@boyingliu01/xp-gate 0.20.1 → 0.20.2

package/lib/__tests__/doctor-spawn-capability.test.js

@@ -0,0 +1,116 @@
+/**
+ * @test #525 doctor: detect sync-spawn EBUSY (WorkBuddy sandbox) and attribute it
+ * @intent The Spawn capability check reports a WARN with fixed attribution when
+ *   spawnSync fails with EBUSY, PASS when sync spawn works, SKIP on any other
+ *   probe error — and never adds to the issue count (environmental, not a
+ *   defect). execWithTimeout surfaces the same attribution on stderr once
+ *   instead of returning a bare null that reads as "tool missing".
+ * @note Every probe is mocked: a test asserting the real spawn path would
+ *   itself be EBUSY-blocked inside a WorkBuddy session (the very condition
+ *   under test) and green elsewhere — a test that changes verdict with the
+ *   terminal it runs in is not a test.
+ */
+describe('checkSpawnCapability (#525)', () => {
+  let doc;
+  let spawnSpy;
+
+  function loadDoctorWithSpawn(syncImpl) {
+    vi.resetModules();
+    delete require.cache[require.resolve('../doctor')];
+    spawnSpy = vi.spyOn(require('child_process'), 'spawnSync').mockImplementation(syncImpl);
+    doc = require('../doctor');
+    return spawnSpy;
+  }
+
+  afterEach(() => {
+    if (spawnSpy) spawnSpy.mockRestore();
+  });
+
+  it('reports PASS with the node version when sync spawn works', () => {
+    loadDoctorWithSpawn(() => ({ error: null, stdout: 'v22.11.0\n', stderr: '' }));
+    const checks = [];
+    const issues = doc.checkSpawnCapability(checks);
+    expect(issues).toBe(0);
+    expect(checks).toHaveLength(1);
+    expect(checks[0].name).toBe('Spawn capability');
+    expect(checks[0].status).toBe('PASS');
+    expect(checks[0].detail).toContain('v22.11.0');
+  });
+
+  it('reports WARN with fixed attribution on EBUSY and never counts it', () => {
+    loadDoctorWithSpawn(() => ({
+      error: Object.assign(new Error('spawn EBUSY'), { code: 'EBUSY' }),
+      stdout: '',
+      stderr: '',
+    }));
+    const checks = [];
+    const issues = doc.checkSpawnCapability(checks);
+    expect(issues).toBe(0);
+    expect(checks).toHaveLength(1);
+    expect(checks[0].status).toBe('WARN');
+    expect(checks[0].detail).toBe(doc.EBUSY_ATTRIBUTION);
+    // The attribution must name the actual situation, not a vague failure.
+    expect(doc.EBUSY_ATTRIBUTION).toContain('WorkBuddy');
+    expect(doc.EBUSY_ATTRIBUTION).toContain('async child_process.spawn');
+    expect(doc.EBUSY_ATTRIBUTION).toContain('NOT a code or antivirus problem');
+  });
+
+  it('reports SKIP (not a sandbox WARN) on non-EBUSY probe errors', () => {
+    loadDoctorWithSpawn(() => ({
+      error: Object.assign(new Error('permission denied'), { code: 'EACCES' }),
+      stdout: '',
+      stderr: '',
+    }));
+    const checks = [];
+    const issues = doc.checkSpawnCapability(checks);
+    expect(issues).toBe(0);
+    expect(checks[0].status).toBe('SKIP');
+    expect(checks[0].detail).toContain('EACCES');
+  });
+
+  it('probes via process.execPath so PATH differences cannot skew the verdict', () => {
+    const spy = loadDoctorWithSpawn(() => ({ error: null, stdout: 'vX\n', stderr: '' }));
+    doc.checkSpawnCapability([]);
+    expect(spy).toHaveBeenCalled();
+    expect(spy.mock.calls[0][0]).toBe(process.execPath);
+  });
+
+  it('probe failure (thrown) degrades to SKIP instead of crashing doctor', () => {
+    loadDoctorWithSpawn(() => {
+      throw new Error('hostile environment');
+    });
+    const checks = [];
+    const issues = doc.checkSpawnCapability(checks);
+    expect(issues).toBe(0);
+    expect(checks[0].status).toBe('SKIP');
+  });
+});
+
+describe('execWithTimeout EBUSY attribution (#525)', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    delete require.cache[require.resolve('../doctor')];
+  });
+
+  it('emits the attribution on stderr once for repeated EBUSY, never a bare null read', async () => {
+    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const cp = require('child_process');
+    // doctor.js destructures `exec` at require time, so the spy must be in
+    // place BEFORE the fresh require below.
+    const execSpy = vi.spyOn(cp, 'exec').mockImplementation((cmd, opts, cb) => {
+      const callback = typeof opts === 'function' ? opts : cb;
+      setImmediate(() => callback(Object.assign(new Error('busy'), { code: 'EBUSY' })));
+      return { killed: false, exitCode: null, kill() {} };
+    });
+    const doc = require('../doctor');
+
+    await doc.execWithTimeout('anything');
+    await doc.execWithTimeout('anything-again');
+
+    const attrLines = errSpy.mock.calls.filter((c) => String(c[0]).includes('WorkBuddy'));
+    expect(attrLines).toHaveLength(1);
+    expect(String(attrLines[0][0])).toContain('async child_process.spawn');
+    execSpy.mockRestore();
+    errSpy.mockRestore();
+  });
+});

package/lib/__tests__/doctor-tui-skill-freshness.test.js

@@ -72,34 +72,73 @@ describe('doctor-tui skill freshness (#439)', () => {
     expect(check.status).toBe('PASS');
   });
 
-  it('treats a versionless skill as up to date when only line endings differ', () => {
+  /**
+   * AC-439-04: every bundled skill now carries a version, so the versionless
+   * fallback branch is only reachable when the INSTALLED copy lacks one (e.g.
+   * written by an older tool version). Strip the version line to simulate it.
+   */
+  function stripVersion(content) {
+    return content.replace(/^version:[^\n]*\n/m, '');
+  }
+
+  it('treats an installed copy without version as up to date when only line endings differ', () => {
     const bundled = readBundled('grilling');
-    // This is the branch the issue hit for 11 of 12 skills: no version field at all,
-    // so freshness can only be decided by content.
-    expect(bundled).not.toMatch(/^version:/m);
-    installSkill('grilling', flipLineEndings(bundled));
+    // AC-439-04: grilling used to be one of the 11 skills without a version
+    // field; all bundled skills now declare one.
+    expect(bundled).toMatch(/^version:/m);
+    installSkill('grilling', flipLineEndings(stripVersion(bundled)));
     const { check } = runFreshness('grilling');
     expect(check, JSON.stringify(check)).toBeDefined();
     expect(check.status).toBe('PASS');
   });
 
-  // AC-439-02 promises "differences beyond line endings" still report Outdated,
+  // AC-439-02 promises "differences beyond line endings" still report WARN,
   // which means every line-ending convention has to be tolerated, not just CRLF
   // (Round 2 feasibility FC-05: the helper's name already says as much).
   it('treats a lone-CR skill file as up to date too', () => {
     const bundled = readBundled('grilling');
-    installSkill('grilling', bundled.replace(/\r\n/g, '\n').replace(/\n/g, '\r'));
+    installSkill(
+      'grilling',
+      stripVersion(bundled).replace(/\r\n/g, '\n').replace(/\n/g, '\r')
+    );
     const { check } = runFreshness('grilling');
     expect(check, JSON.stringify(check)).toBeDefined();
     expect(check.status).toBe('PASS');
   });
 
-  it('still reports Outdated for a real content difference (anti-vacuity)', () => {
+  it('still reports WARN for a real content difference (anti-vacuity)', () => {
     const bundled = readBundled('grilling');
-    installSkill('grilling', `${flipLineEndings(bundled)}\n## Diverged section\n`);
+    installSkill('grilling', `${flipLineEndings(stripVersion(bundled))}\n## Diverged section\n`);
     const { issues, check } = runFreshness('grilling');
     expect(check.status).toBe('WARN');
-    expect(check.detail).toContain('Outdated');
     expect(issues).toBe(1);
   });
+
+  // AC-439-03: without a version the doctor cannot claim "Outdated", and the
+  // advice must NOT be the destructive `update-skill --all` -- it pulls from
+  // main, which may be older than the installed copy (#439).
+  it('versionless content diff advises manual comparison, never the destructive update', () => {
+    const bundled = readBundled('grilling');
+    installSkill('grilling', `${flipLineEndings(stripVersion(bundled))}\n## Diverged section\n`);
+    const { check } = runFreshness('grilling');
+    expect(check.status).toBe('WARN');
+    expect(check.detail).toContain('Content differs');
+    expect(check.detail).not.toMatch(/update-skill\s+--all/);
+    expect(check.detail).toContain('update-skill'); // the caveat IS mentioned
+  });
+
+  // AC-439-04: the 11 skills that used to fall into the byte-comparison branch
+  // now declare a version, making semver equality the primary freshness path.
+  it('every bundled skill carries a version frontmatter', () => {
+    const skills = fs
+      .readdirSync(bundledSkillsDir, { withFileTypes: true })
+      .filter((d) => d.isDirectory())
+      .map((d) => d.name);
+    expect(skills.length).toBeGreaterThanOrEqual(13);
+    const missing = skills.filter((name) => {
+      const md = path.join(bundledSkillsDir, name, 'SKILL.md');
+      return !/^version:\s*\d+\.\d+\.\d+/m.test(fs.readFileSync(md, 'utf8'));
+    });
+    expect(missing, `skills missing version frontmatter: ${missing.join(', ')}`).toEqual([]);
+  });
 });

package/lib/doctor-tui.js

@@ -87,6 +87,16 @@ function sameContentIgnoringLineEndings(a, b) {
   return normalize(a) === normalize(b);
 }
 
+/**
+ * Drop the frontmatter `version:` line, if any. Version METADATA is not content:
+ * when one side lacks a version, that line alone would otherwise read as a real
+ * content difference and every pre-#439-format installed copy would be flagged
+ * forever (#439).
+ */
+function withoutVersionLine(content) {
+  return content.replace(/^version:[^\n]*\r?\n/m, '');
+}
+
 /**
  * Compare two semver strings. Returns:
  *   -1 if a < b, 0 if a == b, 1 if a > b, undefined if either is not valid semver.
@@ -185,12 +195,20 @@ function diagnoseInstalledSkills(config, checks) {
       }
     } else {
       // No version in at least one file — compare content, but not byte-for-byte:
-      // line endings alone are not evidence of staleness (#439).
-      if (!sameContentIgnoringLineEndings(bundledContent, userContent)) {
+      // line endings alone are not evidence of staleness (#439). And without a
+      // version we cannot call it "Outdated": update-skill pulls from main,
+      // which may be OLDER than what the user has installed, so the advice is
+      // "compare manually", never the destructive update command (#439). The
+      // version line itself is excluded from the comparison -- metadata, not
+      // content.
+      if (!sameContentIgnoringLineEndings(
+        withoutVersionLine(bundledContent),
+        withoutVersionLine(userContent)
+      )) {
         checks.push({
           name: `Skill: ${name}`,
           status: 'WARN',
-          detail: 'Outdated — run xp-gate update-skill --all',
+          detail: 'Content differs and version cannot be determined (missing version frontmatter) — compare manually before running update-skill (it pulls from main, which may be older than the installed copy)',
         });
         issues++;
       } else {

package/lib/doctor.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execSync, spawnSync } = require('child_process');
 const { exec } = require('child_process');
 const util = require('util');
 const execAsync = util.promisify(exec);
@@ -62,10 +62,47 @@ const EXEC_TIMEOUT_MS = 1500;
  */
 const GLOBAL_DIAGNOSIS_TIMEOUT_MS = 10000;
 
+/**
+ * Fixed attribution text for the WorkBuddy-desktop sandbox restriction (#525).
+ *
+ * In a WorkBuddy desktop session, a node process's *synchronous* child-process
+ * calls (spawnSync/execSync) always fail with EBUSY, while async spawn works;
+ * external terminals, CI and git hook chains are unaffected. The interception
+ * layer belongs to the host application, not to xp-gate or any antivirus, so
+ * the only correct response is to name it and point at the working channels.
+ */
+const EBUSY_ATTRIBUTION = 'sync spawn blocked by host sandbox (EBUSY) -- likely WorkBuddy desktop session; '
+  + 'use async child_process.spawn in-session, verify via CI / external terminal / git hook chain. '
+  + 'NOT a code or antivirus problem.';
+
 /**
  * Execute a command with a hard timeout using async exec.
  * Returns { stdout, stderr } on success, null on failure/timeout.
  */
+/**
+ * Dedup scope: one attribution line per *diagnosis* is a diagnosis; one per
+ * check is noise. `diagnoseAsync` resets this, so a long-lived host process
+ * (or a --fix pre/post double run) still attributes each report round (#525 R1).
+ */
+let ebusyAttributionShown = false;
+
+/**
+ * Shared EBUSY attribution printer for BOTH spawn families (#525 R1).
+ *
+ * Note the asymmetry the platform sandbox exhibits: synchronous child-process
+ * calls (execSync/spawnSync) always fail with EBUSY in a WorkBuddy session,
+ * while async spawn/exec currently pass. The sync call sites below are where
+ * the false reds actually come from; the async branch in execWithTimeout is
+ * kept as a defense-in-depth no-op today -- if the sandbox ever widens its
+ * interception, the attribution is already wired.
+ */
+function noteSandboxAttribution(err) {
+  if (err && err.code === 'EBUSY' && !ebusyAttributionShown) {
+    ebusyAttributionShown = true;
+    console.error(`  ⚠ ${EBUSY_ATTRIBUTION}`);
+  }
+}
+
 async function execWithTimeout(cmd, opts = {}) {
   try {
     const { stdout, stderr } = await execAsync(cmd, {
@@ -73,11 +110,54 @@ async function execWithTimeout(cmd, opts = {}) {
       timeout: opts.timeout || EXEC_TIMEOUT_MS,
     });
     return { stdout: stdout.trim(), stderr: stderr.trim() };
-  } catch {
+  } catch (err) {
+    // #525: a bare null here reads as "tool missing" and has already cost a
+    // misdiagnosis round. Name the sandbox once when it is the sandbox.
+    noteSandboxAttribution(err);
     return null;
   }
 }
 
+/**
+ * Probe whether synchronous child-process creation works in this process (#525).
+ *
+ * @param {Array<{name: string, status: string, detail: string}>} checks — mutated
+ * @returns {number} always 0, for assertion convenience in tests only — callers
+ *   MUST ignore it: a sandbox WARN is environmental, never an issue count.
+ *   (`formatDoctorJson` likewise excludes this check from missing_tools.)
+ */
+function checkSpawnCapability(checks) {
+  let result;
+  try {
+    result = spawnSync(process.execPath, ['--version'], {
+      encoding: 'utf8',
+      timeout: EXEC_TIMEOUT_MS,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch (err) {
+    checks.push({ name: 'Spawn capability', status: 'SKIP', detail: `probe could not run: ${err.message}` });
+    return 0;
+  }
+  if (!result.error) {
+    checks.push({
+      name: 'Spawn capability',
+      status: 'PASS',
+      detail: `sync spawn OK (node ${(result.stdout || '').trim() || 'unknown'})`,
+    });
+    return 0;
+  }
+  if (result.error.code === 'EBUSY') {
+    checks.push({ name: 'Spawn capability', status: 'WARN', detail: EBUSY_ATTRIBUTION });
+    // Context for the rest of the report (#525 R1): the sandbox hits every
+    // sync spawn, so sibling FAIL entries ("Not found" et al) may share this
+    // cause instead of being real machine problems.
+    console.error('  ⚠ Other FAIL/WARN entries in this report may share this cause (they run sync spawns too).');
+    return 0;
+  }
+  checks.push({ name: 'Spawn capability', status: 'SKIP', detail: `probe error: ${result.error.code || result.error.message}` });
+  return 0;
+}
+
 function isXpGateFile(filePath, signature) {
   if (!fs.existsSync(filePath)) return false;
   try {
@@ -121,7 +201,8 @@ function getGitDirSync() {
       timeout: EXEC_TIMEOUT_MS,
       stdio: ['pipe', 'pipe', 'pipe'],
     }).trim();
-  } catch {
+  } catch (err) {
+    noteSandboxAttribution(err); // a sync-spawn EBUSY here reads as "not a git repo" otherwise (#525)
     return null;
   }
 }
@@ -144,7 +225,8 @@ function getCurrentHooksPathSync() {
       timeout: EXEC_TIMEOUT_MS,
       stdio: ['pipe', 'pipe', 'pipe'],
     }).trim();
-  } catch {
+  } catch (err) {
+    noteSandboxAttribution(err); // a sync-spawn EBUSY here reads as "hooksPath not set" otherwise (#525)
     return null;
   }
 }
@@ -786,8 +868,10 @@ function defaultProjectGithooks() {
       stdio: ['pipe', 'pipe', 'pipe'],
     }).trim();
     if (toplevel) return path.join(toplevel, 'githooks');
-  } catch {
+  } catch (err) {
     // Not a git repository -- fall back to the directory we were called in.
+    // But an EBUSY is not "not a repository": name the sandbox instead (#525).
+    noteSandboxAttribution(err);
   }
   return path.join(process.cwd(), 'githooks');
 }
@@ -957,8 +1041,10 @@ function printEffectiveHooks() {
       timeout: EXEC_TIMEOUT_MS,
       stdio: ['pipe', 'pipe', 'pipe'],
     }).trim();
-  } catch {
+  } catch (err) {
     // No explicit core.hooksPath -> git falls back to .git/hooks.
+    // But an EBUSY is not "no hooksPath configured": attribute it (#525).
+    noteSandboxAttribution(err);
     configured = '';
   }
 
@@ -1170,6 +1256,13 @@ async function diagnoseAsync() {
   const checks = [];
   let issues = 0;
 
+  // Spawn capability probe FIRST (sync, no config dependency) — #525: it must
+  // report even when the config early-exits below, and its WARN (environmental,
+  // never an issue count) primes the interpretation of every later FAIL. The
+  // attribution dedup scope is one diagnosis, so reset it here.
+  ebusyAttributionShown = false;
+  checkSpawnCapability(checks);
+
   // --- Phase 1: Config-dependent checks (sequential, data dependencies) ---
   const configResult = checkConfig();
   if (configResult.config === null) {
@@ -1183,6 +1276,7 @@ async function diagnoseAsync() {
   issues += diagnoseVersion(config, getPackageVersion(), checks);
   // TemplateDir check (sync, no I/O)
   issues += diagnoseTemplateDir(config, checks);
+  // (Spawn capability probe already ran at the top of diagnoseAsync — #525.)
 
   // --- Phase 2: Fetch gitDir early (needed by hooks and adapters) ---
   const gitDirPromise = getGitDir();
@@ -1459,7 +1553,10 @@ function printReport(checks) {
   console.log('-----------------');
 
   for (const check of checks) {
-    const statusSymbol = check.status === 'PASS' ? ' ✓' : check.status === 'WARN' ? ' ⚠' : ' ✗';
+    // SKIP is "checked, not applicable" — rendering it as the failure symbol
+    // made a healthy machine look broken (#525 R1 touched this via the
+    // Spawn capability probe's SKIP branch).
+    const statusSymbol = check.status === 'PASS' ? ' ✓' : check.status === 'WARN' ? ' ⚠' : check.status === 'SKIP' ? ' –' : ' ✗';
     console.log(`  ${statusSymbol} ${check.name}: ${check.detail}`);
   }
 }
@@ -2235,8 +2332,11 @@ async function doctor(args) {
 }
 
 function formatDoctorJson(checks, issues) {
+  // missing_tools means "installable CLI tool absent" (#525 R1): the Spawn
+  // capability WARN is environmental (host sandbox) and must not appear here,
+  // or machine consumers would read a healthy machine as needing an install.
   const missing_tools = checks
-    .filter(c => c.status === 'WARN' || c.status === 'FAIL')
+    .filter(c => c.name !== 'Spawn capability' && (c.status === 'WARN' || c.status === 'FAIL'))
     .map(c => ({ name: c.name, detail: c.detail }));
   return {
     ok: issues === 0,
@@ -2272,4 +2372,7 @@ module.exports = {
   repoModuleSource,
   contentDelta,
   pathsEquivalent,
+  checkSpawnCapability,
+  execWithTimeout,
+  EBUSY_ATTRIBUTION,
 };

package/lib/gate-audit.ts

@@ -37,6 +37,7 @@ export interface GateAuditEntry {
   repo_path: string;
   commit_hash: string;
   duration_anomaly?: boolean; // Issue #370: set when duration_ms > max_duration_ms
+  detail?: string; // #507: optional gate-specific payload (e.g. effective CCN threshold)
 }
 
 // ── Public API ───────────────────────────────────────────────────────────────
@@ -258,6 +259,8 @@ function runCli(): void {
       commit_hash: getCommitHash(),
       // Issue #370: only set when explicitly flagged (omit field otherwise)
       ...(opts['duration-anomaly'] === 'true' ? { duration_anomaly: true } : {}),
+      // #507: only set when provided (omit field otherwise)
+      ...(opts['detail'] ? { detail: opts['detail'] } : {}),
     };
     appendAuditEntry(entry);
   } else {

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-08T19:51:29.290Z",
+  "checked_at": "2026-10-12T10:19:27.219Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-08
+**Generated:** 2026-10-12
 **Commit:** unknown
 **Branch:** unknown
-**Version:** 0.20.1.0
+**Version:** 0.20.2.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-08
+**Generated:** 2026-10-12
 **Commit:** unknown
 **Branch:** unknown
-**Version:** 0.20.1.0
+**Version:** 0.20.2.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/admin-template-guidelines/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: admin-template-guidelines
+version: 1.0.0
 description: "6 maintainability rules for AI-generated admin interfaces (Fastify + Nunjucks + HTMX + Alpine.js). Prevents route bloat, test inconsistency, Nunjucks traps, repeated data logic, auth blind spots, and HTMX/Alpine confusion."
 maturity: alpha
 ---

package/plugins/claude-code/skills/batch-grill-me/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: batch-grill-me
+version: 1.0.0
 description: A relentless interview that asks every frontier question at once, round by round.
 disable-model-invocation: true
 ---

package/plugins/claude-code/skills/clipboard-vision/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: clipboard-vision
+version: 1.0.0
 description: Use when the user explicitly asks to analyze, describe, OCR, or inspect a single image currently stored in the system clipboard.
 ---
 

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-08
+**Generated:** 2026-10-12
 **Commit:** unknown
 **Branch:** unknown
-**Version:** 0.20.1.0
+**Version:** 0.20.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/domain-modeling/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: domain-modeling
+version: 1.0.0
 description: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.
 ---
 

package/plugins/claude-code/skills/grill-with-docs/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: grill-with-docs
+version: 1.0.0
 description: A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
 disable-model-invocation: true
 ---

package/plugins/claude-code/skills/grilling/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: grilling
+version: 1.0.0
 description: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
 ---
 

package/plugins/claude-code/skills/improve-codebase-architecture/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: improve-codebase-architecture
+version: 1.0.0
 description: Find deepening opportunities in a codebase, informed by domain language in CONTEXT.md and decisions in ADRs. Use when user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more AI-navigable. Run periodically (weekly or after surges of development).
 ---
 

package/plugins/claude-code/skills/ralph-loop/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: ralph-loop
+version: 1.0.0
 description: Use when executing Sprint-Flow Phase 2 BUILD, processing one REQ, building the next requirement, iterating with clean context, or requiring full regression per requirement.
 maturity: stable
 ---

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-08
+**Generated:** 2026-10-12
 **Commit:** unknown
 **Branch:** unknown
-**Version:** 0.20.1.0
+**Version:** 0.20.2.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-driven-development/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: test-driven-development
+version: 1.0.0
 description: Use when implementing any feature or bugfix, before writing implementation code
 ---
 

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-08
+**Generated:** 2026-10-12
 **Commit:** unknown
 **Branch:** unknown
-**Version:** 0.20.1.0
+**Version:** 0.20.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/claude-code/skills/test-specification-alignment/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: test-specification-alignment
+version: 1.0.0
 description: "Use when asked to run tests, verify tests, align tests with specification.yaml, before BUILD verification, or before release/ship."
 ---
 

package/plugins/claude-code/skills/to-issues/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: to-issues
+version: 1.0.0
 description: Break a plan, spec, or PRD into independently-grabbable issues using tracer-bullet vertical slices. Use when user wants to convert a plan into issues, create implementation tickets, or break down work into vertical slices. Integrates with XP-Gate sprint-flow Phase 1.
 ---
 

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",