geneseed 3.13.0 → 3.14.0

package/js/loop/registry.mjs

@@ -7,7 +7,8 @@
  * WRITER CONVENTIONS, mirrored from `js/inspect/registry.mjs` (`installs.json`'s own registry)
  * on purpose rather than invented fresh: `jsonDumpsIndent` because these rows are absolute
  * paths and a username carrying an accent writes one here (ensure_ascii matters); a
- * `<file>.tmp` + `renameSync` so a crash mid-write cannot leave `loops.json` half-written where
+ * `<file>.tmp` + `renameWithRetry` (LOOP.md's own atomic rename, retried on a transient Windows
+ * lock) so a crash mid-write cannot leave `loops.json` half-written where
  * the NEXT read would see valid-but-truncated JSON instead of either the old file or the new
  * one; and every public function swallows its own errors — a registry hiccup must never fail
  * `loop init`, and a corrupt `loops.json` must read back as empty rather than throw. The one
@@ -28,20 +29,20 @@
  * re-`init`ed) clears it, so a stale finished-window never survives into a loop that is running
  * again.
  *
- * `recordLoop` and `activeLoops`/`setLoopPreset` never call each other's normalisation by
- * accident: both resolve a root through `realpathSync.native` (falling back to `path.resolve`
- * for a root that no longer exists) and compare with `normcase` — the same case-folding
- * `js/lib/paths.mjs` uses everywhere a Windows path is compared — so a loop launched from a
- * differently-cased spelling of the same worktree is still one row, not two.
+ * `recordLoop` and `setLoopPreset` resolve the root they are given the same way — `normalize`:
+ * `realpathSync.native`, falling back to `path.resolve` for a root that no longer exists — and
+ * compare it with `normcase`, the same case-folding `js/lib/paths.mjs` uses everywhere a Windows
+ * path is compared, so a loop launched from a differently-cased spelling of the same worktree is
+ * still one row, not two. `activeLoops` compares nothing: it reads each row's root as stored.
  */
-import { readFileSync, mkdirSync, realpathSync, renameSync } from 'node:fs';
+import { readFileSync, mkdirSync, realpathSync } from 'node:fs';
 import path from 'node:path';
 
 import { userLoopsDir } from './catalog.mjs';
 import { writeText, readText, isDir, isFile } from '../lib/fs.mjs';
 import { parseJson, jsonDumpsIndent } from '../lib/json.mjs';
 import { normcase } from '../lib/paths.mjs';
-import { parseLoopFile, writeLoopFile, LOOP_FILE } from './state.mjs';
+import { parseLoopFile, writeLoopFile, renameWithRetry, reviewOf, LOOP_FILE } from './state.mjs';
 import { PRESETS } from './score.mjs';
 
 const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
@@ -65,7 +66,7 @@ function save(loops) {
     mkdirSync(path.dirname(file), { recursive: true });
     const tmp = `${file}.tmp`;
     writeText(tmp, `${jsonDumpsIndent({ loops })}\n`);
-    renameSync(tmp, file);
+    renameWithRetry(tmp, file);
   } catch {
     /* best-effort: a registry hiccup must never fail init or a read */
   }
@@ -77,12 +78,6 @@ function normalize(dir) {
 
 const sameRoot = (a, b) => normcase(a) === normcase(b);
 
-/** The soft-decision iterations of `state.history` — the same shape `state.mjs`'s own
- * end-of-run `summary()` reports, so a card and a finished-loop review read the same fields. */
-function reviewOf(state) {
-  return state.history.filter((h) => h.decision === 'soft').map((h) => ({ iteration: h.iteration, intent: h.intent }));
-}
-
 function runningRow(entry, state) {
   return {
     root: entry.root, branch: entry.branch, title: entry.title, started: entry.started,

package/js/loop/score.mjs

@@ -29,7 +29,7 @@ export const PRESETS = Object.freeze({
 export const DEFAULT_PRESET = 'balanced';
 
 /** More deleted lines than this in one iteration counts as a code deletion. */
-export const DELETION_LINES = 20;
+const DELETION_LINES = 20;
 
 const RANK = { silent: 0, soft: 1, blocking: 2 };
 

package/js/loop/state.mjs

@@ -43,9 +43,9 @@ import { iterationLoop, ENGINE_MAX_ITERATIONS } from './graph.mjs';
 
 const BEGIN = '<!-- loop-state:begin -->';
 const END = '<!-- loop-state:end -->';
-export const VERIFY_COMMAND = 'git add -A && git diff --cached --numstat | geneseed loop score --diff';
+const VERIFY_COMMAND = 'git add -A && git diff --cached --numstat | geneseed loop score --diff';
 export const LOOP_FILE = 'LOOP.md';
-export const LOOP_FILE_TMP = `${LOOP_FILE}.tmp`;
+const LOOP_FILE_TMP = `${LOOP_FILE}.tmp`;
 const slash = (p) => String(p).replaceAll('\\', '/');
 
 export function renderLoopFile(state) {
@@ -101,7 +101,11 @@ export function parseLoopFile(text) {
 const head = (state) => iterationLoop(state.graph).nodes[0];
 const fmt = (n) => Number(n).toFixed(1);
 
-/** `contracts`: extra globs (`loop init --contracts`), appended after the graph's own. */
+/**
+ * `contracts`: extra globs (`loop init --contracts`), appended after the graph's own. Every
+ * field the engine ever writes is listed here, `gateAmends` included (`decideGate` still reads
+ * it with `?.`, for a LOOP.md written before it was listed).
+ */
 export function initState({ title, requirement, graph, preset = DEFAULT_PRESET, contracts = [] }) {
   if (!Object.hasOwn(PRESETS, preset)) throw new Error(`unknown preset ${JSON.stringify(preset)}`);
   const loop = iterationLoop(graph);
@@ -111,7 +115,7 @@ export function initState({ title, requirement, graph, preset = DEFAULT_PRESET,
     iteration: loop.nodes.includes(graph.start) ? 1 : 0,
     card: null, validated: false, pendingVerify: false, closing: false, counters: {},
     resplit: false, emptyStreak: 0, snapshot: '', visited: [], tests: 'n/a', current: {},
-    notes: [], history: [],
+    notes: [], history: [], gateAmends: {},
   };
   if (preset === 'prudent') { state.status = 'awaiting'; state.awaiting = { kind: 'launch' }; }
   return state;
@@ -127,12 +131,14 @@ function resetUnit(state) {
   state.current = {}; state.tests = 'n/a';
 }
 
+/** The soft-decision iterations of `state.history` — what the end-of-run summary and the
+ * registry's Active-tab row both call `review`, so the two read the same fields. */
+export function reviewOf(state) {
+  return state.history.filter((h) => h.decision === 'soft').map((h) => ({ iteration: h.iteration, intent: h.intent }));
+}
+
 function summary(state) {
-  return {
-    iterations: state.history.length,
-    review: state.history.filter((h) => h.decision === 'soft').map((h) => ({ iteration: h.iteration, intent: h.intent })),
-    notes: state.notes,
-  };
+  return { iterations: state.history.length, review: reviewOf(state), notes: state.notes };
 }
 
 export function trailers(state) {
@@ -296,13 +302,31 @@ function filterPorcelain(porcelain) {
 
 // Setup work (iteration 0, graph.start outside the iteration loop) is its own unit; rejecting
 // it has nowhere to retry back into, so it stops the loop instead of looping to the head.
+// Iteration 0 alone says so: `initState` starts at 0 only when graph.start is outside the
+// iteration loop, and `iteration` only ever counts up from there.
 function isSetupUnit(state) {
-  return state.iteration === 0 && !iterationLoop(state.graph).nodes.includes(state.graph.start);
+  return state.iteration === 0;
+}
+
+const isStringList = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string');
+
+// A card arrives from the model as JSON (`record --card`), so its shape is checked before
+// anything is stored: a string `writeSet` stored here only throws later, inside `score --diff`,
+// with `pendingVerify` already set — and `score --declared` refuses while that is set, so
+// nothing could get the loop moving again.
+function cardProblem(card) {
+  if (typeof card !== 'object' || Array.isArray(card)) return 'the card must be a JSON object';
+  if (!isStringList(card.actions)) return "the card's actions must be a list of strings";
+  if (!isStringList(card.writeSet)) return "the card's writeSet must be a list of strings";
+  if (card.intent != null && typeof card.intent !== 'string') return "the card's intent must be a string";
+  return null;
 }
 
 export function recordOutcome(state, bricks, outcome, { card = null, porcelain = null, note = '' } = {}) {
   assertRunning(state);
   if (state.pendingVerify) throw new Error('the iteration is closed: run `geneseed loop score --diff` first');
+  const problem = card === null ? null : cardProblem(card);
+  if (problem) throw new Error(problem);
   const from = state.node;
   const brick = bricks.get(from);
   if (!brick) throw new Error(`no brick named ${from} in the catalogue`);
@@ -323,7 +347,7 @@ export function recordOutcome(state, bricks, outcome, { card = null, porcelain =
   // `fail` findings) — pushed before the transition below, so it lands in `notes` even when
   // this call closes the unit, re-splits, or stops the loop. `notes` is never reset mid-run
   // (only `exhaust`'s own push and `decideAwaiting` add to it otherwise), so it survives
-  // `resetUnit`/`finishUnit` the same way the research's fact 1 says a card does not.
+  // `resetUnit`/`finishUnit` — which a card does not: `resetUnit` clears it.
   if (note) state.notes.push(`iteration ${state.iteration} (${from}): ${note}`);
   state.visited.push(from);
 

package/js/maintain/memory.mjs

@@ -30,7 +30,7 @@
 import { readdirSync, unlinkSync } from 'node:fs';
 import path from 'node:path';
 
-import { memoryDropIndex } from '../hosts/hooks.mjs';
+import { memoryDropIndex } from '../hosts/memory-files.mjs';
 import { resolveMemoryDir } from '../hosts/hosts.mjs';
 import { printOut, printErr, isFile } from '../lib/fs.mjs';
 

package/js/maintain/migrate.mjs

@@ -35,17 +35,14 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from 'node:
 import path from 'node:path';
 
 import { main as driverMain } from '../build/driver.mjs';
-import { PACK_ORDER, ROOT } from '../build/source.mjs';
+import { ROOT } from '../build/source.mjs';
+import { CLAUDE_STYLE } from '../hosts/hosts.mjs';
+import { EMIT_HOST_SCOPE, installState, installTargets, readMaybe } from '../hosts/installs.mjs';
+import { installProfile } from '../build/generate.mjs';
 import {
-  EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
-  footprintOfDir, installState, installTargets, modeOfDir, postureOfDir, readMaybe, themeOfDir,
-  trustOfDir,
-} from '../hosts/installs.mjs';
-import { DEFAULT_EMIT, setupBuildArgs } from '../build/generate.mjs';
-import { DEFAULT_PRESET } from '../loop/score.mjs';
-import {
-  autostartPaths, autostartStale, hookShimPath, migrateShape, readJsonc, shimHome,
-} from '../hosts/settings.mjs';
+  autostartPaths, autostartStale, hookShimPath, migrateShape, shimHome,
+} from '../hosts/shim.mjs';
+import { loadJsonObject } from '../hosts/settings.mjs';
 import { writeText, printOut, printErr } from '../lib/fs.mjs';
 
 /** Every emit name the generator answers to — the set an unrecognised marker is NOT in. */
@@ -61,21 +58,20 @@ const KNOWN_EMITS = new Set(EMIT_HOST_SCOPE.keys());
  * host-parity rule asks for.
  */
 function hookSettingsFile(root, host, scope) {
-  if (!['claude', 'bob', 'openclaude'].includes(host)) return null;
+  if (!CLAUDE_STYLE.includes(host)) return null;
   const name = scope === 'project' && host !== 'bob' ? 'settings.local.json' : 'settings.json';
   return path.join(root, name);
 }
 
 /** Every hook command string in a settings file, or [] when it cannot be read or parsed. */
 function hookCommandsOf(file) {
-  // `readJsonc`, NOT `JSON.parse`. A hand-edited settings.json with comments and a trailing
-  // comma is the one shape no machine in this project writes, and strict JSON rejects it —
+  // `loadJsonObject` (JSONC), NOT `JSON.parse`. A hand-edited settings.json with comments and a
+  // trailing comma is the one shape no machine in this project writes, and strict JSON rejects it —
   // which would classify a wired install as `none` and make `migrate` skip the machine
   // silently. `mergeClaudeSettings` already reads through comments for exactly this reason.
   // Found by the JSONC corpus fixture; a generated fixture would have hidden it.
-  let loaded;
-  try { [loaded] = readJsonc(readFileSync(file, 'utf8')); } catch { return []; }
-  if (!loaded || typeof loaded !== 'object') return [];
+  const { state, data: loaded } = loadJsonObject(file);
+  if (state !== 'ok') return [];
   const hooks = loaded.hooks;
   if (!hooks || typeof hooks !== 'object') return [];
   const out = [];
@@ -210,21 +206,13 @@ export function cmdMigrate(args = {}) {
     try { rmSync(stash, { recursive: true, force: true }); } catch { /* nothing to undo */ }
   };
 
-  // Step 3 — re-emit, in each install's OWN six values. Same reads as `cmdRebuildAll`, and
-  // the pack selection is the sixth: leaving it out re-emitted a narrowed install at whatever
-  // `harness.config.json` said, which WIDENS a constitution its owner had cut down (and, the
-  // other way, can strip the consent gate). `null` — a pre-marker carrier, which on a MIGRATION
-  // is the common case and not the rare one — resolves to ALL packs through
-  // `doctrinesForBuild`, never to `harness.config.json`, which is what makes it fail-closed.
+  // Step 3 — re-emit, in each install's OWN values: `installProfile`, the one reading
+  // `rebuild-all` and `status` share. This loop hand-copied it once and drifted twice — it
+  // passed the excluded rules as `null` (re-admitting every rule an owner switched off,
+  // `process 5` among them) and dropped `--config-dir`, so a global found through
+  // `CLAUDE_CONFIG_DIR`/`OPENCODE_CONFIG_DIR` re-emitted into the DEFAULT dir instead.
   for (const r of rows) {
-    const marker = r.marker && (EMIT_HOST_SCOPE.get(r.marker) ?? ['', ''])[0] === r.host
-      ? r.marker : '';
-    const emit = marker || DEFAULT_EMIT.get(`${r.host} ${r.scope}`) || 'opencode-global';
-    const theme = themeOfDir(r.root) || defaultTheme();
-    const out = r.scope === 'global' ? null : r.root;
-    const argv = setupBuildArgs(theme, emit, out, out, footprintOfDir(r.root),
-      postureOfDir(r.root) || defaultPosture(), modeOfDir(r.root) || defaultMode(),
-      doctrinesForBuild(r.root), PACK_ORDER, null, trustOfDir(r.root) || DEFAULT_PRESET);
+    const { emit, theme, argv } = installProfile(r.host, r.scope, r.root);
     const label = `${r.host}:${r.scope} (${r.root})`;
     printOut(`[migrate] re-emitting ${label}: theme=${theme} emit=${emit}\n`);
     let rc = 1;

package/js/maintain/uninstall.mjs

@@ -47,31 +47,28 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 
-import { hookRunnerEntry } from '../build/driver.mjs';
+import { hookRunnerEntry } from '../hosts/shim.mjs';
 import { confirm } from './setup.mjs';
 import {
   claudeCfg, claudeReadManifest, doctrinesOfDir, emitHostScopeOf, excludedRulesOfDir, installKind,
   installState,
-  registeredTargets, readMaybe, DISABLED_STASH,
+  registeredTargets, DISABLED_STASH,
 } from '../hosts/installs.mjs';
 import {
-  GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
+  CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
-import { mcpCommented } from '../hosts/mcp.mjs';
+import { mcpCommented, mcpLoad } from '../hosts/mcp.mjs';
 import {
-  managedBlockRead, managedBlockRemove, managedBlockWrite,
-  mergeClaudeSettings, opencodeTarget, readJsonc,
+  atomicWriteJson, managedBlockRead, managedBlockRemove, managedBlockWrite,
+  loadJsonObject, mergeClaudeSettings, opencodeTarget,
   settingsIntegrityCheck, wireClaudeExcludes, unwireClaudeExcludes, unwireClaudeSettings,
 } from '../hosts/settings.mjs';
 import { printOut, printErr, readText, writeText, isFile, isDir, isOsError } from '../lib/fs.mjs';
-import { indexOfDeepEqual, jsonDumps, jsonDumpsIndent, deepEquals } from '../lib/json.mjs';
+import { indexOfDeepEqual, isDict, jsonDumps, deepEquals } from '../lib/json.mjs';
 import { comparePaths, isAbsolutePath, within } from '../lib/paths.mjs';
 
 const hostSpec = (host) => HOSTS.find((h) => h.host === host);
 
-/** The Claude-STYLE hosts — one manifest shape, one reversal. Spelled once. */
-const CLAUDE_STYLE = ['claude', 'bob', 'openclaude'];
-
 /**
  * `shutil.rmtree(p, ignore_errors=True)`.
  *
@@ -154,11 +151,15 @@ function pruneAncestors(start, stop) {
  * failure strings) differ in the root and in the label, which are the two arguments. The
  * `victim.is_file()` guard is load-bearing rather than defensive: a manifest entry naming a
  * directory is SKIPPED, not recursed into, and `removed` counts only what actually went.
+ *
+ * `ownedWithin` first, the same containment boundary deactivate draws: the manifest is a file
+ * on disk, and without it an `owned` entry of `../../.bashrc` was unlinked — and the prune
+ * then climbed from ITS parent, which never meets `base`, removing empty directories as it went.
  */
 function unlinkOwned(base, owned, label = '') {
   let removed = 0;
   const failed = [];
-  for (const rel of owned) {
+  for (const rel of ownedWithin(base, owned)) {
     const victim = path.join(base, rel);
     try {
       if (isFile(victim)) {
@@ -177,6 +178,23 @@ function unlinkOwned(base, owned, label = '') {
   return [removed, failed];
 }
 
+/**
+ * The manifest rels that resolve INSIDE `base` — the one security boundary every walk over
+ * `owned` goes through (uninstall, both deactivates).
+ *
+ * `path.resolve(rroot, r)` and NOT `path.join`, which is the one line here that is a security
+ * boundary rather than a translation. The Python is `(rroot / r).resolve()`, and pathlib's
+ * `/` REPLACES the base when the right operand is absolute — so a manifest entry naming
+ * `C:/evil.md` resolves outside the root and `_within` rejects it. `path.join` would have
+ * concatenated it into `<root>/C:/evil.md`, which passes containment and would then be acted
+ * on. `path.resolve` has pathlib's semantics for exactly this case, and collapses `..`
+ * besides, which is why the guard runs on the resolved path rather than the lexical one.
+ */
+function ownedWithin(base, rels) {
+  const rroot = resolvePath(base);
+  return rels.filter((r) => r && within(resolvePath(path.resolve(rroot, r)), rroot));
+}
+
 /** The two WARNs every reversal prints when an owned file survives. Identical in all three. */
 function warnSurvivors(failed) {
   printErr('[uninstall] WARN: could not remove '
@@ -203,13 +221,9 @@ const REVERSAL_MARKERS = [GLOBAL_MANIFEST, '.geneseed-theme', '.geneseed-emit',
  */
 export function unmergeOpencodeJson(p, entry) {
   const target = opencodeTarget(p);
-  if (!existsSync(target)) return false;
-  let cfg;
-  let hadComments;
-  const text = readMaybe(target);
-  if (text === null) return false;             // the Python's `except OSError: return False`
-  [cfg, hadComments] = readJsonc(text);
-  if (cfg === null || typeof cfg !== 'object' || Array.isArray(cfg)) return false;
+  // Absent, unreadable (the Python's `except OSError: return False`) or not an object: decline.
+  const { state, data: cfg, hadComments } = loadJsonObject(target);
+  if (state !== 'ok') return false;
   const instr = cfg.instructions;
   if (!Array.isArray(instr) || !instr.includes(entry)) return false;
   if (path.extname(target) === '.jsonc' && hadComments) {
@@ -218,7 +232,7 @@ export function unmergeOpencodeJson(p, entry) {
     return false;
   }
   cfg.instructions = instr.filter((i) => i !== entry);
-  writeText(target, `${jsonDumpsIndent(cfg)}\n`);
+  atomicWriteJson(target, cfg);
   return true;
 }
 
@@ -269,8 +283,7 @@ function claudeMdPath(cfg, managed) {
 
 /** A manifest's `managed` map, or `{}` — the Python's `isinstance(..., dict)` guard. */
 function managedOf(man) {
-  const mg = man.managed;
-  return typeof mg === 'object' && mg !== null && !Array.isArray(mg) ? mg : {};
+  return isDict(man.managed) ? man.managed : {};
 }
 
 /** A manifest's `owned` list, or `[]`. */
@@ -339,22 +352,6 @@ export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
   return { removed, unmerged, archived, failed };
 }
 
-/**
- * `_harness_mcp._mcp_load`, reduced to the OpenCode arm.
- *
- * The Claude arm (`.mcp.json`, `~/.claude.json`, parsed STRICTLY — see `mcpLoad` in
- * js/hosts/mcp.mjs for why) lives with the MCP catalog. `installAgentEntry` is this port's only caller and passes
- * no host, so porting the branch would ship an unreachable arm with no cell and no partition
- * to be part of — the criterion this port decides keep-vs-delete by.
- */
-function mcpLoadOpencode(p) {
-  if (!existsSync(p)) return {};
-  const text = readMaybe(p);
-  if (text === null) return {};
-  const [data] = readJsonc(text);
-  return typeof data === 'object' && data !== null && !Array.isArray(data) ? data : {};
-}
-
 /**
  * `_harness_mcp._install_agent_entry` — the `instructions` entry to drop.
  *
@@ -367,7 +364,7 @@ export function installAgentEntry(root, kind) {
   if (kind === 'global') {
     return path.join(root, 'AGENT.md').split(path.sep).join('/');
   }
-  const cfg = mcpLoadOpencode(opencodeTarget(path.join(root, 'opencode.json')));
+  const cfg = mcpLoad(opencodeTarget(path.join(root, 'opencode.json')));
   return installAgentEntryOf(cfg.instructions);
 }
 
@@ -645,22 +642,6 @@ function printOtherHostHits(root, removedHost) {
   }
 }
 
-/**
- * `_harness_setup._confirm`, and the only interactive read this verb makes.
- *
- * MOVED TO `js/maintain/setup.mjs` IN P5i, where the Python's own owner is: `_confirm` lives in
- * `_harness_setup` beside the `_ask` it is built on, and `setup` is its second caller. The
- * body stayed here for one phase because a helper with one caller is not shared yet; the
- * rule this port uses is that the SECOND owner is what moves it, and a byte gate is what
- * licenses the move.
- *
- * UNREACHABLE FROM EVERY CELL, restated because moving it does not change that: `cmdUninstall`
- * only reaches it when stdin is a TTY, and the harness gives every cell a pipe. What the
- * cells DO gate is the branch beside it — the non-interactive refusal — which is why that one
- * has an `expect` naming its wording. It is now gated positively too, by the stdin-seeded
- * corpus P5i added for the wizard.
- */
-
 /**
  * `_harness_mcp.cmd_uninstall`.
  *
@@ -690,7 +671,7 @@ export function cmdUninstall(args) {
   const data = installDataDir(root, host, scope);
   const stores = ['memory', 'notebook'].filter((n) => isDir(path.join(data, n)));
   printOut(`[uninstall] target: ${root} (${host}:${scope})\n`);
-  if (['claude', 'bob', 'openclaude'].includes(host)) {
+  if (CLAUDE_STYLE.includes(host)) {
     printOut('[uninstall] removes: agents/, skills/, markers, the '
       + `${hostSpec(host).agentFile} managed block, and Geneseed's `
       + 'settings.json hooks/excludes (your own keys/hooks are kept).\n');
@@ -810,17 +791,7 @@ function installRelive(root) {
   return isFile(path.join(root, 'AGENT.md'));
 }
 
-/**
- * `_harness_mcp._install_move_list` — the rels to move aside, `_within`-guarded.
- *
- * `path.resolve(rroot, r)` and NOT `path.join`, which is the one line here that is a security
- * boundary rather than a translation. The Python is `(rroot / r).resolve()`, and pathlib's
- * `/` REPLACES the base when the right operand is absolute — so a manifest entry naming
- * `C:/evil.md` resolves outside the root and `_within` rejects it. `path.join` would have
- * concatenated it into `<root>/C:/evil.md`, which passes containment and would then be MOVED.
- * `path.resolve` has pathlib's semantics for exactly this case, and collapses `..` besides,
- * which is why the guard runs on the resolved path rather than the lexical one.
- */
+/** `_harness_mcp._install_move_list` — the rels to move aside, `ownedWithin`-guarded. */
 function installMoveList(root, kind) {
   let rels;
   if (kind === 'project') {
@@ -828,8 +799,7 @@ function installMoveList(root, kind) {
   } else {
     rels = ownedOf(claudeReadManifest(root)).filter((r) => r !== VERSION_MARKER);
   }
-  const rroot = resolvePath(root);
-  return rels.filter((r) => r && within(resolvePath(path.resolve(rroot, r)), rroot));
+  return ownedWithin(root, rels);
 }
 
 /**
@@ -844,16 +814,11 @@ function installMoveList(root, kind) {
  */
 function installReaddEntry(target, entry) {
   if (!existsSync(target)) {
-    mkdirSync(path.dirname(target), { recursive: true });
-    writeText(target, `${jsonDumpsIndent({
-      $schema: 'https://opencode.ai/config.json', instructions: [entry],
-    })}\n`);
+    atomicWriteJson(target, { $schema: 'https://opencode.ai/config.json', instructions: [entry] });
     return true;
   }
-  let raw;
-  try { raw = readText(target); } catch { return false; }   // except OSError
-  const [cfg, hadComments] = readJsonc(raw);
-  if (typeof cfg !== 'object' || cfg === null || Array.isArray(cfg)) return false;
+  const { state, data: cfg, hadComments } = loadJsonObject(target);
+  if (state !== 'ok') return false;            // unreadable (except OSError), or not an object
   const instr = Array.isArray(cfg.instructions) ? cfg.instructions : [];
   if (indexOfDeepEqual(instr, entry) >= 0) return false;
   if (path.extname(target) === '.jsonc' && hadComments) {
@@ -862,7 +827,7 @@ function installReaddEntry(target, entry) {
     return false;
   }
   cfg.instructions = [...instr, entry];
-  writeText(target, `${jsonDumpsIndent(cfg)}\n`);
+  atomicWriteJson(target, cfg);
   return true;
 }
 
@@ -1067,16 +1032,14 @@ function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   const excluded = excludedRulesOfDir(root).length ? excludedRulesOfDir(root)
     : excludedRulesOfDir(cfg);
   // `host` reaches the group builder: a Bob reactivate must re-wire Gemini-named groups.
-  const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed), 'global',
+  const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed),
     managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!deepEquals(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;
     data.managed = managed;
-    const tmp = path.join(cfg, `${GLOBAL_MANIFEST}.tmp`);
     try {
-      writeText(tmp, `${jsonDumpsIndent(data)}\n`);
-      renameSync(tmp, path.join(cfg, GLOBAL_MANIFEST));
+      atomicWriteJson(path.join(cfg, GLOBAL_MANIFEST), data);
     } catch { /* except OSError: pass */ }
   }
 }
@@ -1093,9 +1056,7 @@ function claudeDeactivate(root, scope = 'global', host = 'claude') {
   const man = claudeReadManifest(cfg);
   const managed = managedOf(man);
   const stash = path.join(cfg, DISABLED_STASH, host);
-  const rroot = resolvePath(cfg);
-  const rels = ownedOf(man).filter((r) => r && r !== VERSION_MARKER
-    && within(resolvePath(path.resolve(rroot, r)), rroot));
+  const rels = ownedWithin(cfg, ownedOf(man).filter((r) => r !== VERSION_MARKER));
   const { done, failed } = moveAll(cfg, stash, rels);
   if (failed) {
     cleanHostStash(cfg, host);
@@ -1129,9 +1090,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
   const stash = path.join(cfg, DISABLED_STASH, host);
   const blockFile = path.join(stash, '_claude_md_block.txt');
   const reliveManifest = claudeReadManifest(cfg);
-  // `.get("managed") or {}` — an `or`, not an isinstance guard, and the difference is
-  // observable on a manifest whose `managed` is `null`.
-  const reliveManaged = reliveManifest.managed || {};
+  const reliveManaged = managedOf(reliveManifest);
   let relive = managedBlockRead(claudeMdPath(cfg, reliveManaged)) !== null;
   // Bob GLOBAL writes no managed AGENTS.md block — its preamble carrier is the owned
   // `rules/geneseed.md`, so a live copy of THAT is the relive signal there. Without this arm
@@ -1149,7 +1108,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
   }
   const { leftovers, moved } = restoreAll(stash, cfg, '_claude_md_block.txt');
   if (leftovers.length) return { ok: false, failed: leftovers, moved };
-  const managed = claudeReadManifest(cfg).managed || {};
+  const managed = managedOf(claudeReadManifest(cfg));
   // ⚠ THE CARRIER IS RESTORED BEFORE THE HOOKS ARE RE-MERGED, AND THE ORDER IS LOAD-BEARING.
   // `remergeClaudeHooks` reads the install's pack selection back off the carrier, and on a
   // Claude-style host that selection lives inside the MANAGED BLOCK — which the deactivate

package/js/ui/cli.mjs

@@ -429,18 +429,6 @@ export function cliCommand(verb) {
   return (load().commands ?? []).find((c) => c.name === verb) ?? null;
 }
 
-/**
- * `<verb> --help` for whichever binary asked, or `null` for a verb the table does not
- * describe — the caller already owns that refusal and its message.
- *
- * ONE OWNER FOR TWO ENTRIES. `bin/geneseed-hook.mjs` carries the four hook verbs and
- * `bin/geneseed-cli.mjs` the rest of the table, and
- * `test_the_two_entry_points_carry_disjoint_verb_sets` keeps them from learning each other's
- * tables — so the help each prints has to come from here rather than from a copy in each.
- *
- * CRLF ON WINDOWS for `die`'s reason: argparse writes through a Python text stream, which
- * translates, and this text lands in the same terminals and the same pipes as that one.
- */
 /**
  * `geneseed --help` — every verb with its one-line help, from the same table the per-verb help
  * reads. `verbs` is the entry's own dispatch list, so the listing can name nothing the entry
@@ -460,6 +448,18 @@ export function printVerbList(prog, verbs, extra = {}) {
   return 0;
 }
 
+/**
+ * `<verb> --help` for whichever binary asked, or `null` for a verb the table does not
+ * describe — the caller already owns that refusal and its message.
+ *
+ * ONE OWNER FOR TWO ENTRIES. `bin/geneseed-hook.mjs` carries the four hook verbs and
+ * `bin/geneseed-cli.mjs` the rest of the table, and
+ * `test_the_two_entry_points_carry_disjoint_verb_sets` keeps them from learning each other's
+ * tables — so the help each prints has to come from here rather than from a copy in each.
+ *
+ * CRLF ON WINDOWS for `die`'s reason: argparse writes through a Python text stream, which
+ * translates, and this text lands in the same terminals and the same pipes as that one.
+ */
 export function printHelp(prog, verb) {
   const cmd = cliCommand(verb);
   if (cmd === null) return null;