geneseed 3.19.0 → 4.0.0

package/js/hosts/installs.mjs

@@ -36,11 +36,15 @@ import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 
 import { CONFIG, PACK_ORDER, THEMES, discoverNames, resolveSkillNames } from '../build/source.mjs';
-import { CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, resolvePath } from './hosts.mjs';
+import {
+  CLAUDE_STYLE, DISABLED_STASH, GLOBAL_MANIFEST, HOSTS, isHostGlobalDir, liveRecordedHooks,
+  resolvePath,
+} from './hosts.mjs';
 import { registryRoots } from '../inspect/registry.mjs';
 import { printErr, readText, isFile, isDir } from '../lib/fs.mjs';
 import { formatRepr, isDict } from '../lib/json.mjs';
 import { comparePaths } from '../lib/paths.mjs';
+import { claudeHookShell } from './shim.mjs';
 
 /**
  * `Path.read_text(encoding="utf-8")`, or null where Python raises OSError.
@@ -137,14 +141,54 @@ function themeFromAgent(agentMd) {
 }
 
 /**
- * `_harness_setup.CARRIERS` — the four instruction carriers, in the Python's order.
+ * `_harness_setup.CARRIERS` — the Python's four root-level carriers, plus one JS-only addition.
  *
  * A shared table rather than three copies of the same list: `_theme_of_dir`,
  * `_posture_of_dir` and `_mode_of_dir` each walk it, and the order is observable (the first
  * carrier that answers wins). `rules/geneseed.md` is spelled with `path.join` at each use
  * because the Python writes `d / "rules" / "geneseed.md"` for that one entry.
+ *
+ * `.openclaude/CLAUDE.md` is NOT in the Python — OpenClaude didn't exist yet — and it is half
+ * of the fix for host-compat verdict B1 (the other half is `carriersFor`, below).
+ * OpenClaude's own per-repo carrier is `carrierInLayer` (see `CLAUDE_SHAPED.openclaude` in
+ * `js/build/driver.mjs`, and the `HOSTS` column of the same name): it sits at
+ * `<repo>/.openclaude/CLAUDE.md`, and the root `CLAUDE.md` is deliberately left untouched so a
+ * Claude Code install can share the repo.
+ *
+ * ⚠ THIS LIST STAYS HOST-AGNOSTIC ON PURPOSE — it is only `firstCarrier`'s FALLBACK for a
+ * caller with no host to narrow by (none of this module's exported `*OfDir` readers is one;
+ * see `carriersFor`). A caller that DOES have a host must pass it, or in a repo sharing two
+ * carriers that answer the same probe — only root `CLAUDE.md` today, between `claude` and
+ * `openclaude`'s global scope — this host-agnostic order decides for both of them, which was
+ * exactly B1's failure mode reversed: reading `.openclaude/CLAUDE.md` unconditionally made
+ * `claude`'s OWN read-back answer OpenClaude's settings in a shared repo.
  */
-const CARRIERS = ['AGENT.md', 'CLAUDE.md', path.join('rules', 'geneseed.md'), 'AGENTS.md'];
+const CARRIERS = [
+  'AGENT.md', path.join('.openclaude', 'CLAUDE.md'), 'CLAUDE.md',
+  path.join('rules', 'geneseed.md'), 'AGENTS.md',
+];
+
+/**
+ * `host`'s own carrier path(s), narrowed off the single `HOSTS` table — `carrierInLayer` and
+ * `projectMarker`/`agentFile` — rather than a second hand-rolled host→carrier map.
+ *
+ * ONE HOST, ONE ANSWER, EXCEPT BOB. `carrierInLayer` true (OpenClaude only) tries the nested
+ * per-repo path FIRST and the bare `agentFile` SECOND, because the same column name means two
+ * different locations depending on scope: `<repo>/.openclaude/CLAUDE.md` for a project
+ * install, `<cfgDir>/CLAUDE.md` for a global one (see `CLAUDE_SHAPED.openclaude-global`,
+ * which has no `carrierInLayer`). Bob is the one host with a second, differently-NAMED
+ * carrier — `rules/geneseed.md` at global scope, because Bob never auto-loads a global
+ * `AGENTS.md` (`CLAUDE_SHAPED['bob-global']`'s summary says so) — which `HOSTS` has no column
+ * for and this hard-codes, same as the un-narrowed `CARRIERS` above always did.
+ */
+function carriersFor(host) {
+  const row = HOSTS.find((h) => h.host === host);
+  if (!row) return CARRIERS;
+  if (host === 'bob') return [path.join('rules', 'geneseed.md'), row.agentFile];
+  return row.carrierInLayer
+    ? [path.join(row.projectMarker, row.agentFile), row.agentFile]
+    : [row.agentFile];
+}
 
 /**
  * The scan `themeOfDir`, `leadOfDir`, `doctrinesOfDir` and `excludedRulesOfDir` each wrote
@@ -153,11 +197,35 @@ const CARRIERS = ['AGENT.md', 'CLAUDE.md', path.join('rules', 'geneseed.md'), 'A
  * legitimate stop values for the two register readers below — to mean "stop, this is the
  * answer". `fallback` is what every caller's own trailing `return …;` supplied once the
  * whole list was exhausted with no answer.
+ *
+ * `host`, when given, narrows the scan to THAT HOST'S OWN carrier(s) via `carriersFor` —
+ * `null` (the default) keeps today's full, host-agnostic `CARRIERS` walk, so every call site
+ * this task's fix round did not touch is unchanged. Every exported reader below takes the
+ * same optional `host` last, mirroring `trustOfDir`'s existing `(d, host = null)` shape one
+ * screen down — this is not a new convention, it is that one applied to the carrier scan too.
+ *
+ * ⚠ HOST-NARROWED: THE FIRST CANDIDATE THAT EXISTS IS AUTHORITATIVE, EVEN IF ITS PROBE COMES
+ * BACK `undefined`. `undefined` is overloaded on purpose for the host-agnostic walk above (it
+ * means BOTH "this carrier is absent" and "this carrier exists but says nothing"), and that
+ * is exactly right for `CARRIERS`, where only one entry can ever exist for a given host —
+ * but `carriersFor` can return TWO paths for one host (OpenClaude's nested-then-bare
+ * `CLAUDE.md`; Bob's `rules/geneseed.md`-then-`AGENTS.md`), and "exists but says nothing" is
+ * the COMMON case for `excludedRulesOfDir`/`excludedSkillsOfDir` — their marker line is
+ * written only when something is excluded. Falling through past an existing-but-silent own
+ * carrier to the SECOND candidate let it read a sibling host's file that happens to sit at
+ * that second path (root `CLAUDE.md`, for OpenClaude's second candidate, in a repo also
+ * carrying a Claude install) — the fix-round-1 bug, reversed again. So once a host is given,
+ * `isFile` on each candidate (checked AFTER the probe, so a non-existent file's `undefined`
+ * still falls through to try the host's OWN next candidate — the one legitimate reason the
+ * list has two entries) stops the walk at the first one that exists and returns `fallback`,
+ * never a later file's answer.
  */
-function firstCarrier(d, probe, fallback = null) {
-  for (const carrier of CARRIERS) {
-    const result = probe(path.join(d, carrier));
+function firstCarrier(d, probe, fallback = null, host = null) {
+  for (const carrier of (host === null ? CARRIERS : carriersFor(host))) {
+    const carrierPath = path.join(d, carrier);
+    const result = probe(carrierPath);
     if (result !== undefined) return result;
+    if (host !== null && isFile(carrierPath)) return fallback;
   }
   return fallback;
 }
@@ -176,14 +244,35 @@ const THEME_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
  * through to the sigil scan, as a missing marker does. A plain name that is not shipped is
  * still RETURNED: `loadTheme` then refuses it loudly, which `status`/`rebuild-all`/`migrate`
  * cells pin ("unknown theme 'nosuchtheme'"), rather than a typo going unnoticed.
+ *
+ * `host`, when given, narrows the sigil scan to that host's own carrier — see `firstCarrier`.
+ *
+ * ⚠ THE ROOT MARKER ITSELF IS HOST-NARROWED TOO (host-compat B1, round 3): `driver.mjs` writes
+ * it at `d` unconditionally for a GLOBAL emit (every host's `-global` arm, the `writeText`
+ * right after `writeMarkers`), but at PROJECT scope only for a host whose emit calls `build()`
+ * directly — today that is `opencode` alone; the CLAUDE-STYLE hosts (`claude`/`bob`/
+ * `openclaude`, `CLAUDE_STYLE` below) go through `claudeShaped` instead, which never calls it
+ * (`driver.mjs`'s own comment: "Deliberately not written for the claude/bob/openclaude
+ * PROJECT emits"). So a claude-style host must distrust this marker UNLESS `d` is provably
+ * that host's OWN global config dir — `isHostGlobalDir` (`hosts.mjs`), which is what makes this
+ * scope-correct without a `scope` parameter: at ANY other `d` (a project root, or another
+ * host's global dir entirely) a claude-style host's project emit never wrote this file, so a
+ * present one is a SIBLING's (`opencode`'s project marker, in a shared repo — the B1 failure,
+ * reached a third way) and `themeOfDir` falls through to `firstCarrier`'s sigil scan instead,
+ * exactly as it already must for a claude-style host's own project installs.
  */
-export function themeOfDir(d) {
-  const marker = path.join(d, '.geneseed-theme');
-  if (isFile(marker)) {
-    const name = (readMaybe(marker) ?? '').trim();
-    if (THEME_NAME_RE.test(name)) return name;
+export function themeOfDir(d, host = null) {
+  let trust = host === null || !CLAUDE_STYLE.includes(host);
+  // A `configDir()` that throws cannot prove `d` is the global: distrust the marker.
+  try { trust ||= isHostGlobalDir(host, d); } catch { /* sigil scan below */ }
+  if (trust) {
+    const marker = path.join(d, '.geneseed-theme');
+    if (isFile(marker)) {
+      const name = (readMaybe(marker) ?? '').trim();
+      if (THEME_NAME_RE.test(name)) return name;
+    }
   }
-  return firstCarrier(d, (carrierPath) => themeFromAgent(carrierPath) || undefined);
+  return firstCarrier(d, (carrierPath) => themeFromAgent(carrierPath) || undefined, null, host);
 }
 
 /** `_harness_setup.FOOTPRINTS`. */
@@ -230,7 +319,7 @@ export function capitalize(s) {
   return s.length ? s[0].toUpperCase() + s.slice(1).toLowerCase() : s;
 }
 
-function leadOfDir(d, names) {
+function leadOfDir(d, names, host = null) {
   return firstCarrier(d, (carrierPath) => {
     const text = readMaybe(carrierPath);
     if (text === null) return undefined;
@@ -238,11 +327,11 @@ function leadOfDir(d, names) {
       if (text.includes(`**${capitalize(name)}**`)) return name;
     }
     return undefined;
-  });
+  }, null, host);
 }
 
-export const postureOfDir = (d) => leadOfDir(d, discoverNames('postures', 'peer'));
-export const modeOfDir = (d) => leadOfDir(d, discoverNames('modes', 'direct'));
+export const postureOfDir = (d, host = null) => leadOfDir(d, discoverNames('postures', 'peer'), host);
+export const modeOfDir = (d, host = null) => leadOfDir(d, discoverNames('modes', 'direct'), host);
 
 /**
  * The loop skill's default trust preset, read back off a deployed install — `null` when no
@@ -274,7 +363,8 @@ export function trustOfDir(d, host = null) {
 const ACTIVE_PACKS_RE = /^Active packs:[ \t]*(.+?)[ \t]*$/m;
 
 /**
- * A carrier rendered BEFORE the comms pack existed — the address migration's one detector.
+ * A carrier rendered BEFORE the comms pack existed — the pre-4.0.0 address migration's one
+ * detector, kept only to WARN now.
  *
  * The comms pack took `process 7` (reference codes) out of process, and `process 8` (one
  * writer per file) was renumbered to `process 7`. An install built before that names
@@ -285,12 +375,67 @@ const ACTIVE_PACKS_RE = /^Active packs:[ \t]*(.+?)[ \t]*$/m;
  * it. No current carrier can say `process 8` — the pack has seven rules and nothing cites
  * an eighth.
  *
- * ponytail: text sniff, not a stamp. It holds only while process has seven rules; the day
- * process gets an eighth, this must move to a build stamp (or be retired, once no install
- * built before the migration can remain).
+ * 4.0.0 RETIRED THE AUTO-MIGRATION THIS DROVE (see `warnLegacyProcessCarrier` below): it used
+ * to add `comms` and re-address `process 7`/`process 8` on sight, silently, which is exactly
+ * backward the day the process pack ever regains an eighth rule for an unrelated reason —
+ * this sniff would then fire on a CURRENT carrier and rewrite data nobody asked rewritten. A
+ * false positive that only prints a loud warning and reads the carrier as written is safe to
+ * keep; a false positive that mutates data was not. See CHANGELOG "Removed" (4.0.0) for the
+ * upgrade instruction this now points installs at.
  */
 const legacyProcessCarrier = (text) => /\bprocess 8\b/.test(text);
 
+/**
+ * The loud half of retiring the migration: one stderr line pointing a pre-comms install at
+ * `geneseed setup`, instead of the silent rewrite `doctrinesOfDir`/`excludedRulesOfDir` used
+ * to perform on the same detection. Never thrown — both are read-only introspection called by
+ * `uninstall`, `diff`, `validate` and the web console, none of which should become
+ * un-runnable against an install that merely needs a rebuild.
+ *
+ * NEVER `geneseed rebuild-all` — that is the exact command `rebuildAll` (`js/build/generate.mjs`)
+ * now REFUSES to run against a legacy carrier (see `legacyProcessCarrierOfDir` there), because
+ * running it is what caused the permanent data loss this fix round exists to stop. Pointing the
+ * warning at the one command that is guaranteed to do nothing here would be a second silent
+ * misread wearing a loud one's clothes.
+ *
+ * DEDUPED ONCE PER PROCESS — `doctor`/`validate`/`uninstall` read the same install's carrier
+ * more than once per run, and a line per read drowns the one thing the owner needs to act on.
+ * `resetLegacyProcessCarrierWarning` (below) exists only so tests can see the line fire more
+ * than once in one process; nothing else should call it.
+ */
+let warnedLegacyProcessCarrier = false;
+function warnLegacyProcessCarrier() {
+  if (warnedLegacyProcessCarrier) return;
+  warnedLegacyProcessCarrier = true;
+  printErr('[geneseed] WARN: this install predates the comms pack (3.7.0, 2026-09-27) — its '
+    + "carrier still names 'process 8'. The automatic migration (adding comms, re-addressing "
+    + 'process 7/process 8) was removed in 4.0.0; the carrier is now read as written. Run '
+    + '`geneseed setup` once to rebuild this install on the current rule addresses.\n');
+}
+
+/** Test-only: undo the dedup above so a test can see the warning fire again. */
+export function resetLegacyProcessCarrierWarning() {
+  warnedLegacyProcessCarrier = false;
+}
+
+/**
+ * Whether ANY of `d`'s own carriers still shows the pre-comms signature — the one question
+ * `rebuildAll`, `upgrade` (which shells into it) and `migrate` must ask BEFORE calling
+ * `installProfile`/`driverMain` on an install, now that `doctrinesOfDir`/`excludedRulesOfDir`
+ * no longer rewrite it for them. Re-emitting a legacy carrier through the current template
+ * does not raise an error — it just writes a fresh `Active packs:` line that silently drops
+ * `comms` and leaves `process 7`/`process 8` unaddressed, permanently, with no further carrier
+ * text left afterward for THIS function to ever detect again. Checking before the write is the
+ * only point where the loss is still preventable.
+ */
+export function legacyProcessCarrierOfDir(d, host = null) {
+  return firstCarrier(d, (carrierPath) => {
+    const text = readMaybe(carrierPath);
+    if (text === null) return undefined;
+    return legacyProcessCarrier(text) || undefined;
+  }, false, host) === true;
+}
+
 /**
  * The doctrine packs a DEPLOYED install carries — the third register read back off disk,
  * beside `postureOfDir` and `modeOfDir`, and the first that is a SET.
@@ -322,7 +467,7 @@ const legacyProcessCarrier = (text) => /\bprocess 8\b/.test(text);
  * checkout ships; one that is not condemns the whole line to `null`. A trailing comma is
  * exactly the empty field a fold leaves behind, which is what makes this catch it.
  */
-export function doctrinesOfDir(d) {
+export function doctrinesOfDir(d, host = null) {
   return firstCarrier(d, (carrierPath) => {
     const text = readMaybe(carrierPath);
     if (text === null) return undefined;
@@ -331,14 +476,14 @@ export function doctrinesOfDir(d) {
     if (m[1] === 'none') return [];
     const named = m[1].split(',').map((s) => s.trim());
     if (!named.every((n) => PACK_ORDER.includes(n))) return null;
-    // MIGRATION: a pre-comms install that carried process carried the codes rule inside it,
-    // so it keeps that rule by gaining comms. Its old `process 7` exclusion, if any, is
-    // re-addressed to `comms 1` by `excludedRulesOfDir` in the same pass.
+    // RETIRED MIGRATION (4.0.0): a pre-comms install used to gain `comms` here so it kept the
+    // codes rule it carried inside `process`. That rewrite is gone — the carrier is read as
+    // written, and the owner is warned loudly instead, once per read.
     if (named.includes('process') && !named.includes('comms') && legacyProcessCarrier(text)) {
-      named.push('comms');
+      warnLegacyProcessCarrier();
     }
     return PACK_ORDER.filter((pk) => named.includes(pk));
-  });
+  }, null, host);
 }
 
 /**
@@ -359,8 +504,8 @@ export function doctrinesOfDir(d) {
  *
  * `[]` still passes through untouched — a marker that reads `none` is an answer, not a silence.
  */
-export function doctrinesForBuild(d) {
-  return doctrinesOfDir(d) ?? [...PACK_ORDER];
+export function doctrinesForBuild(d, host = null) {
+  return doctrinesOfDir(d, host) ?? [...PACK_ORDER];
 }
 
 /** `Excluded rules: process 7, craft 3` — the marker's optional second line. */
@@ -384,7 +529,7 @@ const EXCLUDED_RULES_RE = /^Excluded rules:[ \t]*(.+?)[ \t]*$/m;
  * same rule as the pack list, same reason, opposite default. Half an exclusion list would
  * take away rules nobody named.
  */
-export function excludedRulesOfDir(d) {
+export function excludedRulesOfDir(d, host = null) {
   return firstCarrier(d, (carrierPath) => {
     const text = readMaybe(carrierPath);
     if (text === null) return undefined;
@@ -400,12 +545,13 @@ export function excludedRulesOfDir(d) {
         ? `${parts[0]}.${Number(parts[1])}` : null;
     });
     if (!ids.every(Boolean)) return [];
-    // MIGRATION: the same pre-comms carrier spells the old addresses — see
-    // `legacyProcessCarrier`. One map, applied once, so `process 8` cannot chain onward.
-    const MOVED = { 'process.7': 'comms.1', 'process.8': 'process.7' };
-    const out = legacyProcessCarrier(text) ? ids.map((id) => MOVED[id] ?? id) : ids;
-    return [...new Set(out)].sort();
-  }, []);
+    // RETIRED MIGRATION (4.0.0): a pre-comms carrier used to have its old addresses
+    // (`process.7` -> `comms.1`, `process.8` -> `process.7`) remapped here, once, so
+    // `process 8` could not chain onward. That rewrite is gone — the addresses are returned
+    // exactly as named, and the owner is warned loudly instead of having them silently moved.
+    if (legacyProcessCarrier(text)) warnLegacyProcessCarrier();
+    return [...new Set(ids)].sort();
+  }, [], host);
 }
 
 /** `Excluded skills: bruno, daydream` — written only when something is excluded. */
@@ -421,9 +567,10 @@ const EXCLUDED_SKILLS_RE = /^Excluded skills:[ \t]*(.+?)[ \t]*$/m;
  * name drops out (`resolveSkillNames`), so a skill merge does not quietly re-admit everything
  * else the install left out. Silent unless the caller passes `notify` — status, diff and the
  * console call this on every read; the replays that rebuild an install (`rebuild-all`,
- * `upgrade`, `migrate`) pass it.
+ * `upgrade`, `migrate`) pass it. `host` is last, after `notify`, for the same reason
+ * `trustOfDir` puts it last: every existing positional call keeps working unchanged.
  */
-export function excludedSkillsOfDir(d, notify = null) {
+export function excludedSkillsOfDir(d, notify = null, host = null) {
   return firstCarrier(d, (carrierPath) => {
     const text = readMaybe(carrierPath);
     if (text === null) return undefined;
@@ -433,7 +580,7 @@ export function excludedSkillsOfDir(d, notify = null) {
     if (unknown.length) return [];
     if (notify) for (const n of notices) notify(n);
     return ids;
-  }, []);
+  }, [], host);
 }
 
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
@@ -468,8 +615,8 @@ export function emitHostScopeOf(root) {
   return EMIT_HOST_SCOPE.get(emit.trim()) ?? null;
 }
 
-/** `_harness_mcp.DISABLED_STASH` — a sibling dir whose presence means "disabled". */
-export const DISABLED_STASH = '.geneseed-disabled';
+// `DISABLED_STASH` moved to `hosts.mjs`: the hook stand-down reads it and must not import this.
+export { DISABLED_STASH };
 
 /**
  * `_harness_mcp._claude_cfg` — where a Claude-STYLE install keeps its manifest.
@@ -505,6 +652,33 @@ export function installState(root, host = 'opencode', scope = 'global') {
   return installKind(root) !== null ? 'active' : 'absent';
 }
 
+/**
+ * Host-compat verdict I1: an OpenClaude PROJECT install is additive, never exclusive — it loads
+ * its own `<repo>/.openclaude/CLAUDE.md` **and** whatever root `CLAUDE.md`/`AGENTS.md` a claude
+ * or bob PROJECT install already wrote there (`B/src/utils/claudemd.ts` l.904-928; `CARRIERS`
+ * above deliberately leaves the root file untouched for OpenClaude so a Claude/Bob install can
+ * share the repo). There is no clean fix: excluding the root file would hide the user's OWN
+ * content in it too, so the only thing `status`/`doctor` can do is say the doubling exists.
+ *
+ * `installState` on the two hosts is enough — a claude/bob PROJECT install is 'active' only
+ * once it has actually written its own `.claude`/`.bob` manifest, which is exactly when it has
+ * also written the root carrier.
+ */
+export function openclaudeDualHarnessRoot(root) {
+  if (installState(root, 'openclaude', 'project') !== 'active') return false;
+  return installState(root, 'claude', 'project') === 'active'
+    || installState(root, 'bob', 'project') === 'active';
+}
+
+/** Every PROJECT root `installTargets()` reaches where `openclaudeDualHarnessRoot` is true. */
+export function openclaudeDualHarnessRoots() {
+  const roots = new Set();
+  for (const [, scope, root] of installTargets()) {
+    if (scope === 'project') roots.add(resolvePath(root));
+  }
+  return [...roots].filter(openclaudeDualHarnessRoot).sort(comparePaths);
+}
+
 /** `_harness_mcp._registered_targets` — (host, scope, root) for every registered root. */
 export function registeredTargets() {
   const out = [];
@@ -531,15 +705,15 @@ export function installTargets() {
   const seen = new Set();
 
   const add = (host, scope, root) => {
-    // A "project" whose marker dir IS this host's global config dir is the global install
-    // seen from its parent (the daemon's cwd is $HOME, where $HOME/.claude == ~/.claude) —
-    // not a separate project. Surfacing it would alias the global's files.
+    // A "project" whose marker dir IS this host's global (`isHostGlobalDir`: the env-resolved
+    // dir, the default `~/<marker>`, or a `-global` emit) is the global install seen from its
+    // parent (the daemon's cwd is $HOME, where $HOME/.claude == ~/.claude) — not a separate
+    // project. Surfacing it would alias the global's files, and `rebuild-all` would re-emit it
+    // as a project rooted at $HOME (final review C2, under `$CLAUDE_CONFIG_DIR`).
     if (scope !== 'global') {
       try {
         const spec = HOSTS.find((h) => h.host === host);
-        if (resolvePath(path.join(root, spec.projectMarker)) === resolvePath(spec.configDir())) {
-          return;
-        }
+        if (isHostGlobalDir(host, path.join(root, spec.projectMarker))) return;
       } catch { /* as the Python's bare `except Exception: pass` */ }
     }
     const key = `${host}\0${resolvePath(root)}`;
@@ -557,6 +731,45 @@ export function installTargets() {
   return out;
 }
 
+/**
+ * Each Claude install whose emitted hook FORM no longer matches this machine's hook shell
+ * (`claudeHookShell`; Task 15) — the "Git Bash removed after the emit" gap, which otherwise
+ * reports nothing: hooks signal through stdout and Claude treats a parse error as non-blocking.
+ *
+ * Bash form with Git Bash now gone is a PROBLEM: `context`/`learn` fail open under PowerShell
+ * (no `onFailure`, so a launch failure there is still non-blocking) and, since Task 1, the two
+ * gates fail CLOSED instead (`onFailure: "block"` blocks every Bash/PowerShell/Write/Edit/
+ * NotebookEdit call until `rebuild-all` re-emits the PowerShell form) — worse for the user
+ * either way, so the message below still reports it as drift needing a rebuild; it does not
+ * distinguish the two outcomes. PowerShell form with Git Bash now present is a `[note]`: the hooks work,
+ * they only pay PowerShell's startup. Read from the recorded claims the settings file still
+ * carries (`liveRecordedHooks`) — the form the emit wrote, not re-derived; Windows only, since
+ * nowhere else has two hook shells. `targets` and `platform` are parameters so a test can hand
+ * it a sandboxed install and `gateSummary` its own config dirs.
+ */
+export function hookShellProblems(targets = installTargets(), platform = process.platform) {
+  if (platform !== 'win32') return [];
+  const now = claudeHookShell(process.env, platform);
+  const out = [];
+  for (const [host, scope, root] of targets) {
+    // A disabled install's manifest still records the hooks it unwired: nothing runs, so
+    // nothing drifts.
+    if (host !== 'claude' || claudeState(root, scope) !== 'active') continue;
+    const cfg = claudeCfg(root, scope);
+    const handlers = liveRecordedHooks(cfg);
+    if (!handlers.length) continue;
+    const was = handlers.some(([, h]) => h.shell === 'powershell') ? 'powershell' : 'bash';
+    if (was === now) continue;
+    out.push(was === 'bash'
+      ? `[hooks] ${cfg}: hooks were emitted for Git Bash, which is no longer found, so Claude `
+        + 'Code runs them under PowerShell where context/learn fail open (no effect) and '
+        + 'git-gate/rule-gate now BLOCK every call instead of gating it - run: geneseed rebuild-all'
+      : `[note] ${cfg}: hooks were emitted for PowerShell, but Git Bash is now found - they work, `
+        + 'and pay PowerShell startup on every call; geneseed rebuild-all switches them back');
+  }
+  return out;
+}
+
 // ---- what this machine installed (`_harness_setup._installed_defaults`) --------------------
 
 /**

package/js/hosts/native.mjs

@@ -150,7 +150,7 @@ function triggerOf(text) {
  * failure, so the cure is a shorter first trigger sentence in the source, never a wider cap.
  */
 const DESCRIPTION_CAP = 320;
-function skillDescription(text) {
+export function skillDescription(text) {
   return withWhen(firstBlockquote(text), triggerOf(text));
 }
 
@@ -245,7 +245,7 @@ function isReadonly(text) {
  * themselves, and the ones gated on an environment the model cannot see (a herdr pane).
  */
 const USER_INVOKED_RE = /<!--\s*invocation:\s*user\s*-->/;
-function isUserInvokedOnly(text) {
+export function isUserInvokedOnly(text) {
   return USER_INVOKED_RE.test(text);
 }
 
@@ -359,7 +359,11 @@ function claudeAgentFrontmatter(stem, text, overrides) {
   if (isReadonly(text)) {
     const list = ['Write', 'Edit', 'NotebookEdit'];
     if (!text.includes(WEBFETCH_MARKER)) list.push('WebFetch');
-    if (!text.includes(BASH_MARKER)) list.push('Bash');
+    // Bash AND PowerShell: docs `tools-reference.md` says denying Bash turns PowerShell off
+    // only for settings rules and `--disallowedTools` — agent frontmatter is not named there,
+    // so a "read-only" agent on Windows could still run shell commands via PowerShell
+    // (Claude verdict R1). The one opt-in marker lifts both together.
+    if (!text.includes(BASH_MARKER)) list.push('Bash', 'PowerShell');
     fm.push(`disallowedTools: ${list.join(', ')}`);
   }
   return fm;
@@ -505,8 +509,10 @@ export function claimer(oldOwned, cfg, manifestExisted = true) {
  * `opts.claim` — a `claimer` closure the caller shares with its other writers; built from
  * `oldOwned`/`cfg`/`manifestExisted` when absent.
  *
- * Returns `{ nAgents, nSkills, written }` — Python's 3-tuple, with `written` as absolute
- * paths in write order.
+ * Returns `{ nAgents, nSkills, written, userOnlySkills }` — Python's 3-tuple, with `written` as
+ * absolute paths in write order, plus `userOnlySkills` (the claimed stems carrying the
+ * user-only marker; Task 4/O-1's input to OpenCode's `permission.skill` wiring — see the
+ * comment above the skill-frontmatter branch).
  *
  * That order is NOT observable, and this comment used to claim it was ("it lands in
  * `owned`, which the prune diffs against"). Measured when a mutation reversing it stayed
@@ -519,6 +525,15 @@ export function claimer(oldOwned, cfg, manifestExisted = true) {
 export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null, {
   host = 'opencode', oldOwned = null, cfg = null, manifestExisted = true,
   theme = null, src = undefined, skillDirOf = null, claim = claimer(oldOwned, cfg, manifestExisted),
+  // Bob (host-compat R1): its skills page documents only `name`/`description` — no
+  // `disable-model-invocation` — and giving it the Claude-dialect alias SKILL.md (the
+  // `host === 'claude'` branch below) would be an unverified key PLUS a visible duplicate
+  // in the model's catalogue (exactly the OpenCode problem this file already dodges for
+  // aliases). `bobDialect` suppresses both for Bob only, while `host: 'claude'` keeps every
+  // OTHER Claude-dialect choice (agent frontmatter, `warnClaudeIgnored`) — Bob still renders
+  // those verbatim. The caller (`emit-claude.mjs`) routes the suppressed names through
+  // `writeAliasCommands(..., alsoUserOnly: true)` into `.bob/commands/*.md` instead (O2).
+  bobDialect = false,
 } = {}) {
   const ov = overrides || {};
   if (host === 'claude') warnClaudeIgnored(ov);
@@ -527,6 +542,7 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
   const written = [];
   const sideFiles = [];            // [stem, dest, text], written after the loop
   const claimedSkills = new Set(); // stems whose own SKILL.md claim held
+  const userOnlySkills = [];       // claimed stems carrying the user-only marker
 
   const write = (dest, text) => {
     mkdirSync(path.dirname(dest), { recursive: true });
@@ -590,6 +606,7 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
     let fm;
     let dest;
     let kind;
+    let userOnly = false;
     if (folder === 'agents') {
       fm = host === 'claude' ? claudeAgentFrontmatter(stem, text, ov)
         : opencodeAgentFrontmatter(stem, text, ov, theme);
@@ -597,26 +614,45 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
       kind = 'agent';
     } else {
       // Skills are BYTE-IDENTICAL across hosts: name + description, body link-stripped.
-      // The user-only key is emitted for every host too — Claude Code and Bob honour it,
-      // OpenCode ignores an unknown key — so the identity holds. ALIASES are the one
-      // exception: OpenCode has no user-only skill, so an alias skill there would land in the
+      // The user-only key is emitted for Claude Code, which honours it natively
+      // (`disable-model-invocation`). OpenCode has no frontmatter equivalent, so the
+      // SAME marker also drives `userOnlySkills` below, which the OpenCode emit turns into a
+      // `permission.skill: {name: "deny"}` row in `opencode.json` (opencode-verdict.md O-1) —
+      // the model loses the skill from its catalogue, `/name` still runs it (O-1's second
+      // finding: the command path reads the UNFILTERED skill list, never the permission one).
+      // Bob's skills page documents no such key (host-compat R1) — see `bobDialect` above,
+      // which skips the SKILL.md for a user-only skill on Bob entirely.
+      // ALIASES are the one case every non-Claude dialect shares: no alias skill via
+      // frontmatter exists for them either, so an alias skill there would land in the
       // model's catalogue as a duplicate; it gets a command instead (`writeAliasCommands`).
       fm = [`name: ${stem}`, `description: ${jsonDumps(skillDescription(text))}`];
-      if (isUserInvokedOnly(text)) fm.push('disable-model-invocation: true');
+      userOnly = isUserInvokedOnly(text);
+      if (userOnly && !bobDialect) fm.push('disable-model-invocation: true');
       body = stripSkillBodyLinks(pointSideFiles(body, stem, skillDirOf ? skillDirOf(stem)
         : SKILL_DIR_PLACEHOLDER));
       dest = path.join(skillsDir, stem, 'SKILL.md');
       kind = 'skill';
     }
+    // Bob, user-only: no SKILL.md at all — the command written by the caller is the only
+    // copy, so the model's `use_skill` catalogue never carries it (see `bobDialect` above).
+    // The `continue` is BEFORE `claimedSkills.add(stem)` below, so a user-only skill's own
+    // side files (none exist today, but the layout allows them) are skipped too — there is
+    // no `skills/<stem>/` folder on Bob for one to sit beside.
+    if (kind === 'skill' && userOnly && bobDialect) continue;
     if (!claim(dest)) continue;
     write(dest, `---\n${fm.join('\n')}\n---\n\n${body}`);
-    if (kind === 'skill') claimedSkills.add(stem);
+    if (kind === 'skill') {
+      claimedSkills.add(stem);
+      // Only a CLAIMED user-only skill is Geneseed's to deny: a pre-existing file the claim
+      // declined belongs to the user, and `userOnly` was computed from OUR text, not theirs.
+      if (userOnly) userOnlySkills.push(stem);
+    }
     // An old name keeps answering `/name`: user-only, so the model's catalogue lists the
     // skill once. Read off the already-filtered items, so excluding the target drops its
     // aliases; through `claim`, so manifest, prune and uninstall own them; not counted.
     // Only once the target's own claim held: a user's file at the target gets no alias
     // pointing at a skill this install never wrote.
-    if (kind === 'skill' && host === 'claude') {
+    if (kind === 'skill' && host === 'claude' && !bobDialect) {
       // The host announces the ALIAS's folder as the base directory, so a side-file pointer
       // climbs back to the target's.
       const aliasBody = skillDirOf ? body : stripSkillBodyLinks(
@@ -634,7 +670,7 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
   for (const [stem, dest, text] of sideFiles) {
     if (claimedSkills.has(stem) && claim(dest)) write(dest, stripSkillBodyLinks(text));
   }
-  return { nAgents, nSkills, written };
+  return { nAgents, nSkills, written, userOnlySkills };
 }
 
 /**