@seanmozeik/tripwire 0.6.5 → 0.6.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seanmozeik/tripwire",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Opinionated hooks dispatcher for AI coding agents with configurable safety rules",
   "license": "MIT",
   "bin": {
@@ -27,21 +27,27 @@
     "format": "oxfmt --write .",
     "lint": "oxlint --tsconfig tsconfig.oxlint.json .",
     "lint:fix": "oxlint --format agent --tsconfig tsconfig.oxlint.json --fix .",
+    "prepare": "bunx effect-tsgo patch",
     "test": "bun test",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@effect/platform-bun": "^4.0.0-beta.78",
-    "effect": "^4.0.0-beta.78",
     "shell-quote": "^1.8.4"
   },
   "devDependencies": {
+    "@effect/platform-bun": "^4.0.0-beta.102",
+    "@effect/tsgo": "^0.24.3",
     "@types/bun": "^1.3.14",
     "@types/shell-quote": "^1.7.5",
+    "effect": "^4.0.0-beta.102",
     "oxfmt": "^0.53.0",
-    "oxlint": "^1.68.0",
+    "oxlint": "1.68.0",
     "oxlint-tsgolint": "^0.23.0",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "@effect/platform-bun": "^4.0.0-beta.102",
+    "effect": "^4.0.0-beta.102"
   },
   "engines": {
     "bun": ">=1.0"

package/src/rules/bash-tool-policy.ts

@@ -88,9 +88,21 @@ const POLICIES: readonly Policy[] = [
     rule: 'consider-rg',
     action: 'warn',
     message:
-      'Consider `rg` (ripgrep) instead of `grep`. Faster; recurses by default; respects .gitignore by default (use `-u`/`-uu` to include ignored/hidden files); searches the CWD when no path is given. NOT a clean flag-for-flag swap; some flags differ or are unneeded. Carry over fine: `-i`, `-n`, `-v`, `-l`, `-c`. WATCH OUT: `-r` is NOT recursive in rg — it means `--replace` (rg already recurses), so `rg -rn "PATTERN" dir/` silently parses as `--replace=n` and rewrites every match to the literal "n" while exiting 0. Drop the `-r`: `grep -rn PATTERN .` → `rg -n PATTERN`. And `grep --include`/`--exclude` become `rg -g GLOB`/`-g !GLOB`.',
+      'Consider `rg` (ripgrep) instead of `grep`. Faster; recurses by default; respects .gitignore by default (use `-u`/`-uu` to include ignored/hidden files); searches the CWD when no path is given. NOT a clean flag-for-flag swap; some flags differ or are unneeded. Carry over fine: `-i`, `-n`, `-v`, `-l`, `-c`. WATCH OUT: `-r` is NOT recursive in rg, it means `--replace` (rg already recurses), so `rg -rn "PATTERN" dir/` silently parses as `--replace=n` and rewrites every match to the literal "n" while exiting 0. Drop the `-r`: `grep -rn PATTERN .` → `rg -n PATTERN`. And `grep --include`/`--exclude` become `rg -g GLOB`/`-g !GLOB`.',
     fires: (seg) => seg.head === 'grep' || seg.head === 'egrep' || seg.head === 'fgrep',
   },
+  {
+    rule: 'rg-r-is-replace',
+    action: 'warn',
+    message:
+      'STOP — your rg output is probably mangled. `-r` in rg means `--replace`, NOT recursive, so any `-r{X}` flag combo silently rewrites every match to the literal string "{X}" and exits 0 with no error. ripgrep is always recursive by default — there is no `-r` for recursion. If you want to search: drop the `-r` entirely (`rg -rn PATTERN` → `rg -n PATTERN`). If you genuinely want text substitution: use `--replace` explicitly.',
+    fires: (seg) => {
+      if (seg.head !== 'rg') {
+        return false;
+      }
+      return seg.flags.some((f) => f.startsWith('-') && !f.startsWith('--') && f.includes('r'));
+    },
+  },
   {
     rule: 'consider-btop',
     action: 'warn',