@boyingliu01/xp-gate 0.7.1 → 0.8.1

package/lib/__tests__/detect-deps.test.js

@@ -342,20 +342,14 @@ describe('detect-deps', () => {
 
     it('creates skills directory if it does not exist', async () => {
       const { autoInstallDeps } = require('../detect-deps');
-      // Mock execSync to avoid actual git clone
-      const { execSync } = require('child_process');
-      vi.spyOn(require('child_process'), 'execSync').mockImplementation((cmd) => {
-        // Simulate successful clone by creating the target dir
-        const match = cmd.match(/"([^"]+)"$/);
-        if (match) {
-          fs.mkdirSync(match[1], { recursive: true });
-          fs.writeFileSync(path.join(match[1], 'package.json'), JSON.stringify({ version: '2.0.0' }));
-        }
-        return '';
+      vi.spyOn(require('child_process'), 'spawnSync').mockImplementation((cmd, args) => {
+        const destPath = args[args.length - 1];
+        fs.mkdirSync(destPath, { recursive: true });
+        fs.writeFileSync(path.join(destPath, 'package.json'), JSON.stringify({ version: '2.0.0' }));
+        return { status: 0, stdout: Buffer.from(''), stderr: Buffer.from('') };
       });
 
       const result = await autoInstallDeps();
-      // Should have attempted to install
       expect(result.ok).toBe(true);
       expect(result.installed).toContain('superpowers');
       expect(result.installed).toContain('gstack');
@@ -365,7 +359,7 @@ describe('detect-deps', () => {
 
     it('returns errors when git clone fails', async () => {
       const { autoInstallDeps } = require('../detect-deps');
-      vi.spyOn(require('child_process'), 'execSync').mockImplementation(() => {
+      vi.spyOn(require('child_process'), 'spawnSync').mockImplementation(() => {
         throw new Error('git not found');
       });
 
@@ -376,5 +370,44 @@ describe('detect-deps', () => {
 
       vi.restoreAllMocks();
     });
+
+    it('returns errors when git clone exits non-zero (Issue #155)', async () => {
+      const { autoInstallDeps } = require('../detect-deps');
+      vi.spyOn(require('child_process'), 'spawnSync').mockImplementation(() => ({
+        status: 128,
+        stdout: Buffer.from(''),
+        stderr: Buffer.from('fatal: repository not found'),
+      }));
+
+      const result = await autoInstallDeps();
+      expect(result.ok).toBe(false);
+      expect(result.errors.length).toBeGreaterThan(0);
+      expect(result.errors[0].message).toMatch(/repository not found|git clone failed|exit/i);
+
+      vi.restoreAllMocks();
+    });
+
+    it('passes repoUrl as argv[] argument, never via shell string (Issue #155)', async () => {
+      const { autoInstallDeps } = require('../detect-deps');
+      const spy = vi.spyOn(require('child_process'), 'spawnSync').mockImplementation((cmd, args) => {
+        const destPath = args[args.length - 1];
+        fs.mkdirSync(destPath, { recursive: true });
+        fs.writeFileSync(path.join(destPath, 'package.json'), JSON.stringify({ version: '2.0.0' }));
+        return { status: 0, stdout: Buffer.from(''), stderr: Buffer.from('') };
+      });
+
+      await autoInstallDeps();
+
+      expect(spy).toHaveBeenCalled();
+      for (const call of spy.mock.calls) {
+        const [cmd, args, opts] = call;
+        expect(cmd).toBe('git');
+        expect(Array.isArray(args)).toBe(true);
+        expect(args[0]).toBe('clone');
+        expect(opts && opts.shell).not.toBe(true);
+      }
+
+      vi.restoreAllMocks();
+    });
   });
 });

package/lib/__tests__/init.test.js

@@ -28,6 +28,16 @@ describe('init', () => {
     logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
     errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    vi.spyOn(childProcess, 'spawnSync').mockImplementation((cmd, args) => {
+      if (cmd === 'git' && Array.isArray(args) && args[0] === 'clone') {
+        return {
+          status: 1,
+          stdout: Buffer.from(''),
+          stderr: Buffer.from('git clone disabled in test (default stub)'),
+        };
+      }
+      return { status: 0, stdout: Buffer.from(''), stderr: Buffer.from('') };
+    });
   });
 
   afterEach(() => {
@@ -56,7 +66,21 @@ describe('init', () => {
     });
   }
 
+  function stubSpawnGitClone(status = 0, stderr = '') {
+    vi.spyOn(childProcess, 'spawnSync').mockImplementation((cmd, args) => {
+      if (cmd === 'git' && Array.isArray(args) && args[0] === 'clone') {
+        return {
+          status,
+          stdout: Buffer.from(''),
+          stderr: Buffer.from(stderr),
+        };
+      }
+      return { status: 0, stdout: Buffer.from(''), stderr: Buffer.from('') };
+    });
+  }
+
   function mockExecSuccess() {
+    stubSpawnGitClone(1, 'git clone disabled in test');
     execSpy = vi.spyOn(childProcess, 'execSync').mockImplementation((cmd) => {
       if (cmd === 'git rev-parse --git-dir') {
         return path.join(tmpProject, '.git') + '\n';
@@ -69,6 +93,7 @@ describe('init', () => {
   }
 
   function mockExecGitDirOnly() {
+    stubSpawnGitClone(1, 'git clone disabled in test');
     execSpy = vi.spyOn(childProcess, 'execSync').mockImplementation((cmd) => {
       if (cmd === 'git rev-parse --git-dir') {
         return path.join(tmpProject, '.git') + '\n';
@@ -81,6 +106,7 @@ describe('init', () => {
   }
 
   function mockExecFail() {
+    stubSpawnGitClone(1, 'git clone disabled in test');
     execSpy = vi.spyOn(childProcess, 'execSync').mockImplementation(() => {
       throw new Error('Not a git repo');
     });
@@ -103,12 +129,15 @@ describe('init', () => {
   });
 
   it('init([]) with missing superpowers warns Missing dependencies', async () => {
-    // Mock execSync to make auto-install fail immediately
-    vi.spyOn(childProcess, 'execSync').mockImplementation((cmd) => {
-      if (typeof cmd === 'string' && cmd.includes('git clone')) {
-        throw new Error('git clone not available in test');
+    vi.spyOn(childProcess, 'spawnSync').mockImplementation((cmd, args) => {
+      if (cmd === 'git' && Array.isArray(args) && args[0] === 'clone') {
+        return {
+          status: 1,
+          stdout: Buffer.from(''),
+          stderr: Buffer.from('git clone not available in test'),
+        };
       }
-      return '';
+      return { status: 0, stdout: Buffer.from(''), stderr: Buffer.from('') };
     });
     const { init } = require('../init');
     const result = await init([]);
@@ -118,14 +147,16 @@ describe('init', () => {
   });
 
   it('init([]) with versionMismatch warns version detail', async () => {
-    // Mock execSync to make auto-install fail immediately
-    vi.spyOn(childProcess, 'execSync').mockImplementation((cmd) => {
-      if (typeof cmd === 'string' && cmd.includes('git clone')) {
-        throw new Error('git clone not available in test');
+    vi.spyOn(childProcess, 'spawnSync').mockImplementation((cmd, args) => {
+      if (cmd === 'git' && Array.isArray(args) && args[0] === 'clone') {
+        return {
+          status: 1,
+          stdout: Buffer.from(''),
+          stderr: Buffer.from('git clone not available in test'),
+        };
       }
-      return '';
+      return { status: 0, stdout: Buffer.from(''), stderr: Buffer.from('') };
     });
-    // superpowers too old, gstack good
     const sp = path.join(skillsDir(), 'superpowers');
     fs.mkdirSync(sp, { recursive: true });
     fs.writeFileSync(path.join(sp, 'package.json'), JSON.stringify({ version: '0.0.1' }));

package/lib/__tests__/ui-detector.test.ts

@@ -1,15 +1,32 @@
 /**
  * @test ui-detector
  * @intent Verify detectUiSprint correctly identifies UI file changes
+ * @covers Issue #155 — getChangedFiles must use spawnSync (array args) to prevent
+ *         shell-meta injection via baseBranch parameter
  */
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 
 vi.mock('child_process', () => ({
-  execSync: vi.fn(),
+  spawnSync: vi.fn(),
+  // Keep execSync as a vi.fn so any unintentional callers fail loudly
+  execSync: vi.fn(() => {
+    throw new Error('execSync must not be used: command injection risk (Issue #155)');
+  }),
 }));
 
-const mockExecSync = vi.mocked(execSync);
+const mockSpawnSync = vi.mocked(spawnSync);
+
+function mockSpawnReturn(stdout: string) {
+  mockSpawnSync.mockReturnValue({
+    pid: 1,
+    stdout: Buffer.from(stdout),
+    stderr: Buffer.from(''),
+    status: 0,
+    signal: null,
+    output: [null, stdout, ''],
+  } as unknown as ReturnType<typeof spawnSync>);
+}
 
 describe('ui-detector', () => {
   beforeEach(() => {
@@ -18,7 +35,7 @@ describe('ui-detector', () => {
 
   describe('detectUiSprint', () => {
     it('should return false for empty diff', async () => {
-      mockExecSync.mockReturnValue('');
+      mockSpawnReturn('');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(false);
@@ -27,14 +44,14 @@ describe('ui-detector', () => {
     });
 
     it('should return false for pure backend changes', async () => {
-      mockExecSync.mockReturnValue('src/auth.ts\nsrc/db.ts\n');
+      mockSpawnReturn('src/auth.ts\nsrc/db.ts\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint('main');
       expect(result.isUiSprint).toBe(false);
     });
 
     it('should return true for template files in view directories', async () => {
-      mockExecSync.mockReturnValue('views/index.njk\n');
+      mockSpawnReturn('views/index.njk\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -43,7 +60,7 @@ describe('ui-detector', () => {
     });
 
     it('should return true for component files in view directories', async () => {
-      mockExecSync.mockReturnValue('src/components/Button.tsx\n');
+      mockSpawnReturn('src/components/Button.tsx\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -51,28 +68,28 @@ describe('ui-detector', () => {
     });
 
     it('should return false for component files NOT in view directories', async () => {
-      mockExecSync.mockReturnValue('src/hooks/useAuth.tsx\n');
+      mockSpawnReturn('src/hooks/useAuth.tsx\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(false);
     });
 
     it('should return true for style files in view directories', async () => {
-      mockExecSync.mockReturnValue('views/styles/main.css\n');
+      mockSpawnReturn('views/styles/main.css\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
     });
 
     it('should return false for style files NOT in view directories', async () => {
-      mockExecSync.mockReturnValue('src/index.css\n');
+      mockSpawnReturn('src/index.css\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(false);
     });
 
     it('should return true for mixed changes (backend + UI)', async () => {
-      mockExecSync.mockReturnValue('src/auth.ts\nviews/login.html\n');
+      mockSpawnReturn('src/auth.ts\nviews/login.html\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -80,7 +97,7 @@ describe('ui-detector', () => {
     });
 
     it('should return true for renamed UI files', async () => {
-      mockExecSync.mockReturnValue('views/a.html → views/b.html\n');
+      mockSpawnReturn('views/a.html → views/b.html\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -88,24 +105,25 @@ describe('ui-detector', () => {
     });
 
     it('should return false for pure documentation changes', async () => {
-      mockExecSync.mockReturnValue('docs/README.md\n');
+      mockSpawnReturn('docs/README.md\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(false);
     });
 
     it('should use main as default base branch', async () => {
-      mockExecSync.mockReturnValue('');
+      mockSpawnReturn('');
       const { detectUiSprint } = await import('../ui-detector');
       detectUiSprint();
-      expect(mockExecSync).toHaveBeenCalledWith(
-        expect.stringContaining('git diff --name-only main..HEAD'),
+      expect(mockSpawnSync).toHaveBeenCalledWith(
+        'git',
+        ['diff', '--name-only', 'main..HEAD'],
         expect.any(Object)
       );
     });
 
     it('should handle git command failure gracefully', async () => {
-      mockExecSync.mockImplementation(() => {
+      mockSpawnSync.mockImplementation(() => {
         throw new Error('git not available');
       });
       const { detectUiSprint } = await import('../ui-detector');
@@ -113,8 +131,36 @@ describe('ui-detector', () => {
       expect(result.isUiSprint).toBe(false);
     });
 
+    it('should treat non-zero git exit status as failure (Issue #155)', async () => {
+      mockSpawnSync.mockReturnValue({
+        pid: 1,
+        stdout: Buffer.from(''),
+        stderr: Buffer.from('fatal: bad revision'),
+        status: 128,
+        signal: null,
+        output: [null, '', 'fatal: bad revision'],
+      } as unknown as ReturnType<typeof spawnSync>);
+      const { detectUiSprint } = await import('../ui-detector');
+      const result = detectUiSprint('main');
+      expect(result.isUiSprint).toBe(false);
+    });
+
+    it('should not interpret shell metacharacters in baseBranch (Issue #155)', async () => {
+      mockSpawnReturn('');
+      const { getChangedFiles } = await import('../ui-detector');
+      const malicious = 'main; touch /tmp/xp-gate-pwned';
+      getChangedFiles(malicious);
+      expect(mockSpawnSync).toHaveBeenCalledWith(
+        'git',
+        ['diff', '--name-only', `${malicious}..HEAD`],
+        expect.objectContaining({ shell: false })
+      );
+      const callArgs = mockSpawnSync.mock.calls[0];
+      expect(Array.isArray(callArgs[1])).toBe(true);
+    });
+
     it('should handle multiple UI files across different types', async () => {
-      mockExecSync.mockReturnValue('views/index.njk\nsrc/components/Button.tsx\nsrc/auth.ts\n');
+      mockSpawnReturn('views/index.njk\nsrc/components/Button.tsx\nsrc/auth.ts\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -124,21 +170,21 @@ describe('ui-detector', () => {
 
   describe('getChangedFiles', () => {
     it('parses git diff output into file array', async () => {
-      mockExecSync.mockReturnValue('src/a.ts\nsrc/b.ts\n');
+      mockSpawnReturn('src/a.ts\nsrc/b.ts\n');
       const { getChangedFiles } = await import('../ui-detector');
       const files = getChangedFiles('main');
       expect(files).toEqual(['src/a.ts', 'src/b.ts']);
     });
 
     it('returns empty array for empty diff', async () => {
-      mockExecSync.mockReturnValue('');
+      mockSpawnReturn('');
       const { getChangedFiles } = await import('../ui-detector');
       const files = getChangedFiles('main');
       expect(files).toEqual([]);
     });
 
     it('filters out empty lines', async () => {
-      mockExecSync.mockReturnValue('src/a.ts\n\nsrc/b.ts\n');
+      mockSpawnReturn('src/a.ts\n\nsrc/b.ts\n');
       const { getChangedFiles } = await import('../ui-detector');
       const files = getChangedFiles('main');
       expect(files).toEqual(['src/a.ts', 'src/b.ts']);

package/lib/detect-deps.js

@@ -179,89 +179,91 @@ async function checkDeps(platform = 'opencode') {
  * @param {string} [platform='opencode'] - AI agent platform
  * @returns {Promise<{ok: boolean, installed?: string[], errors?: Array<{name: string, message: string}>}>}
  */
-async function autoInstallDeps(platform = 'opencode') {
-  const skillsDirs = getSkillsDirs(platform);
-  const targetDir = skillsDirs[0]; // Install to the primary skills directory
+function runGitClone(repoUrl, destPath) {
+  const cp = require('child_process');
+  const result = cp.spawnSync(
+    'git',
+    ['clone', '--depth', '1', repoUrl, destPath],
+    { stdio: ['ignore', 'pipe', 'pipe'], timeout: 120000, shell: false }
+  );
+  if (result.status === 0) return;
+  const stderr = String(result.stderr ?? '').trim();
+  throw new Error(stderr || `git clone exited with status ${result.status}`);
+}
 
-  if (!fs.existsSync(targetDir)) {
-    try {
-      fs.mkdirSync(targetDir, { recursive: true });
-    } catch (e) {
-      return {
-        ok: false,
-        errors: [{ name: 'mkdir', message: `Cannot create skills directory: ${e.message}` }]
-      };
-    }
+function ensureTargetDir(targetDir) {
+  if (fs.existsSync(targetDir)) return null;
+  try {
+    fs.mkdirSync(targetDir, { recursive: true });
+    return null;
+  } catch (e) {
+    return { name: 'mkdir', message: `Cannot create skills directory: ${e.message}` };
   }
+}
 
-  const check = await checkDeps(platform);
-  if (check.ok) {
-    return { ok: true, installed: [] };
-  }
+function versionMismatchError(versionMismatch) {
+  return {
+    name: versionMismatch.name,
+    message: `version mismatch: need ${versionMismatch.required}, found ${versionMismatch.found} (auto-install cannot upgrade)`,
+  };
+}
 
-  const errors = [];
-  const installed = [];
+function depExistsIn(skillsDirs, depName) {
+  for (const baseDir of skillsDirs) {
+    if (fs.existsSync(path.join(baseDir, depName))) return true;
+  }
+  return false;
+}
 
-  // Check each dep: missing → install, version mismatch → can't auto-fix
-  const depCheck = await checkDeps(platform);
-  if (depCheck.ok) {
-    return { ok: true, installed: [] };
+function safeRemove(destPath) {
+  try {
+    if (fs.existsSync(destPath)) {
+      fs.rmSync(destPath, { recursive: true, force: true });
+    }
+  } catch {
+    // best-effort cleanup of partial clone
   }
+}
 
-  // If the issue is version mismatch, auto-install can't help
-  if (depCheck.versionMismatch) {
-    return {
-      ok: false,
-      installed: [],
-      errors: [{
-        name: depCheck.versionMismatch.name,
-        message: `version mismatch: need ${depCheck.versionMismatch.required}, found ${depCheck.versionMismatch.found} (auto-install cannot upgrade)`
-      }]
-    };
+function installOneDep(dep, targetDir) {
+  const destPath = path.join(targetDir, dep.name);
+  const repoUrl = `https://github.com/${dep.repo}.git`;
+  try {
+    console.log(`  ${dep.name}: not found → installing from ${repoUrl} ...`);
+    runGitClone(repoUrl, destPath);
+    console.log(`  ${dep.name}: OK`);
+    return { ok: true };
+  } catch (e) {
+    const message = e.message || 'git clone failed';
+    console.warn(`  ${dep.name}: FAILED (${message})`);
+    safeRemove(destPath);
+    return { ok: false, error: { name: dep.name, message } };
   }
+}
 
-  for (const dep of REQUIRED_DEPS) {
-    // Re-check if this specific dep is missing
-    let exists = false;
-    for (const baseDir of skillsDirs) {
-      if (fs.existsSync(path.join(baseDir, dep.name))) {
-        exists = true;
-        break;
-      }
-    }
-    if (exists) continue;
+async function autoInstallDeps(platform = 'opencode') {
+  const skillsDirs = getSkillsDirs(platform);
+  const targetDir = skillsDirs[0];
 
-    const destPath = path.join(targetDir, dep.name);
-    const repoUrl = `https://github.com/${dep.repo}.git`;
+  const mkdirErr = ensureTargetDir(targetDir);
+  if (mkdirErr) return { ok: false, errors: [mkdirErr] };
 
-    try {
-      console.log(`  ${dep.name}: not found → installing from ${repoUrl} ...`);
-      const cp = require('child_process');
-      cp.execSync(`git clone --depth 1 "${repoUrl}" "${destPath}"`, {
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 120000, // 2 minute timeout
-      });
-      installed.push(dep.name);
-      console.log(`  ${dep.name}: OK`);
-    } catch (e) {
-      errors.push({ name: dep.name, message: e.message || 'git clone failed' });
-      console.warn(`  ${dep.name}: FAILED (${e.message || 'unknown error'})`);
-      // Clean up partial clone
-      try {
-        if (fs.existsSync(destPath)) {
-          fs.rmSync(destPath, { recursive: true, force: true });
-        }
-      } catch {
-        // Ignore cleanup failures
-      }
-    }
+  const depCheck = await checkDeps(platform);
+  if (depCheck.ok) return { ok: true, installed: [] };
+  if (depCheck.versionMismatch) {
+    return { ok: false, installed: [], errors: [versionMismatchError(depCheck.versionMismatch)] };
   }
 
-  if (errors.length > 0) {
-    return { ok: false, installed, errors };
+  const errors = [];
+  const installed = [];
+  for (const dep of REQUIRED_DEPS) {
+    if (depExistsIn(skillsDirs, dep.name)) continue;
+    const result = installOneDep(dep, targetDir);
+    if (result.ok) installed.push(dep.name);
+    else errors.push(result.error);
   }
 
+  if (errors.length > 0) return { ok: false, installed, errors };
   return { ok: true, installed };
 }
 

package/lib/ui-detector.ts

@@ -1,4 +1,4 @@
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
 
@@ -75,6 +75,19 @@ function getFullExclusions(repoRoot?: string): string[] {
   return [...UI_GATE_DEFAULT_EXCLUSIONS, ...loadUiGateIgnore(repoRoot)];
 }
 
+function runGitDiff(baseBranch: string): string {
+  const result = spawnSync(
+    'git',
+    ['diff', '--name-only', `${baseBranch}..HEAD`],
+    { stdio: ['pipe', 'pipe', 'pipe'], shell: false, encoding: 'utf8' }
+  );
+  if (result.status !== 0) {
+    const stderr = String(result.stderr ?? '').trim();
+    throw new Error(stderr || `git diff exited with status ${result.status}`);
+  }
+  return String(result.stdout ?? '').trim();
+}
+
 export function detectUiSprint(baseBranch: string = 'main'): UiDetectionResult {
   try {
     const files = getChangedFiles(baseBranch);
@@ -88,18 +101,11 @@ export function detectUiSprint(baseBranch: string = 'main'): UiDetectionResult {
 }
 
 export function getChangedFiles(baseBranch: string): string[] {
-  const diffOutput = execSync(`git diff --name-only ${baseBranch}..HEAD`, {
-    encoding: 'utf8',
-    stdio: ['pipe', 'pipe', 'pipe'],
-  }).trim();
-
-  if (diffOutput === '') {
-    return [];
-  }
-
+  const diffOutput = runGitDiff(baseBranch);
+  if (diffOutput === '') return [];
   return diffOutput
     .split('\n')
-    .filter((f) => f.length > 0)
+    .filter((f: string) => f.length > 0)
     .map(parseRenamedFile);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 6 quality gates, Sprint Flow, and Delphi multi-expert review.",
   "author": {