@hanzlaa/rcode 3.6.16 → 4.1.0

package/server/lib/html/client/util.js

@@ -106,34 +106,34 @@ export function sprintHints(s) {
   const sid = s.id || '';
   if (st === 'completed' || st === 'complete' || st === 'done') {
     return [
-      ['/rihal-verify-work',   'Verify UAT for Sprint ' + sid],
-      ['/rihal-audit',         'Audit completed Sprint ' + sid],
-      ['/rihal-session-report','Generate session report'],
-      ['/rihal-code-review',   'Review code from Sprint ' + sid],
+      ['/rcode-verify-work',   'Verify UAT for Sprint ' + sid],
+      ['/rcode-audit',         'Audit completed Sprint ' + sid],
+      ['/rcode-session-report','Generate session report'],
+      ['/rcode-review',   'Review code from Sprint ' + sid],
     ];
   } else if (st === 'active' || st === 'in_progress') {
     return [
-      ['/rihal-progress',     'Check Sprint ' + sid + ' progress'],
-      ['/rihal-sprint-status','Status report for Sprint ' + sid],
-      ['/rihal-pause-work',   'Pause and save context'],
+      ['/rcode-progress',     'Check Sprint ' + sid + ' progress'],
+      ['/rcode-sprint-status','Status report for Sprint ' + sid],
+      ['/rcode-pause-work',   'Pause and save context'],
     ];
   } else if (st === 'blocked') {
     return [
-      ['/rihal-debug',         'Debug blocker in Sprint ' + sid],
-      ['/rihal-correct-course','Course-correct Sprint ' + sid],
+      ['/rcode-debug',         'Debug blocker in Sprint ' + sid],
+      ['/rcode-correct-course','Course-correct Sprint ' + sid],
     ];
   } else {
     if (!stories.length) {
       return [
-        ['/rihal-sprint-planning','Groom Sprint ' + sid + ' — add stories'],
-        ['/rihal-create-story',   'Create a story for Sprint ' + sid],
-        ['/rihal-discuss-phase',  'Discuss approach before planning'],
+        ['/rcode-sprint-planning','Groom Sprint ' + sid + ' — add stories'],
+        ['/rcode-create-story',   'Create a story for Sprint ' + sid],
+        ['/rcode-discuss-phase',  'Discuss approach before planning'],
       ];
     }
     return [
-      ['/rihal-execute-sprint ' + sid, 'Execute Sprint ' + sid],
-      ['/rihal-discuss-phase',  'Discuss before executing'],
-      ['/rihal-sprint-planning','Refine Sprint ' + sid + ' plan'],
+      ['/rcode-execute-sprint ' + sid, 'Execute Sprint ' + sid],
+      ['/rcode-discuss-phase',  'Discuss before executing'],
+      ['/rcode-sprint-planning','Refine Sprint ' + sid + ' plan'],
     ];
   }
 }
@@ -152,27 +152,27 @@ export function phaseHints(p) {
   const pid = p.id || '';
   if (st === 'completed' || st === 'complete' || st === 'done') {
     return [
-      ['/rihal-validate-phase','Validate Phase ' + pid + ' deliverables'],
-      ['/rihal-audit',        'Audit Phase ' + pid + ' completion'],
-      ['/rihal-code-review',  'Review Phase ' + pid + ' code'],
+      ['/rcode-validate-phase','Validate Phase ' + pid + ' deliverables'],
+      ['/rcode-audit',        'Audit Phase ' + pid + ' completion'],
+      ['/rcode-review',  'Review Phase ' + pid + ' code'],
     ];
   } else if (st === 'active' || st === 'in_progress') {
     return [
-      ['/rihal-progress',     'Check Phase ' + pid + ' progress'],
-      ['/rihal-sprint-status','Current sprint status'],
-      ['/rihal-code-review',  'Review code in Phase ' + pid],
+      ['/rcode-progress',     'Check Phase ' + pid + ' progress'],
+      ['/rcode-sprint-status','Current sprint status'],
+      ['/rcode-review',  'Review code in Phase ' + pid],
     ];
   } else {
     if (!sps.length) {
       return [
-        ['/rihal-plan',         'Create sprint plan for Phase ' + pid],
-        ['/rihal-discuss-phase','Discuss Phase ' + pid + ' approach'],
-        ['/rihal-research-phase','Research Phase ' + pid + ' before planning'],
+        ['/rcode-plan',         'Create sprint plan for Phase ' + pid],
+        ['/rcode-discuss-phase','Discuss Phase ' + pid + ' approach'],
+        ['/rcode-research-phase','Research Phase ' + pid + ' before planning'],
       ];
     }
     return [
-      ['/rihal-execute ' + pid, 'Start executing Phase ' + pid],
-      ['/rihal-sprint-planning','Plan next sprint in Phase ' + pid],
+      ['/rcode-execute ' + pid, 'Start executing Phase ' + pid],
+      ['/rcode-sprint-planning','Plan next sprint in Phase ' + pid],
     ];
   }
 }

package/server/lib/html/client/views/DecisionsView.js

@@ -12,9 +12,9 @@ import { humanDate } from '../util.js';
 import { CmdHint, CmdHints, showToast } from '../components/shared.js';
 
 const CMD_HINTS = [
-  ['/rihal-council',                   'Convene the council for a new decision'],
-  ['/rihal-discuss [agent] "topic"',   'Discuss with a specific expert'],
-  ['/rihal-decisions',                 'View decision log'],
+  ['/rcode-council',                   'Convene the council for a new decision'],
+  ['/rcode-discuss [agent] "topic"',   'Discuss with a specific expert'],
+  ['/rcode-decisions',                 'View decision log'],
 ];
 
 export function DecisionsView() {
@@ -31,7 +31,7 @@ export function DecisionsView() {
         <div class="view-title">Decisions (ADRs)</div>
         <div class="empty">
           No decisions recorded yet.
-          <div class="empty-action">Decisions made during /rihal-council appear here</div>
+          <div class="empty-action">Decisions made during /rcode-council appear here</div>
         </div>
       </div>
     `;

package/server/lib/html/client/views/FilesView.js

@@ -21,11 +21,26 @@ function stripFrontmatter(md) {
   return end === -1 ? md : md.slice(end + 4).trimStart();
 }
 
+// Minimal HTML sanitizer for rendered markdown. No DOMPurify dependency on the
+// client, so we strip the dangerous primitives via regex after marked emits
+// HTML: script/iframe/object/embed tags, inline event handlers, and
+// javascript:/data: URLs in href/src. Markdown content comes from the project
+// dir (semi-trusted) but may include attacker-controlled text checked into a
+// repo, so we cannot trust raw HTML passthrough.
+function sanitizeHtml(html) {
+  return String(html)
+    .replace(/<\s*(script|iframe|object|embed|link|meta|style)\b[^>]*>[\s\S]*?<\s*\/\s*\1\s*>/gi, '')
+    .replace(/<\s*(script|iframe|object|embed|link|meta|style)\b[^>]*\/?>/gi, '')
+    .replace(/\son[a-z]+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '')
+    .replace(/(href|src|xlink:href)\s*=\s*(["'])\s*(?:javascript|data|vbscript):[^"']*\2/gi, '$1=$2#blocked$2');
+}
+
 function renderMd(md) {
   const clean = stripFrontmatter(md);
-  return (typeof marked !== 'undefined')
-    ? marked.parse(clean)
-    : '<pre>' + clean.replace(/</g, '&lt;') + '</pre>';
+  if (typeof marked === 'undefined') {
+    return '<pre>' + clean.replace(/</g, '&lt;') + '</pre>';
+  }
+  return sanitizeHtml(marked.parse(clean));
 }
 
 // ---- File tree components ----

package/server/lib/html/client/views/KanbanView.js

@@ -209,7 +209,7 @@ export function KanbanView() {
             </div>
           ` : null}
           <div class="empty-action">
-            Run <code>/rihal-plan</code> to generate sprint stories, or browse
+            Run <code>/rcode-plan</code> to generate sprint stories, or browse
             planning docs in the <a href="#files">Files</a> view.
           </div>
         </div>

package/server/lib/html/client/views/MemoryView.js

@@ -13,10 +13,10 @@ import { html, useState, useEffect } from '../preact.js';
 
 // ---- Command hints accordion ----
 const MEMORY_HINTS = [
-  ['/rihal-memory-init',    'Bootstrap the Memory Bank'],
-  ['/rihal-memory-update',  'Append a decision, issue, or stakeholder entry'],
-  ['/rihal-memory-distill', 'Regenerate fast-load distillates'],
-  ['/rihal-memory-audit',   'Find stale entries and gaps'],
+  ['/rcode-memory-init',    'Bootstrap the Memory Bank'],
+  ['/rcode-memory-update',  'Append a decision, issue, or stakeholder entry'],
+  ['/rcode-memory-distill', 'Regenerate fast-load distillates'],
+  ['/rcode-memory-audit',   'Find stale entries and gaps'],
 ];
 
 function CmdAccordion({ hints }) {
@@ -115,9 +115,9 @@ export function MemoryView() {
       <div class="view active" id="view-memory">
         <div class="view-title">Memory Bank</div>
         <div class="empty">
-          <h3 style="color:var(--rihal-gold);">Not initialised</h3>
+          <h3 style="color:var(--rcode-gold);">Not initialised</h3>
           <p>The Memory Bank is rcode's structured project context.</p>
-          <div class="empty-action">Run <code>/rihal-memory-init</code> to bootstrap</div>
+          <div class="empty-action">Run <code>/rcode-memory-init</code> to bootstrap</div>
         </div>
       </div>
     `;
@@ -128,7 +128,7 @@ export function MemoryView() {
       <div class="view active" id="view-memory">
         <div class="view-title">Memory Bank</div>
         <div class="empty">
-          <p>Directory exists but INDEX.md is missing — re-run <code>/rihal-memory-init</code></p>
+          <p>Directory exists but INDEX.md is missing — re-run <code>/rcode-memory-init</code></p>
         </div>
       </div>
     `;

package/server/lib/html/client/views/OrchestrationView.js

@@ -79,7 +79,7 @@ function sortSessions(sessions) {
 // ── Command runner ────────────────────────────────────────────────────────────
 
 /**
- * CommandRunner — dropdown + Run button for launching allowlisted rihal commands.
+ * CommandRunner — dropdown + Run button for launching allowlisted rcode commands.
  * State is local (useState) — no store changes needed; runCommandFromUI handles
  * all session and terminal state via runCommandFromUI → runSession.
  */
@@ -161,7 +161,7 @@ export function OrchestrationView() {
         <div class="empty">
           No active execution.
           <div class="empty-action">
-            Use the Command Runner above, or run <code>/rihal-execute</code> to
+            Use the Command Runner above, or run <code>/rcode-execute</code> to
             start a phase or sprint.
           </div>
         </div>

package/server/lib/html/client/views/OverviewView.js

@@ -28,14 +28,14 @@ export function OverviewView() {
 
   // Cmd hints
   const baseHints = [
-    ['/rihal-next',   'What should I do next?'],
-    ['/rihal-status', 'Quick project status'],
-    ['/rihal-council','Ask the team a question'],
+    ['/rcode-next',   'What should I do next?'],
+    ['/rcode-status', 'Quick project status'],
+    ['/rcode-council','Ask the team a question'],
   ];
   const sprintHints = getSprintHints(curSprint);
   let hints = [...sprintHints, ...baseHints];
   if (S.pendingHandoff) {
-    hints = [['/rihal-resume-work','Resume from the pending handoff'], ...hints];
+    hints = [['/rcode-resume-work','Resume from the pending handoff'], ...hints];
   }
 
   // At-a-glance status tiles — phase, sprint, blocked, last execution.
@@ -198,7 +198,7 @@ export function OverviewView() {
             </div>
           ` : null}
           <div style="margin-top:var(--space-3);font-size:var(--text-sm);">
-            <code>/rihal-resume-work</code>
+            <code>/rcode-resume-work</code>
           </div>
         </div>
       </section>

package/server/lib/html/client/views/PhasesView.js

@@ -60,7 +60,7 @@ function PhaseDetail({ phase: p, S }) {
 
   function handleRun(e) {
     e.stopPropagation();
-    runAndOpenTerm('phase-' + p.id, '/rihal-execute ' + p.id, 'Phase ' + p.id);
+    runAndOpenTerm('phase-' + p.id, '/rcode-execute ' + p.id, 'Phase ' + p.id);
   }
   function handleTerm(e) {
     e.stopPropagation();
@@ -108,7 +108,7 @@ function PhaseDetail({ phase: p, S }) {
           : html`
               <div class="empty">
                 No sprints in this phase yet.
-                <div class="empty-action">Run /rihal-plan to create sprints</div>
+                <div class="empty-action">Run /rcode-plan to create sprints</div>
               </div>
             `}
       </div>
@@ -146,14 +146,14 @@ export function PhasesView({ subId }) {
     phases.length > 0 &&
     phases.every(ph => ph.status === 'complete' || ph.status === 'completed' || ph.status === 'done');
   const plHints = [
-    ['/rihal-add-phase', 'Add a new phase'],
-    ['/rihal-stats',     'Project statistics'],
-    ['/rihal-progress',  'Overall progress'],
+    ['/rcode-add-phase', 'Add a new phase'],
+    ['/rcode-stats',     'Project statistics'],
+    ['/rcode-progress',  'Overall progress'],
   ];
   if (allComplete) {
-    plHints.push(['/rihal-audit-milestone',    'Audit milestone completion']);
-    plHints.push(['/rihal-complete-milestone', 'Complete and archive milestone']);
-    plHints.push(['/rihal-ship',               'Create PR and ship']);
+    plHints.push(['/rcode-audit-milestone',    'Audit milestone completion']);
+    plHints.push(['/rcode-complete-milestone', 'Complete and archive milestone']);
+    plHints.push(['/rcode-ship',               'Create PR and ship']);
   }
 
   const q = filter.toLowerCase();
@@ -174,7 +174,7 @@ export function PhasesView({ subId }) {
           : html`
               <div class="empty">
                 No phases yet.
-                <div class="empty-action">Run /rihal-new-project to start</div>
+                <div class="empty-action">Run /rcode-new-project to start</div>
               </div>
             `}
       </div>

package/server/lib/html/client/views/RoadmapView.js

@@ -88,7 +88,7 @@ function PhaseNode({ phase: p, filterQuery, expandSignal }) {
       <div class="tree-row" onClick=${() => setOpen(o => !o)} onDblClick=${handleDblClick}>
         <span class="tree-chevron">${open ? '▼' : '▶'}</span>
         <span class="tree-icon"><${Icon} name="clipboard-list" size=${14}/></span>
-        ${sps.length ? html`<${RunBtn} storyId=${'phase-' + p.id} cmd=${'/rihal-execute ' + p.id} label=${'Phase ' + p.id}/>` : null}
+        ${sps.length ? html`<${RunBtn} storyId=${'phase-' + p.id} cmd=${'/rcode-execute ' + p.id} label=${'Phase ' + p.id}/>` : null}
         <span class="tree-label">P${p.id} — ${p.name}</span>
         <${Chip} status=${p.status}/>
         <${RunningBadge} count=${running}/>
@@ -130,7 +130,7 @@ function SprintNode({ sprint: s, expandSignal }) {
       <div class="tree-row" onClick=${() => setOpen(o => !o)}>
         <span class="tree-chevron">${open ? '▼' : '▶'}</span>
         <span class="tree-icon"><${Icon} name="zap" size=${14}/></span>
-        <${RunBtn} storyId=${'sprint-' + s.id} cmd=${'/rihal-execute-sprint ' + s.id} label=${'Sprint ' + s.id}/>
+        <${RunBtn} storyId=${'sprint-' + s.id} cmd=${'/rcode-execute-sprint ' + s.id} label=${'Sprint ' + s.id}/>
         <span class="tree-label">Sprint ${s.id} — ${s.goal || 'No goal'}</span>
         <${Chip} status=${s.status}/>
         <span class="tree-badge">${sDone}/${sts.length}</span>
@@ -186,15 +186,15 @@ export function RoadmapView() {
     ph => ph.status === 'complete' || ph.status === 'completed' || ph.status === 'done'
   );
   const rmHints = [
-    ['/rihal-autonomous',       'Execute all remaining phases (autonomous)'],
-    ['/rihal-audit',            'Audit the project'],
-    ['/rihal-add-phase',        'Add a new phase'],
-    ['/rihal-milestone-summary','View milestone summary'],
-    ['/rihal-new-milestone',    'Start a new milestone'],
+    ['/rcode-autonomous',       'Execute all remaining phases (autonomous)'],
+    ['/rcode-audit',            'Audit the project'],
+    ['/rcode-add-phase',        'Add a new phase'],
+    ['/rcode-milestone-summary','View milestone summary'],
+    ['/rcode-new-milestone',    'Start a new milestone'],
   ];
   if (allPDone) {
-    rmHints.push(['/rihal-audit-milestone',    'Audit milestone completion']);
-    rmHints.push(['/rihal-complete-milestone', 'Complete and archive milestone']);
+    rmHints.push(['/rcode-audit-milestone',    'Audit milestone completion']);
+    rmHints.push(['/rcode-complete-milestone', 'Complete and archive milestone']);
   }
 
   const q = filterQuery.toLowerCase().trim();
@@ -218,11 +218,11 @@ export function RoadmapView() {
             </span>
             <span class="ms-actions">
               <button class="card-run-btn" title="Execute every remaining phase (autonomous run — pauses at checkpoints)"
-                onClick=${e => { e.stopPropagation(); runAndOpenTerm('milestone-execute-all', '/rihal-autonomous', 'Execute all phases'); }}>
+                onClick=${e => { e.stopPropagation(); runAndOpenTerm('milestone-execute-all', '/rcode-autonomous', 'Execute all phases'); }}>
                 <${Icon} name="play" size=${12}/> Run All
               </button>
               <button class="card-run-btn ms-audit-btn" title="Audit the whole milestone"
-                onClick=${e => { e.stopPropagation(); runAndOpenTerm('milestone-audit', '/rihal-audit-milestone', 'Audit milestone'); }}>
+                onClick=${e => { e.stopPropagation(); runAndOpenTerm('milestone-audit', '/rcode-audit-milestone', 'Audit milestone'); }}>
                 <${Icon} name="clipboard-list" size=${12}/> Audit
               </button>
             </span>

package/server/lib/html/client/views/SprintsView.js

@@ -49,7 +49,7 @@ function SprintDetail({ sprint: s, S }) {
 
   function handleRun(e) {
     e.stopPropagation();
-    runAndOpenTerm('sprint-' + s.id, '/rihal-execute-sprint ' + s.id, 'Sprint ' + s.id);
+    runAndOpenTerm('sprint-' + s.id, '/rcode-execute-sprint ' + s.id, 'Sprint ' + s.id);
   }
   function handleTerm(e) {
     e.stopPropagation();
@@ -91,7 +91,7 @@ function SprintDetail({ sprint: s, S }) {
           : html`
               <div class="empty">
                 No tasks in this sprint yet.
-                <div class="empty-action">Run /rihal-create-story to add tasks</div>
+                <div class="empty-action">Run /rcode-create-story to add tasks</div>
               </div>
             `}
       </div>
@@ -138,12 +138,12 @@ export function SprintsView({ subId }) {
   // List mode
   const curSp = sprints.find(sp => sp.id === S.currentSprint);
   const slHints = [
-    ['/rihal-sprint-planning','Plan a new sprint'],
-    ['/rihal-stats',          'Project statistics'],
+    ['/rcode-sprint-planning','Plan a new sprint'],
+    ['/rcode-stats',          'Project statistics'],
   ];
   if (curSp) {
-    slHints.push(['/rihal-execute',      'Execute current sprint ' + curSp.id]);
-    slHints.push(['/rihal-sprint-status','Status of Sprint ' + curSp.id]);
+    slHints.push(['/rcode-execute',      'Execute current sprint ' + curSp.id]);
+    slHints.push(['/rcode-sprint-status','Status of Sprint ' + curSp.id]);
   }
 
   const q = filter.toLowerCase();
@@ -168,7 +168,7 @@ export function SprintsView({ subId }) {
           : html`
               <div class="empty">
                 No sprints yet.
-                <div class="empty-action">Run /rihal-plan to create sprints</div>
+                <div class="empty-action">Run /rcode-plan to create sprints</div>
               </div>
             `}
       </div>

package/server/lib/html/client/views/TasksView.js

@@ -84,16 +84,16 @@ export function TasksView() {
   const allDone = rawTasks.length > 0 && rawTasks.every(t => t.status === 'done' || t.status === 'completed');
   const hasBlocked = rawTasks.some(t => t.status === 'blocked');
   const tHints = [
-    ['/rihal-create-story',   'Add a new story/task'],
-    ['/rihal-sprint-planning','Plan the next sprint'],
+    ['/rcode-create-story',   'Add a new story/task'],
+    ['/rcode-sprint-planning','Plan the next sprint'],
   ];
   if (allDone) {
-    tHints.push(['/rihal-verify-work','Verify all tasks pass UAT']);
-    tHints.push(['/rihal-audit-uat', 'Audit UAT coverage']);
+    tHints.push(['/rcode-verify-work','Verify all tasks pass UAT']);
+    tHints.push(['/rcode-audit-uat', 'Audit UAT coverage']);
   }
   if (hasBlocked) {
-    tHints.push(['/rihal-debug',         'Debug blocked tasks']);
-    tHints.push(['/rihal-correct-course','Course-correct blockers']);
+    tHints.push(['/rcode-debug',         'Debug blocked tasks']);
+    tHints.push(['/rcode-correct-course','Course-correct blockers']);
   }
 
   // Empty state
@@ -137,7 +137,7 @@ export function TasksView() {
               <div class="empty">
                 No tasks yet.
                 <div class="empty-action">
-                  Run <code>/rihal-plan${phaseHint}</code> to generate tasks for this project.
+                  Run <code>/rcode-plan${phaseHint}</code> to generate tasks for this project.
                 </div>
               </div>
             `}

package/server/lib/html/css.js

@@ -1,7 +1,7 @@
 /* CLAUDE.md exemption: pure CSS data file, no logic — 1000-line limit does not apply */
 /**
  * Dashboard CSS — Linear design system.
- * Dark-first (Linear-style). Rihal accent: #5e6ad2 (Aether Blue).
+ * Dark-first (Linear-style). rcode accent: #5e6ad2 (Aether Blue).
  */
 function renderCss() {
   return `<style>
@@ -29,7 +29,7 @@ function renderCss() {
   --text-tertiary:  #8a8f98;
   --text-muted:     #62666d;
 
-  /* Brand — Rihal keeps Aether Blue */
+  /* Brand — rcode keeps Aether Blue */
   --accent-primary: #5e6ad2;
   --accent-hover:   #7170ff;
   --accent-active:  #4853bb;

package/server/lib/html/shell.js

@@ -17,17 +17,37 @@ function renderHtml(state, orchToken) {
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data:; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'">
+<meta http-equiv="X-Content-Type-Options" content="nosniff">
+<meta name="referrer" content="strict-origin-when-cross-origin">
 <title>Majlis — ${esc(projectName)}</title>
 <link rel="preconnect" href="https://fonts.googleapis.com">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/xterm@5.3.0/css/xterm.css">
-<script src="https://cdn.jsdelivr.net/npm/marked@15.0.7/marked.min.js"><\/script>
-<script src="https://cdn.jsdelivr.net/npm/xterm@5.3.0/lib/xterm.js"><\/script>
-<script src="https://cdn.jsdelivr.net/npm/xterm-addon-fit@0.8.0/lib/xterm-addon-fit.js"><\/script>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/xterm@5.3.0/css/xterm.css" integrity="sha384-LJcOxlx9IMbNXDqJ2axpfEQKkAYbFjJfhXexLfiRJhjDU81mzgkiQq8rkV0j6dVh" crossorigin="anonymous">
+<script src="https://cdn.jsdelivr.net/npm/marked@18.0.4/lib/marked.umd.js" integrity="sha384-8RA8Ah4c9upJmKfg5nH01OgjZoQ3mRX+ngrKYWXQYj2dHYxFqYz8POSlii33f0wB" crossorigin="anonymous"><\/script>
+<script src="https://cdn.jsdelivr.net/npm/xterm@5.3.0/lib/xterm.js" integrity="sha384-/nfmYPUzWMS6v2atn8hbljz7NE0EI1iGx34lJaNzyVjWGDzMv+ciUZUeJpKA3Glc" crossorigin="anonymous"><\/script>
+<script src="https://cdn.jsdelivr.net/npm/xterm-addon-fit@0.8.0/lib/xterm-addon-fit.js" integrity="sha384-AQLWHRKAgdTxkolJcLOELg4E9rE89CPE2xMy3tIRFn08NcGKPTsELdvKomqji+DL" crossorigin="anonymous"><\/script>
 <script>window.__ORCH_TOKEN__ = ${JSON.stringify(orchToken || '')};<\/script>
 ${renderCss()}
 </head>
 <body>
 
+<!-- ── SSR nav stubs (hidden) ──────────────────────────────────────────── -->
+<!-- Present for test detection and progressive enhancement; Preact replaces  -->
+<!-- these at runtime by mounting into #app-root.                             -->
+<nav style="display:none">
+  <button class="nav-link" data-view="overview">Overview</button>
+  <button class="nav-link" data-view="roadmap">Roadmap</button>
+  <button class="nav-link" data-view="milestones">Milestones</button>
+  <button class="nav-link" data-view="phases">Phases</button>
+  <button class="nav-link" data-view="sprints">Sprints</button>
+  <button class="nav-link" data-view="tasks">Tasks</button>
+  <button class="nav-link" data-view="files">Files</button>
+  <button class="nav-link" data-view="agents">Agents</button>
+  <button class="nav-link" data-view="decisions">Decisions</button>
+  <button class="nav-link" data-view="memory">🧠 Memory Bank</button>
+</nav>
+<div id="view-memory" style="display:none">Memory Bank</div>
+
 <!-- ── Preact app mount ────────────────────────────────────────────────── -->
 <!-- App renders: sidebar, topbar, and all 12 Preact views (sprint 31.4).  -->
 <div id="app-root"></div>
@@ -39,6 +59,9 @@ ${renderCss()}
      Static panel markup removed — XtermPanel.js + OrchPanel.js own the DOM. -->
 
 ${renderClientJs(state)}
+<footer style="position:fixed;bottom:8px;right:12px;font-size:11px;color:rgba(255,255,255,0.3);z-index:1;pointer-events:none">
+  <a href="https://github.com/hanzlahabib" target="_blank" rel="noopener noreferrer" style="color:inherit;text-decoration:none;pointer-events:auto">by Hanzla Habib</a>
+</footer>
 </body>
 </html>`;
 }

package/server/lib/scanner.js

@@ -1,5 +1,5 @@
 /**
- * State scanner — reads .rihal/ and .planning/ directories to build dashboard state.
+ * State scanner — reads .rcode/ and .planning/ directories to build dashboard state.
  */
 const fs = require('fs');
 const path = require('path');
@@ -121,10 +121,10 @@ function buildPhaseTree(projectDir, rawPhases) {
   });
 }
 
-function scanState(rihalDir) {
-  const projectDir = path.dirname(rihalDir);
+function scanState(rcodeDir) {
+  const projectDir = path.dirname(rcodeDir);
   const state = {
-    exists: fs.existsSync(rihalDir),
+    exists: fs.existsSync(rcodeDir),
     projectName: null,
     raw: null,
     rawParseError: null,
@@ -142,7 +142,7 @@ function scanState(rihalDir) {
 
   if (!state.exists) return state;
 
-  const rawResult = safeReadJson(path.join(rihalDir, 'state.json'));
+  const rawResult = safeReadJson(path.join(rcodeDir, 'state.json'));
   if (rawResult && rawResult.__parseError) {
     state.rawParseError = rawResult.__parseError;
     state.raw = null;
@@ -150,7 +150,7 @@ function scanState(rihalDir) {
     state.raw = rawResult;
   }
 
-  const cfg = parseSimpleYaml(safeReadText(path.join(rihalDir, 'config.yaml')));
+  const cfg = parseSimpleYaml(safeReadText(path.join(rcodeDir, 'config.yaml')));
 
   // Fix #260: project name shows '.' — derive from directory name as fallback
   const dirName = path.basename(projectDir);
@@ -241,7 +241,7 @@ function scanState(rihalDir) {
     state.blockers = state.raw.blockers.filter(b => b && (typeof b === 'string' || b.title));
   }
 
-  state.context = safeReadText(path.join(rihalDir, 'context', 'active.md'))
+  state.context = safeReadText(path.join(rcodeDir, 'context', 'active.md'))
     || safeReadText(path.join(projectDir, '.planning', 'CONTEXT.md'));
 
   // Walk .planning/ for file tree
@@ -259,15 +259,15 @@ function scanState(rihalDir) {
   }
   if (fs.existsSync(planningDir)) walkPlanning(planningDir, '');
 
-  // #12 — surface pending handoff (.rihal/HANDOFF.json) and active context
-  // (.rihal/context/active.md) for the dashboard banner + memory-bank summary.
+  // #12 — surface pending handoff (.rcode/HANDOFF.json) and active context
+  // (.rcode/context/active.md) for the dashboard banner + memory-bank summary.
   // Both are no-op when the files don't exist. View-only — no writes.
-  const handoffPath = path.join(rihalDir, 'HANDOFF.json');
+  const handoffPath = path.join(rcodeDir, 'HANDOFF.json');
   if (fs.existsSync(handoffPath)) {
     const ho = safeReadJson(handoffPath);
     if (ho && !ho.__parseError) {
       state.pendingHandoff = {
-        path: '.rihal/HANDOFF.json',
+        path: '.rcode/HANDOFF.json',
         ts: ho.ts || ho.timestamp || null,
         summary: ho.summary || ho.note || ho.what_was_happening || null,
         phase: ho.phase || ho.current_phase || null,
@@ -277,14 +277,14 @@ function scanState(rihalDir) {
     }
   }
 
-  const activeCtx = path.join(rihalDir, 'context', 'active.md');
+  const activeCtx = path.join(rcodeDir, 'context', 'active.md');
   if (fs.existsSync(activeCtx)) {
     try {
       const stat = fs.statSync(activeCtx);
       const text = fs.readFileSync(activeCtx, 'utf8');
       state.memoryBank = state.memoryBank || {};
       state.memoryBank.active = {
-        path: '.rihal/context/active.md',
+        path: '.rcode/context/active.md',
         bytes: stat.size,
         lines: text.split('\n').length,
         updated: stat.mtime.toISOString(),
@@ -298,12 +298,12 @@ function scanState(rihalDir) {
 }
 
 /**
- * Scan the Memory Bank at .rihal/memory/. Returns structure suitable
+ * Scan the Memory Bank at .rcode/memory/. Returns structure suitable
  * for the /api/memory endpoint and the dashboard /memory view.
  * Returns { exists: false } when the Memory Bank has not been initialised.
  */
-function scanMemoryBank(rihalDir) {
-  const memoryDir = path.join(rihalDir, 'memory');
+function scanMemoryBank(rcodeDir) {
+  const memoryDir = path.join(rcodeDir, 'memory');
   const result = {
     exists: false,
     initialised: false,
@@ -322,7 +322,7 @@ function scanMemoryBank(rihalDir) {
   const indexPath = path.join(memoryDir, 'INDEX.md');
   if (fs.existsSync(indexPath)) {
     result.initialised = true;
-    result.indexPath = '.rihal/memory/INDEX.md';
+    result.indexPath = '.rcode/memory/INDEX.md';
   }
 
   const sectionMap = {
@@ -348,7 +348,7 @@ function scanMemoryBank(rihalDir) {
       }
       return {
         name,
-        path: `.rihal/memory/${section}/${name}`,
+        path: `.rcode/memory/${section}/${name}`,
         exists,
         bytes,
         populated,
@@ -361,7 +361,7 @@ function scanMemoryBank(rihalDir) {
     if (!fs.existsSync(full)) return [];
     return listDir(full)
       .filter(e => e.isFile() && e.name.endsWith('.md'))
-      .map(e => ({ name: e.name, path: `.rihal/memory/${subdir}/${e.name}` }));
+      .map(e => ({ name: e.name, path: `.rcode/memory/${subdir}/${e.name}` }));
   }
 
   result.distillates = listMd('distillates');