peaks-loop 4.0.36 → 4.0.37

package/dist/services/session/getSessionDir.js

@@ -2,20 +2,25 @@
  * Canonical session-directory resolver.
  *
  * As of slice 2026-06-05-peaks-runtime-layer the per-session workspace
- * lives at `<root>/.peaks/_runtime/<sessionId>/` (NOT at the legacy
- * `<root>/.peaks/_runtime/<sessionId>/` location). All **write** paths MUST route
- * through this helper. The legacy top-level path is preserved as a
- * back-compat **read** fallback only (see
- * `src/services/artifacts/request-artifact-service.ts:662` etc.).
+ * lives at `<root>/.peaks/_runtime/<sessionId>/`, NOT at the legacy
+ * `<root>/.peaks/<sessionId>/` location. All **write** paths MUST route
+ * through this helper. The legacy top-level path survives only as a
+ * back-compat **read** fallback (see `legacySessionRoot` in
+ * `src/services/artifacts/artifact-prerequisites.ts` and `sessionOwnsSlice`
+ * in `src/services/sc/sc-service.ts`).
  *
- * The corresponding test in
  * `tests/unit/services/session/session-dir-canonical.test.ts` enforces
- * two invariants:
+ * three invariants:
  *
  *   (a) `getSessionDir(root, sid)` returns `<root>/.peaks/_runtime/<sid>`.
- *   (b) A static scan of `src/` flags any direct join of `.peaks` +
- *       `sessionId` that does NOT route through this resolver. The
- *       back-compat **read** sites are excluded by explicit allow-list.
+ *   (b) A static scan of `src/**` flags any `join()` chain that names
+ *       `.peaks` plus a session id without routing through this resolver,
+ *       wherever the id sits in the chain. The back-compat **read** sites
+ *       are exempted by an allow-list whose entries are asserted to be
+ *       load-bearing (an inert entry fails the scan).
+ *   (c) A static scan of every markdown file under `skills/` flags a
+ *       legacy `.peaks/<sid>/...` artifact path that a sub-agent would
+ *       follow verbatim.
  *
  * @param projectRoot - Absolute path to the project root.
  * @param sessionId - The session identifier (e.g. `2026-06-06-session-5b1095`).

package/dist/services/skills/hooks-codegate-superpowers.d.ts

@@ -15,7 +15,32 @@ interface ResolvedHookSpec {
     readonly hookEnforceSentinel: string;
     readonly hookEnforceMatcher: string;
     readonly hookEnforceEvent: string;
+    /**
+     * True when the gate-enforce entry must be materialized into the IDE's
+     * MACHINE-LOCAL settings file rather than the shared one (see
+     * `hookEnforceShell` below). Set for Claude Code, whose project-scope
+     * hooks have a gitignored per-machine sibling file.
+     */
+    readonly hookEnforceMachineLocal: boolean;
+    /**
+     * The `shell` field for the gate-enforce handler, or `undefined` to omit
+     * the key entirely and let the IDE use its documented default.
+     *
+     * Claude Code only. See `resolveHookShell` for why Windows needs this.
+     */
+    readonly hookEnforceShell: string | undefined;
 }
+/**
+ * Claude Code runs a shell-form hook command through a shell that defaults
+ * to bash — which on Windows means Git Bash, and MSYS2's bash
+ * force-allocates its own console window. The result is a visible window on
+ * EVERY Bash tool call. The window is created by the spawner (Claude Code)
+ * before any peaks code runs, so `windowsHide` and any in-process hiding
+ * cannot help; pinning the hook's `shell` is the only lever the hook schema
+ * offers. The platform-neutral default (`undefined` → omit the key) is kept
+ * everywhere else.
+ */
+export declare function resolveHookShell(platform?: NodeJS.Platform): string | undefined;
 export declare function resolveHookSpec(ide: IdeId): ResolvedHookSpec;
 /** A typed descriptor for a single peaks-managed hook entry. */
 export type PeaksHookEntry = {
@@ -23,6 +48,14 @@ export type PeaksHookEntry = {
     matcher: string;
     command: string;
     event: string;
+    /**
+     * When true the entry is written to the machine-local, gitignored settings
+     * file (`.claude/settings.local.json`) instead of the shared one, because
+     * the entry carries a machine-specific value (the `shell` field).
+     */
+    machineLocal?: boolean;
+    /** Optional `shell` field for the emitted handler. */
+    shell?: string;
 };
 /**
  * Slice 2026-08-06-codegate-vendor-neutral — code-gate hook entry.

package/dist/services/skills/hooks-codegate-superpowers.js

@@ -11,6 +11,19 @@ import { getAdapter } from '../ide/ide-registry.js';
 import { HOOK_OUTER_CACHE_COMMAND, HOOK_OUTER_CACHE_EVENT, HOOK_OUTER_CACHE_SENTINEL, HOOK_WORKSPACE_INIT_COMMAND, HOOK_WORKSPACE_INIT_EVENT, HOOK_WORKSPACE_INIT_SENTINEL } from './session-start-hook-constants.js';
 /** Sentinel substring identifying a Claude-Code gate-enforce hook entry. */
 export const HOOK_ENFORCE_SENTINEL = 'peaks gate enforce';
+/**
+ * Claude Code runs a shell-form hook command through a shell that defaults
+ * to bash — which on Windows means Git Bash, and MSYS2's bash
+ * force-allocates its own console window. The result is a visible window on
+ * EVERY Bash tool call. The window is created by the spawner (Claude Code)
+ * before any peaks code runs, so `windowsHide` and any in-process hiding
+ * cannot help; pinning the hook's `shell` is the only lever the hook schema
+ * offers. The platform-neutral default (`undefined` → omit the key) is kept
+ * everywhere else.
+ */
+export function resolveHookShell(platform = process.platform) {
+    return platform === 'win32' ? 'powershell' : undefined;
+}
 /**
  * Per-IDE hook command + sentinel. The default (Claude Code) uses the
  * legacy `peaks gate enforce` surface; Trae / Cursor / Codex (Cursor-style
@@ -42,11 +55,22 @@ export function resolveHookSpec(ide) {
         // silently writing a Claude-shaped entry to a non-Claude settings.json.
         throw new Error(`peaks hooks install: unsupported IDE '${ide}' (no HOOK_COMMAND_BY_IDE entry; add one to hooks-settings-service.ts)`);
     }
+    const isClaudeCode = ide === 'claude-code';
+    // Claude Code's gate hook must emit its structured decision as JSON:
+    // without `--json` the hook validator rejects the plain `{}` stdout with
+    // "Hook JSON output validation failed". See
+    // .peaks/memory/bash-pretooluse-hook-json-error-fix.md.
+    const jsonFlag = isClaudeCode ? ' --json' : '';
     return {
-        hookEnforceCommand: `${spec.command} --project "\${${adapter.envVar}}"`,
+        hookEnforceCommand: `${spec.command} --project "\${${adapter.envVar}}"${jsonFlag}`,
         hookEnforceSentinel: spec.sentinel,
         hookEnforceMatcher: adapter.toolMatcher,
-        hookEnforceEvent: adapter.hookEvent
+        hookEnforceEvent: adapter.hookEvent,
+        // Only Claude Code has the machine-local sibling settings file the
+        // routing depends on, and only Claude Code's hook schema accepts a
+        // `shell` key.
+        hookEnforceMachineLocal: isClaudeCode,
+        hookEnforceShell: isClaudeCode ? resolveHookShell() : undefined
     };
 }
 /**
@@ -64,7 +88,14 @@ export const HOOK_CODE_GATE_COMMAND = `peaks code-gate --json`;
 export function resolveHookEntries(ide, _skipProgress = false) {
     const spec = resolveHookSpec(ide);
     const entries = [
-        { sentinel: spec.hookEnforceSentinel, matcher: spec.hookEnforceMatcher, command: spec.hookEnforceCommand, event: spec.hookEnforceEvent }
+        {
+            sentinel: spec.hookEnforceSentinel,
+            matcher: spec.hookEnforceMatcher,
+            command: spec.hookEnforceCommand,
+            event: spec.hookEnforceEvent,
+            machineLocal: spec.hookEnforceMachineLocal,
+            ...(spec.hookEnforceShell !== undefined ? { shell: spec.hookEnforceShell } : {})
+        }
     ];
     if (ide === 'claude-code') {
         entries.push({

package/dist/services/skills/hooks-settings-service.d.ts

@@ -76,6 +76,13 @@ export type HookInstallPlan = {
     desiredCommand: string;
     sentinel: string;
     matcher: string;
+    /**
+     * Machine-local, gitignored settings file that the gate-enforce entry is
+     * written to instead of `settingsPath`. Undefined when the IDE has no such
+     * file (or the scope is global, where the settings file is already
+     * machine-local). See `resolveHookTargets`.
+     */
+    localSettingsPath?: string;
 };
 export type HookInstallResult = HookInstallPlan & {
     applied: boolean;
@@ -83,12 +90,15 @@ export type HookInstallResult = HookInstallPlan & {
 export type HookRemoveResult = {
     scope: HookScope;
     settingsPath: string;
+    localSettingsPath?: string;
     removed: boolean;
 };
 export type HookStatus = {
     scope: HookScope;
     settingsPath: string;
     exists: boolean;
+    localSettingsPath?: string;
+    localExists?: boolean;
     installed: boolean;
 };
 /**

package/dist/services/skills/hooks-settings-service.js

@@ -1,6 +1,6 @@
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { assertSafeSettingsFile } from '../ide/shared/safe-path.js';
 import { atomicWriteJson, readJsonObjectFile } from '../ide/shared/atomic-json.js';
 import { getAdapter } from '../ide/ide-registry.js';
@@ -44,6 +44,43 @@ function assertSafeSettingsPathCompat(scope, ide, root, settingsPath) {
         throw new Error(`settings path drift: ${expected} vs ${settingsPath}`);
     }
 }
+/** Machine-local sibling of the adapter's settings file (Claude Code convention). */
+const LOCAL_SETTINGS_FILE_NAME = 'settings.local.json';
+/** IDEs whose hook settings have a machine-local, gitignored sibling file. */
+const IDES_WITH_LOCAL_SETTINGS = new Set(['claude-code']);
+/**
+ * Resolve the machine-local settings file an IDE may carry (e.g. Claude
+ * Code's `.claude/settings.local.json`), or `undefined` when there is none.
+ *
+ * Global scope resolves to `undefined`: the global settings file
+ * (`~/.claude/settings.json`) is already machine-local, so nothing needs
+ * relocating there.
+ */
+function resolveLocalSettingsPath(scope, ide, projectRoot) {
+    if (scope === 'global' || !IDES_WITH_LOCAL_SETTINGS.has(ide))
+        return undefined;
+    const root = resolveSettingsRoot(scope, projectRoot);
+    const adapter = getAdapter(ide);
+    assertSafeSettingsFile(scope, root, adapter.settings.dirName, LOCAL_SETTINGS_FILE_NAME);
+    return join(root, adapter.settings.dirName, LOCAL_SETTINGS_FILE_NAME);
+}
+function resolveHookTargets(scope, ide, projectRoot) {
+    const sharedPath = resolveSettingsPath(scope, ide, projectRoot);
+    const localPath = resolveLocalSettingsPath(scope, ide, projectRoot);
+    const shared = { settingsPath: sharedPath, entries: [] };
+    if (localPath === undefined || localPath === sharedPath) {
+        return [{ settingsPath: sharedPath, entries: [...resolveHookEntries(ide)] }];
+    }
+    const local = { settingsPath: localPath, entries: [] };
+    for (const entry of resolveHookEntries(ide)) {
+        (entry.machineLocal === true ? local : shared).entries.push(entry);
+    }
+    return [shared, local];
+}
+/** Read a settings file as an object, or `{}` when it does not exist yet. */
+function readSettingsFile(settingsPath) {
+    return existsSync(settingsPath) ? readJsonObjectFile(settingsPath) : {};
+}
 /** Read the existing hook array entries for the adapter's hookEvent (tolerant of any prior shape). */
 function readHookEventEntries(settings, eventKey) {
     const hooks = settings.hooks;
@@ -209,8 +246,7 @@ export const PEAKS_HOOK_ENTRIES = (() => {
         { sentinel: spec.hookEnforceSentinel, matcher: spec.hookEnforceMatcher, command: spec.hookEnforceCommand, event: spec.hookEnforceEvent }
     ];
 })();
-function isInstalledForIde(settings, ide) {
-    const entries = resolveHookEntries(ide);
+function isInstalledForEntries(settings, entries) {
     const sentinels = entries.map((e) => e.sentinel);
     // Check every distinct event key our entries could be on.
     const eventKeys = new Set(entries.map((e) => e.event));
@@ -230,12 +266,14 @@ function isInstalledForIde(settings, ide) {
  * fully reflected on disk: gate-enforce present AND no legacy
  * progress-start present.
  */
-function shapeMatchesDesired(settings, ide) {
-    const desiredEntries = resolveHookEntries(ide);
-    const desiredSentinels = new Set(desiredEntries.map((e) => e.sentinel));
-    const allPeaksSentinels = resolveLegacySentinels(ide);
-    const eventKeys = new Set(resolveHookEntries(ide).map((e) => e.event));
+function shapeMatchesDesired(settings, entries, allPeaksSentinels) {
+    const eventKeys = new Set(entries.map((e) => e.event));
     for (const eventKey of eventKeys) {
+        // Only the entries that belong to THIS event key can be expected on it —
+        // the desired set must be per-event, or a target whose entries span two
+        // event keys (claude-code: SessionStart + PreToolUse) would never look
+        // installed and every `peaks hooks install` would rewrite the files.
+        const desiredSentinels = new Set(entries.filter((e) => e.event === eventKey).map((e) => e.sentinel));
         const present = readHookEventEntries(settings, eventKey);
         const peaksPresent = present.filter((e) => entryIsPeaksManaged(e, allPeaksSentinels));
         // (a) every peaks-managed entry currently on disk must match the
@@ -261,29 +299,36 @@ export function planHookInstall(scope, projectRoot, options) {
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
     const spec = resolveHookSpec(ide);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
     return {
         scope,
         settingsPath,
         exists,
-        alreadyInstalled: isInstalledForIde(settings, ide),
+        alreadyInstalled: targets.every((t) => isInstalledForEntries(readSettingsFile(t.settingsPath), t.entries)),
         desiredCommand: spec.hookEnforceCommand,
         sentinel: spec.hookEnforceSentinel,
-        matcher: spec.hookEnforceMatcher
+        matcher: spec.hookEnforceMatcher,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
     };
 }
-/** Merge all peaks-managed hook entries into settings, preserving all other keys and hooks. */
-function withHooksInstalledForIde(settings, ide, _skipProgress = false) {
+/**
+ * Merge a target's peaks-managed hook entries into `settings`, preserving
+ * all other keys and hooks. Entries routed to a DIFFERENT settings file are
+ * not part of `entries`, so the legacy-sentinel filter below strips them
+ * from this file (that is what migrates a gate-enforce entry that an older
+ * peaks release wrote into the shared file).
+ */
+function withHooksInstalled(settings, entries, allSentinels) {
     const existingHooks = (settings.hooks && typeof settings.hooks === 'object' && !Array.isArray(settings.hooks))
         ? settings.hooks
         : {};
-    // Per-IDE entries may map to different events (Trae: gate-enforce on
-    // beforeToolCall; Claude: gate-enforce on PreToolUse). Group by event
-    // so each event array is independently merged.
+    // Our entries may sit on more than one event key. Group by event so each
+    // event array is independently merged.
     const ourByEvent = new Map();
-    for (const spec of resolveHookEntries(ide)) {
+    for (const spec of entries) {
         const list = ourByEvent.get(spec.event) ?? [];
         list.push(spec);
         ourByEvent.set(spec.event, list);
@@ -293,14 +338,16 @@ function withHooksInstalledForIde(settings, ide, _skipProgress = false) {
     // stripped by the filter (the file converges on the new
     // gate-enforce-only shape, idempotently). The desired set (passed
     // in below) only contains the gate-enforce sentinel.
-    const allSentinels = resolveLegacySentinels(ide);
     const nextHooks = { ...existingHooks };
-    for (const [eventKey, ourEntries] of ourByEvent) {
+    // An event key this file used to carry but whose entries all moved to the
+    // other file still needs its stale peaks entries stripped.
+    const eventKeys = new Set([...ourByEvent.keys(), ...Object.keys(existingHooks)]);
+    for (const eventKey of eventKeys) {
         const existing = readHookEntriesFromHooks(nextHooks, eventKey);
         const nonPeaks = existing.filter((entry) => !entryIsPeaksManaged(entry, allSentinels));
-        const ourFormatted = ourEntries.map((spec) => ({
+        const ourFormatted = (ourByEvent.get(eventKey) ?? []).map((spec) => ({
             matcher: spec.matcher,
-            hooks: [{ type: 'command', command: spec.command }]
+            hooks: [{ type: 'command', command: spec.command, ...(spec.shell !== undefined ? { shell: spec.shell } : {}) }]
         }));
         const merged = [...nonPeaks, ...ourFormatted];
         if (merged.length > 0) {
@@ -322,15 +369,17 @@ export function applyHookInstall(scope, projectRoot, options) {
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
     const spec = resolveHookSpec(ide);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
+    const allSentinels = resolveLegacySentinels(ide);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
     // Slice #014: `alreadyInstalled` reflects the FULL desired shape
     // (gate-enforce-only + no stale progress-start entry). Pre-#014
     // installs that left a progress-start entry behind will be treated
     // as not-yet-installed, so the merge strips the stale entry on the
     // next install call. This is the only path that converges the file
     // on the new shape; pure presence-checks are insufficient.
-    const alreadyInstalled = shapeMatchesDesired(settings, ide);
+    const alreadyInstalled = targets.every((t) => shapeMatchesDesired(readSettingsFile(t.settingsPath), t.entries, allSentinels));
     const baseResult = {
         scope,
         settingsPath,
@@ -338,7 +387,8 @@ export function applyHookInstall(scope, projectRoot, options) {
         alreadyInstalled,
         desiredCommand: spec.hookEnforceCommand,
         sentinel: spec.hookEnforceSentinel,
-        matcher: spec.hookEnforceMatcher
+        matcher: spec.hookEnforceMatcher,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
     };
     if (baseResult.alreadyInstalled) {
         return { ...baseResult, applied: false };
@@ -356,8 +406,17 @@ export function applyHookInstall(scope, projectRoot, options) {
     // entry. The chain cannot run raw `git worktree add` (or
     // `podman run`) without an explicit `peaks hooks uninstall`
     // first. Both helpers are pure + idempotent.
-    const merged = withTriggeredDenyList(withSuperpowersSkillDenylist(withHooksInstalledForIde(settings, ide)));
-    atomicWriteJson(settingsPath, merged);
+    //
+    // The `permissions.deny` block lives in the adapter's settings file
+    // only (as it always has) — it is committed, so the deny list is
+    // shared; the machine-local file carries hook entries only.
+    for (const target of targets) {
+        const next = withHooksInstalled(readSettingsFile(target.settingsPath), target.entries, allSentinels);
+        const merged = target.settingsPath === settingsPath
+            ? withTriggeredDenyList(withSuperpowersSkillDenylist(next))
+            : next;
+        atomicWriteJson(target.settingsPath, merged);
+    }
     return { ...baseResult, alreadyInstalled: false, applied: true };
 }
 export function removeHookInstall(scope, projectRoot, options) {
@@ -365,60 +424,92 @@ export function removeHookInstall(scope, projectRoot, options) {
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
-    if (!existsSync(settingsPath)) {
-        return { scope, settingsPath, removed: false };
+    const targets = resolveHookTargets(scope, ide, projectRoot);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
+    const present = targets.filter((t) => existsSync(t.settingsPath));
+    if (present.length === 0) {
+        return {
+            scope,
+            settingsPath,
+            removed: false,
+            ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
+        };
     }
-    const settings = readJsonObjectFile(settingsPath);
-    const existingHooks = settings.hooks ?? {};
     // Slice #014: uninstall must remove the gate-enforce entry AND any
     // legacy progress-start entry that a pre-#014 install left behind.
     // The legacy sentinel set covers both shapes so the uninstall
     // converges the file on "no peaks-managed entries", regardless of
     // what shape the file was in when the user ran uninstall.
     const sentinels = resolveLegacySentinels(ide);
-    const eventKeys = new Set(resolveHookEntries(ide).map((e) => e.event));
     let removedAny = false;
-    const nextHooks = { ...existingHooks };
-    for (const eventKey of eventKeys) {
-        const entries = readHookEntriesFromHooks(nextHooks, eventKey);
-        const kept = entries.filter((entry) => !entryIsPeaksManaged(entry, sentinels));
-        if (kept.length !== entries.length)
-            removedAny = true;
-        if (kept.length > 0) {
-            nextHooks[eventKey] = kept;
+    for (const target of present) {
+        const settings = readJsonObjectFile(target.settingsPath);
+        const existingHooks = settings.hooks ?? {};
+        // Scan every event key on disk as well as the ones we install on:
+        // entries may have been routed to the other settings file by a
+        // previous install.
+        const eventKeys = new Set([...target.entries.map((e) => e.event), ...Object.keys(existingHooks)]);
+        const nextHooks = { ...existingHooks };
+        for (const eventKey of eventKeys) {
+            const entries = readHookEntriesFromHooks(nextHooks, eventKey);
+            const kept = entries.filter((entry) => !entryIsPeaksManaged(entry, sentinels));
+            if (kept.length !== entries.length)
+                removedAny = true;
+            if (kept.length > 0) {
+                nextHooks[eventKey] = kept;
+            }
+            else {
+                delete nextHooks[eventKey];
+            }
+        }
+        const nextSettings = { ...settings };
+        if (Object.keys(nextHooks).length > 0) {
+            nextSettings.hooks = nextHooks;
         }
         else {
-            delete nextHooks[eventKey];
+            delete nextSettings.hooks;
         }
+        // Slice 2026-07-29-worktree-layer3-deny: Layer 3 — symmetric uninstall.
+        // Strips the peaks-managed `UseSkill(...)` deny entries alongside the
+        // hook entries; user-written entries are untouched. The helper self-
+        // decomposes an empty `permissions` object.
+        //
+        // Slice 2026-07-29-worktree-l2-extended Part 29: also strip the
+        // trigger-style deny entries via withoutTriggeredDenyList. The
+        // chain of helpers is order-independent (each is idempotent and
+        // additive over the same set of peaks-managed entries).
+        const finalSettings = target.settingsPath === settingsPath
+            ? withoutTriggeredDenyList(withoutSuperpowersSkillDenylist(nextSettings))
+            : nextSettings;
+        atomicWriteJson(target.settingsPath, finalSettings);
     }
-    const nextSettings = { ...settings };
-    if (Object.keys(nextHooks).length > 0) {
-        nextSettings.hooks = nextHooks;
-    }
-    else {
-        delete nextSettings.hooks;
-    }
-    // Slice 2026-07-29-worktree-layer3-deny: Layer 3 — symmetric uninstall.
-    // Strips the peaks-managed `UseSkill(...)` deny entries alongside the
-    // hook entries; user-written entries are untouched. The helper self-
-    // decomposes an empty `permissions` object.
-    //
-    // Slice 2026-07-29-worktree-l2-extended Part 29: also strip the
-    // trigger-style deny entries via withoutTriggeredDenyList. The
-    // chain of helpers is order-independent (each is idempotent and
-    // additive over the same set of peaks-managed entries).
-    const finalSettings = withoutTriggeredDenyList(withoutSuperpowersSkillDenylist(nextSettings));
-    atomicWriteJson(settingsPath, finalSettings);
-    return { scope, settingsPath, removed: removedAny };
+    return {
+        scope,
+        settingsPath,
+        removed: removedAny,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
+    };
 }
 export function readHookStatus(scope, projectRoot, options) {
     const ide = resolveIde(options);
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
-    return { scope, settingsPath, exists, installed: isInstalledForIde(settings, ide) };
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
+    return {
+        scope,
+        settingsPath,
+        exists,
+        ...(localTarget !== undefined
+            ? { localSettingsPath: localTarget.settingsPath, localExists: existsSync(localTarget.settingsPath) }
+            : {}),
+        installed: targets.some((t) => {
+            const settings = readSettingsFile(t.settingsPath);
+            return Object.keys(settings).length > 0 && isInstalledForEntries(settings, t.entries);
+        })
+    };
 }
 /**
  * Slice 2026-07-29-worktree-l2-extended Part 27 — trigger-style deny.

package/dist/services/slice/slice-check-service.d.ts

@@ -1,2 +1,16 @@
 import type { SliceCheckOptions, SliceCheckResult } from './slice-check-types.js';
+/**
+ * 2026-09-10 D1-follow-up (G5): `tsconfig.build.json` is the type contract the
+ * package actually ships (`src/**` only) and it is clean, so the typecheck
+ * stage GATES on it. The wider `tsconfig.json` adds `tests/**`, which still
+ * carries errors this slice did not cause — 142 as measured on 2026-09-10
+ * (`pnpm exec tsc -p tsconfig.json --noEmit 2>&1 | grep -c "error TS"`), all
+ * of them under `tests/`, none under `src/`. That count is therefore a
+ * baseline, not a gate: the stage fails only when it GROWS, which is the
+ * question "did this slice add a type error anywhere?". Re-measure and update
+ * this constant when the residue is paid down.
+ */
+export declare const TYPECHECK_PREEXISTING_BASELINE = 142;
+/** Named code for "the CLI this stage needs is not installed". */
+export declare const BINARY_UNRESOLVED_CODE = "SLICE_CHECK_BINARY_UNRESOLVED";
 export declare function sliceCheck(options: SliceCheckOptions): Promise<SliceCheckResult>;