peaks-loop 4.0.0-beta.2 → 4.0.0-beta.21

package/dist/services/artifacts/workspace-service.js

@@ -0,0 +1,272 @@
+import { existsSync } from 'node:fs';
+import { Buffer } from 'node:buffer';
+import { resolve } from 'node:path';
+import { isInsidePath, stablePath } from '../../shared/path-utils.js';
+import { getWorkspaceConfig, getWorkspaceConfigForCurrentPath } from '../config/config-service.js';
+import { pathExists } from 'peaks-loop-shared/fs';
+import { execCommand } from '../../shared/process.js';
+function canonicalPath(path) {
+    return stablePath(path);
+}
+function canonicalChildPath(parentPath, ...segments) {
+    return stablePath(resolve(parentPath, ...segments));
+}
+export function getLocalArtifactPath(workspace) {
+    if (workspace.artifactStorage?.localPath) {
+        return resolve(workspace.artifactStorage.localPath);
+    }
+    return resolve(workspace.rootPath, '.peaks', 'artifacts');
+}
+export function isArtifactWorkspaceOutsideTarget(_workspace, _artifactWorkspacePath) {
+    return true;
+}
+export function hasValidArtifactWorkspace(workspace, artifactWorkspacePath = getLocalArtifactPath(workspace)) {
+    if (!isArtifactWorkspaceOutsideTarget(workspace, artifactWorkspacePath))
+        return false;
+    const artifactRoot = canonicalPath(artifactWorkspacePath);
+    const peaksRoot = canonicalChildPath(artifactWorkspacePath, '.peaks');
+    const changesRoot = canonicalChildPath(artifactWorkspacePath, '.peaks', 'changes');
+    const configPath = canonicalChildPath(artifactWorkspacePath, '.peaks', 'config.json');
+    if (!existsSync(resolve(artifactWorkspacePath, '.peaks', 'config.json')))
+        return false;
+    if (!isInsidePath(peaksRoot, artifactRoot))
+        return false;
+    if (!isInsidePath(changesRoot, artifactRoot))
+        return false;
+    if (!isInsidePath(configPath, artifactRoot))
+        return false;
+    return true;
+}
+export function getArtifactRemoteRepo(workspace) {
+    if (workspace.artifactStorage?.mode === 'local-with-remote-sync') {
+        return workspace.artifactStorage.remote;
+    }
+    if (workspace.artifactStorage?.mode === 'local') {
+        return null;
+    }
+    return workspace.artifactRepo ?? null;
+}
+function getPublicRemoteUrl(artifactRepo) {
+    if (!artifactRepo)
+        return null;
+    return artifactRepo.provider === 'github'
+        ? `https://github.com/${artifactRepo.owner}/${artifactRepo.name}.git`
+        : `https://gitlab.com/${artifactRepo.owner}/${artifactRepo.name}.git`;
+}
+function getGitAuthEnv(artifactRepo) {
+    if (!artifactRepo || artifactRepo.provider !== 'github')
+        return undefined;
+    const token = process.env.GH_TOKEN;
+    if (!token)
+        return undefined;
+    const authValue = Buffer.from(`x-access-token:${token}`, 'utf-8').toString('base64');
+    return {
+        ...process.env,
+        GIT_CONFIG_COUNT: '1',
+        GIT_CONFIG_KEY_0: 'http.https://github.com/.extraheader',
+        GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${authValue}`
+    };
+}
+function redactSecrets(message) {
+    const token = process.env.GH_TOKEN;
+    const urlRedacted = message.replace(/https:\/\/x-access-token:[^@]+@/g, 'https://x-access-token:***@');
+    const headerRedacted = urlRedacted.replace(/AUTHORIZATION:\s*basic\s+[A-Za-z0-9+/=]+/gi, 'AUTHORIZATION: basic ***');
+    if (!token)
+        return headerRedacted;
+    const encoded = Buffer.from(`x-access-token:${token}`, 'utf-8').toString('base64');
+    return headerRedacted.replaceAll(token, '***').replaceAll(encoded, '***');
+}
+export async function executeArtifactSync(workspaceId) {
+    const workspace = workspaceId
+        ? getWorkspaceConfig(workspaceId)
+        : getWorkspaceConfigForCurrentPath();
+    if (!workspace) {
+        return {
+            workspaceId: workspaceId ?? 'unknown',
+            success: false,
+            localPath: '.peaks-artifacts',
+            remoteUrl: null,
+            commands: [],
+            output: [],
+            error: 'Workspace not found'
+        };
+    }
+    const localPath = getLocalArtifactPath(workspace);
+    if (!isArtifactWorkspaceOutsideTarget(workspace, localPath)) {
+        return {
+            workspaceId: workspace.workspaceId,
+            success: false,
+            localPath,
+            remoteUrl: null,
+            commands: [],
+            output: [],
+            error: 'Artifact workspace must be outside the target repository'
+        };
+    }
+    const artifactRepo = getArtifactRemoteRepo(workspace);
+    if (!artifactRepo) {
+        return {
+            workspaceId: workspace.workspaceId,
+            success: true,
+            localPath,
+            remoteUrl: null,
+            commands: [],
+            output: ['Local artifact storage is configured']
+        };
+    }
+    const remoteUrl = getPublicRemoteUrl(artifactRepo);
+    const gitAuthEnv = getGitAuthEnv(artifactRepo);
+    if (!remoteUrl) {
+        return {
+            workspaceId: workspace.workspaceId,
+            success: false,
+            localPath,
+            remoteUrl: null,
+            commands: [],
+            output: [],
+            error: 'Invalid artifact repository configuration'
+        };
+    }
+    const commands = [];
+    const output = [];
+    const hasLocalDir = await pathExists(localPath);
+    if (!hasLocalDir) {
+        commands.push(`git clone ${remoteUrl} "${localPath}"`);
+        try {
+            await execCommand('git', ['clone', remoteUrl, localPath], { env: gitAuthEnv });
+            output.push(`Cloned artifact repository to ${localPath}`);
+        }
+        catch (err) {
+            return {
+                workspaceId: workspace.workspaceId,
+                success: false,
+                localPath,
+                remoteUrl,
+                commands,
+                output,
+                error: `Clone failed: ${redactSecrets(err instanceof Error ? err.message : String(err))}`
+            };
+        }
+    }
+    else {
+        commands.push(`cd "${localPath}" && git fetch origin`);
+        commands.push(`cd "${localPath}" && git pull origin main`);
+        try {
+            await execCommand('git', ['fetch', 'origin'], { cwd: localPath, env: gitAuthEnv });
+            output.push('Fetched latest from remote');
+            await execCommand('git', ['pull', 'origin', 'main'], { cwd: localPath, env: gitAuthEnv });
+            output.push('Pulled latest changes');
+        }
+        catch (err) {
+            return {
+                workspaceId: workspace.workspaceId,
+                success: false,
+                localPath,
+                remoteUrl,
+                commands,
+                output,
+                error: `Sync failed: ${redactSecrets(err instanceof Error ? err.message : String(err))}`
+            };
+        }
+    }
+    return {
+        workspaceId: workspace.workspaceId,
+        success: true,
+        localPath,
+        remoteUrl,
+        commands,
+        output
+    };
+}
+export function getArtifactWorkspaceStatus(workspaceId) {
+    const workspace = workspaceId
+        ? getWorkspaceConfig(workspaceId)
+        : getWorkspaceConfigForCurrentPath();
+    if (!workspace) {
+        return {
+            workspaceId: workspaceId ?? 'unknown',
+            localPath: '.peaks-artifacts',
+            configured: false,
+            syncStatus: 'unknown',
+            lastSync: null,
+            hasLocalChanges: false,
+            artifactRepo: null,
+            nextActions: ['Add a workspace with: peaks config workspace add --id <id> --name <name> --path <path>']
+        };
+    }
+    const localPath = getLocalArtifactPath(workspace);
+    const hasLocalDir = existsSync(localPath);
+    const artifactRepo = getArtifactRemoteRepo(workspace);
+    const hasSafeBoundary = isArtifactWorkspaceOutsideTarget(workspace, localPath);
+    const syncStatus = !hasSafeBoundary
+        ? 'unknown'
+        : !hasLocalDir
+            ? 'pending'
+            : 'synced';
+    return {
+        workspaceId: workspace.workspaceId,
+        localPath,
+        configured: hasSafeBoundary,
+        syncStatus,
+        lastSync: null,
+        hasLocalChanges: false,
+        artifactRepo,
+        nextActions: !hasSafeBoundary
+            ? ['Configure artifact workspace outside the target repository.']
+            : artifactRepo
+                ? [`Run peaks artifacts sync --workspace ${workspace.workspaceId} --dry-run`]
+                : [`Local artifact storage ready at ${localPath}`]
+    };
+}
+export function planArtifactSync(workspaceId, dryRun = true) {
+    const workspace = workspaceId
+        ? getWorkspaceConfig(workspaceId)
+        : getWorkspaceConfigForCurrentPath();
+    if (!workspace) {
+        return {
+            workspaceId: workspaceId ?? 'unknown',
+            dryRun,
+            localPath: '.peaks-artifacts',
+            remoteUrl: null,
+            plannedCommands: ['No artifact repo configured — add one with peaks config workspace add --provider github --repo-owner <owner> --repo-name <name>']
+        };
+    }
+    const localPath = getLocalArtifactPath(workspace);
+    if (!isArtifactWorkspaceOutsideTarget(workspace, localPath)) {
+        return {
+            workspaceId: workspace.workspaceId,
+            dryRun,
+            localPath,
+            remoteUrl: null,
+            plannedCommands: ['Artifact workspace must be outside the target repository']
+        };
+    }
+    const artifactRepo = getArtifactRemoteRepo(workspace);
+    const remoteUrl = getPublicRemoteUrl(artifactRepo);
+    const plannedCommands = artifactRepo
+        ? dryRun
+            ? [
+                `# Sync plan for workspace ${workspace.workspaceId}`,
+                `# Local: ${localPath}`,
+                `# Remote: ${remoteUrl}`,
+                '# peaks artifacts sync --workspace ' + workspace.workspaceId,
+                '# (dry-run only — no changes made)'
+            ]
+            : [
+                `# Sync execution for workspace ${workspace.workspaceId}`,
+                `# Confirm: will sync ${localPath} with ${remoteUrl}`,
+                '# Exit 1 if not confirmed'
+            ]
+        : [
+            `# Local artifact storage for workspace ${workspace.workspaceId}`,
+            `# Local: ${localPath}`,
+            '# No remote repository is configured or required'
+        ];
+    return {
+        workspaceId: workspace.workspaceId,
+        dryRun,
+        localPath,
+        remoteUrl,
+        plannedCommands
+    };
+}

package/dist/services/audit/static-service.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Static audit service — `peaks audit static`.
+ *
+ * Slice 3 of 4.0.0-beta.11 dropped the ECC AgentShield subprocess
+ * integration entirely. The pre-Slice-3 implementation probed
+ * `npx ecc-agentshield --version` and shelled out to
+ * `npx ecc-agentshield scan --json --target <path>` on every audit
+ * call, but the upstream `affaan-m/everything-claude-code` v2.0.0
+ * release ships no `ecc-agentshield` binary — the repo is
+ * `agents/*.md` flat files plus SKILL.md descriptors.
+ *
+ * The new contract: `peaks audit static` runs the peaks-loop lint
+ * layer only. There is no subprocess probe, no `installed` flag,
+ * no agent-shield reason code. The `agentShield` field is preserved
+ * on the result type as a frozen "always disabled" stub so any
+ * downstream consumer keeps compiling, but the merged findings list
+ * is always the peaks-loop findings list (no ECC findings).
+ *
+ * The subprocess-runner seam (`SubprocessRunner`, `defaultSubprocessRunner`)
+ * is preserved as an EXPORTED TYPE so legacy tests can still
+ * mock it; the runner itself is never invoked from production code.
+ */
+import { type ProseRatioResult } from './prose-ratio-calculator.js';
+import type { EnforcerFinding, RedLineAudit } from './types.js';
+export interface StaticAuditInput {
+    readonly projectRoot: string;
+    /** Slice 3: retained for backward-compat; no longer wired. */
+    readonly enableAgentShield?: boolean | undefined;
+    /** Slice 3: retained as a type seam; never invoked in production. */
+    readonly subprocessRunner?: SubprocessRunner | undefined;
+}
+export interface StaticAuditResult {
+    readonly audit: RedLineAudit;
+    readonly agentShield: AgentShieldState;
+    readonly warnings: readonly string[];
+    readonly proseRatio: ProseRatioResult;
+}
+/**
+ * Frozen stub. Slice 3 collapsed the agent-shield reason set to a
+ * single value (`'disabled-and-ecc-missing'`) because the
+ * subprocess integration was removed; we preserve the other
+ * reason literals as TYPE-LEVEL members so any test or
+ * downstream consumer that pattern-matches on `'flag-enabled-but-ecc-missing'`
+ * keeps type-checking, but the runtime value is always the
+ * single collapsed state.
+ */
+export interface AgentShieldState {
+    readonly spawned: false;
+    readonly installed: false;
+    readonly reason: 'enabled-and-installed' | 'disabled-by-preference' | 'flag-disabled' | 'flag-enabled-but-ecc-missing' | 'disabled-and-ecc-missing';
+    readonly findings: readonly EnforcerFinding[];
+}
+/**
+ * Subprocess runner interface — preserved as a TYPE for legacy
+ * test code. Production no longer invokes it; the audit always
+ * runs peaks-loop-only findings.
+ */
+export interface SubprocessRunner {
+    run(command: string, args: readonly string[], timeoutMs: number): SubprocessResult;
+}
+export interface SubprocessResult {
+    readonly status: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly error?: Error;
+}
+export declare function runStaticAudit(input: StaticAuditInput): StaticAuditResult;

package/dist/services/audit/static-service.js

@@ -0,0 +1,51 @@
+/**
+ * Static audit service — `peaks audit static`.
+ *
+ * Slice 3 of 4.0.0-beta.11 dropped the ECC AgentShield subprocess
+ * integration entirely. The pre-Slice-3 implementation probed
+ * `npx ecc-agentshield --version` and shelled out to
+ * `npx ecc-agentshield scan --json --target <path>` on every audit
+ * call, but the upstream `affaan-m/everything-claude-code` v2.0.0
+ * release ships no `ecc-agentshield` binary — the repo is
+ * `agents/*.md` flat files plus SKILL.md descriptors.
+ *
+ * The new contract: `peaks audit static` runs the peaks-loop lint
+ * layer only. There is no subprocess probe, no `installed` flag,
+ * no agent-shield reason code. The `agentShield` field is preserved
+ * on the result type as a frozen "always disabled" stub so any
+ * downstream consumer keeps compiling, but the merged findings list
+ * is always the peaks-loop findings list (no ECC findings).
+ *
+ * The subprocess-runner seam (`SubprocessRunner`, `defaultSubprocessRunner`)
+ * is preserved as an EXPORTED TYPE so legacy tests can still
+ * mock it; the runner itself is never invoked from production code.
+ */
+import { runRedLinesAudit } from './red-lines-service.js';
+import { loadPreferences } from '../preferences/preferences-service.js';
+import { computeProseRatio } from './prose-ratio-calculator.js';
+export function runStaticAudit(input) {
+    // Slice 3: agent-shield integration removed. The CLI flag and
+    // preference are still read for backward-compat (a user with a
+    // stale preferences.json that sets `agentShieldEnabled: true`
+    // does not get a hard error) but neither spawns a subprocess.
+    loadPreferences(input.projectRoot);
+    // Always run the peaks-loop lint layer; no ECC findings merged.
+    const peaksResult = runRedLinesAudit({ projectRoot: input.projectRoot });
+    const mergedAudit = {
+        ...peaksResult.audit,
+        enforcerFindings: [...peaksResult.audit.enforcerFindings],
+    };
+    const state = {
+        spawned: false,
+        installed: false,
+        reason: 'disabled-and-ecc-missing',
+        findings: [],
+    };
+    const proseRatio = computeProseRatio(mergedAudit.audit);
+    return {
+        audit: mergedAudit,
+        agentShield: state,
+        warnings: [],
+        proseRatio,
+    };
+}