@boyingliu01/xp-gate 0.25.0 → 0.27.0

package/lib/__tests__/doctor-469-hook-env.test.js

@@ -17,11 +17,16 @@ const describeWin = isWindows ? describe : describe.skip;
 // Walkthrough FC-02: a bare `return` inside it() silently reports PASS on a
 // runner without bash — a false-green in the very suite that guards against
 // false greens. Bash-gated tests must SKIP loudly instead.
-const { execSync } = require('child_process');
-const BASH_AVAILABLE = (() => {
-  try { execSync('bash --version', { stdio: 'ignore' }); return true; } catch { return false; }
+// On Windows a bare PATH 'bash' may resolve to the WSL System32 stub, whose
+// argv handling drops `-c` positional args — probing through it answers for
+// the wrong environment (the exact #469 failure class). Resolve the same
+// authoritative bash the hooks get: checkBash().
+const { checkBash } = require('../detect-deps.js');
+const BASH_PROBE = (() => {
+  const b = checkBash();
+  return b.ok ? b.path : null;
 })();
-const itWithBash = BASH_AVAILABLE ? it : it.skip;
+const itWithBash = BASH_PROBE ? it : it.skip;
 
 describe('doctor hook-env probing (#469)', () => {
   function mod() {
@@ -30,7 +35,7 @@ describe('doctor hook-env probing (#469)', () => {
 
   itWithBash('AC-469-01: a tool the hook env sees is reported with its hook-env path', async () => {
     const { probeToolInHookEnv } = mod();
-    const bashPath = isWindows ? 'bash' : '/bin/sh';
+    const bashPath = isWindows ? BASH_PROBE : '/bin/sh';
     const p = await probeToolInHookEnv(isWindows ? 'node' : 'sh', bashPath);
     expect(typeof p).toBe('string');
     expect(p.length).toBeGreaterThan(0);
@@ -39,7 +44,7 @@ describe('doctor hook-env probing (#469)', () => {
   itWithBash('AC-469-01: a tool absent from the hook env returns null — no fall-through', async () => {
     const { detectCliToolAsync } = mod();
     const result = await detectCliToolAsync('definitely-not-a-real-tool-xyz-469', isWindows, {
-      bashPath: 'bash',
+      bashPath: BASH_PROBE,
     });
     // With bash present there is NO fall-through: `where` finding nothing is
     // irrelevant here, the hook env verdict is final.
@@ -56,7 +61,7 @@ describe('doctor hook-env probing (#469)', () => {
 
   itWithBash('AC-469-01: an installed tool is visible through the hook-env tier', async () => {
     const { detectCliToolAsync } = mod();
-    const result = await detectCliToolAsync('node', true, { bashPath: 'bash' });
+    const result = await detectCliToolAsync('node', true, { bashPath: BASH_PROBE });
     expect(result.available).toBe(true);
     // The hook-env path is POSIX form on Windows — cmd.exe cannot run it.
     if (isWindows) expect(result.path.startsWith('/')).toBe(true);

package/lib/__tests__/doctor-module-resolution-parity.test.js

@@ -51,13 +51,22 @@ function matchBlock(source, pattern, label) {
 }
 
 function bashBin() {
-  const candidate = process.env.XP_GATE_BASH_BIN || 'bash';
-  const probe = spawnSync(candidate, ['-c', 'echo ok'], { encoding: 'utf8' });
-  // A missing runner must fail loudly, never read as a passing guard.
-  if (probe.status !== 0 || probe.error) {
-    throw new Error(`bash runner unavailable (${candidate}): ${probe.error ? probe.error.message : `exit ${probe.status}`}`);
+  if (process.env.XP_GATE_BASH_BIN) {
+    const probe = spawnSync(process.env.XP_GATE_BASH_BIN, ['-c', 'echo ok'], { encoding: 'utf8' });
+    if (probe.status !== 0 || probe.error) {
+      throw new Error(`bash runner unavailable (${process.env.XP_GATE_BASH_BIN}): ${probe.error ? probe.error.message : `exit ${probe.status}`}`);
+    }
+    return process.env.XP_GATE_BASH_BIN;
+  }
+  // Resolve the authoritative bash the hooks actually get. On Windows a bare
+  // PATH 'bash' may be the WSL System32 stub, whose `-c` scripts receive an
+  // empty $1 and resolve nothing — a vacuous resolver run, not a passing one.
+  const { checkBash } = require('../detect-deps.js');
+  const b = checkBash();
+  if (!b.ok) {
+    throw new Error(`bash runner unavailable: ${b.message || 'checkBash failed'}`);
   }
-  return candidate;
+  return b.path;
 }
 
 /**

package/lib/__tests__/doctor-tui-skill-freshness.test.js

@@ -32,12 +32,20 @@ describe('doctor-tui skill freshness (#439)', () => {
   // HOME has no platform marker, so detectPlatform() resolves to opencode.
   function installSkill(name, content) {
     const dir = path.join(tmpHome, '.config', 'opencode', 'skills', name);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, 'SKILL.md'), content);
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(path.join(dir, 'SKILL.md'), content);
+    } catch (err) {
+      throw new Error(`failed to install test skill ${name}: ${err && err.message}`);
+    }
   }
 
   function readBundled(name) {
-    return fs.readFileSync(path.join(bundledSkillsDir, name, 'SKILL.md'), 'utf8');
+    try {
+      return fs.readFileSync(path.join(bundledSkillsDir, name, 'SKILL.md'), 'utf8');
+    } catch (err) {
+      throw new Error(`failed to read bundled skill ${name}: ${err && err.message}`);
+    }
   }
 
   /** Same bytes, opposite line endings — the only difference a fresh install can have. */
@@ -134,7 +142,11 @@ describe('doctor-tui skill freshness (#439)', () => {
       .readdirSync(bundledSkillsDir, { withFileTypes: true })
       .filter((d) => d.isDirectory())
       .map((d) => d.name);
-    expect(skills.length).toBeGreaterThanOrEqual(13);
+    // Sanity floor only: the substantive assertion below is that every bundled
+    // skill declares a version. #522 removed clipboard-vision, dropping the
+    // bundle from 13 to 12 skills, so the floor tracks the current bundle size
+    // instead of a stale magic number (Delphi Round 1, finding A-Critical).
+    expect(skills.length).toBeGreaterThanOrEqual(12);
     const missing = skills.filter((name) => {
       const md = path.join(bundledSkillsDir, name, 'SKILL.md');
       return !/^version:\s*\d+\.\d+\.\d+/m.test(fs.readFileSync(md, 'utf8'));

package/lib/__tests__/test-alignment.test.ts

@@ -325,6 +325,43 @@ test('multiple assertions', () => {
     expect(result.tests[0].assertions).toBeGreaterThanOrEqual(4);
     expect(result.totalAssertions).toBeGreaterThanOrEqual(4);
   });
+
+  it('AC-FIXTURE-ASSERT: should count assertions per-test, not per-file (#392)', async () => {
+    // Regression for #392-#1: assertion counting must be scoped to the test
+    // body, otherwise totalAssertions is inflated by fileCount x perFileCount.
+    const testTs = `
+/**
+ * @test REQ-MULTI-001 First test
+ * @intent Assertion counting is per-test
+ * @covers AC-FIXTURE-MULTI-01
+ */
+test('first test', () => {
+  expect(a()).toBe(1);
+  expect(b()).toBe(2);
+});
+
+/**
+ * @test REQ-MULTI-002 Second test
+ * @intent Assertion counting is per-test
+ * @covers AC-FIXTURE-MULTI-02
+ */
+test('second test', () => {
+  expect(c()).toBe(3);
+});
+`;
+    const testFile = writeTempFile('multi-assert.test.ts', testTs);
+    const result = parseTestFiles([testFile]);
+
+    expect(result.tests).toHaveLength(2);
+    // countAssertions counts matching *patterns*, so `expect(x).toBe(y)` yields
+    // 2 (one `expect(` + one `toBe(`). First test body has 2 such assertions
+    // => 4; second has 1 => 2. The key regression: each test counts ONLY its own
+    // body (total 6), never the whole file (3 expect + 3 toBe = 6 per test,
+    // which would inflate totalAssertions to 12 under the old per-file bug).
+    expect(result.tests[0].assertions).toBe(4);
+    expect(result.tests[1].assertions).toBe(2);
+    expect(result.totalAssertions).toBe(6);
+  });
 });
 
 // ============================================================================

package/lib/__tests__/windows-bash-probe.test.js

@@ -0,0 +1,73 @@
+/**
+ * @test REQ-windows-bash probe behavior
+ * @intent resolveWindowsBashCandidates must accept only a bash that round-trips
+ *         `-c` positional argv AND reports MINGW/MSYS/CYGWIN via uname — the WSL
+ *         System32 stub (Linux uname, dropped $1) is rejected even when PATH
+ *         leads with it. Behavior is exercised through an injected fake spawner,
+ *         so no real interpreter configuration is assumed on the host (#469
+ *         follow-up, Delphi walkthrough R1 MN-06).
+ * @covers AC-WINBASH-01
+ */
+const { describe, it, expect } = await import('vitest');
+const { resolveWindowsBashCandidates } = require('../detect-deps.js');
+
+// The candidate loop reads `where bash` from the host; tests inject both the
+// discovery runner and the probe spawner, so results are deterministic on any
+// machine regardless of what interpreter configuration it happens to have.
+function fakeWhere(whereOutput) {
+  return (cmd) => {
+    if (/^where bash/.test(cmd)) {
+      if (whereOutput instanceof Error) throw whereOutput;
+      return whereOutput || '';
+    }
+    throw new Error(`unexpected execSync: ${cmd}`);
+  };
+}
+
+function fakeSpawn(behaviors) {
+  const probed = [];
+  const fn = (candidate) => {
+    probed.push(candidate);
+    const b = behaviors[candidate];
+    if (b instanceof Error) throw b;
+    // Unknown candidates model a missing file: no stdout at all.
+    return { stdout: b !== undefined ? b : '' };
+  };
+  fn.probed = probed;
+  return fn;
+}
+
+describe('resolveWindowsBashCandidates (win32 authoritative bash)', () => {
+  it('AC-WINBASH-01: rejects a WSL stub whose $1 is empty and uname is Linux', () => {
+    const spawn = fakeSpawn({ 'C:\\Windows\\System32\\bash.exe': '[ ]\nLinux\n' });
+    // No MSYS candidate exists in this world (hardcoded fallbacks report no
+    // stdout), so the resolver must find nothing rather than settle for the stub.
+    expect(resolveWindowsBashCandidates(spawn, fakeWhere('C:\\Windows\\System32\\bash.exe\r\n'))).toBeNull();
+  });
+
+  it('AC-WINBASH-01: accepts the first candidate with argv round-trip + MINGW uname', () => {
+    const spawn = fakeSpawn({
+      'C:\\a\\bash.exe': '[]\nLinux\n', // drops $1 → reject
+      'C:\\b\\bash.exe': '[XPGATE_ARGV_PROBE]\nMINGW64_NT-10.0\n', // accept
+    });
+    const result = resolveWindowsBashCandidates(spawn, fakeWhere('C:\\a\\bash.exe\r\nC:\\b\\bash.exe\r\n'));
+    expect(result).toBe('C:\\b\\bash.exe');
+    expect(spawn.probed.slice(0, 2)).toEqual(['C:\\a\\bash.exe', 'C:\\b\\bash.exe']);
+  });
+
+  it('AC-WINBASH-01: a Linux uname with intact argv still fails the platform test', () => {
+    // A real WSL bash answers [XPGATE_ARGV_PROBE] correctly under some
+    // invocations but its filesystem view cannot run these hooks — uname wins.
+    const spawn = fakeSpawn({ 'C:\\wsl\\bash.exe': '[XPGATE_ARGV_PROBE]\nLinux\n' });
+    expect(resolveWindowsBashCandidates(spawn, fakeWhere('C:\\wsl\\bash.exe\r\n'))).toBeNull();
+  });
+
+  it('AC-WINBASH-01: a throwing candidate is skipped, not fatal', () => {
+    const spawn = fakeSpawn({
+      'C:\\gone\\bash.exe': new Error('ENOENT'),
+      'C:\\msys64\\usr\\bin\\bash.exe': '[XPGATE_ARGV_PROBE]\nMSYS_NT-10.0\n',
+    });
+    const result = resolveWindowsBashCandidates(spawn, fakeWhere(new Error('where unavailable')));
+    expect(result).toBe('C:\\msys64\\usr\\bin\\bash.exe');
+  });
+});

package/lib/check-alignment-runner.cjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+/**
+ * check-alignment-runner.cjs — Thin argv shim for test-alignment.ts
+ *
+ * Bridges the `xp-gate check-alignment` CLI to the TypeScript engine without
+ * shell-command interpolation of user-supplied paths (#392-#6).
+ *
+ * It is designed to be launched EITHER way:
+ *   1. In-repo (fast path): `node` loads this file after xp-gate.js already
+ *      called `require('tsx/cjs')`, so requiring `./test-alignment.ts` works.
+ *   2. Published global install (zero-install path): `npx -y tsx` runs this
+ *      file, and npx self-provisions tsx on demand (never a package dep), so
+ *      `./test-alignment.ts` loads even though the package ships zero deps.
+ *
+ * All user-supplied paths are passed as discrete argv elements, never embedded
+ * into a shell command string, preserving the #392-#6 injection fix.
+ */
+'use strict';
+
+const { execFileSync } = require('child_process');
+
+// --- argv parsing ----------------------------------------------------------
+function argValue(argv, flag) {
+  const idx = argv.indexOf(flag);
+  return idx >= 0 && idx + 1 < argv.length ? argv[idx + 1] : undefined;
+}
+function argFlag(argv, flag) {
+  return argv.includes(flag);
+}
+
+const specPath = argValue(process.argv, '--spec');
+const testDirsArg = argValue(process.argv, '--tests');
+const outputPath = argValue(process.argv, '--output');
+const jsonMode = argFlag(process.argv, '--json');
+
+if (!specPath) {
+  console.error('check-alignment: --spec <path> is required');
+  process.exit(1);
+}
+
+const testDirs = testDirsArg ? [testDirsArg] : undefined;
+
+let headCommit = 'unknown';
+try {
+  headCommit = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() || 'unknown';
+} catch (err) {
+  headCommit = 'unknown';
+}
+
+const { runFullAlignment } = require('./test-alignment.ts');
+
+let report;
+try {
+  report = runFullAlignment({
+    specPath,
+    testDirs,
+    headCommit,
+    outputPath: outputPath || undefined,
+  });
+} catch (err) {
+  console.error('check-alignment failed:', err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}
+
+if (jsonMode) {
+  console.log(JSON.stringify(report, null, 2));
+} else {
+  console.log('Status:', report.alignment_status);
+  console.log('Score:', report.score);
+  console.log('Misaligned:', report.misaligned_tests.length);
+}
+// Set exitCode instead of process.exit() so buffered stdout (notably the
+// --json document) flushes fully before the process terminates (#392 review).
+process.exitCode = report.alignment_status === 'PASS' ? 0 : 1;

package/lib/detect-deps.js

@@ -270,12 +270,88 @@ function getSkillsDirs(platform) {
   return profile.skillsDirs;
 }
 
+/**
+ * Resolve a bash that can actually run the hooks.
+ *
+ * On Windows, `bash` on PATH is ambiguous: WSL installs C:\Windows\System32\
+ * bash.exe (a Linux interpreter whose filesystem view does not contain the
+ * Windows temp dirs the tooling passes to it), and its argv handling silently
+ * drops the positional arguments a `-c` script expects ($1 empty → scripts
+ * source nothing and "succeed" vacuously). Git for Windows ships the MSYS bash
+ * the hooks are written for. Probe candidates with an argv round-trip plus an
+ * uname check — only an MSYS/MINGW/CYGWIN bash counts on win32; a plain
+ * "bash --version" success proves nothing.
+ * @returns {string|null}
+ */
+function probeWindowsBash() {
+  const { spawnSync } = require('child_process');
+  // `where` runs through the same module so tests can fake discovery + probe.
+  const { execSync: localExecSync } = require('child_process');
+  return resolveWindowsBashCandidates(spawnSync, localExecSync);
+}
+
+// Candidate list + probe loop split out for behavior tests: a fake spawner can
+// simulate the WSL stub (echoes Linux / drops $1) vs an MSYS bash without any
+// real interpreter on PATH (Delphi walkthrough R1, MN-06).
+function resolveWindowsBashCandidates(spawnProbe, whereExecSync) {
+  const _execSync = whereExecSync || execSync;
+  const candidates = [];
+  try {
+    const found = _execSync('where bash', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    for (const line of found.split(/\r?\n/)) if (line.trim()) candidates.push(line.trim());
+  } catch { /* where unavailable */ }
+  candidates.push(
+    'C:\\Program Files\\Git\\bin\\bash.exe',
+    'C:\\Program Files\\Git\\usr\\bin\\bash.exe',
+    'C:\\Program Files (x86)\\Git\\bin\\bash.exe',
+    'C:\\Program Files (x86)\\Git\\usr\\bin\\bash.exe',
+    'C:\\msys64\\usr\\bin\\bash.exe',
+    'C:\\cygwin64\\bin\\bash.exe'
+  );
+  for (const candidate of candidates) {
+    try {
+      const r = spawnProbe(candidate, ['-c', 'echo "[$1]"; uname -s', 'sh', 'XPGATE_ARGV_PROBE'], {
+        encoding: 'utf8',
+        timeout: 5000,
+        windowsHide: true,
+      });
+      const out = String((r && r.stdout) || '');
+      if (out.includes('[XPGATE_ARGV_PROBE]') && /(MINGW|MSYS|CYGWIN)/i.test(out)) {
+        return candidate;
+      }
+    } catch { /* next candidate */ }
+  }
+  return null;
+}
+
 /**
  * Check if bash is available on the system.
  * XP-Gate hooks are bash scripts — Windows users need Git Bash installed.
  * @returns {{ok: boolean, path?: string, message?: string}}
  */
 function checkBash() {
+  // On Windows resolve explicitly: PATH may lead with the WSL System32 stub,
+  // which cannot execute these hooks (wrong filesystem view, dropped $1).
+  if (process.platform === 'win32') {
+    const winBash = probeWindowsBash();
+    if (winBash) {
+      let version = 'unknown';
+      try {
+        // spawnSync with discrete argv — never interpolate a discovered path
+        // into a shell string (a PATH dir name may carry cmd metacharacters).
+        const result = spawnSync(winBash, ['--version'], { encoding: 'utf8', timeout: 5000 });
+        const versionMatch = String(result.stdout || '').match(/version\s+([^\s]+)/);
+        if (versionMatch) version = versionMatch[1];
+      } catch { /* keep unknown */ }
+      return { ok: true, path: winBash, version };
+    }
+    return {
+      ok: false,
+      message: 'bash not found. Windows users must install [Git for Windows](https://git-scm.com/download/win).\n' +
+        '   During installation, ensure "Git Bash Here" is checked — this adds bash.exe to PATH.\n' +
+        '   After installation, restart your terminal and run `npm install` again.'
+    };
+  }
   try {
     // Try 'bash' first (works on Linux/macOS and when Git Bash is in PATH)
     const result = execSync('bash --version', {
@@ -289,17 +365,11 @@ function checkBash() {
       version: versionMatch ? versionMatch[1] : 'unknown'
     };
   } catch (e) {
-    // On Windows with Git Bash, try common locations
+    // POSIX fallback: common absolute locations
     const bashPaths = [
-      // Git for Windows
-      'C:\\Program Files\\Git\\bin\\bash.exe',
-      'C:\\Program Files\\Git\\usr\\bin\\bash.exe',
-      'C:\\Program Files (x86)\\Git\\bin\\bash.exe',
-      'C:\\Program Files (x86)\\Git\\usr\\bin\\bash.exe',
-      // MSYS2
-      'C:\\msys64\\usr\\bin\\bash.exe',
-      // Cygwin
-      'C:\\cygwin64\\bin\\bash.exe',
+      '/bin/bash',
+      '/usr/bin/bash',
+      '/usr/local/bin/bash',
     ];
 
     for (const bashPath of bashPaths) {
@@ -319,15 +389,7 @@ function checkBash() {
       }
     }
 
-    // Windows-specific guidance
-    if (process.platform === 'win32') {
-      return {
-        ok: false,
-        message: 'bash not found. Windows users must install [Git for Windows](https://git-scm.com/download/win).\n' +
-          '   During installation, ensure "Git Bash Here" is checked — this adds bash.exe to PATH.\n' +
-          '   After installation, restart your terminal and run `npm install` again.'
-      };
-    }
+    // Windows is handled above; this fallback only runs on POSIX now.
 
     return {
       ok: false,
@@ -505,6 +567,7 @@ function compareVersions(a, b) {
 module.exports = {
   checkDeps,
   checkBash,
+  resolveWindowsBashCandidates,
   autoInstallDeps,
   detectPlatform,
   getSkillsDirs,

package/lib/gate-runner.js

@@ -18,15 +18,22 @@ const path = require('node:path');
  * behaves exactly as it does inside the commit hook.
  */
 function runGateAdapter(scriptPath, cwd = process.cwd()) {
+  let bashCommand = 'bash';
   if (process.platform === 'win32') {
-    try {
-      execSync('bash --version', { stdio: 'pipe', timeout: 5000 });
-    } catch {
+    // PATH may lead with the WSL System32 stub, which cannot run these hooks
+    // (Linux filesystem view, and `-c` scripts receive an empty $1 through it).
+    // checkBash probes for an MSYS/MINGW bash that round-trips argv correctly.
+    const { checkBash } = require('./detect-deps.js');
+    const bash = checkBash();
+    if (!bash.ok) {
       console.log('⚠️  This gate requires bash to run shell scripts.');
-      console.log('   On Windows, install Git for Windows (includes Git Bash) or enable WSL.');
+      // No WSL suggestion: these hooks need Git Bash specifically — the WSL
+      // bash is rejected by the probe above (Linux filesystem view, dropped $1).
+      console.log('   On Windows, install Git for Windows (https://git-scm.com/download/win).');
       console.log('   Alternatively, install the required tool directly and run the gate again.');
       return;
     }
+    bashCommand = bash.path;
   }
   const scriptDir = path.dirname(scriptPath);
   const commonScript = [
@@ -62,7 +69,7 @@ function runGateAdapter(scriptPath, cwd = process.cwd()) {
   // execFileSync avoids an extra /bin/sh layer, so bash receives the script as a
   // single argv arg (no shell-metacharacter injection through the path).
   execFileSync(
-    'bash',
+    bashCommand,
     ['--noprofile', '--norc', '-c', wrap, 'xp-gate', commonScript, nowMsScript, scriptPath, process.execPath],
     { stdio: 'inherit', cwd }
   );

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-15T07:13:54.700Z",
+  "checked_at": "2026-10-16T13:39:44.004Z",
   "source": "network"
 }

package/lib/sprint-status.js

@@ -345,8 +345,11 @@ async function handleSprintStatus(args = []) {
 
   if (dirIdx >= 0 && dirIdx + 1 < args.length) {
     searchDir = path.resolve(args[dirIdx + 1]);
-    // Path traversal protection: must be under cwd
-    if (!searchDir.startsWith(process.cwd())) {
+    // Path traversal protection: must be under cwd. Use path.relative instead
+    // of a prefix match so a sibling like `<cwd>2` cannot bypass the check
+    // (#392-#5).
+    const rel = path.relative(process.cwd(), searchDir);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
       console.error('Error: --dir path must be under current working directory');
       return 1;
     }