peaks-loop 4.1.2 → 4.1.4

package/dist/cli/commands/audit-goal-runners.js

@@ -0,0 +1,114 @@
+/**
+ * `peaks audit goal` runner — the peaks-audit entry gate.
+ *
+ * The action body moved out of `audit-commands.ts` verbatim; the registrar now
+ * only wires the command and delegates. This is the one action whose delegate
+ * returns a promise, so the runner stays `async` (it awaits `auditGoal()`).
+ *
+ * `anthropic` is the default and reads the session's own environment
+ * (see `resolveAnthropicConfig`). `stub` stays for CI/tests but is
+ * reported as a scaffold, and a missing credential fails loudly — a silent
+ * fall back to the scaffold envelope would leave the gate exactly as fake
+ * as it was before this slice.
+ */
+import { fail, ok } from 'peaks-loop-shared/result';
+import { auditGoal, IncompleteAuditError } from '../../services/audit/audit-goal-service.js';
+import { createAnthropicRunner, LlmBindingError, LlmRequestError, resolveAnthropicConfig } from '../../services/llm/anthropic-runner.js';
+import { createStubRunner } from '../../services/llm/stub-runner.js';
+import { getErrorMessage, printResult } from '../cli-helpers.js';
+import { DEFAULT_LLM_PROVIDER, isSupportedLlmProvider, PROJECT_PATH_HINT, SUPPORTED_LLM_PROVIDERS, validateProjectRoot } from './audit-command-shared.js';
+import { auditGoalFailureData } from './audit-refusal-data.js';
+export const AUDIT_GOAL_DESCRIPTION = 'Audit a human need across 6 dimensions and propose a goal (peaks-audit primitive)';
+/** The slice-owned error codes are carried verbatim so callers can gate on them. */
+function auditGoalErrorCode(error) {
+    if (error instanceof IncompleteAuditError ||
+        error instanceof LlmBindingError ||
+        error instanceof LlmRequestError) {
+        return error.code;
+    }
+    return 'AUDIT_GOAL_FAILED';
+}
+function auditGoalNextActions(code) {
+    switch (code) {
+        case 'LLM_CREDENTIAL_MISSING':
+            return [
+                'Export ANTHROPIC_AUTH_TOKEN (or ANTHROPIC_API_KEY) in the environment that launches peaks, then re-run.',
+                'For an offline scaffold instead of an audit, re-run with `--llm-provider stub` — it performs NO audit.'
+            ];
+        case 'LLM_MODEL_MISSING':
+            return [
+                'Export ANTHROPIC_MODEL (or CLAUDE_CODE_SUBAGENT_MODEL) in the environment that launches peaks, then re-run.'
+            ];
+        case 'INCOMPLETE_AUDIT':
+            return [
+                'The LLM reply omitted a required dimension; re-run so autonomous work never proceeds on a partial audit.'
+            ];
+        default:
+            return ['Inspect the failure above, then re-run with the same --need.'];
+    }
+}
+function unsupportedProviderEnvelope(options, projectRoot, provider) {
+    return fail('audit.goal', 'LLM_PROVIDER_NOT_IMPLEMENTED', `LLM provider "${provider}" is not implemented. Supported providers: ${SUPPORTED_LLM_PROVIDERS.join(', ')}.`, auditGoalFailureData(options.need, projectRoot), [
+        `Re-run with \`--llm-provider ${DEFAULT_LLM_PROVIDER}\` for a real audit, or \`--llm-provider stub\` for an offline scaffold.`
+    ]);
+}
+/** Bind the provider, run the audit, and print the success envelope. */
+async function runBoundAudit(options, projectRoot, isStub, io) {
+    const providerBinding = isStub
+        ? 'stub'
+        : 'anthropic-messages-api';
+    let model;
+    let llmRunner;
+    if (isStub) {
+        llmRunner = createStubRunner();
+    }
+    else {
+        const config = resolveAnthropicConfig();
+        model = config.model;
+        llmRunner = createAnthropicRunner(config);
+    }
+    const result = await auditGoal({ need: options.need }, llmRunner);
+    const data = {
+        status: isStub ? 'scaffold-only' : 'audit-complete',
+        providerBinding,
+        need: options.need,
+        projectRoot,
+        result,
+        ...(model === undefined ? {} : { model })
+    };
+    const envelope = ok('audit.goal', data, [], isStub
+        ? [
+            `Stub provider: the 6 dimensions below are placeholders, not findings. Re-run with \`--llm-provider ${DEFAULT_LLM_PROVIDER}\` for a real audit.`
+        ]
+        : [`Audit produced by ${providerBinding}${model === undefined ? '' : ` (model: ${model})`}.`]);
+    printResult(io, envelope, options.json);
+}
+function goalErrorEnvelope(options, projectRoot, isStub, error) {
+    const code = auditGoalErrorCode(error);
+    const providerBinding = isStub
+        ? 'stub'
+        : 'anthropic-messages-api';
+    return fail('audit.goal', code, getErrorMessage(error), auditGoalFailureData(options.need, projectRoot, providerBinding, error instanceof LlmBindingError ? error.missingEnv : undefined), auditGoalNextActions(code));
+}
+export async function runAuditGoal(options, io) {
+    const validation = validateProjectRoot(options.project);
+    if (!validation.ok) {
+        printResult(io, fail('audit.goal', validation.code, validation.message, auditGoalFailureData(options.need, options.project), [PROJECT_PATH_HINT]), options.json);
+        process.exitCode = 1;
+        return;
+    }
+    const provider = options.llmProvider ?? DEFAULT_LLM_PROVIDER;
+    if (!isSupportedLlmProvider(provider)) {
+        printResult(io, unsupportedProviderEnvelope(options, validation.projectRoot, provider), options.json);
+        process.exitCode = 1;
+        return;
+    }
+    const isStub = provider === 'stub';
+    try {
+        await runBoundAudit(options, validation.projectRoot, isStub, io);
+    }
+    catch (error) {
+        printResult(io, goalErrorEnvelope(options, validation.projectRoot, isStub, error), options.json);
+        process.exitCode = 1;
+    }
+}

package/dist/cli/commands/audit-red-lines-runners.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `peaks audit red-lines` runner — Slice L2.1.
+ *
+ * The action body moved out of `audit-commands.ts` verbatim; the registrar now
+ * only wires the command and delegates. Every envelope, error code and hint
+ * string is unchanged.
+ */
+import { type ProgramIO } from '../cli-helpers.js';
+import { type RedLinesOptions } from './audit-command-shared.js';
+export declare const RED_LINES_DESCRIPTION = "Scan skills/, .claude/rules/, and openspec/changes/ for MANDATORY / BLOCKING / MUST NOT / RED LINE markers; classify each as cli-backed / partial / prose-only";
+export declare function runRedLines(options: RedLinesOptions, io: ProgramIO): void;

package/dist/cli/commands/audit-red-lines-runners.js

@@ -0,0 +1,43 @@
+/**
+ * `peaks audit red-lines` runner — Slice L2.1.
+ *
+ * The action body moved out of `audit-commands.ts` verbatim; the registrar now
+ * only wires the command and delegates. Every envelope, error code and hint
+ * string is unchanged.
+ */
+import { fail, ok } from 'peaks-loop-shared/result';
+import { runRedLinesAudit } from '../../services/audit/red-lines-service.js';
+import { getErrorMessage, printResult } from '../cli-helpers.js';
+import { PROJECT_PATH_HINT, SCANNER_HINT, validateProjectRoot } from './audit-command-shared.js';
+import { emptyRedLineAudit } from './audit-refusal-data.js';
+export const RED_LINES_DESCRIPTION = 'Scan skills/, .claude/rules/, and openspec/changes/ for MANDATORY / BLOCKING / MUST NOT / RED LINE markers; classify each as cli-backed / partial / prose-only';
+function redLinesNextActions(audit) {
+    const nextActions = [];
+    if (audit.proseOnly > 0) {
+        nextActions.push(`${audit.proseOnly} prose-only red lines remain. Plan P1/P2 enforcers in L2.2-L2.4.`);
+    }
+    if (audit.cliBacked > 0) {
+        nextActions.push(`${audit.cliBacked} red lines are now cli-backed. Re-run after each enforcer lands to track the prose-only ratio.`);
+    }
+    return nextActions;
+}
+function redLinesFailureEnvelope(code, message, nextAction) {
+    return fail('audit.red-lines', code, message, emptyRedLineAudit(), [nextAction]);
+}
+export function runRedLines(options, io) {
+    const validation = validateProjectRoot(options.project);
+    if (!validation.ok) {
+        printResult(io, redLinesFailureEnvelope(validation.code, validation.message, PROJECT_PATH_HINT), options.json);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const result = runRedLinesAudit({ projectRoot: validation.projectRoot });
+        const envelope = ok('audit.red-lines', result.audit, result.warnings.map((w) => `${w.file}: ${w.message}`), redLinesNextActions(result.audit));
+        printResult(io, envelope, options.json);
+    }
+    catch (error) {
+        printResult(io, redLinesFailureEnvelope('SCANNER_FAILED', getErrorMessage(error), SCANNER_HINT), options.json);
+        process.exitCode = 1;
+    }
+}

package/dist/cli/commands/audit-refusal-data.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The empty/failure `data` payloads the `peaks audit *` runners attach to a
+ * refusal envelope.
+ *
+ * Kept in one module so each runner reads as control flow: every literal here
+ * is byte-identical to the inline object it replaced, and every builder is a
+ * pure function of its arguments (no module-level mutable state).
+ */
+import type { ArtifactKind, ArtifactWriteRecord } from '../../services/audit/artifact-writer.js';
+import type { ProseRatioResult } from '../../services/audit/prose-ratio-calculator.js';
+import type { RedLineAudit } from '../../services/audit/types.js';
+import type { AuditGoalData, StaticAuditData } from './audit-command-shared.js';
+/** A zeroed scan result, as `peaks audit red-lines` prints it on a refusal. */
+export declare function emptyRedLineAudit(): RedLineAudit;
+export declare function emptyStaticAuditData(): StaticAuditData;
+export declare function emptyProseRatioResult(): ProseRatioResult;
+/**
+ * A write record with no file behind it. `kind` is carried through because the
+ * `INVALID_KIND` and `INPUT_NOT_FOUND` refusals name a caller-supplied kind;
+ * the `--project` refusal holds the neutral `narrative`.
+ */
+export declare function emptyArtifactWriteRecord(kind: ArtifactKind): ArtifactWriteRecord;
+export declare function auditGoalFailureData(need: string, projectRoot: string, providerBinding?: AuditGoalData['providerBinding'], missingEnv?: readonly string[]): AuditGoalData;

package/dist/cli/commands/audit-refusal-data.js

@@ -0,0 +1,69 @@
+/**
+ * The empty/failure `data` payloads the `peaks audit *` runners attach to a
+ * refusal envelope.
+ *
+ * Kept in one module so each runner reads as control flow: every literal here
+ * is byte-identical to the inline object it replaced, and every builder is a
+ * pure function of its arguments (no module-level mutable state).
+ */
+/** A zeroed scan result, as `peaks audit red-lines` prints it on a refusal. */
+export function emptyRedLineAudit() {
+    return {
+        totalRedLines: 0,
+        cliBacked: 0,
+        partial: 0,
+        proseOnly: 0,
+        audit: [],
+        enforcerFindings: []
+    };
+}
+export function emptyStaticAuditData() {
+    return {
+        audit: emptyRedLineAudit(),
+        agentShield: {
+            spawned: false,
+            installed: false,
+            reason: 'flag-disabled',
+            findings: []
+        }
+    };
+}
+export function emptyProseRatioResult() {
+    return {
+        totalRedLines: 0,
+        cliBacked: 0,
+        partial: 0,
+        proseOnly: 0,
+        discoveredProseOnly: 0,
+        informational: 0,
+        ratio: 0,
+        target: 0.05,
+        exceeds: false
+    };
+}
+/**
+ * A write record with no file behind it. `kind` is carried through because the
+ * `INVALID_KIND` and `INPUT_NOT_FOUND` refusals name a caller-supplied kind;
+ * the `--project` refusal holds the neutral `narrative`.
+ */
+export function emptyArtifactWriteRecord(kind) {
+    return {
+        kind,
+        slug: '',
+        title: '',
+        date: '',
+        filePath: '',
+        memoryDir: '',
+        indexPath: '',
+        indexSynced: false
+    };
+}
+export function auditGoalFailureData(need, projectRoot, providerBinding = 'unresolved', missingEnv) {
+    return {
+        status: 'audit-failed',
+        providerBinding,
+        need,
+        projectRoot,
+        ...(missingEnv === undefined ? {} : { missingEnv })
+    };
+}

package/dist/cli/commands/audit-static-runners.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `peaks audit static` and `peaks audit prose-ratio` runners.
+ *
+ * The two action bodies moved out of `audit-commands.ts` verbatim; the
+ * registrar now only wires the commands and delegates. Every envelope, error
+ * code and hint string is unchanged.
+ */
+import { type ProgramIO } from '../cli-helpers.js';
+import { type ProseRatioOptions, type StaticAuditOptions } from './audit-command-shared.js';
+export declare const STATIC_AUDIT_DESCRIPTION = "Run the static audit (peaks-loop lint only; the ECC AgentShield subprocess was removed in 4.0.0-beta.11). Per spec \u00A75.3.";
+export declare const PROSE_RATIO_DESCRIPTION = "Compute the prose-only ratio (informational entries excluded). Exits 1 if ratio > target (default 5%).";
+export declare function runStaticAuditCommand(options: StaticAuditOptions, io: ProgramIO): void;
+export declare function runProseRatio(options: ProseRatioOptions, io: ProgramIO): void;

package/dist/cli/commands/audit-static-runners.js

@@ -0,0 +1,139 @@
+/**
+ * `peaks audit static` and `peaks audit prose-ratio` runners.
+ *
+ * The two action bodies moved out of `audit-commands.ts` verbatim; the
+ * registrar now only wires the commands and delegates. Every envelope, error
+ * code and hint string is unchanged.
+ */
+import { fail, ok } from 'peaks-loop-shared/result';
+import { runStaticAudit } from '../../services/audit/static-service.js';
+import { writeAuditDecision } from '../../services/audit/decision-writer.js';
+import { computeProseRatio } from '../../services/audit/prose-ratio-calculator.js';
+import { getErrorMessage, printResult } from '../cli-helpers.js';
+import { PROJECT_PATH_HINT, SCANNER_HINT, validateProjectRoot } from './audit-command-shared.js';
+import { emptyProseRatioResult, emptyStaticAuditData } from './audit-refusal-data.js';
+export const STATIC_AUDIT_DESCRIPTION = 'Run the static audit (peaks-loop lint only; the ECC AgentShield subprocess was removed in 4.0.0-beta.11). Per spec §5.3.';
+export const PROSE_RATIO_DESCRIPTION = 'Compute the prose-only ratio (informational entries excluded). Exits 1 if ratio > target (default 5%).';
+const RID_REQUIRES_RECORD_MESSAGE = '`--rid` requires `--record` (decision slug disambiguator has no effect without persistence)';
+const RID_REQUIRES_RECORD_HINT = 'Pass `--record` together with `--rid <id>`, or omit `--rid`';
+/**
+ * Persist the decision record when `--record` is set. The writer is idempotent
+ * at the slug level (same date+rid → same file); repeated runs overwrite.
+ * Failures here are surfaced as warnings so the primary audit JSON still
+ * reaches the caller.
+ */
+function persistDecisionRecord(audit, projectRoot, rid) {
+    try {
+        return {
+            decision: writeAuditDecision(audit, {
+                projectRoot,
+                ...(rid ? { rid } : {})
+            })
+        };
+    }
+    catch (writeError) {
+        return { warning: `Failed to write decision record: ${getErrorMessage(writeError)}` };
+    }
+}
+function staticNextActions(decision) {
+    const nextActions = [];
+    // nextActions block was removed. `agentShield.installed` is a frozen
+    // `false`, so the block printed on every run and pointed users at a
+    // removed subprocess, removed flags, and a dead preference.
+    if (decision) {
+        nextActions.push(`Decision record written: ${decision.filePath}`);
+        nextActions.push(`Index synced: ${decision.indexSynced ? 'yes' : 'no'} (memory hot.decision[] now includes this audit)`);
+    }
+    return nextActions;
+}
+function staticFailureEnvelope(code, message, nextAction) {
+    return fail('audit.static', code, message, emptyStaticAuditData(), [nextAction]);
+}
+/**
+ * The `--project` / `--rid` preflight. Returns the validated project root, or
+ * prints the refusal (and sets the exit code) and returns `undefined`.
+ *
+ * Slice K1: `--rid` is meaningful only with `--record`. Surface a 422
+ * when the user passes `--rid` without `--record` so the CLI fails
+ * loudly rather than silently ignoring the request id.
+ */
+function resolveStaticProjectRoot(options, io) {
+    const validation = validateProjectRoot(options.project);
+    if (!validation.ok) {
+        printResult(io, staticFailureEnvelope(validation.code, validation.message, PROJECT_PATH_HINT), options.json);
+        process.exitCode = 1;
+        return undefined;
+    }
+    if (options.rid && !options.record) {
+        printResult(io, staticFailureEnvelope('FLAGS_CONFLICT', RID_REQUIRES_RECORD_MESSAGE, RID_REQUIRES_RECORD_HINT), options.json);
+        process.exitCode = 1;
+        return undefined;
+    }
+    return validation.projectRoot;
+}
+export function runStaticAuditCommand(options, io) {
+    const projectRoot = resolveStaticProjectRoot(options, io);
+    if (projectRoot === undefined) {
+        return;
+    }
+    try {
+        const result = runStaticAudit({ projectRoot });
+        const persisted = options.record
+            ? persistDecisionRecord(result.audit, projectRoot, options.rid)
+            : {};
+        const data = {
+            audit: result.audit,
+            agentShield: result.agentShield,
+            ...(persisted.decision ? { decision: persisted.decision } : {})
+        };
+        const warnings = [...result.warnings];
+        if (persisted.warning) {
+            warnings.push(persisted.warning);
+        }
+        const envelope = ok('audit.static', data, warnings, staticNextActions(persisted.decision));
+        printResult(io, envelope, options.json);
+    }
+    catch (error) {
+        printResult(io, staticFailureEnvelope('SCANNER_FAILED', getErrorMessage(error), SCANNER_HINT), options.json);
+        process.exitCode = 1;
+    }
+}
+function proseRatioNextActions(ratio) {
+    return [
+        ratio.exceeds
+            ? `Prose-only ratio ${(ratio.ratio * 100).toFixed(2)}% exceeds target ${(ratio.target * 100).toFixed(2)}% (${ratio.proseOnly}/${ratio.totalRedLines})`
+            : `Prose-only ratio ${(ratio.ratio * 100).toFixed(2)}% within target ${(ratio.target * 100).toFixed(2)}% (${ratio.proseOnly}/${ratio.totalRedLines})`
+    ];
+}
+function proseRatioFailureEnvelope(code, message, nextAction) {
+    return fail('audit.prose-ratio', code, message, emptyProseRatioResult(), [
+        nextAction
+    ]);
+}
+export function runProseRatio(options, io) {
+    const validation = validateProjectRoot(options.project);
+    if (!validation.ok) {
+        printResult(io, proseRatioFailureEnvelope(validation.code, validation.message, PROJECT_PATH_HINT), options.json);
+        process.exitCode = 1;
+        return;
+    }
+    const target = Number.parseFloat(options.target);
+    if (!Number.isFinite(target) || target < 0 || target > 1) {
+        printResult(io, proseRatioFailureEnvelope('INVALID_TARGET', `--target must be a number between 0 and 1 (got "${options.target}")`, 'Pass --target 0.05 (default) or another number in [0, 1]'), options.json);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const result = runStaticAudit({ projectRoot: validation.projectRoot });
+        const ratio = computeProseRatio(result.audit.audit, { target });
+        const envelope = ok('audit.prose-ratio', ratio, [], proseRatioNextActions(ratio));
+        printResult(io, envelope, options.json);
+        if (ratio.exceeds) {
+            process.exitCode = 1;
+        }
+    }
+    catch (error) {
+        printResult(io, proseRatioFailureEnvelope('SCANNER_FAILED', getErrorMessage(error), SCANNER_HINT), options.json);
+        process.exitCode = 1;
+    }
+}

package/dist/cli/commands/await-runners.d.ts

@@ -0,0 +1,11 @@
+import { type ProgramIO } from '../cli-helpers.js';
+import type { SubAgentDispatcher } from '../../services/dispatch/sub-agent-dispatcher-types.js';
+import { type AwaitOptions } from './sub-agent-shared.js';
+/** The per-IDE dispatcher resolution the await CLI needs, plus the id it named. */
+export interface AwaitIdeResolution {
+    readonly ide: string;
+    readonly dispatcher: SubAgentDispatcher;
+}
+/** Injected resolver so this module never imports the IDE registry itself. */
+export type ResolveIdeDispatcher = (projectRoot: string) => Promise<AwaitIdeResolution>;
+export declare function runAwait(options: AwaitOptions, io: ProgramIO, resolveIde: ResolveIdeDispatcher): Promise<void>;

package/dist/cli/commands/await-runners.js

@@ -0,0 +1,148 @@
+/**
+ * The `await` action body for `peaks sub-agent`, moved out of
+ * `share-commands.ts` so that registrar file stays under the line cap.
+ *
+ * The registrar keeps the command shape and delegates here. The per-IDE
+ * dispatcher is INJECTED (`resolveIde`) rather than imported: the module that
+ * consumes the IDE registry is `share-commands.ts`, which is the file the
+ * vendor-neutral identity guard measures — so this module never names the
+ * registry and never becomes a second consumer.
+ */
+import { fail, getErrorMessage, ok } from 'peaks-loop-shared/result';
+import { printResult } from '../cli-helpers.js';
+import { summarizeBatchResults } from './sub-agent-shared.js';
+import { awaitErrorNextActions } from './share-error-hints.js';
+import { resolveSessionId } from './share-identity.js';
+import { resolveBatchRecords } from './share-record-paths.js';
+export async function runAwait(options, io, resolveIde) {
+    const asJson = options.json === true;
+    if (!options.batch) {
+        printResult(io, fail('sub-agent.await', 'MISSING_BATCH', '--batch is required', { ok: false }, [
+            'Re-run with --batch <batchId> from a dispatch envelope.'
+        ]), asJson);
+        process.exitCode = 1;
+        return;
+    }
+    const parsed = parseAwaitTimeout(options.timeout, io, asJson);
+    if (!parsed.ok)
+        return;
+    const projectRoot = options.project ?? process.cwd();
+    const sid = resolveSessionId(options, projectRoot);
+    // Lazy-import IDE modules so `peaks sub-agent share` and
+    // `peaks sub-agent shared-read` (the high-frequency G8.4 path) do not
+    // pay for adapter resolution at module-load time.
+    const resolved = await resolveIde(projectRoot);
+    const awaitBatch = resolved.dispatcher.awaitBatch?.bind(resolved.dispatcher);
+    if (typeof awaitBatch !== 'function') {
+        reportIdeNotSupported(resolved.ide, io, asJson);
+        return;
+    }
+    await runAwaitBatch({
+        options,
+        io,
+        asJson,
+        projectRoot,
+        sessionId: sid,
+        batch: options.batch,
+        timeoutMs: parsed.timeoutMs,
+        label: resolved.dispatcher.label,
+        awaitBatch
+    });
+}
+/**
+ * Report a dispatcher with no `awaitBatch`. Every built-in adapter has one since
+ * slice 1.3, so this names a custom adapter registered outside the built-in set.
+ */
+function reportIdeNotSupported(ide, io, asJson) {
+    printResult(io, fail('sub-agent.await', 'IDE_NOT_SUPPORTED', `IDE ${ide} does not support awaitBatch`, { ok: false }, [
+        'Every built-in adapter has an awaitBatch since slice 1.3; a dispatcher without one is a custom adapter registered outside the built-in set.'
+    ]), asJson);
+    process.exitCode = 1;
+}
+/**
+ * Validate `--timeout`. Absent means "no cap"; anything present must be a
+ * positive integer. A rejected value prints `INVALID_TIMEOUT` and sets the
+ * non-zero exit code exactly where the original inline check did.
+ */
+function parseAwaitTimeout(raw, io, asJson) {
+    if (typeof raw === 'string' && raw.length > 0) {
+        const n = Number.parseInt(raw, 10);
+        if (!Number.isInteger(n) || n <= 0) {
+            printResult(io, fail('sub-agent.await', 'INVALID_TIMEOUT', `--timeout must be a positive integer ms (got ${raw})`, { ok: false }, ['Pass an integer like --timeout 60000.']), asJson);
+            process.exitCode = 1;
+            return { ok: false };
+        }
+        return { ok: true, timeoutMs: n };
+    }
+    return { ok: true, timeoutMs: undefined };
+}
+async function runAwaitBatch(input) {
+    try {
+        // session's dispatch directory. `recordPaths` used to be hardcoded to
+        // `[]`, and `awaitBatch` short-circuits on an empty list
+        // (await-batch.ts:134) — so `await` reported zero results and exited 0
+        // for every batch, forever. A batch we cannot locate is now a failure,
+        // not a success with nothing in it.
+        const { readRecord } = await import('../../services/dispatch/dispatch-record-writer.js');
+        const scan = resolveBatchRecords({
+            projectRoot: input.projectRoot,
+            sessionId: input.sessionId,
+            batchId: input.batch,
+            readOne: readRecord
+        });
+        if (scan.recordPaths.length === 0) {
+            reportNoDispatchRecords(scan, input);
+            return;
+        }
+        const batchInput = {
+            batchId: input.batch,
+            dispatchCount: scan.recordPaths.length,
+            recordPaths: scan.recordPaths,
+            ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {})
+        };
+        const results = await input.awaitBatch(batchInput);
+        printAwaitSuccess(results, scan, input);
+    }
+    catch (error) {
+        const code = error.code ?? 'AWAIT_ERROR';
+        printResult(input.io, fail('sub-agent.await', code, getErrorMessage(error), { ok: false }, [
+            awaitErrorNextActions(code)
+        ]), input.asJson);
+        process.exitCode = 1;
+    }
+}
+function reportNoDispatchRecords(scan, input) {
+    const unreadableNote = scan.unreadable.length > 0
+        ? ` ${scan.unreadable.length} dispatch record(s) there could not be read, so they could not be matched to this batch: ${scan.unreadable.join(', ')}`
+        : '';
+    printResult(input.io, fail('sub-agent.await', 'NO_DISPATCH_RECORDS', `No dispatch record with batchId=${input.batch} under ${scan.sessionDir}.${unreadableNote}`, {
+        ok: false,
+        batchId: input.batch,
+        sessionDir: scan.sessionDir,
+        unreadableRecords: scan.unreadable
+    }, [awaitErrorNextActions('NO_DISPATCH_RECORDS')]), input.asJson);
+    process.exitCode = 1;
+}
+function printAwaitSuccess(results, scan, input) {
+    const summary = summarizeBatchResults(results);
+    printResult(input.io, ok('sub-agent.await', {
+        envelopeVersion: '2.1.0',
+        batchId: input.batch,
+        ide: input.label,
+        results,
+        summary,
+        unreadableRecords: scan.unreadable
+    }, scan.unreadable.length > 0
+        ? [
+            `${scan.unreadable.length} unreadable dispatch record(s) in this session were skipped and are NOT part of the results: ${scan.unreadable.join(', ')}`
+        ]
+        : [], [
+        // four non-Claude IDEs would report `awaitByLlm: <ide> 1.2 fallback`,
+        // the slice-1.2 marker that slice 1.3 replaced with a real
+        // file-polling await. The text survived because nothing tested it —
+        // no adapter produces that note any more (asserted in
+        // sub-agent-dispatchers.test.ts), and the emitter that produced it,
+        // `awaitByLlmFallback`, has since been removed.
+        `Each non-claude-code IDE labels its own results (see the \`note\` field), so a timed-out slot is attributable to the adapter it came from.`
+    ]), input.asJson);
+}

package/dist/cli/commands/baseline-audit-command.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { ProgramIO } from '../cli-helpers.js';
+export declare function registerBaselineAuditCommand(baseline: Command, io: ProgramIO): void;

package/dist/cli/commands/baseline-audit-command.js

@@ -0,0 +1,64 @@
+// src/cli/commands/baseline-audit-command.ts
+//
+// `peaks baseline audit` — the independent-context capability scorer. Split
+// out of `baseline-commands.ts`; the scorer vocabulary, the guard summary the
+// audit is handed, the sessionless scope and the verdict rule are unchanged.
+import { readBaselineFile } from '../../services/capability-baseline/store.js';
+import { GUARD_CONTRACTS } from '../../services/capability-guard-runner/registry.js';
+import { runAllGuards } from '../../services/capability-guard-runner/runner.js';
+import { RUNTIME_SESSIONLESS_SCOPE } from '../../services/workspace/runtime-layout.js';
+import { DEFAULT_SCORER_MODE, fail, guardContext, isScorerMode, ok, SCORER_MODES } from './baseline-command-shared.js';
+async function runAudit(io, opts) {
+    const projectRoot = opts.project ?? '.';
+    if (!isScorerMode(opts.scorer)) {
+        fail(io, 'UNKNOWN_SCORER', `unknown scorer "${String(opts.scorer)}"; expected one of ${SCORER_MODES.join(', ')}`);
+        return;
+    }
+    const r = readBaselineFile(projectRoot);
+    if (!r.ok) {
+        fail(io, r.error.code, r.error.message);
+        return;
+    }
+    // The guard summary is the REAL aggregate of the 15 contracts. It used to
+    // be a literal `{pass:15,fail:0,skipped:0,total:15}` that no run produced.
+    const guardSummary = await runAllGuards(GUARD_CONTRACTS, guardContext(projectRoot));
+    // `live` is the deterministic independent checker: a real
+    // separate-context evaluation that needs no credentials, which is why it
+    // is the only kind that can run inside the secretless OIDC publish gate.
+    // It is handed the frozen rows and the registry, not just the guard
+    // summary — a scorer that only sees the guard result is a restatement.
+    //
+    // `sessionId` is the on-disk scope for the audit artifacts. This command
+    // has NO session — it is the credential-free scorer that runs inside the
+    // secretless OIDC publish gate — and it used to pass the literal `'cli'`,
+    // so every run wrote `.peaks/_runtime/cli/capability-audit/*.json` into
+    // the operator's real workspace. That directory is indistinguishable from
+    // a session dir whose id failed validation, so `peaks doctor`'s
+    // orphan-session check failed on it permanently. The reserved
+    // underscore-prefixed scope says "machinery, not a session" in the name.
+    const { runAudit: runIndependentAudit } = await import('../../services/capability-audit-service/runner.js');
+    const audit = await runIndependentAudit({
+        projectRoot,
+        sessionId: RUNTIME_SESSIONLESS_SCOPE,
+        journeyId: 'J01',
+        scorerMode: opts.scorer,
+        baselineRows: r.file.rows,
+        contracts: GUARD_CONTRACTS,
+        guardSummary
+    });
+    const data = audit;
+    if (audit.verdict === 'consistent' && !audit.degraded) {
+        ok(io, 'baseline.audit', data);
+        return;
+    }
+    fail(io, 'AUDIT_NOT_CONSISTENT', `capability audit verdict is "${audit.verdict}"${audit.degraded ? ' (degraded: stub scorer)' : ''}`, data);
+}
+export function registerBaselineAuditCommand(baseline, io) {
+    baseline
+        .command('audit')
+        .description('Run the capability audit (independent-context scorer). Exits non-zero unless the verdict is consistent.')
+        .option('--scorer <mode>', `Scorer to run: ${SCORER_MODES.join('|')}. 'live' (default) runs the deterministic independent checker, which needs no credentials; 'stub' performs no evaluation and can never be consistent.`, DEFAULT_SCORER_MODE)
+        .option('--project <path>', 'Project root', '.')
+        .option('--json', 'Emit JSON envelope')
+        .action((opts) => runAudit(io, opts));
+}