geneseed 3.1.3 → 3.3.0

package/js/hosts/settings.mjs

@@ -42,35 +42,15 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import { printErr, readText, writeText } from '../lib/fs.mjs';
+import { readText, writeText, isOsError } from '../lib/fs.mjs';
 import {
   jsonDumps, jsonDumpsCompact, jsonDumpsIndent, parseJson, deepEquals, formatRepr,
-  indexOfDeepEqual,
+  indexOfDeepEqual, get, has, isDict,
 } from '../lib/json.mjs';
+import { expanduser } from './hosts.mjs';
+import { stripWhitespace, stripWhitespaceEnd } from '../lib/text.mjs';
 
-export const OPENCODE_SCHEMA = 'https://opencode.ai/config.json';
-
-/** `dict.get(key)` with Python's semantics — OWN properties only.
- *
- * `loaded[event]` where `event` came out of a manifest hands back `Object.prototype`'s
- * member for `constructor`, `toString` or `valueOf`, where Python's `.get` returns None.
- * The same hazard `js/hosts/native.mjs` hit with `overrides[stem]`, on a dict the USER edits. */
-function get(obj, key) {
-  return Object.prototype.hasOwnProperty.call(obj, key) ? obj[key] : undefined;
-}
-
-function has(obj, key) {
-  return Object.prototype.hasOwnProperty.call(obj, key);
-}
-
-/** `except OSError` — an fs failure carries a `code`; anything else is a bug, so rethrow. */
-function isOsError(e) {
-  return Boolean(e) && typeof e.code === 'string';
-}
-
-function isDict(v) {
-  return Boolean(v) && typeof v === 'object' && !Array.isArray(v);
-}
+const OPENCODE_SCHEMA = 'https://opencode.ai/config.json';
 
 /**
  * Is the `process` doctrine pack active for the install being emitted?
@@ -114,7 +94,7 @@ const consentRuleOn = (d, excluded = []) =>
  * Law IV's territory — an always-on invariant — not the process pack's, and the guard
  * plugin's own force-push arm is unconditional for the same reason.
  */
-export function defaultPermission(doctrines = null, excluded = []) {
+function defaultPermission(doctrines = null, excluded = []) {
   const bash = { 'rm -rf *': 'ask' };
   if (consentRuleOn(doctrines, excluded)) {
     bash['git commit*'] = 'ask';
@@ -205,22 +185,10 @@ function reconcileOpencodePermission(perm, want) {
   return [changed, stranded, null];
 }
 
-/**
- * `Path.with_suffix(suffix)` for the one shape this module needs.
- *
- * `PurePath.suffix` and `path.extname` disagree on leading-dot and trailing-dot names
- * (`.bashrc`, `x.`); the only caller passes `…/opencode.json`, and the emit's own callers
- * pass a literal. Spelled off `path.extname` with the empty-extension case handled so a
- * future caller with a suffix-less path appends rather than truncates.
- */
-function withSuffix(p, suffix) {
-  const ext = path.extname(p);
-  return (ext ? p.slice(0, p.length - ext.length) : p) + suffix;
-}
-
-/** `_build_settings._opencode_target`. */
+/** `_build_settings._opencode_target`. Only caller of a `.json` -> `.jsonc` suffix swap. */
 export function opencodeTarget(jsonPath) {
-  const jsonc = withSuffix(jsonPath, '.jsonc');
+  const ext = path.extname(jsonPath);
+  const jsonc = (ext ? jsonPath.slice(0, jsonPath.length - ext.length) : jsonPath) + '.jsonc';
   return existsSync(jsonc) ? jsonc : jsonPath;
 }
 
@@ -305,7 +273,7 @@ export function readJsonc(text) {
  * already has a `permission` key to add one is not saying so. Any other truthy value is read as
  * `'add'`, which is what the boolean callers this replaced meant.
  */
-export function warnCommentedJsonc(target, agentPath, permission,
+function warnCommentedJsonc(target, agentPath, permission,
   includeLsp = false, prefix = 'geneseed', doctrines = null, excluded = []) {
   process.stdout.write(`[${prefix}] ${path.basename(target)} has comments — not rewriting `
     + 'it (your edits are kept). Add this to its "instructions" array by hand:\n');
@@ -354,7 +322,7 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
       raw = readText(target);
     } catch (e) {
       if (!isOsError(e)) throw e;
-      process.stderr.write(`[geneseed] WARN: could not read ${target} (${asOsError(e)}) `
+      process.stderr.write(`[geneseed] WARN: could not read ${target} (${e.message}) `
         + `— NOT touching it. Add ${jsonDumps(agentPath)} to its "instructions" array by `
         + "hand once it's readable again.\n");
       return target;
@@ -433,25 +401,18 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
     atomicWriteJson(target, config);
   } catch (e) {
     if (!isOsError(e)) throw e;
-    process.stderr.write(`[geneseed] WARN: could not write ${target} (${asOsError(e)}) — `
+    process.stderr.write(`[geneseed] WARN: could not write ${target} (${e.message}) — `
       + `the harness will NOT auto-load until this is fixed. Add ${jsonDumps(agentPath)} `
       + 'to its "instructions" array by hand.\n');
   }
   return target;
 }
 
-/**
- * `str(OSError)` — what Python interpolates for `except OSError as e: f"({e})"`.
- *
- * Python renders `[Errno 13] Permission denied: 'C:\\x\\y'`; Node's message is
- * `EACCES: permission denied, open 'C:\x\y'`. The two cannot be made to agree, so the
- * parity gate does not drive a cell through a real fs failure — it exercises the branch
- * with an injectable failure instead and compares everything except the OS's own wording.
- * Named here so the gap is a decision rather than a surprise at GA.
- */
-function asOsError(e) {
-  return e.message;
-}
+// `except OSError as e: f"({e})"` is inlined as `e.message` at each call site above and below.
+// Python renders `[Errno 13] Permission denied: 'C:\\x\\y'`; Node's message is
+// `EACCES: permission denied, open 'C:\x\y'`. The two cannot be made to agree, so the parity
+// gate does not drive a cell through a real fs failure — it exercises the branch with an
+// injectable failure instead and compares everything except the OS's own wording.
 
 // ---- the hook shim ----------------------------------------------------------------
 // `|| exit 0` on the emitted commands does NOT mean "ignore failures": git-gate and
@@ -499,32 +460,18 @@ export function shimRel(platform = process.platform) {
   return ['bin', SHIM_MARK + (platform === 'win32' ? '.cmd' : '')];
 }
 
-/** `_build_settings._shim_home`. */
-export function shimHome() {
-  const env = process.env.GENESEED_HOME;
-  return env ? expanduser(env) : path.join(os.homedir(), '.geneseed');
-}
-
 /**
- * `Path(x).expanduser()` — private twin of `js/hosts/hosts.mjs`'s `expanduser`, same guard.
+ * `_build_settings._shim_home`.
  *
- * `GENESEED_HOME` is user-set, same as any config-dir env var there, so a `~user` value here
- * has the identical failure mode (a hook shim written under a literal `~user` directory) and
- * gets the identical fix — refuse rather than pass through. See that file's docblock for why
- * the refusal lives IN the primitive rather than at `shimHome`'s caller.
+ * `expanduser` is `js/hosts/hosts.mjs`'s — GENESEED_HOME is user-set, same as any config-dir
+ * env var there, so a `~user` value here has the identical failure mode (a hook shim written
+ * under a literal `~user` directory) and gets the identical refusal. This module used to carry
+ * a private "same guard" twin; the two had drifted (this one's refusal message dropped the
+ * parenthetical explaining WHY), which is exactly the kind of divergence one owner prevents.
  */
-function expanduser(p) {
-  if (p === '~') return os.homedir();
-  if (p.startsWith('~/') || p.startsWith('~\\')) return path.join(os.homedir(), p.slice(2));
-  if (p.startsWith('~')) {
-    const msg = `refusing '${p}': a '~user' path is not expanded by this port; pass an `
-      + 'absolute path, or "~" / "~/…" for your own home directory';
-    printErr(`${msg}\n`);
-    const e = new Error(msg);
-    e.exitCode = 1;
-    throw e;
-  }
-  return p;
+export function shimHome() {
+  const env = process.env.GENESEED_HOME;
+  return env ? expanduser(env) : path.join(os.homedir(), '.geneseed');
 }
 
 /** `_build_settings._hook_shim_path`. */
@@ -720,11 +667,34 @@ export function hookPrefix({ runner, entry, platform = process.platform } = {})
  * belongs in — the user's call — not how work is run, so it is not the process pack's to
  * remove. `default` here means unknown, and unknown keeps the gate (see `processPackOn`).
  */
-export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = []) {
+export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude') {
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
   // --root carries the install's own dir so a GLOBAL hook can stand down when a project
   // install of the same host sits at/above cwd (project-bypasses-global).
+  if (host === 'bob') {
+    // BOB'S OWN HOOK CONTRACT, per its hooks doc and 2.0.2 changelog (docs/reviews/
+    // bob-global-injection-2026-09.md): FIVE events — SessionStart, UserPromptSubmit,
+    // PreToolUse, PostToolUse, Stop — Claude's names, but NOT Claude's protocol. stdout is
+    // read as context on SessionStart only; on PreToolUse it is ignored and the one way to
+    // refuse a call is EXIT CODE 2. The groups this emit wrote before were Claude's whole
+    // set: `SubagentStop`/`PreCompact` are not Bob events, and the gates answered with a
+    // stdout JSON Bob never reads — permissive on every call. `--host bob` makes the gates
+    // speak exit codes (js/hosts/hooks.mjs). No matcher on PreToolUse: Bob's tool names
+    // are undocumented (its IDE and Shell differ), so `tool-gate` reads the payload's shape
+    // instead. Which tool payload fields Bob sends is equally undocumented; the gates read
+    // Claude's (`command`, `file_path`/`path`, `content`/`new_string`) and defer on anything
+    // else. Unverified live: no Bob install on the authoring machine.
+    const b = ' --host bob';
+    return {
+      SessionStart: [{ hooks: [{ type: 'command', command: `${run} context --root "${cfg}"${b} || exit 0` }] }],
+      // One group, both gates: process 5's consent is a stderr line here (Bob has no ask
+      // tier), so the pack toggle that drops Claude's git-gate group has nothing to drop —
+      // `tool-gate` only ever EXITS 2 for Laws I and IV, which every build carries.
+      PreToolUse: [{ hooks: [{ type: 'command', command: `${run} tool-gate --root "${cfg}"${b}` }] }],
+      Stop: [{ hooks: [{ type: 'command', command: `${run} learn ${mem} || exit 0` }] }],
+    };
+  }
   const context = `${run} context --root "${cfg}" || exit 0`;
   const gate = `${run} git-gate --root "${cfg}"`;
   const ruleGate = `${run} rule-gate --root "${cfg}"`;
@@ -740,7 +710,10 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [])
     ],
     SessionStart: [
       { matcher: 'startup|clear', hooks: [{ type: 'command', command: context }] },
-      { matcher: 'resume', hooks: [{ type: 'command', command: context }] },
+      // `compact` too: auto-compaction keeps the instruction file (the host re-reads it) but
+      // summarises away the eagerly injected context, memory index and notebook TOC. Re-seed
+      // them the way a resume does — the static AGENT.md is NOT re-printed.
+      { matcher: 'resume|compact', hooks: [{ type: 'command', command: context }] },
     ],
     // `|| exit 0` (not `|| true`): hooks run under cmd.exe on native Windows, where `true`
     // is not a command and the swallow-failures intent would invert into a 9009 error.
@@ -748,9 +721,151 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [])
     // Same command as Stop: `learn` reads the payload's hook_event_name and routes a
     // SubagentStop to the per-agent lesson path.
     SubagentStop: [{ hooks: [{ type: 'command', command: learn }] }],
+    // And once more BEFORE compaction. `learn` distils the tail of the transcript (the newest
+    // MAX_NOTES_CHARS), so per-turn Stop is a sliding window over the session — and
+    // compaction is the one moment that window is about to be summarised away for good.
+    // The payload carries `transcript_path` like Stop's; the SessionStart `compact` matcher
+    // re-seeds context AFTER, this captures memory BEFORE. Same `|| exit 0`: never block.
+    PreCompact: [{ hooks: [{ type: 'command', command: learn }] }],
   };
 }
 
+/**
+ * Geneseed's Copilot hooks, keyed by Copilot's event names.
+ *
+ * COPILOT'S SETTINGS ARE NOT CLAUDE'S. `~/.copilot/settings.json` carries `hooks` as a map of
+ * event → ONE `{command, shell?, timeout?}` object, not event → list of matcher groups, so
+ * nothing in `claudeHookGroups`/`mergeClaudeSettings` can be reused for it: there is no
+ * array to append to, and a second Geneseed group per event is not expressible. Two hooks:
+ *
+ *   * `sessionStart` → `context --host copilot`: the same project-context injection Claude
+ *     gets, in Copilot's `{"additionalContext"}` envelope.
+ *   * `toolCall` → `tool-gate --host copilot`: both gates behind the one command the event
+ *     allows, block-only for Laws I/IV, warn for the rest (js/hosts/hooks.mjs's header).
+ *
+ * No `sessionEnd`/`agentStop` → `learn`: Copilot's payloads for those carry no
+ * `transcript_path`, so `learn` would have nothing to distil. The memory write-back stays on
+ * the preamble for this host, as before.
+ *
+ * `|| exit 0` on the non-gate, as in `claudeHookGroups` and for the same reason.
+ */
+export function copilotHooks(cfg, hookOpts) {
+  const run = hookPrefix(hookOpts);
+  return {
+    sessionStart: { command: `${run} context --root "${cfg}" --host copilot || exit 0` },
+    toolCall: { command: `${run} tool-gate --root "${cfg}" --host copilot` },
+  };
+}
+
+/**
+ * Wire Copilot's hooks into `p` — returns the complete current claim set, `[{event, hook}]`.
+ *
+ * ONE SLOT PER EVENT MEANS A FOREIGN HOOK CANNOT BE JOINED, ONLY DISPLACED — and displacing
+ * a hook the user wrote is not Geneseed's to do. A slot is taken when it holds a hook that
+ * is neither canonical nor a claim recorded by a previous emit; that event is skipped with a
+ * warning and never claimed. A recorded stale claim (a moved shim) is replaced, as the Claude
+ * merge prunes stale groups. Comments in the file mean it is not rewritten, as everywhere.
+ */
+export function mergeCopilotSettings(p, priorHooks = null, hookOpts = {}) {
+  const prior = (priorHooks || []).filter(isDict);
+  let config = {};
+  let hadComments = false;
+  if (existsSync(p)) {
+    try {
+      const [loaded, hc] = readJsonc(readText(p));
+      hadComments = hc;
+      if (isDict(loaded)) config = loaded;
+    } catch (e) {
+      if (!isOsError(e)) throw e;
+    }
+  }
+  let hooks = get(config, 'hooks');
+  if (!isDict(hooks)) hooks = {};
+  const canonical = copilotHooks(path.dirname(p), hookOpts);
+  const claims = [];
+  let changed = false;
+  for (const [event, hook] of Object.entries(canonical)) {
+    const cur = get(hooks, event);
+    const recorded = prior.find((r) => get(r, 'event') === event);
+    if (isDict(cur) && deepEquals(cur, hook)) { claims.push({ event, hook }); continue; }
+    if (isDict(cur) && !(recorded && deepEquals(recorded.hook, cur))) {
+      process.stderr.write(`[geneseed] ${path.basename(p)}: hooks.${event} is already set and `
+        + 'is not Geneseed\'s — left alone, so this event is not wired.\n');
+      continue;
+    }
+    hooks[event] = hook;
+    claims.push({ event, hook });
+    changed = true;
+  }
+  // A recorded claim whose event is no longer canonical: unwire it, or it fires forever.
+  for (const rec of prior) {
+    const event = get(rec, 'event');
+    if (event in canonical) continue;
+    if (deepEquals(get(hooks, event), get(rec, 'hook'))) { delete hooks[event]; changed = true; }
+  }
+  if (!changed) return [p, claims];
+  if (hadComments) {
+    process.stderr.write(`[geneseed] ${path.basename(p)} has comments — not rewriting it `
+      + "(your edits are kept). Add Geneseed's hooks by hand from adapters/copilot/README.md.\n");
+    return [p, prior];
+  }
+  if (Object.keys(hooks).length) config.hooks = hooks;
+  else delete config.hooks;
+  atomicWriteJson(p, config);
+  return [p, claims];
+}
+
+/** Remove exactly the recorded Copilot hooks from `p`. True when the file was rewritten. */
+export function unwireCopilotSettings(p, recorded) {
+  if (!existsSync(p) || !recorded || !recorded.length) return false;
+  let loaded;
+  let hadComments;
+  try {
+    [loaded, hadComments] = readJsonc(readText(p));
+  } catch (e) {
+    if (!isOsError(e)) throw e;
+    return false;
+  }
+  if (hadComments || !isDict(loaded)) return false;
+  const hooks = get(loaded, 'hooks');
+  if (!isDict(hooks)) return false;
+  for (const rec of recorded) {
+    const event = get(rec, 'event');
+    if (deepEquals(get(hooks, event), get(rec, 'hook'))) delete hooks[event];
+  }
+  if (!Object.keys(hooks).length) delete loaded.hooks;
+  try {
+    atomicWriteJson(p, loaded);
+  } catch (e) {
+    if (!isOsError(e)) throw e;
+    return false;
+  }
+  return true;
+}
+
+/**
+ * The Copilot twin of `settingsIntegrityCheck`: every recorded hook present (or absent) in
+ * the file it was claimed against. Same contract — problems as strings, each also WARNed on
+ * stderr, empty when clean — so a merge that did not stick is loud at emit time rather than
+ * a hook that quietly never fires.
+ */
+export function copilotIntegrityCheck(p, recorded, expect = 'present') {
+  const problems = [];
+  const hooks = existsSync(p) ? (() => {
+    try { return get(readJsonc(readText(p))[0], 'hooks'); } catch { return null; }
+  })() : null;
+  for (const rec of (recorded || []).filter(isDict)) {
+    const hit = deepEquals(get(hooks, rec.event), rec.hook);
+    if (expect === 'present' && !hit) {
+      problems.push(`${p}: recorded Copilot hook missing — event=${rec.event}`);
+    } else if (expect === 'absent' && hit) {
+      problems.push(`${p}: recorded Copilot hook still present after unwire — event=${rec.event}`);
+    }
+  }
+  for (const x of problems) process.stderr.write(`[geneseed] WARN: ${x}\n`);
+  return problems;
+}
+
 /**
  * `_build_settings._merge_claude_settings` — returns `[target, managed]`.
  *
@@ -763,7 +878,7 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [])
  * `scope` is accepted and unused, exactly as in the Python.
  */
 export function mergeClaudeSettings(p, _scope = 'global', priorHooks = null, hookOpts = {},
-  doctrines = null, excluded = []) {
+  doctrines = null, excluded = [], host = 'claude') {
   const prior = (priorHooks || []).filter(isDict);
   let config = {};
   let hadComments = false;
@@ -783,7 +898,7 @@ export function mergeClaudeSettings(p, _scope = 'global', priorHooks = null, hoo
   }
   let hooks = get(config, 'hooks');
   if (!isDict(hooks)) hooks = {};
-  const canonical = claudeHookGroups(path.dirname(p), hookOpts, doctrines, excluded);
+  const canonical = claudeHookGroups(path.dirname(p), hookOpts, doctrines, excluded, host);
   const canonFlat = [];
   for (const [event, groups] of Object.entries(canonical)) {
     for (const g of groups) canonFlat.push({ event, group: g });
@@ -824,7 +939,7 @@ export function mergeClaudeSettings(p, _scope = 'global', priorHooks = null, hoo
     return [p, prior];
   }
   // The `else` is DEAD on both sides and reproduced rather than dropped: `canonical` always
-  // carries four events, so by the time control reaches here `hooks` is never empty. A
+  // carries at least three events, so by the time control reaches here `hooks` is never empty. A
   // mutation keeping the empty block instead of deleting it is the one of thirty-three that
   // stays green, and it stays green because there is nothing to detect — recorded the way
   // `themed_rel` is, so "the gate cannot see it" and "there is nothing to see" keep their
@@ -918,7 +1033,7 @@ export function wireClaudeExcludes(p, excludes) {
     atomicWriteJson(p, config);
   } catch (e) {
     if (!isOsError(e)) throw e;
-    process.stderr.write(`[geneseed] WARN: could not write ${p} (${asOsError(e)}) — `
+    process.stderr.write(`[geneseed] WARN: could not write ${p} (${e.message}) — `
       + 'claudeMdExcludes were not wired. Add to its "claudeMdExcludes" array by hand: '
       + `${jsonDumpsCompact(added)}\n`);
     return [];
@@ -973,7 +1088,7 @@ export const GENESEED_HOOK_SNIFF = ['harness.py', SHIM_MARK];
 // 2 and 3 differ ONLY inside the shim body. A classifier reading the host config alone would
 // call a fully-unmigrated machine "already migrated" — silently — and `migrate` would no-op on
 // exactly the installs it exists for. The shim body is a REQUIRED input, not a refinement.
-export const SHIM_ENTRY_MARK = 'geneseed-hook.mjs';
+const SHIM_ENTRY_MARK = 'geneseed-hook.mjs';
 
 /**
  * `_build_settings._migrate_shape` — 'legacy' | 'current' | 'none'.
@@ -1028,7 +1143,7 @@ export function autostartStale(text, root) {
 }
 
 /** `_build_settings._settings_hook_groups` — flatten `hooks` to [event, group] pairs. */
-export function settingsHookGroups(loaded) {
+function settingsHookGroups(loaded) {
   const hooks = get(loaded, 'hooks');
   if (!isDict(hooks)) return [];
   const out = [];
@@ -1068,7 +1183,7 @@ export function settingsIntegrityCheck(p, managed, expect = 'present') {
     [loaded] = readJsonc(readText(p));
   } catch (e) {
     if (!isOsError(e)) throw e;
-    problems.push(`${p}: could not read the file (${asOsError(e)})`);
+    problems.push(`${p}: could not read the file (${e.message})`);
     return flush();
   }
   if (!isDict(loaded)) {
@@ -1128,12 +1243,7 @@ export function settingsIntegrityCheck(p, managed, expect = 'present') {
   return flush();
 }
 
-const BLOCK_BEGIN = '<!-- BEGIN {id} -->';
-const BLOCK_END = '<!-- END {id} -->';
-
-function delimiters(blockId) {
-  return [BLOCK_BEGIN.replace('{id}', blockId), BLOCK_END.replace('{id}', blockId)];
-}
+const delimiters = (blockId) => [`<!-- BEGIN ${blockId} -->`, `<!-- END ${blockId} -->`];
 
 /**
  * `_build_settings._managed_block_write` — 'created' | 'updated' | 'merged'.
@@ -1141,7 +1251,7 @@ function delimiters(blockId) {
  */
 export function managedBlockWrite(p, content, blockId = 'GENESEED') {
   const [begin, end] = delimiters(blockId);
-  const block = `${begin}\n${stripEnd(content)}\n${end}\n`;
+  const block = `${begin}\n${stripWhitespaceEnd(content)}\n${end}\n`;
   if (!existsSync(p)) {
     mkdirSync(path.dirname(p), { recursive: true });
     writeText(p, block);
@@ -1171,7 +1281,7 @@ export function managedBlockRemove(p, blockId = 'GENESEED', whole = false) {
   if (!existing.includes(begin) || !existing.includes(end)) return;
   const pre = existing.split(begin)[0];
   const post = existing.slice(existing.indexOf(end) + end.length);
-  const rest = stripEnds(`${stripTrailingNewlines(pre)}\n${lstripNewlines(post)}`);
+  const rest = stripWhitespace(`${stripTrailingNewlines(pre)}\n${lstripNewlines(post)}`);
   if (rest) writeText(p, `${rest}\n`);
   else unlinkSync(p);
 }
@@ -1186,25 +1296,6 @@ export function managedBlockRead(p, blockId = 'GENESEED') {
   return stripNewlines(inner.slice(0, inner.indexOf(end)));
 }
 
-// `str.strip()` and friends. JS's `trim()` is NOT `strip()`, and the difference runs both
-// ways: `trim()` eats U+FEFF, which Python does not strip, and Python strips U+0085 and
-// U+001C–U+001F, which `trim()` leaves. A managed block is user-editable prose in a file
-// Geneseed shares with the user, so the set is spelled out rather than approximated — and
-// spelled with escapes, never literals: a raw U+2028 in a JS source file ends the line.
-const WHITESPACE = '[\t\n\v\f\r\x1c-\x1f \x85\xa0\u1680\u2000-\u200a'
-  + '\u2028\u2029\u202f\u205f\u3000]';
-
-const RSTRIP_RE = new RegExp(`${WHITESPACE}+$`);
-const LSTRIP_RE = new RegExp(`^${WHITESPACE}+`);
-
-function stripEnd(s) {
-  return s.replace(RSTRIP_RE, '');
-}
-
-function stripEnds(s) {
-  return s.replace(LSTRIP_RE, '').replace(RSTRIP_RE, '');
-}
-
 function lstripNewlines(s) {
   return s.replace(/^\n+/, '');
 }

package/js/inspect/checks-authoring.mjs

@@ -411,7 +411,8 @@ export function constitutionProblems() {
     try { text = readText(path.join(dir, `${pack}.md`)); } catch { continue; }
     for (const [, key] of text.matchAll(DOC_TOKEN_RE)) wanted.add(key);
   }
-  const lexWant = ['I', 'II', 'III', 'IV', 'V', 'VI', 'VII', 'VIII', 'IX'].map((r) => `LEX_${r}`);
+  const lexWant = ['I', 'II', 'III', 'IV', 'V', 'VI', 'VII', 'VIII', 'IX', 'X', 'XI']
+    .map((r) => `LEX_${r}`);
   // `_TEMPLATE.json` is included — it is the file `--sync-themes` seeds a new theme from, so a
   // stale key there propagates into every voice added afterwards. `themeFiles()` excludes it.
   const files = [...themeFiles(), path.join(THEMES, '_TEMPLATE.json')];
@@ -443,11 +444,11 @@ export function constitutionProblems() {
     const stale = lex.filter((k) => !lexWant.includes(k));
     const missing = lexWant.filter((k) => !lex.includes(k));
     for (const k of stale) {
-      problems.push(`[authoring] ${name} still defines {${k}} — the invariants are I..IX and `
-        + 'nothing renders this key, so it is a title for a rule that no longer exists');
+      problems.push(`[authoring] ${name} still defines {${k}} — no law heading carries this `
+        + 'numeral and nothing renders this key, so it is a title for a rule that no longer exists');
     }
     for (const k of missing) {
-      problems.push(`[authoring] ${name} has no {${k}} — one of the nine invariants would `
+      problems.push(`[authoring] ${name} has no {${k}} — one of the invariants would `
         + 'render with an empty title');
     }
     // M10 — ⚠ BOTH HEADING PARSERS MATCH THE TIER NOUN WITH `\S+`. A two-word value does not

package/js/inspect/checks-build.mjs

@@ -217,7 +217,7 @@ export function renderedProblems(bundle) {
       // The OpenCode emits de-link AGENT.md's per-row table entries after rendering, so the
       // bundle on disk legitimately differs from `renderAll`'s output for this one file.
       const text = host === 'opencode' && outRel === 'AGENT.md'
-        ? stripCapabilityLinks(cfg, rendered) : rendered;
+        ? stripCapabilityLinks(rendered) : rendered;
       if (readText(dest) !== text) {
         problems.push(`[rendered] ${name}/${outRel} stale (differs from a fresh render) `
           + '— rebuild');

package/js/inspect/diff.mjs

@@ -47,11 +47,9 @@ import {
   readJsonMaybe, readMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
 import { unifiedDiff, splitLines } from '../lib/udiff.mjs';
-import { printOut, printErr, readText, writeText } from '../lib/fs.mjs';
+import { printOut, printErr, readText, writeText, isFile } from '../lib/fs.mjs';
 import { toPlatformPath } from '../lib/paths.mjs';
 
-const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
-
 /**
  * `_harness_core._T0` — this process's start, in epoch seconds.
  *