@boyingliu01/xp-gate 0.35.5 → 0.35.7

package/lib/assertion-debt.js

@@ -0,0 +1,173 @@
+/**
+ * `xp-gate audit assertions` — make pre-existing assertion debt visible (#668).
+ *
+ * Gate 5d deliberately checks only the files in the diff: a full-repo scan on
+ * every commit is too slow. That has an expensive side effect. Pre-existing debt
+ * blocks unrelated changes — the author who fixed `writeReport()`'s error handling
+ * was stopped by four long-standing `expect(true).toBe(true)` lines in a file they
+ * had merely touched — and the block reads as "this change introduced a problem".
+ *
+ * The worst consequence is not that one false attribution. It is what it does to
+ * behaviour: noise in the attribution makes people reach for
+ * `@assertion-justified` instead of fixing the test. A gate that teaches people to
+ * annotate their way past it is worse than no gate. Hence a batch work queue.
+ *
+ * Scope: only the two shapes Gate 5d BLOCKS (tautological, empty catch). Weak-only
+ * assertions and mock echoes WARN there because each can be legitimate; putting them
+ * in a "debt to clear" list would invent work.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/** Directories that never contain hand-written assertions worth auditing. */
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  'coverage',
+  '.stryker-tmp',
+  '.agent-tmp',
+  // Build output mirrored from src/ — listing it again would double-count debt and
+  // send a batch fixer to a file that regenerates.
+  '.xp-gate',
+]);
+
+/** Test-file patterns across the ecosystems XP-Gate supports. */
+function isTestFile(name) {
+  return (
+    /\.(test|spec)\.[cm]?[jt]sx?$/.test(name) ||
+    /(^|\/)(__tests__)\//.test(name) ||
+    /\.test\.bats$/.test(name) ||
+    /^test_.*\.py$/.test(name) ||
+    /_test\.(go|rs|py)$/.test(name)
+  );
+}
+
+/**
+ * Tautological assertions: the assertion cannot fail.
+ *
+ * Mirrors `classify_tautological_assertions` in githooks/lib/assertion-quality.sh.
+ * The two implementations must agree, because a debt list that disagrees with the
+ * gate it exists to serve sends people to fix lines that are not blocking and miss
+ * the ones that are.
+ */
+const TAUTOLOGY_PATTERNS = [
+  // (a) identical literal on both sides.
+  {
+    re: /expect\s*\(\s*(true|false|null|undefined|-?\d+|"[^"]*"|'[^']*')\s*\)\s*\.\s*to(?:Be|Equal|StrictEqual)\s*\(\s*\1\s*\)/,
+  },
+  // (b) a literal tested against the truthiness it already has.
+  { re: /expect\s*\(\s*(?:true|1|-1|"[^"]+"|'[^']+')\s*\)\s*\.\s*toBeTruthy\s*\(/ },
+  { re: /expect\s*\(\s*(?:false|0|null|undefined|""|'')\s*\)\s*\.\s*toBeFalsy\s*\(/ },
+];
+
+/** An empty catch body: the failure it guards is discarded. */
+const EMPTY_CATCH_RE = /catch\s*(?:\([^)]*\))?\s*\{\s*\}/;
+
+/**
+ * Is this line a fixture rather than a real assertion?
+ *
+ * A `.bats` test that exercises the Gate 5d classifier necessarily contains
+ * `'expect(true).toBe(true);'` as a quoted INPUT. Reporting it as debt would send a
+ * batch fixer to delete the very strings that pin the classifier — turning the
+ * "fix debt" instruction into an instruction to remove test coverage.
+ *
+ * The distinguishing feature is quoting: in a fixture the shape is wrapped in
+ * quotes and usually sits inside a list/assignment, where a real assertion is bare
+ * executable code.
+ */
+function isFixtureLine(trimmed) {
+  // A leading quote before the assertion shape: `'expect(...)...'` or "expect(...)".
+  if (/^['"`]/.test(trimmed)) return true;
+  // Assertion shape appearing inside a quoted string on the line.
+  if (/['"][^'"`]*expect\s*\(/.test(trimmed)) return true;
+  return false;
+}
+
+/** Classify one source line, or null when it is fine. */
+function classifyLine(text) {
+  const trimmed = text.trim();
+  if (trimmed === '') return null;
+  // A commented-out assertion is not an assertion.
+  if (/^(\/\/|\*|\/\*|#)/.test(trimmed)) return null;
+  if (isFixtureLine(trimmed)) return null;
+  for (const { re } of TAUTOLOGY_PATTERNS) {
+    if (re.test(trimmed)) return 'tautological';
+  }
+  if (EMPTY_CATCH_RE.test(trimmed)) return 'swallowed-error';
+  return null;
+}
+
+/** Find debt in one file's text. */
+function scanSource(text, file) {
+  const findings = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const kind = classifyLine(lines[i]);
+    if (kind) findings.push({ line: i + 1, kind, text: lines[i].trim() });
+  }
+  return findings.length > 0 ? [{ file, findings }] : [];
+}
+
+/** Walk the tree collecting test files, bounded to avoid node_modules. */
+function listTestFiles(root, out = []) {
+  let entries;
+  try {
+    entries = fs.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  if (!Array.isArray(entries)) return out;
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue;
+      listTestFiles(path.join(root, entry.name), out);
+      continue;
+    }
+    if (isTestFile(entry.name)) out.push(path.join(root, entry.name));
+  }
+  return out;
+}
+
+/**
+ * Scan for assertion debt.
+ *
+ * @param {{cwd?: string, source?: string, file?: string}} opts
+ * @returns {Array<{file: string, findings: Array<{line: number, kind: string, text: string}>}>}
+ */
+function scanForAssertionDebt(opts = {}) {
+  if (typeof opts.source === 'string') {
+    return scanSource(opts.source, opts.file || '<inline>');
+  }
+  const root = opts.cwd || process.cwd();
+  const results = [];
+  for (const abs of listTestFiles(root)) {
+    let text;
+    try {
+      text = fs.readFileSync(abs, 'utf8');
+    } catch {
+      continue;
+    }
+    const rel = path.relative(root, abs).split(path.sep).join('/');
+    results.push(...scanSource(text, rel));
+  }
+  return results.sort((a, b) => b.findings.length - a.findings.length || a.file.localeCompare(b.file));
+}
+
+/** Totals for a debt run: per-kind counts plus the file count to batch over. */
+function summarizeDebt(results) {
+  const byKind = { tautological: 0, 'swallowed-error': 0 };
+  let total = 0;
+  for (const entry of results) {
+    for (const finding of entry.findings) {
+      byKind[finding.kind] = (byKind[finding.kind] || 0) + 1;
+      total += 1;
+    }
+  }
+  return { files: results.length, total, byKind };
+}
+
+module.exports = { classifyLine, scanForAssertionDebt, summarizeDebt, isTestFile };

package/lib/doctor-brief.js

@@ -0,0 +1,159 @@
+/**
+ * `xp-gate doctor --brief` — one command that answers every common environment
+ * probe (#653).
+ *
+ * Why this exists: 32.7% of shell calls in a working session were pure probing
+ * (`where gcc`, `Test-Path`, per-file `Get-Content`, version checks), at ~16s
+ * each. The common thread is that the answers barely change, yet every question
+ * costs a full round trip. The fix is not to print less — it is to ask once.
+ *
+ * Two rules this module holds itself to:
+ *
+ * 1. **Read-only.** `--brief` is meant to be called often precisely because it is
+ *    cheap. Anything that writes would make frequent calling compound state
+ *    changes instead of only latency.
+ * 2. **Structured first, summary second.** A model that has to regex a sentence
+ *    has not saved a round trip. `facts` carries the data; `summary` is a
+ *    convenience for humans and nothing depends on it.
+ *
+ * No runtime dependencies: this ships inside the zero-install package.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+/** The fact groups `--brief` promises. Tests pin this list; adding a group here
+ *  without teaching the model to use it only adds output, so keep it deliberate. */
+const BRIEF_FACTS = ['hooks', 'language', 'adapters', 'coverage', 'gateState'];
+
+/** Run a command, returning trimmed stdout or null. Never throws. */
+function tryExec(cmd, args, cwd) {
+  try {
+    const out = execFileSync(cmd, args, {
+      cwd,
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return out.trim();
+  } catch {
+    return null;
+  }
+}
+
+/** Which hooks actually execute, and where they live. */
+function readHooks(cwd) {
+  const hooksPath = tryExec('git', ['config', '--get', 'core.hooksPath'], cwd);
+  const effective = hooksPath || '.git/hooks';
+  const dir = path.isAbsolute(effective) ? effective : path.join(cwd, effective);
+  let installed = [];
+  try {
+    installed = fs.readdirSync(dir).filter((name) => !name.endsWith('.sample'));
+  } catch {
+    installed = [];
+  }
+  return {
+    hooksPath: hooksPath || null,
+    effectivePath: dir,
+    installed,
+    // #451: when core.hooksPath is set, the repo copy is NOT what runs.
+    globalOverride: Boolean(hooksPath),
+  };
+}
+
+/** Project language markers, cheapest signal first. */
+const LANGUAGE_MARKERS = [
+  ['typescript', ['tsconfig.json']],
+  ['python', ['pyproject.toml', 'setup.py', 'requirements.txt']],
+  ['go', ['go.mod']],
+  ['java', ['pom.xml', 'build.gradle', 'build.gradle.kts']],
+  ['kotlin', ['build.gradle.kts']],
+  ['dart', ['pubspec.yaml']],
+  ['rust', ['Cargo.toml']],
+];
+
+function detectLanguages(cwd) {
+  const found = [];
+  for (const [lang, markers] of LANGUAGE_MARKERS) {
+    if (markers.some((m) => fs.existsSync(path.join(cwd, m)))) found.push(lang);
+  }
+  return { detected: found, primary: found[0] || null };
+}
+
+/** Which adapters are reachable via the documented 3-tier resolution. */
+function detectAdapters(cwd) {
+  const tiers = [
+    path.join(process.env.HOME || process.env.USERPROFILE || '', '.config', 'xp-gate', 'adapters'),
+    path.join(cwd, 'githooks', 'adapters'),
+  ];
+  const seen = new Set();
+  const sources = [];
+  for (const dir of tiers) {
+    let names = [];
+    try {
+      names = fs.readdirSync(dir).filter((n) => n.endsWith('.sh'));
+    } catch {
+      continue;
+    }
+    for (const n of names) seen.add(n);
+    sources.push({ dir, count: names.length });
+  }
+  return { count: seen.size, sources };
+}
+
+/** Where coverage would come from, if anywhere. */
+const COVERAGE_CANDIDATES = [
+  'coverage/coverage-final.json',
+  'coverage/lcov.info',
+  'target/site/jacoco/jacoco.xml',
+  'build/reports/jacoco/test/jacocoTestReport.xml',
+];
+
+function detectCoverage(cwd) {
+  const hits = COVERAGE_CANDIDATES.filter((rel) => fs.existsSync(path.join(cwd, rel)));
+  return { found: hits.length > 0, files: hits };
+}
+
+/** Last gate artifact, so callers stop re-reading `.xp-gate/` by hand. */
+function readGateState(cwd) {
+  const artifact = path.join(cwd, '.xp-gate', 'quality-status', 'main.json');
+  try {
+    const parsed = JSON.parse(fs.readFileSync(artifact, 'utf8'));
+    return {
+      artifact,
+      commit: parsed.commit || null,
+      gates: Object.keys(parsed).filter((k) => k.startsWith('gate')).length,
+    };
+  } catch {
+    // No artifact is a fact worth stating, not an error: "never run" and
+    // "failed to read" would otherwise be indistinguishable.
+    return { artifact, commit: null, gates: 0 };
+  }
+}
+
+/**
+ * Build the brief report.
+ *
+ * @param {{cwd?: string}} opts
+ * @returns {{facts: object, summary: string}}
+ */
+function buildBriefReport(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  const facts = {
+    hooks: readHooks(cwd),
+    language: detectLanguages(cwd),
+    adapters: detectAdapters(cwd),
+    coverage: detectCoverage(cwd),
+    gateState: readGateState(cwd),
+  };
+  const summary = [
+    `lang=${facts.language.primary || 'unknown'} adapters=${facts.adapters.count} ` +
+      `coverage=${facts.coverage.found ? 'yes' : 'no'} hooks=${facts.hooks.globalOverride ? 'global' : 'local'}`,
+    `hooksPath=${facts.hooks.effectivePath}`,
+  ].join('\n');
+  return { facts, summary };
+}
+
+module.exports = { BRIEF_FACTS, buildBriefReport };

package/lib/doctor.js

@@ -2873,7 +2873,7 @@ function diagnoseLanguageTools() {
 // #488: an unrecognised flag used to be silently ignored — the npm release
 // that predates --sync-hooks made "doctor --sync-hooks" a silent no-op and the
 // user believed a sync had happened. Fail loudly instead.
-const KNOWN_FLAGS = ['--fix', '--sync-hooks', '--force', '--install-tools', '--json', '--format', '--refresh-env'];
+const KNOWN_FLAGS = ['--fix', '--sync-hooks', '--force', '--install-tools', '--json', '--format', '--refresh-env', '--brief'];
 
 /**
  * The accepted flag surface of `doctor`, as a pure function.
@@ -2931,11 +2931,31 @@ function doctorFlagContract(args) {
     errors.push('--install-tools is only read by --fix, and it is the only flag that installs toolchains onto this machine');
     errors.push('Pass --fix --install-tools, or drop --install-tools');
   }
-  return { errors, fixMode, syncHooks, force, installToolsFlag, jsonMode, refreshEnv };
+  // #653: --brief exists to collapse a class of exploratory probes (`where gcc`,
+  // Test-Path, per-file reads) into one cheap read. It is read-only by contract:
+  // users call it often precisely because it is cheap, so a write smuggled in
+  // would compound state changes instead of only latency.
+  const briefFlag = args.includes('--brief');
+  if (briefFlag && (fixMode || syncHooks || installToolsFlag || force)) {
+    errors.push('--brief is a read-only fact dump and cannot be combined with --fix, --sync-hooks, --install-tools or --force');
+  }
+  return { errors, fixMode, syncHooks, force, installToolsFlag, jsonMode, refreshEnv, briefFlag };
 }
 
 async function doctor(args) {
-  const { errors, fixMode, syncHooks, force, installToolsFlag, jsonMode, refreshEnv } = doctorFlagContract(args);
+  const { errors, fixMode, syncHooks, force, installToolsFlag, jsonMode, refreshEnv, briefFlag } = doctorFlagContract(args);
+  if (briefFlag && errors.length === 0) {
+    // Answers the whole "what is this machine set up like" question in one shot.
+    const { buildBriefReport } = require('./doctor-brief');
+    const report = buildBriefReport({ cwd: process.cwd() });
+    if (jsonMode) {
+      process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    } else {
+      process.stdout.write(`${report.summary}\n`);
+    }
+    process.exitCode = 0;
+    return;
+  }
   if (errors.length > 0) {
     for (const error of errors) console.error(error);
     return 1;

package/lib/gate-rules.js

@@ -0,0 +1,149 @@
+/**
+ * Collect the gate thresholds that actually block a commit, from the files that
+ * define them (#652).
+ *
+ * Why generated rather than hand-written: BUILD-phase docs used to say "there are
+ * gates 0-11" without saying what the numbers are. The numbers live in
+ * `.principlesrc`, `jscpd.conf.json`, `.ccn-baseline.json` and the hook itself. A
+ * hand-copied table is correct on the day it is written and wrong on the day
+ * someone tunes a threshold — and a self-check list that lies is worse than none,
+ * because it teaches the wrong rule and then contradicts it at commit time.
+ *
+ * Every rule therefore carries an `evidence` pointer, so "the limit is 50" can be
+ * checked or argued with instead of being indistinguishable from a guess.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/** Read and parse a JSON file, or null when absent/unreadable. */
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Normalise severity spellings.
+ *
+ * The config files and the hook do not agree: `.principlesrc` says `warning`,
+ * Gate 3's boundary is `warn`, and both mean the same thing. Carrying two spellings
+ * into one list would make it look like two different severities exist.
+ */
+function normaliseSeverity(value) {
+  if (value === 'warning') return 'warn';
+  if (value === 'block' || value === 'warn' || value === 'info') return value;
+  return 'warn';
+}
+
+/** Flatten `.principlesrc` rules into entries with source + evidence. */
+function principlesRules(cwd) {
+  const file = path.join(cwd, '.principlesrc');
+  const cfg = readJson(file);
+  if (!cfg || !cfg.rules) return [];
+  const out = [];
+  for (const group of Object.keys(cfg.rules)) {
+    for (const [name, rule] of Object.entries(cfg.rules[group] || {})) {
+      out.push({
+        id: `${group}.${name}`,
+        source: 'principles',
+        severity: normaliseSeverity(rule.severity),
+        // Not every rule is threshold-shaped (e.g. unused-imports); report the
+        // one that exists rather than inventing a 0.
+        threshold: typeof rule.threshold === 'number' ? rule.threshold : null,
+        evidence: '.principlesrc',
+      });
+    }
+  }
+  return out;
+}
+
+/**
+ * Gate 2's duplicate-code rule.
+ *
+ * `githooks/pre-commit` prints "jscpd found duplicated code (warning, not blocking
+ * by default)" -- this gate reports, it does not block. The BUILD-phase doc used to
+ * claim "jscpd similarity >5% BLOCK", which sent people to refactor for a verdict
+ * that never fires. A generated list must record what the hook does, not what the
+ * old prose said.
+ */
+function jscpdRules(cwd) {
+  const cfg = readJson(path.join(cwd, 'jscpd.conf.json'));
+  // jscpd itself has no similarity threshold in this project's config and the hook
+  // never compares a percentage. Reporting null says "no limit declared" instead of
+  // inventing a number the hook does not enforce.
+  const threshold = cfg && typeof cfg.threshold === 'number' ? cfg.threshold : null;
+  return [
+    {
+      id: 'duplication.jscpd',
+      source: 'jscpd',
+      severity: 'info',
+      threshold,
+      evidence: 'githooks/pre-commit (Gate 2, advisory)',
+    },
+  ];
+}
+
+/** Gate 3 warn/block boundaries, which the hook itself owns. */
+function ccnRules(cwd) {
+  return [
+    { id: 'ccn.warn', source: 'ccn', severity: 'warn', threshold: 5, evidence: 'githooks/pre-commit (Gate 3)' },
+    { id: 'ccn.block', source: 'ccn', severity: 'block', threshold: 10, evidence: 'githooks/pre-commit (Gate 3)' },
+  ];
+}
+
+/** Boy Scout's structural limits, read from wherever they are configured. */
+function boyScoutRules(cwd) {
+  const out = [
+    {
+      id: 'boy-scout.new-file',
+      source: 'boy-scout',
+      severity: 'block',
+      threshold: 0,
+      evidence: 'src/principles/boy-scout.ts',
+    },
+  ];
+  // The per-function line and nesting limits are principles rules; when
+  // .principlesrc exists they are already listed by principlesRules, so only add
+  // here when it does not (so the BUILD list never silently loses them).
+  const cfg = readJson(path.join(cwd, '.principlesrc'));
+  if (!cfg || !cfg.rules || !cfg.rules['clean-code']) {
+    out.push(
+      { id: 'clean-code.long-function', source: 'boy-scout', severity: 'warn', threshold: 50, evidence: 'defaults' },
+      { id: 'clean-code.deep-nesting', source: 'boy-scout', severity: 'warn', threshold: 4, evidence: 'defaults' },
+    );
+  }
+  return out;
+}
+
+/**
+ * Collect every rule that can block or warn a commit.
+ *
+ * @param {{cwd?: string}} opts
+ * @returns {Array<{id: string, source: string, severity: string, threshold: number|null, evidence: string}>}
+ */
+function collectGateRules(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  const rules = [...principlesRules(cwd), ...jscpdRules(cwd), ...ccnRules(cwd), ...boyScoutRules(cwd)];
+  // Stable order: blocking first, then warn/info, so a reader stops at what hurts.
+  const rank = { block: 0, warn: 1, info: 2 };
+  return rules.sort(
+    (a, b) => (rank[a.severity] ?? 3) - (rank[b.severity] ?? 3) || a.id.localeCompare(b.id),
+  );
+}
+
+/** Render the checklist as markdown with an evidence column. */
+function renderGateRules(rules) {
+  const lines = ['| Rule | Severity | Limit | Evidence |', '|---|---|---|---|'];
+  for (const rule of rules) {
+    lines.push(
+      `| \`${rule.id}\` | ${rule.severity} | ${rule.threshold === null ? '—' : rule.threshold} | \`${rule.evidence}\` |`,
+    );
+  }
+  return lines.join('\n');
+}
+
+module.exports = { collectGateRules, renderGateRules };

package/lib/gate-runner.js

@@ -320,8 +320,49 @@ const GATE_NOT_RUN = 'NOT_RUN';
  * Finds the .ts entry point, spawns tsx with --run flag.
  * Falls back to bash script if TypeScript module not found.
  */
+/**
+ * Resolve the working directory for a gate run.
+ *
+ * `targetPath` is documented as "file or directory" (that is what
+ * `xp-gate check <file>` passes), but spawnSync's `cwd` must be a directory.
+ * Resolving a FILE path into cwd made spawnSync fail with a bare ENOENT that read
+ * as "Gate 3 failed to run npx tsx" — a tool failure reported under the label of a
+ * code verdict. The file's own directory is the meaningful cwd in that case.
+ */
+function resolveGateCwd(targetPath) {
+  if (!targetPath) return process.cwd();
+  const resolved = path.resolve(targetPath);
+  try {
+    if (fs.statSync(resolved).isFile()) return path.dirname(resolved);
+  } catch {
+    // Nonexistent path: leave it for the gate itself to report.
+  }
+  return resolved;
+}
+
+/**
+ * Resolve how to invoke npx without a shell.
+ *
+ * `shell: true` on Windows looked like the right fix for resolving npx.cmd, but
+ * node passes the argv to CreateProcess as one concatenated string without
+ * escaping (DEP0190) — so any entry path with a backslash or space produced a
+ * malformed command line and spawnSync failed with a bare ENOENT. The gate then
+ * reported FAIL while nothing had actually run: a tool failure wearing the verdict
+ * "your code is broken".
+ *
+ * Calling npx.cmd directly is not the fix either: since the CVE-2024-27980
+ * hardening, node refuses .cmd/.bat from spawnSync without a shell and returns
+ * EINVAL. Running npx's own cli.js with the current node binary sidesteps both —
+ * plain argv, no shell, no batch wrapper.
+ */
+function resolveNpxInvocation(args) {
+  const npxCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npx-cli.js');
+  if (fs.existsSync(npxCli)) return [process.execPath, [npxCli, ...args]];
+  return ['npx', args];
+}
+
 function runTsGate(gateModule, targetPath, opts = {}) {
-  const targetCwd = targetPath ? path.resolve(targetPath) : process.cwd();
+  const targetCwd = resolveGateCwd(targetPath);
   const entry = findTsGateEntry(gateModule);
   if (!entry) {
     // Fallback to bash script
@@ -344,10 +385,15 @@ function runTsGate(gateModule, targetPath, opts = {}) {
   // malformed argv, and reports a killed child (timeout, signal) as a null status.
   // All three mean "the gate did not report a verdict", which must not be read as
   // success: a gate that never ran is not a gate that passed.
+  //
+  // spawnSync reports a spawn failure (npx missing) on `error`, throws only on a
+  // malformed argv, and reports a killed child (timeout, signal) as a null status.
+  // All three mean "the gate did not report a verdict", which must not be read as
+  // success: a gate that never ran is not a gate that passed.
+  const [command, commandArgs] = resolveNpxInvocation(args);
   try {
-    const result = spawnSync('npx', args, {
+    const result = spawnSync(command, commandArgs, {
       stdio: 'inherit',
-      shell: process.platform === 'win32',
       cwd: targetCwd,
       timeout: TS_GATE_TIMEOUT_MS,
     });

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T18:00:25.743Z",
+  "checked_at": "2026-10-30T18:41:08.730Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 4776dc7f
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.5.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 4776dc7f
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.5.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.5",
+  "version": "0.35.7",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.5",
+  "version": "0.35.7",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 4776dc7f
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.5.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 4776dc7f
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.5.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.