@boyingliu01/xp-gate 0.32.1 → 0.32.2

package/adapters/powershell.sh

@@ -268,6 +268,19 @@ run_static_analysis() {
         return 3
       fi
     fi
+    # Downstream hardening (ported): a scope file narrows the gate to product
+    # code, but it must be analysed under a DECLARED rule set. With no
+    # PSScriptAnalyzerSettings.psd1 the -Settings binding falls back to defaults,
+    # so a repo that declared its scope silently swapped rule sets. Refuse the
+    # run rather than grade against an unknown rule set.
+    #
+    # Mirrors the missing-module semantics (return 3 = fail closed upstream).
+    if [ "${#analysis_targets[@]}" -gt 0 ] && [ ! -f "PSScriptAnalyzerSettings.psd1" ]; then
+      echo "XP_G1_REASON: analysis-settings-missing:PSScriptAnalyzerSettings.psd1"
+      echo "  ⚠️  $scope_file is in use but PSScriptAnalyzerSettings.psd1 is absent - refusing to analyse with an unknown rule set"
+      return 3
+    fi
+
 
     if [ "${#analysis_targets[@]}" -gt 0 ]; then
       # Scoped per-path run. -Path binds ONE string only (an array argument
@@ -430,14 +443,27 @@ run_lint() {
 # A hanging Pester test (e.g. a test that dot-sources a script whose body performs
 # WMI/registry/scheduled-task scans) would otherwise block `git commit` forever.
 # Default 300s, override via XP_GATE_POWERSHELL_TEST_TIMEOUT_S.
+# #599: ONE helper, TWO budgets. The instrumented coverage run enables
+# CodeCoverage, so instrumentation alone costs more than a plain run: a shared
+# 300s budget is not the same headroom for both. The caller passes its default
+# explicitly and the timeout message names the variable that actually governs it,
+# otherwise a budget shortfall gets reported as "a test is hanging" and the
+# reader is sent to the wrong place.
 _pester_timeout() {
-  local default_s="${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}"
+  local budget_var="$1"
+  local default_s="${2:-300}"
+  local effective_s
+  if [ "$budget_var" = "XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S" ]; then
+    effective_s="${XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S:-$default_s}"
+  else
+    effective_s="${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-$default_s}"
+  fi
   # Prefer GNU timeout (Git Bash / Linux). On Windows where `timeout` resolves to
   # the native timeout.exe, fall back to running without a hard timeout.
   if command -v timeout >/dev/null 2>&1 && timeout --version 2>/dev/null | grep -qi "coreutils"; then
-    timeout "${default_s}s" "$@"
+    timeout "${effective_s}s" "${@:3}"
   else
-    "$@"
+    "${@:3}"
   fi
 }
 
@@ -465,7 +491,7 @@ run_tests() {
   if [ "${#test_files[@]}" -gt 0 ]; then
     test_paths=$(_powershell_path_array "${test_files[@]}")
     echo "Running Pester tests..."
-    _pester_timeout "$PWSH" "${POWERSHELL_ARGS[@]}" "
+_pester_timeout "XP_GATE_POWERSHELL_TEST_TIMEOUT_S" "${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}" "$PWSH" "${POWERSHELL_ARGS[@]}" "
       \$results = Invoke-Pester -Path $test_paths -PassThru
       if (\$results.FailedCount -gt 0) {
         Write-Host \"FAILED: \$(\$results.FailedCount) test(s)\"
@@ -476,7 +502,7 @@ run_tests() {
     "
     local run_exit=$?
     if [ "$run_exit" = "124" ]; then
-      echo "⚠️  Pester tests TIMED OUT after ${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}s (may be hanging)."
+  echo "⚠️  Pester tests TIMED OUT after ${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}s (XP_GATE_POWERSHELL_TEST_TIMEOUT_S; may be hanging)."
       echo "    A test may be blocking on a system call (WMI/registry/scheduled-task)."
       echo "    Fix the hanging test, or set XP_GATE_POWERSHELL_TEST_TIMEOUT_S to a higher value."
       return 1
@@ -572,7 +598,7 @@ run_coverage() {
     # is the deprecated Pester 4 parameter set and fails outright on Pester 5.x
     # ("cannot resolve parameter set"). Using it silently produced no coverage.xml,
     # which the pre-commit hook then reported as an unparseable/zero result.
-    _pester_timeout "$PWSH" "${POWERSHELL_ARGS[@]}" "
+_pester_timeout "XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S" "${XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S:-900}" "$PWSH" "${POWERSHELL_ARGS[@]}" "
       \$cfg = New-PesterConfiguration
       \$cfg.Run.Path = $test_paths
       \$cfg.CodeCoverage.Enabled = \$true
@@ -587,7 +613,7 @@ run_coverage() {
     " 2>&1
     local cov_exit=$?
     if [ "$cov_exit" = "124" ]; then
-      echo "⚠️  Pester coverage TIMED OUT after ${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}s (may be hanging)."
+  echo "⚠️  Pester coverage TIMED OUT after ${XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S:-900}s (XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S; instrumentation costs more than a plain run - raise this rather than suspecting a hang)."
       return 1
     fi
     return $cov_exit

package/gate-3.sh

@@ -176,7 +176,42 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                       known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
                     }
                   }
-                  function norm(p) { return String(p).replace(/\\\\/g, "/").replace(/^\.\//, ""); }
+                  // The measurement emits ABSOLUTE paths (pwsh resolved them), while
+                  // a baseline recorded by a repo-side generator holds paths relative
+                  // to the repo root. Normalising alone cannot bridge that, so a key
+                  // miss falls back to a suffix match on the file path: exactly one
+                  // known entry whose normalised path ends with "<sep>measured" is the
+                  // same file. Without this every existing function looked brand new,
+                  // and a real regression was reported as "new function" -- the right
+                  // verdict for the wrong reason.
+                  //
+                  // Backslashes are normalised with split/join, NOT -replace: this JS
+                  // is embedded in a double-quoted bash command, where a regex escape
+                  // loses a level and silently matches the wrong number of
+                  // backslashes. Measured: /\\\\/g arrived as /\\/g, matched only
+                  // doubled separators, and every Windows path kept its backslashes.
+                  function norm(p) {
+                    return String(p)
+                      .split("\\").join("/")
+                      .replace(/^[A-Za-z]:\//, "")
+                      .replace(/^\.\//, "")
+                      .replace(/^\//, "");
+                  }
+                  function lookup(path, name) {
+                    const key = norm(path) + "::" + name;
+                    if (known.has(key)) return known.get(key);
+                    const target = norm(path);
+                    let hit = null;
+                    for (const [k, v] of known) {
+                      const [kp, kn] = k.split("::");
+                      if (kn !== name) continue;
+                      if (target.endsWith("/" + kp) || kp.endsWith("/" + target) || kp === target) {
+                        if (hit !== null && hit !== v) return null;  // ambiguous: treat as new
+                        hit = v;
+                      }
+                    }
+                    return hit;
+                  }
                   const seen = new Set();
                   const regressions = [];
                   const improved = [];
@@ -186,7 +221,7 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                     const key = norm(m[1]) + "::" + m[3];
                     const now = Number(m[4]);
                     seen.add(key);
-                    const was = known.has(key) ? known.get(key) : null;
+                    const was = lookup(m[1], m[3]);
                     if (was === null) {
                       if (now > threshold) {
                         regressions.push(m[1] + ":" + m[2] + "  " + m[3] + "  new function at ccn=" + now);

package/hooks/gate-3.sh

@@ -176,7 +176,42 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                       known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
                     }
                   }
-                  function norm(p) { return String(p).replace(/\\\\/g, "/").replace(/^\.\//, ""); }
+                  // The measurement emits ABSOLUTE paths (pwsh resolved them), while
+                  // a baseline recorded by a repo-side generator holds paths relative
+                  // to the repo root. Normalising alone cannot bridge that, so a key
+                  // miss falls back to a suffix match on the file path: exactly one
+                  // known entry whose normalised path ends with "<sep>measured" is the
+                  // same file. Without this every existing function looked brand new,
+                  // and a real regression was reported as "new function" -- the right
+                  // verdict for the wrong reason.
+                  //
+                  // Backslashes are normalised with split/join, NOT -replace: this JS
+                  // is embedded in a double-quoted bash command, where a regex escape
+                  // loses a level and silently matches the wrong number of
+                  // backslashes. Measured: /\\\\/g arrived as /\\/g, matched only
+                  // doubled separators, and every Windows path kept its backslashes.
+                  function norm(p) {
+                    return String(p)
+                      .split("\\").join("/")
+                      .replace(/^[A-Za-z]:\//, "")
+                      .replace(/^\.\//, "")
+                      .replace(/^\//, "");
+                  }
+                  function lookup(path, name) {
+                    const key = norm(path) + "::" + name;
+                    if (known.has(key)) return known.get(key);
+                    const target = norm(path);
+                    let hit = null;
+                    for (const [k, v] of known) {
+                      const [kp, kn] = k.split("::");
+                      if (kn !== name) continue;
+                      if (target.endsWith("/" + kp) || kp.endsWith("/" + target) || kp === target) {
+                        if (hit !== null && hit !== v) return null;  // ambiguous: treat as new
+                        hit = v;
+                      }
+                    }
+                    return hit;
+                  }
                   const seen = new Set();
                   const regressions = [];
                   const improved = [];
@@ -186,7 +221,7 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                     const key = norm(m[1]) + "::" + m[3];
                     const now = Number(m[4]);
                     seen.add(key);
-                    const was = known.has(key) ? known.get(key) : null;
+                    const was = lookup(m[1], m[3]);
                     if (was === null) {
                       if (now > threshold) {
                         regressions.push(m[1] + ":" + m[2] + "  " + m[3] + "  new function at ccn=" + now);

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-29T23:47:25.119Z",
+  "checked_at": "2026-10-30T08:22:09.989Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** 78786c3f
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.2.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** 78786c3f
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.2.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.32.1",
+  "version": "0.32.2",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.32.1",
+  "version": "0.32.2",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** 78786c3f
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** 78786c3f
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.2.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** 78786c3f
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/README.md

@@ -124,6 +124,48 @@ Delphi 方法的价值**完全建立在「评审者是不同模型」之上**。
 `{ ok: true }` 是**无条件**返回的常量，"把退出码契约换成了一个常量，而不是真正的结果信号"。
 机制**拒绝**给出共识，而不是盖章通过 —— 这正是它该有的行为。
 
+## 配置界面（Plugins 页）
+
+插件声明了 `dsh.client`（`platform: web`），在 Web GUI 里注册一个**行配置页**：
+
+**侧边栏 Plugins → `@boyingliu01/dsh-plugin-xp-gate` → 组件 `tool-xp-gate` → 配置**
+
+该页面可以编辑 Delphi 三席（角色 / 模型）、网关、密钥引用与共识参数；模型可从
+**宿主已配置的 provider 目录**下拉选择，也可手填。
+
+### 来源优先级
+
+| 优先级 | 来源 | 说明 |
+|---|---|---|
+| 1 | 本插件配置里的 `delphi` 段（本页写入） | 一旦保存了席位，评审就用它 |
+| 2 | 项目根 `.delphi-config.json` | 席位为空时自动回落，老项目**无需改动** |
+
+页面上如果 `seats` 为空，评审继续走 `.delphi-config.json`，所以**打开页面不会静默改变行为**。
+
+### 宿主强制的不变量（不是表单装饰）
+
+表单只是方便，**宿主是权威**。每次评审前 `seatsFromSettings` 重新校验：
+
+- 恰好 3 席
+- 3 个 model 去空白后两两不同
+- 模型不得为空或未展开的 `${...}` 占位符
+- 配了席位就必须有 `base_url`
+- `api_key` 必须是**凭据引用**（`${VAR}` / `{env:VAR}`）；写入明文 token 会被拒绝，
+  因为那会把密钥落到 profile 文件里
+
+> 为什么不在表单里就拦死：DSH 的 settings 表单只能编辑 `.volatile()` 字段，
+> 而 volatile 意味着**保存即热生效**。对"每次运行都花钱"的配置来说，前端校验不够，
+> 所以校验放在宿主、在发出任何请求之前。
+
+### 关于 `bash` 守卫
+
+`delphiGuard` 用**只读工具白名单**判定：只有 `read` / `grep` / `glob` / `read_image` /
+XP-Gate 自己的报告类工具算只读，**其余一律视为可写**（包括 `bash`、`pwsh` 和将来新增的工具）。
+
+早期版本用"已知写工具黑名单"（`write` / `edit` / `str_replace_editor`），
+`bash` 一条命令就能改文件，等于这道 HARD-GATE 可绕过。白名单的代价是可能**误拦**新加的
+只读工具——那会表现为"拦得太狠"，而不是"悄悄放行"。
+
 ## Skills
 
 本包在 publish 时通过 `scripts/prepack.cjs` 捆绑仓库 `skills/`（当前 12 个）。
@@ -171,7 +213,7 @@ subagent model selection:
 
 ```bash
 npm install --ignore-scripts   # --ignore-scripts 绕过 esbuild postinstall（受限环境会 EBUSY）
-npm run build                  # tsc -> lib/
+npm run build                  # tsc -> lib/，并把 client/client.js 复制成 lib/client.js
 npm run prepare-skills         # 从仓库 skills/ 复制
 npm test                       # vitest
 ```
@@ -182,9 +224,16 @@ npm test                       # vitest
 npm run build:dsh-plugin       # = node scripts/build-plugin.mjs --platform dsh
 ```
 
+> `client/client.js` 是**手写**的浏览器 bundle，不走 tsc：它以 DSH 的客户端模块格式
+> (`window.__ModuleLoader__.load`) 编写，引用了浏览器全局，不是 TypeScript 模块。
+> `npm run build` 的第二步（`scripts/copy-client.cjs`）负责把它放进 `lib/`。
+
 ## 注意
 
-- `lib/` 与 `skills/` 是**构建产物**（已 gitignore），不提交。
+- `lib/` 与 `skills/` 是**构建产物**（已 gitignore），不提交；`client/client.js` 是**源文件**，要提交。
 - `scripts/prepack.cjs` 的 skill 列表为**动态发现**（读取仓库 `skills/`），不硬编码。
 - `plugins/dsh/package.json` 的 peerDeps 仍 pin `0.1.1-rc.2`，但实测运行在 `0.2.0-rc.2` 上
   `defineTool` / `TOOL_ABORTED` / `HarnessError` 签名未变，无需改写。
+- **配置项只有在导出 `Config` 之后才会显示。** 0.31.4 及更早的构建没有导出
+  `Config`，所以 `dsh --profile <name> --dump-config-schema` 里该行落在
+  `unknownConfig`，Plugins 页也就没有可编辑的字段。安装 0.32.x 后这一项自愈。