@boyingliu01/xp-gate 0.35.23 → 0.36.0

package/lib/__tests__/update-skill.test.js

@@ -114,8 +114,14 @@ describe('update-skill', () => {
     const result = await updateSkill(null, { check: true });
     expect(result).toBe(0);
     expect(logSpy).toHaveBeenCalledWith('Checking for updates...');
-    expect(logSpy).toHaveBeenCalledWith('  foo: 1.2.3');
-    expect(logSpy).toHaveBeenCalledWith('  bar: 2.0.0');
+
+    // #725: the check reads the DISK now, not the registry. These skills have no
+    // copy anywhere on this fixture HOME, so the honest answer is "registry only"
+    // -- printing the recorded version as though it were verified is what let a
+    // stale multi-platform copy look up to date.
+    const lines = logSpy.mock.calls.map((c) => c[0]);
+    expect(lines.some((l) => /foo: 1\.2\.3 \(registry only/.test(l))).toBe(true);
+    expect(lines.some((l) => /bar: 2\.0\.0 \(registry only/.test(l))).toBe(true);
     expect(logSpy).toHaveBeenCalledWith('Update check complete');
   });
 
@@ -124,7 +130,8 @@ describe('update-skill', () => {
     const { updateSkill } = require('../update-skill');
     const result = await updateSkill(null, { check: true });
     expect(result).toBe(0);
-    expect(logSpy).toHaveBeenCalledWith('  baz: unknown');
+    const lines = logSpy.mock.calls.map((c) => c[0]);
+    expect(lines.some((l) => /baz: unknown/.test(l))).toBe(true);
   });
 
   it('check=true with empty config returns 0 and prints only headers', async () => {
@@ -145,51 +152,55 @@ describe('update-skill', () => {
     expect(installSkillMock).not.toHaveBeenCalled();
   });
 
+  // These编排 tests use names the bundle really carries: since #713 `--all`
+  // only claims skills xp-gate ships, so a placeholder like 'foo' is filtered
+  // out before it can exercise the loop. The orchestration behaviour under test
+  // (fan-out, error propagation, verbose passthrough) is orthogonal to ownership.
   it('all=true updates every installed skill (calls installSkill each), returns 0 on success', async () => {
     writeConfig({
-      foo: { version: '1.0.0' },
-      bar: { version: '1.0.0' },
+      'delphi-review': { version: '1.0.0' },
+      'grilling': { version: '1.0.0' },
     });
     const { updateSkill } = require('../update-skill');
     const result = await updateSkill(null, { all: true });
     expect(result).toBe(0);
     expect(installSkillMock).toHaveBeenCalledTimes(2);
-    expect(installSkillMock).toHaveBeenCalledWith('foo', {
+    expect(installSkillMock).toHaveBeenCalledWith('delphi-review', {
       force: true,
       verbose: false,
     });
-    expect(installSkillMock).toHaveBeenCalledWith('bar', {
+    expect(installSkillMock).toHaveBeenCalledWith('grilling', {
       force: true,
       verbose: false,
     });
-    expect(logSpy).toHaveBeenCalledWith('Updating foo...');
-    expect(logSpy).toHaveBeenCalledWith('Updating bar...');
-    expect(logSpy).toHaveBeenCalledWith('✓ foo updated');
-    expect(logSpy).toHaveBeenCalledWith('✓ bar updated');
+    expect(logSpy).toHaveBeenCalledWith('Updating delphi-review...');
+    expect(logSpy).toHaveBeenCalledWith('Updating grilling...');
+    expect(logSpy).toHaveBeenCalledWith('✓ delphi-review updated');
+    expect(logSpy).toHaveBeenCalledWith('✓ grilling updated');
   });
 
   it('all=true returns 1 when at least one installSkill rejects', async () => {
     writeConfig({
-      good: { version: '1.0.0' },
-      bad: { version: '1.0.0' },
+      'delphi-review': { version: '1.0.0' },
+      'grilling': { version: '1.0.0' },
     });
     installSkillMock.mockImplementation(async (name) => {
-      if (name === 'bad') throw new Error('boom');
+      if (name === 'grilling') throw new Error('boom');
       return 0;
     });
     const { updateSkill } = require('../update-skill');
     const result = await updateSkill(null, { all: true });
     expect(result).toBe(1);
-    expect(errorSpy).toHaveBeenCalledWith('Failed to update bad: boom');
-    expect(logSpy).toHaveBeenCalledWith('✓ good updated');
+    expect(errorSpy).toHaveBeenCalledWith('Failed to update grilling: boom');
+    expect(logSpy).toHaveBeenCalledWith('✓ delphi-review updated');
   });
 
   it('all=true propagates verbose flag into installSkill options', async () => {
-    writeConfig({ foo: { version: '1.0.0' } });
+    writeConfig({ 'delphi-review': { version: '1.0.0' } });
     const { updateSkill } = require('../update-skill');
     const result = await updateSkill(null, { all: true, verbose: true });
     expect(result).toBe(0);
-    expect(installSkillMock).toHaveBeenCalledWith('foo', {
+    expect(installSkillMock).toHaveBeenCalledWith('delphi-review', {
       force: true,
       verbose: true,
     });
@@ -289,6 +300,68 @@ describe('update-skill', () => {
   });
 });
 
+/**
+ * Shared fixture for the `--all` blocks below.
+ *
+ * Both blocks need the same three things before a test runs: a throwaway HOME,
+ * `install-skill` stubbed in the require cache (update-skill lazy-requires it),
+ * and console silenced. Three copies of that boilerplate tripped the clone
+ * detector -- and it had to stay byte-identical across copies to work, which is
+ * exactly the kind of duplication that rots quietly. Returns the handles each
+ * block asserts on.
+ */
+function makeAllModeFixture(prefix) {
+  const handle = { tmpHome: null, installSkillMock: null, logSpy: null, errorSpy: null, originalHome: null };
+
+  handle.beforeEach = () => {
+    handle.originalHome = process.env.HOME;
+    handle.tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    process.env.HOME = handle.tmpHome;
+    vi.resetModules();
+    delete require.cache[require.resolve('../update-skill')];
+    delete require.cache[require.resolve('../install-skill.js')];
+    handle.installSkillMock = vi.fn().mockResolvedValue(0);
+    const p = require.resolve('../install-skill.js');
+    require.cache[p] = {
+      id: p,
+      filename: p,
+      loaded: true,
+      exports: { installSkill: handle.installSkillMock },
+    };
+    handle.logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    handle.errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  };
+
+  handle.afterEach = () => {
+    process.env.HOME = handle.originalHome;
+    fs.rmSync(handle.tmpHome, { recursive: true, force: true });
+    delete require.cache[require.resolve('../install-skill.js')];
+    delete require.cache[require.resolve('../update-skill')];
+    vi.restoreAllMocks();
+  };
+
+  /**
+   * Everything the run printed, log and error channels merged.
+   *
+   * Both channels matter: the same "nothing to update" message may be a log or
+   * a warning depending on the code path, and asserting on one alone silently
+   * passes when the message moves. Flattening to one string also keeps the
+   * assertions readable instead of re-deriving it in every test.
+   */
+  handle.output = () =>
+    [...handle.logSpy.mock.calls, ...handle.errorSpy.mock.calls].map((c) => c.join(' ')).join('\n');
+
+  /** Deployment helper: writes `<HOME>/.config/<platform>/skills/<name>/SKILL.md`. */
+  handle.deploySkill = (platform, name, body) => {
+    const dir = path.join(handle.tmpHome, '.config', platform, 'skills', name);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'SKILL.md'), body);
+    return dir;
+  };
+
+  return handle;
+}
+
 // ── #682: `--all` must enumerate what is on disk, not the config registry ────
 // `xp-gate init` / `setup-global` deploy skills to disk but never write
 // `config.installedSkills`, so `--all` iterated an always-empty object: it
@@ -297,71 +370,275 @@ describe('update-skill', () => {
 // block pins the same contract for update-skill, plus the honesty requirement
 // that a run which updates nothing must not look like a successful one.
 describe('update-skill #682 filesystem enumeration', () => {
+  const fx = makeAllModeFixture('xpgate-up682-');
+
+  beforeEach(fx.beforeEach);
+  afterEach(fx.afterEach);
+
+  function deploySkill(platform, name) {
+    return fx.deploySkill(platform, name, 'old content');
+  }
+
+  it('AC-719-01: --all updates skills found on disk even when config.installedSkills is absent', async () => {
+    deploySkill('opencode', 'sprint-flow');
+    deploySkill('opencode', 'delphi-review');
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+    expect(code).toBe(0);
+    const names = fx.installSkillMock.mock.calls.map((c) => c[0]);
+    expect(names).toContain('sprint-flow');
+    expect(names).toContain('delphi-review');
+  });
+
+  it('AC-719-02: --all does not update the same skill twice for the same platform', async () => {
+    deploySkill('opencode', 'sprint-flow');
+    fs.mkdirSync(path.join(fx.tmpHome, '.config', 'xp-gate'), { recursive: true });
+    fs.writeFileSync(
+      path.join(fx.tmpHome, '.config', 'xp-gate', 'xp-gate.json'),
+      JSON.stringify({ installedSkills: { 'sprint-flow': { version: '1.0.0' } } })
+    );
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { all: true });
+    const sprintCalls = fx.installSkillMock.mock.calls.filter((c) => c[0] === 'sprint-flow');
+    expect(sprintCalls.length).toBe(1);
+  });
+
+  it('AC-719-03: --all with nothing installed says so instead of silently succeeding', async () => {
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+    expect(fx.output()).toMatch(/nothing to update|no skills installed|not installed/i);
+    expect(fx.installSkillMock).not.toHaveBeenCalled();
+    expect(code).toBe(0);
+  });
+});
+
+// ── #713: `--all` must only claim skills this package actually ships ─────────
+// #682 fixed the "enumerate nothing" side of this by scanning the filesystem,
+// but scoped the scan too widely: any `<skillsDir>/<name>/SKILL.md` was treated
+// as ours. Skill directories are a shared namespace -- every skill tool uses the
+// same layout -- so on a machine that also has other skill bundles, `--all`
+// walked all of them, printed `Error: Unknown skill: <name>` for each, and told
+// the user to `npm install -g xp-gate@latest` to obtain a skill xp-gate does not
+// and will never carry. The fix is intersection, not union: scanned names are
+// filtered against the bundled set before they become candidates.
+describe('update-skill #713 bundled-skill ownership', () => {
+  const fx = makeAllModeFixture('xpgate-up713-');
+
+  beforeEach(fx.beforeEach);
+  afterEach(fx.afterEach);
+
+  function bundledNames() {
+    // Read the real bundle so the test cannot drift from the package contents.
+    const dir = path.join(__dirname, '..', '..', 'skills');
+    return fs
+      .readdirSync(dir, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && fs.existsSync(path.join(dir, e.name, 'SKILL.md')))
+      .map((e) => e.name);
+  }
+
+  function deploySkill(platform, name) {
+    return fx.deploySkill(platform, name, 'content');
+  }
+
+  /**
+   * @test REQ-713 Skill ownership scoping
+   * @intent A skill directory xp-gate does not ship must never become an --all candidate
+   * @covers AC-713-01
+   */
+  it('AC-713-01: --all ignores skills present on disk but not in the package bundle', async () => {
+    const [ours] = bundledNames();
+    deploySkill('opencode', ours);
+    deploySkill('opencode', 'clipboard-vision');
+    deploySkill('opencode', 'code-search');
+
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+
+    expect(code).toBe(0);
+    const attempted = fx.installSkillMock.mock.calls.map((c) => c[0]);
+    expect(attempted).toContain(ours);
+    expect(attempted).not.toContain('clipboard-vision');
+    expect(attempted).not.toContain('code-search');
+  });
+
+  /**
+   * @test REQ-713 Skill ownership scoping
+   * @intent Foreign skills must not produce the misleading "update the package" advice
+   * @covers AC-713-02
+   */
+  it('AC-713-02: --all prints no Unknown-skill errors for foreign skill directories', async () => {
+    const [ours] = bundledNames();
+    deploySkill('opencode', ours);
+    deploySkill('opencode', 'pdf');
+    deploySkill('opencode', 'docx');
+
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { all: true });
+
+    const said = fx.errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
+    expect(said).not.toMatch(/Unknown skill/);
+  });
+
+  /**
+   * @test REQ-713 Skill ownership scoping
+   * @intent A machine holding only foreign skills must report nothing to update
+   * @covers AC-713-03
+   */
+  it('AC-713-03: --all with only foreign skills reports nothing to update', async () => {
+    deploySkill('opencode', 'clipboard-vision');
+    deploySkill('opencode', 'xlsx');
+
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+
+    expect(fx.output()).toMatch(/nothing to update|no skills installed/i);
+    expect(fx.installSkillMock).not.toHaveBeenCalled();
+    expect(code).toBe(0);
+  });
+});
+
+describe('update-skill #725 --check reads the disk, not the registry', () => {
   let tmpHome;
   let originalHome;
-  let installSkillMock;
   let logSpy;
-  let errorSpy;
 
   beforeEach(() => {
     originalHome = process.env.HOME;
-    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-up682-'));
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-725-'));
     process.env.HOME = tmpHome;
     vi.resetModules();
     delete require.cache[require.resolve('../update-skill')];
-    delete require.cache[require.resolve('../install-skill.js')];
-    installSkillMock = vi.fn().mockResolvedValue(0);
-    const p = require.resolve('../install-skill.js');
-    require.cache[p] = { id: p, filename: p, loaded: true, exports: { installSkill: installSkillMock } };
     logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
   });
 
   afterEach(() => {
-    process.env.HOME = originalHome;
+    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+    logSpy.mockRestore();
     fs.rmSync(tmpHome, { recursive: true, force: true });
-    delete require.cache[require.resolve('../install-skill.js')];
-    delete require.cache[require.resolve('../update-skill')];
-    vi.restoreAllMocks();
   });
 
-  function deploySkill(platform, name) {
-    const dir = path.join(tmpHome, '.config', platform, 'skills', name);
+  function writeConfig(installedSkills) {
+    const dir = path.join(tmpHome, '.config', 'xp-gate');
     fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, 'SKILL.md'), 'old content');
+    fs.writeFileSync(path.join(dir, 'xp-gate.json'), JSON.stringify({ installedSkills }));
+  }
+
+  // The bundled version these tests compare against is whatever the package under
+  // test actually declares. Reading it keeps the fixtures honest across a release
+  // bump: hardcoded stamps silently turn "up to date" fixtures into "behind" ones
+  // the moment VERSION moves, and the failure then names /behind/i rather than the
+  // stale literal that caused it.
+  function bundledVersion() {
+    return JSON.parse(
+      fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8'),
+    ).version;
+  }
+
+  /** The same release in the 4-part stamp form AGENTS.md files carry. */
+  function bundledStamp() {
+    const v = bundledVersion();
+    return /^\d+\.\d+\.\d+$/.test(v) ? `${v}.0` : v;
+  }
+
+  /** Deploy a copy of a shipped skill into one platform, with a chosen stamp. */
+  function deploy(platformRel, name, version) {
+    const dir = path.join(tmpHome, platformRel, name);
+    fs.mkdirSync(dir, { recursive: true });
+    // SKILL.md is copied verbatim so a content comparison would call it current;
+    // the version stamp is what must decide.
+    const bundled = path.join(__dirname, '..', '..', 'skills', name, 'SKILL.md');
+    fs.copyFileSync(bundled, path.join(dir, 'SKILL.md'));
+    if (version) {
+      fs.writeFileSync(
+        path.join(dir, 'AGENTS.md'),
+        `# KB\n\n**Version:** ${version}\n`
+      );
+    }
     return dir;
   }
 
-  it('AC-682-01: --all updates skills found on disk even when config.installedSkills is absent', async () => {
-    deploySkill('opencode', 'sprint-flow');
-    deploySkill('opencode', 'delphi-review');
+  function lines() {
+    return logSpy.mock.calls.map((c) => String(c[0]));
+  }
+
+  /**
+   * @test REQ-725
+   * @intent A copy stamped with an older version must be reported even when the registry says it is current
+   * @covers AC-725-04
+   */
+  it('AC-725-04: reports a stale on-disk copy the registry calls current', async () => {
+    writeConfig({ 'delphi-review': { version: bundledVersion() } });
+    deploy(path.join('.qoder', 'skills'), 'delphi-review', bundledStamp());
+    deploy(path.join('.config', 'opencode', 'skills'), 'delphi-review', '0.32.0.0');
+
     const { updateSkill } = require('../update-skill');
-    const code = await updateSkill(null, { all: true });
-    expect(code).toBe(0);
-    const names = installSkillMock.mock.calls.map((c) => c[0]);
-    expect(names).toContain('sprint-flow');
-    expect(names).toContain('delphi-review');
+    await updateSkill(null, { check: true });
+
+    const said = lines().join('\n');
+    // The registry claims the bundled version for this skill, and it is right about Qoder.
+    // It is wrong about OpenCode, and only reading the disk can say so.
+    expect(said).toMatch(/delphi-review \[opencode\]: 0\.32\.0\.0/);
+    expect(said).toMatch(/behind/i);
   });
 
-  it('AC-682-02: --all does not update the same skill twice for the same platform', async () => {
-    deploySkill('opencode', 'sprint-flow');
-    fs.mkdirSync(path.join(tmpHome, '.config', 'xp-gate'), { recursive: true });
-    fs.writeFileSync(
-      path.join(tmpHome, '.config', 'xp-gate', 'xp-gate.json'),
-      JSON.stringify({ installedSkills: { 'sprint-flow': { version: '1.0.0' } } })
-    );
+  /**
+   * @test REQ-725
+   * @intent Two matching copies must report as up to date
+   * @covers AC-725-04
+   */
+  it('AC-725-04: both copies current reports up to date and no shortfall', async () => {
+    writeConfig({ 'delphi-review': { version: bundledVersion() } });
+    deploy(path.join('.qoder', 'skills'), 'delphi-review', bundledStamp());
+    deploy(path.join('.config', 'opencode', 'skills'), 'delphi-review', bundledStamp());
+
     const { updateSkill } = require('../update-skill');
-    await updateSkill(null, { all: true });
-    const sprintCalls = installSkillMock.mock.calls.filter((c) => c[0] === 'sprint-flow');
-    expect(sprintCalls.length).toBe(1);
+    await updateSkill(null, { check: true });
+
+    const said = lines().join('\n');
+    expect(said).not.toMatch(/behind/i);
+    expect(said).toMatch(/up to date on 2 platform/i);
   });
 
-  it('AC-682-03: --all with nothing installed says so instead of silently succeeding', async () => {
+  /**
+   * @test REQ-725
+   * @intent A release whose micro digit is 0 must not be read as a different release
+   * @covers AC-725-04
+   */
+  it('AC-725-04: a micro .0 stamp matches its own 3-part version', async () => {
+    // The stamp and the packaged version name the SAME release; only their digit
+    // count differs. This regressed once: normalization stripped every trailing
+    // zero instead of the last segment, so `X.Y.0.0` became `X.Y.0` while
+    // `X.Y.0` became `X.Y`, and a current copy was reported as behind. It was
+    // invisible while releases ended in a non-zero micro digit, which is why the
+    // assertion is built from the live packaged version rather than a literal:
+    // it only has teeth on releases whose micro digit is 0.
+    const three = bundledVersion();
+    const four = bundledStamp();
+
+    writeConfig({ 'delphi-review': { version: three } });
+    deploy(path.join('.qoder', 'skills'), 'delphi-review', four);
+
     const { updateSkill } = require('../update-skill');
-    const code = await updateSkill(null, { all: true });
-    const said = [...logSpy.mock.calls, ...errorSpy.mock.calls].map((c) => c.join(' ')).join('\n');
-    expect(said).toMatch(/nothing to update|no skills installed|not installed/i);
-    expect(installSkillMock).not.toHaveBeenCalled();
-    expect(code).toBe(0);
+    await updateSkill(null, { check: true });
+
+    const said = lines().join('\n');
+    expect(said, `${four} and ${three} name the same release`).not.toMatch(/behind/i);
+  });
+
+  /**
+   * @test REQ-725
+   * @intent A skill with no version stamp must not be flagged merely for lacking one
+   * @covers AC-725-05
+   */
+  it('AC-725-05: an unstamped copy identical to the bundle is not reported as behind', async () => {
+    // Most skills ship no AGENTS.md, so "unknown" is their normal state. Measuring
+    // staleness by absence of a stamp flagged every skill on a healthy machine.
+    writeConfig({ 'admin-template-guidelines': { version: bundledVersion() } });
+    deploy(path.join('.qoder', 'skills'), 'admin-template-guidelines', null);
+
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { check: true });
+
+    expect(lines().join('\n')).not.toMatch(/behind/i);
   });
 });

package/lib/detect-deps.js

@@ -302,6 +302,29 @@ function getSkillsDirs(platform) {
   return profile.skillsDirs.map((segments) => path.join(home, ...segments));
 }
 
+/**
+ * Every AI-agent platform whose directory actually exists in the home dir.
+ *
+ * `detectPlatform()` short-circuits to a single platform (opencode is the
+ * fallback), which is right for "which one do I target by default" but wrong for
+ * "which agents does this machine actually run" -- a migration period, or a user
+ * who keeps two tools, has several live trees, and an update must reach all of
+ * them. Each profile's `skillsDirs` lists home-relative path segments; a platform
+ * counts as installed when any of its directories exists.
+ *
+ * @returns {string[]} installed platform names, in PLATFORM_PROFILES order
+ */
+function detectInstalledPlatforms() {
+  const home = require('./shared-paths.js').HOME_DIR;
+  const installed = [];
+  for (const [platform, profile] of Object.entries(PLATFORM_PROFILES)) {
+    if (profile.skillsDirs.some((segments) => fs.existsSync(path.join(home, ...segments)))) {
+      installed.push(platform);
+    }
+  }
+  return installed;
+}
+
 /**
  * Resolve a bash that can actually run the hooks.
  *
@@ -659,6 +682,7 @@ module.exports = {
   autoInstallDeps,
   detectPlatform,
   getSkillsDirs,
+  detectInstalledPlatforms,
   PLATFORM_PROFILES,
   REQUIRED_DEPS,
   GATE_CLI_TOOLS,

package/lib/doctor.js

@@ -21,7 +21,7 @@ const CONFIG_FILE = () => sharedPaths.CONFIG_FILE;
 const GLOBAL_HOOKS_DIR = () => sharedPaths.GLOBAL_HOOKS_DIR;
 const GLOBAL_ADAPTERS_DIR = () => sharedPaths.GLOBAL_ADAPTERS_DIR;
 const { checkUpgrade, formatUpgradeMsg } = require('./check-version.js');
-const { GATE_CLI_TOOLS, checkCliTool, getToolInstallCmd, checkBash } = require('./detect-deps.js');
+const { GATE_CLI_TOOLS, checkCliTool, getToolInstallCmd, checkBash, detectInstalledPlatforms, getSkillsDirs } = require('./detect-deps.js');
 // #505: the single source of truth for module resolution order. The hook reads a
 // generated shell projection of this same module.
 const { RESOLUTION_ORDER } = require('./hook-module-resolution.js');
@@ -3343,7 +3343,13 @@ async function doctorDelphi(options = {}) {
     }
     return out;
   };
-  if (!fs.existsSync(path.join(installedSkillDir, 'SKILL.md'))) {
+  // #725 follow-up: decide "installed anywhere?" from the full platform set, not
+  // just the directory `detectPlatform()` selects — a dsh-only machine has no
+  // marker detectPlatform() keys on, so the opencode fallback directory never
+  // exists and the old check falsely reported "not installed" even though the
+  // copy IS deployed under ~/.dsh/skills.
+  const deployedDirs = otherDeployedSkillDirs(installedSkillDir);
+  if (deployedDirs.length === 0) {
     add('Delphi skill install parity', 'FAIL',
       `not installed at ${installedSkillDir} (install: xp-gate install-skill delphi-review)`);
   } else {
@@ -3357,24 +3363,26 @@ async function doctorDelphi(options = {}) {
       add('Delphi skill install parity', 'FAIL',
         `bundled skill directory missing or empty: ${bundledSkillDir} — reinstall xp-gate`);
     } else {
+      // #725: check every platform that has the skill deployed, not only the one
+      // `detectPlatform()` selects. On a machine with both Qoder and OpenCode the
+      // OpenCode copy was frozen at an old version and this check reported PASS,
+      // because it never looked there -- the drifted copy was invisible to both
+      // `update-skill` and `doctor`.
       const drifted = [];
-      for (const rel of bundledFiles) {
-        const installedPath = path.join(installedSkillDir, rel);
-        const bundledPath = path.join(bundledSkillDir, rel);
-        if (!fs.existsSync(installedPath)) {
-          drifted.push(`${rel}: missing`);
-        } else if (sha256(installedPath) !== sha256(bundledPath)) {
-          drifted.push(`${rel}: differs from bundle`);
+      for (const dir of deployedDirs) {
+        const dirDrift = collectSkillDrift(dir, bundledFiles, bundledSkillDir, sha256);
+        if (dirDrift.length > 0) {
+          drifted.push(`${platformTag(dir)}: ${dirDrift.join(', ')}`);
         }
       }
       if (drifted.length > 0) {
         add('Delphi skill install parity', 'FAIL',
-          `${drifted.length} file(s) differ from the ${getCliVersionSafe()} bundle: `
-          + `${drifted.slice(0, 5).join('; ')}${drifted.length > 5 ? '; ...' : ''} `
+          `installed copy differs from the ${getCliVersionSafe()} bundle — `
+          + `${drifted.slice(0, 3).join('; ')}${drifted.length > 3 ? '; ...' : ''} `
           + '(reinstall: xp-gate install-skill delphi-review --force)');
       } else {
         add('Delphi skill install parity', 'PASS',
-          `${bundledFiles.length} file(s) match the bundle`);
+          `${bundledFiles.length} file(s) match the bundle across ${deployedDirs.length} platform(s)`);
       }
     }
   }
@@ -3591,6 +3599,66 @@ function getCliVersionSafe() {
   }
 }
 
+/**
+ * Skills directories that hold the delphi-review skill, including the detected one.
+ *
+ * #725: `detectPlatform()` returns a single platform, so on a machine carrying
+ * both Qoder and OpenCode the OpenCode copy of the skill was never examined —
+ * `update-skill` did not refresh it and `doctor` reported PASS anyway. Both were
+ * looking at the same one directory. A migration period (user moved between AI
+ * tools, both trees still live) is the normal case that produces this, and the
+ * frozen copy is exactly what a parity check exists to catch.
+ *
+ * The original fix still hardcoded the three pre-dsh platforms, so the DSH copy
+ * (`~/.dsh/skills/delphi-review`) — which `detectPlatform()` never returns and
+ * `PLATFORM_PROFILES` does carry — stayed invisible. Derive the candidates from
+ * the profiles so every installed platform is examined.
+ *
+ * @param {string} detectedDir the platform `detectPlatform()` selected
+ * @returns {string[]} directories that actually contain the skill
+ */
+function otherDeployedSkillDirs(detectedDir) {
+  const candidates = [detectedDir];
+  for (const platform of detectInstalledPlatforms()) {
+    candidates.push(path.join(getSkillsDirs(platform)[0], 'delphi-review'));
+  }
+  const seen = new Set();
+  const found = [];
+  for (const dir of candidates) {
+    if (seen.has(dir)) continue;
+    seen.add(dir);
+    if (fs.existsSync(path.join(dir, 'SKILL.md'))) found.push(dir);
+  }
+  return found;
+}
+
+/**
+ * A short label for a skills directory: the platform segment, not the full path.
+ * Keeps the doctor line readable when two platforms disagree.
+ */
+function platformTag(skillDir) {
+  const parent = path.basename(path.dirname(path.dirname(skillDir)));
+  return parent === 'opencode' ? 'opencode' : parent;
+}
+
+/**
+ * Files in `skillDir` that are missing or differ from the bundle.
+ * @returns {string[]} `rel: reason` entries; empty when the copy is clean
+ */
+function collectSkillDrift(skillDir, bundledFiles, bundledSkillDir, sha256) {
+  const drifted = [];
+  for (const rel of bundledFiles) {
+    const installedPath = path.join(skillDir, rel);
+    const bundledPath = path.join(bundledSkillDir, rel);
+    if (!fs.existsSync(installedPath)) {
+      drifted.push(`${rel}: missing`);
+    } else if (sha256(installedPath) !== sha256(bundledPath)) {
+      drifted.push(`${rel}: differs`);
+    }
+  }
+  return drifted;
+}
+
 module.exports = {
   doctor, doctorDelphi, isXpGateFile, SIGNATURES,
   fixVersionMismatch,