geneseed 3.13.0 → 3.15.0

package/js/web/docs.mjs

@@ -291,11 +291,20 @@ function subCounts(state, body) {
 /**
  * The Docs selector names a HOST; a tag names a host or a FAMILY. Bob and OpenClaude emit
  * through the Claude engine, so a `claude` tag (page or block) is the Claude family and shows
- * to all three of them, while `bob` / `openclaude` narrow to the one host. The same mapping as
- * the console's host table (`web/src/lib/hosts.js`, its `docs` column).
+ * to all three of them, while `bob` / `openclaude` narrow to the one host. `name` is how a
+ * host-only passage's visible label spells the host. One row per host: the family table, the
+ * host list and both marker patterns below are read off it.
  */
-export const HOST_FAMILY = { opencode: 'opencode', claude: 'claude', openclaude: 'claude', bob: 'claude' };
-export const HARNESSES = Object.keys(HOST_FAMILY);
+const DOC_HOSTS = {
+  opencode: { family: 'opencode', name: 'OpenCode' },
+  claude: { family: 'claude', name: 'Claude Code' },
+  openclaude: { family: 'claude', name: 'OpenClaude' },
+  bob: { family: 'claude', name: 'IBM Bob' },
+};
+export const HOST_FAMILY = Object.fromEntries(
+  Object.entries(DOC_HOSTS).map(([id, h]) => [id, h.family]));
+export const HARNESSES = Object.keys(DOC_HOSTS);
+const anyOf = (words) => `(?:${words.join('|')})`;
 /**
  * A page or block tagged `tag` shows to `host`. Untagged content shows to every host. One tag
  * names a host or a family; a LIST names hosts exactly, no family widening, because picking
@@ -307,7 +316,7 @@ export const harnessShows = (tag, host) => (Array.isArray(tag)
   : !tag || tag === host || tag === HOST_FAMILY[host]);
 /** A block's tag: `claude` alone, or `claude,openclaude` — the list, read as above. */
 const harnessTag = (raw) => (raw.includes(',') ? raw.split(/\s*,\s*/) : raw);
-const HOST_ID = '(?:opencode|claude|openclaude|bob)';
+const HOST_ID = anyOf(HARNESSES);
 const HARNESS_OPEN_RE = new RegExp(String.raw`^\s*<!--\s*harness:(${HOST_ID}(?:\s*,\s*${HOST_ID})*)\s*-->\s*$`);
 const HARNESS_CLOSE_RE = /^\s*<!--\s*\/harness\s*-->\s*$/;
 /**
@@ -328,9 +337,9 @@ export function normHarness(value, state) {
 /**
  * Every open has a matching close, with no nesting.
  *
- * A marker inside a ``` fence is example text, not a marker (the same rule `sliceSection`
- * uses). Its purpose is to FAIL OPEN: an unbalanced marker leaves the body untouched, so a
- * typo can never blank the rest of a page.
+ * A marker inside a ``` fence is example text, not a marker (the same rule the frontend's
+ * outline uses). Its purpose is to FAIL OPEN: an unbalanced marker leaves the body untouched,
+ * so a typo can never blank the rest of a page.
  *
  * EXPORTED FOR THE AUTHORING GATE, in the shape `installAgentEntryOf` established: failing
  * open means a typo is INVISIBLE in the rendered output — the page simply shows everything,
@@ -359,7 +368,7 @@ export function harnessBlocksBalanced(lines) {
  * the marker; the console has already filtered the block to the reader's host, so there the
  * label only repeats what the host selector says, and it goes with the marker.
  */
-const HOST_NAME = '(?:OpenCode|Claude Code|OpenClaude|IBM Bob)';
+const HOST_NAME = anyOf(Object.values(DOC_HOSTS).map((h) => h.name));
 const HOST_LABEL_RE = new RegExp(String.raw`^\s*\*\(${HOST_NAME}(?: and ${HOST_NAME})* only\)\*\s*$`);
 
 export function stripHarnessBlocks(body, harnessName) {
@@ -411,16 +420,14 @@ function visibleGroups(harnessName) {
   return groups;
 }
 
-// ---- slugs and section slicing ----------------------------------------------------------
+// ---- heading slugs -----------------------------------------------------------------------
 
 const SLUG_STRIP_RE = new RegExp(`[^a-z0-9${WHITESPACE}-]`, 'g');
 const SLUG_WS_RE = new RegExp(`[${WHITESPACE}]+`, 'g');
 const SLUG_DASH_RE = /-+/g;
-const HEADING_RE = /^(#{1,6})\s+(.+?)\s*$/;
 
 /**
- * The same rules the frontend's `slug()` uses, so a registry `anchor` written against a
- * heading matches the id the renderer assigns.
+ * The same rules the frontend's `slug()` uses for the id it gives a rendered heading.
  *
  * `WHITESPACE` and `stripWhitespace` rather than `\s` and `trim()` — see `WHITESPACE`'s own
  * docblock for the measured set of characters where this matters.
@@ -431,45 +438,6 @@ export function slugifyHeading(text) {
   return s.replace(/^-+|-+$/g, '');
 }
 
-/**
- * The body trimmed to one heading's section.
- *
- * Returns `[body, ok]`; `ok === false` (with the ORIGINAL body) when the anchor is
- * missing, so the caller falls back to the whole document. An H1 slice stops at the first
- * H2 — `max(level, 2)` — so it captures an intro paragraph rather than the whole file.
- */
-export function sliceSection(body, anchor) {
-  const lines = splitLines(body);
-  let start = -1;
-  let startLevel = 0;
-  let inFence = false;
-  for (let i = 0; i < lines.length; i += 1) {
-    const ln = lines[i];
-    if (ln.startsWith('```')) { inFence = !inFence; continue; }
-    if (inFence) continue;
-    const m = HEADING_RE.exec(ln);
-    if (!m) continue;
-    if (slugifyHeading(m[2]) === anchor) {
-      start = i;
-      startLevel = Math.max(m[1].length, 2);
-      break;
-    }
-  }
-  if (start < 0) return [body, false];
-  const out = [lines[start]];
-  inFence = false;
-  for (let j = start + 1; j < lines.length; j += 1) {
-    const ln = lines[j];
-    if (ln.startsWith('```')) { inFence = !inFence; out.push(ln); continue; }
-    if (inFence) { out.push(ln); continue; }
-    const m = HEADING_RE.exec(ln);
-    if (m && m[1].length <= startLevel) break;
-    out.push(ln);
-  }
-  while (out.length && out[out.length - 1].trim() === '') out.pop();
-  return [`${out.join('\n')}\n`, true];
-}
-
 // ---- the endpoints -----------------------------------------------------------------------
 
 function findDocPage(pageId) {
@@ -523,23 +491,20 @@ function glossary(state, page) {
  * what gates the github-shaped deep links in the UI. Both come from `originDisplay()`,
  * which shells out to `git remote get-url` (the `git` row in `ALLOWED_SPAWNS`).
  *
- * `version` IS NOT WHAT IT LOOKS LIKE, and it is the shape this page has always had rather than
- * a shortcut here. It reads a `version` key off the status snapshot and THERE IS NO SUCH KEY —
- * the snapshot spells the fingerprints `source_fp` / `installed_fp` / `version_verdict`. So the
- * field is `{}`, always, and `sd.version || {}` reproduces the EXPRESSION rather than the
- * constant: if the key ever appears, the page gains it without another edit.
+ * `version` carries the status snapshot's fingerprints under the names the About page reads.
+ * It used to read a `version` key the snapshot never had, so the page's build rows were
+ * always empty; the snapshot spells them `installed_fp` / `source_fp` / `version_verdict`.
  *
  * THERE IS NO INTERPRETER FIELD, and the absence is deliberate — see `apiSetup` in
  * `api.mjs`, which spells the same absence for the same reason.
- *
- * `statusData()` is called for one dead field, and deliberately: this page has always paid that
- * cost, and skipping it would answer faster in a way no gate measures and no user asked for.
  */
 function about(state) {
   const sd = statusData();
   const od = originDisplay();
   return {
-    version: sd.version || {},
+    version: {
+      installed_fp: sd.installed_fp, source_fp: sd.source_fp, verdict: sd.version_verdict,
+    },
     theme: state.theme,
     emit: state.emit,
     deployed: deployed(state),
@@ -590,18 +555,10 @@ export function apiDocsPage(state, pageId, harnessName = null) {
  */
 const KIND_ROUTES = {
   markdown: (state, pageId, page, hn) => {
-    let body = readDocSource(page.source);
-    let anchor = page.anchor ?? null;
-    // A successful slice drops the anchor: the heading is already at the top, so the
-    // client must not also try to scroll to it.
-    if (anchor && page.slice) {
-      const [sliced, ok] = sliceSection(body, anchor);
-      body = sliced;
-      if (ok) anchor = null;
-    }
-    body = rewriteDocLinks(stripHarnessBlocks(body, hn), page.source, idsByRel());
+    const body = rewriteDocLinks(stripHarnessBlocks(readDocSource(page.source), hn),
+      page.source, idsByRel());
     return { id: pageId, title: page.title, kind: 'markdown', body,
-      source: page.source, anchor, links: resolveLinks(state, body) };
+      source: page.source, links: resolveLinks(state, body) };
   },
   concept: (state, pageId, page, hn) => {
     const body = rewriteDocLinks(subCounts(state, stripHarnessBlocks(page.body ?? '', hn)),

package/js/web/handler.mjs

@@ -16,20 +16,16 @@ import { isTruthy, jsonDumpsCompact } from '../lib/json.mjs';
 import { parseIntStrict, percentDecode } from '../lib/text.mjs';
 import { preflight } from '../maintain/update.mjs';
 import { apiDeployCmd, apiInstallCmd, apiPickFolder, apiRestore, buildOverride, mcpTargetPaths } from './actions.mjs';
-import { NotFound, PREFIX_ROUTES, STATE_ROUTES } from './api.mjs';
+import { NotFound } from './catalog.mjs';
 import { openUrl, requestRestart } from './daemon.mjs';
 import { apiDocs, apiDocsPage } from './docs.mjs';
 import { actionCommands } from './jobs.mjs';
-import { POST_ROUTES, readJsonBody } from './routes.mjs';
+import { POST_ROUTES, PREFIX_ROUTES, STATE_ROUTES, readJsonBody } from './routes.mjs';
 import { isFile } from '../lib/fs.mjs';
 import { readFileSync, statSync } from 'node:fs';
 import { basename, dirname, extname, join, sep } from 'node:path';
 import { gzipSync } from 'node:zlib';
 
-// `isFile` is owned by `js/lib/fs.mjs` now (single owner). Re-exported here so
-// `js/web/server.mjs`'s existing `import { isFile, ... } from './handler.mjs'` keeps working.
-export { isFile };
-
 /**
  * DNS-rebinding guard. `h.split(":", 1)[0]` keeps everything before the FIRST colon, so
  * `localhost:4747` passes and a bare IPv6 literal would not — which is what the `[::1]`
@@ -45,6 +41,15 @@ const GZIP_TYPES = ['application/json', 'text/', 'image/svg+xml',
   'application/manifest+json', 'application/javascript'];
 const GZIP_MIN = 1024;
 
+/**
+ * The largest POST body read, in bytes. Every real body is a few KB of JSON (a rule, a profile,
+ * a path); without a cap any web page could `no-cors` POST an arbitrary blob and this process
+ * would buffer all of it before the token check refused it.
+ */
+export const MAX_BODY = 1024 * 1024;
+
+const BUSY = { error: 'a job is running — wait for it to finish (or cancel it) first' };
+
 const CTYPES = {
   '.html': 'text/html', '.js': 'text/javascript',
   '.css': 'text/css', '.json': 'application/json',
@@ -126,7 +131,11 @@ export function makeHandler(state, jm, token, dist, holder = null) {
   function doGet(req, res, path, ae) {
     const route = STATE_ROUTES[path];
     if (route !== undefined) return sendJson(res, route(state), 200, ae);
-    if (path === '/api/ping') return sendJson(res, { ok: true, theme: state.theme }, 200, ae);
+    // `pid` is what a restarting client waits on: the OLD server keeps answering this ping for
+    // a moment after `/api/restart` returns, and a reload onto it fetches the old token.
+    if (path === '/api/ping') {
+      return sendJson(res, { ok: true, theme: state.theme, pid: process.pid }, 200, ae);
+    }
     for (const [prefix, handler] of PREFIX_ROUTES) {
       if (path.startsWith(prefix)) return sendJson(res, handler(state, path), 200, ae);
     }
@@ -148,14 +157,22 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     return serveStatic(res, path, ae);
   }
 
-  function doPost(req, res, path, ae, body) {
+  /** The Host and token guards, answered BEFORE a byte of the body is read. `true` = refused. */
+  function refusePost(req, res, ae) {
     if (!localHost(req.headers.host)) {
-      return sendJson(res, { error: 'forbidden host' }, 403, ae);
+      sendJson(res, { error: 'forbidden host' }, 403, ae);
+      return true;
     }
     if (req.headers['x-geneseed-token'] !== token) {
-      return sendJson(res, { error: 'forbidden' }, 403, ae);
+      sendJson(res, { error: 'forbidden' }, 403, ae);
+      return true;
     }
+    return false;
+  }
+
+  function doPost(req, res, path, ae, body) {
     if (path === '/api/shutdown') {
+      if (jm.busy) return sendJson(res, BUSY, 409, ae);
       // The one POST route the SHELL owns. It must answer BEFORE it stops, so closing is
       // deferred to `res.on('finish', ...)` so the response flushes first.
       // `closeAllConnections` is the other half: `close()` alone waits for idle keep-alive
@@ -167,18 +184,17 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       return sendJson(res, { stopping: true }, 200, ae);
     }
     if (path === '/api/restart') {
-      // THE ONE ROUTE IN THIS FILE NO TEST MAY REACH, and it is declared rather than probed.
-      // `requestRestart` spawns a DETACHED `web restart`, which stops whatever daemon the
-      // record names and starts a fresh one that outlives the caller. Actually driving this
-      // route from a test would either stop the test's own server or, worse, orphan a real
-      // daemon that binds 4747 and serves the checkout forever in the developer's own
-      // environment.
-      //
-      // So the gate asserts this dispatches to `requestRestart(state.theme)` directly rather
-      // than by hitting the route through a live request — a declaration is not normally
-      // enough to stand in for a dispatcher, but here probing the dispatcher costs more than
-      // the assurance is worth.
-      requestRestart(state.theme);
+      // THE SUCCESS ARM NO TEST MAY REACH. `requestRestart` spawns a DETACHED `web restart`,
+      // which stops whatever daemon the record names and starts a fresh one that outlives the
+      // caller — driven from a test, it would orphan a real daemon on 4747 in the developer's
+      // own environment. Its two REFUSALS are reachable and probed: a running job (409, it
+      // would be orphaned), and a server that is not the recorded daemon (409, see
+      // `requestRestart`) — which a test's server never is.
+      if (jm.busy) return sendJson(res, BUSY, 409, ae);
+      if (!requestRestart(state.theme)) {
+        return sendJson(res,
+          { error: 'foreground server: restart it from its terminal' }, 409, ae);
+      }
       return sendJson(res, { restarting: true }, 200, ae);
     }
     if (path === '/api/reveal') {
@@ -277,6 +293,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
         return sendJson(res,
           { precondition: pre.code, kind: pre.kind, message: pre.message }, 422, ae);
       }
+      // `requestRestart` declines on a foreground server, which then shows its stale banner.
       const jid = jm.start('update', actionCommands('update'), (rc) => {
         state.refresh();
         if (rc === 0) requestRestart(state.theme);
@@ -336,12 +353,19 @@ export function makeHandler(state, jm, token, dist, holder = null) {
         }
       }
       if (req.method === 'POST') {
-        // The body is drained before routing regardless of what the route needs it for:
-        // `readJsonBody` needs the bytes for a real POST body, and Node's own HTTP parser
-        // owns the message boundary anyway — unread bytes are discarded when the response
-        // ends rather than mis-parsed as the next request line, so this is where the bytes
-        // have to come from either way.
+        // GUARDS FIRST, BODY SECOND. The Host and token checks need no body, so they answer
+        // before one is read — a refused request is DISCARDED (`resume`, nothing buffered), never
+        // collected. A body over `MAX_BODY` is refused on its declared length, and the socket is
+        // closed rather than drained. Otherwise the body is buffered before routing regardless
+        // of what the route needs it for: Node's parser owns the message boundary, so unread
+        // bytes are discarded when the response ends rather than mis-parsed as the next request.
+        if (refusePost(req, res, ae)) return req.resume();
         const length = parseIntStrict(String(req.headers['content-length'] ?? '')) ?? 0;
+        if (length > MAX_BODY) {
+          res.setHeader('Connection', 'close');
+          sendJson(res, { error: `request body over ${MAX_BODY} bytes` }, 413, ae);
+          return req.resume();
+        }
         return readBody(req, length, (buf) => {
           req._body = buf;
           try {

package/js/web/jobs.mjs

@@ -91,6 +91,7 @@ import { setupBuildArgs } from '../build/generate.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 import { isDict } from '../hosts/mcp.mjs';
 import { readText, writeText, isFile } from '../lib/fs.mjs';
+import { which } from '../lib/paths.mjs';
 import { jsonDumpsCompact, parseJson, isTruthy } from '../lib/json.mjs';
 
 /**
@@ -103,7 +104,10 @@ function killJobTree(child) {
   try {
     if (process.platform === 'win32') {
       // The one machine primitive with no Node equivalent — see this module's header.
-      spawnSync('taskkill', ['/T', '/F', '/PID', String(child.pid)], {
+      // `which`, never a bare name (cwd-first on Windows); none on PATH → `child.kill()` below.
+      const taskkill = which('taskkill');
+      if (!taskkill) throw new Error('taskkill not on PATH');
+      spawnSync(taskkill, ['/T', '/F', '/PID', String(child.pid)], {
         timeout: 15000, windowsHide: true, stdio: 'ignore',
       });
     } else {
@@ -210,8 +214,13 @@ export class JobManager {
     }
   }
 
+  /**
+   * Persist the newest `HISTORY_MAX` finished jobs — and DROP the rest from memory too. The
+   * file was always capped; `_jobs` was not, so a daemon left running for weeks held every job
+   * it ever ran, each with up to `MEM_CAP` chars of output. Memory now holds what the file
+   * holds, plus whatever is running (which `_run` saves again when it finishes).
+   */
   _saveHistory() {
-    if (!this._historyPath) return;
     const jobs = [...this._jobs.values()].filter((j) => j.status !== 'running')
       .map((j) => ({ ...j }));
     // STABLE sort matters: two jobs started inside the same clock tick keep insertion
@@ -219,11 +228,24 @@ export class JobManager {
     jobs.sort((a, b) => (Number(a.started ?? 0) || 0) - (Number(b.started ?? 0) || 0));
     const kept = jobs.slice(-JobManager.HISTORY_MAX)
       .map((j) => ({ ...j, output: tailChars(String(j.output), JobManager.OUTPUT_CAP) }));
+    const keep = new Set(kept.map((j) => String(j.id)));
+    for (const [id, j] of this._jobs) {
+      if (j.status !== 'running' && !keep.has(id)) this._jobs.delete(id);
+    }
+    if (!this._historyPath) return;
     try {
       writeText(this._historyPath, jsonDumpsCompact(kept, { bareInts: true }));
     } catch { /* a console that cannot persist its history still runs */ }
   }
 
+  /**
+   * A job is running. `/api/shutdown` and `/api/restart` refuse while it is: a running job is
+   * not persisted, and stopping the server under it orphans the child and loses its record.
+   */
+  get busy() {
+    return this._busy;
+  }
+
   /** Last `n` jobs, oldest first — the order the console appends in. */
   recent(n = JobManager.HISTORY_MAX) {
     const jobs = [...this._jobs.values()]

package/js/web/routes.mjs

@@ -1,10 +1,12 @@
 /**
  * WHAT THE WEB API ANSWERS — as a declaration, separate from the dispatcher that honours it.
  *
- * Two tables and two inline lists. They are not documentation: `tests/unit/web_server.test.mjs`
- * holds their union against a surface list written out in the test, and probes the real handler,
- * because a declaration is not a dispatcher — a route can be declared here and missing from the
- * dispatch, and nothing but a probe notices.
+ * Four tables and two inline lists. The two GET tables (`STATE_ROUTES`, `PREFIX_ROUTES`) used
+ * to live in `api.mjs`, which made it import every route module that also imported it. None of
+ * this is documentation: `tests/unit/web_server.test.mjs` holds their union against a surface
+ * list written out in the test, and probes the real handler, because a declaration is not a
+ * dispatcher — a route can be declared here and missing from the dispatch, and nothing but a
+ * probe notices.
  *
  * This file used to also carry the Python→Node port's NOT_PORTED / DECLINED partition — five
  * sets, all empty once the port finished. They were deleted when the port bookkeeping retired
@@ -15,8 +17,15 @@
  * expose X?", which has nothing to do with sockets, daemons or gzip.
  */
 import { formatValue, isTruthy, parseJson } from '../lib/json.mjs';
-import { apiExcludesMutate, apiInstallToggle, apiLoopsPresetMutate, apiMcpToggle, apiMemoryDelete, apiProfileSave, apiRulesMutate, apiRulesPromote, apiSelectView } from './actions.mjs';
-import { apiActivityToggle } from './activity.mjs';
+import { percentDecode } from '../lib/text.mjs';
+import { apiExcludesMutate, apiInstallToggle, apiLoopsPresetMutate, apiMcp, apiMcpToggle, apiMemoryDelete, apiSelectView } from './actions.mjs';
+import { apiActivity, apiActivityDetail, apiActivityToggle } from './activity.mjs';
+import {
+  apiDiff, apiDoctor, apiExcludes, apiInstalls, apiLoops, apiLoopsActive, apiOverview,
+  apiRecent, apiSetup, apiThemes,
+} from './api.mjs';
+import { NotFound, apiCatalog, apiItem } from './catalog.mjs';
+import { apiProfile, apiProfileSave, apiRules, apiRulesMutate, apiRulesPromote } from './user-files.mjs';
 
 /**
  * The POSTs this daemon answers — and this table IS the dispatch, not a declaration beside
@@ -102,3 +111,49 @@ export function readJsonBody(buf) {
   return (obj !== null && typeof obj === 'object' && obj.constructor === Object) ? obj : {};
 }
 
+/**
+ * The prefix routes — path in, response out.
+ *
+ * `percentDecode` and not `decodeURIComponent`: the JS builtin throws a `URIError` on a `%`
+ * that is not an escape, where this shell instead answers a 404 naming the literal text.
+ */
+export const PREFIX_ROUTES = [
+  ['/api/catalog/', (state, p) => apiCatalog(state, p.split('/').pop())],
+  // /api/item/<type>/<name> — TYPE has no slash, the NAME keeps its slashes so a wiki
+  // page's relpath survives. A missing name is a 404 here rather than a 500 two frames down.
+  ['/api/item/', (state, p) => {
+    const m = /^\/api\/item\/([^/]+)\/(.+)$/.exec(p);
+    if (!m) throw new NotFound(p);
+    return apiItem(state, m[1], percentDecode(m[2]));
+  }],
+  // The sid is passed through unquoted — `apiActivityDetail`'s safe-name scheme is what
+  // makes the lookup safe, rather than a check out here.
+  ['/api/activity/', (state, p) => apiActivityDetail(
+    state, percentDecode(p.slice('/api/activity/'.length)))],
+];
+
+/**
+ * A literal path to `api_X(state)`, table-keyed rather than a chain of `if`s — the reason
+ * it is a table is `tests/unit/web_server.test.mjs`'s cross-check, which requires this
+ * table plus `PREFIX_ROUTES` and `GET_INLINE` to equal a surface list written out in the
+ * test, so a route cannot appear or vanish unenumerated.
+ */
+export const STATE_ROUTES = {
+  '/api/overview': apiOverview,
+  '/api/recent': apiRecent,
+  '/api/themes': apiThemes,
+  '/api/setup': apiSetup,
+  '/api/doctor': apiDoctor,
+  '/api/installs': apiInstalls,
+  '/api/excludes': apiExcludes,
+  '/api/profile': apiProfile,
+  '/api/diff': apiDiff,
+  '/api/activity': apiActivity,
+  // `/api/rules` must exist as a PAIR with its POST: `apiRulesMutate` splices `parseRules`'
+  // line indices, and the fingerprint every mutation must send back is what this GET
+  // answers — a daemon whose POST worked and whose GET 501'd would have no way to obtain one.
+  '/api/rules': apiRules,
+  '/api/mcp': apiMcp,
+  '/api/loops': apiLoops,
+  '/api/loops/active': apiLoopsActive,
+};

package/js/web/server.mjs

@@ -23,13 +23,13 @@
  * surface now lives in `js/web/routes.mjs` and `tests/unit/web_server.test.mjs`.
  */
 import { GLOBAL_MANIFEST, resolvePath } from '../hosts/hosts.mjs';
-import { printOut } from '../lib/fs.mjs';
+import { isFile, printOut } from '../lib/fs.mjs';
 import { which } from '../lib/paths.mjs';
 import { parseIntStrict } from '../lib/text.mjs';
-import { promptLine } from '../maintain/setup.mjs';
-import { webState } from './api.mjs';
+import { promptLine } from '../lib/prompt.mjs';
+import { webState } from './state.mjs';
 import { clearDaemon, codeStamp, openUrl, readDaemon, restartDaemon, startDaemon, statusDaemon, stopDaemon, writeDaemon } from './daemon.mjs';
-import { isFile, makeHandler } from './handler.mjs';
+import { makeHandler } from './handler.mjs';
 import { JobManager } from './jobs.mjs';
 import { spawnSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';

package/js/web/state.mjs

@@ -0,0 +1,138 @@
+/**
+ * `WebState` — the resolved view of the deployed harness every endpoint reads from.
+ *
+ * Its own module so that `daemon.mjs`, which needs only `webState(theme).target`, does not load
+ * every read endpoint to get it (it imported all of `api.mjs` for this one factory). It still
+ * reaches `catalog.mjs`, for the inventory it caches.
+ */
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+import { opencodeConfigDir } from '../hosts/hosts.mjs';
+import {
+  footprintOfDir, installedDefaults, modeOfDir, postureOfDir, themeOfDir, trustOfDir,
+} from '../hosts/installs.mjs';
+import { doctorCollect } from '../inspect/doctor.mjs';
+import { DEFAULT_PRESET } from '../loop/score.mjs';
+import { readText, isFile } from '../lib/fs.mjs';
+import { stripWhitespace } from '../lib/text.mjs';
+import { inventoryFor } from './catalog.mjs';
+
+/**
+ * `YYYY-MM-DD HH:MM`, LOCAL time — `toISOString` would be UTC, which reads wrong in every
+ * timezone but one for a user-facing timestamp.
+ */
+export function stampMinute(ms) {
+  const d = new Date(ms);
+  const p2 = (n) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${p2(d.getMonth() + 1)}-${p2(d.getDate())} `
+    + `${p2(d.getHours())}:${p2(d.getMinutes())}`;
+}
+
+// ---- WebState ---------------------------------------------------------------------------
+
+/**
+ * The resolved view of the deployed harness a request reads from.
+ *
+ * A factory returning a plain object rather than a class, because the two cached
+ * properties are the only behaviour and a getter pair expresses them without ceremony.
+ * THE CACHING IS BEHAVIOUR, NOT AN OPTIMISATION: `doctorCollect` renders a theme per call
+ * and the console GETs `/api/overview` on mount and again after every mutation, so an
+ * uncached `doctor` would put a full build on each of those requests. `refresh()` is what a mutation calls to
+ * drop both.
+ */
+export function webState(theme = null, target = null) {
+  const st = {
+    // NOT resolved: `target` is printed by three endpoints, so resolving it here would
+    // change what they answer.
+    target: target || opencodeConfigDir(),
+    root: null,
+    theme: null,
+    emit: null,
+    footprint: null,
+    posture: null,
+    mode: null,
+    trust: null,
+    _inv: null,
+    _doctor: null,
+  };
+  // The INSTALL ROOT (== build --out). For globals it IS the data dir; a claude/bob
+  // PROJECT install keeps its data under <repo>/.claude while the markers land at <repo>/.
+  st.root = st.target;
+  st.theme = theme || themeOfDir(st.target) || 'neutral';
+  st.emit = installedDefaults().emit || 'opencode-global';
+  // The install's sigils, each defaulted when its marker is absent (footprint to 'full').
+  // Read from the ROOT, where every emit writes them.
+  const readMarkers = () => {
+    st.footprint = footprintOfDir(st.root);
+    st.posture = postureOfDir(st.root) || 'peer';
+    st.mode = modeOfDir(st.root) || 'direct';
+    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
+  };
+  readMarkers();
+
+  Object.defineProperty(st, 'inventory', {
+    get() {
+      if (st._inv === null) st._inv = inventoryFor(st);
+      return st._inv;
+    },
+  });
+  Object.defineProperty(st, 'doctor', {
+    get() {
+      if (st._doctor === null) {
+        const [, problems] = doctorCollect({ theme: st.theme });
+        st.stampDoctor(problems);
+      }
+      return st._doctor;
+    },
+  });
+  st.stampDoctor = (problems) => {
+    st._doctor = { ok: !problems.length, problems, checked_at: stampMinute(Date.now()) };
+  };
+  /**
+   * The CURRENT install's mode, from its `.geneseed-emit` marker: the ROOT first (where
+   * every emit writes it), then the data dir.
+   *
+   * `refresh()` below MUST call this: without it, `emit` goes stale after any write that
+   * re-themes or re-points the install, since the constructor only reads it once via
+   * `installedDefaults()`.
+   */
+  st.detectEmit = () => {
+    for (const d of [st.root, st.target]) {
+      try {
+        const em = path.join(d, '.geneseed-emit');
+        if (isFile(em)) {
+          const v = stripWhitespace(readText(em));
+          if (v) return v;
+        }
+      } catch { /* unreadable marker: try the next candidate */ }
+    }
+    return existsSync(path.join(st.root, 'CLAUDE.md')) ? 'claude-global' : 'opencode-global';
+  };
+  /**
+   * Re-point the console at another detected install's data dir.
+   *
+   * `root` is the install ROOT the markers and sigils live at. It defaults to `target` and
+   * differs only for claude/bob/openclaude PROJECT installs, where the data sits under
+   * `<repo>/.claude|.bob|.openclaude` while `.geneseed-emit`/`-theme`/`-footprint` land at
+   * `<repo>/` — reading them from the data dir mis-detects the install as opencode/neutral,
+   * and a Diff or a Restore would then overwrite it in the wrong dialect.
+   */
+  st.selectView = (target, root = null) => {
+    st.target = target;
+    st.root = root || target;
+    st.theme = themeOfDir(st.root) || themeOfDir(st.target) || 'neutral';
+    st.emit = st.detectEmit();
+    readMarkers();
+    st._inv = null;
+    st._doctor = null;
+  };
+  st.refresh = () => {
+    st._inv = null;
+    st._doctor = null;
+    st.theme = themeOfDir(st.root) || themeOfDir(st.target) || st.theme;
+    st.emit = st.detectEmit() || st.emit;
+    readMarkers();
+  };
+  return st;
+}