geneseed 4.9.0 → 4.9.2

package/js/hosts/loss.mjs

@@ -18,14 +18,18 @@
  *     `branch -f`/`checkout -B`/`switch -C` moving a protected branch off commits nothing else
  *     holds — the same forms on a feature branch pass;
  *   - `stash drop`/`stash clear` while a stash exists; `reflog expire` and `gc --prune` always;
- *   - a file removal (`rm`, `rmdir`, `del`, `erase`, `Remove-Item`/`ri`/`rd`) of anything git
- *     cannot bring back: untracked, ignored or modified files, a repository's own `.git`, or
- *     any path outside a git repository.
+ *   - a file removal (`rm`, `rmdir`, `unlink`, `del`, `erase`, `Remove-Item`/`ri`/`rd`) of
+ *     anything git cannot bring back: untracked, ignored or modified files, a repository's own
+ *     `.git`, or any path outside a git repository.
  *
  * FAIL CLOSED. Anything this reader cannot settle — a glob or a `$variable` in a path it must
- * name, a `cd` it cannot follow, an interpreter (`sh -c`, `xargs`, `eval`) carrying a removal,
- * a git that fails, times out or is missing — asks, and the reason says it could not verify.
- * "Not proven safe" is an ask; only "proven safe" passes.
+ * name, a `cd` it cannot follow, an interpreter (`sh -c`, `xargs`, `eval`, `find -delete`)
+ * carrying a removal, a removal that names no path (`… | Remove-Item` takes its paths from the
+ * pipe), a wrapper flag whose arity it does not know, ANY program it does not read (`setsid`,
+ * `ForEach-Object`, `case`) with a removal named unquoted after it, a git that fails, times out
+ * or is missing — asks, and the reason says it could not verify. A command substitution
+ * (`$(…)`, backticks) is judged as a command of its own. "Not proven safe" is an ask; only
+ * "proven safe" passes.
  *
  * THE ONE SPAWN IN THE GATE PATH, and why it is allowed. Whether a work tree is dirty, which
  * files are untracked, and whether a branch's commits are reachable elsewhere are not readable
@@ -60,16 +64,31 @@ import { currentBranch, gitRootOf, protectedBranches, stashExists } from './gitr
  * a superset of what the parse acts on.
  */
 export const LOSS_CANDIDATE_RE =
-  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'])(?:rm|rmdir|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"']|$)/im;
+  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'`])(?:rm|rmdir|unlink|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"'`]|$)|(?:^|\s)-delete(?=\s|$)/im;
 
 class Unverified extends Error {}
 const unverified = (why) => { throw new Unverified(why); };
 
-const RM_PROGS = new Set(['rm', 'rmdir', 'del', 'erase', 'remove-item', 'ri', 'rd']);
+const RM_PROGS = new Set(['rm', 'rmdir', 'unlink', 'del', 'erase', 'remove-item', 'ri', 'rd']);
 // cmd.exe's own removal verbs take `/s` `/q` switches, which are not paths.
 const CMD_SWITCH_PROGS = new Set(['rmdir', 'del', 'erase', 'rd']);
 const CD_PROGS = new Set(['cd', 'pushd', 'chdir', 'set-location', 'sl']);
-const WRAPPERS = new Set(['sudo', 'doas', 'command', 'builtin', '\\builtin', 'time', 'nice', 'nohup', 'exec', 'env']);
+// A wrapper runs the command after its own flags: `<short flags taking a value>|<short flags taking
+// none>`. A flag in neither list (`env -S` runs a string, `env -C`/`sudo -D` change directory,
+// `command -v` only looks up) is not guessed at — the segment asks if it names a removal.
+const WRAPPERS = new Map([['sudo', 'ughpCUrtT|AbEHiknPSs'], ['doas', 'uC|ns'], ['command', '|p'],
+  ['builtin', '|'], ['\\builtin', '|'], ['time', 'fo|pav'], ['nice', 'n|'], ['nohup', '|'],
+  ['exec', 'a|cl'], ['env', 'u|i0v'], ['timeout', 'sk|v'], ['ionice', 'cn|t'], ['stdbuf', 'ioe|']]);
+const WRAPPER_LONG = new Set(['--preserve-status', '--foreground', '--verbose', '--login', '--preserve-env',
+  '--non-interactive', '--ignore-environment', '--null']);
+// Shell grammar that may stand before the program word (`(cd x && rm y)`, `if …; then rm y; fi`).
+const STRUCTURE = new Set(['(', '((', '{', '!', 'if', 'then', 'elif', 'else', 'do', 'while', 'until']);
+// The only programs this reader does not parse that may still name a removal word and pass: their
+// `rm`/`del` is their own subcommand (a package, a container), or they never run their arguments
+// (a substitution in one is judged on its own). Any other program over a removal word asks.
+const INERT = new Set(['npm', 'pnpm', 'yarn', 'bun', 'cargo', 'brew', 'docker', 'podman', 'echo', 'printf',
+  'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'which', 'where', 'type', 'man', 'get-command',
+  'get-help']);
 // Programs that run ANOTHER command from their arguments or stdin: what they would remove is
 // not on this command line in a form the parse can read, so a removal word inside one asks.
 const INDIRECT = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish', 'pwsh', 'powershell', 'cmd',
@@ -434,6 +453,8 @@ function rmAct(prog, args, dir) {
     if (opts && CMD_SWITCH_PROGS.has(prog) && /^\/[a-zA-Z?]$/.test(a)) continue;
     targets.push(a);
   }
+  // `… | Remove-Item`, `ri -Force`: the paths come from the pipe, which this reader cannot see.
+  if (!targets.length) unverified(`\`${prog}\` names no path, so what it removes comes from elsewhere`);
   const groups = new Map();
   for (const t of targets) {
     const shown = t.replace(OPAQUE, '');
@@ -475,6 +496,69 @@ function rmAct(prog, args, dir) {
 /** The program word, stripped of its path and `.exe`, lowercased (PowerShell and cmd are case-blind). */
 const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '');
 
+/**
+ * A segment's RAW tokens with the shell grammar around its command dropped: leading `(`, `{`,
+ * `!`, `then`, `do`… (a `(` glued to the first word too) and a closing `)`/`}`. Without it
+ * `(git reset --hard)` has `(git` for its program and `--hard)` for its flag. `rootScan`
+ * shares it, so `(find / …)` is a scan.
+ */
+export function stripStructure(raw) {
+  const t = raw.slice();
+  while (t.length) {
+    if (STRUCTURE.has(t[0])) t.shift();
+    else if (/^\(+./.test(t[0])) t[0] = t[0].replace(/^\(+/, '');
+    else break;
+  }
+  while (t.length && (t[t.length - 1] === '}' || /^\)+$/.test(t[t.length - 1]))) t.pop();
+  if (t.length) t[t.length - 1] = t[t.length - 1].replace(/\)+$/, '');
+  return t;
+}
+
+/**
+ * The bodies of the command substitutions in `text` (`$(…)`, backticks, `<(…)`, `>(…)`) —
+ * single quotes hide them, double quotes do not. An unclosed one runs to the end of the text:
+ * the splitter already cut an unquoted `$(a; b)` at its `;`.
+ */
+function substitutions(text) {
+  const out = [];
+  let sq = false; let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (sq) { if (c === "'") sq = false; continue; }
+    if (c === "'" && !dq) { sq = true; continue; }
+    if (c === '"') { dq = !dq; continue; }
+    if (c === '`') {
+      const end = text.indexOf('`', i + 1);
+      out.push(text.slice(i + 1, end < 0 ? text.length : end));
+      i = end < 0 ? text.length : end;
+    } else if ('$<>'.includes(c) && text[i + 1] === '(') {
+      let depth = 1; let j = i + 2;
+      for (; j < text.length && depth; j++) depth += text[j] === '(' ? 1 : text[j] === ')' ? -1 : 0;
+      out.push(text.slice(i + 2, depth ? text.length : j - 1));
+      i = j - 1;
+    }
+  }
+  return out;
+}
+
+/** `w` past wrapper `name`'s own flags (and `timeout`'s duration), or null when a flag is unknown. */
+function pastWrapper(name, w) {
+  const [takes, plain] = WRAPPERS.get(name).split('|');
+  let i = 0;
+  for (; i < w.length && w[i].length > 1 && w[i].startsWith('-'); i++) {
+    const a = w[i];
+    if (a === '--') { i += 1; break; }
+    if (a.startsWith('--')) { if (a.includes('=') || WRAPPER_LONG.has(a)) continue; return null; }
+    if (name === 'nice' && /^-\d+$/.test(a)) continue;
+    for (let j = 1; j < a.length; j++) {
+      if (takes.includes(a[j])) { if (j === a.length - 1) i += 1; break; }   // the value: the rest, or the next word
+      if (!plain.includes(a[j])) return null;
+    }
+  }
+  if (name === 'timeout' && /^\d/.test(w[i] || '')) i += 1;
+  return w.slice(i);
+}
+
 /**
  * The verdict for a whole command, given its segments as RAW token arrays (quotes still on —
  * `js/hosts/hooks.mjs` cuts and tokenises with the same lexer `rootScan` uses, so a quoted
@@ -485,19 +569,33 @@ const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '')
  * each host's ceiling for a crashed gate (docs/adr/0007-gates-fail-closed-per-host-ceiling.md).
  * `always: false` skips the two acts that lose data in every state (`reflog expire`, `gc --prune`)
  * — the OpenCode guard passes it, because a static `permission.bash` glob already asks for those.
+ * `split` cuts a command substitution's body into segments the same way (both callers pass their
+ * splitter); without it, a substitution that names a removal asks.
+ * @param {string[][]} segments
+ * @param {string} cwd
+ * @param {{ always?: boolean, split?: (text: string) => string[][] }} [options]
  */
-export function lossReason(segments, cwd, { always = true } = {}) {
-  let dir = cwd;
-  try {
-    for (const raw of segments) {
+export function lossReason(segments, cwd, { always = true, split } = {}) {
+  /** The first loss among `segs`, run from `start`; a substitution body is judged as a command. */
+  const judge = (segs, start, depth = 0) => {
+    let dir = start;
+    for (const raw of segs.map(stripStructure)) {
+      const text = raw.join(' ');
+      const named = LOSS_CANDIDATE_RE.test(text);
+      for (const body of named ? substitutions(text) : []) {
+        if (!LOSS_CANDIDATE_RE.test(body)) continue;
+        // Bounded: `$($($(…` nested past any real command would rescan the text once per level.
+        if (!split || depth >= 4) unverified('a command substitution names a removal');
+        const v = judge(split(body), dir, depth + 1);
+        if (v) return v;
+      }
       let w = words(raw);
-      while (w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
+      while (w && w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
         const wrapper = progOf(w[0]);
-        w = w.slice(1);
-        // A wrapper's own flags (`sudo -u x`, `env -i`) are not the program.
-        if (wrapper !== 'command' && wrapper !== 'exec') while (w.length && w[0].startsWith('-')) w = w.slice(1);
+        w = /^\w+=/.test(w[0]) ? w.slice(1) : pastWrapper(wrapper, w.slice(1));
+        if (!w && named) unverified(`\`${wrapper}\` takes a flag the gate does not know`);
       }
-      if (!w.length) continue;
+      if (!w || !w.length) continue;
       const prog = progOf(w[0]);
       const args = w.slice(1);
       if (CD_PROGS.has(prog)) {
@@ -510,10 +608,18 @@ export function lossReason(segments, cwd, { always = true } = {}) {
       else if (RM_PROGS.has(prog)) verdict = rmAct(prog, args, dir);
       else if (INDIRECT.has(prog) && LOSS_CANDIDATE_RE.test(args.join(' '))) {
         unverified(`\`${prog}\` runs a command the gate cannot read`);
+      } else if (named && !INERT.has(prog)
+        && LOSS_CANDIDATE_RE.test(raw.map((t) => t.replace(/"[^"]*"?|'[^']*'?/g, ' ')).join(' '))) {
+        // A program this reader does not know (a wrapper, a loop, shell syntax) over an unquoted
+        // removal word: it may run it, so it is not proven safe. A quoted word is data.
+        unverified(`\`${w[0].replace(OPAQUE, '')}\` is not a program the gate reads, and a removal follows it`);
       }
       if (verdict) return verdict;
     }
     return null;
+  };
+  try {
+    return judge(segments, cwd);
   } catch (e) {
     if (!(e instanceof Unverified)) throw e;
     return `the gate could not verify what this command would lose (${e.message})`;

package/js/hosts/native.mjs

@@ -33,6 +33,7 @@ import { writeText, copyFile, readText } from '../lib/fs.mjs';
 import { jsonDumps, parseJson, formatValue, formatRepr, isTruthy, isDict } from '../lib/json.mjs';
 import { relPosix } from '../lib/text.mjs';
 import { aliasesOf } from '../build/source.mjs';
+import { resolvePath } from './hosts.mjs';
 import { claimLeaf, ownedState } from './owned.mjs';
 // `lstripNewlines` on spec bodies is a no-op on every input the generator produces today
 // (measured: no file under `src/` and no rendered spec in any theme begins with a newline), so
@@ -497,8 +498,9 @@ export function claimer(oldOwned, cfg, manifestExisted = true, oldHashes = {}) {
   const oldSet = oldOwned !== null && oldOwned !== undefined ? new Set(oldOwned) : null;
   let headerPrinted = false;
   const editRefused = new Set();
+  const rroot = cfg != null ? resolvePath(cfg) : undefined;  // once per emit, not per leaf
   const claim = (dest) => {
-    if (cfg != null && !claimLeaf(cfg, dest, relPosix(cfg, dest))) return false;
+    if (cfg != null && !claimLeaf(cfg, dest, relPosix(cfg, dest), rroot)) return false;
     if (oldSet === null || cfg == null || !existsSync(dest)) return true;
     const rel = relPosix(cfg, dest);
     if (oldSet.has(rel)) {

package/js/hosts/owned.mjs

@@ -26,7 +26,7 @@ import path from 'node:path';
 
 import { resolvePath } from './hosts.mjs';
 import { within } from '../lib/paths.mjs';
-import { isFile } from '../lib/fs.mjs';
+import { isFile, statOrNull, textWrites } from '../lib/fs.mjs';
 
 /**
  * The manifest rels that resolve INSIDE `base` — the one security boundary every walk over
@@ -68,9 +68,13 @@ export function ownedWithin(base, rels) {
  * `resolvePath` follows the root link on both `root` and `dest`, so a leaf reached the
  * ordinary way through a linked root still resolves inside it and stays allowed — only the
  * LEAF itself being a link is refused.
+ *
+ * `rroot` is `resolvePath(root)`, passed in by a caller that claims many leaves under one root
+ * (`claimer`, once per emit) — re-resolving it per leaf was ~2.6 s of `doctor --all`. Only the
+ * ROOT is hoisted: the lstat and the leaf's own `resolvePath` below stay per call, since they
+ * are the boundary.
  */
-export function safeLeaf(root, dest) {
-  const rroot = resolvePath(root);
+export function safeLeaf(root, dest, rroot = resolvePath(root)) {
   const st = lstatSync(dest, { throwIfNoEntry: false });
   if (st) {
     if (st.isSymbolicLink()) return false;
@@ -86,8 +90,8 @@ export function safeLeaf(root, dest) {
  * callers that already have it (every one of them, since it is what they are about to push
  * into `owned`) pass it straight through instead of re-deriving it from `dest`.
  */
-export function claimLeaf(root, dest, rel) {
-  if (safeLeaf(root, dest)) return true;
+export function claimLeaf(root, dest, rel, rroot = undefined) {
+  if (safeLeaf(root, dest, rroot)) return true;
   process.stderr.write(`[geneseed] refused ${rel}: it is a link — Geneseed writes only `
     + 'regular files it owns\n');
   return false;
@@ -107,6 +111,19 @@ export function fileHash(p) {
   return createHash('sha256').update(folded, 'latin1').digest('hex');
 }
 
+/**
+ * `fileHash` of a file whose whole content is `written`, computed from the string instead of
+ * read back — `written` must be EXACTLY what went to disk as utf8 (`writeText`'s translated
+ * text, never the text before its `\n` -> `os.EOL`: an embedded `\r\n` becomes `\r\r\n` on
+ * Windows, which folds to `\r\n`, not `\n`). CR and LF are single bytes that never occur
+ * inside a multi-byte utf8 sequence, so folding the string then encoding equals encoding then
+ * folding.
+ */
+export function textHash(written) {
+  return createHash('sha256').update(Buffer.from(written.replaceAll('\r\n', '\n'), 'utf8'))
+    .digest('hex');
+}
+
 /**
  * One sha256 per entry of `owned` that is both inside `root` (through `ownedWithin`, the same
  * containment boundary every other owned-rel walk goes through) and a file that still exists —
@@ -114,12 +131,23 @@ export function fileHash(p) {
  * rather than hashed. Keys land in the same sorted order the manifest writers already give
  * `owned` itself (`[...owned].sort()`), so the hash map a re-emit produces for an unchanged
  * tree is byte-identical to the one before it — `golden.mjs --idempotent`'s whole point.
+ *
+ * A file this emit wrote through `writeText` is hashed from the text it recorded
+ * (`textWrites`, `js/lib/fs.mjs`) rather than read back, while its size and mtime still match
+ * the stat taken at write time; anything else — a copied binary, an unrecorded rewrite — is read.
+ * shortcut: a same-size rewrite by a non-`writeText` writer inside one mtime tick would keep the
+ * stale record; no emit does that today (measured across golden's cells, 0 mismatches) — route
+ * such a writer through `writeText` or drop its entry if one ever appears.
  */
 export function ownedHashes(root, owned) {
   const hashes = {};
   for (const rel of ownedWithin(root, owned).sort()) {
     const p = path.join(root, rel);
-    if (isFile(p)) hashes[rel] = fileHash(p);
+    const st = statOrNull(p);
+    if (!st?.isFile()) continue;
+    const w = textWrites.map?.get(path.resolve(p));
+    hashes[rel] = w && w.size === st.size && w.mtimeMs === st.mtimeMs ? textHash(w.text)
+      : fileHash(p);
   }
   return hashes;
 }

package/js/hosts/settings.mjs

@@ -726,7 +726,9 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
  * remove. `default` here means unknown, and unknown keeps the gate (see `processPackOn`).
  */
 export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude',
-  deletionGate = true, { secretsGate = true, doneGate = true } = {}) {
+  gates = {}) {
+  // One object keyed as `GATE_SWITCHES` keys it; only an explicit `false` disarms a gate.
+  const { secretsGate = true, doneGate = true, deletionGate = true } = gates ?? {};
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
   // --root carries the install's own dir so a GLOBAL hook can stand down when a live, wired
@@ -932,15 +934,14 @@ function readSettingsForMerge(p, consequence) {
  * global that never stood down for a project install.
  */
 export function mergeClaudeSettings(p, priorHooks = null, hookOpts = {},
-  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), deletionGate = true,
-  gates = {}) {
+  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), gates = {}) {
   const prior = (priorHooks || []).filter(isDict);
   const loaded = readSettingsForMerge(p, 'Hooks were not wired.');
   if (!loaded) return [p, prior];
   const [config, hadComments] = loaded;
   let hooks = get(config, 'hooks');
   if (!isDict(hooks)) hooks = {};
-  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, deletionGate, gates);
+  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, gates);
   const canonFlat = [];
   for (const [event, groups] of Object.entries(canonical)) {
     for (const g of groups) canonFlat.push({ event, group: g });

package/js/inspect/cost.mjs

@@ -9,8 +9,12 @@
  *              `AGENTS.md`), CRLF folded to LF as the smoke test folds it, so the figure and
  *              `CARRIER_CEILING` are the same measurement. `readText` also folds a lone CR,
  *              which the smoke test does not, so the two agree on any carrier without one.
- * - `skills`   the name + description every native skill lists (aliases included: they are
- *              SKILL.md files the host lists like any other).
+ * - `skills`   the name + description of every native skill the MODEL lists. A user-only skill
+ *              (and every alias, which native.mjs writes user-only) stays on disk but out of
+ *              the catalogue, by each host's own mechanism (`userOnly`): the frontmatter's
+ *              `disable-model-invocation` on Claude Code and OpenClaude; on OpenCode, which
+ *              ignores that key, the `permission.skill` deny in `opencode.json`; on Bob no
+ *              SKILL.md exists for one, so there is nothing to skip.
  * - `agents`   the same for native agents; Bob has none, its agents table is in the carrier.
  * - `context`  the session files the context hook injects (untouched seeds already skipped).
  *              The per-repo project context is NOT counted: it changes with the working dir.
@@ -21,6 +25,8 @@ import { sessionFiles } from '../hosts/hooks-context.mjs';
 import { carriersFor } from '../hosts/installs.mjs';
 import { frontmatter } from '../hosts/memory-files.mjs';
 import { listDir } from '../hosts/hooks-prims.mjs';
+import { loadJsonObject, opencodeTarget } from '../hosts/settings.mjs';
+import { isDict } from '../lib/json.mjs';
 import { isFile, readText } from '../lib/fs.mjs';
 
 /**
@@ -44,14 +50,39 @@ function fmValue(raw) {
   return raw;
 }
 
-/** name + description of one spec file; `fallbackName` for agents, whose name is the file stem. */
-function listedChars(file, fallbackName) {
+/**
+ * name + description of one spec file; `fallbackName` for agents, whose name is the file stem.
+ * `hidden(fm)` answers true for a file the host keeps out of the model's catalogue: it counts 0.
+ * @param {string} file
+ * @param {string} fallbackName
+ * @param {(fm: Map<string, string>) => boolean} [hidden]
+ */
+function listedChars(file, fallbackName, hidden = () => false) {
   let fm;
   try { [fm] = frontmatter(readText(file)); } catch { return 0; }
+  if (hidden(fm)) return 0;
   const name = fmValue(fm.get('name')) || fallbackName;
   return name.length + fmValue(fm.get('description')).length;
 }
 
+/**
+ * How `host` hides a skill from the model, mirroring `writeNativeLayer` (js/hosts/native.mjs).
+ * OpenCode reads the deny where `mcpConfigFor` finds its config (`opencode.json(c)` at the
+ * root); a blanket non-object `permission.skill` is the user's own policy and hides nothing
+ * by name, so nothing is skipped. Bob documents no such key: nothing is skipped either.
+ */
+function userOnlyTest(host, root) {
+  if (host === 'claude' || host === 'openclaude') {
+    return (_name, fm) => fm.get('disable-model-invocation') === 'true';
+  }
+  if (host === 'opencode') {
+    const { data } = loadJsonObject(opencodeTarget(path.join(root, 'opencode.json')));
+    const skill = isDict(data) && isDict(data.permission) ? data.permission.skill : null;
+    return (name) => isDict(skill) && skill[name] === 'deny';
+  }
+  return () => false;
+}
+
 /**
  * `root` is the install's root (`installTargets`), `dir` its data dir (`viewCfg`), which holds
  * `skills/`, `agents/` and the session files. Every part that cannot be read counts 0; a missing
@@ -64,9 +95,10 @@ export function alwaysOnCost({ host, root, dir, footprint }) {
 
   let skills = 0;
   const skillsDir = path.join(dir, 'skills');
+  const userOnly = userOnlyTest(host, root);
   for (const name of listDir(skillsDir)) {
     const f = path.join(skillsDir, name, 'SKILL.md');
-    if (isFile(f)) skills += listedChars(f, name);
+    if (isFile(f)) skills += listedChars(f, name, (fm) => userOnly(name, fm));
   }
   let agents = 0;
   if (host !== 'bob') {

package/js/inspect/diff.mjs

@@ -35,11 +35,15 @@
  *     directly rather than by comparison, because a check made tolerant of a value owes one
  *     somewhere else.
  */
+import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { emitGlobalInto } from '../build/driver.mjs';
+import { PRIMARY_AGENT_SRC, emitGlobalInto } from '../build/driver.mjs';
+import { rglobFiles } from '../build/emit-common.mjs';
+import { CONFIG, makeCfg } from '../build/source.mjs';
+import { sourceFingerprint } from '../build/version.mjs';
 import {
   GLOBAL_MANIFEST, VERSION_MARKER, expanduser, opencodeConfigDir, resolvePath,
 } from '../hosts/hosts.mjs';
@@ -53,6 +57,7 @@ import {
 import { unifiedDiff, splitLines } from '../lib/udiff.mjs';
 import { printOut, printErr, readText, writeText, isFile } from '../lib/fs.mjs';
 import { toPlatformPath } from '../lib/paths.mjs';
+import { relPosix } from '../lib/text.mjs';
 
 /**
  * `_harness_core._T0` — this process's start, in epoch seconds.
@@ -121,6 +126,81 @@ export function withStdoutSwallowed(fn) {
   }
 }
 
+/** A manifest's `rel`, spelled the way the expected snapshot keys it. */
+const posixRel = (rel) => rel.split('\\').join('/');
+
+/**
+ * Render the `expected` tree for `host` at `axes` into a temp dir and SNAPSHOT it — every file,
+ * not only the owned ones, because a rel the DEPLOYED manifest claims is looked up here too and
+ * its presence decides "edited" against "added". The temp dir is gone before this returns.
+ *
+ * The one place a render depends on WHERE it is installed: a global Bob emit writes each
+ * folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the
+ * reference render names the temp tree. Mapped back to the deployed dir here, or every such
+ * skill reads as edited. A deployment that has since MOVED still differs, and that is real
+ * drift — its skills point at a directory that is no longer theirs. A side-file pointer (and a
+ * global OpenCode command's) spells the same directory `/`-separated, so that spelling is
+ * mapped too.
+ */
+function renderExpected(host, axes, deployedDir) {
+  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-diff-'));
+  try {
+    const expected = path.join(tmp, 'expected');
+    withStdoutSwallowed(() => emitGlobalInto(host, {
+      ...axes, out: path.join(tmp, 'bundle'), cfgDir: expected,
+    }));
+    const posix = (p) => p.split(path.sep).join('/');
+    const texts = new Map();
+    for (const p of rglobFiles(expected)) {
+      texts.set(relPosix(expected, p), readText(p).split(expected).join(deployedDir)
+        .split(posix(expected)).join(posix(deployedDir)));
+    }
+    return { owned: ownedSet(expected), texts };
+  } finally {
+    // `tempfile.TemporaryDirectory()`'s cleanup, which runs on the exception path too.
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+/**
+ * A memo for `diffCollect`'s `expected` render — opt-in, so `geneseed diff` and every other
+ * caller still renders afresh. The web console passes one: `/api/overview` and `/api/fleet`
+ * both diff the selected install on every refresh, and the render is ~0.6 s of each.
+ *
+ * ONLY THE RENDER IS MEMOISED, NEVER THE RESULT: the compare against the deployed tree runs on
+ * every call, because catching a hand edit there is the whole point of the drift figure.
+ * One entry per deployed dir, at most `cap` of them (least recently used goes first); `renders`
+ * counts real renders, for the tests.
+ */
+export function renderMemo(cap = 4) {
+  return { cap, renders: 0, entries: new Map() };
+}
+
+/**
+ * The memoised `renderExpected`. The key is everything the render reads: the source
+ * fingerprint, the two render inputs it does not hash (`harness.config.json` and the
+ * orchestrator agent), the host and every axis. A deployed dir whose key changed is
+ * re-rendered in place, and a fingerprint change drops every entry from the old source.
+ */
+function memoExpected(memo, host, axes, deployedDir, sourceFp) {
+  const fp = sourceFp ?? sourceFingerprint(makeCfg());
+  const extra = createHash('sha256');
+  for (const p of [CONFIG, PRIMARY_AGENT_SRC]) extra.update(`${readMaybe(p) ?? ''}\0`);
+  const key = JSON.stringify([fp, extra.digest('hex'), host, axes]);
+  const hit = memo.entries.get(deployedDir);
+  memo.entries.delete(deployedDir);
+  if (hit && hit.key === key) {
+    memo.entries.set(deployedDir, hit);
+    return hit.exp;
+  }
+  for (const [d, e] of memo.entries) if (e.fp !== fp) memo.entries.delete(d);
+  const exp = renderExpected(host, axes, deployedDir);
+  memo.renders += 1;
+  memo.entries.set(deployedDir, { key, fp, exp });
+  while (memo.entries.size > memo.cap) memo.entries.delete(memo.entries.keys().next().value);
+  return exp;
+}
+
 /**
  * `_harness_diff._diff_collect` — returns `{target, theme, files}`, with `files === null` for
  * "nothing to compare here".
@@ -140,7 +220,9 @@ export function withStdoutSwallowed(fn) {
  * choice, which is the same defect with teeth. `rebuild-all` never had it: it reads
  * `postureOfDir`/`modeOfDir` per install root, and this now asks the same two questions.
  */
-export function diffCollect({ target = null, theme = null, emit = null, footprint = null } = {}) {
+export function diffCollect({
+  target = null, theme = null, emit = null, footprint = null, memo = null, sourceFp = null,
+} = {}) {
   // `Path(target).expanduser()` — expanded and NOT resolved, which is the opposite of
   // `cmd_version`'s `.expanduser().resolve()` two files over. It is observable: `target` is
   // printed on the summary line, so `--target .` reports `.` here and an absolute path
@@ -165,69 +247,58 @@ export function diffCollect({ target = null, theme = null, emit = null, footprin
 
   const fp = footprint || footprintOfDir(dir);
 
+  // Every input the render reads off the deployment, in ONE object: it is what the render is
+  // called with AND what the memo keys on, so the two cannot drift apart.
+  const axes = {
+    theme: themeName, footprint: fp,
+    // The third register read off the deployment, for the same reason as the other two: an
+    // install built with `--doctrines craft` compared against an `expected` rendered at all
+    // four reports its entire doctrines section — and its `Active packs:` line — as drift.
+    // `null` (no marker) means unknown and renders at all four, which `doctrinesForBuild`
+    // makes explicit rather than leaving to `makeCfg`'s parameter default two layers down.
+    posture: postureOfDir(dir), mode: modeOfDir(dir), doctrines: doctrinesForBuild(dir),
+    // The loop skill's preset, or its `Default trust preset:` line reads as edited.
+    trust: trustOfDir(dir, host),
+    // The excluded rules, or an install built `--exclude-rules "process 5"` reads its
+    // carrier as drift: `expected` would re-state the rule the deployment took away.
+    excludeRules: excludedRulesOfDir(dir),
+    // The excluded skills, or every skill the install left out reads as deleted.
+    excludeSkills: excludedSkillsOfDir(dir),
+    // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
+    ...gatesOfDir(dir),
+  };
+  const deployedDir = resolvePath(dir);
+  const exp = memo
+    ? memoExpected(memo, host, axes, deployedDir, sourceFp)
+    : renderExpected(host, axes, deployedDir);
+
   const files = [];
-  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-diff-'));
-  try {
-    const expected = path.join(tmp, 'expected');
-    withStdoutSwallowed(() => emitGlobalInto(host, {
-      theme: themeName, out: path.join(tmp, 'bundle'), cfgDir: expected, footprint: fp,
-      // The third register read off the deployment, for the same reason as the other two: an
-      // install built with `--doctrines craft` compared against an `expected` rendered at all
-      // four reports its entire doctrines section — and its `Active packs:` line — as drift.
-      // `null` (no marker) means unknown and renders at all four, which `doctrinesForBuild`
-      // makes explicit rather than leaving to `makeCfg`'s parameter default two layers down.
-      posture: postureOfDir(dir), mode: modeOfDir(dir), doctrines: doctrinesForBuild(dir),
-      // The loop skill's preset, or its `Default trust preset:` line reads as edited.
-      trust: trustOfDir(dir, host),
-      // The excluded rules, or an install built `--exclude-rules "process 5"` reads its
-      // carrier as drift: `expected` would re-state the rule the deployment took away.
-      excludeRules: excludedRulesOfDir(dir),
-      // The excluded skills, or every skill the install left out reads as deleted.
-      excludeSkills: excludedSkillsOfDir(dir),
-      // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
-      ...gatesOfDir(dir),
-    }));
-    // The one place a render depends on WHERE it is installed: a global Bob emit writes each
-    // folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the
-    // reference render names the temp tree. Mapped back to the deployed dir before comparing,
-    // or every such skill reads as edited. A deployment that has since MOVED still differs,
-    // and that is real drift — its skills point at a directory that is no longer theirs.
-    // A side-file pointer (and a global OpenCode command's) spells the same directory
-    // `/`-separated, so that spelling is mapped too.
-    const deployedDir = resolvePath(dir);
-    const posix = (p) => p.split(path.sep).join('/');
-    const rels = [...new Set([...ownedSet(dir), ...ownedSet(expected)])].sort();
-    for (const rel of rels) {
-      const a = path.join(dir, rel);
-      const b = path.join(expected, rel);
-      if (isFile(a) && isFile(b)) {
-        // `read_text(errors="replace")` — Node's utf8 decoder substitutes U+FFFD for the
-        // same bytes, and `readText` folds the line endings the way `Path.read_text` does.
-        const ta = readText(a);
-        const tb = readText(b).split(expected).join(deployedDir)
-          .split(posix(expected)).join(posix(deployedDir));
-        if (cmpKey(rel, ta) !== cmpKey(rel, tb)) {
-          const diff = unifiedDiff(splitLines(tb), splitLines(ta), {
-            fromfile: `source/${rel}`, tofile: `deployed/${rel}`, lineterm: '',
-          });
-          files.push({ rel, status: 'edited', diff });
-        }
-      } else if (isFile(a)) {
-        const body = splitLines(readText(a));
-        files.push({
-          rel,
-          status: 'added',
-          diff: ['(only in deployed — your addition)', '', ...body.map((ln) => `+${ln}`)],
-        });
-      } else {
-        files.push({
-          rel, status: 'missing', diff: ['(in source, not deployed — re-emit to add)'],
+  const rels = [...new Set([...ownedSet(dir), ...exp.owned])].sort();
+  for (const rel of rels) {
+    const a = path.join(dir, rel);
+    const tb = exp.texts.get(posixRel(rel));
+    if (isFile(a) && tb !== undefined) {
+      // `read_text(errors="replace")` — Node's utf8 decoder substitutes U+FFFD for the
+      // same bytes, and `readText` folds the line endings the way `Path.read_text` does.
+      const ta = readText(a);
+      if (cmpKey(rel, ta) !== cmpKey(rel, tb)) {
+        const diff = unifiedDiff(splitLines(tb), splitLines(ta), {
+          fromfile: `source/${rel}`, tofile: `deployed/${rel}`, lineterm: '',
         });
+        files.push({ rel, status: 'edited', diff });
       }
+    } else if (isFile(a)) {
+      const body = splitLines(readText(a));
+      files.push({
+        rel,
+        status: 'added',
+        diff: ['(only in deployed — your addition)', '', ...body.map((ln) => `+${ln}`)],
+      });
+    } else {
+      files.push({
+        rel, status: 'missing', diff: ['(in source, not deployed — re-emit to add)'],
+      });
     }
-  } finally {
-    // `tempfile.TemporaryDirectory()`'s cleanup, which runs on the exception path too.
-    rmSync(tmp, { recursive: true, force: true });
   }
   // Already sorted by `rel` above; the Python sorts again after the loop and so does this,
   // because the two sorts are over different things — that one is over the RECORDS, and a