@boyingliu01/xp-gate 0.35.24 → 0.36.1

package/lib/install-skill.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { checkDeps } = require('./detect-deps.js');
+const { checkDeps, detectInstalledPlatforms, getSkillsDirs } = require('./detect-deps.js');
 const { rollback } = require('./rollback.js');
 const { HOME_DIR, CONFIG_DIR, detectPlatform } = require('./shared-paths.js');
 const { copyDirRecursive } = require('./shared-utils');
@@ -16,6 +16,29 @@ function getSkillsDir() {
   return path.join(HOME_DIR, '.config', 'opencode', 'skills');
 }
 
+/**
+ * Every skills directory that belongs to an installed platform.
+ *
+ * #725 fixed the single-platform assumption, but the enumeration still hardcoded
+ * the three pre-dsh platforms (`.qoder`, `.config/opencode`, `.claude`) and so
+ * missed `~/.dsh/skills` -- the DSH platform `detectPlatform()` never returns and
+ * `PLATFORM_PROFILES` does carry. Derive the target set from the profiles instead
+ * of a parallel list: a machine with Qoder, OpenCode and DSH all present must
+ * have all three updated, and a migration period (two tools live) must not leave
+ * one silently frozen.
+ *
+ * A machine with no agent installed yet still needs one target, so fall back to
+ * the platform `detectPlatform()` selects and keep plain `install-skill` working.
+ *
+ * @returns {string[]} home-relative skills directories, de-duplicated
+ */
+function deployedSkillsDirs() {
+  const installed = detectInstalledPlatforms();
+  if (installed.length === 0) return [getSkillsDir()];
+  const dirs = installed.map((platform) => getSkillsDirs(platform)[0]);
+  return [...new Set(dirs)];
+}
+
 // The npm package ships the canonical skill content; `files` includes skills/.
 const BUNDLED_SKILLS_DIR = path.join(__dirname, '..', 'skills');
 
@@ -87,26 +110,52 @@ async function installSkill(name, options = {}) {
     return 1;
   }
 
-  const targetDir = path.join(getSkillsDir(), name);
-  const dupError = checkDuplicateInstall(targetDir, force);
-  if (dupError) {
-    console.error(dupError);
-    return 1;
-  }
+  // #725: update EVERY platform that already carries this skill, not just the
+  // one `detectPlatform()` picks. A machine with both Qoder and OpenCode used to
+  // get one silently-frozen copy. Each target is installed independently so a
+  // failure on one platform does not abort the others -- a half-updated machine
+  // that reports success is exactly the bug being fixed.
+  //
+  // deployedSkillsDirs() already falls back to the detected platform when nothing
+  // is deployed anywhere, so it never returns an empty list.
+  const finalTargets = deployedSkillsDirs().map((dir) => path.join(dir, name));
+
+  // `lastError` alone was wrong: an unreadable platform (e.g. ~/.qoder/skills is
+  // a file, so readdir throws ENOTDIR) set it to 1 and nothing reset it when the
+  // other platform installed fine -- the CLI then reported failure for a machine
+  // that had in fact been updated. Track successes instead: the command failed
+  // only when EVERY target failed.
+  let succeeded = 0;
+  let lastError = 0;
+  for (const targetDir of finalTargets) {
+    const dupError = checkDuplicateInstall(targetDir, force);
+    if (dupError) {
+      console.error(dupError);
+      lastError = 1;
+      continue;
+    }
 
-  const installId = `${name}-${Date.now()}`;
-  const backupDir = path.join(CONFIG_DIR, 'backup', installId);
-  backupExisting(targetDir, installId, backupDir);
+    // The platform segment keeps concurrent per-platform backups distinct; a bare
+    // `Date.now()` collided when both platforms were written in the same tick.
+    const platformTag = path.basename(path.dirname(targetDir));
+    const installId = `${name}-${Date.now()}-${platformTag}`;
+    const backupDir = path.join(CONFIG_DIR, 'backup', installId);
+    backupExisting(targetDir, installId, backupDir);
 
-  try {
-    const result = await performInstall(name, targetDir, verbose);
-    if (result !== 0) return result;
-    return 0;
-  } catch (err) {
-    console.error(`Error: Install failed - ${err.message}`);
-    await rollback(installId);
-    return 1;
+    try {
+      if (verbose && finalTargets.length > 1) console.log(`Target: ${targetDir}`);
+      const result = await performInstall(name, targetDir, verbose);
+      if (result !== 0) lastError = result;
+      else succeeded += 1;
+    } catch (err) {
+      console.error(`Error: Install failed - ${err.message}`);
+      await rollback(installId);
+      lastError = 1;
+    }
   }
+
+  if (succeeded > 0) return 0;
+  return lastError || 1;
 }
 
 function checkDuplicateInstall(targetDir, force) {

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-11-03T07:08:33.951Z",
+  "checked_at": "2026-11-05T16:16:15.014Z",
   "source": "network"
 }

package/lib/principles.js

@@ -209,10 +209,18 @@ function findPrinciplesEntry() {
 // Extensions the principles engine has an adapter for. Kept as a literal rather
 // than imported from src/principles/analyzer.ts because this file must stay
 // loadable by plain Node with no transpile step (the package ships zero runtime
-// dependencies and no build). Must match `getAdapterForFile`'s adapterMap.
+// dependencies and no build). Must match `getAdapterForFile`'s adapterMap —
+// `__tests__/principles-csharp-coverage.test.js` now derives the expected set
+// from that adapterMap and fails when the two drift, because "kept in sync by
+// comment" did not survive contact with #717.
+//
+// `.cs`/`.csx` were the gap: analyzer.ts registered CSharpAdapter, this walk
+// never offered the files, so `xp-gate principles <csharp-dir>` reported
+// "Files checked: 0" — indistinguishable from "no violations".
 const SOURCE_EXTENSIONS = new Set([
   '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
   '.py', '.go', '.java', '.kt', '.kts',
+  '.cs', '.csx',
   '.dart', '.swift', '.cpp', '.cc', '.cxx', '.c', '.h', '.hpp',
   '.m', '.mm',
 ]);

package/lib/uninstall.js

@@ -52,6 +52,27 @@ const GLOBAL_USER_DATA = [
   { key: '.delphi-config.json', label: '.delphi-config.json (your Delphi expert config)' },
 ];
 
+/**
+ * Directories under the config dir that the uninstall snapshot must NOT copy.
+ *
+ * #724: `createBackupSnapshot()` copied every plan entry, so an uninstall wrote a
+ * full second copy of `node_modules/` (~1000 files, ~12 MB) into
+ * `.uninstall-backup/`. That is the one thing here with no rollback value: it is
+ * a dependency tree npm regenerates from `package.json` in seconds, and it was
+ * the difference between a snapshot of a few config files and a 12 MB directory.
+ */
+const UNBACKUPABLE_DIRS = new Set(['node_modules', 'modules']);
+
+/**
+ * How many uninstall snapshots to keep.
+ *
+ * #724: the snapshot directory is named `uninstall-<timestamp>` and nothing ever
+ * pruned it, so every uninstall added another full copy and the directory only
+ * grew. Keeping the most recent few preserves the "I uninstalled by accident"
+ * recovery path without letting the directory become unbounded.
+ */
+const BACKUP_RETENTION = 3;
+
 /**
  * Signature strings used to verify file ownership.
  * Each hook/adapter file contains a unique marker string.
@@ -149,6 +170,11 @@ function unsetHooksPath() {
 
 /**
  * Create a backup snapshot of files/dirs before deletion.
+ *
+ * #724: two scoping rules keep this proportionate. `node_modules/` and
+ * `modules/` are skipped outright -- they are regenerable from package.json, and
+ * copying them made the snapshot ~1000 files / 12 MB. Everything else is copied
+ * as before, so the recovery path for real config is unchanged.
  */
 function createBackupSnapshot(plan) {
   // Use a unique backup dir for this uninstall session
@@ -159,6 +185,9 @@ function createBackupSnapshot(plan) {
 
   for (const item of plan) {
     if (!item.path || !fs.existsSync(item.path)) continue;
+    // Retained user data is not being deleted, so there is nothing to roll back.
+    if (item.retain === true) continue;
+    if (UNBACKUPABLE_DIRS.has(path.basename(item.path))) continue;
 
     const relPath = path.basename(item.path);
     const destPath = path.join(sessionBackup, relPath);
@@ -176,9 +205,49 @@ function createBackupSnapshot(plan) {
     }
   }
 
+  pruneOldBackups(sessionBackup);
+
   return backupMeta;
 }
 
+/**
+ * Keep only the newest BACKUP_RETENTION uninstall snapshots (#724).
+ *
+ * Snapshots are named `uninstall-<epoch-ms>`, so a plain reverse-sort of the
+ * directory names is a correct newest-first order without reading any metadata.
+ * An empty snapshot (every entry was skipped) is removed rather than counted
+ * toward the retention budget -- otherwise a run that backed up nothing would
+ * evict a snapshot that actually held config.
+ */
+function pruneOldBackups(sessionBackup) {
+  try {
+    if (isDirEmpty(sessionBackup)) {
+      fs.rmdirSync(sessionBackup);
+      return;
+    }
+    const sessions = fs
+      .readdirSync(BACKUP_DIR, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && e.name.startsWith('uninstall-'))
+      .map((e) => e.name)
+      .sort()
+      .reverse();
+    for (const stale of sessions.slice(BACKUP_RETENTION)) {
+      fs.rmSync(path.join(BACKUP_DIR, stale), { recursive: true, force: true });
+    }
+  } catch {
+    // Pruning is housekeeping. Failing it must never fail the uninstall, which
+    // has already done the work the user asked for.
+  }
+}
+
+function isDirEmpty(dir) {
+  try {
+    return fs.readdirSync(dir).length === 0;
+  } catch {
+    return false;
+  }
+}
+
 function copyDirSync(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
   const entries = fs.readdirSync(src, { withFileTypes: true });
@@ -561,11 +630,27 @@ async function uninstall(args) {
   // §4.3 Step 4: Print plan
   console.log(`XP-Gate Uninstall (${mode} mode)`);
   console.log('=======================\n');
-  console.log('The following will be removed:\n');
 
-  for (const item of plan) {
+  // #724: 'retain' entries used to be printed under "The following will be
+  // removed" and then kept, with no further mention anywhere in the output.
+  // A user scripting cleanup from this preview would delete a directory they
+  // had been told was gone. The two groups are now stated separately, and the
+  // retained list is echoed again at the end.
+  const removable = plan.filter((item) => item.retain !== true);
+  const retained = plan.filter((item) => item.retain === true);
+
+  console.log('The following will be removed:\n');
+  for (const item of removable) {
     console.log(`  • ${item.label}`);
   }
+
+  if (retained.length > 0) {
+    console.log('\nThe following will be KEPT (your data):\n');
+    for (const item of retained) {
+      console.log(`  • ${item.label}`);
+    }
+  }
+
   if (options.purge) {
     console.log('\nPurge mode — additional cleanup:');
     for (const d of purgeDirs) {
@@ -642,6 +727,15 @@ async function uninstall(args) {
   console.log('Note: Qoder Delphi expert agents (.qoder/agents/delphi-*.md) are user-owned files');
   console.log('      that init never overwrites, so they were left in place — delete them by hand');
   console.log('      (then restart the Qoder session) if you want them gone.');
+  // #724: restate the retained data. The preview said it once, but the last thing
+  // a user reads before closing the terminal is the summary -- and an uninstall
+  // that leaves files behind owes them an explicit accounting of what it kept.
+  for (const item of retained) {
+    console.log(`Kept: ${item.label}`);
+  }
+  if (backupMeta && backupMeta.entries.length > 0) {
+    console.log(`Rollback snapshot: ${backupMeta.sessionBackup}`);
+  }
   if (hadErrors) {
     console.log('Some items could not be removed. Run doctor for diagnostics.');
   }

package/lib/update-skill.js

@@ -128,17 +128,158 @@ function readSkillsDirEntries(detect, platform) {
   return entries.map((entry) => ({ name: entry.name, isDirectory: entry.isDirectory(), dir }));
 }
 
+/**
+ * The version of the CLI that is running, for comparing against what is on disk.
+ *
+ * Same source as install-skill.js reads (#713): the installed package.json, not
+ * the repo-root VERSION file, which the published tarball does not ship.
+ *
+ * @returns {string} semver, or 'unknown' when the package metadata is unreadable
+ */
+function getCliVersion() {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
+    return typeof pkg.version === 'string' && pkg.version ? pkg.version : 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+/**
+ * Compare a 4-part release stamp against a 3-part npm semver.
+ *
+ * A trailing `.0` is the only difference between the two schemes, so trimming it
+ * is enough -- this is deliberately not a full semver comparison, which would
+ * imply support for pre-release ordering that neither source produces.
+ *
+ * The trailing segment is dropped, not "every trailing zero": a naive
+ * `.replace(/.0+$/, '')` also ate the dot of the segment before it, so
+ * `0.36.0.0` normalized to `0.36.0` while `0.36.0` normalized to `0.36` and a
+ * current copy was reported as behind. That stayed hidden while releases ended
+ * in a non-zero micro digit (`0.35.24.0` vs `0.35.24` agree either way) and
+ * broke the first time the micro digit was 0.
+ *
+ * @returns {boolean} true when both name the same release
+ */
+function sameVersion(a, b) {
+  // A 4-part stamp whose micro digit is 0 names the same release as its 3-part
+  // form; anything else is compared as-is so a real difference is never hidden.
+  const norm = (v) => {
+    const parts = String(v).split('.');
+    return parts.length === 4 && parts[3] === '0' ? parts.slice(0, 3).join('.') : String(v);
+  };
+  return norm(a) === norm(b);
+}
+
+/**
+ * Whether a deployed copy is byte-identical to the bundle this CLI ships.
+ *
+ * Most skills carry no AGENTS.md, so their only version marker is `unknown`. That
+ * is not evidence of staleness -- treating it as such flagged every skill on a
+ * healthy machine. Content comparison answers the question the version stamp was
+ * standing in for, and answers it for those skills too.
+ *
+ * Only SKILL.md is compared: it is the file every skill has, and it is the one
+ * `update-skill` rewrites. Anything else a user added locally must not make their
+ * copy look outdated.
+ *
+ * @param {string} skillName
+ * @param {{dir: string}} entry a deployed copy
+ * @returns {boolean} true when the copy already matches the bundle
+ */
+function copyMatchesBundle(skillName, entry) {
+  const bundled = path.join(__dirname, '..', 'skills', skillName, 'SKILL.md');
+  const installed = path.join(entry.dir, 'SKILL.md');
+  try {
+    return fs.readFileSync(installed, 'utf8') === fs.readFileSync(bundled, 'utf8');
+  } catch {
+    // Unreadable either way: fall back to the version stamp's verdict rather than
+    // asserting a match we could not verify.
+    return false;
+  }
+}
+
 function handleCheckMode() {
   console.log('Checking for updates...');
   const config = getConfig();
   const skills = config.installedSkills || {};
+
+  // #725: this used to print config.installedSkills[name].version and call it a
+  // day. That value is what the last install WROTE DOWN, not what is on disk, so
+  // a copy left behind by a single-platform update reported the new version while
+  // its files still said the old one. Reporting the registry as if it were the
+  // installation is how a stale skill looked healthy.
+  const bundledVersion = getCliVersion();
+  let stale = 0;
+
   for (const [skillName, info] of Object.entries(skills)) {
-    console.log(`  ${skillName}: ${info.version || 'unknown'}`);
+    const registry = info.version || 'unknown';
+    const onDisk = deployedSkillVersions(skillName);
+    if (onDisk.length === 0) {
+      console.log(`  ${skillName}: ${registry} (registry only - no copy found on disk)`);
+      continue;
+    }
+    // AGENTS.md stamps the 4-part release version (0.35.24.0) while package.json
+    // carries the 3-part npm semver (0.35.24). Comparing them raw marked every
+    // copy on a healthy machine as behind -- a false alarm is as useless as no
+    // check at all, so normalize before comparing.
+    // A copy is behind when its version stamp says so. Only a copy with NO stamp
+    // falls back to content comparison -- a known-old stamp must not be excused by
+    // an identical SKILL.md, which is exactly the delphi-review case: the two
+    // platform copies differ only in the generated AGENTS.md header.
+    const behind = onDisk.filter((entry) => (entry.version === 'unknown'
+      ? !copyMatchesBundle(skillName, entry)
+      : !sameVersion(entry.version, bundledVersion)));
+    if (behind.length > 0) {
+      stale += behind.length;
+      for (const entry of behind) {
+        console.log(`  ${skillName} [${entry.platform}]: ${entry.version} -> ${bundledVersion} available`);
+      }
+    } else {
+      console.log(`  ${skillName}: ${bundledVersion} (up to date on ${onDisk.length} platform(s))`);
+    }
   }
-  console.log('Update check complete');
+
+  console.log(stale > 0 ? `Update check complete — ${stale} copy(ies) behind.` : 'Update check complete');
   return 0;
 }
 
+/**
+ * Versions actually written into each platform's copy of \`skillName\`.
+ *
+ * Reads the \`**Version:**\` stamp from the generated AGENTS.md, which is the only
+ * per-copy version marker an installed skill carries. A copy without one (older
+ * layouts, or a hand-written skill) reports \`unknown\` rather than being skipped --
+ * silently omitting it would hide exactly the stale copy this check exists for.
+ *
+ * @param {string} skillName
+ * @returns {Array<{platform: string, version: string, dir: string}>} one entry per deployed copy
+ */
+function deployedSkillVersions(skillName) {
+  let detect;
+  try {
+    detect = require('./detect-deps.js');
+  } catch {
+    return [];
+  }
+  const found = [];
+  for (const platform of Object.keys(detect.PLATFORM_PROFILES)) {
+    for (const entry of readSkillsDirEntries(detect, platform)) {
+      if (!entry.isDirectory || entry.name !== skillName) continue;
+      const agentsFile = path.join(entry.dir, entry.name, 'AGENTS.md');
+      let version = 'unknown';
+      try {
+        const match = fs.readFileSync(agentsFile, 'utf8').match(/^\*\*Version:\*\*\s*(\S+)/m);
+        if (match) version = match[1];
+      } catch {
+        // No AGENTS.md: still count the copy, with an unknown stamp.
+      }
+      found.push({ platform, version, dir: path.join(entry.dir, entry.name) });
+    }
+  }
+  return found;
+}
+
 async function handleAllMode(verbose) {
   const names = installedSkillNames();
   console.log('Updating all skills...');

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-11-03
-**Commit:** fa007d1f
-**Branch:** main
-**Version:** 0.35.24.0
+**Generated:** 2026-11-04
+**Commit:** eb2097b0
+**Branch:** sprint/2026-11-03-02
+**Version:** 0.36.1.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-11-03
-**Commit:** fa007d1f
-**Branch:** main
-**Version:** 0.35.24.0
+**Generated:** 2026-11-04
+**Commit:** eb2097b0
+**Branch:** sprint/2026-11-03-02
+**Version:** 0.36.1.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.24",
+  "version": "0.36.1",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.24",
+  "version": "0.36.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-11-03
-**Commit:** fa007d1f
-**Branch:** main
-**Version:** 0.35.24.0
+**Generated:** 2026-11-04
+**Commit:** eb2097b0
+**Branch:** sprint/2026-11-03-02
+**Version:** 0.36.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-11-03
-**Commit:** fa007d1f
-**Branch:** main
-**Version:** 0.35.24.0
+**Generated:** 2026-11-04
+**Commit:** eb2097b0
+**Branch:** sprint/2026-11-03-02
+**Version:** 0.36.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-11-03
-**Commit:** fa007d1f
-**Branch:** main
-**Version:** 0.35.24.0
+**Generated:** 2026-11-04
+**Commit:** eb2097b0
+**Branch:** sprint/2026-11-03-02
+**Version:** 0.36.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM;;;GAA6C,CAAA;AAElG,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAkQlD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9E;AA8ID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAgC9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM;;;GAA6C,CAAA;AAElG,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAkQlD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9E;AA8ID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAmC9D"}

package/plugins/dsh/lib/index.js

@@ -483,10 +483,13 @@ export function apply(ctx, config = {}) {
     // delphi-review work on a machine whose key lives in the credential store rather
     // than in the host process's inherited environment.
     //
-    // The cast is needed because the service is attached by a peer package's module
-    // augmentation, which only applies when that package is in the compilation; a
-    // consumer may install this plugin without it.
-    const credentials = ctx.credentials;
+    // Read via ctx.get() rather than a bare ctx.credentials (#721): Cordis's context
+    // proxy throws "cannot get property ... without inject" on any property that is
+    // neither a declared service nor in this plugin's inject list. "credentials" is
+    // deliberately NOT in inject — adding it would stop the plugin from loading on a
+    // host without the service, discarding the process.env fallback below. ctx.get()
+    // is the inject-free read and returns undefined when the host provides none.
+    const credentials = ctx.get?.("credentials");
     const resolveApiKey = createCredentialResolver(credentials, process.env);
     ctx.tools.register(gateCheckTool(shell, dialect));
     ctx.tools.register(gatePrinciplesTool(shell, dialect));

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.24",
+  "version": "0.36.1",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-11-03
-**Commit:** fa007d1f
-**Branch:** main
-**Version:** 0.35.24.0
+**Generated:** 2026-11-04
+**Commit:** eb2097b0
+**Branch:** sprint/2026-11-03-02
+**Version:** 0.36.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-11-03
-**Commit:** fa007d1f
-**Branch:** main
-**Version:** 0.35.24.0
+**Generated:** 2026-11-04
+**Commit:** eb2097b0
+**Branch:** sprint/2026-11-03-02
+**Version:** 0.36.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-11-03
-**Commit:** fa007d1f
-**Branch:** main
-**Version:** 0.35.24.0
+**Generated:** 2026-11-04
+**Commit:** eb2097b0
+**Branch:** sprint/2026-11-03-02
+**Version:** 0.36.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/src/index.test.ts

@@ -80,6 +80,31 @@ describe("apply", () => {
     expect(names).toContain("gate-arch")
   })
 
+  /**
+   * @test REQ-721
+   * @intent 验证 apply(ctx) 在宿主未提供 credentials 服务时仍能启动。Cordis 的
+   *         上下文是一个代理：对既未在 inject 声明、也未 provide 的服务做裸属性
+   *         读取会直接抛 "cannot get property ... without inject"（#721 根因）。
+   *         credentials 是可选服务，必须经 ctx.get() 读取（未提供时返回 undefined，
+   *         走 process.env 回落），而不是 ctx.credentials。
+   * @covers AC-721-01
+   */
+  it("applies without a credentials service (Cordis throws on undeclared property reads)", () => {
+    const { ctx, captured } = makeCtx("ok")
+    // 复现 Cordis 的 context proxy 语义：目标上不存在、也未声明的属性读取抛错，
+    // 而不是返回 undefined —— 裸的 ctx.credentials 会在这里把整个插件启动炸掉。
+    const cordisLike = new Proxy(ctx as object, {
+      get(target, prop, receiver) {
+        if (prop === "get") return (_name: string) => undefined
+        if (Reflect.has(target, prop)) return Reflect.get(target, prop, receiver)
+        throw new Error(`cannot get property "${String(prop)}" without inject`)
+      },
+    })
+    expect(() => apply(cordisLike as unknown as Context)).not.toThrow()
+    // apply 存活后，工具仍按契约注册。
+    expect(captured.map((c) => (c as CapturedTool).name)).toContain("gate-check")
+  })
+
   /**
    * @test REQ-DSH-006
    * @intent 验证 apply(ctx) 通过 ctx.skills.registerProvider 注册了 bundled skill provider，