peaks-loop 4.0.0-beta.8 → 4.0.0-beta.9

package/dist/services/session/caller-binding-service.js

@@ -0,0 +1,148 @@
+/**
+ * Caller-Binding Service (slice 020 — caller-keyed session binding).
+ *
+ * Each caller has its own on-disk binding file at
+ * `.peaks/_runtime/callers/<callerId>.json`. This service is the
+ * single read/write surface for that file. Legacy single-file bindings
+ * (`.peaks/_runtime/session.json` and `.peaks/.session.json`) remain
+ * readable for one minor release (M1 / M4); the read path falls back
+ * to them with a `legacy-fallback-used: true` flag.
+ *
+ * M2: legacy bindings resolve into a synthetic callerId of the form
+ * `legacy-<8hex-of-sha256(outerSessionId)>`, with `claudeSessionId`
+ * and `projectRoot` as fallback hash inputs. The synthetic id is
+ * permanent and recognisable by the `legacy-` prefix.
+ *
+ * See `.peaks/_runtime/2026-06-09-session-8bfe7d/prd/source/caller-id-contract.md`
+ * for the freeze-in contract.
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { dirname, join, resolve } from 'node:path';
+import { CALLER_ID_REGEX } from './caller-id-types.js';
+import { getSessionDir } from './getSessionDir.js';
+/**
+ * On-disk location of the per-caller binding file. P4 invariant:
+ * the `callers/<callerId>.json` lives at `.peaks/_runtime/callers/`,
+ * the same root as the per-peak session dirs.
+ */
+export function getCallerBindingFile(projectRoot, callerId) {
+    if (!CALLER_ID_REGEX.test(callerId)) {
+        // Defensive: a malformed callerId should never make it to disk.
+        // The caller is expected to validate via `resolveCallerId` first.
+        throw new Error(`getCallerBindingFile: invalid callerId "${callerId}"`);
+    }
+    return join(projectRoot, '.peaks', '_runtime', 'callers', `${callerId}.json`);
+}
+/**
+ * On-disk location of the per-(peak, caller) active-skill file. D6:
+ * one file per (peakSessionId, callerId) pair; two callers bound to
+ * the same peak session never clobber each other.
+ */
+export function getActiveSkillFileForCaller(projectRoot, peakSessionId, callerId) {
+    if (!CALLER_ID_REGEX.test(callerId)) {
+        throw new Error(`getActiveSkillFileForCaller: invalid callerId "${callerId}"`);
+    }
+    return join(getSessionDir(projectRoot, peakSessionId), `active-skill-${callerId}.json`);
+}
+/**
+ * Resolve a stable, deterministic callerId for a legacy single-file
+ * binding (M2). The hash input priority is:
+ *
+ *   1. `outerSessionId` (slice 018 stamped this on the per-peak
+ *      session.json for sessions created after the slice shipped).
+ *   2. `claudeSessionId` (legacy field name on pre-018 presence
+ *      files; honour the read side so v1.2.x data does not lose its
+ *      binding).
+ *   3. `projectRoot` (truly anonymous case: pre-018 sessions that
+ *      never recorded an outer / claude id).
+ *
+ * The synthetic id is `legacy-<first 8 hex chars of sha256(input)>`.
+ * 32 bits of entropy is enough for typical on-disk state
+ * (R1: <100 legacy peak sessions per project; the test asserts
+ * uniqueness across 1000 synthetic ids).
+ */
+export function synthesiseLegacyCallerId(input) {
+    const hash = createHash('sha256').update(input, 'utf8').digest('hex').slice(0, 8);
+    return `legacy-${hash}`;
+}
+/**
+ * Read a per-caller binding file. Returns `null` if the file does
+ * not exist, is malformed, or is for a different project (M1 back-compat
+ * read returns the legacy file but only after the per-caller file is
+ * absent).
+ */
+export function getCallerBinding(projectRoot, callerId) {
+    const bindingPath = getCallerBindingFile(projectRoot, callerId);
+    if (!existsSync(bindingPath)) {
+        return null;
+    }
+    try {
+        const raw = readFileSync(bindingPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.callerId !== 'string' || parsed.callerId !== callerId) {
+            return null;
+        }
+        if (typeof parsed.peakSessionId !== 'string' || parsed.peakSessionId.length === 0) {
+            return null;
+        }
+        if (typeof parsed.projectRoot !== 'string' || parsed.projectRoot.length === 0) {
+            return null;
+        }
+        return parsed;
+    }
+    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        return null;
+    }
+}
+/**
+ * Write or update a per-caller binding file. The caller is responsible
+ * for the binding object (callerId must match the file stem, peakSessionId
+ * must be a valid session id, projectRoot is canonicalized). Idempotent:
+ * re-writing the same callerId overwrites the file.
+ */
+export function setCallerBinding(projectRoot, callerId, binding) {
+    if (binding.callerId !== callerId) {
+        throw new Error(`setCallerBinding: binding.callerId "${binding.callerId}" does not match callerId "${callerId}"`);
+    }
+    const bindingPath = getCallerBindingFile(projectRoot, callerId);
+    const dir = dirname(bindingPath);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    const payload = {
+        ...binding,
+        projectRoot: resolve(binding.projectRoot)
+    };
+    writeFileSync(bindingPath, JSON.stringify(payload, null, 2), 'utf8');
+}
+/**
+ * Enumerate the per-caller binding files under
+ * `.peaks/_runtime/callers/`. Returns the parsed bindings plus the
+ * raw filenames (so callers can list orphan / legacy files without
+ * re-reading).
+ */
+export function listCallerBindings(projectRoot) {
+    const dir = join(projectRoot, '.peaks', '_runtime', 'callers');
+    if (!existsSync(dir))
+        return [];
+    let names;
+    try {
+        const entries = readdirSync(dir, { withFileTypes: true });
+        names = entries.filter((e) => e.isFile() && e.name.endsWith('.json')).map((e) => e.name);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of names) {
+        const callerId = name.replace(/\.json$/, '');
+        if (!CALLER_ID_REGEX.test(callerId))
+            continue;
+        const binding = getCallerBinding(projectRoot, callerId);
+        if (binding !== null) {
+            out.push(binding);
+        }
+    }
+    return out;
+}

package/dist/services/session/caller-id-types.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Caller-Id Resolution types (slice 020 — caller-keyed session binding).
+ *
+ * The single shared `.peaks/_runtime/session.json` and
+ * `.peaks/_runtime/active-skill.json` files are replaced with per-caller
+ * layouts: `.peaks/_runtime/callers/<callerId>.json` and
+ * `.peaks/_runtime/<peakSid>/active-skill-<callerId>.json`. The
+ * `callerId` is a generic identifier the calling platform declares
+ * itself (Claude Code via `CLAUDE_CODE_SESSION_ID`, future platforms
+ * via `PLATFORM_FALLBACKS`).
+ *
+ * See `.peaks/_runtime/2026-06-09-session-8bfe7d/prd/source/caller-id-contract.md`
+ * for the freeze-in contract (D1-D7 + M1-M5).
+ */
+export type CallerIdSource = 'flag' | 'env' | 'fallback' | 'none';
+/**
+ * On-disk shape of `.peaks/_runtime/callers/<callerId>.json`. One file
+ * per caller; two callers may point to the same `peakSessionId` (D6).
+ */
+export interface CallerBinding {
+    /** Echo of the filename stem; matches D1 regex. */
+    callerId: string;
+    /** The peak session this caller is bound to. */
+    peakSessionId: string;
+    /** Absolute path to the project root, canonicalized. */
+    projectRoot: string;
+    /** ISO 8601 timestamp; stamped at first write. */
+    createdAt: string;
+    /** ISO 8601 timestamp; bumped on every `peaks <cmd>` that touches the binding. */
+    lastActivityAt: string;
+    /** Last skill that touched this binding, e.g. "peaks-code". */
+    skill: string;
+    /** Last mode, e.g. "full-auto". */
+    mode: string;
+    /** Last gate, e.g. "startup". */
+    gate: string;
+}
+/**
+ * Per-(peakSessionId, callerId) presence record at
+ * `.peaks/_runtime/<peakSid>/active-skill-<callerId>.json`. Each caller
+ * has its own file (D6); two callers bound to the same peak session
+ * never clobber each other's presence.
+ */
+export interface CallerSkillPresence {
+    callerId: string;
+    skill: string;
+    mode?: string;
+    gate?: string;
+    setAt: string;
+    lastHeartbeat?: string;
+}
+/**
+ * D1 callerId regex: ASCII letters, digits, dot, underscore, hyphen;
+ * 1-200 chars. Excludes path separators (Windows: `\`, Unix: `/`),
+ * NUL, control chars, whitespace, all other Unicode — callerId is
+ * embedded in a file path and must be portable across Windows / macOS
+ * / Linux.
+ */
+export declare const CALLER_ID_REGEX: RegExp;
+/**
+ * Thrown by `resolveCallerId` for two cases:
+ *
+ *   - `code: 'EX_USAGE'` (exit 64, D2): no callerId available
+ *     anywhere (flag/env/fallback all empty).
+ *   - `code: 'EX_DATAERR'` (exit 65, D5): resolved callerId does not
+ *     match D1's regex.
+ *
+ * The `source` field tells the user where the bad id came from
+ * (`flag` / `env` / `fallback` / `none`) so the error message points
+ * at the right thing to fix.
+ */
+export declare class CallerIdError extends Error {
+    readonly code: 'EX_USAGE' | 'EX_DATAERR';
+    readonly source: CallerIdSource;
+    readonly value: string | undefined;
+    constructor(code: 'EX_USAGE' | 'EX_DATAERR', source: CallerIdSource, message: string, value?: string);
+}

package/dist/services/session/caller-id-types.js

@@ -0,0 +1,46 @@
+/**
+ * Caller-Id Resolution types (slice 020 — caller-keyed session binding).
+ *
+ * The single shared `.peaks/_runtime/session.json` and
+ * `.peaks/_runtime/active-skill.json` files are replaced with per-caller
+ * layouts: `.peaks/_runtime/callers/<callerId>.json` and
+ * `.peaks/_runtime/<peakSid>/active-skill-<callerId>.json`. The
+ * `callerId` is a generic identifier the calling platform declares
+ * itself (Claude Code via `CLAUDE_CODE_SESSION_ID`, future platforms
+ * via `PLATFORM_FALLBACKS`).
+ *
+ * See `.peaks/_runtime/2026-06-09-session-8bfe7d/prd/source/caller-id-contract.md`
+ * for the freeze-in contract (D1-D7 + M1-M5).
+ */
+/**
+ * D1 callerId regex: ASCII letters, digits, dot, underscore, hyphen;
+ * 1-200 chars. Excludes path separators (Windows: `\`, Unix: `/`),
+ * NUL, control chars, whitespace, all other Unicode — callerId is
+ * embedded in a file path and must be portable across Windows / macOS
+ * / Linux.
+ */
+export const CALLER_ID_REGEX = /^[a-zA-Z0-9._-]{1,200}$/;
+/**
+ * Thrown by `resolveCallerId` for two cases:
+ *
+ *   - `code: 'EX_USAGE'` (exit 64, D2): no callerId available
+ *     anywhere (flag/env/fallback all empty).
+ *   - `code: 'EX_DATAERR'` (exit 65, D5): resolved callerId does not
+ *     match D1's regex.
+ *
+ * The `source` field tells the user where the bad id came from
+ * (`flag` / `env` / `fallback` / `none`) so the error message points
+ * at the right thing to fix.
+ */
+export class CallerIdError extends Error {
+    code;
+    source;
+    value;
+    constructor(code, source, message, value) {
+        super(message);
+        this.name = 'CallerIdError';
+        this.code = code;
+        this.source = source;
+        this.value = value;
+    }
+}

package/dist/services/session/getSessionDir.d.ts

@@ -0,0 +1 @@
+export declare function getSessionDir(projectRoot: string, sessionId: string): string;

package/dist/services/session/getSessionDir.js

@@ -0,0 +1,27 @@
+/**
+ * Canonical session-directory resolver.
+ *
+ * As of slice 2026-06-05-peaks-runtime-layer the per-session workspace
+ * lives at `<root>/.peaks/_runtime/<sessionId>/` (NOT at the legacy
+ * `<root>/.peaks/_runtime/<sessionId>/` location). All **write** paths MUST route
+ * through this helper. The legacy top-level path is preserved as a
+ * back-compat **read** fallback only (see
+ * `src/services/artifacts/request-artifact-service.ts:662` etc.).
+ *
+ * The corresponding test in
+ * `tests/unit/services/session/session-dir-canonical.test.ts` enforces
+ * two invariants:
+ *
+ *   (a) `getSessionDir(root, sid)` returns `<root>/.peaks/_runtime/<sid>`.
+ *   (b) A static scan of `src/` flags any direct join of `.peaks` +
+ *       `sessionId` that does NOT route through this resolver. The
+ *       back-compat **read** sites are excluded by explicit allow-list.
+ *
+ * @param projectRoot - Absolute path to the project root.
+ * @param sessionId - The session identifier (e.g. `2026-06-06-session-5b1095`).
+ * @returns Absolute path to the canonical session directory.
+ */
+import { join } from 'node:path';
+export function getSessionDir(projectRoot, sessionId) {
+    return join(projectRoot, '.peaks', '_runtime', sessionId);
+}

package/dist/services/session/index.d.ts

@@ -0,0 +1,6 @@
+export { ensureSession, getSessionId, getCurrentSessionDir, listSessions, getSessionMeta, setSessionMeta, setSessionTitle, listSessionMetas, getProjectScanPath, hasProjectScan, setCurrentSessionBinding, rotateSessionBinding, type SessionInfo, type SessionMeta } from './session-manager.js';
+export { getSessionDir } from './getSessionDir.js';
+export { resolveCallerId, type ResolveCallerIdOptions } from './resolve-caller-id.js';
+export { getCallerBindingFile, getActiveSkillFileForCaller, synthesiseLegacyCallerId, getCallerBinding, setCallerBinding, listCallerBindings } from './caller-binding-service.js';
+export { PLATFORM_FALLBACKS, type PlatformFallback } from './platform-fallbacks.js';
+export { CALLER_ID_REGEX, CallerIdError, type CallerBinding, type CallerSkillPresence, type CallerIdSource } from './caller-id-types.js';

package/dist/services/session/index.js

@@ -0,0 +1,7 @@
+export { ensureSession, getSessionId, getCurrentSessionDir, listSessions, getSessionMeta, setSessionMeta, setSessionTitle, listSessionMetas, getProjectScanPath, hasProjectScan, setCurrentSessionBinding, rotateSessionBinding } from './session-manager.js';
+export { getSessionDir } from './getSessionDir.js';
+// Slice 020 — caller-keyed session binding. The new canonical path.
+export { resolveCallerId } from './resolve-caller-id.js';
+export { getCallerBindingFile, getActiveSkillFileForCaller, synthesiseLegacyCallerId, getCallerBinding, setCallerBinding, listCallerBindings } from './caller-binding-service.js';
+export { PLATFORM_FALLBACKS } from './platform-fallbacks.js';
+export { CALLER_ID_REGEX, CallerIdError } from './caller-id-types.js';

package/dist/services/session/platform-fallbacks.d.ts

@@ -0,0 +1,31 @@
+/**
+ * PLATFORM_FALLBACKS — the Level 3 fallback table for caller-id resolution.
+ *
+ * Slice 020 (D3): when neither `--caller-id` nor `PEAKS_CALLER_ID` is
+ * set, the resolver walks this table top-to-bottom and takes the
+ * first non-empty entry. Today there is exactly one entry: Claude
+ * Code (`CLAUDE_CODE_SESSION_ID`).
+ *
+ * To add a new platform (Cursor, Windsurf, peaks-ide, etc.):
+ *
+ *   1. Add a new entry below.
+ *   2. Bump the contract doc's A5 acceptance criterion
+ *      (`.peaks/_runtime/2026-06-09-session-8bfe7d/prd/source/caller-id-contract.md`).
+ *   3. Add a regression test that asserts the new entry resolves
+ *      correctly under D4 priority.
+ *
+ * The contract's A5 test (`tests/unit/services/session/caller-id-resolution.test.ts`)
+ * asserts `PLATFORM_FALLBACKS.length === 1`; adding a new entry will
+ * fail that test, forcing the contract bump.
+ *
+ * Adding an entry does NOT require code changes to read points
+ * (statusline, doctor, sc, session-info) — they all call the same
+ * resolver. Each entry is a one-line additive change.
+ */
+export interface PlatformFallback {
+    readonly envVar: string;
+    readonly description: string;
+    /** Semver this entry was added in (e.g. "1.3.7"). */
+    readonly addedIn: string;
+}
+export declare const PLATFORM_FALLBACKS: ReadonlyArray<PlatformFallback>;

package/dist/services/session/platform-fallbacks.js

@@ -0,0 +1,35 @@
+/**
+ * PLATFORM_FALLBACKS — the Level 3 fallback table for caller-id resolution.
+ *
+ * Slice 020 (D3): when neither `--caller-id` nor `PEAKS_CALLER_ID` is
+ * set, the resolver walks this table top-to-bottom and takes the
+ * first non-empty entry. Today there is exactly one entry: Claude
+ * Code (`CLAUDE_CODE_SESSION_ID`).
+ *
+ * To add a new platform (Cursor, Windsurf, peaks-ide, etc.):
+ *
+ *   1. Add a new entry below.
+ *   2. Bump the contract doc's A5 acceptance criterion
+ *      (`.peaks/_runtime/2026-06-09-session-8bfe7d/prd/source/caller-id-contract.md`).
+ *   3. Add a regression test that asserts the new entry resolves
+ *      correctly under D4 priority.
+ *
+ * The contract's A5 test (`tests/unit/services/session/caller-id-resolution.test.ts`)
+ * asserts `PLATFORM_FALLBACKS.length === 1`; adding a new entry will
+ * fail that test, forcing the contract bump.
+ *
+ * Adding an entry does NOT require code changes to read points
+ * (statusline, doctor, sc, session-info) — they all call the same
+ * resolver. Each entry is a one-line additive change.
+ */
+export const PLATFORM_FALLBACKS = [
+    {
+        envVar: 'CLAUDE_CODE_SESSION_ID',
+        description: 'Claude Code session id',
+        addedIn: '1.3.7'
+    }
+    // Future entries (do NOT add without bumping the contract's A5):
+    // { envVar: 'CURSOR_SESSION_ID', description: 'Cursor session id', addedIn: 'TBD' },
+    // { envVar: 'WINDSURF_SESSION_ID', description: 'Windsurf session id', addedIn: 'TBD' },
+    // { envVar: 'PEAKS_IDE_SESSION_ID', description: 'peaks-ide session id', addedIn: 'TBD' },
+];

package/dist/services/session/resolve-caller-id.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Caller-Id Resolution (slice 020 — caller-keyed session binding).
+ *
+ * `resolveCallerId` is the single source of truth for "who is calling
+ * the CLI". The resolver applies D4 priority (flag > env > platform
+ * fallback > reject) and validates the winner against D1's regex;
+ * failures throw `CallerIdError` (D2 → exit 64, D5 → exit 65).
+ *
+ * The function is synchronous and pure. It does NOT touch the
+ * filesystem, does NOT read any caller binding file, and does NOT
+ * mutate state. The caller (a CLI command, a service, a test) decides
+ * what to do with the resolved id.
+ *
+ * See `.peaks/_runtime/2026-06-09-session-8bfe7d/prd/source/caller-id-contract.md`
+ * for the freeze-in contract (D1-D7).
+ */
+import { CallerIdError } from './caller-id-types.js';
+export { CallerIdError };
+export interface ResolveCallerIdOptions {
+    /**
+     * The `--caller-id <id>` flag value (per-invocation override).
+     * D4 priority level 1: flag wins.
+     */
+    flagValue?: string;
+    /**
+     * Override for the `PEAKS_CALLER_ID` environment variable. D4
+     * priority level 2: env wins. Defaults to `process.env.PEAKS_CALLER_ID`.
+     * The override exists so tests can run without mutating process.env.
+     */
+    envOverride?: string;
+    /**
+     * The env object to read. Defaults to `process.env`. Exists so
+     * tests can drive Level 3 (platform fallback) without mutating
+     * process.env.
+     */
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Resolve the calling process's callerId per D1-D5.
+ *
+ * D4 priority (strict, no merge):
+ *   1. `opts.flagValue` (per-invocation `--caller-id <id>` override)
+ *   2. `opts.envOverride ?? process.env.PEAKS_CALLER_ID` (per-process declaration)
+ *   3. First non-empty entry in `PLATFORM_FALLBACKS` (platform default)
+ *   4. → **D2 fires**: throw `CallerIdError` (EX_USAGE, exit 64)
+ *
+ * On success: returns the resolved id (matches D1's regex, validated).
+ * On D2 (nothing set): throws `CallerIdError` (EX_USAGE, exit 64).
+ * On D5 (regex fail): throws `CallerIdError` (EX_DATAERR, exit 65).
+ *
+ * @example
+ *   resolveCallerId({ flagValue: 'foo-bar' })  // → 'foo-bar'
+ *   resolveCallerId({ envOverride: 'baz' })    // → 'baz'
+ *   resolveCallerId({ env: { CLAUDE_CODE_SESSION_ID: 'sid-123' } })  // → 'sid-123'
+ *   resolveCallerId()                          // → throws CallerIdError (EX_USAGE)
+ */
+export declare function resolveCallerId(opts?: ResolveCallerIdOptions): string;

package/dist/services/session/resolve-caller-id.js

@@ -0,0 +1,88 @@
+/**
+ * Caller-Id Resolution (slice 020 — caller-keyed session binding).
+ *
+ * `resolveCallerId` is the single source of truth for "who is calling
+ * the CLI". The resolver applies D4 priority (flag > env > platform
+ * fallback > reject) and validates the winner against D1's regex;
+ * failures throw `CallerIdError` (D2 → exit 64, D5 → exit 65).
+ *
+ * The function is synchronous and pure. It does NOT touch the
+ * filesystem, does NOT read any caller binding file, and does NOT
+ * mutate state. The caller (a CLI command, a service, a test) decides
+ * what to do with the resolved id.
+ *
+ * See `.peaks/_runtime/2026-06-09-session-8bfe7d/prd/source/caller-id-contract.md`
+ * for the freeze-in contract (D1-D7).
+ */
+import { CALLER_ID_REGEX, CallerIdError } from './caller-id-types.js';
+import { PLATFORM_FALLBACKS } from './platform-fallbacks.js';
+// Re-export for CLI consumers (avoids a second import line).
+export { CallerIdError };
+/**
+ * Check whether `value` looks like a callerId (non-empty, matches D1).
+ * Returns the trimmed value if so, undefined otherwise. Does not throw.
+ */
+function isNonEmpty(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/**
+ * Read a single platform-fallback env var from `env`. Returns the
+ * non-empty trimmed value or `undefined`. Logs nothing.
+ */
+function readPlatformFallback(env) {
+    for (let i = 0; i < PLATFORM_FALLBACKS.length; i++) {
+        const candidate = env[PLATFORM_FALLBACKS[i].envVar];
+        if (isNonEmpty(candidate)) {
+            return { value: candidate, index: i };
+        }
+    }
+    return undefined;
+}
+/**
+ * Validate `value` against D1's regex. Returns the value on success,
+ * throws `CallerIdError` (EX_DATAERR, exit 65) on failure.
+ */
+function validateCallerId(value, source) {
+    if (!CALLER_ID_REGEX.test(value)) {
+        throw new CallerIdError('EX_DATAERR', source, `Invalid caller id "${value}" (source: ${source}). callerId must match ^[a-zA-Z0-9._-]{1,200}$.`, value);
+    }
+    return value;
+}
+/**
+ * Resolve the calling process's callerId per D1-D5.
+ *
+ * D4 priority (strict, no merge):
+ *   1. `opts.flagValue` (per-invocation `--caller-id <id>` override)
+ *   2. `opts.envOverride ?? process.env.PEAKS_CALLER_ID` (per-process declaration)
+ *   3. First non-empty entry in `PLATFORM_FALLBACKS` (platform default)
+ *   4. → **D2 fires**: throw `CallerIdError` (EX_USAGE, exit 64)
+ *
+ * On success: returns the resolved id (matches D1's regex, validated).
+ * On D2 (nothing set): throws `CallerIdError` (EX_USAGE, exit 64).
+ * On D5 (regex fail): throws `CallerIdError` (EX_DATAERR, exit 65).
+ *
+ * @example
+ *   resolveCallerId({ flagValue: 'foo-bar' })  // → 'foo-bar'
+ *   resolveCallerId({ envOverride: 'baz' })    // → 'baz'
+ *   resolveCallerId({ env: { CLAUDE_CODE_SESSION_ID: 'sid-123' } })  // → 'sid-123'
+ *   resolveCallerId()                          // → throws CallerIdError (EX_USAGE)
+ */
+export function resolveCallerId(opts = {}) {
+    const env = opts.env ?? process.env;
+    // D4 level 1: flag value
+    if (isNonEmpty(opts.flagValue)) {
+        return validateCallerId(opts.flagValue, 'flag');
+    }
+    // D4 level 2: env var
+    const envValue = isNonEmpty(opts.envOverride) ? opts.envOverride : env.PEAKS_CALLER_ID;
+    if (isNonEmpty(envValue)) {
+        return validateCallerId(envValue, 'env');
+    }
+    // D4 level 3: PLATFORM_FALLBACKS table (top-to-bottom)
+    const fallback = readPlatformFallback(env);
+    if (fallback !== undefined) {
+        return validateCallerId(fallback.value, 'fallback');
+    }
+    // D4 level 4: D2 fires — no callerId available
+    throw new CallerIdError('EX_USAGE', 'none', 'No caller id available. Set PEAKS_CALLER_ID or pass --caller-id.');
+}

package/dist/services/session/session-binding-bridge.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Session × binding-store × outer-session bridge layer.
+ *
+ * v2.18.0: extracted from `session-manager.ts` to keep that file under
+ * the Karpathy 800 LOC cap while the binding-store D2 sub-slice work
+ * adds ~65 LOC over the next slice. The 4 blocks that moved here are
+ * the natural "bridge" concern: the lower-level session-manager
+ * primitives (read / write the project-level session binding, get /
+ * rotate, etc.) are wired up here into the user-facing `ensureSession`
+ * and the outer-session-aware `ensureSessionWithRotation`.
+ *
+ * `session-manager.ts` re-exports the two functions and the two result
+ * types so the 5 external callers (`request-artifact-service.ts`,
+ * `upgrade-commands.ts`, `init-command.ts`, plus 2 test files) do NOT
+ * need to change their import path. The re-export shim is the only
+ * added code in `session-manager.ts`.
+ *
+ * Body of every function moved verbatim per Karpathy #3 (Surgical
+ * Changes). No behavior change. The bridge adds nothing of its own.
+ */
+export type EnsureSessionOptions = {
+    /**
+     * When `true`, suppress the outer-session-mismatch auto-rotation.
+     * The caller wants today's "stamp the field, do not rotate" behaviour
+     * even when the outer session id has changed. Used by
+     * `peaks workspace init --no-rotate-on-outer-mismatch`.
+     */
+    skipRotateOnOuterMismatch?: boolean;
+};
+/**
+ * Result of `ensureSessionWithRotation`. When the bound session was
+ * rotated because the outer session id had changed, `previousSessionId`
+ * is the id of the unbound session and `rotationReason` is the structured
+ * reason code the CLI surfaces in its JSON envelope.
+ */
+export type EnsureSessionResult = {
+    sessionId: string;
+    previousSessionId: string | null;
+    rotationReason: 'outer-session-mismatch' | null;
+};
+export declare function ensureSession(projectRoot: string): Promise<string>;
+/**
+ * Outer-session-aware wrapper around `ensureSession`.
+ *
+ * Slice 018 (auto-roll on outer-mismatch). When the current outer
+ * session id (sourced from `PEAKS_OUTER_SESSION_ID` with
+ * `CLAUDE_CODE_SESSION_ID` as the Claude-Code fallback) differs from
+ * the outer session id recorded on the *bound* peaks session's
+ * `.peaks/_runtime/<sid>/session.json`, the project-level session
+ * binding is rotated before `ensureSession` is called. The old
+ * session dir is preserved on disk (data is never wiped) — only the
+ * binding changes — and the rotation is surfaced in the return value
+ * so the CLI can include it in the JSON envelope.
+ *
+ * Rotation is suppressed in three cases (all false-positive guards):
+ *
+ *   1. The current outer session id is undefined (no env var set) —
+ *      there is no signal to compare against, defaulting to "do not
+ *      rotate" avoids orphaning the session.
+ *   2. The bound session has no recorded `outerSessionId` (legacy
+ *      session predating the outer-session contract) — there is no
+ *      signal on the other side either.
+ *   3. The bound session's recorded outer session id matches the
+ *      current one (reconnect within the same Claude session) — this
+ *      is the common case, not a swap.
+ *
+ * When `options.skipRotateOnOuterMismatch === true`, the rotation
+ * check is short-circuited and the binding is preserved (opt-out for
+ * `peaks workspace init --no-rotate-on-outer-mismatch`). The wrapper
+ * still delegates to `ensureSession` so the caller gets the existing
+ * binding on a reconnect and a fresh id on a first run.
+ *
+ * Existing public surface is preserved: `ensureSession` is unchanged.
+ * This wrapper is the new entry point the CLI uses.
+ */
+export declare function ensureSessionWithRotation(projectRoot: string, options?: EnsureSessionOptions): Promise<EnsureSessionResult>;