scar-cli 0.23.0__tar.gz → 0.24.0__tar.gz

scar_cli-0.24.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.24.0"
+}

{scar_cli-0.23.0 → scar_cli-0.24.0}/.scars/0005-history-rewrite-orphans-commit-evidence.landmine.md

@@ -8,8 +8,13 @@ created: 2026-06-11
 authors: ["claude-code", "Kibukx"]
 anchors:
   - path: .scars/
+  - command: "git push.*--force"
+  - command: "git rebase"
+  - command: "git filter-repo|git filter-branch"
+  - command: "git commit.*--amend"
 violation: "commit: [0-9a-f]{7,40}"
 evidence:
+  - note: "2026-09-05 anchors: path .scars/ KEPT on purpose. The violation tripwire commit: [0-9a-f]{7,40} only evaluates on files an anchor matched, so dropping it to cut firings would silently disarm the scar. Command anchors added instead, so the history-rewrite half fires on the act rather than on any scar edit"
   - note: v0.1.0 public release (2026-06-11): fresh-start force-push orphaned 3 commit SHAs cited by scars 0001 and 0002; SHAs still resolve on GitHub by URL but fail in any fresh clone, and GitHub may GC them eventually
 expires:
   condition: "evidence schema gains a resolvable form (full URL or archived diff) or lint warns on bare SHAs at promotion"

{scar_cli-0.23.0 → scar_cli-0.24.0}/.scars/0006-yaml-pattern-anchor-over-escaping.landmine.md

@@ -9,8 +9,9 @@ authors: ["claude-code", "kibukx"]
 anchors:
   - path: src/scar/orphan.py
   - path: src/scar/match.py
-  - path: .scars/
+  - pattern: "\n\s*-\s*pattern:"
 evidence:
+  - note: "2026-09-05 anchors: path .scars/ replaced by a pattern matching a scar frontmatter pattern: entry. The directory anchor fired on every scar edit, while the hazard only exists when a pattern anchor is being authored"
   - pr: 40
   - note: scar 1 grep pattern matched only its own body, never experiments/anchor-survival/RESULTS.md
 expires:

{scar_cli-0.23.0 → scar_cli-0.24.0}/.scars/0008-rich-output-nontty-must-bypass-rich.landmine.md

@@ -7,10 +7,10 @@ confidence: 0.9
 created: 2026-06-30
 authors: ["claude-code", "kibukx"]
 anchors:
-  - path: src/scar/cli.py
   - path: src/scar/output.py
-  - pattern: "output\.render\("
+  - pattern: "def plain\(\):"
 evidence:
+  - note: "2026-09-05 anchors: path src/scar/cli.py dropped, it is 3000+ lines and the tty gate is 17 of them. The 18 output.render( call sites only invoke the already-safe dispatcher, so that pattern is replaced by def plain():, which marks the 14 non-tty contract closures this scar actually protects"
   - issue: 78
   - note: 187-test suite asserts plain substrings like '0001-bad.deadend.md' and long anchor paths on main([...]) under capsys
 expires:

{scar_cli-0.23.0 → scar_cli-0.24.0}/.scars/0011-lint-compile-check-lets-redos-anchors-hang-hotpath.landmine.md

@@ -7,11 +7,11 @@ confidence: 0.9
 created: 2026-06-30
 authors: ["claude-code", "Kibukx"]
 anchors:
-  - path: src/scar/lint.py
-  - path: src/scar/match.py
   - pattern: "rx\.search\("
   - pattern: "MAX_ANCHOR_SCAN"
+  - pattern: "_is_redos_prone"
 evidence:
+  - note: "2026-09-05 anchors: both whole-file path anchors dropped, lint.py and match.py serve many concerns beyond ReDoS. _is_redos_prone added so the GATE itself stays anchored, since the body says the gate is the defense and the 64 KiB cap is not"
   - issue: 88
 expires:
   condition: "lint gains full regex-safety analysis OR the matcher runs on a hardened regex engine with a hard timeout"

scar_cli-0.24.0/.scars/candidates/host-detection-must-not-read-the-process-home.md

@@ -0,0 +1,40 @@
+---
+id: 0
+type: deadend
+title: Host detection must take home from installer.CLAUDE_DIR, never Path.home() — a bare call passes locally and fails every other machine
+severity: high
+confidence: 0.9
+created: 2026-09-07
+authors: ["claude-code"]
+anchors:
+  - pattern: "detect_hosts\("
+  - symbol: src/scar/cli.py::_detect
+evidence:
+  - issue: 318
+  - note: "2026-09-07, during the multi-host skill install work: the skill-install refusal resolved home with Path.home(). Under HOME=empty the suite went 1031 passed / 2 FAILED, both PRE-EXISTING tests, printing 'claude not detected on this machine, nothing written'. Fixed by reusing _detect(). Branch SHAs deliberately omitted: scar #5 fired on the amend that wrote this, and squash-merge would orphan them."
+expires:
+  condition: "detect_hosts takes home from one injected seam no caller can bypass"
+  review_after: 2027-03-08
+status: candidate
+---
+
+`Path.home()` in a detection path looks obviously right and is a trap. Tests
+patch `installer.CLAUDE_DIR`, not the environment, and `_detect()` derives
+home from `installer.CLAUDE_DIR.parent`. A bare call reads the author's real
+home, finds their real `~/.claude`, and passes. On any machine without one,
+every CI runner included, detection returns nothing and the caller refuses.
+
+The failure is invisible where it is introduced: the suite was fully green on
+the authoring machine, and the tests that finally failed were pre-existing
+ones nobody had touched. Use `_detect(kind)`, or `installer.CLAUDE_DIR.parent`
+exactly as `_detect` does. Never add a second answer to where home is.
+
+Two anchors on purpose. `cli.py` is 143 KiB and its first `detect_hosts(` sits
+at byte ~123,000, past the 64 KiB `MAX_ANCHOR_SCAN` bound, so the pattern is
+blind to the very file the defect landed in. The `symbol:` anchor covers it,
+at the cost of needing `scar-cli[symbols]`. Lint reports neither gap: the
+pattern matches `hosts.py`, so the scar reads live while blind where it counts.
+
+Not armed. The obvious tripwire is `Path\.home\(\)`, but `cli.py` carries that
+string in a warning comment and `installer.py` uses it correctly for module
+constants, so it would fire on prose and on correct code.

scar_cli-0.24.0/.scars/candidates/path-anchor-breadth-drives-the-review-due-threshold.md

@@ -0,0 +1,37 @@
+---
+id: 0
+type: landmine
+title: A whole-file or whole-directory path anchor makes the review-due threshold report anchor breadth, not code hazard
+severity: medium
+confidence: 0.8
+created: 2026-09-04
+authors: ["claude-code"]
+anchors:
+  - path: SCAR-FORMAT.md
+  - pattern: "review_after_firings"
+evidence:
+  - issue: 312
+  - note: "triage of all five over-threshold scars in this repo on 2026-09-04: four were over-anchored, one was a real code fix"
+expires:
+  condition: "lint reports what share of a scar's firings touched the hazard, so the review-due warning can distinguish breadth from recurrence"
+  review_after: 2027-03-04
+status: candidate
+---
+
+`scar lint` warns past `review_after_firings` that either the guarded code
+merits the fix or the scar merits revision. Read literally that sends you to
+the code first. It is usually the anchor.
+
+A `path:` anchor is a repo-relative PREFIX, so it fires on every edit beneath
+it. Scar #8 guards a 17-line tty branch inside a 52-line module but anchored
+the whole 3,090-line `src/scar/cli.py`; roughly nine of every ten of its 47
+firings touched nothing related. Scar #5 guards against history rewrites and
+anchored all of `.scars/`, so it fired on 22 routine promotions and zero
+force-pushes, which is zero of its actual trigger events.
+
+A firing count therefore measures anchor breadth first and hazard recurrence
+second, and the two are not separable from the log. Before reading a
+review-due warning as evidence that code needs fixing, check what share of the
+firings touched the hazard at all. Then narrow the anchor to the smallest file
+holding the branching, or switch to a `command:` anchor when the trigger is an
+action rather than a file (#312 is the one case here that really was the code).

{scar_cli-0.23.0 → scar_cli-0.24.0}/AGENTS.md

@@ -26,8 +26,11 @@ The full authoring contract — qualification criteria, the candidates-only writ
 path, mandatory YAML frontmatter, and the regex over-escaping trap — is packaged
 as the `scar-authoring` skill.
 
-- **Claude Code:** install the plugin (recommended) or `scar skill install` to
-  drop the skill into `~/.claude/skills/`. It auto-loads on trigger.
+- **Claude Code, Codex, Cursor, opencode, Windsurf:** `scar skill install`
+  detects which of those hosts are on the machine and writes the skill to each
+  one's native skills directory. On Claude Code the plugin is the recommended
+  route and carries the same skill. The per-host destination table is in
+  [website/docs/agents.md](website/docs/agents.md).
 - **MCP agents (Cursor/Windsurf/opencode):** the `scar_draft` tool enforces the
   candidates-only path and lints before writing; its description carries the
   digest.

{scar_cli-0.23.0 → scar_cli-0.24.0}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.24.0](https://github.com/Daily-Nerd/Scar/compare/v0.23.0...v0.24.0) (2026-09-08)
+
+
+### Features
+
+* **firing-log:** one shared validated reader for the firing log ([#313](https://github.com/Daily-Nerd/Scar/issues/313)) ([d316922](https://github.com/Daily-Nerd/Scar/commit/d31692205715e63380b8ac104643de4ceac0338d))
+* **skill:** install the authoring skill to every detected host ([#320](https://github.com/Daily-Nerd/Scar/issues/320)) ([1d9c985](https://github.com/Daily-Nerd/Scar/commit/1d9c985e3e5815ba67d222defa86d549886c7e94))
+
+
+### Bug Fixes
+
+* **promote:** record whether a promotion happened at a terminal ([#315](https://github.com/Daily-Nerd/Scar/issues/315)) ([f28e8eb](https://github.com/Daily-Nerd/Scar/commit/f28e8eb90a5fb3161aa40565dbfb218d1b9b4160)), closes [#308](https://github.com/Daily-Nerd/Scar/issues/308)
+
 ## [0.23.0](https://github.com/Daily-Nerd/Scar/compare/v0.22.0...v0.23.0) (2026-09-03)
 
 

{scar_cli-0.23.0 → scar_cli-0.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scar-cli
-Version: 0.23.0
+Version: 0.24.0
 Summary: SCAR — version control for negative knowledge (deadends, fences, landmines)
 License: MIT
 License-File: LICENSE
@@ -80,6 +80,8 @@ scar skill install               # same detection for the scar-authoring skill
 scar hook status                 # every host with the channel that serves it (settings, plugin, none)
 ```
 
+`scar skill install` writes the scar-authoring skill to a native path for Claude Code, Codex, Cursor, opencode, or Windsurf. Claude Code is the one confirmed to load it, and the rest are written per vendor documentation but unverified: see the [per-host table](https://daily-nerd.github.io/Scar/agents#where-scar-skill-install-writes) for which is which.
+
 Claude Code users: the marketplace **plugin** ships the hooks and the scar-authoring skill together. `scar hook install` and `scar skill install` see the plugin and skip Claude unless you pass `--runtime claude --force`. Re-run `scar skill install` after upgrading a manual install; the installed skill is a static copy.
 
 Codex users: run `scar hook install --runtime codex`, then open `/hooks` in Codex to review and trust the entries. The hooks push matching scars before `Bash` and `apply_patch` calls and report post-patch `violation:` tripwires without blocking. The plugin no longer carries Codex hook definitions; the installer is the one path.

{scar_cli-0.23.0 → scar_cli-0.24.0}/README.md

@@ -65,6 +65,8 @@ scar skill install               # same detection for the scar-authoring skill
 scar hook status                 # every host with the channel that serves it (settings, plugin, none)
 ```
 
+`scar skill install` writes the scar-authoring skill to a native path for Claude Code, Codex, Cursor, opencode, or Windsurf. Claude Code is the one confirmed to load it, and the rest are written per vendor documentation but unverified: see the [per-host table](https://daily-nerd.github.io/Scar/agents#where-scar-skill-install-writes) for which is which.
+
 Claude Code users: the marketplace **plugin** ships the hooks and the scar-authoring skill together. `scar hook install` and `scar skill install` see the plugin and skip Claude unless you pass `--runtime claude --force`. Re-run `scar skill install` after upgrading a manual install; the installed skill is a static copy.
 
 Codex users: run `scar hook install --runtime codex`, then open `/hooks` in Codex to review and trust the entries. The hooks push matching scars before `Bash` and `apply_patch` calls and report post-patch `violation:` tripwires without blocking. The plugin no longer carries Codex hook definitions; the installer is the one path.

{scar_cli-0.23.0 → scar_cli-0.24.0}/SCAR-FORMAT.md

@@ -43,7 +43,7 @@ is deliberate: consumers in hook hot-paths parse with zero dependencies.
 | `created` | yes | ISO date | |
 | `authors` | yes | inline list | who drafted it: agents as `"claude-code"` etc. The reviewer is no longer appended here |
 | `promoted_by` | active scars | string | the human who promoted it. Written only by `scar promote`, which overwrites anything a candidate carried. Empty on scars promoted before the field existed, and never inferred from `authors` |
-| `promoted_by_source` | optional | `explicit` \| `git-config` | whether `promoted_by` came from `--reviewer` or from `git config user.name`. Written only alongside `promoted_by`, never on its own. Absent on scars promoted before the field existed |
+| `promoted_by_source` | optional | `explicit` \| `git-config-interactive` \| `git-config` | how strongly `promoted_by` is evidenced. `explicit` = a name was typed with `--reviewer`. `git-config-interactive` = no name typed, but `promote` ran at a terminal, so a person was there. `git-config` = no name typed and no terminal recorded, which is the unattended shape `lint` warns on. Written only alongside `promoted_by`, never on its own. Absent on scars promoted before the field existed, and plain `git-config` on scars promoted before interactivity was recorded, so neither absence proves an agent did it |
 | `anchors` | yes, ≥1 | list of `- path:`, `- pattern:`, `- symbol:`, and/or `- command:` | §4 |
 | `evidence` | recommended | list of `- commit:`/`- pr:`/`- issue:`/`- incident:`/`- note:`/`- url:` | absent ⇒ challengeable on sight; `issue:`/`url:` are durable forms that survive squash-merge |
 | `expires.condition` | recommended | quoted string | what change obsoletes this scar |

{scar_cli-0.23.0 → scar_cli-0.24.0}/SPEC.md

@@ -468,3 +468,5 @@ ones that reach `main` wrong.
 ### 9.10 Install detection
 
 `scar hook install` and `scar skill install` without `--runtime` detect hosts (claude, codex, windsurf, cursor, opencode) by config directory or binary on PATH, and resolve for each the channel that already serves it: `settings` (Scar's own entries in the host's hook file), `plugin` (the scar marketplace plugin installed and not disabled), or `none`. windsurf is repo-scoped: its hooks file is written into the working repo, so the binary on PATH counts only when that repo is inside a git repository. On a terminal, one question per present, wirable, unserved host, default no. Without a terminal, exactly one such host is installed; zero or several means the commands are printed and nothing is written. Zero detected hosts says so, rather than naming the plugin. `--all` wires every such host. `--runtime claude` on a Claude Code already served by the plugin refuses unless `--force`. `--all` and `--force` apply to `install` only, and `--force` applies to `--runtime claude` only. A missing or unreadable plugin registry never counts as `plugin`.
+
+Two rules differ for the skill kind. windsurf is not repo-scoped there: its global skills live under home (`~/.codeium/windsurf/skills`), so the binary on PATH counts on its own, with no git-repo guard. And `scar skill install --runtime <host>` refuses, exit 1, when detection does not find that host on the machine, rather than creating a skill directory nothing reads. Every destination resolves through the same home the detection pass used, and the Codex destination honours `$CODEX_HOME`, so a reported success always names a directory the detected host actually reads.

{scar_cli-0.23.0 → scar_cli-0.24.0}/plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "scar",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "SCAR — version control for negative knowledge (deadends, fences, landmines)",
   "hooks": {
     "PreToolUse": [

{scar_cli-0.23.0 → scar_cli-0.24.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "scar-cli"
-version = "0.23.0"
+version = "0.24.0"
 description = "SCAR — version control for negative knowledge (deadends, fences, landmines)"
 readme = "README.md"
 requires-python = ">=3.10"

{scar_cli-0.23.0 → scar_cli-0.24.0}/src/scar/cli.py

@@ -19,6 +19,7 @@ from typing import Callable
 
 from rich_argparse import RichHelpFormatter
 
+from .firing_log import read_firing_log_records
 from .lint import _is_redos_prone, lint_text
 from .match import (
     find_violations_for_diff,
@@ -749,6 +750,16 @@ def _cmd_status(args) -> int:
     return 0
 
 
+def _stdin_is_a_terminal() -> bool:
+    """True when a person is driving this invocation. Never raises: a closed
+    or replaced stdin has no isatty, and promote must not die over a question
+    it can safely answer "no" to."""
+    try:
+        return sys.stdin.isatty()
+    except Exception:
+        return False
+
+
 def _cmd_promote(args) -> int:
     store = _require_store()
     if store is None:
@@ -766,9 +777,17 @@ def _cmd_promote(args) -> int:
     if not reviewer:
         reviewer = _git(store.root, "config", "user.name").stdout.strip()
         from_git = bool(reviewer)
-    # #295: the same distinction from_git already carries, in the vocabulary
-    # promoted_by_source is written with.
-    reviewer_source = "git-config" if from_git else ("explicit" if reviewer else None)
+    # #295 gave promoted_by_source two values; #308 splits the git-config one,
+    # because "the name came from git config" answered the wrong question. The
+    # question lint actually asks is whether a PERSON vouched, and a human
+    # running promote at a terminal is a person whether or not they retyped
+    # their own name. stdin only, deliberately: `scar promote x > log` is still
+    # a human at a keyboard, so a redirected stdout must not read as unattended.
+    if reviewer and from_git:
+        reviewer_source = ("git-config-interactive" if _stdin_is_a_terminal()
+                           else "git-config")
+    else:
+        reviewer_source = "explicit" if reviewer else None
     try:
         new_path = store.promote(matches[0], reviewer=reviewer,
                                   reviewer_source=reviewer_source)
@@ -1365,35 +1384,24 @@ def _dedup_key(rec: dict) -> tuple | None:
 
 
 def _read_firing_log(log_path: Path) -> list[dict]:
-    """Read the machine-global firing log, keeping only dict records. The log
-    is written best-effort from a fail-open hook, so ANY JSON shape can appear
-    on a line (landmine #12) — `null`, `[]`, numbers all parse fine and then
-    crash at rec.get(); skip everything that isn't a dict.
+    """Read the machine-global firing log, deduplicated for reporting.
+
+    Line-shape defence (landmine #12: blanket per-line guard, keep only dicts,
+    distrust slice math) lives in firing_log.read_firing_log_records, which
+    hooks calls too. Do not re-add a local copy here; two copies drifting is
+    what the landmine records.
 
     Rows describing the same tool call are collapsed (#250) — see _dedup_key.
     """
     records = []
     seen: set[tuple] = set()
-    if log_path.exists():
-        for line in log_path.read_text(encoding="utf-8").splitlines():
-            line = line.strip()
-            if not line:
-                continue
-            try:
-                # scar 0012 prescribes a BLANKET per-line guard, not a narrow
-                # except tuple: a reader that escapes into precheck's outer
-                # fail-open kills injection permanently.
-                rec = json.loads(line)
-            except Exception:
+    for rec in read_firing_log_records(log_path):
+        key = _dedup_key(rec)
+        if key is not None:
+            if key in seen:
                 continue
-            if not isinstance(rec, dict):
-                continue
-            key = _dedup_key(rec)
-            if key is not None:
-                if key in seen:
-                    continue
-                seen.add(key)
-            records.append(rec)
+            seen.add(key)
+        records.append(rec)
     return records
 
 
@@ -2814,20 +2822,38 @@ def _cmd_skill_lifecycle(args) -> int:
     runtime = args.runtime
     if runtime is None and args.kind in ("install", "status"):
         def install_many(names: list[str], repo: Path, dry: bool) -> int:
-            del repo  # skill has exactly one wirable host: claude
-            return skill_install(dry=dry) if "claude" in names else 0
+            del repo  # every skill destination is home-scoped
+            # Worst exit code wins, same as _run_hook_installers. `|=` agrees
+            # with max only while every code is 0 or 1: 1|2 is 3, which is
+            # not a code this CLI ever returns.
+            rc = 0
+            for name in names:
+                rc = max(rc, skill_install(name, dry=dry))
+            return rc
         return _lifecycle_no_runtime("skill", args, install_many, skill_status)
-    # uninstall with no --runtime keeps targeting Claude, the only wirable
-    # host today: same rule as `hook`.
+    # uninstall with no --runtime keeps targeting Claude: removal is out of
+    # the detection spec's scope, same rule as `hook`.
     runtime = runtime or "claude"
     if (runtime == "claude" and args.kind == "install"
             and not getattr(args, "force", False)
             and hosts.claude_plugin_enabled(CLAUDE_DIR)):
         _plugin_refusal("the scar-authoring skill is", "~/.claude/skills")
         return 0
-    return {"install": lambda: skill_install(dry=dry),
-            "uninstall": lambda: skill_uninstall(dry=dry),
-            "status": skill_status}[args.kind]()
+    if args.kind == "install":
+        # Same detection seam _lifecycle_no_runtime uses via _detect("skill"):
+        # a second way to resolve "home" here (e.g. a bare Path.home() call)
+        # would ignore whatever a test or a caller has patched onto
+        # installer.CLAUDE_DIR, the one fact this branch is supposed to
+        # share with the rest of the CLI.
+        detected = {h.name for h in _detect("skill")[0] if h.present}
+        if runtime not in detected:
+            # Refusing beats creating the tree: a directory scar invents is
+            # one no host reads, and the failure would be silent.
+            print(f"{runtime} not detected on this machine, nothing written")
+            return 1
+    return {"install": lambda: skill_install(runtime, dry=dry),
+            "uninstall": lambda: skill_uninstall(runtime, dry=dry),
+            "status": lambda: skill_status(runtime)}[args.kind]()
 
 
 def _scar_version() -> str:
@@ -3021,19 +3047,20 @@ def build_parser() -> argparse.ArgumentParser:
          help="run the Windsurf/Cascade hook adapter (stdin JSON; installed by "
               "`scar hook install --runtime windsurf`, not run by hand)")
 
+    from . import installer
+
     p = _add(sub, "skill", _cmd_skill_lifecycle, help="install, remove, or inspect the scar-authoring skill")
     p.add_argument("kind", choices=["install", "uninstall", "status"])
     p.add_argument("--dry-run", action="store_true",
-                   help="show changes without writing to ~/.claude/skills")
-    # One invocation, one target: --runtime claude writes ~/.claude/skills,
-    # --all writes to every unserved host detection finds (only claude is
-    # wirable today), and no flag at all means detect and ask.
+                   help="show changes without writing to the host's skills directory")
+    # One invocation, one target: --runtime names any host in the destination
+    # registry (installer.SKILL_HOSTS), --all writes to every unserved host
+    # detection finds, and no flag at all means detect and ask.
     target = p.add_mutually_exclusive_group()
-    target.add_argument("--runtime", choices=["claude"], default=None,
+    target.add_argument("--runtime", choices=list(installer.SKILL_HOSTS), default=None,
                         help="with install/uninstall/status: which host to wire. "
                              "Omitted: detect installed hosts and ask (install), "
-                             "or show every host's channel (status); uninstall "
-                             "still targets claude")
+                             "or show every host's channel (status)")
     target.add_argument("--all", action="store_true",
                         help="with install: wire every detected, unserved host "
                              "without asking. A target like --runtime, so "

scar_cli-0.24.0/src/scar/firing_log.py

@@ -0,0 +1,71 @@
+"""The one reader for ``firing-log.jsonl``.
+
+The log is append-only JSONL written best-effort from a hook that must never
+fail or delay an edit, so any line shape can and does appear: ``null``, ``[]``,
+numbers, truncated JSON, non-string ``ts``. Landmine #12 records three separate
+bugs shipped from that fact in two days (PR #122, issue #124), and prescribes
+two rules that every reader has to follow identically:
+
+* guard every line with a BLANKET ``except Exception``, never a narrow tuple,
+  because a reader that escapes into precheck's outer fail-open kills injection
+  permanently and silently;
+* distrust slice math, because ``lines[-0:]`` is the whole list rather than
+  nothing.
+
+Both rules used to be re-implemented per reader. They live here instead. This
+module deliberately imports nothing from ``hooks`` or ``cli`` so either can
+call it: the caller supplies the path (``hooks.firing_log_path()`` still owns
+where the log lives, including the ``SCAR_STATE_DIR`` override).
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+__all__ = ["read_firing_log_records"]
+
+
+def read_firing_log_records(path: Path, *, tail: int | None = None) -> list[dict]:
+    """Every well-formed dict record in the firing log, oldest first.
+
+    Lines that are blank, unparseable, or parse to a non-dict are dropped.
+    ``tail`` keeps only the newest N LINES, applied before parsing, so a
+    malformed line still consumes one of the N slots exactly as it counts
+    toward ``gc.truncate_firing_log``'s total.
+
+    Never raises on log content or on an unreadable log: a missing file, a
+    directory in its place, and undecodable bytes all read as "no records".
+    That is required, not merely tidy, because one caller runs inside the
+    fail-open precheck path.
+
+    A negative ``tail`` IS refused, because it is a caller bug rather than a
+    data condition: ``lines[-(-1):]`` silently returns the OLDEST rows, the
+    opposite of what every caller wants.
+    """
+    if tail is not None and tail < 0:
+        raise ValueError(f"tail must be non-negative, got {tail}")
+
+    try:
+        text = path.read_text(encoding="utf-8")
+    except Exception:
+        return []
+
+    lines = text.splitlines()
+    if tail is not None:
+        # Not lines[-tail:] — at tail == 0 that is lines[-0:], the whole list.
+        lines = lines[-tail:] if tail > 0 else []
+
+    records: list[dict] = []
+    for line in lines:
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            rec = json.loads(line)
+        except Exception:
+            continue
+        if not isinstance(rec, dict):
+            continue
+        records.append(rec)
+    return records

{scar_cli-0.23.0 → scar_cli-0.24.0}/src/scar/hooks.py

@@ -17,6 +17,7 @@ import sys
 import time
 from pathlib import Path
 
+from .firing_log import read_firing_log_records
 from .match import (MatchCensus, armed_scar_ids, find_violations, has_content_signal,
                     rank_and_census_for_edit)
 from .render import injection_context
@@ -123,19 +124,16 @@ def _recently_fired(repo: str, target: str) -> set[int]:
     One-liner (demoted) showings don't count — a later content-signal match
     still deserves the full body. Best-effort: any failure returns empty set
     (module contract: never fail or delay the edit)."""
-    try:
-        # 200-line tail cap is LINE-COUNT-based, not time-based: on a busy log
-        # a recent full-body showing can scroll out past 200 lines before the
-        # cooldown window elapses, so the scar re-renders full body early.
-        # Under-collapsing fails safe (over-inform), so this is not fixed.
-        lines = firing_log_path().read_text(encoding="utf-8").splitlines()[-200:]
-    except Exception:
-        return set()
+    # 200-line tail cap is LINE-COUNT-based, not time-based: on a busy log
+    # a recent full-body showing can scroll out past 200 lines before the
+    # cooldown window elapses, so the scar re-renders full body early.
+    # Under-collapsing fails safe (over-inform), so this is not fixed.
+    # Line shape is the shared reader's problem (landmine #12); FIELD shape
+    # is still ours, so the per-record blanket guard below stays.
     cutoff = time.time() - COOLDOWN_SECONDS
     recent: set[int] = set()
-    for line in lines:
+    for rec in read_firing_log_records(firing_log_path(), tail=200):
         try:
-            rec = json.loads(line)
             if rec.get("repo") != repo or rec.get("target") != target:
                 continue
             ts = time.mktime(time.strptime(rec["ts"], "%Y-%m-%dT%H:%M:%S"))

{scar_cli-0.23.0 → scar_cli-0.24.0}/src/scar/hosts.py

@@ -26,14 +26,16 @@ class Host:
     hint: str | None = None
 
 
-# name, home-relative config dir (None = repo-scoped), binary on PATH,
-# wirable for hooks, wirable for the skill
+# name, hook config dir (None = repo-scoped), skill config dir, binary,
+# wirable for hooks, wirable for the skill. The two directory columns differ
+# for windsurf alone: its hooks are a committed repo file, its global skills
+# live under home.
 _SPECS = (
-    ("claude", ".claude", "claude", True, True),
-    ("codex", ".codex", "codex", True, False),
-    ("windsurf", None, "windsurf", True, False),
-    ("cursor", ".cursor", "cursor", False, False),
-    ("opencode", ".config/opencode", "opencode", False, False),
+    ("claude", ".claude", ".claude", "claude", True, True),
+    ("codex", ".codex", ".codex", "codex", True, True),
+    ("windsurf", None, ".codeium/windsurf", "windsurf", True, True),
+    ("cursor", ".cursor", ".cursor", "cursor", False, True),
+    ("opencode", ".config/opencode", ".config/opencode", "opencode", False, True),
 )
 
 
@@ -60,7 +62,8 @@ def detect_hosts(
 ) -> list[Host]:
     which_path = path_env if path_env is not None else os.environ.get("PATH", "")
     found: list[Host] = []
-    for name, rel, binary, hook_ok, skill_ok in _SPECS:
+    for name, hook_rel, skill_rel, binary, hook_ok, skill_ok in _SPECS:
+        rel = skill_rel if kind == "skill" else hook_rel
         signal = ""
         cfg = None
         if name == "codex" and codex_dir is not None:
@@ -69,13 +72,16 @@ def detect_hosts(
             cfg = home / rel
         elif repo is not None:
             cfg = repo / ".windsurf"
-        # windsurf is the one repo-scoped host: cascade_install writes
-        # <cwd>/.windsurf/hooks.json with no repo guard of its own, so the
-        # binary alone must not make it a candidate. Inside a git repo that
-        # path is a file the user can review and commit; outside one it is a
-        # stray directory in whatever folder the shell happened to be in.
+        # windsurf is the one repo-scoped host, and only for hooks:
+        # cascade_install writes <cwd>/.windsurf/hooks.json with no repo
+        # guard of its own, so the binary alone must not make it a
+        # candidate. Inside a git repo that path is a file the user can
+        # review and commit; outside one it is a stray directory in
+        # whatever folder the shell happened to be in. Its skills live at a
+        # home-scoped directory instead (~/.codeium/windsurf), so this guard
+        # does not apply to kind="skill".
         on_path = bool(shutil.which(binary, path=which_path))
-        if name == "windsurf" and on_path:
+        if name == "windsurf" and on_path and kind != "skill":
             on_path = repo is not None and _in_git_repo(repo)
         if cfg is not None and cfg.is_dir():
             signal = str(cfg)
@@ -120,11 +126,16 @@ def resolve_channels(
     for h in found:
         if not (h.present and h.wirable):
             continue
+        if kind == "skill":
+            if h.name == "claude" and claude_plugin_enabled(claude_dir):
+                h.channel = "plugin"
+            elif installer.skill_present(h.name):
+                h.channel = "settings"
+            continue
         if h.name == "claude":
             if claude_plugin_enabled(claude_dir):
                 h.channel = "plugin"
-            elif (installer.skill_present() if kind == "skill"
-                  else installer.claude_hooks_present()):
+            elif installer.claude_hooks_present():
                 h.channel = "settings"
         elif h.name == "codex" and installer.codex_hooks_present():
             h.channel = "settings"