peaks-loop 4.0.45 → 4.0.47

package/dist/services/release/version-precheck-service.js

@@ -37,12 +37,45 @@ function upgrade(result, strict) {
     }
     return result;
 }
+/** Read + parse a JSON manifest, mapping both failure modes onto a blocker description. */
+function readPackageJson(path, label) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return {
+            ok: false,
+            message: `${label} is missing or unreadable at ${path}`,
+            remediation: `run \`peaks release precheck\` from a project root that has a readable ${label}`
+        };
+    }
+    try {
+        return { ok: true, value: JSON.parse(raw) };
+    }
+    catch {
+        return {
+            ok: false,
+            message: `${label} at ${path} is not valid JSON`,
+            remediation: `fix the ${label} syntax; \`peaks release precheck\` cannot gate a version it cannot parse`
+        };
+    }
+}
 function readRootVersion(projectRoot) {
-    const pkg = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'));
+    const path = join(projectRoot, 'package.json');
+    const read = readPackageJson(path, 'root package.json');
+    if (!read.ok) {
+        return read;
+    }
+    const pkg = read.value;
     if (typeof pkg.version !== 'string' || !SEMVER_RE.test(pkg.version)) {
-        throw new Error(`invalid root package.json#version: ${JSON.stringify(pkg.version)}`);
+        return {
+            ok: false,
+            message: `invalid root package.json#version: ${JSON.stringify(pkg.version)}`,
+            remediation: 'set root package.json#version to a clean semver (e.g. 4.0.0) before running `peaks release precheck`'
+        };
     }
-    return pkg.version;
+    return { ok: true, version: pkg.version };
 }
 function rollup(layers, strict) {
     const statuses = Object.values(layers).map((l) => l.status);
@@ -58,7 +91,16 @@ function rollup(layers, strict) {
 // Layer A — rootVsShared (mirrors publish.yml §(A) on-disk gate only)
 // ---------------------------------------------------------------------------
 export function runRootVsShared(opts) {
-    const rootVersion = readRootVersion(opts.projectRoot);
+    const rootRead = readRootVersion(opts.projectRoot);
+    if (!rootRead.ok) {
+        return {
+            status: 'blocker',
+            message: rootRead.message,
+            remediation: rootRead.remediation,
+            observed: { rootVersion: null, sharedVersion: null }
+        };
+    }
+    const rootVersion = rootRead.version;
     const sharedDist = join(opts.projectRoot, 'packages', 'peaks-loop-shared', 'dist', 'version.js');
     let sharedVersion = null;
     let distExists = false;
@@ -112,7 +154,18 @@ export function runRootVsShared(opts) {
 // Layer B — tagCollision (CLI-only; not in publish.yml today)
 // ---------------------------------------------------------------------------
 export function runTagCollision(opts) {
-    const rootVersion = readRootVersion(opts.projectRoot);
+    const rootRead = readRootVersion(opts.projectRoot);
+    if (!rootRead.ok) {
+        // Fail closed: without a version there is no tag name to check, so this
+        // layer cannot claim "safe to publish".
+        return {
+            status: 'blocker',
+            message: rootRead.message,
+            remediation: rootRead.remediation,
+            observed: { tagName: null }
+        };
+    }
+    const rootVersion = rootRead.version;
     const tagName = `v${rootVersion}`;
     // 2026-09-10: no shell. `git` is `git.exe` on Windows, so the wrapper bought
     // nothing — and it actively broke this layer, because `projectRoot` is an
@@ -125,7 +178,8 @@ export function runTagCollision(opts) {
     // blocker). It also emitted DEP0190 on every run, on every layer.
     const res = spawnSync('git', ['-C', opts.projectRoot, 'tag', '--list', tagName], {
         encoding: 'utf8',
-        timeout: 5_000
+        timeout: 5_000,
+        windowsHide: true
     });
     if (res.error !== null && res.error !== undefined) {
         return {
@@ -198,8 +252,16 @@ export function runChangesetStaged(opts) {
 // Layer D — workspaceLockstep (CLI-only; not in publish.yml today)
 // ---------------------------------------------------------------------------
 export function runWorkspaceLockstep(opts) {
-    const rootPkgRaw = readFileSync(join(opts.projectRoot, 'package.json'), 'utf8');
-    const rootPkg = JSON.parse(rootPkgRaw);
+    const rootRead = readPackageJson(join(opts.projectRoot, 'package.json'), 'root package.json');
+    if (!rootRead.ok) {
+        return {
+            status: 'blocker',
+            message: rootRead.message,
+            remediation: rootRead.remediation,
+            observed: { sharedDep: null }
+        };
+    }
+    const rootPkg = rootRead.value;
     const allDeps = {
         ...(rootPkg.dependencies ?? {}),
         ...(rootPkg.devDependencies ?? {})
@@ -222,9 +284,16 @@ export function runWorkspaceLockstep(opts) {
             observed: { sharedDep }
         };
     }
-    const sharedPkgRaw = readFileSync(join(opts.projectRoot, 'packages', 'peaks-loop-shared', 'package.json'), 'utf8');
-    const sharedPkg = JSON.parse(sharedPkgRaw);
-    const sharedVersion = sharedPkg.version ?? '';
+    const sharedRead = readPackageJson(join(opts.projectRoot, 'packages', 'peaks-loop-shared', 'package.json'), 'packages/peaks-loop-shared/package.json');
+    if (!sharedRead.ok) {
+        return {
+            status: 'blocker',
+            message: sharedRead.message,
+            remediation: sharedRead.remediation,
+            observed: { sharedDep, sharedVersion: null }
+        };
+    }
+    const sharedVersion = sharedRead.value.version ?? '';
     if (!SEMVER_RE.test(sharedVersion)) {
         return {
             status: 'blocker',
@@ -244,7 +313,8 @@ export function runWorkspaceLockstep(opts) {
 // runAllLayers — orchestrator
 // ---------------------------------------------------------------------------
 export function runAllLayers(opts) {
-    const rootVersion = readRootVersion(opts.projectRoot);
+    const rootRead = readRootVersion(opts.projectRoot);
+    const rootVersion = rootRead.ok ? rootRead.version : null;
     const strict = opts.strict === true;
     const layers = {
         rootVsShared: upgrade(runRootVsShared(opts), strict),

package/dist/services/runtime/vendor-adapter.d.ts

@@ -20,11 +20,36 @@
  *
  * Vendor-specific verb strings (`claude --compact`, `codex --compact`,
  * `copilot compact`) MUST live ONLY in adapter implementations under
- * `src/services/runtime/vendors/<vendor>.ts`. The runtime service that
+ * `src/services/runtime/vendors/<vendor>.ts` and
+ * `src/services/ide/adapters/<vendor>-adapter.ts`. The runtime service that
  * orchestrates these adapters (runtime-service.ts) and the CLI commands
- * (`peaks runtime compact --via <id>`) MUST NOT contain vendor verbs
- * — verified by AC-1: `rg -n "claude --compact|codex --compact|copilot
- * compact" src/services/code/` must return 0 matches.
+ * (`peaks runtime compact --via <id>`) MUST NOT contain vendor verbs.
+ *
+ * Slice 2026-09-12-auto-compact-vendor-neutrality widened AC-1's scope from
+ * `src/services/code/` to ALL of `src/`, and had to change how it is
+ * enforced. Both changes came from measurement:
+ *
+ *   - The old scope excluded the files that carried the defect AC-1
+ *     describes — the compact dispatcher (`src/services/context/`) and the
+ *     hook installer (`src/services/hooks/`) — so it returned 0 by
+ *     construction. A grep over a directory that does not contain the code
+ *     being checked is not evidence of anything.
+ *   - Widened as a raw grep over `src/`, the check returns 13, not 0. Twelve
+ *     hits are the phrase quoted in COMMENTS and doc strings (this block
+ *     among them); the thirteenth is `compactCommand: 'claude --compact'`
+ *     in `src/services/ide/adapters/claude-code-adapter.ts` — the one place
+ *     the string is supposed to be. A text grep measures prose, not code.
+ *
+ * AC-1 is therefore enforced by the AST-based check in
+ * `tests/unit/runtime/vendor-neutral-identity-guard.test.ts`: no vendor
+ * verb in any STRING LITERAL of `src/` outside the adapter implementations.
+ * Parsed, the count is 1 and the single hit is that adapter — which is the
+ * property AC-1 was always about.
+ *
+ * AC-1 covers VERB STRINGS only. The compact path's defects were IDENTITY
+ * COMPARISONS (`ideId !== 'claude-code'`), a second shape the same guard
+ * file covers and AC-1 never could. Read that guard's header for what
+ * neither check catches before treating vendor neutrality as proven.
  *
  * See `.peaks/_runtime/2026-07-08-session-17918f/prd/002-adapter-runtime-and-polyrepo.md`
  * for the source PRD.

package/dist/services/runtime/vendors/claude-code.js

@@ -23,7 +23,7 @@ export class ClaudeCodeAdapter {
         if (args.force === true)
             argv.push('--force');
         return new Promise((resolveRun) => {
-            const proc = spawn('claude', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+            const proc = spawn('claude', argv, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
             let stdout = '';
             let stderr = '';
             proc.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });

package/dist/services/runtime/vendors/codex.js

@@ -27,7 +27,7 @@ export class CodexAdapter {
         if (args.force === true)
             argv.push('--force');
         return new Promise((resolveRun) => {
-            const proc = spawn('codex', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+            const proc = spawn('codex', argv, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
             let stdout = '';
             let stderr = '';
             proc.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });

package/dist/services/runtime/vendors/copilot.js

@@ -24,7 +24,7 @@ export class CopilotAdapter {
         if (args.force === true)
             argv.push('--force');
         return new Promise((resolveRun) => {
-            const proc = spawn('copilot', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
+            const proc = spawn('copilot', argv, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
             let stdout = '';
             let stderr = '';
             proc.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });

package/dist/services/sc/sc-service.js

@@ -60,7 +60,7 @@ function getCurrentCommitHash(workspaceRoot) {
     if (!workspaceRoot)
         return null;
     try {
-        return execFileSync('git', ['rev-parse', 'HEAD'], { cwd: workspaceRoot, encoding: 'utf-8' }).trim();
+        return execFileSync('git', ['rev-parse', 'HEAD'], { cwd: workspaceRoot, encoding: 'utf-8', windowsHide: true }).trim();
     }
     catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;

package/dist/services/scan/diff-scope-service.js

@@ -119,9 +119,9 @@ function parseRedLineScope(rdBody) {
 }
 function tryGitChangedFiles(projectRoot, baseRef) {
     try {
-        const trackedRaw = execFileSync('git', ['-C', projectRoot, 'diff', '--name-only', baseRef], { encoding: 'utf8' });
+        const trackedRaw = execFileSync('git', ['-C', projectRoot, 'diff', '--name-only', baseRef], { encoding: 'utf8', windowsHide: true });
         const tracked = trackedRaw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-        const untrackedRaw = execFileSync('git', ['-C', projectRoot, 'ls-files', '--others', '--exclude-standard'], { encoding: 'utf8' });
+        const untrackedRaw = execFileSync('git', ['-C', projectRoot, 'ls-files', '--others', '--exclude-standard'], { encoding: 'utf8', windowsHide: true });
         const untracked = untrackedRaw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
         return { ok: true, files: Array.from(new Set([...tracked, ...untracked])) };
     }

package/dist/services/scan/file-size-scan.js

@@ -65,9 +65,9 @@ function getChangedFiles(projectRoot, baseRef) {
         // (--diff-filter=D) are intentionally excluded: they have no on-disk
         // body to count, and a refactor that deletes large files is exactly
         // when the gate should NOT block. Slice #015 fix.
-        const trackedRaw = execFileSync('git', ['-C', projectRoot, 'diff', '--name-only', '--diff-filter=AM', baseRef], { encoding: 'utf8' });
+        const trackedRaw = execFileSync('git', ['-C', projectRoot, 'diff', '--name-only', '--diff-filter=AM', baseRef], { encoding: 'utf8', windowsHide: true });
         const tracked = trackedRaw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-        const untrackedRaw = execFileSync('git', ['-C', projectRoot, 'ls-files', '--others', '--exclude-standard'], { encoding: 'utf8' });
+        const untrackedRaw = execFileSync('git', ['-C', projectRoot, 'ls-files', '--others', '--exclude-standard'], { encoding: 'utf8', windowsHide: true });
         const untracked = untrackedRaw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
         return Array.from(new Set([...tracked, ...untracked]));
     }

package/dist/services/scan/orphan-service.js

@@ -233,7 +233,8 @@ function diffVsHead(projectRoot, baseRef) {
     const res = spawnSync('git', args, {
         cwd: projectRoot,
         encoding: 'utf8',
-        timeout: 5000
+        timeout: 5000,
+        windowsHide: true
     });
     if (res.status !== 0 || !res.stdout) {
         return { added: [], removed: [], modified: [] };

package/dist/services/scan/type-sanity-service.js

@@ -39,9 +39,9 @@ function isArtifactWorkspaceFile(filePath) {
 function tryGitDiffFiles(projectRoot, baseRef) {
     try {
         // Combine: tracked changes vs baseRef + untracked files. Use porcelain status for untracked too.
-        const trackedRaw = execFileSync('git', ['-C', projectRoot, 'diff', '--name-only', baseRef], { encoding: 'utf8' });
+        const trackedRaw = execFileSync('git', ['-C', projectRoot, 'diff', '--name-only', baseRef], { encoding: 'utf8', windowsHide: true });
         const tracked = trackedRaw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-        const untrackedRaw = execFileSync('git', ['-C', projectRoot, 'ls-files', '--others', '--exclude-standard'], { encoding: 'utf8' });
+        const untrackedRaw = execFileSync('git', ['-C', projectRoot, 'ls-files', '--others', '--exclude-standard'], { encoding: 'utf8', windowsHide: true });
         const untracked = untrackedRaw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
         const merged = Array.from(new Set([...tracked, ...untracked])).filter((file) => !isArtifactWorkspaceFile(file));
         return { ok: true, files: merged };

package/dist/services/skillhub/tar-runtime.js

@@ -62,6 +62,7 @@ export function runTar(args) {
     try {
         execFileSync(cmd, args, {
             stdio: ["ignore", "ignore", "pipe"],
+            windowsHide: true,
             // Surface stderr text rather than dumping a Buffer at the caller.
             // execFileSync with stdio: ["ignore","ignore","pipe"] captures the
             // stderr stream into the Error's `.stderr` Buffer when the child

package/dist/services/skills/hooks-codegate-superpowers.d.ts

@@ -41,6 +41,14 @@ interface ResolvedHookSpec {
  * everywhere else.
  */
 export declare function resolveHookShell(platform?: NodeJS.Platform): string | undefined;
+/**
+ * True when the IDE is tabled in `HOOK_COMMAND_BY_IDE`, i.e. peaks can write a
+ * hook entry for it. `qoder` / `tongyi-lingma` / `zcode` are reserved adapter
+ * ids the registry knows but this table does not, so no hook can exist for
+ * them — which makes "uninstall" a no-op (nothing was ever installed) while
+ * "install" remains a hard failure.
+ */
+export declare function hasHookSpec(ide: IdeId): boolean;
 export declare function resolveHookSpec(ide: IdeId): ResolvedHookSpec;
 /** A typed descriptor for a single peaks-managed hook entry. */
 export type PeaksHookEntry = {

package/dist/services/skills/hooks-codegate-superpowers.js

@@ -8,7 +8,7 @@
  * type contract re-exported by the caller.
  */
 import { getAdapter } from '../ide/ide-registry.js';
-import { HOOK_OUTER_CACHE_COMMAND, HOOK_OUTER_CACHE_EVENT, HOOK_OUTER_CACHE_SENTINEL, HOOK_WORKSPACE_INIT_COMMAND, HOOK_WORKSPACE_INIT_EVENT, HOOK_WORKSPACE_INIT_SENTINEL } from './session-start-hook-constants.js';
+import { HOOK_OUTER_CACHE_COMMAND, HOOK_OUTER_CACHE_EVENT, HOOK_OUTER_CACHE_SENTINEL, HOOK_POST_COMPACT_REINJECT_COMMAND, HOOK_POST_COMPACT_REINJECT_EVENT, HOOK_POST_COMPACT_REINJECT_MATCHER, HOOK_POST_COMPACT_REINJECT_SENTINEL, HOOK_WORKSPACE_INIT_COMMAND, HOOK_WORKSPACE_INIT_EVENT, HOOK_WORKSPACE_INIT_SENTINEL } from './session-start-hook-constants.js';
 /** Sentinel substring identifying a Claude-Code gate-enforce hook entry. */
 export const HOOK_ENFORCE_SENTINEL = 'peaks gate enforce';
 /**
@@ -45,6 +45,16 @@ const HOOK_COMMAND_BY_IDE = {
     // registered. When a slice adds them, add a HOOK_COMMAND_BY_IDE entry
     // here — the function below fail-closes on missing entries.
 };
+/**
+ * True when the IDE is tabled in `HOOK_COMMAND_BY_IDE`, i.e. peaks can write a
+ * hook entry for it. `qoder` / `tongyi-lingma` / `zcode` are reserved adapter
+ * ids the registry knows but this table does not, so no hook can exist for
+ * them — which makes "uninstall" a no-op (nothing was ever installed) while
+ * "install" remains a hard failure.
+ */
+export function hasHookSpec(ide) {
+    return HOOK_COMMAND_BY_IDE[ide] !== undefined;
+}
 export function resolveHookSpec(ide) {
     // getAdapter throws on unregistered IDEs — the registry is the source of truth.
     const adapter = getAdapter(ide);
@@ -53,7 +63,12 @@ export function resolveHookSpec(ide) {
         // Defensive fallback: if an adapter is added to the registry without a
         // HOOK_COMMAND_BY_IDE entry, fail-closed with a clear error instead of
         // silently writing a Claude-shaped entry to a non-Claude settings.json.
-        throw new Error(`peaks hooks install: unsupported IDE '${ide}' (no HOOK_COMMAND_BY_IDE entry; add one to hooks-settings-service.ts)`);
+        //
+        // Caller-neutral on purpose: this one resolver backs install, status,
+        // uninstall and the dry-run plan, so the message names neither a verb
+        // (naming the install verb made an uninstall failure read as an install
+        // failure) nor a file that is not the table.
+        throw new Error(`unsupported IDE '${ide}': no HOOK_COMMAND_BY_IDE entry (add one in hooks-codegate-superpowers.ts)`);
     }
     const isClaudeCode = ide === 'claude-code';
     // Claude Code's gate hook must emit its structured decision as JSON:
@@ -129,6 +144,23 @@ export function resolveHookEntries(ide, _skipProgress = false) {
             command: HOOK_CODE_GATE_COMMAND,
             event: HOOK_CODE_GATE_EVENT
         });
+        // rid 2026-09-13-a2-post-compact-reinject: the post-compaction
+        // engineering-state re-injection. A THIRD SessionStart entry, on a
+        // DIFFERENT matcher (`compact`) than the outer-cache and primer entries
+        // (matcher `''`, i.e. every source). The matcher is what scopes it: the
+        // card belongs in the context after a compaction emptied it, not on a
+        // fresh `startup` where the dispatch context is still present.
+        //
+        // It rides this table rather than a bespoke installer so install,
+        // status, uninstall, the dry-run plan and the workspace-init drift
+        // comparator all see it as one more peaks-managed entry — the same
+        // contract the other two SessionStart entries have.
+        entries.push({
+            sentinel: HOOK_POST_COMPACT_REINJECT_SENTINEL,
+            matcher: HOOK_POST_COMPACT_REINJECT_MATCHER,
+            command: HOOK_POST_COMPACT_REINJECT_COMMAND,
+            event: HOOK_POST_COMPACT_REINJECT_EVENT
+        });
     }
     return entries;
 }
@@ -154,7 +186,12 @@ export function resolveLegacySentinels(ide) {
         // the gate-enforce entry, and so hand-added entries matching this
         // sentinel are recognized as peaks-managed (not stripped as
         // non-Peaks).
-        return [...base, HOOK_OUTER_CACHE_SENTINEL, HOOK_WORKSPACE_INIT_SENTINEL];
+        // rid 2026-09-13-a2-post-compact-reinject: the post-compact re-injection
+        // sentinel joins the same set, so uninstall strips it (and status counts
+        // it) exactly like the other two SessionStart entries. Without this the
+        // entry would be unremovable by `peaks hooks uninstall` — the rollback
+        // path T2 requires.
+        return [...base, HOOK_OUTER_CACHE_SENTINEL, HOOK_WORKSPACE_INIT_SENTINEL, HOOK_POST_COMPACT_REINJECT_SENTINEL];
     }
     return base;
 }

package/dist/services/skills/hooks-settings-service.d.ts

@@ -116,6 +116,18 @@ export type HookStatus = {
     localSettingsPath?: string;
     localExists?: boolean;
     installed: boolean;
+    /**
+     * Whether this IDE can host a peaks hook AT ALL (`hasHookSpec`).
+     *
+     * `status` answers "what is on disk", and for an IDE with no
+     * `HOOK_COMMAND_BY_IDE` entry the answer is "nothing, and nothing ever will
+     * be" — which is a successful query returning a negative fact, not a failed
+     * one. The exit code says the query succeeded; this field says what it found.
+     * Without it `installed: false` would be indistinguishable from a supported
+     * IDE that simply has no hook installed yet, which is a state the user can
+     * act on.
+     */
+    supportsHooks: boolean;
 };
 /**
  * Slice #014: read the *actually-installed* peaks-managed hook entries

package/dist/services/skills/hooks-settings-service.js

@@ -4,7 +4,7 @@ import { join, resolve } from 'node:path';
 import { assertSafeSettingsFile } from '../ide/shared/safe-path.js';
 import { atomicWriteJson, readJsonObjectFile } from '../ide/shared/atomic-json.js';
 import { getAdapter } from '../ide/ide-registry.js';
-import { resolveHookSpec, resolveHookEntries, resolveLegacySentinels, SUPERPOWERS_DENIED_SKILLS, formatSuperpowersDenyEntry, SUPERPOWERS_DENY_SENTINELS, hasExternalGateExemptions, withExternalGateExemptions, withoutExternalGateExemptions } from './hooks-codegate-superpowers.js';
+import { resolveHookSpec, resolveHookEntries, hasHookSpec, resolveLegacySentinels, SUPERPOWERS_DENIED_SKILLS, formatSuperpowersDenyEntry, SUPERPOWERS_DENY_SENTINELS, hasExternalGateExemptions, withExternalGateExemptions, withoutExternalGateExemptions } from './hooks-codegate-superpowers.js';
 export { HOOK_ENFORCE_SENTINEL, HOOK_CODE_GATE_SENTINEL, HOOK_CODE_GATE_MATCHER, HOOK_CODE_GATE_EVENT, HOOK_CODE_GATE_COMMAND, SUPERPOWERS_DENIED_SKILLS } from './hooks-codegate-superpowers.js';
 // --- Module-level defaults (claude-code) -----------------------------------
 // These exports remain for backward compat — tests and downstream callers
@@ -44,25 +44,49 @@ function assertSafeSettingsPathCompat(scope, ide, root, settingsPath) {
         throw new Error(`settings path drift: ${expected} vs ${settingsPath}`);
     }
 }
-/** Machine-local sibling of the adapter's settings file (Claude Code convention). */
-const LOCAL_SETTINGS_FILE_NAME = 'settings.local.json';
-/** IDEs whose hook settings have a machine-local, gitignored sibling file. */
-const IDES_WITH_LOCAL_SETTINGS = new Set(['claude-code']);
 /**
  * Resolve the machine-local settings file an IDE may carry (e.g. Claude
  * Code's `.claude/settings.local.json`), or `undefined` when there is none.
  *
+ * B3(b) 2026-09-13: the machine-local layer is an adapter-DECLARED capability,
+ * not a name list. It used to be two hardcoded facts here — a `Set(['claude-code'])`
+ * membership test and the filename literal `'settings.local.json'` — i.e. a
+ * module that routes per-IDE was itself naming one IDE and one IDE's file.
+ * Both now read off the adapter that owns them
+ * (`IdeSettingsLocation.localSettingsFileName`), exactly as
+ * `auto-compact-dispatcher.ts` already did for the same field.
+ *
+ * Behaviour is UNCHANGED, and that was verified rather than assumed: over all
+ * nine registered `IdeId`s, `IDES_WITH_LOCAL_SETTINGS.has(id)` was `true` for
+ * exactly the ids whose adapter declares `localSettingsFileName` (claude-code
+ * alone, `'settings.local.json'`). So the set was an exact duplicate of a
+ * declaration the adapters already carried, not an independent policy — and
+ * a new adapter that declares the field now gets this path for free instead
+ * of being silently denied it.
+ *
+ * This ALSO removes a live instance of the vendor guard's limit 1 (indirect
+ * identity: `SET.has(ide)`), which no AST check over comparisons or literals
+ * can see. The guard's header named this exact line as the example.
+ *
  * Global scope resolves to `undefined`: the global settings file
  * (`~/.claude/settings.json`) is already machine-local, so nothing needs
  * relocating there.
  */
 function resolveLocalSettingsPath(scope, ide, projectRoot) {
-    if (scope === 'global' || !IDES_WITH_LOCAL_SETTINGS.has(ide))
+    if (scope === 'global')
         return undefined;
-    const root = resolveSettingsRoot(scope, projectRoot);
     const adapter = getAdapter(ide);
-    assertSafeSettingsFile(scope, root, adapter.settings.dirName, LOCAL_SETTINGS_FILE_NAME);
-    return join(root, adapter.settings.dirName, LOCAL_SETTINGS_FILE_NAME);
+    const localFileName = adapter.settings.localSettingsFileName;
+    // `undefined` = this IDE has no machine-local layer. Note the order: a
+    // caller reaching here with an id the registry does not know still throws
+    // from `getAdapter` above, exactly as it did before — every path into this
+    // function already called `getAdapter(ide)` via `resolveSettingsPath`, so
+    // no new throw path is introduced.
+    if (localFileName === undefined)
+        return undefined;
+    const root = resolveSettingsRoot(scope, projectRoot);
+    assertSafeSettingsFile(scope, root, adapter.settings.dirName, localFileName);
+    return join(root, adapter.settings.dirName, localFileName);
 }
 function resolveHookTargets(scope, ide, projectRoot) {
     const sharedPath = resolveSettingsPath(scope, ide, projectRoot);
@@ -453,6 +477,24 @@ export function removeHookInstall(scope, projectRoot, options) {
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
+    // An IDE with no HOOK_COMMAND_BY_IDE entry can never carry a peaks hook, so
+    // "remove it" is already true. That is a no-op success, not a failure: the
+    // post-condition the caller asked for holds. This stays asymmetric with
+    // `applyHookInstall`, which still fails closed for the same IDEs — reporting
+    // a successful install there would claim an enforcement that cannot exist.
+    //
+    // `resolveHookTargets` below is what throws for these IDEs, so the check has
+    // to come first. Note `resolveSettingsPath` above still runs: an IDE the
+    // adapter registry does not know at all remains a hard error.
+    if (!hasHookSpec(ide)) {
+        const localSettingsPath = resolveLocalSettingsPath(scope, ide, projectRoot);
+        return {
+            scope,
+            settingsPath,
+            removed: false,
+            ...(localSettingsPath !== undefined && localSettingsPath !== settingsPath ? { localSettingsPath } : {})
+        };
+    }
     const targets = resolveHookTargets(scope, ide, projectRoot);
     const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
     const present = targets.filter((t) => existsSync(t.settingsPath));
@@ -528,6 +570,30 @@ export function readHookStatus(scope, projectRoot, options) {
     const root = resolveSettingsRoot(scope, projectRoot);
     const settingsPath = resolveSettingsPath(scope, ide, projectRoot);
     assertSafeSettingsPathCompat(scope, ide, root, settingsPath);
+    // An IDE with no HOOK_COMMAND_BY_IDE entry has no hook on disk and can never
+    // have one, so "what is installed?" has a definite answer: nothing. That is a
+    // no-op success, exactly like `removeHookInstall` — the query ran, the disk
+    // was read, and the honest reply is `supportsHooks: false, installed: false`.
+    // This stays asymmetric with `applyHookInstall`, which still fails closed for
+    // the same IDEs: reporting a successful INSTALL would claim an enforcement
+    // that cannot exist, whereas reporting a successful STATUS claims nothing.
+    //
+    // `resolveHookTargets` below is what throws for these IDEs, so the check has
+    // to come first. `resolveSettingsPath` above still runs: an IDE the adapter
+    // registry does not know at all remains a hard error.
+    if (!hasHookSpec(ide)) {
+        const localSettingsPath = resolveLocalSettingsPath(scope, ide, projectRoot);
+        return {
+            scope,
+            settingsPath,
+            exists: existsSync(settingsPath),
+            ...(localSettingsPath !== undefined && localSettingsPath !== settingsPath
+                ? { localSettingsPath, localExists: existsSync(localSettingsPath) }
+                : {}),
+            installed: false,
+            supportsHooks: false
+        };
+    }
     const targets = resolveHookTargets(scope, ide, projectRoot);
     const exists = existsSync(settingsPath);
     const localTarget = targets.find((t) => t.settingsPath !== settingsPath);
@@ -541,7 +607,8 @@ export function readHookStatus(scope, projectRoot, options) {
         installed: targets.some((t) => {
             const settings = readSettingsFile(t.settingsPath);
             return Object.keys(settings).length > 0 && isInstalledForEntries(settings, t.entries);
-        })
+        }),
+        supportsHooks: true
     };
 }
 /**

package/dist/services/skills/session-start-hook-constants.d.ts

@@ -25,6 +25,47 @@
  */
 /** Sentinel substring identifying a SessionStart outer-cache hook entry. */
 export declare const HOOK_OUTER_CACHE_SENTINEL = "peaks outer-cache write";
+/**
+ * rid `2026-09-13-a2-post-compact-reinject` — SessionStart entry scoped to
+ * `matcher: 'compact'` that puts the engineering state back into the context
+ * a compaction just emptied.
+ *
+ * This is the official mechanism, and the `matcher` is the load-bearing part
+ * of it: Claude Code adds a `SessionStart` hook's plain-text stdout to the
+ * context, and scoping to `compact` means the card is re-injected AFTER a
+ * compaction rather than on every fresh session. Compaction itself cannot be
+ * initiated from here — the harness performs it, and a hook can only observe
+ * or veto. Re-injection is the half that IS available to us.
+ *
+ * Why a separate entry instead of folding this into the `peaks session
+ * primer` entry that already runs on every SessionStart: the primer's own
+ * contract is "rotation + presence cleanup", it fires on `startup` too (where
+ * the dispatch context is still in the history and the card would be noise),
+ * and its output is a rotation envelope rather than an engineering-state
+ * card. Two entries, two intents — each one's output means exactly one thing.
+ */
+export declare const HOOK_POST_COMPACT_REINJECT_SENTINEL = "peaks session reinject";
+/**
+ * The reinject hook command. `--project "${CLAUDE_PROJECT_DIR}"` matches the
+ * other two SessionStart entries: `${CLAUDE_PROJECT_DIR}` is Claude Code's
+ * standard project-root convention, and the CLI resolves it strictly (a
+ * SessionStart payload is env-driven and must not be trusted as a path).
+ *
+ * `--quiet-failure` is NOT a flag and deliberately so: printing nothing on
+ * failure is this command's unconditional behaviour, not something a caller
+ * opts into. See `reinject-command.ts` — stdout IS context here, so an error
+ * message on stdout would be injected into the model's context as though
+ * peaks-loop meant it.
+ */
+export declare const HOOK_POST_COMPACT_REINJECT_COMMAND = "peaks session reinject --project \"${CLAUDE_PROJECT_DIR}\"";
+/** SessionStart hook event key (same as outer-cache + primer). */
+export declare const HOOK_POST_COMPACT_REINJECT_EVENT = "SessionStart";
+/**
+ * The SessionStart `source` value the re-injection is scoped to. Claude Code
+ * reports `compact` as the SessionStart source when the session is resuming
+ * from a compaction; the hook entry's `matcher` is matched against it.
+ */
+export declare const HOOK_POST_COMPACT_REINJECT_MATCHER = "compact";
 /** Default (claude-code) SessionStart hook command. */
 export declare const HOOK_OUTER_CACHE_COMMAND = "peaks outer-cache write --project \"${CLAUDE_PROJECT_DIR}\"";
 /** SessionStart hook event key for Claude Code. */

package/dist/services/skills/session-start-hook-constants.js

@@ -25,6 +25,47 @@
  */
 /** Sentinel substring identifying a SessionStart outer-cache hook entry. */
 export const HOOK_OUTER_CACHE_SENTINEL = 'peaks outer-cache write';
+/**
+ * rid `2026-09-13-a2-post-compact-reinject` — SessionStart entry scoped to
+ * `matcher: 'compact'` that puts the engineering state back into the context
+ * a compaction just emptied.
+ *
+ * This is the official mechanism, and the `matcher` is the load-bearing part
+ * of it: Claude Code adds a `SessionStart` hook's plain-text stdout to the
+ * context, and scoping to `compact` means the card is re-injected AFTER a
+ * compaction rather than on every fresh session. Compaction itself cannot be
+ * initiated from here — the harness performs it, and a hook can only observe
+ * or veto. Re-injection is the half that IS available to us.
+ *
+ * Why a separate entry instead of folding this into the `peaks session
+ * primer` entry that already runs on every SessionStart: the primer's own
+ * contract is "rotation + presence cleanup", it fires on `startup` too (where
+ * the dispatch context is still in the history and the card would be noise),
+ * and its output is a rotation envelope rather than an engineering-state
+ * card. Two entries, two intents — each one's output means exactly one thing.
+ */
+export const HOOK_POST_COMPACT_REINJECT_SENTINEL = 'peaks session reinject';
+/**
+ * The reinject hook command. `--project "${CLAUDE_PROJECT_DIR}"` matches the
+ * other two SessionStart entries: `${CLAUDE_PROJECT_DIR}` is Claude Code's
+ * standard project-root convention, and the CLI resolves it strictly (a
+ * SessionStart payload is env-driven and must not be trusted as a path).
+ *
+ * `--quiet-failure` is NOT a flag and deliberately so: printing nothing on
+ * failure is this command's unconditional behaviour, not something a caller
+ * opts into. See `reinject-command.ts` — stdout IS context here, so an error
+ * message on stdout would be injected into the model's context as though
+ * peaks-loop meant it.
+ */
+export const HOOK_POST_COMPACT_REINJECT_COMMAND = `peaks session reinject --project "\${CLAUDE_PROJECT_DIR}"`;
+/** SessionStart hook event key (same as outer-cache + primer). */
+export const HOOK_POST_COMPACT_REINJECT_EVENT = 'SessionStart';
+/**
+ * The SessionStart `source` value the re-injection is scoped to. Claude Code
+ * reports `compact` as the SessionStart source when the session is resuming
+ * from a compaction; the hook entry's `matcher` is matched against it.
+ */
+export const HOOK_POST_COMPACT_REINJECT_MATCHER = 'compact';
 /** Default (claude-code) SessionStart hook command. */
 export const HOOK_OUTER_CACHE_COMMAND = `peaks outer-cache write --project "\${CLAUDE_PROJECT_DIR}"`;
 /** SessionStart hook event key for Claude Code. */