geneseed 4.5.0 → 4.7.0

package/CHANGELOG.md

@@ -8,6 +8,36 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.7.0] — 2026-10-17
+
+Minor: the Deletion Is Deliberate gate stops asking on worktree removal.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed hooks and OpenCode plugins pick up the change.
+- OpenCode: an `opencode.json` written by an earlier version keeps the four `git worktree remove … -f`/`--force` keys under `permission.bash`. Geneseed no longer claims them, so it neither removes nor reports them; delete them by hand to stop the prompt.
+
+### Changed
+- **`git worktree remove --force` no longer asks.** Removing a worktree is routine agent housekeeping, so the *Deletion Is Deliberate* gate now lets `worktree remove -f`/`--force` through like a plain `worktree remove`, on every host: the Claude Code/OpenClaude/Bob git-gate, OpenCode's permission globs and the guard plugin's warning. Every other destructive git form is gated as before.
+
+## [4.6.0] — 2026-10-17
+
+Minor: a refactor and cleanup pass over everything since 3.15.0, and the nine gate and counter bugs it turned up.
+
+### Upgrade notes
+- **Node 22.7.0 or newer is now required** (was 22.3.0). `doctor --probe` imports the installed OpenCode guard plugin, an ES module under a package.json with no `type`; Node detects that syntax by default only from 22.7.0 (#303).
+- Run `geneseed rebuild-all` once after updating so the installed hooks and OpenCode plugins pick up the fixes below.
+
+### Fixed
+- **Bob no longer blocks removing a secret.** The credential scan read the text being replaced (`search`, and the SEARCH half of an `apply_diff`), so an agent deleting a leaked key was hard-refused. Only what is written is scanned now; planting a key still blocks (#304).
+- **The done gate needs the whole command.** A declared check such as `npm run lint` was counted as run by `npm run lint:fix`, by `echo npm run lint`, or by a commit message naming it. The check must now open a command segment, end at a boundary and sit outside quotes, on Claude Code and OpenCode alike (#307).
+- **The OpenCode done reminder counts only edits inside the project.** An `apply_patch` outside the repo armed it, and a folder named like `..cache/` was taken for outside (#310). The wiki `put` had the same over-strict path check (#312).
+- **Usage counting.** The OpenCode guard no longer counts Skill and subagent calls in a repo listed in `excludes.json` (#308), and OpenCode 2's `subagent` tool is now counted (#311). The console's usage endpoint only reads the ledger and never rewrites it, so a concurrent append can no longer be lost (#305).
+- **The console shows *Verify Before Asserting* as hook-gated**, matching the doctor, since the done gate enforces it (#306).
+- The dead-shim warning names the release (4.0.0) instead of an internal plan step (#302).
+
+### Changed
+- Behaviour-preserving refactors across inspect, the OpenCode plugins and emitters, hosts, the web layer, and maintain/build (#297–#301). The scorecard's YAML reader moved to `js/inspect/scorecard-yaml.mjs`. Unused exports and duplicated helpers were removed, and parity tests now pin more of the code the OpenCode plugins share.
+
 ## [4.5.0] — 2026-10-17
 
 Minor: gates that are proven, not just present — a done gate at turn end, `doctor --probe`, and Bob's refusals restored on Windows.

package/README.md

@@ -8,7 +8,7 @@
 [![CI](https://github.com/Arylmera/Geneseed/actions/workflows/ci.yml/badge.svg)](https://github.com/Arylmera/Geneseed/actions/workflows/ci.yml)
 [![AI Harness Scorecard](https://img.shields.io/badge/AI%20Harness%20Scorecard-A%2095.3%2F100-brightgreen)](#ai-harness-scorecard)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Node >= 22.3](https://img.shields.io/badge/node-%3E%3D22.3-5fa04e)](package.json)
+[![Node >= 22.7](https://img.shields.io/badge/node-%3E%3D22.7-5fa04e)](package.json)
 [![zero dependencies](https://img.shields.io/badge/deps-zero-success)](package.json)
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
 [![Skills](https://img.shields.io/badge/skills-47-blueviolet)](src/skills/)
@@ -75,7 +75,7 @@ geneseed-build --theme imperial  # Warhammer 40k voice, identical structure
 
 ### ⚡ The short way — `npx`
 
-The harness is published on npm as **[`geneseed`](https://www.npmjs.com/package/geneseed)** — three commands (`geneseed`, `geneseed-hook`, `geneseed-build`), zero dependencies. One command, nothing cloned, nothing else to install. The only prerequisite is **Node ≥ 22.3**.
+The harness is published on npm as **[`geneseed`](https://www.npmjs.com/package/geneseed)** — three commands (`geneseed`, `geneseed-hook`, `geneseed-build`), zero dependencies. One command, nothing cloned, nothing else to install. The only prerequisite is **Node ≥ 22.7**.
 
 ```bash
 npx geneseed setup            # the guided wizard
@@ -102,9 +102,9 @@ Every other route (Claude Code, Bob, OpenClaude, plain `AGENT.md`, per-repo inst
 
 ### 🧬 The long way — a git checkout
 
-Cloning is the route when npm is out of reach (a corporate network with no registry access) or when you intend to *change* the harness rather than use it. It needs **git** and the same **Node ≥ 22.3** as everything else — there is nothing extra to install.
+Cloning is the route when npm is out of reach (a corporate network with no registry access) or when you intend to *change* the harness rather than use it. It needs **git** and the same **Node ≥ 22.7** as everything else — there is nothing extra to install.
 
-**One step: run the installer at the root of the clone.** It checks that Node ≥ 22.3 and git are there and, when one is missing, says exactly what to install and where (on a managed PC: Software Center / Company Portal) — it never installs anything itself. Then it runs the setup wizard — which opens by listing the AI coding tools it can install into (OpenCode, Claude Code, IBM Bob, OpenClaude), each `ok` or with its install link, and asks before going on when none is there — and offers to open the web console.
+**One step: run the installer at the root of the clone.** It checks that Node ≥ 22.7 and git are there and, when one is missing, says exactly what to install and where (on a managed PC: Software Center / Company Portal) — it never installs anything itself. Then it runs the setup wizard — which opens by listing the AI coding tools it can install into (OpenCode, Claude Code, IBM Bob, OpenClaude), each `ok` or with its install link, and asks before going on when none is there — and offers to open the web console.
 
 ```bash
 git clone https://github.com/Arylmera/Geneseed.git
@@ -124,11 +124,11 @@ cd Geneseed
 
 Afterwards, `./geneseed setup` (`.\geneseed.cmd setup`) re-runs the wizard and bare `./geneseed` (`.\geneseed.cmd`) opens the web console. PowerShell runs a `.cmd` directly, so that is the PowerShell spelling too.
 
-Both launchers are thin shims over the Node CLI: they need `node` (22.3+) on `PATH`, and nothing else. Set `GENESEED_NODE` to an absolute path if `node` is not on `PATH` — under a version manager that only patches interactive shells, say. The wizard is plain text prompts on every console, old or new.
+Both launchers are thin shims over the Node CLI: they need `node` (22.7+) on `PATH`, and nothing else. Set `GENESEED_NODE` to an absolute path if `node` is not on `PATH` — under a version manager that only patches interactive shells, say. The wizard is plain text prompts on every console, old or new.
 
 ### 🟩 One runtime — Node, and nothing else
 
-Node ≥ 22.3 is the entire dependency list — every command, all five hook verbs, the web console and both generators run from it, and nothing any bundle ships needs a second interpreter.
+Node ≥ 22.7 is the entire dependency list — every command, all five hook verbs, the web console and both generators run from it, and nothing any bundle ships needs a second interpreter.
 
 ### ✅ After installing
 

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.5.0**.
+> string. Current label: **4.7.0**.
 
 ## Capabilities
 

package/adapters/opencode/HOW-OPENCODE-LOADS.md

@@ -94,7 +94,7 @@ changed for each plugin:
 | `@opencode-ai/plugin` `tool()` helper | `@opencode/plugin`; a plain JSON-schema `input` needs no helper |
 | `todo.updated`, session `summary` diffs | no V2 event. The activity cards show no todos or files on V2 |
 | tool part carries its name | `session.tool.called` has no name; it rides on `session.tool.input.started` |
-| tools `bash`, `apply_patch`, `task` | renamed `shell`, `patch`, `subagent` (the old ids are aliases). The guard's substring classes cover both spellings |
+| tools `bash`, `apply_patch`, `task` | renamed `shell`, `patch`, `subagent` (the old ids are aliases). The guard's substring classes cover both spellings; its usage counter takes `subagent` (type under `agent`) beside `task`, since the hook sees the name before alias resolution |
 
 None of this is checked by a mock alone: `node tests/host_canary.mjs` starts the real V1 and V2
 and fails on the host's own `failed to load plugin` log line.
@@ -124,7 +124,8 @@ to native **skills**, not slash commands (same `SKILL.md` shape as Claude Code).
 | plugin on `session.created` | **context plugin (v2)** — auto-discovers & injects the repo's `eager` docs |
 | plugin on `experimental.session.compacting` | **context plugin** — re-pushes the `eager` docs so they survive compaction |
 | plugin on `session.idle` | **learn plugin** — distils memory into `memory/` (debounced to fire once, at session end) |
-| plugin on `tool.execute.before` | **guard plugin** — blocks secret-file writes and catastrophic shell (Laws I & IV; `GENESEED_GUARD=off\|warn`) |
+| plugin on `experimental.chat.messages.transform` (V1) | **context plugin** — also adds the done gate's reminder when a check in `.geneseed/done-checks.txt` has not passed since the last edit (Verify Before Asserting); OpenCode 2 turns are not judged |
+| plugin on `tool.execute.before` | **guard plugin** — blocks secret-file writes and credential-shaped write content (Sealed Secrets), writes to a protected check or the done list (External Gate), catastrophic shell (Deletion Is Deliberate), a recursive whole-filesystem scan (Commands Must Return), the first rule-store write (Persist Insight) and protected wiki folders; logs each block to the gate ledger and counts skill/subagent use (`GENESEED_GUARD=off\|warn`) |
 | plugin registering a custom tool | **workflow plugin** — the `workflow` tool runs saved orchestration scripts from `workflows/` |
 | `context.json` / `.harness/` (manifest) | *optional* override when discovery doesn't fit |
 

package/adapters/opencode/plugins/geneseed-context.js

@@ -194,8 +194,12 @@ const EXCLUDE_DIRS = new Set([
   ".venv", "__pycache__", ".opencode", ".harness",
 ])
 
-async function isFile(p) { try { return (await fs.stat(p)).isFile() } catch { return false } }
-async function isDir(p) { try { return (await fs.stat(p)).isDirectory() } catch { return false } }
+async function isFile(p) {
+  try { return (await fs.stat(p)).isFile() } catch { return false }
+}
+async function isDir(p) {
+  try { return (await fs.stat(p)).isDirectory() } catch { return false }
+}
 
 // ---- session files (the harness's own) --------------------------------------
 // The files AGENT.md names for session start, relative to the HARNESS dir — the dir that
@@ -666,8 +670,10 @@ async function wikiSets() {
 
     const recs = new Map()   // abs -> { rel, abs, load, desc }
     const put = (abs, load, desc) => {
-      let rel = path.relative(w.path, abs).split(path.sep).join("/")
-      if (rel.startsWith("..")) rel = abs.split(path.sep).join("/")   // outside the root
+      const raw = path.relative(w.path, abs)
+      // outside the root: "..", "../…" or another drive — not a name like "..cache"
+      const outside = raw === ".." || raw.startsWith(".." + path.sep) || path.isAbsolute(raw)
+      const rel = (outside ? abs : raw).split(path.sep).join("/")
       const prev = recs.get(abs)
       recs.set(abs, { rel: `${name}/${rel}`, abs, load, desc: desc || prev?.desc || "" })
     }
@@ -901,6 +907,18 @@ async function readDoneChecks(root) {
 function runsUnpiped(command, line) {
   const cmd = String(command).replace(/[ \t]+/g, " ")
   for (let i = cmd.indexOf(line); i !== -1; i = cmd.indexOf(line, i + 1)) {
+    const next = cmd[i + line.length]
+    if (next !== undefined && !/[\s;&|]/.test(next)) continue
+    const head = cmd.slice(0, i)
+    if (!/(^|&&|\|\||;|\n) ?$/.test(head)) continue
+    let quote = "", esc = false
+    for (const ch of head) {
+      if (esc) esc = false
+      else if (ch === "\\" && quote !== "'") esc = true
+      else if (quote) { if (ch === quote) quote = "" }
+      else if (ch === '"' || ch === "'") quote = ch
+    }
+    if (quote) continue
     const rest = cmd.slice(i + line.length)
     let piped = false
     for (let j = 0; j < rest.length; j += 1) {
@@ -913,6 +931,33 @@ function runsUnpiped(command, line) {
   return false
 }
 
+// An `apply_patch` call names its targets only in `patchText` markers. Copied from
+// geneseed-guard.js (tests/plugins/helper_parity.test.mjs holds the copies equal); `from` is
+// the pre-move path of an `Update File` + `Move to`, `path` where the file lands.
+function patchSections(patchText) {
+  const out = []
+  let current = null
+  const flush = () => { if (current) out.push(current) }
+  const lines = String(patchText).split(/\r?\n/)
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    let m = /^\*\*\* (?:Add|Delete) File:\s*(.+)$/.exec(line)
+    if (m) { flush(); current = { from: "", path: m[1].trim(), added: [] }; continue }
+    m = /^\*\*\* Update File:\s*(.+)$/.exec(line)
+    if (m) {
+      flush()
+      let from = "", p = m[1].trim()
+      const mv = /^\*\*\* Move to:\s*(.+)$/.exec(lines[i + 1] || "")
+      if (mv) { from = p; p = mv[1].trim(); i++ }
+      current = { from, path: p, added: [] }
+      continue
+    }
+    if (current && line.startsWith("+") && !line.startsWith("+++")) current.added.push(line.slice(1))
+  }
+  flush()
+  return out
+}
+
 // The checks still owed, judged over the previous turn and the current one: a reminder lasts
 // one turn, not the whole session. Our own injected messages (`geneseed-*` ids) open no turn.
 function doneOwed(messages, checks, root) {
@@ -925,14 +970,21 @@ function doneOwed(messages, checks, root) {
   for (const m of messages.slice(from)) {
     for (const p of m?.parts ?? []) if (p?.type === "tool" && p.state) tools.push(p)
   }
+  // The Node hook's `within()`: `..cache/x` is inside the root, `../x` is not.
+  const inside = (fp) => {
+    const rel = path.relative(root, path.resolve(root, fp))
+    return !(rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel))
+  }
   let lastEdit = -1
   tools.forEach((p, i) => {
     if (!DONE_EDIT_TOOLS.has(String(p.tool).toLowerCase()) || p.state.status === "error") return
-    const fp = p.state.input?.filePath ?? p.state.input?.file_path
-    if (typeof fp === "string" && fp) {
-      const rel = path.relative(root, path.resolve(root, fp))
-      if (rel.startsWith("..") || path.isAbsolute(rel)) return
-    }
+    const input = p.state.input ?? {}
+    const fp = input.filePath ?? input.file_path
+    const targets = typeof fp === "string" && fp ? [fp]
+      : typeof input.patchText === "string" ? patchSections(input.patchText).flatMap((s) => [s.from, s.path]).filter(Boolean)
+      : []
+    // No derivable target: counted — the reminder is fail-open, a missed one is the worse error.
+    if (targets.length && !targets.some(inside)) return
     lastEdit = i
   })
   if (lastEdit === -1) return []
@@ -947,6 +999,31 @@ function doneOwed(messages, checks, root) {
   return checks.filter((c) => !passed.has(c))
 }
 
+// The session-scope rule, once for both majors and both deliveries: a child/subagent session
+// inherits its parent's context, and a geneseed-* session (learn distils, geneseed-wf:*
+// children) must stay clean.
+const isSkippedSession = (meta) =>
+  Boolean(meta?.parentID ?? meta?.parentId) || String(meta?.title ?? "").startsWith("geneseed-")
+
+// The rule as a per-sid cached filter over `getMeta(sid)` (each major's own session.get shape).
+// Cached because the transform runs on EVERY request; a failed lookup is NOT cached, so the
+// next request re-checks.
+function sessionSkipper(getMeta) {
+  const cache = new Map()
+  return async (sid) => {
+    if (!sid) return false
+    const hit = cache.get(sid)
+    if (hit !== undefined) return hit
+    try {
+      const skip = isSkippedSession(await getMeta(sid))
+      cache.set(sid, skip)
+      return skip
+    } catch {
+      return false
+    }
+  }
+}
+
 export const GeneseedContext = async (ctx) => {
   const { client } = ctx
   const done = new Set()
@@ -963,15 +1040,12 @@ export const GeneseedContext = async (ctx) => {
       // context). The sid is only marked done AFTER the guards pass — marking it
       // earlier would permanently skip a session when a transient session.get
       // failure let it through the title check.
-      let title = "", parent
+      let meta
       try {
         const info = await client.session.get({ path: { id: sid } })
-        const meta = info?.data ?? info
-        title = meta?.title ?? ""
-        parent = meta?.parentID ?? meta?.parentId
+        meta = info?.data ?? info
       } catch {}
-      if (parent) { log("skipped: child/subagent session"); return }
-      if (title.startsWith("geneseed-")) { log("skipped: geneseed-* session"); return }
+      if (isSkippedSession(meta)) { log("skipped: child/subagent or geneseed-* session"); return }
 
       if (await alreadyInjected(client, sid)) { log("skipped: already injected (marker present)"); return }
       done.add(sid)
@@ -998,28 +1072,13 @@ export const GeneseedContext = async (ctx) => {
     }
   }
 
-  // Session-scope filter for the INVISIBLE delivery, mirroring injectVisible's
-  // guards: child/subagent sessions inherit the parent's context, and geneseed-*
-  // sessions (learn distils, geneseed-wf:* children) must stay clean — without this
-  // the transform prepends the full context block to every request of every session
-  // in-process. Cached per sid (the transform runs on EVERY request); a transient
-  // session.get failure is NOT cached so the next request re-checks.
-  const sessionSkip = new Map()
-  async function skipSession(sid) {
-    if (!sid) return false
-    const hit = sessionSkip.get(sid)
-    if (hit !== undefined) return hit
-    try {
-      const info = await client.session.get({ path: { id: sid } })
-      const meta = info?.data ?? info
-      const skip = Boolean(meta?.parentID ?? meta?.parentId) ||
-        String(meta?.title ?? "").startsWith("geneseed-")
-      sessionSkip.set(sid, skip)
-      return skip
-    } catch {
-      return false
-    }
-  }
+  // Session-scope filter for the INVISIBLE delivery, the same rule as injectVisible's
+  // guards — without it the transform prepends the full context block to every request of
+  // every session in-process.
+  const skipSession = sessionSkipper(async (sid) => {
+    const info = await client.session.get({ path: { id: sid } })
+    return info?.data ?? info
+  })
 
   return {
     event: async ({ event }) => {
@@ -1072,13 +1131,15 @@ export const GeneseedContext = async (ctx) => {
     // detects that and takes over with the visible delivery.
     "experimental.chat.messages.transform": async (_input, output) => {
       transformSeen = true                  // the hook exists on this build
+      // One scope decision per request, shared by the done gate and the context block:
+      // both end on an empty request, an excluded repo, or a skipped session.
+      if (!output || !Array.isArray(output.messages) || !output.messages.length) return
+      const sid = output.messages[0]?.info?.sessionID
+      if (await sovereignBypass(root) || await skipSession(sid)) return
       // The done gate's reminder: FIRST, and independent of the context block:
       // INJECT_OFF and the visible delivery leave it on, and no early return below can skip it.
       // Its own function, so its early returns end the reminder, never the context injection.
       await (async () => {
-        if (!output || !Array.isArray(output.messages) || !output.messages.length) return
-        const sid = output.messages[0]?.info?.sessionID
-        if (await sovereignBypass(root) || await skipSession(sid)) return
         const checks = await readDoneChecks(root)
         if (!checks.length) return
         const owed = doneOwed(output.messages, checks, root)
@@ -1094,11 +1155,7 @@ export const GeneseedContext = async (ctx) => {
         log("transform: done-gate reminder injected")
       })().catch((err) => log(`done-gate error: ${err?.message ?? err}`))
       if (INJECT_OFF || !TRANSFORM || fallbackVisible) return
-      if (await sovereignBypass(root)) return
       try {
-        if (!output || !Array.isArray(output.messages) || !output.messages.length) return
-        const sid = output.messages[0]?.info?.sessionID
-        if (await skipSession(sid)) return
         // Already present this request? (idempotent across plugin copies / retries.)
         const present = output.messages.some((m) =>
           (m?.parts ?? []).some((p) => typeof p?.text === "string" && p.text.includes(MARKER)))
@@ -1146,22 +1203,12 @@ const v2Model = (ref) => (ref?.providerID && ref?.id ? `${ref.providerID}/${ref.
 async function setupV2(ctx) {
   const root = repoRoot({ worktree: ctx?.location?.project?.directory, directory: ctx?.location?.directory })
   const blockCache = { text: null, at: 0 }
-  // Same scope rule as V1's skipSession: child/subagent sessions inherit the parent's
-  // context, geneseed-* sessions stay clean. A failed lookup is not cached.
-  const sessionSkip = new Map()
-  async function skipSession(sid) {
-    if (!sid) return false
-    const hit = sessionSkip.get(sid)
-    if (hit !== undefined) return hit
-    try {
-      const info = await ctx.session.get({ sessionID: sid })
-      const skip = Boolean(info?.parentID) || String(info?.title ?? "").startsWith("geneseed-")
-      sessionSkip.set(sid, skip)
-      return skip
-    } catch {
-      return false
-    }
-  }
+  // Same scope rule as V1's skipSession. V2's info names the parent `parentID` only, so only
+  // that and the title are passed on.
+  const skipSession = sessionSkipper(async (sid) => {
+    const info = await ctx.session.get({ sessionID: sid })
+    return { parentID: info?.parentID, title: info?.title }
+  })
 
   // The done gate is not judged on OpenCode 2 (see `doneOwed`): said once, where its log goes.
   if ((await readDoneChecks(root).catch(() => [])).length) {
@@ -1205,7 +1252,7 @@ async function setupV2(ctx) {
       if (ev?.type !== "session.created" || INJECT_OFF) continue
       const d = ev.data ?? {}
       try {
-        if (d.parentID || String(d.title ?? "").startsWith("geneseed-")) continue
+        if (isSkippedSession({ parentID: d.parentID, title: d.title })) continue
         if (await sovereignBypass(root)) continue
         const { block } = await resolveBlock(root)
         if (!block) continue

package/adapters/opencode/plugins/geneseed-guard.js

@@ -2,7 +2,10 @@
 //
 // Enforces the safety Laws at the tool boundary (`tool.execute.before`), the same
 // "enforce by injection, don't just instruct" stance as the context plugin:
-//   - Sealed Secrets:  block writes to private-key / credential files.
+//   - Sealed Secrets:  block writes to private-key / credential files, and any write whose
+//     added content carries a credential-shaped string (`.env`-shaped targets exempt).
+//   - External Gate:  block writes to a check listed in `.geneseed/protected-checks.txt`,
+//     and to the done gate's own list `.geneseed/done-checks.txt`.
 //   - Deletion Is Deliberate:  block catastrophic shell commands.
 //   - Commands Must Return:  block a recursive scan rooted at a whole filesystem (find /).
 //   - Persist Insight (rule vs memory):  speed-bump the first write to user-rules.md
@@ -10,7 +13,10 @@
 //   - Wiki (AGENT.md §8):  block mutations under a declared wiki's `protected`
 //     folders — the user's knowledge base sets its own no-go zones in geneseed-wiki.jsonc.
 // High-confidence patterns only, so legitimate work is never caught. Borderline cases
-// (.env edits, force-push) are WARNED, not blocked.
+// (.env edits, force-push) are WARNED, not blocked. Every block is recorded in the gate
+// ledger (`<cfg>/notebook/gates.jsonl`) under the hook's rule key (`law-1`, `rigor-5`,
+// `law-4`, `ops-2`, `process-1`, `wiki`); every skill or subagent call, blocked or not, is
+// counted in `<cfg>/notebook/usage.jsonl` when that `notebook/` exists and `.usage-off` does not.
 //
 // GENESEED_GUARD=off    disable entirely.
 // GENESEED_GUARD=warn   downgrade every block to a warning (log, but allow).
@@ -222,7 +228,6 @@ const SHELL_WARN_RE = [
   /\bgit\s+switch\b[^\n]*\s(-[a-zA-Z]*f\b|--force\b|--discard-changes\b)/,
   /\bgit\s+restore\b(?:(?![^\n]*--staged\b)|(?=[^\n]*--staged\b)(?=[^\n]*--worktree\b))/,
   /\bgit\s+stash\s+(drop|clear)\b/,
-  /\bgit\s+worktree\b[^\n]*\bremove\b[^\n]*(-[a-zA-Z]*f\b|--force\b)/,
   /\bgit\s+reflog\b[^\n]*\bexpire\b/,
   /\bgit\s+gc\b[^\n]*--prune\b/,
 ]
@@ -317,23 +322,10 @@ const rootArg = (t) => !/^["']/.test(t) && FS_ROOT_RE.test(t)
 // (`packages/opencode/src/patch/index.ts` `parsePatchHeader`): `*** Add File:`,
 // `*** Update File:` (optionally followed by `*** Move to:`, both the old and the new
 // path count) and `*** Delete File:`. The `+`-prefixed body lines are the new file
-// content, never a path, and are not scanned here — no gate in this file inspects
-// write content, only the target path.
+// content, never a path: `parsePatchSections` below collects them for the content secret
+// scan, and this list carries only the target paths, both sides of a move included.
 function parsePatchPaths(patchText) {
-  const out = []
-  const lines = String(patchText).split(/\r?\n/)
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]
-    let m = /^\*\*\* (?:Add|Delete) File:\s*(.+)$/.exec(line)
-    if (m) { out.push(m[1].trim()); continue }
-    m = /^\*\*\* Update File:\s*(.+)$/.exec(line)
-    if (m) {
-      out.push(m[1].trim())
-      const mv = /^\*\*\* Move to:\s*(.+)$/.exec(lines[i + 1] || "")
-      if (mv) { out.push(mv[1].trim()); i++ }
-    }
-  }
-  return out.filter(Boolean)
+  return patchSections(patchText).flatMap((s) => [s.from, s.path]).filter(Boolean)
 }
 
 // Returns every candidate path for this call, normalized (backslashes -> `/`) and,
@@ -362,6 +354,12 @@ function pickPath(args, cwd) {
 // land, so content is attributed to it, not the pre-move path. `*** Delete File:` sections
 // collect no `+` lines (nothing is being written).
 function parsePatchSections(patchText) {
+  return patchSections(patchText).filter((s) => s.path)
+}
+// The one marker parser both lists derive from. `from` is the pre-move path of an
+// `Update File` followed by `Move to` (empty otherwise); `path` is where the file lands.
+// Unfiltered: an empty marker path is dropped by each caller on its own terms.
+function patchSections(patchText) {
   const out = []
   let current = null
   const flush = () => { if (current) out.push(current) }
@@ -369,20 +367,20 @@ function parsePatchSections(patchText) {
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i]
     let m = /^\*\*\* (?:Add|Delete) File:\s*(.+)$/.exec(line)
-    if (m) { flush(); current = { path: m[1].trim(), added: [] }; continue }
+    if (m) { flush(); current = { from: "", path: m[1].trim(), added: [] }; continue }
     m = /^\*\*\* Update File:\s*(.+)$/.exec(line)
     if (m) {
       flush()
-      let p = m[1].trim()
+      let from = "", p = m[1].trim()
       const mv = /^\*\*\* Move to:\s*(.+)$/.exec(lines[i + 1] || "")
-      if (mv) { p = mv[1].trim(); i++ }
-      current = { path: p, added: [] }
+      if (mv) { from = p; p = mv[1].trim(); i++ }
+      current = { from, path: p, added: [] }
       continue
     }
     if (current && line.startsWith("+") && !line.startsWith("+++")) current.added.push(line.slice(1))
   }
   flush()
-  return out.filter((s) => s.path)
+  return out
 }
 
 // The content a write/edit/apply_patch call would actually land on disk, per FILE — what the
@@ -428,8 +426,12 @@ const hasAny = (name, parts) => parts.some((s) => name.includes(s))
 // geneseed-wiki.jsonc (the machine-level knowledge-base manifest) may list `protected` folders
 // per wiki. Mutating anything under one is denied. Same resolution chain as the
 // context plugin: $GENESEED_WIKI -> $GENESEED_HARNESS/geneseed-wiki.jsonc -> beside the install.
-async function isFile(p) { try { return (await fs.stat(p)).isFile() } catch { return false } }
-async function isDir(p) { try { return (await fs.stat(p)).isDirectory() } catch { return false } }
+async function isFile(p) {
+  try { return (await fs.stat(p)).isFile() } catch { return false }
+}
+async function isDir(p) {
+  try { return (await fs.stat(p)).isDirectory() } catch { return false }
+}
 
 // The wiki manifest is JSONC (the seeded stub carries a commented example): strip // and
 // /* */ comments plus trailing commas before parsing — string-aware, so quoted
@@ -589,7 +591,7 @@ function usageOf(tool, args) {
   let kind = null
   let name = null
   if (!t.startsWith("mcp") && t.includes("skill")) { kind = "skill"; name = a.skill ?? a.name ?? a.skill_name }
-  else if (t === "agent" || t === "task") { kind = "agent"; name = a.subagent_type ?? a.agent }
+  else if (t === "agent" || t === "task" || t === "subagent") { kind = "agent"; name = a.subagent_type ?? a.agent }
   if (!kind || typeof name !== "string") return null
   name = name.trim().replace(/^\/+/, "")
   return USAGE_NAME_RE.test(name) ? { kind, name } : null
@@ -612,9 +614,12 @@ export const GeneseedGuard = async (ctx) => {
   const root = () => ctx?.worktree || ctx?.directory || process.cwd()
   return {
     "tool.execute.before": async (input, output) => {
+      // Bypass before counting, the order Claude's toolGate keeps: an excluded repo is
+      // dormant, so nothing is written there. GENESEED_GUARD=off still counts — Claude's
+      // hook has no such switch; GENESEED_NO_USAGE / .usage-off stop the counter.
+      if (await sovereignBypass(root())) return
       await recordUse(input?.tool || input?.name, output?.args || input?.args)
       if (OFF) return
-      if (await sovereignBypass(root())) return
       const tool = (input?.tool || input?.name || "").toLowerCase()
       const args = output?.args || input?.args || {}
       // `rule` is the ledger key, spelled as js/hosts/hooks.mjs spells it (`law-1`,

package/adapters/opencode/plugins/geneseed-learn.js

@@ -304,7 +304,7 @@ function parseFrontmatter(chunk) {
 
 // A memory `name:` becomes a FILENAME and the model writes it, so it is a plain slug or
 // nothing — no separator, no `..`, no drive. The same rule as MEMORY_SLUG_RE in
-// js/hosts/hooks.mjs, inlined because this file ships standalone.
+// js/hosts/memory-files.mjs, inlined because this file ships standalone.
 const MEMORY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$/
 
 // The chunk without its frontmatter `action:` line, which is an instruction, not the fact.

package/docs/guides/install-clone.md

@@ -6,7 +6,7 @@ kind: "concept"
 section: "Install"
 description: "Install from a git clone when npm is out of reach, or when you want to change the harness."
 ---
-Clone the repository when npm is out of reach (for example, a corporate network with no registry access), or when you want to change the harness rather than just use it. A clone needs **git** as well as Node 22.3 or newer. git is what updates the clone.
+Clone the repository when npm is out of reach (for example, a corporate network with no registry access), or when you want to change the harness rather than just use it. A clone needs **git** as well as Node 22.7 or newer. git is what updates the clone.
 
 Each OS has a one-step installer at the root of the clone. It checks for Node and git. If one is missing, it names what to install and where to get it, then stops. **It never installs anything itself.** When the checks pass, it runs the setup wizard and offers to open the web console.
 

package/docs/guides/install.md

@@ -10,7 +10,7 @@ Geneseed builds a harness (the rules, agents, skills and hooks your AI coding to
 
 ## The 5-minute path
 
-The only prerequisite is **Node 22.3 or newer**.
+The only prerequisite is **Node 22.7 or newer**.
 
 ```
 npx geneseed setup
@@ -30,7 +30,7 @@ Next: [Verify it works](verify.md). To see what the install just wrote, read [Wh
 
 ## Prerequisites
 
-- **Node 22.3 or newer.** This is the only hard requirement. Geneseed has zero runtime dependencies, and nothing it installs needs a second interpreter.
+- **Node 22.7 or newer.** This is the only hard requirement. Geneseed has zero runtime dependencies, and nothing it installs needs a second interpreter.
 - **Your agent tool**: OpenCode (recommended), Claude Code, IBM Bob, OpenClaude, or any tool that reads a root instructions file.
 - **git**, for a clone only. A clone updates itself with `git pull`.
 - *Optional:* a document converter (MarkItDown, Pandoc or Docling) if you want the agent to read PDFs and Office files. See [Reading non-markdown docs](read-non-markdown.md).

package/docs/reference/troubleshoot-install.md

@@ -12,7 +12,7 @@ Each entry gives the likely cause, the fix, and how to confirm it worked. First
 
 The one-step installer (`./install`, `install.cmd`, `install.command`) checks Node first and stops:
 
-> `xx  Node v20.11.0 is too old — Geneseed needs 22.3 or newer.`
+> `xx  Node v20.11.0 is too old — Geneseed needs 22.7 or newer.`
 
 **Cause.** No Node on PATH, or an older one — Linux distribution packages are often behind.
 
@@ -24,15 +24,15 @@ The one-step installer (`./install`, `install.cmd`, `install.command`) checks No
 node --version
 ```
 
-prints 22.3 or newer, and the installer's first line reads `ok  Node v…`.
+prints 22.7 or newer, and the installer's first line reads `ok  Node v…`.
 
-## `geneseed needs Node 22.3 or newer`
+## `geneseed needs Node 22.7 or newer`
 
 Run without the installer — `npx geneseed`, a global npm install, or a hook — on an older Node, every Geneseed command stops with one sentence:
 
-> `geneseed needs Node 22.3 or newer; this is Node 20.18.1. Install a current Node from https://nodejs.org (or your package manager), then run the command again.`
+> `geneseed needs Node 22.7 or newer; this is Node 20.18.1. Install a current Node from https://nodejs.org (or your package manager), then run the command again.`
 
-**Cause.** The `node` on PATH is older than 22.3. npm only *warns* about the engine requirement, so a global install succeeds anyway. A hook prints the same sentence and lets the tool call through rather than block it, so on Claude Code, Bob or OpenClaude the hooks are off until Node is upgraded.
+**Cause.** The `node` on PATH is older than 22.7. npm only *warns* about the engine requirement, so a global install succeeds anyway. A hook prints the same sentence and lets the tool call through rather than block it, so on Claude Code, Bob or OpenClaude the hooks are off until Node is upgraded.
 
 **Fix.** Install the current Node.js LTS (see above), open a **new** terminal, and run the command again.
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.5.0"
+  "version": "4.7.0"
 }

package/js/README.md

@@ -82,7 +82,7 @@ user co-owns, and the hook verbs those emitted configs then run.
 | `native.mjs` | Capability specs → host-native subagents and skills. The impure half of the emit |
 | `opencode.mjs` | OpenCode-only extras: colour themes, primary agent, `/commands`, plugins, overrides stub |
 | `installs.mjs` | Detects deployed installs and reads back their theme, footprint, posture, mode and loop trust preset |
-| `mcp.mjs` | MCP server presets, the per-host `mcpServers` config read/write, and toggle state |
+| `mcp.mjs` | Reads each host's MCP config (`mcpServers`, or OpenCode's `mcp`) and where it lives — read-only since 2026-10: the user edits the file, Geneseed only shows it |
 | `link.mjs` | `geneseed link`/`unlink` — the PATH shim, and the only Windows USER-Path registry edit |
 | `owned.mjs` | Manifest rel -> path on disk decisions: `ownedWithin`, the containment boundary `uninstall.mjs` and the driver's prune both go through before acting on an `owned` list entry |
 
@@ -101,7 +101,7 @@ Everything that inspects an already-built or already-deployed harness and report
 |---|---|
 | `doctor.mjs` | The `geneseed doctor` **driver** only: picks themes, runs the checks, prints the verdict |
 | `checks-build.mjs` | Gates over what the build PRODUCED: links, tokens, theme parity, OpenCode colours, bundle drift |
-| `checks-repo.mjs` | Gates over the repo's own records: `registry.json`, committed secrets, the hook shim, vendored pins |
+| `checks-repo.mjs` | Gates over the repo's own records: `registry.json`, committed secrets, the hook shim, vendored pins and folder skills, skill aliases and side files, this module map, the host tables, the scorecard ratchet |
 | `checks-authoring.mjs` | `authoringProblems`, the aggregate self-consistency gate: spec purpose lines, the learn-prompt literal, `node --check` over the plugins (the doctor's one default spawn), then the groups below |
 | `checks-probe.mjs` | `doctor --probe` (opt-in): runs each live install's own gate command through the host's shell on a must-refuse and a must-pass payload — the doctor's second spawn; the OpenCode guard plugin is imported and called in-process instead, through both plugin APIs |
 | `checks-constitution.mjs` | The constitution: rule declarations and citations, LEAN blocks, `HOOK_PINNED`, theme vocabulary, the console's `LAW_META`/`DOCTRINE_META` |
@@ -114,7 +114,8 @@ Everything that inspects an already-built or already-deployed harness and report
 | `diff.mjs` | `geneseed diff` — what a deployed install has that a fresh render of `src/` does not |
 | `excludes.mjs` | `geneseed exclude add|remove|list` — the WRITER for `excludes.json`; `hooks.mjs` only reads it |
 | `registry.mjs` | `installs.json` under XDG — the persistent deploy-root list `rebuild-all` re-emits into |
-| `scorecard.mjs` | `geneseed scorecard` — a port of the AI Harness Scorecard (upstream pinned in its docblock): the repo walk, the CI-YAML subset parser, `assessRepo`, the text/JSON renderers. Pure: no spawn, no network |
+| `scorecard.mjs` | `geneseed scorecard` — a port of the AI Harness Scorecard (upstream pinned in its docblock): the repo walk, the CI-YAML parsing, `assessRepo`, the text/JSON renderers. Pure: no spawn, no network |
+| `scorecard-yaml.mjs` | The YAML 1.1 subset the scorecard reads CI configs with, plus Python's `str()`/`bool()` over its values; `scorecard.mjs` re-exports it. Its ceiling is in its `ponytail:` note |
 | `scorecard-svg.mjs` | The scorecard as an SVG card for a README (`geneseed scorecard --svg`): grade plus one bar per pillar, deterministic so doctor can compare the committed card byte for byte |
 | `scorecard-checks.mjs` | The scorecard's 31 checks in five pillars, ported line for line — ids, points, partial scores, evidence and fixes as upstream writes them |
 
@@ -138,7 +139,7 @@ into files users have committed, so change the test that states it in the same c
 | `udiff.mjs` | `geneseed diff`'s own difflib clone — the alignment IS the printed hunks — plus `splitLines` |
 | `proc.mjs` | One constant: the `windowsHide` flag every spawn in `js/` must reuse |
 | `prompt.mjs` | The line-mode stdin readers — `ask`, `promptLine`, `confirm`, `askChoice` — read a byte at a time so they stop where Enter stops. Shared by `setup`, `uninstall` and `web` without dragging in the wizard |
-| `node-floor.mjs` | The first import of all three binaries: below Node 22.3, one sentence on stderr and exit 1 (0 in the hook) instead of a stack trace |
+| `node-floor.mjs` | The first import of all three binaries: below Node 22.7, one sentence on stderr and exit 1 (0 in the hook) instead of a stack trace |
 
 **Before editing:** parse with `parseJson`, never `JSON.parse` — the latter collapses int `1` and
 float `1.0` into one double, and that value gets written into a user's file. Do not swap in a diff