@boyingliu01/xp-gate 0.35.21 → 0.35.23

package/lib/runtime-journal.js

@@ -0,0 +1,156 @@
+/**
+ * `xp-gate runtime-journal` — CLI for the AGENTS.md runtime-efficiency rules.
+ *
+ * Implements the same "measure don't restate" stance as `gate-rules`: the three
+ * rules in AGENTS.md §AGENT RUNTIME DISCIPLINE were written on 2026-10-30, but
+ * by 2026-11-02 only rule 1 had taken effect (pure-read shell: 32.7% -> 0.2%)
+ * while rule 2 stayed at 1.02 calls/step and rule 3 was violated 103 times with
+ * an explicit `wait: true`. A rule nobody measures is a rule nobody follows, so
+ * this surfaces the cost as numbers.
+ *
+ * Advisory by design — it reports share-of-time and never blocks a commit.
+ * The behaviour it measures (how the agent waits) is not something a git hook
+ * can decide.
+ *
+ * @module runtime-journal
+ */
+
+'use strict';
+
+const path = require('path');
+const os = require('os');
+
+const {
+  analyseSessions,
+  discoverSessionDirs,
+  summariseForSlot,
+} = require('./agent-runtime-journal');
+
+/** Default lookback for the report, in days. */
+const DEFAULT_DAYS = 3;
+
+/**
+ * Candidate roots that hold DSH session journals, most specific first.
+ *
+ * `DSH_SESSIONS_DIR` wins so a CI job or a different machine can point at the
+ * store without code changes.
+ *
+ * The DSH store names each project root `--<slug>--`, where the slug is the
+ * absolute cwd with every path separator replaced by a dash — e.g.
+ * `D:\projects\xp-gate` becomes `--D-projects-xp-gate--`. Deriving it from the
+ * full path matters: a basename-only guess (`--xp-gate--`) names a directory
+ * that does not exist.
+ *
+ * @param {string} [cwd] project directory; defaults to `process.cwd()`
+ * @returns {string[]}
+ */
+function sessionRootCandidates(cwd = process.cwd()) {
+  const home = os.homedir();
+  const dirs = [];
+  if (process.env.DSH_SESSIONS_DIR) dirs.push(process.env.DSH_SESSIONS_DIR);
+  const base = path.join(home, '.dsh', 'sessions');
+  // Each separator becomes one dash, then the store wraps the slug in an extra
+  // dash on both sides: `D:\projects\xp-gate` -> `D-projects-xp-gate` ->
+  // `--D-projects-xp-gate--`. The wrapping pair is not redundant; without it
+  // the path names a directory that does not exist.
+  const slug = String(cwd).replace(/[\\/:]+/g, '-');
+  if (slug) dirs.push(path.join(base, `--${slug}--`));
+  dirs.push(base);
+  return dirs;
+}
+
+/**
+ * Find the session root that actually exists and contains journals.
+ * @param {string[]} candidates
+ * @returns {string|null}
+ */
+function pickSessionRoot(candidates) {
+  for (const candidate of candidates) {
+    if (discoverSessionDirs(candidate).length > 0) return candidate;
+  }
+  return null;
+}
+
+/**
+ * Parse `--days N` from argv.
+ * @param {string[]} argv
+ * @param {number} fallback
+ * @returns {number}
+ */
+function parseDays(argv, fallback) {
+  const idx = argv.indexOf('--days');
+  if (idx === -1) return fallback;
+  const raw = argv[idx + 1];
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+
+/**
+ * Run the `runtime-journal` subcommand.
+ *
+ * Always exits 0: this is a diagnostic. Callers that want a gate can read the
+ * JSON and apply their own threshold, which keeps the measurement honest
+ * (a tool that fails on bad news gets suppressed, not fixed).
+ *
+ * @param {string[]} argv
+ * @returns {number} exit code (always 0)
+ */
+function handleRuntimeJournal(argv) {
+  const args = argv || [];
+  const json = args.includes('--json');
+  const days = parseDays(args, DEFAULT_DAYS);
+  const now = Date.now();
+  const sinceMs = now - days * 24 * 60 * 60 * 1000;
+
+  const explicitDir = (() => {
+    const idx = args.indexOf('--sessions-dir');
+    return idx === -1 ? null : args[idx + 1];
+  })();
+
+  const root = explicitDir
+    ? (discoverSessionDirs(explicitDir).length ? explicitDir : null)
+    : pickSessionRoot(sessionRootCandidates(process.cwd()));
+
+  if (!root) {
+    // NOT MEASURABLE rather than a zero report: a zero that means "no data"
+    // reads as "no problem", the false-green that #636 set out to remove.
+    if (json) {
+      process.stdout.write(`${JSON.stringify({ measurable: false, reason: 'no session journals found', days }, null, 2)}\n`);
+    } else {
+      process.stdout.write('Runtime efficiency: NOT MEASURABLE (no session journals found)\n');
+      process.stdout.write('Hint: set DSH_SESSIONS_DIR, or pass --sessions-dir <path>.\n');
+    }
+    return 0;
+  }
+
+  const report = analyseSessions(discoverSessionDirs(root), { sinceMs, untilMs: now });
+
+  if (json) {
+    const payload = {
+      measurable: report.toolCalls > 0,
+      days,
+      window: { from: new Date(sinceMs).toISOString(), to: new Date(now).toISOString() },
+      sessionsDir: root,
+      ...report,
+    };
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+    return 0;
+  }
+
+  process.stdout.write(`Runtime efficiency — last ${days} day(s)\n`);
+  process.stdout.write(`Sessions: ${root}\n`);
+  const slots = summariseForSlot(report);
+  for (const line of slots) process.stdout.write(`  ${line}\n`);
+  if (report.toolCalls > 0) {
+    process.stdout.write(`  measured ${report.toolCalls} tool call(s), median ${report.toolMedianMs} ms\n`);
+  }
+  return 0;
+}
+
+module.exports = {
+  DEFAULT_DAYS,
+  handleRuntimeJournal,
+  sessionRootCandidates,
+  pickSessionRoot,
+  parseDays,
+};

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.21",
+  "version": "0.35.23",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.21",
+  "version": "0.35.23",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.21",
+  "version": "0.35.23",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.21",
+  "version": "0.35.23",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.21",
+  "version": "0.35.23",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/scripts/delphi-external-review.cjs

@@ -199,6 +199,28 @@ function readConfig(configPath, profileOverride) {
         process.exit(1);
       }
     }
+
+    // (#707) base_url supports ${VAR} for the same reason api_key does: writing a
+    // gateway address as a placeholder is the natural way to keep an internal
+    // endpoint out of version control. Without expansion the placeholder is a
+    // perfectly valid non-empty string, so validation passed and the literal text
+    // `${PG_GATEWAY}/v1/chat/completions` went out as a URL — failing at the
+    // NETWORK layer with a DNS/connection error while the config looked correct.
+    // A caller (whale-sql-audit) had to hardcode its gateway into a distributed
+    // repo because of this.
+    //
+    // Failing here, at config load, names the variable; falling back to the
+    // literal is exactly what caused the original misdiagnosis, so it does not.
+    if (typeof prov.base_url === 'string'
+        && prov.base_url.startsWith('${') && prov.base_url.endsWith('}')) {
+      const envName = prov.base_url.slice(2, -1);
+      const envVal = process.env[envName];
+      if (!envVal) {
+        console.error(`[delphi-review] ERROR: Environment variable ${envName} is not set (profiles.${profileName}.providers.${name}.base_url). Export it or point that provider at a literal URL.`);
+        process.exit(1);
+      }
+      prov.base_url = envVal;
+    }
   }
 
   const experts = Object.fromEntries(Object.entries(profile.experts || {}).map(([role, expert]) => [
@@ -701,7 +723,52 @@ async function callModelAPI(providerConfig, model, systemPrompt, userPrompt, opt
     }
 
     if (response.status >= 500) {
-      return { error: true, retryable: true, message: `Server error (${response.status}).` };
+      // (#705) Read the provider's structured error body, the same way the 429
+      // branch above does, instead of discarding it.
+      //
+      // Measured on the whalecloud gateway: a prompt containing
+      // `new ProcessBuilder(args).start()` makes the gateway fail in its
+      // response-processing stage and return 500 with
+      //   {"error":{"type":"response_processing_error",
+      //             "param":"non_stream_chat_response","code":"500"}}
+      // The old code threw that away and reported "Server error (500).", which
+      // reads as a transient outage. `type`/`param` are what tell an operator
+      // apart gateway flapping vs. upstream timeout vs. content-triggered
+      // processing failure — three problems with three different responses.
+      //
+      // Retryability is the other half: a content-dependent failure cannot clear
+      // by retrying (the content did not change), so marking it retryable burns
+      // the orchestrator's retry budget on a guaranteed repeat. Only an
+      // explicitly recognised response_processing_error is demoted; every other
+      // 5xx keeps the previous retryable=true, and an unparseable body keeps the
+      // previous behaviour entirely — reading the body must not change the
+      // verdict on its own.
+      let detail = '';
+      let processingError = false;
+      try {
+        const body = await response.json();
+        if (body && body.error && typeof body.error === 'object') {
+          const type = typeof body.error.type === 'string' ? body.error.type : '';
+          const param = typeof body.error.param === 'string' ? body.error.param : '';
+          if (type === 'response_processing_error') {
+            processingError = true;
+          }
+          const parts = [type, param].filter(Boolean);
+          if (parts.length > 0) {
+            detail = ` Provider reported: ${parts.join('/')}.`;
+          }
+        }
+      } catch {
+        // body is not JSON; keep the previous behaviour untouched
+      }
+      if (processingError) {
+        return {
+          error: true,
+          retryable: false,
+          message: `Server error (${response.status}).${detail} This is a content-dependent upstream processing failure, so retrying the same prompt will fail the same way.`,
+        };
+      }
+      return { error: true, retryable: true, message: `Server error (${response.status}).${detail}` };
     }
 
     if (!response.ok) {

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-11-02
-**Commit:** ae161a9c
+**Commit:** 8a968080
 **Branch:** main
-**Version:** 0.35.21.0
+**Version:** 0.35.23.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.