geneseed 3.13.0 → 3.15.0

package/js/hosts/hosts.mjs

@@ -66,8 +66,12 @@ export function sovereignBypass(root) {
       // `withDiscardableStderr` because `expanduser` writes its refusal at the RAISE SITE
       // and this caller catches: the reference prints nothing here, so replaying the
       // message would be a stderr divergence on every hook call for one bad entry.
+      //
+      // `resolvePath`, the same resolution as `cwd` above: symlinks and junctions are followed on
+      // BOTH sides, so an entry spelled through a link matches the real directory the session
+      // stands in (and the OpenCode plugins' `norm` applies the identical rule).
       base = withDiscardableStderr(
-        () => normcase(toPlatformPath(expanduser(raw.trim()))).replace(/[\\/]+$/, ''));
+        () => normcase(resolvePath(raw.trim())).replace(/[\\/]+$/, ''));
     } catch {
       // PER ENTRY, and the loop continues. One unusable line in a file the USER hand-edits
       // must not decide the whole function — `expanduser` refuses a `~user` form, and the
@@ -208,14 +212,13 @@ export function openclaudeConfigDir() {
 }
 
 /**
- * `_build_global.HOSTS`, reduced to the two columns a non-emitting caller needs, and IN ITS
- * ORDER — opencode, claude, bob, openclaude.
+ * `_build_global.HOSTS` — one row per host, IN ITS ORDER: opencode, claude, bob, openclaude.
+ * A new host is one row here; `EMIT_HOST_SCOPE` (`js/hosts/installs.mjs`) and `CLAUDE_STYLE`
+ * below are derived from it.
  *
  * An array rather than an object because the order is observable output, not an
  * implementation detail: `harness exclude add` walks it and prints one message per host, so
- * a reordering is a diff in stderr. (`emit_global` and `native_catalog` stay out;
- * `bin/build-driver.mjs` receives those decisions from its own dispatch rather than reading a
- * table.)
+ * a reordering is a diff in stderr.
  *
  * `projectMarker` joined in P5f. `_install_targets` asks "does this cwd carry a project
  * install of host H", and `_claude_cfg` asks "which subdir holds a project install's
@@ -228,24 +231,34 @@ export function openclaudeConfigDir() {
  * block`). It is a column and not a literal in the message for the reason every other column
  * here is one — Bob answers `AGENTS.md` while Claude answers `CLAUDE.md`, and
  * a host added later must not need the message edited to stay true.
+ *
+ * `family` joined in 2026-10: `'claude'` for every host emitted through the Claude-shaped
+ * engine — one manifest shape, one `settings.json` hook wiring, one strict-JSON `mcpServers`
+ * config, one reversal. The list had been spelled out by hand in ten places, one of which
+ * ignored the named constant right above it.
+ *
+ * `catalog` — does the host list every skill and agent to the model by itself? See
+ * `hostCatalogsNatively` below for what it decides and why it is split per kind.
  */
 export const HOSTS = [
-  { host: 'opencode', configDir: opencodeConfigDir, projectMarker: '.opencode', agentFile: 'AGENT.md' },
-  { host: 'claude', configDir: claudeConfigDir, projectMarker: '.claude', agentFile: 'CLAUDE.md' },
-  { host: 'bob', configDir: bobConfigDir, projectMarker: '.bob', agentFile: 'AGENTS.md' },
-  { host: 'openclaude', configDir: openclaudeConfigDir, projectMarker: '.openclaude', agentFile: 'CLAUDE.md' },
+  { host: 'opencode', family: 'opencode', configDir: opencodeConfigDir, projectMarker: '.opencode', agentFile: 'AGENT.md', catalog: { skills: true, agents: true } },
+  { host: 'claude', family: 'claude', configDir: claudeConfigDir, projectMarker: '.claude', agentFile: 'CLAUDE.md', catalog: { skills: true, agents: true } },
+  { host: 'bob', family: 'claude', configDir: bobConfigDir, projectMarker: '.bob', agentFile: 'AGENTS.md', catalog: { skills: true, agents: false } },
+  { host: 'openclaude', family: 'claude', configDir: openclaudeConfigDir, projectMarker: '.openclaude', agentFile: 'CLAUDE.md', catalog: { skills: true, agents: true } },
 ];
 
+/** The Claude-STYLE hosts (`family: 'claude'`), in `HOSTS` order. Test with `.includes(host)`. */
+export const CLAUDE_STYLE = HOSTS.filter((h) => h.family === 'claude').map((h) => h.host);
+
 /**
  * `_build_global.host_catalogs_natively` — does `host` list every skill and agent to the
  * model by itself?
  *
- * The third column of `HOSTS`, and the reason the docblock above no longer says
- * `native_catalog` stays out: `doctor`'s `_rendered_problems` has to know, because a host
+ * `HOSTS`' `catalog` column. `doctor`'s `_rendered_problems` has to know, because a host
  * that catalogues natively gets AGENT.md's tables collapsed to a pointer and comparing the
  * portable shape against its bundle reports AGENT.md stale on every run forever. It is a
- * column and not a set literal so that the capability is still declared in exactly one place
- * — the Python's own reason for the helper.
+ * column and not a set literal so that the capability is declared in exactly one place
+ * — the Python's own reason for the helper. The driver reads it through this function too.
  *
  * Unknown host -> false, which is the shape that KEEPS the tables. The value arrives from a
  * user-editable `.geneseed-emit` marker, so an unrecognised one must degrade to the portable
@@ -256,19 +269,12 @@ export const HOSTS = [
  * single boolean was wrong both ways: `false` shipped the §4 Skills table on top of a
  * catalogue Bob already had (~1.7k tokens twice), `true` would have stripped the §3 Agents
  * table that is Bob's ONLY agent catalogue. Each CATALOG block in AGENT.md names its kind and
- * resolves against its own flag. Mirrored in
- * `bin/build-driver.mjs` (which cannot import this module's spawning neighbours).
+ * resolves against its own flag.
+ *
+ * Returns `{ skills, agents }` for a known host, `false` for an unknown one.
  */
-const NATIVE_CATALOG = {
-  opencode: { skills: true, agents: true },
-  claude: { skills: true, agents: true },
-  bob: { skills: true, agents: false },
-  openclaude: { skills: true, agents: true },
-};
-
-/** `{ skills, agents }` for a known host, `false` for an unknown one. */
 export function hostCatalogsNatively(host) {
-  return NATIVE_CATALOG[host] || false;
+  return HOSTS.find((h) => h.host === host)?.catalog || false;
 }
 
 /** `_harness_learn.MEMORY_DIR_NAMES` — the neutral name and the imperial theme's. */

package/js/hosts/installs.mjs

@@ -36,10 +36,10 @@ import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 
 import { CONFIG, PACK_ORDER, THEMES, discoverNames } from '../build/source.mjs';
-import { GLOBAL_MANIFEST, HOSTS, resolvePath } from './hosts.mjs';
+import { CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, resolvePath } from './hosts.mjs';
 import { registryRoots } from '../inspect/registry.mjs';
 import { printErr, readText, isFile, isDir } from '../lib/fs.mjs';
-import { formatRepr } from '../lib/json.mjs';
+import { formatRepr, isDict } from '../lib/json.mjs';
 import { comparePaths } from '../lib/paths.mjs';
 
 /**
@@ -107,8 +107,8 @@ export const defaultMode = () => configuredDefault('mode', 'direct');
  * `_build_render.theme_files` — shipped themes, `_`-prefixed scaffolds excluded.
  *
  * `dir` defaults to the checkout's own `themes/`, which is every caller but one: P2's
- * `syncThemes` is driven over a FIXTURE directory by the cross-implementation corpus in
- * `tests/test_maintainer_tools_parity.py`, because the tool it belongs to rewrites committed
+ * `syncThemes` is driven over a FIXTURE directory by the corpus in
+ * `tests/unit/maintainer_tools.test.mjs`, because the tool it belongs to rewrites committed
  * files and cannot be gated against the real ones. A parameter, not a second enumeration —
  * a scaffold mistaken for a theme is exactly what this function exists to prevent, once.
  *
@@ -162,12 +162,26 @@ function firstCarrier(d, probe, fallback = null) {
   return fallback;
 }
 
-/** `_harness_setup._theme_of_dir` — the marker, else the sigil in one of five carriers. */
+/**
+ * A marker value that can only name a file directly in the themes dir: no separator, no `..`,
+ * and not a `_`-prefixed scaffold.
+ */
+const THEME_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+
+/**
+ * `_harness_setup._theme_of_dir` — the marker, else the sigil in one of five carriers.
+ *
+ * The marker's value becomes `<themes>/<name>.json` in `loadTheme`, so a path in it
+ * (`../harness.config`) loaded any `.json` as a theme. A value that is not a plain name falls
+ * through to the sigil scan, as a missing marker does. A plain name that is not shipped is
+ * still RETURNED: `loadTheme` then refuses it loudly, which `status`/`rebuild-all`/`migrate`
+ * cells pin ("unknown theme 'nosuchtheme'"), rather than a typo going unnoticed.
+ */
 export function themeOfDir(d) {
   const marker = path.join(d, '.geneseed-theme');
   if (isFile(marker)) {
     const name = (readMaybe(marker) ?? '').trim();
-    if (name) return name;
+    if (THEME_NAME_RE.test(name)) return name;
   }
   return firstCarrier(d, (carrierPath) => themeFromAgent(carrierPath) || undefined);
 }
@@ -210,7 +224,7 @@ export function footprintOfDir(d) {
  * the string, so a posture file named `Foreman` renders `**Foreman**` and one named `FOREMAN`
  * would be scanned for as `**Foreman**` by both implementations only if this reproduces the
  * lowercasing. Every shipped name is already lowercase, which is exactly why the difference
- * would go unnoticed — the corpus in `tests/test_pure_function_parity.py` is what covers it.
+ * would go unnoticed — the former Python corpus covered it, and no test drives it now.
  */
 export function capitalize(s) {
   return s.length ? s[0].toUpperCase() + s.slice(1).toLowerCase() : s;
@@ -239,10 +253,15 @@ export const modeOfDir = (d) => leadOfDir(d, discoverNames('modes', 'direct'));
  * `Default trust preset: **<Label>**` line, and this scans the places an emit lands it: the
  * native layer (`skills/loop/SKILL.md`, in the root itself for a global install and under the
  * host's `projectMarker` for a project one) and the plain bundle (`skills/loop.md`).
+ *
+ * `host` narrows the project dirs to that host's own: in a repo carrying `.opencode/` AND
+ * `.claude/`, the Claude row otherwise read OpenCode's preset, since OpenCode comes first in
+ * `HOSTS`. Without it every host's dir is tried, in `HOSTS` order — the caller that has no host.
  */
 const TRUST_RE = /^Default trust preset: \*\*(Prudent|Balanced|Aggressive)\*\*/m;
-export function trustOfDir(d) {
-  for (const base of ['', ...HOSTS.map((h) => h.projectMarker)]) {
+export function trustOfDir(d, host = null) {
+  const rows = host === null ? HOSTS : HOSTS.filter((h) => h.host === host);
+  for (const base of ['', ...rows.map((h) => h.projectMarker)]) {
     for (const rel of [['skills', 'loop', 'SKILL.md'], ['skills', 'loop.md']]) {
       const m = TRUST_RE.exec(readMaybe(path.join(d, base, ...rel)) ?? '');
       if (m) return m[1].toLowerCase();
@@ -394,7 +413,7 @@ export function excludedRulesOfDir(d) {
 /** `_harness_mcp._claude_read_manifest`. */
 export function claudeReadManifest(cfgDir) {
   const data = readJsonMaybe(path.join(cfgDir, GLOBAL_MANIFEST));
-  return data && typeof data === 'object' && !Array.isArray(data) ? data : {};
+  return isDict(data) ? data : {};
 }
 
 /**
@@ -403,17 +422,16 @@ export function claudeReadManifest(cfgDir) {
  * Claude-style reversal.
  */
 export function manifestIsClaude(cfgDir) {
-  const mg = claudeReadManifest(cfgDir).managed;
-  return typeof mg === 'object' && mg !== null && !Array.isArray(mg);
+  return isDict(claudeReadManifest(cfgDir).managed);
 }
 
-/** `_harness_mcp._EMIT_HOST_SCOPE` — a marker's emit name fixes (host, scope). */
-export const EMIT_HOST_SCOPE = new Map([
-  ['opencode', ['opencode', 'project']], ['opencode-global', ['opencode', 'global']],
-  ['claude', ['claude', 'project']], ['claude-global', ['claude', 'global']],
-  ['bob', ['bob', 'project']], ['bob-global', ['bob', 'global']],
-  ['openclaude', ['openclaude', 'project']], ['openclaude-global', ['openclaude', 'global']],
-]);
+/**
+ * `_harness_mcp._EMIT_HOST_SCOPE` — a marker's emit name fixes (host, scope). Derived from
+ * `HOSTS`, whose emit names are `<host>` and `<host>-global`, so a new host is one row there.
+ */
+export const EMIT_HOST_SCOPE = new Map(HOSTS.flatMap(({ host }) => [
+  [host, [host, 'project']], [`${host}-global`, [host, 'global']],
+]));
 
 /** `_harness_mcp._emit_host_scope_of` — `root`'s own marker, resolved, or null. */
 export function emitHostScopeOf(root) {
@@ -454,7 +472,7 @@ export function installKind(root) {
 
 /** `_harness_mcp._install_state` — 'active' | 'disabled' | 'absent'. */
 export function installState(root, host = 'opencode', scope = 'global') {
-  if (['claude', 'bob', 'openclaude'].includes(host)) return claudeState(root, scope, host);
+  if (CLAUDE_STYLE.includes(host)) return claudeState(root, scope, host);
   if (isDir(path.join(root, DISABLED_STASH))) return 'disabled';
   return installKind(root) !== null ? 'active' : 'absent';
 }

package/js/hosts/link.mjs

@@ -57,8 +57,8 @@
  * never needs to:
  *
  *   * `winUserPathScript` is PURE — the escaping, the split and the idempotence live there
- *     and `tests/test_win_user_path.py` runs it over a corpus (apostrophes, trailing
- *     separators, UNC roots) against the Python twin, byte for byte.
+ *     and `tests/unit/win_user_path.test.mjs` runs it over a corpus of hazards (apostrophes,
+ *     typographic quotes, trailing separators, UNC roots) and asserts each property absolutely.
  *   * `cmdLink` SHORT-CIRCUITS when the bin dir is already on `PATH`, so a cell that seeds
  *     `PATH` with its own sandboxed bin dir exercises the whole verb and never spawns.
  *   * `cmdUnlink` has no such short-circuit, so its cells seed a `PATH` with no `powershell`
@@ -81,9 +81,11 @@ import os from 'node:os';
 import { ROOT } from '../build/source.mjs';
 import { readMaybe } from './installs.mjs';
 import { printOut, printErr, writeText } from '../lib/fs.mjs';
-import { toPlatformPath } from '../lib/paths.mjs';
+import { toPlatformPath, which } from '../lib/paths.mjs';
 
 const IS_WIN = process.platform === 'win32';
+/** What `cmdUnlink` recognises a written Unix launcher by — see `isOurLauncher`. */
+const SHIM_MARKER = 'GENESEED_LINK_SHIM';
 
 /** `_harness_lifecycle._win_bin_dir`. */
 function winBinDir() {
@@ -97,12 +99,18 @@ function winBinDir() {
  * `_harness_lifecycle._win_user_path_script` — the PowerShell one-liner, built but not run.
  *
  * Every quoting hazard in this verb is in this string, which is why it is a separate
- * function on both sides: `''` is PowerShell's single-quote escape, the `;` split drops
+ * function: `''` is PowerShell's single-quote escape, the `;` split drops
  * empty segments so a trailing separator cannot append an empty entry, and `-notcontains`
  * is what makes `link` idempotent.
+ *
+ * THE ESCAPE COVERS FIVE CHARACTERS, NOT ONE. PowerShell also reads the typographic quotes
+ * U+2018–U+201B as single quotes, so one of them left bare in a directory name closes the
+ * string exactly as `'` does and turns the rest of the path into code. Each is doubled with
+ * ITSELF — `‘‘` is the escape for `‘` — which is what PowerShell's own `CodeGeneration.
+ * EscapeSingleQuotedStringContent` does.
  */
 export function winUserPathScript(action, directory) {
-  const d = directory.replaceAll("'", "''");   // PS single-quote escape (O'Brien)
+  const d = directory.replace(/['‘-‛]/g, '$&$&');   // PS single-quote escape (O'Brien)
   if (action === 'add') {
     return `$d='${d}';`
       + "$p=[Environment]::GetEnvironmentVariable('Path','User');"
@@ -134,13 +142,56 @@ export function winUserPathScript(action, directory) {
  * false rather than crashing the verb.
  */
 function winUserPath(action, directory) {
-  const r = spawnSync('powershell',
+  // `which`, never a bare name: Windows resolves a bare name against the cwd first, and
+  // `which` never searches the cwd implicitly (see its docblock).
+  const ps = which('powershell');
+  if (!ps) return false;
+  const r = spawnSync(ps,
     ['-NoProfile', '-Command', winUserPathScript(action, directory)],
     { stdio: 'inherit', windowsHide: true });
   if (r.error) return false;
   return r.status === 0;
 }
 
+/**
+ * Is `dir` one of the ENTRIES of a Windows PATH string?
+ *
+ * Entry-wise, not a substring test: `…\Geneseed\bin` is a substring of `…\Geneseed\bin2` and of
+ * `…\Geneseed\bin\old`, and a substring hit skipped the registry write while the shim's own dir
+ * stayed off PATH. Trailing separators and case are both noise on Windows.
+ */
+export function winPathHas(pathEnv, dir) {
+  const norm = (s) => s.replace(/[\\/]+$/, '').toLowerCase();
+  const want = norm(dir);
+  return pathEnv.split(';').some((e) => e && norm(e) === want);
+}
+
+/**
+ * The Unix launcher's text. Single-quoted, never double: inside `"…"` the shell still expands
+ * `$`, backticks and `\`, so an install path holding any of them ran as code each time
+ * `geneseed` started. `'\''` is the one escape single quotes need.
+ */
+export function unixShimText(exe, entry) {
+  const q = (s) => `'${s.replaceAll("'", "'\\''")}'`;
+  return `#!/bin/sh\n# ${SHIM_MARKER}\nexec ${q(exe)} ${q(entry)} "$@"\n`;
+}
+
+/**
+ * Is the file at `f` a launcher `geneseed link` made? Two shapes exist on disk. (a) A symlink,
+ * judged by `os.readlink(f)` raw, then `.name` — NOT a resolved path: the question is whether
+ * the link's own target BASENAME is `geneseed`, so a symlink pointing at some other program
+ * that happens to sit in a `geneseed` directory is left alone. That is every install made
+ * before the shim. (b) A regular file carrying the marker — never "any regular file called
+ * geneseed", which would be npm's own bin link or a stranger's program.
+ *
+ * ONE OWNER FOR BOTH VERBS. `unlink` always refused what is not ours; `link` used to delete
+ * whatever sat at its destination before writing, so the two disagreed about the same file.
+ */
+function isOurLauncher(f) {
+  if (isSymlink(f)) return path.basename(readlinkSync(f)) === 'geneseed';
+  return existsSync(f) && (readMaybe(f) ?? '').includes(SHIM_MARKER);
+}
+
 /** `_harness_lifecycle.cmd_link` — put `geneseed` on PATH so it runs from any directory. */
 export function cmdLink(args) {
   const here = ROOT;
@@ -159,8 +210,7 @@ export function cmdLink(args) {
       return 1;
     }
     printOut(`geneseed: wrote shim ${shim}\n`);
-    const on_path = (process.env.PATH || '').toLowerCase().includes(bindir.toLowerCase());
-    if (on_path || winUserPath('add', bindir)) {
+    if (winPathHas(process.env.PATH || '', bindir) || winUserPath('add', bindir)) {
       printOut(`geneseed: '${bindir}' is on your user PATH — open a NEW terminal, then run \`geneseed\`.\n`);
     } else {
       printOut(`geneseed: add '${bindir}' to your PATH manually, then run \`geneseed\` from anywhere.\n`);
@@ -174,8 +224,8 @@ export function cmdLink(args) {
   // PATH=` line) as well as comparing it against `PATH.split(os.pathsep)`, so an argument
   // that is not already normalised diverges in three places at once. A trailing slash is the
   // cheapest one: `str(Path('/x/bin/'))` is `/x/bin` and the raw string is not.
-  // `harness_golden`'s `link/an-explicit-dir-argument-is-used-instead-of-the-default` passes
-  // one, and it is the cell that found this.
+  // The retired cell `link/an-explicit-dir-argument-is-used-instead-of-the-default` passed
+  // one, and it is what found this.
   let targetDir = args.dir ? toPlatformPath(args.dir) : null;
   if (targetDir === null) {
     const local = path.join(os.homedir(), '.local', 'bin');
@@ -191,16 +241,23 @@ export function cmdLink(args) {
   try {
     mkdirSync(targetDir, { recursive: true });
     // `dest.is_symlink() or dest.exists()` — the first half is what catches a BROKEN
-    // symlink, which `existsSync` follows and reports absent.
-    if (isSymlink(dest) || existsSync(dest)) rmSync(dest, { force: true });
+    // symlink, which `existsSync` follows and reports absent. Only OUR launcher is replaced:
+    // anything else there — npm's own bin link, a stranger's program — is refused, the same
+    // judgement `cmdUnlink` makes about the same file.
+    if (isSymlink(dest) || existsSync(dest)) {
+      if (!isOurLauncher(dest)) {
+        printErr(`geneseed: ${dest} exists and is not a launcher geneseed wrote — leaving it `
+          + 'alone. Remove it yourself, or pick another dir: geneseed link <dir>\n');
+        return 1;
+      }
+      rmSync(dest, { force: true });
+    }
     // A WRITTEN SHIM, not a symlink to `ROOT/geneseed`. The bash launcher execs a Python
     // interpreter, so symlinking it puts Python on PATH from the Node verb. The Windows
-    // arm above has always written a shim; this is the same shape. `GENESEED_LINK_SHIM`
-    // is the marker `cmdUnlink` recognises — without it, unlink cannot tell our file from
+    // arm above has always written a shim; this is the same shape. `SHIM_MARKER`
+    // is what `cmdUnlink` recognises — without it, unlink cannot tell our file from
     // a stranger's and would have to refuse every regular file, which is a no-op.
-    writeText(dest, '#!/bin/sh\n'
-      + '# GENESEED_LINK_SHIM\n'
-      + `exec "${process.execPath}" "${entry}" "$@"\n`);
+    writeText(dest, unixShimText(process.execPath, entry));
     chmodSync(dest, 0o755);
   } catch (e) {
     printErr(`geneseed: could not write ${dest} (${asOsError(e)}) — pick a writable dir: `
@@ -246,15 +303,7 @@ export function cmdUnlink() {
     if (seen.has(d)) continue;
     seen.add(d);
     const f = path.join(d, 'geneseed');
-    // TWO shapes, because two shapes exist on disk. (a) `os.readlink(f)` raw, then `.name`
-    // — NOT a resolved path: the reference asks whether the link's own target BASENAME is
-    // `geneseed`, so a symlink pointing at some other program that happens to sit in a
-    // `geneseed` directory is left alone. That is every install made before the shim.
-    // (b) a regular file we wrote, identified by its marker — never "any regular file
-    // called geneseed", which would delete a stranger's program.
-    const ours = (isSymlink(f) && path.basename(readlinkSync(f)) === 'geneseed')
-      || (!isSymlink(f) && existsSync(f) && (readMaybe(f) ?? '').includes('GENESEED_LINK_SHIM'));
-    if (ours) {
+    if (isOurLauncher(f)) {
       try {
         rmSync(f);
         printOut(`geneseed: removed ${f}\n`);

package/js/hosts/mcp.mjs

@@ -11,12 +11,6 @@
  * `_mcp_install_targets`, `_mcp_known_names` and `_mcp_meta` are 168 lines of Python, all
  * new. The endpoints on top of them are the small half.
  *
- * AND `settings.mjs`'s ATOMIC WRITE IS NOT THIS ONE. `atomicWriteJson` is
- * `_build_settings._atomic_write_json`; `_mcp_save` is a different function with a different
- * temp suffix (`.tmp`, not `.geneseed-tmp`) that also creates the parent directory. Reusing
- * the first would be right until the moment a write fails, which is the moment the temp
- * file's name becomes the only evidence of what happened.
- *
  * THE ROUND TRIP IS THE HAZARD, and it is why every read here goes through `parseJson`.
  * `_mcp_save` rewrites the WHOLE config, not the servers map — and for a Claude global
  * install that config is `~/.claude.json`, which holds projects and history far beyond MCP
@@ -28,23 +22,23 @@
  * the wrapper rather than testing `typeof v === 'object'`. Python's `isinstance(x, dict)` is
  * false for a float; the JS twin has to be false for its wrapper.
  */
-import { existsSync, mkdirSync, renameSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { bobConfigDir, resolvePath } from './hosts.mjs';
+import { CLAUDE_STYLE, bobConfigDir, resolvePath } from './hosts.mjs';
 import { installState, installTargets } from './installs.mjs';
-import { printOut, printErr, readText, writeText } from '../lib/fs.mjs';
-import { isDict, jsonDumpsIndent, parseJson } from '../lib/json.mjs';
+import { printOut, printErr } from '../lib/fs.mjs';
+import { isDict } from '../lib/json.mjs';
 import { padEndToWidth } from '../lib/text.mjs';
-import { opencodeTarget, readJsonc } from './settings.mjs';
+import { atomicWriteJson, loadJsonObject, opencodeTarget } from './settings.mjs';
 
 
 /** `dict.get(key, default)`. */
 const dget = (obj, key, dflt) => (isDict(obj) && Object.hasOwn(obj, key) ? obj[key] : dflt);
 
 /** The hosts whose MCP config is strict JSON under `mcpServers`, with no `enabled` flag. */
-const FLAGLESS = ['claude', 'bob', 'openclaude'];
+const FLAGLESS = CLAUDE_STYLE;
 
 /**
  * `_harness_mcp._MCP_PRESETS` — the ready-to-wire servers the MCP screen can toggle.
@@ -175,49 +169,19 @@ export function mcpSetEnabled(config, name, enabled, host = 'opencode') {
  * version of this note said otherwise, and `generate.test.mjs` pins the string-aware case.)
  */
 export function mcpLoad(p, host = 'opencode') {
-  if (!existsSync(p)) return {};
-  let text;
-  try {
-    text = readText(p);
-  } catch {
-    return {};
-  }
-  if (FLAGLESS.includes(host)) {
-    let data;
-    try {
-      data = parseJson(text);
-    } catch {
-      return {};
-    }
-    return isDict(data) ? data : {};
-  }
-  const [data] = readJsonc(text);
-  return isDict(data) ? data : {};
+  const { state, data } = loadJsonObject(p, { strict: FLAGLESS.includes(host) });
+  return state === 'ok' ? data : {};
 }
 
 /** `_mcp_commented` — an existing `.jsonc` that carries comments, which must not be rewritten. */
 export function mcpCommented(p) {
-  if (path.extname(p) !== '.jsonc' || !existsSync(p)) return false;
-  try {
-    const [, had] = readJsonc(readText(p));
-    return had;
-  } catch {
-    return false;
-  }
+  if (path.extname(p) !== '.jsonc') return false;
+  return loadJsonObject(p).hadComments;
 }
 
-/**
- * `_mcp_save` — pretty JSON, written ATOMICALLY through a sibling temp file.
- *
- * Not `atomicWriteJson`: that is `_build_settings._atomic_write_json`, whose temp file is
- * named `.geneseed-tmp` and which does not create the parent directory. Two Python
- * functions, two twins.
- */
+/** `_mcp_save` — pretty JSON, written ATOMICALLY. The one writer, under its MCP name. */
 export function mcpSave(p, config) {
-  mkdirSync(path.dirname(p), { recursive: true });
-  const tmp = `${p}.tmp`;
-  writeText(tmp, `${jsonDumpsIndent(config)}\n`);
-  renameSync(tmp, p);
+  atomicWriteJson(p, config);
 }
 
 /**