@boyingliu01/xp-gate 0.27.4 → 0.27.6

package/lib/__tests__/doctor-delphi.test.js

@@ -1,244 +1,293 @@
-/**
- * @test doctor-delphi
- * @intent Guard #414 REQ-3/REQ-6: `xp-gate doctor delphi` turns the failure
- * modes measured on real machines into diagnosable checks — drifted agent
- * bindings (B2), a skill install that silently lagged the published package
- * (B4), a runner script nobody can find (B3), and a config that cannot serve
- * three distinct models. Every check must be assertable in isolation, and the
- * npm-latest probe must be skippable so the doctor never needs the network.
- */
-const fs = require('fs');
-const path = require('path');
-const { resetLibModules, muteConsole, makeTempDirs, removeTempDirs } = require('./helpers/lib-sandbox.cjs');
-
-const LIB_MODULES = ['../init', '../detect-deps.js', '../shared-paths', '../doctor', '../delphi-setup'].map(name => require.resolve(name));
-
-function repoRoot() {
-  return path.join(__dirname, '..', '..', '..', '..');
-}
-
-function bundledSkillDir() {
-  return path.join(repoRoot(), 'src', 'npm-package', 'skills', 'delphi-review');
-}
-
-describe('doctor delphi (#414 REQ-3/REQ-6)', () => {
-  let tmpDirs;
-  let tmpHome;
-  let originalHome;
-
-  beforeEach(() => {
-    tmpDirs = makeTempDirs(['doctor-delphi-home']);
-    tmpHome = tmpDirs['doctor-delphi-home'];
-    originalHome = process.env.HOME;
-    process.env.HOME = tmpHome;
-    fs.mkdirSync(path.join(tmpHome, '.qoder'), { recursive: true });
-    resetLibModules(vi, LIB_MODULES);
-    muteConsole(vi);
-  });
-
-  afterEach(() => {
-    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
-    removeTempDirs(tmpDirs);
-    vi.restoreAllMocks();
-  });
-
-  function healthyHome() {
-    // A home that would pass the agent + skill-parity checks.
-    fs.mkdirSync(path.join(tmpHome, '.qoder', 'agents'), { recursive: true });
-    fs.mkdirSync(path.join(tmpHome, '.qoder', 'skills', 'delphi-review'), { recursive: true });
-    for (const role of ['architecture', 'technical', 'feasibility']) {
-      fs.copyFileSync(
-        path.join(repoRoot(), 'plugins', 'qoder', 'agents', `delphi-${role}.md`),
-        path.join(tmpHome, '.qoder', 'agents', `delphi-${role}.md`),
-      );
-    }
-    for (const f of fs.readdirSync(bundledSkillDir(), { withFileTypes: true })) {
-      const dest = path.join(tmpHome, '.qoder', 'skills', 'delphi-review', f.name);
-      if (f.isDirectory()) {
-        fs.mkdirSync(dest, { recursive: true });
-        for (const inner of fs.readdirSync(path.join(bundledSkillDir(), f.name))) {
-          if (fs.statSync(path.join(bundledSkillDir(), f.name, inner)).isFile()) {
-            fs.copyFileSync(path.join(bundledSkillDir(), f.name, inner), path.join(dest, inner));
-          }
-        }
-      } else if (f.isFile()) {
-        fs.copyFileSync(path.join(bundledSkillDir(), f.name), dest);
-      }
-    }
-  }
-
-  function writeConfig(configPath) {
-    fs.writeFileSync(configPath, JSON.stringify({
-      active_profile: 'default',
-      profiles: {
-        default: {
-          providers: {
-            gw: { base_url: 'https://gw.example/v1', api_key: 'k' },
-          },
-          experts: {
-            architecture: { provider: 'gw', model: 'model-a' },
-            technical: { provider: 'gw', model: 'model-b' },
-            feasibility: { provider: 'gw', model: 'model-c' },
-          },
-        },
-      },
-    }));
-    return configPath;
-  }
-
-  it('a fully healthy environment PASSes every check and exits 0', async () => {
-    healthyHome();
-    const { doctorDelphi } = require('../doctor');
-    const configPath = writeConfig(path.join(tmpDirs['doctor-delphi-home'], '.delphi-config.json'));
-    const localVersion = require('../../package.json').version;
-    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: localVersion });
-    expect(code).toBe(0);
-  });
-
-  it('a stale agent binding FAILs and names delphi-setup as the repair path', async () => {
-    healthyHome();
-    fs.writeFileSync(
-      path.join(tmpHome, '.qoder', 'agents', 'delphi-technical.md'),
-      '---\nname: delphi-technical\nmodel: "[Retired](retired-id)"\n---\n# body\n',
-    );
-    const { doctorDelphi } = require('../doctor');
-    const code = await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
-    expect(code).toBe(1);
-  });
-
-  it('a skill install that drifted from the bundled copy FAILs with a reinstall hint', async () => {
-    healthyHome();
-    const installed = path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'SKILL.md');
-    fs.appendFileSync(installed, '\ndrifted line\n');
-    const logs = [];
-    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
-    const { doctorDelphi } = require('../doctor');
-    await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
-    logSpy.mockRestore();
-    expect(logs.join('\n')).toMatch(/install-skill|reinstall/i);
-  });
-
-  it('a duplicate-model config FAILs instead of promising a review that will BLOCK', async () => {
-    healthyHome();
-    const configPath = path.join(tmpHome, '.delphi-config.json');
-    fs.writeFileSync(configPath, JSON.stringify({
-      active_profile: 'default',
-      profiles: {
-        default: {
-          providers: { gw: { base_url: 'https://gw.example/v1', api_key: 'k' } },
-          experts: {
-            architecture: { provider: 'gw', model: 'same' },
-            technical: { provider: 'gw', model: 'same' },
-            feasibility: { provider: 'gw', model: 'model-c' },
-          },
-        },
-      },
-    }));
-    const { doctorDelphi } = require('../doctor');
-    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
-    expect(code).toBe(1);
-  });
-
-  it('a missing config FAILs with the copy-the-example hint', async () => {
-    healthyHome();
-    const logs = [];
-    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
-    const { doctorDelphi } = require('../doctor');
-    await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
-    logSpy.mockRestore();
-    expect(logs.join('\n')).toMatch(/\.delphi-config\.json/);
-  });
-
-  it('npmLatest=null skips the version check without failing the run', async () => {
-    healthyHome();
-    const { doctorDelphi } = require('../doctor');
-    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
-    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
-    expect(code).toBe(0);
-  });
-
-  // R1 FC-07: the switch shipping off is the platform default, not a defect —
-  // only enabled-but-underprovisioned is a real FAIL.
-  it('DSH with subagentModelSelection absent is SKIP, not FAIL', async () => {
-    healthyHome();
-    fs.mkdirSync(path.join(tmpHome, '.dsh'), { recursive: true });
-    fs.writeFileSync(path.join(tmpHome, '.dsh', 'settings.json'), JSON.stringify({ other: true }));
-    const { doctorDelphi } = require('../doctor');
-    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
-    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
-    expect(code).toBe(0);
-  });
-
-  // R1 FC-09: a project-level agent set (delphi-setup --local --project) is
-  // what the doctor reads, so the repair loop closes.
-  it('a complete project-level agent set takes precedence over the HOME set', async () => {
-    healthyHome();
-    const projDir = fs.mkdtempSync(path.join(require('os').tmpdir(), 'doctor-delphi-proj-'));
-    try {
-      fs.mkdirSync(path.join(projDir, '.qoder', 'agents'), { recursive: true });
-      for (const role of ['architecture', 'technical', 'feasibility']) {
-        fs.copyFileSync(
-          path.join(repoRoot(), 'plugins', 'qoder', 'agents', `delphi-${role}.md`),
-          path.join(projDir, '.qoder', 'agents', `delphi-${role}.md`),
-        );
-      }
-      // Corrupt the HOME set; the project set must win and the run stays green.
-      fs.writeFileSync(
-        path.join(tmpHome, '.qoder', 'agents', 'delphi-technical.md'),
-        '---\nname: delphi-technical\nmodel: "[Retired](retired-id)"\n---\n# body\n',
-      );
-      const { doctorDelphi } = require('../doctor');
-      const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
-      const code = await doctorDelphi({
-        projectDir: projDir, configPath, npmLatest: null,
-      });
-      expect(code).toBe(0);
-    } finally {
-      fs.rmSync(projDir, { recursive: true, force: true });
-    }
-  });
-
-  // R1 MI-03: parity covers the whole bundled file set, so a stale references/
-  // copy cannot hide behind a matching SKILL.md.
-  it('a drifted references file FAILs parity even when SKILL.md matches', async () => {
-    healthyHome();
-    // R2 MJ-R2-01: the assertion must be the ONLY way this test can fail. An
-    // absent config would exit 1 regardless of parity, so the fixture supplies
-    // a valid one and lets the drifted file carry the verdict.
-    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
-    const refsDir = path.join(bundledSkillDir(), 'references');
-    const refFile = fs.existsSync(refsDir)
-      ? fs.readdirSync(refsDir).find((f) => f.endsWith('.md'))
-      : null;
-    expect(refFile).toBeTruthy(); // explicit: without a bundled reference this test has nothing to say
-    fs.mkdirSync(path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'references'), { recursive: true });
-    fs.appendFileSync(
-      path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'references', refFile),
-      '\ndrift\n',
-    );
-    const { doctorDelphi } = require('../doctor');
-    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
-    expect(code).toBe(1);
-  });
-
-  // R3 FC-01/FC-02: the empty-bundle branch is driven directly through the
-  // injectable bundledSkillDir — the healthy fixture cannot exercise it, and
-  // an indirect output-shape assertion would pass even without the fix.
-  it('an empty bundled skill directory FAILs parity instead of passing vacuously', async () => {
-    healthyHome();
-    const emptyBundle = fs.mkdtempSync(path.join(require('os').tmpdir(), 'doctor-empty-bundle-'));
-    try {
-      const logs = [];
-      const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
-      const { doctorDelphi } = require('../doctor');
-      const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
-      const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null, bundledSkillDir: emptyBundle });
-      logSpy.mockRestore();
-      expect(code).toBe(1);
-      const parityLine = logs.find((l) => l.includes('Delphi skill install parity'));
-      expect(parityLine).toContain('missing or empty');
-    } finally {
-      fs.rmSync(emptyBundle, { recursive: true, force: true });
-    }
-  });
-});
+/**
+ * @test doctor-delphi
+ * @intent Guard #414 REQ-3/REQ-6: `xp-gate doctor delphi` turns the failure
+ * modes measured on real machines into diagnosable checks — drifted agent
+ * bindings (B2), a skill install that silently lagged the published package
+ * (B4), a runner script nobody can find (B3), and a config that cannot serve
+ * three distinct models. Every check must be assertable in isolation, and the
+ * npm-latest probe must be skippable so the doctor never needs the network.
+ */
+const fs = require('fs');
+const path = require('path');
+const { resetLibModules, muteConsole, makeTempDirs, removeTempDirs } = require('./helpers/lib-sandbox.cjs');
+
+const LIB_MODULES = ['../init', '../detect-deps.js', '../shared-paths', '../doctor', '../delphi-setup'].map(name => require.resolve(name));
+
+function repoRoot() {
+  return path.join(__dirname, '..', '..', '..', '..');
+}
+
+function bundledSkillDir() {
+  return path.join(repoRoot(), 'src', 'npm-package', 'skills', 'delphi-review');
+}
+
+describe('doctor delphi (#414 REQ-3/REQ-6)', () => {
+  let tmpDirs;
+  let tmpHome;
+  let originalHome;
+
+  beforeEach(() => {
+    tmpDirs = makeTempDirs(['doctor-delphi-home']);
+    tmpHome = tmpDirs['doctor-delphi-home'];
+    originalHome = process.env.HOME;
+    process.env.HOME = tmpHome;
+    fs.mkdirSync(path.join(tmpHome, '.qoder'), { recursive: true });
+    resetLibModules(vi, LIB_MODULES);
+    muteConsole(vi);
+  });
+
+  afterEach(() => {
+    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+    removeTempDirs(tmpDirs);
+    vi.restoreAllMocks();
+  });
+
+  function healthyHome() {
+    // A home that would pass the agent + skill-parity checks.
+    fs.mkdirSync(path.join(tmpHome, '.qoder', 'agents'), { recursive: true });
+    fs.mkdirSync(path.join(tmpHome, '.qoder', 'skills', 'delphi-review'), { recursive: true });
+    for (const role of ['architecture', 'technical', 'feasibility']) {
+      fs.copyFileSync(
+        path.join(repoRoot(), 'plugins', 'qoder', 'agents', `delphi-${role}.md`),
+        path.join(tmpHome, '.qoder', 'agents', `delphi-${role}.md`),
+      );
+    }
+    for (const f of fs.readdirSync(bundledSkillDir(), { withFileTypes: true })) {
+      const dest = path.join(tmpHome, '.qoder', 'skills', 'delphi-review', f.name);
+      if (f.isDirectory()) {
+        fs.mkdirSync(dest, { recursive: true });
+        for (const inner of fs.readdirSync(path.join(bundledSkillDir(), f.name))) {
+          if (fs.statSync(path.join(bundledSkillDir(), f.name, inner)).isFile()) {
+            fs.copyFileSync(path.join(bundledSkillDir(), f.name, inner), path.join(dest, inner));
+          }
+        }
+      } else if (f.isFile()) {
+        fs.copyFileSync(path.join(bundledSkillDir(), f.name), dest);
+      }
+    }
+  }
+
+  function writeConfig(configPath) {
+    fs.writeFileSync(configPath, JSON.stringify({
+      active_profile: 'default',
+      profiles: {
+        default: {
+          providers: {
+            gw: { base_url: 'https://gw.example/v1', api_key: 'k' },
+          },
+          experts: {
+            architecture: { provider: 'gw', model: 'model-a' },
+            technical: { provider: 'gw', model: 'model-b' },
+            feasibility: { provider: 'gw', model: 'model-c' },
+          },
+        },
+      },
+    }));
+    return configPath;
+  }
+
+  it('a fully healthy environment PASSes every check and exits 0', async () => {
+    healthyHome();
+    const { doctorDelphi } = require('../doctor');
+    const configPath = writeConfig(path.join(tmpDirs['doctor-delphi-home'], '.delphi-config.json'));
+    const localVersion = require('../../package.json').version;
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: localVersion });
+    expect(code).toBe(0);
+  });
+
+  it('a stale agent binding FAILs and names delphi-setup as the repair path', async () => {
+    healthyHome();
+    fs.writeFileSync(
+      path.join(tmpHome, '.qoder', 'agents', 'delphi-technical.md'),
+      '---\nname: delphi-technical\nmodel: "[Retired](retired-id)"\n---\n# body\n',
+    );
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
+    expect(code).toBe(1);
+  });
+
+  it('a skill install that drifted from the bundled copy FAILs with a reinstall hint', async () => {
+    healthyHome();
+    const installed = path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'SKILL.md');
+    fs.appendFileSync(installed, '\ndrifted line\n');
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    const { doctorDelphi } = require('../doctor');
+    await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
+    logSpy.mockRestore();
+    expect(logs.join('\n')).toMatch(/install-skill|reinstall/i);
+  });
+
+  it('a duplicate-model config FAILs instead of promising a review that will BLOCK', async () => {
+    healthyHome();
+    const configPath = path.join(tmpHome, '.delphi-config.json');
+    fs.writeFileSync(configPath, JSON.stringify({
+      active_profile: 'default',
+      profiles: {
+        default: {
+          providers: { gw: { base_url: 'https://gw.example/v1', api_key: 'k' } },
+          experts: {
+            architecture: { provider: 'gw', model: 'same' },
+            technical: { provider: 'gw', model: 'same' },
+            feasibility: { provider: 'gw', model: 'model-c' },
+          },
+        },
+      },
+    }));
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    expect(code).toBe(1);
+  });
+
+  // #541 follow-up: the loaders fall back to the machine-wide global config
+  // ONLY on ENOENT, so a project-local file silently shadows the global one.
+  // When their seats differ, the effective model mix depends on cwd — exactly
+  // the cross-project drift class that burned quota (2026-10-03). Doctor must
+  // warn about the shadow; identical seats are a legitimate override.
+  it('#541 a project config whose seats differ from the global one WARNs as a shadow', async () => {
+    healthyHome();
+    const globalPath = path.join(tmpHome, '.config', 'xp-gate', '.delphi-config.json');
+    fs.mkdirSync(path.dirname(globalPath), { recursive: true });
+    writeConfig(globalPath);
+    const configPath = path.join(tmpHome, '.delphi-config.json');
+    fs.writeFileSync(configPath, JSON.stringify({
+      active_profile: 'default',
+      profiles: {
+        default: {
+          providers: { gw: { base_url: 'https://gw.example/v1', api_key: 'k' } },
+          experts: {
+            architecture: { provider: 'gw', model: 'other-a' },
+            technical: { provider: 'gw', model: 'model-b' },
+            feasibility: { provider: 'gw', model: 'model-c' },
+          },
+        },
+      },
+    }));
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, globalConfigPath: globalPath, npmLatest: null });
+    logSpy.mockRestore();
+    // A warning, not a failure: an intentional per-project override is legal.
+    expect(code).toBe(0);
+    expect(logs.join('\n')).toMatch(/shadow/i);
+  });
+
+  it('#541 a project config with seats identical to the global one does not warn', async () => {
+    healthyHome();
+    const globalPath = path.join(tmpHome, '.config', 'xp-gate', '.delphi-config.json');
+    fs.mkdirSync(path.dirname(globalPath), { recursive: true });
+    writeConfig(globalPath);
+    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, globalConfigPath: globalPath, npmLatest: null });
+    logSpy.mockRestore();
+    expect(code).toBe(0);
+    expect(logs.join('\n')).not.toMatch(/shadow/i);
+  });
+
+  it('a missing config FAILs with the copy-the-example hint', async () => {
+    healthyHome();
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    const { doctorDelphi } = require('../doctor');
+    await doctorDelphi({ projectDir: tmpHome, configPath: path.join(tmpHome, 'absent.json'), npmLatest: null });
+    logSpy.mockRestore();
+    expect(logs.join('\n')).toMatch(/\.delphi-config\.json/);
+  });
+
+  it('npmLatest=null skips the version check without failing the run', async () => {
+    healthyHome();
+    const { doctorDelphi } = require('../doctor');
+    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    expect(code).toBe(0);
+  });
+
+  // R1 FC-07: the switch shipping off is the platform default, not a defect —
+  // only enabled-but-underprovisioned is a real FAIL.
+  it('DSH with subagentModelSelection absent is SKIP, not FAIL', async () => {
+    healthyHome();
+    fs.mkdirSync(path.join(tmpHome, '.dsh'), { recursive: true });
+    fs.writeFileSync(path.join(tmpHome, '.dsh', 'settings.json'), JSON.stringify({ other: true }));
+    const { doctorDelphi } = require('../doctor');
+    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    expect(code).toBe(0);
+  });
+
+  // R1 FC-09: a project-level agent set (delphi-setup --local --project) is
+  // what the doctor reads, so the repair loop closes.
+  it('a complete project-level agent set takes precedence over the HOME set', async () => {
+    healthyHome();
+    const projDir = fs.mkdtempSync(path.join(require('os').tmpdir(), 'doctor-delphi-proj-'));
+    try {
+      fs.mkdirSync(path.join(projDir, '.qoder', 'agents'), { recursive: true });
+      for (const role of ['architecture', 'technical', 'feasibility']) {
+        fs.copyFileSync(
+          path.join(repoRoot(), 'plugins', 'qoder', 'agents', `delphi-${role}.md`),
+          path.join(projDir, '.qoder', 'agents', `delphi-${role}.md`),
+        );
+      }
+      // Corrupt the HOME set; the project set must win and the run stays green.
+      fs.writeFileSync(
+        path.join(tmpHome, '.qoder', 'agents', 'delphi-technical.md'),
+        '---\nname: delphi-technical\nmodel: "[Retired](retired-id)"\n---\n# body\n',
+      );
+      const { doctorDelphi } = require('../doctor');
+      const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+      const code = await doctorDelphi({
+        projectDir: projDir, configPath, npmLatest: null,
+      });
+      expect(code).toBe(0);
+    } finally {
+      fs.rmSync(projDir, { recursive: true, force: true });
+    }
+  });
+
+  // R1 MI-03: parity covers the whole bundled file set, so a stale references/
+  // copy cannot hide behind a matching SKILL.md.
+  it('a drifted references file FAILs parity even when SKILL.md matches', async () => {
+    healthyHome();
+    // R2 MJ-R2-01: the assertion must be the ONLY way this test can fail. An
+    // absent config would exit 1 regardless of parity, so the fixture supplies
+    // a valid one and lets the drifted file carry the verdict.
+    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+    const refsDir = path.join(bundledSkillDir(), 'references');
+    const refFile = fs.existsSync(refsDir)
+      ? fs.readdirSync(refsDir).find((f) => f.endsWith('.md'))
+      : null;
+    expect(refFile).toBeTruthy(); // explicit: without a bundled reference this test has nothing to say
+    fs.mkdirSync(path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'references'), { recursive: true });
+    fs.appendFileSync(
+      path.join(tmpHome, '.qoder', 'skills', 'delphi-review', 'references', refFile),
+      '\ndrift\n',
+    );
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    expect(code).toBe(1);
+  });
+
+  // R3 FC-01/FC-02: the empty-bundle branch is driven directly through the
+  // injectable bundledSkillDir — the healthy fixture cannot exercise it, and
+  // an indirect output-shape assertion would pass even without the fix.
+  it('an empty bundled skill directory FAILs parity instead of passing vacuously', async () => {
+    healthyHome();
+    const emptyBundle = fs.mkdtempSync(path.join(require('os').tmpdir(), 'doctor-empty-bundle-'));
+    try {
+      const logs = [];
+      const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+      const { doctorDelphi } = require('../doctor');
+      const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+      const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null, bundledSkillDir: emptyBundle });
+      logSpy.mockRestore();
+      expect(code).toBe(1);
+      const parityLine = logs.find((l) => l.includes('Delphi skill install parity'));
+      expect(parityLine).toContain('missing or empty');
+    } finally {
+      fs.rmSync(emptyBundle, { recursive: true, force: true });
+    }
+  });
+});

package/lib/doctor.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { execSync, spawnSync } = require('child_process');
+const { execSync, execFileSync, spawnSync } = require('child_process');
 const { exec } = require('child_process');
 const util = require('util');
 const execAsync = util.promisify(exec);
@@ -1959,7 +1959,11 @@ function fixMissingHooks(mode, srcDir, hooksDir) {
  */
 function fixCoreHooksPath(globalHooksDir) {
   try {
-    execSync(`git config --global core.hooksPath "${globalHooksDir}"`, {
+    // Args array instead of shell string interpolation: the value is a path
+    // that must never be re-parsed by a shell. Also keeps semgrep's
+    // detect-child-process rule from flagging this audited-safe call
+    // (same baseline as .semgrepignore).
+    execFileSync('git', ['config', '--global', 'core.hooksPath', globalHooksDir], {
       stdio: ['pipe', 'pipe', 'pipe'],
       timeout: EXEC_TIMEOUT_MS,
     });
@@ -2684,6 +2688,11 @@ function formatDoctorJson(checks, issues) {
 // runner script surfaced only as a failed review (B3).
 async function doctorDelphi(options = {}) {
   const { configPath, npmLatest } = options;
+  // #541: the shadow check needs the loader's global fallback path. It is
+  // injectable for tests; the default mirrors delphi-config.ts /
+  // delphi-external-review.cjs resolution (XDG_CONFIG_HOME honored).
+  const globalConfigPath = options.globalConfigPath
+    || path.join(process.env.XDG_CONFIG_HOME || path.join(require('os').homedir(), '.config'), 'xp-gate', '.delphi-config.json');
   const checks = [];
   const add = (name, status, detail) => checks.push({ name, status, detail });
 
@@ -2856,6 +2865,40 @@ async function doctorDelphi(options = {}) {
           add('Delphi config (.delphi-config.json)', 'PASS',
             `profile "${profileName}": ${models.join(' / ')}`);
         }
+        // #541 follow-up: shadow detection. Loaders fall back to the global
+        // config ONLY on ENOENT, so this project file always wins here. If the
+        // machine-wide config exists AND seats differ, the effective model mix
+        // depends on cwd — the cross-project drift class behind the 2026-10-03
+        // quota burn. Warn (intentional overrides are legal), never fail.
+        try {
+          if (fs.existsSync(globalConfigPath) && path.resolve(globalConfigPath) !== path.resolve(cfgPath)) {
+            const gRaw = JSON.parse(fs.readFileSync(globalConfigPath, 'utf8'));
+            const gProfileName = gRaw.active_profile || 'default';
+            const gProfile = gRaw.profiles && gRaw.profiles[gProfileName];
+            const gExperts = (gProfile && gProfile.experts) || {};
+            // Seat shape is object-keyed OR array in the wild (delphi-config.ts
+            // accepts both); normalize to a role->model map before comparing.
+            const pickExpert = (experts, role, idx) => {
+              if (!experts) return null;
+              if (Array.isArray(experts)) {
+                const e = experts.find((x) => x && x.role === role) || experts[idx];
+                return (e && e.model) || null;
+              }
+              return (experts[role] && experts[role].model) || null;
+            };
+            const gModels = roles.map((r, i) => pickExpert(gExperts, r, i));
+            // Compare only roles BOTH sides define: a role missing on one side
+            // is an incomplete config (check 5 already FAILs it), not drift.
+            const differing = roles.filter((r, i) => gModels[i] && models[i] && gModels[i] !== models[i]);
+            if (differing.length > 0) {
+              add('Delphi config shadow (#541)', 'WARN',
+                `project config shadows ${globalConfigPath}; seats differ (${differing.join(', ')}) — reviews run from other directories will use different models`);
+            }
+          }
+        } catch {
+          // A broken/unreadable global config is not this check's failure mode;
+          // silence here must not mask it elsewhere, so nothing is claimed.
+        }
       }
     } catch (err) {
       add('Delphi config (.delphi-config.json)', 'FAIL', `unparseable: ${err.message}`);
@@ -2926,7 +2969,7 @@ async function doctorDelphi(options = {}) {
   }
 
   for (const check of checks) {
-    const mark = check.status === 'PASS' ? '✓' : check.status === 'SKIP' ? '○' : '✗';
+    const mark = check.status === 'PASS' ? '✓' : check.status === 'SKIP' ? '○' : check.status === 'WARN' ? '⚠' : '✗';
     console.log(`  ${mark} ${check.name}: ${check.detail || check.status}`);
   }
   const failed = checks.filter((c) => c.status === 'FAIL').length;

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-17T15:37:03.841Z",
+  "checked_at": "2026-10-18T12:56:33.155Z",
   "source": "network"
 }