@boyingliu01/xp-gate 0.31.0 → 0.31.1

package/adapters/powershell.sh

@@ -81,6 +81,11 @@ _find_powershell_files() {
     local entry
     while IFS= read -r entry; do
       entry="${entry%$'\r'}"
+      # #578: strip a UTF-8 BOM before anything else. PowerShell 5.1's
+      # `Set-Content -Encoding UTF8` writes one, and it glues itself to the first
+      # line -- so the first directory name would silently never match, and a
+      # leading '#' comment would stop looking like a comment.
+      entry="${entry#$'\xEF\xBB\xBF'}"
       # Strip surrounding whitespace, then the ./ prefix and trailing / a repo
       # may reasonably write; -name matches a bare directory name.
       entry="${entry#"${entry%%[![:space:]]*}"}"
@@ -89,6 +94,30 @@ _find_powershell_files() {
       entry="${entry#./}"
       entry="${entry%/}"
       [ -n "$entry" ] || continue
+
+      # #574: discovery feeds THREE denominators at once (test discovery,
+      # coverage, static-analysis scope), so a bad entry does not merely fail to
+      # prune -- it silently shrinks all three while the file still looks
+      # reasonable.
+      #   -name '*'     matches EVERY directory -> prunes the whole tree -> the
+      #                 gate analyses nothing and still exits 0.
+      #   -name 'a/b'   matches nothing (names have no separators) -> a silent
+      #                 no-op that reads as working config.
+      # Only bare directory NAMES are honoured; anything else is reported and
+      # ignored. Reported, not silently dropped: an ignored entry is a config
+      # error the operator has to see.
+      case "$entry" in
+        */*|*\\*|*'*'*|*'?'*|*'['*)
+          echo "  ⚠️  $prune_file: ignoring invalid entry '$entry' (must be a bare directory name, no separators or glob metacharacters)" >&2
+          continue
+          ;;
+        .|..)
+          echo "  ⚠️  $prune_file: ignoring invalid entry '$entry'" >&2
+          continue
+          ;;
+      esac
+
+      echo "  ℹ️  pruning directory name '$entry' (from $prune_file)" >&2
       prune_args[${#prune_args[@]}]=-o
       prune_args[${#prune_args[@]}]=-name
       prune_args[${#prune_args[@]}]="$entry"
@@ -109,6 +138,10 @@ _find_powershell_files() {
       -name .workbuddy -o \
       -name .sprint-state -o \
       -name wrc-drill -o \
+      -name .xp-gate -o \
+      -name .vscode -o \
+      -name .idea -o \
+      -name .qoder -o \
       -path './plugins/claude-code/skills' -o \
       -path './plugins/opencode/skills' -o \
       -path './plugins/qoder/skills' -o \
@@ -155,6 +188,7 @@ run_static_analysis() {
     local PSSA_OUT
     local scope_file=".xp-gate-powershell-analysis-paths"
     local analysis_targets=()
+    local scope_missing=0
 
     # #571: repo-local analysis scope. Pester test files legitimately trip
     # dozens of rule warnings under the Pester execution model, so a whole-repo
@@ -175,6 +209,12 @@ run_static_analysis() {
       local declared=0
       while IFS= read -r target_line; do
         target_line="${target_line%$'\r'}"
+        # #578: a UTF-8 BOM (PowerShell 5.1's `Set-Content -Encoding UTF8` writes
+        # one) glues itself to the FIRST line. On a path that manufactures a
+        # nonexistent entry -- and since #576 that returns 3, so a perfectly valid
+        # scope file would fail closed on every commit. On the '#' header it turns
+        # a comment into a phantom path. Strip it before classifying.
+        target_line="${target_line#$'\xEF\xBB\xBF'}"
         # Strip surrounding whitespace before classifying: a line of spaces is
         # not a path, and `case` alone would treat it as one — measured, a
         # whitespace-only line became an "analysis path not found" entry.
@@ -186,6 +226,7 @@ run_static_analysis() {
           # shellcheck disable=SC2004  # explicit index arithmetic on an array
           analysis_targets[${#analysis_targets[@]}]="$target_line"
         else
+          scope_missing=$((scope_missing + 1))
           echo "  ℹ️  analysis path not found (skipped): $target_line"
           echo "XP_G1_REASON: analysis-path-missing:$target_line"
         fi
@@ -218,13 +259,18 @@ run_static_analysis() {
         try { Import-Module PSScriptAnalyzer -ErrorAction Stop | Out-Null } catch { exit 3 }
         \$settings = Join-Path (Get-Location) 'PSScriptAnalyzerSettings.psd1'
         \$all = @()
-        foreach (\$p in $target_array) {
-          \$recurse = [System.IO.Directory]::Exists(\$p)
-          if (Test-Path -LiteralPath \$settings) {
-            \$all += @(Invoke-ScriptAnalyzer -Path \$p -Recurse:\$recurse -Severity Error,Warning -Settings \$settings -ErrorAction Stop)
-          } else {
-            \$all += @(Invoke-ScriptAnalyzer -Path \$p -Recurse:\$recurse -Severity Error,Warning -ErrorAction Stop)
+        try {
+          foreach (\$p in $target_array) {
+            \$recurse = [System.IO.Directory]::Exists(\$p)
+            if (Test-Path -LiteralPath \$settings) {
+              \$all += @(Invoke-ScriptAnalyzer -Path \$p -Recurse:\$recurse -Severity Error,Warning -Settings \$settings -ErrorAction Stop)
+            } else {
+              \$all += @(Invoke-ScriptAnalyzer -Path \$p -Recurse:\$recurse -Severity Error,Warning -ErrorAction Stop)
+            }
           }
+        } catch {
+          Write-Output ('PSSA_RUN_ERROR: ' + \$_.Exception.Message)
+          exit 3
         }
         if (\$all) {
           \$all | Format-Table -AutoSize
@@ -258,11 +304,32 @@ run_static_analysis() {
           echo "XP_G1_REASON: PSScriptAnalyzer module not installed (Install-Module PSScriptAnalyzer)"
           return 3
         fi
+        # #576: a scope entry that vanished means product code may have ESCAPED
+        # the gate. The reason line was emitted above, but pre-commit switches on
+        # the RETURN CODE and only uses the reason for the message text -- so
+        # returning 0 here made the reason dead weight and Gate 1 printed
+        # PASSED. Measured before this fix: "RETURN CODE = 0". The scan being
+        # clean does not make an incomplete scope a pass.
+        if [ "$scope_missing" -gt 0 ]; then
+          echo "  ⚠️  $scope_missing scope entry(ies) did not exist - product code may have escaped the gate"
+          return 3
+        fi
         return 0
         ;;
       1)
         return 1   # real findings -> BLOCK upstream
         ;;
+      3)
+        # #576: the PowerShell fragment exits 3 when the scan itself raised. That
+        # is "could not verify", not "found violations" -- pwsh would exit 1 for
+        # findings, so mapping this to 1 would report an analysis crash as lint
+        # errors. Surface the actual exception where the fragment captured one.
+        echo "XP_G1_REASON: PSScriptAnalyzer raised an error during the run"
+        printf '%s\n' "$PSSA_OUT" | grep '^PSSA_RUN_ERROR: ' | sed 's/^PSSA_RUN_ERROR: //' | head -3 | while IFS= read -r _ps_err; do
+          echo "  ⚠️  $_ps_err"
+        done
+        return 2   # unusable -> fail closed upstream
+        ;;
       *)
         echo "XP_G1_REASON: PSScriptAnalyzer run failed (exit $PSSA_RC)"
         return 2   # unusable -> fail closed upstream

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-22T06:57:22.941Z",
+  "checked_at": "2026-10-22T08:31:44.285Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-22
-**Commit:** fcd717af
+**Commit:** 0678b903
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.