geneseed 4.5.0 → 4.7.0

package/js/hosts/opencode.mjs

@@ -28,6 +28,7 @@ import { jsonDumps, jsonDumpsIndent, parseJson } from '../lib/json.mjs';
 import { comparePaths } from '../lib/paths.mjs';
 import { sourceReleaseVersion } from '../build/version.mjs';
 import { aliasesOf } from '../build/source.mjs';
+import { lstripNewlines } from './settings.mjs';
 import {
   firstBlockquote, isUserInvokedOnly, skillDescription, stripSkillBodyLinks, pointSideFiles,
   pushOverrideLines,
@@ -295,7 +296,7 @@ export function writePrimaryAgent(cfg, agentsDir, overrides, claim = (_dest) =>
       || !statSync(cfg.primaryAgentSrc).isFile()) {
     return null;
   }
-  const body = readText(cfg.primaryAgentSrc).replace(/^\n+/, '');
+  const body = lstripNewlines(readText(cfg.primaryAgentSrc));
   const desc = 'Primary orchestrator — works by the harness Rules and delegates to the '
     + 'capability subagents.';
   const fm = [`description: ${jsonDumps(desc)}`, 'mode: primary', 'color: primary'];
@@ -309,19 +310,43 @@ export function writePrimaryAgent(cfg, agentsDir, overrides, claim = (_dest) =>
   return dest;
 }
 
-/** `_build_emit._write_command_layer` — the opt-in /slash commands. */
-export function writeCommandLayer(cfg, items, commandDir, claim = (_dest) => true,
-  skillDirOf = (n) => path.join(path.dirname(commandDir), 'skills', n).split(path.sep).join('/')) {
-  if (!truthyEnv('GENESEED_COMMANDS')) return [];
-  const byName = new Map();
+/**
+ * The top-level skills of `items` (`src/skills/<stem>.md`, no `_` partials) as ordered
+ * `[stem, text]` pairs — the one parse both command writers below share.
+ */
+function topLevelSkills(cfg, items) {
+  /** @type {[string, string][]} */
+  const found = [];
   for (const { text, src } of items) {
     if (text === null) continue;
     const sp = path.relative(cfg.src, src).split(path.sep);
     if (sp.length === 2 && sp[0] === 'skills' && sp[1].endsWith('.md')
         && !sp[1].startsWith('_')) {
-      byName.set(sp[1].slice(0, -3), text);
+      found.push([sp[1].slice(0, -3), text]);
     }
   }
+  return found;
+}
+
+/** Both command writers' default `skillDirOf`: the skill's own directory beside `commandDir`. */
+const siblingSkillDir = (commandDir) => (n) =>
+  path.join(path.dirname(commandDir), 'skills', n).split(path.sep).join('/');
+
+/** A command has no base directory, so a side-file pointer names the skill's own. */
+function commandBody(text, stem, skillDir) {
+  return stripSkillBodyLinks(pointSideFiles(lstripNewlines(text), stem, skillDir));
+}
+
+function writeCommandFile(dest, desc, body) {
+  mkdirSync(path.dirname(dest), { recursive: true });
+  writeText(dest, `---\ndescription: ${jsonDumps(desc)}\n---\n\n${body}`);
+}
+
+/** `_build_emit._write_command_layer` — the opt-in /slash commands. */
+export function writeCommandLayer(cfg, items, commandDir, claim = (_dest) => true,
+  skillDirOf = siblingSkillDir(commandDir)) {
+  if (!truthyEnv('GENESEED_COMMANDS')) return [];
+  const byName = new Map(topLevelSkills(cfg, items));
   const written = [];
   for (const [name, skill] of Object.entries(COMMAND_SET)) {
     // A command runs a skill; `--exclude-skills` took that skill out, so the command goes too.
@@ -333,10 +358,7 @@ export function writeCommandLayer(cfg, items, commandDir, claim = (_dest) => tru
     const dest = path.join(commandDir, `${name}.md`);
     if (!claim(dest)) continue;
     const desc = firstBlockquote(text);
-    // A command has no base directory, so a side-file pointer names the skill's own.
-    const body = stripSkillBodyLinks(pointSideFiles(text.replace(/^\n+/, ''), skill, skillDirOf(skill)));
-    mkdirSync(path.dirname(dest), { recursive: true });
-    writeText(dest, `---\ndescription: ${jsonDumps(desc)}\n---\n\n${body}`);
+    writeCommandFile(dest, desc, commandBody(text, skill, skillDirOf(skill)));
     written.push(dest);
   }
   return written;
@@ -358,22 +380,15 @@ export function writeCommandLayer(cfg, items, commandDir, claim = (_dest) => tru
  * (Task 4) — it keeps its SKILL.md and does not need a second, command-shaped copy.
  */
 export function writeAliasCommands(cfg, items, commandDir, claim = (_dest) => true,
-  skillDirOf = (n) => path.join(path.dirname(commandDir), 'skills', n).split(path.sep).join('/'),
-  alsoUserOnly = false) {
+  skillDirOf = siblingSkillDir(commandDir), alsoUserOnly = false) {
   const written = [];
-  for (const { text, src } of items) {
-    if (text === null) continue;
-    const sp = path.relative(cfg.src, src).split(path.sep);
-    if (sp.length !== 2 || sp[0] !== 'skills' || !sp[1].endsWith('.md') || sp[1].startsWith('_')) continue;
-    const stem = sp[1].slice(0, -3);
-    const body = stripSkillBodyLinks(pointSideFiles(text.replace(/^\n+/, ''), stem, skillDirOf(stem)));
+  for (const [stem, text] of topLevelSkills(cfg, items)) {
+    const body = commandBody(text, stem, skillDirOf(stem));
     const names = alsoUserOnly && isUserInvokedOnly(text) ? [...aliasesOf(text), stem] : aliasesOf(text);
     for (const name of names) {
       const dest = path.join(commandDir, `${name}.md`);
       if (!claim(dest)) continue;
-      mkdirSync(path.dirname(dest), { recursive: true });
-      const desc = name === stem ? skillDescription(text) : `Alias of ${stem}.`;
-      writeText(dest, `---\ndescription: ${jsonDumps(desc)}\n---\n\n${body}`);
+      writeCommandFile(dest, name === stem ? skillDescription(text) : `Alias of ${stem}.`, body);
       written.push(dest);
     }
   }

package/js/hosts/owned.mjs

@@ -144,11 +144,25 @@ export function hashesOf(doc) {
 }
 
 /**
- * Where one owned file stands against its recorded hash — the table later tasks (rebuild,
- * prune, uninstall) will branch on to stop clobbering a user's edit to a Geneseed-owned file.
- * `'unknown'` is deliberately distinct from `'unmodified'`: an older manifest with no `hashes`
- * entry for this rel (today's installs, pre-Task-3) must not be read as "proven untouched" —
- * see the constraint that a manifest without `hashes` keeps today's behaviour exactly.
+ * An OpenCode manifest's `skill_denies` — the `permission.skill` denies Geneseed itself added
+ * (`opencodeLayer` records them; a deny the user wrote, even on a Geneseed skill, is never in
+ * it) — or `[]` when the manifest, or the key, is absent or malformed, which sweeps nothing.
+ * Unlike the Law IV `permission.bash` gates (permanent, never taken back — see
+ * `reconcileOpencodePermission`), a skill-visibility deny is reversible: once uninstalled there
+ * is no skill left to hide, and the name is the user's to reuse. One home because rebuild's
+ * deny sweep and uninstall must agree on what Geneseed owns.
+ */
+export function recordedDenies(doc) {
+  const d = doc && doc.skill_denies;
+  return Array.isArray(d) ? d.filter((n) => typeof n === 'string') : [];
+}
+
+/**
+ * Where one owned file stands against its recorded hash — the table rebuild, prune and
+ * uninstall branch on so none of them clobbers a user's edit to a Geneseed-owned file.
+ * `'unknown'` is deliberately distinct from `'unmodified'`: a manifest written before hashes
+ * were recorded has no entry for this rel, and must not be read as "proven untouched" — a
+ * manifest without `hashes` keeps the pre-hash behaviour exactly.
  */
 export function ownedState(root, rel, hashes) {
   if (!Object.hasOwn(hashes, rel)) return 'unknown';

package/js/hosts/settings.mjs

@@ -103,11 +103,16 @@ const consentRuleOn = (d, excluded = []) =>
  * like `-d`, so it is deliberately NOT a key here; `-D --force`/`--delete -f`/`-d --force`/
  * `-df` are the same act again and are a known ceiling this does not chase); `checkout
  * -f`/`--force` and `switch -f`/`--force`/`--discard-changes` (git's own `switch -h` lists
- * `-f, --force` and `--discard-changes` as two separate options); `worktree remove -f`/`--force` (both
- * flag-then-path and path-then-flag order); `reflog expire`; `gc --prune` (matched bare, since
- * a `--prune` with no `=now` still eventually prunes); and `push *--delete*` / `push * :*` (a
- * literal space before the colon, so `push origin HEAD:main`, an ordinary refspec, does not
- * match).
+ * `-f, --force` and `--discard-changes` as two separate options); `reflog expire`; `gc
+ * --prune` (matched bare, since a `--prune` with no `=now` still eventually prunes); and `push
+ * *--delete*` / `push * :*` (a literal space before the colon, so `push origin HEAD:main`, an
+ * ordinary refspec, does not match).
+ *
+ * `git worktree remove -f`/`--force` was a key here and was REMOVED (user decision, 2026-10-17:
+ * worktree removal is routine housekeeping, not a Law IV deletion). Removal from this list also
+ * removes the four globs from `OWNED_BASH`, so an `opencode.json` written before keeps them —
+ * neither taken back nor reported as stranded, since Geneseed no longer claims them. Its user
+ * deletes them by hand (the CHANGELOG upgrade note says so).
  *
  * `git restore` is DELIBERATELY NOT HERE. Its rule is "ask unless `--staged` appears ALONE" —
  * `--staged --worktree` together still discards the working tree — and a glob has no negation,
@@ -128,8 +133,6 @@ const LAW_IV_BASH = ['git push --force*', 'git push -f*', 'git push *--force*',
   'git checkout -f*', 'git checkout * -f*', 'git checkout --force*', 'git checkout * --force*',
   'git switch -f*', 'git switch * -f*', 'git switch --force*', 'git switch * --force*',
   'git switch --discard-changes*', 'git switch * --discard-changes*',
-  'git worktree remove -f*', 'git worktree remove --force*',
-  'git worktree remove * -f*', 'git worktree remove * --force*',
   'git reflog expire*', 'git gc --prune*', 'git gc * --prune*',
   'git stash drop*', 'git stash clear*',
   'git push *--delete*', 'git push * :*'];
@@ -145,7 +148,8 @@ const LAW_IV_BASH = ['git push --force*', 'git push -f*', 'git push *--force*',
  * `-u origin`/`--set-upstream origin`/any remote through its leading `*`; the second key covers
  * the `refs/heads/` spelling the same way.
  *
- * ORDER IS LOAD-BEARING. `defaultPermission` appends these AFTER `git push*`'s ask (so a loop
+ * ORDER IS LOAD-BEARING. `PUSH_CHAIN` (which `defaultPermission` and `OWNED_BASH` both read)
+ * puts these AFTER `git push*`'s ask (so a loop
  * push is not swallowed by the blanket consent ask) and BEFORE `LAW_IV_BASH` (so `findLast`
  * — OpenCode's own `permission.bash` evaluator — lets a force push, a `+refspec`, or a
  * `--delete`/bare-`:` push still ask even when the target is `loop/*`; those LAW_IV_BASH keys
@@ -222,18 +226,22 @@ const LOOP_PUSH_ASK_FLAG_EXTRA = [
 ];
 const LOOP_PUSH_ASK_TRAILING = ['git push * HEAD:loop/* ?*', 'git push * HEAD:refs/heads/loop/* ?*'];
 
+/**
+ * The tiers after `git push*`, in the `findLast` order the docblocks above depend on — ONE
+ * ordered table, so `defaultPermission` and `OWNED_BASH` cannot disagree about it.
+ */
+const PUSH_CHAIN = [
+  [LOOP_PUSH_ALLOW, 'allow'], [LOOP_PUSH_ASK_EXTRA, 'ask'], [LOOP_PUSH_ALLOW_FLAG, 'allow'],
+  [LOOP_PUSH_ASK_FLAG_EXTRA, 'ask'], [LOOP_PUSH_ASK_TRAILING, 'ask'], [LAW_IV_BASH, 'ask'],
+];
+
 function defaultPermission(doctrines = null, excluded = []) {
   const bash = { 'rm -rf *': 'ask' };
   if (consentRuleOn(doctrines, excluded)) {
     bash['git commit*'] = 'ask';
     bash['git push*'] = 'ask';
   }
-  for (const k of LOOP_PUSH_ALLOW) bash[k] = 'allow';
-  for (const k of LOOP_PUSH_ASK_EXTRA) bash[k] = 'ask';
-  for (const k of LOOP_PUSH_ALLOW_FLAG) bash[k] = 'allow';
-  for (const k of LOOP_PUSH_ASK_FLAG_EXTRA) bash[k] = 'ask';
-  for (const k of LOOP_PUSH_ASK_TRAILING) bash[k] = 'ask';
-  for (const k of LAW_IV_BASH) bash[k] = 'ask';
+  for (const [keys, verdict] of PUSH_CHAIN) for (const k of keys) bash[k] = verdict;
   return { bash };
 }
 
@@ -245,8 +253,7 @@ function defaultPermission(doctrines = null, excluded = []) {
  * the pack returns, and to name it when this build no longer wants it but will not remove it.
  */
 const OWNED_BASH = ['rm -rf *', 'git commit*', 'git push*',
-  ...LOOP_PUSH_ALLOW, ...LOOP_PUSH_ASK_EXTRA, ...LOOP_PUSH_ALLOW_FLAG, ...LOOP_PUSH_ASK_FLAG_EXTRA,
-  ...LOOP_PUSH_ASK_TRAILING, ...LAW_IV_BASH];
+  ...PUSH_CHAIN.flatMap(([keys]) => keys)];
 
 /**
  * Bring an ALREADY-WRITTEN `permission` block back into line with the pack selection, and
@@ -626,7 +633,8 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
     // skill reconcile above never ran either — the unwired skill denies are folded into THIS
     // one WARN rather than going unmentioned (a dedicated `skillOpaque` needs `perm` to be a
     // dict to even look at `perm.skill`, which this case by definition is not).
-    const names = [...OWNED_BASH.filter((k) => has(defaultPermission(doctrines, excluded).bash, k)),
+    const wanted = defaultPermission(doctrines, excluded).bash;
+    const names = [...OWNED_BASH.filter((k) => has(wanted, k)),
       ...(!permIsObject ? skillNames : [])];
     process.stderr.write(`[geneseed] WARN: "permission" in ${path.basename(target)} `
       + `${opaque}, so Geneseed cannot wire its own gates into it — including `
@@ -1236,7 +1244,8 @@ export function managedBlockRead(p, blockId = 'GENESEED') {
   return stripNewlines(inner.slice(0, inner.indexOf(end)));
 }
 
-function lstripNewlines(s) {
+/** `str.lstrip("\n")`; the one copy — `native.mjs` and `opencode.mjs` import it from here. */
+export function lstripNewlines(s) {
   return s.replace(/^\n+/, '');
 }
 

package/js/hosts/shim.mjs

@@ -9,8 +9,9 @@
  * `js/build/driver.mjs`, and through it the whole generator, for the two-line
  * `hookRunnerEntry`, which now lives here beside the `hookPrefix` that consumes its answer.
  *
- * Keep this module's imports to `node:` builtins, `js/lib/fs.mjs` and `./hosts.mjs`: being
- * cheap to load is its whole reason to exist.
+ * Keep this module's imports to `node:` builtins, `js/lib/fs.mjs`, `./hosts.mjs` and
+ * `./hooks-prims.mjs` (whose only import, `js/lib/paths.mjs`, `./hosts.mjs` already loads):
+ * being cheap to load is its whole reason to exist.
  */
 import {
   chmodSync, existsSync, mkdirSync, realpathSync, renameSync, statSync, writeFileSync,
@@ -19,6 +20,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { readText, isOsError } from '../lib/fs.mjs';
 import { expanduser } from './hosts.mjs';
+import { isFile } from './hooks-prims.mjs';
 
 /** The checkout this module ships in — `js/build/source.mjs`'s `ROOT`, computed locally so the
  * shim does not import the source loader. */
@@ -295,7 +297,6 @@ export function claudeHookShell(env = process.env, platform = process.platform)
  */
 export function claudeGitBashPath(env = process.env) {
   const read = (name) => Object.entries(env).find(([k]) => k.toUpperCase() === name)?.[1];
-  const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
   const forced = read('CLAUDE_CODE_GIT_BASH_PATH');
   if (forced && GIT_BASH_NAMES.has(path.basename(forced).toLowerCase()) && isFile(forced)) {
     return forced;

package/js/hosts/usage.mjs

@@ -26,8 +26,9 @@ const NAME_RE = /^[A-Za-z0-9][\w.:@/-]{0,99}$/;
 /**
  * `{kind, name}` for a skill or subagent call, else null. Reads the Claude shape (`tool_name` /
  * `tool_input`: `Skill` → `skill`, `Agent` or the older `Task` → `subagent_type`), OpenCode's
- * (`skill` → `name`, `task` → `subagent_type`) and, best-effort, Bob's (`tool` / `input`, any
- * tool whose name contains "skill"): Bob's skill tool name is unverified, no Bob runs here.
+ * (`skill` → `name`, `task` → `subagent_type`; V2 hooks see the pre-alias `subagent` → `agent`)
+ * and, best-effort, Bob's (`tool` / `input`, any tool whose name contains "skill"): Bob's skill
+ * tool name is unverified, no Bob runs here.
  */
 export function usageOf(payload) {
   if (!payload || typeof payload !== 'object') return null;
@@ -38,7 +39,7 @@ export function usageOf(payload) {
   if (!tool.startsWith('mcp') && tool.includes('skill')) {
     kind = 'skill';
     name = ti.skill ?? ti.name ?? ti.skill_name;
-  } else if (tool === 'agent' || tool === 'task') {
+  } else if (tool === 'agent' || tool === 'task' || tool === 'subagent') {
     kind = 'agent';
     name = ti.subagent_type ?? ti.agent;
   }

package/js/inspect/checks-authoring.mjs

@@ -14,8 +14,10 @@
  */
 import path from 'node:path';
 import { PLUGIN_SRC, SRC } from '../build/source.mjs';
+import { HOSTS } from '../hosts/hosts.mjs';
 import { descBlockProblem, firstBlockquote } from '../hosts/native.mjs';
 import { readText } from '../lib/fs.mjs';
+import { blankCodeSpans } from '../lib/text.mjs';
 import { which } from '../lib/paths.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
 import {
@@ -25,15 +27,15 @@ import {
 import { constitutionProblems, leanBlockProblems } from './checks-constitution.mjs';
 import { countTableProblems } from './checks-counts.mjs';
 import { catalogProblems } from '../loop/catalog.mjs';
-import { blankCodeSpans, globSorted, isDir, isFile, rglob } from './scan.mjs';
+import { globSorted, isDir, isFile, rglob } from './scan.mjs';
 import { spawnSync } from 'node:child_process';
 
-// The four harness ids `js/web/docs.mjs`'s `HARNESS_OPEN_RE` accepts, comma-separated, in its
-// own `HARNESSES` constant. Not imported: `js/web/docs.mjs` pulls in the web daemon's CLI
-// reference, status and update modules, and `inspect/` has no existing import from `web/` to
-// extend — paying that weight on every `doctor --all` for one id list is not "cheap" reuse.
-// Inlined instead, so it must be kept in step by hand if `HARNESSES` ever changes.
-const HARNESS_IDS = 'opencode|claude|openclaude|bob';
+// The harness ids `js/web/docs.mjs`'s `HARNESS_OPEN_RE` accepts — its `HARNESSES`, keyed by the
+// same host ids as `HOSTS`. Not imported from there: `js/web/docs.mjs` pulls in the web daemon's
+// CLI reference, status and update modules, a weight every `doctor --all` would pay for one id
+// list. `HOSTS` is the ids' own home and already in doctor's import closure. Alternation order
+// does not matter: the pattern is anchored at both ends.
+const HARNESS_IDS = HOSTS.map((h) => h.host).join('|');
 
 /**
  * The comment bodies (trimmed) that are known to be FUNCTIONAL — consumed by the render, a

package/js/inspect/checks-probe.mjs

@@ -25,8 +25,7 @@
  * `GENESEED_GATE_PROBE=1` keeps the probe's asks out of the gate ledger (`ledger()` in
  * `js/hosts/hooks.mjs`), so `status` never counts a doctor run as a refusal.
  */
-import { existsSync, mkdtempSync, rmSync } from 'node:fs';
-import os from 'node:os';
+import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { liveRecordedHooks } from '../hosts/hosts.mjs';
@@ -34,7 +33,7 @@ import { claudeCfg, installState, installTargets } from '../hosts/installs.mjs';
 import { SHIM_MARK, claudeGitBashPath } from '../hosts/shim.mjs';
 import { which } from '../lib/paths.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
-import { NOTE, withTempDir } from './scan.mjs';
+import { NOTE, withTempDir, withTempDirAsync } from './scan.mjs';
 import { spawnSync } from 'node:child_process';
 
 /**
@@ -43,7 +42,7 @@ import { spawnSync } from 'node:child_process';
  * runs everything through `tool-gate --host bob`. OpenCode's guard is an in-process plugin with
  * no command: `guardProbe` below imports it instead.
  */
-export const PROBED_VERB = { claude: 'git-gate', openclaude: 'git-gate', bob: 'tool-gate' };
+const PROBED_VERB = { claude: 'git-gate', openclaude: 'git-gate', bob: 'tool-gate' };
 
 export const BAD_COMMAND = 'git reset --hard HEAD';
 export const GOOD_COMMAND = 'git status';
@@ -51,7 +50,7 @@ export const GOOD_COMMAND = 'git status';
 const PROBE_TIMEOUT_MS = 20_000;
 
 /** A PreToolUse payload in Claude's shape — the shape every probed host's gate reads. */
-export function probePayload(command, cwd) {
+function probePayload(command, cwd) {
   return JSON.stringify({
     session_id: 'geneseed-probe', hook_event_name: 'PreToolUse', tool_name: 'Bash',
     tool_input: { command }, cwd,
@@ -64,7 +63,7 @@ export function probePayload(command, cwd) {
  * `shell: "powershell"` wins; Bob runs `cmd /c` on Windows; Claude/OpenClaude run Git Bash
  * there (`claudeGitBashPath`, the rule `claudeHookShell` uses); `sh -c` everywhere else.
  */
-export function probeShell(host, handler, platform = process.platform, env = process.env) {
+function probeShell(host, handler, platform = process.platform, env = process.env) {
   const cmd = handler.command;
   if (handler.shell === 'powershell') {
     const ps = which('powershell') || which('pwsh');
@@ -173,10 +172,10 @@ export function gateProbe(targets = installTargets(), { platform = process.platf
 
 // ---- OpenCode: the guard plugin, probed in-process ------------------------------------------
 
-export const GUARD_PLUGIN = 'geneseed-guard.js';
+const GUARD_PLUGIN = 'geneseed-guard.js';
 /** The guard blocks catastrophic shell (`SHELL_BLOCK_RE`); destructive git is the permission
  * prompt's job there, and only WARNS in the guard — so its must-refuse payload is this one. */
-export const GUARD_BAD_COMMAND = 'rm -rf /';
+const GUARD_BAD_COMMAND = 'rm -rf /';
 
 /** The guard plugin of an OpenCode install: `<global>/plugins/` or `<repo>/.opencode/plugins/`
  * (`emitOpencodeInto` copies the plugins to `<dir>/plugins`). */
@@ -203,7 +202,7 @@ async function quietProbe(fn) {
  * (`setupV2`'s docblock). An unexpected throw is not a refusal — it is rethrown, and the caller
  * reports the guard as broken.
  */
-export async function runGuard(mod, cwd) {
+async function runGuard(mod, cwd) {
   const v1 = async (command) => {
     const hooks = await mod.server({ worktree: cwd, directory: cwd });
     try {
@@ -233,7 +232,7 @@ export async function runGuard(mod, cwd) {
 }
 
 /** The verdict for one API's pair — null when sound. */
-export function guardVerdict([badRefused, goodRefused]) {
+function guardVerdict([badRefused, goodRefused]) {
   if (!badRefused) return `registered but not refusing — \`${GUARD_BAD_COMMAND}\` went through`;
   if (goodRefused) return `refuses everything — \`${GOOD_COMMAND}\` was refused too`;
   return null;
@@ -269,13 +268,17 @@ export async function guardProbe(targets = installTargets(), env = process.env)
     }
     let verdicts;
     try {
+      // ESM under OpenCode's typeless package.json: parses only with syntax detection (Node >=
+      // 22.7, the floor). Its MODULE_TYPELESS_PACKAGE_JSON warning fires a tick later, inside
+      // quietProbe's stderr swap, so the doctor never prints it.
       const mod = (await import(pathToFileURL(file).href)).default;
       if (mod?.id !== 'geneseed-guard' || typeof mod.server !== 'function' || typeof mod.setup !== 'function') {
         problems.push(`${label}: not probed — it does not export the Geneseed guard `
           + '({ id, server, setup }) — run: geneseed rebuild-all');
         continue;
       }
-      verdicts = await withTempDirAsync((tmp) => quietProbe(() => runGuard(mod, tmp)));
+      verdicts = await withTempDirAsync(
+        (tmp) => quietProbe(() => runGuard(mod, tmp)), 'geneseed-probe-');
     } catch (e) {
       problems.push(`${label}: does not run (${e?.message || e})`);
       continue;
@@ -287,9 +290,3 @@ export async function guardProbe(targets = installTargets(), env = process.env)
   }
   return { problems, probed };
 }
-
-/** `withTempDir` for an async body: the dir outlives the promise, then goes. */
-async function withTempDirAsync(fn) {
-  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-probe-'));
-  try { return await fn(tmp); } finally { rmSync(tmp, { recursive: true, force: true }); }
-}

package/js/inspect/checks-repo.mjs

@@ -1,6 +1,7 @@
 /**
- * The checks over the REPO's own records — the registry, committed secrets, the hook shim
- * and the vendored skill folders (their pins and their SKILL.md frontmatter).
+ * The checks over the REPO's own records — the registry, committed secrets, the hook shim,
+ * the vendored skill folders (their pins and their SKILL.md frontmatter), skill aliases and
+ * side files, the `js/README.md` module map, the host tables, and the scorecard ratchet.
  *
  * Same contract as `checks-build.mjs`: an array of problem strings, empty when clean, one
  * planted fault per check in the gate. This is the group that reads what the repo SAYS about
@@ -10,8 +11,8 @@ import path from 'node:path';
 import {
   ALIASES_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf, knownSkillIds,
 } from '../build/source.mjs';
-import { CLAUDE_STYLE, HOSTS, liveRecordedHooks } from '../hosts/hosts.mjs';
-import { claudeCfg, installTargets } from '../hosts/installs.mjs';
+import { HOSTS } from '../hosts/hosts.mjs';
+import { installTargets, installsReferencingShim } from '../hosts/installs.mjs';
 import { VENDORED_SKILL_DIRS } from '../hosts/native.mjs';
 import { COMMAND_SET } from '../hosts/opencode.mjs';
 import { hookShimPath, shimDeadPaths } from '../hosts/shim.mjs';
@@ -41,12 +42,8 @@ function registryKeys() {
 const SEMVER_RE = /^\d+\.\d+\.\d+$/;
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 
-// `ENTITY_STATUSES`, `LAW_CLASSES`, `LAW_CLASS` and `SKILL_CLASS` moved to
-// `js/inspect/inventory.mjs` in P6c — see the import above. They crossed HERE in P5g because
-// doctor's authoring gates are what validate them, and they belong where Python keeps
-// them (`_harness_tui`) now that the catalog reads them too. The gates below are
-// unchanged, which is what licensed the move: a copy would have stopped being the
-// value under test the first time one of them was edited.
+// `ENTITY_STATUSES` is imported from `js/inspect/inventory.mjs`, not copied: the catalog reads
+// it too, and a copy would stop being the value under test the first time one side changed.
 
 /**
  * `_harness_build._registry_problems` — `registry.json` describes exactly what `src/`
@@ -167,44 +164,6 @@ export function secretProblems() {
   return problems;
 }
 
-/**
- * Every active Claude-STYLE install (`CLAUDE_STYLE`: claude, bob, openclaude — the hosts that
- * share this one machine-wide shim) whose LIVE, recorded hooks still name `shimPath` by exact
- * string, keyed by its own config dir.
- *
- * Split out of `shimProblems` for the case `shimDeadPaths` cannot see: that function reads
- * paths back OUT of the shim body, so it has nothing to read once the shim file is gone
- * outright (deleted, not moved-and-regenerated) — a plain `isFile` check upstream then calls
- * that clean, the same as a source checkout that never emitted. `liveRecordedHooks` is already
- * "the manifest claims it AND the settings file still runs it" (`js/hosts/hosts.mjs`), so a
- * disabled or never-wired install cannot appear here — only installs for which the missing
- * shim is a live, standing failure.
- *
- * MATCHES THE EXACT PATH, not merely a command that mentions the shim's filename
- * (`geneseed-hook`): the shim path is baked per `GENESEED_HOME`, so a machine with more than
- * one Geneseed home (a relocated one, or a sandboxed test run beside a real install) must not
- * let an install naming a DIFFERENT, perfectly healthy shim answer for this one.
- *
- * EXPORTED: `status`'s `gateSummary` (`js/inspect/status.mjs`) needs the same answer to fold
- * into its `dead` field, the one `statusLines` already renders as a `DEAD` gates row — two
- * readers of one fact, not two copies of the install walk.
- *
- * `targets` is a parameter, the same convention `hookShellProblems` uses, so a test can hand
- * it a sandboxed `[host, scope, root]` triple instead of walking this machine's real config
- * dirs and registry — the live default every production caller takes.
- */
-export function installsReferencingShim(shimPath = hookShimPath(), targets = installTargets()) {
-  const out = [];
-  for (const [host, scope, root] of targets) {
-    if (!CLAUDE_STYLE.includes(host)) continue;
-    const cfg = claudeCfg(root, scope, host);
-    const live = liveRecordedHooks(cfg)
-      .some(([, h]) => typeof h.command === 'string' && h.command.includes(shimPath));
-    if (live) out.push(cfg);
-  }
-  return out;
-}
-
 /**
  * `_harness_build._shim_problems` — the hook shim exists and points at something real.
  *
@@ -220,7 +179,7 @@ export function installsReferencingShim(shimPath = hookShimPath(), targets = ins
  * reason to own one. But one deleted by hand (or by a cleanup script) out from under an
  * install that still names it is the same dead-hooks failure as a moved checkout, newly worth
  * catching now that the two Claude gates fail CLOSED on a dead hook instead of open
- * (`onFailure: "block"`, Task 1) — a Bash/Write/Edit call blocked with no shim to even try
+ * (`onFailure: "block"`) — a Bash/Write/Edit call blocked with no shim to even try
  * running is otherwise invisible until the user notices nothing works.
  * `installsReferencingShim` answers that half; this still returns `[]` when nothing live
  * names the missing shim.
@@ -243,7 +202,7 @@ export function shimProblems(targets = installTargets()) {
   if (!isFile(p)) {
     return installsReferencingShim(p, targets).map((cfg) => `[shim] ${p} does not exist, but ${cfg} `
       + 'still runs its hooks through it — every hook in that install is dead, and (since '
-      + "Task 1) Claude's git-gate/rule-gate now BLOCK instead of silently passing. Run: "
+      + "Geneseed 4.0.0) Claude's git-gate/rule-gate now BLOCK instead of silently passing. Run: "
       + 'geneseed rebuild-all');
   }
   let body;
@@ -597,7 +556,7 @@ export function hostMatrixProblems(root = ROOT) {
  * invisible here. A check this repo starts to pass is added by hand; one it stops passing is a
  * doctor problem until fixed or deliberately removed from this list, in the same commit.
  */
-export const SCORECARD_FLOOR = [
+const SCORECARD_FLOOR = [
   'architecture_doc',
   'agent_instructions',
   'adr_presence',
@@ -630,6 +589,9 @@ export const SCORECARD_FLOOR = [
   'security_critical_marking',
 ];
 
+/** Where the README's scorecard card lives, and what doctor compares against a fresh render. */
+const SCORECARD_CARD = 'docs/assets/scorecard.svg';
+
 /**
  * The scorecard ratchet — one problem per `SCORECARD_FLOOR` check that no longer passes.
  *
@@ -659,6 +621,3 @@ export function scorecardProblems(root = ROOT) {
       + (k ? `: ${k.evidence}. Fix: ${k.remediation}` : ', and the scorecard has no such check');
   }));
 }
-
-/** Where the README's scorecard card lives, and what doctor compares against a fresh render. */
-export const SCORECARD_CARD = 'docs/assets/scorecard.svg';

package/js/inspect/cost.mjs

@@ -6,8 +6,9 @@
  *
  * Four parts, each the thing the host loads before the user types:
  * - `carrier`  the root instruction file (`AGENT.md`, `CLAUDE.md`, Bob's `rules/geneseed.md` or
- *              `AGENTS.md`), CRLF decoded exactly as the smoke test decodes it, so the figure
- *              and `CARRIER_CEILING` are the same measurement.
+ *              `AGENTS.md`), CRLF folded to LF as the smoke test folds it, so the figure and
+ *              `CARRIER_CEILING` are the same measurement. `readText` also folds a lone CR,
+ *              which the smoke test does not, so the two agree on any carrier without one.
  * - `skills`   the name + description every native skill lists (aliases included: they are
  *              SKILL.md files the host lists like any other).
  * - `agents`   the same for native agents; Bob has none, its agents table is in the carrier.
@@ -30,8 +31,6 @@ import { isFile, readText } from '../lib/fs.mjs';
  */
 export const CARRIER_CEILING = { full: 62_219, lean: 39_088 };
 
-const decode = (p) => readText(p).split('\r\n').join('\n');
-
 /**
  * A frontmatter value as the host shows it. The emit writes descriptions JSON-escaped
  * (`—` for one em dash), and `frontmatter()` has already stripped the quotes, so the
@@ -48,7 +47,7 @@ function fmValue(raw) {
 /** name + description of one spec file; `fallbackName` for agents, whose name is the file stem. */
 function listedChars(file, fallbackName) {
   let fm;
-  try { [fm] = frontmatter(decode(file)); } catch { return 0; }
+  try { [fm] = frontmatter(readText(file)); } catch { return 0; }
   const name = fmValue(fm.get('name')) || fallbackName;
   return name.length + fmValue(fm.get('description')).length;
 }
@@ -61,7 +60,7 @@ function listedChars(file, fallbackName) {
 export function alwaysOnCost({ host, root, dir, footprint }) {
   const carrierPath = carriersFor(host).map((rel) => path.join(root, rel)).find(isFile);
   if (!carrierPath) return null;
-  const carrier = decode(carrierPath).length;
+  const carrier = readText(carrierPath).length;
 
   let skills = 0;
   const skillsDir = path.join(dir, 'skills');

package/js/inspect/doctor.mjs

@@ -241,8 +241,8 @@ export function doctorCollect({
   problems = problems.concat(ran('loops', 'Loop catalogue', loopProblems()));
   problems = problems.concat(ran('shim', 'Hook shim', shimProbs));
   // Windows: a Claude install's hooks emitted for Git Bash on a machine that no longer has it
-  // misbehave under PowerShell (Task 15) — context/learn fail open, and since Task 1 the two
-  // gates fail CLOSED instead (`onFailure: "block"`). The reverse direction is a note.
+  // misbehave under PowerShell — context/learn fail open, and the two gates fail CLOSED
+  // instead (`onFailure: "block"`). The reverse direction is a note.
   problems = problems.concat(ran('hook_shell', 'Hook shell', hookShellProblems()));
   if (probeRun) {
     problems = problems.concat(ran('probe', 'Gate probe', [...probeRun.problems, ...extraProbeProblems]));

package/js/inspect/scan.mjs

@@ -14,15 +14,13 @@ import { SRC } from '../build/source.mjs';
 import { comparePaths, within } from '../lib/paths.mjs';
 import { isDir, isFile } from '../lib/fs.mjs';
 import { has } from '../lib/json.mjs';
-import { FENCE_RE, INLINE_CODE_RE, blankCodeSpans } from '../lib/text.mjs';
+import { FENCE_RE, INLINE_CODE_RE } from '../lib/text.mjs';
 import { mkdtempSync, readdirSync, rmSync } from 'node:fs';
 
 // `isDir`/`isFile`/`has` are owned by `js/lib` now (single owner across `hosts/`, `build/`,
 // `inspect/` and `web/`) — re-exported here so this module's own existing callers keep
-// importing them from `./scan.mjs` unchanged. `blankCodeSpans` is `js/lib/text.mjs`'s too, for
-// the same reason: `js/build/source.mjs`'s `stripAuthorNotes` needs the identical fence/code-span
-// answer and cannot import this module (it would cycle back through `../build/source.mjs` above).
-export { isDir, isFile, has, blankCodeSpans };
+// importing them from `./scan.mjs` unchanged.
+export { isDir, isFile, has };
 
 // --------------------------------------------------------------------------------------
 // _harness_core's scanning primitives
@@ -106,3 +104,9 @@ export function withTempDir(fn, prefix = 'geneseed-doctor-') {
   try { return fn(tmp); } finally { rmSync(tmp, { recursive: true, force: true }); }
 }
 
+/** `withTempDir` for an async body: the dir outlives the promise, then goes. */
+export async function withTempDirAsync(fn, prefix = 'geneseed-doctor-') {
+  const tmp = mkdtempSync(path.join(os.tmpdir(), prefix));
+  try { return await fn(tmp); } finally { rmSync(tmp, { recursive: true, force: true }); }
+}
+