geneseed 3.20.0 → 4.0.0

package/js/hosts/gitref.mjs

@@ -12,9 +12,9 @@
  * `child_process` ban like every other closure that feeds `bin/geneseed-cli.mjs` — may ever
  * import. A module that is fs/path only is importable from anywhere.
  *
- * The OpenCode guard plugin (`adapters/opencode/plugins/geneseed-guard.js`) keeps its own
- * standalone copy — it cannot import from `js/` at all — kept in step by hand, commented as
- * this module's twin.
+ * The OpenCode guard plugin once kept a standalone twin of this for its `permission.ask`
+ * loop exemption; upstream never calls that hook, so the twin was deleted (OpenCode verdict
+ * I-2). This module has no copy to keep in step.
  */
 import { existsSync, statSync, lstatSync, readFileSync, openSync, readSync, closeSync } from 'node:fs';
 import path from 'node:path';

package/js/hosts/hooks-context.mjs

@@ -9,8 +9,8 @@ import { createHash } from 'node:crypto';
 import { readText, printOut as out, printErr as err, withDiscardableStderr } from '../lib/fs.mjs';
 import { normcase, toPlatformPath } from '../lib/paths.mjs';
 import { relPosix } from '../lib/text.mjs';
-import { resolvePath, sovereignBypass } from './hosts.mjs';
-import { isFile, isDir, selfAndParents, sortPaths, listDir } from './hooks-prims.mjs';
+import { globalHookStandingDown, hookProjectDir, resolvePath, sovereignBypass } from './hosts.mjs';
+import { isFile, isDir, sortPaths, listDir } from './hooks-prims.mjs';
 
 /**
  * `str(OSError)` — `[Errno N] strerror: 'filename'`, with the filename REPR'd.
@@ -169,29 +169,8 @@ export function sessionFiles(hookRoot) {
   return found;
 }
 
-const CLAUDE_MARKERS = ['.claude', '.bob', '.openclaude'];
-const GENESEED_MANIFEST = '.geneseed-manifest.json';
-
-/**
- * `_global_hook_standing_down` — project-bypasses-global.
- *
- * A GLOBAL install's hook passes its own dir as `--root`; when a Geneseed PROJECT install
- * of the SAME host sits at or above cwd, the project's hook injects and this one must not
- * double up.
- */
-export function globalHookStandingDown(hookRoot, cwd) {
-  const marker = path.basename(hookRoot);
-  if (!CLAUDE_MARKERS.includes(marker)) return false;
-  for (const d of selfAndParents(cwd)) {
-    const cand = path.join(d, marker);
-    if (isFile(path.join(cand, GENESEED_MANIFEST))) {
-      // Path equality, which is case-folded on Windows — `~/.claude` and `~/.Claude` are
-      // the same install there and two different ones on Linux.
-      return normcase(resolvePath(cand)) !== normcase(resolvePath(hookRoot));
-    }
-  }
-  return false;
-}
+// Moved to `hosts.mjs` so the gates and `learn` share it; re-exported for this verb's callers.
+export { globalHookStandingDown };
 
 /** `_disp` — relative to the repo root when it sits under it, else verbatim. */
 function disp(pathStr, root) {
@@ -412,8 +391,9 @@ function lazyLines(entries, root, room) {
 
 export function cmdContext(args) {
   HOST = (args && args.host) || 'claude';
-  // Discovery runs against the project root the hook was launched from — Claude runs
-  // SessionStart hooks with cwd = repo root — not the harness package dir.
+  // Discovery (and the stand-down) runs against the SESSION's project root, not the harness
+  // package dir: `$CLAUDE_PROJECT_DIR` when the host sets it (`hookProjectDir`), because
+  // SessionStart also fires on resume/compact/clear, after the agent may have `cd`'d away.
   // The only two `resolvePath` calls in this file whose argument can be a `~user` path the
   // user typed — `$GENESEED_ROOT` and `--root` — and `resolvePath` expands, so both can now
   // throw. Every other caller either builds its argument by `path.join` from an absolute
@@ -423,15 +403,16 @@ export function cmdContext(args) {
   let hookRoot;
   try {
     ({ root, hookRoot } = withDiscardableStderr(() => ({
-      root: resolvePath(process.env.GENESEED_ROOT || process.cwd()),
+      root: resolvePath(process.env.GENESEED_ROOT || hookProjectDir()),
       hookRoot: args.root ? resolvePath(args.root) : null,
     })));
   } catch {
     return 0;
   }
   if (hookRoot && sovereignBypass(hookRoot)) return 0;
-  if (hookRoot && !process.env.GENESEED_STACK_GLOBAL
-      && globalHookStandingDown(hookRoot, root)) return 0;
+  // The RAW `args.host`, not `HOST`: `HOST` defaults to claude, which would key an older
+  // OpenClaude emit's `~/.openclaude` (no `--host`) on `.claude` instead of its folder name.
+  if (globalHookStandingDown(hookRoot, root, args.host, 'context')) return 0;
   const session = hookRoot ? sessionFiles(hookRoot) : [];
   // A session file discovery would also pick up (a `user-rules.md` at the repo root of an
   // install whose harness dir IS the repo root) is injected once, in the session block.

package/js/hosts/hooks-learn.mjs

@@ -9,7 +9,9 @@ import { spawnSync } from 'node:child_process';
 import { readText, printOut as out, printErr as err } from '../lib/fs.mjs';
 import { toPlatformPath } from '../lib/paths.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
-import { resolveMemoryDir, sovereignBypass } from './hosts.mjs';
+import {
+  globalHookStandingDown, hookProjectDir, resolveMemoryDir, sovereignBypass,
+} from './hosts.mjs';
 import { readStdin, splitLines, splitWords } from './hooks-prims.mjs';
 import {
   existingSlugs, writeMemories, consolidateMemory, appendAgentLesson,
@@ -116,10 +118,27 @@ function flattenTranscript(p) {
 }
 
 /**
- * `_read_notes` — a lifecycle-hook payload with a `transcript_path` is read and flattened
- * (this is what makes wiring `learn` to a Stop hook work with no redirection); anything
- * else is used as-is. `meta` is that payload as `hookMeta` parsed it — passed in by
- * `cmdLearn`, which needs it again, so the raw text is parsed once.
+ * `_read_notes` — a lifecycle-hook payload naming a transcript is read and flattened (this is
+ * what makes wiring `learn` to a Stop hook work with no redirection); anything else is used
+ * as-is. `meta` is that payload as `hookMeta` parsed it — passed in by `cmdLearn`, which needs
+ * it again, so the raw text is parsed once.
+ *
+ * B10 (Claude verdict, host-compat-2026-10): on SubagentStop, `transcript_path` is the MAIN
+ * session's transcript — the subagent's own turn lives in `agent_transcript_path` instead, in
+ * a nested `subagents/` folder (docs `hooks.md`). Flattening the parent's file distils a lesson
+ * about the wrong conversation, so the agent's own path wins whenever both are given; Stop/
+ * PreCompact never send `agent_transcript_path`, so they fall through to `transcript_path`
+ * unchanged.
+ *
+ * `last_assistant_message` (Stop and SubagentStop) is the host's own copy of the final turn. It
+ * is never preferred over the transcript — `learn` distils from the whole exchange, and
+ * `last_assistant_message` is Claude's reply alone, with the user's side of the turn gone, so
+ * using it as the default would trade lesson quality for a read it does not need to save. It is
+ * used in two cases only, both strictly additive: as the whole of `notes` when the transcript
+ * file cannot be read at all (missing, or the host has not flushed it yet); and APPENDED when
+ * the file DID read but the write lagged behind the live conversation enough to miss the final
+ * turn (docs `hooks.md`) — detected by the flattened text not already ending in it, so a
+ * transcript that already has the final turn never gets a duplicate.
  *
  * EXPORTED FOR THE UNIT TIER, and the rule this follows is written down once here for it and
  * for `./memory-files.mjs`'s `existingSlugs` and `writeMemories`.
@@ -134,8 +153,14 @@ function flattenTranscript(p) {
  */
 export function readNotes(raw, meta = hookMeta(raw)) {
   if (!raw.trim()) return '';
-  const tp = meta.transcript_path;
-  return tp ? flattenTranscript(tp) : raw;
+  const tp = meta.agent_transcript_path || meta.transcript_path;
+  if (!tp) return raw;
+  const flat = flattenTranscript(tp);
+  const lastMsg = typeof meta.last_assistant_message === 'string'
+    ? meta.last_assistant_message.trim() : '';
+  if (!flat) return lastMsg || flat;
+  if (lastMsg && !flat.endsWith(lastMsg)) return `${flat}\n\nassistant: ${lastMsg}`;
+  return flat;
 }
 
 function buildLearnPrompt(notes, existing) {
@@ -163,8 +188,15 @@ function runLlm(llm, prompt) {
   // `_harness_learn.py:85` runs this through the wrapped `run(..., capture_output=True)`,
   // which folds in `CREATE_NO_WINDOW`; a model CLI invoked from the windowless daemon
   // otherwise pops a console for as long as it takes to answer.
+  //
+  // `GENESEED_LEARN_CHILD=1` (Claude B2): `$GENESEED_LLM="claude -p"` with hooks not disabled
+  // starts a child Claude session that loads this SAME install's Stop hook, which re-runs
+  // `learn` — one recursion per nested session, stopped only by the host's 600 s timeout
+  // killing the outermost call. The marker rides in the child's own environment (inherited by
+  // every grandchild too), and `cmdLearn`'s first line stands down the instant it sees it.
   const proc = spawnSync(argv[0], [...argv.slice(1), prompt],
-    { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, ...NO_WINDOW });
+    { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
+      env: { ...process.env, GENESEED_LEARN_CHILD: '1' }, ...NO_WINDOW });
   // Universal newlines, because Python reads the pipe in TEXT mode: a model CLI that is
   // itself a Python script emits CRLF on Windows, `subprocess` folds it to `\n`, and
   // `write_text` expands it again on the way into the memory file. Node hands back the raw
@@ -198,6 +230,9 @@ function learnAgentLesson(meta, notes, args) {
   if (!memDir) return 0;
   const prompt = [agentLessonPrompt(), '', 'NOTES:', notes].join('\n');
   const llm = process.env.GENESEED_LLM;
+  // Unreachable through the hook path: `cmdLearn` already returned above when `$GENESEED_LLM`
+  // was unset, because a SubagentStop payload always names its own event. Left in as the same
+  // defensive no-op `resolveMemoryDir`'s check above is, should this ever be called directly.
   if (!llm) {
     err('[learn] $GENESEED_LLM unset \u2014 printing agent-lesson prompt.\n\n');
     out(`${prompt}\n`);
@@ -217,6 +252,11 @@ function learnAgentLesson(meta, notes, args) {
 }
 
 export function cmdLearn(args) {
+  // B2: stand straight down inside a model-CLI child `runLlm` just spawned (see its comment).
+  // Checked before anything else — a child never gets as far as reading its own stdin, let
+  // alone deciding whether there is a store to write to.
+  if (process.env.GENESEED_LEARN_CHILD) return 0;
+
   if (args.consolidate) {
     const memDir = resolveMemoryDir(args.memory);
     if (!memDir) {
@@ -234,9 +274,50 @@ export function cmdLearn(args) {
   // The Stop/SubagentStop hook always passes `--memory <cfg>/memory`; inside an excluded
   // folder the global install must not learn.
   if (args.memory && sovereignBypass(path.dirname(toPlatformPath(args.memory)))) return 0;
+  // Same install root, and a project install of this host beside it learns on its own Stop: a
+  // second LLM call, and the global store learning facts the project owns (Claude B4).
+  if (args.memory && globalHookStandingDown(path.dirname(toPlatformPath(args.memory)),
+    hookProjectDir(), args.host, 'learn')) return 0;
 
   const raw = args.file ? readText(args.file) : readStdin();
   const meta = hookMeta(raw);
+  // A genuine lifecycle-hook call names its own event — `hook_event_name` (Claude/OpenClaude)
+  // or `event` (Bob, whose docs give the Stop payload as `{"event":"Stop","session_id":...}`).
+  // A MANUAL invocation (plain notes text, a `--file`, or a hand-typed JSON note such as
+  // `{"foo": 1}` — `readNotes`'s own rule, kept for it below) carries neither and is unaffected
+  // by either check in this block.
+  const hookEvent = typeof meta.hook_event_name === 'string' ? meta.hook_event_name
+    : (typeof meta.event === 'string' ? meta.event : null);
+
+  // I2 (Bob): its Stop payload never carries `transcript_path`, so there is never a transcript
+  // to distil — and the bare envelope itself is not notes text (that would waste a model call
+  // on `{"event":"Stop","session_id":"s"}`). Scoped to `--host bob`: every other host's Stop/
+  // PreCompact genuinely carries `transcript_path` (docs `hooks.md`), so a bare envelope there
+  // is either a hand-typed note (no event field at all) or a bug upstream, neither of which this
+  // should swallow. SubagentStop is excluded too — its own transcript is `agent_transcript_path`,
+  // which `readNotes` now reads instead (B10), and it is routed below on the
+  // agent-name fields alone. Kept rather than dropping Bob's Stop group (js/hosts/settings.mjs):
+  // the group costs nothing once this returns immediately, and if Bob ever starts sending a
+  // transcript, learning starts working there with no emit change.
+  if (args.host === 'bob' && hookEvent && hookEvent !== 'SubagentStop' && !args.file
+    && typeof meta.transcript_path !== 'string') {
+    err('[learn] no transcript available (bob) \u2014 nothing to distil.\n');
+    return 0;
+  }
+
+  // B3: a real hook call with `$GENESEED_LLM` unset has nothing to send a prompt to — stdout on
+  // Stop/SubagentStop/PreCompact reaches only the debug log, never the user (docs `hooks.md`) —
+  // so reading and flattening the transcript (up to 16 KB, every turn) just to print it nowhere
+  // is pure waste. Checked BEFORE `readNotes`, which is what does that read. A manual
+  // invocation keeps printing the prompt on an unset `$GENESEED_LLM` — that is the documented,
+  // deliberate behaviour (docs/reference/env-context.md) for someone running `learn` by hand to
+  // see what would have been sent, and `hookEvent` being unset is exactly what tells the two
+  // apart.
+  if (hookEvent && !process.env.GENESEED_LLM) {
+    err('[learn] $GENESEED_LLM unset \u2014 nothing to distil.\n');
+    return 0;
+  }
+
   let notes = readNotes(raw, meta);
   if (!notes.trim()) {
     err('[learn] no notes or transcript content \u2014 nothing to distil.\n');

package/js/hosts/hooks.mjs

@@ -6,14 +6,17 @@
  * fused for a host that runs ONE command per event), and a Stop/SubagentStop/PreCompact
  * distiller.
  *
- * ONE VERB, TWO DIALECTS. `--host` names the host that will read the verdict. Claude Code
+ * THREE HOSTS, TWO DIALECTS. `--host` names the host that will read the verdict. Claude Code
  * (the default) reads `hookSpecificOutput.permissionDecision: "ask"` and shows the user a
  * prompt. `--host bob` is Bob's own protocol: PreToolUse ignores stdout and refuses only on
- * EXIT CODE 2, so the two Laws exit 2 with the reason on stderr and the rest is a stderr line with exit 0; SessionStart
- * context is plain stdout, as on Claude. `--host openclaude` speaks Claude's dialect verbatim
- * (OpenClaude is a Claude Code fork); the flag only picks which root file counts as native. Since P5b they are also what the emitted hooks name: `bin/build-driver.mjs` bakes
- * `<node> <checkout>/bin/geneseed-hook.mjs` into the machine-wide shim, so an install this
- * driver emits has no Python in its hook path at all — which is what let the interpreter
+ * EXIT CODE 2, so `BLOCK_RULES` (Laws I and IV, plus rigor-5 and ops-2) exit 2 with the reason on stderr
+ * and the rest is a stderr line with exit 0; SessionStart context is plain stdout, as on
+ * Claude. `--host openclaude` speaks Claude's dialect verbatim (OpenClaude is a Claude Code
+ * fork); the flag only picks which root file counts as native for `context`'s discovery.
+ *
+ * Since P5b, `--host` is also what the emitted hooks themselves name: `bin/build-driver.mjs`
+ * bakes `<node> <checkout>/bin/geneseed-hook.mjs` into the machine-wide shim, so an install
+ * this driver emits has no Python in its hook path at all — which is what let the interpreter
  * discovery and its exit-4 refusal be deleted rather than merely bypassed.
  *
  * Ported from `rituals/_harness_context.py` and `rituals/_harness_learn.py`, whose shared
@@ -51,7 +54,9 @@ import { readFileSync, appendFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { printOut as out, printErr as err } from '../lib/fs.mjs';
 import { normcase } from '../lib/paths.mjs';
-import { GATE_LEDGER, resolvePath, sovereignBypass } from './hosts.mjs';
+import {
+  GATE_LEDGER, globalHookStandingDown, hookProjectDir, resolvePath, sovereignBypass,
+} from './hosts.mjs';
 import { currentBranch, gitRootOf, loopLaunched } from './gitref.mjs';
 import { selfAndParents, readStdin } from './hooks-prims.mjs';
 
@@ -75,8 +80,32 @@ const GIT_GATE_RE = /\bgit\b[^\n]*\b(?:commit|push)\b/;
 // A forced push is `--force*`, a `-f` cluster, or a `+refspec` (`push origin +main`) — the last
 // is a force push with no flag at all. `push --force*` trips this gate rather than process 5's
 // so the stronger reason is the one the user reads.
+//
+// B5 (claude-code.md / claude-verdict.md) found the long/modern spellings of the same acts
+// still passed: `clean --force` (the long flag, not a `-f` cluster), `branch --delete --force`
+// (the long form of `-D`, EITHER flag order — `--force --delete` is the same act; an un-forced
+// `--delete` refuses on an unmerged branch exactly like `-d`, so it stays OUT; `-D --force`/
+// `--delete -f`/`-d --force`/`-df` are the SAME act again and are a known ceiling this does not
+// chase — add them if a probe ever shows one in real use), `checkout -f`/`--force` and
+// `switch -f`/`--force`/`--discard-changes`
+// (git's own `-h` lists `-f, --force` AND a separate `--discard-changes` for switch — both
+// discard uncommitted work the same way `checkout --` does), `worktree remove --force`/`-f`
+// (can discard an uncommitted worktree), `reflog expire` and `gc --prune=now` (delete the
+// reflog/dangling-commit safety net recovery depends on), and `push :branch`/`push --delete`
+// (deletes a remote branch — the colon form needs a space before the `:` so `push origin
+// HEAD:main`, an ordinary refspec, is not caught).
+//
+// `restore` and `stash drop`/`stash clear` are carved OUT of the shared `\bgit\b[^\n]*\b(…)`
+// wrapper above and anchored to the verb position instead (`git`, an optional `-C <path>`, then
+// the verb immediately): every other arm here needs a flag that is vanishingly unlikely in a
+// commit message or a filename, but "restore" needs no flag at all and "drop"/"clear" are
+// ordinary English, so `git commit -m "restore working behavior"` or `git stash push -m "clear
+// old state"` would otherwise trip Law IV on the MESSAGE TEXT, not the command. Anchoring to
+// the verb position is also what lets `restore` ask for `--staged --worktree` together (that
+// combination DOES discard working-tree changes, unlike `--staged` alone) while still deferring
+// on `--staged` alone.
 const DESTRUCTIVE_GIT_RE =
-  /\bgit\b[^\n]*\b(?:reset\b[^\n]*\s--hard\b|clean\b[^\n]*\s-[a-zA-Z]*f|branch\s+-D|checkout\s+--\s|push\b[^\n]*(?:\s--force|\s-[a-zA-Z]*f\b|\s\+\S))/;
+  /\bgit\b[^\n]*\b(?:reset\b[^\n]*\s--hard\b|clean\b[^\n]*\s(?:-[a-zA-Z]*f|--force\b)|branch\b[^\n]*\s(?:-D\b|--delete\b[^\n]*--force\b|--force\b[^\n]*--delete\b)|checkout\s+--\s|checkout\b[^\n]*\s(?:-[a-zA-Z]*f\b|--force\b)|switch\b[^\n]*\s(?:-[a-zA-Z]*f\b|--force\b|--discard-changes\b)|worktree\b[^\n]*\bremove\b[^\n]*(?:-[a-zA-Z]*f\b|--force\b)|reflog\b[^\n]*\bexpire\b|gc\b[^\n]*--prune\b|push\b[^\n]*(?:\s--force|\s-[a-zA-Z]*f\b|\s\+\S|\s--delete\b|\s:\S))|\bgit(?:\s+-C\s+\S+)*\s+restore\b(?:(?![^\n]*--staged\b)|(?=[^\n]*--staged\b)(?=[^\n]*--worktree\b))|\bgit(?:\s+-C\s+\S+)*\s+stash\s+(?:drop|clear)\b/;
 
 // `loopExempt` — a WHITELIST, not the blacklist this replaced. A false ask costs one prompt; a
 // false allow publishes. So the exemption holds only when the ENTIRE command is built from
@@ -196,12 +225,16 @@ const BOB_DENY_EXIT = 2;
 /**
  * On Bob, which has no ask tier, which rules are worth a hard block. Laws I and IV: a
  * credential in a tracked file and a history-discarding git act are wrong in every context,
- * so refusing them costs nothing. Process 1 and process 5 are the USER's calls — a hard
+ * so refusing them costs nothing. rigor-5 (External Gate) joins them: a protected check the
+ * agent can edit is not a check, so it is as unconditional as the two Laws — NOT "Laws I/IV
+ * only", see bob-code.md B3. Process 1 and process 5 are the USER's calls — a hard
  * block would make Bob unable to commit at all — so they become a warning the host
- * logs. `gate-error` is a warning too: a crashed gate that blocked every tool call would be
+ * logs. ops-2 (Commands Must Return, the root-scan check) is a block too: a warning would let a
+ * scan of every drive run for hours, and the agent loses nothing by re-targeting a directory.
+ * `gate-error` is a warning too: a crashed gate that blocked every tool call would be
  * a lockout, not a safeguard, and there is no prompt through which the user could clear it.
  */
-const BLOCK_RULES = new Set(['law-1', 'law-4', 'rigor-5']);
+const BLOCK_RULES = new Set(['law-1', 'law-4', 'rigor-5', 'ops-2']);
 
 /**
  * THE GATE LEDGER — one JSON line per ask, nothing per defer.
@@ -295,9 +328,132 @@ function readPayload() {
 
 function gitGate(args) {
   if (sovereignBypass(args.root)) return 0;
+  // A project install of this host beside a global one: the project's own git-gate runs too and
+  // carries the project's `--no-consent` choice, so the global's verdict would only overrule it
+  // (Claude B4). Law IV still runs, in the project's gate.
+  if (globalHookStandingDown(args.root, hookProjectDir(), args.host, 'git-gate')) return 0;
   return gitDecide(args, readPayload());
 }
 
+// ======================================================================================
+// root scan — Doctrine ops 2 (Commands Must Return)'s tool-boundary backstop
+// ======================================================================================
+
+// On 2026-10-10 a subagent ran `find / -iname "write.ts" … | head -5` in Git Bash, where `/`
+// mounts every drive (/c, /d) and a network share: 3.5 h at 100 % CPU, and the Bash timeout
+// did not stop the orphaned child. `| head` stops nothing — find still visits every directory.
+// Ported from Ritus/guards/root_scan.py (its 9 refuse / 8 pass self-check is in
+// tests/unit/hook_gates.test.mjs), with one tightening: the reference's recursion regex,
+// `-[a-z]*r[a-z]*` under `/i`, read PowerShell's `-Force`/`-Filter`/`-ErrorAction` as a
+// recursion flag, which on Bob and OpenCode is a hard block, not a prompt. So grep takes a short
+// flag cluster carrying `r`/`R` (or `--recursive`), ls/dir an uppercase `R` (their `-r` is
+// reverse), and PowerShell's `-Recurse` or one of its prefix abbreviations. Lives HERE, inside `gitDecide`, rather than in a verb of
+// its own: every `command` payload on every host already routes through this function, and a
+// new verb on an older machine-wide shim would exit 1 — which `onFailure: "block"` turns into
+// every Bash call refused. Runs whether or not the ops pack is built in, like rule-gate's
+// process-1: how a command is run is never wrong to bound. Twin: adapters/opencode/plugins/
+// geneseed-guard.js `rootScan` — keep in step (tests/plugins/guard.test.mjs diffs the constants).
+const SCAN_ALWAYS = new Set(['find', 'du', 'tree', 'rg', 'fd', 'where.exe']);
+const SCAN_GREP_R = new Set(['grep', 'egrep']);
+const SCAN_LS_R = new Set(['ls', 'dir']);
+const SCAN_PS_R = new Set(['get-childitem', 'gci']);
+// `-r` recurses for grep only: for `ls` it is REVERSE (`ls -ltr /` lists one directory), so
+// ls/dir need an UPPERCASE `R` in the cluster, `--recursive`, or (as PowerShell aliases) `-Recurse`.
+const GREP_RECURSE_RE = /^(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)$/;
+const LS_RECURSE_RE = /^(?:-[a-zA-Z]*R[a-zA-Z]*|--recursive)$/;
+const PS_RECURSE_RE = /^-r(?:e(?:c(?:u(?:r(?:s(?:e)?)?)?)?)?)?$/i;
+// A trailing `*` is still the root: the shell expands `du -sh /*` to every drive just the same.
+const FS_ROOT_RE = /^(?:\/|\/[a-z]\/?|\/mnt\/[a-z]\/?|[a-z]:[\\/]?)\*?$/i;
+// The cheap prefilter: a command that names no scanner pays this one test and nothing else.
+const SCAN_WORD_RE = /\b(?:find|du|tree|rg|fd|where\.exe|grep|egrep|ls|dir|get-childitem|gci)\b/i;
+// Non-POSIX tokens, like the reference's `shlex.split(posix=False)`: a quoted run stays inside
+// its word and a backslash is NEVER an escape — a POSIX lexer would eat the one in `C:\ -Recurse`
+// and leave the root unseen.
+const SCAN_TOKEN_RE = /(?:[^\s"']+|"[^"]*"?|'[^']*'?)+/g;
+const SCAN_WRAPPERS = new Set(['sudo', 'command', '\\builtin', 'time', 'nice']);
+// One left-to-right pass: a comment (`#` starting a word, to the end of the line — an apostrophe
+// in it is no quote), a quoted run (kept whole, so its `;`/`|` is data), a separator, or a
+// heredoc opener (`<<TAG`, `<<-TAG`, `<< 'TAG'`, `<<"TAG"` — never the here-string `<<<`).
+// Every alternative consumes at least one character, and none can backtrack past its start.
+const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g;
+
+/**
+ * The command cut at `|`/`;`/`&&`/`||`/newline OUTSIDE quotes, with every heredoc body (the
+ * lines after `<<TAG` up to the `TAG` line; `<<-` lets it be tab-indented) dropped: both are data.
+ * Without this, `git commit -F - <<'EOF'` — the mandated multi-line commit form — or a quoted
+ * `-m "fix; find / loop"` whose text merely names a root scan reads as one, which on Bob and
+ * OpenCode is a hard block of the commit. An unterminated heredoc runs to the end, as in bash.
+ * Backslash is no escape here either, like `SCAN_TOKEN_RE` (`"C:\"` must close).
+ */
+function scanSegments(command) {
+  const segs = [];
+  const tags = [];
+  const re = new RegExp(SCAN_SPLIT_RE);
+  let start = 0;
+  let m;
+  while ((m = re.exec(command))) {
+    if (m[3]) { tags.push([m[1], m[3]]); continue; }
+    if (m[0][0] === '"' || m[0][0] === "'") continue;
+    segs.push(command.slice(start, m.index));
+    start = re.lastIndex;
+    // A comment is cut OUT of its segment (its text is prose, `# scanning / for refs`); the
+    // newline after it, if any, is the next separator.
+    if (m[0][0] === '#') continue;
+    // A pending heredoc's body starts on the line after its opener; each line is read once.
+    while (m[0] === '\n' && tags.length) {
+      const end = command.indexOf('\n', start);
+      const line = command.slice(start, end < 0 ? command.length : end).replace(/\r$/, '');
+      start = end < 0 ? command.length : end + 1;
+      if ((tags[0][0] ? line.replace(/^\t+/, '') : line) === tags[0][1]) tags.shift();
+      if (end < 0) break;
+    }
+    re.lastIndex = start;
+  }
+  segs.push(command.slice(start));
+  return segs;
+}
+
+/**
+ * The first segment (see `scanSegments`) that recursively scans a whole filesystem root, or
+ * null. A segment whose PROGRAM is ssh is exempt — its remote command is ssh's argument, and a
+ * remote root scan is the remote's business — but only that segment: `ssh h true; find /` still
+ * refuses, and so does a `find /` whose comment merely mentions ssh (the reference exempted any
+ * command containing "ssh"). Any path deeper than a root passes.
+ */
+export function rootScan(command) {
+  if (!SCAN_WORD_RE.test(command)) return null;
+  for (const seg of scanSegments(command)) {
+    // Tokens keep their quotes until the root test, so a quoted `"a:"` can be told from a bare `C:`.
+    let toks = (seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t));
+    while (toks.length && SCAN_WRAPPERS.has(unquote(toks[0]))) toks = toks.slice(1);
+    if (!toks.length) continue;
+    // The program word without its path (either slash) or an `.exe` suffix: `C:\tools\rg.exe`.
+    const word = unquote(toks[0]).split(/[\\/]/).pop().toLowerCase();
+    const prog = SCAN_ALWAYS.has(word) ? word : word.replace(/\.exe$/, '');
+    const always = SCAN_ALWAYS.has(prog);
+    const grep = SCAN_GREP_R.has(prog);
+    const ls = SCAN_LS_R.has(prog);
+    const ps = SCAN_PS_R.has(prog);
+    if (!always && !grep && !ls && !ps) continue; // ssh is none of these, so its segment passes
+    // `-Path=x` and PowerShell's colon binding `-Path:C:\` read as the path itself.
+    const argv = toks.slice(1).map((t) => {
+      const m = /^-path[=:](.+)$/i.exec(t);
+      return m ? m[1] : t;
+    });
+    if (!always && !argv.some((a) => (grep && GREP_RECURSE_RE.test(a))
+      || (ls && (LS_RECURSE_RE.test(a) || (a.length >= 3 && PS_RECURSE_RE.test(a))))
+      || (ps && PS_RECURSE_RE.test(a)))) continue;
+    if (argv.some(rootArg)) return seg.trim();
+  }
+  return null;
+}
+// For ls/dir a PowerShell `-Recurse` abbreviation counts from `-re` up: a bare `-r` there is the
+// POSIX reverse flag (`ls -r /`, `dir -r C:\`). gci/Get-ChildItem keep the full abbreviation set.
+const unquote = (t) => t.replace(/^["']+|["']+$/g, '');
+// A QUOTED token is data — a grep pattern (`grep -rn "/" src`), a path named in a search
+// (`rg "/mnt/c" README.md`) — never a root target; only an unquoted root is one.
+const rootArg = (t) => !/^["']/.test(t) && FS_ROOT_RE.test(t);
+
 function gitDecide(args, payload) {
   const command = ((payload && payload.tool_input) || {}).command;
   if (typeof command !== 'string') return 0;
@@ -305,6 +461,14 @@ function gitDecide(args, payload) {
     return ask(args, 'git-gate', 'law-4', 'Geneseed (Deletion Is Deliberate) \u2014 a history-rewriting or '
       + 'discarding git act needs confirmation bound to this specific command');
   }
+  // Before `--no-consent`: that flag drops the process pack's rule, not this one.
+  const scan = rootScan(command);
+  if (scan) {
+    return ask(args, 'git-gate', 'ops-2', `Geneseed (Commands Must Return) \u2014 \`${scan.slice(0, 80)}\` `
+      + 'recursively scans a whole filesystem root (in Git Bash, / spans every drive and mounted '
+      + 'share, for hours; | head stops nothing). Search a specific directory instead: the '
+      + 'project, node_modules, ~/.npm, %APPDATA%.');
+  }
   // `--no-consent`: the process pack (or process 5 alone) is off, so the commit/push ask has
   // no rule behind it — but Law IV above is universal and has already run. Checked before
   // `loopExempt` so a non-git command, or one with consent off, never pays for the whitelist.
@@ -397,8 +561,14 @@ function ruleDecide(args, payload) {
   if (typeof p !== 'string' || !p) return 0;
   // Write carries `content`, Edit `new_string`, NotebookEdit `new_source`, MultiEdit an
   // `edits[]` of `new_string`s — every one can plant a credential, so every one is scanned.
+  // MultiEdit is no longer in Claude Code's own tool table (tools-reference.md) or the
+  // settings matcher that routes here (Claude verdict R2); the `edits[]` read stays as a
+  // cheap, harmless guard in case that ever changes.
+  // `diff` (Bob's `apply_diff`) and `replace`/`search` (`search_and_replace`) are Roo-lineage
+  // field names the Bob docs never confirm (bob-verdict.md I1) — accepted when present, never
+  // required, same as every field above.
   const edits = Array.isArray(ti.edits) ? ti.edits.map((e) => e && e.new_string) : [];
-  const body = [ti.content, ti.new_string, ti.new_source, ...edits]
+  const body = [ti.content, ti.new_string, ti.new_source, ti.diff, ti.replace, ti.search, ...edits]
     .filter((v) => typeof v === 'string').join('\n');
   if (body && !DOTENV_RE.test(p) && SECRET_RE.test(body)) {
     return ask(args, 'rule-gate', 'law-1', `Geneseed (Sealed Secrets) — ${p} would carry a `
@@ -424,15 +594,39 @@ export const cmdRuleGate = guardGate(ruleGate, 'rule-gate');
 // ======================================================================================
 
 /**
- * Bob's PreToolUse entry carries no matcher over documented tool names, so it cannot name `git-gate` for Bash and `rule-gate` for Write the way Claude's
- * `PreToolUse` does. This verb is the two fused, dispatched on the payload rather
- * than on a matcher: a `command` field is a shell call and gets the git checks, a path
- * field is a write and gets the rule checks. Nothing here decides anything the two named
- * gates do not — it only removes the need for a matcher the host does not have.
+ * Bob's documented PreToolUse payload (bob-verdict.md I1) is `{event, session_id, tool,
+ * input:{...}}` — none of `tool_input`, `tool_name` or `hook_event_name` exist. Normalised
+ * HERE, once, at Bob's one entry point (`toolGate` is the only verb its settings.json invokes
+ * for PreToolUse), so `gitDecide`/`ruleDecide` keep reading the Claude shape unchanged and
+ * never learn Bob exists. A no-op for an already-Claude-shaped payload: every field it sets
+ * is only filled in when the Claude-named field is absent.
+ */
+function normaliseBobPayload(payload) {
+  if (!payload || typeof payload !== 'object') return payload;
+  const out = { ...payload };
+  if (!out.tool_input && payload.input && typeof payload.input === 'object') {
+    out.tool_input = payload.input;
+  }
+  if (!out.tool_name && typeof payload.tool === 'string') out.tool_name = payload.tool;
+  if (!out.hook_event_name && typeof payload.event === 'string') out.hook_event_name = payload.event;
+  return out;
+}
+
+/**
+ * Bob's PreToolUse entry carries no matcher, deliberately (host-compat O1, revisited): Bob's
+ * tool list drifts (already stale against the 2.1.0+ changelog — `web_fetch`, the Office/
+ * IBM-docs tools) and its "regex on the tool name" dialect is otherwise unverified, so
+ * `claudeHookGroups` (settings.mjs) does not build one — an allow-list would fail OPEN on a
+ * tool it has not seen yet, and a deny-list needs lookahead the regex dialect may not have.
+ * So this verb cannot name `git-gate` for one tool and `rule-gate` for another the way
+ * Claude's two separate `PreToolUse` matchers do; it is the two fused, dispatched on the
+ * PAYLOAD rather than on a matcher: a `command` field is a shell call and gets the git
+ * checks, a path field is a write and gets the rule checks. Nothing here decides anything
+ * the two named gates do not — it only removes the need for a matcher the host does not have.
  */
 function toolGate(args) {
   if (sovereignBypass(args.root)) return 0;
-  const payload = readPayload();
+  const payload = normaliseBobPayload(readPayload());
   const ti = (payload && payload.tool_input) || {};
   return typeof ti.command === 'string' ? gitDecide(args, payload) : ruleDecide(args, payload);
 }