@boyingliu01/xp-gate 0.15.4 → 0.18.0

package/scripts/__tests__/sync-package-content.test.js

@@ -262,6 +262,56 @@ describe('syncGateScripts', () => {
   });
 });
 
+/**
+ * @test REQ-450 sync-hooks
+ * @intent Verify syncHooks() copies githooks pre-commit, pre-push, adapter-common.sh,
+ *        and lib/ subdirectory to src/npm-package/hooks/
+ * @covers AC-450-01, AC-450-02, AC-450-03, AC-450-04
+ */
+describe('syncHooks', () => {
+  const WORKTREE_PATH = path.resolve(__dirname, '..', '..', '..', '..');
+  const PKG_ROOT = path.join(WORKTREE_PATH, 'src', 'npm-package');
+  const HOOKS_DIR = path.join(PKG_ROOT, 'hooks');
+  const syncScript = path.join(WORKTREE_PATH, 'src', 'npm-package', 'scripts', 'sync-package-content.js');
+  const nodeExe = process.execPath;
+
+  // Ensure hooks are re-synced once before tests run; share the result.
+  let syncOk = false;
+  beforeAll(() => {
+    const result = spawnSync(nodeExe, [syncScript], {
+      cwd: WORKTREE_PATH,
+      stdio: 'pipe',
+      timeout: 15000,
+    });
+    syncOk = result.status === 0;
+    if (!syncOk) {
+      console.error('sync stderr:', result.stderr?.toString() || '(empty)');
+      console.error('sync stdout:', result.stdout?.toString() || '(empty)');
+    }
+  }, 15000);
+
+  it('syncHooks copies pre-commit to hooks dir', () => {
+    expect(syncOk, 'sync script must exit 0').toBe(true);
+    expect(fs.existsSync(path.join(HOOKS_DIR, 'pre-commit')), 'pre-commit must exist').toBe(true);
+  });
+
+  it('syncHooks copies pre-push to hooks dir', () => {
+    expect(syncOk, 'sync script must exit 0').toBe(true);
+    expect(fs.existsSync(path.join(HOOKS_DIR, 'pre-push')), 'pre-push must exist').toBe(true);
+  });
+
+  it('syncHooks copies adapter-common.sh to hooks dir', () => {
+    expect(syncOk, 'sync script must exit 0').toBe(true);
+    expect(fs.existsSync(path.join(HOOKS_DIR, 'adapter-common.sh')), 'adapter-common.sh must exist').toBe(true);
+  });
+
+  it('syncHooks copies lib/now-ms.sh to hooks/lib dir', () => {
+    expect(syncOk, 'sync script must exit 0').toBe(true);
+    const libFile = path.join(HOOKS_DIR, 'lib', 'now-ms.sh');
+    expect(fs.existsSync(libFile), `lib/now-ms.sh must exist in hooks dir: ${libFile}`).toBe(true);
+  });
+});
+
 /**
  * @test REQ-329 adapter-mirror-drift
  * @intent Verify checkAdapterDrift() detects file count and content mismatches

package/scripts/check-mattpocock-license.cjs

@@ -0,0 +1,302 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * C0 License Verification Gate (v0.18.0 Phase C0)
+ *
+ * Verifies that mattpocock/skills ships a permissive (MIT) license before the
+ * 4 built-in Matt Pocock skills (grilling, grill-with-docs, batch-grill-me,
+ * domain-modeling) are packed into the npm distribution. Design doc §6/§12/§16.4:
+ * a confirmed permissive license is a publish blocker; without it the skills
+ * must be clean-room rewritten from the functional spec instead of copied.
+ *
+ * Flow:
+ *   1. Fetch https://raw.githubusercontent.com/mattpocock/skills/main/LICENSE
+ *      (10s timeout, one retry). On success, refresh the offline cache.
+ *   2. On network failure, fall back to the offline cache
+ *      (.xp-gate/mattpocock-license.cache.md).
+ *   3. Validate the text is a compliant MIT license (regex: "MIT License"
+ *      header + grant clause) and record SHA-256 as evidence.
+ *   4. Write a verdict JSON to lib/mattpocock-license-verdict.json.
+ *
+ * Exit codes:
+ *   0  PASS — MIT license confirmed (network or cache)
+ *   1  FAIL — license obtained but NOT a compliant MIT license
+ *   2  MISSING — license could not be obtained at all (triggers clean-room path)
+ *
+ * CLI flags:
+ *   --offline             Skip network; use the offline cache only.
+ *   --refresh             Re-fetch from network and update the cache
+ *                         (default flow already does this; explicit for clarity).
+ *   --force-clean-room    Record a clean-room rewrite decision to
+ *                         .xp-gate/clean-room-decision.json and exit 0 for this
+ *                         publish only (original skill text must NOT be copied).
+ *
+ * Env overrides (used by tests for hermetic execution):
+ *   XPGATE_LICENSE_URL           license URL to fetch
+ *   XPGATE_LICENSE_CACHE         offline cache file path
+ *   XPGATE_LICENSE_VERDICT       verdict JSON output path
+ *   XPGATE_CLEAN_ROOM_DECISION   clean-room decision JSON path
+ *
+ * Zero runtime dependencies (Node built-ins only).
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const https = require('https');
+const http = require('http');
+
+const PKG_ROOT = path.resolve(__dirname, '..');
+const REPO_ROOT = path.resolve(PKG_ROOT, '..', '..');
+
+const DEFAULT_LICENSE_URL = 'https://raw.githubusercontent.com/mattpocock/skills/main/LICENSE';
+const NETWORK_TIMEOUT_MS = 10000;
+const MAX_RETRIES = 1;
+const MAX_REDIRECTS = 3;
+
+const LICENSE_URL = process.env.XPGATE_LICENSE_URL || DEFAULT_LICENSE_URL;
+const CACHE_PATH = process.env.XPGATE_LICENSE_CACHE || path.join(REPO_ROOT, '.xp-gate', 'mattpocock-license.cache.md');
+const VERDICT_PATH = process.env.XPGATE_LICENSE_VERDICT || path.join(PKG_ROOT, 'lib', 'mattpocock-license-verdict.json');
+const CLEAN_ROOM_PATH = process.env.XPGATE_CLEAN_ROOM_DECISION || path.join(REPO_ROOT, '.xp-gate', 'clean-room-decision.json');
+
+const EXIT_PASS = 0;
+const EXIT_FAIL = 1; // license obtained but non-compliant
+const EXIT_MISSING = 2; // license missing/unrecognizable → clean-room path
+
+function sha256(text) {
+  return crypto.createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+/**
+ * Validate that license text is a compliant MIT license.
+ * Regex-based (tolerates copyright-year changes upstream) rather than a fixed
+ * hash, with the SHA-256 recorded separately as tamper evidence.
+ * @param {string} text
+ * @returns {{ valid: boolean, licenseType: string|null, reason: string }}
+ */
+function validateLicense(text) {
+  if (typeof text !== 'string' || text.trim().length === 0) {
+    return { valid: false, licenseType: null, reason: 'license text is empty' };
+  }
+  const hasMitHeader = /MIT License/i.test(text);
+  const hasGrantClause = /Permission is hereby granted, free of charge/i.test(text);
+  const hasNoWarranty = /THE SOFTWARE IS PROVIDED "AS IS"/i.test(text);
+  const hasExpectedCopyright = /Copyright \(c\)\s+\d{4}\s+Matt Pocock/i.test(text);
+
+  if (hasMitHeader && hasGrantClause && hasNoWarranty) {
+    return {
+      valid: true,
+      licenseType: 'MIT',
+      reason: hasExpectedCopyright
+        ? 'MIT License with Matt Pocock copyright notice'
+        : 'MIT License (copyright holder differs from expected "Matt Pocock")',
+    };
+  }
+  return {
+    valid: false,
+    licenseType: null,
+    reason: 'text does not match MIT License terms (missing "MIT License" header, grant clause, or warranty disclaimer)',
+  };
+}
+
+/**
+ * Fetch a URL, following up to MAX_REDIRECTS redirects.
+ * Supports https: and http: (http only used by tests against a local server).
+ * @param {string} url
+ * @param {{ timeoutMs?: number, redirectsLeft?: number }} [options]
+ * @returns {Promise<string>}
+ */
+function fetchUrl(url, options) {
+  const timeoutMs = (options && options.timeoutMs) || NETWORK_TIMEOUT_MS;
+  const redirectsLeft = options && typeof options.redirectsLeft === 'number' ? options.redirectsLeft : MAX_REDIRECTS;
+
+  return new Promise((resolve, reject) => {
+    let mod;
+    if (url.startsWith('https:')) mod = https;
+    else if (url.startsWith('http:')) mod = http;
+    else {
+      reject(new Error(`unsupported URL scheme: ${url}`));
+      return;
+    }
+
+    const req = mod.get(url, (res) => {
+      const status = res.statusCode || 0;
+      if (status >= 300 && status < 400 && res.headers.location && redirectsLeft > 0) {
+        res.resume();
+        const next = new URL(res.headers.location, url).toString();
+        fetchUrl(next, { timeoutMs, redirectsLeft: redirectsLeft - 1 }).then(resolve, reject);
+        return;
+      }
+      if (status !== 200) {
+        res.resume();
+        reject(new Error(`HTTP ${status} for ${url}`));
+        return;
+      }
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(chunk));
+      res.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+      res.on('error', reject);
+    });
+    req.setTimeout(timeoutMs, () => {
+      req.destroy(new Error(`timeout after ${timeoutMs}ms fetching ${url}`));
+    });
+    req.on('error', reject);
+  });
+}
+
+/**
+ * Fetch with one retry after the initial attempt fails.
+ * @param {string} url
+ * @param {number} [retries]
+ * @returns {Promise<string>}
+ */
+async function fetchWithRetry(url, retries) {
+  const attempts = (typeof retries === 'number' ? retries : MAX_RETRIES) + 1;
+  let lastErr;
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      return await fetchUrl(url);
+    } catch (err) {
+      lastErr = err;
+      console.error(`[license-check] network attempt ${attempt}/${attempts} failed: ${err.message}`);
+    }
+  }
+  throw lastErr;
+}
+
+function writeJson(filePath, obj) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(obj, null, 2)}\n`, 'utf8');
+}
+
+function handleForceCleanRoom() {
+  const recordedAt = new Date().toISOString();
+  const decision = {
+    decision: 'clean-room-rewrite',
+    recorded_at: recordedAt,
+    note: 'mattpocock/skills LICENSE missing or non-compliant at publish time. '
+      + 'The 4 built-in skills (grilling, grill-with-docs, batch-grill-me, domain-modeling) '
+      + 'must be clean-room rewritten from the functional spec (interview discipline / '
+      + 'CONTEXT.md+ADR formats / batch decision protocol) — original expression must NOT be copied.',
+  };
+  writeJson(CLEAN_ROOM_PATH, decision);
+  writeJson(VERDICT_PATH, {
+    verdict: 'FAIL',
+    license_type: null,
+    sha256: null,
+    checked_at: recordedAt,
+    source: 'clean-room-decision',
+    clean_room: true,
+  });
+  console.error(`[license-check] clean-room decision recorded: ${CLEAN_ROOM_PATH}`);
+  console.error('[license-check] WARNING: publishing under clean-room override — verbatim skill text must NOT be shipped until the rewrite lands.');
+  process.exit(EXIT_PASS);
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const offline = args.includes('--offline');
+  const refresh = args.includes('--refresh');
+
+  if (args.includes('--force-clean-room')) {
+    handleForceCleanRoom();
+    return;
+  }
+
+  let text = null;
+  let source = null;
+
+  if (offline) {
+    console.error('[license-check] --offline: skipping network fetch');
+  } else {
+    if (refresh) console.error('[license-check] --refresh: re-fetching license from network');
+    try {
+      text = await fetchWithRetry(LICENSE_URL);
+      source = 'network';
+      // Refresh the offline cache on every successful network fetch.
+      try {
+        fs.mkdirSync(path.dirname(CACHE_PATH), { recursive: true });
+        fs.writeFileSync(CACHE_PATH, text, 'utf8');
+        console.error(`[license-check] offline cache updated: ${CACHE_PATH}`);
+      } catch (cacheErr) {
+        console.error(`[license-check] WARN: failed to update offline cache: ${cacheErr.message}`);
+      }
+    } catch (netErr) {
+      console.error(`[license-check] network unavailable: ${netErr.message}`);
+    }
+  }
+
+  if (text === null && fs.existsSync(CACHE_PATH)) {
+    text = fs.readFileSync(CACHE_PATH, 'utf8');
+    source = 'cache';
+    console.error(`[license-check] using offline cache: ${CACHE_PATH}`);
+  }
+
+  const checkedAt = new Date().toISOString();
+
+  if (text === null) {
+    writeJson(VERDICT_PATH, {
+      verdict: 'FAIL',
+      license_type: null,
+      sha256: null,
+      checked_at: checkedAt,
+      source: 'none',
+      error: 'license missing: network fetch failed and no offline cache available',
+    });
+    console.error('[license-check] ERROR: mattpocock/skills LICENSE could not be obtained (network failed, no cache).');
+    console.error('[license-check] This is a publish blocker (design §6 C0 license gate).');
+    console.error('[license-check] Mitigation: start a clean-room rewrite of the 4 built-in skills from the functional spec,');
+    console.error('[license-check]   or run `npm run license-check -- --force-clean-room` to record the clean-room rewrite path for this publish.');
+    process.exit(EXIT_MISSING);
+  }
+
+  const result = validateLicense(text);
+  const digest = sha256(text);
+
+  if (!result.valid) {
+    writeJson(VERDICT_PATH, {
+      verdict: 'FAIL',
+      license_type: result.licenseType,
+      sha256: digest,
+      checked_at: checkedAt,
+      source,
+      reason: result.reason,
+    });
+    console.error(`[license-check] FAIL: ${result.reason}`);
+    console.error(`[license-check] sha256: ${digest} (source: ${source})`);
+    console.error('[license-check] The license is NOT a compliant MIT license — verbatim redistribution of the skills is prohibited.');
+    console.error('[license-check] Mitigation: run `npm run license-check -- --force-clean-room` to record the clean-room rewrite path.');
+    process.exit(EXIT_FAIL);
+  }
+
+  writeJson(VERDICT_PATH, {
+    verdict: 'PASS',
+    license_type: 'MIT',
+    sha256: digest,
+    checked_at: checkedAt,
+    source,
+  });
+  console.error(`[license-check] PASS: MIT License confirmed (${result.reason})`);
+  console.error(`[license-check] sha256: ${digest}`);
+  console.error(`[license-check] source: ${source}`);
+  console.error(`[license-check] verdict written: ${VERDICT_PATH}`);
+  process.exit(EXIT_PASS);
+}
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`[license-check] unexpected error: ${err.message}`);
+    process.exit(EXIT_MISSING);
+  });
+}
+
+module.exports = {
+  validateLicense,
+  sha256,
+  fetchUrl,
+  fetchWithRetry,
+  EXIT_PASS,
+  EXIT_FAIL,
+  EXIT_MISSING,
+};

package/scripts/migrate-audit-anomalies.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * Issue #370: One-time migration to mark existing anomalous audit records.
+ *
+ * Scans .xp-gate/audit.jsonl for entries where duration_ms > max_duration_ms
+ * (default 7200000ms = 2h, configurable via .xp-gate-config.json audit.max_duration_ms)
+ * and adds `duration_anomaly: true` to those entries.
+ *
+ * Original duration_ms values are PRESERVED — never clamped or modified.
+ *
+ * Usage: node src/npm-package/scripts/migrate-audit-anomalies.mjs [--dry-run]
+ */
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { join } from 'path';
+
+const repoRoot = process.cwd();
+const auditPath = join(repoRoot, '.xp-gate', 'audit.jsonl');
+const configPath = join(repoRoot, '.xp-gate-config.json');
+const dryRun = process.argv.includes('--dry-run');
+
+// Read max_duration_ms from config (default 7200000)
+let maxDurationMs = 7200000;
+if (existsSync(configPath)) {
+  try {
+    const config = JSON.parse(readFileSync(configPath, 'utf8'));
+    if (config.audit && typeof config.audit.max_duration_ms === 'number') {
+      maxDurationMs = config.audit.max_duration_ms;
+    }
+  } catch {
+    // Use default
+  }
+}
+
+if (!existsSync(auditPath)) {
+  console.log(`No audit log found at ${auditPath} — nothing to migrate.`);
+  process.exit(0);
+}
+
+const content = readFileSync(auditPath, 'utf8');
+const lines = content.split('\n');
+let markedCount = 0;
+let alreadyMarked = 0;
+const updatedLines = [];
+
+for (const line of lines) {
+  if (!line.trim()) {
+    updatedLines.push(line);
+    continue;
+  }
+  try {
+    const entry = JSON.parse(line);
+    if (entry.duration_ms > maxDurationMs) {
+      if (entry.duration_anomaly === true) {
+        alreadyMarked++;
+      } else {
+        entry.duration_anomaly = true;
+        markedCount++;
+      }
+    }
+    updatedLines.push(JSON.stringify(entry));
+  } catch {
+    // Preserve malformed lines as-is
+    updatedLines.push(line);
+  }
+}
+
+if (dryRun) {
+  console.log(`[DRY RUN] Would mark ${markedCount} records with duration_anomaly: true`);
+  console.log(`[DRY RUN] Already marked: ${alreadyMarked}`);
+  console.log(`[DRY RUN] Threshold: duration_ms > ${maxDurationMs}`);
+} else {
+  writeFileSync(auditPath, updatedLines.join('\n'), 'utf8');
+  console.log(`Migration complete:`);
+  console.log(`  Marked ${markedCount} records with duration_anomaly: true`);
+  console.log(`  Already marked: ${alreadyMarked}`);
+  console.log(`  Threshold: duration_ms > ${maxDurationMs}`);
+  console.log(`  File: ${auditPath}`);
+}

package/scripts/sync-package-content.js

@@ -9,7 +9,11 @@ const REPO_ROOT = path.resolve(PKG_ROOT, '..', '..');
 
 const CORE_SKILLS = [
   'admin-template-guidelines',
+  'batch-grill-me',
   'delphi-review',
+  'domain-modeling',
+  'grill-with-docs',
+  'grilling',
   'improve-codebase-architecture',
   'ralph-loop',
   'sprint-flow',
@@ -172,6 +176,48 @@ function syncAdapters() {
   return copied + gateFiles.length;
 }
 
+function syncHooks() {
+  const SRC = path.join(REPO_ROOT, 'githooks');
+  const DST = path.join(PKG_ROOT, 'hooks');
+  // In-place copy (no rmrf) to avoid race condition with parallel test readers.
+  fs.mkdirSync(DST, { recursive: true });
+
+  const HOOK_FILES = ['pre-commit', 'pre-push', 'adapter-common.sh'];
+  let copied = 0;
+
+  for (const name of HOOK_FILES) {
+    const srcPath = path.join(SRC, name);
+    const dstPath = path.join(DST, name);
+    if (fs.existsSync(srcPath)) {
+      fs.copyFileSync(srcPath, dstPath);
+      copied += 1;
+    }
+  }
+
+  // Copy lib/ subdirectory recursively
+  const libSrc = path.join(SRC, 'lib');
+  const libDst = path.join(DST, 'lib');
+  if (fs.existsSync(libSrc)) {
+    copyDir(libSrc, libDst);
+    copied += 1;
+  }
+
+  // Copy gate-*.sh files from githooks root to hooks/
+  const gateFiles = fs.readdirSync(SRC).filter(f =>
+    f.endsWith('.sh') && (f.startsWith('gate-') || f === 'sprint-gate.sh')
+  );
+  for (const f of gateFiles) {
+    fs.copyFileSync(path.join(SRC, f), path.join(DST, f));
+  }
+  if (gateFiles.length > 0) {
+    console.error(`[sync] hooks/ gate scripts: ${gateFiles.join(', ')}`);
+    copied += gateFiles.length;
+  }
+
+  console.error(`[sync] hooks/ (${copied} entries)`);
+  return copied;
+}
+
 function syncModules(moduleName) {
   const src = path.join(REPO_ROOT, 'src', moduleName);
   const dest = path.join(PKG_ROOT, moduleName);
@@ -406,11 +452,12 @@ function main() {
   const plugins = syncPlugins();
   const scripts = syncScripts();
   const adapters = syncAdapters();
-const principles = syncModules('principles');
-const mutation = syncModules('mutation');
-const mockPolicy = syncModules('mock-policy');
-const buildIntegrity = syncModules('build-integrity');
-console.error(`[sync] done: ${skills} skill(s), ${plugins} plugin(s), ${scripts} script(s), ${adapters} adapter entries, ${principles + mutation + mockPolicy + buildIntegrity} module(s)`);
+  const hooks = syncHooks();
+  const principles = syncModules('principles');
+  const mutation = syncModules('mutation');
+  const mockPolicy = syncModules('mock-policy');
+  const buildIntegrity = syncModules('build-integrity');
+  console.error(`[sync] done: ${skills} skill(s), ${plugins} plugin(s), ${scripts} script(s), ${adapters} adapter entries, ${hooks} hook entries, ${principles + mutation + mockPolicy + buildIntegrity} module(s)`);
   if (skills !== CORE_SKILLS.length) {
     console.error(`[sync] ERROR: expected ${CORE_SKILLS.length} skills, copied ${skills}`);
     process.exit(1);

package/skills/batch-grill-me/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: batch-grill-me
+description: A relentless interview that asks every frontier question at once, round by round.
+disable-model-invocation: true
+---
+
+Interview the user relentlessly until you reach a shared understanding. Map this as a **design tree**: every decision branches into the decisions that hang off it.
+
+Work the tree in **rounds**. The **frontier** is every decision whose prerequisites are already settled — the questions you can ask *now* without guessing at answers you haven't heard yet. Ask the whole frontier in one round: number each question and give your recommended answer. Then wait for the user's answers before the next round.
+
+Each round the user answers reshapes the tree — settled decisions push the frontier outward and unblock questions that depended on them. Recompute the frontier and ask the next round. A question whose answer depends on another question still open in this round belongs to a *later* round, not this one.
+
+Finding *facts* is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it — don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report — ask the rest of the frontier now. The *decisions* are the user's — put each to them and wait.
+
+The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Do not act on it until the user confirms you have reached a shared understanding.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-23
-**Commit:** 884f68c
+**Generated:** 2026-07-25
+**Commit:** 3150b22
 **Branch:** main
-**Version:** 0.15.4.0
+**Version:** 0.18.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.