peaks-loop 4.0.0-beta.3 → 4.0.0-beta.31

package/scripts/install-skills.mjs

@@ -172,21 +172,15 @@ function readPackageVersion(packageRoot = resolvePackageRoot()) {
 }
 
 function createConfigDefaults(packageRoot) {
-  return {
+return {
     version: readPackageVersion(packageRoot),
     currentWorkspace: null,
   workspaces: [],
   language: 'en',
-  model: 'sonnet',
   economyMode: true,
   swarmMode: true,
   tokens: {},
-  providers: {
-    minimax: {
-      model: 'minimax-2.7'
-    }
-  },
-    proxy: {}
+  proxy: {}
   };
 }
 
@@ -381,7 +375,7 @@ function resolveProjectRoot(options) {
  * overrides `PEAKS_CLAUDE_SKILLS_DIR` / `PEAKS_CLAUDE_OUTPUT_STYLES_DIR`
  * continue to work, and the legacy default is preserved.
  */
-const IDE_DETECTION_DIRS = [
+export const IDE_DETECTION_DIRS = [
   { id: 'claude-code', dir: '.claude' },
   { id: 'trae', dir: '.trae' },
   { id: 'trae-cn', dir: '.trae-cn' },
@@ -389,6 +383,7 @@ const IDE_DETECTION_DIRS = [
   { id: 'cursor', dir: '.cursor' },
   { id: 'qoder', dir: '.qoder' },
   { id: 'tongyi-lingma', dir: '.tongyi-lingma' },
+  { id: 'zcode', dir: '.zcode' },
 ];
 
 /**
@@ -404,7 +399,7 @@ const IDE_DETECTION_DIRS = [
  * directory was never populated. 2.0 fixes this by giving
  * all 8 platforms canonical install paths.
  */
-const IDE_SKILL_INSTALL_PROFILES = {
+export const IDE_SKILL_INSTALL_PROFILES = {
   'claude-code': {
     skillsDir: join(homedir(), '.claude', 'skills'),
     outputStylesDir: join(homedir(), '.claude', 'output-styles'),
@@ -469,6 +464,14 @@ const IDE_SKILL_INSTALL_PROFILES = {
     envVar: 'PEAKS_OPENCLAW_SKILLS_DIR',
     outputStylesEnvVar: 'PEAKS_OPENCLAW_OUTPUT_STYLES_DIR',
   },
+  'zcode': {
+    skillsDir: join(homedir(), '.zcode', 'skills'),
+    outputStylesDir: join(homedir(), '.zcode', 'output-styles'),
+    agentsDir: join(homedir(), '.zcode', 'agents'),
+    envVar: 'PEAKS_ZCODE_SKILLS_DIR',
+    outputStylesEnvVar: 'PEAKS_ZCODE_OUTPUT_STYLES_DIR',
+    agentsEnvVar: 'PEAKS_ZCODE_AGENTS_DIR',
+  },
 };
 
 function detectInstalledIdeId(projectRoot) {

package/scripts/sync-version.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 
 const packageJson = JSON.parse(readFileSync(resolve('package.json'), 'utf8'));
@@ -9,4 +9,72 @@ if (typeof version !== 'string' || version.length === 0) {
   throw new Error('package.json version must be a non-empty string');
 }
 
-writeFileSync(resolve('src/shared/version.ts'), `export const CLI_VERSION = ${JSON.stringify(version)};\n`);
+// Slice 3a — version.ts lives in the peaks-loop-shared workspace package.
+// The shared package is `private: true` and is consumed via workspace:*,
+// so its own package.json `version` field is irrelevant for downstream
+// consumers; we always emit the main peaks-loop version.
+writeFileSync(
+  resolve('packages/peaks-loop-shared/src/version.ts'),
+  `export const CLI_VERSION = ${JSON.stringify(version)};\n`,
+);
+
+// 2026-07-22 follow-up (post-monorepo recurrence): automatically bump
+// `peaks-loop-shared`'s own package.json version so the npm pack always
+// ships a fresh tarball. Pre-monorepo this never recurred because the
+// root was the only published artifact; in monorepo mode the shared
+// subpackage's tarball gets cached on the registry with stale CLI_VERSION
+// when only the root version changes, and `npm install` re-uses that
+// cached tarball because peaks-loop<ver>'s package.json still pins
+// `peaks-loop-shared@<old>`. Bumping the shared version forces a fresh
+// tarball upload. Read-modify-write on the shared package's package.json
+// only — the shared package is private, so its version field doesn't
+// appear in any consumer's package.json (the peaks-loop dependency
+// rewrite is still handled by the publish pack step).
+//
+// SAFETY: this auto-bump only runs when invoked from the publish
+// `build` step (i.e. on the CI runner producing a release). It does NOT
+// run for `pretest` / `predev` / `prepublish` / `pretest:coverage` —
+// otherwise a local dev loop would ratchet the shared version upward
+// by 0.0.1 every test run and the working tree would diverge from the
+// last git tag. The gate is `process.env.PEAKS_AUTO_BUMP_SHARED === '1'`.
+//
+// Skip the bump when the existing shared version is NOT a clean
+// x.y.z SemVer (some test fixtures use markers like `9.9.9-oldsub`).
+// In that case, leave the version alone and let the test that set
+// the marker continue to work.
+if (process.env.PEAKS_AUTO_BUMP_SHARED === '1') {
+  const sharedPkgPath = resolve('packages/peaks-loop-shared/package.json');
+  const sharedPkg = JSON.parse(readFileSync(sharedPkgPath, 'utf8'));
+  const sharedVersion = sharedPkg.version;
+  const sharedVersionMatch = /^(\d+)\.(\d+)\.(\d+)$/.exec(sharedVersion);
+  if (sharedVersionMatch) {
+    const nextSharedVersion = `${sharedVersionMatch[1]}.${sharedVersionMatch[2]}.${Number(sharedVersionMatch[3]) + 1}`;
+    sharedPkg.version = nextSharedVersion;
+    writeFileSync(sharedPkgPath, JSON.stringify(sharedPkg, null, 2) + '\n');
+    console.log(`[sync-version] bumped peaks-loop-shared ${sharedVersion} -> ${nextSharedVersion} (root ${version})`);
+  } else {
+    console.log(`[sync-version] peaks-loop-shared version "${sharedVersion}" is not x.y.z; skipping auto-bump`);
+  }
+} else {
+  console.log(`[sync-version] peaks-loop-shared auto-bump skipped (PEAKS_AUTO_BUMP_SHARED not set)`);
+}
+
+// 2026-07-22 follow-up (Bug-04 root-cause fix): the previous version of
+// this script wrote `version.ts` only, then handed off to `tsc`. Tsc's
+// incremental-build cache compares `version.ts` only by mtime + size —
+// and the freshly-written version.ts has the SAME size as before, so tsc
+// reported "no changes" and skipped emitting `dist/version.js`. The
+// pre-existing `dist/version.js` (from a prior build with an OLD CLI_VERSION)
+// was then re-packed by `release-pack.mjs` into the npm tarball, causing
+// downstream `peaks -v` to print the wrong version.
+//
+// Fix: invalidate the shared `dist/version.js` (and its .d.ts / .map) so a
+// subsequent `tsc -p tsconfig.json` on the shared subpackage has to regen it.
+// This is idempotent: if no dist yet exists, noop; if it exists, unlink.
+for (const ext of ['js', 'd.ts', 'd.ts.map']) {
+  const sharedDist = resolve('packages/peaks-loop-shared/dist/version.' + ext);
+  if (existsSync(sharedDist)) {
+    unlinkSync(sharedDist);
+  }
+}
+

package/skills/bee/peaks-perf-audit/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: peaks-perf-audit
+visibility: internal
 description: Independent performance audit skill. Reads the immutable peaks-prd handoff + the project-level perf-template.md, performs a 6-dimension perf audit, and writes a structured envelope to `.peaks/_runtime/<sessionId>/audit/perf-<rid>.md`. Decoupled from peaks-rd 5-way fan-out per slice v2.12.0 (Group A, Tier 3). Use when the slice introduces CPU-bound hot loops, I/O throughput changes, memory allocation patterns, concurrency model changes, bundle size deltas, or cold-start costs.
 metadata:
   appliesTo: peaks-loop v2.12.0+

package/skills/bee/peaks-prd/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "Feishu 文档 https://example.feishu.cn/wiki/PRODUCT_DOC_ID 是产品文档，需要登录。目标是 /Users/yuanyuan/Desktop/work/platform-rag-web 前端项目，请从文档提取可以交给 RD 实现、QA 复测的前端改动点。",
+    "expected": "先校验文档 URL 使用 https 且属于批准的 Feishu/Lark tenant 域名，再使用 headed gstack/browse/dist/browse 打开有头浏览器访问，遇到登录时等待用户完成并回复确认后再继续；登录后只提取产品实现逻辑、页面/路由/组件/状态/API contract/mock 假设/验收标准/联调问题，输出 .peaks/_runtime/<session-id>/prd/ 下的脱敏实现型 PRD handoff；不得保留登录 URL、cookie、headers、tokens、storage state、browser traces、raw browser/network state 或 PII/SSO/MFA 截图/日志。"
+  },
+  {
+    "id": 2,
+    "prompt": "产品文档业务背景很多，但用户明确只要落实到前端开发和 QA 验收，不要长篇业务叙述。当前没有 swagger.json，需要先 mock。",
+    "expected": "压缩业务背景，只输出待联调态 frontend delta、mock/API contract、后续 swagger 替换清单、QA 浏览器验收路径和阻塞问题。"
+  }
+]

package/skills/bee/peaks-qa/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "验证 /Users/yuanyuan/Desktop/work/platform-rag-web 的前端需求实现。后端 swagger.json 不存在，当前实现使用 mock/API contract。",
+    "expected": "QA 运行相关测试/API 或 mock contract 验证，启动前端应用，用 headed gstack/browse/dist/browse 有头浏览器做强制 E2E，遇到登录时等待用户完成并回复确认后再继续，记录脱敏 route/actions、脱敏 console/network 失败、脱敏截图或观察；不得保留登录 URL、cookie、headers、tokens、storage state、browser traces、PII/SSO/MFA 材料；生成 .peaks/_runtime/<session-id>/qa/validation-report.md，并包含安全和性能检查结果。"
+  },
+  {
+    "id": 2,
+    "prompt": "浏览器 E2E 中如果页面白屏、console 报错、网络 mock 失败、UI 有明显回归怎么办？",
+    "expected": "QA 必须带证据退回 RD 修复，不能通过 QA；修复后重新浏览器验证。"
+  }
+]

package/skills/bee/peaks-rd/SKILL.md

@@ -136,30 +136,20 @@ If any gate fails, return to development for fixes or hand off as blocked. Do no
 
 ## Parallel review fan-out (v2.12.0 3-way fanout — code-reviewer + qa-test-cases-writer + karpathy-reviewer)
 
-The THREE review activities run in parallel via `peaks sub-agent dispatch <role>`, not sequentially. Sub-agents: `code-reviewer`, `qa-test-cases-writer` (writes `qa/test-cases/<rid>.md`), `karpathy-reviewer` (the **hard Karpathy-Gate**). This is the v2.12.0 3-way fanout. Feature / refactor / bugfix: all three. Config / docs / chore: no fan-out — no `karpathy-reviewer` dispatched. OCR augmentation (B3): `peaksConfig.ocr.llm` → `peaks code-review run-ocr --json` → merge into `code-review.md`; → `references/ocr-integration.md`.
+**v2.12.0 collapse (Group A — Tier 1+2+3):** the previous 5-way fan-out (slice 004 4-way + slice 5/6 `karpathy-reviewer` addition) totalled **5 sub-agents**. The `security-reviewer` and `perf-baseline-reviewer` slots moved out of the RD 3-way fan-out into two new standalone audit skills:
 
-> **v2.12.0 collapse (Group A):** the 5-way fan-out moved `security-reviewer` + `perf-baseline-reviewer` into standalone audit skills (`peaks-security-audit` + `peaks-perf-audit`). → `references/v2-12-fanout-collapse.md`.
+- `peaks-security-audit` — CLI: `peaks security-audit run`. Writes `audit/security.md` (under `.peaks/_runtime/<sessionId>/audit/security.md`). Required RD-side prereq `AUDIT_SECURITY`.
+- `peaks-perf-audit` — CLI: `peaks perf-audit run`. Writes `audit/perf.md` (under `.peaks/_runtime/<sessionId>/audit/perf.md`). Required RD-side prereq `AUDIT_PERF`.
 
-> **v2.15.0+:** 技术决策 AI 据 prd 业务场景块自决,user 不参与;存量项目无 UT,改 A 前跑 `peaks impact scan`(G13);fork 场景 tech-doc 列上游基线+业务 patch 集(G11)。详见 `.peaks/memory/peaks-loop-user-role-and-tech-decision.md`。
+Both audit skills consume the immutable peaks-prd handoff (`prd/handoff.md`) and the project-scoped audit templates under `.peaks/project-scan/{security-template, perf-template, audit-output-schema}.md`. The handoff presence is enforced by the `AUDIT_REQUIRES_HANDOFF` prereq. The 1-minor-release back-compat window (v2.12.0) keeps the old `rd/security-review.md` and `rd/perf-baseline.md` paths readable via `mustContainAny` — see `references/rd-fanout-contracts.md` §"Deprecated reviewer back-compat".
 
-> **Slice 2026-06-24-efficiency-4p-bundle / G4 (P1.3) — karpathy-skip policy authoritative.** Decision table at `src/services/rd/reviewer-dispatch-policy.ts` (`shouldDispatchKarpathy`, `reviewerListFor`). Pinned by `tests/unit/rd/karpathy-skip-on-config-docs-chore.test.ts`.
+**Current 3-way fan-out** (always runs for feature / refactor / bugfix; no fan-out for config / docs / chore):
 
-### Hard Karpathy-Gate (Slice 5/6)
+1. `code-reviewer` — writes `rd/code-review.md` (Gate B3).
+2. `qa-test-cases-writer` — writes `qa/test-cases/<rid>.md` (Gate C2).
+3. `karpathy-reviewer` — writes `rd/karpathy-review.md` (the **hard Karpathy-Gate**, KARPATHY_REVIEW prereq).
 
-The `karpathy-reviewer` sub-agent is a **hard gate** for `rd:qa-handoff`. Per `andrej-karpathy-skills:karpathy-guidelines` §1 Think Before Coding ("state your assumptions") + §3 Surgical Changes ("touch only what the user asked"), `peaks request transition --state qa-handoff` is BLOCKED by the CLI gate until `.peaks/_runtime/<sessionId>/rd/karpathy-review.md` exists with the `## Karpathy-Gate` header and at least one of the 4 guideline section markers. The file is enforced by the `KARPATHY_REVIEW` prerequisite in `src/services/artifacts/artifact-prerequisites.ts` (added in Slice 5). The escape hatch is `peaks request transition --allow-incomplete --confirm` (assisted mode). The companion `peaks scan karpathy` CLI is a structural scanner for the same file (`src/services/scan/karpathy-service.ts`); the semantic review is the sub-agent's job.
-
-### Peaks-Loop Gate C — type-specific RD evidence
-
-The CLI gate at `rd:qa-handoff` is the authoritative check. Missing any required file → DO NOT attempt the qa-handoff transition; CLI will reject with `PREREQUISITES_MISSING`.
-
-| Request type | Required RD evidence |
-|---|---|
-| feature / refactor | `audit/security.md` + `audit/perf.md` + `rd/code-review.md` + `rd/karpathy-review.md` + `qa/test-cases/<rid>.md` + `prd/handoff.md` |
-| bugfix | `audit/security.md` + `audit/perf.md` (perf-shaped only) + `rd/code-review.md` + `rd/karpathy-review.md` + `qa/test-cases/<rid>.md` + `prd/handoff.md` |
-| config | `audit/security.md` |
-| docs / chore | (no extra evidence required) |
-
-→ see `references/rd-fanout-contracts.md` for the **3** sub-agents' contracts + hard prohibitions + aggregation + degradation. Pre-v2.12.0 `rd/{security-review,perf-baseline}.md` paths remain readable for the 1-minor-release back-compat window.
+Full dispatch contract (when-to-fan-out rules, dispatch template, prereq gates) lives in **`references/parallel-review-fanout.md`**. Read that file before issuing any 3-way fan-out.
 
 ## Refactor hard gates
 
@@ -185,7 +175,7 @@ Peaks-Loop PRD/RD/QA gates remain authoritative: OpenSpec structures the durable
 
 ## Mock data placement rules (BLOCKING — framework-aware)
 
-When the project-scan in `.peaks/_runtime/<sessionId>/rd/project-scan.md` identifies a frontend framework, mock data MUST follow the framework's built-in mock mechanism. **Never write mock data inline in component files.**
+When the project-scan in `.peaks/project-scan/project-scan.md` (project-level, git-tracked; slice 2026-07-15-project-scan-bootstrap) identifies a frontend framework, mock data MUST follow the framework's built-in mock mechanism. **Never write mock data inline in component files.**
 
 → see `references/mock-data-placement.md` for the framework-to-mock-directory mapping + hard rules + verification gate.
 

package/skills/bee/peaks-rd/references/library-version-awareness.md

@@ -2,12 +2,12 @@
 
 > Body of `## Library version awareness (3rd-party breaking-change gate)`. After `peaks scan libraries` lands the dependency list under `## Library versions` in `rd/project-scan.md`, RD MUST cross-check the slice's diff against `schemas/library-breaking-changes.data.json` before writing any 3rd-party API call. Concretely:
 
-1. **Read the project's `## Library versions` section** in `.peaks/_runtime/<sessionId>/rd/project-scan.md`. Identify the `name` + `major` of every dependency the slice imports from.
+1. **Read the project's `## Library versions` section** in `.peaks/project-scan/project-scan.md`. Identify the `name` + `major` of every dependency the slice imports from.
 2. **Open `schemas/library-breaking-changes.data.json`** (LLM reads via the `Read` tool). For each library where the installed `major` matches a `toMajor` in the table, load the corresponding `breakingChanges[]` list.
 3. **For each `import` statement in the slice's diff** (e.g. `import { Drawer } from 'antd'`), check whether the imported symbol or its prop signature matches any `breakingChanges[].api` entry for the library's installed major.
 4. **On a hit**:
    - **Warn the LLM in the slice's handoff**: in `.peaks/_runtime/<sessionId>/rd/requests/<rid>.md` under `## Implementation evidence`, append a one-line note per hit: `- [lib-version] <library> <installed version> imports <api>; breaking-change rule says use <replacement> instead.`
-   - **Persist a `lesson` memory** at the END of `.peaks/_runtime/<sessionId>/rd/project-scan.md` (or the tech-doc, or the handoff — any of these is read by future RD runs):
+   - **Persist a `lesson` memory** at the END of `.peaks/project-scan/project-scan.md` (or the tech-doc, or the handoff — any of these is read by future RD runs):
      ```
      <!-- peaks-memory:start -->
      title: <library> <installed major> requires <api> → <replacement>

package/skills/bee/peaks-rd/references/mock-data-placement.md

@@ -2,7 +2,7 @@
 
 > Body of `## Mock data placement rules` + `### Framework-to-mock-directory mapping` + `### Hard rules` + `### Verification gate`. **BLOCKING — framework-aware.**
 
-When the project-scan in `.peaks/_runtime/<sessionId>/rd/project-scan.md` identifies a frontend framework, mock data MUST follow the framework's built-in mock mechanism. **Never write mock data inline in component files.**
+When the project-scan in `.peaks/project-scan/project-scan.md` identifies a frontend framework, mock data MUST follow the framework's built-in mock mechanism. **Never write mock data inline in component files.**
 
 ## Framework-to-mock-directory mapping
 

package/skills/bee/peaks-rd/references/rd-runbook.md

@@ -29,11 +29,11 @@ peaks codegraph context --project <repo> "<task>"
 peaks codegraph affected --project <repo> <changed-files...> --json
 
 # 4.1 read project-scan from Code's pre-RD scan — BLOCKING if missing
-# **STOP if .peaks/_runtime/<sessionId>/rd/project-scan.md does not exist.**
+# **STOP if .peaks/project-scan/project-scan.md does not exist.**
 # **Do not write any code, do not plan any implementation, do not pass go.**
 # **Create the project-scan first, then proceed.**
 # NOTE: project-scan.md is a session-scoped singleton. Check if it already exists
-# before regenerating (e.g. via `ls .peaks/_runtime/<sessionId>/rd/project-scan.md`). If it exists
+# before regenerating (e.g. via `ls .peaks/project-scan/project-scan.md`). If it exists
 # and is complete (has `## Archetype` and `## Project mode` sections), reuse it.
 # Required sections in project-scan:
 #   - build tool and framework

package/skills/bee/peaks-rd/references/rd-transition-gates.md

@@ -19,8 +19,8 @@ You cannot declare a phase complete from memory. Each gate below is a `ls` or `g
 
 **Peaks-Loop Gate A — After project-scan read (before any implementation):**
 ```bash
-ls .peaks/_runtime/<sessionId>/rd/project-scan.md
-# Expected output: .peaks/_runtime/<sessionId>/rd/project-scan.md
+ls .peaks/project-scan/project-scan.md
+# Expected output: .peaks/project-scan/project-scan.md
 # "No such file" → STOP, create the project-scan first. Do not write code.
 ```
 

package/skills/bee/peaks-rd/references/writing-handoff-frontmatter.md

@@ -33,7 +33,7 @@ nextActions:
   - "peaks-qa reads this handoff and runs the regression matrix"
   - "If Gate C passes, transition to txt handoff"
 gateEvidence:
-  projectScan: .peaks/_runtime/<sessionId>/rd/project-scan.md
+  projectScan: .peaks/project-scan/project-scan.md
   prdHandoff: .peaks/_runtime/<sessionId>/prd/handoff.md
   codeReview: .peaks/_runtime/<sessionId>/rd/code-review.md
   securityReview: .peaks/_runtime/<sessionId>/rd/security-review.md

package/skills/bee/peaks-rd/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "根据 peaks-prd 产出的前端待联调 delta，在 /Users/yuanyuan/Desktop/work/platform-rag-web 中实现 UI/交互/API mock。项目没有后端 swagger.json，需要先用 mock/API contract 开发。",
+    "expected": "RD 先做 standards init/update dry-run 和项目扫描；非平凡变更检查 OpenSpec；按最小 slice 实现；新增/变更代码有单测或合理 focused coverage；前端/UI slice 自测必须用 headed gstack/browse/dist/browse 有头浏览器端到端验证并记录脱敏 route/actions、脱敏 console/network 观察和验收结果；完成 code review、安全 review、post-check dry-run 后才交给 QA；所有进入 .peaks/_runtime/<session-id>/rd/ 的浏览器证据必须脱敏，不得保留登录 URL、cookie、headers、tokens、storage state、browser traces、raw browser/network state 或 PII/SSO/MFA 截图/日志。"
+  },
+  {
+    "id": 2,
+    "prompt": "目标项目是存量前端项目，整体 UT 覆盖率可能不达标，但本次只要求新增和改动部分覆盖。",
+    "expected": "不能因历史低覆盖直接失败；必须要求新增/改动代码的 focused test/coverage 证据，缺失则阻塞 RD completion。"
+  }
+]

package/skills/bee/peaks-reviewer/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: peaks-reviewer
+visibility: internal
 description: Third-party independent code-review skill for Peaks. Use as a parallel reviewer to karpathy-reviewer when a workflow needs an out-of-band (non-RD-model) review pass to mitigate single-LLM self-dogfood blind spots. Emits a schema-validated ReviewerEnvelope (no free-form LLM JSON). v2.14.0 G4.
 ---
 

package/skills/bee/peaks-security-audit/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: peaks-security-audit
+visibility: internal
 description: Independent security audit skill. Reads the immutable peaks-prd handoff + the project-level security-template.md, performs an OWASP Top-10 + 8-dimension threat model audit, and writes a structured envelope to `.peaks/_runtime/<sessionId>/audit/security-<rid>.md`. Decoupled from peaks-rd 5-way fan-out per slice v2.12.0 (Group A, Tier 2). Use when the slice introduces authn/authz, secrets, input validation, path/filesystem trust, SQL/NoSQL injection, XSS/content injection, dependency supply chain, or external API surface changes.
 metadata:
   appliesTo: peaks-loop v2.12.0+

package/skills/bee/peaks-txt/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "本次 peaks-code 实战发现了 Feishu 登录、前端 mock 联调、浏览器可见 E2E 和本地 .peaks 产物的使用习惯，需要沉淀给后续 session。",
+    "expected": "Peaks TXT 在 .peaks/_runtime/<session-id>/txt/skill-usage-lessons.md 和 context-capsule.md 中记录规则、原因、影响技能、未来应用方式和是否适合 memory extraction，不保存 secrets、登录态、PII 或原始浏览器数据。"
+  },
+  {
+    "id": 2,
+    "prompt": "流程被打断，需要下个 session 接着做。",
+    "expected": "输出紧凑 capsule：模式、已验证决策、artifact paths、标准变更、开放问题、下一步，不复述完整日志。"
+  }
+]

package/skills/bee/peaks-ui/SKILL.md

@@ -138,7 +138,7 @@ peaks request show <request-id> --role prd --project <repo> --json   # read link
 # browser-launch substitute (it cannot launch a browser of its own).
 
 # 3. read project-scan for component library and CSS framework context
-#    check .peaks/_runtime/<session-id>/rd/project-scan.md (blocking if missing for existing projects)
+#    check .peaks/project-scan/project-scan.md (blocking if missing for existing projects)
 #    NOTE: project-scan.md is a session-scoped singleton — check before regenerating. Reuse if complete.
 
 # 4. PROTOTYPE FIDELITY CHECK (MANDATORY before any design work):
@@ -319,7 +319,7 @@ Every UI invocation touching user-visible behavior MUST produce a design-draft a
 8. **Anti-template checklist** — which generic patterns were rejected.
 
 **Component library awareness rules:**
-- Read `.peaks/_runtime/<session-id>/rd/project-scan.md` before proposing UI changes.
+- Read `.peaks/project-scan/project-scan.md` before proposing UI changes.
 - antd → `theme.token`, `className`/`styles` APIs; no TailwindCSS utilities on antd components.
 - MUI → `sx` prop, `styled()`, `theme`; no TailwindCSS utilities on MUI components.
 - shadcn/ui → TailwindCSS utility classes + existing shadcn variants (expected pattern).

package/skills/bee/peaks-ui/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "根据产品文档做前端页面迭代，要求全自动模式下设计不要模板化，要比普通 Tailwind/shadcn 默认页更好看。",
+    "expected": "Peaks UI 走 awesome-design-md + taste-skill/design-taste-frontend 的参考和品味链路，先定义风格方向、字体、色彩、动效、密度和交互状态，避免默认卡片栅格、居中 hero、AI 紫蓝渐变，并用浏览器可见检查迭代。"
+  },
+  {
+    "id": 2,
+    "prompt": "前端实现已经完成，但页面看起来像默认模板。",
+    "expected": "Peaks UI 产出 taste report，指出弱层级、模板感、交互状态缺失、响应式问题，并退回设计/RD 迭代后再 QA。"
+  }
+]