peaks-cli 1.4.1 → 2.0.0

package/dist/src/services/standards/migrate-claude-rules-service.js

@@ -0,0 +1,193 @@
+/**
+ * peaks standards migrate — .claude/rules/ tree thinning.
+ * Slice: 2026-06-12-standards-migrate-claude-rules.
+ *
+ * The 1.x peaks-cli install copied a thick .claude/rules
+ * tree (skill-first / CLI-auxiliary / dogfood / commit-trailer
+ * rules) into consumer projects. In 2.0, the canonical rules
+ * live at .peaks/standards/ and every markdown file under
+ * .claude/rules becomes a 2-line pointer to the canonical path.
+ *
+ * The service:
+ *   1. Backs up the existing `.claude/rules/` tree to
+ *      `.claude/rules/.peaks-2.0-backup-<ts>/` (timestamped;
+ *      safe to run multiple times).
+ *   2. Replaces each .md file under .claude/rules (recursive)
+ *      with a 2-line pointer.
+ *   3. Scaffolds the 2.0 canonical rules at
+ *      `.peaks/standards/{common,typescript}/`, but
+ *      never overwrites existing files in `.peaks/standards/`.
+ *
+ * All operations are gated by `apply: true`. Dry-run mode
+ * returns the would-change diff without writing.
+ */
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+const POINTER_TEXT = (canonicalPath) => `# Canonical peaks-cli 2.0 rules live at: ${canonicalPath}\n# This file is a 2-line pointer. Edit the canonical file instead.\n`;
+function timestampSlug() {
+    return new Date().toISOString().replace(/[:.]/g, '-');
+}
+function readMarkdownFilesRecursive(root) {
+    if (!existsSync(root))
+        return [];
+    const out = [];
+    const stat = statSync(root);
+    if (stat.isFile()) {
+        return root.endsWith('.md') ? [root] : [];
+    }
+    if (!stat.isDirectory())
+        return [];
+    for (const entry of readdirSync(root)) {
+        out.push(...readMarkdownFilesRecursive(join(root, entry)));
+    }
+    return out;
+}
+function isAlreadyPointer(filePath) {
+    if (!existsSync(filePath))
+        return false;
+    try {
+        const body = readFileSync(filePath, 'utf8');
+        return body.includes('Canonical peaks-cli 2.0 rules live at:');
+    }
+    catch {
+        return false;
+    }
+}
+const CANONICAL_2_0_DEV_PREFERENCE = `# Peaks-Cli dev preference (2.0 canonical)
+
+> Project-local preference, captured from the 1.x install + re-rendered with the 2.0 vocabulary.
+> Scope: applies to every iteration, adjustment, fix, or tweak on this project.
+> Reading: read this **before** opening a new CLI command or routing a new feature through a CLI surface.
+
+## Rule 1 — Skill-first, CLI-auxiliary
+
+When designing or modifying a peaks-cli feature, default to the **skill-first** design. CLI commands are **invoked by the skill prompt** when they are the right primitive: a side effect that must be atomic, a gate that must be machine-enforced, a probe that needs structured JSON, or a backstop that prevents the LLM from skipping a step. Behaviour only an LLM in a skill prompt would use lives **in the relevant skill's SKILL.md**, not as a new CLI command. See \`.claude/rules/common/dev-preference.md\` for the decision template.
+
+## Rule 2 — Dogfood on every adjustment
+
+**Every adjustment, iteration, or fix-problem operation must be dogfood-tested in the current project before the work is declared complete.** No exceptions for "it's a small change", "just a comment update", or "just a SKILL.md line". The unit test suite is a subset of "current effect"; the dogfood is the full set. If a change passes unit tests but breaks a CLI command, the change is a regression.
+
+## Rule 3 — Commits belong to the human
+
+**No AI co-author trailer.** The commit is the human's. **Identity is global gitconfig only** (\`~/.gitconfig\`). Do not set, override, or shadow \`user.name\` / \`user.email\` at the repo level, via env vars, or via \`git -c user.*=...\`. The commit's recorded author and committer must both equal the global identity.
+`;
+const CANONICAL_2_0_CODING_STYLE_TS = `# TypeScript Coding Standards (2.0 canonical)
+
+> Project-local standards, derived from the 1.x install + re-rendered with the 2.0 vocabulary.
+
+- Apply project-local conventions before generic typescript guidance.
+- Keep public APIs typed or documented according to typescript ecosystem norms.
+- Do not add new \`any\` types; use explicit domain types, generics, or \`unknown\` with narrowing.
+- Prefer standard tooling and existing project scripts for formatting, linting, tests, and coverage.
+- peaks-rd must check this file before planning code changes in typescript projects.
+`;
+const CANONICAL_2_0_COMMON_FILES = [
+    { relPath: 'common/dev-preference.md', content: CANONICAL_2_0_DEV_PREFERENCE },
+    {
+        relPath: 'common/coding-style.md',
+        content: '# Coding Standards (2.0 canonical)\n\n- Prefer simple, readable code over clever abstractions.\n- Keep functions focused and files cohesive.\n- Use immutable updates unless a language-specific convention explicitly favors mutation.\n- Validate user input, external data, file paths, and configuration at system boundaries.\n- Preserve existing project conventions when they are stricter than this baseline.\n',
+    },
+    {
+        relPath: 'common/code-review.md',
+        content: '# Code Review Standards (2.0 canonical)\n\n- Review diffs for correctness, maintainability, test coverage, and regression risk.\n- Treat missing tests for changed behavior as a blocker unless the change is documentation-only.\n- Verify code paths that handle filesystem, external APIs, credentials, user input, or generated artifacts.\n',
+    },
+    {
+        relPath: 'common/security.md',
+        content: '# Security Review Standards (2.0 canonical)\n\n- Never hardcode secrets, API keys, passwords, tokens, or credentials.\n- Do not send private code or secrets to external services without explicit user authorization.\n- Guard filesystem writes against path traversal, symlink, and junction escapes.\n- Require explicit confirmation for destructive actions, external state changes, and credential use.\n',
+    },
+    { relPath: 'typescript/coding-style.md', content: CANONICAL_2_0_CODING_STYLE_TS },
+];
+export function migrateClaudeRules(input) {
+    const projectRoot = input.projectRoot;
+    const apply = input.apply === true;
+    const warnings = [];
+    const nextActions = [];
+    const claudeRulesDir = join(projectRoot, '.claude', 'rules');
+    const peaksStandardsDir = join(projectRoot, '.peaks', 'standards');
+    const canonicalRelPath = '.peaks/standards/';
+    const existingRulesFiles = readMarkdownFilesRecursive(claudeRulesDir);
+    const thickFiles = existingRulesFiles.filter((f) => !isAlreadyPointer(f));
+    const hasThickFiles = thickFiles.length > 0;
+    // The backup path is computed eagerly (so dry-run can preview
+    // the would-create location) but only created on disk in
+    // apply mode. In dry-run mode we still return the path so
+    // the user can see where the backup will land.
+    const computedBackupPath = hasThickFiles ? join(claudeRulesDir, `.peaks-2.0-backup-${timestampSlug()}`) : null;
+    const backupPath = apply ? computedBackupPath : null;
+    const thinnedFiles = [];
+    const scaffoldedFiles = [];
+    const preservedFiles = [];
+    // wouldChange is true iff there is at least one thick file to
+    // thin. An empty .claude/rules/ is NOT a wouldChange (no-op).
+    const wouldChange = hasThickFiles;
+    if (apply && hasThickFiles) {
+        // Step 1: backup
+        if (backupPath !== null) {
+            try {
+                mkdirSync(backupPath, { recursive: true });
+                for (const file of thickFiles) {
+                    const body = readFileSync(file, 'utf8');
+                    const rel = file.slice(claudeRulesDir.length + 1);
+                    writeFileSync(join(backupPath, rel), body, 'utf8');
+                }
+            }
+            catch (err) {
+                warnings.push(`Backup step failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        // Step 2: replace each .md with a 2-line pointer
+        for (const file of thickFiles) {
+            try {
+                writeFileSync(file, POINTER_TEXT(canonicalRelPath), 'utf8');
+                thinnedFiles.push(file);
+            }
+            catch (err) {
+                warnings.push(`Thin step failed for ${file}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        // Step 3: scaffold .peaks/standards/ — never overwrite existing
+        for (const file of CANONICAL_2_0_COMMON_FILES) {
+            const dest = join(peaksStandardsDir, file.relPath);
+            if (existsSync(dest)) {
+                preservedFiles.push(dest);
+                continue;
+            }
+            try {
+                mkdirSync(join(dest, '..'), { recursive: true });
+                writeFileSync(dest, file.content, 'utf8');
+                scaffoldedFiles.push(dest);
+            }
+            catch (err) {
+                warnings.push(`Scaffold step failed for ${file.relPath}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    if (thinnedFiles.length > 0) {
+        nextActions.push(`Thinned ${thinnedFiles.length} .md file(s) under .claude/rules (recursive) → 2-line pointer.`);
+    }
+    if (scaffoldedFiles.length > 0) {
+        nextActions.push(`Scaffolded ${scaffoldedFiles.length} 2.0 canonical rule(s) at .peaks/standards/.`);
+    }
+    if (preservedFiles.length > 0) {
+        nextActions.push(`Preserved ${preservedFiles.length} existing .peaks/standards/ file(s) (no overwrite).`);
+    }
+    if (backupPath !== null) {
+        nextActions.push(`Backup at ${backupPath} (git-ignored).`);
+    }
+    if (!apply && wouldChange) {
+        nextActions.push('Re-run with --apply to perform the migration.');
+    }
+    return {
+        ok: true,
+        data: {
+            backupPath,
+            thinnedFiles,
+            scaffoldedFiles,
+            preservedFiles,
+            wouldChange,
+            applied: apply && hasThickFiles,
+            nextActions,
+        },
+        warnings,
+    };
+}

package/dist/src/services/standards/project-context.d.ts

@@ -1,6 +1,6 @@
 export type BuildTool = 'umi' | 'next' | 'vite' | 'rsbuild' | 'rspack' | 'farm' | 'craco' | 'webpack' | 'gulp' | 'angular' | 'custom' | 'unknown';
 export type ComponentLibrary = {
-    readonly name: 'antd' | 'antd-pro' | 'mui' | 'shadcn' | 'element-plus' | 'element-ui' | 'arco' | 'tdesign' | 'semi' | 'nextui' | 'chakra' | 'vant' | 'none';
+    readonly name: 'antd' | 'antd-pro' | 'mui' | 'element-plus' | 'element-ui' | 'arco' | 'tdesign' | 'semi' | 'nextui' | 'chakra' | 'vant' | 'none';
     readonly majorVersion?: string;
     readonly hasProSuite?: boolean;
 };

package/dist/src/services/standards/project-context.js

@@ -64,8 +64,6 @@ function detectComponentLibrary(deps) {
     }
     if ('@mui/material' in deps)
         return { name: 'mui', ...(majorOf(deps['@mui/material']) !== undefined ? { majorVersion: majorOf(deps['@mui/material']) } : {}) };
-    if ('tailwindcss' in deps && Object.keys(deps).some((d) => d.startsWith('@radix-ui/')))
-        return { name: 'shadcn' };
     if ('element-plus' in deps)
         return { name: 'element-plus' };
     if ('element-ui' in deps)
@@ -279,8 +277,6 @@ export function componentLibraryLabel(lib) {
                 return 'Ant Design + Ant Design Pro';
             case 'mui':
                 return 'Material UI';
-            case 'shadcn':
-                return 'shadcn/ui (Tailwind + Radix)';
             case 'element-plus':
                 return 'Element Plus';
             case 'element-ui':

package/dist/src/services/standards/project-standards-service.js

@@ -159,8 +159,6 @@ function renderCommonCodingStyle(ctx) {
     }
     if (lib === 'mui')
         stackRules.push('- Style MUI via `sx`, `styled()`, and `theme`. Do NOT apply TailwindCSS utility classes directly to MUI components.');
-    if (lib === 'shadcn')
-        stackRules.push('- Use existing shadcn component variants and Tailwind utility classes. Do not introduce a competing component library.');
     if (ctx.cssFrameworks.includes('tailwind') && (lib === 'antd' || lib === 'antd-pro' || lib === 'mui')) {
         stackRules.push('- TailwindCSS is for layout/utility only; component-library tokens own component styling.');
     }
@@ -185,7 +183,7 @@ function renderCodeReview(ctx) {
     const extra = [];
     const lib = ctx.componentLibrary.name;
     if (lib === 'antd' || lib === 'antd-pro') {
-        extra.push('- Block PRs that introduce a second component library (MUI/shadcn/Chakra) alongside antd.');
+        extra.push('- Block PRs that introduce a second component library (MUI/Chakra) alongside antd.');
         extra.push('- Block PRs that import antd v3/v4 APIs in this v5 project, or vice versa.');
     }
     if (ctx.cssFrameworks.includes('tailwind') && (lib === 'antd' || lib === 'antd-pro' || lib === 'mui')) {

package/dist/src/services/understand/understand-scan-service.js

@@ -2,6 +2,7 @@ import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isDirectory, pathExists, readText } from '../../shared/fs.js';
 import { getErrorMessage } from '../../shared/result.js';
+import { loadPreferences } from '../preferences/preferences-service.js';
 function defaultArtifactDir(projectRoot) {
     return join(projectRoot, '.understand-anything');
 }
@@ -54,19 +55,31 @@ async function readGraph(graphPath) {
 export async function scanUnderstandAnything(options) {
     const artifactDir = options.artifactDir ?? defaultArtifactDir(options.projectRoot);
     const exists = await isDirectory(artifactDir);
+    // L3.1: read uaPrompt from preferences.json (graceful — returns 'unset' if missing/broken)
+    const uaPrompt = await readUaPrompt(options.projectRoot);
     if (!exists) {
         return {
             exists: false,
             artifactDir,
             graph: { exists: false, path: join(artifactDir, 'knowledge-graph.json') },
             intermediate: { exists: false, path: join(artifactDir, 'intermediate') },
-            diffOverlay: { exists: false, path: join(artifactDir, 'diff-overlay.json') }
+            diffOverlay: { exists: false, path: join(artifactDir, 'diff-overlay.json') },
+            uaPrompt
         };
     }
     const graph = await readGraph(join(artifactDir, 'knowledge-graph.json'));
     const intermediate = await readFlag(join(artifactDir, 'intermediate'));
     const diffOverlay = await readFlag(join(artifactDir, 'diff-overlay.json'));
-    return { exists: true, artifactDir, graph, intermediate, diffOverlay };
+    return { exists: true, artifactDir, graph, intermediate, diffOverlay, uaPrompt };
+}
+async function readUaPrompt(projectRoot) {
+    try {
+        const prefs = await loadPreferences(projectRoot);
+        return prefs.uaPrompt;
+    }
+    catch {
+        return 'unset';
+    }
 }
 function pickStringId(value) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {

package/dist/src/services/understand/understand-types.d.ts

@@ -15,10 +15,36 @@ export type UnderstandFlagReport = {
     exists: boolean;
     path: string;
 };
+/**
+ * Slice L3.1 — UA opt-in UX state. 'unset' triggers an opt-in prompt on
+ * first scan; 'skip-this-session' suppresses the prompt for the current
+ * session; 'skip-forever' writes to .peaks/preferences.json to suppress
+ * all future prompts. Mirrors preferences.json:uaPrompt.
+ */
+export type UaPromptDecision = 'unset' | 'skip-this-session' | 'skip-forever';
 export type UnderstandScanReport = {
     exists: boolean;
     artifactDir: string;
     graph: UnderstandGraphReport;
     intermediate: UnderstandFlagReport;
     diffOverlay: UnderstandFlagReport;
+    /** Slice L3.1: opt-in UX state from preferences.json:uaPrompt. */
+    readonly uaPrompt?: UaPromptDecision;
 };
+/**
+ * Slice L3.1 — opt-in prompt payload. When uaPrompt === 'unset' and UA is
+ * absent, the peaks-solo / peaks-ide layer surfaces this to the user via
+ * AskUserQuestion. The CLI does not prompt directly; it returns this
+ * payload so the LLM-side UX layer can decide.
+ */
+export interface UaOptInPrompt {
+    readonly version: 1;
+    readonly tool: 'ua-opt-in';
+    readonly artifactDir: string;
+    readonly reason: 'ua-artifact-missing';
+    readonly options: readonly {
+        readonly id: 'install' | 'fallback-this-session' | 'fallback-forever';
+        readonly label: string;
+        readonly description: string;
+    }[];
+}

package/dist/src/services/upgrade/1x-detector-service.d.ts

@@ -0,0 +1,7 @@
+export interface OneXState {
+    readonly isOneX: boolean;
+    readonly signals: readonly string[];
+    readonly projectRoot: string | null;
+    readonly configPath: string | null;
+}
+export declare function detect1xProjectState(cwd?: string): OneXState;

package/dist/src/services/upgrade/1x-detector-service.js

@@ -0,0 +1,94 @@
+/**
+ * 1.x → 2.0 detection service — TypeScript mirror of
+ * `scripts/install-skills.mjs:detect1xProjectState`.
+ *
+ * Slice: 2026-06-12-solo-step-0-55-1x-detection.
+ *
+ * The canonical implementation lives in the .mjs postinstall
+ * (because the postinstall runs before any TS compile step).
+ * This TS mirror exists so the peaks-solo skill can call
+ * `peaks upgrade --detect-1x --project <root> --json` and
+ * read a structured JSON envelope to gate the
+ * AskUserQuestion that prompts the 1.x → 2.0 upgrade.
+ *
+ * The two implementations MUST stay in parity. The
+ * `tests/integration/upgrade/1x-detector-parity.test.ts`
+ * test exercises both on the same fixture and asserts
+ * their outputs match.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+const MAX_WALK_UP = 8;
+export function detect1xProjectState(cwd = process.cwd()) {
+    const home = homedir();
+    const signals = [];
+    let projectRoot = null;
+    let configPath = null;
+    // Walk up from cwd looking for .peaks/_runtime (signals
+    // we're inside a peaks project).
+    let dir = cwd;
+    for (let i = 0; i < MAX_WALK_UP; i += 1) {
+        const peaksRuntime = join(dir, '.peaks', '_runtime');
+        if (existsSync(peaksRuntime)) {
+            projectRoot = dir;
+            break;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    // Signal 1: ~/.peaks/config.json with 1.x version
+    const globalConfig = join(home, '.peaks', 'config.json');
+    if (existsSync(globalConfig)) {
+        try {
+            const raw = JSON.parse(readFileSync(globalConfig, 'utf8'));
+            if (typeof raw['version'] === 'string' && /^1\./.test(raw['version'])) {
+                signals.push(`global config at ${globalConfig} is 1.x (${raw['version']})`);
+                if (configPath === null)
+                    configPath = globalConfig;
+            }
+        }
+        catch {
+            // ignore parse error — the 1.x detection is best-effort
+        }
+    }
+    // Signal 2: .claude/rules/common/dev-preference.md with peaks progress
+    if (projectRoot !== null) {
+        const devPref = join(projectRoot, '.claude', 'rules', 'common', 'dev-preference.md');
+        if (existsSync(devPref)) {
+            try {
+                const body = readFileSync(devPref, 'utf8');
+                if (/peaks progress/i.test(body)) {
+                    signals.push(`${devPref} references "peaks progress" (1.x CLI surface, removed in slice #014)`);
+                }
+            }
+            catch {
+                // ignore
+            }
+        }
+        // Signal 3: project preferences.json missing or 1.x
+        const prefs = join(projectRoot, '.peaks', 'preferences.json');
+        if (!existsSync(prefs)) {
+            signals.push(`${prefs} does not exist (1.x project never migrated)`);
+        }
+        else {
+            try {
+                const raw = JSON.parse(readFileSync(prefs, 'utf8'));
+                if (raw['schema_version'] !== '2.0.0') {
+                    signals.push(`${prefs} has schema_version ${JSON.stringify(raw['schema_version'])}, expected '2.0.0'`);
+                }
+            }
+            catch {
+                signals.push(`${prefs} exists but is not valid JSON`);
+            }
+        }
+    }
+    return {
+        isOneX: signals.length > 0,
+        signals,
+        projectRoot,
+        configPath,
+    };
+}

package/dist/src/services/upgrade/gitignore-migrate-service.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The 2.0 canonical ignore block. Mirrors the same paths
+ * peaks-cli's own .gitignore uses; kept in lockstep manually
+ * (the peaks-cli root .gitignore is the source of truth).
+ *
+ * Sentinel: every emitted line carries the marker comment so
+ * the migration can detect "already-migrated" and stay
+ * idempotent.
+ */
+export declare const PEAKS_2_0_BLOCK_SENTINEL = "# peaks-cli 2.0 canonical ignore block \u2014 managed by `peaks upgrade --to 2.0`";
+export declare const CANONICAL_2_0_PEAKS_BLOCK: string;
+/**
+ * Returns true when `line` is a wholesale ignore of the entire
+ * `.peaks/` tree (the 1.x pattern that breaks 2.0 tracking).
+ *
+ * Examples that match:    `.peaks`  `.peaks/`  `/.peaks`  `/.peaks/`  `  .peaks/  `
+ * Examples that DON'T:    `.peaks/_runtime/`  `# .peaks/ comment`  `.peaks_other`
+ */
+export declare function isStaleWholesalePeaksRule(line: string): boolean;
+export interface MigrateGitignoreContentResult {
+    /** True if at least one stale wholesale .peaks rule was removed OR the canonical block was appended. */
+    readonly changed: boolean;
+    /** The exact lines that were removed (verbatim, with original whitespace). */
+    readonly removedRules: readonly string[];
+    /** The migrated content (always ends with a newline). */
+    readonly content: string;
+}
+/**
+ * Pure function: takes the .gitignore content, returns the
+ * migrated content + diff summary. No I/O.
+ */
+export declare function migrateGitignoreContent(input: string): MigrateGitignoreContentResult;
+export interface MigrateGitignoreFileInput {
+    readonly projectRoot: string;
+    readonly apply?: boolean;
+}
+export interface MigrateGitignoreFileResult {
+    /** True if .gitignore is absent (nothing to migrate). */
+    readonly missing: boolean;
+    /** True if the migration would change the file. */
+    readonly changed: boolean;
+    /** True only if `apply: true` AND `changed: true`. */
+    readonly appliedWrite: boolean;
+    /** Absolute path to the timestamped backup file, or null. */
+    readonly backupPath: string | null;
+    /** Removed lines (verbatim). */
+    readonly removedRules: readonly string[];
+}
+/**
+ * FS variant: reads .gitignore, runs migration, optionally
+ * writes the result + a timestamped backup of the original.
+ *
+ * Date.now() is used for the backup suffix; in test environments
+ * where determinism matters, the caller can stub Date via vi.
+ */
+export declare function migrateGitignoreFile(input: MigrateGitignoreFileInput): MigrateGitignoreFileResult;

package/dist/src/services/upgrade/gitignore-migrate-service.js

@@ -0,0 +1,170 @@
+/**
+ * .gitignore 1.x → 2.0 migration service.
+ *
+ * Real bug surfaced by ice-cola dogfood 2026-06-12:
+ *   - 1.x consumer projects often have a wholesale `/.peaks/` (or
+ *     `.peaks/` / `.peaks`) entry in their .gitignore — the 1.x
+ *     install treated .peaks/ as the tool's ephemeral working
+ *     directory.
+ *   - In 2.0 the .peaks/ tree is split: most subdirectories
+ *     remain ignored (_runtime, _sub_agents, audit, etc.) but
+ *     several MUST be tracked: .peaks/standards/,
+ *     .peaks/memory/*.md (durable LLM-authored memories),
+ *     .peaks/PROJECT.md, and the user opt-in dotfiles.
+ *   - A wholesale `.peaks/` ignore silently hides every 2.0
+ *     tracked artifact, violating the "one-key completion" tenet
+ *     because the user runs upgrade, sees 6/6 pass, then git
+ *     status shows no new tracked files — the upgrade looks
+ *     "done" but nothing landed in git.
+ *
+ * The service:
+ *   1. Reads the project's .gitignore (string in / string out;
+ *      no I/O in the pure function).
+ *   2. Detects every line that is a wholesale-ignore of .peaks/
+ *      (with or without leading slash, with or without trailing
+ *      slash, ignoring surrounding whitespace).
+ *   3. Removes those lines and appends the canonical 2.0 block
+ *      (granular subpaths) if not already present.
+ *   4. The FS variant `migrateGitignoreFile` adds backup +
+ *      atomic write on top.
+ *
+ * Idempotent: re-running on a migrated .gitignore is a no-op.
+ *
+ * Spec reference: docs/superpowers/specs/2026-06-11-peaks-cli-l1-l2-l3-redesign.md §8.4
+ * (per-project state in .peaks/preferences.json, durable
+ * memories in .peaks/memory/*.md).
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * The 2.0 canonical ignore block. Mirrors the same paths
+ * peaks-cli's own .gitignore uses; kept in lockstep manually
+ * (the peaks-cli root .gitignore is the source of truth).
+ *
+ * Sentinel: every emitted line carries the marker comment so
+ * the migration can detect "already-migrated" and stay
+ * idempotent.
+ */
+export const PEAKS_2_0_BLOCK_SENTINEL = '# peaks-cli 2.0 canonical ignore block — managed by `peaks upgrade --to 2.0`';
+export const CANONICAL_2_0_PEAKS_BLOCK = [
+    PEAKS_2_0_BLOCK_SENTINEL,
+    '.peaks/_runtime/',
+    '.peaks/_dogfood/',
+    '.peaks/_sub_agents/',
+    '.peaks/audit/',
+    '.peaks/system/',
+    '.peaks/runtime/',
+    '.peaks/preferences.json',
+    '.peaks/memory/upgrade-2.0-*.md',
+].join('\n');
+/**
+ * Returns true when `line` is a wholesale ignore of the entire
+ * `.peaks/` tree (the 1.x pattern that breaks 2.0 tracking).
+ *
+ * Examples that match:    `.peaks`  `.peaks/`  `/.peaks`  `/.peaks/`  `  .peaks/  `
+ * Examples that DON'T:    `.peaks/_runtime/`  `# .peaks/ comment`  `.peaks_other`
+ */
+export function isStaleWholesalePeaksRule(line) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+        return false;
+    if (trimmed.startsWith('#'))
+        return false;
+    // Strip leading slash (relative-to-repo-root convention) and
+    // trailing slash (directory marker); both equivalent in
+    // .gitignore semantics for wholesale ignore.
+    const normalized = trimmed.replace(/^\//, '').replace(/\/$/, '');
+    return normalized === '.peaks';
+}
+/**
+ * Pure function: takes the .gitignore content, returns the
+ * migrated content + diff summary. No I/O.
+ */
+export function migrateGitignoreContent(input) {
+    const lines = input.split('\n');
+    const removed = [];
+    const kept = [];
+    for (const line of lines) {
+        if (isStaleWholesalePeaksRule(line)) {
+            removed.push(line.trim());
+        }
+        else {
+            kept.push(line);
+        }
+    }
+    // Already-migrated detection: if the canonical block is
+    // already present AND nothing was removed, this is a no-op.
+    const hasCanonicalBlock = input.includes(PEAKS_2_0_BLOCK_SENTINEL);
+    if (removed.length === 0 && hasCanonicalBlock) {
+        return { changed: false, removedRules: [], content: input };
+    }
+    // Already-migrated AND nothing stale: no-op, return original
+    // verbatim so byte-equality holds for idempotency.
+    if (removed.length === 0 && !hasCanonicalBlock) {
+        // Check whether there's anything peaks-related at all; if
+        // not, treat as no-op (the user explicitly chose not to
+        // ignore .peaks/ — respect that).
+        return { changed: false, removedRules: [], content: input };
+    }
+    // Removed at least one stale rule. Append canonical block
+    // if not already present.
+    let body = kept.join('\n');
+    if (!body.endsWith('\n') && body.length > 0) {
+        body += '\n';
+    }
+    if (!hasCanonicalBlock) {
+        body += CANONICAL_2_0_PEAKS_BLOCK + '\n';
+    }
+    return { changed: true, removedRules: removed, content: body };
+}
+/**
+ * FS variant: reads .gitignore, runs migration, optionally
+ * writes the result + a timestamped backup of the original.
+ *
+ * Date.now() is used for the backup suffix; in test environments
+ * where determinism matters, the caller can stub Date via vi.
+ */
+export function migrateGitignoreFile(input) {
+    const path = join(input.projectRoot, '.gitignore');
+    if (!existsSync(path)) {
+        return {
+            missing: true,
+            changed: false,
+            appliedWrite: false,
+            backupPath: null,
+            removedRules: [],
+        };
+    }
+    const before = readFileSync(path, 'utf8');
+    const result = migrateGitignoreContent(before);
+    if (!result.changed) {
+        return {
+            missing: false,
+            changed: false,
+            appliedWrite: false,
+            backupPath: null,
+            removedRules: [],
+        };
+    }
+    if (input.apply !== true) {
+        return {
+            missing: false,
+            changed: true,
+            appliedWrite: false,
+            backupPath: null,
+            removedRules: result.removedRules,
+        };
+    }
+    // Apply: write backup first, then atomic-overwrite the original.
+    const ts = new Date().toISOString().replace(/[:.]/g, '-');
+    const backupPath = join(input.projectRoot, `.gitignore.peaks-2.0-backup-${ts}`);
+    writeFileSync(backupPath, before, 'utf8');
+    writeFileSync(path, result.content, 'utf8');
+    return {
+        missing: false,
+        changed: true,
+        appliedWrite: true,
+        backupPath,
+        removedRules: result.removedRules,
+    };
+}