peaks-loop 4.0.7 → 4.0.8

package/dist/cli/commands/sub-agent-exec-command.js

@@ -1,132 +0,0 @@
-/**
- * `peaks sub-agent exec` — slice 4.0.7-PR-meta-6.
- *
- * Companion to `peaks sub-agent dispatch` (slice 2026-06-07). The
- * dispatch CLI is dry-run by design (per skill-first / CLI-auxiliary
- * red line PB-4): it returns a `toolCall` envelope that the LLM
- * extracts args from and re-executes via the Agent tool. The 4.0.7
- * ice-cola dogfood pass surfaced the friction: the LLM often
- * skipped the dispatch altogether instead of paying the parse
- * cost, and routed `Edit` calls directly. PR-meta-4 lowered the
- * friction by adding `--emit-bash-script`, which prints a
- * ready-to-exec bash script alongside the JSON envelope. PR-meta-6
- * ships the actual surface the script invokes: this `exec`
- * sub-command reads the dispatch record from disk (the same
- * record the dispatch CLI wrote) and re-emits the canonical
- * toolCall envelope so the LLM does not have to hand-parse the
- * JSON to retry a dispatch.
- *
- * Architecture (PR-meta-6):
- *   1. The user (or the LLM via Bash tool) runs the script
- *      emitted by `peaks sub-agent dispatch --emit-bash-script`.
- *   2. The script invokes `peaks sub-agent exec --session-id ...
- *      --request-id ... --role ... --batch-id ... --dispatch-record ...
- *      --project ...`.
- *   3. `exec` reads the dispatch record from disk, re-emits the
- *      same toolCall envelope, and prints a single next-action
- *      line: "Run this Task tool call to dispatch."
- *
- * The dry-run architecture is preserved: the LLM still has the
- * final say on whether to actually spawn the Task tool. The
- * script + exec pair is a transparent retry path, not a side-step.
- */
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname } from 'node:path';
-import { addJsonOption, printResult } from '../cli-helpers.js';
-import { fail, ok } from 'peaks-loop-shared/result';
-function failExec(command, message, options, hint) {
-    printResult(undefined, // io is plumbed below
-    fail(command, 'SUB_AGENT_EXEC_FAILED', message, null, [hint]), options.json);
-    // The above `printResult` expects io — the real call site passes
-    // io explicitly. This helper is only used for type-level
-    // documentation; the actual printing is inline in the action.
-    throw new Error(message);
-}
-export function registerSubAgentExecCommand(parent, io) {
-    addJsonOption(parent
-        .command('exec')
-        .description('Slice 4.0.7-PR-meta-6. Re-emit a stored dispatch envelope. Companion to `peaks sub-agent dispatch --emit-bash-script`. Reads the dispatch record from `--dispatch-record` and prints the canonical toolCall envelope so the LLM does not have to hand-parse the JSON to retry. Dry-run: the LLM still owns the actual Agent tool invocation.')
-        .requiredOption('--session-id <sid>', 'session id the dispatch was created in')
-        .requiredOption('--request-id <rid>', 'request id the dispatch was created for')
-        .requiredOption('--role <role>', 'sub-agent role (rd | qa | ui | sc | txt | qa-business | qa-business-api)')
-        .requiredOption('--batch-id <uuid>', 'batch id the dispatch was created in')
-        .requiredOption('--dispatch-record <path>', 'path to the dispatch record JSON (the same file the dispatch CLI wrote under .peaks/_sub_agents/<sid>/)')
-        .requiredOption('--project <path>', 'target project root (echoed back in the envelope; not used to read files)')).action((options) => {
-        if (options.dispatchRecord === undefined || !existsSync(options.dispatchRecord)) {
-            printResult(io, fail('sub-agent.exec', 'DISPATCH_RECORD_MISSING', `Dispatch record not found at ${options.dispatchRecord ?? '(unset)'}`, null, [
-                'Re-run `peaks sub-agent dispatch <role> --prompt <text> --request-id <rid> --json` to create the record.',
-                'Then pass the emitted `dispatchRecordPath` to `peaks sub-agent exec --dispatch-record <path>`.'
-            ]), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        let record;
-        try {
-            record = JSON.parse(readFileSync(options.dispatchRecord, 'utf8'));
-        }
-        catch (err) {
-            printResult(io, fail('sub-agent.exec', 'DISPATCH_RECORD_INVALID', `Failed to parse dispatch record: ${err instanceof Error ? err.message : String(err)}`, { dispatchRecord: options.dispatchRecord }, [
-                'The dispatch record may be truncated. Re-run `peaks sub-agent dispatch` to create a fresh record.'
-            ]), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        if (record.toolCall === undefined) {
-            printResult(io, fail('sub-agent.exec', 'DISPATCH_RECORD_NO_TOOL_CALL', 'Dispatch record has no `toolCall` field. The record may be from a pre-toolCall era; re-run `peaks sub-agent dispatch` to create a fresh record.', { dispatchRecord: options.dispatchRecord }, [
-                'Re-run `peaks sub-agent dispatch` to create a fresh record with a `toolCall` envelope.'
-            ]), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        // Sanity check: the record's sessionId / rid / batchId / role
-        // should match the CLI flags (if the caller passed them). This
-        // is defensive: a mismatch usually means the operator is
-        // running the wrong script. We surface a warning but still
-        // re-emit the envelope (do not block — the dispatch record
-        // is the canonical source of truth).
-        const warnings = [];
-        if (options.sessionId !== undefined && record.sessionId !== undefined && record.sessionId !== options.sessionId) {
-            warnings.push(`session-id mismatch: record=${record.sessionId} vs --session-id=${options.sessionId}; using the record's value as the canonical source.`);
-        }
-        if (options.requestId !== undefined && record.rid !== undefined && record.rid !== options.requestId) {
-            warnings.push(`request-id mismatch: record=${record.rid} vs --request-id=${options.requestId}; using the record's value.`);
-        }
-        if (options.batchId !== undefined && record.batchId !== undefined && record.batchId !== options.batchId) {
-            warnings.push(`batch-id mismatch: record=${record.batchId} vs --batch-id=${options.batchId}; using the record's value.`);
-        }
-        if (options.role !== undefined && record.role !== undefined && record.role !== options.role) {
-            warnings.push(`role mismatch: record=${record.role} vs --role=${options.role}; using the record's value.`);
-        }
-        const nextActions = [
-            'This is a dry-run re-emit. Run the Task tool with the printed `toolCall.args` to actually dispatch the sub-agent.',
-            `After dispatching, the sub-agent should call \`peaks sub-agent heartbeat --record ${options.dispatchRecord}\` periodically.`
-        ];
-        // Re-emit the same envelope shape as `peaks sub-agent dispatch`
-        // so consumers (LLM or downstream tooling) can treat both CLIs
-        // as the same surface. Slice 4.0.7-PR-meta-6: the envelope
-        // version is bumped to 2.4.0 to mark the new `viaExec` field
-        // (true here; false in dispatch CLI output).
-        printResult(io, ok('sub-agent.exec', {
-            envelopeVersion: '2.4.0',
-            viaExec: true,
-            sourceDispatchRecord: options.dispatchRecord,
-            role: record.role ?? options.role,
-            sessionId: record.sessionId ?? options.sessionId,
-            rid: record.rid ?? options.requestId,
-            batchId: record.batchId ?? options.batchId,
-            promptSize: record.promptSize ?? 0,
-            originalPromptSize: record.originalPromptSize ?? 0,
-            toolCall: record.toolCall
-        }, warnings, nextActions), options.json);
-    });
-}
-// Helper export so tests can drive the underlying logic without
-// invoking the action handler. The action handler is the
-// integration path; the helper is the unit path.
-export function readDispatchRecordForExec(dispatchRecordPath) {
-    if (!existsSync(dispatchRecordPath)) {
-        throw new Error(`DISPATCH_RECORD_MISSING: ${dispatchRecordPath}`);
-    }
-    return JSON.parse(readFileSync(dispatchRecordPath, 'utf8'));
-}
-void dirname;

package/dist/services/standards/find-skills-integration.d.ts

@@ -1,59 +0,0 @@
-import type { ProjectContext } from './project-context.js';
-export interface SkillRecommendation {
-    /** GitHub owner/repo, e.g. "vercel-labs/agent-skills". */
-    readonly owner: string;
-    /** Skill slug within the repo, e.g. "react-best-practices". */
-    readonly skillSlug: string;
-    /** Display name (best-effort; may equal slug). */
-    readonly displayName: string;
-    /** Short description from the registry; empty when not parseable. */
-    readonly description: string;
-    /** Install count from the registry listing; null when unparseable. */
-    readonly installCount: number | null;
-    /** The shell command the user can paste to install this skill. */
-    readonly installCommand: string;
-}
-export interface FindSkillsResult {
-    readonly recommendations: readonly SkillRecommendation[];
-    /** Queries that found zero candidates (operator-visible). */
-    readonly emptyQueries: readonly string[];
-    /** `npx skills find` runs that failed (network / registry); non-fatal. */
-    readonly failedRuns: readonly {
-        readonly query: string;
-        readonly reason: string;
-    }[];
-}
-/**
- * Map a ProjectContext to a small query set. Returns at most 8
- * queries to keep the network surface bounded; ordering is
- * best-to-worst (more specific first, then broad). Deliberately
- * no hardcoded owner whitelist — `findSkillsForContext` runs
- * `npx skills find <query>` with no `--owner` filter so the
- * registry / leaderboard surfaces whatever the user might want
- * (per find-skills SKILL.md Step 2-3 guidance).
- */
-export declare function queriesForContext(ctx: ProjectContext): readonly string[];
-/**
- * Spawn runner injection point. The default spawns
- * `npx skills find <query>` (no `--owner` filter, so the registry
- * decides what surfaces). Tests pass a deterministic stub.
- */
-export type SkillFindRunner = (query: string) => Promise<string>;
-export declare const defaultSkillFindRunner: SkillFindRunner;
-/**
- * Parse a `npx skills find` stdout blob into SkillRecommendation rows.
- * The CLI output is line-oriented; a row looks like
- *   <owner>/<repo>@<slug>   <install-count>   <description>
- * The parser is lenient — any line that contains a
- * `<owner>/<repo>@<slug>` triple is captured.
- */
-export declare function parseFindOutput(stdout: string): readonly SkillRecommendation[];
-/**
- * Main entry: query the registry for each query, dedup, sort by
- * install-count desc (the registry's leaderboard already orders by
- * popularity; we keep the same ordering). Returns top-N rows.
- */
-export declare function findSkillsForContext(ctx: ProjectContext, options?: {
-    readonly topN?: number;
-    readonly findRunner?: SkillFindRunner;
-}): Promise<FindSkillsResult>;

package/dist/services/standards/find-skills-integration.js

@@ -1,225 +0,0 @@
-/**
- * Slice 4.0.7-PR-12 (ice-cola surface probe 2026-08-02).
- *
- * After `peaks standards init` / `peaks standards update` materializes
- * the project-local standards tree, the user often wants to also
- * bring in matching skills from the open agent-skills ecosystem
- * (https://skills.sh/). A TypeScript monorepo with React + NestJS +
- * Tailwind + Playwright + pnpm has natural companions in
- * vercel-labs/agent-skills, anthropics/skills, and similar curated
- * collections.
- *
- * Slice 4.0.7 dogfood round 2 (user direction 2026-08-02): do NOT
- * hardcode a `VERIFIED_SKILL_OWNERS` whitelist. The first version
- * shipped a static list of "trusted" owners, but that is exactly
- * what the find-skills skill tells users NOT to do — let the
- * registry + leaderboard decide. This service now:
- *   1. maps the detected ProjectContext to a small set of natural
- *      language queries (component library, build tool, language).
- *   2. runs `npx skills find <query>` ONCE per query with no
- *      `--owner` filter, so the registry returns whatever the
- *      leaderboard surfaces (vercel-labs/agent-skills at the top
- *      for "react" is a registry result, not a hardcoded one).
- *   3. parses + dedups + ranks by install count desc (the
- *      registry / leaderboard already orders by popularity).
- *   4. emits a `SkillRecommendation` list with `install` command.
- *
- * **Hard rule (per peaks-loop external-references):** this service
- * NEVER calls `npx skills add` itself. Installation is gated on the
- * user passing `--suggest-skills` to `peaks standards init/update`,
- * and the install command is emitted as a single shell snippet the
- * user can review before pasting. Default behavior: recommendation
- * only, no install. The CLI caller owns the gating.
- *
- * Pure: no I/O of the project tree; only `npx skills find` calls
- * (which are external side effects that we treat as testable via a
- * `skillFindRunner` injection).
- */
-import { spawn } from 'node:child_process';
-/**
- * Map a ProjectContext to a small query set. Returns at most 8
- * queries to keep the network surface bounded; ordering is
- * best-to-worst (more specific first, then broad). Deliberately
- * no hardcoded owner whitelist — `findSkillsForContext` runs
- * `npx skills find <query>` with no `--owner` filter so the
- * registry / leaderboard surfaces whatever the user might want
- * (per find-skills SKILL.md Step 2-3 guidance).
- */
-export function queriesForContext(ctx) {
-    const queries = [];
-    // Component library first (most specific)
-    if (ctx.componentLibrary.name === 'antd')
-        queries.push('antd', 'react');
-    else if (ctx.componentLibrary.name === 'antd-pro')
-        queries.push('antd-pro', 'react', 'pro-components');
-    else if (ctx.componentLibrary.name === 'mui')
-        queries.push('mui', 'react');
-    else if (ctx.componentLibrary.name === 'shadcn')
-        queries.push('shadcn', 'react', 'tailwind');
-    else if (ctx.componentLibrary.name === 'arco')
-        queries.push('arco', 'react');
-    else if (ctx.componentLibrary.name === 'tdesign')
-        queries.push('tdesign', 'react');
-    else if (ctx.componentLibrary.name === 'element-plus')
-        queries.push('element-plus', 'vue');
-    else if (ctx.componentLibrary.name === 'vant')
-        queries.push('vant', 'mobile');
-    // Build tool
-    if (ctx.buildTool === 'next')
-        queries.push('nextjs', 'react');
-    else if (ctx.buildTool === 'vite')
-        queries.push('vite', 'frontend');
-    else if (ctx.buildTool === 'umi')
-        queries.push('umi');
-    else if (ctx.buildTool === 'rsbuild')
-        queries.push('rsbuild', 'rspack');
-    else if (ctx.buildTool === 'rspack')
-        queries.push('rspack');
-    // CSS framework
-    if (ctx.cssFrameworks.includes('tailwind'))
-        queries.push('tailwind');
-    if (ctx.cssFrameworks.includes('less'))
-        queries.push('less');
-    // Domain hints
-    for (const dep of ctx.notableDeps) {
-        if (dep.startsWith('@nestjs/'))
-            queries.push('nestjs');
-        if (dep === 'playwright' || dep === '@playwright/test')
-            queries.push('playwright', 'e2e');
-        if (dep === 'vitest')
-            queries.push('vitest', 'testing');
-        if (dep === 'prisma')
-            queries.push('prisma');
-        if (dep === 'drizzle-orm')
-            queries.push('drizzle');
-        if (dep === 'graphql' || dep === '@apollo/client')
-            queries.push('graphql');
-    }
-    // Always include the language + the platform itself
-    queries.push(ctx.hasPackageJson ? 'typescript' : 'javascript');
-    // Dedup while preserving order, then cap at 12 to bound the
-    // network surface (each query fans out to the registry). 12
-    // keeps both "specific" (antd, react, nestjs) and "broad"
-    // (typescript / javascript) queries in the same list.
-    const seen = new Set();
-    const deduped = queries.filter((q) => (seen.has(q) ? false : (seen.add(q), true)));
-    return deduped.slice(0, 12);
-}
-export const defaultSkillFindRunner = (query) => new Promise((resolveText, reject) => {
-    // No `--owner` flag: the registry's leaderboard decides the
-    // ranking. We do NOT hardcode a "verified owners" whitelist —
-    // that is exactly the anti-pattern the find-skills SKILL.md
-    // warns against (Step 4: verify install count + source
-    // reputation, but trust the leaderboard first).
-    const child = spawn('npx', ['skills', 'find', query], {
-        stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let stdout = '';
-    let stderr = '';
-    child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
-    child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
-    child.on('error', reject);
-    child.on('close', (code) => {
-        if (code === 0)
-            resolveText(stdout);
-        else
-            reject(new Error(`npx skills find exited ${code}: ${stderr.slice(0, 200)}`));
-    });
-});
-/**
- * Parse a `npx skills find` stdout blob into SkillRecommendation rows.
- * The CLI output is line-oriented; a row looks like
- *   <owner>/<repo>@<slug>   <install-count>   <description>
- * The parser is lenient — any line that contains a
- * `<owner>/<repo>@<slug>` triple is captured.
- */
-export function parseFindOutput(stdout) {
-    const lines = stdout.split('\n');
-    const rows = [];
-    const rowRe = /([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)@([A-Za-z0-9_.-]+)/;
-    for (const line of lines) {
-        const m = line.match(rowRe);
-        if (!m || m[1] === undefined || m[2] === undefined || m[3] === undefined)
-            continue;
-        const rowOwner = m[1];
-        const repoName = m[2];
-        const skillSlug = m[3];
-        // Parse install count if the line has a number with K/M suffix.
-        let installCount = null;
-        const countMatch = line.match(/(\d+(?:\.\d+)?)\s*([KkMm]?)\b/);
-        if (countMatch && countMatch[1] !== undefined) {
-            const base = parseFloat(countMatch[1]);
-            const suffix = (countMatch[2] ?? '').toUpperCase();
-            if (!Number.isNaN(base)) {
-                installCount = suffix === 'K' ? base * 1_000 : suffix === 'M' ? base * 1_000_000 : base;
-            }
-        }
-        const desc = line.replace(rowRe, '').trim();
-        const fullSlug = `${rowOwner}/${repoName}@${skillSlug}`;
-        rows.push({
-            owner: rowOwner,
-            skillSlug,
-            displayName: skillSlug,
-            description: desc,
-            installCount,
-            installCommand: `npx skills add ${fullSlug} -g -y`,
-        });
-    }
-    return rows;
-}
-/**
- * Main entry: query the registry for each query, dedup, sort by
- * install-count desc (the registry's leaderboard already orders by
- * popularity; we keep the same ordering). Returns top-N rows.
- */
-export async function findSkillsForContext(ctx, options = {}) {
-    const topN = options.topN ?? 8;
-    const findRunner = options.findRunner ?? defaultSkillFindRunner;
-    const queries = queriesForContext(ctx);
-    const seen = new Set();
-    const all = [];
-    const emptyQueries = [];
-    const failedRuns = [];
-    for (const query of queries) {
-        try {
-            const stdout = await findRunner(query);
-            const rows = parseFindOutput(stdout);
-            if (rows.length === 0) {
-                emptyQueries.push(query);
-                continue;
-            }
-            for (const r of rows) {
-                const key = `${r.owner}/${r.skillSlug}`;
-                if (seen.has(key))
-                    continue;
-                seen.add(key);
-                all.push(r);
-            }
-        }
-        catch (err) {
-            failedRuns.push({
-                query,
-                reason: err instanceof Error ? err.message : String(err),
-            });
-        }
-    }
-    // Sort by install count desc (registry leaderboard is already
-    // ordered by popularity; we keep the same order so the user sees
-    // the same top results they would see in `npx skills find`).
-    // Tiebreaker: display name asc.
-    all.sort((a, b) => {
-        if (a.installCount !== null && b.installCount !== null && a.installCount !== b.installCount) {
-            return b.installCount - a.installCount;
-        }
-        if (a.installCount === null && b.installCount !== null)
-            return 1;
-        if (a.installCount !== null && b.installCount === null)
-            return -1;
-        return a.displayName.localeCompare(b.displayName);
-    });
-    return {
-        recommendations: all.slice(0, topN),
-        emptyQueries,
-        failedRuns,
-    };
-}