peaks-loop 4.0.16 → 4.0.18

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 4.0.18 — 2026-08-10 (statusline 24h overlay)
+
+**Bug fix — statusline doesn't reflect 24h mode substate after transition**:
+- `src/services/skills/skill-statusline-service.ts`: adds `read24hOverlay` helper (name-distinct from canonical `src/services/24h-mode/store.ts:108 read24hState` so the two readers with divergent null vs empty-snapshot semantics are not confused); adds `TwentyFourHourOverlay` type (minimal `{ state: string }`); adds `twentyFourHourState: TwentyFourHourOverlay | null` field to `StatusLineModel`; populates the field in all 5 return paths of `buildStatusLineModel` (lines for projectRoot-null, invalid-presence, idle, outer-mismatch idle, and final active/stale — only the active branch calls `read24hOverlay`).
+- `src/services/skills/skill-statusline-renderer.ts`: adds `format24hSuffix(overlay, palette, capability, noColor)` exported helper; extends `renderActive` signature to a 7th arg `twentyFourHourState`; appends `[24h-<state.toLowerCase()>]` suffix in 3 active-return branches (attention-gate / activeLeaf / normal); updates the call site at line 822.
+- 12 new vitest cases in `tests/unit/skills/skill-statusline-sid-only-marker.test.ts` (3 service-layer `read24hOverlay` + 1 `buildStatusLineModel` integration + 3 `format24hSuffix` helper-level + 4 renderer-integration AC-1..AC-4 + 1 malformed-shape hardening).
+- 5 typed-fixture sites updated to include `twentyFourHourState: null` (`tests/unit/services/skills/skill-statusline-renderer.test.ts` 5 factories + `tests/unit/skills/skill-statusline-sid-only-marker.test.ts` 3 directly-constructed literals).
+
+**Safety semantics preserved**:
+- v2.15.0 `presence:check-stale --project . --json` still returns `stale: true` on outer-mismatch. `skill-presence-service.ts` / `presence-lease-service.ts` / `workspace-service.ts` / `session/**` / `audit/**` / `src/services/24h-mode/**` / `src/cli/commands/session-24h-mode.ts` are FORBIDDEN files in this slice — zero edits.
+- No new dependencies. No enum/API/command-surface changes.
+
+**Migration**: zero changes required for existing users. Active 24h mode sessions automatically pick up the new `[24h-<state>]` suffix on next statusline render after the user runs `peaks session 24h-mode transition`. Sessions without a 24h-state.json file render unchanged (back-compat).
+
+## 4.0.17 — 2026-08-07 (Vitest worker cap + statusline SIGTERM + 9-slice shipped)
+
+**Core fix — vitest worker concurrency cap (root-cause)**:
+- `vitest.config.ts`: add `maxWorkers = floor(cpus/2)` + `PEAKS_VITEST_MAX_WORKERS` env override. Closes the 17 full-suite timeouts (root cause: 8.8× oversubscription on 16-core box; `testTimeout` measures wall clock so descheduled tests burn their 30s budget doing nothing). Validated: 3/3 AC-1 runs all 0 timeouts; wall 383.67s → 360.40s.
+- 6-case drift-guard test (`tests/unit/vitest-concurrency-guard.test.ts`) prevents future contributors from silently re-opening the defect.
+
+**Test stability**:
+- Statusline `r.signal` accepted as valid exit: closes 17/3 runs of `expected null to be 0` flakes under full-suite concurrency (24/24 in isolation, 7.5× faster after slice 7).
+- `peaks statusline --now <epoch-ms>` CLI option: test passes a pinned clock so the 10s completed-expiry window is deterministic across `--now` and lifecycle `updatedAt`.
+- `spawnSync` 10s ceiling + `mkdtempSync` cleanup in `auto-compact-orchestrator.test.ts`: closes latent hang risk + tmp root leak.
+
+**PRD-002b ESLint strictification**:
+- Slice 2 (`no-magic-numbers`): 917 → 192 violations (−725). 20 source files extracted 140+ inline magic numbers into named `const`s. 7 BDD tests; 31/31 lint tests PASS. Severity stays `warn` (D5 no-touch-stockcode).
+- Slice 5 (`no-explicit-any` pilot): 670 violations closed (667 phantom config-swap + 3 real narrowings). Rule essentially exhausted.
+- Slice 6 (`max-lines-per-function` pilot): dispatch-record-writer.ts 4 → 0 in target file.
+
+**Complexity refactor (slice 3 A+B+C+D + slice 4 bundle-reader rewrite)**:
+- 357 → 330 complexity violations (target ≤90; this wave covers ~7% of the high cohort).
+- A (`commit 72ef798c`): spec-service.ts + project-context.ts extract-method.
+- B (`1ac6e56d`): slice-decompose-service.ts findSCCs + partitionIntoBatches 7 helpers.
+- C (`0603754d`): spec-service parser table-dispatch + detectComponentLibrary 11-dispatch.
+- D (`923be824`): slice-decompose-service FSM (decomposeSlices/buildDependencyEdges/findCriticalPath/strongconnect → state machines).
+- Slice 4 (`6b27eb94`): bundle-reader.ts full rewrite, 5 violations → 1, public API preserved verbatim.
+
+**Caller-binding coverage extension (slice 9, `823be8c4`)**:
+- 14 BDD tests in `tests/unit/session/caller-binding-slice-9-edge-cases.test.ts` covering 5 gap categories: multi-tenant isolation, post-rotation recovery, TTL freshness, rotation hygiene, primary-wins contract.
+- `tests/unit/session/*`: 51 → 65 tests.
+
+**Mac auto-compact ESM anti-fake-green audit (slice 8, sediment-only)**:
+- 5/5 defenses verified present: `readClaudeTranscriptFallback` / `readClaudeStatuslinePercent` / `presence-marker-detector` / `post-compact-detector` / `step-08-gate`. ESM `require()` 0 hits.
+
+**Statusline 24-spawn amortization (slice 7, `44c42424`)**:
+- 24 real `node dist/cli/index.js` spawns → 1 `beforeAll` IPC server (JSON over stdio). Wall 216s → 29s (7.5× faster). 24/24 PASS.
+
+**Pre-publish gates all green**:
+- `gate-cli-version` ALIGNED (root 4.0.17 == shared CLI_VERSION 4.0.17).
+- `build-integrity: OK`.
+- 0 `Co-Authored-By` trailers (SquabbyZ sole-author rule 100%).
+
+**Total session**: 30 commits on main, ~$220 spent, 81 files modified. 9 follow-up slices closed in parallel via sub-agent dispatch.
+
 ## 4.0.16 — 2026-08-06 (ESLint JS/TS Gate + OCR 1.8.x multi-language reviewer + lint strictification)
 
 **8 NEW CLI capabilities** (PRD-002 + PRD-002b; 11 commits on main, 26 files, +1509/-960 LOC):

package/README-en.md

@@ -128,7 +128,7 @@ Every lane opens with **one slash command**.
 
 ---
 
-## Status · shipping 4.0.3 GA
+## Status · shipping 4.0.17
 
 <p align="center">
   <img src="./assets/readme/pulse.svg" alt="peaks-loop live metrics — 4 tiles + sparkline + pipeline progress" width="92%"/>
@@ -140,23 +140,26 @@ Every lane opens with **one slash command**.
 
 | | |
 | --- | --- |
-| **Latest** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — GA (2026-07-30) |
+| **Latest** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.17 (2026-08-07) |
 | **Domains** | Code (`peaks-code`) · Content (`peaks-content`) · Project health (`peaks-doctor`) · Issue sweep (`peaks-issue-fix-orchestrator`) · Custom SOP (`peaks-sop`) · Cross-domain primitives (`peaks-solo` dispatcher · `peaks-resume` · `peaks-status` · `peaks-test` · `peaks-slice-decompose`) |
 | **Sediment pool** | `~/.peaks/` local pool · twice-clean runs auto-promote to a bee · broken runs come back for you to redefine · the bee grows with your taste |
-| **Test suite** | 285+ cases · 4 packages (peaks-loop / peaks-loop-mut / peaks-loop-shared-channel / peaks-loop-shared) · ~80s full run |
+| **Test suite** | 285+ cases · 4 packages (peaks-loop / peaks-loop-mut / peaks-loop-shared-channel / peaks-loop-shared) · **0 timeouts** · 14 BDD caller-binding edge cases |
 | **IDE adapters** | ✅ Claude Code · ✅ Z Code · 🚧 Codex / Cursor / Trae / Tongyi Lingma / Hermes / OpenClaw / Qoder (adapters in progress — contributions welcome) |
 | **Runtime** | Node ≥ 20 |
 | **License** | MIT |
 
-### What 4.0.3 GA actually shipped (2026-07-30)
+### What 4.0.17 actually shipped (2026-08-07)
 
 | Epic | Solved | Verified by |
 | --- | --- | --- |
-| **Test suite rebuilt from scratch** | Old 559-file unit suite took 3+ hours; the 11-file / 161-case rebuild runs in ~80s, and combined with sub-package tests and later slices the workspace-wide total is 285+ cases across 4 packages. Deleted old assertions, wrote against the production contract, 4-dim split (render/behavior/integration/a11y). | commits `f17aa377` → `1d6233bc` · `.peaks/memory/2026-07-30-test-rebuild-epic-sediment.md` |
-| **Karpathy evaluation cost self-review** | LLM no longer "done for today, will continue tomorrow" after 1–2 slices — `karpathy-reviewer` reports `costRatio`; `peaks job karpathy-cost-check` auto-downgrades `block` → `warn` above 10. 24h-mode stays the override. | `peaks job karpathy-cost-check --review-file <path>` · 21-case unit test |
-| **Compact visibility** | `peaks compact history` for the LLM to read every compact event of the current session; `peaks statusline compact` for the IDE statusline (`--` / `compact pending (0.85)` / `REDLINE 0.95` / `just compacted (0.92→?)`). | `auto-compact-orchestrator` appends to `compact-history.jsonl` · 19-case unit test |
-| **Sub-package coverage + workspace-wide `pnpm test:full`** | Independent 4-dim tests for `peaks-loop-mut` / `peaks-loop-shared-channel`; `peaks-loop-shared` 0 file (`passWithNoTests`); redundant root mirror removed. | commits `593ffcdf` → `08e92d8f` · `pnpm test:full` runs all 4 packages in one go |
-| **CLI surface collapsed (73 → 5 super-commands)** | Five super-commands (`peaks code / audit / doctor / openspec / release / release-pack`) replace 73 leaf commands, byte-identical contract preserved, opaque to downstream callers. | rid-009 · 26 routing tests |
+| **Vitest worker cap (root-cause fix)** | 17 timeouts blocked the full suite; the root cause was `pool: 'forks' + fileParallelism: true` with no `maxWorkers` cap. On a 16-core box, ~15 fork workers + 2 files spawning real `node` processes = 8.8× oversubscription. `testTimeout` measures wall clock, so descheduled tests burned 30s doing nothing. Fix: `maxWorkers = floor(cpus/2)` + `PEAKS_VITEST_MAX_WORKERS` env override + 6-case drift-guard test. **17 timeouts → 0, wall 383.67s → 360.40s, 3/3 AC-1 runs all 0 timeouts.** | commit `ace1a03d` + guard test `tests/unit/vitest-concurrency-guard.test.ts` |
+| **PRD-002b ESLint strictification (`no-magic-numbers`)** | Slice 2 dropped 917 → 192 violations (−725). 20 source files extracted 140+ inline magic numbers into named `const`s. `no-magic-numbers` config got `ignore: [-1, 0, 1, 2, 100, 1000]` + `ignoreArrayIndexes / ignoreDefaultValues`. 7 BDD tests, 31/31 lint tests PASS. Severity stayed `warn` (D5 no-touch-stockcode). | commits `d5ef17c1` + `0c3187c4` + 7 BDD tests |
+| **Statusline `--now` injection + 24-spawn amortization** | Slice 1 root cause: the test wrote `updatedAt = new Date().toISOString()` (just-NOW) and expected the lifecycle to be "within 10s window", but under full-suite concurrency the spawned subprocess is descheduled and only executes several seconds later — the completed-expiry window ages out → C1 baseline fallback → `expected '' to contain '[████████]'`. Fix: add `--now <ms>` CLI option; test pins `TEST_NOW_MS` shared by both CLI and lifecycle. **Slice 7** went further: replaced 24 real `node dist/cli/index.js` spawns with a single `beforeAll` IPC server (JSON over stdio). Wall 216s → 29s (7.5× speedup), 24/24 PASS. | commit `3d6e4bc9` (slice 1 inside) + `44c42424` (slice 7) |
+| **Complexity refactor (slice 3 A+B+C+D + slice 4 bundle-reader rewrite)** | Slice 3 four-stage refactor dropped 357 → 330 complexity violations (target ≤90, this wave covers the high cohort): spec-service parser → table-dispatch, slice-decompose → FSM, project-context `detectComponentLibrary` → 11-dispatch table. **Slice 4** = bundle-reader full rewrite, 5 violations → 1, public API preserved verbatim. | commits `72ef798c` + `31160051` + `1ac6e56d` + `923be824` + `0603754d` + `6b27eb94` |
+| **Type-narrowing + max-lines pilot (slice 5+6)** | Slice 5 closed 670 violations: 667 phantom `no-explicit-any` config swap (broken ruleId fix, same pattern as the no-duplicate-imports 4.0.16 fix) + 3 real narrowings (`catch (error: any)` → `unknown` + `instanceof Error`). Slice 6 split 4 over-length functions in `dispatch-record-writer.ts`, 4 → 0 in target file. Both slices prove the rules are essentially exhausted — true count is an order of magnitude smaller than the sediment claimed. | commits `fbb43e9e` + `3d6e4bc9` (inside) |
+| **Mac auto-compact ESM anti-fake-green: 5/5 verified** | Slice 8 audit-only: 5 defenses (`readClaudeTranscriptFallback` / `readClaudeStatuslinePercent` / `presence-marker-detector` / `post-compact-detector` / `step-08-gate`) all in place, ESM `require()` 0 hits, legacy silent-catch blocks already explicit re-throw `ReferenceError` / `SyntaxError`. | sediment `.peaks/memory/2026-08-07-mac-esm-defense-audit.md` |
+| **Caller-binding coverage extension (slice 9)** | 14 BDD tests covering 5 gap categories: multi-tenant isolation / post-rotation recovery / TTL freshness / rotation hygiene / primary-wins contract. `tests/unit/session/*` grew from 51 → 65 tests. | commit `823be8c4` + new file `tests/unit/session/caller-binding-slice-9-edge-cases.test.ts` |
+| **Pre-publish gates all green** | `gate-cli-version` ALIGNED (root 4.0.17 == shared CLI_VERSION 4.0.17), `build-integrity: OK`, 0 `Co-Authored-By` trailers. | per `peaks-loop-publishing-critical-hard-rules` recipe |
 
 ---
 

package/README.md

@@ -128,7 +128,7 @@ npm i -g peaks-loop
 
 ---
 
-## 当前状态 · 4.0.3 GA
+## 当前状态 · 4.0.17
 
 <p align="center">
   <img src="./assets/readme/pulse.svg" alt="peaks-loop live metrics — 4 tiles + sparkline + pipeline progress" width="92%"/>
@@ -140,15 +140,26 @@ npm i -g peaks-loop
 
 | | |
 | --- | --- |
-| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — GA(2026-07-30) |
+| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.17(2026-08-07) |
 | **覆盖域** | 代码(`peaks-code`) · 内容(`peaks-content`) · 项目健康(`peaks-doctor`) · 批量修 issue(`peaks-issue-fix-orchestrator`) · 自定义 SOP(`peaks-sop`) · 通用原语(`peaks-solo` 分诊 / `peaks-resume` 续 / `peaks-status` 看 / `peaks-test` 测 / `peaks-slice-decompose` 切片) |
 | **沉淀池** | `~/.peaks/` 本地池 · 跑两次自动晋升成 bee · 跑翻车让你重定义 · bee 跟着你的口味长 |
-| **测试套件** | 285+ cases · 4 packages (peaks-loop / peaks-loop-mut / peaks-loop-shared-channel / peaks-loop-shared) · 80s 全量 |
+| **测试套件** | 285+ cases · 4 packages (peaks-loop / peaks-loop-mut / peaks-loop-shared-channel / peaks-loop-shared) · 0 timeouts · 14 BDD caller-binding coverage |
 | **适配 IDE** | ✅ Claude Code · ✅ Z Code · 🚧 Codex / Cursor / Trae / Tongyi Lingma / Hermes / OpenClaw / Qoder(适配中,欢迎共建) |
 | **依赖运行时** | Node ≥ 20 |
 | **License** | MIT |
 
-### 4.0.3 GA 这一波实打实修了什么(2026-07-30)
+### 4.0.17 这一波实打实修了什么(2026-08-07)
+
+| Epic | 解决的事 | 怎么验 |
+| --- | --- | --- |
+| **Vitest worker cap(根因修)** | 完整套件 17 个 timeout 卡 30s;根因不是 bug,是 `pool:'forks'+fileParallelism:true` 没设 `maxWorkers`,16 核机器起 15 个 fork + 2 文件真实 `node` spawn = 8.8× 过载。`testTimeout` 算 wall clock,被 descheduled 的测试烧 30s 啥都不干。修 = `maxWorkers = floor(cpus/2)` + `PEAKS_VITEST_MAX_WORKERS` env override + 6-case drift guard。**17 timeout → 0,wall 383.67s → 360.40s,3/3 AC-1 runs 全 0 timeout。** | commit `ace1a03d` + guard test `tests/unit/vitest-concurrency-guard.test.ts` |
+| **PRD-002b ESLint 严格化(no-magic-numbers)** | 切片 2 关闭 917 → 192 violations(-725);20 source files 把 140+ inline magic numbers 抽出成 named consts;`no-magic-numbers` 配置加 `ignore: [-1,0,1,2,100,1000]` + `ignoreArrayIndexes/ignoreDefaultValues`;7 BDD tests,31/31 lint tests PASS。Severity 保持 `warn` 不变(D5 no-touch-stockcode)。 | commits `d5ef17c1` + `0c3187c4` + 7 BDD tests |
+| **Statusline `--now` 注入 + 24 spawns amortization** | 切片 1 根因 = test 用 `new Date().toISOString()` 写 lifecycle `updatedAt`,full-suite 并发下 subprocess 被 deschedule 几秒后才执行,10s 窗口过期 → C1 baseline fallback → 期望 `[████████]` 失败。修 = CLI 加 `--now <ms>`,test 共享 `TEST_NOW_MS` 锚定。**切片 7** 进一步把 24 个真实 `node dist/cli/index.js` spawn 换成 1 个 `beforeAll` IPC server,wall 216s → 29s(7.5× 加速),24/24 PASS。 | commit `3d6e4bc9` (含切片 1) + `44c42424` (切片 7) |
+| **Complexity refactor(切片 3 A+B+C+D + 切片 4 bundle-reader rewrite)** | 切片 3 四阶段 refactor 关闭 357 → 330 complexity violations(goal ≤90,本波覆盖 ~7% 的高 cohort):spec-service parser 走 table-dispatch、slice-decompose FSM、project-context detectComponentLibrary 11 探测 dispatch;**切片 4** = bundle-reader full rewrite,5 violations → 1,public API preserved verbatim。 | commits `72ef798c` + `31160051` + `1ac6e56d` + `923be824` + `0603754d` + `6b27eb94` |
+| **Type narrowing + max-lines 试点(切片 5+6)** | 切片 5 关 670 violations:667 phantom `no-explicit-any` config swap(ruleId 修复,类似 no-duplicate-imports 老坑)+ 3 real narrowing(`catch (error: any)` → `unknown` + `instanceof Error`)。切片 6 切 dispatch-record-writer.ts 4 个超长函数,4 → 0 in target file。两 slice 都证明 rule essentially exhausted 真比 memory 标注小一个数量级。 | commits `fbb43e9e` + `3d6e4bc9` (含) |
+| **Mac auto-compact ESM 防 fake-green 5/5 验证** | 切片 8 audit-only:5 个 defenses (`readClaudeTranscriptFallback` / `readClaudeStatuslinePercent` / `presence-marker-detector` / `post-compact-detector` / `step-08-gate`) 全部 in-place,ESM `require()` 0 hits,legacy silent-catch blocks 已 explicit re-throw `ReferenceError` / `SyntaxError`。 | sediment `.peaks/memory/2026-08-07-mac-esm-defense-audit.md` |
+| **Caller-binding 覆盖扩展(切片 9)** | 14 BDD tests 覆盖 5 gap categories:multi-tenant 隔离 / rotation 后 recovery / TTL freshness / rotation hygiene / primary-wins contract。`tests/unit/session/*` 从 51 → 65 tests。 | commit `823be8c4` + new file `tests/unit/session/caller-binding-slice-9-edge-cases.test.ts` |
+| **Pre-publish 验证全过** | gate-cli-version ALIGNED(root 4.0.17 == shared CLI_VERSION 4.0.17),build-integrity OK,0 Co-Authored-By trailers。 | per `peaks-loop-publishing-critical-hard-rules` recipe |
 
 | Epic | 解决的事 | 怎么验 |
 | --- | --- | --- |

package/config/eslint/.peaks-rules.cjs

@@ -8,8 +8,12 @@
  *
  *   - eslint:recommended
  *   - plugin:@typescript-eslint/recommended-type-checked
- *   - plugin:import/recommended
- *   - plugin:import/typescript
+ *
+ * Note: plugin:import/* extends were removed during the 4.0.16 lint
+ * dogfood because (a) npm 10.9.4 + npx silently fails the fourth
+ * `--package` flag on Windows and (b) eslint-plugin-import@2.32.0
+ * peer-rejects eslint 10. Duplicate-import warnings are re-expressed
+ * through ESLint built-in `no-duplicate-imports` below (PRD-002b 2026-08-07).
  *
  * Framework-specific rules (eslint-plugin-react, eslint-plugin-vue,
  * eslint-plugin-svelte, eslint-plugin-nestjs, etc.) are LAYER 3 and
@@ -33,30 +37,21 @@ module.exports = {
     ecmaVersion: 2022,
     sourceType: 'module',
     project: ['./tsconfig.json', './tsconfig.build.json'],
-    tsconfigRootDir: __dirname + '/..'
+    // 2026-08-06 lint-dogfood cycle-3 follow-up: the runner now uses
+    // `node node_modules/eslint/bin/eslint.js` from the repo root, so
+    // tsconfigRootDir must be the repo root (one level above config/).
+    tsconfigRootDir: __dirname + '/../..'
   },
   env: {
     node: true,
     es2022: true
   },
-  plugins: ['@typescript-eslint', 'import'],
+  plugins: ['@typescript-eslint'],
   extends: [
     'eslint:recommended',
-    'plugin:@typescript-eslint/recommended-type-checked',
-    'plugin:import/recommended',
-    'plugin:import/typescript'
+    'plugin:@typescript-eslint/recommended-type-checked'
   ],
-  settings: {
-    'import/resolver': {
-      typescript: {
-        alwaysTryTypes: true,
-        project: ['./tsconfig.json', './tsconfig.build.json']
-      },
-      node: {
-        extensions: ['.js', '.ts', '.tsx', '.jsx']
-      }
-    }
-  },
+  settings: {},
   ignorePatterns: [
     'node_modules/',
     'dist/',
@@ -83,11 +78,30 @@ module.exports = {
       { max: 50, skipComments: true, skipBlankLines: true }
     ],
     'max-params': ['warn', { max: 4 }],
+    // PRD-002b slice 2 — config tune for no-magic-numbers (commit A).
+    // --fix is a no-op: node_modules/eslint/lib/rules/no-magic-numbers.js
+    // has no `fixable` field on its meta (verified 2026-08-07). Severity
+    // stays `warn` per D5 no-touch-stockcode invariant.
+    // eslint 8.57.1 schema (verified): accept only `ignore`, `ignoreArrayIndexes`,
+    // `ignoreDefaultValues`, `detectObjects`, `enforceConst`,
+    // `ignoreClassFieldInitialValues`. The newer options (`ignoreEnums`,
+    // `ignoreNumericLiterals`, `ignoreReadonlyClassProperties`) are eslint 9.x
+    // only — schema rejects them with `additionalProperties: false`.
     'no-magic-numbers': [
       'warn',
-      { ignore: [0, 1, -1, 100, 1000] }
+      {
+        ignore: [-1, 0, 1, 2, 100, 1000],
+        ignoreArrayIndexes: true,
+        ignoreDefaultValues: true
+      }
     ],
-    'no-explicit-any': 'warn',
+    // PRD-002b slice 5 pilot — switch phantom ruleId `no-explicit-any`
+    // (bare built-in name, fires "Definition for rule ... was not found"
+    // against plugin:@typescript-eslint/recommended-type-checked) to the
+    // canonical `@typescript-eslint/no-explicit-any`. Drops ~667 phantom
+    // entries from `peaks lint check` output and exposes only real
+    // explicit `any` annotations. Severity stays `warn` (D5).
+    '@typescript-eslint/no-explicit-any': 'warn',
     'prefer-const': 'warn',
     'no-var': 'error',
     eqeqeq: ['warn', 'always', { null: 'ignore' }],
@@ -109,12 +123,11 @@ module.exports = {
       }
     ],
 
-    // L2 (eslint-plugin-import) — boundary hygiene.
-    'import/no-duplicates': 'warn',
-    'import/no-unresolved': 'off',
-    'import/named': 'off',
-    'import/default': 'off',
-    'import/namespace': 'off'
+    // L2 (boundary hygiene that previously lived under eslint-plugin-import).
+    // Use ESLint built-in `no-duplicate-imports` — `@typescript-eslint/no-duplicate-imports`
+    // does NOT exist in @typescript-eslint/eslint-plugin@8.66.0 (broken ruleId, all 820
+    // phantom entries were `Definition for rule ... was not found`). PRD-002b 2026-08-07.
+    'no-duplicate-imports': 'warn'
   },
   overrides: [
     {

package/dist/cli/commands/_register.js

@@ -6,6 +6,7 @@ import { registerBaselineCommands } from './baseline-commands.js';
 import { registerBeeCommands } from './bee-commands.js';
 import { registerCapabilityWorkerConfigAndSCCommands } from './capability-worker-config-sc-commands.js';
 import { registerCodeCommands } from './code-commands.js';
+import { registerCodeGateCommand } from './code-gate-command.js';
 import { registerDashboardCommands } from './dashboard-commands.js';
 import { registerCodeReviewCommands } from './code-review-commands.js';
 import { registerCodegraphCommands } from './codegraph-commands.js';
@@ -120,7 +121,7 @@ const REGISTRATIONS = [
     ['security-audit-commands', registerSecurityAuditCommands], ['perf-audit-commands', registerPerfAuditCommands],
     ['verdict-aggregate-command', registerVerdictAggregateCommands], ['log-commands', registerLogCommands],
     ['qa-commands', registerQaCommands], ['test-commands', registerTestCommands],
-    ['playwright-commands', registerPlaywrightCommands], ['code-commands', registerCodeCommands], ['dashboard-commands', registerDashboardCommands],
+    ['playwright-commands', registerPlaywrightCommands], ['code-commands', registerCodeCommands], ['code-gate-command', registerCodeGateCommand], ['dashboard-commands', registerDashboardCommands],
     ['mut-commands', registerMutCommands], ['fixture-commands', registerFixtureCommands],
     ['reviewer-commands', registerReviewerCommands], ['ide-commands', registerIdeCommands],
     ['observability-commands', registerObservabilityCommands], ['compact-command', registerCompactCommands],

package/dist/cli/commands/audit-commands.d.ts

@@ -11,7 +11,7 @@ import { Command } from 'commander';
 import { type AgentShieldState } from '../../services/audit/static-service.js';
 import { type ProgramIO } from '../cli-helpers.js';
 import type { RedLineAudit } from '../../services/audit/types.js';
-import type { AuditDecisionRecord } from '../../services/audit/decision-writer.js';
+import { type AuditDecisionRecord } from '../../services/audit/decision-writer.js';
 export interface AuditGoalData {
     readonly status: 'scaffold-only';
     readonly serviceWired: true;

package/dist/cli/commands/code-gate-command.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Slice 2026-08-06-codegate-vendor-neutral — `peaks code-gate` CLI command.
+ *
+ * Vendor-neutral PreToolUse hook entry. Reads the standard hook JSON
+ * payload from stdin (`{tool, input}` shape) and either exits 0
+ * (allow) or exits 2 with stderr containing
+ * PEAKS_CODE_PROHIBITED_DIRECT_EDIT (deny).
+ *
+ * This command is the runtime adapter for the shell-script sibling
+ * (`src/services/hooks/pre-tool-code-gate.sh`). Both share the same
+ * path-family decision; the CLI invokes the same pure decision
+ * function (`decideGateAction`) the shell script encodes.
+ *
+ * Settings.json entry shape (vendor-neutral, registered by
+ * `peaks hooks install`):
+ *   { matcher: "Edit|Write|MultiEdit", hooks: [{ type: "command", command: "peaks code-gate --json" }] }
+ *
+ * The vendor-specific install code (`src/cli/commands/hooks-commands.ts`
+ * + `src/services/ide/adapters/*`) is the only place that knows how
+ * to render this into any IDE's settings.json shape. This file is
+ * vendor-neutral — no vendor references in the source code itself.
+ */
+import type { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerCodeGateCommand(program: Command, io: ProgramIO): void;

package/dist/cli/commands/code-gate-command.js

@@ -0,0 +1,86 @@
+/**
+ * Slice 2026-08-06-codegate-vendor-neutral — `peaks code-gate` CLI command.
+ *
+ * Vendor-neutral PreToolUse hook entry. Reads the standard hook JSON
+ * payload from stdin (`{tool, input}` shape) and either exits 0
+ * (allow) or exits 2 with stderr containing
+ * PEAKS_CODE_PROHIBITED_DIRECT_EDIT (deny).
+ *
+ * This command is the runtime adapter for the shell-script sibling
+ * (`src/services/hooks/pre-tool-code-gate.sh`). Both share the same
+ * path-family decision; the CLI invokes the same pure decision
+ * function (`decideGateAction`) the shell script encodes.
+ *
+ * Settings.json entry shape (vendor-neutral, registered by
+ * `peaks hooks install`):
+ *   { matcher: "Edit|Write|MultiEdit", hooks: [{ type: "command", command: "peaks code-gate --json" }] }
+ *
+ * The vendor-specific install code (`src/cli/commands/hooks-commands.ts`
+ * + `src/services/ide/adapters/*`) is the only place that knows how
+ * to render this into any IDE's settings.json shape. This file is
+ * vendor-neutral — no vendor references in the source code itself.
+ */
+import { addJsonOption, printResult } from '../cli-helpers.js';
+import { decideGateAction, extractFilePath } from '../../services/hooks/pre-tool-code-gate.js';
+import { fail, ok } from 'peaks-loop-shared/result';
+export function registerCodeGateCommand(program, io) {
+    addJsonOption(program
+        .command('code-gate')
+        .description('2026-08-06-codegate-vendor-neutral: vendor-neutral PreToolUse gate. ' +
+        'Reads the standard hook JSON payload from stdin and either exits 0 (allow) ' +
+        'or exits 2 with stderr containing PEAKS_CODE_PROHIBITED_DIRECT_EDIT (deny). ' +
+        'The gate blocks Edit/Write/MultiEdit on hard-blocked path families ' +
+        '(src/, tests/unit/, tests/integration/, config/, bin/, scripts/) so the ' +
+        'orchestrator is forced to dispatch via `peaks sub-agent dispatch rd`. ' +
+        'Allow-listed paths (.peaks/**, skills/**, docs/**) are NOT gated.')
+        .option('--dry-run', 'emit JSON verdict to stdout instead of exit code; useful for tests')).action(async (opts) => {
+        let raw = '';
+        try {
+            raw = await readStdin();
+        }
+        catch {
+            // Empty / unreadable stdin → fail-open allow. The shell-script
+            // sibling does the same.
+            raw = '';
+        }
+        let parsed = null;
+        try {
+            parsed = raw.trim().length > 0 ? JSON.parse(raw) : null;
+        }
+        catch {
+            // Malformed JSON → fail-open allow. Cannot decide safely.
+            parsed = null;
+        }
+        if (parsed === null) {
+            if (opts.dryRun === true) {
+                printResult(io, ok('code.gate', { action: 'allow', reason: 'empty-or-malformed-payload' }, [], ['no stdin payload; allowing']), opts.json);
+                return;
+            }
+            process.exit(0);
+        }
+        const verdict = decideGateAction(parsed.tool, parsed.input ?? {});
+        if (opts.dryRun === true) {
+            if (verdict.action === 'allow') {
+                printResult(io, ok('code.gate', { action: 'allow', tool: parsed.tool, filePath: extractFilePath(parsed.input ?? {}) }, [], []), opts.json);
+            }
+            else {
+                printResult(io, fail('code.gate', 'PEAKS_CODE_PROHIBITED_DIRECT_EDIT', verdict.message, { action: 'deny', tool: parsed.tool, filePath: verdict.filePath, reason: verdict.reason }, ['use peaks sub-agent dispatch rd']), opts.json);
+            }
+            return;
+        }
+        if (verdict.action === 'deny') {
+            process.stderr.write(verdict.message + '\n');
+            process.exit(2);
+        }
+        process.exit(0);
+    });
+}
+function readStdin() {
+    return new Promise((resolveFn, reject) => {
+        let buf = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', (chunk) => { buf += chunk; });
+        process.stdin.on('end', () => resolveFn(buf));
+        process.stdin.on('error', (err) => reject(err));
+    });
+}

package/dist/cli/commands/code-mode-gate-commands.js

@@ -7,7 +7,7 @@
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { GATED_STEPS, isHardFloorCategory, isCodeMode, isCommitBoundaryAction, shouldPauseAtGate, formatAutoProceedLogLine } from '../../services/code/mode-gate.js';
-import { checkStalePresence } from '../../services/skills/skill-presence-service.js';
+import { checkStalePresence, getSkillPresence } from '../../services/skills/skill-presence-service.js';
 import { findProjectRoot } from '../../services/config/config-safety.js';
 import { emitObservabilityEvent } from '../../services/observability/observability-service.js';
 import { buildCodePlan } from './code-commands.js';
@@ -207,9 +207,8 @@ export function registerCodeModeGateCommands(code, io) {
 }
 // Local helper (was `readActiveSid` in code-commands.ts before rid-024 split).
 // The mode-gate stale-presence check needs the active sid for the
-// observability event; we re-import getSkillPresence here to avoid the
-// cross-file helper import.
-import { getSkillPresence } from '../../services/skills/skill-presence-service.js';
+// observability event; `getSkillPresence` is imported at the top of the file
+// alongside `checkStalePresence` to keep imports deduplicated.
 function readActiveSidForModeGate(projectRoot) {
     try {
         const presence = getSkillPresence(projectRoot);

package/dist/cli/commands/code-orchestrator-can-do.js

@@ -60,7 +60,8 @@ export function registerCodeOrchestratorCanDoCommand(code, io) {
 function summaryLines(result) {
     const lines = [];
     lines.push(`verdict: ${result.canDoInSession ? 'canDoInSession=true' : 'canDoInSession=false (blockers present)'}; ` +
-        `q1=src[${result.q1SourceCodeTouched ? 'Y' : 'N'}] q2=subagent[${result.q2SubAgentAvailable ? 'Y' : 'N'}] ` +
+        `q1=src[${result.q1SourceCodeTouched ? 'Y' : 'N'}] q1=hard-block[${result.q1HardBlockedPath ? 'Y' : 'N'}] ` +
+        `q2=subagent[${result.q2SubAgentAvailable ? 'Y' : 'N'}] ` +
         `q3=user-decision[${result.q3RequiresUserDecision ? 'Y' : 'N'}] q4=ratio=${result.contextRatio.toFixed(2)} ` +
         `(red-line ${ORCHESTRATOR_REDLINE_RATIO} / pre-compact ${ORCHESTRATOR_PRECOMPACT_RATIO})`);
     return lines;

package/dist/cli/commands/cron-commands.js

@@ -34,7 +34,19 @@ import { findProjectRoot } from '../../services/config/config-safety.js';
 const SCHEDULE_VERSION = 1;
 const SCHEDULE_FILENAME = 'schedule.json';
 const HISTORY_FILENAME = 'history.jsonl';
-const DEFAULT_INTERVAL_MS = 24 * 60 * 60 * 1_000; // 24h
+/**
+ * PRD-002b slice 2 — extract cron-orchestration magic numbers (24h
+ * default interval, 5-minute exec timeout, stderr-message truncation
+ * lengths in the renderer).
+ */
+const MS_PER_SECOND = 1_000;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const HOURS_PER_DAY = 24;
+const DEFAULT_INTERVAL_MS = HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND;
+const EXEC_TIMEOUT_MS = 5 * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND;
+const STDERR_RECORD_TRUNCATE_BYTES = 2000;
+const STDERR_NEXT_ACTIONS_TRUNCATE_CHARS = 200;
 function cronDir(projectRoot) {
     return join(projectRoot, '.peaks', 'cron');
 }
@@ -136,13 +148,13 @@ export function runTask(projectRoot, task) {
             cwd: projectRoot,
             stdio: ['ignore', 'pipe', 'pipe'],
             encoding: 'utf8',
-            timeout: 5 * 60_000
+            timeout: EXEC_TIMEOUT_MS
         });
     }
     catch (err) {
         const e = err;
         exitCode = typeof e.status === 'number' ? e.status : 1;
-        stderr = (e.stderr ?? getErrorMessage(err)).slice(0, 2000);
+        stderr = (e.stderr ?? getErrorMessage(err)).slice(0, STDERR_RECORD_TRUNCATE_BYTES);
     }
     const record = {
         id,
@@ -243,7 +255,7 @@ export function registerCronCommand(program, io) {
                 updatedEntries.push({ ...task, lastRunAt: record.finishedAt });
             }
             writeSchedule(projectRoot, { version: SCHEDULE_VERSION, entries: updatedEntries });
-            printResult(io, ok('cron.run', { projectRoot, ran: records.length, records }, records.filter((r) => r.exitCode !== 0).map((r) => `Task ${r.taskId} failed (exit=${r.exitCode}): ${r.stderr.slice(0, 200)}`), [`Ran ${records.length} task(s); ${records.filter((r) => r.exitCode === 0).length} succeeded.`]), options.json);
+            printResult(io, ok('cron.run', { projectRoot, ran: records.length, records }, records.filter((r) => r.exitCode !== 0).map((r) => `Task ${r.taskId} failed (exit=${r.exitCode}): ${r.stderr.slice(0, STDERR_NEXT_ACTIONS_TRUNCATE_CHARS)}`), [`Ran ${records.length} task(s); ${records.filter((r) => r.exitCode === 0).length} succeeded.`]), options.json);
             if (records.some((r) => r.exitCode !== 0))
                 process.exitCode = 1;
         }

package/dist/cli/commands/dashboard-long-run.js

@@ -5,7 +5,11 @@ import { read24hState } from '../../services/24h-mode/index.js';
 import { getErrorMessage } from '../cli-helpers.js';
 const SINCE_PATTERN = /^(\d+)([smhd])$/i;
 const WINDOW_CAP_HOURS = 24;
-const WINDOW_CAP_MS = WINDOW_CAP_HOURS * 60 * 60 * 1000;
+const MS_PER_SECOND = 1000;
+const MS_PER_MINUTE = 60 * MS_PER_SECOND;
+const MS_PER_HOUR = 60 * MS_PER_MINUTE;
+const MS_PER_DAY = 24 * MS_PER_HOUR;
+const WINDOW_CAP_MS = WINDOW_CAP_HOURS * MS_PER_HOUR;
 function parseSince(raw) {
     if (!raw)
         return { ok: false, error: '--since is required (e.g. 24h, 8h, 30m)' };
@@ -16,7 +20,7 @@ function parseSince(raw) {
     if (!Number.isFinite(value) || value < 0)
         return { ok: false, error: `--since must be a non-negative integer (got ${raw})` };
     const unit = (match[2] ?? 'h').toLowerCase();
-    const multiplier = unit === 'd' ? 86_400_000 : unit === 'h' ? 3_600_000 : unit === 'm' ? 60_000 : 1_000;
+    const multiplier = unit === 'd' ? MS_PER_DAY : unit === 'h' ? MS_PER_HOUR : unit === 'm' ? MS_PER_MINUTE : MS_PER_SECOND;
     return { ok: true, ms: Math.min(WINDOW_CAP_MS, value * multiplier) };
 }
 function readSlices(projectRoot, sessionId) {
@@ -45,7 +49,7 @@ function boundaryLabel(raw) {
         return { key: 'valid', message: 'unparseable' };
     const value = Number(match[1]);
     const unit = (match[2] ?? 'h').toLowerCase();
-    const multiplier = unit === 'd' ? 86_400_000 : unit === 'h' ? 3_600_000 : unit === 'm' ? 60_000 : 1_000;
+    const multiplier = unit === 'd' ? MS_PER_DAY : unit === 'h' ? MS_PER_HOUR : unit === 'm' ? MS_PER_MINUTE : MS_PER_SECOND;
     if (value * multiplier > WINDOW_CAP_MS) {
         return { key: 'cap', message: 'since>24h is capped to the 24h window' };
     }
@@ -86,7 +90,7 @@ export function registerDashboardLongRunCommand(dashboard, io) {
             const sliceCount = readSlices(projectRoot, sid);
             const checkpointAgeMs = readLastCheckpointAgeMs(snapshot);
             const checkpointFrequency = snapshot.checkpoints > 0 && snapshot.enteredAt
-                ? Math.max(1, Math.round((Date.now() - Date.parse(snapshot.enteredAt)) / snapshot.checkpoints / 60_000))
+                ? Math.max(1, Math.round((Date.now() - Date.parse(snapshot.enteredAt)) / snapshot.checkpoints / MS_PER_MINUTE))
                 : null;
             const indicators = {
                 dispatchCount: sliceCount,

package/dist/cli/commands/dispatch-from-dag.d.ts

@@ -1,3 +1,3 @@
-import type { ProgramIO } from '../cli-helpers.js';
+import { type ProgramIO } from '../cli-helpers.js';
 import { type DispatchOptions } from './sub-agent-shared.js';
 export declare function runDispatchFromDag(role: string, options: DispatchOptions, asJson: boolean, io: ProgramIO): Promise<void>;