peaks-loop 4.0.47 → 4.0.49

package/dist/services/session/getSessionDir.d.ts

@@ -1 +1,34 @@
 export declare function getSessionDir(projectRoot: string, sessionId: string): string;
+/**
+ * The TOTAL entry to the same axis. Same predicate, same path; the only
+ * difference is that this one is total — it never throws.
+ *
+ * WHY TWO ENTRIES RATHER THAN ONE. The partial entry above is correct
+ * for a caller that cannot proceed without a session dir: a throw is
+ * the one failure a caller cannot forget to handle. It is the WRONG
+ * shape for a frame whose own doc promises never to throw — the
+ * statusline, the fire-and-forget telemetry writer, the best-effort
+ * probe. Each of those frames had to wrap the partial entry in a
+ * `try { } catch { return null }`, and that swallow cannot be told
+ * apart from a real "there is nothing here" answer. Measured on the
+ * compact backoff (`auto-compact-lifecycle.ts`), the conflation turned
+ * an unresolvable id into the ADMIT branch and re-opened a dispatch
+ * that the open run should have suppressed.
+ *
+ * The split does NOT make a swallow unwriteable — TypeScript has no
+ * checked exceptions, so nothing here can. It makes the swallow
+ * UNNECESSARY at a named place, and it gives every checker a stable
+ * name to key on: a frame that degrades must say so by calling this
+ * function, and the degrading branch (`ok: false`) is then a value the
+ * caller has to handle rather than a `catch` nobody reads.
+ *
+ * `reason` is a single-line English sentence fit for an envelope — no
+ * stack traces, no CLI verbs (see `human-nl-choice-only-tenet`).
+ */
+export declare function tryGetSessionDir(projectRoot: string, sessionId: string): {
+    readonly ok: true;
+    readonly dir: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};

package/dist/services/session/getSessionDir.js

@@ -22,11 +22,71 @@
  *       legacy `.peaks/<sid>/...` artifact path that a sub-agent would
  *       follow verbatim.
  *
+ * `sessionId` is the last caller-supplied segment of every session-scoped
+ * path here, so its segment check lives at this join rather than being
+ * re-derived at each call site: `../../x` used to be joined verbatim, and
+ * the CLI wrote outside the project root while still returning `ok: true`.
+ *
+ * The predicate is `isUnsafePathInput`, NOT `SESSION_ID_PATTERN` /
+ * `validateSessionId`. The latter are stricter than the segment axis and
+ * reject ids that are legal today (`sid-1`, a request id reused as the
+ * session-dir name), so adopting them would change results for
+ * well-formed callers.
+ *
+ * Not covered, recorded rather than implied: the `\0` axis
+ * (`isUnsafePathInput` admits a NUL, and `execFileSync` raises EINVAL
+ * before it can be exercised), and callers that hand-roll
+ * `join(root, '.peaks', '_runtime', sid, ...)` instead of calling this.
+ *
  * @param projectRoot - Absolute path to the project root.
  * @param sessionId - The session identifier (e.g. `2026-06-06-session-5b1095`).
  * @returns Absolute path to the canonical session directory.
+ * @throws Error when `sessionId` is not a single path segment.
  */
 import { join } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 export function getSessionDir(projectRoot, sessionId) {
+    // Throwing, not `null` / a tagged result: those widen the return type
+    // to `string | null` and make every call site handle a bad id — the
+    // per-site slice this guard replaces. This is also the shape the repo
+    // already refuses with, and a caller cannot forget to handle a throw.
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     return join(projectRoot, '.peaks', '_runtime', sessionId);
 }
+/**
+ * The TOTAL entry to the same axis. Same predicate, same path; the only
+ * difference is that this one is total — it never throws.
+ *
+ * WHY TWO ENTRIES RATHER THAN ONE. The partial entry above is correct
+ * for a caller that cannot proceed without a session dir: a throw is
+ * the one failure a caller cannot forget to handle. It is the WRONG
+ * shape for a frame whose own doc promises never to throw — the
+ * statusline, the fire-and-forget telemetry writer, the best-effort
+ * probe. Each of those frames had to wrap the partial entry in a
+ * `try { } catch { return null }`, and that swallow cannot be told
+ * apart from a real "there is nothing here" answer. Measured on the
+ * compact backoff (`auto-compact-lifecycle.ts`), the conflation turned
+ * an unresolvable id into the ADMIT branch and re-opened a dispatch
+ * that the open run should have suppressed.
+ *
+ * The split does NOT make a swallow unwriteable — TypeScript has no
+ * checked exceptions, so nothing here can. It makes the swallow
+ * UNNECESSARY at a named place, and it gives every checker a stable
+ * name to key on: a frame that degrades must say so by calling this
+ * function, and the degrading branch (`ok: false`) is then a value the
+ * caller has to handle rather than a `catch` nobody reads.
+ *
+ * `reason` is a single-line English sentence fit for an envelope — no
+ * stack traces, no CLI verbs (see `human-nl-choice-only-tenet`).
+ */
+export function tryGetSessionDir(projectRoot, sessionId) {
+    // Deliberately NOT `try { return {ok:true, dir: getSessionDir(...)} } catch`.
+    // That would re-introduce the swallow this function exists to remove, and it
+    // would also catch a throw from `join` for reasons that are not a bad id.
+    if (isUnsafePathInput(sessionId)) {
+        return { ok: false, reason: `Invalid session id: ${sessionId} (must be a single path segment)` };
+    }
+    return { ok: true, dir: join(projectRoot, '.peaks', '_runtime', sessionId) };
+}

package/dist/services/session/session-checkpoint-service.js

@@ -12,6 +12,7 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join, sep } from 'node:path';
 import { emitObservabilityEvent } from '../observability/observability-service.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 const CHECKPOINTS_DIR = 'checkpoints';
 const CHECKPOINT_FILENAME_EXT = '.json';
 const MAX_CHECKPOINTS = 10;
@@ -76,6 +77,13 @@ function pruneOldest(dir) {
     return removed;
 }
 export function writeCheckpoint(projectRoot, options) {
+    // Sid axis, placed before the first read and the first `mkdir`. Both
+    // `peaks session checkpoint --session-id` and `peaks compact force
+    // --session-id` reach this same function, so one guard closes both measured
+    // surfaces — they were never two joins.
+    if (isUnsafePathInput(options.sessionId)) {
+        throw new Error(`Invalid session id: ${options.sessionId} (must be a single path segment)`);
+    }
     const now = (options.now ?? (() => new Date()))();
     const createdAt = now.toISOString();
     const lastActivity = readSessionLastActivity(projectRoot, options.sessionId) || createdAt;

package/dist/services/skill/resume-detector.js

@@ -32,6 +32,7 @@
  */
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { readArtifactState } from '../artifacts/request-artifact-state-helpers.js';
 const MID_IMPL_RD_STATES = new Set([
     'spec-locked',
     'implemented',
@@ -192,13 +193,21 @@ function classifyTerminalGates(sessionDir, ctx) {
     // RD qa-handoff → deepest gate is C. If the review artifacts are
     // missing the state is inconsistent; fall back to rd-review-fanout.
     if (ctx.primaryRd !== null && ctx.primaryRd.state === 'qa-handoff') {
-        const codeReviewPath = join(sessionDir, 'rd', 'code-review.md');
-        const securityReviewPath = join(sessionDir, 'rd', 'security-review.md');
+        // Slice `2026-09-14-audit-artifact-rid-scoping`: the fan-out evidence
+        // filenames carry the rid. Probe the canonical rid-scoped name first and
+        // the pre-rid names behind it — the same order the transition gate
+        // resolves in, so an inconsistent-looking slice here means the fan-out
+        // never ran, not that it wrote to a name this reader does not know.
+        const rid = ridOf(ctx.primaryRd.filename);
         const missing = [];
-        if (!existsSync(codeReviewPath))
-            missing.push('rd/code-review.md');
-        if (!existsSync(securityReviewPath))
-            missing.push('rd/security-review.md');
+        const codeReviewCandidates = [`rd/code-review-${rid}.md`, 'rd/code-review.md'];
+        const securityCandidates = [`audit/security-${rid}.md`, 'audit/security.md', 'rd/security-review.md'];
+        if (!codeReviewCandidates.some((rel) => existsSync(join(sessionDir, rel)))) {
+            missing.push(codeReviewCandidates[0]);
+        }
+        if (!securityCandidates.some((rel) => existsSync(join(sessionDir, rel)))) {
+            missing.push(securityCandidates[0]);
+        }
         if (missing.length > 0) {
             return {
                 kind: 'resume',
@@ -317,12 +326,21 @@ function readRequestStates(sessionDir, role) {
         };
     });
 }
+/** Empty string (not 'unknown') when the artifact has no state line — `primaryPrd.state.length > 0` below depends on that. */
 function extractState(content) {
-    const match = /^-\s*state:\s*(\S+)|^state:\s*(\S+)/m.exec(content);
-    if (match === null)
-        return '';
-    const captured = match[1] ?? match[2] ?? '';
-    return captured.trim();
+    return readArtifactState(content) ?? '';
+}
+/**
+ * The `<rid>` embedded in a request filename: drop the `.md` suffix and the
+ * zero-padded `NNN-` prefix `request init` writes.
+ *
+ * Uses the same `^0\d{2}-` rule as the request loader
+ * (`request-artifact-service.ts`: "Only strip 3-digit zero-padded prefixes").
+ * A looser `^\d+-` would eat the leading year of every real rid, which is
+ * itself date-shaped (`2026-09-14-<slug>`).
+ */
+function ridOf(filename) {
+    return filename.replace(/^0\d{2}-/, '').replace(/\.md$/, '');
 }
 function hasAbandonedTransitionNote(content) {
     return /user-requested-abandon/.test(content);

package/dist/services/skills/hooks-codegate-superpowers.d.ts

@@ -39,6 +39,12 @@ interface ResolvedHookSpec {
  * cannot help; pinning the hook's `shell` is the only lever the hook schema
  * offers. The platform-neutral default (`undefined` → omit the key) is kept
  * everywhere else.
+ *
+ * Scope note: this is applied to the `Bash`-matcher handlers only. The three
+ * `SessionStart` entries are deliberately NOT pinned, and not because the
+ * mechanism is believed absent there — see the block comment in
+ * `resolveHookEntries` for what is and is not established, and for why adding
+ * the pin in place would break every non-Windows teammate.
  */
 export declare function resolveHookShell(platform?: NodeJS.Platform): string | undefined;
 /**

package/dist/services/skills/hooks-codegate-superpowers.js

@@ -8,7 +8,7 @@
  * type contract re-exported by the caller.
  */
 import { getAdapter } from '../ide/ide-registry.js';
-import { HOOK_OUTER_CACHE_COMMAND, HOOK_OUTER_CACHE_EVENT, HOOK_OUTER_CACHE_SENTINEL, HOOK_POST_COMPACT_REINJECT_COMMAND, HOOK_POST_COMPACT_REINJECT_EVENT, HOOK_POST_COMPACT_REINJECT_MATCHER, HOOK_POST_COMPACT_REINJECT_SENTINEL, HOOK_WORKSPACE_INIT_COMMAND, HOOK_WORKSPACE_INIT_EVENT, HOOK_WORKSPACE_INIT_SENTINEL } from './session-start-hook-constants.js';
+import { HOOK_COMPACT_SETTLE_COMMAND, HOOK_COMPACT_SETTLE_EVENT, HOOK_COMPACT_SETTLE_MATCHER, HOOK_COMPACT_SETTLE_SENTINEL, HOOK_OUTER_CACHE_COMMAND, HOOK_OUTER_CACHE_EVENT, HOOK_OUTER_CACHE_SENTINEL, HOOK_POST_COMPACT_REINJECT_COMMAND, HOOK_POST_COMPACT_REINJECT_EVENT, HOOK_POST_COMPACT_REINJECT_MATCHER, HOOK_POST_COMPACT_REINJECT_SENTINEL, HOOK_WORKSPACE_INIT_COMMAND, HOOK_WORKSPACE_INIT_EVENT, HOOK_WORKSPACE_INIT_SENTINEL } from './session-start-hook-constants.js';
 /** Sentinel substring identifying a Claude-Code gate-enforce hook entry. */
 export const HOOK_ENFORCE_SENTINEL = 'peaks gate enforce';
 /**
@@ -20,6 +20,12 @@ export const HOOK_ENFORCE_SENTINEL = 'peaks gate enforce';
  * cannot help; pinning the hook's `shell` is the only lever the hook schema
  * offers. The platform-neutral default (`undefined` → omit the key) is kept
  * everywhere else.
+ *
+ * Scope note: this is applied to the `Bash`-matcher handlers only. The three
+ * `SessionStart` entries are deliberately NOT pinned, and not because the
+ * mechanism is believed absent there — see the block comment in
+ * `resolveHookEntries` for what is and is not established, and for why adding
+ * the pin in place would break every non-Windows teammate.
  */
 export function resolveHookShell(platform = process.platform) {
     return platform === 'win32' ? 'powershell' : undefined;
@@ -112,6 +118,37 @@ export function resolveHookEntries(ide, _skipProgress = false) {
             ...(spec.hookEnforceShell !== undefined ? { shell: spec.hookEnforceShell } : {})
         }
     ];
+    // ── Why the three SessionStart entries below carry NO `shell` pin ─────────
+    //
+    // The gate-enforce entry above is shell-pinned on Windows (see
+    // `resolveHookShell`) because Claude Code runs a shell-form hook command
+    // through a shell that defaults to bash — Git Bash / MSYS2 on Windows — and
+    // MSYS2 bash force-allocates its own console window. That reason is a
+    // property of the hook RUNNER's shell resolution, not of the `PreToolUse`
+    // event: nothing in it exempts `SessionStart`, so the same command-form
+    // entry on this event goes through the same shell. The pin was applied only
+    // to the `Bash`-matcher handlers because those were the ones the reporter
+    // could see (they run on EVERY Bash tool call); these three run once per
+    // session, so a window here — if there is one — is a single flash rather
+    // than a per-tool-call nuisance. That is a difference in frequency, not
+    // evidence that the window does not appear, and no A/B measurement on this
+    // event exists.
+    //
+    // The pin is nonetheless NOT applied here, and adding it would be a defect
+    // rather than a fix: `shell: "powershell"` resolves to `pwsh`, these entries
+    // are written to the COMMITTED `.claude/settings.json`, and a macOS / Linux
+    // teammate reading that file has no `pwsh` — the exact cross-platform damage
+    // the machine-local split exists to prevent (see the gate-enforce entry's
+    // `machineLocal` flag, and commit 4637baa8's rationale).
+    //
+    // A correct fix therefore has to move these three entries to the
+    // machine-local file as well, which changes where a fresh clone gets its
+    // SessionStart hooks: today they arrive with the repository, after such a
+    // change they would require `peaks hooks install` / `peaks workspace init`.
+    // That is a product-shape decision, not a leftover; it is recorded here so
+    // that whoever makes it starts from the reason the pin is absent instead of
+    // re-deriving it — or, worse, adding the pin in place and breaking every
+    // non-Windows teammate.
     if (ide === 'claude-code') {
         entries.push({
             sentinel: HOOK_OUTER_CACHE_SENTINEL,
@@ -161,6 +198,24 @@ export function resolveHookEntries(ide, _skipProgress = false) {
             command: HOOK_POST_COMPACT_REINJECT_COMMAND,
             event: HOOK_POST_COMPACT_REINJECT_EVENT
         });
+        // rid 2026-09-13-compact-event-settle: the harness's OWN "a compaction
+        // completed" event, which is the only signal that settles a compact as a
+        // FACT rather than as an inference from a ratio that fell.
+        //
+        // No `machineLocal` flag, so this lands in the shared, committed
+        // `.claude/settings.json` — the same file as the three SessionStart entries
+        // above, and NOT the machine-local file the workspace-init materializer
+        // owns. That routing IS the answer to "who owns the `hooks` key for this
+        // entry": the only writer that could delete it is the one that installed
+        // it. See `session-start-hook-constants.ts` for why it also carries no
+        // `shell` pin, and `mergeHooksTree` for the second line of defence if it
+        // ever moves.
+        entries.push({
+            sentinel: HOOK_COMPACT_SETTLE_SENTINEL,
+            matcher: HOOK_COMPACT_SETTLE_MATCHER,
+            command: HOOK_COMPACT_SETTLE_COMMAND,
+            event: HOOK_COMPACT_SETTLE_EVENT
+        });
     }
     return entries;
 }
@@ -191,7 +246,11 @@ export function resolveLegacySentinels(ide) {
         // it) exactly like the other two SessionStart entries. Without this the
         // entry would be unremovable by `peaks hooks uninstall` — the rollback
         // path T2 requires.
-        return [...base, HOOK_OUTER_CACHE_SENTINEL, HOOK_WORKSPACE_INIT_SENTINEL, HOOK_POST_COMPACT_REINJECT_SENTINEL];
+        // rid 2026-09-13-compact-event-settle: the PostCompact settle sentinel joins
+        // too — same rollback argument as the reinject entry above. A hook that
+        // `peaks hooks uninstall` cannot remove is a hook the user cannot get rid
+        // of, and this one fires on every compaction.
+        return [...base, HOOK_OUTER_CACHE_SENTINEL, HOOK_WORKSPACE_INIT_SENTINEL, HOOK_POST_COMPACT_REINJECT_SENTINEL, HOOK_COMPACT_SETTLE_SENTINEL];
     }
     return base;
 }

package/dist/services/skills/hooks-settings-service.js

@@ -322,10 +322,20 @@ function shapeMatchesDesired(settings, entries, allPeaksSentinels) {
                 return false;
             }
         }
-        // (b) every desired entry must be on disk.
-        for (const sentinel of desiredSentinels) {
-            const has = peaksPresent.some((entry) => (entry.hooks ?? []).some((h) => String(h.command ?? '').includes(sentinel)));
-            if (!has)
+        // (b) every desired entry must be on disk AND carry the matcher it declares.
+        //     Presence alone cannot see a WRONG matcher, and a wrong matcher is not
+        //     cosmetic: `''` and `Bash|Task` route the same command to different
+        //     tool sets, so the entry is present while the hook never fires on the
+        //     tools it was installed for. Measured (rid `2026-09-13-compact-event-settle`,
+        //     residual R2): a `PostCompact` entry hand-corrupted to matcher
+        //     `auto|manual` survived `peaks hooks install` unchanged, and the
+        //     installer was structurally unable to repair it.
+        //     An absent matcher reads as `''` — the form Claude Code takes as "every
+        //     source" — so a file written before matchers were explicit converges
+        //     once instead of churning on every install.
+        for (const desired of entries.filter((e) => e.event === eventKey)) {
+            const onDisk = peaksPresent.find((entry) => (entry.hooks ?? []).some((h) => String(h.command ?? '').includes(desired.sentinel)));
+            if (onDisk === undefined || (onDisk.matcher ?? '') !== desired.matcher)
                 return false;
         }
     }

package/dist/services/skills/session-start-hook-constants.d.ts

@@ -83,3 +83,48 @@ export declare const HOOK_WORKSPACE_INIT_SENTINEL = "peaks session primer";
 export declare const HOOK_WORKSPACE_INIT_COMMAND = "peaks session primer --project \"${CLAUDE_PROJECT_DIR}\"";
 /** SessionStart hook event key (same as outer-cache). */
 export declare const HOOK_WORKSPACE_INIT_EVENT = "SessionStart";
+/**
+ * rid `2026-09-13-compact-event-settle` — the `PostCompact` entry that lets the
+ * harness's own event settle a compact, instead of the next `context-now` probe
+ * inferring one from a ratio that fell.
+ *
+ * WHY THIS ENTRY IS NOT A `SessionStart` ONE, despite living in this file: the
+ * three entries above all ride `SessionStart` and differ only by matcher. A
+ * `PostCompact` hook is a different EVENT that carries the one fact no
+ * `SessionStart` payload has — whether the compaction the harness just
+ * completed was `auto` or `manual`. That distinction is the whole question
+ * ("has this machine ever auto-compacted?"), and without it peaks-loop can only
+ * ever see that SOMETHING compacted. See `compact-event-settle.ts` for what the
+ * command does with it.
+ *
+ * WHY THE MATCHER IS THE EMPTY STRING and not the documented `auto|manual`:
+ * both trigger values are wanted, so the matcher must filter nothing. An empty
+ * matcher is the convention the three `SessionStart` entries already rely on to
+ * match every source, and it is the only form that cannot fail SILENTLY — an
+ * alternation string is a match-everything pattern under regex semantics but
+ * matches NEITHER value under exact-equality semantics, and a hook that never
+ * fires looks exactly like a hook with nothing to report.
+ */
+export declare const HOOK_COMPACT_SETTLE_SENTINEL = "peaks compact settle";
+/**
+ * The settle hook command. `--project "${CLAUDE_PROJECT_DIR}"` is byte-for-byte
+ * the shape of the three `SessionStart` entries above — Claude Code's standard
+ * project-root convention, resolved strictly on the CLI side (a hook payload is
+ * env-driven and must not be trusted as a path).
+ *
+ * The command prints NOTHING on the hook path and exits 0 for every outcome.
+ * `PostCompact`'s stdin/stdout contract is truncated in the retrievable docs,
+ * so the safe assumption is the `SessionStart` one — stdout may be added to the
+ * model's context. An error message there would be read as a fact. See
+ * `compact-event-settle.ts`.
+ *
+ * No `shell` pin, deliberately: this entry lands in the shared, committed
+ * `.claude/settings.json`, and a `powershell` pin there would break every
+ * macOS / Linux reader of the file. See `resolveHookEntries`' comment block for
+ * the full reason the three `SessionStart` entries are unpinned too.
+ */
+export declare const HOOK_COMPACT_SETTLE_COMMAND = "peaks compact settle --project \"${CLAUDE_PROJECT_DIR}\"";
+/** The event this entry rides. Claude Code fires it after a compaction completes. */
+export declare const HOOK_COMPACT_SETTLE_EVENT = "PostCompact";
+/** Matcher: empty = every `trigger` (`auto` and `manual`). See the sentinel doc. */
+export declare const HOOK_COMPACT_SETTLE_MATCHER = "";

package/dist/services/skills/session-start-hook-constants.js

@@ -83,3 +83,48 @@ export const HOOK_WORKSPACE_INIT_SENTINEL = 'peaks session primer';
 export const HOOK_WORKSPACE_INIT_COMMAND = `peaks session primer --project "\${CLAUDE_PROJECT_DIR}"`;
 /** SessionStart hook event key (same as outer-cache). */
 export const HOOK_WORKSPACE_INIT_EVENT = 'SessionStart';
+/**
+ * rid `2026-09-13-compact-event-settle` — the `PostCompact` entry that lets the
+ * harness's own event settle a compact, instead of the next `context-now` probe
+ * inferring one from a ratio that fell.
+ *
+ * WHY THIS ENTRY IS NOT A `SessionStart` ONE, despite living in this file: the
+ * three entries above all ride `SessionStart` and differ only by matcher. A
+ * `PostCompact` hook is a different EVENT that carries the one fact no
+ * `SessionStart` payload has — whether the compaction the harness just
+ * completed was `auto` or `manual`. That distinction is the whole question
+ * ("has this machine ever auto-compacted?"), and without it peaks-loop can only
+ * ever see that SOMETHING compacted. See `compact-event-settle.ts` for what the
+ * command does with it.
+ *
+ * WHY THE MATCHER IS THE EMPTY STRING and not the documented `auto|manual`:
+ * both trigger values are wanted, so the matcher must filter nothing. An empty
+ * matcher is the convention the three `SessionStart` entries already rely on to
+ * match every source, and it is the only form that cannot fail SILENTLY — an
+ * alternation string is a match-everything pattern under regex semantics but
+ * matches NEITHER value under exact-equality semantics, and a hook that never
+ * fires looks exactly like a hook with nothing to report.
+ */
+export const HOOK_COMPACT_SETTLE_SENTINEL = 'peaks compact settle';
+/**
+ * The settle hook command. `--project "${CLAUDE_PROJECT_DIR}"` is byte-for-byte
+ * the shape of the three `SessionStart` entries above — Claude Code's standard
+ * project-root convention, resolved strictly on the CLI side (a hook payload is
+ * env-driven and must not be trusted as a path).
+ *
+ * The command prints NOTHING on the hook path and exits 0 for every outcome.
+ * `PostCompact`'s stdin/stdout contract is truncated in the retrievable docs,
+ * so the safe assumption is the `SessionStart` one — stdout may be added to the
+ * model's context. An error message there would be read as a fact. See
+ * `compact-event-settle.ts`.
+ *
+ * No `shell` pin, deliberately: this entry lands in the shared, committed
+ * `.claude/settings.json`, and a `powershell` pin there would break every
+ * macOS / Linux reader of the file. See `resolveHookEntries`' comment block for
+ * the full reason the three `SessionStart` entries are unpinned too.
+ */
+export const HOOK_COMPACT_SETTLE_COMMAND = `peaks compact settle --project "\${CLAUDE_PROJECT_DIR}"`;
+/** The event this entry rides. Claude Code fires it after a compaction completes. */
+export const HOOK_COMPACT_SETTLE_EVENT = 'PostCompact';
+/** Matcher: empty = every `trigger` (`auto` and `manual`). See the sentinel doc. */
+export const HOOK_COMPACT_SETTLE_MATCHER = '';

package/dist/services/skills/skill-statusline-service.d.ts

@@ -7,6 +7,20 @@ export type StatusLineStdin = {
     cwd?: string;
     session_id?: string;
     caller_id?: string;
+    /**
+     * The harness's own context numbers. Declared here because this type IS the
+     * documented shape of the payload the harness pipes in; omitting a documented
+     * field would make the type lie by omission, and a consumer that reached for
+     * it would have to cast. Read (never written) by
+     * `harness-context-witness.ts` — see that module for why
+     * `context_window_size` is NOT a denominator.
+     */
+    context_window?: {
+        context_window_size?: unknown;
+        used_percentage?: unknown;
+        remaining_percentage?: unknown;
+        current_usage?: Record<string, unknown> | undefined;
+    } | undefined;
 };
 export type StatusLineState = 'active' | 'idle' | 'stale' | 'invalid-presence';
 export type StatusLinePresence = {

package/dist/services/slice/slice-check-service.js

@@ -8,6 +8,7 @@ import { isDirectory } from 'peaks-loop-shared/fs';
 // is no longer read. Path-safety helpers now live at
 // `shared/path-safety.ts` if this module ever needs them.
 import { verifyPipeline } from '../workflow/pipeline-verify-service.js';
+import { REQUEST_ID_PATTERN } from '../artifacts/request-artifact-service.js';
 import { findMockViolations } from '../audit/enforcers/mock-placement.js';
 import { runRedLinesAudit } from '../audit/red-lines-service.js';
 /**
@@ -239,20 +240,29 @@ async function runUnitTests(projectRoot, runTests) {
         }
     };
 }
+// Slice `2026-09-14-audit-artifact-rid-scoping`: the evidence filenames
+// carry the rid now. Candidate order is canonical-first, then the
+// back-compat tiers — the same order `artifact-prerequisites.ts` resolves
+// in, so this boundary gate and the transition gate agree on which file is
+// a slice's evidence. `<rid>` is substituted at probe time.
 const REVIEW_FILES = [
-    { name: 'code-review', path: 'rd/code-review.md', label: 'code-review' },
+    {
+        name: 'code-review',
+        paths: ['rd/code-review-<rid>.md', 'rd/code-review.md'],
+        label: 'code-review'
+    },
     // v2.12.0 collapse: security + perf moved to standalone audit skills.
-    // `slice check` accepts EITHER the v2.11.x legacy path OR the v2.12.0
-    // canonical audit path during the 1-minor-release back-compat window
-    // (v2.13.0 hard-deletes the legacy paths — see CHANGELOG [2.12.0]).
+    // `slice check` accepts the rid-scoped audit path, the bare v2.12.0 path
+    // OR the v2.11.x legacy path during the 1-minor-release back-compat
+    // window (v2.13.0 hard-deletes the legacy paths — see CHANGELOG [2.12.0]).
     {
         name: 'security-review',
-        paths: ['audit/security.md', 'rd/security-review.md'],
+        paths: ['audit/security-<rid>.md', 'audit/security.md', 'rd/security-review.md'],
         label: 'security-review'
     },
     {
         name: 'perf-baseline',
-        paths: ['audit/perf.md', 'rd/perf-baseline.md'],
+        paths: ['audit/perf-<rid>.md', 'audit/perf.md', 'rd/perf-baseline.md'],
         label: 'perf-baseline'
     }
 ];
@@ -284,11 +294,11 @@ async function runReviewFanout(projectRoot, rid, refresh) {
     const found = [];
     for (const review of REVIEW_FILES) {
         let hit = null;
-        // v2.12.0 back-compat: each entry may list multiple candidate paths.
-        // First hit (in declared order) wins; canonical paths come first so
-        // v2.12.0+ slices preferentially report the new path even when both
-        // are present during migration.
-        const candidates = 'path' in review ? [review.path] : review.paths;
+        // Back-compat: each entry lists multiple candidate paths. First hit (in
+        // declared order) wins; canonical paths come first so a current slice
+        // preferentially reports its own rid-scoped evidence even when a legacy
+        // file is also present during migration.
+        const candidates = review.paths.map((candidate) => candidate.replace('<rid>', rid));
         for (const candidate of candidates) {
             for (const scope of scopes) {
                 const abs = join(projectRoot, '.peaks', scope, candidate);
@@ -367,6 +377,14 @@ export async function sliceCheck(options) {
         throw new Error('No --rid supplied. Pass --rid <id> on the CLI to identify which slice to check.');
     }
     const rid = options.rid;
+    // The rid becomes a filename in `runReviewFanout`'s candidate list and a
+    // directory segment in its `scopes` — both joined onto the project root. The
+    // rid is the repo's own request-id shape, and `request-artifact-service.ts`
+    // already refuses anything else; apply the same guard here rather than
+    // probing paths a hostile `--rid` steers.
+    if (!REQUEST_ID_PATTERN.test(rid)) {
+        throw new Error(`Invalid request id: ${rid} (expected letters, digits, dots, underscores, or dashes)`);
+    }
     const totalStart = Date.now();
     const stages = [];
     let unitTestsRunMode = 'skipped';

package/dist/services/slice/slice-review-state.js

@@ -14,6 +14,8 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { SLICE_ID_PATTERN } from '../sc/sc-service.js';
 /** The 5 default review items per slice (the 12 Gaps memory checklist). */
 export const DEFAULT_REVIEW_ITEMS = [
     { id: 'business-match', question: '这个 slice 做完,业务流程对吗?(跟产品最初给的需求匹配)' },
@@ -32,9 +34,30 @@ export function buildEmptySliceReview(sliceId, sessionId, now = new Date()) {
     };
 }
 export function getReviewDir(projectRoot, sessionId) {
+    // Sid axis ONLY. Every `peaks slice-review|score|accept|reject` subcommand
+    // reaches the runtime tree through this one constructor. Measured:
+    // `--session-id ../../../../…/PWNED` wrote `slice-reviews/<slice-id>.json`
+    // outside every project root under an `ok: true` envelope (RD sweep case A26).
+    //
+    // It does NOT cover the slice-id axis: the slice id is joined one function
+    // later, in `getReviewPath` below. Corrected 2026-09-14 (repair R1) — this
+    // comment previously said one guard covered the whole family; the security
+    // audit of `2026-09-14-cli-id-escape-instrumentation` (F1b) measured that
+    // false: `slice-review '../../../../…/EVILSL'` wrote a `.json` file outside
+    // the project root under `ok: true`.
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     return resolve(projectRoot, '.peaks', '_runtime', sessionId, 'slice-reviews');
 }
 export function getReviewPath(projectRoot, sessionId, sliceId) {
+    // Slice-id axis. The slice id is the CLI positional (`slice-review
+    // <slice-id>`), so it is caller-supplied and it becomes a filename segment
+    // here. Same control as the rid axis: a pinned format beats the segment check,
+    // which admits `a/b`.
+    if (!SLICE_ID_PATTERN.test(sliceId)) {
+        throw new Error(`Invalid slice id: ${sliceId} (expected letters, digits, dots, underscores, or dashes)`);
+    }
     return join(getReviewDir(projectRoot, sessionId), `${sliceId}.json`);
 }
 export function readSliceReview(projectRoot, sessionId, sliceId) {