geneseed 3.12.0 → 3.14.0

package/js/maintain/uninstall.mjs

@@ -47,31 +47,28 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 
-import { hookRunnerEntry } from '../build/driver.mjs';
+import { hookRunnerEntry } from '../hosts/shim.mjs';
 import { confirm } from './setup.mjs';
 import {
   claudeCfg, claudeReadManifest, doctrinesOfDir, emitHostScopeOf, excludedRulesOfDir, installKind,
   installState,
-  registeredTargets, readMaybe, DISABLED_STASH,
+  registeredTargets, DISABLED_STASH,
 } from '../hosts/installs.mjs';
 import {
-  GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
+  CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
-import { mcpCommented } from '../hosts/mcp.mjs';
+import { mcpCommented, mcpLoad } from '../hosts/mcp.mjs';
 import {
-  managedBlockRead, managedBlockRemove, managedBlockWrite,
-  mergeClaudeSettings, opencodeTarget, readJsonc,
+  atomicWriteJson, managedBlockRead, managedBlockRemove, managedBlockWrite,
+  loadJsonObject, mergeClaudeSettings, opencodeTarget,
   settingsIntegrityCheck, wireClaudeExcludes, unwireClaudeExcludes, unwireClaudeSettings,
 } from '../hosts/settings.mjs';
 import { printOut, printErr, readText, writeText, isFile, isDir, isOsError } from '../lib/fs.mjs';
-import { indexOfDeepEqual, jsonDumps, jsonDumpsIndent, deepEquals } from '../lib/json.mjs';
+import { indexOfDeepEqual, isDict, jsonDumps, deepEquals } from '../lib/json.mjs';
 import { comparePaths, isAbsolutePath, within } from '../lib/paths.mjs';
 
 const hostSpec = (host) => HOSTS.find((h) => h.host === host);
 
-/** The Claude-STYLE hosts — one manifest shape, one reversal. Spelled once. */
-const CLAUDE_STYLE = ['claude', 'bob', 'openclaude'];
-
 /**
  * `shutil.rmtree(p, ignore_errors=True)`.
  *
@@ -154,11 +151,15 @@ function pruneAncestors(start, stop) {
  * failure strings) differ in the root and in the label, which are the two arguments. The
  * `victim.is_file()` guard is load-bearing rather than defensive: a manifest entry naming a
  * directory is SKIPPED, not recursed into, and `removed` counts only what actually went.
+ *
+ * `ownedWithin` first, the same containment boundary deactivate draws: the manifest is a file
+ * on disk, and without it an `owned` entry of `../../.bashrc` was unlinked — and the prune
+ * then climbed from ITS parent, which never meets `base`, removing empty directories as it went.
  */
 function unlinkOwned(base, owned, label = '') {
   let removed = 0;
   const failed = [];
-  for (const rel of owned) {
+  for (const rel of ownedWithin(base, owned)) {
     const victim = path.join(base, rel);
     try {
       if (isFile(victim)) {
@@ -177,6 +178,23 @@ function unlinkOwned(base, owned, label = '') {
   return [removed, failed];
 }
 
+/**
+ * The manifest rels that resolve INSIDE `base` — the one security boundary every walk over
+ * `owned` goes through (uninstall, both deactivates).
+ *
+ * `path.resolve(rroot, r)` and NOT `path.join`, which is the one line here that is a security
+ * boundary rather than a translation. The Python is `(rroot / r).resolve()`, and pathlib's
+ * `/` REPLACES the base when the right operand is absolute — so a manifest entry naming
+ * `C:/evil.md` resolves outside the root and `_within` rejects it. `path.join` would have
+ * concatenated it into `<root>/C:/evil.md`, which passes containment and would then be acted
+ * on. `path.resolve` has pathlib's semantics for exactly this case, and collapses `..`
+ * besides, which is why the guard runs on the resolved path rather than the lexical one.
+ */
+function ownedWithin(base, rels) {
+  const rroot = resolvePath(base);
+  return rels.filter((r) => r && within(resolvePath(path.resolve(rroot, r)), rroot));
+}
+
 /** The two WARNs every reversal prints when an owned file survives. Identical in all three. */
 function warnSurvivors(failed) {
   printErr('[uninstall] WARN: could not remove '
@@ -203,13 +221,9 @@ const REVERSAL_MARKERS = [GLOBAL_MANIFEST, '.geneseed-theme', '.geneseed-emit',
  */
 export function unmergeOpencodeJson(p, entry) {
   const target = opencodeTarget(p);
-  if (!existsSync(target)) return false;
-  let cfg;
-  let hadComments;
-  const text = readMaybe(target);
-  if (text === null) return false;             // the Python's `except OSError: return False`
-  [cfg, hadComments] = readJsonc(text);
-  if (cfg === null || typeof cfg !== 'object' || Array.isArray(cfg)) return false;
+  // Absent, unreadable (the Python's `except OSError: return False`) or not an object: decline.
+  const { state, data: cfg, hadComments } = loadJsonObject(target);
+  if (state !== 'ok') return false;
   const instr = cfg.instructions;
   if (!Array.isArray(instr) || !instr.includes(entry)) return false;
   if (path.extname(target) === '.jsonc' && hadComments) {
@@ -218,7 +232,7 @@ export function unmergeOpencodeJson(p, entry) {
     return false;
   }
   cfg.instructions = instr.filter((i) => i !== entry);
-  writeText(target, `${jsonDumpsIndent(cfg)}\n`);
+  atomicWriteJson(target, cfg);
   return true;
 }
 
@@ -269,8 +283,7 @@ function claudeMdPath(cfg, managed) {
 
 /** A manifest's `managed` map, or `{}` — the Python's `isinstance(..., dict)` guard. */
 function managedOf(man) {
-  const mg = man.managed;
-  return typeof mg === 'object' && mg !== null && !Array.isArray(mg) ? mg : {};
+  return isDict(man.managed) ? man.managed : {};
 }
 
 /** A manifest's `owned` list, or `[]`. */
@@ -339,22 +352,6 @@ export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
   return { removed, unmerged, archived, failed };
 }
 
-/**
- * `_harness_mcp._mcp_load`, reduced to the OpenCode arm.
- *
- * The Claude arm (`.mcp.json`, `~/.claude.json`, parsed STRICTLY — see `mcpLoad` in
- * js/hosts/mcp.mjs for why) lives with the MCP catalog. `installAgentEntry` is this port's only caller and passes
- * no host, so porting the branch would ship an unreachable arm with no cell and no partition
- * to be part of — the criterion this port decides keep-vs-delete by.
- */
-function mcpLoadOpencode(p) {
-  if (!existsSync(p)) return {};
-  const text = readMaybe(p);
-  if (text === null) return {};
-  const [data] = readJsonc(text);
-  return typeof data === 'object' && data !== null && !Array.isArray(data) ? data : {};
-}
-
 /**
  * `_harness_mcp._install_agent_entry` — the `instructions` entry to drop.
  *
@@ -367,7 +364,7 @@ export function installAgentEntry(root, kind) {
   if (kind === 'global') {
     return path.join(root, 'AGENT.md').split(path.sep).join('/');
   }
-  const cfg = mcpLoadOpencode(opencodeTarget(path.join(root, 'opencode.json')));
+  const cfg = mcpLoad(opencodeTarget(path.join(root, 'opencode.json')));
   return installAgentEntryOf(cfg.instructions);
 }
 
@@ -645,22 +642,6 @@ function printOtherHostHits(root, removedHost) {
   }
 }
 
-/**
- * `_harness_setup._confirm`, and the only interactive read this verb makes.
- *
- * MOVED TO `js/maintain/setup.mjs` IN P5i, where the Python's own owner is: `_confirm` lives in
- * `_harness_setup` beside the `_ask` it is built on, and `setup` is its second caller. The
- * body stayed here for one phase because a helper with one caller is not shared yet; the
- * rule this port uses is that the SECOND owner is what moves it, and a byte gate is what
- * licenses the move.
- *
- * UNREACHABLE FROM EVERY CELL, restated because moving it does not change that: `cmdUninstall`
- * only reaches it when stdin is a TTY, and the harness gives every cell a pipe. What the
- * cells DO gate is the branch beside it — the non-interactive refusal — which is why that one
- * has an `expect` naming its wording. It is now gated positively too, by the stdin-seeded
- * corpus P5i added for the wizard.
- */
-
 /**
  * `_harness_mcp.cmd_uninstall`.
  *
@@ -690,7 +671,7 @@ export function cmdUninstall(args) {
   const data = installDataDir(root, host, scope);
   const stores = ['memory', 'notebook'].filter((n) => isDir(path.join(data, n)));
   printOut(`[uninstall] target: ${root} (${host}:${scope})\n`);
-  if (['claude', 'bob', 'openclaude'].includes(host)) {
+  if (CLAUDE_STYLE.includes(host)) {
     printOut('[uninstall] removes: agents/, skills/, markers, the '
       + `${hostSpec(host).agentFile} managed block, and Geneseed's `
       + 'settings.json hooks/excludes (your own keys/hooks are kept).\n');
@@ -810,17 +791,7 @@ function installRelive(root) {
   return isFile(path.join(root, 'AGENT.md'));
 }
 
-/**
- * `_harness_mcp._install_move_list` — the rels to move aside, `_within`-guarded.
- *
- * `path.resolve(rroot, r)` and NOT `path.join`, which is the one line here that is a security
- * boundary rather than a translation. The Python is `(rroot / r).resolve()`, and pathlib's
- * `/` REPLACES the base when the right operand is absolute — so a manifest entry naming
- * `C:/evil.md` resolves outside the root and `_within` rejects it. `path.join` would have
- * concatenated it into `<root>/C:/evil.md`, which passes containment and would then be MOVED.
- * `path.resolve` has pathlib's semantics for exactly this case, and collapses `..` besides,
- * which is why the guard runs on the resolved path rather than the lexical one.
- */
+/** `_harness_mcp._install_move_list` — the rels to move aside, `ownedWithin`-guarded. */
 function installMoveList(root, kind) {
   let rels;
   if (kind === 'project') {
@@ -828,8 +799,7 @@ function installMoveList(root, kind) {
   } else {
     rels = ownedOf(claudeReadManifest(root)).filter((r) => r !== VERSION_MARKER);
   }
-  const rroot = resolvePath(root);
-  return rels.filter((r) => r && within(resolvePath(path.resolve(rroot, r)), rroot));
+  return ownedWithin(root, rels);
 }
 
 /**
@@ -844,16 +814,11 @@ function installMoveList(root, kind) {
  */
 function installReaddEntry(target, entry) {
   if (!existsSync(target)) {
-    mkdirSync(path.dirname(target), { recursive: true });
-    writeText(target, `${jsonDumpsIndent({
-      $schema: 'https://opencode.ai/config.json', instructions: [entry],
-    })}\n`);
+    atomicWriteJson(target, { $schema: 'https://opencode.ai/config.json', instructions: [entry] });
     return true;
   }
-  let raw;
-  try { raw = readText(target); } catch { return false; }   // except OSError
-  const [cfg, hadComments] = readJsonc(raw);
-  if (typeof cfg !== 'object' || cfg === null || Array.isArray(cfg)) return false;
+  const { state, data: cfg, hadComments } = loadJsonObject(target);
+  if (state !== 'ok') return false;            // unreadable (except OSError), or not an object
   const instr = Array.isArray(cfg.instructions) ? cfg.instructions : [];
   if (indexOfDeepEqual(instr, entry) >= 0) return false;
   if (path.extname(target) === '.jsonc' && hadComments) {
@@ -862,7 +827,7 @@ function installReaddEntry(target, entry) {
     return false;
   }
   cfg.instructions = [...instr, entry];
-  writeText(target, `${jsonDumpsIndent(cfg)}\n`);
+  atomicWriteJson(target, cfg);
   return true;
 }
 
@@ -1067,16 +1032,14 @@ function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   const excluded = excludedRulesOfDir(root).length ? excludedRulesOfDir(root)
     : excludedRulesOfDir(cfg);
   // `host` reaches the group builder: a Bob reactivate must re-wire Gemini-named groups.
-  const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed), 'global',
+  const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed),
     managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!deepEquals(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;
     data.managed = managed;
-    const tmp = path.join(cfg, `${GLOBAL_MANIFEST}.tmp`);
     try {
-      writeText(tmp, `${jsonDumpsIndent(data)}\n`);
-      renameSync(tmp, path.join(cfg, GLOBAL_MANIFEST));
+      atomicWriteJson(path.join(cfg, GLOBAL_MANIFEST), data);
     } catch { /* except OSError: pass */ }
   }
 }
@@ -1093,9 +1056,7 @@ function claudeDeactivate(root, scope = 'global', host = 'claude') {
   const man = claudeReadManifest(cfg);
   const managed = managedOf(man);
   const stash = path.join(cfg, DISABLED_STASH, host);
-  const rroot = resolvePath(cfg);
-  const rels = ownedOf(man).filter((r) => r && r !== VERSION_MARKER
-    && within(resolvePath(path.resolve(rroot, r)), rroot));
+  const rels = ownedWithin(cfg, ownedOf(man).filter((r) => r !== VERSION_MARKER));
   const { done, failed } = moveAll(cfg, stash, rels);
   if (failed) {
     cleanHostStash(cfg, host);
@@ -1129,9 +1090,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
   const stash = path.join(cfg, DISABLED_STASH, host);
   const blockFile = path.join(stash, '_claude_md_block.txt');
   const reliveManifest = claudeReadManifest(cfg);
-  // `.get("managed") or {}` — an `or`, not an isinstance guard, and the difference is
-  // observable on a manifest whose `managed` is `null`.
-  const reliveManaged = reliveManifest.managed || {};
+  const reliveManaged = managedOf(reliveManifest);
   let relive = managedBlockRead(claudeMdPath(cfg, reliveManaged)) !== null;
   // Bob GLOBAL writes no managed AGENTS.md block — its preamble carrier is the owned
   // `rules/geneseed.md`, so a live copy of THAT is the relive signal there. Without this arm
@@ -1149,7 +1108,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
   }
   const { leftovers, moved } = restoreAll(stash, cfg, '_claude_md_block.txt');
   if (leftovers.length) return { ok: false, failed: leftovers, moved };
-  const managed = claudeReadManifest(cfg).managed || {};
+  const managed = managedOf(claudeReadManifest(cfg));
   // ⚠ THE CARRIER IS RESTORED BEFORE THE HOOKS ARE RE-MERGED, AND THE ORDER IS LOAD-BEARING.
   // `remergeClaudeHooks` reads the install's pack selection back off the carrier, and on a
   // Claude-style host that selection lives inside the MANAGED BLOCK — which the deactivate

package/js/ui/cli.mjs

@@ -429,18 +429,6 @@ export function cliCommand(verb) {
   return (load().commands ?? []).find((c) => c.name === verb) ?? null;
 }
 
-/**
- * `<verb> --help` for whichever binary asked, or `null` for a verb the table does not
- * describe — the caller already owns that refusal and its message.
- *
- * ONE OWNER FOR TWO ENTRIES. `bin/geneseed-hook.mjs` carries the four hook verbs and
- * `bin/geneseed-cli.mjs` the rest of the table, and
- * `test_the_two_entry_points_carry_disjoint_verb_sets` keeps them from learning each other's
- * tables — so the help each prints has to come from here rather than from a copy in each.
- *
- * CRLF ON WINDOWS for `die`'s reason: argparse writes through a Python text stream, which
- * translates, and this text lands in the same terminals and the same pipes as that one.
- */
 /**
  * `geneseed --help` — every verb with its one-line help, from the same table the per-verb help
  * reads. `verbs` is the entry's own dispatch list, so the listing can name nothing the entry
@@ -460,6 +448,18 @@ export function printVerbList(prog, verbs, extra = {}) {
   return 0;
 }
 
+/**
+ * `<verb> --help` for whichever binary asked, or `null` for a verb the table does not
+ * describe — the caller already owns that refusal and its message.
+ *
+ * ONE OWNER FOR TWO ENTRIES. `bin/geneseed-hook.mjs` carries the four hook verbs and
+ * `bin/geneseed-cli.mjs` the rest of the table, and
+ * `test_the_two_entry_points_carry_disjoint_verb_sets` keeps them from learning each other's
+ * tables — so the help each prints has to come from here rather than from a copy in each.
+ *
+ * CRLF ON WINDOWS for `die`'s reason: argparse writes through a Python text stream, which
+ * translates, and this text lands in the same terminals and the same pipes as that one.
+ */
 export function printHelp(prog, verb) {
   const cmd = cliCommand(verb);
   if (cmd === null) return null;

package/js/web/actions.mjs

@@ -27,7 +27,7 @@
  */
 import { spawn } from 'node:child_process';
 import {
-  accessSync, constants, copyFileSync, mkdirSync, mkdtempSync, rmSync, unlinkSync,
+  accessSync, constants, copyFileSync, mkdirSync, mkdtempSync, realpathSync, rmSync, unlinkSync,
 } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -40,9 +40,10 @@ import { withStdoutSwallowed } from '../inspect/diff.mjs';
 import { excludeAdd, excludeRemove } from '../inspect/excludes.mjs';
 import { setupBuildArgs } from '../build/generate.mjs';
 import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
-import { frontmatter, memoryDropIndex } from '../hosts/hooks.mjs';
+import { activeLoops, setLoopPreset } from '../loop/registry.mjs';
+import { frontmatter, memoryDropIndex } from '../hosts/memory-files.mjs';
 import {
-  HOSTS, bobConfigDir, claudeConfigDir, expanduser, openclaudeConfigDir,
+  CLAUDE_STYLE, HOSTS, bobConfigDir, claudeConfigDir, expanduser, openclaudeConfigDir,
   opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
 import {
@@ -56,6 +57,7 @@ import {
 import { readText, writeText, isFile, isDir } from '../lib/fs.mjs';
 import { parseJson, formatRepr, formatValue, isTruthy } from '../lib/json.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
+import { normcase } from '../lib/paths.mjs';
 import { WHITESPACE, codePointLength, stripWhitespace } from '../lib/text.mjs';
 import { installDeactivate, installReactivate, installUninstall } from '../maintain/uninstall.mjs';
 import { splitLines } from '../lib/udiff.mjs';
@@ -577,6 +579,36 @@ export function apiExcludesMutate(state, body) {
   return action === 'add' ? excludeAdd(p) : excludeRemove(p);
 }
 
+// ---- loop preset picker ---------------------------------------------------------------------
+
+/**
+ * The Active tab's one write: rewrite a registered worktree's `LOOP.md` `preset` field.
+ * `POST /api/loops/preset` makes two refusals — a `preset` outside `PRESETS` and a `root` that is
+ * not a running registered loop (no arbitrary path writes) — and both are decided HERE, as the
+ * `NotFound` every other mutating route answers in, so the handler's catch (`4xx`, not the 500 a
+ * bare `Error` would fall to) covers this route the way it covers `apiRulesMutate`'s unknown id.
+ *
+ * DECIDED, NOT RECOGNISED. This route used to call `setLoopPreset` and sort its throws by their
+ * MESSAGE text, so rewording an error in `js/loop/registry.mjs` would have turned a 404 into a
+ * 500 with no test of this file noticing. "Running" is `activeLoops`' word for it — registered,
+ * still a directory, `LOOP.md` present (a corrupt one included, so that it reaches the parse and
+ * fails there) — matched on the root the registry stores, which is the realpath. The preset is
+ * checked first: `activeLoops` may prune the registry, and a refused preset must touch nothing
+ * (`tests/unit/web_server.test.mjs` probes this route against the real machine's registry).
+ * Anything `setLoopPreset` still throws, a corrupt `LOOP.md` above all, is a 500.
+ */
+export function apiLoopsPresetMutate(state, body) {
+  const root = strOr(bget(body, 'root'));
+  const preset = strOr(bget(body, 'preset'));
+  if (!Object.hasOwn(PRESETS, preset)) throw new NotFound(`unknown preset ${JSON.stringify(preset)}`);
+  let key;
+  try { key = realpathSync.native(root); } catch { key = path.resolve(root); }
+  const running = root && activeLoops().some((l) => l.status !== 'finished'
+    && normcase(l.root) === normcase(key));
+  if (!running) throw new NotFound('unknown loop');
+  return { ok: true, loop: setLoopPreset(root, preset) };
+}
+
 // ---- MCP ----------------------------------------------------------------------------------
 
 export function apiMcp() {
@@ -645,7 +677,7 @@ export function apiMcpToggle(state, body) {
     return { ok: false, error: 'config holds comments — edit it by hand to keep them' };
   }
   let cfg;
-  if (['claude', 'bob', 'openclaude'].includes(host)) {
+  if (CLAUDE_STYLE.includes(host)) {
     if (isFile(p)) {
       let parsed;
       try {
@@ -786,6 +818,9 @@ export function apiRestore(state, files) {
       // behind it — prompt and boundary disagreeing by a WRITE, the write-side twin of the
       // read-side hole `diffCollect` had (and the reason the panel offered the file at all).
       doctrines: doctrinesForBuild(target),
+      // The excluded rules for the same boundary reason: without them a restored AGENT.md
+      // re-states a rule whose hook gate the install deliberately left unwired.
+      excludeRules: excludedRulesOfDir(target),
     }));
     for (const raw of (isTruthy(files) ? files : [])) {
       const rel = stripWhitespace(formatValue(raw).replace(/\\/g, '/')).replace(/^\/+/, '');

package/js/web/api.mjs

@@ -18,15 +18,16 @@ import { sourceReleaseVersion } from '../hosts/opencode.mjs';
 import { diffCollect } from '../inspect/diff.mjs';
 import { doctorCollect } from '../inspect/doctor.mjs';
 import { excludesSnapshot } from '../inspect/excludes.mjs';
-import { GLOBAL_MANIFEST, HOSTS, opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
+import { CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
 import {
   doctrinesForBuild, excludedRulesOfDir, footprintOfDir, installState, installTargets,
   installedDefaults, modeOfDir, trustOfDir,
   postureOfDir, readJsonMaybe, readMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
-import { frontmatter } from '../hosts/hooks.mjs';
+import { frontmatter } from '../hosts/memory-files.mjs';
 import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
 import { loadCatalog, catalogProblems } from '../loop/catalog.mjs';
+import { activeLoops } from '../loop/registry.mjs';
 import {
   SKILL_CLASS, entityStatus, loadRegistry, tuiInventory,
 } from '../inspect/inventory.mjs';
@@ -98,10 +99,15 @@ export function webState(theme = null, target = null) {
   st.root = st.target;
   st.theme = theme || themeOfDir(st.target) || 'neutral';
   st.emit = installedDefaults().emit || 'opencode-global';
-  st.footprint = footprintOfDir(st.target);      // 'full' when no marker
-  st.posture = postureOfDir(st.target) || 'peer';
-  st.mode = modeOfDir(st.target) || 'direct';
-  st.trust = trustOfDir(st.target) || DEFAULT_PRESET;
+  // The install's sigils, each defaulted when its marker is absent (footprint to 'full').
+  // Read from the ROOT, where every emit writes them.
+  const readMarkers = () => {
+    st.footprint = footprintOfDir(st.root);
+    st.posture = postureOfDir(st.root) || 'peer';
+    st.mode = modeOfDir(st.root) || 'direct';
+    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
+  };
+  readMarkers();
 
   Object.defineProperty(st, 'inventory', {
     get() {
@@ -155,10 +161,7 @@ export function webState(theme = null, target = null) {
     st.root = root || target;
     st.theme = themeOfDir(st.root) || themeOfDir(st.target) || 'neutral';
     st.emit = st.detectEmit();
-    st.footprint = footprintOfDir(st.root);
-    st.posture = postureOfDir(st.root) || 'peer';
-    st.mode = modeOfDir(st.root) || 'direct';
-    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
+    readMarkers();
     st._inv = null;
     st._doctor = null;
   };
@@ -167,10 +170,7 @@ export function webState(theme = null, target = null) {
     st._doctor = null;
     st.theme = themeOfDir(st.root) || themeOfDir(st.target) || st.theme;
     st.emit = st.detectEmit() || st.emit;
-    st.footprint = footprintOfDir(st.root);
-    st.posture = postureOfDir(st.root) || 'peer';
-    st.mode = modeOfDir(st.root) || 'direct';
-    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
+    readMarkers();
   };
   return st;
 }
@@ -731,7 +731,7 @@ export const apiExcludes = () => excludesSnapshot();
  * nested-marker host cannot silently read the bare root.
  */
 export function viewCfg(host, scope, root) {
-  if (scope === 'project' && ['claude', 'bob', 'openclaude'].includes(host)) {
+  if (scope === 'project' && CLAUDE_STYLE.includes(host)) {
     return path.join(root, HOSTS.find((h) => h.host === host).projectMarker);
   }
   return root;
@@ -799,13 +799,11 @@ export function apiOverview(state) {
     buildEpoch = Math.floor(ms / 1000);
   }
   // Which detected install the current view points at, so the dashboard's footprint hero
-  // can re-emit exactly it. Mirrors `viewCfg`'s rule, spelled out separately here.
+  // can re-emit exactly it.
   let install = null;
   for (const [host, scope, root] of installTargets()) {
-    const data = (scope === 'project' && ['claude', 'bob', 'openclaude'].includes(host))
-      ? path.join(root, HOSTS.find((h) => h.host === host).projectMarker) : root;
     try {
-      if (samePath(data, state.target)) {
+      if (samePath(viewCfg(host, scope, root), state.target)) {
         install = { host, scope, path: root, footprint: footprintOfDir(root) };
         break;
       }
@@ -953,7 +951,9 @@ export function apiRecent(state) {
  * layout needs `nodes`, `edges` and `loops` exactly as the engine reads them.
  */
 export function apiLoops(state) {
-  const { bricks, templates, overridden } = loadCatalog({ projectRoot: state.root });
+  const opts = { projectRoot: state.root };
+  const catalog = loadCatalog(opts);
+  const { bricks, templates, overridden } = catalog;
   const byName = ([a], [b]) => (a < b ? -1 : 1);
   return {
     templates: [...templates].sort(byName).map(([name, { origin, ...graph }]) => ({
@@ -964,10 +964,22 @@ export function apiLoops(state) {
     // A brick or template the catalogue skipped (bad frontmatter, not JSON, misnamed), and a
     // template that fails the graph rules: the page says so — the same list `loop check`
     // prints — or a team's broken override would just silently not be there.
-    problems: catalogProblems({ projectRoot: state.root }),
+    // The catalogue already loaded above, not a second read of every brick and template.
+    problems: catalogProblems(opts, catalog),
   };
 }
 
+/**
+ * The Active tab's read: every worktree `geneseed loop init` has registered, with its live
+ * `LOOP.md` state re-read on every call (`activeLoops` itself, not a cached copy — the registry
+ * stores identity only, see `js/loop/registry.mjs`). Takes no `state`-derived filtering: the
+ * registry is machine-wide, not scoped to this install's root, so a loop launched from a
+ * different project still shows up here.
+ */
+export function apiLoopsActive() {
+  return { loops: activeLoops() };
+}
+
 /** The source's release label, or null when it cannot be read. */
 function releaseLabel() {
   const v = sourceReleaseVersion({ config: CONFIG });
@@ -1018,4 +1030,5 @@ export const STATE_ROUTES = {
   '/api/rules': apiRules,
   '/api/mcp': apiMcp,
   '/api/loops': apiLoops,
+  '/api/loops/active': apiLoopsActive,
 };