geneseed 3.13.0 → 3.15.0

package/CHANGELOG.md

@@ -8,6 +8,99 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [3.15.0] — 2026-10-05
+
+**Upgrading:** re-emit (`geneseed rebuild-all`) so OpenCode installs get the hardened plugins and
+the corrected command layer; then `geneseed web restart` (and a hard reload).
+
+### Security
+- **OpenCode notify plugin** — a session title containing a typographic quote (`’`) could close
+  the PowerShell string and run code; title and body now travel through environment variables,
+  and the notifier no longer opens a visible console window.
+- **OpenCode guard** — `rm -rf /*`, `rm -rf ~/*`, `rm -rf -- /` and `rm -r -f /` are blocked
+  (only bare `rm -rf /`, which GNU rm already refuses, was caught before).
+- **Memory names** — a model-written memory named `MEMORY`/`README`, or differing only in case
+  from an existing fact, is refused instead of overwriting the index or another fact (Claude
+  `learn` hook and OpenCode learn plugin); the console's delete endpoint compares the reserved
+  names case-insensitively.
+- **Web console** — POST requests are checked for Host and token before the body is read, and
+  bodies over 1 MiB are refused; `/api/item/config/<name>` serves only the known config files.
+- **No cwd lookups on Windows** — `git`, `java`, `taskkill` and `powershell` are resolved through
+  PATH only, never the current directory, so a binary planted in an untrusted clone can't run.
+- **`.geneseed-theme`** — a path-like marker value is refused instead of loading an arbitrary
+  `.json` file as a theme.
+
+### Fixed
+- **`geneseed upgrade` kept your settings** — it re-rendered an OpenCode install with only its
+  theme and emit, resetting footprint, posture, mode, doctrine packs and excluded rules to the
+  defaults; it now reads the install's own values before pulling. The doctor rollback uses
+  `reset --keep` (no longer discards edits made during the doctor run), a deleted upstream is
+  reported instead of "already up to date", and `bootstrap` exits 1 when the update failed.
+- OpenCode: `/code-review` is emitted again (the skill had been renamed); the command and
+  orchestrator files no longer overwrite — and then uninstall — a file you already had; the
+  learn plugin no longer exports non-functions; the context cache is per project; same-day
+  workflow runs no longer collide, and kept worktrees live under `.geneseed/worktrees/`.
+- `agent-overrides.json` values that are not plain strings or numbers are skipped with a warning
+  instead of crashing the emit or injecting frontmatter; Claude-family hosts warn about the keys
+  they ignore.
+- In a repo with both `.opencode/` and `.claude/`, each install reads its own loop trust preset.
+- Web console: Restart/update from a foreground `geneseed web` no longer orphans a daemon, the
+  page reloads against the new server, shutdown/restart wait for running jobs, `web stop` no
+  longer forgets a daemon that is still running, finished jobs are trimmed from memory, the Diff
+  page explains project installs, and job polling survives a dropped request.
+- `geneseed link` no longer deletes a `geneseed` it didn't create; the PATH check and quoting
+  are exact.
+- Exclusions follow one rule on every host: `..` and symlinks are resolved on both sides, so an
+  entry spelled through a link excludes the real folder and `exclude remove` can take back any
+  entry that excludes.
+- `geneseed setup` no longer crashes when the deployed theme is one this checkout doesn't ship.
+
+### Changed
+- `uninstall` loads 14 modules instead of 43 (prompts moved to `js/lib/prompt.mjs`); `update`
+  27 instead of 52; the web daemon 40 instead of 51.
+- Web server split along its seams (`routes.mjs`, `catalog.mjs`, `state.mjs`, `user-files.mjs`),
+  removing two import cycles; dead TUI helpers, undriven probe rows and stale comment pointers
+  to the former Python suite removed.
+
+## [3.14.0] — 2026-10-04
+
+**Upgrading:** re-emit (`geneseed rebuild-all`) so installed hooks pick up the gate fixes and the
+per-verb hook modules; then `geneseed web restart`.
+
+### Security
+- **Sealed Secrets gate** — `sk-ant-` keys containing `_` (base64url, most real keys) no longer
+  slip past; `MultiEdit` (`edits[].new_string`) and `NotebookEdit` (`notebook_path`/`new_source`)
+  are now scanned like `Write`/`Edit`.
+- **Destructive-git gate** — catches `git push -f`, `git push origin +main`, `git reset -q --hard`
+  and `git clean -d -f` (flags anywhere after the verb); `LAW_IV_BASH` mirrors it.
+- **Memory names** — a model-written memory `name:` that is not a plain slug is refused instead
+  of becoming a path outside the memory dir (Claude `learn` hook and the OpenCode learn plugin).
+- **Uninstall** — manifest paths are contained to the install dir before unlinking (as deactivate
+  already did); empty-directory pruning stops at the base.
+
+### Fixed
+- `--exclude-rules` is carried through every re-render: `geneseed diff` no longer reports drift on
+  an install with excluded rules, console Restore and `geneseed migrate` no longer re-admit them,
+  and `validate` honours every render axis. Unknown ids in `harness.config.json` now warn and are
+  dropped instead of breaking every later rebuild.
+- Claude `settings.json` that is not a JSON object, or unreadable, is refused instead of
+  overwritten; every JSON config write is atomic.
+- Loop: a malformed `record --card` is refused before it can wedge the loop; `check` resolves
+  bricks from the git root; `next` no longer rewrites `LOOP.md`; a clean tree is recognised.
+- Console: the Docs host selector follows the deployed install instead of sticking to OpenCode;
+  the About page shows the installed and source fingerprints; the outline strips inline markdown.
+- `theme --transparent-only` names the file it wrote; `validate --help` prints its own usage.
+- Doctor's module-map check keys by folder, so twin module names can no longer hide a missing row.
+- `learn` reports on stderr when it cannot start the model CLI.
+
+### Changed
+- The hook binary loads one verb's module per call (`hooks.mjs` gates, `hooks-context.mjs`,
+  `hooks-learn.mjs`): gate cold import ~16 → ~10 ms, on every tool call. The memory-file helpers
+  live in the no-spawn `memory-files.mjs`, so the CLI no longer reaches `child_process`.
+- Internal splits: `js/hosts/shim.mjs`, `js/build/args.mjs`, `checks-constitution.mjs`,
+  `checks-counts.mjs`; one JSON-object reader and one `CLAUDE_STYLE` host list; dead code and
+  Python-era comments removed.
+
 ## [3.13.0] — 2026-10-04
 
 **Upgrading:** re-emit (`geneseed rebuild-all`) so the installed `loop` skill knows the new

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.13.0**.
+> string. Current label: **3.15.0**.
 
 ## Capabilities
 

package/adapters/opencode/plugins/geneseed-context.js

@@ -52,7 +52,7 @@
 // opencode-global` and `--emit opencode` both place it for you. Keep ONE copy:
 // OpenCode dedups plugins by npm name+version only, so two local copies both load.
 
-import { promises as fs } from "node:fs"
+import { promises as fs, realpathSync } from "node:fs"
 import * as path from "node:path"
 import { fileURLToPath } from "node:url"
 import { homedir } from "node:os"
@@ -73,6 +73,16 @@ const norm = (p) => {
     raw = raw === "~" ? homedir() : path.join(homedir(), raw.slice(2))
   }
   let s = path.resolve(raw)
+  // Symlinks and junctions followed through the deepest existing ancestor (the rest appended),
+  // the rule js/hosts/hosts.mjs resolvePath applies: an exclude spelled through a link matches
+  // on every host, not only on Claude/Bob.
+  for (let cur = s, tail = []; ;) {
+    try { s = path.join(realpathSync.native(cur), ...tail); break } catch { /* walk up */ }
+    const up = path.dirname(cur)
+    if (up === cur) break
+    tail.unshift(path.basename(cur))
+    cur = up
+  }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 async function sovereignBypass(cwd) {
@@ -580,7 +590,7 @@ async function walkWikiDir(dir, depth, acc) {
 // entry on a large vault would otherwise inject thousands of listing lines. Beyond
 // the cap the listing truncates with a visible count and the agent explores the
 // folders on demand instead.
-const WIKI_LAZY_LIMIT = Number(process.env.GENESEED_WIKI_LAZY_LIMIT || 200)
+const WIKI_LAZY_LIMIT = envNum("GENESEED_WIKI_LAZY_LIMIT", 200)
 
 // Parse wiki.jsonc into renderable wikis: [{ name, root, desc, conventions, inbox,
 // protected, eager:[{rel,abs,desc}], lazy:[...], truncated }]. Entry paths resolve
@@ -765,16 +775,19 @@ async function resolveBlock(root) {
   return { block: await buildBlock(sets, wikis, commands, await sessionFiles(harness)), src }
 }
 
-// Per-process cache of the rendered block text for the transform path (root is fixed
-// per plugin instance). Recomputed at most once per TTL so doc edits are picked up.
-let _blockCache = { text: null, at: 0 }
+// Per-INSTANCE cache of the rendered block text for the transform path: the caller owns
+// `cache`, one per plugin instance, because root is fixed per instance but one OpenCode
+// process can serve several directories — a module-level cache served project A's
+// context into B for a whole TTL. Recomputed at most once per TTL so doc edits are
+// picked up.
 const BLOCK_TTL_MS = 30000
-async function cachedBlockText(root) {
+async function cachedBlockText(root, cache) {
   const now = Date.now()
-  if (_blockCache.text !== null && now - _blockCache.at < BLOCK_TTL_MS) return _blockCache.text
+  if (cache.text !== null && now - cache.at < BLOCK_TTL_MS) return cache.text
   let text = ""
   try { const { block } = await resolveBlock(root); text = block?.text || "" } catch {}
-  _blockCache = { text, at: now }
+  cache.text = text
+  cache.at = now
   return text
 }
 
@@ -797,6 +810,7 @@ export const GeneseedContext = async (ctx) => {
   const { client } = ctx
   const done = new Set()
   const root = repoRoot(ctx)
+  const blockCache = { text: null, at: 0 }
 
   // Visible delivery — post the block as a noReply session message. Used when
   // GENESEED_CONTEXT_VISIBLE forces it, and by the transform fallback below.
@@ -927,7 +941,7 @@ export const GeneseedContext = async (ctx) => {
         const present = output.messages.some((m) =>
           (m?.parts ?? []).some((p) => typeof p?.text === "string" && p.text.includes(MARKER)))
         if (present) return
-        const cached = await cachedBlockText(root)
+        const cached = await cachedBlockText(root, blockCache)
         if (!cached) return
         // Model line is request-specific (kept out of the cache): prefer the live
         // transcript on this request, fall back to $GENESEED_MODEL.

package/adapters/opencode/plugins/geneseed-guard.js

@@ -31,7 +31,7 @@
 // fires `permission.ask` simply never reaches this hook — the static ask still fires, so the
 // failure mode is one extra prompt, never a silent allow.
 
-import { promises as fs, existsSync, statSync, lstatSync, readFileSync, openSync, readSync, closeSync } from "node:fs"
+import { promises as fs, realpathSync, existsSync, statSync, lstatSync, readFileSync, openSync, readSync, closeSync } from "node:fs"
 import * as path from "node:path"
 import { fileURLToPath } from "node:url"
 import { homedir } from "node:os"
@@ -50,6 +50,16 @@ const norm = (p) => {
     raw = raw === "~" ? homedir() : path.join(homedir(), raw.slice(2))
   }
   let s = path.resolve(raw)
+  // Symlinks and junctions followed through the deepest existing ancestor (the rest appended),
+  // the rule js/hosts/hosts.mjs resolvePath applies: an exclude spelled through a link matches
+  // on every host, not only on Claude/Bob.
+  for (let cur = s, tail = []; ;) {
+    try { s = path.join(realpathSync.native(cur), ...tail); break } catch { /* walk up */ }
+    const up = path.dirname(cur)
+    if (up === cur) break
+    tail.unshift(path.basename(cur))
+    cur = up
+  }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 async function sovereignBypass(cwd) {
@@ -119,8 +129,10 @@ const SECRET_WARN_RE = [/(^|\/)\.env(\.[\w.-]+)?$/i]
 // Catastrophic, effectively irreversible shell → BLOCK. Both Unix and Windows shells,
 // since OpenCode runs natively on Windows and the agent may emit cmd / PowerShell.
 const SHELL_BLOCK_RE = [
-  /\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+(--no-preserve-root\s+)?\/(\s|$)/, // rm -rf /
-  /\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+~(\/)?(\s|$)/,                     // rm -rf ~
+  // rm -rf /, ~, /*, ~/* — flags may be split (-r -f), long (--recursive), or end with
+  // `--`; the lookahead insists one of them recurses. The target must be the root or
+  // home itself (optionally globbed), so `rm -rf /tmp/x` and `rm -rf ./build` pass.
+  /\brm\s+(?=(?:(?:-[a-zA-Z]+|--[a-z-]*)\s+)*?(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)\s)(?:(?:-[a-zA-Z]+|--[a-z-]*)\s+)+(?:\/|~\/?)\*?(\s|$)/,
   /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,                         // fork bomb
   /\bmkfs\.\w+\s+\/dev\//,                                            // format a device
   /\bdd\b[^\n]*\bof=\/dev\/(sd|nvme|hd|disk)/,                        // dd over a raw disk
@@ -409,7 +421,7 @@ export const GeneseedGuard = async (ctx) => {
   return {
     "tool.execute.before": async (input, output) => {
       if (OFF) return
-      if (await sovereignBypass(process.cwd())) return
+      if (await sovereignBypass(root())) return
       const tool = (input?.tool || input?.name || "").toLowerCase()
       const args = output?.args || input?.args || {}
       // `rule` is the ledger key, spelled as js/hosts/hooks.mjs spells it (`law-1`,

package/adapters/opencode/plugins/geneseed-learn.js

@@ -29,10 +29,11 @@
 //   3. ./memory  or  ./Harness/memory   (when the bundle is inside the project)
 // If none resolve, it logs once and does nothing — it never blocks a session.
 //
-// It is intentionally conservative: trivial sessions are skipped, each session is
-// processed at most once per process, and any error is swallowed.
+// It is intentionally conservative: trivial sessions are skipped, one session never
+// has two distils in flight at once (a continued session re-distils after its next
+// quiet window — see TIMING), and any error is swallowed.
 
-import { promises as fs } from "node:fs"
+import { promises as fs, realpathSync } from "node:fs"
 import * as path from "node:path"
 import { fileURLToPath } from "node:url"
 import { homedir } from "node:os"
@@ -54,6 +55,16 @@ const norm = (p) => {
     raw = raw === "~" ? homedir() : path.join(homedir(), raw.slice(2))
   }
   let s = path.resolve(raw)
+  // Symlinks and junctions followed through the deepest existing ancestor (the rest appended),
+  // the rule js/hosts/hosts.mjs resolvePath applies: an exclude spelled through a link matches
+  // on every host, not only on Claude/Bob.
+  for (let cur = s, tail = []; ;) {
+    try { s = path.join(realpathSync.native(cur), ...tail); break } catch { /* walk up */ }
+    const up = path.dirname(cur)
+    if (up === cur) break
+    tail.unshift(path.basename(cur))
+    cur = up
+  }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 async function sovereignBypass(cwd) {
@@ -155,19 +166,20 @@ const AGENT_NAME_RE = /^[a-z][a-z0-9-]{1,40}$/
 const MAX_AGENT_BULLETS = 100 // hard cap, oldest dropped; no pruning heuristics
 
 // SINGLE SOURCE — the harness extracts this exact literal (see LEARN_PROMPT_HEAD).
-export const AGENT_LESSON_PROMPT = `The notes below are one subagent dispatch ("agent run").
+// Not exported: OpenCode calls every export as a plugin factory, and a string is not one.
+const AGENT_LESSON_PROMPT = `The notes below are one subagent dispatch ("agent run").
 Output AT MOST ONE line: a durable lesson about how this agent should operate on a
 FUTURE, unrelated dispatch (a boundary that proved wrong, an input it always needs,
 a method that worked). Task residue ("fixed X", file names, ticket detail) is NOT a
 lesson. If there is none — the overwhelmingly common case — output exactly: NOTHING.`
 
-export function resolveAgentName(meta) {
+function resolveAgentName(meta) {
   const raw = meta?.agent ?? meta?.agentName ?? meta?.agentID ?? null
   const name = typeof raw === "string" ? raw.trim().toLowerCase() : null
   return name && AGENT_NAME_RE.test(name) ? name : null
 }
 
-export async function appendAgentLesson(memDir, agent, lesson) {
+async function appendAgentLesson(memDir, agent, lesson) {
   const dir = path.join(memDir, "agents")
   await fs.mkdir(dir, { recursive: true })
   const file = path.join(dir, `${agent}.md`)
@@ -211,8 +223,12 @@ function envModel() {
   return null
 }
 
+// Stems that name the store's own files, never a fact: `MEMORY` is the index, so a model
+// that emitted `name: MEMORY` would overwrite it.
+const RESERVED_STEMS = new Set(["memory", "readme"])
+
 async function existingSlugs(memDir) {
-  const skip = new Set(["memory", "readme"])
+  const skip = RESERVED_STEMS
   try {
     const entries = await fs.readdir(memDir)
     return new Set(
@@ -251,7 +267,15 @@ function parseFrontmatter(chunk) {
   return fm
 }
 
+// A memory `name:` becomes a FILENAME and the model writes it, so it is a plain slug or
+// nothing — no separator, no `..`, no drive. The same rule as MEMORY_SLUG_RE in
+// js/hosts/hooks.mjs, inlined because this file ships standalone.
+const MEMORY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$/
+
+// Compared lowercase: on a case-insensitive filesystem (Windows, macOS) `User-Prefs`
+// and `user-prefs` are the same file, so a case variant would overwrite a stored fact.
 async function writeMemories(output, memDir, existing) {
+  const taken = new Set([...existing].map((s) => s.toLowerCase()))
   const written = []
   const indexLines = []
   for (let chunk of output.split(/^---FILE---\s*$/m)) {
@@ -259,9 +283,11 @@ async function writeMemories(output, memDir, existing) {
     if (!chunk || chunk.toUpperCase() === "NOTHING") continue
     const fm = parseFrontmatter(chunk)
     const name = (fm.name || "").trim()
-    if (!name || existing.has(name)) continue
+    const key = name.toLowerCase()
+    if (!MEMORY_SLUG_RE.test(name) || RESERVED_STEMS.has(key) || taken.has(key)) continue
     await fs.writeFile(path.join(memDir, `${name}.md`), chunk.replace(/\n+$/, "") + "\n", "utf8")
     existing.add(name)
+    taken.add(key)
     written.push(name)
     const desc = (fm.description || "").trim()
     indexLines.push(`- [${name}](${name}.md)` + (desc ? ` — ${desc}` : ""))
@@ -275,14 +301,19 @@ async function writeMemories(output, memDir, existing) {
   return written
 }
 
-export const GeneseedLearn = async ({ client }) => {
+export const GeneseedLearn = async (ctx) => {
+  const { client } = ctx ?? {}
   const ours = new Set()       // throwaway distil sessions — never mine our own output
   const timers = new Map()     // sid -> debounce timer, re-armed on each idle
   const inFlight = new Set()   // sid currently being distilled (guards against overlap)
   let warnedNoDir = false
 
+  // The session root, as guard and context use it — not process.cwd(), which is the
+  // directory OpenCode was launched from and need not be the project being served.
+  const root = ctx?.worktree || ctx?.directory || process.cwd()
+
   async function runDistill(sid) {
-    if (await sovereignBypass(process.cwd())) return
+    if (await sovereignBypass(root)) return
     if (inFlight.has(sid)) return   // a run is already underway; the next idle re-arms
     inFlight.add(sid)
     try {
@@ -393,4 +424,8 @@ export const GeneseedLearn = async ({ client }) => {
   }
 }
 
+// OpenCode treats every export as a plugin and rejects non-functions; hang the test
+// helpers off the factory instead — reachable via import, invisible to the loader.
+Object.assign(GeneseedLearn, { writeMemories, resolveAgentName, appendAgentLesson })
+
 export default GeneseedLearn

package/adapters/opencode/plugins/geneseed-notify.js

@@ -27,6 +27,7 @@
 // glob), exactly like the context, learn, guard, and workflow plugins.
 
 import { spawn } from "node:child_process"
+import path from "node:path"
 
 const MODE = (process.env.GENESEED_NOTIFY || "on").toLowerCase()
 const OFF = ["off", "0", "false", "no"].includes(MODE)
@@ -67,11 +68,41 @@ function shouldNotify({ now, lastUserMs, parentID, title, minMs }) {
 
 // AppleScript double-quoted string literal.
 function asStr(s) { return '"' + String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"' }
-// PowerShell single-quoted string literal (escape ' by doubling).
-function psStr(s) { return "'" + String(s).replace(/'/g, "''") + "'" }
 
-function spawnDetached(cmd, args) {
-  const child = spawn(cmd, args, { stdio: "ignore", detached: true })
+// The notifier invocation for a platform, as data. Exported (via the factory) for tests.
+// Windows passes title and body through the environment, never through the -Command
+// text: PowerShell treats U+2018-U+201B as quote characters too, so escaping ASCII '
+// alone let a model-generated session title like  x’;Start-Process calc;’  close the
+// literal and run code. An env var is read as a value and never parsed as script.
+function notifyCommand(platform, title, body) {
+  if (platform === "darwin") {
+    return { cmd: "osascript", args: ["-e", `display notification ${asStr(body)} with title ${asStr(title)}`] }
+  }
+  if (platform === "win32") {
+    const script =
+      "Add-Type -AssemblyName System.Windows.Forms;" +
+      "Add-Type -AssemblyName System.Drawing;" +
+      "$n=New-Object System.Windows.Forms.NotifyIcon;" +
+      "$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;" +
+      "$n.ShowBalloonTip(5000,$env:GS_T,$env:GS_B,[System.Windows.Forms.ToolTipIcon]::Info);" +
+      "Start-Sleep -Seconds 6;$n.Dispose()"
+    return {
+      // By absolute path: a bare "powershell" resolves against the cwd first on Windows.
+      cmd: path.join(process.env.SystemRoot || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      args: ["-NoProfile", "-NonInteractive", "-Command", script],
+      env: { GS_T: String(title), GS_B: String(body) },
+    }
+  }
+  return { cmd: "notify-send", args: [title, body] }
+}
+
+// windowsHide: without it a detached PowerShell opens a visible console window that
+// sits on screen for the six seconds the balloon needs.
+function spawnDetached({ cmd, args, env }) {
+  const child = spawn(cmd, args, {
+    stdio: "ignore", detached: true, windowsHide: true,
+    env: env ? { ...process.env, ...env } : process.env,
+  })
   child.on("error", (e) => log(`spawn ${cmd} failed: ${e?.message ?? e}`))   // e.g. notifier not installed
   child.unref()
 }
@@ -79,20 +110,7 @@ function spawnDetached(cmd, args) {
 // Best-effort native notification; every failure is swallowed.
 function deliver(title, body) {
   try {
-    if (process.platform === "darwin") {
-      spawnDetached("osascript", ["-e", `display notification ${asStr(body)} with title ${asStr(title)}`])
-    } else if (process.platform === "win32") {
-      const script =
-        "Add-Type -AssemblyName System.Windows.Forms;" +
-        "Add-Type -AssemblyName System.Drawing;" +
-        "$n=New-Object System.Windows.Forms.NotifyIcon;" +
-        "$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;" +
-        `$n.ShowBalloonTip(5000,${psStr(title)},${psStr(body)},[System.Windows.Forms.ToolTipIcon]::Info);` +
-        "Start-Sleep -Seconds 6;$n.Dispose()"
-      spawnDetached("powershell", ["-NoProfile", "-NonInteractive", "-Command", script])
-    } else {
-      spawnDetached("notify-send", [title, body])
-    }
+    spawnDetached(notifyCommand(process.platform, title, body))
   } catch (err) {
     log(`deliver failed: ${err?.message ?? err}`)
   }
@@ -137,6 +155,6 @@ export const GeneseedNotify = async ({ client }) => {
 // ponytail: OpenCode treats every export as a plugin and rejects non-functions; a
 // bare helper export crashes startup or logs "not a function". Hang the test helpers
 // off the factory instead — reachable via `import`, invisible to the loader.
-Object.assign(GeneseedNotify, { lastUserMs, shouldNotify })
+Object.assign(GeneseedNotify, { lastUserMs, shouldNotify, notifyCommand })
 
 export default GeneseedNotify

package/adapters/opencode/plugins/geneseed-workflow.js

@@ -14,7 +14,9 @@
 // written to `.geneseed/workflow-runs/<runId>.log`. Every failure is contained and
 // reported, never thrown into the session.
 //
-// Quiet by default; GENESEED_DEBUG=1 logs to stderr. GENESEED_WORKFLOWS_DIR overrides
+// One stderr line at load (the banner below — it is how a restart shows the tool
+// registered, or warns that it could not); everything else is quiet unless
+// GENESEED_DEBUG=1. GENESEED_WORKFLOWS_DIR overrides
 // where saved workflows are loaded from.
 
 import { execFile } from "node:child_process"

package/adapters/opencode/workflows/_runtime.js

@@ -16,6 +16,7 @@
 // authoring convention — imported modules cannot have their globals shadowed — not a
 // hard sandbox guard. See docs/specs/2026-06-09-opencode-workflow-primitive.md.
 
+import { promises as fs } from "node:fs"
 import * as os from "node:os"
 import * as path from "node:path"
 
@@ -189,14 +190,23 @@ async function runChildSession(client, { prompt, agent, model, title, directory
 // the runtime never merges, commits, or deletes work. `git(argv, cwd)` is injected by the
 // plugin so this file stays pure and testable. The worktree has no untracked files from
 // the root (no node_modules, no .env): an agent that must run the project installs first.
-const slug = (t) => String(t).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 32) || "agent"
+//
+// Worktrees live under <root>/.geneseed/worktrees/ beside the run traces, NOT in the OS
+// temp dir: a kept worktree is unmerged work, and temp cleaners delete it. The state dir
+// gets a `*` .gitignore of its own (never overwriting one already there), so neither the
+// worktrees nor the traces show up as untracked files in the project.
+const fullSlug = (t) => String(t).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "")
+const slug = (t) => fullSlug(t).slice(0, 32) || "agent"
 
 export async function isolate(git, root, name) {
   if (typeof git !== "function") throw new Error("worktree isolation unavailable — no git executor")
   if (!root) throw new Error("worktree isolation unavailable — unknown working dir")
   const base = (await git(["rev-parse", "HEAD"], root)).trim()
   const branch = `geneseed-wf/${name}`
-  const dir = path.join(os.tmpdir(), "geneseed-wf", name)
+  const state = path.join(root, ".geneseed")
+  await fs.mkdir(path.join(state, "worktrees"), { recursive: true })
+  await fs.writeFile(path.join(state, ".gitignore"), "*\n", { flag: "wx" }).catch(() => {})
+  const dir = path.join(state, "worktrees", name)
   await git(["worktree", "add", "-b", branch, dir, base], root)
   return { dir, branch, base }
 }
@@ -224,7 +234,10 @@ export function overlaps(worktrees) {
 export function createRuntime(ctx) {
   const { client, directory, worktree, log: sink, git } = ctx
   const root = worktree || directory
-  const runTag = slug(ctx.runId || "run")
+  // The WHOLE run id, never truncated: it ends in the run's time, and cutting it to the
+  // label slug's 32 characters left two same-day runs of a long-named workflow with one
+  // tag — the second run's `worktree add -b` then hit the first run's kept branch.
+  const runTag = fullSlug(ctx.runId || "run") || "run"
   const worktrees = []
   const args = ctx.args || {}
   const cap = ctx.concurrency || concurrencyCap()