@boyingliu01/opencode-plugin 0.35.15 → 0.35.16

package/README.md

@@ -62,9 +62,30 @@ Or via local path (development):
 }
 ```
 
+### OpenCode v2
+
+v2 validates the plugin's default export against a schema requiring `id` plus
+`effect` or `setup`. This package ships both keys from 0.35.15 onwards, so the
+same published version loads under v1 and v2 — no separate build, no manifest
+change on your side.
+
+Register it the same way (v2 reads the same `plugin` array):
+
+```json
+{
+  "plugin": ["@boyingliu01/opencode-plugin"]
+}
+```
+
+Do **not** register `@boyingliu01/opencode-plugin/tui`. The TUI panel was
+abandoned in v0.13.0 and there is no `/tui` entry; v2's npm installer treats the
+whole string as a package name, so it fails on every startup with
+`NpmInstallFailedError`. The subpath export was removed in 0.35.15 for exactly
+that reason.
+
 ## Requirements
 
-- OpenCode v0.11+
+- OpenCode v0.11+ (v2.1.4+ supported)
 - One of:
   - `xp-gate` CLI installed globally (`npm install -g @boyingliu01/xp-gate`) — **preferred**, or
   - the xp-gate repo checked out locally with `src/principles/index.ts` reachable — **fallback** (the tool will shell out via `npx -y tsx`)

package/index.ts

@@ -470,11 +470,24 @@ function gateArchTool(directory: string) {
 
 function readCurrentSessionModel(dbPath: string, sessionId: string): string {
   try {
+    // execFileSync, NOT execSync (#639). `sessionId` comes from the caller's
+    // argument, and the previous form interpolated it into a shell string:
+    //
+    //   `sqlite3 "${dbPath}" "SELECT model FROM session WHERE id = '${escapedId}'"`
+    //
+    // Escaping only the SQL single quote left every SHELL metacharacter live --
+    // a session id containing `"`, `$( )` or a backtick escaped the quoting and
+    // executed. Passing argv as an array removes the shell from the path
+    // entirely, so no escaping is needed or possible to get wrong.
+    //
+    // The SQL single quote is still escaped: that is a SQL concern, not a shell
+    // one, and it survives the move to argv unchanged.
     const escapedId = sessionId.replace(/'/g, "''")
-    const currentRaw = execSync(
-      `sqlite3 "${dbPath}" "SELECT model FROM session WHERE id = '${escapedId}'"`,
-      { encoding: "utf8", timeout: SQLITE_TIMEOUT_MS }
-    ).trim()
+    const sql = `SELECT model FROM session WHERE id = '${escapedId}'`
+    const currentRaw = execFileSync("sqlite3", [dbPath, sql], {
+      encoding: "utf8",
+      timeout: SQLITE_TIMEOUT_MS,
+    }).trim()
     if (!currentRaw) return "unknown"
     try {
       const parsed = JSON.parse(currentRaw)
@@ -664,9 +677,31 @@ export const XpGatePlugin = async (input: OpenCodePluginInput) => {
   }
 }
 
+/**
+ * The plugin module, shaped for BOTH OpenCode generations (#639).
+ *
+ * v1 read `server`. v2 validates the default export against a schema that
+ * requires `id` plus exactly one of `effect` / `setup`, and rejects anything
+ * else outright:
+ *
+ *   PluginModule.LoadError: Plugin must export a default definition with an id
+ *   and an effect or setup function.
+ *   (cause: SchemaError(Missing key at ["default"]["effect"] / ["default"]["setup"]))
+ *
+ * The failure mode is total, not partial: the plugin does not load at all, so
+ * `gate-check` / `gate-principles` / `gate-arch` simply vanish from v2 sessions
+ * and every startup prints a load error.
+ *
+ * `setup` and the v1 `server` take the same input and return the same shape, so
+ * the same function serves both keys. Both are exported deliberately: dropping
+ * `server` would break every v1 user on upgrade, which is a migration nobody
+ * asked for. `pluginModule` is not frozen, so this stays a plain object literal
+ * that both runtimes can read.
+ */
 const pluginModule = {
   id: "xp-gate",
   server: XpGatePlugin,
+  setup: XpGatePlugin,
 }
 
 /**

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.15",
+  "version": "0.35.16",
   "type": "module",
   "main": "index.ts",
-  "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",
+  "description": "XP-Gate quality gates + AI workflow skills for OpenCode",
   "repository": {
     "type": "git",
     "url": "https://github.com/boyingliu01/xp-gate",
@@ -17,15 +17,10 @@
     ".": {
       "import": "./index.ts",
       "types": "./index.ts"
-    },
-    "./tui": {
-      "import": "./tui-plugin.tsx",
-      "types": "./tui-plugin.tsx"
     }
   },
   "files": [
     "index.ts",
-    "tui-plugin.ts",
     "skills/",
     "tsconfig.json",
     "README.md"

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 3aa988e7
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.16.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 3aa988e7
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.16.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 3aa988e7
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.16.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.