@boyingliu01/xp-gate 0.35.11 → 0.35.13

package/hooks/pre-commit

@@ -100,8 +100,16 @@ fi
 # and a plausible wrong number is harder to notice than a visible gap.
 #
 # Resolve from the repo's own declaration, in the order the tools themselves
-# use: pyproject [tool.coverage.report] fail_under, then .coveragerc. A repo
-# declaring neither keeps the historical 80.
+# use: pyproject [tool.coverage.report] fail_under, then .coveragerc, then the
+# JS/TS runner's own threshold block. A repo declaring none keeps the historical 80.
+#
+# #605: the JS/TS branch below enforces THIS number, but the resolver only ever
+# read Python declarations -- so a vitest project declaring `thresholds.lines: 60`
+# was silently judged against 80. The result was the worst possible split:
+# `npx vitest run` goes green, the commit is then rejected, and the two numbers
+# are read from different files with nothing pointing at the disagreement.
+# Same defect shape as #554/#609: a declaration exists, an enforcement exists,
+# and nothing connected them.
 _resolve_coverage_threshold() {
   _rct_value=""
   _rct_src="default"
@@ -117,13 +125,36 @@ _resolve_coverage_threshold() {
     _rct_value=$(grep -oE '^[[:space:]]*fail_under[[:space:]]*=[[:space:]]*[0-9]+' .coveragerc 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
     [ -n "$_rct_value" ] && _rct_src=".coveragerc fail_under"
   fi
+  # #605: JS/TS. Read the runner's own threshold rather than assuming 80, so the
+  # hook enforces the number the project actually declares. `lines` specifically:
+  # it is the metric the JS branch below compares, and it is the one vitest docs
+  # lead with. Only the FLAT shape is read -- the nested `thresholds: { global }`
+  # form is vitest 2.x and was proven silently dropped by the 1.6.x config parser
+  # (#561), so honouring it here would enforce a number that never takes effect.
+  if [ -z "$_rct_value" ]; then
+    for _rct_cfg in vitest.config.ts vitest.config.js vitest.config.mts; do
+      [ -f "$_rct_cfg" ] || continue
+      _rct_value=$(sed -n '/thresholds[[:space:]]*:[[:space:]]*{/,/}/p' "$_rct_cfg" 2>/dev/null \
+        | grep -oE 'lines[[:space:]]*:[[:space:]]*[0-9]+' | grep -oE '[0-9]+' | head -1 || true)
+      if [ -n "$_rct_value" ]; then
+        _rct_src="$_rct_cfg coverage.thresholds.lines"
+        break
+      fi
+    done
+  fi
   case "$_rct_value" in
-    ''|*[!0-9]*) _rct_value="80"; _rct_src="default (no fail_under declared)" ;;
+    ''|*[!0-9]*) _rct_value="80"; _rct_src="default (no coverage threshold declared)" ;;
   esac
   COVERAGE_THRESHOLD_SOURCE="$_rct_src"
   printf '%s' "$_rct_value"
 }
-COVERAGE_THRESHOLD="$(_resolve_coverage_threshold)"
+# NOT `COVERAGE_THRESHOLD="$(_resolve_coverage_threshold)"`: command substitution
+# runs in a subshell, so `COVERAGE_THRESHOLD_SOURCE` set inside the function was
+# discarded and the audit record's `threshold_source` field was empty on every
+# single commit. A field that is always blank is worse than a missing one -- it
+# looks populated and says nothing. Call the function in this shell instead.
+_resolve_coverage_threshold >/dev/null
+COVERAGE_THRESHOLD="$_rct_value"
 
 # Look up one tier's directory variable by name without eval-ing arbitrary input:
 # the base names are a closed set baked into the generated file.

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T21:19:13.693Z",
+  "checked_at": "2026-10-30T22:02:11.313Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.11",
+  "version": "0.35.13",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.11",
+  "version": "0.35.13",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/index.d.ts

@@ -1,5 +1,26 @@
 import z from "@deepseek-ai/schemastery";
 import type { Context } from "@deepseek-ai/cordis";
+/**
+ * Renders a tool's string result as plain text.
+ *
+ * Extracted because five tools had written this identical closure inline, which
+ * left five separate uncovered functions in the coverage report for one line of
+ * behaviour (#562). One definition can be tested once and reads as what it is: a
+ * shared output convention, not five coincidences.
+ *
+ * Generic in the argument type on purpose. `defineTool` types `render` as
+ * `(args: <this tool's parameters>, value: string) => ContentBlock[]`, so a
+ * `(_args: unknown, ...)` implementation is NOT assignable to it -- `unknown` is
+ * the wrong direction for a parameter. Declaring it as `A` lets every call site
+ * infer its own argument shape while the return type stays a plain text block.
+ *
+ * This mismatch was caught by `tsc` in the publish job, not by the test suite:
+ * vitest transpiles without type-checking. A green test run is not a green build.
+ */
+export declare const renderText: <A>(_args: A, value: string) => {
+    type: "text";
+    text: string;
+}[];
 export declare const name = "tool-xp-gate";
 export declare const inject: string[];
 /**

package/plugins/dsh/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAsZlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAgC9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM;;;GAA6C,CAAA;AAElG,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAsZlD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAgC9D"}

package/plugins/dsh/lib/index.js

@@ -15,6 +15,24 @@ import { delphiGuardDecision, isCheckablePath, isEditTool } from "./hooks.js";
 import { PHASE_STATUSES, SPRINT_SUBCOMMANDS, buildSprintCommand } from "./sprint.js";
 import { createSkillProvider } from "./skill-provider.js";
 import { createCredentialResolver } from "./credentials.js";
+/**
+ * Renders a tool's string result as plain text.
+ *
+ * Extracted because five tools had written this identical closure inline, which
+ * left five separate uncovered functions in the coverage report for one line of
+ * behaviour (#562). One definition can be tested once and reads as what it is: a
+ * shared output convention, not five coincidences.
+ *
+ * Generic in the argument type on purpose. `defineTool` types `render` as
+ * `(args: <this tool's parameters>, value: string) => ContentBlock[]`, so a
+ * `(_args: unknown, ...)` implementation is NOT assignable to it -- `unknown` is
+ * the wrong direction for a parameter. Declaring it as `A` lets every call site
+ * infer its own argument shape while the return type stays a plain text block.
+ *
+ * This mismatch was caught by `tsc` in the publish job, not by the test suite:
+ * vitest transpiles without type-checking. A green test run is not a green build.
+ */
+export const renderText = (_args, value) => [{ type: "text", text: value }];
 export const name = "tool-xp-gate";
 // "skills" is required: the bundled skill provider registers during apply(), and
 // without it ctx.skills may not be mounted yet when this plugin starts.
@@ -68,7 +86,7 @@ function gateCheckTool(shell, dialect) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DEFAULT_TIMEOUT_MS,
         async execute(args, exec) {
@@ -92,7 +110,7 @@ function gatePrinciplesTool(shell, dialect) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DEFAULT_TIMEOUT_MS,
         async execute(args, exec) {
@@ -115,7 +133,7 @@ function gateArchTool(shell, dialect) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DEFAULT_TIMEOUT_MS,
         async execute(args, exec) {
@@ -297,7 +315,7 @@ function delphiReviewTool(resolveApiKey, settings) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DELPHI_TIMEOUT_MS,
         async execute(args, exec) {
@@ -348,7 +366,7 @@ function sprintTool(shell, dialect) {
         },
         output: {
             schema: { type: "string" },
-            render: (_args, value) => [{ type: "text", text: value }],
+            render: renderText,
         },
         timeoutMs: DEFAULT_TIMEOUT_MS,
         async execute(args, exec) {

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.11",
+  "version": "0.35.13",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/src/index.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect } from "vitest"
 import type { Context } from "@deepseek-ai/cordis"
 import type { ShellExecRequest, ShellExecSpec, ShellRunResult } from "@deepseek-ai/dsh-shell"
 import type { SkillProvider, SkillProviderControl, SkillProviderObservation } from "@deepseek-ai/dsh-skill"
-import { apply, inject } from "./index.js"
+import { apply, inject, renderText } from "./index.js"
 
 type ProviderFactory = (control: SkillProviderControl) => SkillProvider
 
@@ -169,4 +169,21 @@ describe("apply", () => {
     await tool.execute({ config: "custom.yaml" }, { signal: new AbortController().signal })
     expect(requests[1]?.command).toContain("xp-gate arch --use-config 'custom.yaml'")
   })
+
+  /**
+   * @test REQ-562
+   * @intent 5 个工具曾各自内联一份完全相同的 render 闭包，在覆盖率报告里表现为 5 个
+   *         未覆盖函数，而实际只有一行行为（#562）。提取为共享常量后只需测一次，
+   *         也让"共享的输出约定"这件事在代码里显形，而不是 5 个巧合。
+   * @covers AC-562-04
+   */
+  it("renderText wraps a tool result as a single text part", () => {
+    expect(renderText(undefined, "hello")).toEqual([{ type: "text", text: "hello" }])
+  })
+
+  it("renderText keeps empty output as an empty text part, not a dropped one", () => {
+    // A tool that legitimately produced nothing must still render one part; returning
+    // [] would look to the host like the tool never answered.
+    expect(renderText({ path: "x" }, "")).toEqual([{ type: "text", text: "" }])
+  })
 })

package/plugins/dsh/src/index.ts

@@ -32,6 +32,25 @@ import { createSkillProvider } from "./skill-provider.js"
 import type { ApiKeyResolver } from "./credentials.js"
 import { createCredentialResolver } from "./credentials.js"
 
+/**
+ * Renders a tool's string result as plain text.
+ *
+ * Extracted because five tools had written this identical closure inline, which
+ * left five separate uncovered functions in the coverage report for one line of
+ * behaviour (#562). One definition can be tested once and reads as what it is: a
+ * shared output convention, not five coincidences.
+ *
+ * Generic in the argument type on purpose. `defineTool` types `render` as
+ * `(args: <this tool's parameters>, value: string) => ContentBlock[]`, so a
+ * `(_args: unknown, ...)` implementation is NOT assignable to it -- `unknown` is
+ * the wrong direction for a parameter. Declaring it as `A` lets every call site
+ * infer its own argument shape while the return type stays a plain text block.
+ *
+ * This mismatch was caught by `tsc` in the publish job, not by the test suite:
+ * vitest transpiles without type-checking. A green test run is not a green build.
+ */
+export const renderText = <A>(_args: A, value: string) => [{ type: "text" as const, text: value }]
+
 export const name = "tool-xp-gate"
 // "skills" is required: the bundled skill provider registers during apply(), and
 // without it ctx.skills may not be mounted yet when this plugin starts.
@@ -92,7 +111,7 @@ function gateCheckTool(shell: Context["shell"], dialect: ShellDialect) {
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DEFAULT_TIMEOUT_MS,
     async execute(args, exec) {
@@ -118,7 +137,7 @@ function gatePrinciplesTool(shell: Context["shell"], dialect: ShellDialect) {
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DEFAULT_TIMEOUT_MS,
     async execute(args, exec) {
@@ -144,7 +163,7 @@ function gateArchTool(shell: Context["shell"], dialect: ShellDialect) {
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DEFAULT_TIMEOUT_MS,
     async execute(args, exec) {
@@ -352,7 +371,7 @@ function delphiReviewTool(resolveApiKey: ApiKeyResolver, settings: DelphiSetting
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DELPHI_TIMEOUT_MS,
     async execute(args, exec) {
@@ -405,7 +424,7 @@ function sprintTool(shell: Context["shell"], dialect: ShellDialect) {
     },
     output: {
       schema: { type: "string" },
-      render: (_args, value) => [{ type: "text", text: value }],
+      render: renderText,
     },
     timeoutMs: DEFAULT_TIMEOUT_MS,
     async execute(args, exec) {

package/plugins/opencode/index.ts

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin"
 import { z } from "zod"
-import { exec, execSync, spawn } from "node:child_process"
+import { exec, execFileSync, execSync, spawn } from "node:child_process"
 import { promisify } from "node:util"
 import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "node:fs"
 import { join } from "node:path"
@@ -345,7 +345,7 @@ function generateSessionTitle(dbPath: string, sessionId: string): string {
       ORDER BY m.time_created DESC
       LIMIT 10
     `
-    const raw = execSync(`sqlite3 "${dbPath}" "${sql}"`, {
+    const raw = execFileSync("sqlite3", [dbPath, sql], {
       encoding: "utf8",
       timeout: 5000,
     })
@@ -492,7 +492,11 @@ function writeSessionModel(dbPath: string, sessionId: string, modelJson: string)
   const escapedModel = modelJson.replace(/'/g, "''")
   const sql = `UPDATE session SET model = '${escapedModel}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
   try {
-    execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: SQLITE_TIMEOUT_MS })
+    // execFileSync, NOT execSync: `dbPath` was interpolated into a shell string with
+    // only double quotes for protection, so a path containing `"` or `$()` broke out
+    // into shell (semgrep security-audit flagged it as a command-injection sink).
+    // Passing the arguments as an array removes the shell from the picture entirely.
+    execFileSync("sqlite3", [dbPath, sql], { timeout: SQLITE_TIMEOUT_MS })
   } catch (err) {
     // Contract is to propagate: the caller renders the failure as
     // "Session reload failed: <message>". Wrapped so the IO sits inside
@@ -616,7 +620,7 @@ function renameSession(sessionId: string, newTitle?: string): string {
   const escapedId = sessionId.replace(/'/g, "''")
   const sql = `UPDATE session SET title = '${escapedTitle}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
   try {
-    execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: SQLITE_TIMEOUT_MS })
+    execFileSync("sqlite3", [dbPath, sql], { timeout: SQLITE_TIMEOUT_MS })
     return `Session renamed to: "${trimmed}"`
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err)

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.11",
+  "version": "0.35.13",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/semver.test.ts

@@ -0,0 +1,64 @@
+/**
+ * @test REQ-562 插件版本比较必须正确，否则升级提示会撒谎
+ * @intent `plugins/opencode/index.ts` 有 4 个 export，函数覆盖率 50%，且**没有任何
+ *         测试文件**。它不是可选的样板：`semverLt` 决定"要不要提示用户升级"，
+ *         在 3 处被调用（第 143/249/289 行）。
+ *
+ *         一个错的 `semverLt` 不会崩溃，只会让提示永远说"已是最新"或永远提示升级——
+ *         两种都是"看起来在工作"。这类函数正是最该被钉住的：纯、无副作用、
+ *         影响用户可见的行为。
+ *
+ *         这里只测导出的纯函数，不碰网络和文件系统——测试不该依赖 npm registry
+ *         是否在线（那会让 CI 在断网时红，而问题不在代码里）。
+ * @covers AC-562-03
+ */
+'use strict';
+
+const path = require('node:path');
+const { fileURLToPath } = require('node:url');
+
+const PLUGIN_ENTRY = path.resolve(path.dirname(fileURLToPath(import.meta.url)), 'index.ts');
+
+describe('opencode 插件版本比较 (#562)', () => {
+  let mod;
+
+  beforeAll(async () => {
+    // The plugin is TypeScript with an npm dependency on @opencode-ai/plugin, which
+    // is only present in that workspace. Import through tsx so the test itself stays
+    // runnable from the root suite.
+    mod = await import(PLUGIN_ENTRY);
+  });
+
+  it('AC-562-03: 暴露了纯函数测试钩子', () => {
+    expect(mod.__test).toBeDefined();
+    expect(typeof mod.__test.semverLt).toBe('function');
+  });
+
+  it('AC-562-03: 主版本更高时判定为更小', () => {
+    expect(mod.__test.semverLt('0.35.10', '0.36.0')).toBe(true);
+    expect(mod.__test.semverLt('0.36.0', '0.35.10')).toBe(false);
+  });
+
+  it('AC-562-03: patch 与 minor 的位数差异不被误判', () => {
+    // This is the case a naive string comparison gets wrong: "0.9.0" < "0.10.0"
+    // lexicographically is 9 < 1 == false. Numeric segment compare must win.
+    expect(mod.__test.semverLt('0.9.0', '0.10.0')).toBe(true);
+    expect(mod.__test.semverLt('0.10.0', '0.9.0')).toBe(false);
+  });
+
+  it('AC-562-03: 前导 v 与缺失段被正确处理', () => {
+    expect(mod.__test.semverLt('v0.35.10', '0.35.11')).toBe(true);
+    // "0.35" is treated as 0.35.0, so it is LESS than 0.35.1 -- solid? No: it is
+    // equal to 0.35.0, and 0.35 < 0.35.1. Asserting the documented behaviour keeps
+    // a future refactor from silently changing missing-segment semantics.
+    expect(mod.__test.semverLt('0.35', '0.35.1')).toBe(true);
+    expect(mod.__test.semverLt('0.35.1', '0.35')).toBe(false);
+  });
+
+  it('AC-562-03: 相等版本不判定为更小', () => {
+    // `upToDate = !semverLt(...)` -- if equal versions compared as "less", every
+    // run would tell the user an update is available when there is none.
+    expect(mod.__test.semverLt('0.35.11', '0.35.11')).toBe(false);
+    expect(mod.__test.semverLt('v0.35.11', '0.35.11')).toBe(false);
+  });
+});

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.11",
+  "version": "0.35.13",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c5c05324
+**Commit:** 3978d361
 **Branch:** main
-**Version:** 0.35.11.0
+**Version:** 0.35.13.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.