@boyingliu01/xp-gate 0.15.3 → 0.15.5

package/adapters/gate-3.sh

@@ -0,0 +1,68 @@
+# ============================================================================
+# GATE 3: Cyclomatic Complexity Check
+# Uses lizard - checks cyclomatic complexity of changed source files
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 3: Cyclomatic complexity..."
+GATE_3_START=$(gate_start_ms)
+
+if [ "$PROJECT_LANG" = "documentation-only" ]; then
+  echo "⏭️  SKIPPED - Complexity (documentation project)."
+  GATE_3_STATUS="SKIP"
+
+elif [ "$PROJECT_LANG" = "powershell" ]; then
+  echo "ℹ️  No PowerShell Clean Code / SOLID tool available"
+  echo "⏭️  SKIPPED - Complexity (no PowerShell tool)"
+  GATE_3_STATUS="SKIP"
+  
+else
+  CCN_THRESHOLD=5
+  
+  # Check lizard availability
+  LIZARD_CMD=""
+  if command -v lizard > /dev/null 2>&1; then
+    LIZARD_CMD=lizard
+  elif [ -f ~/.local/bin/lizard ]; then
+    LIZARD_CMD=~/.local/bin/lizard
+  fi
+  
+  if [ -n "$LIZARD_CMD" ]; then
+    LIZARD_PATH=$(eval echo "$LIZARD_CMD")
+    
+    # Get changed source files for complexity check (includes test files)
+    CC_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt)$' || true)
+    
+    if [ -n "$CC_FILES" ]; then
+      echo "Checking complexity for source files..."
+      
+      # Run lizard with CCN threshold
+      CC_OUTPUT=$($LIZARD_PATH -C $CCN_THRESHOLD $CC_FILES 2>&1 || true)
+      
+      # Parse warning count from the summary table: "Warning cnt   8"
+      # Use anchored grep to avoid matching lizard table headers (e.g. "Rt" column)
+      CC_WARNINGS=$(echo "$CC_OUTPUT" | grep "^Warning cnt" | awk '{print $NF}' | tr -d '[:space:]' | sed 's/[^0-9]//g' || true)
+      CC_WARNINGS=${CC_WARNINGS:-0}
+      
+      if [ "$CC_WARNINGS" -gt 0 ]; then
+        echo "$CC_OUTPUT"
+        echo ""
+        echo "❌ BLOCKED - $CC_WARNINGS functions with CCN > $CCN_THRESHOLD found."
+        echo "Refactor high-complexity functions to keep below $CCN_THRESHOLD complexity."
+        exit 1
+      else
+        echo "✅ PASSED - All functions within complexity threshold ($CCN_THRESHOLD)."
+        GATE_3_STATUS="PASS"
+      fi
+    else
+      echo "⏭️  SKIPPED - Complexity (no source files to check)."
+      GATE_3_STATUS="SKIP"
+    fi
+  else
+    echo "⚠️  WARN - lizard not installed, complexity check not performed"
+    echo "   Install with: pip install --user lizard"
+    echo "   Gate 3: Complexity check (WARN, tool not available)"
+    GATE_3_STATUS="WARN"
+  fi
+fi
+record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "${CC_WARNINGS:-0}" "$GATE_3_START"

package/adapters/gate-4.sh

@@ -0,0 +1,80 @@
+# ============================================================================
+# GATE 4: Principles Checker (Clean Code + SOLID)
+# Reuses existing principles checker logic
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 4: Principles checker (Clean Code + SOLID)..."
+GATE_4_START=$(gate_start_ms)
+
+GATE_4_STATUS=""
+
+if [ "$PROJECT_LANG" = "documentation-only" ]; then
+  echo "⏭️  SKIPPED - Principles check (documentation project)."
+  GATE_4_STATUS="SKIP"
+  
+else
+  # Get source files to check against principles
+  PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm)$' || true)
+  
+  if [ -n "$PRINCIPLES_FILES" ]; then
+    # Check for principles checker in installed modules first, then project src/
+    PRINCIPLES_DIR=""
+    if [ -d ".xp-gate/modules/principles" ]; then
+      PRINCIPLES_DIR=".xp-gate/modules/principles"
+    elif [ -f "src/principles/index.ts" ]; then
+      PRINCIPLES_DIR="src/principles"
+    elif [ -d "$HOME/.config/xp-gate/modules/principles" ]; then
+      PRINCIPLES_DIR="$HOME/.config/xp-gate/modules/principles"
+    fi
+    
+    if [ -n "$PRINCIPLES_DIR" ]; then
+      echo "Checking Clean Code + SOLID principles..."
+      
+      if command -v npx > /dev/null 2>&1; then
+        # Run principles checker and store results
+        if npx tsx $PRINCIPLES_DIR/index.ts --files $PRINCIPLES_FILES --format json > /tmp/principles-output.json 2>/dev/null; then
+          # Check severity levels
+          ERROR_COUNT=$(grep -c '"severity":"error"' /tmp/principles-output.json 2>/dev/null || true)
+          ERROR_COUNT=${ERROR_COUNT:-0}
+          WARNING_COUNT=$(grep -c '"severity":"warning"' /tmp/principles-output.json 2>/dev/null || true)
+          WARNING_COUNT=${WARNING_COUNT:-0}
+          
+          if [ "$ERROR_COUNT" -gt 0 ]; then
+            echo ""
+            echo "❌ BLOCKED - $ERROR_COUNT principle ERROR(S) found"
+            echo "Critical violations must be fixed before commit:"
+            echo "  - error-handling violations"
+            echo "  - SOLID principle violations"
+            echo "  - architectural violations"
+            npx tsx $PRINCIPLES_DIR/index.ts --files $PRINCIPLES_FILES --format console
+            GATE_4_STATUS="FAIL"
+            exit 1
+          fi
+          
+          echo "✅ PASSED - Principles checker (no errors found)."
+          GATE_4_STATUS="PASS"
+          if [ "$WARNING_COUNT" -gt 0 ]; then
+            echo "ℹ️  $WARNING_COUNT warnings found (will be handled by Boy Scout Rule)."
+          fi
+        else
+          echo "⚠️  Warning: Principles checker execution failed"
+          echo "⏭️  SKIPPED - Principles check (execution issue)"
+          GATE_4_STATUS="SKIP"
+        fi
+      else
+        echo "ℹ️  npx not available - skipping principles check"
+        echo "⏭️  SKIPPED - Principles check (no Node.js/npx)"
+        GATE_4_STATUS="SKIP"
+      fi
+    else
+      echo "ℹ️  Principles checker not found in project - skipping"
+      echo "⏭️  SKIPPED - Principles check (checker not in project)"
+      GATE_4_STATUS="SKIP"
+    fi
+  else
+    echo "⏭️  SKIPPED - Principles check (no matching source files changed)"
+    GATE_4_STATUS="SKIP"
+  fi
+fi
+record_gate_audit "gate-4" "principles" "$GATE_4_STATUS" "${WARNING_COUNT:-0}" "$GATE_4_START"

package/adapters/gate-7.sh

@@ -0,0 +1,45 @@
+# ============================================================================
+# GATE 7: IaC Security Scanning (Terraform, Kubernetes, Docker)
+# Detects security issues in Infrastructure as Code files
+# Tools: checkov (recommended), hadolint, kube-score, tflint
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 7: IaC Security Scanning (Terraform, Kubernetes, Docker)..."
+GATE_7_START=$(gate_start_ms)
+
+# Check if any IaC files are changed
+IAC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E "\.(tf|yaml|yml)$|Dockerfile" || true)
+if [ -z "$IAC_FILES" ]; then
+  echo "✅ PASSED - No IaC files detected in changes."
+  GATE_7_STATUS="PASS"
+else
+  # Run IaC adapter
+  if [ -f "githooks/adapters/iac.sh" ]; then
+    # shellcheck source=githooks/adapters/iac.sh
+    source "githooks/adapters/iac.sh"
+    
+    # Run static analysis for IaC files
+    IAC_OUTPUT=$(run_static_analysis "$IAC_FILES" 2>&1)
+    IAC_EXIT=$?
+    
+    echo "$IAC_OUTPUT"
+    
+    if [ $IAC_EXIT -eq 0 ]; then
+      echo "✅ PASSED - IaC security scan."
+      GATE_7_STATUS="PASS"
+    else
+      echo ""
+      echo "❌ BLOCKED - IaC security issues detected"
+      echo "Fix the security issues above before committing."
+      echo "Tip: Install checkov for comprehensive IaC scanning: pip install checkov"
+      GATE_7_STATUS="FAIL"
+      exit 1
+    fi
+  else
+    echo "ℹ️  SKIP - IaC adapter not found"
+    echo "⏭️  SKIPPED - IaC security (no IaC adapter found)"
+    GATE_7_STATUS="SKIP"
+  fi
+fi
+record_gate_audit "gate-7" "iac-security" "$GATE_7_STATUS" "0" "$GATE_7_START"

package/adapters/gate-8.sh

@@ -0,0 +1,56 @@
+# ============================================================================
+# GATE 8: Secret Scanning (gitleaks)
+# Detects secrets (API keys, passwords, tokens) in staged files
+# Tool: gitleaks -- https://github.com/gitleaks/gitleaks
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 8: Secret scanning (gitleaks)..."
+GATE_8_START=$(gate_start_ms)
+
+# Gitleaks availability check
+GITLEAKS_CMD=""
+if command -v gitleaks >/dev/null 2>&1; then
+  GITLEAKS_CMD="gitleaks"
+elif [ -f "$HOME/.local/bin/gitleaks" ]; then
+  GITLEAKS_CMD="$HOME/.local/bin/gitleaks"
+fi
+
+if [ -n "$GITLEAKS_CMD" ]; then
+  GITLEAKS_CONFIG=""
+  if [ -f ".gitleaks.toml" ]; then
+    GITLEAKS_CONFIG="--config=.gitleaks.toml"
+  fi
+
+  # Run gitleaks on staged changes only (pre-commit mode for speed)
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --pre-commit --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path=/tmp/gitleaks-report.json 2>&1)
+  GITLEAKS_EXIT=$?
+
+  if [ "$GITLEAKS_EXIT" -eq 0 ]; then
+    echo "     ✅ PASSED - No secrets detected."
+    GATE_8_STATUS="PASS"
+  elif [ "$GITLEAKS_EXIT" -eq 1 ]; then
+    # Secrets found — output details
+    echo "$GITLEAKS_OUTPUT"
+    echo ""
+    echo "❌ BLOCKED - Secrets detected in staged files."
+    echo ""
+    echo "Remediation options:"
+    echo "  1. Remove the secret and use environment variables instead"
+    echo "  2. Add a false positive to .gitleaks.toml allowlist"
+    echo "  3. Use git secret or vault for sensitive data"
+    echo ""
+    echo "See: https://github.com/gitleaks/gitleaks"
+    exit 1
+  else
+    echo "     ⚠️  gitleaks exited with code $GITLEAKS_EXIT - skipping gate"
+    echo "     ✅ Secret Scanning (SKIP, gitleaks error)"
+    GATE_8_STATUS="SKIP"
+  fi
+else
+  echo "     ℹ️  gitleaks not installed — secret scanning unavailable"
+  echo "     Install: brew install gitleaks (macOS) | winget install gitleaks (Windows) | scripts/install-gitleaks.sh (Linux)"
+  echo "     ⏭️  SKIPPED - Secret scanning (gitleaks not installed)"
+  GATE_8_STATUS="SKIP"
+fi
+record_gate_audit "gate-8" "secret-scanning" "$GATE_8_STATUS" "0" "$GATE_8_START"

package/adapters/gate-9.sh

@@ -0,0 +1,104 @@
+# ============================================================================
+# GATE 9: Semgrep SAST Security Scan
+# Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
+# Tool: semgrep -- https://semgrep.dev
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 9: Semgrep SAST Security Scan..."
+GATE_9_START=$(gate_start_ms)
+
+GATE_9_STATUS=""
+
+# Semgrep availability check
+SEMGREP_CMD=""
+if command -v semgrep >/dev/null 2>&1; then
+  SEMGREP_CMD="semgrep"
+elif [ -f "$HOME/.local/bin/semgrep" ]; then
+  SEMGREP_CMD="$HOME/.local/bin/semgrep"
+fi
+
+if [ -z "$SEMGREP_CMD" ]; then
+  echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
+  echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
+  echo "     Pre-cache rules: semgrep --config=p/security-audit"
+  echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
+  GATE_9_STATUS="WARN"
+else
+  # Get staged files filtered to Semgrep-supported languages
+  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+
+  if [ -z "$SEMGREP_FILES" ]; then
+    echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
+    GATE_9_STATUS="SKIP"
+  else
+    # Run semgrep with JSON output
+    # --config=p/security-audit: explicit security ruleset
+    # --json: machine-readable output
+    # --disable-version-check: skip network call
+    SEMGREP_OUTPUT=$($SEMGREP_CMD scan --config=p/security-audit --json --disable-version-check $SEMGREP_FILES 2>&1)
+    SEMGREP_EXIT=$?
+
+    if [ "$SEMGREP_EXIT" -eq 0 ]; then
+      echo "     ✅ PASSED - No security vulnerabilities found."
+      GATE_9_STATUS="PASS"
+    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
+      # Findings detected - parse JSON to categorize
+      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
+
+      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
+
+      # Extract top finding details
+      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};
+const severity=(extra.severity||'UNKNOWN').toUpperCase();
+const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
+const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
+console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
+}catch(e){console.log('  (Failed to parse semgrep output)');}
+});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+
+      if [ "$CRITICAL_HIGH" -gt 0 ]; then
+        echo ""
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "   GATE 9: Semgrep Security Gate"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
+        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  ❌ BLOCKED — Critical/High vulnerability found"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "$FINDING_DETAILS"
+        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+        GATE_9_STATUS="FAIL"
+        exit 1
+      else
+        echo ""
+        echo "     ✅ PASSED - No critical/high vulnerabilities"
+        if [ "$MEDIUM_LOW" -gt 0 ]; then
+          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
+          echo "$FINDING_DETAILS"
+        fi
+        GATE_9_STATUS="PASS"
+      fi
+    else
+      # semgrep runtime error (timeout, config error, etc.)
+      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
+      GATE_9_STATUS="SKIP"
+    fi
+  fi
+fi
+record_gate_audit "gate-9" "sast-security" "$GATE_9_STATUS" "0" "$GATE_9_START"

package/bin/xp-gate.js

@@ -179,7 +179,7 @@ const COMMANDS = {
     usage: 'xp-gate update-hooks [--global] [--force] [--dry-run] [--no-backup] [--scope hooks|adapters|all]'
   },
   'install': {
-    description: 'One-step install (init + bootstrap + doctor)',
+    description: 'One-step install (init + baseline + bootstrap + doctor --fix)',
     run: subargs => {
       const { install } = require('../lib/install-cmd');
       install(subargs).then(code => process.exit(code));

package/hooks/pre-commit

@@ -174,6 +174,8 @@ echo ""
 # ============================================================================
 # Gate 0: Version Consistency Check (Protected Branches)
 # ============================================================================
+GATE_0_START=$(gate_start_ms)
+GATE_0_STATUS="PASS"
 
 CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
 PROTECTED_BRANCHES="master develop trunk mainline"
@@ -327,6 +329,8 @@ Or use --no-verify (discouraged) or include [skip-version-check] in commit messa
 
 Staged files: $(echo "$STAGED_FILES" | tr '\n' ', ' | sed 's/,$//')
 "
+        GATE_0_STATUS="BLOCK"
+        record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "1" "$GATE_0_START"
         exit 1
       fi
     fi
@@ -336,6 +340,8 @@ else
   echo "✅ PASSED - Gate 0: Version Consistency Check (non-protected branch: $CURRENT_BRANCH)"
 fi
 
+record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "0" "$GATE_0_START"
+
 echo ""
 
 # Get list of changed files
@@ -2345,6 +2351,7 @@ fi
 GATE_9_END=$(date +%s)
 GATE_9_DURATION=$((GATE_9_END - GATE_9_START))
 echo "✅ Gate 9 completed in ${GATE_9_DURATION}s"
+record_gate_audit "gate-9" "build-integrity" "$GATE_9_STATUS" "0" "$GATE_9_START"
 echo ""
 # ============================================================================
 
@@ -2379,6 +2386,7 @@ if [ -n "$SPRINT_GATE_SCRIPT" ]; then
   if ! bash "$SPRINT_GATE_SCRIPT" --pre-commit; then
     GATE_11_STATUS="BLOCK"
     echo "❌ BLOCKED - Gate 11: Sprint Flow Enforcement"
+    record_gate_audit "gate-11" "sprint-flow" "$GATE_11_STATUS" "1" "$GATE_11_START"
     # Sprint gate failure is a hard block — exit immediately
     exit 1
   fi
@@ -2390,6 +2398,7 @@ fi
 GATE_11_END=$(date +%s)
 GATE_11_DURATION=$((GATE_11_END - GATE_11_START))
 echo "✅ Gate 11 completed in ${GATE_11_DURATION}s"
+record_gate_audit "gate-11" "sprint-flow" "$GATE_11_STATUS" "0" "$GATE_11_START"
 echo ""
 # ============================================================================
 

package/lib/__tests__/install-cmd.test.js

@@ -1,41 +1,6 @@
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-
 describe('install-cmd', () => {
-  let tmpDir;
-  let consoleLogSpy;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-install-'));
-    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    vi.resetModules();
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-    vi.restoreAllMocks();
-  });
-
   it('exports install function', () => {
     const { install } = require('../install-cmd');
     expect(typeof install).toBe('function');
   });
-
-  it('install accepts --global flag', async () => {
-    const { install } = require('../install-cmd');
-    const code = await install(['--global'], tmpDir);
-    expect(typeof code).toBe('number');
-  });
-
-  it('install runs without --global (local mode) in git repo', async () => {
-    // Simulate git repo
-    const gitDir = path.join(tmpDir, '.git');
-    fs.mkdirSync(gitDir, { recursive: true });
-    fs.mkdirSync(path.join(gitDir, 'hooks'), { recursive: true });
-
-    const { install } = require('../install-cmd');
-    const code = await install([], tmpDir);
-    expect(typeof code).toBe('number');
-  });
 });

package/lib/doctor-tui.js

@@ -0,0 +1,198 @@
+/**
+ * TUI registration and installed-skills diagnostics for doctor.
+ * Extracted from doctor.js to keep file size under the large-file threshold.
+ */
+const fs = require('fs');
+const path = require('path');
+const { HOME_DIR, detectPlatform } = require('./shared-paths.js');
+
+// npm package source dir (template hooks/adapters)
+const PKG_DIR = path.dirname(__dirname);
+
+/**
+ * TUI registration path and expected plugin entry.
+ */
+const TUI_JSON_PATH = path.join(HOME_DIR, '.config', 'opencode', 'tui.json');
+const TUI_PLUGIN_ENTRY = '@boyingliu01/opencode-plugin/tui';
+
+/**
+ * Read and parse tui.json, returning { data, error }.
+ * data = parsed object on success, null on file missing, undefined on corrupt.
+ */
+function readTuiJson() {
+  if (!fs.existsSync(TUI_JSON_PATH)) return { data: null, error: null };
+  try {
+    const raw = fs.readFileSync(TUI_JSON_PATH, 'utf8');
+    const data = JSON.parse(raw);
+    return { data, error: null };
+  } catch (e) {
+    return { data: undefined, error: `Corrupt JSON: ${e.message}` };
+  }
+}
+
+/**
+ * Check 9: TUI auto-registration in ~/.config/opencode/tui.json.
+ * @returns {number} issue count
+ */
+function diagnoseTuiRegistration(checks) {
+  const { data, error } = readTuiJson();
+
+  if (error) {
+    checks.push({ name: 'TUI registration', status: 'FAIL', detail: error });
+    return 1;
+  }
+
+  if (data === null) {
+    checks.push({ name: 'TUI registration', status: 'FAIL', detail: 'Not registered' });
+    return 1;
+  }
+
+  const plugins = Array.isArray(data.plugin) ? data.plugin : [];
+  if (plugins.includes(TUI_PLUGIN_ENTRY)) {
+    checks.push({ name: 'TUI registration', status: 'PASS', detail: `${TUI_PLUGIN_ENTRY} registered` });
+    return 0;
+  }
+
+  checks.push({ name: 'TUI registration', status: 'FAIL', detail: 'Not registered' });
+  return 1;
+}
+
+/**
+ * Check 9: Installed skills vs package-bundled skills (#332).
+ * Reports WARN for each installed skill whose SKILL.md differs from the bundled version.
+ * @param {object} config
+ * @param {Array} checks
+ * @returns {number} issue count
+ */
+function diagnoseInstalledSkills(config, checks) {
+  const installedSkills = config.installedSkills || {};
+  const skillNames = Object.keys(installedSkills);
+  if (skillNames.length === 0) {
+    checks.push({ name: 'Installed skills', status: 'SKIP', detail: 'No skills installed' });
+    return 0;
+  }
+
+  const bundledSkillsDir = path.join(PKG_DIR, 'skills');
+  if (!fs.existsSync(bundledSkillsDir)) {
+    checks.push({ name: 'Installed skills', status: 'SKIP', detail: 'Package skills dir not found' });
+    return 0;
+  }
+
+  const platform = detectPlatform();
+  let userSkillsDir;
+  if (platform === 'qoder') {
+    userSkillsDir = path.join(HOME_DIR, '.qoder', 'skills');
+  } else if (platform === 'claude-code') {
+    userSkillsDir = path.join(HOME_DIR, '.claude', 'skills');
+  } else {
+    userSkillsDir = path.join(HOME_DIR, '.config', 'opencode', 'skills');
+  }
+
+  let issues = 0;
+  for (const name of skillNames) {
+    const bundledSkillMd = path.join(bundledSkillsDir, name, 'SKILL.md');
+    const userSkillMd = path.join(userSkillsDir, name, 'SKILL.md');
+
+    if (!fs.existsSync(bundledSkillMd)) continue;
+    if (!fs.existsSync(userSkillMd)) {
+      checks.push({ name: `Skill: ${name}`, status: 'FAIL', detail: 'Installed SKILL.md missing' });
+      issues++;
+      continue;
+    }
+
+    const bundledContent = fs.readFileSync(bundledSkillMd, 'utf8');
+    const userContent = fs.readFileSync(userSkillMd, 'utf8');
+    if (bundledContent !== userContent) {
+      checks.push({
+        name: `Skill: ${name}`,
+        status: 'WARN',
+        detail: 'Outdated — run xp-gate update-skill --all',
+      });
+      issues++;
+    } else {
+      checks.push({ name: `Skill: ${name}`, status: 'PASS', detail: 'Up to date' });
+    }
+  }
+
+  return issues;
+}
+
+/**
+ * Fix TUI registration: ensure @boyingliu01/opencode-plugin/tui is in tui.json.
+ * Uses atomic write (tmp + renameSync) for JSON safety.
+ * On corrupt JSON: backup to .corrupt-{timestamp}.bak then rebuild.
+ * Idempotent: skips if already registered.
+ * @returns {boolean} Whether a fix was applied
+ */
+function fixTuiRegistration() {
+  const { data, error } = readTuiJson();
+
+  // Corrupt JSON: backup old file, rebuild from scratch
+  if (error && data === undefined) {
+    const ts = Date.now();
+    const backupPath = `${TUI_JSON_PATH}.corrupt-${ts}.bak`;
+    try {
+      fs.copyFileSync(TUI_JSON_PATH, backupPath);
+      console.log(`  ⚠ TUI config corrupted — backed up to ${backupPath}`);
+    } catch { /* non-critical */ }
+    // Rebuild fresh
+    const dir = path.dirname(TUI_JSON_PATH);
+    fs.mkdirSync(dir, { recursive: true });
+    const newConfig = { plugin: [TUI_PLUGIN_ENTRY] };
+    const tmpPath = `${TUI_JSON_PATH}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify(newConfig, null, 2));
+    fs.renameSync(tmpPath, TUI_JSON_PATH);
+    console.log(`  ✓ Registered ${TUI_PLUGIN_ENTRY} in TUI (rebuilt after corrupt backup)`);
+    return true;
+  }
+
+  // File doesn't exist: create it
+  if (data === null) {
+    const dir = path.dirname(TUI_JSON_PATH);
+    fs.mkdirSync(dir, { recursive: true });
+    const newConfig = { plugin: [TUI_PLUGIN_ENTRY] };
+    const tmpPath = `${TUI_JSON_PATH}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify(newConfig, null, 2));
+    fs.renameSync(tmpPath, TUI_JSON_PATH);
+    console.log(`  ✓ Created TUI config with ${TUI_PLUGIN_ENTRY}`);
+    return true;
+  }
+
+  // File exists, check if plugin already registered (idempotent)
+  const plugins = Array.isArray(data.plugin) ? data.plugin : [];
+  if (plugins.includes(TUI_PLUGIN_ENTRY)) return false;
+
+  // Append plugin entry
+  data.plugin = plugins.concat([TUI_PLUGIN_ENTRY]);
+  const tmpPath = `${TUI_JSON_PATH}.tmp`;
+  fs.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+  fs.renameSync(tmpPath, TUI_JSON_PATH);
+  console.log(`  ✓ Added ${TUI_PLUGIN_ENTRY} to TUI config`);
+  return true;
+}
+
+/**
+ * Wrapper for init.js: ensure TUI is registered without console output.
+ * Returns true if the plugin is already registered or was just added.
+ */
+function ensureTuiRegistration() {
+  const { data } = readTuiJson();
+  if (data === null || data === undefined) {
+    fixTuiRegistration();
+    return;
+  }
+  const plugins = Array.isArray(data.plugin) ? data.plugin : [];
+  if (!plugins.includes(TUI_PLUGIN_ENTRY)) {
+    fixTuiRegistration();
+  }
+}
+
+module.exports = {
+  TUI_JSON_PATH,
+  TUI_PLUGIN_ENTRY,
+  readTuiJson,
+  diagnoseTuiRegistration,
+  diagnoseInstalledSkills,
+  fixTuiRegistration,
+  ensureTuiRegistration,
+};