peaks-loop 4.0.31 → 4.0.33

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 4.0.33 — 2026-09-09 (ECC 去插件化 + 动态获取修复 + 移除 understand-anything)
+
+**Highlights**:
+
+1. **ECC 去插件化** — 此前 ECC code-review 依赖用户手动安装 Claude Code 插件，新开发机缺失即静默降级为 inline review。
+
+   - **物化到 `~/.peaks/agents/ecc/`**（peaks 自有目录，**永不写 `~/.claude/`**）。
+   - **缓存后备路径**：插件缺失时自动确保缓存 → 把物化指令注入通用子代理 → 经同一 bridge 渲染，新增 `detectEcc` 状态 `ready-via-cache`。
+   - **按真实名解析**：新增 `resolveMaterializedAgentName()`（候选名 + 确定性回退），修正物化文件名 `code-review.md` → 上游实际 `code-reviewer.md`。
+   - **修正原生插件 id**：`everything-claude-code:code-review` → **`ecc:code-reviewer`**（插件实名 `ecc`、agent 实名 `code-reviewer`；旧名是退役的仓库名）。
+
+2. **修复 `peaks ecc install` 下载链（此前从未真正跑通）** — 三条 D-010 路径全挂：`ecc.tar.gz` 资产已不存在（404）、`tarball_url` 请求发 `accept: application/octet-stream` 被 GitHub 拒（415）、无 `.tgz` 资产可回退。现改为 `tarball_url → 资产 → PRD url` + 正确 accept 头；tar 根目录剥离改为按形状（codeload 与 api 前缀不同）。实测 `peaks ecc install` exit 0，物化 68 个 agent。
+
+3. **死代码 / 坏引用修复** — `getInstalledCapabilityIds` 从写死 `[]` 改为真实只读检测；`peaks shadcn init`（skill 引用但命令不存在）实现为 `npx --package shadcn@4.21.0` 动态包装；清除 AgentShield 的 3 处误导残留（死 flag / 每次必印的假提示 / 过期注释）。
+
+4. **移除 understand-anything 集成** — 命令 + 服务 + 能力目录 + skill/docs/README/宣传片引用全部删除，切片拆解与分析统一走 codegraph。
+
+**验证**：全量 124 files / 1057 passed（原 119 / 1014）；tsc clean；实测 `~/.claude/` 零写入。
+
+## 4.0.32 — 2026-09-08 (CI 首次全绿 — 工作流修复 + Linux-only 测试修复)
+
+**Highlights**:
+
+1. **CI 工作流修复（本仓库 ci.yml 首次真正跑通）** — 此前第一个门 `pnpm/action-setup@v4` 在 runner 默认 Node 24 上 self-installer 必挂，导致后续所有步骤从未被验证。
+
+   - `pnpm/action-setup@v4` → `corepack`（对齐 publish.yml）。
+   - 删除 Build 之前的 `npx tsc --noEmit` 步骤：它跑在 `packages/*/dist` 生成之前，而 `peaks-loop-shared/version` 等 subpath 指向 dist，任何 commit 都过不了；canonical typecheck 由 `npm run build` 内的 `tsc -p tsconfig.build.json` 承担。
+   - 移除 node 20.x 矩阵（windows-latest + 20.x 的 pnpm install 红且日志 admin-only 无法诊断）。
+   - capability-guard 固定 `PEAKS_CALLER_ID`（J02 等 contract 会 spawn `bin/peaks.js`，CI 无 IDE adapter env 时 callerId 解析走 D2/EX_USAGE）。
+   - Test 步骤新增 `--reporter=github-actions`，失败转为可无 admin 读取的 check-run annotation。
+
+2. **3 类 pre-existing Linux-only 测试修复**（windows 早已绿，ubuntu 红；用 Docker Linux 容器忠实复现定位）：
+
+   - `setImmediate` 闭包竞态：延迟清理回调读取可变模块级 `workspace`，可能在下一个测试 `beforeEach` 重新赋值后删除**活着的**工作目录 → `ENOENT: uv_cwd`（3 个 session 套件 + 4 个潜伏同模式文件）。
+   - `detect-eslint` 断言 Windows 专属行为（`npx-resolver` 在 POSIX 上按设计返回裸 `npx`）→ 改为平台感知断言。
+   - `scan-orchestrator` 的 100ms 墙钟下限 flake → 改为断言 `elapsedMs` 已被填充。
+
+   验证：CI run 全 3 job success；双平台独立复跑 Linux 119 files / 1010 passed、Windows 119 files / 1014 passed。
+
 ## 4.0.31 — 2026-09-08 (codegraph auto-refresh 悬空 marker 修复)
 
 **Highlights**:

package/README-en.md

@@ -174,11 +174,10 @@ Every lane opens with **one slash command**.
 | Role | Project | One-liner |
 | --- | --- | --- |
 | **Sediment + gates** | [**peaks-loop**](https://github.com/SquabbyZ/peaks-loop) ← you are here | loop-engineering crystallization system; install → PRD/RD/QA/UI/SC/TXT as one chain + sediment |
-| **Tactical handbook** | [affaan-m/ECC](https://github.com/affaan-m/ECC) | everything-claude-code: the best tactics, skills, and SOPs you can put on top of Claude Code |
-| **Code understanding** | [Egonex-AI/Understand-Anything](https://github.com/Egonex-AI/Understand-Anything) | any repo, one sentence to grok it — let the LLM actually *understand* the project, not guess |
+| **Tactical handbook** | [affaan-m/ECC](https://github.com/affaan-m/ECC) | the best tactics, skills, and SOPs you can put on top of Claude Code |
 | **Process & discipline** | [obra/superpowers](https://github.com/obra/superpowers) | brainstorming / TDD / debugging / code-review as flow disciplines, every one with a hard exit |
 
-**One sentence to use them all**: clone the three repos above, install peaks-loop, hand the rest to your LLM — it pulls what it needs, holds the gates, lands the tactics, sediments the flow.
+**One sentence to use them all**: clone the two repos above, install peaks-loop, hand the rest to your LLM — it pulls what it needs, holds the gates, lands the tactics, sediments the flow.
 
 ### Tribute
 
@@ -312,7 +311,7 @@ Three common pitfalls:
 - Changelog → [`CHANGELOG.md`](./CHANGELOG.md)
 - Questions → [GitHub Issues](https://github.com/SquabbyZ/peaks-loop/issues)
 - Tribute: [multica-ai/andrej-karpathy-skills](https://github.com/multica-ai/andrej-karpathy-skills) · [alchaincyf/darwin-skill](https://github.com/alchaincyf/darwin-skill)
-- Recommended combo: [affaan-m/ECC](https://github.com/affaan-m/ECC) · [Egonex-AI/Understand-Anything](https://github.com/Egonex-AI/Understand-Anything) · [obra/superpowers](https://github.com/obra/superpowers)
+- Recommended combo: [affaan-m/ECC](https://github.com/affaan-m/ECC) · [obra/superpowers](https://github.com/obra/superpowers)
 
 ---
 

package/README.md

@@ -9,7 +9,7 @@
 [![ci](https://img.shields.io/github/actions/workflow/status/SquabbyZ/peaks-loop/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white&label=ci)](https://github.com/SquabbyZ/peaks-loop/actions/workflows/ci.yml)
 [![license](https://img.shields.io/badge/license-MIT-blue?style=for-the-badge)](./LICENSE)
 [![node](https://img.shields.io/badge/node-%E2%89%A520-339933?style=for-the-badge&logo=node.js&logoColor=white)](https://www.npmjs.com/package/peaks-loop)
-[![tests](https://img.shields.io/badge/tests-285%2B%20cases%20%C3%97%204%20pkgs-22c55e?style=for-the-badge&logo=vitest&logoColor=white)](#status)
+[![tests](https://img.shields.io/badge/tests-1096%20cases%20%C3%97%204%20pkgs-22c55e?style=for-the-badge&logo=vitest&logoColor=white)](#status)
 [![stars](https://img.shields.io/github/stars/SquabbyZ/peaks-loop?style=for-the-badge&logo=github&github=github&logoColor=white)](https://github.com/SquabbyZ/peaks-loop/stargazers)
 
 [English](./README-en.md) · **简体中文**
@@ -128,7 +128,7 @@ npm i -g peaks-loop
 
 ---
 
-## 当前状态 · 4.0.17
+## 当前状态 · 4.0.32
 
 <p align="center">
   <img src="./assets/readme/pulse.svg" alt="peaks-loop live metrics — 4 tiles + sparkline + pipeline progress" width="92%"/>
@@ -140,40 +140,33 @@ npm i -g peaks-loop
 
 | | |
 | --- | --- |
-| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.17(2026-08-07) |
+| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.32(2026-09-08) |
 | **覆盖域** | 代码(`peaks-code`) · 内容(`peaks-content`) · 项目健康(`peaks-doctor`) · 批量修 issue(`peaks-issue-fix-orchestrator`) · 自定义 SOP(`peaks-sop`) · 通用原语(`peaks-solo` 分诊 / `peaks-resume` 续 / `peaks-status` 看 / `peaks-test` 测 / `peaks-slice-decompose` 切片) |
 | **沉淀池** | `~/.peaks/` 本地池 · 跑两次自动晋升成 bee · 跑翻车让你重定义 · bee 跟着你的口味长 |
-| **测试套件** | 285+ cases · 4 packages (peaks-loop / peaks-loop-mut / peaks-loop-shared-channel / peaks-loop-shared) · 0 timeouts · 14 BDD caller-binding coverage |
+| **测试套件** | 1096 cases · 4 packages (peaks-loop 1015 / runtime 39 / mut 22 / shared-channel 20) · **CI 首次全绿**(ubuntu + windows) · 14 BDD caller-binding coverage |
 | **适配 IDE** | ✅ Claude Code · ✅ Z Code · 🚧 Codex / Cursor / Trae / Tongyi Lingma / Hermes / OpenClaw / Qoder(适配中,欢迎共建) |
 | **依赖运行时** | Node ≥ 20 |
 | **License** | MIT |
 
-### 4.0.17 这一波实打实修了什么(2026-08-07)
+### 近期演进(4.0.18 → 4.0.32)
 
-| Epic | 解决的事 | 怎么验 |
+| 版本 | 解决的事 | 怎么验 |
 | --- | --- | --- |
-| **Vitest worker cap(根因修)** | 完整套件 17 个 timeout 卡 30s;根因不是 bug,是 `pool:'forks'+fileParallelism:true` 没设 `maxWorkers`,16 核机器起 15 个 fork + 2 文件真实 `node` spawn = 8.8× 过载。`testTimeout` 算 wall clock,被 descheduled 的测试烧 30s 啥都不干。修 = `maxWorkers = floor(cpus/2)` + `PEAKS_VITEST_MAX_WORKERS` env override + 6-case drift guard。**17 timeout → 0,wall 383.67s → 360.40s,3/3 AC-1 runs 全 0 timeout。** | commit `ace1a03d` + guard test `tests/unit/vitest-concurrency-guard.test.ts` |
-| **PRD-002b ESLint 严格化(no-magic-numbers)** | 切片 2 关闭 917 → 192 violations(-725);20 source files 把 140+ inline magic numbers 抽出成 named consts;`no-magic-numbers` 配置加 `ignore: [-1,0,1,2,100,1000]` + `ignoreArrayIndexes/ignoreDefaultValues`;7 BDD tests,31/31 lint tests PASS。Severity 保持 `warn` 不变(D5 no-touch-stockcode)。 | commits `d5ef17c1` + `0c3187c4` + 7 BDD tests |
-| **Statusline `--now` 注入 + 24 spawns amortization** | 切片 1 根因 = test 用 `new Date().toISOString()` 写 lifecycle `updatedAt`,full-suite 并发下 subprocess 被 deschedule 几秒后才执行,10s 窗口过期 → C1 baseline fallback → 期望 `[████████]` 失败。修 = CLI 加 `--now <ms>`,test 共享 `TEST_NOW_MS` 锚定。**切片 7** 进一步把 24 个真实 `node dist/cli/index.js` spawn 换成 1 个 `beforeAll` IPC server,wall 216s → 29s(7.5× 加速),24/24 PASS。 | commit `3d6e4bc9` (含切片 1) + `44c42424` (切片 7) |
-| **Complexity refactor(切片 3 A+B+C+D + 切片 4 bundle-reader rewrite)** | 切片 3 四阶段 refactor 关闭 357 → 330 complexity violations(goal ≤90,本波覆盖 ~7% 的高 cohort):spec-service parser 走 table-dispatch、slice-decompose FSM、project-context detectComponentLibrary 11 探测 dispatch;**切片 4** = bundle-reader full rewrite,5 violations → 1,public API preserved verbatim。 | commits `72ef798c` + `31160051` + `1ac6e56d` + `923be824` + `0603754d` + `6b27eb94` |
-| **Type narrowing + max-lines 试点(切片 5+6)** | 切片 5 关 670 violations:667 phantom `no-explicit-any` config swap(ruleId 修复,类似 no-duplicate-imports 老坑)+ 3 real narrowing(`catch (error: any)` → `unknown` + `instanceof Error`)。切片 6 切 dispatch-record-writer.ts 4 个超长函数,4 → 0 in target file。两 slice 都证明 rule essentially exhausted 真比 memory 标注小一个数量级。 | commits `fbb43e9e` + `3d6e4bc9` (含) |
-| **Mac auto-compact ESM 防 fake-green 5/5 验证** | 切片 8 audit-only:5 个 defenses (`readClaudeTranscriptFallback` / `readClaudeStatuslinePercent` / `presence-marker-detector` / `post-compact-detector` / `step-08-gate`) 全部 in-place,ESM `require()` 0 hits,legacy silent-catch blocks 已 explicit re-throw `ReferenceError` / `SyntaxError`。 | sediment `.peaks/memory/2026-08-07-mac-esm-defense-audit.md` |
-| **Caller-binding 覆盖扩展(切片 9)** | 14 BDD tests 覆盖 5 gap categories:multi-tenant 隔离 / rotation 后 recovery / TTL freshness / rotation hygiene / primary-wins contract。`tests/unit/session/*` 从 51 → 65 tests。 | commit `823be8c4` + new file `tests/unit/session/caller-binding-slice-9-edge-cases.test.ts` |
-| **Pre-publish 验证全过** | gate-cli-version ALIGNED(root 4.0.17 == shared CLI_VERSION 4.0.17),build-integrity OK,0 Co-Authored-By trailers。 | per `peaks-loop-publishing-critical-hard-rules` recipe |
-
-| Epic | 解决的事 | 怎么验 |
-| --- | --- | --- |
-| **测试体系从零重建** | 旧 559 文件单测卡 3 小时跑不完;现 11 test files / 161 cases 单测已上线,加上子包测试与新增切片,全量 4 packages 285+ cases 全绿,`pnpm test:full` ~80s。删旧断言、写生产合约、4 维分拆(render/behavior/integration/a11y)。 | commit `f17aa377` → `1d6233bc` · `.peaks/memory/2026-07-30-test-rebuild-epic-sediment.md` |
-| **Karpathy 评估成本自审** | LLM 在 1-2 个 slice 后不再"今天差不多了明天继续"——`karpathy-reviewer` 报 `costRatio`,>10 时 `peaks job karpathy-cost-check` 自动降级 `block`→`warn`。24h-mode 仍是 override。 | `peaks job karpathy-cost-check --review-file <path>` · 21 cases 单测 |
-| **Compact 显性可见** | `peaks compact history` 给 LLM 看本次会话所有 compact 事件;`peaks statusline compact` 单行指示给 IDE 状态栏( `--` / `compact pending (0.85)` / `REDLINE 0.95` / `just compacted (0.92→?)`)。 | `auto-compact-orchestrator` append 到 `compact-history.jsonl` · 19 cases 单测 |
-| **子包独立单测 + `pnpm test:full` 覆盖全 workspace** | `peaks-loop-mut` / `peaks-loop-shared-channel` 各自 4 维单测;`peaks-loop-shared` 0 file (passWithNoTests);root 镜像冗余删除。 | commit `593ffcdf` → `08e92d8f` · `pnpm test:full` 一次跑完 4 packages |
-| **CLI surface 收敛(73 → 5 super-commands)** | 5 个 super-command(`peaks code / audit / doctor / openspec / release / release-pack`)替换 73 个 leaf command,byte-identical 契约保留,改动对外透明。 | rid-009 · 26 routing test |
+| **4.0.32** | **CI 首次全绿** —— ci.yml 此前死在第一个门(`pnpm/action-setup@v4` 在 Node 24 runner 上 self-installer 必挂),后面所有步骤从未被验证。修 5 层:corepack 替 pnpm action、删 pre-Build 的 `tsc`(结构性过不了:subpath 指向未生成的 dist)、移除 node 20 矩阵、CI 固定 `PEAKS_CALLER_ID`、3 类 Linux-only 测试 bug(`setImmediate` 闭包竞态 / 平台写死断言 / 墙钟 flake)。 | CI run 全 3 job success;双平台独立复跑 119 files / 0 failed |
+| **4.0.31** | **codegraph 自动刷新失效修复** —— `.peaks-loop-marker` 被下游误判为"已初始化",悬空 `.codegraph/` 永远建不出 `codegraph.db`。改为按 `codegraph.db` 判真实初始化 + 源头真 `init` + 悬空态自愈。 | 现场从悬空态成功建出 24.71 MB 索引 |
+| **4.0.30** | **搜索优先 preflight**(编排层"先搜再答":Context7/WebSearch → ≤5 条绑定指令注入 RD 派发)+ **9 个超行文件拆分**(`src/` 全量 ≤800 行)+ CLI 漂移修复。 | scoped + full suite |
+| **4.0.29** | **codegraph 生命周期闭环** —— RD 规划前 pre-dispatch preflight 自动 init/index 并注入结构;slice 完成边界自动 refresh(CLI-internal,不可绕过)。 | 29 单测 |
+| **4.0.28** | **codegraph 数据目录回根** + **env-first 1M 窗口识别**(修 1M 模型被误判 200K 导致 false soft-warn)。 | `context-now` 修复前 200K/0.884 → 修复后 1M/0.187 |
+| **4.0.24** | zod v4 + Context7 接入 + **Step 2.5 best-practice scan**(业务感知的最佳实践扫描)。 | — |
+| **4.0.21** | vendor-detect recovery + codegraph 集成 + anti-fake-green gate。 | — |
+| **4.0.19 / 4.0.20** | **detached sub-agent**(真 OS 进程 + G8 无限上下文自压缩);`peaks-loop-internal-runtime` 作为公开 lockstep 包发布。 | — |
+| **4.0.18** | statusline 24h overlay。 | — |
 
 ---
 
-## 强烈推荐 · 四个项目组合起来用
+## 强烈推荐 · 三个项目组合起来用
 
-> **0 学习成本。** 这是组合起来用最大的好处 —— 不只是效果俱佳,更是因为这四个项目的**接口对齐到了"自然语言"**,你只需要说一句话,谁替你跑命令、按什么闸门、按什么战术手册,完全不用你记。
+> **0 学习成本。** 这是组合起来用最大的好处 —— 不只是效果俱佳,更是因为这几个项目的**接口对齐到了"自然语言"**,你只需要说一句话,谁替你跑命令、按什么闸门、按什么战术手册,完全不用你记。
 
 <p align="center">
   <img src="./assets/readme/footer.svg" alt="peaks-loop 推荐组合" width="92%"/>
@@ -182,11 +175,10 @@ npm i -g peaks-loop
 | 角色 | 项目 | 一句话 |
 | --- | --- | --- |
 | **结晶与门禁** | [**peaks-loop**](https://github.com/SquabbyZ/peaks-loop) ← 你在这里 | loop engineering 结晶系统,装上就有 PRD/RD/QA/UI/SC/TXT 一整条工程链 + 沉淀 |
-| **战术手册** | [affaan-m/ECC](https://github.com/affaan-m/ECC) | everything-claude-code:Claude Code 上能拿到的最好用的战术、技能、SOP 集合 |
-| **代码理解** | [Egonex-AI/Understand-Anything](https://github.com/Egonex-AI/Understand-Anything) | 任意仓库,一句话读懂 —— 让 LLM 真正"理解"项目,而不是猜 |
+| **战术手册** | [affaan-m/ECC](https://github.com/affaan-m/ECC) | Claude Code 上能拿到的最好用的战术、技能、SOP 集合 |
 | **流程与纪律** | [obra/superpowers](https://github.com/obra/superpowers) | brainstorming / TDD / debugging / code-review 等流程纪律,每条都自带硬退出条件 |
 
-**用起来就一句话**:把上面三个仓库都 clone 到本地,peaks-loop 装上,剩下的交给 LLM —— 它会按需取用、按纪律守门、按战术落地、按需求沉淀。
+**用起来就一句话**:把上面两个仓库都 clone 到本地,peaks-loop 装上,剩下的交给 LLM —— 它会按需取用、按纪律守门、按战术落地、按需求沉淀。
 
 ### 致敬
 
@@ -319,7 +311,7 @@ npx peaks doctor --project .
 - 更新日志 → [`CHANGELOG.md`](./CHANGELOG.md)
 - 提问 → [GitHub Issues](https://github.com/SquabbyZ/peaks-loop/issues)
 - 致敬: [multica-ai/andrej-karpathy-skills](https://github.com/multica-ai/andrej-karpathy-skills) · [alchaincyf/darwin-skill](https://github.com/alchaincyf/darwin-skill)
-- 组合推荐: [affaan-m/ECC](https://github.com/affaan-m/ECC) · [Egonex-AI/Understand-Anything](https://github.com/Egonex-AI/Understand-Anything) · [obra/superpowers](https://github.com/obra/superpowers)
+- 组合推荐: [affaan-m/ECC](https://github.com/affaan-m/ECC) · [obra/superpowers](https://github.com/obra/superpowers)
 
 ---
 

package/dist/cli/commands/_register.js

@@ -60,6 +60,7 @@ import { registerReviewerCommands } from './reviewer-commands.js';
 import { registerRoleCommands } from './role-commands.js';
 import { registerRuntimeCommands } from './runtime-commands.js';
 import { registerScanCommands } from './scan-commands.js';
+import { registerShadcnCommands } from './shadcn-commands.js';
 import { registerSecurityAuditCommands } from './security-audit-commands.js';
 import { registerSedimentCommands } from './sediment-commands.js';
 import { registerSkillConformanceCommands } from './skill-conformance-commands.js';
@@ -75,7 +76,6 @@ import { registerSubAgentCommands } from './sub-agent-commands.js';
 import { registerSubAgentShutdownCommands } from './sub-agent-shutdown-commands.js';
 import { registerSubAgentDispatchGuard } from './sub-agent-dispatch-guard.js';
 import { registerTestCommands } from './test-commands.js';
-import { registerUnderstandCommands } from './understand-commands.js';
 import { registerVendorDetectCommand } from './vendor-detect.js';
 import { registerUpgradeCommands } from './upgrade-commands.js';
 import { registerUserTouchpointCommands } from './user-touchpoint-commands.js';
@@ -97,7 +97,8 @@ const REGISTRATIONS = [
     ['perf-commands', registerPerfCommands], ['preferences-commands', registerPreferencesCommands],
     ['project-commands', registerProjectCommands], ['prd-commands', registerPrdCommands],
     ['request-commands', registerRequestCommands], ['retrospective-commands', registerRetrospectiveCommands],
-    ['scan-commands', registerScanCommands], ['slice-commands', registerSliceCommands],
+    ['scan-commands', registerScanCommands], ['shadcn-commands', registerShadcnCommands],
+    ['slice-commands', registerSliceCommands],
     ['sop-commands', registerSopCommands], ['feedback-commands', registerFeedbackCommands],
     ['fork-commands', registerForkCommands], ['impact-commands', registerImpactCommands],
     ['smoke-commands', registerSmokeCommands], ['release-commands', registerReleaseCommands],
@@ -111,7 +112,7 @@ const REGISTRATIONS = [
     ['governance-classify-contract-commands', registerContractCommands],
     ['sub-agent-dispatch-guard', registerSubAgentDispatchGuard], ['gate-commands', registerGateCommands],
     ['hook-handle', registerHookHandleCommand], ['hooks-commands', registerHooksCommands],
-    ['heartbeat-commands', registerHeartbeatCommands], ['statusline-commands', registerStatusLineCommands], ['understand-commands', registerUnderstandCommands],
+    ['heartbeat-commands', registerHeartbeatCommands], ['statusline-commands', registerStatusLineCommands],
     ['workspace-commands', registerWorkspaceCommands], ['workflow-plan-commands', registerWorkflowPlanCommands],
     ['audit-commands', registerAuditCommands], ['final-review-commands', registerFinalReviewCommands],
     ['governance-classify-contract-commands', registerClassifyCommands], ['context-commands', registerContextCommands],

package/dist/cli/commands/audit-commands.js

@@ -78,12 +78,6 @@ export function registerAuditCommands(program, io) {
             process.exitCode = 1;
         }
     });
-    // Slice #6 L2.3 P2-a: peaks audit static — soft-optional ECC
-    // AgentShell integration. Reads `.peaks/preferences.json`'s
-    // `agentShieldEnabled` flag (default false). The CLI flags
-    // `--enable-agent-shield` / `--disable-agent-shield` override
-    // the preference for a single call.
-    //
     // Slice K1 (2.8.0): `--record` persists the audit snapshot as a
     // project-memory decision at `.peaks/memory/audit-decisions/<slug>.md`.
     // `--rid <id>` is an optional disambiguator for multiple audits on
@@ -91,12 +85,16 @@ export function registerAuditCommands(program, io) {
     // Per `peaks-loop-when-adding-a-new-subcommand-check-for-existing-top-level-first`
     // and the dev-preference red line "Default-no on new CLI commands",
     // we extend the existing command rather than register a new subcommand.
+    //
+    // 2026-09-09-ecc-dynamic-and-cleanup B3: the dead
+    // `--enable-agent-shield` / `--disable-agent-shield` flags were removed.
+    // `runStaticAudit`'s agentShield state is a frozen "always disabled" stub
+    // (Slice 3 of 4.0.0-beta.11 removed the subprocess), so the flags had no
+    // effect and the ECC opt-in prose misled users on every run.
     addJsonOption(audit
         .command('static')
-        .description('Run the static audit (peaks-loop lint + optional ECC AgentShield subprocess). Per spec §5.3.')
+        .description('Run the static audit (peaks-loop lint only; the ECC AgentShield subprocess was removed in 4.0.0-beta.11). Per spec §5.3.')
         .requiredOption('--project <path>', 'target project root')
-        .option('--enable-agent-shield', 'force-enable ECC AgentShield subprocess for this call (overrides preference)')
-        .option('--disable-agent-shield', 'force-disable ECC AgentShield subprocess for this call (overrides preference)')
         .option('--record', 'persist the audit snapshot to .peaks/memory/audit-decisions/ as a project-memory decision')
         .option('--rid <rid>', 'disambiguator for the decision record slug (used with --record; pairs multiple audits on the same day)')).action(async (options) => {
         const validation = validateProjectRoot(options.project);
@@ -105,14 +103,6 @@ export function registerAuditCommands(program, io) {
             process.exitCode = 1;
             return;
         }
-        // Resolve the flag override. `--enable-agent-shield` and
-        // `--disable-agent-shield` are mutually exclusive; we surface
-        // a 422 if both are passed.
-        if (options.enableAgentShield && options.disableAgentShield) {
-            printResult(io, fail('audit.static', 'FLAGS_CONFLICT', '`--enable-agent-shield` and `--disable-agent-shield` are mutually exclusive', emptyStaticAuditData(), ['Pass at most one of the two flags']), options.json);
-            process.exitCode = 1;
-            return;
-        }
         // Slice K1: `--rid` is meaningful only with `--record`. Surface a 422
         // when the user passes `--rid` without `--record` so the CLI fails
         // loudly rather than silently ignoring the request id.
@@ -123,12 +113,7 @@ export function registerAuditCommands(program, io) {
         }
         try {
             const result = runStaticAudit({
-                projectRoot: validation.projectRoot,
-                ...(options.enableAgentShield
-                    ? { enableAgentShield: true }
-                    : options.disableAgentShield
-                        ? { enableAgentShield: false }
-                        : {}),
+                projectRoot: validation.projectRoot
             });
             // Persist the decision record when `--record` is set. The writer is
             // idempotent at the slug level (same date+rid → same file); repeated
@@ -153,22 +138,10 @@ export function registerAuditCommands(program, io) {
                 ...(decision ? { decision } : {})
             };
             const nextActions = [];
-            // Per spec §5.3 + §7.2: when ECC is not installed, surface
-            // the canonical 4-option user opt-in UX (a/b/c/d) via
-            // nextActions. The peaks-loop `peaks audit static` CLI is
-            // non-interactive (JSON envelope by default), so the 4
-            // options are surfaced as machine-readable action strings
-            // — same pattern as understand-commands.ts `INSTALL_HINT`.
-            if (!result.agentShield.installed) {
-                nextActions.push('ECC AgentShield not installed. Pick one of the four options below:');
-                nextActions.push('  a) Install: run `npx ecc-agentshield --help` to install, then re-run `peaks audit static`.');
-                nextActions.push('  b) Skip this run: pass `--disable-agent-shield` to suppress the subprocess for this call.');
-                nextActions.push('  c) Skip forever: run `peaks preferences set agentShieldEnabled false` (writes to `.peaks/preferences.json`).');
-                nextActions.push('  d) Learn more: see docs/superpowers/specs/2026-06-11-peaks-loop-l1-l2-l3-redesign.md §5.3 + §7.2.');
-            }
-            if (result.agentShield.spawned && result.agentShield.findings.length > 0) {
-                nextActions.push(`${result.agentShield.findings.length} ECC findings merged into the audit. Review with \`peaks audit static --json\`.`);
-            }
+            // 2026-09-09-ecc-dynamic-and-cleanup B3: the ECC AgentShield opt-in
+            // nextActions block was removed. `agentShield.installed` is a frozen
+            // `false`, so the block printed on every run and pointed users at a
+            // removed subprocess, removed flags, and a dead preference.
             if (decision) {
                 nextActions.push(`Decision record written: ${decision.filePath}`);
                 nextActions.push(`Index synced: ${decision.indexSynced ? 'yes' : 'no'} (memory hot.decision[] now includes this audit)`);

package/dist/cli/commands/capability-commands.d.ts

@@ -11,6 +11,12 @@ export declare function runCapabilityStatus(io: ProgramIO, options: {
     json?: boolean;
 }): void;
 export declare function runCapabilityMap(io: ProgramIO, options: CapabilityMapOptions): void;
+/**
+ * Read-only detection of already-satisfied capabilities. Delegates to
+ * `detectInstalledCapabilityIds` (no install side effect, fail-soft).
+ * `_config` is retained for signature back-compat — the probe needs the
+ * project root, which comes from the process cwd.
+ */
 export declare function getInstalledCapabilityIds(_config: PeaksConfig): string[];
 export declare function parseCapabilityMapSource(source: string): CapabilityMapSourceFilter | null;
 export {};

package/dist/cli/commands/capability-commands.js

@@ -1,5 +1,7 @@
 import { readConfig } from '../../services/config/config-service.js';
+import { findProjectRoot } from '../../services/config/config-safety.js';
 import { resolveCapabilityAvailability } from '../../services/recommendations/capability-availability.js';
+import { detectInstalledCapabilityIds } from '../../services/recommendations/installed-capability-detector.js';
 import { createCapabilityMapPlan } from '../../services/recommendations/capability-map-service.js';
 import { seedCapabilityItems, seedCapabilitySources } from '../../services/recommendations/seed-capability-catalog.js';
 import { fail, ok } from 'peaks-loop-shared/result';
@@ -12,7 +14,9 @@ export function registerCapabilityCommands(program, io) {
     addCapabilityMapOptions(program.command('capabilities').description('Show dry-run external capability landing map')).action((options) => runCapabilityMap(io, options));
 }
 export function runCapabilityStatus(io, options) {
-    const availability = resolveCapabilityAvailability(seedCapabilityItems);
+    const availability = resolveCapabilityAvailability(seedCapabilityItems, {
+        installedCapabilityIds: getInstalledCapabilityIds(readConfig())
+    });
     printResult(io, ok("capability.status", { sources: seedCapabilitySources, items: seedCapabilityItems, availability }), options.json);
 }
 function addCapabilityMapOptions(command) {
@@ -34,8 +38,22 @@ export function runCapabilityMap(io, options) {
         ...(httpProxy === undefined ? {} : { httpProxy })
     })), options.json);
 }
+/**
+ * Read-only detection of already-satisfied capabilities. Delegates to
+ * `detectInstalledCapabilityIds` (no install side effect, fail-soft).
+ * `_config` is retained for signature back-compat — the probe needs the
+ * project root, which comes from the process cwd.
+ */
 export function getInstalledCapabilityIds(_config) {
-    return [];
+    return detectInstalledCapabilityIds({ projectRoot: resolveProbeRoot() });
+}
+function resolveProbeRoot() {
+    try {
+        return findProjectRoot(process.cwd()) ?? process.cwd();
+    }
+    catch {
+        return process.cwd();
+    }
 }
 export function parseCapabilityMapSource(source) {
     if (CAPABILITY_SOURCE_FILTERS.has(source)) {

package/dist/cli/commands/ecc-commands.js

@@ -4,7 +4,7 @@ import { fail, ok } from 'peaks-loop-shared/result';
 export function registerEccCommands(program, io) {
     const ecc = program
         .command('ecc')
-        .description('affaan-m/everything-claude-code cache: download + read-only access for the LLM (no subprocess; no peaks agent run).');
+        .description('affaan-m/ECC cache: download + read-only access for the LLM (no subprocess; no peaks agent run).');
     addJsonOption(ecc
         .command('install')
         .description('Download affaan-m/ECC to ~/.peaks/cache/ecc-<sha>/ (selective extract: agents/ subtree only).')
@@ -14,6 +14,7 @@ export function registerEccCommands(program, io) {
             const result = await downloadToCache(options.ref !== undefined && options.ref.length > 0 ? { ref: options.ref } : {});
             const envelope = ok('ecc.install', result, [], [
                 `Cache landed at ~/.peaks/cache/ecc-${result.sha}/agents/`,
+                `Plugin-free copy materialized at ~/.peaks/agents/ecc/ (read it directly when the ECC plugin is absent)`,
                 `Inspect with: peaks ecc ls`,
                 `Consume one agent with: peaks ecc show <name>`,
             ]);
@@ -23,7 +24,7 @@ export function registerEccCommands(program, io) {
             const message = getErrorMessage(error);
             printResult(io, fail('ecc.install', 'FETCH_FAILED', message, { ref: options.ref ?? 'latest' }, [
                 'Network failure during ECC download. Manual fallback:',
-                '  git clone https://github.com/affaan-m/everything-claude-code.git',
+                '  git clone https://github.com/affaan-m/ECC.git',
                 '  Copy <repo>/agents/*.md into ~/.peaks/cache/ecc-<sha>/agents/.',
                 '  Drop a minimal ecc-installed.json manifest into ~/.peaks/cache/.',
             ]), asJson);

package/dist/cli/commands/project-commands.js

@@ -10,7 +10,7 @@ export function registerProjectCommands(program, io) {
     const project = program.command('project').description('Aggregate Peaks state for a target project (read-only)');
     addJsonOption(project
         .command('dashboard')
-        .description('One-call snapshot of doctor / MCP / OpenSpec / requests / Understand Anything / capabilities for a project')
+        .description('One-call snapshot of doctor / MCP / OpenSpec / requests / capabilities for a project')
         .requiredOption('--project <path>', 'target project root')
         .option('--strict', 'ok follows the doctor aggregate (legacy semantics). Default: workspace-only (ok tracks the runbook health)', false)).action(async (options) => {
         try {

package/dist/cli/commands/shadcn-commands.d.ts

@@ -0,0 +1,32 @@
+import { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+/** Pinned upstream version — bump deliberately, never float on `latest`. */
+export declare const SHADCN_PACKAGE = "shadcn@4.21.0";
+export type ShadcnInitState = 'ok' | 'shadcn-missing' | 'execution-failed';
+export type ShadcnInitOptions = {
+    readonly cwd: string;
+    readonly preset: string;
+    readonly template?: string;
+    readonly yes?: boolean;
+    readonly timeoutMs?: number;
+};
+export type ShadcnInitResult = {
+    readonly state: ShadcnInitState;
+    readonly argv: readonly string[];
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly exitCode: number | null;
+    readonly durationMs: number;
+};
+/**
+ * Pure argv builder. `--package <pin> --` makes npx resolve the pinned
+ * upstream CLI without installing it into the project.
+ */
+export declare function buildShadcnInitArgs(options: Pick<ShadcnInitOptions, 'preset' | 'template' | 'yes'>): string[];
+/**
+ * Spawn the upstream CLI through the cross-platform npx resolver (on Windows
+ * `npx` is a `.cmd` shim that `spawnSync` refuses to invoke directly).
+ * Fail-soft: a missing network / missing npx returns a state, never throws.
+ */
+export declare function runShadcnInit(options: ShadcnInitOptions): ShadcnInitResult;
+export declare function registerShadcnCommands(program: Command, io: ProgramIO): void;

package/dist/cli/commands/shadcn-commands.js

@@ -0,0 +1,120 @@
+/**
+ * `peaks shadcn init` — dynamic wrapper around the upstream `shadcn` CLI.
+ *
+ * Slice B2 of 2026-09-09-ecc-dynamic-and-cleanup: `skills/bee/peaks-rd/SKILL.md`
+ * and `references/frontend-project-generation.md` already tell RD to scaffold
+ * a frontend with `peaks shadcn init --preset [CODE] --template vite`, but the
+ * command did not exist and `shadcn` was not a dependency. Rather than add a
+ * hard dependency, this mirrors `src/services/lint/detect-ocr-18.ts` +
+ * `npx-resolver.ts`: the tool is obtained on demand via
+ * `npx --package shadcn@<pin> -- shadcn ...`, so the skill reference is true
+ * and the dependency stays dynamic.
+ *
+ * Per the "Enhancement, not new AI CLI" tenet this is a thin pass-through:
+ * peaks-loop resolves the upstream binary and forwards the user's intent. It
+ * does not reimplement scaffolding and does not inject its own prompts.
+ */
+import { spawnSync } from 'node:child_process';
+import { resolveNpxInvocation } from '../../services/lint/npx-resolver.js';
+import { fail, ok } from 'peaks-loop-shared/result';
+import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+/** Pinned upstream version — bump deliberately, never float on `latest`. */
+export const SHADCN_PACKAGE = 'shadcn@4.21.0';
+/**
+ * Pure argv builder. `--package <pin> --` makes npx resolve the pinned
+ * upstream CLI without installing it into the project.
+ */
+export function buildShadcnInitArgs(options) {
+    const args = ['--package', SHADCN_PACKAGE, '--', 'shadcn', 'init', '--preset', options.preset];
+    if (options.template !== undefined && options.template.length > 0) {
+        args.push('--template', options.template);
+    }
+    if (options.yes === true) {
+        args.push('--yes');
+    }
+    return args;
+}
+/**
+ * Spawn the upstream CLI through the cross-platform npx resolver (on Windows
+ * `npx` is a `.cmd` shim that `spawnSync` refuses to invoke directly).
+ * Fail-soft: a missing network / missing npx returns a state, never throws.
+ */
+export function runShadcnInit(options) {
+    const start = Date.now();
+    const args = buildShadcnInitArgs(options);
+    const invocation = resolveNpxInvocation(args);
+    const result = spawnSync(invocation.command, [...invocation.args], {
+        cwd: options.cwd,
+        encoding: 'utf8',
+        timeout: options.timeoutMs ?? 300_000,
+        maxBuffer: 32 * 1024 * 1024,
+        env: invocation.baseEnv
+    });
+    const stdout = typeof result.stdout === 'string' ? result.stdout : '';
+    const stderr = typeof result.stderr === 'string' ? result.stderr : '';
+    if (result.error !== undefined && result.error !== null) {
+        return {
+            state: 'shadcn-missing',
+            argv: args,
+            stdout,
+            stderr: stderr.length > 0 ? stderr : getErrorMessage(result.error),
+            exitCode: null,
+            durationMs: Date.now() - start
+        };
+    }
+    if (result.status !== 0) {
+        return {
+            state: 'execution-failed',
+            argv: args,
+            stdout,
+            stderr,
+            exitCode: result.status,
+            durationMs: Date.now() - start
+        };
+    }
+    return {
+        state: 'ok',
+        argv: args,
+        stdout,
+        stderr,
+        exitCode: 0,
+        durationMs: Date.now() - start
+    };
+}
+export function registerShadcnCommands(program, io) {
+    const shadcn = program
+        .command('shadcn')
+        .description('Dynamic wrapper for the upstream shadcn CLI (obtained via `npx --package`; no hard dependency).');
+    addJsonOption(shadcn
+        .command('init')
+        .description('Scaffold/init a shadcn/ui project by forwarding to upstream `shadcn init`.')
+        .requiredOption('--preset <code>', 'shadcn registry preset code (resolve it before scaffolding when unknown)')
+        .option('--template <name>', 'project template, e.g. vite or next')
+        .option('--project <path>', 'target project root', '.')
+        .option('--yes', 'forward --yes to upstream (skip its confirmation prompts)', false)).action((options) => {
+        const asJson = options.json === true;
+        const result = runShadcnInit({
+            cwd: options.project,
+            preset: options.preset,
+            ...(options.template !== undefined && options.template.length > 0 ? { template: options.template } : {}),
+            ...(options.yes === true ? { yes: true } : {})
+        });
+        if (result.state === 'ok') {
+            printResult(io, ok('shadcn.init', result, [], [
+                `Upstream argv: npx ${result.argv.join(' ')}`,
+                'Generated projects must be TypeScript-only (no JavaScript source or config files).'
+            ]), asJson);
+            return;
+        }
+        const code = result.state === 'shadcn-missing' ? 'SHADCN_UNAVAILABLE' : 'SHADCN_INIT_FAILED';
+        const message = result.state === 'shadcn-missing'
+            ? `could not resolve ${SHADCN_PACKAGE} via npx`
+            : `upstream shadcn init exited with code ${result.exitCode}`;
+        printResult(io, fail('shadcn.init', code, message, result, [
+            `Pinned package: ${SHADCN_PACKAGE}`,
+            'Ensure Node.js >= 20 with npm is on PATH and the network allows the npm registry.',
+            `Retry with: npx --package ${SHADCN_PACKAGE} -- shadcn init --preset <code>`
+        ]), asJson);
+        process.exitCode = 1;
+    });
+}

package/dist/cli/commands/slice-commands.js

@@ -134,7 +134,7 @@ export function registerSliceCommands(program, io) {
     addJsonOption(slice
         .command('decompose <rid>')
         .description('Run the 6-stage slice-decomposition algorithm on a PRD. ' +
-        'Inputs: PRD body + peaks codegraph + .understand-anything/knowledge-graph.json (optional). ' +
+        'Inputs: PRD body + peaks codegraph (project analysis is codegraph-first; structural import edges are the fallback). ' +
         'Outputs: .peaks/sc/slice-decomposition/<rid>.json with critical-path, ' +
         'parallel-batches, and per-slice work estimates. ' +
         'Algorithm is fzf-free. Replay vs hand-derived 2.1.0 dry-run: +-10% on p50. ' +
@@ -202,9 +202,6 @@ export function registerSliceCommands(program, io) {
                 `Next: peaks slice pick ${rid}  (requires fzf >= 0.38)`,
                 `Or manually craft -picked.json from the JSON output, then peaks slice plan ${rid}`
             ];
-            if (result.understandAnything.fallback === 'structural-only') {
-                nextActions.push('Note: understand-anything not indexed; cuts are structural-only. Run /understand in your IDE to improve semantic-cut quality.');
-            }
             if (result.pickHint) {
                 nextActions.push(result.pickHint);
             }

package/dist/services/audit/static-service.d.ts

@@ -5,7 +5,7 @@
  * integration entirely. The pre-Slice-3 implementation probed
  * `npx ecc-agentshield --version` and shelled out to
  * `npx ecc-agentshield scan --json --target <path>` on every audit
- * call, but the upstream `affaan-m/everything-claude-code` v2.0.0
+ * call, but the upstream `affaan-m/everything-claude-code` (now `affaan-m/ECC`) v2.0.0
  * release ships no `ecc-agentshield` binary — the repo is
  * `agents/*.md` flat files plus SKILL.md descriptors.
  *

package/dist/services/audit/static-service.js

@@ -5,7 +5,7 @@
  * integration entirely. The pre-Slice-3 implementation probed
  * `npx ecc-agentshield --version` and shelled out to
  * `npx ecc-agentshield scan --json --target <path>` on every audit
- * call, but the upstream `affaan-m/everything-claude-code` v2.0.0
+ * call, but the upstream `affaan-m/everything-claude-code` (now `affaan-m/ECC`) v2.0.0
  * release ships no `ecc-agentshield` binary — the repo is
  * `agents/*.md` flat files plus SKILL.md descriptors.
  *