@ericrisco/rsc 2.0.12 → 2.0.13

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.12",
+  "version": "2.0.13",
   "counts": {
     "skills": 273,
     "agents": 33,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "2.0.12",
+  "version": "2.0.13",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {
@@ -64,5 +64,27 @@
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "rscFixes": [
+    {
+      "fixedIn": "2.0.6",
+      "symptom": "A guard your team disarmed (.rsc/.no-gitmoji and similar) comes back armed after cloning the repo"
+    },
+    {
+      "fixedIn": "2.0.8",
+      "symptom": "rsc doctor reports commandOrphans for skills that are installed, and rsc capabilities shows no skills (macOS/Linux)"
+    },
+    {
+      "fixedIn": "2.0.10",
+      "symptom": "onboard fails with RSC_ONBOARDING_INCOMPLETE: installed agents differ from accepted policy (antigravity, windsurf, cline, roo, continue, amp, jules, zed, aider)"
+    },
+    {
+      "fixedIn": "2.0.11",
+      "symptom": "Stop or PreCompact hook error: Hook JSON output validation failed, and a 'consider compacting' notice repeating after every turn"
+    },
+    {
+      "fixedIn": "2.0.12",
+      "symptom": "Security: session continuation context could come from a different git worktree"
+    }
+  ]
 }

package/scripts/doctor.js

@@ -18,6 +18,7 @@ import { inspectMemoryWiring } from '../targets/memory.js';
 import { metricsSummary } from '../targets/session-memory-core.mjs';
 import { agentPath } from '../targets/agents.js';
 import { projectOptOuts } from '../targets/opt-outs.js';
+import { versionReport } from './lib/versions.js';
 
 // Gates the committed manifest says the team disarmed, still armed here. Read through the same
 // partition the installer uses, so a machine-only switch somebody's older rsc wrote into the
@@ -238,6 +239,9 @@ export function doctor({ target, home, cwd }) {
     // never rewrites somebody's machine — so the only thing owed is saying it out loud, and
     // saying it every run, because a notice offered once per session is a notice missed.
     optOutsNotApplied: optOutsNotApplied(root),
+    // First thing to read on any bug report: a project behind its CLI runs old hooks, and "it is
+    // already fixed" only helps once the fix is in `.rsc/`.
+    versions: versionReport(root),
     // Counted, never interpreted — by spec, the gap log's reader is the user.
     automationGaps: countGaps(root),
     memory,

package/scripts/lib/versions.js

@@ -0,0 +1,31 @@
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Which rsc is running, and which rsc this project was last built with. Two different numbers, and
+// the gap between them is where a published fix fails to arrive: hooks are materialized as copies
+// under `.rsc/`, so a release changes nothing in a project until someone syncs it. Nobody could see
+// that gap before — there was no `--version`, and bug reports arrived without one.
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+export const CLI_VERSION = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8')).version;
+
+/** `.rsc/.version` is written at install and at every sync — the version this project's hooks came from. */
+export function installedVersion(root) {
+  try { return readFileSync(join(root, '.rsc', '.version'), 'utf8').trim() || null; } catch { return null; }
+}
+
+export function isNewer(a, b) {
+  const pa = String(a).split('.').map(Number);
+  const pb = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) > (pb[i] || 0)) return true;
+    if ((pa[i] || 0) < (pb[i] || 0)) return false;
+  }
+  return false;
+}
+
+export function versionReport(root) {
+  const installed = installedVersion(root);
+  return { cli: CLI_VERSION, installed, behind: Boolean(installed && isNewer(CLI_VERSION, installed)) };
+}

package/scripts/rsc.js

@@ -16,6 +16,7 @@ import { runUpgrade } from './lib/upgrade.js';
 import { diagnose, repair } from './lib/repair.js';
 import { DEFAULT_SKILL_FLOOR, withDefaultSkillFloor } from './lib/default-skill-floor.js';
 import { readManifest, writeManifest } from './lib/manifest-file.js';
+import { versionReport } from './lib/versions.js';
 import {
   normalizeOnboarding, missingOnboardingFields, scanProject,
   buildOnboardingPlan, decodeGoal, encodeGoal, identifyPlan, recommendDeferredComponents,
@@ -23,6 +24,20 @@ import {
 import { applyAcceptedOnboarding, verifyOnboarding, ensureHarnessSkeleton, harnessReadiness } from './lib/onboarding-apply.js';
 
 const rawArgv = process.argv.slice(2);
+
+// `rsc --version` — answered before anything else runs, offline, and in a shape a bug report can
+// paste. Two numbers because there are two things: the CLI you just ran, and the harness this
+// project was built with. When they differ the project is running old hooks, and a fix that was
+// published may simply not be here yet.
+if (['--version', '-v', 'version'].includes(rawArgv[0])) {
+  const v = versionReport(process.cwd());
+  const lines = [`rsc ${v.cli}`];
+  if (v.installed) lines.push(`installed in this project: ${v.installed}${v.behind ? ' (behind)' : ''}`);
+  else lines.push('installed in this project: none');
+  if (v.behind) lines.push('This project runs older hooks than this CLI. To catch up, run here:', '  npx @ericrisco/rsc@latest');
+  process.stdout.write(`${lines.join('\n')}\n`);
+  process.exit(0);
+}
 const GLOBAL_VALUE_FLAGS = new Set([
   '--target', '--technical-level', '--accompaniment', '--project-kind', '--goal', '--goal-base64', '--software-scope', '--accept-plan',
 ]);

package/targets/session-start.mjs

@@ -266,19 +266,58 @@ function isNewer(a, b) {
   return false;
 }
 
+// "rsc X is out" was being ignored — the maintainer's own workspace sat on 2.0.4 for days with this
+// notice on every session, and two people in two days reported bugs that were already fixed. A
+// version number names nothing anyone recognises. A symptom does: someone who sees a red error after
+// every turn updates the moment they are told that is what the update fixes (`suggest` §3: say what
+// is wrong as a symptom, not as a cause).
+//
+// The symptoms travel for free: the registry's `/latest` document is the published package.json, so
+// its `rscFixes` field — `{ fixedIn, symptom }` — arrives in the response this check already makes.
+// It is text a model will read, so every entry is reduced to one short plain line or dropped.
+const SEMVER_ONLY = /^\d+\.\d+\.\d+$/;
+function fixesSince(list, installed, latest) {
+  if (!Array.isArray(list)) return [];
+  const out = [];
+  for (const item of list) {
+    if (!item || typeof item !== 'object' || typeof item.symptom !== 'string') continue;
+    if (!SEMVER_ONLY.test(String(item.fixedIn))) continue;
+    if (!isNewer(item.fixedIn, installed) || isNewer(item.fixedIn, latest)) continue;
+    const symptom = item.symptom.replace(/[\u0000-\u001f\u007f]+/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 200);
+    if (symptom) out.push({ fixedIn: item.fixedIn, symptom });
+  }
+  return out.slice(0, 8);
+}
+
 if (!process.env.RSC_NO_UPDATE_CHECK) {
   try {
     const installed = readFileSync(join(root, '.rsc', '.version'), 'utf8').trim();
-    let latest = process.env.RSC_LATEST;
-    if (!latest) {
+    let doc = null;
+    if (process.env.RSC_LATEST_JSON) doc = JSON.parse(process.env.RSC_LATEST_JSON);
+    else if (process.env.RSC_LATEST) doc = { version: process.env.RSC_LATEST };
+    else {
       const ctrl = new AbortController();
       const timer = setTimeout(() => ctrl.abort(), 1500);
       const res = await fetch('https://registry.npmjs.org/@ericrisco%2frsc/latest', { signal: ctrl.signal });
       clearTimeout(timer);
-      latest = (await res.json()).version;
+      doc = await res.json();
     }
+    const latest = doc?.version;
     if (installed && latest && isNewer(latest, installed)) {
-      process.stdout.write(`
+      let fixes = [];
+      try { fixes = fixesSince(doc.rscFixes, installed, latest); } catch { fixes = []; }
+      if (fixes.length) {
+        process.stdout.write(`
+===== rsc update available =====
+rsc ${latest} is out — you have ${installed}. It fixes problems this install still has:
+${fixes.map((f) => `  - ${f.symptom} (fixed in ${f.fixedIn})`).join('\n')}
+ACTION: before starting the task, tell the user in one line that the update fixes what they
+may be seeing, and if they say yes, run it in this project:
+  npx @ericrisco/rsc@latest
+================================
+`);
+      } else {
+        process.stdout.write(`
 ===== rsc update available =====
 rsc ${latest} is out — you have ${installed}.
 ACTION: tell the user a new version is available and, if they say yes, run:
@@ -286,6 +325,7 @@ ACTION: tell the user a new version is available and, if they say yes, run:
 (That reinstalls and refreshes the skill content to the latest.)
 ================================
 `);
+      }
     }
   } catch { /* offline / no baseline / parse error → stay silent */ }
 }