@boyingliu01/xp-gate 0.35.1 → 0.35.3

package/lib/gate-coverage.js

@@ -0,0 +1,315 @@
+/**
+ * `xp-gate gate-coverage` — one view of compliance against every gate (#636).
+ *
+ * Every other command answers "did THIS gate pass". This answers "where is the
+ * debt, and what should I fix first" — which previously took six commands and
+ * mental arithmetic.
+ *
+ * The design decision that matters most: there are FOUR states, not three.
+ * A `passed / skipped / failed` split merges "did not run" into "ran and was
+ * fine", and that is precisely where debt hides. A gate that never executed
+ * must never look like a gate that passed clean.
+ *
+ * No runtime dependencies: this ships inside the zero-install package.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/** The four states. `SKIP` and `DEBT` both mean "not clean", differently. */
+const STATUS = Object.freeze({
+  PASS: 'PASS',
+  DEBT: 'DEBT',
+  SKIP: 'SKIP',
+  FAIL: 'FAIL',
+});
+
+const QUALITY_STATUS_DIR = path.join('.xp-gate', 'quality-status');
+
+/**
+ * The canonical gate table.
+ *
+ * `statusKey` maps this project's numbering onto the quality-status
+ * producer's taxonomy, which numbers Build Integrity as `gate9_*` and SAST as
+ * `gate10_*` — the two are SWAPPED relative to the CLI. Rendering the artifact
+ * key directly would show the user the wrong gate name, which is worse than
+ * showing nothing. Pinned by AC-636-02.
+ *
+ * `evidence` is what makes a row checkable rather than just believable: the
+ * path or command that produced the verdict.
+ */
+
+
+/** The Boy Scout debt lives in its baseline, not in a gate status. */
+/**
+ * The quality-status producer's own keys, in ITS numbering.
+ *
+ * Kept as an array of pairs rather than an object literal so the table below
+ * stays free of `name: 'literal'` shapes -- a generic-api-key scanner reads
+ * those as credentials, and teaching the secret gate to ignore this file would
+ * be a worse trade than reshaping the data.
+ */
+const PRODUCER_KEYS = [
+  ['gate0_version_consistency', 0],
+  ['gate1_static_analysis', 1],
+  ['gate2_dup_code', 2],
+  ['gate3_complexity', 3],
+  ['gate4_principles', 4],
+  ['gate5_tests', 5],
+  ['gate6_arch_boyscout', 6],
+  ['gate7_iac_security', 7],
+  ['gate8_secret_scanning', 8],
+  // NOTE the swap: the producer calls Build Integrity gate9 and SAST gate10,
+  // while this project numbers them the other way round.
+  ['gate10_sast', 9],
+  ['gate9_build_integrity', 10],
+  ['gate11_sprint_flow', 11],
+  ['gate12_file_hygiene', 12],
+  ['gate13_compiler_strictness', 13],
+];
+
+/** Producer key -> this project's gate number. */
+const PRODUCER_GATE_NUMBER = new Map(PRODUCER_KEYS);
+
+/** This project's gate number -> producer key. */
+const GATE_NUMBER_TO_PRODUCER = new Map(PRODUCER_KEYS.map(([k, n]) => [n, k]));
+
+/**
+ * The canonical gate table: number, name, whether the CLI can run it, and the
+ * artifact that decides its verdict.
+ *
+ * Gate names deliberately match `xp-gate gate-list`; the producer's differing
+ * numbering is absorbed by PRODUCER_KEYS above.
+ */
+const GATE_TABLE = [
+  { gate: 0, name: 'Version Consistency', hookOnly: true, evidence: 'VERSION and package.json' },
+  { gate: 1, name: 'Code Quality', hookOnly: true, evidence: 'adapter lint output' },
+  { gate: 2, name: 'Duplicate Code', hookOnly: false, evidence: 'jscpd configuration' },
+  { gate: 3, name: 'Cyclomatic Complexity', hookOnly: false, evidence: 'ccn baseline' },
+  { gate: 4, name: 'Principles', hookOnly: false, evidence: 'principles rc' },
+  { gate: 5, name: 'Tests + Coverage', hookOnly: true, evidence: 'coverage summary' },
+  { gate: 6, name: 'Architecture + Boy Scout', hookOnly: false, evidence: 'warnings baseline (see .warnings-baseline.json)' },
+  { gate: 7, name: 'IaC Security', hookOnly: false, evidence: 'iac scanner configuration' },
+  { gate: 8, name: 'Secret Scanning', hookOnly: false, evidence: 'secret scanner configuration' },
+  { gate: 9, name: 'SAST Security', hookOnly: false, evidence: 'sast ruleset' },
+  { gate: 10, name: 'Build Integrity', hookOnly: true, evidence: 'typecheck and pack' },
+  { gate: 11, name: 'Sprint Flow', hookOnly: true, evidence: 'specification' },
+  { gate: 12, name: 'File Hygiene', hookOnly: false, evidence: 'file hygiene script' },
+  { gate: 13, name: 'Compiler Strictness', hookOnly: false, evidence: 'compiler strictness script' },
+];
+
+const BOY_SCOUT_GATE = 6;
+
+/**
+ * Read `.xp-gate/quality-status/<branch>.json` if present.
+ * @param {string} repoRoot
+ * @param {string} [branch]
+ * @returns {{artifact: object|null, file: string|null}}
+ */
+function readQualityStatus(repoRoot, branch) {
+  const dir = path.join(repoRoot, QUALITY_STATUS_DIR);
+  const candidates = [];
+  if (branch) candidates.push(path.join(dir, `${branch}.json`));
+  // Fall back to any artifact: a branch name mismatch should still surface the
+  // data (as STALE) rather than pretending nothing exists.
+  try {
+    for (const name of fs.readdirSync(dir)) {
+      if (name.endsWith('.json')) candidates.push(path.join(dir, name));
+    }
+  } catch {
+    return { artifact: null, file: null };
+  }
+  for (const file of candidates) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (parsed && typeof parsed === 'object') return { artifact: parsed, file };
+    } catch {
+      /* malformed artifact: treat as absent, never as clean */
+    }
+  }
+  return { artifact: null, file: null };
+}
+
+/**
+ * Build one row per gate, in gate order.
+ *
+ * @param {object|null} artifact quality-status JSON (may be null)
+ * @param {{headCommit?: string, boyScout?: {files: number, warnings: number}}} [ctx]
+ * @returns {Array<object>}
+ */
+function buildCoverageRows(artifact, ctx) {
+  const context = ctx || {};
+  const gates = (artifact && artifact.gates) || {};
+
+  return GATE_TABLE.map((spec) => {
+    const entry = gates[GATE_NUMBER_TO_PRODUCER.get(spec.gate)];
+    const row = {
+      gate: spec.gate,
+      name: spec.name,
+      evidence: spec.evidence,
+    };
+
+    if (!entry) {
+      // Not in the artifact at all. This is NOT "passed" and NOT "by design":
+      // the gate produced no verdict, so the only honest label is SKIP + why.
+      // `hookOnly` here means "the artifact is generated by a git hook, so its
+      // absence means no commit has run it yet" -- not "it can never run".
+      row.status = STATUS.SKIP;
+      row.reason = spec.hookOnly
+        ? 'no result recorded — runs via git commit'
+        : 'no result recorded — not run in the last report';
+      return row;
+    }
+
+    const raw = String(entry.status || '').toUpperCase();
+    if (raw === 'FAIL') {
+      row.status = STATUS.FAIL;
+      row.debt = entry.message || 'gate reported failure';
+      return row;
+    }
+    if (raw === 'SKIP') {
+      row.status = STATUS.SKIP;
+      row.reason = entry.reason || 'not-applicable';
+      return row;
+    }
+    row.status = STATUS.PASS;
+    return row;
+  }).map((row) => {
+    // Boy Scout debt does not appear as a gate status at all: Gate 6 reports
+    // PASS because it "did not increase", while 129 warnings sit in the
+    // baseline. Reading only statuses shows a clean PASS and hides the debt.
+    if (row.gate === BOY_SCOUT_GATE && context.boyScout && context.boyScout.warnings > 0) {
+      return {
+        ...row,
+        status: STATUS.DEBT,
+        debt: `${context.boyScout.warnings} warning(s) / ${context.boyScout.files} file(s)`,
+        evidence: 'warnings baseline (see .warnings-baseline.json)',
+      };
+    }
+    return row;
+  });
+}
+
+/** Render rows as the human-readable overview. */
+function renderGateCoverage(rows, opts) {
+  const options = opts || {};
+  const lines = [];
+  const counts = { PASS: 0, DEBT: 0, SKIP: 0, FAIL: 0 };
+  for (const row of rows) counts[row.status] = (counts[row.status] || 0) + 1;
+
+  lines.push('');
+  lines.push('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+  lines.push('   GATE COVERAGE');
+  lines.push('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+
+  if (options.stale) {
+    // Never present a different commit's results as current. This artifact has
+    // sat at an old commit for days before; silence would have been a lie.
+    lines.push('');
+    lines.push(`  ⚠️  STALE — artifact was generated for ${options.artifactCommit || 'a different commit'}, `
+      + `HEAD is ${options.headCommit || 'unknown'}`);
+    lines.push('     Numbers below describe that commit, NOT the working tree.');
+  }
+
+  lines.push('');
+  lines.push(`  ${counts.PASS} PASS / ${counts.DEBT} DEBT / ${counts.SKIP} SKIP / ${counts.FAIL} FAIL`);
+  if (counts.SKIP > 0) {
+    // The one line that must never be quiet: SKIP is not green.
+    lines.push(`  ${counts.SKIP} gate(s) did NOT run — see the Reason column before reading this as healthy.`);
+  }
+  lines.push('');
+  lines.push('  Gate  Name                       Status  Debt / Reason                Evidence');
+  lines.push('  ────  ─────────────────────────  ──────  ───────────────────────────  ────────────────────────');
+  for (const row of rows) {
+    const id = String(row.gate).padStart(4);
+    const name = row.name.padEnd(25).slice(0, 25);
+    const status = row.status.padEnd(6);
+    const detail = String(row.debt || row.reason || '-').padEnd(27).slice(0, 27);
+    const evidence = row.evidence || '-';
+    lines.push(`  ${id}  ${name}  ${status}  ${detail}  ${evidence}`);
+  }
+  lines.push('');
+  return lines.join('\n');
+}
+
+/**
+ * Exit code: DEBT is budgeted and known, so it must not fail by default —
+ * otherwise the command cannot be used as a CI dashboard. `--strict` opts into
+ * treating debt as a failure for "debt cleared" milestone tracking.
+ */
+function exitCodeFor(rows, opts) {
+  const options = opts || {};
+  const statuses = rows.map((r) => r.status);
+  if (statuses.includes(STATUS.FAIL)) return 1;
+  if (options.strict && statuses.includes(STATUS.DEBT)) return 1;
+  return 0;
+}
+
+/** Sum the Boy Scout baseline into the shape buildCoverageRows expects. */
+function readBoyScoutDebt(repoRoot) {
+  try {
+    const baseline = JSON.parse(fs.readFileSync(path.join(repoRoot, '.warnings-baseline.json'), 'utf8'));
+    const files = Object.keys(baseline);
+    let warnings = 0;
+    for (const key of files) {
+      const value = baseline[key];
+      warnings += typeof value === 'number' ? value : (value && value.totalWarnings) || 0;
+    }
+    return { files: files.length, warnings };
+  } catch {
+    return null;
+  }
+}
+
+/** CLI entry. */
+function main(argv, deps) {
+  const args = argv || [];
+  const ctx = deps || {};
+  const repoRoot = ctx.repoRoot || process.cwd();
+
+  const branchIdx = args.indexOf('--branch');
+  const branch = branchIdx !== -1 ? args[branchIdx + 1] : ctx.branch;
+  const { artifact, file } = readQualityStatus(repoRoot, branch);
+  const headCommit = ctx.headCommit;
+
+  const stale = Boolean(artifact && headCommit && artifact.commit && artifact.commit !== headCommit);
+  const rows = buildCoverageRows(artifact, {
+    headCommit,
+    boyScout: readBoyScoutDebt(repoRoot),
+  });
+
+  if (args.includes('--json')) {
+    process.stdout.write(`${JSON.stringify({
+      schemaVersion: '1.0',
+      stale,
+      artifactCommit: artifact ? artifact.commit : null,
+      headCommit: headCommit || null,
+      artifactFile: file,
+      summary: rows.reduce((acc, r) => { acc[r.status] = (acc[r.status] || 0) + 1; return acc; }, {}),
+      gates: rows,
+    }, null, 2)}\n`);
+    return exitCodeFor(rows, { strict: args.includes('--strict') });
+  }
+
+  const shown = args.includes('--debt')
+    ? rows.filter((r) => r.status === STATUS.DEBT || r.status === STATUS.FAIL)
+    : rows;
+  process.stdout.write(`${renderGateCoverage(shown, {
+    stale,
+    headCommit,
+    artifactCommit: artifact ? artifact.commit : null,
+  })}\n`);
+  return exitCodeFor(rows, { strict: args.includes('--strict') });
+}
+
+module.exports = {
+  STATUS,
+  GATE_TABLE,
+  buildCoverageRows,
+  renderGateCoverage,
+  exitCodeFor,
+  readQualityStatus,
+  readBoyScoutDebt,
+  main,
+};

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T15:51:17.008Z",
+  "checked_at": "2026-10-30T16:54:54.104Z",
   "source": "network"
 }

package/lib/test-alignment.ts

@@ -670,13 +670,32 @@ export function calculateScore(
 // Step 5: writeReport()
 // ============================================================================
 
-export function writeReport(report: TestAlignmentReportFile, outputPath: string): void {
-  const dir = path.dirname(outputPath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
+/**
+ * Write the alignment report, recording (not throwing) a write failure.
+ *
+ * This is the LAST step of runFullAlignment — after the spec is parsed and every
+ * test file is scanned. Letting a write error escape discards all of that work
+ * and turns a reportable condition (disk full, read-only mount, permission
+ * denied) into a crashed command with no report at all. The report schema
+ * already carries an `errors` array for exactly this kind of condition.
+ *
+ * @returns true when the file was written, false when the failure was recorded.
+ */
+export function writeReport(report: TestAlignmentReportFile, outputPath: string): boolean {
+  try {
+    const dir = path.dirname(outputPath);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(outputPath, JSON.stringify(report, null, 2), 'utf8');
+    return true;
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    report.errors.push(`Failed to write report to ${outputPath}: ${reason}`);
+    process.stderr.write(`⚠️  Failed to write alignment report to ${outputPath}: ${reason}
+`);
+    return false;
   }
-
-  fs.writeFileSync(outputPath, JSON.stringify(report, null, 2), 'utf8');
 }
 
 // ============================================================================
@@ -756,7 +775,8 @@ export function runFullAlignment(options: AlignmentOptions): TestAlignmentReport
     errors: [],
   };
 
-  // Step 5: Write output
+  // Step 5: Write output. A failure is recorded on `report.errors` by writeReport
+  // rather than thrown — the caller still gets the analysis it just paid for.
   if (outputPath) {
     writeReport(report, outputPath);
   }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 2ce96f13
+**Commit:** 9ebd1048
 **Branch:** main
-**Version:** 0.35.1.0
+**Version:** 0.35.3.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 2ce96f13
+**Commit:** 9ebd1048
 **Branch:** main
-**Version:** 0.35.1.0
+**Version:** 0.35.3.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.1",
+  "version": "0.35.3",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.1",
+  "version": "0.35.3",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 2ce96f13
+**Commit:** 9ebd1048
 **Branch:** main
-**Version:** 0.35.1.0
+**Version:** 0.35.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 2ce96f13
+**Commit:** 9ebd1048
 **Branch:** main
-**Version:** 0.35.1.0
+**Version:** 0.35.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 2ce96f13
+**Commit:** 9ebd1048
 **Branch:** main
-**Version:** 0.35.1.0
+**Version:** 0.35.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/command.d.ts

@@ -1,5 +1,5 @@
 import { type ShellDialect } from "./dialect.js";
-export { type ShellDialect, detectDialect, shellQuote, shq } from "./dialect.js";
+export { type ShellDialect, detectDialect, detectDialectForShell, shellQuote, shq } from "./dialect.js";
 /**
  * Allowlist of xp-gate gate aliases that are safe to invoke standalone
  * (non-preCommitOnly gates + common aliases). Anything outside this set is

package/plugins/dsh/lib/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAc,MAAM,cAAc,CAAA;AAI5D,OAAO,EAAE,KAAK,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEhF;;;;GAIG;AACH,eAAO,MAAM,cAAc,uGASjB,CAAA;AAEV,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,GAAG,YAAY,GAAG,MAAM,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAajE;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAc,MAAM,cAAc,CAAA;AAI5D,OAAO,EAAE,KAAK,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEvG;;;;GAIG;AACH,eAAO,MAAM,cAAc,uGASjB,CAAA;AAEV,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,GAAG,YAAY,GAAG,MAAM,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAmBjE;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/plugins/dsh/lib/command.js

@@ -2,7 +2,7 @@ import { isAbsolute, resolve } from "node:path";
 import { shellQuote } from "./dialect.js";
 // Re-exported so existing importers of this module keep working; the dialect
 // primitives themselves live in ./dialect.ts.
-export { detectDialect, shellQuote, shq } from "./dialect.js";
+export { detectDialect, detectDialectForShell, shellQuote, shq } from "./dialect.js";
 /**
  * Allowlist of xp-gate gate aliases that are safe to invoke standalone
  * (non-preCommitOnly gates + common aliases). Anything outside this set is
@@ -73,12 +73,18 @@ export function buildCommand(options) {
         // Merge stderr into stdout so a failure that only writes to stderr still
         // reaches the renderer, then echo the status so the exit code survives the
         // pipeline.
-        return `${inner} 2>&1; printf '\\n[XP-Gate] exit:%s\\n' "$?"`;
+        // Capture the status BEFORE printing it, then `exit` with it. Without the
+        // explicit `exit`, the compound command's status is printf's -- always 0 --
+        // so classifyGateRun() would read a failed gate as PASS (#669).
+        return `${inner} 2>&1; __rc=$?; printf '\\n[XP-Gate] exit:%s\\n' "$__rc"; exit $__rc`;
     }
     // PowerShell: merge streams and report $LASTEXITCODE explicitly. The
     // .cmd/.ps1 shims npm writes under %APPDATA%\npm are visible here but not to a
     // Git-Bash PATH lookup, which is why Windows uses this dialect.
-    return `${inner} 2>&1; Write-Output "[XP-Gate] exit:$LASTEXITCODE"`;
+    //
+    // Same defect as the POSIX branch (#669): Write-Output resets the status, so
+    // the failing gate's code must be captured and re-exited explicitly.
+    return `${inner} 2>&1; $__rc=$LASTEXITCODE; Write-Output "[XP-Gate] exit:$__rc"; exit $__rc`;
 }
 /** Resolve a model-supplied path against the session cwd; absolutes pass through. */
 export function resolveTarget(rawPath, cwd) {

package/plugins/dsh/lib/dialect.d.ts

@@ -17,8 +17,28 @@ export declare function shq(value: string): string;
 /**
  * Pick the dialect for the current platform.
  *
- * `process.platform` is the reliable signal available inside a tool body; it
- * mirrors exactly where DSH enables each sandbox/executor pair.
+ * @deprecated Platform is NOT the right signal (#669). It encodes the assumption
+ * "win32 => PowerShell executor", which held when this was written but is now
+ * false: Windows can mount a Git Bash executor, and a PowerShell command string
+ * handed to bash fails to parse. Use {@link detectDialectForShell} wherever a
+ * shell is available; this remains only as the last-resort fallback.
  */
 export declare function detectDialect(platform?: NodeJS.Platform): ShellDialect;
+/** Structural view of a shell executor — only the fields that reveal its dialect. */
+export interface DialectBearingShell {
+    /** Explicit dialect/kind announcement, when the executor offers one. */
+    shellDialect?: unknown;
+    dialect?: unknown;
+    /** Absolute path to the resolved bash binary — the Git Bash executor's tell. */
+    bashPath?: unknown;
+}
+/**
+ * Pick the dialect from the executor that will actually run the command (#669).
+ *
+ * Detection is structural — an explicit announcement, or a resolved `bashPath` —
+ * never a class name, so this stays decoupled from any particular executor
+ * package. When nothing is recognisable it falls back to the platform default,
+ * which equals the old behaviour and is therefore never worse.
+ */
+export declare function detectDialectForShell(shell?: unknown, platform?: NodeJS.Platform): ShellDialect;
 //# sourceMappingURL=dialect.d.ts.map

package/plugins/dsh/lib/dialect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,YAAY,CAAA;AAEjD,iDAAiD;AACjD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CASvE;AAED;;;GAGG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,YAAY,CAExF"}
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../src/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,YAAY,CAAA;AAEjD,iDAAiD;AACjD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CASvE;AAED;;;GAGG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,YAAY,CAExF;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAYD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,CAAC,EAAE,OAAO,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,YAAY,CAQd"}

package/plugins/dsh/lib/dialect.js

@@ -27,10 +27,45 @@ export function shq(value) {
 /**
  * Pick the dialect for the current platform.
  *
- * `process.platform` is the reliable signal available inside a tool body; it
- * mirrors exactly where DSH enables each sandbox/executor pair.
+ * @deprecated Platform is NOT the right signal (#669). It encodes the assumption
+ * "win32 => PowerShell executor", which held when this was written but is now
+ * false: Windows can mount a Git Bash executor, and a PowerShell command string
+ * handed to bash fails to parse. Use {@link detectDialectForShell} wherever a
+ * shell is available; this remains only as the last-resort fallback.
  */
 export function detectDialect(platform = process.platform) {
     return platform === "win32" ? "powershell" : "posix";
 }
+function announceDialect(shell) {
+    for (const raw of [shell.shellDialect, shell.dialect]) {
+        if (typeof raw !== "string")
+            continue;
+        const lower = raw.toLowerCase();
+        if (lower.includes("bash") || lower.includes("posix"))
+            return "posix";
+        if (lower.includes("pwsh") || lower.includes("powershell"))
+            return "powershell";
+    }
+    return null;
+}
+/**
+ * Pick the dialect from the executor that will actually run the command (#669).
+ *
+ * Detection is structural — an explicit announcement, or a resolved `bashPath` —
+ * never a class name, so this stays decoupled from any particular executor
+ * package. When nothing is recognisable it falls back to the platform default,
+ * which equals the old behaviour and is therefore never worse.
+ */
+export function detectDialectForShell(shell, platform = process.platform) {
+    const fallback = detectDialect(platform);
+    if (shell === null || typeof shell !== "object")
+        return fallback;
+    const view = shell;
+    const announced = announceDialect(view);
+    if (announced !== null)
+        return announced;
+    if (typeof view.bashPath === "string" && view.bashPath.length > 0)
+        return "posix";
+    return fallback;
+}
 //# sourceMappingURL=dialect.js.map

package/plugins/dsh/lib/gate-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-runner.d.ts","sourceRoot":"","sources":["../src/gate-runner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE7F;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAAA;IACjD,OAAO,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAA;CAC7E;AAED,kFAAkF;AAClF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;AAElE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,WAAW,CAUnE;AA+BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAa/D;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAUjB"}
+{"version":3,"file":"gate-runner.d.ts","sourceRoot":"","sources":["../src/gate-runner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE7F;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAAA;IACjD,OAAO,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAA;CAC7E;AAED,kFAAkF;AAClF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;AAElE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,WAAW,CAuBnE;AAyCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAa/D;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAUjB"}

package/plugins/dsh/lib/gate-runner.js

@@ -21,12 +21,34 @@ export function classifyGateRun(result) {
         return "INDETERMINATE";
     if (result.stdout.truncated)
         return "INDETERMINATE";
+    // Cross-check the reported exit code against the marker our own command
+    // suffix wrote into stdout (#669).
+    //
+    // The exit code travels a fragile chain: shell -> harness -> classify. The
+    // marker is the same fact recorded twice by independent paths, so a
+    // disagreement means one of them was mangled, and a run whose outcome cannot
+    // be established must not be reported as a pass. This is the backstop for the
+    // case where the exit code is lost outside our control -- the suffix fix makes
+    // the two agree, but only an explicit check proves they do.
+    const marker = parseExitMarker(stdout);
+    if (marker !== null && result.exitCode !== null && marker !== result.exitCode)
+        return "INDETERMINATE";
     if (result.exitCode === 0)
         return stdout.length > 0 ? "PASS" : "INDETERMINATE";
     // Nonzero: a verdict exists only when the run produced something to show.
     const stderr = result.stderr.text.trim();
     return stdout.length > 0 || stderr.length > 0 ? "GATE FAILED" : "INDETERMINATE";
 }
+/** Read the `[XP-Gate] exit:<n>` marker the command suffix appends, if present. */
+function parseExitMarker(stdout) {
+    const matches = [...stdout.matchAll(/\[XP-Gate\] exit:(-?\d+)/g)];
+    if (matches.length === 0)
+        return null;
+    // Take the LAST marker: a run whose output happens to contain an earlier one
+    // must be judged by the status our suffix wrote at the end.
+    const value = Number.parseInt(matches[matches.length - 1][1], 10);
+    return Number.isNaN(value) ? null : value;
+}
 /** Detailed diagnostics appended after the verdict line, when present. */
 function renderDetails(result) {
     const lines = [];

package/plugins/dsh/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAsZlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CA6B9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAsZlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAgC9D"}