@boyingliu01/xp-gate 0.31.3 → 0.32.0

package/principles/rules/clean-code/unused-imports.ts

@@ -1,31 +1,42 @@
 import { Rule, Violation, Severity } from '../../types';
 import { getActiveConfig } from '../../config';
 
+/** One import as the adapter reports it. */
+interface ImportFacts {
+  name?: string;
+  line?: number;
+  used?: boolean;
+  type?: string;
+}
+
+/**
+ * An import is unused when nothing references it. A `import type` is exempt: it
+ * is erased at compile time, so an unused type import is not dead code in the
+ * shipped output.
+ */
+function isUnusedValueImport(imp: ImportFacts): boolean {
+  return !imp.used && imp.type !== 'type';
+}
+
 export const unusedImportsRule: Rule = {
   id: 'clean-code.unused-imports',
   name: 'Unused Imports Rule',
   threshold: 1,
   severity: 'info',
   check: (file: string, adapter: unknown): Violation[] => {
-    const violations: Violation[] = [];
     // Read the ACTIVE config per invocation; a module-load snapshot was #457.
     const settings = getActiveConfig().rules['clean-code']['unused-imports'];
-    
-    const typedAdapter = adapter as { imports?: Array<{name?: string; line?: number; used?: boolean; type?: string;}> | undefined };
-    const imports = typedAdapter.imports || [];
-    
-    for (const imp of imports) {
-      if (!imp.used && imp.type !== 'type') {
-        violations.push({
-          file,
-          line: imp.line ?? 1,
-          ruleId: 'clean-code.unused-imports',
-          message: `Unused import "${imp.name}" - consider removing`,
-          severity: (settings.severity as Severity) ?? 'info'
-        });
-      }
-    }
-    
-    return violations;
+    const severity = (settings.severity as Severity) ?? 'info';
+
+    const imports = (adapter as { imports?: ImportFacts[] }).imports || [];
+    return imports
+      .filter(isUnusedValueImport)
+      .map((imp) => ({
+        file,
+        line: imp.line ?? 1,
+        ruleId: 'clean-code.unused-imports',
+        message: `Unused import "${imp.name}" - consider removing`,
+        severity,
+      }));
   }
-};
+};

package/principles/rules/solid/dip.ts

@@ -21,35 +21,45 @@ function shouldSkipInstantiation(className: string): boolean {
   return false;
 }
 
+/** `new Foo(` -> `Foo`. */
+function classNameFromNewMatch(match: string): string {
+  return match.replace(/new\s+/, '').replace(/\s*\(/, '');
+}
+
+/** Violations for one class body: each `new X(` that is not exempt. */
+function instantiationViolations(
+  code: string, line: number, file: string, severity: Severity,
+): Violation[] {
+  const violations: Violation[] = [];
+  for (const match of code.match(/new\s+(\w+)\s*\(/g) || []) {
+    const className = classNameFromNewMatch(match);
+    if (shouldSkipInstantiation(className)) continue;
+    violations.push({
+      file,
+      line,
+      ruleId: 'solid.dip',
+      severity,
+      message: `Direct instantiation detected: new ${className}(). Prefer dependency injection for flexibility.`,
+    });
+  }
+  return violations;
+}
+
 export const dipRule: Rule = {
   id: 'solid.dip',
   name: 'Dependency Inversion Principle Rule',
   threshold: 0,
   severity: 'warning',
   check: (file: string, adapter: import('../../types').Adapter): Violation[] => {
-    const violations: Violation[] = [];
     const settings = getActiveConfig().rules['solid']['dip'];
     const severity = (settings.severity as Severity) ?? 'warning';
 
-    for (const cls_any of adapter.extractClasses() || []) {
-      const cls = cls_any as {code?: string; line?: number};
-      const code = cls.code;
-      if (!code) continue;
-
-      const newMatches = code.match(/new\s+(\w+)\s*\(/g) || [];
-      for (const match of newMatches) {
-        const className = match.replace(/new\s+/, '').replace(/\s*\(/, '');
-        if (shouldSkipInstantiation(className)) continue;
-
-        violations.push({
-          file,
-          line: cls.line || 0,
-          ruleId: 'solid.dip',
-          severity,
-          message: `Direct instantiation detected: new ${className}(). Prefer dependency injection for flexibility.`,
-        });
-      }
+    const violations: Violation[] = [];
+    for (const clsAny of adapter.extractClasses() || []) {
+      const cls = clsAny as { code?: string; line?: number };
+      if (!cls.code) continue;
+      violations.push(...instantiationViolations(cls.code, cls.line || 0, file, severity));
     }
     return violations;
   }
-};
+};

package/principles/rules/solid/lsp.ts

@@ -170,13 +170,28 @@ function undetermined(): Violation[] {
  * @param paramsText parameter list without surrounding parens
  * @returns parameter fragments
  */
+/** Delimiters that nest inside a parameter list (generics included). */
+const PARAM_OPENERS = '<([{';
+const PARAM_CLOSERS = '>)]}';
+
+/**
+ * Depth delta contributed by one character.
+ *
+ * Kept separate from the splitter so the nesting rule is stated once instead of
+ * being folded into the loop's condition (#620).
+ */
+function paramDepthDelta(ch: string): number {
+  if (PARAM_OPENERS.includes(ch)) return 1;
+  if (PARAM_CLOSERS.includes(ch)) return -1;
+  return 0;
+}
+
 function splitParams(paramsText: string): string[] {
   const parts: string[] = [];
   let depth = 0;
   let current = '';
   for (const ch of paramsText) {
-    if (ch === '<' || ch === '(' || ch === '[' || ch === '{') depth += 1;
-    else if (ch === '>' || ch === ')' || ch === ']' || ch === '}') depth -= 1;
+    depth += paramDepthDelta(ch);
     if (ch === ',' && depth <= 0) {
       parts.push(current);
       current = '';

package/principles/rules/solid/ocp.ts

@@ -1,39 +1,49 @@
 import { Rule, Violation } from '../../types';
 import { getActiveConfig } from '../../config';
 
+/** The base class named in `extends X`, or null when the class extends nothing. */
+function baseClassOf(code: string): string | null {
+  const match = code.match(/extends\s+(\w+)/);
+  return match ? match[1] : null;
+}
+
+/**
+ * OCP is violated when a class, in the same body, both extends a base class and
+ * redeclares it — a local extension that had to reach back into the base.
+ */
+function ocpViolation(
+  code: string, name: string | undefined, line: number, file: string,
+  severity: 'error' | 'warning' | 'info',
+): Violation | null {
+  const baseClass = baseClassOf(code);
+  if (baseClass === null) return null;
+  if (!code.includes(`class ${baseClass}`)) return null;
+  return {
+    file,
+    line,
+    ruleId: 'solid.ocp',
+    message: `Possible modification of base class "${baseClass}" while extending. Extension should not require modifying the base.`,
+    severity,
+  };
+}
+
 export const ocpRule: Rule = {
   id: 'solid.ocp',
   name: 'Open/Closed Principle Rule',
   threshold: 0,
   severity: 'info',
   check: (file: string, adapter: import('../../types').Adapter): Violation[] => {
-    const violations: Violation[] = [];
     // Read the ACTIVE config per invocation; a module-load snapshot was #457.
     const settings = getActiveConfig().rules['solid']['ocp'];
-    const severity = (settings.severity as "error" | "warning" | "info") ?? 'info';
-    
-    const classes = adapter.extractClasses() || [];
-    
-    for (const raw of classes) {
+    const severity = (settings.severity as 'error' | 'warning' | 'info') ?? 'info';
+
+    const violations: Violation[] = [];
+    for (const raw of adapter.extractClasses() || []) {
       const cls = raw as { code?: string; line?: number; name?: string };
       if (!cls.code) continue;
-      
-      const extendsMatch = cls.code.match(/extends\s+(\w+)/);
-      if (extendsMatch) {
-        const baseClass = extendsMatch[1];
-        
-        if (cls.code.includes(`class ${baseClass}`)) {
-          violations.push({
-            file,
-            line: cls.line ?? 1,
-            ruleId: 'solid.ocp',
-            message: `Possible modification of base class "${baseClass}" while extending. Extension should not require modifying the base.`,
-            severity: severity
-          });
-        }
-      }
+      const found = ocpViolation(cls.code, cls.name, cls.line ?? 1, file, severity);
+      if (found) violations.push(found);
     }
-    
     return violations;
   }
-};
+};

package/principles/rules/solid/srp.ts

@@ -1,41 +1,83 @@
 import { Rule, Violation } from '../../types';
 import { getActiveConfig } from '../../config';
 
+/** The shape the adapter hands us for one class. */
+interface RawClass {
+  code?: string;
+  line?: number;
+  name?: string;
+  methodCount?: number;
+  imports?: Record<string, unknown>;
+}
+
+/** A class, normalized for the checks below. */
+interface ClassFacts {
+  name: string | undefined;
+  line: number;
+  methodCount: number;
+  importCategories: number;
+}
+
+/** Read the (optional) fields of a raw class once, with sane defaults. */
+function readClass(raw: unknown): ClassFacts {
+  const cls = raw as RawClass;
+  return {
+    name: cls.name,
+    line: cls.line ?? 1,
+    methodCount: cls.methodCount || 0,
+    importCategories: cls.imports ? Object.keys(cls.imports).length : 0,
+  };
+}
+
+/** Too many methods in one class. */
+function methodViolation(
+  facts: ClassFacts, file: string, maxMethods: number, severity: 'error' | 'warning' | 'info',
+): Violation | null {
+  if (facts.methodCount <= maxMethods) return null;
+  return {
+    file,
+    line: facts.line,
+    ruleId: 'solid.srp',
+    severity,
+    message: `Class "${facts.name}" has too many methods: ${facts.methodCount} (maximum: ${maxMethods}). Consider splitting into focused classes.`,
+  };
+}
+
+/** Imports reaching across too many domains. */
+function importViolation(
+  facts: ClassFacts, file: string, severity: 'error' | 'warning' | 'info',
+): Violation | null {
+  if (facts.importCategories <= 3) return null;
+  return {
+    file,
+    line: facts.line,
+    ruleId: 'solid.srp',
+    severity,
+    message: `Class "${facts.name}" imports from ${facts.importCategories} different domains. Each class should focus on one responsibility.`,
+  };
+}
+
 export const srpRule: Rule = {
   id: 'solid.srp',
   name: 'Single Responsibility Principle Rule',
   threshold: 15,
   severity: 'warning',
   check: (file: string, adapter: import('../../types').Adapter): Violation[] => {
-    const violations: Violation[] = [];
     // Read the ACTIVE config per invocation; a module-load snapshot was #457.
     const settings = getActiveConfig().rules['solid']['srp'];
-
-    const classes = adapter.extractClasses() || [];
     const maxMethods = settings.methodThreshold as number;
     const sev = (settings.severity as 'error' | 'warning' | 'info') ?? 'warning';
 
-    for (const raw of classes) {
-      const cls = raw as { code?: string; line?: number; name?: string; methodCount?: number; imports?: Record<string, unknown> };
-      const methodCount = cls.methodCount || 0;
-      const importCategories = cls.imports ? Object.keys(cls.imports).length : 0;
-      const line = cls.line ?? 1;
-
-      if (methodCount > maxMethods) {
-        violations.push({
-          file, line, ruleId: 'solid.srp', severity: sev,
-          message: `Class "${cls.name}" has too many methods: ${methodCount} (maximum: ${maxMethods}). Consider splitting into focused classes.`,
-        });
-      }
-
-      if (importCategories > 3) {
-        violations.push({
-          file, line, ruleId: 'solid.srp', severity: sev,
-          message: `Class "${cls.name}" imports from ${importCategories} different domains. Each class should focus on one responsibility.`,
-        });
+    const violations: Violation[] = [];
+    for (const raw of adapter.extractClasses() || []) {
+      const facts = readClass(raw);
+      for (const found of [
+        methodViolation(facts, file, maxMethods, sev),
+        importViolation(facts, file, sev),
+      ]) {
+        if (found) violations.push(found);
       }
     }
-
     return violations;
   },
-};
+};

package/scripts/delphi-external-review.cjs

@@ -152,8 +152,8 @@ function readConfig(configPath, profileOverride) {
     // pins ~/.config/xp-gate — overriding only this loader would make the two
     // disagree. On Linux, $HOME/.config IS the XDG default, so behaviour there
     // is identical; the env var only matters for non-default setups.
-    const configHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
-    const globalPath = path.join(configHome, 'xp-gate', '.delphi-config.json');
+    // Extracted so all three resolution points share one definition (REQ-636).
+    const globalPath = globalConfigPath(process.env);
     if (fs.existsSync(globalPath)) {
       console.error(`[delphi-review] ${configPath} not found here — using global config ${globalPath}`);
       configPath = globalPath;
@@ -958,6 +958,7 @@ if (require.main !== module) {
   module.exports = {
     parseArgs,
     readConfig,
+    globalConfigPath,
     validateDistinctModels,
     extractJsonFromResponse,
     buildSystemPrompt,
@@ -985,3 +986,25 @@ if (require.main !== module) {
     process.exit(1);
   });
 }
+
+/**
+ * Machine-wide `.delphi-config.json` path: `$XDG_CONFIG_HOME/xp-gate/`, or
+ * `~/.config/xp-gate/` when the variable is unset.
+ *
+ * Exported so the path-parity test can hold this loader, the Gate MW validator
+ * and the DSH plugin to one definition instead of three restatements.
+ *
+ * Deliberately declared at the END of the file. Function declarations hoist, so
+ * readConfig above can call it, but placing it here keeps every line before the
+ * old EOF byte-identical — which matters because `.ccn-baseline.json` anchors
+ * anonymous functions by line number (`file::(anonymous)@657`). Adding these
+ * lines near the top shifted that anchor to 676 and Gate 3 then read a
+ * pre-existing CCN=24 function as a brand-new violation.
+ *
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {string}
+ */
+function globalConfigPath(env) {
+  const configHome = env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+  return path.join(configHome, 'xp-gate', '.delphi-config.json');
+}

package/scripts/sync-package-content.js

@@ -41,7 +41,11 @@ function rmrf(target) {
 // package — but `find -type f` in scripts/check-hook-mirror.sh saw it in the mirror and
 // reported "hook mirror file set drifted", which blocks the push with no fix the operator
 // can apply from their own code (#587/#588).
-const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'coverage', '.opencode', '__pycache__']);
+// `__tests__` is here for the same reason as `dist` and `coverage`: it is not
+// distribution content. The package declares no `files` allowlist, so anything
+// copied reaches users -- and plugins/opencode/__tests__/ would have shipped a
+// vitest suite to consumers who have no vitest installed (#625/#626).
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'coverage', '.opencode', '__pycache__', '__tests__']);
 const SKIP_FILES = new Set(['package-lock.json']);
 const SKIP_FILE_SUFFIXES = ['.lock', '.js.map'];
 
@@ -121,9 +125,32 @@ function syncPlugins() {
       console.error(`[sync] plugins/${name}`);
     }
   }
+  assertDshBundleEntry();
   return copied;
 }
 
+/**
+ * Fail loudly if the dsh plugin's compiled entry is missing.
+ *
+ * The npm main package declares `exports["./dsh"]` -> plugins/dsh/lib/index.js
+ * so that `dsh plugin add @boyingliu01/xp-gate` can mount the tool directly.
+ * `lib/` is a gitignored tsc artifact, and this sync only COPIES what already
+ * exists — it does not build. Publishing without a prior build therefore
+ * produces a tarball whose exports target does not exist, which fails at plugin
+ * load time on the user's machine and is invisible to every unit test here.
+ * Checking it at pack time turns that into an immediate, named error.
+ */
+function assertDshBundleEntry() {
+  const entry = path.join(PKG_ROOT, 'plugins', 'dsh', 'lib', 'index.js');
+  if (fs.existsSync(entry)) return;
+  console.error(
+    '[sync] ERROR: plugins/dsh/lib/index.js is missing. The npm main package ' +
+      'exports "./dsh" from that path, so the published bundle would not load. ' +
+      'Build it first: (cd plugins/dsh && npm run build)',
+  );
+  process.exit(1);
+}
+
 function syncScripts() {
   const srcRoot = path.join(REPO_ROOT, 'scripts');
   const destRoot = path.join(PKG_ROOT, 'scripts');

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** 7a6d9971
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.3.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** 7a6d9971
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.3.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** 7a6d9971
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.3.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.