@hanzlaa/rcode 4.1.1 → 4.3.0

package/cli/nuke.js

@@ -20,9 +20,12 @@
 'use strict';
 
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
+// HOME-aware home resolution (#889) — os.homedir() ignores a stubbed HOME
+// on Windows, so tests pointing HOME at a temp dir still scanned the real
+// profile dir there (and tripped over real ~/.rcode state).
+const { homedir } = require('./lib/homedir.cjs');
 
 function exists(p) {
   try { fs.accessSync(p); return true; } catch { return false; }
@@ -37,7 +40,7 @@ function readDirSafe(p) {
  * Returns a list of { manager, dir } — dir may not exist.
  */
 function getGlobalNodeModulesDirs() {
-  const home = os.homedir();
+  const home = homedir();
   const candidates = [];
 
   // npm — npm root -g resolves to the active node version's lib/node_modules.
@@ -106,7 +109,7 @@ function findRcodePackages(globalNodeModules) {
  * Resolve global bin directories where rcode/rcode/rcode may live.
  */
 function getGlobalBinDirs() {
-  const home = os.homedir();
+  const home = homedir();
   const dirs = new Set();
 
   // npm prefix bin
@@ -214,7 +217,7 @@ function findClaudeArtifacts(claudeDir) {
 }
 
 function buildPlan({ includePlanning }) {
-  const home = os.homedir();
+  const home = homedir();
   const cwd = process.cwd();
   const plan = {
     packages: [],
@@ -244,13 +247,15 @@ function buildPlan({ includePlanning }) {
   plan.globalClaude = findClaudeArtifacts(path.join(home, '.claude'));
 
   // Global state (~/.rcode/)
+  // #889: was `= globalRcode` (undefined) — a ReferenceError that only fired
+  // when ~/.rcode existed, crashing every dry-run on machines with global state.
   const globalrcode = path.join(home, '.rcode');
-  if (exists(globalrcode)) plan.globalrcode = globalRcode;
+  if (exists(globalrcode)) plan.globalrcode = globalrcode;
 
   // Project-level (CWD only — never recurse, user may have many projects)
   plan.projectClaude = findClaudeArtifacts(path.join(cwd, '.claude'));
   const projectrcode = path.join(cwd, '.rcode');
-  if (exists(projectrcode) && cwd !== home) plan.projectrcode = projectRcode;
+  if (exists(projectrcode) && cwd !== home) plan.projectrcode = projectrcode;
 
   if (includePlanning) {
     const projectPlanning = path.join(cwd, '.planning');
@@ -351,7 +356,7 @@ function executePlan(plan) {
     if (rmrf(a.path)) { console.log(`  ✓ removed ${a.path}`); removed++; }
   }
   if (plan.globalrcode && rmrf(plan.globalrcode)) {
-    console.log(`  ✓ removed ${plan.globalRcode}`); removed++;
+    console.log(`  ✓ removed ${plan.globalrcode}`); removed++;
   }
 
   // Claude artifacts (project)
@@ -359,7 +364,7 @@ function executePlan(plan) {
     if (rmrf(a.path)) { console.log(`  ✓ removed ${a.path}`); removed++; }
   }
   if (plan.projectrcode && rmrf(plan.projectrcode)) {
-    console.log(`  ✓ removed ${plan.projectRcode}`); removed++;
+    console.log(`  ✓ removed ${plan.projectrcode}`); removed++;
   }
   if (plan.projectPlanning && rmrf(plan.projectPlanning)) {
     console.log(`  ✓ removed ${plan.projectPlanning}`); removed++;

package/cli/postinstall.js

@@ -13,6 +13,17 @@
 const os = require('os');
 const path = require('path');
 
+/**
+ * Path containment check that survives Windows: path.relative normalizes
+ * separators (/ vs \) and compares drive letters case-insensitively, which
+ * a raw startsWith prefix compare does not.
+ */
+function isPathInside(child, parent) {
+  const rel = path.relative(parent, child);
+  if (rel === '') return true;
+  return rel !== '..' && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel);
+}
+
 /**
  * Decide whether the current postinstall invocation represents a GLOBAL
  * `npm install -g @hanzlaa/rcode` (true) or a transitive devDep install
@@ -28,17 +39,16 @@ const path = require('path');
 function isGlobalInstall(env, dirname, cwd) {
   try {
     if (env.npm_config_global === 'true') return true;
-    if (env.PNPM_HOME && dirname.startsWith(env.PNPM_HOME)) return true;
+    if (env.PNPM_HOME && isPathInside(dirname, env.PNPM_HOME)) return true;
     const globalPatterns = [
-      /\/node_modules\/@hanzlaa\/rcode/,
+      /[/\\]node_modules[/\\]@hanzlaa[/\\]rcode/,
       /[/\\]lib[/\\]node_modules[/\\]/,
       /\.nvm[/\\]versions[/\\]/,
       /\.pnpm[/\\]/,
       /\.yarn[/\\]global/,
     ];
     if (globalPatterns.some((re) => re.test(dirname))) return true;
-    const localNodeModules = path.join(cwd, 'node_modules');
-    if (!dirname.startsWith(localNodeModules)) return true;
+    if (!isPathInside(dirname, path.join(cwd, 'node_modules'))) return true;
     return false;
   } catch {
     return false;

package/cli/rcode-slash-router.cjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+'use strict';
+
+// rcode slash-command hook router.
+//
+// WHY this exists: Codex CLI and Antigravity CLI do NOT surface file-based
+// `/slash` commands the way Claude Code / Grok do (verified live). They DO,
+// however, support a prompt-submit hook (`UserPromptSubmit` / `UserPrompt`)
+// that can inject extra context into the model's turn. This router is wired
+// into that hook by the installer. When the user types `/rcode-<name> [args]`,
+// the router loads the matching command body and injects it as additional
+// context so the model executes that command — the closest thing to a native
+// slash command those CLIs allow.
+//
+// Dependency-free (Node stdlib only) so it can run from a stable home dir
+// (~/.rcode/bin/) without an install step. NEVER throws to the host CLI: any
+// error exits 0 with no output so a malfunctioning router can never break or
+// swallow the user's real prompt.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+// Command bodies are copied here by the installer (installSlashRouterCommands).
+// A fixed home-dir location means the hook can always read them regardless of
+// the user's current working directory.
+// HOME wins over os.homedir() (#889): os.homedir() ignores HOME on Windows
+// (it reads USERPROFILE), so HOME-redirected runs (tests, git-bash) would read
+// the wrong profile dir. Inlined — this script is copied standalone to
+// ~/.rcode/bin/ and must stay dependency-free (no ./lib requires).
+const COMMANDS_DIR = path.join(process.env.HOME || os.homedir(), '.rcode', 'slash-commands');
+
+// Matches `/rcode-<name>` at the very start, optional whitespace, then the
+// rest of the line(s) as arguments. `\b` ends the command name so trailing
+// punctuation/args don't leak into <name>.
+const SLASH_RE = /^\/rcode-([a-z0-9-]+)\b[ \t]*([\s\S]*)$/;
+
+function readStdin() {
+  try {
+    return fs.readFileSync(0, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+// Strip a leading YAML frontmatter block (`---\n...\n---`). The frontmatter is
+// CLI-tooling metadata (name/description/allowed-tools) that only confuses the
+// model — we want the executable command body injected, not its header.
+// \r?\n because Windows checkouts may deliver CRLF command bodies (#889).
+function stripFrontmatter(text) {
+  return text.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '');
+}
+
+function emit(hookEventName, additionalContext) {
+  const payload = {
+    hookSpecificOutput: {
+      hookEventName: hookEventName || 'UserPromptSubmit',
+      additionalContext,
+    },
+  };
+  process.stdout.write(JSON.stringify(payload));
+}
+
+function main() {
+  const raw = readStdin();
+  if (!raw.trim()) return;
+
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return; // not JSON we understand → pass-through (no output)
+  }
+
+  // Field names vary across CLIs; accept the common spellings.
+  const prompt =
+    data.prompt ??
+    data.user_prompt ??
+    data.userPrompt ??
+    data.message ??
+    data.input ??
+    '';
+  const hookEventName = data.hook_event_name || data.hookEventName || 'UserPromptSubmit';
+
+  if (typeof prompt !== 'string') return;
+
+  const match = prompt.replace(/^\s+/, '').match(SLASH_RE);
+  if (!match) return; // not an rcode command → pass-through (no output)
+
+  const name = match[1];
+  const args = (match[2] || '').trim();
+
+  const cmdFile = path.join(COMMANDS_DIR, `${name}.md`);
+  if (!fs.existsSync(cmdFile)) {
+    // Unknown command: inject a short note rather than silently doing nothing,
+    // so the user learns the command name didn't resolve.
+    emit(
+      hookEventName,
+      `Unknown rcode command: /rcode-${name}. No matching command body was found in ${COMMANDS_DIR}.`,
+    );
+    return;
+  }
+
+  let body = stripFrontmatter(fs.readFileSync(cmdFile, 'utf8')).trim();
+  if (args) {
+    // Surface user-supplied args the way the command bodies expect ($ARGUMENTS).
+    body += `\n\nArguments: ${args}`;
+  }
+
+  emit(hookEventName, body);
+}
+
+try {
+  main();
+} catch {
+  // Never break the host CLI's prompt — fail open, silently.
+}
+process.exit(0);

package/cli/uninstall.js

@@ -25,6 +25,7 @@
  */
 
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const { askConfirm, PromptAbortError } = require('./lib/prompts.cjs');
@@ -128,6 +129,35 @@ function cleanRcodePreCommitHook(cwd) {
   } catch { return 'skipped'; }
 }
 
+/**
+ * Remove the rcode slash-router hook entry from a CLI hooks JSON file
+ * (codex: ~/.codex/hooks.json UserPromptSubmit, antigravity:
+ * ~/.gemini/antigravity/settings.json UserPrompt) while preserving every
+ * other entry (herdr's, the user's). Matches the router by command substring.
+ * Idempotent + guarded: missing/unparseable files are no-ops.
+ * Returns 'removed' | 'unchanged' | 'skipped'.
+ */
+function removeSlashRouterHook(jsonPath, eventKey) {
+  if (!fs.existsSync(jsonPath)) return 'skipped';
+  let root;
+  try { root = JSON.parse(fs.readFileSync(jsonPath, 'utf8')); } catch { return 'skipped'; }
+  if (!root || typeof root !== 'object' || !root.hooks || !Array.isArray(root.hooks[eventKey])) {
+    return 'unchanged';
+  }
+  const before = root.hooks[eventKey].length;
+  root.hooks[eventKey] = root.hooks[eventKey].filter(group =>
+    !(Array.isArray(group?.hooks) &&
+      group.hooks.some(h => typeof h?.command === 'string' && h.command.includes('rcode-slash-router.cjs'))),
+  );
+  if (root.hooks[eventKey].length === before) return 'unchanged';
+  // Drop the event key entirely if it is now empty, to leave a tidy file.
+  if (root.hooks[eventKey].length === 0) delete root.hooks[eventKey];
+  try {
+    writeFileAtomic(jsonPath, JSON.stringify(root, null, 2) + '\n');
+    return 'removed';
+  } catch { return 'skipped'; }
+}
+
 /**
  * Walk a directory and remove all files/subdirs whose name matches a predicate.
  * Returns the number of entries removed. Always skips local overrides (#382).
@@ -433,7 +463,11 @@ function planToPathList(plan, cwd, options = {}) {
  * still proceed since the user already confirmed the destructive action.
  */
 function createBackup(cwd, plan, options = {}) {
-  const paths = planToPathList(plan, cwd, { purge: options.purge === true });
+  // Tar entry names are always '/'-separated; on Windows planToPathList
+  // produces '\'-joined paths that bsdtar may store verbatim. Normalize so
+  // the archive (and any `tar -tzf` consumer) sees portable paths.
+  const paths = planToPathList(plan, cwd, { purge: options.purge === true })
+    .map((p) => p.split(path.sep).join('/'));
   if (paths.length === 0) {
     return { ok: false, warning: 'nothing to back up' };
   }
@@ -746,6 +780,29 @@ async function runUninstall(args) {
     if (n > 0) console.log(`   ✓ removed ${n} Antigravity agents`);
   }
 
+  // Slash-router hooks (home-dir, CLI-native). Installed only via `--global`
+  // for codex/antigravity; remove the rcode UserPromptSubmit/UserPrompt entry
+  // from each CLI's hooks JSON, leaving herdr + other hooks intact.
+  if (editors.includes('codex')) {
+    const r = removeSlashRouterHook(path.join(os.homedir(), '.codex', 'hooks.json'), 'UserPromptSubmit');
+    if (r === 'removed') console.log(`   ✓ removed rcode slash-router hook from ~/.codex/hooks.json`);
+  }
+  if (editors.includes('antigravity')) {
+    const r = removeSlashRouterHook(path.join(os.homedir(), '.gemini', 'antigravity', 'settings.json'), 'UserPrompt');
+    if (r === 'removed') console.log(`   ✓ removed rcode slash-router hook from ~/.gemini/antigravity/settings.json`);
+  }
+  // The router script + command-body copies are shared by both CLIs; remove
+  // them once if either is in scope.
+  if (editors.includes('codex') || editors.includes('antigravity')) {
+    const home = os.homedir();
+    for (const dir of [path.join(home, '.rcode', 'slash-commands'), path.join(home, '.rcode', 'bin')]) {
+      if (fs.existsSync(dir)) {
+        const rr = safeRmSync(dir, home);
+        if (rr.ok) console.log(`   ✓ removed ${dir}`);
+      }
+    }
+  }
+
   // #706 — gemini removal (.gemini/rcode/{agents,commands})
   if (editors.includes('gemini')) {
     let n = 0;
@@ -925,6 +982,7 @@ module.exports.isLocalOverride = isLocalOverride;
 module.exports.planToPathList = planToPathList;
 module.exports.discoverKnownActionSkills = discoverKnownActionSkills;
 module.exports.stripRcodeGitignoreBlock = stripRcodeGitignoreBlock;
+module.exports.removeSlashRouterHook = removeSlashRouterHook;
 
 // Direct invocation — allow `node cli/uninstall.js [flags]` to run end-to-end.
 // When called via cli/index.js, module.exports is invoked directly.

package/cli/update.js

@@ -34,6 +34,8 @@ const { spawnSync } = require('child_process');
 const clack = require('@clack/prompts');
 const { PromptAbortError } = require('./lib/prompts.cjs');
 const { writeFileAtomic } = require('./lib/fsutil.cjs');
+// HOME-aware home resolution (#889): os.homedir() ignores HOME on Windows.
+const { homedir } = require('./lib/homedir.cjs');
 const { verifyInstall, formatReport } = require('./lib/manifest.cjs');
 const install = require('./install');
 
@@ -46,7 +48,9 @@ const install = require('./install');
 function readConfigYaml(configPath) {
   const text = fs.readFileSync(configPath, 'utf8');
   const obj = {};
-  for (const raw of text.split('\n')) {
+  // CRLF tolerance (#889): split on \r?\n — a stray \r otherwise defeats the
+  // `#.*$` comment strip ($ won't cross the \r) and leaks comments into values.
+  for (const raw of text.split(/\r?\n/)) {
     const line = raw.replace(/#.*$/, '').trimEnd();
     if (!line) continue;
     if (line.startsWith(' ')) continue; // ignore nested keys (rare; preserved on disk via raw text path)
@@ -68,14 +72,16 @@ function readConfigYaml(configPath) {
  * If the key doesn't exist, append it.
  */
 function setYamlKey(rawText, key, value) {
-  const re = new RegExp(`^${key}:\\s*.*$`, 'm');
+  // CRLF tolerance (#889): [^\S\n]/[^\r\n] keep the match on one line even
+  // when the file uses \r\n (plain \s would walk across the line break).
+  const re = new RegExp(`^${key}:[^\\S\\n]*[^\\r\\n]*$`, 'm');
   const replacement = typeof value === 'string'
     ? `${key}: "${value.replace(/"/g, '\\"')}"`
     : `${key}: ${value}`;
   if (re.test(rawText)) {
     return rawText.replace(re, replacement);
   }
-  return rawText.replace(/\n*$/, '') + `\n${replacement}\n`;
+  return rawText.replace(/(?:\r?\n)*$/, '') + `\n${replacement}\n`;
 }
 
 function parseArgs(args) {
@@ -98,8 +104,7 @@ function detectInstalledEditors(cwd) {
   // .rcode/config.yaml as the canonical signal — if config exists, the
   // project ran rcode install at least once for claude. The presence of
   // any commands/agents/skills then becomes secondary evidence.
-  const os = require('os');
-  const homeSkills = path.join(os.homedir(), '.claude/skills');
+  const homeSkills = path.join(homedir(), '.claude/skills');
   const projectClaude = (
     (fs.existsSync(path.join(cwd, '.claude/skills')) &&
       fs.readdirSync(path.join(cwd, '.claude/skills')).some(n => n.startsWith('rcode-'))) ||

package/cli/workflow.js

@@ -73,9 +73,11 @@ function listWorkflows(workflowsDir) {
 }
 
 function showWorkflow(workflowsDir, name) {
+  // Normalise: strip rcode- prefix so both `plan` and `rcode-plan` resolve (#883)
+  const bare = name.startsWith('rcode-') ? name.slice('rcode-'.length) : name;
   const candidates = [
+    path.join(workflowsDir, `${bare}.md`),
     path.join(workflowsDir, `${name}.md`),
-    path.join(workflowsDir, `rcode-${name}.md`),
   ];
 
   for (const p of candidates) {