@boyingliu01/xp-gate 0.12.12 → 0.12.13

package/adapters/iac.sh

@@ -20,8 +20,12 @@ detect_iac_files() {
         tf_files="$tf_files $file"
         ;;
       *.yaml|*.yml)
+        # Check if it's inside .github/workflows/ (GitHub Actions)
+        if echo "$file" | grep -q "\.github/workflows/"; then
+          # Pass directly to checkov as a GitHub Actions file
+          yaml_files="$yaml_files $file"
         # Check if it's a K8s manifest (has apiVersion and kind)
-        if grep -qE "^(apiVersion|kind):" "$file" 2>/dev/null; then
+        elif grep -qE "^(apiVersion|kind):" "$file" 2>/dev/null; then
           yaml_files="$yaml_files $file"
         fi
         ;;
@@ -59,52 +63,75 @@ run_static_analysis() {
   # Try checkov first (recommended - supports multiple platforms)
   if command -v checkov >/dev/null 2>&1; then
     echo "Running checkov IaC security scan..."
-    
+
+    # checkov 3.x always exits 0 even on failures. We capture output to a
+    # temp file and parse it for "FAILED for resource" lines instead.
+    local checkov_log=$(mktemp)
+    local checkov_args="--compact"
+
     # Run checkov on all detected IaC files
     local tf_files=$(echo "$iac_files" | grep "TERRAFORM:" | sed 's/TERRAFORM://')
     local k8s_files=$(echo "$iac_files" | grep "KUBERNETES:" | sed 's/KUBERNETES://')
     local docker_files=$(echo "$iac_files" | grep "DOCKER:" | sed 's/DOCKER://')
-    
+
     if [ -n "$tf_files" ]; then
       echo "Scanning Terraform files..."
       for file in $tf_files; do
         if [ -f "$file" ]; then
-          checkov --file "$file" --compact 2>&1 | tail -20
-          local tf_exit=${PIPESTATUS[0]}
-          if [ $tf_exit -ne 0 ]; then
-            exit_code=$tf_exit
-          fi
+          checkov --file "$file" $checkov_args >> "$checkov_log" 2>&1
         fi
       done
     fi
-    
+
     if [ -n "$k8s_files" ]; then
-      echo "Scanning Kubernetes manifests..."
+      local gh_files=""
+      local k8s_only=""
       for file in $k8s_files; do
-        if [ -f "$file" ]; then
-          checkov --file "$file" --compact 2>&1 | tail -20
-          local k8s_exit=${PIPESTATUS[0]}
-          if [ $k8s_exit -ne 0 ]; then
-            exit_code=$k8s_exit
-          fi
+        if echo "$file" | grep -q "\.github/workflows/"; then
+          gh_files="$gh_files $file"
+        else
+          k8s_only="$k8s_only $file"
         fi
       done
+
+      if [ -n "$k8s_only" ]; then
+        echo "Scanning Kubernetes manifests..."
+        for file in $k8s_only; do
+          if [ -f "$file" ]; then
+            checkov --file "$file" $checkov_args --framework kubernetes >> "$checkov_log" 2>&1
+          fi
+        done
+      fi
+
+      if [ -n "$gh_files" ]; then
+        echo "Scanning GitHub Actions workflows..."
+        for file in $gh_files; do
+          if [ -f "$file" ]; then
+            checkov --file "$file" $checkov_args --framework github_actions >> "$checkov_log" 2>&1
+          fi
+        done
+      fi
     fi
-    
+
     if [ -n "$docker_files" ]; then
       echo "Scanning Dockerfiles..."
       for file in $docker_files; do
         if [ -f "$file" ]; then
-          checkov --file "$file" --compact 2>&1 | tail -20
-          local docker_exit=${PIPESTATUS[0]}
-          if [ $docker_exit -ne 0 ]; then
-            exit_code=$docker_exit
-          fi
+          checkov --file "$file" $checkov_args >> "$checkov_log" 2>&1
         fi
       done
     fi
-    
-    echo "checkov scan completed with exit code: $exit_code"
+
+    # Print captured output then check for failures
+    cat "$checkov_log"
+    local failed_count=$(grep -c "FAILED for resource" "$checkov_log" 2>/dev/null || echo 0)
+    rm -f "$checkov_log"
+
+    if [ "$failed_count" -gt 0 ]; then
+      echo "❌ $failed_count security issue(s) found by checkov. Blocking commit."
+      exit_code=1
+    fi
+    echo "checkov scan completed."
     return $exit_code
   fi
   

package/bin/xp-gate.js

@@ -30,7 +30,7 @@ const COMMANDS = {
   'init': {
     description: 'Initialize xp-gate (use --global for all projects)',
     run: subargs => init(subargs).then(code => process.exit(code)),
-    usage: 'xp-gate init [--global]'
+    usage: 'xp-gate init [--global] [--yes]'
   },
   'setup-global': {
     description: 'Set up xp-gate globally for all git projects',
@@ -125,7 +125,7 @@ const COMMANDS = {
     usage: 'xp-gate upgrade [--preview] [--apply]'
   },
   'bootstrap': {
-    description: 'Install CLI tools required by quality gates (jscpd, lizard, checkov, gitleaks, semgrep)',
+    description: 'Install CLI tools required by quality gates. Also invoked by "xp-gate init --yes"',
     run: subargs => process.exit(bootstrap(subargs)),
     usage: 'xp-gate bootstrap [--dry-run] [--verbose]'
   },

package/lib/init.js

@@ -279,13 +279,75 @@ function printCliToolStatus() {
   console.log(`CLI tools: ${available.length}/${GATE_CLI_TOOLS.length} available`);
   if (missing.length > 0) {
     console.log(`  Missing: ${missing.join(', ')}`);
-    console.log('  Quality gates using these tools will silently SKIP until they are installed.');
-    console.log(`  Run 'xp-gate bootstrap' to install all missing tools, or 'xp-gate doctor' for details.\n`);
+    console.log('  Quality gates using these tools will silently SKIP until they are installed.\n');
   } else {
     console.log('');
   }
 }
 
+/**
+ * Ask the user for confirmation via stdin.
+ * @param {string} question - The yes/no question to display
+ * @returns {Promise<boolean>} true if user answered yes
+ */
+function askYesNo(question) {
+  return new Promise((resolve) => {
+    const rl = require('readline').createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    rl.question(`${question} (Y/n) `, (answer) => {
+      rl.close();
+      const normalized = answer.trim().toLowerCase();
+      // Empty (just Enter) or y/yes → yes; anything else → no
+      resolve(normalized === '' || normalized === 'y' || normalized === 'yes');
+    });
+  });
+}
+
+/**
+ * Prompt the user to auto-install missing CLI quality-gate tools.
+ * Called after installation completes. Interactive only when TTY is available.
+ * Skips silently when no tools are missing.
+ *
+ * @param {boolean} autoYes - If true, skip prompt and auto-install
+ * @returns {Promise<number>} 0 on success or skipped, 1 on failure
+ */
+async function promptBootstrap(autoYes) {
+  const { bootstrap } = require('./bootstrap.js');
+
+  // Check what's missing without printing a full header
+  const missing = [];
+  for (const entry of GATE_CLI_TOOLS) {
+    const result = checkCliTool(entry.tool);
+    if (!result.available) {
+      missing.push(entry.tool);
+    }
+  }
+
+  if (missing.length === 0) return 0;
+
+  console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+  console.log('  Quality Gate CLI Tools');
+  console.log('');
+  console.log(`  ${missing.length} tool(s) required by quality gates are not installed:`);
+  for (const tool of missing) {
+    console.log(`    ✗ ${tool}`);
+  }
+  console.log('');
+  console.log('  Without these tools, the corresponding quality gates will');
+  console.log('  silently SKIP during git commits — you may miss issues.');
+  console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+
+  if (autoYes || (process.stdin.isTTY && await askYesNo('\nInstall missing tools now?'))) {
+    console.log('');
+    return bootstrap([]);
+  }
+
+  console.log('\n  Skipped. Run "xp-gate bootstrap" later to install them.');
+  return 0;
+}
+
 async function init(args) {
   console.log('XP-Gate Initialization');
   console.log('====================\n');
@@ -384,7 +446,10 @@ async function installLocal(args) {
 
   console.log('\nInstallation complete!');
   console.log('Run git commit to trigger quality gates');
-  console.log('');
+
+  // Auto-install missing CLI tools (prompt user)
+  const autoYes = args.includes('--yes') || args.includes('--auto-install');
+  await promptBootstrap(autoYes);
   console.log('━━━ FIRST-CLASS TEST QUALITY ━━━');
   console.log('XP-Gate treats test code as a first-class citizen:');
   console.log('  • TypeScript: test files are type-checked, not excluded from tsconfig.json');
@@ -455,6 +520,11 @@ async function setupGlobal(args) {
   console.log('\nGlobal setup complete!');
   console.log('All git repositories will now use xp-gate quality gates.');
   console.log('Per-project adapters can still override by creating <repo>/githooks/');
+
+  // Auto-install missing CLI tools (prompt user)
+  const autoYes = args.includes('--yes') || args.includes('--auto-install');
+  await promptBootstrap(autoYes);
+
   console.log('');
   console.log('━━━ FIRST-CLASS TEST QUALITY ━━━');
   console.log('XP-Gate treats test code as a first-class citizen:');
@@ -556,4 +626,4 @@ function injectKarpathyPrinciples(projectRoot) {
   }
 }
 
-module.exports = { init };
+module.exports = { init, promptBootstrap };

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.12.12",
+  "version": "0.12.13",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.12.12",
+  "version": "0.12.13",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.12.12",
+  "version": "0.12.13",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.12.12",
+  "version": "0.12.13",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → USER ACCEPTANCE → FEEDBACK → SHIP → LAND → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-06
-**Commit:** 132a12e
+**Generated:** 2026-07-07
+**Commit:** 897f8eb
 **Branch:** main
-**Version:** 0.12.12.0
+**Version:** 0.12.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.