peaks-loop 4.0.14 → 4.0.16

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## 4.0.16 — 2026-08-06 (ESLint JS/TS Gate + OCR 1.8.x multi-language reviewer + lint strictification)
+
+**8 NEW CLI capabilities** (PRD-002 + PRD-002b; 11 commits on main, 26 files, +1509/-960 LOC):
+
+- `peaks lint` (parent, un-hidden) — JS/TS ESLint verifier for peaks-rd Gate B5. Calls `npx --package eslint@10.8.0 --package @typescript-eslint/parser@8.66.0 --package @typescript-eslint/eslint-plugin@8.66.0 --package eslint-plugin-import@2.32.0 -- eslint`. Soft-fail (npx missing / errors never block a slice).
+- `peaks lint check` (default) — diffOnly=true + baselineFile waiver + redLineMode='baseline-aware'. Envelope has `state` + `findings` + `summary` + `baselineWaived` + `redLine` + `durationMs`.
+- `peaks lint baseline` — one-shot full-repo scan; writes `.peaks/lint/baseline.json` (project-level, gitignored by default; peak-loop ships its own as a TS CLI reference fixture).
+- `peaks lint --red-line` (or `peaks lint check --red-line`) — generates `.peaks/memory/lint-redline-summary.md` so the next LLM invocation reads prior sibling-violation context before writing new code.
+- `peaks code-review detect-ocr-18` — 5-state probe for OCR 1.8.x install + LLM config readiness.
+- `peaks code-review run-ocr-18 --language <py|go|java|rust|cpp|csharp|ruby|php>` — 8-language multi-language reviewer (AACR-bench coverage).
+- `peaks code-review ocr-18-delegate-preview` — Delegation Mode entry; no LLM key required (host agent's key suffices).
+
+**3 NEW runner options** on `src/services/lint/eslint-runner.ts`:
+- `diffOnly` (default `true`): filter ESLint findings to `git diff HEAD` hunks; 存量违规 silently skipped (no-touch-stockcode invariant).
+- `baselineFile` (default `.peaks/lint/baseline.json`): waiver matching on ruleId + file + line; baseline-violations never counted in `summary`.
+- `redLineMode` (default `'baseline-aware'`): aggregate baseline violations by ruleId; output `## Red-line` section for LLM.
+
+**Rule severity promotion** (`config/eslint/.peaks-rules.cjs`):
+- `max-lines: ['error', { max: 400, ... }]` (NEW, was implicit `eslint:recommended` only).
+- `max-lines-per-function`: `['warn', 50]` → `['error', 50]`.
+- `complexity: ['warn', 10]` unchanged (soft guidance, not hard limit).
+
+**OCR 1.8.9 surface clear-zero** (PRD-002 S2):
+- `@alibaba-group/open-code-review` 1.3.1 peer → 1.8.9 required dep (1.8.x per-platform `optionalDependencies` structurally removes the 2.0.3-era postinstall HTTPS problem).
+- Deleted: `src/services/code-review/ocr-service.ts` (463 lines) + 4 config types + 4 functions + skill ref `ocr-integration.md` (229 lines).
+- 8 languages now supported: Python / Go / Java / Rust / C++ / C# / Ruby / PHP.
+
+**7 binding decisions** (PRD-002b):
+- D1 with 4.0.16 release; D2 cost-unbounded single slice; D3 lint for LLM consumption; D4 incremental-first (diffOnly); D5 no-touch-stockcode (baseline waiver); D6 project-aware baseline (downstream MUST regenerate); D7 no downstream-migration slice (`npm update peaks-loop` propagates).
+
+**Quality gates**: `pnpm build` exit 0; 19 new BDD tests (8 eslint-runner + 2 lint-commands + 9 ocr-multilang-adapter); cycle-1 stdout narrowing regression preserved at `src/services/lint/eslint-runner.ts:134/144/187`; verify-pipeline 10/10 gates PASS.
+
+**5 pre-existing test timeouts** (NOT introduced by this slice; out of scope for 4.0.16; future slice `2026-08-06-fix-pre-existing-test-timeouts`):
+- `tests/unit/services/auto-compact-orchestrator.test.ts:270`
+- `tests/unit/services/skills/presence-lease-service.test.ts:163`
+- `tests/unit/services/session-binding-bridge-path-canonicalize.test.ts:117`
+- `tests/unit/cli/statusline-cli-integration.test.ts:895`
+- (1 more, full-suite-only)
+
+**Lockstep bump.** peaks-loop-shared `0.0.45 → 0.0.46` (CLI_VERSION re-stamped to 4.0.16).
+
+## 4.0.15 — 2026-08-06 (rotation guards tightening + caller-derived workflowId + caller-binding primary source + atomic write hygiene)
+
+**Tightens rotation guards with 4th same-process re-resolve short-circuit** (slice `2026-08-06-rotation-guards-and-caller-binding`, commit `f38a796f`):
+- `src/services/session/session-binding-bridge.ts` introduces a module-scoped `lastResolvedOuter: { value: string | undefined; resolvedAt: number } | null` populated on every non-throw `getCurrentOuterSessionId` call (env hit / cache hit / undefined fallback). `ensureSessionWithRotation` now short-circuits on a 4th additive guard: when `lastResolvedOuter.value === currentOuterSessionId === boundOuter`, the rotation path is skipped. The 3 legacy guards (currentOuterSessionId === undefined / boundOuter empty / boundOuter === currentOuter) are preserved verbatim per PRD PB3. Test seam `_resetLastResolvedOuterForTest()` exported.
+- Tests: `tests/unit/session/rotation-guards-tightening.test.ts` (11 cases: 3 legacy-guard regressions + 4th-guard flip A→B same-process + per-process isolation + writeAtomic fallback + skipRotate + module-state integrity).
+
+**Caller-derived workflowId in legacy compat shim** (slice same, commit `2f6322a3`):
+- `src/services/skills/skill-presence-service.ts:391` switches the legacy compat shim's `workflowId` from `wf-${sessionId}-compat` to `wf-${projection.callerId.slice(0, 189)}-compat`. The slice(0, 189) protects against `WORKFLOW_ID_REGEX` overflow (3 + 200 callerId + 7 = 210 chars > 200 regex cap). `presence-lease-service.ts` and the sub-agent graph workflowId generators at `workflow-presence-lifecycle.ts:95` + `workflow-lifecycle-commands.ts:125` are untouched (per-invocation `wf-${Date.now().toString(36)}`, NOT legacy compat shims).
+- No migration of legacy `wf-<sid>-compat` leases from 4.0.14 installs; they become orphans and are reaped by the 24h30m stale-started GC at `presence-lease-service.ts:42`.
+- Tests: `tests/unit/services/skills/workflow-id-caller-derivation.test.ts` (8 cases: short / long / 200-char callerId boundary / graphRef D4a validation / 2-caller key isolation / legacy back-compat read / slice loss-free regression).
+
+**Caller-binding becomes primary binding source + atomic write hygiene** (slice same, commit `97caa66b`):
+- `src/services/session/session-binding-bridge.ts:184-310` `ensureSession` now uses a 3-tier read order: **`callers/<callerId>.json` (if `resolveCallerProjection` succeeds)** → `session.json` (fallback) → fresh-generate. Write path: BOTH files written on first bind or rotation, with `callers/<callerId>.json` FIRST (source of truth) + `session.json` SECOND (denormalized cache for legacy consumers). The lazy `resolveCallerProjection` import is wrapped in try/catch so `PEAKS_CALLER_NOT_RESOLVED` falls through to `session.json` (preserves legacy behavior).
+- `src/services/session/session-manager.ts` adds internal helper `getSessionIdFromCallerBinding` (NOT exported; called from `getSessionId` and `getSessionIdCanonical` BEFORE `readSessionFile` / `readSessionFileCanonical`). Public signatures unchanged — all 14 `getSessionId(` consumers continue to compile and run without modification.
+- `src/services/session/caller-binding-service.ts:113-133` `setCallerBinding` swaps non-atomic `writeFileSync` for `atomicWriteJson` (single-line, plus import + removal of the now-redundant `mkdirSync` block — atomicWriteJson does its own `mkdirSync(dir, { recursive: true })`).
+- `src/cli/commands/outer-cache-commands.ts:125` `peaks outer-cache write` swaps non-atomic `writeFileSync` for `atomicWriteJson` (carry-forward bug from 4.0.14 QA issue #1: a power-loss mid-write left the cache in "permanent bad state" until the next SessionStart).
+- Tests: `tests/unit/session/caller-binding-primary-source.test.ts` (11 cases: 3-tier read order / dual-write ordering / callerId-unresolved fallback / malformed file graceful fallback / `getSessionId` preservation / `skipRotate` honored / 14-consumer regression / `setCallerBinding` atomic / temp-file cleanup) + `tests/unit/cli/outer-cache-atomic-write.test.ts` (4 cases: writeFileSync residue check / atomicWriteJson call / 4.0.14 AC1-AC7 regression / simulated write failure).
+- All 5 modified files stay under the 800 LOC cap: `session-binding-bridge.ts` 527 / `skill-presence-service.ts` 695 / `session-manager.ts` 618 / `caller-binding-service.ts` 204 / `outer-cache-commands.ts` 201. Regression sweep: 229/230 PASS / 1 SKIP (pre-existing Win-only conditional). `tsc -p tsconfig.json --noEmit` clean for slice files.
+
+**Lockstep bump.** peaks-loop-shared `0.0.44 → 0.0.45` (CLI_VERSION re-stamped to 4.0.15); peaks-loop-mut `0.1.17 → 0.1.18`; peaks-loop-shared-channel `0.0.21 → 0.0.22`.
+
 ## 4.0.14 — 2026-08-06 (outer-session cache + ensureSession meta over-coverage)
 
 **Fixes the "5 terminals / 5 sessions stuck on 3fe1be" bug** (slice `2026-08-06-session-outer-cache-and-meta-coverage`, commit `f02a9b45`):

package/config/eslint/.peaks-rules.cjs

@@ -70,9 +70,16 @@ module.exports = {
   ],
   rules: {
     // L1 (eslint built-in) — always on, no plugin package required.
+    // PRD-002b slice: max-lines + max-lines-per-function promoted warn → error.
+    // D5 no-touch-stockcode invariant:存量违规通过 .peaks/lint/baseline.json 豁免
+    // (see src/services/lint/eslint-runner.ts baselineFile option).
+    'max-lines': [
+      'error',
+      { max: 400, skipBlankLines: true, skipComments: true }
+    ],
     complexity: ['warn', { max: 10 }],
     'max-lines-per-function': [
-      'warn',
+      'error',
       { max: 50, skipComments: true, skipBlankLines: true }
     ],
     'max-params': ['warn', { max: 4 }],

package/dist/cli/commands/_register.js

@@ -30,6 +30,7 @@ import { registerIdeCommands } from './ide-commands.js';
 import { registerImpactCommands } from './impact-commands.js';
 import { registerJobCommands } from './job-commands.js';
 import { registerLegacyCommands } from './legacy-commands.js';
+import { registerLintCommands } from './lint-commands.js';
 import { registerLogCommands } from './log-commands.js';
 import { registerLoopCommands } from './loop-commands.js';
 import { registerWorkflowEvalCommands } from './loop-eval-commands.js';
@@ -99,7 +100,7 @@ const REGISTRATIONS = [
     ['prd-blocks-commands', registerPrdBlocksCommands], ['user-touchpoint-commands', registerUserTouchpointCommands],
     ['slice-review-commands', registerSliceReviewCommands], ['qa-business-review-commands', registerQaBusinessReviewCommands],
     ['slice-integrate-commands', registerSliceIntegrateCommands], ['doc-commands', registerDocCommands],
-    ['legacy-commands', registerLegacyCommands], ['role-commands', registerRoleCommands],
+    ['legacy-commands', registerLegacyCommands], ['lint-commands', registerLintCommands], ['role-commands', registerRoleCommands],
     ['complexity-commands', registerComplexityCommands], ['sub-agent-commands', registerSubAgentCommands],
     ['sub-agent-shutdown-commands', registerSubAgentShutdownCommands], ['e2e-verify', registerE2EVerifyCommand],
     ['governance-classify-contract-commands', registerContractCommands],

package/dist/cli/commands/code-review-commands.d.ts

@@ -1,34 +1,6 @@
 /**
- * peaks code-review * CLI surface — soft-optional ocr integration
- * for peaks-rd Gate B3.
- *
- * Per the "skill-first / CLI-auxiliary" tenet, peaks-rd SKILL.md
- * is the primary surface; this CLI returns structured JSON the
- * skill consumes to produce a second-opinion code review.
- *
- * Subcommands:
- *   - `peaks code-review detect-ocr` — JSON envelope describing the
- *     current ocr install + config state (5 reasons: ready /
- *     package-missing / binary-missing / config-missing /
- *     detection-failed). Source of truth for the LLM endpoint
- *     config is `peaksConfig.ocr.llm` in the user's peaks-loop
- *     config (NOT `~/.opencodereview/config.json`).
- *   - `peaks code-review run-ocr [--from --to --commit]` — invokes
- *     `ocr review --format json` and wraps the result in a peaks
- *     ResultEnvelope. Soft-fails when ocr isn't ready so peaks-rd
- *     can continue without the second-opinion review. Injects the
- *     LLM endpoint config as env vars (OCR_LLM_URL / OCR_LLM_TOKEN
- *     / OCR_LLM_MODEL / OCR_USE_ANTHROPIC / OCR_LLM_AUTH_HEADER)
- *     so the ocr subprocess never has to read from a file the
- *     user did not set up themselves.
- *   - `peaks code-review config-template` — prints the JSON snippet
- *     the user should paste into their peaks-loop config.json. It
- *     does NOT write anything. The user is in control of their
- *     LLM token / URL / model. No `peaks ocr config set`; the user
- *     either edits the JSON directly or uses `peaks config set
- *     --key ocr.llm.url --value '...'` (a peaks-loop command, not
- *     an ocr command).
+ * peaks code-review * CLI surface — ECC bridge + OCR 1.8.x.
  */
-import { Command } from 'commander';
+import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';
 export declare function registerCodeReviewCommands(program: Command, io: ProgramIO): void;

package/dist/cli/commands/code-review-commands.js

@@ -1,83 +1,61 @@
-import { getOcrConfigTemplate, detectOcr, runOcrReview } from '../../services/code-review/ocr-service.js';
-import { getOcrLlmConfig, getUserConfigPath, redactConfigSecrets } from '../../services/config/config-service.js';
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
+import { detectOcr18 } from '../../services/lint/detect-ocr-18.js';
+import { OCR_18_LANGUAGES, runOcr18 } from '../../services/lint/ocr-multilang-adapter.js';
+const SUPPORTED_LANGUAGES_SET = new Set(OCR_18_LANGUAGES);
 export function registerCodeReviewCommands(program, io) {
     const codeReview = program
         .command('code-review', { hidden: true })
-        .description('Code-review primitives for peaks-rd Gate B3. Wraps the soft-optional `@alibaba-group/open-code-review` (ocr) tool when it is installed + configured; peaks-rd uses the structured JSON output as a second-opinion review alongside its own LLM review. ocr is a peerDependency of peaks-loop 2.8.2+ (was briefly promoted to a hard dependency in 2.0.1/2.0.2, then demoted to optionalDependencies 2.0.3+ — peer in 2.8.2 because its postinstall downloads a Go binary via HTTPS and would otherwise slow `npm i -g peaks-loop` in restricted environments). Install manually with `npm i -g @alibaba-group/open-code-review` if you want second-opinion reviews. LLM endpoint config lives under `peaksConfig.ocr.llm` in the user config — run `peaks code-review config-template` to see the JSON snippet to paste.');
+        .description('Code-review primitives for peaks-rd Gate B3. ECC bridge (JS/TS) + OCR 1.8.x multi-language.');
     addJsonOption(codeReview
-        .command('detect-ocr')
-        .description('Read-only probe: returns the ocr install + config state as a JSON envelope (5 reasons: ready / package-missing / binary-missing / config-missing / detection-failed). peaks-rd calls this first to decide whether to invoke `run-ocr`. Reads the LLM endpoint from `peaksConfig.ocr.llm` (not from ~/.opencodereview/config.json).')
-        .option('--project <path>', 'project root (default: cwd)')).action((options) => {
-        const projectRoot = options.project ?? process.cwd();
+        .command('detect-ocr-18')
+        .description('Read-only probe: returns the 5-state OCR 1.8.x runtime envelope (ready / ocr18-missing / binary-missing / llm-config-missing / detection-failed).')).action((options) => {
         try {
-            const detect = detectOcr({
-                cwd: projectRoot,
-                peaksConfigPath: getUserConfigPath(),
-                peaksOcrConfig: getOcrLlmConfig(),
-            });
-            const envelope = detect.state === 'ready'
-                ? ok('code-review.detect-ocr', detect, [...detect.warnings], [...detect.nextActions])
-                : fail('code-review.detect-ocr', detect.state.toUpperCase().replace(/-/g, '_'), `ocr is not ready: ${detect.state}`, detect, [...detect.nextActions]);
+            const result = detectOcr18();
+            const envelope = result.state === 'ready'
+                ? ok('code-review.detect-ocr-18', result, [...result.warnings], [...result.nextActions])
+                : fail('code-review.detect-ocr-18', result.state.toUpperCase().replace(/-/g, '_'), `ocr 1.8.x is not ready: ${result.state}`, result, [...result.nextActions]);
             printResult(io, envelope, options.json);
-            if (detect.state !== 'ready') {
-                process.exitCode = 1;
-            }
+            if (result.state !== 'ready')
+                process.exitCode = 0; // soft-fail
         }
         catch (error) {
-            printResult(io, fail('code-review.detect-ocr', 'DETECT_OCR_FAILED', getErrorMessage(error), { state: 'detection-failed', packageInstalled: false, binaryPath: null, version: null, configPath: '', configValid: false, missingKeys: [] }, ['Re-run with `--project <path>` pointing at a known-good project root.']), options.json);
-            process.exitCode = 1;
+            printResult(io, fail('code-review.detect-ocr-18', 'DETECT_FAILED', getErrorMessage(error), { state: 'detection-failed' }, ['Re-run with a valid npx on PATH.']), options.json);
         }
     });
     addJsonOption(codeReview
-        .command('run-ocr')
-        .description('Run `ocr review --format json` and return the parsed JSON envelope. Soft-fails (exit 0, ok=false) when ocr is not ready, so peaks-rd can continue without the second-opinion review and surface the install/config nextActions to the user. The peaks-loop `peaksConfig.ocr.llm` block is injected as OCR_LLM_URL / OCR_LLM_TOKEN / ... env vars so the ocr subprocess never has to read ~/.opencodereview/config.json.')
-        .option('--project <path>', 'project root (default: cwd)')
-        .option('--from <ref>', 'git ref to diff from (e.g. main, origin/main)')
-        .option('--to <ref>', 'git ref to diff to (e.g. HEAD, feature-branch)')
-        .option('--commit <sha>', 'specific commit SHA to review')).action((options) => {
-        const projectRoot = options.project ?? process.cwd();
-        try {
-            const result = runOcrReview({
-                cwd: projectRoot,
-                peaksConfigPath: getUserConfigPath(),
-                peaksOcrConfig: getOcrLlmConfig(),
-                input: { projectRoot, ...(options.from !== undefined && { from: options.from }), ...(options.to !== undefined && { to: options.to }), ...(options.commit !== undefined && { commit: options.commit }) },
-            });
-            // Soft-fail policy: when ocr is not ready or the subprocess
-            // failed, we still return a JSON envelope (ok=false) but
-            // do NOT set process.exitCode — the caller is expected to
-            // pattern-match on the state and proceed without ocr.
-            const envelope = result.spawned && result.exitCode === 0
-                ? ok('code-review.run-ocr', result, [...result.warnings], [...result.nextActions])
-                : fail('code-review.run-ocr', result.state.toUpperCase().replace(/-/g, '_'), result.spawned ? `ocr review exited ${result.exitCode}` : `ocr is not ready: ${result.state}`, result, [...result.nextActions]);
-            printResult(io, envelope, options.json);
-            // Intentionally do NOT set process.exitCode here — soft-fail.
-        }
-        catch (error) {
-            printResult(io, fail('code-review.run-ocr', 'RUN_OCR_FAILED', getErrorMessage(error), { spawned: false, state: 'detection-failed', exitCode: null, stdout: '', stderr: '', durationMs: 0, parsed: null }, ['Run `peaks code-review detect-ocr --json` to inspect ocr install state.']), options.json);
-            // Soft-fail on exception too — peaks-rd should continue.
+        .command('run-ocr-18')
+        .description('Invoke `ocr review --filter-language <lang>` (or `ocr delegate preview` when --delegate) for one of 8 supported languages.')
+        .option('--language <lang>', `target language: ${OCR_18_LANGUAGES.join(' | ')}`)
+        .option('--from <ref>', 'git ref to diff from (e.g. main)')
+        .option('--to <ref>', 'git ref to diff to (e.g. HEAD)')
+        .option('--commit <sha>', 'specific commit SHA to review')
+        .option('--delegate', 'use Delegation Mode (no LLM key required)')).action((options) => {
+        const language = options.language;
+        if (language === undefined || !SUPPORTED_LANGUAGES_SET.has(language)) {
+            printResult(io, fail('code-review.run-ocr-18', 'LANGUAGE_UNSUPPORTED', `unsupported language: ${language ?? '<missing>'}`, { state: 'language-unsupported', supported: OCR_18_LANGUAGES }, [`Pick one of: ${OCR_18_LANGUAGES.join(', ')}`]), options.json);
+            return;
         }
+        const result = runOcr18({
+            cwd: process.cwd(),
+            language: language,
+            ...(options.from !== undefined ? { from: options.from } : {}),
+            ...(options.to !== undefined ? { to: options.to } : {}),
+            ...(options.commit !== undefined ? { commit: options.commit } : {}),
+            ...(options.delegate === true ? { delegate: true } : {})
+        });
+        const envelope = result.state === 'ok'
+            ? ok('code-review.run-ocr-18', result, [], [])
+            : fail('code-review.run-ocr-18', result.state.toUpperCase().replace(/-/g, '_'), `ocr 1.8.x state: ${result.state}`, result, ['Re-run `peaks code-review detect-ocr-18 --json` to refresh.']);
+        printResult(io, envelope, options.json);
     });
     addJsonOption(codeReview
-        .command('config-template')
-        .description('Print the JSON snippet the user should paste into their peaks-loop config (`peaksConfig.ocr.llm`). This command does NOT write anything. The user is the only party that touches the LLM token / URL / model — peaks-loop never auto-configures the endpoint. Token value is shown as the placeholder "<your-api-key>"; replace it before pasting.')).action((options) => {
-        const template = getOcrConfigTemplate();
-        const targetPath = getUserConfigPath();
-        const currentConfig = getOcrLlmConfig();
-        const currentRedacted = currentConfig === null ? null : redactConfigSecrets(currentConfig, 'ocr.llm');
-        const payload = {
-            targetPath,
-            currentConfig: currentRedacted,
-            template,
-            nextActions: [
-                `Edit ${targetPath} and add the "ocr" block from the template above.`,
-                'OR use peaks-loop config set with one key at a time: `peaks config set --key ocr.llm.url --value \'<url>\'` etc.',
-                'The authToken field is sensitive and is stored in the user layer (`~/.peaks/config.json`); peaks-loop will not commit it.',
-                'Re-run `peaks code-review detect-ocr --json` to verify the new state is `ready`.',
-            ],
-        };
-        printResult(io, ok('code-review.config-template', payload), options.json);
+        .command('ocr-18-delegate-preview')
+        .description('Print the Delegation Mode spec for the host agent (no LLM key required).')).action((options) => {
+        const result = runOcr18({ cwd: process.cwd(), language: 'python', delegate: true });
+        const envelope = result.state === 'ok'
+            ? ok('code-review.ocr-18-delegate-preview', result, [], [])
+            : fail('code-review.ocr-18-delegate-preview', result.state.toUpperCase().replace(/-/g, '_'), `ocr 1.8.x state: ${result.state}`, result, ['Re-run `peaks code-review detect-ocr-18 --json` to refresh.']);
+        printResult(io, envelope, options.json);
     });
 }

package/dist/cli/commands/lint-commands.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `peaks code lint` — read-only ESLint verifier (Gate B5).
+ *
+ * PRD-002b slice: three subcommands expose the runner's new
+ * incremental-first / no-touch-stockcode options to the CLI surface.
+ *
+ *   - `peaks lint baseline` — one-shot full-repo scan; writes
+ *     `.peaks/lint/baseline.json` (project-level, gitignored by
+ *     default). Each project regenerates its own baseline; the file
+ *     is project-aware (D6 binding).
+ *   - `peaks lint check` — default; diffOnly=true + baselineFile
+ *     waiver + redLineMode='baseline-aware'. This is the LLM-facing
+ *     Gate B5 entry point.
+ *   - `peaks lint --red-line` — write
+ *     `.peaks/memory/lint-redline-summary.md` so the next LLM
+ *     invocation can read the cross-project red-line before
+ *     writing more code (supplementary S2 dual-track).
+ */
+import type { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerLintCommands(program: Command, io: ProgramIO): void;

package/dist/cli/commands/lint-commands.js

@@ -0,0 +1,146 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+import { fail, ok } from 'peaks-loop-shared/result';
+import { detectEslint } from '../../services/lint/detect-eslint.js';
+import { runEslint } from '../../services/lint/eslint-runner.js';
+function parseTimeoutMs(value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number.parseInt(value, 10);
+    if (Number.isNaN(parsed) || parsed <= 0) {
+        throw new Error(`--timeout-ms must be a positive integer; received "${value}"`);
+    }
+    return parsed;
+}
+function writeBaselineJson(cwd, baselineFile, result) {
+    const fullPath = join(cwd, baselineFile);
+    mkdirSync(dirname(fullPath), { recursive: true });
+    const violations = result.findings.map((f) => ({
+        ruleId: f.ruleId,
+        file: f.filePath,
+        line: f.line,
+        severity: f.severity,
+        message: f.message
+    }));
+    const payload = {
+        version: 1,
+        generatedAt: new Date().toISOString(),
+        toolVersion: 'peaks-loop-4.0.16+',
+        violations
+    };
+    writeFileSync(fullPath, JSON.stringify(payload, null, 2), 'utf8');
+    return { path: fullPath, violations: violations.length };
+}
+function writeRedLineSummary(cwd, result) {
+    const fullPath = join(cwd, '.peaks/memory/lint-redline-summary.md');
+    mkdirSync(dirname(fullPath), { recursive: true });
+    const lines = [];
+    lines.push('---');
+    lines.push('title: lint red-line summary (auto-generated)');
+    lines.push('rid: 2026-08-06-eslint-strict-metrics');
+    lines.push('generatedAt: ' + new Date().toISOString());
+    lines.push('source: `peaks lint --red-line` (PRD-002b slice)');
+    lines.push('---');
+    lines.push('');
+    lines.push('# Lint red-line summary');
+    lines.push('');
+    lines.push('> LLM-facing card. The next LLM invocation MUST read this file before writing JS/TS code under the peaks-rd Gate B5 surface.');
+    lines.push('');
+    lines.push('## Top ruleIds (sorted by baseline violation count)');
+    lines.push('');
+    if (result.redLine.length === 0) {
+        lines.push('No baseline violations recorded — project is lint-clean against the current baseline.');
+    }
+    else {
+        for (const entry of result.redLine) {
+            lines.push(`- \`${entry.ruleId}\`: ${entry.count} occurrence${entry.count === 1 ? '' : 's'}`);
+            for (const top of entry.topFiles) {
+                lines.push(`    - ${top.file} (${top.count})`);
+            }
+        }
+    }
+    lines.push('');
+    writeFileSync(fullPath, lines.join('\n'), 'utf8');
+    return { path: fullPath, ruleIds: result.redLine.map((r) => r.ruleId) };
+}
+export function registerLintCommands(program, io) {
+    const lint = program
+        .command('lint')
+        .description('Read-only ESLint verifier (peaks-rd Gate B5). Soft-fails when the toolchain is missing.');
+    addJsonOption(lint
+        .command('detect-eslint', { isDefault: false })
+        .description('Read-only probe: returns the 5-state ESLint runtime envelope (ready / eslint-missing / config-error / npx-failed / detection-failed).')).action((options) => {
+        const result = detectEslint();
+        const envelope = result.state === 'ready'
+            ? ok('code.lint.detect-eslint', result, [...result.warnings], [...result.nextActions])
+            : fail('code.lint.detect-eslint', result.state.toUpperCase().replace(/-/g, '_'), `eslint is not ready: ${result.state}`, result, [...result.nextActions]);
+        printResult(io, envelope, options.json);
+        if (result.state !== 'ready') {
+            process.exitCode = 0; // soft-fail
+        }
+    });
+    addJsonOption(lint
+        .command('check', { isDefault: true })
+        .description('Run the read-only ESLint verifier on diff hunks + apply baseline waiver + emit red-line (default Gate B5 entry).')
+        .option('--scope <path>', 'lint scope (default: project root)')
+        .option('--config <path>', 'explicit ESLint config path')
+        .option('--timeout-ms <ms>', 'subprocess timeout in milliseconds (default 60000)')
+        .option('--baseline-file <path>', 'baseline JSON path (default .peaks/lint/baseline.json)')
+        .option('--red-line', 'also write .peaks/memory/lint-redline-summary.md')).action((options) => {
+        let timeoutMs;
+        try {
+            timeoutMs = parseTimeoutMs(options.timeoutMs);
+        }
+        catch (error) {
+            printResult(io, fail('code.lint', 'INVALID_TIMEOUT', getErrorMessage(error), { state: 'execution-failed' }, ['Re-run with --timeout-ms <positive integer>.']), options.json);
+            return;
+        }
+        const cwd = process.cwd();
+        const runOptions = {
+            cwd,
+            ...(options.scope !== undefined ? { scope: options.scope } : {}),
+            ...(options.configPath !== undefined ? { configPath: options.configPath } : {}),
+            ...(options.baselineFile !== undefined ? { baselineFile: options.baselineFile } : {}),
+            ...(timeoutMs !== undefined ? { timeoutMs } : {})
+        };
+        const result = runEslint(runOptions);
+        const extras = {};
+        if (options.redLine === true) {
+            extras.redLineSummary = writeRedLineSummary(cwd, result);
+        }
+        const envelope = result.state === 'ok' || result.state === 'baseline-missing'
+            ? ok('code.lint', { ...result, ...extras }, [], [])
+            : fail('code.lint', result.state.toUpperCase().replace(/-/g, '_'), `peaks code lint state: ${result.state}`, { ...result, ...extras }, [`Re-run with --scope <path> or restore the ESLint toolchain.`]);
+        printResult(io, envelope, options.json);
+    });
+    addJsonOption(lint
+        .command('baseline')
+        .description('One-shot full-repo scan; writes .peaks/lint/baseline.json (project-level, gitignored by default).')
+        .option('--scope <path>', 'lint scope (default: project root)')
+        .option('--config <path>', 'explicit ESLint config path')
+        .option('--timeout-ms <ms>', 'subprocess timeout in milliseconds (default 60000)')
+        .option('--baseline-file <path>', 'baseline JSON output path (default .peaks/lint/baseline.json)')).action((options) => {
+        let timeoutMs;
+        try {
+            timeoutMs = parseTimeoutMs(options.timeoutMs);
+        }
+        catch (error) {
+            printResult(io, fail('code.lint.baseline', 'INVALID_TIMEOUT', getErrorMessage(error), { state: 'execution-failed' }, ['Re-run with --timeout-ms <positive integer>.']), options.json);
+            return;
+        }
+        const cwd = process.cwd();
+        const runOptions = {
+            cwd,
+            diffOnly: false,
+            ...(options.scope !== undefined ? { scope: options.scope } : {}),
+            ...(options.configPath !== undefined ? { configPath: options.configPath } : {}),
+            ...(timeoutMs !== undefined ? { timeoutMs } : {})
+        };
+        const result = runEslint(runOptions);
+        const baselineFile = options.baselineFile ?? '.peaks/lint/baseline.json';
+        const written = writeBaselineJson(cwd, baselineFile, result);
+        const envelope = ok('code.lint.baseline', { state: result.state, findings: result.findings.length, ...written }, [], ['Commit baseline.json (or .gitignore it). Peak-loop ships its own baseline as a reference fixture.']);
+        printResult(io, envelope, options.json);
+    });
+}

package/dist/cli/commands/outer-cache-commands.js

@@ -25,9 +25,10 @@
  * Both subcommands accept `--project <path>` (defaults to cwd / git
  * root) and `--json` (default in TTY-less invocations).
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fail, ok } from 'peaks-loop-shared/result';
+import { atomicWriteJson } from '../../services/ide/shared/atomic-json.js';
 import { addJsonOption, printResult } from '../cli-helpers.js';
 import { findProjectRoot } from '../../services/config/config-safety.js';
 const OUTER_SESSION_CACHE_REL = join('.peaks', '_runtime', '.outer-session-cache.json');
@@ -88,10 +89,16 @@ export function registerOuterCacheCommands(program, io) {
         const capturedAt = new Date().toISOString();
         const payload = { outerSessionId, capturedAt };
         try {
-            const dir = dirname(cachePath);
-            if (!existsSync(dir))
-                mkdirSync(dir, { recursive: true });
-            writeFileSync(cachePath, JSON.stringify(payload, null, 2) + '\n', 'utf8');
+            // Slice 2026-08-06-session-cacde8-A.5c: atomic write (temp +
+            // rename) so a power-loss mid-write cannot leave the cache file
+            // truncated. `atomicWriteJson` owns its own
+            // `mkdirSync(dir, { recursive: true })` so the inline mkdir
+            // block is removed. The previous `writeFileSync` path was the
+            // 4.0.14 carry-forward QA issue #1; the bridge's cache-miss
+            // fallback treated the truncated state as a miss (safe) but
+            // the file was stuck in "permanent bad state" until the next
+            // SessionStart fired.
+            atomicWriteJson(cachePath, payload);
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);

package/dist/cli/commands/security-audit-commands.d.ts

@@ -7,7 +7,7 @@
  *   - `peaks security-audit detect` — JSON envelope describing the
  *     5-state security-audit runtime (ready / handoff-missing /
  *     template-missing / dispatch-failed / envelope-malformed).
- *     Mirrors `peaks code-review detect-ocr` semantics.
+ *     Mirrors the ECC bridge detect semantics.
  *   - `peaks security-audit run` — runs the full pipeline:
  *     detect → read handoff + template → write audit artifact to
  *     `.peaks/_runtime/<sid>/audit/security-<rid>.md`. Reads the

package/dist/cli/commands/security-audit-commands.js

@@ -40,7 +40,7 @@ export function registerSecurityAuditCommands(program, io) {
         .description('Independent security audit skill driver. Reads the immutable peaks-prd handoff (sha256-locked) + the project-level security-template.md, then writes a structured security-<rid>.md artifact. Decoupled from peaks-rd 5-way fan-out per slice v2.12.0 (Group A, Tier 2). See skills/bee/peaks-security-audit/SKILL.md for the full workflow.');
     addJsonOption(securityAudit
         .command('detect')
-        .description('Read-only probe: returns the 5-state security-audit runtime as a JSON envelope (ready / handoff-missing / template-missing / dispatch-failed / envelope-malformed). The peaks-security-audit skill calls this first to decide whether to invoke `run`. Mirrors `peaks code-review detect-ocr` semantics.')
+        .description('Read-only probe: returns the 5-state security-audit runtime as a JSON envelope (ready / handoff-missing / template-missing / dispatch-failed / envelope-malformed). The peaks-security-audit skill calls this first to decide whether to invoke `run`. Mirrors the ECC bridge detect semantics.')
         .option('--rid <rid>', 'request id (e.g. 2026-06-27-v2-12-...)')
         .option('--sid <sid>', 'session id (e.g. 2026-06-27-session-...)')
         .option('--project <path>', 'project root (default: cwd)')).action((options) => {

package/dist/services/code-review/ecc-bridge.d.ts

@@ -5,10 +5,7 @@
  * `rd/code-review.md` markdown format that `peaks request transition`
  * Gate B3 already reads (`mustContain: ['## Findings', 'CRITICAL']`).
  *
- * Companion to `ocr-service.ts`: ECC is the in-skill agent option
- * (uses peaks-loop's own Agent tool surface), ocr is the external
- * subprocess option. Both produce a second-opinion code review that
- * the parent RD loop aggregates alongside its own inline review.
+ * ECC is the in-skill agent option and the production Gate B3 path.
  *
  * === Why a bridge (not a direct swap) ===
  *
@@ -54,9 +51,7 @@ export interface EccEnvelope {
     readonly gateAction: EccGateAction;
 }
 /**
- * 5-state detect result — mirrors `ocr-service.ts` `OcrDetectState`
- * (ready / package-missing / binary-missing / config-missing /
- * detection-failed). ECC's analogue:
+ * 5-state ECC detection result:
  *   - `ready`               — ECC plugin is installed and reachable
  *   - `plugin-missing`      — `everything-claude-code` not in skill list
  *   - `agent-missing`       — plugin present but `code-review` agent absent

package/dist/services/config/config-service.d.ts

@@ -1,4 +1,4 @@
-import type { ConfigGetOptions, ConfigLayer, ConfigSetOptions, ConfigV2, OcrAuthHeader, OcrConfig, OcrLlmConfig, PeaksConfig, TokenRef, WorkspaceConfig } from './config-types.js';
+import type { ConfigGetOptions, ConfigLayer, ConfigSetOptions, ConfigV2, PeaksConfig, TokenRef, WorkspaceConfig } from './config-types.js';
 export { resolveProjectRootForConfig, resolveCanonicalProjectRoot } from './config-safety.js';
 /**
  * Load the slim 2.0 `~/.peaks/config.json` file. Returns the parsed
@@ -22,23 +22,6 @@ export type RedactedConfigValue = string | number | boolean | null | RedactedCon
     [key: string]: RedactedConfigValue;
 };
 export declare function redactConfigSecrets(value: unknown, path?: string): RedactedConfigValue;
-/**
- * Read the ocr LLM endpoint config from the user-layer
- * `~/.peaks/config.json`. The user populates this themselves by
- * pasting the `peaks code-review config-template` output (or by
- * running `peaks config set --key ocr.llm.url --value '...'`).
- * peaks-loop never auto-writes these values.
- */
-export declare function getOcrConfig(): OcrConfig;
-/**
- * Return the resolved `OcrLlmConfig` block (`peaksConfig.ocr.llm`)
- * or `null` when the user has not populated the user config. The
- * 5-state OCR detector uses this as the source of truth; when the
- * returned block is missing required fields it produces a
- * `config-missing` state with a templated `nextActions` payload
- * the user can paste into their config.
- */
-export declare function getOcrLlmConfig(): OcrLlmConfig | null;
 export declare function bootstrapProjectLanguageConfig(projectRoot: string, language: string): void;
 export declare function readConfig(projectRoot?: string | null): PeaksConfig;
 export declare function writeConfig(partial: Partial<PeaksConfig>, layer?: ConfigLayer): void;
@@ -53,6 +36,6 @@ export declare function getWorkspaceConfigForPath(path?: string): WorkspaceConfi
 export declare function ensureWorkspaceConfigForPath(path?: string): WorkspaceConfig | null;
 export declare function getWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
 export declare function ensureWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
-export type { OcrAuthHeader, OcrConfig, OcrLlmConfig, TokenRef, WorkspaceConfig, PeaksConfig, ConfigLayer };
+export type { TokenRef, WorkspaceConfig, PeaksConfig, ConfigLayer };
 export { getUserConfigPath } from './config-safety.js';
 export { globalConfigPath } from './config-migration.js';

package/dist/services/config/config-service.js

@@ -412,58 +412,6 @@ export function redactConfigSecrets(value, path = '') {
         return [key, redactConfigSecrets(entry, nextPath)];
     }));
 }
-const OCR_AUTH_HEADERS = new Set(['authorization', 'x-api-key', 'bearer']);
-function toOcrLlmConfig(value) {
-    if (!isRecord(value))
-        return {};
-    const url = typeof value.url === 'string' && value.url.trim().length > 0 ? value.url.trim() : undefined;
-    const authToken = typeof value.authToken === 'string' && value.authToken.length > 0 ? value.authToken : undefined;
-    const model = typeof value.model === 'string' && value.model.trim().length > 0 ? value.model.trim() : undefined;
-    const useAnthropic = typeof value.useAnthropic === 'boolean' ? value.useAnthropic : undefined;
-    const rawAuthHeader = typeof value.authHeader === 'string' ? value.authHeader : undefined;
-    const authHeader = rawAuthHeader !== undefined && OCR_AUTH_HEADERS.has(rawAuthHeader)
-        ? rawAuthHeader
-        : undefined;
-    return {
-        ...(url !== undefined ? { url } : {}),
-        ...(authToken !== undefined ? { authToken } : {}),
-        ...(model !== undefined ? { model } : {}),
-        ...(useAnthropic !== undefined ? { useAnthropic } : {}),
-        ...(authHeader !== undefined ? { authHeader } : {})
-    };
-}
-function toOcrConfig(value) {
-    if (!isRecord(value))
-        return {};
-    return {
-        ...(isRecord(value.llm) ? { llm: toOcrLlmConfig(value.llm) } : {})
-    };
-}
-/**
- * Read the ocr LLM endpoint config from the user-layer
- * `~/.peaks/config.json`. The user populates this themselves by
- * pasting the `peaks code-review config-template` output (or by
- * running `peaks config set --key ocr.llm.url --value '...'`).
- * peaks-loop never auto-writes these values.
- */
-export function getOcrConfig() {
-    const userConfig = readUserJsonFile() ?? {};
-    return toOcrConfig(userConfig.ocr);
-}
-/**
- * Return the resolved `OcrLlmConfig` block (`peaksConfig.ocr.llm`)
- * or `null` when the user has not populated the user config. The
- * 5-state OCR detector uses this as the source of truth; when the
- * returned block is missing required fields it produces a
- * `config-missing` state with a templated `nextActions` payload
- * the user can paste into their config.
- */
-export function getOcrLlmConfig() {
-    const ocr = getOcrConfig();
-    if (!ocr.llm)
-        return null;
-    return ocr.llm;
-}
 function inferHumanLanguage(value) {
     const normalized = value.trim();
     if (!normalized) {