@boyingliu01/xp-gate 0.26.0 → 0.27.0

package/lib/check-alignment-runner.cjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+/**
+ * check-alignment-runner.cjs — Thin argv shim for test-alignment.ts
+ *
+ * Bridges the `xp-gate check-alignment` CLI to the TypeScript engine without
+ * shell-command interpolation of user-supplied paths (#392-#6).
+ *
+ * It is designed to be launched EITHER way:
+ *   1. In-repo (fast path): `node` loads this file after xp-gate.js already
+ *      called `require('tsx/cjs')`, so requiring `./test-alignment.ts` works.
+ *   2. Published global install (zero-install path): `npx -y tsx` runs this
+ *      file, and npx self-provisions tsx on demand (never a package dep), so
+ *      `./test-alignment.ts` loads even though the package ships zero deps.
+ *
+ * All user-supplied paths are passed as discrete argv elements, never embedded
+ * into a shell command string, preserving the #392-#6 injection fix.
+ */
+'use strict';
+
+const { execFileSync } = require('child_process');
+
+// --- argv parsing ----------------------------------------------------------
+function argValue(argv, flag) {
+  const idx = argv.indexOf(flag);
+  return idx >= 0 && idx + 1 < argv.length ? argv[idx + 1] : undefined;
+}
+function argFlag(argv, flag) {
+  return argv.includes(flag);
+}
+
+const specPath = argValue(process.argv, '--spec');
+const testDirsArg = argValue(process.argv, '--tests');
+const outputPath = argValue(process.argv, '--output');
+const jsonMode = argFlag(process.argv, '--json');
+
+if (!specPath) {
+  console.error('check-alignment: --spec <path> is required');
+  process.exit(1);
+}
+
+const testDirs = testDirsArg ? [testDirsArg] : undefined;
+
+let headCommit = 'unknown';
+try {
+  headCommit = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() || 'unknown';
+} catch (err) {
+  headCommit = 'unknown';
+}
+
+const { runFullAlignment } = require('./test-alignment.ts');
+
+let report;
+try {
+  report = runFullAlignment({
+    specPath,
+    testDirs,
+    headCommit,
+    outputPath: outputPath || undefined,
+  });
+} catch (err) {
+  console.error('check-alignment failed:', err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}
+
+if (jsonMode) {
+  console.log(JSON.stringify(report, null, 2));
+} else {
+  console.log('Status:', report.alignment_status);
+  console.log('Score:', report.score);
+  console.log('Misaligned:', report.misaligned_tests.length);
+}
+// Set exitCode instead of process.exit() so buffered stdout (notably the
+// --json document) flushes fully before the process terminates (#392 review).
+process.exitCode = report.alignment_status === 'PASS' ? 0 : 1;

package/lib/detect-deps.js

@@ -270,12 +270,88 @@ function getSkillsDirs(platform) {
   return profile.skillsDirs;
 }
 
+/**
+ * Resolve a bash that can actually run the hooks.
+ *
+ * On Windows, `bash` on PATH is ambiguous: WSL installs C:\Windows\System32\
+ * bash.exe (a Linux interpreter whose filesystem view does not contain the
+ * Windows temp dirs the tooling passes to it), and its argv handling silently
+ * drops the positional arguments a `-c` script expects ($1 empty → scripts
+ * source nothing and "succeed" vacuously). Git for Windows ships the MSYS bash
+ * the hooks are written for. Probe candidates with an argv round-trip plus an
+ * uname check — only an MSYS/MINGW/CYGWIN bash counts on win32; a plain
+ * "bash --version" success proves nothing.
+ * @returns {string|null}
+ */
+function probeWindowsBash() {
+  const { spawnSync } = require('child_process');
+  // `where` runs through the same module so tests can fake discovery + probe.
+  const { execSync: localExecSync } = require('child_process');
+  return resolveWindowsBashCandidates(spawnSync, localExecSync);
+}
+
+// Candidate list + probe loop split out for behavior tests: a fake spawner can
+// simulate the WSL stub (echoes Linux / drops $1) vs an MSYS bash without any
+// real interpreter on PATH (Delphi walkthrough R1, MN-06).
+function resolveWindowsBashCandidates(spawnProbe, whereExecSync) {
+  const _execSync = whereExecSync || execSync;
+  const candidates = [];
+  try {
+    const found = _execSync('where bash', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    for (const line of found.split(/\r?\n/)) if (line.trim()) candidates.push(line.trim());
+  } catch { /* where unavailable */ }
+  candidates.push(
+    'C:\\Program Files\\Git\\bin\\bash.exe',
+    'C:\\Program Files\\Git\\usr\\bin\\bash.exe',
+    'C:\\Program Files (x86)\\Git\\bin\\bash.exe',
+    'C:\\Program Files (x86)\\Git\\usr\\bin\\bash.exe',
+    'C:\\msys64\\usr\\bin\\bash.exe',
+    'C:\\cygwin64\\bin\\bash.exe'
+  );
+  for (const candidate of candidates) {
+    try {
+      const r = spawnProbe(candidate, ['-c', 'echo "[$1]"; uname -s', 'sh', 'XPGATE_ARGV_PROBE'], {
+        encoding: 'utf8',
+        timeout: 5000,
+        windowsHide: true,
+      });
+      const out = String((r && r.stdout) || '');
+      if (out.includes('[XPGATE_ARGV_PROBE]') && /(MINGW|MSYS|CYGWIN)/i.test(out)) {
+        return candidate;
+      }
+    } catch { /* next candidate */ }
+  }
+  return null;
+}
+
 /**
  * Check if bash is available on the system.
  * XP-Gate hooks are bash scripts — Windows users need Git Bash installed.
  * @returns {{ok: boolean, path?: string, message?: string}}
  */
 function checkBash() {
+  // On Windows resolve explicitly: PATH may lead with the WSL System32 stub,
+  // which cannot execute these hooks (wrong filesystem view, dropped $1).
+  if (process.platform === 'win32') {
+    const winBash = probeWindowsBash();
+    if (winBash) {
+      let version = 'unknown';
+      try {
+        // spawnSync with discrete argv — never interpolate a discovered path
+        // into a shell string (a PATH dir name may carry cmd metacharacters).
+        const result = spawnSync(winBash, ['--version'], { encoding: 'utf8', timeout: 5000 });
+        const versionMatch = String(result.stdout || '').match(/version\s+([^\s]+)/);
+        if (versionMatch) version = versionMatch[1];
+      } catch { /* keep unknown */ }
+      return { ok: true, path: winBash, version };
+    }
+    return {
+      ok: false,
+      message: 'bash not found. Windows users must install [Git for Windows](https://git-scm.com/download/win).\n' +
+        '   During installation, ensure "Git Bash Here" is checked — this adds bash.exe to PATH.\n' +
+        '   After installation, restart your terminal and run `npm install` again.'
+    };
+  }
   try {
     // Try 'bash' first (works on Linux/macOS and when Git Bash is in PATH)
     const result = execSync('bash --version', {
@@ -289,17 +365,11 @@ function checkBash() {
       version: versionMatch ? versionMatch[1] : 'unknown'
     };
   } catch (e) {
-    // On Windows with Git Bash, try common locations
+    // POSIX fallback: common absolute locations
     const bashPaths = [
-      // Git for Windows
-      'C:\\Program Files\\Git\\bin\\bash.exe',
-      'C:\\Program Files\\Git\\usr\\bin\\bash.exe',
-      'C:\\Program Files (x86)\\Git\\bin\\bash.exe',
-      'C:\\Program Files (x86)\\Git\\usr\\bin\\bash.exe',
-      // MSYS2
-      'C:\\msys64\\usr\\bin\\bash.exe',
-      // Cygwin
-      'C:\\cygwin64\\bin\\bash.exe',
+      '/bin/bash',
+      '/usr/bin/bash',
+      '/usr/local/bin/bash',
     ];
 
     for (const bashPath of bashPaths) {
@@ -319,15 +389,7 @@ function checkBash() {
       }
     }
 
-    // Windows-specific guidance
-    if (process.platform === 'win32') {
-      return {
-        ok: false,
-        message: 'bash not found. Windows users must install [Git for Windows](https://git-scm.com/download/win).\n' +
-          '   During installation, ensure "Git Bash Here" is checked — this adds bash.exe to PATH.\n' +
-          '   After installation, restart your terminal and run `npm install` again.'
-      };
-    }
+    // Windows is handled above; this fallback only runs on POSIX now.
 
     return {
       ok: false,
@@ -505,6 +567,7 @@ function compareVersions(a, b) {
 module.exports = {
   checkDeps,
   checkBash,
+  resolveWindowsBashCandidates,
   autoInstallDeps,
   detectPlatform,
   getSkillsDirs,

package/lib/gate-runner.js

@@ -18,15 +18,22 @@ const path = require('node:path');
  * behaves exactly as it does inside the commit hook.
  */
 function runGateAdapter(scriptPath, cwd = process.cwd()) {
+  let bashCommand = 'bash';
   if (process.platform === 'win32') {
-    try {
-      execSync('bash --version', { stdio: 'pipe', timeout: 5000 });
-    } catch {
+    // PATH may lead with the WSL System32 stub, which cannot run these hooks
+    // (Linux filesystem view, and `-c` scripts receive an empty $1 through it).
+    // checkBash probes for an MSYS/MINGW bash that round-trips argv correctly.
+    const { checkBash } = require('./detect-deps.js');
+    const bash = checkBash();
+    if (!bash.ok) {
       console.log('⚠️  This gate requires bash to run shell scripts.');
-      console.log('   On Windows, install Git for Windows (includes Git Bash) or enable WSL.');
+      // No WSL suggestion: these hooks need Git Bash specifically — the WSL
+      // bash is rejected by the probe above (Linux filesystem view, dropped $1).
+      console.log('   On Windows, install Git for Windows (https://git-scm.com/download/win).');
       console.log('   Alternatively, install the required tool directly and run the gate again.');
       return;
     }
+    bashCommand = bash.path;
   }
   const scriptDir = path.dirname(scriptPath);
   const commonScript = [
@@ -62,7 +69,7 @@ function runGateAdapter(scriptPath, cwd = process.cwd()) {
   // execFileSync avoids an extra /bin/sh layer, so bash receives the script as a
   // single argv arg (no shell-metacharacter injection through the path).
   execFileSync(
-    'bash',
+    bashCommand,
     ['--noprofile', '--norc', '-c', wrap, 'xp-gate', commonScript, nowMsScript, scriptPath, process.execPath],
     { stdio: 'inherit', cwd }
   );

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-16T00:33:22.006Z",
+  "checked_at": "2026-10-16T13:39:44.004Z",
   "source": "network"
 }

package/lib/sprint-status.js

@@ -345,8 +345,11 @@ async function handleSprintStatus(args = []) {
 
   if (dirIdx >= 0 && dirIdx + 1 < args.length) {
     searchDir = path.resolve(args[dirIdx + 1]);
-    // Path traversal protection: must be under cwd
-    if (!searchDir.startsWith(process.cwd())) {
+    // Path traversal protection: must be under cwd. Use path.relative instead
+    // of a prefix match so a sibling like `<cwd>2` cannot bypass the check
+    // (#392-#5).
+    const rel = path.relative(process.cwd(), searchDir);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
       console.error('Error: --dir path must be under current working directory');
       return 1;
     }

package/lib/test-alignment.ts

@@ -230,28 +230,124 @@ function countAssertions(content: string): number {
 }
 
 /**
- * Extract JSDoc block preceding a test/it/describe declaration.
- * Handles .each(), .skip(), .todo() variants and backtick template literals.
+ * Given a content string and the index where the test callback arrow/function
+ * begins (the position of `() =>` or `function() {`), scan forward with brace
+ * matching to return the full callback body (including the outer braces).
+ * Skips single/double quoted strings, backtick template literals, and line/block
+ * comments so braces inside them do not throw off matching.
+ */
+function extractCallbackBody(content: string, callbackStart: number): string {
+  // Find the opening brace of the callback body after `() => {` / `function() {`.
+  let i = callbackStart;
+  let inLineComment = false;
+  let inBlockComment = false;
+  let inSingle = false;
+  let inDouble = false;
+  let inTemplate = false;
+  let depth = 0;
+  let started = false;
+  let openIdx = -1;
+
+  while (i < content.length) {
+    const c = content[i];
+    const n = content[i + 1];
+
+    if (inLineComment) {
+      if (c === '\n') inLineComment = false;
+      i++;
+      continue;
+    }
+    if (inBlockComment) {
+      if (c === '*' && n === '/') { inBlockComment = false; i += 2; continue; }
+      i++;
+      continue;
+    }
+    if (inSingle) {
+      if (c === '\\') { i += 2; continue; }
+      if (c === '\'') inSingle = false;
+      i++;
+      continue;
+    }
+    if (inDouble) {
+      if (c === '\\') { i += 2; continue; }
+      if (c === '"') inDouble = false;
+      i++;
+      continue;
+    }
+    if (inTemplate) {
+      if (c === '\\') { i += 2; continue; }
+      if (c === '`') inTemplate = false;
+      // Template `${}` interpolation can contain braces; treat interpolation
+      // content conservatively by not toggling depth on braces inside it.
+      i++;
+      continue;
+    }
+
+    if (c === '/' && n === '/') { inLineComment = true; i += 2; continue; }
+    if (c === '/' && n === '*') { inBlockComment = true; i += 2; continue; }
+    if (c === '\'') { inSingle = true; i++; continue; }
+    if (c === '"') { inDouble = true; i++; continue; }
+    if (c === '`') { inTemplate = true; i++; continue; }
+
+    if (c === '{') {
+      if (!started) { started = true; openIdx = i; depth = 1; }
+      else depth++;
+      i++;
+      continue;
+    }
+    if (c === '}') {
+      depth--;
+      if (depth === 0) {
+        return content.slice(openIdx, i + 1);
+      }
+      i++;
+      continue;
+    }
+
+    i++;
+  }
+
+  // No balanced body found — the declaration had no callback body (e.g. a
+  // `test.todo('name');` line). Return an empty body so it counts 0 assertions.
+  return '';
+}
+
+/**
+ * Extract JSDoc block preceding a test/it/describe declaration, along with the
+ * *function body* of the callback (so assertion counting is per-test, not
+ * per-file). Handles .skip(), .todo(), .only() variants and backtick template
+ * literals.
+ *
+ * Known limitation (pre-existing, not introduced by #392): `test.each([...])`
+ * parameterised forms are NOT matched, because the argument list is a bracketed
+ * array literal and the name string follows it without a comma. This means such
+ * tests are omitted from assertion counting. Coverage determination itself is
+ * driven by `@covers` tags, so this only affects the avg-assertions data-validity
+ * heuristic, never AC coverage. Tracked separately from #392.
  */
 function extractJSDocBeforeTest(content: string): Array<{ jsdoc: string; testBody: string; testName: string }> {
   const results: Array<{ jsdoc: string; testBody: string; testName: string }> = [];
 
-  // Match: /** JSDOC */ (test|it|describe)[.modifier]( [args], )'name', ...
-  // `.each` variants have an extra `()` before the test name string
-  const testPattern = /\/\*\*([\s\S]*?)\*\/(?:[\s\n]*)(?:test|it|describe)(?:\.(?:each|skip|todo|only))?\s*\([^)]*\)\s*,\s*\(\s*(?:['"]([^'"]+)['"]|`([^`]*)`)\s*[,\)]/g;
+  // Match: /** JSDOC */ (test|it|describe)[.modifier]( [args], )'name', ( [params] ) => {
+  // `.each` variants have an extra `()` before the test name string.
+  // Group 4 (bodyStart) points at the callback open paren so we can brace-match
+  // the real function body.
+  const testPattern = /\/\*\*([\s\S]*?)\*\/(?:[\s\n]*)(?:test|it|describe)(?:\.(?:each|skip|todo|only))?\s*\([^)]*\)\s*,\s*\(\s*(?:['"]([^'"]+)['"]|`([^`]*)`)\s*\)?\s*,?\s*(?:\([^)]*\)\s*=>)?\s*/g;
 
   let match: RegExpExecArray | null;
   while ((match = testPattern.exec(content)) !== null) {
     const jsdoc = match[1]!;
     const testName = match[2] || match[3] || '';
     if (testName) {
-      const testBody = content.slice(match.index, match.index + match[0].length);
+      const body = extractCallbackBody(content, match.index + match[0].length);
+      // JSDoc + declaration + function body gives a self-contained test body.
+      const testBody = content.slice(match.index, match.index + match[0].length) + body;
       results.push({ jsdoc, testBody, testName });
     }
   }
 
   // Second pass: match standard test/it/describe without .each
-  const simplePattern = /\/\*\*([\s\S]*?)\*\/(?:[\s\n]*)(?:test|it|describe)(?:\.(?:skip|todo|only))?\s*\(\s*(?:['"]([^'"]+)['"]|`([^`]*)`)\s*[,\)]/g;
+  const simplePattern = /\/\*\*([\s\S]*?)\*\/(?:[\s\n]*)(?:test|it|describe)(?:\.(?:skip|todo|only))?\s*\(\s*(?:['"]([^'"]+)['"]|`([^`]*)`)\s*\)?\s*,?\s*(?:\([^)]*\)\s*=>)?\s*/g;
 
   while ((match = simplePattern.exec(content)) !== null) {
     const jsdoc = match[1]!;
@@ -260,7 +356,8 @@ function extractJSDocBeforeTest(content: string): Array<{ jsdoc: string; testBod
       // Don't duplicate if already found in first pass
       const alreadyFound = results.some(r => r.jsdoc === jsdoc);
       if (!alreadyFound) {
-        const testBody = content.slice(match.index, match.index + match[0].length);
+        const body = extractCallbackBody(content, match.index + match[0].length);
+        const testBody = content.slice(match.index, match.index + match[0].length) + body;
         results.push({ jsdoc, testBody, testName });
       }
     }
@@ -269,6 +366,27 @@ function extractJSDocBeforeTest(content: string): Array<{ jsdoc: string; testBod
   return results;
 }
 
+/**
+ * Extract a Python test function body: from the `def test_xxx():` line up to
+ * (but not including) the next top-level `def ` line or end of file. This keeps
+ * assertion counting scoped to the individual test.
+ */
+function extractPythonTestBody(content: string, defIndex: number): string {
+  const nextDef = content.indexOf('\ndef ', defIndex);
+  const endIdx = nextDef === -1 ? content.length : nextDef;
+  return content.slice(defIndex, endIdx);
+}
+
+/**
+ * Extract a Go test function body via brace matching starting at the opening
+ * brace that follows `func Test_xxx()`. Returns the full `{ ... }` block.
+ */
+function extractGoTestBody(content: string, funcIndex: number): string {
+  const braceIdx = content.indexOf('{', funcIndex);
+  if (braceIdx === -1) return '';
+  return extractCallbackBody(content, braceIdx);
+}
+
 function pushTestWithCovers(
   tests: TestCase[],
   testPath: string,
@@ -276,6 +394,7 @@ function pushTestWithCovers(
   reqId: string,
   intent: string | undefined,
   fileContent: string,
+  bodyContent: string,
   totalAssertionsRef: { value: number },
 ) {
   const coversRegex = /@covers\s+(.+)/g;
@@ -285,7 +404,9 @@ function pushTestWithCovers(
     covers.push(...coversMatch[1]!.split(',').map(s => s.trim()).filter(c => /^AC-[A-Z0-9]+-\d+-\d+$/.test(c)));
   }
 
-  const assertions = countAssertions(fileContent);
+  // Count assertions against the *per-test body*, not the whole file, so
+  // totalAssertions is not inflated by fileCount x perFileCount (#392-#1).
+  const assertions = countAssertions(bodyContent);
   totalAssertionsRef.value += assertions;
 
   tests.push({
@@ -319,7 +440,7 @@ export function parseTestFiles(testPaths: string[]): TestMap {
         // Filter: only valid AC IDs (AC-XXX-NNN-NN pattern)
         const covers = coversRaw.filter(c => /^AC-[A-Z0-9]+-\d+-\d+$/.test(c));
 
-        const assertions = countAssertions(content);
+        const assertions = countAssertions(m.testBody);
         totalAssertionsObj.value += assertions;
 
         tests.push({
@@ -336,7 +457,8 @@ export function parseTestFiles(testPaths: string[]): TestMap {
       const pyTestPattern = /(# @test\s+(REQ-[A-Z0-9]+-[A-Z0-9]+)[\s\S]*?)(?:# @intent\s+(.+?)\n)?def\s+(test_\w+)/g;
       let m: RegExpExecArray | null;
       while ((m = pyTestPattern.exec(content)) !== null) {
-        pushTestWithCovers(tests, testPath, m[4]!, m[2]!, m[3]?.trim(), content, totalAssertionsObj);
+        const body = extractPythonTestBody(content, m.index + m[0].lastIndexOf('def '));
+        pushTestWithCovers(tests, testPath, m[4]!, m[2]!, m[3]?.trim(), content, body, totalAssertionsObj);
       }
     } else if (ext === '.go') {
       const goTestPattern = /(\/\/ @test\s+(REQ-[A-Z0-9]+-[A-Z0-9]+))\s*[\s\S]*?func\s+(Test_\w+)/g;
@@ -344,7 +466,9 @@ export function parseTestFiles(testPaths: string[]): TestMap {
       while ((m = goTestPattern.exec(content)) !== null) {
         const block = content.slice(Math.max(0, m.index - 500), m.index);
         const intentMatch = block.match(/\/\/ @intent\s+(.+)/);
-        pushTestWithCovers(tests, testPath, m[3]!, m[2]!, intentMatch?.[1]?.trim(), content, totalAssertionsObj);
+        const funcStart = m.index + m[0].lastIndexOf('func ');
+        const body = extractGoTestBody(content, funcStart);
+        pushTestWithCovers(tests, testPath, m[3]!, m[2]!, intentMatch?.[1]?.trim(), content, body, totalAssertionsObj);
       }
     }
   }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-16
-**Commit:** 98096abe
+**Commit:** 429f73c5
 **Branch:** main
-**Version:** 0.26.0.0
+**Version:** 0.27.0.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-16
-**Commit:** 98096abe
+**Commit:** 429f73c5
 **Branch:** main
-**Version:** 0.26.0.0
+**Version:** 0.27.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-16
-**Commit:** 98096abe
+**Commit:** 429f73c5
 **Branch:** main
-**Version:** 0.26.0.0
+**Version:** 0.27.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-16
-**Commit:** 98096abe
+**Commit:** 429f73c5
 **Branch:** main
-**Version:** 0.26.0.0
+**Version:** 0.27.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-16
-**Commit:** 98096abe
+**Commit:** 429f73c5
 **Branch:** main
-**Version:** 0.26.0.0
+**Version:** 0.27.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/README.md

@@ -185,6 +185,6 @@ npm run build:dsh-plugin       # = node scripts/build-plugin.mjs --platform dsh
 ## 注意
 
 - `lib/` 与 `skills/` 是**构建产物**（已 gitignore），不提交。
-- `scripts/prepack.cjs` 目前硬编码 12 个 skill，**不含 `clipboard-vision`**（仓库有 13 个）。
+- `scripts/prepack.cjs` 的 skill 列表为**动态发现**（读取仓库 `skills/`），不硬编码。
 - `plugins/dsh/package.json` 的 peerDeps 仍 pin `0.1.1-rc.2`，但实测运行在 `0.2.0-rc.2` 上
   `defineTool` / `TOOL_ABORTED` / `HarnessError` 签名未变，无需改写。

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/scripts/prepack.cjs

@@ -10,8 +10,8 @@
  * plugins/opencode/scripts/prepack.cjs).
  *
  * The skill list is DISCOVERED, not hardcoded: a hardcoded list silently drifts
- * from the repo (it previously shipped 12 of 13, omitting clipboard-vision, and
- * would need editing on every new skill) — see #448.
+ * from the repo (a hardcoded set previously omitted one shipped skill, breaking
+ * parity) — see #448.
  */
 
 const fs = require('fs');

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-16
-**Commit:** 98096abe
+**Commit:** 429f73c5
 **Branch:** main
-**Version:** 0.26.0.0
+**Version:** 0.27.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-16
-**Commit:** 98096abe
+**Commit:** 429f73c5
 **Branch:** main
-**Version:** 0.26.0.0
+**Version:** 0.27.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-16
-**Commit:** 98096abe
+**Commit:** 429f73c5
 **Branch:** main
-**Version:** 0.26.0.0
+**Version:** 0.27.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.