@boyingliu01/xp-gate 0.35.15 → 0.35.17

package/plugins/opencode/index.ts

@@ -470,11 +470,24 @@ function gateArchTool(directory: string) {
 
 function readCurrentSessionModel(dbPath: string, sessionId: string): string {
   try {
+    // execFileSync, NOT execSync (#639). `sessionId` comes from the caller's
+    // argument, and the previous form interpolated it into a shell string:
+    //
+    //   `sqlite3 "${dbPath}" "SELECT model FROM session WHERE id = '${escapedId}'"`
+    //
+    // Escaping only the SQL single quote left every SHELL metacharacter live --
+    // a session id containing `"`, `$( )` or a backtick escaped the quoting and
+    // executed. Passing argv as an array removes the shell from the path
+    // entirely, so no escaping is needed or possible to get wrong.
+    //
+    // The SQL single quote is still escaped: that is a SQL concern, not a shell
+    // one, and it survives the move to argv unchanged.
     const escapedId = sessionId.replace(/'/g, "''")
-    const currentRaw = execSync(
-      `sqlite3 "${dbPath}" "SELECT model FROM session WHERE id = '${escapedId}'"`,
-      { encoding: "utf8", timeout: SQLITE_TIMEOUT_MS }
-    ).trim()
+    const sql = `SELECT model FROM session WHERE id = '${escapedId}'`
+    const currentRaw = execFileSync("sqlite3", [dbPath, sql], {
+      encoding: "utf8",
+      timeout: SQLITE_TIMEOUT_MS,
+    }).trim()
     if (!currentRaw) return "unknown"
     try {
       const parsed = JSON.parse(currentRaw)
@@ -664,9 +677,31 @@ export const XpGatePlugin = async (input: OpenCodePluginInput) => {
   }
 }
 
+/**
+ * The plugin module, shaped for BOTH OpenCode generations (#639).
+ *
+ * v1 read `server`. v2 validates the default export against a schema that
+ * requires `id` plus exactly one of `effect` / `setup`, and rejects anything
+ * else outright:
+ *
+ *   PluginModule.LoadError: Plugin must export a default definition with an id
+ *   and an effect or setup function.
+ *   (cause: SchemaError(Missing key at ["default"]["effect"] / ["default"]["setup"]))
+ *
+ * The failure mode is total, not partial: the plugin does not load at all, so
+ * `gate-check` / `gate-principles` / `gate-arch` simply vanish from v2 sessions
+ * and every startup prints a load error.
+ *
+ * `setup` and the v1 `server` take the same input and return the same shape, so
+ * the same function serves both keys. Both are exported deliberately: dropping
+ * `server` would break every v1 user on upgrade, which is a migration nobody
+ * asked for. `pluginModule` is not frozen, so this stays a plain object literal
+ * that both runtimes can read.
+ */
 const pluginModule = {
   id: "xp-gate",
   server: XpGatePlugin,
+  setup: XpGatePlugin,
 }
 
 /**

package/plugins/opencode/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.15",
+  "version": "0.35.17",
   "type": "module",
   "main": "index.ts",
-  "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",
+  "description": "XP-Gate quality gates + AI workflow skills for OpenCode",
   "repository": {
     "type": "git",
     "url": "https://github.com/boyingliu01/xp-gate",
@@ -17,15 +17,10 @@
     ".": {
       "import": "./index.ts",
       "types": "./index.ts"
-    },
-    "./tui": {
-      "import": "./tui-plugin.tsx",
-      "types": "./tui-plugin.tsx"
     }
   },
   "files": [
     "index.ts",
-    "tui-plugin.ts",
     "skills/",
     "tsconfig.json",
     "README.md"

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.15",
+  "version": "0.35.17",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/principles/adapters/import-clause.ts

@@ -0,0 +1,57 @@
+/**
+ * Import-clause parsing for the TypeScript adapter's `imports` getter.
+ *
+ * Extracted from `typescript.ts` so that one function does not have to carry
+ * both the parsing rules and the usage-scoring loop: together they pushed the
+ * getter past the 50-line budget and to 5 nesting levels. Splitting also lets
+ * the clause grammar be tested without reading a file.
+ */
+
+/** One symbol bound by an import statement. */
+export interface ImportBinding {
+  name: string;
+  type?: string;
+}
+
+/** A plain identifier -- these are the only names an import can bind. */
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+
+/**
+ * Parse the clause between `import` and `from` into the symbols it binds.
+ *
+ * Covers the four shapes TypeScript allows: a default binding, a named brace
+ * list (with per-member `type` and `as` renames), and a namespace binding.
+ *
+ * @param clause text between `import` / `import type` and `from`
+ * @param isTypeOnly whether the whole statement was `import type ...`
+ */
+export function parseImportClause(clause: string, isTypeOnly: boolean): ImportBinding[] {
+  const bindings: ImportBinding[] = [];
+  const marker = isTypeOnly ? 'type' : undefined;
+  const push = (name: string, type?: string): void => {
+    if (IDENTIFIER.test(name)) bindings.push({ name, ...(type ? { type } : {}) });
+  };
+
+  // default import
+  const def = /^(\w+)/.exec(clause);
+  if (def) push(def[1], marker);
+
+  // named imports { a, b as c }
+  const braces = /\{([\s\S]*?)\}/.exec(clause);
+  if (braces) {
+    for (const raw of braces[1].split(',')) {
+      const part = raw.trim();
+      if (!part) continue;
+      const asMatch = /\bas\s+(\w+)\s*$/.exec(part);
+      const local = asMatch ? asMatch[1] : part.replace(/^type\s+/, '').trim();
+      const memberTypeOnly = /^type\s+/.test(part);
+      push(local, isTypeOnly || memberTypeOnly ? 'type' : undefined);
+    }
+  }
+
+  // namespace import * as ns
+  const ns = /\*\s+as\s+(\w+)/.exec(clause);
+  if (ns) push(ns[1], marker);
+
+  return bindings;
+}

package/principles/adapters/member-scan.ts

@@ -0,0 +1,73 @@
+/**
+ * Class-member scanning for the TypeScript adapter.
+ *
+ * Extracted from `typescript.ts` to keep that file inside its line budget, and
+ * because this is the piece that was wrong: counting members by looking at the
+ * character BEFORE a name reported every call site inside a method body as a
+ * member. `{ helper(1); }` and `{ async run() { ... }` differ in what follows the
+ * name, not in what precedes it -- so depth is what separates them.
+ */
+
+/** Words that look like `name(` but are control flow, never members. */
+const CONTROL_KEYWORDS = new Set([
+  'if', 'for', 'while', 'switch', 'catch', 'return', 'typeof', 'new',
+]);
+
+/** Class body members live one level in: the body string starts AT its `{`. */
+const MEMBER_DEPTH = 1;
+
+/**
+ * Names of the members declared directly in a class body.
+ *
+ * Depth-aware rather than prefix-aware: a member declaration sits at brace
+ * depth 1 of the body, and a call inside a method sits deeper. Nesting is
+ * tracked over the MASKED body, so braces inside strings and comments cannot
+ * shift the depth -- prose in a JSDoc line like
+ * "three separate events (close / error / timeout)" otherwise reads as
+ * `events(` and is counted as a method, as is `unknown` from `(): unknown {`.
+ *
+ * Arrow-function properties (`handler = () => {}`) carry no `name(` shape and
+ * are not counted; they were not counted before either.
+ */
+export function countTopLevelMembers(body: string): string[] {
+  const names: string[] = [];
+  let depth = 0;
+  for (let i = 0; i < body.length; i += 1) {
+    const c = body[i];
+    if (c === '{') { depth += 1; continue; }
+    if (c === '}') { depth -= 1; continue; }
+    if (depth !== MEMBER_DEPTH || c !== '(') continue;
+    const name = memberNameBefore(body, i);
+    if (name && !CONTROL_KEYWORDS.has(name.value)) names.push(name.value);
+  }
+  return names;
+}
+
+/**
+ * The identifier immediately before the `(` at `parenIndex`, skipping modifiers
+ * (`public`, `static`, `async`, `readonly`, `get`, `set`, `*`).
+ *
+ * @returns the name and its offset, or null when no identifier precedes the paren.
+ */
+function memberNameBefore(
+  body: string,
+  parenIndex: number,
+): { value: string; index: number } | null {
+  let end = parenIndex;
+  while (end > 0 && /\s/.test(body[end - 1])) end -= 1;
+  let start = end;
+  while (start > 0 && /[\w$]/.test(body[start - 1])) start -= 1;
+  if (start === end) return null;
+  return { value: body.substring(start, end), index: start };
+}
+
+/**
+ * Claim a `name@offset` key once, so overlapping extraction shapes cannot
+ * double-count the same declaration.
+ */
+export function claimMember(seen: Set<string>, name: string, nameIndex: number): boolean {
+  const key = `${name}@${nameIndex}`;
+  if (seen.has(key)) return false;
+  seen.add(key);
+  return true;
+}

package/principles/adapters/position-analysis.ts

@@ -0,0 +1,43 @@
+/**
+ * Position analysis for TypeScript's regex-based extraction.
+ *
+ * The extraction regexes match `name(` for both a method DECLARATION and a CALL.
+ * This module answers which one it is, keeping `typescript.ts` inside its line
+ * budget and giving the rule a place to be tested directly.
+ */
+
+/**
+ * Characters that can only precede a CALL, never a declaration.
+ *
+ * `.` covers member calls (`this.c()`, `obj.method()`), `(` a call used as an
+ * argument (`if (existsSync(p))`), `,` a call in a list (`foo(a, bar(b))`), and
+ * the operators cover a call in a condition or expression
+ * (`hadExisting && existsSync(p)`, `x = read(p)`, `!isReady(q)`). No member
+ * declaration begins with any of them.
+ *
+ * Deliberately NOT included: `{`, `;`, `}` and plain whitespace. Those precede
+ * BOTH shapes -- `{ helper(1); }` is a call, `{ run(): void {` is a declaration
+ * -- so using them makes the answer depend on formatting. Depth is what
+ * separates those two, which is why extractClasses counts by brace depth.
+ */
+const CALL_PRECEDERS = new Set([
+  '.', '(', ',',
+  '&', '|', '=', '!', '?', ':', '+', '-', '*', '/', '<', '>', '[',
+]);
+
+/**
+ * Is the identifier starting at `nameIndex` a call rather than a declaration?
+ *
+ * Without this check `if (existsSync(p))` was extracted as a method named
+ * `existsSync` -- the extraction regex's lookbehind permits `(` before the name
+ * -- which then borrowed the enclosing block's brace as a "body" and reported a
+ * phantom `missing-error-handling` warning that no edit could clear. It also
+ * inflated `extractClasses().methodCount` with the names of whatever the class
+ * body happened to call (66 reported for a class declaring 30).
+ */
+export function isCallPosition(masked: string, nameIndex: number): boolean {
+  let i = nameIndex - 1;
+  while (i >= 0 && /\s/.test(masked[i])) i -= 1;
+  return i >= 0 && CALL_PRECEDERS.has(masked[i]);
+}
+

package/principles/adapters/quote-state.ts

@@ -0,0 +1,80 @@
+/**
+ * Character-level quote and delimiter tracking for TypeScript source scanning.
+ *
+ * The param-list and brace scanners all need "is this delimiter inside a string
+ * or template?" before they can act on it. That logic is identical for every
+ * caller, so it lives here instead of being repeated -- and it keeps
+ * `typescript.ts` inside the 1050-line budget.
+ */
+
+export interface QuoteState {
+  inSingle: boolean;
+  inDouble: boolean;
+  inTemplate: boolean;
+}
+
+export function newQuoteState(): QuoteState {
+  return { inSingle: false, inDouble: false, inTemplate: false };
+}
+
+export function inQuotedState(state: QuoteState): boolean {
+  return state.inSingle || state.inDouble || state.inTemplate;
+}
+
+/** The three quote kinds tracked by QuoteState, with the flag that marks each. */
+const QUOTE_KINDS: ReadonlyArray<{ quote: string; flag: 'inSingle' | 'inDouble' | 'inTemplate' }> = [
+  { quote: "'", flag: 'inSingle' },
+  { quote: '"', flag: 'inDouble' },
+  { quote: '`', flag: 'inTemplate' },
+];
+
+/**
+ * Advance one character of quote tracking.
+ *
+ * Extracted because `countParams` and `readParenGroup` carried the same
+ * six-branch block verbatim (#602): both must ignore delimiters that appear
+ * inside a string, and neither may treat an escape as a closing quote.
+ *
+ * Table-driven (#620): all three quote kinds behave identically -- an escape
+ * skips two characters, the matching quote closes the literal -- so they are one
+ * rule applied to a list rather than three copies of it.
+ *
+ * @returns the number of characters consumed (2 when the next char is escaped).
+ */
+export function advanceQuoteState(src: string, i: number, state: QuoteState): number {
+  const c = src[i];
+
+  for (const kind of QUOTE_KINDS) {
+    if (!state[kind.flag]) continue;
+    if (c === '\\') return 2;
+    if (c === kind.quote) state[kind.flag] = false;
+    return 1;
+  }
+
+  // Not inside any literal: open the one this character starts, if any.
+  const opener = QUOTE_KINDS.find(kind => kind.quote === c);
+  if (opener) state[opener.flag] = true;
+  return 1;
+}
+
+/** Opening delimiters that raise the generic/bracket depth in a param list. */
+const DEPTH_OPENERS = new Set(['(', '[', '{', '<']);
+/** Closing delimiters that lower it. */
+const DEPTH_CLOSERS = new Set([')', ']', '}', '>']);
+
+/**
+ * Adjust `depth` for one delimiter.
+ * @returns true when the character was a delimiter (so it cannot also be a
+ *          separator), false otherwise.
+ */
+export function applyDelimiter(c: string, depth: { value: number }): boolean {
+  if (DEPTH_OPENERS.has(c)) { depth.value++; return true; }
+  if (DEPTH_CLOSERS.has(c)) { depth.value--; return true; }
+  return false;
+}
+
+/** True when the character opens a quote/template the scanners must skip. */
+export function isQuote(c: string): boolean {
+  return c === "'" || c === '"' || c === '`';
+}
+