skalpel 4.0.57 → 4.0.59

package/anchor-shadow.mjs

@@ -505,11 +505,22 @@ function findPushBranch(text) {
   return { remote, branch };
 }
 
-// findTag(text) → a release tag (vX.Y.Z or a `git tag <t>` / `git push origin <t>` mention). Validated.
+// findTag(text) → a release tag, COMMAND-ANCHORED (2026-07-13 false-accusation incident): a git-tag
+// target may ONLY be minted when the tag token appears on a line that is itself a `git tag` / `git push`
+// COMMAND — NEVER scavenged from arbitrary prose/output. A bare `v26.3.1` in quoted `node --version`
+// output once became a "release tag", probed `git ls-remote --tags origin v26.3.1`, and minted a false
+// SHIP_FAIL on a true claim. Implementation: extract ONLY the candidate lines matching
+// /\bgit\s+(?:tag|push)\b/ and run the (unchanged) tag patterns over those lines alone; no such line →
+// no target, ever (→ NO_TARGET, no probe, no accusation). Validation (SHIP_SAFE_REF) unchanged.
 function findTag(text) {
-  const near = /\bgit\s+(?:tag|push[^\n;&|]*?)\s+(v?\d+\.\d+\.\d+[0-9A-Za-z.\-+]*)\b/i.exec(text);
+  const cmdLines = String(text || "")
+    .split(/\r?\n/)
+    .filter((l) => /\bgit\s+(?:tag|push)\b/i.test(l));
+  if (!cmdLines.length) return null; // no git tag/push command anywhere in context → no tag target
+  const cmds = cmdLines.join("\n");
+  const near = /\bgit\s+(?:tag|push[^\n;&|]*?)\s+(v?\d+\.\d+\.\d+[0-9A-Za-z.\-+]*)\b/i.exec(cmds);
   if (near && SHIP_SAFE_REF.test(near[1])) return near[1];
-  const m = /\b(v\d+\.\d+\.\d+[0-9A-Za-z.\-+]*)\b/.exec(text);
+  const m = /\b(v\d+\.\d+\.\d+[0-9A-Za-z.\-+]*)\b/.exec(cmds);
   return m && SHIP_SAFE_REF.test(m[1]) ? m[1] : null;
 }
 

package/eval-harness.mjs

@@ -1127,6 +1127,7 @@ const SHIP_FIXTURES = [
     expectReprobe: true,
   },
   // (d) TRUE CATCH: pushed-claim + sha NOT on the real remote tip → red (it never left the machine).
+  //     Since the all-reds confirm-gate (2026-07-13 incident), even a hard FAIL must confirm 2/2.
   {
     id: "d",
     label: "pushed + sha-not-on-remote → RED",
@@ -1136,8 +1137,9 @@ const SHIP_FIXTURES = [
     exec: gitRemoteExec({ tip: SHA_OLD, ancestor: false }),
     expectOutcome: "SHIP_FAIL",
     expectRed: true,
+    expectReprobe: true,
   },
-  // (e) TRUE CATCH: merged-claim + PR is OPEN → red.
+  // (e) TRUE CATCH: merged-claim + PR is OPEN → red (confirmed 2/2).
   {
     id: "e",
     label: "merged + PR OPEN → RED",
@@ -1147,6 +1149,7 @@ const SHIP_FIXTURES = [
     exec: ghPrExec("OPEN", null),
     expectOutcome: "SHIP_FAIL",
     expectRed: true,
+    expectReprobe: true,
   },
   // (f) TRUE CATCH: live-claim + confirmed 404 × 2 → red (only the double-negative fires).
   {
@@ -1217,7 +1220,7 @@ const SHIP_FIXTURES = [
     expectRed: true,
     expectReprobe: true,
   },
-  // (l) published + NOT on the registry → red (npm view E404).
+  // (l) published + NOT on the registry → red (npm view E404, confirmed 2/2).
   {
     id: "l",
     label: "published + npm E404 → RED",
@@ -1227,6 +1230,7 @@ const SHIP_FIXTURES = [
     exec: npmExec(false, "9.9.9"),
     expectOutcome: "SHIP_FAIL",
     expectRed: true,
+    expectReprobe: true,
   },
   // (m) published + IS on the registry → NO red.
   {
@@ -1239,7 +1243,7 @@ const SHIP_FIXTURES = [
     expectOutcome: "SHIP_OK",
     expectRed: false,
   },
-  // (n) CI green claim + checks FAILING → red.
+  // (n) CI green claim + checks FAILING → red (confirmed 2/2).
   {
     id: "n",
     label: "ci-green + checks failing → RED",
@@ -1249,6 +1253,7 @@ const SHIP_FIXTURES = [
     exec: ghChecksExec([{ bucket: "pass" }, { bucket: "fail" }]),
     expectOutcome: "SHIP_FAIL",
     expectRed: true,
+    expectReprobe: true,
   },
   // (o) CI green claim + checks passing → NO red.
   {
@@ -1261,7 +1266,7 @@ const SHIP_FIXTURES = [
     expectOutcome: "SHIP_OK",
     expectRed: false,
   },
-  // (p) released (git tag) + tag NOT on origin → red.
+  // (p) released (git tag) + tag NOT on origin → red (confirmed 2/2).
   {
     id: "p",
     label: "released tag + missing on origin → RED",
@@ -1271,6 +1276,7 @@ const SHIP_FIXTURES = [
     exec: gitTagExec(false, "v2.0.0"),
     expectOutcome: "SHIP_FAIL",
     expectRed: true,
+    expectReprobe: true,
   },
   // (q) released (git tag) + tag present on origin → NO red.
   {

package/install.mjs

@@ -587,32 +587,27 @@ function cleanupLocalData() {
     return cleaned;
   }
 
-  // Plain uninstall: remove staged hooks + the raw transcript snapshots + all local state/logs, but
-  // KEEP the saved auth (that's what `--purge` is for). List every file skalpel writes under ~/.skalpel
-  // so nothing is silently left behind; auth.json (legacy local location) is deliberately preserved.
-  rm(join(SKALPEL_DIR, "hooks"), "staged hooks");
-  rm(join(SKALPEL_DIR, "ingest-outbox"), "raw transcript snapshots (ingest-outbox)");
-  for (const f of [
-    "stats.json", // legacy "time saved" accumulator — nothing writes it now, but old installs left one
-    "session.json",
-    "steer.json",
-    "traj.json",
-    "pending.json",
-    "prefs.json",
-    "insights.ndjson",
-    "insights-ready.json",
-    "metrics.ndjson",
-    "bootstrap.json",
-    "bootstrap.lock",
-    "client.json",
-    "doctor.log",
-    "hook.log",
-    "verify-shadow.log",
-    "verify-last.json",
-    "verify-shadow.lock",
-    "verify-reveal.json",
-  ]) {
-    rm(join(SKALPEL_DIR, f), f);
+  // Plain uninstall: remove EVERYTHING under ~/.skalpel — staged hooks, transcript snapshots, all
+  // state/logs — but KEEP the saved auth (that's what `--purge` is for). This is a SWEEP, not a
+  // hand-maintained filename list: the old list silently drifted from what the runtime actually
+  // writes (steers.ndjson, verify-verdict.json, verify-ship-last.json, auth-notice.json,
+  // build-stalled.json, first-run.json, verify-reveal-notified.json all survived it), breaking the
+  // "nothing silently left behind" promise. Everything under ~/.skalpel is ours; only auth.json
+  // (legacy local session location) is deliberately preserved. rm()'s PKG_DIR guard still protects
+  // a self-hosted layout from deleting the running installer.
+  const LABELS = {
+    hooks: "staged hooks",
+    "ingest-outbox": "raw transcript snapshots (ingest-outbox)",
+  };
+  let entries = [];
+  try {
+    entries = existsSync(SKALPEL_DIR) ? readdirSync(SKALPEL_DIR).sort() : [];
+  } catch {
+    /* unreadable dir — best-effort; an uninstall never fails on it */
+  }
+  for (const name of entries) {
+    if (name === "auth.json") continue; // kept — `--purge` is the deliberate "forget me entirely"
+    rm(join(SKALPEL_DIR, name), LABELS[name] || name);
   }
   if (cleaned.length)
     cleaned.push("(auth kept — run `skalpel uninstall --purge` to remove it too)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.57",
+  "version": "4.0.59",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-setup.mjs

@@ -16,7 +16,7 @@ import {
   constants,
 } from "node:fs";
 import { homedir } from "node:os";
-import { join, dirname, delimiter, sep as pathSep } from "node:path";
+import { basename, join, dirname, delimiter, sep as pathSep } from "node:path";
 import { createInterface, emitKeypressEvents } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
@@ -591,7 +591,7 @@ export async function scanHistory(days = LOOKBACK_DAYS) {
   const files = walk(join(homedir(), ".claude", "projects"))
     .concat(walk(join(homedir(), ".codex", "sessions")))
     .filter((f) => {
-      if (f.split("/").pop().startsWith("agent-")) return false; // sub-agent transcripts, not the user
+      if (basename(f).startsWith("agent-")) return false; // sub-agent transcripts, not the user
       try {
         return statSync(f).mtimeMs >= cutoff;
       } catch {
@@ -611,6 +611,19 @@ export async function scanHistory(days = LOOKBACK_DAYS) {
   return out;
 }
 
+// Whether the 401 self-heal below may spawn the INTERACTIVE sign-in. login.mjs opens a Google
+// OAuth browser tab and blocks (~180s) on the callback — acceptable only on a real terminal where
+// the user can see why a tab just popped. The detached background build (`__build`, stdio:"ignore")
+// has neither TTY: spawning login from there pops a zero-context browser tab and stalls the build,
+// so it must instead let the 401 fall through to the ingest error, which backgroundBuild's
+// build-stalled.json marker surfaces next session. Pure decision helper, exported for tests.
+export function shouldSelfHealLogin(
+  stdoutIsTTY = process.stdout.isTTY,
+  stdinIsTTY = process.stdin.isTTY,
+) {
+  return Boolean(stdoutIsTTY && stdinIsTTY);
+}
+
 // HOSTED model: the client is thin — it just UPLOADS the raw transcripts; the SERVER filters
 // (real-session detection) + judges (Gemini) + builds the Amplitude dash + aggregate DAG into the
 // hosted store under the user's uid. No Python, no engine, no graph-building on the user's machine.
@@ -669,7 +682,7 @@ async function buildGraph(sp, files, id) {
       curBytes = 0;
     }
     try {
-      cur[f.split("/").pop()] = readFileSync(f, "utf8");
+      cur[basename(f)] = readFileSync(f, "utf8");
       curBytes += size;
     } catch {
       /* skip unreadable */
@@ -695,8 +708,9 @@ async function buildGraph(sp, files, id) {
     const label = batches.length > 1 ? ` (batch ${bi + 1}/${batches.length})` : "";
     sp.text(`Building your graph…${label}`);
     let r = await postBatch(batches[bi], token);
-    // SELF-HEAL on 401: refresh the Google session once, then retry this batch.
-    if (r.status === 401 && !process.env.SKALPEL_USER) {
+    // SELF-HEAL on 401: refresh the Google session once, then retry this batch. INTERACTIVE ONLY
+    // (shouldSelfHealLogin): in the detached/non-TTY case the 401 falls through to the throw below.
+    if (r.status === 401 && !process.env.SKALPEL_USER && shouldSelfHealLogin()) {
       sp.text("Session expired — re-opening sign-in…");
       spawnSync("node", [join(__dir, "login.mjs")], { stdio: "inherit" });
       const fresh = await identity();

package/skalpel-statusline.mjs

@@ -39,7 +39,16 @@ import { readFileSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { tailLines } from "./transcript.mjs";
-import { cleanText, REVEAL_PATH, VERDICT_PATH, revealEnabled, autoDarkened } from "./insights.mjs";
+import {
+  cleanText,
+  REVEAL_PATH,
+  VERDICT_PATH,
+  revealEnabled,
+  autoDarkened,
+  ADJUDICATIONS_PATH,
+  SUPPRESS_PATH,
+  proofSig,
+} from "./insights.mjs";
 
 const CYAN = "\x1b[36m";
 const GREEN = "\x1b[32m";
@@ -352,6 +361,38 @@ function compactMeasured(ms) {
     : `${(Math.floor(h * 10) / 10).toFixed(1).replace(/\.0$/, "")}h`;
 }
 
+// adjudicatedNoKeys() → the set of `${session}|${proofSig}` keys the USER adjudicated "not a real catch"
+// (`skalpel no` appends a verdict:"no" row to verify-adjudications.ndjson AND a session-scoped row to
+// verify-suppressed.ndjson — both are read, either is sufficient evidence). Bounded tail reads (same
+// tailLines guard as the shadow log), fail-open (any error → empty set → tally unchanged). Called LAZILY
+// from shadowTally only when a mismatch row actually exists, so a log with no catches — and any install
+// where the adjudication files are absent — pays zero extra cost.
+const ADJ_READ_BYTES = 256 * 1024;
+function adjudicatedNoKeys() {
+  const keys = new Set();
+  try {
+    for (const l of tailLines(ADJUDICATIONS_PATH, ADJ_READ_BYTES)) {
+      try {
+        const r = JSON.parse(l);
+        if (r && r.verdict === "no" && r.proof) keys.add(`${r.session ?? ""}|${proofSig(r.proof)}`);
+      } catch {
+        /* partial / garbage line — skip */
+      }
+    }
+    for (const l of tailLines(SUPPRESS_PATH, ADJ_READ_BYTES)) {
+      try {
+        const r = JSON.parse(l);
+        if (r && r.session && r.proof) keys.add(`${r.session}|${proofSig(r.proof)}`);
+      } catch {
+        /* partial / garbage line — skip */
+      }
+    }
+  } catch {
+    /* fail-open: no adjudication data → nothing excluded */
+  }
+  return keys;
+}
+
 // measuredCaughtTotalMs() → the CUMULATIVE LIFETIME sum, in ms, of EVERY real measured red→green delta:
 // each caught false "done" (mismatch row) that has a later same-session same-proof PASS contributes that
 // one measured (t_pass − t_false) delta; a catch with no later PASS contributes 0 (never estimated). This
@@ -388,7 +429,20 @@ function shadowTally() {
     const CHECKED = new Set(["PASS", "GENUINE_FAIL", "SHIP_OK", "SHIP_FAIL"]);
     let checked = 0;
     let lies = 0;
+    // ADJUDICATION-AWARE (2026-07-13 false-accusation incident): a mismatch row the USER marked "not a
+    // real catch" (`skalpel no`) must stop counting as `false` on the bar — and an adjudicated-wrong
+    // check isn't a check we stand behind, so it leaves `checked` (and its fixDelta leaves the measured
+    // total) too. Lazy: the adjudication files are only read once a mismatch row actually exists.
+    let noKeys = null;
+    const adjudicatedWrong = (r) => {
+      if (r.mismatch !== true) return false;
+      if (noKeys === null) noKeys = adjudicatedNoKeys();
+      if (noKeys.size === 0) return false;
+      // The join key mirrors the reveal/adjudication sig: a ship row's "proof" is its probe command.
+      return noKeys.has(`${r.session ?? ""}|${proofSig(r.proof_command || r.probe_command)}`);
+    };
     for (const r of rows) {
+      if (adjudicatedWrong(r)) continue; // user said "no" — not a lie, not a check, no measured delta
       if (CHECKED.has(r.outcome)) checked += 1;
       if (r.mismatch !== true) continue; // only a caught false "done" (verify-shadow's money metric)
       lies += 1;

package/verify-shadow.mjs

@@ -1013,6 +1013,21 @@ const SHIP_CLAIM_PATTERNS = [
 const SHIP_FUTURE_OR_QUESTION =
   /\b(?:will|i'?ll|we'?ll|going\s+to|gonna|about\s+to|let\s+me|planning\s+to|need\s+to|shall\s+i|should\s+i|can\s+i|once\s+|after\s+i|before\s+i|ready\s+to)\b/i;
 
+// PRECISION (2026-07-13 false-accusation incident): markdown STRUCTURE is not a declarative sentence.
+// A real ship claim ("Deployed to prod.", "it's live at https://…") is a plain declarative line; a
+// bullet / table row / blockquote / heading / bold-lead line is the assistant NARRATING or summarizing —
+// a status-table bullet ("- **`npx skalpel@latest` (what customers install):** 4.0.52 — …") once minted
+// a false SHIP_FAIL on the founder's own machine. NARROWING only: skip such lines outright.
+const SHIP_MARKDOWN_STRUCTURE = /^(?:[-*+]\s|\||>|#|\*\*)/;
+// shipMatchInBackticks(line, offset) → does the match offset fall inside an ODD backtick segment (i.e.
+// inside inline `code`)? A ship keyword inside backticks is being QUOTED (a command, a flag, output),
+// never asserted. Split-on-backtick parity: chars after an odd number of ` are inside code.
+function shipMatchInBackticks(line, offset) {
+  let ticks = 0;
+  for (let i = 0; i < offset && i < line.length; i++) if (line[i] === "`") ticks++;
+  return ticks % 2 === 1;
+}
+
 // detectShipClaim(text) → { claim:bool, kind, text:<the claim line, <=120c> }. Scans lines; returns the
 // first ASSERTIVE ship-status line. `kind` is the canonical claim keyword reconstructShipTargetV1 consumes.
 export function detectShipClaim(text) {
@@ -1023,8 +1038,10 @@ export function detectShipClaim(text) {
     if (!l) continue;
     if (/\?\s*$/.test(l)) continue; // a question is not a claim
     if (SHIP_FUTURE_OR_QUESTION.test(l)) continue; // intention, not "it's done"
+    if (SHIP_MARKDOWN_STRUCTURE.test(l)) continue; // markdown structure, not a declarative sentence
     for (const [kind, re] of SHIP_CLAIM_PATTERNS) {
-      if (re.test(l)) {
+      const m = re.exec(l);
+      if (m && !shipMatchInBackticks(l, m.index)) {
         return { claim: true, kind, text: l.replace(/\s+/g, " ").trim().slice(0, 120) };
       }
     }
@@ -1289,9 +1306,10 @@ function maybeSurfaceReveal(row) {
   }
 }
 
-// SHIP-STATUS v1 confirm-gate: the wait between a URL FAIL_CANDIDATE (404/410/NXDOMAIN/refused) and its
-// ONE confirming re-probe. Default ~60s; overridable via env (SKALPEL_SHIP_CONFIRM_MS, 0 for tests). The
-// wait happens ONLY inside the DETACHED, unref'd `--run` worker — never on the per-turn hook deadline.
+// SHIP-STATUS v1 confirm-gate: the wait between ANY first-probe negative (a URL FAIL_CANDIDATE — 404/
+// 410/NXDOMAIN/refused — or a hard registry/tag/pr/git/checks FAIL) and its ONE confirming re-probe.
+// Default ~60s; overridable via env (SKALPEL_SHIP_CONFIRM_MS, 0 for tests). The wait happens ONLY inside
+// the DETACHED, unref'd `--run` worker — never on the per-turn hook deadline.
 const SHIP_CONFIRM_DELAY_MS = (() => {
   const v = parseInt(process.env.SKALPEL_SHIP_CONFIRM_MS ?? "", 10);
   return Number.isFinite(v) && v >= 0 ? v : 60_000;
@@ -1305,7 +1323,7 @@ function shipSleep(ms) {
 
 // resolveShipStatus({kind, contextText, payload, target?, exec?, ...}) — the TESTABLE core of the ship
 // catch: reconstruct the strict single-family target (or accept a prebuilt one), run its ONE read-only
-// probe, and (only for a URL FAIL_CANDIDATE) confirm-gate before ever calling it a red. Returns a plain
+// probe, and (for EVERY first-probe negative, any kind) confirm-gate before ever calling it a red. Returns a plain
 // result object — no I/O, no lock, no reveal. `exec` (the read-only command runner) and `sleep` are
 // injectable purely so the eval harness can drive every branch hermetically. Never throws to the caller.
 //   outcome ∈ { NO_TARGET, SHIP_OK, SHIP_FAIL, SHIP_UNKNOWN };  mismatch === (outcome === "SHIP_FAIL").
@@ -1338,10 +1356,16 @@ export async function resolveShipStatus({
   let evidence = first.evidence;
   let confirm_reprobe = false;
   let confirm_outcome = null;
-  // Defect 3 CONFIRM-GATE: a URL fail candidate (a 404/410/gone or a NXDOMAIN/refused, which can be pure
-  // CDN/propagation lag) NEVER reveals immediately — wait ~60s and re-probe ONCE; only a CONFIRMED
-  // double-negative (2/2 fail candidate) fires. A PASS on the re-probe means it was transient → SHIP_OK.
-  if (verdict === "FAIL_CANDIDATE" && tgt.kind === "url") {
+  // CONFIRM-GATE for ALL ship reds (Defect 3, widened after the 2026-07-13 false accusation): NO
+  // first-probe negative EVER reds immediately — not a URL FAIL_CANDIDATE (404/410/NXDOMAIN/refused:
+  // pure CDN/propagation lag) and not a hard registry/tag/pr/git/checks "FAIL" (replication lag, an
+  // eventually-consistent registry read, a stale gh view). Every negative waits (SHIP_CONFIRM_DELAY_MS,
+  // or the injected confirmDelayMs) and re-probes ONCE; only a CONFIRMED 2/2 negative becomes a red.
+  // A PASS on the confirm means it was transient → SHIP_OK; an UNKNOWN on the confirm → SHIP_UNKNOWN
+  // (never a red we can't stand behind). runShipProbeV1's verdict vocabulary is exactly
+  // PASS | FAIL | FAIL_CANDIDATE | UNKNOWN — both negative forms gate identically here.
+  const shipNegative = (v) => v === "FAIL" || v === "FAIL_CANDIDATE";
+  if (shipNegative(verdict)) {
     if (typeof beforeReprobe === "function") {
       try {
         beforeReprobe();
@@ -1355,11 +1379,11 @@ export async function resolveShipStatus({
     confirm_reprobe = true;
     confirm_outcome = second.verdict;
     evidence = second.evidence || evidence;
-    verdict =
-      second.verdict === "FAIL_CANDIDATE" ? "FAIL" : second.verdict === "PASS" ? "PASS" : "UNKNOWN";
-  } else if (verdict === "FAIL_CANDIDATE") {
-    // A non-URL probe should never yield a lone candidate; treat as UNKNOWN so it can never single-red.
-    verdict = "UNKNOWN";
+    verdict = shipNegative(second.verdict)
+      ? "FAIL"
+      : second.verdict === "PASS"
+        ? "PASS"
+        : "UNKNOWN";
   }
   const outcome =
     verdict === "PASS" ? "SHIP_OK" : verdict === "FAIL" ? "SHIP_FAIL" : "SHIP_UNKNOWN";
@@ -1447,7 +1471,7 @@ async function maybeShipStatusCatch({ text, session, cwd, transcriptPath }) {
       pass_fail,
       outcome,
       mismatch: outcome === "SHIP_FAIL", // claimed shipped, the read-only probe DECISIVELY says it is NOT
-      // The instrument records the confirm re-probe (URL fail-candidate) and its second-probe verdict.
+      // The instrument records the confirm re-probe (any first-probe negative) and its second verdict.
       confirm_reprobe: resolved.confirm_reprobe,
       confirm_outcome: resolved.confirm_outcome,
       evidence: String(resolved.evidence || "").slice(0, 200),