@hanzlaa/rcode 2.1.0

package/rihal/workflows/research-phase.md

@@ -0,0 +1,82 @@
+<purpose>
+Research how to implement a phase. Spawns rihal-phase-researcher with phase context.
+
+Standalone research command. For most workflows, use `/rihal:plan` which integrates research automatically.
+</purpose>
+
+<available_agent_types>
+Valid Rihal subagent types (use exact names — do not fall back to 'general-purpose'):
+- rihal-phase-researcher — Researches technical approaches for a phase
+</available_agent_types>
+
+<process>
+
+## Step 0: Resolve Model Profile
+
+@.rihal/references/model-profile-resolution.md
+
+Resolve model for:
+- `rihal-phase-researcher`
+
+## Step 1: Normalize and Validate Phase
+
+@.rihal/references/phase-argument-parsing.md
+
+```bash
+PHASE_INFO=$(node ".rihal/bin/rihal-tools.cjs" roadmap get-phase "${PHASE}")
+```
+
+If `found` is false: Error and exit.
+
+## Step 2: Check Existing Research
+
+```bash
+ls .planning/phases/${PHASE}-*/RESEARCH.md 2>/dev/null || true
+```
+
+If exists: Offer update/view/skip options.
+
+## Step 3: Gather Phase Context
+
+```bash
+INIT=$(node ".rihal/bin/rihal-tools.cjs" init phase-op "${PHASE}")
+if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
+# Extract: phase_dir, padded_phase, phase_number, state_path, requirements_path, context_path
+AGENT_SKILLS_RESEARCHER=$(node ".rihal/bin/rihal-tools.cjs" agent-skills rihal-researcher 2>/dev/null)
+```
+
+## Step 4: Spawn Researcher
+
+```
+Task(
+  prompt="<objective>
+Research implementation approach for Phase {phase}: {name}
+</objective>
+
+<files_to_read>
+- {context_path} (USER DECISIONS from /rihal:discuss-phase)
+- {requirements_path} (Project requirements)
+- {state_path} (Project decisions and history)
+</files_to_read>
+
+${AGENT_SKILLS_RESEARCHER}
+
+<additional_context>
+Phase description: {description}
+</additional_context>
+
+<output>
+Write to: .planning/phases/${PHASE}-{slug}/${PHASE}-RESEARCH.md
+</output>",
+  subagent_type="rihal-phase-researcher",
+  model="{researcher_model}"
+)
+```
+
+## Step 5: Handle Return
+
+- `## RESEARCH COMPLETE` — Display summary, offer: Plan/Dig deeper/Review/Done
+- `## CHECKPOINT REACHED` — Present to user, spawn continuation
+- `## RESEARCH INCONCLUSIVE` — Show attempts, offer: Add context/Try different mode/Manual
+
+</process>

package/rihal/workflows/resume-work.md

@@ -0,0 +1,326 @@
+<trigger>
+Use this workflow when:
+- Starting a new session on an existing project
+- User says "continue", "what's next", "where were we", "resume"
+- Any planning operation when .planning/ already exists
+- User returns after time away from project
+</trigger>
+
+<purpose>
+Instantly restore full project context so "Where were we?" has an immediate, complete answer.
+</purpose>
+
+<required_reading>
+@.rihal/references/continuation-format.md
+</required_reading>
+
+<process>
+
+<step name="initialize">
+Load all context in one call:
+
+```bash
+INIT=$(node ".rihal/bin/rihal-tools.cjs" init resume)
+if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
+```
+
+Parse JSON for: `state_exists`, `roadmap_exists`, `project_exists`, `planning_exists`, `has_interrupted_agent`, `interrupted_agent_id`, `commit_docs`.
+
+**If `state_exists` is true:** Proceed to load_state
+**If `state_exists` is false but `roadmap_exists` or `project_exists` is true:** Offer to reconstruct STATE.md
+**If `planning_exists` is false:** This is a new project - route to /rihal:new-project
+</step>
+
+<step name="load_state">
+
+Read and parse STATE.md, then PROJECT.md:
+
+```bash
+cat .planning/STATE.md
+cat .planning/PROJECT.md
+```
+
+**From STATE.md extract:**
+
+- **Project Reference**: Core value and current focus
+- **Current Position**: Phase X of Y, Plan A of B, Status
+- **Progress**: Visual progress bar
+- **Recent Decisions**: Key decisions affecting current work
+- **Pending Todos**: Ideas captured during sessions
+- **Blockers/Concerns**: Issues carried forward
+- **Session Continuity**: Where we left off, any resume files
+
+**From PROJECT.md extract:**
+
+- **What This Is**: Current accurate description
+- **Requirements**: Validated, Active, Out of Scope
+- **Key Decisions**: Full decision log with outcomes
+- **Constraints**: Hard limits on implementation
+
+</step>
+
+<step name="check_incomplete_work">
+Look for incomplete work that needs attention:
+
+```bash
+# Check for structured handoff (preferred — machine-readable)
+cat .planning/HANDOFF.json 2>/dev/null || true
+
+# Check for continue-here files (mid-plan resumption)
+ls .planning/phases/*/.continue-here*.md 2>/dev/null || true
+
+# Check for plans without summaries (incomplete execution)
+for plan in .planning/phases/*/*-SPRINT.md; do
+  [ -e "$plan" ] || continue
+  summary="${plan/PLAN/SUMMARY}"
+  [ ! -f "$summary" ] && echo "Incomplete: $plan"
+done 2>/dev/null || true
+
+# Check for interrupted agents (use has_interrupted_agent and interrupted_agent_id from init)
+if [ "$has_interrupted_agent" = "true" ]; then
+  echo "Interrupted agent: $interrupted_agent_id"
+fi
+```
+
+**If HANDOFF.json exists:**
+
+- This is the primary resumption source — structured data from `/rihal:pause-work`
+- Parse `status`, `phase`, `plan`, `task`, `total_tasks`, `next_action`
+- Check `blockers` and `human_actions_pending` — surface these immediately
+- Check `completed_tasks` for `in_progress` items — these need attention first
+- Validate `uncommitted_files` against `git status` — flag divergence
+- Use `context_notes` to restore mental model
+- Flag: "Found structured handoff — resuming from task {task}/{total_tasks}"
+- **After successful resumption, delete HANDOFF.json** (it's a one-shot artifact)
+
+**If .continue-here file exists (fallback):**
+
+- This is a mid-plan resumption point
+- Read the file for specific resumption context
+- Flag: "Found mid-plan checkpoint"
+
+**If PLAN without SUMMARY exists:**
+
+- Execution was started but not completed
+- Flag: "Found incomplete plan execution"
+
+**If interrupted agent found:**
+
+- Subagent was spawned but session ended before completion
+- Read agent-history.json for task details
+- Flag: "Found interrupted agent"
+  </step>
+
+<step name="present_status">
+Present complete project status to user:
+
+```
+╔══════════════════════════════════════════════════════════════╗
+║  PROJECT STATUS                                               ║
+╠══════════════════════════════════════════════════════════════╣
+║  Building: [one-liner from PROJECT.md "What This Is"]         ║
+║                                                               ║
+║  Phase: [X] of [Y] - [Phase name]                            ║
+║  Plan:  [A] of [B] - [Status]                                ║
+║  Progress: [██████░░░░] XX%                                  ║
+║                                                               ║
+║  Last activity: [date] - [what happened]                     ║
+╚══════════════════════════════════════════════════════════════╝
+
+[If incomplete work found:]
+⚠️  Incomplete work detected:
+    - [.continue-here file or incomplete plan]
+
+[If interrupted agent found:]
+⚠️  Interrupted agent detected:
+    Agent ID: [id]
+    Task: [task description from agent-history.json]
+    Interrupted: [timestamp]
+
+    Resume with: Task tool (resume parameter with agent ID)
+
+[If pending todos exist:]
+📋 [N] pending todos — /rihal:check-todos to review
+
+[If blockers exist:]
+⚠️  Carried concerns:
+    - [blocker 1]
+    - [blocker 2]
+
+[If alignment is not ✓:]
+⚠️  Brief alignment: [status] - [assessment]
+```
+
+</step>
+
+<step name="determine_next_action">
+Based on project state, determine the most logical next action:
+
+**If interrupted agent exists:**
+→ Primary: Resume interrupted agent (Task tool with resume parameter)
+→ Option: Start fresh (abandon agent work)
+
+**If HANDOFF.json exists:**
+→ Primary: Resume from structured handoff (highest priority — specific task/blocker context)
+→ Option: Discard handoff and reassess from files
+
+**If .continue-here file exists:**
+→ Fallback: Resume from checkpoint
+→ Option: Start fresh on current plan
+
+**If incomplete plan (PLAN without SUMMARY):**
+→ Primary: Complete the incomplete plan
+→ Option: Abandon and move on
+
+**If phase in progress, all plans complete:**
+→ Primary: Advance to next phase (via internal transition workflow)
+→ Option: Review completed work
+
+**If phase ready to plan:**
+→ Check if CONTEXT.md exists for this phase:
+
+- If CONTEXT.md missing:
+  → Primary: Discuss phase vision (how user imagines it working)
+  → Secondary: Plan directly (skip context gathering)
+- If CONTEXT.md exists:
+  → Primary: Plan the phase
+  → Option: Review roadmap
+
+**If phase ready to execute:**
+→ Primary: Execute next plan
+→ Option: Review the plan first
+</step>
+
+<step name="offer_options">
+Present contextual options based on project state:
+
+```
+What would you like to do?
+
+[Primary action based on state - e.g.:]
+1. Resume interrupted agent [if interrupted agent found]
+   OR
+1. Execute phase (/rihal:execute-phase {phase} ${Rihal_WS})
+   OR
+1. Discuss Phase 3 context (/rihal:discuss-phase 3 ${Rihal_WS}) [if CONTEXT.md missing]
+   OR
+1. Plan Phase 3 (/rihal:plan 3 ${Rihal_WS}) [if CONTEXT.md exists or discuss option declined]
+
+[Secondary options:]
+2. Review current phase status
+3. Check pending todos ([N] pending)
+4. Review brief alignment
+5. Something else
+```
+
+**Note:** When offering phase planning, check for CONTEXT.md existence first:
+
+```bash
+ls .planning/phases/XX-name/*-CONTEXT.md 2>/dev/null || true
+```
+
+If missing, suggest discuss-phase before plan. If exists, offer plan directly.
+
+Wait for user selection.
+</step>
+
+<step name="route_to_workflow">
+Based on user selection, route to appropriate workflow:
+
+- **Execute plan** → Show command for user to run after clearing:
+  ```
+  ---
+
+  ## ▶ Next Up
+
+  **{phase}-{plan}: [Plan Name]** — [objective from SPRINT.md]
+
+  `/clear` then:
+
+  `/rihal:execute-phase {phase} ${Rihal_WS}`
+
+  ---
+  ```
+- **Plan phase** → Show command for user to run after clearing:
+  ```
+  ---
+
+  ## ▶ Next Up
+
+  **Phase [N]: [Name]** — [Goal from ROADMAP.md]
+
+  `/clear` then:
+
+  `/rihal:plan [phase-number] ${Rihal_WS}`
+
+  ---
+
+  **Also available:**
+  - `/rihal:discuss-phase [N] ${Rihal_WS}` — gather context first
+  - `/rihal:research-phase [N] ${Rihal_WS}` — investigate unknowns
+
+  ---
+  ```
+- **Advance to next phase** → ./transition.md (internal workflow, invoked inline — NOT a user command)
+- **Check todos** → Read .planning/todos/pending/, present summary
+- **Review alignment** → Read PROJECT.md, compare to current state
+- **Something else** → Ask what they need
+</step>
+
+<step name="update_session">
+Before proceeding to routed workflow, update session continuity:
+
+Update STATE.md:
+
+```markdown
+## Session Continuity
+
+Last session: [now]
+Stopped at: Session resumed, proceeding to [action]
+Resume file: [updated if applicable]
+```
+
+This ensures if session ends unexpectedly, next resume knows the state.
+</step>
+
+</process>
+
+<reconstruction>
+If STATE.md is missing but other artifacts exist:
+
+"STATE.md missing. Reconstructing from artifacts..."
+
+1. Read PROJECT.md → Extract "What This Is" and Core Value
+2. Read ROADMAP.md → Determine phases, find current position
+3. Scan \*-SUMMARY.md files → Extract decisions, concerns
+4. Count pending todos in .planning/todos/pending/
+5. Check for .continue-here files → Session continuity
+
+Reconstruct and write STATE.md, then proceed normally.
+
+This handles cases where:
+
+- Project predates STATE.md introduction
+- File was accidentally deleted
+- Cloning repo without full .planning/ state
+  </reconstruction>
+
+<quick_resume>
+If user says "continue" or "go":
+- Load state silently
+- Determine primary action
+- Execute immediately without presenting options
+
+"Continuing from [state]... [action]"
+</quick_resume>
+
+<success_criteria>
+Resume is complete when:
+
+- [ ] STATE.md loaded (or reconstructed)
+- [ ] Incomplete work detected and flagged
+- [ ] Clear status presented to user
+- [ ] Contextual next actions offered
+- [ ] User knows exactly where project stands
+- [ ] Session continuity updated
+      </success_criteria>

package/rihal/workflows/review-adversarial.md

@@ -0,0 +1,180 @@
+# Workflow: rihal:review-adversarial
+
+<purpose>
+Assume an adversarial/hostile perspective and audit code for weaknesses: SQL injection, XSS, race conditions, data loss scenarios, unauthorized access, abuse cases, denial of service vectors. Output attack/weakness report that feeds into story AC or subtasks.
+</purpose>
+
+
+## Step 0 — Usage check
+
+If `$ARGUMENTS` is empty or contains only `--help` or `-h`:
+
+```
+/rihal:review-adversarial <argument-here>
+```
+
+**Examples:**
+```
+/rihal:review-adversarial example 1
+/rihal:review-adversarial example 2
+```
+
+STOP — do not proceed.
+
+<available_agent_types>
+- `rihal-security-adversary` — adversarial code reviewer (security-focused)
+</available_agent_types>
+
+## Step 0 — Initialize
+
+```bash
+INIT=$(node .rihal/bin/rihal-tools.cjs init review-adversarial "$ARGUMENTS")
+```
+
+Parse:
+- `flags.phase` — specific phase to review (optional)
+- `flags.component` — specific component/file (optional)
+- `review_path` — `.rihal/ADVERSARIAL-REVIEW-{phase}.md` or `.rihal/ADVERSARIAL-REVIEW.md`
+- `targets` — files/components to audit
+
+## Step 1 — Identify Review Targets
+
+**If `flags.component` provided:** Review single component
+```bash
+find {project} -name "{component}*" -type f
+```
+
+**If `flags.phase` provided:** Review all files changed in phase
+```bash
+git diff HEAD~{wave}..HEAD --name-only | grep -E '\.(js|ts|py|go|rs)$'
+```
+
+**Otherwise:** Review all source files in current phase/latest changes
+
+Collect:
+- File paths
+- File types (backend, frontend, API, database, etc.)
+- Lines of code per file
+- External dependencies used
+
+## Step 2 — Spawn Adversarial Reviewer
+
+Spawn `rihal-security-adversary` subagent:
+
+```
+Task tool call:
+  subagent_type: "rihal-security-adversary"
+  description: "Adversarial security review"
+  prompt: |
+    Conduct an adversarial security review. Assume a hostile perspective.
+    Goal: Find every possible way this code could be exploited, broken, or abused.
+    
+    **Files to audit:**
+    {target_files_with_contents}
+    
+    **Attack categories (audit all):**
+    
+    1. INJECTION ATTACKS
+       - SQL Injection (parameterized queries? raw string interpolation?)
+       - Command Injection (shell commands, subprocess, exec?)
+       - XSS (input sanitization? output encoding?)
+       - Template Injection
+    
+    2. AUTHENTICATION & AUTHORIZATION
+       - Session hijacking (JWT stored in localStorage?)
+       - Privilege escalation (role checks everywhere?)
+       - API key exposure (hardcoded, logged, in git history?)
+       - Insecure password storage
+    
+    3. DATA LOSS & CORRUPTION
+       - Race conditions (concurrent writes without locks?)
+       - Unprotected database transactions
+       - Missing rollback on error
+       - Unchecked third-party API failures
+    
+    4. DENIAL OF SERVICE
+       - Unbounded loops or recursion
+       - Excessive resource allocation (memory, CPU)
+       - No rate limiting on public endpoints
+       - Infinite file uploads
+    
+    5. ABUSE CASES
+       - Can user bypass limits (pagination, quotas)?
+       - Can user access data not theirs?
+       - Can user trigger expensive operations?
+       - Can user enumerate/discovery resources?
+    
+    For each vulnerability:
+    - Type (injection, authz, data loss, DoS, abuse)
+    - Severity (critical, high, medium, low)
+    - Attack scenario (specific steps to exploit)
+    - Impact (data breach, outage, corruption, etc.)
+    - Proof of concept (code snippet showing vulnerability)
+    - Fix (specific remediation)
+    
+    Output: ADVERSARIAL-REVIEW.md
+```
+
+## Step 3 — Store Review and File Tasks
+
+Write review to `.rihal/ADVERSARIAL-REVIEW-{phase}.md`
+
+Extract findings:
+- Critical vulnerabilities
+- High-risk issues
+- Medium-risk issues
+- Low-risk recommendations
+
+## Step 4 — File Security Tasks
+
+For each critical/high finding, optionally file as subtask:
+
+```bash
+node .rihal/bin/rihal-tools.cjs state add-task \
+  --title "Fix {vulnerability_type}: {brief_description}" \
+  --severity critical/high/medium \
+  --component {component_name}
+```
+
+Or add to story AC:
+
+Update `.rihal/story-current.md` acceptance criteria:
+
+```markdown
+## Security Requirements
+
+- [ ] No SQL injection vulnerabilities (parameterized queries)
+- [ ] All user input sanitized per OWASP guidelines
+- [ ] API keys not logged or stored in repository
+- [ ] Rate limiting on public endpoints
+- [ ] CSRF tokens on state-changing requests
+```
+
+Print:
+```
+🛡️ Adversarial Review Complete
+
+Findings by severity:
+  • Critical: {count}
+  • High: {count}
+  • Medium: {count}
+  • Low: {count}
+
+Review: {review_path}
+
+Critical findings filed as blocking AC. High findings as optional tasks.
+```
+
+## Success Criteria
+
+- ADVERSARIAL-REVIEW.md created
+- All 5 attack categories audited
+- Findings ranked by severity
+- Proof-of-concept included for each vulnerability
+- Critical/high issues filed as tasks or AC
+
+## On Error
+
+- If subagent fails: provide template adversarial review structure
+- If files too large: split review across multiple components
+- If no findings: report "No vulnerabilities found" (document assumptions)