@hanzlaa/rcode 3.4.9 → 3.4.11

package/cli/digest.js

@@ -12,7 +12,12 @@ const fs = require('fs');
 const path = require('path');
 
 function normalize(name) {
-  return name.replace(/^rihal-/, '');
+  const stripped = name.replace(/^rihal-/, '');
+  // Reject path traversal attempts — names must be simple identifiers
+  if (stripped.includes('..') || stripped.includes('/') || stripped.includes('\\')) {
+    throw new Error(`Invalid agent name: '${name}'`);
+  }
+  return stripped;
 }
 
 function listAvailable(digestDir, agentsDir) {

package/cli/index.js

@@ -51,7 +51,7 @@ Usage:
 
 📦 PROJECT
   install        Install Rihal Code into the current project
-                 (sets up .rihal/, .claude/skills/, .claude/commands/rihal/,
+                 (sets up .rihal/, .claude/skills/, .claude/commands/,
                  .cursor/rules/, .windsurf/rules/, .antigravity/agents/, AGENTS.md)
   init           Alias for install
   update         Refresh skill files (backs up .rihal/ state first)

package/cli/lib/fsutil.cjs

@@ -43,7 +43,7 @@ function writeFileAtomic(filePath, content, opts = {}) {
 
   let fd;
   try {
-    fd = fs.openSync(tmpPath, 'w', mode ?? 0o644);
+    fd = fs.openSync(tmpPath, 'wx', mode ?? 0o644);
     fs.writeSync(fd, content, 0, encoding);
     // fsync the data to disk before rename — otherwise a crash between
     // write() and rename() could leave the target renamed but with zero

package/cli/lib/github.cjs

@@ -18,6 +18,14 @@ const { execSync, spawnSync } = require('child_process');
 
 // ---------- Utility: run gh commands safely ----------
 
+function sanitizeGhOutput(text) {
+  if (!text) return '';
+  // Strip anything that looks like a token (ghp_*, ghs_*, github_pat_*)
+  return text
+    .replace(/\b(ghp_|ghs_|github_pat_)[A-Za-z0-9_]{10,}\b/g, '[REDACTED]')
+    .slice(0, 2000);
+}
+
 function runGh(args, { input = null, allowFailure = false } = {}) {
   const result = spawnSync('gh', args, {
     encoding: 'utf8',
@@ -26,9 +34,8 @@ function runGh(args, { input = null, allowFailure = false } = {}) {
   });
 
   if (result.status !== 0 && !allowFailure) {
-    throw new Error(
-      `gh ${args.join(' ')} failed:\n${result.stderr || result.stdout || '(no output)'}`
-    );
+    const detail = sanitizeGhOutput(result.stderr || result.stdout || '(no output)');
+    throw new Error(`gh ${args.join(' ')} failed:\n${detail}`);
   }
 
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzlaa/rcode",
-  "version": "3.4.9",
+  "version": "3.4.11",
   "description": "rcode — the memory bank for AI-driven SaaS teams. Persistent project context, distinctive engineering personas, and phase-based workflows. Built by Rihal. Works in Claude Code, Cursor, Gemini, VS Code, and Antigravity.",
   "main": "cli/index.js",
   "bin": {
@@ -8,15 +8,6 @@
     "rihal": "dist/rcode.js",
     "rihal-code": "dist/rcode.js"
   },
-  "scripts": {
-    "dashboard": "node server/dashboard.js",
-    "test": "node --test",
-    "test:ci": "node --test --test-reporter=spec",
-    "postinstall": "node cli/postinstall.js",
-    "build:cli": "node scripts/build.cjs",
-    "build": "node scripts/build.cjs",
-    "dogfood": "bash scripts/dogfood-check.sh"
-  },
   "files": [
     "cli/",
     "rihal/",
@@ -69,5 +60,14 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "dashboard": "node server/dashboard.js",
+    "test": "node --test",
+    "test:ci": "node --test --test-reporter=spec",
+    "postinstall": "node cli/postinstall.js",
+    "build:cli": "node scripts/build.cjs",
+    "build": "node scripts/build.cjs",
+    "dogfood": "bash scripts/dogfood-check.sh"
   }
-}
+}

package/rihal/bin/rihal-tools.cjs

@@ -4688,11 +4688,11 @@ function cmdProgress(args) {
       byNum[num] = {
         path: full,
         dirName: entry,
-        plan_count: files.filter(f => /PLAN\.md$|-PLAN\.md$|SPRINT\.md$/.test(f)).length,
+        plan_count: files.filter(f => /-SPRINT\.md$/i.test(f)).length,
         summary_count: files.filter(f => /SUMMARY\.md$|-SUMMARY\.md$/.test(f)).length,
         has_research: files.includes('RESEARCH.md'),
         has_context: files.includes('CONTEXT.md'),
-        has_verification: files.includes('VERIFICATION.md'),
+        has_verification: files.some(f => /VERIFICATION\.md$/i.test(f)),
       };
     }
     return byNum;

package/rihal/workflows/do.md

@@ -296,6 +296,7 @@ Evaluate `$QUESTION` against these routing rules. Apply the **first matching** r
 | Implement a story, "work on story", "dev story", "build story" | `/rihal-dev-story` | Story-level implementation |
 | Find gaps in milestone plans, "gaps in plans", "missing plan", "unplanned phases" | `/rihal-plan-milestone-gaps` | Identify and fill planning gaps |
 | Executing a phase, "build phase N", "run phase N", "implement phase" | `/rihal-execute` | Direct phase execution request |
+| `/rihal-phase <number>` where number matches an existing phase dir | `/rihal-execute <N>` | User mistyped phase instead of execute — detect bare integer + existing dir, route to execute |
 | Running all remaining phases automatically | `/rihal-autonomous` | Full autonomous execution |
 | A review or quality concern about existing work | `/rihal-verify-work` | Needs verification |
 | "Council", "discuss strategy", "should we" | `/rihal-council` | Multi-agent strategic discussion |

package/rihal/workflows/feature-drift.md

@@ -103,8 +103,8 @@ Auditor returns structured JSON:
 **If `MODE=phase-status` (Phase 8 / #461):**
 
 Spawn `rihal-docs-auditor` with `--mode=phase-status`. Pass:
-- `roadmap_phases[]` — output of `node rihal/bin/rihal-tools.cjs roadmap list-phases` (post-#464 fix)
-- `phase_dirs[]` — output of `node rihal/bin/rihal-tools.cjs init phase-op N` for each phase number, OR a direct walk of `.planning/phases/*` that captures: dir name, presence of `*-SUMMARY.md`, `*-SPRINT.md`, `*-PLAN.md`, `*-CONTEXT.md`, `*-RESEARCH.md`, `*-VERIFICATION.md`
+- `roadmap_phases[]` — output of `node .rihal/bin/rihal-tools.cjs roadmap list-phases` (post-#464 fix)
+- `phase_dirs[]` — output of `node .rihal/bin/rihal-tools.cjs init phase-op N` for each phase number, OR a direct walk of `.planning/phases/*` that captures: dir name, presence of `*-SUMMARY.md`, `*-SPRINT.md`, `*-PLAN.md`, `*-CONTEXT.md`, `*-RESEARCH.md`, `*-VERIFICATION.md`
 - For each phase, the most recent commit hash that touches files in `${phase_dir}/` (used as a freshness signal)
 
 Auditor returns structured JSON:

package/rihal/workflows/phase.md

@@ -14,7 +14,42 @@ If `$ARGUMENTS` is empty AND no flag is set:
 
 STOP — do not proceed.
 
-## Step 1 — Parse mode flags
+## Step 1 — Disambiguate numeric arguments BEFORE routing
+
+If `$ARGUMENTS` is a bare integer (e.g. `116`, `20`, `7`) with no other words or flags:
+
+```bash
+# Check if a phase directory matching this number already exists
+PHASE_NUM="$ARGUMENTS"
+EXISTING=$(find .planning/phases -maxdepth 1 -type d -name "${PHASE_NUM}-*" 2>/dev/null | head -1)
+```
+
+If `$EXISTING` is non-empty, the user typed a phase number that already exists — they almost certainly meant to operate on it, not create a new one. Stop and ask:
+
+```
+Phase {N} already exists: {directory name}
+
+What did you mean to do?
+
+  /rihal-execute {N}   — execute the sprint plan for this phase
+  /rihal-plan {N}      — re-plan or view the plan for this phase
+  /rihal-status        — see overall project status
+
+  /rihal-phase "{description}"   — add a NEW phase (put the description in quotes)
+```
+
+Do NOT proceed to add/insert/remove. Wait for the user to clarify.
+
+If `$ARGUMENTS` is a bare integer and `$EXISTING` is empty, it's an ambiguous but plausible new-phase name. Proceed to Step 2 but warn:
+
+```
+Note: "{N}" looks like a number. If you meant to execute/plan phase {N}, use /rihal-execute {N} or /rihal-plan {N}.
+Adding a new phase named "{N}" — press Ctrl+C to cancel, or continue.
+```
+
+Then proceed to Step 2.
+
+## Step 1b — Parse mode flags
 
 Inspect `$ARGUMENTS`:
 
@@ -24,7 +59,7 @@ Inspect `$ARGUMENTS`:
 
 Strip the mode flag and pass remaining args to the underlying workflow.
 
-## Step 2 — Dispatch to underlying workflow
+## Step 2 — Dispatch to underlying workflow (after disambiguation)
 
 Each mode is implemented by an existing workflow:
 

package/rihal/workflows/status.md

@@ -58,12 +58,15 @@ the weighted bar as the primary progress indicator to avoid a misleading `0/N (0
 For each entry in `SNAPSHOT.phases[]`:
 
 - `▶` if `phase.number === SNAPSHOT.current_phase`
-- `✓` if `phase.disk.summary_count > 0` AND matches `phase.disk.plan_count` AND `phase.disk.has_verification` (complete + verified; if VERIFICATION.md absent, use `◎` and label "complete-unverified")
+- `✓` if `phase.disk.summary_count > 0` AND `phase.disk.summary_count >= phase.disk.plan_count` AND `phase.disk.has_verification` (complete + verified; if VERIFICATION.md absent, use `◎` and label "complete-unverified")
+- `◎` if `phase.disk.summary_count > 0` AND `phase.disk.summary_count >= phase.disk.plan_count` AND NOT `phase.disk.has_verification` (work done, awaiting verification)
 - `◆` if `phase.disk.plan_count > phase.disk.summary_count` (executing — has plans, not all summarized)
 - `◇` if `phase.disk.has_context && !phase.disk.plan_count` (discussing — CONTEXT.md exists but no plan yet)
 - `◈` if `phase.disk.has_research && !phase.disk.plan_count` (researched — RESEARCH.md but no plan)
 - `○` otherwise (planned — no artifacts on disk)
 
+**Edge case — summary without sprint:** If `summary_count > 0` AND `plan_count === 0`, treat as `◎ complete-unverified` (sprint was archived or the phase used an older single-file workflow; summary is evidence of completed work).
+
 ```
 Phases:
   ▶ [04] Component compaction — executing (1/3 plans)