@boyingliu01/xp-gate 0.35.23 → 0.35.24

package/lib/__tests__/update-skill.test.js

@@ -145,51 +145,55 @@ describe('update-skill', () => {
     expect(installSkillMock).not.toHaveBeenCalled();
   });
 
+  // These编排 tests use names the bundle really carries: since #713 `--all`
+  // only claims skills xp-gate ships, so a placeholder like 'foo' is filtered
+  // out before it can exercise the loop. The orchestration behaviour under test
+  // (fan-out, error propagation, verbose passthrough) is orthogonal to ownership.
   it('all=true updates every installed skill (calls installSkill each), returns 0 on success', async () => {
     writeConfig({
-      foo: { version: '1.0.0' },
-      bar: { version: '1.0.0' },
+      'delphi-review': { version: '1.0.0' },
+      'grilling': { version: '1.0.0' },
     });
     const { updateSkill } = require('../update-skill');
     const result = await updateSkill(null, { all: true });
     expect(result).toBe(0);
     expect(installSkillMock).toHaveBeenCalledTimes(2);
-    expect(installSkillMock).toHaveBeenCalledWith('foo', {
+    expect(installSkillMock).toHaveBeenCalledWith('delphi-review', {
       force: true,
       verbose: false,
     });
-    expect(installSkillMock).toHaveBeenCalledWith('bar', {
+    expect(installSkillMock).toHaveBeenCalledWith('grilling', {
       force: true,
       verbose: false,
     });
-    expect(logSpy).toHaveBeenCalledWith('Updating foo...');
-    expect(logSpy).toHaveBeenCalledWith('Updating bar...');
-    expect(logSpy).toHaveBeenCalledWith('✓ foo updated');
-    expect(logSpy).toHaveBeenCalledWith('✓ bar updated');
+    expect(logSpy).toHaveBeenCalledWith('Updating delphi-review...');
+    expect(logSpy).toHaveBeenCalledWith('Updating grilling...');
+    expect(logSpy).toHaveBeenCalledWith('✓ delphi-review updated');
+    expect(logSpy).toHaveBeenCalledWith('✓ grilling updated');
   });
 
   it('all=true returns 1 when at least one installSkill rejects', async () => {
     writeConfig({
-      good: { version: '1.0.0' },
-      bad: { version: '1.0.0' },
+      'delphi-review': { version: '1.0.0' },
+      'grilling': { version: '1.0.0' },
     });
     installSkillMock.mockImplementation(async (name) => {
-      if (name === 'bad') throw new Error('boom');
+      if (name === 'grilling') throw new Error('boom');
       return 0;
     });
     const { updateSkill } = require('../update-skill');
     const result = await updateSkill(null, { all: true });
     expect(result).toBe(1);
-    expect(errorSpy).toHaveBeenCalledWith('Failed to update bad: boom');
-    expect(logSpy).toHaveBeenCalledWith('✓ good updated');
+    expect(errorSpy).toHaveBeenCalledWith('Failed to update grilling: boom');
+    expect(logSpy).toHaveBeenCalledWith('✓ delphi-review updated');
   });
 
   it('all=true propagates verbose flag into installSkill options', async () => {
-    writeConfig({ foo: { version: '1.0.0' } });
+    writeConfig({ 'delphi-review': { version: '1.0.0' } });
     const { updateSkill } = require('../update-skill');
     const result = await updateSkill(null, { all: true, verbose: true });
     expect(result).toBe(0);
-    expect(installSkillMock).toHaveBeenCalledWith('foo', {
+    expect(installSkillMock).toHaveBeenCalledWith('delphi-review', {
       force: true,
       verbose: true,
     });
@@ -289,79 +293,199 @@ describe('update-skill', () => {
   });
 });
 
-// ── #682: `--all` must enumerate what is on disk, not the config registry ────
-// `xp-gate init` / `setup-global` deploy skills to disk but never write
-// `config.installedSkills`, so `--all` iterated an always-empty object: it
-// printed "Updating all skills..." and exited 0 having touched nothing. doctor
-// solved the identical problem in #635 by enumerating the filesystem; this
-// block pins the same contract for update-skill, plus the honesty requirement
-// that a run which updates nothing must not look like a successful one.
-describe('update-skill #682 filesystem enumeration', () => {
-  let tmpHome;
-  let originalHome;
-  let installSkillMock;
-  let logSpy;
-  let errorSpy;
+/**
+ * Shared fixture for the `--all` blocks below.
+ *
+ * Both blocks need the same three things before a test runs: a throwaway HOME,
+ * `install-skill` stubbed in the require cache (update-skill lazy-requires it),
+ * and console silenced. Three copies of that boilerplate tripped the clone
+ * detector -- and it had to stay byte-identical across copies to work, which is
+ * exactly the kind of duplication that rots quietly. Returns the handles each
+ * block asserts on.
+ */
+function makeAllModeFixture(prefix) {
+  const handle = { tmpHome: null, installSkillMock: null, logSpy: null, errorSpy: null, originalHome: null };
 
-  beforeEach(() => {
-    originalHome = process.env.HOME;
-    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-up682-'));
-    process.env.HOME = tmpHome;
+  handle.beforeEach = () => {
+    handle.originalHome = process.env.HOME;
+    handle.tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    process.env.HOME = handle.tmpHome;
     vi.resetModules();
     delete require.cache[require.resolve('../update-skill')];
     delete require.cache[require.resolve('../install-skill.js')];
-    installSkillMock = vi.fn().mockResolvedValue(0);
+    handle.installSkillMock = vi.fn().mockResolvedValue(0);
     const p = require.resolve('../install-skill.js');
-    require.cache[p] = { id: p, filename: p, loaded: true, exports: { installSkill: installSkillMock } };
-    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-  });
+    require.cache[p] = {
+      id: p,
+      filename: p,
+      loaded: true,
+      exports: { installSkill: handle.installSkillMock },
+    };
+    handle.logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    handle.errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  };
 
-  afterEach(() => {
-    process.env.HOME = originalHome;
-    fs.rmSync(tmpHome, { recursive: true, force: true });
+  handle.afterEach = () => {
+    process.env.HOME = handle.originalHome;
+    fs.rmSync(handle.tmpHome, { recursive: true, force: true });
     delete require.cache[require.resolve('../install-skill.js')];
     delete require.cache[require.resolve('../update-skill')];
     vi.restoreAllMocks();
-  });
-
-  function deploySkill(platform, name) {
-    const dir = path.join(tmpHome, '.config', platform, 'skills', name);
+  };
+
+  /**
+   * Everything the run printed, log and error channels merged.
+   *
+   * Both channels matter: the same "nothing to update" message may be a log or
+   * a warning depending on the code path, and asserting on one alone silently
+   * passes when the message moves. Flattening to one string also keeps the
+   * assertions readable instead of re-deriving it in every test.
+   */
+  handle.output = () =>
+    [...handle.logSpy.mock.calls, ...handle.errorSpy.mock.calls].map((c) => c.join(' ')).join('\n');
+
+  /** Deployment helper: writes `<HOME>/.config/<platform>/skills/<name>/SKILL.md`. */
+  handle.deploySkill = (platform, name, body) => {
+    const dir = path.join(handle.tmpHome, '.config', platform, 'skills', name);
     fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, 'SKILL.md'), 'old content');
+    fs.writeFileSync(path.join(dir, 'SKILL.md'), body);
     return dir;
+  };
+
+  return handle;
+}
+
+// ── #682: `--all` must enumerate what is on disk, not the config registry ────
+// `xp-gate init` / `setup-global` deploy skills to disk but never write
+// `config.installedSkills`, so `--all` iterated an always-empty object: it
+// printed "Updating all skills..." and exited 0 having touched nothing. doctor
+// solved the identical problem in #635 by enumerating the filesystem; this
+// block pins the same contract for update-skill, plus the honesty requirement
+// that a run which updates nothing must not look like a successful one.
+describe('update-skill #682 filesystem enumeration', () => {
+  const fx = makeAllModeFixture('xpgate-up682-');
+
+  beforeEach(fx.beforeEach);
+  afterEach(fx.afterEach);
+
+  function deploySkill(platform, name) {
+    return fx.deploySkill(platform, name, 'old content');
   }
 
-  it('AC-682-01: --all updates skills found on disk even when config.installedSkills is absent', async () => {
+  it('AC-719-01: --all updates skills found on disk even when config.installedSkills is absent', async () => {
     deploySkill('opencode', 'sprint-flow');
     deploySkill('opencode', 'delphi-review');
     const { updateSkill } = require('../update-skill');
     const code = await updateSkill(null, { all: true });
     expect(code).toBe(0);
-    const names = installSkillMock.mock.calls.map((c) => c[0]);
+    const names = fx.installSkillMock.mock.calls.map((c) => c[0]);
     expect(names).toContain('sprint-flow');
     expect(names).toContain('delphi-review');
   });
 
-  it('AC-682-02: --all does not update the same skill twice for the same platform', async () => {
+  it('AC-719-02: --all does not update the same skill twice for the same platform', async () => {
     deploySkill('opencode', 'sprint-flow');
-    fs.mkdirSync(path.join(tmpHome, '.config', 'xp-gate'), { recursive: true });
+    fs.mkdirSync(path.join(fx.tmpHome, '.config', 'xp-gate'), { recursive: true });
     fs.writeFileSync(
-      path.join(tmpHome, '.config', 'xp-gate', 'xp-gate.json'),
+      path.join(fx.tmpHome, '.config', 'xp-gate', 'xp-gate.json'),
       JSON.stringify({ installedSkills: { 'sprint-flow': { version: '1.0.0' } } })
     );
     const { updateSkill } = require('../update-skill');
     await updateSkill(null, { all: true });
-    const sprintCalls = installSkillMock.mock.calls.filter((c) => c[0] === 'sprint-flow');
+    const sprintCalls = fx.installSkillMock.mock.calls.filter((c) => c[0] === 'sprint-flow');
     expect(sprintCalls.length).toBe(1);
   });
 
-  it('AC-682-03: --all with nothing installed says so instead of silently succeeding', async () => {
+  it('AC-719-03: --all with nothing installed says so instead of silently succeeding', async () => {
     const { updateSkill } = require('../update-skill');
     const code = await updateSkill(null, { all: true });
-    const said = [...logSpy.mock.calls, ...errorSpy.mock.calls].map((c) => c.join(' ')).join('\n');
-    expect(said).toMatch(/nothing to update|no skills installed|not installed/i);
-    expect(installSkillMock).not.toHaveBeenCalled();
+    expect(fx.output()).toMatch(/nothing to update|no skills installed|not installed/i);
+    expect(fx.installSkillMock).not.toHaveBeenCalled();
+    expect(code).toBe(0);
+  });
+});
+
+// ── #713: `--all` must only claim skills this package actually ships ─────────
+// #682 fixed the "enumerate nothing" side of this by scanning the filesystem,
+// but scoped the scan too widely: any `<skillsDir>/<name>/SKILL.md` was treated
+// as ours. Skill directories are a shared namespace -- every skill tool uses the
+// same layout -- so on a machine that also has other skill bundles, `--all`
+// walked all of them, printed `Error: Unknown skill: <name>` for each, and told
+// the user to `npm install -g xp-gate@latest` to obtain a skill xp-gate does not
+// and will never carry. The fix is intersection, not union: scanned names are
+// filtered against the bundled set before they become candidates.
+describe('update-skill #713 bundled-skill ownership', () => {
+  const fx = makeAllModeFixture('xpgate-up713-');
+
+  beforeEach(fx.beforeEach);
+  afterEach(fx.afterEach);
+
+  function bundledNames() {
+    // Read the real bundle so the test cannot drift from the package contents.
+    const dir = path.join(__dirname, '..', '..', 'skills');
+    return fs
+      .readdirSync(dir, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && fs.existsSync(path.join(dir, e.name, 'SKILL.md')))
+      .map((e) => e.name);
+  }
+
+  function deploySkill(platform, name) {
+    return fx.deploySkill(platform, name, 'content');
+  }
+
+  /**
+   * @test REQ-713 Skill ownership scoping
+   * @intent A skill directory xp-gate does not ship must never become an --all candidate
+   * @covers AC-713-01
+   */
+  it('AC-713-01: --all ignores skills present on disk but not in the package bundle', async () => {
+    const [ours] = bundledNames();
+    deploySkill('opencode', ours);
+    deploySkill('opencode', 'clipboard-vision');
+    deploySkill('opencode', 'code-search');
+
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+
+    expect(code).toBe(0);
+    const attempted = fx.installSkillMock.mock.calls.map((c) => c[0]);
+    expect(attempted).toContain(ours);
+    expect(attempted).not.toContain('clipboard-vision');
+    expect(attempted).not.toContain('code-search');
+  });
+
+  /**
+   * @test REQ-713 Skill ownership scoping
+   * @intent Foreign skills must not produce the misleading "update the package" advice
+   * @covers AC-713-02
+   */
+  it('AC-713-02: --all prints no Unknown-skill errors for foreign skill directories', async () => {
+    const [ours] = bundledNames();
+    deploySkill('opencode', ours);
+    deploySkill('opencode', 'pdf');
+    deploySkill('opencode', 'docx');
+
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { all: true });
+
+    const said = fx.errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
+    expect(said).not.toMatch(/Unknown skill/);
+  });
+
+  /**
+   * @test REQ-713 Skill ownership scoping
+   * @intent A machine holding only foreign skills must report nothing to update
+   * @covers AC-713-03
+   */
+  it('AC-713-03: --all with only foreign skills reports nothing to update', async () => {
+    deploySkill('opencode', 'clipboard-vision');
+    deploySkill('opencode', 'xlsx');
+
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+
+    expect(fx.output()).toMatch(/nothing to update|no skills installed/i);
+    expect(fx.installSkillMock).not.toHaveBeenCalled();
     expect(code).toBe(0);
   });
 });

package/lib/install-skill.js

@@ -19,12 +19,27 @@ function getSkillsDir() {
 // The npm package ships the canonical skill content; `files` includes skills/.
 const BUNDLED_SKILLS_DIR = path.join(__dirname, '..', 'skills');
 
+/**
+ * The version of the CLI that is actually running.
+ *
+ * This used to read `../../../VERSION` relative to __dirname. Two things were
+ * wrong with that (#713): three levels up from `node_modules/@boyingliu01/
+ * xp-gate/lib` is `node_modules/`, and the package does not ship VERSION at all
+ * (`files` omits it). The catch therefore returned `0.0.0` on every installed
+ * machine, so `xp-gate 0.0.0 bundles: ...` -- printed as help when an unknown
+ * skill is requested -- read as a corrupt installation rather than as a typo.
+ *
+ * package.json travels with the package by definition, so it is the only source
+ * that is always present and always current.
+ *
+ * @returns {string} the package version, or 'unknown' if it cannot be read
+ */
 function getCliVersion() {
   try {
-    const versionFile = path.join(__dirname, '..', '..', '..', 'VERSION');
-    return fs.readFileSync(versionFile, 'utf8').trim();
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
+    return typeof pkg.version === 'string' && pkg.version ? pkg.version : 'unknown';
   } catch {
-    return '0.0.0';
+    return 'unknown';
   }
 }
 

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-11-02T15:52:57.140Z",
+  "checked_at": "2026-11-03T07:08:33.951Z",
   "source": "network"
 }

package/lib/uninstall.js

@@ -27,15 +27,24 @@ function globalSkillRoots() {
 }
 
 /**
- * Directories inside ~/.config/xp-gate/ that `setup-global` creates and that
- * `uninstall` used to leave behind (#663).
+ * Directories and files inside ~/.config/xp-gate/ that `setup-global` creates
+ * and that `uninstall` used to leave behind (#663).
+ *
+ * `ownedByPath: true` marks entries the installer writes at a FIXED path under
+ * our own config directory -- there is no other way they got there, so a content
+ * signature is the wrong test for them (#714). It matters most for
+ * `package.json`: its body is nothing but dependency pins (`js-yaml`, `zod`), so
+ * no signature string can ever match it, and demanding one meant the file was
+ * scheduled for deletion and then skipped at delete time. `xp-gate.json` is
+ * equally ours -- the uninstaller itself writes `mode: "uninstalled"` into it
+ * moments earlier -- and was likewise reported as foreign.
  */
 const GLOBAL_INSTALL_RESIDUE = [
-  { key: 'modules', label: 'modules/' },
-  { key: 'node_modules', label: 'node_modules/' },
-  { key: 'package.json', label: 'package.json' },
-  { key: 'package-lock.json', label: 'package-lock.json' },
-  { key: 'xp-gate.json', label: 'xp-gate.json' },
+  { key: 'modules', label: 'modules/', ownedByPath: true },
+  { key: 'node_modules', label: 'node_modules/', ownedByPath: true },
+  { key: 'package.json', label: 'package.json', ownedByPath: true },
+  { key: 'package-lock.json', label: 'package-lock.json', ownedByPath: true },
+  { key: 'xp-gate.json', label: 'xp-gate.json', ownedByPath: true },
 ];
 
 /** User DATA that must survive an uninstall, and must be reported as retained. */
@@ -325,7 +334,12 @@ function buildPlan(mode) {
           type: isDir ? 'dir' : 'file',
           path: target,
           label: `~/.config/xp-gate/${item.label}`,
-          critical: false
+          critical: false,
+          // #714: a fixed-path file we install ourselves needs no content
+          // signature. Carrying the flag through the plan is what makes the
+          // delete actually happen instead of stopping at "does not contain
+          // xp-gate signature".
+          ownedByPath: item.ownedByPath === true
         });
       }
     }
@@ -365,6 +379,20 @@ function buildPlan(mode) {
  * @returns {boolean} true on success, false on skip (not xp-gate owned)
  */
 function removeFile(item, config) {
+  // #714: `ownedByPath` entries are files the installer writes at a fixed path
+  // inside our own ~/.config/xp-gate/ directory, so ownership is established by
+  // the path itself. Without this branch the residue files fell through to
+  // verifyFileOwnership() with neither a manifest entry nor a signature, and
+  // isXpGateFile() evaluated `content.includes(undefined)` -- always false. The
+  // file was listed in the plan, "uninstall complete" was printed, and the file
+  // stayed.
+  if (item.ownedByPath === true) {
+    if (!fs.existsSync(item.path)) return false;
+    fs.unlinkSync(item.path);
+    console.log(`  Removed ${item.label}`);
+    return true;
+  }
+
   const manifestEntry = config.manifest && config.manifest.files
     ? config.manifest.files[item.manifestKey]
     : null;
@@ -740,8 +768,17 @@ function planHooksDirRemoval(hooksDir) {
     : { action: 'remove-all', foreign: [], owned };
 }
 
-/** Hook entry points xp-gate installs. */
-const OWNED_HOOK_NAMES = ['pre-commit', 'pre-push', 'post-merge'];
+/**
+ * Hook entry points xp-gate installs.
+ *
+ * This must stay in sync with `copyHooks()`'s `hookFiles` list, which is what
+ * actually puts them on disk. `post-commit` was missing here (#714), so the
+ * uninstaller classified its own hook as a third party's and kept it -- the
+ * file contains nine `xp-gate` references and is installed unconditionally by
+ * setup-global. The set is derived from the installer's list rather than
+ * retyped, so the two cannot drift apart again.
+ */
+const OWNED_HOOK_NAMES = ['pre-commit', 'pre-push', 'post-merge', 'post-commit'];
 
 /** 'git-lfs' when the file proves it, else null. Content-based: see doctor.js. */
 function foreignHookSource(filePath) {

package/lib/update-skill.js

@@ -7,6 +7,32 @@ const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir();
 
 const CONFIG_DIR = path.join(HOME, '.config', 'xp-gate');
 
+/**
+ * The skill names this package ships.
+ *
+ * `skills/` is the bundle contract: a skill the installed package does not carry
+ * is not ours to touch. Resolved lazily so a caller that stubs out the package
+ * layout still gets a sensible empty set instead of a throw at require() time.
+ *
+ * @returns {Set<string>} bundled skill directory names
+ */
+function bundledSkillNames() {
+  const dir = path.join(__dirname, '..', 'skills');
+  try {
+    return new Set(
+      fs
+        .readdirSync(dir, { withFileTypes: true })
+        .filter(
+          (entry) =>
+            entry.isDirectory() && fs.existsSync(path.join(dir, entry.name, 'SKILL.md'))
+        )
+        .map((entry) => entry.name)
+    );
+  } catch {
+    return new Set();
+  }
+}
+
 /**
  * The skill names that are actually deployed on this machine.
  *
@@ -16,46 +42,90 @@ const CONFIG_DIR = path.join(HOME, '.config', 'xp-gate');
  * "Updating all skills..." and exit 0 having touched nothing (#682) -- the
  * same defect #635 fixed for `doctor`, with the same fix: ask the filesystem.
  *
+ * Enumerating the filesystem alone is too wide, though (#713). A skill
+ * directory is a shared namespace -- every skill tool uses the same
+ * `<dir>/<name>/SKILL.md` layout -- so on a machine that also carries other
+ * bundles, `--all` walked all of them, printed `Error: Unknown skill: <name>`
+ * for each, and advised `npm install -g xp-gate@latest` to obtain a skill this
+ * package does not and will never ship. Scanned names are therefore filtered
+ * against the bundle: the candidate set is the intersection, not the union.
+ *
  * The explicit registry is still unioned in, so a skill that is merely
  * registered (or was installed on a platform this scan cannot see) keeps
- * working for callers that rely on it.
+ * working for callers that rely on it -- but only when the package really
+ * carries it, for the same reason as above.
  *
  * @returns {string[]} de-duplicated skill names, in a stable order
  */
 function installedSkillNames() {
+  const bundled = bundledSkillNames();
   const names = new Set();
-  const config = getConfig();
-  for (const name of Object.keys(config.installedSkills || {})) names.add(name);
 
-  let platforms = [];
+  // Registry first: a skill can be registered on a platform this scan cannot see.
+  for (const name of Object.keys(getConfig().installedSkills || {})) {
+    if (bundled.has(name)) names.add(name);
+  }
+
+  for (const name of bundledNamesOnDisk(bundled)) names.add(name);
+  return [...names].sort();
+}
+
+/**
+ * Bundled skill names that are actually deployed on this machine.
+ *
+ * Split out of installedSkillNames() because the per-platform probing is three
+ * nested try/catch levels deep on its own: reading a directory that may not
+ * exist, on a platform whose detection may itself throw. Flattening it into a
+ * named loop keeps each failure mode visible instead of piling onto one
+ * function's complexity budget.
+ *
+ * Every unreadable location is skipped silently -- an absent platform is the
+ * normal case on any given machine, not an error worth reporting mid-update.
+ *
+ * @param {Set<string>} bundled names the package ships; anything else is not ours
+ * @returns {string[]} deployed-and-bundled skill names
+ */
+function bundledNamesOnDisk(bundled) {
+  const found = [];
+  let detect;
+  let platforms;
   try {
-    platforms = Object.keys(require('./detect-deps.js').PLATFORM_PROFILES);
+    detect = require('./detect-deps.js');
+    platforms = Object.keys(detect.PLATFORM_PROFILES);
   } catch {
-    // detect-deps unavailable: fall back to the registry only rather than
-    // reporting "nothing installed" for a machine that has skills on disk.
-    platforms = [];
+    // detect-deps unavailable: the registry half of installedSkillNames() still
+    // applies, so returning nothing here does not report "no skills installed".
+    return found;
   }
-  const detect = require('./detect-deps.js');
+
   for (const platform of platforms) {
-    let dir;
-    try {
-      dir = detect.getSkillsDirs(platform)[0];
-    } catch {
-      continue;
-    }
-    let entries;
-    try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      // A skill is `<dir>/<name>/SKILL.md` — the shape install-skill writes.
-      if (fs.existsSync(path.join(dir, entry.name, 'SKILL.md'))) names.add(entry.name);
+    for (const entry of readSkillsDirEntries(detect, platform)) {
+      if (!entry.isDirectory || !bundled.has(entry.name)) continue;
+      if (fs.existsSync(path.join(entry.dir, entry.name, 'SKILL.md'))) found.push(entry.name);
     }
   }
-  return [...names].sort();
+  return found;
+}
+
+/**
+ * Read one platform's skills directory as plain records, so callers get the
+ * directory back without depending on dirent internals.
+ * @returns {Array<{name: string, isDirectory: boolean, dir: string}>} empty when unreadable
+ */
+function readSkillsDirEntries(detect, platform) {
+  let dir;
+  try {
+    dir = detect.getSkillsDirs(platform)[0];
+  } catch {
+    return [];
+  }
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.map((entry) => ({ name: entry.name, isDirectory: entry.isDirectory(), dir }));
 }
 
 function handleCheckMode() {

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-11-02
-**Commit:** 8a968080
+**Generated:** 2026-11-03
+**Commit:** fa007d1f
 **Branch:** main
-**Version:** 0.35.23.0
+**Version:** 0.35.24.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-11-02
-**Commit:** 8a968080
+**Generated:** 2026-11-03
+**Commit:** fa007d1f
 **Branch:** main
-**Version:** 0.35.23.0
+**Version:** 0.35.24.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.23",
+  "version": "0.35.24",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.23",
+  "version": "0.35.24",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-11-02
-**Commit:** 8a968080
+**Generated:** 2026-11-03
+**Commit:** fa007d1f
 **Branch:** main
-**Version:** 0.35.23.0
+**Version:** 0.35.24.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.