peaks-loop 4.0.54 → 4.1.1

package/dist/cli/commands/worktree-auth-manage-commands.js

@@ -0,0 +1,128 @@
+/**
+ * `peaks worktree reconcile-host` + `peaks worktree auth revoke|status`
+ * — slice 2026-07-27-worktree-user-auth.
+ *
+ * Extracted from `worktree-auth-commands.ts` to keep that file under the
+ * raw-line cap (mechanical verbatim move; validation and presentation
+ * helpers only). Every decision point — the HOST_WORKTREE_RECONCILE_FAILED
+ * (exit 1 / unmanaged-entries exit 1), REVOKE_FAILED (exit 1) and the
+ * status FILE_INVALID (exit 1) / empty-grants (exit 0) / grants-listed
+ * (exit 0) / STATUS_FAILED (exit 1) outcomes — is preserved in the
+ * original order with the same emitted text.
+ */
+import { fail, ok } from 'peaks-loop-shared/result';
+import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+import { clearAllGrants, readAuthorization } from '../../services/hooks/worktree-authorization-gate.js';
+import { reconcileHostWorktrees } from '../../services/worktree/host-worktree-reconciler.js';
+import { resolveProjectRoot, resolveSessionId } from './worktree-lease-commands.js';
+export function registerWorktreeAuthReconcileCommand(auth, io) {
+    addJsonOption(auth
+        .command('reconcile-host')
+        .description('Read-only reconciliation of host-created .claude/worktrees/agent-* against the canonical Peaks lease store.')
+        .option('--session <sid>', 'override session id')
+        .option('--project <path>', 'project root (default: findProjectRoot(cwd))')
+        .option('--host-root <path>', 'override host worktree root')).action((options) => {
+        const projectRoot = resolveProjectRoot(options);
+        const sessionId = resolveSessionId(options, projectRoot);
+        try {
+            const result = reconcileHostWorktrees({
+                projectRoot,
+                sessionId,
+                ...(options.hostRoot !== undefined ? { hostRoot: options.hostRoot } : {})
+            });
+            const warnings = result.unmanaged.length > 0
+                ? [`${result.unmanaged.length} host worktree(s) are outside Peaks lease governance.`]
+                : [];
+            printResult(io, ok('worktree.reconcile-host', { ...result, sessionId, projectRoot }, warnings), options.json);
+            if (result.unmanaged.length > 0)
+                process.exitCode = 1;
+        }
+        catch (error) {
+            printResult(io, fail('worktree.reconcile-host', 'HOST_WORKTREE_RECONCILE_FAILED', getErrorMessage(error), { sessionId, projectRoot }, []), options.json);
+            process.exitCode = 1;
+        }
+    });
+}
+export function registerWorktreeAuthRevokeCommand(auth, io) {
+    addJsonOption(auth
+        .command('revoke')
+        .description('Remove all unconsumed grants for the current session.')
+        .option('--session <sid>', 'override session id (default: read .peaks/_runtime/session.json)')
+        .option('--project <path>', 'project root (default: findProjectRoot(cwd))')).action((options) => {
+        try {
+            const projectRoot = resolveProjectRoot(options);
+            const sessionId = resolveSessionId(options, projectRoot);
+            const result = clearAllGrants(projectRoot, sessionId);
+            printResult(io, ok('worktree.auth.revoke', { sessionId, projectRoot, ...result }, [], [
+                result.removed > 0
+                    ? `Cleared ${result.removed} grant(s). The PreToolUse gate now fail-closes again.`
+                    : 'No grants to clear. The gate is already fail-closed.'
+            ]), options.json);
+        }
+        catch (error) {
+            printResult(io, fail('worktree.auth.revoke', 'REVOKE_FAILED', getErrorMessage(error), {}, [
+                'Re-run after fixing the failure (see cause in the error message).'
+            ]), options.json);
+            process.exitCode = 1;
+        }
+    });
+}
+function printStatusFileInvalid(io, options, sessionId, error) {
+    printResult(io, fail('worktree.auth.status', 'FILE_INVALID', getErrorMessage(error), { sessionId }, [
+        'Delete the malformed worktree-auth.json and re-grant.',
+        'For security, the gate never fails open on a malformed grant file.'
+    ]), options.json);
+}
+function printStatusNoGrants(io, options, sessionId, projectRoot) {
+    printResult(io, ok('worktree.auth.status', { sessionId, projectRoot, grants: [], file: null }, [], ['No grants on file. The PreToolUse gate will fail-close on worktree-mutating tool calls.']), options.json);
+}
+function printStatusFailed(io, options, error) {
+    printResult(io, fail('worktree.auth.status', 'STATUS_FAILED', getErrorMessage(error), {}, [
+        'Re-run after fixing the failure (see cause in the error message).'
+    ]), options.json);
+}
+function runStatusAction(io, options) {
+    try {
+        const projectRoot = resolveProjectRoot(options);
+        const sessionId = resolveSessionId(options, projectRoot);
+        let file;
+        try {
+            file = readAuthorization(projectRoot, sessionId);
+        }
+        catch (error) {
+            printStatusFileInvalid(io, options, sessionId, error);
+            process.exitCode = 1;
+            return;
+        }
+        if (file === null) {
+            printStatusNoGrants(io, options, sessionId, projectRoot);
+            return;
+        }
+        const now = Date.now();
+        const live = file.grants.map((g) => ({
+            ...g,
+            expired: Date.parse(g.expiresAt) <= now
+        }));
+        printResult(io, ok('worktree.auth.status', {
+            sessionId,
+            projectRoot,
+            file: '.peaks/_runtime/' + sessionId + '/worktree-auth.json',
+            grants: live
+        }, [], [
+            `${file.grants.length} grant(s) recorded. ${live.filter((g) => !g.expired).length} still valid.`
+        ]), options.json);
+    }
+    catch (error) {
+        printStatusFailed(io, options, error);
+        process.exitCode = 1;
+    }
+}
+export function registerWorktreeAuthStatusCommand(auth, io) {
+    addJsonOption(auth
+        .command('status')
+        .description("Inspect the current session's worktree-authorization file (granted operations + expiry).")
+        .option('--session <sid>', 'override session id (default: read .peaks/_runtime/session.json)')
+        .option('--project <path>', 'project root (default: findProjectRoot(cwd))')).action((options) => {
+        runStatusAction(io, options);
+    });
+}

package/dist/cli/commands/worktree-lease-commands.d.ts

@@ -10,7 +10,7 @@
  * They coexist with `peaks worktree auth grant|revoke|status` (the L2 hook
  * gate surface) on the shared `peaks worktree` parent command.
  */
-import { Command } from 'commander';
+import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';
 export declare function resolveSessionId(options: {
     session?: string;

package/dist/cli/commands/worktree-lease-commands.js

@@ -16,7 +16,7 @@ import { findProjectRoot } from '../../services/config/config-safety.js';
 import { getCurrentSessionId } from '../../services/skills/skill-presence-service.js';
 import { atomicWriteJson } from '../../services/ide/shared/atomic-json.js';
 import { emitLeaseEvent } from '../../services/observability/observability-service.js';
-import { deserializeLease, finalizeLease, generateLeaseId, isLeaseActive, isLeaseGcEligible, leaseFilePath, leaseStoreDir, listLeasesSync, markExpired, markGc, markReleased, renewLease, ttlForRole, worktreePath, } from '../../services/worktree/worktree-lease.js';
+import { deserializeLease, finalizeLease, generateLeaseId, isLeaseActive, isLeaseGcEligible, leaseFilePath, leaseStoreDir, listLeasesSync, markExpired, markGc, markReleased, renewLease, ttlForRole, worktreePath } from '../../services/worktree/worktree-lease.js';
 import { execSync } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync as readFileSyncNode, statSync } from 'node:fs';
 export function resolveSessionId(options, projectRoot) {
@@ -91,7 +91,12 @@ export function registerWorktreeLeaseCommands(auth, io) {
             // and authorize this very `git worktree add`; for Part 1 we still
             // require a current `peaks worktree auth grant` token to remain
             // consistent with the slice-027 hard gate contract.
-            execSync(`git worktree add "${wtPath}" -b "${branch}"`, { cwd: projectRoot, stdio: 'pipe', encoding: 'utf8', windowsHide: true });
+            execSync(`git worktree add "${wtPath}" -b "${branch}"`, {
+                cwd: projectRoot,
+                stdio: 'pipe',
+                encoding: 'utf8',
+                windowsHide: true
+            });
             atomicWriteJson(leaseFilePath(joinPathSession(projectRoot, sessionId), leaseId), lease);
             // Part 4.A: emit spawn metric (fire-and-forget; never blocks).
             emitLeaseEvent({
@@ -167,7 +172,12 @@ export function registerWorktreeLeaseCommands(auth, io) {
             // released.
             let gitWorktreeRemoveFailed = false;
             try {
-                execSync(`git worktree remove --force "${lease.path}"`, { cwd: projectRoot, stdio: 'pipe', encoding: 'utf8', windowsHide: true });
+                execSync(`git worktree remove --force "${lease.path}"`, {
+                    cwd: projectRoot,
+                    stdio: 'pipe',
+                    encoding: 'utf8',
+                    windowsHide: true
+                });
             }
             catch {
                 gitWorktreeRemoveFailed = true;
@@ -184,7 +194,11 @@ export function registerWorktreeLeaseCommands(auth, io) {
                 rid: released.rid,
                 role: released.role
             });
-            printResult(io, ok('worktree.release', { lease: released, sessionId, projectRoot, gitWorktreeRemoveFailed }, gitWorktreeRemoveFailed ? ['git worktree remove failed (likely the path was already pruned); lease marked released.'] : [], [
+            printResult(io, ok('worktree.release', { lease: released, sessionId, projectRoot, gitWorktreeRemoveFailed }, gitWorktreeRemoveFailed
+                ? [
+                    'git worktree remove failed (likely the path was already pruned); lease marked released.'
+                ]
+                : [], [
                 `Lease ${lease.leaseId} marked released.`,
                 gitWorktreeRemoveFailed
                     ? 'Manual `git worktree prune` may be needed.'
@@ -192,16 +206,13 @@ export function registerWorktreeLeaseCommands(auth, io) {
             ]), options.json);
         }
         catch (error) {
-            printResult(io, fail('worktree.release', 'RELEASE_FAILED', getErrorMessage(error), { leaseId: options.leaseId, sessionId }, [
-                'Verify the lease id and re-run.',
-                'If the lease was never spawned, no-op.'
-            ]), options.json);
+            printResult(io, fail('worktree.release', 'RELEASE_FAILED', getErrorMessage(error), { leaseId: options.leaseId, sessionId }, ['Verify the lease id and re-run.', 'If the lease was never spawned, no-op.']), options.json);
             process.exitCode = 1;
         }
     });
     addJsonOption(auth
         .command('renew')
-        .description('Extend an active lease\'s `expiresAt` and persist it. Idempotent for already-active leases. ' +
+        .description("Extend an active lease's `expiresAt` and persist it. Idempotent for already-active leases. " +
         'Default TTL uses `DEFAULT_TTL_BY_ROLE[<lease.role>]`; pass --ttl <ms> to override.')
         .requiredOption('--lease-id <id>', 'lease id returned by `peaks worktree spawn`')
         .option('--ttl <ms>', 'time-to-live in ms from now (default: role-default)')
@@ -242,9 +253,7 @@ export function registerWorktreeLeaseCommands(auth, io) {
             const now = Date.now();
             const ttlMs = options.ttl === undefined ? ttlForRole(lease.role) : Number.parseInt(options.ttl, 10);
             if (!Number.isInteger(ttlMs) || ttlMs <= 0) {
-                printResult(io, fail('worktree.renew', 'INVALID_TTL', '--ttl must be a positive integer (ms)', { ttl: options.ttl }, [
-                    'Re-run with --ttl 1800000 (30 min) or omit to use role default.'
-                ]), options.json);
+                printResult(io, fail('worktree.renew', 'INVALID_TTL', '--ttl must be a positive integer (ms)', { ttl: options.ttl }, ['Re-run with --ttl 1800000 (30 min) or omit to use role default.']), options.json);
                 process.exitCode = 1;
                 return;
             }
@@ -266,15 +275,13 @@ export function registerWorktreeLeaseCommands(auth, io) {
             ]), options.json);
         }
         catch (err) {
-            printResult(io, fail('worktree.renew', 'RENEW_FAILED', getErrorMessage(err), { leaseId: options.leaseId, sessionId }, [
-                'Re-run after fixing the failure (see cause in the error message).'
-            ]), options.json);
+            printResult(io, fail('worktree.renew', 'RENEW_FAILED', getErrorMessage(err), { leaseId: options.leaseId, sessionId }, ['Re-run after fixing the failure (see cause in the error message).']), options.json);
             process.exitCode = 1;
         }
     });
     addJsonOption(auth
         .command('list')
-        .description('List every lease under the current session\'s lease store. ' +
+        .description("List every lease under the current session's lease store. " +
         'Optionally filter by --status (active|released|expired|gc) and/or --expired-only. ' +
         'Leases past their expiresAt with status=active are still listed under "active" by default ' +
         '(`isLeaseActive` returns false for them, but the on-disk status only flips to "expired" ' +
@@ -324,7 +331,9 @@ export function registerWorktreeLeaseCommands(auth, io) {
                 leases: filtered
             }, result.errors.map((e) => `Malformed lease: ${e.file} (${e.error})`), [
                 `${filtered.length} lease(s) matched (${result.leases.length} on disk).`,
-                result.errors.length > 0 ? 'Some lease files were malformed — see errors[]; they were skipped.' : ''
+                result.errors.length > 0
+                    ? 'Some lease files were malformed — see errors[]; they were skipped.'
+                    : ''
             ].filter(Boolean)), options.json);
         }
         catch (err) {
@@ -336,13 +345,13 @@ export function registerWorktreeLeaseCommands(auth, io) {
     });
     addJsonOption(auth
         .command('gc')
-        .description('Sweep released/expired leases: remove their git worktree (if still attached), prune git\'s ' +
+        .description("Sweep released/expired leases: remove their git worktree (if still attached), prune git's " +
         'worktree references, and mark the lease as "gc". With --lease-id <id>, only that lease is ' +
-        'considered. With --dry-run, report what would be gc\'d without mutating. Expired-active ' +
+        "considered. With --dry-run, report what would be gc'd without mutating. Expired-active " +
         'leases (status=active but past expiresAt) are eligible — they are first marked "expired" ' +
         'then their worktree is removed.')
         .option('--lease-id <id>', 'only consider this specific lease')
-        .option('--dry-run', 'report what would be gc\'d without mutating')
+        .option('--dry-run', "report what would be gc'd without mutating")
         .option('--session <sid>', 'override session id')
         .option('--project <path>', 'project root (default: findProjectRoot(cwd))')).action((options) => {
         const projectRoot = resolveProjectRoot(options);
@@ -355,9 +364,7 @@ export function registerWorktreeLeaseCommands(auth, io) {
                 existsSync: (p) => existsSync(p)
             });
             if (result.kind === 'store-missing') {
-                printResult(io, ok('worktree.gc', { sessionId, projectRoot, swept: 0, storeMissing: true }, [], [
-                    `No lease store at ${storeDir}; nothing to gc.`
-                ]), options.json);
+                printResult(io, ok('worktree.gc', { sessionId, projectRoot, swept: 0, storeMissing: true }, [], [`No lease store at ${storeDir}; nothing to gc.`]), options.json);
                 return;
             }
             const now = Date.now();
@@ -379,14 +386,24 @@ export function registerWorktreeLeaseCommands(auth, io) {
                     // already gone we still mark the lease gc.
                     let gitWorktreeRemoveFailed = false;
                     try {
-                        execSync(`git worktree remove --force "${updated.path}"`, { cwd: projectRoot, stdio: 'pipe', encoding: 'utf8', windowsHide: true });
+                        execSync(`git worktree remove --force "${updated.path}"`, {
+                            cwd: projectRoot,
+                            stdio: 'pipe',
+                            encoding: 'utf8',
+                            windowsHide: true
+                        });
                     }
                     catch {
                         gitWorktreeRemoveFailed = true;
                     }
                     // `git worktree prune` clears any stale admin entries. Best-effort.
                     try {
-                        execSync('git worktree prune', { cwd: projectRoot, stdio: 'pipe', encoding: 'utf8', windowsHide: true });
+                        execSync('git worktree prune', {
+                            cwd: projectRoot,
+                            stdio: 'pipe',
+                            encoding: 'utf8',
+                            windowsHide: true
+                        });
                     }
                     catch {
                         // ignore — prune is idempotent
@@ -402,13 +419,30 @@ export function registerWorktreeLeaseCommands(auth, io) {
                         rid: lease.rid,
                         role: lease.role
                     });
-                    swept.push({ leaseId: lease.leaseId, path: lease.path, prevStatus, gitWorktreeRemoveFailed });
+                    swept.push({
+                        leaseId: lease.leaseId,
+                        path: lease.path,
+                        prevStatus,
+                        gitWorktreeRemoveFailed
+                    });
                 }
                 else {
-                    swept.push({ leaseId: lease.leaseId, path: lease.path, prevStatus, gitWorktreeRemoveFailed: false });
+                    swept.push({
+                        leaseId: lease.leaseId,
+                        path: lease.path,
+                        prevStatus,
+                        gitWorktreeRemoveFailed: false
+                    });
                 }
             }
-            printResult(io, ok('worktree.gc', { sessionId, projectRoot, dryRun, candidates: candidates.length, swept, errors: result.errors }, result.errors.map((e) => `Malformed lease: ${e.file} (${e.error})`), [
+            printResult(io, ok('worktree.gc', {
+                sessionId,
+                projectRoot,
+                dryRun,
+                candidates: candidates.length,
+                swept,
+                errors: result.errors
+            }, result.errors.map((e) => `Malformed lease: ${e.file} (${e.error})`), [
                 dryRun
                     ? `[dry-run] Would gc ${swept.length} lease(s); no filesystem changes were made.`
                     : `Gc'd ${swept.length} lease(s).`,
@@ -435,9 +469,7 @@ export function registerWorktreeLeaseCommands(auth, io) {
         try {
             const file = leaseFilePath(joinPathSession(projectRoot, sessionId), options.leaseId);
             if (!existsSync(file)) {
-                printResult(io, fail('worktree.lease-status', 'LEASE_NOT_FOUND', `no lease on disk at ${file}`, { leaseId: options.leaseId, file }, [
-                    'Run `peaks worktree list` to inspect available leases.'
-                ]), options.json);
+                printResult(io, fail('worktree.lease-status', 'LEASE_NOT_FOUND', `no lease on disk at ${file}`, { leaseId: options.leaseId, file }, ['Run `peaks worktree list` to inspect available leases.']), options.json);
                 process.exitCode = 1;
                 return;
             }
@@ -446,9 +478,7 @@ export function registerWorktreeLeaseCommands(auth, io) {
                 lease = deserializeLease(readFileSyncNode(file, 'utf8'));
             }
             catch (err) {
-                printResult(io, fail('worktree.lease-status', 'LEASE_FILE_INVALID', getErrorMessage(err), { leaseId: options.leaseId, file }, [
-                    'Delete the malformed lease file manually and re-spawn.'
-                ]), options.json);
+                printResult(io, fail('worktree.lease-status', 'LEASE_FILE_INVALID', getErrorMessage(err), { leaseId: options.leaseId, file }, ['Delete the malformed lease file manually and re-spawn.']), options.json);
                 process.exitCode = 1;
                 return;
             }
@@ -482,9 +512,7 @@ export function registerWorktreeLeaseCommands(auth, io) {
             ]), options.json);
         }
         catch (err) {
-            printResult(io, fail('worktree.lease-status', 'STATUS_FAILED', getErrorMessage(err), { leaseId: options.leaseId, sessionId }, [
-                'Re-run after fixing the failure (see cause in the error message).'
-            ]), options.json);
+            printResult(io, fail('worktree.lease-status', 'STATUS_FAILED', getErrorMessage(err), { leaseId: options.leaseId, sessionId }, ['Re-run after fixing the failure (see cause in the error message).']), options.json);
             process.exitCode = 1;
         }
     });

package/dist/cli/index.js

@@ -66,13 +66,17 @@ program.parseAsync(process.argv).catch((error) => {
             printMissingRequiredOptionEnvelope(defaultIo, resolveInvokedCommandPath(program, argv), getErrorMessage(error));
             return;
         }
-        if (error.code === 'commander.missingArgument' || error.code === 'commander.unknownCommand' || error.code === 'commander.unknownOption') {
+        if (error.code === 'commander.missingArgument' ||
+            error.code === 'commander.unknownCommand' ||
+            error.code === 'commander.unknownOption') {
             // Emit a `COMMAND_NOT_FOUND` JSON envelope for the unknown-command
             // path. The error text already went to stderr via Commander's
             // default handler; we add a structured envelope for LLM-side
             // consumers (Human-NL-Choice-Only: don't tell the human to type
             // a CLI verb — say what the LLM can coordinate).
-            printErrorEnvelope(defaultIo, 'cli', 'COMMAND_NOT_FOUND', getErrorMessage(error), {}, ['Run `peaks --help` to list available commands.']);
+            printErrorEnvelope(defaultIo, 'cli', 'COMMAND_NOT_FOUND', getErrorMessage(error), {}, [
+                'Run `peaks --help` to list available commands.'
+            ]);
             process.exitCode = 1;
             return;
         }

package/dist/cli/program.js

@@ -18,7 +18,7 @@ import { registerSopCommands } from './commands/sop-commands.js';
 import { registerSkillVisibilityCommand } from './commands/skill-visibility.js';
 import { registerPrimerCommand } from './commands/primer-command.js';
 import { registerReinjectCommand } from './commands/reinject-command.js';
-import { applyRetention, cleanupEccCache } from '../services/log/retention.js';
+import { applyRetention } from '../services/log/retention.js';
 import { writeLogEntry, maybeWriteStderr } from '../services/log/logger.js';
 import { printSuperCommandCatalog } from './cli-helpers.js';
 export { printErrorEnvelope, printResult } from './cli-helpers.js';
@@ -53,16 +53,13 @@ function bootstrapLogger(verbose) {
     try {
         applyRetention({ retentionDays: 7 });
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         /* best-effort retention sweep; never block the CLI */
     }
-    // Slice 3 (on-demand-ecc): 7-day TTL sweep over ecc-<sha>/ cache dirs.
-    try {
-        cleanupEccCache({ retentionDays: 7, nowMs: Date.now() });
-    }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-        /* best-effort ECC retention sweep; never block the CLI */
-    }
+    // The ECC cache sweep that used to sit here is gone with the cache: ECC comes
+    // from the `ecc-universal` dependency, whose files expire when npm removes the
+    // package, not on a peaks-loop TTL.
     const dateOverride = process.env.PEAKS_LOG_DATE_OVERRIDE;
     const entry = {
         ts: new Date().toISOString(),
@@ -74,7 +71,8 @@ function bootstrapLogger(verbose) {
     try {
         writeLogEntry(entry, dateOverride !== undefined ? { dateOverride } : {});
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         /* best-effort */
     }
     if (verbose || process.env.PEAKS_LOG_LEVEL === 'debug') {

package/dist/hooks/pre-tool-use-sub-agent.js

@@ -54,12 +54,7 @@ export function readPromptSizeFromHookStdin(stdin) {
  * (e.g. a shell script that wraps the peaks CLI).
  */
 export function runHookGuardSubprocess(prompt) {
-    const result = spawnSync('node', [
-        process.argv[1] ?? 'peaks',
-        'sub-agent-dispatch-guard',
-        '--prompt', prompt,
-        '--json'
-    ], { encoding: 'utf8', windowsHide: true });
+    const result = spawnSync('node', [process.argv[1] ?? 'peaks', 'sub-agent-dispatch-guard', '--prompt', prompt, '--json'], { encoding: 'utf8', windowsHide: true });
     if (result.status !== 0) {
         // Fallback: allow (don't block the dispatch on a guard subprocess failure).
         return {

package/dist/reporters/bdd-reporter.js

@@ -108,18 +108,24 @@ function basename(path) {
  */
 function collectScenarios(entity, file, out) {
     const visited = new WeakSet();
+    const asWalkable = (node) => {
+        const obj = node;
+        return obj;
+    };
     const walk = (node, scenarioLabel) => {
         if (node === null || typeof node !== 'object')
             return;
         if (visited.has(node))
             return;
         visited.add(node);
-        const obj = node;
+        const obj = asWalkable(node);
         if (obj.type === 'test') {
             const tc = node;
             const result = tc.result ? tc.result() : undefined;
             const resultObj = (result ?? {});
-            const state = (resultObj.state === 'passed' || resultObj.state === 'failed' || resultObj.state === 'skipped')
+            const state = resultObj.state === 'passed' ||
+                resultObj.state === 'failed' ||
+                resultObj.state === 'skipped'
                 ? resultObj.state
                 : 'skipped';
             const err = resultObj.state === 'failed' && resultObj.errors && resultObj.errors[0]
@@ -129,7 +135,7 @@ function collectScenarios(entity, file, out) {
                 scenario: scenarioLabel,
                 title: tc.name,
                 state,
-                error: err,
+                error: err
             });
             return;
         }

package/dist/services/24h-mode/auto-engage.d.ts

@@ -37,3 +37,22 @@ export declare function applyAutoEngagePresenceMode(input: {
     /** Defaults to `24h`; any other value is refused. */
     mode?: string;
 }): AutoEngagePresenceResult;
+/**
+ * Turn a presence-mode stamp result into envelope-level `warnings` /
+ * `nextActions`, so a `{ applied: false }` is SEEN rather than merely
+ * present in `data`.
+ *
+ * Slice H3 (rid=h3-24h-threshold-not-wired): `no-in-flight-lease` is
+ * the common case in practice — entering `24H_ACTIVE` before any skill
+ * workflow has a lease — and it used to be reported only inside
+ * `data.presenceMode`, where nothing read it. The user then believed
+ * the 24h thresholds were in force while the profile still resolved to
+ * `standard`.
+ *
+ * `nextActions` address the LLM driver (it runs the CLI on the user's
+ * behalf); they never ask the user to type a verb.
+ */
+export declare function presenceModeAdvisory(result: AutoEngagePresenceResult): {
+    readonly warnings: readonly string[];
+    readonly nextActions: readonly string[];
+};

package/dist/services/24h-mode/auto-engage.js

@@ -44,3 +44,38 @@ export function applyAutoEngagePresenceMode(input) {
     }
     return { applied: true, mode: AUTO_ENGAGE_PRESENCE_MODE, updated };
 }
+/**
+ * Turn a presence-mode stamp result into envelope-level `warnings` /
+ * `nextActions`, so a `{ applied: false }` is SEEN rather than merely
+ * present in `data`.
+ *
+ * Slice H3 (rid=h3-24h-threshold-not-wired): `no-in-flight-lease` is
+ * the common case in practice — entering `24H_ACTIVE` before any skill
+ * workflow has a lease — and it used to be reported only inside
+ * `data.presenceMode`, where nothing read it. The user then believed
+ * the 24h thresholds were in force while the profile still resolved to
+ * `standard`.
+ *
+ * `nextActions` address the LLM driver (it runs the CLI on the user's
+ * behalf); they never ask the user to type a verb.
+ */
+export function presenceModeAdvisory(result) {
+    if (result.applied)
+        return { warnings: [], nextActions: [] };
+    if (result.reason === 'no-in-flight-lease') {
+        return {
+            warnings: [
+                'The `24h` presence mode was NOT recorded: no in-flight presence lease to stamp (`no-in-flight-lease`). Auto-compact thresholds are still derived from the 24h state machine, so the 24h (partial) lines apply; the mode gate and statusline will NOT see `24h`.'
+            ],
+            nextActions: [
+                'Do NOT report that the 24h thresholds are inactive — they are active via the 24h state machine. If the mode gate / statusline also need to see `24h`, start the skill workflow first and then re-run `peaks session 24h-mode transition --state 24H_ACTIVE` yourself. Do not ask the user to run it.'
+            ]
+        };
+    }
+    return {
+        warnings: [
+            `The \`24h\` presence mode was NOT recorded (\`${result.reason}\`). Auto-compact thresholds are still derived from the 24h state machine, so the 24h (partial) lines apply; the mode gate and statusline will NOT see \`24h\`.`
+        ],
+        nextActions: []
+    };
+}

package/dist/services/24h-mode/decider.js

@@ -120,7 +120,11 @@ export function checkTriggers(input) {
  *   - all-trigger-resolved
  *   - B3 unresolvable (B3Escalation that the user dismisses)
  */
-export const HANDOFF_EXIT_CONDITIONS = ['user_abort', 'all_triggers_resolved', 'b3_unresolvable'];
+export const HANDOFF_EXIT_CONDITIONS = [
+    'user_abort',
+    'all_triggers_resolved',
+    'b3_unresolvable'
+];
 export function isHandoffExitCondition(s) {
     return HANDOFF_EXIT_CONDITIONS.includes(s);
 }

package/dist/services/24h-mode/store.js

@@ -29,10 +29,12 @@ function coerceSnapshot(raw) {
     if (typeof raw['enteredAt'] !== 'string') {
         throw new Error('24H_STATE_INVALID: enteredAt must be an ISO string');
     }
-    if (raw['enteredFrom'] !== null && (typeof raw['enteredFrom'] !== 'string' || !isState(raw['enteredFrom']))) {
+    if (raw['enteredFrom'] !== null &&
+        (typeof raw['enteredFrom'] !== 'string' || !isState(raw['enteredFrom']))) {
         throw new Error('24H_STATE_INVALID: enteredFrom must be a State or null');
     }
-    if (!Array.isArray(raw['activeSlices']) || !raw['activeSlices'].every((s) => typeof s === 'string')) {
+    if (!Array.isArray(raw['activeSlices']) ||
+        !raw['activeSlices'].every((s) => typeof s === 'string')) {
         throw new Error('24H_STATE_INVALID: activeSlices must be string[]');
     }
     if (typeof raw['monotonicGuards'] !== 'number' || !Number.isInteger(raw['monotonicGuards'])) {

package/dist/services/adapter/adapter-registry.js

@@ -53,13 +53,24 @@ class ProcessVendorAdapter {
         if (args.force === true)
             argv.push('--force');
         return new Promise((resolveRun) => {
-            const proc = spawn(this.binary, argv, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+            const proc = spawn(this.binary, argv, {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                windowsHide: true
+            });
             let stdout = '';
             let stderr = '';
-            proc.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
-            proc.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+            proc.stdout.on('data', (chunk) => {
+                stdout += chunk.toString('utf8');
+            });
+            proc.stderr.on('data', (chunk) => {
+                stderr += chunk.toString('utf8');
+            });
             proc.on('error', (err) => {
-                resolveRun({ exitCode: 127, stdout, stderr: stderr + (stderr.length > 0 ? '\n' : '') + err.message });
+                resolveRun({
+                    exitCode: 127,
+                    stdout,
+                    stderr: stderr + (stderr.length > 0 ? '\n' : '') + err.message
+                });
             });
             proc.on('close', (code) => {
                 resolveRun({ exitCode: code ?? 0, stdout, stderr });
@@ -178,9 +189,10 @@ function isPersistedRegistry(value) {
         if (typeof a !== 'object' || a === null)
             return false;
         const r = a;
-        return typeof r.id === 'string'
-            && typeof r.displayName === 'string'
-            && typeof r.binary === 'string'
-            && (r.args === undefined || (Array.isArray(r.args) && r.args.every((x) => typeof x === 'string')));
+        return (typeof r.id === 'string' &&
+            typeof r.displayName === 'string' &&
+            typeof r.binary === 'string' &&
+            (r.args === undefined ||
+                (Array.isArray(r.args) && r.args.every((x) => typeof x === 'string'))));
     });
 }

package/dist/services/adapter/adapter.d.ts

@@ -40,11 +40,11 @@ export interface AdapterEnvelope {
     preamble: string;
     refs: {
         path: string;
-        kind: "file" | "dir" | "script";
+        kind: 'file' | 'dir' | 'script';
     }[];
 }
 export interface Adapter {
-    readonly name: "claude" | "codex" | "copilot" | "auto";
+    readonly name: 'claude' | 'codex' | 'copilot' | 'auto';
     resolveScratchDir(beeName: string): Promise<string>;
     materialize(beeName: string, env: AdapterEnvelope, segments: AdapterSegment[]): Promise<string>;
     publish(scratchDir: string): Promise<string>;

package/dist/services/adapter/auto-adapter.d.ts

@@ -11,8 +11,8 @@
  * (`src/cli/commands/adapter-commands.ts`) echoes back the name it was given
  * and reads no adapter file.
  */
-import { Adapter } from "./adapter.js";
-type Detectable = Pick<Adapter, "name" | "detect">;
+import type { Adapter } from './adapter.js';
+type Detectable = Pick<Adapter, 'name' | 'detect'>;
 export declare class AutoAdapter {
     private readonly _o;
     private readonly _adapters;