peaks-loop 4.0.54 → 4.1.0

package/dist/services/slice/calibration-store.js

@@ -61,9 +61,15 @@ export function calibrate(complexitySum, testCount, locSum, sampleSize) {
     if (!Number.isInteger(sampleSize) || sampleSize < 0) {
         throw new RangeError(`calibrate: sampleSize must be a non-negative integer, got ${sampleSize}`);
     }
-    const minutesP50 = LOC_WEIGHT_PER_LINE * locSum + TEST_WEIGHT_PER_FILE * testCount + COMPLEXITY_WEIGHT_PER_NODE * complexitySum;
+    const minutesP50 = LOC_WEIGHT_PER_LINE * locSum +
+        TEST_WEIGHT_PER_FILE * testCount +
+        COMPLEXITY_WEIGHT_PER_NODE * complexitySum;
     const minutesP90 = minutesP50 * P90_P50_RATIO;
-    const confidence = sampleSize >= HIGH_CONFIDENCE_MIN_SAMPLES ? 'high' : sampleSize >= MEDIUM_CONFIDENCE_MIN_SAMPLES ? 'medium' : 'low';
+    const confidence = sampleSize >= HIGH_CONFIDENCE_MIN_SAMPLES
+        ? 'high'
+        : sampleSize >= MEDIUM_CONFIDENCE_MIN_SAMPLES
+            ? 'medium'
+            : 'low';
     const rationale = sampleSize === 0
         ? `v1 heuristic: ${LOC_WEIGHT_PER_LINE} min/LoC + ${TEST_WEIGHT_PER_FILE} min/test + ${COMPLEXITY_WEIGHT_PER_NODE} min/complexity; confidence low because no historical sample`
         : sampleSize < HIGH_CONFIDENCE_MIN_SAMPLES

package/dist/services/slice/cross-pass-edge-merger.d.ts

@@ -22,32 +22,7 @@
  * Pass 3 is reserved for future use; the type allows `passNumber: 3` but v1 input
  * never contains it. Pairs are processed left-to-right so edges are deterministic.
  */
-import type { CrossPassEdge, LlmConfidence, PassResult } from './slice-topology-types.js';
-import type { LlmRunner } from '../audit/audit-goal-service.js';
-export interface MergeResult {
-    readonly edges: readonly CrossPassEdge[];
-    readonly llmCalls: readonly LlmCallTrace[];
-}
-export interface MergeOptions {
-    readonly projectRoot: string;
-    readonly llmRunner?: LlmRunner;
-    readonly cacheDir?: string;
-    readonly maxLlmCalls?: number;
-}
-/**
- * Full LLM-call trace captured by `runLlmFallback` for every arbitrator call.
- * Mirrors v2 `LlmArbitration` minus the non-null `tokens` contract; the
- * orchestrator coalesces a possible `null` `tokens` to a zeroed pair.
- */
-export interface LlmCallTrace {
-    readonly callId: string;
-    readonly promptHash: string;
-    readonly input: string;
-    readonly output: string;
-    readonly confidence: LlmConfidence;
-    readonly tokens: {
-        readonly input: number;
-        readonly output: number;
-    } | null;
-}
+import type { PassResult } from './slice-topology-types.js';
+import { type LlmCallTrace, type MergeOptions, type MergeResult } from './cross-pass-edge-static-scan-support.js';
+export type { LlmCallTrace, MergeOptions, MergeResult };
 export declare function merge(passes: readonly PassResult[], opts: MergeOptions): Promise<MergeResult>;

package/dist/services/slice/cross-pass-edge-merger.js

@@ -24,26 +24,9 @@
  */
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { join } from 'node:path';
 import { arbitrate } from './llm-arbitrator.js';
-// ---------------------------------------------------------------------------
-// Static-detection regexes
-// ---------------------------------------------------------------------------
-/** `import type { Foo } from '../upper/...'` and `import type * as Foo from '...'` */
-const TYPE_IMPORT_RE = /import\s+type\s+(?:\{[^}]*\}|\*\s+as\s+\w+|\w+)\s+from\s+['"]([^'"]+)['"]/g;
-/** `export { Bar } from '...'` / `export * from '...'` / `export type { Bar } from '...'`. */
-const RE_EXPORT_RE = /\bexport\s+(?:type\s+)?(?:\*|\{[^}]*\})\s+from\s+['"]([^'"]+)['"]/g;
-/** Any `from '...'` — used only for the fixture-shares rule (test files). */
-const ANY_FROM_RE = /\bfrom\s+['"]([^'"]+)['"]/g;
-const RESOLVE_EXTENSIONS = [
-    '',
-    '.ts',
-    '.tsx',
-    '.js',
-    '/index.ts',
-    '/index.tsx',
-    '/index.js'
-];
+import { ANY_FROM_RE, buildEdge, isTestFile, RE_EXPORT_RE, resolveImport, TYPE_IMPORT_RE } from './cross-pass-edge-static-scan-support.js';
 // ---------------------------------------------------------------------------
 // Entry point
 // ---------------------------------------------------------------------------
@@ -98,7 +81,7 @@ function detectStaticEdges(file, lowerSliceId, fromPass, toPass, upperFileToSlic
                 kind: 'type-shares',
                 confidence: 'structural',
                 evidence,
-                arbitratedBy: null,
+                arbitratedBy: null
             }));
         }
     });
@@ -115,7 +98,7 @@ function detectStaticEdges(file, lowerSliceId, fromPass, toPass, upperFileToSlic
                 kind: 'import-re-export',
                 confidence: 'structural',
                 evidence,
-                arbitratedBy: null,
+                arbitratedBy: null
             }));
         }
     });
@@ -133,7 +116,7 @@ function detectStaticEdges(file, lowerSliceId, fromPass, toPass, upperFileToSlic
                     kind: 'fixture-shares',
                     confidence: 'structural',
                     evidence,
-                    arbitratedBy: null,
+                    arbitratedBy: null
                 }));
             }
         });
@@ -151,7 +134,7 @@ async function runLlmFallback(upper, lowerSlice, fromPass, toPass, cacheDir, max
         cacheDir,
         maxCallsPerInvocation,
         perCallTimeoutMs: 5000,
-        llmRunner,
+        llmRunner
     });
     const isFailurePath = result.callId === 'budget-exhausted' ||
         result.callId === 'timeout' ||
@@ -178,22 +161,13 @@ async function runLlmFallback(upper, lowerSlice, fromPass, toPass, cacheDir, max
             kind: 'llm-arbitrated',
             confidence: 'llm',
             evidence: `llm:${result.callId}: ${parsed.reason}`,
-            arbitratedBy: result.callId,
+            arbitratedBy: result.callId
         }));
     }
 }
-function buildEdge(fields) {
-    return {
-        fromPass: fields.fromPass,
-        toPass: fields.toPass,
-        fromSliceId: fields.fromSliceId,
-        toSliceId: fields.toSliceId,
-        kind: fields.kind,
-        confidence: fields.confidence,
-        evidence: fields.evidence,
-        arbitratedBy: fields.arbitratedBy,
-    };
-}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
 function forEachMatch(re, content, cb) {
     re.lastIndex = 0;
     let match;
@@ -202,31 +176,6 @@ function forEachMatch(re, content, cb) {
         cb(spec, match[0]);
     }
 }
-/**
- * Resolve an import specifier relative to the importing file. Tries common
- * TypeScript extensions and returns the first candidate that exists on disk;
- * if none exist (e.g. the file is virtual / generated), falls back to the
- * `.ts` form so the caller can still match against its own index.
- */
-function resolveImport(fromFile, spec) {
-    const base = isAbsolute(spec)
-        ? spec
-        : resolve(dirname(fromFile), spec);
-    for (const ext of RESOLVE_EXTENSIONS) {
-        const candidate = base + ext;
-        if (existsSync(candidate)) {
-            return candidate;
-        }
-    }
-    return base + '.ts';
-}
-function isTestFile(filePath) {
-    return (filePath.endsWith('.test.ts') ||
-        filePath.endsWith('.test.tsx') ||
-        filePath.endsWith('.test.js') ||
-        /(^|[\\/])__tests__[\\/]/.test(filePath) ||
-        /(^|[\\/])tests[\\/]/.test(filePath));
-}
 function parseDependsReply(raw) {
     // Accept either a pure JSON object or a fenced ```json { ... } ``` block.
     const fence = raw.match(/```(?:json)?\s*([\s\S]*?)```/);
@@ -237,10 +186,11 @@ function parseDependsReply(raw) {
             return null;
         return {
             depends: obj.depends,
-            reason: typeof obj.reason === 'string' ? obj.reason : '',
+            reason: typeof obj.reason === 'string' ? obj.reason : ''
         };
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
 }

package/dist/services/slice/cross-pass-edge-static-scan-support.d.ts

@@ -0,0 +1,69 @@
+/**
+ * cross-pass-edge-static-scan-support — the finding-free primitives that back
+ * `cross-pass-edge-merger.ts`.
+ *
+ * Hoisted verbatim by the wave-5 file-size split
+ * (rid 2026-10-01-wave5-w5-2-slice-scan). Nothing in this module *decides*
+ * anything: the static-detection regexes, the import-specifier resolver, the
+ * edge-shape builder and the merger's public contracts are data and pure
+ * lookups. The detection pipeline that reads them (`merge`,
+ * `detectStaticEdges`, `runLlmFallback`) stays in the parent, and the parent
+ * re-exports these types so `./cross-pass-edge-merger.js` remains the public
+ * import path.
+ */
+import type { CrossPassEdge, LlmConfidence, PassNumber } from './slice-topology-types.js';
+import type { LlmRunner } from '../audit/audit-goal-service.js';
+export interface MergeResult {
+    readonly edges: readonly CrossPassEdge[];
+    readonly llmCalls: readonly LlmCallTrace[];
+}
+export interface MergeOptions {
+    readonly projectRoot: string;
+    readonly llmRunner?: LlmRunner;
+    readonly cacheDir?: string;
+    readonly maxLlmCalls?: number;
+}
+/**
+ * Full LLM-call trace captured by `runLlmFallback` for every arbitrator call.
+ * Mirrors v2 `LlmArbitration` minus the non-null `tokens` contract; the
+ * orchestrator coalesces a possible `null` `tokens` to a zeroed pair.
+ */
+export interface LlmCallTrace {
+    readonly callId: string;
+    readonly promptHash: string;
+    readonly input: string;
+    readonly output: string;
+    readonly confidence: LlmConfidence;
+    readonly tokens: {
+        readonly input: number;
+        readonly output: number;
+    } | null;
+}
+/** `import type { Foo } from '../upper/...'` and `import type * as Foo from '...'` */
+declare const TYPE_IMPORT_RE: RegExp;
+/** `export { Bar } from '...'` / `export * from '...'` / `export type { Bar } from '...'`. */
+declare const RE_EXPORT_RE: RegExp;
+/** Any `from '...'` — used only for the fixture-shares rule (test files). */
+declare const ANY_FROM_RE: RegExp;
+export { ANY_FROM_RE, RE_EXPORT_RE, TYPE_IMPORT_RE };
+interface EdgeFields {
+    readonly fromPass: PassNumber;
+    readonly toPass: PassNumber;
+    readonly fromSliceId: string;
+    readonly toSliceId: string;
+    readonly kind: CrossPassEdge['kind'];
+    readonly confidence: CrossPassEdge['confidence'];
+    readonly evidence: string;
+    readonly arbitratedBy: string | null;
+}
+declare function buildEdge(fields: EdgeFields): CrossPassEdge;
+export { buildEdge };
+/**
+ * Resolve an import specifier relative to the importing file. Tries common
+ * TypeScript extensions and returns the first candidate that exists on disk;
+ * if none exist (e.g. the file is virtual / generated), falls back to the
+ * `.ts` form so the caller can still match against its own index.
+ */
+declare function resolveImport(fromFile: string, spec: string): string;
+declare function isTestFile(filePath: string): boolean;
+export { isTestFile, resolveImport };

package/dist/services/slice/cross-pass-edge-static-scan-support.js

@@ -0,0 +1,74 @@
+/**
+ * cross-pass-edge-static-scan-support — the finding-free primitives that back
+ * `cross-pass-edge-merger.ts`.
+ *
+ * Hoisted verbatim by the wave-5 file-size split
+ * (rid 2026-10-01-wave5-w5-2-slice-scan). Nothing in this module *decides*
+ * anything: the static-detection regexes, the import-specifier resolver, the
+ * edge-shape builder and the merger's public contracts are data and pure
+ * lookups. The detection pipeline that reads them (`merge`,
+ * `detectStaticEdges`, `runLlmFallback`) stays in the parent, and the parent
+ * re-exports these types so `./cross-pass-edge-merger.js` remains the public
+ * import path.
+ */
+import { existsSync } from 'node:fs';
+import { dirname, isAbsolute, resolve } from 'node:path';
+// ---------------------------------------------------------------------------
+// Static-detection regexes
+// ---------------------------------------------------------------------------
+/** `import type { Foo } from '../upper/...'` and `import type * as Foo from '...'` */
+const TYPE_IMPORT_RE = /import\s+type\s+(?:\{[^}]*\}|\*\s+as\s+\w+|\w+)\s+from\s+['"]([^'"]+)['"]/g;
+/** `export { Bar } from '...'` / `export * from '...'` / `export type { Bar } from '...'`. */
+const RE_EXPORT_RE = /\bexport\s+(?:type\s+)?(?:\*|\{[^}]*\})\s+from\s+['"]([^'"]+)['"]/g;
+/** Any `from '...'` — used only for the fixture-shares rule (test files). */
+const ANY_FROM_RE = /\bfrom\s+['"]([^'"]+)['"]/g;
+const RESOLVE_EXTENSIONS = [
+    '',
+    '.ts',
+    '.tsx',
+    '.js',
+    '/index.ts',
+    '/index.tsx',
+    '/index.js'
+];
+export { ANY_FROM_RE, RE_EXPORT_RE, TYPE_IMPORT_RE };
+function buildEdge(fields) {
+    return {
+        fromPass: fields.fromPass,
+        toPass: fields.toPass,
+        fromSliceId: fields.fromSliceId,
+        toSliceId: fields.toSliceId,
+        kind: fields.kind,
+        confidence: fields.confidence,
+        evidence: fields.evidence,
+        arbitratedBy: fields.arbitratedBy
+    };
+}
+export { buildEdge };
+// ---------------------------------------------------------------------------
+// Specifier + path predicates
+// ---------------------------------------------------------------------------
+/**
+ * Resolve an import specifier relative to the importing file. Tries common
+ * TypeScript extensions and returns the first candidate that exists on disk;
+ * if none exist (e.g. the file is virtual / generated), falls back to the
+ * `.ts` form so the caller can still match against its own index.
+ */
+function resolveImport(fromFile, spec) {
+    const base = isAbsolute(spec) ? spec : resolve(dirname(fromFile), spec);
+    for (const ext of RESOLVE_EXTENSIONS) {
+        const candidate = base + ext;
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    return base + '.ts';
+}
+function isTestFile(filePath) {
+    return (filePath.endsWith('.test.ts') ||
+        filePath.endsWith('.test.tsx') ||
+        filePath.endsWith('.test.js') ||
+        /(^|[\\/])__tests__[\\/]/.test(filePath) ||
+        /(^|[\\/])tests[\\/]/.test(filePath));
+}
+export { isTestFile, resolveImport };

package/dist/services/slice/granularity-decider.js

@@ -25,7 +25,7 @@ export function shouldSubdivide(wu, thresholds = DEFAULT_THRESHOLDS) {
     if (locExceeded || filesExceeded) {
         return {
             subdivide: true,
-            reason: `wu ${wu.id}: loc=${wu.loc} files=${wu.files.length} exceeds threshold`,
+            reason: `wu ${wu.id}: loc=${wu.loc} files=${wu.files.length} exceeds threshold`
         };
     }
     const locBorderline = wu.loc > thresholds.maxLoc * 0.8;
@@ -33,7 +33,7 @@ export function shouldSubdivide(wu, thresholds = DEFAULT_THRESHOLDS) {
     if (locBorderline || filesBorderline) {
         return {
             subdivide: 'tie-break',
-            reason: `wu ${wu.id}: within 20% of threshold, needs LLM judgment`,
+            reason: `wu ${wu.id}: within 20% of threshold, needs LLM judgment`
         };
     }
     return { subdivide: false, reason: `wu ${wu.id}: under threshold` };

package/dist/services/slice/slice-archive-service.js

@@ -66,7 +66,10 @@ export function archiveSubAgentRecords(projectRoot, options) {
     return { archivedCompleted, archivedInFlight, gcDeleted };
 }
 function isCompletedOutcome(outcome) {
-    return outcome === 'success' || outcome === 'failed' || outcome === 'timeout' || outcome === 'cancelled';
+    return (outcome === 'success' ||
+        outcome === 'failed' ||
+        outcome === 'timeout' ||
+        outcome === 'cancelled');
 }
 function readRecordOrNull(path) {
     try {
@@ -81,7 +84,8 @@ function readRecordOrNull(path) {
             return null;
         return obj;
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
 }
@@ -103,7 +107,8 @@ function runGarbageCollection(dir, nowMs) {
                 deleted += 1;
             }
         }
-        catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        catch {
+            // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
             /* skip unreadable; do not crash the archive op */
         }
     }

package/dist/services/slice/slice-check-service.js

@@ -128,7 +128,11 @@ function tailLines(text, max) {
     const lines = text.split('\n').filter((l) => l.trim().length > 0);
     if (lines.length <= max)
         return lines.join('\n');
-    return [...lines.slice(0, HEAD_LINES_IN_TAIL), `... (${lines.length - max} more lines) ...`, ...lines.slice(-max + HEAD_LINES_IN_TAIL)].join('\n');
+    return [
+        ...lines.slice(0, HEAD_LINES_IN_TAIL),
+        `... (${lines.length - max} more lines) ...`,
+        ...lines.slice(-max + HEAD_LINES_IN_TAIL)
+    ].join('\n');
 }
 async function runTypecheck(projectRoot) {
     const start = Date.now();
@@ -229,7 +233,8 @@ async function runUnitTests(projectRoot, runTests) {
         durationMs: result.durationMs,
         detail: result.status === 'pass'
             ? `All tests passed in ${result.durationMs}ms.`
-            : tailLines(result.stdout + result.stderr, UNIT_TEST_TAIL_LINES) || `vitest exited with code ${result.exitCode}.`,
+            : tailLines(result.stdout + result.stderr, UNIT_TEST_TAIL_LINES) ||
+                `vitest exited with code ${result.exitCode}.`,
         data: {
             tests: summary.tests,
             passed,
@@ -408,8 +413,7 @@ export async function sliceCheck(options) {
         // fix. Does NOT affect the other 3 stages. Only meaningful when
         // the stage actually runs (skipped-tests bypass short-circuits
         // above).
-        if (options.allowPreExistingFailures === true &&
-            unitTests.status === 'fail') {
+        if (options.allowPreExistingFailures === true && unitTests.status === 'fail') {
             const failureCount = unitTests.data?.failed ?? 0;
             stages.push({
                 name: 'unit-tests',
@@ -486,7 +490,7 @@ async function runAuditRegression(projectRoot) {
                 description: 'audit-regression: catalog integrity + runtime budget (L2.4 P2-b stage 6)',
                 status: 'fail',
                 durationMs,
-                detail: issues.join('; '),
+                detail: issues.join('; ')
             };
         }
         return {
@@ -494,7 +498,7 @@ async function runAuditRegression(projectRoot) {
             description: 'audit-regression: catalog integrity + runtime budget (L2.4 P2-b stage 6)',
             status: 'pass',
             durationMs,
-            detail: `catalog: ${result.audit.totalRedLines} entries (${result.audit.cliBacked} cli-backed, ${result.audit.proseOnly} prose-only); audit ran in ${durationMs}ms`,
+            detail: `catalog: ${result.audit.totalRedLines} entries (${result.audit.cliBacked} cli-backed, ${result.audit.proseOnly} prose-only); audit ran in ${durationMs}ms`
         };
     }
     catch (error) {
@@ -503,7 +507,7 @@ async function runAuditRegression(projectRoot) {
             description: 'audit-regression: catalog integrity + runtime budget (L2.4 P2-b stage 6)',
             status: 'fail',
             durationMs: Date.now() - start,
-            detail: 'audit-regression failed: ' + (error instanceof Error ? error.message : String(error)),
+            detail: 'audit-regression failed: ' + (error instanceof Error ? error.message : String(error))
         };
     }
 }
@@ -554,6 +558,13 @@ async function runMockPlacement(projectRoot) {
         detail: violations.length === 0
             ? `Scanned ${files.length} changed file(s); no inline mock data found.`
             : `${violations.length} violation(s): ${violations.map((v) => `${v.filePath} (${v.snippet})`).join('; ')}`,
-        data: { scannedFiles: files.length, violations: violations.map((v) => ({ filePath: v.filePath, pattern: v.pattern, snippet: v.snippet })) }
+        data: {
+            scannedFiles: files.length,
+            violations: violations.map((v) => ({
+                filePath: v.filePath,
+                pattern: v.pattern,
+                snippet: v.snippet
+            }))
+        }
     };
 }

package/dist/services/slice/slice-decompose-runners.js

@@ -19,38 +19,75 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join, relative, dirname } from 'node:path';
+import { z } from 'zod';
+import { parseJson } from '../../shared/json-parse.js';
 import { resolveNpxInvocation } from '../lint/npx-resolver.js';
 // 2026-09-10: the D1 fix (`orchestrator-can-do.ts`) resolved this tree's own CLI
 // entry so a bare `peaks` never had to be resolved through a Windows `.cmd`
 // shim. `runCodegraph` below needs exactly that, so it reuses the same helper
 // rather than growing a second mechanism.
 import { cliEntryPath, interpreterArgs } from '../web/daemon-supervisor.js';
+/**
+ * The two `codegraph … --json` stdout shapes these runners consume.
+ *
+ * WHY THESE EXIST (batch B4). `JSON.parse(stdout)` is `any`, so `runCodegraph`
+ * — a subprocess whose stdout is not under this module's control — was the
+ * entry for eight `no-unsafe-*` findings: three `no-unsafe-assignment` on the
+ * parse plus five reads (`parsed.changedFiles`, `.affectedTests`,
+ * `.totalDependentsTraversed`) with nothing behind them. The declarations in
+ * `slice-decompose-types.js` (`CodegraphAffectedResult`) are the contract these
+ * two schemas now actually enforce, instead of the parse silently claiming it.
+ *
+ * `query`'s schema is `z.array(z.unknown())` and NOT a deeper envelope, and
+ * that is a measured choice: an element without `node` is DROPPED by the
+ * per-entry guard below rather than failing the whole response, and the guard
+ * tolerates `id` / `kind` / `name` / `filePath` / `score` being any JSON value
+ * (each is run through `String(...)` / `Number(...)`). A stricter element
+ * schema would turn one odd upstream row into an empty result set.
+ */
+const codegraphQueryOutputSchema = z.array(z.unknown());
+/**
+ * `codegraph affected --json` stdout. Every field is `.optional()` because the
+ * `?? files` / `?? []` / `?? 0` defaults below were already the reading of a
+ * missing field — and because the `catch` fallback is those same three values,
+ * a response that misses this schema lands on exactly the value the old
+ * `any`-typed read produced.
+ */
+const codegraphAffectedOutputSchema = z.object({
+    changedFiles: z.array(z.string()).optional(),
+    affectedTests: z.array(z.string()).optional(),
+    totalDependentsTraversed: z.number().optional()
+});
 export function defaultCodegraphRunner() {
     return {
         async query(text, projectRoot) {
             try {
                 const stdout = runCodegraph(['query', text, '--json', '--project', projectRoot], projectRoot);
-                const parsed = JSON.parse(stdout);
-                if (Array.isArray(parsed)) {
-                    // Upstream envelope: { node: {id, kind, name, filePath, ...}, score }
-                    // Flatten to our CodegraphQueryHit shape.
-                    return parsed
-                        .map((entry) => {
-                        if (entry && typeof entry === 'object' && 'node' in entry) {
-                            const node = entry.node;
-                            return {
-                                id: String(node.id ?? ''),
-                                kind: String(node.kind ?? 'unknown'),
-                                name: String(node.name ?? ''),
-                                filePath: String(node.filePath ?? ''),
-                                score: Number(entry.score ?? 0)
-                            };
-                        }
-                        return null;
-                    })
-                        .filter((h) => h !== null && h.filePath !== '');
-                }
-                return [];
+                // The envelope is an ARRAY; the elements are heterogeneous — an entry
+                // that carries no `node` is dropped by the guard below rather than
+                // rejected as a whole, which is what the per-entry check has always
+                // done. `z.array(z.unknown())` is therefore the exact replacement for
+                // the `Array.isArray(parsed)` guard it supersedes: a non-array now
+                // misses the schema and lands in the same `catch` as a non-parseable
+                // stdout, whose fallback (`[]`) is what the old `return []` returned.
+                const parsed = parseJson(stdout, codegraphQueryOutputSchema);
+                // Upstream envelope: { node: {id, kind, name, filePath, ...}, score }
+                // Flatten to our CodegraphQueryHit shape.
+                return parsed
+                    .map((entry) => {
+                    if (entry && typeof entry === 'object' && 'node' in entry) {
+                        const node = entry.node;
+                        return {
+                            id: String(node.id ?? ''),
+                            kind: String(node.kind ?? 'unknown'),
+                            name: String(node.name ?? ''),
+                            filePath: String(node.filePath ?? ''),
+                            score: Number(entry.score ?? 0)
+                        };
+                    }
+                    return null;
+                })
+                    .filter((h) => h !== null && h.filePath !== '');
             }
             catch {
                 return [];
@@ -59,7 +96,7 @@ export function defaultCodegraphRunner() {
         async affected(files, projectRoot) {
             try {
                 const stdout = runCodegraph(['affected', ...files, '--json', '--project', projectRoot], projectRoot);
-                const parsed = JSON.parse(stdout);
+                const parsed = parseJson(stdout, codegraphAffectedOutputSchema);
                 return {
                     changedFiles: parsed.changedFiles ?? files,
                     affectedTests: parsed.affectedTests ?? [],
@@ -146,7 +183,8 @@ export function defaultImportEdgeRunner() {
                         edges.push({ from: file, to: resolved, evidence: match[0] });
                     }
                 }
-                catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+                catch {
+                    // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
                     // Skip unreadable files
                 }
             }

package/dist/services/slice/slice-decompose-service.js

@@ -157,7 +157,9 @@ function matchAcToHit(ac, hits) {
         return null;
     const acLower = ac.toLowerCase();
     for (const h of hits) {
-        const nameBase = basename(h.filePath, '.ts').replace(/\.tsx?$/, '').toLowerCase();
+        const nameBase = basename(h.filePath, '.ts')
+            .replace(/\.tsx?$/, '')
+            .toLowerCase();
         if (acLower.includes(nameBase)) {
             return h;
         }
@@ -481,9 +483,7 @@ function computeUpstream(wus, edges) {
 function runBatchScheduler(wus, upstream) {
     const placed = new Set();
     const batches = [];
-    const seedIds = wus
-        .filter((wu) => (upstream.get(wu.id) ?? []).length === 0)
-        .map((wu) => wu.id);
+    const seedIds = wus.filter((wu) => (upstream.get(wu.id) ?? []).length === 0).map((wu) => wu.id);
     batches.push(materialiseBatch(1, [], seedIds, wus));
     for (const id of seedIds)
         placed.add(id);

package/dist/services/slice/slice-review-state.js

@@ -19,8 +19,14 @@ import { SLICE_ID_PATTERN } from '../sc/sc-service.js';
 /** The 5 default review items per slice (the 12 Gaps memory checklist). */
 export const DEFAULT_REVIEW_ITEMS = [
     { id: 'business-match', question: '这个 slice 做完,业务流程对吗?(跟产品最初给的需求匹配)' },
-    { id: 'boundary-cases', question: '边界 case 跟业务预期一致吗?(异常输入/错误提示/空/加载/失败状态)' },
-    { id: 'ui-assembly', question: 'UI 装配跟产品预期一致吗?(页面模式/关键交互/信息密度,非视觉设计)' },
+    {
+        id: 'boundary-cases',
+        question: '边界 case 跟业务预期一致吗?(异常输入/错误提示/空/加载/失败状态)'
+    },
+    {
+        id: 'ui-assembly',
+        question: 'UI 装配跟产品预期一致吗?(页面模式/关键交互/信息密度,非视觉设计)'
+    },
     { id: 'mergeable', question: '能合入下个业务版本吗?(业务风险/集成断点)' }
 ];
 export function buildEmptySliceReview(sliceId, sessionId, now = new Date()) {

package/dist/services/smoke/smoke-paths-state.js

@@ -67,7 +67,10 @@ export function recordRun(state, id, status, note, now = new Date()) {
         if (p.id !== id)
             return p;
         found = true;
-        const newHistory = [...p.history, { at: now.toISOString(), status, ...(note !== undefined ? { note } : {}) }].slice(-5);
+        const newHistory = [
+            ...p.history,
+            { at: now.toISOString(), status, ...(note !== undefined ? { note } : {}) }
+        ].slice(-5);
         return {
             ...p,
             status,
@@ -101,7 +104,11 @@ export function summarizeState(state) {
             passed++;
         else if (p.status === 'fail') {
             failed++;
-            failedDetails.push({ id: p.id, name: p.name, ...(p.lastRunNote !== undefined ? { lastRunNote: p.lastRunNote } : {}) });
+            failedDetails.push({
+                id: p.id,
+                name: p.name,
+                ...(p.lastRunNote !== undefined ? { lastRunNote: p.lastRunNote } : {})
+            });
         }
         else
             pending++;