peaks-loop 4.0.15 → 4.0.17

package/dist/services/hooks/pre-tool-code-gate.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Slice 2026-08-06-codegate-vendor-neutral — Code-Gate core logic.
+ *
+ * Vendor-neutral PreToolUse gate. Reads the standard `{tool, input}`
+ * JSON hook payload (any IDE / harness using this protocol is
+ * supported; the implementation is host-agnostic) and decides
+ * whether the tool call is allowed:
+ *
+ *   Edit / Write / MultiEdit on hard-blocked path families
+ *   (src/, tests/unit/, tests/integration/, config/, bin/, scripts/)
+ *   → deny with `PEAKS_CODE_PROHIBITED_DIRECT_EDIT`.
+ *
+ *   All other tool calls, OR allow-listed paths
+ *   (.peaks/**, .peaks/_runtime/**, skills/**, docs/**, *.md)
+ *   → allow (silent exit 0).
+ *
+ * Pure function. The shell-script sibling
+ * (`pre-tool-code-gate.sh`) is the canonical source for the same
+ * logic, usable from any non-Node harness. Both share the same
+ * hard-blocked + allow-listed path families.
+ */
+export type GateToolName = 'Edit' | 'Write' | 'MultiEdit' | string;
+export type GatePathKey = 'file_path' | 'path' | 'notebook_path';
+export interface GateInput {
+    readonly tool: GateToolName;
+    readonly input: Readonly<Record<string, unknown>>;
+}
+/** Hard-blocked path families — orchestrator MUST NOT Edit/Write these. */
+export declare const HARD_BLOCKED_PATH_FAMILIES: readonly ["src/", "tests/unit/", "tests/integration/", "config/", "bin/", "scripts/"];
+/** Allow-listed path prefixes / suffixes — orchestrator may freely Edit/Write these. */
+export declare const ALLOW_LISTED_PATH_PATTERNS: readonly [".peaks/", ".peaks_", "skills/", "docs/", ".md", "CHANGELOG.md", "README.md"];
+export type GateVerdict = {
+    readonly action: 'allow';
+} | {
+    readonly action: 'deny';
+    readonly filePath: string;
+    readonly reason: string;
+    readonly message: string;
+};
+/** Pull the target file path from `input.file_path | input.path | input.notebook_path`. */
+export declare function extractFilePath(input: Readonly<Record<string, unknown>>): string;
+/**
+ * Pure decision function. Given the tool name + input object, return
+ * the gate verdict. Tolerates malformed payloads (allow).
+ */
+export declare function decideGateAction(tool: GateToolName, input: Readonly<Record<string, unknown>>): GateVerdict;

package/dist/services/hooks/pre-tool-code-gate.js

@@ -0,0 +1,91 @@
+/**
+ * Slice 2026-08-06-codegate-vendor-neutral — Code-Gate core logic.
+ *
+ * Vendor-neutral PreToolUse gate. Reads the standard `{tool, input}`
+ * JSON hook payload (any IDE / harness using this protocol is
+ * supported; the implementation is host-agnostic) and decides
+ * whether the tool call is allowed:
+ *
+ *   Edit / Write / MultiEdit on hard-blocked path families
+ *   (src/, tests/unit/, tests/integration/, config/, bin/, scripts/)
+ *   → deny with `PEAKS_CODE_PROHIBITED_DIRECT_EDIT`.
+ *
+ *   All other tool calls, OR allow-listed paths
+ *   (.peaks/**, .peaks/_runtime/**, skills/**, docs/**, *.md)
+ *   → allow (silent exit 0).
+ *
+ * Pure function. The shell-script sibling
+ * (`pre-tool-code-gate.sh`) is the canonical source for the same
+ * logic, usable from any non-Node harness. Both share the same
+ * hard-blocked + allow-listed path families.
+ */
+/** Hard-blocked path families — orchestrator MUST NOT Edit/Write these. */
+export const HARD_BLOCKED_PATH_FAMILIES = [
+    'src/',
+    'tests/unit/',
+    'tests/integration/',
+    'config/',
+    'bin/',
+    'scripts/',
+];
+/** Allow-listed path prefixes / suffixes — orchestrator may freely Edit/Write these. */
+export const ALLOW_LISTED_PATH_PATTERNS = [
+    '.peaks/',
+    '.peaks_',
+    'skills/',
+    'docs/',
+    '.md',
+    'CHANGELOG.md',
+    'README.md',
+];
+/** Pull the target file path from `input.file_path | input.path | input.notebook_path`. */
+export function extractFilePath(input) {
+    for (const key of ['file_path', 'path', 'notebook_path']) {
+        const v = input[key];
+        if (typeof v === 'string' && v.length > 0)
+            return v;
+    }
+    return '';
+}
+function matchesAny(path, families) {
+    for (const fam of families) {
+        if (path.startsWith(fam))
+            return fam;
+        // also handle ".md" suffix pattern
+        if (fam.startsWith('.') && path.endsWith(fam))
+            return fam;
+    }
+    return null;
+}
+/**
+ * Pure decision function. Given the tool name + input object, return
+ * the gate verdict. Tolerates malformed payloads (allow).
+ */
+export function decideGateAction(tool, input) {
+    // Only gate Edit / Write / MultiEdit.
+    if (tool !== 'Edit' && tool !== 'Write' && tool !== 'MultiEdit') {
+        return { action: 'allow' };
+    }
+    const filePath = extractFilePath(input);
+    if (filePath.length === 0) {
+        // No path → cannot decide; fail-open (allow). The probe side
+        // (`orchestrator-can-do`) handles slice-spec content; this hook
+        // handles file paths only.
+        return { action: 'allow' };
+    }
+    // Allow-list check first — short-circuits any deny.
+    const allowMatch = matchesAny(filePath, ALLOW_LISTED_PATH_PATTERNS);
+    if (allowMatch !== null) {
+        return { action: 'allow' };
+    }
+    // Hard-blocked family check.
+    const denyMatch = matchesAny(filePath, HARD_BLOCKED_PATH_FAMILIES);
+    if (denyMatch !== null) {
+        const reason = `${denyMatch} (orchestrator's hard-blocked path family)`;
+        const message = `PEAKS_CODE_PROHIBITED_DIRECT_EDIT: ${filePath} matches hard-blocked path family ${reason}; ` +
+            `orchestrator MUST NOT Edit/Write these directly. Use: peaks sub-agent dispatch rd --prompt '<your task>' --request-id <rid> --project . --batch-id <uuid>`;
+        return { action: 'deny', filePath, reason, message };
+    }
+    // Anything not in the deny list → allow (e.g. CHANGELOG, README, top-level files).
+    return { action: 'allow' };
+}

package/dist/services/ide/current-model-detector.js

@@ -24,8 +24,7 @@
  *   - It returns `undefined` when detection is unavailable; callers
  *     must fall back to the configured / hardcoded model.
  */
-import { getAdapter } from './ide-registry.js';
-import { listAdapterIds } from './ide-registry.js';
+import { getAdapter, listAdapterIds } from './ide-registry.js';
 /**
  * Probe every registered IDE adapter for its currently-active model
  * id. Returns the first non-empty value found in registration order,

package/dist/services/lint/detect-eslint.d.ts

@@ -0,0 +1,10 @@
+import { ESLINT_PACKAGE_PINS } from './eslint-runner.js';
+export type EslintDetectState = 'ready' | 'eslint-missing' | 'config-error' | 'npx-failed' | 'detection-failed';
+export type EslintDetectResult = {
+    readonly state: EslintDetectState;
+    readonly npxAvailable: boolean;
+    readonly pinnedVersions: typeof ESLINT_PACKAGE_PINS;
+    readonly warnings: readonly string[];
+    readonly nextActions: readonly string[];
+};
+export declare function detectEslint(): EslintDetectResult;

package/dist/services/lint/detect-eslint.js

@@ -0,0 +1,62 @@
+/**
+ * 5-state ESLint detect — soft-fail when the toolchain is missing.
+ * Mirrors the ECC bridge detect shape so peaks-rd can compose a
+ * unified Gate B5 verdict.
+ */
+import { spawnSync } from 'node:child_process';
+import { resolveNpxInvocation } from './npx-resolver.js';
+import { ESLINT_PACKAGE_PINS } from './eslint-runner.js';
+const PACKAGES_TO_PROBE = [
+    'eslint',
+    'typescriptEslintParser',
+    'typescriptEslintPlugin'
+];
+function packageNameFor(key) {
+    switch (key) {
+        case 'eslint': return 'eslint';
+        case 'typescriptEslintParser': return '@typescript-eslint/parser';
+        case 'typescriptEslintPlugin': return '@typescript-eslint/eslint-plugin';
+    }
+}
+function probeNpx() {
+    const { command, args, baseEnv } = resolveNpxInvocation(['--version']);
+    const probe = spawnSync(command, args, { encoding: 'utf8', env: baseEnv });
+    return probe.status === 0;
+}
+function probePackage(key) {
+    const pkg = packageNameFor(key);
+    const pin = ESLINT_PACKAGE_PINS[key];
+    // shell:true required on Windows because `npm` (like npx) is a `.cmd`
+    // shim; Node 22 refuses to invoke it without shell wrapper.
+    // 2026-08-06 lint-dogfood cycle-2 follow-up.
+    const result = spawnSync('npm', ['view', `${pkg}@${pin}`, 'version'], { encoding: 'utf8', shell: true });
+    return result.status === 0;
+}
+export function detectEslint() {
+    const nextActions = [];
+    const warnings = [];
+    if (!probeNpx()) {
+        return {
+            state: 'npx-failed',
+            npxAvailable: false,
+            pinnedVersions: ESLINT_PACKAGE_PINS,
+            warnings: ['npx is not on PATH'],
+            nextActions: ['Install Node.js ≥ 20 with npm to enable `npx --package`.', 'Or run `peaks code lint --no-npx` (future slice).']
+        };
+    }
+    for (const key of PACKAGES_TO_PROBE) {
+        if (!probePackage(key)) {
+            warnings.push(`npm registry cannot resolve ${packageNameFor(key)}@${ESLINT_PACKAGE_PINS[key]}`);
+        }
+    }
+    if (warnings.length > 0) {
+        nextActions.push('Re-run `peaks code lint --json` after npm connectivity is restored.');
+    }
+    return {
+        state: 'ready',
+        npxAvailable: true,
+        pinnedVersions: ESLINT_PACKAGE_PINS,
+        warnings,
+        nextActions
+    };
+}

package/dist/services/lint/detect-ocr-18.d.ts

@@ -0,0 +1,10 @@
+import { OCR_18_PACKAGE } from './ocr-multilang-adapter.js';
+export type Ocr18DetectState = 'ready' | 'ocr18-missing' | 'binary-missing' | 'llm-config-missing' | 'detection-failed';
+export type Ocr18DetectResult = {
+    readonly state: Ocr18DetectState;
+    readonly npxAvailable: boolean;
+    readonly package: typeof OCR_18_PACKAGE;
+    readonly warnings: readonly string[];
+    readonly nextActions: readonly string[];
+};
+export declare function detectOcr18(): Ocr18DetectResult;

package/dist/services/lint/detect-ocr-18.js

@@ -0,0 +1,40 @@
+/**
+ * 5-state OCR 1.8.x detect. Mirrors the ECC detect shape.
+ */
+import { spawnSync } from 'node:child_process';
+import { OCR_18_PACKAGE } from './ocr-multilang-adapter.js';
+function probeNpx() {
+    const probe = spawnSync('npx', ['--version'], { encoding: 'utf8' });
+    return probe.status === 0;
+}
+function probeOcr18() {
+    const result = spawnSync('npx', ['--package', OCR_18_PACKAGE, '--', 'ocr', 'version'], { encoding: 'utf8' });
+    return result.status === 0;
+}
+export function detectOcr18() {
+    if (!probeNpx()) {
+        return {
+            state: 'ocr18-missing',
+            npxAvailable: false,
+            package: OCR_18_PACKAGE,
+            warnings: ['npx is not on PATH'],
+            nextActions: ['Install Node.js ≥ 20 with npm to enable `npx --package`.']
+        };
+    }
+    if (!probeOcr18()) {
+        return {
+            state: 'ocr18-missing',
+            npxAvailable: true,
+            package: OCR_18_PACKAGE,
+            warnings: [`could not resolve ${OCR_18_PACKAGE}`],
+            nextActions: ['Run `npm i @alibaba-group/open-code-review@1.8.9` to install the reviewer.']
+        };
+    }
+    return {
+        state: 'ready',
+        npxAvailable: true,
+        package: OCR_18_PACKAGE,
+        warnings: [],
+        nextActions: []
+    };
+}

package/dist/services/lint/eslint-runner.d.ts

@@ -0,0 +1,57 @@
+export declare const ESLINT_PACKAGE_PINS: {
+    readonly eslint: "8.57.1";
+    readonly typescriptEslintParser: "8.66.0";
+    readonly typescriptEslintPlugin: "8.66.0";
+};
+export type RedLineMode = 'none' | 'baseline-aware';
+export type EslintState = 'ok' | 'eslint-missing' | 'npx-failed' | 'execution-failed' | 'baseline-missing';
+export type EslintFinding = {
+    readonly filePath: string;
+    readonly line: number;
+    readonly column: number;
+    readonly ruleId: string | null;
+    readonly severity: 'error' | 'warn' | 'info';
+    readonly message: string;
+};
+export type EslintSummary = {
+    readonly error: number;
+    readonly warn: number;
+    readonly info: number;
+};
+export type BaselineViolation = {
+    readonly ruleId: string;
+    readonly file: string;
+    readonly line: number;
+    readonly severity: 'error' | 'warn' | 'info';
+    readonly message: string;
+};
+export type RedLineEntry = {
+    readonly ruleId: string;
+    readonly count: number;
+    readonly topFiles: ReadonlyArray<{
+        readonly file: string;
+        readonly count: number;
+    }>;
+};
+export type EslintRunResult = {
+    readonly state: EslintState;
+    readonly findings: readonly EslintFinding[];
+    readonly summary: EslintSummary;
+    readonly durationMs: number;
+    readonly rawOutput: string;
+    readonly baselineWaived: readonly EslintFinding[];
+    readonly redLine: readonly RedLineEntry[];
+};
+export type EslintRunOptions = {
+    readonly cwd: string;
+    readonly scope?: string;
+    readonly configPath?: string;
+    readonly fix?: boolean;
+    readonly write?: boolean;
+    readonly timeoutMs?: number;
+    readonly diffOnly?: boolean;
+    readonly baselineFile?: string;
+    readonly redLineMode?: RedLineMode;
+};
+export declare function buildEslintArgs(options: EslintRunOptions): string[];
+export declare function runEslint(options: EslintRunOptions): EslintRunResult;