geneseed 3.1.3 → 3.2.0

package/js/build/stubs.mjs

@@ -198,59 +198,51 @@ agent-overrides.json
 // Seeded stubs — write-once, never overwrite
 // ---------------------------------------------------------------------------
 
-/** `_build_render.ensure_context_stub`. */
+/**
+ * `_build_render`'s eight `ensure_*_stub` functions all wrote this same guard out by hand:
+ * write `t` to `p` only when nothing is there yet. The STUB BODIES above are what a recorded
+ * corpus compares byte for byte — this only touches the write-once CHECK every one of them
+ * repeated, never the text.
+ */
+const seed = (p, t) => { if (!existsSync(p)) writeText(p, t); };
+
+/** A stub whose destination is a fixed `out`-relative name and a fixed body. */
+const stubWriter = (file, stub) => (out) => seed(path.join(out, file), stub);
+
+/** `_build_render.ensure_context_stub` — the one stub whose body is computed, not literal. */
 export function ensureContextStub(out) {
-  const dest = path.join(out, 'context.json');
-  if (!existsSync(dest)) {
-    writeText(dest, `${jsonDumpsIndent(CONTEXT_STUB, { ensureAscii: false })}\n`);
-  }
+  seed(path.join(out, 'context.json'), `${jsonDumpsIndent(CONTEXT_STUB, { ensureAscii: false })}\n`);
 }
 
 /** `_build_render.ensure_wiki_stub` — a legacy `wiki.json` counts as present. */
 export function ensureWikiStub(out) {
-  const dest = path.join(out, 'wiki.jsonc');
-  if (!existsSync(dest) && !existsSync(path.join(out, 'wiki.json'))) writeText(dest, WIKI_STUB);
+  if (!existsSync(path.join(out, 'wiki.json'))) seed(path.join(out, 'wiki.jsonc'), WIKI_STUB);
 }
 
 /** `_build_render.ensure_rules_stub`. */
-export function ensureRulesStub(out) {
-  const dest = path.join(out, RULES_FILE);
-  if (!existsSync(dest)) writeText(dest, RULES_STUB);
-}
+export const ensureRulesStub = stubWriter(RULES_FILE, RULES_STUB);
 
 /** `_build_render.ensure_profile_stub`. */
-export function ensureProfileStub(out) {
-  const dest = path.join(out, PROFILE_FILE);
-  if (!existsSync(dest)) writeText(dest, PROFILE_STUB);
-}
+export const ensureProfileStub = stubWriter(PROFILE_FILE, PROFILE_STUB);
 
 /**
  * `_build_render.ensure_excludes_stub` — the sovereign-repo list, seeded once and NEVER
  * overwritten. Reachable only from the Claude-shaped emits, which is why it arrived with
  * `emitClaudeRender` rather than with the bundle stubs beside it.
  */
-export function ensureExcludesStub(out) {
-  const dest = path.join(out, EXCLUDES_FILE);
-  if (!existsSync(dest)) writeText(dest, EXCLUDES_STUB);
-}
+export const ensureExcludesStub = stubWriter(EXCLUDES_FILE, EXCLUDES_STUB);
 
 /** `_build_render.ensure_bundle_gitignore`. */
-export function ensureBundleGitignore(out) {
-  const dest = path.join(out, '.gitignore');
-  if (!existsSync(dest)) writeText(dest, BUNDLE_GITIGNORE);
-}
+export const ensureBundleGitignore = stubWriter('.gitignore', BUNDLE_GITIGNORE);
+
+/** A stub INSIDE an already-existing store dir — a memory/notebook index, only ever seeded
+ * once the store itself exists (`ensureMemoryIndex`/`ensureNotebookIndex` are both called
+ * right after the store dir is created, but never invent the dir themselves). */
+const storeIndexWriter = (file, header) => (dir) => { if (isDir(dir)) seed(path.join(dir, file), header); };
 
 /** `_build_render.ensure_memory_index` — only inside an EXISTING store dir. */
-export function ensureMemoryIndex(memDir) {
-  if (!isDir(memDir)) return;
-  const idx = path.join(memDir, 'MEMORY.md');
-  if (!existsSync(idx)) writeText(idx, '# Memory Index\n');
-}
+export const ensureMemoryIndex = storeIndexWriter('MEMORY.md', '# Memory Index\n');
 
 /** `_build_render.ensure_notebook_index`. */
-export function ensureNotebookIndex(nbDir) {
-  if (!isDir(nbDir)) return;
-  const idx = path.join(nbDir, 'NOTEBOOK.md');
-  if (!existsSync(idx)) writeText(idx, '# Notebook Index\n');
-}
+export const ensureNotebookIndex = storeIndexWriter('NOTEBOOK.md', '# Notebook Index\n');
 

package/js/build/themes.mjs

@@ -66,7 +66,7 @@ import { stripWhitespaceStart, stripWhitespaceEnd, stripWhitespace } from '../li
  *     for containers — a `===` here would return `null` every time and silently route every
  *     theme through the re-dump fallback, i.e. rewrite all 14 files in full.
  */
-export function insertThemeKeys(raw, theme, tmpl, tmplKeys, missing) {
+function insertThemeKeys(raw, theme, tmpl, tmplKeys, missing) {
   const lines = splitLines(raw);
   if (!lines.length || stripWhitespace(lines[0]) !== '{') return null;
 

package/js/build/version.mjs

@@ -145,9 +145,7 @@ export function writeVersion(cfg, out) {
   // Mutating it away stays green here for a reason no cell can remove — freezing the
   // clock across a process boundary is not something the harness can do — which is
   // exactly why the choice is spelled out instead of relying on the comparison.
-  const d = new Date();
-  const today = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-`
-    + `${String(d.getDate()).padStart(2, '0')}`;
+  const today = new Date().toLocaleDateString('sv-SE');
   writeText(path.join(out, VERSION_MARKER),
     `${fp} (built ${today}) [release ${release}]\n`);
   return fp;

package/js/hosts/hooks.mjs

@@ -35,7 +35,6 @@ import { existsSync, statSync, readFileSync, readdirSync, mkdirSync, realpathSyn
   from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
 import { readText, writeText, printOut, printErr, withDiscardableStderr } from '../lib/fs.mjs';
 import { jsonDumpsCompact } from '../lib/json.mjs';
 import { normcase, comparePaths, toPlatformPath } from '../lib/paths.mjs';
@@ -46,7 +45,7 @@ import { NO_WINDOW } from '../lib/proc.mjs';
 // with it went this file's private `opencodeConfigDir`, whose only caller it was.
 import { resolveMemoryDir, expanduser } from './hosts.mjs';
 
-const ROOT = path.dirname(path.dirname(path.dirname(fileURLToPath(import.meta.url))));
+const ROOT = path.resolve(import.meta.dirname, '../..');
 
 // ---- Python path and text primitives -------------------------------------------------
 // Small, and each one is here because a JS-idiomatic equivalent differs observably.
@@ -101,6 +100,7 @@ function resolvePath(p) {
   }
 }
 
+// NOT imported from `js/lib/fs.mjs` (the owner everywhere else) — hot path, no new import cost.
 const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
 const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
 
@@ -575,7 +575,7 @@ export function cmdGitGate(args) {
  * Geneseed's own coinage and match anywhere; any other markdown matches only inside THIS
  * install's `<root>/memory/`.
  */
-export function ruleGateTarget(p, root) {
+function ruleGateTarget(p, root) {
   if (typeof p !== 'string') return null;
   // Split on BOTH separators rather than taking a basename: a payload carrying a Windows
   // path reaches a POSIX host with its backslashes intact, and `path.basename` there

package/js/hosts/hosts.mjs

@@ -14,14 +14,12 @@
  * changed resolver rather than catch it — but `tests/unit/node_driver.test.mjs`'s relocation
  * table, which asserts each host's global target absolutely.
  */
-import { realpathSync, statSync } from 'node:fs';
+import { realpathSync } from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import { printErr, withDiscardableStderr } from '../lib/fs.mjs';
+import { printErr, withDiscardableStderr, isDir } from '../lib/fs.mjs';
 import { toPlatformPath } from '../lib/paths.mjs';
 
-const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
-
 /** `_build_global.GLOBAL_MANIFEST` — the file whose presence means "a global install". */
 export const GLOBAL_MANIFEST = '.geneseed-manifest.json';
 

package/js/hosts/installs.mjs

@@ -32,19 +32,16 @@
  * web cells recorded it. Both candidates are gone (the argument is in the Python), and the
  * claim is now true rather than aspirational.
  */
-import { existsSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 
 import { CONFIG, PACK_ORDER, THEMES, discoverNames } from '../build/source.mjs';
 import { GLOBAL_MANIFEST, HOSTS, resolvePath } from './hosts.mjs';
 import { registryRoots } from '../inspect/registry.mjs';
-import { printErr, readText } from '../lib/fs.mjs';
+import { printErr, readText, isFile, isDir } from '../lib/fs.mjs';
 import { formatRepr } from '../lib/json.mjs';
 import { comparePaths } from '../lib/paths.mjs';
 
-const isDir = (p) => { try { return statSync(p).isDirectory(); } catch { return false; } };
-const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
-
 /**
  * `Path.read_text(encoding="utf-8")`, or null where Python raises OSError.
  *
@@ -150,6 +147,22 @@ function themeFromAgent(agentMd) {
 const CARRIERS = ['AGENT.md', 'CLAUDE.md', path.join('rules', 'geneseed.md'),
   'copilot-instructions.md', 'AGENTS.md'];
 
+/**
+ * The scan `themeOfDir`, `leadOfDir`, `doctrinesOfDir` and `excludedRulesOfDir` each wrote
+ * out: try each carrier in order, first answer wins. `probe(carrierPath)` returns
+ * `undefined` to mean "keep looking" and anything else — including `null` or `[]`, both
+ * legitimate stop values for the two register readers below — to mean "stop, this is the
+ * answer". `fallback` is what every caller's own trailing `return …;` supplied once the
+ * whole list was exhausted with no answer.
+ */
+function firstCarrier(d, probe, fallback = null) {
+  for (const carrier of CARRIERS) {
+    const result = probe(path.join(d, carrier));
+    if (result !== undefined) return result;
+  }
+  return fallback;
+}
+
 /** `_harness_setup._theme_of_dir` — the marker, else the sigil in one of five carriers. */
 export function themeOfDir(d) {
   const marker = path.join(d, '.geneseed-theme');
@@ -157,11 +170,7 @@ export function themeOfDir(d) {
     const name = (readMaybe(marker) ?? '').trim();
     if (name) return name;
   }
-  for (const carrier of CARRIERS) {
-    const found = themeFromAgent(path.join(d, carrier));
-    if (found) return found;
-  }
-  return null;
+  return firstCarrier(d, (carrierPath) => themeFromAgent(carrierPath) || undefined);
 }
 
 /** `_harness_setup.FOOTPRINTS`. */
@@ -209,14 +218,14 @@ export function capitalize(s) {
 }
 
 function leadOfDir(d, names) {
-  for (const carrier of CARRIERS) {
-    const text = readMaybe(path.join(d, carrier));
-    if (text === null) continue;
+  return firstCarrier(d, (carrierPath) => {
+    const text = readMaybe(carrierPath);
+    if (text === null) return undefined;
     for (const name of names) {
       if (text.includes(`**${capitalize(name)}**`)) return name;
     }
-  }
-  return null;
+    return undefined;
+  });
 }
 
 export const postureOfDir = (d) => leadOfDir(d, discoverNames('postures', 'peer'));
@@ -257,17 +266,16 @@ const ACTIVE_PACKS_RE = /^Active packs:[ \t]*(.+?)[ \t]*$/m;
  * exactly the empty field a fold leaves behind, which is what makes this catch it.
  */
 export function doctrinesOfDir(d) {
-  for (const carrier of CARRIERS) {
-    const text = readMaybe(path.join(d, carrier));
-    if (text === null) continue;
+  return firstCarrier(d, (carrierPath) => {
+    const text = readMaybe(carrierPath);
+    if (text === null) return undefined;
     const m = ACTIVE_PACKS_RE.exec(text);
-    if (!m) continue;
+    if (!m) return undefined;
     if (m[1] === 'none') return [];
     const named = m[1].split(',').map((s) => s.trim());
     if (!named.every((n) => PACK_ORDER.includes(n))) return null;
-    return PACK_ORDER.filter((p) => named.includes(p));
-  }
-  return null;
+    return PACK_ORDER.filter((pk) => named.includes(pk));
+  });
 }
 
 /**
@@ -314,11 +322,11 @@ const EXCLUDED_RULES_RE = /^Excluded rules:[ \t]*(.+?)[ \t]*$/m;
  * take away rules nobody named.
  */
 export function excludedRulesOfDir(d) {
-  for (const carrier of CARRIERS) {
-    const text = readMaybe(path.join(d, carrier));
-    if (text === null) continue;
+  return firstCarrier(d, (carrierPath) => {
+    const text = readMaybe(carrierPath);
+    if (text === null) return undefined;
     const m = EXCLUDED_RULES_RE.exec(text);
-    if (!m) continue;
+    if (!m) return undefined;
     if (m[1] === 'none') return [];
     const named = m[1].split(',').map((s) => s.trim());
     // `<pack> <n>` on the page, `<pack>.<n>` in the code — the same asymmetry the rendered
@@ -329,8 +337,7 @@ export function excludedRulesOfDir(d) {
         ? `${parts[0]}.${Number(parts[1])}` : null;
     });
     return ids.every(Boolean) ? [...new Set(ids)].sort() : [];
-  }
-  return [];
+  }, []);
 }
 
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------

package/js/hosts/link.mjs

@@ -86,7 +86,7 @@ import { toPlatformPath } from '../lib/paths.mjs';
 const IS_WIN = process.platform === 'win32';
 
 /** `_harness_lifecycle._win_bin_dir`. */
-export function winBinDir() {
+function winBinDir() {
   // `os.environ.get(...) or str(Path.home())` — an EMPTY LOCALAPPDATA falls back too,
   // which `??` would not do.
   const base = process.env.LOCALAPPDATA || os.homedir();

package/js/hosts/native.mjs

@@ -173,14 +173,14 @@ function agentColorMap(theme) {
       cleaned[k] = 'secondary';
     }
   }
-  if (!Object.prototype.hasOwnProperty.call(cleaned, '_default')) cleaned._default = 'secondary';
+  if (!Object.hasOwn(cleaned, '_default')) cleaned._default = 'secondary';
   return cleaned;
 }
 
 /** `_build_emit._agent_color`. */
 function agentColor(stem, theme) {
   const colors = agentColorMap(theme);
-  return Object.prototype.hasOwnProperty.call(colors, stem) ? colors[stem] : colors._default;
+  return Object.hasOwn(colors, stem) ? colors[stem] : colors._default;
 }
 
 function isPlainObject(v) {
@@ -195,7 +195,7 @@ function given(v) {
 /**
  * `overrides.get(stem) or {}`.
  *
- * The `hasOwnProperty` guard is not ceremony: a bare `overrides[stem]` reaches
+ * The `Object.hasOwn` guard is not ceremony: a bare `overrides[stem]` reaches
  * `Object.prototype` for an agent named `constructor`, `toString` or `valueOf`, and would
  * hand back a function where Python hands back `None`.
  *
@@ -206,7 +206,7 @@ function given(v) {
  * difference on any path the gate covers — a difference in which malformed input crashes.
  */
 function agentOverride(overrides, stem) {
-  return (Object.prototype.hasOwnProperty.call(overrides, stem) && overrides[stem]) || {};
+  return (Object.hasOwn(overrides, stem) && overrides[stem]) || {};
 }
 
 /**
@@ -230,30 +230,48 @@ export function pushOverrideLines(fm, ov) {
   if (given(ov.steps)) fm.push(`steps: ${formatValue(ov.steps)}`);
 }
 
-/** `_build_emit._claude_agent_frontmatter`. */
-function claudeAgentFrontmatter(stem, text, overrides) {
+/**
+ * The readonly-tool line `claudeAgentFrontmatter`/`copilotAgentFrontmatter` each emit — a
+ * DENYLIST for Claude, an ALLOWLIST for Copilot — differing only in the key, the base list,
+ * the one extra entry the `<!-- bash: allow -->` marker toggles, and whether the value is
+ * bracketed. `extraWhenBashAllowed` is `false` for Claude (Bash is denied UNLESS the marker
+ * allows it) and `true` for Copilot (`execute` is allowed ONLY IF the marker is present) —
+ * the same marker, read in the opposite sense a denylist and an allowlist require.
+ */
+const READONLY_TOOLS = {
+  claude: {
+    key: 'disallowedTools', tools: ['Write', 'Edit', 'NotebookEdit', 'WebFetch'],
+    extra: 'Bash', extraWhenBashAllowed: false, brackets: false,
+  },
+  copilot: {
+    key: 'tools', tools: ['read', 'search', 'todo', 'agent'],
+    extra: 'execute', extraWhenBashAllowed: true, brackets: true,
+  },
+};
+
+/** `_build_emit._claude_agent_frontmatter` / `._copilot_agent_frontmatter`. */
+function claudeCopilotAgentFrontmatter(host, stem, text, overrides) {
   const fm = [`name: ${stem}`, `description: ${jsonDumps(descOf(text))}`];
   const ov = agentOverride(overrides, stem);
   if (isTruthy(ov.model)) fm.push(`model: ${formatValue(ov.model)}`);
   if (isReadonly(text)) {
-    const denied = ['Write', 'Edit', 'NotebookEdit', 'WebFetch'];
-    if (!text.includes('<!-- bash: allow -->')) denied.push('Bash');
-    fm.push(`disallowedTools: ${denied.join(', ')}`);
+    const {
+      key, tools, extra, extraWhenBashAllowed, brackets,
+    } = READONLY_TOOLS[host];
+    const list = [...tools];
+    if (text.includes('<!-- bash: allow -->') === extraWhenBashAllowed) list.push(extra);
+    fm.push(`${key}: ${brackets ? `[${list.join(', ')}]` : list.join(', ')}`);
   }
   return fm;
 }
 
-/** `_build_emit._copilot_agent_frontmatter` — `tools:` is an ALLOWLIST, not a denylist. */
+function claudeAgentFrontmatter(stem, text, overrides) {
+  return claudeCopilotAgentFrontmatter('claude', stem, text, overrides);
+}
+
+/** `tools:` is an ALLOWLIST, not a denylist. */
 function copilotAgentFrontmatter(stem, text, overrides) {
-  const fm = [`name: ${stem}`, `description: ${jsonDumps(descOf(text))}`];
-  const ov = agentOverride(overrides, stem);
-  if (isTruthy(ov.model)) fm.push(`model: ${formatValue(ov.model)}`);
-  if (isReadonly(text)) {
-    const allowed = ['read', 'search', 'todo', 'agent'];
-    if (text.includes('<!-- bash: allow -->')) allowed.push('execute');
-    fm.push(`tools: [${allowed.join(', ')}]`);
-  }
-  return fm;
+  return claudeCopilotAgentFrontmatter('copilot', stem, text, overrides);
 }
 
 /** `_build_emit._opencode_agent_frontmatter`. */

package/js/hosts/opencode.mjs

@@ -115,36 +115,47 @@ export function sourceReleaseVersion(cfg) {
   return '0.0.0';
 }
 
+const GRAY = 8;
+const GREEN = 2;
+const RED = 1;
+const YEL = 3;
+const MAG = 5;
+const NONE = 'none';
+
+/**
+ * `_build_emit._theme_json`'s role -> value map, one entry per `PALETTE_ROLES` member (19 —
+ * not the 17 the plan that asked for this derivation guessed; logged as a wrong-plan-claim
+ * row). `acc` is the one theme-tinted value; `fn` and `type` happen to share it today but are
+ * kept as their own role entries rather than aliased to `accent`, since nothing requires a
+ * future theme to tint them together.
+ *
+ * ONE SLOT IS NOT A PURE FUNCTION OF ITS ROLE, and folding it in here would be wrong rather
+ * than tidy: `syntaxPunctuation` carries role `fgMuted`, the same role as `textMuted`,
+ * `diffContext`, `diffLineNumber` and `markdownBlockQuote` — all four of which render GRAY —
+ * but `syntaxPunctuation` alone has always rendered NONE. A real asymmetry this theme has
+ * shipped with, reproduced below as a one-slot override rather than smoothed away, the same
+ * pattern `colorThemeJson` already uses for its own `TRANSPARENT_NONE` slots.
+ */
+const roleAnsi = (acc) => ({
+  accent: acc, secondary: MAG, err: RED, warn: YEL, ok: GREEN,
+  fg: NONE, fgMuted: GRAY, border: GRAY,
+  bg: NONE, bgPanel: NONE, bgElement: NONE, addBg: NONE, delBg: NONE,
+  comment: GRAY, kw: MAG, fn: acc, str: GREEN, num: MAG, type: acc,
+});
+
+/** The one slot `roleAnsi`'s role lookup gets wrong on its own — forced to NONE after. */
+const THEME_JSON_NONE_OVERRIDE = new Set(['syntaxPunctuation']);
+
 /** `_build_emit._theme_json` — a COMPLETE terminal-native theme tinted by ACCENT. */
 export function themeJson(theme) {
   const raw = theme && theme.ACCENT !== undefined ? theme.ACCENT : 'cyan';
   const key = String(raw).toLowerCase();
-  const acc = Object.prototype.hasOwnProperty.call(ANSI, key) ? ANSI[key] : 6;
-  const GRAY = 8;
-  const GREEN = 2;
-  const RED = 1;
-  const YEL = 3;
-  const MAG = 5;
-  const NONE = 'none';
-  const t = {
-    primary: acc, secondary: MAG, accent: acc,
-    error: RED, warning: YEL, success: GREEN, info: acc,
-    text: NONE, textMuted: GRAY,
-    background: NONE, backgroundPanel: NONE, backgroundElement: NONE,
-    border: GRAY, borderActive: acc, borderSubtle: GRAY,
-    diffAdded: GREEN, diffRemoved: RED, diffContext: GRAY,
-    diffHunkHeader: acc, diffHighlightAdded: GREEN, diffHighlightRemoved: RED,
-    diffAddedBg: NONE, diffRemovedBg: NONE, diffContextBg: NONE,
-    diffLineNumber: GRAY, diffAddedLineNumberBg: NONE, diffRemovedLineNumberBg: NONE,
-    markdownText: NONE, markdownHeading: acc, markdownLink: MAG,
-    markdownLinkText: acc, markdownCode: GREEN, markdownBlockQuote: GRAY,
-    markdownEmph: YEL, markdownStrong: YEL, markdownHorizontalRule: GRAY,
-    markdownListItem: acc, markdownListEnumeration: acc, markdownImage: MAG,
-    markdownImageText: acc, markdownCodeBlock: NONE,
-    syntaxComment: GRAY, syntaxKeyword: MAG, syntaxFunction: acc,
-    syntaxVariable: NONE, syntaxString: GREEN, syntaxNumber: MAG,
-    syntaxType: acc, syntaxOperator: MAG, syntaxPunctuation: NONE,
-  };
+  const acc = Object.hasOwn(ANSI, key) ? ANSI[key] : 6;
+  const roles = roleAnsi(acc);
+  const t = {};
+  for (const [slot, role] of Object.entries(SLOT_ROLE)) {
+    t[slot] = THEME_JSON_NONE_OVERRIDE.has(slot) ? NONE : roles[role];
+  }
   return { $schema: 'https://opencode.ai/theme.json', theme: t };
 }
 
@@ -177,7 +188,7 @@ export function colorThemeJson(palette, transparent) {
     // `palette[role]` is a plain subscript in Python: a palette missing a role raises
     // KeyError and aborts the emit. A bare JS lookup would yield undefined, which
     // JSON.stringify DROPS — silently emitting a theme with missing slots.
-    if (!Object.prototype.hasOwnProperty.call(palette, role)) {
+    if (!Object.hasOwn(palette, role)) {
       throw new Error(`palette has no role '${role}' (slot '${slot}')`);
     }
     t[slot] = palette[role];
@@ -257,7 +268,7 @@ export function writePrimaryAgent(cfg, agentsDir, overrides) {
   const desc = 'Primary orchestrator — works by the harness Rules and delegates to the '
     + 'capability subagents.';
   const fm = [`description: ${jsonDumps(desc)}`, 'mode: primary', 'color: primary'];
-  const ov = (Object.prototype.hasOwnProperty.call(overrides, 'orchestrator')
+  const ov = (Object.hasOwn(overrides, 'orchestrator')
     && overrides.orchestrator) || {};
   pushOverrideLines(fm, ov);
   const dest = path.join(agentsDir, 'orchestrator.md');