skalpel 4.0.58 → 4.0.59

package/install.mjs

@@ -587,32 +587,27 @@ function cleanupLocalData() {
     return cleaned;
   }
 
-  // Plain uninstall: remove staged hooks + the raw transcript snapshots + all local state/logs, but
-  // KEEP the saved auth (that's what `--purge` is for). List every file skalpel writes under ~/.skalpel
-  // so nothing is silently left behind; auth.json (legacy local location) is deliberately preserved.
-  rm(join(SKALPEL_DIR, "hooks"), "staged hooks");
-  rm(join(SKALPEL_DIR, "ingest-outbox"), "raw transcript snapshots (ingest-outbox)");
-  for (const f of [
-    "stats.json", // legacy "time saved" accumulator — nothing writes it now, but old installs left one
-    "session.json",
-    "steer.json",
-    "traj.json",
-    "pending.json",
-    "prefs.json",
-    "insights.ndjson",
-    "insights-ready.json",
-    "metrics.ndjson",
-    "bootstrap.json",
-    "bootstrap.lock",
-    "client.json",
-    "doctor.log",
-    "hook.log",
-    "verify-shadow.log",
-    "verify-last.json",
-    "verify-shadow.lock",
-    "verify-reveal.json",
-  ]) {
-    rm(join(SKALPEL_DIR, f), f);
+  // Plain uninstall: remove EVERYTHING under ~/.skalpel — staged hooks, transcript snapshots, all
+  // state/logs — but KEEP the saved auth (that's what `--purge` is for). This is a SWEEP, not a
+  // hand-maintained filename list: the old list silently drifted from what the runtime actually
+  // writes (steers.ndjson, verify-verdict.json, verify-ship-last.json, auth-notice.json,
+  // build-stalled.json, first-run.json, verify-reveal-notified.json all survived it), breaking the
+  // "nothing silently left behind" promise. Everything under ~/.skalpel is ours; only auth.json
+  // (legacy local session location) is deliberately preserved. rm()'s PKG_DIR guard still protects
+  // a self-hosted layout from deleting the running installer.
+  const LABELS = {
+    hooks: "staged hooks",
+    "ingest-outbox": "raw transcript snapshots (ingest-outbox)",
+  };
+  let entries = [];
+  try {
+    entries = existsSync(SKALPEL_DIR) ? readdirSync(SKALPEL_DIR).sort() : [];
+  } catch {
+    /* unreadable dir — best-effort; an uninstall never fails on it */
+  }
+  for (const name of entries) {
+    if (name === "auth.json") continue; // kept — `--purge` is the deliberate "forget me entirely"
+    rm(join(SKALPEL_DIR, name), LABELS[name] || name);
   }
   if (cleaned.length)
     cleaned.push("(auth kept — run `skalpel uninstall --purge` to remove it too)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.58",
+  "version": "4.0.59",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-setup.mjs

@@ -16,7 +16,7 @@ import {
   constants,
 } from "node:fs";
 import { homedir } from "node:os";
-import { join, dirname, delimiter, sep as pathSep } from "node:path";
+import { basename, join, dirname, delimiter, sep as pathSep } from "node:path";
 import { createInterface, emitKeypressEvents } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
@@ -591,7 +591,7 @@ export async function scanHistory(days = LOOKBACK_DAYS) {
   const files = walk(join(homedir(), ".claude", "projects"))
     .concat(walk(join(homedir(), ".codex", "sessions")))
     .filter((f) => {
-      if (f.split("/").pop().startsWith("agent-")) return false; // sub-agent transcripts, not the user
+      if (basename(f).startsWith("agent-")) return false; // sub-agent transcripts, not the user
       try {
         return statSync(f).mtimeMs >= cutoff;
       } catch {
@@ -611,6 +611,19 @@ export async function scanHistory(days = LOOKBACK_DAYS) {
   return out;
 }
 
+// Whether the 401 self-heal below may spawn the INTERACTIVE sign-in. login.mjs opens a Google
+// OAuth browser tab and blocks (~180s) on the callback — acceptable only on a real terminal where
+// the user can see why a tab just popped. The detached background build (`__build`, stdio:"ignore")
+// has neither TTY: spawning login from there pops a zero-context browser tab and stalls the build,
+// so it must instead let the 401 fall through to the ingest error, which backgroundBuild's
+// build-stalled.json marker surfaces next session. Pure decision helper, exported for tests.
+export function shouldSelfHealLogin(
+  stdoutIsTTY = process.stdout.isTTY,
+  stdinIsTTY = process.stdin.isTTY,
+) {
+  return Boolean(stdoutIsTTY && stdinIsTTY);
+}
+
 // HOSTED model: the client is thin — it just UPLOADS the raw transcripts; the SERVER filters
 // (real-session detection) + judges (Gemini) + builds the Amplitude dash + aggregate DAG into the
 // hosted store under the user's uid. No Python, no engine, no graph-building on the user's machine.
@@ -669,7 +682,7 @@ async function buildGraph(sp, files, id) {
       curBytes = 0;
     }
     try {
-      cur[f.split("/").pop()] = readFileSync(f, "utf8");
+      cur[basename(f)] = readFileSync(f, "utf8");
       curBytes += size;
     } catch {
       /* skip unreadable */
@@ -695,8 +708,9 @@ async function buildGraph(sp, files, id) {
     const label = batches.length > 1 ? ` (batch ${bi + 1}/${batches.length})` : "";
     sp.text(`Building your graph…${label}`);
     let r = await postBatch(batches[bi], token);
-    // SELF-HEAL on 401: refresh the Google session once, then retry this batch.
-    if (r.status === 401 && !process.env.SKALPEL_USER) {
+    // SELF-HEAL on 401: refresh the Google session once, then retry this batch. INTERACTIVE ONLY
+    // (shouldSelfHealLogin): in the detached/non-TTY case the 401 falls through to the throw below.
+    if (r.status === 401 && !process.env.SKALPEL_USER && shouldSelfHealLogin()) {
       sp.text("Session expired — re-opening sign-in…");
       spawnSync("node", [join(__dir, "login.mjs")], { stdio: "inherit" });
       const fresh = await identity();