geneseed 3.20.0 → 4.1.0

package/js/hosts/mcp.mjs

@@ -1,22 +1,15 @@
 /**
- * MCP server presets, state and config I/O — `rituals/_harness_mcp.py`'s MCP block.
+ * MCP server state and config reading — `rituals/_harness_mcp.py`'s MCP block, minus its writers.
  *
- * WHAT THE PLAN SAID AND WHAT READING FOUND. The P6f plan scored `api_mcp` + `api_mcp_toggle`
- * at "~90 new, already in js/: `_mcp_load`/`readJsonc` (P6c), `settings.mjs`'s atomic write".
- * Measured against `js/`: `readJsonc` had crossed and NOTHING ELSE HAD. `js/web/api.mjs`
- * carries a five-line `mcpLoad` that is the no-host, comment-tolerant reader P6c needed for
- * `geneseed-wiki.jsonc`, which is one arm of one of these thirteen functions. `_MCP_PRESETS`,
- * `_mcp_servers_key`, `_mcp_preset_block`, `_mcp_apply`, `_mcp_state`, `_mcp_set_enabled`,
- * `_mcp_load`'s host fork, `_mcp_commented`, `_mcp_save`, `_mcp_config_for`,
- * `_mcp_install_targets`, `_mcp_known_names` and `_mcp_meta` are 168 lines of Python, all
- * new. The endpoints on top of them are the small half.
+ * READ-ONLY BY DECISION (2026-10). Which MCP servers an install wires depends on the user and on
+ * the host, so Geneseed shows what each config already holds and where that file lives, and the
+ * user edits it. The three presets (`MCP_PRESETS`), the block shaper, the applier, the
+ * enable/disable flip and the atomic saver went with the console's Add button and toggle;
+ * `docs/guides/mcp*.md` carry the blocks a user copies by hand. Nothing here writes.
  *
- * THE ROUND TRIP IS THE HAZARD, and it is why every read here goes through `parseJson`.
- * `_mcp_save` rewrites the WHOLE config, not the servers map — and for a Claude global
- * install that config is `~/.claude.json`, which holds projects and history far beyond MCP
- * wiring. A `JSON.parse` would turn every `"temperature": 1.0` in somebody's real file into
- * `1` on the way back out. `readJsonc` already learned this; the strict-JSON fork has to
- * learn it separately, because it does not go through `readJsonc` at all.
+ * THE READ IS STILL HOST-SHAPED. OpenCode nests servers under `mcp` with an `enabled` flag and
+ * may be `.jsonc`; the Claude-shaped three use `mcpServers`, are strict JSON, and have no flag —
+ * present IS enabled. `uninstall` reads through `mcpLoad` too.
  *
  * A JsonNumber IS AN OBJECT TO `typeof`, which is why `isDict` (js/lib/json.mjs) excludes
  * the wrapper rather than testing `typeof v === 'object'`. Python's `isinstance(x, dict)` is
@@ -31,7 +24,7 @@ import { installState, installTargets } from './installs.mjs';
 import { printOut, printErr } from '../lib/fs.mjs';
 import { isDict } from '../lib/json.mjs';
 import { padEndToWidth } from '../lib/text.mjs';
-import { atomicWriteJson, loadJsonObject, opencodeTarget } from './settings.mjs';
+import { loadJsonObject, opencodeTarget } from './settings.mjs';
 
 
 /** `dict.get(key, default)`. */
@@ -40,52 +33,6 @@ const dget = (obj, key, dflt) => (isDict(obj) && Object.hasOwn(obj, key) ? obj[k
 /** The hosts whose MCP config is strict JSON under `mcpServers`, with no `enabled` flag. */
 const FLAGLESS = CLAUDE_STYLE;
 
-/**
- * `_harness_mcp._MCP_PRESETS` — the ready-to-wire servers the MCP screen can toggle.
- *
- * The `desc` strings go on the wire verbatim (`api_mcp` returns them), so they are the one
- * place in this file where a byte matters more than the shape. Insertion order is the
- * listing order.
- */
-export const MCP_PRESETS = {
-  markitdown: {
-    label: 'MarkItDown',
-    desc: 'PDF / Office / HTML -> Markdown for the ingest skill. Runs via `uvx` '
-      + '(needs uv; zero-install, fetches on first call). No uv? Switch the command '
-      + 'to ["markitdown-mcp"] after `pipx install markitdown-mcp`. Exposes one '
-      + 'tool: convert_to_markdown(uri).',
-    block: { type: 'local', command: ['uvx', 'markitdown-mcp'], enabled: true },
-  },
-  gitlab: {
-    label: 'GitLab',
-    desc: 'GitLab repo / MR / issue / CI tools via @zereight/mcp-gitlab (npx, no '
-      + 'install). Edit GITLAB_PERSONAL_ACCESS_TOKEN (scopes: api, read_repository) '
-      + 'and GITLAB_API_URL before use. For a second instance (a self-hosted server), '
-      + 'copy this block by hand under a new name and point it at the other URL — '
-      + 'docs/guides/mcp-gitlab.md has the pattern.',
-    block: {
-      type: 'local',
-      command: ['npx', '-y', '@zereight/mcp-gitlab'],
-      environment: { GITLAB_PERSONAL_ACCESS_TOKEN: '',
-        GITLAB_API_URL: 'https://gitlab.com/api/v4' },
-      enabled: true,
-    },
-  },
-  filesystem: {
-    label: 'Filesystem',
-    desc: 'Read/write files under explicitly allowed directories via '
-      + '@modelcontextprotocol/server-filesystem (npx, no install). Replace the '
-      + 'trailing path arg(s) with only the dir(s) the agent may touch '
-      + '(least-privilege).',
-    block: {
-      type: 'local',
-      command: ['npx', '-y', '@modelcontextprotocol/server-filesystem',
-        '/path/to/allowed/dir'],
-      enabled: true,
-    },
-  },
-};
-
 /** `_mcp_servers_key` — OpenCode nests servers under `mcp`, the other three `mcpServers`. */
 const serversKey = (host) => (FLAGLESS.includes(host) ? 'mcpServers' : 'mcp');
 
@@ -95,50 +42,11 @@ const serversOf = (config, host) => {
   return isDict(s) ? s : {};
 };
 
-/**
- * `_mcp_preset_block` — the block to WRITE for a preset, shaped for `host`.
- *
- * OpenCode takes it verbatim. The flagless three split the command list into `command`
- * (head) + `args` (tail) and rename `environment` to `env`.
- */
-export function mcpPresetBlock(name, host = 'opencode') {
-  const block = { ...MCP_PRESETS[name].block };
-  if (!FLAGLESS.includes(host)) return block;
-  const cmd = [...(block.command || [])];
-  const out = { command: cmd.length ? cmd[0] : '', args: cmd.slice(1) };
-  const env = block.environment;
-  if (env) out.env = { ...env };
-  return out;
-}
-
-/**
- * `_mcp_apply` — a COPY of `config` with server `name` set to `block`, or removed when
- * `block` is null. Never touches another key; drops an emptied servers map.
- *
- * The key ORDER is behaviour, not cosmetics: `setdefault` appends `$schema` at the end of a
- * fresh dict and leaves an existing one where it is, and `_mcp_save` writes the result out
- * as the file the user then reads. `{...config}` plus a guarded assignment is the same rule.
- */
-export function mcpApply(config, name, block, host = 'opencode') {
-  const cfg = { ...config };
-  const key = serversKey(host);
-  if (host === 'opencode' && !Object.hasOwn(cfg, '$schema')) {
-    cfg.$schema = 'https://opencode.ai/config.json';
-  }
-  const servers = { ...serversOf(cfg, host) };
-  if (block === null) delete servers[name];
-  else servers[name] = block;
-  if (Object.keys(servers).length) cfg[key] = servers;
-  else delete cfg[key];
-  return cfg;
-}
-
 /**
  * `_mcp_state` — 'enabled' | 'disabled' | 'absent'.
  *
  * OpenCode: a present server with no explicit `enabled` counts as enabled (its default).
- * The flagless three have no such key, so present IS enabled and 'disabled' never occurs —
- * toggling one off removes its entry instead.
+ * The flagless three have no such key, so present IS enabled and 'disabled' never occurs.
  */
 export function mcpState(config, name, host = 'opencode') {
   const server = serversOf(config, host)[name];
@@ -147,25 +55,13 @@ export function mcpState(config, name, host = 'opencode') {
   return dget(server, 'enabled', true) ? 'enabled' : 'disabled';
 }
 
-/** `_mcp_set_enabled` — flip a present server's enabled-ness. No-op when it is absent. */
-export function mcpSetEnabled(config, name, enabled, host = 'opencode') {
-  const server = serversOf(config, host)[name];
-  if (!isDict(server)) return config;
-  if (FLAGLESS.includes(host)) {
-    return enabled ? config : mcpApply(config, name, null, host);
-  }
-  return mcpApply(config, name, { ...server, enabled }, host);
-}
-
 /**
  * `_mcp_load` — a config as a dict; `{}` when missing, unreadable, unparseable or not an
  * object.
  *
  * The host fork is the whole function. OpenCode is read comment-tolerantly because a
  * hand-maintained `opencode.jsonc` carries `//`; the other three are read STRICTLY, because
- * their configs are plain JSON by contract, and a file that does not parse as such — for a
- * Claude global install, one that holds projects and history — is not one to rewrite from a
- * best-effort reading. (The comment stripper's trailing-comma pass IS string-aware; an older
+ * their configs are plain JSON by contract. (The comment stripper's trailing-comma pass IS string-aware; an older
  * version of this note said otherwise, and `generate.test.mjs` pins the string-aware case.)
  */
 export function mcpLoad(p, host = 'opencode') {
@@ -179,11 +75,6 @@ export function mcpCommented(p) {
   return loadJsonObject(p).hadComments;
 }
 
-/** `_mcp_save` — pretty JSON, written ATOMICALLY. The one writer, under its MCP name. */
-export function mcpSave(p, config) {
-  atomicWriteJson(p, config);
-}
-
 /**
  * `_mcp_config_for` — the file an install writes its MCP servers into, or null for a host
  * that carries no MCP wiring at that scope.
@@ -222,19 +113,9 @@ export function mcpInstallTargets() {
   return out;
 }
 
-/** `_mcp_known_names` — the presets first, then any server already in THIS config. */
-export function mcpKnownNames(config, host = 'opencode') {
-  const names = Object.keys(MCP_PRESETS);
-  const present = isDict(config) ? Object.keys(serversOf(config, host)) : [];
-  return names.concat(present.filter((n) => !Object.hasOwn(MCP_PRESETS, n)));
-}
-
-/** `_mcp_meta` — (label, description); the bare name and a generic note for an unknown one. */
-export function mcpMeta(name) {
-  const p = MCP_PRESETS[name];
-  if (p) return [p.label, p.desc];
-  return [name, 'User-defined MCP server (not a Harness preset). It lives in this '
-    + "config already — 'e' enables/disables it, Enter removes it."];
+/** The servers THIS config already has, in file order. Nothing it could have. */
+export function mcpServerNames(config, host = 'opencode') {
+  return isDict(config) ? Object.keys(serversOf(config, host)) : [];
 }
 
 export { isDict };
@@ -242,22 +123,11 @@ export { isDict };
 // ---- the verb ----------------------------------------------------------------------------
 
 /**
- * `geneseed mcp` — the CLI FACE this library never had.
- *
- * Everything above crossed with the web console rather than with a subcommand: the reference
- * kept it as a preset/state library whose only command was the uninstall path, and the one
- * way to see which servers an install had wired was to start a server and look. That is the
- * gap this verb closes, and it closes it by CALLING the library — the same `mcpInstallTargets`
- * / `mcpLoad` / `mcpKnownNames` / `mcpState` / `mcpMeta` sequence the console's read endpoint
- * runs, rendered as text instead of as JSON.
+ * `geneseed mcp` — the servers each active install has wired, and the file they live in.
  *
- * ponytail: READ-ONLY, on purpose, and this is the ceiling. Wiring a server from here needs
- * the console's toggle orchestration, whose load-bearing part is not the toggle at all — it
- * is the refusal to rewrite a config it could not parse strictly, because for a global
- * Claude install that file holds projects and history and a rewrite from an empty object
- * would erase them. A second copy of that guard is a second place for it to be wrong. When a
- * terminal toggle is wanted, move the console's non-HTTP core down into this module and have
- * both faces call it; do not grow a parallel one here.
+ * The same `mcpInstallTargets` / `mcpLoad` / `mcpServerNames` / `mcpState` sequence the
+ * console's read endpoint runs, rendered as text instead of as JSON. Read-only like the
+ * console: there is nothing here to add or toggle a server with.
  */
 export function cmdMcp() {
   const targets = mcpInstallTargets()
@@ -272,9 +142,10 @@ export function cmdMcp() {
     if (mcpCommented(p)) {
       printOut('  this config carries comments — edit it by hand so they survive.\n');
     }
-    for (const name of mcpKnownNames(cfg, host)) {
-      const [lbl] = mcpMeta(name);
-      printOut(`  ${padEndToWidth(mcpState(cfg, name, host), 8)}  ${padEndToWidth(name, 12)}  ${lbl}\n`);
+    const names = mcpServerNames(cfg, host);
+    if (!names.length) printOut('  no MCP server configured\n');
+    for (const name of names) {
+      printOut(`  ${padEndToWidth(mcpState(cfg, name, host), 8)}  ${name}\n`);
     }
   }
   return 0;

package/js/hosts/native.mjs

@@ -150,7 +150,7 @@ function triggerOf(text) {
  * failure, so the cure is a shorter first trigger sentence in the source, never a wider cap.
  */
 const DESCRIPTION_CAP = 320;
-function skillDescription(text) {
+export function skillDescription(text) {
   return withWhen(firstBlockquote(text), triggerOf(text));
 }
 
@@ -245,7 +245,7 @@ function isReadonly(text) {
  * themselves, and the ones gated on an environment the model cannot see (a herdr pane).
  */
 const USER_INVOKED_RE = /<!--\s*invocation:\s*user\s*-->/;
-function isUserInvokedOnly(text) {
+export function isUserInvokedOnly(text) {
   return USER_INVOKED_RE.test(text);
 }
 
@@ -359,7 +359,11 @@ function claudeAgentFrontmatter(stem, text, overrides) {
   if (isReadonly(text)) {
     const list = ['Write', 'Edit', 'NotebookEdit'];
     if (!text.includes(WEBFETCH_MARKER)) list.push('WebFetch');
-    if (!text.includes(BASH_MARKER)) list.push('Bash');
+    // Bash AND PowerShell: docs `tools-reference.md` says denying Bash turns PowerShell off
+    // only for settings rules and `--disallowedTools` — agent frontmatter is not named there,
+    // so a "read-only" agent on Windows could still run shell commands via PowerShell
+    // (Claude verdict R1). The one opt-in marker lifts both together.
+    if (!text.includes(BASH_MARKER)) list.push('Bash', 'PowerShell');
     fm.push(`disallowedTools: ${list.join(', ')}`);
   }
   return fm;
@@ -505,8 +509,10 @@ export function claimer(oldOwned, cfg, manifestExisted = true) {
  * `opts.claim` — a `claimer` closure the caller shares with its other writers; built from
  * `oldOwned`/`cfg`/`manifestExisted` when absent.
  *
- * Returns `{ nAgents, nSkills, written }` — Python's 3-tuple, with `written` as absolute
- * paths in write order.
+ * Returns `{ nAgents, nSkills, written, userOnlySkills }` — Python's 3-tuple, with `written` as
+ * absolute paths in write order, plus `userOnlySkills` (the claimed stems carrying the
+ * user-only marker; Task 4/O-1's input to OpenCode's `permission.skill` wiring — see the
+ * comment above the skill-frontmatter branch).
  *
  * That order is NOT observable, and this comment used to claim it was ("it lands in
  * `owned`, which the prune diffs against"). Measured when a mutation reversing it stayed
@@ -519,6 +525,15 @@ export function claimer(oldOwned, cfg, manifestExisted = true) {
 export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null, {
   host = 'opencode', oldOwned = null, cfg = null, manifestExisted = true,
   theme = null, src = undefined, skillDirOf = null, claim = claimer(oldOwned, cfg, manifestExisted),
+  // Bob (host-compat R1): its skills page documents only `name`/`description` — no
+  // `disable-model-invocation` — and giving it the Claude-dialect alias SKILL.md (the
+  // `host === 'claude'` branch below) would be an unverified key PLUS a visible duplicate
+  // in the model's catalogue (exactly the OpenCode problem this file already dodges for
+  // aliases). `bobDialect` suppresses both for Bob only, while `host: 'claude'` keeps every
+  // OTHER Claude-dialect choice (agent frontmatter, `warnClaudeIgnored`) — Bob still renders
+  // those verbatim. The caller (`emit-claude.mjs`) routes the suppressed names through
+  // `writeAliasCommands(..., alsoUserOnly: true)` into `.bob/commands/*.md` instead (O2).
+  bobDialect = false,
 } = {}) {
   const ov = overrides || {};
   if (host === 'claude') warnClaudeIgnored(ov);
@@ -527,6 +542,7 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
   const written = [];
   const sideFiles = [];            // [stem, dest, text], written after the loop
   const claimedSkills = new Set(); // stems whose own SKILL.md claim held
+  const userOnlySkills = [];       // claimed stems carrying the user-only marker
 
   const write = (dest, text) => {
     mkdirSync(path.dirname(dest), { recursive: true });
@@ -590,6 +606,7 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
     let fm;
     let dest;
     let kind;
+    let userOnly = false;
     if (folder === 'agents') {
       fm = host === 'claude' ? claudeAgentFrontmatter(stem, text, ov)
         : opencodeAgentFrontmatter(stem, text, ov, theme);
@@ -597,26 +614,45 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
       kind = 'agent';
     } else {
       // Skills are BYTE-IDENTICAL across hosts: name + description, body link-stripped.
-      // The user-only key is emitted for every host too — Claude Code and Bob honour it,
-      // OpenCode ignores an unknown key — so the identity holds. ALIASES are the one
-      // exception: OpenCode has no user-only skill, so an alias skill there would land in the
+      // The user-only key is emitted for Claude Code, which honours it natively
+      // (`disable-model-invocation`). OpenCode has no frontmatter equivalent, so the
+      // SAME marker also drives `userOnlySkills` below, which the OpenCode emit turns into a
+      // `permission.skill: {name: "deny"}` row in `opencode.json` (opencode-verdict.md O-1) —
+      // the model loses the skill from its catalogue, `/name` still runs it (O-1's second
+      // finding: the command path reads the UNFILTERED skill list, never the permission one).
+      // Bob's skills page documents no such key (host-compat R1) — see `bobDialect` above,
+      // which skips the SKILL.md for a user-only skill on Bob entirely.
+      // ALIASES are the one case every non-Claude dialect shares: no alias skill via
+      // frontmatter exists for them either, so an alias skill there would land in the
       // model's catalogue as a duplicate; it gets a command instead (`writeAliasCommands`).
       fm = [`name: ${stem}`, `description: ${jsonDumps(skillDescription(text))}`];
-      if (isUserInvokedOnly(text)) fm.push('disable-model-invocation: true');
+      userOnly = isUserInvokedOnly(text);
+      if (userOnly && !bobDialect) fm.push('disable-model-invocation: true');
       body = stripSkillBodyLinks(pointSideFiles(body, stem, skillDirOf ? skillDirOf(stem)
         : SKILL_DIR_PLACEHOLDER));
       dest = path.join(skillsDir, stem, 'SKILL.md');
       kind = 'skill';
     }
+    // Bob, user-only: no SKILL.md at all — the command written by the caller is the only
+    // copy, so the model's `use_skill` catalogue never carries it (see `bobDialect` above).
+    // The `continue` is BEFORE `claimedSkills.add(stem)` below, so a user-only skill's own
+    // side files (none exist today, but the layout allows them) are skipped too — there is
+    // no `skills/<stem>/` folder on Bob for one to sit beside.
+    if (kind === 'skill' && userOnly && bobDialect) continue;
     if (!claim(dest)) continue;
     write(dest, `---\n${fm.join('\n')}\n---\n\n${body}`);
-    if (kind === 'skill') claimedSkills.add(stem);
+    if (kind === 'skill') {
+      claimedSkills.add(stem);
+      // Only a CLAIMED user-only skill is Geneseed's to deny: a pre-existing file the claim
+      // declined belongs to the user, and `userOnly` was computed from OUR text, not theirs.
+      if (userOnly) userOnlySkills.push(stem);
+    }
     // An old name keeps answering `/name`: user-only, so the model's catalogue lists the
     // skill once. Read off the already-filtered items, so excluding the target drops its
     // aliases; through `claim`, so manifest, prune and uninstall own them; not counted.
     // Only once the target's own claim held: a user's file at the target gets no alias
     // pointing at a skill this install never wrote.
-    if (kind === 'skill' && host === 'claude') {
+    if (kind === 'skill' && host === 'claude' && !bobDialect) {
       // The host announces the ALIAS's folder as the base directory, so a side-file pointer
       // climbs back to the target's.
       const aliasBody = skillDirOf ? body : stripSkillBodyLinks(
@@ -634,7 +670,7 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
   for (const [stem, dest, text] of sideFiles) {
     if (claimedSkills.has(stem) && claim(dest)) write(dest, stripSkillBodyLinks(text));
   }
-  return { nAgents, nSkills, written };
+  return { nAgents, nSkills, written, userOnlySkills };
 }
 
 /**

package/js/hosts/opencode.mjs

@@ -28,7 +28,10 @@ import { jsonDumps, jsonDumpsIndent, parseJson } from '../lib/json.mjs';
 import { comparePaths } from '../lib/paths.mjs';
 import { sourceReleaseVersion } from '../build/version.mjs';
 import { aliasesOf } from '../build/source.mjs';
-import { firstBlockquote, stripSkillBodyLinks, pointSideFiles, pushOverrideLines } from './native.mjs';
+import {
+  firstBlockquote, isUserInvokedOnly, skillDescription, stripSkillBodyLinks, pointSideFiles,
+  pushOverrideLines,
+} from './native.mjs';
 
 // Re-exported for `js/web/api.mjs` and the tests, which import it from here.
 export { sourceReleaseVersion };
@@ -111,7 +114,7 @@ export const COMMAND_SET = {
 };
 
 /** Mirrors `_build_emit.PONYTAIL_COMMAND_BODY`. */
-const PONYTAIL_COMMAND_BODY =
+export const PONYTAIL_COMMAND_BODY =
   'Ponytail level requested: $ARGUMENTS\n\n'
   + 'The geneseed-ponytail plugin records this level and, from your next turn, appends '
   + 'the matching "laziest solution that works" ruleset to your system prompt — honour '
@@ -169,10 +172,19 @@ export function themeJson(theme) {
   return { $schema: 'https://opencode.ai/theme.json', theme: t };
 }
 
-/** `_build_emit._write_theme` — `<themes_dir>/geneseed-<theme>.json`. */
-export function writeTheme(themesDir, themeName, theme) {
-  mkdirSync(themesDir, { recursive: true });
+/**
+ * `_build_emit._write_theme` — `<themes_dir>/geneseed-<theme>.json`.
+ *
+ * `claim` — the same `claimer` closure the native layer and command writers share (see
+ * `writePrimaryAgent`'s docblock). Without it a user's own same-named theme file was
+ * overwritten and recorded in `owned`, so uninstall deleted it next. Default: claim
+ * everything, for a caller with no manifest to consult. Returns `null`, not the dest,
+ * when the claim is refused — so the caller does not push a non-write into `owned`.
+ */
+export function writeTheme(themesDir, themeName, theme, claim = (_dest) => true) {
   const dest = path.join(themesDir, `geneseed-${themeName}.json`);
+  if (!claim(dest)) return null;
+  mkdirSync(themesDir, { recursive: true });
   writeText(dest, `${jsonDumpsIndent(themeJson(theme))}\n`);
   return dest;
 }
@@ -215,8 +227,8 @@ export function colorThemeFiles(cfg) {
     .sort(comparePaths);
 }
 
-/** `_build_emit._write_color_themes` — each curated palette in both flavours. */
-export function writeColorThemes(cfg, themesDir) {
+/** `_build_emit._write_color_themes` — each curated palette in both flavours. `claim` — see `writeTheme`. */
+export function writeColorThemes(cfg, themesDir, claim = (_dest) => true) {
   mkdirSync(themesDir, { recursive: true });
   const written = [];
   for (const src of colorThemeFiles(cfg)) {
@@ -224,6 +236,7 @@ export function writeColorThemes(cfg, themesDir) {
     const palette = spec.palette;
     for (const [flavour, transparent] of [['solid', false], ['transparent', true]]) {
       const dest = path.join(themesDir, `geneseed-${spec.name}-${flavour}.json`);
+      if (!claim(dest)) continue;
       writeText(dest, `${jsonDumpsIndent(colorThemeJson(palette, transparent))}\n`);
       written.push(dest);
     }
@@ -336,9 +349,17 @@ export function writeCommandLayer(cfg, items, commandDir, claim = (_dest) => tru
  * second copy of its target. UNCONDITIONAL, unlike the `GENESEED_COMMANDS` set — an old name
  * that only works behind an opt-in is a name that broke. Read off the already-filtered
  * `items`, so excluding the target drops its aliases.
+ *
+ * `alsoUserOnly` (Bob host-compat O2/R1): Bob's skills page documents no model-invocation
+ * key either, so a genuinely user-only skill (not just an alias) needs the same treatment —
+ * `writeNativeLayer({ bobDialect: true })` already skipped its SKILL.md, and this is the one
+ * place left to give `/<stem>` a home. Default `false`: OpenCode's own call site leaves this
+ * off, because a real user-only skill there is handled by `permission.skill` deny instead
+ * (Task 4) — it keeps its SKILL.md and does not need a second, command-shaped copy.
  */
 export function writeAliasCommands(cfg, items, commandDir, claim = (_dest) => true,
-  skillDirOf = (n) => path.join(path.dirname(commandDir), 'skills', n).split(path.sep).join('/')) {
+  skillDirOf = (n) => path.join(path.dirname(commandDir), 'skills', n).split(path.sep).join('/'),
+  alsoUserOnly = false) {
   const written = [];
   for (const { text, src } of items) {
     if (text === null) continue;
@@ -346,11 +367,13 @@ export function writeAliasCommands(cfg, items, commandDir, claim = (_dest) => tr
     if (sp.length !== 2 || sp[0] !== 'skills' || !sp[1].endsWith('.md') || sp[1].startsWith('_')) continue;
     const stem = sp[1].slice(0, -3);
     const body = stripSkillBodyLinks(pointSideFiles(text.replace(/^\n+/, ''), stem, skillDirOf(stem)));
-    for (const alias of aliasesOf(text)) {
-      const dest = path.join(commandDir, `${alias}.md`);
+    const names = alsoUserOnly && isUserInvokedOnly(text) ? [...aliasesOf(text), stem] : aliasesOf(text);
+    for (const name of names) {
+      const dest = path.join(commandDir, `${name}.md`);
       if (!claim(dest)) continue;
       mkdirSync(path.dirname(dest), { recursive: true });
-      writeText(dest, `---\ndescription: ${jsonDumps(`Alias of ${sp[1].slice(0, -3)}.`)}\n---\n\n${body}`);
+      const desc = name === stem ? skillDescription(text) : `Alias of ${stem}.`;
+      writeText(dest, `---\ndescription: ${jsonDumps(desc)}\n---\n\n${body}`);
       written.push(dest);
     }
   }
@@ -367,8 +390,13 @@ export function writePonytailCommand(commandDir, claim = (_dest) => true) {
   return dest;
 }
 
-/** `_copy_plugins` / `_copy_workflows` — maintained files, copied verbatim (copy2, so LF). */
-function copyJsDir(srcDir, dst, owned, prefix) {
+/**
+ * `_copy_plugins` / `_copy_workflows` — maintained files, copied verbatim (copy2, so LF).
+ *
+ * `claim` — see `writeTheme`. A file the claim refuses is skipped: not copied, not counted,
+ * not pushed into `owned`, exactly as a declined native-layer write is.
+ */
+function copyJsDir(srcDir, dst, owned, prefix, claim = (_dest) => true) {
   let n = 0;
   if (existsSync(srcDir) && statSync(srcDir).isDirectory()) {
     mkdirSync(dst, { recursive: true });
@@ -377,7 +405,9 @@ function copyJsDir(srcDir, dst, owned, prefix) {
       .map((name) => path.join(srcDir, name))
       .sort(comparePaths);
     for (const js of files) {
-      copyFile(js, path.join(dst, path.basename(js)));
+      const dest = path.join(dst, path.basename(js));
+      if (!claim(dest)) continue;
+      copyFile(js, dest);
       if (owned !== null && owned !== undefined) owned.push(`${prefix}/${path.basename(js)}`);
       n += 1;
     }
@@ -386,11 +416,11 @@ function copyJsDir(srcDir, dst, owned, prefix) {
 }
 
 /** `_build_emit._copy_plugins`. */
-export function copyPlugins(cfg, dst, owned = null) {
-  return copyJsDir(cfg.pluginSrc, dst, owned, 'plugins');
+export function copyPlugins(cfg, dst, owned = null, claim = (_dest) => true) {
+  return copyJsDir(cfg.pluginSrc, dst, owned, 'plugins', claim);
 }
 
 /** `_build_emit._copy_workflows`. */
-export function copyWorkflows(cfg, dst, owned = null) {
-  return copyJsDir(cfg.workflowSrc, dst, owned, 'workflows');
+export function copyWorkflows(cfg, dst, owned = null, claim = (_dest) => true) {
+  return copyJsDir(cfg.workflowSrc, dst, owned, 'workflows', claim);
 }