peaks-loop 4.0.54 → 4.1.1

package/dist/services/final-review/final-review-verdicts.d.ts

@@ -0,0 +1,60 @@
+import type { PrePostDiffConclusion } from './pre-post-diff.js';
+import type { DimensionEvidence, DimensionKind } from './final-review-types.js';
+/**
+ * F2 — read what the delivered conclusion SAYS, and make a detected drift
+ * impossible to hand over as "nothing needs attention".
+ *
+ * The layer that made delivery a machine fact stopped one step short: it
+ * verified that the reviewer received the `VERDICT:` line and then threw the
+ * line away, keeping only a boolean. Measured (QA round 5, one export removed,
+ * the model replying 4/4 `pass`):
+ *
+ *   VERDICT: STRUCTURAL DRIFT DETECTED — ... 1 export name(s).
+ *   existing-functionality-intact: pass/high
+ *   allPass: true | needsAttention: []
+ *
+ * — an envelope that says "clean handoff" directly above the evidence it
+ * attached itself, whose first line says a removal was detected. That is the
+ * same shape as every other hole here: a check that ran, whose RESULT was never
+ * consumed, so the check's presence was mistaken for its verdict.
+ *
+ * The verdict is deliberately NOT forced to `fail`: a removal can be authorized
+ * by the approved scope, and that judgement belongs to the reviewer and to the
+ * human. What is refused is SILENCE — a drift the service detected is a
+ * dimension a human has to look at, so it is named in `needsAttention` (which
+ * also clears `allPass`: a handoff with an open question is not a clean one)
+ * and its dimension says so in its own summary.
+ *
+ * `indeterminate` counts too. A delivered conclusion this service cannot
+ * classify is not "no drift" — it is a conclusion nobody read, which is the
+ * defect this function exists to close, so it is surfaced rather than dropped.
+ */
+export declare function enforceStructuralDriftAttention(dimensions: readonly DimensionEvidence[], deliveredConclusion: PrePostDiffConclusion | null): {
+    readonly dimensions: readonly DimensionEvidence[];
+    readonly mustAttend: boolean;
+};
+/**
+ * `allPass` / `needsAttention` are DERIVED from the verdicts, never copied
+ * verbatim from the model's own summary fields: a model that writes a fabricated
+ * `pass` line plus a matching `allPass: true` would otherwise produce exactly
+ * the forged clean handoff this primitive exists to prevent, and once the gate
+ * above rewrites a verdict the two would silently disagree.
+ *
+ * Both fields are only ever NARROWED, never widened — `allPass` cannot become
+ * true unless the model also said true and no dimension is non-`pass`, and a
+ * dimension the model itself flagged is never dropped from `needsAttention`.
+ */
+export declare function summarizeVerdicts(dimensions: readonly DimensionEvidence[], modelFlags: {
+    readonly allPass: unknown;
+    readonly needsAttention: unknown;
+}, 
+/**
+ * Dimensions the SERVICE must flag whatever the model said — today, the one
+ * F2 names when the delivered baseline reports structural drift. A handoff
+ * with a machine-detected drift in it is not clean, so this also clears
+ * `allPass`, exactly as a non-`pass` verdict does.
+ */
+mustAttend?: readonly DimensionKind[]): {
+    readonly allPass: boolean;
+    readonly needsAttention: readonly DimensionKind[];
+};

package/dist/services/final-review/final-review-verdicts.js

@@ -0,0 +1,91 @@
+// src/services/final-review/final-review-verdicts.ts
+//
+// F2 — reading the delivered conclusion — and the derived allPass /
+// needsAttention summary. Hoisted verbatim from final-review-service.ts
+// (C wave 7 file-size split).
+/**
+ * F2 — read what the delivered conclusion SAYS, and make a detected drift
+ * impossible to hand over as "nothing needs attention".
+ *
+ * The layer that made delivery a machine fact stopped one step short: it
+ * verified that the reviewer received the `VERDICT:` line and then threw the
+ * line away, keeping only a boolean. Measured (QA round 5, one export removed,
+ * the model replying 4/4 `pass`):
+ *
+ *   VERDICT: STRUCTURAL DRIFT DETECTED — ... 1 export name(s).
+ *   existing-functionality-intact: pass/high
+ *   allPass: true | needsAttention: []
+ *
+ * — an envelope that says "clean handoff" directly above the evidence it
+ * attached itself, whose first line says a removal was detected. That is the
+ * same shape as every other hole here: a check that ran, whose RESULT was never
+ * consumed, so the check's presence was mistaken for its verdict.
+ *
+ * The verdict is deliberately NOT forced to `fail`: a removal can be authorized
+ * by the approved scope, and that judgement belongs to the reviewer and to the
+ * human. What is refused is SILENCE — a drift the service detected is a
+ * dimension a human has to look at, so it is named in `needsAttention` (which
+ * also clears `allPass`: a handoff with an open question is not a clean one)
+ * and its dimension says so in its own summary.
+ *
+ * `indeterminate` counts too. A delivered conclusion this service cannot
+ * classify is not "no drift" — it is a conclusion nobody read, which is the
+ * defect this function exists to close, so it is surfaced rather than dropped.
+ */
+export function enforceStructuralDriftAttention(dimensions, deliveredConclusion) {
+    // `null` is "no conclusion was DELIVERED" — the gate above owns that case. It
+    // must not be folded into `indeterminate`: a project with no baseline has not
+    // delivered an unreadable conclusion, it has delivered none, and saying
+    // otherwise would put a false "the comparison was never read" marker on every
+    // non-git run.
+    if (deliveredConclusion === null)
+        return { dimensions, mustAttend: false };
+    if (deliveredConclusion === 'no-drift' || deliveredConclusion === 'additions-only') {
+        return { dimensions, mustAttend: false };
+    }
+    const what = deliveredConclusion === 'drift-detected'
+        ? 'the delivered pre/post baseline diff reports STRUCTURAL DRIFT DETECTED'
+        : 'the delivered pre/post baseline diff carries a VERDICT line this service cannot classify, so the comparison was never actually read';
+    return {
+        dimensions: dimensions.map((dimension) => {
+            if (dimension.dimension !== 'existing-functionality-intact')
+                return dimension;
+            return {
+                ...dimension,
+                summary: `${dimension.summary} [pre-post-diff-drift-gate: ${what}. The removal may well be authorized by the approved scope — that is the reviewer's and the human's call — but a detected drift is never "nothing needs attention": this dimension is listed in needsAttention and allPass is false.]`
+            };
+        }),
+        mustAttend: true
+    };
+}
+/**
+ * `allPass` / `needsAttention` are DERIVED from the verdicts, never copied
+ * verbatim from the model's own summary fields: a model that writes a fabricated
+ * `pass` line plus a matching `allPass: true` would otherwise produce exactly
+ * the forged clean handoff this primitive exists to prevent, and once the gate
+ * above rewrites a verdict the two would silently disagree.
+ *
+ * Both fields are only ever NARROWED, never widened — `allPass` cannot become
+ * true unless the model also said true and no dimension is non-`pass`, and a
+ * dimension the model itself flagged is never dropped from `needsAttention`.
+ */
+export function summarizeVerdicts(dimensions, modelFlags, 
+/**
+ * Dimensions the SERVICE must flag whatever the model said — today, the one
+ * F2 names when the delivered baseline reports structural drift. A handoff
+ * with a machine-detected drift in it is not clean, so this also clears
+ * `allPass`, exactly as a non-`pass` verdict does.
+ */
+mustAttend = []) {
+    const nonPass = dimensions.filter((d) => d.verdict !== 'pass').map((d) => d.dimension);
+    const flaggedByModel = Array.isArray(modelFlags.needsAttention)
+        ? modelFlags.needsAttention
+        : [];
+    return {
+        allPass: modelFlags.allPass !== false &&
+            dimensions.length > 0 &&
+            nonPass.length === 0 &&
+            mustAttend.length === 0,
+        needsAttention: [...new Set([...flaggedByModel, ...nonPass, ...mustAttend])]
+    };
+}

package/dist/services/final-review/index.d.ts

@@ -1,3 +1,3 @@
-export { prepareFinalReview, type PrepareFinalReviewOptions, type LlmRunner, IncompleteFinalReviewError, MAX_EVIDENCE_BYTES_PER_FILE, MAX_EVIDENCE_BYTES_TOTAL, assertFloorReservationAffordable, undeliverableDimensions, type UndeliverableDimensionEvidence, } from './final-review-service.js';
-export { classifyPrePostDiffVerdict, type PrePostDiffConclusion, } from './pre-post-diff.js';
-export type { DimensionKind, DimensionVerdict, EvidenceKind, DimensionConfidence, EvidenceItem, DimensionEvidence, FinalReviewOutput, } from './final-review-types.js';
+export { prepareFinalReview, type PrepareFinalReviewOptions, type LlmRunner, IncompleteFinalReviewError, MAX_EVIDENCE_BYTES_PER_FILE, MAX_EVIDENCE_BYTES_TOTAL, assertFloorReservationAffordable, undeliverableDimensions, type UndeliverableDimensionEvidence } from './final-review-service.js';
+export { classifyPrePostDiffVerdict, type PrePostDiffConclusion } from './pre-post-diff.js';
+export type { DimensionKind, DimensionVerdict, EvidenceKind, DimensionConfidence, EvidenceItem, DimensionEvidence, FinalReviewOutput } from './final-review-types.js';

package/dist/services/final-review/index.js

@@ -1,2 +1,2 @@
-export { prepareFinalReview, IncompleteFinalReviewError, MAX_EVIDENCE_BYTES_PER_FILE, MAX_EVIDENCE_BYTES_TOTAL, assertFloorReservationAffordable, undeliverableDimensions, } from './final-review-service.js';
-export { classifyPrePostDiffVerdict, } from './pre-post-diff.js';
+export { prepareFinalReview, IncompleteFinalReviewError, MAX_EVIDENCE_BYTES_PER_FILE, MAX_EVIDENCE_BYTES_TOTAL, assertFloorReservationAffordable, undeliverableDimensions } from './final-review-service.js';
+export { classifyPrePostDiffVerdict } from './pre-post-diff.js';

package/dist/services/final-review/pre-post-diff.js

@@ -84,7 +84,9 @@ export const PRE_POST_DIFF_DRIFT_DETECTED = 'STRUCTURAL DRIFT DETECTED';
  * prose masquerade as its conclusion.
  */
 export function classifyPrePostDiffVerdict(content) {
-    const line = content.split(/\r?\n/).find(candidate => candidate.startsWith(PRE_POST_DIFF_VERDICT_MARKER));
+    const line = content
+        .split(/\r?\n/)
+        .find((candidate) => candidate.startsWith(PRE_POST_DIFF_VERDICT_MARKER));
     if (line === undefined)
         return 'indeterminate';
     const conclusion = line.slice(PRE_POST_DIFF_VERDICT_MARKER.length);
@@ -98,12 +100,7 @@ export function classifyPrePostDiffVerdict(content) {
 }
 /** Test-file globs — the single definition both the file count and the case
  *  count use, so the two can never disagree about what a "test file" is. */
-export const TEST_FILE_GLOBS = [
-    '*.test.ts',
-    '*.test.tsx',
-    '*.spec.ts',
-    '*.spec.tsx'
-];
+export const TEST_FILE_GLOBS = ['*.test.ts', '*.test.tsx', '*.spec.ts', '*.spec.tsx'];
 /** Source globs for the public-API surface. */
 export const API_SOURCE_GLOBS = ['*.ts', '*.tsx'];
 const TEST_FILE_RE = /\.(test|spec)\.(ts|tsx)$/;
@@ -189,8 +186,8 @@ function runGit(cwd, args) {
 function lines(text) {
     return text
         .split(/\r?\n/)
-        .map(line => line.trim())
-        .filter(line => line.length > 0);
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
 }
 function isTestPath(path) {
     return TEST_FILE_RE.test(path);
@@ -203,13 +200,13 @@ function isTestPath(path) {
 function namesInExportList(body) {
     return body
         .split(',')
-        .map(part => part.replace(/^\s*type\s+/, '').trim())
-        .filter(part => part.length > 0)
-        .map(part => {
+        .map((part) => part.replace(/^\s*type\s+/, '').trim())
+        .filter((part) => part.length > 0)
+        .map((part) => {
         const alias = /\s+as\s+([A-Za-z_$][\w$]*)$/.exec(part);
         return alias === null ? part : alias[1];
     })
-        .filter(name => /^[A-Za-z_$][\w$]*$/.test(name));
+        .filter((name) => /^[A-Za-z_$][\w$]*$/.test(name));
 }
 /**
  * The exported NAMES bound by one source line. Approximate by design: the
@@ -286,7 +283,12 @@ function countFilesMatching(repoRoot, paths, re) {
 function resolveBaseRef(repoRoot, explicit) {
     if (explicit !== undefined && explicit.trim() !== '') {
         const requested = explicit.trim();
-        const resolved = runGit(repoRoot, ['rev-parse', '--verify', '--quiet', `${requested}^{commit}`]);
+        const resolved = runGit(repoRoot, [
+            'rev-parse',
+            '--verify',
+            '--quiet',
+            `${requested}^{commit}`
+        ]);
         if (resolved.stdout.trim() !== '') {
             return { ok: true, ref: resolved.stdout.trim(), label: requested, reason: '' };
         }
@@ -350,10 +352,10 @@ function delta(before, after) {
 function renderFileList(label, added, removed, netDelta) {
     const lines = [];
     if (netDelta < 0 && removed.length > 0) {
-        lines.push(`Removed ${label} (${String(removed.length)}):`, ...removed.map(p => `  - ${p}`));
+        lines.push(`Removed ${label} (${String(removed.length)}):`, ...removed.map((p) => `  - ${p}`));
     }
     if (netDelta > 0 && added.length > 0) {
-        lines.push(`Added ${label} (${String(added.length)}):`, ...added.map(p => `  + ${p}`));
+        lines.push(`Added ${label} (${String(added.length)}):`, ...added.map((p) => `  + ${p}`));
     }
     if (netDelta === 0 && (added.length > 0 || removed.length > 0)) {
         lines.push(`${label}: ${String(removed.length)} path(s) gone / ${String(added.length)} new, with NO net change — so this is a path change (a move or a rename), not a removal.`);
@@ -427,11 +429,11 @@ export function producePrePostDiff(opts) {
     const trackedFiles = lines(runGit(repoRoot, ['ls-files', '-co', '--exclude-standard']).stdout);
     const untrackedFiles = lines(runGit(repoRoot, ['ls-files', '--others', '--exclude-standard']).stdout);
     // `ls-files` lists INDEX entries, and an entry can outlive its file on disk.
-    const afterFiles = trackedFiles.filter(path => existsSync(join(repoRoot, path)));
+    const afterFiles = trackedFiles.filter((path) => existsSync(join(repoRoot, path)));
     const testFilesBefore = baseFiles.filter(isTestPath);
     const testFilesAfter = afterFiles.filter(isTestPath);
-    const addedTestFiles = testFilesAfter.filter(path => !baseFiles.includes(path));
-    const removedTestFiles = testFilesBefore.filter(path => !afterFiles.includes(path));
+    const addedTestFiles = testFilesAfter.filter((path) => !baseFiles.includes(path));
+    const removedTestFiles = testFilesBefore.filter((path) => !afterFiles.includes(path));
     // F4 — the SOURCE FILE lists, so a deleted module is visible even when the
     // counts it would have moved do not move at all: a `.ts` module with no
     // top-level `export ` line leaves the export count untouched, and a module
@@ -443,13 +445,12 @@ export function producePrePostDiff(opts) {
     // never counted twice.
     const sourceFilesBefore = baseFiles.filter(isSourcePath);
     const sourceFilesAfter = afterFiles.filter(isSourcePath);
-    const addedSourceFiles = sourceFilesAfter.filter(path => !baseFiles.includes(path));
-    const removedSourceFiles = sourceFilesBefore.filter(path => !afterFiles.includes(path));
+    const addedSourceFiles = sourceFilesAfter.filter((path) => !baseFiles.includes(path));
+    const removedSourceFiles = sourceFilesBefore.filter((path) => !afterFiles.includes(path));
     // ---- test surface --------------------------------------------------------
     // Before: the base TREE (a tree grep cannot hit the ignore-walk trap above).
     // After: the working tree, read from the files `afterFiles` lists.
-    const testCasesBefore = sumGrepCounts(runGit(repoRoot, ['grep', '-c', '-E', TEST_CASE_ERE, base.ref, '--', ...TEST_FILE_GLOBS])
-        .stdout);
+    const testCasesBefore = sumGrepCounts(runGit(repoRoot, ['grep', '-c', '-E', TEST_CASE_ERE, base.ref, '--', ...TEST_FILE_GLOBS]).stdout);
     const testCasesAfter = countFilesMatching(repoRoot, testFilesAfter, TEST_CASE_LINE_RE);
     // ---- public API surface (changed .ts / .tsx files only) ------------------
     // The COUNT keeps the `*.ts` / `*.tsx` glob semantics on both sides — the base
@@ -457,7 +458,7 @@ export function producePrePostDiff(opts) {
     // and the working-tree side must not either, or the two sides would count
     // different file sets. The FILE LISTS (`sourceFiles*`) are the disjoint
     // non-test surface used for the artifact and the removal rule.
-    const countedSourceAfter = afterFiles.filter(path => /\.(ts|tsx)$/.test(path));
+    const countedSourceAfter = afterFiles.filter((path) => /\.(ts|tsx)$/.test(path));
     const exportsBefore = sumGrepCounts(runGit(repoRoot, ['grep', '-c', '-E', EXPORT_LINE_ERE, base.ref, '--', ...API_SOURCE_GLOBS])
         .stdout);
     const exportsAfter = countFilesMatching(repoRoot, countedSourceAfter, EXPORT_LINE_RE);
@@ -513,11 +514,11 @@ export function producePrePostDiff(opts) {
     }
     // Untracked files are invisible to `git diff`, and in this repo's workflow the
     // slice's new files are exactly the ones still untracked.
-    for (const path of untrackedFiles.filter(path => /\.(ts|tsx)$/.test(path))) {
+    for (const path of untrackedFiles.filter((path) => /\.(ts|tsx)$/.test(path))) {
         try {
             for (const name of readFileSync(join(repoRoot, path), 'utf8')
                 .split(/\r?\n/)
-                .flatMap(line => extractExportedNames(line))) {
+                .flatMap((line) => extractExportedNames(line))) {
                 addedExports.push({ name, path });
             }
         }
@@ -576,7 +577,7 @@ export function producePrePostDiff(opts) {
         '## Verdict',
         verdict,
         '',
-        '# The verdict above is repeated nowhere: it is the file\'s conclusion. The method',
+        "# The verdict above is repeated nowhere: it is the file's conclusion. The method",
         '# and the raw counts it rests on follow, for a human who wants to check it.',
         '#',
         `# Base ref : ${base.label} (${base.ref})`,
@@ -594,7 +595,7 @@ export function producePrePostDiff(opts) {
         '#',
         '# METHOD — public API surface (changed .ts / .tsx files only)',
         '#   Top-level `export` statements (lines anchored at column 0) are counted with',
-        "#   `git grep -c` on both sides. The added/removed NAMES come from the changed",
+        '#   `git grep -c` on both sides. The added/removed NAMES come from the changed',
         "#   lines of `git diff -U0 <base> -- '*.ts' '*.tsx'`, plus any untracked file",
         '#   read from disk. The FILE lists below cover non-test `.ts` / `.tsx` files.',
         '#',
@@ -660,6 +661,8 @@ export function producePrePostDiff(opts) {
         `non-test source files ${delta(sourceFilesBefore.length, sourceFilesAfter.length)}, ` +
         `top-level export statements ${delta(exportsBefore, exportsAfter)}, ` +
         `+${String(addedExports.length)} / -${String(removedExports.length)} export names. ` +
-        (removals.length === 0 ? 'No structural removal detected.' : `Structural removals: ${removals.join('; ')}.`);
+        (removals.length === 0
+            ? 'No structural removal detected.'
+            : `Structural removals: ${removals.join('; ')}.`);
     return { status: 'computed', summary, relativePath, absolutePath, content };
 }

package/dist/services/fixture/fixture-capture-service.js

@@ -178,7 +178,8 @@ function inferEnvelopeFromBody(body) {
         return 'audit-security';
     if (/^---\n[\s\S]*?verdict\s*:/m.test(body) && /perf|baseline|threshold/i.test(body))
         return 'audit-perf';
-    if (/^## Karpathy-Gate[\s\S]*?gateAction\s*:/m.test(body) || /gateAction\s*:\s*(pass|warn|block)/m.test(body))
+    if (/^## Karpathy-Gate[\s\S]*?gateAction\s*:/m.test(body) ||
+        /gateAction\s*:\s*(pass|warn|block)/m.test(body))
         return 'karpathy-review';
     if (/^---$|schemaVersion.*2|sha256\s*:/m.test(body))
         return 'prd-handoff';
@@ -250,7 +251,15 @@ function applyEdgeCaseVariant(raw, variant, envelope) {
             // The parser must still recover the frontmatter envelope.
             const json = JSON.stringify({
                 verdict: 'warn',
-                violations: [{ dimension: 'embed', severity: 'HIGH', file: 'embed.ts', line: 1, hint: 'embedded json' }],
+                violations: [
+                    {
+                        dimension: 'embed',
+                        severity: 'HIGH',
+                        file: 'embed.ts',
+                        line: 1,
+                        hint: 'embedded json'
+                    }
+                ],
                 summary: 'embedded json inside markdown'
             }, null, 2);
             return `${raw}\n\n## Embedded JSON\n\n\`\`\`json\n${json}\n\`\`\`\n`;
@@ -274,11 +283,10 @@ function applyEdgeCaseVariant(raw, variant, envelope) {
             const body = fmMatch !== null ? fmMatch[2] : raw;
             const kept = body
                 .split('\n')
-                .filter((line) => /^\s*(verdict|passed|gateAction|verdict\s*：)\s*[:：]/i.test(line) || line.trim().length === 0)
+                .filter((line) => /^\s*(verdict|passed|gateAction|verdict\s*：)\s*[:：]/i.test(line) ||
+                line.trim().length === 0)
                 .join('\n');
-            return fmMatch !== null
-                ? `---\n${fmMatch[1]}\n---\n${kept}`
-                : kept;
+            return fmMatch !== null ? `---\n${fmMatch[1]}\n---\n${kept}` : kept;
         }
         case 'multi-findings': {
             // For envelopes with `## Findings` sections, duplicate the

package/dist/services/fresh-context/trigger-scan.js

@@ -15,8 +15,19 @@
  */
 /** Signal keywords — matched case-insensitively as substrings. */
 export const SIGNAL_KEYWORDS = [
-    '升级', '迁移', '最新', 'latest', 'new', '版本', '兼容',
-    'breaking', 'upgrade', 'migrate', '新框架', '推荐库', '选型'
+    '升级',
+    '迁移',
+    '最新',
+    'latest',
+    'new',
+    '版本',
+    '兼容',
+    'breaking',
+    'upgrade',
+    'migrate',
+    '新框架',
+    '推荐库',
+    '选型'
 ];
 /** Force keywords — the user explicitly asks for a live search. */
 export const FORCE_KEYWORDS = ['联网搜', '查最新', '搜一下'];

package/dist/services/fuzzy-matching/fuzzy-match-service.js

@@ -32,7 +32,7 @@ export function fuzzyMatchWithKey(query, items, options) {
         limit,
         // Per spec: default is case-insensitive (NOT fzf's smart-case).
         // The user explicitly opts into case-sensitive via caseSensitive:true.
-        casing: options.caseSensitive === true ? 'case-sensitive' : 'case-insensitive',
+        casing: options.caseSensitive === true ? 'case-sensitive' : 'case-insensitive'
         // normalize:true (default) strips diacritics; fzf returns more matches
         // for non-ASCII text this way, which is what we want for
         // bilingual (zh-CN + en) memory entries.

package/dist/services/fuzzy-matching/fzf-pick-service.js

@@ -48,7 +48,12 @@ export async function pickFromList(options) {
     if (options.items.length === 0) {
         // Nothing to pick from. Still write an empty picked artifact so
         // downstream commands have a stable file contract.
-        const emptyPayload = { ...options.meta, pickedAt: new Date().toISOString(), fzfVersion, picked: [] };
+        const emptyPayload = {
+            ...options.meta,
+            pickedAt: new Date().toISOString(),
+            fzfVersion,
+            picked: []
+        };
         writeArtifact(options.outputPath, emptyPayload);
         return { picked: [], outputPath: options.outputPath, fzfVersion };
     }

package/dist/services/hooks/pre-tool-code-gate.js

@@ -26,7 +26,7 @@ export const HARD_BLOCKED_PATH_FAMILIES = [
     'tests/integration/',
     'config/',
     'bin/',
-    'scripts/',
+    'scripts/'
 ];
 /** Allow-listed path prefixes / suffixes — orchestrator may freely Edit/Write these. */
 export const ALLOW_LISTED_PATH_PATTERNS = [
@@ -36,7 +36,7 @@ export const ALLOW_LISTED_PATH_PATTERNS = [
     'docs/',
     '.md',
     'CHANGELOG.md',
-    'README.md',
+    'README.md'
 ];
 /** Pull the target file path from `input.file_path | input.path | input.notebook_path`. */
 export function extractFilePath(input) {

package/dist/services/hooks/presence-marker-detector.js

@@ -105,12 +105,22 @@ export function detectPresenceMarker(input) {
     const markerFound = messageHasMarker(message);
     if (markerFound) {
         if (brokenGraph !== null) {
-            return { active: true, skill: presence.skill, markerFound: true, warning: `Peaks presence active but graph is broken (${brokenGraph}); run \`peaks workspace reconcile\` to repair.` };
+            return {
+                active: true,
+                skill: presence.skill,
+                markerFound: true,
+                warning: `Peaks presence active but graph is broken (${brokenGraph}); run \`peaks workspace reconcile\` to repair.`
+            };
         }
         return { active: true, skill: presence.skill, markerFound: true };
     }
     if (brokenGraph !== null) {
-        return { active: true, skill: presence.skill, markerFound: false, warning: `Peaks presence active but graph is broken (${brokenGraph}); run \`peaks workspace reconcile\` to repair.` };
+        return {
+            active: true,
+            skill: presence.skill,
+            markerFound: false,
+            warning: `Peaks presence active but graph is broken (${brokenGraph}); run \`peaks workspace reconcile\` to repair.`
+        };
     }
     return {
         active: true,

package/dist/services/hooks/worktree-authorization-gate.js

@@ -35,9 +35,9 @@
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { deserializeLease, isLeaseActive, leaseFilePath, } from '../worktree/worktree-lease.js';
+import { deserializeLease, isLeaseActive, leaseFilePath } from '../worktree/worktree-lease.js';
 import { readDispatchProvenance } from '../worktree/dispatch-provenance.js';
-import { containerLeaseFilePath, deserializeContainerLease, isContainerLeaseActive, } from '../container/container-lease.js';
+import { containerLeaseFilePath, deserializeContainerLease, isContainerLeaseActive } from '../container/container-lease.js';
 export const WORKTREE_AUTH_FILE = 'worktree-auth.json';
 /** Stable identifier of the current "user authorization" — derived from session + tool + key args. */
 export function currentAuthFingerprint(input) {
@@ -184,7 +184,12 @@ export function decideFromAuthorization(input, operation, file) {
         .filter((g) => Date.parse(g.expiresAt) > now)
         .find((g) => g.requestId === null || g.requestId === input.requestId);
     if (requestMatched !== undefined) {
-        return { allow: true, authorization: requestMatched, remaining: file.grants.length, viaLease: null };
+        return {
+            allow: true,
+            authorization: requestMatched,
+            remaining: file.grants.length,
+            viaLease: null
+        };
     }
     // No live grant matched the current rid (or the caller's rid is null). Diagnose why.
     const sameOpAnyState = file.grants.filter((g) => g.operation === operation);
@@ -197,7 +202,8 @@ export function decideFromAuthorization(input, operation, file) {
         };
     }
     const ridScoped = sameOpAnyState.find((g) => g.requestId !== null);
-    const ridMatchesScope = ridScoped !== undefined && (input.requestId === null || ridScoped.requestId === input.requestId);
+    const ridMatchesScope = ridScoped !== undefined &&
+        (input.requestId === null || ridScoped.requestId === input.requestId);
     if (ridScoped !== undefined && !ridMatchesScope) {
         return {
             allow: false,
@@ -236,7 +242,11 @@ export function evaluateWorktreeAuth(input) {
     if (operation === 'agent-isolation-worktree') {
         const token = input.dispatchProvenanceToken ?? '';
         const provenance = token.length > 0
-            ? readDispatchProvenance({ projectRoot: input.projectRoot, sessionId: input.sessionId, token })
+            ? readDispatchProvenance({
+                projectRoot: input.projectRoot,
+                sessionId: input.sessionId,
+                token
+            })
             : null;
         if (provenance === null ||
             input.leaseId === null ||
@@ -309,7 +319,9 @@ export function evaluateWorktreeAuth(input) {
     // `peaks worktree auth grant` are unaffected (their grants already allowed above).
     if (input.leaseId === null || input.leaseId === undefined || input.leaseId.length === 0) {
         // Part 19: try the container lease fallback before giving up.
-        if (input.containerLeaseId !== null && input.containerLeaseId !== undefined && input.containerLeaseId.length > 0) {
+        if (input.containerLeaseId !== null &&
+            input.containerLeaseId !== undefined &&
+            input.containerLeaseId.length > 0) {
             return decideFromContainerLease(input);
         }
         return decision;
@@ -320,7 +332,9 @@ export function evaluateWorktreeAuth(input) {
     // Part 19: if the worktree lease did not allow, try the container
     // lease as a second lease path (sub-agents with container
     // isolation).
-    if (input.containerLeaseId !== null && input.containerLeaseId !== undefined && input.containerLeaseId.length > 0) {
+    if (input.containerLeaseId !== null &&
+        input.containerLeaseId !== undefined &&
+        input.containerLeaseId.length > 0) {
         return decideFromContainerLease(input);
     }
     return leaseResult;