@boyingliu01/xp-gate 0.31.3 → 0.32.0

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** 7a6d9971
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.3.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/mutation/__tests__/pitest-gradle-availability.test.ts

@@ -0,0 +1,74 @@
+/**
+ * @test REQ-630
+ * @intent A Gradle build file alone is not enough: PITest is launched through
+ *         `./gradlew` or a `gradle` on PATH. The pre-existing isAvailable tests
+ *         mocked EVERY existsSync to true and mocked the gradle launcher to
+ *         succeed, so "build.gradle configures pitest but no launcher can be
+ *         run" was never exercised, and deleting the launcher guard left the
+ *         suite green. On a machine with a pom-free Gradle project and no gradle
+ *         installed, isAvailable() would claim the runner works, and Gate M
+ *         would fail later with a confusing "gradle not found".
+ *
+ *         These cases live here rather than in pitest-runner.test.ts because
+ *         that file carries pre-existing warnings; editing it would trigger the
+ *         Boy Scout "<=5 warnings must clear to zero" rule for unrelated code.
+ * @covers AC-630-01, AC-630-02
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { PitestRunner } from '../runners/pitest-runner';
+
+// `fs` is mocked module-wide; each case sets the answers it needs.
+vi.mock('fs', () => ({
+  existsSync: vi.fn(),
+  readFileSync: vi.fn(),
+  readdirSync: vi.fn(),
+}));
+// `execSync` decides whether a launcher runs; `spawn` is unused by isAvailable
+// but is imported by the runner module.
+vi.mock('child_process', () => ({ execSync: vi.fn(), spawn: vi.fn() }));
+
+describe('PitestRunner.isAvailable — Gradle launcher requirement', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('AC-630-01: no ./gradlew and gradle not runnable -> unavailable despite a pitest build file', async () => {
+    const { existsSync, readFileSync } = await import('fs');
+    const { execSync } = await import('child_process');
+    // Maven throws; the gradle launcher also throws (not installed).
+    vi.mocked(execSync).mockImplementation(() => {
+      throw new Error('not found');
+    });
+    // build.gradle exists and configures pitest; ./gradlew does NOT exist.
+    vi.mocked(existsSync).mockImplementation((p: unknown) =>
+      String(p).endsWith('build.gradle'),
+    );
+    vi.mocked(readFileSync).mockReturnValue(
+      'plugins { id "info.solidsoft.pitest" version "1.15.0" }',
+    );
+
+    const runner = new PitestRunner();
+    expect(await runner.isAvailable()).toBe(false);
+  });
+
+  it('AC-630-02: ./gradlew present -> the gradle launcher is not required on PATH', async () => {
+    const { existsSync, readFileSync } = await import('fs');
+    const { execSync } = await import('child_process');
+    // Every launcher probe throws, but ./gradlew exists, so a wrapper-based
+    // build must still count as available.
+    vi.mocked(execSync).mockImplementation(() => {
+      throw new Error('not found');
+    });
+    vi.mocked(existsSync).mockImplementation((p: unknown) => {
+      const s = String(p);
+      return s.includes('gradlew') || s.endsWith('build.gradle.kts');
+    });
+    vi.mocked(readFileSync).mockReturnValue(
+      'plugins { id("info.solidsoft.gradle.pitest") version "1.15.0" }',
+    );
+
+    const runner = new PitestRunner();
+    expect(await runner.isAvailable()).toBe(true);
+  });
+});

package/mutation/__tests__/test-filter-parity.test.ts

@@ -31,7 +31,10 @@ describe('test-path filter parity between pre-push and gate-m (#480)', () => {
   it('both sides exclude declaration files and spec-named tests', () => {
     expect(prePushFilter).toContain(String.raw`\.d\.ts$`);
     expect(prePushFilter).toContain(String.raw`\.spec\.`);
-    expect(gateM).toContain("endsWith('.d.ts')");
-    expect(gateM).toContain("includes('.spec.')");
+    // gate-m states each exclusion as an entry in EXCLUDED_PATH_PATTERNS rather
+    // than as an endsWith/includes call, so the parity assertion follows the
+    // regex. What it pins is unchanged: the TS side still excludes both.
+    expect(gateM).toContain(String.raw`pattern: /\.d\.ts$/`);
+    expect(gateM).toContain(String.raw`pattern: /\.spec\./`);
   });
 });

package/mutation/gate-m.ts

@@ -80,39 +80,45 @@ function parseTimeout(options: GateMOptions, args: string[], i: number): void {
 
 // ── File filtering: excludes tests, declarations, adapters ──
 // Delegate per-language filtering to a helper.
-
+//
+// Every exclusion is a "does this normalized path look like X?" question, so
+// they are stated as data rather than as a chain of early returns. Keeping the
+// list declarative is what makes the rules reviewable: a new convention is one
+// line, and the reasons stay attached to the pattern they justify.
 export function filterSourceFiles(files: string[]): string[] {
   return files.filter(file => {
-    const ext = path.extname(file);
     // One separator view for every pattern below: the path arrives from the
     // adapter layer, which on Windows yields backslash-delimited relative paths.
     const normalized = file.replace(/\\/g, '/');
-    // Skip test files
-    if (normalized.includes('.test.') || normalized.includes('_test.')) return false;
-    // Skip spec-named test files: the pre-push filter already excludes them, and
-    // a mutant inside a *.spec.ts is scored against a production budget (#480).
-    if (normalized.includes('.spec.')) return false;
-    // Skip test-tree directories: helpers/fixtures/factories there are test
-    // infrastructure judged by the suites that run them, not by mutation
-    // scoring budgeted for production code (#480)
-    if (/(^|\/)(tests?|__tests__)\//.test(normalized)) return false;
-    // Skip Java/Kotlin test files: FooTest.java, FooSpec.kt, etc. Case-sensitive
-    // "Test"/"Spec"/"IT" suffix matching is what the Surefire/Failsafe conventions
-    // actually produce -- `[A-Z]Test\.only` caught MyTest.java but not FooTest.java,
-    // so most test classes stayed in the mutation candidate list.
-    if (/Test\.(java|kt|kts)$/.test(normalized)) return false;
-    if (/Tests\.(java|kt|kts)$/.test(normalized)) return false;
-    if (/(IT|Spec)\.(java|kt|kts)$/.test(normalized)) return false;
-    // Skip declaration files
-    if (normalized.endsWith('.d.ts')) return false;
-    // Skip adapter files
-    if (normalized.includes('/adapters/')) return false;
+    if (isExcludedPath(normalized)) return false;
     // Skip files with no registered runner
-    const runner = resolveRunner(ext);
-    return runner !== undefined;
+    return resolveRunner(path.extname(file)) !== undefined;
   });
 }
 
+const EXCLUDED_PATH_PATTERNS: readonly { pattern: RegExp; reason: string }[] = [
+  { pattern: /\.test\.|_test\./, reason: 'test files' },
+  // Spec-named test files: the pre-push filter already excludes them, and a
+  // mutant inside a *.spec.ts is scored against a production budget (#480).
+  { pattern: /\.spec\./, reason: 'spec files' },
+  // Test-tree directories: helpers/fixtures/factories there are test
+  // infrastructure judged by the suites that run them, not by mutation
+  // scoring budgeted for production code (#480)
+  { pattern: /(^|\/)(tests?|__tests__)\//, reason: 'test trees' },
+  // Java/Kotlin test files: FooTest.java, FooSpec.kt, etc. Case-sensitive
+  // "Test"/"Spec"/"IT" suffix matching is what the Surefire/Failsafe
+  // conventions actually produce -- `[A-Z]Test\.only` caught MyTest.java but
+  // not FooTest.java, so most test classes stayed in the candidate list.
+  { pattern: /(Test|Tests|IT|Spec)\.(java|kt|kts)$/, reason: 'JVM test classes' },
+  { pattern: /\.d\.ts$/, reason: 'declaration files' },
+  { pattern: /\/adapters\//, reason: 'adapter files' },
+];
+
+/** True when `normalized` matches any exclusion rule. */
+function isExcludedPath(normalized: string): boolean {
+  return EXCLUDED_PATH_PATTERNS.some(({ pattern }) => pattern.test(normalized));
+}
+
 async function fileExists(filePath: string): Promise<boolean> {
   try {
     await fs.access(filePath);

package/mutation/runners/mutmut-runner.ts

@@ -99,38 +99,90 @@ export class MutmutRunner implements MutationRunner {
     }
   }
 
+  /**
+   * Build the terminal-outcome handler for one `mutmut run`.
+   *
+   * Three separate events (close / error / timeout) can end a run, and each one
+   * has to cancel both timers, mark the promise settled exactly once, and hand
+   * back the right shape. Factoring that into a single small object keeps
+   * `runMutmut` down to spawning and wiring, which is all it should express.
+   */
+  private settleTracker(
+    resolve: (outcome: MutationRunOutcome) => void,
+    cancelTimers: () => void,
+  ): {
+    didTimeOut: () => boolean;
+    markTimedOut: () => void;
+    settle: (outcome: MutationRunOutcome) => void;
+    isSettled: () => boolean;
+  } {
+    let settled = false;
+    let timedOut = false;
+    return {
+      didTimeOut: () => timedOut,
+      markTimedOut: () => {
+        timedOut = true;
+      },
+      isSettled: () => settled,
+      settle: (outcome) => {
+        if (settled) return;
+        settled = true;
+        cancelTimers();
+        resolve(outcome);
+      },
+    };
+  }
+
+  /**
+   * How to invoke `mutmut run` for the current route, or null when a WSL path
+   * could not be derived (in which case the run must be skipped, not attempted).
+   */
+  private buildInvocation(cwd: string): { command: string; args: string[] } | null {
+    if (this.route !== 'wsl') {
+      return { command: 'mutmut', args: ['run'] };
+    }
+    const wslPath = this.toWslPath(cwd);
+    if (wslPath === null) return null;
+    return { command: 'wsl', args: ['--cd', wslPath, 'mutmut', 'run'] };
+  }
+
   private async runMutmut(options: RunMutationOptions): Promise<MutationRunOutcome> {
     return new Promise((resolve) => {
-      const command = this.route === 'wsl' ? 'wsl' : 'mutmut';
-      const wslPath = this.route === 'wsl' ? this.toWslPath(options.cwd) : options.cwd;
-      if (wslPath === null) {
+      const invocation = this.buildInvocation(options.cwd);
+      if (invocation === null) {
         resolve({ report: null, timedOut: false });
         return;
       }
-      const args = this.route === 'wsl' ? ['--cd', wslPath, 'mutmut', 'run'] : ['run'];
-      const child = spawn(command, args, { stdio: 'pipe', cwd: options.cwd });
 
-      let stderr = '';
+      const child = spawn(invocation.command, invocation.args, {
+        stdio: 'pipe',
+        cwd: options.cwd,
+      });
+
       let stdout = '';
-      let didTimeOut = false;
-      let settled = false;
+      let stderr = '';
+      let escalationId: NodeJS.Timeout | undefined;
+
+      // Both timers must be cancelled from three different terminal events
+      // (close, error, timeout). Keeping the pair in one place is what stops the
+      // settle path from drifting out of step with the timeout path.
+      const cancelTimers = (): void => {
+        clearTimeout(timeoutId);
+        if (escalationId) clearTimeout(escalationId);
+      };
+
+      const tracker = this.settleTracker(resolve, cancelTimers);
+
       const timeoutId = setTimeout(() => {
-        didTimeOut = true;
+        tracker.markTimedOut();
         child.kill('SIGTERM');
-        if (settled) return;
+        if (tracker.isSettled()) return;
+        // SIGTERM may be ignored; escalate once, and let the retry live in a
+        // variable so `cancelTimers` can reach it.
         escalationId = setTimeout(() => {
-          if (!settled) child.kill('SIGKILL');
+          if (!tracker.isSettled()) child.kill('SIGKILL');
         }, 5000);
       }, options.timeoutMs);
-      let escalationId: NodeJS.Timeout | undefined;
-
-      const settle = (outcome: MutationRunOutcome): void => {
-        if (settled) return;
-        settled = true;
-        if (timeoutId) clearTimeout(timeoutId);
-        if (escalationId) clearTimeout(escalationId);
-        resolve(outcome);
-      };
 
       child.stdout?.on('data', (data: Buffer) => {
         stdout += data.toString();
@@ -141,25 +193,23 @@ export class MutmutRunner implements MutationRunner {
       });
 
       child.on('close', (code) => {
-        clearTimeout(timeoutId);
-
+        // A null exit code means the process was killed ("timed out" when we did
+        // it, "unknown" otherwise); there is no report to parse either way.
         if (code === null) {
-          settle({ report: null, timedOut: didTimeOut });
+          tracker.settle({ report: null, timedOut: tracker.didTimeOut() });
           return;
         }
 
-        // Parse results from mutmut run stdout (v3.x emoji progress)
-        const report = this.parseEmojiProgress(stdout);
-        settle({
-          report,
-          timedOut: didTimeOut,
+        tracker.settle({
+          // Parse results from mutmut run stdout (v3.x emoji progress)
+          report: this.parseEmojiProgress(stdout),
+          timedOut: tracker.didTimeOut(),
           error: code !== 0 ? stderr || stdout : undefined,
         });
       });
 
       child.on('error', (err) => {
-        clearTimeout(timeoutId);
-        settle({ report: null, timedOut: didTimeOut, error: err.message });
+        tracker.settle({ report: null, timedOut: tracker.didTimeOut(), error: err.message });
       });
     });
   }

package/mutation/runners/pitest-runner.ts

@@ -38,48 +38,7 @@ export class PitestRunner implements MutationRunner {
   readonly extensions = ['java', 'kt', 'kts'];
 
   async isAvailable(): Promise<boolean> {
-    // Check Maven availability: mvn exists + pom.xml with pitest-maven plugin
-    try {
-      execSync('mvn --version', { stdio: 'pipe', timeout: 5000 });
-      if (existsSync('pom.xml')) {
-        const pom = readFileSync('pom.xml', 'utf-8');
-        if (
-          pom.includes('pitest-maven') ||
-          pom.includes('org.pitest')
-        ) {
-          return true;
-        }
-      }
-    } catch {
-      // Maven not available
-    }
-
-    // Check Gradle availability: gradle/gradlew exists + build.gradle(.kts) with pitest plugin
-    const gradlewPath = './gradlew';
-    const hasGradlew = existsSync(gradlewPath);
-    try {
-      if (!hasGradlew) {
-        execSync('gradle --version', { stdio: 'pipe', timeout: 5000 });
-      }
-      const buildGradle = existsSync('build.gradle.kts')
-        ? 'build.gradle.kts'
-        : existsSync('build.gradle')
-          ? 'build.gradle'
-          : null;
-      if (buildGradle) {
-        const content = readFileSync(buildGradle, 'utf-8');
-        if (
-          content.includes('info.solidsoft.pitest') ||
-          content.includes('info.solidsoft.gradle.pitest')
-        ) {
-          return true;
-        }
-      }
-    } catch {
-      return false;
-    }
-
-    return false;
+    return mavenPitestConfigured() || gradlePitestConfigured();
   }
 
   async run(options: RunMutationOptions): Promise<MutationRunOutcome> {
@@ -288,3 +247,62 @@ export class PitestRunner implements MutationRunner {
     }
   }
 }
+
+/**
+ * True when `command` can be executed at all.
+ *
+ * `execSync` with a short timeout is the cheapest cross-platform probe: the
+ * command either resolves and runs, or throws (missing / not executable). Only
+ * the throw matters here — the output is irrelevant.
+ */
+function commandRuns(command: string): boolean {
+  try {
+    execSync(command, { stdio: 'pipe', timeout: 5000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when `file` exists and contains any of `markers`.
+ *
+ * The read is guarded: a file can exist and still be unreadable (permissions,
+ * a directory named like a build file, a transient IO error). Treating that as
+ * "does not mention" keeps the caller's answer honest — an unreadable build file
+ * does not configure pitest — instead of throwing out of `isAvailable`.
+ */
+function fileMentions(file: string, markers: readonly string[]): boolean {
+  if (!existsSync(file)) return false;
+  try {
+    const content = readFileSync(file, 'utf-8');
+    return markers.some((marker) => content.includes(marker));
+  } catch {
+    return false;
+  }
+}
+
+/** Maven is usable when `mvn` runs and the POM configures the pitest plugin. */
+function mavenPitestConfigured(): boolean {
+  if (!commandRuns('mvn --version')) return false;
+  return fileMentions('pom.xml', ['pitest-maven', 'org.pitest']);
+}
+
+/**
+ * The Gradle build file PITest would read, preferring the Kotlin DSL.
+ * @returns the file name, or null when neither exists.
+ */
+function gradleBuildFile(): string | null {
+  if (existsSync('build.gradle.kts')) return 'build.gradle.kts';
+  if (existsSync('build.gradle')) return 'build.gradle';
+  return null;
+}
+
+/** Gradle is usable when a launcher runs and the build file configures pitest. */
+function gradlePitestConfigured(): boolean {
+  const hasWrapper = existsSync('./gradlew');
+  if (!hasWrapper && !commandRuns('gradle --version')) return false;
+  const buildFile = gradleBuildFile();
+  if (buildFile === null) return false;
+  return fileMentions(buildFile, ['info.solidsoft.pitest', 'info.solidsoft.gradle.pitest']);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.31.3",
+  "version": "0.32.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"
@@ -12,6 +12,7 @@
     "lib/",
     "skills/",
     "plugins/",
+    "dsh.bundle.patch.yml",
     "adapter-common.sh",
     "principles/",
     "mutation/",
@@ -25,10 +26,21 @@
     "gate-9.sh",
     "gate-10.sh",
     "gate-12-file-hygiene.sh",
+    "gate-13-compiler-strictness.sh",
     "sprint-gate.sh"
   ],
+  "dsh": {
+    "bundle": {
+      "patch": "./dsh.bundle.patch.yml"
+    }
+  },
   "exports": {
-    "./tui": "./plugins/opencode/tui-plugin.ts"
+    "./tui": "./plugins/opencode/tui-plugin.ts",
+    "./dsh": {
+      "import": "./plugins/dsh/lib/index.js",
+      "default": "./plugins/dsh/lib/index.js"
+    },
+    "./package.json": "./package.json"
   },
   "repository": {
     "type": "git",

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.31.3",
+  "version": "0.32.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** 7a6d9971
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.3.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** 7a6d9971
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.3.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** 7a6d9971
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.3.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/command.d.ts

@@ -0,0 +1,38 @@
+import { type ShellDialect } from "./dialect.js";
+export { type ShellDialect, detectDialect, shellQuote, shq } from "./dialect.js";
+/**
+ * Allowlist of xp-gate gate aliases that are safe to invoke standalone
+ * (non-preCommitOnly gates + common aliases). Anything outside this set is
+ * rejected before reaching the shell.
+ */
+export declare const GATE_WHITELIST: readonly ["duplicates", "complexity", "principles", "arch", "architecture", "iac", "secrets", "sast"];
+export type GateId = (typeof GATE_WHITELIST)[number];
+export declare function isGateAllowed(gate: string): boolean;
+export interface BuildCommandOptions {
+    subcommand: "check" | "principles" | "arch";
+    target?: string;
+    gates?: readonly string[];
+    config?: string;
+    /**
+     * Executor dialect. Defaults to `"posix"` so existing callers keep working;
+     * callers running under DSH on Windows must pass `"powershell"`.
+     */
+    dialect?: ShellDialect;
+}
+/**
+ * Build a single unconditional shell command.
+ *
+ * There is deliberately no presence probe. An earlier version wrapped the call
+ * in `if command -v xp-gate …; then …; else print hint; fi`, which left the exit
+ * code at 0 on the else branch — so a CLI that resolved but then failed produced
+ * empty stdout with exit 0, and the model read that as a pass.
+ *
+ * Running unconditionally turns "not installed" into an ordinary command-not-found
+ * (nonzero exit, empty output), which renderGateResult classifies as
+ * INDETERMINATE and pairs with an install hint. It also removes the branch that
+ * could not distinguish "absent" from "present but broken".
+ */
+export declare function buildCommand(options: BuildCommandOptions): string;
+/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
+export declare function resolveTarget(rawPath: string, cwd: string): string;
+//# sourceMappingURL=command.d.ts.map

package/plugins/dsh/lib/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAc,MAAM,cAAc,CAAA;AAI5D,OAAO,EAAE,KAAK,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEhF;;;;GAIG;AACH,eAAO,MAAM,cAAc,uGASjB,CAAA;AAEV,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,GAAG,YAAY,GAAG,MAAM,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAajE;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/plugins/dsh/lib/command.js

@@ -0,0 +1,87 @@
+import { isAbsolute, resolve } from "node:path";
+import { shellQuote } from "./dialect.js";
+// Re-exported so existing importers of this module keep working; the dialect
+// primitives themselves live in ./dialect.ts.
+export { detectDialect, shellQuote, shq } from "./dialect.js";
+/**
+ * Allowlist of xp-gate gate aliases that are safe to invoke standalone
+ * (non-preCommitOnly gates + common aliases). Anything outside this set is
+ * rejected before reaching the shell.
+ */
+export const GATE_WHITELIST = [
+    "duplicates",
+    "complexity",
+    "principles",
+    "arch",
+    "architecture",
+    "iac",
+    "secrets",
+    "sast",
+];
+export function isGateAllowed(gate) {
+    return GATE_WHITELIST.includes(gate);
+}
+function buildInner(options, dialect) {
+    const { subcommand, target, gates, config } = options;
+    const q = (value) => shellQuote(value, dialect);
+    if (subcommand === "check") {
+        const tokens = ["xp-gate", "check"];
+        if (target !== undefined)
+            tokens.push(q(target));
+        if (gates !== undefined && gates.length > 0) {
+            // Defense-in-depth: the JSON-schema enum already rejects unknown gate ids,
+            // but we also whitelist here so a non-whitelisted value can never reach the shell.
+            const allowed = gates.filter(isGateAllowed);
+            if (allowed.length > 0)
+                tokens.push("--gates", q(allowed.join(",")));
+        }
+        return tokens.join(" ");
+    }
+    if (subcommand === "principles") {
+        const tokens = ["xp-gate", "principles"];
+        if (target !== undefined)
+            tokens.push(q(target));
+        return tokens.join(" ");
+    }
+    // subcommand === "arch" — the only remaining member of the union.
+    // #447: the default path runs the pinned local @archlinter/cli with its
+    // built-in rules — no config needed. Forcing `--config architecture.yaml`
+    // (the old default) hit the pre-0.16 schema that archlint itself rejects.
+    // Only forward an explicitly provided config, via the opt-in --use-config.
+    const tokens = ["xp-gate", "arch"];
+    if (config !== undefined)
+        tokens.push("--use-config", q(config));
+    return tokens.join(" ");
+}
+/**
+ * Build a single unconditional shell command.
+ *
+ * There is deliberately no presence probe. An earlier version wrapped the call
+ * in `if command -v xp-gate …; then …; else print hint; fi`, which left the exit
+ * code at 0 on the else branch — so a CLI that resolved but then failed produced
+ * empty stdout with exit 0, and the model read that as a pass.
+ *
+ * Running unconditionally turns "not installed" into an ordinary command-not-found
+ * (nonzero exit, empty output), which renderGateResult classifies as
+ * INDETERMINATE and pairs with an install hint. It also removes the branch that
+ * could not distinguish "absent" from "present but broken".
+ */
+export function buildCommand(options) {
+    const dialect = options.dialect ?? "posix";
+    const inner = buildInner(options, dialect);
+    if (dialect === "posix") {
+        // Merge stderr into stdout so a failure that only writes to stderr still
+        // reaches the renderer, then echo the status so the exit code survives the
+        // pipeline.
+        return `${inner} 2>&1; printf '\\n[XP-Gate] exit:%s\\n' "$?"`;
+    }
+    // PowerShell: merge streams and report $LASTEXITCODE explicitly. The
+    // .cmd/.ps1 shims npm writes under %APPDATA%\npm are visible here but not to a
+    // Git-Bash PATH lookup, which is why Windows uses this dialect.
+    return `${inner} 2>&1; Write-Output "[XP-Gate] exit:$LASTEXITCODE"`;
+}
+/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
+export function resolveTarget(rawPath, cwd) {
+    return isAbsolute(rawPath) ? rawPath : resolve(cwd, rawPath);
+}
+//# sourceMappingURL=command.js.map