@boyingliu01/xp-gate 0.19.3 → 0.20.1

package/lib/shared-utils.js

@@ -34,7 +34,7 @@ function readXpGateConfig() {
 }
 
 function copyHooks(srcDir, destDir) {
-  ['pre-commit', 'pre-push'].forEach(hook => {
+  ['pre-commit', 'pre-push', 'post-merge'].forEach(hook => {
     const src = path.join(srcDir, 'hooks', hook);
     const dest = path.join(destDir, hook);
     if (fs.existsSync(src)) {
@@ -64,7 +64,7 @@ function copyAdapters(srcDir, destDir) {
       }
     });
   }
-  const githooksDir = path.resolve(srcDir, '..', '..', '..', 'githooks');
+  const githooksDir = path.resolve(srcDir, '..', '..', 'githooks');
   if (fs.existsSync(githooksDir)) {
     fs.readdirSync(githooksDir).forEach(f => {
       if ((f.startsWith('gate-') || f === 'sprint-gate.sh') && f.endsWith('.sh')) {
@@ -72,6 +72,50 @@ function copyAdapters(srcDir, destDir) {
       }
     });
   }
+  // Gate scripts ship at the package root — sync-package-content.js copies them
+  // from githooks/ during prepack. Installed environments have no repo-level
+  // githooks/, so the package root is the only reliable source.
+  if (fs.existsSync(srcDir)) {
+    fs.readdirSync(srcDir).forEach(f => {
+      if ((f.startsWith('gate-') || f === 'sprint-gate.sh') && f.endsWith('.sh')) {
+        fs.copyFileSync(path.join(srcDir, f), path.join(destDir, f));
+      }
+    });
+  }
+}
+
+/**
+ * The flags each skill command consumes. A flag outside that command's list used
+ * to be dropped silently, so `xp-gate install-skill <name> --offline` — the form
+ * the CLI documented until the bundle-only installer (#416) removed it — exited 0
+ * having done nothing with the flag. Same defect class as the one #488 fixed for
+ * `doctor --sync-hooks`: an ignored option must be answered loudly. A flag that
+ * parses but is never destructured by the handler is ignored too, so the table is
+ * keyed per command (Round 2 architecture MI-04).
+ */
+const SKILL_FLAGS_BY_COMMAND = {
+  'install-skill': ['--verbose', '--force'],
+  'update-skill': ['--verbose', '--all', '--check'],
+  'uninstall-skill': ['--force'],
+};
+
+/**
+ * @param {string[]} args - arguments after the skill name
+ * @param {string} command - the subcommand whose flags are accepted
+ * @returns {{options: Object.<string, boolean>, unknown: string[]}}
+ */
+function parseSkillFlags(args, command) {
+  const options = { verbose: false, force: false, all: false, check: false };
+  const allowed = SKILL_FLAGS_BY_COMMAND[command] || [];
+  const unknown = [];
+  for (const arg of args) {
+    if (!allowed.includes(arg)) {
+      unknown.push(arg);
+      continue;
+    }
+    options[arg.slice(2)] = true;
+  }
+  return { options, unknown };
 }
 
-module.exports = { copyDirRecursive, readXpGateConfig, copyHooks, copyAdapters };
+module.exports = { copyDirRecursive, readXpGateConfig, copyHooks, copyAdapters, SKILL_FLAGS_BY_COMMAND, parseSkillFlags };

package/lib/uninstall.js

@@ -19,6 +19,7 @@ const BACKUP_DIR = path.join(CONFIG_DIR, '.uninstall-backup');
 const SIGNATURES = {
   'pre-commit': 'OpenCode Quality Gates - Pre-Commit Hook',
   'pre-push': 'Pre-push Hook - Code Walkthrough Result Validator',
+  'post-merge': 'XP-Gate VERSION sync hook',
   'adapter-common.sh': 'detect_project_lang()'
 };
 
@@ -201,6 +202,14 @@ function buildPlan(mode) {
         manifestKey: '.git/hooks/pre-push',
         critical: true
       });
+      plan.push({
+        type: 'file',
+        path: path.join(hooksDir, 'post-merge'),
+        signature: SIGNATURES['post-merge'],
+        label: '.git/hooks/post-merge',
+        manifestKey: '.git/hooks/post-merge',
+        critical: true
+      });
       plan.push({
         type: 'file',
         path: path.join(githooksDir, 'adapter-common.sh'),
@@ -489,6 +498,9 @@ async function uninstall(args) {
 
   // Print summary
   console.log('\nUninstall complete');
+  console.log('Note: Qoder Delphi expert agents (.qoder/agents/delphi-*.md) are user-owned files');
+  console.log('      that init never overwrites, so they were left in place — delete them by hand');
+  console.log('      (then restart the Qoder session) if you want them gone.');
   if (hadErrors) {
     console.log('Some items could not be removed. Run doctor for diagnostics.');
   }

package/lib/update-hooks.js

@@ -38,8 +38,8 @@ function getProjectHooksDir() {
 function detectLocalModifications(srcDir, hooksDestDir, adaptersDestDir) {
   const modified = [];
 
-  // Check hook files: pre-commit, pre-push
-  ['pre-commit', 'pre-push'].forEach(hook => {
+  // Check hook files: pre-commit, pre-push, post-merge
+  ['pre-commit', 'pre-push', 'post-merge'].forEach(hook => {
     const srcPath = path.join(srcDir, 'hooks', hook);
     const destPath = path.join(hooksDestDir, hook);
     if (fs.existsSync(destPath) && fs.existsSync(srcPath)) {
@@ -150,7 +150,7 @@ function atomicCopyFile(src, dest, dryRun, noBackup, label) {
 }
 
 /**
- * Copy hook files (pre-commit, pre-push) from package to destination.
+ * Copy hook files (pre-commit, pre-push, post-merge) from package to destination.
  * @param {string} srcDir - Package root directory
  * @param {string} destDir - Destination hooks directory
  * @param {boolean} dryRun
@@ -158,7 +158,7 @@ function atomicCopyFile(src, dest, dryRun, noBackup, label) {
  */
 function copyHooks(srcDir, destDir, dryRun, noBackup) {
   const hooksSrcDir = path.join(srcDir, 'hooks');
-  ['pre-commit', 'pre-push'].forEach(hook => {
+  ['pre-commit', 'pre-push', 'post-merge'].forEach(hook => {
     const src = path.join(hooksSrcDir, hook);
     const dest = path.join(destDir, hook);
     atomicCopyFile(src, dest, dryRun, noBackup, hook);

package/lib/update-skill.js

@@ -6,7 +6,6 @@ const os = require('os');
 const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir();
 
 const CONFIG_DIR = path.join(HOME, '.config', 'xp-gate');
-const SKILLS_DIR = path.join(HOME, '.config', 'opencode', 'skills');
 
 function handleCheckMode() {
   console.log('Checking for updates...');
@@ -59,12 +58,12 @@ async function updateSkill(name, options = {}) {
 
 async function updateSingleSkill(name, verbose) {
   console.log(`Updating ${name}...`);
-  
-  const targetDir = path.join(SKILLS_DIR, name);
-  if (fs.existsSync(targetDir)) {
-    fs.rmSync(targetDir, { recursive: true });
-  }
-  
+
+  // Everything destructive lives behind installSkill()'s validation: it resolves
+  // the platform skills directory, backs the existing copy up, and only then
+  // replaces it. Deleting here first (#416) wiped the wrong copy on Qoder and
+  // Claude Code, and turned an update of a skill the package no longer carries
+  // into an unrecoverable loss.
   const { installSkill } = require('./install-skill.js');
   const result = await installSkill(name, { force: true, verbose });
   

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-09-24
-**Commit:** 467174d
-**Branch:** main
-**Version:** 0.19.3.0
+**Generated:** 2026-10-08
+**Commit:** unknown
+**Branch:** unknown
+**Version:** 0.20.1.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-09-24
-**Commit:** 467174d
-**Branch:** main
-**Version:** 0.19.3.0
+**Generated:** 2026-10-08
+**Commit:** unknown
+**Branch:** unknown
+**Version:** 0.20.1.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/mutation/__tests__/gate-m.test.ts

@@ -7,8 +7,10 @@
 import { describe, it, expect, vi } from 'vitest';
 import fs from 'fs/promises';
 
-// We need to test parseArgs and filterSourceFiles from gate-m
-// Import the module and test its public interface
+// The REAL filter is under test: the previous local duplicate diverged from
+// gate-m.ts (which is multi-language via registered runners) and could not
+// catch #480 for that exact reason.
+import { filterSourceFiles } from '../gate-m';
 import { detectAITestCharacteristics } from '../detect-ai-test';
 
 /* jscpd:disable */
@@ -56,16 +58,6 @@ function parseArgs(args: string[]): {
 }
 /* jscpd:enable */
 
-function filterSourceFiles(files: string[]): string[] {
-  return files.filter(file => {
-    if (!file.endsWith('.ts')) return false;
-    if (file.endsWith('.test.ts')) return false;
-    if (file.endsWith('.d.ts')) return false;
-    if (file.includes('/adapters/')) return false;
-    return true;
-  });
-}
-
 vi.mock('fs/promises');
 
 describe('gate-m.ts - Mutation Testing Gate', () => {
@@ -126,11 +118,71 @@ describe('gate-m.ts - Mutation Testing Gate', () => {
       expect(result).toEqual(['src/foo.ts']);
     });
 
-    it('should filter out non-TypeScript files', () => {
+    it('should filter out files with no registered runner', () => {
       const files = ['src/foo.ts', 'src/bar.js', 'src/baz.py'];
       const result = filterSourceFiles(files);
 
-      expect(result).toEqual(['src/foo.ts']);
+      // .ts (stryker) and .py (mutmut) have registered runners; .js has none.
+      expect(result).toEqual(['src/foo.ts', 'src/baz.py']);
+    });
+
+    it('should filter out test-tree helpers not named *.test.* (#480)', () => {
+      const files = [
+        'tests/e2e/helpers/e2e-server.ts',
+        'test/fixtures/setup.py',
+        'src/__tests__/harness.ts',
+        'tests\\e2e\\helpers\\e2e-server.ts',
+      ];
+      const result = filterSourceFiles(files);
+
+      expect(result).toEqual([]);
+
+      // The same exclusion inside a list that also carries production source:
+      // `a/b/tests/` is a tree segment, and src/foo.ts must survive next to it.
+      expect(filterSourceFiles(['src/foo.ts', 'a/b/tests/fixture-factory.ts'])).toEqual(['src/foo.ts']);
+    });
+
+    // Round 2 feasibility FC-03: only the test-tree regex read `normalized`, the
+    // `.test.`/`_test.`, Java/Kotlin and /adapters/ checks read the raw path, so a
+    // backslash-delimited path was judged by two different views of one string.
+    it('should judge every exclusion against one separator view of the path (#480)', () => {
+      for (const files of [
+        ['src\\adapters\\router.ts'],
+        ['src\\FooTest.java'],
+        ['src/FooTest.java'],
+        ['src/PaymentTests.kt'],
+        ['src/BillingSpec.kts'],
+        ['src\\helper_test.go'],
+        ['src\\__tests__\\harness.ts'],
+        ['src\\legacy.d.ts'],
+      ]) {
+        expect(filterSourceFiles(files)).toEqual([]);
+      }
+    });
+
+    // The same class as #480: pre-push excludes *.spec.* from the mutation
+    // candidate list, gate-m.ts did not, so the two definitions of "not
+    // production code" already disagreed on spec-named test files.
+    it('should filter out *.spec.* test files, as pre-push already does (#480)', () => {
+      expect(filterSourceFiles(['src/login.spec.ts'])).toEqual([]);
+      expect(filterSourceFiles(['src\\login.spec.ts'])).toEqual([]);
+    });
+
+    it('should not exclude production paths that merely contain "test" as a substring (#480)', () => {
+      // Round 2 technical MN-02 asked whether the tree segment is anchored: it is,
+      // so only a whole path segment named test/tests/__tests__ excludes.
+      const files = [
+        'src/latest/foo.ts',
+        'src/protest/foo.ts',
+        'src/test-utils/foo.ts',
+        'src/mytests/foo.ts',
+        'testing/reporter.ts',
+        'src/test-data.ts',
+        'tests-helper.ts',
+      ];
+      const result = filterSourceFiles(files);
+
+      expect(result).toEqual(files);
     });
 
     it('should return empty array when no source files', () => {

package/mutation/__tests__/mutmut-runner.test.ts

@@ -32,6 +32,61 @@ describe('MutmutRunner', () => {
   let MutmutRunner: typeof import('../runners/mutmut-runner').MutmutRunner;
   let tmpDir: string;
 
+  /**
+   * Wait until the runner has actually spawned the child process.
+   *
+   * `run()` awaits `isAvailable()` when the platform is win32 (the route is
+   * resolved via a version probe), so `spawn` is NOT called synchronously with
+   * `run()`. Calling `stdoutCb` right after `run()` therefore raced on Windows:
+   * the callback had not been captured yet and the test threw
+   * `stdoutCb is not a function`. Linux skipped the await entirely, which is why
+   * CI stayed green while the same suite failed locally.
+   */
+  async function waitForSpawn(): Promise<void> {
+    for (let i = 0; i < 50 && !vi.mocked(spawn).mock.calls.length; i++) {
+      await new Promise(resolve => setTimeout(resolve, 0));
+    }
+  }
+
+  /**
+   * Build a fake child process whose `stdout`/`close` callbacks are captured so a
+   * test can drive them by hand. Shared because every spawn-based test needs the
+   * same shape, and inlining it in each one pushed those callbacks past the
+   * function-length rule.
+   */
+  function mockChildProcess(capture: {
+    stdout?: (cb: (d: Buffer) => void) => void;
+    stderr?: (cb: (d: Buffer) => void) => void;
+    close?: (cb: (code: number | null) => void) => void;
+    /** Run when `close` is subscribed, instead of the test driving it by hand. */
+    onClose?: (emit: { stderr: (d: Buffer) => void; close: (code: number) => void }) => void;
+  }) {
+    let stderrCb: ((d: Buffer) => void) | null = null;
+    let closeCb: ((code: number | null) => void) | null = null;
+    return {
+      stdout: {
+        on: vi.fn((_event: string, cb: (d: Buffer) => void) => capture.stdout?.(cb)),
+      },
+      stderr: {
+        on: vi.fn((_event: string, cb: (d: Buffer) => void) => {
+          stderrCb = cb;
+          capture.stderr?.(cb);
+        }),
+      },
+      on: vi.fn((event: string, cb: (code: number | null) => void) => {
+        if (event !== 'close') return;
+        closeCb = cb;
+        capture.close?.(cb);
+        capture.onClose?.({
+          stderr: d => stderrCb?.(d),
+          close: code => closeCb?.(code),
+        });
+      }),
+      kill: vi.fn(),
+      killed: false,
+    } as unknown as ChildProcess;
+  }
+
   beforeEach(async () => {
     vi.clearAllMocks();
     vi.mocked(execSync).mockReset();
@@ -140,20 +195,12 @@ describe('MutmutRunner', () => {
       let stdoutCb: ((d: Buffer) => void) | null = null;
       let closeCb: ((code: number | null) => void) | null = null;
 
-      const mockChild = {
-        stdout: {
-          on: vi.fn((_event: string, cb: (d: Buffer) => void) => {
-            stdoutCb = cb;
-          }),
-        },
-        stderr: { on: vi.fn() },
-        on: vi.fn((event: string, cb: (code: number | null) => void) => {
-          if (event === 'close') closeCb = cb;
+      vi.mocked(spawn).mockReturnValue(
+        mockChildProcess({
+          stdout: cb => { stdoutCb = cb; },
+          close: cb => { closeCb = cb; },
         }),
-        kill: vi.fn(),
-        killed: false,
-      };
-      vi.mocked(spawn).mockReturnValue(mockChild as unknown as ChildProcess);
+      );
 
       // No existing pyproject.toml
       vi.mocked(existsSync).mockReturnValue(false);
@@ -165,9 +212,11 @@ describe('MutmutRunner', () => {
         cwd: tmpDir,
       });
 
-      // Simulate stdout with emoji progress
+      // Simulate stdout with emoji progress. One wait covers both callbacks --
+      // they are captured by the same spawn invocation.
       const progressOutput =
         '38/38  🎉 9 🫥 29  ⏰ 0  🤔 0  🙁 0  🔇 0  🧙 0\n';
+      await waitForSpawn();
       stdoutCb!(Buffer.from(progressOutput));
       closeCb!(0);
 
@@ -211,6 +260,7 @@ describe('MutmutRunner', () => {
         timeoutMs: 60000,
         cwd: 'C:\\work\\project',
       });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -249,6 +299,7 @@ describe('MutmutRunner', () => {
         timeoutMs: 60000,
         cwd: 'C:\\work\\project',
       });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -285,6 +336,7 @@ describe('MutmutRunner', () => {
         timeoutMs: 60000,
         cwd: 'C:\\work dir\\safe; echo injected',
       });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -320,6 +372,7 @@ describe('MutmutRunner', () => {
       const runner = new MutmutRunner('win32');
       expect(await runner.isAvailable()).toBe(true);
       const promise = runner.run({ files: ['src/main.py'], timeoutMs: 60000, cwd: windowsPath });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -368,6 +421,7 @@ describe('MutmutRunner', () => {
       nativeAvailable = false;
       expect(await runner.isAvailable()).toBe(true);
       const promise = runner.run({ files: ['src/main.py'], timeoutMs: 60000, cwd: 'C:\\repo' });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -489,6 +543,7 @@ describe('MutmutRunner', () => {
       expect(await runner.isAvailable()).toBe(true);
       const promise = runner.run({ files: ['src/main.py'], timeoutMs: 100, cwd: 'C:\\repo' });
       await vi.advanceTimersByTimeAsync(100);
+      await waitForSpawn();
       closeCb!(1);
       const outcome = await promise;
 
@@ -622,26 +677,18 @@ describe('MutmutRunner', () => {
     });
 
     it('should return error message when exit code is non-zero', async () => {
-      let stderrCb: ((d: Buffer) => void) | null = null;
-      const mockChild = {
-        stdout: { on: vi.fn() },
-        stderr: {
-          on: vi.fn((_event: string, cb: (d: Buffer) => void) => {
-            stderrCb = cb;
-          }),
-        },
-        on: vi.fn((event: string, cb: (code: number | null) => void) => {
-          if (event === 'close') {
+      // The stderr line and the non-zero exit must arrive together, so the
+      // factory emits both as soon as the runner subscribes to `close`.
+      vi.mocked(spawn).mockReturnValue(
+        mockChildProcess({
+          onClose: emit => {
             setTimeout(() => {
-              if (stderrCb) stderrCb(Buffer.from('mutation failed'));
-              cb(1);
+              emit.stderr(Buffer.from('mutation failed'));
+              emit.close(1);
             }, 10);
-          }
+          },
         }),
-        kill: vi.fn(),
-        killed: false,
-      };
-      vi.mocked(spawn).mockReturnValue(mockChild as unknown as ChildProcess);
+      );
       vi.mocked(existsSync).mockReturnValue(false);
 
       const runner = new MutmutRunner();
@@ -685,6 +732,7 @@ describe('MutmutRunner', () => {
       });
 
       const output = '20/20  🎉 10 🫥 5  ⏰ 2  🤔 1  🙁 2  🔇 0  🧙 0\n';
+      await waitForSpawn();
       stdoutCb!(Buffer.from(output));
       closeCb!(0);
 
@@ -724,9 +772,11 @@ describe('MutmutRunner', () => {
         cwd: tmpDir,
       });
 
+      await waitForSpawn();
+
       stdoutCb!(Buffer.from('Some random output without emoji\n'));
+      await waitForSpawn();
       closeCb!(0);
-
       const result = await promise;
       expect(result.report).toBeNull();
       expect(result.timedOut).toBe(false);
@@ -760,6 +810,7 @@ describe('MutmutRunner', () => {
       });
 
       const output = '0/0  🎉 0 🫥 0  ⏰ 0  🤔 0  🙁 0  🔇 0  🧙 0\n';
+      await waitForSpawn();
       stdoutCb!(Buffer.from(output));
       closeCb!(0);
 
@@ -789,6 +840,7 @@ describe('MutmutRunner', () => {
         timeoutMs: 60000,
         cwd: tmpDir,
       });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -839,6 +891,7 @@ describe('MutmutRunner', () => {
         timeoutMs: 60000,
         cwd: tmpDir,
       });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -888,6 +941,7 @@ describe('MutmutRunner', () => {
         timeoutMs: 60000,
         cwd: tmpDir,
       });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -905,16 +959,9 @@ describe('MutmutRunner', () => {
   describe('cleanup', () => {
     it('should restore backup after run completes', async () => {
       let closeCb: ((code: number | null) => void) | null = null;
-      const mockChild = {
-        stdout: { on: vi.fn() },
-        stderr: { on: vi.fn() },
-        on: vi.fn((event: string, cb: (code: number | null) => void) => {
-          if (event === 'close') closeCb = cb;
-        }),
-        kill: vi.fn(),
-        killed: false,
-      };
-      vi.mocked(spawn).mockReturnValue(mockChild as unknown as ChildProcess);
+      vi.mocked(spawn).mockReturnValue(
+        mockChildProcess({ close: cb => { closeCb = cb; } }),
+      );
 
       vi.mocked(existsSync).mockImplementation((path) => {
         const p = path.toString();
@@ -939,6 +986,7 @@ describe('MutmutRunner', () => {
         timeoutMs: 60000,
         cwd: tmpDir,
       });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 
@@ -989,6 +1037,7 @@ describe('MutmutRunner', () => {
         timeoutMs: 60000,
         cwd: tmpDir,
       });
+      await waitForSpawn();
       closeCb!(0);
       await promise;
 

package/mutation/__tests__/test-filter-parity.test.ts

@@ -0,0 +1,37 @@
+/**
+ * @test REQ-480
+ * @intent "测试基础设施" 的定义在 githooks/pre-push（bash）与 src/mutation/gate-m.ts
+ *         （TypeScript）各写了一遍，没有共享常量的自然机制；一侧演化后 Gate M 与
+ *         pre-push 会对同一变更集给出不一致裁决（Round 2 架构 MA-02 / 可行性 FC-03）。
+ *         跨语言无法共用函数，退而求其次：把两处文本钉成同一份定义。
+ * @covers AC-480-04
+ */
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+
+const repoRoot = path.resolve(__dirname, '..', '..', '..');
+const prePush = fs.readFileSync(path.join(repoRoot, 'githooks', 'pre-push'), 'utf8');
+const gateM = fs.readFileSync(path.join(repoRoot, 'src', 'mutation', 'gate-m.ts'), 'utf8');
+
+const prePushFilter =
+  prePush.split('\n').find((line) => line.includes('CHANGED_SOURCE_FILES=')) || '';
+
+describe('test-path filter parity between pre-push and gate-m (#480)', () => {
+  it('compares a real filter line, not an empty string', () => {
+    expect(prePushFilter).toContain('grep -v');
+    expect(gateM).toContain('export function filterSourceFiles');
+  });
+
+  it('both sides exclude the same test-tree segments', () => {
+    expect(prePushFilter).toContain('(tests?|__tests__)/');
+    expect(gateM).toContain(String.raw`(^|\/)(tests?|__tests__)\/`);
+  });
+
+  it('both sides exclude declaration files and spec-named tests', () => {
+    expect(prePushFilter).toContain(String.raw`\.d\.ts$`);
+    expect(prePushFilter).toContain(String.raw`\.spec\.`);
+    expect(gateM).toContain("endsWith('.d.ts')");
+    expect(gateM).toContain("includes('.spec.')");
+  });
+});

package/mutation/gate-m.ts

@@ -79,19 +79,32 @@ function parseTimeout(options: GateMOptions, args: string[], i: number): void {
 // ── File filtering: excludes tests, declarations, adapters ──
 // Delegate per-language filtering to a helper.
 
-function filterSourceFiles(files: string[]): string[] {
+export function filterSourceFiles(files: string[]): string[] {
   return files.filter(file => {
     const ext = path.extname(file);
+    // One separator view for every pattern below: the path arrives from the
+    // adapter layer, which on Windows yields backslash-delimited relative paths.
+    const normalized = file.replace(/\\/g, '/');
     // Skip test files
-    if (file.includes('.test.') || file.includes('_test.')) return false;
-    // Skip Java/Kotlin test files: FooTest.java, FooSpec.kt, etc.
-    if (/[A-Z]Test\.(java|kt|kts)$/.test(file)) return false;
-    if (/[A-Z]Tests\.(java|kt|kts)$/.test(file)) return false;
-    if (/[A-Z](IT|Spec)\.(java|kt|kts)$/.test(file)) return false;
+    if (normalized.includes('.test.') || normalized.includes('_test.')) return false;
+    // Skip spec-named test files: the pre-push filter already excludes them, and
+    // a mutant inside a *.spec.ts is scored against a production budget (#480).
+    if (normalized.includes('.spec.')) return false;
+    // Skip test-tree directories: helpers/fixtures/factories there are test
+    // infrastructure judged by the suites that run them, not by mutation
+    // scoring budgeted for production code (#480)
+    if (/(^|\/)(tests?|__tests__)\//.test(normalized)) return false;
+    // Skip Java/Kotlin test files: FooTest.java, FooSpec.kt, etc. Case-sensitive
+    // "Test"/"Spec"/"IT" suffix matching is what the Surefire/Failsafe conventions
+    // actually produce -- `[A-Z]Test\.only` caught MyTest.java but not FooTest.java,
+    // so most test classes stayed in the mutation candidate list.
+    if (/Test\.(java|kt|kts)$/.test(normalized)) return false;
+    if (/Tests\.(java|kt|kts)$/.test(normalized)) return false;
+    if (/(IT|Spec)\.(java|kt|kts)$/.test(normalized)) return false;
     // Skip declaration files
-    if (file.endsWith('.d.ts')) return false;
+    if (normalized.endsWith('.d.ts')) return false;
     // Skip adapter files
-    if (file.includes('/adapters/')) return false;
+    if (normalized.includes('/adapters/')) return false;
     // Skip files with no registered runner
     const runner = resolveRunner(ext);
     return runner !== undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.19.3",
+  "version": "0.20.1",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"
@@ -42,7 +42,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "version": "0.14.31",
+    "version": "0.20.0",
     "license-check": "node scripts/check-mattpocock-license.cjs",
     "prepack": "node scripts/check-mattpocock-license.cjs && node scripts/sync-package-content.js",
     "test": "echo \"Run tests\" && exit 0"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.19.3",
+  "version": "0.20.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {