geneseed 4.5.0 → 4.7.0

package/js/build/bundle.mjs

@@ -24,6 +24,16 @@ import {
 import { writeVersion } from './version.mjs';
 import { existsSync, mkdirSync, renameSync, rmSync } from 'node:fs';
 
+/**
+ * Seed the memory index, then move a flat one to topics — the pair every emit runs on its
+ * memory store, in that order. Here and not in `js/hosts/memory-files.mjs`: `stubs.mjs`
+ * imports that module, so the reverse import would be a cycle.
+ */
+export function ensureMemoryStore(memDir) {
+  ensureMemoryIndex(memDir);
+  migrateMemoryIndex(memDir);
+}
+
 // ---------------------------------------------------------------------------
 // Source completeness
 // ---------------------------------------------------------------------------
@@ -223,8 +233,7 @@ export function build(cfg, themeName, out, { footprint = 'full', nativeCatalog =
   ensureRulesStub(out);
   ensureProfileStub(out);
   ensureBundleGitignore(out);
-  ensureMemoryIndex(path.join(out, theme[SRC_DIR_TOKENS.memory] ?? 'memory'));
-  migrateMemoryIndex(path.join(out, theme[SRC_DIR_TOKENS.memory] ?? 'memory'));
+  ensureMemoryStore(path.join(out, theme[SRC_DIR_TOKENS.memory] ?? 'memory'));
   ensureNotebookIndex(path.join(out, theme[SRC_DIR_TOKENS.notebook] ?? 'notebook'));
   process.stdout.write(`[geneseed] built theme '${themeName}' -> ${out} (${items.length} files)\n`);
 }

package/js/build/driver.mjs

@@ -51,7 +51,7 @@ import {
   openclaudeConfigDir, hostCatalogsNatively,
 } from '../hosts/hosts.mjs';
 import {
-  hashesOf, ownedHashes, ownedState, ownedWithin,
+  hashesOf, ownedHashes, ownedState, ownedWithin, recordedDenies,
 } from '../hosts/owned.mjs';
 
 // P5d moved these out of this file for the reason P5c moved the host resolvers: `harness
@@ -257,15 +257,6 @@ function readManifest(manifestPath) {
   return { existed, doc };
 }
 
-/**
- * An OpenCode manifest's `skill_denies` — the `permission.skill` denies Geneseed itself added
- * (see `opencodeLayer`) — or `[]` when absent or malformed, which sweeps nothing.
- */
-function recordedDenies(doc) {
-  const d = doc && doc.skill_denies;
-  return Array.isArray(d) ? d.filter((n) => typeof n === 'string') : [];
-}
-
 /** The "+ primary agent, N command(s)" tail both OpenCode summary lines share. */
 function extrasTail(stats) {
   const extras = [...(stats.primary ? ['primary agent'] : []),

package/js/build/emit-claude.mjs

@@ -7,24 +7,21 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { migrateMemoryIndex } from '../hosts/memory-files.mjs';
 import { claimer, loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
 import { ensureAgentOverridesStub, writeAliasCommands } from '../hosts/opencode.mjs';
 import {
   managedBlockRemove, managedBlockWrite, mergeClaudeSettings,
   unwireClaudeExcludes, unwireClaudeSettings, wireClaudeExcludes,
 } from '../hosts/settings.mjs';
-import { claimLeaf } from '../hosts/owned.mjs';
-import { writeText } from '../lib/fs.mjs';
 import { get, isDict, isTruthy } from '../lib/json.mjs';
 import { relPosix } from '../lib/text.mjs';
-import { assertSourceComplete, phaseLog } from './bundle.mjs';
+import { assertSourceComplete, phaseLog, ensureMemoryStore } from './bundle.mjs';
 import {
-  globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
+  claimAndWrite, globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
 import { renderAll, renderFile } from './render.mjs';
 import {
-  BOB_RULES_STUB, ensureContextStub, ensureExcludesStub, ensureMemoryIndex, ensureNotebookIndex,
+  BOB_RULES_STUB, ensureContextStub, ensureExcludesStub, ensureNotebookIndex,
   ensureProfileStub,
   ensureRulesStub, ensureWikiStub, WIKI_FILE,
 } from './stubs.mjs';
@@ -100,16 +97,8 @@ export function emitClaudeRender(cfg, job) {
   // slim shadow stub whose only job is to have the same filename.
   if (isBob && agentText !== null) {
     const rulesMd = path.join(cfgDir, 'rules', 'geneseed.md');
-    // `claimLeaf` BEFORE `mkdirSync`: `safeLeaf` walks up to the nearest EXISTING ancestor
-    // (`resolvePath`'s own contract), so it needs no directory created first — and creating
-    // `rules/` first would plant an empty directory at a linked ancestor's target the moment
-    // before the refusal fires.
-    if (claimLeaf(cfgDir, rulesMd, 'rules/geneseed.md')) {
-      mkdirSync(path.dirname(rulesMd), { recursive: true });
-      writeText(rulesMd, scope === 'project' ? BOB_RULES_STUB
-        : stripCapabilityLinks(prefixedAgentText('../') || agentText));
-      owned.push('rules/geneseed.md');
-    }
+    claimAndWrite(cfgDir, rulesMd, 'rules/geneseed.md', scope === 'project' ? BOB_RULES_STUB
+      : stripCapabilityLinks(prefixedAgentText('../') || agentText), owned);
   }
 
   ensureAgentOverridesStub(cfg, cfgDir);
@@ -146,8 +135,7 @@ export function emitClaudeRender(cfg, job) {
   }
 
   const memStatus = globalMemory(cfgDir, items, out, cfg.src);
-  ensureMemoryIndex(path.join(cfgDir, 'memory'));
-  migrateMemoryIndex(path.join(cfgDir, 'memory'));
+  ensureMemoryStore(path.join(cfgDir, 'memory'));
   const nbStatus = globalNotebook(cfgDir, items, out, cfg.src);
   ensureNotebookIndex(path.join(cfgDir, 'notebook'));
   // context.json too: the root names it as the project's own manifest, and until 2026-10 this
@@ -172,10 +160,7 @@ export function emitClaudeRender(cfg, job) {
       // `!existsSync(gi)` is exactly the case a DANGLING symlink also satisfies — it reads
       // as absent — so `claimLeaf` (which lstats) runs before the write, not instead of
       // this check.
-      if (claimLeaf(cfgDir, gi, '.gitignore')) {
-        writeText(gi, `${giLines.join('\n')}\n`);
-        owned.push('.gitignore');
-      }
+      claimAndWrite(cfgDir, gi, '.gitignore', `${giLines.join('\n')}\n`, owned);
     } else if (oldOwned.includes('.gitignore')) {
       owned.push('.gitignore');
     }

package/js/build/emit-common.mjs

@@ -63,7 +63,7 @@ export const TMPL_SPEC_RE = /\{\{DIR_(AGENTS|SKILLS)\}\}\/([A-Za-z0-9_-]+)\.md/g
  * `Path.rglob("*")` restricted to files, skipping `__pycache__` as Python's callers do.
  *
  * `recursive: true, withFileTypes: true` (Node >= 20.1, `parentPath` >= 21.4 — this repo
- * requires >= 22.3) replaces a hand-rolled walk; the order it yields is NOT the walk's
+ * requires >= 22.7) replaces a hand-rolled walk; the order it yields is NOT the walk's
  * order, but `sourceFingerprint`, this function's one caller, re-sorts every result by a
  * plain string key before it is ever observed, so no caller depends on it.
  */
@@ -184,15 +184,22 @@ export function shipLeanLaws(items, theme, cfgDir, owned, footprint) {
     // nothing to detect, not because the gate cannot see it.
     if (text !== null && parts.length && dirs.has(parts[0])) {
       const dest = path.join(cfgDir, ...parts);
-      // `claimLeaf` BEFORE `mkdirSync`, for the same reason `emitClaudeRender`'s rules stub
-      // does: `safeLeaf` needs no directory created first, and creating one ahead of the
-      // refusal would plant it at a linked ancestor's target.
-      if (claimLeaf(cfgDir, dest, rel)) {
-        mkdirSync(path.dirname(dest), { recursive: true });
-        writeText(dest, text);
-        owned.push(rel);
-      }
+      claimAndWrite(cfgDir, dest, rel, text, owned);
     }
   }
 }
 
+/**
+ * Claim-on-create one leaf: write `text` to `dest` and own `rel` only when `claimLeaf`
+ * allows it. `claimLeaf` runs BEFORE `mkdirSync`: `safeLeaf` walks up to the nearest
+ * EXISTING ancestor (`resolvePath`'s own contract), so it needs no directory created first —
+ * and creating the parent first would plant an empty directory at a linked ancestor's target
+ * the moment before the refusal fires. A leaf directly in an existing `root` makes the
+ * `mkdirSync` a no-op.
+ */
+export function claimAndWrite(root, dest, rel, text, owned) {
+  if (!claimLeaf(root, dest, rel)) return;
+  mkdirSync(path.dirname(dest), { recursive: true });
+  writeText(dest, text);
+  owned.push(rel);
+}

package/js/build/emit-opencode.mjs

@@ -8,23 +8,21 @@
  */
 import path from 'node:path';
 import { VERSION_MARKER } from '../hosts/hosts.mjs';
-import { migrateMemoryIndex } from '../hosts/memory-files.mjs';
 import { claimer, loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
 import {
   copyPlugins, copyWorkflows, ensureAgentOverridesStub, writeColorThemes, writeCommandLayer,
   writeAliasCommands, writePonytailCommand, writePrimaryAgent, writeTheme,
 } from '../hosts/opencode.mjs';
 import { mergeOpencodeJson, opencodeSentinelWrite } from '../hosts/settings.mjs';
-import { claimLeaf } from '../hosts/owned.mjs';
 import { isFile, readText, writeText } from '../lib/fs.mjs';
 import { relPosix } from '../lib/text.mjs';
-import { assertSourceComplete, build, phaseLog } from './bundle.mjs';
+import { assertSourceComplete, build, phaseLog, ensureMemoryStore } from './bundle.mjs';
 import {
-  globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
+  claimAndWrite, globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
 import { renderAll } from './render.mjs';
 import {
-  ensureExcludesStub, ensureMemoryIndex, ensureNotebookIndex, ensureProfileStub, ensureRulesStub,
+  ensureExcludesStub, ensureNotebookIndex, ensureProfileStub, ensureRulesStub,
   ensureWikiStub,
 } from './stubs.mjs';
 import { writeVersion } from './version.mjs';
@@ -216,10 +214,7 @@ export function emitOpencodeGlobalRender(cfg, job) {
     // store are siblings, so `memory/` resolves from AGENT.md's own location and stays
     // hermetic — no absolute path a doctor check would flag as an escape.
     const agentDest = path.join(cfgDir, 'AGENT.md');
-    if (claimLeaf(cfgDir, agentDest, 'AGENT.md')) {
-      writeText(agentDest, stripCapabilityLinks(agentText));
-      owned.push('AGENT.md');
-    }
+    claimAndWrite(cfgDir, agentDest, 'AGENT.md', stripCapabilityLinks(agentText), owned);
   }
   // Co-owned, so never in `owned` — see `opencodeSentinelWrite`.
   opencodeSentinelWrite(cfgDir);
@@ -233,8 +228,7 @@ export function emitOpencodeGlobalRender(cfg, job) {
   });
 
   const memStatus = globalMemory(cfgDir, items, out, cfg.src);
-  ensureMemoryIndex(path.join(cfgDir, 'memory'));
-  migrateMemoryIndex(path.join(cfgDir, 'memory'));
+  ensureMemoryStore(path.join(cfgDir, 'memory'));
   const nbStatus = globalNotebook(cfgDir, items, out, cfg.src);
   ensureNotebookIndex(path.join(cfgDir, 'notebook'));
   ensureWikiStub(cfgDir);

package/js/build/generate.mjs

@@ -223,7 +223,7 @@ export function installProfile(host, scope, root, notify = null) {
   // one of them. `null` (no marker) stays `null` so the argv omits the flag, as it always did.
   const excludeRules = excludedRulesOfDir(root, host);
   // Skills left out stay left out: an upgrade that forgot them would put them all back.
-  const excludeSkills = excludedSkillsOfDir(root, notify, host);
+  const excludeSkills = excludedSkillsOfDir(root, host, notify);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
     PACK_ORDER, excludeRules, trust, excludeSkills);

package/js/hosts/hooks-context.mjs

@@ -150,7 +150,7 @@ export { SESSION_FILES, SEED_SHA256 };
 const MAP_COUNT_RE = /^- \[([^\]]*)\]\(topics\/[^)]+\.md\) — (\d+) facts?$/;
 // Past this many facts a topic file stops being a quick read, and the curator splits it.
 const CURATE_TOPIC_MAX = 40;
-const CURATE_NUDGE = '[memory] A topic holds over 40 facts, or facts sit in misc: offer the user '
+const CURATE_NUDGE = `[memory] A topic holds over ${CURATE_TOPIC_MAX} facts, or facts sit in misc: offer the user `
   + 'to dispatch the memory-curator agent to merge, re-topic and archive this store.';
 export { CURATE_TOPIC_MAX, CURATE_NUDGE };
 
@@ -193,9 +193,6 @@ export function sessionFiles(hookRoot) {
   return found;
 }
 
-// Moved to `hosts.mjs` so the gates and `learn` share it; re-exported for this verb's callers.
-export { globalHookStandingDown };
-
 /** `_disp` — relative to the repo root when it sits under it, else verbatim. */
 function disp(pathStr, root) {
   // A path on another drive has no relative form, so it is printed as given. `path.relative`

package/js/hosts/hooks-done.mjs

@@ -51,14 +51,30 @@ export function readDoneChecks(root) {
 }
 
 /**
- * True when `command` runs `line` with no pipe after it in the same segment. A segment ends at
- * `&&`, `||`, `;` or a newline; a single `|` before that end is a pipe. Whitespace is collapsed
- * on both sides. shortcut: quotes are not parsed — a `|` inside a quoted argument after the
- * check reads as a pipe, which only ever refuses a pass, never grants one.
+ * True when `command` runs `line` as a whole command with no pipe after it in the same segment.
+ * A segment ends at `&&`, `||`, `;` or a newline; a single `|` before that end is a pipe. The
+ * check must open a segment (the start, or right after one of those separators) and be followed
+ * by the end, whitespace or a separator, never by more of a word (`npm run lint:fix` does not
+ * prove `npm run lint`); a match inside a quoted string (`-m "ran npm test"`) is text, not a run.
+ * Whitespace is collapsed on both sides. shortcut: the shell is not parsed — a prefix such as
+ * `sudo`/`time`/`env X=1`, a subshell, or a `|` inside a quoted argument after the check all read
+ * as "not run". Every approximation here refuses a pass, so the gate errs toward a reminder.
  */
 export function runsUnpiped(command, line) {
   const cmd = String(command).replace(/[ \t]+/g, ' ');
   for (let i = cmd.indexOf(line); i !== -1; i = cmd.indexOf(line, i + 1)) {
+    const next = cmd[i + line.length];
+    if (next !== undefined && !/[\s;&|]/.test(next)) continue;
+    const head = cmd.slice(0, i);
+    if (!/(^|&&|\|\||;|\n) ?$/.test(head)) continue;
+    let quote = '', esc = false;
+    for (const ch of head) {
+      if (esc) esc = false;
+      else if (ch === '\\' && quote !== "'") esc = true;
+      else if (quote) { if (ch === quote) quote = ''; }
+      else if (ch === '"' || ch === "'") quote = ch;
+    }
+    if (quote) continue;
     const rest = cmd.slice(i + line.length);
     let piped = false;
     for (let j = 0; j < rest.length; j += 1) {
@@ -126,8 +142,10 @@ export function doneDecide(transcript, checks, root, cwd = root) {
 /**
  * The Stop-side wrapper `cmdLearn` calls first. Returns true when it printed a block (the turn
  * goes on, so `learn` must not distil yet); false in every other case, with nothing on stdout.
+ * `install` is the root `cmdLearn` already derived from `--memory` (null without one), so the
+ * ledger lands in the same root its sovereignty check read.
  */
-export function doneGate(meta, args) {
+export function doneGate(meta, args, install) {
   try {
     const cwd = typeof meta.cwd === 'string' && meta.cwd ? meta.cwd : process.cwd();
     const root = gitRootOf(cwd);
@@ -148,7 +166,6 @@ export function doneGate(meta, args) {
     }
     const missing = doneDecide(transcript, checks, root, cwd);
     if (!missing.length) return false;
-    const install = args.memory ? path.dirname(args.memory) : null;
     if (meta.stop_hook_active === true) {
       recordGate(install, 'done-gate-cap', 'law-3');
       err(`[done-gate] cap reached — turn ends with unproven checks: ${missing.join('; ')}\n`);

package/js/hosts/hooks-learn.mjs

@@ -293,12 +293,12 @@ export function cmdLearn(args) {
   }
 
   // The Stop/SubagentStop hook always passes `--memory <cfg>/memory`; inside an excluded
-  // folder the global install must not learn.
-  if (args.memory && sovereignBypass(path.dirname(toPlatformPath(args.memory)))) return 0;
+  // folder the global install must not learn. The done gate's ledger lives in the same root.
+  const install = args.memory ? path.dirname(toPlatformPath(args.memory)) : null;
+  if (install && sovereignBypass(install)) return 0;
   // Same install root, and a project install of this host beside it learns on its own Stop: a
   // second LLM call, and the global store learning facts the project owns (Claude B4).
-  if (args.memory && globalHookStandingDown(path.dirname(toPlatformPath(args.memory)),
-    hookProjectDir(), args.host, 'learn')) return 0;
+  if (install && globalHookStandingDown(install, hookProjectDir(), args.host, 'learn')) return 0;
 
   const raw = args.file ? readText(args.file) : readStdin();
   const meta = hookMeta(raw);
@@ -312,7 +312,7 @@ export function cmdLearn(args) {
 
   // The done gate (#289) judges the turn BEFORE anything here spawns, and only on Stop. A block
   // means the turn goes on, so there is nothing to distil yet: the next Stop will.
-  if (hookEvent === 'Stop' && !args.file && doneGate(meta, args)) return 0;
+  if (hookEvent === 'Stop' && !args.file && doneGate(meta, args, install)) return 0;
 
   // I2 (Bob): its Stop payload never carries `transcript_path`, so there is never a transcript
   // to distil — and the bare envelope itself is not notes text (that would waste a model call

package/js/hosts/hooks.mjs

@@ -90,11 +90,14 @@ const GIT_GATE_RE = /\bgit\b[^\n]*\b(?:commit|push)\b/;
 // chase — add them if a probe ever shows one in real use), `checkout -f`/`--force` and
 // `switch -f`/`--force`/`--discard-changes`
 // (git's own `-h` lists `-f, --force` AND a separate `--discard-changes` for switch — both
-// discard uncommitted work the same way `checkout --` does), `worktree remove --force`/`-f`
-// (can discard an uncommitted worktree), `reflog expire` and `gc --prune=now` (delete the
-// reflog/dangling-commit safety net recovery depends on), and `push :branch`/`push --delete`
-// (deletes a remote branch — the colon form needs a space before the `:` so `push origin
-// HEAD:main`, an ordinary refspec, is not caught).
+// discard uncommitted work the same way `checkout --` does), `reflog expire` and `gc
+// --prune=now` (delete the reflog/dangling-commit safety net recovery depends on), and `push
+// :branch`/`push --delete` (deletes a remote branch — the colon form needs a space before the
+// `:` so `push origin HEAD:main`, an ordinary refspec, is not caught).
+//
+// `worktree remove --force`/`-f` is deliberately NOT here (user decision, 2026-10-17): removing
+// a worktree is routine agent housekeeping, so it passes like a plain `worktree remove`. The
+// OpenCode guard's `SHELL_WARN_RE` and `LAW_IV_BASH` (js/hosts/settings.mjs) dropped it too.
 //
 // `restore` and `stash drop`/`stash clear` are carved OUT of the shared `\bgit\b[^\n]*\b(…)`
 // wrapper above and anchored to the verb position instead (`git`, an optional `-C <path>`, then
@@ -106,7 +109,7 @@ const GIT_GATE_RE = /\bgit\b[^\n]*\b(?:commit|push)\b/;
 // combination DOES discard working-tree changes, unlike `--staged` alone) while still deferring
 // on `--staged` alone.
 const DESTRUCTIVE_GIT_RE =
-  /\bgit\b[^\n]*\b(?:reset\b[^\n]*\s--hard\b|clean\b[^\n]*\s(?:-[a-zA-Z]*f|--force\b)|branch\b[^\n]*\s(?:-D\b|--delete\b[^\n]*--force\b|--force\b[^\n]*--delete\b)|checkout\s+--\s|checkout\b[^\n]*\s(?:-[a-zA-Z]*f\b|--force\b)|switch\b[^\n]*\s(?:-[a-zA-Z]*f\b|--force\b|--discard-changes\b)|worktree\b[^\n]*\bremove\b[^\n]*(?:-[a-zA-Z]*f\b|--force\b)|reflog\b[^\n]*\bexpire\b|gc\b[^\n]*--prune\b|push\b[^\n]*(?:\s--force|\s-[a-zA-Z]*f\b|\s\+\S|\s--delete\b|\s:\S))|\bgit(?:\s+-C\s+\S+)*\s+restore\b(?:(?![^\n]*--staged\b)|(?=[^\n]*--staged\b)(?=[^\n]*--worktree\b))|\bgit(?:\s+-C\s+\S+)*\s+stash\s+(?:drop|clear)\b/;
+  /\bgit\b[^\n]*\b(?:reset\b[^\n]*\s--hard\b|clean\b[^\n]*\s(?:-[a-zA-Z]*f|--force\b)|branch\b[^\n]*\s(?:-D\b|--delete\b[^\n]*--force\b|--force\b[^\n]*--delete\b)|checkout\s+--\s|checkout\b[^\n]*\s(?:-[a-zA-Z]*f\b|--force\b)|switch\b[^\n]*\s(?:-[a-zA-Z]*f\b|--force\b|--discard-changes\b)|reflog\b[^\n]*\bexpire\b|gc\b[^\n]*--prune\b|push\b[^\n]*(?:\s--force|\s-[a-zA-Z]*f\b|\s\+\S|\s--delete\b|\s:\S))|\bgit(?:\s+-C\s+\S+)*\s+restore\b(?:(?![^\n]*--staged\b)|(?=[^\n]*--staged\b)(?=[^\n]*--worktree\b))|\bgit(?:\s+-C\s+\S+)*\s+stash\s+(?:drop|clear)\b/;
 
 // `loopExempt` — a WHITELIST, not the blacklist this replaced. A false ask costs one prompt; a
 // false allow publishes. So the exemption holds only when the ENTIRE command is built from
@@ -445,6 +448,8 @@ export function rootScan(command) {
       const m = /^-path[=:](.+)$/i.exec(t);
       return m ? m[1] : t;
     });
+    // For ls/dir a PowerShell `-Recurse` abbreviation counts from `-re` up: a bare `-r` there is the
+    // POSIX reverse flag (`ls -r /`, `dir -r C:\`). gci/Get-ChildItem keep the full abbreviation set.
     if (!always && !argv.some((a) => (grep && GREP_RECURSE_RE.test(a))
       || (ls && (LS_RECURSE_RE.test(a) || (a.length >= 3 && PS_RECURSE_RE.test(a))))
       || (ps && PS_RECURSE_RE.test(a)))) continue;
@@ -452,8 +457,6 @@ export function rootScan(command) {
   }
   return null;
 }
-// For ls/dir a PowerShell `-Recurse` abbreviation counts from `-re` up: a bare `-r` there is the
-// POSIX reverse flag (`ls -r /`, `dir -r C:\`). gci/Get-ChildItem keep the full abbreviation set.
 const unquote = (t) => t.replace(/^["']+|["']+$/g, '');
 // A QUOTED token is data — a grep pattern (`grep -rn "/" src`), a path named in a search
 // (`rg "/mnt/c" README.md`) — never a root target; only an unquoted root is one.
@@ -527,19 +530,19 @@ const SECRET_RE =
   /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,}|sk-ant-[A-Za-z0-9_-]{20,}|xox[abprs]-[0-9A-Za-z-]{10,})\b|-----BEGIN [A-Z ]*PRIVATE KEY-----/;
 const DOTENV_RE = /(^|[\\/])\.env(\.[^\\/]*)?$/;
 
+export const SENSOR_LIST = '.geneseed/protected-checks.txt';
+// The done gate's list (`./hooks-done.mjs`, #289) protects itself too, with or without a
+// protected-checks list: emptying it would disarm the gate it feeds.
+export const DONE_LIST = '.geneseed/done-checks.txt';
 /**
  * External Gate's boundary half: the checks an agent is judged by must sit outside what it can
  * edit, or a failing check is one edit away from a passing one. A project opts in by listing
  * them, one repo-relative path per line (`#` comments), in `.geneseed/protected-checks.txt` at
  * its git root — found by walking up from the WRITE TARGET, not the cwd, so a session in one repo
  * writing into another reads that other repo's list. The list protects itself. Returns the entry
- * the path falls under, or null. ponytail: a write tool only — a shell `sed -i` or redirect is
+ * the path falls under, or null. shortcut: a write tool only — a shell `sed -i` or redirect is
  * not seen here; CI running the checks is the boundary that holds against that.
  */
-export const SENSOR_LIST = '.geneseed/protected-checks.txt';
-// The done gate's list (`./hooks-done.mjs`, #289) protects itself too, with or without a
-// protected-checks list: emptying it would disarm the gate it feeds.
-export const DONE_LIST = '.geneseed/done-checks.txt';
 function protectedCheck(p) {
   try {
     const target = resolvePath(p);
@@ -563,6 +566,14 @@ function ruleGate(args) {
   return ruleDecide(args, readPayload());
 }
 
+// The REPLACE halves of a Roo-style `apply_diff` (`<<<<<<< SEARCH … ======= <new> >>>>>>> REPLACE`).
+// A diff without those markers is a shape we do not know, so it is returned whole: fail closed.
+function diffReplaced(diff) {
+  if (typeof diff !== 'string') return diff;
+  const halves = [...diff.matchAll(/^=======\r?\n([\s\S]*?)^>>>>>>> REPLACE/gm)].map((m) => m[1]);
+  return halves.length ? halves.join('\n') : diff;
+}
+
 function ruleDecide(args, payload) {
   const ti = (payload && payload.tool_input) || {};
   // NotebookEdit names its target `notebook_path`; the settings matcher routes it here too.
@@ -575,9 +586,11 @@ function ruleDecide(args, payload) {
   // cheap, harmless guard in case that ever changes.
   // `diff` (Bob's `apply_diff`) and `replace`/`search` (`search_and_replace`) are Roo-lineage
   // field names the Bob docs never confirm (bob-verdict.md I1) — accepted when present, never
-  // required, same as every field above.
+  // required, same as every field above. Only WRITTEN text is scanned: `search` and a diff's
+  // SEARCH halves are text leaving the file (like Claude's `old_string`), so a secret there is
+  // being removed — blocking it would stop the agent cleaning up a leak.
   const edits = Array.isArray(ti.edits) ? ti.edits.map((e) => e && e.new_string) : [];
-  const body = [ti.content, ti.new_string, ti.new_source, ti.diff, ti.replace, ti.search, ...edits]
+  const body = [ti.content, ti.new_string, ti.new_source, diffReplaced(ti.diff), ti.replace, ...edits]
     .filter((v) => typeof v === 'string').join('\n');
   if (body && !DOTENV_RE.test(p) && SECRET_RE.test(body)) {
     return ask(args, 'rule-gate', 'law-1', `Geneseed (Sealed Secrets) — ${p} would carry a `

package/js/hosts/hosts.mjs

@@ -55,6 +55,8 @@ export function sovereignBypass(root) {
   } catch {
     return false;
   }
+  // Nothing to match, so no reason to pay for the cwd and `.git` reads below on every hook call.
+  if (!entries.length) return false;
   let heres;
   try {
     heres = [normcase(resolvePath(process.cwd()))];

package/js/hosts/installs.mjs

@@ -44,7 +44,7 @@ import { registryRoots } from '../inspect/registry.mjs';
 import { printErr, readText, isFile, isDir } from '../lib/fs.mjs';
 import { formatRepr, isDict } from '../lib/json.mjs';
 import { comparePaths } from '../lib/paths.mjs';
-import { claudeHookShell } from './shim.mjs';
+import { claudeHookShell, hookShimPath } from './shim.mjs';
 
 /**
  * `Path.read_text(encoding="utf-8")`, or null where Python raises OSError.
@@ -567,10 +567,10 @@ const EXCLUDED_SKILLS_RE = /^Excluded skills:[ \t]*(.+?)[ \t]*$/m;
  * name drops out (`resolveSkillNames`), so a skill merge does not quietly re-admit everything
  * else the install left out. Silent unless the caller passes `notify` — status, diff and the
  * console call this on every read; the replays that rebuild an install (`rebuild-all`,
- * `upgrade`, `migrate`) pass it. `host` is last, after `notify`, for the same reason
- * `trustOfDir` puts it last: every existing positional call keeps working unchanged.
+ * `upgrade`, `migrate`) pass it. `host` comes second, the same `(d, host)` order as its
+ * siblings `excludedRulesOfDir`/`doctrinesOfDir`, so the marker readers call alike.
  */
-export function excludedSkillsOfDir(d, notify = null, host = null) {
+export function excludedSkillsOfDir(d, host = null, notify = null) {
   return firstCarrier(d, (carrierPath) => {
     const text = readMaybe(carrierPath);
     if (text === null) return undefined;
@@ -615,9 +615,6 @@ export function emitHostScopeOf(root) {
   return EMIT_HOST_SCOPE.get(emit.trim()) ?? null;
 }
 
-// `DISABLED_STASH` moved to `hosts.mjs`: the hook stand-down reads it and must not import this.
-export { DISABLED_STASH };
-
 /**
  * `_harness_mcp._claude_cfg` — where a Claude-STYLE install keeps its manifest.
  *
@@ -733,12 +730,12 @@ export function installTargets() {
 
 /**
  * Each Claude install whose emitted hook FORM no longer matches this machine's hook shell
- * (`claudeHookShell`; Task 15) — the "Git Bash removed after the emit" gap, which otherwise
+ * (`claudeHookShell`) — the "Git Bash removed after the emit" gap, which otherwise
  * reports nothing: hooks signal through stdout and Claude treats a parse error as non-blocking.
  *
  * Bash form with Git Bash now gone is a PROBLEM: `context`/`learn` fail open under PowerShell
- * (no `onFailure`, so a launch failure there is still non-blocking) and, since Task 1, the two
- * gates fail CLOSED instead (`onFailure: "block"` blocks every Bash/PowerShell/Write/Edit/
+ * (no `onFailure`, so a launch failure there is still non-blocking) while the two gates,
+ * being gates, fail CLOSED instead (`onFailure: "block"` blocks every Bash/PowerShell/Write/Edit/
  * NotebookEdit call until `rebuild-all` re-emits the PowerShell form) — worse for the user
  * either way, so the message below still reports it as drift needing a rebuild; it does not
  * distinguish the two outcomes. PowerShell form with Git Bash now present is a `[note]`: the hooks work,
@@ -771,6 +768,44 @@ export function hookShellProblems(targets = installTargets(), platform = process
   return out;
 }
 
+/**
+ * Every active Claude-STYLE install (`CLAUDE_STYLE`: claude, bob, openclaude — the hosts that
+ * share this one machine-wide shim) whose LIVE, recorded hooks still name `shimPath` by exact
+ * string, keyed by its own config dir.
+ *
+ * Split out of `shimProblems` (`js/inspect/checks-repo.mjs`) for the case `shimDeadPaths`
+ * cannot see: that function reads paths back OUT of the shim body, so it has nothing to read once the shim file is gone
+ * outright (deleted, not moved-and-regenerated) — a plain `isFile` check upstream then calls
+ * that clean, the same as a source checkout that never emitted. `liveRecordedHooks` is already
+ * "the manifest claims it AND the settings file still runs it" (`js/hosts/hosts.mjs`), so a
+ * disabled or never-wired install cannot appear here — only installs for which the missing
+ * shim is a live, standing failure. It also keeps only handlers whose `command` is a string,
+ * so the match below needs no type guard of its own.
+ *
+ * MATCHES THE EXACT PATH, not merely a command that mentions the shim's filename
+ * (`geneseed-hook`): the shim path is baked per `GENESEED_HOME`, so a machine with more than
+ * one Geneseed home (a relocated one, or a sandboxed test run beside a real install) must not
+ * let an install naming a DIFFERENT, perfectly healthy shim answer for this one.
+ *
+ * LIVES HERE, beside the `claudeCfg` and `installTargets` it is built on, because neither
+ * reader owns the install walk: doctor's `shimProblems`, and `status`'s `gateSummary`
+ * (`js/inspect/status.mjs`), which folds the same answer into its `dead` field — the one
+ * `statusLines` renders as a `DEAD` gates row. Two readers of one fact, not two copies.
+ *
+ * `targets` is a parameter, the same convention `hookShellProblems` uses, so a test can hand
+ * it a sandboxed `[host, scope, root]` triple instead of walking this machine's real config
+ * dirs and registry — the live default every production caller takes.
+ */
+export function installsReferencingShim(shimPath = hookShimPath(), targets = installTargets()) {
+  const out = [];
+  for (const [host, scope, root] of targets) {
+    if (!CLAUDE_STYLE.includes(host)) continue;
+    const cfg = claudeCfg(root, scope, host);
+    if (liveRecordedHooks(cfg).some(([, h]) => h.command.includes(shimPath))) out.push(cfg);
+  }
+  return out;
+}
+
 // ---- what this machine installed (`_harness_setup._installed_defaults`) --------------------
 
 /**

package/js/hosts/native.mjs

@@ -34,6 +34,11 @@ import { jsonDumps, parseJson, formatValue, formatRepr, isTruthy, isDict } from
 import { relPosix } from '../lib/text.mjs';
 import { aliasesOf } from '../build/source.mjs';
 import { claimLeaf, ownedState } from './owned.mjs';
+// `lstripNewlines` on spec bodies is a no-op on every input the generator produces today
+// (measured: no file under `src/` and no rendered spec in any theme begins with a newline), so
+// mutating it away leaves the parity gate green — correctly, there is no reachable behaviour to
+// detect. Kept because a spec author adding a leading blank line is one commit from needing it.
+import { lstripNewlines } from './settings.mjs';
 
 /** What a folder skill writes where it needs its own directory — see `writeNativeLayer`. */
 const SKILL_DIR_PLACEHOLDER = '<this-skill-directory>';
@@ -704,16 +709,3 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
   }
   return { nAgents, nSkills, written, userOnlySkills };
 }
-
-/**
- * `str.lstrip("\n")` — only newlines, not all whitespace.
- *
- * Currently a no-op on every input the generator produces: measured, no file under `src/`
- * and no rendered spec in any of the 14 themes begins with a newline. Mutating it away
- * leaves the parity gate green, and that is correct rather than a hole — there is no
- * reachable behaviour to detect. Kept because it is what the Python does, and a spec
- * author adding a leading blank line is one commit away from making it matter.
- */
-function lstripNewlines(text) {
-  return text.replace(/^\n+/, '');
-}