geneseed 4.0.0 → 4.2.0

package/js/inspect/checks-repo.mjs

@@ -10,7 +10,7 @@ import path from 'node:path';
 import {
   ALIASES_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf, knownSkillIds,
 } from '../build/source.mjs';
-import { CLAUDE_STYLE, liveRecordedHooks } from '../hosts/hosts.mjs';
+import { CLAUDE_STYLE, HOSTS, liveRecordedHooks } from '../hosts/hosts.mjs';
 import { claudeCfg, installTargets } from '../hosts/installs.mjs';
 import { VENDORED_SKILL_DIRS } from '../hosts/native.mjs';
 import { COMMAND_SET } from '../hosts/opencode.mjs';
@@ -507,6 +507,81 @@ export function moduleMapProblems() {
   return problems;
 }
 
+/**
+ * Each host's label as the two hand-written tables below spell it, keyed by `HOSTS`' `host` id.
+ *
+ * Local to this arm rather than a column on `HOSTS` (`js/hosts/hosts.mjs`): `HOSTS` is the
+ * machine-facing table (config dirs, project markers, catalog flags), and a doc-table LABEL is
+ * a fact about two Markdown files, not about an install.
+ */
+const HOST_LABELS = { opencode: 'OpenCode', claude: 'Claude Code', bob: 'Bob', openclaude: 'OpenClaude' };
+
+/**
+ * The two hand-written, one-column-per-host tables, and the non-host columns each one carries
+ * (a header cell that is neither a `HOST_LABELS` value nor one of these is an unknown label
+ * that LOOKS like it was meant to be a host column).
+ */
+const HOST_MATRIX_FILES = [
+  { rel: 'docs/concepts/host-matrix.md', otherCols: new Set(['Capability']) },
+  { rel: 'docs/concepts/enforcement-table.md', otherCols: new Set(['id', 'Pack']) },
+];
+
+/** The first `| … |` table row of `text`, as trimmed, non-empty cells — its header. */
+function firstTableHeader(text) {
+  for (const line of text.split('\n')) {
+    const t = line.trim();
+    if (t.startsWith('|')) return t.split('|').map((c) => c.trim()).filter((c) => c.length > 0);
+  }
+  return null;
+}
+
+/**
+ * `js/README.md`'s sibling gate for the two hand-written host tables: each one's header row
+ * must name exactly the hosts `HOSTS` lists, by their `HOST_LABELS` spelling — no fewer (a new
+ * host shipped with no column) and no stray cell that merely LOOKS like a host label (a typo,
+ * or a host renamed in `HOST_LABELS` but not in the doc).
+ *
+ * A host with no `HOST_LABELS` entry is its own problem, independent of either file: nothing
+ * in a table header can be compared against a label that does not exist.
+ *
+ * `root` is a parameter (default: `ROOT`) so a test can point this at a temp copy with one
+ * column removed, rather than mutating the real docs tree.
+ */
+export function hostMatrixProblems(root = ROOT) {
+  const problems = [];
+  const expected = new Set();
+  for (const h of HOSTS) {
+    const label = HOST_LABELS[h.host];
+    if (!label) { problems.push(`[authoring] host ${h.host} has no HOST_LABELS entry`); continue; }
+    expected.add(label);
+  }
+  for (const { rel, otherCols } of HOST_MATRIX_FILES) {
+    let text;
+    try {
+      text = readText(path.join(root, ...rel.split('/')));
+    } catch (e) {
+      problems.push(`[authoring] ${rel} is unreadable: ${e.message}`);
+      continue;
+    }
+    const header = firstTableHeader(text);
+    if (!header) {
+      problems.push(`[authoring] ${rel} has no table header row`);
+      continue;
+    }
+    const present = new Set(header);
+    for (const label of [...expected].sort()) {
+      if (!present.has(label)) problems.push(`[authoring] ${rel} has no column for ${label}`);
+    }
+    for (const cell of header) {
+      if (!expected.has(cell) && !otherCols.has(cell)) {
+        problems.push(`[authoring] ${rel} column '${cell}' is not a host HOST_LABELS names or `
+          + 'a known non-host column — a stale or misspelled label');
+      }
+    }
+  }
+  return problems;
+}
+
 /**
  * The AI Harness Scorecard checks this repo passes, written out — the ratchet's floor.
  *

package/js/inspect/cost.mjs

@@ -0,0 +1,83 @@
+/**
+ * WHAT ONE INSTALL COSTS EVERY SESSION, read off the files it emitted — the Overview's
+ * always-on figure. Characters, not tokens: the console shows ≈ chars ÷ 4 and says it is an
+ * estimate, because a tokenizer would be a vendored dependency for a number that only has to
+ * be honest about its size.
+ *
+ * Four parts, each the thing the host loads before the user types:
+ * - `carrier`  the root instruction file (`AGENT.md`, `CLAUDE.md`, Bob's `rules/geneseed.md` or
+ *              `AGENTS.md`), CRLF decoded exactly as the smoke test decodes it, so the figure
+ *              and `CARRIER_CEILING` are the same measurement.
+ * - `skills`   the name + description every native skill lists (aliases included: they are
+ *              SKILL.md files the host lists like any other).
+ * - `agents`   the same for native agents; Bob has none, its agents table is in the carrier.
+ * - `context`  the session files the context hook injects (untouched seeds already skipped).
+ *              The per-repo project context is NOT counted: it changes with the working dir.
+ */
+import path from 'node:path';
+
+import { sessionFiles } from '../hosts/hooks-context.mjs';
+import { carriersFor } from '../hosts/installs.mjs';
+import { frontmatter } from '../hosts/memory-files.mjs';
+import { listDir } from '../hosts/hooks-prims.mjs';
+import { isFile, readText } from '../lib/fs.mjs';
+
+/**
+ * THE ANTI-BLOAT CEILING on the carrier, per footprint — the most a root file may weigh with
+ * every doctrine pack active. `tests/unit/emit_smoke.test.mjs` gates every emit against it and the
+ * console draws it on the cost chart, so it lives here, once, where both read it. Raise it by
+ * exactly the measured overrun and say why in that test's docblock, which keeps its history.
+ */
+export const CARRIER_CEILING = { full: 62_076, lean: 38_890 };
+
+const decode = (p) => readText(p).split('\r\n').join('\n');
+
+/**
+ * A frontmatter value as the host shows it. The emit writes descriptions JSON-escaped
+ * (`—` for one em dash), and `frontmatter()` has already stripped the quotes, so the
+ * escapes are decoded here or one character counts as six.
+ */
+function fmValue(raw) {
+  if (!raw) return '';
+  if (raw.includes('\\')) {
+    try { return JSON.parse(`"${raw}"`); } catch { /* not a JSON escape after all: count as written */ }
+  }
+  return raw;
+}
+
+/** name + description of one spec file; `fallbackName` for agents, whose name is the file stem. */
+function listedChars(file, fallbackName) {
+  let fm;
+  try { [fm] = frontmatter(decode(file)); } catch { return 0; }
+  const name = fmValue(fm.get('name')) || fallbackName;
+  return name.length + fmValue(fm.get('description')).length;
+}
+
+/**
+ * `root` is the install's root (`installTargets`), `dir` its data dir (`viewCfg`), which holds
+ * `skills/`, `agents/` and the session files. Every part that cannot be read counts 0; a missing
+ * carrier answers `null` for the whole cost, so the console shows "not measured", not a tiny bar.
+ */
+export function alwaysOnCost({ host, root, dir, footprint }) {
+  const carrierPath = carriersFor(host).map((rel) => path.join(root, rel)).find(isFile);
+  if (!carrierPath) return null;
+  const carrier = decode(carrierPath).length;
+
+  let skills = 0;
+  const skillsDir = path.join(dir, 'skills');
+  for (const name of listDir(skillsDir)) {
+    const f = path.join(skillsDir, name, 'SKILL.md');
+    if (isFile(f)) skills += listedChars(f, name);
+  }
+  let agents = 0;
+  if (host !== 'bob') {
+    const agentsDir = path.join(dir, 'agents');
+    for (const name of listDir(agentsDir)) {
+      if (name.endsWith('.md')) agents += listedChars(path.join(agentsDir, name), name.slice(0, -3));
+    }
+  }
+  let context = 0;
+  try { for (const s of sessionFiles(dir)) context += s.text.length; } catch { /* none */ }
+
+  return { carrier, skills, agents, context, ceiling: CARRIER_CEILING[footprint] ?? null };
+}

package/js/inspect/doctor.mjs

@@ -42,7 +42,7 @@ import { authoringProblems, loopProblems } from './checks-authoring.mjs';
 import {
   checkBuild, colorThemeProblems, renderedProblems, themeParityProblems,
 } from './checks-build.mjs';
-import { moduleMapProblems, scorecardProblems, shimProblems } from './checks-repo.mjs';
+import { hostMatrixProblems, moduleMapProblems, scorecardProblems, shimProblems } from './checks-repo.mjs';
 import { NOTE, isDoctorNote, sortedProblems, sortedUnique, stemOf, withTempDir } from './scan.mjs';
 
 /**
@@ -249,6 +249,7 @@ export function doctorCollect({
   problems = problems.concat(ran('openclaude_dual', 'OpenClaude dual harness',
     openclaudeDualHarnessNotes()));
   problems = problems.concat(ran('map', 'Module map', moduleMapProblems()));
+  problems = problems.concat(ran('host_matrix', 'Host tables', hostMatrixProblems()));
   problems = problems.concat(ran('scorecard', 'Scorecard floor', scorecardProblems()));
   // P10c's `cli` check is GONE, and the reason is not that it stopped mattering. It hashed
   // `rituals/harness.py` and compared that against a digest baked into `cli.json`, to catch a

package/js/inspect/inventory.mjs

@@ -106,7 +106,7 @@ export const SKILL_CLASS = {
   // knowledge base, terminal) rather than about the user's code. They sat under
   // `understand` before, which made that class a grab-bag.
   wiki: 'harness', geneseed: 'harness', rule: 'harness', profile: 'harness',
-  herdr: 'harness', 'skill-forge': 'harness',
+  'skill-forge': 'harness',
   teach: 'learn', quiz: 'learn', 'learn-mode': 'learn',
 };
 

package/js/maintain/uninstall.mjs

@@ -59,6 +59,7 @@ import {
   resolvePath, settingsFile,
 } from '../hosts/hosts.mjs';
 import { mcpCommented, mcpLoad } from '../hosts/mcp.mjs';
+import { hashesOf, ownedState, ownedWithin } from '../hosts/owned.mjs';
 import {
   atomicWriteJson, managedBlockRead, managedBlockRemove, managedBlockWrite,
   loadJsonObject, mergeClaudeSettings, opencodeTarget, OPENCODE_SENTINEL, opencodeSentinelWrite,
@@ -67,7 +68,7 @@ import {
 } from '../hosts/settings.mjs';
 import { printOut, printErr, readText, writeText, isFile, isDir, isOsError } from '../lib/fs.mjs';
 import { indexOfDeepEqual, isDict, jsonDumps, deepEquals } from '../lib/json.mjs';
-import { comparePaths, isAbsolutePath, within } from '../lib/paths.mjs';
+import { comparePaths, isAbsolutePath } from '../lib/paths.mjs';
 
 const hostSpec = (host) => HOSTS.find((h) => h.host === host);
 
@@ -145,7 +146,7 @@ function pruneAncestors(start, stop) {
 
 /**
  * The manifest's `owned` list, unlinked one by one with the ancestor prune, returning
- * `[removed, failed]`.
+ * `[removed, failed, kept]`.
  *
  * The third copy of this loop in `_harness_mcp.py` and the reason it is one function here:
  * `_uninstall_global` (rooted at the target), `_claude_uninstall` (rooted at the cfg dir) and
@@ -157,15 +158,28 @@ function pruneAncestors(start, stop) {
  * `ownedWithin` first, the same containment boundary deactivate draws: the manifest is a file
  * on disk, and without it an `owned` entry of `../../.bashrc` was unlinked — and the prune
  * then climbed from ITS parent, which never meets `base`, removing empty directories as it went.
- * @returns {[number, string[]]}
+ *
+ * Task 5 (O-1's uninstall half): `hashes` is the manifest's recorded `hashes` map (`hashesOf`,
+ * `{}` for an older manifest — the constraint that keeps a hash-less install's behaviour
+ * unchanged). Unless `force`, a rel whose `ownedState` reads `'modified'` is left on disk rather
+ * than unlinked and lands in `kept`, not `failed` — it is not an error, the file just is not
+ * Geneseed's to delete any more once the user has edited it. `'unknown'` and `'missing'` are
+ * NOT `'modified'` and are unlinked exactly as before, so an older, hash-less manifest's
+ * uninstall is byte-identical to today's.
+ * @returns {[number, string[], string[]]}
  */
-function unlinkOwned(base, owned, label = '') {
+function unlinkOwned(base, owned, label = '', hashes = {}, force = false) {
   let removed = 0;
   const failed = [];
+  const kept = [];
   for (const rel of ownedWithin(base, owned)) {
     const victim = path.join(base, rel);
     try {
       if (isFile(victim)) {
+        if (!force && ownedState(base, rel, hashes) === 'modified') {
+          kept.push(`${label}${rel}`);
+          continue;
+        }
         unlinkSync(victim);
         removed += 1;
         pruneAncestors(path.dirname(victim), base);
@@ -178,24 +192,7 @@ function unlinkOwned(base, owned, label = '') {
       failed.push(`${label}${rel} (${e && e.message ? e.message : e})`);
     }
   }
-  return [removed, failed];
-}
-
-/**
- * The manifest rels that resolve INSIDE `base` — the one security boundary every walk over
- * `owned` goes through (uninstall, both deactivates).
- *
- * `path.resolve(rroot, r)` and NOT `path.join`, which is the one line here that is a security
- * boundary rather than a translation. The Python is `(rroot / r).resolve()`, and pathlib's
- * `/` REPLACES the base when the right operand is absolute — so a manifest entry naming
- * `C:/evil.md` resolves outside the root and `_within` rejects it. `path.join` would have
- * concatenated it into `<root>/C:/evil.md`, which passes containment and would then be acted
- * on. `path.resolve` has pathlib's semantics for exactly this case, and collapses `..`
- * besides, which is why the guard runs on the resolved path rather than the lexical one.
- */
-function ownedWithin(base, rels) {
-  const rroot = resolvePath(base);
-  return rels.filter((r) => r && within(resolvePath(path.resolve(rroot, r)), rroot));
+  return [removed, failed, kept];
 }
 
 /** The two WARNs every reversal prints when an owned file survives. Identical in all three. */
@@ -204,6 +201,19 @@ function warnSurvivors(failed) {
     + `${failed.length} owned file(s): ${failed.join(', ')}\n`);
 }
 
+/**
+ * The message a reversal prints for every rel `unlinkOwned` left on disk because the user had
+ * edited it and `--force` was not given. Separate from `warnSurvivors`: a kept file is not an
+ * error (nothing failed) — it is the user's now, exactly like a refused claim on re-emit, and
+ * the uninstall completes around it. So the hint is `--force` on the uninstall itself, not a
+ * retry: once it completes there is no install left to rerun against.
+ */
+function warnKept(kept) {
+  printErr(`[uninstall] kept ${kept.length} file(s) you edited: ${kept.join(', ')}`
+    + ' — they are yours now (uninstall with --force to delete edited files too)\n');
+}
+
+/** Only a FAILED unlink keeps the manifest and markers — a kept edit never does. */
 function warnMarkersKept() {
   printErr('[uninstall] WARN: the manifest and markers were KEPT so '
     + '`geneseed uninstall` can be retried once the file(s) are '
@@ -332,11 +342,12 @@ function ownedOf(man) {
  * 'absent' and the retry the WARN promises would bounce off `cmdUninstall`'s own gate,
  * stranding the leftovers forever.
  */
-export function claudeUninstall(cfg, archiveMemory) {
+export function claudeUninstall(cfg, archiveMemory, force = false) {
   const man = claudeReadManifest(cfg);
   const managed = managedOf(man);
-  const [removed, failed] = unlinkOwned(cfg, ownedOf(man));
+  const [removed, failed, kept] = unlinkOwned(cfg, ownedOf(man), '', hashesOf(man), force);
   if (failed.length) warnSurvivors(failed);
+  if (kept.length) warnKept(kept);
   const hooks = managed.settings_hooks || [];
   const sf = settingsFile(cfg, managed);
   const unwired = unwireClaudeSettings(sf, hooks);
@@ -354,7 +365,7 @@ export function claudeUninstall(cfg, archiveMemory) {
     archived = archiveStore(path.join(cfg, 'memory'));
   }
   // `unmerged` reports REALITY: hooks were recorded AND the unwire actually rewrote the file.
-  return { removed, unmerged: Boolean(hooks.length) && unwired, archived, failed };
+  return { removed, unmerged: Boolean(hooks.length) && unwired, archived, failed, kept };
 }
 
 /**
@@ -364,11 +375,12 @@ export function claudeUninstall(cfg, archiveMemory) {
  * install and an OpenCode one can share one entry point: the Claude family has no
  * opencode.json to unmerge and a settings.json plus a managed block instead.
  */
-export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
-  if (CLAUDE_STYLE.includes(host)) return claudeUninstall(target, archiveMemory);
+export function uninstallGlobal(target, archiveMemory, host = 'opencode', force = false) {
+  if (CLAUDE_STYLE.includes(host)) return claudeUninstall(target, archiveMemory, force);
   const man = claudeReadManifest(target);
-  const [removed, failed] = unlinkOwned(target, ownedOf(man));
+  const [removed, failed, kept] = unlinkOwned(target, ownedOf(man), '', hashesOf(man), force);
   if (failed.length) warnSurvivors(failed);
+  if (kept.length) warnKept(kept);
   for (const d of ['agents', 'skills', 'plugins']) {
     const p = path.join(target, d);
     if (isDir(p) && isEmptyDir(p)) rmdirQuiet(p);
@@ -382,7 +394,7 @@ export function uninstallGlobal(target, archiveMemory, host = 'opencode') {
   if (archiveMemory && isDir(path.join(target, 'memory'))) {
     archived = archiveStore(path.join(target, 'memory'));
   }
-  return { removed, unmerged, archived, failed };
+  return { removed, unmerged, archived, failed, kept };
 }
 
 /**
@@ -431,19 +443,22 @@ export function installAgentEntryOf(instr) {
  * describing a file that no longer exists, which the fallback would then paper over with the
  * canonical spelling — and a bundle sub-dir layout would be left wired.
  */
-function opencodeProjectUninstall(root) {
+function opencodeProjectUninstall(root, force = false) {
   const entry = installAgentEntry(root, 'project');
   let removed = 0;
   let failed = [];
+  let kept = [];
   let man = null;
   const oc = path.join(root, '.opencode');
   const manifestPath = path.join(oc, GLOBAL_MANIFEST);
   if (isFile(manifestPath)) {
     man = claudeReadManifest(oc);
-    [removed, failed] = unlinkOwned(oc, ownedOf(man), '.opencode/');
+    [removed, failed, kept] = unlinkOwned(oc, ownedOf(man), '.opencode/', hashesOf(man), force);
     if (failed.length) warnSurvivors(failed);
+    if (kept.length) warnKept(kept);
     // Survivors gate, mirroring the other two reversals: `_project_qualifies` keys off the
     // manifest, so deleting it while an owned file survives makes the install unfindable.
+    // A kept (edited) file is not a survivor: it is the user's now, not this install's.
     if (!failed.length) {
       unlinkQuiet(manifestPath);
       if (isDir(oc) && isEmptyDir(oc)) rmdirQuiet(oc);
@@ -464,6 +479,7 @@ function opencodeProjectUninstall(root) {
     man ? skillPermissionNames(man) : []);
   const result = { removed, unmerged, archived: null };
   if (failed.length) result.failed = failed;
+  if (kept.length) result.kept = kept;
   return result;
 }
 
@@ -506,8 +522,16 @@ export function ownedDirsFor(root, host, scope, data) {
  * plugins), so a locked owned file OUTSIDE those (Bob's `rules/geneseed.md`) would slip the
  * gate while the reversal kept its manifest, and deleting the root markers here would then
  * contradict that "KEPT" promise. The reversal's own `failed` list closes that hole.
+ *
+ * A KEPT file (Task 5: the user edited it, no `--force`) is the opposite case: it is the
+ * user's now, exactly like a refused claim on re-emit, so it must NOT hold the install open —
+ * a manifest kept for it left the install 'active' and the next `rebuild-all`/`update`
+ * re-wired hooks into a repo the user had uninstalled. So a watched directory whose only
+ * remaining files are kept ones is not a survivor, and `kept` never gates the markers; it is
+ * returned so a caller (the web's remove) can name the files and the `--force` way out.
  */
-export function installUninstall(root, host = 'opencode', scope = 'global', memory = 'keep') {
+export function installUninstall(root, host = 'opencode', scope = 'global', memory = 'keep',
+  force = false) {
   if (!['keep', 'archive', 'delete'].includes(memory)) memory = 'keep';
   if (installState(root, host, scope) === 'absent') {
     return { ok: false, error: 'nothing installed here' };
@@ -517,13 +541,13 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
   //    install's, and they go with it.
   let summary;
   if (CLAUDE_STYLE.includes(host)) {
-    summary = claudeUninstall(data, false);
+    summary = claudeUninstall(data, false, force);
     rmtreeQuiet(path.join(data, DISABLED_STASH, host));
   } else if (installKind(root) === 'global') {
-    summary = uninstallGlobal(root, false, 'opencode');
+    summary = uninstallGlobal(root, false, 'opencode', force);
     rmtreeQuiet(path.join(root, DISABLED_STASH));
   } else {
-    summary = opencodeProjectUninstall(root);
+    summary = opencodeProjectUninstall(root, force);
     rmtreeQuiet(path.join(root, DISABLED_STASH));
   }
   // 2. Memory + notebook, independent of the owned-file removal above.
@@ -536,7 +560,14 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
   }
   // 3. The root markers, but only once the reversal's dirs are actually gone.
   const failed = summary.failed || [];
-  const survivors = ownedDirsFor(root, host, scope, data).filter((d) => existsSync(d));
+  const kept = summary.kept || [];
+  // `kept` rels are spelled relative to the reversal's own base: the cfg dir for the Claude
+  // family, the root for OpenCode (whose project reversal already prefixes `.opencode/`).
+  const keptAbs = new Set(kept.map((r) => path.join(CLAUDE_STYLE.includes(host) ? data : root, r)));
+  const survivors = ownedDirsFor(root, host, scope, data).filter((d) => existsSync(d)
+    && !(keptAbs.size && readdirSync(d, { recursive: true, withFileTypes: true })
+      .every((e) => e.isDirectory() || keptAbs.has(path.join(e.parentPath, e.name)))));
+  const withKept = (o) => (kept.length ? { ...o, kept } : o);
   if (survivors.length || failed.length) {
     if (survivors.length && !failed.length) {
       // With `failed` set the reversal already warned twice — no third overlapping WARN.
@@ -544,12 +575,15 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
         + `${survivors.join(', ')}. The install marker was KEPT so you can retry `
         + '`geneseed uninstall` once the file(s) are unlocked/removable.\n');
     }
-    const out = {
+    // `incomplete` names every reason the root markers stayed — directory survivors and a
+    // failed unlink — deduped.
+    const named = survivors.concat(failed);
+    const out = withKept({
       ok: true,
       removed: summary.removed ?? 0,
       memory,
-      incomplete: survivors.concat(failed.filter((f) => !survivors.includes(f))),
-    };
+      incomplete: named.filter((f, i) => named.indexOf(f) === i),
+    });
     if (archived.length) out.archived = archived;
     return out;
   }
@@ -623,7 +657,7 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
   }
   // 4. Tidy an emptied marker dir (.claude/.bob/.openclaude) so no husk lingers in the repo.
   if (data !== root && isDir(data) && isEmptyDir(data)) rmdirQuiet(data);
-  const out = { ok: true, removed: summary.removed ?? 0, memory };
+  const out = withKept({ ok: true, removed: summary.removed ?? 0, memory });
   if (archived.length) out.archived = archived;
   return out;
 }
@@ -806,7 +840,7 @@ export function cmdUninstall(args) {
     }
   }
   const memory = args.archiveMemory ? 'archive' : 'keep';
-  const s = installUninstall(root, host, scope, memory);
+  const s = installUninstall(root, host, scope, memory, Boolean(args.force));
   if (!(s.ok ?? true)) {
     printErr(`[uninstall] failed: ${s.error || 'unknown error'}\n`);
     return 1;
@@ -820,7 +854,8 @@ export function cmdUninstall(args) {
       + 'the install marker was kept — retry `geneseed uninstall` once they\'re '
       + `removable. ${cfgfile} updated where needed; memory/notebook ${mem}.\n`);
   } else {
-    printOut(`[uninstall] done — removed ${s.removed} file(s); ${cfgfile} updated where `
+    const keptNote = s.kept ? `, kept ${s.kept.length} you edited` : '';
+    printOut(`[uninstall] done — removed ${s.removed} file(s)${keptNote}; ${cfgfile} updated where `
       + `needed; memory/notebook ${mem}. Start a new session to apply.\n`);
   }
   if (scope === 'global') printSurvivingProjectInventory(root);

package/js/web/actions.mjs

@@ -42,7 +42,7 @@ import { setupBuildArgs } from '../build/generate.mjs';
 import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
 import { activeLoops, setLoopPreset } from '../loop/registry.mjs';
 import {
-  CLAUDE_STYLE, HOSTS, bobConfigDir, claudeConfigDir, expanduser, openclaudeConfigDir,
+  HOSTS, bobConfigDir, claudeConfigDir, expanduser, openclaudeConfigDir,
   opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
 import {
@@ -50,11 +50,10 @@ import {
   installState, installTargets, legacyProcessCarrierOfDir, modeOfDir, postureOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import {
-  MCP_PRESETS, isDict, mcpApply, mcpCommented, mcpInstallTargets, mcpKnownNames, mcpLoad,
-  mcpMeta, mcpPresetBlock, mcpSave, mcpSetEnabled, mcpState,
+  isDict, mcpCommented, mcpInstallTargets, mcpLoad, mcpServerNames, mcpState,
 } from '../hosts/mcp.mjs';
-import { readText, isFile, isDir } from '../lib/fs.mjs';
-import { parseJson, formatRepr, formatValue, isTruthy } from '../lib/json.mjs';
+import { isFile, isDir } from '../lib/fs.mjs';
+import { formatRepr, formatValue, isTruthy } from '../lib/json.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
 import { normcase, which, within } from '../lib/paths.mjs';
 import { stripWhitespace } from '../lib/text.mjs';
@@ -348,18 +347,20 @@ export function apiLoopsPresetMutate(state, body) {
 
 // ---- MCP ----------------------------------------------------------------------------------
 
+/**
+ * The MCP servers each active install ALREADY has, and nothing it could have. Read-only by
+ * decision (2026-10): which servers to wire depends on the user and on the host, so the console
+ * shows what is in each config and where that file lives, and the user edits it. There is no
+ * preset to add and no toggle, so nothing here ever rewrites a config — including
+ * `~/.claude.json`, which holds far more than MCP wiring.
+ */
 export function apiMcp() {
   const out = [];
   for (const [label, p, host, scope, root] of mcpInstallTargets()) {
     if (installState(root, host, scope) !== 'active') continue;
     const cfg = mcpLoad(p, host);
-    const servers = [];
-    for (const name of mcpKnownNames(cfg, host)) {
-      const [lbl, desc] = mcpMeta(name);
-      servers.push({ name, label: lbl, desc,
-        preset: Object.hasOwn(MCP_PRESETS, name),
-        state: mcpState(cfg, name, host) });
-    }
+    const servers = mcpServerNames(cfg, host)
+      .map((name) => ({ name, state: mcpState(cfg, name, host) }));
     out.push({ label, path: p, host, root, exists: isFile(p),
       commented: mcpCommented(p), servers });
   }
@@ -370,10 +371,8 @@ export function apiMcp() {
 /**
  * The MCP config paths a request body is allowed to name, as `path -> [path, host]`.
  *
- * LIFTED OUT OF `apiMcpToggle` BECAUSE IT NOW HAS A SECOND CALLER, not for tidiness. `/api/reveal`
- * hands a path to the desktop's file manager, and the allowlist is the whole security of that
- * endpoint exactly as it is of the toggle: an unlisted path must 404 before anything is opened.
- * Two copies of a security check drift, and the copy that drifts is the one nobody re-read.
+ * `/api/reveal` hands a path to the desktop's file manager, and this allowlist is the whole
+ * security of that endpoint: an unlisted path must 404 before anything is opened.
  *
  * It is rebuilt per call rather than cached: installs come and go while the daemon runs, and a
  * stale allowlist is wrong in both directions — refusing a real target, or naming a dead one.
@@ -386,67 +385,6 @@ export function mcpTargetPaths() {
   return known;
 }
 
-/**
- * Enable / disable / first-add one server.
- *
- * THE PATH COMES OUT OF THE REQUEST BODY, so the allowlist is the whole security of this
- * endpoint: `known` is built from the detected install targets and an unlisted path is a 404
- * before anything is read or written. Without it this is "write arbitrary JSON to an
- * arbitrary file", behind a CSRF token and nothing else.
- *
- * The Claude-shaped hosts are parsed ONCE, STRICTLY, and that exact object is what gets
- * rewritten — so the safety check and the value saved come from the same read, with no
- * time-of-check/time-of-use gap and no comment-stripper touching a string that contains
- * `,]`. A file that will not parse is refused rather than clobbered: it may be
- * `~/.claude.json`, which holds projects and history far beyond MCP wiring.
- */
-export function apiMcpToggle(state, body) {
-  const name = strOr(bget(body, 'name'));
-  const want = isTruthy(bget(body, 'enabled'));
-  const pathArg = strOr(bget(body, 'path'));
-  const known = mcpTargetPaths();
-  const hit = known.get(pathArg);
-  if (hit === undefined || !name) {
-    throw new NotFound(`mcp target ${pathArg || '(none)'}`);
-  }
-  const [p, host] = hit;
-  if (mcpCommented(p)) {
-    return { ok: false, error: 'config holds comments — edit it by hand to keep them' };
-  }
-  let cfg;
-  if (CLAUDE_STYLE.includes(host)) {
-    if (isFile(p)) {
-      let parsed;
-      try {
-        parsed = parseJson(readText(p));
-      } catch {
-        parsed = null;
-      }
-      if (!isDict(parsed)) {
-        return { ok: false,
-          error: "couldn't parse this config — edit it by hand to avoid data loss" };
-      }
-      cfg = parsed;
-    } else {
-      cfg = {};
-    }
-  } else {
-    cfg = mcpLoad(p);
-  }
-  if (mcpState(cfg, name, host) === 'absent') {
-    if (!Object.hasOwn(MCP_PRESETS, name)) {
-      return { ok: false, error: `unknown server '${name}'` };
-    }
-    if (!want) return { ok: false, error: `'${name}' is not configured` };
-    cfg = mcpApply(cfg, name, mcpPresetBlock(name, host), host);
-    cfg = mcpSetEnabled(cfg, name, true, host);
-  } else {
-    cfg = mcpSetEnabled(cfg, name, want, host);
-  }
-  mcpSave(p, cfg);
-  return { ok: true, name, state: mcpState(cfg, name, host) };
-}
-
 // ---- the harness selector ------------------------------------------------------------------
 
 /**