@ericrisco/rsc 1.0.28 → 1.0.30

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.28",
+  "version": "1.0.30",
   "counts": {
     "skills": 276
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "description": "Eric Risco's agent-skills catalog as a granular, self-recommending CLI installer.",
   "type": "module",
   "bin": {

package/scripts/drift-check.js

@@ -146,18 +146,50 @@ export function basesFor(docPath, { mode, root }) {
   return [dirname(docPath), root, join(root, '02-DOCS'), join(root, '02-DOCS', 'wiki'), join(root, 'skills')];
 }
 
-const resolves = (target, bases) => bases.some((b) => existsSync(resolve(b, target)));
+// `existsSync` asks the filesystem, and on APFS/HFS+ (macOS) and NTFS (Windows) the filesystem
+// ignores case. So a link to `AUDIT.md` resolves against a file named `audit.md` and this gate goes
+// GREEN on the maintainer's machine while Linux CI — and every installed user — sees a broken link.
+// That is P2 in its most expensive form: the gate fails open exactly where the work is done. It
+// happened for real (the motion-craft port moved references and one link kept its old casing).
+//
+// So existence is checked one path segment at a time against the parent's actual directory listing,
+// which is byte-exact on every filesystem. The walk starts at `root`, which is real by
+// construction; the declared hole is a target that resolves OUTSIDE the repo, where there is no
+// listing we can trust — the repo's own path may sit under a differently-cased volume or behind a
+// symlink, and a false positive in a blocking gate costs more than a named gap.
+// Spec: 02-DOCS/wiki/sdd/specs/drift-check-case.md
+function existsExact(absTarget, root, cache) {
+  const rel = relative(root, absTarget);
+  // Outside the repo (or the root itself): keep the old behaviour, and say so rather than guess.
+  if (rel === '' || rel.startsWith('..') || rel.startsWith('/')) return existsSync(absTarget);
+
+  let dir = root;
+  for (const segment of rel.split('/')) {
+    let entries = cache.get(dir);
+    if (entries === undefined) {
+      // An unreadable directory is not evidence of drift; fall back rather than accuse.
+      try { entries = new Set(readdirSync(dir)); } catch { return existsSync(absTarget); }
+      cache.set(dir, entries);
+    }
+    if (!entries.has(segment)) return false;
+    dir = join(dir, segment);
+  }
+  return true;
+}
+
+const resolves = (target, bases, root, cache) =>
+  bases.some((b) => existsExact(resolve(b, target), root, cache));
 
 // Knowledge mode only. The authoring standards write per-skill paths generically — "every skill
 // carries `evals/cases.yaml`" — which is a claim about a shape shared by 258 directories, not a
 // location. Resolving it against any one skill is the honest reading; treating it as drift
 // produced five findings that were never wrong.
-function resolvesInAnySkill(target, root) {
+function resolvesInAnySkill(target, root, cache) {
   if (target.startsWith('.') || target.startsWith('/')) return false;
   const skillsDir = join(root, 'skills');
   if (!existsSync(skillsDir)) return false;
   for (const e of readdirSync(skillsDir, { withFileTypes: true })) {
-    if (e.isDirectory() && existsSync(join(skillsDir, e.name, target))) return true;
+    if (e.isDirectory() && existsExact(join(skillsDir, e.name, target), root, cache)) return true;
   }
   return false;
 }
@@ -186,6 +218,9 @@ export function scanTree(dir, { mode, root = REPO, label = null } = {}) {
   const findings = [];
   let claims = 0;
   let skipped = 0;
+  // Directory listings, memoized per scan rather than per module: 824 claims share a few hundred
+  // directories, and a cache that outlived the scan would answer from a stale listing.
+  const cache = new Map();
   for (const doc of markdownFiles(dir)) {
     const text = readFileSync(doc, 'utf8');
     const raw = mode === 'catalog'
@@ -199,8 +234,8 @@ export function scanTree(dir, { mode, root = REPO, label = null } = {}) {
         continue;
       }
       claims++;
-      if (mode === 'knowledge' && resolvesInAnySkill(c.target, root)) continue;
-      if (!resolves(c.target, bases)) {
+      if (mode === 'knowledge' && resolvesInAnySkill(c.target, root, cache)) continue;
+      if (!resolves(c.target, bases, root, cache)) {
         findings.push({
           doc: relative(root, doc),
           line: c.line,

package/targets/danger-guard.mjs

@@ -54,11 +54,62 @@ if (typeof cmd !== 'string' || !cmd) allow();
 // High-signal, low-false-positive. Each rule: what it catches and the plain why.
 const noWhere = (verbRe) => verbRe.test(cmd) && !/\bwhere\b/i.test(cmd);
 
+// A flag is a whitespace-separated token that BEGINS with a dash. That sounds obvious, and the
+// first version of this rule got it wrong in a way that cost real trust: it tested
+// /-[a-z]*r[a-z]*\b/ and /-[a-z]*f[a-z]*\b/ against the ENTIRE command string, so any hyphenated
+// path segment carrying an "r" and an "f" read as the flags -r and -f. The segment `-fixture` alone
+// satisfies both (f-i-x-t-u-r-e), so `rm skills/zz-case-fixture/SKILL.md` and `rm my-draft.md` were
+// DENIED with the reason "rm with -r and -f" — a claim that was false about the command in front of
+// it. It also denied commands that merely QUOTED a dangerous one, which is the same mistake the
+// gitmoji guard had to fix: blocking the conversation about a command, not the command.
+//
+// That is worse than a nuisance. The deny message ends by telling the user how to switch this guard
+// OFF, so crying wolf on a single-file delete is an active instruction to disable the thing that
+// stops a real recursive wipe. Friction has to stay proportional to risk or the protection gets
+// turned off (P7), and a denial's stated reason has to be true (P6).
+//
+// Flags are also scoped to the segment that actually runs rm: `rm notes.md && ls -lrtF` carries an
+// r and an F, but they belong to ls.
+function rmFlagsIn(segment) {
+  return segment.split(/\s+/).filter((t) => /^--?[A-Za-z]/.test(t));
+}
+
+// Wrappers that stand in front of the real command without being it. A shell with -c is included
+// deliberately: `bash -c "rm -rf /"` DOES run the delete, and dropping it would have been the hole
+// this rewrite opened while fixing the over-fire.
+const WRAPPERS = /^(sudo|doas|env|command|time|nohup|xargs)$/i;
+const SHELLS = /^(bash|sh|zsh|dash|ksh)$/i;
+
+// `rm` has to be the command being EXECUTED, not a word inside someone else's argument. Without
+// this, `echo "never run rm -rf /"` was denied — the guard blocking the conversation about a
+// command instead of the command, exactly the defect the gitmoji guard had to fix with its own
+// RUNS_GIT check. A guard that argues with you about a sentence is a guard you turn off.
+function runsRm(segment) {
+  const tokens = segment.trim().split(/\s+/).filter(Boolean);
+  let i = 0;
+  while (i < tokens.length) {
+    const bare = tokens[i].replace(/^['"]/, '');
+    if (WRAPPERS.test(bare)) { i += 1; continue; }
+    if (SHELLS.test(bare)) {
+      i += 1;
+      while (i < tokens.length && /^-/.test(tokens[i])) i += 1; // skip -c and friends
+      continue;
+    }
+    return bare === 'rm' || bare.endsWith('/rm');
+  }
+  return false;
+}
+
 function isRmRecursiveForce() {
   if (!/\brm\b/.test(cmd)) return false;
-  const hasR = /(-[a-z]*r[a-z]*|--recursive)\b/i.test(cmd);
-  const hasF = /(-[a-z]*f[a-z]*|--force)\b/i.test(cmd);
-  return hasR && hasF; // -rf / -fr / -r -f / --recursive --force
+  for (const segment of cmd.split(/\|\||&&|[|;&]/)) {
+    if (!runsRm(segment)) continue;
+    const flags = rmFlagsIn(segment);
+    const hasR = flags.some((f) => /^--recursive$/i.test(f) || /^-[A-Za-z]*r/i.test(f));
+    const hasF = flags.some((f) => /^--force$/i.test(f) || /^-[A-Za-z]*f/i.test(f));
+    if (hasR && hasF) return true; // -rf / -fr / -Rf / -r -f / --recursive --force
+  }
+  return false;
 }
 
 const RULES = [