@boyingliu01/xp-gate 0.27.6 → 0.28.1

package/scripts/delphi-external-review.cjs

@@ -25,66 +25,87 @@ function isValidTimeoutMs(value) {
   return Number.isInteger(value) && value >= 1000 && value <= 600000;
 }
 
-function parseArgs(argv) {
+// Flag -> args key. `null` marks flags that take no value. Keeping this as data
+// means a new flag is one table row instead of one more switch arm (the switch
+// had grown to ten arms plus a special case for --timeout-ms).
+const VALUE_FLAGS = {
+  '--expert': 'expert',
+  '--input': 'input',
+  '--input-file': 'inputFile',
+  '--round': 'round',
+  '--config': 'config',
+  '--mode': 'mode',
+  '--profile': 'profile',
+  '--other-experts-file': 'otherExpertsFile',
+};
+const BOOLEAN_FLAGS = { '--fallback-local': 'fallbackLocal' };
+const INTEGER_FLAGS = { '--round': (v) => parseInt(v) };
+
+function collectRawArgs(argv) {
   const args = {};
   let timeoutMsRaw;
   for (let i = 0; i < argv.length; i++) {
-    switch (argv[i]) {
-      case '--expert': args.expert = argv[++i]; break;
-      case '--input': args.input = argv[++i]; break;
-      case '--input-file': args.inputFile = argv[++i]; break;
-      case '--round': args.round = parseInt(argv[++i]); break;
-      case '--config': args.config = argv[++i]; break;
-      case '--mode': args.mode = argv[++i]; break;
-      case '--profile': args.profile = argv[++i]; break;
-      case '--other-experts-file': args.otherExpertsFile = argv[++i]; break;
-      case '--timeout-ms': timeoutMsRaw = argv[++i]; break;
-      case '--fallback-local': args.fallbackLocal = true; break;
-      default: break;
-    }
-  }
+    const flag = argv[i];
+    if (flag === '--timeout-ms') { timeoutMsRaw = argv[++i]; continue; }
+    if (BOOLEAN_FLAGS[flag]) { args[BOOLEAN_FLAGS[flag]] = true; continue; }
+    const key = VALUE_FLAGS[flag];
+    if (!key) continue;
+    const value = argv[++i];
+    args[key] = INTEGER_FLAGS[flag] ? INTEGER_FLAGS[flag](value) : value;
+  }
+  return { args, timeoutMsRaw };
+}
 
-  // Validate required args
+function fail(message) {
+  console.error(`[delphi-review] ERROR: ${message}`);
+  process.exit(1);
+}
+
+// Every rejection path used to inline its own console.error + exit. Collected
+// here so the rules read as rules and each message stays verbatim.
+function missingArgumentList(args) {
   const missing = [];
   if (!args.expert) missing.push('--expert');
   if (!args.input && !args.inputFile) missing.push('--input or --input-file');
   if (!args.round) missing.push('--round');
   if (!args.config) missing.push('--config');
+  return missing;
+}
 
-  if (missing.length > 0) {
-    console.error(`[delphi-review] ERROR: Missing required arguments: ${missing.join(', ')}`);
-    process.exit(1);
+function applyTimeoutFlag(args, timeoutMsRaw) {
+  if (timeoutMsRaw === undefined) return;
+  const parsed = /^\d+$/.test(timeoutMsRaw) ? Number(timeoutMsRaw) : NaN;
+  if (!isValidTimeoutMs(parsed)) {
+    fail('--timeout-ms must be an integer between 1000 and 600000.');
   }
+  args.timeoutMs = parsed;
+}
 
-  // Validate expert role
-  if (!VALID_EXPERTS.includes(args.expert)) {
-    console.error(`[delphi-review] ERROR: Invalid expert role "${args.expert}". Must be one of: ${VALID_EXPERTS.join(', ')}`);
-    process.exit(1);
+function resolveMode(args) {
+  if (!args.mode) args.mode = 'design';
+  if (!VALID_MODES.includes(args.mode)) {
+    fail(`Invalid mode "${args.mode}". Must be one of: ${VALID_MODES.join(', ')}`);
   }
+}
 
-  // Validate mutual exclusivity of --input and --input-file
-  if (args.input && args.inputFile) {
-    console.error('[delphi-review] ERROR: --input and --input-file are mutually exclusive. Use only one.');
-    process.exit(1);
+function requireArgs(args, timeoutMsRaw) {
+  const missing = missingArgumentList(args);
+  if (missing.length > 0) {
+    fail(`Missing required arguments: ${missing.join(', ')}`);
   }
-
-  // Validate --timeout-ms: integer within [1000, 600000]
-  if (timeoutMsRaw !== undefined) {
-    const parsed = /^\d+$/.test(timeoutMsRaw) ? Number(timeoutMsRaw) : NaN;
-    if (!isValidTimeoutMs(parsed)) {
-      console.error('[delphi-review] ERROR: --timeout-ms must be an integer between 1000 and 600000.');
-      process.exit(1);
-    }
-    args.timeoutMs = parsed;
+  if (!VALID_EXPERTS.includes(args.expert)) {
+    fail(`Invalid expert role "${args.expert}". Must be one of: ${VALID_EXPERTS.join(', ')}`);
   }
-
-  // Defaults
-  if (!args.mode) args.mode = 'design';
-  if (!VALID_MODES.includes(args.mode)) {
-    console.error(`[delphi-review] ERROR: Invalid mode "${args.mode}". Must be one of: ${VALID_MODES.join(', ')}`);
-    process.exit(1);
+  if (args.input && args.inputFile) {
+    fail('--input and --input-file are mutually exclusive. Use only one.');
   }
+  applyTimeoutFlag(args, timeoutMsRaw);
+  resolveMode(args);
+}
 
+function parseArgs(argv) {
+  const { args, timeoutMsRaw } = collectRawArgs(argv);
+  requireArgs(args, timeoutMsRaw);
   return args;
 }
 
@@ -223,61 +244,75 @@ function readConfig(configPath, profileOverride) {
 // ── Distinct-model validation ───────────────────────────────────────────
 const REQUIRED_EXPERT_ROLES = ['architecture', 'technical', 'feasibility'];
 
-function validateDistinctModels(experts, providers, consensus = {}) {
-  const expertMap = experts && typeof experts === 'object' ? experts : {};
-  const providerMap = providers && typeof providers === 'object' ? providers : {};
-  const expertRoles = Object.keys(expertMap);
-  const normalizedModels = [];
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.trim() !== '';
+}
 
+// Roles must be EXACTLY the three required ones: a missing role means the
+// review would silently run with two experts, an extra one means the config
+// no longer matches the three-model policy. One pass reports both.
+function collectModelAssignments(expertMap) {
+  const assignments = [];
   for (const role of REQUIRED_EXPERT_ROLES) {
-    const expert = expertRoles.includes(role) ? expertMap[role] : undefined;
-    if (!expert) {
-      return { valid: false, reason: `Missing required expert role: ${role}.` };
-    }
-    if (typeof expert.model !== 'string' || expert.model.trim() === '') {
-      return { valid: false, reason: `Expert ${role} must define a non-empty model.` };
+    const expert = expertMap[role];
+    if (!expert) return { error: `Missing required expert role: ${role}.` };
+    if (!isNonEmptyString(expert.model)) {
+      return { error: `Expert ${role} must define a non-empty model.` };
     }
-    normalizedModels.push({ role, model: expert.model.trim() });
-  }
-
-  const unexpectedRole = expertRoles.find(role => !REQUIRED_EXPERT_ROLES.includes(role));
-  if (unexpectedRole) {
-    return { valid: false, reason: `Unsupported expert role: ${unexpectedRole}.` };
+    assignments.push({ role, model: expert.model.trim() });
   }
+  const unexpectedRole = Object.keys(expertMap).find(role => !REQUIRED_EXPERT_ROLES.includes(role));
+  if (unexpectedRole) return { error: `Unsupported expert role: ${unexpectedRole}.` };
+  return { assignments };
+}
 
+function findDuplicateModel(assignments) {
   const seen = new Map();
-  for (const assignment of normalizedModels) {
-    const previousRole = seen.get(assignment.model);
+  for (const { role, model } of assignments) {
+    const previousRole = seen.get(model);
     if (previousRole) {
-      return {
-        valid: false,
-        reason: `duplicate model "${assignment.model}" assigned to ${previousRole} and ${assignment.role}.`,
-      };
+      return `duplicate model "${model}" assigned to ${previousRole} and ${role}.`;
     }
-    seen.set(assignment.model, assignment.role);
+    seen.set(model, role);
+  }
+  return null;
+}
+
+// Everything an expert's provider must carry to be callable. Returns the
+// human-readable reason instead of throwing, so the caller keeps one shape.
+function providerConfigError(role, expert, providerMap) {
+  if (!isNonEmptyString(expert.provider) || expert.provider === 'local') {
+    return `Expert ${role} must define a non-local callable provider.`;
+  }
+  const provider = providerMap[expert.provider];
+  if (!provider || typeof provider !== 'object' || Array.isArray(provider)) {
+    return `Expert ${role} provider configuration must be an object.`;
+  }
+  if (!isNonEmptyString(provider.base_url)) {
+    return `Expert ${role} provider must define a non-empty base_url.`;
   }
+  if (!isNonEmptyString(provider.api_key)) {
+    return `Expert ${role} provider must define a non-empty api_key.`;
+  }
+  if (provider.timeout_ms !== undefined && !isValidTimeoutMs(provider.timeout_ms)) {
+    return `Expert ${role} provider ${expert.provider} timeout_ms must be an integer between 1000 and 600000.`;
+  }
+  return null;
+}
+
+function validateDistinctModels(experts, providers, consensus = {}) {
+  const expertMap = experts && typeof experts === 'object' ? experts : {};
+  const providerMap = providers && typeof providers === 'object' ? providers : {};
+
+  const collected = collectModelAssignments(expertMap);
+  if (collected.error) return { valid: false, reason: collected.error };
+
+  const duplicate = findDuplicateModel(collected.assignments);
+  if (duplicate) return { valid: false, reason: duplicate };
 
   for (const role of REQUIRED_EXPERT_ROLES) {
-    const expert = expertMap[role];
-    if (typeof expert.provider !== 'string' || expert.provider.trim() === '' || expert.provider === 'local') {
-      return { valid: false, reason: `Expert ${role} must define a non-local callable provider.` };
-    }
-    const provider = providerMap[expert.provider];
-    if (!provider || typeof provider !== 'object' || Array.isArray(provider)) {
-      return { valid: false, reason: `Expert ${role} provider configuration must be an object.` };
-    }
-    if (typeof provider.base_url !== 'string' || provider.base_url.trim() === '') {
-      return { valid: false, reason: `Expert ${role} provider must define a non-empty base_url.` };
-    }
-    if (typeof provider.api_key !== 'string' || provider.api_key.trim() === '') {
-      return { valid: false, reason: `Expert ${role} provider must define a non-empty api_key.` };
-    }
-    if (provider.timeout_ms !== undefined && !isValidTimeoutMs(provider.timeout_ms)) {
-      return {
-        valid: false,
-        reason: `Expert ${role} provider ${expert.provider} timeout_ms must be an integer between 1000 and 600000.`,
-      };
-    }
+    const error = providerConfigError(role, expertMap[role], providerMap);
+    if (error) return { valid: false, reason: error };
   }
 
   if (consensus.cross_provider_required === true) {
@@ -454,25 +489,32 @@ function describePromptBudgetFailure({ bytes, maxBytes, expert }) {
 // routed seat, and a ~60 byte smoke probe on the "dead" seat passed in 7s.
 // The optional per-seat `prompt_calibration` record carries the measured
 // bounds so failures can be classified against evidence instead of guessed.
+// A calibration record is only usable when it carries a measured PASS bound
+// and, if it also carries a FAIL bound, that bound is strictly larger. Each
+// broken shape names itself so the operator knows which field to correct.
+const CALIBRATION_SHAPE_HINT = 'needs measured_at and a finite last_pass_bytes > 0 (last_fail_bytes, if present, must be larger)';
+
+function isPositiveFinite(value) {
+  return Number.isFinite(value) && value > 0;
+}
+
+function calibrationProblem(raw) {
+  if (!isPlainObject(raw)) return 'must be an object';
+  const pass = raw.last_pass_bytes;
+  const fail = raw.last_fail_bytes;
+  const failOk = fail === undefined || isPositiveFinite(fail);
+  if (!isPositiveFinite(pass) || !failOk) return CALIBRATION_SHAPE_HINT;
+  if (fail !== undefined && !(fail > pass)) return 'has last_fail_bytes <= last_pass_bytes';
+  if (!isNonEmptyString(raw.measured_at)) return CALIBRATION_SHAPE_HINT;
+  return null;
+}
+
 function resolveSeatCalibration(expertConfig) {
   const raw = expertConfig && expertConfig.prompt_calibration;
   if (raw === undefined) return { calibration: null };
-  const warn = (detail) => {
-    console.error(`[delphi-review] WARNING: prompt_calibration ${detail}; ignoring the record.`);
-  };
-  if (!isPlainObject(raw)) {
-    warn('must be an object');
-    return { calibration: null, warning: 'prompt_calibration_malformed' };
-  }
-  const hasPass = Number.isFinite(raw.last_pass_bytes) && raw.last_pass_bytes > 0;
-  const hasFail = raw.last_fail_bytes === undefined
-    || (Number.isFinite(raw.last_fail_bytes) && raw.last_fail_bytes > 0);
-  const ordered = hasPass && hasFail
-    && (raw.last_fail_bytes === undefined || raw.last_fail_bytes > raw.last_pass_bytes);
-  if (!hasPass || !hasFail || typeof raw.measured_at !== 'string' || raw.measured_at.trim() === '' || !ordered) {
-    warn(raw.last_fail_bytes !== undefined && hasPass && raw.last_fail_bytes <= raw.last_pass_bytes
-      ? 'has last_fail_bytes <= last_pass_bytes'
-      : 'needs measured_at and a finite last_pass_bytes > 0 (last_fail_bytes, if present, must be larger)');
+  const problem = calibrationProblem(raw);
+  if (problem) {
+    console.error(`[delphi-review] WARNING: prompt_calibration ${problem}; ignoring the record.`);
     return { calibration: null, warning: 'prompt_calibration_malformed' };
   }
   return {
@@ -492,40 +534,61 @@ function resolveSeatCalibration(expertConfig) {
 // sends operators chasing a cause that is not there (#481). Everything else
 // gets a stable error_type so orchestrators can assert on the class instead of
 // parsing prose.
+// The calibrated ceiling for a seat, or null when the seat carries no usable
+// record. Null is meaningful: it is the "no evidence to reclassify on" branch.
+function calibratedCeiling(calibration) {
+  if (calibration && Number.isFinite(calibration.last_pass_bytes)) return calibration.last_pass_bytes;
+  return null;
+}
+
+// `error_kind` is the primary signal; the message literal stays as a
+// backward-compatible fallback for callers that hand-build results.
+function isPreResponseDrop(result) {
+  return !result.retryable
+    && (result.error_kind === 'pre_response_drop' || result.message === 'Network error.');
+}
+
+function sizeExceededResult(result, promptBytes, threshold) {
+  return {
+    ...result,
+    error_type: 'SIZE_EXCEEDED',
+    retryable: false,
+    bytes: promptBytes,
+    calibrated_pass_bytes: threshold,
+    message: `Request dropped before any response: ${promptBytes} bytes exceeds this seat's calibrated passing size `
+      + `(${threshold} bytes). Classified SIZE_EXCEEDED, not a network fault — trim the payload or recalibrate the seat.`,
+  };
+}
+
+// No calibration means no evidence to reclassify on — but an uncalibrated
+// seat dying on a full-budget payload is exactly how #481 started. Keep the
+// class honest (network_error) and point the operator at the protocol.
+function uncalibratedBudgetHint(result, promptBytes) {
+  return {
+    ...result,
+    error_type: 'network_error',
+    bytes: promptBytes,
+    message: `${result.message} Note: this seat has no prompt_calibration record and the payload is at the `
+      + 'default budget — this pattern matches an uncalibrated size ceiling. Recalibrate per the #481 protocol.',
+  };
+}
+
 function classifySeatFailure({ result, promptBytes, calibration }) {
   if (!result || !result.error) return result;
-  const threshold = calibration && Number.isFinite(calibration.last_pass_bytes)
-    ? calibration.last_pass_bytes
-    : null;
-  // `error_kind` is the primary signal; the message literal stays as a
-  // backward-compatible fallback for callers that hand-build results.
-  const isPreResponseDrop = !result.retryable
-    && (result.error_kind === 'pre_response_drop' || result.message === 'Network error.');
-  if (isPreResponseDrop && threshold !== null && Number.isFinite(promptBytes) && promptBytes > threshold) {
-    return {
-      ...result,
-      error_type: 'SIZE_EXCEEDED',
-      retryable: false,
-      bytes: promptBytes,
-      calibrated_pass_bytes: threshold,
-      message: `Request dropped before any response: ${promptBytes} bytes exceeds this seat's calibrated passing size `
-        + `(${threshold} bytes). Classified SIZE_EXCEEDED, not a network fault — trim the payload or recalibrate the seat.`,
-    };
+  if (!isPreResponseDrop(result)) {
+    return { ...result, error_type: result.retryable ? 'retryable_error' : 'network_error' };
   }
-  if (isPreResponseDrop && threshold === null && Number.isFinite(promptBytes)
-    && promptBytes >= DEFAULT_PROMPT_BUDGET_BYTES) {
-    // No calibration means no evidence to reclassify on — but an uncalibrated
-    // seat dying on a full-budget payload is exactly how #481 started. Keep the
-    // class honest (network_error) and point the operator at the protocol.
-    return {
-      ...result,
-      error_type: 'network_error',
-      bytes: promptBytes,
-      message: `${result.message} Note: this seat has no prompt_calibration record and the payload is at the `
-        + 'default budget — this pattern matches an uncalibrated size ceiling. Recalibrate per the #481 protocol.',
-    };
+  const threshold = calibratedCeiling(calibration);
+  if (!Number.isFinite(promptBytes)) {
+    return { ...result, error_type: 'network_error' };
+  }
+  if (threshold !== null && promptBytes > threshold) {
+    return sizeExceededResult(result, promptBytes, threshold);
+  }
+  if (threshold === null && promptBytes >= DEFAULT_PROMPT_BUDGET_BYTES) {
+    return uncalibratedBudgetHint(result, promptBytes);
   }
-  return { ...result, error_type: result.retryable ? 'retryable_error' : 'network_error' };
+  return { ...result, error_type: 'network_error' };
 }
 
 // ── Schema retry (#414 REQ-5) ──────────────────────────────────────────

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-18
-**Commit:** 17c3c043
+**Generated:** 2026-10-19
+**Commit:** 9b545de5
 **Branch:** main
-**Version:** 0.27.6.0
+**Version:** 0.28.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-18
-**Commit:** 17c3c043
+**Generated:** 2026-10-19
+**Commit:** 9b545de5
 **Branch:** main
-**Version:** 0.27.6.0
+**Version:** 0.28.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-18
-**Commit:** 17c3c043
+**Generated:** 2026-10-19
+**Commit:** 9b545de5
 **Branch:** main
-**Version:** 0.27.6.0
+**Version:** 0.28.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/command.d.ts

@@ -1,32 +0,0 @@
-import { type ShellDialect } from "./dialect.js";
-export { type ShellDialect, detectDialect, shellQuote, shq } from "./dialect.js";
-/** Shown when the global `xp-gate` CLI is not on PATH. */
-export declare const FALLBACK_MESSAGE = "[XP-Gate] xp-gate CLI not installed. Install it with: npm install -g @boyingliu01/xp-gate";
-/**
- * Allowlist of xp-gate gate aliases that are safe to invoke standalone
- * (non-preCommitOnly gates + common aliases). Anything outside this set is
- * rejected before reaching the shell.
- */
-export declare const GATE_WHITELIST: readonly ["duplicates", "complexity", "principles", "arch", "architecture", "iac", "secrets", "sast"];
-export type GateId = (typeof GATE_WHITELIST)[number];
-export declare function isGateAllowed(gate: string): boolean;
-export interface BuildCommandOptions {
-    subcommand: "check" | "principles" | "arch";
-    target?: string;
-    gates?: readonly string[];
-    config?: string;
-    /**
-     * Executor dialect. Defaults to `"posix"` so existing callers keep working;
-     * callers running under DSH on Windows must pass `"powershell"`.
-     */
-    dialect?: ShellDialect;
-}
-/**
- * Build a single guarded shell command: runs `xp-gate …` when the global CLI
- * is present, otherwise prints the graceful-degradation hint. A single
- * presence check avoids a separate probe/run race.
- */
-export declare function buildCommand(options: BuildCommandOptions): string;
-/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
-export declare function resolveTarget(rawPath: string, cwd: string): string;
-//# sourceMappingURL=command.d.ts.map

package/plugins/dsh/lib/command.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAc,MAAM,cAAc,CAAA;AAI5D,OAAO,EAAE,KAAK,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEhF,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,8FACgE,CAAA;AAE7F;;;;GAIG;AACH,eAAO,MAAM,cAAc,uGASjB,CAAA;AAEV,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,GAAG,YAAY,GAAG,MAAM,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB;AA+BD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAmBjE;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/plugins/dsh/lib/command.js

@@ -1,81 +0,0 @@
-import { isAbsolute, resolve } from "node:path";
-import { shellQuote } from "./dialect.js";
-// Re-exported so existing importers of this module keep working; the dialect
-// primitives themselves live in ./dialect.ts.
-export { detectDialect, shellQuote, shq } from "./dialect.js";
-/** Shown when the global `xp-gate` CLI is not on PATH. */
-export const FALLBACK_MESSAGE = "[XP-Gate] xp-gate CLI not installed. Install it with: npm install -g @boyingliu01/xp-gate";
-/**
- * Allowlist of xp-gate gate aliases that are safe to invoke standalone
- * (non-preCommitOnly gates + common aliases). Anything outside this set is
- * rejected before reaching the shell.
- */
-export const GATE_WHITELIST = [
-    "duplicates",
-    "complexity",
-    "principles",
-    "arch",
-    "architecture",
-    "iac",
-    "secrets",
-    "sast",
-];
-export function isGateAllowed(gate) {
-    return GATE_WHITELIST.includes(gate);
-}
-function buildInner(options, dialect) {
-    const { subcommand, target, gates, config } = options;
-    const q = (value) => shellQuote(value, dialect);
-    if (subcommand === "check") {
-        const tokens = ["xp-gate", "check"];
-        if (target !== undefined)
-            tokens.push(q(target));
-        if (gates !== undefined && gates.length > 0) {
-            // Defense-in-depth: the JSON-schema enum already rejects unknown gate ids,
-            // but we also whitelist here so a non-whitelisted value can never reach the shell.
-            const allowed = gates.filter(isGateAllowed);
-            if (allowed.length > 0)
-                tokens.push("--gates", q(allowed.join(",")));
-        }
-        return tokens.join(" ");
-    }
-    if (subcommand === "principles") {
-        const tokens = ["xp-gate", "principles"];
-        if (target !== undefined)
-            tokens.push(q(target));
-        return tokens.join(" ");
-    }
-    // subcommand === "arch" — the only remaining member of the union.
-    // #447: the default path runs the pinned local @archlinter/cli with its
-    // built-in rules — no config needed. Forcing `--config architecture.yaml`
-    // (the old default) hit the pre-0.16 schema that archlint itself rejects.
-    // Only forward an explicitly provided config, via the opt-in --use-config.
-    const tokens = ["xp-gate", "arch"];
-    if (config !== undefined)
-        tokens.push("--use-config", q(config));
-    return tokens.join(" ");
-}
-/**
- * Build a single guarded shell command: runs `xp-gate …` when the global CLI
- * is present, otherwise prints the graceful-degradation hint. A single
- * presence check avoids a separate probe/run race.
- */
-export function buildCommand(options) {
-    const dialect = options.dialect ?? "posix";
-    const inner = buildInner(options, dialect);
-    if (dialect === "posix") {
-        return `if command -v xp-gate >/dev/null 2>&1; then ${inner}; else printf '%s\\n' ${shellQuote(FALLBACK_MESSAGE, dialect)}; fi`;
-    }
-    // PowerShell: `Get-Command` resolves the .cmd/.ps1 shims npm writes to
-    // %APPDATA%\npm. Those shims are invisible to a Git-Bash PATH lookup, so this
-    // branch is more reliable than `command -v` on Windows.
-    //
-    // The hint branch leaves $LASTEXITCODE untouched at 0, matching the POSIX
-    // branch's `printf` behaviour.
-    return `if (Get-Command xp-gate -ErrorAction SilentlyContinue) { ${inner} } else { Write-Output ${shellQuote(FALLBACK_MESSAGE, dialect)} }`;
-}
-/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
-export function resolveTarget(rawPath, cwd) {
-    return isAbsolute(rawPath) ? rawPath : resolve(cwd, rawPath);
-}
-//# sourceMappingURL=command.js.map

package/plugins/dsh/lib/delphi-config.d.ts

@@ -1,75 +0,0 @@
-/**
- * Delphi configuration loading for the DSH plugin.
- *
- * Reads the same `.delphi-config.json` the xp-gate skill already uses, so a
- * project configures its reviewers once and both the skill and the DSH tool
- * agree on who they are.
- *
- * @test REQ-DSH-016
- * @intent 复用项目既有的 .delphi-config.json，把 provider/api_key/专家席位解析成
- *         DSH 工具可用的结构，并对 ${ENV} 占位符与缺失密钥给出可操作的报错。
- * @covers AC-DSH-016-02
- */
-import type { ExpertSeat, DelphiOptions } from "./delphi.js";
-/** Shape of one expert entry in .delphi-config.json. */
-interface RawExpert {
-    id?: string;
-    role?: string;
-    name?: string;
-    model?: string;
-    requested_model?: string;
-    max_tokens?: number;
-    maxTokens?: number;
-    /** Per-expert provider override; falls back to the profile default. */
-    provider?: string;
-}
-interface RawProfile {
-    provider?: string;
-    providers?: Record<string, {
-        base_url?: string;
-        baseUrl?: string;
-        api_key?: string;
-        apiKey?: string;
-    }>;
-    /**
-     * Experts appear in two shapes in the wild: an object keyed by role (what
-     * xp-gate actually writes) and an array. Both are accepted.
-     */
-    experts?: RawExpert[] | Record<string, RawExpert>;
-    consensus?: {
-        threshold_percent?: number;
-        max_review_rounds?: number;
-    };
-}
-export interface RawDelphiConfig extends RawProfile {
-    active_profile?: string;
-    profiles?: Record<string, RawProfile>;
-}
-export interface ResolvedDelphiConfig {
-    readonly seats: ExpertSeat[];
-    readonly baseUrl: string;
-    readonly apiKey: string;
-    readonly thresholdPercent: number;
-    readonly maxRounds: number;
-    readonly provider: string;
-}
-/** Raised when config on disk cannot be turned into a usable review setup. */
-export declare class DelphiSetupError extends Error {
-}
-/**
- * Expand `${VAR}` and `{env:VAR}` placeholders from the environment.
- * Supports the two spellings already present in xp-gate config files.
- */
-export declare function expandEnv(value: string, env?: NodeJS.ProcessEnv): string;
-/**
- * Turn raw config into a ready-to-run review setup.
- * Fails loudly and specifically: a missing key or an unexpanded placeholder is
- * the most common way a Delphi run silently degrades.
- */
-export declare function resolveConfig(cfg: RawDelphiConfig, env?: NodeJS.ProcessEnv): ResolvedDelphiConfig;
-/** Read and resolve `.delphi-config.json` from a project root. */
-export declare function loadDelphiConfig(cwd: string, env?: NodeJS.ProcessEnv, globalPath?: string): ResolvedDelphiConfig;
-/** Build the transport options a round needs from a resolved config. */
-export declare function toDelphiOptions(cfg: ResolvedDelphiConfig): DelphiOptions;
-export {};
-//# sourceMappingURL=delphi-config.d.ts.map

package/plugins/dsh/lib/delphi-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delphi-config.d.ts","sourceRoot":"","sources":["../src/delphi-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG5D,wDAAwD;AACxD,UAAU,SAAS;IACjB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtG;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACjD,SAAS,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACvE;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,8EAA8E;AAC9E,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAIrF;AA0ED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,eAAe,EACpB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,CAuBtB;AAsCD,kEAAkE;AAClE,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,GAAE,MAAqE,GAChF,oBAAoB,CAkCtB;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,aAAa,CAQxE"}