peaks-loop 4.0.43 → 4.0.45

package/dist/services/codegraph/codegraph-exclude-reconciler.d.ts

@@ -0,0 +1,26 @@
+export declare function matchesCodegraphGlob(filePath: string, pattern: string): boolean;
+export type CodegraphExcludeReconcileInput = {
+    readonly trackedFiles: readonly string[];
+    readonly include: readonly string[];
+    readonly exclude: readonly string[];
+};
+export type CodegraphExcludeViolation = {
+    readonly path: string;
+    readonly matchedRule: string;
+};
+export type CodegraphExcludeReconcileResult = {
+    readonly violations: readonly CodegraphExcludeViolation[];
+    readonly rulesToRemove: readonly string[];
+    readonly trackedSourceCount: number;
+    readonly excludedTrackedCount: number;
+};
+export declare function reconcileCodegraphExclude(input: CodegraphExcludeReconcileInput): CodegraphExcludeReconcileResult;
+export declare const CODEGRAPH_CONFIG_FILENAME = "config.json";
+export type CodegraphExcludeConfig = {
+    readonly include: readonly string[];
+    readonly exclude: readonly string[];
+};
+export declare function readTrackedFiles(projectRoot: string): readonly string[];
+export declare function assertStringArray(value: unknown, field: string, configPath: string): readonly string[];
+export declare function readCodegraphExcludeConfig(projectRoot: string): CodegraphExcludeConfig;
+export declare function reconcileCodegraphExcludeFromProject(projectRoot: string): CodegraphExcludeReconcileResult;

package/dist/services/codegraph/codegraph-exclude-reconciler.js

@@ -0,0 +1,217 @@
+// src/services/codegraph/codegraph-exclude-reconciler.ts
+//
+// Slice S1 of `2026-09-12-codegraph-exclude-integrity` — the pure
+// reconciliation core. It answers one question:
+//
+//   "Which git-tracked source files does the codegraph `exclude` list
+//    silently block, and which rules must be removed to unblock them?"
+//
+// Why this exists (the real defect): upstream `@colbymchenry/codegraph`
+// ships a 99-entry default `exclude` template matched by *directory
+// name* via `picomatch.isMatch(path, pattern, { dot: true })`. Upstream
+// `mergeConfig` has no separate override channel — `config.json`'s
+// `exclude` array replaces the defaults wholesale — so any default rule
+// whose directory name collides with real source silently drops tracked
+// files from the index while `peaks codegraph status` still reports
+// `[OK] Index is up to date`. This repo has five such rules:
+// `**` + `/artifacts/**`, `**` + `/release/**`, `**` + `/vendor/**`,
+// `**` + `/bin/**`, `**` + `/publish/**`.
+//
+// Scope of this module:
+//   - PURE: `reconcileCodegraphExclude` takes already-resolved data and
+//     computes violations + the rules to remove. No fs, no spawn.
+//   - ADAPTER: `readTrackedFiles` / `readCodegraphExcludeConfig` /
+//     `reconcileCodegraphExcludeFromProject` are the thin
+//     boundary-reading helpers. They READ ONLY — this module never
+//     writes `.codegraph/config.json` (that is S2's repair path).
+//
+// It is deliberately generic: no hardcoded rule list. Any rule that
+// blocks a tracked source file is caught by the same logic, in this
+// repo or any other.
+//
+// NOTE FOR FUTURE EDITORS: glob literals contain the two-character
+// sequence that ends a block comment, so every comment in this file
+// uses `//` lines. Do not convert them to `/* ... */`.
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import picomatch from 'picomatch';
+import { normalizePath } from '../../shared/path-utils.js';
+import { CODEGRAPH_DIR_NAME } from './codegraph-service.js';
+// ─────────────────────────────────────────────────────────────────────
+// Glob matching — delegated to `picomatch`, the same engine upstream uses
+//
+// Upstream `@colbymchenry/codegraph` matches its `exclude` / `include`
+// globs with `picomatch.isMatch(path, pattern, { dot: true })`.
+//
+// This module used to re-implement that matcher by hand, covering only
+// `**`, `*` and `?`. That was a silent-failure generator: the hand-rolled
+// version returned `false` for every *extended* glob (`{a,b}`, `[abc]`,
+// `!(...)`), so a config carrying `**/{release,artifacts}/**` was
+// reconciled as clean while the gap was still there — `init` and
+// `repair-exclude` reported success over an incomplete index, which is
+// the exact failure this mechanism exists to prevent. The generated
+// regexes were also superlinear in the number of `**/` segments.
+//
+// So the matcher IS picomatch now: promoted from a transitive dependency
+// of `@colbymchenry/codegraph` to a direct one, pinned to the version
+// already in the tree (4.0.4). No new install weight, no fork of the
+// semantics, and no way to drift from upstream again.
+//
+// `dot: true` keeps upstream's semantics: `*` and `?` also match a
+// leading `.`.
+//
+// NOTE: this delegation was differential-tested against the previous
+// implementation over every git-tracked file in this repo x every rule
+// of both the upstream 99-rule default template and this repo's config,
+// with zero disagreements on the vocabulary the old matcher supported —
+// the only differences being the extended globs it used to get wrong.
+//
+// One side effect of the delegation had to be repaired right after it
+// shipped: `picomatch('')` throws, so a config carrying `"exclude": [""]`
+// made the whole reconciliation throw, and `peaks codegraph status`
+// turned that into `[WARN] … not evaluated` with exit 0 — a silent false
+// pass over a real index gap, which is precisely what this module exists
+// to prevent. Empty / whitespace-only rules are now skipped before
+// compilation (`isUnmatchableRule`), so no single junk entry can mask the
+// verdict of the other rules.
+// ─────────────────────────────────────────────────────────────────────
+const PICOMATCH_OPTIONS = { dot: true };
+// `picomatch(glob, options)` parses the glob once and returns a reusable
+// matcher. Compiling per rule (not per file x rule) is what keeps a
+// reconciliation over N files x M rules linear in N.
+function compileGlob(pattern) {
+    return { pattern, match: picomatch(pattern, PICOMATCH_OPTIONS) };
+}
+// A rule that carries no glob at all — empty or whitespace-only — cannot
+// name a project-relative source path, so it is skipped instead of
+// compiled.
+//
+// Why this guard exists (regression introduced by the very commit that
+// delegated matching to picomatch): `picomatch('')` THROWS
+// ("Expected pattern to be a non-empty string"). A config carrying
+// `"exclude": [""]` therefore aborted the whole reconciliation, and the
+// consumers degraded that throw into a silent false pass — `status`
+// printed `[WARN] codegraph exclude integrity not evaluated` and left
+// the exit code at 0 while tracked source files were still excluded.
+// Skipping the rule is semantically exact (it matches nothing) and keeps
+// every OTHER rule's verdict, so one junk entry can never mask a real
+// gap. `picomatch('   ')` does not throw; it simply matches no real path,
+// so dropping it is a no-op with the same outcome.
+function isUnmatchableRule(pattern) {
+    return pattern.trim().length === 0;
+}
+// Compile a rule list, dropping the rules that cannot match anything.
+function compileRules(patterns) {
+    return patterns.filter((pattern) => !isUnmatchableRule(pattern)).map(compileGlob);
+}
+// Does `filePath` match `pattern` under the same rules upstream uses?
+// Exported so the test suite can pin the glob semantics directly,
+// including the negative case: the artifacts rule must NOT match
+// `src/artifactsman/foo.ts`.
+//
+// Total by construction: an unmatchable rule answers `false` rather than
+// throwing, so no caller can be turned into a false pass by one junk
+// entry in the config. For every non-empty pattern the answer is the
+// picomatch answer, unchanged.
+export function matchesCodegraphGlob(filePath, pattern) {
+    if (isUnmatchableRule(pattern)) {
+        return false;
+    }
+    return compileGlob(pattern).match(normalizePath(filePath));
+}
+// Reconcile the codegraph `exclude` list against the set of git-tracked
+// source files. Pure: no fs, no spawn, no clock.
+//
+// The `include` filter runs first: a rule that only blocks files the
+// index would not ingest anyway (e.g. a markdown-only rule) is not a
+// violation and is not removed.
+export function reconcileCodegraphExclude(input) {
+    // Unmatchable rules are dropped from BOTH lists before compiling — see
+    // `isUnmatchableRule`. An empty `include` entry admits nothing, which
+    // is the same verdict as an explicitly empty `include` list, so it
+    // needs no special case here.
+    const includeRules = compileRules(input.include);
+    const excludeRules = compileRules(input.exclude);
+    const trackedSourceFiles = [];
+    for (const candidate of input.trackedFiles) {
+        const normalizedPath = normalizePath(candidate);
+        if (includeRules.some((rule) => rule.match(normalizedPath))) {
+            trackedSourceFiles.push(normalizedPath);
+        }
+    }
+    const violations = [];
+    const offendingRules = new Set();
+    const blockedFiles = new Set();
+    for (const path of trackedSourceFiles) {
+        for (const rule of excludeRules) {
+            if (!rule.match(path)) {
+                continue;
+            }
+            violations.push({ path, matchedRule: rule.pattern });
+            offendingRules.add(rule.pattern);
+            blockedFiles.add(path);
+        }
+    }
+    return {
+        violations,
+        rulesToRemove: input.exclude.filter((pattern) => offendingRules.has(pattern)),
+        trackedSourceCount: trackedSourceFiles.length,
+        excludedTrackedCount: blockedFiles.size
+    };
+}
+// ─────────────────────────────────────────────────────────────────────
+// Thin boundary adapters — READ ONLY
+// ─────────────────────────────────────────────────────────────────────
+// Upstream `CONFIG_FILENAME` inside `<projectRoot>/.codegraph/`.
+export const CODEGRAPH_CONFIG_FILENAME = 'config.json';
+// Project-relative paths of every git-tracked file, exactly as
+// `git ls-files` reports them. Why git and not an fs walk: the index
+// must cover what git tracks (see the anti-fake-green contract in
+// `src/services/dispatch/dispatch-sub-agent.ts`), so git is the only
+// admissible source of truth.
+//
+// Throws when `projectRoot` is not inside a git work tree — callers
+// decide whether that is fatal; this function never swallows it.
+export function readTrackedFiles(projectRoot) {
+    const stdout = execFileSync('git', ['-C', projectRoot, 'ls-files'], {
+        encoding: 'utf8',
+        maxBuffer: 64 * 1024 * 1024
+    });
+    return stdout
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0)
+        .map((line) => normalizePath(line));
+}
+// Exported for S2's repair writer, which re-validates `exclude` on the
+// way out so the read and write paths agree on what a valid config is.
+export function assertStringArray(value, field, configPath) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string')) {
+        throw new Error(`codegraph config ${configPath}: "${field}" must be an array of strings`);
+    }
+    return value;
+}
+// Read `<projectRoot>/.codegraph/config.json` and return just the two
+// glob lists the reconciler needs. Read-only: this module never writes
+// that file.
+export function readCodegraphExcludeConfig(projectRoot) {
+    const configPath = join(projectRoot, CODEGRAPH_DIR_NAME, CODEGRAPH_CONFIG_FILENAME);
+    const parsed = JSON.parse(readFileSync(configPath, 'utf8'));
+    if (typeof parsed !== 'object' || parsed === null) {
+        throw new Error(`codegraph config ${configPath}: expected a JSON object`);
+    }
+    const record = parsed;
+    return {
+        include: assertStringArray(record.include, 'include', configPath),
+        exclude: assertStringArray(record.exclude, 'exclude', configPath)
+    };
+}
+// Read-only entry point: resolve the project's tracked files + codegraph
+// config from disk and reconcile them. S2's repair path consumes this
+// result and writes the reduced `exclude` list back; S1 only computes.
+export function reconcileCodegraphExcludeFromProject(projectRoot) {
+    const trackedFiles = readTrackedFiles(projectRoot);
+    const { include, exclude } = readCodegraphExcludeConfig(projectRoot);
+    return reconcileCodegraphExclude({ trackedFiles, include, exclude });
+}

package/dist/services/codegraph/codegraph-exclude-repair.d.ts

@@ -0,0 +1,102 @@
+import { type CodegraphProcessRunner } from './codegraph-service.js';
+/** Suffix of the byte-exact pre-repair copy kept next to the config. */
+export declare const CODEGRAPH_CONFIG_BACKUP_SUFFIX = ".bak";
+export type CodegraphExcludeRepairPlan = {
+    /** True when at least one rule would actually be dropped. */
+    readonly changed: boolean;
+    /** The `exclude` array after the removal. */
+    readonly exclude: readonly string[];
+    /** Rules actually present in `exclude` and dropped, in config order. */
+    readonly removedRules: readonly string[];
+};
+/**
+ * Pure: given the current `exclude` list and the rules to drop, return
+ * the new list. No fs, no clock, no serialization.
+ *
+ * A rule named in `rulesToRemove` but absent from `exclude` is NOT
+ * invented — the result is a subset of the input, so a caller can
+ * never add a rule by accident. Removing an already-absent rule is a
+ * no-op, which is what makes the whole repair idempotent: feeding the
+ * repaired list back in yields `changed: false`.
+ */
+export declare function repairCodegraphExclude(input: {
+    readonly exclude: readonly string[];
+    readonly rulesToRemove: readonly string[];
+}): CodegraphExcludeRepairPlan;
+export type CodegraphExcludeRepairOutcome = {
+    readonly applied: false;
+    readonly reason: 'no-rules-to-remove';
+    readonly removedRules: readonly string[];
+} | {
+    readonly applied: true;
+    readonly configPath: string;
+    readonly backupPath: string;
+    readonly removedRules: readonly string[];
+    readonly excludeCountBefore: number;
+    readonly excludeCountAfter: number;
+};
+/**
+ * Apply the repair to `<projectRoot>/.codegraph/config.json`.
+ *
+ * No-op (and no write, no mtime change, no backup) when
+ * `rulesToRemove` is empty. Otherwise: back up the original bytes to
+ * `config.json.bak`, then rewrite the file with `exclude` reduced by
+ * exactly the rules that were both requested and present.
+ *
+ * Throws only on real fs/parse failures — the caller decides whether
+ * that is fatal (`repair-exclude` → non-zero exit) or a surfaced
+ * warning (`init` → keep going, the init itself already succeeded).
+ */
+export declare function applyCodegraphExcludeRepair(projectRoot: string, rulesToRemove: readonly string[]): CodegraphExcludeRepairOutcome;
+export type CodegraphExcludeRepairReport = {
+    /** True when the config was actually rewritten. */
+    readonly applied: boolean;
+    /** Rules dropped from `exclude`. */
+    readonly rulesRemoved: readonly string[];
+    /** Distinct tracked source files the dropped rules had been hiding. */
+    readonly filesRecovered: number;
+    /** Tracked files the config's `include` filter admits at all. */
+    readonly trackedSourceCount: number;
+    /** Absolute path of the rewritten config (empty when nothing was written). */
+    readonly configPath: string;
+    /** Byte-exact rollback copy (null when nothing was written). */
+    readonly backupPath: string | null;
+    /** True when the post-repair `codegraph index` finished successfully. */
+    readonly reindexed: boolean;
+    /**
+     * Non-null when the step could not run to completion (no git repo,
+     * missing config, malformed config, upstream index failure, …).
+     * Always reported, never swallowed — but never thrown either, so a
+     * successful `peaks codegraph init` is never undone by it.
+     */
+    readonly warning: string | null;
+};
+export type CodegraphExcludeRepairOptions = {
+    /**
+     * When `false`, skip the follow-up `codegraph index` rebuild and
+     * return `reindexed: false` (with no warning — nothing went wrong).
+     *
+     * Set by callers that run their OWN index immediately after this
+     * step: the pre-dispatch preflight and the post-slice autorefresh
+     * both call `init` → `index`, and an index is expensive enough
+     * (5-30 s on this repo) that a fresh init must not pay for it twice.
+     */
+    readonly reindex?: boolean;
+};
+/**
+ * Reconcile `projectRoot`'s exclude list, drop the rules that block
+ * tracked source files, and rebuild the index so the recovered files
+ * actually land in it.
+ *
+ * This is the ONE shared "after upstream init" self-heal: the CLI's
+ * fresh `peaks codegraph init`, the pre-dispatch preflight and the
+ * post-slice autorefresh all call it, so a fresh clone cannot end up
+ * with a peaks-loop marker stamped over an incomplete index that no
+ * later `init` would ever repair.
+ *
+ * Never throws. Every failure becomes a populated `warning` field, so
+ * the caller can surface it without the step being able to break the
+ * command it is attached to — including the fail-soft preflight and
+ * the never-throwing `refreshCodegraphAfterSlice`.
+ */
+export declare function repairCodegraphExcludeFromProject(projectRoot: string, runner?: CodegraphProcessRunner, options?: CodegraphExcludeRepairOptions): Promise<CodegraphExcludeRepairReport>;

package/dist/services/codegraph/codegraph-exclude-repair.js

@@ -0,0 +1,266 @@
+// src/services/codegraph/codegraph-exclude-repair.ts
+//
+// Slice S2 of `2026-09-12-codegraph-exclude-integrity` — the WRITE path.
+//
+// S1 computes `rulesToRemove`; this module applies it. Two callers are
+// allowed to reach it and nothing else is:
+//
+//   1. `peaks codegraph init` — after a fresh upstream init (which
+//      always writes upstream's 99-rule default template), so a brand
+//      new clone / new machine ends up with a complete index instead
+//      of silently dropping tracked source files.
+//   2. `peaks codegraph repair-exclude` — the explicit repair for a
+//      workspace that was initialized before this slice shipped, or
+//      whose config drifted.
+//
+// `status` and the doctor check deliberately do NOT live here: they
+// read `codegraph-exclude-integrity.ts` and never write.
+//
+// Safety posture (the file being edited belongs to a THIRD-PARTY tool):
+//   - `rulesToRemove` comes from S1, which only ever lists a rule that
+//     actually blocks at least one git-tracked source file. A rule that
+//     matches nothing tracked is never dropped.
+//   - Nothing is written when `rulesToRemove` is empty — the config
+//     bytes, and its mtime, are untouched.
+//   - The original bytes are copied to `config.json.bak` before the
+//     rewrite, so a rollback is byte-exact.
+//   - The rewrite itself goes through a same-directory temp file plus
+//     `renameSync`, so the config is never observed half-written.
+//   - Every other key of the config survives verbatim, in its original
+//     position; only `exclude` changes.
+import { randomBytes } from 'node:crypto';
+import { readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { assertStringArray, CODEGRAPH_CONFIG_FILENAME } from './codegraph-exclude-reconciler.js';
+import { CODEGRAPH_DIR_NAME, createCodegraphInvocation, executeCodegraphInvocation } from './codegraph-service.js';
+import { inspectCodegraphExcludeIntegrity } from './codegraph-exclude-integrity.js';
+/** Suffix of the byte-exact pre-repair copy kept next to the config. */
+export const CODEGRAPH_CONFIG_BACKUP_SUFFIX = '.bak';
+/**
+ * Pure: given the current `exclude` list and the rules to drop, return
+ * the new list. No fs, no clock, no serialization.
+ *
+ * A rule named in `rulesToRemove` but absent from `exclude` is NOT
+ * invented — the result is a subset of the input, so a caller can
+ * never add a rule by accident. Removing an already-absent rule is a
+ * no-op, which is what makes the whole repair idempotent: feeding the
+ * repaired list back in yields `changed: false`.
+ */
+export function repairCodegraphExclude(input) {
+    const removable = new Set(input.rulesToRemove);
+    // De-duplicated, order-preserving. A config that lists the same rule
+    // twice would otherwise be counted twice here, and this array is what
+    // the caller reports to the user as "rules removed".
+    const removedRules = [...new Set(input.exclude.filter((rule) => removable.has(rule)))];
+    if (removedRules.length === 0) {
+        return { changed: false, exclude: input.exclude, removedRules: [] };
+    }
+    return {
+        changed: true,
+        exclude: input.exclude.filter((rule) => !removable.has(rule)),
+        removedRules
+    };
+}
+/**
+ * Detect the indentation the config already uses so the rewrite keeps
+ * the file's shape instead of reformatting a third-party tool's file.
+ *
+ * A single-line (minified) config has no indentation to copy: `0` tells
+ * `JSON.stringify` to emit compact JSON, so the file comes back as the
+ * one-liner it went in as. `0` is NOT the same as "not set" here — an
+ * omitted indent would also be compact, but returning a number keeps the
+ * intent explicit at the call site.
+ *
+ * Falls back to two spaces when the file spans lines but has no indented
+ * member.
+ */
+function detectIndent(text) {
+    if (!text.trimEnd().includes('\n')) {
+        return 0;
+    }
+    const match = /\n([ \t]+)"/.exec(text);
+    return match?.[1] ?? 2;
+}
+function serializeConfig(config, originalText) {
+    const body = JSON.stringify(config, null, detectIndent(originalText));
+    return originalText.endsWith('\n') ? `${body}\n` : body;
+}
+/**
+ * Write `content` to `filePath` atomically: same-directory temp file,
+ * then `renameSync` over the target.
+ *
+ * The file being written belongs to a THIRD-PARTY tool, so a crash or a
+ * full disk mid-`writeFileSync` must never leave a half-written config
+ * behind. `rename` within one directory is atomic, so a reader sees
+ * either the old bytes or the new ones, never a prefix of the new ones.
+ * The temp file lives next to the target (same directory ⇒ same
+ * filesystem ⇒ the rename cannot degrade to a cross-device copy) and is
+ * removed if the write or the rename fails.
+ *
+ * N5: the temp name carries the pid plus 6 random bytes. A FIXED
+ * `${filePath}.tmp` is single-writer only, and this writer has three
+ * reachable concurrent callers — a fresh `peaks codegraph init` (which
+ * repairs then indexes), the pre-dispatch preflight, and the post-slice
+ * autorefresh. Two overlapping writers sharing one temp name let one
+ * `renameSync` publish a file the other was still writing, which is
+ * exactly the half-written config the temp file exists to prevent. The
+ * suffix keeps the temp in the SAME directory, so the rename stays
+ * within one filesystem and therefore stays atomic.
+ */
+function writeConfigAtomic(filePath, content) {
+    const tempPath = `${filePath}.${String(process.pid)}.${randomBytes(6).toString('hex')}.tmp`;
+    try {
+        writeFileSync(tempPath, content, 'utf8');
+        renameSync(tempPath, filePath);
+    }
+    catch (error) {
+        rmSync(tempPath, { force: true });
+        throw error;
+    }
+}
+/**
+ * Apply the repair to `<projectRoot>/.codegraph/config.json`.
+ *
+ * No-op (and no write, no mtime change, no backup) when
+ * `rulesToRemove` is empty. Otherwise: back up the original bytes to
+ * `config.json.bak`, then rewrite the file with `exclude` reduced by
+ * exactly the rules that were both requested and present.
+ *
+ * Throws only on real fs/parse failures — the caller decides whether
+ * that is fatal (`repair-exclude` → non-zero exit) or a surfaced
+ * warning (`init` → keep going, the init itself already succeeded).
+ */
+export function applyCodegraphExcludeRepair(projectRoot, rulesToRemove) {
+    if (rulesToRemove.length === 0) {
+        return { applied: false, reason: 'no-rules-to-remove', removedRules: [] };
+    }
+    const configPath = join(projectRoot, CODEGRAPH_DIR_NAME, CODEGRAPH_CONFIG_FILENAME);
+    const originalText = readFileSync(configPath, 'utf8');
+    const parsed = JSON.parse(originalText);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`codegraph config ${configPath}: expected a JSON object`);
+    }
+    const record = parsed;
+    const exclude = assertStringArray(record.exclude, 'exclude', configPath);
+    const plan = repairCodegraphExclude({ exclude, rulesToRemove });
+    if (!plan.changed) {
+        return { applied: false, reason: 'no-rules-to-remove', removedRules: [] };
+    }
+    const backupPath = `${configPath}${CODEGRAPH_CONFIG_BACKUP_SUFFIX}`;
+    writeFileSync(backupPath, originalText, 'utf8');
+    // Spread first, then replace `exclude` — every other key keeps its
+    // original value AND its original position in the serialized object.
+    writeConfigAtomic(configPath, serializeConfig({ ...record, exclude: plan.exclude }, originalText));
+    return {
+        applied: true,
+        configPath,
+        backupPath,
+        removedRules: plan.removedRules,
+        excludeCountBefore: exclude.length,
+        excludeCountAfter: plan.exclude.length
+    };
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function emptyRepairReport(warning) {
+    return {
+        applied: false,
+        rulesRemoved: [],
+        filesRecovered: 0,
+        trackedSourceCount: 0,
+        configPath: '',
+        backupPath: null,
+        reindexed: false,
+        warning
+    };
+}
+/**
+ * Reconcile `projectRoot`'s exclude list, drop the rules that block
+ * tracked source files, and rebuild the index so the recovered files
+ * actually land in it.
+ *
+ * This is the ONE shared "after upstream init" self-heal: the CLI's
+ * fresh `peaks codegraph init`, the pre-dispatch preflight and the
+ * post-slice autorefresh all call it, so a fresh clone cannot end up
+ * with a peaks-loop marker stamped over an incomplete index that no
+ * later `init` would ever repair.
+ *
+ * Never throws. Every failure becomes a populated `warning` field, so
+ * the caller can surface it without the step being able to break the
+ * command it is attached to — including the fail-soft preflight and
+ * the never-throwing `refreshCodegraphAfterSlice`.
+ */
+export async function repairCodegraphExcludeFromProject(projectRoot, runner, options = {}) {
+    let integrity;
+    try {
+        integrity = inspectCodegraphExcludeIntegrity(projectRoot);
+    }
+    catch (error) {
+        return emptyRepairReport(`codegraph exclude reconcile skipped: ${errorMessage(error)}`);
+    }
+    if (integrity.rulesToRemove.length === 0) {
+        return {
+            applied: false,
+            rulesRemoved: [],
+            filesRecovered: 0,
+            trackedSourceCount: integrity.trackedSourceCount,
+            configPath: integrity.configPath,
+            backupPath: null,
+            reindexed: false,
+            warning: null
+        };
+    }
+    let outcome;
+    try {
+        outcome = applyCodegraphExcludeRepair(projectRoot, integrity.rulesToRemove);
+    }
+    catch (error) {
+        return emptyRepairReport(`codegraph exclude repair failed for ${integrity.configPath}: ${errorMessage(error)}`);
+    }
+    if (!outcome.applied) {
+        return {
+            applied: false,
+            rulesRemoved: [],
+            filesRecovered: 0,
+            trackedSourceCount: integrity.trackedSourceCount,
+            configPath: integrity.configPath,
+            backupPath: null,
+            reindexed: false,
+            warning: null
+        };
+    }
+    const base = {
+        applied: true,
+        rulesRemoved: outcome.removedRules,
+        filesRecovered: integrity.excludedTrackedCount,
+        trackedSourceCount: integrity.trackedSourceCount,
+        configPath: outcome.configPath,
+        backupPath: outcome.backupPath
+    };
+    if (options.reindex === false) {
+        // The caller indexes immediately after this returns, so doing it
+        // here too would index the same tree twice for no extra coverage.
+        return { ...base, reindexed: false, warning: null };
+    }
+    // The recovered files are on disk but not in the index yet. Rebuild
+    // it now — that is the whole point of repairing at init time.
+    try {
+        const result = await executeCodegraphInvocation(createCodegraphInvocation({ subcommand: 'index', project: projectRoot, quiet: true }), runner);
+        if (result.exitCode !== 0) {
+            return {
+                ...base,
+                reindexed: false,
+                warning: `codegraph exclude repaired (${outcome.removedRules.length} rule(s) removed) but the follow-up index failed (exit ${String(result.exitCode)}); run \`peaks codegraph index --project <root>\`.`
+            };
+        }
+        return { ...base, reindexed: true, warning: null };
+    }
+    catch (error) {
+        return {
+            ...base,
+            reindexed: false,
+            warning: `codegraph exclude repaired (${outcome.removedRules.length} rule(s) removed) but the follow-up index could not run: ${errorMessage(error)}`
+        };
+    }
+}

package/dist/services/codegraph/codegraph-preflight-service.js

@@ -33,6 +33,7 @@
 import { mkdirSync } from 'node:fs';
 import { CODEGRAPH_DIR_NAME, createCodegraphInvocation, defaultCodegraphInitGuard, executeCodegraphInvocation, isCodegraphInitialized, writeCodegraphMarker, } from './codegraph-service.js';
 import { defaultCodegraphProcessRunner } from './codegraph-process-runner.js';
+import { repairCodegraphExcludeFromProject } from './codegraph-exclude-repair.js';
 /** Cap for the directory histogram in the rendered structure block. */
 export const CODEGRAPH_STRUCTURE_MAX_DIRS = 40;
 /** Cap for bare root files listed in the rendered structure block. */
@@ -208,6 +209,17 @@ export async function buildCodegraphPreflightBlock(projectRoot, runner) {
             catch {
                 // Best-effort: a marker-write failure must not undo the init.
             }
+            // Upstream init just wrote its 99-rule default `exclude` template,
+            // some of which block tracked source files. Without this, a fresh
+            // clone is initialized HERE, by the first dispatch's preflight —
+            // marker stamped over an incomplete index — and every later
+            // `peaks codegraph init` hits `noop-already-peaks-loop`, so the
+            // CLI's own self-heal becomes unreachable. Same shared helper, so
+            // all three init landing sites behave identically.
+            //
+            // Never throws, and `reindex: false` because the index call below
+            // covers the recovered files anyway.
+            await repairCodegraphExcludeFromProject(projectRoot, processRunner, { reindex: false });
         }
         catch (error) {
             return { available: false, note: `codegraph init unavailable: ${errorMessage(error)}` };

package/dist/services/codegraph/codegraph-service.d.ts

@@ -10,7 +10,6 @@ type BaseCodegraphInvocationOptions = {
     files?: string[];
     json?: boolean;
     quiet?: boolean;
-    yes?: boolean;
     force?: boolean;
     limit?: number;
     maxDepth?: number;

package/dist/services/codegraph/codegraph-service.js

@@ -13,7 +13,11 @@ const NUMERIC_FLAG_NAMES = ['limit', 'maxDepth'];
 const COMMON_OPTION_KEYS = ['subcommand', 'project'];
 const ALLOWED_OPTIONS_BY_SUBCOMMAND = {
     status: [],
-    init: ['yes'],
+    // Upstream `init` takes NO flags. The `--yes` we used to whitelist
+    // here was passed straight through to `@colbymchenry/codegraph`, which
+    // rejects it with CODEGRAPH_COMMAND_FAILED — and upstream init never
+    // prompts, so there was nothing for it to answer.
+    init: [],
     index: ['force', 'quiet'],
     query: ['search', 'json', 'limit'],
     files: ['json', 'maxDepth'],
@@ -120,9 +124,6 @@ function buildCommandArgs(options, projectRoot) {
     if (options.subcommand === 'affected') {
         args.push(...buildAffectedFileArgs(projectRoot, options.files));
     }
-    if (options.yes === true) {
-        args.push('--yes');
-    }
     if (options.force === true) {
         args.push('--force');
     }