geneseed 4.9.1 → 4.9.2

package/js/hosts/hooks-done.mjs

@@ -28,6 +28,11 @@
  *     result is not `is_error` — every non-zero exit, denial and timeout carries it (checked on
  *     14 000+ real Claude Code results, 2026-10-17).
  *
+ * READ FROM THE END (constant-cost Stop). Only the current turn matters, so the transcript is read
+ * backward in growing windows (`tailReader`) until the turn's opening prompt is inside one; a
+ * turn longer than every window falls back to the whole file. Never judged on a truncated turn:
+ * a window without a prompt answers "read more", not "no edit".
+ *
  * At most one block per turn: `stop_hook_active` is true when this Stop follows a block, and the
  * gate then lets the turn end and leaves a ledger line, so a gate that cries wolf gets found.
  */
@@ -37,7 +42,7 @@ import { readText, printOut as out, printErr as err } from '../lib/fs.mjs';
 import { within } from '../lib/paths.mjs';
 import { gitRootOf } from './gitref.mjs';
 import { DONE_LIST, recordGate } from './hooks.mjs';
-import { splitLines } from './hooks-prims.mjs';
+import { splitLines, tailReader } from './hooks-prims.mjs';
 
 const EDIT_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit', 'MultiEdit']);
 const SHELL_TOOLS = new Set(['Bash', 'PowerShell']);
@@ -102,18 +107,24 @@ function isPrompt(obj) {
 /**
  * The decision, over transcript TEXT: the checks that have not passed since the turn's last
  * edit, or [] when the turn may end (no edit, or every check passed after it). Exported for the
- * unit tier — a transcript is text no CLI cell can vary cheaply.
+ * unit tier — a transcript is text no CLI cell can vary cheaply. `whole` false means the text
+ * is only the file's tail: with no prompt in it the turn may start earlier, so the answer is
+ * null ("read more") — a turn judged from its middle could miss its edit and wrongly pass.
  */
-export function doneDecide(transcript, checks, root, cwd = root) {
+export function doneDecide(transcript, checks, root, cwd = root, whole = true) {
   const entries = [];
   for (const line of splitLines(transcript)) {
     if (!line.trim()) continue;
     try { entries.push(JSON.parse(line)); } catch { /* a torn last line is not evidence */ }
   }
-  let start = 0;
+  let start = -1;
   for (let i = entries.length - 1; i >= 0; i -= 1) {
     if (isPrompt(entries[i])) { start = i + 1; break; }
   }
+  if (start === -1) {
+    if (!whole) return null;
+    start = 0;
+  }
   const calls = [];                      // tool_use blocks, in order
   const results = new Map();             // tool_use_id -> is_error
   for (const obj of entries.slice(start)) {
@@ -147,9 +158,10 @@ export function doneDecide(transcript, checks, root, cwd = root) {
  * The Stop-side wrapper `cmdLearn` calls first. Returns true when it printed a block (the turn
  * goes on, so `learn` must not distil yet); false in every other case, with nothing on stdout.
  * `install` is the root `cmdLearn` already derived from `--memory` (null without one), so the
- * ledger lands in the same root its sovereignty check read.
+ * ledger lands in the same root its sovereignty check read. `read` is `cmdLearn`'s per-Stop
+ * transcript reader, so the distillation after an allow reuses the windows read here.
  */
-export function doneGate(meta, args, install) {
+export function doneGate(meta, args, install, read = tailReader()) {
   try {
     const cwd = typeof meta.cwd === 'string' && meta.cwd ? meta.cwd : process.cwd();
     const root = gitRootOf(cwd);
@@ -160,15 +172,15 @@ export function doneGate(meta, args, install) {
       err(`[done-gate] no transcript${args.host === 'bob' ? ' (bob)' : ''} — turn not judged.\n`);
       return false;
     }
-    let transcript;
+    let missing;
     try {
-      transcript = readText(meta.transcript_path);
+      missing = read(meta.transcript_path,
+        (text, whole) => doneDecide(text, checks, root, cwd, whole));
     } catch {
       // No ask tier on Stop: blocking on an unreadable transcript would trap the user.
       err('[done-gate] transcript unreadable — turn not judged.\n');
       return false;
     }
-    const missing = doneDecide(transcript, checks, root, cwd);
     if (!missing.length) return false;
     if (meta.stop_hook_active === true) {
       recordGate(install, 'done-gate-cap', 'law-3');

package/js/hosts/hooks-learn.mjs

@@ -12,7 +12,7 @@ import { NO_WINDOW } from '../lib/proc.mjs';
 import {
   globalHookStandingDown, hookProjectDir, resolveMemoryDir, sovereignBypass,
 } from './hosts.mjs';
-import { readStdin, splitLines, splitWords } from './hooks-prims.mjs';
+import { readStdin, splitLines, splitWords, tailReader } from './hooks-prims.mjs';
 import { doneGate } from './hooks-done.mjs';
 import {
   existingSlugs, readFacts, writeMemories, consolidateMemory, appendAgentLesson,
@@ -94,15 +94,26 @@ function contentText(content) {
   return '';
 }
 
-/** Render a Claude-Code-style JSONL transcript into `role: text` notes. */
-function flattenTranscript(p) {
-  let raw;
+/**
+ * Render a Claude-Code-style JSONL transcript into `role: text` notes, read from the END: the
+ * window grows until its notes hold twice MAX_NOTES_CHARS UTF-16 units (so at least
+ * MAX_NOTES_CHARS code points) or it is the whole file. The window's notes are a suffix of the
+ * whole file's, so the tail `cmdLearn` keeps is the one a full read would give — and a tail of
+ * tool output, which flattens to nothing, just reads further back.
+ */
+function flattenTranscript(p, read) {
   try {
     // `errors="replace"`: Node's utf8 decoder already substitutes U+FFFD.
-    raw = readText(p);
+    return read(p, (raw, whole) => {
+      const flat = flattenText(raw);
+      return whole || flat.length >= 2 * MAX_NOTES_CHARS ? flat : null;
+    });
   } catch {
     return '';
   }
+}
+
+function flattenText(raw) {
   const acc = [];
   for (let line of splitLines(raw)) {
     line = line.trim();
@@ -152,11 +163,11 @@ function flattenTranscript(p) {
  * store, a transcript payload that is not JSON. Those are decisions over text, and the corpus
  * reaches none of them.
  */
-export function readNotes(raw, meta = hookMeta(raw)) {
+export function readNotes(raw, meta = hookMeta(raw), read = tailReader()) {
   if (!raw.trim()) return '';
   const tp = meta.agent_transcript_path || meta.transcript_path;
   if (!tp) return raw;
-  const flat = flattenTranscript(tp);
+  const flat = flattenTranscript(tp, read);
   const lastMsg = typeof meta.last_assistant_message === 'string'
     ? meta.last_assistant_message.trim() : '';
   if (!flat) return lastMsg || flat;
@@ -314,7 +325,9 @@ export function cmdLearn(args) {
   // means the turn goes on, so there is nothing to distil yet: the next Stop will.
   // `--no-done-gate` (the install switched Law III's gate off) skips the check, never the
   // distillation below.
-  if (hookEvent === 'Stop' && !args.file && !args.noDoneGate && doneGate(meta, args, install)) return 0;
+  // One reader for this Stop: an allowed turn's distillation reuses the windows the gate read.
+  const read = tailReader();
+  if (hookEvent === 'Stop' && !args.file && !args.noDoneGate && doneGate(meta, args, install, read)) return 0;
 
   // I2 (Bob): its Stop payload never carries `transcript_path`, so there is never a transcript
   // to distil — and the bare envelope itself is not notes text (that would waste a model call
@@ -334,7 +347,7 @@ export function cmdLearn(args) {
 
   // B3: a real hook call with `$GENESEED_LLM` unset has nothing to send a prompt to — stdout on
   // Stop/SubagentStop/PreCompact reaches only the debug log, never the user (docs `hooks.md`) —
-  // so reading and flattening the transcript (up to 16 KB, every turn) just to print it nowhere
+  // so reading and flattening the transcript (a 2 MB tail or more, every turn) just to print it nowhere
   // is pure waste. Checked BEFORE `readNotes`, which is what does that read. A manual
   // invocation keeps printing the prompt on an unset `$GENESEED_LLM` — that is the documented,
   // deliberate behaviour (docs/reference/env-context.md) for someone running `learn` by hand to
@@ -345,7 +358,7 @@ export function cmdLearn(args) {
     return 0;
   }
 
-  let notes = readNotes(raw, meta);
+  let notes = readNotes(raw, meta, read);
   if (!notes.trim()) {
     err('[learn] no notes or transcript content \u2014 nothing to distil.\n');
     return 0;

package/js/hosts/hooks-prims.mjs

@@ -10,6 +10,7 @@
 import { statSync, readFileSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { comparePaths } from '../lib/paths.mjs';
+import { readTail } from '../lib/fs.mjs';
 
 // ---- Python path and text primitives -------------------------------------------------
 // Small, and each one is here because a JS-idiomatic equivalent differs observably.
@@ -75,6 +76,30 @@ export function splitLines(text) {
   return parts;
 }
 
+/** The first window a Stop reads from a transcript's end; real transcripts reach 50 MB. */
+export const TAIL_BYTES = 2 * 1024 * 1024;
+
+/**
+ * A transcript reader for ONE hook invocation: `read(file, judge)` hands `judge(text, whole)`
+ * the file's last `bytes`, then a window four times larger, until `judge` answers (anything
+ * but null) or the window holds the whole file — where it must answer. Each window is read once
+ * per reader, so the done gate and `learn` share one read when both run on the same Stop.
+ * A read error (missing, unreadable) throws to the caller, uncached. Never a module-level cache:
+ * the host appends between Stops, and a test rewrites the same path.
+ */
+export function tailReader(bytes = TAIL_BYTES) {
+  const seen = new Map();
+  return (file, judge) => {
+    for (let n = bytes; ; n *= 4) {
+      const key = `${n}:${file}`;
+      if (!seen.has(key)) seen.set(key, readTail(file, n));
+      const { text, start } = seen.get(key);
+      const answer = judge(text, start === 0);
+      if (answer !== null || start === 0) return answer;
+    }
+  };
+}
+
 /** `str.split()` with no argument — runs of whitespace, ends stripped, no empties. */
 export function splitWords(s) {
   return s.split(/\s+/).filter(Boolean);

package/js/hosts/hooks.mjs

@@ -525,8 +525,13 @@ export const DONE_LIST = '.geneseed/done-checks.txt';
  * not seen here; CI running the checks is the boundary that holds against that.
  */
 function protectedCheck(p) {
+  return protectedIn(path.resolve(p)) ?? protectedIn(resolvePath(p));
+}
+// One reading of the target. `protectedCheck` takes two — the path as written and the path with
+// links followed — so a link from outside into a protected folder and a protected folder that
+// links out of the repo are both caught: following links never loosens the gate.
+function protectedIn(target) {
   try {
-    const target = resolvePath(p);
     const root = gitRootOf(path.dirname(target));
     if (!root) return null;
     if (normcase(path.relative(root, target)) === normcase(DONE_LIST)) return DONE_LIST;

package/js/hosts/installs.mjs

@@ -609,9 +609,6 @@ export function gatesOfDir(d, host = null) {
   return Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, gateOfDir(d, g.marker, host)]));
 }
 
-/** Law IV's switch alone (#319's reader, kept for its callers). */
-export const deletionGateOfDir = (d, host = null) => gateOfDir(d, 'Deletion gate', host);
-
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
 
 /** `_harness_mcp._claude_read_manifest`. */
@@ -838,7 +835,11 @@ export function installsReferencingShim(shimPath = hookShimPath(), targets = ins
 // ---- what this machine installed (`_harness_setup._installed_defaults`) --------------------
 
 /**
- * `_harness_setup._installed_defaults` — all six keys.
+ * `_harness_setup._installed_defaults` — eight keys: `theme`, `posture`, `mode`, `emit`,
+ * `footprint`, `doctrines`, `excludeRules`, `excludeSkills`. NOT the gate switches: a walk
+ * across every install on the machine would carry one host's `off` into another's re-run, and
+ * for a gate that disarms a boundary its owner never switched off — `setup` reads them off the
+ * one install it is re-running (`targetGates` in js/maintain/setup.mjs).
  *
  * It carried only `theme` and `emit` for four phases because those are the two `status`
  * prints and the two `doctor` reads, and the port's keep-vs-delete rule is "part of an

package/js/hosts/native.mjs

@@ -33,6 +33,7 @@ import { writeText, copyFile, readText } from '../lib/fs.mjs';
 import { jsonDumps, parseJson, formatValue, formatRepr, isTruthy, isDict } from '../lib/json.mjs';
 import { relPosix } from '../lib/text.mjs';
 import { aliasesOf } from '../build/source.mjs';
+import { resolvePath } from './hosts.mjs';
 import { claimLeaf, ownedState } from './owned.mjs';
 // `lstripNewlines` on spec bodies is a no-op on every input the generator produces today
 // (measured: no file under `src/` and no rendered spec in any theme begins with a newline), so
@@ -497,8 +498,9 @@ export function claimer(oldOwned, cfg, manifestExisted = true, oldHashes = {}) {
   const oldSet = oldOwned !== null && oldOwned !== undefined ? new Set(oldOwned) : null;
   let headerPrinted = false;
   const editRefused = new Set();
+  const rroot = cfg != null ? resolvePath(cfg) : undefined;  // once per emit, not per leaf
   const claim = (dest) => {
-    if (cfg != null && !claimLeaf(cfg, dest, relPosix(cfg, dest))) return false;
+    if (cfg != null && !claimLeaf(cfg, dest, relPosix(cfg, dest), rroot)) return false;
     if (oldSet === null || cfg == null || !existsSync(dest)) return true;
     const rel = relPosix(cfg, dest);
     if (oldSet.has(rel)) {

package/js/hosts/owned.mjs

@@ -26,7 +26,7 @@ import path from 'node:path';
 
 import { resolvePath } from './hosts.mjs';
 import { within } from '../lib/paths.mjs';
-import { isFile } from '../lib/fs.mjs';
+import { isFile, statOrNull, textWrites } from '../lib/fs.mjs';
 
 /**
  * The manifest rels that resolve INSIDE `base` — the one security boundary every walk over
@@ -68,9 +68,13 @@ export function ownedWithin(base, rels) {
  * `resolvePath` follows the root link on both `root` and `dest`, so a leaf reached the
  * ordinary way through a linked root still resolves inside it and stays allowed — only the
  * LEAF itself being a link is refused.
+ *
+ * `rroot` is `resolvePath(root)`, passed in by a caller that claims many leaves under one root
+ * (`claimer`, once per emit) — re-resolving it per leaf was ~2.6 s of `doctor --all`. Only the
+ * ROOT is hoisted: the lstat and the leaf's own `resolvePath` below stay per call, since they
+ * are the boundary.
  */
-export function safeLeaf(root, dest) {
-  const rroot = resolvePath(root);
+export function safeLeaf(root, dest, rroot = resolvePath(root)) {
   const st = lstatSync(dest, { throwIfNoEntry: false });
   if (st) {
     if (st.isSymbolicLink()) return false;
@@ -86,8 +90,8 @@ export function safeLeaf(root, dest) {
  * callers that already have it (every one of them, since it is what they are about to push
  * into `owned`) pass it straight through instead of re-deriving it from `dest`.
  */
-export function claimLeaf(root, dest, rel) {
-  if (safeLeaf(root, dest)) return true;
+export function claimLeaf(root, dest, rel, rroot = undefined) {
+  if (safeLeaf(root, dest, rroot)) return true;
   process.stderr.write(`[geneseed] refused ${rel}: it is a link — Geneseed writes only `
     + 'regular files it owns\n');
   return false;
@@ -107,6 +111,19 @@ export function fileHash(p) {
   return createHash('sha256').update(folded, 'latin1').digest('hex');
 }
 
+/**
+ * `fileHash` of a file whose whole content is `written`, computed from the string instead of
+ * read back — `written` must be EXACTLY what went to disk as utf8 (`writeText`'s translated
+ * text, never the text before its `\n` -> `os.EOL`: an embedded `\r\n` becomes `\r\r\n` on
+ * Windows, which folds to `\r\n`, not `\n`). CR and LF are single bytes that never occur
+ * inside a multi-byte utf8 sequence, so folding the string then encoding equals encoding then
+ * folding.
+ */
+export function textHash(written) {
+  return createHash('sha256').update(Buffer.from(written.replaceAll('\r\n', '\n'), 'utf8'))
+    .digest('hex');
+}
+
 /**
  * One sha256 per entry of `owned` that is both inside `root` (through `ownedWithin`, the same
  * containment boundary every other owned-rel walk goes through) and a file that still exists —
@@ -114,12 +131,23 @@ export function fileHash(p) {
  * rather than hashed. Keys land in the same sorted order the manifest writers already give
  * `owned` itself (`[...owned].sort()`), so the hash map a re-emit produces for an unchanged
  * tree is byte-identical to the one before it — `golden.mjs --idempotent`'s whole point.
+ *
+ * A file this emit wrote through `writeText` is hashed from the text it recorded
+ * (`textWrites`, `js/lib/fs.mjs`) rather than read back, while its size and mtime still match
+ * the stat taken at write time; anything else — a copied binary, an unrecorded rewrite — is read.
+ * shortcut: a same-size rewrite by a non-`writeText` writer inside one mtime tick would keep the
+ * stale record; no emit does that today (measured across golden's cells, 0 mismatches) — route
+ * such a writer through `writeText` or drop its entry if one ever appears.
  */
 export function ownedHashes(root, owned) {
   const hashes = {};
   for (const rel of ownedWithin(root, owned).sort()) {
     const p = path.join(root, rel);
-    if (isFile(p)) hashes[rel] = fileHash(p);
+    const st = statOrNull(p);
+    if (!st?.isFile()) continue;
+    const w = textWrites.map?.get(path.resolve(p));
+    hashes[rel] = w && w.size === st.size && w.mtimeMs === st.mtimeMs ? textHash(w.text)
+      : fileHash(p);
   }
   return hashes;
 }

package/js/hosts/settings.mjs

@@ -726,7 +726,9 @@ export function mergeOpencodeJson(p, agentPath, doctrines = null, excluded = [],
  * remove. `default` here means unknown, and unknown keeps the gate (see `processPackOn`).
  */
 export function claudeHookGroups(cfg, hookOpts, doctrines = null, excluded = [], host = 'claude',
-  deletionGate = true, { secretsGate = true, doneGate = true } = {}) {
+  gates = {}) {
+  // One object keyed as `GATE_SWITCHES` keys it; only an explicit `false` disarms a gate.
+  const { secretsGate = true, doneGate = true, deletionGate = true } = gates ?? {};
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
   // --root carries the install's own dir so a GLOBAL hook can stand down when a live, wired
@@ -932,15 +934,14 @@ function readSettingsForMerge(p, consequence) {
  * global that never stood down for a project install.
  */
 export function mergeClaudeSettings(p, priorHooks = null, hookOpts = {},
-  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), deletionGate = true,
-  gates = {}) {
+  doctrines = null, excluded = [], host = 'claude', cfgDir = path.dirname(p), gates = {}) {
   const prior = (priorHooks || []).filter(isDict);
   const loaded = readSettingsForMerge(p, 'Hooks were not wired.');
   if (!loaded) return [p, prior];
   const [config, hadComments] = loaded;
   let hooks = get(config, 'hooks');
   if (!isDict(hooks)) hooks = {};
-  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, deletionGate, gates);
+  const canonical = claudeHookGroups(cfgDir, hookOpts, doctrines, excluded, host, gates);
   const canonFlat = [];
   for (const [event, groups] of Object.entries(canonical)) {
     for (const g of groups) canonFlat.push({ event, group: g });

package/js/inspect/cost.mjs

@@ -9,8 +9,12 @@
  *              `AGENTS.md`), CRLF folded to LF as the smoke test folds it, so the figure and
  *              `CARRIER_CEILING` are the same measurement. `readText` also folds a lone CR,
  *              which the smoke test does not, so the two agree on any carrier without one.
- * - `skills`   the name + description every native skill lists (aliases included: they are
- *              SKILL.md files the host lists like any other).
+ * - `skills`   the name + description of every native skill the MODEL lists. A user-only skill
+ *              (and every alias, which native.mjs writes user-only) stays on disk but out of
+ *              the catalogue, by each host's own mechanism (`userOnly`): the frontmatter's
+ *              `disable-model-invocation` on Claude Code and OpenClaude; on OpenCode, which
+ *              ignores that key, the `permission.skill` deny in `opencode.json`; on Bob no
+ *              SKILL.md exists for one, so there is nothing to skip.
  * - `agents`   the same for native agents; Bob has none, its agents table is in the carrier.
  * - `context`  the session files the context hook injects (untouched seeds already skipped).
  *              The per-repo project context is NOT counted: it changes with the working dir.
@@ -21,6 +25,8 @@ import { sessionFiles } from '../hosts/hooks-context.mjs';
 import { carriersFor } from '../hosts/installs.mjs';
 import { frontmatter } from '../hosts/memory-files.mjs';
 import { listDir } from '../hosts/hooks-prims.mjs';
+import { loadJsonObject, opencodeTarget } from '../hosts/settings.mjs';
+import { isDict } from '../lib/json.mjs';
 import { isFile, readText } from '../lib/fs.mjs';
 
 /**
@@ -44,14 +50,39 @@ function fmValue(raw) {
   return raw;
 }
 
-/** name + description of one spec file; `fallbackName` for agents, whose name is the file stem. */
-function listedChars(file, fallbackName) {
+/**
+ * name + description of one spec file; `fallbackName` for agents, whose name is the file stem.
+ * `hidden(fm)` answers true for a file the host keeps out of the model's catalogue: it counts 0.
+ * @param {string} file
+ * @param {string} fallbackName
+ * @param {(fm: Map<string, string>) => boolean} [hidden]
+ */
+function listedChars(file, fallbackName, hidden = () => false) {
   let fm;
   try { [fm] = frontmatter(readText(file)); } catch { return 0; }
+  if (hidden(fm)) return 0;
   const name = fmValue(fm.get('name')) || fallbackName;
   return name.length + fmValue(fm.get('description')).length;
 }
 
+/**
+ * How `host` hides a skill from the model, mirroring `writeNativeLayer` (js/hosts/native.mjs).
+ * OpenCode reads the deny where `mcpConfigFor` finds its config (`opencode.json(c)` at the
+ * root); a blanket non-object `permission.skill` is the user's own policy and hides nothing
+ * by name, so nothing is skipped. Bob documents no such key: nothing is skipped either.
+ */
+function userOnlyTest(host, root) {
+  if (host === 'claude' || host === 'openclaude') {
+    return (_name, fm) => fm.get('disable-model-invocation') === 'true';
+  }
+  if (host === 'opencode') {
+    const { data } = loadJsonObject(opencodeTarget(path.join(root, 'opencode.json')));
+    const skill = isDict(data) && isDict(data.permission) ? data.permission.skill : null;
+    return (name) => isDict(skill) && skill[name] === 'deny';
+  }
+  return () => false;
+}
+
 /**
  * `root` is the install's root (`installTargets`), `dir` its data dir (`viewCfg`), which holds
  * `skills/`, `agents/` and the session files. Every part that cannot be read counts 0; a missing
@@ -64,9 +95,10 @@ export function alwaysOnCost({ host, root, dir, footprint }) {
 
   let skills = 0;
   const skillsDir = path.join(dir, 'skills');
+  const userOnly = userOnlyTest(host, root);
   for (const name of listDir(skillsDir)) {
     const f = path.join(skillsDir, name, 'SKILL.md');
-    if (isFile(f)) skills += listedChars(f, name);
+    if (isFile(f)) skills += listedChars(f, name, (fm) => userOnly(name, fm));
   }
   let agents = 0;
   if (host !== 'bob') {