geneseed 3.19.0 → 4.0.0

package/js/hosts/settings.mjs

@@ -12,9 +12,9 @@
  * this module.
  *
  * THE STDOUT RULE BINDS HARDEST HERE. The hooks this module writes signal their verdict as
- * a JSON object on stdout and return 0 on EVERY path (`|| exit 0` is not what it looks
- * like — see the shim comment below), so a stray byte printed on a hook path does not make
- * noise, it silently disables a gate. Everything printed here is a generator-time message;
+ * a JSON object on stdout and return 0 on EVERY path (`|| exit 0`, or `; exit 0` in the
+ * PowerShell form, is not what it looks like — see the shim comment below), so a stray byte
+ * printed on a hook path does not make noise, it silently disables a gate. Everything printed here is a generator-time message;
  * the split between them is asserted absolutely by `tests/unit/settings_jsonc.test.mjs` and
  * `tests/unit/settings_integrity.test.mjs`. The asymmetry (`_warn_commented_jsonc` prints to
  * STDOUT, every other message to stderr) is inherited from `_build_settings.py` and kept
@@ -41,7 +41,7 @@ import {
   jsonDumps, jsonDumpsCompact, jsonDumpsIndent, parseJson, deepEquals, formatRepr,
   indexOfDeepEqual, get, has, isDict,
 } from '../lib/json.mjs';
-import { SHIM_MARK, hookPrefix } from './shim.mjs';
+import { SHIM_MARK, claudeHookShell, hookPrefix } from './shim.mjs';
 import { stripWhitespace, stripWhitespaceEnd } from '../lib/text.mjs';
 
 const OPENCODE_SCHEMA = 'https://opencode.ai/config.json';
@@ -93,10 +93,134 @@ const consentRuleOn = (d, excluded = []) =>
  * after other words (`push origin -f`, `reset -q --hard`, `clean -d -f`) and `git push *+*`
  * a `+refspec` force push. The regex stays the stricter reader — it also sees a flag cluster
  * with `f` not first (`clean -d -xf`), which a glob cannot say without matching `--exclude=f`.
+ *
+ * B5's (claude-code.md / claude-verdict.md) long/modern spellings, added here appended (never
+ * reorder: OpenCode's permission engine evaluates key order with `findLast`, so moving an
+ * existing key can change which VALUE wins on a file that already disagrees with one — adding
+ * only is always safe, since every key here maps to the same `'ask'`). `clean --force`, the
+ * long flag; `branch --delete --force`, the long form of `-D` (both orders, since a glob has
+ * no "either order" — an un-forced `--delete` already refuses on an unmerged branch exactly
+ * like `-d`, so it is deliberately NOT a key here; `-D --force`/`--delete -f`/`-d --force`/
+ * `-df` are the same act again and are a known ceiling this does not chase); `checkout
+ * -f`/`--force` and `switch -f`/`--force`/`--discard-changes` (git's own `switch -h` lists
+ * `-f, --force` and `--discard-changes` as two separate options); `worktree remove -f`/`--force` (both
+ * flag-then-path and path-then-flag order); `reflog expire`; `gc --prune` (matched bare, since
+ * a `--prune` with no `=now` still eventually prunes); and `push *--delete*` / `push * :*` (a
+ * literal space before the colon, so `push origin HEAD:main`, an ordinary refspec, does not
+ * match).
+ *
+ * `git restore` is DELIBERATELY NOT HERE. Its rule is "ask unless `--staged` appears ALONE" —
+ * `--staged --worktree` together still discards the working tree — and a glob has no negation,
+ * so the closest glob (`git restore*`) would ask on the harmless `--staged`-alone case too. The
+ * regex (`DESTRUCTIVE_GIT_RE`) gets that exactly right; `stash drop`/`clear` have the SAME
+ * `restore` anchoring concern in the regex (a bare word / ordinary English, matched there only
+ * in verb position) but no false-positive risk as a glob, since OpenCode matches a glob against
+ * the FULL sub-command text (`opencode-verdict.md` CR-6) — `git stash drop*` cannot match a
+ * DIFFERENT sub-command like `git stash push -m "clear old state"`, so they ARE glob keys here.
+ * Guard-only acts (currently just `restore`) still warn via the OpenCode guard plugin's
+ * `SHELL_WARN_RE` — see `adapters/opencode/plugins/geneseed-guard.js`.
  */
 const LAW_IV_BASH = ['git push --force*', 'git push -f*', 'git push *--force*', 'git push * -f*',
   'git push *+*', 'git reset --hard*', 'git reset * --hard*', 'git clean -f*', 'git clean * -f*',
-  'git branch -D*', 'git checkout -- *'];
+  'git branch -D*', 'git checkout -- *',
+  'git clean --force*', 'git clean * --force*',
+  'git branch *--delete*--force*', 'git branch *--force*--delete*',
+  'git checkout -f*', 'git checkout * -f*', 'git checkout --force*', 'git checkout * --force*',
+  'git switch -f*', 'git switch * -f*', 'git switch --force*', 'git switch * --force*',
+  'git switch --discard-changes*', 'git switch * --discard-changes*',
+  'git worktree remove -f*', 'git worktree remove --force*',
+  'git worktree remove * -f*', 'git worktree remove * --force*',
+  'git reflog expire*', 'git gc --prune*', 'git gc * --prune*',
+  'git stash drop*', 'git stash clear*',
+  'git push *--delete*', 'git push * :*'];
+
+/**
+ * User decision (2026-10-10): a loop runs on its own `loop/*` branch, never `main`/`master`, so
+ * pushing it is fine — only the COMMIT still asks. OpenCode has no dynamic equivalent of
+ * `js/hosts/hooks.mjs`'s `loopExempt` (Task 6: its `permission.ask` plugin hook is declared but
+ * never called), so this is a STATIC allow for the exact refspec shapes the loop engine itself
+ * pushes — `pushSegmentOk`'s `[-u|--set-upstream] <remote> HEAD:<branch>` and
+ * `HEAD:refs/heads/<branch>` forms, with `<branch>` fixed to `loop/*` here since a static glob
+ * cannot read the checked-out branch the way the Node hook does. `git push * HEAD:loop/*` eats
+ * `-u origin`/`--set-upstream origin`/any remote through its leading `*`; the second key covers
+ * the `refs/heads/` spelling the same way.
+ *
+ * ORDER IS LOAD-BEARING. `defaultPermission` appends these AFTER `git push*`'s ask (so a loop
+ * push is not swallowed by the blanket consent ask) and BEFORE `LAW_IV_BASH` (so `findLast`
+ * — OpenCode's own `permission.bash` evaluator — lets a force push, a `+refspec`, or a
+ * `--delete`/bare-`:` push still ask even when the target is `loop/*`; those LAW_IV_BASH keys
+ * match the same command and come later, so they win). Never move this block to before
+ * `git push*` or after `LAW_IV_BASH` — either moves the `findLast` boundary the ordering above
+ * depends on.
+ */
+const LOOP_PUSH_ALLOW = ['git push * HEAD:loop/*', 'git push * HEAD:refs/heads/loop/*'];
+
+/**
+ * ⚠ SECOND FIX ROUND (control review). The first guard (`'git push *:* HEAD:loop/*'`) checked
+ * for a literal `:` ahead of the loop refspec, reasoning that a second refspec always carries
+ * one. Wrong: a bare branch name IS a valid refspec (`git push origin main` pushes local
+ * `main` to remote `main`) and carries no colon at all, so `git push origin main HEAD:loop/x`
+ * sailed past the colon check and pushed `main` with no prompt. A colon is not the invariant;
+ * TOKEN COUNT is — the loop engine's leading extras are exactly `-u <remote>` or
+ * `--set-upstream <remote>` (one flag, one remote: always precisely ONE or TWO tokens before
+ * the refspec), and every injected extra refspec, colon or not, adds a token beyond that. This
+ * replaces the colon guard with a token-count chain, each tier ordered (`findLast` wins) to
+ * override the one before it where it must:
+ *
+ * 1. `LOOP_PUSH_ALLOW` (above) — allow. Matches ANY text before the loop refspec, however many
+ *    tokens.
+ * 2. `LOOP_PUSH_ASK_EXTRA` (`'git push * * HEAD:loop/*'`) — ask. Requires the text before the
+ *    refspec to contain its own literal space, i.e. 2+ tokens — which a bare single remote
+ *    (`origin`) never has (no space inside one word), so the documented bare-remote form keeps
+ *    falling through to (1)'s allow; `origin main` (remote + an injected second refspec, with
+ *    or without a colon), `-u origin` (flag + remote — ALSO 2 tokens, so this ALSO fires for the
+ *    legitimate `-u`/`--set-upstream` form; that is corrected by tier 3, not avoided here) and
+ *    any other 2+-token prefix — `--all origin`, `-f origin`, `--force-with-lease origin`,
+ *    `--mirror origin` — all trip it.
+ * 3. `LOOP_PUSH_ALLOW_FLAG` (`'git push -u * HEAD:loop/*'` / `'git push --set-upstream * …'`) —
+ *    allow, ordered AFTER (2) specifically to re-admit the one 2-token prefix that is legitimate:
+ *    `-u <remote>` or `--set-upstream <remote>`. The literal `-u `/`--set-upstream ` prefix means
+ *    only a command that STARTS with that flag can match; nothing with a different first token
+ *    (including an injected refspec in that slot) does.
+ * 4. `LOOP_PUSH_ASK_FLAG_EXTRA` (`'git push -u * * HEAD:loop/*'` / `--set-upstream` twin) — ask,
+ *    ordered AFTER (3) to re-close it: ANYTHING beyond `-u <remote>` before the refspec — a
+ *    third token, e.g. `-u origin main HEAD:loop/x` — puts a literal space inside what (3)'s
+ *    single wildcard would otherwise swallow whole, so this fires and wins back from (3).
+ * 5. `LOOP_PUSH_ASK_TRAILING` (`'git push * HEAD:loop/* ?*'`) — ask. Requires ONE more character,
+ *    ANYWHERE, past the refspec, via `?` (`Wildcard.match`'s single-char wildcard) rather than a
+ *    bare trailing `*`: a pattern ENDING in literal `" *"` hits upstream's own special case
+ *    (`escaped.endsWith(' .*')` -> `'( .*)?'`), making that whole clause OPTIONAL and silently
+ *    re-allowing the plain push this tier exists to still catch. Catches an injected refspec, or
+ *    anything else, AFTER the loop one (`git push origin HEAD:loop/x HEAD:main`,
+ *    `… HEAD:loop/x main`) — order relative to the others does not matter for this tier, since
+ *    nothing else in this chain inspects text after the refspec.
+ *
+ * A second `loop/*` refspec after the first also trips tier 5 and asks — harmless, and accepted
+ * rather than chased: the engine never emits one, and telling it apart from an injected `main`
+ * needs no extra tier, since both are "something after the refspec".
+ *
+ * NO REMAINING CEILING for the realistic shapes: every 2+-token prefix — a flag, an injected
+ * refspec, colon or not — is caught by (2) unless it is exactly the one legitimate `-u`/
+ * `--set-upstream` + remote pair, which (4) still catches the moment anything rides along with
+ * it. The one shape this chain cannot see is a BARE SINGLE flag occupying the sole "remote"
+ * slot with nothing else before the refspec (`git push --all HEAD:loop/x`, one token, same shape
+ * as a legitimate bare remote) — indistinguishable from a real remote name by token count alone,
+ * and not a practical gap: a leading `-`/`--` token is parsed by git as an OPTION, never as the
+ * remote, so this exact shape either errors (no remote given) or reads the refspec text itself
+ * as the remote and fails to resolve it — it does not reach a working push to `main`. Still
+ * caught by `LAW_IV_BASH`'s existing anywhere-in-the-command globs regardless of position
+ * (`'git push *--force*'`, `'git push * -f*'`, et al.), independently of this chain.
+ */
+const LOOP_PUSH_ASK_EXTRA = ['git push * * HEAD:loop/*', 'git push * * HEAD:refs/heads/loop/*'];
+const LOOP_PUSH_ALLOW_FLAG = [
+  'git push -u * HEAD:loop/*', 'git push --set-upstream * HEAD:loop/*',
+  'git push -u * HEAD:refs/heads/loop/*', 'git push --set-upstream * HEAD:refs/heads/loop/*',
+];
+const LOOP_PUSH_ASK_FLAG_EXTRA = [
+  'git push -u * * HEAD:loop/*', 'git push --set-upstream * * HEAD:loop/*',
+  'git push -u * * HEAD:refs/heads/loop/*', 'git push --set-upstream * * HEAD:refs/heads/loop/*',
+];
+const LOOP_PUSH_ASK_TRAILING = ['git push * HEAD:loop/* ?*', 'git push * HEAD:refs/heads/loop/* ?*'];
 
 function defaultPermission(doctrines = null, excluded = []) {
   const bash = { 'rm -rf *': 'ask' };
@@ -104,6 +228,11 @@ function defaultPermission(doctrines = null, excluded = []) {
     bash['git commit*'] = 'ask';
     bash['git push*'] = 'ask';
   }
+  for (const k of LOOP_PUSH_ALLOW) bash[k] = 'allow';
+  for (const k of LOOP_PUSH_ASK_EXTRA) bash[k] = 'ask';
+  for (const k of LOOP_PUSH_ALLOW_FLAG) bash[k] = 'allow';
+  for (const k of LOOP_PUSH_ASK_FLAG_EXTRA) bash[k] = 'ask';
+  for (const k of LOOP_PUSH_ASK_TRAILING) bash[k] = 'ask';
   for (const k of LAW_IV_BASH) bash[k] = 'ask';
   return { bash };
 }
@@ -115,7 +244,9 @@ function defaultPermission(doctrines = null, excluded = []) {
  * has to be able to recognise a key that is Geneseed's business at all — to add it back when
  * the pack returns, and to name it when this build no longer wants it but will not remove it.
  */
-const OWNED_BASH = ['rm -rf *', 'git commit*', 'git push*', ...LAW_IV_BASH];
+const OWNED_BASH = ['rm -rf *', 'git commit*', 'git push*',
+  ...LOOP_PUSH_ALLOW, ...LOOP_PUSH_ASK_EXTRA, ...LOOP_PUSH_ALLOW_FLAG, ...LOOP_PUSH_ASK_FLAG_EXTRA,
+  ...LOOP_PUSH_ASK_TRAILING, ...LAW_IV_BASH];
 
 /**
  * Bring an ALREADY-WRITTEN `permission` block back into line with the pack selection, and
@@ -189,6 +320,59 @@ function reconcileOpencodePermission(perm, want) {
   return [changed, stranded, null];
 }
 
+/**
+ * `permission.skill` rows for OpenCode's O-1 fix (opencode-verdict.md): a skill marked
+ * `<!-- invocation: user -->` is still model-invocable there (Claude Code's
+ * `disable-model-invocation` has no OpenCode equivalent), so each one gets an explicit
+ * `"<name>": "deny"` — confirmed against upstream `permission.ts` (`skill: Schema.optional(Rule)`,
+ * `Rule = Action | Record<string,Action>`) and `Skill.available`'s `Permission.evaluate("skill",
+ * …)` filter. `/name` still runs it: `Command`'s skill loop reads `skill.all()`, never the
+ * permission-filtered list, so the command path is untouched by design.
+ */
+function defaultSkillPermission(names) {
+  const skill = {};
+  for (const n of names) skill[n] = 'deny';
+  return skill;
+}
+
+/**
+ * Add any of `names` missing from an EXISTING `permission.skill` (each one pushed onto `added`),
+ * and remove any of `staleNames` that still read `"deny"` — the `skill` twin of
+ * `reconcileOpencodePermission`, but with a DIFFERENT removal rule. `reconcileOpencodePermission`
+ * never removes a bash key because nothing on disk records which `ask`/`allow` entry is
+ * Geneseed's; a skill deny has a record instead: the manifest's `skill_denies`, the names a
+ * previous emit itself ADDED (never a name whose deny was already there — that one is the
+ * user's, even on a Geneseed skill). The caller reads it into `staleNames` = "recorded by the
+ * PREVIOUS build, not wanted by THIS one" — a skill that lost its `<!-- invocation: user -->`
+ * marker, or was `--exclude-skills`'d. The value check on top still guards a user's own
+ * re-scoped `"allow"`/`"ask"` for a recorded name — the record licenses taking back Geneseed's
+ * OWN entry, not whatever is there now.
+ *
+ * A non-object `permission.skill` (a blanket `"skill": "allow"`/`"deny"`/`"ask"`) is the
+ * user's own policy and is left alone, reported as opaque — same contract as
+ * `reconcileOpencodePermission`'s `bash` shape guard. `staleNames` is silently skipped in that
+ * case too: there is no per-name object to delete from.
+ * @returns {[boolean, string | null]}
+ */
+function reconcileOpencodeSkillPermission(perm, names, staleNames = [], added = []) {
+  if (!has(perm, 'skill')) {
+    if (!names.length) return [false, null];
+    perm.skill = defaultSkillPermission(names);
+    added.push(...names);
+    return [true, null];
+  }
+  const skill = get(perm, 'skill');
+  if (!isDict(skill)) return [false, names.length ? 'has a "skill" that is not an object' : null];
+  let changed = false;
+  for (const n of names) {
+    if (!has(skill, n)) { skill[n] = 'deny'; changed = true; added.push(n); }
+  }
+  for (const n of staleNames) {
+    if (skill[n] === 'deny') { delete skill[n]; changed = true; }
+  }
+  return [changed, null];
+}
+
 /** `_build_settings._opencode_target`. Only caller of a `.json` -> `.jsonc` suffix swap. */
 export function opencodeTarget(jsonPath) {
   const ext = path.extname(jsonPath);
@@ -318,7 +502,7 @@ export function loadJsonObject(p, { strict = false } = {}) {
  * `'add'`, which is what the boolean callers this replaced meant.
  */
 function warnCommentedJsonc(target, agentPath, permission,
-  includeLsp = false, prefix = 'geneseed', doctrines = null, excluded = []) {
+  includeLsp = false, prefix = 'geneseed', doctrines = null, excluded = [], skillNames = []) {
   process.stdout.write(`[${prefix}] ${path.basename(target)} has comments — not rewriting `
     + 'it (your edits are kept). Add this to its "instructions" array by hand:\n');
   process.stdout.write(`[${prefix}]     ${jsonDumps(agentPath)}\n`);
@@ -330,6 +514,13 @@ function warnCommentedJsonc(target, agentPath, permission,
     for (const line of jsonDumpsIndent(defaultPermission(doctrines, excluded)).split('\n')) {
       process.stdout.write(`[${prefix}]     ${line}\n`);
     }
+    if (skillNames.length) {
+      process.stdout.write(`[${prefix}] and, to hide its user-only skills from the model, a `
+        + '"permission"."skill" key:\n');
+      for (const line of jsonDumpsIndent(defaultSkillPermission(skillNames)).split('\n')) {
+        process.stdout.write(`[${prefix}]     ${line}\n`);
+      }
+    }
   }
   if (includeLsp) {
     process.stdout.write(`[${prefix}] and, to enable code intelligence, a top-level `
@@ -364,8 +555,14 @@ export function atomicWriteJson(p, config) {
  * Zero runtime callers — re-measured this phase and still true. `rituals/_harness_mcp.py`
  * re-implements the inverse itself rather than inherit this one's permission/lsp side
  * effects, so the only crossings are the two emit-tree ones (`_build_emit.emit_opencode`,
- * `_build_global.emit_opencode_global`). */
-export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = []) {
+ * `_build_global.emit_opencode_global`).
+ *
+ * `result.skillsAdded` is set to the `permission.skill` denies this call added ONLY when the
+ * file on disk now matches what it computed (written, or nothing to change). Left unset on
+ * every path that wrote nothing — unreadable, not an object, commented `.jsonc`, write
+ * failure — so the caller keeps its previous record rather than claiming denies never written. */
+export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [], skillNames = [],
+  staleSkillNames = [], result = {}) {
   const target = opencodeTarget(p);
   let config = { $schema: OPENCODE_SCHEMA, instructions: [] };
   const { state, data, hadComments, error } = loadJsonObject(target);
@@ -396,10 +593,28 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
   let permChanged = addPerm;
   let stranded = [];
   let opaque = null;
-  if (addPerm) config.permission = defaultPermission(doctrines, excluded);
-  else {
-    [permChanged, stranded, opaque] = reconcileOpencodePermission(get(config, 'permission'),
+  let skillOpaque = null;
+  let permIsObject = true;
+  const added = [];
+  if (addPerm) {
+    config.permission = defaultPermission(doctrines, excluded);
+    if (skillNames.length) {
+      config.permission.skill = defaultSkillPermission(skillNames);
+      added.push(...skillNames);
+    }
+  } else {
+    const perm = get(config, 'permission');
+    permIsObject = isDict(perm);
+    [permChanged, stranded, opaque] = reconcileOpencodePermission(perm,
       defaultPermission(doctrines, excluded));
+    // Independent of the `bash` shape: a `permission.bash` the build cannot wire into must
+    // not also block the UNRELATED `permission.skill` key from being reconciled.
+    if (permIsObject) {
+      let skillChanged;
+      [skillChanged, skillOpaque] = reconcileOpencodeSkillPermission(perm, skillNames, staleSkillNames,
+        added);
+      permChanged = permChanged || skillChanged;
+    }
   }
   // The shape said no. This is the direction the residue warning above is NOT — a rule stated
   // in AGENT.md with nothing behind it — and it used to pass in silence, because a blanket
@@ -407,12 +622,23 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
   // short-circuits before any of the three WARNs below. Reported, never rewritten: the blanket
   // policy is the user's answer and it wins (`generate.test.mjs` pins that it survives).
   if (opaque) {
+    // `permIsObject` is false only here: `permission` itself is not an object at all, so the
+    // skill reconcile above never ran either — the unwired skill denies are folded into THIS
+    // one WARN rather than going unmentioned (a dedicated `skillOpaque` needs `perm` to be a
+    // dict to even look at `perm.skill`, which this case by definition is not).
+    const names = [...OWNED_BASH.filter((k) => has(defaultPermission(doctrines, excluded).bash, k)),
+      ...(!permIsObject ? skillNames : [])];
     process.stderr.write(`[geneseed] WARN: "permission" in ${path.basename(target)} `
       + `${opaque}, so Geneseed cannot wire its own gates into it — including `
-      + `${OWNED_BASH.filter((k) => has(defaultPermission(doctrines, excluded).bash, k))
-        .map((k) => jsonDumps(k)).join(', ')}. Your policy is left exactly as written; the `
+      + `${names.map((k) => jsonDumps(k)).join(', ')}. Your policy is left exactly as written; the `
       + 'harness states those rules but nothing enforces them at this boundary.\n');
   }
+  if (skillOpaque) {
+    process.stderr.write(`[geneseed] WARN: "permission"."skill" in ${path.basename(target)} `
+      + `${skillOpaque}, so Geneseed cannot wire its own skill-visibility gates into it — `
+      + `including ${skillNames.map((k) => jsonDumps(k)).join(', ')}. Your policy is left `
+      + 'exactly as written; those skills stay in the model\'s catalogue.\n');
+  }
   // Told, not silently left: these are gates for a rule this build does not make binding, kept
   // because Geneseed cannot prove it was the one that wrote them. stderr, like the other two
   // WARNs here — the emit's stdout is byte-compared by the golden corpus.
@@ -425,7 +651,10 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
   }
   const addLsp = !has(config, 'lsp');
   if (addLsp) config.lsp = true;
-  if (!addInstr && !permChanged && !addLsp) return target;
+  if (!addInstr && !permChanged && !addLsp) {
+    result.skillsAdded = added;
+    return target;
+  }
   if (path.extname(target) === '.jsonc' && hadComments) {
     // ⚠ THE TWO CASES GIVE OPPOSITE ADVICE, and telling a file that HAS a `permission` key to
     // add one is how the first cut of this got it wrong. `add` = there is no block, here is the
@@ -439,11 +668,12 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
     // block to paste, split by which of the two situations the reader is actually in. It is
     // stdout, not stderr, because on this path the paste-in IS the output.
     warnCommentedJsonc(target, agentPath, addPerm ? 'add' : (permChanged && 'reconcile'),
-      addLsp, 'geneseed', doctrines, excluded);
+      addLsp, 'geneseed', doctrines, excluded, skillNames);
     return target;
   }
   try {
     atomicWriteJson(target, config);
+    result.skillsAdded = added;
   } catch (e) {
     if (!isOsError(e)) throw e;
     process.stderr.write(`[geneseed] WARN: could not write ${target} (${e.message}) — `
@@ -494,8 +724,11 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [])
 export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude') {
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
-  // --root carries the install's own dir so a GLOBAL hook can stand down when a project
-  // install of the same host sits at/above cwd (project-bypasses-global).
+  // --root carries the install's own dir so a GLOBAL hook can stand down when a live, wired
+  // project install of the same host sits in the session's project dir (no walk up —
+  // `globalHookStandingDown`, project-bypasses-global): `context` and
+  // `git-gate` read it, `learn` reads `--memory`'s parent. `rule-gate` and Bob's `tool-gate`
+  // do not stand down: both still run once per install (host-compat B4 fixed only the three).
   if (host === 'bob') {
     // BOB'S OWN HOOK CONTRACT, per its hooks doc and 2.0.2 changelog (docs/reviews/
     // bob-global-injection-2026-09.md): FIVE events — SessionStart, UserPromptSubmit,
@@ -504,46 +737,84 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [],
     // refuse a call is EXIT CODE 2. The groups this emit wrote before were Claude's whole
     // set: `SubagentStop`/`PreCompact` are not Bob events, and the gates answered with a
     // stdout JSON Bob never reads — permissive on every call. `--host bob` makes the gates
-    // speak exit codes (js/hosts/hooks.mjs). No matcher on PreToolUse: Bob's tool names
-    // are undocumented (its IDE and Shell differ), so `tool-gate` reads the payload's shape
+    // speak exit codes (js/hosts/hooks.mjs). DELIBERATELY no matcher on PreToolUse
+    // (host-compat O1, revisited): bob-docs.md §2's tool list is already stale against the
+    // changelog (`web_fetch`, the 2.1.0 Office/IBM-docs tools are undocumented there), so an
+    // allow-list matcher built from it fails OPEN on every tool Bob adds between one
+    // docs read and the next — the exact failure mode a gate must not have. A deny-list
+    // with a negative-lookahead was the other shape considered; it depends on an unverified
+    // regex DIALECT (bob-docs.md never states whether its "regex on the tool name" supports
+    // lookahead at all), and a dialect mismatch there would silence the WHOLE gate rather than
+    // merely skip spawning it. bob-verdict.md O1 itself rates the matcher's upside "low,
+    // performance only" — not worth either risk. So `tool-gate` reads the payload's shape
     // instead. Which tool payload fields Bob sends is equally undocumented; the gates read
     // Claude's (`command`, `file_path`/`path`, `content`/`new_string`) and defer on anything
-    // else. Unverified live: no Bob install on the authoring machine.
+    // else. Unverified live: no Bob install on the authoring machine. Revisit a matcher only
+    // once a live Bob session can confirm both the current tool list and the regex dialect.
     const b = ' --host bob';
     return {
       SessionStart: [{ hooks: [{ type: 'command', command: `${run} context --root "${cfg}"${b} || exit 0` }] }],
       // One group, both gates: process 5's consent is a stderr line here (Bob has no ask
       // tier), so the pack toggle that drops Claude's git-gate group has nothing to drop —
       // `tool-gate` only ever EXITS 2 for Laws I and IV, which every build carries, and for a
-      // write under a project's own `.geneseed/protected-checks.txt` — the project opted in.
+      // write under a project's own `.geneseed/protected-checks.txt` — the project opted in —
+      // and for a recursive scan rooted at a whole filesystem (ops 2, the root-scan check).
       PreToolUse: [{ hooks: [{ type: 'command', command: `${run} tool-gate --root "${cfg}"${b}` }] }],
-      Stop: [{ hooks: [{ type: 'command', command: `${run} learn ${mem} || exit 0` }] }],
+      // Bob's Stop payload never carries `transcript_path` (I2) — `learn` reads `--host bob`
+      // and returns immediately rather than wasting a model call on the bare envelope. KEPT
+      // rather than DROPPED: the stand-down costs nothing (no transcript read, no spawn), and
+      // if Bob ever starts sending one, learning on Bob starts working with no emit change —
+      // dropping the group would need a second one re-added later for the same reason.
+      Stop: [{ hooks: [{ type: 'command', command: `${run} learn ${mem}${b} || exit 0` }] }],
     };
   }
-  // OpenClaude takes Claude's whole group set and verdicts unchanged; only `context` needs
-  // the host, to know which root file OpenClaude already loads by itself.
+  // OpenClaude takes Claude's whole group set and verdicts unchanged. `context` needs the host
+  // to know which root file OpenClaude already loads by itself; `git-gate` and `learn` need it
+  // to stand down under a relocated `$OPENCLAUDE_CONFIG_DIR` (the marker is keyed on `--host`,
+  // not the folder name — `globalHookStandingDown`). Claude's commands carry none: no `--host`
+  // means Claude, so they stay byte-identical. An OLDER shim (last-writer-wins) accepts
+  // `--host` on `git-gate` but not on `learn`, which then exits 1 under `|| exit 0` and skips.
   const h = host === 'openclaude' ? ' --host openclaude' : '';
   const context = `${run} context --root "${cfg}"${h} || exit 0`;
-  const gate = `${run} git-gate --root "${cfg}"${consentRuleOn(doctrines, excluded) ? '' : ' --no-consent'}`;
+  const gate = `${run} git-gate --root "${cfg}"${h}${consentRuleOn(doctrines, excluded) ? '' : ' --no-consent'}`;
   const ruleGate = `${run} rule-gate --root "${cfg}"`;
-  const learn = `${run} learn ${mem} || exit 0`;
-  return {
+  const learn = `${run} learn ${mem}${h} || exit 0`;
+  // Claude Code only (hooks.md, v2.1.295+; Task 1): a `command` hook that can't start, times
+  // out, or exits anything but 0 or 2 — even one whose stdout happens to be valid JSON — now
+  // BLOCKS the tool call instead of sliding through as the non-blocking default. Only safe to
+  // turn on now that an argv error inside geneseed-hook.mjs itself exits 0 (earlier host-compat
+  // fix): before that, a gate typo would have turned every tool call into a hang-visible block.
+  // A normal run (exit 0 + a schema-valid verdict) is untouched either way — see hooks.md's
+  // failure table. OpenClaude is a 2.1.88-era fork and must never see a field that version
+  // predates; Bob's own hook doc names no such field (and takes the early return above).
+  const onFailureBlock = host === 'claude' ? { onFailure: 'block' } : {};
+  const groups = {
     PreToolUse: [
-      { matcher: 'Bash', hooks: [{ type: 'command', command: gate }] },
+      // `Bash|PowerShell`, not `Bash` alone (Claude verdict I1): docs `hooks.md` says a hook
+      // that matches only `Bash` never fires on the PowerShell tool, which is Windows' default
+      // shell whenever Git Bash is absent — and on Windows without Git Bash, Bash is not even
+      // registered. `tool_input.command` is the same field on both tools, so `GIT_GATE_RE`
+      // needs no change.
+      { matcher: 'Bash|PowerShell', hooks: [{ type: 'command', command: gate, ...onFailureBlock }] },
       {
-        matcher: 'Write|Edit|MultiEdit|NotebookEdit',
-        hooks: [{ type: 'command', command: ruleGate }],
+        // No `MultiEdit`: it is not in Claude Code's tool table (tools-reference.md) — a dead
+        // matcher entry (Claude verdict R2).
+        matcher: 'Write|Edit|NotebookEdit',
+        hooks: [{ type: 'command', command: ruleGate, ...onFailureBlock }],
       },
     ],
-    SessionStart: [
-      { matcher: 'startup|clear', hooks: [{ type: 'command', command: context }] },
-      // `compact` too: auto-compaction keeps the instruction file (the host re-reads it) but
-      // summarises away the eagerly injected context, memory index and notebook TOC. Re-seed
-      // them the way a resume does — the static AGENT.md is NOT re-printed.
-      { matcher: 'resume|compact', hooks: [{ type: 'command', command: context }] },
-    ],
-    // `|| exit 0` (not `|| true`): hooks run under cmd.exe on native Windows, where `true`
-    // is not a command and the swallow-failures intent would invert into a 9009 error.
+    // One matcher-less group, not a `startup|clear` / `resume|compact` split (Claude verdict
+    // I4): every SessionStart source — `startup`, `resume`, `clear`, `compact` and `fork` —
+    // runs the identical `context` command, so splitting them only risked missing one. The
+    // split DID: a `--fork-session` run sets `source: "fork"`, which neither half matched, so
+    // a forked session got no session files or project context. The static AGENT.md is NOT
+    // re-printed here either way.
+    SessionStart: [{ hooks: [{ type: 'command', command: context }] }],
+    // `|| exit 0` (not `|| true`): the hook shell is `sh -c` on POSIX and Git Bash on Windows
+    // (OpenClaude requires it), or PowerShell on Windows when Git Bash isn't installed
+    // (hooks.md, "Shell form") — never cmd.exe for Claude. Bob runs `cmd /c`, where `true` is
+    // not a command (a 9009 error), so `exit 0` is the spelling every shell-form host shares.
+    // Under PowerShell `||` is a parse error in 5.1: `powershellForm` below swaps the tail.
     Stop: [{ hooks: [{ type: 'command', command: learn }] }],
     // Same command as Stop: `learn` reads the payload's hook_event_name and routes a
     // SubagentStop to the per-agent lesson path.
@@ -551,10 +822,45 @@ export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [],
     // And once more BEFORE compaction. `learn` distils the tail of the transcript (the newest
     // MAX_NOTES_CHARS), so per-turn Stop is a sliding window over the session — and
     // compaction is the one moment that window is about to be summarised away for good.
-    // The payload carries `transcript_path` like Stop's; the SessionStart `compact` matcher
-    // re-seeds context AFTER, this captures memory BEFORE. Same `|| exit 0`: never block.
+    // The payload carries `transcript_path` like Stop's; the matcher-less SessionStart group
+    // (its `compact` source) re-seeds context AFTER, this captures memory BEFORE. Same
+    // `|| exit 0`: never block.
     PreCompact: [{ hooks: [{ type: 'command', command: learn }] }],
   };
+  // Claude Code only: OpenClaude always runs Git Bash on Windows (its `findGitBashPath` exits
+  // without one), and Bob takes the early return above.
+  if (host !== 'claude' || claudeHookShell(process.env, hookOpts?.platform) !== 'powershell') {
+    return groups;
+  }
+  return powershellForm(groups);
+}
+
+/**
+ * The PowerShell spelling of a hook group set, for a Claude install on Windows without Git Bash
+ * (`claudeHookShell`). Without it the bash form is a parse error there and every hook fails
+ * OPEN. Each handler gets an explicit `shell: "powershell"` (hooks.md: it wins over the
+ * default) and a leading `&` — PowerShell refuses a quoted command head followed by arguments —
+ * and the never-block tail `|| exit 0` becomes `; exit 0`, valid in pwsh 7 and Windows
+ * PowerShell 5.1 alike (both measured byte-identical to the bash form's output). The gates stay
+ * bare on the exit-code side (no verb exits 2), but since Task 1 they carry `onFailure: "block"`
+ * (Claude only — `claudeHookGroups`'s `onFailureBlock`), so a launch failure — e.g. the bash-form
+ * command run under a Git-Bash-less PowerShell, a parse error — now BLOCKS instead of sliding
+ * through. `context`/`learn` carry no such field and stay non-blocking on a launch failure,
+ * in either shell.
+ *
+ * The paths stay double-quoted, where PowerShell expands `$name` and reads a backtick as an
+ * escape — a Windows path may legally hold either, and a mangled `--root` silently changes
+ * which install a gate answers for. So both are backtick-escaped first; nothing else in the
+ * command (verbs, flags) can contain them.
+ */
+function powershellForm(groups) {
+  const ps = (h) => {
+    const escaped = h.command.replace(/[`$]/g, '`$&');
+    const command = `& ${escaped.replace(/ \|\| exit 0$/, '; exit 0')}`;
+    return { ...h, command, shell: 'powershell' };
+  };
+  return Object.fromEntries(Object.entries(groups)
+    .map(([event, gs]) => [event, gs.map((g) => ({ ...g, hooks: g.hooks.map(ps) }))]));
 }
 
 /**
@@ -898,6 +1204,24 @@ export function managedBlockRemove(p, blockId = 'GENESEED', whole = false) {
   else unlinkSync(p);
 }
 
+/**
+ * The global OpenCode `AGENTS.md` sentinel. OpenCode loads `<cfg>/AGENTS.md` and, only when it
+ * is ABSENT, `~/.claude/CLAUDE.md` — where a Claude-global install keeps the whole harness in
+ * Claude dialect — so without an AGENTS.md the harness loads twice. The switch upstream is an
+ * env var (`OPENCODE_DISABLE_CLAUDE_CODE_PROMPT`) no config file can set, so the file has to exist.
+ * The carrier stays `AGENT.md`: this block only has to exist, and it is one line because it
+ * lands in every system prompt. A user's own AGENTS.md already suppresses the fallback and is
+ * left byte-for-byte alone; only an absent file or one carrying our block is written.
+ */
+export const OPENCODE_SENTINEL = 'AGENTS.md';
+
+export function opencodeSentinelWrite(cfgDir) {
+  const p = path.join(cfgDir, OPENCODE_SENTINEL);
+  if (existsSync(p) && managedBlockRead(p) === null) return;
+  managedBlockWrite(p, 'Geneseed keeps this block so OpenCode does not also load '
+    + '~/.claude/CLAUDE.md; the harness is AGENT.md. Put your own rules outside the block.');
+}
+
 /** `_build_settings._managed_block_read` — the block's inner content, or null. */
 export function managedBlockRead(p, blockId = 'GENESEED') {
   if (!existsSync(p)) return null;

package/js/hosts/shim.mjs

@@ -258,6 +258,43 @@ export function hookPrefix({ runner, entry, platform = process.platform } = {})
   return `"${runner}" "${entry}"`;
 }
 
+/** The basenames env-vars.md accepts for `CLAUDE_CODE_GIT_BASH_PATH`. */
+const GIT_BASH_NAMES = new Set(['bash.exe', 'sh.exe', 'bash', 'sh']);
+
+/**
+ * Which shell Claude Code runs a shell-form hook under on this machine: 'bash' | 'powershell'.
+ *
+ * hooks.md (`shell` field; "Shell form"): Git Bash on Windows, or PowerShell when Git Bash isn't
+ * installed — never cmd.exe. Under PowerShell the bash-form `"<shim>.cmd" verb … || exit 0` is a
+ * parse error, so every hook fails OPEN; `claudeHookGroups` emits the PowerShell form instead.
+ *
+ * THE RULE, filesystem and env only (the generator never spawns):
+ *   1. `CLAUDE_CODE_GIT_BASH_PATH` naming an existing bash.exe/sh.exe/bash/sh (env-vars.md; an
+ *      invalid value is ignored and Claude auto-detects as if unset);
+ *   2. any PATH entry holding `git.exe` with `<dir>\..\bin\bash.exe` beside it — the PATH
+ *      auto-detect is undocumented, so this mirrors the one detector we can read, OpenClaude's
+ *      `findGitBashPath` (`<git>/../../bin/bash.exe`).
+ * ponytail: no guessed default install paths. A missed Git Bash costs only PowerShell startup
+ * (~150 ms a hook — `shell: "powershell"` is explicit and wins), a false hit fails open; add a
+ * location when Claude documents one. `env` is a parameter so tests inject it; keys are matched
+ * case-insensitively because a copied Windows env keeps `Path`.
+ */
+export function claudeHookShell(env = process.env, platform = process.platform) {
+  if (platform !== 'win32') return 'bash';
+  const read = (name) => Object.entries(env).find(([k]) => k.toUpperCase() === name)?.[1];
+  const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
+  const forced = read('CLAUDE_CODE_GIT_BASH_PATH');
+  if (forced && GIT_BASH_NAMES.has(path.basename(forced).toLowerCase()) && isFile(forced)) {
+    return 'bash';
+  }
+  for (const raw of (read('PATH') || '').split(';')) {
+    const dir = raw.replace(/"/g, '');
+    if (dir && isFile(path.join(dir, 'git.exe'))
+      && isFile(path.join(dir, '..', 'bin', 'bash.exe'))) return 'bash';
+  }
+  return 'powershell';
+}
+
 /**
  * `_build_settings._hook_runner_entry()`'s two values — this driver's answer, which since
  * P5b is NOT Python's.