@boyingliu01/xp-gate 0.35.24 → 0.36.0

package/lib/__tests__/update-skill-flags.test.js

@@ -0,0 +1,78 @@
+/**
+ * @test REQ-725
+ * @intent `xp-gate update-skill --check` treated the flag itself as a skill name
+ *         and failed with "--check is not installed". #347 fixed exactly this for
+ *         --all and the sibling flag was left broken, so the regression is pinned
+ *         here at the CLI boundary -- where the bug was -- rather than at the
+ *         parser, which was never wrong.
+ * @covers AC-725-03
+ */
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const BIN = path.join(__dirname, '..', '..', 'bin', 'xp-gate.js');
+
+/** Run the real CLI against a throwaway HOME so no real install is touched. */
+function runCli(args, home) {
+  const env = { ...process.env, HOME: home, USERPROFILE: home };
+  return spawnSync(process.execPath, [BIN, ...args], {
+    encoding: 'utf8',
+    env,
+    timeout: 120000,
+  });
+}
+
+describe('update-skill flag parsing (#725)', () => {
+  let home;
+
+  beforeEach(() => {
+    home = fs.mkdtempSync(path.join(os.tmpdir(), 'xpg-725-cli-'));
+    // An empty but present config dir keeps the command on the update path
+    // instead of bailing out with "not installed" for the wrong reason.
+    fs.mkdirSync(path.join(home, '.config', 'xp-gate'), { recursive: true });
+    fs.writeFileSync(
+      path.join(home, '.config', 'xp-gate', 'xp-gate.json'),
+      JSON.stringify({ installedSkills: {} })
+    );
+  });
+
+  afterEach(() => {
+    fs.rmSync(home, { recursive: true, force: true });
+  });
+
+  /**
+   * @covers AC-725-03
+   */
+  it('AC-725-03: --check is not mistaken for a skill name', () => {
+    const result = runCli(['update-skill', '--check'], home);
+    const said = `${result.stdout}\n${result.stderr}`;
+
+    // The bug printed exactly this. Anything mentioning it means the flag went
+    // through the name slot again.
+    expect(said, '--check must not be read as a skill name').not.toMatch(/--check is not installed/i);
+    // It should reach check mode instead: a listing pass, exit 0.
+    expect(result.status).toBe(0);
+  });
+
+  /**
+   * @covers AC-725-03
+   */
+  it('AC-725-03: --all --check keeps working (the combination #347 fixed)', () => {
+    const result = runCli(['update-skill', '--all', '--check'], home);
+    expect(`${result.stdout}\n${result.stderr}`).not.toMatch(/--all is not installed/i);
+    expect(result.status).toBe(0);
+  });
+
+  /**
+   * @covers AC-725-03
+   */
+  it('AC-725-03: a bare name still routes to the single-skill path', () => {
+    // A name that is not installed must be rejected BY NAME -- proof the name
+    // slot still works after the flag extraction.
+    const result = runCli(['update-skill', 'definitely-not-a-skill'], home);
+    const said = `${result.stdout}\n${result.stderr}`;
+    expect(said).toMatch(/definitely-not-a-skill/);
+  });
+});

package/lib/__tests__/update-skill.test.js

@@ -114,8 +114,14 @@ describe('update-skill', () => {
     const result = await updateSkill(null, { check: true });
     expect(result).toBe(0);
     expect(logSpy).toHaveBeenCalledWith('Checking for updates...');
-    expect(logSpy).toHaveBeenCalledWith('  foo: 1.2.3');
-    expect(logSpy).toHaveBeenCalledWith('  bar: 2.0.0');
+
+    // #725: the check reads the DISK now, not the registry. These skills have no
+    // copy anywhere on this fixture HOME, so the honest answer is "registry only"
+    // -- printing the recorded version as though it were verified is what let a
+    // stale multi-platform copy look up to date.
+    const lines = logSpy.mock.calls.map((c) => c[0]);
+    expect(lines.some((l) => /foo: 1\.2\.3 \(registry only/.test(l))).toBe(true);
+    expect(lines.some((l) => /bar: 2\.0\.0 \(registry only/.test(l))).toBe(true);
     expect(logSpy).toHaveBeenCalledWith('Update check complete');
   });
 
@@ -124,7 +130,8 @@ describe('update-skill', () => {
     const { updateSkill } = require('../update-skill');
     const result = await updateSkill(null, { check: true });
     expect(result).toBe(0);
-    expect(logSpy).toHaveBeenCalledWith('  baz: unknown');
+    const lines = logSpy.mock.calls.map((c) => c[0]);
+    expect(lines.some((l) => /baz: unknown/.test(l))).toBe(true);
   });
 
   it('check=true with empty config returns 0 and prints only headers', async () => {
@@ -489,3 +496,149 @@ describe('update-skill #713 bundled-skill ownership', () => {
     expect(code).toBe(0);
   });
 });
+
+describe('update-skill #725 --check reads the disk, not the registry', () => {
+  let tmpHome;
+  let originalHome;
+  let logSpy;
+
+  beforeEach(() => {
+    originalHome = process.env.HOME;
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-725-'));
+    process.env.HOME = tmpHome;
+    vi.resetModules();
+    delete require.cache[require.resolve('../update-skill')];
+    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+    logSpy.mockRestore();
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+  });
+
+  function writeConfig(installedSkills) {
+    const dir = path.join(tmpHome, '.config', 'xp-gate');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'xp-gate.json'), JSON.stringify({ installedSkills }));
+  }
+
+  // The bundled version these tests compare against is whatever the package under
+  // test actually declares. Reading it keeps the fixtures honest across a release
+  // bump: hardcoded stamps silently turn "up to date" fixtures into "behind" ones
+  // the moment VERSION moves, and the failure then names /behind/i rather than the
+  // stale literal that caused it.
+  function bundledVersion() {
+    return JSON.parse(
+      fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8'),
+    ).version;
+  }
+
+  /** The same release in the 4-part stamp form AGENTS.md files carry. */
+  function bundledStamp() {
+    const v = bundledVersion();
+    return /^\d+\.\d+\.\d+$/.test(v) ? `${v}.0` : v;
+  }
+
+  /** Deploy a copy of a shipped skill into one platform, with a chosen stamp. */
+  function deploy(platformRel, name, version) {
+    const dir = path.join(tmpHome, platformRel, name);
+    fs.mkdirSync(dir, { recursive: true });
+    // SKILL.md is copied verbatim so a content comparison would call it current;
+    // the version stamp is what must decide.
+    const bundled = path.join(__dirname, '..', '..', 'skills', name, 'SKILL.md');
+    fs.copyFileSync(bundled, path.join(dir, 'SKILL.md'));
+    if (version) {
+      fs.writeFileSync(
+        path.join(dir, 'AGENTS.md'),
+        `# KB\n\n**Version:** ${version}\n`
+      );
+    }
+    return dir;
+  }
+
+  function lines() {
+    return logSpy.mock.calls.map((c) => String(c[0]));
+  }
+
+  /**
+   * @test REQ-725
+   * @intent A copy stamped with an older version must be reported even when the registry says it is current
+   * @covers AC-725-04
+   */
+  it('AC-725-04: reports a stale on-disk copy the registry calls current', async () => {
+    writeConfig({ 'delphi-review': { version: bundledVersion() } });
+    deploy(path.join('.qoder', 'skills'), 'delphi-review', bundledStamp());
+    deploy(path.join('.config', 'opencode', 'skills'), 'delphi-review', '0.32.0.0');
+
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { check: true });
+
+    const said = lines().join('\n');
+    // The registry claims the bundled version for this skill, and it is right about Qoder.
+    // It is wrong about OpenCode, and only reading the disk can say so.
+    expect(said).toMatch(/delphi-review \[opencode\]: 0\.32\.0\.0/);
+    expect(said).toMatch(/behind/i);
+  });
+
+  /**
+   * @test REQ-725
+   * @intent Two matching copies must report as up to date
+   * @covers AC-725-04
+   */
+  it('AC-725-04: both copies current reports up to date and no shortfall', async () => {
+    writeConfig({ 'delphi-review': { version: bundledVersion() } });
+    deploy(path.join('.qoder', 'skills'), 'delphi-review', bundledStamp());
+    deploy(path.join('.config', 'opencode', 'skills'), 'delphi-review', bundledStamp());
+
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { check: true });
+
+    const said = lines().join('\n');
+    expect(said).not.toMatch(/behind/i);
+    expect(said).toMatch(/up to date on 2 platform/i);
+  });
+
+  /**
+   * @test REQ-725
+   * @intent A release whose micro digit is 0 must not be read as a different release
+   * @covers AC-725-04
+   */
+  it('AC-725-04: a micro .0 stamp matches its own 3-part version', async () => {
+    // The stamp and the packaged version name the SAME release; only their digit
+    // count differs. This regressed once: normalization stripped every trailing
+    // zero instead of the last segment, so `X.Y.0.0` became `X.Y.0` while
+    // `X.Y.0` became `X.Y`, and a current copy was reported as behind. It was
+    // invisible while releases ended in a non-zero micro digit, which is why the
+    // assertion is built from the live packaged version rather than a literal:
+    // it only has teeth on releases whose micro digit is 0.
+    const three = bundledVersion();
+    const four = bundledStamp();
+
+    writeConfig({ 'delphi-review': { version: three } });
+    deploy(path.join('.qoder', 'skills'), 'delphi-review', four);
+
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { check: true });
+
+    const said = lines().join('\n');
+    expect(said, `${four} and ${three} name the same release`).not.toMatch(/behind/i);
+  });
+
+  /**
+   * @test REQ-725
+   * @intent A skill with no version stamp must not be flagged merely for lacking one
+   * @covers AC-725-05
+   */
+  it('AC-725-05: an unstamped copy identical to the bundle is not reported as behind', async () => {
+    // Most skills ship no AGENTS.md, so "unknown" is their normal state. Measuring
+    // staleness by absence of a stamp flagged every skill on a healthy machine.
+    writeConfig({ 'admin-template-guidelines': { version: bundledVersion() } });
+    deploy(path.join('.qoder', 'skills'), 'admin-template-guidelines', null);
+
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { check: true });
+
+    expect(lines().join('\n')).not.toMatch(/behind/i);
+  });
+});

package/lib/detect-deps.js

@@ -302,6 +302,29 @@ function getSkillsDirs(platform) {
   return profile.skillsDirs.map((segments) => path.join(home, ...segments));
 }
 
+/**
+ * Every AI-agent platform whose directory actually exists in the home dir.
+ *
+ * `detectPlatform()` short-circuits to a single platform (opencode is the
+ * fallback), which is right for "which one do I target by default" but wrong for
+ * "which agents does this machine actually run" -- a migration period, or a user
+ * who keeps two tools, has several live trees, and an update must reach all of
+ * them. Each profile's `skillsDirs` lists home-relative path segments; a platform
+ * counts as installed when any of its directories exists.
+ *
+ * @returns {string[]} installed platform names, in PLATFORM_PROFILES order
+ */
+function detectInstalledPlatforms() {
+  const home = require('./shared-paths.js').HOME_DIR;
+  const installed = [];
+  for (const [platform, profile] of Object.entries(PLATFORM_PROFILES)) {
+    if (profile.skillsDirs.some((segments) => fs.existsSync(path.join(home, ...segments)))) {
+      installed.push(platform);
+    }
+  }
+  return installed;
+}
+
 /**
  * Resolve a bash that can actually run the hooks.
  *
@@ -659,6 +682,7 @@ module.exports = {
   autoInstallDeps,
   detectPlatform,
   getSkillsDirs,
+  detectInstalledPlatforms,
   PLATFORM_PROFILES,
   REQUIRED_DEPS,
   GATE_CLI_TOOLS,

package/lib/doctor.js

@@ -21,7 +21,7 @@ const CONFIG_FILE = () => sharedPaths.CONFIG_FILE;
 const GLOBAL_HOOKS_DIR = () => sharedPaths.GLOBAL_HOOKS_DIR;
 const GLOBAL_ADAPTERS_DIR = () => sharedPaths.GLOBAL_ADAPTERS_DIR;
 const { checkUpgrade, formatUpgradeMsg } = require('./check-version.js');
-const { GATE_CLI_TOOLS, checkCliTool, getToolInstallCmd, checkBash } = require('./detect-deps.js');
+const { GATE_CLI_TOOLS, checkCliTool, getToolInstallCmd, checkBash, detectInstalledPlatforms, getSkillsDirs } = require('./detect-deps.js');
 // #505: the single source of truth for module resolution order. The hook reads a
 // generated shell projection of this same module.
 const { RESOLUTION_ORDER } = require('./hook-module-resolution.js');
@@ -3343,7 +3343,13 @@ async function doctorDelphi(options = {}) {
     }
     return out;
   };
-  if (!fs.existsSync(path.join(installedSkillDir, 'SKILL.md'))) {
+  // #725 follow-up: decide "installed anywhere?" from the full platform set, not
+  // just the directory `detectPlatform()` selects — a dsh-only machine has no
+  // marker detectPlatform() keys on, so the opencode fallback directory never
+  // exists and the old check falsely reported "not installed" even though the
+  // copy IS deployed under ~/.dsh/skills.
+  const deployedDirs = otherDeployedSkillDirs(installedSkillDir);
+  if (deployedDirs.length === 0) {
     add('Delphi skill install parity', 'FAIL',
       `not installed at ${installedSkillDir} (install: xp-gate install-skill delphi-review)`);
   } else {
@@ -3357,24 +3363,26 @@ async function doctorDelphi(options = {}) {
       add('Delphi skill install parity', 'FAIL',
         `bundled skill directory missing or empty: ${bundledSkillDir} — reinstall xp-gate`);
     } else {
+      // #725: check every platform that has the skill deployed, not only the one
+      // `detectPlatform()` selects. On a machine with both Qoder and OpenCode the
+      // OpenCode copy was frozen at an old version and this check reported PASS,
+      // because it never looked there -- the drifted copy was invisible to both
+      // `update-skill` and `doctor`.
       const drifted = [];
-      for (const rel of bundledFiles) {
-        const installedPath = path.join(installedSkillDir, rel);
-        const bundledPath = path.join(bundledSkillDir, rel);
-        if (!fs.existsSync(installedPath)) {
-          drifted.push(`${rel}: missing`);
-        } else if (sha256(installedPath) !== sha256(bundledPath)) {
-          drifted.push(`${rel}: differs from bundle`);
+      for (const dir of deployedDirs) {
+        const dirDrift = collectSkillDrift(dir, bundledFiles, bundledSkillDir, sha256);
+        if (dirDrift.length > 0) {
+          drifted.push(`${platformTag(dir)}: ${dirDrift.join(', ')}`);
         }
       }
       if (drifted.length > 0) {
         add('Delphi skill install parity', 'FAIL',
-          `${drifted.length} file(s) differ from the ${getCliVersionSafe()} bundle: `
-          + `${drifted.slice(0, 5).join('; ')}${drifted.length > 5 ? '; ...' : ''} `
+          `installed copy differs from the ${getCliVersionSafe()} bundle — `
+          + `${drifted.slice(0, 3).join('; ')}${drifted.length > 3 ? '; ...' : ''} `
           + '(reinstall: xp-gate install-skill delphi-review --force)');
       } else {
         add('Delphi skill install parity', 'PASS',
-          `${bundledFiles.length} file(s) match the bundle`);
+          `${bundledFiles.length} file(s) match the bundle across ${deployedDirs.length} platform(s)`);
       }
     }
   }
@@ -3591,6 +3599,66 @@ function getCliVersionSafe() {
   }
 }
 
+/**
+ * Skills directories that hold the delphi-review skill, including the detected one.
+ *
+ * #725: `detectPlatform()` returns a single platform, so on a machine carrying
+ * both Qoder and OpenCode the OpenCode copy of the skill was never examined —
+ * `update-skill` did not refresh it and `doctor` reported PASS anyway. Both were
+ * looking at the same one directory. A migration period (user moved between AI
+ * tools, both trees still live) is the normal case that produces this, and the
+ * frozen copy is exactly what a parity check exists to catch.
+ *
+ * The original fix still hardcoded the three pre-dsh platforms, so the DSH copy
+ * (`~/.dsh/skills/delphi-review`) — which `detectPlatform()` never returns and
+ * `PLATFORM_PROFILES` does carry — stayed invisible. Derive the candidates from
+ * the profiles so every installed platform is examined.
+ *
+ * @param {string} detectedDir the platform `detectPlatform()` selected
+ * @returns {string[]} directories that actually contain the skill
+ */
+function otherDeployedSkillDirs(detectedDir) {
+  const candidates = [detectedDir];
+  for (const platform of detectInstalledPlatforms()) {
+    candidates.push(path.join(getSkillsDirs(platform)[0], 'delphi-review'));
+  }
+  const seen = new Set();
+  const found = [];
+  for (const dir of candidates) {
+    if (seen.has(dir)) continue;
+    seen.add(dir);
+    if (fs.existsSync(path.join(dir, 'SKILL.md'))) found.push(dir);
+  }
+  return found;
+}
+
+/**
+ * A short label for a skills directory: the platform segment, not the full path.
+ * Keeps the doctor line readable when two platforms disagree.
+ */
+function platformTag(skillDir) {
+  const parent = path.basename(path.dirname(path.dirname(skillDir)));
+  return parent === 'opencode' ? 'opencode' : parent;
+}
+
+/**
+ * Files in `skillDir` that are missing or differ from the bundle.
+ * @returns {string[]} `rel: reason` entries; empty when the copy is clean
+ */
+function collectSkillDrift(skillDir, bundledFiles, bundledSkillDir, sha256) {
+  const drifted = [];
+  for (const rel of bundledFiles) {
+    const installedPath = path.join(skillDir, rel);
+    const bundledPath = path.join(bundledSkillDir, rel);
+    if (!fs.existsSync(installedPath)) {
+      drifted.push(`${rel}: missing`);
+    } else if (sha256(installedPath) !== sha256(bundledPath)) {
+      drifted.push(`${rel}: differs`);
+    }
+  }
+  return drifted;
+}
+
 module.exports = {
   doctor, doctorDelphi, isXpGateFile, SIGNATURES,
   fixVersionMismatch,

package/lib/install-skill.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { checkDeps } = require('./detect-deps.js');
+const { checkDeps, detectInstalledPlatforms, getSkillsDirs } = require('./detect-deps.js');
 const { rollback } = require('./rollback.js');
 const { HOME_DIR, CONFIG_DIR, detectPlatform } = require('./shared-paths.js');
 const { copyDirRecursive } = require('./shared-utils');
@@ -16,6 +16,29 @@ function getSkillsDir() {
   return path.join(HOME_DIR, '.config', 'opencode', 'skills');
 }
 
+/**
+ * Every skills directory that belongs to an installed platform.
+ *
+ * #725 fixed the single-platform assumption, but the enumeration still hardcoded
+ * the three pre-dsh platforms (`.qoder`, `.config/opencode`, `.claude`) and so
+ * missed `~/.dsh/skills` -- the DSH platform `detectPlatform()` never returns and
+ * `PLATFORM_PROFILES` does carry. Derive the target set from the profiles instead
+ * of a parallel list: a machine with Qoder, OpenCode and DSH all present must
+ * have all three updated, and a migration period (two tools live) must not leave
+ * one silently frozen.
+ *
+ * A machine with no agent installed yet still needs one target, so fall back to
+ * the platform `detectPlatform()` selects and keep plain `install-skill` working.
+ *
+ * @returns {string[]} home-relative skills directories, de-duplicated
+ */
+function deployedSkillsDirs() {
+  const installed = detectInstalledPlatforms();
+  if (installed.length === 0) return [getSkillsDir()];
+  const dirs = installed.map((platform) => getSkillsDirs(platform)[0]);
+  return [...new Set(dirs)];
+}
+
 // The npm package ships the canonical skill content; `files` includes skills/.
 const BUNDLED_SKILLS_DIR = path.join(__dirname, '..', 'skills');
 
@@ -87,26 +110,52 @@ async function installSkill(name, options = {}) {
     return 1;
   }
 
-  const targetDir = path.join(getSkillsDir(), name);
-  const dupError = checkDuplicateInstall(targetDir, force);
-  if (dupError) {
-    console.error(dupError);
-    return 1;
-  }
+  // #725: update EVERY platform that already carries this skill, not just the
+  // one `detectPlatform()` picks. A machine with both Qoder and OpenCode used to
+  // get one silently-frozen copy. Each target is installed independently so a
+  // failure on one platform does not abort the others -- a half-updated machine
+  // that reports success is exactly the bug being fixed.
+  //
+  // deployedSkillsDirs() already falls back to the detected platform when nothing
+  // is deployed anywhere, so it never returns an empty list.
+  const finalTargets = deployedSkillsDirs().map((dir) => path.join(dir, name));
+
+  // `lastError` alone was wrong: an unreadable platform (e.g. ~/.qoder/skills is
+  // a file, so readdir throws ENOTDIR) set it to 1 and nothing reset it when the
+  // other platform installed fine -- the CLI then reported failure for a machine
+  // that had in fact been updated. Track successes instead: the command failed
+  // only when EVERY target failed.
+  let succeeded = 0;
+  let lastError = 0;
+  for (const targetDir of finalTargets) {
+    const dupError = checkDuplicateInstall(targetDir, force);
+    if (dupError) {
+      console.error(dupError);
+      lastError = 1;
+      continue;
+    }
 
-  const installId = `${name}-${Date.now()}`;
-  const backupDir = path.join(CONFIG_DIR, 'backup', installId);
-  backupExisting(targetDir, installId, backupDir);
+    // The platform segment keeps concurrent per-platform backups distinct; a bare
+    // `Date.now()` collided when both platforms were written in the same tick.
+    const platformTag = path.basename(path.dirname(targetDir));
+    const installId = `${name}-${Date.now()}-${platformTag}`;
+    const backupDir = path.join(CONFIG_DIR, 'backup', installId);
+    backupExisting(targetDir, installId, backupDir);
 
-  try {
-    const result = await performInstall(name, targetDir, verbose);
-    if (result !== 0) return result;
-    return 0;
-  } catch (err) {
-    console.error(`Error: Install failed - ${err.message}`);
-    await rollback(installId);
-    return 1;
+    try {
+      if (verbose && finalTargets.length > 1) console.log(`Target: ${targetDir}`);
+      const result = await performInstall(name, targetDir, verbose);
+      if (result !== 0) lastError = result;
+      else succeeded += 1;
+    } catch (err) {
+      console.error(`Error: Install failed - ${err.message}`);
+      await rollback(installId);
+      lastError = 1;
+    }
   }
+
+  if (succeeded > 0) return 0;
+  return lastError || 1;
 }
 
 function checkDuplicateInstall(targetDir, force) {

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-11-03T07:08:33.951Z",
+  "checked_at": "2026-11-05T12:23:08.769Z",
   "source": "network"
 }