@ericrisco/rsc 3.0.20 → 3.0.21

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.20",
+  "version": "3.0.21",
   "counts": {
     "skills": 271,
     "agents": 34,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "3.0.20",
+  "version": "3.0.21",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {

package/scripts/doctor.js

@@ -398,6 +398,7 @@ export const RSC_HOOKS = [
   { id: 'ship-guard', label: 'ship-guard', needle: '.rsc/ship-guard.', injects: null },
   { id: 'danger-guard', label: 'danger-guard', needle: '.rsc/danger-guard.', injects: null },
   { id: 'gitmoji-guard', label: 'gitmoji-guard', needle: '.rsc/gitmoji-guard.', injects: null },
+  { id: 'copy-guard', label: 'copy-guard', needle: '.rsc/copy-guard.', injects: null },
   // The bash-era form, still retired by unwireHook. If uninstall knows how to remove it, the report
   // has to know how to count it.
   { id: 'legacy-cat-form', label: 'legacy suggest hook', needle: 'skills/rsc/suggest', injects: 'sessionStart' },

package/scripts/install-apply.js

@@ -88,6 +88,9 @@ export function generatedHookFiles({ target, cwd, policy }) {
     // team-safe-default: the 3.0 start-up duties and the trunk policy (also read by branch-guard).
     join(cwd, '.rsc', 'team-safe-start.mjs'),
     join(cwd, '.rsc', 'trunk-policy.mjs'),
+    // The copy guard and the rules it reads: wired for every Claude project.
+    join(cwd, '.rsc', 'copy-guard.mjs'),
+    join(cwd, '.rsc', 'copy-rules.mjs'),
   ];
   // The danger guard is declared on its own terms (#273): present unless the plan says otherwise,
   // whether or not the code guards are.

package/scripts/rsc.js

@@ -46,7 +46,7 @@ if (['--version', '-v', 'version'].includes(rawArgv[0])) {
   process.exit(0);
 }
 const GENERAL_HELP = [
-  'Use: npx @ericrisco/rsc onboard | reassess | add <id...> | install --profile <p> | consult "<text>" | list | capabilities [--full|gap-log] | audit | registry refresh | doctor | sync | agent-model <target> <model|inherit|status> | agents [status|reset <name|--all>] | memory <on|off|status|save|resume|learn|metrics> | review consolidate [reports…] | sello <on|off|status|…> | worktrees [reap [path] [--confirm]] | backups | restore <id|latest> | upgrade | repair | uninstall <id...> | purge | help',
+  'Use: npx @ericrisco/rsc onboard | reassess | add <id...> | install --profile <p> | consult "<text>" | list | capabilities [--full|gap-log] | audit | registry refresh | doctor | sync | agent-model <target> <model|inherit|status> | agents [status|reset <name|--all>] | memory <on|off|status|save|resume|learn|metrics> | review consolidate [reports…] | copy check <file> | copy rules | sello <on|off|status|…> | worktrees [reap [path] [--confirm]] | backups | restore <id|latest> | upgrade | repair | uninstall <id...> | purge | help',
   'Any command takes --target <claude|codex|cursor|copilot|gemini|…> (comma-separate for several)',
   '   → without it, rsc uses the assistant already installed here; if two are, it asks instead of guessing.',
 ].join('\n');
@@ -77,7 +77,7 @@ const PURGE_HELP = [
 const GLOBAL_VALUE_FLAGS = new Set([
   '--target', '--technical-level', '--accompaniment', '--project-kind', '--goal', '--goal-base64', '--software-scope', '--workflow', '--accept-plan',
 ]);
-const COMMANDS = new Set(['onboard', 'reassess', 'add', 'install', 'consult', 'catalog', 'audit', 'list', 'doctor', 'memory', 'knowledge-sync', 'git-permissions', 'agent-model', 'agents', 'main', 'isolation', 'sync', 'backups', 'restore', 'upgrade', 'registry', 'worktrees', 'capabilities', 'review', 'sello', 'repair', 'uninstall', 'purge']);
+const COMMANDS = new Set(['copy', 'onboard', 'reassess', 'add', 'install', 'consult', 'catalog', 'audit', 'list', 'doctor', 'memory', 'knowledge-sync', 'git-permissions', 'agent-model', 'agents', 'main', 'isolation', 'sync', 'backups', 'restore', 'upgrade', 'registry', 'worktrees', 'capabilities', 'review', 'sello', 'repair', 'uninstall', 'purge']);
 function positionalTokens(input) {
   const out = [];
   for (let i = 0; i < input.length; i++) {
@@ -1181,6 +1181,36 @@ async function main() {
       say('Use: npx @ericrisco/rsc registry refresh | registry status');
       return;
     }
+    case 'copy': {
+      // The phrases this project forbids in what it publishes (targets/copy-rules.mjs). `check` is the
+      // gate the copy skills run before delivering text; the Claude Stop hook runs the same check.
+      const USE = 'Use: npx @ericrisco/rsc copy check <file|-> [--json] | copy rules [--json]\n  Rules come from 02-DOCS/wiki/: a "Never use" / "Frases prohibidas" section, a "Never use: a, b" line, or a sentence that prohibits quoted phrases.';
+      const sub = argv[1];
+      if (sub !== 'check' && sub !== 'rules') { say(USE); if (sub) process.exitCode = 1; return; }
+      const { readFileSync } = await import('node:fs');
+      const C = await import('../targets/copy-rules.mjs');
+      const rules = C.loadRules(process.cwd());
+      if (sub === 'rules') {
+        if (argv.includes('--json')) say(JSON.stringify(rules, null, 2));
+        else say(rules.length ? rules.map((r) => `${r.phrase}  (${r.source}:${r.line})`).join('\n') : 'No banned phrases declared in 02-DOCS/wiki/.');
+        return;
+      }
+      const file = argv.slice(2).find((a) => !a.startsWith('--'));
+      let text = '';
+      try {
+        if (file && file !== '-') text = readFileSync(file, 'utf8');
+        else if (!process.stdin.isTTY) text = readFileSync(0, 'utf8');
+        else { say(USE); process.exitCode = 1; return; }
+      } catch (e) { say(`rsc: cannot read ${file || 'stdin'} (${e.code || e.message}).`); process.exitCode = 1; return; }
+      const hits = C.findViolations(C.proseOnly(text), rules);
+      const where = file && file !== '-' ? file : 'stdin';
+      if (argv.includes('--json')) say(JSON.stringify({ rules: rules.length, hits }, null, 2));
+      else if (!rules.length) say('No banned phrases declared in 02-DOCS/wiki/: nothing to check.');
+      else if (!hits.length) say(`RSC_COPY_CLEAN · ${rules.length} rule(s) checked.`);
+      else say(['RSC_COPY_VIOLATION · rewrite without these (a negation still counts):', ...hits.map((h) => `  ${where}:${h.line}  "${h.phrase}" found as "${h.match}"  (rule in ${h.source})`)].join('\n'));
+      if (hits.length) process.exitCode = 1;
+      return;
+    }
     case 'review': {
       // `review consolidate` — the deterministic half of the refuter panel (P1): the three lenses
       // often report one defect three ways, so grouping happens here, by location and evidence, and

package/skills/ads/SKILL.md

@@ -140,6 +140,15 @@ this gate before judging any campaign:
 Hand the reporting/dashboards to the `analytics` / `dashboard` skills — you set up
 the signal; they build the read-out.
 
+## Banned phrases gate (before you deliver)
+
+The project's forbidden phrases are enforced, not suggested. Before handing over copy meant to be
+published, write it to a scratch file and run `npx @ericrisco/rsc copy check <file>`. On
+`RSC_COPY_VIOLATION`, rewrite and check again. A negation still counts ("this is not X" uses X), so
+say what it is instead. When the person states a new ban, record it in
+`02-DOCS/wiki/brand/voice-guide.md` under `## Never use`, one phrase per bullet (`word*` also covers
+its derivatives). In Claude Code a Stop hook runs the same check on your final answer.
+
 ## Anti-patterns
 
 | Anti-pattern | Why it fails | Do instead |

package/skills/brand-voice/SKILL.md

@@ -139,6 +139,15 @@ To score a sample against the guide, run three passes:
 
 Off-brand reads like everyone else: abstract nouns, hedged claims, AI tells, energy faked with punctuation instead of verbs. The fix is always a rewrite toward a rule, never "make it pop."
 
+## Banned phrases gate (before you deliver)
+
+The project's forbidden phrases are enforced, not suggested. Before handing over copy meant to be
+published, write it to a scratch file and run `npx @ericrisco/rsc copy check <file>`. On
+`RSC_COPY_VIOLATION`, rewrite and check again. A negation still counts ("this is not X" uses X), so
+say what it is instead. When the person states a new ban, record it in
+`02-DOCS/wiki/brand/voice-guide.md` under `## Never use`, one phrase per bullet (`word*` also covers
+its derivatives). In Claude Code a Stop hook runs the same check on your final answer.
+
 ## Anti-patterns
 
 | Anti-pattern | Why it fails | Do this instead |

package/skills/content-engine/SKILL.md

@@ -132,6 +132,15 @@ The derivative menu, a worked 1→10 example, and per-channel Bad→Good rewrite
 
 The tell: if the ask is **the system that decides what gets made, when, and how it moves**, it is here. If the ask is **producing one artifact** or **the act of distributing**, it is a sibling.
 
+## Banned phrases gate (before you deliver)
+
+The project's forbidden phrases are enforced, not suggested. Before handing over copy meant to be
+published, write it to a scratch file and run `npx @ericrisco/rsc copy check <file>`. On
+`RSC_COPY_VIOLATION`, rewrite and check again. A negation still counts ("this is not X" uses X), so
+say what it is instead. When the person states a new ban, record it in
+`02-DOCS/wiki/brand/voice-guide.md` under `## Never use`, one phrase per bullet (`word*` also covers
+its derivatives). In Claude Code a Stop hook runs the same check on your final answer.
+
 ## Anti-patterns
 
 | Anti-pattern | Why it fails | Do instead |

package/skills/landing-copy/SKILL.md

@@ -121,6 +121,15 @@ These are skeletons to fill with the buyer's actual language, not fill-in templa
 
 Common stack: **PAS/AIDA hook → FAB offer → proof → CTA.** How much you agitate the problem before the offer depends on traffic temperature (cold needs more, warm goes straight to the offer). Full explanations with fresh examples and the awareness-stage note → `references/frameworks.md`.
 
+## Banned phrases gate (before you deliver)
+
+The project's forbidden phrases are enforced, not suggested. Before handing over copy meant to be
+published, write it to a scratch file and run `npx @ericrisco/rsc copy check <file>`. On
+`RSC_COPY_VIOLATION`, rewrite and check again. A negation still counts ("this is not X" uses X), so
+say what it is instead. When the person states a new ban, record it in
+`02-DOCS/wiki/brand/voice-guide.md` under `## Never use`, one phrase per bullet (`word*` also covers
+its derivatives). In Claude Code a Stop hook runs the same check on your final answer.
+
 ## Anti-patterns → fix
 
 | Rationalization | Reality / Fix |

package/skills/linkedin-content/SKILL.md

@@ -138,6 +138,15 @@ Full templates with char budgets for all three formats live in `references/hooks
 
 If the project has an `02-DOCS/` post log, read it before drafting: pull prior posts and their measured outcomes (impressions, dwell, comments, saves) and bias the new draft toward the hook patterns, formats, and CTA types that actually performed *for this account* — not generic best practice. Then log the new post back with its hook, format, and CTA type so the next draft is sharper. The front-matter schema (date, format, hook, cta_type, impressions, dwell_s, comments, saves) is in `references/hooks-and-formats.md`.
 
+## Banned phrases gate (before you deliver)
+
+The project's forbidden phrases are enforced, not suggested. Before handing over copy meant to be
+published, write it to a scratch file and run `npx @ericrisco/rsc copy check <file>`. On
+`RSC_COPY_VIOLATION`, rewrite and check again. A negation still counts ("this is not X" uses X), so
+say what it is instead. When the person states a new ban, record it in
+`02-DOCS/wiki/brand/voice-guide.md` under `## Never use`, one phrase per bullet (`word*` also covers
+its derivatives). In Claude Code a Stop hook runs the same check on your final answer.
+
 ## Anti-patterns
 
 | Anti-pattern | Why it kills the post | Fix |

package/skills/marketing/SKILL.md

@@ -147,6 +147,15 @@ Good — "We rebuilt deploys around one CLI step. Here's what changed: 22 min
 
 The brand study's do/don't word lists EXTEND this list per project — always apply both.
 
+## Banned phrases gate (before you deliver)
+
+The project's forbidden phrases are enforced, not suggested. Before handing over copy meant to be
+published, write it to a scratch file and run `npx @ericrisco/rsc copy check <file>`. On
+`RSC_COPY_VIOLATION`, rewrite and check again. A negation still counts ("this is not X" uses X), so
+say what it is instead. When the person states a new ban, record it in
+`02-DOCS/wiki/brand/voice-guide.md` under `## Never use`, one phrase per bullet (`word*` also covers
+its derivatives). In Claude Code a Stop hook runs the same check on your final answer.
+
 ## Anti-patterns
 
 | Anti-pattern | Why it fails / the fix |

package/targets/claude.js

@@ -277,6 +277,20 @@ export function wireHook(paths, sourceMd, policy = {}) {
   } else rmSync(join(paths.projectRoot, '.rsc', 'ftd-nudge.mjs'), { force: true });
   if (!settings.hooks.PostToolUse.length) delete settings.hooks.PostToolUse;
 
+  // Copy guard: a Stop hook that refuses a final answer carrying a phrase the project forbids in what
+  // it publishes. Every wired project gets it because brand rules are not a software concern; it is
+  // silent and costs one directory read where no rules are declared. Opt-out: .rsc/.no-copy-guard.
+  settings.hooks.Stop ||= [];
+  settings.hooks.Stop = settings.hooks.Stop.filter((e) => !hookWiringOf(e).includes('.rsc/copy-guard.'));
+  {
+    const cgDest = join(paths.projectRoot, '.rsc', 'copy-guard.mjs');
+    copyFileSync(join(HERE, 'copy-rules.mjs'), join(paths.projectRoot, '.rsc', 'copy-rules.mjs'));
+    copyFileSync(join(HERE, 'copy-guard.mjs'), cgDest);
+    const cgCmd = viaBootstrap('quiet', at('.rsc', 'copy-guard.mjs'), `"${P}"`);
+    settings.hooks.Stop.push({ hooks: [{ type: 'command', command: cgCmd, timeout: 10 }] });
+    written.push(cgDest, join(paths.projectRoot, '.rsc', 'copy-rules.mjs'));
+  }
+
   // Danger guard: its own decision, not part of the code-hook block above (#273). `init` promises it
   // to non-technical and mixed users whatever the project is, and a plan that predates the field is
   // read as "yes": a non-technical operations install gets the guard it was missing on its next sync,

package/targets/clone-bootstrap.mjs

@@ -43,7 +43,7 @@ const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9a-z.-]+)?$/i;
  * nothing checks is just drift with a head start.
  */
 export const PROJECT_OPT_OUTS = [
-  'audit', 'auto-update', 'claudemd-check', 'danger-guard', 'feature-gate', 'ftd-close', 'ftd-nudge', 'gitmoji', 'knowledge-sync', 'ship-guard', 'trunk-guard', 'trunk-open', 'worktree-cleanup', 'worktree-isolation',
+  'audit', 'auto-update', 'claudemd-check', 'copy-guard', 'danger-guard', 'feature-gate', 'ftd-close', 'ftd-nudge', 'gitmoji', 'knowledge-sync', 'ship-guard', 'trunk-guard', 'trunk-open', 'worktree-cleanup', 'worktree-isolation',
 ];
 
 /**

package/targets/copy-guard.mjs

@@ -0,0 +1,85 @@
+// Copy guard — a Claude Code Stop hook that refuses to let a final answer carry a phrase the project
+// has forbidden (rules: targets/copy-rules.mjs).
+//
+// Why a hook and not another instruction: the instruction already existed, and the model read it,
+// quoted it, and still wrote "no es una red de captación" because it decided a negation was allowed.
+// The Stop hook runs after the model has finished, on the text the reader is about to get, so the
+// decision is no longer the model's. It blocks once per turn with the exact phrases and where the
+// rule lives; the model rewrites. A second stop in the same turn is let through (stop_hook_active),
+// so a rule that cannot be satisfied never traps the session in a loop.
+//
+// Silent and free when the project declares no banned phrases, which is almost every project.
+// Fails open on any error. Opt out with .rsc/.no-copy-guard.
+import { existsSync, readFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadRules, findViolations, proseOnly } from './copy-rules.mjs';
+
+const TAIL_BYTES = 2_000_000;
+
+/** The text of the last assistant turn, read from the end of the transcript. */
+export function lastAssistantText(transcriptPath) {
+  let raw = '';
+  try {
+    const size = statSync(transcriptPath).size;
+    const start = Math.max(0, size - TAIL_BYTES);
+    const fd = openSync(transcriptPath, 'r');
+    const buf = Buffer.alloc(size - start);
+    readSync(fd, buf, 0, buf.length, start);
+    closeSync(fd);
+    raw = buf.toString('utf8');
+  } catch { return ''; }
+  const entries = raw.split('\n').map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+  const texts = [];
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const e = entries[i];
+    const msg = e.message || {};
+    const content = msg.content;
+    if (e.type === 'user' || msg.role === 'user') {
+      // A tool result belongs to the assistant's own turn; a real prompt ends the search.
+      const isToolResult = Array.isArray(content) && content.length && content.every((c) => c && c.type === 'tool_result');
+      if (!isToolResult) break;
+      continue;
+    }
+    if (e.type === 'assistant' || msg.role === 'assistant') {
+      if (typeof content === 'string') texts.unshift(content);
+      else if (Array.isArray(content)) texts.unshift(content.filter((c) => c && c.type === 'text').map((c) => c.text).join('\n'));
+    }
+  }
+  return texts.join('\n');
+}
+
+/** The hook's decision, pure enough to test: a block object, or null. */
+export function decide(root, input) {
+  if (existsSync(join(root, '.rsc', '.no-copy-guard'))) return null;
+  if (input.stop_hook_active) return null;
+  const rules = loadRules(root);
+  if (!rules.length) return null;
+  const text = typeof input.last_assistant_message === 'string' && input.last_assistant_message
+    ? input.last_assistant_message
+    : input.transcript_path ? lastAssistantText(input.transcript_path) : '';
+  if (!text) return null;
+  const hits = findViolations(proseOnly(text), rules);
+  if (!hits.length) return null;
+  const seen = new Set();
+  const list = hits.filter((h) => !seen.has(h.phrase) && seen.add(h.phrase))
+    .map((h) => `- "${h.phrase}" (found as "${h.match}", line ${h.line}; rule in ${h.source})`).join('\n');
+  return {
+    decision: 'block',
+    reason: `rsc copy guard: your answer uses phrases this project forbids in what it publishes:\n${list}\n`
+      + 'Rewrite the answer without them. A negation still counts ("this is not X" uses X): say what it is instead. '
+      + 'Reply in the person\'s language. If you need to name a banned phrase when talking about the rule, put it inside `backticks`; '
+      + 'text in backticks is not checked. If the person explicitly asked for the phrase, say so in one line and keep it.',
+  };
+}
+
+const self = fileURLToPath(import.meta.url);
+if (process.argv[1] && resolve(process.argv[1]) === self) {
+  try {
+    const root = process.argv[2] || process.cwd();
+    const input = JSON.parse(readFileSync(0, 'utf8') || '{}');
+    const out = decide(root, input);
+    if (out) process.stdout.write(JSON.stringify(out));
+  } catch { /* fail open */ }
+  process.exit(0);
+}

package/targets/copy-rules.mjs

@@ -0,0 +1,144 @@
+// Project copy rules: the phrases a project has forbidden in anything it publishes.
+//
+// Until this file existed those rules were prose the model read and interpreted. A student's project
+// banned recruitment wording in decisions.md, and the agent still delivered "this is not a recruitment
+// network": it judged that negating a banned word was allowed. A rule the model can reinterpret is a
+// preference. This module turns the project's own wording into patterns a script can check, so the
+// copy guard (targets/copy-guard.mjs) and `rsc copy check` enforce it without asking the model.
+//
+// Where rules come from, all under 02-DOCS/wiki/ (raw/ is unprocessed input, not policy):
+//   1. a heading that names a ban ("## Never use", "## Frases prohibidas") → its bullet items;
+//   2. a "Never use: a, b, c" line → its comma-separated items;
+//   3. a sentence that prohibits ("Queda prohibido …", "Never say …") → its quoted phrases.
+// Only node builtins: the file is copied next to the hook and must run with nothing installed.
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+const BAN = String.raw`(?:prohib\p{L}*|forbid\p{L}*|banned|ban list|never (?:use|say|write)|nunca (?:uses|usar|digas|decir|escribas)|no (?:uses|digas|escribas)|do not (?:use|say|write)|don'?t (?:use|say|write)|vetad\p{L}*|blocklist|denylist)`;
+const BAN_HEADING = new RegExp(BAN, 'iu');
+const BAN_SENTENCE = new RegExp(BAN, 'iu');
+const BAN_COLON = new RegExp(String.raw`^\s*(?:[-*+]\s+)?\**\s*(?:[\p{L} ]{0,20}\s)?${BAN}[^:]{0,20}:\**\s*(.+)$`, 'iu');
+const QUOTED = /"([^"\n]{1,80})"|“([^”\n]{1,80})”|«([^»\n]{1,80})»|`([^`\n]{1,80})`/gu;
+
+export const normalize = (s) => String(s).normalize('NFD').replace(/\p{M}/gu, '').toLowerCase();
+
+// A trailing * is the explicit wildcard, so only a markdown bold pair is stripped from the end.
+const clean = (s) => s.replace(/^[\s"“«`'*_]+/u, '').replace(/\*\*$/u, '').replace(/[\s"”»`'_.;:,]+$/u, '').trim();
+
+function quotedIn(text) {
+  const out = [];
+  for (const m of text.matchAll(QUOTED)) out.push(m[1] ?? m[2] ?? m[3] ?? m[4]);
+  return out;
+}
+
+function listItems(text) {
+  const q = quotedIn(text);
+  if (q.length) return q;
+  return text.split(/[,;]|\s+(?:y|and|o|or)\s+/u).map(clean).filter(Boolean);
+}
+
+/** Banned phrases declared in one markdown document. */
+export function extractRules(markdown, source = '') {
+  const found = [];
+  const add = (phrase, line) => {
+    const p = clean(phrase);
+    // A ban is a word or a short phrase. Anything longer is a sentence that happened to be quoted.
+    if (p && p.split(/\s+/).length <= 6 && /\p{L}/u.test(p)) found.push({ phrase: p, source, line });
+  };
+  const lines = String(markdown).split('\n');
+  let inFence = false, banSection = false, para = [], paraStart = 0;
+  const flush = () => {
+    if (!para.length) return;
+    const text = para.join(' ');
+    for (const sentence of text.split(/(?<=[.!?])\s+(?=[\p{Lu}¿¡"“«])/u)) {
+      if (BAN_SENTENCE.test(sentence)) for (const q of quotedIn(sentence)) add(q, paraStart + 1);
+    }
+    para = [];
+  };
+  lines.forEach((raw, i) => {
+    if (/^\s*```/.test(raw)) { flush(); inFence = !inFence; return; }
+    if (inFence) return;
+    const heading = raw.match(/^#{1,6}\s+(.*)$/);
+    if (heading) { flush(); banSection = BAN_HEADING.test(heading[1]); return; }
+    if (!raw.trim()) { flush(); return; }
+    const colon = raw.match(BAN_COLON);
+    if (colon && !quotedIn(raw.slice(0, raw.indexOf(':'))).length) { flush(); for (const item of listItems(colon[1])) add(item, i + 1); return; }
+    const bullet = raw.match(/^\s*(?:[-*+]|\d+[.)])\s+(.*)$/);
+    if (bullet && banSection) { flush(); for (const item of listItems(bullet[1])) add(item, i + 1); return; }
+    if (bullet) { flush(); para = [bullet[1]]; paraStart = i; flush(); return; }
+    if (!para.length) paraStart = i;
+    para.push(raw.trim());
+  });
+  flush();
+  return found;
+}
+
+/** Every rule in the project's wiki, de-duplicated by its normalized phrase. */
+export function loadRules(root, { maxFiles = 3000 } = {}) {
+  const base = join(root, '02-DOCS', 'wiki');
+  const files = [];
+  const walk = (dir) => {
+    let entries = [];
+    try { entries = readdirSync(dir); } catch { return; }
+    for (const name of entries) {
+      if (files.length >= maxFiles || name.startsWith('.')) continue;
+      const full = join(dir, name);
+      let st; try { st = statSync(full); } catch { continue; }
+      if (st.isDirectory()) walk(full);
+      else if (name.endsWith('.md')) files.push(full);
+    }
+  };
+  walk(base);
+  const seen = new Map();
+  for (const f of files) {
+    let body = '';
+    try { body = readFileSync(f, 'utf8'); } catch { continue; }
+    for (const r of extractRules(body, relative(root, f).split('\\').join('/'))) {
+      const key = normalize(r.phrase);
+      if (!seen.has(key)) seen.set(key, r);
+    }
+  }
+  return [...seen.values()];
+}
+
+const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/**
+ * The pattern for one phrase. A trailing * widens it explicitly. A single Spanish infinitive is the
+ * one implicit widening, because that is how such bans are written and how they leak: "captar"
+ * forbidden, "captación" delivered. Only forms that continue the stem with the verb's own vowels
+ * count, so "captar" catches "capta", "captación", "captando" and leaves "captura" alone.
+ */
+export function patternOf(phrase) {
+  let p = normalize(phrase).trim();
+  let tail = '(?![\\p{L}\\p{N}])';
+  if (p.endsWith('*')) { p = p.slice(0, -1); tail = '[\\p{L}\\p{N}]*'; }
+  else if (/^\p{L}{3,}(ar|er|ir)$/u.test(p)) {
+    const vowels = p.endsWith('ar') ? '[aeo]' : '[aeio]';
+    return new RegExp(`(?<![\\p{L}\\p{N}])${esc(p.slice(0, -2))}${vowels}\\p{L}*`, 'gu');
+  }
+  const body = p.split(/\s+/).map(esc).join('\\s+');
+  return new RegExp(`(?<![\\p{L}\\p{N}])${body}${tail}`, 'gu');
+}
+
+/** Text with code removed: an agent may cite a rule inside backticks without it counting as copy. */
+export function proseOnly(text) {
+  return String(text)
+    .replace(/```[\s\S]*?(?:```|$)/g, (m) => m.replace(/[^\n]/g, ' '))
+    .replace(/`[^`\n]*`/g, (m) => ' '.repeat(m.length));
+}
+
+/** Each place the text uses a banned phrase: { phrase, source, line, match }. */
+export function findViolations(text, rules) {
+  const hits = [];
+  const compiled = rules.map((r) => ({ r, re: patternOf(r.phrase) }));
+  String(text).split('\n').forEach((raw, i) => {
+    const line = normalize(raw);
+    for (const { r, re } of compiled) {
+      re.lastIndex = 0;
+      const m = re.exec(line);
+      if (m) hits.push({ phrase: r.phrase, source: r.source, line: i + 1, match: m[0] });
+    }
+  });
+  return hits;
+}

package/targets/opt-outs.js

@@ -20,6 +20,7 @@ export const PROJECT_OPT_OUTS = [
   'audit',            // cadence of this project's skill audit
   'auto-update',      // installing new rsc releases alone: one machine ahead moves the team's catalogVersion
   'claudemd-check',   // the root CLAUDE.md context budget
+  'copy-guard',       // the Stop hook that enforces the project's banned phrases in delivered copy
   'danger-guard',     // foot-gun denial, keyed to the committed user profile
   'feature-gate',     // per-turn re-injection of the SDD gate
   'ftd-close',        // a landed branch's feature documents marked done by the post-merge hook