@boyingliu01/dsh-plugin-xp-gate 0.19.0

package/README.md

@@ -0,0 +1,25 @@
+# @boyingliu01/dsh-plugin-xp-gate
+
+XP-Gate deterministic quality gates + AI workflow skills as a **DeepSeek Harness (DSH)** native plugin.
+
+## Tools
+
+| Tool | Purpose |
+|------|---------|
+| `gate-check` | Run XP-Gate quality gates (`xp-gate check`) on a file or directory |
+| `gate-principles` | Run the 14 Clean Code/SOLID rules (`xp-gate principles`, Gate 4) |
+| `gate-arch` | Run architecture validation (`xp-gate arch`, Gate 6) |
+
+## Install
+
+```bash
+dsh plugin --profile <name> add @boyingliu01/dsh-plugin-xp-gate
+```
+
+The tools require a global `xp-gate` CLI:
+
+```bash
+npm install -g @boyingliu01/xp-gate
+```
+
+When `xp-gate` is missing the tools degrade gracefully (tool-missing → SKIP-style message) rather than erroring.

package/cordis.patch.yml

@@ -0,0 +1,7 @@
+# XP-Gate DSH bundle patch: mounts the xp-gate tool plugin into a dsh profile.
+# Applied as ONE insert over the empty profile root; reconciled by
+# `dsh plugin add @boyingliu01/dsh-plugin-xp-gate`.
+
+- insert:
+    - id: tool-xp-gate
+      name: '@boyingliu01/dsh-plugin-xp-gate'

package/lib/command.d.ts

@@ -0,0 +1,27 @@
+/** Shown when the global `xp-gate` CLI is not on PATH. */
+export declare const FALLBACK_MESSAGE = "[XP-Gate] xp-gate CLI not installed. Install it with: npm install -g @boyingliu01/xp-gate";
+/**
+ * Allowlist of xp-gate gate aliases that are safe to invoke standalone
+ * (non-preCommitOnly gates + common aliases). Anything outside this set is
+ * rejected before reaching the shell.
+ */
+export declare const GATE_WHITELIST: readonly ["duplicates", "complexity", "principles", "arch", "architecture", "iac", "secrets", "sast"];
+export type GateId = (typeof GATE_WHITELIST)[number];
+/** POSIX single-quote shell escaping: `'` becomes `'\''`. */
+export declare function shq(value: string): string;
+export declare function isGateAllowed(gate: string): boolean;
+export interface BuildCommandOptions {
+    subcommand: "check" | "principles" | "arch";
+    target?: string;
+    gates?: readonly string[];
+    config?: string;
+}
+/**
+ * Build a single guarded shell command: runs `xp-gate …` when the global CLI
+ * is present, otherwise prints the graceful-degradation hint. A single
+ * `if command -v` avoids a separate probe/run race.
+ */
+export declare function buildCommand(options: BuildCommandOptions): string;
+/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
+export declare function resolveTarget(rawPath: string, cwd: string): string;
+//# sourceMappingURL=command.d.ts.map

package/lib/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AAEA,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,8FACgE,CAAA;AAE7F;;;;GAIG;AACH,eAAO,MAAM,cAAc,uGASjB,CAAA;AAEV,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,6DAA6D;AAC7D,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,GAAG,YAAY,GAAG,MAAM,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAuBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAGjE;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/lib/command.js

@@ -0,0 +1,62 @@
+import { isAbsolute, resolve } from "node:path";
+/** Shown when the global `xp-gate` CLI is not on PATH. */
+export const FALLBACK_MESSAGE = "[XP-Gate] xp-gate CLI not installed. Install it with: npm install -g @boyingliu01/xp-gate";
+/**
+ * Allowlist of xp-gate gate aliases that are safe to invoke standalone
+ * (non-preCommitOnly gates + common aliases). Anything outside this set is
+ * rejected before reaching the shell.
+ */
+export const GATE_WHITELIST = [
+    "duplicates",
+    "complexity",
+    "principles",
+    "arch",
+    "architecture",
+    "iac",
+    "secrets",
+    "sast",
+];
+/** POSIX single-quote shell escaping: `'` becomes `'\''`. */
+export function shq(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+export function isGateAllowed(gate) {
+    return GATE_WHITELIST.includes(gate);
+}
+function buildInner(options) {
+    const { subcommand, target, gates, config } = options;
+    if (subcommand === "check") {
+        const tokens = ["xp-gate", "check"];
+        if (target !== undefined)
+            tokens.push(shq(target));
+        if (gates !== undefined && gates.length > 0) {
+            // Defense-in-depth: the JSON-schema enum already rejects unknown gate ids,
+            // but we also whitelist here so a non-whitelisted value can never reach the shell.
+            const allowed = gates.filter(isGateAllowed);
+            if (allowed.length > 0)
+                tokens.push("--gates", shq(allowed.join(",")));
+        }
+        return tokens.join(" ");
+    }
+    if (subcommand === "principles") {
+        const tokens = ["xp-gate", "principles"];
+        if (target !== undefined)
+            tokens.push(shq(target));
+        return tokens.join(" ");
+    }
+    return ["xp-gate", "arch", "--config", shq(config ?? "architecture.yaml")].join(" ");
+}
+/**
+ * Build a single guarded shell command: runs `xp-gate …` when the global CLI
+ * is present, otherwise prints the graceful-degradation hint. A single
+ * `if command -v` avoids a separate probe/run race.
+ */
+export function buildCommand(options) {
+    const inner = buildInner(options);
+    return `if command -v xp-gate >/dev/null 2>&1; then ${inner}; else printf '%s\\n' ${shq(FALLBACK_MESSAGE)}; fi`;
+}
+/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
+export function resolveTarget(rawPath, cwd) {
+    return isAbsolute(rawPath) ? rawPath : resolve(cwd, rawPath);
+}
+//# sourceMappingURL=command.js.map

package/lib/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE/C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2FAA2F,CAAA;AAE7F;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,MAAM;IACN,cAAc;IACd,KAAK;IACL,SAAS;IACT,MAAM;CACE,CAAA;AAIV,6DAA6D;AAC7D,MAAM,UAAU,GAAG,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAQ,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7D,CAAC;AASD,SAAS,UAAU,CAAC,OAA4B;IAC9C,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACrD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACnC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,2EAA2E;YAC3E,mFAAmF;YACnF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxE,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;QACxC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAClD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,+CAA+C,KAAK,yBAAyB,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAA;AACjH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW;IACxD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC"}

package/lib/gate-runner.d.ts

@@ -0,0 +1,18 @@
+import type { ShellExecRequest, ShellExecSpec, ShellRunResult } from "@deepseek-ai/dsh-shell";
+/**
+ * Structural view of `ctx.shell` so the runner is testable with a fake shell
+ * without importing the abstract `ShellExecutor` service.
+ */
+export interface XpGateShell {
+    resolve(request: ShellExecRequest): ShellExecSpec;
+    run(spec: ShellExecSpec): Promise<ShellRunResult>;
+}
+/** Render a completed shell run as a single model-facing text block. */
+export declare function renderGateResult(result: ShellRunResult): string;
+/**
+ * Run an xp-gate command through the harness shell seam. Nonzero exits, timeouts,
+ * and sandbox denials resolve (and render) rather than reject; only cancellation
+ * (the caller's AbortSignal fired first) throws an AbortError with code ABORTED.
+ */
+export declare function runXpGate(shell: XpGateShell, signal: AbortSignal, command: string, workdir: string, timeoutMs: number): Promise<string>;
+//# sourceMappingURL=gate-runner.d.ts.map

package/lib/gate-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-runner.d.ts","sourceRoot":"","sources":["../src/gate-runner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE7F;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAAA;IACjD,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;CAClD;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAqB/D;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CASjB"}

package/lib/gate-runner.js

@@ -0,0 +1,46 @@
+import { TOOL_ABORTED } from "@deepseek-ai/dsh-tools";
+import { HarnessError } from "@deepseek-ai/dsh-llm";
+/** Render a completed shell run as a single model-facing text block. */
+export function renderGateResult(result) {
+    const lines = [];
+    const stdout = result.stdout.text.trim();
+    if (stdout.length > 0)
+        lines.push(stdout);
+    const stderr = result.stderr.text.trim();
+    if (stderr.length > 0)
+        lines.push(`[stderr] ${stderr}`);
+    if (result.timedOut)
+        lines.push(`[timed out after ${result.timeoutMs}ms]`);
+    if (result.exitCode !== null && result.exitCode !== 0)
+        lines.push(`[exit code: ${result.exitCode}]`);
+    if (result.signal !== null)
+        lines.push(`[signal: ${result.signal}]`);
+    if (result.sandbox?.denied === true) {
+        lines.push(`[sandbox: file access denied under ${result.sandbox.mode} mode]`);
+    }
+    if (result.stdout.truncated) {
+        const spill = result.stdout.spillPath !== undefined ? `, full output: ${result.stdout.spillPath}` : "";
+        lines.push(`[stdout truncated${spill}]`);
+    }
+    if (result.stderr.truncated) {
+        const spill = result.stderr.spillPath !== undefined ? `, full output: ${result.stderr.spillPath}` : "";
+        lines.push(`[stderr truncated${spill}]`);
+    }
+    return lines.length > 0 ? lines.join("\n") : "[XP-Gate] command completed (no output).";
+}
+/**
+ * Run an xp-gate command through the harness shell seam. Nonzero exits, timeouts,
+ * and sandbox denials resolve (and render) rather than reject; only cancellation
+ * (the caller's AbortSignal fired first) throws an AbortError with code ABORTED.
+ */
+export async function runXpGate(shell, signal, command, workdir, timeoutMs) {
+    const spec = shell.resolve({ command, workdir, timeoutMs, signal });
+    const result = await shell.run(spec);
+    if (result.aborted) {
+        const error = new HarnessError("tool call aborted", TOOL_ABORTED);
+        error.name = "AbortError";
+        throw error;
+    }
+    return renderGateResult(result);
+}
+//# sourceMappingURL=gate-runner.js.map

package/lib/gate-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-runner.js","sourceRoot":"","sources":["../src/gate-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAYnD,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,EAAE,CAAC,CAAA;IACvD,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,SAAS,KAAK,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAA;IACpG,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACtG,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACtG,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAA;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAkB,EAClB,MAAmB,EACnB,OAAe,EACf,OAAe,EACf,SAAiB;IAEjB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAA;QACjE,KAAK,CAAC,IAAI,GAAG,YAAY,CAAA;QACzB,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAA;AACjC,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from "@deepseek-ai/cordis";
+export declare const name = "tool-xp-gate";
+export declare const inject: string[];
+export declare function apply(ctx: Context, _config?: unknown): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAIlD,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAClC,eAAO,MAAM,MAAM,UAAqB,CAAA;AAIxC,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,OAAY,GAAG,IAAI,CAmF/D"}

package/lib/index.js

@@ -0,0 +1,79 @@
+import { defineTool } from "@deepseek-ai/dsh-tools";
+import { GATE_WHITELIST, buildCommand, resolveTarget } from "./command.js";
+import { runXpGate } from "./gate-runner.js";
+export const name = "tool-xp-gate";
+export const inject = ["tools", "shell"];
+const DEFAULT_TIMEOUT_MS = 120_000;
+export function apply(ctx, _config = {}) {
+    const shell = ctx.shell;
+    ctx.tools.register(defineTool({
+        name: "gate-check",
+        description: "Run XP-Gate quality gates (xp-gate check) on a file or directory and return the gate report. Prefers the global xp-gate CLI and degrades to an actionable install hint when it is absent.",
+        parameters: {
+            path: {
+                type: "string",
+                required: true,
+                description: "File or directory path to check (absolute or relative to the workspace).",
+            },
+            gates: {
+                type: "array",
+                items: { type: "string", enum: GATE_WHITELIST },
+                description: "Optional gate subset to run (e.g. ['principles', 'arch']).",
+            },
+        },
+        output: {
+            schema: { type: "string" },
+            render: (_args, value) => [{ type: "text", text: value }],
+        },
+        timeoutMs: DEFAULT_TIMEOUT_MS,
+        async execute(args, exec) {
+            const cwd = exec.agent?.session?.header?.cwd ?? process.cwd();
+            const target = resolveTarget(args.path, cwd);
+            const command = buildCommand({ subcommand: "check", target, gates: args.gates });
+            return runXpGate(shell, exec.signal, command, cwd, DEFAULT_TIMEOUT_MS);
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: "gate-principles",
+        description: "Run the 14 Clean Code / SOLID rules (xp-gate principles, Gate 4) on a file or directory and return the principles report.",
+        parameters: {
+            path: {
+                type: "string",
+                required: true,
+                description: "File or directory path to check (absolute or relative to the workspace).",
+            },
+        },
+        output: {
+            schema: { type: "string" },
+            render: (_args, value) => [{ type: "text", text: value }],
+        },
+        timeoutMs: DEFAULT_TIMEOUT_MS,
+        async execute(args, exec) {
+            const cwd = exec.agent?.session?.header?.cwd ?? process.cwd();
+            const target = resolveTarget(args.path, cwd);
+            const command = buildCommand({ subcommand: "principles", target });
+            return runXpGate(shell, exec.signal, command, cwd, DEFAULT_TIMEOUT_MS);
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: "gate-arch",
+        description: "Run architecture validation (xp-gate arch, Gate 6) using the given config file and return the architecture report. Defaults to architecture.yaml.",
+        parameters: {
+            config: {
+                type: "string",
+                description: "Architecture config file path (defaults to architecture.yaml).",
+            },
+        },
+        output: {
+            schema: { type: "string" },
+            render: (_args, value) => [{ type: "text", text: value }],
+        },
+        timeoutMs: DEFAULT_TIMEOUT_MS,
+        async execute(args, exec) {
+            const cwd = exec.agent?.session?.header?.cwd ?? process.cwd();
+            const command = buildCommand({ subcommand: "arch", config: args.config });
+            return runXpGate(shell, exec.signal, command, cwd, DEFAULT_TIMEOUT_MS);
+        },
+    }));
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAEnD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5C,MAAM,CAAC,MAAM,IAAI,GAAG,cAAc,CAAA;AAClC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAExC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAElC,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,UAAmB,EAAE;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;IAEvB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAChB,UAAU,CAAC;QACT,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,2LAA2L;QAC7L,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,0EAA0E;aACxF;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;gBAC/C,WAAW,EAAE,4DAA4D;aAC1E;SACF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SAC1D;QACD,SAAS,EAAE,kBAAkB;QAC7B,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;YAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;YAChF,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACxE,CAAC;KACF,CAAC,CACH,CAAA;IAED,GAAG,CAAC,KAAK,CAAC,QAAQ,CAChB,UAAU,CAAC;QACT,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,2HAA2H;QAC7H,UAAU,EAAE;YACV,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,0EAA0E;aACxF;SACF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SAC1D;QACD,SAAS,EAAE,kBAAkB;QAC7B,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;YAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;YAClE,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACxE,CAAC;KACF,CAAC,CACH,CAAA;IAED,GAAG,CAAC,KAAK,CAAC,QAAQ,CAChB,UAAU,CAAC;QACT,IAAI,EAAE,WAAW;QACjB,WAAW,EACT,mJAAmJ;QACrJ,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,gEAAgE;aAC9E;SACF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SAC1D;QACD,SAAS,EAAE,kBAAkB;QAC7B,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;YAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACzE,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACxE,CAAC;KACF,CAAC,CACH,CAAA;AACH,CAAC"}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@boyingliu01/dsh-plugin-xp-gate",
+  "version": "0.19.0",
+  "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/boyingliu01/xp-gate",
+    "directory": "plugins/dsh"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "files": [
+    "lib/",
+    "cordis.patch.yml",
+    "skills/",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "check": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "prepare-skills": "node scripts/prepack.cjs",
+    "prepack": "npm run build && npm run prepare-skills"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-shell": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-shell": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+    "@types/node": "^25.6.0",
+    "typescript": "^5.9.3",
+    "vitest": "^1.6.1",
+    "yaml": "^2.9.0"
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "xp-gate",
+    "quality-gates",
+    "code-review",
+    "sprint-flow"
+  ],
+  "author": "boyingliu01",
+  "license": "MIT"
+}

package/skills/admin-template-guidelines/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: admin-template-guidelines
+description: "6 maintainability rules for AI-generated admin interfaces (Fastify + Nunjucks + HTMX + Alpine.js). Prevents route bloat, test inconsistency, Nunjucks traps, repeated data logic, auth blind spots, and HTMX/Alpine confusion."
+maturity: alpha
+---
+
+# Admin Template Guidelines
+
+6 maintainability rules distilled from real rework patterns in interview-bot admin interface development. These constraints MUST be enforced during sprint-flow BUILD phase when generating admin routes, views, or tests.
+
+## 核心原则
+
+| 原则 | 说明 |
+|------|------|
+| **路由拆分** | Admin routes 按模块拆分，禁止单文件膨胀 |
+| **测试一致性** | 所有测试使用共享 `createAdminTestApp()` helper |
+| **Nunjucks 括号** | 比较表达式与 filter 混用时必须加括号 |
+| **View Model Mapper** | 重复数据转换提取为独立函数 |
+| **Auth 保护** | 所有 Admin 路由（含 GET）必须认证 |
+| **HTMX+Alpine 分离** | HTMX 管服务端交互，Alpine 管客户端状态 |
+
+---
+
+## 规则 1: 路由拆分（Route Splitting）
+
+**Constraint:** Admin routes MUST be split by module — never a single monolithic file.
+
+### 模块划分
+
+| 文件 | 职责 |
+|------|------|
+| `admin/routes/templates.ts` | 模板 CRUD（列表/创建/编辑/删除） |
+| `admin/routes/plans.ts` | 访谈计划管理（创建/启动/暂停/完结） |
+| `admin/routes/reports.ts` | 报告生成与导出 |
+| `admin/routes/analytics.ts` | 数据统计与看板 |
+| `admin/routes/tree.ts` | 技能树/目录管理 |
+| `admin/routes/admin-shared.ts` | 共享中间件、通用 helper、布局渲染 |
+
+**Examples:** → see `references/rule-1.md`
+
+---
+
+## 规则 2: 测试一致性（Test Consistency）
+
+**Constraint:** All admin route tests MUST use a shared `createAdminTestApp()` helper — never hand-roll mini Fastify instances per test file.
+
+**Examples:** → see `references/rule-2.md`
+
+---
+
+## 规则 3: Nunjucks 括号陷阱（Nunjucks Parentheses）
+
+**Constraint:** Comparison expressions in Nunjucks MUST be wrapped in parentheses when used with filters. The Nunjucks filter operator (`|`) has **higher precedence** than comparison operators, causing silent incorrect output.
+
+**Examples & Checklist:** → see `references/rule-3.md`
+
+---
+
+## 规则 4: View Model Mapper
+
+**Constraint:** Repeated data transformation patterns MUST be extracted into dedicated functions. Any data mapping, filtering, or calculation that appears in 3+ route handlers must live in a shared `view-models.ts` module.
+
+### 常见重复模式
+
+| 模式 | 出现位置 | 提取函数 |
+|------|----------|----------|
+| `_count` → `totalCount` 映射 | templates.ts, plans.ts, reports.ts | `mapCountFields()` |
+| COMPLETED 状态过滤 | plans.ts, reports.ts, analytics.ts | `filterCompletedPlans()` |
+| 完成率计算 | plans.ts, analytics.ts, tree.ts | `calculateCompletionRate()` |
+| 完整 ViewModel 转换 | 所有列表页路由 | `mapTemplateToViewModel()` |
+
+**Examples:** → see `references/rule-4.md`
+
+---
+
+## 规则 5: Auth 保护（Auth Protection）
+
+**Constraint:** ALL Admin routes MUST be protected by authentication — including GET routes. No admin endpoint is exempt. Prefer cookie/session validation over API key headers.
+
+### 路由豁免规则
+
+| 路由类型 | 需要 Auth | 说明 |
+|----------|-----------|------|
+| Admin GET | ✅ 必须 | 管理页面包含敏感数据 |
+| Admin POST/PUT/DELETE | ✅ 必须 | 数据变更操作 |
+| Admin API (HTMX endpoints) | ✅ 必须 | 部分更新接口 |
+| Public GET | ❌ 不需要 | 面向用户的公开页面 |
+
+**Examples:** → see `references/rule-5.md`
+
+---
+
+## 规则 6: HTMX + Alpine 分离
+
+**Constraint:** Clear separation of concerns between HTMX (server-driven content replacement) and Alpine.js (client-side UI state). HTMX handles server interactions; Alpine handles local component state.
+
+### 职责矩阵
+
+| 功能 | HTMX | Alpine.js |
+|------|------|-----------|
+| 页面导航 / URL 变更 | ✅ | ❌ |
+| 表单提交到服务端 | ✅ | ❌ |
+| 列表分页/搜索/排序 | ✅ | ❌ |
+| 局部内容替换（`hx-target`） | ✅ | ❌ |
+| 下拉菜单开关 | ❌ | ✅ |
+| Modal 显示/隐藏 | ❌ | ✅ |
+| 表单字段即时验证 | ❌ | ✅ |
+| Toast 通知本地状态 | ❌ | ✅ |
+| 按钮 loading 状态切换 | ❌ | ✅ |
+
+**Examples & Principles:** → see `references/rule-6.md`
+
+

package/skills/admin-template-guidelines/references/rule-1.md

@@ -0,0 +1,91 @@
+# Rule 1: Route Splitting — Examples
+
+## ❌ 错误示例：单文件膨胀（800+ 行）
+
+```typescript
+// admin/routes/index.ts — 反模式
+import { FastifyInstance } from 'fastify';
+
+export async function adminRoutes(fastify: FastifyInstance) {
+  // 模板列表 — 第 10 行
+  fastify.get('/admin/templates', async (req, reply) => { ... });
+  // 模板创建 — 第 45 行
+  fastify.post('/admin/templates', async (req, reply) => { ... });
+  // 模板编辑 — 第 80 行
+  fastify.get('/admin/templates/:id/edit', async (req, reply) => { ... });
+  // 模板删除 — 第 115 行
+  fastify.delete('/admin/templates/:id', async (req, reply) => { ... });
+  // 计划列表 — 第 150 行
+  fastify.get('/admin/plans', async (req, reply) => { ... });
+  // 计划创建 — 第 190 行
+  fastify.post('/admin/plans', async (req, reply) => { ... });
+  // ... 持续膨胀到 800+ 行 ...
+}
+```
+
+## ✅ 正确示例：按模块拆分
+
+```typescript
+// admin/routes/admin-shared.ts
+import { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
+
+export function registerAdminShared(fastify: FastifyInstance) {
+  // 共享中间件：认证
+  fastify.addHook('onRequest', authenticateAdmin);
+
+  // 共享 helper：渲染带布局的页面
+  fastify.decorate('renderAdmin', async function (
+    this: FastifyInstance,
+    req: FastifyRequest,
+    reply: FastifyReply,
+    template: string,
+    data: Record<string, unknown>
+  ) {
+    return reply.view(`admin/layouts/main.njk`, {
+      ...data,
+      _content: await reply.view(`admin/${template}.njk`, data),
+    });
+  });
+}
+
+// admin/routes/templates.ts
+import { FastifyInstance } from 'fastify';
+
+export async function registerTemplateRoutes(fastify: FastifyInstance) {
+  fastify.get('/admin/templates', { onRequest: [authenticateAdmin] }, listTemplates);
+  fastify.get('/admin/templates/new', { onRequest: [authenticateAdmin] }, showNewTemplate);
+  fastify.post('/admin/templates', { onRequest: [authenticateAdmin] }, createTemplate);
+  fastify.get('/admin/templates/:id/edit', { onRequest: [authenticateAdmin] }, showEditTemplate);
+  fastify.put('/admin/templates/:id', { onRequest: [authenticateAdmin] }, updateTemplate);
+  fastify.delete('/admin/templates/:id', { onRequest: [authenticateAdmin] }, deleteTemplate);
+}
+
+// admin/routes/plans.ts
+import { FastifyInstance } from 'fastify';
+
+export async function registerPlanRoutes(fastify: FastifyInstance) {
+  fastify.get('/admin/plans', { onRequest: [authenticateAdmin] }, listPlans);
+  fastify.post('/admin/plans', { onRequest: [authenticateAdmin] }, createPlan);
+  fastify.post('/admin/plans/:id/start', { onRequest: [authenticateAdmin] }, startPlan);
+  fastify.post('/admin/plans/:id/pause', { onRequest: [authenticateAdmin] }, pausePlan);
+  fastify.post('/admin/plans/:id/complete', { onRequest: [authenticateAdmin] }, completePlan);
+}
+
+// admin/routes/index.ts — 仅负责聚合注册
+import { FastifyInstance } from 'fastify';
+import { registerAdminShared } from './admin-shared';
+import { registerTemplateRoutes } from './templates';
+import { registerPlanRoutes } from './plans';
+import { registerReportRoutes } from './reports';
+import { registerAnalyticsRoutes } from './analytics';
+import { registerTreeRoutes } from './tree';
+
+export async function registerAllAdminRoutes(fastify: FastifyInstance) {
+  registerAdminShared(fastify);
+  await registerTemplateRoutes(fastify);
+  await registerPlanRoutes(fastify);
+  await registerReportRoutes(fastify);
+  await registerAnalyticsRoutes(fastify);
+  await registerTreeRoutes(fastify);
+}
+```