@boyingliu01/xp-gate 0.35.10 → 0.35.12

package/lib/slo.js

@@ -0,0 +1,150 @@
+/**
+ * @test REQ-609 SLO 指标必须区分"达标"与"没有数据"
+ * @intent 指南 §15 要求首构 ≥90%、终构 ≥98%、首测 ≥85%、Flaky ≤0.5%、
+ *         CI 无效触发 ≤20%、文件丢失 = 0。
+ *
+ *         这个模块的**全部价值**在于三态判定，而不是六行数字：
+ *
+ *           PASS   有数据，且在目标内
+ *           MISS   有数据，但在目标外          <- 唯一需要行动的
+ *           UNKNOWN 数据不足，无从判断         <- 不是通过，也不是失败
+ *
+ *         为什么 UNKNOWN 必须独立存在：把"没有数据"折叠进 PASS 就是 #554 那一类
+ *         缺陷（门禁没跑却报通过）；折叠进 MISS 则会让每一个新仓库一开始就六项
+ *         全红，于是所有人都学会忽略这个面板——面板一旦被忽略，它就和不存在一样。
+ *
+ *         "文件丢失 = 0"尤其危险：它的目标值是 0，而没有数据时最自然的算法
+ *         恰好也产出 0。所以这一项的 UNKNOWN 判定必须先于数值比较，而不是
+ *         比较完之后再补一句注释。
+ *
+ *         每个 SLO 都带 `source`：没有指明数据来源的指标无法被核实，
+ *         也就无法被信任。
+ */
+'use strict';
+
+/** 六项 SLO 及其目标。方向决定比较运算符，避免手写每个分支。 */
+const SLO_DEFINITIONS = [
+  {
+    id: 'first_build_pass',
+    label: 'First-build pass rate',
+    target: 90,
+    unit: '%',
+    direction: 'min',
+    source: '.xp-gate/audit.jsonl + pre-commit reports',
+    describe: 'first attempt of each gate run passes without a retry',
+  },
+  {
+    id: 'final_build_pass',
+    label: 'Final-build pass rate',
+    target: 98,
+    unit: '%',
+    direction: 'min',
+    source: '.xp-gate/audit.jsonl (last attempt per gate per commit)',
+    describe: 'the attempt that actually lands passes',
+  },
+  {
+    id: 'first_test_pass',
+    label: 'First-test pass rate',
+    target: 85,
+    unit: '%',
+    direction: 'min',
+    source: '.xp-gate/audit.jsonl (Gate 5 first attempt)',
+    describe: 'test suite passes on its first run in a commit',
+  },
+  {
+    id: 'flaky_rate',
+    label: 'Flaky rate',
+    target: 0.5,
+    unit: '%',
+    direction: 'max',
+    source: '.xp-gate/audit.jsonl re-run records',
+    describe: 'a test that failed then passed on re-run without a code change',
+  },
+  {
+    id: 'ci_wasted_trigger',
+    label: 'CI wasted trigger rate',
+    target: 20,
+    unit: '%',
+    direction: 'max',
+    source: '.github workflow runs vs gate journal',
+    describe: 'a CI run triggered by a commit that the gates had already rejected',
+  },
+  {
+    id: 'file_loss',
+    label: 'File loss events',
+    target: 0,
+    unit: '',
+    direction: 'max',
+    source: 'vitest-worktree-guard + git status snapshots',
+    describe: 'tracked files disappearing during a run',
+  },
+];
+
+const STATES = { PASS: 'PASS', MISS: 'MISS', UNKNOWN: 'UNKNOWN' };
+
+/**
+ * Evaluate one SLO sample.
+ *
+ * `value === null` / `undefined` means "no measurement", which is a different
+ * claim from `value === 0`. Keeping them distinct is the whole point of this module.
+ */
+function evaluateSlo(id, value, opts = {}) {
+  const def = SLO_DEFINITIONS.find((d) => d.id === id);
+  if (!def) throw new Error(`unknown SLO id: ${id}`);
+
+  if (value === null || value === undefined || Number.isNaN(value)) {
+    return {
+      ...def,
+      value: null,
+      state: STATES.UNKNOWN,
+      reason: opts.reason || 'no measurement available in the reporting window',
+    };
+  }
+
+  // File loss is the trap: its target is 0, and a naive max-direction comparison
+  // (`0 <= 0`) reports PASS for a window that observed nothing. Requiring an
+  // explicit sample count makes "we looked and saw none" different from "we did
+  // not look".
+  const samples = opts.samples;
+  if (def.id === 'file_loss' && (samples === undefined || samples === null || samples <= 0)) {
+    return {
+      ...def,
+      value: null,
+      state: STATES.UNKNOWN,
+      reason: 'no guard runs in the window -- absence of guards is not absence of loss',
+    };
+  }
+
+  const pass = def.direction === 'min' ? value >= def.target : value <= def.target;
+  return {
+    ...def,
+    value,
+    sampleCount: samples,
+    state: pass ? STATES.PASS : STATES.MISS,
+    reason: pass ? '' : `${value}${def.unit} vs target ${def.direction === 'min' ? '>=' : '<='} ${def.target}${def.unit}`,
+  };
+}
+
+/** Evaluate a whole batch of measurements (`{ id: value | {value,samples} }`). */
+function evaluateAll(measurements = {}) {
+  return SLO_DEFINITIONS.map((def) => {
+    const raw = measurements[def.id];
+    if (raw && typeof raw === 'object') return evaluateSlo(def.id, raw.value, raw);
+    return evaluateSlo(def.id, raw);
+  });
+}
+
+/** Count rows per state -- what a dashboard badge and a retro line both need. */
+function summariseStates(rows) {
+  const out = { PASS: 0, MISS: 0, UNKNOWN: 0, total: rows.length };
+  for (const r of rows) out[r.state] += 1;
+  return out;
+}
+
+module.exports = {
+  SLO_DEFINITIONS,
+  STATES,
+  evaluateSlo,
+  evaluateAll,
+  summariseStates,
+};

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.10",
+  "version": "0.35.12",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.10",
+  "version": "0.35.12",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/index.d.ts

@@ -1,5 +1,26 @@
 import z from "@deepseek-ai/schemastery";
 import type { Context } from "@deepseek-ai/cordis";
+/**
+ * Renders a tool's string result as plain text.
+ *
+ * Extracted because five tools had written this identical closure inline, which
+ * left five separate uncovered functions in the coverage report for one line of
+ * behaviour (#562). One definition can be tested once and reads as what it is: a
+ * shared output convention, not five coincidences.
+ *
+ * Generic in the argument type on purpose. `defineTool` types `render` as
+ * `(args: <this tool's parameters>, value: string) => ContentBlock[]`, so a
+ * `(_args: unknown, ...)` implementation is NOT assignable to it -- `unknown` is
+ * the wrong direction for a parameter. Declaring it as `A` lets every call site
+ * infer its own argument shape while the return type stays a plain text block.
+ *
+ * This mismatch was caught by `tsc` in the publish job, not by the test suite:
+ * vitest transpiles without type-checking. A green test run is not a green build.
+ */
+export declare const renderText: <A>(_args: A, value: string) => {
+    type: "text";
+    text: string;
+}[];
 export declare const name = "tool-xp-gate";
 export declare const inject: string[];
 /**

package/plugins/dsh/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAsZlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAgC9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM;;;GAA6C,CAAA;AAElG,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAsZlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAgC9D"}

package/plugins/dsh/lib/index.js

@@ -15,6 +15,24 @@ import { delphiGuardDecision, isCheckablePath, isEditTool } from "./hooks.js";
 import { PHASE_STATUSES, SPRINT_SUBCOMMANDS, buildSprintCommand } from "./sprint.js";
 import { createSkillProvider } from "./skill-provider.js";
 import { createCredentialResolver } from "./credentials.js";
+/**
+ * Renders a tool's string result as plain text.
+ *
+ * Extracted because five tools had written this identical closure inline, which
+ * left five separate uncovered functions in the coverage report for one line of
+ * behaviour (#562). One definition can be tested once and reads as what it is: a
+ * shared output convention, not five coincidences.
+ *
+ * Generic in the argument type on purpose. `defineTool` types `render` as
+ * `(args: <this tool's parameters>, value: string) => ContentBlock[]`, so a
+ * `(_args: unknown, ...)` implementation is NOT assignable to it -- `unknown` is
+ * the wrong direction for a parameter. Declaring it as `A` lets every call site
+ * infer its own argument shape while the return type stays a plain text block.
+ *
+ * This mismatch was caught by `tsc` in the publish job, not by the test suite:
+ * vitest transpiles without type-checking. A green test run is not a green build.
+ */
+export const renderText = (_args, value) => [{ type: "text", text: value }];
 export const name = "tool-xp-gate";
 // "skills" is required: the bundled skill provider registers during apply(), and
 // without it ctx.skills may not be mounted yet when this plugin starts.
@@ -68,7 +86,7 @@ function gateCheckTool(shell, dialect) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DEFAULT_TIMEOUT_MS,
         async execute(args, exec) {
@@ -92,7 +110,7 @@ function gatePrinciplesTool(shell, dialect) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DEFAULT_TIMEOUT_MS,
         async execute(args, exec) {
@@ -115,7 +133,7 @@ function gateArchTool(shell, dialect) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DEFAULT_TIMEOUT_MS,
         async execute(args, exec) {
@@ -297,7 +315,7 @@ function delphiReviewTool(resolveApiKey, settings) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DELPHI_TIMEOUT_MS,
         async execute(args, exec) {
@@ -348,7 +366,7 @@ function sprintTool(shell, dialect) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DEFAULT_TIMEOUT_MS,
         async execute(args, exec) {

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.10",
+  "version": "0.35.12",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/src/index.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect } from "vitest"
 import type { Context } from "@deepseek-ai/cordis"
 import type { ShellExecRequest, ShellExecSpec, ShellRunResult } from "@deepseek-ai/dsh-shell"
 import type { SkillProvider, SkillProviderControl, SkillProviderObservation } from "@deepseek-ai/dsh-skill"
-import { apply, inject } from "./index.js"
+import { apply, inject, renderText } from "./index.js"
 
 type ProviderFactory = (control: SkillProviderControl) => SkillProvider
 
@@ -169,4 +169,21 @@ describe("apply", () => {
     await tool.execute({ config: "custom.yaml" }, { signal: new AbortController().signal })
     expect(requests[1]?.command).toContain("xp-gate arch --use-config 'custom.yaml'")
   })
+
+  /**
+   * @test REQ-562
+   * @intent 5 个工具曾各自内联一份完全相同的 render 闭包，在覆盖率报告里表现为 5 个
+   *         未覆盖函数，而实际只有一行行为（#562）。提取为共享常量后只需测一次，
+   *         也让"共享的输出约定"这件事在代码里显形，而不是 5 个巧合。
+   * @covers AC-562-04
+   */
+  it("renderText wraps a tool result as a single text part", () => {
+    expect(renderText(undefined, "hello")).toEqual([{ type: "text", text: "hello" }])
+  })
+
+  it("renderText keeps empty output as an empty text part, not a dropped one", () => {
+    // A tool that legitimately produced nothing must still render one part; returning
+    // [] would look to the host like the tool never answered.
+    expect(renderText({ path: "x" }, "")).toEqual([{ type: "text", text: "" }])
+  })
 })

package/plugins/dsh/src/index.ts

@@ -32,6 +32,25 @@ import { createSkillProvider } from "./skill-provider.js"
 import type { ApiKeyResolver } from "./credentials.js"
 import { createCredentialResolver } from "./credentials.js"
 
+/**
+ * Renders a tool's string result as plain text.
+ *
+ * Extracted because five tools had written this identical closure inline, which
+ * left five separate uncovered functions in the coverage report for one line of
+ * behaviour (#562). One definition can be tested once and reads as what it is: a
+ * shared output convention, not five coincidences.
+ *
+ * Generic in the argument type on purpose. `defineTool` types `render` as
+ * `(args: <this tool's parameters>, value: string) => ContentBlock[]`, so a
+ * `(_args: unknown, ...)` implementation is NOT assignable to it -- `unknown` is
+ * the wrong direction for a parameter. Declaring it as `A` lets every call site
+ * infer its own argument shape while the return type stays a plain text block.
+ *
+ * This mismatch was caught by `tsc` in the publish job, not by the test suite:
+ * vitest transpiles without type-checking. A green test run is not a green build.
+ */
+export const renderText = <A>(_args: A, value: string) => [{ type: "text" as const, text: value }]
+
 export const name = "tool-xp-gate"
 // "skills" is required: the bundled skill provider registers during apply(), and
 // without it ctx.skills may not be mounted yet when this plugin starts.
@@ -92,7 +111,7 @@ function gateCheckTool(shell: Context["shell"], dialect: ShellDialect) {
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DEFAULT_TIMEOUT_MS,
     async execute(args, exec) {
@@ -118,7 +137,7 @@ function gatePrinciplesTool(shell: Context["shell"], dialect: ShellDialect) {
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DEFAULT_TIMEOUT_MS,
     async execute(args, exec) {
@@ -144,7 +163,7 @@ function gateArchTool(shell: Context["shell"], dialect: ShellDialect) {
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DEFAULT_TIMEOUT_MS,
     async execute(args, exec) {
@@ -352,7 +371,7 @@ function delphiReviewTool(resolveApiKey: ApiKeyResolver, settings: DelphiSetting
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DELPHI_TIMEOUT_MS,
     async execute(args, exec) {
@@ -405,7 +424,7 @@ function sprintTool(shell: Context["shell"], dialect: ShellDialect) {
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DEFAULT_TIMEOUT_MS,
     async execute(args, exec) {

package/plugins/opencode/index.ts

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin"
 import { z } from "zod"
-import { exec, execSync, spawn } from "node:child_process"
+import { exec, execFileSync, execSync, spawn } from "node:child_process"
 import { promisify } from "node:util"
 import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "node:fs"
 import { join } from "node:path"
@@ -345,7 +345,7 @@ function generateSessionTitle(dbPath: string, sessionId: string): string {
       ORDER BY m.time_created DESC
       LIMIT 10
     `
-    const raw = execSync(`sqlite3 "${dbPath}" "${sql}"`, {
+    const raw = execFileSync("sqlite3", [dbPath, sql], {
       encoding: "utf8",
       timeout: 5000,
     })
@@ -492,7 +492,11 @@ function writeSessionModel(dbPath: string, sessionId: string, modelJson: string)
   const escapedModel = modelJson.replace(/'/g, "''")
   const sql = `UPDATE session SET model = '${escapedModel}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
   try {
-    execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: SQLITE_TIMEOUT_MS })
+    // execFileSync, NOT execSync: `dbPath` was interpolated into a shell string with
+    // only double quotes for protection, so a path containing `"` or `$()` broke out
+    // into shell (semgrep security-audit flagged it as a command-injection sink).
+    // Passing the arguments as an array removes the shell from the picture entirely.
+    execFileSync("sqlite3", [dbPath, sql], { timeout: SQLITE_TIMEOUT_MS })
   } catch (err) {
     // Contract is to propagate: the caller renders the failure as
     // "Session reload failed: <message>". Wrapped so the IO sits inside
@@ -616,7 +620,7 @@ function renameSession(sessionId: string, newTitle?: string): string {
   const escapedId = sessionId.replace(/'/g, "''")
   const sql = `UPDATE session SET title = '${escapedTitle}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
   try {
-    execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: SQLITE_TIMEOUT_MS })
+    execFileSync("sqlite3", [dbPath, sql], { timeout: SQLITE_TIMEOUT_MS })
     return `Session renamed to: "${trimmed}"`
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err)

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.10",
+  "version": "0.35.12",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/semver.test.ts

@@ -0,0 +1,64 @@
+/**
+ * @test REQ-562 插件版本比较必须正确，否则升级提示会撒谎
+ * @intent `plugins/opencode/index.ts` 有 4 个 export，函数覆盖率 50%，且**没有任何
+ *         测试文件**。它不是可选的样板：`semverLt` 决定"要不要提示用户升级"，
+ *         在 3 处被调用（第 143/249/289 行）。
+ *
+ *         一个错的 `semverLt` 不会崩溃，只会让提示永远说"已是最新"或永远提示升级——
+ *         两种都是"看起来在工作"。这类函数正是最该被钉住的：纯、无副作用、
+ *         影响用户可见的行为。
+ *
+ *         这里只测导出的纯函数，不碰网络和文件系统——测试不该依赖 npm registry
+ *         是否在线（那会让 CI 在断网时红，而问题不在代码里）。
+ * @covers AC-562-03
+ */
+'use strict';
+
+const path = require('node:path');
+const { fileURLToPath } = require('node:url');
+
+const PLUGIN_ENTRY = path.resolve(path.dirname(fileURLToPath(import.meta.url)), 'index.ts');
+
+describe('opencode 插件版本比较 (#562)', () => {
+  let mod;
+
+  beforeAll(async () => {
+    // The plugin is TypeScript with an npm dependency on @opencode-ai/plugin, which
+    // is only present in that workspace. Import through tsx so the test itself stays
+    // runnable from the root suite.
+    mod = await import(PLUGIN_ENTRY);
+  });
+
+  it('AC-562-03: 暴露了纯函数测试钩子', () => {
+    expect(mod.__test).toBeDefined();
+    expect(typeof mod.__test.semverLt).toBe('function');
+  });
+
+  it('AC-562-03: 主版本更高时判定为更小', () => {
+    expect(mod.__test.semverLt('0.35.10', '0.36.0')).toBe(true);
+    expect(mod.__test.semverLt('0.36.0', '0.35.10')).toBe(false);
+  });
+
+  it('AC-562-03: patch 与 minor 的位数差异不被误判', () => {
+    // This is the case a naive string comparison gets wrong: "0.9.0" < "0.10.0"
+    // lexicographically is 9 < 1 == false. Numeric segment compare must win.
+    expect(mod.__test.semverLt('0.9.0', '0.10.0')).toBe(true);
+    expect(mod.__test.semverLt('0.10.0', '0.9.0')).toBe(false);
+  });
+
+  it('AC-562-03: 前导 v 与缺失段被正确处理', () => {
+    expect(mod.__test.semverLt('v0.35.10', '0.35.11')).toBe(true);
+    // "0.35" is treated as 0.35.0, so it is LESS than 0.35.1 -- solid? No: it is
+    // equal to 0.35.0, and 0.35 < 0.35.1. Asserting the documented behaviour keeps
+    // a future refactor from silently changing missing-segment semantics.
+    expect(mod.__test.semverLt('0.35', '0.35.1')).toBe(true);
+    expect(mod.__test.semverLt('0.35.1', '0.35')).toBe(false);
+  });
+
+  it('AC-562-03: 相等版本不判定为更小', () => {
+    // `upToDate = !semverLt(...)` -- if equal versions compared as "less", every
+    // run would tell the user an update is available when there is none.
+    expect(mod.__test.semverLt('0.35.11', '0.35.11')).toBe(false);
+    expect(mod.__test.semverLt('v0.35.11', '0.35.11')).toBe(false);
+  });
+});

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6c9bcb78
+**Commit:** a92243d7
 **Branch:** main
-**Version:** 0.35.10.0
+**Version:** 0.35.12.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.10",
+  "version": "0.35.12",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {