peaks-loop 4.0.35 → 4.0.37

package/dist/services/skills/hooks-settings-service.js

@@ -1,6 +1,6 @@
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { assertSafeSettingsFile } from '../ide/shared/safe-path.js';
 import { atomicWriteJson, readJsonObjectFile } from '../ide/shared/atomic-json.js';
 import { getAdapter } from '../ide/ide-registry.js';
@@ -44,6 +44,43 @@ function assertSafeSettingsPathCompat(scope, ide, root, settingsPath) {
         throw new Error(`settings path drift: ${expected} vs ${settingsPath}`);
     }
 }
+/** Machine-local sibling of the adapter's settings file (Claude Code convention). */
+const LOCAL_SETTINGS_FILE_NAME = 'settings.local.json';
+/** IDEs whose hook settings have a machine-local, gitignored sibling file. */
+const IDES_WITH_LOCAL_SETTINGS = new Set(['claude-code']);
+/**
+ * Resolve the machine-local settings file an IDE may carry (e.g. Claude
+ * Code's `.claude/settings.local.json`), or `undefined` when there is none.
+ *
+ * Global scope resolves to `undefined`: the global settings file
+ * (`~/.claude/settings.json`) is already machine-local, so nothing needs
+ * relocating there.
+ */
+function resolveLocalSettingsPath(scope, ide, projectRoot) {
+    if (scope === 'global' || !IDES_WITH_LOCAL_SETTINGS.has(ide))
+        return undefined;
+    const root = resolveSettingsRoot(scope, projectRoot);
+    const adapter = getAdapter(ide);
+    assertSafeSettingsFile(scope, root, adapter.settings.dirName, LOCAL_SETTINGS_FILE_NAME);
+    return join(root, adapter.settings.dirName, LOCAL_SETTINGS_FILE_NAME);
+}
+function resolveHookTargets(scope, ide, projectRoot) {
+    const sharedPath = resolveSettingsPath(scope, ide, projectRoot);
+    const localPath = resolveLocalSettingsPath(scope, ide, projectRoot);
+    const shared = { settingsPath: sharedPath, entries: [] };
+    if (localPath === undefined || localPath === sharedPath) {
+        return [{ settingsPath: sharedPath, entries: [...resolveHookEntries(ide)] }];
+    }
+    const local = { settingsPath: localPath, entries: [] };
+    for (const entry of resolveHookEntries(ide)) {
+        (entry.machineLocal === true ? local : shared).entries.push(entry);
+    }
+    return [shared, local];
+}
+/** Read a settings file as an object, or `{}` when it does not exist yet. */
+function readSettingsFile(settingsPath) {
+    return existsSync(settingsPath) ? readJsonObjectFile(settingsPath) : {};
+}
 /** Read the existing hook array entries for the adapter's hookEvent (tolerant of any prior shape). */
 function readHookEventEntries(settings, eventKey) {
     const hooks = settings.hooks;
@@ -209,8 +246,7 @@ export const PEAKS_HOOK_ENTRIES = (() => {
         { sentinel: spec.hookEnforceSentinel, matcher: spec.hookEnforceMatcher, command: spec.hookEnforceCommand, event: spec.hookEnforceEvent }
     ];
 })();
-function isInstalledForIde(settings, ide) {
-    const entries = resolveHookEntries(ide);
+function isInstalledForEntries(settings, entries) {
     const sentinels = entries.map((e) => e.sentinel);
     // Check every distinct event key our entries could be on.
     const eventKeys = new Set(entries.map((e) => e.event));
@@ -230,12 +266,14 @@ function isInstalledForIde(settings, ide) {
  * fully reflected on disk: gate-enforce present AND no legacy
  * progress-start present.
  */
-function shapeMatchesDesired(settings, ide) {
-    const desiredEntries = resolveHookEntries(ide);
-    const desiredSentinels = new Set(desiredEntries.map((e) => e.sentinel));
-    const allPeaksSentinels = resolveLegacySentinels(ide);
-    const eventKeys = new Set(resolveHookEntries(ide).map((e) => e.event));
+function shapeMatchesDesired(settings, entries, allPeaksSentinels) {
+    const eventKeys = new Set(entries.map((e) => e.event));
     for (const eventKey of eventKeys) {
+        // Only the entries that belong to THIS event key can be expected on it —
+        // the desired set must be per-event, or a target whose entries span two
+        // event keys (claude-code: SessionStart + PreToolUse) would never look
+        // installed and every `peaks hooks install` would rewrite the files.
+        const desiredSentinels = new Set(entries.filter((e) => e.event === eventKey).map((e) => e.sentinel));
         const present = readHookEventEntries(settings, eventKey);
         const peaksPresent = present.filter((e) => entryIsPeaksManaged(e, allPeaksSentinels));
         // (a) every peaks-managed entry currently on disk must match the
@@ -261,29 +299,36 @@ export function planHookInstall(scope, projectRoot, options) {
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
     const spec = resolveHookSpec(ide);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
     return {
         scope,
         settingsPath,
         exists,
-        alreadyInstalled: isInstalledForIde(settings, ide),
+        alreadyInstalled: targets.every((t) => isInstalledForEntries(readSettingsFile(t.settingsPath), t.entries)),
         desiredCommand: spec.hookEnforceCommand,
         sentinel: spec.hookEnforceSentinel,
-        matcher: spec.hookEnforceMatcher
+        matcher: spec.hookEnforceMatcher,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
     };
 }
-/** Merge all peaks-managed hook entries into settings, preserving all other keys and hooks. */
-function withHooksInstalledForIde(settings, ide, _skipProgress = false) {
+/**
+ * Merge a target's peaks-managed hook entries into `settings`, preserving
+ * all other keys and hooks. Entries routed to a DIFFERENT settings file are
+ * not part of `entries`, so the legacy-sentinel filter below strips them
+ * from this file (that is what migrates a gate-enforce entry that an older
+ * peaks release wrote into the shared file).
+ */
+function withHooksInstalled(settings, entries, allSentinels) {
     const existingHooks = (settings.hooks && typeof settings.hooks === 'object' && !Array.isArray(settings.hooks))
         ? settings.hooks
         : {};
-    // Per-IDE entries may map to different events (Trae: gate-enforce on
-    // beforeToolCall; Claude: gate-enforce on PreToolUse). Group by event
-    // so each event array is independently merged.
+    // Our entries may sit on more than one event key. Group by event so each
+    // event array is independently merged.
     const ourByEvent = new Map();
-    for (const spec of resolveHookEntries(ide)) {
+    for (const spec of entries) {
         const list = ourByEvent.get(spec.event) ?? [];
         list.push(spec);
         ourByEvent.set(spec.event, list);
@@ -293,14 +338,16 @@ function withHooksInstalledForIde(settings, ide, _skipProgress = false) {
     // stripped by the filter (the file converges on the new
     // gate-enforce-only shape, idempotently). The desired set (passed
     // in below) only contains the gate-enforce sentinel.
-    const allSentinels = resolveLegacySentinels(ide);
     const nextHooks = { ...existingHooks };
-    for (const [eventKey, ourEntries] of ourByEvent) {
+    // An event key this file used to carry but whose entries all moved to the
+    // other file still needs its stale peaks entries stripped.
+    const eventKeys = new Set([...ourByEvent.keys(), ...Object.keys(existingHooks)]);
+    for (const eventKey of eventKeys) {
         const existing = readHookEntriesFromHooks(nextHooks, eventKey);
         const nonPeaks = existing.filter((entry) => !entryIsPeaksManaged(entry, allSentinels));
-        const ourFormatted = ourEntries.map((spec) => ({
+        const ourFormatted = (ourByEvent.get(eventKey) ?? []).map((spec) => ({
             matcher: spec.matcher,
-            hooks: [{ type: 'command', command: spec.command }]
+            hooks: [{ type: 'command', command: spec.command, ...(spec.shell !== undefined ? { shell: spec.shell } : {}) }]
         }));
         const merged = [...nonPeaks, ...ourFormatted];
         if (merged.length > 0) {
@@ -322,15 +369,17 @@ export function applyHookInstall(scope, projectRoot, options) {
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
     const spec = resolveHookSpec(ide);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
+    const allSentinels = resolveLegacySentinels(ide);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
     // Slice #014: `alreadyInstalled` reflects the FULL desired shape
     // (gate-enforce-only + no stale progress-start entry). Pre-#014
     // installs that left a progress-start entry behind will be treated
     // as not-yet-installed, so the merge strips the stale entry on the
     // next install call. This is the only path that converges the file
     // on the new shape; pure presence-checks are insufficient.
-    const alreadyInstalled = shapeMatchesDesired(settings, ide);
+    const alreadyInstalled = targets.every((t) => shapeMatchesDesired(readSettingsFile(t.settingsPath), t.entries, allSentinels));
     const baseResult = {
         scope,
         settingsPath,
@@ -338,7 +387,8 @@ export function applyHookInstall(scope, projectRoot, options) {
         alreadyInstalled,
         desiredCommand: spec.hookEnforceCommand,
         sentinel: spec.hookEnforceSentinel,
-        matcher: spec.hookEnforceMatcher
+        matcher: spec.hookEnforceMatcher,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
     };
     if (baseResult.alreadyInstalled) {
         return { ...baseResult, applied: false };
@@ -356,8 +406,17 @@ export function applyHookInstall(scope, projectRoot, options) {
     // entry. The chain cannot run raw `git worktree add` (or
     // `podman run`) without an explicit `peaks hooks uninstall`
     // first. Both helpers are pure + idempotent.
-    const merged = withTriggeredDenyList(withSuperpowersSkillDenylist(withHooksInstalledForIde(settings, ide)));
-    atomicWriteJson(settingsPath, merged);
+    //
+    // The `permissions.deny` block lives in the adapter's settings file
+    // only (as it always has) — it is committed, so the deny list is
+    // shared; the machine-local file carries hook entries only.
+    for (const target of targets) {
+        const next = withHooksInstalled(readSettingsFile(target.settingsPath), target.entries, allSentinels);
+        const merged = target.settingsPath === settingsPath
+            ? withTriggeredDenyList(withSuperpowersSkillDenylist(next))
+            : next;
+        atomicWriteJson(target.settingsPath, merged);
+    }
     return { ...baseResult, alreadyInstalled: false, applied: true };
 }
 export function removeHookInstall(scope, projectRoot, options) {
@@ -365,60 +424,92 @@ export function removeHookInstall(scope, projectRoot, options) {
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
-    if (!existsSync(settingsPath)) {
-        return { scope, settingsPath, removed: false };
+    const targets = resolveHookTargets(scope, ide, projectRoot);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
+    const present = targets.filter((t) => existsSync(t.settingsPath));
+    if (present.length === 0) {
+        return {
+            scope,
+            settingsPath,
+            removed: false,
+            ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
+        };
     }
-    const settings = readJsonObjectFile(settingsPath);
-    const existingHooks = settings.hooks ?? {};
     // Slice #014: uninstall must remove the gate-enforce entry AND any
     // legacy progress-start entry that a pre-#014 install left behind.
     // The legacy sentinel set covers both shapes so the uninstall
     // converges the file on "no peaks-managed entries", regardless of
     // what shape the file was in when the user ran uninstall.
     const sentinels = resolveLegacySentinels(ide);
-    const eventKeys = new Set(resolveHookEntries(ide).map((e) => e.event));
     let removedAny = false;
-    const nextHooks = { ...existingHooks };
-    for (const eventKey of eventKeys) {
-        const entries = readHookEntriesFromHooks(nextHooks, eventKey);
-        const kept = entries.filter((entry) => !entryIsPeaksManaged(entry, sentinels));
-        if (kept.length !== entries.length)
-            removedAny = true;
-        if (kept.length > 0) {
-            nextHooks[eventKey] = kept;
+    for (const target of present) {
+        const settings = readJsonObjectFile(target.settingsPath);
+        const existingHooks = settings.hooks ?? {};
+        // Scan every event key on disk as well as the ones we install on:
+        // entries may have been routed to the other settings file by a
+        // previous install.
+        const eventKeys = new Set([...target.entries.map((e) => e.event), ...Object.keys(existingHooks)]);
+        const nextHooks = { ...existingHooks };
+        for (const eventKey of eventKeys) {
+            const entries = readHookEntriesFromHooks(nextHooks, eventKey);
+            const kept = entries.filter((entry) => !entryIsPeaksManaged(entry, sentinels));
+            if (kept.length !== entries.length)
+                removedAny = true;
+            if (kept.length > 0) {
+                nextHooks[eventKey] = kept;
+            }
+            else {
+                delete nextHooks[eventKey];
+            }
+        }
+        const nextSettings = { ...settings };
+        if (Object.keys(nextHooks).length > 0) {
+            nextSettings.hooks = nextHooks;
         }
         else {
-            delete nextHooks[eventKey];
+            delete nextSettings.hooks;
         }
+        // Slice 2026-07-29-worktree-layer3-deny: Layer 3 — symmetric uninstall.
+        // Strips the peaks-managed `UseSkill(...)` deny entries alongside the
+        // hook entries; user-written entries are untouched. The helper self-
+        // decomposes an empty `permissions` object.
+        //
+        // Slice 2026-07-29-worktree-l2-extended Part 29: also strip the
+        // trigger-style deny entries via withoutTriggeredDenyList. The
+        // chain of helpers is order-independent (each is idempotent and
+        // additive over the same set of peaks-managed entries).
+        const finalSettings = target.settingsPath === settingsPath
+            ? withoutTriggeredDenyList(withoutSuperpowersSkillDenylist(nextSettings))
+            : nextSettings;
+        atomicWriteJson(target.settingsPath, finalSettings);
     }
-    const nextSettings = { ...settings };
-    if (Object.keys(nextHooks).length > 0) {
-        nextSettings.hooks = nextHooks;
-    }
-    else {
-        delete nextSettings.hooks;
-    }
-    // Slice 2026-07-29-worktree-layer3-deny: Layer 3 — symmetric uninstall.
-    // Strips the peaks-managed `UseSkill(...)` deny entries alongside the
-    // hook entries; user-written entries are untouched. The helper self-
-    // decomposes an empty `permissions` object.
-    //
-    // Slice 2026-07-29-worktree-l2-extended Part 29: also strip the
-    // trigger-style deny entries via withoutTriggeredDenyList. The
-    // chain of helpers is order-independent (each is idempotent and
-    // additive over the same set of peaks-managed entries).
-    const finalSettings = withoutTriggeredDenyList(withoutSuperpowersSkillDenylist(nextSettings));
-    atomicWriteJson(settingsPath, finalSettings);
-    return { scope, settingsPath, removed: removedAny };
+    return {
+        scope,
+        settingsPath,
+        removed: removedAny,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
+    };
 }
 export function readHookStatus(scope, projectRoot, options) {
     const ide = resolveIde(options);
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
-    return { scope, settingsPath, exists, installed: isInstalledForIde(settings, ide) };
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
+    return {
+        scope,
+        settingsPath,
+        exists,
+        ...(localTarget !== undefined
+            ? { localSettingsPath: localTarget.settingsPath, localExists: existsSync(localTarget.settingsPath) }
+            : {}),
+        installed: targets.some((t) => {
+            const settings = readSettingsFile(t.settingsPath);
+            return Object.keys(settings).length > 0 && isInstalledForEntries(settings, t.entries);
+        })
+    };
 }
 /**
  * Slice 2026-07-29-worktree-l2-extended Part 27 — trigger-style deny.

package/dist/services/slice/slice-check-service.d.ts

@@ -1,2 +1,16 @@
 import type { SliceCheckOptions, SliceCheckResult } from './slice-check-types.js';
+/**
+ * 2026-09-10 D1-follow-up (G5): `tsconfig.build.json` is the type contract the
+ * package actually ships (`src/**` only) and it is clean, so the typecheck
+ * stage GATES on it. The wider `tsconfig.json` adds `tests/**`, which still
+ * carries errors this slice did not cause — 142 as measured on 2026-09-10
+ * (`pnpm exec tsc -p tsconfig.json --noEmit 2>&1 | grep -c "error TS"`), all
+ * of them under `tests/`, none under `src/`. That count is therefore a
+ * baseline, not a gate: the stage fails only when it GROWS, which is the
+ * question "did this slice add a type error anywhere?". Re-measure and update
+ * this constant when the residue is paid down.
+ */
+export declare const TYPECHECK_PREEXISTING_BASELINE = 142;
+/** Named code for "the CLI this stage needs is not installed". */
+export declare const BINARY_UNRESOLVED_CODE = "SLICE_CHECK_BINARY_UNRESOLVED";
 export declare function sliceCheck(options: SliceCheckOptions): Promise<SliceCheckResult>;

package/dist/services/slice/slice-check-service.js

@@ -28,49 +28,75 @@ const HEAD_LINES_IN_TAIL = 3;
 const AUDIT_MIN_RED_LINES = 60;
 const REVIEW_FILE_MIN_BYTES = 20;
 /**
- * Resolve a CLI binary to a project-local path, falling back to
- * the system `npx`. pnpm (and npm/yarn) all create
- * `node_modules/.bin/<name>`:
- *
- *   - On Unix, this is a symlink to the package's executable.
- *   - On Windows, this is a `.cmd` shim; `execFileSync` only
- *     resolves `.cmd` through the shell (PATHEXT), so we pass
- *     `shell: true` when invoking one. Without this, the
- *     Windows `npx ENOENT` false-positive from
- *     observations 2317 + 2792 reproduces for every local
- *     binary.
+ * 2026-09-10 D1-follow-up (G5): `tsconfig.build.json` is the type contract the
+ * package actually ships (`src/**` only) and it is clean, so the typecheck
+ * stage GATES on it. The wider `tsconfig.json` adds `tests/**`, which still
+ * carries errors this slice did not cause — 142 as measured on 2026-09-10
+ * (`pnpm exec tsc -p tsconfig.json --noEmit 2>&1 | grep -c "error TS"`), all
+ * of them under `tests/`, none under `src/`. That count is therefore a
+ * baseline, not a gate: the stage fails only when it GROWS, which is the
+ * question "did this slice add a type error anywhere?". Re-measure and update
+ * this constant when the residue is paid down.
+ */
+export const TYPECHECK_PREEXISTING_BASELINE = 142;
+/**
+ * 2026-09-10 D1-follow-up (C6): each name resolves to the JS entry its package
+ * declares, as a path relative to `node_modules/` — the same files
+ * `node_modules/.bin/<name>` shims point at.
  *
- * Returns the command + args + a `shell` flag that the
- * `runCommand` helper threads into `execFileSync`.
+ * The `.bin` shim these used to spawn is a `.cmd` on Windows, and a `.cmd`
+ * cannot be spawned without `shell: true` (EINVAL, Node >= 20). `shell: true`
+ * re-parses the command line, so a project path containing a space was split
+ * at the space and the stage reported a phantom typecheck/test failure.
+ * Running the JS entry through `process.execPath` needs no shell — a spaced
+ * path is just an argument — and is the shape the D1 fix uses for `peaks`
+ * itself (`orchestrator-can-do.ts`).
+ */
+const LOCAL_CLI_ENTRIES = {
+    tsc: ['typescript', 'bin', 'tsc'],
+    vitest: ['vitest', 'vitest.mjs']
+};
+/** Named code for "the CLI this stage needs is not installed". */
+export const BINARY_UNRESOLVED_CODE = 'SLICE_CHECK_BINARY_UNRESOLVED';
+function localCliPath(projectRoot, name) {
+    return join(projectRoot, 'node_modules', ...LOCAL_CLI_ENTRIES[name]);
+}
+/**
+ * Resolve a CLI to the interpreter + JS entry `runCommand` needs, or `null`
+ * when that entry is not on disk. Never returns a shell: the returned command
+ * is always `process.execPath`.
  */
 function resolveLocalBinary(projectRoot, name) {
-    // pnpm creates `node_modules/.bin/<name>` (symlink on Unix,
-    // `.cmd` shim on Windows). We probe both shapes; the
-    // `process.platform === 'win32'` extension probe is the most
-    // portable approach.
-    const isWin = process.platform === 'win32';
-    const candidateNames = isWin ? [`${name}.cmd`, `${name}.ps1`, `${name}`] : [name];
-    for (const candidate of candidateNames) {
-        const cmdPath = join(projectRoot, 'node_modules', '.bin', candidate);
-        if (existsSync(cmdPath)) {
-            return { command: cmdPath, args: [], shell: isWin };
-        }
-    }
-    // Fallback: system npx. On Windows this still has the ENOENT
-    // issue, but the fallback is at least informative when it
-    // fires (the user can see "npx not found" instead of a
-    // silent exit 1).
-    return { command: 'npx', args: [name], shell: false };
+    const entry = localCliPath(projectRoot, name);
+    if (!existsSync(entry))
+        return null;
+    return { command: process.execPath, args: [entry] };
 }
-function runCommand(command, args, cwd, timeoutMs, shell = false) {
+/**
+ * Failed stage for an unresolvable CLI. The previous fallback spawned `npx`
+ * and reported whatever came back — an ENOENT-shaped "exited 1" that reads
+ * exactly like a genuine typecheck/test failure. This names the code and the
+ * path that was searched instead.
+ */
+function unresolvedBinaryStage(stage, cli, projectRoot, durationMs) {
+    const expected = localCliPath(projectRoot, cli);
+    return {
+        name: stage,
+        description: `${cli}: binary unresolved (${BINARY_UNRESOLVED_CODE})`,
+        status: 'fail',
+        durationMs,
+        detail: `${BINARY_UNRESOLVED_CODE}: ${cli} not found at ${expected}. Install dependencies (pnpm install) so that entry exists.`,
+        data: { code: BINARY_UNRESOLVED_CODE, cli, expected }
+    };
+}
+function runCommand(command, args, cwd, timeoutMs) {
     const start = Date.now();
     try {
         const stdout = execFileSync(command, args, {
             cwd,
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: timeoutMs,
-            maxBuffer: EXEC_MAX_BUFFER_BYTES,
-            shell
+            maxBuffer: EXEC_MAX_BUFFER_BYTES
         }).toString('utf8');
         return {
             status: 'pass',
@@ -105,22 +131,52 @@ function tailLines(text, max) {
 async function runTypecheck(projectRoot) {
     const start = Date.now();
     // Per Windows npx ENOENT (observations 2317+2792 from
-    // 2026-06-09), prefer the project-local `node_modules/.bin/tsc`
-    // (symlink on Unix, .cmd on Windows). The local binary is
-    // installed by pnpm at workspace-install time and avoids the
-    // npx PATH-lookup issue.
+    // 2026-06-09), prefer the project-local tsc; it is installed by
+    // pnpm at workspace-install time and avoids the npx PATH-lookup
+    // issue. 2026-09-10 C6: that local binary is now the package's
+    // JS entry run through `process.execPath`, not the `.bin` shim.
     const tsc = resolveLocalBinary(projectRoot, 'tsc');
-    const result = runCommand(tsc.command, [...tsc.args, '--noEmit'], projectRoot, TYPECHECK_TIMEOUT_MS, tsc.shell);
-    const testFiles = result.stdout.match(/(tests?\/.*\.test\.ts)/g) ?? [];
+    if (tsc === null) {
+        return unresolvedBinaryStage('typecheck', 'tsc', projectRoot, Date.now() - start);
+    }
+    // 2026-09-10 G5: this stage used to run a bare `tsc --noEmit`, which picked
+    // up the DEFAULT tsconfig.json (src/** + tests/**) and its 142 pre-existing
+    // test-side errors — so the stage was permanently red and its one real
+    // signal was buried. The gate is now the build tsconfig, which covers
+    // exactly what ships.
+    const buildConfig = 'tsconfig.build.json';
+    const hasBuildConfig = existsSync(join(projectRoot, buildConfig));
+    const gate = runCommand(tsc.command, [...tsc.args, '-p', hasBuildConfig ? buildConfig : 'tsconfig.json', '--noEmit'], projectRoot, TYPECHECK_TIMEOUT_MS);
+    // Measure the wider count so the residue is surfaced rather than hidden.
+    // The baseline comparison only applies when a clean build tsconfig gives it
+    // a meaning; without one the gate above already IS this run.
+    const wide = hasBuildConfig
+        ? runCommand(tsc.command, [...tsc.args, '-p', 'tsconfig.json', '--noEmit'], projectRoot, TYPECHECK_TIMEOUT_MS)
+        : gate;
+    const wideErrors = (wide.stdout + wide.stderr).match(/error TS\d+/g)?.length ?? 0;
+    const wideLabel = hasBuildConfig ? 'tsconfig.json (src/** + tests/**)' : 'tsconfig.json';
+    const regressed = hasBuildConfig && gate.status === 'pass' && wideErrors > TYPECHECK_PREEXISTING_BASELINE;
+    const reason = gate.status !== 'pass'
+        ? `tsc -p ${hasBuildConfig ? buildConfig : 'tsconfig.json'} --noEmit exited ${gate.exitCode}`
+        : regressed
+            ? `typecheck errors grew to ${wideErrors} (pre-existing baseline ${TYPECHECK_PREEXISTING_BASELINE})`
+            : '';
     return {
         name: 'typecheck',
-        description: `${tsc.command} --noEmit (no JS emit, type-only check)`,
-        status: result.status,
-        durationMs: result.durationMs,
-        detail: result.status === 'pass'
-            ? `Typecheck passed in ${result.durationMs}ms.`
-            : tailLines(result.stdout + result.stderr, TYPECHECK_TAIL_LINES) || `tsc exited with code ${result.exitCode}.`,
-        data: { exitCode: result.exitCode }
+        description: hasBuildConfig
+            ? `tsc -p ${buildConfig} --noEmit (gate) + -p tsconfig.json (baseline report)`
+            : `tsc --noEmit (no JS emit, type-only check)`,
+        status: reason.length === 0 ? 'pass' : 'fail',
+        durationMs: Date.now() - start,
+        detail: reason.length === 0
+            ? `${hasBuildConfig ? `${buildConfig} (src/**) clean; ` : ''}${wideLabel}: ${wideErrors} pre-existing error(s), baseline ${TYPECHECK_PREEXISTING_BASELINE} — reported, not hidden.`
+            : `${reason}. ${tailLines(gate.status !== 'pass' ? gate.stdout + gate.stderr : wide.stdout + wide.stderr, TYPECHECK_TAIL_LINES)}`,
+        data: {
+            exitCode: gate.exitCode,
+            wideTsconfigErrors: wideErrors,
+            preExistingBaseline: hasBuildConfig ? TYPECHECK_PREEXISTING_BASELINE : null,
+            ...(regressed ? { regression: wideErrors - TYPECHECK_PREEXISTING_BASELINE } : {})
+        }
     };
 }
 function parseVitestSummary(stdout, fallbackDuration) {
@@ -147,15 +203,19 @@ async function runUnitTests(projectRoot, runTests) {
     // `tests/unit/slice-check-service.test.ts` for the regression net.
     // Per Windows npx ENOENT (observations 2317+2792), resolve
     // the project-local vitest binary instead of shelling out
-    // through npx.
+    // through npx. 2026-09-10 C6: that binary is the package's JS
+    // entry run through `process.execPath`, not the `.bin` shim.
     const vitest = resolveLocalBinary(projectRoot, 'vitest');
+    if (vitest === null) {
+        return unresolvedBinaryStage('unit-tests', 'vitest', projectRoot, Date.now() - start);
+    }
     const vitestArgs = runTests
         ? ['run', '--reporter=default', '--coverage=false']
         : ['run', '--changed', '--reporter=default', '--coverage=false'];
     const description = runTests
-        ? `${vitest.command} run (full test suite, coverage off)`
-        : `${vitest.command} run --changed (tests for git-changed files only, coverage off)`;
-    const result = runCommand(vitest.command, [...vitest.args, ...vitestArgs], projectRoot, UNIT_TESTS_TIMEOUT_MS, vitest.shell);
+        ? `vitest run (full test suite, coverage off)`
+        : `vitest run --changed (tests for git-changed files only, coverage off)`;
+    const result = runCommand(vitest.command, [...vitest.args, ...vitestArgs], projectRoot, UNIT_TESTS_TIMEOUT_MS);
     const summary = parseVitestSummary(result.stdout, result.durationMs);
     // Vitest doesn't always print the per-bucket counts cleanly; infer "passed"
     // as total - failed - skipped when failed/skipped buckets are present.

package/dist/services/slice/slice-check-types.d.ts

@@ -6,10 +6,15 @@
  * 4 self-checks that must pass at slice end before the slice is handed
  * off to peaks-qa:
  *
- *   1. typecheck (`npx tsc --noEmit`)
+ *   1. typecheck — the project-local TypeScript entry
+ *      (`node_modules/typescript/bin/tsc`) run as `node <entry>`: no
+ *      `npx`, no shell. Gates on `-p tsconfig.build.json --noEmit`; the
+ *      wider `-p tsconfig.json --noEmit` count is reported against
+ *      `TYPECHECK_PREEXISTING_BASELINE` and gates only if it grows.
  *   2. unit tests — by default the **changed-only** suite
- *      (`npx vitest run --changed`). Pass `--run-tests` to opt in to the
- *      full suite (`npx vitest run`); pass `--skip-tests` to skip
+ *      (`vitest run --changed`, same `node <entry>` shape via
+ *      `node_modules/vitest/vitest.mjs`). Pass `--run-tests` to opt in to
+ *      the full suite (`vitest run`); pass `--skip-tests` to skip
  *      entirely (e.g. docs-only or config-only slices).
  *   3. 3-way review fan-out (code-review + security-review + perf-baseline)
  *   4. gate machinery (`peaks workflow verify-pipeline --rid <rid>`)
@@ -48,8 +53,8 @@ export type SliceCheckResult = {
     stages: SliceCheckStage[];
     /**
      * Which unit-test mode actually ran. One of:
-     * - `"changed"` — default: `npx vitest run --changed` (tests for git-changed files only)
-     * - `"full"` — opt-in via `--run-tests`: `npx vitest run` (full suite)
+     * - `"changed"` — default: `vitest run --changed` (tests for git-changed files only)
+     * - `"full"` — opt-in via `--run-tests`: `vitest run` (full suite)
      * - `"skipped"` — opt-in via `--skip-tests` (stage not executed)
      * - `"overridden"` — full mode + `--allow-pre-existing-failures` and the run failed;
      *   stage downgraded to `skipped` with the pre-existing-failure reason
@@ -73,9 +78,9 @@ export type SliceCheckOptions = {
      */
     refreshFanout: boolean;
     /**
-     * When true, run the **full** `npx vitest run` suite at the boundary.
+     * When true, run the **full** `vitest run` suite at the boundary.
      * When false (the default), run the **changed-only** suite
-     * (`npx vitest run --changed`) which only exercises tests related to
+     * (`vitest run --changed`) which only exercises tests related to
      * git-changed files. The changed-only mode is the new default as of
      * run 017 — full suite costs 30s+ on this repo; the changed-only
      * mode costs ~1-3s in steady state and is what catches the

package/dist/services/slice/slice-check-types.js

@@ -6,10 +6,15 @@
  * 4 self-checks that must pass at slice end before the slice is handed
  * off to peaks-qa:
  *
- *   1. typecheck (`npx tsc --noEmit`)
+ *   1. typecheck — the project-local TypeScript entry
+ *      (`node_modules/typescript/bin/tsc`) run as `node <entry>`: no
+ *      `npx`, no shell. Gates on `-p tsconfig.build.json --noEmit`; the
+ *      wider `-p tsconfig.json --noEmit` count is reported against
+ *      `TYPECHECK_PREEXISTING_BASELINE` and gates only if it grows.
  *   2. unit tests — by default the **changed-only** suite
- *      (`npx vitest run --changed`). Pass `--run-tests` to opt in to the
- *      full suite (`npx vitest run`); pass `--skip-tests` to skip
+ *      (`vitest run --changed`, same `node <entry>` shape via
+ *      `node_modules/vitest/vitest.mjs`). Pass `--run-tests` to opt in to
+ *      the full suite (`vitest run`); pass `--skip-tests` to skip
  *      entirely (e.g. docs-only or config-only slices).
  *   3. 3-way review fan-out (code-review + security-review + perf-baseline)
  *   4. gate machinery (`peaks workflow verify-pipeline --rid <rid>`)