geneseed 3.14.0 → 3.16.0

package/CHANGELOG.md

@@ -8,6 +8,72 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [3.16.0] — 2026-10-05
+
+**Upgrading:** re-emit (`geneseed rebuild-all`) so the context hook stays under Claude Code's output cap. To drop skills you never use, rebuild an install with `--exclude-skills <name,…>` (see [Exclusions](docs/concepts/exclusions.md)).
+
+### Added
+
+- `--exclude-skills <name,…>` leaves skills you never use out of an install, on every host: their files, their catalogue rows and any OpenCode command that runs them. The install records the list on an `Excluded skills:` line, and `upgrade`, `rebuild-all`, `diff`, `setup` and the web console keep it. Unknown skills are refused, and so are the ten the harness links to by path. `status` shows `skills off: …`.
+
+### Fixed
+
+- The context hook (Claude Code, Bob, OpenClaude) now keeps its whole output under 9,000 characters. Claude Code shows the model only a preview of a hook output past ~10k, so a doc-heavy repo lost its context silently — this repo's was 25.6 KB, now 2.5 KB. Eager docs that do not fit are listed lazy with the reason; the lazy listing folds three or more docs in one folder into `dir/ — N docs` and ends in a count if it is still too long. The OpenCode plugin folds its project listing the same way.
+
+## [3.15.0] — 2026-10-05
+
+**Upgrading:** re-emit (`geneseed rebuild-all`) so OpenCode installs get the hardened plugins and
+the corrected command layer; then `geneseed web restart` (and a hard reload).
+
+### Security
+- **OpenCode notify plugin** — a session title containing a typographic quote (`’`) could close
+  the PowerShell string and run code; title and body now travel through environment variables,
+  and the notifier no longer opens a visible console window.
+- **OpenCode guard** — `rm -rf /*`, `rm -rf ~/*`, `rm -rf -- /` and `rm -r -f /` are blocked
+  (only bare `rm -rf /`, which GNU rm already refuses, was caught before).
+- **Memory names** — a model-written memory named `MEMORY`/`README`, or differing only in case
+  from an existing fact, is refused instead of overwriting the index or another fact (Claude
+  `learn` hook and OpenCode learn plugin); the console's delete endpoint compares the reserved
+  names case-insensitively.
+- **Web console** — POST requests are checked for Host and token before the body is read, and
+  bodies over 1 MiB are refused; `/api/item/config/<name>` serves only the known config files.
+- **No cwd lookups on Windows** — `git`, `java`, `taskkill` and `powershell` are resolved through
+  PATH only, never the current directory, so a binary planted in an untrusted clone can't run.
+- **`.geneseed-theme`** — a path-like marker value is refused instead of loading an arbitrary
+  `.json` file as a theme.
+
+### Fixed
+- **`geneseed upgrade` kept your settings** — it re-rendered an OpenCode install with only its
+  theme and emit, resetting footprint, posture, mode, doctrine packs and excluded rules to the
+  defaults; it now reads the install's own values before pulling. The doctor rollback uses
+  `reset --keep` (no longer discards edits made during the doctor run), a deleted upstream is
+  reported instead of "already up to date", and `bootstrap` exits 1 when the update failed.
+- OpenCode: `/code-review` is emitted again (the skill had been renamed); the command and
+  orchestrator files no longer overwrite — and then uninstall — a file you already had; the
+  learn plugin no longer exports non-functions; the context cache is per project; same-day
+  workflow runs no longer collide, and kept worktrees live under `.geneseed/worktrees/`.
+- `agent-overrides.json` values that are not plain strings or numbers are skipped with a warning
+  instead of crashing the emit or injecting frontmatter; Claude-family hosts warn about the keys
+  they ignore.
+- In a repo with both `.opencode/` and `.claude/`, each install reads its own loop trust preset.
+- Web console: Restart/update from a foreground `geneseed web` no longer orphans a daemon, the
+  page reloads against the new server, shutdown/restart wait for running jobs, `web stop` no
+  longer forgets a daemon that is still running, finished jobs are trimmed from memory, the Diff
+  page explains project installs, and job polling survives a dropped request.
+- `geneseed link` no longer deletes a `geneseed` it didn't create; the PATH check and quoting
+  are exact.
+- Exclusions follow one rule on every host: `..` and symlinks are resolved on both sides, so an
+  entry spelled through a link excludes the real folder and `exclude remove` can take back any
+  entry that excludes.
+- `geneseed setup` no longer crashes when the deployed theme is one this checkout doesn't ship.
+
+### Changed
+- `uninstall` loads 14 modules instead of 43 (prompts moved to `js/lib/prompt.mjs`); `update`
+  27 instead of 52; the web daemon 40 instead of 51.
+- Web server split along its seams (`routes.mjs`, `catalog.mjs`, `state.mjs`, `user-files.mjs`),
+  removing two import cycles; dead TUI helpers, undriven probe rows and stale comment pointers
+  to the former Python suite removed.
+
 ## [3.14.0] — 2026-10-04
 
 **Upgrading:** re-emit (`geneseed rebuild-all`) so installed hooks pick up the gate fixes and the

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.14.0**.
+> string. Current label: **3.16.0**.
 
 ## Capabilities
 

package/adapters/opencode/plugins/geneseed-context.js

@@ -52,7 +52,7 @@
 // opencode-global` and `--emit opencode` both place it for you. Keep ONE copy:
 // OpenCode dedups plugins by npm name+version only, so two local copies both load.
 
-import { promises as fs } from "node:fs"
+import { promises as fs, realpathSync } from "node:fs"
 import * as path from "node:path"
 import { fileURLToPath } from "node:url"
 import { homedir } from "node:os"
@@ -73,6 +73,16 @@ const norm = (p) => {
     raw = raw === "~" ? homedir() : path.join(homedir(), raw.slice(2))
   }
   let s = path.resolve(raw)
+  // Symlinks and junctions followed through the deepest existing ancestor (the rest appended),
+  // the rule js/hosts/hosts.mjs resolvePath applies: an exclude spelled through a link matches
+  // on every host, not only on Claude/Bob.
+  for (let cur = s, tail = []; ;) {
+    try { s = path.join(realpathSync.native(cur), ...tail); break } catch { /* walk up */ }
+    const up = path.dirname(cur)
+    if (up === cur) break
+    tail.unshift(path.basename(cur))
+    cur = up
+  }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 async function sovereignBypass(cwd) {
@@ -107,6 +117,8 @@ const MAX_DEPTH = 6
 // the head of each file (enough for an H1) rather than the whole thing — a large
 // docs/ tree must not cost one full-file read per entry on every session start.
 const LAZY_HEADING_LIMIT = envNum("GENESEED_LAZY_HEADINGS", 64)
+// Same threshold as the Claude hook's LAZY_FOLD_AT.
+const LAZY_FOLD_AT = 3
 const HEADING_SLICE_BYTES = 4096
 
 // Quiet by default — OpenCode surfaces a plugin's stderr in the UI (red text). Set
@@ -580,7 +592,7 @@ async function walkWikiDir(dir, depth, acc) {
 // entry on a large vault would otherwise inject thousands of listing lines. Beyond
 // the cap the listing truncates with a visible count and the agent explores the
 // folders on demand instead.
-const WIKI_LAZY_LIMIT = Number(process.env.GENESEED_WIKI_LAZY_LIMIT || 200)
+const WIKI_LAZY_LIMIT = envNum("GENESEED_WIKI_LAZY_LIMIT", 200)
 
 // Parse wiki.jsonc into renderable wikis: [{ name, root, desc, conventions, inbox,
 // protected, eager:[{rel,abs,desc}], lazy:[...], truncated }]. Entry paths resolve
@@ -654,7 +666,7 @@ async function wikiSets() {
 // Render one eager+lazy set into `out`. The budget state (eager bytes, heading
 // reads) is SHARED across segments — project context and every wiki draw from the
 // same caps, so the whole block stays bounded no matter how many wikis are declared.
-async function renderSet(out, { eager, lazy }, state) {
+async function renderSet(out, { eager, lazy }, state, { fold = false } = {}) {
   const perFile = EAGER_FILE_KB * 1024
   const total = EAGER_TOTAL_KB * 1024
   const demoted = []
@@ -682,8 +694,26 @@ async function renderSet(out, { eager, lazy }, state) {
     state.injected++
   }
 
+  // The project listing folds like the Claude hook's (js/hosts/hooks-context.mjs): three or more
+  // undescribed docs sharing a parent directory become one `dir/ — N docs` line — a docs/ tree
+  // of 186 files was 186 lines on every session. Root files never fold. A wiki listing keeps its
+  // per-note headings: a vault is navigated by them, and it carries its own cap.
+  const byDir = new Map()
+  if (fold) {
+    for (const l of lazy) {
+      const dir = path.posix.dirname(l.rel.replace(/\\/g, "/"))
+      if (!l.desc && dir !== ".") byDir.set(dir, (byDir.get(dir) || 0) + 1)
+    }
+  }
+  const folded = new Set()
   const lazyLines = []
   for (const l of lazy) {
+    const dir = path.posix.dirname(l.rel.replace(/\\/g, "/"))
+    if (!l.desc && byDir.get(dir) >= LAZY_FOLD_AT) {
+      if (!folded.has(dir)) lazyLines.push(`  - ${dir}/ — ${byDir.get(dir)} docs`)
+      folded.add(dir)
+      continue
+    }
     let head = l.desc
     // Only crack open files we have no description for, and cap how many — bounded by
     // a head-slice read so a big docs/ tree stays cheap on every session start.
@@ -724,7 +754,7 @@ async function buildBlock(sets, wikis = [], commands = [], session = []) {
   }
 
   const proj = []
-  await renderSet(proj, sets, state)
+  await renderSet(proj, sets, state, { fold: true })
 
   if (commands.length) {
     proj.push("--- Project commands (runnable targets discovered in the repo root) ---")
@@ -765,16 +795,19 @@ async function resolveBlock(root) {
   return { block: await buildBlock(sets, wikis, commands, await sessionFiles(harness)), src }
 }
 
-// Per-process cache of the rendered block text for the transform path (root is fixed
-// per plugin instance). Recomputed at most once per TTL so doc edits are picked up.
-let _blockCache = { text: null, at: 0 }
+// Per-INSTANCE cache of the rendered block text for the transform path: the caller owns
+// `cache`, one per plugin instance, because root is fixed per instance but one OpenCode
+// process can serve several directories — a module-level cache served project A's
+// context into B for a whole TTL. Recomputed at most once per TTL so doc edits are
+// picked up.
 const BLOCK_TTL_MS = 30000
-async function cachedBlockText(root) {
+async function cachedBlockText(root, cache) {
   const now = Date.now()
-  if (_blockCache.text !== null && now - _blockCache.at < BLOCK_TTL_MS) return _blockCache.text
+  if (cache.text !== null && now - cache.at < BLOCK_TTL_MS) return cache.text
   let text = ""
   try { const { block } = await resolveBlock(root); text = block?.text || "" } catch {}
-  _blockCache = { text, at: now }
+  cache.text = text
+  cache.at = now
   return text
 }
 
@@ -797,6 +830,7 @@ export const GeneseedContext = async (ctx) => {
   const { client } = ctx
   const done = new Set()
   const root = repoRoot(ctx)
+  const blockCache = { text: null, at: 0 }
 
   // Visible delivery — post the block as a noReply session message. Used when
   // GENESEED_CONTEXT_VISIBLE forces it, and by the transform fallback below.
@@ -927,7 +961,7 @@ export const GeneseedContext = async (ctx) => {
         const present = output.messages.some((m) =>
           (m?.parts ?? []).some((p) => typeof p?.text === "string" && p.text.includes(MARKER)))
         if (present) return
-        const cached = await cachedBlockText(root)
+        const cached = await cachedBlockText(root, blockCache)
         if (!cached) return
         // Model line is request-specific (kept out of the cache): prefer the live
         // transcript on this request, fall back to $GENESEED_MODEL.

package/adapters/opencode/plugins/geneseed-guard.js

@@ -31,7 +31,7 @@
 // fires `permission.ask` simply never reaches this hook — the static ask still fires, so the
 // failure mode is one extra prompt, never a silent allow.
 
-import { promises as fs, existsSync, statSync, lstatSync, readFileSync, openSync, readSync, closeSync } from "node:fs"
+import { promises as fs, realpathSync, existsSync, statSync, lstatSync, readFileSync, openSync, readSync, closeSync } from "node:fs"
 import * as path from "node:path"
 import { fileURLToPath } from "node:url"
 import { homedir } from "node:os"
@@ -50,6 +50,16 @@ const norm = (p) => {
     raw = raw === "~" ? homedir() : path.join(homedir(), raw.slice(2))
   }
   let s = path.resolve(raw)
+  // Symlinks and junctions followed through the deepest existing ancestor (the rest appended),
+  // the rule js/hosts/hosts.mjs resolvePath applies: an exclude spelled through a link matches
+  // on every host, not only on Claude/Bob.
+  for (let cur = s, tail = []; ;) {
+    try { s = path.join(realpathSync.native(cur), ...tail); break } catch { /* walk up */ }
+    const up = path.dirname(cur)
+    if (up === cur) break
+    tail.unshift(path.basename(cur))
+    cur = up
+  }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 async function sovereignBypass(cwd) {
@@ -119,8 +129,10 @@ const SECRET_WARN_RE = [/(^|\/)\.env(\.[\w.-]+)?$/i]
 // Catastrophic, effectively irreversible shell → BLOCK. Both Unix and Windows shells,
 // since OpenCode runs natively on Windows and the agent may emit cmd / PowerShell.
 const SHELL_BLOCK_RE = [
-  /\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+(--no-preserve-root\s+)?\/(\s|$)/, // rm -rf /
-  /\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+~(\/)?(\s|$)/,                     // rm -rf ~
+  // rm -rf /, ~, /*, ~/* — flags may be split (-r -f), long (--recursive), or end with
+  // `--`; the lookahead insists one of them recurses. The target must be the root or
+  // home itself (optionally globbed), so `rm -rf /tmp/x` and `rm -rf ./build` pass.
+  /\brm\s+(?=(?:(?:-[a-zA-Z]+|--[a-z-]*)\s+)*?(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)\s)(?:(?:-[a-zA-Z]+|--[a-z-]*)\s+)+(?:\/|~\/?)\*?(\s|$)/,
   /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,                         // fork bomb
   /\bmkfs\.\w+\s+\/dev\//,                                            // format a device
   /\bdd\b[^\n]*\bof=\/dev\/(sd|nvme|hd|disk)/,                        // dd over a raw disk
@@ -409,7 +421,7 @@ export const GeneseedGuard = async (ctx) => {
   return {
     "tool.execute.before": async (input, output) => {
       if (OFF) return
-      if (await sovereignBypass(process.cwd())) return
+      if (await sovereignBypass(root())) return
       const tool = (input?.tool || input?.name || "").toLowerCase()
       const args = output?.args || input?.args || {}
       // `rule` is the ledger key, spelled as js/hosts/hooks.mjs spells it (`law-1`,

package/adapters/opencode/plugins/geneseed-learn.js

@@ -29,10 +29,11 @@
 //   3. ./memory  or  ./Harness/memory   (when the bundle is inside the project)
 // If none resolve, it logs once and does nothing — it never blocks a session.
 //
-// It is intentionally conservative: trivial sessions are skipped, each session is
-// processed at most once per process, and any error is swallowed.
+// It is intentionally conservative: trivial sessions are skipped, one session never
+// has two distils in flight at once (a continued session re-distils after its next
+// quiet window — see TIMING), and any error is swallowed.
 
-import { promises as fs } from "node:fs"
+import { promises as fs, realpathSync } from "node:fs"
 import * as path from "node:path"
 import { fileURLToPath } from "node:url"
 import { homedir } from "node:os"
@@ -54,6 +55,16 @@ const norm = (p) => {
     raw = raw === "~" ? homedir() : path.join(homedir(), raw.slice(2))
   }
   let s = path.resolve(raw)
+  // Symlinks and junctions followed through the deepest existing ancestor (the rest appended),
+  // the rule js/hosts/hosts.mjs resolvePath applies: an exclude spelled through a link matches
+  // on every host, not only on Claude/Bob.
+  for (let cur = s, tail = []; ;) {
+    try { s = path.join(realpathSync.native(cur), ...tail); break } catch { /* walk up */ }
+    const up = path.dirname(cur)
+    if (up === cur) break
+    tail.unshift(path.basename(cur))
+    cur = up
+  }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
 async function sovereignBypass(cwd) {
@@ -155,19 +166,20 @@ const AGENT_NAME_RE = /^[a-z][a-z0-9-]{1,40}$/
 const MAX_AGENT_BULLETS = 100 // hard cap, oldest dropped; no pruning heuristics
 
 // SINGLE SOURCE — the harness extracts this exact literal (see LEARN_PROMPT_HEAD).
-export const AGENT_LESSON_PROMPT = `The notes below are one subagent dispatch ("agent run").
+// Not exported: OpenCode calls every export as a plugin factory, and a string is not one.
+const AGENT_LESSON_PROMPT = `The notes below are one subagent dispatch ("agent run").
 Output AT MOST ONE line: a durable lesson about how this agent should operate on a
 FUTURE, unrelated dispatch (a boundary that proved wrong, an input it always needs,
 a method that worked). Task residue ("fixed X", file names, ticket detail) is NOT a
 lesson. If there is none — the overwhelmingly common case — output exactly: NOTHING.`
 
-export function resolveAgentName(meta) {
+function resolveAgentName(meta) {
   const raw = meta?.agent ?? meta?.agentName ?? meta?.agentID ?? null
   const name = typeof raw === "string" ? raw.trim().toLowerCase() : null
   return name && AGENT_NAME_RE.test(name) ? name : null
 }
 
-export async function appendAgentLesson(memDir, agent, lesson) {
+async function appendAgentLesson(memDir, agent, lesson) {
   const dir = path.join(memDir, "agents")
   await fs.mkdir(dir, { recursive: true })
   const file = path.join(dir, `${agent}.md`)
@@ -211,8 +223,12 @@ function envModel() {
   return null
 }
 
+// Stems that name the store's own files, never a fact: `MEMORY` is the index, so a model
+// that emitted `name: MEMORY` would overwrite it.
+const RESERVED_STEMS = new Set(["memory", "readme"])
+
 async function existingSlugs(memDir) {
-  const skip = new Set(["memory", "readme"])
+  const skip = RESERVED_STEMS
   try {
     const entries = await fs.readdir(memDir)
     return new Set(
@@ -256,7 +272,10 @@ function parseFrontmatter(chunk) {
 // js/hosts/hooks.mjs, inlined because this file ships standalone.
 const MEMORY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$/
 
+// Compared lowercase: on a case-insensitive filesystem (Windows, macOS) `User-Prefs`
+// and `user-prefs` are the same file, so a case variant would overwrite a stored fact.
 async function writeMemories(output, memDir, existing) {
+  const taken = new Set([...existing].map((s) => s.toLowerCase()))
   const written = []
   const indexLines = []
   for (let chunk of output.split(/^---FILE---\s*$/m)) {
@@ -264,9 +283,11 @@ async function writeMemories(output, memDir, existing) {
     if (!chunk || chunk.toUpperCase() === "NOTHING") continue
     const fm = parseFrontmatter(chunk)
     const name = (fm.name || "").trim()
-    if (!MEMORY_SLUG_RE.test(name) || existing.has(name)) continue
+    const key = name.toLowerCase()
+    if (!MEMORY_SLUG_RE.test(name) || RESERVED_STEMS.has(key) || taken.has(key)) continue
     await fs.writeFile(path.join(memDir, `${name}.md`), chunk.replace(/\n+$/, "") + "\n", "utf8")
     existing.add(name)
+    taken.add(key)
     written.push(name)
     const desc = (fm.description || "").trim()
     indexLines.push(`- [${name}](${name}.md)` + (desc ? ` — ${desc}` : ""))
@@ -280,14 +301,19 @@ async function writeMemories(output, memDir, existing) {
   return written
 }
 
-export const GeneseedLearn = async ({ client }) => {
+export const GeneseedLearn = async (ctx) => {
+  const { client } = ctx ?? {}
   const ours = new Set()       // throwaway distil sessions — never mine our own output
   const timers = new Map()     // sid -> debounce timer, re-armed on each idle
   const inFlight = new Set()   // sid currently being distilled (guards against overlap)
   let warnedNoDir = false
 
+  // The session root, as guard and context use it — not process.cwd(), which is the
+  // directory OpenCode was launched from and need not be the project being served.
+  const root = ctx?.worktree || ctx?.directory || process.cwd()
+
   async function runDistill(sid) {
-    if (await sovereignBypass(process.cwd())) return
+    if (await sovereignBypass(root)) return
     if (inFlight.has(sid)) return   // a run is already underway; the next idle re-arms
     inFlight.add(sid)
     try {
@@ -400,6 +426,6 @@ export const GeneseedLearn = async ({ client }) => {
 
 // OpenCode treats every export as a plugin and rejects non-functions; hang the test
 // helpers off the factory instead — reachable via import, invisible to the loader.
-Object.assign(GeneseedLearn, { writeMemories })
+Object.assign(GeneseedLearn, { writeMemories, resolveAgentName, appendAgentLesson })
 
 export default GeneseedLearn

package/adapters/opencode/plugins/geneseed-notify.js

@@ -27,6 +27,7 @@
 // glob), exactly like the context, learn, guard, and workflow plugins.
 
 import { spawn } from "node:child_process"
+import path from "node:path"
 
 const MODE = (process.env.GENESEED_NOTIFY || "on").toLowerCase()
 const OFF = ["off", "0", "false", "no"].includes(MODE)
@@ -67,11 +68,41 @@ function shouldNotify({ now, lastUserMs, parentID, title, minMs }) {
 
 // AppleScript double-quoted string literal.
 function asStr(s) { return '"' + String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"' }
-// PowerShell single-quoted string literal (escape ' by doubling).
-function psStr(s) { return "'" + String(s).replace(/'/g, "''") + "'" }
 
-function spawnDetached(cmd, args) {
-  const child = spawn(cmd, args, { stdio: "ignore", detached: true })
+// The notifier invocation for a platform, as data. Exported (via the factory) for tests.
+// Windows passes title and body through the environment, never through the -Command
+// text: PowerShell treats U+2018-U+201B as quote characters too, so escaping ASCII '
+// alone let a model-generated session title like  x’;Start-Process calc;’  close the
+// literal and run code. An env var is read as a value and never parsed as script.
+function notifyCommand(platform, title, body) {
+  if (platform === "darwin") {
+    return { cmd: "osascript", args: ["-e", `display notification ${asStr(body)} with title ${asStr(title)}`] }
+  }
+  if (platform === "win32") {
+    const script =
+      "Add-Type -AssemblyName System.Windows.Forms;" +
+      "Add-Type -AssemblyName System.Drawing;" +
+      "$n=New-Object System.Windows.Forms.NotifyIcon;" +
+      "$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;" +
+      "$n.ShowBalloonTip(5000,$env:GS_T,$env:GS_B,[System.Windows.Forms.ToolTipIcon]::Info);" +
+      "Start-Sleep -Seconds 6;$n.Dispose()"
+    return {
+      // By absolute path: a bare "powershell" resolves against the cwd first on Windows.
+      cmd: path.join(process.env.SystemRoot || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      args: ["-NoProfile", "-NonInteractive", "-Command", script],
+      env: { GS_T: String(title), GS_B: String(body) },
+    }
+  }
+  return { cmd: "notify-send", args: [title, body] }
+}
+
+// windowsHide: without it a detached PowerShell opens a visible console window that
+// sits on screen for the six seconds the balloon needs.
+function spawnDetached({ cmd, args, env }) {
+  const child = spawn(cmd, args, {
+    stdio: "ignore", detached: true, windowsHide: true,
+    env: env ? { ...process.env, ...env } : process.env,
+  })
   child.on("error", (e) => log(`spawn ${cmd} failed: ${e?.message ?? e}`))   // e.g. notifier not installed
   child.unref()
 }
@@ -79,20 +110,7 @@ function spawnDetached(cmd, args) {
 // Best-effort native notification; every failure is swallowed.
 function deliver(title, body) {
   try {
-    if (process.platform === "darwin") {
-      spawnDetached("osascript", ["-e", `display notification ${asStr(body)} with title ${asStr(title)}`])
-    } else if (process.platform === "win32") {
-      const script =
-        "Add-Type -AssemblyName System.Windows.Forms;" +
-        "Add-Type -AssemblyName System.Drawing;" +
-        "$n=New-Object System.Windows.Forms.NotifyIcon;" +
-        "$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;" +
-        `$n.ShowBalloonTip(5000,${psStr(title)},${psStr(body)},[System.Windows.Forms.ToolTipIcon]::Info);` +
-        "Start-Sleep -Seconds 6;$n.Dispose()"
-      spawnDetached("powershell", ["-NoProfile", "-NonInteractive", "-Command", script])
-    } else {
-      spawnDetached("notify-send", [title, body])
-    }
+    spawnDetached(notifyCommand(process.platform, title, body))
   } catch (err) {
     log(`deliver failed: ${err?.message ?? err}`)
   }
@@ -137,6 +155,6 @@ export const GeneseedNotify = async ({ client }) => {
 // ponytail: OpenCode treats every export as a plugin and rejects non-functions; a
 // bare helper export crashes startup or logs "not a function". Hang the test helpers
 // off the factory instead — reachable via `import`, invisible to the loader.
-Object.assign(GeneseedNotify, { lastUserMs, shouldNotify })
+Object.assign(GeneseedNotify, { lastUserMs, shouldNotify, notifyCommand })
 
 export default GeneseedNotify

package/adapters/opencode/plugins/geneseed-workflow.js

@@ -14,7 +14,9 @@
 // written to `.geneseed/workflow-runs/<runId>.log`. Every failure is contained and
 // reported, never thrown into the session.
 //
-// Quiet by default; GENESEED_DEBUG=1 logs to stderr. GENESEED_WORKFLOWS_DIR overrides
+// One stderr line at load (the banner below — it is how a restart shows the tool
+// registered, or warns that it could not); everything else is quiet unless
+// GENESEED_DEBUG=1. GENESEED_WORKFLOWS_DIR overrides
 // where saved workflows are loaded from.
 
 import { execFile } from "node:child_process"

package/adapters/opencode/workflows/_runtime.js

@@ -16,6 +16,7 @@
 // authoring convention — imported modules cannot have their globals shadowed — not a
 // hard sandbox guard. See docs/specs/2026-06-09-opencode-workflow-primitive.md.
 
+import { promises as fs } from "node:fs"
 import * as os from "node:os"
 import * as path from "node:path"
 
@@ -189,14 +190,23 @@ async function runChildSession(client, { prompt, agent, model, title, directory
 // the runtime never merges, commits, or deletes work. `git(argv, cwd)` is injected by the
 // plugin so this file stays pure and testable. The worktree has no untracked files from
 // the root (no node_modules, no .env): an agent that must run the project installs first.
-const slug = (t) => String(t).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 32) || "agent"
+//
+// Worktrees live under <root>/.geneseed/worktrees/ beside the run traces, NOT in the OS
+// temp dir: a kept worktree is unmerged work, and temp cleaners delete it. The state dir
+// gets a `*` .gitignore of its own (never overwriting one already there), so neither the
+// worktrees nor the traces show up as untracked files in the project.
+const fullSlug = (t) => String(t).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "")
+const slug = (t) => fullSlug(t).slice(0, 32) || "agent"
 
 export async function isolate(git, root, name) {
   if (typeof git !== "function") throw new Error("worktree isolation unavailable — no git executor")
   if (!root) throw new Error("worktree isolation unavailable — unknown working dir")
   const base = (await git(["rev-parse", "HEAD"], root)).trim()
   const branch = `geneseed-wf/${name}`
-  const dir = path.join(os.tmpdir(), "geneseed-wf", name)
+  const state = path.join(root, ".geneseed")
+  await fs.mkdir(path.join(state, "worktrees"), { recursive: true })
+  await fs.writeFile(path.join(state, ".gitignore"), "*\n", { flag: "wx" }).catch(() => {})
+  const dir = path.join(state, "worktrees", name)
   await git(["worktree", "add", "-b", branch, dir, base], root)
   return { dir, branch, base }
 }
@@ -224,7 +234,10 @@ export function overlaps(worktrees) {
 export function createRuntime(ctx) {
   const { client, directory, worktree, log: sink, git } = ctx
   const root = worktree || directory
-  const runTag = slug(ctx.runId || "run")
+  // The WHOLE run id, never truncated: it ends in the run's time, and cutting it to the
+  // label slug's 32 characters left two same-day runs of a long-named workflow with one
+  // tag — the second run's `worktree add -b` then hit the first run's kept branch.
+  const runTag = fullSlug(ctx.runId || "run") || "run"
   const worktrees = []
   const args = ctx.args || {}
   const cap = ctx.concurrency || concurrencyCap()

package/bin/geneseed-cli.mjs

@@ -8,7 +8,8 @@
  * specific.
  *
  *   * GROWING `bin/geneseed-hook.mjs` weakens the gate the design now rests on.
- *     `test_the_entry_carries_exactly_the_verbs_the_emitter_wires` asserts EQUALITY between
+ *     'the hook entry carries exactly the verbs the emitter wires' (`tests/unit/hook_cli.test.mjs`)
+ *     asserts EQUALITY between
  *     that file's table and the hooks `js/hosts/settings.mjs` wires, and P5b made it load-bearing:
  *     the shim is machine-wide (`~/.geneseed/bin/geneseed-hook[.cmd]`, no per-install
  *     component) and last-writer-wins, so a Node emit owns the hooks of installs Python
@@ -23,23 +24,24 @@
  *     no-op and a success are one observation.
  *   * `bin/build-driver.mjs` IS `build.py`'s `main()` — a different Python program from
  *     `rituals/harness.py`, not a different half of the same one. It parses generator FLAGS
- *     with a partition asserted over them (`test_the_node_driver_classifies_every_emit`),
- *     `tests/golden.py` drives it 259 times per run, and it is under a hard `child_process`
+ *     with a partition asserted over them ('the driver classifies every emit',
+ *     `tests/unit/node_driver.test.mjs`),
+ *     `tests/golden.mjs` drives it over every emit configuration, and it is under a hard `child_process`
  *     ban that is half the proof it is not a passthrough. `exclude` spawns nothing and would
  *     not have broken that ban — but `web`, `upgrade` and `setup` will, and the ban should
  *     outlive them rather than be dismantled by the first verb that does not need it.
  *
  * What this costs is what the P5b handoff predicted: a second acceptance matrix. It is paid
- * in `tests/harness_golden.py`, which now carries a `bin` per cell and takes `--new-cli`
- * beside `--new` — and it would have been paid identically by the `bin/build-driver.mjs` option,
+ * in `tests/golden.mjs --cli` (`tests/helpers/matrix/cli.<platform>.json`), which carries a
+ * `bin` per cell — and it would have been paid identically by the `bin/build-driver.mjs` option,
  * so it is not a discriminator between the two.
  *
  * THE VERB SET REFUSES THE REST BY NAME, exactly as the hook entry does. It carries 22 of the
  * 26 names the reference's parser answered to (25 subparsers, plus the alias) — the other
  * four are the hook verbs — and, since the three rows at the end of the table below, three
- * that the reference never had at all. `test_the_two_entry_points_carry_disjoint_verb_sets`
- * keeps the two tables from ever answering the same verb twice, since the shim bakes only one
- * of them.
+ * that the reference never had at all. 'the two entry points carry disjoint verb sets'
+ * (`tests/unit/hook_cli.test.mjs`) keeps the two tables from ever answering the same verb
+ * twice, since the shim bakes only one of them.
  *
  * P6h MADE THE DISPATCH ASYNCHRONOUS and put `js/web/` on this entry's import graph — LAZILY,
  * since the slim pass: every command module loads through its verb's thunk, so the graph is
@@ -73,9 +75,9 @@ import { printErr, printOut } from '../js/lib/fs.mjs';
  * hold: the FUNCTION.
  *
  * IT IS STILL A TABLE and still the DISPATCH rather than a declaration beside one.
- * `tests/test_hook_cli_parity.py` scrapes `const VERBS = {` for its three matrix gates, and
- * `main`'s refusal lists `Object.keys(VERBS)` IN THIS ORDER, which `harness_golden` cells
- * assert verbatim — the order is the old table's and is not alphabetical.
+ * `tests/unit/hook_cli.test.mjs` scrapes `const VERBS = {` for its matrix gates, and
+ * `main`'s refusal lists `Object.keys(VERBS)` IN THIS ORDER (no cell asserts the list
+ * verbatim any more) — the order is the old table's and is not alphabetical.
  *
  * FLATTENED TO `verb: fn` since Task 5, AND TO `verb: loader` since the lazy pass: every row
  * is now a thunk that imports the command's module and resolves to its function, so the one
@@ -104,9 +106,9 @@ const VERBS = {
   // `up.add_parser(..., aliases=["update"])`, reproduced in P8c as a ROW OF ITS OWN rather than
   // as an `aliases` field on the row above — because a field would be a DECLARATION and the
   // three matrix gates read this table as the DISPATCH (rule 7, and M23 is where it was
-  // learned). As a key it is a real verb: `test_every_entry_verb_is_a_real_harness_subcommand`
-  // reads argparse's aliases out of `harness.py` and finds it, and
-  // `test_the_matrix_covers_every_verb_it_claims` demands the `update/` cell group that proves
+  // learned). As a key it is a real verb: `tests/unit/hook_cli.test.mjs`'s 'every entry verb
+  // is a command the driver table dispatches' finds it in `js/cli-table.json`, and 'the matrix
+  // covers every verb each entry claims' demands the `update/` cell group that proves
   // it reaches `cmdUpgrade` — including the theme re-read, which is what separates it from
   // `sync-self`.
   //
@@ -129,8 +131,8 @@ const VERBS = {
   // exit code, and that arm crosses byte for byte. The panel behind it is P7c's;
   // `js/ui/tui.mjs`'s header argues why this entry falls back to `cmd_tui`'s own
   // panel-unavailable line rather than inventing a second full-screen UI, and
-  // `tests/test_tui_boundary.py` asserts that the arm it declares is genuinely unreachable
-  // here rather than merely untested.
+  // `tests/unit/no_panel.test.mjs` asserts that no panel lies behind it — the module paints
+  // nothing and refuses on a TTY too — rather than leaving that merely untested.
   tui: () => import('../js/ui/tui.mjs').then((m) => m.cmdTui),
   // THE THREE THAT NEVER HAD A PYTHON ORIGINAL, and they are last for that reason rather
   // than by alphabet: every row above is the twin of a subparser, and these three are not.
@@ -143,9 +145,9 @@ const VERBS = {
   // this change rather than after it. The recorded help corpus was rendered from a live
   // argparse object, and there was no subparser to render these from; the acceptance matrix
   // is a comparison of two implementations, and there is only one. So their gates are
-  // ABSOLUTE — `tests/snapshot/cli_help.test.mjs` splits the two populations by name and refuses a
-  // verb that falls into neither, and each has its own unit gate stating what it does rather
-  // than that it agrees.
+  // ABSOLUTE — `tests/unit/hook_cli.test.mjs`'s `NATIVE` list splits the two populations by
+  // name and refuses a verb that falls into neither, and each has its own unit gate stating
+  // what it does rather than that it agrees.
   catalog: () => import('../js/build/catalog.mjs').then((m) => m.cmdCatalog),
   mcp: () => import('../js/hosts/mcp.mjs').then((m) => m.cmdMcp),
   memory: () => import('../js/maintain/memory.mjs').then((m) => m.cmdMemory),
@@ -173,7 +175,7 @@ function die(code, msg) {
  *
  * The WORDING of an argparse failure is deliberately not reproduced — argparse prints a
  * usage block computed from the whole parser tree, and P5a set the precedent for the hook
- * entry: state the fault plainly, gate it absolutely in `test_hook_cli_parity.py`, and keep
+ * entry: state the fault plainly, gate it absolutely in `tests/unit/hook_cli.test.mjs`, and keep
  * it out of the compared matrix. What IS compared is every error the command's own body
  * raises, `exclude`'s missing-path refusal among them.
  */