skalpel 4.0.6 → 4.0.8

package/README.md

@@ -4,13 +4,18 @@ Behavioral graph for AI-assisted coding. Learns how you work from your Claude Co
 steers the model in real time — off the loops, re-explains, and re-fixes that eat your day.
 
 ```bash
-npm install -g skalpel
-skalpel            # sign in with Google → build your graph → see your insights → you're live
+npx skalpel@latest   # sign in with Google → build your graph → see your insights → you're live
 ```
 
+That's it — no global install. `npx` fetches the latest and runs the one-time setup (which copies
+the hooks into `~/.skalpel` so they persist afterward). It sidesteps every machine-specific install
+failure: no global-bin `PATH` to configure, no `sudo`, and it's always the newest version — so a
+stale copy can never leave you on old code. Prefer a permanent install? `npm install -g skalpel`
+still works and behaves identically.
+
 ## What it does
 
-- **`skalpel`** (or the postinstall nudge) runs the onboarding: red-banner wordmark → **Sign in with
+- **`npx skalpel@latest`** (or `skalpel` after a global install) runs the onboarding: red-banner wordmark → **Sign in with
   Google** (AWS-hosted, no localhost) → **builds your graph** (async, live progress) → **reveals your
   insights** (your hours, rework %, signature trap, biggest time-sink) → wires the hooks → you're live.
 - After that, every prompt in Claude Code / Codex pulls your own behavioral graph via a fast hook, and a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.6",
+  "version": "4.0.8",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-setup.mjs

@@ -424,6 +424,26 @@ async function reportLiveAndLaunch(message) {
 // arbitrary "cap to 100" that could upload fragments and MISS the real sessions.
 const MIN_USER_TURNS = Math.max(1, Number.parseInt(process.env.SKALPEL_MIN_USER_TURNS || "5", 10));
 
+// USER QUERIES ONLY. Claude Code logs every tool RESULT back as a role:"user" message
+// (content = [{type:"tool_result"}]). Counting those as "user turns" is the bug that classified
+// internal tool traffic as real intents and inflated "found N" so the client promised sessions the
+// server then dropped (empty graphs for quiet/agentic users). This mirrors the server's
+// engine._user_turn_count EXACTLY so the client's count == what the server ingests. One definition,
+// two implementations kept in lockstep — see docs/SESSION-COUNTING.md.
+const _HUMAN_PROMPT_SOURCES = new Set(["typed", "queued", "suggestion_accepted"]);
+function isGenuineUserTurn(e) {
+  if (!(e?.type === "user" || e?.role === "user")) return false;
+  const ps = e?.promptSource;
+  if (ps != null) return _HUMAN_PROMPT_SOURCES.has(ps); // newer CLI: trust the source label
+  // older/current builds omit promptSource — a row is a tool RESULT (not a query) when its content
+  // is a block list carrying a tool_result. Everything else that's role:user is a genuine query.
+  const c = e?.message?.content;
+  if (Array.isArray(c) && c.some((b) => b && typeof b === "object" && b.type === "tool_result")) {
+    return false;
+  }
+  return true;
+}
+
 export async function userTurnCount(path, cap = 5) {
   let n = 0;
   const input = createReadStream(path, { encoding: "utf8" });
@@ -437,7 +457,7 @@ export async function userTurnCount(path, cap = 5) {
       } catch {
         continue;
       }
-      if (e?.type === "user" || e?.role === "user") {
+      if (isGenuineUserTurn(e)) {
         n++;
         if (n >= cap) {
           rl.close();
@@ -727,6 +747,48 @@ async function revealInsights(report) {
   );
 }
 
+// Self-heal preflight. The install failures friends hit were never our code — they were the MACHINE:
+// a ~/.skalpel left root-owned by a past `sudo npm i -g` (so we can't stage hooks into it), or a Node
+// too old for the hook runtime. Catch both HERE with a one-line fix instead of a cryptic EACCES stack
+// trace five calls deep. Runs only on the setup path (login/logout/uninstall return before this).
+function preflight() {
+  const major = Number.parseInt(process.versions.node.split(".")[0], 10);
+  if (major < 18) {
+    console.error(
+      `   ${R}✗${X} skalpel needs Node 18+ — you have ${process.versions.node}. Update Node, then re-run.`,
+    );
+    process.exit(1);
+  }
+  const dir = join(homedir(), ".skalpel");
+  try {
+    mkdirSync(dir, { recursive: true });
+    accessSync(dir, constants.W_OK);
+    return; // writable — good to go
+  } catch {
+    /* not writable — try to self-heal, then re-check below */
+  }
+  // If we're root via `sudo` (SUDO_UID set), hand ownership back to the real user so the later
+  // non-root hook writes don't EACCES. On Windows there's no uid model — getuid is undefined, skip.
+  if (typeof process.getuid === "function" && process.getuid() === 0 && process.env.SUDO_UID) {
+    spawnSync(
+      "chown",
+      ["-R", `${process.env.SUDO_UID}:${process.env.SUDO_GID || process.env.SUDO_UID}`, dir],
+      { stdio: "ignore" },
+    );
+  }
+  try {
+    accessSync(dir, constants.W_OK);
+  } catch {
+    const who = process.env.USER || process.env.LOGNAME || "$(whoami)";
+    console.error(
+      `   ${R}✗${X} ~/.skalpel isn't writable — a past \`sudo\` install left it root-owned.\n` +
+        `     One line fixes it, then re-run:\n\n` +
+        `       ${B}sudo chown -R ${who} ~/.skalpel${X}\n`,
+    );
+    process.exit(1);
+  }
+}
+
 async function main() {
   if (sub === "uninstall") {
     spawnSync("node", [join(__dir, "install.mjs"), "--uninstall"], { stdio: "inherit" });
@@ -766,6 +828,7 @@ async function main() {
     mkdirSync(cfgDir, { recursive: true });
     writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));
   }
+  preflight(); // fail fast + fixable if the machine can't take the install (root-owned dir / old Node)
   banner();
 
   // 1) SIGN IN with Google (once). SKALPEL_USER (dev) or an existing ~/.skalpel/auth.json skips it.