@boyingliu01/xp-gate 0.15.1 → 0.15.2

package/bin/xp-gate.js

@@ -211,6 +211,30 @@ const COMMANDS = {
       handleSprintAudit(subargs).then(code => process.exit(code));
     },
     usage: 'xp-gate sprint-audit [--dir <path>] [--json]'
+  },
+  'detect-languages': {
+    description: 'Detect project languages and generate .xp-gate-config.json',
+    run: subargs => {
+      const { handleDetectLanguages } = require('../lib/language-tools.js');
+      handleDetectLanguages(subargs).then(code => process.exit(code));
+    },
+    usage: 'xp-gate detect-languages [--json] [--write]'
+  },
+  'check-tools': {
+    description: 'Check quality gate tool availability per language',
+    run: subargs => {
+      const { handleCheckTools } = require('../lib/language-tools.js');
+      handleCheckTools(subargs).then(code => process.exit(code));
+    },
+    usage: 'xp-gate check-tools [--languages <langs>] [--json]'
+  },
+  'install-tools': {
+    description: 'Install missing quality gate tools for detected languages',
+    run: subargs => {
+      const { handleInstallTools } = require('../lib/language-tools.js');
+      handleInstallTools(subargs).then(code => process.exit(code));
+    },
+    usage: 'xp-gate install-tools [--languages <langs>] [--dry-run] [--yes]'
   }
 };
 

package/hooks/pre-commit

@@ -375,7 +375,29 @@ if [ -n "$_RESOLVED_LANG_OVERRIDE" ]; then
   echo "   🔧 LANGUAGE OVERRIDE: $PROJECT_LANG"
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo ""
-else
+elif [ -f ".xp-gate-config.json" ]; then
+  # ---- Read from project config file (v0.15.2+) ----
+  # .xp-gate-config.json is generated by `xp-gate init` or `xp-gate detect-languages`
+  # It contains detected languages and their tool status.
+  _CONFIG_LANGS=$(node -e "try{const c=JSON.parse(require('fs').readFileSync('.xp-gate-config.json','utf8'));console.log(Object.keys(c.languages||{}).join(' '));}catch(e){console.log('');}" 2>/dev/null || echo "")
+  if [ -n "$_CONFIG_LANGS" ]; then
+    PROJECT_LANGS="$_CONFIG_LANGS"
+    PROJECT_LANG=$(echo "$_CONFIG_LANGS" | awk '{print $1}')
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "   📋 LANGUAGES FROM .xp-gate-config.json"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    echo "Detected languages: $PROJECT_LANGS"
+    echo ""
+  else
+    # Config file exists but no languages detected — fall through to extension detection
+    _CONFIG_LANGS=""
+  fi
+fi
+
+# If no languages from override or config, detect from changed files
+if [ -z "$PROJECT_LANGS" ] && [ -z "$_CONFIG_LANGS" ]; then
   # ---- Extension → language mapping ----
   # Extracts unique languages from changed file extensions
   PROJECT_LANGS=""
@@ -676,7 +698,7 @@ CHANGEDFILELIST
     done
     echo ""
   fi
-fi
+fi  # close language override if/else
 
 # Helper: check if a language is in PROJECT_LANGS
 has_project_lang() {

package/hooks/pre-push

@@ -865,16 +865,11 @@ if ! command -v jq &> /dev/null; then
 fi
 
 # Validate result file content
-# SHA self-reference paradox fix: if the result file was committed as part of
-# HEAD, its content references HEAD^ (the commit being reviewed), not HEAD.
+# SHA self-reference paradox fix (Issue #346):
+# The walkthrough file may reference an earlier commit if it was generated before
+# subsequent walkthrough-only commits. We check if the referenced commit is in
+# the current branch's history and if no functional commits occurred after it.
 CURRENT_COMMIT=$(git rev-parse HEAD)
-if git diff-tree --no-commit-id --name-only -r HEAD 2>/dev/null | grep -qx "$RESULT_FILE"; then
-  # Result file is part of the latest commit — compare against the reviewed commit
-  EXPECTED_COMMIT=$(git rev-parse HEAD^ 2>/dev/null || echo "unknown")
-else
-  # Result file is working-tree only — compare against current HEAD
-  EXPECTED_COMMIT="$CURRENT_COMMIT"
-fi
 
 # Check JSON validity
 if ! jq empty "$RESULT_FILE" 2>/dev/null; then
@@ -906,16 +901,42 @@ if [ "$RESULT_BRANCH" != "$CURRENT_BRANCH" ]; then
   echo "Proceeding with commit verification..."
 fi
 
-# Commit match check
-if [ "$RESULT_COMMIT" != "$EXPECTED_COMMIT" ]; then
+# Commit match check (Issue #346: flexible matching to avoid circular dependency)
+# Check if RESULT_COMMIT is in the current branch's history
+if ! git merge-base --is-ancestor "$RESULT_COMMIT" HEAD 2>/dev/null; then
+  echo ""
+  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+  echo "   ❌ RESULT FILE INVALID - PUSH BLOCKED"
+  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+  echo ""
+  echo "Result file references a commit not in current branch:"
+  echo "  Referenced: $RESULT_COMMIT"
+  echo "  Current HEAD: $CURRENT_COMMIT"
+  echo ""
+  echo "Re-run: /delphi-review --mode code-walkthrough"
+  echo ""
+  exit 1
+fi
+
+# Check if there are any functional commits after RESULT_COMMIT
+# Functional commits are those that are NOT walkthrough-only updates or Gate MW fixes
+FUNCTIONAL_COMMITS_AFTER=$(git log --oneline "$RESULT_COMMIT"..HEAD -- . \
+  ':!.code-walkthrough-result.json' \
+  ':!.delphi/code-walkthrough.md' \
+  ':!githooks/pre-push' \
+  ':!src/npm-package/hooks/pre-push' 2>/dev/null | wc -l)
+if [ "$FUNCTIONAL_COMMITS_AFTER" -gt 0 ]; then
   echo ""
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo "   ❌ RESULT FILE OUTDATED - PUSH BLOCKED"
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo ""
-  echo "Result file is for a different commit:"
-    echo "  Expected: $EXPECTED_COMMIT"
-    echo "  Found: $RESULT_COMMIT"
+  echo "Functional commits found after walkthrough:"
+  git log --oneline "$RESULT_COMMIT"..HEAD -- . \
+    ':!.code-walkthrough-result.json' \
+    ':!.delphi/code-walkthrough.md' \
+    ':!githooks/pre-push' \
+    ':!src/npm-package/hooks/pre-push' 2>/dev/null | head -5
   echo ""
   echo "Re-run: /delphi-review --mode code-walkthrough"
   echo ""
@@ -961,9 +982,178 @@ if [[ "$CURRENT_TIME" > "$RESULT_EXPIRES" ]]; then
   exit 1
 fi
 
+# ============================================================================
+# PROVENANCE VALIDATION (Issue #339)
+# Validate that the walkthrough was genuinely produced by Delphi review,
+# not fabricated by an LLM.
+# ============================================================================
+
+# Check provenance fields exist
+EXPERTS_COUNT=$(jq -r '.experts // [] | length' "$RESULT_FILE")
+CONSENSUS=$(jq -r '.consensus // 0' "$RESULT_FILE")
+WALKTHROUGH_HASH=$(jq -r '.walkthroughHash // empty' "$RESULT_FILE")
+GENERATED_AT=$(jq -r '.generatedAt // empty' "$RESULT_FILE")
+
+# Grace period: configurable via env var (default 30 days)
+GRACE_DAYS="${XP_GATE_MW_GRACE_DAYS:-30}"
+
+# Check if this is a "new" walkthrough (has provenance fields)
+HAS_PROVENANCE="false"
+if [ -n "$WALKTHROUGH_HASH" ] && [ -n "$GENERATED_AT" ] && [ "$EXPERTS_COUNT" -ge 3 ]; then
+  HAS_PROVENANCE="true"
+fi
+
+if [ "$HAS_PROVENANCE" = "true" ]; then
+  # Full provenance validation
+  
+  # 1. Experts count check (minimum 3)
+  if [ "$EXPERTS_COUNT" -lt 3 ]; then
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "   ❌ INSUFFICIENT EXPERTS - PUSH BLOCKED"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    echo "Walkthrough requires minimum 3 experts:"
+    echo "  Found: $EXPERTS_COUNT experts"
+    echo ""
+    echo "Re-run: /delphi-review --mode code-walkthrough"
+    echo ""
+    exit 1
+  fi
+
+  # 2. Consensus check (≥90%)
+  # Use integer math: multiply by 10 to avoid bc dependency
+  CONSENSUS_X10=$(echo "$CONSENSUS * 10" | bc -l | cut -d'.' -f1)
+  if [ "$CONSENSUS_X10" -lt 900 ]; then
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "   ❌ CONSENSUS TOO LOW - PUSH BLOCKED"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    echo "Walkthrough requires ≥90% consensus:"
+    echo "  Found: ${CONSENSUS}%"
+    echo ""
+    echo "Re-run: /delphi-review --mode code-walkthrough"
+    echo ""
+    exit 1
+  fi
+
+  # 3. Walkthrough hash verification
+  WALKTHROUGH_DOC=".delphi/code-walkthrough.md"
+  if [ ! -f "$WALKTHROUGH_DOC" ]; then
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "   ❌ WALKTHROUGH DOC MISSING - PUSH BLOCKED"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    echo "Walkthrough document not found:"
+    echo "  Expected: $WALKTHROUGH_DOC"
+    echo ""
+    echo "Re-run: /delphi-review --mode code-walkthrough"
+    echo ""
+    exit 1
+  fi
+
+  # Cross-platform SHA-256 computation
+  COMPUTED_HASH=""
+  if command -v sha256sum &> /dev/null; then
+    COMPUTED_HASH=$(sha256sum "$WALKTHROUGH_DOC" | cut -d' ' -f1)
+  elif command -v shasum &> /dev/null; then
+    COMPUTED_HASH=$(shasum -a 256 "$WALKTHROUGH_DOC" | cut -d' ' -f1)
+  elif command -v openssl &> /dev/null; then
+    COMPUTED_HASH=$(openssl sha256 -r "$WALKTHROUGH_DOC" | cut -d' ' -f1)
+  fi
+
+  if [ -z "$COMPUTED_HASH" ]; then
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "   ❌ NO SHA-256 TOOL - PUSH BLOCKED"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    echo "No SHA-256 tool available (install sha256sum, shasum, or openssl)"
+    echo ""
+    exit 1
+  fi
+
+  if [ "$WALKTHROUGH_HASH" != "$COMPUTED_HASH" ]; then
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "   ❌ WALKTHROUGH HASH MISMATCH - PUSH BLOCKED"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    echo "Walkthrough document has been modified after review:"
+    echo "  Expected: $WALKTHROUGH_HASH"
+    echo "  Found:    $COMPUTED_HASH"
+    echo ""
+    echo "Re-run: /delphi-review --mode code-walkthrough"
+    echo ""
+    exit 1
+  fi
+
+  # 4. generatedAt check (replay protection)
+  if [ -z "$GENERATED_AT" ]; then
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "   ❌ MISSING generatedAt - PUSH BLOCKED"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    echo "Walkthrough result missing generatedAt timestamp"
+    echo ""
+    echo "Re-run: /delphi-review --mode code-walkthrough"
+    echo ""
+    exit 1
+  fi
+else
+  # Grace period: old walkthroughs without provenance get WARNING
+  echo ""
+  echo "⚠️ WARNING: Legacy walkthrough format (no provenance fields)"
+  echo "  Provenance fields will be required after grace period (${GRACE_DAYS} days)"
+  echo "  Consider re-running: /delphi-review --mode code-walkthrough"
+  echo ""
+fi
+
 # ============================================================================
 # ALL CHECKS PASSED
 # ============================================================================
+echo ""
+
+# ============================================================================
+# SPRINT-STATE BACKUP CHECK (WARNING ONLY — Issue #318)
+# Scan for worktree sprint-state directories that haven't been backed up
+# to .sprint-history/ before push. WARN only (doesn't block) — sprint-state
+# inside worktrees is deleted on `git worktree remove`, causing permanent
+# data loss if orchestrator forgets to back up during CLOSE phase.
+# ============================================================================
+if [ -d ".worktrees/sprint" ]; then
+  for worktree_dir in .worktrees/sprint/sprint-*; do
+    [ -d "$worktree_dir" ] || continue
+    [ -d "$worktree_dir/.sprint-state" ] || continue
+    sprint_id=$(basename "$worktree_dir")
+    if [ -f "$worktree_dir/.sprint-state/sprint-state.json" ]; then
+      if [ ! -d ".sprint-history/$sprint_id" ]; then
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "   ⚠️  SPRINT-STATE NOT BACKED UP: $sprint_id"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo ""
+        echo "Unarchived sprint state found in worktree:"
+        echo "  Path: $worktree_dir/.sprint-state/"
+        echo "  Backup: .sprint-history/$sprint_id/ (MISSING)"
+        echo ""
+        echo "RISK: If this worktree is removed before CLOSE backup,"
+        echo "      design docs, Delphi verdicts, and phase summaries"
+        echo "      are permanently lost."
+        echo ""
+        echo "Backup now:"
+        echo "  mkdir -p .sprint-history/$sprint_id"
+        echo "  cp -r $worktree_dir/.sprint-state/* .sprint-history/$sprint_id/"
+        echo ""
+        echo "See: https://github.com/boyingliu01/xp-gate/issues/318"
+        echo ""
+      fi
+    fi
+  done
+fi
+
 echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo "   ✅ GATE MW: CODE WALKTHROUGH VERIFIED"