@ericrisco/rsc 2.0.11 → 2.0.12

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.11",
+  "version": "2.0.12",
   "counts": {
     "skills": 273,
     "agents": 33,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {

package/targets/session-memory-adapter.mjs

@@ -98,15 +98,18 @@ export function handleLifecycle({ target, event, native = {}, cwd, settings } =
   try {
     if (!LOCAL_TARGETS.has(target)) throw new Error(`unsupported memory target: ${target}`);
     if (isRemote(target, native)) return { output: {}, capture: null, remote: true, degraded: false };
-    const project = nearestHarness(resolve(cwd || native.cwd || process.env.RSC_PROJECT_CWD || process.cwd()));
+    // Two answers from one path, kept apart on purpose: `project` is where the journal is KEPT (the
+    // nearest harness), `here` is where the agent WORKS and therefore who the session is.
+    const here = resolve(cwd || native.cwd || process.env.RSC_PROJECT_CWD || process.cwd());
+    const project = nearestHarness(here);
     if (!existsSync(project)) throw new Error('project directory unavailable');
     const config = settings || projectSettings(project);
     if (config.enabled === false) return { output: {}, capture: null, remote: false, degraded: false };
     const id = sessionId(native, target);
     const eventName = hookEventName(target, event, native);
     if (event === 'start') {
-      const started = capture({ cwd: project, sessionId: id, target, event: 'start', settings: config });
-      const resumed = resume({ cwd: project, target, settings: config });
+      const started = capture({ cwd: project, worktreeCwd: here, sessionId: id, target, event: 'start', settings: config });
+      const resumed = resume({ cwd: project, worktreeCwd: here, target, settings: config });
       return {
         output: nativeOutput(target, eventName, resumed.context),
         capture: started,
@@ -117,6 +120,7 @@ export function handleLifecycle({ target, event, native = {}, cwd, settings } =
     }
     const captureInput = {
       cwd: project,
+      worktreeCwd: here,
       sessionId: id,
       target,
       event: event === 'end' ? 'sessionEnd' : event,

package/targets/session-memory-core.mjs

@@ -284,6 +284,12 @@ function readRecords(root) {
 
 export function capture(input = {}) {
   const cwd = resolve(input.cwd || process.cwd());
+  // WHERE the journal lives and WHO the session is are two different questions. `cwd` answers the
+  // first — the nearest harness, so a child with no manifest of its own does not scatter journals.
+  // The second has to be asked of git from where the agent actually works: asked from the harness,
+  // every worktree nested under it came back as the harness itself, and a sibling's record then
+  // "matched exactly". See GHSA-8gjp-3r7c-33f4.
+  const here = resolve(input.worktreeCwd || cwd);
   const config = settings(input.settings);
   if (!config.enabled) return { record: null, path: null, notice: null, compactionHint: false };
   const store = chooseMemoryRoot(cwd);
@@ -299,7 +305,7 @@ export function capture(input = {}) {
   const recordPath = join(store.root, 'sessions', `${storageId}.json`);
   let anchor = readJson(anchorPath);
   let existing = readJson(recordPath);
-  const firstSnapshot = snapshot(cwd, null);
+  const firstSnapshot = snapshot(here, null);
   if (!anchor) {
     anchor = {
       sessionId,
@@ -312,7 +318,7 @@ export function capture(input = {}) {
   }
   if (input.event === 'start' && !existing) return { record: null, path: null, notice: null, compactionHint: false };
 
-  const repo = snapshot(cwd, anchor.baselineHead);
+  const repo = snapshot(here, anchor.baselineHead);
   const editCount = Math.max(0, (existing?.editCount || 0) + (finiteOrNull(input.editDelta, true) || 0));
   const baselineFiles = new Set(anchor.baselineFiles || []);
   const newDirtyPath = repo.files.some((path) => !baselineFiles.has(path));
@@ -419,13 +425,19 @@ export function resume(input = {}) {
   ensureStore(store.root);
   const now = iso(input.now);
   prune(store.root, now, config);
-  const current = snapshot(cwd, null);
-  const records = readRecords(store.root).filter((record) => validAnchor(cwd, record))
+  const here = resolve(input.worktreeCwd || cwd);
+  const current = snapshot(here, null);
+  const records = readRecords(store.root).filter((record) => validAnchor(here, record))
     .sort((a, b) => b.timestamps.updatedAt.localeCompare(a.timestamps.updatedAt));
   let record = records.find((candidate) => candidate.branch === current.branch && candidate.worktree === current.worktree) || null;
   let match = record ? 'exact' : 'none';
+  // Only ever this worktree's own records. The chain used to end in `|| records[0]` — the newest
+  // record in the store, whoever wrote it — which a moved or renamed checkout reached every time,
+  // because its stale records match nothing. A shared store is a place to KEEP several worktrees'
+  // journals, never a reason to hand one of them to another. No continuation is the honest answer
+  // when there is nothing of yours to continue.
   if (!record) {
-    record = records.find((candidate) => candidate.worktree === current.worktree) || records[0] || null;
+    record = records.find((candidate) => candidate.worktree === current.worktree) || null;
     if (record) match = 'nearby';
   }
   const lessons = selectedLessons(store.root, config);