peaks-loop 4.0.54 → 4.1.0

package/dist/services/rd/types.js

@@ -13,10 +13,12 @@ export const StrategyOutputSchema = z.object({
     rootCauseAnalysis: z.string(),
     impactSurface: z.array(z.string()),
     designRationale: z.string(),
-    askUserQuestion: z.object({
+    askUserQuestion: z
+        .object({
         question: z.string(),
-        options: z.array(z.string()),
-    }).optional(),
+        options: z.array(z.string())
+    })
+        .optional()
 });
 export const AstViolationSchema = z.object({
     file: z.string(),
@@ -24,17 +26,17 @@ export const AstViolationSchema = z.object({
     api: z.string(),
     expectedVersion: z.string(),
     actualVersion: z.string(),
-    severity: z.enum(['error', 'warning']),
+    severity: z.enum(['error', 'warning'])
 });
 export const AstGateResultSchema = z.object({
     passed: z.boolean(),
-    violations: z.array(AstViolationSchema),
+    violations: z.array(AstViolationSchema)
 });
 export const ExternalApiCallSchema = z.object({
     file: z.string(),
     line: z.number().int(),
     api: z.string(),
-    version: z.string(),
+    version: z.string()
 });
 export const ImplOutputSchema = z.object({
     version: z.literal('1.0'),
@@ -43,5 +45,5 @@ export const ImplOutputSchema = z.object({
     inputSig: z.string().regex(/^[a-f0-9]{64}$/), // STRAT.sig
     changedFiles: z.array(z.string()),
     externalApiCalls: z.array(ExternalApiCallSchema),
-    astGateResult: AstGateResultSchema,
+    astGateResult: AstGateResultSchema
 });

package/dist/services/rd-swarm/rd-swarm-service.d.ts

@@ -1,5 +1,7 @@
 import type { WorkspaceConfig } from '../config/config-types.js';
 import { type BoundaryError } from '../openspec/artifact-boundary.js';
+import type { RdTaskGraph } from './rd-swarm-types.js';
+export type { RdConflictGroup, RdTask, RdTaskGraph, RdWaveName } from './rd-swarm-types.js';
 export type RdSwarmPlanRequest = {
     skill: 'rd' | string;
     changeId: string;
@@ -11,50 +13,5 @@ export type RdSwarmPlanRequest = {
     requiresTechApproval?: boolean;
     workspace?: WorkspaceConfig;
 };
-export type RdWaveName = 'discovery' | 'planning' | 'implementation candidates' | 'quality gates' | 'reducer';
-export type RdTask = {
-    taskId: string;
-    wave: RdWaveName;
-    workerKind: string;
-    purpose: string;
-    inputs: string[];
-    outputs: [string, ...string[]];
-    dependsOn: string[];
-    conflictGroup: string;
-    targetArea: string;
-    expectedEvidence: string;
-};
-export type RdConflictGroup = {
-    groupId: string;
-    ownedPaths: string[];
-    parallelismPolicy: 'parallel' | 'sequential';
-    reason: string;
-};
-export type RdTaskGraph = {
-    changeId: string;
-    goal: string;
-    available: boolean;
-    workerTarget: number;
-    waves: Array<{
-        name: RdWaveName;
-        taskIds: string[];
-    }>;
-    tasks: RdTask[];
-    conflictGroups: RdConflictGroup[];
-    artifactRoot: string;
-    outputs: {
-        taskGraph: string;
-        waveManifests: string[];
-        workerBriefs: string[];
-        reducerReport: string;
-    };
-    gateStatus: {
-        techApprovalRequired: boolean;
-        techStatus: string;
-        skipReason?: string;
-    };
-    blockedReasons: string[];
-    nextActions: string[];
-};
 export declare function planRdSwarmGraph(input: RdSwarmPlanRequest): RdTaskGraph;
 export type { BoundaryError };

package/dist/services/rd-swarm/rd-swarm-service.js

@@ -4,13 +4,36 @@ import { planArtifactPath, validateChangeId } from '../openspec/artifact-boundar
 import { getTechStatus as getLegacyTechStatus } from '../tech/tech-service.js';
 const MIN_WORKERS = 25;
 const MAX_WORKERS = 40;
-const REQUIRED_TECH_FILES = ['frontend-tech-doc.md', 'backend-tech-doc.md', 'tech-approval-record.md'];
+const REQUIRED_TECH_FILES = [
+    'frontend-tech-doc.md',
+    'backend-tech-doc.md',
+    'tech-approval-record.md'
+];
 function failure(input, reasons, actions, gateStatus, workerTarget) {
-    return { ...input, available: false, workerTarget, waves: [], tasks: [], conflictGroups: [], outputs: { taskGraph: `${input.artifactRoot}/task-graph.json`, waveManifests: [], workerBriefs: [], reducerReport: `${input.artifactRoot}/reducer-report.md` }, gateStatus, blockedReasons: reasons, nextActions: actions };
+    return {
+        ...input,
+        available: false,
+        workerTarget,
+        waves: [],
+        tasks: [],
+        conflictGroups: [],
+        outputs: {
+            taskGraph: `${input.artifactRoot}/task-graph.json`,
+            waveManifests: [],
+            workerBriefs: [],
+            reducerReport: `${input.artifactRoot}/reducer-report.md`
+        },
+        gateStatus,
+        blockedReasons: reasons,
+        nextActions: actions
+    };
 }
 function validate(input) {
     if (input.skill !== 'rd')
-        return { ok: false, error: { code: 'UNSUPPORTED_SWARM_SKILL', message: `Unsupported skill ${input.skill}` } };
+        return {
+            ok: false,
+            error: { code: 'UNSUPPORTED_SWARM_SKILL', message: `Unsupported skill ${input.skill}` }
+        };
     const id = validateChangeId(input.changeId);
     if (!id.ok)
         return { ok: false, error: id.error };
@@ -21,39 +44,92 @@ function validate(input) {
 }
 function localTechStatus(input) {
     try {
-        const canonical = getLegacyTechStatus({ sessionId: input.changeId, artifactWorkspacePath: input.workspaceRoot, ...(input.workspace ? { workspace: input.workspace } : {}) });
+        const canonical = getLegacyTechStatus({
+            sessionId: input.changeId,
+            artifactWorkspacePath: input.workspaceRoot,
+            ...(input.workspace ? { workspace: input.workspace } : {})
+        });
         if (canonical.status === 'approved')
             return 'approved';
     }
-    catch { /* pure planner fallback for an unconfigured workspace */ }
+    catch {
+        /* pure planner fallback for an unconfigured workspace */
+    }
     const root = join(input.workspaceRoot, input.changeId, 'rd', 'architecture');
     const missing = REQUIRED_TECH_FILES.filter((name) => !existsSync(join(root, name)));
     if (missing.length > 0)
-        return missing.includes('tech-approval-record.md') && missing.length === 1 ? 'missing-approval' : 'missing';
+        return missing.includes('tech-approval-record.md') && missing.length === 1
+            ? 'missing-approval'
+            : 'missing';
     try {
-        return readFileSync(join(root, 'tech-approval-record.md'), 'utf8').split(/\r?\n/).some((line) => line.trim() === 'status: approved') ? 'approved' : 'not-approved';
+        return readFileSync(join(root, 'tech-approval-record.md'), 'utf8')
+            .split(/\r?\n/)
+            .some((line) => line.trim() === 'status: approved')
+            ? 'approved'
+            : 'not-approved';
     }
     catch {
         return 'not-approved';
     }
 }
 function path(input, template) {
-    const result = planArtifactPath({ changeId: input.changeId, workspaceRoot: input.workspaceRoot, role: 'rd', requestId: 'swarm', template });
+    const result = planArtifactPath({
+        changeId: input.changeId,
+        workspaceRoot: input.workspaceRoot,
+        role: 'rd',
+        requestId: 'swarm',
+        template
+    });
     if (!result.ok)
         throw new Error(result.error.message);
     return result.value.jsonSafeRelativePath;
 }
 function createTask(taskId, wave, goal, dependencies, index) {
     const output = `workers/${taskId}/brief.md`;
-    return { taskId, wave, workerKind: taskId, purpose: `${taskId} for ${goal}`, inputs: [goal], outputs: [output], dependsOn: [...dependencies], conflictGroup: `group-${wave.replace(/\s/g, '-')}`, targetArea: wave === 'implementation candidates' ? `slice-${index + 1}` : wave, expectedEvidence: `${taskId}-evidence.md` };
+    return {
+        taskId,
+        wave,
+        workerKind: taskId,
+        purpose: `${taskId} for ${goal}`,
+        inputs: [goal],
+        outputs: [output],
+        dependsOn: [...dependencies],
+        conflictGroup: `group-${wave.replace(/\s/g, '-')}`,
+        targetArea: wave === 'implementation candidates' ? `slice-${index + 1}` : wave,
+        expectedEvidence: `${taskId}-evidence.md`
+    };
 }
 function taskIds(target) {
-    const discovery = ['rd-frontend-scan', 'rd-backend-scan', 'rd-test-scan', 'rd-contract-scan', 'rd-risk-scan'];
-    const planning = ['rd-frontend-slicer', 'rd-backend-slicer', 'rd-unit-test-slicer', 'rd-contract-planner', 'rd-quality-gate-planner'];
-    const quality = ['rd-code-review-worker', 'rd-security-review-worker', 'rd-typecheck-worker', 'rd-coverage-worker', 'rd-regression-worker'];
+    const discovery = [
+        'rd-frontend-scan',
+        'rd-backend-scan',
+        'rd-test-scan',
+        'rd-contract-scan',
+        'rd-risk-scan'
+    ];
+    const planning = [
+        'rd-frontend-slicer',
+        'rd-backend-slicer',
+        'rd-unit-test-slicer',
+        'rd-contract-planner',
+        'rd-quality-gate-planner'
+    ];
+    const quality = [
+        'rd-code-review-worker',
+        'rd-security-review-worker',
+        'rd-typecheck-worker',
+        'rd-coverage-worker',
+        'rd-regression-worker'
+    ];
     const implementationCount = Math.max(1, target - discovery.length - planning.length - quality.length - 1);
     const implementation = Array.from({ length: implementationCount }, (_, i) => `rd-impl-${String(i + 1).padStart(3, '0')}`);
-    return { discovery, planning, 'implementation candidates': implementation, 'quality gates': quality, reducer: ['rd-reducer-worker'] };
+    return {
+        discovery,
+        planning,
+        'implementation candidates': implementation,
+        'quality gates': quality,
+        reducer: ['rd-reducer-worker']
+    };
 }
 export function planRdSwarmGraph(input) {
     const checked = validate(input);
@@ -63,7 +139,12 @@ export function planRdSwarmGraph(input) {
     if (!checked.ok)
         return failure(common, [checked.error.code], [checked.error.message], { techApprovalRequired: input.requiresTechApproval === true, techStatus: 'unavailable' }, Number.isInteger(requested) && requested > 0 ? Math.min(requested, MAX_WORKERS) : 0);
     if (!Number.isInteger(requested) || requested < 1)
-        return failure({ ...common, goal: checked.value.goal, changeId: checked.value.changeId, artifactRoot: `${checked.value.changeId}/swarm` }, ['INVALID_MAX_WORKERS'], ['Use a positive integer for max-workers.'], { techApprovalRequired: input.requiresTechApproval === true, techStatus: 'unavailable' }, 0);
+        return failure({
+            ...common,
+            goal: checked.value.goal,
+            changeId: checked.value.changeId,
+            artifactRoot: `${checked.value.changeId}/swarm`
+        }, ['INVALID_MAX_WORKERS'], ['Use a positive integer for max-workers.'], { techApprovalRequired: input.requiresTechApproval === true, techStatus: 'unavailable' }, 0);
     const goal = checked.value.goal;
     const changeId = checked.value.changeId;
     const artifactRoot = `${changeId}/swarm`;
@@ -73,21 +154,59 @@ export function planRdSwarmGraph(input) {
         reasons.push('SMALL_SCOPE');
     const required = input.requiresTechApproval === true;
     const techStatus = localTechStatus({ ...input, changeId, goal });
-    const gateStatus = { techApprovalRequired: required, techStatus, ...(required ? {} : { skipReason: 'tech-gate-not-required' }) };
+    const gateStatus = {
+        techApprovalRequired: required,
+        techStatus,
+        ...(required ? {} : { skipReason: 'tech-gate-not-required' })
+    };
     if (required && techStatus !== 'approved') {
         reasons.push('TECH_APPROVAL_REQUIRED');
         if (techStatus === 'missing-approval' || techStatus === 'missing')
             reasons.push('TECH_APPROVAL_MISSING');
     }
     if (reasons.includes('SMALL_SCOPE'))
-        return failure({ changeId, goal, artifactRoot }, reasons, ['Describe the small scope in natural language or increase the worker target to at least 25.'], gateStatus, target);
+        return failure({ changeId, goal, artifactRoot }, reasons, [
+            'Describe the small scope in natural language or increase the worker target to at least 25.'
+        ], gateStatus, target);
     if (required && techStatus !== 'approved')
         return failure({ changeId, goal, artifactRoot }, reasons, ['Review and approve the technical plan before running the RD swarm.'], gateStatus, target);
     const ids = taskIds(target);
-    const waves = Object.entries(ids).map(([name, taskIds]) => ({ name, taskIds }));
-    const dependencies = { discovery: [], planning: ids.discovery, 'implementation candidates': ids.planning, 'quality gates': ids['implementation candidates'], reducer: ids['quality gates'] };
+    const waves = Object.entries(ids).map(([name, taskIds]) => ({
+        name,
+        taskIds
+    }));
+    const dependencies = {
+        discovery: [],
+        planning: ids.discovery,
+        'implementation candidates': ids.planning,
+        'quality gates': ids['implementation candidates'],
+        reducer: ids['quality gates']
+    };
     const tasks = waves.flatMap(({ name, taskIds: waveTaskIds }) => waveTaskIds.map((id, i) => createTask(id, name, goal, dependencies[name], i)));
-    const conflictGroups = waves.map(({ name, taskIds: waveTaskIds }) => ({ groupId: `group-${name.replace(/\s/g, '-')}`, ownedPaths: waveTaskIds.map((id) => `${artifactRoot}/workers/${id}/brief.md`), parallelismPolicy: waveTaskIds.length > 1 ? 'parallel' : 'sequential', reason: `${name} workers have isolated artifact ownership` }));
-    const outputs = { taskGraph: path(input, '<changeId>/swarm/task-graph.json'), waveManifests: waves.map((wave, i) => path(input, `<changeId>/swarm/waves/wave-${i + 1}-${wave.name}.json`)), workerBriefs: tasks.map((task) => path(input, `<changeId>/swarm/${task.outputs[0]}`)), reducerReport: path(input, '<changeId>/swarm/reducer-report.md') };
-    return { changeId, goal, available: true, workerTarget: target, waves, tasks, conflictGroups, artifactRoot, outputs, gateStatus, blockedReasons: reasons, nextActions: reasons.includes('WORKER_CAP_EXCEEDED') ? ['Worker target was capped at 40.'] : [] };
+    const conflictGroups = waves.map(({ name, taskIds: waveTaskIds }) => ({
+        groupId: `group-${name.replace(/\s/g, '-')}`,
+        ownedPaths: waveTaskIds.map((id) => `${artifactRoot}/workers/${id}/brief.md`),
+        parallelismPolicy: waveTaskIds.length > 1 ? 'parallel' : 'sequential',
+        reason: `${name} workers have isolated artifact ownership`
+    }));
+    const outputs = {
+        taskGraph: path(input, '<changeId>/swarm/task-graph.json'),
+        waveManifests: waves.map((wave, i) => path(input, `<changeId>/swarm/waves/wave-${i + 1}-${wave.name}.json`)),
+        workerBriefs: tasks.map((task) => path(input, `<changeId>/swarm/${task.outputs[0]}`)),
+        reducerReport: path(input, '<changeId>/swarm/reducer-report.md')
+    };
+    return {
+        changeId,
+        goal,
+        available: true,
+        workerTarget: target,
+        waves,
+        tasks,
+        conflictGroups,
+        artifactRoot,
+        outputs,
+        gateStatus,
+        blockedReasons: reasons,
+        nextActions: reasons.includes('WORKER_CAP_EXCEEDED') ? ['Worker target was capped at 40.'] : []
+    };
 }

package/dist/services/rd-swarm/rd-swarm-types.d.ts

@@ -0,0 +1,54 @@
+/**
+ * rd-swarm-types — the pure declaration surface of the RD swarm dry-run
+ * planner (`rd-swarm-service.ts`).
+ *
+ * Slice rid-013 owns the planner behavior; this module owns only the graph
+ * shapes (wave names, task records, conflict groups, and the task-graph
+ * envelope). `rd-swarm-service.ts` imports and re-exports every name here, so
+ * importers keep resolving them from the original path.
+ */
+export type RdWaveName = 'discovery' | 'planning' | 'implementation candidates' | 'quality gates' | 'reducer';
+export type RdTask = {
+    taskId: string;
+    wave: RdWaveName;
+    workerKind: string;
+    purpose: string;
+    inputs: string[];
+    outputs: [string, ...string[]];
+    dependsOn: string[];
+    conflictGroup: string;
+    targetArea: string;
+    expectedEvidence: string;
+};
+export type RdConflictGroup = {
+    groupId: string;
+    ownedPaths: string[];
+    parallelismPolicy: 'parallel' | 'sequential';
+    reason: string;
+};
+export type RdTaskGraph = {
+    changeId: string;
+    goal: string;
+    available: boolean;
+    workerTarget: number;
+    waves: Array<{
+        name: RdWaveName;
+        taskIds: string[];
+    }>;
+    tasks: RdTask[];
+    conflictGroups: RdConflictGroup[];
+    artifactRoot: string;
+    outputs: {
+        taskGraph: string;
+        waveManifests: string[];
+        workerBriefs: string[];
+        reducerReport: string;
+    };
+    gateStatus: {
+        techApprovalRequired: boolean;
+        techStatus: string;
+        skipReason?: string;
+    };
+    blockedReasons: string[];
+    nextActions: string[];
+};

package/dist/services/rd-swarm/rd-swarm-types.js

@@ -0,0 +1,10 @@
+/**
+ * rd-swarm-types — the pure declaration surface of the RD swarm dry-run
+ * planner (`rd-swarm-service.ts`).
+ *
+ * Slice rid-013 owns the planner behavior; this module owns only the graph
+ * shapes (wave names, task records, conflict groups, and the task-graph
+ * envelope). `rd-swarm-service.ts` imports and re-exports every name here, so
+ * importers keep resolving them from the original path.
+ */
+export {};

package/dist/services/recommendations/capability-map-service.js

@@ -50,9 +50,17 @@ function normalizeProxyUrl(value) {
         return undefined;
     try {
         const url = new URL(value);
-        return (url.protocol === 'http:' || url.protocol === 'https:') && url.username.length === 0 && url.password.length === 0 && url.pathname === '/' && url.search.length === 0 && url.hash.length === 0 ? value : undefined;
+        return (url.protocol === 'http:' || url.protocol === 'https:') &&
+            url.username.length === 0 &&
+            url.password.length === 0 &&
+            url.pathname === '/' &&
+            url.search.length === 0 &&
+            url.hash.length === 0
+            ? value
+            : undefined;
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return undefined;
     }
 }

package/dist/services/recommendations/capability-seed-items.js

@@ -10,8 +10,18 @@ export const seedCapabilityItems = [
         riskLevel: 'low',
         inputContract: 'git-diff or changed-file summary',
         outputContract: 'review-report',
-        fallback: { mode: 'built-in-review-checklist', qualityImpact: 'lower', nextAction: 'Use Peaks built-in code review checklist if the external agent is unavailable.' },
-        presentation: { displayName: { en: 'Code Review Agent', 'zh-CN': '代码评审代理' }, description: { en: 'Reviews code changes for quality, maintainability, tests, and risks.', 'zh-CN': '用于在代码改动后检查质量、可维护性、测试和风险。' } }
+        fallback: {
+            mode: 'built-in-review-checklist',
+            qualityImpact: 'lower',
+            nextAction: 'Use Peaks built-in code review checklist if the external agent is unavailable.'
+        },
+        presentation: {
+            displayName: { en: 'Code Review Agent', 'zh-CN': '代码评审代理' },
+            description: {
+                en: 'Reviews code changes for quality, maintainability, tests, and risks.',
+                'zh-CN': '用于在代码改动后检查质量、可维护性、测试和风险。'
+            }
+        }
     },
     {
         capabilityId: 'everything-claude-code.security-review-agent',
@@ -24,8 +34,18 @@ export const seedCapabilityItems = [
         riskLevel: 'medium',
         inputContract: 'git-diff or changed-file summary',
         outputContract: 'security-review-report',
-        fallback: { mode: 'built-in-security-checklist', qualityImpact: 'lower', nextAction: 'Use Peaks built-in security checklist if the external agent is unavailable.' },
-        presentation: { displayName: { en: 'Security Review Agent', 'zh-CN': '安全评审代理' }, description: { en: 'Checks auth, user input, filesystem, external calls, and secret-handling risks.', 'zh-CN': '检查认证、用户输入、文件系统、外部调用和密钥处理风险。' } }
+        fallback: {
+            mode: 'built-in-security-checklist',
+            qualityImpact: 'lower',
+            nextAction: 'Use Peaks built-in security checklist if the external agent is unavailable.'
+        },
+        presentation: {
+            displayName: { en: 'Security Review Agent', 'zh-CN': '安全评审代理' },
+            description: {
+                en: 'Checks auth, user input, filesystem, external calls, and secret-handling risks.',
+                'zh-CN': '检查认证、用户输入、文件系统、外部调用和密钥处理风险。'
+            }
+        }
     },
     {
         capabilityId: 'everything-claude-code.language-standards',
@@ -38,8 +58,18 @@ export const seedCapabilityItems = [
         riskLevel: 'low',
         inputContract: 'project-language and existing project standards',
         outputContract: 'project-local rules baseline',
-        fallback: { mode: 'peaks-built-in-standards', qualityImpact: 'same', nextAction: 'Use Peaks curated baseline and preserve existing project conventions.' },
-        presentation: { displayName: { en: 'Language Coding Standards', 'zh-CN': '语言编码规范' }, description: { en: 'Provides language coding standards for project-local Peaks rules.', 'zh-CN': '为项目内 Peaks 规则提供语言编码规范来源。' } }
+        fallback: {
+            mode: 'peaks-built-in-standards',
+            qualityImpact: 'same',
+            nextAction: 'Use Peaks curated baseline and preserve existing project conventions.'
+        },
+        presentation: {
+            displayName: { en: 'Language Coding Standards', 'zh-CN': '语言编码规范' },
+            description: {
+                en: 'Provides language coding standards for project-local Peaks rules.',
+                'zh-CN': '为项目内 Peaks 规则提供语言编码规范来源。'
+            }
+        }
     },
     {
         capabilityId: 'everything-claude-code.code-review-guidance',
@@ -52,8 +82,18 @@ export const seedCapabilityItems = [
         riskLevel: 'low',
         inputContract: 'project-local diff and test evidence',
         outputContract: 'code-review rules baseline',
-        fallback: { mode: 'peaks-built-in-review-checklist', qualityImpact: 'same', nextAction: 'Use Peaks curated code review baseline if the external source is unavailable.' },
-        presentation: { displayName: { en: 'Code Review Guidance', 'zh-CN': '代码评审指导' }, description: { en: 'Provides review guidance for project-local Peaks rules and QA preflight.', 'zh-CN': '为项目内 Peaks 规则和 QA preflight 提供代码评审指导。' } }
+        fallback: {
+            mode: 'peaks-built-in-review-checklist',
+            qualityImpact: 'same',
+            nextAction: 'Use Peaks curated code review baseline if the external source is unavailable.'
+        },
+        presentation: {
+            displayName: { en: 'Code Review Guidance', 'zh-CN': '代码评审指导' },
+            description: {
+                en: 'Provides review guidance for project-local Peaks rules and QA preflight.',
+                'zh-CN': '为项目内 Peaks 规则和 QA preflight 提供代码评审指导。'
+            }
+        }
     },
     {
         capabilityId: 'everything-claude-code.security-review-guidance',
@@ -66,8 +106,18 @@ export const seedCapabilityItems = [
         riskLevel: 'low',
         inputContract: 'project-local diff and sensitive-boundary summary',
         outputContract: 'security-review rules baseline',
-        fallback: { mode: 'peaks-built-in-security-checklist', qualityImpact: 'same', nextAction: 'Use Peaks curated security baseline if the external source is unavailable.' },
-        presentation: { displayName: { en: 'Security Review Guidance', 'zh-CN': '安全评审指导' }, description: { en: 'Provides security review guidance for project-local Peaks rules and QA preflight.', 'zh-CN': '为项目内 Peaks 规则和 QA preflight 提供安全评审指导。' } }
+        fallback: {
+            mode: 'peaks-built-in-security-checklist',
+            qualityImpact: 'same',
+            nextAction: 'Use Peaks curated security baseline if the external source is unavailable.'
+        },
+        presentation: {
+            displayName: { en: 'Security Review Guidance', 'zh-CN': '安全评审指导' },
+            description: {
+                en: 'Provides security review guidance for project-local Peaks rules and QA preflight.',
+                'zh-CN': '为项目内 Peaks 规则和 QA preflight 提供安全评审指导。'
+            }
+        }
     },
     {
         capabilityId: 'context7.docs-lookup',
@@ -80,8 +130,18 @@ export const seedCapabilityItems = [
         riskLevel: 'low',
         inputContract: 'library or API documentation request',
         outputContract: 'documentation-summary',
-        fallback: { mode: 'manual-docs-input', qualityImpact: 'lower', nextAction: 'Ask the user to provide the relevant documentation link or pasted excerpt.' },
-        presentation: { displayName: { en: 'Documentation Lookup', 'zh-CN': '文档查询能力' }, description: { en: 'Fetches current library and API documentation for implementation planning.', 'zh-CN': '用于获取当前库和 API 文档，辅助实现规划。' } }
+        fallback: {
+            mode: 'manual-docs-input',
+            qualityImpact: 'lower',
+            nextAction: 'Ask the user to provide the relevant documentation link or pasted excerpt.'
+        },
+        presentation: {
+            displayName: { en: 'Documentation Lookup', 'zh-CN': '文档查询能力' },
+            description: {
+                en: 'Fetches current library and API documentation for implementation planning.',
+                'zh-CN': '用于获取当前库和 API 文档，辅助实现规划。'
+            }
+        }
     },
     capability('codegraph.project-indexing', 'codegraph', 'Codegraph Project Indexing', 'cli', 'project-analysis', ['engineer'], 'medium', 'peaks-rd-local-scan', 'Use Peaks RD local project scanning when codegraph is unavailable.', 'Codegraph Project Indexing', 'Codegraph 项目索引', 'Indexes a local project through the peaks codegraph execution boundary for role-skill analysis.', '通过 peaks codegraph 执行边界索引本地项目，辅助角色 skill 分析。'),
     capability('codegraph.semantic-query', 'codegraph', 'Codegraph Semantic Query', 'cli', 'project-analysis', ['engineer'], 'medium', 'peaks-rd-local-scan', 'Use local Grep/Glob and RD scanning when codegraph semantic query is unavailable.', 'Codegraph Semantic Query', 'Codegraph 语义查询', 'Queries local symbols and project relationships for RD planning evidence.', '查询本地符号和项目关系，为 RD 规划提供证据。'),
@@ -132,7 +192,14 @@ function capability(capabilityId, sourceId, name, itemType, category, audience,
         workflows: ['capability-map'],
         audience,
         riskLevel,
-        fallback: { mode: fallbackMode, qualityImpact: fallbackMode.startsWith('peaks-') ? 'same' : 'lower', nextAction },
-        presentation: { displayName: { en: displayNameEn, 'zh-CN': displayNameZh }, description: { en: descriptionEn, 'zh-CN': descriptionZh } }
+        fallback: {
+            mode: fallbackMode,
+            qualityImpact: fallbackMode.startsWith('peaks-') ? 'same' : 'lower',
+            nextAction
+        },
+        presentation: {
+            displayName: { en: displayNameEn, 'zh-CN': displayNameZh },
+            description: { en: descriptionEn, 'zh-CN': descriptionZh }
+        }
     };
 }