@hanzlaa/rcode 3.4.11 → 3.4.12

package/README.md

@@ -100,6 +100,11 @@ Restart Claude Code (or your IDE), type `/`, and every `rihal-*` command appears
 
 Update anytime with `npx @hanzlaa/rcode update` (or `/rihal-update` inside a Claude session).
 
+> **Want `rcode` on your PATH?** `npx @hanzlaa/rcode install` sets up the project files but doesn't put `rcode` in your shell. For the `rcode` CLI command (e.g. `rcode version`, `rcode update`), install globally once:
+> ```bash
+> npm install -g @hanzlaa/rcode
+> ```
+
 ### Then begin the rihla
 
 ```

package/cli/install.js

@@ -1972,6 +1972,10 @@ async function install(opts) {
   console.log(dim('    npx @hanzlaa/rcode@latest install   # pull the latest rcode + brain'));
   console.log(dim(`    /rihal-update v${version}              # pin rcode to a specific version`));
   console.log('');
+  console.log(dim('  Want the rcode CLI on your PATH? (optional — needed for rcode version / rcode update):'));
+  console.log(dim('    npm install -g @hanzlaa/rcode       # installs rcode, rihal, rihal-code commands'));
+  console.log(dim('    rcode version                       # verify'));
+  console.log('');
   console.log(dim('  Customize without losing changes on update:'));
   console.log(dim('    Create <name>.local.md siblings (e.g. .claude/agents/rihal-waleed.local.md)'));
   console.log(dim('    *.local.md files are NEVER touched by install / --force-overwrite / uninstall.'));

package/dist/rcode.js

@@ -16462,6 +16462,10 @@ ${BLOCK}`);
       console.log(dim("    npx @hanzlaa/rcode@latest install   # pull the latest rcode + brain"));
       console.log(dim(`    /rihal-update v${version}              # pin rcode to a specific version`));
       console.log("");
+      console.log(dim("  Want the rcode CLI on your PATH? (optional \u2014 needed for rcode version / rcode update):"));
+      console.log(dim("    npm install -g @hanzlaa/rcode       # installs rcode, rihal, rihal-code commands"));
+      console.log(dim("    rcode version                       # verify"));
+      console.log("");
       console.log(dim("  Customize without losing changes on update:"));
       console.log(dim("    Create <name>.local.md siblings (e.g. .claude/agents/rihal-waleed.local.md)"));
       console.log(dim("    *.local.md files are NEVER touched by install / --force-overwrite / uninstall."));
@@ -16909,7 +16913,7 @@ var require_fsutil = __commonJS({
       );
       let fd;
       try {
-        fd = fs2.openSync(tmpPath, "w", mode ?? 420);
+        fd = fs2.openSync(tmpPath, "wx", mode ?? 420);
         fs2.writeSync(fd, content, 0, encoding);
         fs2.fsyncSync(fd);
         fs2.closeSync(fd);
@@ -17923,7 +17927,11 @@ var require_digest = __commonJS({
     var fs2 = require("fs");
     var path2 = require("path");
     function normalize(name) {
-      return name.replace(/^rihal-/, "");
+      const stripped = name.replace(/^rihal-/, "");
+      if (stripped.includes("..") || stripped.includes("/") || stripped.includes("\\")) {
+        throw new Error(`Invalid agent name: '${name}'`);
+      }
+      return stripped;
     }
     function listAvailable(digestDir, agentsDir) {
       const digestNames = fs2.existsSync(digestDir) ? fs2.readdirSync(digestDir).filter((f) => f.endsWith(".md") && f !== "README.md").map((f) => f.replace(".md", "")) : [];
@@ -19285,6 +19293,10 @@ var require_show_model = __commonJS({
 var require_github = __commonJS({
   "cli/lib/github.cjs"(exports2, module2) {
     var { execSync, spawnSync } = require("child_process");
+    function sanitizeGhOutput(text) {
+      if (!text) return "";
+      return text.replace(/\b(ghp_|ghs_|github_pat_)[A-Za-z0-9_]{10,}\b/g, "[REDACTED]").slice(0, 2e3);
+    }
     function runGh(args, { input = null, allowFailure = false } = {}) {
       const result = spawnSync("gh", args, {
         encoding: "utf8",
@@ -19292,10 +19304,9 @@ var require_github = __commonJS({
         stdio: input ? ["pipe", "pipe", "pipe"] : ["ignore", "pipe", "pipe"]
       });
       if (result.status !== 0 && !allowFailure) {
-        throw new Error(
-          `gh ${args.join(" ")} failed:
-${result.stderr || result.stdout || "(no output)"}`
-        );
+        const detail = sanitizeGhOutput(result.stderr || result.stdout || "(no output)");
+        throw new Error(`gh ${args.join(" ")} failed:
+${detail}`);
       }
       return {
         status: result.status,
@@ -20408,7 +20419,7 @@ Usage:
 
 \u{1F4E6} PROJECT
   install        Install Rihal Code into the current project
-                 (sets up .rihal/, .claude/skills/, .claude/commands/rihal/,
+                 (sets up .rihal/, .claude/skills/, .claude/commands/,
                  .cursor/rules/, .windsurf/rules/, .antigravity/agents/, AGENTS.md)
   init           Alias for install
   update         Refresh skill files (backs up .rihal/ state first)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzlaa/rcode",
-  "version": "3.4.11",
+  "version": "3.4.12",
   "description": "rcode — the memory bank for AI-driven SaaS teams. Persistent project context, distinctive engineering personas, and phase-based workflows. Built by Rihal. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.",
   "main": "cli/index.js",
   "bin": {