geneseed 3.14.0 → 3.15.0

package/js/README.md

@@ -129,6 +129,7 @@ into files users have committed, so change the test that states it in the same c
 | `text.mjs` | String primitives: `codePointLength`, `WHITESPACE`, `parseIntStrict`, `percentDecode` |
 | `udiff.mjs` | `geneseed diff`'s own difflib clone — the alignment IS the printed hunks — plus `splitLines` |
 | `proc.mjs` | One constant: the `windowsHide` flag every spawn in `js/` must reuse |
+| `prompt.mjs` | The line-mode stdin readers — `ask`, `promptLine`, `confirm`, `askChoice` — read a byte at a time so they stop where Enter stops. Shared by `setup`, `uninstall` and `web` without dragging in the wizard |
 | `node-floor.mjs` | The first import of all three binaries: below Node 22.3, one sentence on stderr and exit 1 (0 in the hook) instead of a stack trace |
 
 **Before editing:** parse with `parseJson`, never `JSON.parse` — the latter collapses int `1` and
@@ -202,10 +203,13 @@ the deployed harness as JSON.
 | module | owns |
 |---|---|
 | `server.mjs` | `serve()`/`cmdWeb`: UI-build precheck, socket bind, token mint, daemon record wiring |
-| `routes.mjs` | Route DECLARATION only: the `POST_ROUTES` table and the ported/unported/declined sets |
-| `handler.mjs` | One function per request: dispatch, gzip, Host/CSRF guards, static SPA fallback |
-| `api.mjs` | `WebState` plus every GET read endpoint; owns `STATE_ROUTES`, `PREFIX_ROUTES`, `NotFound` |
-| `actions.mjs` | The mutating endpoints — rules, profile, memory, MCP, excludes — plus install/deploy argv |
+| `routes.mjs` | The route tables — `STATE_ROUTES`, `PREFIX_ROUTES`, `POST_ROUTES` (+ its 409 column) — and the inline lists |
+| `handler.mjs` | One function per request: dispatch, gzip, Host/CSRF guards and body cap (before the body is read), static SPA fallback |
+| `state.mjs` | `webState` — the resolved install view every endpoint reads, with its cached inventory and doctor |
+| `catalog.mjs` | The Library read model: inventory, constitution tiers, memory/notebook/wiki/config items, `apiCatalog`/`apiItem`, `NotFound` |
+| `api.mjs` | The dashboard and settings reads: overview, recent, themes, setup, doctor, diff, installs, excludes, loops |
+| `user-files.mjs` | The fingerprint-guarded editors for `user-rules.md` (incl. memory promotion) and `PROFILE.md`, read and write |
+| `actions.mjs` | The other mutating endpoints — memory delete, MCP, excludes, installs, view, restore — plus install/deploy argv |
 | `daemon.mjs` | Detached web start/stop/status/restart, the `.geneseed-web.json` record, and `openUrl` |
 | `jobs.mjs` | `JobManager` and the action→argv table. The only module here that spawns job children |
 | `docs.mjs` | The Docs tab: the `docs/<folder>/` page registry, `?harness=` filtering, link rewriting, the six page kinds |
@@ -232,4 +236,4 @@ and inline lists are held against a surface list written out in
 | a hook verb | `js/hosts/hooks.mjs` (a gate) or its own `js/hosts/hooks-<verb>.mjs` | `claudeHookGroups` in `settings.mjs`, the `VERBS` row (with its `load`) in `bin/geneseed-hook.mjs`. Keep the import graph tiny |
 | a console doc page | `docs/<understand|guides|concepts|reference>/<id>.md` — the stem is the id | `docs/extending.md` §4c. Only `kind: "concept"` gets `{N_*}` substitution |
 | an OpenCode plugin | `adapters/opencode/plugins/geneseed-<name>.js` | `docs/extending.md` §4a — the `geneseed-` prefix is mechanically load-bearing |
-| to change a `js/lib/` primitive | `tests/fixtures/pure_probe.mjs` **first** | the docblock says which Node default it deliberately departs from — change that sentence too, or the next reader restores the default |
+| to change a `js/lib/` primitive | `tests/unit/lib_primitives.test.mjs` **first** | the docblock says which Node default it deliberately departs from — change that sentence too, or the next reader restores the default |

package/js/build/args.mjs

@@ -24,8 +24,8 @@ const EMITS = ['files', 'opencode', 'opencode-global', 'claude', 'claude-global'
  *
  * The corrupt-file branch is reproduced including its imprecision: the warning says only
  * "using theme 'neutral'", but the branch also resets posture and mode. Matching the
- * Python text matters more than fixing it here, because the two CLIs' stderr is compared
- * byte-for-byte by `tests/golden.py` (:316).
+ * Python text mattered more than fixing it here, because the two CLIs' stderr was compared
+ * byte-for-byte by the former Python golden harness; nothing pins the wording now.
  */
 export function configDefaults() {
   const d = {
@@ -325,7 +325,8 @@ export function parseArgs(argv, defaults) {
  * `--validate-only` reads exactly the flags `build.py`'s parser already produced, so the port
  * hands the CLI this parser rather than a second one beside it. That is not tidiness: a
  * hand-rolled copy would have its own `--target` alias, its own `choices` lists and its own
- * `-h`, and `test_the_help_text_names_every_flag_the_reference_takes` gates only this one.
+ * `-h`, and `tests/unit/node_driver.test.mjs`'s '--help names every flag the parser takes' gates only
+ * this one.
  *
  * `withPlatformNewlines` because the refusal and `-h` paths WRITE: called from `bin/build-driver.mjs`
  * they sit inside `main`'s funnel, and called from the CLI binary they would not.

package/js/build/bundle.mjs

@@ -12,9 +12,9 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { copyFile, readText, writeText } from '../lib/fs.mjs';
+import { copyFile, isDir, isFile, readText, writeText } from '../lib/fs.mjs';
 import { jsonDumpsIndent, parseJson, formatReprAscii, isTruthy } from '../lib/json.mjs';
-import { OWNED_SRC_DIRS, SRC_DIRS_MARKER, TMPL_SPEC_RE, isDir, isFile } from './emit-common.mjs';
+import { OWNED_SRC_DIRS, SRC_DIRS_MARKER, TMPL_SPEC_RE } from './emit-common.mjs';
 import { SRC_DIR_TOKENS, renderAll } from './render.mjs';
 import {
   ensureBundleGitignore, ensureContextStub, ensureMemoryIndex, ensureNotebookIndex,
@@ -114,16 +114,9 @@ function safePriorDirName(out, priorName) {
 // build
 // ---------------------------------------------------------------------------
 
-/**
- * `_build_render.build` — render the bundle into `out`.
- *
- * `out` arrives as the STRING Python already resolved, and is echoed into the progress
- * lines verbatim: Python interpolates `str(Path)`, which is backslash-separated on
- * Windows, and re-deriving it here would differ by separator in every message.
- */
 /**
  * THE PHASE BOUNDARY MARKER — T8, and the whole of what this port owes
- * `tests/test_emit_phase_order.py`.
+ * `tests/unit/emit_phase_order.test.mjs`.
  *
  * Every emit runs its stages in one order: RENDER* → WIRE* → PRUNE → MANIFEST → VERIFY. RENDER
  * writes files Geneseed owns wholesale; WIRE reconciles files the USER co-owns (the
@@ -156,6 +149,13 @@ export function phaseLog(phase) {
   process.stderr.write(`[geneseed:phase] ${phase}\n`);
 }
 
+/**
+ * `_build_render.build` — render the bundle into `out`.
+ *
+ * `out` arrives as the STRING Python already resolved, and is echoed into the progress
+ * lines verbatim: Python interpolates `str(Path)`, which is backslash-separated on
+ * Windows, and re-deriving it here would differ by separator in every message.
+ */
 export function build(cfg, themeName, out, { footprint = 'full', nativeCatalog = false } = {}) {
   phaseLog('RENDER');
   const { theme, items } = renderAll(cfg, themeName, { footprint, nativeCatalog });

package/js/build/driver.mjs

@@ -42,6 +42,7 @@ import { settingsIntegrityCheck } from '../hosts/settings.mjs';
 import { hookRunnerEntry } from '../hosts/shim.mjs';
 import { writeText, withPlatformNewlines, isFile } from '../lib/fs.mjs';
 import { parseJson, jsonDumpsIndent } from '../lib/json.mjs';
+import { relPosix } from '../lib/text.mjs';
 // P5c moved these out of this file: `bin/geneseed-cli.mjs` needs the same four resolvers to
 // find a global install, and a resolver that decides WHERE a driver writes is the last thing
 // that should exist twice. golden.py's 259 cells are what made the move safe to attempt.
@@ -90,7 +91,8 @@ const PRIMARY_AGENT_SRC = path.join(ROOT, 'adapters', 'opencode', 'agents', 'orc
  *  It is invisible on a machine whose paths are already canonical, which is every machine
  *  this ran on until GitHub's Windows runner handed it a `C:\\Users\\RUNNER~1\\...` and the
  *  two CLIs printed the same directory under two different names — a 70-byte difference in a
- *  line compared BYTE for byte by `test_the_two_entry_points_agree_on_stdout_BYTES`. The
+ *  line the former Python suite compared BYTE for byte; `tests/unit/resolve_out.test.mjs` pins
+ *  it now. The
  *  argument to `resolvePath` is made absolute first so its `expanduser` cannot fire: the
  *  reference does not expand `~` here, and a bare `~` is a legal directory name. */
 export function resolveOut(raw) {
@@ -149,10 +151,10 @@ function warnBobGlobalOverProject() {
  * would be written into `opencode.json`'s instruction path.
  */
 function relUnder(out, root) {
-  const rel = path.relative(root, out);
+  const rel = relPosix(root, out);
   if (rel === '' || rel === '.') return '';
   if (rel.startsWith('..') || path.isAbsolute(rel)) return '';
-  return rel.split(path.sep).join('/');
+  return rel;
 }
 
 /**
@@ -255,7 +257,7 @@ function projectSurvivors(emitName) {
  * RENDER and WIRE already ran in Node before P4; what lived only in Python was the stage
  * either side of them: reading the previous manifest (PRE), pruning what this layer no
  * longer owns, writing the manifest atomically, and the summary line. All five stages now
- * run in one process, in the order `test_emit_phase_order.py` pins for the Python twin:
+ * run in one process, in the order `tests/unit/emit_phase_order.test.mjs` pins:
  * RENDER -> WIRE -> PRUNE -> MANIFEST -> VERIFY (opencode has no VERIFY; it writes no
  * settings file of its own).
  */
@@ -511,9 +513,8 @@ const claudeShaped = (name) => (cfg, args, out) => {
 
 /**
  * build.py:437-466 — the POST stage, which writes markers and records the install and
- * wires NOTHING. `test_the_post_emit_stage_wires_nothing` classifies that stage on the
- * Python side; this is the same stage on this side, and it stays after the dispatch for
- * the same reason.
+ * wires NOTHING. `tests/unit/emit_phase_order.test.mjs`'s 'the post-emit marker stage wires
+ * nothing' classifies it, and that is why it stays after the dispatch.
  *
  * `writeText`, never `writeFileSync`: Python's `Path.write_text` opens in text mode with
  * `newline=None` and translates the trailing `\n` to CRLF on Windows. A marker written

package/js/build/emit-claude.mjs

@@ -14,10 +14,11 @@ import {
   unwireClaudeExcludes, unwireClaudeSettings, wireClaudeExcludes,
 } from '../hosts/settings.mjs';
 import { writeText } from '../lib/fs.mjs';
-import { isTruthy } from '../lib/json.mjs';
+import { get, isDict, isTruthy } from '../lib/json.mjs';
+import { relPosix } from '../lib/text.mjs';
 import { assertSourceComplete, phaseLog } from './bundle.mjs';
 import {
-  get, globalMemory, globalNotebook, isDict, relPosix, shipLeanLaws, stripCapabilityLinks,
+  globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
 import { renderAll, renderFile } from './render.mjs';
 import {

package/js/build/emit-common.mjs

@@ -10,18 +10,11 @@
  * `emit-claude.mjs` do that; `bundle.mjs` renders the bundle they read from.
  */
 import path from 'node:path';
-import { copyFile, writeText, isFile, isDir } from '../lib/fs.mjs';
-import { get, isDict } from '../lib/json.mjs';
+import { copyFile, writeText, isDir } from '../lib/fs.mjs';
+import { relPosix } from '../lib/text.mjs';
 import { SRC_DIR_TOKENS, destRel } from './render.mjs';
 import { mkdirSync, readdirSync, cpSync } from 'node:fs';
 
-// `isFile`/`isDir`/`get`/`isDict` are owned by `js/lib` now (single owner across `hosts/`,
-// `build/`, `inspect/` and `web/` — layering forbids `build/` reaching into `inspect/scan.mjs`
-// for them, so `js/lib` is the one home both sides can reach). Re-exported here so this
-// module's own existing callers (`emit-claude.mjs`, `emit-opencode.mjs`, `version.mjs`,
-// `bundle.mjs`) keep importing them from `./emit-common.mjs` unchanged.
-export { isFile, isDir, get, isDict };
-
 /** `_build_render.SRC_DIRS_MARKER`. */
 export const SRC_DIRS_MARKER = '.geneseed-srcdirs.json';
 /**
@@ -79,11 +72,6 @@ export function rglobFiles(root) {
     .map((d) => path.join(d.parentPath, d.name));
 }
 
-/** `p.relative_to(base).as_posix()`. */
-export function relPosix(base, p) {
-  return path.relative(base, p).split(path.sep).join('/');
-}
-
 /**
  * `_build_emit._strip_capability_links` — `re.sub(r"\1")`, so the pattern needs `g`.
  *

package/js/build/emit-opencode.mjs

@@ -8,16 +8,17 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
+import { claimer, loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
 import {
   copyPlugins, copyWorkflows, ensureAgentOverridesStub, writeColorThemes, writeCommandLayer,
   writePonytailCommand, writePrimaryAgent, writeTheme,
 } from '../hosts/opencode.mjs';
 import { mergeOpencodeJson } from '../hosts/settings.mjs';
-import { readText, writeText } from '../lib/fs.mjs';
+import { isFile, readText, writeText } from '../lib/fs.mjs';
+import { relPosix } from '../lib/text.mjs';
 import { assertSourceComplete, build, phaseLog } from './bundle.mjs';
 import {
-  globalMemory, globalNotebook, isFile, relPosix, shipLeanLaws, stripCapabilityLinks,
+  globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
 import { renderAll } from './render.mjs';
 import {
@@ -56,17 +57,20 @@ function opencodeLayer(cfg, items, themeName, theme, dir, owned, opts) {
   } = opts;
   ensureAgentOverridesStub(cfg, overridesDir);
   const overrides = loadAgentOverrides(overridesDir);
+  // One claim for every writer below whose path lands in `owned` — see `claimer`.
+  const claim = claimer(oldOwned, dir, manifestExisted);
 
   const { nAgents, nSkills, written } = writeNativeLayer(
     items, path.join(dir, 'agents'), path.join(dir, 'skills'), overrides,
-    { host: 'opencode', oldOwned, cfg: dir, manifestExisted, theme, src: cfg.src });
+    { host: 'opencode', theme, src: cfg.src, claim });
   for (const p of written) owned.push(relPosix(dir, p));
 
-  const primary = writePrimaryAgent(cfg, path.join(dir, 'agents'), overrides);
+  const primary = writePrimaryAgent(cfg, path.join(dir, 'agents'), overrides, claim);
   if (primary) owned.push(relPosix(dir, primary));
 
-  const commands = writeCommandLayer(cfg, items, path.join(dir, 'command'));
-  commands.push(writePonytailCommand(path.join(dir, 'command')));   // always-on /ponytail
+  const commands = writeCommandLayer(cfg, items, path.join(dir, 'command'), claim);
+  const ponytail = writePonytailCommand(path.join(dir, 'command'), claim);   // always-on /ponytail
+  if (ponytail) commands.push(ponytail);
   for (const p of commands) owned.push(relPosix(dir, p));
 
   owned.push(relPosix(dir, writeTheme(path.join(dir, 'themes'), themeName, theme)));
@@ -97,7 +101,7 @@ function opencodeLayer(cfg, items, themeName, theme, dir, owned, opts) {
  * manifest is the DRIVER's stage: it reads the file, hands the prior claim in, and prunes
  * and rewrites it after this returns. One owner of the file, and this function is not it.
  *
- * `nativeCatalog` likewise arrives decided. It is `HOSTS['opencode']['native_catalog']` from
+ * `nativeCatalog` likewise arrives decided. It is `hostCatalogsNatively('opencode')` from
  * `js/hosts/hosts.mjs`, resolved by the driver before the call; passing the decision rather
  * than re-reading the registry keeps one owner of it.
  */

package/js/build/generate.mjs

@@ -9,25 +9,27 @@
  * WHY `build` IMPORTS THE DRIVER RATHER THAN SPAWNING IT. The Python is
  * `run([sys.executable, BUILD, *extra]).returncode` — a passthrough to a second process.
  * Reproducing that shape here would mean spawning `node bin/build-driver.mjs`, and
- * `test_the_cli_reaches_no_child_process_module` forbids it: the ban is transitive over this
- * entry's imports, and P5c's argument for keeping it is that `web`, `upgrade` and `setup`
- * will genuinely need to spawn, so the ban should outlive them rather than be dismantled by
- * a verb that does not. It is also the wrong shape on its own terms. Python needs a second
+ * `tests/unit/hook_cli.test.mjs`'s 'the CLI entry reaches child_process only where it is
+ * declared' forbids it: the check is transitive over this entry's imports and allow-lists only
+ * the modules that genuinely start processes — `web`, `upgrade`, `setup` — and P5c's argument
+ * for it is that the ban should outlive them rather than be dismantled by a verb that does not.
+ * It is also the wrong shape on its own terms. Python needs a second
  * process because `build.py` is a different PROGRAM; `bin/build-driver.mjs` is a module in this
  * one, and a Node CLI spawning a Node driver to do work it could do in-process is exactly
  * the passthrough the whole port has been removing. So the driver's `main` is exported and
  * called directly, and the observable contract — the tree, the streams, the exit code — is
- * what `build/*` in `tests/harness_golden.py` compares.
+ * what the `build/*` cells of `tests/golden.mjs --cli` assert.
  *
  * WHAT NO CELL CAN REACH HERE, stated rather than left implicit. `fenceFor`'s real arm is
  * unreachable from the matrix: measured over the whole rendered tree, the longest backtick
  * run in any source text is 3, so `max(4, longest + 1)` picks 4 for all 96 files, and a port
  * that hardcoded four backticks is byte-identical in every prompt cell. Reaching the other
  * arm needs a file in `src/`, and `src/` is the tree no fixture can redirect (P5d). It is
- * therefore gated as a pure function over a corpus in `tests/snapshot/pure_snapshot.test.mjs`, with the
- * unreachability measured in BOTH directions rather than asserted: one test proves the corpus
- * leaves the floor, and one re-renders every theme × posture × mode of the live tree and proves
- * `src/` still does not. The 96 above is one render — the sweep is 13 440 files.
+ * the former Python suite gated it as a pure function over a corpus, with the unreachability
+ * measured in BOTH directions rather than asserted: one test proved the corpus left the floor,
+ * and one re-rendered every theme × posture × mode of the live tree and proved `src/` still did
+ * not. The 96 above is one render — the sweep was 13 440 files. That suite is gone and no Node
+ * test calls `fenceFor`, so the real arm is pinned by nothing today.
  */
 import { existsSync, mkdirSync, statSync } from 'node:fs';
 import path from 'node:path';
@@ -202,7 +204,7 @@ export function installProfile(host, scope, root) {
   const posture = postureOfDir(root) || defaultPosture();
   const mode = modeOfDir(root) || defaultMode();
   // Read off the deployed loop skill; no config fallback — `DEFAULT_PRESET` is the engine's.
-  const trust = trustOfDir(root) || DEFAULT_PRESET;
+  const trust = trustOfDir(root, host) || DEFAULT_PRESET;
   // A rebuild that defaulted the pack selection would re-emit an install into a constitution
   // its owner did not choose — and in one direction that is not merely surprising: dropping
   // the process pack takes the commit/push consent RULES out of AGENT.md while
@@ -360,7 +362,9 @@ export function buildPrompt(cfg, themeName) {
  * Windows. At ~10,000 newlines in a 400 KB document that is the largest byte difference this
  * port could ship, and `harness_golden` can only see half of it — the FILE half is compared
  * directly, the stdout half is folded by `subprocess`'s universal-newline decode, which is
- * why `test_the_two_entry_points_agree_on_stdout_BYTES` grew a `prompt` row.
+ * why the former Python suite's stdout-bytes comparison grew a `prompt` row — kept today as
+ * a row of `tests/unit/hook_cli.test.mjs`'s 'every newline the entry points write is the
+ * platform's'.
  */
 export function cmdPrompt(args) {
   // `args.theme or "neutral"` — a literal in the Python, NOT the config's theme, so this

package/js/build/render.mjs

@@ -8,7 +8,7 @@
  *
  * WHY THIS HALF AND NOT MORE. The emits split into five stages —
  * RENDER* -> WIRE* -> PRUNE -> MANIFEST -> VERIFY (see `_build_global._emit_claude_core`
- * and tests/test_emit_phase_order.py). RENDER produces files Geneseed owns wholesale;
+ * and tests/unit/emit_phase_order.test.mjs). RENDER produces files Geneseed owns wholesale;
  * WIRE reconciles files the user co-owns (settings.json, opencode.json, the CLAUDE.md
  * managed block) and lives in `js/hosts/settings.mjs`, driven from the two emit modules.
  * THIS module is only RENDER

package/js/build/source.mjs

@@ -20,9 +20,9 @@
  * `capabilityLinkRe`'s equivalent override in `stripCapabilityLinks` had no producer either
  * and was deleted outright in the over-engineering cleanup, `cfg` param and all.
  *
- * The move is safe for the reason P5c's was: `tests/golden.py` drives `bin/build-driver.mjs`
- * over 259 cells and compares the tree byte-for-byte, and every one of them builds a cfg
- * from these paths. A depth error or a renamed key fails 259 cells, not zero.
+ * The move is safe for the reason P5c's was: `tests/golden.mjs` drives `bin/build-driver.mjs`
+ * over every emit configuration and requires each to render, and every one of them builds a
+ * cfg from these paths. A depth error or a renamed key fails every cell, not zero.
  */
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
@@ -38,7 +38,7 @@ import { DEFAULT_PRESET } from '../loop/score.mjs';
  * on raw or folded text, so one behaviour serves both.
  */
 const _packTexts = new Map();
-export function readRawText(file) {
+function readRawText(file) {
   const key = path.resolve(file);
   const mtime = statSync(file).mtimeMs;
   const hit = _packTexts.get(key);
@@ -160,8 +160,8 @@ export function resolveRuleIds(text, src = SRC) {
  * `_OWNED` redirect the suite uses is an in-process write, and no env var moves it
  * (`$GENESEED_ROOT` is `harness context`'s doc-discovery root — a different name for a
  * different job). Both implementations therefore answer from their own file's location,
- * which is what makes them comparable and what makes them unfenceable. See the
- * status/version section of `tests/harness_golden.py`.
+ * which is what made them comparable and what makes them unfenceable. See
+ * `js/inspect/status.mjs`'s header for what that leaves unreachable from any cell.
  */
 export const ROOT = path.resolve(import.meta.dirname, '../..');
 export const SRC = path.join(ROOT, 'src');

package/js/build/stubs.mjs

@@ -9,8 +9,9 @@
  */
 import path from 'node:path';
 import { writeText } from '../lib/fs.mjs';
+import { isDir } from '../lib/fs.mjs';
 import { jsonDumpsIndent } from '../lib/json.mjs';
-import { isDir } from './emit-common.mjs';
+import { EXCLUDES_FILE } from '../hosts/hosts.mjs';
 import { existsSync } from 'node:fs';
 
 // ---------------------------------------------------------------------------
@@ -102,8 +103,8 @@ usually one promoted from a recurring memory. Review it by that date, then
 graduate it (remove the marker) or demote it back to memory.
 `;
 
-/** `_build_render.EXCLUDES_FILE`. */
-export const EXCLUDES_FILE = 'excludes.json';
+// Owned by `js/hosts/hosts.mjs` (the hook reads it there); re-exported for `js/inspect/excludes.mjs`.
+export { EXCLUDES_FILE };
 
 /**
  * `_build_render.EXCLUDES_STUB` — one long line, exactly as Python spells it.
@@ -232,8 +233,8 @@ export const ensureProfileStub = stubWriter(PROFILE_FILE, PROFILE_STUB);
 
 /**
  * `_build_render.ensure_excludes_stub` — the sovereign-repo list, seeded once and NEVER
- * overwritten. Reachable only from the Claude-shaped emits, which is why it arrived with
- * `emitClaudeRender` rather than with the bundle stubs beside it.
+ * overwritten. Called by every GLOBAL emit — the Claude-shaped ones and opencode-global —
+ * since that is where the hook looks for it.
  */
 export const ensureExcludesStub = stubWriter(EXCLUDES_FILE, EXCLUDES_STUB);
 

package/js/build/version.mjs

@@ -8,9 +8,11 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { sourceReleaseVersion } from '../hosts/opencode.mjs';
 import { readText, writeText } from '../lib/fs.mjs';
-import { isDir, relPosix, rglobFiles } from './emit-common.mjs';
+import { parseJson } from '../lib/json.mjs';
+import { isDir } from '../lib/fs.mjs';
+import { relPosix } from '../lib/text.mjs';
+import { rglobFiles } from './emit-common.mjs';
 import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 
@@ -132,6 +134,23 @@ export function versionIsNewer(a, b) {
   return false;
 }
 
+/**
+ * `_build_core.source_release_version` — the release this checkout would install. It reads
+ * `cfg.config`, so it takes `cfg`. It lived in `js/hosts/opencode.mjs` for no better reason
+ * than that the first caller was there; every reader since asks a version question, so it
+ * lives with them. `js/hosts/opencode.mjs` re-exports it for its older importers.
+ */
+export function sourceReleaseVersion(cfg) {
+  try {
+    const data = parseJson(readText(cfg.config));
+    const v = data && typeof data === 'object' && !Array.isArray(data) ? data.version : null;
+    if (typeof v === 'string' && v) return v;
+  } catch {
+    // OSError / JSONDecodeError — degrade to "not newer" rather than raising.
+  }
+  return '0.0.0';
+}
+
 /** `_build_render._warn_if_downgrade` — STDOUT, matching the Python. */
 function warnIfDowngrade(cfg, out) {
   const deployed = readReleaseVersion(out);

package/js/hosts/hooks-context.mjs

@@ -8,6 +8,7 @@ import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { readText, printOut as out, printErr as err, withDiscardableStderr } from '../lib/fs.mjs';
 import { normcase, toPlatformPath } from '../lib/paths.mjs';
+import { relPosix } from '../lib/text.mjs';
 import { resolvePath, sovereignBypass } from './hosts.mjs';
 import { isFile, isDir, selfAndParents, sortPaths, listDir } from './hooks-prims.mjs';
 
@@ -177,7 +178,7 @@ function disp(pathStr, root) {
       !== path.parse(path.resolve(root)).root.toLowerCase()) {
     return pathStr;
   }
-  return path.relative(root, pathStr).split(path.sep).join('/');
+  return relPosix(root, pathStr);
 }
 
 

package/js/hosts/hooks-prims.mjs

@@ -23,8 +23,8 @@ import { comparePaths } from '../lib/paths.mjs';
 // none of that reached the hook, because a corpus finds what it is pointed at and nothing
 // named `pyStrPath` was. The consequence was live: `sovereignBypass` compares an
 // `excludes.json` entry against cwd, so a hand-edited `..` entry made the NODE hook stand
-// down for a repo Python still gates. `context/bypass-does-not-match-a-dotdot-entry` is
-// the cell.
+// down for a repo Python still gates. (Since the Python is gone, exclude entries resolve `..`
+// and symlinks on every host — `context/sovereign-bypass-matches-a-dotdot-entry` is the cell.)
 //
 // So the line is not "duplicate rather than couple" — it is "one owner for anything that
 // reproduces a language primitive, wherever it is used". `fs.mjs` carries no

package/js/hosts/hosts.mjs

@@ -66,8 +66,12 @@ export function sovereignBypass(root) {
       // `withDiscardableStderr` because `expanduser` writes its refusal at the RAISE SITE
       // and this caller catches: the reference prints nothing here, so replaying the
       // message would be a stderr divergence on every hook call for one bad entry.
+      //
+      // `resolvePath`, the same resolution as `cwd` above: symlinks and junctions are followed on
+      // BOTH sides, so an entry spelled through a link matches the real directory the session
+      // stands in (and the OpenCode plugins' `norm` applies the identical rule).
       base = withDiscardableStderr(
-        () => normcase(toPlatformPath(expanduser(raw.trim()))).replace(/[\\/]+$/, ''));
+        () => normcase(resolvePath(raw.trim())).replace(/[\\/]+$/, ''));
     } catch {
       // PER ENTRY, and the loop continues. One unusable line in a file the USER hand-edits
       // must not decide the whole function — `expanduser` refuses a `~user` form, and the
@@ -208,14 +212,13 @@ export function openclaudeConfigDir() {
 }
 
 /**
- * `_build_global.HOSTS`, reduced to the two columns a non-emitting caller needs, and IN ITS
- * ORDER — opencode, claude, bob, openclaude.
+ * `_build_global.HOSTS` — one row per host, IN ITS ORDER: opencode, claude, bob, openclaude.
+ * A new host is one row here; `EMIT_HOST_SCOPE` (`js/hosts/installs.mjs`) and `CLAUDE_STYLE`
+ * below are derived from it.
  *
  * An array rather than an object because the order is observable output, not an
  * implementation detail: `harness exclude add` walks it and prints one message per host, so
- * a reordering is a diff in stderr. (`emit_global` and `native_catalog` stay out;
- * `bin/build-driver.mjs` receives those decisions from its own dispatch rather than reading a
- * table.)
+ * a reordering is a diff in stderr.
  *
  * `projectMarker` joined in P5f. `_install_targets` asks "does this cwd carry a project
  * install of host H", and `_claude_cfg` asks "which subdir holds a project install's
@@ -232,13 +235,16 @@ export function openclaudeConfigDir() {
  * `family` joined in 2026-10: `'claude'` for every host emitted through the Claude-shaped
  * engine — one manifest shape, one `settings.json` hook wiring, one strict-JSON `mcpServers`
  * config, one reversal. The list had been spelled out by hand in ten places, one of which
- * ignored the named constant right above it; a fifth host is now one row here.
+ * ignored the named constant right above it.
+ *
+ * `catalog` — does the host list every skill and agent to the model by itself? See
+ * `hostCatalogsNatively` below for what it decides and why it is split per kind.
  */
 export const HOSTS = [
-  { host: 'opencode', family: 'opencode', configDir: opencodeConfigDir, projectMarker: '.opencode', agentFile: 'AGENT.md' },
-  { host: 'claude', family: 'claude', configDir: claudeConfigDir, projectMarker: '.claude', agentFile: 'CLAUDE.md' },
-  { host: 'bob', family: 'claude', configDir: bobConfigDir, projectMarker: '.bob', agentFile: 'AGENTS.md' },
-  { host: 'openclaude', family: 'claude', configDir: openclaudeConfigDir, projectMarker: '.openclaude', agentFile: 'CLAUDE.md' },
+  { host: 'opencode', family: 'opencode', configDir: opencodeConfigDir, projectMarker: '.opencode', agentFile: 'AGENT.md', catalog: { skills: true, agents: true } },
+  { host: 'claude', family: 'claude', configDir: claudeConfigDir, projectMarker: '.claude', agentFile: 'CLAUDE.md', catalog: { skills: true, agents: true } },
+  { host: 'bob', family: 'claude', configDir: bobConfigDir, projectMarker: '.bob', agentFile: 'AGENTS.md', catalog: { skills: true, agents: false } },
+  { host: 'openclaude', family: 'claude', configDir: openclaudeConfigDir, projectMarker: '.openclaude', agentFile: 'CLAUDE.md', catalog: { skills: true, agents: true } },
 ];
 
 /** The Claude-STYLE hosts (`family: 'claude'`), in `HOSTS` order. Test with `.includes(host)`. */
@@ -248,12 +254,11 @@ export const CLAUDE_STYLE = HOSTS.filter((h) => h.family === 'claude').map((h) =
  * `_build_global.host_catalogs_natively` — does `host` list every skill and agent to the
  * model by itself?
  *
- * The third column of `HOSTS`, and the reason the docblock above no longer says
- * `native_catalog` stays out: `doctor`'s `_rendered_problems` has to know, because a host
+ * `HOSTS`' `catalog` column. `doctor`'s `_rendered_problems` has to know, because a host
  * that catalogues natively gets AGENT.md's tables collapsed to a pointer and comparing the
  * portable shape against its bundle reports AGENT.md stale on every run forever. It is a
- * column and not a set literal so that the capability is still declared in exactly one place
- * — the Python's own reason for the helper.
+ * column and not a set literal so that the capability is declared in exactly one place
+ * — the Python's own reason for the helper. The driver reads it through this function too.
  *
  * Unknown host -> false, which is the shape that KEEPS the tables. The value arrives from a
  * user-editable `.geneseed-emit` marker, so an unrecognised one must degrade to the portable
@@ -264,19 +269,12 @@ export const CLAUDE_STYLE = HOSTS.filter((h) => h.family === 'claude').map((h) =
  * single boolean was wrong both ways: `false` shipped the §4 Skills table on top of a
  * catalogue Bob already had (~1.7k tokens twice), `true` would have stripped the §3 Agents
  * table that is Bob's ONLY agent catalogue. Each CATALOG block in AGENT.md names its kind and
- * resolves against its own flag. Mirrored in
- * `bin/build-driver.mjs` (which cannot import this module's spawning neighbours).
+ * resolves against its own flag.
+ *
+ * Returns `{ skills, agents }` for a known host, `false` for an unknown one.
  */
-const NATIVE_CATALOG = {
-  opencode: { skills: true, agents: true },
-  claude: { skills: true, agents: true },
-  bob: { skills: true, agents: false },
-  openclaude: { skills: true, agents: true },
-};
-
-/** `{ skills, agents }` for a known host, `false` for an unknown one. */
 export function hostCatalogsNatively(host) {
-  return NATIVE_CATALOG[host] || false;
+  return HOSTS.find((h) => h.host === host)?.catalog || false;
 }
 
 /** `_harness_learn.MEMORY_DIR_NAMES` — the neutral name and the imperial theme's. */