@boyingliu01/xp-gate 0.35.17 → 0.35.19

package/lib/__tests__/gate-runner.test.js

@@ -9,6 +9,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 const { execFileSync, spawnSync } = require('node:child_process');
+const { findConsumerGateVariant } = require('../gate-runner');
 
 let tmpProject;
 let tmpAdapters;
@@ -25,15 +26,26 @@ afterEach(() => {
   }
 });
 
+// Fixture writers run in every `beforeAll`; swallowing their failure would turn a
+// broken fixture into "the gate under test misbehaved", which is the opposite of
+// what the assertion is checking. Report which file could not be written.
+function writeFixture(filePath, content) {
+  try {
+    fs.writeFileSync(filePath, content);
+  } catch (err) {
+    throw new Error(`Cannot write test fixture ${filePath}: ${err.message}`);
+  }
+}
+
 function writeAdapterCommon() {
-  fs.writeFileSync(
+  writeFixture(
     path.join(tmpAdapters, 'adapter-common.sh'),
     'detect_project_lang() { echo "typescript"; }'
   );
 }
 
 function writeGateFragment(fragmentLines) {
-  fs.writeFileSync(
+  writeFixture(
     path.join(tmpAdapters, 'gate-9.sh'),
     ['# gate-9 fragment', ...fragmentLines, 'exit 0'].join('\n')
   );
@@ -55,14 +67,21 @@ function hostilePathSegment() {
 }
 
 function initializeGitProject() {
-  execFileSync('git', ['init', '-q'], { cwd: tmpProject });
-  execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: tmpProject });
-  execFileSync('git', ['config', 'user.name', 'XP-Gate Test'], { cwd: tmpProject });
-  fs.writeFileSync(path.join(tmpProject, 'tracked.ts'), 'const value = 1;\n');
-  execFileSync('git', ['add', 'tracked.ts'], { cwd: tmpProject });
-  execFileSync('git', ['-c', 'core.hooksPath=/dev/null', 'commit', '-qm', 'initial'], {
-    cwd: tmpProject,
-  });
+  try {
+    execFileSync('git', ['init', '-q'], { cwd: tmpProject });
+    execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: tmpProject });
+    execFileSync('git', ['config', 'user.name', 'XP-Gate Test'], { cwd: tmpProject });
+    writeFixture(path.join(tmpProject, 'tracked.ts'), 'const value = 1;\n');
+    execFileSync('git', ['add', 'tracked.ts'], { cwd: tmpProject });
+    execFileSync('git', ['-c', 'core.hooksPath=/dev/null', 'commit', '-qm', 'initial'], {
+      cwd: tmpProject,
+    });
+  } catch (err) {
+    // Without this the failure surfaces as a downstream assertion on the gate's
+    // output. Name the setup step instead: a repo fixture that never initialised
+    // is not a gate defect.
+    throw new Error(`Cannot initialise the fixture git repo at ${tmpProject}: ${err.message}`);
+  }
 }
 
 // Runs runGateAdapter in a child node process (worker threads forbid process
@@ -188,7 +207,7 @@ describe('gate-runner.js — runGateAdapter', () => {
       ].join('\n')
     );
 
-    const result = spawnSync(process.execPath, [cliPath, 'check', '9'], {
+    const result = spawnSync(process.execPath, [cliPath, 'check', '10'], {
       cwd: tmpProject,
       encoding: 'utf8',
       timeout: 30000,
@@ -225,7 +244,7 @@ describe('gate-runner.js — runGateAdapter', () => {
 
     const result = spawnSync(
       process.execPath,
-      [path.join(packageFixture, 'bin', 'xp-gate.js'), 'check', '9', targetProject],
+      [path.join(packageFixture, 'bin', 'xp-gate.js'), 'check', '10', targetProject],
       {
         cwd: callerProject,
         encoding: 'utf8',
@@ -283,7 +302,7 @@ describe('gate-runner.js — runGateAdapter', () => {
 
     const result = spawnSync(
       process.execPath,
-      [path.join(packageFixture, 'bin', 'xp-gate.js'), 'check', '9'],
+      [path.join(packageFixture, 'bin', 'xp-gate.js'), 'check', '10'],
       { cwd: tmpProject, encoding: 'utf8', timeout: 30000 }
     );
 
@@ -301,10 +320,36 @@ describe('gate-runner.js — runGateAdapter', () => {
 
     const result = spawnSync(
       process.execPath,
-      [path.join(packageFixture, 'bin', 'xp-gate.js'), 'check', '9', targetProject],
+      [path.join(packageFixture, 'bin', 'xp-gate.js'), 'check', '10', targetProject],
       { cwd: tmpProject, encoding: 'utf8', timeout: 30000 }
     );
 
     expect(result.status).toBe(1);
   }, 30000);
+
+  // The mirror image of the tests above, asserted on the resolver rather than on
+  // CLI output. A project that declares no variant must resolve to nothing, so
+  // the built-in implementation still runs.
+  //
+  // Asserted here, not through `check 9`: BOTH implementations print "Semgrep"
+  // (githooks/gate-9.sh says it five times too), and a bash fallback that finds
+  // no script prints neither banner, so every stdout-based assertion passed even
+  // with the TypeScript module hard-disabled -- the guard proved nothing.
+  it('resolves no variant when the project declares none (REQ-standalone-gates-05)', () => {
+    const plainProject = path.join(tmpProject, 'plain-target');
+    fs.mkdirSync(plainProject, { recursive: true });
+
+    expect(findConsumerGateVariant('gate-9', plainProject)).toBe(null);
+  });
+
+  it('resolves the declared variant when the project has one (REQ-standalone-gates-05)', () => {
+    const variantProject = path.join(tmpProject, 'variant-target');
+    const gatesDir = path.join(variantProject, 'githooks', 'gates');
+    fs.mkdirSync(gatesDir, { recursive: true });
+    const variantPath = path.join(gatesDir, 'gate-9-project-choice.sh');
+    fs.writeFileSync(variantPath, 'exit 0\n');
+
+    const resolved = findConsumerGateVariant('gate-9', variantProject);
+    expect(resolved).toBe(variantPath);
+  });
 });

package/lib/__tests__/shared-utils.test.js

@@ -130,4 +130,51 @@ describe('shared-utils', () => {
     });
   });
 
+  describe('copyDirRecursive (#640 concurrency)', () => {
+    // The mirrored trees this walks are rewritten in place by
+    // scripts/sync-package-content.js. A concurrent init enumerates the
+    // directory, then finds an entry gone -- ENOENT on a file that reappears
+    // microseconds later. That must not abort the install.
+    it('skips a file that disappears between enumeration and copy', () => {
+      const src = path.join(tmpRoot, 'src');
+      const dest = path.join(tmpRoot, 'dest');
+      fs.mkdirSync(src, { recursive: true });
+      fs.writeFileSync(path.join(src, 'stable.sh'), 'stable');
+      fs.writeFileSync(path.join(src, 'vanishing.sh'), 'vanishing');
+
+      const realReadFileSync = fs.readFileSync;
+      vi.spyOn(fs, 'readFileSync').mockImplementation((p, ...rest) => {
+        if (String(p).endsWith('vanishing.sh')) {
+          const err = new Error('ENOENT: no such file or directory');
+          err.code = 'ENOENT';
+          throw err;
+        }
+        return realReadFileSync(p, ...rest);
+      });
+
+      const { copyDirRecursive } = require('../shared-utils');
+      expect(() => copyDirRecursive(src, dest)).not.toThrow();
+      expect(fs.existsSync(path.join(dest, 'stable.sh'))).toBe(true);
+      expect(fs.existsSync(path.join(dest, 'vanishing.sh'))).toBe(false);
+    });
+
+    it('still surfaces a real read error instead of silently skipping', () => {
+      // Only ENOENT means "being replaced". A permission or disk error is a real
+      // failure, and swallowing it would ship a half-installed hook set.
+      const src = path.join(tmpRoot, 'src2');
+      const dest = path.join(tmpRoot, 'dest2');
+      fs.mkdirSync(src, { recursive: true });
+      fs.writeFileSync(path.join(src, 'locked.sh'), 'locked');
+
+      vi.spyOn(fs, 'readFileSync').mockImplementation(() => {
+        const err = new Error('EACCES: permission denied');
+        err.code = 'EACCES';
+        throw err;
+      });
+
+      const { copyDirRecursive } = require('../shared-utils');
+      expect(() => copyDirRecursive(src, dest)).toThrow(/EACCES/);
+    });
+  });
+
 });

package/lib/__tests__/update-skill.test.js

@@ -288,3 +288,80 @@ describe('update-skill', () => {
     });
   });
 });
+
+// ── #682: `--all` must enumerate what is on disk, not the config registry ────
+// `xp-gate init` / `setup-global` deploy skills to disk but never write
+// `config.installedSkills`, so `--all` iterated an always-empty object: it
+// printed "Updating all skills..." and exited 0 having touched nothing. doctor
+// solved the identical problem in #635 by enumerating the filesystem; this
+// block pins the same contract for update-skill, plus the honesty requirement
+// that a run which updates nothing must not look like a successful one.
+describe('update-skill #682 filesystem enumeration', () => {
+  let tmpHome;
+  let originalHome;
+  let installSkillMock;
+  let logSpy;
+  let errorSpy;
+
+  beforeEach(() => {
+    originalHome = process.env.HOME;
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-up682-'));
+    process.env.HOME = tmpHome;
+    vi.resetModules();
+    delete require.cache[require.resolve('../update-skill')];
+    delete require.cache[require.resolve('../install-skill.js')];
+    installSkillMock = vi.fn().mockResolvedValue(0);
+    const p = require.resolve('../install-skill.js');
+    require.cache[p] = { id: p, filename: p, loaded: true, exports: { installSkill: installSkillMock } };
+    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    process.env.HOME = originalHome;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+    delete require.cache[require.resolve('../install-skill.js')];
+    delete require.cache[require.resolve('../update-skill')];
+    vi.restoreAllMocks();
+  });
+
+  function deploySkill(platform, name) {
+    const dir = path.join(tmpHome, '.config', platform, 'skills', name);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'SKILL.md'), 'old content');
+    return dir;
+  }
+
+  it('AC-682-01: --all updates skills found on disk even when config.installedSkills is absent', async () => {
+    deploySkill('opencode', 'sprint-flow');
+    deploySkill('opencode', 'delphi-review');
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+    expect(code).toBe(0);
+    const names = installSkillMock.mock.calls.map((c) => c[0]);
+    expect(names).toContain('sprint-flow');
+    expect(names).toContain('delphi-review');
+  });
+
+  it('AC-682-02: --all does not update the same skill twice for the same platform', async () => {
+    deploySkill('opencode', 'sprint-flow');
+    fs.mkdirSync(path.join(tmpHome, '.config', 'xp-gate'), { recursive: true });
+    fs.writeFileSync(
+      path.join(tmpHome, '.config', 'xp-gate', 'xp-gate.json'),
+      JSON.stringify({ installedSkills: { 'sprint-flow': { version: '1.0.0' } } })
+    );
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { all: true });
+    const sprintCalls = installSkillMock.mock.calls.filter((c) => c[0] === 'sprint-flow');
+    expect(sprintCalls.length).toBe(1);
+  });
+
+  it('AC-682-03: --all with nothing installed says so instead of silently succeeding', async () => {
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+    const said = [...logSpy.mock.calls, ...errorSpy.mock.calls].map((c) => c.join(' ')).join('\n');
+    expect(said).toMatch(/nothing to update|no skills installed|not installed/i);
+    expect(installSkillMock).not.toHaveBeenCalled();
+    expect(code).toBe(0);
+  });
+});

package/lib/doctor-tui.js

@@ -280,8 +280,29 @@ function diagnoseSkillsInDir(skillNames, userSkillsDir, bundledSkillsDir, checks
         });
         issues++;
       } else {
-        // cmp >= 0: installed version is same or newer than bundled
-        checks.push({ name: label(name), status: 'PASS', detail: 'Up to date' });
+        // cmp >= 0: installed version is same or newer than bundled.
+        //
+        // #681: an EQUAL version is a claim, not a fact. A skill that gained a
+        // whole chapter without a version bump reported "Up to date" while the
+        // installed copy was ~20k characters behind, and `update-skill` agreed.
+        // So when the versions tie, still compare the bodies — and do NOT
+        // prescribe `update-skill` on a difference: the installed copy may be
+        // NEWER than main (the same asymmetry the versionless branch below
+        // already respects), so the advice is "compare manually".
+        const sameBody = sameContentIgnoringLineEndings(
+          withoutVersionLine(bundledContent),
+          withoutVersionLine(userContent)
+        );
+        if (!sameBody) {
+          checks.push({
+            name: label(name),
+            status: 'WARN',
+            detail: `Content differs at the same version ${userVersion} — the version was not bumped when the skill changed; compare manually before running update-skill`,
+          });
+          issues++;
+        } else {
+          checks.push({ name: label(name), status: 'PASS', detail: 'Up to date' });
+        }
       }
     } else {
       // No version in at least one file — compare content, but not byte-for-byte:

package/lib/doctor.js

@@ -3394,9 +3394,26 @@ async function doctorDelphi(options = {}) {
 
   // 5. Config ping: parseable, three distinct callable models. A duplicate
   // model here is a review that will BLOCK later — say so now.
-  const cfgPath = configPath || path.join(process.cwd(), '.delphi-config.json');
+  //
+  // #684: resolve the SAME way the runner does. A project-local config wins; a
+  // machine-level one under XDG_CONFIG_HOME (or ~/.config) is the documented
+  // fallback, and a review keeps working on it. Checking only `cwd` reported
+  // FAIL on the layout SKILL.md recommends and told the user to copy the example
+  // into the project — manufacturing the drifted duplicate #541 warns about.
+  //
+  // An explicit `configPath` is an ANSWER, not a hint: a caller that names a
+  // file means that file, so it disables the fallback. Otherwise a test (or a
+  // caller) pinning an absent path silently reads the developer's real global
+  // config and reports PASS — the same vacuous-pass shape this batch is fixing.
+  const projectCfgPath = configPath
+    || path.join(options.projectDir || process.cwd(), '.delphi-config.json');
+  const usingGlobalConfig = !configPath
+    && !fs.existsSync(projectCfgPath)
+    && fs.existsSync(globalConfigPath);
+  const cfgPath = usingGlobalConfig ? globalConfigPath : projectCfgPath;
+  const cfgLabel = 'Delphi config (.delphi-config.json)';
   if (!fs.existsSync(cfgPath)) {
-    add('Delphi config (.delphi-config.json)', 'FAIL',
+    add(cfgLabel, 'FAIL',
       `${cfgPath} not found (copy .delphi-config.json.example from the skill directory)`);
   } else {
     try {
@@ -3404,7 +3421,7 @@ async function doctorDelphi(options = {}) {
       const profileName = raw.active_profile || 'default';
       const profile = raw.profiles && raw.profiles[profileName];
       if (!profile) {
-        add('Delphi config (.delphi-config.json)', 'FAIL', `profile "${profileName}" not found`);
+        add(cfgLabel, 'FAIL', `profile "${profileName}" not found`);
       } else {
         const experts = profile.experts || {};
         const models = roles.map((r) => experts[r] && experts[r].model);
@@ -3422,10 +3439,14 @@ async function doctorDelphi(options = {}) {
           if (missingRoles.length > 0) problems.push(`missing experts: ${missingRoles.join(', ')}`);
           if (duplicates.length > 0) problems.push(`duplicate models: ${[...new Set(duplicates)].join(', ')}`);
           if (badProviders.length > 0) problems.push(`unusable provider binding: ${badProviders.join(', ')}`);
-          add('Delphi config (.delphi-config.json)', 'FAIL', problems.join('; '));
+          add(cfgLabel, 'FAIL', problems.join('; '));
         } else {
-          add('Delphi config (.delphi-config.json)', 'PASS',
-            `profile "${profileName}": ${models.join(' / ')}`);
+          // Always name the file that was actually read. Without it a user with
+          // both scopes present cannot tell which one the review will use — the
+          // exact ambiguity that made #684 hard to see.
+          const scopeNote = usingGlobalConfig ? ` [global: ${cfgPath}]` : ` [project: ${cfgPath}]`;
+          add(cfgLabel, 'PASS',
+            `profile "${profileName}": ${models.join(' / ')}${scopeNote}`);
           // #574: non-local seats are reported, not blocked. The local-only rule
           // is an operator preference (the 2026-10-03 quota burn), so doctor
           // surfaces the cost exposure without failing a deliberately hosted
@@ -3483,7 +3504,7 @@ async function doctorDelphi(options = {}) {
         }
       }
     } catch (err) {
-      add('Delphi config (.delphi-config.json)', 'FAIL', `unparseable: ${err.message}`);
+      add(cfgLabel, 'FAIL', `unparseable: ${err.message}`);
     }
   }
 

package/lib/gate-runner.js

@@ -361,16 +361,69 @@ function resolveNpxInvocation(args) {
   return ['npx', args];
 }
 
+/**
+ * A project-local gate variant, if the project declares one.
+ *
+ * `<consumer cwd>/githooks/gates/gate-<n>-<name>.sh` is where a PROJECT puts its
+ * own variant of a gate: the hyphenated name is the point, because it lets one
+ * project keep several variants where a flat `gate-<n>.sh` cannot express the
+ * choice (#672, restored by 7b43666a). `xp-gate init` never creates that
+ * directory, so a stock project simply falls through to the built-in
+ * implementation and nothing changes for it.
+ *
+ * This is deliberately NOT the same as `<project>/src/gates/<gate>.ts`, which
+ * `findTsGateEntry` refuses to read (#672): that path let the party being
+ * checked supply the implementation, so `process.exit(0)` passed every gate.
+ * Declaring a variant under `githooks/gates/` is an explicit, named opt-in;
+ * dropping a file into `src/gates/` is not.
+ *
+ * @param {string} gateModule e.g. 'gate-9'
+ * @param {string} cwd project root to search
+ * @returns {string|null}
+ */
+function findConsumerGateVariant(gateModule, cwd) {
+  const gateNum = gateModule.replace('gate-', '');
+  // Strictly the project's own declaration. `resolveGateScript` additionally
+  // probes the flat `githooks/gate-<n>.sh` and the global install
+  // (~/.config/xp-gate/adapters/); treating either as "the project declared a
+  // variant" would hand every gate to whichever bash copy happens to be
+  // installed -- on a machine with a global install that is *always*. A variant
+  // is a file the project deliberately named, so only `githooks/gates/` counts.
+  const gatesDir = path.join(cwd, 'githooks', 'gates');
+  const declared = matchGateFileIn(gatesDir, gateNum);
+  return declared ? path.join(gatesDir, declared) : null;
+}
+
+/**
+ * Which implementation runs this gate: a project-declared variant, the built-in
+ * TypeScript module, or a bash fallback.
+ *
+ * Split out of `runTsGate` so that function stays about running the gate. The
+ * precedence is a contract with two sides -- `githooks/gates/` is the project's
+ * opt-in, and the built-in module must remain reachable when nobody opted in --
+ * so it is named here rather than inlined in the runner.
+ *
+ * @returns {{kind: 'variant', script: string} | {kind: 'module', entry: string} | {kind: 'fallback', script: string} | {kind: 'none'}}
+ */
+function resolveGateImplementation(gateModule, targetCwd) {
+  const variant = findConsumerGateVariant(gateModule, targetCwd);
+  if (variant) return { kind: 'variant', script: variant };
+
+  const entry = findTsGateEntry(gateModule);
+  if (entry) return { kind: 'module', entry };
+
+  const script = resolveGateScript(gateModule.replace('gate-', ''), targetCwd);
+  return script ? { kind: 'fallback', script } : { kind: 'none' };
+}
+
 function runTsGate(gateModule, targetPath, opts = {}) {
   const targetCwd = resolveGateCwd(targetPath);
-  const entry = findTsGateEntry(gateModule);
-  if (!entry) {
-    // Fallback to bash script
-    const gateNum = gateModule.replace('gate-', '');
-    const script = resolveGateScript(gateNum, targetCwd);
-    if (script) {
-      return runGateAdapter(script, targetCwd, opts);
-    }
+  const impl = resolveGateImplementation(gateModule, targetCwd);
+
+  if (impl.kind === 'variant' || impl.kind === 'fallback') {
+    return runGateAdapter(impl.script, targetCwd, opts);
+  }
+  if (impl.kind === 'none') {
     // #618: nothing ran. Before this, the function fell through to `return 0`
     // and the --all summary counted the gate as passed.
     console.log(`Gate ${gateModule}: TypeScript module not found and no bash fallback available.`);
@@ -378,7 +431,7 @@ function runTsGate(gateModule, targetPath, opts = {}) {
     return GATE_NOT_RUN;
   }
 
-  const args = ['-y', 'tsx', entry, '--run'];
+  const args = ['-y', 'tsx', impl.entry, '--run'];
   if (targetPath) args.push('--cwd', targetPath);
 
   // spawnSync reports a spawn failure (npx missing) on `error`, throws only on a
@@ -508,21 +561,28 @@ const GATE_REGISTRY = {
       return runTsGate('gate-8', targetPath);
     },
   },
+  // Numbering follows the HOOK, which is where gates actually execute (#677).
+  // These two were swapped here: the CLI called 9 "SAST" and 10 "Build Integrity"
+  // while the hook runs 9=Build integrity and 10=Semgrep SAST. A user reading
+  // "❌ BLOCKED - Gate 9: Build integrity check failed" in their commit output and
+  // then running `xp-gate check --gates 9` got semgrep -- a different gate, reported
+  // green. The hook is the majority implementation and the one the error message
+  // names, so its numbering wins.
   '9': {
+    name: 'Build Integrity',
+    description: 'TypeScript compilation, npm pack, and import validation',
+    aliases: ['build', '9'],
+    preCommitOnly: true,
+    reason: 'Build integrity checks require language detection and build tool context',
+  },
+  '10': {
     name: 'SAST Security',
     description: 'semgrep static application security testing',
-    aliases: ['sast', 'semgrep', '9'],
+    aliases: ['sast', 'semgrep', '10'],
     run: (targetPath) => {
       return runTsGate('gate-9', targetPath);
     },
   },
-  '10': {
-    name: 'Build Integrity',
-    description: 'TypeScript compilation, npm pack, and import validation',
-    aliases: ['build', '10'],
-    preCommitOnly: true,
-    reason: 'Build integrity checks require language detection and build tool context',
-  },
   '11': {
     name: 'Sprint Flow Enforcement',
     description: 'Sprint state and delphi-review validation',
@@ -530,6 +590,26 @@ const GATE_REGISTRY = {
     preCommitOnly: true,
     reason: 'Requires sprint state (.sprint-state/) and git branch context',
   },
+  // Gates 12 and 13 block commits in the hook but were absent here entirely, so
+  // `xp-gate check --gates 12` answered "Unknown gate(s)" for a gate that had just
+  // blocked the user (#677). Registered with an explicit reason rather than
+  // pretending to re-implement them: both need the staged-diff and per-language
+  // build context the hook assembles, and a half-correct reimplementation that
+  // answered PASS would be worse than saying so.
+  '12': {
+    name: 'File Hygiene',
+    description: 'conflict markers (blocking) + YAML/JSON syntax (blocking) + whitespace warnings',
+    aliases: ['hygiene', 'file-hygiene', '12'],
+    preCommitOnly: true,
+    reason: 'File hygiene inspects the staged diff, which only exists inside the hook',
+  },
+  '13': {
+    name: 'Compiler Strictness',
+    description: 'gcc/g++ -Wall -Wextra, javac -Xlint, Maven/Gradle warnings on changed files',
+    aliases: ['compiler', 'strictness', '13'],
+    preCommitOnly: true,
+    reason: 'Compiler strictness needs the changed-file set and a discovered toolchain',
+  },
   'python-health': {
     name: 'Python Environment Health',
     description: 'Comprehensive Python environment diagnostics',
@@ -718,4 +798,4 @@ async function runGate(gateId, targetPath, opts = {}) {
   return 1;
 }
 
-module.exports = { GATE_REGISTRY, GATE_NOT_RUN, getGateInfo, getAllGates, runGate, resolveAlias, getAliases, runGateAdapter, findTsGateEntry, resolveGateScript, SOURCE_FILE_EXTENSIONS, resolveAllModeChangedFiles, describeEmptyChangedFiles, describeChangedFilesScope };
+module.exports = { findConsumerGateVariant, GATE_REGISTRY, GATE_NOT_RUN, getGateInfo, getAllGates, runGate, resolveAlias, getAliases, runGateAdapter, findTsGateEntry, resolveGateScript, SOURCE_FILE_EXTENSIONS, resolveAllModeChangedFiles, describeEmptyChangedFiles, describeChangedFilesScope };

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-31T07:40:57.523Z",
+  "checked_at": "2026-11-01T15:38:49.220Z",
   "source": "network"
 }

package/lib/shared-utils.js

@@ -8,6 +8,19 @@ const path = require('path');
 /**
  * Recursively copy a directory.
  * Pure function: only uses fs/path params, no global config.
+ *
+ * A file that disappears between `readdirSync` and `copyFileSync` is skipped
+ * rather than crashing the whole copy. That is not defensive padding: the
+ * mirrored trees this walks (`hooks/`, `adapters/`) are rewritten in place by
+ * `scripts/sync-package-content.js`, which unlinks and recreates each entry. A
+ * concurrent `xp-gate init` (or a test suite that runs init while another test
+ * invokes the sync) enumerates the directory, then finds the entry gone --
+ * `ENOENT` on a file that will exist again microseconds later. Aborting the
+ * install there would report a broken package for a transient race.
+ *
+ * Copies the CONTENT instead of `copyFileSync` so the read and the write both
+ * see a consistent snapshot, and only ENOENT is tolerated -- permission and
+ * disk errors still surface, because those are real failures.
  */
 function copyDirRecursive(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
@@ -18,11 +31,24 @@ function copyDirRecursive(src, dest) {
     if (entry.isDirectory()) {
       copyDirRecursive(srcPath, destPath);
     } else {
-      fs.copyFileSync(srcPath, destPath);
+      copyFileContents(srcPath, destPath);
     }
   }
 }
 
+/** Copy one file, treating "vanished mid-copy" as a skip. @returns {boolean} whether it was copied */
+function copyFileContents(srcPath, destPath) {
+  let data;
+  try {
+    data = fs.readFileSync(srcPath);
+  } catch (err) {
+    if (err.code === 'ENOENT') return false;
+    throw err;
+  }
+  fs.writeFileSync(destPath, data);
+  return true;
+}
+
 function readXpGateConfig() {
   const cfgPath = path.join(require('os').homedir(), '.xp-gate', 'config.json');
   try {

package/lib/update-skill.js

@@ -7,6 +7,57 @@ const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir();
 
 const CONFIG_DIR = path.join(HOME, '.config', 'xp-gate');
 
+/**
+ * The skill names that are actually deployed on this machine.
+ *
+ * `xp-gate init` / `setup-global` copy skills onto disk but never write
+ * `config.installedSkills`, so the config registry is empty on a fully
+ * deployed machine. Iterating it made `update-skill --all` print
+ * "Updating all skills..." and exit 0 having touched nothing (#682) -- the
+ * same defect #635 fixed for `doctor`, with the same fix: ask the filesystem.
+ *
+ * The explicit registry is still unioned in, so a skill that is merely
+ * registered (or was installed on a platform this scan cannot see) keeps
+ * working for callers that rely on it.
+ *
+ * @returns {string[]} de-duplicated skill names, in a stable order
+ */
+function installedSkillNames() {
+  const names = new Set();
+  const config = getConfig();
+  for (const name of Object.keys(config.installedSkills || {})) names.add(name);
+
+  let platforms = [];
+  try {
+    platforms = Object.keys(require('./detect-deps.js').PLATFORM_PROFILES);
+  } catch {
+    // detect-deps unavailable: fall back to the registry only rather than
+    // reporting "nothing installed" for a machine that has skills on disk.
+    platforms = [];
+  }
+  const detect = require('./detect-deps.js');
+  for (const platform of platforms) {
+    let dir;
+    try {
+      dir = detect.getSkillsDirs(platform)[0];
+    } catch {
+      continue;
+    }
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      // A skill is `<dir>/<name>/SKILL.md` — the shape install-skill writes.
+      if (fs.existsSync(path.join(dir, entry.name, 'SKILL.md'))) names.add(entry.name);
+    }
+  }
+  return [...names].sort();
+}
+
 function handleCheckMode() {
   console.log('Checking for updates...');
   const config = getConfig();
@@ -19,11 +70,16 @@ function handleCheckMode() {
 }
 
 async function handleAllMode(verbose) {
-  const config = getConfig();
-  const skills = config.installedSkills || {};
+  const names = installedSkillNames();
   console.log('Updating all skills...');
+  // #635/#682: an empty run must say so. Exiting 0 after "Updating all skills..."
+  // with no further output reads as success, and was how this stayed broken.
+  if (names.length === 0) {
+    console.log('No skills installed — nothing to update.');
+    return 0;
+  }
   let hasErrors = false;
-  for (const skillName of Object.keys(skills)) {
+  for (const skillName of names) {
     try {
       await updateSingleSkill(skillName, verbose);
     } catch (err) {

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 26a741de
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.17.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.