peaks-loop 4.0.15 → 4.0.17

package/dist/services/lint/eslint-runner.js

@@ -0,0 +1,370 @@
+/**
+ * ESLint runner — read-only verifier for peaks code lint.
+ * Pins the 4 toolchain packages to the same major versions
+ * `config/eslint/.peaks-rules.cjs` requires; the runner loads them
+ * via `npx --package` so peaks-loop devDeps do not grow. Per the
+ * G-lint-2 red line, --fix / --write are FORBIDDEN.
+ *
+ * PRD-002b slice: three new options enforce the
+ * incremental-first / no-touch-stockcode / project-aware baseline
+ * invariants:
+ *
+ *   - diffOnly (default true): filter findings to git-diff hunks;
+ *    存量违规 silently skipped. Enforces D4 + D5.
+ *   - baselineFile (default '.peaks/lint/baseline.json'): waiver
+ *     matching findings (ruleId + file + line). Enforces D5.
+ *   - redLineMode (default 'baseline-aware'): aggregate baseline
+ *     violations by ruleId so the envelope carries an LLM-readable
+ *     red-line. Enforces D6 + supplementary S2.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { resolveNpxInvocation } from './npx-resolver.js';
+/**
+ * PRD-002b slice 2 — extract runner-pipeline magic numbers (ESLint
+ * severity codes, buffer / timeout budgets, max project-root walk
+ * depth, red-line top-N aggregation cap, base severity defaults).
+ * Values are bytewise-identical to the original literals.
+ */
+const ESLINT_SEVERITY_ERROR = 2;
+const ESLINT_SEVERITY_WARN = 1;
+const ESLINT_DEFAULT_TIMEOUT_MS = 60_000;
+const KB_PER_MB = 1024;
+const BYTES_PER_KB = 1024;
+const MB_TO_BYTES = KB_PER_MB * BYTES_PER_KB;
+const DIFF_BUFFER_BYTES = 16 * MB_TO_BYTES;
+const OUTPUT_BUFFER_BYTES = 32 * MB_TO_BYTES;
+const PROJECT_ROOT_WALK_MAX_DEPTH = 8;
+const RED_LINE_TOP_FILES = 5;
+export const ESLINT_PACKAGE_PINS = {
+    eslint: '8.57.1',
+    typescriptEslintParser: '8.66.0',
+    typescriptEslintPlugin: '8.66.0'
+};
+function severityFor(value) {
+    if (value === ESLINT_SEVERITY_ERROR)
+        return 'error';
+    if (value === ESLINT_SEVERITY_WARN)
+        return 'warn';
+    return 'info';
+}
+function summarize(findings) {
+    let error = 0;
+    let warn = 0;
+    let info = 0;
+    for (const f of findings) {
+        if (f.severity === 'error')
+            error++;
+        else if (f.severity === 'warn')
+            warn++;
+        else
+            info++;
+    }
+    return { error, warn, info };
+}
+/**
+ * Read `git diff HEAD --unified=0` and parse every `+` line as a
+ * touched line number. Falls back to [] on any parse error so the
+ * caller treats all findings as out-of-diff (no silent zero-result).
+ */
+function resolveProjectRoot(cwd) {
+    // ESLint 8 auto-discovers `.eslintrc.*` from cwd upward. When the
+    // CLI is launched via `node bin/peaks.js`, cwd is the bin/ dir and
+    // ESLint fails to find the config. Walk up until we see
+    // `config/eslint/.peaks-rules.cjs` and use that as the project root.
+    const marker = join('config', 'eslint', '.peaks-rules.cjs');
+    let current = cwd;
+    for (let depth = 0; depth < PROJECT_ROOT_WALK_MAX_DEPTH; depth += 1) {
+        if (existsSync(join(current, marker)))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return cwd;
+}
+function loadDiffRanges(cwd) {
+    const ranges = [];
+    try {
+        const result = spawnSync('git', ['diff', 'HEAD', '--unified=0', '--no-color'], {
+            cwd,
+            encoding: 'utf8',
+            maxBuffer: DIFF_BUFFER_BYTES
+        });
+        if (result.status !== 0 || typeof result.stdout !== 'string')
+            return [];
+        const stdout = result.stdout;
+        let currentFile = null;
+        let currentLine = 0;
+        for (const raw of stdout.split('\n')) {
+            const line = raw;
+            if (line.startsWith('+++ ')) {
+                const path = line.slice(4).split('\t')[0] ?? '';
+                currentFile = path.startsWith('b/') ? path.slice(2) : path;
+                continue;
+            }
+            if (line.startsWith('--- ')) {
+                continue;
+            }
+            const hunk = /^@@\s+-\d+(?:,\d+)?\s+\+(\d+)(?:,\d+)?\s+@@/.exec(line);
+            if (hunk !== null) {
+                currentLine = Number.parseInt(hunk[1] ?? '0', 10);
+                continue;
+            }
+            if (currentFile !== null && line.startsWith('+') && !line.startsWith('+++')) {
+                if (Number.isFinite(currentLine) && currentLine > 0) {
+                    ranges.push({ file: currentFile, lines: [currentLine] });
+                }
+                currentLine += 1;
+            }
+        }
+    }
+    catch {
+        return [];
+    }
+    return ranges;
+}
+function inDiff(filePath, line, ranges) {
+    if (ranges.length === 0)
+        return false;
+    for (const r of ranges) {
+        if (r.file !== filePath)
+            continue;
+        for (const ln of r.lines) {
+            if (Math.abs(ln - line) <= 0)
+                return true;
+        }
+    }
+    return false;
+}
+function loadBaseline(cwd, baselineFile) {
+    const fullPath = join(cwd, baselineFile);
+    let raw;
+    try {
+        raw = readFileSync(fullPath, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    const violations = Array.isArray(parsed.violations) ? parsed.violations : [];
+    const out = [];
+    for (const v of violations) {
+        if (typeof v.ruleId !== 'string' || typeof v.file !== 'string' || typeof v.line !== 'number')
+            continue;
+        out.push({
+            ruleId: v.ruleId,
+            file: v.file,
+            line: v.line,
+            severity: severityFor(v.severity),
+            message: typeof v.message === 'string' ? v.message : ''
+        });
+    }
+    return out;
+}
+function matchBaseline(finding, baseline) {
+    for (const v of baseline) {
+        if (v.ruleId !== finding.ruleId)
+            continue;
+        if (v.file !== finding.filePath)
+            continue;
+        if (v.line !== finding.line)
+            continue;
+        return true;
+    }
+    return false;
+}
+function aggregateRedLine(baseline) {
+    const byRule = new Map();
+    for (const v of baseline) {
+        const existing = byRule.get(v.ruleId);
+        if (existing === undefined) {
+            const fileCounts = new Map();
+            fileCounts.set(v.file, 1);
+            byRule.set(v.ruleId, { count: 1, fileCounts });
+        }
+        else {
+            existing.count += 1;
+            existing.fileCounts.set(v.file, (existing.fileCounts.get(v.file) ?? 0) + 1);
+        }
+    }
+    const out = [];
+    for (const [ruleId, agg] of byRule.entries()) {
+        const topFiles = [...agg.fileCounts.entries()]
+            .map(([file, count]) => ({ file, count }))
+            .sort((a, b) => b.count - a.count)
+            .slice(0, RED_LINE_TOP_FILES);
+        out.push({ ruleId, count: agg.count, topFiles });
+    }
+    out.sort((a, b) => b.count - a.count);
+    return out;
+}
+const EMPTY_DIFF_RANGE = [];
+const EMPTY_REDLINE = [];
+function emptyResult(state, start, rawOutput) {
+    return {
+        state,
+        findings: [],
+        summary: { error: 0, warn: 0, info: 0 },
+        durationMs: Date.now() - start,
+        rawOutput,
+        baselineWaived: [],
+        redLine: EMPTY_REDLINE
+    };
+}
+export function buildEslintArgs(options) {
+    if (options.fix === true || options.write === true) {
+        throw Object.assign(new Error('peaks code lint is read-only; --fix and --write are forbidden'), {
+            code: 'LINT_FIX_FORBIDDEN'
+        });
+    }
+    // The runner now uses the locally-installed eslint binary
+    // (`./node_modules/eslint/bin/eslint.js`) instead of the npx
+    // --package wrapper, which is broken on Windows (npm 10.9.4 chdirs
+    // the child to its own cache bin, breaking config auto-discovery).
+    // The pin constants are kept for detect-eslint's npm-registry
+    // probe + for the npx-resolver fallback path.
+    const args = ['--format', 'json'];
+    // Always pass the legacy .peaks-rules.cjs path; ESLint 8
+    // auto-discovers only `.eslintrc.*` files and our config lives at
+    // `config/eslint/.peaks-rules.cjs`. Callers may override via
+    // `options.configPath`.
+    const effectiveConfigPath = options.configPath ?? join('config', 'eslint', '.peaks-rules.cjs');
+    args.push('--config', effectiveConfigPath);
+    args.push(...(options.scope !== undefined && options.scope.length > 0 ? [options.scope] : ['.']));
+    return args;
+}
+export function runEslint(options) {
+    const start = Date.now();
+    let args;
+    try {
+        args = buildEslintArgs(options);
+    }
+    catch (error) {
+        return emptyResult('execution-failed', start, error instanceof Error ? error.message : String(error));
+    }
+    const projectRoot = resolveProjectRoot(options.cwd);
+    // Invoke eslint via `node <node_modules/eslint/bin/eslint.js>` to bypass
+    // the Windows .cmd shim entirely (Node 22 spawnSync cannot run .cmd
+    // shims without shell:true, and shell:true mangles quoted args).
+    const localEslintJs = join(projectRoot, 'node_modules', 'eslint', 'bin', 'eslint.js');
+    const useLocal = existsSync(localEslintJs);
+    const spawnOptions = {
+        cwd: projectRoot,
+        encoding: 'utf8',
+        timeout: options.timeoutMs ?? ESLINT_DEFAULT_TIMEOUT_MS,
+        maxBuffer: OUTPUT_BUFFER_BYTES
+    };
+    let command;
+    let invocationArgs;
+    let baseEnv;
+    if (useLocal) {
+        command = process.execPath;
+        invocationArgs = [localEslintJs, ...args];
+        baseEnv = process.env;
+    }
+    else {
+        // Fallback: resolve `npx` through the user's bundled npm install to
+        // bypass the Windows .cmd shim + shell-quoting issues.
+        const resolved = resolveNpxInvocation([
+            '--package', `eslint@${ESLINT_PACKAGE_PINS.eslint}`,
+            '--package', `@typescript-eslint/parser@${ESLINT_PACKAGE_PINS.typescriptEslintParser}`,
+            '--package', `@typescript-eslint/eslint-plugin@${ESLINT_PACKAGE_PINS.typescriptEslintPlugin}`,
+            '--', 'eslint', ...args
+        ]);
+        command = resolved.command;
+        invocationArgs = resolved.args;
+        baseEnv = resolved.baseEnv;
+    }
+    const result = spawnSync(command, invocationArgs, { ...spawnOptions, env: baseEnv });
+    if (result.error !== undefined && result.error !== null) {
+        const message = result.error.message;
+        const state = /ENOENT/.test(message) ? 'npx-failed' : 'execution-failed';
+        return emptyResult(state, start, typeof result.stdout === 'string' ? result.stdout : '');
+    }
+    if (result.signal !== null && result.signal !== undefined) {
+        return emptyResult('execution-failed', start, typeof result.stdout === 'string' ? result.stdout : '');
+    }
+    const stdout = typeof result.stdout === 'string' ? result.stdout : '';
+    let findings = [];
+    if (stdout.trim().length > 0) {
+        try {
+            const parsed = JSON.parse(stdout);
+            for (const entry of parsed) {
+                if (typeof entry !== 'object' || entry === null)
+                    continue;
+                const parentFile = typeof entry.filePath === 'string'
+                    ? entry.filePath
+                    : '';
+                const messages = Array.isArray(entry.messages)
+                    ? entry.messages
+                    : [];
+                for (const m of messages) {
+                    if (m === null || typeof m !== 'object')
+                        continue;
+                    findings.push({
+                        filePath: typeof m.filePath === 'string' && m.filePath.length > 0 ? m.filePath : parentFile,
+                        line: typeof m.line === 'number' ? m.line : 0,
+                        column: typeof m.column === 'number' ? m.column : 0,
+                        ruleId: typeof m.ruleId === 'string' ? m.ruleId : null,
+                        severity: severityFor(m.severity),
+                        message: typeof m.message === 'string' ? m.message : ''
+                    });
+                }
+            }
+        }
+        catch {
+            return emptyResult('execution-failed', start, stdout);
+        }
+    }
+    if (result.status !== 0 && findings.length === 0) {
+        return emptyResult('eslint-missing', start, typeof result.stderr === 'string' ? result.stderr : stdout);
+    }
+    // PRD-002b slice: incremental-first / no-touch-stockcode filters.
+    // PRD-002b D6: baselineFile is project-level; if missing we surface
+    // state='baseline-missing' so the caller can re-run `peaks lint baseline`.
+    const diffOnly = options.diffOnly !== false;
+    const redLineMode = options.redLineMode ?? 'baseline-aware';
+    const baselinePath = options.baselineFile ?? '.peaks/lint/baseline.json';
+    const baseline = loadBaseline(options.cwd, baselinePath);
+    const diffRanges = diffOnly ? loadDiffRanges(options.cwd) : EMPTY_DIFF_RANGE;
+    let activeFindings = findings;
+    let waived = [];
+    if (diffOnly) {
+        activeFindings = findings.filter((f) => inDiff(f.filePath, f.line, diffRanges));
+    }
+    if (baseline.length > 0) {
+        const next = [];
+        waived = [];
+        for (const f of activeFindings) {
+            if (matchBaseline(f, baseline)) {
+                waived.push(f);
+            }
+            else {
+                next.push(f);
+            }
+        }
+        activeFindings = next;
+    }
+    const redLine = redLineMode === 'baseline-aware' ? aggregateRedLine(baseline) : EMPTY_REDLINE;
+    const finalState = baseline.length === 0 && diffOnly && options.baselineFile !== undefined
+        ? 'baseline-missing'
+        : 'ok';
+    return {
+        state: finalState,
+        findings: activeFindings,
+        summary: summarize(activeFindings),
+        durationMs: Date.now() - start,
+        rawOutput: stdout,
+        baselineWaived: waived,
+        redLine
+    };
+}

package/dist/services/lint/npx-resolver.d.ts

@@ -0,0 +1,6 @@
+export type NpxInvocation = {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly baseEnv: NodeJS.ProcessEnv;
+};
+export declare function resolveNpxInvocation(npxArgs: readonly string[]): NpxInvocation;

package/dist/services/lint/npx-resolver.js

@@ -0,0 +1,47 @@
+/**
+ * Cross-platform `npx` resolver.
+ *
+ * On Windows, `npm` installs `npx` as a `.cmd` shim; Node 22's
+ * `child_process.spawnSync` refuses to invoke it unless `shell: true`
+ * is set, and `shell: true` corrupts quoted `--package` arguments.
+ * Rather than depend on shell quoting, this helper resolves the
+ * npx script bundled with the user's `npm` install and invokes it
+ * via `node <npx-cli.js>` with the same argv. macOS / Linux continue
+ * to use the regular `npx` binary.
+ */
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import process from 'node:process';
+function locateNpxCliScript() {
+    const candidates = process.platform === 'win32'
+        ? [
+            join(process.execPath, '..', '..', 'node_modules', 'npm', 'bin', 'npx-cli.js'),
+            'C:/nvm4w/nodejs/node_modules/npm/bin/npx-cli.js',
+            'C:/Program Files/nodejs/node_modules/npm/bin/npx-cli.js'
+        ]
+        : [
+            join(process.execPath, '..', '..', 'lib', 'node_modules', 'npm', 'bin', 'npx-cli.js')
+        ];
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+export function resolveNpxInvocation(npxArgs) {
+    if (process.platform === 'win32') {
+        const cliScript = locateNpxCliScript();
+        if (cliScript !== null) {
+            return {
+                command: process.execPath,
+                args: [cliScript, ...npxArgs],
+                baseEnv: process.env
+            };
+        }
+    }
+    return {
+        command: 'npx',
+        args: npxArgs,
+        baseEnv: process.env
+    };
+}

package/dist/services/lint/ocr-multilang-adapter.d.ts

@@ -0,0 +1,34 @@
+export declare const OCR_18_PACKAGE = "@alibaba-group/open-code-review@1.8.9";
+export declare const OCR_18_LANGUAGES: readonly ["python", "go", "java", "rust", "cpp", "csharp", "ruby", "php"];
+export type Ocr18Language = (typeof OCR_18_LANGUAGES)[number];
+export type Ocr18State = 'ok' | 'ocr18-missing' | 'binary-missing' | 'llm-config-missing' | 'execution-failed' | 'language-unsupported';
+export type Ocr18Finding = {
+    readonly filePath: string;
+    readonly line: number;
+    readonly ruleId: string | null;
+    readonly severity: 'error' | 'warn' | 'info';
+    readonly message: string;
+};
+export type Ocr18Summary = {
+    readonly total: number;
+    readonly bySeverity: Readonly<Record<'error' | 'warn' | 'info', number>>;
+    readonly byLanguage: Readonly<Record<Ocr18Language, number>>;
+};
+export type Ocr18RunResult = {
+    readonly state: Ocr18State;
+    readonly findings: readonly Ocr18Finding[];
+    readonly summary: Ocr18Summary | null;
+    readonly durationMs: number;
+    readonly rawOutput: string;
+};
+export type Ocr18RunOptions = {
+    readonly cwd: string;
+    readonly language: string;
+    readonly from?: string;
+    readonly to?: string;
+    readonly commit?: string;
+    readonly delegate?: boolean;
+    readonly timeoutMs?: number;
+};
+export declare function buildOcr18Args(options: Ocr18RunOptions): string[];
+export declare function runOcr18(options: Ocr18RunOptions): Ocr18RunResult;

package/dist/services/lint/ocr-multilang-adapter.js

@@ -0,0 +1,143 @@
+/**
+ * OCR 1.8.x multi-language reviewer adapter. Routes one of the
+ * 8 supported languages to the corresponding `ocr review` filter.
+ */
+import { spawnSync } from 'node:child_process';
+export const OCR_18_PACKAGE = '@alibaba-group/open-code-review@1.8.9';
+export const OCR_18_LANGUAGES = [
+    'python',
+    'go',
+    'java',
+    'rust',
+    'cpp',
+    'csharp',
+    'ruby',
+    'php'
+];
+function isSupportedLanguage(value) {
+    return OCR_18_LANGUAGES.includes(value);
+}
+function severityFor(value) {
+    if (value === 'error' || value === 'critical' || value === 2)
+        return 'error';
+    if (value === 'warn' || value === 'warning' || value === 1)
+        return 'warn';
+    return 'info';
+}
+function emptyByLanguage() {
+    const out = {};
+    for (const lang of OCR_18_LANGUAGES) {
+        out[lang] = 0;
+    }
+    return out;
+}
+export function buildOcr18Args(options) {
+    if (!isSupportedLanguage(options.language)) {
+        throw Object.assign(new Error(`unsupported language: ${options.language}`), { code: 'LANGUAGE_UNSUPPORTED' });
+    }
+    const args = [
+        '--package', OCR_18_PACKAGE,
+        '--', 'ocr'
+    ];
+    if (options.delegate === true) {
+        args.push('delegate', 'preview');
+        if (options.from !== undefined)
+            args.push('--from', options.from);
+        if (options.to !== undefined)
+            args.push('--to', options.to);
+        if (options.commit !== undefined)
+            args.push('--commit', options.commit);
+    }
+    else {
+        args.push('review', '--filter-language', options.language);
+        if (options.from !== undefined)
+            args.push('--from', options.from);
+        if (options.to !== undefined)
+            args.push('--to', options.to);
+        if (options.commit !== undefined)
+            args.push('--commit', options.commit);
+        args.push('--format', 'json');
+    }
+    return args;
+}
+export function runOcr18(options) {
+    const start = Date.now();
+    if (!isSupportedLanguage(options.language)) {
+        return {
+            state: 'language-unsupported',
+            findings: [],
+            summary: null,
+            durationMs: Date.now() - start,
+            rawOutput: `unsupported language: ${options.language}`
+        };
+    }
+    const args = buildOcr18Args(options);
+    const spawnOptions = {
+        cwd: options.cwd,
+        encoding: 'utf8',
+        timeout: options.timeoutMs ?? 60_000,
+        maxBuffer: 32 * 1024 * 1024
+    };
+    const result = spawnSync('npx', args, spawnOptions);
+    const stdout = typeof result.stdout === 'string' ? result.stdout : '';
+    const stderr = typeof result.stderr === 'string' ? result.stderr : '';
+    if (result.error !== undefined && result.error !== null) {
+        return {
+            state: 'ocr18-missing',
+            findings: [],
+            summary: null,
+            durationMs: Date.now() - start,
+            rawOutput: stderr || stdout
+        };
+    }
+    if (result.status !== 0) {
+        return {
+            state: 'execution-failed',
+            findings: [],
+            summary: null,
+            durationMs: Date.now() - start,
+            rawOutput: stderr || stdout
+        };
+    }
+    let findings = [];
+    if (stdout.trim().length > 0) {
+        try {
+            const parsed = JSON.parse(stdout);
+            if (Array.isArray(parsed.findings)) {
+                for (const entry of parsed.findings) {
+                    if (entry === null || typeof entry !== 'object')
+                        continue;
+                    const f = entry;
+                    findings.push({
+                        filePath: typeof f.file === 'string' ? f.file : '',
+                        line: typeof f.line === 'number' ? f.line : 0,
+                        ruleId: typeof f.rule === 'string' ? f.rule : null,
+                        severity: severityFor(f.severity),
+                        message: typeof f.message === 'string' ? f.message : ''
+                    });
+                }
+            }
+        }
+        catch {
+            return {
+                state: 'execution-failed',
+                findings: [],
+                summary: null,
+                durationMs: Date.now() - start,
+                rawOutput: stderr || stdout
+            };
+        }
+    }
+    const bySeverity = { error: 0, warn: 0, info: 0 };
+    for (const f of findings)
+        bySeverity[f.severity]++;
+    const byLanguageMut = { ...emptyByLanguage() };
+    byLanguageMut[options.language] = findings.length;
+    return {
+        state: 'ok',
+        findings,
+        summary: { total: findings.length, bySeverity, byLanguage: byLanguageMut },
+        durationMs: Date.now() - start,
+        rawOutput: stdout
+    };
+}

package/dist/services/loop/loop-release-types.js

@@ -1,4 +1,23 @@
 import { z } from "zod";
+/* ---------------------------------------------------------------------- */
+/* PRD-002b slice 2 — schema-limit constants extracted from inline         */
+/* `.max(N)` calls so the no-magic-numbers rule stops flagging the        */
+/* constraint values. Names describe the field, not just the number.     */
+/* Bytewise-identical to the original literals (signaled in commit).     */
+/* ---------------------------------------------------------------------- */
+const LOOP_ID_MAX = 64;
+const LOOP_SHARE_EXCLUDED_PATH_MAX = 4096;
+const LOOP_NAME_MAX = 200;
+const LOOP_SCENARIO_MAX = 4000;
+const LOOP_TRIGGER_POLICY_MAX = 2000;
+const LOOP_SUCCESS_CRITERIA_ITEM_MAX = 1000;
+const LOOP_INTERACTION_POLICY_MAX = 2000;
+const LOOP_FEEDBACK_POLICY_MAX = 2000;
+const LOOP_EVOLUTION_POLICY_MAX = 2000;
+const LOOP_EVALUATOR_POLICY_ITEM_MAX = 1000;
+const LOOP_LINKED_BEE_MAX = 64;
+const LOOP_HISTORY_ITEM_MAX = 128;
+const LOOP_CRYSTALLIZATION_EVIDENCE_MAX = 128;
 /**
  * LoopRelease — spec §4.1 (Loop Engineering Asset).
  *
@@ -74,7 +93,7 @@ export const LOOP_RELEASE_M3_FIELDS = [
 export const LoopReleaseM3ExtensionSchema = z.object({
     shareable: z.boolean().default(true),
     share_excluded_paths: z
-        .array(z.string().min(1).max(4096))
+        .array(z.string().min(1).max(LOOP_SHARE_EXCLUDED_PATH_MAX))
         .default([]),
     desktop_visible: z.boolean().default(true),
     export_bundle_format: z
@@ -92,27 +111,27 @@ export const LoopReleaseInputSchema = z
     id: z
         .string()
         .min(1)
-        .max(64)
+        .max(LOOP_ID_MAX)
         .regex(/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/, {
         message: "id must be kebab-case starting with a lowercase letter (e.g. loop-onboarding-research)",
     }),
-    name: z.string().min(1).max(200),
-    scenario: z.string().trim().min(1).max(4000),
-    trigger_policy: z.string().trim().min(1).max(2000),
+    name: z.string().min(1).max(LOOP_NAME_MAX),
+    scenario: z.string().trim().min(1).max(LOOP_SCENARIO_MAX),
+    trigger_policy: z.string().trim().min(1).max(LOOP_TRIGGER_POLICY_MAX),
     success_criteria: z
-        .array(z.string().trim().min(1).max(1000))
+        .array(z.string().trim().min(1).max(LOOP_SUCCESS_CRITERIA_ITEM_MAX))
         .min(1, "success_criteria must list at least one declarative criterion"),
     interaction_policy: z
         .string()
         .trim()
         .min(1, "interaction_policy must declare human-NL-choice-only semantics")
-        .max(2000),
-    feedback_policy: z.string().trim().min(1).max(2000),
-    evolution_policy: z.string().trim().min(1).max(2000),
-    evaluator_policy: z.array(z.string().trim().min(1).max(1000)).min(1),
-    linked_bees: z.array(z.string().min(1).max(64)).default([]),
-    run_history: z.array(z.string().min(1).max(128)).default([]),
-    crystallization_evidence: z.array(z.string().min(1).max(128)).default([]),
+        .max(LOOP_INTERACTION_POLICY_MAX),
+    feedback_policy: z.string().trim().min(1).max(LOOP_FEEDBACK_POLICY_MAX),
+    evolution_policy: z.string().trim().min(1).max(LOOP_EVOLUTION_POLICY_MAX),
+    evaluator_policy: z.array(z.string().trim().min(1).max(LOOP_EVALUATOR_POLICY_ITEM_MAX)).min(1),
+    linked_bees: z.array(z.string().min(1).max(LOOP_LINKED_BEE_MAX)).default([]),
+    run_history: z.array(z.string().min(1).max(LOOP_HISTORY_ITEM_MAX)).default([]),
+    crystallization_evidence: z.array(z.string().min(1).max(LOOP_CRYSTALLIZATION_EVIDENCE_MAX)).default([]),
     lifecycle_status: LoopReleaseLifecycleStatusSchema,
     version: z
         .string()

package/dist/services/loop/spec-service.d.ts

@@ -57,7 +57,13 @@ export declare function resolveLoopSpec(projectRoot: string, sid: string, rid: s
  *  `buildSpec` preserves raw values so out-of-range entries surface in
  *  `lintLoopSpec` rather than being silently clamped. */
 export declare function buildSpec(input: Partial<LoopSpec>, expectedRid: string): LoopSpec;
-/** Lint a LoopSpec — returns a report with semantic errors / warnings. */
+/** Lint a LoopSpec — returns a report with semantic errors / warnings.
+ *
+ *  Refactored 2026-08-07 (PRD-002b slice 3 commit A — extract-method):
+ *  the original function had complexity 14. Each validation phase now lives
+ *  in its own helper, dropping the orchestrator to complexity ~5.
+ *  Behavior is byte-for-byte preserved: same error/warning strings, same
+ *  ordering, same return shape. */
 export declare function lintLoopSpec(spec: LoopSpec): SpecLintReport;
 /** Serialize a LoopSpec to a stable YAML representation. Pure. */
 export declare function serializeSpec(spec: LoopSpec): string;