@boyingliu01/xp-gate 0.15.4 → 0.18.0

package/lib/__tests__/sprint-status-rework.test.js

@@ -0,0 +1,184 @@
+/**
+ * TDD: written RED first (Phase G per design §12)
+ * @test REQ-REWORK-001 Sprint rework rate tracking (#369)
+ * @intent Validate xp-gate sprint-status --rework-check computes rework rate for closed sprints
+ */
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const { execSync } = require('child_process');
+
+const { handleSprintStatus } = require('../sprint-status');
+
+let TMP_DIR;
+let cwdSpy;
+
+function git(cmd, dir) {
+  return execSync(`git ${cmd}`, { cwd: dir || TMP_DIR, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+}
+
+function writeSprintState(state, dir) {
+  const sd = path.join(dir || TMP_DIR, '.sprint-state');
+  fs.mkdirSync(sd, { recursive: true });
+  fs.writeFileSync(path.join(sd, 'sprint-state.json'), JSON.stringify(state, null, 2));
+}
+
+function writeHistoryFile(name, state, dir) {
+  const hd = path.join(dir || TMP_DIR, '.sprint-state', 'sprint-history');
+  fs.mkdirSync(hd, { recursive: true });
+  fs.writeFileSync(path.join(hd, name), JSON.stringify(state, null, 2));
+}
+
+function makeCommit(msg, dir) {
+  const d = dir || TMP_DIR;
+  fs.appendFileSync(path.join(d, 'file.txt'), `${msg}-${Date.now()}\n`);
+  git('add -A', d);
+  git(`commit --no-verify -m "${msg}"`, d);
+}
+
+function daysAgo(n) {
+  return new Date(Date.now() - n * 86400000).toISOString();
+}
+
+beforeAll(() => {
+  TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'rework-test-'));
+  cwdSpy = vi.spyOn(process, 'cwd');
+});
+
+beforeEach(() => {
+  cwdSpy.mockReturnValue(TMP_DIR);
+});
+
+afterAll(() => {
+  cwdSpy.mockRestore();
+  fs.rmSync(TMP_DIR, { recursive: true, force: true });
+});
+
+describe('sprint-status --rework-check (#369)', () => {
+  // TDD: written RED first (G phase per design §12)
+  test('(a) no closed sprints → exit 0 + graceful message', async () => {
+    writeSprintState({
+      _schema_version: 1,
+      id: 'sprint-open',
+      task_description: 'Open sprint',
+      phase: 3,
+      status: 'in_progress',
+      started_at: daysAgo(1),
+      isolation: { worktree_path: null, branch: 'main' },
+      phase_history: [],
+      metrics: {},
+    });
+
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const code = await handleSprintStatus(['--rework-check', '--window-days', '7', '--dir', TMP_DIR]);
+    const output = logSpy.mock.calls.map(c => c.join(' ')).join('\n');
+    logSpy.mockRestore();
+
+    expect(code).toBe(0);
+    expect(output).toContain('No closed sprints within');
+  });
+
+  // TDD: written RED first (G phase per design §12)
+  test('(b) 2 fix / 10 total → rework_rate 0.2, no alert, state file updated', async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rework-b-'));
+    cwdSpy.mockReturnValue(dir);
+
+    git('init', dir);
+    git('config user.email "test@test.com"', dir);
+    git('config user.name "Test"', dir);
+    makeCommit('feat: initial', dir);
+    makeCommit('fix: resolve login bug', dir);
+    makeCommit('fix(auth): handle timeout', dir);
+
+    writeSprintState({
+      _schema_version: 1,
+      id: 'sprint-b',
+      task_description: 'Sprint B',
+      phase: 6,
+      status: 'completed',
+      started_at: daysAgo(9),
+      isolation: { worktree_path: null, branch: 'main' },
+      phase_history: [],
+      metrics: { completed_at: daysAgo(2), total_sprint_commits: 10 },
+    }, dir);
+
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const code = await handleSprintStatus(['--rework-check', '--window-days', '7', '--dir', dir]);
+    const output = logSpy.mock.calls.map(c => c.join(' ')).join('\n');
+    logSpy.mockRestore();
+
+    expect(code).toBe(0);
+    expect(output).toContain('20.0%');
+    expect(output).not.toContain('⚠️');
+
+    const updated = JSON.parse(
+      fs.readFileSync(path.join(dir, '.sprint-state', 'sprint-state.json'), 'utf8')
+    );
+    expect(updated.metrics.rework_rate).toBeCloseTo(0.2, 1);
+
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  // TDD: written RED first (G phase per design §12)
+  test('(c) 5 fix / 10 total → rework_rate 0.5, alert printed', async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rework-c-'));
+    cwdSpy.mockReturnValue(dir);
+
+    git('init', dir);
+    git('config user.email "test@test.com"', dir);
+    git('config user.name "Test"', dir);
+    makeCommit('fix: one', dir);
+    makeCommit('fix: two', dir);
+    makeCommit('bugfix: three', dir);
+    makeCommit('hotfix: four', dir);
+    makeCommit('patch: five', dir);
+    makeCommit('feat: six', dir);
+
+    writeSprintState({
+      _schema_version: 1,
+      id: 'sprint-c',
+      task_description: 'Sprint C',
+      phase: 6,
+      status: 'completed',
+      started_at: daysAgo(9),
+      isolation: { worktree_path: null, branch: 'main' },
+      phase_history: [],
+      metrics: { completed_at: daysAgo(2), total_sprint_commits: 10 },
+    }, dir);
+
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const code = await handleSprintStatus(['--rework-check', '--window-days', '7', '--dir', dir]);
+    const output = logSpy.mock.calls.map(c => c.join(' ')).join('\n');
+    logSpy.mockRestore();
+
+    expect(code).toBe(0);
+    expect(output).toContain('50.0%');
+    expect(output).toContain('⚠️');
+    expect(output).toContain('sprint-c');
+
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  // TDD: written RED first (G phase per design §12)
+  test('(d) --window-days 1 filters out sprints closed >1 day ago', async () => {
+    writeHistoryFile('sprint-old.json', {
+      _schema_version: 1,
+      id: 'sprint-old',
+      task_description: 'Old sprint',
+      phase: 6,
+      status: 'completed',
+      started_at: daysAgo(20),
+      isolation: { worktree_path: null, branch: 'main' },
+      phase_history: [],
+      metrics: { completed_at: daysAgo(10), total_sprint_commits: 10 },
+    });
+
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const code = await handleSprintStatus(['--rework-check', '--window-days', '1', '--dir', TMP_DIR]);
+    const output = logSpy.mock.calls.map(c => c.join(' ')).join('\n');
+    logSpy.mockRestore();
+
+    expect(code).toBe(0);
+    expect(output).toContain('No closed sprints within 1 day');
+  });
+});

package/lib/check-version.js

@@ -89,6 +89,15 @@ function readCache() {
 }
 
 function writeCache(latest, publishedAt) {
+  // Validate version before writing — prevent corrupted/non-semver values
+  // from persisting in version-cache.json (e.g. undefined, empty string, placeholders).
+  // Uses 3-digit semver: MAJOR.MINOR.PATCH with optional pre-release tag.
+  const semverRegex = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
+  if (typeof latest !== 'string' || !semverRegex.test(latest)) {
+    console.warn(`[version-cache] Invalid version "${latest}" — not writing to cache`);
+    return;
+  }
+
   const cp = cachePath();
   if (!cp) return;
   ensureDir(path.dirname(cp));

package/lib/doctor-tui.js

@@ -57,9 +57,44 @@ function diagnoseTuiRegistration(checks) {
   return 1;
 }
 
+/**
+ * Extract version from SKILL.md YAML frontmatter (between first --- and second ---).
+ * Returns version string or undefined if no version field found.
+ * @param {string} content - SKILL.md file content
+ * @returns {string|undefined}
+ */
+function extractSkillVersion(content) {
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!match) return undefined;
+  const frontmatter = match[1];
+  const versionMatch = frontmatter.match(/version:\s*(\S+)/);
+  return versionMatch ? versionMatch[1] : undefined;
+}
+
+/**
+ * Compare two semver strings. Returns:
+ *   -1 if a < b, 0 if a == b, 1 if a > b, undefined if either is not valid semver.
+ * @param {string} a
+ * @param {string} b
+ * @returns {number|undefined}
+ */
+function compareSemver(a, b) {
+  const aParts = a.split('.').map(Number);
+  const bParts = b.split('.').map(Number);
+  if (aParts.some(n => isNaN(n)) || bParts.some(n => isNaN(n))) return undefined;
+  for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
+    const na = aParts[i] || 0;
+    const nb = bParts[i] || 0;
+    if (na < nb) return -1;
+    if (na > nb) return 1;
+  }
+  return 0;
+}
+
 /**
  * Check 9: Installed skills vs package-bundled skills (#332).
- * Reports WARN for each installed skill whose SKILL.md differs from the bundled version.
+ * Uses semver version comparison on SKILL.md frontmatter when available;
+ * falls back to byte-for-byte content comparison for skills without version field.
  * @param {object} config
  * @param {Array} checks
  * @returns {number} issue count
@@ -102,15 +137,48 @@ function diagnoseInstalledSkills(config, checks) {
 
     const bundledContent = fs.readFileSync(bundledSkillMd, 'utf8');
     const userContent = fs.readFileSync(userSkillMd, 'utf8');
-    if (bundledContent !== userContent) {
-      checks.push({
-        name: `Skill: ${name}`,
-        status: 'WARN',
-        detail: 'Outdated — run xp-gate update-skill --all',
-      });
-      issues++;
+
+    // Try semver comparison if both SKILL.md files have version frontmatter
+    const bundledVersion = extractSkillVersion(bundledContent);
+    const userVersion = extractSkillVersion(userContent);
+
+    if (bundledVersion !== undefined && userVersion !== undefined) {
+      const cmp = compareSemver(userVersion, bundledVersion);
+      if (cmp === undefined) {
+        // Version strings not valid semver — fall back to byte comparison
+        if (bundledContent !== userContent) {
+          checks.push({
+            name: `Skill: ${name}`,
+            status: 'WARN',
+            detail: `Outdated — run xp-gate update-skill --all (installed: ${userVersion}, bundled: ${bundledVersion})`,
+          });
+          issues++;
+        } else {
+          checks.push({ name: `Skill: ${name}`, status: 'PASS', detail: 'Up to date' });
+        }
+      } else if (cmp < 0) {
+        checks.push({
+          name: `Skill: ${name}`,
+          status: 'WARN',
+          detail: `Outdated — run xp-gate update-skill --all (installed: ${userVersion}, bundled: ${bundledVersion})`,
+        });
+        issues++;
+      } else {
+        // cmp >= 0: installed version is same or newer than bundled
+        checks.push({ name: `Skill: ${name}`, status: 'PASS', detail: 'Up to date' });
+      }
     } else {
-      checks.push({ name: `Skill: ${name}`, status: 'PASS', detail: 'Up to date' });
+      // No version in at least one file — fall back to byte-for-byte comparison
+      if (bundledContent !== userContent) {
+        checks.push({
+          name: `Skill: ${name}`,
+          status: 'WARN',
+          detail: 'Outdated — run xp-gate update-skill --all',
+        });
+        issues++;
+      } else {
+        checks.push({ name: `Skill: ${name}`, status: 'PASS', detail: 'Up to date' });
+      }
     }
   }
 
@@ -195,4 +263,6 @@ module.exports = {
   diagnoseInstalledSkills,
   fixTuiRegistration,
   ensureTuiRegistration,
+  extractSkillVersion,
+  compareSemver,
 };

package/lib/doctor.js

@@ -14,7 +14,7 @@ const {
   getTemplateDir,
 } = require('./shared-paths.js');
 const { checkUpgrade, formatUpgradeMsg } = require('./check-version.js');
-const { GATE_CLI_TOOLS, checkCliTool, getToolInstallCmd } = require('./detect-deps.js');
+const { GATE_CLI_TOOLS, checkCliTool, getToolInstallCmd, checkBash } = require('./detect-deps.js');
 const {
   diagnoseTuiRegistration, diagnoseInstalledSkills,
   fixTuiRegistration, ensureTuiRegistration, readTuiJson,
@@ -156,8 +156,7 @@ function getCurrentHooksPathSync() {
 async function checkEnv(checks) {
   const envChecks = [
     { name: 'Node.js', cmd: 'node --version' },
-    { name: 'Git', cmd: 'git --version' },
-    { name: 'Bash', cmd: 'bash --version' }
+    { name: 'Git', cmd: 'git --version' }
   ];
 
   const results = await Promise.allSettled(
@@ -181,6 +180,19 @@ async function checkEnv(checks) {
     }
   }
 
+  // Bash check uses checkBash() for robust cross-platform detection
+  // (handles Windows Git Bash at common install paths)
+  const bashResult = checkBash();
+  if (bashResult.ok) {
+    const versionStr = bashResult.version
+      ? `GNU bash, version ${bashResult.version} (${bashResult.path})`
+      : `bash found at ${bashResult.path}`;
+    checks.push({ name: 'Environment: Bash', status: 'PASS', detail: versionStr });
+  } else {
+    checks.push({ name: 'Environment: Bash', status: 'FAIL', detail: 'Not found' });
+    allOk = false;
+  }
+
   return allOk;
 }
 

package/lib/gate-audit.ts

@@ -36,6 +36,7 @@ export interface GateAuditEntry {
   trigger: 'commit' | 'push' | 'manual';
   repo_path: string;
   commit_hash: string;
+  duration_anomaly?: boolean; // Issue #370: set when duration_ms > max_duration_ms
 }
 
 // ── Public API ───────────────────────────────────────────────────────────────
@@ -145,14 +146,19 @@ function parseAuditEntries(logPath: string): GateAuditEntry[] {
 /**
  * Aggregate audit entries by gate_id, computing sums for passed/ms/issues.
  */
-function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number; passed: number; ms: number; issues: number }> {
-  const buckets = new Map<string, { total: number; passed: number; ms: number; issues: number }>();
+function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number; passed: number; ms: number; issues: number; anomaly_count: number }> {
+  const buckets = new Map<string, { total: number; passed: number; ms: number; issues: number; anomaly_count: number }>();
 
   for (const e of entries) {
-    const b = buckets.get(e.gate_id) ?? { total: 0, passed: 0, ms: 0, issues: 0 };
+    const b = buckets.get(e.gate_id) ?? { total: 0, passed: 0, ms: 0, issues: 0, anomaly_count: 0 };
     b.total += 1;
     if (e.passed) b.passed += 1;
-    b.ms += e.duration_ms;
+    // Issue #370: exclude anomalous durations from ms aggregation
+    if (e.duration_anomaly === true) {
+      b.anomaly_count += 1;
+    } else {
+      b.ms += e.duration_ms;
+    }
     b.issues += e.issues_found;
     buckets.set(e.gate_id, b);
   }
@@ -165,7 +171,7 @@ function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number
  */
 export function computeStats(
   repoRoot: string = process.cwd(),
-): { gate_id: string; pass_pct: string; avg_ms: number; avg_issues: number }[] {
+): { gate_id: string; pass_pct: string; avg_ms: number; avg_issues: number; anomaly_count: number }[] {
   const logPath = join(repoRoot, AUDIT_DIR, AUDIT_FILE);
   const entries = parseAuditEntries(logPath);
   if (entries.length === 0) {
@@ -174,14 +180,17 @@ export function computeStats(
 
   const buckets = aggregateByGate(entries);
 
-  const results: { gate_id: string; pass_pct: string; avg_ms: number; avg_issues: number }[] = [];
+  const results: { gate_id: string; pass_pct: string; avg_ms: number; avg_issues: number; anomaly_count: number }[] = [];
 
   for (const [gate_id, b] of Array.from(buckets.entries())) {
+    // Issue #370: avg_ms computed only over non-anomalous entries
+    const normalCount = b.total - b.anomaly_count;
     results.push({
       gate_id,
       pass_pct: (b.total > 0 ? ((b.passed / b.total) * 100).toFixed(1) + '%' : 'N/A'),
-      avg_ms: b.total > 0 ? Math.round(b.ms / b.total) : 0,
+      avg_ms: normalCount > 0 ? Math.round(b.ms / normalCount) : 0,
       avg_issues: b.total > 0 ? parseFloat((b.issues / b.total).toFixed(2)) : 0,
+      anomaly_count: b.anomaly_count,
     });
   }
 
@@ -247,6 +256,8 @@ function runCli(): void {
       trigger: (opts['trigger'] as 'commit' | 'push' | 'manual') || 'manual',
       repo_path: process.cwd(),
       commit_hash: getCommitHash(),
+      // Issue #370: only set when explicitly flagged (omit field otherwise)
+      ...(opts['duration-anomaly'] === 'true' ? { duration_anomaly: true } : {}),
     };
     appendAuditEntry(entry);
   } else {

package/lib/gate-runner.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { execSync, execFileSync } = require('child_process');
+const { execSync, execFileSync, spawnSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 
@@ -28,6 +28,54 @@ function runBashScript(scriptPath) {
 // Gate metadata registry — maps gate IDs to names, descriptions, and how to run them.
 // Standalone gates (<gate-id>: { run }) are invokable via xp-gate gate-<id>.
 // Pre-commit-only gates (<gate-id>: { preCommitOnly: true }) run only in git commit context.
+
+/**
+ * Run a TypeScript gate module via npx tsx.
+ * Finds the .ts entry point, spawns tsx with --run flag.
+ * Falls back to bash script if TypeScript module not found.
+ */
+function runTsGate(gateModule, targetPath) {
+  const entry = findTsGateEntry(gateModule);
+  if (!entry) {
+    // Fallback to bash script
+    const script = resolveGateScript(gateModule.replace('gate-', ''));
+    if (script) {
+      runBashScript(script);
+    } else {
+      console.log(`Gate ${gateModule}: TypeScript module not found and no bash fallback available.`);
+    }
+    return 0;
+  }
+
+  const args = ['-y', 'tsx', entry, '--run'];
+  if (targetPath) args.push('--cwd', targetPath);
+
+  const result = spawnSync('npx', args, {
+    stdio: 'inherit',
+    shell: process.platform === 'win32',
+    cwd: targetPath || process.cwd(),
+    timeout: 120000,
+  });
+
+  return result.status === null ? 1 : result.status;
+}
+
+function findTsGateEntry(gateModule) {
+  const candidates = [
+    // Development layout
+    path.resolve(__dirname, '..', '..', '..', 'src', 'gates', `${gateModule}.ts`),
+    // npm package bundled layout
+    path.resolve(__dirname, '..', 'gates', `${gateModule}.ts`),
+    // node_modules install
+    path.resolve(__dirname, '..', '..', 'src', 'gates', `${gateModule}.ts`),
+    // Repo root
+    path.resolve(process.cwd(), 'src', 'gates', `${gateModule}.ts`),
+  ];
+  for (const c of candidates) {
+    if (fs.existsSync(c)) return c;
+  }
+  return null;
+}
 const GATE_REGISTRY = {
   '0': {
     name: 'Version Consistency',
@@ -59,14 +107,7 @@ const GATE_REGISTRY = {
     description: 'lizard cyclomatic complexity analysis',
     aliases: ['complexity', 'ccn', '3'],
     run: (targetPath) => {
-      const script = resolveGateScript('3');
-      if (script) {
-        runBashScript(script);
-      } else {
-        const target = targetPath || '.';
-        console.log(`Running lizard on ${target}...`);
-        execFileSync('lizard', [target, '--CCN', '10', '--length', '50', '--arguments', '5', '--warnings_only'], { stdio: 'inherit', shell: true });
-      }
+      return runTsGate('gate-3', targetPath);
     },
   },
   '4': {
@@ -99,13 +140,7 @@ const GATE_REGISTRY = {
     description: 'Infrastructure-as-Code security scanning (checkov, hadolint, kube-score, tflint)',
     aliases: ['iac', 'infra', '7'],
     run: (targetPath) => {
-      const script = resolveGateScript('7');
-      if (script) {
-        runBashScript(script);
-      } else {
-        console.log('IaC security scan requires git-staged context for changed files detection.');
-        console.log('Run: git commit to trigger Gate 7 automatically.');
-      }
+      return runTsGate('gate-7', targetPath);
     },
   },
   '8': {
@@ -113,13 +148,7 @@ const GATE_REGISTRY = {
     description: 'gitleaks secret and credential detection',
     aliases: ['secrets', 'secret', '8'],
     run: (targetPath) => {
-      const script = resolveGateScript('8');
-      if (script) {
-        runBashScript(script);
-      } else {
-        console.log('Secret scanning requires git-staged context for changed files detection.');
-        console.log('Run: git commit to trigger Gate 8 automatically.');
-      }
+      return runTsGate('gate-8', targetPath);
     },
   },
   '9': {
@@ -127,13 +156,7 @@ const GATE_REGISTRY = {
     description: 'semgrep static application security testing',
     aliases: ['sast', 'semgrep', '9'],
     run: (targetPath) => {
-      const script = resolveGateScript('9');
-      if (script) {
-        runBashScript(script);
-      } else {
-        console.log('SAST scanning requires git-staged context for changed files detection.');
-        console.log('Run: git commit to trigger Gate 9 automatically.');
-      }
+      return runTsGate('gate-9', targetPath);
     },
   },
   '10': {
@@ -150,6 +173,30 @@ const GATE_REGISTRY = {
     preCommitOnly: true,
     reason: 'Requires sprint state (.sprint-state/) and git branch context',
   },
+  'python-health': {
+    name: 'Python Environment Health',
+    description: 'Comprehensive Python environment diagnostics',
+    aliases: ['python-health', 'py-health'],
+    run: (targetPath) => {
+      return runTsGate('python-health', targetPath);
+    },
+  },
+  'test-layers': {
+    name: 'Test Layer Analytics',
+    description: 'Report test distribution across unit/integration/e2e layers',
+    aliases: ['test-layers', 'layers', 'test-analytics'],
+    run: (targetPath) => {
+      return runTsGate('test-layers', targetPath);
+    },
+  },
+  'pbt': {
+    name: 'Property-Based Testing Detection',
+    description: 'Detect PBT framework usage and report coverage',
+    aliases: ['pbt', 'pbt-detect', 'property-based-testing'],
+    run: (targetPath) => {
+      return runTsGate('pbt-detect', targetPath);
+    },
+  },
 };
 
 // Reverse-lookup: alias → gate ID (built once at module load)

package/lib/init.js

@@ -318,6 +318,7 @@ async function init(args) {
   console.log('====================\n');
 
   // Check bash availability (required for shell hooks)
+  console.log('Checking bash availability...');
   const bashCheck = checkBash();
   if (bashCheck.ok) {
     console.log(`Bash: ✓ ${bashCheck.path} (v${bashCheck.version})\n`);
@@ -327,8 +328,10 @@ async function init(args) {
   }
 
   // Check CLI tools availability (quality gates will SKIP silently if tools are missing)
+  console.log('Checking CLI tools...');
   printCliToolStatus();
 
+  console.log('Checking platform dependencies...');
   // Detect platform and check/auto-install dependencies
   const platform = detectPlatform();
   console.log(`Platform: ${platform}\n`);
@@ -534,18 +537,22 @@ async function setupGlobal(args) {
   console.log(`Global hooks: ${GLOBAL_HOOKS_DIR}`);
   console.log(`Global adapters: ${GLOBAL_ADAPTERS_DIR}\n`);
 
+  console.log('[setup-global] Creating global directories...');
   fs.mkdirSync(GLOBAL_HOOKS_DIR, { recursive: true });
   fs.mkdirSync(GLOBAL_ADAPTERS_DIR, { recursive: true });
 
+  console.log('[setup-global] Installing git hooks...');
   copyHooks(srcDir, GLOBAL_HOOKS_DIR);
   console.log('Installing hooks...');
   console.log(`  pre-commit -> ${GLOBAL_HOOKS_DIR}`);
   console.log(`  pre-push -> ${GLOBAL_HOOKS_DIR}`);
 
+  console.log('[setup-global] Installing adapters...');
   copyAdapters(srcDir, GLOBAL_ADAPTERS_DIR);
   console.log(`  adapter-common.sh + adapters -> ${GLOBAL_ADAPTERS_DIR}`);
 
   // Install principles/, mutation/, mock-policy/ to global modules dir
+  console.log('[setup-global] Installing quality gate modules...');
   const globalModulesDir = path.join(CONFIG_DIR, 'modules');
   ['principles', 'mutation', 'mock-policy'].forEach(module => {
     const moduleSrc = path.join(srcDir, module);
@@ -557,6 +564,7 @@ async function setupGlobal(args) {
     }
   });
 
+  console.log('[setup-global] Configuring git...');
   const { execSync } = require('child_process');
   try {
     execSync(`git config --global core.hooksPath "${GLOBAL_HOOKS_DIR}"`);
@@ -567,6 +575,7 @@ async function setupGlobal(args) {
 
   ensureConfigDir();
 
+  console.log('[setup-global] Generating installation manifest...');
   const manifest = generateGlobalManifest(srcDir);
   updateConfig({ lastInit: new Date().toISOString(), mode: 'global', templateDir: TEMPLATE_DIR, manifest });
 
@@ -581,6 +590,7 @@ async function setupGlobal(args) {
   console.log('Per-project adapters can still override by creating <repo>/githooks/');
 
   // Auto-install missing CLI tools (prompt user)
+  console.log('[setup-global] Checking quality gate CLI tools...');
   const autoYes = args.includes('--yes') || args.includes('--auto-install');
   await promptBootstrap(autoYes);
 

package/lib/mattpocock-license-verdict.json

@@ -0,0 +1,7 @@
+{
+  "verdict": "PASS",
+  "license_type": "MIT",
+  "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
+  "checked_at": "2026-07-27T08:49:43.679Z",
+  "source": "network"
+}