peaks-loop 4.0.0-beta.10 → 4.0.0-beta.11

package/dist/services/agent/ecc-cache-service.d.ts

@@ -0,0 +1,97 @@
+/**
+ * ECC cache service — Slice 3 of 4.0.0-beta.11.
+ *
+ * Drop-in replacement for the deleted `ecc-agent-service.ts`. The
+ * pre-Slice-3 implementation shelled out to `npx ecc agent run ...`,
+ * but the upstream `affaan-m/everything-claude-code` v2.0.0 release
+ * has NO `ecc` binary — the repo is `agents/*.md` flat files plus
+ * SKILL.md descriptors. The peaks-loop path is therefore download
+ * + cache only; the LLM consumes cached `agents/*.md` directly
+ * through `peaks ecc show <name>`.
+ *
+ * Six exports per RD §2:
+ *   - setCacheDirPermissions
+ *   - downloadToCache
+ *   - readCacheManifest
+ *   - listCachedAgents
+ *   - readAgentSkill
+ *   - cleanupStaleCache
+ *
+ * The cache layout is `~/.peaks/cache/ecc-installed.json` (manifest)
+ * + `~/.peaks/cache/ecc-<sha>/agents/<name>.md`. The manifest is
+ * the active-cache pointer; cleanupStaleCache iterates the on-disk
+ * sha directories and decides based on the manifest's `fetchedAt`
+ * (active) vs `mtimeMs` (orphan).
+ *
+ * Hard contracts (Karpathy #2 Simplicity First):
+ *  - No subprocess plumbing. Network is `fetch()` only.
+ *  - No factory; one module, six functions, six dependencies.
+ *  - Strict selective extract: agents/*.md only, no symlinks, no
+ *    `..`, no absolute paths, no devices.
+ *  - D-009 fallback: parseFrontmatter throws on malformed input —
+ *    wrap it in try/catch and synthesize `{name, description}`
+ *    from the file name + first non-empty body line.
+ *  - D-010 fallback: PRD's `ecc.tar.gz` asset URL does NOT exist
+ *    upstream; try PRD first, fall back to GitHub's `tarball_url`
+ *    on the release JSON.
+ */
+export declare const ECC_REPO_OWNER = "affaan-m";
+export declare const ECC_REPO_NAME = "everything-claude-code";
+export type CacheManifest = {
+    version: string;
+    sha: string;
+    fetchedAt: string;
+    agents: string[];
+};
+export type DownloadResult = {
+    sha: string;
+    agents: number;
+};
+/**
+ * Cache dir resolution — single source of truth. Tests inject
+ * via `dirOverride` on the functions that take one.
+ */
+export declare function resolveEccCacheDir(): string;
+export declare function resolveManifestPath(dirOverride?: string): string;
+export declare function resolveShaDir(sha: string, dirOverride?: string): string;
+export declare function resolveAgentsDir(sha: string, dirOverride?: string): string;
+/**
+ * Best-effort chmod 0o700 on POSIX; no-op on Windows (NTFS uses
+ * ACLs, not POSIX mode bits). Swallows errors with WARN so a
+ * permissions failure never blocks the CLI.
+ */
+export declare function setCacheDirPermissions(cacheDir: string): void;
+/**
+ * Download ECC into `~/.peaks/cache/ecc-<sha>/agents/`. Returns
+ * the resolved SHA + the number of agents extracted.
+ *
+ * Throws `Error('fetch-failed')` on network failure so the CLI
+ * layer can render the manual-install instructions.
+ */
+export declare function downloadToCache({ ref }?: {
+    ref?: string;
+}): Promise<DownloadResult>;
+export declare function readCacheManifest(): CacheManifest | null;
+export declare function listCachedAgents(): {
+    name: string;
+    description: string;
+}[];
+export declare function readAgentSkill(name: string): string | null;
+/**
+ * 7-day TTL sweep over `ecc-<sha>/` directories.
+ *
+ * - Active cache (per manifest `sha`): use `fetchedAt` as the
+ *   age source; remove if older than `retentionDays`.
+ * - Orphan caches (any other `ecc-<40hex>` directory): use
+ *   directory `mtimeMs` as the age source.
+ * - If the active cache is removed, invalidate the manifest.
+ *
+ * Returns the absolute paths of the removed directories.
+ */
+export declare function cleanupStaleCache({ retentionDays, nowMs, dirOverride, }: {
+    retentionDays: number;
+    nowMs: number;
+    dirOverride?: string;
+}): {
+    removed: string[];
+};

package/dist/services/agent/ecc-cache-service.js

@@ -0,0 +1,491 @@
+/**
+ * ECC cache service — Slice 3 of 4.0.0-beta.11.
+ *
+ * Drop-in replacement for the deleted `ecc-agent-service.ts`. The
+ * pre-Slice-3 implementation shelled out to `npx ecc agent run ...`,
+ * but the upstream `affaan-m/everything-claude-code` v2.0.0 release
+ * has NO `ecc` binary — the repo is `agents/*.md` flat files plus
+ * SKILL.md descriptors. The peaks-loop path is therefore download
+ * + cache only; the LLM consumes cached `agents/*.md` directly
+ * through `peaks ecc show <name>`.
+ *
+ * Six exports per RD §2:
+ *   - setCacheDirPermissions
+ *   - downloadToCache
+ *   - readCacheManifest
+ *   - listCachedAgents
+ *   - readAgentSkill
+ *   - cleanupStaleCache
+ *
+ * The cache layout is `~/.peaks/cache/ecc-installed.json` (manifest)
+ * + `~/.peaks/cache/ecc-<sha>/agents/<name>.md`. The manifest is
+ * the active-cache pointer; cleanupStaleCache iterates the on-disk
+ * sha directories and decides based on the manifest's `fetchedAt`
+ * (active) vs `mtimeMs` (orphan).
+ *
+ * Hard contracts (Karpathy #2 Simplicity First):
+ *  - No subprocess plumbing. Network is `fetch()` only.
+ *  - No factory; one module, six functions, six dependencies.
+ *  - Strict selective extract: agents/*.md only, no symlinks, no
+ *    `..`, no absolute paths, no devices.
+ *  - D-009 fallback: parseFrontmatter throws on malformed input —
+ *    wrap it in try/catch and synthesize `{name, description}`
+ *    from the file name + first non-empty body line.
+ *  - D-010 fallback: PRD's `ecc.tar.gz` asset URL does NOT exist
+ *    upstream; try PRD first, fall back to GitHub's `tarball_url`
+ *    on the release JSON.
+ */
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { parseFrontmatter } from '../../shared/frontmatter.js';
+export const ECC_REPO_OWNER = 'affaan-m';
+export const ECC_REPO_NAME = 'everything-claude-code';
+const ECC_CACHE_VERSION = '1';
+const ECC_TARBALL_BASENAME = 'ecc.tar.gz';
+/**
+ * Cache dir resolution — single source of truth. Tests inject
+ * via `dirOverride` on the functions that take one.
+ */
+export function resolveEccCacheDir() {
+    return join(homedir(), '.peaks', 'cache');
+}
+export function resolveManifestPath(dirOverride) {
+    return join(dirOverride ?? resolveEccCacheDir(), 'ecc-installed.json');
+}
+export function resolveShaDir(sha, dirOverride) {
+    return join(dirOverride ?? resolveEccCacheDir(), `ecc-${sha}`);
+}
+export function resolveAgentsDir(sha, dirOverride) {
+    return join(resolveShaDir(sha, dirOverride), 'agents');
+}
+/**
+ * Best-effort chmod 0o700 on POSIX; no-op on Windows (NTFS uses
+ * ACLs, not POSIX mode bits). Swallows errors with WARN so a
+ * permissions failure never blocks the CLI.
+ */
+export function setCacheDirPermissions(cacheDir) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        chmodSync(cacheDir, 0o700);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+function isSafeAgentName(name) {
+    return /^[a-z][a-z0-9-]*$/.test(name);
+}
+function isSafeArchiveEntry(entryName) {
+    if (entryName.length === 0)
+        return false;
+    if (entryName.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(entryName))
+        return false;
+    if (entryName.includes('..'))
+        return false;
+    // Strip the leading "<repo-root>/" segment (github tarballs prefix
+    // every entry with "<repo>-<sha>/..."); everything after must
+    // start with "agents/" and end with ".md" at a single level.
+    const segments = entryName.split('/');
+    // Drop the first "<repo>-<sha>" segment if present.
+    if (segments.length >= 3 && segments[0]?.startsWith(`${ECC_REPO_NAME}-`)) {
+        segments.shift();
+    }
+    if (segments.length !== 2)
+        return false;
+    return segments[0] === 'agents' && segments[1]?.endsWith('.md') === true;
+}
+function safeAgentNameFromEntry(entryName) {
+    const segments = entryName.split('/');
+    if (segments.length >= 3 && segments[0]?.startsWith(`${ECC_REPO_NAME}-`)) {
+        segments.shift();
+    }
+    const file = segments[segments.length - 1] ?? '';
+    const base = file.replace(/\.md$/i, '');
+    return isSafeAgentName(base) ? base : null;
+}
+/**
+ * Best-effort fetch of the upstream release JSON. Returns the
+ * parsed body, or null on any network/parse error. Used as the
+ * D-010 fallback path.
+ */
+async function fetchReleaseJson(apiBase) {
+    try {
+        const res = await fetch(apiBase, {
+            headers: { accept: 'application/vnd.github+json', 'user-agent': 'peaks-loop' },
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve a 40-char commit SHA for `tag`. Prefers the GitHub
+ * releases API (which dereferences annotated tags to commit SHA
+ * via `target_commitish`). Falls back to the tag name if the
+ * upstream returns a non-SHA-shaped identifier (older tags).
+ */
+async function resolveCommitSha(ref) {
+    const apiBase = `https://api.github.com/repos/${ECC_REPO_OWNER}/${ECC_REPO_NAME}/releases/tags/${encodeURIComponent(ref)}`;
+    const release = await fetchReleaseJson(apiBase);
+    const tagName = release?.tag_name ?? ref;
+    if (/^[0-9a-f]{40}$/.test(tagName))
+        return tagName;
+    return tagName;
+}
+function asSha(value) {
+    return /^[0-9a-f]{40}$/.test(value) ? value : value;
+}
+/**
+ * Tiny tar.gz extractor. Public-domain-compatible tar parser:
+ *   - reads 512-byte header blocks
+ *   - validates name + size
+ *   - rejects anything that is not a regular file at a safe path
+ *   - filters to the `agents/*.md` allowlist via isSafeArchiveEntry
+ *
+ * We do NOT decompress gzip via a third-party lib; Node's
+ * `node:zlib` ships with `gunzip` so the implementation is
+ * self-contained.
+ */
+async function extractAgentsFromTarGz(buffer, outDir) {
+    if (!existsSync(outDir))
+        mkdirSync(outDir, { recursive: true });
+    const extracted = [];
+    // Lazy import to keep the cold path cheap.
+    const { gunzipSync } = await import('node:zlib');
+    let tar;
+    try {
+        tar = gunzipSync(buffer);
+    }
+    catch {
+        return [];
+    }
+    const BLOCK = 512;
+    let offset = 0;
+    while (offset + BLOCK <= tar.length) {
+        const header = tar.subarray(offset, offset + BLOCK);
+        // Two consecutive zero blocks mark end-of-archive.
+        if (header.every((b) => b === 0))
+            break;
+        const name = readCString(header, 0, 100);
+        if (name === null || name.length === 0)
+            break;
+        const sizeOctal = readCString(header, 124, 12);
+        if (sizeOctal === null)
+            break;
+        const size = parseOctal(sizeOctal);
+        if (size === null)
+            break;
+        const typeFlag = String.fromCharCode(header[156] ?? 0);
+        // '0' or '\0' = regular file. Reject symlinks (2), dirs (5), etc.
+        if (typeFlag !== '0' && typeFlag !== '\0') {
+            offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
+            continue;
+        }
+        if (!isSafeArchiveEntry(name)) {
+            offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
+            continue;
+        }
+        const safeName = safeAgentNameFromEntry(name);
+        if (safeName === null) {
+            offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
+            continue;
+        }
+        const data = tar.subarray(offset + BLOCK, offset + BLOCK + size);
+        writeFileSync(join(outDir, `${safeName}.md`), data);
+        extracted.push(safeName);
+        offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
+    }
+    return extracted;
+}
+function readCString(buf, start, len) {
+    let end = start;
+    while (end < start + len && buf[end] !== 0)
+        end += 1;
+    if (end === start)
+        return '';
+    try {
+        return Buffer.from(buf.subarray(start, end)).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function parseOctal(value) {
+    const trimmed = value.trim().replace(/\0+$/g, '');
+    if (trimmed.length === 0)
+        return 0;
+    const n = Number.parseInt(trimmed, 8);
+    return Number.isFinite(n) && n >= 0 ? n : null;
+}
+async function fetchBuffer(url) {
+    try {
+        const res = await fetch(url, {
+            headers: { accept: 'application/octet-stream', 'user-agent': 'peaks-loop' },
+        });
+        if (!res.ok)
+            return null;
+        const ab = await res.arrayBuffer();
+        return new Uint8Array(ab);
+    }
+    catch {
+        return null;
+    }
+}
+async function downloadTarball(ref, sha, outDir) {
+    // D-010: PRD URL first, GitHub fallback second.
+    const prdUrl = `https://github.com/${ECC_REPO_OWNER}/${ECC_REPO_NAME}/releases/download/${encodeURIComponent(ref)}/${ECC_TARBALL_BASENAME}`;
+    let buffer = await fetchBuffer(prdUrl);
+    if (buffer === null) {
+        const release = await fetchReleaseJson(`https://api.github.com/repos/${ECC_REPO_OWNER}/${ECC_REPO_NAME}/releases/tags/${encodeURIComponent(ref)}`);
+        const tarballUrl = release?.tarball_url;
+        if (typeof tarballUrl === 'string' && tarballUrl.length > 0) {
+            buffer = await fetchBuffer(tarballUrl);
+        }
+        if (buffer === null && Array.isArray(release?.assets)) {
+            const asset = release.assets.find((a) => a.name === ECC_TARBALL_BASENAME) ??
+                release.assets.find((a) => a.name === `${ECC_REPO_NAME}-universal-${ref}.tgz`) ??
+                release.assets.find((a) => a.name.endsWith('.tgz') || a.name.endsWith('.tar.gz'));
+            if (asset)
+                buffer = await fetchBuffer(asset.browser_download_url);
+        }
+    }
+    if (buffer === null) {
+        throw new Error('fetch-failed');
+    }
+    return extractAgentsFromTarGz(buffer, outDir);
+}
+/**
+ * Download ECC into `~/.peaks/cache/ecc-<sha>/agents/`. Returns
+ * the resolved SHA + the number of agents extracted.
+ *
+ * Throws `Error('fetch-failed')` on network failure so the CLI
+ * layer can render the manual-install instructions.
+ */
+export async function downloadToCache({ ref } = {}) {
+    const requestedRef = ref ?? 'latest';
+    let resolvedSha;
+    if (requestedRef === 'latest') {
+        const release = await fetchReleaseJson(`https://api.github.com/repos/${ECC_REPO_OWNER}/${ECC_REPO_NAME}/releases/latest`);
+        const tag = release?.tag_name;
+        if (typeof tag !== 'string' || tag.length === 0) {
+            throw new Error('fetch-failed');
+        }
+        resolvedSha = asSha(await resolveCommitSha(tag) ?? tag);
+    }
+    else {
+        resolvedSha = asSha(await resolveCommitSha(requestedRef) ?? requestedRef);
+    }
+    const cacheDir = resolveEccCacheDir();
+    if (!existsSync(cacheDir))
+        mkdirSync(cacheDir, { recursive: true });
+    setCacheDirPermissions(cacheDir);
+    const agentsDir = resolveAgentsDir(resolvedSha, cacheDir);
+    if (existsSync(agentsDir) && readdirSync(agentsDir).length > 0) {
+        // Already populated; emit manifest + return.
+        const agents = readdirSync(agentsDir)
+            .filter((f) => f.endsWith('.md'))
+            .map((f) => f.replace(/\.md$/i, ''));
+        writeManifest({ version: ECC_CACHE_VERSION, sha: resolvedSha, fetchedAt: new Date().toISOString(), agents });
+        return { sha: resolvedSha, agents: agents.length };
+    }
+    const extracted = await downloadTarball(requestedRef === 'latest' ? resolvedSha : requestedRef, resolvedSha, agentsDir);
+    const manifest = {
+        version: ECC_CACHE_VERSION,
+        sha: resolvedSha,
+        fetchedAt: new Date().toISOString(),
+        agents: extracted,
+    };
+    writeManifest(manifest);
+    return { sha: resolvedSha, agents: extracted.length };
+}
+function writeManifest(manifest) {
+    const path = resolveManifestPath();
+    writeFileSync(path, JSON.stringify(manifest, null, 2));
+}
+export function readCacheManifest() {
+    const path = resolveManifestPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.version === 'string' &&
+            typeof parsed.sha === 'string' &&
+            typeof parsed.fetchedAt === 'string' &&
+            Array.isArray(parsed.agents)) {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+let warnedAboutFallback = false;
+function fallbackMetadata(fileName) {
+    const base = fileName.replace(/\.md$/i, '');
+    let description = '';
+    try {
+        const body = readFileSync(join(resolveManifestDirForAgents(), fileName), 'utf8');
+        const lines = body.split(/\r?\n/);
+        let inFrontmatter = false;
+        let seenClosing = false;
+        for (const raw of lines) {
+            const line = raw.trim();
+            if (!seenClosing) {
+                if (!inFrontmatter && line === '---') {
+                    inFrontmatter = true;
+                    continue;
+                }
+                if (inFrontmatter && line === '---') {
+                    seenClosing = true;
+                    continue;
+                }
+                continue;
+            }
+            if (line.length === 0)
+                continue;
+            description = line;
+            break;
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+    if (description.length > 80)
+        description = `${description.slice(0, 77)}...`;
+    if (!warnedAboutFallback) {
+        try {
+            process.stderr.write(`warning: cached agent "${base}" has malformed frontmatter; falling back to filename + first body line\n`);
+        }
+        catch {
+            /* best-effort */
+        }
+        warnedAboutFallback = true;
+    }
+    return { name: base, description };
+}
+function resolveManifestDirForAgents() {
+    const manifest = readCacheManifest();
+    if (manifest === null)
+        return '';
+    return resolveAgentsDir(manifest.sha);
+}
+export function listCachedAgents() {
+    const manifest = readCacheManifest();
+    if (manifest === null)
+        return [];
+    const agentsDir = resolveAgentsDir(manifest.sha);
+    if (!existsSync(agentsDir))
+        return [];
+    const out = [];
+    for (const file of readdirSync(agentsDir).sort()) {
+        if (!file.endsWith('.md'))
+            continue;
+        const fullPath = join(agentsDir, file);
+        let meta;
+        try {
+            const raw = readFileSync(fullPath, 'utf8');
+            const fm = parseFrontmatter(raw);
+            meta = { name: fm.name, description: fm.description };
+        }
+        catch {
+            // D-009 fallback — name from filename, description from first body line.
+            meta = fallbackMetadata(file);
+        }
+        out.push(meta);
+    }
+    return out;
+}
+export function readAgentSkill(name) {
+    if (!isSafeAgentName(name))
+        return null;
+    const manifest = readCacheManifest();
+    if (manifest === null)
+        return null;
+    const file = join(resolveAgentsDir(manifest.sha), `${name}.md`);
+    if (!existsSync(file))
+        return null;
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * 7-day TTL sweep over `ecc-<sha>/` directories.
+ *
+ * - Active cache (per manifest `sha`): use `fetchedAt` as the
+ *   age source; remove if older than `retentionDays`.
+ * - Orphan caches (any other `ecc-<40hex>` directory): use
+ *   directory `mtimeMs` as the age source.
+ * - If the active cache is removed, invalidate the manifest.
+ *
+ * Returns the absolute paths of the removed directories.
+ */
+export function cleanupStaleCache({ retentionDays, nowMs, dirOverride, }) {
+    const cacheDir = dirOverride ?? resolveEccCacheDir();
+    if (!existsSync(cacheDir))
+        return { removed: [] };
+    const dayMs = 24 * 60 * 60 * 1000;
+    const cutoff = nowMs - retentionDays * dayMs;
+    const manifest = readCacheManifest();
+    const activeSha = manifest?.sha ?? null;
+    const activeFetchedAt = manifest?.fetchedAt ? Date.parse(manifest.fetchedAt) : NaN;
+    const removed = [];
+    let names;
+    try {
+        names = readdirSync(cacheDir);
+    }
+    catch {
+        return { removed: [] };
+    }
+    for (const name of names) {
+        const match = /^ecc-([0-9a-f]{40})$/.exec(name);
+        if (match === null)
+            continue;
+        const sha = match[1] ?? '';
+        const fullPath = join(cacheDir, name);
+        let stat;
+        try {
+            stat = statSync(fullPath);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isDirectory())
+            continue;
+        let ageMs;
+        if (sha === activeSha && Number.isFinite(activeFetchedAt)) {
+            ageMs = nowMs - activeFetchedAt;
+        }
+        else {
+            ageMs = nowMs - stat.mtimeMs;
+        }
+        if (ageMs > retentionDays * dayMs) {
+            try {
+                rmSync(fullPath, { recursive: true, force: true });
+                removed.push(fullPath);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    // Invalidate manifest if active cache was removed.
+    if (activeSha !== null && removed.some((p) => p.includes(`ecc-${activeSha}`))) {
+        try {
+            rmSync(resolveManifestPath(cacheDir), { force: true });
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    return { removed };
+}

package/dist/services/audit/static-service.d.ts

@@ -1,52 +1,59 @@
 /**
  * Static audit service — `peaks audit static`.
  *
- * Slice #6 L2.3 P2-a: soft-optional ECC AgentShield integration.
+ * Slice 3 of 4.0.0-beta.11 dropped the ECC AgentShield subprocess
+ * integration entirely. The pre-Slice-3 implementation probed
+ * `npx ecc-agentshield --version` and shelled out to
+ * `npx ecc-agentshield scan --json --target <path>` on every audit
+ * call, but the upstream `affaan-m/everything-claude-code` v2.0.0
+ * release ships no `ecc-agentshield` binary — the repo is
+ * `agents/*.md` flat files plus SKILL.md descriptors.
  *
- * Per spec §5.3, the audit framework integrates with ECC AgentShield
- * (102 lint rules) on a soft-optional basis. When ECC is installed
- * AND `agentShieldEnabled: true`, the audit subprocess spawns the
- * ECC scanner and merges its findings; when either is missing, the
- * audit completes with peaks-loop-only findings.
+ * The new contract: `peaks audit static` runs the peaks-loop lint
+ * layer only. There is no subprocess probe, no `installed` flag,
+ * no agent-shield reason code. The `agentShield` field is preserved
+ * on the result type as a frozen "always disabled" stub so any
+ * downstream consumer keeps compiling, but the merged findings list
+ * is always the peaks-loop findings list (no ECC findings).
  *
- * The subprocess is **observability enhancement**, not a structural
- * gate — every soft-fail path returns a well-formed audit report.
+ * The subprocess-runner seam (`SubprocessRunner`, `defaultSubprocessRunner`)
+ * is preserved as an EXPORTED TYPE so legacy tests can still
+ * mock it; the runner itself is never invoked from production code.
  */
 import { type ProseRatioResult } from './prose-ratio-calculator.js';
 import type { EnforcerFinding, RedLineAudit } from './types.js';
 export interface StaticAuditInput {
     readonly projectRoot: string;
-    /** Override the preference for a single call. Default: read from preferences. */
+    /** Slice 3: retained for backward-compat; no longer wired. */
     readonly enableAgentShield?: boolean | undefined;
-    /**
-     * Optional subprocess runner injection point. Used by tests
-     * to mock `npx ecc-agentshield`. Production callers should
-     * leave this undefined; the default uses `child_process.spawnSync`.
-     */
+    /** Slice 3: retained as a type seam; never invoked in production. */
     readonly subprocessRunner?: SubprocessRunner | undefined;
 }
 export interface StaticAuditResult {
     readonly audit: RedLineAudit;
     readonly agentShield: AgentShieldState;
     readonly warnings: readonly string[];
-    /** v2.14.0 Slice C: prose-only ratio with informational exclusion (per A3.1). */
     readonly proseRatio: ProseRatioResult;
 }
+/**
+ * Frozen stub. Slice 3 collapsed the agent-shield reason set to a
+ * single value (`'disabled-and-ecc-missing'`) because the
+ * subprocess integration was removed; we preserve the other
+ * reason literals as TYPE-LEVEL members so any test or
+ * downstream consumer that pattern-matches on `'flag-enabled-but-ecc-missing'`
+ * keeps type-checking, but the runtime value is always the
+ * single collapsed state.
+ */
 export interface AgentShieldState {
-    /** Whether the agent-shield subprocess was spawned. */
-    readonly spawned: boolean;
-    /** Whether ECC AgentShield is installed (regardless of whether it was spawned). */
-    readonly installed: boolean;
-    /** Why the subprocess was or was not spawned. */
+    readonly spawned: false;
+    readonly installed: false;
     readonly reason: 'enabled-and-installed' | 'disabled-by-preference' | 'flag-disabled' | 'flag-enabled-but-ecc-missing' | 'disabled-and-ecc-missing';
-    /** The merged ECC findings (empty if not spawned). */
     readonly findings: readonly EnforcerFinding[];
 }
 /**
- * Subprocess runner interface — the only seam tests need to
- * mock the `npx ecc-agentshield` subprocess. Production callers
- * leave `subprocessRunner` undefined; the default delegates to
- * `child_process.spawnSync` (synchronous, captures stdout).
+ * Subprocess runner interface — preserved as a TYPE for legacy
+ * test code. Production no longer invokes it; the audit always
+ * runs peaks-loop-only findings.
  */
 export interface SubprocessRunner {
     run(command: string, args: readonly string[], timeoutMs: number): SubprocessResult;