peaks-loop 4.0.0-beta.15 → 4.0.0-beta.17

package/CHANGELOG.md

@@ -2,6 +2,78 @@
 
 ## 4.0.0
 
+### Patch Changes
+
+- Updated dependencies
+  - peaks-loop-shared@0.0.5
+  - peaks-loop-audit-independent@0.0.5
+  - peaks-loop-crystallization@0.0.6
+  - peaks-loop-doctor@0.0.5
+  - peaks-loop-final-review@0.0.5
+
+## 4.0.0
+
+### Patch Changes
+
+- Updated dependencies
+  - peaks-loop-shared@0.0.5
+  - peaks-loop-audit-independent@0.0.5
+  - peaks-loop-crystallization@0.0.5
+  - peaks-loop-doctor@0.0.5
+  - peaks-loop-final-review@0.0.5
+
+## 4.0.0-beta.17
+
+### Patch Changes
+
+- Repair registry install: `npm i -g peaks-loop` previously failed with
+  `EUNSUPPORTEDPROTOCOL / workspace:*` because the publish workflow
+  called `npm publish` on each workspace directory directly, which
+  serialized the manifest verbatim and leaked the pnpm-only
+  `workspace:*` protocol into the published tarballs. The new
+  `scripts/release-pack.mjs` packs each workspace package with
+  `pnpm pack` (which rewrites `workspace:*` to exact semver pins) and
+  then publishes the resulting tarball via `npm publish <tarball>` so
+  npm 11+ OIDC Trusted Publishing remains in effect.
+
+  Bumped versions: `peaks-loop` 4.0.0-beta.16 → 4.0.0-beta.17; all
+  eight subpackages 0.0.3 → 0.0.4. The publish workflow's changeset
+  step is now conditional on detected `.changeset/*.md` files so the
+  registry-repair release keeps its manually-pinned versions, and
+  future releases still pick up automated `changeset version` bumps.
+
+  - per-package OIDC Trusted Publisher entries still need to be added
+    once on npmjs.com (one-time UI step per package).
+  - the install smoke verifies the registry tarball surface: bin shim,
+    package layout, postinstall, and registry metadata. `peaks
+--version`/`--help` may fail at runtime until
+    `peaks-loop-crystallization` declares `zod` as a runtime
+    dependency (a separate source bug, out of scope for this repair).
+
+## 4.0.0
+
+### Patch Changes
+
+- Updated dependencies
+  - peaks-loop-shared@0.0.5
+  - peaks-loop-audit-independent@0.0.5
+  - peaks-loop-crystallization@0.0.5
+  - peaks-loop-doctor@0.0.5
+  - peaks-loop-final-review@0.0.5
+
+## 4.0.0
+
+### Patch Changes
+
+- Updated dependencies
+  - peaks-loop-shared@0.0.5
+  - peaks-loop-audit-independent@0.0.5
+  - peaks-loop-crystallization@0.0.5
+  - peaks-loop-doctor@0.0.5
+  - peaks-loop-final-review@0.0.5
+
+## 4.0.0
+
 ### Minor Changes
 
 - 5d01343: Monorepo extraction: peaks-loop 4.0.0-beta.15 ships the new pnpm
@@ -2646,7 +2718,7 @@ codex / cursor`) follow the same discipline.
   4. `scanExportsInFile` now matches `export default function name()`
      and `export default class Name`; `importedNameCount` now treats
      re-exports (`export { x } from './y'`, `export type { T } from
-   './y'`) as consumer references.
+'./y'`) as consumer references.
      Bonus: `OrphanScanOptions.baseRef` lets the scan diff against an
      arbitrary git ref (default: `HEAD`) for branch-vs-main reviews.
 - **karpathy-service code-fence skip (Slice 2.6.1.B)** — `peaks scan

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "peaks-loop",
-  "version": "4.0.0-beta.15",
+  "version": "4.0.0-beta.17",
   "description": "Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration",
   "author": "SquabbyZ",
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@10.11.0",
   "publishConfig": {
     "access": "public"
   },
@@ -44,66 +43,25 @@
     "CHANGELOG.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && pnpm -r --filter \"./packages/*\" run build && tsc -p tsconfig.build.json && node ./scripts/copy-templates.mjs",
-    "prepack": "npm run build",
-    "prepublishOnly": "node scripts/prepublish-build.mjs",
-    "prepublish": "node ./scripts/sync-version.mjs",
-    "postinstall": "node ./scripts/install-skills.mjs",
-    "predev": "node ./scripts/sync-version.mjs",
-    "dev": "tsx src/cli/index.ts",
-    "dev:watch": "node ./scripts/watch.mjs",
-    "pretest": "node ./scripts/sync-version.mjs",
-    "test": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",
-    "test:full": "vitest run",
-    "test:fast": "vitest run --maxWorkers=8 -t \"^((?!@slow|@integration|@replay).)*$\" tests/unit",
-    "test:dev": "vitest run tests/unit",
-    "test:dev:cli": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",
-    "test:unit": "vitest run tests/unit",
-    "test:integration": "vitest run tests/integration",
-    "test:cli": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",
-    "test:workflow": "vitest run tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/workflow-autonomous-resume-validation.test.ts tests/unit/workflow-autonomous-service.test.ts tests/unit/workflow-router-service.test.ts tests/unit/skill-browser-workflow.test.ts tests/unit/services/workflow",
-    "test:audit:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",
-    "test:ci": "node ./scripts/sync-version.mjs && node ./scripts/lint/silent-warning-detector.mjs && vitest run --coverage",
-    "test:changed": "node scripts/test-changed.mjs",
-    "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",
-    "test:race": "vitest run --no-file-parallelism packages/peaks-loop-shared-channel/tests/shared-channel.test.ts tests/unit/dispatch-record-writer.test.ts tests/unit/services/retrospective/heartbeat.test.ts tests/unit/cli/commands/share-commands.test.ts",
-    "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",
-    "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",
-    "test:coverage": "vitest run --coverage",
-    "test:coverage:workflow": "vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",
-    "pretest:coverage": "node ./scripts/pretest-coverage.mjs",
-    "schema:generate": "node scripts/generate-context-schema.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit && vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",
-    "mut:run": "peaks mut run --project . --out mut-report.json",
-    "mut:scan": "peaks mut asserts --in mut-report.json",
-    "audit:prose-ratio": "peaks audit prose-ratio --project .",
-    "dogfood:sediment": "bash scripts/dogfood-sediment-cycle.sh"
-  },
   "engines": {
     "node": ">=20.0.0"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "better-sqlite3"
-    ]
-  },
   "dependencies": {
     "@colbymchenry/codegraph": "0.7.10",
     "better-sqlite3": "^12.11.1",
     "commander": "^12.1.0",
     "fzf": "^0.5.2",
     "headroom-ai": "0.22.4",
-    "peaks-loop-audit-independent": "workspace:*",
-    "peaks-loop-crystallization": "workspace:*",
-    "peaks-loop-doctor": "workspace:*",
-    "peaks-loop-final-review": "workspace:*",
-    "peaks-loop-mut": "workspace:*",
-    "peaks-loop-job-snapshot": "workspace:*",
-    "peaks-loop-shared-channel": "workspace:*",
-    "peaks-loop-shared": "workspace:*",
     "yaml": "^2.9.0",
-    "zod": "^3.25.76"
+    "zod": "^3.25.76",
+    "peaks-loop-audit-independent": "0.0.4",
+    "peaks-loop-crystallization": "0.0.5",
+    "peaks-loop-doctor": "0.0.4",
+    "peaks-loop-job-snapshot": "0.0.4",
+    "peaks-loop-final-review": "0.0.4",
+    "peaks-loop-mut": "0.0.4",
+    "peaks-loop-shared": "0.0.4",
+    "peaks-loop-shared-channel": "0.0.4"
   },
   "peerDependencies": {
     "@alibaba-group/open-code-review": "1.3.1"
@@ -127,5 +85,39 @@
     "vite": "^6.0.0",
     "vitest": "^4.1.0",
     "zod-to-json-schema": "^3.25.2"
+  },
+  "scripts": {
+    "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && pnpm -r --filter \"./packages/*\" run build && tsc -p tsconfig.build.json && node ./scripts/copy-templates.mjs",
+    "prepublish": "node ./scripts/sync-version.mjs",
+    "postinstall": "node ./scripts/install-skills.mjs",
+    "predev": "node ./scripts/sync-version.mjs",
+    "dev": "tsx src/cli/index.ts",
+    "dev:watch": "node ./scripts/watch.mjs",
+    "pretest": "node ./scripts/sync-version.mjs",
+    "test": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",
+    "test:full": "vitest run",
+    "test:fast": "vitest run --maxWorkers=8 -t \"^((?!@slow|@integration|@replay).)*$\" tests/unit",
+    "test:dev": "vitest run tests/unit",
+    "test:dev:cli": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",
+    "test:unit": "vitest run tests/unit",
+    "test:integration": "vitest run tests/integration",
+    "test:cli": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",
+    "test:workflow": "vitest run tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/workflow-autonomous-resume-validation.test.ts tests/unit/workflow-autonomous-service.test.ts tests/unit/workflow-router-service.test.ts tests/unit/skill-browser-workflow.test.ts tests/unit/services/workflow",
+    "test:audit:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",
+    "test:ci": "node ./scripts/sync-version.mjs && node ./scripts/lint/silent-warning-detector.mjs && vitest run --coverage",
+    "test:changed": "node scripts/test-changed.mjs",
+    "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",
+    "test:race": "vitest run --no-file-parallelism packages/peaks-loop-shared-channel/tests/shared-channel.test.ts tests/unit/dispatch-record-writer.test.ts tests/unit/services/retrospective/heartbeat.test.ts tests/unit/cli/commands/share-commands.test.ts",
+    "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",
+    "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",
+    "test:coverage": "vitest run --coverage",
+    "test:coverage:workflow": "vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",
+    "pretest:coverage": "node ./scripts/pretest-coverage.mjs",
+    "schema:generate": "node scripts/generate-context-schema.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",
+    "mut:run": "peaks mut run --project . --out mut-report.json",
+    "mut:scan": "peaks mut asserts --in mut-report.json",
+    "audit:prose-ratio": "peaks audit prose-ratio --project .",
+    "dogfood:sediment": "bash scripts/dogfood-sediment-cycle.sh"
   }
-}
+}

package/skills/bee/peaks-prd/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "Feishu 文档 https://example.feishu.cn/wiki/PRODUCT_DOC_ID 是产品文档，需要登录。目标是 /Users/yuanyuan/Desktop/work/platform-rag-web 前端项目，请从文档提取可以交给 RD 实现、QA 复测的前端改动点。",
+    "expected": "先校验文档 URL 使用 https 且属于批准的 Feishu/Lark tenant 域名，再使用 headed gstack/browse/dist/browse 打开有头浏览器访问，遇到登录时等待用户完成并回复确认后再继续；登录后只提取产品实现逻辑、页面/路由/组件/状态/API contract/mock 假设/验收标准/联调问题，输出 .peaks/_runtime/<session-id>/prd/ 下的脱敏实现型 PRD handoff；不得保留登录 URL、cookie、headers、tokens、storage state、browser traces、raw browser/network state 或 PII/SSO/MFA 截图/日志。"
+  },
+  {
+    "id": 2,
+    "prompt": "产品文档业务背景很多，但用户明确只要落实到前端开发和 QA 验收，不要长篇业务叙述。当前没有 swagger.json，需要先 mock。",
+    "expected": "压缩业务背景，只输出待联调态 frontend delta、mock/API contract、后续 swagger 替换清单、QA 浏览器验收路径和阻塞问题。"
+  }
+]

package/skills/bee/peaks-qa/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "验证 /Users/yuanyuan/Desktop/work/platform-rag-web 的前端需求实现。后端 swagger.json 不存在，当前实现使用 mock/API contract。",
+    "expected": "QA 运行相关测试/API 或 mock contract 验证，启动前端应用，用 headed gstack/browse/dist/browse 有头浏览器做强制 E2E，遇到登录时等待用户完成并回复确认后再继续，记录脱敏 route/actions、脱敏 console/network 失败、脱敏截图或观察；不得保留登录 URL、cookie、headers、tokens、storage state、browser traces、PII/SSO/MFA 材料；生成 .peaks/_runtime/<session-id>/qa/validation-report.md，并包含安全和性能检查结果。"
+  },
+  {
+    "id": 2,
+    "prompt": "浏览器 E2E 中如果页面白屏、console 报错、网络 mock 失败、UI 有明显回归怎么办？",
+    "expected": "QA 必须带证据退回 RD 修复，不能通过 QA；修复后重新浏览器验证。"
+  }
+]

package/skills/bee/peaks-rd/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "根据 peaks-prd 产出的前端待联调 delta，在 /Users/yuanyuan/Desktop/work/platform-rag-web 中实现 UI/交互/API mock。项目没有后端 swagger.json，需要先用 mock/API contract 开发。",
+    "expected": "RD 先做 standards init/update dry-run 和项目扫描；非平凡变更检查 OpenSpec；按最小 slice 实现；新增/变更代码有单测或合理 focused coverage；前端/UI slice 自测必须用 headed gstack/browse/dist/browse 有头浏览器端到端验证并记录脱敏 route/actions、脱敏 console/network 观察和验收结果；完成 code review、安全 review、post-check dry-run 后才交给 QA；所有进入 .peaks/_runtime/<session-id>/rd/ 的浏览器证据必须脱敏，不得保留登录 URL、cookie、headers、tokens、storage state、browser traces、raw browser/network state 或 PII/SSO/MFA 截图/日志。"
+  },
+  {
+    "id": 2,
+    "prompt": "目标项目是存量前端项目，整体 UT 覆盖率可能不达标，但本次只要求新增和改动部分覆盖。",
+    "expected": "不能因历史低覆盖直接失败；必须要求新增/改动代码的 focused test/coverage 证据，缺失则阻塞 RD completion。"
+  }
+]

package/skills/bee/peaks-txt/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "本次 peaks-code 实战发现了 Feishu 登录、前端 mock 联调、浏览器可见 E2E 和本地 .peaks 产物的使用习惯，需要沉淀给后续 session。",
+    "expected": "Peaks TXT 在 .peaks/_runtime/<session-id>/txt/skill-usage-lessons.md 和 context-capsule.md 中记录规则、原因、影响技能、未来应用方式和是否适合 memory extraction，不保存 secrets、登录态、PII 或原始浏览器数据。"
+  },
+  {
+    "id": 2,
+    "prompt": "流程被打断，需要下个 session 接着做。",
+    "expected": "输出紧凑 capsule：模式、已验证决策、artifact paths、标准变更、开放问题、下一步，不复述完整日志。"
+  }
+]

package/skills/bee/peaks-ui/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "根据产品文档做前端页面迭代，要求全自动模式下设计不要模板化，要比普通 Tailwind/shadcn 默认页更好看。",
+    "expected": "Peaks UI 走 awesome-design-md + taste-skill/design-taste-frontend 的参考和品味链路，先定义风格方向、字体、色彩、动效、密度和交互状态，避免默认卡片栅格、居中 hero、AI 紫蓝渐变，并用浏览器可见检查迭代。"
+  },
+  {
+    "id": 2,
+    "prompt": "前端实现已经完成，但页面看起来像默认模板。",
+    "expected": "Peaks UI 产出 taste report，指出弱层级、模板感、交互状态缺失、响应式问题，并退回设计/RD 迭代后再 QA。"
+  }
+]

package/skills/peaks-code/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "/peaks-code https://example.feishu.cn/wiki/PRODUCT_DOC_ID 是产品文档。请根据这份产品文档，对 /Users/yuanyuan/Desktop/work/platform-rag-web 这个前端项目进行迭代开发。目前只是前端项目，没有后端 swagger.json，可以先 mock，等后面有真实 swagger.json 数据时再联调替换。允许修改目标仓代码，这是实战测试。",
+    "expected": "peaks-code 选择 full-auto/实战路径，使用本仓 skills 目录下的 peaks-prd/rd/ui/qa/sc/txt，Feishu 走 headed gstack/browse/dist/browse 可见浏览器登录 handoff，先校验 https 和批准的 Feishu/Lark tenant 域名，生成 .peaks/_runtime/<session-id>/prd|rd|qa|txt 脱敏中间产物；RD 完成实现、单测、CR、安全检查、dry-run 后必须进入 QA；前端 RD 自测和 QA 验证都必须使用 headed gstack/browse/dist/browse 有头浏览器端到端验证并确认可见浏览器；QA 完成 API/mock 验证、浏览器 E2E、报告、安全和性能检查。若 QA 报告存在失败、阻塞、缺失或未验证项，必须回到 RD 修复并再次 QA，直到 QA 全部通过或生成 blocked handoff；full-auto 可用 Claude Code goal 维持 RD fixes until QA passes all acceptance items 的控制目标；不得保留登录 URL、cookie、headers、tokens、storage state、browser traces、raw browser/network state 或 PII/SSO/MFA 截图/日志。"
+  },
+  {
+    "id": 2,
+    "prompt": "/peaks-code 对 /Users/yuanyuan/Desktop/work/platform-rag-web 做前端需求迭代，需求来自需要登录的 Feishu 产品文档；如果浏览器登录没打开或文档仍不可读，需要阻塞并告诉我具体要做什么，不要用 unauthenticated fetch，也不要绕过 SSO/MFA。",
+    "expected": "流程必须验证可见浏览器 handoff，不能降级到 fetch；登录或访问失败时生成 blocked PRD/TXT 胶囊，只记录脱敏状态和下一步，不保存登录 URL、cookie、headers、tokens、storage state、浏览器 traces，或包含 PII/SSO/MFA 内容的截图和日志。"
+  }
+]

package/skills/peaks-sop/test-prompts.json

@@ -0,0 +1,17 @@
+[
+  {
+    "id": 1,
+    "prompt": "我想要一个发布流程：先写好 CHANGELOG，再跑通测试，最后才能发布。帮我做成一个 SOP，我不想自己写 JSON。",
+    "expected": "peaks-sop 访谈出 phases（如 draft/review/ship）和门禁，调用 peaks sop init --apply 生成骨架，把门禁写进 sop.json（changelog 用 file-exists、tests 用 command 并提示需要 --allow-commands），跑 peaks sop lint 到 ok:true，用 peaks sop check 验证每个门禁，再 peaks sop register 注册。全程不让用户手写 JSON。"
+  },
+  {
+    "id": 2,
+    "prompt": "我的 SOP lint 报错说门禁绑定了未知阶段，帮我修。",
+    "expected": "peaks-sop 读 lint findings 定位违例门禁，在 sop.json 里把门禁的 phase 改成已声明的阶段（或补声明该阶段），重新 peaks sop lint 直到 ok:true，不直接 register 未通过 lint 的 SOP。"
+  },
+  {
+    "id": 3,
+    "prompt": "这个发布 SOP 真的能在测试没过时把我拦住吗？我想先确认再用。",
+    "expected": "peaks-sop 用 peaks sop check 在好/坏两种状态下验证门禁返回 pass/fail，再用 peaks sop advance --to ship --dry-run 干跑确认门禁未通过时阻断推进且不落盘，向用户展示阻断行为后再交付。"
+  }
+]