peaks-loop 4.0.15 → 4.0.17

package/dist/cli/commands/code-review-commands.js

@@ -1,83 +1,61 @@
-import { getOcrConfigTemplate, detectOcr, runOcrReview } from '../../services/code-review/ocr-service.js';
-import { getOcrLlmConfig, getUserConfigPath, redactConfigSecrets } from '../../services/config/config-service.js';
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
+import { detectOcr18 } from '../../services/lint/detect-ocr-18.js';
+import { OCR_18_LANGUAGES, runOcr18 } from '../../services/lint/ocr-multilang-adapter.js';
+const SUPPORTED_LANGUAGES_SET = new Set(OCR_18_LANGUAGES);
 export function registerCodeReviewCommands(program, io) {
     const codeReview = program
         .command('code-review', { hidden: true })
-        .description('Code-review primitives for peaks-rd Gate B3. Wraps the soft-optional `@alibaba-group/open-code-review` (ocr) tool when it is installed + configured; peaks-rd uses the structured JSON output as a second-opinion review alongside its own LLM review. ocr is a peerDependency of peaks-loop 2.8.2+ (was briefly promoted to a hard dependency in 2.0.1/2.0.2, then demoted to optionalDependencies 2.0.3+ — peer in 2.8.2 because its postinstall downloads a Go binary via HTTPS and would otherwise slow `npm i -g peaks-loop` in restricted environments). Install manually with `npm i -g @alibaba-group/open-code-review` if you want second-opinion reviews. LLM endpoint config lives under `peaksConfig.ocr.llm` in the user config — run `peaks code-review config-template` to see the JSON snippet to paste.');
+        .description('Code-review primitives for peaks-rd Gate B3. ECC bridge (JS/TS) + OCR 1.8.x multi-language.');
     addJsonOption(codeReview
-        .command('detect-ocr')
-        .description('Read-only probe: returns the ocr install + config state as a JSON envelope (5 reasons: ready / package-missing / binary-missing / config-missing / detection-failed). peaks-rd calls this first to decide whether to invoke `run-ocr`. Reads the LLM endpoint from `peaksConfig.ocr.llm` (not from ~/.opencodereview/config.json).')
-        .option('--project <path>', 'project root (default: cwd)')).action((options) => {
-        const projectRoot = options.project ?? process.cwd();
+        .command('detect-ocr-18')
+        .description('Read-only probe: returns the 5-state OCR 1.8.x runtime envelope (ready / ocr18-missing / binary-missing / llm-config-missing / detection-failed).')).action((options) => {
         try {
-            const detect = detectOcr({
-                cwd: projectRoot,
-                peaksConfigPath: getUserConfigPath(),
-                peaksOcrConfig: getOcrLlmConfig(),
-            });
-            const envelope = detect.state === 'ready'
-                ? ok('code-review.detect-ocr', detect, [...detect.warnings], [...detect.nextActions])
-                : fail('code-review.detect-ocr', detect.state.toUpperCase().replace(/-/g, '_'), `ocr is not ready: ${detect.state}`, detect, [...detect.nextActions]);
+            const result = detectOcr18();
+            const envelope = result.state === 'ready'
+                ? ok('code-review.detect-ocr-18', result, [...result.warnings], [...result.nextActions])
+                : fail('code-review.detect-ocr-18', result.state.toUpperCase().replace(/-/g, '_'), `ocr 1.8.x is not ready: ${result.state}`, result, [...result.nextActions]);
             printResult(io, envelope, options.json);
-            if (detect.state !== 'ready') {
-                process.exitCode = 1;
-            }
+            if (result.state !== 'ready')
+                process.exitCode = 0; // soft-fail
         }
         catch (error) {
-            printResult(io, fail('code-review.detect-ocr', 'DETECT_OCR_FAILED', getErrorMessage(error), { state: 'detection-failed', packageInstalled: false, binaryPath: null, version: null, configPath: '', configValid: false, missingKeys: [] }, ['Re-run with `--project <path>` pointing at a known-good project root.']), options.json);
-            process.exitCode = 1;
+            printResult(io, fail('code-review.detect-ocr-18', 'DETECT_FAILED', getErrorMessage(error), { state: 'detection-failed' }, ['Re-run with a valid npx on PATH.']), options.json);
         }
     });
     addJsonOption(codeReview
-        .command('run-ocr')
-        .description('Run `ocr review --format json` and return the parsed JSON envelope. Soft-fails (exit 0, ok=false) when ocr is not ready, so peaks-rd can continue without the second-opinion review and surface the install/config nextActions to the user. The peaks-loop `peaksConfig.ocr.llm` block is injected as OCR_LLM_URL / OCR_LLM_TOKEN / ... env vars so the ocr subprocess never has to read ~/.opencodereview/config.json.')
-        .option('--project <path>', 'project root (default: cwd)')
-        .option('--from <ref>', 'git ref to diff from (e.g. main, origin/main)')
-        .option('--to <ref>', 'git ref to diff to (e.g. HEAD, feature-branch)')
-        .option('--commit <sha>', 'specific commit SHA to review')).action((options) => {
-        const projectRoot = options.project ?? process.cwd();
-        try {
-            const result = runOcrReview({
-                cwd: projectRoot,
-                peaksConfigPath: getUserConfigPath(),
-                peaksOcrConfig: getOcrLlmConfig(),
-                input: { projectRoot, ...(options.from !== undefined && { from: options.from }), ...(options.to !== undefined && { to: options.to }), ...(options.commit !== undefined && { commit: options.commit }) },
-            });
-            // Soft-fail policy: when ocr is not ready or the subprocess
-            // failed, we still return a JSON envelope (ok=false) but
-            // do NOT set process.exitCode — the caller is expected to
-            // pattern-match on the state and proceed without ocr.
-            const envelope = result.spawned && result.exitCode === 0
-                ? ok('code-review.run-ocr', result, [...result.warnings], [...result.nextActions])
-                : fail('code-review.run-ocr', result.state.toUpperCase().replace(/-/g, '_'), result.spawned ? `ocr review exited ${result.exitCode}` : `ocr is not ready: ${result.state}`, result, [...result.nextActions]);
-            printResult(io, envelope, options.json);
-            // Intentionally do NOT set process.exitCode here — soft-fail.
-        }
-        catch (error) {
-            printResult(io, fail('code-review.run-ocr', 'RUN_OCR_FAILED', getErrorMessage(error), { spawned: false, state: 'detection-failed', exitCode: null, stdout: '', stderr: '', durationMs: 0, parsed: null }, ['Run `peaks code-review detect-ocr --json` to inspect ocr install state.']), options.json);
-            // Soft-fail on exception too — peaks-rd should continue.
+        .command('run-ocr-18')
+        .description('Invoke `ocr review --filter-language <lang>` (or `ocr delegate preview` when --delegate) for one of 8 supported languages.')
+        .option('--language <lang>', `target language: ${OCR_18_LANGUAGES.join(' | ')}`)
+        .option('--from <ref>', 'git ref to diff from (e.g. main)')
+        .option('--to <ref>', 'git ref to diff to (e.g. HEAD)')
+        .option('--commit <sha>', 'specific commit SHA to review')
+        .option('--delegate', 'use Delegation Mode (no LLM key required)')).action((options) => {
+        const language = options.language;
+        if (language === undefined || !SUPPORTED_LANGUAGES_SET.has(language)) {
+            printResult(io, fail('code-review.run-ocr-18', 'LANGUAGE_UNSUPPORTED', `unsupported language: ${language ?? '<missing>'}`, { state: 'language-unsupported', supported: OCR_18_LANGUAGES }, [`Pick one of: ${OCR_18_LANGUAGES.join(', ')}`]), options.json);
+            return;
         }
+        const result = runOcr18({
+            cwd: process.cwd(),
+            language: language,
+            ...(options.from !== undefined ? { from: options.from } : {}),
+            ...(options.to !== undefined ? { to: options.to } : {}),
+            ...(options.commit !== undefined ? { commit: options.commit } : {}),
+            ...(options.delegate === true ? { delegate: true } : {})
+        });
+        const envelope = result.state === 'ok'
+            ? ok('code-review.run-ocr-18', result, [], [])
+            : fail('code-review.run-ocr-18', result.state.toUpperCase().replace(/-/g, '_'), `ocr 1.8.x state: ${result.state}`, result, ['Re-run `peaks code-review detect-ocr-18 --json` to refresh.']);
+        printResult(io, envelope, options.json);
     });
     addJsonOption(codeReview
-        .command('config-template')
-        .description('Print the JSON snippet the user should paste into their peaks-loop config (`peaksConfig.ocr.llm`). This command does NOT write anything. The user is the only party that touches the LLM token / URL / model — peaks-loop never auto-configures the endpoint. Token value is shown as the placeholder "<your-api-key>"; replace it before pasting.')).action((options) => {
-        const template = getOcrConfigTemplate();
-        const targetPath = getUserConfigPath();
-        const currentConfig = getOcrLlmConfig();
-        const currentRedacted = currentConfig === null ? null : redactConfigSecrets(currentConfig, 'ocr.llm');
-        const payload = {
-            targetPath,
-            currentConfig: currentRedacted,
-            template,
-            nextActions: [
-                `Edit ${targetPath} and add the "ocr" block from the template above.`,
-                'OR use peaks-loop config set with one key at a time: `peaks config set --key ocr.llm.url --value \'<url>\'` etc.',
-                'The authToken field is sensitive and is stored in the user layer (`~/.peaks/config.json`); peaks-loop will not commit it.',
-                'Re-run `peaks code-review detect-ocr --json` to verify the new state is `ready`.',
-            ],
-        };
-        printResult(io, ok('code-review.config-template', payload), options.json);
+        .command('ocr-18-delegate-preview')
+        .description('Print the Delegation Mode spec for the host agent (no LLM key required).')).action((options) => {
+        const result = runOcr18({ cwd: process.cwd(), language: 'python', delegate: true });
+        const envelope = result.state === 'ok'
+            ? ok('code-review.ocr-18-delegate-preview', result, [], [])
+            : fail('code-review.ocr-18-delegate-preview', result.state.toUpperCase().replace(/-/g, '_'), `ocr 1.8.x state: ${result.state}`, result, ['Re-run `peaks code-review detect-ocr-18 --json` to refresh.']);
+        printResult(io, envelope, options.json);
     });
 }

package/dist/cli/commands/cron-commands.js

@@ -34,7 +34,19 @@ import { findProjectRoot } from '../../services/config/config-safety.js';
 const SCHEDULE_VERSION = 1;
 const SCHEDULE_FILENAME = 'schedule.json';
 const HISTORY_FILENAME = 'history.jsonl';
-const DEFAULT_INTERVAL_MS = 24 * 60 * 60 * 1_000; // 24h
+/**
+ * PRD-002b slice 2 — extract cron-orchestration magic numbers (24h
+ * default interval, 5-minute exec timeout, stderr-message truncation
+ * lengths in the renderer).
+ */
+const MS_PER_SECOND = 1_000;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const HOURS_PER_DAY = 24;
+const DEFAULT_INTERVAL_MS = HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND;
+const EXEC_TIMEOUT_MS = 5 * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND;
+const STDERR_RECORD_TRUNCATE_BYTES = 2000;
+const STDERR_NEXT_ACTIONS_TRUNCATE_CHARS = 200;
 function cronDir(projectRoot) {
     return join(projectRoot, '.peaks', 'cron');
 }
@@ -136,13 +148,13 @@ export function runTask(projectRoot, task) {
             cwd: projectRoot,
             stdio: ['ignore', 'pipe', 'pipe'],
             encoding: 'utf8',
-            timeout: 5 * 60_000
+            timeout: EXEC_TIMEOUT_MS
         });
     }
     catch (err) {
         const e = err;
         exitCode = typeof e.status === 'number' ? e.status : 1;
-        stderr = (e.stderr ?? getErrorMessage(err)).slice(0, 2000);
+        stderr = (e.stderr ?? getErrorMessage(err)).slice(0, STDERR_RECORD_TRUNCATE_BYTES);
     }
     const record = {
         id,
@@ -243,7 +255,7 @@ export function registerCronCommand(program, io) {
                 updatedEntries.push({ ...task, lastRunAt: record.finishedAt });
             }
             writeSchedule(projectRoot, { version: SCHEDULE_VERSION, entries: updatedEntries });
-            printResult(io, ok('cron.run', { projectRoot, ran: records.length, records }, records.filter((r) => r.exitCode !== 0).map((r) => `Task ${r.taskId} failed (exit=${r.exitCode}): ${r.stderr.slice(0, 200)}`), [`Ran ${records.length} task(s); ${records.filter((r) => r.exitCode === 0).length} succeeded.`]), options.json);
+            printResult(io, ok('cron.run', { projectRoot, ran: records.length, records }, records.filter((r) => r.exitCode !== 0).map((r) => `Task ${r.taskId} failed (exit=${r.exitCode}): ${r.stderr.slice(0, STDERR_NEXT_ACTIONS_TRUNCATE_CHARS)}`), [`Ran ${records.length} task(s); ${records.filter((r) => r.exitCode === 0).length} succeeded.`]), options.json);
             if (records.some((r) => r.exitCode !== 0))
                 process.exitCode = 1;
         }

package/dist/cli/commands/dashboard-long-run.js

@@ -5,7 +5,11 @@ import { read24hState } from '../../services/24h-mode/index.js';
 import { getErrorMessage } from '../cli-helpers.js';
 const SINCE_PATTERN = /^(\d+)([smhd])$/i;
 const WINDOW_CAP_HOURS = 24;
-const WINDOW_CAP_MS = WINDOW_CAP_HOURS * 60 * 60 * 1000;
+const MS_PER_SECOND = 1000;
+const MS_PER_MINUTE = 60 * MS_PER_SECOND;
+const MS_PER_HOUR = 60 * MS_PER_MINUTE;
+const MS_PER_DAY = 24 * MS_PER_HOUR;
+const WINDOW_CAP_MS = WINDOW_CAP_HOURS * MS_PER_HOUR;
 function parseSince(raw) {
     if (!raw)
         return { ok: false, error: '--since is required (e.g. 24h, 8h, 30m)' };
@@ -16,7 +20,7 @@ function parseSince(raw) {
     if (!Number.isFinite(value) || value < 0)
         return { ok: false, error: `--since must be a non-negative integer (got ${raw})` };
     const unit = (match[2] ?? 'h').toLowerCase();
-    const multiplier = unit === 'd' ? 86_400_000 : unit === 'h' ? 3_600_000 : unit === 'm' ? 60_000 : 1_000;
+    const multiplier = unit === 'd' ? MS_PER_DAY : unit === 'h' ? MS_PER_HOUR : unit === 'm' ? MS_PER_MINUTE : MS_PER_SECOND;
     return { ok: true, ms: Math.min(WINDOW_CAP_MS, value * multiplier) };
 }
 function readSlices(projectRoot, sessionId) {
@@ -45,7 +49,7 @@ function boundaryLabel(raw) {
         return { key: 'valid', message: 'unparseable' };
     const value = Number(match[1]);
     const unit = (match[2] ?? 'h').toLowerCase();
-    const multiplier = unit === 'd' ? 86_400_000 : unit === 'h' ? 3_600_000 : unit === 'm' ? 60_000 : 1_000;
+    const multiplier = unit === 'd' ? MS_PER_DAY : unit === 'h' ? MS_PER_HOUR : unit === 'm' ? MS_PER_MINUTE : MS_PER_SECOND;
     if (value * multiplier > WINDOW_CAP_MS) {
         return { key: 'cap', message: 'since>24h is capped to the 24h window' };
     }
@@ -86,7 +90,7 @@ export function registerDashboardLongRunCommand(dashboard, io) {
             const sliceCount = readSlices(projectRoot, sid);
             const checkpointAgeMs = readLastCheckpointAgeMs(snapshot);
             const checkpointFrequency = snapshot.checkpoints > 0 && snapshot.enteredAt
-                ? Math.max(1, Math.round((Date.now() - Date.parse(snapshot.enteredAt)) / snapshot.checkpoints / 60_000))
+                ? Math.max(1, Math.round((Date.now() - Date.parse(snapshot.enteredAt)) / snapshot.checkpoints / MS_PER_MINUTE))
                 : null;
             const indicators = {
                 dispatchCount: sliceCount,

package/dist/cli/commands/dispatch-from-dag.d.ts

@@ -1,3 +1,3 @@
-import type { ProgramIO } from '../cli-helpers.js';
+import { type ProgramIO } from '../cli-helpers.js';
 import { type DispatchOptions } from './sub-agent-shared.js';
 export declare function runDispatchFromDag(role: string, options: DispatchOptions, asJson: boolean, io: ProgramIO): Promise<void>;

package/dist/cli/commands/hooks-commands.js

@@ -43,7 +43,16 @@ function listExpectedEntriesForIde(ide, _skipProgress = false) {
     if (ide === 'trae') {
         return [{ matcher: adapter.toolMatcher, sentinel: 'peaks hook handle' }];
     }
-    return [{ matcher: adapter.toolMatcher, sentinel: 'peaks gate enforce' }];
+    // Slice 2026-08-06-codegate-vendor-neutral: Claude Code install
+    // also emits the Edit|Write|MultiEdit code-gate entry. The summary
+    // mirrors the install shape, NOT a hardcoded expected list. The
+    // hook source of truth is `src/services/hooks/pre-tool-code-gate.sh`
+    // (vendor-neutral); the runtime adapter is `peaks code-gate --json`
+    // registered as a PreToolUse entry.
+    return [
+        { matcher: adapter.toolMatcher, sentinel: 'peaks gate enforce' },
+        { matcher: 'Edit|Write|MultiEdit', sentinel: 'peaks code-gate' }
+    ];
 }
 /**
  * Slice 2026-07-24-peaks-code-bridge-002-rootcause (G6b / G10): copy the
@@ -98,6 +107,26 @@ function copyBridgeHookIfPresent(userHome) {
     copyFileSync(source, target);
     return { copied: true, source, target };
 }
+/**
+ * Slice 2026-08-06-codegate-vendor-neutral: copy the code-gate hook
+ * source (`src/services/hooks/pre-tool-code-gate.sh`) into the user-
+ * global peaks-code hooks dir, mirroring the bridge-hook copy. The
+ * hook itself is vendor-neutral (no `claude` / `anthropic` strings in
+ * the script) — this installer is the vendor adapter that decides
+ * where the file lands. The CLI command `peaks code-gate` is the
+ * runtime entry; the shell script is the canonical artifact distributed
+ * alongside the bridge hook.
+ */
+function copyCodeGateHookIfPresent(userHome) {
+    const source = resolve(__dirname, '..', '..', 'services', 'hooks', 'pre-tool-code-gate.sh');
+    const target = resolve(userHome, '.claude', 'skills', 'peaks-code', 'hooks', 'pre-tool-code-gate.sh');
+    if (!existsSync(source)) {
+        return { copied: false, source, target };
+    }
+    mkdirSync(dirname(target), { recursive: true });
+    copyFileSync(source, target);
+    return { copied: true, source, target };
+}
 export function registerHooksCommands(program, io) {
     const hooks = program
         .command('hooks')
@@ -121,6 +150,14 @@ export function registerHooksCommands(program, io) {
                 const bridgeCopy = scope === 'global'
                     ? copyBridgeHookIfPresent(process.env.USERPROFILE ?? process.env.HOME ?? '')
                     : { copied: false, source: '', target: '' };
+                // Slice 2026-08-06-codegate-vendor-neutral: also copy the
+                // code-gate hook script. The runtime gate lives at
+                // `peaks code-gate --json` (registered as a PreToolUse entry
+                // in the install output); the script is the build artifact
+                // distributed alongside the bridge hook.
+                const codeGateCopy = scope === 'global'
+                    ? copyCodeGateHookIfPresent(process.env.USERPROFILE ?? process.env.HOME ?? '')
+                    : { copied: false, source: '', target: '' };
                 printResult(io, ok('hooks.install', {
                     ...plan,
                     ide,
@@ -129,6 +166,7 @@ export function registerHooksCommands(program, io) {
                     skipProgress,
                     entries: dryRunEntries,
                     bridgeHookCopy: bridgeCopy,
+                    codeGateHookCopy: codeGateCopy,
                     // Slice 2026-07-29-worktree-layer3-deny: surface the
                     // Layer 3 deny entries the install WOULD write. The
                     // dry-run branch never actually invokes
@@ -141,7 +179,10 @@ export function registerHooksCommands(program, io) {
                     `would write ${listSuperpowersDenyEntries().length} permissions.deny entries (Layer 3 worktree governance)`,
                     bridgeCopy.copied
                         ? `would copy bridge hook from ${bridgeCopy.source} to ${bridgeCopy.target}`
-                        : 'would not copy bridge hook (source missing or non-global scope)'
+                        : 'would not copy bridge hook (source missing or non-global scope)',
+                    codeGateCopy.copied
+                        ? `would copy code-gate hook from ${codeGateCopy.source} to ${codeGateCopy.target}`
+                        : 'would not copy code-gate hook (source missing or non-global scope)'
                 ]), options.json);
                 return;
             }
@@ -161,6 +202,14 @@ export function registerHooksCommands(program, io) {
             const bridgeCopy = scope === 'global'
                 ? copyBridgeHookIfPresent(process.env.USERPROFILE ?? process.env.HOME ?? '')
                 : { copied: false, source: '', target: '' };
+            // Slice 2026-08-06-codegate-vendor-neutral: also copy the
+            // code-gate hook script. The runtime gate lives at
+            // `peaks code-gate --json` (registered as a PreToolUse entry
+            // in the install output); the script is the build artifact
+            // distributed alongside the bridge hook.
+            const codeGateCopy = scope === 'global'
+                ? copyCodeGateHookIfPresent(process.env.USERPROFILE ?? process.env.HOME ?? '')
+                : { copied: false, source: '', target: '' };
             const nextActions = result.applied
                 ? [
                     'Restart the IDE (or reload the workspace) so the hook entries take effect',
@@ -170,7 +219,10 @@ export function registerHooksCommands(program, io) {
                     `Layer 3 deny: wrote ${listSuperpowersDenyEntries().length} permissions.deny entries (worktree governance)`,
                     bridgeCopy.copied
                         ? `Copied bridge hook: ${bridgeCopy.target}`
-                        : 'Bridge hook not copied (source missing or non-global scope)'
+                        : 'Bridge hook not copied (source missing or non-global scope)',
+                    codeGateCopy.copied
+                        ? `Copied code-gate hook: ${codeGateCopy.target}`
+                        : 'Code-gate hook not copied (source missing or non-global scope)'
                 ]
                 : (bridgeCopy.copied
                     ? [`Bridge hook copied: ${bridgeCopy.target}`]
@@ -189,6 +241,7 @@ export function registerHooksCommands(program, io) {
                 skipProgress,
                 entries: installedEntries.map((e) => ({ matcher: e.matcher, sentinel: e.sentinel })),
                 bridgeHookCopy: bridgeCopy,
+                codeGateHookCopy: codeGateCopy,
                 permissionsDenyApplied: result.applied,
                 permissionsDenyEntries: denyEntries
             }, [], nextActions), options.json);

package/dist/cli/commands/lint-commands.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `peaks code lint` — read-only ESLint verifier (Gate B5).
+ *
+ * PRD-002b slice: three subcommands expose the runner's new
+ * incremental-first / no-touch-stockcode options to the CLI surface.
+ *
+ *   - `peaks lint baseline` — one-shot full-repo scan; writes
+ *     `.peaks/lint/baseline.json` (project-level, gitignored by
+ *     default). Each project regenerates its own baseline; the file
+ *     is project-aware (D6 binding).
+ *   - `peaks lint check` — default; diffOnly=true + baselineFile
+ *     waiver + redLineMode='baseline-aware'. This is the LLM-facing
+ *     Gate B5 entry point.
+ *   - `peaks lint --red-line` — write
+ *     `.peaks/memory/lint-redline-summary.md` so the next LLM
+ *     invocation can read the cross-project red-line before
+ *     writing more code (supplementary S2 dual-track).
+ */
+import type { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerLintCommands(program: Command, io: ProgramIO): void;

package/dist/cli/commands/lint-commands.js

@@ -0,0 +1,146 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+import { fail, ok } from 'peaks-loop-shared/result';
+import { detectEslint } from '../../services/lint/detect-eslint.js';
+import { runEslint } from '../../services/lint/eslint-runner.js';
+function parseTimeoutMs(value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number.parseInt(value, 10);
+    if (Number.isNaN(parsed) || parsed <= 0) {
+        throw new Error(`--timeout-ms must be a positive integer; received "${value}"`);
+    }
+    return parsed;
+}
+function writeBaselineJson(cwd, baselineFile, result) {
+    const fullPath = join(cwd, baselineFile);
+    mkdirSync(dirname(fullPath), { recursive: true });
+    const violations = result.findings.map((f) => ({
+        ruleId: f.ruleId,
+        file: f.filePath,
+        line: f.line,
+        severity: f.severity,
+        message: f.message
+    }));
+    const payload = {
+        version: 1,
+        generatedAt: new Date().toISOString(),
+        toolVersion: 'peaks-loop-4.0.16+',
+        violations
+    };
+    writeFileSync(fullPath, JSON.stringify(payload, null, 2), 'utf8');
+    return { path: fullPath, violations: violations.length };
+}
+function writeRedLineSummary(cwd, result) {
+    const fullPath = join(cwd, '.peaks/memory/lint-redline-summary.md');
+    mkdirSync(dirname(fullPath), { recursive: true });
+    const lines = [];
+    lines.push('---');
+    lines.push('title: lint red-line summary (auto-generated)');
+    lines.push('rid: 2026-08-06-eslint-strict-metrics');
+    lines.push('generatedAt: ' + new Date().toISOString());
+    lines.push('source: `peaks lint --red-line` (PRD-002b slice)');
+    lines.push('---');
+    lines.push('');
+    lines.push('# Lint red-line summary');
+    lines.push('');
+    lines.push('> LLM-facing card. The next LLM invocation MUST read this file before writing JS/TS code under the peaks-rd Gate B5 surface.');
+    lines.push('');
+    lines.push('## Top ruleIds (sorted by baseline violation count)');
+    lines.push('');
+    if (result.redLine.length === 0) {
+        lines.push('No baseline violations recorded — project is lint-clean against the current baseline.');
+    }
+    else {
+        for (const entry of result.redLine) {
+            lines.push(`- \`${entry.ruleId}\`: ${entry.count} occurrence${entry.count === 1 ? '' : 's'}`);
+            for (const top of entry.topFiles) {
+                lines.push(`    - ${top.file} (${top.count})`);
+            }
+        }
+    }
+    lines.push('');
+    writeFileSync(fullPath, lines.join('\n'), 'utf8');
+    return { path: fullPath, ruleIds: result.redLine.map((r) => r.ruleId) };
+}
+export function registerLintCommands(program, io) {
+    const lint = program
+        .command('lint')
+        .description('Read-only ESLint verifier (peaks-rd Gate B5). Soft-fails when the toolchain is missing.');
+    addJsonOption(lint
+        .command('detect-eslint', { isDefault: false })
+        .description('Read-only probe: returns the 5-state ESLint runtime envelope (ready / eslint-missing / config-error / npx-failed / detection-failed).')).action((options) => {
+        const result = detectEslint();
+        const envelope = result.state === 'ready'
+            ? ok('code.lint.detect-eslint', result, [...result.warnings], [...result.nextActions])
+            : fail('code.lint.detect-eslint', result.state.toUpperCase().replace(/-/g, '_'), `eslint is not ready: ${result.state}`, result, [...result.nextActions]);
+        printResult(io, envelope, options.json);
+        if (result.state !== 'ready') {
+            process.exitCode = 0; // soft-fail
+        }
+    });
+    addJsonOption(lint
+        .command('check', { isDefault: true })
+        .description('Run the read-only ESLint verifier on diff hunks + apply baseline waiver + emit red-line (default Gate B5 entry).')
+        .option('--scope <path>', 'lint scope (default: project root)')
+        .option('--config <path>', 'explicit ESLint config path')
+        .option('--timeout-ms <ms>', 'subprocess timeout in milliseconds (default 60000)')
+        .option('--baseline-file <path>', 'baseline JSON path (default .peaks/lint/baseline.json)')
+        .option('--red-line', 'also write .peaks/memory/lint-redline-summary.md')).action((options) => {
+        let timeoutMs;
+        try {
+            timeoutMs = parseTimeoutMs(options.timeoutMs);
+        }
+        catch (error) {
+            printResult(io, fail('code.lint', 'INVALID_TIMEOUT', getErrorMessage(error), { state: 'execution-failed' }, ['Re-run with --timeout-ms <positive integer>.']), options.json);
+            return;
+        }
+        const cwd = process.cwd();
+        const runOptions = {
+            cwd,
+            ...(options.scope !== undefined ? { scope: options.scope } : {}),
+            ...(options.configPath !== undefined ? { configPath: options.configPath } : {}),
+            ...(options.baselineFile !== undefined ? { baselineFile: options.baselineFile } : {}),
+            ...(timeoutMs !== undefined ? { timeoutMs } : {})
+        };
+        const result = runEslint(runOptions);
+        const extras = {};
+        if (options.redLine === true) {
+            extras.redLineSummary = writeRedLineSummary(cwd, result);
+        }
+        const envelope = result.state === 'ok' || result.state === 'baseline-missing'
+            ? ok('code.lint', { ...result, ...extras }, [], [])
+            : fail('code.lint', result.state.toUpperCase().replace(/-/g, '_'), `peaks code lint state: ${result.state}`, { ...result, ...extras }, [`Re-run with --scope <path> or restore the ESLint toolchain.`]);
+        printResult(io, envelope, options.json);
+    });
+    addJsonOption(lint
+        .command('baseline')
+        .description('One-shot full-repo scan; writes .peaks/lint/baseline.json (project-level, gitignored by default).')
+        .option('--scope <path>', 'lint scope (default: project root)')
+        .option('--config <path>', 'explicit ESLint config path')
+        .option('--timeout-ms <ms>', 'subprocess timeout in milliseconds (default 60000)')
+        .option('--baseline-file <path>', 'baseline JSON output path (default .peaks/lint/baseline.json)')).action((options) => {
+        let timeoutMs;
+        try {
+            timeoutMs = parseTimeoutMs(options.timeoutMs);
+        }
+        catch (error) {
+            printResult(io, fail('code.lint.baseline', 'INVALID_TIMEOUT', getErrorMessage(error), { state: 'execution-failed' }, ['Re-run with --timeout-ms <positive integer>.']), options.json);
+            return;
+        }
+        const cwd = process.cwd();
+        const runOptions = {
+            cwd,
+            diffOnly: false,
+            ...(options.scope !== undefined ? { scope: options.scope } : {}),
+            ...(options.configPath !== undefined ? { configPath: options.configPath } : {}),
+            ...(timeoutMs !== undefined ? { timeoutMs } : {})
+        };
+        const result = runEslint(runOptions);
+        const baselineFile = options.baselineFile ?? '.peaks/lint/baseline.json';
+        const written = writeBaselineJson(cwd, baselineFile, result);
+        const envelope = ok('code.lint.baseline', { state: result.state, findings: result.findings.length, ...written }, [], ['Commit baseline.json (or .gitignore it). Peak-loop ships its own baseline as a reference fixture.']);
+        printResult(io, envelope, options.json);
+    });
+}

package/dist/cli/commands/qa-commands.js

@@ -25,8 +25,7 @@
  * with reason `--no-browser`. This is a slice-level opt-out for
  * backend-only or already-covered-by-unit-tests work.
  */
-import { join } from 'node:path';
-import { resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { addJsonOption, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { archiveScreenshots } from '../../services/qa/screenshot-archive-service.js';

package/dist/cli/commands/security-audit-commands.d.ts

@@ -7,7 +7,7 @@
  *   - `peaks security-audit detect` — JSON envelope describing the
  *     5-state security-audit runtime (ready / handoff-missing /
  *     template-missing / dispatch-failed / envelope-malformed).
- *     Mirrors `peaks code-review detect-ocr` semantics.
+ *     Mirrors the ECC bridge detect semantics.
  *   - `peaks security-audit run` — runs the full pipeline:
  *     detect → read handoff + template → write audit artifact to
  *     `.peaks/_runtime/<sid>/audit/security-<rid>.md`. Reads the

package/dist/cli/commands/security-audit-commands.js

@@ -40,7 +40,7 @@ export function registerSecurityAuditCommands(program, io) {
         .description('Independent security audit skill driver. Reads the immutable peaks-prd handoff (sha256-locked) + the project-level security-template.md, then writes a structured security-<rid>.md artifact. Decoupled from peaks-rd 5-way fan-out per slice v2.12.0 (Group A, Tier 2). See skills/bee/peaks-security-audit/SKILL.md for the full workflow.');
     addJsonOption(securityAudit
         .command('detect')
-        .description('Read-only probe: returns the 5-state security-audit runtime as a JSON envelope (ready / handoff-missing / template-missing / dispatch-failed / envelope-malformed). The peaks-security-audit skill calls this first to decide whether to invoke `run`. Mirrors `peaks code-review detect-ocr` semantics.')
+        .description('Read-only probe: returns the 5-state security-audit runtime as a JSON envelope (ready / handoff-missing / template-missing / dispatch-failed / envelope-malformed). The peaks-security-audit skill calls this first to decide whether to invoke `run`. Mirrors the ECC bridge detect semantics.')
         .option('--rid <rid>', 'request id (e.g. 2026-06-27-v2-12-...)')
         .option('--sid <sid>', 'session id (e.g. 2026-06-27-session-...)')
         .option('--project <path>', 'project root (default: cwd)')).action((options) => {

package/dist/cli/commands/sediment-commands.d.ts

@@ -1,5 +1,5 @@
 import type { Command } from "commander";
-import type { ProgramIO } from "../cli-helpers.js";
+import { type ProgramIO } from "../cli-helpers.js";
 export interface CliResult {
     ok: boolean;
     error?: string;

package/dist/cli/commands/slice-commands.js

@@ -9,6 +9,17 @@ import { decompose as multiPassDecompose } from '../../services/slice/multi-pass
 import { readResult as readDecompositionResult, writeResult as writeSchemaResult } from '../../services/slice/schema-router.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+/**
+ * PRD-002b slice 2 — extract CLI listing-pagination + table-format
+ * constants. Values are bytewise-identical to the original literals.
+ */
+const SLICE_LIST_DEFAULT_LIMIT = 50;
+const SLICE_LIST_MAX_LIMIT = 500;
+const SLICE_LIST_RID_COL_WIDTH = 34;
+const SLICE_LIST_MTIME_COL_WIDTH = 22;
+const SLICE_LIST_SIZE_COL_WIDTH = 8;
+const SLICE_LIST_PICKED_COL_WIDTH = 6;
+const SLICE_LIST_SEPARATOR_WIDTH = 76;
 export function registerSliceCommands(program, io) {
     const slice = program.command('slice').description('Slice lifecycle: check (boundary), decompose (PRD -> 6-stage algorithm), ' +
         'pick (fzf multi-select), plan (apply via peaks request init). ' +
@@ -67,12 +78,12 @@ export function registerSliceCommands(program, io) {
         '(mtime > 30d). Use --stale-only to filter, --rid <substring> to narrow, ' +
         '--limit <n> to cap. To remove stale entries, use `peaks slice cleanup` (separate slice).')
         .option('--project <path>', 'target project root', '.')
-        .option('--limit <n>', 'cap result count (default 50, max 500)', (v) => parseInt(v, 10), 50)
+        .option('--limit <n>', 'cap result count (default 50, max 500)', (v) => parseInt(v, 10), SLICE_LIST_DEFAULT_LIMIT)
         .option('--stale-only', 'only include rids older than the stale threshold', false)
         .option('--rid <substring>', 'case-insensitive substring filter on rid', '')).action((options) => {
         try {
             const projectRoot = resolveCanonicalProjectRoot(options.project);
-            const limit = Math.max(1, Math.min(500, options.limit ?? 50));
+            const limit = Math.max(1, Math.min(SLICE_LIST_MAX_LIMIT, options.limit ?? SLICE_LIST_DEFAULT_LIMIT));
             const all = listDecompositions(projectRoot);
             let filtered = all;
             const ridSub = (options.rid ?? '').toLowerCase();
@@ -97,13 +108,13 @@ export function registerSliceCommands(program, io) {
             }
             // Plaintext mode: header + table
             const lines = [];
-            lines.push('RID'.padEnd(34) + 'MTIME'.padEnd(22) + 'SIZE'.padEnd(8) + 'PICKED'.padEnd(6) + 'STALE');
-            lines.push('-'.repeat(76));
+            lines.push('RID'.padEnd(SLICE_LIST_RID_COL_WIDTH) + 'MTIME'.padEnd(SLICE_LIST_MTIME_COL_WIDTH) + 'SIZE'.padEnd(SLICE_LIST_SIZE_COL_WIDTH) + 'PICKED'.padEnd(SLICE_LIST_PICKED_COL_WIDTH) + 'STALE');
+            lines.push('-'.repeat(SLICE_LIST_SEPARATOR_WIDTH));
             for (const r of page) {
-                lines.push(r.rid.padEnd(34) +
-                    r.mtime.padEnd(22) +
-                    String(r.sizeBytes).padEnd(8) +
-                    (r.pickedPath ? 'yes' : 'no').padEnd(6) +
+                lines.push(r.rid.padEnd(SLICE_LIST_RID_COL_WIDTH) +
+                    r.mtime.padEnd(SLICE_LIST_MTIME_COL_WIDTH) +
+                    String(r.sizeBytes).padEnd(SLICE_LIST_SIZE_COL_WIDTH) +
+                    (r.pickedPath ? 'yes' : 'no').padEnd(SLICE_LIST_PICKED_COL_WIDTH) +
                     (r.isStale ? 'yes' : 'no'));
             }
             if (truncated) {
@@ -365,6 +376,7 @@ function writeDecompositionFile(rid, result, projectRoot) {
  * recorded in .peaks/memory/ for follow-up). If that slice ships with a
  * different default, both must update here.
  */
+// eslint-disable-next-line no-magic-numbers -- canonical 30-day-in-ms math
 const STALE_THRESHOLD_MS = 30 * 24 * 60 * 60 * 1000;
 /**
  * Enumerate every slice decomposition artifact under

package/dist/cli/commands/statusline-commands.d.ts

@@ -3,6 +3,7 @@ import { type ProgramIO } from '../cli-helpers.js';
 type RenderOptions = {
     project?: string;
     json?: boolean;
+    now?: number | string;
 };
 /**
  * Default-statusline render body. Reused by both the top-level default