peaks-loop 4.1.1 → 4.1.3

package/dist/services/feedback/feedback-promotion-service.js

@@ -1,5 +1,4 @@
 /**
- * v2.15.0 slice 002 — AC-3: feedback-promotion service.
  *
  * `.peaks/memory/<name>.md` memories with `metadata.type === 'feedback'`
  * are user-given rules. They are advisory (LLM-readable) until promoted
@@ -18,10 +17,8 @@
  *       claimed layer.
  *
  *   (b) The ARTIFACT that layer implies — see `promotionArtifactChecks`.
- *       rid 2026-09-14-gate-h-promotion: the marker alone used to count,
  *       which made the gate self-certifying, because the only thing a marker
  *       proves is that `peaks feedback promote` ran. Every layer-A marker in
- *       this repo pointed at `sops/<name>.md`, a file that did not exist and
  *       that no engine reads.
  *
  * The comment marker is the SOURCE OF TRUTH for human review; the sidecar is
@@ -59,12 +56,10 @@ export const PROMOTION_LAYER_DETAILS = [
     }
 ];
 /**
- * rid 2026-09-14-gate-h-promotion — what actually backs a promotion.
  *
  * Before this, a promotion was honored on the marker alone (HTML comment or
  * sidecar). Both are written by `peaks feedback promote` and neither proves
  * that anything was enforced: every layer-A promotion in this repo pointed at
- * `sops/<name>.md`, a file that did not exist and that no engine reads. The
  * gate was therefore self-certifying — it read only what the command it tells
  * you to run had written.
  *
@@ -85,7 +80,6 @@ export const PROMOTION_LAYER_DETAILS = [
  *     is the repo's existing convention: the one real layer-C promotion cites
  *     its memory by path, from the category's doc block.
  *
- * R2 (2026-09-14-gate-h-promotion): each of those is now a PARSE plus a shape
  * assertion, in `promotion-artifact-evidence.ts`. Every check used to be a
  * `text.includes(<rule>)` over the whole file, which certified a tree that was
  * a refusal — an invalid-JSON registry, a template saying "do NOT add a
@@ -157,7 +151,6 @@ export function missingArtifacts(checks, projectRoot) {
 }
 const COMMENT_MARKER_RE = /<!--\s*peaks-feedback-promoted:\s*layer=([ABC])\s*-->/;
 /**
- * rid 2026-09-14-gate-h-promotion (classify slice) — the "not to be promoted"
  * declaration.
  *
  * The gate used to know only `has artifact` / `has no artifact`, so a memory that
@@ -313,7 +306,6 @@ export function listUnpromotedFeedback(opts) {
         // honours the closed state and reports `0 unpromoted` for closed records.
         if (isClosedMemory(join(memoryDir, entry.name)))
             continue;
-        // rid 2026-09-14-gate-h-promotion (classify slice): a memory may declare
         // itself out of the gate. A malformed declaration is a FAILURE, not a skip —
         // otherwise "make the fields unusable" would be the quietest way through.
         const declaration = readNotToPromote(join(memoryDir, entry.name));
@@ -345,7 +337,6 @@ export function listUnpromotedFeedback(opts) {
             });
             continue;
         }
-        // rid 2026-09-14-gate-h-promotion: a marker is a claim, not evidence. It
         // counts only when the layer's enforcement surface actually carries the
         // artifact. Before this, the marker alone was accepted, so the gate
         // certified whatever the promote command had written and nothing else.
@@ -586,7 +577,6 @@ export async function promoteFeedback(opts) {
     if (parsed === null) {
         throw new Error(`Not a feedback memory: ${opts.feedbackPath}`);
     }
-    // rid 2026-09-14-gate-h-promotion (classify slice): the tool must not create the
     // contradiction the gate rejects — promoting a memory that declares itself out of
     // the gate would print `effective: true` while Gate H reports a contradiction.
     const declaration = readNotToPromote(opts.feedbackPath);

package/dist/services/feedback/promotion-artifact-evidence.d.ts

@@ -1,5 +1,4 @@
 /**
- * rid 2026-09-14-gate-h-promotion (R2; repaired by R8) — what a promotion's
  * artifact has to PROVE.
  *
  * The three layers used to be checked with `text.includes(<rule name>)` over the

package/dist/services/feedback/promotion-artifact-evidence.js

@@ -1,5 +1,4 @@
 /**
- * rid 2026-09-14-gate-h-promotion (R2; repaired by R8) — what a promotion's
  * artifact has to PROVE.
  *
  * The three layers used to be checked with `text.includes(<rule name>)` over the

package/dist/services/final-review/final-review-evidence-budget.d.ts

@@ -12,8 +12,6 @@ export declare const REQUIRED_DIMENSIONS: readonly DimensionKind[];
  *
  * RE-EVALUATED 2026-09-12 (F-BLOCK) — 32 KiB did NOT hold once the tenth
  * source (`final-review-pre-post-diff`) was appended. Measured on this repo's
- * own run (`2026-09-12-session-e37ef0`, rid
- * `2026-09-12-codegraph-exclude-integrity`), the ten sources are 2,621 / 8,164
  * / 9,492 / 10,839 / 11,422 / 13,050 / 13,462 / 13,852 / 17,745 / 20,543
  * bytes — 121,190 bytes on disk, 76,321 bytes once the 8 KiB per-file cap is
  * applied. Four sources at the cap spent the old 32,768 to the byte, so the
@@ -28,7 +26,6 @@ export declare const REQUIRED_DIMENSIONS: readonly DimensionKind[];
  * 66,848 bytes of inlined evidence and is clamped from there on — a cap at or
  * above that point buys the reviewer no more output room at all.
  *
- * F-CAP — an earlier version of this comment claimed 40 KiB (40,960 =
  * 10 x 4,096) was "the smallest cap that affords one floor-sized slice to EVERY
  * source in the ten-source set". That was arithmetic about a budget, not a
  * statement about the allocator: sources are capped at

package/dist/services/final-review/final-review-evidence-budget.js

@@ -39,8 +39,6 @@ export const REQUIRED_DIMENSIONS = [
  *
  * RE-EVALUATED 2026-09-12 (F-BLOCK) — 32 KiB did NOT hold once the tenth
  * source (`final-review-pre-post-diff`) was appended. Measured on this repo's
- * own run (`2026-09-12-session-e37ef0`, rid
- * `2026-09-12-codegraph-exclude-integrity`), the ten sources are 2,621 / 8,164
  * / 9,492 / 10,839 / 11,422 / 13,050 / 13,462 / 13,852 / 17,745 / 20,543
  * bytes — 121,190 bytes on disk, 76,321 bytes once the 8 KiB per-file cap is
  * applied. Four sources at the cap spent the old 32,768 to the byte, so the
@@ -55,7 +53,6 @@ export const REQUIRED_DIMENSIONS = [
  * 66,848 bytes of inlined evidence and is clamped from there on — a cap at or
  * above that point buys the reviewer no more output room at all.
  *
- * F-CAP — an earlier version of this comment claimed 40 KiB (40,960 =
  * 10 x 4,096) was "the smallest cap that affords one floor-sized slice to EVERY
  * source in the ten-source set". That was arithmetic about a budget, not a
  * statement about the allocator: sources are capped at
@@ -118,7 +115,6 @@ export const MAX_EVIDENCE_BYTES_PER_FILE = MAX_EVIDENCE_BYTES_TOTAL / REQUIRED_D
  * The anti-starvation reservation (the "floor").
  *
  * The allocator would otherwise be strictly first-come-first-served, and with
- * this repo's own evidence set (`2026-09-12-session-e37ef0`, measured) the
  * first four sources consumed the entire 32 KiB cap — 4 x 8,192 = 32,768, to
  * the byte — before source 5 was even opened. `existing-functionality-intact`
  * is supplied ONLY by `rd/tech-doc.md` (6th), `prd/handoff.md` (9th) and the
@@ -146,7 +142,6 @@ export const MAX_EVIDENCE_BYTES_PER_FILE = MAX_EVIDENCE_BYTES_TOTAL / REQUIRED_D
  *
  * L4 — those are the DERIVED numbers and the relation is an EQUALITY, not an
  * inequality with room to spare: the reservation spends the entire budget and
- * leaves ZERO slack. This block used to read `= 4 x 8,192 = 32,768 <= 40,960`,
  * which was true of the typed-literal cap and stopped being true the moment the
  * cap was divided out of the total; left as written it read as 8 KiB of
  * headroom that does not exist and would have invited "just raise the cap a

package/dist/services/final-review/final-review-evidence-sources.d.ts

@@ -31,7 +31,6 @@ export interface EvidenceSource {
     readonly segments: readonly string[];
     /**
      * An older location of the SAME artifact, tried only when `segments` is not
-     * on disk. Slice `2026-09-14-prd-capsule-rid-scoping` moved the PRD handoff
      * capsule to `prd/handoff-<rid>.md`; sessions written before it hold only
      * the bare `prd/handoff.md`, and this module's delivery gate keys on that
      * source — so a source that goes missing does not fail the gate, it stops

package/dist/services/final-review/final-review-evidence-sources.js

@@ -125,7 +125,6 @@ function baseEvidenceSourcesB(rid) {
         {
             key: SCOPE_CONTRACT_SOURCE_KEY,
             label: 'PRD handoff (approved scope + non-goals)',
-            // One capsule per slice since `2026-09-14-prd-capsule-rid-scoping`; the
             // bare name is the pre-scoping tier and still lives on 3 sessions.
             segments: ['prd', `handoff-${rid}.md`],
             legacySegments: ['prd', 'handoff.md'],

package/dist/services/final-review/final-review-output-budget.d.ts

@@ -10,7 +10,6 @@ export declare const MIN_OUTPUT_TOKENS = 3000;
  * A Messages-API-compatible endpoint applies `max_tokens` to the WHOLE
  * response, and a reasoning model spends it on hidden reasoning before it
  * emits a single character of the 4-dim envelope. Measured on this repo's own
- * machine (2026-09-12, rid `2026-09-12-codegraph-exclude-integrity`,
  * `deepseek-flash[1M]` via `api.deepseek.com/anthropic`): `max_tokens=8192`
  * came back with `output_tokens=8192` and only **574** visible characters —
  * the entire budget went to reasoning. A bytes-per-token estimate of the

package/dist/services/final-review/final-review-output-budget.js

@@ -15,7 +15,6 @@
  *
  * The input side above was raised (32 KiB then, 40 KiB today) but the
  * output ceiling stayed hard-coded at 3000 tokens. Measured on this repo's own
- * run (rid `2026-09-12-codegraph-exclude-integrity`, 9 sources, 32 KiB
  * inlined, real anthropic provider): 3/3 attempts failed — 2x
  * INCOMPLETE_FINAL_REVIEW with the JSON cut off mid-string, 1x a reply with no
  * text block. A 4-dimension envelope (4 x `summary` + `evidence[]` +
@@ -27,7 +26,6 @@
  * measurement. Both claims were falsified by re-measurement on the SAME
  * machine the gate ships on (`deepseek-flash[1M]` via
  * `api.deepseek.com/anthropic`, 2026-09-12, QA run 3/3 red + orchestrator
- * re-run 3/3 red, rid `2026-09-12-codegraph-exclude-integrity`, byte-identical
  * prompt):
  *
  *   max_tokens=7096 (what the old formula produced for the 32 KiB pack)
@@ -67,7 +65,6 @@ export const MIN_OUTPUT_TOKENS = 3_000;
  * A Messages-API-compatible endpoint applies `max_tokens` to the WHOLE
  * response, and a reasoning model spends it on hidden reasoning before it
  * emits a single character of the 4-dim envelope. Measured on this repo's own
- * machine (2026-09-12, rid `2026-09-12-codegraph-exclude-integrity`,
  * `deepseek-flash[1M]` via `api.deepseek.com/anthropic`): `max_tokens=8192`
  * came back with `output_tokens=8192` and only **574** visible characters —
  * the entire budget went to reasoning. A bytes-per-token estimate of the

package/dist/services/final-review/final-review-service.d.ts

@@ -26,7 +26,6 @@ export declare function evidenceSourcesFor(rid: string, prePostDiffAvailable: bo
  * Which dimensions the reviewer was actually given evidence FOR. A dimension
  * absent from this set has no delivered evidence behind it.
  *
- * F3 / 1.3 — this used to read `status !== 'found'`, i.e. "a source that
  * mentions this dimension was inlined (at least a byte of it)". Two things were
  * wrong with that, and both are the same thing: it asked about the SOURCE (was
  * it included) instead of about the DIMENSION (was its evidence seen), and it

package/dist/services/final-review/final-review-service.js

@@ -63,7 +63,6 @@ export function evidenceSourcesFor(rid, prePostDiffAvailable) {
  * Which dimensions the reviewer was actually given evidence FOR. A dimension
  * absent from this set has no delivered evidence behind it.
  *
- * F3 / 1.3 — this used to read `status !== 'found'`, i.e. "a source that
  * mentions this dimension was inlined (at least a byte of it)". Two things were
  * wrong with that, and both are the same thing: it asked about the SOURCE (was
  * it included) instead of about the DIMENSION (was its evidence seen), and it

package/dist/services/fixture/fixture-capture-service.js

@@ -1,5 +1,4 @@
 /**
- * v2.14.0 G1 AC-1.4 — Fixture capture service.
  *
  * Producer-side counterpart of `fixture-sanitize-service`. The CLI
  * (`scripts/fixture-capture.mjs`) is a thin wrapper around this module.

package/dist/services/fixture/fixture-sanitize-service.d.ts

@@ -1,7 +1,5 @@
 /**
- * v2.14.0 G1 AC-1.5 — Fixture sanitization service.
  *
- * Five sanitize rules (PRD AC-1.5 + the explicit
  * "username path segment" extension):
  *
  *   1. cookie-redaction              — `Cookie: <name>=<value>` / `Set-Cookie: ...`
@@ -23,7 +21,6 @@
  *     the original (potentially sensitive) values.
  *
  * Why a separate service (not inline in capture CLI):
- *   - Unit-testable in isolation. The PRD AC-1.5 mandate is "tested",
  *     and 5 sanitize rules need 5+ test cases per rule. Keeping the
  *     logic in a service makes the tests trivial.
  *   - Re-usable by future capture tools (`peaks fixture redact`,

package/dist/services/fixture/fixture-sanitize-service.js

@@ -1,7 +1,5 @@
 /**
- * v2.14.0 G1 AC-1.5 — Fixture sanitization service.
  *
- * Five sanitize rules (PRD AC-1.5 + the explicit
  * "username path segment" extension):
  *
  *   1. cookie-redaction              — `Cookie: <name>=<value>` / `Set-Cookie: ...`
@@ -23,7 +21,6 @@
  *     the original (potentially sensitive) values.
  *
  * Why a separate service (not inline in capture CLI):
- *   - Unit-testable in isolation. The PRD AC-1.5 mandate is "tested",
  *     and 5 sanitize rules need 5+ test cases per rule. Keeping the
  *     logic in a service makes the tests trivial.
  *   - Re-usable by future capture tools (`peaks fixture redact`,

package/dist/services/fresh-context/config.js

@@ -1,5 +1,4 @@
 /**
- * Fresh-context kill-switch reader (slice 2026-09-07-search-first-preflight).
  *
  * Reads the global `freshContext.enabled` boolean via the config service's
  * nested-key accessor — the same one `peaks config get --key` uses. Defaults

package/dist/services/fresh-context/fresh-context-block.js

@@ -1,5 +1,4 @@
 /**
- * Fresh-context dispatch block reader (slice 2026-09-07-search-first-preflight).
  *
  * Reads the orchestrator-synthesized `.peaks/_runtime/<sessionId>/fresh-context.md`
  * and returns its `## Fresh context` section for injection into the RD/PRD

package/dist/services/fresh-context/trigger-scan.d.ts

@@ -1,6 +1,5 @@
 /**
  * Fresh-context trigger scan — pure, deterministic signal detection for the
- * search-first preflight (slice 2026-09-07-search-first-preflight).
  *
  * The scan is a cheap NL keyword check that runs BEFORE the first planning
  * action. It decides whether the orchestrator should search for fresh

package/dist/services/fresh-context/trigger-scan.js

@@ -1,6 +1,5 @@
 /**
  * Fresh-context trigger scan — pure, deterministic signal detection for the
- * search-first preflight (slice 2026-09-07-search-first-preflight).
  *
  * The scan is a cheap NL keyword check that runs BEFORE the first planning
  * action. It decides whether the orchestrator should search for fresh

package/dist/services/fuzzy-matching/fzf-pick-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * Generic fzf binary picker (slice 2026-06-14-fzf-rollout).
  *
  * Promoted from `src/services/slice/slice-pick-service.ts` (which is
  * the only prior caller). Encapsulates the canonical fzf integration

package/dist/services/fuzzy-matching/fzf-pick-service.js

@@ -1,5 +1,4 @@
 /**
- * Generic fzf binary picker (slice 2026-06-14-fzf-rollout).
  *
  * Promoted from `src/services/slice/slice-pick-service.ts` (which is
  * the only prior caller). Encapsulates the canonical fzf integration

package/dist/services/handoff/handoff-parser.d.ts

@@ -1,7 +1,6 @@
 /**
  * Handoff frontmatter — parser.
  *
- * Spec: docs/superpowers/plans/2026-06-25-slice-topology-multipass.md
  *       Phase 1, Task 4.
  *
  * Reads a markdown handoff file from disk and splits it into:

package/dist/services/handoff/handoff-parser.js

@@ -1,7 +1,6 @@
 /**
  * Handoff frontmatter — parser.
  *
- * Spec: docs/superpowers/plans/2026-06-25-slice-topology-multipass.md
  *       Phase 1, Task 4.
  *
  * Reads a markdown handoff file from disk and splits it into:

package/dist/services/handoff/handoff-types.d.ts

@@ -1,7 +1,6 @@
 /**
  * Handoff frontmatter schema — types.
  *
- * Spec: docs/superpowers/plans/2026-06-25-slice-topology-multipass.md
  *       Phase 1, Task 4 (Handoff frontmatter types + parser + writer).
  *
  * A handoff artifact is a markdown file with a YAML frontmatter block

package/dist/services/handoff/handoff-types.js

@@ -1,7 +1,6 @@
 /**
  * Handoff frontmatter schema — types.
  *
- * Spec: docs/superpowers/plans/2026-06-25-slice-topology-multipass.md
  *       Phase 1, Task 4 (Handoff frontmatter types + parser + writer).
  *
  * A handoff artifact is a markdown file with a YAML frontmatter block

package/dist/services/handoff/handoff-writer.d.ts

@@ -1,7 +1,6 @@
 /**
  * Handoff frontmatter — writer.
  *
- * Spec: docs/superpowers/plans/2026-06-25-slice-topology-multipass.md
  *       Phase 1, Task 4.
  *
  * Serializes a `HandoffFrontmatter` plus a body string into a single

package/dist/services/handoff/handoff-writer.js

@@ -1,7 +1,6 @@
 /**
  * Handoff frontmatter — writer.
  *
- * Spec: docs/superpowers/plans/2026-06-25-slice-topology-multipass.md
  *       Phase 1, Task 4.
  *
  * Serializes a `HandoffFrontmatter` plus a body string into a single

package/dist/services/hooks/auto-compact-hook-install.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-07-02-auto-compact-zero-pause — `ide-native` pathway
  * hook install/remove service.
  *
  * Writes the auto-compact PreToolUse hook into the consumer

package/dist/services/hooks/auto-compact-hook-install.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-07-02-auto-compact-zero-pause — `ide-native` pathway
  * hook install/remove service.
  *
  * Writes the auto-compact PreToolUse hook into the consumer

package/dist/services/hooks/mcp-surface-gate.d.ts

@@ -0,0 +1,19 @@
+import type { ProgramIO } from '../../cli/cli-helpers.js';
+import type { IdeAdapter } from '../ide/ide-types.js';
+/** The tool names the proven surface declares. */
+export type McpSurfaceLookup = () => readonly string[];
+/** The production lookup. Injectable so a test can make it throw and watch the refusal. */
+export declare function lookupAllowedMcpTools(): readonly string[];
+/** The adapter whose harness sent this payload. */
+export declare function detectAdapter(parsedStdin: unknown): IdeAdapter;
+/** The deny emission, in the shape the host already treats as a hard block. */
+export declare function emitMcpDeny(io: ProgramIO, code: string, reason: string): void;
+/**
+ * Run the MCP branch over one parsed hook payload.
+ *
+ * @returns `true` when the call was BLOCKED (a deny has already been emitted).
+ *          `false` means "this is not an MCP call for this surface" — every
+ *          other tool name, and every harness declaring no MCP naming, lands
+ *          there and keeps the allow/deny result it had before.
+ */
+export declare function handleMcpSurfaceGate(io: ProgramIO, parsedStdin: unknown, lookup?: McpSurfaceLookup, adapterOf?: (payload: unknown) => IdeAdapter): boolean;

package/dist/services/hooks/mcp-surface-gate.js

@@ -0,0 +1,87 @@
+// src/services/hooks/mcp-surface-gate.ts
+//
+// L3 for the read-only MCP surface: the pre-tool branch that covers MCP tool
+// calls (spec §6.1, §6.2, §6.3).
+//
+// WHY IT IS ITS OWN MODULE. It shares an entry point with the Bash and worktree
+// branches but nothing else: different surface (an MCP tool name, not a command
+// text), different failure direction (fail-CLOSED, where the others fail open),
+// and a different thing it polices. Keeping it beside them made the interceptor
+// file carry three unrelated decisions; it lives here so the file that owns the
+// hook's control flow stays the file that owns the hook's control flow.
+//
+// WHAT IT POLICES, AND WHAT IT DOES NOT. It does not second-guess what a tool
+// would return. It answers one question: "is this MCP tool call one the proven
+// surface declares?" It exists for DRIFT — a stale server process, a hand-edited
+// harness config pointing somewhere else, a tool added to a config that was
+// never proved read-only. The read-only proof itself is L2's job; this is the
+// belt over it.
+//
+// FAIL-CLOSED, AND THE ASYMMETRY WITH THE BASH BRANCH IS DELIBERATE. The Bash
+// branch guards command TEXT, where a false block interrupts real work, so it
+// fails open. This branch guards CONFIG CONSISTENCY, where a false block costs
+// one call that should have been consistent while a false allow costs a call
+// that bypassed the chain. The costs are not the same size, so they do not share
+// a direction — and they do not share a `catch` either.
+//
+// IT READS THE SURFACE AS DATA, NEVER AS CODE. The allowed tool names come from
+// the generated whitelist artifact through its loader, so this branch keeps
+// working when `src/services/mcp/` is deleted (spec §1) — which is also what
+// `tests/unit/standards/no-mcp-source-import.test.ts` enforces mechanically.
+import { getErrorMessage } from 'peaks-loop-shared/result';
+import { emitBlock } from './output.js';
+import { getAdapter } from '../ide/ide-registry.js';
+import { detectIdeFromContext, parseClaudeShapeStdin } from '../ide/hook-translator.js';
+import { matchMcpToolName } from '../ide/mcp-tool-matcher.js';
+import { loadReadOnlyWhitelist, toolIdsOf } from '../readonly-surface/readonly-whitelist.js';
+/** The production lookup. Injectable so a test can make it throw and watch the refusal. */
+export function lookupAllowedMcpTools() {
+    return toolIdsOf(loadReadOnlyWhitelist());
+}
+/** The adapter whose harness sent this payload. */
+export function detectAdapter(parsedStdin) {
+    const ide = detectIdeFromContext({ env: process.env, cwd: process.cwd(), parsedStdin });
+    return getAdapter(ide);
+}
+/** The deny emission, in the shape the host already treats as a hard block. */
+export function emitMcpDeny(io, code, reason) {
+    emitBlock(io, `[mcp-surface-gate:${code}] ${reason}. Blocked by fail-closed policy — ` +
+        'run the read-only command through the CLI instead, or add its argv to ' +
+        'contracts/readonly-surface.json and regenerate the whitelist.');
+}
+/**
+ * Run the MCP branch over one parsed hook payload.
+ *
+ * @returns `true` when the call was BLOCKED (a deny has already been emitted).
+ *          `false` means "this is not an MCP call for this surface" — every
+ *          other tool name, and every harness declaring no MCP naming, lands
+ *          there and keeps the allow/deny result it had before.
+ */
+export function handleMcpSurfaceGate(io, parsedStdin, lookup = lookupAllowedMcpTools, adapterOf = detectAdapter) {
+    let adapter;
+    try {
+        adapter = adapterOf(parsedStdin);
+    }
+    catch (error) {
+        // Detection itself failed. Falling through would let the call pass
+        // unchecked, which is the one outcome this branch exists to prevent.
+        emitMcpDeny(io, 'IDE_DETECTION_FAILED', `the harness could not be identified (${getErrorMessage(error)})`);
+        return true;
+    }
+    const { toolName } = parseClaudeShapeStdin(parsedStdin);
+    const match = toolName === undefined ? undefined : matchMcpToolName(adapter, toolName);
+    if (match === undefined)
+        return false;
+    let allowed;
+    try {
+        allowed = lookup();
+    }
+    catch (error) {
+        emitMcpDeny(io, 'SURFACE_UNREADABLE', `the read-only surface could not be read (${getErrorMessage(error)})`);
+        return true;
+    }
+    if (allowed.includes(match.toolId))
+        return false;
+    emitMcpDeny(io, 'NOT_IN_READONLY_SURFACE', `"${toolName}" is not one of the read-only tools this project declares (${allowed.join(', ') || 'none'})`);
+    return true;
+}

package/dist/services/hooks/output.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 003-2026-06-16-hook-governance — single source of truth for the
  * peaks hook output contract. See `.claude/HOOKS.md` for the canonical doc.
  *
  * Three helpers, one job: enforce the stdout/stderr/exit-code discipline

package/dist/services/hooks/output.js

@@ -1,5 +1,4 @@
 /**
- * Slice 003-2026-06-16-hook-governance — single source of truth for the
  * peaks hook output contract. See `.claude/HOOKS.md` for the canonical doc.
  *
  * Three helpers, one job: enforce the stdout/stderr/exit-code discipline

package/dist/services/hooks/pre-tool-code-gate.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-08-06-codegate-vendor-neutral — Code-Gate core logic.
  *
  * Vendor-neutral PreToolUse gate. Reads the standard `{tool, input}`
  * JSON hook payload (any IDE / harness using this protocol is

package/dist/services/hooks/pre-tool-code-gate.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-08-06-codegate-vendor-neutral — Code-Gate core logic.
  *
  * Vendor-neutral PreToolUse gate. Reads the standard `{tool, input}`
  * JSON hook payload (any IDE / harness using this protocol is

package/dist/services/hooks/presence-marker-detector.js

@@ -1,7 +1,6 @@
 import { getSessionId } from '../session/session-manager.js';
 import { listPresenceLeases } from '../skills/presence-lease-service.js';
 /**
- * Slice 028 (Q1=A): hook-based skill-presence marker detection.
  *
  * Background: the consumer-facing CLAUDE.md template (rendered by
  * `peaks standards init` / `peaks standards update`) instructs the LLM

package/dist/services/hooks/worktree-authorization-gate.d.ts

@@ -1,5 +1,4 @@
 /**
- * peaks-loop Worktree Authorization Gate (slice 2026-07-27-worktree-user-auth).
  *
  * Project-level red line: no autonomous LLM path is allowed to create a
  * Git worktree, switch Claude Code's Agent isolation to "worktree",
@@ -54,7 +53,6 @@ export type AuthorizationFile = {
 };
 export type WorktreeAuthorization = {
     readonly operation: OperationType;
-    /** Free-form description (e.g. "rd sub-agent for rid-006"). Echoed in deny reasons for traceability. */
     readonly reason: string;
     /** 16-hex SHA-1 prefix of the prompt at grant time. Optional; the gate may match by operation only. */
     readonly promptHash: string | null;
@@ -134,7 +132,6 @@ export type WorktreeAuthCheckInput = {
      */
     readonly leaseId: string | null;
     /**
-     * Slice 2026-07-29-worktree-l2-extended Part 19: L4 container
      * lease id (parallel to `leaseId` for container isolation).
      * `PEAKS_CONTAINER_LEASE_ID` env is the canonical source.
      * Permits docker / podman tool calls when the container lease

package/dist/services/hooks/worktree-authorization-gate.js

@@ -1,5 +1,4 @@
 /**
- * peaks-loop Worktree Authorization Gate (slice 2026-07-27-worktree-user-auth).
  *
  * Project-level red line: no autonomous LLM path is allowed to create a
  * Git worktree, switch Claude Code's Agent isolation to "worktree",

package/dist/services/ide/adapters/claude-code-adapter.d.ts

@@ -1,42 +1,9 @@
 import type { IdeAdapter } from '../ide-types.js';
+import { resolveClaudeTranscriptPath } from './claude-code-local-state.js';
+import { modelContextWindowTokens, resolveClaudeModelFromEnv } from './claude-code-model-window.js';
+export { resolveClaudeTranscriptPath };
+export { modelContextWindowTokens, resolveClaudeModelFromEnv };
 /**
- * Resolve the absolute path of a Claude Code transcript jsonl by OUTER
- * session id, searching `~/.claude/projects/**` recursively.
- *
- * Exported (slice 2026-09-10-context-audit-and-discipline, Slice A) so
- * `peaks code context-audit` reuses THIS locator instead of re-implementing
- * the recursive find. Returns `null` when the transcript does not exist —
- * callers MUST treat that as "unavailable", never as an error.
- */
-export declare function resolveClaudeTranscriptPath(outerSessionId: string, projectsDir?: string): string | null;
-/**
- * Resolve the currently-active Claude Code model id from a runtime env map.
- * Returns the first non-empty `CLAUDE_CODE_MODEL_ENV_VARS` value (trimmed), or
- * `undefined` when none is present. Pure + exported for tests; the caller falls
- * back to the transcript `message.model` when this returns undefined.
- */
-export declare function resolveClaudeModelFromEnv(env: NodeJS.ProcessEnv | undefined): string | undefined;
-/**
- * Model-aware context-window size in tokens.
- *
- * Detection rule (documented):
- *   1. Empty / unknown model → DEFAULT_CONTEXT_WINDOW_TOKENS (200_000).
- *   2. Suffix heuristic — a model id containing `1m` (case-insensitive) is
- *      treated as 1M-context.
- *   3. Explicit allowlist — known 1M Claude model ids
- *      (ONE_MILLION_CONTEXT_MODELS).
- *   4. Everything else → 200_000 (the safe default).
- *
- * Callers MAY additionally infer ≥1M from the observed token count: if
- * `contextTokens > DEFAULT_CONTEXT_WINDOW_TOKENS`, the model cannot be a
- * 200K model and must be ≥1M (see `readClaudeTranscriptEstimate`).
- *
- * This is the HEURISTIC layer only. Explicit user overrides sit ABOVE it —
- * see `resolveContextWindow`, which is what the probe actually calls.
- */
-export declare function modelContextWindowTokens(model: string): number;
-/**
- * Slice 2026-09-09-context-window-override: vendor-neutral escape hatch for
  * the context-window size in tokens. Third-party / proxied models whose id
  * carries no `[1M]` suffix (and is absent from the hardcoded allowlist) are
  * otherwise stuck at the 200K default, which inflates `ratio` up to 5×.
@@ -73,7 +40,6 @@ export interface ContextWindowOverrides {
      * (`auto-compact-reader.ts` via `harness-window-config.ts`), NOT here: the
      * settings path and the key name are per-IDE declarations.
      *
-     * Slice 2026-09-13-auto-compact-trigger-ownership: this layer is what makes
      * the ratio peaks-loop computes and the window the harness compacts against
      * THE SAME NUMBER. Without it they are two independent resolutions that can
      * drift 5× apart on a 1M-window model the model-name heuristic misses.
@@ -100,7 +66,6 @@ export interface ContextWindowOverrides {
     readonly onAboveModelEstimate?: ((message: string) => void) | undefined;
 }
 /**
- * E2 (rid 2026-09-13-defects-e) — the notice for a pin larger than
  * peaks-loop's model-window estimate. `null` when there is nothing to say.
  *
  * WHY THIS EXISTS. The harness does not take its auto-compact window on faith:
@@ -158,7 +123,6 @@ export declare function parseContextWindowOverride(raw: unknown): number | null;
  * An invalid explicit override is ignored with a warning and falls through
  * to the next layer — a typo must never crash or silently win the probe.
  *
- * Slice 2026-09-13-auto-compact-trigger-ownership — why layer 3 exists:
  *   The hard constraint is that the window peaks-loop divides by must BE the
  *   window it configured for the harness. Layer 3 is peaks-loop's own output
  *   read back from the harness's settings file, so the two sides reference one