@ericrisco/rsc 2.0.14 → 2.0.16

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.14",
+  "version": "2.0.16",
   "counts": {
     "skills": 273,
     "agents": 33,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "2.0.14",
+  "version": "2.0.16",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {
@@ -85,6 +85,14 @@
     {
       "fixedIn": "2.0.12",
       "symptom": "Security: session continuation context could come from a different git worktree"
+    },
+    {
+      "fixedIn": "2.0.15",
+      "symptom": "The 'consider compacting' notice never appears in sessions that edit files through the terminal instead of the Edit tool"
+    },
+    {
+      "fixedIn": "2.0.16",
+      "symptom": "Non-technical or mixed users in a non-software project had no guard against irreversible commands; repair wired guards the plan had declined"
     }
   ]
 }

package/scripts/install-apply.js

@@ -78,9 +78,12 @@ export function generatedHookFiles({ target, cwd, policy }) {
     join(cwd, '.rsc', 'hook-once.mjs'),
     join(cwd, '.rsc', 'worktree-reaper.mjs'),
   ];
-  if (policy?.codeHooks === false) return [...lifecycle, join(cwd, '.rsc', 'suggest-always-on.md')];
-  return [...lifecycle,
-    join(cwd, '.rsc', 'ship-guard.mjs'), join(cwd, '.rsc', 'danger-guard.mjs'),
+  // The danger guard is declared on its own terms (#273): present unless the plan says otherwise,
+  // whether or not the code guards are.
+  const danger = policy?.dangerGuard === false ? [] : [join(cwd, '.rsc', 'danger-guard.mjs')];
+  if (policy?.codeHooks === false) return [...lifecycle, ...danger, join(cwd, '.rsc', 'suggest-always-on.md')];
+  return [...lifecycle, ...danger,
+    join(cwd, '.rsc', 'ship-guard.mjs'),
     join(cwd, '.rsc', 'gitmoji-guard.mjs'), join(cwd, '.rsc', 'userprompt-gate.mjs'),
     join(cwd, '.rsc', 'sello.mjs')];
 }
@@ -279,6 +282,7 @@ export async function applyInstall({ skillIds = [], agentIds = [], target, home,
     baseAgents: policy.baseAgents !== false,
     alwaysOn: policy.alwaysOn !== false,
     codeHooks: policy.codeHooks !== false,
+    dangerGuard: policy.dangerGuard !== false,
     gitmojiGuard: policy.gitmojiGuard !== false,
     memory: policy.memory !== false,
     context7: policy.context7 === true,

package/scripts/lib/onboarding.js

@@ -230,6 +230,13 @@ export function buildOnboardingPlan(record, evidence) {
   const hooks = practisesSdd;
   const agents = baseAgents ? resolveAgentNames(skills, []).sort() : [];
   const gitmojiGuard = hooks && normalized.targets.includes('claude');
+  // The danger guard is NOT code machinery, and tying it to `hooks` was the mistake behind #273. The
+  // three guards above need a code project with git — a branch to protect, a commit to lint. This one
+  // stops recursive deletes, history-rewriting pushes and friends, which are exactly as irreversible
+  // in an invoicing workspace, and `init` promises it by technical level: non-technical and mixed get
+  // it, whatever the project is. The guard also decides at runtime from the profile, so the plan only
+  // chooses whether it is present, never whether it bites.
+  const dangerGuard = normalized.technicalLevel !== 'technical';
   // `sdd` is installed everywhere now, but its DECISION is about practice, not presence — so where
   // the chain is not practised the explicit `deferred` entry below must be the only one, or the
   // generic "installed → selected" mapping would shadow it and `reassess` would see nothing to watch.
@@ -276,6 +283,7 @@ export function buildOnboardingPlan(record, evidence) {
     alwaysOn: true,
     codeHooks: practisesSdd,
     gitmojiGuard,
+    dangerGuard,
     memory: true,
     context7: false,
   };

package/scripts/lib/repair.js

@@ -131,22 +131,26 @@ export async function repair({ cwd = process.cwd(), target, home = homedir(), dr
 
   const paths = targetPaths(target, home, cwd);
   const ids = [...new Set([...Object.keys(readState(paths.stateFile).skills || {}), ...(readManifest(cwd)?.skills || [])])];
+  // The accepted plan governs a repair exactly as it governs a sync. Without it, `wireHook` saw `{}`,
+  // read `codeHooks !== false` as true and wired every guard the plan had declined — and the next
+  // `sync`, which does pass the policy, took them away again (#274). Restoring is not deciding.
+  const policy = readManifest(cwd)?.onboarding?.plan?.policy;
   const backup = createBackup({
     cwd, operation: 'repair', target,
-    paths: managedPathsForInstall({ skillIds: ids, target, home, cwd }),
+    paths: managedPathsForInstall({ skillIds: ids, target, home, cwd, policy }),
   });
 
   for (const f of todo) {
     if (f.id === 'nested-layout') rmSync(join(paths.root, 'rsc'), { recursive: true, force: true });
-    if (f.id === 'duplicate-hooks') { unwireHook(target, paths); await applyInstall({ skillIds: ids, target, home, cwd, operation: 'repair' }); }
-    if (f.id === 'dangling-links') await applyInstall({ skillIds: ids, target, home, cwd, operation: 'repair' });
+    if (f.id === 'duplicate-hooks') { unwireHook(target, paths); await applyInstall({ skillIds: ids, target, home, cwd, operation: 'repair', policy }); }
+    if (f.id === 'dangling-links') await applyInstall({ skillIds: ids, target, home, cwd, operation: 'repair', policy });
     if (f.id === 'no-manifest') recordInManifest({ cwd, target, skillIds: ids });
     if (f.id === 'wrong-target') {
       // Install where the project actually points, THEN take the old wiring down — in that
       // order, so a failure halfway leaves a working harness rather than none. Taking the
       // block out of the old file gives it back byte-identical: in #249 that file was the
       // project's hand-written constitution, and it had already been written into once.
-      await applyInstall({ skillIds: ids, target: f.to, home, cwd, operation: 'repair' });
+      await applyInstall({ skillIds: ids, target: f.to, home, cwd, operation: 'repair', policy });
       unwireHook(target, paths);
       removeManagedSkills(paths);
       recordInManifest({ cwd, target: f.to, skillIds: ids, dropTarget: target });

package/targets/claude.js

@@ -179,18 +179,6 @@ export function wireHook(paths, sourceMd, policy = {}) {
   );
   settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: sgCmd }] });
 
-  // Danger guard: a PreToolUse(Bash) hook that DENIES irreversible foot-gun commands
-  // (rm -rf, git push --force, DROP/TRUNCATE, DELETE/UPDATE without WHERE, dd to /dev,
-  // curl|bash, …) when the user-profile says the user is NON-technical (default-safe
-  // when no profile exists yet; never guards a fully `technical` user). Materialized +
-  // node-run (Windows-safe), idempotent, fail-open, opt-out via .rsc/.no-danger-guard.
-  const dgDest = join(paths.projectRoot, '.rsc', 'danger-guard.mjs');
-  copyFileSync(join(HERE, 'danger-guard.mjs'), dgDest);
-  const dgCmd = viaBootstrap('guard', at('.rsc', 'danger-guard.mjs'), `"${P}"`);
-  settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter(
-    (e) => !hookWiringOf(e).includes('.rsc/danger-guard.'),
-  );
-  settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: dgCmd }] });
 
   // Gitmoji guard: a PreToolUse(Bash) hook that DENIES a `git commit` whose message
   // carries no gitmoji (gitmoji.dev) in front of the Conventional Commits header. The
@@ -223,23 +211,45 @@ export function wireHook(paths, sourceMd, policy = {}) {
     (e) => !hookWiringOf(e).includes('.rsc/userprompt-gate.'),
   );
   settings.hooks.UserPromptSubmit.push({ hooks: [{ type: 'command', command: fgCmd }] });
-  written.push(sgDest, dgDest, gmDest, fgDest, join(paths.projectRoot, '.rsc', 'sello.mjs'));
+  written.push(sgDest, gmDest, fgDest, join(paths.projectRoot, '.rsc', 'sello.mjs'));
   } else {
     for (const event of ['PreToolUse', 'UserPromptSubmit']) {
       if (!settings.hooks[event]) continue;
       settings.hooks[event] = settings.hooks[event].filter((entry) => {
         const body = hookWiringOf(entry);
-        return !body.includes('.rsc/ship-guard.') && !body.includes('.rsc/danger-guard.') &&
+        return !body.includes('.rsc/ship-guard.') &&
           !body.includes('.rsc/gitmoji-guard.') && !body.includes('.rsc/userprompt-gate.');
       });
       if (!settings.hooks[event].length) delete settings.hooks[event];
     }
-    for (const name of ['ship-guard.mjs', 'danger-guard.mjs', 'gitmoji-guard.mjs', 'userprompt-gate.mjs', 'sello.mjs']) {
+    for (const name of ['ship-guard.mjs', 'gitmoji-guard.mjs', 'userprompt-gate.mjs', 'sello.mjs']) {
       rmSync(join(paths.projectRoot, '.rsc', name), { force: true });
     }
     written.push(operationsSuggest);
   }
 
+  // Danger guard: its own decision, not part of the code-hook block above (#273). `init` promises it
+  // to non-technical and mixed users whatever the project is, and a plan that predates the field is
+  // read as "yes": a non-technical operations install gets the guard it was missing on its next sync,
+  // and a technical user gets a guard that stands down at runtime.
+  settings.hooks.PreToolUse ||= [];
+  settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter((e) => !hookWiringOf(e).includes('.rsc/danger-guard.'));
+  if (policy.dangerGuard !== false) {
+    // Danger guard: a PreToolUse(Bash) hook that DENIES irreversible foot-gun commands
+    // (rm -rf, git push --force, DROP/TRUNCATE, DELETE/UPDATE without WHERE, dd to /dev,
+    // curl|bash, …) when the user-profile says the user is NON-technical (default-safe
+    // when no profile exists yet; never guards a fully `technical` user). Materialized +
+    // node-run (Windows-safe), idempotent, fail-open, opt-out via .rsc/.no-danger-guard.
+    const dgDest = join(paths.projectRoot, '.rsc', 'danger-guard.mjs');
+    copyFileSync(join(HERE, 'danger-guard.mjs'), dgDest);
+    const dgCmd = viaBootstrap('guard', at('.rsc', 'danger-guard.mjs'), `"${P}"`);
+    settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: dgCmd }] });
+    written.push(dgDest);
+  } else {
+    rmSync(join(paths.projectRoot, '.rsc', 'danger-guard.mjs'), { force: true });
+  }
+  if (!settings.hooks.PreToolUse.length) delete settings.hooks.PreToolUse;
+
   mkdirSync(dirname(file), { recursive: true });
   writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');
 

package/targets/session-memory-core.mjs

@@ -319,7 +319,20 @@ export function capture(input = {}) {
   if (input.event === 'start' && !existing) return { record: null, path: null, notice: null, compactionHint: false };
 
   const repo = snapshot(here, anchor.baselineHead);
-  const editCount = Math.max(0, (existing?.editCount || 0) + (finiteOrNull(input.editDelta, true) || 0));
+  // Count what CHANGED, not which tool changed it. `editDelta` is +1 per Edit/Write tool event, and
+  // on its own it was blind to everything done through the shell — a heredoc, `sed -i`, a script, a
+  // formatter — which is how automated sessions work. The session that found this had touched dozens
+  // of files and its record said editCount=1, so the compaction hint never reached the long sessions
+  // it exists for.
+  //
+  // `snapshot` already fingerprints every modified file on every event. Comparing those fingerprints
+  // with the previous event's counts a change from any source. `max`, not `+`: an Edit that changed a
+  // file shows up in BOTH signals, and must count once.
+  const previousFingerprints = anchor.lastFingerprints || anchor.baselineFingerprints || {};
+  const observed = Object.entries(repo.fingerprints || {})
+    .filter(([path, fingerprint]) => fingerprint && previousFingerprints[path] !== fingerprint).length;
+  const editDelta = Math.max(finiteOrNull(input.editDelta, true) || 0, observed);
+  const editCount = Math.max(0, (existing?.editCount || 0) + editDelta);
   const baselineFiles = new Set(anchor.baselineFiles || []);
   const newDirtyPath = repo.files.some((path) => !baselineFiles.has(path));
   const baselineFingerprints = anchor.baselineFingerprints || {};
@@ -368,7 +381,17 @@ export function capture(input = {}) {
   // already written and `readRecords` would quietly drop the project's whole history.
   let compactionHint = Boolean(config.compactionHint && editCount >= config.editThreshold);
   if (compactionHint && anchor.compactionHintedAt) compactionHint = false;
-  else if (compactionHint) atomicJson(anchorPath, { ...anchor, compactionHintedAt: now });
+  // One anchor write per event at most, carrying both pieces of per-session state: the fingerprints
+  // the next event compares against, and the once-per-session hint mark. Written only when either
+  // actually changed, so a read-only shell command costs no extra disk.
+  const fingerprintsMoved = observed > 0 || !anchor.lastFingerprints;
+  if (compactionHint || fingerprintsMoved) {
+    atomicJson(anchorPath, {
+      ...anchor,
+      lastFingerprints: repo.fingerprints || {},
+      ...(compactionHint ? { compactionHintedAt: now } : {}),
+    });
+  }
   return {
     record,
     path: recordPath,