geneseed 3.3.0 → 3.5.0

package/js/maintain/uninstall.mjs

@@ -47,7 +47,7 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 
-import { hookRunnerEntry } from '../../bin/build-driver.mjs';
+import { hookRunnerEntry } from '../build/driver.mjs';
 import { confirm } from './setup.mjs';
 import {
   claudeCfg, claudeReadManifest, doctrinesOfDir, emitHostScopeOf, excludedRulesOfDir, installKind,
@@ -60,7 +60,7 @@ import {
 import { mcpCommented } from '../hosts/mcp.mjs';
 import {
   copilotIntegrityCheck, managedBlockRead, managedBlockRemove, managedBlockWrite,
-  mergeClaudeSettings, mergeCopilotSettings, opencodeTarget, readJsonc,
+  mergeClaudeSettings, opencodeTarget, readJsonc,
   settingsIntegrityCheck, wireClaudeExcludes, unwireClaudeExcludes, unwireClaudeSettings,
   unwireCopilotSettings,
 } from '../hosts/settings.mjs';
@@ -347,9 +347,8 @@ export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
 /**
  * `_harness_mcp._mcp_load`, reduced to the OpenCode arm.
  *
- * The Claude arm (`.mcp.json`, `~/.claude.json`, parsed with STRICT `json.loads` because the
- * comment stripper's trailing-comma pass is not string-aware) belongs to the MCP catalog and
- * the TUI, and neither has crossed. `installAgentEntry` is this port's only caller and passes
+ * The Claude arm (`.mcp.json`, `~/.claude.json`, parsed STRICTLY — see `mcpLoad` in
+ * js/hosts/mcp.mjs for why) lives with the MCP catalog. `installAgentEntry` is this port's only caller and passes
  * no host, so porting the branch would ship an unreachable arm with no cell and no partition
  * to be part of — the criterion this port decides keep-vs-delete by.
  */
@@ -645,7 +644,7 @@ function printSurvivingProjectInventory(removedRoot) {
 function printOtherHostHits(root, removedHost) {
   for (const spec of HOSTS) {
     if (spec.host !== removedHost && projectQualifies(root, spec.host)) {
-      printOut(`[uninstall] also found ${spec.host}:project here — run \`harness `
+      printOut(`[uninstall] also found ${spec.host}:project here — run \`geneseed `
         + 'uninstall` again to remove it.\n');
     }
   }
@@ -1058,15 +1057,18 @@ function cleanHostStash(cfg, host = 'claude') {
 function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
   const data = claudeReadManifest(cfg);
   const managed = managedOf(data);
-  // A Copilot install: its own merge, its own claim key, and none of the pack/exclude axes
-  // below — the Copilot gate is not pack-conditional (see `copilotHooks`). Without this
-  // branch a Copilot reactivate would write CLAUDE-shaped hook groups into
-  // ~/.copilot/settings.json, which Copilot cannot read.
+  // A LEGACY Copilot install (single-slot `copilot_hooks`, the dead `toolCall` event):
+  // reactivating it re-wires the CURRENT Copilot shape — event → array, recorded under
+  // `settings_hooks` — rather than restoring hooks Copilot no longer reads. None of the
+  // pack/exclude axes below apply: the Copilot gate is not pack-conditional.
   if (Array.isArray(managed.copilot_hooks)) {
-    const [, claims] = mergeCopilotSettings(settingsFile(cfg, managed), managed.copilot_hooks,
-      hookRunnerEntry());
-    if (!deepEquals(claims, managed.copilot_hooks) && Object.keys(data).length > 0) {
-      managed.copilot_hooks = claims;
+    const sf = settingsFile(cfg, managed);
+    unwireCopilotSettings(sf, managed.copilot_hooks);
+    const [, claims] = mergeClaudeSettings(sf, 'global', null, hookRunnerEntry(), null, [],
+      'copilot', cfg);
+    if (Object.keys(data).length > 0) {
+      delete managed.copilot_hooks;
+      managed.settings_hooks = claims;
       data.managed = managed;
       const tmp = path.join(cfg, `${GLOBAL_MANIFEST}.tmp`);
       try {
@@ -1098,7 +1100,7 @@ function remergeClaudeHooks(cfg, root = cfg, host = 'claude') {
     : excludedRulesOfDir(cfg);
   // `host` reaches the group builder: a Bob reactivate must re-wire Gemini-named groups.
   const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed), 'global',
-    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host);
+    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines, excluded, host, cfg);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!deepEquals(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;

package/js/ui/cli.mjs

@@ -441,6 +441,25 @@ export function cliCommand(verb) {
  * CRLF ON WINDOWS for `die`'s reason: argparse writes through a Python text stream, which
  * translates, and this text lands in the same terminals and the same pipes as that one.
  */
+/**
+ * `geneseed --help` — every verb with its one-line help, from the same table the per-verb help
+ * reads. `verbs` is the entry's own dispatch list, so the listing can name nothing the entry
+ * would refuse; a verb the table does not describe still appears, with no help line.
+ */
+export function printVerbList(prog, verbs, extra = {}) {
+  const helpOf = new Map([...Object.entries(extra),
+    ...cliReference().commands.filter((c) => c.help).map((c) => [c.name, c.help])]);
+  const names = [...verbs].sort();
+  const pad = Math.max(...names.map((n) => n.length)) + 2;
+  const lines = [`usage: ${prog} <command> [options]`, '',
+    `A bare \`${prog}\` runs \`home\`. \`${prog} <command> --help\` describes one command.`, '',
+    'commands:'];
+  for (const n of names) lines.push(`  ${n.padEnd(pad)}${helpOf.get(n) || ''}`.trimEnd());
+  const text = `${lines.join('\n')}\n`;
+  process.stdout.write(process.platform === 'win32' ? text.replaceAll('\n', '\r\n') : text);
+  return 0;
+}
+
 export function printHelp(prog, verb) {
   const cmd = cliCommand(verb);
   if (cmd === null) return null;

package/js/ui/menu.mjs

@@ -45,7 +45,7 @@ import { startDaemon } from '../web/daemon.mjs';
 function menuHelp() {
   printOut('Geneseed — no interactive menu here. Get started with:  geneseed setup\n');
   printOut('Other commands:  bootstrap · update · build · doctor · diff · tui · web\n');
-  printOut('On a VT-capable terminal, a bare `./geneseed` opens the interactive menu of these.\n');
+  printOut('`geneseed --help` lists every command.\n');
   return 0;
 }
 

package/js/web/actions.mjs

@@ -32,7 +32,7 @@ import {
 import os from 'node:os';
 import path from 'node:path';
 
-import { emitGlobalInto } from '../../bin/build-driver.mjs';
+import { emitGlobalInto } from '../build/driver.mjs';
 import {
   ROOT, discoverNames, knownRuleIds, PACK_ORDER,
 } from '../build/source.mjs';
@@ -127,7 +127,7 @@ function bodyExcludeRules(body) {
 const splitWords = (s) => s.split(new RegExp(`[${WHITESPACE}]+`)).filter(Boolean);
 
 /** Today's date, LOCAL (not UTC) — this is a user-facing date, not a wire timestamp. */
-export function todayIso(d = new Date()) {
+function todayIso(d = new Date()) {
   const p2 = (n) => String(n).padStart(2, '0');
   return `${d.getFullYear()}-${p2(d.getMonth() + 1)}-${p2(d.getDate())}`;
 }
@@ -278,13 +278,13 @@ const rulesPath = (state) => path.join(state.target, RULES_FILE);
  * `max(ids) + 1`. Widening this to match would only move the gap one line down, to whatever
  * parses the captured digits back into a number.
  */
-export const RULE_HEAD_RE = new RegExp(
+const RULE_HEAD_RE = new RegExp(
   `^##[${WHITESPACE}]+R(\\d+)[${WHITESPACE}]*[—–-]+[${WHITESPACE}]*`
   + `([^${WHITESPACE}].*?)[${WHITESPACE}]*$`,
 );
 
 /** Advisory only; nothing blocks past it. */
-export const RULES_BUDGET = { max_rules: 15, max_tokens: 1500 };
+const RULES_BUDGET = { max_rules: 15, max_tokens: 1500 };
 
 const META_RE = new RegExp(`^\\((.+)\\)[${WHITESPACE}]*$`);
 

package/js/web/activity.mjs

@@ -48,7 +48,7 @@ import { NotFound, stemOf } from './api.mjs';
  * platform where the probe cannot tell. Generous on purpose: streaming bumps `updated_at`
  * constantly, so only a genuinely abandoned (process-still-alive) session ages out.
  */
-export const ACTIVITY_STALE_SECONDS = 1800;
+const ACTIVITY_STALE_SECONDS = 1800;
 
 const nowSeconds = () => Date.now() / 1000;
 
@@ -66,7 +66,7 @@ const activityFlag = (state) => path.join(state.target, '.geneseed-activity');
  * default every user who has never toggled is in. An undecodable flag file is not treated
  * specially: Node substitutes U+FFFD and reads on rather than raising.
  */
-export function activityEnabled(state) {
+function activityEnabled(state) {
   let raw;
   try {
     raw = readText(activityFlag(state));
@@ -97,7 +97,7 @@ function toIntOr(raw) {
 }
 
 /** Best-effort liveness for the writer process. See this file's header. */
-export function pidAlive(raw) {
+function pidAlive(raw) {
   const pid = toIntOr(raw);
   if (pid === null || pid <= 0) return false;
   try {
@@ -161,7 +161,7 @@ function isLive(entry, now) {
  * missing dir is `[]`, a garbage file is skipped (and kept — only a snapshot that PARSED and
  * failed the liveness test is unlinked), newest first.
  */
-export function activityEntries(state) {
+function activityEntries(state) {
   const d = activityDir(state);
   if (!isDir(d)) return [];
   const now = nowSeconds();

package/js/web/api.mjs

@@ -201,7 +201,7 @@ export function specDesc(fm, body) {
  * plumbing rather than prose, which is what makes a deployed entry the same shape as a
  * source-rendered one and every consumer indifferent to the origin.
  */
-export function specEntries(root, nested) {
+function specEntries(root, nested) {
   const out = [];
   if (!isDir(root)) return out;
   let names;
@@ -238,7 +238,7 @@ export function specEntries(root, nested) {
  * the walk. So the catalogue is always whole, and which packs this INSTALL built in comes from
  * its own carrier via `doctrinesForBuild`, which resolves "no marker" to every pack.
  */
-export function deployedInventory(state) {
+function deployedInventory(state) {
   const render = tuiInventory(state.theme, doctrinesForBuild(state.target),
     excludedRulesOfDir(state.target));
   const registry = loadRegistry();
@@ -259,7 +259,7 @@ export function deployedInventory(state) {
 }
 
 /** The deployed record when there is one, else the source render. */
-export function inventoryFor(state) {
+function inventoryFor(state) {
   return deployed(state) ? deployedInventory(state) : tuiInventory(state.theme);
 }
 
@@ -305,7 +305,7 @@ export function memoryItems(state) {
   });
 }
 
-export function notebookItems(state) {
+function notebookItems(state) {
   const d = notebookDir(state);
   if (!isDir(d)) return [];
   return globMd(d).map((n) => ({
@@ -319,7 +319,7 @@ const CONFIG_META = {
   'wiki.jsonc': ['Wiki manifest', 'your machine-wide knowledge base(s)'],
 };
 
-export function configItems(state) {
+function configItems(state) {
   const out = [];
   for (const fname of ['context.json', 'wiki.jsonc']) {
     const p = path.join(state.target, fname);
@@ -331,7 +331,7 @@ export function configItems(state) {
   return out;
 }
 
-export const WIKI_FILE_CAP = 5000;
+const WIKI_FILE_CAP = 5000;
 
 /**
  * `resolvePath` for a path that came out of a HAND-MAINTAINED manifest — `null`, never a throw.
@@ -419,7 +419,10 @@ export function wikiItems(state) {
     // blank every OTHER vault in it.
     const root = wikiPath(String(dget(w, 'path', null) || ''));
     if (!root || !isDir(root)) continue;
-    const entries = (dget(w, 'entries', null) || [])
+    // A hand-edited `entries` that is not a list (`{}`, a string) is a malformed vault, not a
+    // crash: `/api/status` counts these, and one bad manifest must not fail the dashboard.
+    const rawEntries = dget(w, 'entries', null);
+    const entries = (Array.isArray(rawEntries) ? rawEntries : [])
       .filter((e) => e && typeof e === 'object' && !Array.isArray(e));
     const excludes = entries.filter((e) => dget(e, 'load', null) === 'exclude')
       .map((e) => String(dget(e, 'path', null) || '').replace(/^\/+|\/+$/g, '').replace(/\\/g, '/'));
@@ -450,7 +453,7 @@ export function wikiItems(state) {
 }
 
 /** One page by `<wiki>:<relpath>`, never outside the vault. */
-export function apiWikiItem(state, name) {
+function apiWikiItem(state, name) {
   const at = name.indexOf(':');
   const wname = at < 0 ? name : name.slice(0, at);
   const rel = (at < 0 ? '' : name.slice(at + 1))
@@ -497,7 +500,7 @@ function flatName(name) {
   }
 }
 
-export const WIKILINK_RE = /\[\[([^\]]+)\]\]/g;
+const WIKILINK_RE = /\[\[([^\]]+)\]\]/g;
 
 /**
  * `[[name]]` matched against known agent and skill names.
@@ -746,9 +749,9 @@ export function apiInstalls(state) {
 
 /** Beside the deployed AGENT.md. */
 export const PROFILE_FILE = 'PROFILE.md';
-export const profilePath = (state) => path.join(state.target, PROFILE_FILE);
+const profilePath = (state) => path.join(state.target, PROFILE_FILE);
 
-export function apiProfile(state) {
+function apiProfile(state) {
   const p = profilePath(state);
   if (!isFile(p)) return { exists: false, path: p, text: '', fingerprint: '' };
   const text = readMaybe(p) ?? '';

package/js/web/daemon.mjs

@@ -83,7 +83,7 @@ export async function probe(url, timeout = 1.5) {
 }
 
 /** The token-carrying POST `geneseed web stop` and the in-page Stop button both send. */
-export async function postShutdown(url, token, timeout = 3.0) {
+async function postShutdown(url, token, timeout = 3.0) {
   try {
     const res = await fetch(`${url}/api/shutdown`, {
       method: 'POST',

package/js/web/docs.mjs

@@ -24,7 +24,7 @@ import { readJsonMaybe, readMaybe } from '../hosts/installs.mjs';
 import { resolvePath } from '../hosts/hosts.mjs';
 import { parseJson } from '../lib/json.mjs';
 import { isFile } from '../lib/fs.mjs';
-import { normcase } from '../lib/paths.mjs';
+import { normcase, within } from '../lib/paths.mjs';
 import { WHITESPACE, stripWhitespace } from '../lib/text.mjs';
 import { statusData } from '../inspect/status.mjs';
 import { originDisplay } from '../maintain/update.mjs';
@@ -39,7 +39,7 @@ const DOC_DIR = path.join(ROOT, 'docs', 'web');
  * covers every key these pages use and parses with the standard library. A value that is
  * not valid JSON is kept as the raw string, which is how `title: Something` works.
  */
-export function docFrontmatter(text) {
+function docFrontmatter(text) {
   const marker = '---\n';
   if (!text.startsWith(marker)) return [{}, text];
   const rest = text.slice(marker.length);
@@ -109,8 +109,13 @@ export function docGroups() {
  */
 const GLOSSARY_KEYS = [
   // The three tiers, in constitutional order and before the entities — a reader who does not
-  // know what an Ontology is here cannot read the rest of the glossary's first rows.
-  ['Ontology', 'ONTOLOGY', 'the always-on worldview under the rules — telos, evidence, '
+  // know what an Ethos is here cannot read the rest of the glossary's first rows.
+  //
+  // `Ethos (Ontology)` for the same reason as `Rule (Law)` below: the neutral theme renamed
+  // what a reader SEES, while the address the reader will meet in `src/ontology/`, in the
+  // `ONTOLOGY` theme key and in every identifier did not move. The parenthesis is the bridge
+  // between the two, and the glossary is the one page that owes a reader that bridge.
+  ['Ethos (Ontology)', 'ONTOLOGY', 'the always-on worldview under the rules — telos, evidence, '
     + 'decisions, conduct; it holds the Pact'],
   ['Rule (Law)', 'LAW', 'one of the nine always-on invariants: what is never done'],
   ['Rules (Laws)', 'LAWS', 'the body of always-on invariants'],
@@ -126,8 +131,9 @@ const GLOSSARY_KEYS = [
   ['Wiki', 'WIKI', 'the machine-wide knowledge base'],
   // Still a token, still themed, but it names a CONCEPT INSIDE the ontology's Telos now
   // rather than a peer of the Rules — `src/postures/peer.md` cites it and the section that
-  // used to carry it is the Ontology.
-  ['Pact', 'PACT', "the two-way collaboration contract, stated in the Ontology's Telos"],
+  // used to carry it is the Ethos.
+  ['Pact', 'PACT', 'the two-way collaboration contract, stated in Telos, the first Ethos '
+    + 'section'],
   ['Posture', null, 'the relationship register the agent works in '
     + '(peer, mentor, expert, assistant, artisan)'],
   ['Mode', null, 'how work gets executed — direct (the agent works every '
@@ -357,12 +363,6 @@ function readDocSource(rel) {
   return readMaybe(target) ?? '';
 }
 
-function within(child, parent) {
-  const c = normcase(child).split(/[\\/]/);
-  const p = normcase(parent).split(/[\\/]/);
-  return p.length <= c.length && p.every((seg, i) => c[i] === seg);
-}
-
 /** The deployed theme's words beside the neutral ones. */
 function glossary(state) {
   const load = (theme) => {

package/js/web/handler.mjs

@@ -62,6 +62,13 @@ export function makeHandler(state, jm, token, dist, holder = null) {
   // syscall against the readFileSync + gzipSync it saves. `gz` is the gzipped body,
   // computed once on the first gzip-accepting request instead of per request.
   const staticCache = new Map();
+  // `dist` RESOLVED ONCE, because every path compared against it below is resolved too.
+  // `resolvePath` is `realpathSync.native`, so a checkout reached by any path that is not its
+  // canonical one — a symlink, a Windows junction, a `subst` or mapped drive, an 8.3 short name,
+  // a lowercase drive letter — made `fp.startsWith(dist + sep)` false for EVERY asset. Each one
+  // then fell back to index.html at `text/html`, the browser refused the module script, and the
+  // page stayed blank with nothing logged on either side.
+  const distReal = resolvePath(dist);
 
   function sendBytes(res, body, ctype, code = 200, extra = null, acceptEncoding = '', gzStore = null) {
     const headers = { ...(extra || {}) };
@@ -86,12 +93,12 @@ export function makeHandler(state, jm, token, dist, holder = null) {
 
   function serveStatic(res, path, acceptEncoding) {
     const rel = (path === '/' || path === '') ? 'index.html' : path.replace(/^\/+/, '');
-    const index = resolvePath(join(dist, 'index.html'));
-    let fp = resolvePath(join(dist, rel));
+    const index = join(distReal, 'index.html');
+    let fp = resolvePath(join(distReal, rel));
     // STRICTLY under `dist`: `fp === dist` itself must also take the fallback below, which
-    // is why this checks `fp !== dist` and not just the prefix.
-    if (!(fp.startsWith(dist + sep) && fp !== dist) && fp !== index) fp = join(dist, 'index.html');
-    if (!isFile(fp)) fp = join(dist, 'index.html');
+    // is why this checks `fp !== distReal` and not just the prefix.
+    if (!(fp.startsWith(distReal + sep) && fp !== distReal) && fp !== index) fp = index;
+    if (!isFile(fp)) fp = index;
     if (!isFile(fp)) {
       return sendJson(res, { error: 'web/dist missing — run the UI build' }, 500, acceptEncoding);
     }

package/js/web/jobs.mjs

@@ -98,7 +98,7 @@ import { jsonDumpsCompact, parseJson, isTruthy } from '../lib/json.mjs';
  * NEVER THROWS: it runs from `cancel()` and from the crash path in `_run`'s `catch`, and an
  * exception in either would leave the child alive with the manager believing it dead.
  */
-export function killJobTree(child) {
+function killJobTree(child) {
   try {
     if (process.platform === 'win32') {
       // The one machine primitive with no Node equivalent — see this module's header.

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",