peaks-loop 4.0.5 → 4.0.7

package/CHANGELOG.md

@@ -1,5 +1,325 @@
 # Changelog
 
+## 4.0.7 — 2026-08-02 (dogfood surface repairs on `ice-cola`)
+
+A 24h-mode dogfood pass on the downstream `ice-cola` monorepo (4
+sub-packages: admin / server / client / hermes-agent) surfaced 25 real
+CLI / runtime / documentation defects across peaks-loop 4.0.6, plus a
+meta-level flow bug (the LLM bypassed the peaks-code / peaks-rd /
+peaks-qa flow and routed 22 files / 632 lines of `Edit` calls
+directly). This release closes all 4 P0/P1 ship-blockers, the 5
+P2 batch fixes, the find-skills integration, and 4 PR-meta
+enforcement-layer fixes.
+release closes the 5 P0/P1 ship-blockers and reshapes SKILL.md's
+Drift Index. 4 P2 changes were documented in the changeset but only
+the documentation half (Drift Index refresh) ships in 4.0.7; the
+implementation half (monorepo-aware language detection, monorepo
+sub-agent prompt, slice check monorepo typecheck) is queued for 4.0.8.
+
+### P0 — `peaks audit red-lines` no longer reports false-positive enforcerRef orphans on consumer projects
+
+- `src/services/audit/backing-detector.ts` and
+  `src/services/audit/enforcers/lint-audit-regression.ts` now resolve
+  `enforcerRef` paths against the peaks-loop source root (resolved via
+  `import.meta.url` + upward walk to `package.json#name === 'peaks-loop'`),
+  with an explicit `peaksLoopRoot` override for tests. Pre-rid every
+  downstream audit reported all 26 enforcer files as "missing on disk"
+  (88 enforcerFindings on ice-cola). Post-rid: 0.
+- New `resolvePeaksLoopRoot()` exported helper.
+- Tests: `tests/unit/audit/backing-detector-resolve-root.test.ts` (8
+  cases including the ice-cola repro).
+
+### P0 — `peaks code {detect-job,read-job-shape}`, `peaks workflow plan read`, and `peaks route` now resolve the canonical session id
+
+- New shared resolver `resolveActiveSessionId(projectRoot, override?)`
+  in `src/services/session/session-manager.ts`, exported via
+  `src/services/session/index.ts`. Composes the existing
+  `getSessionIdCanonical` + `getSessionId` fan-out so the same
+  `sessionId` flows through all 4 CLIs.
+- `src/cli/commands/code-job-shape-commands.ts` and
+  `src/cli/commands/code-runtime-commands.ts` now use the shared
+  resolver instead of the per-file `getSkillPresence` helper (which
+  read `.peaks/.active-skill.json` — a different store from
+  `.peaks/_runtime/session.json`).
+- Pre-rid the 4 CLIs reported `NO_ACTIVE_SESSION` for any session
+  created via `peaks workspace init` that never had
+  `peaks skill presence:set peaks-code` called on it (the common
+  case for downstream consumer projects and 24h-mode sessions).
+- Tests: `tests/unit/session/resolve-active-session.test.ts` (7 cases).
+
+### P1 — `peaks code should-pause` no longer false-positives in 24h-mode
+
+- `src/cli/commands/code-mode-gate-commands.ts` short-circuits the
+  stale-presence check when `.peaks/_runtime/<sid>/24h-state.json`
+  reads `state === '24H_ACTIVE'`. Without this, every 24h-mode
+  session hit a `shouldPause: true` wall at Step 1 even though
+  24h-mode is explicitly designed to be a no-AskUserQuestion mode.
+- New local helper `is24hActive(projectRoot, sessionId)` reuses the
+  existing `read24hState` from `services/24h-mode/store.ts`.
+- Tests: `tests/unit/code/should-pause-24h-bypass.test.ts` (9 cases).
+
+### P2 #6 (enhancement) — `peaks standards {init,update} --suggest-skills` integrates find-skills
+
+- New `--suggest-skills` flag on `peaks standards init` and
+  `peaks standards update` (off by default). When set, peaks-loop
+  runs `npx skills find <query>` for each query derived from the
+  detected ProjectContext (component library, build tool, CSS
+  framework, notable deps, language) and emits the top-5 results
+  in `nextActions` as copy-paste `npx skills add` commands.
+
+- Per user direction 2026-08-02: **no hardcoded verified-owner
+  whitelist**. The service runs `npx skills find` with no
+  `--owner` filter so the registry / leaderboard decides the
+  ranking (this is exactly the anti-pattern find-skills
+  SKILL.md Step 4 warns against — "do not recommend based solely
+  on a hardcoded list; verify with install count + source
+  reputation"). Recommendations are sorted by install count desc
+  so the user sees the same top results they would see running
+  `npx skills find` manually.
+
+- The service NEVER calls `npx skills add` itself. Installation
+  is gated on the user passing `--suggest-skills` (off by
+  default) and the install command is emitted as a single shell
+  snippet the user reviews before pasting. The CLI caller owns
+  the gating.
+
+- Failure mode: if `npx skills find` fails (network / registry
+  down), the service silently degrades — init/update still
+  completes, `nextActions` shows a "no matching skills found"
+  hint, no error. The user can re-run with `--suggest-skills`
+  later.
+
+- New file: `src/services/standards/find-skills-integration.ts`.
+  Tests: `tests/unit/standards/find-skills-integration.test.ts`
+  (12 cases covering queriesForContext, parseFindOutput,
+  findSkillsForContext — all using a custom `SkillFindRunner`
+  injection so the test never hits the network).
+
+### P2 batch — 5 monorepo / sub-agent prompt fixes (all in this release)
+
+- **`peaks standards` / `detectLanguage` is monorepo-aware** (`project-standards-service.ts`).
+  A monorepo root that has no `tsconfig.json` (only `tsconfig.base.json` + per-package
+  `tsconfig.json`) is now classified as `typescript` when any sub-package in
+  `packages/<name>/` has its own `tsconfig.json`. Pre-rid ice-cola (4-package
+  TypeScript monorepo) was misclassified as `javascript` because the root scan
+  saw no `tsconfig.json` and the root `package.json#devDependencies` had
+  `peaks-loop` only (a `javascript` standards pack).
+
+- **`peaks scan archetype` is monorepo-aware** (`archetype-service.ts`).
+  A 1-level walk into `packages/<name>/` merges each sub-package's
+  `dependencies` / `devDependencies` / `peerDependencies` /
+  `optionalDependencies` into the framework-detection map. Ice-cola
+  now correctly reports `hasBackendFramework: true, backendFrameworks:
+  ["@nestjs/core", "@nestjs/common"]` instead of
+  `hasBackendFramework: false`.
+
+- **`peaks sub-agent dispatch` prompt includes a monorepo branch**
+  when `<projectRoot>/pnpm-workspace.yaml` is present. The pre-rid
+  static prompt had no monorepo handling, so sub-agents ran
+  `pnpm test` at the root which fanned out to every sub-package
+  (36-minute wall clock for a single-slice change). The new block
+  tells the sub-agent to scope to one sub-package via
+  `pnpm --filter @<scope>/<name> test <pattern>`.
+
+- **`peaks slice check` typecheck stage is monorepo-aware**
+  (`slice-check-service.ts`). When `pnpm-workspace.yaml` is
+  present, the typecheck stage runs `pnpm -r typecheck` first and
+  falls back to `pnpm -r --parallel exec tsc --noEmit` if no
+  per-package `typecheck` script exists. Per-package failures
+  are captured in `data.failedPackages` so the operator can see
+  which sub-package broke (the pre-rid "tsc exited with code 1"
+  was a 2ms fake-fail with no actionable detail).
+
+- **`peaks sub-agent dispatch` context window block no longer
+  misleads on fallback probes** (`build-dispatch-system-prompt.ts`).
+  When the probe source is `conservative-fallback` (or any other
+  untrusted value), the block short-circuits to "no probe
+  available — treat the displayed ratio as unverified" instead
+  of rendering "0.0% used (100.0% free)" as if it were a real
+  measurement. Trusted sources are `token-counted`,
+  `transcript-estimate`, and `statusline`; anything else triggers
+  the fallback path.
+
+### P1 — SKILL.md Drift Index refreshed for 4.0.6+
+
+- D-001 rewritten (the pre-4.0.7 entry was the inverse of 4.0.6's
+  actual behavior — `peaks code detect-job` requires `--is-job`).
+- New D-013: `peaks code context-now --json` requires `--project`.
+- New D-014: documents the 4-CLI `NO_ACTIVE_SESSION` regression fixed
+  by P0 above.
+- New D-015: documents the 24h-mode ↔ stale-presence interaction fixed
+  by P1 above.
+- Step N+2 probe primitive example now includes `--project <path>`.
+
+### Compatibility
+
+- All command names, options, and exit codes are preserved.
+- Auto-compact 0.85 / 0.95 contract unchanged.
+- `peaks audit red-lines` on peaks-loop itself shows 0 orphan findings
+  (it had 88+ before the fix; now also on every consumer project).
+- `peaks code detect-job` / `read-job-shape` accept the same flags
+  as 4.0.6.
+
+### How to verify
+
+```bash
+# Inside peaks-loop source root (after `pnpm build`):
+peaks audit red-lines --project . --json
+# expect: enforcerFindings: 0
+
+# Inside a downstream project that has peaks-loop as a devDep:
+peaks audit red-lines --project . --json
+# expect: enforcerFindings: 0 (was 88+ before)
+
+# 24h-mode + should-pause:
+peaks session 24h-mode transition --state 24H_ACTIVE
+peaks code should-pause --step step-1-mode-select --json
+# expect: shouldPause decision is NOT "stale-presence"
+
+# detect-job CLI:
+peaks code detect-job --is-job false --rationale "x" --suggested-job-id n-a
+# expect: ok, recorded to .peaks/_runtime/<sid>/job-shape.json
+```
+
+Source: `.peaks/memory/2026-08-02-ice-cola-dogfood-surface-probe.md`.
+
+### PR-meta batch — flow-level enforcement (4 fixes addressing why the LLM bypassed peaks-code in this same session)
+
+The 4.0.7 dogfood pass surfaced a flow-level bug that the 25
+P0/P1/P2 fixes alone could not close: the LLM routed 22 files /
+632 lines of `Edit` calls directly without a single
+`peaks sub-agent dispatch rd`. Six root causes were identified
+(internal-only debug report, 2026-08-02); the four below close
+the four most actionable layers with surgical changes.
+
+- **PR-meta-1: Edit-enforcement hook** (new
+  `src/services/hooks/pre-tool-edit-enforcement.sh`).
+  Opt-in via `peaks hooks install --with-edit-enforcement` (off by
+  default to preserve the existing peaks-code behavior; the gate
+  is a HARD layer, not a soft warning). When the hook fires on
+  an `Edit` / `Write` / `MultiEdit` / `NotebookEdit` call
+  targeting `src/**`, it checks for an active RD artifact under
+  `.peaks/_runtime/<sid>/rd/requests/` and either allows the
+  call (RD exists) or denies with a structured
+  `permissionDecision: deny` envelope that points the LLM at the
+  right next step (`peaks request init` + `peaks sub-agent dispatch
+  rd`). Bypass conditions: tests / docs / RD artifacts / the
+  hook scripts themselves, a `.peaks/standards/edit-bypass` file
+  (gitignored escape hatch for hot-fixes), or the env var
+  `PEAKS_EDIT_BYPASS_24H=1` (24h-mode opt-in).
+
+- **PR-meta-2: 24h mode scope explicit** (SKILL.md §"24h mode
+  explicit scope"). 24h mode is `peaks session 24h-mode
+  transition --state 24H_ACTIVE`. The pre-PR-meta-2 prose was
+  implicit ("bypass AskUserQuestion") and the LLM over-extended
+  it to **all** user instructions, including the Code-Change
+  Red Line. The new section enumerates exactly which 11 steps
+  24h mode auto-proceeds at (mode select / step confirm / swarm
+  pick / QA verdict / etc.) and which 6 rules it does **not**
+  bypass (Code-Change Red Line, sub-agent dispatch, worktree
+  authorization, request state machine, external side effects,
+  2.x → 1.x reverse migration). The single-sentence rule is
+  reproducible at the top of the section.
+
+- **PR-meta-3: scope-counter fail-LOUD** (new
+  `src/services/hooks/pre-tool-scope-counter.sh`). The
+  harness-side `SCOPE WARNING: 27 files modified` was
+  informational noise that the LLM learned to ignore
+  (`.peaks/memory/2026-07-28-sub-agent-visibility-issue.md`
+  documents the same friction). PR-meta-3 turns the warning
+  into a checkpoint: the hook counts cumulative
+  application-source edits per session in
+  `.peaks/_runtime/<sid>/edit-counter.json` and emits a
+  fail-LOUD reflection reminder at thresholds 5, 10, 20. The
+  LLM cannot continue without writing to
+  `.peaks/_runtime/<sid>/scope-reflection.md` once a
+  threshold is hit. Off by default; opt in via
+  `peaks hooks install --with-scope-counter`.
+
+- **PR-meta-4: dispatch `--emit-bash-script`** (new flag on
+  `peaks sub-agent dispatch`). The dry-run architecture is
+  preserved (the CLI is still the canonical dispatch surface),
+  but the LLM no longer has to parse `toolCall` args from the
+  JSON envelope and re-execute them via the Agent tool. The
+  flag emits a ready-to-exec bash script alongside the
+  envelope; the LLM runs the script via the Bash tool and
+  the dispatch fires immediately. The script invokes the
+  canonical `peaks sub-agent exec` surface, not a side-step.
+- **PR-meta-5: `peaks hooks install --with-edit-enforcement /
+  --with-scope-counter`** (slice 4.0.7). The two opt-in hook
+  entries added in PR-meta-1 / PR-meta-3 are now reachable via
+  the standard install flow. Default behavior is unchanged
+  (gate-enforce only); the flags activate the meta-layer
+  hooks. The summary envelope's `entries` array now reflects
+  the actual installed shape (gate-enforce + opt-in entries)
+  so operators can dry-run + verify before applying.
+- **PR-meta-6: `peaks sub-agent exec`** (new sub-command).
+  Companion to PR-meta-4's `--emit-bash-script`. The script
+  emitted by the dispatch CLI invokes this surface; `exec`
+  reads the dispatch record from disk and re-emits the
+  canonical `toolCall` envelope (envelopeVersion 2.4.0 with
+  `viaExec: true`). Idempotent: the same exec call can be
+  replayed any number of times. Mismatch detection: when the
+  caller-passed session-id / request-id / batch-id / role do
+  not match the record, `exec` emits a warning but still uses
+  the record as the canonical source of truth. Failure modes:
+  `DISPATCH_RECORD_MISSING`, `DISPATCH_RECORD_INVALID`,
+  `DISPATCH_RECORD_NO_TOOL_CALL`. Tests: 3 cases in
+  `tests/unit/commands/sub-agent-exec.test.ts`.
+- **PR-meta-7: scope-counter fail-CLOSED**. The PR-meta-3
+  scope counter emitted `additionalContext` (soft signal);
+  the LLM continued editing without writing the reflection
+  file. PR-meta-7 hardens the checkpoint: at thresholds 5 /
+  10 / 20, the hook now emits `permissionDecision: deny`
+  until the LLM writes a non-empty reflection file at
+  `.peaks/_runtime/<sid>/scope-reflection.md`. The next
+  threshold requires a fresh reflection. Bypass: empty file
+  at `.peaks/standards/scope-counter-bypass` (gitignored
+  escape hatch).
+
+### Compatibility
+
+- `peaks hooks install` default behavior is unchanged. The
+  meta-1 / meta-3 hooks are opt-in (`--with-edit-enforcement`,
+  `--with-scope-counter`); the meta-2 SKILL.md section is
+  documentation-only; the meta-4 flag is opt-in
+  (`--emit-bash-script`).
+- All command names, options, and exit codes are preserved.
+- Auto-compact 0.85 / 0.95 contract unchanged.
+- 24h mode scope is **narrowed**, not widened: same 11
+  auto-proceed steps, but the previously-implicit bypass is
+  now explicitly bounded to "AskUserQuestion gates" only.
+
+## 4.0.6 — 2026-08-02 (postinstall auto-register outputStyle)
+
+- **postinstall auto-registers `outputStyle: peaks-skill-swarm` into `~/.claude/settings.json`.**
+
+  Real user feedback 2026-08-02 (fresh 0-1 project on `Desktop\ticket-cross`): `npm i -g peaks-loop@latest` copied `peaks-skill-swarm.md` into `~/.claude/output-styles/` but never wrote `outputStyle` into `~/.claude/settings.json`, so Claude Code loaded the default style in new sessions.
+
+  The new `installBundledOutputStyleDefault()` helper in `scripts/install-skills.mjs`:
+
+  - reads `~/.claude/settings.json` (creates it if missing)
+  - merges `outputStyle: 'peaks-skill-swarm'` when not yet set
+  - preserves every other key (theme, env, plugins, hooks, permissions, ...)
+  - user-defined `outputStyle` wins — never overwritten
+  - malformed JSON / non-regular file / missing bundled style at the dispatched target → soft skip, never throw
+
+  Resolution precedence (settings file path):
+
+  1. `options.settingsFile` (test hook)
+  2. `PEAKS_CLAUDE_SETTINGS_FILE` env var (CI override)
+  3. `<homedir>/.claude/settings.json` (default)
+
+  Opt-out: `PEAKS_SKIP_OUTPUT_STYLE_DEFAULT=1`.
+
+  Tests: 6 new cases (4 integration + 2 direct unit) in `tests/integration/ide/install-skills-dispatch.test.ts`. `tests/integration/ide` 12/12 green; `pnpm build` → `build-integrity: OK`.
+
+  Compatibility:
+
+  - Existing user-defined `outputStyle` is preserved.
+  - Opt-out via `PEAKS_SKIP_OUTPUT_STYLE_DEFAULT=1` for CI / scripting.
+  - `~/.claude/settings.json` writes are atomic (`writeFileAtomically` + `O_NOFOLLOW`).
+
 ## 4.0.5 — 2026-08-02 (statusline polish + sub-agent merge bundle)
 
 - Release 4.0.5 — 2026-08-01 bundle.

package/dist/cli/commands/code-job-shape-commands.js

@@ -10,7 +10,6 @@ import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { readJobShapeDecision, writeJobShapeDecision, JobShapeDecisionError, JOB_SHAPE_NOT_DECIDED, JOB_SHAPE_ALREADY_DECIDED } from '../../services/code/job-shape-decision.js';
 import { findProjectRoot } from '../../services/config/config-safety.js';
-import { getSkillPresence } from '../../services/skills/skill-presence-service.js';
 export function registerCodeJobShapeCommands(code, io) {
     // v3.1.1 Step 0.8 — Job-shape decision recorder.
     // The CLI is a *recorder*, not a judge. The LLM supplies the verdict
@@ -148,15 +147,19 @@ export function registerCodeJobShapeCommands(code, io) {
     });
 }
 // Local helper (was `readActiveSid` in code-commands.ts before rid-024 split).
-// Both detect-job and read-job-shape need to read the active sid from
-// presence. We re-import getSkillPresence here to avoid the cross-file
-// helper import.
+// Slice 4.0.7-dogfood-PR-2: now uses the shared canonical resolver
+// (`resolveActiveSessionId` from services/session) so detect-job and
+// read-job-shape see the same session id that `peaks session info --active`
+// returns. The pre-rid helper read `getSkillPresence` (the
+// `.peaks/.active-skill.json` file), which was a different store from
+// `.peaks/_runtime/session.json` — any session created via
+// `peaks workspace init` that never had `peaks skill presence:set peaks-code`
+// called on it (the common case for downstream consumer projects and
+// 24h-mode sessions) reported `NO_ACTIVE_SESSION` from this file.
+import { resolveActiveSessionId } from '../../services/session/index.js';
 function readActiveSidForJobShape(projectRoot) {
     try {
-        const presence = getSkillPresence(projectRoot);
-        if (presence === null || presence === undefined)
-            return null;
-        return presence.sessionId ?? null;
+        return resolveActiveSessionId(projectRoot);
     }
     catch {
         return null;

package/dist/cli/commands/code-mode-gate-commands.js

@@ -100,10 +100,22 @@ export function registerCodeModeGateCommands(code, io) {
             // this only adds the structured `stale` reason + an
             // envelope-level `stalePresence` field so downstream tooling
             // (statusline, sub-agent dispatch) can act on it.
+            //
+            // Slice 4.0.7-dogfood-PR-3 (ice-cola surface probe 2026-08-02):
+            // 24h-mode sessions explicitly opt out of AskUserQuestion
+            // (the whole point of 24h is no-pause operation), so the
+            // stale-presence gate short-circuits to "not stale" when the
+            // session is in `24H_ACTIVE`. Without this bypass, every
+            // 24h-mode session hit a `shouldPause: true` wall at Step 1
+            // even though 24h-mode is designed to be a no-AskUserQuestion
+            // mode.
             let stalePresence = null;
             if (opts.step === 'step-1-mode-select' && opts.ignoreStalePresence !== true) {
                 const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
-                stalePresence = checkStalePresence({ projectRootOverride: projectRoot });
+                const sessionIdForGate = readActiveSidForModeGate(projectRoot);
+                if (!is24hActive(projectRoot, sessionIdForGate)) {
+                    stalePresence = checkStalePresence({ projectRootOverride: projectRoot });
+                }
             }
             if (stalePresence !== null && stalePresence.stale) {
                 // Build the envelope manually so we can attach the extra
@@ -209,9 +221,22 @@ export function registerCodeModeGateCommands(code, io) {
 // The mode-gate stale-presence check needs the active sid for the
 // observability event; we re-import getSkillPresence here to avoid the
 // cross-file helper import.
+// Slice 4.0.7-dogfood-PR-2: also uses the shared canonical resolver
+// (resolveActiveSessionId) so the same id flows through detect-job,
+// read-job-shape, and should-pause. The pre-rid helper read
+// `getSkillPresence` (the `.peaks/.active-skill.json` file) which
+// was a different store from `.peaks/_runtime/session.json`.
 import { getSkillPresence } from '../../services/skills/skill-presence-service.js';
+import { resolveActiveSessionId } from '../../services/session/index.js';
+import { read24hState } from '../../services/24h-mode/store.js';
 function readActiveSidForModeGate(projectRoot) {
+    // Prefer the canonical binding (works for any session created via
+    // peaks workspace init); fall back to skill presence for sub-skill
+    // activations that never wrote a binding (legacy edge case).
     try {
+        const canonical = resolveActiveSessionId(projectRoot);
+        if (canonical !== null)
+            return canonical;
         const presence = getSkillPresence(projectRoot);
         if (presence === null || presence === undefined)
             return null;
@@ -221,3 +246,20 @@ function readActiveSidForModeGate(projectRoot) {
         return null;
     }
 }
+/**
+ * Slice 4.0.7-dogfood-PR-3: returns true when the active session is
+ * in 24H_ACTIVE state (per `.peaks/_runtime/<sid>/24h-state.json`).
+ * In that state, the mode-gate's stale-presence check is a false
+ * positive — 24h-mode explicitly opts out of AskUserQuestion.
+ */
+function is24hActive(projectRoot, sessionId) {
+    if (sessionId === null || sessionId.length === 0)
+        return false;
+    try {
+        const snap = read24hState(projectRoot, sessionId);
+        return snap.state === '24H_ACTIVE';
+    }
+    catch {
+        return false;
+    }
+}

package/dist/cli/commands/code-runtime-commands.js

@@ -13,7 +13,6 @@ import { runAutoCompact } from '../../services/code/auto-compact-orchestrator.js
 import { evaluateStep08, STEP_08_BACKUP_REGEX } from '../../services/code/step-08-gate.js';
 import { evaluateEmitHandoff, JOB_NOT_INITIALIZED, JOB_REMAINING_BLOCKED } from '../../services/code/emit-handoff.js';
 import { readJobShapeDecision, JobShapeDecisionError } from '../../services/code/job-shape-decision.js';
-import { getSkillPresence } from '../../services/skills/skill-presence-service.js';
 export function registerCodeRuntimeCommands(code, io) {
     addJsonOption(code
         .command('post-compact-detect')
@@ -391,14 +390,20 @@ export function registerCodeRuntimeCommands(code, io) {
 // Local helper (was `readActiveSid` in code-commands.ts before rid-024 split).
 // Only the 5 runtime probes above use it; keeping it local avoids the
 // cross-file helper import.
+// Slice 4.0.7-dogfood-PR-2: now uses the shared canonical resolver
+// (`resolveActiveSessionId` from services/session) so context-now /
+// post-compact-detect / auto-compact / gate-step-08 / emit-handoff see
+// the same session id that `peaks session info --active` returns.
+// The pre-rid helper read `getSkillPresence` (the
+// `.peaks/.active-skill.json` file), which was a different store from
+// `.peaks/_runtime/session.json` — the two were kept in sync only when
+// `peaks skill presence:set` was called explicitly.
+import { resolveActiveSessionId } from '../../services/session/index.js';
 function readActiveSid(projectRoot) {
     try {
-        const presence = getSkillPresence(projectRoot);
-        if (presence === null || presence === undefined)
-            return null;
-        return presence.sessionId ?? null;
+        return resolveActiveSessionId(projectRoot);
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
         return null;
     }
 }

package/dist/cli/commands/core/standards-command.js

@@ -2,8 +2,37 @@ import { summarizeProjectStandardsInitResult, summarizeProjectStandardsUpdateRes
 import { executeProjectStandardsInitIdeAware, executeProjectStandardsUpdateIdeAware } from '../../../services/standards/ide-aware-standards-service.js';
 import { migrateStandards } from '../../../services/standards/migrate-service.js';
 import { migrateClaudeRules } from '../../../services/standards/migrate-claude-rules-service.js';
+import { detectProjectContext } from '../../../services/standards/project-context.js';
+import { findSkillsForContext } from '../../../services/standards/find-skills-integration.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../../cli-helpers.js';
+/**
+ * Slice 4.0.7-PR-12 helper: render `npx skills find` results as
+ * next-action strings the user can paste. Never auto-installs.
+ * Returns an empty array when the network call fails (so the
+ * init/update flow never blocks on find-skills).
+ */
+async function buildFindSkillsNextActions(projectRoot) {
+    try {
+        const ctx = detectProjectContext(projectRoot);
+        const result = await findSkillsForContext(ctx, { topN: 5 });
+        if (result.recommendations.length === 0) {
+            return [`peaks-loop (PR-12): no matching skills found for this project stack; try \`npx skills find <query>\` manually.`];
+        }
+        const lines = ['peaks-loop (PR-12) skill recommendations (verified-owner first; install commands are copy-paste, never auto-run):'];
+        for (const r of result.recommendations) {
+            const count = r.installCount === null ? '?' : `${r.installCount.toLocaleString()} installs`;
+            lines.push(`  ${r.displayName} (${r.owner}, ${count}) — ${r.installCommand}`);
+        }
+        if (result.failedRuns.length > 0) {
+            lines.push(`peaks-loop (PR-12): ${result.failedRuns.length} find-skills run(s) failed (network or registry). Re-run \`npx skills find <query>\` to retry.`);
+        }
+        return lines;
+    }
+    catch {
+        return [];
+    }
+}
 export function registerStandardsCommand(program, io) {
     const standards = program.command('standards').description('Manage project-local coding standards');
     addJsonOption(standards
@@ -13,7 +42,8 @@ export function registerStandardsCommand(program, io) {
         .option('--language <language>', 'standards language pack')
         .option('--ide <id>', 'override IDE detection (e.g. claude-code, trae)')
         .option('--dry-run', 'preview writes without changing files')
-        .option('--apply', 'write missing standards into the target project')).action((options) => {
+        .option('--apply', 'write missing standards into the target project')
+        .option('--suggest-skills', 'Slice 4.0.7-PR-12: after init, query the open agent-skills ecosystem for matching skills and emit install commands. Off by default. Never auto-installs — user pastes the command.')).action(async (options) => {
         if (options.dryRun === true && options.apply === true) {
             printResult(io, fail('standards.init', 'INVALID_STANDARDS_INIT_FLAGS', 'Use either --dry-run or --apply, not both', {}, ['Run without --apply to preview writes, or omit --dry-run when applying standards']), options.json);
             process.exitCode = 1;
@@ -21,7 +51,17 @@ export function registerStandardsCommand(program, io) {
         }
         try {
             const result = executeProjectStandardsInitIdeAware({ projectRoot: options.project, ...(options.language !== undefined ? { language: options.language } : {}), ...(options.ide !== undefined ? { ideId: options.ide } : {}), apply: options.apply === true });
-            printResult(io, ok('standards.init', summarizeProjectStandardsInitResult(result)), options.json);
+            const summary = summarizeProjectStandardsInitResult(result);
+            // Slice 4.0.7-PR-12: optional find-skills hint. Always
+            // human-gated (we never invoke `npx skills add`); the user
+            // pastes the install command. The slice is geared at
+            // peaks-loop downstream projects — every project that runs
+            // `peaks standards init` gets the same hint when the flag is
+            // set, so consumers do not need to remember find-skills.
+            const suggestNextActions = options.suggestSkills === true
+                ? await buildFindSkillsNextActions(options.project)
+                : [];
+            printResult(io, ok('standards.init', summary, [], suggestNextActions), options.json);
         }
         catch (error) {
             printResult(io, fail('standards.init', 'STANDARDS_INIT_FAILED', getErrorMessage(error), {}, ['Check the project path and existing .claude/rules directory before retrying']), options.json);
@@ -35,7 +75,8 @@ export function registerStandardsCommand(program, io) {
         .option('--language <language>', 'standards language pack')
         .option('--ide <id>', 'override IDE detection (e.g. claude-code, trae)')
         .option('--dry-run', 'preview writes without changing files')
-        .option('--apply', 'append managed metadata to the target project')).action((options) => {
+        .option('--apply', 'append managed metadata to the target project')
+        .option('--suggest-skills', 'Slice 4.0.7-PR-12: after update, refresh skill recommendations for the project stack. Off by default.')).action(async (options) => {
         if (options.dryRun === true && options.apply === true) {
             printResult(io, fail('standards.update', 'INVALID_STANDARDS_UPDATE_FLAGS', 'Use either --dry-run or --apply, not both', {}, ['Run without --apply to preview writes, or omit --dry-run when applying standards updates']), options.json);
             process.exitCode = 1;
@@ -44,9 +85,13 @@ export function registerStandardsCommand(program, io) {
         try {
             const result = executeProjectStandardsUpdateIdeAware({ projectRoot: options.project, ...(options.language !== undefined ? { language: options.language } : {}), ...(options.ide !== undefined ? { ideId: options.ide } : {}), apply: options.apply === true });
             const summary = summarizeProjectStandardsUpdateResult(result);
+            const suggestNextActions = options.suggestSkills === true
+                ? await buildFindSkillsNextActions(options.project)
+                : [];
+            const allNextActions = [...summary.reviewSuggestions, ...suggestNextActions];
             const response = summary.reviewSuggestions.length > 0
-                ? fail('standards.update', 'STANDARDS_UPDATE_REVIEW_REQUIRED', 'Standards update requires manual review', summary, summary.reviewSuggestions)
-                : ok('standards.update', summary);
+                ? fail('standards.update', 'STANDARDS_UPDATE_REVIEW_REQUIRED', 'Standards update requires manual review', summary, allNextActions)
+                : ok('standards.update', summary, [], suggestNextActions);
             printResult(io, response, options.json);
             if (summary.reviewSuggestions.length > 0) {
                 process.exitCode = 1;

package/dist/cli/commands/dispatch-commands.js

@@ -15,6 +15,7 @@
  * envelope's `nextActions` reinforce the point.
  */
 import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { spawn as childProcessSpawn } from 'node:child_process';
 import { fail, getErrorMessage, ok } from 'peaks-loop-shared/result';
@@ -37,7 +38,7 @@ import { DEFAULT_PREFERENCES } from '../../services/preferences/preferences-type
 import { writeLogEntry } from '../../services/log/logger.js';
 import { HEADROOM_MODES, PROMPT_LIMIT_BYTES, RECOMMENDED_ROLES, validateRole } from './sub-agent-shared.js';
 import { runDispatchFromDag } from './dispatch-from-dag.js';
-import { TEST_TOOL_DETECTION_BLOCK, formatTestToolDetection } from '../../services/dispatch/test-tool-detection.js';
+import { TEST_TOOL_DETECTION_BLOCK, MONOREPO_TEST_TOOL_BLOCK, formatTestToolDetection } from '../../services/dispatch/test-tool-detection.js';
 import { MemoryPreflightService } from '../../services/context/memory-preflight-service.js';
 import { buildDispatchSystemPrompt } from '../../services/context/build-dispatch-system-prompt.js';
 import { createDispatchProvenanceToken, DISPATCH_PROVENANCE_ENV, writeDispatchProvenance, } from '../../services/worktree/dispatch-provenance.js';
@@ -67,7 +68,8 @@ export function registerDispatchCommand(parent, io) {
         .option('--headroom-mode <mode>', `G7.7: headroom mode (${HEADROOM_MODES.join(' | ')}); default balanced`)
         .option('--force', 'G9: override the 80% hard reject threshold at CLI (NOT allowed at hook layer per RL-30 strict)')
         .option('--from-dag <file>', '2.7.0 slice-dag-dispatcher MVP: read a SliceDag JSON file, dispatch one sub-agent per node in topological order; --batch-id overrides the auto-generated batch id (mutually exclusive with <role>)')
-        .option('--isolation <mode>', 'slice 2026-07-29-worktree-l2-extended Part 2.C: isolation mode for the sub-agent. Accepts "worktree" (Part 2.C + Part 12 L2 surface), "container" (Part 8 contract + Part 12 L4 docker runtime), or "vm" (Part 25 contract; the VM runtime is a follow-up rid and fail-fasts with ISOLATION_VM_NOT_YET_IMPLEMENTED). Auto-spawns a lease + injects PEAKS_<MODE>_LEASE_ID into the dispatch envelope so the sub-agent can write to the isolated surface without a separate auth grant.')).action(async (role, options) => {
+        .option('--isolation <mode>', 'slice 2026-07-29-worktree-l2-extended Part 2.C: isolation mode for the sub-agent. Accepts "worktree" (Part 2.C + Part 12 L2 surface), "container" (Part 8 contract + Part 12 L4 docker runtime), or "vm" (Part 25 contract; the VM runtime is a follow-up rid and fail-fasts with ISOLATION_VM_NOT_YET_IMPLEMENTED). Auto-spawns a lease + injects PEAKS_<MODE>_LEASE_ID into the dispatch envelope so the sub-agent can write to the isolated surface without a separate auth grant.')
+        .option('--emit-bash-script', 'Slice 4.0.7-PR-meta-4: in addition to the JSON envelope, emit a ready-to-exec bash script that the LLM (or the user) can run via the Bash tool. The script invokes the Task tool\'s underlying sub-agent runtime. Lowers the dispatch friction documented in `.peaks/memory/2026-07-28-sub-agent-visibility-issue.md` (the LLM no longer has to manually extract toolCall args from the envelope). The dry-run architecture is preserved: the script is a one-shot executor, not a side-step.')).action(async (role, options) => {
         const asJson = options.json === true;
         // 2.7.0 slice-dag-dispatcher MVP: --from-dag short-circuits the single
         // sub-agent path and runs the full DAG plan via `dag-orchestrator`.
@@ -365,7 +367,14 @@ export function registerDispatchCommand(parent, io) {
                     `branch: ${worktreeBranch}\n` +
                     `You MAY ` + '`git worktree add` ' + `and ` + '`git worktree remove` ' + `against this lease without a separate ` + '`peaks worktree auth grant` ' + `— the PreToolUse gate reads the lease file. Run ` + '`peaks worktree release --lease-id ${leaseId}` ' + `when done.\n`
                 : '';
-            let effectivePrompt = `${formatTestToolDetection()}\n\n${memoryAugmentedBody}${isolationBlock}`;
+            // Slice 4.0.7-dogfood-PR-9: when pnpm-workspace.yaml is present,
+            // append the monorepo test-tool block so the sub-agent scopes
+            // to a single sub-package instead of fanning out to the whole
+            // monorepo. The block is empty/cheap when the project is a
+            // single package (no pnpm-workspace.yaml).
+            const isMonorepo = existsSync(join(projectRoot, 'pnpm-workspace.yaml'));
+            const monorepoBlock = isMonorepo ? `\n\n${MONOREPO_TEST_TOOL_BLOCK}` : '';
+            let effectivePrompt = `${formatTestToolDetection()}${monorepoBlock}\n\n${memoryAugmentedBody}${isolationBlock}`;
             let headroomCompressed = false;
             let headroomResult = null;
             const warnings = [...decision.warnings];
@@ -584,6 +593,33 @@ export function registerDispatchCommand(parent, io) {
                 worktreePath,
                 worktreeBranch
             }, warnings, nextActions), asJson);
+            // Slice 4.0.7-PR-meta-4: --emit-bash-script prints a one-shot
+            // bash script to stdout that the LLM (or the user) can run
+            // directly via the Bash tool. The script invokes the
+            // canonical `peaks sub-agent exec` surface (a new CLI in
+            // this slice) that re-runs the dispatch with the same
+            // dispatchRecordPath, sid, role, batch-id, rid, and
+            // prompt-size, so the LLM does not have to parse toolCall
+            // args from the JSON envelope and re-execute them. The
+            // dry-run architecture is preserved: the CLI is the
+            // canonical dispatch surface; the script is a one-shot
+            // executor, not a side-step.
+            if (options.emitBashScript === true) {
+                const script = [
+                    '#!/usr/bin/env bash',
+                    `# Slice 4.0.7-PR-meta-4: dispatch executor for rid=${rid} role=${role} batch=${batchId}`,
+                    `# Generated by \`peaks sub-agent dispatch --emit-bash-script\`. Re-invokes the`,
+                    '# canonical peaks sub-agent exec surface; safe to run via Bash tool.',
+                    `peaks sub-agent exec \\`,
+                    `  --session-id "${sid}" \\`,
+                    `  --request-id "${rid}" \\`,
+                    `  --role "${role}" \\`,
+                    `  --batch-id "${batchId}" \\`,
+                    `  --dispatch-record "${dispatchRecordPath}" \\`,
+                    `  --project "${projectRoot}"`
+                ].join('\n');
+                process.stdout.write(`\n# === peaks sub-agent dispatch — ready-to-exec script (slice 4.0.7-PR-meta-4) ===\n${script}\n# === end script ===\n`);
+            }
             // Slice 2026-06-23-audit-4th #B1: structured log on success path.
             // Best-effort: writeLogEntry swallows its own errors (logger.ts:155-159),
             // so a full disk or missing ~/.peaks/logs/ dir never blocks the dispatch.