@boyingliu01/xp-gate 0.19.3 → 0.20.0

package/hooks/lib/typecheck.sh

@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+
+# Gate 1 TypeScript static analysis — the single place that decides HOW a project
+# is type-checked (#436).
+#
+# Before this file, `githooks/pre-commit` and `githooks/adapters/typescript.sh` each
+# hardcoded `npx tsc --noEmit`. Plain tsc cannot resolve `.vue` single-file
+# components, so every `import X from './Foo.vue'` became a TS2307 and a Vue project
+# whose own `vue-tsc --noEmit` run is clean was blocked on every commit. Because
+# pre-commit runs under `set -o pipefail`, those false findings really did block.
+#
+# Resolution order:
+#   1. GATE_TS_TYPECHECK_CMD        explicit override, same precedent as SKIP_VERSION_CHECK
+#   2. package.json scripts.typecheck
+#   3. package.json scripts.type-check (the name create-vue generates)
+#   4. `npx tsc --noEmit --skipLibCheck` — the pre-#436 behavior, unchanged
+#
+# Return codes follow the gate exit-code contract: 0 clean, 1 findings, 2 checker
+# unavailable (a tool failure must never be read as "no type errors").
+
+resolve_typecheck_command() {
+  if [ -n "${GATE_TS_TYPECHECK_CMD:-}" ]; then
+    printf '%s' "$GATE_TS_TYPECHECK_CMD"
+    return 0
+  fi
+
+  [ -f "package.json" ] || return 1
+  command -v node >/dev/null 2>&1 || return 1
+
+  local declared_script
+  declared_script=$(node -e '
+    let pkg;
+    try {
+      pkg = JSON.parse(require("fs").readFileSync("package.json", "utf8"));
+    } catch {
+      process.exit(0);
+    }
+    const scripts = (pkg && pkg.scripts) || {};
+    if (scripts.typecheck) process.stdout.write("typecheck");
+    else if (scripts["type-check"]) process.stdout.write("type-check");
+  ' 2>/dev/null) || return 1
+
+  [ -n "$declared_script" ] || return 1
+
+  printf 'npm run %s' "$declared_script"
+  return 0
+}
+
+# The #293 extra pass: projects commonly exclude test files from tsconfig.json, so
+# their type errors accumulate silently. Only meaningful for the tsc fallback —
+# a project checker covers the files its own config declares.
+run_test_file_pass() {
+  local has_tests_in_tsc=false
+  if npx tsc --noEmit --skipLibCheck --listFiles 2>/dev/null | grep -qE '__tests__/|\.test\.ts|\.spec\.ts'; then
+    has_tests_in_tsc=true
+  fi
+  [ "$has_tests_in_tsc" = false ] || return 0
+
+  local test_pass_exit=0
+  if [ -f "tsconfig.tests.json" ]; then
+    echo "Checking test files with tsconfig.tests.json..."
+    npx tsc --noEmit --project tsconfig.tests.json 2>&1 | head -30
+    test_pass_exit=${PIPESTATUS[0]}
+  else
+    echo "Checking test files for type errors..."
+    local temp_tsconfig=".tsconfig.withtests.json"
+    node -e "
+      const cfg = JSON.parse(require('fs').readFileSync('tsconfig.json','utf8'));
+      delete cfg.exclude;
+      cfg.include = cfg.include || ['src/**/*'];
+      cfg.include.push('src/**/__tests__/**','src/**/*.test.ts','src/**/*.spec.ts');
+      require('fs').writeFileSync('$temp_tsconfig', JSON.stringify(cfg, null, 2));
+    " 2>/dev/null
+    npx tsc --noEmit --project "$temp_tsconfig" --skipLibCheck 2>&1 | head -30
+    test_pass_exit=${PIPESTATUS[0]}
+    rm -f "$temp_tsconfig"
+  fi
+
+  if [ "$test_pass_exit" -ne 0 ]; then
+    echo ""
+    echo "❌ BLOCKED - TYPE ERRORS in test files"
+    echo "Your project's tsconfig.json excludes test files from type checking."
+    echo "Add a tsconfig.tests.json to customise test file checking."
+    return 1
+  fi
+  return 0
+}
+
+run_typescript_typecheck() {
+  if ! command -v npx >/dev/null 2>&1; then
+    echo "ℹ️  SKIP - npx not available (no TypeScript checker)"
+    return 2
+  fi
+
+  local project_checker
+  if project_checker=$(resolve_typecheck_command); then
+    # Word-split deliberately on the command name only: `npm run <script>` from
+    # package.json, or a user-set GATE_TS_TYPECHECK_CMD. Never a path list.
+    local checker_argv=()
+    read -r -a checker_argv <<< "$project_checker"
+    echo "Running project typecheck (${project_checker})..."
+    "${checker_argv[@]}" 2>&1 | head -30
+    if [ "${PIPESTATUS[0]}" -ne 0 ]; then
+      echo ""
+      echo "❌ BLOCKED - TYPE ERRORS detected by the project's own typecheck script"
+      echo "Fix the type errors above before committing."
+      return 1
+    fi
+    echo "✅ PASSED - project typecheck."
+    return 0
+  fi
+
+  # Verify tsc is the real compiler (npx may fetch the deprecated tsc@2.0.4 placeholder).
+  local tsc_version
+  tsc_version=$(npx tsc --version 2>&1)
+  if ! echo "$tsc_version" | grep -q "Version"; then
+    echo "ℹ️  SKIP - tsc not properly installed ($tsc_version)"
+    echo "Install typescript (npm install typescript --save-dev) for type checking."
+    return 2
+  fi
+
+  if [ ! -f "tsconfig.json" ]; then
+    echo "ℹ️  SKIP - tsconfig.json not found (no TypeScript project config)"
+    return 2
+  fi
+
+  echo "Running TypeScript static analysis ($tsc_version)..."
+  npx tsc --noEmit --skipLibCheck 2>&1 | head -30
+  if [ "${PIPESTATUS[0]}" -ne 0 ]; then
+    echo ""
+    echo "❌ BLOCKED - TYPE ERRORS detected"
+    echo "Fix the type errors above before committing."
+    return 1
+  fi
+  echo "✅ PASSED - TypeScript static analysis."
+
+  if [ -d "src/__tests__" ] || [ -d "src/tests" ] || [ -d "tests" ] || [ -d "__tests__" ]; then
+    run_test_file_pass || return 1
+  fi
+  return 0
+}

package/hooks/lib/validate-code-walkthrough.cjs

@@ -6,6 +6,17 @@ const fs = require('node:fs');
 const REQUIRED_ROLES = ['architecture', 'technical', 'feasibility'];
 const VALIDITY_MS = 60 * 60 * 1000;
 
+/**
+ * Allowed provenance values for an expert record.
+ *
+ * `channel` is an EXPLICIT whitelist. An absent field is rejected rather than
+ * defaulted: treating "missing" as `local` (or as anything else) would be a
+ * zero-cost bypass, since omitting one key would let evidence that never came
+ * from a real model call pass the gate. Only these exact strings are accepted;
+ * casing and whitespace are not normalised.
+ */
+const VALID_CHANNELS = ['external', 'local'];
+
 function fail(message) {
   console.error(`Invalid code walkthrough evidence: ${message}`);
   process.exit(1);
@@ -47,7 +58,7 @@ function parseTimestamp(value, field) {
   return date.getTime();
 }
 
-function validateExpert(expert, index, roles, models) {
+function validateExpert(expert, index, roles, models, resolvedModels) {
   if (!isPlainObject(expert)) fail(`experts[${index}] must be a plain object.`);
   if (!REQUIRED_ROLES.includes(expert.role)) fail(`experts[${index}].role is invalid.`);
   if (roles.has(expert.role)) fail(`expert role ${expert.role} is duplicated.`);
@@ -61,6 +72,22 @@ function validateExpert(expert, index, roles, models) {
     fail(`expert ${expert.role} contains an error or fallback marker.`);
   }
 
+  // Provenance is mandatory and must be an exact whitelist value (#423). Without
+  // this, three hand-written records with distinct model NAMES satisfied the old
+  // check while no model was ever called.
+  if (!VALID_CHANNELS.includes(expert.channel)) {
+    fail(
+      `expert ${expert.role} channel must be one of: ${VALID_CHANNELS.join(', ')}.`
+    );
+  }
+
+  // requested_model is compared EXACTLY (after trimming); resolved_model below is
+  // compared case-INSENSITIVELY. The asymmetry is intentional, not an oversight:
+  // a requested ID is a case-sensitive gateway identifier and AGENTS.md requires
+  // "three distinct trimmed requested model IDs", whereas resolved_model answers
+  // "did these actually run on one model?" -- and gateways do report the same model
+  // with different casing per call, which is how #423 slipped through. Pinned by
+  // scripts/__tests__/gate-mw-provenance.test.cjs (AC-423-08).
   if (typeof expert.requested_model !== 'string' || expert.requested_model.trim() === '') {
     fail(`expert ${expert.role} requested_model must be non-empty.`);
   }
@@ -68,10 +95,18 @@ function validateExpert(expert, index, roles, models) {
   if (models.has(model)) fail(`requested_model ${model} is duplicated.`);
   models.add(model);
 
-  if (expert.resolved_model !== null
-      && (typeof expert.resolved_model !== 'string' || expert.resolved_model.trim() === '')) {
-    fail(`expert ${expert.role} resolved_model must be non-empty or null.`);
+  // `resolved_model` must be a real, DISTINCT model. Previously null was allowed,
+  // so an expert that never resolved a model still counted as successful; and
+  // nothing compared resolved models, so all three could report the same one
+  // while `requested_model` differed.
+  if (typeof expert.resolved_model !== 'string' || expert.resolved_model.trim() === '') {
+    fail(`expert ${expert.role} resolved_model must be a non-empty string.`);
+  }
+  const resolved = expert.resolved_model.trim().toLowerCase();
+  if (resolvedModels.has(resolved)) {
+    fail(`expert ${expert.role} resolved_model ${expert.resolved_model.trim()} is duplicated.`);
   }
+  resolvedModels.add(resolved);
 }
 
 function validateEvidence(evidence, expectedCommit, expectedBranch, now) {
@@ -100,8 +135,11 @@ function validateEvidence(evidence, expectedCommit, expectedBranch, now) {
   }
   const roles = new Set();
   const models = new Set();
+  // Scoped to this validation run, so one document's models cannot leak into the
+  // next (a long-lived process validating several pushes).
+  const resolvedModels = new Set();
   evidence.experts.forEach((expert, index) => {
-    validateExpert(expert, index, roles, models);
+    validateExpert(expert, index, roles, models, resolvedModels);
   });
   if (roles.size !== REQUIRED_ROLES.length) fail('all required expert roles must be present.');
 }

package/hooks/post-merge

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+#
+# post-merge — XP-Gate VERSION sync hook
+#
+# Detects whether VERSION changed during a merge (via ORIG_HEAD comparison)
+# and, if so, runs scripts/sync-version.cjs (cross-platform Node — preferred)
+# or falls back to scripts/sync-version.sh (legacy, kept for compatibility).
+#
+# Safety features:
+#   - Guard file (.xp-gate/.version-synced) prevents infinite loops
+#   - Runtime check (node/bash) before running the sync script
+#   - [skip ci] in auto-commit message to prevent recursive CI triggers
+#   - ORIG_HEAD fallback: if ORIG_HEAD is missing (shallow clone / first commit),
+#     the check is skipped with a warning.
+#
+set -e
+
+PROJECT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo '')"
+if [[ -z "$PROJECT_ROOT" ]]; then
+  # not a git repo — silently exit
+  exit 0
+fi
+
+GUARD_FILE="$PROJECT_ROOT/.xp-gate/.version-synced"
+
+# ── Guard: skip if already synced for this commit ──
+CURRENT_HEAD="$(git rev-parse HEAD 2>/dev/null || echo '')"
+if [[ -f "$GUARD_FILE" ]]; then
+  read -r GUARD_HASH < "$GUARD_FILE" 2>/dev/null || true
+  if [[ "$GUARD_HASH" == "$CURRENT_HEAD" ]]; then
+    # already synced for this commit — skip
+    exit 0
+  fi
+fi
+
+# ── Only proceed if this is an xp-gate project ──
+SYNC_CJS="$PROJECT_ROOT/scripts/sync-version.cjs"
+SYNC_SH="$PROJECT_ROOT/scripts/sync-version.sh"
+if [[ ! -f "$SYNC_CJS" && ! -f "$SYNC_SH" ]]; then
+  exit 0
+fi
+
+# ── ORIG_HEAD check: detect VERSION change during merge ──
+ORIG_HEAD="$(git rev-parse ORIG_HEAD 2>/dev/null || echo '')"
+if [[ -z "$ORIG_HEAD" ]]; then
+  # ORIG_HEAD not available (shallow clone, first commit, or non-merge operation)
+  exit 0
+fi
+
+VERSION_CHANGED=false
+if git diff-tree --name-only -r "$ORIG_HEAD" HEAD 2>/dev/null | grep -q '^VERSION$'; then
+  VERSION_CHANGED=true
+fi
+
+if [[ "$VERSION_CHANGED" != "true" ]]; then
+  # VERSION not changed — zero overhead
+  exit 0
+fi
+
+# ── Run sync-version — .cjs preferred (cross-platform, covers more targets) ──
+SYNC_OK=false
+
+if [[ -f "$SYNC_CJS" ]] && command -v node &>/dev/null; then
+  echo "[xp-gate] VERSION changed in merge — running sync-version.cjs..."
+  if node "$SYNC_CJS"; then
+    SYNC_OK=true
+  else
+    echo "[xp-gate] Warning: sync-version.cjs failed — VERSION files may be out of sync." >&2
+  fi
+elif [[ -f "$SYNC_SH" ]]; then
+  # Legacy fallback — the .sh implementation is Unix-only (MSYS path bug on Windows)
+  if ! command -v bash &>/dev/null; then
+    echo "[xp-gate] Warning: bash not found — cannot run sync-version.sh" >&2
+    exit 0
+  fi
+  echo "[xp-gate] VERSION changed in merge — running sync-version.sh (fallback)..."
+  if bash "$SYNC_SH"; then
+    SYNC_OK=true
+  else
+    echo "[xp-gate] Warning: sync-version.sh failed — VERSION files may be out of sync." >&2
+  fi
+else
+  echo "[xp-gate] Warning: node not found — cannot run sync-version.cjs" >&2
+fi
+
+if [[ "$SYNC_OK" == "true" ]]; then
+  # record guard
+  mkdir -p "$(dirname "$GUARD_FILE")"
+  echo "$CURRENT_HEAD" > "$GUARD_FILE"
+  echo "[xp-gate] VERSION synced. Affected files:"
+  echo "  - VERSION"
+  echo "  - package.json (+ src/npm-package/package.json)"
+  echo "  - plugins/{claude-code,opencode,qoder,dsh} manifests"
+  echo "  - src/npm-package/plugins/** mirrors"
+  echo "  - AGENTS.md headers (date/commit/branch/version)"
+  echo "[skip ci]"
+  echo "Run 'git add' and 'git commit' to commit these changes."
+fi
+
+exit 0