peaks-loop 4.0.47 → 4.0.49

package/dist/cli/commands/dispatch-commands.js

@@ -127,7 +127,17 @@ export function registerDispatchCommand(parent, io) {
                         ? { maxConcurrent }
                         : {}),
                 });
-                printResult(io, ok(result.command, result.data, result.warnings ?? [], result.nextActions ?? []), asJson);
+                // The handler's `ok` is the launch outcome (a vendor CLI that is not
+                // installed is a failure, not a footnote) — the caller must not
+                // re-wrap it as `ok()` unconditionally, which is how `ok: true` with
+                // `pid: -1` reached the orchestrator.
+                if (result.ok) {
+                    printResult(io, ok(result.command, result.data, result.warnings ?? [], result.nextActions ?? []), asJson);
+                }
+                else {
+                    printResult(io, fail(result.command, 'DISPATCH_DETACHED_SPAWN_FAILED', `Could not launch the vendor CLI for a detached dispatch; nothing was started.`, result.data, result.nextActions ?? []), asJson);
+                    process.exitCode = 1;
+                }
             }
             catch (error) {
                 printResult(io, fail('sub-agent.dispatch', 'DISPATCH_DETACHED_ERROR', getErrorMessage(error), {

package/dist/cli/commands/doctor/invoke-from-code.js

@@ -7,7 +7,13 @@
  */
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { isUnsafePathInput } from '../../../shared/path-safety.js';
 export async function doctorInvokeFromCode(opts) {
+    // Sid axis: `opts.sid` is the sole path segment between the runtime root and
+    // the write below, and nothing upstream validated it.
+    if (isUnsafePathInput(opts.sid)) {
+        throw new Error(`Invalid session id: ${opts.sid} (must be a single path segment)`);
+    }
     const dir = join('.peaks', '_runtime', opts.sid, 'doctor');
     mkdirSync(dir, { recursive: true });
     const proposalPath = join(dir, 'proposal.md');

package/dist/cli/commands/feedback-commands.d.ts

@@ -5,13 +5,17 @@
  *   - `peaks feedback check-unpromoted --project <path> [--strict]`
  *
  * Companion to `sops/feedback-promotion-sop.md`. The promote command
- * generates a stub for the chosen enforcement layer (A: peaks-sop
- * gate, B: peaks-hooks PreToolUse, C: mode-gate hardFloorCategory)
- * and writes the promotion marker + sidecar + RD envelope. The
- * check-unpromoted command scans `.peaks/memory/*.md` for feedback
- * memories without a promotion marker and emits a structured list.
- * `--strict` flips exit code to non-zero when any unpromoted feedback
- * is found — used by `peaks workflow verify-pipeline` Gate H.
+ * writes the promotion marker + sidecar + RD envelope, and — for the
+ * layers whose artifact it can produce (A: a registered SOP manifest)
+ * — the enforcement artifact itself. Layers B and C live in shared
+ * files it does not own, so there it records the requirement and
+ * reports `effective: false` instead of claiming success.
+ *
+ * The check-unpromoted command scans `.peaks/memory/*.md` for feedback
+ * memories whose promotion is missing OR not backed by its layer's
+ * artifact, and emits a structured list. `--strict` flips exit code to
+ * non-zero when any is found — used by `peaks workflow verify-pipeline`
+ * Gate H.
  */
 import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';

package/dist/cli/commands/feedback-commands.js

@@ -5,18 +5,22 @@
  *   - `peaks feedback check-unpromoted --project <path> [--strict]`
  *
  * Companion to `sops/feedback-promotion-sop.md`. The promote command
- * generates a stub for the chosen enforcement layer (A: peaks-sop
- * gate, B: peaks-hooks PreToolUse, C: mode-gate hardFloorCategory)
- * and writes the promotion marker + sidecar + RD envelope. The
- * check-unpromoted command scans `.peaks/memory/*.md` for feedback
- * memories without a promotion marker and emits a structured list.
- * `--strict` flips exit code to non-zero when any unpromoted feedback
- * is found — used by `peaks workflow verify-pipeline` Gate H.
+ * writes the promotion marker + sidecar + RD envelope, and — for the
+ * layers whose artifact it can produce (A: a registered SOP manifest)
+ * — the enforcement artifact itself. Layers B and C live in shared
+ * files it does not own, so there it records the requirement and
+ * reports `effective: false` instead of claiming success.
+ *
+ * The check-unpromoted command scans `.peaks/memory/*.md` for feedback
+ * memories whose promotion is missing OR not backed by its layer's
+ * artifact, and emits a structured list. `--strict` flips exit code to
+ * non-zero when any is found — used by `peaks workflow verify-pipeline`
+ * Gate H.
  */
 import { resolve as resolvePath } from 'node:path';
 import { findProjectRoot } from '../../services/config/config-safety.js';
 import { getCurrentSessionId } from '../../services/skills/skill-presence-service.js';
-import { generatePromotionStub, isPromotionLayer, listUnpromotedFeedback, parseFeedbackMemory, PROMOTION_LAYER_DETAILS, PROMOTION_LAYERS, promoteFeedback } from '../../services/feedback/feedback-promotion-service.js';
+import { generatePromotionStub, isPromotionLayer, listPromotionExempt, listUnpromotedFeedback, missingArtifacts, parseFeedbackMemory, PROMOTION_LAYER_DETAILS, PROMOTION_LAYERS, promoteFeedback, promotionArtifactChecks } from '../../services/feedback/feedback-promotion-service.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
 export function registerFeedbackCommands(program, io) {
@@ -26,15 +30,16 @@ export function registerFeedbackCommands(program, io) {
     addJsonOption(feedback
         .command('promote <memory-file>')
         .description('Promote a feedback memory to one of the 3 enforcement layers (A=peaks-sop gate, B=peaks-hooks PreToolUse, C=mode-gate hardFloorCategory). ' +
-        'Reads `.peaks/memory/<file>.md`, generates a code stub for the chosen layer, and writes ' +
-        'the promotion marker (HTML comment + sidecar .promotion.json) + an RD envelope at ' +
-        '`.peaks/_runtime/<sid>/rd/feedback-promote-<name>.json`. ' +
+        'Reads `.peaks/memory/<file>.md` and writes the promotion marker (HTML comment + sidecar .promotion.json) + an RD envelope at ' +
+        '`.peaks/_runtime/<sid>/rd/feedback-promote-<name>.json`. Layer A additionally generates and registers the SOP manifest the ' +
+        'SOP engine reads. Layers B and C live in shared files the command does not own, so it records the requirement and exits ' +
+        'non-zero (PROMOTION_NOT_EFFECTIVE) until the registration is present. ' +
         'Without --layer, the CLI lists the 3 layer options as nextActions and exits with code 0 ' +
         '(use --layer <A|B|C> to actually promote, or pass --dry-run to preview the stub).')
         .option('--layer <A|B|C>', `enforcement layer (${PROMOTION_LAYERS.join(' | ')})`)
         .option('--project <path>', 'project root (default: cwd)')
         .option('--promoted-by <id>', 'identity string for the audit envelope (default: peaks-rd fork agent)')
-        .option('--dry-run', 'preview the stub without writing the marker / sidecar / envelope')).action((memoryFile, opts) => {
+        .option('--dry-run', 'preview the stub without writing the marker / sidecar / envelope')).action(async (memoryFile, opts) => {
         try {
             const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
             const memoryPath = memoryFile.endsWith('.md')
@@ -91,7 +96,7 @@ export function registerFeedbackCommands(program, io) {
             const layer = opts.layer;
             const sessionId = getCurrentSessionId(projectRoot) ?? 'unknown-sid';
             const promotedBy = opts.promotedBy ?? 'peaks-rd fork agent';
-            const envelope = promoteFeedback({
+            const envelope = await promoteFeedback({
                 feedbackPath: memoryPath,
                 layer,
                 promotedBy,
@@ -99,11 +104,26 @@ export function registerFeedbackCommands(program, io) {
                 projectRoot,
                 dryRun: false
             });
-            printResult(io, ok('feedback.promote', envelope, [], [
+            // rid 2026-09-14-gate-h-promotion: report what was written, not what
+            // the stub wished for. A promotion whose layer artifact is absent is
+            // recorded but NOT effective, and says so with a non-zero exit.
+            const notes = [
                 `Promoted feedback "${envelope.name}" to layer ${envelope.layer} (${envelope.layerDetail}).`,
                 `Generated files: ${envelope.generatedFiles.join(', ')}`,
                 `Envelope written to .peaks/_runtime/${sessionId}/rd/feedback-promote-${envelope.name}.json`
+            ];
+            if (envelope.effective) {
+                printResult(io, ok('feedback.promote', envelope, [], notes), opts.json);
+                return;
+            }
+            const missing = missingArtifacts(promotionArtifactChecks(envelope.name, envelope.layer), projectRoot);
+            printResult(io, fail('feedback.promote', 'PROMOTION_NOT_EFFECTIVE', `Promotion recorded but not effective — layer ${envelope.layer} is not backed by its artifact: ${missing.join('; ')}`, envelope, [
+                ...notes,
+                ...(envelope.layer === 'C'
+                    ? ['Layer C lives in source code: register the hard-floor category in src/services/code/mode-gate.ts, then re-run promote to record it.']
+                    : ['Apply the snippet to the file(s) named above, then re-run promote to record it.'])
             ]), opts.json);
+            process.exitCode = 1;
         }
         catch (err) {
             printResult(io, fail('feedback.promote', 'PROMOTE_FAILED', getErrorMessage(err), { memoryFile }, ['Verify the file is a feedback memory and re-run']), opts.json);
@@ -119,23 +139,35 @@ export function registerFeedbackCommands(program, io) {
         .option('--strict', 'exit non-zero when any unpromoted feedback is found (used by verify-pipeline Gate H)')).action((opts) => {
         try {
             const unpromoted = listUnpromotedFeedback({ projectRoot: opts.project });
+            const exempt = listPromotionExempt({ projectRoot: opts.project });
             const count = unpromoted.length;
             if (count === 0) {
-                printResult(io, ok('feedback.check-unpromoted', { count: 0, unpromoted: [] }, [], [`No unpromoted feedback found in .peaks/memory/.`]), opts.json);
+                printResult(io, ok('feedback.check-unpromoted', { count: 0, unpromoted: [], exempt }, [], [
+                    `No unpromoted feedback found in .peaks/memory/.`,
+                    ...(exempt.length === 0
+                        ? []
+                        : [`${exempt.length} memor${exempt.length === 1 ? 'y' : 'ies'} declare themselves not-to-be-promoted: ${exempt.map((e) => `${e.name} (${e.code})`).join('; ')}.`])
+                ]), opts.json);
                 return;
             }
             const message = `${count} feedback memor${count === 1 ? 'y is' : 'ies are'} not yet promoted to an enforcement layer.`;
             const nextActions = [
                 `Run \`peaks feedback promote <memory-file> --layer <A|B|C>\` for each entry above.`,
                 'A = peaks-sop gate, B = peaks-hooks PreToolUse, C = mode-gate hardFloorCategory.',
+                'A marker alone does not count: the entry above names the artifact its layer still owes.',
                 'See sops/feedback-promotion-sop.md for the SOP and the layer-choice rubric.'
             ];
             if (opts.strict === true) {
-                printResult(io, fail('feedback.check-unpromoted', 'UNPROMOTED_FEEDBACK_FOUND', message, { count, unpromoted }, nextActions), opts.json);
+                printResult(io, fail('feedback.check-unpromoted', 'UNPROMOTED_FEEDBACK_FOUND', message, { count, unpromoted, exempt }, nextActions), opts.json);
                 process.exitCode = 1;
                 return;
             }
-            printResult(io, ok('feedback.check-unpromoted', { count, unpromoted }, [message], nextActions), opts.json);
+            printResult(io, ok('feedback.check-unpromoted', { count, unpromoted, exempt }, [
+                message,
+                ...(exempt.length === 0
+                    ? []
+                    : [`${exempt.length} memor${exempt.length === 1 ? 'y' : 'ies'} declare themselves not-to-be-promoted: ${exempt.map((e) => `${e.name} (${e.code})`).join('; ')}.`])
+            ], nextActions), opts.json);
         }
         catch (err) {
             printResult(io, fail('feedback.check-unpromoted', 'CHECK_FAILED', getErrorMessage(err), { project: opts.project }, ['Verify --project path and re-run']), opts.json);

package/dist/cli/commands/final-review-commands.js

@@ -26,6 +26,7 @@
  */
 import { existsSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
+import { REQUEST_ID_PATTERN } from '../../services/artifacts/request-artifact-service.js';
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { createAnthropicRunner, LlmBindingError, LlmRequestError, resolveAnthropicConfig, } from '../../services/llm/anthropic-runner.js';
@@ -135,6 +136,17 @@ export function registerFinalReviewCommands(program, io) {
         //    in two places: the pre-flight existence check (here) and the
         //    stub-path envelope (below). The service computes it identically
         //    at `src/services/final-review/final-review-service.ts:45-52`.
+        //
+        //    Rid axis. The rid is the CLI positional and it is the FILENAME
+        //    segment below, so it is checked here, at the join. Added 2026-09-14
+        //    (repair R1): this join was a second-slot hole — the `--session-id`
+        //    validation above passed and the rid slot escaped. Found by the
+        //    widened rule D, not by a human reading the file.
+        if (!REQUEST_ID_PATTERN.test(rid)) {
+            printResult(io, fail('final-review.prepare', 'RID_INVALID', `Invalid request id: ${rid} (expected letters, digits, dots, underscores, or dashes)`, emptyFinalReviewData(rid, options.sessionId, ''), ['Pass the rid of the slice, e.g. 2026-09-14-some-slug']), options.json);
+            process.exitCode = 1;
+            return;
+        }
         const auditGoalPath = join(projectValidation.projectRoot, '.peaks', '_runtime', sessionValidation.sessionId, 'audit-goal', `${rid}.json`);
         // 4. Pre-flight: if the audit-goal file is missing, surface a 404
         //    BEFORE the stub/provider check so the caller learns the real

package/dist/cli/commands/hooks-commands.js

@@ -7,7 +7,7 @@ import { findProjectRoot } from '../../services/config/config-safety.js';
 import { applyHookInstall, planHookInstall, readHookStatus, readInstalledEntriesFromSettings, removeHookInstall, listSuperpowersDenyEntries } from '../../services/skills/hooks-settings-service.js';
 import { readJsonObjectFile } from '../../services/ide/shared/atomic-json.js';
 import { detectIdeFromContext } from '../../services/ide/hook-translator.js';
-import { getAdapter } from '../../services/ide/ide-registry.js';
+import { getAdapter, resolveIdeOptionHelp } from '../../services/ide/ide-registry.js';
 /**
  * This module's own directory — `<root>/src/cli/commands` in the source tree,
  * `<root>/dist/cli/commands` in a build. Same reason as
@@ -153,7 +153,7 @@ export function registerHooksCommands(program, io) {
         .description(`Install the peaks-managed gate-enforce hook entry into the adapter's settings.json. Slice #014: only the gate-enforce entry is installed; the legacy progress-start entry is no longer installed. Idempotent: re-runs are no-ops. Project scope by default.`)
         .option('--global', 'install into the user-level ~/.claude/settings.json instead of the project')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')
-        .option('--ide <id>', "target adapter id (claude-code | trae); default: auto-detect from env/cwd")
+        .option('--ide <id>', resolveIdeOptionHelp())
         .option('--dry-run', 'show what would change without writing')
         .option('--no-progress', 'skip the progress-start PreToolUse hook entry; install ONLY the gate-enforce entry')).action((options) => {
         const scope = resolveScope(options);
@@ -282,7 +282,7 @@ export function registerHooksCommands(program, io) {
         .description("Remove the peaks-managed gate-enforce hook entry from the target settings.json. Any legacy progress-start entry that a pre-#014 install left behind is also removed (sentinel-based scan). Third-party hooks are preserved.")
         .option('--global', 'remove from the user-level ~/.claude/settings.json instead of the project')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')
-        .option('--ide <id>', 'target adapter id (claude-code | trae); default: auto-detect from env/cwd')).action((options) => {
+        .option('--ide <id>', resolveIdeOptionHelp())).action((options) => {
         const scope = resolveScope(options);
         const projectRoot = resolveProjectRoot(scope, options.project);
         const ide = resolveIdeForCommand(options, projectRoot);
@@ -310,7 +310,7 @@ export function registerHooksCommands(program, io) {
         .description('Report which peaks-managed hook entries are installed.')
         .option('--global', 'inspect the user-level ~/.claude/settings.json instead of the project')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')
-        .option('--ide <id>', 'target adapter id (claude-code | trae); default: auto-detect from env/cwd')).action((options) => {
+        .option('--ide <id>', resolveIdeOptionHelp())).action((options) => {
         const scope = resolveScope(options);
         const projectRoot = resolveProjectRoot(scope, options.project);
         const ide = resolveIdeForCommand(options, projectRoot);

package/dist/cli/commands/job-commands.js

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { Command } from 'commander';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, printResult } from '../cli-helpers.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 import { JobStateStore } from '../../services/job/job-state-store.js';
 import { JobOrchestrator } from '../../services/job/job-orchestrator.js';
 import { writeJobProgress, readJobProgress, tryReadJobProgress } from '../../services/job/job-progress-store.js';
@@ -70,6 +71,13 @@ function resolveJobStateRoot(opts, jobId) {
     if (!sessionId) {
         throw new Error('NO_ACTIVE_SESSION: peaks job requires --session-id or an active peaks-code session via peaks workspace init');
     }
+    // Sid axis — the sibling of the jobId guard in `JobStateStore.jobDir`. A
+    // caller-supplied `--session-id` reaches this join unmodified, so a
+    // traversal value lands `job/<id>/state.json` outside every project root
+    // while the envelope still reads `ok: true`.
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     const rootDir = join(project, '.peaks', '_runtime', sessionId, 'job');
     if (jobId && !existsSync(join(rootDir, jobId, 'state.json'))) {
         const other = findSessionHoldingJob(project, jobId);

package/dist/cli/commands/loop-eval-commands.js

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 import { resolveWorkflow, planWorkflow, planWorkflowRun } from '../../services/workflow/workflow-loader.js';
 import { dispatchEvaluator } from '../../services/loop/evaluator-dispatcher.js';
 import { DEFAULT_MONOTONIC_THRESHOLD } from '../../services/loop/monotonic-guard.js';
@@ -165,6 +166,25 @@ export function registerWorkflowEvalCommands(program, io) {
                     process.exitCode = 1;
                     return;
                 }
+                // Sid axis AND rid axis — the join below takes TWO ids, not one.
+                // Corrected 2026-09-14 (repair R1): this comment used to say one guard
+                // covers "the whole `--capture-score` write path". The security audit of
+                // `2026-09-14-cli-id-escape-instrumentation` (F1b) measured that false —
+                // the `--session` guard passed and the `rid` slot escaped:
+                // `peaks loop eval '../../../../…/EVILCYC' --capture-score --session
+                // <legal>` created `<projectRoot>/../EVILCYC/cycles/cycle-1.json` under
+                // an `ok: true` envelope. The rid is the CLI positional and has no pinned
+                // format, so the segment check is the control for that axis.
+                if (isUnsafePathInput(options.session)) {
+                    printResult(io, fail('loop.eval', 'INVALID_SESSION_ID', `Invalid session id: ${options.session} (must be a single path segment)`, { provided: options.session }, ['Pass a session id that is a single path segment']), options.json);
+                    process.exitCode = 1;
+                    return;
+                }
+                if (isUnsafePathInput(rid)) {
+                    printResult(io, fail('loop.eval', 'INVALID_REQUEST_ID', `Invalid request id: ${rid} (must be a single path segment)`, { provided: rid }, ['Pass a request id that is a single path segment']), options.json);
+                    process.exitCode = 1;
+                    return;
+                }
                 const score = envelope.degraded ? 0.25 : (envelope.gateAction === 'pass' ? 1.0 : envelope.gateAction === 'warn' ? 0.5 : 0.0);
                 const dir = join(projectRoot, '.peaks', '_runtime', options.session, 'loop', rid, 'cycles');
                 const n = nextEvalCaptureIndex(projectRoot, options.session, rid);
@@ -475,6 +495,17 @@ export function registerWorkflowEvalCommands(program, io) {
  *  writes. The run-driver also writes to the same dir; the next
  *  index = max(prior)+1, or 1. */
 function nextEvalCaptureIndex(projectRoot, sid, rid) {
+    // BOTH id axes: this function is the join for the capture-score cycle dir.
+    // The action guards `options.session` and `rid` before calling in, but the
+    // seam is callable on its own, so the join states its own contract. The rid
+    // half was missing until 2026-09-14 (repair R1) — the same second-slot hole
+    // the action had, in the same file, one function below it.
+    if (isUnsafePathInput(sid)) {
+        throw new Error(`Invalid session id: ${sid} (must be a single path segment)`);
+    }
+    if (isUnsafePathInput(rid)) {
+        throw new Error(`Invalid request id: ${rid} (must be a single path segment)`);
+    }
     const dir = join(projectRoot, '.peaks', '_runtime', sid, 'loop', rid, 'cycles');
     if (!existsSync(dir))
         return 1;

package/dist/cli/commands/perf-audit-commands.js

@@ -46,6 +46,7 @@ export function registerPerfAuditCommands(program, io) {
         .option('--project <path>', 'project root (default: cwd)')).action((options) => {
         const projectRoot = options.project ?? process.cwd();
         const sid = options.sid;
+        const rid = options.rid;
         if (sid === undefined || sid.length === 0) {
             printResult(io, fail('perf-audit.detect', 'SID_REQUIRED', 'session id (--sid) is required for perf-audit.detect', { state: 'sid-missing' }, ['Pass --sid <session-id> (e.g. 2026-06-27-session-...)', 'Run `peaks session info --active --json` to find the active sid.']), options.json);
             process.exitCode = 1;
@@ -55,6 +56,7 @@ export function registerPerfAuditCommands(program, io) {
             const detect = detectPerfAudit({
                 projectRoot,
                 sessionId: sid,
+                ...(rid !== undefined ? { requestId: rid } : {}),
             });
             const envelope = detect.state === 'ready'
                 ? ok('perf-audit.detect', detect, [...detect.warnings], [...detect.nextActions])

package/dist/cli/commands/playwright-commands.js

@@ -33,6 +33,7 @@ import { spawn } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { resolveCanonicalProjectRoot } from '../../services/config/config-service.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 import { getErrorMessage } from '../cli-helpers.js';
 import { runBrowserAction } from '../../services/qa/browser-wrapper-service.js';
 export const DEFAULT_PORT = 8931;
@@ -43,6 +44,17 @@ export function playwrightSessionsDir(projectRoot) {
     return join(projectRoot, '.peaks', '_runtime', PLAYWRIGHT_SESSIONS_DIR);
 }
 export function sessionFilePath(projectRoot, terminalId) {
+    // Terminal-id axis. The derived id is already sanitised (`deriveTerminalId`),
+    // but `--terminal` is caller-supplied and reaches this join unsanitised.
+    // Measured (repair cycle 1, item 1): `playwright stop --terminal ../../../../X`
+    // read a session record planted OUTSIDE the project root, sent SIGTERM to the
+    // pid it named, unlinked that file, and returned `ok: true` — arbitrary
+    // process termination plus an arbitrary file delete, one flag away. This is
+    // the join every reader/writer of a session record goes through, so this is
+    // where the invariant lives.
+    if (isUnsafePathInput(terminalId)) {
+        throw new Error(`Invalid terminal id: ${terminalId} (must be a single path segment)`);
+    }
     return join(playwrightSessionsDir(projectRoot), `${terminalId}.json`);
 }
 /**

package/dist/cli/commands/prd-commands.js

@@ -44,7 +44,7 @@ export function registerPrdCommands(program, io) {
     // peaks prd handoff init
     addJsonOption(handoff
         .command('init')
-        .description('Initialize an immutable handoff: sha256(body) → frontmatter → write to .peaks/_runtime/<sid>/prd/handoff.md')
+        .description('Initialize an immutable handoff: sha256(body) → frontmatter → write to .peaks/_runtime/<sid>/prd/handoff-<rid>.md')
         .requiredOption('--rid <request-id>', 'request id (e.g. 001-v2-11-cc-group-b)')
         .requiredOption('--sid <session-id>', 'session id (e.g. 2026-06-26-session-a28d69)')
         .requiredOption('--body <body>', 'handoff body markdown, or @<file> to read from disk')

package/dist/cli/commands/qa-commands.js

@@ -29,6 +29,7 @@ import { join, resolve } from 'node:path';
 import { addJsonOption, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { archiveScreenshots } from '../../services/qa/screenshot-archive-service.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 import { getSessionId } from '../../services/session/session-manager.js';
 import { BrowserRestartDetector } from '../../services/qa/browser-restart-detector.js';
 import { BrowserEventLogger } from '../../services/qa/browser-event-logger.js';
@@ -68,6 +69,12 @@ async function ensureContextForQa(goal, project, sid) {
 }
 export const DEFAULT_MAX_BROWSER_RESTARTS = 3;
 export function runQaSlice(input) {
+    // Sid axis: this is the join for `qa/browser-events.jsonl`. The `qa gate run`
+    // action guards before calling in, but the function is exported for tests and
+    // states its own contract at the join.
+    if (isUnsafePathInput(input.sessionId)) {
+        throw new Error(`Invalid session id: ${input.sessionId} (must be a single path segment)`);
+    }
     const detector = new BrowserRestartDetector({
         maxRestarts: input.maxRestarts,
         enabled: input.detectorEnabled
@@ -221,6 +228,15 @@ export function registerQaCommands(program, io) {
             // when the user did not supply one.
             const qaProject = options.project;
             const qaSid = options.sessionId ?? 'ad-hoc';
+            // Sid axis. `--session-id` reaches three consumers below — the context
+            // pre-build, `loadMutReport`, and `runQaSlice`'s
+            // `qa/browser-events.jsonl` join — so one guard at resolution covers all
+            // three. (`peaks qa archive-screenshots` has its own, separate join.)
+            if (isUnsafePathInput(qaSid)) {
+                printResult(io, fail('qa.gate', 'INVALID_SESSION_ID', `Invalid session id: ${qaSid} (must be a single path segment)`, { provided: qaSid }, ['Pass a session id that is a single path segment']), options.json);
+                process.exitCode = 1;
+                return;
+            }
             await ensureContextForQa('qa gate run', qaProject, qaSid);
             // Plan 2 / Task 8 — load peaks-mut's report (MUT.sig) if present.
             // Returns null when peaks-mut was not run; the gate treats that
@@ -289,6 +305,12 @@ export function registerQaCommands(program, io) {
         try {
             const projectRoot = resolve(options.project);
             const sid = options.sessionId?.trim() || getSessionId(projectRoot) || 'ad-hoc';
+            // Sid axis. Guarded after resolution so the flag value and the session
+            // binding are both covered. `archiveScreenshots` cannot do this itself:
+            // it only ever sees a fully-resolved `targetDir`.
+            if (isUnsafePathInput(sid)) {
+                throw new Error(`Invalid session id: ${sid} (must be a single path segment)`);
+            }
             const targetDir = join(projectRoot, '.peaks', '_runtime', sid, 'qa', 'screenshots');
             const envelope = archiveScreenshots({ sourceDir: options.source, targetDir });
             printResult(io, ok('qa.archive-screenshots', envelope, [], envelope.moved.length === 0

package/dist/cli/commands/request-commands.js

@@ -10,6 +10,7 @@ import { fail, ok } from 'peaks-loop-shared/result';
 import { triggerBestPracticeScan } from '../../services/prd/best-practice-auto-trigger.js';
 import { refreshCodegraphAfterSlice, } from '../../services/codegraph/codegraph-autorefresh.js';
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 /**
  * Slice 2026-09-10-context-audit-and-discipline (Slice B): bounded view of
  * `request list`. `count` is the true total; `names` carries
@@ -189,6 +190,13 @@ export function registerRequestCommands(program, io) {
             // non-existent .peaks/default/ dir and crashes with ENOENT, so when
             // --session-id is omitted we look the artifact up to find its session.
             let resolvedSessionId = options.sessionId;
+            // Sid axis: either arm of `resolvedSessionId` can be a caller-supplied
+            // `--session-id`, and it is joined into the bypass-counter root below.
+            if (resolvedSessionId !== undefined && isUnsafePathInput(resolvedSessionId)) {
+                printResult(io, fail('request.transition', 'INVALID_SESSION_ID', `Invalid session id: ${resolvedSessionId} (must be a single path segment)`, { provided: resolvedSessionId }, ['Pass a session id that is a single path segment']), options.json);
+                process.exitCode = 1;
+                return;
+            }
             if (resolvedSessionId === undefined) {
                 const { showRequestArtifact: showForSession } = await import('../../services/artifacts/request-artifact-service.js');
                 const located = await showForSession({ projectRoot: options.project, role, requestId });

package/dist/cli/commands/scan-commands.js

@@ -408,7 +408,7 @@ export function registerScanCommands(program, io) {
             });
             const nextActions = [];
             if (report.gateAction === 'block') {
-                nextActions.push('Karpathy review file missing under scope=all. Per karpathy §1 Think Before Coding, create rd/karpathy-review.md before requesting qa-handoff.');
+                nextActions.push('Karpathy review file missing under scope=all. Per karpathy §1 Think Before Coding, the rd:qa-handoff gate wants rd/karpathy-review-<rid>.md; this scanner has no rid and reads only the back-compat name rd/karpathy-review.md, so it cannot go green on the rid-scoped name alone. `peaks request transition --state qa-handoff` is the authoritative gate.');
             }
             else if (report.gateAction === 'warn') {
                 nextActions.push(`Karpathy review emitted ${report.totalViolations} violation(s). Review the warnings and re-run after cleanup (karpathy §3 Surgical Changes).`);

package/dist/cli/commands/security-audit-commands.js

@@ -46,6 +46,7 @@ export function registerSecurityAuditCommands(program, io) {
         .option('--project <path>', 'project root (default: cwd)')).action((options) => {
         const projectRoot = options.project ?? process.cwd();
         const sid = options.sid;
+        const rid = options.rid;
         if (sid === undefined || sid.length === 0) {
             printResult(io, fail('security-audit.detect', 'SID_REQUIRED', 'session id (--sid) is required for security-audit.detect', { state: 'sid-missing' }, ['Pass --sid <session-id> (e.g. 2026-06-27-session-...)', 'Run `peaks session info --active --json` to find the active sid.']), options.json);
             process.exitCode = 1;
@@ -55,6 +56,7 @@ export function registerSecurityAuditCommands(program, io) {
             const detect = detectSecurityAudit({
                 projectRoot,
                 sessionId: sid,
+                ...(rid !== undefined ? { requestId: rid } : {}),
             });
             const envelope = detect.state === 'ready'
                 ? ok('security-audit.detect', detect, [...detect.warnings], [...detect.nextActions])

package/dist/cli/commands/slice-integrate-commands.js

@@ -9,15 +9,37 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { getCurrentSessionId } from '../../services/skills/skill-presence-service.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { SLICE_ID_PATTERN } from '../../services/sc/sc-service.js';
 import { integrateSlices } from '../../services/slice/slice-integration.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, printResult } from '../cli-helpers.js';
 function loadContractsForSlices(projectRoot, sessionId, sliceIds) {
+    // Sid axis: `--session-id` reaches this join unmodified.
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     const dir = resolve(projectRoot, '.peaks', '_runtime', sessionId, 'dispatch', 'contracts');
     if (!existsSync(dir))
         return [];
     const result = [];
     for (const sliceId of sliceIds) {
+        // Slice-id axis: the id becomes the FILENAME below, so `--slices a,../..`
+        // reads a JSON file outside the contracts dir. Guarded 2026-09-14 (repair
+        // R1, security audit F3 of `2026-09-14-cli-id-escape-instrumentation`) —
+        // the session guard above covers the other axis and this one was open.
+        // Skipped with a warning rather than thrown, matching this function's
+        // existing contract for a contract it cannot read.
+        //
+        // NOTE for the instrument: rule D in
+        // `tests/unit/runtime/no-runtime-input-guard.test.ts` does NOT see this
+        // site — its root is the local `const dir` above, not a same-file call, so
+        // it is that rule's limit (m). The guard is real; the coverage is not
+        // claimed.
+        if (!SLICE_ID_PATTERN.test(sliceId)) {
+            console.warn(`loadContractsForSlices: skipping invalid slice id ${JSON.stringify(sliceId)} (must be a single filename segment)`);
+            continue;
+        }
         const file = join(dir, `${sliceId}.json`);
         if (!existsSync(file))
             continue;

package/dist/cli/commands/statusline-commands.js

@@ -6,11 +6,39 @@ import { renderStatusLine, resolveStatusLineCapability, } from '../../services/s
 import { applyStatusLineInstall, planStatusLineInstall, removeStatusLineInstall } from '../../services/skills/statusline-settings-service.js';
 import { readHookStatus as readSettingsStatus } from '../../services/skills/hooks-settings-service.js';
 import { detectIdeFromContext } from '../../services/ide/hook-translator.js';
+import { resolveIdeOptionHelp } from '../../services/ide/ide-registry.js';
 import { decideCompactStatusline, renderCompactStatusline, } from '../../services/compact-statusline/compact-statusline-service.js';
 import { getSessionIdCanonical } from '../../services/session/session-manager.js';
+import { writeHarnessWitness } from '../../services/context/harness-context-witness.js';
 const STDIN_READ_TIMEOUT_MS = 250;
-/** Read piped stdin if present; resolve quickly with '' when attached to a TTY. */
+/**
+ * Read piped stdin if present; resolve quickly with '' when attached to a TTY.
+ *
+ * `PEAKS_STATUSLINE_STDIN` is a test seam (same shape as the `PEAKS_HOOK_STDIN`
+ * seam in `gate-commands.ts`): the harness payload is the only channel that
+ * carries the harness's own context numbers, and a test that cannot supply one
+ * cannot verify the capture at all.
+ *
+ * WHY THIS SEAM IS ACCEPTABLE ON A DIFFERENT ARGUMENT (repair cycle 3). The
+ * precedent does not transfer by itself: `PEAKS_HOOK_STDIN` is defended in
+ * `.peaks/memory/peaks-hook-stdin-test-seam-pattern.md` because its payload
+ * still routes through the `enforceBashCommand` SOP gate. This payload is
+ * routed through no gate — it is PERSISTED verbatim as the record the witness
+ * guard then reads. So the compensating control is different, not absent: the
+ * record is observation-only and one-way. It reaches only `data` and the
+ * `warnings` / `nextActions` arrays of `peaks code context-now`; the compact
+ * `action` there is computed from `probe.ratio` alone, before and independently
+ * of the witness. A forged payload can therefore make the instrument lie —
+ * measured: a hand-written record yields a confident false `agree`, or a
+ * self-contradictory false `disagree` — and can do nothing else. What it cannot
+ * do is fire, block or delay a compact. Unconditional rather than NODE_ENV-
+ * gated, for the reason already recorded for the sibling seam.
+ */
 function readStdin() {
+    const override = process.env['PEAKS_STATUSLINE_STDIN'];
+    if (override !== undefined) {
+        return Promise.resolve(override);
+    }
     return new Promise((resolve) => {
         if (process.stdin.isTTY) {
             resolve('');
@@ -82,6 +110,18 @@ export async function runDefaultStatuslineRender(options, io) {
     // subprocess sat descheduled. Production callers omit the flag.
     const now = options.now !== undefined ? Number(options.now) : Date.now();
     const model = buildStatusLineModel(seeded, now);
+    // Slice 2026-09-13-statusline-window-witness (AC1): capture the harness's OWN
+    // context numbers from the payload it just piped in. The project root and the
+    // canonical session id are taken from the model that was JUST built, so the
+    // witness lands under the same session this render already resolved — a second
+    // resolution here could disagree with it. Never throws; never changes the
+    // rendered line.
+    writeHarnessWitness({
+        projectRoot: model.projectRoot,
+        sessionId: model.sessionId,
+        stdin,
+        nowMs: now,
+    });
     const capability = resolveStatusLineCapability({
         env: process.env,
         isTTY: Boolean(process.stdout.isTTY),
@@ -136,7 +176,7 @@ export function registerStatusLineCommands(program, io) {
         .description("Install the Peaks status line into the adapter's settings.json (project scope by default).")
         .option('--global', 'install into the user-level ~/.claude/settings.json instead of the project')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')
-        .option('--ide <id>', 'target adapter id (claude-code | trae); default: auto-detect from env/cwd')
+        .option('--ide <id>', resolveIdeOptionHelp())
         .option('--force', 'overwrite an existing non-Peaks statusLine entry')
         .option('--dry-run', 'show what would change without writing')).action((options) => {
         const scope = resolveScope(options);
@@ -173,7 +213,7 @@ export function registerStatusLineCommands(program, io) {
         .description("Remove the Peaks status line from the adapter's settings.json.")
         .option('--global', 'remove from the user-level ~/.claude/settings.json instead of the project')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')
-        .option('--ide <id>', 'target adapter id (claude-code | trae); default: auto-detect from env/cwd')).action((options) => {
+        .option('--ide <id>', resolveIdeOptionHelp())).action((options) => {
         const scope = resolveScope(options);
         const projectRoot = scope === 'project'
             ? (options.project ?? findProjectRoot(process.cwd()) ?? process.cwd())
@@ -194,7 +234,7 @@ export function registerStatusLineCommands(program, io) {
         .description('Report whether the Peaks status line is installed in the adapter settings.json.')
         .option('--global', 'inspect the user-level ~/.claude/settings.json instead of the project')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')
-        .option('--ide <id>', 'target adapter id (claude-code | trae); default: auto-detect from env/cwd')).action((options) => {
+        .option('--ide <id>', resolveIdeOptionHelp())).action((options) => {
         const scope = resolveScope(options);
         const projectRoot = scope === 'project'
             ? (options.project ?? findProjectRoot(process.cwd()) ?? process.cwd())