geneseed 4.5.0 → 4.6.0

package/js/inspect/scorecard.mjs

@@ -19,7 +19,8 @@
  *     indicator `*` + `/pom.xml` matching a pom.xml at ANY depth relies on, and `fnmatch` keeps.
  *   * The file list is sorted by the `/` spelling, i.e. upstream's order on POSIX. Only the
  *     first-match evidence strings can tell, never a score.
- *   * YAML is read by the small subset parser below, not PyYAML — see its `ponytail:` note.
+ *   * YAML is read by the small subset parser in `scorecard-yaml.mjs`, not PyYAML — see its
+ *     `ponytail:` note.
  */
 import { readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
@@ -27,409 +28,9 @@ import path from 'node:path';
 import { isDir, isFile, printErr, printOut, readText, writeText } from '../lib/fs.mjs';
 import { ALL_CHECKS } from './scorecard-checks.mjs';
 import { badgeUrl, renderSvg } from './scorecard-svg.mjs';
+import { parseYamlSubset, pyStr, pyTruthy } from './scorecard-yaml.mjs';
 
-// ---------------------------------------------------------------------------------------------
-// The YAML subset
-// ---------------------------------------------------------------------------------------------
-
-class YamlError extends Error {}
-
-/** A flow mapping (`{a: b}`), kept as its source text — the subset does not look inside one. */
-export class FlowMap {
-  constructor(raw) { this.raw = raw; }
-}
-
-const NULLS = new Set(['', '~', 'null', 'Null', 'NULL']);
-const TRUES = new Set(['yes', 'Yes', 'YES', 'true', 'True', 'TRUE', 'on', 'On', 'ON']);
-const FALSES = new Set(['no', 'No', 'NO', 'false', 'False', 'FALSE', 'off', 'Off', 'OFF']);
-
-/**
- * PyYAML's YAML 1.1 resolver for a plain scalar: null, the eighteen booleans (`on` is `True`,
- * which is why upstream looks the GitHub trigger key up under both `"on"` and `True`), ints and
- * floats. Everything else stays a string.
- */
-function resolvePlain(s) {
-  if (NULLS.has(s)) return null;
-  if (TRUES.has(s)) return true;
-  if (FALSES.has(s)) return false;
-  if (/^[-+]?(0|[1-9][0-9_]*)$/.test(s)) return Number(s.replaceAll('_', ''));
-  if (/^[-+]?([0-9][0-9_]*)?\.[0-9_]*([eE][-+][0-9]+)?$/.test(s) && /[0-9]/.test(s)) {
-    return Number(s.replaceAll('_', ''));
-  }
-  return s;
-}
-
-/**
- * `str(value)` for what the subset produces. A collection prints as Python's `repr`, because
- * that is the command text upstream matches: `- echo "a: b"` in a GitLab script is a MAPPING
- * to YAML, and `str()` of it is `{'echo "a': 'b"'}`.
- */
-export function pyStr(v) {
-  if (typeof v === 'string') return v;
-  if (v === null || v === undefined) return 'None';
-  if (v === true) return 'True';
-  if (v === false) return 'False';
-  if (v instanceof FlowMap) return v.raw;
-  if (Array.isArray(v)) return `[${v.map(pyRepr).join(', ')}]`;
-  if (v instanceof Map) return `{${[...v].map(([k, x]) => `${pyRepr(k)}: ${pyRepr(x)}`).join(', ')}}`;
-  return String(v);
-}
-
-function pyRepr(v) {
-  if (typeof v !== 'string') return pyStr(v);
-  const q = v.includes("'") && !v.includes('"') ? '"' : "'";
-  const body = v.replace(/[\\\n\r\t]/g, (c) => ({ '\\': '\\\\', '\n': '\\n', '\r': '\\r', '\t': '\\t' })[c])
-    .replaceAll(q, `\\${q}`);
-  return `${q}${body}${q}`;
-}
-
-/** `bool(value)` — `allow_failure: {exit_codes: [1]}` and `"false"` are both TRUE upstream. */
-export function pyTruthy(v) {
-  if (v === null || v === undefined || v === false) return false;
-  if (typeof v === 'number') return v !== 0;
-  if (typeof v === 'string' || Array.isArray(v)) return v.length > 0;
-  if (v instanceof Map) return v.size > 0;
-  if (v instanceof FlowMap) return v.raw.replace(/\s/g, '') !== '{}';
-  return true;
-}
-
-/** Fold the line breaks inside a multi-line flow or quoted scalar: one break is a space. */
-function foldBreaks(s) {
-  return s.replace(/[ \t]*\n([ \t]*\n)*[ \t]*/g, (m) => {
-    const n = m.split('\n').length - 1;
-    return n === 1 ? ' ' : '\n'.repeat(n - 1);
-  });
-}
-
-const ESCAPES = { n: '\n', t: '\t', r: '\r', 0: '\0', '"': '"', '\\': '\\', '/': '/', ' ': ' ', e: '\x1b', a: '\x07', b: '\b', f: '\f', v: '\v', N: '\x85', _: '\xa0' };
-
-function unescapeDouble(s) {
-  return s.replace(/\\(x[0-9a-fA-F]{2}|u[0-9a-fA-F]{4}|U[0-9a-fA-F]{8}|.)/gs, (m, e) => {
-    if (e.length > 1) return String.fromCodePoint(parseInt(e.slice(1), 16));
-    if (e in ESCAPES) return ESCAPES[e];
-    throw new YamlError(`unknown escape \\${e}`);
-  });
-}
-
-/** Index just past the closing quote of the quoted scalar starting at `s[0]`, or -1. */
-function quoteEnd(s) {
-  const q = s[0];
-  for (let i = 1; i < s.length; i += 1) {
-    if (q === '"' && s[i] === '\\') { i += 1; continue; }
-    if (s[i] === q) {
-      if (q === "'" && s[i + 1] === "'") { i += 1; continue; }
-      return i + 1;
-    }
-  }
-  return -1;
-}
-
-function quotedValue(span) {
-  const body = span.slice(1, -1);
-  if (span[0] === "'") return foldBreaks(body).replaceAll("''", "'");
-  // A `\` before a line break escapes the break itself: no space is folded in for it.
-  return unescapeDouble(foldBreaks(body.replace(/(?<!\\)\\\n[ \t]*/g, '')));
-}
-
-/** Index just past the bracket that closes `s[0]`, honouring quotes; -1 while still open. */
-function flowEnd(s) {
-  let depth = 0;
-  for (let i = 0; i < s.length; i += 1) {
-    const c = s[i];
-    if ((c === '"' || c === "'") && /^$|[\s[{,]/.test(s[i - 1] ?? '')) {
-      const e = quoteEnd(s.slice(i));
-      if (e < 0) return -1;
-      i += e - 1;
-    } else if (c === '[' || c === '{') depth += 1;
-    else if (c === ']' || c === '}') { depth -= 1; if (depth === 0) return i + 1; }
-  }
-  return -1;
-}
-
-/** A flow sequence of scalars becomes an array; a flow mapping anywhere stays opaque. */
-function parseFlow(src) {
-  if (src[0] === '{') return new FlowMap(src);
-  const items = [];
-  let i = 1;
-  while (i < src.length - 1) {
-    while (/[\s,]/.test(src[i]) && i < src.length - 1) i += 1;
-    if (i >= src.length - 1) break;
-    const rest = src.slice(i, -1);
-    let end;
-    if (rest[0] === '[' || rest[0] === '{') {
-      end = flowEnd(rest);
-      items.push(parseFlow(rest.slice(0, end)));
-    } else if (rest[0] === '"' || rest[0] === "'") {
-      end = quoteEnd(rest);
-      items.push(quotedValue(rest.slice(0, end)));
-    } else {
-      end = rest.search(/,|$/);
-      items.push(resolvePlain(foldBreaks(rest.slice(0, end)).trim()));
-    }
-    i += end;
-  }
-  return items;
-}
-
-/**
- * The CI-config YAML subset upstream's checks read, parsed into Maps, arrays and scalars.
- *
- * Returns the document, or `undefined` where PyYAML's `safe_load` would RAISE — and upstream
- * then drops the whole file (`_load_yaml` answers `None`), so a raise is behaviour to keep, not
- * an error to paper over. Raised here: a second document, a local tag such as GitLab's
- * `!reference` (unknown to `safe_load`), a plain value holding `: `, a tab used as indentation.
- *
- * Handles block mappings and sequences (including a sequence at its key's own indent, and a
- * mapping that starts on the `- ` line), `|`/`>` block scalars with chomping and indentation
- * indicators, plain scalars (multi-line, ` #` comments), single- and double-quoted scalars
- * (escapes, multi-line), flow sequences of scalars, `&anchor` prefixes and `!!` tags.
- *
- * ponytail: a subset, not YAML. Its ceiling: flow MAPPINGS are kept opaque (`FlowMap`), so a
- * job or rule written `{...}` is invisible; aliases (`*x`) and merge keys (`<<: *x`) are not
- * resolved — an alias reads as the string `*x` — which is the likeliest real miss on GitLab
- * files that share `before_script` through anchors; `? ` complex keys are refused;
- * multi-document files are refused as PyYAML refuses them. Upgrade path: vendor a YAML parser
- * under `js/vendor/` (CLAUDE.md: never install one) once a scored repo needs any of those.
- */
-export function parseYamlSubset(text) {
-  try {
-    return new YamlParser(text).document();
-  } catch (e) {
-    if (e instanceof YamlError) return undefined;
-    throw e;
-  }
-}
-
-class YamlParser {
-  constructor(text) {
-    this.raw = text.replace(/^\uFEFF/, '').split('\n');
-    this.lines = this.raw.map((r) => {
-      const indent = r.length - r.replace(/^ +/, '').length;
-      const text = r.slice(indent).replace(/\s+$/, '');
-      // A tab where indentation goes is a YAML error — raised by `peek`, on content lines only.
-      return { indent, text: text.replace(/^\t+/, ''), tab: text.startsWith('\t') };
-    });
-    this.pos = 0;
-  }
-
-  document() {
-    let started = false;
-    let i = 0;
-    for (; i < this.lines.length; i += 1) {
-      const { indent, text } = this.lines[i];
-      if (indent === 0 && /^---(\s|$)/.test(text)) {
-        if (started) throw new YamlError('a second document');
-        started = true;
-        this.lines[i] = { indent: 0, text: '' };
-      } else if (indent === 0 && /^\.\.\.(\s|$)/.test(text)) {
-        this.lines.length = i;
-        break;
-      } else if (indent === 0 && text.startsWith('%') && !started) {
-        this.lines[i] = { indent: 0, text: '' };
-      } else if (text && !text.startsWith('#')) {
-        started = true;
-      }
-    }
-    const value = this.node(0);
-    if (this.peek() !== null) throw new YamlError('content after the document');
-    return value;
-  }
-
-  /** Index of the next line that is neither blank nor a comment, or null. */
-  peek() {
-    for (let i = this.pos; i < this.lines.length; i += 1) {
-      const { text } = this.lines[i];
-      if (text && !text.startsWith('#')) {
-        if (this.lines[i].tab) throw new YamlError('a tab as indentation');
-        this.pos = i;
-        return i;
-      }
-    }
-    this.pos = this.lines.length;
-    return null;
-  }
-
-  node(minIndent) {
-    const i = this.peek();
-    if (i === null || this.lines[i].indent < minIndent) return null;
-    const { indent, text } = this.lines[i];
-    if (isSeqItem(text)) return this.seq(indent);
-    if (splitKey(text)) return this.map(indent);
-    this.pos = i + 1;
-    return this.value(text, indent - 1);
-  }
-
-  /** The value of `key:` with nothing after it — or of a bare `-`. */
-  nested(indent, sameIndentSeq) {
-    const i = this.peek();
-    if (i === null) return null;
-    const ln = this.lines[i];
-    if (sameIndentSeq && ln.indent === indent && isSeqItem(ln.text)) return this.seq(indent);
-    return ln.indent > indent ? this.node(ln.indent) : null;
-  }
-
-  map(indent) {
-    const m = new Map();
-    for (let i = this.peek(); i !== null; i = this.peek()) {
-      const ln = this.lines[i];
-      if (ln.indent < indent || (ln.indent === indent && isSeqItem(ln.text))) break;
-      if (ln.indent > indent) throw new YamlError('bad indentation');
-      const kv = splitKey(ln.text);
-      if (!kv) throw new YamlError('expected a key');
-      this.pos = i + 1;
-      // Python dicts keep the FIRST position of a duplicate key and the LAST value; so do Maps.
-      m.set(kv.key, kv.rest === '' || kv.rest.startsWith('#')
-        ? this.nested(indent, true) : this.value(kv.rest, indent));
-    }
-    return m;
-  }
-
-  seq(indent) {
-    const arr = [];
-    for (let i = this.peek(); i !== null; i = this.peek()) {
-      const ln = this.lines[i];
-      if (ln.indent < indent || !isSeqItem(ln.text)) break;
-      if (ln.indent > indent) throw new YamlError('bad indentation');
-      const after = ln.text.slice(1);
-      const body = after.trimStart();
-      if (body === '' || body.startsWith('#')) {
-        this.pos = i + 1;
-        arr.push(this.nested(indent, false));
-      } else {
-        // `- key: v` opens a mapping whose keys sit at the column `key` starts in: re-read the
-        // rest of this line as a node of its own at that column.
-        const col = indent + 1 + (after.length - body.length);
-        this.lines[i] = { indent: col, text: body };
-        arr.push(this.node(col));
-      }
-    }
-    return arr;
-  }
-
-  /** A value that starts on the current line, after `key: ` or `- `. */
-  value(rest, parentIndent) {
-    let s = rest;
-    for (;;) {
-      const anchor = /^&\S+\s*/.exec(s);
-      if (anchor) { s = s.slice(anchor[0].length); continue; }
-      const tag = /^!(\S*)\s*/.exec(s);
-      if (tag) {
-        if (!tag[1].startsWith('!')) throw new YamlError(`unknown tag !${tag[1]}`);
-        s = s.slice(tag[0].length);
-        continue;
-      }
-      break;
-    }
-    if (s === '' || s.startsWith('#')) return this.nested(parentIndent, false);
-    const c = s[0];
-    if (c === '|' || c === '>') return this.block(s, parentIndent);
-    if (c === '"' || c === "'" || c === '[' || c === '{') {
-      let span = s;
-      let end = c === '[' || c === '{' ? flowEnd(span) : quoteEnd(span);
-      while (end < 0 && this.pos < this.lines.length) {
-        span += `\n${this.raw[this.pos].trim()}`;
-        this.pos += 1;
-        end = c === '[' || c === '{' ? flowEnd(span) : quoteEnd(span);
-      }
-      if (end < 0) throw new YamlError('an unterminated scalar');
-      const tail = span.slice(end).trim();
-      if (tail && !tail.startsWith('#')) throw new YamlError('text after a closed scalar');
-      return c === '[' || c === '{' ? parseFlow(span.slice(0, end)) : quotedValue(span.slice(0, end));
-    }
-    if (c === '*') return s.replace(/\s+#.*$/, '');
-    if (c === '@' || c === '`') throw new YamlError('a reserved indicator');
-    return resolvePlain(this.plain(s, parentIndent));
-  }
-
-  /** A plain scalar and its continuation lines, folded. */
-  plain(first, parentIndent) {
-    const parts = [first.replace(/\s+#.*$/, '')];
-    let blanks = 0;
-    if (!/\s#/.test(first)) {
-      for (let j = this.pos; j < this.lines.length; j += 1) {
-        const { indent, text } = this.lines[j];
-        if (!text) { blanks += 1; continue; }
-        if (text.startsWith('#') || indent <= parentIndent) break;
-        parts.push(blanks ? '\n'.repeat(blanks) : ' ', text.replace(/\s+#.*$/, ''));
-        blanks = 0;
-        this.pos = j + 1;
-        if (/\s#/.test(text)) break;
-      }
-    }
-    const out = parts.join('');
-    if (/:(\s|$)/.test(out)) throw new YamlError('mapping values are not allowed here');
-    return out.trim();
-  }
-
-  block(header, parentIndent) {
-    const h = /^([|>])([1-9]?)([+-]?)([1-9]?)\s*(#.*)?$/.exec(header);
-    if (!h) throw new YamlError('a bad block scalar header');
-    const digit = Number(h[2] || h[4] || 0);
-    const chomp = h[3];
-    let contentIndent = digit ? parentIndent + digit : null;
-    const lines = [];
-    let j = this.pos;
-    for (; j < this.raw.length && j < this.lines.length; j += 1) {
-      const r = this.raw[j];
-      if (r.trim() === '') { lines.push(''); continue; }
-      const ind = r.length - r.replace(/^ +/, '').length;
-      if (contentIndent === null) {
-        if (ind <= parentIndent) break;
-        contentIndent = ind;
-      }
-      if (ind < contentIndent) break;
-      lines.push(r.slice(contentIndent));
-    }
-    this.pos = j;
-    let trailing = 0;
-    while (lines.length && lines[lines.length - 1] === '') { lines.pop(); trailing += 1; }
-    let body;
-    if (h[1] === '|') {
-      body = lines.join('\n');
-    } else {
-      body = '';
-      let prevMore = null;
-      let empties = 0;
-      for (const l of lines) {
-        if (l === '') { empties += 1; continue; }
-        const more = /^[ \t]/.test(l);
-        if (prevMore === null) body += '\n'.repeat(empties);
-        else if (!more && !prevMore) body += empties ? '\n'.repeat(empties) : ' ';
-        else body += '\n'.repeat(empties + 1);
-        body += l;
-        prevMore = more;
-        empties = 0;
-      }
-    }
-    if (chomp === '-' || body === '') return chomp === '+' ? body + '\n'.repeat(trailing) : body;
-    return chomp === '+' ? `${body}\n${'\n'.repeat(trailing)}` : `${body}\n`;
-  }
-}
-
-function isSeqItem(text) {
-  return text === '-' || /^-[ \t]/.test(text);
-}
-
-/** `key: rest` → `{ key, rest }`, or null when the line is not a mapping entry. */
-function splitKey(text) {
-  if (isSeqItem(text) || text[0] === '[' || text[0] === '{') return null;
-  if (text.startsWith('? ')) throw new YamlError('a complex key');
-  if (text[0] === '"' || text[0] === "'") {
-    const end = quoteEnd(text);
-    if (end < 0) return null;
-    const m = /^\s*:(\s|$)/.exec(text.slice(end));
-    if (!m) return null;
-    return { key: quotedValue(text.slice(0, end)), rest: text.slice(end + m[0].length).trim() };
-  }
-  const m = /:(\s|$)/.exec(text);
-  if (!m) return null;
-  const hash = text.search(/\s#/);
-  if (hash >= 0 && hash < m.index) return null;
-  const raw = text.slice(0, m.index).trimEnd();
-  const key = resolvePlain(raw);
-  // Keys stay strings except the booleans and null, which `data.get(True)` must be able to find.
-  return { key: typeof key === 'number' ? raw : key, rest: text.slice(m.index + 1).trim() };
-}
+export { FlowMap, parseYamlSubset, pyStr, pyTruthy } from './scorecard-yaml.mjs';
 
 // ---------------------------------------------------------------------------------------------
 // ci_parser.py
@@ -721,6 +322,7 @@ const CATEGORY_CONFIG = {
   ai_safeguards: ['AI-Specific Safeguards', 0.15],
 };
 
+/** @type {[string, number][]} */
 const GRADES = [['A', 85], ['B', 70], ['C', 55], ['D', 40]];
 
 const GRADE_DESCRIPTIONS = {
@@ -780,7 +382,7 @@ export function round1(x) {
 }
 
 /** The JSON payload: upstream's reporter shape, keys renamed to this module's camelCase. */
-export function renderJson(a) {
+function renderJson(a) {
   const r = (x) => round1(x);
   return `${JSON.stringify({
     ...a,
@@ -793,7 +395,7 @@ export function renderJson(a) {
 }
 
 /** The text report: grade, the per-pillar table, then every check that is not at full marks. */
-export function renderText(a) {
+function renderText(a) {
   const out = [
     `AI Harness Scorecard — ${a.repoName}`,
     `Grade ${a.grade} — ${round1(a.overallScore)}/100 (${a.passedChecks}/${a.totalChecks} checks passing)`,

package/js/inspect/status.mjs

@@ -69,11 +69,11 @@ import {
 // deployed theme and footprint, and `rebuild-all` re-emits in the deployed everything, so
 // three verbs now read them.
 import {
-  defaultTheme, hookShellProblems, installedDefaults, installTargets, legacyProcessCarrierOfDir,
-  openclaudeDualHarnessRoots, readJsonMaybe, readMaybe,
+  defaultTheme, hookShellProblems, installedDefaults, installTargets, installsReferencingShim,
+  legacyProcessCarrierOfDir, openclaudeDualHarnessRoots, readJsonMaybe, readMaybe,
 } from '../hosts/installs.mjs';
 import { installProfile, rebuildCommand } from '../build/generate.mjs';
-import { installsReferencingShim } from './checks-repo.mjs';
+import { isDoctorNote } from './scan.mjs';
 import { hookShimPath, shimDead } from '../hosts/shim.mjs';
 import { printOut } from '../lib/fs.mjs';
 import { codePointLength, padEndToWidth } from '../lib/text.mjs';
@@ -211,20 +211,21 @@ export function gateSummary(cfgDirs, platform = process.platform) {
   // `dead` is the machine shim's missing targets: every gate below is armed on paper and never
   // runs, so it outranks `armed` in the row. A shim that exists but names a moved checkout
   // (`shimDead`) and a shim that is simply GONE while a live install still names it
-  // (`installsReferencingShim`, Task 1's fix round — `onFailure: "block"` makes a dead gate
-  // block instead of silently passing, so this stopped being a quiet failure) are the same
-  // row here: both mean "every hook of every install naming this shim cannot run".
-  // `fail_open` (Task 15): Claude installs whose bash-form hooks now run under PowerShell. Only
-  // present when non-empty, so every recorded `--json` panel keeps its shape.
-  // Only the dirs it was handed, and only those that are Claude's global (`isHostGlobalDir`);
+  // (`installsReferencingShim` — `onFailure: "block"` makes a dead gate block instead of
+  // silently passing, so a missing shim is no longer a quiet failure) are the same row here:
+  // both mean "every hook of every install naming this shim cannot run".
+  // `fail_open`: Claude installs whose bash-form hooks now run under PowerShell, where a gate
+  // fails open. Only present when non-empty, so every recorded `--json` panel keeps its shape.
+  // Only the dirs it was handed, and only those that are a host's global (`isHostGlobalDir`,
+  // which throws when a host's `configDir()` cannot resolve — read here as "not that host's");
   // `platform` is injectable so a test on Linux still exercises the win32 branch.
-  const isClaude = (c) => { try { return isHostGlobalDir('claude', c); } catch { return false; } };
-  const claude = cfgDirs.filter(isClaude).map((c) => ['claude', 'global', c]);
-  const failOpen = hookShellProblems(claude, platform).filter((p) => !p.startsWith('[note] '));
+  const isGlobal = (host, c) => { try { return isHostGlobalDir(host, c); } catch { return false; } };
+  const claude = cfgDirs.filter((c) => isGlobal('claude', c)).map((c) => ['claude', 'global', c]);
+  const failOpen = hookShellProblems(claude, platform).filter((p) => !isDoctorNote(p));
   // Same `cfgDirs`, widened to every Claude-STYLE host (`CLAUDE_STYLE`: claude, bob,
   // openclaude — all three share this one machine-wide shim), for `installsReferencingShim`.
   const styleTargets = cfgDirs.flatMap((c) => CLAUDE_STYLE
-    .filter((host) => { try { return isHostGlobalDir(host, c); } catch { return false; } })
+    .filter((host) => isGlobal(host, c))
     .map((host) => [host, 'global', c]));
   const shimPath = hookShimPath();
   const dead = shimDead();

package/js/lib/node-floor.mjs

@@ -10,9 +10,9 @@
  */
 import path from 'node:path';
 
-export const NODE_FLOOR = '22.3.0';
+export const NODE_FLOOR = '22.7.0';
 
-/** Numeric, not string, comparison: '22.10.0' is above '22.3.0'. */
+/** Numeric, not string, comparison: '22.10.0' is above '22.7.0'. */
 export function belowFloor(version, floor = NODE_FLOOR) {
   const v = version.replace(/^v/, '').split('.').map(Number);
   const f = floor.split('.').map(Number);
@@ -23,7 +23,8 @@ export function belowFloor(version, floor = NODE_FLOOR) {
 }
 
 if (belowFloor(process.versions.node)) {
-  process.stderr.write(`geneseed needs Node 22.3 or newer; this is Node ${process.versions.node}. `
+  process.stderr.write(`geneseed needs Node ${NODE_FLOOR.replace(/\.0$/, '')} or newer; `
+    + `this is Node ${process.versions.node}. `
     + 'Install a current Node from https://nodejs.org (or your package manager), then run the '
     + 'command again.\n');
   process.exit(path.basename(process.argv[1] || '').startsWith('geneseed-hook') ? 0 : 1);

package/js/maintain/migrate.mjs

@@ -37,13 +37,12 @@ import path from 'node:path';
 
 import { main as driverMain } from '../build/driver.mjs';
 import { ROOT } from '../build/source.mjs';
-import { CLAUDE_STYLE } from '../hosts/hosts.mjs';
+import { CLAUDE_STYLE, settingsFile } from '../hosts/hosts.mjs';
 import {
   claudeCfg, claudeReadManifest, EMIT_HOST_SCOPE, installState, installTargets,
   legacyProcessCarrierOfDir, readMaybe,
 } from '../hosts/installs.mjs';
 import { installProfile } from '../build/generate.mjs';
-import { settingsFile } from './uninstall.mjs';
 import {
   autostartPaths, autostartStale, hookShimPath, migrateShape, shimHome,
 } from '../hosts/shim.mjs';
@@ -65,7 +64,7 @@ const KNOWN_EMITS = new Set(EMIT_HOST_SCOPE.keys());
  * BOTH HALVES READ BACK AN EXISTING RESOLVER rather than a second hand-rolled copy
  * (host-compat B1/B2): `claudeCfg` (`js/hosts/installs.mjs`) is the cfg dir — `root` itself
  * for a global install, `<root>/<projectMarker>` (`.claude`/`.bob`/`.openclaude`) for a
- * project one — and `settingsFile` (`js/maintain/uninstall.mjs`) is the file name inside it,
+ * project one — and `settingsFile` (`js/hosts/hosts.mjs`) is the file name inside it,
  * read off the install's OWN manifest. The manifest is the authority, not a guess at the
  * canonical name: a pre-existing `bob-global` install with no `managed.settings_file` yet
  * recorded carries the bare, pre-nesting `settings.json` it was actually written with, not

package/js/maintain/uninstall.mjs

@@ -52,14 +52,14 @@ import { confirm } from '../lib/prompt.mjs';
 import {
   claudeCfg, claudeReadManifest, doctrinesOfDir, EMIT_HOST_SCOPE, emitHostScopeOf,
   excludedRulesOfDir, installKind, installState,
-  registeredTargets, DISABLED_STASH,
+  registeredTargets,
 } from '../hosts/installs.mjs';
 import {
-  CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, isHostGlobalDir, opencodeConfigDir,
+  CLAUDE_STYLE, DISABLED_STASH, GLOBAL_MANIFEST, HOSTS, VERSION_MARKER, expanduser, isHostGlobalDir, opencodeConfigDir,
   resolvePath, settingsFile,
 } from '../hosts/hosts.mjs';
 import { mcpCommented, mcpLoad } from '../hosts/mcp.mjs';
-import { hashesOf, ownedState, ownedWithin } from '../hosts/owned.mjs';
+import { hashesOf, ownedState, ownedWithin, recordedDenies } from '../hosts/owned.mjs';
 import {
   atomicWriteJson, managedBlockRead, managedBlockRemove, managedBlockWrite,
   loadJsonObject, mergeClaudeSettings, opencodeTarget, OPENCODE_SENTINEL, opencodeSentinelWrite,
@@ -224,18 +224,6 @@ function warnMarkersKept() {
 const REVERSAL_MARKERS = [GLOBAL_MANIFEST, '.geneseed-theme', '.geneseed-emit',
   '.geneseed-footprint', VERSION_MARKER];
 
-/**
- * The CURRENT manifest's `skill_denies` — the `permission.skill` denies Geneseed itself added
- * (`opencodeLayer` in emit-opencode.mjs records them; a deny the user wrote, even on a Geneseed
- * skill, is never in it). Task 4 (O-1) wires one per user-only skill, and unlike the Law IV
- * `permission.bash` gates (permanent invariants, never taken back — see
- * `reconcileOpencodePermission`), a skill-visibility deny is reversible: once uninstalled there
- * is no skill left to hide, and the name is the user's to reuse. No record takes back nothing.
- */
-function skillPermissionNames(man) {
-  return Array.isArray(man.skill_denies) ? man.skill_denies.filter((n) => typeof n === 'string') : [];
-}
-
 /**
  * `_harness_mcp._unmerge_opencode_json` — drop one `instructions` entry, leave every other
  * key intact.
@@ -313,10 +301,6 @@ export function archiveStore(store) {
   return dest;
 }
 
-// `settingsFile` lives in `hosts.mjs` (the hook stand-down reads it, and must not import this
-// module); re-exported here for `migrate`.
-export { settingsFile };
-
 /** `_harness_mcp._claude_md_path` — where the manifest says the managed block lives. */
 function claudeMdPath(cfg, managed) {
   const rel = ((managed && managed.claude_md) || {}).rel || 'CLAUDE.md';
@@ -386,7 +370,7 @@ export function uninstallGlobal(target, archiveMemory, host = 'opencode', force
     if (isDir(p) && isEmptyDir(p)) rmdirQuiet(p);
   }
   const unmerged = unmergeOpencodeJson(path.join(target, 'opencode.json'),
-    path.join(target, 'AGENT.md').split(path.sep).join('/'), skillPermissionNames(man));
+    path.join(target, 'AGENT.md').split(path.sep).join('/'), recordedDenies(man));
   managedBlockRemove(path.join(target, OPENCODE_SENTINEL));
   if (failed.length) warnMarkersKept();
   else for (const m of REVERSAL_MARKERS) unlinkQuiet(path.join(target, m));
@@ -476,7 +460,7 @@ function opencodeProjectUninstall(root, force = false) {
   const am = path.join(root, 'AGENT.md');
   if (isFile(am)) { unlinkQuiet(am); removed += 1; }
   const unmerged = unmergeOpencodeJson(path.join(root, 'opencode.json'), entry,
-    man ? skillPermissionNames(man) : []);
+    man ? recordedDenies(man) : []);
   const result = { removed, unmerged, archived: null };
   if (failed.length) result.failed = failed;
   if (kept.length) result.kept = kept;
@@ -587,6 +571,21 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
     if (archived.length) out.archived = archived;
     return out;
   }
+  reconcileRootMarkers(root, host, scope);
+  // 4. Tidy an emptied marker dir (.claude/.bob/.openclaude) so no husk lingers in the repo.
+  if (data !== root && isDir(data) && isEmptyDir(data)) rmdirQuiet(data);
+  const out = withKept({ ok: true, removed: summary.removed ?? 0, memory });
+  if (archived.length) out.archived = archived;
+  return out;
+}
+
+/**
+ * `installUninstall`'s step 3 once nothing of THIS host's install survived: drop, rewrite or
+ * keep the root markers depending on whether another host is still installed at `root`. Its
+ * own function because the survivor argument below is the whole of it, and the caller must
+ * only reach it after the reversal (step 1) has unlinked this host's own manifest/markers.
+ */
+function reconcileRootMarkers(root, host, scope) {
   // The root markers are ONE PER ROOT (`generate.mjs`'s "THE MARKER IS TRUSTED ONLY FOR ITS
   // OWN HOST") and `registryRoots` keeps a row alive only while `.geneseed-emit` exists there
   // — so in a repo sharing two project installs (`.claude/` + `.opencode/` at the same cwd,
@@ -655,11 +654,6 @@ export function installUninstall(root, host = 'opencode', scope = 'global', memo
     if (scope === 'global' || host === 'opencode') unlinkQuiet(path.join(root, '.geneseed-theme'));
     unlinkQuiet(path.join(root, VERSION_MARKER));
   }
-  // 4. Tidy an emptied marker dir (.claude/.bob/.openclaude) so no husk lingers in the repo.
-  if (data !== root && isDir(data) && isEmptyDir(data)) rmdirQuiet(data);
-  const out = withKept({ ok: true, removed: summary.removed ?? 0, memory });
-  if (archived.length) out.archived = archived;
-  return out;
 }
 
 /**

package/js/web/actions.mjs

@@ -574,7 +574,7 @@ export function apiInstallCmd(state, body) {
   const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root, host);
   const out = scope === 'global' ? null : String(root);
   const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, null, host));
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host));
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }
 
@@ -675,6 +675,6 @@ export function apiDeployCmd(state, body) {
   const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root, host);
   // project-scope emit name == host name (opencode / claude / bob / openclaude)
   const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, null, host));
+    PACK_ORDER, excludeRules, trust, excludedSkillsOfDir(root, host));
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }