geneseed 2.0.0

package/js/hosts.mjs

@@ -0,0 +1,253 @@
+/**
+ * The four host config dirs, and the two path primitives they are built on.
+ *
+ * EXTRACTED IN P5c, and the reason is arithmetic rather than taste. `bin/geneseed.mjs`
+ * owned these; `bin/geneseed-cli.mjs` needs the same four to find a global install, and a
+ * resolver that decides WHERE a driver writes is the last thing that should exist twice.
+ * `js/hooks.mjs` carries a third copy of `opencodeConfigDir` on purpose — the hook path is
+ * deliberately dependency-free and says so — but the CLI has no such reason, so this is one
+ * owner for both drivers rather than a second exception.
+ *
+ * The move is a pure one, which is why it could be made at all: `tests/golden.py` runs
+ * `bin/geneseed.mjs` over 259 cells and compares the tree byte-for-byte, and roughly half
+ * of those resolve a global config dir. A move that changed one of these by a character
+ * fails ~126 cells, not zero.
+ */
+import { realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { pyPathStr, pyPrintErr, withDiscardableStderr } from './lib/fs.mjs';
+
+const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
+
+/** `_build_global.GLOBAL_MANIFEST` — the file whose presence means "a global install". */
+export const GLOBAL_MANIFEST = '.geneseed-manifest.json';
+
+/**
+ * `_build_core.VERSION_MARKER`. Third caller, so it moves here — `js/emit.mjs` and
+ * `js/diff.mjs` each had a private const of their own and `js/uninstall.mjs` would have made
+ * a third copy of a value whose whole job is being the same string everywhere. Same
+ * arithmetic that put `GLOBAL_MANIFEST` above it.
+ */
+export const VERSION_MARKER = '.geneseed-version';
+
+/**
+ * `Path.expanduser()` — a LEADING `~` only, and `~` alone counts.
+ *
+ * The docblock here used to claim "Python does not expand `~user` on Windows the way a
+ * shell would". That claim was FALSE, and `921384f`'s widened probe corpus caught it:
+ * `ntpath.expanduser('~someuser/x')` swaps the last component of `%USERPROFILE%` and
+ * returns `C:\Users\someuser\x` — it happily expands a name that may not even be a real
+ * account.
+ *
+ * AND THE POSIX HALF OF THAT SENTENCE WAS WRONG IN ITS TURN, corrected here while the
+ * reference is still on the machine to ask. `posixpath.expanduser` does the analogous thing
+ * through the password database and returns the path unchanged when the account is unknown
+ * — but the reference does not call it. It calls `Path.expanduser`, which re-checks the
+ * result and RAISES `RuntimeError: Could not determine home directory.` So the divergence
+ * below is WINDOWS-ONLY: on POSIX the reference and this port already agree in kind — both
+ * refuse — and differ only in which exception says so.
+ *
+ * This port deliberately does NEITHER. Reproducing `ntpath`'s swap faithfully needs its own
+ * corpus, and the Python reference is being deleted, so byte-parity on this one input stops
+ * mattering the moment it is. What matters instead is that a `~user` form never resolves
+ * SILENTLY to the wrong place: the old code below returned it untouched, so
+ * `--target ~someone/x` created a literal `~someone` directory in whatever cwd the user ran
+ * from. It now REFUSES the form outright. This is the single primitive every config-dir env
+ * var and every `--target`/`--dir`/`--bundle`/`--out` argument passes through on the way to
+ * becoming a filesystem path, so refusing here — rather than at each of those call sites —
+ * is one guard instead of several, and none of the paths that already exist there. `~` alone
+ * and `~/…`/`~\…` are unaffected; only a name after the tilde is rejected.
+ */
+export function expanduser(p) {
+  if (p === '~') return os.homedir();
+  if (p.startsWith('~/') || p.startsWith('~\\')) return path.join(os.homedir(), p.slice(2));
+  if (p.startsWith('~')) {
+    const msg = `refusing '${p}': a '~user' path is not expanded by this port (Python's `
+      + "ntpath/posixpath would guess a home directory for 'user' — this port does not); "
+      + 'pass an absolute path, or "~" / "~/…" for your own home directory';
+    pyPrintErr(`${msg}\n`);
+    const e = new Error(msg);
+    e.exitCode = 1;
+    throw e;
+  }
+  return p;
+}
+
+/**
+ * `Path.resolve()` — absolute, symlinks followed, and the filesystem's OWN casing.
+ *
+ * `path.resolve` does none of the last two and `realpathSync` THROWS on a path that does not
+ * exist yet, which is the normal case here: the first `--emit opencode-global` on a machine
+ * resolves a config dir nobody has created. Python's `resolve(strict=False)` canonicalises
+ * the part that exists and appends the rest verbatim, so that is what this reproduces.
+ * It matters because the resolved directory is printed on stdout and compared byte-for-byte.
+ */
+export function pyResolve(p) {
+  let cur = path.resolve(expanduser(p));
+  const tail = [];
+  for (;;) {
+    try {
+      return tail.length ? path.join(realpathSync.native(cur), ...tail) : realpathSync.native(cur);
+    } catch {
+      const parent = path.dirname(cur);
+      if (parent === cur) return path.resolve(expanduser(p));  // nothing on this path exists
+      tail.unshift(path.basename(cur));
+      cur = parent;
+    }
+  }
+}
+
+/**
+ * `_build_core._opencode_config_dir` — and the four resolvers like it are the reason
+ * `bin/geneseed.mjs` exists rather than a child doing the work.
+ *
+ * P3c's rule was "the child must never resolve this": a render child that did would write
+ * 135 files into the developer's real `~/.config/opencode`. A driver is the PARENT, so the
+ * rule inverts — resolving it there is exactly the job. Precedence is the env var (which
+ * relocates the whole dir), then `$XDG_CONFIG_HOME/opencode`, then `~/.config/opencode`.
+ */
+export function opencodeConfigDir() {
+  const env = process.env.OPENCODE_CONFIG_DIR;
+  if (env) return pyResolve(env);
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg ? expanduser(xdg) : path.join(os.homedir(), '.config');
+  return pyResolve(path.join(base, 'opencode'));
+}
+
+/**
+ * `_build_core._copilot_config_dir` — `~/.copilot`, relocatable via `$COPILOT_CONFIG_DIR`.
+ *
+ * Geneseed's own knob, mirroring `$BOB_CONFIG_DIR`: Copilot documents no such variable, but
+ * tests, doctor and locked-down setups still need to re-point the target. Like every
+ * relocation variable it is CLEARED by `golden.cell_env`, so no cell can observe whether
+ * a driver honours it — see `test_the_relocation_var_moves_the_global_target`.
+ */
+export function copilotConfigDir() {
+  const env = process.env.COPILOT_CONFIG_DIR;
+  if (env) return pyResolve(env);
+  return pyResolve(path.join(os.homedir(), '.copilot'));
+}
+
+/**
+ * `_build_core._claude_config_dir` — `~/.claude`, and there is NO env branch BY DESIGN.
+ *
+ * Its three siblings all check a `*_CONFIG_DIR` variable first; this one does not, because
+ * Claude Code documents none and inventing one here would make the two CLIs disagree about
+ * where a global install lives. The absence is the specification, so it is asserted rather
+ * than merely not implemented — `test_every_relocation_var_moves_its_global_target` carries
+ * an INVERSE row for this host: setting `$CLAUDE_CONFIG_DIR` must NOT move the target.
+ * Without that row the table could only say "no cell covers Claude", which reads the same
+ * as an omission.
+ */
+export function claudeConfigDir() {
+  return pyResolve(path.join(os.homedir(), '.claude'));
+}
+
+/** `_build_core._bob_config_dir` — `~/.bob`, relocatable via `$BOB_CONFIG_DIR`. */
+export function bobConfigDir() {
+  const env = process.env.BOB_CONFIG_DIR;
+  if (env) return pyResolve(env);
+  return pyResolve(path.join(os.homedir(), '.bob'));
+}
+
+/**
+ * `_build_global.HOSTS`, reduced to the two columns a non-emitting caller needs, and IN ITS
+ * ORDER — opencode, claude, bob, copilot.
+ *
+ * An array rather than an object because the order is observable output, not an
+ * implementation detail: `harness exclude add` walks it and prints one message per host, so
+ * a reordering is a diff in stderr. (`emit_global` and `native_catalog` stay out;
+ * `bin/geneseed.mjs` receives those decisions from its own dispatch rather than reading a
+ * table.)
+ *
+ * `projectMarker` joined in P5f. `_install_targets` asks "does this cwd carry a project
+ * install of host H", and `_claude_cfg` asks "which subdir holds a project install's
+ * manifest" — both are the same `.opencode`/`.claude`/`.bob`/`.github` value the Python reads
+ * out of `build.HOSTS[host]["project_marker"]`, so it belongs beside the config dir rather
+ * than in a second table in `js/installs.mjs`.
+ *
+ * `agentFile` joined in P5h, and for one caller: `cmd_uninstall` names the managed block's
+ * carrier in its "removes:" preamble (`the CLAUDE.md managed block`, `the AGENTS.md managed
+ * block`). It is a column and not a literal in the message for the reason every other column
+ * here is one — Bob and Copilot both answer `AGENTS.md` while Claude answers `CLAUDE.md`, and
+ * a host added later must not need the message edited to stay true.
+ */
+export const HOSTS = [
+  { host: 'opencode', configDir: opencodeConfigDir, projectMarker: '.opencode', agentFile: 'AGENT.md' },
+  { host: 'claude', configDir: claudeConfigDir, projectMarker: '.claude', agentFile: 'CLAUDE.md' },
+  { host: 'bob', configDir: bobConfigDir, projectMarker: '.bob', agentFile: 'AGENTS.md' },
+  { host: 'copilot', configDir: copilotConfigDir, projectMarker: '.github', agentFile: 'AGENTS.md' },
+];
+
+/**
+ * `_build_global.host_catalogs_natively` — does `host` list every skill and agent to the
+ * model by itself?
+ *
+ * The third column of `HOSTS`, and the reason the docblock above no longer says
+ * `native_catalog` stays out: `doctor`'s `_rendered_problems` has to know, because a host
+ * that catalogues natively gets AGENT.md's tables collapsed to a pointer and comparing the
+ * portable shape against its bundle reports AGENT.md stale on every run forever. It is a
+ * column and not a set literal so that the capability is still declared in exactly one place
+ * — the Python's own reason for the helper.
+ *
+ * Unknown host -> false, which is the shape that KEEPS the tables. The value arrives from a
+ * user-editable `.geneseed-emit` marker, so an unrecognised one must degrade to the portable
+ * bundle rather than raise.
+ */
+const NATIVE_CATALOG = { opencode: true, claude: true, bob: false, copilot: false };
+
+export function hostCatalogsNatively(host) {
+  return Boolean(NATIVE_CATALOG[host]);
+}
+
+/** `_harness_learn.MEMORY_DIR_NAMES` — the neutral name and the imperial theme's. */
+const MEMORY_DIR_NAMES = ['memory', 'anamnesis'];
+
+/**
+ * `_harness_learn._resolve_memory_dir` — where `learn` dedups and indexes, and what
+ * `status` reports on its memory row.
+ *
+ * Precedence: `--memory` > `$GENESEED_MEMORY` > a `memory/` (or `anamnesis/`) beside cwd or
+ * under `./Harness` > `$GENESEED_HARNESS/memory` > the OpenCode GLOBAL config dir's store.
+ * The last two matter for the recommended opencode-global install, whose store lives in
+ * `~/.config/opencode` rather than beside any repo. null => stdout-only.
+ *
+ * HERE rather than in `js/hooks.mjs`, where it was written, because P5d gave it a second
+ * caller that cannot import that file: `bin/geneseed-cli.mjs` is under a transitive
+ * `child_process` ban and `learn` spawns the model CLI. This module is the one both can
+ * reach, and it already owns the `opencodeConfigDir` the last fallback needs — so the move
+ * DELETED a duplicate resolver rather than adding a shared one.
+ */
+export function resolveMemoryDir(explicit) {
+  if (explicit) {
+    const p = pyPathStr(explicit);
+    return isDir(p) ? p : null;
+  }
+  const env = process.env.GENESEED_MEMORY;
+  if (env && isDir(env)) return pyPathStr(env);
+  const cwd = process.cwd();
+  const bases = [cwd, path.join(cwd, 'Harness')];
+  const gh = process.env.GENESEED_HARNESS;
+  if (gh) {
+    // PER BASE, and the walk continues. `$GENESEED_HARNESS` is the FOURTH user-controlled
+    // tilde input and the one the `~user` refusal was never swept onto: `expanduser` throws
+    // on `~someone/x`, and this resolver is reached by `geneseed status` (js/status.mjs's
+    // `resolveMemoryDir(null)`) and by the `learn` hook, whose entry point
+    // (`bin/geneseed-hook.mjs`) has NO top-level try — so an unguarded throw here is a stack
+    // trace on a hook path and a non-zero exit, the exact failure the other three guards
+    // exist to prevent. Skipping the base degrades to "no memory store from $GENESEED_HARNESS",
+    // which is what an unset variable already does. `withDiscardableStderr` because the
+    // refusal prints at the RAISE SITE and both callers byte-compare stderr; the reference
+    // (`rituals/_harness_learn.py`, same guard) prints nothing here.
+    try { bases.push(withDiscardableStderr(() => expanduser(gh))); } catch { /* skip it */ }
+  }
+  try { bases.push(opencodeConfigDir()); } catch { /* best-effort, as the Python */ }
+  for (const base of bases) {
+    for (const name of MEMORY_DIR_NAMES) {
+      const cand = path.join(base, name);
+      if (isDir(cand)) return cand;
+    }
+  }
+  return null;
+}

package/js/installs.mjs

@@ -0,0 +1,378 @@
+/**
+ * How a DEPLOYED install is recognised — `_harness_setup`'s detection half and
+ * `_harness_mcp`'s registry-reading half, which are one subject in two Python files.
+ *
+ * EXTRACTED IN P5f, and by the same arithmetic that produced `js/hosts.mjs` and
+ * `js/checkout.mjs`: this is the third verb-set to need it. P5d wrote `themeOfDir` and
+ * `footprintOfDir` inside `js/status.mjs` because `status` was the only caller; `diff`
+ * renders its 'expected' copy in the theme and footprint the deployment actually uses, and
+ * `rebuild-all` re-emits every install in its own theme, emit, footprint, posture and mode.
+ * Three callers of one detector is where a private helper becomes a module.
+ *
+ * WHAT THE MOVE DID NOT DO, and it is the P5f brief's second blind spot answered by
+ * measurement. `installedDefaults` still omitted posture and mode after P5f, because
+ * `cmd_rebuild_all` never calls `_installed_defaults`: it calls `_posture_of_dir(root)` and
+ * `_mode_of_dir(root)` directly, per install root, which is a different question from "what
+ * did this machine install". **P5i is where the debt came due** — `collectSetupLines`
+ * pre-selects three pickers off it — and the missing keys are now returned.
+ * `status/posture-and-mode-in-the-carrier-change-nothing` stays exactly as valid as it was:
+ * it is the positive control that the PANEL prints neither, and the panel reads two keys of
+ * the five whatever the other three hold.
+ *
+ * WHAT A CELL CANNOT REACH HERE. `installTargets` walks `process.cwd()` and the four host
+ * config dirs, and both are fenceable — `golden.cell_env` redirects HOME/XDG and every cell
+ * chooses its own `cwd`. What it also walks is the persistent registry, which lives under
+ * the redirected `$XDG_CONFIG_HOME` and is therefore fenceable too. So unlike `status`, none
+ * of this module's inputs is the unfenceable `ROOT`; the `rebuild-all` cells seed real
+ * installs and get real answers.
+ *
+ * That sentence was FALSE until wave 2 of the P0/P1 review: `installedDefaults` walked
+ * `ROOT / "Harness"` and `ROOT.parent / "Harness"`, so on a checkout carrying a built
+ * bundle every cell that seeded no emit marker read this developer's own install — four
+ * web cells recorded it. Both candidates are gone (the argument is in the Python), and the
+ * claim is now true rather than aspirational.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+
+import { CONFIG, THEMES, discoverNames } from './checkout.mjs';
+import { GLOBAL_MANIFEST, HOSTS, pyResolve } from './hosts.mjs';
+import { registryRoots } from './registry.mjs';
+import { comparePaths, pyPrintErr, pyRepr, readText } from './lib/fs.mjs';
+
+const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
+const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
+
+/**
+ * `Path.read_text(encoding="utf-8")`, or null where Python raises OSError.
+ *
+ * `readText`, not a bare `readFileSync`: `read_text` opens in TEXT mode, so Python's
+ * universal-newline decoding folds `\r\n` and a lone `\r` to `\n` before the caller ever
+ * sees them, and `readFileSync` does not. Every caller here reads a single-line marker and
+ * trims it, which is why the divergence sat latent through five phases — P6b's
+ * `/api/profile` is the first consumer that hands the whole decoded text back out, and
+ * `profile/a-seeded-profile-carries-its-fingerprint` failed on the CRLF the seeder wrote
+ * AND on the sha256 of it. Fixed here rather than at that one call site: the multi-line
+ * readers (`installs.mjs`'s AGENT.md sigil scan and carrier read, `uninstall.mjs`'s two)
+ * all mirror a Python `read_text` too, so every one of them was wrong in the same way and
+ * a guard at the new caller would have left them wrong.
+ */
+export function readMaybe(p) {
+  try { return readText(p); } catch { return null; }
+}
+
+/** `json.loads(...)` of a file, or null — Python catches JSONDecodeError and OSError alike. */
+export function readJsonMaybe(p) {
+  const txt = readMaybe(p);
+  if (txt === null) return null;
+  try { return JSON.parse(txt); } catch { return null; }
+}
+
+// ---- the configured defaults (`_harness_setup._default_*`) --------------------------------
+
+/**
+ * `_harness_setup._default_theme` / `_default_posture` / `_default_mode`.
+ *
+ * One reader for three keys where the Python has three near-identical functions. The fallback
+ * differs per key and is the argument, so nothing is shared that is not actually the same:
+ * each is `harness.config.json`'s value or a literal, with an unreadable or non-JSON file
+ * falling through to the literal. NOT `configDefaults()` from the driver, which warns on a
+ * corrupt file — these three are silent, as their Python originals are.
+ */
+function configuredDefault(key, fallback) {
+  if (existsSync(CONFIG)) {
+    const doc = readJsonMaybe(CONFIG);
+    if (doc && typeof doc === 'object') return doc[key] ?? fallback;
+  }
+  return fallback;
+}
+
+export const defaultTheme = () => configuredDefault('theme', 'neutral');
+export const defaultPosture = () => configuredDefault('posture', 'peer');
+export const defaultMode = () => configuredDefault('mode', 'direct');
+
+// ---- theme, footprint, posture, mode, read back off a deployed tree -----------------------
+
+/**
+ * `_build_render.theme_files` — shipped themes, `_`-prefixed scaffolds excluded.
+ *
+ * `dir` defaults to the checkout's own `themes/`, which is every caller but one: P2's
+ * `syncThemes` is driven over a FIXTURE directory by the cross-implementation corpus in
+ * `tests/test_maintainer_tools_parity.py`, because the tool it belongs to rewrites committed
+ * files and cannot be gated against the real ones. A parameter, not a second enumeration —
+ * a scaffold mistaken for a theme is exactly what this function exists to prevent, once.
+ *
+ * Sorted with `comparePaths` and not `.sort()`: the Python sorts `Path` objects, which compare
+ * through `_str_normcase`, so on Windows `Cyberpunk.json` sorts before `bar.json` there and
+ * after it under a bare code-unit sort. No shipped theme has an upper-case name, so no
+ * emitted byte moves — it is the fixture corpus that can reach a name that does.
+ */
+export function themeFiles(dir = THEMES) {
+  let names;
+  try { names = readdirSync(dir); } catch { return []; }
+  return names.filter((n) => n.endsWith('.json') && !n.startsWith('_'))
+    .map((n) => path.join(dir, n)).sort(comparePaths);
+}
+
+/** `_harness_setup._theme_from_agent` — match a theme's unique LOADED_SIGIL in a carrier. */
+function themeFromAgent(agentMd) {
+  const text = readMaybe(agentMd);
+  if (text === null) return null;
+  for (const tf of themeFiles()) {
+    const doc = readJsonMaybe(tf);
+    const sig = (doc && typeof doc === 'object' ? doc.LOADED_SIGIL : '') || '';
+    if (sig && text.includes(sig)) return path.basename(tf, '.json');
+  }
+  return null;
+}
+
+/**
+ * `_harness_setup.CARRIERS` — the five instruction carriers, in the Python's order.
+ *
+ * A shared table rather than three copies of the same list: `_theme_of_dir`,
+ * `_posture_of_dir` and `_mode_of_dir` each walk it, and the order is observable (the first
+ * carrier that answers wins). `rules/geneseed.md` is spelled with `path.join` at each use
+ * because the Python writes `d / "rules" / "geneseed.md"` for that one entry.
+ */
+const CARRIERS = ['AGENT.md', 'CLAUDE.md', path.join('rules', 'geneseed.md'),
+  'copilot-instructions.md', 'AGENTS.md'];
+
+/** `_harness_setup._theme_of_dir` — the marker, else the sigil in one of five carriers. */
+export function themeOfDir(d) {
+  const marker = path.join(d, '.geneseed-theme');
+  if (isFile(marker)) {
+    const name = (readMaybe(marker) ?? '').trim();
+    if (name) return name;
+  }
+  for (const carrier of CARRIERS) {
+    const found = themeFromAgent(path.join(d, carrier));
+    if (found) return found;
+  }
+  return null;
+}
+
+/** `_harness_setup.FOOTPRINTS`. */
+const FOOTPRINTS = ['lean', 'full'];
+
+/**
+ * `_harness_setup._footprint_of_dir`.
+ *
+ * `status` reads no footprint row at all; the WARN is why this function is ported there, and
+ * `diff` and `rebuild-all` read the RETURN value as well. An unrecognised marker is reported
+ * rather than swallowed (Rule VII), and a compared stderr is what makes that observable —
+ * `status/a-bogus-footprint-marker-warns-on-stderr` is the cell.
+ */
+export function footprintOfDir(d) {
+  const marker = path.join(d, '.geneseed-footprint');
+  if (isFile(marker)) {
+    const v = (readMaybe(marker) ?? '').trim();
+    if (FOOTPRINTS.includes(v)) return v;
+    if (v) {
+      pyPrintErr(`[geneseed] WARN: ${marker} holds unknown footprint ${pyRepr(v)} — `
+        + `reading it as 'full'. Known: ${FOOTPRINTS.join(', ')}.\n`);
+    }
+  }
+  return 'full';
+}
+
+/**
+ * `_harness_setup._posture_of_dir` / `_mode_of_dir` — CONTENT-detected, not markered.
+ *
+ * The inlined `## Posture` / `## Mode` section opens with a distinctive `**<Name>**` lead, so
+ * a deployed install carries its register in the prose and needs no extra marker file. The
+ * two Python functions are identical but for which name list they scan, which is the argument
+ * here — and the list comes from `discoverNames`, the same call the driver's `--posture`
+ * choices come from, so a new posture file is detectable and buildable in one change.
+ *
+ * `str.capitalize()` is NOT `s[0].toUpperCase() + s.slice(1)`: Python lowercases the REST of
+ * the string, so a posture file named `Foreman` renders `**Foreman**` and one named `FOREMAN`
+ * would be scanned for as `**Foreman**` by both implementations only if this reproduces the
+ * lowercasing. Every shipped name is already lowercase, which is exactly why the difference
+ * would go unnoticed — the corpus in `tests/test_pure_function_parity.py` is what covers it.
+ */
+export function pyCapitalize(s) {
+  return s.length ? s[0].toUpperCase() + s.slice(1).toLowerCase() : s;
+}
+
+function leadOfDir(d, names) {
+  for (const carrier of CARRIERS) {
+    const text = readMaybe(path.join(d, carrier));
+    if (text === null) continue;
+    for (const name of names) {
+      if (text.includes(`**${pyCapitalize(name)}**`)) return name;
+    }
+  }
+  return null;
+}
+
+export const postureOfDir = (d) => leadOfDir(d, discoverNames('postures', 'peer'));
+export const modeOfDir = (d) => leadOfDir(d, discoverNames('modes', 'direct'));
+
+// ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
+
+/** `_harness_mcp._claude_read_manifest`. */
+export function claudeReadManifest(cfgDir) {
+  const data = readJsonMaybe(path.join(cfgDir, GLOBAL_MANIFEST));
+  return data && typeof data === 'object' && !Array.isArray(data) ? data : {};
+}
+
+/**
+ * `_harness_mcp._manifest_is_claude` — keyed on the `managed` MAP, not on `claude_md`: a Bob
+ * global emit ships no AGENTS.md and records no `claude_md`, and still needs the
+ * Claude-style reversal.
+ */
+export function manifestIsClaude(cfgDir) {
+  const mg = claudeReadManifest(cfgDir).managed;
+  return typeof mg === 'object' && mg !== null && !Array.isArray(mg);
+}
+
+/** `_harness_mcp._EMIT_HOST_SCOPE` — a marker's emit name fixes (host, scope). */
+export const EMIT_HOST_SCOPE = new Map([
+  ['opencode', ['opencode', 'project']], ['opencode-global', ['opencode', 'global']],
+  ['claude', ['claude', 'project']], ['claude-global', ['claude', 'global']],
+  ['bob', ['bob', 'project']], ['bob-global', ['bob', 'global']],
+  ['copilot', ['copilot', 'project']], ['copilot-global', ['copilot', 'global']],
+]);
+
+/** `_harness_mcp._emit_host_scope_of` — `root`'s own marker, resolved, or null. */
+export function emitHostScopeOf(root) {
+  const emit = readMaybe(path.join(root, '.geneseed-emit'));
+  if (emit === null) return null;
+  return EMIT_HOST_SCOPE.get(emit.trim()) ?? null;
+}
+
+/** `_harness_mcp.DISABLED_STASH` — a sibling dir whose presence means "disabled". */
+export const DISABLED_STASH = '.geneseed-disabled';
+
+/**
+ * `_harness_mcp._claude_cfg` — where a Claude-STYLE install keeps its manifest.
+ *
+ * The config dir itself for a global install; `<repo>/<project_marker>` for a project one.
+ * Host-aware so Bob and Copilot ride the whole Claude lifecycle with only the subdir
+ * differing, and the marker comes from `HOSTS` rather than a literal for that reason.
+ */
+export function claudeCfg(root, scope, host = 'claude') {
+  if (scope === 'global') return root;
+  const spec = HOSTS.find((h) => h.host === host);
+  return path.join(root, spec ? spec.projectMarker : '.claude');
+}
+
+/** `_harness_mcp._claude_state`. */
+function claudeState(root, scope = 'global', host = 'claude') {
+  const cfg = claudeCfg(root, scope, host);
+  if (isDir(path.join(cfg, DISABLED_STASH, host))) return 'disabled';
+  return existsSync(path.join(cfg, GLOBAL_MANIFEST)) ? 'active' : 'absent';
+}
+
+/** `_harness_mcp._install_kind` — 'global' | 'project' | null. */
+export function installKind(root) {
+  if (existsSync(path.join(root, GLOBAL_MANIFEST))) return 'global';
+  if (isDir(path.join(root, '.opencode'))) return 'project';
+  return null;
+}
+
+/** `_harness_mcp._install_state` — 'active' | 'disabled' | 'absent'. */
+export function installState(root, host = 'opencode', scope = 'global') {
+  if (['claude', 'bob', 'copilot'].includes(host)) return claudeState(root, scope, host);
+  if (isDir(path.join(root, DISABLED_STASH))) return 'disabled';
+  return installKind(root) !== null ? 'active' : 'absent';
+}
+
+/** `_harness_mcp._registered_targets` — (host, scope, root) for every registered root. */
+export function registeredTargets() {
+  const out = [];
+  for (const root of registryRoots()) {
+    const hs = emitHostScopeOf(root);
+    if (hs) out.push([hs[0], hs[1], root]);
+  }
+  return out;
+}
+
+/**
+ * `_harness_mcp._install_targets` — every (host, scope, root) an install may live at,
+ * most-local first.
+ *
+ * De-duplicated on the (host, RESOLVED path) pair, which is three behaviours in one rule: a
+ * cwd carrying both `.opencode/` and `.claude/` yields two correctly-typed rows, a cwd that
+ * IS a global config dir never doubles its own host's row, and a registered root that is also
+ * the cwd never doubles either. `pyResolve` rather than `path.resolve` because Python's
+ * `Path.resolve()` returns the filesystem's own casing — on Windows two spellings of the same
+ * directory differ as strings and not as installs, and this Set is keyed by string.
+ */
+export function installTargets() {
+  const out = [];
+  const seen = new Set();
+
+  const add = (host, scope, root) => {
+    // A "project" whose marker dir IS this host's global config dir is the global install
+    // seen from its parent (the daemon's cwd is $HOME, where $HOME/.claude == ~/.claude) —
+    // not a separate project. Surfacing it would alias the global's files.
+    if (scope !== 'global') {
+      try {
+        const spec = HOSTS.find((h) => h.host === host);
+        if (pyResolve(path.join(root, spec.projectMarker)) === pyResolve(spec.configDir())) {
+          return;
+        }
+      } catch { /* as the Python's bare `except Exception: pass` */ }
+    }
+    const key = `${host}\0${pyResolve(root)}`;
+    if (!seen.has(key)) { seen.add(key); out.push([host, scope, root]); }
+  };
+
+  const cwd = process.cwd();
+  for (const { host, projectMarker } of HOSTS) {
+    if (isDir(path.join(cwd, projectMarker))) add(host, 'project', cwd);
+  }
+  for (const { host, configDir } of HOSTS) {
+    try { add(host, 'global', configDir()); } catch { /* a missing host dir is not fatal */ }
+  }
+  for (const [host, scope, root] of registeredTargets()) add(host, scope, root);
+  return out;
+}
+
+// ---- what this machine installed (`_harness_setup._installed_defaults`) --------------------
+
+/**
+ * `_harness_setup._installed_defaults` — all five keys, as of P5i.
+ *
+ * It carried only `theme` and `emit` for four phases because those are the two `status`
+ * prints and the two `doctor` reads, and the port's keep-vs-delete rule is "part of an
+ * asserted partition", not "the Python has it". `setup` is the caller the debt was recorded
+ * against: `collectSetupLines` pre-selects the posture, mode and footprint picker at
+ * `inst.posture` / `inst.mode` / `inst.footprint`, so a three-key answer would have silently
+ * pre-selected the CONFIGURED default over the DEPLOYED one on three of its five questions.
+ * Nothing in `status` or `doctor` moves: both read the keys they already read.
+ */
+export function installedDefaults() {
+  const found = { theme: null, posture: null, mode: null, emit: null, footprint: null };
+  const candidates = [];
+  for (const { host, configDir } of HOSTS) {
+    try { candidates.push([configDir(), `${host}-global`]); } catch { /* as the Python */ }
+  }
+  // One cwd-relative bundle candidate — `ROOT / "Harness"` and `ROOT.parent / "Harness"`
+  // left with the Python's, see `_harness_setup._installed_defaults` for the argument.
+  candidates.push([path.join(process.cwd(), 'Harness'), null]);
+  for (const [base, knownEmit] of candidates) {
+    if (found.emit === null) {
+      const em = path.join(base, '.geneseed-emit');
+      if (isFile(em)) {
+        found.emit = (readMaybe(em) ?? '').trim() || null;
+      } else if (isFile(path.join(base, GLOBAL_MANIFEST))) {
+        // A manifest with no emit marker: a known config dir names its own host; a bundle
+        // tells Claude from OpenCode by shape.
+        found.emit = knownEmit
+          ?? (manifestIsClaude(base) ? 'claude-global' : 'opencode-global');
+      }
+    }
+    if (found.theme === null) found.theme = themeOfDir(base) ?? null;
+    if (found.posture === null) found.posture = postureOfDir(base) ?? null;
+    if (found.mode === null) found.mode = modeOfDir(base) ?? null;
+    // `found["footprint"] is None` in the Python, so only the FIRST marker on the walk
+    // speaks — and `footprintOfDir` never answers null, which is why a boolean stood in for
+    // the value while nothing read it.
+    if (found.footprint === null && isFile(path.join(base, '.geneseed-footprint'))) {
+      found.footprint = footprintOfDir(base);
+    }
+  }
+  return found;
+}