geneseed 4.9.0 → 4.9.1

package/CHANGELOG.md

@@ -8,6 +8,27 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.9.1] — 2026-10-18
+
+Patch: Deletion Is Deliberate and the root-scan check no longer fail open behind shell structure; the console stops re-running the doctor on every change.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed hooks and OpenCode plugins pick up the fix.
+
+### Fixed
+- **Deletion Is Deliberate and the root-scan check no longer fail open when shell structure hides the program word.** `true & git reset --hard`, `(git reset --hard)`, `if …; then git reset --hard; fi`, `{ rm x; }`, `echo $(rm x)`, `` echo `rm x` ``, `sudo -u root rm x`, `env -u FOO rm x`, `nice -n 5 rm x`, `timeout 5 rm x`, `true & find / …` and `(find / …)` passed where the plain form asks. The `reset --hard` forms had regressed in 4.7.0. Several changes close it, on Claude Code, OpenClaude and Bob (`git-gate`/`tool-gate`) and in the OpenCode guard:
+  - A lone `&` now separates commands. `2>&1`, `<&3`, `&>` and `|&` still do not.
+  - Leading `(`, `{`, `!`, `then`, `do` and `else` are stripped before the program word, and so are closing `)`/`}`.
+  - A command substitution is judged as a command of its own.
+  - Wrappers drop their value-taking flags. `timeout` is now a wrapper.
+  - A removal that names no path asks: `… | Remove-Item`, `ri -Force`.
+  - `find -delete` asks, and `unlink` counts as a removal.
+  - Behind all of these, a removal word written unquoted after a program the gate does not read asks ("could not verify"). That covers a wrapper it does not know (`setsid rm x`), a wrapper flag of unknown arity, `ForEach-Object { Remove-Item $_ }` and `case … rm …`. So does `ssh host rm x`. The exceptions are programs whose `rm` is their own subcommand (npm, pnpm, yarn, bun, cargo, brew, docker, podman) and programs that never run their arguments (echo, printf, the grep family, `which`, `type`, `man`, `Get-Command`, `Get-Help`).
+  - Proven-safe forms still pass: a clean tree, a tracked clean file, a quoted pattern, and a `$(cat <<'EOF' … EOF)` commit message.
+
+### Changed
+- **The console stops re-running the doctor when nothing it checks has changed.** A memory delete no longer drops the cached verdict (~3.6 s saved on the next overview); a finished job, an install toggle and a view switch still do. The Doctor page, the Greenhouse and Operator HUD lenses now read the cached run (groups and themes included) instead of running every check on each visit; the page's *Re-run checks* button asks for a fresh run (`GET /api/doctor?fresh=1`). The server warms the cache right after it starts listening, so an overview requested a few seconds later answers in ~0.15 s rather than ~3.8 s.
+
 ## [4.9.0] — 2026-10-18
 
 Minor: on/off switches for the Sealed Secrets and done gates, and the console calls the laws Dictates.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.9.0**.
+> string. Current label: **4.9.1**.
 
 ## Capabilities
 

package/adapters/opencode/plugins/geneseed-guard.js

@@ -297,16 +297,31 @@ function stashExists(root) {
  * a superset of what the parse acts on.
  */
 const LOSS_CANDIDATE_RE =
-  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'])(?:rm|rmdir|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"']|$)/im;
+  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'`])(?:rm|rmdir|unlink|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"'`]|$)|(?:^|\s)-delete(?=\s|$)/im;
 
 class Unverified extends Error {}
 const unverified = (why) => { throw new Unverified(why); };
 
-const RM_PROGS = new Set(['rm', 'rmdir', 'del', 'erase', 'remove-item', 'ri', 'rd']);
+const RM_PROGS = new Set(['rm', 'rmdir', 'unlink', 'del', 'erase', 'remove-item', 'ri', 'rd']);
 // cmd.exe's own removal verbs take `/s` `/q` switches, which are not paths.
 const CMD_SWITCH_PROGS = new Set(['rmdir', 'del', 'erase', 'rd']);
 const CD_PROGS = new Set(['cd', 'pushd', 'chdir', 'set-location', 'sl']);
-const WRAPPERS = new Set(['sudo', 'doas', 'command', 'builtin', '\\builtin', 'time', 'nice', 'nohup', 'exec', 'env']);
+// A wrapper runs the command after its own flags: `<short flags taking a value>|<short flags taking
+// none>`. A flag in neither list (`env -S` runs a string, `env -C`/`sudo -D` change directory,
+// `command -v` only looks up) is not guessed at — the segment asks if it names a removal.
+const WRAPPERS = new Map([['sudo', 'ughpCUrtT|AbEHiknPSs'], ['doas', 'uC|ns'], ['command', '|p'],
+  ['builtin', '|'], ['\\builtin', '|'], ['time', 'fo|pav'], ['nice', 'n|'], ['nohup', '|'],
+  ['exec', 'a|cl'], ['env', 'u|i0v'], ['timeout', 'sk|v'], ['ionice', 'cn|t'], ['stdbuf', 'ioe|']]);
+const WRAPPER_LONG = new Set(['--preserve-status', '--foreground', '--verbose', '--login', '--preserve-env',
+  '--non-interactive', '--ignore-environment', '--null']);
+// Shell grammar that may stand before the program word (`(cd x && rm y)`, `if …; then rm y; fi`).
+const STRUCTURE = new Set(['(', '((', '{', '!', 'if', 'then', 'elif', 'else', 'do', 'while', 'until']);
+// The only programs this reader does not parse that may still name a removal word and pass: their
+// `rm`/`del` is their own subcommand (a package, a container), or they never run their arguments
+// (a substitution in one is judged on its own). Any other program over a removal word asks.
+const INERT = new Set(['npm', 'pnpm', 'yarn', 'bun', 'cargo', 'brew', 'docker', 'podman', 'echo', 'printf',
+  'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'which', 'where', 'type', 'man', 'get-command',
+  'get-help']);
 // Programs that run ANOTHER command from their arguments or stdin: what they would remove is
 // not on this command line in a form the parse can read, so a removal word inside one asks.
 const INDIRECT = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish', 'pwsh', 'powershell', 'cmd',
@@ -671,6 +686,8 @@ function rmAct(prog, args, dir) {
     if (opts && CMD_SWITCH_PROGS.has(prog) && /^\/[a-zA-Z?]$/.test(a)) continue;
     targets.push(a);
   }
+  // `… | Remove-Item`, `ri -Force`: the paths come from the pipe, which this reader cannot see.
+  if (!targets.length) unverified(`\`${prog}\` names no path, so what it removes comes from elsewhere`);
   const groups = new Map();
   for (const t of targets) {
     const shown = t.replace(OPAQUE, '');
@@ -712,6 +729,69 @@ function rmAct(prog, args, dir) {
 /** The program word, stripped of its path and `.exe`, lowercased (PowerShell and cmd are case-blind). */
 const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '');
 
+/**
+ * A segment's RAW tokens with the shell grammar around its command dropped: leading `(`, `{`,
+ * `!`, `then`, `do`… (a `(` glued to the first word too) and a closing `)`/`}`. Without it
+ * `(git reset --hard)` has `(git` for its program and `--hard)` for its flag. `rootScan`
+ * shares it, so `(find / …)` is a scan.
+ */
+function stripStructure(raw) {
+  const t = raw.slice();
+  while (t.length) {
+    if (STRUCTURE.has(t[0])) t.shift();
+    else if (/^\(+./.test(t[0])) t[0] = t[0].replace(/^\(+/, '');
+    else break;
+  }
+  while (t.length && (t[t.length - 1] === '}' || /^\)+$/.test(t[t.length - 1]))) t.pop();
+  if (t.length) t[t.length - 1] = t[t.length - 1].replace(/\)+$/, '');
+  return t;
+}
+
+/**
+ * The bodies of the command substitutions in `text` (`$(…)`, backticks, `<(…)`, `>(…)`) —
+ * single quotes hide them, double quotes do not. An unclosed one runs to the end of the text:
+ * the splitter already cut an unquoted `$(a; b)` at its `;`.
+ */
+function substitutions(text) {
+  const out = [];
+  let sq = false; let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (sq) { if (c === "'") sq = false; continue; }
+    if (c === "'" && !dq) { sq = true; continue; }
+    if (c === '"') { dq = !dq; continue; }
+    if (c === '`') {
+      const end = text.indexOf('`', i + 1);
+      out.push(text.slice(i + 1, end < 0 ? text.length : end));
+      i = end < 0 ? text.length : end;
+    } else if ('$<>'.includes(c) && text[i + 1] === '(') {
+      let depth = 1; let j = i + 2;
+      for (; j < text.length && depth; j++) depth += text[j] === '(' ? 1 : text[j] === ')' ? -1 : 0;
+      out.push(text.slice(i + 2, depth ? text.length : j - 1));
+      i = j - 1;
+    }
+  }
+  return out;
+}
+
+/** `w` past wrapper `name`'s own flags (and `timeout`'s duration), or null when a flag is unknown. */
+function pastWrapper(name, w) {
+  const [takes, plain] = WRAPPERS.get(name).split('|');
+  let i = 0;
+  for (; i < w.length && w[i].length > 1 && w[i].startsWith('-'); i++) {
+    const a = w[i];
+    if (a === '--') { i += 1; break; }
+    if (a.startsWith('--')) { if (a.includes('=') || WRAPPER_LONG.has(a)) continue; return null; }
+    if (name === 'nice' && /^-\d+$/.test(a)) continue;
+    for (let j = 1; j < a.length; j++) {
+      if (takes.includes(a[j])) { if (j === a.length - 1) i += 1; break; }   // the value: the rest, or the next word
+      if (!plain.includes(a[j])) return null;
+    }
+  }
+  if (name === 'timeout' && /^\d/.test(w[i] || '')) i += 1;
+  return w.slice(i);
+}
+
 /**
  * The verdict for a whole command, given its segments as RAW token arrays (quotes still on —
  * `js/hosts/hooks.mjs` cuts and tokenises with the same lexer `rootScan` uses, so a quoted
@@ -722,19 +802,33 @@ const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '')
  * each host's ceiling for a crashed gate (docs/adr/0007-gates-fail-closed-per-host-ceiling.md).
  * `always: false` skips the two acts that lose data in every state (`reflog expire`, `gc --prune`)
  * — the OpenCode guard passes it, because a static `permission.bash` glob already asks for those.
+ * `split` cuts a command substitution's body into segments the same way (both callers pass their
+ * splitter); without it, a substitution that names a removal asks.
+ * @param {string[][]} segments
+ * @param {string} cwd
+ * @param {{ always?: boolean, split?: (text: string) => string[][] }} [options]
  */
-function lossReason(segments, cwd, { always = true } = {}) {
-  let dir = cwd;
-  try {
-    for (const raw of segments) {
+function lossReason(segments, cwd, { always = true, split } = {}) {
+  /** The first loss among `segs`, run from `start`; a substitution body is judged as a command. */
+  const judge = (segs, start, depth = 0) => {
+    let dir = start;
+    for (const raw of segs.map(stripStructure)) {
+      const text = raw.join(' ');
+      const named = LOSS_CANDIDATE_RE.test(text);
+      for (const body of named ? substitutions(text) : []) {
+        if (!LOSS_CANDIDATE_RE.test(body)) continue;
+        // Bounded: `$($($(…` nested past any real command would rescan the text once per level.
+        if (!split || depth >= 4) unverified('a command substitution names a removal');
+        const v = judge(split(body), dir, depth + 1);
+        if (v) return v;
+      }
       let w = words(raw);
-      while (w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
+      while (w && w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
         const wrapper = progOf(w[0]);
-        w = w.slice(1);
-        // A wrapper's own flags (`sudo -u x`, `env -i`) are not the program.
-        if (wrapper !== 'command' && wrapper !== 'exec') while (w.length && w[0].startsWith('-')) w = w.slice(1);
+        w = /^\w+=/.test(w[0]) ? w.slice(1) : pastWrapper(wrapper, w.slice(1));
+        if (!w && named) unverified(`\`${wrapper}\` takes a flag the gate does not know`);
       }
-      if (!w.length) continue;
+      if (!w || !w.length) continue;
       const prog = progOf(w[0]);
       const args = w.slice(1);
       if (CD_PROGS.has(prog)) {
@@ -747,10 +841,18 @@ function lossReason(segments, cwd, { always = true } = {}) {
       else if (RM_PROGS.has(prog)) verdict = rmAct(prog, args, dir);
       else if (INDIRECT.has(prog) && LOSS_CANDIDATE_RE.test(args.join(' '))) {
         unverified(`\`${prog}\` runs a command the gate cannot read`);
+      } else if (named && !INERT.has(prog)
+        && LOSS_CANDIDATE_RE.test(raw.map((t) => t.replace(/"[^"]*"?|'[^']*'?/g, ' ')).join(' '))) {
+        // A program this reader does not know (a wrapper, a loop, shell syntax) over an unquoted
+        // removal word: it may run it, so it is not proven safe. A quoted word is data.
+        unverified(`\`${w[0].replace(OPAQUE, '')}\` is not a program the gate reads, and a removal follows it`);
       }
       if (verdict) return verdict;
     }
     return null;
+  };
+  try {
+    return judge(segments, cwd);
   } catch (e) {
     if (!(e instanceof Unverified)) throw e;
     return `the gate could not verify what this command would lose (${e.message})`;
@@ -776,9 +878,9 @@ const FS_ROOT_RE = /^(?:\/|\/[a-z]\/?|\/mnt\/[a-z]\/?|[a-z]:[\\/]?)\*?$/i
 const SCAN_WORD_RE = /\b(?:find|du|tree|rg|fd|where\.exe|grep|egrep|ls|dir|get-childitem|gci)\b/i
 const SCAN_TOKEN_RE = /(?:[^\s"']+|"[^"]*"?|'[^']*'?)+/g
 const SCAN_WRAPPERS = new Set(["sudo", "command", "\\builtin", "time", "nice"])
-// A comment (`#` starting a word), a quoted run (its `;`/`|` is data), a separator, or a heredoc
-// opener (never the `<<<` here-string).
-const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g
+// A comment (`#` starting a word), a quoted run (its `;`/`|` is data), a separator (a lone `&`
+// too, never the one in `2>&1`/`<&3`/`&>`/`|&`), or a heredoc opener (never the `<<<` here-string).
+const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<![&<>|])&(?![&>])|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g
 // Cut at separators OUTSIDE quotes and drop every heredoc body (to its TAG line; `<<-` allows
 // tabs): a commit message that names a root scan is data, not a command to block.
 function scanSegments(command) {
@@ -812,7 +914,8 @@ function rootScan(command) {
   if (!SCAN_WORD_RE.test(command)) return null
   for (const seg of scanSegments(command)) {
     // Quotes kept until the root test, so a quoted "a:" is told from a bare C:.
-    let toks = (seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t))
+    // `(find / …)`, `then find / …`: the grammar around the command is not its program.
+    let toks = stripStructure(seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t))
     while (toks.length && SCAN_WRAPPERS.has(unquote(toks[0]))) toks = toks.slice(1)
     if (!toks.length) continue
     // The program word without its path (either slash) or an `.exe` suffix.
@@ -1218,7 +1321,8 @@ export const GeneseedGuard = async (ctx) => {
           if (c && !DELETION_GATE_OFF && LOSS_CANDIDATE_RE.test(c)) {
             // OpenCode's bash tool may run in `workdir`, resolved against the session directory.
             const wd = typeof args.workdir === "string" && args.workdir ? path.resolve(cwd, args.workdir) : cwd
-            const loss = lossReason(scanSegments(c).map((seg) => seg.match(SCAN_TOKEN_RE) || []), wd, { always: false })
+            const cut = (t) => scanSegments(t).map((seg) => seg.match(SCAN_TOKEN_RE) || [])
+            const loss = lossReason(cut(c), wd, { always: false, split: cut })
             if (loss) { await deny(`${loss} (Deletion Is Deliberate) — confirm with the user first`, "law-4"); return }
           }
         }

package/docs/web-ui.md

@@ -165,8 +165,9 @@ streams the output of background jobs and keeps their history across reloads.
   added / missing files with per-file expansion and coloured unified-diff lines. Select
   files to **export an `improvements.md`** back-port, or **restore** them to source.
 - **Doctor** (`#/doctor`) — runs the same health engine as the `doctor` command (every
-  theme, parity, links, authoring gates, drift), grouping any problems per check. Re-run
-  on demand.
+  theme, parity, links, authoring gates, drift), grouping any problems per check. It shows
+  the server's last run — warmed at start, redone after a job, an install toggle or a view
+  switch — and **Re-run checks** runs every check again on demand.
 
 ### 🎨 Setup
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.9.0"
+  "version": "4.9.1"
 }

package/js/hosts/hooks.mjs

@@ -58,7 +58,7 @@ import {
   GATE_LEDGER, globalHookStandingDown, hookProjectDir, resolvePath, sovereignBypass,
 } from './hosts.mjs';
 import { currentBranch, gitRootOf, loopLaunched } from './gitref.mjs';
-import { LOSS_CANDIDATE_RE, lossReason } from './loss.mjs';
+import { LOSS_CANDIDATE_RE, lossReason, stripStructure } from './loss.mjs';
 import { selfAndParents, readStdin } from './hooks-prims.mjs';
 import { recordUse } from './usage.mjs';
 
@@ -349,13 +349,14 @@ const SCAN_WORD_RE = /\b(?:find|du|tree|rg|fd|where\.exe|grep|egrep|ls|dir|get-c
 const SCAN_TOKEN_RE = /(?:[^\s"']+|"[^"]*"?|'[^']*'?)+/g;
 const SCAN_WRAPPERS = new Set(['sudo', 'command', '\\builtin', 'time', 'nice']);
 // One left-to-right pass: a comment (`#` starting a word, to the end of the line — an apostrophe
-// in it is no quote), a quoted run (kept whole, so its `;`/`|` is data), a separator, or a
+// in it is no quote), a quoted run (kept whole, so its `;`/`|` is data), a separator (a lone `&`
+// backgrounds a command and runs the next, but `2>&1`, `<&3`, `&>` and `|&` are not one), or a
 // heredoc opener (`<<TAG`, `<<-TAG`, `<< 'TAG'`, `<<"TAG"` — never the here-string `<<<`).
 // Every alternative consumes at least one character, and none can backtrack past its start.
-const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g;
+const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<![&<>|])&(?![&>])|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g;
 
 /**
- * The command cut at `|`/`;`/`&&`/`||`/newline OUTSIDE quotes, with every heredoc body (the
+ * The command cut at `|`/`;`/`&`/`&&`/`||`/newline OUTSIDE quotes, with every heredoc body (the
  * lines after `<<TAG` up to the `TAG` line; `<<-` lets it be tab-indented) dropped: both are data.
  * Without this, `git commit -F - <<'EOF'` — the mandated multi-line commit form — or a quoted
  * `-m "fix; find / loop"` whose text merely names a root scan reads as one, which on Bob and
@@ -401,7 +402,8 @@ export function rootScan(command) {
   if (!SCAN_WORD_RE.test(command)) return null;
   for (const seg of scanSegments(command)) {
     // Tokens keep their quotes until the root test, so a quoted `"a:"` can be told from a bare `C:`.
-    let toks = (seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t));
+    // `(find / …)`, `then find / …`: the grammar around the command is not its program.
+    let toks = stripStructure(seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t));
     while (toks.length && SCAN_WRAPPERS.has(unquote(toks[0]))) toks = toks.slice(1);
     if (!toks.length) continue;
     // The program word without its path (either slash) or an `.exe` suffix: `C:\tools\rg.exe`.
@@ -427,6 +429,8 @@ export function rootScan(command) {
   return null;
 }
 const unquote = (t) => t.replace(/^["']+|["']+$/g, '');
+// The segments `lossReason` reads: raw tokens, quotes still on — also how it cuts a `$(…)` body.
+const lossSegments = (s) => scanSegments(s).map((seg) => seg.match(SCAN_TOKEN_RE) || []);
 // A QUOTED token is data — a grep pattern (`grep -rn "/" src`), a path named in a search
 // (`rg "/mnt/c" README.md`) — never a root target; only an unquoted root is one.
 const rootArg = (t) => !/^["']/.test(t) && FS_ROOT_RE.test(t);
@@ -439,8 +443,8 @@ function gitDecide(args, payload) {
   if (!args.noDeletionGate && LOSS_CANDIDATE_RE.test(command)) {
     // A pass here FALLS THROUGH: a force push to a feature branch loses nothing, but it is still
     // a push, and process 5 below still asks for it.
-    const loss = lossReason(scanSegments(command).map((seg) => seg.match(SCAN_TOKEN_RE) || []),
-      (payload && payload.cwd) || process.cwd());
+    const loss = lossReason(lossSegments(command), (payload && payload.cwd) || process.cwd(),
+      { split: lossSegments });
     if (loss) {
       return ask(args, 'git-gate', 'law-4', `Geneseed (Deletion Is Deliberate) \u2014 ${loss}. `
         + 'Confirm this specific command, or leave the data in place.');

package/js/hosts/loss.mjs

@@ -18,14 +18,18 @@
  *     `branch -f`/`checkout -B`/`switch -C` moving a protected branch off commits nothing else
  *     holds — the same forms on a feature branch pass;
  *   - `stash drop`/`stash clear` while a stash exists; `reflog expire` and `gc --prune` always;
- *   - a file removal (`rm`, `rmdir`, `del`, `erase`, `Remove-Item`/`ri`/`rd`) of anything git
- *     cannot bring back: untracked, ignored or modified files, a repository's own `.git`, or
- *     any path outside a git repository.
+ *   - a file removal (`rm`, `rmdir`, `unlink`, `del`, `erase`, `Remove-Item`/`ri`/`rd`) of
+ *     anything git cannot bring back: untracked, ignored or modified files, a repository's own
+ *     `.git`, or any path outside a git repository.
  *
  * FAIL CLOSED. Anything this reader cannot settle — a glob or a `$variable` in a path it must
- * name, a `cd` it cannot follow, an interpreter (`sh -c`, `xargs`, `eval`) carrying a removal,
- * a git that fails, times out or is missing — asks, and the reason says it could not verify.
- * "Not proven safe" is an ask; only "proven safe" passes.
+ * name, a `cd` it cannot follow, an interpreter (`sh -c`, `xargs`, `eval`, `find -delete`)
+ * carrying a removal, a removal that names no path (`… | Remove-Item` takes its paths from the
+ * pipe), a wrapper flag whose arity it does not know, ANY program it does not read (`setsid`,
+ * `ForEach-Object`, `case`) with a removal named unquoted after it, a git that fails, times out
+ * or is missing — asks, and the reason says it could not verify. A command substitution
+ * (`$(…)`, backticks) is judged as a command of its own. "Not proven safe" is an ask; only
+ * "proven safe" passes.
  *
  * THE ONE SPAWN IN THE GATE PATH, and why it is allowed. Whether a work tree is dirty, which
  * files are untracked, and whether a branch's commits are reachable elsewhere are not readable
@@ -60,16 +64,31 @@ import { currentBranch, gitRootOf, protectedBranches, stashExists } from './gitr
  * a superset of what the parse acts on.
  */
 export const LOSS_CANDIDATE_RE =
-  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'])(?:rm|rmdir|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"']|$)/im;
+  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'`])(?:rm|rmdir|unlink|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"'`]|$)|(?:^|\s)-delete(?=\s|$)/im;
 
 class Unverified extends Error {}
 const unverified = (why) => { throw new Unverified(why); };
 
-const RM_PROGS = new Set(['rm', 'rmdir', 'del', 'erase', 'remove-item', 'ri', 'rd']);
+const RM_PROGS = new Set(['rm', 'rmdir', 'unlink', 'del', 'erase', 'remove-item', 'ri', 'rd']);
 // cmd.exe's own removal verbs take `/s` `/q` switches, which are not paths.
 const CMD_SWITCH_PROGS = new Set(['rmdir', 'del', 'erase', 'rd']);
 const CD_PROGS = new Set(['cd', 'pushd', 'chdir', 'set-location', 'sl']);
-const WRAPPERS = new Set(['sudo', 'doas', 'command', 'builtin', '\\builtin', 'time', 'nice', 'nohup', 'exec', 'env']);
+// A wrapper runs the command after its own flags: `<short flags taking a value>|<short flags taking
+// none>`. A flag in neither list (`env -S` runs a string, `env -C`/`sudo -D` change directory,
+// `command -v` only looks up) is not guessed at — the segment asks if it names a removal.
+const WRAPPERS = new Map([['sudo', 'ughpCUrtT|AbEHiknPSs'], ['doas', 'uC|ns'], ['command', '|p'],
+  ['builtin', '|'], ['\\builtin', '|'], ['time', 'fo|pav'], ['nice', 'n|'], ['nohup', '|'],
+  ['exec', 'a|cl'], ['env', 'u|i0v'], ['timeout', 'sk|v'], ['ionice', 'cn|t'], ['stdbuf', 'ioe|']]);
+const WRAPPER_LONG = new Set(['--preserve-status', '--foreground', '--verbose', '--login', '--preserve-env',
+  '--non-interactive', '--ignore-environment', '--null']);
+// Shell grammar that may stand before the program word (`(cd x && rm y)`, `if …; then rm y; fi`).
+const STRUCTURE = new Set(['(', '((', '{', '!', 'if', 'then', 'elif', 'else', 'do', 'while', 'until']);
+// The only programs this reader does not parse that may still name a removal word and pass: their
+// `rm`/`del` is their own subcommand (a package, a container), or they never run their arguments
+// (a substitution in one is judged on its own). Any other program over a removal word asks.
+const INERT = new Set(['npm', 'pnpm', 'yarn', 'bun', 'cargo', 'brew', 'docker', 'podman', 'echo', 'printf',
+  'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'which', 'where', 'type', 'man', 'get-command',
+  'get-help']);
 // Programs that run ANOTHER command from their arguments or stdin: what they would remove is
 // not on this command line in a form the parse can read, so a removal word inside one asks.
 const INDIRECT = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish', 'pwsh', 'powershell', 'cmd',
@@ -434,6 +453,8 @@ function rmAct(prog, args, dir) {
     if (opts && CMD_SWITCH_PROGS.has(prog) && /^\/[a-zA-Z?]$/.test(a)) continue;
     targets.push(a);
   }
+  // `… | Remove-Item`, `ri -Force`: the paths come from the pipe, which this reader cannot see.
+  if (!targets.length) unverified(`\`${prog}\` names no path, so what it removes comes from elsewhere`);
   const groups = new Map();
   for (const t of targets) {
     const shown = t.replace(OPAQUE, '');
@@ -475,6 +496,69 @@ function rmAct(prog, args, dir) {
 /** The program word, stripped of its path and `.exe`, lowercased (PowerShell and cmd are case-blind). */
 const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '');
 
+/**
+ * A segment's RAW tokens with the shell grammar around its command dropped: leading `(`, `{`,
+ * `!`, `then`, `do`… (a `(` glued to the first word too) and a closing `)`/`}`. Without it
+ * `(git reset --hard)` has `(git` for its program and `--hard)` for its flag. `rootScan`
+ * shares it, so `(find / …)` is a scan.
+ */
+export function stripStructure(raw) {
+  const t = raw.slice();
+  while (t.length) {
+    if (STRUCTURE.has(t[0])) t.shift();
+    else if (/^\(+./.test(t[0])) t[0] = t[0].replace(/^\(+/, '');
+    else break;
+  }
+  while (t.length && (t[t.length - 1] === '}' || /^\)+$/.test(t[t.length - 1]))) t.pop();
+  if (t.length) t[t.length - 1] = t[t.length - 1].replace(/\)+$/, '');
+  return t;
+}
+
+/**
+ * The bodies of the command substitutions in `text` (`$(…)`, backticks, `<(…)`, `>(…)`) —
+ * single quotes hide them, double quotes do not. An unclosed one runs to the end of the text:
+ * the splitter already cut an unquoted `$(a; b)` at its `;`.
+ */
+function substitutions(text) {
+  const out = [];
+  let sq = false; let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (sq) { if (c === "'") sq = false; continue; }
+    if (c === "'" && !dq) { sq = true; continue; }
+    if (c === '"') { dq = !dq; continue; }
+    if (c === '`') {
+      const end = text.indexOf('`', i + 1);
+      out.push(text.slice(i + 1, end < 0 ? text.length : end));
+      i = end < 0 ? text.length : end;
+    } else if ('$<>'.includes(c) && text[i + 1] === '(') {
+      let depth = 1; let j = i + 2;
+      for (; j < text.length && depth; j++) depth += text[j] === '(' ? 1 : text[j] === ')' ? -1 : 0;
+      out.push(text.slice(i + 2, depth ? text.length : j - 1));
+      i = j - 1;
+    }
+  }
+  return out;
+}
+
+/** `w` past wrapper `name`'s own flags (and `timeout`'s duration), or null when a flag is unknown. */
+function pastWrapper(name, w) {
+  const [takes, plain] = WRAPPERS.get(name).split('|');
+  let i = 0;
+  for (; i < w.length && w[i].length > 1 && w[i].startsWith('-'); i++) {
+    const a = w[i];
+    if (a === '--') { i += 1; break; }
+    if (a.startsWith('--')) { if (a.includes('=') || WRAPPER_LONG.has(a)) continue; return null; }
+    if (name === 'nice' && /^-\d+$/.test(a)) continue;
+    for (let j = 1; j < a.length; j++) {
+      if (takes.includes(a[j])) { if (j === a.length - 1) i += 1; break; }   // the value: the rest, or the next word
+      if (!plain.includes(a[j])) return null;
+    }
+  }
+  if (name === 'timeout' && /^\d/.test(w[i] || '')) i += 1;
+  return w.slice(i);
+}
+
 /**
  * The verdict for a whole command, given its segments as RAW token arrays (quotes still on —
  * `js/hosts/hooks.mjs` cuts and tokenises with the same lexer `rootScan` uses, so a quoted
@@ -485,19 +569,33 @@ const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '')
  * each host's ceiling for a crashed gate (docs/adr/0007-gates-fail-closed-per-host-ceiling.md).
  * `always: false` skips the two acts that lose data in every state (`reflog expire`, `gc --prune`)
  * — the OpenCode guard passes it, because a static `permission.bash` glob already asks for those.
+ * `split` cuts a command substitution's body into segments the same way (both callers pass their
+ * splitter); without it, a substitution that names a removal asks.
+ * @param {string[][]} segments
+ * @param {string} cwd
+ * @param {{ always?: boolean, split?: (text: string) => string[][] }} [options]
  */
-export function lossReason(segments, cwd, { always = true } = {}) {
-  let dir = cwd;
-  try {
-    for (const raw of segments) {
+export function lossReason(segments, cwd, { always = true, split } = {}) {
+  /** The first loss among `segs`, run from `start`; a substitution body is judged as a command. */
+  const judge = (segs, start, depth = 0) => {
+    let dir = start;
+    for (const raw of segs.map(stripStructure)) {
+      const text = raw.join(' ');
+      const named = LOSS_CANDIDATE_RE.test(text);
+      for (const body of named ? substitutions(text) : []) {
+        if (!LOSS_CANDIDATE_RE.test(body)) continue;
+        // Bounded: `$($($(…` nested past any real command would rescan the text once per level.
+        if (!split || depth >= 4) unverified('a command substitution names a removal');
+        const v = judge(split(body), dir, depth + 1);
+        if (v) return v;
+      }
       let w = words(raw);
-      while (w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
+      while (w && w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
         const wrapper = progOf(w[0]);
-        w = w.slice(1);
-        // A wrapper's own flags (`sudo -u x`, `env -i`) are not the program.
-        if (wrapper !== 'command' && wrapper !== 'exec') while (w.length && w[0].startsWith('-')) w = w.slice(1);
+        w = /^\w+=/.test(w[0]) ? w.slice(1) : pastWrapper(wrapper, w.slice(1));
+        if (!w && named) unverified(`\`${wrapper}\` takes a flag the gate does not know`);
       }
-      if (!w.length) continue;
+      if (!w || !w.length) continue;
       const prog = progOf(w[0]);
       const args = w.slice(1);
       if (CD_PROGS.has(prog)) {
@@ -510,10 +608,18 @@ export function lossReason(segments, cwd, { always = true } = {}) {
       else if (RM_PROGS.has(prog)) verdict = rmAct(prog, args, dir);
       else if (INDIRECT.has(prog) && LOSS_CANDIDATE_RE.test(args.join(' '))) {
         unverified(`\`${prog}\` runs a command the gate cannot read`);
+      } else if (named && !INERT.has(prog)
+        && LOSS_CANDIDATE_RE.test(raw.map((t) => t.replace(/"[^"]*"?|'[^']*'?/g, ' ')).join(' '))) {
+        // A program this reader does not know (a wrapper, a loop, shell syntax) over an unquoted
+        // removal word: it may run it, so it is not proven safe. A quoted word is data.
+        unverified(`\`${w[0].replace(OPAQUE, '')}\` is not a program the gate reads, and a removal follows it`);
       }
       if (verdict) return verdict;
     }
     return null;
+  };
+  try {
+    return judge(segments, cwd);
   } catch (e) {
     if (!(e instanceof Unverified)) throw e;
     return `the gate could not verify what this command would lose (${e.message})`;

package/js/inspect/doctor.mjs

@@ -25,9 +25,10 @@
  * that this tool never shells back to the generator — is asserted directly instead.
  *
  * WHAT `doctorCollect` DOES NOT REACH, MEASURED RATHER THAN ASSUMED. It takes `groups` and
- * `cmdDoctor` does not pass it: that parameter is the WEB's, and `apiDoctor` in
- * `js/web/api.mjs` is its only caller. `ran` exists for it — four lines of accumulator that
- * keep the Doctor page's per-check cards a parameter rather than a rewrite.
+ * `cmdDoctor` does not pass it: that parameter is the WEB's, and `runDoctor` in
+ * `js/web/state.mjs` (the cache `apiDoctor` serves) is its only caller. `ran` exists for it —
+ * four lines of accumulator that keep the Doctor page's per-check cards a parameter rather
+ * than a rewrite.
  */
 import path from 'node:path';
 import { emitGlobalInto, emitProjectInto, main as driverMain } from '../build/driver.mjs';

package/js/web/actions.mjs

@@ -307,7 +307,8 @@ export function apiMemoryDelete(state, name) {
   // CASE-FOLDED: this endpoint's own compared `MEMORY` exactly, so on Windows and macOS `memory`
   // resolved to MEMORY.md, passed, and deleted the index the agent reads at session start.
   if (memoryDelete(d, name) === null) throw new NotFound(name);
-  state.refresh();
+  // The doctor reads nothing in the memory store, so its cached verdict survives (`refresh`).
+  state.refresh({ doctor: false });
   return { archived: name };
 }
 

package/js/web/api.mjs

@@ -16,7 +16,6 @@ import { readVersion, sourceFingerprint } from '../build/version.mjs';
 import { sourceReleaseVersion } from '../hosts/opencode.mjs';
 import { alwaysOnCost } from '../inspect/cost.mjs';
 import { diffCollect } from '../inspect/diff.mjs';
-import { doctorCollect } from '../inspect/doctor.mjs';
 import { excludesSnapshot } from '../inspect/excludes.mjs';
 import { CLAUDE_STYLE, HOSTS, VERSION_MARKER, resolvePath } from '../hosts/hosts.mjs';
 import {
@@ -79,13 +78,15 @@ export function apiSetup(state) {
   };
 }
 
-/** The same engine as the `doctor` verb, grouped per check. */
-export function apiDoctor(state) {
-  const groups = [];
-  const [themes, problems] = doctorCollect({ theme: state.theme, groups });
-  state.stampDoctor(problems);
-  return { themes, ok: !problems.length, problems, groups,
-    checked_at: state.doctor.checked_at };
+/**
+ * The same engine as the `doctor` verb, grouped per check — served from the state's cached run
+ * (a lens visit or a page mount no longer pays ~3.6 s), and re-run only when `fresh` is asked
+ * for: the Doctor page's Re-run button, as `GET /api/doctor?fresh=1`.
+ */
+export function apiDoctor(state, fresh = false) {
+  if (fresh) state.runDoctor();
+  const { ok, problems, checked_at } = state.doctor;
+  return { ...state._doctorRun, ok, problems, checked_at };
 }
 
 /**

package/js/web/handler.mjs

@@ -130,7 +130,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
 
   function doGet(req, res, path, ae) {
     const route = STATE_ROUTES[path];
-    if (route !== undefined) return sendJson(res, route(state), 200, ae);
+    if (route !== undefined) return sendJson(res, route(state, req.url), 200, ae);
     // `pid` is what a restarting client waits on: the OLD server keeps answering this ping for
     // a moment after `/api/restart` returns, and a reload onto it fetches the old token.
     if (path === '/api/ping') {

package/js/web/routes.mjs

@@ -146,7 +146,9 @@ export const STATE_ROUTES = {
   '/api/recent': apiRecent,
   '/api/themes': apiThemes,
   '/api/setup': apiSetup,
-  '/api/doctor': apiDoctor,
+  // The one route here that reads its query: `?fresh=1` re-runs instead of serving the cache.
+  '/api/doctor': (state, url) => apiDoctor(state,
+    new URL(url || '', 'http://x').searchParams.has('fresh')),
   '/api/installs': apiInstalls,
   '/api/fleet': apiFleet,
   '/api/update': apiUpdate,

package/js/web/server.mjs

@@ -27,7 +27,7 @@ import { isFile, printOut } from '../lib/fs.mjs';
 import { which } from '../lib/paths.mjs';
 import { parseIntStrict } from '../lib/text.mjs';
 import { promptLine } from '../lib/prompt.mjs';
-import { webState } from './state.mjs';
+import { warmDoctor, webState } from './state.mjs';
 import { clearDaemon, codeStamp, openUrl, readDaemon, restartDaemon, startDaemon, statusDaemon, stopDaemon, writeDaemon } from './daemon.mjs';
 import { makeHandler } from './handler.mjs';
 import { JobManager } from './jobs.mjs';
@@ -165,6 +165,8 @@ export async function serve({ theme = null, port = 4747, openBrowser = true,
       printOut(`[web] Geneseed UI on ${url}  (theme: ${state.theme})\n`);
       printOut(daemon ? '[web] daemon ready.\n' : '[web] Ctrl-C to stop.\n');
       if (openBrowser) openUrl(url);
+      // After the record and the ready line, so `web start`'s wait loop already has its URL.
+      warmDoctor(state);
       // Node kills on SIGINT by default, which would skip this message and the record
       // cleanup in `srv.on('close', ...)` below — a foreground `--daemon-internal` server
       // stopped with Ctrl-C would otherwise leave a record pointing at a dead port.