peaks-loop 4.0.5 → 4.0.7

package/dist/services/session/session-manager.d.ts

@@ -126,6 +126,35 @@ export declare function getSessionId(projectRoot: string): string | null;
  * so this variant is opt-in.
  */
 export declare function getSessionIdCanonical(projectRoot: string): string | null;
+/**
+ * Slice 4.0.7-dogfood-PR-2 (ice-cola surface probe 2026-08-02): the
+ * single shared resolver that the peaks code / peaks workflow / peaks
+ * route CLI families now use to look up the active session id.
+ *
+ * Pre-rid each of these 4 CLIs had its own private helper that read
+ * `getSkillPresence` (which is `.peaks/.active-skill.json`, set by
+ * `peaks skill presence:set <skill>`) instead of the canonical binding
+ * (`.peaks/_runtime/session.json`, written by `peaks workspace init`).
+ * As a result, any session that was created via `peaks workspace init`
+ * but never had `peaks skill presence:set peaks-code` called on it
+ * (the common case for downstream consumer projects and any 24h-mode
+ * session that never flips sub-skills) reported `NO_ACTIVE_SESSION`
+ * from the 4 affected CLIs even though `peaks session info --active`
+ * returned a valid id.
+ *
+ * Resolution order:
+ *   1. explicit `override` (caller-passed --session-id)
+ *   2. canonicalize-on-read (`getSessionIdCanonical`) — handles the
+ *      stored "." vs caller-passed absolute realpath mismatch
+ *   3. strict-equality fallback (`getSessionId`) — handles the
+ *      pre-canonicalize binding form
+ *
+ * The function returns `null` when no binding exists; callers must
+ * decide whether `null` is a hard error (most CLIs print
+ * `NO_ACTIVE_SESSION` and exit 1) or a soft skip (a few CLIs
+ * silently use `'unknown-sid'` as the dispatch fallback).
+ */
+export declare function resolveActiveSessionId(projectRoot: string, override?: string): string | null;
 /**
  * Get the absolute path to the current session directory.
  * Creates the session if it doesn't exist.

package/dist/services/session/session-manager.js

@@ -408,6 +408,39 @@ export function getSessionIdCanonical(projectRoot) {
     const info = readSessionFileCanonical(projectRoot);
     return info?.sessionId ?? null;
 }
+/**
+ * Slice 4.0.7-dogfood-PR-2 (ice-cola surface probe 2026-08-02): the
+ * single shared resolver that the peaks code / peaks workflow / peaks
+ * route CLI families now use to look up the active session id.
+ *
+ * Pre-rid each of these 4 CLIs had its own private helper that read
+ * `getSkillPresence` (which is `.peaks/.active-skill.json`, set by
+ * `peaks skill presence:set <skill>`) instead of the canonical binding
+ * (`.peaks/_runtime/session.json`, written by `peaks workspace init`).
+ * As a result, any session that was created via `peaks workspace init`
+ * but never had `peaks skill presence:set peaks-code` called on it
+ * (the common case for downstream consumer projects and any 24h-mode
+ * session that never flips sub-skills) reported `NO_ACTIVE_SESSION`
+ * from the 4 affected CLIs even though `peaks session info --active`
+ * returned a valid id.
+ *
+ * Resolution order:
+ *   1. explicit `override` (caller-passed --session-id)
+ *   2. canonicalize-on-read (`getSessionIdCanonical`) — handles the
+ *      stored "." vs caller-passed absolute realpath mismatch
+ *   3. strict-equality fallback (`getSessionId`) — handles the
+ *      pre-canonicalize binding form
+ *
+ * The function returns `null` when no binding exists; callers must
+ * decide whether `null` is a hard error (most CLIs print
+ * `NO_ACTIVE_SESSION` and exit 1) or a soft skip (a few CLIs
+ * silently use `'unknown-sid'` as the dispatch fallback).
+ */
+export function resolveActiveSessionId(projectRoot, override) {
+    if (override !== undefined && override.length > 0)
+        return override;
+    return getSessionIdCanonical(projectRoot) ?? getSessionId(projectRoot);
+}
 /**
  * Get the absolute path to the current session directory.
  * Creates the session if it doesn't exist.

package/dist/services/skills/hooks-settings-service.d.ts

@@ -63,6 +63,21 @@ export type HookInstallOptions = {
      * hook entries use it.
      */
     readonly skipProgress?: boolean;
+    /**
+     * Slice 4.0.7-PR-meta-5: opt-in Edit-enforcement hook entry. When
+     * `true`, the install emits the additional PreToolUse hook entry
+     * pointing at `pre-tool-edit-enforcement.sh`. Default `false` to
+     * preserve the existing install behavior; users who want the
+     * Edit layer enforced pass `--with-edit-enforcement` on the CLI
+     * (or set `PEAKS_INSTALL_EDIT_ENFORCEMENT=1`).
+     */
+    readonly withEditEnforcement?: boolean;
+    /**
+     * Slice 4.0.7-PR-meta-5: opt-in scope-counter hook entry. When
+     * `true`, the install emits the additional PreToolUse hook entry
+     * pointing at `pre-tool-scope-counter.sh`. Default `false`.
+     */
+    readonly withScopeCounter?: boolean;
 };
 /** Sentinel substring identifying a Claude-Code gate-enforce hook entry. */
 export declare const HOOK_ENFORCE_SENTINEL = "peaks gate enforce";
@@ -129,6 +144,32 @@ export type PeaksHookEntry = {
     command: string;
     event: string;
 };
+/**
+ * Slice 4.0.7-PR-meta-1: the Edit-enforcement hook entry. Off by
+ * default; opt in via `peaks hooks install --with-edit-enforcement`
+ * (or `PEAKS_INSTALL_EDIT_ENFORCEMENT=1` env). The entry points at
+ * the new `pre-tool-edit-enforcement.sh` script in
+ * `src/services/hooks/`. The matcher targets Edit / Write / MultiEdit
+ * / NotebookEdit (Claude Code: "Edit|Write|MultiEdit|NotebookEdit";
+ * Trae: same). When the hook fires, the script blocks src/** edits
+ * without an RD artifact on disk (per slice 4.0.7-PR-meta-1 design).
+ */
+export declare const EDIT_ENFORCEMENT_HOOK_MATCHER = "Edit|Write|MultiEdit|NotebookEdit";
+export declare const EDIT_ENFORCEMENT_HOOK_SENTINEL = "peaks edit enforcement";
+export declare const EDIT_ENFORCEMENT_HOOK_EVENT = "PreToolUse";
+/**
+ * Slice 4.0.7-PR-meta-3: the scope-counter hook entry. Off by
+ * default. Tracks cumulative application-source edits in the
+ * active session and emits a fail-LOUD reflection reminder at
+ * thresholds 5, 10, 20. The LLM cannot continue without writing
+ * to `.peaks/_runtime/<sid>/scope-reflection.md` once a threshold
+ * is hit. Different from the harness-side SCOPE WARNING (which
+ * is informational noise); the meta-3 hook surfaces a checkpoint
+ * the LLM must reference in its next turn.
+ */
+export declare const SCOPE_COUNTER_HOOK_MATCHER = "Edit|Write|MultiEdit|NotebookEdit";
+export declare const SCOPE_COUNTER_HOOK_SENTINEL = "peaks scope counter";
+export declare const SCOPE_COUNTER_HOOK_EVENT = "PreToolUse";
 /**
  * The set of Skills whose use is denied at the IDE permissions layer for
  * every `peaks hooks install` call. Each entry is the namespace-qualified

package/dist/services/skills/hooks-settings-service.js

@@ -57,6 +57,14 @@ function resolveIde(options) {
 function resolveSkipProgress(options) {
     return options?.skipProgress === true;
 }
+/** Slice 4.0.7-PR-meta-5: read the withEditEnforcement opt-in flag. */
+function resolveWithEditEnforcement(options) {
+    return options?.withEditEnforcement === true;
+}
+/** Slice 4.0.7-PR-meta-5: read the withScopeCounter opt-in flag. */
+function resolveWithScopeCounter(options) {
+    return options?.withScopeCounter === true;
+}
 /** Resolve settings root dir for a scope. */
 function resolveSettingsRoot(scope, projectRoot) {
     if (scope === 'global')
@@ -165,6 +173,32 @@ export function readInstalledEntriesFromSettings(settings, ide) {
     }
     return result;
 }
+/**
+ * Slice 4.0.7-PR-meta-1: the Edit-enforcement hook entry. Off by
+ * default; opt in via `peaks hooks install --with-edit-enforcement`
+ * (or `PEAKS_INSTALL_EDIT_ENFORCEMENT=1` env). The entry points at
+ * the new `pre-tool-edit-enforcement.sh` script in
+ * `src/services/hooks/`. The matcher targets Edit / Write / MultiEdit
+ * / NotebookEdit (Claude Code: "Edit|Write|MultiEdit|NotebookEdit";
+ * Trae: same). When the hook fires, the script blocks src/** edits
+ * without an RD artifact on disk (per slice 4.0.7-PR-meta-1 design).
+ */
+export const EDIT_ENFORCEMENT_HOOK_MATCHER = 'Edit|Write|MultiEdit|NotebookEdit';
+export const EDIT_ENFORCEMENT_HOOK_SENTINEL = 'peaks edit enforcement';
+export const EDIT_ENFORCEMENT_HOOK_EVENT = 'PreToolUse';
+/**
+ * Slice 4.0.7-PR-meta-3: the scope-counter hook entry. Off by
+ * default. Tracks cumulative application-source edits in the
+ * active session and emits a fail-LOUD reflection reminder at
+ * thresholds 5, 10, 20. The LLM cannot continue without writing
+ * to `.peaks/_runtime/<sid>/scope-reflection.md` once a threshold
+ * is hit. Different from the harness-side SCOPE WARNING (which
+ * is informational noise); the meta-3 hook surfaces a checkpoint
+ * the LLM must reference in its next turn.
+ */
+export const SCOPE_COUNTER_HOOK_MATCHER = 'Edit|Write|MultiEdit|NotebookEdit';
+export const SCOPE_COUNTER_HOOK_SENTINEL = 'peaks scope counter';
+export const SCOPE_COUNTER_HOOK_EVENT = 'PreToolUse';
 /**
  * Compute the per-IDE peaks hook entries to merge into the settings file.
  * Replaces the slice #1 hardcoded `PEAKS_HOOK_ENTRIES` constant; the constant
@@ -182,11 +216,33 @@ export function readInstalledEntriesFromSettings(settings, ide) {
  * can find + remove any stale progress-start entry that an older
  * `peaks hooks install` may have written before this slice.
  */
-function resolveHookEntries(ide, _skipProgress = false) {
+function resolveHookEntries(ide, options = {}) {
     const spec = resolveHookSpec(ide);
-    return [
+    const entries = [
         { sentinel: spec.hookEnforceSentinel, matcher: spec.hookEnforceMatcher, command: spec.hookEnforceCommand, event: spec.hookEnforceEvent }
     ];
+    // Slice 4.0.7-PR-meta-1: opt-in Edit enforcement. Default false
+    // to preserve the existing `peaks hooks install` behavior; users
+    // who want the LLM Edit layer enforced call install with the
+    // opt-in flag or env var.
+    if ('withEditEnforcement' in options && options.withEditEnforcement === true) {
+        entries.push({
+            sentinel: EDIT_ENFORCEMENT_HOOK_SENTINEL,
+            matcher: EDIT_ENFORCEMENT_HOOK_MATCHER,
+            command: 'peaks edit-enforcement',
+            event: EDIT_ENFORCEMENT_HOOK_EVENT
+        });
+    }
+    // Slice 4.0.7-PR-meta-3: opt-in scope counter. Default false.
+    if ('withScopeCounter' in options && options.withScopeCounter === true) {
+        entries.push({
+            sentinel: SCOPE_COUNTER_HOOK_SENTINEL,
+            matcher: SCOPE_COUNTER_HOOK_MATCHER,
+            command: 'peaks scope-counter',
+            event: SCOPE_COUNTER_HOOK_EVENT
+        });
+    }
+    return entries;
 }
 /**
  * Legacy sentinel set used by uninstall + status to find and remove stale
@@ -393,7 +449,7 @@ export function planHookInstall(scope, projectRoot, options) {
     };
 }
 /** Merge all peaks-managed hook entries into settings, preserving all other keys and hooks. */
-function withHooksInstalledForIde(settings, ide, _skipProgress = false) {
+function withHooksInstalledForIde(settings, ide, options = {}) {
     const existingHooks = (settings.hooks && typeof settings.hooks === 'object' && !Array.isArray(settings.hooks))
         ? settings.hooks
         : {};
@@ -401,7 +457,7 @@ function withHooksInstalledForIde(settings, ide, _skipProgress = false) {
     // beforeToolCall; Claude: gate-enforce on PreToolUse). Group by event
     // so each event array is independently merged.
     const ourByEvent = new Map();
-    for (const spec of resolveHookEntries(ide)) {
+    for (const spec of resolveHookEntries(ide, options)) {
         const list = ourByEvent.get(spec.event) ?? [];
         list.push(spec);
         ourByEvent.set(spec.event, list);
@@ -474,7 +530,7 @@ export function applyHookInstall(scope, projectRoot, options) {
     // entry. The chain cannot run raw `git worktree add` (or
     // `podman run`) without an explicit `peaks hooks uninstall`
     // first. Both helpers are pure + idempotent.
-    const merged = withTriggeredDenyList(withSuperpowersSkillDenylist(withHooksInstalledForIde(settings, ide)));
+    const merged = withTriggeredDenyList(withSuperpowersSkillDenylist(withHooksInstalledForIde(settings, ide, { withEditEnforcement: resolveWithEditEnforcement(options), withScopeCounter: resolveWithScopeCounter(options) })));
     atomicWriteJson(settingsPath, merged);
     return { ...baseResult, alreadyInstalled: false, applied: true };
 }

package/dist/services/slice/slice-check-service.js

@@ -83,6 +83,19 @@ function tailLines(text, max) {
 }
 async function runTypecheck(projectRoot) {
     const start = Date.now();
+    // Slice 4.0.7-dogfood-PR-10 (ice-cola surface probe 2026-08-02):
+    // detect pnpm-workspace.yaml and run a per-package typecheck instead
+    // of the root `tsc --noEmit`. Pre-rid the typecheck stage ran
+    // against the root, which has no `tsconfig.json` (only
+    // `tsconfig.base.json`) in ice-cola, and reported
+    // `tsc exited with code 1` in 2ms — a fake-fail with no actionable
+    // detail. The fix dispatches to `pnpm -r --parallel exec tsc
+    // --noEmit` (or `pnpm -r typecheck` if defined) and reports
+    // per-package failures in `data.failedPackages`.
+    const isMonorepo = existsSync(join(projectRoot, 'pnpm-workspace.yaml'));
+    if (isMonorepo) {
+        return runMonorepoTypecheck(projectRoot, start);
+    }
     // Per Windows npx ENOENT (observations 2317+2792 from
     // 2026-06-09), prefer the project-local `node_modules/.bin/tsc`
     // (symlink on Unix, .cmd on Windows). The local binary is
@@ -102,6 +115,52 @@ async function runTypecheck(projectRoot) {
         data: { exitCode: result.exitCode }
     };
 }
+/**
+ * Slice 4.0.7-dogfood-PR-10: per-package typecheck for pnpm
+ * monorepos. Tries `pnpm -r typecheck` first (the convention), then
+ * falls back to `pnpm -r --parallel exec tsc --noEmit`. Captures
+ * per-package failures so callers can see which sub-packages
+ * actually failed (the pre-rid "tsc exited with code 1" was an
+ * unhelpful 1-line summary that took 2ms — clear fake-fail).
+ */
+async function runMonorepoTypecheck(projectRoot, start) {
+    const pnpm = resolveLocalBinary(projectRoot, 'pnpm');
+    // First try the convention script.
+    const r1 = runCommand(pnpm.command, [...pnpm.args, '-r', '--workspace-concurrency=4', 'typecheck'], projectRoot, 300_000, pnpm.shell);
+    let result = r1;
+    let mode = 'pnpm -r typecheck';
+    if (result.status === 'fail') {
+        // Convention script missing in some sub-packages. Fall back to
+        // direct tsc invocation in parallel.
+        const tsc = resolveLocalBinary(projectRoot, 'tsc');
+        result = runCommand(pnpm.command, [...pnpm.args, '-r', '--parallel', 'exec', tsc.command, ...tsc.args, '--noEmit'], projectRoot, 300_000, pnpm.shell);
+        mode = 'pnpm -r exec tsc --noEmit';
+    }
+    const failedPackages = [];
+    // pnpm -r prints "<pkg>> error TS..." lines on failure. Extract
+    // them so the operator can see which sub-package broke.
+    const failLines = result.stdout.split('\n');
+    for (const line of failLines) {
+        const m = line.match(/^([^>\s]+)>\s+(.+)$/);
+        if (m && m[1] !== undefined && m[2] !== undefined && /error TS/.test(m[2])) {
+            failedPackages.push({
+                package: m[1],
+                exitCode: result.exitCode,
+                stderrTail: m[2].slice(0, 200)
+            });
+        }
+    }
+    return {
+        name: 'typecheck',
+        description: `${mode} (monorepo per-package typecheck)`,
+        status: result.status,
+        durationMs: Date.now() - start,
+        detail: result.status === 'pass'
+            ? `Monorepo typecheck passed in ${Date.now() - start}ms (${mode}).`
+            : tailLines(result.stdout + result.stderr, 10) || `pnpm exited with code ${result.exitCode}.`,
+        data: { exitCode: result.exitCode, mode, failedPackages }
+    };
+}
 function parseVitestSummary(stdout, fallbackDuration) {
     // Vitest 2.x prints e.g. "Test Files  1 passed (1)" and "Tests  1 passed (1)"
     // and "Duration  0.50s" or "Duration  1.23s". Be lenient with regex.

package/dist/services/standards/find-skills-integration.d.ts

@@ -0,0 +1,59 @@
+import type { ProjectContext } from './project-context.js';
+export interface SkillRecommendation {
+    /** GitHub owner/repo, e.g. "vercel-labs/agent-skills". */
+    readonly owner: string;
+    /** Skill slug within the repo, e.g. "react-best-practices". */
+    readonly skillSlug: string;
+    /** Display name (best-effort; may equal slug). */
+    readonly displayName: string;
+    /** Short description from the registry; empty when not parseable. */
+    readonly description: string;
+    /** Install count from the registry listing; null when unparseable. */
+    readonly installCount: number | null;
+    /** The shell command the user can paste to install this skill. */
+    readonly installCommand: string;
+}
+export interface FindSkillsResult {
+    readonly recommendations: readonly SkillRecommendation[];
+    /** Queries that found zero candidates (operator-visible). */
+    readonly emptyQueries: readonly string[];
+    /** `npx skills find` runs that failed (network / registry); non-fatal. */
+    readonly failedRuns: readonly {
+        readonly query: string;
+        readonly reason: string;
+    }[];
+}
+/**
+ * Map a ProjectContext to a small query set. Returns at most 8
+ * queries to keep the network surface bounded; ordering is
+ * best-to-worst (more specific first, then broad). Deliberately
+ * no hardcoded owner whitelist — `findSkillsForContext` runs
+ * `npx skills find <query>` with no `--owner` filter so the
+ * registry / leaderboard surfaces whatever the user might want
+ * (per find-skills SKILL.md Step 2-3 guidance).
+ */
+export declare function queriesForContext(ctx: ProjectContext): readonly string[];
+/**
+ * Spawn runner injection point. The default spawns
+ * `npx skills find <query>` (no `--owner` filter, so the registry
+ * decides what surfaces). Tests pass a deterministic stub.
+ */
+export type SkillFindRunner = (query: string) => Promise<string>;
+export declare const defaultSkillFindRunner: SkillFindRunner;
+/**
+ * Parse a `npx skills find` stdout blob into SkillRecommendation rows.
+ * The CLI output is line-oriented; a row looks like
+ *   <owner>/<repo>@<slug>   <install-count>   <description>
+ * The parser is lenient — any line that contains a
+ * `<owner>/<repo>@<slug>` triple is captured.
+ */
+export declare function parseFindOutput(stdout: string): readonly SkillRecommendation[];
+/**
+ * Main entry: query the registry for each query, dedup, sort by
+ * install-count desc (the registry's leaderboard already orders by
+ * popularity; we keep the same ordering). Returns top-N rows.
+ */
+export declare function findSkillsForContext(ctx: ProjectContext, options?: {
+    readonly topN?: number;
+    readonly findRunner?: SkillFindRunner;
+}): Promise<FindSkillsResult>;

package/dist/services/standards/find-skills-integration.js

@@ -0,0 +1,225 @@
+/**
+ * Slice 4.0.7-PR-12 (ice-cola surface probe 2026-08-02).
+ *
+ * After `peaks standards init` / `peaks standards update` materializes
+ * the project-local standards tree, the user often wants to also
+ * bring in matching skills from the open agent-skills ecosystem
+ * (https://skills.sh/). A TypeScript monorepo with React + NestJS +
+ * Tailwind + Playwright + pnpm has natural companions in
+ * vercel-labs/agent-skills, anthropics/skills, and similar curated
+ * collections.
+ *
+ * Slice 4.0.7 dogfood round 2 (user direction 2026-08-02): do NOT
+ * hardcode a `VERIFIED_SKILL_OWNERS` whitelist. The first version
+ * shipped a static list of "trusted" owners, but that is exactly
+ * what the find-skills skill tells users NOT to do — let the
+ * registry + leaderboard decide. This service now:
+ *   1. maps the detected ProjectContext to a small set of natural
+ *      language queries (component library, build tool, language).
+ *   2. runs `npx skills find <query>` ONCE per query with no
+ *      `--owner` filter, so the registry returns whatever the
+ *      leaderboard surfaces (vercel-labs/agent-skills at the top
+ *      for "react" is a registry result, not a hardcoded one).
+ *   3. parses + dedups + ranks by install count desc (the
+ *      registry / leaderboard already orders by popularity).
+ *   4. emits a `SkillRecommendation` list with `install` command.
+ *
+ * **Hard rule (per peaks-loop external-references):** this service
+ * NEVER calls `npx skills add` itself. Installation is gated on the
+ * user passing `--suggest-skills` to `peaks standards init/update`,
+ * and the install command is emitted as a single shell snippet the
+ * user can review before pasting. Default behavior: recommendation
+ * only, no install. The CLI caller owns the gating.
+ *
+ * Pure: no I/O of the project tree; only `npx skills find` calls
+ * (which are external side effects that we treat as testable via a
+ * `skillFindRunner` injection).
+ */
+import { spawn } from 'node:child_process';
+/**
+ * Map a ProjectContext to a small query set. Returns at most 8
+ * queries to keep the network surface bounded; ordering is
+ * best-to-worst (more specific first, then broad). Deliberately
+ * no hardcoded owner whitelist — `findSkillsForContext` runs
+ * `npx skills find <query>` with no `--owner` filter so the
+ * registry / leaderboard surfaces whatever the user might want
+ * (per find-skills SKILL.md Step 2-3 guidance).
+ */
+export function queriesForContext(ctx) {
+    const queries = [];
+    // Component library first (most specific)
+    if (ctx.componentLibrary.name === 'antd')
+        queries.push('antd', 'react');
+    else if (ctx.componentLibrary.name === 'antd-pro')
+        queries.push('antd-pro', 'react', 'pro-components');
+    else if (ctx.componentLibrary.name === 'mui')
+        queries.push('mui', 'react');
+    else if (ctx.componentLibrary.name === 'shadcn')
+        queries.push('shadcn', 'react', 'tailwind');
+    else if (ctx.componentLibrary.name === 'arco')
+        queries.push('arco', 'react');
+    else if (ctx.componentLibrary.name === 'tdesign')
+        queries.push('tdesign', 'react');
+    else if (ctx.componentLibrary.name === 'element-plus')
+        queries.push('element-plus', 'vue');
+    else if (ctx.componentLibrary.name === 'vant')
+        queries.push('vant', 'mobile');
+    // Build tool
+    if (ctx.buildTool === 'next')
+        queries.push('nextjs', 'react');
+    else if (ctx.buildTool === 'vite')
+        queries.push('vite', 'frontend');
+    else if (ctx.buildTool === 'umi')
+        queries.push('umi');
+    else if (ctx.buildTool === 'rsbuild')
+        queries.push('rsbuild', 'rspack');
+    else if (ctx.buildTool === 'rspack')
+        queries.push('rspack');
+    // CSS framework
+    if (ctx.cssFrameworks.includes('tailwind'))
+        queries.push('tailwind');
+    if (ctx.cssFrameworks.includes('less'))
+        queries.push('less');
+    // Domain hints
+    for (const dep of ctx.notableDeps) {
+        if (dep.startsWith('@nestjs/'))
+            queries.push('nestjs');
+        if (dep === 'playwright' || dep === '@playwright/test')
+            queries.push('playwright', 'e2e');
+        if (dep === 'vitest')
+            queries.push('vitest', 'testing');
+        if (dep === 'prisma')
+            queries.push('prisma');
+        if (dep === 'drizzle-orm')
+            queries.push('drizzle');
+        if (dep === 'graphql' || dep === '@apollo/client')
+            queries.push('graphql');
+    }
+    // Always include the language + the platform itself
+    queries.push(ctx.hasPackageJson ? 'typescript' : 'javascript');
+    // Dedup while preserving order, then cap at 12 to bound the
+    // network surface (each query fans out to the registry). 12
+    // keeps both "specific" (antd, react, nestjs) and "broad"
+    // (typescript / javascript) queries in the same list.
+    const seen = new Set();
+    const deduped = queries.filter((q) => (seen.has(q) ? false : (seen.add(q), true)));
+    return deduped.slice(0, 12);
+}
+export const defaultSkillFindRunner = (query) => new Promise((resolveText, reject) => {
+    // No `--owner` flag: the registry's leaderboard decides the
+    // ranking. We do NOT hardcode a "verified owners" whitelist —
+    // that is exactly the anti-pattern the find-skills SKILL.md
+    // warns against (Step 4: verify install count + source
+    // reputation, but trust the leaderboard first).
+    const child = spawn('npx', ['skills', 'find', query], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+    child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+    child.on('error', reject);
+    child.on('close', (code) => {
+        if (code === 0)
+            resolveText(stdout);
+        else
+            reject(new Error(`npx skills find exited ${code}: ${stderr.slice(0, 200)}`));
+    });
+});
+/**
+ * Parse a `npx skills find` stdout blob into SkillRecommendation rows.
+ * The CLI output is line-oriented; a row looks like
+ *   <owner>/<repo>@<slug>   <install-count>   <description>
+ * The parser is lenient — any line that contains a
+ * `<owner>/<repo>@<slug>` triple is captured.
+ */
+export function parseFindOutput(stdout) {
+    const lines = stdout.split('\n');
+    const rows = [];
+    const rowRe = /([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)@([A-Za-z0-9_.-]+)/;
+    for (const line of lines) {
+        const m = line.match(rowRe);
+        if (!m || m[1] === undefined || m[2] === undefined || m[3] === undefined)
+            continue;
+        const rowOwner = m[1];
+        const repoName = m[2];
+        const skillSlug = m[3];
+        // Parse install count if the line has a number with K/M suffix.
+        let installCount = null;
+        const countMatch = line.match(/(\d+(?:\.\d+)?)\s*([KkMm]?)\b/);
+        if (countMatch && countMatch[1] !== undefined) {
+            const base = parseFloat(countMatch[1]);
+            const suffix = (countMatch[2] ?? '').toUpperCase();
+            if (!Number.isNaN(base)) {
+                installCount = suffix === 'K' ? base * 1_000 : suffix === 'M' ? base * 1_000_000 : base;
+            }
+        }
+        const desc = line.replace(rowRe, '').trim();
+        const fullSlug = `${rowOwner}/${repoName}@${skillSlug}`;
+        rows.push({
+            owner: rowOwner,
+            skillSlug,
+            displayName: skillSlug,
+            description: desc,
+            installCount,
+            installCommand: `npx skills add ${fullSlug} -g -y`,
+        });
+    }
+    return rows;
+}
+/**
+ * Main entry: query the registry for each query, dedup, sort by
+ * install-count desc (the registry's leaderboard already orders by
+ * popularity; we keep the same ordering). Returns top-N rows.
+ */
+export async function findSkillsForContext(ctx, options = {}) {
+    const topN = options.topN ?? 8;
+    const findRunner = options.findRunner ?? defaultSkillFindRunner;
+    const queries = queriesForContext(ctx);
+    const seen = new Set();
+    const all = [];
+    const emptyQueries = [];
+    const failedRuns = [];
+    for (const query of queries) {
+        try {
+            const stdout = await findRunner(query);
+            const rows = parseFindOutput(stdout);
+            if (rows.length === 0) {
+                emptyQueries.push(query);
+                continue;
+            }
+            for (const r of rows) {
+                const key = `${r.owner}/${r.skillSlug}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                all.push(r);
+            }
+        }
+        catch (err) {
+            failedRuns.push({
+                query,
+                reason: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    // Sort by install count desc (registry leaderboard is already
+    // ordered by popularity; we keep the same order so the user sees
+    // the same top results they would see in `npx skills find`).
+    // Tiebreaker: display name asc.
+    all.sort((a, b) => {
+        if (a.installCount !== null && b.installCount !== null && a.installCount !== b.installCount) {
+            return b.installCount - a.installCount;
+        }
+        if (a.installCount === null && b.installCount !== null)
+            return 1;
+        if (a.installCount !== null && b.installCount === null)
+            return -1;
+        return a.displayName.localeCompare(b.displayName);
+    });
+    return {
+        recommendations: all.slice(0, topN),
+        emptyQueries,
+        failedRuns,
+    };
+}

package/dist/services/standards/project-standards-service.js

@@ -85,8 +85,23 @@ function parseLanguage(value) {
     throw new Error('Unsupported standards language');
 }
 function detectLanguageInternal(projectRoot) {
+    // Slice 4.0.7-dogfood-PR-7 (ice-cola surface probe 2026-08-02): a
+    // monorepo root often has no `tsconfig.json` (it has
+    // `tsconfig.base.json` + per-package `tsconfig.json`), and the root
+    // `package.json` may be a thin workspace manifest (no language-bearing
+    // deps). Pre-rid, ice-cola (4-package TypeScript monorepo:
+    // NestJS server / React admin / Tauri client / Hermes agent) was
+    // misclassified as `javascript` because the root has no `tsconfig.json`
+    // and the root `package.json#devDependencies` only lists `peaks-loop`
+    // (a string of "javascript" in the standards devDep pack). The fix
+    // walks `packages/*/` recursively and prefers the first match of a
+    // language-bearing manifest over the root.
+    if (scanMonorepoPackages(projectRoot, 'tsconfig.json'))
+        return 'typescript';
     if (existsSync(join(projectRoot, 'tsconfig.json')))
         return 'typescript';
+    if (scanMonorepoPackages(projectRoot, 'package.json'))
+        return 'javascript';
     if (existsSync(join(projectRoot, 'package.json')))
         return 'javascript';
     if (existsSync(join(projectRoot, 'pyproject.toml')) || existsSync(join(projectRoot, 'requirements.txt')))
@@ -97,6 +112,35 @@ function detectLanguageInternal(projectRoot) {
         return 'rust';
     return 'generic';
 }
+/**
+ * Slice 4.0.7-dogfood-PR-7: look one level deep into the standard
+ * pnpm monorepo layout (`packages/<name>/`) and return true if any
+ * sub-package contains the named manifest. We deliberately do NOT
+ * recurse arbitrarily (no fs.walk) — the convention is one
+ * packages/[name]/ level. A repo with a nested
+ * workspaces/[name]/[name]/package.json is not in the supported
+ * monorepo shape and will fall through to the root scan.
+ */
+function scanMonorepoPackages(projectRoot, manifestName) {
+    const packagesDir = join(projectRoot, 'packages');
+    if (!existsSync(packagesDir))
+        return false;
+    let entries;
+    try {
+        entries = readdirSync(packagesDir);
+    }
+    catch {
+        return false;
+    }
+    for (const entry of entries) {
+        if (entry === '.' || entry === '..')
+            continue;
+        const candidate = join(packagesDir, entry, manifestName);
+        if (existsSync(candidate))
+            return true;
+    }
+    return false;
+}
 /**
  * Public alias for `detectLanguageInternal` so callers outside this
  * module (e.g. `workspace-service.ts` for the slice 2026-06-16 RD#7