geneseed 4.17.1 → 4.17.2

package/CHANGELOG.md

@@ -8,6 +8,19 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.17.2] — 2026-10-24
+
+Patch: the web console closes its security and data-loss holes from the 2026-10-24 audit.
+
+### Security
+- **Restore acts only on what the diff offers.** `POST /api/actions/restore` trusted the client's file list: one call could reset `user-rules.md`, `PROFILE.md` or a memory file to its seed, or delete a file the diff never listed. It now restores only the paths `/api/diff` offers, computed on the server. It never touches the files written once and then left to you (`user-rules.md`, `PROFILE.md`, `memory/`, `notebook/`). An added file is moved to `archived-restore/<stamp>/` in the install instead of being deleted.
+- **The web console cannot be framed or driven from another site.** Every response carries a Content-Security-Policy with `frame-ancestors 'none'` and a per-response nonce on the token script, plus `X-Frame-Options: DENY`, `nosniff` and `Referrer-Policy: no-referrer`. One request guard checks the exact Host and port, refuses a cross-site `/api` request (`Sec-Fetch-Site`, foreign `Origin`), and compares the token in constant time. A repeated `GET /api/doctor?fresh=1` reuses a run less than 3 s old. The server sets request and header timeouts.
+- **The markdown sanitizer drops SVG animation elements, `template`, raw-text elements and `style` attributes.** These closed a `javascript:` link set through `<set>`/`<animate>`, a full-page overlay drawn with `style`, and a mutation XSS through `xmp`, `noembed`, `noframes`, `noscript` or `plaintext`.
+
+### Fixed
+- **Settings › Maintenance no longer offers an Uninstall.** It ran `geneseed uninstall --yes` with no target, so it always removed the OpenCode global install, whichever install you were viewing. Each install keeps its own Uninstall in Installs › Hosts.
+- **Editing a rule keeps its scope.** A rule written `scope: global` was saved back as `project` on every Edit or Graduate. A scope the editor does not list is now kept as written. A rule body with a line that reads as a rule heading (`## …`) is refused with a 400, because it could create a second rule with a forged id. So is a `|` in the scope or source.
+
 ## [4.17.1] — 2026-10-23
 
 Patch: the web console's Update button works on a global npm install and re-checks for updates while the page is open.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.17.1**.
+> string. Current label: **4.17.2**.
 
 ## Capabilities
 

package/docs/extending.md

@@ -125,7 +125,7 @@ Notes that matter:
 
 ### The gates CI does not run
 
-- **The mutation matrix itself.** `tests/mutate.mjs` — 35 rows, each a one-string edit to a
+- **The mutation matrix itself.** `tests/mutate.mjs` — 34 rows, each a one-string edit to a
   product file with a written argument for which gate should catch it. The full run is **in no
   workflow** and should not be: it mutates the product tree 33 times and runs a gate per edit.
   Run `node tests/mutate.mjs --all` (or `--only M7`) by hand when you change something a gate is

package/docs/web-ui.md

@@ -44,6 +44,15 @@ so other sites can't trigger builds, deletes, or shutdown. Mutating actions (bui
 update, export, restore, memory-delete, uninstall) run in the background and report back
 as toasts (fire-and-notify). Read-only browsing needs no token.
 
+Every request passes one guard first: the `Host` must be `127.0.0.1`, `localhost` or `[::1]`
+**at the server's own port** (DNS rebinding, other local servers), `/api/*` refuses a
+`Sec-Fetch-Site` of `cross-site`/`same-site` or a foreign `Origin` (so another site cannot read
+the API either), and every write compares the token in constant time. Every response carries
+`X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer` and a
+strict CSP (`frame-ancestors 'none'`, same-origin only, the one inline token script admitted by
+a per-response nonce). `?fresh=1` on the doctor re-runs at most once per 3 s, and the server
+drops a request whose headers take over 10 s or whose whole request takes over 30 s.
+
 ## The rail
 
 The left rail mirrors the harness's own shape:
@@ -89,7 +98,9 @@ streams the output of background jobs and keeps their history across reloads.
 
 - **Rules** (`#/rules`) — your own standing rules, read from and written to the
   `user-rules.md` beside the deployed AGENT.md (the seed-once file no update ever
-  touches). List with scope (user/project) and trial chips, add/edit/retire forms, a
+  touches). List with scope (user/project, or any other scope written by hand, which a
+  save keeps as written) and trial chips, add/edit/retire forms (a body line starting
+  `## ` is refused: the file would read it as a new rule heading), a
   **Graduate** action that adopts a trial rule for good, and a budget meter that turns
   amber as the always-loaded set gets heavy. Every write carries the fingerprint of the
   content the page last read — if an agent session edited the file meanwhile, the save
@@ -169,6 +180,9 @@ streams the output of background jobs and keeps their history across reloads.
 - **Changes** (`#/diff`) — the diff between the deployed harness and the source: edited /
   added / missing files with per-file expansion and coloured unified-diff lines. Select
   files to **export an `improvements.md`** back-port, or **restore** them to source.
+  Restore acts only on files the diff lists, and never on your own files (`user-rules.md`,
+  `PROFILE.md`, `memory/`, `notebook/`). An added file is moved into
+  `archived-restore/<date-time>/` in the install, not deleted.
 - **Doctor** (`#/doctor`) — runs the same health engine as the `doctor` command (every
   theme, parity, links, authoring gates, drift), grouping any problems per check. It shows
   the server's last run — warmed at start, redone after a job, an install toggle or a view
@@ -207,8 +221,8 @@ streams the output of background jobs and keeps their history across reloads.
   console: Cultivar, Operator, Matrix or Atlas) with a **Dashboard layout** control (Auto follows each theme's designed Status
   lens; Cultivar / Greenhouse / Operator / Journal force one regardless of skin), the
   install snapshot (deployed/target/theme/version/memory store), a Maintenance card (PATH
-  link/unlink, uninstall), an offline package download, server controls (Stop), and the
-  **About** colophon — project + creator credits and the source link, folded in from the
+  link/unlink and Update; each install is uninstalled from its own panel in Hosts), an
+  offline package download, server controls (Stop), and the **About** colophon — project + creator credits and the source link, folded in from the
   retired `#/about` tab (which still resolves here). Build, update, and MCP wiring live in
   the Harness tab.
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.17.1"
+  "version": "4.17.2"
 }

package/js/README.md

@@ -235,7 +235,7 @@ the deployed harness as JSON.
 |---|---|
 | `server.mjs` | `serve()`/`cmdWeb`: UI-build precheck, socket bind, token mint, daemon record wiring |
 | `routes.mjs` | The route tables — `STATE_ROUTES`, `PREFIX_ROUTES`, `POST_ROUTES` (+ its 409 column) — and the inline lists |
-| `handler.mjs` | One function per request: dispatch, gzip, Host/CSRF guards and body cap (before the body is read), static SPA fallback |
+| `handler.mjs` | One function per request: dispatch, gzip, `requestGuard` (Host+port, Origin/Sec-Fetch-Site on `/api`, constant-time CSRF token) and body cap (before the body is read), `securityHeaders` (CSP nonce, framing), static SPA fallback |
 | `state.mjs` | `webState` — the resolved install view every endpoint reads, with its cached inventory and doctor |
 | `catalog.mjs` | The Library read model: inventory, constitution tiers, memory/notebook/wiki/config items, `apiCatalog`/`apiItem`, `NotFound` |
 | `api.mjs` | The dashboard and settings reads: overview, recent, themes, setup, doctor, diff, installs, excludes, loops |

package/js/web/actions.mjs

@@ -27,7 +27,8 @@
  */
 import { spawn } from 'node:child_process';
 import {
-  accessSync, constants, copyFileSync, mkdirSync, mkdtempSync, realpathSync, rmSync, unlinkSync,
+  accessSync, constants, copyFileSync, existsSync, mkdirSync, mkdtempSync, realpathSync,
+  renameSync, rmSync,
 } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -36,7 +37,8 @@ import { emitGlobalInto } from '../build/driver.mjs';
 import {
   ROOT, discoverNames, knownRuleIds, loadKits, PACK_ORDER,
 } from '../build/source.mjs';
-import { withStdoutSwallowed } from '../inspect/diff.mjs';
+import { diffCollect, drifted, withStdoutSwallowed } from '../inspect/diff.mjs';
+import { SESSION_FILES } from '../hosts/hooks-context.mjs';
 import { excludeAdd, excludeRemove } from '../inspect/excludes.mjs';
 import { installProfile, setupBuildArgs } from '../build/generate.mjs';
 import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
@@ -503,13 +505,30 @@ export function globalEmitHostFor(emit) {
   return HOSTS.some((h) => h.host === host) ? host : 'opencode';
 }
 
+/**
+ * The session files' names and their top folders (`memory/`, `notebook/`, …): seed-once, the
+ * user's after the first build. Derived from `SESSION_FILES`, the one list of them.
+ */
+const SEED_FILES = new Set(SESSION_FILES.filter((r) => !r.includes('/')));
+const SEED_DIRS = new Set(SESSION_FILES.filter((r) => r.includes('/')).map((r) => r.split('/')[0]));
+const isSeedOnce = (rel) => SEED_FILES.has(rel) || SEED_DIRS.has(rel.split('/')[0]);
+
 /**
  * Restore selected drifted files from the SOURCE render.
  *
  * Source wins and local edits are discarded (the inverse, keeping them, is Export
- * improvements). Renders the expected copy exactly as `diffCollect` does, then per rel:
- * expected present -> overwrite/create the deployed copy; expected absent but deployed present
- * (an 'added' file) -> delete it; neither -> an error and nothing touched.
+ * improvements). Renders the expected copy exactly as `diffCollect` does, then per rel, BY ITS
+ * DIFF STATUS: edited/missing -> overwrite/create the deployed copy; added -> move it into
+ * `archived-restore/<stamp>/` inside the install; anything else -> an error and nothing touched.
+ *
+ * THE CLIENT'S LIST IS A SELECTION, NEVER AN AUTHORITY. Only a rel the drift list offers is
+ * acted on, and that list is `diffCollect` with the arguments `apiDiff` passes, so the panel and
+ * this verb cannot disagree. Trusting the POST made it a write-or-delete primitive over the whole
+ * install (audit SE-1, 2026-10): one request reset `user-rules.md` and the memory index to their
+ * stubs, a second unlinked a memory fact and an unrelated secret file. The seed-once files are
+ * refused even when a manifest claims them. An added file is ARCHIVED, never unlinked, in the
+ * `archived-<name>/<stamp>` shape `archiveStore` gives uninstall; nothing owns the archive, so
+ * the next diff does not list it.
  *
  * SYNCHRONOUS, AND NOT A JOB. One render, the same cost as a diff GET, and it returns a
  * structured result rather than a job id — which is why the dispatcher answers it before it
@@ -534,7 +553,11 @@ export function apiRestore(state, files) {
   const restored = [];
   const deleted = [];
   const errors = [];
+  let archive = null;
   const target = resolvePath(state.target);
+  const offered = new Map(drifted(diffCollect({
+    target: state.target, theme: state.theme, emit: state.emit }).files ?? [])
+    .map((f) => [f.rel, f.status]));
   const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-restore-'));
   try {
     const expected = resolvePath(path.join(tmp, 'expected'));
@@ -566,26 +589,48 @@ export function apiRestore(state, files) {
       const rel = stripWhitespace(formatValue(raw).replace(/\\/g, '/')).replace(/^\/+/, '');
       const dst = resolvePath(path.join(target, rel));
       const src = resolvePath(path.join(expected, rel));
+      const status = offered.get(rel);
       if (!rel || !within(dst, target) || !within(src, expected)) {
         errors.push(`${rel}: outside the deployed tree`);
-      } else if (isFile(src)) {
-        mkdirSync(path.dirname(dst), { recursive: true });
-        // A BYTE copy, so the restored file keeps the render's own line endings rather than
-        // the platform's (the `writeText`/`copy2` rule, one file over).
-        copyFileSync(src, dst);
-        restored.push(rel);
-      } else if (isFile(dst)) {
-        unlinkSync(dst);
-        deleted.push(rel);
+      } else if (!status || isSeedOnce(rel)) {
+        errors.push(`${rel}: not a drifted file restore may touch`);
+      } else if (status !== 'added' && !isFile(src)) {
+        errors.push(`${rel}: not in the source render`);
+      } else if (status !== 'added') {
+        // Caught per file, so one EISDIR/EBUSY cannot lose the report of the files before it.
+        try {
+          mkdirSync(path.dirname(dst), { recursive: true });
+          // A BYTE copy, so the restored file keeps the render's own line endings rather than
+          // the platform's (the `writeText`/`copy2` rule, one file over).
+          copyFileSync(src, dst);
+          restored.push(rel);
+        } catch (e) {
+          errors.push(`${rel}: could not restore (${e.code || e.message})`);
+        }
       } else {
-        errors.push(`${rel}: not in the source render nor deployed`);
+        // `archiveStore`'s local `YYYYMMDD-HHMMSS` stamp, one per call; a taken name gets `-2`, …
+        archive ??= path.join(target, 'archived-restore', new Date().toLocaleString('sv-SE')
+          .replace(/\D/g, '').replace(/^(\d{8})/, '$1-'));
+        let dest = resolvePath(path.join(archive, rel));
+        for (let n = 2; existsSync(dest); n += 1) dest = resolvePath(path.join(archive, `${rel}-${n}`));
+        if (!within(dest, archive)) {
+          errors.push(`${rel}: outside the archive`);
+          continue;
+        }
+        try {
+          mkdirSync(path.dirname(dest), { recursive: true });
+          renameSync(dst, dest);
+          deleted.push(rel);
+        } catch (e) {
+          errors.push(`${rel}: could not archive (${e.code || e.message})`);
+        }
       }
     }
   } finally {
     rmSync(tmp, { recursive: true, force: true });
   }
   state.refresh();
-  return { restored, deleted, errors };
+  return { restored, deleted, errors, archive };
 }
 
 /** (host, scope) -> the emit name that installs it. */

package/js/web/api.mjs

@@ -80,13 +80,24 @@ export function apiSetup(state) {
   };
 }
 
+// Short: a user who fixes a problem and clicks Re-run must not be shown the old verdict for long.
+const DOCTOR_COOLDOWN_MS = 3_000;
+
 /**
  * The same engine as the `doctor` verb, grouped per check — served from the state's cached run
  * (a lens visit or a page mount no longer pays ~3.6 s), and re-run only when `fresh` is asked
  * for: the Doctor page's Re-run button, as `GET /api/doctor?fresh=1`.
+ *
+ * A fresh ask within `DOCTOR_COOLDOWN_MS` of the last one THIS PATH ran reuses that run, so a
+ * page looping on `?fresh=1` cannot pin the event loop. `_doctorFreshAt` is written here only: a
+ * verdict planted any other way still re-runs. No single-flight promise — `runDoctor` is
+ * synchronous, so two fresh runs cannot overlap (revisit if it ever goes async).
  */
 export function apiDoctor(state, fresh = false) {
-  if (fresh) state.runDoctor();
+  if (fresh && Date.now() - (state._doctorFreshAt ?? 0) >= DOCTOR_COOLDOWN_MS) {
+    state.runDoctor();
+    state._doctorFreshAt = Date.now();
+  }
   const { ok, problems, checked_at } = state.doctor;
   return { ...state._doctorRun, ok, problems, checked_at };
 }

package/js/web/catalog.mjs

@@ -29,6 +29,9 @@ import { loadKits } from '../build/source.mjs';
 /** A requested catalog section or item that does not exist. */
 export class NotFound extends Error {}
 
+/** A request body the route refuses on its content (a 400, not a 500): the caller can fix it. */
+export class BadRequest extends Error {}
+
 /** `??` would also swallow an explicit `null` the file declared; this does not. */
 export const dget = (obj, key, dflt) => (Object.hasOwn(obj, key) ? obj[key] : dflt);
 

package/js/web/handler.mjs

@@ -6,29 +6,32 @@
  * surface testable at all. Keep the arity.
  *
  * What it actually uses of HTTP is small and deliberate — a whole-buffer `gzipSync` over a few
- * content types, two Cache-Control policies, a CSRF token on POST only, and a Host guard against
- * DNS rebinding. No streaming, no SSE, no ranges, no cookies, no CORS. The routes it honours are
+ * content types, two Cache-Control policies, one set of security headers (CSP with a per-response
+ * nonce) on every response, and one request guard (`requestGuard`) in front of every route. No
+ * streaming, no SSE, no ranges, no cookies, no CORS. The routes it honours are
  * declared next door in `routes.mjs`; the daemon that starts it is in `daemon.mjs`.
  */
 import { resolvePath } from '../hosts/hosts.mjs';
 import { isTruthy, jsonDumpsCompact } from '../lib/json.mjs';
 import { parseIntStrict, percentDecode } from '../lib/text.mjs';
 import { apiDeployCmd, apiInstallCmd, apiPickFolder, apiRestore, buildActionCmds, mcpTargetPaths } from './actions.mjs';
-import { NotFound } from './catalog.mjs';
+import { BadRequest, NotFound } from './catalog.mjs';
 import { openUrl, requestRestart } from './daemon.mjs';
 import { apiDocs, apiDocsPage } from './docs.mjs';
 import { actionCommands, updatePlan } from './jobs.mjs';
 import { POST_ROUTES, PREFIX_ROUTES, STATE_ROUTES, readJsonBody } from './routes.mjs';
 import { installKind } from './update-check.mjs';
 import { isFile } from '../lib/fs.mjs';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { readFileSync, statSync } from 'node:fs';
 import { basename, dirname, extname, join, sep } from 'node:path';
 import { gzipSync } from 'node:zlib';
 
 /**
- * DNS-rebinding guard. `h.split(":", 1)[0]` keeps everything before the FIRST colon, so
- * `localhost:4747` passes and a bare IPv6 literal would not — which is what the `[::1]`
- * prefix check above it is for.
+ * DNS-rebinding guard, HOSTNAME ONLY. `h.split(":", 1)[0]` keeps everything before the FIRST
+ * colon, so `localhost:4747` passes and a bare IPv6 literal would not — which is what the `[::1]`
+ * prefix check above it is for. The server itself no longer calls it: `requestGuard` matches the
+ * exact `name:port` instead, which this looser predicate cannot express.
  */
 export function localHost(host) {
   const h = (host || '').trim().toLowerCase();
@@ -36,6 +39,62 @@ export function localHost(host) {
   return ['127.0.0.1', 'localhost'].includes(h.split(':', 1)[0]);
 }
 
+/**
+ * Sent on EVERY response, merged last so no caller's `extra` can weaken one. `frame-ancestors` +
+ * `X-Frame-Options` stop a foreign page from framing the console and clickjacking its buttons; the
+ * CSP admits the one inline script (the token) by `nonce`, so an injected `<script>` cannot run
+ * and read the token. `style-src 'unsafe-inline'` because the React UI sets `style=` attributes.
+ */
+export function securityHeaders(nonce) {
+  return {
+    'X-Frame-Options': 'DENY',
+    'Content-Security-Policy': "frame-ancestors 'none'; default-src 'self'; "
+      + `script-src 'self' 'nonce-${nonce}'; style-src 'self' 'unsafe-inline'; `
+      + "img-src 'self' data:; font-src 'self' data:; connect-src 'self'; worker-src 'self'; "
+      + "manifest-src 'self'; base-uri 'none'; form-action 'none'",
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer',
+  };
+}
+
+/**
+ * THE one request guard, answered before dispatch (and before a POST body is read). `null` =
+ * pass, else `{ code, body }`.
+ *
+ * - Host must be an allowed hostname AT THIS SOCKET'S PORT, exactly: the hostname stops DNS
+ *   rebinding, the port stops another local server's page from posing as this origin.
+ * - `/api/*`: a cross-site or same-site fetch, or a foreign `Origin`, is refused even on GET —
+ *   the reads expose paths and memories. A request with neither header (curl, Node) passes.
+ * - Any non-GET: the CSRF token, compared in constant time so its bytes cannot be timed out.
+ */
+export function requestGuard(req, token) {
+  const host = req.headers.host || '';
+  // Exact `name:port`, not `localHost` + a suffix test: that pair let `[::1]x.evil:4747` and
+  // `localhost:1:4747` through. Lower-cased the way browsers send it.
+  const want = `:${req.socket.localPort}`;
+  const h = host.trim().toLowerCase();
+  if (!['127.0.0.1', 'localhost', '[::1]'].includes(h.endsWith(want) ? h.slice(0, -want.length) : '')) {
+    return { code: 403, body: { error: 'forbidden host' } };
+  }
+  const path = (req.url || '').split('?', 1)[0];
+  if (path.startsWith('/api/')) {
+    const site = req.headers['sec-fetch-site'];
+    const origin = req.headers.origin;
+    if (site === 'cross-site' || site === 'same-site'
+        || (origin !== undefined && origin !== `http://${host}`)) {
+      return { code: 403, body: { error: 'forbidden origin' } };
+    }
+  }
+  if (req.method !== 'GET') {
+    const got = Buffer.from(String(req.headers['x-geneseed-token'] ?? ''), 'utf-8');
+    const want = Buffer.from(token, 'utf-8');
+    if (got.length !== want.length || !timingSafeEqual(got, want)) {
+      return { code: 403, body: { error: 'forbidden' } };
+    }
+  }
+  return null;
+}
+
 const GZIP_TYPES = ['application/json', 'text/', 'image/svg+xml',
   'application/manifest+json', 'application/javascript'];
 const GZIP_MIN = 1024;
@@ -74,7 +133,8 @@ export function makeHandler(state, jm, token, dist, holder = null) {
   // page stayed blank with nothing logged on either side.
   const distReal = resolvePath(dist);
 
-  function sendBytes(res, body, ctype, code = 200, extra = null, acceptEncoding = '', gzStore = null) {
+  function sendBytes(res, body, ctype, code = 200, extra = null, acceptEncoding = '', gzStore = null,
+    nonce = randomBytes(16).toString('base64')) {
     const headers = { ...(extra || {}) };
     if (body.length >= GZIP_MIN && GZIP_TYPES.some((t) => ctype.startsWith(t))
         && (acceptEncoding || '').includes('gzip')) {
@@ -86,6 +146,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       'Content-Type': ctype,
       'Content-Length': String(body.length),
       ...headers,
+      ...securityHeaders(nonce),
     });
     res.end(body);
   }
@@ -114,8 +175,10 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     }
     let data = entry.data;
     let extra = null;
+    // Fresh per response; for index.html the same value goes in the token script and its CSP.
+    const nonce = randomBytes(16).toString('base64');
     if (basename(fp) === 'index.html') {
-      const inject = Buffer.from(`<script>window.__GENESEED_TOKEN__="${token}";</script>`, 'utf-8');
+      const inject = Buffer.from(`<script nonce="${nonce}">window.__GENESEED_TOKEN__="${token}";</script>`, 'utf-8');
       data = replaceOnce(data, Buffer.from('</head>'), Buffer.concat([inject, Buffer.from('</head>')]));
       extra = { 'Cache-Control': 'no-store' };
       // The injected bytes differ from `entry.data`, so the gz cache must not serve them.
@@ -124,7 +187,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       extra = { 'Cache-Control': 'public, max-age=31536000, immutable' };
     }
     return sendBytes(res, data, CTYPES[extname(fp)] || 'application/octet-stream',
-      200, extra, acceptEncoding, entry);
+      200, extra, acceptEncoding, entry, nonce);
   }
 
   function doGet(req, res, path, ae) {
@@ -156,19 +219,6 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     return serveStatic(res, path, ae);
   }
 
-  /** The Host and token guards, answered BEFORE a byte of the body is read. `true` = refused. */
-  function refusePost(req, res, ae) {
-    if (!localHost(req.headers.host)) {
-      sendJson(res, { error: 'forbidden host' }, 403, ae);
-      return true;
-    }
-    if (req.headers['x-geneseed-token'] !== token) {
-      sendJson(res, { error: 'forbidden' }, 403, ae);
-      return true;
-    }
-    return false;
-  }
-
   function doPost(req, res, path, ae, body) {
     if (path === '/api/shutdown') {
       if (jm.busy) return sendJson(res, BUSY, 409, ae);
@@ -346,10 +396,13 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     const ae = req.headers['accept-encoding'] || '';
     const path = (req.url || '').split('?', 1)[0];
     try {
+      // GUARD FIRST, BODY SECOND: a refused request is DISCARDED (`resume`, nothing buffered).
+      const refused = requestGuard(req, token);
+      if (refused) {
+        sendJson(res, refused.body, refused.code, ae);
+        return req.resume();
+      }
       if (req.method === 'GET') {
-        if (!localHost(req.headers.host)) {
-          return sendJson(res, { error: 'forbidden host' }, 403, ae);
-        }
         try {
           return doGet(req, res, path, ae);
         } catch (e) {
@@ -363,13 +416,10 @@ export function makeHandler(state, jm, token, dist, holder = null) {
         }
       }
       if (req.method === 'POST') {
-        // GUARDS FIRST, BODY SECOND. The Host and token checks need no body, so they answer
-        // before one is read — a refused request is DISCARDED (`resume`, nothing buffered), never
-        // collected. A body over `MAX_BODY` is refused on its declared length, and the socket is
-        // closed rather than drained. Otherwise the body is buffered before routing regardless
+        // The guard above needed no body, so it answered before one was read. A body over
+        // `MAX_BODY` is refused on its declared length, and the socket is closed rather than drained. Otherwise the body is buffered before routing regardless
         // of what the route needs it for: Node's parser owns the message boundary, so unread
         // bytes are discarded when the response ends rather than mis-parsed as the next request.
-        if (refusePost(req, res, ae)) return req.resume();
         const length = parseIntStrict(String(req.headers['content-length'] ?? '')) ?? 0;
         if (length > MAX_BODY) {
           res.setHeader('Connection', 'close');
@@ -387,6 +437,9 @@ export function makeHandler(state, jm, token, dist, holder = null) {
             if (e instanceof NotFound) {
               return sendJson(res, { error: `not found: ${e.message}` }, 404, ae);
             }
+            // A body the route refused on its content (a rule body with a `## ` heading) is
+            // the caller's to fix: 400, not the 500 of a server fault.
+            if (e instanceof BadRequest) return sendJson(res, { error: e.message }, 400, ae);
             return sendJson(res, { error: String(e && e.message ? e.message : e) }, 500, ae);
           }
         });

package/js/web/jobs.mjs

@@ -44,10 +44,10 @@
  * `taskkill /T` is a machine primitive here, not this program.
  *
  * ---------------------------------------------------------------------------------------
- * THE ACTION SURFACE — `doctor`, `build`, `build-all`, `export`, `uninstall`, `update`,
- * `link` and `unlink` each name a verb `bin/geneseed-cli.mjs` runs, plus the three
- * `INLINE_ACTIONS` the dispatcher answers without the table. `tests/unit/web_jobs.test.mjs`
- * holds the union against a written-out list, so a ninth action cannot appear unchecked.
+ * THE ACTION SURFACE — `doctor`, `build`, `build-all`, `export`, `update`, `link` and
+ * `unlink` each name a verb `bin/geneseed-cli.mjs` runs, plus the three `INLINE_ACTIONS` the
+ * dispatcher answers without the table. `tests/unit/web_jobs.test.mjs` holds the union against
+ * a written-out list, so an eighth action cannot appear unchecked.
  *
  * ---------------------------------------------------------------------------------------
  * THREE DETAILS OF `_run`, EACH A COMMENT EXPLAINING A BUG IT ALREADY FIXED.
@@ -454,11 +454,11 @@ function actionTable({
     // by `js/maintain/update.mjs`.
     update: [[NODE(), CLI(), 'upgrade']],
     export: [[NODE(), CLI(), 'diff', '--out']],
-    // Local-machine maintenance, surfaced in the web Settings. uninstall keeps memory (never
-    // deleted) and runs non-interactively with --yes.
+    // Local-machine maintenance, surfaced in the web Settings. No `uninstall` row: it took no
+    // target, so it always fell back to the OpenCode global. The per-install remove is
+    // `installUninstall` in `js/web/actions.mjs`, bound to the (host, path) the panel shows.
     link: [[NODE(), CLI(), 'link']],
     unlink: [[NODE(), CLI(), 'unlink']],
-    uninstall: [[NODE(), CLI(), 'uninstall', '--yes']],
   };
 }
 

package/js/web/server.mjs

@@ -153,6 +153,10 @@ export async function serve({ theme = null, port = 4747, openBrowser = true,
   // Read by `/api/update`, whose background `git fetch` must not race a running update's pull.
   state.jobBusy = () => jm.busy;
   const srv = createServer(makeHandler(state, jm, token, dist, holder));
+  // A client trickling headers or a body (slowloris) would hold a socket forever otherwise; every
+  // real request here is a few KB from the same machine.
+  srv.requestTimeout = 30_000;
+  srv.headersTimeout = 10_000;
   holder.srv = srv;
   return new Promise((done) => {
     srv.on('error', () => {

package/js/web/user-files.mjs

@@ -19,7 +19,7 @@ import { WHITESPACE, codePointLength, stripWhitespace } from '../lib/text.mjs';
 import { splitLines } from '../lib/udiff.mjs';
 import { isFactName } from '../maintain/memory.mjs';
 import { apiMemoryDelete, bget, strOr } from './actions.mjs';
-import { NotFound, memoryDir } from './catalog.mjs';
+import { BadRequest, NotFound, memoryDir } from './catalog.mjs';
 
 /** Splits on runs of `WHITESPACE` (not `\s`), dropping empty strings. */
 const splitWords = (s) => s.split(new RegExp(`[${WHITESPACE}]+`)).filter(Boolean);
@@ -80,6 +80,14 @@ const RULE_HEAD_RE = new RegExp(
   + `([^${WHITESPACE}].*?)[${WHITESPACE}]*$`,
 );
 
+/**
+ * A line `parseRules` reads as the edge of a rule: `## ` ends the current block, and a
+ * `RULE_HEAD_RE` line opens one (a non-breaking space after `##` does the second, not the first).
+ * ONE predicate for both the parser and `ruleFields`, so a body the writer accepts can never
+ * split or forge a rule when read back.
+ */
+const isRuleEdge = (line) => line.startsWith('## ') || RULE_HEAD_RE.test(line);
+
 /** Advisory only; nothing blocks past it. */
 const RULES_BUDGET = { max_rules: 15, max_tokens: 1500 };
 
@@ -119,7 +127,7 @@ export function parseRules(text) {
     if (!m) continue;
     let end = lines.length;
     for (let j = idx + 1; j < lines.length; j += 1) {
-      if (lines[j].startsWith('## ')) { end = j; break; }
+      if (isRuleEdge(lines[j])) { end = j; break; }
     }
     const rid = Number(m[1]);
     if (seen.has(rid)) warnings.push(`duplicate rule id R${rid}`);
@@ -184,18 +192,27 @@ function ruleBlock(rid, title, scope, source, trialUntil, body) {
  * `\p{Nd}` here and not `\d`, unlike `RULE_HEAD_RE` above: this is a pure predicate over a
  * string that stays a string, so accepting any Unicode decimal digit costs nothing and
  * needs no numeric parse afterward.
+ *
+ * REFUSED, NEVER REWRITTEN: a body line that `isRuleEdge` reads would truncate this rule and
+ * could forge another rule's id, and a `|` in the scope or source would forge a metadata field. An
+ * unknown scope (`global`, written by hand) is kept as written — coercing it to `project` made
+ * every Edit or Graduate silently change the user's rule.
  */
 function ruleFields(body) {
   const title = splitWords(strOr(bget(body, 'title'))).join(' ');
   const text = stripWhitespace(strOr(bget(body, 'body')));
-  if (!title) throw new Error('a rule needs a title');
-  if (!text) throw new Error('a rule needs body text');
-  let scope = bget(body, 'scope');
-  if (scope !== 'user' && scope !== 'project') scope = 'project';
+  if (!title) throw new BadRequest('a rule needs a title');
+  if (!text) throw new BadRequest('a rule needs body text');
+  if (splitLines(text).some(isRuleEdge)) {
+    throw new BadRequest('a rule body cannot have a line that starts with "## " (a rule heading)');
+  }
+  const scope = splitWords(strOr(bget(body, 'scope'))).join(' ') || 'project';
+  if (scope.includes('|')) throw new BadRequest('a rule scope cannot contain "|"');
   const source = splitWords(strOr(bget(body, 'source'))).join(' ');
+  if (source.includes('|')) throw new BadRequest('a rule source cannot contain "|" (write it as "/")');
   const trial = stripWhitespace(strOr(bget(body, 'trial_until')));
   if (trial && !/^\p{Nd}{4}-\p{Nd}{2}-\p{Nd}{2}$/u.test(trial)) {
-    throw new Error('trial until must be YYYY-MM-DD');
+    throw new BadRequest('trial until must be YYYY-MM-DD');
   }
   return [title, text, scope, source, trial];
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "4.17.1",
+  "version": "4.17.2",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",

package/web/dist/assets/{Activity-DNVzYkIY.js → Activity-BvbzB-H1.js}

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{i as t,t as n}from"./react-DlYQp10C.js";import{t as r}from"./api-BfpZmUMI.js";import{$ as i,P as a,S as o,w as s,z as c}from"./index-BAArp8rX.js";import{a as l,i as u,n as d,o as f,r as p,t as m}from"./activity-Jw8XcPiP.js";import{t as h}from"./usePoll-bDFN-Hr6.js";var g=e(t(),1),_=n();function v({s:e}){let t=p[e.status]||p.idle,n=e.files,r=e.todos,i=r&&r.total>0||e.error||e.blocked_on;return(0,_.jsxs)(`a`,{className:`card pad-md act-card`,href:`#/activity/${encodeURIComponent(e.session_id)}`,children:[(0,_.jsxs)(`div`,{className:`row between wrap gap-12`,children:[(0,_.jsxs)(`div`,{className:`row gap-10`,style:{minWidth:0},children:[(0,_.jsx)(`span`,{className:`feed-dot ${t.cls||`acc`}`,style:{width:9,height:9}}),(0,_.jsxs)(`div`,{style:{minWidth:0},children:[(0,_.jsx)(`h3`,{style:{margin:0},children:e.title||l(e.cwd)||e.session_id}),e.cwd&&(0,_.jsx)(`div`,{className:`dim mono`,style:{fontSize:12,...m},title:e.cwd,children:e.cwd})]})]}),(0,_.jsxs)(`div`,{className:`row gap-8`,style:{flexShrink:0},children:[e.model&&(0,_.jsx)(`span`,{className:`badge mono`,title:`model`,children:e.model}),e.agent&&(0,_.jsx)(`span`,{className:`badge`,children:e.agent}),(0,_.jsxs)(`span`,{className:`badge ${t.cls}`,children:[(0,_.jsx)(`span`,{className:`dot`}),t.label]}),(0,_.jsx)(a,{name:`chevron`,className:`glyph act-chev`})]})]}),e.phase&&(0,_.jsxs)(`div`,{className:`row gap-8`,style:{marginTop:10,fontSize:14},children:[(0,_.jsx)(a,{name:`activity`}),(0,_.jsx)(`span`,{style:m,children:e.phase})]}),(e.tokens>0||e.cost>0||e.turn_started_at||n&&n.count>0)&&(0,_.jsxs)(`div`,{className:`row wrap`,style:{gap:16,marginTop:12,fontSize:13,color:`var(--text-2)`},children:[e.tokens>0&&(0,_.jsxs)(`span`,{children:[f(e.tokens),` tok`]}),e.cost>0&&(0,_.jsxs)(`span`,{children:[`$`,e.cost.toFixed(2)]}),e.turn_started_at?(0,_.jsx)(`span`,{children:(0,_.jsx)(d,{startedAt:e.turn_started_at})}):null,n&&n.count>0&&(0,_.jsxs)(`span`,{children:[n.count,` file`,n.count===1?``:`s`,` `,(0,_.jsxs)(`span`,{style:{color:`var(--good)`},children:[`+`,n.additions]}),` `,(0,_.jsxs)(`span`,{style:{color:`var(--bad)`},children:[`−`,n.deletions]})]})]}),i&&(0,_.jsxs)(`div`,{className:`row between wrap gap-12`,style:{marginTop:12,paddingTop:10,borderTop:`1px solid var(--line)`},children:[r&&r.total>0?(0,_.jsxs)(`span`,{className:`row gap-8 dim`,style:{fontSize:13},children:[(0,_.jsx)(u,{done:r.done,total:r.total}),`plan `,r.done,`/`,r.total]}):(0,_.jsx)(`span`,{}),e.error?(0,_.jsx)(`span`,{className:`badge bad`,title:e.error,style:{maxWidth:300,...m},children:e.error}):e.blocked_on?(0,_.jsx)(`span`,{className:`badge bad`,title:e.blocked_on,style:{maxWidth:300,...m},children:e.blocked_on}):null]}),(0,_.jsxs)(`div`,{className:`dim mono`,style:{fontSize:11,marginTop:8},children:[`updated `,c(e.updated_at),` ago`]})]})}function y(){let[e,t]=(0,g.useState)(null),[n,a]=(0,g.useState)(``);h(e=>r.activity().then(n=>{e()&&(t(n),a(``))},t=>{e()&&a(t.message)}),2e3,[]);let c=!e||e.enabled!==!1,l=e?.activity||[],u=i(),d=async()=>{let e=!c;try{let n=await r.activityToggle(e);t(e=>({...e||{},enabled:n.enabled,activity:n.enabled&&e?.activity||[]})),a(``)}catch(e){a(e.message)}};return(0,_.jsxs)(`div`,{className:`narrow`,children:[(0,_.jsxs)(`div`,{className:`head-row mb-16`,children:[(0,_.jsxs)(`div`,{children:[(0,_.jsx)(`h1`,{className:`h`,children:`Activity`}),(0,_.jsx)(`p`,{className:`sub`,children:`Live OpenCode sessions this harness is running: what each one is doing right now. Refreshes every couple of seconds; sessions drop off when their process exits.`})]}),(0,_.jsxs)(`div`,{className:`row gap-10`,style:{alignItems:`center`,flexShrink:0},children:[(0,_.jsx)(`span`,{className:`dim mono`,style:{fontSize:12},children:c?`tracking on`:`tracking off`}),(0,_.jsx)(`div`,{className:`sw-toggle${c?` on`:``}`,role:`switch`,"aria-checked":c,"aria-label":`Toggle activity tracking`,tabIndex:0,onClick:d,onKeyDown:e=>{(e.key===`Enter`||e.key===` `)&&(e.key===` `&&e.preventDefault(),d())}})]})]}),(0,_.jsx)(o,{error:n,style:{marginBottom:12}}),e?c?l.length===0?(0,_.jsxs)(`div`,{className:`empty`,children:[(0,_.jsx)(`div`,{className:`big`,children:`No active sessions`}),`Run `,(0,_.jsx)(`code`,{children:`opencode`}),` and the sessions it spins up appear here.`]}):(0,_.jsx)(`div`,{className:`stack gap-12`,ref:u,children:l.map(e=>(0,_.jsx)(`div`,{"data-flip":e.session_id,children:(0,_.jsx)(v,{s:e})},e.session_id))}):(0,_.jsxs)(`div`,{className:`empty`,children:[(0,_.jsx)(`div`,{className:`big`,children:`Activity tracking is off`}),`The plugin isn't recording sessions. Flip the switch to turn it back on.`]}):(0,_.jsx)(s,{label:`Reading live sessions…`})]})}export{y as default};
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{i as t,t as n}from"./react-DlYQp10C.js";import{t as r}from"./api-BfpZmUMI.js";import{$ as i,P as a,S as o,w as s,z as c}from"./index-D-cBvfU2.js";import{a as l,i as u,n as d,o as f,r as p,t as m}from"./activity-Jw8XcPiP.js";import{t as h}from"./usePoll-bDFN-Hr6.js";var g=e(t(),1),_=n();function v({s:e}){let t=p[e.status]||p.idle,n=e.files,r=e.todos,i=r&&r.total>0||e.error||e.blocked_on;return(0,_.jsxs)(`a`,{className:`card pad-md act-card`,href:`#/activity/${encodeURIComponent(e.session_id)}`,children:[(0,_.jsxs)(`div`,{className:`row between wrap gap-12`,children:[(0,_.jsxs)(`div`,{className:`row gap-10`,style:{minWidth:0},children:[(0,_.jsx)(`span`,{className:`feed-dot ${t.cls||`acc`}`,style:{width:9,height:9}}),(0,_.jsxs)(`div`,{style:{minWidth:0},children:[(0,_.jsx)(`h3`,{style:{margin:0},children:e.title||l(e.cwd)||e.session_id}),e.cwd&&(0,_.jsx)(`div`,{className:`dim mono`,style:{fontSize:12,...m},title:e.cwd,children:e.cwd})]})]}),(0,_.jsxs)(`div`,{className:`row gap-8`,style:{flexShrink:0},children:[e.model&&(0,_.jsx)(`span`,{className:`badge mono`,title:`model`,children:e.model}),e.agent&&(0,_.jsx)(`span`,{className:`badge`,children:e.agent}),(0,_.jsxs)(`span`,{className:`badge ${t.cls}`,children:[(0,_.jsx)(`span`,{className:`dot`}),t.label]}),(0,_.jsx)(a,{name:`chevron`,className:`glyph act-chev`})]})]}),e.phase&&(0,_.jsxs)(`div`,{className:`row gap-8`,style:{marginTop:10,fontSize:14},children:[(0,_.jsx)(a,{name:`activity`}),(0,_.jsx)(`span`,{style:m,children:e.phase})]}),(e.tokens>0||e.cost>0||e.turn_started_at||n&&n.count>0)&&(0,_.jsxs)(`div`,{className:`row wrap`,style:{gap:16,marginTop:12,fontSize:13,color:`var(--text-2)`},children:[e.tokens>0&&(0,_.jsxs)(`span`,{children:[f(e.tokens),` tok`]}),e.cost>0&&(0,_.jsxs)(`span`,{children:[`$`,e.cost.toFixed(2)]}),e.turn_started_at?(0,_.jsx)(`span`,{children:(0,_.jsx)(d,{startedAt:e.turn_started_at})}):null,n&&n.count>0&&(0,_.jsxs)(`span`,{children:[n.count,` file`,n.count===1?``:`s`,` `,(0,_.jsxs)(`span`,{style:{color:`var(--good)`},children:[`+`,n.additions]}),` `,(0,_.jsxs)(`span`,{style:{color:`var(--bad)`},children:[`−`,n.deletions]})]})]}),i&&(0,_.jsxs)(`div`,{className:`row between wrap gap-12`,style:{marginTop:12,paddingTop:10,borderTop:`1px solid var(--line)`},children:[r&&r.total>0?(0,_.jsxs)(`span`,{className:`row gap-8 dim`,style:{fontSize:13},children:[(0,_.jsx)(u,{done:r.done,total:r.total}),`plan `,r.done,`/`,r.total]}):(0,_.jsx)(`span`,{}),e.error?(0,_.jsx)(`span`,{className:`badge bad`,title:e.error,style:{maxWidth:300,...m},children:e.error}):e.blocked_on?(0,_.jsx)(`span`,{className:`badge bad`,title:e.blocked_on,style:{maxWidth:300,...m},children:e.blocked_on}):null]}),(0,_.jsxs)(`div`,{className:`dim mono`,style:{fontSize:11,marginTop:8},children:[`updated `,c(e.updated_at),` ago`]})]})}function y(){let[e,t]=(0,g.useState)(null),[n,a]=(0,g.useState)(``);h(e=>r.activity().then(n=>{e()&&(t(n),a(``))},t=>{e()&&a(t.message)}),2e3,[]);let c=!e||e.enabled!==!1,l=e?.activity||[],u=i(),d=async()=>{let e=!c;try{let n=await r.activityToggle(e);t(e=>({...e||{},enabled:n.enabled,activity:n.enabled&&e?.activity||[]})),a(``)}catch(e){a(e.message)}};return(0,_.jsxs)(`div`,{className:`narrow`,children:[(0,_.jsxs)(`div`,{className:`head-row mb-16`,children:[(0,_.jsxs)(`div`,{children:[(0,_.jsx)(`h1`,{className:`h`,children:`Activity`}),(0,_.jsx)(`p`,{className:`sub`,children:`Live OpenCode sessions this harness is running: what each one is doing right now. Refreshes every couple of seconds; sessions drop off when their process exits.`})]}),(0,_.jsxs)(`div`,{className:`row gap-10`,style:{alignItems:`center`,flexShrink:0},children:[(0,_.jsx)(`span`,{className:`dim mono`,style:{fontSize:12},children:c?`tracking on`:`tracking off`}),(0,_.jsx)(`div`,{className:`sw-toggle${c?` on`:``}`,role:`switch`,"aria-checked":c,"aria-label":`Toggle activity tracking`,tabIndex:0,onClick:d,onKeyDown:e=>{(e.key===`Enter`||e.key===` `)&&(e.key===` `&&e.preventDefault(),d())}})]})]}),(0,_.jsx)(o,{error:n,style:{marginBottom:12}}),e?c?l.length===0?(0,_.jsxs)(`div`,{className:`empty`,children:[(0,_.jsx)(`div`,{className:`big`,children:`No active sessions`}),`Run `,(0,_.jsx)(`code`,{children:`opencode`}),` and the sessions it spins up appear here.`]}):(0,_.jsx)(`div`,{className:`stack gap-12`,ref:u,children:l.map(e=>(0,_.jsx)(`div`,{"data-flip":e.session_id,children:(0,_.jsx)(v,{s:e})},e.session_id))}):(0,_.jsxs)(`div`,{className:`empty`,children:[(0,_.jsx)(`div`,{className:`big`,children:`Activity tracking is off`}),`The plugin isn't recording sessions. Flip the switch to turn it back on.`]}):(0,_.jsx)(s,{label:`Reading live sessions…`})]})}export{y as default};