@boyingliu01/xp-gate 0.35.18 → 0.35.20

package/lib/__tests__/sprint-status-rework-704.test.js

@@ -0,0 +1,149 @@
+/**
+ * @test REQ-704 Sprint Status 返工率
+ * @intent `--rework-check` 的返工率恒为 0，且会把任何正确的值覆盖成 0。
+ *
+ *         根因有两层，必须同时修好才算真的修好：
+ *         (1) 统计区间的下界用了 `completed_at` —— 按定义它是 sprint **结束**的
+ *             时刻，而 sprint 的全部提交都发生在它之前。于是 `git log --since
+ *             <completed_at>` 返回空集。要统计的区间是「开始 → 结束」，
+ *             实际统计的区间是「结束 → 现在」，恰好是空的。
+ *         (2) `total_sprint_commits` 从未被计算过，只被读取（值恒为 0），
+ *             再经 `Math.max(total, 1)` 兜底成 1，使 `0/1` 恒等于 0。
+ *
+ *         这是一个质量指标的 fail-open：返工率是 #369 用来暴露「门禁全过但仍
+ *         返工」的唯一信号，恒为 0 意味着返工永远不可观测，而 CLI 还会主动打印
+ *         「All sprints within acceptable rework rate」。告警阈值永不触发。
+ *
+ *         测试必须用真实 git 仓库：这个 bug 的全部性质都藏在 `git log --since`
+ *         的行为里，任何 mock 都能让它「通过」。
+ * @covers AC-704-01, AC-704-02, AC-704-03, AC-704-04
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const sprintStatus = require('../sprint-status');
+
+function git(cwd, args, env = {}) {
+  // `-c core.hooksPath=` disables hooks for this fixture. Without it, the
+  // temporary repo inherits this machine's global hooksPath and every fixture
+  // commit runs the full pre-commit suite (~60s each, and it can BLOCK on
+  // unrelated file-hygiene findings in .xp-gate/reports). The test asserts on
+  // `git log`, so hooks contribute nothing but time and flakiness.
+  return execFileSync('git', ['-c', 'core.hooksPath=', ...args], {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, ...env },
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+}
+
+/** Capture console.log so assertions read the CLI output, not a return value. */
+function captureLogs(fn) {
+  const lines = [];
+  const original = console.log;
+  console.log = (...args) => lines.push(args.join(' '));
+  try {
+    const result = fn();
+    return { lines, result };
+  } finally {
+    console.log = original;
+  }
+}
+
+describe('sprint-status --rework-check 返工率 (#704)', () => {
+  let dir;
+  let stateFile;
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rework-704-'));
+    git(dir, ['init', '-q', '.']);
+    git(dir, ['config', 'user.email', 'test@example.com']);
+    git(dir, ['config', 'user.name', 'Test']);
+
+    // 4 commits: 2 feat + 2 fix => real rework rate 50%, above the 30% threshold.
+    // Author/committer dates are pinned so the sprint window is deterministic.
+    const commits = [
+      ['2026-11-01T10:00:00Z', 'a.txt', 'feat: initial'],
+      ['2026-11-01T10:10:00Z', 'b.txt', 'fix(core): repair the thing'],
+      ['2026-11-01T10:20:00Z', 'c.txt', 'feat: another'],
+      ['2026-11-01T10:30:00Z', 'd.txt', 'fix: 修掉一个缺陷'],
+    ];
+    for (const [date, file, message] of commits) {
+      fs.writeFileSync(path.join(dir, file), file);
+      git(dir, ['add', '-A']);
+      git(dir, ['commit', '-q', '-m', message], {
+        GIT_AUTHOR_DATE: date,
+        GIT_COMMITTER_DATE: date,
+      });
+    }
+
+    fs.mkdirSync(path.join(dir, '.sprint-state'), { recursive: true });
+    stateFile = path.join(dir, '.sprint-state', 'sprint-state.json');
+    // completed_at is AFTER every commit — this is the real CLOSE ordering, and
+    // the exact input that made `--since completed_at` return an empty set.
+    fs.writeFileSync(stateFile, JSON.stringify({
+      _schema_version: 1,
+      id: 'sprint-2026-11-01-01',
+      phase: 6,
+      status: 'completed',
+      started_at: '2026-11-01T09:00:00.000Z',
+      metrics: { completed_at: '2026-11-01T11:00:00.000Z' },
+    }, null, 2));
+  });
+
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('AC-704-01: counts fix commits between sprint start and completion, not after completion', () => {
+    const { lines } = captureLogs(() => sprintStatus.handleReworkCheck(dir, 3650));
+    const output = lines.join('\n');
+
+    // The two fix commits happened inside the sprint window. Reporting 0 means
+    // the lower bound is on the wrong side of the sprint.
+    expect(output).toMatch(/2 fix \/ 4 total commits/);
+  });
+
+  it('AC-704-02: reports the real rate and raises the >30% alert', () => {
+    const { lines } = captureLogs(() => sprintStatus.handleReworkCheck(dir, 3650));
+    const output = lines.join('\n');
+
+    expect(output).toMatch(/50\.0%/);
+    expect(output).toMatch(/exceeds 30% threshold/);
+    // The all-clear line must NOT be printed when a sprint is over threshold:
+    // that sentence is what turns a fail-open into a false reassurance.
+    expect(output).not.toMatch(/All sprints within acceptable rework rate/);
+  });
+
+  it('AC-704-03: persists the computed rate and the commit total it was computed from', () => {
+    captureLogs(() => sprintStatus.handleReworkCheck(dir, 3650));
+
+    const persisted = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
+    expect(persisted.metrics.rework_rate).toBe(0.5);
+    // total_sprint_commits was never computed before; the report needs it to
+    // stay meaningful on the next run.
+    expect(persisted.metrics.total_sprint_commits).toBe(4);
+  });
+
+  it('AC-704-04: an empty window reports 0/0, not a confident 0%', () => {
+    // Second sprint state: its window contains no commits at all.
+    fs.writeFileSync(stateFile, JSON.stringify({
+      _schema_version: 1,
+      id: 'sprint-2026-11-02-01',
+      phase: 6,
+      status: 'completed',
+      started_at: '2026-11-01T10:35:00.000Z',
+      metrics: { completed_at: '2026-11-01T12:00:00.000Z' },
+    }, null, 2));
+
+    const { lines } = captureLogs(() => sprintStatus.handleReworkCheck(dir, 3650));
+    const output = lines.join('\n');
+
+    // Zero commits in the window is NOT "0% rework" — it is "nothing to
+    // measure". Rendering it as 0.0% would recreate this same fail-open one
+    // level down.
+    expect(output).toMatch(/0 fix \/ 0 total commits/);
+  });
+});

package/lib/__tests__/sprint-status-rework.test.js

@@ -55,6 +55,21 @@ function daysAgo(n) {
   return new Date(Date.now() - n * 86400000).toISOString();
 }
 
+/**
+ * Hour-level offset, needed to express a sprint window that actually CONTAINS
+ * the fixture's commits (#704).
+ *
+ * The commits are made "now", so a window built from daysAgo(9)→daysAgo(2) held
+ * no commits at all. The old fixtures compensated by hand-writing
+ * `total_sprint_commits: 10` — a number nothing in the code ever produced — which
+ * pinned the expected rate against a value that could only exist in the test.
+ * Negative = in the future; used for `completed_at`, which in the real CLOSE
+ * ordering is stamped after the last commit.
+ */
+function hoursAgo(n) {
+  return new Date(Date.now() - n * 3600000).toISOString();
+}
+
 beforeAll(() => {
   TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'rework-test-'));
   cwdSpy = vi.spyOn(process, 'cwd');
@@ -101,9 +116,14 @@ describe('sprint-status --rework-check (#369)', () => {
     git('init', dir);
     git('config user.email "test@test.com"', dir);
     git('config user.name "Test"', dir);
+    // 10 commits, 2 of them fixes => 20%, below the 30% threshold.
+    // The count has to come from real history: the old fixture made 3 commits
+    // and declared 'total_sprint_commits: 10' by hand, so the expected 20%
+    // could only ever be produced by the fabricated number (#704).
     makeCommit('feat: initial', dir);
     makeCommit('fix: resolve login bug', dir);
     makeCommit('fix(auth): handle timeout', dir);
+    for (let i = 0; i < 7; i += 1) makeCommit(`feat: feature ${i}`, dir);
 
     writeSprintState({
       _schema_version: 1,
@@ -111,10 +131,10 @@ describe('sprint-status --rework-check (#369)', () => {
       task_description: 'Sprint B',
       phase: 6,
       status: 'completed',
-      started_at: daysAgo(9),
+      started_at: hoursAgo(1),
       isolation: { worktree_path: null, branch: 'main' },
       phase_history: [],
-      metrics: { completed_at: daysAgo(2), total_sprint_commits: 10 },
+      metrics: { completed_at: hoursAgo(-1) },
     }, dir);
 
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
@@ -142,12 +162,13 @@ describe('sprint-status --rework-check (#369)', () => {
     git('init', dir);
     git('config user.email "test@test.com"', dir);
     git('config user.name "Test"', dir);
+    // 10 commits, 5 of them fixes => 50%, above the 30% threshold.
     makeCommit('fix: one', dir);
     makeCommit('fix: two', dir);
     makeCommit('bugfix: three', dir);
     makeCommit('hotfix: four', dir);
     makeCommit('patch: five', dir);
-    makeCommit('feat: six', dir);
+    for (let i = 0; i < 5; i += 1) makeCommit(`feat: feature ${i}`, dir);
 
     writeSprintState({
       _schema_version: 1,
@@ -155,10 +176,10 @@ describe('sprint-status --rework-check (#369)', () => {
       task_description: 'Sprint C',
       phase: 6,
       status: 'completed',
-      started_at: daysAgo(9),
+      started_at: hoursAgo(1),
       isolation: { worktree_path: null, branch: 'main' },
       phase_history: [],
-      metrics: { completed_at: daysAgo(2), total_sprint_commits: 10 },
+      metrics: { completed_at: hoursAgo(-1) },
     }, dir);
 
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
@@ -208,6 +229,10 @@ describe('sprint-status --rework-check (#369)', () => {
     }
     makeCommit('feat: target initial', targetDir);
     makeCommit('fix: target bug', targetDir);
+    // 8 more target commits => 10 total, 1 fix => 10%. The count must come from
+    // real history; the old fixture declared it in the state file by hand, and
+    // this test's actual subject is GIT_DIR precedence, not arithmetic (#704).
+    for (let i = 0; i < 8; i += 1) makeCommit(`feat: target feature ${i}`, targetDir);
     makeCommit('fix: outer one', outerDir);
     makeCommit('fix: outer two', outerDir);
     makeCommit('fix: outer three', outerDir);
@@ -218,10 +243,10 @@ describe('sprint-status --rework-check (#369)', () => {
       task_description: 'Hook environment sprint',
       phase: 6,
       status: 'completed',
-      started_at: daysAgo(9),
+      started_at: hoursAgo(1),
       isolation: { worktree_path: null, branch: 'main' },
       phase_history: [],
-      metrics: { completed_at: daysAgo(2), total_sprint_commits: 10 },
+      metrics: { completed_at: hoursAgo(-1) },
     }, targetDir);
     cwdSpy.mockReturnValue(targetDir);
 

package/lib/__tests__/test-alignment-java-702.test.ts

@@ -0,0 +1,182 @@
+/**
+ * @test REQ-702 Test Alignment 语言覆盖
+ * @intent `parseTestFiles` 只认 .ts/.tsx/.js/.jsx/.py/.go。`.java` 文件被读进内存、
+ *         取出扩展名、然后什么都不做 —— 不是被拒绝，是被丢弃。
+ *
+ *         一个判定分支不存在时，系统报告的是「通过」而不是「未检查」：
+ *         纯 Java 工程 totalTests=0、totalAssertions=0，对齐分数在空集上计算，
+ *         但状态看起来是「跑过了」；混合工程里 Java 侧的覆盖被误报成
+ *         「未覆盖」，产生假阳性 gap。
+ *
+ *         与 #623（Gate 0 bypass 永不生效）、#645（真实仓库被测试写脏）同类：
+ *         共同点是静默失效。
+ *
+ *         修复要分三层，缺一层就还是 fail-open：
+ *         (1) 加 .java 分支，按 JUnit 5 的实际写法解析 @test/@intent 与断言；
+ *         (2) 未适配的扩展名必须 fail-loud，不能静默丢弃；
+ *         (3) 已适配集合显式化，集合外的扩展名要被报出来（.kt/.cs/.rb/.rs 同理）。
+ * @covers AC-702-01, AC-702-02, AC-702-03, AC-702-04, AC-702-05, AC-702-06
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+
+import {
+  parseTestFiles,
+  UNSUPPORTED_TEST_EXTENSIONS,
+  runFullAlignment,
+} from '../test-alignment';
+
+const JAVA_TEST = `import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * @test REQ-001-01
+ * @intent probe intent
+ * @covers AC-001-01-01
+ */
+class ProbeTest {
+    @Test
+    void shouldProbe() {
+        assertEquals(1, 1);
+        assertEquals(2, 2);
+        assertTrue(true);
+    }
+}
+`;
+
+const JS_TEST = `/**
+ * @test REQ-001-01
+ * @intent probe intent
+ * @covers AC-001-01-01
+ */
+describe('probe', () => {
+  it('should probe', () => {
+    expect(1).toBe(1);
+  });
+});
+`;
+
+describe('test-alignment 语言覆盖 (#702)', () => {
+  let dir: string;
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'align-702-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('AC-702-01: a .java test file produces a TestCase with its REQ and covers', () => {
+    const javaFile = path.join(dir, 'ProbeTest.java');
+    fs.writeFileSync(javaFile, JAVA_TEST);
+
+    const map = parseTestFiles([javaFile]);
+
+    // The file declares @test REQ-001-01 and @covers AC-001-01-01. Dropping it
+    // means the AC is reported "not covered by any test" — a false gap in a
+    // mixed project and a structurally empty report in a pure-Java one.
+    expect(map.totalTests).toBe(1);
+    expect(map.tests[0].requirementId).toBe('REQ-001-01');
+    expect(map.tests[0].name).toBe('shouldProbe');
+    expect(map.tests[0].covers).toContain('AC-001-01-01');
+    expect(map.tests[0].intent).toBe('probe intent');
+  });
+
+  it('AC-702-02: JUnit 5 assertion calls are counted', () => {
+    const javaFile = path.join(dir, 'ProbeTest.java');
+    fs.writeFileSync(javaFile, JAVA_TEST);
+
+    const map = parseTestFiles([javaFile]);
+
+    // assertEquals x2 + assertTrue x1. countAssertions() only knew JS/Python
+    // patterns, so a Java test would have parsed as zero-assertion.
+    expect(map.tests[0].assertions).toBe(3);
+    expect(map.totalAssertions).toBe(3);
+  });
+
+  it('AC-702-03: an unsupported test extension is reported, never silently dropped', () => {
+    const ktFile = path.join(dir, 'ProbeTest.kt');
+    fs.writeFileSync(ktFile, `/** @test REQ-001-01 */\nclass ProbeTest {}\n`);
+
+    const map = parseTestFiles([ktFile]);
+
+    // Silently returning an empty map is the bug: the caller cannot tell
+    // "no tests here" from "tests here I could not read".
+    expect(map.unsupportedFiles).toBeDefined();
+    expect(map.unsupportedFiles.length).toBe(1);
+    expect(map.unsupportedFiles[0]).toContain('ProbeTest.kt');
+  });
+
+  it('AC-702-04: the supported extension set is explicit and includes .java', () => {
+    // A hardcoded if/else chain is why .java fell through: there was no list to
+    // check the code against, so a missing branch looked like a complete one.
+    expect(Array.isArray(UNSUPPORTED_TEST_EXTENSIONS)).toBe(true);
+    expect(UNSUPPORTED_TEST_EXTENSIONS).toContain('.kt');
+    expect(UNSUPPORTED_TEST_EXTENSIONS).toContain('.rs');
+    expect(UNSUPPORTED_TEST_EXTENSIONS).not.toContain('.java');
+    expect(UNSUPPORTED_TEST_EXTENSIONS).not.toContain('.ts');
+    expect(UNSUPPORTED_TEST_EXTENSIONS).not.toContain('.go');
+  });
+});
+
+describe('runFullAlignment surfaces unparsed test files (#702)', () => {
+  const SPEC = `specification:
+  requirements:
+    - id: REQ-001-01
+      title: Probe requirement
+      acceptance_criteria:
+        - id: AC-001-01-01
+          criteria: The probe test asserts something
+          test_type: unit
+`;
+
+  let dir: string;
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'align-full-702-'));
+    fs.mkdirSync(path.join(dir, 'spec'), { recursive: true });
+    fs.mkdirSync(path.join(dir, 'tests'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'spec', 'specification.yaml'), SPEC);
+  });
+
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('AC-702-05: a pure-Kotlin test dir cannot PASS on an empty parsed set', () => {
+    fs.writeFileSync(
+      path.join(dir, 'tests', 'ProbeTest.kt'),
+      '/** @test REQ-001-01 */\nclass ProbeTest {}\n',
+    );
+
+    const report = runFullAlignment({
+      specPath: path.join(dir, 'spec', 'specification.yaml'),
+      testDirs: [path.join(dir, 'tests')],
+    });
+
+    // Zero parsed tests + zero parseable files used to look like a clean run.
+    // It is the opposite: nothing was read, so nothing can be certified.
+    expect(report.alignment_status).toBe('FAIL');
+    expect(report.errors.some(e => e.includes('ProbeTest.kt'))).toBe(true);
+    expect(report.anti_pattern_detected).toBe(true);
+  });
+
+  it('AC-702-06: a high score does not override the presence of unparsed files', () => {
+    // Java test covers the AC, so the score would be high on its own.
+    fs.writeFileSync(path.join(dir, 'tests', 'ProbeTest.java'), JAVA_TEST);
+    // One unparseable Rust test is enough to make the number untrustworthy.
+    fs.writeFileSync(path.join(dir, 'tests', 'ProbeTest.rs'), 'fn probe() {}\n');
+
+    const report = runFullAlignment({
+      specPath: path.join(dir, 'spec', 'specification.yaml'),
+      testDirs: [path.join(dir, 'tests')],
+    });
+
+    expect(report.errors.some(e => e.includes('ProbeTest.rs'))).toBe(true);
+    expect(report.alignment_status).toBe('FAIL');
+  });
+});

package/lib/__tests__/test-alignment.test.ts

@@ -384,6 +384,7 @@ describe('REQ-ALIGN-003: verifyAlignment()', () => {
         { name: 'testA', file: 'a.test.ts', requirementId: 'REQ-A', intent: 'test A', covers: ['AC-A-01'], assertions: 2, edgeCases: [] },
       ],
       totalTests: 1,
+      unsupportedFiles: [],
       totalAssertions: 2,
     };
 
@@ -420,6 +421,7 @@ describe('REQ-ALIGN-003: verifyAlignment()', () => {
       }],
       totalTests: 1,
       totalAssertions: 2,
+      unsupportedFiles: [],
     };
 
     const report = verifyAlignment(specMap, testMap);
@@ -447,6 +449,7 @@ describe('REQ-ALIGN-003: verifyAlignment()', () => {
       }],
       totalTests: 1,
       totalAssertions: 1,
+      unsupportedFiles: [],
     };
 
     const report = verifyAlignment(specMap, testMap);
@@ -553,7 +556,7 @@ specification:
     const spec = parseSpecification(specFile);
     expect(spec.requirements).toHaveLength(0);
 
-    const testMap = { tests: [], totalTests: 0, totalAssertions: 0 };
+    const testMap = { tests: [], totalTests: 0, totalAssertions: 0, unsupportedFiles: [] };
     const report = verifyAlignment(spec, testMap);
     // 0/0 = division by zero must be handled gracefully
     expect(report.coverage.requirementsTotal).toBe(0);
@@ -576,7 +579,7 @@ specification:
 `;
     const specFile = writeTempFile('no-tests-spec.yaml', specYaml);
     const spec = parseSpecification(specFile);
-    const testMap = { tests: [], totalTests: 0, totalAssertions: 0 };
+    const testMap = { tests: [], totalTests: 0, totalAssertions: 0, unsupportedFiles: [] };
     const report = verifyAlignment(spec, testMap);
 
     expect(report.coverage.requirementsCovered).toBe(0);
@@ -747,6 +750,7 @@ specification:
       }],
       totalTests: 1,
       totalAssertions: 3,
+      unsupportedFiles: [],
     };
     const report = verifyAlignment(spec, testMap);
     const score = calculateScore(report.issues, report.coverage, testMap);

package/lib/__tests__/update-skill.test.js

@@ -288,3 +288,80 @@ describe('update-skill', () => {
     });
   });
 });
+
+// ── #682: `--all` must enumerate what is on disk, not the config registry ────
+// `xp-gate init` / `setup-global` deploy skills to disk but never write
+// `config.installedSkills`, so `--all` iterated an always-empty object: it
+// printed "Updating all skills..." and exited 0 having touched nothing. doctor
+// solved the identical problem in #635 by enumerating the filesystem; this
+// block pins the same contract for update-skill, plus the honesty requirement
+// that a run which updates nothing must not look like a successful one.
+describe('update-skill #682 filesystem enumeration', () => {
+  let tmpHome;
+  let originalHome;
+  let installSkillMock;
+  let logSpy;
+  let errorSpy;
+
+  beforeEach(() => {
+    originalHome = process.env.HOME;
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-up682-'));
+    process.env.HOME = tmpHome;
+    vi.resetModules();
+    delete require.cache[require.resolve('../update-skill')];
+    delete require.cache[require.resolve('../install-skill.js')];
+    installSkillMock = vi.fn().mockResolvedValue(0);
+    const p = require.resolve('../install-skill.js');
+    require.cache[p] = { id: p, filename: p, loaded: true, exports: { installSkill: installSkillMock } };
+    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    process.env.HOME = originalHome;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+    delete require.cache[require.resolve('../install-skill.js')];
+    delete require.cache[require.resolve('../update-skill')];
+    vi.restoreAllMocks();
+  });
+
+  function deploySkill(platform, name) {
+    const dir = path.join(tmpHome, '.config', platform, 'skills', name);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'SKILL.md'), 'old content');
+    return dir;
+  }
+
+  it('AC-682-01: --all updates skills found on disk even when config.installedSkills is absent', async () => {
+    deploySkill('opencode', 'sprint-flow');
+    deploySkill('opencode', 'delphi-review');
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+    expect(code).toBe(0);
+    const names = installSkillMock.mock.calls.map((c) => c[0]);
+    expect(names).toContain('sprint-flow');
+    expect(names).toContain('delphi-review');
+  });
+
+  it('AC-682-02: --all does not update the same skill twice for the same platform', async () => {
+    deploySkill('opencode', 'sprint-flow');
+    fs.mkdirSync(path.join(tmpHome, '.config', 'xp-gate'), { recursive: true });
+    fs.writeFileSync(
+      path.join(tmpHome, '.config', 'xp-gate', 'xp-gate.json'),
+      JSON.stringify({ installedSkills: { 'sprint-flow': { version: '1.0.0' } } })
+    );
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { all: true });
+    const sprintCalls = installSkillMock.mock.calls.filter((c) => c[0] === 'sprint-flow');
+    expect(sprintCalls.length).toBe(1);
+  });
+
+  it('AC-682-03: --all with nothing installed says so instead of silently succeeding', async () => {
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+    const said = [...logSpy.mock.calls, ...errorSpy.mock.calls].map((c) => c.join(' ')).join('\n');
+    expect(said).toMatch(/nothing to update|no skills installed|not installed/i);
+    expect(installSkillMock).not.toHaveBeenCalled();
+    expect(code).toBe(0);
+  });
+});

package/lib/doctor-tui.js

@@ -280,8 +280,29 @@ function diagnoseSkillsInDir(skillNames, userSkillsDir, bundledSkillsDir, checks
         });
         issues++;
       } else {
-        // cmp >= 0: installed version is same or newer than bundled
-        checks.push({ name: label(name), status: 'PASS', detail: 'Up to date' });
+        // cmp >= 0: installed version is same or newer than bundled.
+        //
+        // #681: an EQUAL version is a claim, not a fact. A skill that gained a
+        // whole chapter without a version bump reported "Up to date" while the
+        // installed copy was ~20k characters behind, and `update-skill` agreed.
+        // So when the versions tie, still compare the bodies — and do NOT
+        // prescribe `update-skill` on a difference: the installed copy may be
+        // NEWER than main (the same asymmetry the versionless branch below
+        // already respects), so the advice is "compare manually".
+        const sameBody = sameContentIgnoringLineEndings(
+          withoutVersionLine(bundledContent),
+          withoutVersionLine(userContent)
+        );
+        if (!sameBody) {
+          checks.push({
+            name: label(name),
+            status: 'WARN',
+            detail: `Content differs at the same version ${userVersion} — the version was not bumped when the skill changed; compare manually before running update-skill`,
+          });
+          issues++;
+        } else {
+          checks.push({ name: label(name), status: 'PASS', detail: 'Up to date' });
+        }
       }
     } else {
       // No version in at least one file — compare content, but not byte-for-byte:

package/lib/doctor.js

@@ -3394,9 +3394,26 @@ async function doctorDelphi(options = {}) {
 
   // 5. Config ping: parseable, three distinct callable models. A duplicate
   // model here is a review that will BLOCK later — say so now.
-  const cfgPath = configPath || path.join(process.cwd(), '.delphi-config.json');
+  //
+  // #684: resolve the SAME way the runner does. A project-local config wins; a
+  // machine-level one under XDG_CONFIG_HOME (or ~/.config) is the documented
+  // fallback, and a review keeps working on it. Checking only `cwd` reported
+  // FAIL on the layout SKILL.md recommends and told the user to copy the example
+  // into the project — manufacturing the drifted duplicate #541 warns about.
+  //
+  // An explicit `configPath` is an ANSWER, not a hint: a caller that names a
+  // file means that file, so it disables the fallback. Otherwise a test (or a
+  // caller) pinning an absent path silently reads the developer's real global
+  // config and reports PASS — the same vacuous-pass shape this batch is fixing.
+  const projectCfgPath = configPath
+    || path.join(options.projectDir || process.cwd(), '.delphi-config.json');
+  const usingGlobalConfig = !configPath
+    && !fs.existsSync(projectCfgPath)
+    && fs.existsSync(globalConfigPath);
+  const cfgPath = usingGlobalConfig ? globalConfigPath : projectCfgPath;
+  const cfgLabel = 'Delphi config (.delphi-config.json)';
   if (!fs.existsSync(cfgPath)) {
-    add('Delphi config (.delphi-config.json)', 'FAIL',
+    add(cfgLabel, 'FAIL',
       `${cfgPath} not found (copy .delphi-config.json.example from the skill directory)`);
   } else {
     try {
@@ -3404,7 +3421,7 @@ async function doctorDelphi(options = {}) {
       const profileName = raw.active_profile || 'default';
       const profile = raw.profiles && raw.profiles[profileName];
       if (!profile) {
-        add('Delphi config (.delphi-config.json)', 'FAIL', `profile "${profileName}" not found`);
+        add(cfgLabel, 'FAIL', `profile "${profileName}" not found`);
       } else {
         const experts = profile.experts || {};
         const models = roles.map((r) => experts[r] && experts[r].model);
@@ -3422,10 +3439,14 @@ async function doctorDelphi(options = {}) {
           if (missingRoles.length > 0) problems.push(`missing experts: ${missingRoles.join(', ')}`);
           if (duplicates.length > 0) problems.push(`duplicate models: ${[...new Set(duplicates)].join(', ')}`);
           if (badProviders.length > 0) problems.push(`unusable provider binding: ${badProviders.join(', ')}`);
-          add('Delphi config (.delphi-config.json)', 'FAIL', problems.join('; '));
+          add(cfgLabel, 'FAIL', problems.join('; '));
         } else {
-          add('Delphi config (.delphi-config.json)', 'PASS',
-            `profile "${profileName}": ${models.join(' / ')}`);
+          // Always name the file that was actually read. Without it a user with
+          // both scopes present cannot tell which one the review will use — the
+          // exact ambiguity that made #684 hard to see.
+          const scopeNote = usingGlobalConfig ? ` [global: ${cfgPath}]` : ` [project: ${cfgPath}]`;
+          add(cfgLabel, 'PASS',
+            `profile "${profileName}": ${models.join(' / ')}${scopeNote}`);
           // #574: non-local seats are reported, not blocked. The local-only rule
           // is an operator preference (the 2026-10-03 quota burn), so doctor
           // surfaces the cost exposure without failing a deliberately hosted
@@ -3483,7 +3504,7 @@ async function doctorDelphi(options = {}) {
         }
       }
     } catch (err) {
-      add('Delphi config (.delphi-config.json)', 'FAIL', `unparseable: ${err.message}`);
+      add(cfgLabel, 'FAIL', `unparseable: ${err.message}`);
     }
   }
 

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-31T16:53:19.066Z",
+  "checked_at": "2026-11-02T02:08:42.160Z",
   "source": "network"
 }