peaks-cli 1.4.2 → 2.0.1

package/dist/src/services/skills/skill-runbook-service.js

@@ -1,4 +1,5 @@
 import { dirname, join } from 'node:path';
+import * as path from 'node:path';
 import { readText } from '../../shared/fs.js';
 import { loadSkillRegistry } from './skill-registry.js';
 const DESTRUCTIVE_APPLY_PATTERNS = [
@@ -12,8 +13,25 @@ const DESTRUCTIVE_APPLY_PATTERNS = [
 const AUTHORIZATION_KEYWORDS_PATTERN = /authoriz|explicit|--dry-run|approv|only after|only when/i;
 const PEAKS_COMMAND_LINE_PATTERN = /^\s*peaks\s+\w/;
 function extractRunbookSection(body) {
-    const match = /## Default runbook\n+([\s\S]*?)(?=\n## |$)/.exec(body);
-    return match === null ? null : match[1];
+    // Find a `## Default runbook` heading at the start of a line, then capture
+    // the section body up to the next `## ` heading or end of input.
+    //
+    // Implementation note: we avoid a regex with a multiline `(?=\n## |$)`
+    // lookahead because the `m` flag turns `$` into "end of any line" in
+    // JavaScript, which would let the lazy capture stop at the first `\n`.
+    // Instead, we (a) use the regex only to locate the heading, then (b)
+    // manually scan forward for the next `## ` heading or end of input.
+    const headingRe = /^## Default runbook[^\n]*(?:\n|$)/m;
+    const headingMatch = headingRe.exec(body);
+    if (headingMatch === null)
+        return null;
+    const startAfter = headingMatch.index + headingMatch[0].length;
+    const rest = body.slice(startAfter);
+    // Find the next `## ` heading at the start of a line.
+    const nextHeadingRe = /^## /m;
+    const nextMatch = nextHeadingRe.exec(rest);
+    const end = nextMatch === null ? rest.length : nextMatch.index;
+    return rest.slice(0, end);
 }
 /**
  * Load the runbook section, falling back to `references/runbook.md` if the
@@ -32,15 +50,31 @@ function extractRunbookSection(body) {
  */
 async function loadRunbookSection(skillPath, body) {
     const inline = extractRunbookSection(body);
-    const refPath = join(dirname(skillPath), 'references', 'runbook.md');
-    let refSection = null;
-    try {
-        const refBody = await readText(refPath);
-        refSection = extractRunbookSection(refBody);
-    }
-    catch {
-        // reference file does not exist or is not readable
+    const skillDir = dirname(skillPath);
+    // Try multiple reference filenames. Convention: each skill may name its
+    // runbook file `runbook.md` (the generic name, used by peaks-solo), or
+    // `<role>-runbook.md` (the role-suffixed name, used by peaks-rd → rd-runbook.md,
+    // peaks-qa → qa-runbook.md, etc.). Prefer the longest extracted section.
+    const refCandidates = [
+        join(skillDir, 'references', 'runbook.md'),
+        join(skillDir, 'references', `${path.basename(skillDir).replace(/^peaks-/, '')}-runbook.md`)
+    ];
+    let bestRef = null;
+    for (const refPath of refCandidates) {
+        try {
+            const refBody = await readText(refPath);
+            const refSection = extractRunbookSection(refBody);
+            if (refSection === null)
+                continue;
+            if (bestRef === null || refSection.length > bestRef.length) {
+                bestRef = refSection;
+            }
+        }
+        catch {
+            // candidate not present or unreadable; try the next one
+        }
     }
+    const refSection = bestRef;
     if (inline === null)
         return refSection;
     if (refSection === null)

package/dist/src/services/skills/sync-service.d.ts

@@ -0,0 +1,86 @@
+import type { IdeId } from '../ide/ide-types.js';
+/**
+ * The 8 platforms per Slice #12 final piece. Slice #0.7 + Slice
+ * #0.5.2 registered these in the IdeId union; this list is the
+ * single source of truth for the sync fan-out.
+ */
+export declare const SYNC_PLATFORMS: readonly IdeId[];
+export interface PlatformSyncResult {
+    /** The platform that was attempted. */
+    readonly platform: IdeId;
+    /** True if installBundledSkills returned without error. */
+    readonly ok: boolean;
+    /** Skills newly symlinked (idempotent re-runs return []). */
+    readonly installed: readonly string[];
+    /** Skills whose target was not a managed symlink (third-party owned). */
+    readonly skipped: readonly string[];
+    /** Error message; present when ok=false. */
+    readonly error?: string;
+    /** Wall-clock duration in ms. */
+    readonly durationMs: number;
+}
+export interface SyncServiceInput {
+    readonly projectRoot: string;
+    /** When omitted, the service iterates all 8 platforms. */
+    readonly platforms?: readonly IdeId[] | undefined;
+    /** When true, the installer is invoked in dry-run mode. */
+    readonly dryRun?: boolean | undefined;
+}
+export interface SyncServiceResult {
+    readonly applied: boolean;
+    readonly dryRun: boolean;
+    readonly projectRoot: string;
+    readonly perPlatform: readonly PlatformSyncResult[];
+    readonly syncedCount: number;
+    readonly failedCount: number;
+    readonly totalInstalled: number;
+}
+interface InstallBundledSkillsOptions {
+    readonly ideId: IdeId;
+    readonly projectRoot: string;
+    readonly dryRun?: boolean;
+    readonly targetRoot?: string;
+}
+interface InstallResult {
+    readonly installed: readonly string[];
+    readonly skipped: readonly string[];
+}
+type InstallerFn = (opts: InstallBundledSkillsOptions) => InstallResult;
+/**
+ * Resolve the path of `install-skills.mjs` inside the peaks-cli
+ * install root, walking up from `import.meta.url` until a
+ * `package.json` with `"name": "peaks-cli"` is found. Returns
+ * `null` when peaks-cli is not on the import path or the script
+ * is absent (e.g. a partial install).
+ */
+export declare function resolvePeaksCliInstallerPath(): string | null;
+/**
+ * Test seam: attempt to import the installer at `scriptPath`.
+ * Returns the `installBundledSkills` function on success, or
+ * `null` when the file is missing / not importable. The
+ * production code calls this through `loadInstaller`; tests
+ * `vi.spyOn` it to drive the three-tier probe without touching
+ * the real filesystem.
+ */
+export declare function loadInstallerForTest(scriptPath: string): Promise<InstallerFn | null>;
+/**
+ * Validate a single platform id against the SYNC_PLATFORMS
+ * allowlist. Throws on a bogus value.
+ */
+export declare function assertValidPlatform(platform: string): asserts platform is IdeId;
+export declare function runSkillSync(input: SyncServiceInput): Promise<SyncServiceResult>;
+/**
+ * Test-only export surface. Not part of the public API; subject
+ * to breaking changes without a major version bump.
+ *
+ * The seam exposes the `services` indirection table (so tests
+ * can `vi.spyOn` the resolver and loader) and a cache reset.
+ */
+export declare const __testing: {
+    services: {
+        resolvePeaksCliInstallerPath(): string | null;
+        loadInstallerForTest(scriptPath: string): Promise<InstallerFn | null>;
+    };
+    resetInstallerCache(): void;
+};
+export {};

package/dist/src/services/skills/sync-service.js

@@ -0,0 +1,271 @@
+/**
+ * peaks skill sync — fan-out the peaks-* skill family to all 8
+ * supported LLM-CLI platforms. Per spec §9 line 1105 (Slice #12
+ * final piece): "peaks skills sync 8 平台分发".
+ *
+ * The 8 target platforms are enumerated by the `IdeId` union
+ * (src/services/ide/ide-types.ts:16-24). The per-IDE install
+ * profile is `IdeSkillInstall`; the actual symlink installer
+ * is `scripts/install-skills.mjs::installBundledSkills` (dynamically
+ * imported so this module does not require a build step).
+ *
+ * Slice 2.0.1-bug2-skill-sync-fallback: when peaks-cli is
+ * installed from npm into a consumer project, that consumer's
+ * CWD does not contain `scripts/install-skills.mjs`. The previous
+ * hard-coded `join(process.cwd(), 'scripts', 'install-skills.mjs')`
+ * therefore threw `ERR_MODULE_NOT_FOUND` in every consumer run.
+ * The fix is a three-tier probe:
+ *   1. peaks-cli's own install path (resolved from
+ *      `import.meta.url` walking up to the package root, or
+ *      from `process.argv[1]` for CJS-equivalent entrypoints),
+ *   2. the consumer CWD (`<cwd>/scripts/install-skills.mjs`),
+ *   3. graceful skip — warn once per process, return a no-op
+ *      installer so the per-platform result is `ok: true` with
+ *      `installed: []` and a `skipped` rationale.
+ */
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve as resolvePath } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+/**
+ * The 8 platforms per Slice #12 final piece. Slice #0.7 + Slice
+ * #0.5.2 registered these in the IdeId union; this list is the
+ * single source of truth for the sync fan-out.
+ */
+export const SYNC_PLATFORMS = [
+    'claude-code',
+    'trae',
+    'codex',
+    'cursor',
+    'qoder',
+    'tongyi-lingma',
+    'hermes',
+    'openclaw',
+];
+/**
+ * Sentinel: the resolver ran, found no installer, and warned.
+ * Memoized so subsequent `loadInstaller()` calls short-circuit
+ * without re-walking the filesystem on every platform iteration.
+ */
+const NO_INSTALLER_SENTINEL = Symbol('sync-service.no-installer');
+/**
+ * Cache state: either an installer function, the "not found"
+ * sentinel, or `null` (cache cold, first probe still pending).
+ */
+let cachedInstaller = null;
+/**
+ * No-op installer used when neither candidate path resolves to
+ * an importable `install-skills.mjs`. Reports zero installs and
+ * a single skip reason so the per-platform result is `ok: true`
+ * with an explainable `skipped` line.
+ */
+function noopInstaller(_opts) {
+    return {
+        installed: [],
+        skipped: [
+            'install-skills.mjs not found in project; skill sync skipped — bundled skills are installed via peaks-cli postinstall',
+        ],
+    };
+}
+/**
+ * Internal indirection table for the test seam. The production
+ * `loadInstaller` reads `services.resolvePeaksCliInstallerPath()`
+ * and `services.loadInstallerForTest()` at call time, so a
+ * `vi.spyOn(services, 'resolvePeaksCliInstallerPath')` in tests
+ * takes effect (ES module top-level `const` captures the original
+ * reference and would bypass the spy).
+ */
+const services = {
+    resolvePeaksCliInstallerPath,
+    loadInstallerForTest,
+};
+/**
+ * Resolve the path of `install-skills.mjs` inside the peaks-cli
+ * install root, walking up from `import.meta.url` until a
+ * `package.json` with `"name": "peaks-cli"` is found. Returns
+ * `null` when peaks-cli is not on the import path or the script
+ * is absent (e.g. a partial install).
+ */
+export function resolvePeaksCliInstallerPath() {
+    const candidates = [];
+    // Tier 1a: walk up from this module's URL.
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        let cursor = here;
+        for (let depth = 0; depth < 8; depth += 1) {
+            const pkgJson = join(cursor, 'package.json');
+            if (existsSync(pkgJson)) {
+                candidates.push(join(cursor, 'scripts', 'install-skills.mjs'));
+                break;
+            }
+            const parent = dirname(cursor);
+            if (parent === cursor)
+                break;
+            cursor = parent;
+        }
+    }
+    catch {
+        // import.meta.url may be unavailable in some bundlers; fall through.
+    }
+    // Tier 1b: process.argv[1] (the entrypoint). Useful when this
+    // module is bundled or shimmed.
+    try {
+        const argvEntry = process.argv[1];
+        if (typeof argvEntry === 'string' && argvEntry.length > 0) {
+            let cursor = resolvePath(dirname(argvEntry));
+            for (let depth = 0; depth < 8; depth += 1) {
+                const pkgJson = join(cursor, 'package.json');
+                if (existsSync(pkgJson)) {
+                    candidates.push(join(cursor, 'scripts', 'install-skills.mjs'));
+                    break;
+                }
+                const parent = dirname(cursor);
+                if (parent === cursor)
+                    break;
+                cursor = parent;
+            }
+        }
+    }
+    catch {
+        // process.argv may be unavailable in some runtimes; fall through.
+    }
+    for (const candidate of candidates) {
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * Test seam: attempt to import the installer at `scriptPath`.
+ * Returns the `installBundledSkills` function on success, or
+ * `null` when the file is missing / not importable. The
+ * production code calls this through `loadInstaller`; tests
+ * `vi.spyOn` it to drive the three-tier probe without touching
+ * the real filesystem.
+ */
+export async function loadInstallerForTest(scriptPath) {
+    try {
+        const mod = (await import(pathToFileURL(scriptPath).href));
+        return mod.installBundledSkills;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve and load the installer, memoizing the outcome.
+ * Three-tier probe (peaks-cli install path → CWD → no-op),
+ * with the "not found" outcome memoized as a sentinel so the
+ * warning is logged at most once per process.
+ *
+ * The probe delegates to the `services` indirection table so
+ * tests can `vi.spyOn(services, 'resolvePeaksCliInstallerPath')`
+ * and have the spied value take effect at runtime (direct
+ * module-level calls would bind the original function at load
+ * time and bypass the spy).
+ */
+async function loadInstaller() {
+    if (cachedInstaller === NO_INSTALLER_SENTINEL) {
+        return noopInstaller;
+    }
+    if (cachedInstaller !== null) {
+        return cachedInstaller;
+    }
+    // Tier 1: peaks-cli install path.
+    const peaksCliScript = services.resolvePeaksCliInstallerPath();
+    if (peaksCliScript !== null) {
+        const installer = await services.loadInstallerForTest(peaksCliScript);
+        if (installer !== null) {
+            cachedInstaller = installer;
+            return installer;
+        }
+    }
+    // Tier 2: consumer CWD.
+    const cwdScript = join(process.cwd(), 'scripts', 'install-skills.mjs');
+    const cwdInstaller = await services.loadInstallerForTest(cwdScript);
+    if (cwdInstaller !== null) {
+        cachedInstaller = cwdInstaller;
+        return cwdInstaller;
+    }
+    // Tier 3: graceful skip. Warn once per process.
+    cachedInstaller = NO_INSTALLER_SENTINEL;
+    // eslint-disable-next-line no-console -- intentional user-visible signal
+    console.warn('peaks skill sync: install-skills.mjs not found in project; ' +
+        'skipping (bundled skills come from peaks-cli postinstall).');
+    return noopInstaller;
+}
+/**
+ * Validate a single platform id against the SYNC_PLATFORMS
+ * allowlist. Throws on a bogus value.
+ */
+export function assertValidPlatform(platform) {
+    if (!SYNC_PLATFORMS.includes(platform)) {
+        throw new Error(`peaks skill sync: unknown platform "${platform}". ` +
+            `Valid platforms: ${SYNC_PLATFORMS.join(', ')}`);
+    }
+}
+export async function runSkillSync(input) {
+    const platforms = input.platforms ?? SYNC_PLATFORMS;
+    for (const p of platforms) {
+        assertValidPlatform(p);
+    }
+    const dryRun = input.dryRun === true;
+    const installer = await loadInstaller();
+    const perPlatform = [];
+    let syncedCount = 0;
+    let failedCount = 0;
+    let totalInstalled = 0;
+    for (const platform of platforms) {
+        const start = Date.now();
+        try {
+            const result = installer({
+                ideId: platform,
+                projectRoot: input.projectRoot,
+                ...(dryRun ? { dryRun: true } : {}),
+            });
+            perPlatform.push({
+                platform,
+                ok: true,
+                installed: result.installed,
+                skipped: result.skipped,
+                durationMs: Date.now() - start,
+            });
+            syncedCount += 1;
+            totalInstalled += result.installed.length;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            perPlatform.push({
+                platform,
+                ok: false,
+                installed: [],
+                skipped: [],
+                error: message,
+                durationMs: Date.now() - start,
+            });
+            failedCount += 1;
+        }
+    }
+    return {
+        applied: !dryRun,
+        dryRun,
+        projectRoot: input.projectRoot,
+        perPlatform,
+        syncedCount,
+        failedCount,
+        totalInstalled,
+    };
+}
+/**
+ * Test-only export surface. Not part of the public API; subject
+ * to breaking changes without a major version bump.
+ *
+ * The seam exposes the `services` indirection table (so tests
+ * can `vi.spyOn` the resolver and loader) and a cache reset.
+ */
+export const __testing = {
+    services,
+    resetInstallerCache() {
+        cachedInstaller = null;
+    },
+};

package/dist/src/services/slice/slice-check-service.js

@@ -1,17 +1,55 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { isDirectory } from '../../shared/fs.js';
 import { getCurrentChangeId } from '../../shared/change-id.js';
 import { verifyPipeline } from '../workflow/pipeline-verify-service.js';
-function runCommand(command, args, cwd, timeoutMs) {
+import { findMockViolations } from '../audit/enforcers/mock-placement.js';
+import { runRedLinesAudit } from '../audit/red-lines-service.js';
+/**
+ * Resolve a CLI binary to a project-local path, falling back to
+ * the system `npx`. pnpm (and npm/yarn) all create
+ * `node_modules/.bin/<name>`:
+ *
+ *   - On Unix, this is a symlink to the package's executable.
+ *   - On Windows, this is a `.cmd` shim; `execFileSync` only
+ *     resolves `.cmd` through the shell (PATHEXT), so we pass
+ *     `shell: true` when invoking one. Without this, the
+ *     Windows `npx ENOENT` false-positive from
+ *     observations 2317 + 2792 reproduces for every local
+ *     binary.
+ *
+ * Returns the command + args + a `shell` flag that the
+ * `runCommand` helper threads into `execFileSync`.
+ */
+function resolveLocalBinary(projectRoot, name) {
+    // pnpm creates `node_modules/.bin/<name>` (symlink on Unix,
+    // `.cmd` shim on Windows). We probe both shapes; the
+    // `process.platform === 'win32'` extension probe is the most
+    // portable approach.
+    const isWin = process.platform === 'win32';
+    const candidateNames = isWin ? [`${name}.cmd`, `${name}.ps1`, `${name}`] : [name];
+    for (const candidate of candidateNames) {
+        const cmdPath = join(projectRoot, 'node_modules', '.bin', candidate);
+        if (existsSync(cmdPath)) {
+            return { command: cmdPath, args: [], shell: isWin };
+        }
+    }
+    // Fallback: system npx. On Windows this still has the ENOENT
+    // issue, but the fallback is at least informative when it
+    // fires (the user can see "npx not found" instead of a
+    // silent exit 1).
+    return { command: 'npx', args: [name], shell: false };
+}
+function runCommand(command, args, cwd, timeoutMs, shell = false) {
     const start = Date.now();
     try {
         const stdout = execFileSync(command, args, {
             cwd,
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: timeoutMs,
-            maxBuffer: 32 * 1024 * 1024
+            maxBuffer: 32 * 1024 * 1024,
+            shell
         }).toString('utf8');
         return {
             status: 'pass',
@@ -41,11 +79,17 @@ function tailLines(text, max) {
 }
 async function runTypecheck(projectRoot) {
     const start = Date.now();
-    const result = runCommand('npx', ['tsc', '--noEmit'], projectRoot, 180_000);
+    // Per Windows npx ENOENT (observations 2317+2792 from
+    // 2026-06-09), prefer the project-local `node_modules/.bin/tsc`
+    // (symlink on Unix, .cmd on Windows). The local binary is
+    // installed by pnpm at workspace-install time and avoids the
+    // npx PATH-lookup issue.
+    const tsc = resolveLocalBinary(projectRoot, 'tsc');
+    const result = runCommand(tsc.command, [...tsc.args, '--noEmit'], projectRoot, 180_000, tsc.shell);
     const testFiles = result.stdout.match(/(tests?\/.*\.test\.ts)/g) ?? [];
     return {
         name: 'typecheck',
-        description: 'npx tsc --noEmit (no JS emit, type-only check)',
+        description: `${tsc.command} --noEmit (no JS emit, type-only check)`,
         status: result.status,
         durationMs: result.durationMs,
         detail: result.status === 'pass'
@@ -76,13 +120,17 @@ async function runUnitTests(projectRoot, runTests) {
     // state. Opt-in to the full suite via `runTests: true` (CLI flag
     // `--run-tests`). See `references/runbook.md` for the rationale and
     // `tests/unit/slice-check-service.test.ts` for the regression net.
-    const args = runTests
-        ? ['vitest', 'run', '--reporter=default', '--coverage=false']
-        : ['vitest', 'run', '--changed', '--reporter=default', '--coverage=false'];
+    // Per Windows npx ENOENT (observations 2317+2792), resolve
+    // the project-local vitest binary instead of shelling out
+    // through npx.
+    const vitest = resolveLocalBinary(projectRoot, 'vitest');
+    const vitestArgs = runTests
+        ? ['run', '--reporter=default', '--coverage=false']
+        : ['run', '--changed', '--reporter=default', '--coverage=false'];
     const description = runTests
-        ? 'npx vitest run (full test suite, coverage off)'
-        : 'npx vitest run --changed (tests for git-changed files only, coverage off)';
-    const result = runCommand('npx', args, projectRoot, 600_000);
+        ? `${vitest.command} run (full test suite, coverage off)`
+        : `${vitest.command} run --changed (tests for git-changed files only, coverage off)`;
+    const result = runCommand(vitest.command, [...vitest.args, ...vitestArgs], projectRoot, 600_000, vitest.shell);
     const summary = parseVitestSummary(result.stdout, result.durationMs);
     // Vitest doesn't always print the per-bucket counts cleanly; infer "passed"
     // as total - failed - skipped when failed/skipped buckets are present.
@@ -225,7 +273,7 @@ export async function sliceCheck(options) {
     if (options.skipTests) {
         stages.push({
             name: 'unit-tests',
-            description: 'npx vitest run (skipped per --skip-tests)',
+            description: 'vitest run (skipped per --skip-tests)',
             status: 'skipped',
             durationMs: 0,
             detail: 'Skipped: --skip-tests was set. Use the peaks-solo-test skill to run the full suite manually.'
@@ -244,7 +292,7 @@ export async function sliceCheck(options) {
             const failureCount = unitTests.data?.failed ?? 0;
             stages.push({
                 name: 'unit-tests',
-                description: `npx vitest run ${options.runTests === true ? '' : '--changed '} (overridden via --allow-pre-existing-failures)`.trim(),
+                description: `vitest run ${options.runTests === true ? '' : '--changed '} (overridden via --allow-pre-existing-failures)`.trim(),
                 status: 'skipped',
                 durationMs: unitTests.durationMs,
                 detail: `pre-existing failures: ${failureCount} failing test(s) under coverage.exclude or unrelated to this slice; user opted in via --allow-pre-existing-failures. For the long-term fix, mark these tests .skip or move to coverage.exclude (see dogfood-2-f1-f4.md F17c).`,
@@ -261,6 +309,17 @@ export async function sliceCheck(options) {
     stages.push(await runReviewFanout(options.projectRoot, rid, options.refreshFanout));
     // Stage 4: gate verify-pipeline
     stages.push(await runGateVerifyPipeline(options.projectRoot, rid, rid));
+    // Stage 5: mock-placement (L2.1 P0 #5) — refuse inline mock data in src/ or skills/.
+    // Lifts changed files via `git diff --name-only HEAD`; falls back to a
+    // warning when the diff is empty (e.g. a fresh tree). Lighter than the
+    // full `peaks scan diff-vs-scope` and keeps the slice check self-contained.
+    stages.push(await runMockPlacement(options.projectRoot));
+    // Stage 6 (Slice #7 L2.4 P2-b): audit-regression — assert
+    // catalog integrity (no orphan enforcers, no orphan catalog
+    // entries), catalog size lower bound, and runtime budget.
+    // The stage runs `peaks audit red-lines` in-process (no
+    // subprocess) and is gating: failure exits non-zero.
+    stages.push(await runAuditRegression(options.projectRoot));
     const boundaryReady = stages.every((s) => s.status === 'pass' || s.status === 'skipped');
     const nextActions = [];
     if (!boundaryReady) {
@@ -283,3 +342,97 @@ export async function sliceCheck(options) {
         nextActions
     };
 }
+async function runAuditRegression(projectRoot) {
+    const start = Date.now();
+    try {
+        const result = runRedLinesAudit({ projectRoot });
+        const durationMs = Date.now() - start;
+        // Slice #7 L2.4 P2-b acceptance A3 + A4:
+        //   - totalRedLines >= 60 (catalog grew to 66; pins the lower bound)
+        //   - enforcerFindings has no rl-audit-no-orphan-enforcer / rl-audit-no-orphan-catalog hits
+        const issues = [];
+        if (result.audit.totalRedLines < 60) {
+            issues.push(`totalRedLines ${result.audit.totalRedLines} < 60`);
+        }
+        const orphanFindings = result.audit.enforcerFindings.filter((f) => f.enforcerId === 'rl-audit-no-orphan-enforcer-001' ||
+            f.enforcerId === 'rl-audit-no-orphan-catalog-001');
+        if (orphanFindings.length > 0) {
+            issues.push(`${orphanFindings.length} orphan-enforcer / orphan-catalog finding(s)`);
+        }
+        if (issues.length > 0) {
+            return {
+                name: 'audit-regression',
+                description: 'audit-regression: catalog integrity + runtime budget (L2.4 P2-b stage 6)',
+                status: 'fail',
+                durationMs,
+                detail: issues.join('; '),
+            };
+        }
+        return {
+            name: 'audit-regression',
+            description: 'audit-regression: catalog integrity + runtime budget (L2.4 P2-b stage 6)',
+            status: 'pass',
+            durationMs,
+            detail: `catalog: ${result.audit.totalRedLines} entries (${result.audit.cliBacked} cli-backed, ${result.audit.proseOnly} prose-only); audit ran in ${durationMs}ms`,
+        };
+    }
+    catch (error) {
+        return {
+            name: 'audit-regression',
+            description: 'audit-regression: catalog integrity + runtime budget (L2.4 P2-b stage 6)',
+            status: 'fail',
+            durationMs: Date.now() - start,
+            detail: 'audit-regression failed: ' + (error?.message ?? String(error)),
+        };
+    }
+}
+async function runMockPlacement(projectRoot) {
+    const start = Date.now();
+    // List changed files via git. `--name-only` produces one path per line;
+    // we filter to text files in scope and read each.
+    const diffResult = runCommand('git', ['diff', '--name-only', '--diff-filter=ACMR', 'HEAD'], projectRoot, 30_000);
+    if (diffResult.status !== 'pass') {
+        return {
+            name: 'mock-placement',
+            description: 'mock-placement: no inline mock data in src/ or skills/ (L2.1 P0 #5)',
+            status: 'skipped',
+            durationMs: Date.now() - start,
+            detail: 'git diff failed or returned no changed files; mock-placement scan skipped.'
+        };
+    }
+    const changed = diffResult.stdout
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
+    if (changed.length === 0) {
+        return {
+            name: 'mock-placement',
+            description: 'mock-placement: no inline mock data in src/ or skills/ (L2.1 P0 #5)',
+            status: 'skipped',
+            durationMs: Date.now() - start,
+            detail: 'no changed files in HEAD diff; mock-placement scan skipped.'
+        };
+    }
+    const files = changed
+        .filter((p) => p.startsWith('src/') || p.startsWith('skills/'))
+        .filter((p) => p.endsWith('.ts') || p.endsWith('.tsx') || p.endsWith('.js') || p.endsWith('.mjs'))
+        .map((filePath) => {
+        const abs = join(projectRoot, filePath);
+        if (!existsSync(abs))
+            return null;
+        const content = readFileSync(abs, 'utf-8');
+        return { filePath, content };
+    })
+        .filter((f) => f !== null);
+    const violations = findMockViolations(files);
+    return {
+        name: 'mock-placement',
+        description: 'mock-placement: no inline mock data in src/ or skills/ (L2.1 P0 #5)',
+        status: violations.length === 0 ? 'pass' : 'fail',
+        durationMs: Date.now() - start,
+        detail: violations.length === 0
+            ? `Scanned ${files.length} changed file(s); no inline mock data found.`
+            : `${violations.length} violation(s): ${violations.map((v) => `${v.filePath} (${v.snippet})`).join('; ')}`,
+        data: { scannedFiles: files.length, violations: violations.map((v) => ({ filePath: v.filePath, pattern: v.pattern, snippet: v.snippet })) }
+    };
+}

package/dist/src/services/slice/slice-check-types.d.ts

@@ -28,7 +28,7 @@
 export type SliceCheckStageStatus = 'pass' | 'fail' | 'skipped';
 export type SliceCheckStage = {
     /** Stable id for the stage (matches the runbook's check list). */
-    name: 'typecheck' | 'unit-tests' | 'review-fanout' | 'gate-verify-pipeline';
+    name: 'typecheck' | 'unit-tests' | 'review-fanout' | 'gate-verify-pipeline' | 'mock-placement' | 'audit-regression';
     /** Human-readable description. */
     description: string;
     status: SliceCheckStageStatus;