@boyingliu01/xp-gate 0.23.0 → 0.25.0

package/lib/__tests__/delphi-setup.test.js

@@ -0,0 +1,203 @@
+/**
+ * @test delphi-setup
+ * @intent Guard #414 REQ-4: `xp-gate delphi-setup` is the repair path for
+ * drifted Qoder agent bindings. `xp-gate init` deliberately never overwrites
+ * an existing agent file, so a stale binding could previously never be fixed
+ * without hand-editing. delphi-setup must write three distinct, quoted model
+ * bindings, refuse duplicates and junk, and always demand an IDE reload —
+ * Qoder caches agent definitions at session start, so a skipped reload looks
+ * exactly like a fix that did not work.
+ */
+const fs = require('fs');
+const path = require('path');
+const { resetLibModules, muteConsole, makeTempDirs, removeTempDirs } = require('./helpers/lib-sandbox.cjs');
+
+const LIB_MODULES = ['../init', '../detect-deps.js', '../shared-paths', '../delphi-setup'].map(name => require.resolve(name));
+
+function repoRoot() {
+  return path.join(__dirname, '..', '..', '..', '..');
+}
+
+describe('delphi-setup (#414 REQ-4)', () => {
+  let tmpDirs;
+  let tmpHome;
+  let originalHome;
+
+  beforeEach(() => {
+    tmpDirs = makeTempDirs(['delphi-setup-home']);
+    tmpHome = tmpDirs['delphi-setup-home'];
+    originalHome = process.env.HOME;
+    process.env.HOME = tmpHome;
+    fs.mkdirSync(path.join(tmpHome, '.qoder'), { recursive: true });
+    resetLibModules(vi, LIB_MODULES);
+    muteConsole(vi);
+  });
+
+  afterEach(() => {
+    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+    removeTempDirs(tmpDirs);
+    vi.restoreAllMocks();
+  });
+
+  function agentsDir() {
+    return path.join(tmpHome, '.qoder', 'agents');
+  }
+
+  it('writes three agent files with the requested distinct bindings', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    const code = await delphiSetup([
+      '--model', 'architecture=qwen-max',
+      '--model', 'technical=deepseek-v3.2',
+      '--model', 'feasibility=glm-5.2',
+    ]);
+    expect(code).toBe(0);
+    const { readQoderModelId } = require('../init');
+    expect(readQoderModelId(path.join(agentsDir(), 'delphi-architecture.md'))).toBe('qwen-max');
+    expect(readQoderModelId(path.join(agentsDir(), 'delphi-technical.md'))).toBe('deepseek-v3.2');
+    expect(readQoderModelId(path.join(agentsDir(), 'delphi-feasibility.md'))).toBe('glm-5.2');
+  });
+
+  it('preserves the rest of the bundled template body when rebinding', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    await delphiSetup([
+      '--model', 'architecture=qwen-max',
+      '--model', 'technical=deepseek-v3.2',
+      '--model', 'feasibility=glm-5.2',
+    ]);
+    const body = fs.readFileSync(path.join(agentsDir(), 'delphi-architecture.md'), 'utf8');
+    const shippedBody = fs.readFileSync(path.join(repoRoot(), 'plugins', 'qoder', 'agents', 'delphi-architecture.md'), 'utf8');
+    // The name line is template identity; only the binding may change.
+    expect(body).toMatch(/^name: delphi-architecture$/m);
+    expect(body).not.toBe('');
+    expect(shippedBody).toMatch(/^name: delphi-architecture$/m);
+  });
+
+  it('repairs a stale binding by overwriting it (this is the point of the command)', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    fs.mkdirSync(agentsDir(), { recursive: true });
+    fs.writeFileSync(
+      path.join(agentsDir(), 'delphi-architecture.md'),
+      '---\nname: delphi-architecture\nmodel: "[Retired-Model](dead-model-id)"\n---\n# body\n',
+    );
+    const code = await delphiSetup([
+      '--model', 'architecture=qwen-max',
+      '--model', 'technical=deepseek-v3.2',
+      '--model', 'feasibility=glm-5.2',
+    ]);
+    expect(code).toBe(0);
+    const { readQoderModelId } = require('../init');
+    expect(readQoderModelId(path.join(agentsDir(), 'delphi-architecture.md'))).toBe('qwen-max');
+  });
+
+  // R1 FC-04: a repair without a rollback is a second way to lose a working
+  // binding — existing files are backed up before the first write.
+  it('backs up existing agent files before overwriting them', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    fs.mkdirSync(agentsDir(), { recursive: true });
+    const staleBody = '---\nname: delphi-architecture\nmodel: "[Retired-Model](dead-model-id)"\n---\n# body\n';
+    fs.writeFileSync(path.join(agentsDir(), 'delphi-architecture.md'), staleBody);
+    const code = await delphiSetup([
+      '--model', 'architecture=qwen-max',
+      '--model', 'technical=deepseek-v3.2',
+      '--model', 'feasibility=glm-5.2',
+    ]);
+    expect(code).toBe(0);
+    // Some backup copy of the stale file must exist somewhere under the
+    // sandbox HOME config dir; the exact timestamped dir is intentional.
+    const backupRoot = path.join(tmpHome, '.config', 'xp-gate', 'backup');
+    const found = (function find(dir) {
+      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        const p = path.join(dir, e.name);
+        if (e.isDirectory()) {
+          const hit = find(p);
+          if (hit) return hit;
+        } else if (e.name === 'delphi-architecture.md') {
+          return p;
+        }
+      }
+      return null;
+    })(backupRoot);
+    expect(found).not.toBeNull();
+    expect(fs.readFileSync(found, 'utf8')).toBe(staleBody);
+  });
+
+  // R1 MN-05: a BOM in front of '---' must not read as a missing frontmatter.
+  it('rebinds a template carrying a UTF-8 BOM', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    fs.mkdirSync(agentsDir(), { recursive: true });
+    fs.writeFileSync(
+      path.join(agentsDir(), 'delphi-architecture.md'),
+      '\uFEFF---\nname: delphi-architecture\nmodel: "[Old](old-id)"\n---\n# body\n',
+    );
+    const code = await delphiSetup([
+      '--model', 'architecture=qwen-max',
+      '--model', 'technical=deepseek-v3.2',
+      '--model', 'feasibility=glm-5.2',
+    ]);
+    expect(code).toBe(0);
+    const { readQoderModelId } = require('../init');
+    expect(readQoderModelId(path.join(agentsDir(), 'delphi-architecture.md'))).toBe('qwen-max');
+  });
+
+  it('rejects duplicate model IDs — three distinct models are the invariant being set up', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    const code = await delphiSetup([
+      '--model', 'architecture=same-model',
+      '--model', 'technical=same-model',
+      '--model', 'feasibility=other',
+    ]);
+    expect(code).toBe(1);
+    expect(fs.existsSync(agentsDir())).toBe(false);
+  });
+
+  it('rejects an unknown role and a bare model id without a role=', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    expect(await delphiSetup(['--model', 'critic=x'])).toBe(1);
+    expect(await delphiSetup(['--model', 'just-a-model'])).toBe(1);
+    expect(fs.existsSync(agentsDir())).toBe(false);
+  });
+
+  it('rejects a model id outside the platform binding charset', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    const code = await delphiSetup([
+      '--model', 'architecture=has space',
+      '--model', 'technical=deepseek-v3.2',
+      '--model', 'feasibility=glm-5.2',
+    ]);
+    expect(code).toBe(1);
+    expect(fs.existsSync(agentsDir())).toBe(false);
+  });
+
+  it('demands an IDE reload on success — the registry only loads at session start', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    await delphiSetup([
+      '--model', 'architecture=qwen-max',
+      '--model', 'technical=deepseek-v3.2',
+      '--model', 'feasibility=glm-5.2',
+    ]);
+    logSpy.mockRestore();
+    const out = logs.join('\n');
+    expect(out).toMatch(/重载|reload|新会话|restart/i);
+  });
+
+  it('--local --project targets the project .qoder/agents instead of HOME', async () => {
+    const { delphiSetup } = require('../delphi-setup');
+    const projectDir = fs.mkdtempSync(path.join(require('os').tmpdir(), 'delphi-setup-proj-'));
+    try {
+      const code = await delphiSetup([
+        '--local', '--project', projectDir,
+        '--model', 'architecture=qwen-max',
+        '--model', 'technical=deepseek-v3.2',
+        '--model', 'feasibility=glm-5.2',
+      ]);
+      expect(code).toBe(0);
+      const { readQoderModelId } = require('../init');
+      expect(readQoderModelId(path.join(projectDir, '.qoder', 'agents', 'delphi-architecture.md'))).toBe('qwen-max');
+      expect(fs.existsSync(path.join(tmpHome, '.qoder', 'agents'))).toBe(false);
+    } finally {
+      fs.rmSync(projectDir, { recursive: true, force: true });
+    }
+  });
+});

package/lib/__tests__/doctor-delphi.test.js

@@ -0,0 +1,244 @@
+/**
+ * @test doctor-delphi
+ * @intent Guard #414 REQ-3/REQ-6: `xp-gate doctor delphi` turns the failure
+ * modes measured on real machines into diagnosable checks — drifted agent
+ * bindings (B2), a skill install that silently lagged the published package
+ * (B4), a runner script nobody can find (B3), and a config that cannot serve
+ * three distinct models. Every check must be assertable in isolation, and the
+ * npm-latest probe must be skippable so the doctor never needs the network.
+ */
+const fs = require('fs');
+const path = require('path');
+const { resetLibModules, muteConsole, makeTempDirs, removeTempDirs } = require('./helpers/lib-sandbox.cjs');
+
+const LIB_MODULES = ['../init', '../detect-deps.js', '../shared-paths', '../doctor', '../delphi-setup'].map(name => require.resolve(name));
+
+function repoRoot() {
+  return path.join(__dirname, '..', '..', '..', '..');
+}
+
+function bundledSkillDir() {
+  return path.join(repoRoot(), 'src', 'npm-package', 'skills', 'delphi-review');
+}
+
+describe('doctor delphi (#414 REQ-3/REQ-6)', () => {
+  let tmpDirs;
+  let tmpHome;
+  let originalHome;
+
+  beforeEach(() => {
+    tmpDirs = makeTempDirs(['doctor-delphi-home']);
+    tmpHome = tmpDirs['doctor-delphi-home'];
+    originalHome = process.env.HOME;
+    process.env.HOME = tmpHome;
+    fs.mkdirSync(path.join(tmpHome, '.qoder'), { recursive: true });
+    resetLibModules(vi, LIB_MODULES);
+    muteConsole(vi);
+  });
+
+  afterEach(() => {
+    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+    removeTempDirs(tmpDirs);
+    vi.restoreAllMocks();
+  });
+
+  function healthyHome() {
+    // A home that would pass the agent + skill-parity checks.
+    fs.mkdirSync(path.join(tmpHome, '.qoder', 'agents'), { recursive: true });
+    fs.mkdirSync(path.join(tmpHome, '.qoder', 'skills', 'delphi-review'), { recursive: true });
+    for (const role of ['architecture', 'technical', 'feasibility']) {
+      fs.copyFileSync(
+        path.join(repoRoot(), 'plugins', 'qoder', 'agents', `delphi-${role}.md`),
+        path.join(tmpHome, '.qoder', 'agents', `delphi-${role}.md`),
+      );
+    }
+    for (const f of fs.readdirSync(bundledSkillDir(), { withFileTypes: true })) {
+      const dest = path.join(tmpHome, '.qoder', 'skills', 'delphi-review', f.name);
+      if (f.isDirectory()) {
+        fs.mkdirSync(dest, { recursive: true });
+        for (const inner of fs.readdirSync(path.join(bundledSkillDir(), f.name))) {
+          if (fs.statSync(path.join(bundledSkillDir(), f.name, inner)).isFile()) {
+            fs.copyFileSync(path.join(bundledSkillDir(), f.name, inner), path.join(dest, inner));
+          }
+        }
+      } else if (f.isFile()) {
+        fs.copyFileSync(path.join(bundledSkillDir(), f.name), dest);
+      }
+    }
+  }
+
+  function writeConfig(configPath) {
+    fs.writeFileSync(configPath, JSON.stringify({
+      active_profile: 'default',
+      profiles: {
+        default: {
+          providers: {
+            gw: { base_url: 'https://gw.example/v1', api_key: 'k' },
+          },
+          experts: {
+            architecture: { provider: 'gw', model: 'model-a' },
+            technical: { provider: 'gw', model: 'model-b' },
+            feasibility: { provider: 'gw', model: 'model-c' },
+          },
+        },
+      },
+    }));
+    return configPath;
+  }
+
+  it('a fully healthy environment PASSes every check and exits 0', async () => {
+    healthyHome();
+    const { doctorDelphi } = require('../doctor');
+    const configPath = writeConfig(path.join(tmpDirs['doctor-delphi-home'], '.delphi-config.json'));
+    const localVersion = require('../../package.json').version;
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: localVersion });
+    expect(code).toBe(0);
+  });
+
+  it('a stale agent binding FAILs and names delphi-setup as the repair path', async () => {
+    healthyHome();
+    fs.writeFileSync(
+      path.join(tmpHome, '.qoder', 'agents', 'delphi-technical.md'),
+      '---\nname: delphi-technical\nmodel: "[Retired](retired-id)"\n---\n# body\n',
+    );
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
+    expect(code).toBe(1);
+  });
+
+  it('a skill install that drifted from the bundled copy FAILs with a reinstall hint', async () => {
+    healthyHome();
+    const installed = path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'SKILL.md');
+    fs.appendFileSync(installed, '\ndrifted line\n');
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    const { doctorDelphi } = require('../doctor');
+    await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
+    logSpy.mockRestore();
+    expect(logs.join('\n')).toMatch(/install-skill|reinstall/i);
+  });
+
+  it('a duplicate-model config FAILs instead of promising a review that will BLOCK', async () => {
+    healthyHome();
+    const configPath = path.join(tmpHome, '.delphi-config.json');
+    fs.writeFileSync(configPath, JSON.stringify({
+      active_profile: 'default',
+      profiles: {
+        default: {
+          providers: { gw: { base_url: 'https://gw.example/v1', api_key: 'k' } },
+          experts: {
+            architecture: { provider: 'gw', model: 'same' },
+            technical: { provider: 'gw', model: 'same' },
+            feasibility: { provider: 'gw', model: 'model-c' },
+          },
+        },
+      },
+    }));
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    expect(code).toBe(1);
+  });
+
+  it('a missing config FAILs with the copy-the-example hint', async () => {
+    healthyHome();
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    const { doctorDelphi } = require('../doctor');
+    await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
+    logSpy.mockRestore();
+    expect(logs.join('\n')).toMatch(/\.delphi-config\.json/);
+  });
+
+  it('npmLatest=null skips the version check without failing the run', async () => {
+    healthyHome();
+    const { doctorDelphi } = require('../doctor');
+    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    expect(code).toBe(0);
+  });
+
+  // R1 FC-07: the switch shipping off is the platform default, not a defect —
+  // only enabled-but-underprovisioned is a real FAIL.
+  it('DSH with subagentModelSelection absent is SKIP, not FAIL', async () => {
+    healthyHome();
+    fs.mkdirSync(path.join(tmpHome, '.dsh'), { recursive: true });
+    fs.writeFileSync(path.join(tmpHome, '.dsh', 'settings.json'), JSON.stringify({ other: true }));
+    const { doctorDelphi } = require('../doctor');
+    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    expect(code).toBe(0);
+  });
+
+  // R1 FC-09: a project-level agent set (delphi-setup --local --project) is
+  // what the doctor reads, so the repair loop closes.
+  it('a complete project-level agent set takes precedence over the HOME set', async () => {
+    healthyHome();
+    const projDir = fs.mkdtempSync(path.join(require('os').tmpdir(), 'doctor-delphi-proj-'));
+    try {
+      fs.mkdirSync(path.join(projDir, '.qoder', 'agents'), { recursive: true });
+      for (const role of ['architecture', 'technical', 'feasibility']) {
+        fs.copyFileSync(
+          path.join(repoRoot(), 'plugins', 'qoder', 'agents', `delphi-${role}.md`),
+          path.join(projDir, '.qoder', 'agents', `delphi-${role}.md`),
+        );
+      }
+      // Corrupt the HOME set; the project set must win and the run stays green.
+      fs.writeFileSync(
+        path.join(tmpHome, '.qoder', 'agents', 'delphi-technical.md'),
+        '---\nname: delphi-technical\nmodel: "[Retired](retired-id)"\n---\n# body\n',
+      );
+      const { doctorDelphi } = require('../doctor');
+      const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+      const code = await doctorDelphi({
+        projectDir: projDir, configPath, npmLatest: null,
+      });
+      expect(code).toBe(0);
+    } finally {
+      fs.rmSync(projDir, { recursive: true, force: true });
+    }
+  });
+
+  // R1 MI-03: parity covers the whole bundled file set, so a stale references/
+  // copy cannot hide behind a matching SKILL.md.
+  it('a drifted references file FAILs parity even when SKILL.md matches', async () => {
+    healthyHome();
+    // R2 MJ-R2-01: the assertion must be the ONLY way this test can fail. An
+    // absent config would exit 1 regardless of parity, so the fixture supplies
+    // a valid one and lets the drifted file carry the verdict.
+    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+    const refsDir = path.join(bundledSkillDir(), 'references');
+    const refFile = fs.existsSync(refsDir)
+      ? fs.readdirSync(refsDir).find((f) => f.endsWith('.md'))
+      : null;
+    expect(refFile).toBeTruthy(); // explicit: without a bundled reference this test has nothing to say
+    fs.mkdirSync(path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'references'), { recursive: true });
+    fs.appendFileSync(
+      path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'references', refFile),
+      '\ndrift\n',
+    );
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    expect(code).toBe(1);
+  });
+
+  // R3 FC-01/FC-02: the empty-bundle branch is driven directly through the
+  // injectable bundledSkillDir — the healthy fixture cannot exercise it, and
+  // an indirect output-shape assertion would pass even without the fix.
+  it('an empty bundled skill directory FAILs parity instead of passing vacuously', async () => {
+    healthyHome();
+    const emptyBundle = fs.mkdtempSync(path.join(require('os').tmpdir(), 'doctor-empty-bundle-'));
+    try {
+      const logs = [];
+      const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+      const { doctorDelphi } = require('../doctor');
+      const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+      const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null, bundledSkillDir: emptyBundle });
+      logSpy.mockRestore();
+      expect(code).toBe(1);
+      const parityLine = logs.find((l) => l.includes('Delphi skill install parity'));
+      expect(parityLine).toContain('missing or empty');
+    } finally {
+      fs.rmSync(emptyBundle, { recursive: true, force: true });
+    }
+  });
+});

package/lib/__tests__/init-gitleaks-notice.test.js

@@ -0,0 +1,57 @@
+/**
+ * @intent #511: Gate 8 is fail-closed since #499 (missing gitleaks BLOCKS the
+ *         commit). The npm init path never surfaced that fact, so an upgrading
+ *         user met a hard BLOCK with no prior signal. `probeGitleaksNotice`
+ *         prints a migration notice and never installs anything.
+ * @covers probeGitleaksNotice() in lib/init.js
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const { probeGitleaksNotice } = require('../init.js');
+
+describe('probeGitleaksNotice (#511)', () => {
+  it('reports present and stays quiet when gitleaks is available', () => {
+    const lines = [];
+    const result = probeGitleaksNotice(
+      () => ({ available: true, version: '8.24.2' }),
+      l => lines.push(l),
+    );
+    expect(result.available).toBe(true);
+    const joined = lines.join('\n');
+    expect(joined).toContain('gitleaks present');
+    expect(joined).toContain('8.24.2');
+    expect(joined).not.toContain('FAIL-CLOSED');
+  });
+
+  it('prints the fail-closed migration notice when gitleaks is missing', () => {
+    const lines = [];
+    const result = probeGitleaksNotice(() => ({ available: false }), l => lines.push(l));
+    expect(result.available).toBe(false);
+    const joined = lines.join('\n');
+    expect(joined).toContain('FAIL-CLOSED');
+    expect(joined).toContain('Gate 8');
+    expect(joined).toContain('install-gitleaks.sh');
+    expect(joined).toContain('brew install gitleaks');
+    expect(joined).toContain('winget install gitleaks');
+  });
+
+  it('probes exactly the gitleaks tool name', () => {
+    const checkTool = vi.fn(() => ({ available: true }));
+    probeGitleaksNotice(checkTool, () => {});
+    expect(checkTool).toHaveBeenCalledWith('gitleaks');
+  });
+
+  it('never installs anything — it is a pure text probe', () => {
+    // The helper must not shell out: no exec/spawn import is exercised here,
+    // and the only observable effect is log lines. A missing tool returns the
+    // notice; the caller decides whether to install.
+    const lines = [];
+    const before = process.env.PATH;
+    probeGitleaksNotice(() => ({ available: false }), l => lines.push(l));
+    expect(process.env.PATH).toBe(before);
+    expect(lines.some(l => /dev\/null|execSync|spawn/.test(l))).toBe(false);
+  });
+});