riskrails 3.1.0 → 3.2.2

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "A weight-based engineering pipeline for Claude Code and Codex: each change is weighed on six axes, runs light, guarded or full, edits only the files its plan names, and ends at human approval — enforced by hooks, reviewed adversarially, routed to the cheap model tier by default.",
-    "version": "3.1.0"
+    "version": "3.2.2"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
         "source": "url",
         "url": "https://github.com/vanssata/claude-agentic-sdlc-module.git"
       },
-      "version": "3.1.0",
+      "version": "3.2.2",
       "strict": true
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "riskrails",
-  "version": "3.1.0",
+  "version": "3.2.2",
   "description": "A weight-based engineering pipeline for Claude Code and Codex: each change is weighed on six axes, runs light, guarded or full, edits only the files its plan names, and ends at human approval — enforced by hooks, reviewed adversarially, routed to the cheap model tier by default.",
   "author": {
     "name": "Ivan Kakurov"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "riskrails",
-  "version": "3.1.0",
+  "version": "3.2.2",
   "description": "A weight-based engineering pipeline for Claude Code and Codex: each change is weighed on six axes, runs light, guarded or full, edits only the files its plan names, and ends at human approval — enforced by hooks, reviewed adversarially, routed to the cheap model tier by default.",
   "author": {
     "name": "Ivan Kakurov"

package/README.md

@@ -1,6 +1,6 @@
 # RiskRails
 
-[![Version](https://img.shields.io/badge/version-3.1.0-d2f878?labelColor=101210)](https://github.com/vanssata/claude-agentic-sdlc-module/releases/tag/v3.1.0)
+[![Version](https://img.shields.io/badge/version-3.2.2-d2f878?labelColor=101210)](https://github.com/vanssata/claude-agentic-sdlc-module/releases/tag/v3.2.2)
 [![Runtimes](https://img.shields.io/badge/runtimes-Claude%20Code%20%7C%20Codex-d2f878?labelColor=101210)](docs/routing.md)
 [![Known risks](https://img.shields.io/badge/known%20risks-documented-d2f878?labelColor=101210)](docs/known-risks.md)
 [![License: MIT](https://img.shields.io/badge/license-MIT-d2f878?labelColor=101210)](LICENSE)
@@ -18,7 +18,7 @@ approval. Risky actions are stopped by a hook, not by a polite request in a
 prompt.
 
 ```bash
-npx riskrails@3.1.0   # detects Claude Code, Codex or both (Node 18+, Python 3.11+)
+npx riskrails@3.2.2   # detects Claude Code, Codex or both (Node 18+, Python 3.11+)
 ```
 
 Then, in any project: `/rr-setup` once, and `/rr-build <what you want>` for
@@ -50,12 +50,12 @@ Tuned for **one developer who knows the codebase**, on a Claude Pro, Max or
 Team plan, or a ChatGPT Plus or Pro plan, following the
 [AI-native SDLC playbook](https://claude.com/blog/the-ai-native-sdlc-playbook).
 
-**Version 3.1.0.** The guards have limits: read [Known risks](docs/known-risks.md)
+**Version 3.2.2.** The guards have limits: read [Known risks](docs/known-risks.md)
 before relying on them. What is decided but not built is in [ROADMAP.md](ROADMAP.md).
 
 ## Upgrade to 3.1
 
-From 3.0.x: update the home (`npx riskrails@3.1.0`, restart the runtime), then
+From 3.0.x: update the home (`npx riskrails@3.2.2`, restart the runtime), then
 in each project `/rr-setup --update` (dry run first, then `--apply`). Schema 10
 becomes **11**: migration `0011` proposes deleting `.ai/policies/risk-tiers.json`
 and `risk-tiers.md`, which `weight.json` and `weight.md` replaced; confirm with
@@ -82,7 +82,7 @@ version. Step by step, in this order:
 3. **Update the home** on every machine, for every runtime:
 
    ```bash
-   npx riskrails@3.1.0              # or: npx -y riskrails@latest --yes
+   npx riskrails@3.2.2              # or: npx -y riskrails@latest --yes
    ```
 
    It moves `<home>/claude-agentic/` to `<home>/riskrails/` and leaves a
@@ -120,12 +120,13 @@ home-side details in [docs/installation.md](docs/installation.md).
 ## Install
 
 ```bash
-npx riskrails@3.1.0                       # detects Claude Code, Codex, or both; proposes the detected plan
-npx riskrails@3.1.0 --target codex        # auto | claude | codex | both
-npx riskrails@3.1.0 --plan max --fable no # pro | team-pro | team-max | max | max20 | balanced-max
-npx riskrails@3.1.0 --codex-plan plus     # plus | pro | balanced-max
-npx riskrails@3.1.0 --context economy     # the plan's compaction window; the context guard also blocks
-npx riskrails@3.1.0 --dry-run             # print what would be written, write nothing
+npx riskrails@3.2.2                       # detects Claude Code, Codex, or both; proposes the detected plan
+npx riskrails@3.2.2 --target codex        # auto | claude | codex | both
+npx riskrails@3.2.2 --plan max --fable no # pro | team-pro | team-max | max | max20 | balanced-max
+npx riskrails@3.2.2 --codex-plan plus     # plus | pro | balanced-max
+npx riskrails@3.2.2 --context economy     # the plan's compaction window; the context guard also blocks
+npx riskrails@3.2.2 --statusline own      # keep your own statusline command (from 3.2.1; default: the plugin's two-line statusline)
+npx riskrails@3.2.2 --dry-run             # print what would be written, write nothing
 npx -y riskrails@latest --yes             # update in place, keeping the recorded plan
 ```
 

package/bin/riskrails.js

@@ -3,7 +3,7 @@
 //   npx riskrails [--target auto|claude|codex|both] [--plan pro|team-pro|team-max|max|max20|balanced-max]
 //                 [--fable auto|yes|no] [--codex-plan plus|pro|balanced-max] [--dry-run]
 //                 [--context default|economy] [--statusline-context yes|no]
-//                 [--home DIR] [--codex-home DIR] [--yes] [--version]
+//                 [--statusline riskrails|own] [--home DIR] [--codex-home DIR] [--yes] [--version]
 // --target defaults to auto: each runtime is installed only if its executable is on PATH.
 // --plan   Claude only: pro, team-pro (Team Standard seat), team-max (Team Premium seat), max
 //          or max20 (Max 20x: max's settings, larger budgets). Defaults to auto-detect from
@@ -22,9 +22,17 @@
 //          Max, 300 000 on Pro) and the guard also holds a prompt back past 120% of it.
 //          Without economy, an autoCompactWindow equal to the plan's is removed; any other
 //          value is the user's and stays. Recorded in riskrails/profile.json as `context`.
-// --statusline-context  yes (default) shows the model and the context use in the
-//          statusline: a line before the user's own in Claude Code, `model-with-reasoning`
-//          and `context-used` in Codex's [tui] status_line. no adds nothing and removes nothing.
+// --statusline-context  yes (default) shows the model, effort and context use in the
+//          statusline: the first line in Claude Code (`--context`), `model-with-reasoning`
+//          and `context-used` in Codex's [tui] status_line. no leaves that line out (Claude:
+//          removes `--context`; Codex: adds nothing and removes nothing); not recorded.
+// --statusline  Claude only. riskrails (default) writes the plugin's statusline on every
+//          install and update: the model, effort and context line and the prompt line
+//          (user@host:cwd | branch | 5h/7d limits | cost), over a statusline command of your
+//          own (the old command is printed and kept in riskrails/statusline.json). own keeps
+//          your command behind the quota check, as before 3.2, and brings a replaced one
+//          back. The choice is recorded in riskrails/statusline.json; a later install
+//          without --statusline keeps it.
 // --home / --codex-home  the runtime homes (default ~/.claude and ~/.codex; the environment
 //          variables CLAUDE_DIR and CODEX_DIR mean the same). Naming exactly one of them under
 //          --target auto installs that runtime alone.
@@ -56,7 +64,7 @@ let CODEX_DIR = env.CODEX_DIR || path.join(os.homedir(), '.codex');
 const HOME = env.HOME || os.homedir();
 let PLAN = '', FABLE = 'auto', DRY = false, TARGET = 'auto', PLAN_GIVEN = false;
 let CODEX_PLAN = '', CODEX_PLAN_GIVEN = false, YES = false;
-let CONTEXT = 'default', STATUSLINE_CONTEXT = 'yes';
+let CONTEXT = 'default', STATUSLINE_CONTEXT = 'yes', STATUSLINE = 'riskrails', STATUSLINE_GIVEN = false;
 
 function version() {
   try { return JSON.parse(fs.readFileSync(path.join(SRC, 'package.json'), 'utf8')).version || 'unknown'; }
@@ -88,6 +96,7 @@ function usage() {
       case '--codex-plan': CODEX_PLAN = take(); CODEX_PLAN_GIVEN = true; break;
       case '--context': CONTEXT = take(); break;
       case '--statusline-context': STATUSLINE_CONTEXT = take(); break;
+      case '--statusline': STATUSLINE = take(); STATUSLINE_GIVEN = true; break;
       case '--home': CLAUDE_DIR = path.resolve(take()); CLAUDE_DIR_GIVEN = true; break;
       case '--codex-home': CODEX_DIR = path.resolve(take()); CODEX_DIR_GIVEN = true; break;
       case '--dry-run': DRY = true; break;
@@ -105,6 +114,7 @@ if (!['default', 'economy'].includes(CONTEXT)) die(`--context must be default|ec
 if (!['yes', 'no'].includes(STATUSLINE_CONTEXT)) {
   die(`--statusline-context must be yes|no (got '${STATUSLINE_CONTEXT}')`, 2);
 }
+if (!['riskrails', 'own'].includes(STATUSLINE)) die(`--statusline must be riskrails|own (got '${STATUSLINE}')`, 2);
 const major = Number(process.versions.node.split('.')[0]);
 if (major < 18) die('riskrails needs Node 18 or newer (this is ' + process.versions.node + ')', 1);
 
@@ -117,6 +127,25 @@ function onPath(cmd) {
   return false;
 }
 if (!onPath('python3')) die('python3 is required', 1);
+{
+  const pv = spawnSync('python3', ['-c', "import sys; print('%d.%d' % sys.version_info[:2])"],
+    { env, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'pipe'] });
+  const lines = (pv.stdout || '').split('\n').map((l) => l.trim()).filter(Boolean);
+  const found = (lines.length ? lines[lines.length - 1] : '').match(/^(\d+)\.(\d+)$/) || [];
+  if (!found.length || Number(found[1]) < 3 || (Number(found[1]) === 3 && Number(found[2]) < 11)) {
+    let why = '';
+    if (!found.length) {
+      const errLine = ((pv.stderr || '').split('\n').map((l) => l.trim()).find(Boolean)) || '';
+      const parts = [];
+      if (pv.error) parts.push(`error ${pv.error.code || pv.error.message}`);
+      if (pv.status !== null && pv.status !== undefined && pv.status !== 0) parts.push(`exit status ${pv.status}`);
+      if (pv.signal) parts.push(`signal ${pv.signal}`);
+      if (errLine) parts.push(`stderr: ${errLine}`);
+      why = parts.length ? ` - ${parts.join(', ')}` : ' - no version on stdout';
+    }
+    die(`python3 3.11 or newer is required (found ${found.length ? found[0] : 'unknown'}${why})`, 1);
+  }
+}
 
 // ------------------------------------------------------------------ helpers
 const exists = (p) => fs.existsSync(p);                       // follows symlinks, as [ -e ]
@@ -553,11 +582,34 @@ function shSplit(s) {                                            // shlex.split,
   return words;
 }
 
-// The wrapper is `<PREFIX> [--context] [--then '<the user's command>']`; --context
-// (--statusline-context yes) adds a line with the model and the context use.
+// The wrapper is `<PREFIX> [--context] [--line] [--then '<the user's command>']`; --context
+// (--statusline-context yes) adds a line with the model, effort and context use, --line
+// (--statusline riskrails, the default) the plugin's prompt line. With riskrails the
+// command is exactly `<PREFIX> [--context] --line`: a command of the user's is replaced
+// (printed, and kept in <home>/riskrails/statusline.json: the dated settings.json backup is
+// replaced by a second run the same day); with own it stays behind --then, and own brings
+// a replaced command back. The mode is recorded there too: a run without --statusline
+// keeps the recorded one, so the update notice's `--yes` does not undo own.
 function statuslineGate(file, gate, mode) {
   const PREFIX = '"$HOME/.claude/hooks/runtime-gate.py" statusline';
-  const WANT = STATUSLINE_CONTEXT === 'yes' ? `${PREFIX} --context` : PREFIX;
+  const RECORD = path.join(path.dirname(file), 'riskrails', 'statusline.json');
+  let record = {};
+  try { const r = JSON.parse(read(RECORD)); if (isObj(r)) record = r; } catch (e) { /* none yet */ }
+  const MODE = STATUSLINE_GIVEN ? STATUSLINE : (['riskrails', 'own'].includes(record.mode) ? record.mode : 'riskrails');
+  const OWN = MODE === 'own';
+  const kept = typeof record.replaced === 'string' && record.replaced.trim() ? record.replaced : '';
+  let saved = '';                                    // a command of the user's this run replaces
+  const persist = () => {
+    if (mode === 'dry') return;
+    const next = Object.assign({}, record, { mode: MODE },
+      saved ? { replaced: saved, replaced_at: BACKUP_DATE } : {});
+    if (JSON.stringify(next) === JSON.stringify(record)) return;
+    mkdirp(path.dirname(RECORD));
+    fs.writeFileSync(RECORD + '.tmp', asciiJSON(next) + '\n');
+    fs.renameSync(RECORD + '.tmp', RECORD);
+  };
+  const CTX = STATUSLINE_CONTEXT === 'yes' ? `${PREFIX} --context` : PREFIX;
+  const WANT = OWN ? CTX : `${CTX} --line`;
   const OLD_PREFIX = '"$HOME/.claude/hooks/fable-gate.py" statusline';
   let settings = {};
   if (exists(file)) {
@@ -570,26 +622,64 @@ function statuslineGate(file, gate, mode) {
     line.command = PREFIX + cmd.slice(OLD_PREFIX.length);
     ours = true; gate = 'moved';
   }
-  // What follows the prefix and an optional --context: the user's --then, byte for byte.
-  const tail = () => line.command.slice(PREFIX.length).trim().replace(/^--context(\s+|$)/, '');
+  // What follows the prefix and its --context/--line flags: the user's --then, byte for byte.
+  const tail = () => line.command.slice(PREFIX.length).trim().replace(/^((--context|--line)(\s+|$))+/, '');
+  // The user's own command inside a `--then '<command>'` tail, for the replaced message.
+  const wrapped = (rest) => {
+    // an unparsable tail is not recorded: an earlier good `replaced` stays, the dated backup holds the line
+    try { const parts = shSplit(rest); return parts.length > 1 ? parts[1] : ''; } catch (e) { return ''; }
+  };
   const shown = STATUSLINE_CONTEXT === 'yes' ? ' with the model and the context use' : '';
+  const plugin = STATUSLINE_CONTEXT === 'yes'
+    ? 'the model, effort and context line and the prompt line' : 'the prompt line';
+  const backup = '--statusline own brings it back';
   let action = null;
   if (gate === 'moved') {
     const rest = tail();
-    line.command = rest ? `${WANT} ${rest}` : WANT;
-    action = 'moved the fable-gate statusline wrapper to runtime-gate (your command is unchanged)';
+    if (OWN) {
+      line.command = rest ? `${WANT} ${rest}` : WANT;
+      action = 'moved the fable-gate statusline wrapper to runtime-gate (your command is unchanged)';
+    } else {
+      line.command = WANT;
+      saved = rest.startsWith('--then') ? wrapped(rest) : '';
+      action = `moved the fable-gate statusline wrapper to runtime-gate, with the plugin's statusline (${plugin})` +
+        (saved ? `; replaced your statusline command: ${saved} (${backup})` : '');
+    }
   } else if (gate === 'on') {
     if (ours) {
       const rest = tail();
-      const want = rest ? `${WANT} ${rest}` : WANT;
-      if (want === cmd) return ['statusline: already records the quota'];
+      const hadLine = /(^|\s)--line(\s|$)/.test(cmd.slice(PREFIX.length));
+      // one-shot: only the run that switches to own restores; once own is recorded, a bare line stays bare
+      const restore = OWN && !rest && kept && record.mode !== 'own';
+      saved = !OWN && rest.startsWith('--then') ? wrapped(rest) : '';
+      const want = restore ? `${WANT} --then ${shQuote(kept)}` : OWN && rest ? `${WANT} ${rest}` : WANT;
+      if (want === cmd) {
+        persist();
+        return [OWN ? 'statusline: already records the quota' : "statusline: already the plugin's statusline"];
+      }
       line.command = want;
-      action = STATUSLINE_CONTEXT === 'yes'
-        ? 'added the model and the context use to the statusline wrapper (your command is unchanged)'
-        : 'removed the model and context line from the statusline wrapper (your command is unchanged)';
+      if (saved) {
+        action = `replaced your statusline command with the plugin's statusline (${plugin}): ${saved} (${backup})`;
+      } else if (restore) {
+        action = `restored your statusline command behind the quota check${shown}: ${kept}`;
+      } else if (!OWN) {
+        action = `set the plugin's statusline (${plugin})`;
+      } else if (hadLine) {
+        action = rest ? `removed the plugin's prompt line; your command runs behind the quota check${shown}`
+          : `removed the plugin's prompt line; no command of yours to restore, so the quota check runs${shown} alone`;
+      } else {
+        action = STATUSLINE_CONTEXT === 'yes'
+          ? 'added the model and the context use to the statusline wrapper (your command is unchanged)'
+          : 'removed the model and context line from the statusline wrapper (your command is unchanged)';
+      }
     } else if (line === undefined || line === null) {
       settings.statusLine = { type: 'command', command: WANT };
-      action = `added a statusline that records the quota (and the Fable weekly limit)${shown}`;
+      action = OWN ? `added a statusline that records the quota (and the Fable weekly limit)${shown}`
+        : `added the plugin's statusline (${plugin}), which also records the quota`;
+    } else if (!OWN && isObj(line) && line.type === 'command' && typeof cmd === 'string' && cmd.trim()) {
+      line.command = WANT;
+      saved = cmd;
+      action = `replaced your statusline command with the plugin's statusline (${plugin}): ${cmd} (${backup})`;
     } else if (isObj(line) && line.type === 'command' && typeof cmd === 'string' && cmd.trim()) {
       line.command = `${WANT} --then ${shQuote(cmd)}`;
       action = `wrapped your statusline command with the quota check${shown} (its output is unchanged)`;
@@ -609,6 +699,7 @@ function statuslineGate(file, gate, mode) {
     }
   }
   if (mode === 'dry') return ['statusline: would have ' + action];
+  persist();                                         // the replaced command first: never lost
   fs.writeFileSync(file + '.tmp', asciiJSON(settings) + '\n');
   fs.renameSync(file + '.tmp', file);
   return ['statusline: ' + action];

package/hooks/ai-path-guard-defaults.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Shipped defaults for ai-path-guard. Do not edit this file; a project overrides it in .ai/policies/path-guard.json (patterns are unioned, allow wins over every other list). Patterns are POSIX extended regular expressions matched against the absolute path. deny_patterns are secrets: refused for read and write. protected_config_patterns are always on and refuse writes: the task's state and journal, task.md, the compact record (.ai/memory/, .ai/local/memory/), and the guards' own configuration, engine and state.py under .claude/ or .codex/, in a project or in the user's home, and the riskrails plugin's cache folder, which carries the same code on the plugin route. A project's dependency_instruction_patterns, from before 3.4, are read as deny_patterns. task_protected_patterns are on only while a task is in flight (.ai/state/state.json, or else current.json, exists and has not reached \"done\"): the runtime's settings, Claude's record of installed plugins and the pipeline's policies, so a run cannot change the rules it is being judged by. Reading anything but a secret is allowed.",
+  "_comment": "Shipped defaults for ai-path-guard. Do not edit this file; a project overrides it in .ai/policies/path-guard.json (patterns are unioned, allow wins over every other list). Patterns are POSIX extended regular expressions matched against the absolute path. deny_patterns are secrets: refused for read and write. protected_config_patterns are always on and refuse writes: the task's state and journal, task.md, the compact record (.ai/memory/, .ai/local/memory/), and the guards' own configuration, engine and state.py under .claude/ or .codex/, in a project or in the user's home, and the riskrails plugin's cache folder, which carries the same code on the plugin route. Also the installer's statusline record (.claude/riskrails/statusline.json), which keeps the statusline command it replaced. A project's dependency_instruction_patterns, from before 3.4, are read as deny_patterns. task_protected_patterns are on only while a task is in flight (.ai/state/state.json, or else current.json, exists and has not reached \"done\"): the runtime's settings, Claude's record of installed plugins and the pipeline's policies, so a run cannot change the rules it is being judged by. Reading anything but a secret is allowed.",
   "deny_patterns": [
     "(^|/)\\.env$",
     "(^|/)\\.env\\.(local|prod|production|staging|live)$",
@@ -38,7 +38,8 @@
     "(^|/)\\.(claude|codex)/hooks/runtime-gate\\.py$",
     "(^|/)\\.(claude|codex)/hooks/(guard|lib)/",
     "(^|/)\\.(claude|codex)/skills/ai-task/",
-    "(^|/)\\.(claude|codex)/plugins/cache/[^/]+/riskrails(/|$)"
+    "(^|/)\\.(claude|codex)/plugins/cache/[^/]+/riskrails(/|$)",
+    "(^|/)\\.claude/(riskrails|claude-agentic)/statusline\\.json$"
   ],
   "task_protected_patterns": [
     "(^|/)\\.claude/settings[^/]*\\.json$",

package/hooks/context-guard.py

@@ -126,7 +126,7 @@ def user_settings():
         with open(os.path.join(config_dir(), "settings.json"), encoding="utf-8") as fh:
             settings = json.load(fh)
         return settings if isinstance(settings, dict) else {}
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return {}
 
 
@@ -157,7 +157,7 @@ def profile_context():
         with open(os.path.join(home, "riskrails", "profile.json"), encoding="utf-8") as fh:
             context = json.load(fh).get("context")
         return context if isinstance(context, dict) else {}
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, RecursionError, AttributeError):
         return {}
 
 
@@ -253,7 +253,7 @@ def current_context(path):
             continue
         try:
             entry = json.loads(raw)
-        except ValueError:
+        except (ValueError, RecursionError):
             continue
         if entry.get("type") == "system" and entry.get("subtype") == "compact_boundary":
             return None             # the numbers before it describe the old context
@@ -301,7 +301,7 @@ def scan_session(path):
                 continue
             try:
                 entry = json.loads(raw)
-            except ValueError:
+            except (ValueError, RecursionError):
                 continue
             if entry.get("isSidechain"):
                 continue
@@ -395,7 +395,7 @@ def task_in_flight(root):
     try:
         with open(state, encoding="utf-8") as fh:
             return (json.load(fh) or {}).get("current_stage") != "done"
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return False
 
 
@@ -412,7 +412,7 @@ def write_session(root, updates):
         with open(path, encoding="utf-8") as fh:
             data = json.load(fh)
         data = data if isinstance(data, dict) else {}
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         data = {}
     data.update(updates)
     try:
@@ -431,7 +431,7 @@ def prompt_count(root):
     try:
         with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
             count = json.load(fh).get("prompt_count")
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, RecursionError, AttributeError):
         return 0
     return count if isinstance(count, int) and not isinstance(count, bool) else 0
 
@@ -471,7 +471,7 @@ def recorded_mtime(root):
     try:
         with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
             return json.load(fh).get("account_mtime")
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, RecursionError, AttributeError):
         return None
 
 
@@ -488,7 +488,7 @@ def detect_drift(root, cwd, session, open_it=True, mtime=None):
         raw = ""
     try:
         found = json.loads(raw)
-    except ValueError:
+    except (ValueError, RecursionError):
         return None
     if root and mtime is not None and isinstance(found, dict):
         write_session(root, {"account_mtime": mtime})
@@ -514,9 +514,12 @@ def drift_notice(root, found, session):
                     f"DIALOG_PENDING {decision} — call {tool} with exactly this JSON, then run the picked "
                     f"command verbatim or 'state.py decision settle --id {decision}': {payload}")
     command = found.get("command") or ""
+    ack = found.get("ack")
+    keep = f" — or, to keep {installed} and not be told again for this account: {ack}" if ack else ""
     return (f"RiskRails: this account is {account}; RiskRails is installed for {installed}.",
             f"RiskRails: the account's plan is {account} but RiskRails is installed for {installed}, so its "
-            f"budgets do not match. Tell the user; in their own terminal, outside the agent, they run: {command}")
+            f"budgets do not match. Tell the user; in their own terminal, outside the agent, they run: {command}"
+            f"{keep}")
 
 
 def handoff_block(root, reason):
@@ -656,7 +659,7 @@ def prompt_warning(payload, session, transcript):
     try:
         with open(marker, encoding="utf-8") as fh:
             state = json.load(fh)
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         state = {}
 
     def save():

package/hooks/dialog-gate.py

@@ -37,7 +37,7 @@ def prompt_count(root):
     try:
         with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
             count = json.load(fh).get("prompt_count")
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, AttributeError, RecursionError):
         return None
     return count if isinstance(count, int) and not isinstance(count, bool) else None