@hanzlaa/rcode 3.4.26 → 3.4.28

package/AGENTS.md

@@ -24,7 +24,7 @@ If a user says "just keep going" or "don't stop until done", that authorization
 
 - Follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): subject`
 - Types allowed: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`, `perf`, `revert`
-- Scopes allowed: `agents`, `skills`, `workflows`, `templates`, `dashboard`, `docs`, `config`, `github`, `commands`, `memory`, `brand`, `cli`, `ci`, `release`, `meta`, `tasks`, `migrations`, `refs`, `state`, `hooks`, `install`, `parity`, `triggers`, `dogfood`, `namespace`, `planning`, `insights`, `help`, `roadmap`, `session`, `audits`, `execute`, `executor`, `plan`, `planner`, `readme`, `sync`, `sprint`, `agent-exp`, `extensibility`, `lens-audit`, `tiers`, plus numeric phase/sprint scopes (e.g. `docs(15)`, `feat(8.3)`)
+- Scopes allowed: `agents`, `skills`, `workflows`, `templates`, `dashboard`, `docs`, `config`, `github`, `commands`, `memory`, `brand`, `cli`, `ci`, `release`, `meta`, `tasks`, `migrations`, `refs`, `state`, `hooks`, `install`, `parity`, `triggers`, `dogfood`, `namespace`, `planning`, `insights`, `help`, `roadmap`, `session`, `audits`, `execute`, `executor`, `plan`, `planner`, `readme`, `sync`, `sprint`, `agent-exp`, `extensibility`, `lens-audit`, `tiers`, `build`, `council`, `doctor`, `postinstall`, `progress`, `security`, `tools`, `uninstall`, `test`, plus numeric phase/sprint scopes (e.g. `docs(15)`, `feat(8.3)`)
 - Subject: lowercase first letter, imperative mood, no trailing period, under 72 chars
 - **NEVER add Claude/AI attribution to commit messages.** No "Generated with Claude Code", no "Co-Authored-By: Claude", no "🤖 Generated". The user does not want this.
 - **NEVER use `--no-verify`** to bypass hooks. If hooks fail, fix the underlying issue.

package/CONTRIBUTING.md

@@ -298,6 +298,15 @@ We use [Conventional Commits](https://www.conventionalcommits.org/) format. The
 - `extensibility` — extensibility and plugin hooks
 - `lens-audit` — 15-lens audit system and lenses
 - `tiers` — TIERS.md and tier-related documentation
+- `build` — `scripts/build.cjs`, esbuild config, bundle artifacts
+- `council` — `/rihal-council` workflow + spawning logic
+- `doctor` — `cli/doctor.js` health checks
+- `postinstall` — `cli/postinstall.js` lifecycle hook
+- `progress` — `/rihal-progress` workflow
+- `security` — security guardrails (symlink guards, integrity checks)
+- `test` — test files under `test/` (test-only changes)
+- `tools` — `rihal/bin/rihal-tools.cjs` subcommands
+- `uninstall` — `cli/uninstall.js` flow
 - `<phase-id>` — numeric phase scope when committing inside a phase (e.g. `docs(15)`, `feat(8.3)`)
 - `<sprint-id>` — numeric sprint scope inside a phase (e.g. `feat(15.1)`)
 

package/cli/install.js

@@ -79,6 +79,18 @@ const bold = (s) => pc.bold(s);
 const PACKAGE_ROOT = path.resolve(__dirname, '..');
 const SOURCE_ROOT = path.join(PACKAGE_ROOT, 'rihal');
 
+/**
+ * Single source of truth for supported IDEs (#697 — W4.3).
+ *
+ * Order matters: this is the order used in detection, prompts, and error
+ * messages. Anywhere code used to inline `['claude','cursor','gemini',
+ * 'vscode','antigravity']` it now references this constant. Adding a new
+ * IDE is now: append here, add a case to getPathsForIde, add a signal to
+ * detectIdeSignals, plus a row to runInstallWizard's multiselect — three
+ * sites instead of ten.
+ */
+const SUPPORTED_IDES = Object.freeze(['claude', 'cursor', 'gemini', 'vscode', 'antigravity']);
+
 // Zod schema for .rihal/config.yaml validation (#250).
 const ConfigSchema = z.object({
   user_name: z.string().min(1),
@@ -338,12 +350,16 @@ async function resolveIde(opts) {
     // nothing detected. (Note: opts.ide defaults to 'claude' from parseArgs,
     // so check opts.ideProvided not opts.ide to honor real --ide overrides.)
     const signals = detectIdeSignals(opts.target);
-    const detected = ['claude', 'cursor', 'gemini', 'vscode', 'antigravity'].filter(k => signals[k]);
+    const detected = SUPPORTED_IDES.filter(k => signals[k]);
     return detected.length > 0 ? detected : ['claude'];
   }
 
   const signals = detectIdeSignals(opts.target);
-  const detected = ['claude', 'cursor', 'gemini', 'vscode'].filter(k => signals[k]);
+  // Antigravity is intentionally excluded from the interactive auto-detect
+  // because it's experimental and we don't want to opt-in users without
+  // explicit consent. Use SUPPORTED_IDES.filter(k => k !== 'antigravity')
+  // to keep the inclusion criteria self-documenting.
+  const detected = SUPPORTED_IDES.filter(k => k !== 'antigravity' && signals[k]);
 
   // Pre-select detected IDEs, or default to claude
   const initialValues = detected.length > 0 ? detected : ['claude'];
@@ -1613,7 +1629,7 @@ async function installInner(opts) {
   }
 
   // Validate IDE(s) — structured error for unsupported editors (#197).
-  const SUPPORTED_IDES = ['claude', 'cursor', 'gemini', 'vscode', 'antigravity'];
+  // SUPPORTED_IDES is the module-level constant (#697 / W4.3).
   const unsupported = opts.ides.filter(ide => !SUPPORTED_IDES.includes(ide));
   if (unsupported.length > 0) {
     console.error(`✖ --ide ${unsupported.join(', ')} is not supported in v${readPackageVersion()}.`);
@@ -2597,3 +2613,4 @@ module.exports = runFromCli;
 module.exports.parseArgs = parseArgs;
 module.exports.buildInstallPlan = buildInstallPlan;
 module.exports.install = install;
+module.exports.SUPPORTED_IDES = SUPPORTED_IDES;

package/cli/lib/manifest.cjs

@@ -109,7 +109,12 @@ function diffSet(editor, kind, expected, installed) {
  * makes doctor report drift like "agents 119/23" when nothing is wrong.
  * That's why the agent count comes from .claude/agents/, not .claude/skills/.
  */
-function verifyClaudeInstall(cwd, packageRoot) {
+function verifyClaudeInstall(cwd, packageRoot, options = {}) {
+  // Issue #698: tests assert against an isolated tempdir cwd. The global
+  // fallback (#664) makes that impossible because it reads the contributor's
+  // real ~/.claude/. Tests can pass { globalFallback: false } to disable it.
+  // Default remains true to preserve the runtime behavior introduced in #664.
+  const globalFallback = options.globalFallback !== false;
   const pkg = readPackageManifest(packageRoot);
   const agentsDir = path.join(cwd, '.claude/agents');
   const skillsDir = path.join(cwd, '.claude/skills');
@@ -129,7 +134,7 @@ function verifyClaudeInstall(cwd, packageRoot) {
   // level .claude/agents/rihal-*.md when the user's ~/.claude/ already has
   // them, to avoid duplicate commands. Without this fallback the verifier
   // reports 0 agents on every successful install in that scenario.
-  if (installedAgents.size === 0) {
+  if (installedAgents.size === 0 && globalFallback) {
     try {
       const os = require('os');
       const globalAgentsDir = path.join(os.homedir(), '.claude/agents');
@@ -143,12 +148,13 @@ function verifyClaudeInstall(cwd, packageRoot) {
     } catch { /* non-fatal — permission errors etc. */ }
   }
 
-  // Actions: .claude/skills/<bare-name>/ — exclude rihal-* dirs (those are
-  // either agent stubs or command stubs, never action skills).
+  // Actions: .claude/skills/rihal-<name>/. installSkills (cli/install.js)
+  // prefixes every action with rihal-, and readPackageManifest does the
+  // same — so both sides are normalized. The previous version filtered OUT
+  // rihal-* dirs which excluded ALL real actions and made the diff always
+  // report "everything missing." Compare directly against the prefixed set.
   const allInstalled = readInstalledDirs(skillsDir);
-  const actionsInstalled = new Set(
-    [...allInstalled].filter((n) => !n.startsWith('rihal-'))
-  );
+  const actionsInstalled = new Set([...allInstalled].filter((n) => pkg.actions.has(n)));
 
   return [
     diffSet('claude', 'agents', pkg.agents, installedAgents),

package/cli/postinstall.js

@@ -13,42 +13,52 @@
 const os = require('os');
 const path = require('path');
 
-// Skip in CI or test environments
-if (process.env.CI || process.env.NODE_ENV === 'test') {
-  process.exit(0);
-}
-
-// Only auto-install when invoked as a global package (npm install -g).
-// A local devDependency install should not touch the user's ~/.claude/.
-const isGlobalInstall = (() => {
+/**
+ * Decide whether the current postinstall invocation represents a GLOBAL
+ * `npm install -g @hanzlaa/rcode` (true) or a transitive devDep install
+ * inside someone's project (false).
+ *
+ * Pure function — takes its inputs explicitly so tests can drive every
+ * branch without needing to mutate process.env / __dirname / process.cwd.
+ *
+ * @param {object} env  process.env-like
+ * @param {string} dirname  __dirname of the postinstall script
+ * @param {string} cwd  process.cwd() at invocation time
+ */
+function isGlobalInstall(env, dirname, cwd) {
   try {
-    // npm sets npm_config_global=true for global installs
-    if (process.env.npm_config_global === 'true') return true;
-    // pnpm sets npm_config_global too, but check PNPM_HOME as a fallback
-    if (process.env.PNPM_HOME && __dirname.startsWith(process.env.PNPM_HOME)) return true;
-    // Check if __dirname is inside a known global node_modules path.
-    // Covers: /usr/local/lib, /usr/lib, ~/.nvm/.../lib, ~/.pnpm/..., ~/.yarn/...
+    if (env.npm_config_global === 'true') return true;
+    if (env.PNPM_HOME && dirname.startsWith(env.PNPM_HOME)) return true;
     const globalPatterns = [
-      /\/node_modules\/@hanzlaa\/rcode/,  // any global node_modules
-      /[/\\]lib[/\\]node_modules[/\\]/,   // /usr/local/lib/node_modules
-      /\.nvm[/\\]versions[/\\]/,           // nvm
-      /\.pnpm[/\\]/,                       // pnpm global store
-      /\.yarn[/\\]global/,                 // yarn global
+      /\/node_modules\/@hanzlaa\/rcode/,
+      /[/\\]lib[/\\]node_modules[/\\]/,
+      /\.nvm[/\\]versions[/\\]/,
+      /\.pnpm[/\\]/,
+      /\.yarn[/\\]global/,
     ];
-    if (globalPatterns.some((re) => re.test(__dirname))) return true;
-    // Last resort: package is NOT inside a project's local node_modules
-    // (local installs have .../project/node_modules/@hanzlaa/rcode/cli)
-    const localNodeModules = path.join(process.cwd(), 'node_modules');
-    if (!__dirname.startsWith(localNodeModules)) return true;
+    if (globalPatterns.some((re) => re.test(dirname))) return true;
+    const localNodeModules = path.join(cwd, 'node_modules');
+    if (!dirname.startsWith(localNodeModules)) return true;
     return false;
   } catch {
     return false;
   }
-})();
+}
+
+// Skip in CI or test environments. Tests that import this module bypass
+// the top-level effect by checking require.main !== module.
+if (require.main === module) {
+  if (process.env.CI || process.env.NODE_ENV === 'test') {
+    process.exit(0);
+  }
+  runPostInstall();
+}
+
+function runPostInstall() {
 
 const globalTarget = path.join(os.homedir(), '.claude');
 
-if (isGlobalInstall) {
+if (isGlobalInstall(process.env, __dirname, process.cwd())) {
   // Spawn dist/rcode.js (fully bundled — no devDep requires) to do the global
   // install. Calling cli/install.js directly fails in global npm installs because
   // devDependencies (picocolors, semver, etc.) are not installed for global packages.
@@ -101,3 +111,7 @@ More:
 Docs: https://github.com/hanzlahabib/rihal-code
 `);
 }
+
+} // end runPostInstall
+
+module.exports = { isGlobalInstall };

package/cli/uninstall.js

@@ -68,6 +68,25 @@ function isLocalOverride(name) {
   return /\.local\.(md|mdc|json|yaml|yml|toml|js|ts)$/.test(name);
 }
 
+/**
+ * Strip the rcode-managed block from a .gitignore string.
+ *
+ * Pure function (no fs) so it can be unit-tested independently. Issue #684
+ * fixed the over-broad legacy regex; this helper centralises the logic so
+ * any future shape change has exactly one site to update.
+ *
+ * Both supported shapes require BOTH the opener AND the closer to match —
+ * user comments starting with "# rcode" are safe.
+ */
+function stripRihalGitignoreBlock(text) {
+  return text
+    // Current shape (install.js BEGIN/END markers — exact match).
+    .replace(/\n?# ===== rcode-managed gitignore block[\s\S]*?# ===== end rcode-managed gitignore block =====\n?/g, '\n')
+    // Legacy >>> / <<< fenced shape.
+    .replace(/\n?# >>> rihal-code >>>[\s\S]*?# <<< rihal-code <<<\n?/g, '\n')
+    .replace(/\n{3,}/g, '\n\n');
+}
+
 /**
  * Walk a directory and remove all files/subdirs whose name matches a predicate.
  * Returns the number of entries removed. Always skips local overrides (#382).
@@ -419,15 +438,13 @@ async function runUninstall(args) {
   const opts = parseArgs(args);
   const cwd = process.cwd();
 
-  // Issue #693: keep the IDE list in sync with the installer. The installer
-  // ships claude/cursor/gemini/vscode/antigravity. The previous uninstaller
-  // list (claude/cursor/windsurf/antigravity) was missing gemini + vscode
-  // and included windsurf (which the installer never writes). Result: a
-  // user with vscode-style commands could never `rcode uninstall`.
-  const SUPPORTED_EDITORS = ['claude', 'cursor', 'gemini', 'vscode', 'antigravity'];
+  // Issue #693 + #697 (W4.3): keep the IDE list in sync with the installer
+  // by importing the single source of truth. Adding an IDE to install.js
+  // SUPPORTED_IDES is now the only edit needed for parity.
+  const { SUPPORTED_IDES } = require('./install.js');
   const editors = opts.editor
-    ? (opts.editor === 'all' ? SUPPORTED_EDITORS : [opts.editor])
-    : SUPPORTED_EDITORS;
+    ? (opts.editor === 'all' ? Array.from(SUPPORTED_IDES) : [opts.editor])
+    : Array.from(SUPPORTED_IDES);
 
   console.log(`\n🕌 Rihal Code — Uninstall\n`);
   console.log(`   Project: ${cwd}`);
@@ -731,12 +748,7 @@ async function runUninstall(args) {
     if (fs.existsSync(gitignorePath)) {
       try {
         const before = fs.readFileSync(gitignorePath, 'utf8');
-        const stripped = before
-          // Current shape (install.js BEGIN/END markers — exact match).
-          .replace(/\n?# ===== rcode-managed gitignore block[\s\S]*?# ===== end rcode-managed gitignore block =====\n?/g, '\n')
-          // Legacy >>> / <<< fenced shape.
-          .replace(/\n?# >>> rihal-code >>>[\s\S]*?# <<< rihal-code <<<\n?/g, '\n')
-          .replace(/\n{3,}/g, '\n\n');
+        const stripped = stripRihalGitignoreBlock(before);
         if (stripped !== before) {
           fs.writeFileSync(gitignorePath, stripped);
           console.log(`   ✓ stripped rcode block from .gitignore (--purge)`);
@@ -773,6 +785,14 @@ async function runUninstall(args) {
   console.log(`   rcode install`);
 }
 
+// Re-exports for unit tests (W3.2 — issue #694 follow-up). The default
+// export remains the async runner; these are attached afterwards so pure
+// functions can be exercised without spawning a child process.
+module.exports.isLocalOverride = isLocalOverride;
+module.exports.planToPathList = planToPathList;
+module.exports.discoverKnownActionSkills = discoverKnownActionSkills;
+module.exports.stripRihalGitignoreBlock = stripRihalGitignoreBlock;
+
 // Direct invocation — allow `node cli/uninstall.js [flags]` to run end-to-end.
 // When called via cli/index.js, module.exports is invoked directly.
 if (require.main === module) {

package/cli/update.js

@@ -383,3 +383,7 @@ async function runUpdate(args, { packageRoot, packageJson }) {
   }
   console.log();
 }
+
+// Re-exports for unit tests (W3.4 — issue #694 follow-up).
+module.exports.parseArgs = parseArgs;
+module.exports.detectInstalledEditors = detectInstalledEditors;

package/dist/rcode.js

@@ -15073,7 +15073,8 @@ var require_manifest = __commonJS({
         extra
       };
     }
-    function verifyClaudeInstall(cwd, packageRoot) {
+    function verifyClaudeInstall(cwd, packageRoot, options = {}) {
+      const globalFallback = options.globalFallback !== false;
       const pkg = readPackageManifest(packageRoot);
       const agentsDir = path2.join(cwd, ".claude/agents");
       const skillsDir = path2.join(cwd, ".claude/skills");
@@ -15085,7 +15086,7 @@ var require_manifest = __commonJS({
           }
         }
       }
-      if (installedAgents.size === 0) {
+      if (installedAgents.size === 0 && globalFallback) {
         try {
           const os = require("os");
           const globalAgentsDir = path2.join(os.homedir(), ".claude/agents");
@@ -15100,9 +15101,7 @@ var require_manifest = __commonJS({
         }
       }
       const allInstalled = readInstalledDirs(skillsDir);
-      const actionsInstalled = new Set(
-        [...allInstalled].filter((n) => !n.startsWith("rihal-"))
-      );
+      const actionsInstalled = new Set([...allInstalled].filter((n) => pkg.actions.has(n)));
       return [
         diffSet("claude", "agents", pkg.agents, installedAgents),
         diffSet("claude", "actions", pkg.actions, actionsInstalled)
@@ -15218,6 +15217,7 @@ var require_install = __commonJS({
     var bold = (s) => pc.bold(s);
     var PACKAGE_ROOT2 = path2.resolve(__dirname, "..");
     var SOURCE_ROOT = path2.join(PACKAGE_ROOT2, "rihal");
+    var SUPPORTED_IDES = Object.freeze(["claude", "cursor", "gemini", "vscode", "antigravity"]);
     var ConfigSchema = z.object({
       user_name: z.string().min(1),
       project_name: z.string().min(1),
@@ -15419,11 +15419,11 @@ var require_install = __commonJS({
       if (opts.noPrompt || opts.global) return ["claude"];
       if (opts.yes || !process.stdin.isTTY) {
         const signals2 = detectIdeSignals(opts.target);
-        const detected2 = ["claude", "cursor", "gemini", "vscode", "antigravity"].filter((k) => signals2[k]);
+        const detected2 = SUPPORTED_IDES.filter((k) => signals2[k]);
         return detected2.length > 0 ? detected2 : ["claude"];
       }
       const signals = detectIdeSignals(opts.target);
-      const detected = ["claude", "cursor", "gemini", "vscode"].filter((k) => signals[k]);
+      const detected = SUPPORTED_IDES.filter((k) => k !== "antigravity" && signals[k]);
       const initialValues = detected.length > 0 ? detected : ["claude"];
       const choices = await clack.multiselect({
         message: "\u{1F3AF} Which editor(s) will you use rcode with?",
@@ -16400,7 +16400,6 @@ ${BLOCK}`, { mode: 493 });
         console.error(`\u2716 Source tree not found at ${SOURCE_ROOT}. Running from wrong dir?`);
         return 1;
       }
-      const SUPPORTED_IDES = ["claude", "cursor", "gemini", "vscode", "antigravity"];
       const unsupported = opts.ides.filter((ide) => !SUPPORTED_IDES.includes(ide));
       if (unsupported.length > 0) {
         console.error(`\u2716 --ide ${unsupported.join(", ")} is not supported in v${readPackageVersion()}.`);
@@ -17204,6 +17203,7 @@ commit_planning: ${desired}
     module2.exports.parseArgs = parseArgs;
     module2.exports.buildInstallPlan = buildInstallPlan;
     module2.exports.install = install;
+    module2.exports.SUPPORTED_IDES = SUPPORTED_IDES;
   }
 });
 
@@ -17703,6 +17703,8 @@ var require_update = __commonJS({
       }
       console.log();
     }
+    module2.exports.parseArgs = parseArgs;
+    module2.exports.detectInstalledEditors = detectInstalledEditors;
   }
 });
 
@@ -17746,6 +17748,9 @@ var require_uninstall = __commonJS({
     function isLocalOverride(name) {
       return /\.local\.(md|mdc|json|yaml|yml|toml|js|ts)$/.test(name);
     }
+    function stripRihalGitignoreBlock(text) {
+      return text.replace(/\n?# ===== rcode-managed gitignore block[\s\S]*?# ===== end rcode-managed gitignore block =====\n?/g, "\n").replace(/\n?# >>> rihal-code >>>[\s\S]*?# <<< rihal-code <<<\n?/g, "\n").replace(/\n{3,}/g, "\n\n");
+    }
     function removeMatching(dir, predicate) {
       if (!fs2.existsSync(dir)) return 0;
       let count = 0;
@@ -17981,8 +17986,8 @@ var require_uninstall = __commonJS({
     async function runUninstall(args) {
       const opts = parseArgs(args);
       const cwd = process.cwd();
-      const SUPPORTED_EDITORS = ["claude", "cursor", "gemini", "vscode", "antigravity"];
-      const editors = opts.editor ? opts.editor === "all" ? SUPPORTED_EDITORS : [opts.editor] : SUPPORTED_EDITORS;
+      const { SUPPORTED_IDES } = require_install();
+      const editors = opts.editor ? opts.editor === "all" ? Array.from(SUPPORTED_IDES) : [opts.editor] : Array.from(SUPPORTED_IDES);
       console.log(`
 \u{1F54C} Rihal Code \u2014 Uninstall
 `);
@@ -18219,7 +18224,7 @@ var require_uninstall = __commonJS({
         if (fs2.existsSync(gitignorePath)) {
           try {
             const before = fs2.readFileSync(gitignorePath, "utf8");
-            const stripped = before.replace(/\n?# ===== rcode-managed gitignore block[\s\S]*?# ===== end rcode-managed gitignore block =====\n?/g, "\n").replace(/\n?# >>> rihal-code >>>[\s\S]*?# <<< rihal-code <<<\n?/g, "\n").replace(/\n{3,}/g, "\n\n");
+            const stripped = stripRihalGitignoreBlock(before);
             if (stripped !== before) {
               fs2.writeFileSync(gitignorePath, stripped);
               console.log(`   \u2713 stripped rcode block from .gitignore (--purge)`);
@@ -18248,6 +18253,10 @@ var require_uninstall = __commonJS({
 To reinstall later:`);
       console.log(`   rcode install`);
     }
+    module2.exports.isLocalOverride = isLocalOverride;
+    module2.exports.planToPathList = planToPathList;
+    module2.exports.discoverKnownActionSkills = discoverKnownActionSkills;
+    module2.exports.stripRihalGitignoreBlock = stripRihalGitignoreBlock;
     if (require.main === module2) {
       module2.exports(process.argv.slice(2)).catch((err) => {
         if (err instanceof PromptAbortError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzlaa/rcode",
-  "version": "3.4.26",
+  "version": "3.4.28",
   "description": "rcode — the memory bank for AI-driven SaaS teams. Persistent project context, distinctive engineering personas, and phase-based workflows. Built by Rihal. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.",
   "main": "cli/index.js",
   "bin": {