@boyingliu01/xp-gate 0.19.1 → 0.19.3

package/gate-10.sh

@@ -0,0 +1,105 @@
+# shellcheck shell=bash
+# ============================================================================
+# GATE 10: Semgrep SAST Security Scan
+# Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
+# Tool: semgrep -- https://semgrep.dev
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 10: Semgrep SAST Security Scan..."
+GATE_10_START=$(gate_start_ms)
+
+GATE_10_STATUS=""
+
+# Semgrep availability check
+SEMGREP_CMD=""
+if command -v semgrep >/dev/null 2>&1; then
+  SEMGREP_CMD="semgrep"
+elif [ -f "$HOME/.local/bin/semgrep" ]; then
+  SEMGREP_CMD="$HOME/.local/bin/semgrep"
+fi
+
+if [ -z "$SEMGREP_CMD" ]; then
+  echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
+  echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
+  echo "     Pre-cache rules: semgrep --config=p/security-audit"
+  echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
+  GATE_10_STATUS="WARN"
+else
+  # Get staged files filtered to Semgrep-supported languages
+  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+
+  if [ -z "$SEMGREP_FILES" ]; then
+    echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
+    GATE_10_STATUS="SKIP"
+  else
+    # Run semgrep with JSON output
+    # --config=p/security-audit: explicit security ruleset
+    # --json: machine-readable output
+    # --disable-version-check: skip network call
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "$SEMGREP_FILES" 2>&1)
+    SEMGREP_EXIT=$?
+
+    if [ "$SEMGREP_EXIT" -eq 0 ]; then
+      echo "     ✅ PASSED - No security vulnerabilities found."
+      GATE_10_STATUS="PASS"
+    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
+      # Findings detected - parse JSON to categorize
+      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
+
+      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
+
+      # Extract top finding details
+      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};
+const severity=(extra.severity||'UNKNOWN').toUpperCase();
+const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
+const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
+console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
+}catch(e){console.log('  (Failed to parse semgrep output)');}
+});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+
+      if [ "$CRITICAL_HIGH" -gt 0 ]; then
+        echo ""
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "   GATE 10: Semgrep Security Gate"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
+        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  ❌ BLOCKED — Critical/High vulnerability found"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "$FINDING_DETAILS"
+        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+        GATE_10_STATUS="FAIL"
+        exit 1
+      else
+        echo ""
+        echo "     ✅ PASSED - No critical/high vulnerabilities"
+        if [ "$MEDIUM_LOW" -gt 0 ]; then
+          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
+          echo "$FINDING_DETAILS"
+        fi
+        GATE_10_STATUS="PASS"
+      fi
+    else
+      # semgrep runtime error (timeout, config error, etc.)
+      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
+      GATE_10_STATUS="SKIP"
+    fi
+  fi
+fi
+record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"

package/hooks/pre-commit

@@ -1013,8 +1013,16 @@ else
   else
     # Run Ruff (includes syntax check, linting)
     echo "Running Ruff linting (syntax + lint)..."
-    RUFF_OUTPUT=$(ruff check "$CHANGED_FILES" --output-format json 2>&1)
-    RUFF_EXIT=$?
+    # Filter to *.py (unquoted) like the format/debug gates below; skip ruff
+    # when no Python files are staged so yaml/.gitignore are never parsed.
+    PY_LINT_FILES=$(echo "$CHANGED_FILES" | grep '\.py$' || true)
+    if [ -z "$PY_LINT_FILES" ]; then
+      RUFF_OUTPUT="[]"
+      RUFF_EXIT=0
+    else
+      RUFF_OUTPUT=$(ruff check $PY_LINT_FILES --output-format json 2>&1)
+      RUFF_EXIT=$?
+    fi
     if [ "$RUFF_EXIT" -ne 0 ]; then
       if [ -f ".xp-gate/lint-baseline.json" ] && command -v node &> /dev/null; then
         # Get baseline warnings for changed Python files
@@ -1101,9 +1109,14 @@ else
     
     # Optional: Type checking with mypy
     if command -v mypy &> /dev/null; then
-      echo "Running mypy type checking (optional)..."
-      mypy --ignore-missing-imports $(echo "$CHANGED_FILES" | grep "\.py$" || echo ".") 2>&1 | head -20 | tail -10
-      MYPY_EXIT=$?
+      PY_MYPY_FILES=$(echo "$CHANGED_FILES" | grep "\.py$" || true)
+      if [ -z "$PY_MYPY_FILES" ]; then
+        MYPY_EXIT=0
+      else
+        echo "Running mypy type checking (optional)..."
+        mypy --ignore-missing-imports $PY_MYPY_FILES 2>&1 | head -20 | tail -10
+        MYPY_EXIT=$?
+      fi
       if [ "$MYPY_EXIT" -ne 0 ]; then
         echo ""
         echo "❌ BLOCKED - MYPI TYPE ERRORS detected"
@@ -2565,12 +2578,18 @@ fi
 GATE_11_START=$(date +%s)
 GATE_11_STATUS="PASS"
 
+# BEGIN SPRINT_GATE_SCRIPT RESOLUTION
+# Tier order: GATE_DIR (gate scripts dir) -> repo-root githooks/ -> SCRIPT_DIR
+# (hooks dir; update-hooks installs sprint-gate.sh beside pre-commit/pre-push).
 SPRINT_GATE_SCRIPT=""
 if [ -f "$GATE_DIR/sprint-gate.sh" ]; then
   SPRINT_GATE_SCRIPT="$GATE_DIR/sprint-gate.sh"
 elif [ -f "$(git rev-parse --show-toplevel 2>/dev/null)/githooks/sprint-gate.sh" ]; then
   SPRINT_GATE_SCRIPT="$(git rev-parse --show-toplevel)/githooks/sprint-gate.sh"
+elif [ -f "$SCRIPT_DIR/sprint-gate.sh" ]; then
+  SPRINT_GATE_SCRIPT="$SCRIPT_DIR/sprint-gate.sh"
 fi
+# END SPRINT_GATE_SCRIPT RESOLUTION
 
 if [ -n "$SPRINT_GATE_SCRIPT" ]; then
   if ! bash "$SPRINT_GATE_SCRIPT" --pre-commit; then

package/lib/__tests__/npm-package.test.js

@@ -110,3 +110,28 @@ describe('published adapter-common.sh', () => {
     expect(published).toContain('run_without_git_context');
   });
 });
+
+// ---------- Issue #411: gate scripts must be publishable (doctor parity) ----------
+
+describe('Issue #411: every gate-*.sh at package root is listed in "files"', () => {
+  const GATE_SCRIPT_RE = /^gate-\d+.*\.sh$/;
+
+  it('files array covers all gate scripts present at package root', () => {
+    const rootScripts = fs.readdirSync(pkgDir).filter(f => GATE_SCRIPT_RE.test(f));
+    expect(rootScripts.length).toBeGreaterThan(0);
+    const files = pkg.files || [];
+    const missing = rootScripts.filter(f => !files.includes(f));
+    expect(missing).toEqual([]);
+  });
+
+  it('files array covers doctor EXPECTED_GATE_SCRIPTS', () => {
+    const doctorSrc = fs.readFileSync(path.join(pkgDir, 'lib', 'doctor.js'), 'utf8');
+    const match = doctorSrc.match(/EXPECTED_GATE_SCRIPTS\s*=\s*\[([^\]]*)\]/);
+    expect(match).not.toBeNull();
+    const expected = [...match[1].matchAll(/'([^']+)'/g)].map(m => m[1]);
+    expect(expected).toContain('gate-10.sh');
+    const files = pkg.files || [];
+    const missing = expected.filter(f => !files.includes(f));
+    expect(missing).toEqual([]);
+  });
+});

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-08-30T15:25:50.166Z",
+  "checked_at": "2026-09-24T04:13:16.240Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"
@@ -23,6 +23,7 @@
     "gate-7.sh",
     "gate-8.sh",
     "gate-9.sh",
+    "gate-10.sh",
     "gate-12-file-hygiene.sh",
     "sprint-gate.sh"
   ],

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "xp-gate",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "displayName": "XP-Gate",
-  "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
+  "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {
     "name": "boyingliu01"
   },

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-08-30
-**Commit:** 0848858
+**Generated:** 2026-09-24
+**Commit:** 467174d
 **Branch:** main
-**Version:** 0.19.1.0
+**Version:** 0.19.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "xp-gate",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "displayName": "XP-Gate",
-  "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
+  "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {
     "name": "boyingliu01"
   },