peaks-cli 1.4.2 → 2.0.1

package/dist/src/services/config/config-restore.js

@@ -0,0 +1,47 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { backupConfigPath } from './config-migration.js';
+/**
+ * Spec §8.6 — restore a single archived field from `config.json.1.x.bak`.
+ * Does NOT modify `config.json` itself (which is now slim v2).
+ * Instead writes a sidecar `config.json.restore-<field>.json` so the user
+ * can review before adopting. Fields in the deferred-design set
+ * (workspaces, providers, proxy) throw RESTORE_GUARDED so the user has
+ * to acknowledge explicitly.
+ */
+const GUARDED_FIELDS = new Set(['workspaces', 'providers', 'proxy']);
+function readBakContent() {
+    const bak = backupConfigPath();
+    if (!existsSync(bak)) {
+        throw new Error('NO_BACKUP: ~/.peaks/config.json.1.x.bak not found');
+    }
+    return JSON.parse(readFileSync(bak, 'utf8'));
+}
+export function listAvailableFields() {
+    const bak = readBakContent();
+    return Object.keys(bak).filter((k) => k !== 'version');
+}
+export function restoreField(opts) {
+    const bak = readBakContent();
+    if (!(opts.field in bak)) {
+        throw new Error(`FIELD_NOT_FOUND: ${opts.field} is not in config.json.1.x.bak`);
+    }
+    if (GUARDED_FIELDS.has(opts.field)) {
+        throw new Error(`RESTORE_GUARDED: restoring "${opts.field}" is discouraged because the deferred design intentionally avoids it; add it to config.json manually if you really need it`);
+    }
+    const home = homedir();
+    const sidecar = join(home, '.peaks', `config.json.restore-${opts.field}.json`);
+    if (!opts.apply) {
+        return { field: opts.field, applied: false };
+    }
+    mkdirSync(join(home, '.peaks'), { recursive: true });
+    const payload = {
+        field: opts.field,
+        value: bak[opts.field],
+        source: 'config.json.1.x.bak',
+        restoredAt: new Date().toISOString(),
+    };
+    writeFileSync(sidecar, JSON.stringify(payload, null, 2) + '\n', 'utf8');
+    return { field: opts.field, applied: true, sidecarPath: sidecar };
+}

package/dist/src/services/config/config-rollback.d.ts

@@ -0,0 +1,13 @@
+export interface RollbackPlan {
+    available: boolean;
+    detectedVersion: string | null;
+    backupPath: string;
+}
+export interface RollbackResult extends RollbackPlan {
+    applied: boolean;
+    restoredConfigPath?: string;
+}
+export declare function planRollback(): RollbackPlan;
+export declare function executeRollback(opts: {
+    apply: boolean;
+}): RollbackResult;

package/dist/src/services/config/config-rollback.js

@@ -0,0 +1,26 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { backupConfigPath, globalConfigPath } from './config-migration.js';
+export function planRollback() {
+    const backup = backupConfigPath();
+    if (!existsSync(backup)) {
+        return { available: false, detectedVersion: null, backupPath: backup };
+    }
+    const raw = JSON.parse(readFileSync(backup, 'utf8'));
+    return {
+        available: true,
+        detectedVersion: raw.version ?? null,
+        backupPath: backup,
+    };
+}
+export function executeRollback(opts) {
+    const plan = planRollback();
+    if (!plan.available) {
+        throw new Error('NO_BACKUP: ~/.peaks/config.json.1.x.bak not found');
+    }
+    if (!opts.apply) {
+        return { ...plan, applied: false };
+    }
+    const restored = JSON.parse(readFileSync(plan.backupPath, 'utf8'));
+    writeFileSync(globalConfigPath(), JSON.stringify(restored, null, 2) + '\n', 'utf8');
+    return { ...plan, applied: true, restoredConfigPath: globalConfigPath() };
+}

package/dist/src/services/config/config-service.d.ts

@@ -1,7 +1,22 @@
-import type { ConfigGetOptions, ConfigLayer, ConfigSetOptions, MiniMaxProviderConfig, PeaksConfig, TokenRef, WorkspaceConfig } from './config-types.js';
+import type { ConfigGetOptions, ConfigLayer, ConfigSetOptions, ConfigV2, MiniMaxProviderConfig, OcrAuthHeader, OcrConfig, OcrLlmConfig, PeaksConfig, TokenRef, WorkspaceConfig } from './config-types.js';
 export { resolveProjectRootForConfig, resolveCanonicalProjectRoot } from './config-safety.js';
+/**
+ * Load the slim 2.0 `~/.peaks/config.json` file. Returns the parsed
+ * object when the file is at schema 2.0.0; returns null when the
+ * file is absent (fresh install, no global config yet).
+ *
+ * Throws `CONFIG_LEGACY_VERSION` when the file exists at a 1.x
+ * schema version — the caller is expected to run
+ * `peaks config migrate --apply` to bring it forward before
+ * continuing. This gate is intentional: a slim 2.0 reader must
+ * not silently pass through a 1.x shape, because every field it
+ * ignores is a field the caller is going to look for elsewhere
+ * (preferences.json, .bak, _state/).
+ */
+export declare function loadGlobalConfig(): ConfigV2 | null;
 export declare function isConfigLayer(value: string): value is ConfigLayer;
 export declare function isSensitiveConfigPath(path: string): boolean;
+export declare function isLegacyConfigKey(path: string): boolean;
 export declare function containsSensitiveConfigValue(value: unknown): boolean;
 export type RedactedConfigValue = string | number | boolean | null | RedactedConfigValue[] | {
     [key: string]: RedactedConfigValue;
@@ -18,6 +33,23 @@ export type MiniMaxProviderStatus = {
 export declare function getMiniMaxProviderConfig(): MiniMaxProviderConfig;
 export declare function getMiniMaxProviderStatus(): MiniMaxProviderStatus;
 export declare function setMiniMaxProviderConfig(input: MiniMaxProviderConfig): MiniMaxProviderStatus;
+/**
+ * Read the ocr LLM endpoint config from the user-layer
+ * `~/.peaks/config.json`. The user populates this themselves by
+ * pasting the `peaks code-review config-template` output (or by
+ * running `peaks config set --key ocr.llm.url --value '...'`).
+ * peaks-cli never auto-writes these values.
+ */
+export declare function getOcrConfig(): OcrConfig;
+/**
+ * Return the resolved `OcrLlmConfig` block (`peaksConfig.ocr.llm`)
+ * or `null` when the user has not populated the user config. The
+ * 5-state OCR detector uses this as the source of truth; when the
+ * returned block is missing required fields it produces a
+ * `config-missing` state with a templated `nextActions` payload
+ * the user can paste into their config.
+ */
+export declare function getOcrLlmConfig(): OcrLlmConfig | null;
 export declare function bootstrapProjectLanguageConfig(projectRoot: string, language: string): void;
 export declare function readConfig(projectRoot?: string | null): PeaksConfig;
 export declare function writeConfig(partial: Partial<PeaksConfig>, layer?: ConfigLayer): void;
@@ -32,4 +64,6 @@ export declare function getWorkspaceConfigForPath(path?: string): WorkspaceConfi
 export declare function ensureWorkspaceConfigForPath(path?: string): WorkspaceConfig | null;
 export declare function getWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
 export declare function ensureWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
-export type { TokenRef, WorkspaceConfig, PeaksConfig, ConfigLayer };
+export type { OcrAuthHeader, OcrConfig, OcrLlmConfig, TokenRef, WorkspaceConfig, PeaksConfig, ConfigLayer };
+export { getUserConfigPath } from './config-safety.js';
+export { globalConfigPath } from './config-migration.js';

package/dist/src/services/config/config-service.js

@@ -3,8 +3,35 @@ import { dirname, isAbsolute, resolve } from 'node:path';
 import { DEFAULT_CONFIG } from './config-types.js';
 import { stablePath } from '../../shared/path-utils.js';
 import { findProjectRoot, getProjectBootstrapConfigPath, getProjectConfigPath, getUserConfigPath, isInsidePath, readConfigFileSafely, resolveProjectRootForConfig, validateArtifactWorkspaceMarkerPath, validateArtifactWorkspaceRoot, validateProjectBootstrapConfigPathForWrite, validateUserConfigPathForWrite, writeConfigFileSafely, writeProjectConfigFile, writeUserConfigFile } from './config-safety.js';
+import { globalConfigPath, CONFIG_SCHEMA_VERSION_V2 } from './config-migration.js';
+import { isConfigV2 } from './config-types.js';
 // Re-export resolveProjectRootForConfig and resolveCanonicalProjectRoot for external consumers
 export { resolveProjectRootForConfig, resolveCanonicalProjectRoot } from './config-safety.js';
+/**
+ * Load the slim 2.0 `~/.peaks/config.json` file. Returns the parsed
+ * object when the file is at schema 2.0.0; returns null when the
+ * file is absent (fresh install, no global config yet).
+ *
+ * Throws `CONFIG_LEGACY_VERSION` when the file exists at a 1.x
+ * schema version — the caller is expected to run
+ * `peaks config migrate --apply` to bring it forward before
+ * continuing. This gate is intentional: a slim 2.0 reader must
+ * not silently pass through a 1.x shape, because every field it
+ * ignores is a field the caller is going to look for elsewhere
+ * (preferences.json, .bak, _state/).
+ */
+export function loadGlobalConfig() {
+    const path = globalConfigPath();
+    if (!existsSync(path))
+        return null;
+    const content = readConfigFileSafely(path, 'Global config path must stay inside the user root');
+    const raw = JSON.parse(content);
+    if (isConfigV2(raw)) {
+        return raw;
+    }
+    const detected = typeof raw.version === 'string' ? raw.version : 'unknown';
+    throw new Error(`CONFIG_LEGACY_VERSION: ~/.peaks/config.json is at version "${detected}", expected ${CONFIG_SCHEMA_VERSION_V2}. Run \`peaks config migrate --apply\`.`);
+}
 function readJsonFile(path, validateBeforeRead, errorMessage = 'Config path must stay inside the config root') {
     if (!path || !existsSync(path))
         return null;
@@ -89,6 +116,26 @@ export function isSensitiveConfigPath(path) {
     const normalized = path.toLowerCase().replace(/[^a-z0-9]/g, '');
     return normalized.includes('apikey') || normalized.includes('accesskey') || normalized.includes('privatekey') || normalized.includes('token') || normalized.includes('secret') || normalized.includes('password') || normalized.includes('bearer') || normalized.includes('credential') || normalized.includes('auth');
 }
+/**
+ * 2.0.1 slim-config contract: `~/.peaks/config.json` only stores
+ * `version` + `ocr.llm.*` placeholders. The 1.x → 2.0 migration
+ * moved per-project fields (`language`, `model`, `economyMode`,
+ * `swarmMode`) to `<project>/.peaks/preferences.json` (per spec
+ * §10.4). `setConfig` rejects writes to those keys and points the
+ * user to the preferences path; tokens / providers / proxy still
+ * live in `~/.peaks/config.json` (the loader is tolerant of them
+ * but does not synthesise defaults for them anymore).
+ */
+const LEGACY_CONFIG_KEYS = new Set([
+    'language',
+    'model',
+    'economyMode',
+    'swarmMode'
+]);
+export function isLegacyConfigKey(path) {
+    const topLevel = path.split(/[.[].*/, 1)[0] ?? '';
+    return LEGACY_CONFIG_KEYS.has(topLevel);
+}
 function isProviderConfigPath(path) {
     return path === 'providers' || path.startsWith('providers.');
 }
@@ -367,6 +414,58 @@ export function setMiniMaxProviderConfig(input) {
     writeConfig({ providers }, 'user');
     return createMiniMaxProviderStatus(providers.minimax ?? {});
 }
+const OCR_AUTH_HEADERS = new Set(['authorization', 'x-api-key', 'bearer']);
+function toOcrLlmConfig(value) {
+    if (!isRecord(value))
+        return {};
+    const url = typeof value.url === 'string' && value.url.trim().length > 0 ? value.url.trim() : undefined;
+    const authToken = typeof value.authToken === 'string' && value.authToken.length > 0 ? value.authToken : undefined;
+    const model = typeof value.model === 'string' && value.model.trim().length > 0 ? value.model.trim() : undefined;
+    const useAnthropic = typeof value.useAnthropic === 'boolean' ? value.useAnthropic : undefined;
+    const rawAuthHeader = typeof value.authHeader === 'string' ? value.authHeader : undefined;
+    const authHeader = rawAuthHeader !== undefined && OCR_AUTH_HEADERS.has(rawAuthHeader)
+        ? rawAuthHeader
+        : undefined;
+    return {
+        ...(url !== undefined ? { url } : {}),
+        ...(authToken !== undefined ? { authToken } : {}),
+        ...(model !== undefined ? { model } : {}),
+        ...(useAnthropic !== undefined ? { useAnthropic } : {}),
+        ...(authHeader !== undefined ? { authHeader } : {})
+    };
+}
+function toOcrConfig(value) {
+    if (!isRecord(value))
+        return {};
+    return {
+        ...(isRecord(value.llm) ? { llm: toOcrLlmConfig(value.llm) } : {})
+    };
+}
+/**
+ * Read the ocr LLM endpoint config from the user-layer
+ * `~/.peaks/config.json`. The user populates this themselves by
+ * pasting the `peaks code-review config-template` output (or by
+ * running `peaks config set --key ocr.llm.url --value '...'`).
+ * peaks-cli never auto-writes these values.
+ */
+export function getOcrConfig() {
+    const userConfig = readUserJsonFile() ?? {};
+    return toOcrConfig(userConfig.ocr);
+}
+/**
+ * Return the resolved `OcrLlmConfig` block (`peaksConfig.ocr.llm`)
+ * or `null` when the user has not populated the user config. The
+ * 5-state OCR detector uses this as the source of truth; when the
+ * returned block is missing required fields it produces a
+ * `config-missing` state with a templated `nextActions` payload
+ * the user can paste into their config.
+ */
+export function getOcrLlmConfig() {
+    const ocr = getOcrConfig();
+    if (!ocr.llm)
+        return null;
+    return ocr.llm;
+}
 function inferHumanLanguage(value) {
     const normalized = value.trim();
     if (!normalized) {
@@ -472,6 +571,10 @@ export function setConfig(options) {
     if (!isConfigLayer(layer)) {
         throw new Error('Invalid config layer');
     }
+    if (isLegacyConfigKey(options.key)) {
+        throw new Error(`Legacy config key "${options.key}" is no longer stored in ~/.peaks/config.json. ` +
+            'Set it under <project>/.peaks/preferences.json (e.g. `peaks preferences set --key <key> --value <value>`).');
+    }
     if (layer === 'project' && (isProviderConfigPath(options.key) || isProxyConfigPath(options.key) || isSensitiveConfigPath(options.key) || containsSensitiveConfigValue(options.value))) {
         throw new Error('Sensitive config keys must be stored in the user config layer');
     }
@@ -641,3 +744,5 @@ export function getWorkspaceConfigForCurrentPath() {
 export function ensureWorkspaceConfigForCurrentPath() {
     return ensureWorkspaceConfigForPath(process.cwd());
 }
+export { getUserConfigPath } from './config-safety.js';
+export { globalConfigPath } from './config-migration.js';

package/dist/src/services/config/config-types.d.ts

@@ -1,3 +1,4 @@
+import { CONFIG_SCHEMA_VERSION_V2 } from './config-migration.js';
 export type TokenRef = {
     env: string;
 } | {
@@ -49,6 +50,39 @@ export type WorkspaceConfig = {
     artifactStorage?: ArtifactStorageConfig;
     installedCapabilityIds: string[];
 };
+/**
+ * Open Code Review (ocr) LLM endpoint config. Stored under
+ * `peaksConfig.ocr.llm` so the user has a single, discoverable
+ * place to declare their LLM endpoint for the ocr second-opinion
+ * review. peaks-cli never auto-writes these values; the user pastes
+ * the template (printed by `peaks code-review config-template`) into
+ * their `~/.peaks/config.json` themselves.
+ *
+ * The field names map onto the OCR package's own env-var surface
+ * (the highest-priority config path for the ocr subprocess):
+ *
+ *   peaksConfig.ocr.llm.url          → OCR_LLM_URL
+ *   peaksConfig.ocr.llm.authToken    → OCR_LLM_TOKEN
+ *   peaksConfig.ocr.llm.model        → OCR_LLM_MODEL
+ *   peaksConfig.ocr.llm.useAnthropic → OCR_USE_ANTHROPIC
+ *   peaksConfig.ocr.llm.authHeader   → OCR_LLM_AUTH_HEADER
+ *
+ * All fields are optional at the type level so the user can fill
+ * them in one at a time; the 5-state detector treats the
+ * `url + authToken + model` triple as the minimum for a `ready`
+ * state and reports the missing keys in `nextActions`.
+ */
+export type OcrAuthHeader = 'authorization' | 'x-api-key' | 'bearer';
+export type OcrLlmConfig = {
+    url?: string;
+    authToken?: string;
+    model?: string;
+    useAnthropic?: boolean;
+    authHeader?: OcrAuthHeader;
+};
+export type OcrConfig = {
+    llm?: OcrLlmConfig;
+};
 export type PeaksConfig = {
     version: string;
     language: string;
@@ -78,6 +112,15 @@ export type PeaksConfig = {
         enabled: boolean;
         heartbeatIntervalMs: number;
     };
+    /**
+     * Open Code Review (ocr) second-opinion config. Source of truth
+     * for the LLM endpoint that the ocr subprocess consumes via env
+     * vars (`OCR_LLM_URL` / `OCR_LLM_TOKEN` / ...). peaks-cli does
+     * NOT auto-write this — the user populates it by pasting the
+     * `peaks code-review config-template` output into their
+     * `~/.peaks/config.json`. See `OcrLlmConfig` for the field map.
+     */
+    ocr?: OcrConfig;
 };
 export type ConfigLayer = 'user' | 'project';
 export type ConfigGetOptions = {
@@ -89,4 +132,34 @@ export type ConfigSetOptions = {
     value: unknown;
     layer?: ConfigLayer;
 };
+/**
+ * 2.0.1 slim runtime default. The on-disk `~/.peaks/config.json`
+ * only carries `version` + `ocr.llm.*` placeholders. Legacy fields
+ * (language / model / economyMode / swarmMode / tokens / providers /
+ * proxy) live in `<project>/.peaks/preferences.json` (per spec
+ * §10.4) and are NOT synthesised here — `readConfig()` merges the
+ * user file over this default, and any legacy field that the user
+ * file still carries (1.x file) is exposed via `getConfig` for
+ * backward compatibility.
+ *
+ * Cast to `PeaksConfig` because the type still declares the legacy
+ * fields as required (they are part of the `readConfig()` contract
+ * for tolerant loading of pre-2.0.1 files); the runtime default
+ * itself does not supply them.
+ */
 export declare const DEFAULT_CONFIG: PeaksConfig;
+/**
+ * Slim 2.0 schema for `~/.peaks/config.json`. After migration,
+ * the only meaningful field is `version`; everything else
+ * (language, model, economyMode, swarmMode, tokens, providers,
+ * proxy, workspaces, currentWorkspace) is stored elsewhere
+ * (`.peaks/preferences.json`, `.peaks/_state/`, or `.bak`).
+ *
+ * The type is intentionally minimal: extra keys are ignored at
+ * runtime, not rejected, so a hand-written or partially-migrated
+ * file does not fail the loader.
+ */
+export interface ConfigV2 {
+    readonly version: typeof CONFIG_SCHEMA_VERSION_V2;
+}
+export declare function isConfigV2(raw: unknown): raw is ConfigV2;

package/dist/src/services/config/config-types.js

@@ -1,19 +1,34 @@
 import { CLI_VERSION } from '../../shared/version.js';
+import { CONFIG_SCHEMA_VERSION_V2 } from './config-migration.js';
+/**
+ * 2.0.1 slim runtime default. The on-disk `~/.peaks/config.json`
+ * only carries `version` + `ocr.llm.*` placeholders. Legacy fields
+ * (language / model / economyMode / swarmMode / tokens / providers /
+ * proxy) live in `<project>/.peaks/preferences.json` (per spec
+ * §10.4) and are NOT synthesised here — `readConfig()` merges the
+ * user file over this default, and any legacy field that the user
+ * file still carries (1.x file) is exposed via `getConfig` for
+ * backward compatibility.
+ *
+ * Cast to `PeaksConfig` because the type still declares the legacy
+ * fields as required (they are part of the `readConfig()` contract
+ * for tolerant loading of pre-2.0.1 files); the runtime default
+ * itself does not supply them.
+ */
 export const DEFAULT_CONFIG = {
     version: CLI_VERSION,
-    language: 'en',
-    model: 'sonnet',
-    economyMode: true,
-    swarmMode: true,
-    tokens: {},
-    providers: {
-        minimax: {
-            model: 'minimax-2.7'
+    ocr: {
+        llm: {
+            url: '',
+            authToken: '',
+            model: '',
+            useAnthropic: false,
+            authHeader: 'authorization'
         }
-    },
-    proxy: {},
-    progress: {
-        enabled: true,
-        heartbeatIntervalMs: 60000
     }
 };
+export function isConfigV2(raw) {
+    return (typeof raw === 'object' &&
+        raw !== null &&
+        raw.version === CONFIG_SCHEMA_VERSION_V2);
+}

package/dist/src/services/config/model-routing.js

@@ -1,7 +1,6 @@
-import { DEFAULT_CONFIG } from './config-types.js';
 export const STRONGEST_MODEL_ID = 'claude-opus-4-7';
 export function getConfiguredExecutionModelId(providers) {
-    const providerConfigs = Object.values(providers ?? DEFAULT_CONFIG.providers);
+    const providerConfigs = Object.values(providers ?? {});
     const configuredModel = providerConfigs
         .map((provider) => provider?.model?.trim())
         .find((model) => typeof model === 'string' && model.length > 0);
@@ -11,5 +10,8 @@ export function getConfiguredExecutionModelId(providers) {
     return configuredModel;
 }
 export function getEconomyAwareExecutionModelId(config) {
-    return config.economyMode ? getConfiguredExecutionModelId(config.providers) : STRONGEST_MODEL_ID;
+    // Slice 2.0.1-bug1 round 3: economy is the project default. Treat undefined as enabled
+    // (matches the pre-slice implicit default from DEFAULT_CONFIG.economyMode = true). Only an
+    // explicit `economyMode === false` switches execution to STRONGEST_MODEL_ID.
+    return config.economyMode !== false ? getConfiguredExecutionModelId(config.providers) : STRONGEST_MODEL_ID;
 }

package/dist/src/services/doctor/doctor-service.js

@@ -10,6 +10,7 @@ import { loadSkillRegistry } from '../skills/skill-registry.js';
 import { getSkillPresence } from '../skills/skill-presence-service.js';
 import { planStatusLineInstall } from '../skills/statusline-settings-service.js';
 import { findProjectRoot } from '../config/config-safety.js';
+import { isValidSessionId } from '../workspace/sid-naming-guard.js';
 import { CLI_VERSION } from '../../shared/version.js';
 const CODEGRAPH_EXPECTED_VERSION = '0.7.10';
 const SKILL_PRESENCE_FRESHNESS_THRESHOLD_MS = 24 * 60 * 60 * 1000;
@@ -809,6 +810,101 @@ export async function runDoctor(options = {}) {
             message: `Failed to load doctor-report.schema.json for self-validation: ${getErrorMessage(error)}`
         });
     }
+    // Slice L3.2: project doctor MVP — 2 new diagnostic checks.
+    //   1. L3:l3-orphan-sessions — flags bare sids in .peaks/_runtime/ that
+    //      fail isValidSessionId. Reuses the Slice 0.5 sid-naming-guard.
+    //   2. L3:l3-memory-health — verifies .peaks/memory/index.json is
+    //      well-formed JSON with the expected schema_version field and
+    //      references real files on disk.
+    // Slice L3.2: project doctor MVP — 2 new diagnostic checks.
+    //   1. L3:l3-orphan-sessions — flags bare sids in .peaks/_runtime/ that
+    //      fail isValidSessionId. Reuses the Slice 0.5 sid-naming-guard.
+    //   2. L3:l3-memory-health — verifies .peaks/memory/index.json is
+    //      well-formed JSON with the expected schema_version field and
+    //      references real files on disk.
+    const l3ProjectRoot = findProjectRoot(process.cwd()) ?? process.cwd();
+    try {
+        const runtimeDir = join(l3ProjectRoot, '.peaks/_runtime');
+        if (existsSync(runtimeDir)) {
+            const entries = readdirSync(runtimeDir, { withFileTypes: true })
+                .filter((e) => e.isDirectory())
+                .map((e) => e.name);
+            const validSids = entries.filter((sid) => isValidSessionId(sid));
+            const invalidSids = entries.filter((sid) => !isValidSessionId(sid));
+            checks.push({
+                id: 'L3:l3-orphan-sessions',
+                ok: invalidSids.length === 0,
+                message: invalidSids.length === 0
+                    ? `All ${validSids.length} session(s) under .peaks/_runtime/ are valid (isValidSessionId)`
+                    : `${invalidSids.length} orphan session(s) under .peaks/_runtime/ fail isValidSessionId: ${invalidSids.slice(0, 5).join(', ')}${invalidSids.length > 5 ? '...' : ''}. Run \`peaks workspace clean --project <repo>\` to archive.`
+            });
+        }
+        else {
+            checks.push({
+                id: 'L3:l3-orphan-sessions',
+                ok: true,
+                message: 'No .peaks/_runtime/ directory; nothing to check.'
+            });
+        }
+    }
+    catch (error) {
+        checks.push({
+            id: 'L3:l3-orphan-sessions',
+            ok: true,
+            message: `L3:l3-orphan-sessions probe failed (${getErrorMessage(error)}); skipping check`
+        });
+    }
+    try {
+        const memoryIndexPath = join(l3ProjectRoot, '.peaks/memory/index.json');
+        if (existsSync(memoryIndexPath)) {
+            const raw = readFileSync(memoryIndexPath, 'utf8');
+            try {
+                const parsed = JSON.parse(raw);
+                if (parsed.schema_version === undefined) {
+                    checks.push({
+                        id: 'L3:l3-memory-health',
+                        ok: false,
+                        message: '.peaks/memory/index.json missing schema_version field'
+                    });
+                }
+                else if (!Array.isArray(parsed.entries)) {
+                    checks.push({
+                        id: 'L3:l3-memory-health',
+                        ok: false,
+                        message: '.peaks/memory/index.json entries is not an array'
+                    });
+                }
+                else {
+                    checks.push({
+                        id: 'L3:l3-memory-health',
+                        ok: true,
+                        message: `.peaks/memory/index.json is well-formed JSON; schema_version=${parsed.schema_version}; ${parsed.entries.length} memory entries`
+                    });
+                }
+            }
+            catch (parseError) {
+                checks.push({
+                    id: 'L3:l3-memory-health',
+                    ok: false,
+                    message: `.peaks/memory/index.json is not valid JSON: ${getErrorMessage(parseError)}`
+                });
+            }
+        }
+        else {
+            checks.push({
+                id: 'L3:l3-memory-health',
+                ok: true,
+                message: 'No .peaks/memory/index.json yet (no memories extracted)'
+            });
+        }
+    }
+    catch (error) {
+        checks.push({
+            id: 'L3:l3-memory-health',
+            ok: true,
+            message: `L3:l3-memory-health probe failed (${getErrorMessage(error)}); skipping check`
+        });
+    }
     const failed = checks.filter((check) => !check.ok).length;
     return {
         checks,

package/dist/src/services/ide/adapters/hermes-adapter.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Hermes IDE adapter (Slice #0.7) — peaks-cli 的第七个内置 IDE 适配器。
+ *
+ * 不可消除的 per-IDE 字段(slice #0.7 填表):
+ *   - settings.dirName = '.hermes'          : Hermes 项目根下的配置目录
+ *   - settings.settingsFileName = 'settings.json'
+ *   - envVar = 'HERMES_PROJECT_DIR'   : Hermes 注入的 env 变量(用于 ${...} 占位)
+ *   - hookEvent = 'PreToolUse'        : 现代 IDE 通用约定(UNVERIFIED — 待真实 Hermes 安装验证)
+ *   - toolMatcher = 'Bash'            : 同上(UNVERIFIED)
+ *
+ * Slice #0.7 状态:
+ *   - Slim adapter shape 跟 trae-adapter.ts / claude-code-adapter.ts 同型,
+ *     验证 slice #1 抽出的形状在第 7 个 IDE 上仍然可以"填表"接入。
+ *   - 4 UNVERIFIED fields (hookEvent, toolMatcher, envVar, dirName) 在
+ *     Hermes 真实安装可用前均为占位值;待真实 Hermes fixture 验证后
+ *     跟 trae-adapter 一样会被 VERIFIED 标记。
+ *   - 见 PRD §0.7 + memory trae-adapter-values-verified-against-1x.md
+ *     了解 UNVERIFIED → VERIFIED 的迁移路径。
+ */
+import type { IdeAdapter } from '../ide-types.js';
+export declare const HERMES_ADAPTER: IdeAdapter;

package/dist/src/services/ide/adapters/hermes-adapter.js

@@ -0,0 +1,51 @@
+/**
+ * Hermes IDE adapter (Slice #0.7) — peaks-cli 的第七个内置 IDE 适配器。
+ *
+ * 不可消除的 per-IDE 字段(slice #0.7 填表):
+ *   - settings.dirName = '.hermes'          : Hermes 项目根下的配置目录
+ *   - settings.settingsFileName = 'settings.json'
+ *   - envVar = 'HERMES_PROJECT_DIR'   : Hermes 注入的 env 变量(用于 ${...} 占位)
+ *   - hookEvent = 'PreToolUse'        : 现代 IDE 通用约定(UNVERIFIED — 待真实 Hermes 安装验证)
+ *   - toolMatcher = 'Bash'            : 同上(UNVERIFIED)
+ *
+ * Slice #0.7 状态:
+ *   - Slim adapter shape 跟 trae-adapter.ts / claude-code-adapter.ts 同型,
+ *     验证 slice #1 抽出的形状在第 7 个 IDE 上仍然可以"填表"接入。
+ *   - 4 UNVERIFIED fields (hookEvent, toolMatcher, envVar, dirName) 在
+ *     Hermes 真实安装可用前均为占位值;待真实 Hermes fixture 验证后
+ *     跟 trae-adapter 一样会被 VERIFIED 标记。
+ *   - 见 PRD §0.7 + memory trae-adapter-values-verified-against-1x.md
+ *     了解 UNVERIFIED → VERIFIED 的迁移路径。
+ */
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { traeSubAgentDispatcher } from '../../dispatch/sub-agent-dispatcher.js';
+export const HERMES_ADAPTER = {
+    id: 'hermes',
+    displayName: 'Hermes',
+    settings: {
+        dirName: '.hermes', // UNVERIFIED — placeholder; pending real Hermes 1.x fixture
+        settingsFileName: 'settings.json',
+        resolveSettingsFile: (scope, projectRoot) => {
+            const root = scope === 'global' ? homedir() : resolve(projectRoot ?? homedir());
+            return join(root, '.hermes', 'settings.json');
+        },
+        supportsScope: (scope) => scope === 'project' || scope === 'global'
+    },
+    envVar: 'HERMES_PROJECT_DIR', // UNVERIFIED
+    hookEvent: 'PreToolUse', // UNVERIFIED
+    toolMatcher: 'Bash', // UNVERIFIED
+    // Slice #0.7: Hermes sub-agent dispatcher UNVERIFIED — pending real Hermes
+    // dogfood. Reusing the Trae dispatcher as a uniform placeholder (byte-stable
+    // shape per slice #008; same rationale as Trae adapter).
+    subAgentDispatcher: traeSubAgentDispatcher,
+    // Slice #010 G9: Hermes PreToolUse is the assumed hook path. UNVERIFIED.
+    promptSizeAware: true,
+    installHints: [
+        'Restart Hermes (or reload the workspace) so the PreToolUse hooks take effect.'
+    ],
+    capabilities: {
+        gateEnforce: true,
+        statusline: true
+    }
+};

package/dist/src/services/ide/adapters/openclaw-adapter.d.ts

@@ -0,0 +1,14 @@
+/**
+ * OpenClaw IDE adapter (Slice #0.7) — peaks-cli 的第八个内置 IDE 适配器。
+ *
+ * 不可消除的 per-IDE 字段(slice #0.7 填表):
+ *   - settings.dirName = '.openclaw'        : OpenClaw 项目根下的配置目录
+ *   - settings.settingsFileName = 'settings.json'
+ *   - envVar = 'OPENCLAW_PROJECT_DIR' : OpenClaw 注入的 env 变量
+ *   - hookEvent = 'PreToolUse'        : 现代 IDE 通用约定(UNVERIFIED)
+ *   - toolMatcher = 'Bash'            : 同上(UNVERIFIED)
+ *
+ * Slice #0.7 状态: 同 hermes-adapter.ts 的 UNVERIFIED 占位说明。
+ */
+import type { IdeAdapter } from '../ide-types.js';
+export declare const OPENCLAW_ADAPTER: IdeAdapter;