geneseed 3.13.0 → 3.15.0

package/js/build/emit-claude.mjs

@@ -14,10 +14,11 @@ import {
   unwireClaudeExcludes, unwireClaudeSettings, wireClaudeExcludes,
 } from '../hosts/settings.mjs';
 import { writeText } from '../lib/fs.mjs';
-import { isTruthy } from '../lib/json.mjs';
+import { get, isDict, isTruthy } from '../lib/json.mjs';
+import { relPosix } from '../lib/text.mjs';
 import { assertSourceComplete, phaseLog } from './bundle.mjs';
 import {
-  get, globalMemory, globalNotebook, isDict, relPosix, shipLeanLaws, stripCapabilityLinks,
+  globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
 import { renderAll, renderFile } from './render.mjs';
 import {
@@ -40,7 +41,7 @@ import { existsSync, mkdirSync } from 'node:fs';
  * Six emits route through here — claude, bob and openclaude at both scopes — so this one
  * job is what puts two thirds of the matrix on the seam.
  *
- * `claudeMdText` is the payload's one item that is not a file this process wrote. WIRE
+ * `claudeMdText` is the one product of this render that is not a file it writes. WIRE
  * needs the managed block's text, and that text is a RENDER (`prefixedAgentText`
  * re-renders AGENT.md with every store dir prefixed), so it is computed here and merged
  * there. `emitOpencodeRender` needed nothing of the kind — its wired file is derived from
@@ -174,8 +175,6 @@ export function emitClaudeRender(cfg, job) {
     stats: { nAgents, nSkills },
     memStatus,
     nbStatus,
-    hasAgentText: agentText !== null,
-    claudeMdText,
     managed,
   };
 }
@@ -264,7 +263,7 @@ function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRu
   // travels from `cfg` rather than being re-read off the deployment: this is the emit that
   // DECIDES the install's packs, so the marker on disk is still the previous build's.
   const [, managedHooks] = mergeClaudeSettings(
-    settingsPath, scope, oldSf === settingsName ? get(old, 'settings_hooks') : null, hookOpts,
+    settingsPath, oldSf === settingsName ? get(old, 'settings_hooks') : null, hookOpts,
     doctrines, excludeRules, host, cfgDir,
   );
   managed.settings_hooks = managedHooks;

package/js/build/emit-common.mjs

@@ -10,18 +10,11 @@
  * `emit-claude.mjs` do that; `bundle.mjs` renders the bundle they read from.
  */
 import path from 'node:path';
-import { copyFile, writeText, isFile, isDir } from '../lib/fs.mjs';
-import { get, isDict } from '../lib/json.mjs';
+import { copyFile, writeText, isDir } from '../lib/fs.mjs';
+import { relPosix } from '../lib/text.mjs';
 import { SRC_DIR_TOKENS, destRel } from './render.mjs';
 import { mkdirSync, readdirSync, cpSync } from 'node:fs';
 
-// `isFile`/`isDir`/`get`/`isDict` are owned by `js/lib` now (single owner across `hosts/`,
-// `build/`, `inspect/` and `web/` — layering forbids `build/` reaching into `inspect/scan.mjs`
-// for them, so `js/lib` is the one home both sides can reach). Re-exported here so this
-// module's own existing callers (`emit-claude.mjs`, `emit-opencode.mjs`, `version.mjs`,
-// `bundle.mjs`) keep importing them from `./emit-common.mjs` unchanged.
-export { isFile, isDir, get, isDict };
-
 /** `_build_render.SRC_DIRS_MARKER`. */
 export const SRC_DIRS_MARKER = '.geneseed-srcdirs.json';
 /**
@@ -79,11 +72,6 @@ export function rglobFiles(root) {
     .map((d) => path.join(d.parentPath, d.name));
 }
 
-/** `p.relative_to(base).as_posix()`. */
-export function relPosix(base, p) {
-  return path.relative(base, p).split(path.sep).join('/');
-}
-
 /**
  * `_build_emit._strip_capability_links` — `re.sub(r"\1")`, so the pattern needs `g`.
  *

package/js/build/emit-opencode.mjs

@@ -8,16 +8,17 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
+import { claimer, loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
 import {
   copyPlugins, copyWorkflows, ensureAgentOverridesStub, writeColorThemes, writeCommandLayer,
   writePonytailCommand, writePrimaryAgent, writeTheme,
 } from '../hosts/opencode.mjs';
 import { mergeOpencodeJson } from '../hosts/settings.mjs';
-import { readText, writeText } from '../lib/fs.mjs';
+import { isFile, readText, writeText } from '../lib/fs.mjs';
+import { relPosix } from '../lib/text.mjs';
 import { assertSourceComplete, build, phaseLog } from './bundle.mjs';
 import {
-  globalMemory, globalNotebook, isFile, relPosix, shipLeanLaws, stripCapabilityLinks,
+  globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
 import { renderAll } from './render.mjs';
 import {
@@ -56,17 +57,20 @@ function opencodeLayer(cfg, items, themeName, theme, dir, owned, opts) {
   } = opts;
   ensureAgentOverridesStub(cfg, overridesDir);
   const overrides = loadAgentOverrides(overridesDir);
+  // One claim for every writer below whose path lands in `owned` — see `claimer`.
+  const claim = claimer(oldOwned, dir, manifestExisted);
 
   const { nAgents, nSkills, written } = writeNativeLayer(
     items, path.join(dir, 'agents'), path.join(dir, 'skills'), overrides,
-    { host: 'opencode', oldOwned, cfg: dir, manifestExisted, theme, src: cfg.src });
+    { host: 'opencode', theme, src: cfg.src, claim });
   for (const p of written) owned.push(relPosix(dir, p));
 
-  const primary = writePrimaryAgent(cfg, path.join(dir, 'agents'), overrides);
+  const primary = writePrimaryAgent(cfg, path.join(dir, 'agents'), overrides, claim);
   if (primary) owned.push(relPosix(dir, primary));
 
-  const commands = writeCommandLayer(cfg, items, path.join(dir, 'command'));
-  commands.push(writePonytailCommand(path.join(dir, 'command')));   // always-on /ponytail
+  const commands = writeCommandLayer(cfg, items, path.join(dir, 'command'), claim);
+  const ponytail = writePonytailCommand(path.join(dir, 'command'), claim);   // always-on /ponytail
+  if (ponytail) commands.push(ponytail);
   for (const p of commands) owned.push(relPosix(dir, p));
 
   owned.push(relPosix(dir, writeTheme(path.join(dir, 'themes'), themeName, theme)));
@@ -97,7 +101,7 @@ function opencodeLayer(cfg, items, themeName, theme, dir, owned, opts) {
  * manifest is the DRIVER's stage: it reads the file, hands the prior claim in, and prunes
  * and rewrites it after this returns. One owner of the file, and this function is not it.
  *
- * `nativeCatalog` likewise arrives decided. It is `HOSTS['opencode']['native_catalog']` from
+ * `nativeCatalog` likewise arrives decided. It is `hostCatalogsNatively('opencode')` from
  * `js/hosts/hosts.mjs`, resolved by the driver before the call; passing the decision rather
  * than re-reading the registry keeps one owner of it.
  */

package/js/build/generate.mjs

@@ -9,25 +9,27 @@
  * WHY `build` IMPORTS THE DRIVER RATHER THAN SPAWNING IT. The Python is
  * `run([sys.executable, BUILD, *extra]).returncode` — a passthrough to a second process.
  * Reproducing that shape here would mean spawning `node bin/build-driver.mjs`, and
- * `test_the_cli_reaches_no_child_process_module` forbids it: the ban is transitive over this
- * entry's imports, and P5c's argument for keeping it is that `web`, `upgrade` and `setup`
- * will genuinely need to spawn, so the ban should outlive them rather than be dismantled by
- * a verb that does not. It is also the wrong shape on its own terms. Python needs a second
+ * `tests/unit/hook_cli.test.mjs`'s 'the CLI entry reaches child_process only where it is
+ * declared' forbids it: the check is transitive over this entry's imports and allow-lists only
+ * the modules that genuinely start processes — `web`, `upgrade`, `setup` — and P5c's argument
+ * for it is that the ban should outlive them rather than be dismantled by a verb that does not.
+ * It is also the wrong shape on its own terms. Python needs a second
  * process because `build.py` is a different PROGRAM; `bin/build-driver.mjs` is a module in this
  * one, and a Node CLI spawning a Node driver to do work it could do in-process is exactly
  * the passthrough the whole port has been removing. So the driver's `main` is exported and
  * called directly, and the observable contract — the tree, the streams, the exit code — is
- * what `build/*` in `tests/harness_golden.py` compares.
+ * what the `build/*` cells of `tests/golden.mjs --cli` assert.
  *
  * WHAT NO CELL CAN REACH HERE, stated rather than left implicit. `fenceFor`'s real arm is
  * unreachable from the matrix: measured over the whole rendered tree, the longest backtick
  * run in any source text is 3, so `max(4, longest + 1)` picks 4 for all 96 files, and a port
  * that hardcoded four backticks is byte-identical in every prompt cell. Reaching the other
  * arm needs a file in `src/`, and `src/` is the tree no fixture can redirect (P5d). It is
- * therefore gated as a pure function over a corpus in `tests/snapshot/pure_snapshot.test.mjs`, with the
- * unreachability measured in BOTH directions rather than asserted: one test proves the corpus
- * leaves the floor, and one re-renders every theme × posture × mode of the live tree and proves
- * `src/` still does not. The 96 above is one render — the sweep is 13 440 files.
+ * the former Python suite gated it as a pure function over a corpus, with the unreachability
+ * measured in BOTH directions rather than asserted: one test proved the corpus left the floor,
+ * and one re-rendered every theme × posture × mode of the live tree and proved `src/` still did
+ * not. The 96 above is one render — the sweep was 13 440 files. That suite is gone and no Node
+ * test calls `fenceFor`, so the real arm is pinned by nothing today.
  */
 import { existsSync, mkdirSync, statSync } from 'node:fs';
 import path from 'node:path';
@@ -171,7 +173,7 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
  * A pre-marker install still has a (host, scope), which is what the walk found it by, so it
  * is rebuilt in its own mode rather than defaulted to OpenCode.
  */
-export const DEFAULT_EMIT = new Map([
+const DEFAULT_EMIT = new Map([
   ['opencode global', 'opencode-global'], ['opencode project', 'opencode'],
   ['claude global', 'claude-global'], ['claude project', 'claude'],
   ['bob global', 'bob-global'], ['bob project', 'bob'],
@@ -202,7 +204,7 @@ export function installProfile(host, scope, root) {
   const posture = postureOfDir(root) || defaultPosture();
   const mode = modeOfDir(root) || defaultMode();
   // Read off the deployed loop skill; no config fallback — `DEFAULT_PRESET` is the engine's.
-  const trust = trustOfDir(root) || DEFAULT_PRESET;
+  const trust = trustOfDir(root, host) || DEFAULT_PRESET;
   // A rebuild that defaulted the pack selection would re-emit an install into a constitution
   // its owner did not choose — and in one direction that is not merely surprising: dropping
   // the process pack takes the commit/push consent RULES out of AGENT.md while
@@ -360,7 +362,9 @@ export function buildPrompt(cfg, themeName) {
  * Windows. At ~10,000 newlines in a 400 KB document that is the largest byte difference this
  * port could ship, and `harness_golden` can only see half of it — the FILE half is compared
  * directly, the stdout half is folded by `subprocess`'s universal-newline decode, which is
- * why `test_the_two_entry_points_agree_on_stdout_BYTES` grew a `prompt` row.
+ * why the former Python suite's stdout-bytes comparison grew a `prompt` row — kept today as
+ * a row of `tests/unit/hook_cli.test.mjs`'s 'every newline the entry points write is the
+ * platform's'.
  */
 export function cmdPrompt(args) {
   // `args.theme or "neutral"` — a literal in the Python, NOT the config's theme, so this
@@ -483,7 +487,10 @@ export function cmdTheme(args) {
     written.push(dest);
   }
   printOut(`[theme] wrote ${written.map((p) => path.basename(p)).join(', ')} to ${destDir}\n`);
-  printOut(`[theme] select in OpenCode with: /theme ${full}`
-    + (args.solidOnly ? '' : `  (or /theme ${full}-transparent)`) + '\n');
+  // The hint names what was WRITTEN: `--transparent-only` writes no `${full}.json`, and a
+  // hint selecting it would point OpenCode at a theme that does not exist.
+  const [first, ...rest] = written.map((p) => path.basename(p, '.json'));
+  printOut(`[theme] select in OpenCode with: /theme ${first}`
+    + rest.map((n) => `  (or /theme ${n})`).join('') + '\n');
   return 0;
 }

package/js/build/render.mjs

@@ -8,7 +8,7 @@
  *
  * WHY THIS HALF AND NOT MORE. The emits split into five stages —
  * RENDER* -> WIRE* -> PRUNE -> MANIFEST -> VERIFY (see `_build_global._emit_claude_core`
- * and tests/test_emit_phase_order.py). RENDER produces files Geneseed owns wholesale;
+ * and tests/unit/emit_phase_order.test.mjs). RENDER produces files Geneseed owns wholesale;
  * WIRE reconciles files the user co-owns (settings.json, opencode.json, the CLAUDE.md
  * managed block) and lives in `js/hosts/settings.mjs`, driven from the two emit modules.
  * THIS module is only RENDER
@@ -34,7 +34,7 @@ import { readText } from '../lib/fs.mjs';
 import { parseJson } from '../lib/json.mjs';
 import { normcase, comparePaths } from '../lib/paths.mjs';
 // `js/build/source.mjs` imports nothing but node builtins, so this direction cannot cycle.
-import { PACK_ORDER, readPackText, resolveRuleIds } from './source.mjs';
+import { PACK_ORDER, readPackText, resolveRuleIds, ruleCanon } from './source.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 
 /** Document STRUCTURE is theme-INDEPENDENT — mirrors `_build_render.STRUCTURE`. */
@@ -86,7 +86,7 @@ const CATALOG_BLOCK_RE =
 // truncation — the objection `docs/token-footprint.md` raised against terse-ing the
 // Ontology ("four orphan sentences") is answered by authoring the short form, not
 // generating it. Same marker grammar as CATALOG so the two stay learnable as one idea.
-const LEAN_BLOCK_RE =
+export const LEAN_BLOCK_RE =
   /[ \t]*<!-- LEAN:begin -->\n(?<full>[\s\S]*?)[ \t]*<!-- LEAN:else -->\n(?<lean>[\s\S]*?)[ \t]*<!-- LEAN:end -->\n/g;
 
 /**
@@ -184,7 +184,7 @@ function resolveLean(text, footprint) {
  * match is a corner both engines implement, and the leading '' Python produces when the
  * text starts with a heading is load-bearing (it becomes `blocks[0]`, the preamble).
  */
-function splitAtLawHeadings(text) {
+export function splitAtLawHeadings(text) {
   const out = [];
   let start = 0;
   for (let i = 0; i < text.length; i++) {
@@ -310,12 +310,8 @@ function activeDoctrines(cfg) {
   // interpret. Dropped here rather than in `doctrinesBody` so `DOCTRINES_LIST` — the
   // `Active packs:` marker a later reader parses back — agrees with what was rendered.
   const excluded = new Set(cfg.excludeRules ?? []);
-  const survives = (pack) => {
-    const ids = [...readPackText(path.join(dir, `${pack}.md`))
-      .matchAll(/^### \{\{DOCTRINE\}\} ([a-z]+) (\d+)\b/gm)]
-      .map((m) => `${m[1]}.${Number(m[2])}`);
-    return ids.some((id) => !excluded.has(id));
-  };
+  const { rules } = ruleCanon(cfg.src);
+  const survives = (pack) => rules.some((r) => r.pack === pack && !excluded.has(`${pack}.${r.n}`));
   return PACK_ORDER.filter((p) => wanted.includes(p)).filter(survives);
 }
 

package/js/build/source.mjs

@@ -20,9 +20,9 @@
  * `capabilityLinkRe`'s equivalent override in `stripCapabilityLinks` had no producer either
  * and was deleted outright in the over-engineering cleanup, `cfg` param and all.
  *
- * The move is safe for the reason P5c's was: `tests/golden.py` drives `bin/build-driver.mjs`
- * over 259 cells and compares the tree byte-for-byte, and every one of them builds a cfg
- * from these paths. A depth error or a renamed key fails 259 cells, not zero.
+ * The move is safe for the reason P5c's was: `tests/golden.mjs` drives `bin/build-driver.mjs`
+ * over every emit configuration and requires each to render, and every one of them builds a
+ * cfg from these paths. A depth error or a renamed key fails every cell, not zero.
  */
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
@@ -38,7 +38,7 @@ import { DEFAULT_PRESET } from '../loop/score.mjs';
  * on raw or folded text, so one behaviour serves both.
  */
 const _packTexts = new Map();
-export function readRawText(file) {
+function readRawText(file) {
   const key = path.resolve(file);
   const mtime = statSync(file).mtimeMs;
   const hit = _packTexts.get(key);
@@ -160,8 +160,8 @@ export function resolveRuleIds(text, src = SRC) {
  * `_OWNED` redirect the suite uses is an in-process write, and no env var moves it
  * (`$GENESEED_ROOT` is `harness context`'s doc-discovery root — a different name for a
  * different job). Both implementations therefore answer from their own file's location,
- * which is what makes them comparable and what makes them unfenceable. See the
- * status/version section of `tests/harness_golden.py`.
+ * which is what made them comparable and what makes them unfenceable. See
+ * `js/inspect/status.mjs`'s header for what that leaves unreachable from any cell.
  */
 export const ROOT = path.resolve(import.meta.dirname, '../..');
 export const SRC = path.join(ROOT, 'src');
@@ -222,7 +222,8 @@ export const PACK_ORDER = ['craft', 'rigor', 'ops', 'process', 'comms'];
  * The ONE enumerator, for the same arithmetic reason `PACK_ORDER` is one array: the CLI
  * flag, the console's trust boundary and the doctor all have to close `--exclude-rules`
  * against the SAME set, and a second copy is a set that drifts by one rule the day a pack
- * grows. Read from the UNRENDERED source (`### {{DOCTRINE}} <pack> <n>`) rather than from a
+ * grows. Read off `ruleCanon` — the same declarations, in the same order, that the render
+ * numbers its headings from and the doctor validates citations against — rather than from a
  * built tree, because an address is a property of the source and the rendered heading is
  * themed — fourteen spellings of a thing that must compare equal to itself.
  *
@@ -232,16 +233,7 @@ export const PACK_ORDER = ['craft', 'rigor', 'ops', 'process', 'comms'];
  * were ever out of order, and disagree in the direction that reads as correct.
  */
 export function knownRuleIds() {
-  const out = [];
-  for (const pack of PACK_ORDER) {
-    const file = path.join(SRC, 'doctrines', `${pack}.md`);
-    let text = '';
-    try { text = readPackText(file); } catch { continue; }
-    for (const m of text.matchAll(/^### \{\{DOCTRINE\}\} ([a-z]+) (\d+)\b/gm)) {
-      if (m[1] === pack) out.push(`${pack}.${Number(m[2])}`);
-    }
-  }
-  return out;
+  return ruleCanon(SRC).rules.filter((r) => r.kind === 'DOCTRINE').map((r) => `${r.pack}.${r.n}`);
 }
 
 /**

package/js/build/stubs.mjs

@@ -9,8 +9,9 @@
  */
 import path from 'node:path';
 import { writeText } from '../lib/fs.mjs';
+import { isDir } from '../lib/fs.mjs';
 import { jsonDumpsIndent } from '../lib/json.mjs';
-import { isDir } from './emit-common.mjs';
+import { EXCLUDES_FILE } from '../hosts/hosts.mjs';
 import { existsSync } from 'node:fs';
 
 // ---------------------------------------------------------------------------
@@ -102,8 +103,8 @@ usually one promoted from a recurring memory. Review it by that date, then
 graduate it (remove the marker) or demote it back to memory.
 `;
 
-/** `_build_render.EXCLUDES_FILE`. */
-export const EXCLUDES_FILE = 'excludes.json';
+// Owned by `js/hosts/hosts.mjs` (the hook reads it there); re-exported for `js/inspect/excludes.mjs`.
+export { EXCLUDES_FILE };
 
 /**
  * `_build_render.EXCLUDES_STUB` — one long line, exactly as Python spells it.
@@ -232,8 +233,8 @@ export const ensureProfileStub = stubWriter(PROFILE_FILE, PROFILE_STUB);
 
 /**
  * `_build_render.ensure_excludes_stub` — the sovereign-repo list, seeded once and NEVER
- * overwritten. Reachable only from the Claude-shaped emits, which is why it arrived with
- * `emitClaudeRender` rather than with the bundle stubs beside it.
+ * overwritten. Called by every GLOBAL emit — the Claude-shaped ones and opencode-global —
+ * since that is where the hook looks for it.
  */
 export const ensureExcludesStub = stubWriter(EXCLUDES_FILE, EXCLUDES_STUB);
 

package/js/build/version.mjs

@@ -8,9 +8,11 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { sourceReleaseVersion } from '../hosts/opencode.mjs';
 import { readText, writeText } from '../lib/fs.mjs';
-import { isDir, relPosix, rglobFiles } from './emit-common.mjs';
+import { parseJson } from '../lib/json.mjs';
+import { isDir } from '../lib/fs.mjs';
+import { relPosix } from '../lib/text.mjs';
+import { rglobFiles } from './emit-common.mjs';
 import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 
@@ -132,6 +134,23 @@ export function versionIsNewer(a, b) {
   return false;
 }
 
+/**
+ * `_build_core.source_release_version` — the release this checkout would install. It reads
+ * `cfg.config`, so it takes `cfg`. It lived in `js/hosts/opencode.mjs` for no better reason
+ * than that the first caller was there; every reader since asks a version question, so it
+ * lives with them. `js/hosts/opencode.mjs` re-exports it for its older importers.
+ */
+export function sourceReleaseVersion(cfg) {
+  try {
+    const data = parseJson(readText(cfg.config));
+    const v = data && typeof data === 'object' && !Array.isArray(data) ? data.version : null;
+    if (typeof v === 'string' && v) return v;
+  } catch {
+    // OSError / JSONDecodeError — degrade to "not newer" rather than raising.
+  }
+  return '0.0.0';
+}
+
 /** `_build_render._warn_if_downgrade` — STDOUT, matching the Python. */
 function warnIfDowngrade(cfg, out) {
   const deployed = readReleaseVersion(out);