peaks-loop 4.0.0-beta.8 → 4.0.0-beta.9

package/dist/cli/commands/user-touchpoint-commands.js

@@ -0,0 +1,78 @@
+/**
+ * v2.15.0 follow-up — G4: user touchpoint CLI.
+ *
+ *   - `peaks code gate-classify --step <step-id>` — classify a single
+ *     Code gate (business / tech / mode-selection / commit-boundary /
+ *     commit-floor)
+ *   - `peaks code user-touchpoints`                — list all gates the
+ *     user must review (vs AI auto-decides in full-auto)
+ *   - `peaks code commit-boundary-actions`         — list the 5
+ *     hard-floor commit actions (push / tag / publish / global
+ *     install)
+ *
+ * Surfaces the 12 Gaps positioning memory rule:
+ *   "user 在循环里 = 业务/产品审阅者,不参与技术决策"
+ */
+import { aiAutoDecidesGates, classifyGate, COMMIT_BOUNDARY_ACTIONS_LIST, userMustReviewGates } from '../../services/code/user-touchpoint-classifier.js';
+import { fail, ok } from '../../shared/result.js';
+import { addJsonOption, printResult } from '../cli-helpers.js';
+export function registerUserTouchpointCommands(program, io) {
+    // G4 commands are registered as TOP-LEVEL commands (not sub-commands
+    // of `peaks code`) because `peaks code` is a SKILL (consumed by the
+    // LLM in SKILL.md), not a CLI command. Top-level names: gate-classify /
+    // user-touchpoints / commit-boundary-actions.
+    //
+    // We do NOT create a new `peaks code` CLI command here because that
+    // would conflict with the peaks-code skill presence tracking (see
+    // `src/services/skills/skill-presence-service.ts`).
+    addJsonOption(program
+        .command('gate-classify')
+        .description('v2.15.0 follow-up G4: classify a single Code gate by its decision kind: ' +
+        'business / tech / mode-selection / commit-boundary / commit-floor. ' +
+        'Returns null when the step is unknown.')
+        .requiredOption('--step <step-id>', 'step id (e.g. step-1-mode-select, phase-2-prd-confirm)')).action((opts) => {
+        const c = classifyGate(opts.step);
+        if (c === null) {
+            printResult(io, fail('code.gate-classify', 'UNKNOWN_STEP', `unknown step "${opts.step}"`, {}, [
+                'Run `peaks code user-touchpoints` to list all known steps.'
+            ]), opts.json ?? false);
+            process.exitCode = 1;
+            return;
+        }
+        printResult(io, ok('code.gate-classify', { classification: c }, [], [
+            c.userShouldReview === 'always'
+                ? 'User must review this gate in all modes.'
+                : c.userShouldReview === 'business-only'
+                    ? 'User reviews this gate only when it surfaces a business decision.'
+                    : 'AI auto-decides this gate in full-auto. User does not need to review.'
+        ]), opts.json ?? false);
+    });
+    addJsonOption(program
+        .command('user-touchpoints')
+        .description('List all Code gates the user must review. The 12 Gaps positioning ' +
+        'memory: user 在循环里 = 业务/产品审阅者,不参与技术决策。 ' +
+        'These are the only gates where the user is asked to decide.')).action((opts) => {
+        const must = userMustReviewGates();
+        const auto = aiAutoDecidesGates();
+        printResult(io, ok('code.user-touchpoints', {
+            userMustReview: must,
+            aiAutoDecides: auto,
+            counts: {
+                userMustReview: must.length,
+                aiAutoDecides: auto.length
+            }
+        }, [], [
+            `User reviews ${must.length} gate(s); AI auto-decides ${auto.length} in full-auto.`,
+            'Goal: 减少 user 被打扰次数 from 14 → 6-8 (the must-review count).'
+        ]), opts.json ?? false);
+    });
+    addJsonOption(program
+        .command('commit-boundary-actions')
+        .description('List the 5 commit-boundary hard-floor actions. These are the ' +
+        'actions that PAUSE even in full-auto (v2.15.0 slice 002 AC-4 rule: ' +
+        '"full-auto 只做到 commit"). The user is always asked to confirm.')).action((opts) => {
+        printResult(io, ok('code.commit-boundary-actions', { actions: COMMIT_BOUNDARY_ACTIONS_LIST }, [], [
+            'Even in full-auto, the user must explicitly confirm these actions.'
+        ]), opts.json ?? false);
+    });
+}

package/dist/cli/commands/verdict-aggregate-command.d.ts

@@ -0,0 +1,14 @@
+/**
+ * v2.13.2 AC-2 — `peaks verdict aggregate` CLI surface.
+ *
+ * Reads the 5 envelope sources under `.peaks/_runtime/<sid>/` for a
+ * given rid, runs `aggregateVerdict()`, and prints the verdict +
+ * reasons JSON envelope. Used by peaks-code / peaks-final-review to
+ * cross-check the slice-level verdict without booting the full
+ * 5-skill fanout.
+ *
+ * File budget: ≤ 150 lines (Karpathy §2).
+ */
+import { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerVerdictAggregateCommands(program: Command, io: ProgramIO): void;

package/dist/cli/commands/verdict-aggregate-command.js

@@ -0,0 +1,106 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { aggregateVerdict } from '../../services/verdict/verdict-aggregator.js';
+import { parseKarpathyEnvelope, parseMutEnvelope, parseQaEnvelope, parseSecurityEnvelope, parsePerfEnvelope, envelopesToAggregatorInput } from '../../services/verdict/envelopes.js';
+import { addJsonOption, printResult } from '../cli-helpers.js';
+import { fail, ok } from '../../shared/result.js';
+const SECURITY_REL = 'audit/security.md';
+const PERF_REL = 'audit/perf.md';
+const KARPATHY_REL = 'rd/karpathy-review.md';
+const MUT_REL = 'mut/mut-report.json';
+const QA_REL = 'qa/test-reports';
+export function registerVerdictAggregateCommands(program, io) {
+    const verdict = program.command('verdict').description('Aggregate the 5 envelope sources feeding peaks-code verdict logic');
+    addJsonOption(verdict
+        .command('aggregate')
+        .description('Aggregate 5 envelope sources (security / perf / karpathy / mut / qa) and print the verdict + reasons JSON envelope. Used by peaks-code and peaks-final-review.')
+        .requiredOption('--from-rid <rid>', 'request id, e.g. 2026-06-27-...')
+        .option('--sid <sid>', 'session id, e.g. 2026-06-27-session-...; default: project default')
+        .option('--project <path>', 'project root (default: cwd)')).action(async (options) => {
+        const projectRoot = options.project ?? process.cwd();
+        const sid = options.sid ?? 'default';
+        const rid = options.fromRid;
+        if (rid === undefined || rid.length === 0) {
+            printResult(io, fail('verdict.aggregate', 'RID_REQUIRED', '--from-rid is required', {}, ['Re-run with --from-rid <rid>']), options.json);
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const sources = {
+                // v2.13.3 AC-1: use the canonical markdown-aware parser from
+                // envelopes.ts. The old inline `parseSecurityFromMarkdown`
+                // only understood shape A (`- [SEV] dim @ file:line — hint`),
+                // so real dogfood fixtures using shape B (`- HIGH: hint in file:line`)
+                // returned `verdict: warn, violations: []` — the aggregator
+                // then produced `reasons: []` and `verdict: 'pass'` even when
+                // the audit had flagged HIGH violations.
+                security: readAudit(projectRoot, sid, SECURITY_REL, parseSecurityEnvelope),
+                perf: readAudit(projectRoot, sid, PERF_REL, parsePerfEnvelope),
+                karpathy: readAudit(projectRoot, sid, KARPATHY_REL, (m) => parseKarpathyEnvelope(m)),
+                mut: await readMut(projectRoot, sid),
+                qa: readQa(projectRoot, sid, rid)
+            };
+            const input = envelopesToAggregatorInput([
+                sources.security !== null ? { kind: 'security', envelope: sources.security } : null,
+                sources.perf !== null ? { kind: 'perf', envelope: sources.perf } : null,
+                sources.karpathy !== null ? { kind: 'karpathy', envelope: sources.karpathy } : null,
+                sources.mut !== null ? { kind: 'mut', envelope: sources.mut } : null,
+                sources.qa !== null ? { kind: 'qa', envelope: sources.qa } : null
+            ]);
+            const result = aggregateVerdict(input);
+            const sourceFlags = {
+                security: sources.security !== null ? 'present' : 'missing',
+                perf: sources.perf !== null ? 'present' : 'missing',
+                karpathy: sources.karpathy !== null ? 'present' : 'missing',
+                mut: sources.mut !== null ? 'present' : 'missing',
+                qa: sources.qa !== null ? 'present' : 'missing'
+            };
+            printResult(io, ok('verdict.aggregate', { verdict: result.verdict, reasons: result.reasons, sources: sourceFlags }, [], []), options.json);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            printResult(io, fail('verdict.aggregate', 'AGGREGATE_FAILED', message, {}, ['Verify the rid/sid/project are correct']), options.json);
+            process.exitCode = 1;
+        }
+    });
+}
+function readAudit(projectRoot, sid, rel, parse) {
+    const path = join(projectRoot, '.peaks', '_runtime', sid, rel);
+    if (!existsSync(path))
+        return null;
+    const md = readFileSync(path, 'utf8');
+    return parse(md);
+}
+async function readMut(projectRoot, sid) {
+    const path = join(projectRoot, '.peaks', '_runtime', sid, MUT_REL);
+    if (!existsSync(path))
+        return null;
+    const raw = readFileSync(path, 'utf8');
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        return null;
+    }
+    return parseMutJson(json);
+}
+function readQa(projectRoot, sid, rid) {
+    const dir = join(projectRoot, '.peaks', '_runtime', sid, QA_REL);
+    const candidates = [`${rid}.md`, `001-${rid}.md`];
+    for (const name of candidates) {
+        const path = join(dir, name);
+        if (existsSync(path)) {
+            const md = readFileSync(path, 'utf8');
+            return parseQaEnvelope(md);
+        }
+    }
+    return null;
+}
+function parseMutJson(json) {
+    return parseMutEnvelope(json);
+}
+// v2.13.3 AC-1: removed inline `parseSecurityFromMarkdown` /
+// `parsePerfFromMarkdown` (only handled shape A). The canonical
+// `parseSecurityEnvelope` / `parsePerfEnvelope` in envelopes.ts now
+// own the markdown parse + JSON back-compat fallback.

package/dist/cli/commands/worker-commands.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerWorkerCommands(program: Command, io: ProgramIO): void;

package/dist/cli/commands/worker-commands.js

@@ -0,0 +1,52 @@
+import { getMiniMaxProviderConfig } from '../../services/config/config-service.js';
+import { runMiniMaxWorker } from '../../services/providers/minimax-worker-service.js';
+import { fail, ok } from '../../shared/result.js';
+import { addJsonOption, getErrorMessage, printResult, redactSensitiveErrorMessage, summarizeMiniMaxWorkerResult } from '../cli-helpers.js';
+function addMiniMaxWorkerOptions(command) {
+    return addJsonOption(command
+        .description('Run a single MiniMax coding and unit-test execution worker')
+        .requiredOption('--session-id <id>', 'session identifier (the single-axis workspace binding after the change-id root removal)')
+        .requiredOption('--goal <goal>', 'execution goal')
+        .requiredOption('--coding-task <task>', 'coding execution task')
+        .requiredOption('--unit-test-task <task>', 'unit-test execution task')
+        .option('--model <model>', 'model name for the worker', 'MiniMax-M2.7')
+        .option('--confirm', 'confirm that worker inputs may be sent to the external MiniMax provider once and only return a review handoff', false));
+}
+async function runMiniMaxWorkerCommand(io, options) {
+    if (!options.confirm) {
+        printResult(io, fail('worker.minimax', 'CONFIRMATION_REQUIRED', 'This worker only runs with explicit confirmation because inputs may be sent to the external MiniMax provider', {}, ['Rerun with --confirm after removing secrets from worker inputs']), options.json);
+        process.exitCode = 1;
+        return;
+    }
+    const sessionId = options.sessionId.trim();
+    const goal = options.goal.trim();
+    const codingTask = options.codingTask.trim();
+    const unitTestTask = options.unitTestTask.trim();
+    if (!sessionId || !goal || !codingTask || !unitTestTask) {
+        printResult(io, fail('worker.minimax', 'INVALID_WORKER_INPUT', 'Worker inputs must be non-empty', {}, ['Provide non-empty values for --session-id, --goal, --coding-task, and --unit-test-task']), options.json);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const result = await runMiniMaxWorker(getMiniMaxProviderConfig(), { sessionId, goal, codingTask, unitTestTask, model: options.model });
+        const safeResult = summarizeMiniMaxWorkerResult(result);
+        if (!result.provider.configured) {
+            printResult(io, fail('worker.minimax', 'MINIMAX_PROVIDER_NOT_CONFIGURED', 'MiniMax provider requires baseUrl and apiKey in user config', safeResult, ['Run peaks config provider minimax set --base-url <url> and either MINIMAX_API_KEY']), options.json);
+            process.exitCode = 1;
+            return;
+        }
+        printResult(io, result.provider.ok ? ok('worker.minimax', safeResult) : fail('worker.minimax', 'MINIMAX_WORKER_FAILED', 'MiniMax worker execution failed', safeResult, ['Check the MiniMax base URL, API key, and worker tasks']), options.json);
+        if (!result.provider.ok) {
+            process.exitCode = 1;
+        }
+    }
+    catch (error) {
+        printResult(io, fail('worker.minimax', 'MINIMAX_WORKER_FAILED', redactSensitiveErrorMessage(getErrorMessage(error)), {}, ['Check the MiniMax base URL, API key, and worker tasks']), options.json);
+        process.exitCode = 1;
+    }
+}
+export function registerWorkerCommands(program, io) {
+    const worker = program.command('worker').description('Run controlled execution workers');
+    addMiniMaxWorkerOptions(worker.command('minimax')).action(async (options) => runMiniMaxWorkerCommand(io, options));
+    addMiniMaxWorkerOptions(program.command('minimax-worker')).action(async (options) => runMiniMaxWorkerCommand(io, options));
+}

package/dist/cli/commands/workflow-commands.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerWorkflowCommands(program: Command, io: ProgramIO): void;