geneseed 4.4.1 → 4.6.0

package/js/hosts/settings.mjs

@@ -145,7 +145,8 @@ const LAW_IV_BASH = ['git push --force*', 'git push -f*', 'git push *--force*',
  * `-u origin`/`--set-upstream origin`/any remote through its leading `*`; the second key covers
  * the `refs/heads/` spelling the same way.
  *
- * ORDER IS LOAD-BEARING. `defaultPermission` appends these AFTER `git push*`'s ask (so a loop
+ * ORDER IS LOAD-BEARING. `PUSH_CHAIN` (which `defaultPermission` and `OWNED_BASH` both read)
+ * puts these AFTER `git push*`'s ask (so a loop
  * push is not swallowed by the blanket consent ask) and BEFORE `LAW_IV_BASH` (so `findLast`
  * — OpenCode's own `permission.bash` evaluator — lets a force push, a `+refspec`, or a
  * `--delete`/bare-`:` push still ask even when the target is `loop/*`; those LAW_IV_BASH keys
@@ -222,18 +223,22 @@ const LOOP_PUSH_ASK_FLAG_EXTRA = [
 ];
 const LOOP_PUSH_ASK_TRAILING = ['git push * HEAD:loop/* ?*', 'git push * HEAD:refs/heads/loop/* ?*'];
 
+/**
+ * The tiers after `git push*`, in the `findLast` order the docblocks above depend on — ONE
+ * ordered table, so `defaultPermission` and `OWNED_BASH` cannot disagree about it.
+ */
+const PUSH_CHAIN = [
+  [LOOP_PUSH_ALLOW, 'allow'], [LOOP_PUSH_ASK_EXTRA, 'ask'], [LOOP_PUSH_ALLOW_FLAG, 'allow'],
+  [LOOP_PUSH_ASK_FLAG_EXTRA, 'ask'], [LOOP_PUSH_ASK_TRAILING, 'ask'], [LAW_IV_BASH, 'ask'],
+];
+
 function defaultPermission(doctrines = null, excluded = []) {
   const bash = { 'rm -rf *': 'ask' };
   if (consentRuleOn(doctrines, excluded)) {
     bash['git commit*'] = 'ask';
     bash['git push*'] = 'ask';
   }
-  for (const k of LOOP_PUSH_ALLOW) bash[k] = 'allow';
-  for (const k of LOOP_PUSH_ASK_EXTRA) bash[k] = 'ask';
-  for (const k of LOOP_PUSH_ALLOW_FLAG) bash[k] = 'allow';
-  for (const k of LOOP_PUSH_ASK_FLAG_EXTRA) bash[k] = 'ask';
-  for (const k of LOOP_PUSH_ASK_TRAILING) bash[k] = 'ask';
-  for (const k of LAW_IV_BASH) bash[k] = 'ask';
+  for (const [keys, verdict] of PUSH_CHAIN) for (const k of keys) bash[k] = verdict;
   return { bash };
 }
 
@@ -245,8 +250,7 @@ function defaultPermission(doctrines = null, excluded = []) {
  * the pack returns, and to name it when this build no longer wants it but will not remove it.
  */
 const OWNED_BASH = ['rm -rf *', 'git commit*', 'git push*',
-  ...LOOP_PUSH_ALLOW, ...LOOP_PUSH_ASK_EXTRA, ...LOOP_PUSH_ALLOW_FLAG, ...LOOP_PUSH_ASK_FLAG_EXTRA,
-  ...LOOP_PUSH_ASK_TRAILING, ...LAW_IV_BASH];
+  ...PUSH_CHAIN.flatMap(([keys]) => keys)];
 
 /**
  * Bring an ALREADY-WRITTEN `permission` block back into line with the pack selection, and
@@ -626,7 +630,8 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
     // skill reconcile above never ran either — the unwired skill denies are folded into THIS
     // one WARN rather than going unmentioned (a dedicated `skillOpaque` needs `perm` to be a
     // dict to even look at `perm.skill`, which this case by definition is not).
-    const names = [...OWNED_BASH.filter((k) => has(defaultPermission(doctrines, excluded).bash, k)),
+    const wanted = defaultPermission(doctrines, excluded).bash;
+    const names = [...OWNED_BASH.filter((k) => has(wanted, k)),
       ...(!permIsObject ? skillNames : [])];
     process.stderr.write(`[geneseed] WARN: "permission" in ${path.basename(target)} `
       + `${opaque}, so Geneseed cannot wire its own gates into it — including `
@@ -1236,7 +1241,8 @@ export function managedBlockRead(p, blockId = 'GENESEED') {
   return stripNewlines(inner.slice(0, inner.indexOf(end)));
 }
 
-function lstripNewlines(s) {
+/** `str.lstrip("\n")`; the one copy — `native.mjs` and `opencode.mjs` import it from here. */
+export function lstripNewlines(s) {
   return s.replace(/^\n+/, '');
 }
 

package/js/hosts/shim.mjs

@@ -9,8 +9,9 @@
  * `js/build/driver.mjs`, and through it the whole generator, for the two-line
  * `hookRunnerEntry`, which now lives here beside the `hookPrefix` that consumes its answer.
  *
- * Keep this module's imports to `node:` builtins, `js/lib/fs.mjs` and `./hosts.mjs`: being
- * cheap to load is its whole reason to exist.
+ * Keep this module's imports to `node:` builtins, `js/lib/fs.mjs`, `./hosts.mjs` and
+ * `./hooks-prims.mjs` (whose only import, `js/lib/paths.mjs`, `./hosts.mjs` already loads):
+ * being cheap to load is its whole reason to exist.
  */
 import {
   chmodSync, existsSync, mkdirSync, realpathSync, renameSync, statSync, writeFileSync,
@@ -19,6 +20,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { readText, isOsError } from '../lib/fs.mjs';
 import { expanduser } from './hosts.mjs';
+import { isFile } from './hooks-prims.mjs';
 
 /** The checkout this module ships in — `js/build/source.mjs`'s `ROOT`, computed locally so the
  * shim does not import the source loader. */
@@ -118,14 +120,18 @@ export function shimDead() {
  */
 export function hookShimBody(runner, entry, platform = process.platform) {
   if (platform === 'win32') {
-    // Bare `exit /b` propagates the LIVE errorlevel; `%ERRORLEVEL%` would expand at parse
-    // time and return a stale one. Never plain `exit` — that kills the parent cmd.exe, so
+    // `exit /b %ERRORLEVEL%`, on its OWN line. A bare `exit /b` was here, on the claim that it
+    // propagates the live errorlevel, and that is false under `cmd /d /s /c` — Bob's hook
+    // shell, and Node's `shell: true`: the batch returned 0 after the gate exited 2, so every
+    // Bob block on Windows went through (#290; measured, see hook_form.test.mjs). `%ERRORLEVEL%`
+    // expands when ITS line is parsed, which is after the runner line has finished, so the value
+    // is the runner's, not a stale one. Never plain `exit` — that kills the parent cmd.exe, so
     // the emitted `|| exit 0` would never get to evaluate.
     return '@echo off\r\n'
       + 'rem Generated by Geneseed - do not edit. Rewritten on every emit.\r\n'
       + 'setlocal\r\n'
       + `"${runner}" "${entry}" %*\r\n`
-      + 'exit /b\r\n';
+      + 'exit /b %ERRORLEVEL%\r\n';
   }
   return '#!/bin/sh\n'
     + '# Generated by Geneseed - do not edit. Rewritten on every emit.\n'
@@ -281,18 +287,26 @@ const GIT_BASH_NAMES = new Set(['bash.exe', 'sh.exe', 'bash', 'sh']);
  */
 export function claudeHookShell(env = process.env, platform = process.platform) {
   if (platform !== 'win32') return 'bash';
+  return claudeGitBashPath(env) ? 'bash' : 'powershell';
+}
+
+/**
+ * The Git Bash `claudeHookShell` finds on Windows, as a path — or null. One rule, two readers:
+ * the emit only needs to know WHETHER, `doctor --probe` (`js/inspect/checks-probe.mjs`) needs
+ * the file itself, to run a gate through the same shell Claude would.
+ */
+export function claudeGitBashPath(env = process.env) {
   const read = (name) => Object.entries(env).find(([k]) => k.toUpperCase() === name)?.[1];
-  const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
   const forced = read('CLAUDE_CODE_GIT_BASH_PATH');
   if (forced && GIT_BASH_NAMES.has(path.basename(forced).toLowerCase()) && isFile(forced)) {
-    return 'bash';
+    return forced;
   }
   for (const raw of (read('PATH') || '').split(';')) {
     const dir = raw.replace(/"/g, '');
-    if (dir && isFile(path.join(dir, 'git.exe'))
-      && isFile(path.join(dir, '..', 'bin', 'bash.exe'))) return 'bash';
+    const bash = dir ? path.join(dir, '..', 'bin', 'bash.exe') : '';
+    if (dir && isFile(path.join(dir, 'git.exe')) && isFile(bash)) return path.resolve(bash);
   }
-  return 'powershell';
+  return null;
 }
 
 /**

package/js/hosts/usage.mjs

@@ -26,8 +26,9 @@ const NAME_RE = /^[A-Za-z0-9][\w.:@/-]{0,99}$/;
 /**
  * `{kind, name}` for a skill or subagent call, else null. Reads the Claude shape (`tool_name` /
  * `tool_input`: `Skill` → `skill`, `Agent` or the older `Task` → `subagent_type`), OpenCode's
- * (`skill` → `name`, `task` → `subagent_type`) and, best-effort, Bob's (`tool` / `input`, any
- * tool whose name contains "skill"): Bob's skill tool name is unverified, no Bob runs here.
+ * (`skill` → `name`, `task` → `subagent_type`; V2 hooks see the pre-alias `subagent` → `agent`)
+ * and, best-effort, Bob's (`tool` / `input`, any tool whose name contains "skill"): Bob's skill
+ * tool name is unverified, no Bob runs here.
  */
 export function usageOf(payload) {
   if (!payload || typeof payload !== 'object') return null;
@@ -38,7 +39,7 @@ export function usageOf(payload) {
   if (!tool.startsWith('mcp') && tool.includes('skill')) {
     kind = 'skill';
     name = ti.skill ?? ti.name ?? ti.skill_name;
-  } else if (tool === 'agent' || tool === 'task') {
+  } else if (tool === 'agent' || tool === 'task' || tool === 'subagent') {
     kind = 'agent';
     name = ti.subagent_type ?? ti.agent;
   }

package/js/inspect/checks-authoring.mjs

@@ -14,8 +14,10 @@
  */
 import path from 'node:path';
 import { PLUGIN_SRC, SRC } from '../build/source.mjs';
+import { HOSTS } from '../hosts/hosts.mjs';
 import { descBlockProblem, firstBlockquote } from '../hosts/native.mjs';
 import { readText } from '../lib/fs.mjs';
+import { blankCodeSpans } from '../lib/text.mjs';
 import { which } from '../lib/paths.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
 import {
@@ -25,15 +27,15 @@ import {
 import { constitutionProblems, leanBlockProblems } from './checks-constitution.mjs';
 import { countTableProblems } from './checks-counts.mjs';
 import { catalogProblems } from '../loop/catalog.mjs';
-import { blankCodeSpans, globSorted, isDir, isFile, rglob } from './scan.mjs';
+import { globSorted, isDir, isFile, rglob } from './scan.mjs';
 import { spawnSync } from 'node:child_process';
 
-// The four harness ids `js/web/docs.mjs`'s `HARNESS_OPEN_RE` accepts, comma-separated, in its
-// own `HARNESSES` constant. Not imported: `js/web/docs.mjs` pulls in the web daemon's CLI
-// reference, status and update modules, and `inspect/` has no existing import from `web/` to
-// extend — paying that weight on every `doctor --all` for one id list is not "cheap" reuse.
-// Inlined instead, so it must be kept in step by hand if `HARNESSES` ever changes.
-const HARNESS_IDS = 'opencode|claude|openclaude|bob';
+// The harness ids `js/web/docs.mjs`'s `HARNESS_OPEN_RE` accepts — its `HARNESSES`, keyed by the
+// same host ids as `HOSTS`. Not imported from there: `js/web/docs.mjs` pulls in the web daemon's
+// CLI reference, status and update modules, a weight every `doctor --all` would pay for one id
+// list. `HOSTS` is the ids' own home and already in doctor's import closure. Alternation order
+// does not matter: the pattern is anchored at both ends.
+const HARNESS_IDS = HOSTS.map((h) => h.host).join('|');
 
 /**
  * The comment bodies (trimmed) that are known to be FUNCTIONAL — consumed by the render, a

package/js/inspect/checks-constitution.mjs

@@ -170,12 +170,12 @@ const DOCTRINE_TOKEN_RE = /\{\{DOCTRINE(?:\}\}|:)/;
  * The rules the hooks enforce at the tool boundary, and the address each is bound to there. The
  * hook path cannot afford to read the canon on every tool call, so its gate-ledger keys
  * (`law-1`, `law-4`, `process-1`, `process-5`, `rigor-5`, `ops-2` in `js/hosts/hooks.mjs` and the OpenCode guard
- * plugin), `CONSENT_RULE` in `js/hosts/settings.mjs` and the console's `HOOK_GATED` stay
+ * plugin; `law-3` in the done gate, `js/hosts/hooks-done.mjs`), `CONSENT_RULE` in `js/hosts/settings.mjs` and the console's `HOOK_GATED` stay
  * number-keyed — and this pin is what turns a renumber that moves one of these rules into a
  * doctor failure instead of a gate silently guarding its neighbour.
  */
 export const HOOK_PINNED = {
-  'sealed-secrets': 'I', 'deletion-is-deliberate': 'IV',
+  'sealed-secrets': 'I', 'verify-before-asserting': 'III', 'deletion-is-deliberate': 'IV',
   'persist-insight': 'process 1', 'consent-before-push': 'process 5', 'external-gate': 'rigor 5',
   'commands-must-return': 'ops 2',
 };

package/js/inspect/checks-probe.mjs

@@ -0,0 +1,292 @@
+/**
+ * `geneseed doctor --probe` — prove each installed gate still REFUSES, not just that it exists.
+ *
+ * A gate that is registered, launches and then allows everything looks exactly like a working
+ * one: `onFailure: "block"` (ADR 0007) covers a gate that never starts, `shimProblems` covers the
+ * shim's paths and `hookShellProblems` infers shell drift — none of them observes a verdict. So
+ * this runs each live install's own gate command, AS ITS SETTINGS SPELL IT, through the shell
+ * the host would use, on two canned payloads: one Law IV call that every build must refuse
+ * (`git reset --hard HEAD`, also in Bob's `BLOCK_RULES`) and one that must pass (`git status`).
+ * Both directions are judged, because "allows everything" and "refuses everything" (the
+ * PowerShell-fallback case `hookShellProblems` can only infer) are both broken gates.
+ *
+ * WHY THIS SPAWNS, and why it is opt-in. ADR 0002 allows a CLI spawn only as a declared row of
+ * `ALLOWED_SPAWNS` (`tests/unit/hook_cli.test.mjs`); this is the row that runs INSTALLED code
+ * rather than the checkout's, which is why it waits for `--probe` instead of riding every
+ * `doctor`. It runs only a command that `liveRecordedHooks` returns — recorded in our own
+ * manifest AND live in the settings — and that still carries `geneseed-hook`, a gate verb and
+ * `--root`; anything else is reported and never run. Nothing the payloads name is executed:
+ * the gate only reads them, from an empty temp dir.
+ *
+ * WHAT A PASS DOES NOT CLAIM. The probe runs under doctor's environment — this terminal's PATH
+ * and HOME — not the host app's. A host launched with a different environment (an empty HOME, a
+ * PATH without the shell's tools) can still break a gate that passes here.
+ *
+ * `GENESEED_GATE_PROBE=1` keeps the probe's asks out of the gate ledger (`ledger()` in
+ * `js/hosts/hooks.mjs`), so `status` never counts a doctor run as a refusal.
+ */
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { liveRecordedHooks } from '../hosts/hosts.mjs';
+import { claudeCfg, installState, installTargets } from '../hosts/installs.mjs';
+import { SHIM_MARK, claudeGitBashPath } from '../hosts/shim.mjs';
+import { which } from '../lib/paths.mjs';
+import { NO_WINDOW } from '../lib/proc.mjs';
+import { NOTE, withTempDir, withTempDirAsync } from './scan.mjs';
+import { spawnSync } from 'node:child_process';
+
+/**
+ * The gate that refuses Law IV on each host (`claudeHookGroups`, `js/hosts/settings.mjs`). On
+ * Claude and OpenClaude it is `git-gate`; `tool-gate` there only counts Skill/Agent calls. Bob
+ * runs everything through `tool-gate --host bob`. OpenCode's guard is an in-process plugin with
+ * no command: `guardProbe` below imports it instead.
+ */
+const PROBED_VERB = { claude: 'git-gate', openclaude: 'git-gate', bob: 'tool-gate' };
+
+export const BAD_COMMAND = 'git reset --hard HEAD';
+export const GOOD_COMMAND = 'git status';
+
+const PROBE_TIMEOUT_MS = 20_000;
+
+/** A PreToolUse payload in Claude's shape — the shape every probed host's gate reads. */
+function probePayload(command, cwd) {
+  return JSON.stringify({
+    session_id: 'geneseed-probe', hook_event_name: 'PreToolUse', tool_name: 'Bash',
+    tool_input: { command }, cwd,
+  });
+}
+
+/**
+ * The shell a host runs this handler under, as `{ exe, argv, label, verbatim }` — or null when
+ * that shell is not on this machine. Mirrors the emit's own rule: an explicit
+ * `shell: "powershell"` wins; Bob runs `cmd /c` on Windows; Claude/OpenClaude run Git Bash
+ * there (`claudeGitBashPath`, the rule `claudeHookShell` uses); `sh -c` everywhere else.
+ */
+function probeShell(host, handler, platform = process.platform, env = process.env) {
+  const cmd = handler.command;
+  if (handler.shell === 'powershell') {
+    const ps = which('powershell') || which('pwsh');
+    return ps ? { exe: ps, argv: ['-NoProfile', '-NonInteractive', '-Command', cmd], label: 'PowerShell' }
+      : null;
+  }
+  if (platform !== 'win32') return { exe: which('sh') || '/bin/sh', argv: ['-c', cmd], label: 'sh' };
+  if (host === 'bob') {
+    // `/s /c "<cmd>"` with verbatim arguments: cmd strips the outer quotes and keeps the
+    // command's own quoting. Node's default quoting would turn its `"` into `\"`, which cmd
+    // does not unescape.
+    const cmdExe = env.ComSpec || env.COMSPEC || which('cmd');
+    return cmdExe ? { exe: cmdExe, argv: ['/d', '/s', '/c', `"${cmd}"`], label: 'cmd', verbatim: true }
+      : null;
+  }
+  const bash = claudeGitBashPath(env);
+  return bash ? { exe: bash, argv: ['-c', cmd], label: 'Git Bash' } : null;
+}
+
+const ASK_RE = /"permissionDecision":\s*"(?:ask|deny)"/;
+
+/** Did the gate refuse? Exit 2 on Bob; on Claude-shaped hosts exit 2 or an ask/deny verdict. */
+export function refused(host, r) {
+  if (host === 'bob') return r.status === 2;
+  return r.status === 2 || (r.status === 0 && ASK_RE.test(r.stdout || ''));
+}
+
+/**
+ * The verdict for one gate, from its two runs — null when the gate is sound, or the problem.
+ * Pure, so the whole verdict table is pinned without spawning.
+ */
+export function probeVerdict(host, bad, good) {
+  for (const r of [bad, good]) {
+    if (r.status !== 0 && r.status !== 2) {
+      const why = r.error ? r.error : `exit ${r.status}`;
+      const tail = (r.stderr || '').trim().split(/\r?\n/).pop();
+      return `does not run (${why}${tail ? `: ${tail}` : ''})${host === 'claude'
+        ? ' — Claude blocks every matching call while this lasts (onFailure: block)'
+        : ' — the host lets every call through while this lasts'}`;
+    }
+  }
+  if (!refused(host, bad)) return `registered but not refusing — \`${BAD_COMMAND}\` went through`;
+  if (refused(host, good)) return `refuses everything — \`${GOOD_COMMAND}\` was refused too`;
+  return null;
+}
+
+/** Is this recorded command one of ours for `verb`? A gate verb, `--root`, and our shim. */
+export function isOurGate(command, verb) {
+  return command.includes(` ${verb} --root`) && command.includes(SHIM_MARK);
+}
+
+/** One spawn of one handler on one payload. THE ONE SPAWN of this module. */
+function runOnce(shell, payload, cwd, env) {
+  const r = spawnSync(shell.exe, shell.argv, {
+    input: payload, cwd, env, encoding: 'utf-8', timeout: PROBE_TIMEOUT_MS,
+    windowsVerbatimArguments: Boolean(shell.verbatim), ...NO_WINDOW,
+  });
+  const e = /** @type {NodeJS.ErrnoException | undefined} */ (r.error);
+  const error = e ? (e.code === 'ETIMEDOUT' ? 'timed out' : e.message) : null;
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr, error };
+}
+
+/**
+ * Probe every live Claude-shaped install. Returns `{ problems, probed }`: `problems` in
+ * doctor's line format, `probed` the labels of the gates that ran and behaved.
+ * `targets`, `platform` and `env` are parameters so a test hands it a sandboxed install.
+ */
+export function gateProbe(targets = installTargets(), { platform = process.platform, env = process.env } = {}) {
+  const problems = [];
+  const probed = [];
+  for (const [host, scope, root] of targets) {
+    const verb = PROBED_VERB[host];
+    if (!verb || installState(root, host, scope) !== 'active') continue;
+    const cfg = claudeCfg(root, scope, host);
+    const gates = liveRecordedHooks(cfg)
+      .filter(([event, h]) => event === 'PreToolUse' && h.command.includes(` ${verb} --root`));
+    if (!gates.length) {
+      problems.push(`[probe] ${cfg}: no live ${verb} hook in its settings — nothing refuses `
+        + 'a destructive call at the boundary — run: geneseed rebuild-all');
+      continue;
+    }
+    for (const [, handler] of gates) {
+      const label = `[probe] ${cfg}: ${verb}`;
+      if (!isOurGate(handler.command, verb)) {
+        problems.push(`${label} not probed — its command does not run ${SHIM_MARK}, and doctor `
+          + 'runs nothing else from a settings file');
+        continue;
+      }
+      const shell = probeShell(host, handler, platform, env);
+      if (!shell) {
+        problems.push(`${label} does not run — the shell ${host} would use is not on this machine`);
+        continue;
+      }
+      const verdict = withTempDir((tmp) => {
+        const runEnv = { ...env, GENESEED_GATE_PROBE: '1', CLAUDE_PROJECT_DIR: tmp };
+        const bad = runOnce(shell, probePayload(BAD_COMMAND, tmp), tmp, runEnv);
+        const good = runOnce(shell, probePayload(GOOD_COMMAND, tmp), tmp, runEnv);
+        return probeVerdict(host, bad, good);
+      }, 'geneseed-probe-');
+      if (verdict) problems.push(`${label} under ${shell.label} ${verdict}`);
+      else probed.push(`${path.normalize(cfg)} (${verb}, ${shell.label})`);
+    }
+  }
+  return { problems, probed };
+}
+
+// ---- OpenCode: the guard plugin, probed in-process ------------------------------------------
+
+const GUARD_PLUGIN = 'geneseed-guard.js';
+/** The guard blocks catastrophic shell (`SHELL_BLOCK_RE`); destructive git is the permission
+ * prompt's job there, and only WARNS in the guard — so its must-refuse payload is this one. */
+const GUARD_BAD_COMMAND = 'rm -rf /';
+
+/** The guard plugin of an OpenCode install: `<global>/plugins/` or `<repo>/.opencode/plugins/`
+ * (`emitOpencodeInto` copies the plugins to `<dir>/plugins`). */
+export function guardPluginPath(root, scope) {
+  return path.join(scope === 'global' ? root : path.join(root, '.opencode'), 'plugins', GUARD_PLUGIN);
+}
+
+/** Run `fn` with stderr swallowed and `GENESEED_GATE_PROBE` set, both restored after. */
+async function quietProbe(fn) {
+  const write = process.stderr.write;
+  const saved = process.env.GENESEED_GATE_PROBE;
+  process.stderr.write = () => true;
+  process.env.GENESEED_GATE_PROBE = '1';
+  try { return await fn(); } finally {
+    process.stderr.write = write;
+    if (saved === undefined) delete process.env.GENESEED_GATE_PROBE;
+    else process.env.GENESEED_GATE_PROBE = saved;
+  }
+}
+
+/**
+ * Both plugin APIs, each on both payloads: `{ v1: [badRefused, goodRefused], v2: [...] }`.
+ * V1 (`server`) refuses by THROWING `[geneseed-guard] …`; V2 (`setup`) by RENAMING the call
+ * (`setupV2`'s docblock). An unexpected throw is not a refusal — it is rethrown, and the caller
+ * reports the guard as broken.
+ */
+async function runGuard(mod, cwd) {
+  const v1 = async (command) => {
+    const hooks = await mod.server({ worktree: cwd, directory: cwd });
+    try {
+      await hooks['tool.execute.before']({ tool: 'bash' }, { args: { command } });
+      return false;
+    } catch (e) {
+      if (String(e?.message || '').startsWith('[geneseed-guard]')) return true;
+      throw e;
+    }
+  };
+  const v2 = async (command) => {
+    /** @type {((event: { tool: string }) => Promise<void>) | null} */
+    let hook = null;
+    await mod.setup({
+      location: { project: { directory: cwd }, directory: cwd },
+      tool: { hook: (name, fn) => { if (name === 'execute.before') hook = fn; } },
+    });
+    if (!hook) throw new Error('setup registered no execute.before hook');
+    const event = { tool: 'bash', input: { command } };
+    await hook(event);
+    return event.tool !== 'bash';
+  };
+  return {
+    v1: [await v1(GUARD_BAD_COMMAND), await v1(GOOD_COMMAND)],
+    v2: [await v2(GUARD_BAD_COMMAND), await v2(GOOD_COMMAND)],
+  };
+}
+
+/** The verdict for one API's pair — null when sound. */
+function guardVerdict([badRefused, goodRefused]) {
+  if (!badRefused) return `registered but not refusing — \`${GUARD_BAD_COMMAND}\` went through`;
+  if (goodRefused) return `refuses everything — \`${GOOD_COMMAND}\` was refused too`;
+  return null;
+}
+
+/**
+ * Probe every live OpenCode install's guard plugin by importing it into this process and
+ * calling its hooks — no spawn. Proves the installed FILE and its logic under Node, not under
+ * OpenCode's runtime (the weekly host canary proves the plugin loads there). Returns
+ * `{ problems, probed }` like `gateProbe`; a guard this environment switched off
+ * (`GENESEED_GUARD=off|warn`) is a NOTE, not a failure — that switch is the user's.
+ *
+ * Only a file named `geneseed-guard.js` in an install `installState` recognises is imported,
+ * and only one whose default export is `{ id: 'geneseed-guard', server, setup }`.
+ */
+export async function guardProbe(targets = installTargets(), env = process.env) {
+  const problems = [];
+  const probed = [];
+  for (const [host, scope, root] of targets) {
+    if (host !== 'opencode' || installState(root, host, scope) !== 'active') continue;
+    const file = guardPluginPath(root, scope);
+    const label = `[probe] ${file}`;
+    if (!existsSync(file)) {
+      problems.push(`${label}: no guard plugin — nothing refuses a catastrophic command at the `
+        + 'boundary — run: geneseed rebuild-all');
+      continue;
+    }
+    const mode = String(env.GENESEED_GUARD || 'on').toLowerCase();
+    if (['off', '0', 'false', 'no', 'warn'].includes(mode)) {
+      problems.push(`${NOTE}${label}: not probed — GENESEED_GUARD=${mode} in this environment `
+        + 'switches the guard off');
+      continue;
+    }
+    let verdicts;
+    try {
+      // ESM under OpenCode's typeless package.json: parses only with syntax detection (Node >=
+      // 22.7, the floor). Its MODULE_TYPELESS_PACKAGE_JSON warning fires a tick later, inside
+      // quietProbe's stderr swap, so the doctor never prints it.
+      const mod = (await import(pathToFileURL(file).href)).default;
+      if (mod?.id !== 'geneseed-guard' || typeof mod.server !== 'function' || typeof mod.setup !== 'function') {
+        problems.push(`${label}: not probed — it does not export the Geneseed guard `
+          + '({ id, server, setup }) — run: geneseed rebuild-all');
+        continue;
+      }
+      verdicts = await withTempDirAsync(
+        (tmp) => quietProbe(() => runGuard(mod, tmp)), 'geneseed-probe-');
+    } catch (e) {
+      problems.push(`${label}: does not run (${e?.message || e})`);
+      continue;
+    }
+    const bad = [['V1', guardVerdict(verdicts.v1)], ['V2', guardVerdict(verdicts.v2)]]
+      .filter(([, v]) => v);
+    for (const [api, v] of bad) problems.push(`${label}: guard (OpenCode ${api} hook) ${v}`);
+    if (!bad.length) probed.push(`${path.normalize(file)} (guard, in-process)`);
+  }
+  return { problems, probed };
+}

package/js/inspect/checks-repo.mjs

@@ -1,6 +1,7 @@
 /**
- * The checks over the REPO's own records — the registry, committed secrets, the hook shim
- * and the vendored skill folders (their pins and their SKILL.md frontmatter).
+ * The checks over the REPO's own records — the registry, committed secrets, the hook shim,
+ * the vendored skill folders (their pins and their SKILL.md frontmatter), skill aliases and
+ * side files, the `js/README.md` module map, the host tables, and the scorecard ratchet.
  *
  * Same contract as `checks-build.mjs`: an array of problem strings, empty when clean, one
  * planted fault per check in the gate. This is the group that reads what the repo SAYS about
@@ -10,8 +11,8 @@ import path from 'node:path';
 import {
   ALIASES_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf, knownSkillIds,
 } from '../build/source.mjs';
-import { CLAUDE_STYLE, HOSTS, liveRecordedHooks } from '../hosts/hosts.mjs';
-import { claudeCfg, installTargets } from '../hosts/installs.mjs';
+import { HOSTS } from '../hosts/hosts.mjs';
+import { installTargets, installsReferencingShim } from '../hosts/installs.mjs';
 import { VENDORED_SKILL_DIRS } from '../hosts/native.mjs';
 import { COMMAND_SET } from '../hosts/opencode.mjs';
 import { hookShimPath, shimDeadPaths } from '../hosts/shim.mjs';
@@ -41,12 +42,8 @@ function registryKeys() {
 const SEMVER_RE = /^\d+\.\d+\.\d+$/;
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 
-// `ENTITY_STATUSES`, `LAW_CLASSES`, `LAW_CLASS` and `SKILL_CLASS` moved to
-// `js/inspect/inventory.mjs` in P6c — see the import above. They crossed HERE in P5g because
-// doctor's authoring gates are what validate them, and they belong where Python keeps
-// them (`_harness_tui`) now that the catalog reads them too. The gates below are
-// unchanged, which is what licensed the move: a copy would have stopped being the
-// value under test the first time one of them was edited.
+// `ENTITY_STATUSES` is imported from `js/inspect/inventory.mjs`, not copied: the catalog reads
+// it too, and a copy would stop being the value under test the first time one side changed.
 
 /**
  * `_harness_build._registry_problems` — `registry.json` describes exactly what `src/`
@@ -167,44 +164,6 @@ export function secretProblems() {
   return problems;
 }
 
-/**
- * Every active Claude-STYLE install (`CLAUDE_STYLE`: claude, bob, openclaude — the hosts that
- * share this one machine-wide shim) whose LIVE, recorded hooks still name `shimPath` by exact
- * string, keyed by its own config dir.
- *
- * Split out of `shimProblems` for the case `shimDeadPaths` cannot see: that function reads
- * paths back OUT of the shim body, so it has nothing to read once the shim file is gone
- * outright (deleted, not moved-and-regenerated) — a plain `isFile` check upstream then calls
- * that clean, the same as a source checkout that never emitted. `liveRecordedHooks` is already
- * "the manifest claims it AND the settings file still runs it" (`js/hosts/hosts.mjs`), so a
- * disabled or never-wired install cannot appear here — only installs for which the missing
- * shim is a live, standing failure.
- *
- * MATCHES THE EXACT PATH, not merely a command that mentions the shim's filename
- * (`geneseed-hook`): the shim path is baked per `GENESEED_HOME`, so a machine with more than
- * one Geneseed home (a relocated one, or a sandboxed test run beside a real install) must not
- * let an install naming a DIFFERENT, perfectly healthy shim answer for this one.
- *
- * EXPORTED: `status`'s `gateSummary` (`js/inspect/status.mjs`) needs the same answer to fold
- * into its `dead` field, the one `statusLines` already renders as a `DEAD` gates row — two
- * readers of one fact, not two copies of the install walk.
- *
- * `targets` is a parameter, the same convention `hookShellProblems` uses, so a test can hand
- * it a sandboxed `[host, scope, root]` triple instead of walking this machine's real config
- * dirs and registry — the live default every production caller takes.
- */
-export function installsReferencingShim(shimPath = hookShimPath(), targets = installTargets()) {
-  const out = [];
-  for (const [host, scope, root] of targets) {
-    if (!CLAUDE_STYLE.includes(host)) continue;
-    const cfg = claudeCfg(root, scope, host);
-    const live = liveRecordedHooks(cfg)
-      .some(([, h]) => typeof h.command === 'string' && h.command.includes(shimPath));
-    if (live) out.push(cfg);
-  }
-  return out;
-}
-
 /**
  * `_harness_build._shim_problems` — the hook shim exists and points at something real.
  *
@@ -220,7 +179,7 @@ export function installsReferencingShim(shimPath = hookShimPath(), targets = ins
  * reason to own one. But one deleted by hand (or by a cleanup script) out from under an
  * install that still names it is the same dead-hooks failure as a moved checkout, newly worth
  * catching now that the two Claude gates fail CLOSED on a dead hook instead of open
- * (`onFailure: "block"`, Task 1) — a Bash/Write/Edit call blocked with no shim to even try
+ * (`onFailure: "block"`) — a Bash/Write/Edit call blocked with no shim to even try
  * running is otherwise invisible until the user notices nothing works.
  * `installsReferencingShim` answers that half; this still returns `[]` when nothing live
  * names the missing shim.
@@ -243,7 +202,7 @@ export function shimProblems(targets = installTargets()) {
   if (!isFile(p)) {
     return installsReferencingShim(p, targets).map((cfg) => `[shim] ${p} does not exist, but ${cfg} `
       + 'still runs its hooks through it — every hook in that install is dead, and (since '
-      + "Task 1) Claude's git-gate/rule-gate now BLOCK instead of silently passing. Run: "
+      + "Geneseed 4.0.0) Claude's git-gate/rule-gate now BLOCK instead of silently passing. Run: "
       + 'geneseed rebuild-all');
   }
   let body;
@@ -597,7 +556,7 @@ export function hostMatrixProblems(root = ROOT) {
  * invisible here. A check this repo starts to pass is added by hand; one it stops passing is a
  * doctor problem until fixed or deliberately removed from this list, in the same commit.
  */
-export const SCORECARD_FLOOR = [
+const SCORECARD_FLOOR = [
   'architecture_doc',
   'agent_instructions',
   'adr_presence',
@@ -630,6 +589,9 @@ export const SCORECARD_FLOOR = [
   'security_critical_marking',
 ];
 
+/** Where the README's scorecard card lives, and what doctor compares against a fresh render. */
+const SCORECARD_CARD = 'docs/assets/scorecard.svg';
+
 /**
  * The scorecard ratchet — one problem per `SCORECARD_FLOOR` check that no longer passes.
  *
@@ -659,6 +621,3 @@ export function scorecardProblems(root = ROOT) {
       + (k ? `: ${k.evidence}. Fix: ${k.remediation}` : ', and the scorecard has no such check');
   }));
 }
-
-/** Where the README's scorecard card lives, and what doctor compares against a fresh render. */
-export const SCORECARD_CARD = 'docs/assets/scorecard.svg';