@ericrisco/rsc 1.0.29 → 1.0.31

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.29",
+  "version": "1.0.31",
   "counts": {
     "skills": 276
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "1.0.29",
+  "version": "1.0.31",
   "description": "Eric Risco's agent-skills catalog as a granular, self-recommending CLI installer.",
   "type": "module",
   "bin": {

package/scripts/lib/backups.js

@@ -146,9 +146,20 @@ function safeRelative(cwd, absPath) {
   return rel.split(sep).join('/');
 }
 
+// A manifest path is split on BOTH separators, because the input is file content — readManifest()
+// reads it off disk — and not every manifest was written by safeRelative() on this platform. A path
+// stored with Windows separators (`..\..\somewhere`) has no '/' to split on, so the old check saw a
+// single segment, found no '..', and handed the raw string to join() — which honours backslashes on
+// Windows. The guard only guarded on POSIX.
+//
+// Splitting into real segments does both jobs at once: `..` becomes visible to the check, and the
+// path is rebuilt by join() rather than passed through, so the separator the manifest happened to
+// use stops mattering. Found while fixing the Windows hook-duplication bug: same family.
+const pathSegments = (value) => value.split(/[/\\]+/).filter(Boolean);
+
 function safeJoin(cwd, relPath) {
-  if (!relPath || isAbsolute(relPath) || relPath.split('/').includes('..')) {
+  if (!relPath || isAbsolute(relPath) || pathSegments(relPath).includes('..')) {
     throw new Error(`path is outside project root: ${relPath}`);
   }
-  return join(cwd, ...relPath.split('/'));
+  return join(cwd, ...pathSegments(relPath));
 }

package/targets/claude.js

@@ -14,6 +14,31 @@ export function writeSkill(id, fromDir, toPath) {
   return linkOrCopy(fromDir, toPath);
 }
 
+// A hook entry, stringified with its path separators normalized to `/`.
+//
+// This exists because of a Windows bug that cost real users 4× the context budget. `join()` yields
+// `.rsc\session-start.mjs` on Windows, `JSON.stringify` escapes that to `.rsc\\session-start.mjs`,
+// and all seven dedup filters below searched for a forward-slash needle (`.rsc/session-start.`).
+// The needle never matched, so every `install` / `add` / `sync` APPENDED a hook instead of replacing
+// it: a real Windows box reported every hook present four times, which means the `suggest` always-on
+// body was injected 4× per session start and all six guards ran 4× per command.
+//
+// Worse, and unreported: `unwireHook` uses the same needles, so on Windows `uninstall` and `purge`
+// removed NONE of the hooks they claim to remove — a cleanup that silently cleans nothing.
+//
+// ONE replacement, and only the JSON-escaped form. `JSON.stringify` escapes every backslash as
+// `\\`, so a separator always arrives doubled and a LONE backslash in the JSON text is never a
+// separator — it is some other escape (`\"`, `\n`, `\uXXXX`). Collapsing those too would mangle
+// them for no gain, which is why the second `.replace(/\\/g, '/')` this started with is gone: a
+// mutation pass showed nothing depended on it.
+//
+// Normalizing the HAYSTACK (never the needle) keeps every call site readable as a plain POSIX path,
+// and keeps a user's own `C:\...\my-own-hook.mjs` from ever looking like an rsc hook.
+// `scripts/doctor.js` already handled both forms; this is that knowledge, shared.
+export function hookWiringOf(entry) {
+  return JSON.stringify(entry).replace(/\\\\/g, '/');
+}
+
 // Inverse of wireHook: drop every rsc-wired hook entry (any command pointing at a
 // .rsc/ script — session-start, worklog-checkpoint, ship-guard, danger-guard, … —
 // plus the legacy cat-form) from settings.json, across all events. User hooks and
@@ -27,7 +52,7 @@ export function unwireHook(paths) {
   if (!settings.hooks) return [];
   for (const event of Object.keys(settings.hooks)) {
     settings.hooks[event] = (settings.hooks[event] || []).filter((e) => {
-      const s = JSON.stringify(e);
+      const s = hookWiringOf(e);
       return !s.includes('.rsc/') && !s.includes('skills/rsc/suggest');
     });
     if (settings.hooks[event].length === 0) delete settings.hooks[event];
@@ -61,7 +86,7 @@ export function wireHook(paths) {
   settings.hooks ||= {};
   settings.hooks.SessionStart ||= [];
   settings.hooks.SessionStart = settings.hooks.SessionStart.filter((e) => {
-    const s = JSON.stringify(e);
+    const s = hookWiringOf(e);
     // drop legacy cat-form and any prior session-start script (.sh from the bash era, or .mjs)
     return !s.includes('skills/rsc/suggest') && !s.includes('.rsc/session-start.');
   });
@@ -78,7 +103,7 @@ export function wireHook(paths) {
   for (const event of ['PreCompact', 'SessionEnd']) {
     settings.hooks[event] ||= [];
     settings.hooks[event] = settings.hooks[event].filter(
-      (e) => !JSON.stringify(e).includes('.rsc/worklog-checkpoint.'),
+      (e) => !hookWiringOf(e).includes('.rsc/worklog-checkpoint.'),
     );
     settings.hooks[event].push({ hooks: [{ type: 'command', command: wlCmd }] });
   }
@@ -96,7 +121,7 @@ export function wireHook(paths) {
   const sgCmd = `node "${sgDest}" "${paths.projectRoot}"`;
   settings.hooks.PreToolUse ||= [];
   settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter(
-    (e) => !JSON.stringify(e).includes('.rsc/ship-guard.'),
+    (e) => !hookWiringOf(e).includes('.rsc/ship-guard.'),
   );
   settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: sgCmd }] });
 
@@ -109,7 +134,7 @@ export function wireHook(paths) {
   copyFileSync(join(HERE, 'danger-guard.mjs'), dgDest);
   const dgCmd = `node "${dgDest}" "${paths.projectRoot}"`;
   settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter(
-    (e) => !JSON.stringify(e).includes('.rsc/danger-guard.'),
+    (e) => !hookWiringOf(e).includes('.rsc/danger-guard.'),
   );
   settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: dgCmd }] });
 
@@ -124,7 +149,7 @@ export function wireHook(paths) {
   copyFileSync(join(HERE, 'gitmoji-guard.mjs'), gmDest);
   const gmCmd = `node "${gmDest}" "${paths.projectRoot}"`;
   settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter(
-    (e) => !JSON.stringify(e).includes('.rsc/gitmoji-guard.'),
+    (e) => !hookWiringOf(e).includes('.rsc/gitmoji-guard.'),
   );
   settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: gmCmd }] });
 
@@ -141,7 +166,7 @@ export function wireHook(paths) {
   const fgCmd = `node "${fgDest}" "${paths.projectRoot}"`;
   settings.hooks.UserPromptSubmit ||= [];
   settings.hooks.UserPromptSubmit = settings.hooks.UserPromptSubmit.filter(
-    (e) => !JSON.stringify(e).includes('.rsc/userprompt-gate.'),
+    (e) => !hookWiringOf(e).includes('.rsc/userprompt-gate.'),
   );
   settings.hooks.UserPromptSubmit.push({ hooks: [{ type: 'command', command: fgCmd }] });
 

package/targets/danger-guard.mjs

@@ -54,11 +54,62 @@ if (typeof cmd !== 'string' || !cmd) allow();
 // High-signal, low-false-positive. Each rule: what it catches and the plain why.
 const noWhere = (verbRe) => verbRe.test(cmd) && !/\bwhere\b/i.test(cmd);
 
+// A flag is a whitespace-separated token that BEGINS with a dash. That sounds obvious, and the
+// first version of this rule got it wrong in a way that cost real trust: it tested
+// /-[a-z]*r[a-z]*\b/ and /-[a-z]*f[a-z]*\b/ against the ENTIRE command string, so any hyphenated
+// path segment carrying an "r" and an "f" read as the flags -r and -f. The segment `-fixture` alone
+// satisfies both (f-i-x-t-u-r-e), so `rm skills/zz-case-fixture/SKILL.md` and `rm my-draft.md` were
+// DENIED with the reason "rm with -r and -f" — a claim that was false about the command in front of
+// it. It also denied commands that merely QUOTED a dangerous one, which is the same mistake the
+// gitmoji guard had to fix: blocking the conversation about a command, not the command.
+//
+// That is worse than a nuisance. The deny message ends by telling the user how to switch this guard
+// OFF, so crying wolf on a single-file delete is an active instruction to disable the thing that
+// stops a real recursive wipe. Friction has to stay proportional to risk or the protection gets
+// turned off (P7), and a denial's stated reason has to be true (P6).
+//
+// Flags are also scoped to the segment that actually runs rm: `rm notes.md && ls -lrtF` carries an
+// r and an F, but they belong to ls.
+function rmFlagsIn(segment) {
+  return segment.split(/\s+/).filter((t) => /^--?[A-Za-z]/.test(t));
+}
+
+// Wrappers that stand in front of the real command without being it. A shell with -c is included
+// deliberately: `bash -c "rm -rf /"` DOES run the delete, and dropping it would have been the hole
+// this rewrite opened while fixing the over-fire.
+const WRAPPERS = /^(sudo|doas|env|command|time|nohup|xargs)$/i;
+const SHELLS = /^(bash|sh|zsh|dash|ksh)$/i;
+
+// `rm` has to be the command being EXECUTED, not a word inside someone else's argument. Without
+// this, `echo "never run rm -rf /"` was denied — the guard blocking the conversation about a
+// command instead of the command, exactly the defect the gitmoji guard had to fix with its own
+// RUNS_GIT check. A guard that argues with you about a sentence is a guard you turn off.
+function runsRm(segment) {
+  const tokens = segment.trim().split(/\s+/).filter(Boolean);
+  let i = 0;
+  while (i < tokens.length) {
+    const bare = tokens[i].replace(/^['"]/, '');
+    if (WRAPPERS.test(bare)) { i += 1; continue; }
+    if (SHELLS.test(bare)) {
+      i += 1;
+      while (i < tokens.length && /^-/.test(tokens[i])) i += 1; // skip -c and friends
+      continue;
+    }
+    return bare === 'rm' || bare.endsWith('/rm');
+  }
+  return false;
+}
+
 function isRmRecursiveForce() {
   if (!/\brm\b/.test(cmd)) return false;
-  const hasR = /(-[a-z]*r[a-z]*|--recursive)\b/i.test(cmd);
-  const hasF = /(-[a-z]*f[a-z]*|--force)\b/i.test(cmd);
-  return hasR && hasF; // -rf / -fr / -r -f / --recursive --force
+  for (const segment of cmd.split(/\|\||&&|[|;&]/)) {
+    if (!runsRm(segment)) continue;
+    const flags = rmFlagsIn(segment);
+    const hasR = flags.some((f) => /^--recursive$/i.test(f) || /^-[A-Za-z]*r/i.test(f));
+    const hasF = flags.some((f) => /^--force$/i.test(f) || /^-[A-Za-z]*f/i.test(f));
+    if (hasR && hasF) return true; // -rf / -fr / -Rf / -r -f / --recursive --force
+  }
+  return false;
 }
 
 const RULES = [