@hanzlaa/rcode 2.8.0 → 3.2.0

package/AGENTS.md

@@ -24,7 +24,7 @@ If a user says "just keep going" or "don't stop until done", that authorization
 
 - Follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): subject`
 - Types allowed: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`, `perf`, `revert`
-- Scopes allowed: `agents`, `skills`, `workflows`, `templates`, `dashboard`, `docs`, `config`, `github`
+- Scopes allowed: `agents`, `skills`, `workflows`, `templates`, `dashboard`, `docs`, `config`, `github`, `commands`, `memory`, `brand`, `cli`, `ci`, `release`, `meta`, `tasks`, `migrations`, `refs`
 - Subject: lowercase first letter, imperative mood, no trailing period, under 72 chars
 - **NEVER add Claude/AI attribution to commit messages.** No "Generated with Claude Code", no "Co-Authored-By: Claude", no "🤖 Generated". The user does not want this.
 - **NEVER use `--no-verify`** to bypass hooks. If hooks fail, fix the underlying issue.
@@ -46,6 +46,16 @@ If a user says "just keep going" or "don't stop until done", that authorization
 
 ---
 
+## Naming & Branding (per `BRAND.md`)
+
+- **Skill names** in frontmatter: `rihal-<verb>-<noun>` for legacy skills; new branded skills use `rcode-<verb>-<noun>` ONLY in slash command surface (`/rcode:<name>`); folder names stay `rihal-*` because `cli/install.js` hardcodes that prefix.
+- **Persona IDs** in `team.yaml` stay `rihal-<name>` (dashboard scanner reads them by id; renaming breaks rendering).
+- **Persona display names** keep Arabic alongside Latin: `Sadiq (صادق)`, `Dalil (دليل)`, etc.
+- **Concept primitives** (Memory Bank, Distillate, Majlis, Diwan) are named tooling — capitalised, used consistently in user-facing copy.
+- **Plain English over jargon in flags.** Prefer `--attack` over `--adversarial`, `--edge-cases` over `--edge-case-hunter`. Audience includes non-native English speakers.
+
+---
+
 ## File Modification Rules
 
 - **Maximum file size: 1000 lines** — refactor before exceeding

package/CONTRIBUTING.md

@@ -2,6 +2,13 @@
 
 Thank you for contributing. These guidelines exist to keep the module maintainable and impressive when demoed.
 
+> **Before you contribute, also read:**
+> - [`BRAND.md`](BRAND.md) — voice, naming conventions, persona glossary
+> - [`AGENTS.md`](AGENTS.md) — non-negotiable rules for AI coding agents (commit policy, push policy, off-limits files)
+> - [`MIGRATIONS.md`](MIGRATIONS.md) — every renamed/dropped surface in the rcode improvement programme
+> - [`MEMORY_BANK.md`](MEMORY_BANK.md) — Memory Bank specification
+> - [`TASKS.md`](TASKS.md) — master task tracker driving GitHub issues
+
 ---
 
 ## Architecture overview — what are all these files?

package/README.md

@@ -1,16 +1,31 @@
-# Rihal Code
+# Rihal Code (rcode)
 
 <div dir="rtl">طريقة رحال</div>
 
-> **Install Rihal's brain into your project in one command.** Every Rihalian — engineer, PM, designer, CTO, QA — gets an AI assistant that already knows how Rihal builds: PR standards, commit conventions, architecture patterns, sprint cadence, the Rihal team's agent personas. No onboarding. No prompting. Works in Claude Code, Cursor, and any compatible AI IDE.
+> **rcode is the memory bank for AI-driven SaaS teams — your project's context, structured, visible, and never lost.**
+>
+> Built by Rihal. Designed for solo devs, startup teams, and SaaS builders. Install once, and your AI assistant gets a persistent project brain: structured memory, decisions log, distinctive personas, and phase-based workflows. Works in Claude Code, Cursor, and any compatible AI IDE.
+
+---
+
+## Who is rcode for
+
+You'll feel rcode pay off if you've lived any of these:
+
+- **AI agents lose context mid-project.** Three sessions in, the assistant has forgotten the architectural decision you made on day one.
+- **Onboarding a teammate** means a 30-minute archaeology dig through Slack, Notion, and review comments to explain "why we did it this way".
+- **Late client requirements** keep shifting the goal posts, and there's no record of what was decided when.
+- **MVPs that work but can't be revamped** without rewriting from scratch — the original context is lost.
+
+rcode addresses these with a checked-in **Memory Bank** (`.rihal/memory/`), distinctive engineering personas, and a phased workflow that survives session resets. **For everything in one place, read [`DOCS.md`](DOCS.md).** See [`MEMORY_BANK.md`](MEMORY_BANK.md) for the spec, and [`BRAND.md`](BRAND.md) for naming and voice conventions.
 
 ---
 
 ## Why this exists
 
-Every Rihal project carries unwritten context — how we review PRs, what "done" means, how we sequence milestones, how PRDs travel from Product into Engineering. That context sits in people's heads, Slack, Notion, senior engineers' review comments. AI assistants pick it up never, because every new chat session starts knowing nothing about how Rihal works.
+Every project carries unwritten context — how the team reviews PRs, what "done" means, how milestones sequence, how PRDs travel from Product into Engineering. That context sits in people's heads, Slack, Notion, and senior engineers' review comments. AI assistants pick it up never, because every new chat session starts knowing nothing about how this project actually works.
 
-**Rihal Code fixes that.** One install, and the AI knows. Every session. Every repo. Every Rihalian.
+**rcode fixes that.** One install, and the AI knows. Every session. Every repo. Every contributor.
 
 See [`docs/what-is-rihal-code.md`](docs/what-is-rihal-code.md) for the full story, and [`docs/ROADMAP.md`](docs/ROADMAP.md) for where this is going (next: live MCP server in v3.0).
 
@@ -37,8 +52,10 @@ Rihal Code packages a lot. To keep things approachable, everything is organized
 
 Most AI tools give you one assistant pretending to be everything. **Rihal Code gives you Rihal's team — and Rihal's brain — inside every project.**
 
-- **43 agents** with clear roles, cultural identity (Arabic names), and hard scope boundaries
-- **99 slash commands** covering research, planning, execution, verification, and recovery
+- **45 agents** with clear roles, cultural identity (Arabic names), and hard scope boundaries
+- **95 slash commands** covering research, planning, execution, verification, and recovery
+- **80 skills** including Memory Bank primitives, 11 engineering-rigor skills (TDD, harden, perf, debug, trim, etc.), and 8 real-pain skills (auth-audit, mvp-graduate, deploy-unify, etc.)
+- **Persistent project memory** at `.rihal/memory/` — checked into git, visible in the Diwan dashboard, lossless distillates for fast LLM hydration
 - **3 execution modes**: parallel debate (`/rihal:council`), sequential pipelines (`/rihal:chain`), and quick-sync (`/rihal:discuss`)
 - **File-based state** in `.rihal/` that every workflow reads and updates
 - **Intent guards** on every workflow — catch wrong commands early with copy-paste redirects
@@ -48,6 +65,8 @@ Most AI tools give you one assistant pretending to be everything. **Rihal Code g
 - **Post-execute gates** (integration-checker, nyquist-auditor) verify completeness
 - **Global agents** at `~/.rihal/agents/` — customize without forking
 
+See [`MIGRATIONS.md`](MIGRATIONS.md) if you're upgrading from a pre-Memory-Bank install.
+
 It's not a chatbot. It's a methodology.
 
 ---
@@ -65,9 +84,9 @@ npx @hanzlaa/rcode install
 One unified installer. Pure file shipping, no runtime dependencies. Installs into:
 
 - `.rihal/` — config, workflows, references, bin (Rihal infrastructure)
-- `.claude/agents/` — 43 first-class subagents
-- `.claude/commands/rihal/` — 99 slash commands
-- `.claude/skills/` — 56 phrase-activated skills (scaffold-project, create-prd, prfaq, retrospective, etc.)
+- `.claude/agents/` — 45 first-class subagents
+- `.claude/commands/rihal/` — 95 slash commands
+- `.claude/skills/` — 80 phrase-activated skills (scaffold-project, create-prd, prfaq, memory-init, retrospective, etc.)
 - `rihal/brain/` — Rihal standards pulled from upstream (PR / commit / architecture docs)
 - `.planning/` — where your artifacts land (council sessions, plans, chains, summaries)
 
@@ -111,7 +130,7 @@ npx @hanzlaa/rcode install --ide gemini
 /rihal:plan --research build a rental app    → researcher grounds, plan-checker verifies
 /rihal:execute .planning/plans/01/PLAN.md    → atomic commits + post-gates
 /rihal:status                                → phases, decisions, blockers, sessions
-/rihal:karpathy-audit HEAD~5..HEAD           → audit changes vs 4 coding principles
+/rihal:code-review HEAD~5..HEAD --karpathy   → audit changes vs 4 coding principles
 ```
 
 ---
@@ -165,7 +184,7 @@ npx @hanzlaa/rcode install --ide gemini
 - **Execution**: rihal-executor, rihal-planner, rihal-verifier, rihal-plan-checker, rihal-debugger
 - **Discovery**: rihal-codebase-mapper, rihal-project-researcher, rihal-roadmapper, rihal-phase-researcher, rihal-advisor-researcher, rihal-assumptions-analyzer, rihal-research-synthesizer
 - **Verification**: rihal-integration-checker, rihal-nyquist-auditor
-- **Quality**: rihal-tech-writer, rihal-ux-designer, rihal-architect, rihal-code-reviewer, rihal-code-fixer, rihal-edge-case-hunter, rihal-deviation-analyzer
+- **Quality**: rihal-noor, rihal-ux-designer, rihal-code-reviewer, rihal-code-fixer, rihal-edge-case-hunter, rihal-deviation-analyzer
 - **And more**: rihal-docs-auditor, rihal-doc-verifier, rihal-doc-writer, rihal-repo-metrics, rihal-security-auditor, etc.
 
 **Customize globally:** Define reusable agents in `~/.rihal/agents/rihal-<name>.md`. They appear in every project alongside project-local agents, without forking the repo.
@@ -256,11 +275,11 @@ Amazon's "Working Backwards" method: write the finished-product press release *b
 3. **Surgical changes** — touch only what's needed, match existing style
 4. **Goal-driven execution** — define verifiable success criteria
 
-`/rihal:karpathy-audit` runs these 4 principles as a post-hoc audit against any diff or phase. Use it after implementation to catch bloated, over-engineered, or scope-creeping changes before they land in a PR.
+`/rihal:code-review --karpathy` runs these 4 principles as a post-hoc audit against any diff or phase. Use it after implementation to catch bloated, over-engineered, or scope-creeping changes before they land in a PR.
 
 ```
-/rihal:karpathy-audit HEAD~5..HEAD
-/rihal:karpathy-audit 03 --files=src/auth/
+/rihal:code-review HEAD~5..HEAD --karpathy
+/rihal:code-review 03 --files=src/auth/ --karpathy
 ```
 
 ### Plan verification + post-execute gates
@@ -309,13 +328,13 @@ Recent additions in this session:
 
 ---
 
-## Full command surface (99 commands)
+## Full command surface (95 commands)
 
 ### Router + lifecycle
 `init` · `do` · `help` · `status` · `stats` · `health` · `forensics` · `update`
 
 ### Discovery + research
-`new-project` · `map-codebase` · `scan` · `explore` · `document-project` · `analyze-dependencies` · `discuss-phase-power`
+`new-project` · `map-codebase` · `scan` · `explore` · `document-project` · `analyze-dependencies`
 
 ### Discovery + validation
 `prfaq` · `brainstorm` · `market-research` · `domain-research` · `technical-research` · `product-brief`
@@ -324,10 +343,10 @@ Recent additions in this session:
 `plan` · `chain` · `create-epics-and-stories` · `create-story` · `dev-story` · `sprint-planning`
 
 ### Execution
-`execute` · `quick` · `autonomous` · `audit-fix` · `undo` · `check-implementation-readiness`
+`execute` · `quick` · `autonomous` · `audit-fix` · `undo`
 
 ### Observability + review
-`code-review` · `code-review-fix` · `review-adversarial` · `review-edge-case-hunter` · `karpathy-audit` · `checkpoint-preview` · `secure-phase` · `show` · `why` · `rerun` · `diff`
+`code-review` · `code-review-fix` · `checkpoint-preview` · `secure-phase` · `show` · `why` · `rerun` · `diff`
 
 ### Recovery + correction
 `pause-work` · `resume-work` · `correct-course` · `next` · `config`
@@ -446,8 +465,8 @@ Every install runs 5 automated smoke tests before exiting:
     ✓ rihal-tools.cjs runs — syntax ok
     ✓ .rihal/config.yaml present — 412 bytes
     ✓ .rihal/state.json parses — valid JSON
-    ✓ agents installed — 43
-    ✓ skills + commands installed — 56 skills + 99 commands
+    ✓ agents installed — 45
+    ✓ skills + commands installed — 80 skills + 95 commands
 ```
 
 A failed check prints the debug command and returns exit code 1 so CI catches broken installs.

package/cli/install.js

@@ -268,20 +268,26 @@ function printInstallHeader(targetVersion) {
  * Returns a set like { claude: true, cursor: false, gemini: false }.
  */
 function detectIdeSignals(target) {
-  const signals = { claude: false, cursor: false, gemini: false };
+  const signals = { claude: false, cursor: false, gemini: false, vscode: false, antigravity: false };
   // 1. Project-local install dirs (strongest signal — they already use one)
   if (fs.existsSync(path.join(target, '.claude'))) signals.claude = true;
   if (fs.existsSync(path.join(target, '.cursor'))) signals.cursor = true;
   if (fs.existsSync(path.join(target, '.gemini'))) signals.gemini = true;
+  if (fs.existsSync(path.join(target, '.vscode'))) signals.vscode = true;
+  if (fs.existsSync(path.join(target, '.antigravity'))) signals.antigravity = true;
   // 2. User-level config dirs
   const home = os.homedir();
   if (fs.existsSync(path.join(home, '.claude'))) signals.claude = true;
   if (fs.existsSync(path.join(home, '.cursor'))) signals.cursor = true;
   if (fs.existsSync(path.join(home, '.config', 'Cursor'))) signals.cursor = true;
   if (fs.existsSync(path.join(home, '.gemini'))) signals.gemini = true;
+  if (fs.existsSync(path.join(home, '.vscode'))) signals.vscode = true;
+  if (fs.existsSync(path.join(home, '.config', 'Code'))) signals.vscode = true;
+  if (fs.existsSync(path.join(home, '.antigravity'))) signals.antigravity = true;
   // 3. Env vars commonly set by editor terminals
   if (process.env.CURSOR_TRACE_ID || /cursor/i.test(process.env.TERM_PROGRAM || '')) signals.cursor = true;
   if (process.env.CLAUDECODE === '1' || process.env.CLAUDE_CODE_ENTRYPOINT) signals.claude = true;
+  if (process.env.VSCODE_PID || /vscode/i.test(process.env.TERM_PROGRAM || '')) signals.vscode = true;
   return signals;
 }
 
@@ -297,43 +303,32 @@ async function resolveIde(opts) {
   if (opts.yes || !process.stdin.isTTY) return opts.ide || 'claude';
 
   const signals = detectIdeSignals(opts.target);
-  const detected = ['claude', 'cursor', 'gemini'].filter(k => signals[k]);
-
-  // Build the menu — detected IDEs marked with a hint
-  const choices = [
-    { key: '1', value: 'claude', label: 'Claude Code',  hint: signals.claude ? dim('(detected)') : '' },
-    { key: '2', value: 'cursor', label: 'Cursor',       hint: signals.cursor ? dim('(detected)') : '' },
-    { key: '3', value: 'gemini', label: 'Gemini CLI',   hint: signals.gemini ? dim('(detected)') : dim('(beta — limited)') },
-  ];
+  const detected = ['claude', 'cursor', 'gemini', 'vscode'].filter(k => signals[k]);
 
   // Pick a default: prefer the single detected IDE; otherwise claude
   let defaultValue = 'claude';
   if (detected.length === 1) defaultValue = detected[0];
 
-  const readline = require('readline');
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const prompt = (q) => new Promise(r => rl.question(q, a => r(a)));
+  // Use @clack/prompts for arrow-key navigation. Closes #449 / #450.
+  const choice = await clack.select({
+    message: '🎯 Which editor will you use rcode with?',
+    initialValue: defaultValue,
+    options: [
+      { value: 'claude',     label: 'Claude Code',  hint: signals.claude ? '(detected)' : undefined },
+      { value: 'cursor',     label: 'Cursor',       hint: signals.cursor ? '(detected)' : undefined },
+      { value: 'gemini',     label: 'Gemini CLI',   hint: signals.gemini ? '(detected)' : '(beta — limited)' },
+      { value: 'vscode',     label: 'VS Code',      hint: signals.vscode ? '(detected)' : '(via Continue / Copilot extensions)' },
+      { value: 'antigravity', label: 'Antigravity', hint: '(experimental — installs to .antigravity/)' },
+    ],
+  });
 
-  console.log(pc.bold('🎯 Which editor will you use Rihal with?'));
-  console.log('');
-  for (const c of choices) {
-    const marker = c.value === defaultValue ? pc.green('●') : dim('○');
-    const label = c.value === defaultValue ? pc.bold(c.label) : c.label;
-    console.log(`   ${marker} ${pc.cyan('[' + c.key + ']')} ${label}  ${c.hint}`);
+  // Handle Ctrl-C cleanly
+  if (clack.isCancel(choice)) {
+    clack.cancel('Install cancelled.');
+    process.exit(0);
   }
-  console.log('');
-  const defaultKey = choices.find(c => c.value === defaultValue).key;
-  const answer = (await prompt(`   Pick an editor [${defaultKey}]: `)).trim().toLowerCase();
-  rl.close();
-
-  if (!answer) return defaultValue;
-  // Accept either the number key or the name
-  const byKey = choices.find(c => c.key === answer);
-  if (byKey) return byKey.value;
-  const byName = choices.find(c => c.value === answer || c.label.toLowerCase().startsWith(answer));
-  if (byName) return byName.value;
-  console.log(dim(`   Unrecognised choice "${answer}" — falling back to ${defaultValue}.`));
-  return defaultValue;
+
+  return choice;
 }
 
 /**
@@ -345,19 +340,21 @@ async function resolveCommitPlanning(opts) {
   if (opts.commitPlanning !== null) return opts.commitPlanning;
   if (opts.yes || !process.stdin.isTTY) return true; // non-interactive default
 
-  const readline = require('readline');
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const prompt = (q) => new Promise(r => rl.question(q, a => r(a)));
-  console.log('');
-  console.log('📋 .planning/ holds PRDs, roadmaps, sprints, SUMMARY files.');
-  console.log('   Commit them to git, or keep them local?');
-  console.log('');
-  console.log('   [Y] Commit — collaborators see the same plans  (default, recommended)');
-  console.log('   [n] Gitignore — planning stays local  (good for sensitive PRDs)');
-  console.log('');
-  const answer = (await prompt('   Commit planning artifacts? [Y/n]: ')).trim().toLowerCase();
-  rl.close();
-  return !(answer === 'n' || answer === 'no');
+  const choice = await clack.select({
+    message: '📋 .planning/ holds PRDs, roadmaps, sprints, SUMMARY files. How should they be tracked?',
+    initialValue: 'commit',
+    options: [
+      { value: 'commit',    label: 'Commit',    hint: 'collaborators see the same plans (recommended)' },
+      { value: 'gitignore', label: 'Gitignore', hint: 'planning stays local (good for sensitive PRDs)' },
+    ],
+  });
+
+  if (clack.isCancel(choice)) {
+    clack.cancel('Install cancelled.');
+    process.exit(0);
+  }
+
+  return choice === 'commit';
 }
 
 function printHelp() {
@@ -1342,6 +1339,7 @@ async function install(opts) {
   let preserved = 0;
   const preservedFiles = [];
   const preservedDiffs = [];  // { rel, insertions, deletions, patch } for #251
+  const conflictedFiles = []; // { rel, src, destPath, existingContent, sourceContent } for #451 / #453
   const spinner = createSpinner(dim(`Installing ${plan.length} files…`), { color: 'cyan' }).start();
 
   for (const entry of plan) {
@@ -1381,9 +1379,15 @@ async function install(opts) {
       const sourceHash = sha256(fs.readFileSync(entry.src));
       if (existingHash === sourceHash) { skipped++; continue; }
       if (!opts.yes && !opts.nonDestructive) {
-        spinner.stop();
-        console.warn('  ' + warn(`${entry.rel} differs from package version — use --force-overwrite to overwrite`));
-        spinner.start();
+        // Buffer the conflict instead of spamming a warning per file (#451).
+        // Surfaced as a categorised summary post-install + interactive offer (#453).
+        conflictedFiles.push({
+          rel: relForward,
+          src: entry.src,
+          destPath,
+          existingContent: fs.readFileSync(destPath, 'utf8'),
+          sourceContent: fs.readFileSync(entry.src, 'utf8'),
+        });
         skipped++;
         continue;
       }
@@ -1406,6 +1410,100 @@ async function install(opts) {
 
   spinner.success({ text: ok(`${copied} files installed`) });
 
+  // Categorised conflict summary (#451) + interactive resolution offer (#453).
+  // Replaces the per-file 'differs from package version' warning spam.
+  if (conflictedFiles.length > 0) {
+    const byCategory = { workflows: [], agents: [], commands: [], skills: [], references: [], other: [] };
+    for (const c of conflictedFiles) {
+      if (c.rel.includes('/workflows/')) byCategory.workflows.push(c);
+      else if (c.rel.includes('/agents/')) byCategory.agents.push(c);
+      else if (c.rel.includes('/commands/')) byCategory.commands.push(c);
+      else if (c.rel.includes('/skills/')) byCategory.skills.push(c);
+      else if (c.rel.includes('/references/')) byCategory.references.push(c);
+      else byCategory.other.push(c);
+    }
+    console.log('');
+    console.log('  ' + warn(`${conflictedFiles.length} file${conflictedFiles.length === 1 ? '' : 's'} have local edits AND v${readPackageVersion()} updates:`));
+    for (const [cat, list] of Object.entries(byCategory)) {
+      if (list.length === 0) continue;
+      console.log('    ' + dim(`${list.length} ${cat}`));
+    }
+    console.log('');
+
+    if (!opts.yes && process.stdin.isTTY) {
+      const action = await clack.select({
+        message: 'How should we handle these?',
+        initialValue: 'review',
+        options: [
+          { value: 'review', label: 'Review each one',                hint: 'see the diff, decide per file' },
+          { value: 'upstream', label: 'Take v' + readPackageVersion() + ' for all', hint: 'lose local edits, get all bug fixes' },
+          { value: 'keep',   label: 'Keep my local edits',            hint: 'skip v' + readPackageVersion() + ' updates for these files (current behaviour)' },
+        ],
+      });
+      if (clack.isCancel(action)) {
+        clack.note('Skipped — local edits preserved.');
+      } else if (action === 'upstream') {
+        let applied = 0;
+        for (const c of conflictedFiles) {
+          fs.writeFileSync(c.destPath, c.sourceContent, 'utf8');
+          applied++;
+        }
+        console.log('  ' + ok(`Applied v${readPackageVersion()} to ${applied} file${applied === 1 ? '' : 's'}.`));
+      } else if (action === 'review') {
+        let applied = 0, kept = 0;
+        for (const c of conflictedFiles) {
+          const patch = createTwoFilesPatch(c.rel, c.rel, c.existingContent, c.sourceContent, 'local', 'v' + readPackageVersion());
+          let ins = 0, del = 0;
+          for (const line of patch.split('\n')) {
+            if (line.startsWith('+') && !line.startsWith('+++')) ins++;
+            if (line.startsWith('-') && !line.startsWith('---')) del++;
+          }
+          console.log('');
+          console.log('  ' + pc.bold(c.rel) + dim('  ') + pc.green(`+${ins}`) + ' ' + pc.red(`-${del}`));
+          const decision = await clack.select({
+            message: 'Take upstream, keep local, or view diff?',
+            initialValue: 'view',
+            options: [
+              { value: 'upstream', label: 'Take v' + readPackageVersion() },
+              { value: 'keep',     label: 'Keep local' },
+              { value: 'view',     label: 'View diff first' },
+            ],
+          });
+          let finalAction = decision;
+          if (clack.isCancel(decision) || decision === 'view') {
+            for (const line of patch.split('\n').slice(4)) {
+              if (line.startsWith('+')) process.stdout.write(pc.green(line) + '\n');
+              else if (line.startsWith('-')) process.stdout.write(pc.red(line) + '\n');
+              else if (line.startsWith('@')) process.stdout.write(pc.cyan(line) + '\n');
+              else process.stdout.write(dim(line) + '\n');
+            }
+            const after = await clack.select({
+              message: 'Now: take upstream or keep local?',
+              initialValue: 'keep',
+              options: [
+                { value: 'upstream', label: 'Take v' + readPackageVersion() },
+                { value: 'keep',     label: 'Keep local' },
+              ],
+            });
+            finalAction = clack.isCancel(after) ? 'keep' : after;
+          }
+          if (finalAction === 'upstream') {
+            fs.writeFileSync(c.destPath, c.sourceContent, 'utf8');
+            applied++;
+          } else {
+            kept++;
+          }
+        }
+        console.log('  ' + ok(`Review complete: ${applied} applied, ${kept} kept local.`));
+      } else {
+        console.log('  ' + dim(`${conflictedFiles.length} file${conflictedFiles.length === 1 ? '' : 's'} kept local. Re-run with --force-overwrite or 'rcode update' anytime.`));
+      }
+    } else {
+      console.log('  ' + dim(`Re-run with --force-overwrite to apply v${readPackageVersion()} updates, or pipe through an interactive shell to resolve per-file.`));
+    }
+    console.log('');
+  }
+
   // Write .rihal/_config/manifest.yaml + agent-manifest.csv + files-manifest.csv
   const configDir = path.join(opts.target, '.rihal', '_config');
   ensureDir(configDir);