more detail|expand|go deeper|more on this|explain the trap)\b/.test(t))
+  if (
+    /\b(tell me more|more detail|expand|go deeper|more on this|explain the trap)\b/.test(t) &&
+    (mentionsUs || pure("tell me more|more detail|expand|go deeper|more on this|explain the trap"))
+  )
     return { action: "more" };
   if (
     /\b(that('?s| was)? (helpful|useful|good|great)|nice catch|good (call|catch)|helped|love (this|that)|👍)\b/.test(
       t,
-    )
+    ) &&
+    (mentionsUs ||
+      pure(
+        "that(?:'?s| was)? (?:helpful|useful|good|great)|nice catch|good (?:call|catch)|helped|love (?:this|that)|👍",
+      ))
   )
     return { action: "up" };
   if (/\b(not (helpful|useful)|wrong|useless|👎|off base|missed)\b/.test(t) && mentionsUs)

package/skalpel-statusline.mjs

@@ -85,7 +85,17 @@ function readPayload() {
 // "still wrong", "that's not it"). Mirrors the per-turn hook's own cascade detector so the number the
 // bar shows is the same one the hook acts on — and it is a COUNT of real events, not a time estimate.
 const CORRECTION =
-  /^(no\b|nope|that'?s not|not what|still\b|again\b|wrong\b|i said|i meant|wtf|tf\b|why (is|are|does|isn|do)|ugh|c'?mon|cmon|bruh)/i;
+  /^(no\b|nope|that'?s not|not what|still\b|again\b|wrong\b|i said|i meant|wtf|tf\b|ugh|c'?mon|cmon|bruh)/i;
+// A ^-anchored CORRECTION match is only a REAL interrupt signal when the turn is a SHORT standalone
+// reaction ("no", "nope wrong", "still broken") — NOT an ordinary debugging prompt whose prose merely
+// OPENS with one of those words ("still seeing the error after the refresh because…", "why is the auth
+// middleware rejecting valid tokens?"). Gating on shape (<= 4 words OR < 30 chars) is what stops the
+// re-ask count from false-firing on healthy debugging turns. Explicit "[Request interrupted by
+// user]" markers stay counted unconditionally (a hard signal) — this gate is only for prose corrections.
+// NOTE: kept BYTE-IDENTICAL with skalpel-hook.mjs's _CORRECTION gate so the two never drift.
+function isShortReaction(trimmed) {
+  return trimmed.length < 30 || trimmed.split(/\s+/).length <= 4;
+}
 function reaskCount(transcriptPath) {
   if (!transcriptPath) return 0;
   const lines = tailLines(transcriptPath, 256 * 1024);
@@ -112,7 +122,10 @@ function reaskCount(transcriptPath) {
     if (/\[Request interrupted by user\]/i.test(text)) signals++;
     if (e.type === "user" || e.role === "user") {
       userTurns++;
-      if (CORRECTION.test(text.trim())) signals++;
+      const trimmed = text.trim();
+      // A correction counts only as a SHORT standalone reaction — not a long prompt that merely opens
+      // with "still"/"again"/"no"/… (ordinary debugging phrasing). See isShortReaction above.
+      if (isShortReaction(trimmed) && CORRECTION.test(trimmed)) signals++;
     }
   }
   return signals;
@@ -332,10 +345,10 @@ function compactMeasured(ms) {
 // This always-on aggregate counter is an EXPLICIT PRODUCT DECISION by the owner: it is skalpel's terminal
 // presence and must never be gated/hidden ("never remove it from the terminal otherwise skalpel is
 // invisible"). Aggregate-only + no fabrication is what keeps that always-on surface honest.
-function measuredCaughtTotalMs() {
+function shadowTally() {
   try {
     const lines = tailLines(VERIFY_LOG_PATH, SHADOW_READ_BYTES);
-    if (!lines.length) return 0;
+    if (!lines.length) return { totalMs: 0, checked: 0, lies: 0 };
     const rows = [];
     for (const l of lines) {
       try {
@@ -349,14 +362,25 @@ function measuredCaughtTotalMs() {
     // O(falseCount × rows) that re-scanned every row for each catch on EVERY bar render.
     const fixDeltaFor = buildFixDeltas(rows);
     let total = 0;
+    // The HEARTBEAT counts (same single pass — zero extra I/O on the bar's hot path):
+    //   checked — claims the shadow got a GENUINE verdict for (its own proof/probe really ran: PASS /
+    //             GENUINE_FAIL / SHIP_OK / SHIP_FAIL). HARNESS_ERROR rows are logged but NOT counted —
+    //             identical to the ledger's "unverifiable" rule: we never claim a check we can't stand
+    //             behind. So a fresh install (or harness-noise-only log) keeps checked = 0.
+    //   lies    — the caught-false subset (mismatch === true), the money metric.
+    const CHECKED = new Set(["PASS", "GENUINE_FAIL", "SHIP_OK", "SHIP_FAIL"]);
+    let checked = 0;
+    let lies = 0;
     for (const r of rows) {
+      if (CHECKED.has(r.outcome)) checked += 1;
       if (r.mismatch !== true) continue; // only a caught false "done" (verify-shadow's money metric)
+      lies += 1;
       const d = fixDeltaFor(r); // exact ledger.mjs logic; null-session rows excluded (Finding 3)
       if (d && Number.isFinite(d.ms) && d.ms > 0) total += d.ms; // real measured delta only; else +0
     }
-    return total;
+    return { totalMs: total, checked, lies };
   } catch {
-    return 0; // any error → no measured total (fail-open: never break or slow the bar)
+    return { totalMs: 0, checked: 0, lies: 0 }; // fail-open: never break or slow the bar
   }
 }
 
@@ -422,10 +446,23 @@ function main() {
   //   • Raahil's `~`-prefixed saved ESTIMATE ("· ~7m saved") — shown only when saved_min > 0 (its data is
   //     the user's own steers.ndjson credit, not the shadow log, so it keeps his always-on #609 behavior).
   const { steers, savedMin } = readState();
+  const tally = SHOW_MEASURED ? shadowTally() : { totalMs: 0, checked: 0, lies: 0 };
   let line = `${BOLD}skalpel${RESET} · ${CYAN}${steers} steers${RESET}`;
   if (SHOW_MEASURED) {
-    const caught = compactMeasured(measuredCaughtTotalMs()); // null when < 1s of real measured catches
+    const caught = compactMeasured(tally.totalMs); // null when < 1s of real measured catches
     if (caught) line += ` · ${CYAN}${caught} caught${RESET}`;
+    // THE HEARTBEAT (founder: "I only see 0 steers — the product is invisible while it works").
+    // Once the armed shadow has genuinely CHECKED at least one claim, the line SHOWS the work:
+    //   clean so far → "· 3 claims verified"    (the earned-silence receipt — real verdicts only)
+    //   lies caught  → "· 31 checked · 2 false" (the honest split; the measured clause carries the time)
+    // Real counts from the same single log pass. A fresh install (checked = 0) emits EXACTLY the
+    // baseline line — byte-identical, nothing invented.
+    if (tally.checked > 0) {
+      line +=
+        tally.lies > 0
+          ? ` · ${CYAN}${tally.checked} checked · ${tally.lies} false${RESET}`
+          : ` · ${CYAN}${tally.checked} claim${tally.checked === 1 ? "" : "s"} verified${RESET}`;
+    }
   }
   if (SHOW_SAVED) {
     const phrase = savedPhrase(savedMin);