@boyingliu01/xp-gate 0.13.2 → 0.14.1

package/bin/xp-gate.js

@@ -157,6 +157,14 @@ const COMMANDS = {
       }
     },
     usage: 'xp-gate update-hooks [--global] [--force] [--dry-run] [--no-backup] [--scope hooks|adapters|all]'
+  },
+  'install': {
+    description: 'One-step install (init + bootstrap + doctor)',
+    run: subargs => {
+      const { install } = require('../lib/install-cmd');
+      install(subargs).then(code => process.exit(code));
+    },
+    usage: 'xp-gate install [--global]'
   }
 };
 

package/gate-9.sh

@@ -1,14 +1,14 @@
 # ============================================================================
-# GATE 10: Semgrep SAST Security Scan
+# GATE 9: Semgrep SAST Security Scan
 # Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
 # Tool: semgrep -- https://semgrep.dev
 # ============================================================================
 
  2>&1 echo ""
- 2>&1 echo "→ Gate 10: Semgrep SAST Security Scan..."
-GATE_10_START=$(gate_start_ms)
+ 2>&1 echo "→ Gate 9: Semgrep SAST Security Scan..."
+GATE_9_START=$(gate_start_ms)
 
-GATE_10_STATUS=""
+GATE_9_STATUS=""
 
 # Semgrep availability check
 SEMGREP_CMD=""
@@ -22,15 +22,15 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
   echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
   echo "     Pre-cache rules: semgrep --config=p/security-audit"
-  echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
-  GATE_10_STATUS="WARN"
+  echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
+  GATE_9_STATUS="WARN"
 else
   # Get staged files filtered to Semgrep-supported languages
   SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
-    GATE_10_STATUS="SKIP"
+    GATE_9_STATUS="SKIP"
   else
     # Run semgrep with JSON output
     # --config=p/security-audit: explicit security ruleset
@@ -41,7 +41,7 @@ else
 
     if [ "$SEMGREP_EXIT" -eq 0 ]; then
       echo "     ✅ PASSED - No security vulnerabilities found."
-      GATE_10_STATUS="PASS"
+      GATE_9_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
       CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
@@ -99,7 +99,7 @@ except:
       if [ "$CRITICAL_HIGH" -gt 0 ]; then
         echo ""
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 10: Semgrep Security Gate"
+        echo "   GATE 9: Semgrep Security Gate"
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
         echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
@@ -108,7 +108,7 @@ except:
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "$FINDING_DETAILS"
         echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_10_STATUS="FAIL"
+        GATE_9_STATUS="FAIL"
         exit 1
       else
         echo ""
@@ -117,14 +117,14 @@ except:
           echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
           echo "$FINDING_DETAILS"
         fi
-        GATE_10_STATUS="PASS"
+        GATE_9_STATUS="PASS"
       fi
     else
       # semgrep runtime error (timeout, config error, etc.)
       echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
-      GATE_10_STATUS="SKIP"
+      GATE_9_STATUS="SKIP"
     fi
   fi
 fi
-record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"
+record_gate_audit "gate-9" "sast-security" "$GATE_9_STATUS" "0" "$GATE_9_START"

package/hooks/gate-9.sh

@@ -1,14 +1,14 @@
 # ============================================================================
-# GATE 10: Semgrep SAST Security Scan
+# GATE 9: Semgrep SAST Security Scan
 # Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
 # Tool: semgrep -- https://semgrep.dev
 # ============================================================================
 
  2>&1 echo ""
- 2>&1 echo "→ Gate 10: Semgrep SAST Security Scan..."
-GATE_10_START=$(gate_start_ms)
+ 2>&1 echo "→ Gate 9: Semgrep SAST Security Scan..."
+GATE_9_START=$(gate_start_ms)
 
-GATE_10_STATUS=""
+GATE_9_STATUS=""
 
 # Semgrep availability check
 SEMGREP_CMD=""
@@ -22,15 +22,15 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
   echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
   echo "     Pre-cache rules: semgrep --config=p/security-audit"
-  echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
-  GATE_10_STATUS="WARN"
+  echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
+  GATE_9_STATUS="WARN"
 else
   # Get staged files filtered to Semgrep-supported languages
   SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
-    GATE_10_STATUS="SKIP"
+    GATE_9_STATUS="SKIP"
   else
     # Run semgrep with JSON output
     # --config=p/security-audit: explicit security ruleset
@@ -41,7 +41,7 @@ else
 
     if [ "$SEMGREP_EXIT" -eq 0 ]; then
       echo "     ✅ PASSED - No security vulnerabilities found."
-      GATE_10_STATUS="PASS"
+      GATE_9_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
       CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
@@ -99,7 +99,7 @@ except:
       if [ "$CRITICAL_HIGH" -gt 0 ]; then
         echo ""
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 10: Semgrep Security Gate"
+        echo "   GATE 9: Semgrep Security Gate"
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
         echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
@@ -108,7 +108,7 @@ except:
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "$FINDING_DETAILS"
         echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_10_STATUS="FAIL"
+        GATE_9_STATUS="FAIL"
         exit 1
       else
         echo ""
@@ -117,14 +117,14 @@ except:
           echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
           echo "$FINDING_DETAILS"
         fi
-        GATE_10_STATUS="PASS"
+        GATE_9_STATUS="PASS"
       fi
     else
       # semgrep runtime error (timeout, config error, etc.)
       echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
-      GATE_10_STATUS="SKIP"
+      GATE_9_STATUS="SKIP"
     fi
   fi
 fi
-record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"
+record_gate_audit "gate-9" "sast-security" "$GATE_9_STATUS" "0" "$GATE_9_START"

package/lib/__tests__/bootstrap.test.js

@@ -0,0 +1,78 @@
+const { bootstrap } = require('../bootstrap.js');
+
+describe('bootstrap', () => {
+  let consoleLogSpy;
+
+  beforeEach(() => {
+    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('returns 0 when --dry-run given with no missing tools', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [],
+      checkCliTool: () => ({ available: true }),
+      getToolInstallCmd: () => 'echo done',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap(['--dry-run']);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+
+  it('returns 0 when all CLI tools are available', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [{ tool: 'testtool', gates: ['Gate 1'], install: { linux: 'echo ok' } }],
+      checkCliTool: () => ({ available: true, version: '1.0' }),
+      getToolInstallCmd: () => 'echo ok',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap([]);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+
+  it('accepts --lang ts parameter', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [],
+      checkCliTool: () => ({ available: true }),
+      getToolInstallCmd: () => 'echo done',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap(['--lang', 'ts']);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+
+  it('accepts --lang ts,py parameter', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [],
+      checkCliTool: () => ({ available: true }),
+      getToolInstallCmd: () => 'echo done',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap(['--lang', 'ts,py']);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+
+  it('recognizes --verbose flag without error', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [],
+      checkCliTool: () => ({ available: true }),
+      getToolInstallCmd: () => 'echo done',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap(['--verbose']);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+});

package/lib/__tests__/detect-deps.test.js

@@ -413,6 +413,94 @@ describe('detect-deps', () => {
 
   // ── checkCliTool tests (Issue #299 — Windows cross-platform) ──
 
+  describe('GATE_TOOLS classification', () => {
+    it('exports GATE_TOOLS with required categories', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(GATE_TOOLS.PLATFORM).toEqual(expect.arrayContaining(['jscpd', 'lizard', 'semgrep', 'gitleaks', 'npx']));
+      expect(GATE_TOOLS.IAC).toEqual(expect.arrayContaining(['checkov', 'hadolint', 'kube-score', 'tflint']));
+      expect(GATE_TOOLS.LANG_MAP.ts).toBe('typescript');
+      expect(GATE_TOOLS.LANG_MAP.py).toBe('python');
+    });
+
+    it('has LINT entries for all 12 supported languages', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(Object.keys(GATE_TOOLS.LINT).sort()).toEqual([
+        'cpp', 'dart', 'flutter', 'go', 'java', 'kotlin',
+        'objectivec', 'powershell', 'python', 'shell', 'swift', 'typescript',
+      ]);
+    });
+
+    it('has TEST entries for major languages', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(GATE_TOOLS.TEST.typescript).toContain('vitest');
+      expect(GATE_TOOLS.TEST.python).toContain('pytest');
+      expect(GATE_TOOLS.TEST.go).toContain('go');
+    });
+
+    it('has MUTATION entries for languages with mutation support', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(GATE_TOOLS.MUTATION.typescript).toContain('stryker');
+      expect(GATE_TOOLS.MUTATION.python).toContain('mutmut');
+      expect(GATE_TOOLS.MUTATION.go).toContain('gomutants');
+      expect(GATE_TOOLS.MUTATION.java).toContain('pitest');
+    });
+
+    it('has SPECIAL with jq, tsx, node descriptors', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(GATE_TOOLS.SPECIAL.jq.gate).toBe('MW');
+      expect(GATE_TOOLS.SPECIAL.tsx.gate).toContain('M');
+      expect(GATE_TOOLS.SPECIAL.node.gate).toContain('0');
+    });
+
+    it('LANG_MAP values all exist as LINT keys', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      const lintKeys = Object.keys(GATE_TOOLS.LINT);
+      for (const full of Object.values(GATE_TOOLS.LANG_MAP)) {
+        expect(lintKeys).toContain(full);
+      }
+    });
+  });
+
+  describe('detectProjectLang', () => {
+    it('returns empty array for project with no known markers', () => {
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toEqual([]);
+    });
+
+    it('detects typescript from tsconfig.json', () => {
+      fs.writeFileSync(path.join(tmpHome, 'tsconfig.json'), '{}');
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toContain('typescript');
+    });
+
+    it('detects python from pyproject.toml', () => {
+      fs.writeFileSync(path.join(tmpHome, 'pyproject.toml'), '[project]\n');
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toContain('python');
+    });
+
+    it('detects go from go.mod', () => {
+      fs.writeFileSync(path.join(tmpHome, 'go.mod'), 'module example.com/m\n');
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toContain('go');
+    });
+
+    it('detects java from pom.xml', () => {
+      fs.writeFileSync(path.join(tmpHome, 'pom.xml'), '<project></project>');
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toContain('java');
+    });
+
+    it('detects multiple languages in monorepo', () => {
+      fs.writeFileSync(path.join(tmpHome, 'package.json'), JSON.stringify({ devDependencies: { typescript: '^5.0.0' } }));
+      fs.writeFileSync(path.join(tmpHome, 'go.mod'), 'module example.com/m\n');
+      const { detectProjectLang } = require('../detect-deps');
+      const langs = detectProjectLang(tmpHome);
+      expect(langs).toContain('typescript');
+      expect(langs).toContain('go');
+    });
+  });
+
   describe('checkCliTool', () => {
     const { execSync: realExecSync } = require('child_process');
 

package/lib/__tests__/doctor.test.js

@@ -931,4 +931,32 @@ describe('doctor', () => {
     const currentContent = fs.readFileSync(path.join(projectAdaptersDir(), 'gate-3.sh'), 'utf8');
     expect(currentContent).toBe(originalContent);
   });
+
+  it('--format json returns valid JSON with tools field', async () => {
+    setupLocalInstall();
+    seedVersionCache();
+    mockExecSuccess();
+    const { doctor } = require('../doctor');
+    const { formatDoctorJson } = require('../doctor');
+
+    const checks = [
+      { name: 'CLI tool: jscpd (Gate 2)', status: 'PASS', detail: 'v0.3.5' },
+      { name: 'CLI tool: lizard (Gate 3)', status: 'WARN', detail: 'Not found' },
+    ];
+    const json = formatDoctorJson(checks, 1);
+    expect(json.ok).toBe(false);
+    expect(json.issues).toBe(1);
+    expect(json.checks).toHaveLength(2);
+    expect(json.missing_tools).toBeDefined();
+  });
+
+  it('--format json returns ok:true when no issues', async () => {
+    const { formatDoctorJson } = require('../doctor');
+    const checks = [
+      { name: 'CLI tool: jscpd (Gate 2)', status: 'PASS', detail: 'v0.3.5' },
+    ];
+    const json = formatDoctorJson(checks, 0);
+    expect(json.ok).toBe(true);
+    expect(json.issues).toBe(0);
+  });
 });

package/lib/__tests__/install-cmd.test.js

@@ -0,0 +1,41 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+describe('install-cmd', () => {
+  let tmpDir;
+  let consoleLogSpy;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-install-'));
+    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  it('exports install function', () => {
+    const { install } = require('../install-cmd');
+    expect(typeof install).toBe('function');
+  });
+
+  it('install accepts --global flag', async () => {
+    const { install } = require('../install-cmd');
+    const code = await install(['--global'], tmpDir);
+    expect(typeof code).toBe('number');
+  });
+
+  it('install runs without --global (local mode) in git repo', async () => {
+    // Simulate git repo
+    const gitDir = path.join(tmpDir, '.git');
+    fs.mkdirSync(gitDir, { recursive: true });
+    fs.mkdirSync(path.join(gitDir, 'hooks'), { recursive: true });
+
+    const { install } = require('../install-cmd');
+    const code = await install([], tmpDir);
+    expect(typeof code).toBe('number');
+  });
+});

package/lib/__tests__/uninstall.test.js

@@ -623,4 +623,57 @@ describe('uninstall', () => {
     // After successful uninstall, backup should be cleaned up
     expect(fs.existsSync(backupDir())).toBe(false);
   });
+
+  it('--purge in global mode removes ~/.xp-gate/ and ~/.config/xp-gate/ config dir', async () => {
+    setupGlobalInstall();
+    const expectedHooksPath = globalHooksDir();
+
+    const xpGateDir = path.join(tmpHome, '.xp-gate');
+    fs.mkdirSync(path.join(xpGateDir, 'reports', 'pre-commit'), { recursive: true });
+    fs.writeFileSync(path.join(xpGateDir, 'reports', 'pre-commit', 'test.json'), '{}');
+
+    mockExecGlobalHooksPath(expectedHooksPath);
+    const { uninstall } = require('../uninstall');
+
+    const result = await uninstall(['--purge']);
+
+    expect(result).toBe(0);
+    expect(fs.existsSync(xpGateDir)).toBe(false);
+    expect(fs.existsSync(path.join(tmpHome, '.config', 'xp-gate'))).toBe(false);
+  });
+
+  it('--purge in local mode removes project and global .xp-gate/ dirs', async () => {
+    setupLocalInstall();
+
+    const projectXpGate = path.join(tmpProject, '.xp-gate');
+    fs.mkdirSync(path.join(projectXpGate, 'quality-status'), { recursive: true });
+    fs.writeFileSync(path.join(projectXpGate, 'quality-status', 'main.json'), '{}');
+
+    const globalXpGate = path.join(tmpHome, '.xp-gate');
+    fs.mkdirSync(path.join(globalXpGate, 'reports', 'pre-commit'), { recursive: true });
+    fs.writeFileSync(path.join(globalXpGate, 'reports', 'pre-commit', 'test.json'), '{}');
+
+    mockExecSuccess();
+    const { uninstall } = require('../uninstall');
+
+    const result = await uninstall(['--purge']);
+
+    expect(result).toBe(0);
+    expect(fs.existsSync(projectXpGate)).toBe(false);
+    expect(fs.existsSync(globalXpGate)).toBe(false);
+    expect(fs.existsSync(path.join(tmpHome, '.config', 'xp-gate'))).toBe(false);
+  });
+
+  it('--purge --dry-run prints purge plan without deleting', async () => {
+    setupGlobalInstall();
+    mockExecGlobalHooksPath(globalHooksDir());
+    const { uninstall } = require('../uninstall');
+
+    const result = await uninstall(['--purge', '--dry-run']);
+
+    expect(result).toBe(0);
+    expect(fs.existsSync(globalHooksDir())).toBe(true);
+    expect(fs.existsSync(globalAdaptersDir())).toBe(true);
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Purge'));
+  });
 });

package/lib/__tests__/update-hooks.test.js

@@ -347,10 +347,12 @@ describe('updateHooks', () => {
 
   describe('getProjectHooksDir', () => {
     it('returns .git/hooks path under cwd', () => {
+      const gitDir = path.join(tmpProject, '.git');
+      fs.mkdirSync(gitDir, { recursive: true });
+      vi.spyOn(process, 'cwd').mockReturnValue(tmpProject);
       const mod = getModule();
-      const cwd = process.cwd();
       const result = mod.getProjectHooksDir();
-      expect(result).toBe(path.join(cwd, '.git', 'hooks'));
+      expect(result).toBe(path.join(tmpProject, '.git', 'hooks'));
     });
 
     it('throws when .git/ does not exist', () => {

package/lib/detect-deps.js

@@ -518,4 +518,6 @@ module.exports = {
   GATE_CLI_TOOLS,
   checkCliTool,
   getToolInstallCmd,
+  GATE_TOOLS: require('./gate-tools.js').GATE_TOOLS,
+  detectProjectLang: require('./gate-tools.js').detectProjectLang,
 };

package/lib/doctor.js

@@ -804,6 +804,18 @@ async function doctor(args) {
   return issues > 0 ? 1 : 0;
 }
 
+function formatDoctorJson(checks, issues) {
+  const missing_tools = checks
+    .filter(c => c.status === 'WARN' || c.status === 'FAIL')
+    .map(c => ({ name: c.name, detail: c.detail }));
+  return {
+    ok: issues === 0,
+    issues,
+    checks: checks.map(c => ({ name: c.name, status: c.status, detail: c.detail })),
+    missing_tools,
+  };
+}
+
 module.exports = {
   doctor, isXpGateFile, SIGNATURES,
   fixVersionMismatch,
@@ -815,4 +827,5 @@ module.exports = {
   fixTuiRegistration,
   ensureTuiRegistration,
   readTuiJson,
+  formatDoctorJson,
 };

package/lib/gate-tools.js

@@ -0,0 +1,87 @@
+const fs = require('fs');
+const path = require('path');
+
+const GATE_TOOLS = {
+  PLATFORM: ['jscpd', 'lizard', 'semgrep', 'gitleaks', 'npx'],
+  IAC: ['checkov', 'hadolint', 'kube-score', 'tflint'],
+
+  LANG_MAP: {
+    ts: 'typescript', py: 'python', go: 'go', java: 'java',
+    kt: 'kotlin', cpp: 'cpp', swift: 'swift', dart: 'dart',
+    flutter: 'flutter', sh: 'shell', ps: 'powershell', objc: 'objectivec',
+  },
+
+  LINT: {
+    typescript: ['biome', 'eslint', 'tsc'],
+    python: ['ruff', 'flake8', 'mypy', 'black', 'isort'],
+    go: ['golangci-lint', 'go'],
+    java: ['checkstyle', 'pmd'],
+    kotlin: ['ktlint', 'detekt'],
+    cpp: ['clang-tidy', 'cppcheck', 'cmake'],
+    swift: ['swiftlint', 'swift'],
+    dart: ['dart'],
+    flutter: ['flutter'],
+    shell: ['shellcheck'],
+    powershell: ['pwsh'],
+    objectivec: ['oclint'],
+  },
+
+  TEST: {
+    typescript: ['vitest', 'jest'],
+    python: ['pytest'],
+    go: ['go'],
+    java: ['mvn', 'gradle'],
+    kotlin: ['mvn', 'gradle'],
+    swift: ['swift'],
+    cpp: ['ctest', 'gcovr'],
+    dart: ['dart'],
+    flutter: ['flutter'],
+  },
+
+  MUTATION: {
+    typescript: ['stryker'],
+    python: ['mutmut'],
+    go: ['gomutants'],
+    java: ['pitest'],
+  },
+
+  SPECIAL: {
+    jq: { gate: 'MW', desc: 'code-walkthrough JSON parser (mandatory)' },
+    tsx: { gate: 'M/M3/4/6', desc: 'TypeScript executor (via npx)' },
+    node: { gate: '0/4/6/M/M3', desc: 'All TypeScript gate runtime' },
+  },
+};
+
+const LANG_MARKERS = [
+  { file: 'tsconfig.json', lang: 'typescript' },
+  { file: 'package.json', check: (p) => {
+    try {
+      const json = JSON.parse(fs.readFileSync(p, 'utf8'));
+      return !!(json.devDependencies && json.devDependencies.typescript)
+        || !!(json.dependencies && json.dependencies.typescript);
+    } catch { return false; }
+  }, lang: 'typescript' },
+  { file: 'go.mod', lang: 'go' },
+  { file: 'pyproject.toml', lang: 'python' },
+  { file: 'manage.py', lang: 'python' },
+  { file: 'requirements.txt', lang: 'python' },
+  { file: 'pom.xml', lang: 'java' },
+  { file: 'build.gradle', lang: 'java' },
+  { file: 'build.gradle.kts', lang: 'kotlin' },
+  { file: 'pubspec.yaml', lang: 'flutter' },
+  { file: 'CMakeLists.txt', lang: 'cpp' },
+  { file: 'Package.swift', lang: 'swift' },
+];
+
+function detectProjectLang(projectRoot) {
+  const found = new Set();
+  const exists = (f) => fs.existsSync(path.join(projectRoot, f));
+  for (const marker of LANG_MARKERS) {
+    if (!exists(marker.file)) continue;
+    if (marker.check && !marker.check(path.join(projectRoot, marker.file))) continue;
+    found.add(marker.lang);
+  }
+  return [...found];
+}
+
+module.exports = { GATE_TOOLS, detectProjectLang };

package/lib/init.js

@@ -2,6 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { checkDeps, checkBash, autoInstallDeps, detectPlatform, GATE_CLI_TOOLS, checkCliTool } = require('./detect-deps.js');
+const { copyHooks, copyAdapters } = require('./shared-utils.js');
 const {
   HOME_DIR,
   CONFIG_DIR,
@@ -11,42 +12,6 @@ const {
   GLOBAL_ADAPTERS_DIR,
 } = require('./shared-paths.js');
 
-function copyHooks(srcDir, destDir) {
-  ['pre-commit', 'pre-push'].forEach(hook => {
-    const src = path.join(srcDir, 'hooks', hook);
-    const dest = path.join(destDir, hook);
-    if (fs.existsSync(src)) {
-      fs.copyFileSync(src, dest);
-      fs.chmodSync(dest, 0o755);
-    }
-  });
-}
-
-function copyAdapters(srcDir, destDir) {
-  const adapterSrc = path.join(srcDir, 'adapter-common.sh');
-  if (fs.existsSync(adapterSrc)) {
-    fs.copyFileSync(adapterSrc, path.join(destDir, 'adapter-common.sh'));
-  }
-  const adaptersDir = path.join(srcDir, 'adapters');
-  if (fs.existsSync(adaptersDir)) {
-    fs.readdirSync(adaptersDir).forEach(f => {
-      if (f.endsWith('.sh')) {
-        fs.copyFileSync(path.join(adaptersDir, f), path.join(destDir, f));
-      }
-    });
-  }
-  // Copy gate scripts (gate-*.sh) from githooks/ source-of-truth to destDir.
-  // These are sourced by pre-commit via GATE_DIR which resolves to the adapter dir.
-  const githooksDir = path.resolve(srcDir, '..', '..', '..', 'githooks');
-  if (fs.existsSync(githooksDir)) {
-    fs.readdirSync(githooksDir).forEach(f => {
-      if (f.startsWith('gate-') && f.endsWith('.sh')) {
-        fs.copyFileSync(path.join(githooksDir, f), path.join(destDir, f));
-      }
-    });
-  }
-}
-
 function copyRecursive(src, dest) {
   const stat = fs.statSync(src);
   if (stat.isDirectory()) {