@boyingliu01/xp-gate 0.27.4 → 0.27.5

package/lib/__tests__/sprint-audit.test.js

@@ -1,207 +1,207 @@
-/**
- * Tests for sprint-audit CLI command (Layer 2)
- * @test REQ-338 Sprint audit — final completeness check
- * @intent Verify sprint-audit correctly checks phase coverage, artifacts, consistency
- * @covers AC-AUDIT-01 (SKIP when no sprint-state.json)
- * @covers AC-AUDIT-02 (PASS when 6/6 completed)
- * @covers AC-AUDIT-03 (PASS_WITH_WARNINGS when 4-5/6 completed)
- * @covers AC-AUDIT-04 (FAIL when <4/6 completed)
- * @covers AC-AUDIT-05 (FAIL on state inconsistency)
- * @covers AC-AUDIT-06 (--json flag outputs JSON)
- * @covers AC-AUDIT-07 (report persisted to audit-report.json)
- */
-
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import { handleSprintAudit } from '../sprint-audit.js';
-
-describe('sprint-audit', () => {
-  let tmpDir;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sprint-audit-test-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  function writeState(state) {
-    const stateDir = path.join(tmpDir, '.sprint-state');
-    fs.mkdirSync(stateDir, { recursive: true });
-    fs.writeFileSync(path.join(stateDir, 'sprint-state.json'), JSON.stringify(state));
-  }
-
-  function makeState(overrides = {}) {
-    return {
-      _schema_version: 1,
-      id: 'sprint-test-audit',
-      task_description: 'Test audit feature',
-      phase: 6,
-      status: 'completed',
-      started_at: '2026-07-22T10:00:00Z',
-      phase_history: [],
-      isolation: { branch: 'sprint/test-audit', worktree_path: null },
-      outputs: {},
-      ...overrides,
-    };
-  }
-
-  function makePhaseHistory(completedPhases) {
-    const phaseNames = ['PREP', 'DESIGN', 'BUILD', 'VERIFY', 'SHIP', 'CLOSE'];
-    return completedPhases.map((p, i) => ({
-      phase: p,
-      phase_name: phaseNames[p - 1],
-      status: 'completed',
-      started_at: `2026-07-22T10:${String(i).padStart(2, '0')}:00Z`,
-      completed_at: `2026-07-22T10:${String(i).padStart(2, '0')}:30Z`,
-      duration_seconds: 30,
-    }));
-  }
-
-  describe('handleSprintAudit()', () => {
-    it('returns 0 and shows help with --help', async () => {
-      const code = await handleSprintAudit(['--help']);
-      expect(code).toBe(0);
-    });
-
-    it('returns SKIP (exit 0) when no sprint-state.json exists', async () => {
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir]);
-      expect(code).toBe(0);
-      expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('No sprint-state.json'));
-      logSpy.mockRestore();
-    });
-
-    it('returns PASS when 6/6 phases completed', async () => {
-      writeState(makeState({ phase_history: makePhaseHistory([1, 2, 3, 4, 5, 6]) }));
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir]);
-      expect(code).toBe(0);
-      // Check output contains PASS
-      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
-      expect(output).toContain('PASS');
-      expect(output).toContain('6/6');
-      logSpy.mockRestore();
-    });
-
-    it('returns PASS_WITH_WARNINGS when 5/6 completed', async () => {
-      writeState(makeState({ phase: 5, phase_history: makePhaseHistory([1, 2, 3, 4, 5]) }));
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir]);
-      expect(code).toBe(0);
-      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
-      expect(output).toContain('PASS_WITH_WARNINGS');
-      logSpy.mockRestore();
-    });
-
-    it('returns PASS_WITH_WARNINGS when 4/6 completed', async () => {
-      writeState(makeState({ phase: 4, phase_history: makePhaseHistory([1, 2, 3, 4]) }));
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir]);
-      expect(code).toBe(0);
-      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
-      expect(output).toContain('PASS_WITH_WARNINGS');
-      logSpy.mockRestore();
-    });
-
-    it('returns FAIL when <4/6 completed', async () => {
-      writeState(makeState({ phase: 3, phase_history: makePhaseHistory([1, 2, 3]) }));
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir]);
-      expect(code).toBe(1);
-      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
-      expect(output).toContain('FAIL');
-      logSpy.mockRestore();
-    });
-
-    it('returns FAIL on state inconsistency (phase vs phase_history)', async () => {
-      const history = makePhaseHistory([1, 2, 3, 4, 5, 6]);
-      writeState(makeState({ phase: 3, phase_history: history })); // phase=3 but last entry is 6
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir]);
-      expect(code).toBe(1);
-      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
-      expect(output).toContain('State inconsistency');
-      logSpy.mockRestore();
-    });
-
-    it('outputs JSON when --json flag is set', async () => {
-      writeState(makeState({ phase_history: makePhaseHistory([1, 2, 3, 4, 5, 6]) }));
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir, '--json']);
-      expect(code).toBe(0);
-      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
-      const result = JSON.parse(output);
-      expect(result.verdict).toBe('PASS');
-      expect(result.coverage.completed).toBe(6);
-      logSpy.mockRestore();
-    });
-
-    it('counts skipped phases as completed in coverage', async () => {
-      const history = makePhaseHistory([1, 2, 3, 4, 5]);
-      history.push({
-        phase: 6, phase_name: 'CLOSE', status: 'skipped',
-        started_at: '2026-07-22T10:05:00Z', completed_at: '2026-07-22T10:05:00Z', duration_seconds: 0,
-      });
-      writeState(makeState({ phase: 6, phase_history: history }));
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir, '--json']);
-      expect(code).toBe(0);
-      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
-      const result = JSON.parse(output);
-      expect(result.coverage.completed).toBe(6);
-      expect(result.verdict).toBe('PASS');
-      logSpy.mockRestore();
-    });
-
-    it('warns about missing summary files for completed phases', async () => {
-      writeState(makeState({ phase_history: makePhaseHistory([1, 2, 3, 4, 5, 6]) }));
-      // No phase-outputs directory → all summaries missing
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir, '--json']);
-      expect(code).toBe(0);
-      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
-      const result = JSON.parse(output);
-      expect(result.warnings.length).toBeGreaterThan(0);
-      expect(result.warnings.some(w => w.includes('summary missing'))).toBe(true);
-      logSpy.mockRestore();
-    });
-
-    it('persists audit report to audit-report.json', async () => {
-      writeState(makeState({ phase_history: makePhaseHistory([1, 2, 3, 4, 5, 6]) }));
-
-      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-      await handleSprintAudit(['--dir', tmpDir]);
-      logSpy.mockRestore();
-
-      const reportPath = path.join(tmpDir, '.sprint-state', 'audit-report.json');
-      expect(fs.existsSync(reportPath)).toBe(true);
-      const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
-      expect(report.verdict).toBe('PASS');
-      expect(report.sprint_id).toBe('sprint-test-audit');
-    });
-
-    it('handles corrupted sprint-state.json gracefully', async () => {
-      const stateDir = path.join(tmpDir, '.sprint-state');
-      fs.mkdirSync(stateDir, { recursive: true });
-      fs.writeFileSync(path.join(stateDir, 'sprint-state.json'), 'not-valid-json');
-
-      const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-      const code = await handleSprintAudit(['--dir', tmpDir]);
-      expect(code).toBe(1);
-      expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('Failed to parse'));
-      errSpy.mockRestore();
-    });
-  });
-});
+/**
+ * Tests for sprint-audit CLI command (Layer 2)
+ * @test REQ-338 Sprint audit — final completeness check
+ * @intent Verify sprint-audit correctly checks phase coverage, artifacts, consistency
+ * @covers AC-AUDIT-01 (SKIP when no sprint-state.json)
+ * @covers AC-AUDIT-02 (PASS when 6/6 completed)
+ * @covers AC-AUDIT-03 (PASS_WITH_WARNINGS when 4-5/6 completed)
+ * @covers AC-AUDIT-04 (FAIL when <4/6 completed)
+ * @covers AC-AUDIT-05 (FAIL on state inconsistency)
+ * @covers AC-AUDIT-06 (--json flag outputs JSON)
+ * @covers AC-AUDIT-07 (report persisted to audit-report.json)
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { handleSprintAudit } from '../sprint-audit.js';
+
+describe('sprint-audit', () => {
+  let tmpDir;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sprint-audit-test-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  function writeState(state) {
+    const stateDir = path.join(tmpDir, '.sprint-state');
+    fs.mkdirSync(stateDir, { recursive: true });
+    fs.writeFileSync(path.join(stateDir, 'sprint-state.json'), JSON.stringify(state));
+  }
+
+  function makeState(overrides = {}) {
+    return {
+      _schema_version: 1,
+      id: 'sprint-test-audit',
+      task_description: 'Test audit feature',
+      phase: 6,
+      status: 'completed',
+      started_at: '2026-07-22T10:00:00Z',
+      phase_history: [],
+      isolation: { branch: 'sprint/test-audit', worktree_path: null },
+      outputs: {},
+      ...overrides,
+    };
+  }
+
+  function makePhaseHistory(completedPhases) {
+    const phaseNames = ['PREP', 'DESIGN', 'BUILD', 'VERIFY', 'SHIP', 'CLOSE'];
+    return completedPhases.map((p, i) => ({
+      phase: p,
+      phase_name: phaseNames[p - 1],
+      status: 'completed',
+      started_at: `2026-07-22T10:${String(i).padStart(2, '0')}:00Z`,
+      completed_at: `2026-07-22T10:${String(i).padStart(2, '0')}:30Z`,
+      duration_seconds: 30,
+    }));
+  }
+
+  describe('handleSprintAudit()', () => {
+    it('returns 0 and shows help with --help', async () => {
+      const code = await handleSprintAudit(['--help']);
+      expect(code).toBe(0);
+    });
+
+    it('returns SKIP (exit 0) when no sprint-state.json exists', async () => {
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir]);
+      expect(code).toBe(0);
+      expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('No sprint-state.json'));
+      logSpy.mockRestore();
+    });
+
+    it('returns PASS when 6/6 phases completed', async () => {
+      writeState(makeState({ phase_history: makePhaseHistory([1, 2, 3, 4, 5, 6]) }));
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir]);
+      expect(code).toBe(0);
+      // Check output contains PASS
+      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
+      expect(output).toContain('PASS');
+      expect(output).toContain('6/6');
+      logSpy.mockRestore();
+    });
+
+    it('returns PASS_WITH_WARNINGS when 5/6 completed', async () => {
+      writeState(makeState({ phase: 5, phase_history: makePhaseHistory([1, 2, 3, 4, 5]) }));
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir]);
+      expect(code).toBe(0);
+      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
+      expect(output).toContain('PASS_WITH_WARNINGS');
+      logSpy.mockRestore();
+    });
+
+    it('returns PASS_WITH_WARNINGS when 4/6 completed', async () => {
+      writeState(makeState({ phase: 4, phase_history: makePhaseHistory([1, 2, 3, 4]) }));
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir]);
+      expect(code).toBe(0);
+      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
+      expect(output).toContain('PASS_WITH_WARNINGS');
+      logSpy.mockRestore();
+    });
+
+    it('returns FAIL when <4/6 completed', async () => {
+      writeState(makeState({ phase: 3, phase_history: makePhaseHistory([1, 2, 3]) }));
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir]);
+      expect(code).toBe(1);
+      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
+      expect(output).toContain('FAIL');
+      logSpy.mockRestore();
+    });
+
+    it('returns FAIL on state inconsistency (phase vs phase_history)', async () => {
+      const history = makePhaseHistory([1, 2, 3, 4, 5, 6]);
+      writeState(makeState({ phase: 3, phase_history: history })); // phase=3 but last entry is 6
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir]);
+      expect(code).toBe(1);
+      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
+      expect(output).toContain('State inconsistency');
+      logSpy.mockRestore();
+    });
+
+    it('outputs JSON when --json flag is set', async () => {
+      writeState(makeState({ phase_history: makePhaseHistory([1, 2, 3, 4, 5, 6]) }));
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir, '--json']);
+      expect(code).toBe(0);
+      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
+      const result = JSON.parse(output);
+      expect(result.verdict).toBe('PASS');
+      expect(result.coverage.completed).toBe(6);
+      logSpy.mockRestore();
+    });
+
+    it('counts skipped phases as completed in coverage', async () => {
+      const history = makePhaseHistory([1, 2, 3, 4, 5]);
+      history.push({
+        phase: 6, phase_name: 'CLOSE', status: 'skipped',
+        started_at: '2026-07-22T10:05:00Z', completed_at: '2026-07-22T10:05:00Z', duration_seconds: 0,
+      });
+      writeState(makeState({ phase: 6, phase_history: history }));
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir, '--json']);
+      expect(code).toBe(0);
+      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
+      const result = JSON.parse(output);
+      expect(result.coverage.completed).toBe(6);
+      expect(result.verdict).toBe('PASS');
+      logSpy.mockRestore();
+    });
+
+    it('warns about missing summary files for completed phases', async () => {
+      writeState(makeState({ phase_history: makePhaseHistory([1, 2, 3, 4, 5, 6]) }));
+      // No phase-outputs directory → all summaries missing
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir, '--json']);
+      expect(code).toBe(0);
+      const output = logSpy.mock.calls.map(c => c[0]).join('\n');
+      const result = JSON.parse(output);
+      expect(result.warnings.length).toBeGreaterThan(0);
+      expect(result.warnings.some(w => w.includes('summary missing'))).toBe(true);
+      logSpy.mockRestore();
+    });
+
+    it('persists audit report to audit-report.json', async () => {
+      writeState(makeState({ phase_history: makePhaseHistory([1, 2, 3, 4, 5, 6]) }));
+
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      await handleSprintAudit(['--dir', tmpDir]);
+      logSpy.mockRestore();
+
+      const reportPath = path.join(tmpDir, '.sprint-state', 'audit-report.json');
+      expect(fs.existsSync(reportPath)).toBe(true);
+      const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+      expect(report.verdict).toBe('PASS');
+      expect(report.sprint_id).toBe('sprint-test-audit');
+    });
+
+    it('handles corrupted sprint-state.json gracefully', async () => {
+      const stateDir = path.join(tmpDir, '.sprint-state');
+      fs.mkdirSync(stateDir, { recursive: true });
+      fs.writeFileSync(path.join(stateDir, 'sprint-state.json'), 'not-valid-json');
+
+      const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+      const code = await handleSprintAudit(['--dir', tmpDir]);
+      expect(code).toBe(1);
+      expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('Failed to parse'));
+      errSpy.mockRestore();
+    });
+  });
+});

package/lib/doctor.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { execSync, spawnSync } = require('child_process');
+const { execSync, execFileSync, spawnSync } = require('child_process');
 const { exec } = require('child_process');
 const util = require('util');
 const execAsync = util.promisify(exec);
@@ -1959,7 +1959,11 @@ function fixMissingHooks(mode, srcDir, hooksDir) {
  */
 function fixCoreHooksPath(globalHooksDir) {
   try {
-    execSync(`git config --global core.hooksPath "${globalHooksDir}"`, {
+    // Args array instead of shell string interpolation: the value is a path
+    // that must never be re-parsed by a shell. Also keeps semgrep's
+    // detect-child-process rule from flagging this audited-safe call
+    // (same baseline as .semgrepignore).
+    execFileSync('git', ['config', '--global', 'core.hooksPath', globalHooksDir], {
       stdio: ['pipe', 'pipe', 'pipe'],
       timeout: EXEC_TIMEOUT_MS,
     });
@@ -2684,6 +2688,11 @@ function formatDoctorJson(checks, issues) {
 // runner script surfaced only as a failed review (B3).
 async function doctorDelphi(options = {}) {
   const { configPath, npmLatest } = options;
+  // #541: the shadow check needs the loader's global fallback path. It is
+  // injectable for tests; the default mirrors delphi-config.ts /
+  // delphi-external-review.cjs resolution (XDG_CONFIG_HOME honored).
+  const globalConfigPath = options.globalConfigPath
+    || path.join(process.env.XDG_CONFIG_HOME || path.join(require('os').homedir(), '.config'), 'xp-gate', '.delphi-config.json');
   const checks = [];
   const add = (name, status, detail) => checks.push({ name, status, detail });
 
@@ -2856,6 +2865,40 @@ async function doctorDelphi(options = {}) {
           add('Delphi config (.delphi-config.json)', 'PASS',
             `profile "${profileName}": ${models.join(' / ')}`);
         }
+        // #541 follow-up: shadow detection. Loaders fall back to the global
+        // config ONLY on ENOENT, so this project file always wins here. If the
+        // machine-wide config exists AND seats differ, the effective model mix
+        // depends on cwd — the cross-project drift class behind the 2026-10-03
+        // quota burn. Warn (intentional overrides are legal), never fail.
+        try {
+          if (fs.existsSync(globalConfigPath) && path.resolve(globalConfigPath) !== path.resolve(cfgPath)) {
+            const gRaw = JSON.parse(fs.readFileSync(globalConfigPath, 'utf8'));
+            const gProfileName = gRaw.active_profile || 'default';
+            const gProfile = gRaw.profiles && gRaw.profiles[gProfileName];
+            const gExperts = (gProfile && gProfile.experts) || {};
+            // Seat shape is object-keyed OR array in the wild (delphi-config.ts
+            // accepts both); normalize to a role->model map before comparing.
+            const pickExpert = (experts, role, idx) => {
+              if (!experts) return null;
+              if (Array.isArray(experts)) {
+                const e = experts.find((x) => x && x.role === role) || experts[idx];
+                return (e && e.model) || null;
+              }
+              return (experts[role] && experts[role].model) || null;
+            };
+            const gModels = roles.map((r, i) => pickExpert(gExperts, r, i));
+            // Compare only roles BOTH sides define: a role missing on one side
+            // is an incomplete config (check 5 already FAILs it), not drift.
+            const differing = roles.filter((r, i) => gModels[i] && models[i] && gModels[i] !== models[i]);
+            if (differing.length > 0) {
+              add('Delphi config shadow (#541)', 'WARN',
+                `project config shadows ${globalConfigPath}; seats differ (${differing.join(', ')}) — reviews run from other directories will use different models`);
+            }
+          }
+        } catch {
+          // A broken/unreadable global config is not this check's failure mode;
+          // silence here must not mask it elsewhere, so nothing is claimed.
+        }
       }
     } catch (err) {
       add('Delphi config (.delphi-config.json)', 'FAIL', `unparseable: ${err.message}`);
@@ -2926,7 +2969,7 @@ async function doctorDelphi(options = {}) {
   }
 
   for (const check of checks) {
-    const mark = check.status === 'PASS' ? '✓' : check.status === 'SKIP' ? '○' : '✗';
+    const mark = check.status === 'PASS' ? '✓' : check.status === 'SKIP' ? '○' : check.status === 'WARN' ? '⚠' : '✗';
     console.log(`  ${mark} ${check.name}: ${check.detail || check.status}`);
   }
   const failed = checks.filter((c) => c.status === 'FAIL').length;

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-17T15:37:03.841Z",
+  "checked_at": "2026-10-18T12:53:19.772Z",
   "source": "network"
 }