peaks-loop 4.0.36 → 4.0.38

package/dist/services/skills/hooks-settings-service.d.ts

@@ -68,6 +68,20 @@ export type HookInstallOptions = {
 };
 /** Default (claude-code) hook command — kept as a stable export for tests. */
 export declare const HOOK_ENFORCE_COMMAND = "peaks gate enforce --project \"${CLAUDE_PROJECT_DIR}\" --json";
+/**
+ * One peaks-managed entry paired with the settings file it is (or will be)
+ * written to.
+ *
+ * `entries` is a flat list of the same matcher/sentinel pairs, which reads as
+ * "written to `settingsPath`" even when the entry is routed to the other file
+ * (see `resolveHookTargets`). This carries the routing explicitly so the
+ * dry-run can name the real target without a real run.
+ */
+export type HookEntryTarget = {
+    matcher: string;
+    sentinel: string;
+    settingsPath: string;
+};
 export type HookInstallPlan = {
     scope: HookScope;
     settingsPath: string;
@@ -76,6 +90,15 @@ export type HookInstallPlan = {
     desiredCommand: string;
     sentinel: string;
     matcher: string;
+    /**
+     * Machine-local, gitignored settings file that the gate-enforce entry is
+     * written to instead of `settingsPath`. Undefined when the IDE has no such
+     * file (or the scope is global, where the settings file is already
+     * machine-local). See `resolveHookTargets`.
+     */
+    localSettingsPath?: string;
+    /** Every entry the install writes, paired with its target file. */
+    entryTargets: ReadonlyArray<HookEntryTarget>;
 };
 export type HookInstallResult = HookInstallPlan & {
     applied: boolean;
@@ -83,12 +106,15 @@ export type HookInstallResult = HookInstallPlan & {
 export type HookRemoveResult = {
     scope: HookScope;
     settingsPath: string;
+    localSettingsPath?: string;
     removed: boolean;
 };
 export type HookStatus = {
     scope: HookScope;
     settingsPath: string;
     exists: boolean;
+    localSettingsPath?: string;
+    localExists?: boolean;
     installed: boolean;
 };
 /**

package/dist/services/skills/hooks-settings-service.js

@@ -1,10 +1,10 @@
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { assertSafeSettingsFile } from '../ide/shared/safe-path.js';
 import { atomicWriteJson, readJsonObjectFile } from '../ide/shared/atomic-json.js';
 import { getAdapter } from '../ide/ide-registry.js';
-import { resolveHookSpec, resolveHookEntries, resolveLegacySentinels, SUPERPOWERS_DENIED_SKILLS, formatSuperpowersDenyEntry, SUPERPOWERS_DENY_SENTINELS } from './hooks-codegate-superpowers.js';
+import { resolveHookSpec, resolveHookEntries, resolveLegacySentinels, SUPERPOWERS_DENIED_SKILLS, formatSuperpowersDenyEntry, SUPERPOWERS_DENY_SENTINELS, hasExternalGateExemptions, withExternalGateExemptions, withoutExternalGateExemptions } from './hooks-codegate-superpowers.js';
 export { HOOK_ENFORCE_SENTINEL, HOOK_CODE_GATE_SENTINEL, HOOK_CODE_GATE_MATCHER, HOOK_CODE_GATE_EVENT, HOOK_CODE_GATE_COMMAND, SUPERPOWERS_DENIED_SKILLS } from './hooks-codegate-superpowers.js';
 // --- Module-level defaults (claude-code) -----------------------------------
 // These exports remain for backward compat — tests and downstream callers
@@ -44,6 +44,57 @@ function assertSafeSettingsPathCompat(scope, ide, root, settingsPath) {
         throw new Error(`settings path drift: ${expected} vs ${settingsPath}`);
     }
 }
+/** Machine-local sibling of the adapter's settings file (Claude Code convention). */
+const LOCAL_SETTINGS_FILE_NAME = 'settings.local.json';
+/** IDEs whose hook settings have a machine-local, gitignored sibling file. */
+const IDES_WITH_LOCAL_SETTINGS = new Set(['claude-code']);
+/**
+ * Resolve the machine-local settings file an IDE may carry (e.g. Claude
+ * Code's `.claude/settings.local.json`), or `undefined` when there is none.
+ *
+ * Global scope resolves to `undefined`: the global settings file
+ * (`~/.claude/settings.json`) is already machine-local, so nothing needs
+ * relocating there.
+ */
+function resolveLocalSettingsPath(scope, ide, projectRoot) {
+    if (scope === 'global' || !IDES_WITH_LOCAL_SETTINGS.has(ide))
+        return undefined;
+    const root = resolveSettingsRoot(scope, projectRoot);
+    const adapter = getAdapter(ide);
+    assertSafeSettingsFile(scope, root, adapter.settings.dirName, LOCAL_SETTINGS_FILE_NAME);
+    return join(root, adapter.settings.dirName, LOCAL_SETTINGS_FILE_NAME);
+}
+function resolveHookTargets(scope, ide, projectRoot) {
+    const sharedPath = resolveSettingsPath(scope, ide, projectRoot);
+    const localPath = resolveLocalSettingsPath(scope, ide, projectRoot);
+    const wantsEnvExemptions = ide === 'claude-code';
+    if (localPath === undefined || localPath === sharedPath) {
+        // Global scope lands here: the user-level file is already machine-local,
+        // so it is the safe target (there is no sibling to prefer).
+        return [{ settingsPath: sharedPath, entries: [...resolveHookEntries(ide)], envExemptions: wantsEnvExemptions }];
+    }
+    const shared = { settingsPath: sharedPath, entries: [] };
+    const local = { settingsPath: localPath, entries: [], envExemptions: wantsEnvExemptions };
+    for (const entry of resolveHookEntries(ide)) {
+        (entry.machineLocal === true ? local : shared).entries.push(entry);
+    }
+    return [shared, local];
+}
+/** True when `target` already holds everything the install would write to it. */
+function targetIsSatisfied(target, allSentinels) {
+    const settings = readSettingsFile(target.settingsPath);
+    if (!shapeMatchesDesired(settings, target.entries, allSentinels))
+        return false;
+    return target.envExemptions !== true || hasExternalGateExemptions(settings);
+}
+/** Flatten the resolved targets into one `{ matcher, sentinel, settingsPath }` row per entry. */
+function describeEntryTargets(targets) {
+    return targets.flatMap((target) => target.entries.map((entry) => ({ matcher: entry.matcher, sentinel: entry.sentinel, settingsPath: target.settingsPath })));
+}
+/** Read a settings file as an object, or `{}` when it does not exist yet. */
+function readSettingsFile(settingsPath) {
+    return existsSync(settingsPath) ? readJsonObjectFile(settingsPath) : {};
+}
 /** Read the existing hook array entries for the adapter's hookEvent (tolerant of any prior shape). */
 function readHookEventEntries(settings, eventKey) {
     const hooks = settings.hooks;
@@ -209,8 +260,7 @@ export const PEAKS_HOOK_ENTRIES = (() => {
         { sentinel: spec.hookEnforceSentinel, matcher: spec.hookEnforceMatcher, command: spec.hookEnforceCommand, event: spec.hookEnforceEvent }
     ];
 })();
-function isInstalledForIde(settings, ide) {
-    const entries = resolveHookEntries(ide);
+function isInstalledForEntries(settings, entries) {
     const sentinels = entries.map((e) => e.sentinel);
     // Check every distinct event key our entries could be on.
     const eventKeys = new Set(entries.map((e) => e.event));
@@ -230,12 +280,14 @@ function isInstalledForIde(settings, ide) {
  * fully reflected on disk: gate-enforce present AND no legacy
  * progress-start present.
  */
-function shapeMatchesDesired(settings, ide) {
-    const desiredEntries = resolveHookEntries(ide);
-    const desiredSentinels = new Set(desiredEntries.map((e) => e.sentinel));
-    const allPeaksSentinels = resolveLegacySentinels(ide);
-    const eventKeys = new Set(resolveHookEntries(ide).map((e) => e.event));
+function shapeMatchesDesired(settings, entries, allPeaksSentinels) {
+    const eventKeys = new Set(entries.map((e) => e.event));
     for (const eventKey of eventKeys) {
+        // Only the entries that belong to THIS event key can be expected on it —
+        // the desired set must be per-event, or a target whose entries span two
+        // event keys (claude-code: SessionStart + PreToolUse) would never look
+        // installed and every `peaks hooks install` would rewrite the files.
+        const desiredSentinels = new Set(entries.filter((e) => e.event === eventKey).map((e) => e.sentinel));
         const present = readHookEventEntries(settings, eventKey);
         const peaksPresent = present.filter((e) => entryIsPeaksManaged(e, allPeaksSentinels));
         // (a) every peaks-managed entry currently on disk must match the
@@ -261,29 +313,42 @@ export function planHookInstall(scope, projectRoot, options) {
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
     const spec = resolveHookSpec(ide);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
     return {
         scope,
         settingsPath,
         exists,
-        alreadyInstalled: isInstalledForIde(settings, ide),
+        // The env clause mirrors `applyHookInstall`'s: without it the dry-run would
+        // claim "nothing to do" about a file the install is going to write.
+        alreadyInstalled: targets.every((t) => {
+            const settings = readSettingsFile(t.settingsPath);
+            return isInstalledForEntries(settings, t.entries) && (t.envExemptions !== true || hasExternalGateExemptions(settings));
+        }),
         desiredCommand: spec.hookEnforceCommand,
         sentinel: spec.hookEnforceSentinel,
-        matcher: spec.hookEnforceMatcher
+        matcher: spec.hookEnforceMatcher,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {}),
+        entryTargets: describeEntryTargets(targets)
     };
 }
-/** Merge all peaks-managed hook entries into settings, preserving all other keys and hooks. */
-function withHooksInstalledForIde(settings, ide, _skipProgress = false) {
+/**
+ * Merge a target's peaks-managed hook entries into `settings`, preserving
+ * all other keys and hooks. Entries routed to a DIFFERENT settings file are
+ * not part of `entries`, so the legacy-sentinel filter below strips them
+ * from this file (that is what migrates a gate-enforce entry that an older
+ * peaks release wrote into the shared file).
+ */
+function withHooksInstalled(settings, entries, allSentinels) {
     const existingHooks = (settings.hooks && typeof settings.hooks === 'object' && !Array.isArray(settings.hooks))
         ? settings.hooks
         : {};
-    // Per-IDE entries may map to different events (Trae: gate-enforce on
-    // beforeToolCall; Claude: gate-enforce on PreToolUse). Group by event
-    // so each event array is independently merged.
+    // Our entries may sit on more than one event key. Group by event so each
+    // event array is independently merged.
     const ourByEvent = new Map();
-    for (const spec of resolveHookEntries(ide)) {
+    for (const spec of entries) {
         const list = ourByEvent.get(spec.event) ?? [];
         list.push(spec);
         ourByEvent.set(spec.event, list);
@@ -293,14 +358,16 @@ function withHooksInstalledForIde(settings, ide, _skipProgress = false) {
     // stripped by the filter (the file converges on the new
     // gate-enforce-only shape, idempotently). The desired set (passed
     // in below) only contains the gate-enforce sentinel.
-    const allSentinels = resolveLegacySentinels(ide);
     const nextHooks = { ...existingHooks };
-    for (const [eventKey, ourEntries] of ourByEvent) {
+    // An event key this file used to carry but whose entries all moved to the
+    // other file still needs its stale peaks entries stripped.
+    const eventKeys = new Set([...ourByEvent.keys(), ...Object.keys(existingHooks)]);
+    for (const eventKey of eventKeys) {
         const existing = readHookEntriesFromHooks(nextHooks, eventKey);
         const nonPeaks = existing.filter((entry) => !entryIsPeaksManaged(entry, allSentinels));
-        const ourFormatted = ourEntries.map((spec) => ({
+        const ourFormatted = (ourByEvent.get(eventKey) ?? []).map((spec) => ({
             matcher: spec.matcher,
-            hooks: [{ type: 'command', command: spec.command }]
+            hooks: [{ type: 'command', command: spec.command, ...(spec.shell !== undefined ? { shell: spec.shell } : {}) }]
         }));
         const merged = [...nonPeaks, ...ourFormatted];
         if (merged.length > 0) {
@@ -322,15 +389,20 @@ export function applyHookInstall(scope, projectRoot, options) {
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
     const spec = resolveHookSpec(ide);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
+    const allSentinels = resolveLegacySentinels(ide);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
     // Slice #014: `alreadyInstalled` reflects the FULL desired shape
     // (gate-enforce-only + no stale progress-start entry). Pre-#014
     // installs that left a progress-start entry behind will be treated
     // as not-yet-installed, so the merge strips the stale entry on the
     // next install call. This is the only path that converges the file
     // on the new shape; pure presence-checks are insufficient.
-    const alreadyInstalled = shapeMatchesDesired(settings, ide);
+    //
+    // The external-gate exemption is part of the desired shape too, so a project
+    // installed by a release that predates it still converges on upgrade.
+    const alreadyInstalled = targets.every((t) => targetIsSatisfied(t, allSentinels));
     const baseResult = {
         scope,
         settingsPath,
@@ -338,7 +410,9 @@ export function applyHookInstall(scope, projectRoot, options) {
         alreadyInstalled,
         desiredCommand: spec.hookEnforceCommand,
         sentinel: spec.hookEnforceSentinel,
-        matcher: spec.hookEnforceMatcher
+        matcher: spec.hookEnforceMatcher,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {}),
+        entryTargets: describeEntryTargets(targets)
     };
     if (baseResult.alreadyInstalled) {
         return { ...baseResult, applied: false };
@@ -356,8 +430,22 @@ export function applyHookInstall(scope, projectRoot, options) {
     // entry. The chain cannot run raw `git worktree add` (or
     // `podman run`) without an explicit `peaks hooks uninstall`
     // first. Both helpers are pure + idempotent.
-    const merged = withTriggeredDenyList(withSuperpowersSkillDenylist(withHooksInstalledForIde(settings, ide)));
-    atomicWriteJson(settingsPath, merged);
+    //
+    // The `permissions.deny` block lives in the adapter's settings file
+    // only (as it always has) — it is committed, so the deny list is
+    // shared; the machine-local file carries hook entries plus, for Claude
+    // Code, the third-party gate exemptions (machine-local by the same
+    // argument as the hook `shell` pin).
+    for (const target of targets) {
+        let next = withHooksInstalled(readSettingsFile(target.settingsPath), target.entries, allSentinels);
+        if (target.envExemptions === true) {
+            next = withExternalGateExemptions(next);
+        }
+        const merged = target.settingsPath === settingsPath
+            ? withTriggeredDenyList(withSuperpowersSkillDenylist(next))
+            : next;
+        atomicWriteJson(target.settingsPath, merged);
+    }
     return { ...baseResult, alreadyInstalled: false, applied: true };
 }
 export function removeHookInstall(scope, projectRoot, options) {
@@ -365,60 +453,96 @@ export function removeHookInstall(scope, projectRoot, options) {
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
-    if (!existsSync(settingsPath)) {
-        return { scope, settingsPath, removed: false };
+    const targets = resolveHookTargets(scope, ide, projectRoot);
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
+    const present = targets.filter((t) => existsSync(t.settingsPath));
+    if (present.length === 0) {
+        return {
+            scope,
+            settingsPath,
+            removed: false,
+            ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
+        };
     }
-    const settings = readJsonObjectFile(settingsPath);
-    const existingHooks = settings.hooks ?? {};
     // Slice #014: uninstall must remove the gate-enforce entry AND any
     // legacy progress-start entry that a pre-#014 install left behind.
     // The legacy sentinel set covers both shapes so the uninstall
     // converges the file on "no peaks-managed entries", regardless of
     // what shape the file was in when the user ran uninstall.
     const sentinels = resolveLegacySentinels(ide);
-    const eventKeys = new Set(resolveHookEntries(ide).map((e) => e.event));
     let removedAny = false;
-    const nextHooks = { ...existingHooks };
-    for (const eventKey of eventKeys) {
-        const entries = readHookEntriesFromHooks(nextHooks, eventKey);
-        const kept = entries.filter((entry) => !entryIsPeaksManaged(entry, sentinels));
-        if (kept.length !== entries.length)
-            removedAny = true;
-        if (kept.length > 0) {
-            nextHooks[eventKey] = kept;
+    for (const target of present) {
+        const settings = readJsonObjectFile(target.settingsPath);
+        const existingHooks = settings.hooks ?? {};
+        // Scan every event key on disk as well as the ones we install on:
+        // entries may have been routed to the other settings file by a
+        // previous install.
+        const eventKeys = new Set([...target.entries.map((e) => e.event), ...Object.keys(existingHooks)]);
+        const nextHooks = { ...existingHooks };
+        for (const eventKey of eventKeys) {
+            const entries = readHookEntriesFromHooks(nextHooks, eventKey);
+            const kept = entries.filter((entry) => !entryIsPeaksManaged(entry, sentinels));
+            if (kept.length !== entries.length)
+                removedAny = true;
+            if (kept.length > 0) {
+                nextHooks[eventKey] = kept;
+            }
+            else {
+                delete nextHooks[eventKey];
+            }
+        }
+        const nextSettings = { ...settings };
+        if (Object.keys(nextHooks).length > 0) {
+            nextSettings.hooks = nextHooks;
         }
         else {
-            delete nextHooks[eventKey];
+            delete nextSettings.hooks;
         }
+        // Slice 2026-07-29-worktree-layer3-deny: Layer 3 — symmetric uninstall.
+        // Strips the peaks-managed `UseSkill(...)` deny entries alongside the
+        // hook entries; user-written entries are untouched. The helper self-
+        // decomposes an empty `permissions` object.
+        //
+        // Slice 2026-07-29-worktree-l2-extended Part 29: also strip the
+        // trigger-style deny entries via withoutTriggeredDenyList. The
+        // chain of helpers is order-independent (each is idempotent and
+        // additive over the same set of peaks-managed entries).
+        let finalSettings = nextSettings;
+        if (target.envExemptions === true) {
+            finalSettings = withoutExternalGateExemptions(finalSettings);
+        }
+        if (target.settingsPath === settingsPath) {
+            finalSettings = withoutTriggeredDenyList(withoutSuperpowersSkillDenylist(finalSettings));
+        }
+        atomicWriteJson(target.settingsPath, finalSettings);
     }
-    const nextSettings = { ...settings };
-    if (Object.keys(nextHooks).length > 0) {
-        nextSettings.hooks = nextHooks;
-    }
-    else {
-        delete nextSettings.hooks;
-    }
-    // Slice 2026-07-29-worktree-layer3-deny: Layer 3 — symmetric uninstall.
-    // Strips the peaks-managed `UseSkill(...)` deny entries alongside the
-    // hook entries; user-written entries are untouched. The helper self-
-    // decomposes an empty `permissions` object.
-    //
-    // Slice 2026-07-29-worktree-l2-extended Part 29: also strip the
-    // trigger-style deny entries via withoutTriggeredDenyList. The
-    // chain of helpers is order-independent (each is idempotent and
-    // additive over the same set of peaks-managed entries).
-    const finalSettings = withoutTriggeredDenyList(withoutSuperpowersSkillDenylist(nextSettings));
-    atomicWriteJson(settingsPath, finalSettings);
-    return { scope, settingsPath, removed: removedAny };
+    return {
+        scope,
+        settingsPath,
+        removed: removedAny,
+        ...(localTarget !== undefined ? { localSettingsPath: localTarget.settingsPath } : {})
+    };
 }
 export function readHookStatus(scope, projectRoot, options) {
     const ide = resolveIde(options);
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
+    const targets = resolveHookTargets(scope, ide, projectRoot);
     const exists = existsSync(settingsPath);
-    const settings = exists ? readJsonObjectFile(settingsPath) : {};
-    return { scope, settingsPath, exists, installed: isInstalledForIde(settings, ide) };
+    const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
+    return {
+        scope,
+        settingsPath,
+        exists,
+        ...(localTarget !== undefined
+            ? { localSettingsPath: localTarget.settingsPath, localExists: existsSync(localTarget.settingsPath) }
+            : {}),
+        installed: targets.some((t) => {
+            const settings = readSettingsFile(t.settingsPath);
+            return Object.keys(settings).length > 0 && isInstalledForEntries(settings, t.entries);
+        })
+    };
 }
 /**
  * Slice 2026-07-29-worktree-l2-extended Part 27 — trigger-style deny.

package/dist/services/slice/slice-check-service.d.ts

@@ -1,2 +1,16 @@
 import type { SliceCheckOptions, SliceCheckResult } from './slice-check-types.js';
+/**
+ * 2026-09-10 D1-follow-up (G5): `tsconfig.build.json` is the type contract the
+ * package actually ships (`src/**` only) and it is clean, so the typecheck
+ * stage GATES on it. The wider `tsconfig.json` adds `tests/**`, which still
+ * carries errors this slice did not cause — 142 as measured on 2026-09-10
+ * (`pnpm exec tsc -p tsconfig.json --noEmit 2>&1 | grep -c "error TS"`), all
+ * of them under `tests/`, none under `src/`. That count is therefore a
+ * baseline, not a gate: the stage fails only when it GROWS, which is the
+ * question "did this slice add a type error anywhere?". Re-measure and update
+ * this constant when the residue is paid down.
+ */
+export declare const TYPECHECK_PREEXISTING_BASELINE = 142;
+/** Named code for "the CLI this stage needs is not installed". */
+export declare const BINARY_UNRESOLVED_CODE = "SLICE_CHECK_BINARY_UNRESOLVED";
 export declare function sliceCheck(options: SliceCheckOptions): Promise<SliceCheckResult>;

package/dist/services/slice/slice-check-service.js

@@ -28,49 +28,75 @@ const HEAD_LINES_IN_TAIL = 3;
 const AUDIT_MIN_RED_LINES = 60;
 const REVIEW_FILE_MIN_BYTES = 20;
 /**
- * Resolve a CLI binary to a project-local path, falling back to
- * the system `npx`. pnpm (and npm/yarn) all create
- * `node_modules/.bin/<name>`:
- *
- *   - On Unix, this is a symlink to the package's executable.
- *   - On Windows, this is a `.cmd` shim; `execFileSync` only
- *     resolves `.cmd` through the shell (PATHEXT), so we pass
- *     `shell: true` when invoking one. Without this, the
- *     Windows `npx ENOENT` false-positive from
- *     observations 2317 + 2792 reproduces for every local
- *     binary.
+ * 2026-09-10 D1-follow-up (G5): `tsconfig.build.json` is the type contract the
+ * package actually ships (`src/**` only) and it is clean, so the typecheck
+ * stage GATES on it. The wider `tsconfig.json` adds `tests/**`, which still
+ * carries errors this slice did not cause — 142 as measured on 2026-09-10
+ * (`pnpm exec tsc -p tsconfig.json --noEmit 2>&1 | grep -c "error TS"`), all
+ * of them under `tests/`, none under `src/`. That count is therefore a
+ * baseline, not a gate: the stage fails only when it GROWS, which is the
+ * question "did this slice add a type error anywhere?". Re-measure and update
+ * this constant when the residue is paid down.
+ */
+export const TYPECHECK_PREEXISTING_BASELINE = 142;
+/**
+ * 2026-09-10 D1-follow-up (C6): each name resolves to the JS entry its package
+ * declares, as a path relative to `node_modules/` — the same files
+ * `node_modules/.bin/<name>` shims point at.
  *
- * Returns the command + args + a `shell` flag that the
- * `runCommand` helper threads into `execFileSync`.
+ * The `.bin` shim these used to spawn is a `.cmd` on Windows, and a `.cmd`
+ * cannot be spawned without `shell: true` (EINVAL, Node >= 20). `shell: true`
+ * re-parses the command line, so a project path containing a space was split
+ * at the space and the stage reported a phantom typecheck/test failure.
+ * Running the JS entry through `process.execPath` needs no shell — a spaced
+ * path is just an argument — and is the shape the D1 fix uses for `peaks`
+ * itself (`orchestrator-can-do.ts`).
+ */
+const LOCAL_CLI_ENTRIES = {
+    tsc: ['typescript', 'bin', 'tsc'],
+    vitest: ['vitest', 'vitest.mjs']
+};
+/** Named code for "the CLI this stage needs is not installed". */
+export const BINARY_UNRESOLVED_CODE = 'SLICE_CHECK_BINARY_UNRESOLVED';
+function localCliPath(projectRoot, name) {
+    return join(projectRoot, 'node_modules', ...LOCAL_CLI_ENTRIES[name]);
+}
+/**
+ * Resolve a CLI to the interpreter + JS entry `runCommand` needs, or `null`
+ * when that entry is not on disk. Never returns a shell: the returned command
+ * is always `process.execPath`.
  */
 function resolveLocalBinary(projectRoot, name) {
-    // pnpm creates `node_modules/.bin/<name>` (symlink on Unix,
-    // `.cmd` shim on Windows). We probe both shapes; the
-    // `process.platform === 'win32'` extension probe is the most
-    // portable approach.
-    const isWin = process.platform === 'win32';
-    const candidateNames = isWin ? [`${name}.cmd`, `${name}.ps1`, `${name}`] : [name];
-    for (const candidate of candidateNames) {
-        const cmdPath = join(projectRoot, 'node_modules', '.bin', candidate);
-        if (existsSync(cmdPath)) {
-            return { command: cmdPath, args: [], shell: isWin };
-        }
-    }
-    // Fallback: system npx. On Windows this still has the ENOENT
-    // issue, but the fallback is at least informative when it
-    // fires (the user can see "npx not found" instead of a
-    // silent exit 1).
-    return { command: 'npx', args: [name], shell: false };
+    const entry = localCliPath(projectRoot, name);
+    if (!existsSync(entry))
+        return null;
+    return { command: process.execPath, args: [entry] };
 }
-function runCommand(command, args, cwd, timeoutMs, shell = false) {
+/**
+ * Failed stage for an unresolvable CLI. The previous fallback spawned `npx`
+ * and reported whatever came back — an ENOENT-shaped "exited 1" that reads
+ * exactly like a genuine typecheck/test failure. This names the code and the
+ * path that was searched instead.
+ */
+function unresolvedBinaryStage(stage, cli, projectRoot, durationMs) {
+    const expected = localCliPath(projectRoot, cli);
+    return {
+        name: stage,
+        description: `${cli}: binary unresolved (${BINARY_UNRESOLVED_CODE})`,
+        status: 'fail',
+        durationMs,
+        detail: `${BINARY_UNRESOLVED_CODE}: ${cli} not found at ${expected}. Install dependencies (pnpm install) so that entry exists.`,
+        data: { code: BINARY_UNRESOLVED_CODE, cli, expected }
+    };
+}
+function runCommand(command, args, cwd, timeoutMs) {
     const start = Date.now();
     try {
         const stdout = execFileSync(command, args, {
             cwd,
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: timeoutMs,
-            maxBuffer: EXEC_MAX_BUFFER_BYTES,
-            shell
+            maxBuffer: EXEC_MAX_BUFFER_BYTES
         }).toString('utf8');
         return {
             status: 'pass',
@@ -105,22 +131,52 @@ function tailLines(text, max) {
 async function runTypecheck(projectRoot) {
     const start = Date.now();
     // Per Windows npx ENOENT (observations 2317+2792 from
-    // 2026-06-09), prefer the project-local `node_modules/.bin/tsc`
-    // (symlink on Unix, .cmd on Windows). The local binary is
-    // installed by pnpm at workspace-install time and avoids the
-    // npx PATH-lookup issue.
+    // 2026-06-09), prefer the project-local tsc; it is installed by
+    // pnpm at workspace-install time and avoids the npx PATH-lookup
+    // issue. 2026-09-10 C6: that local binary is now the package's
+    // JS entry run through `process.execPath`, not the `.bin` shim.
     const tsc = resolveLocalBinary(projectRoot, 'tsc');
-    const result = runCommand(tsc.command, [...tsc.args, '--noEmit'], projectRoot, TYPECHECK_TIMEOUT_MS, tsc.shell);
-    const testFiles = result.stdout.match(/(tests?\/.*\.test\.ts)/g) ?? [];
+    if (tsc === null) {
+        return unresolvedBinaryStage('typecheck', 'tsc', projectRoot, Date.now() - start);
+    }
+    // 2026-09-10 G5: this stage used to run a bare `tsc --noEmit`, which picked
+    // up the DEFAULT tsconfig.json (src/** + tests/**) and its 142 pre-existing
+    // test-side errors — so the stage was permanently red and its one real
+    // signal was buried. The gate is now the build tsconfig, which covers
+    // exactly what ships.
+    const buildConfig = 'tsconfig.build.json';
+    const hasBuildConfig = existsSync(join(projectRoot, buildConfig));
+    const gate = runCommand(tsc.command, [...tsc.args, '-p', hasBuildConfig ? buildConfig : 'tsconfig.json', '--noEmit'], projectRoot, TYPECHECK_TIMEOUT_MS);
+    // Measure the wider count so the residue is surfaced rather than hidden.
+    // The baseline comparison only applies when a clean build tsconfig gives it
+    // a meaning; without one the gate above already IS this run.
+    const wide = hasBuildConfig
+        ? runCommand(tsc.command, [...tsc.args, '-p', 'tsconfig.json', '--noEmit'], projectRoot, TYPECHECK_TIMEOUT_MS)
+        : gate;
+    const wideErrors = (wide.stdout + wide.stderr).match(/error TS\d+/g)?.length ?? 0;
+    const wideLabel = hasBuildConfig ? 'tsconfig.json (src/** + tests/**)' : 'tsconfig.json';
+    const regressed = hasBuildConfig && gate.status === 'pass' && wideErrors > TYPECHECK_PREEXISTING_BASELINE;
+    const reason = gate.status !== 'pass'
+        ? `tsc -p ${hasBuildConfig ? buildConfig : 'tsconfig.json'} --noEmit exited ${gate.exitCode}`
+        : regressed
+            ? `typecheck errors grew to ${wideErrors} (pre-existing baseline ${TYPECHECK_PREEXISTING_BASELINE})`
+            : '';
     return {
         name: 'typecheck',
-        description: `${tsc.command} --noEmit (no JS emit, type-only check)`,
-        status: result.status,
-        durationMs: result.durationMs,
-        detail: result.status === 'pass'
-            ? `Typecheck passed in ${result.durationMs}ms.`
-            : tailLines(result.stdout + result.stderr, TYPECHECK_TAIL_LINES) || `tsc exited with code ${result.exitCode}.`,
-        data: { exitCode: result.exitCode }
+        description: hasBuildConfig
+            ? `tsc -p ${buildConfig} --noEmit (gate) + -p tsconfig.json (baseline report)`
+            : `tsc --noEmit (no JS emit, type-only check)`,
+        status: reason.length === 0 ? 'pass' : 'fail',
+        durationMs: Date.now() - start,
+        detail: reason.length === 0
+            ? `${hasBuildConfig ? `${buildConfig} (src/**) clean; ` : ''}${wideLabel}: ${wideErrors} pre-existing error(s), baseline ${TYPECHECK_PREEXISTING_BASELINE} — reported, not hidden.`
+            : `${reason}. ${tailLines(gate.status !== 'pass' ? gate.stdout + gate.stderr : wide.stdout + wide.stderr, TYPECHECK_TAIL_LINES)}`,
+        data: {
+            exitCode: gate.exitCode,
+            wideTsconfigErrors: wideErrors,
+            preExistingBaseline: hasBuildConfig ? TYPECHECK_PREEXISTING_BASELINE : null,
+            ...(regressed ? { regression: wideErrors - TYPECHECK_PREEXISTING_BASELINE } : {})
+        }
     };
 }
 function parseVitestSummary(stdout, fallbackDuration) {
@@ -147,15 +203,19 @@ async function runUnitTests(projectRoot, runTests) {
     // `tests/unit/slice-check-service.test.ts` for the regression net.
     // Per Windows npx ENOENT (observations 2317+2792), resolve
     // the project-local vitest binary instead of shelling out
-    // through npx.
+    // through npx. 2026-09-10 C6: that binary is the package's JS
+    // entry run through `process.execPath`, not the `.bin` shim.
     const vitest = resolveLocalBinary(projectRoot, 'vitest');
+    if (vitest === null) {
+        return unresolvedBinaryStage('unit-tests', 'vitest', projectRoot, Date.now() - start);
+    }
     const vitestArgs = runTests
         ? ['run', '--reporter=default', '--coverage=false']
         : ['run', '--changed', '--reporter=default', '--coverage=false'];
     const description = runTests
-        ? `${vitest.command} run (full test suite, coverage off)`
-        : `${vitest.command} run --changed (tests for git-changed files only, coverage off)`;
-    const result = runCommand(vitest.command, [...vitest.args, ...vitestArgs], projectRoot, UNIT_TESTS_TIMEOUT_MS, vitest.shell);
+        ? `vitest run (full test suite, coverage off)`
+        : `vitest run --changed (tests for git-changed files only, coverage off)`;
+    const result = runCommand(vitest.command, [...vitest.args, ...vitestArgs], projectRoot, UNIT_TESTS_TIMEOUT_MS);
     const summary = parseVitestSummary(result.stdout, result.durationMs);
     // Vitest doesn't always print the per-bucket counts cleanly; infer "passed"
     // as total - failed - skipped when failed/skipped buckets are present.