@boyingliu01/xp-gate 0.14.30 → 0.15.0

package/adapters/java.sh

@@ -79,16 +79,45 @@ run_tests() {
   fi
 }
 
+_detect_jacoco_configured() {
+  local build_system="$1"
+  if [ "$build_system" = "maven" ]; then
+    # Check for jacoco-maven-plugin in pom.xml
+    grep -q 'jacoco-maven-plugin\|org.jacoco' pom.xml 2>/dev/null && return 0
+    # Check for jacoco.xml report already generated
+    [ -f "target/site/jacoco/jacoco.xml" ] && return 0
+    return 1
+  elif [ "$build_system" = "gradle" ]; then
+    # Check for jacoco plugin in build.gradle or build.gradle.kts
+    grep -q "id.*jacoco\|apply.*plugin.*jacoco\|jacoco" build.gradle build.gradle.kts 2>/dev/null && return 0
+    [ -f "build/reports/jacoco/test/jacocoTestReport.xml" ] && return 0
+    return 1
+  fi
+  return 1
+}
+
 run_coverage() {
   local build_system
   build_system=$(_detect_java_build)
 
   if [ "$build_system" = "maven" ]; then
-    mvn test jacoco:report -q 2>&1 | tail -10
-    return "${PIPESTATUS[0]}"
+    if _detect_jacoco_configured "$build_system"; then
+      mvn test jacoco:report -q 2>&1 | tail -10
+      return "${PIPESTATUS[0]}"
+    else
+      echo "ℹ️  JaCoCo not configured in pom.xml — SKIP coverage check"
+      echo "   To enable: add jacoco-maven-plugin to your pom.xml"
+      return 0
+    fi
   elif [ "$build_system" = "gradle" ]; then
-    gradle jacocoTestReport --quiet 2>&1 | tail -10
-    return "${PIPESTATUS[0]}"
+    if _detect_jacoco_configured "$build_system"; then
+      gradle jacocoTestReport --quiet 2>&1 | tail -10
+      return "${PIPESTATUS[0]}"
+    else
+      echo "ℹ️  JaCoCo not configured in Gradle build — SKIP coverage check"
+      echo "   To enable: add 'id \"jacoco\"' to your build.gradle plugins block"
+      return 0
+    fi
   else
     echo "No Maven/Gradle project detected"
     return 1

package/gate-9.sh

@@ -44,57 +44,31 @@ else
       GATE_9_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
-      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    results = data.get('results', [])
-    count = 0
-    for r in results:
-        extra = r.get('extra', {})
-        severity = extra.get('severity', '').upper()
-        if severity in ('CRITICAL', 'HIGH'):
-            count += 1
-    print(count)
-except:
-    print('0')
-" 2>/dev/null || echo "0")
+      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
 
-      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    results = data.get('results', [])
-    count = 0
-    for r in results:
-        extra = r.get('extra', {})
-        severity = extra.get('severity', '').upper()
-        if severity in ('MEDIUM', 'LOW'):
-            count += 1
-    print(count)
-except:
-    print('0')
-" 2>/dev/null || echo "0")
+      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
 
       # Extract top finding details
-      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    results = data.get('results', [])
-    for r in results[:5]:  # Show top 5
-        extra = r.get('extra', {})
-        severity = extra.get('severity', 'UNKNOWN').upper()
-        rule_id = r.get('check_id', 'unknown')
-        path = r.get('path', 'unknown')
-        start_line = r.get('start', {}).get('line', '?')
-        message = extra.get('message', '')[:80]
-        print(f'  [{severity}] {rule_id}')
-        print(f'  {path}:{start_line} → {message}')
-        print()
-except:
-    print('  (Failed to parse semgrep output)')
-" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};
+const severity=(extra.severity||'UNKNOWN').toUpperCase();
+const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
+const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
+console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
+}catch(e){console.log('  (Failed to parse semgrep output)');}
+});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
 
       if [ "$CRITICAL_HIGH" -gt 0 ]; then
         echo ""

package/hooks/gate-9.sh

@@ -44,57 +44,31 @@ else
       GATE_9_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
-      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    results = data.get('results', [])
-    count = 0
-    for r in results:
-        extra = r.get('extra', {})
-        severity = extra.get('severity', '').upper()
-        if severity in ('CRITICAL', 'HIGH'):
-            count += 1
-    print(count)
-except:
-    print('0')
-" 2>/dev/null || echo "0")
+      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
 
-      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    results = data.get('results', [])
-    count = 0
-    for r in results:
-        extra = r.get('extra', {})
-        severity = extra.get('severity', '').upper()
-        if severity in ('MEDIUM', 'LOW'):
-            count += 1
-    print(count)
-except:
-    print('0')
-" 2>/dev/null || echo "0")
+      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
 
       # Extract top finding details
-      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    results = data.get('results', [])
-    for r in results[:5]:  # Show top 5
-        extra = r.get('extra', {})
-        severity = extra.get('severity', 'UNKNOWN').upper()
-        rule_id = r.get('check_id', 'unknown')
-        path = r.get('path', 'unknown')
-        start_line = r.get('start', {}).get('line', '?')
-        message = extra.get('message', '')[:80]
-        print(f'  [{severity}] {rule_id}')
-        print(f'  {path}:{start_line} → {message}')
-        print()
-except:
-    print('  (Failed to parse semgrep output)')
-" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};
+const severity=(extra.severity||'UNKNOWN').toUpperCase();
+const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
+const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
+console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
+}catch(e){console.log('  (Failed to parse semgrep output)');}
+});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
 
       if [ "$CRITICAL_HIGH" -gt 0 ]; then
         echo ""

package/hooks/pre-commit

@@ -212,13 +212,20 @@ if [ "$is_protected" = "true" ]; then
 
   # If either VERSION or CHANGELOG.md is staged, pass
   if [ "$has_version_change" = "true" ] || [ "$has_changelog_change" = "true" ]; then
-    # Auto-run sync-version.sh when VERSION is staged (issue #206 follow-up).
-    # Propagates VERSION → 4 package.json + refreshes 32 AGENTS.md headers,
-    # then stages only files sync-version.sh is known to touch (NOT runtime
+    # Auto-run sync-version when VERSION is staged (issue #206 follow-up).
+    # Propagates VERSION → 4 package.json + refreshes AGENTS.md headers,
+    # then stages only files sync-version is known to touch (NOT runtime
     # journals or unrelated edits) so the commit captures it atomically.
-    if [ "$has_version_change" = "true" ] && [ -f "$ROOT_DIR/scripts/sync-version.sh" ]; then
-      echo "🔄 Gate 0: VERSION staged — running sync-version.sh to fan out to package.json + AGENTS.md headers..."
-      if bash "$ROOT_DIR/scripts/sync-version.sh" > /tmp/xp-gate-sync-version.log 2>&1; then
+    # Prefer Node.js (.cjs) for cross-platform; fall back to bash (.sh).
+    SYNC_VERSION_CMD=""
+    if [ -f "$ROOT_DIR/scripts/sync-version.cjs" ] && command -v node >/dev/null 2>&1; then
+      SYNC_VERSION_CMD="node $ROOT_DIR/scripts/sync-version.cjs"
+    elif [ -f "$ROOT_DIR/scripts/sync-version.sh" ]; then
+      SYNC_VERSION_CMD="bash $ROOT_DIR/scripts/sync-version.sh"
+    fi
+    if [ "$has_version_change" = "true" ] && [ -n "$SYNC_VERSION_CMD" ]; then
+      echo "🔄 Gate 0: VERSION staged — running sync-version to fan out to package.json + AGENTS.md headers..."
+      if $SYNC_VERSION_CMD > /tmp/xp-gate-sync-version.log 2>&1; then
         SYNC_STAGED=0
         # Stage the 4 known package.json targets if modified
         for pkg in package.json src/npm-package/package.json \
@@ -238,9 +245,9 @@ if [ "$is_protected" = "true" ]; then
             SYNC_STAGED=$((SYNC_STAGED + 1))
           fi
         done < <(find "$ROOT_DIR" -name 'AGENTS.md' -not -path '*/node_modules/*' -not -path '*/.git/*' -print0)
-        echo "   auto-staged $SYNC_STAGED file(s) from sync-version.sh (package.json × ≤6 + AGENTS.md headers)"
+        echo "   auto-staged $SYNC_STAGED file(s) from sync-version (package.json × ≤6 + AGENTS.md headers)"
       else
-        echo "⚠️  sync-version.sh failed; see /tmp/xp-gate-sync-version.log — continuing without auto-sync"
+        echo "⚠️  sync-version failed; see /tmp/xp-gate-sync-version.log — continuing without auto-sync"
       fi
     fi
     echo "✅ PASSED - Gate 0: Version Consistency Check (VERSION/CHANGELOG staged)"
@@ -314,7 +321,7 @@ This bypasses the ship workflow and causes version drift.
 Before committing:
   1. Update VERSION file with new version
   2. Add entry to CHANGELOG.md
-  3. Run: bash scripts/sync-version.sh
+  3. Run: node scripts/sync-version.cjs
 
 Or use --no-verify (discouraged) or include [skip-version-check] in commit message.
 
@@ -347,13 +354,25 @@ fi
 # v0.15.1+; ARCH-03 fix), PROJECT_SUBDIRS (per-language subdir override, empty = root).
 # ============================================================================
 
-# XP_GATE_LANG env var override — skip all detection, use single language
-if [ -n "${XP_GATE_LANG:-}" ]; then
-  PROJECT_LANGS="$XP_GATE_LANG"
-  PROJECT_LANG="$XP_GATE_LANG"
+# Language override resolution (project-level > git config > env var)
+# Priority: .xp-gate-lang file > git config xp-gate.lang > XP_GATE_LANG env
+_RESOLVED_LANG_OVERRIDE=""
+if [ -f ".xp-gate-lang" ]; then
+  _RESOLVED_LANG_OVERRIDE=$(sed -n '1p' .xp-gate-lang 2>/dev/null | tr -d '[:space:]')
+elif git config xp-gate.lang >/dev/null 2>&1; then
+  _RESOLVED_LANG_OVERRIDE=$(git config xp-gate.lang 2>/dev/null)
+elif [ -n "${XP_GATE_LANG:-}" ]; then
+  _RESOLVED_LANG_OVERRIDE="$XP_GATE_LANG"
+  echo "⚠️  XP_GATE_LANG env var is deprecated for multi-project use."
+  echo "   Prefer: echo '$XP_GATE_LANG' > .xp-gate-lang  OR  git config xp-gate.lang $XP_GATE_LANG"
+fi
+
+if [ -n "$_RESOLVED_LANG_OVERRIDE" ]; then
+  PROJECT_LANGS="$_RESOLVED_LANG_OVERRIDE"
+  PROJECT_LANG="$_RESOLVED_LANG_OVERRIDE"
   echo ""
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "   🔧 XP_GATE_LANG OVERRIDE: $PROJECT_LANG"
+  echo "   🔧 LANGUAGE OVERRIDE: $PROJECT_LANG"
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo ""
 else
@@ -682,7 +701,7 @@ record_gate_audit() {
   local issues_found="$4"
   local start_ms="$5"
   local end_ms
-  end_ms=$(date +%s%3N 2>/dev/null || python3 -c "import time;print(int(time.time()*1000))" 2>/dev/null || echo "0")
+  end_ms=$(date +%s%3N 2>/dev/null || node -e "console.log(Date.now())" 2>/dev/null || echo "0")
   local duration_ms=$((end_ms - start_ms))
   if [ "$duration_ms" -lt 0 ] 2>/dev/null; then
     duration_ms=0
@@ -710,7 +729,7 @@ record_gate_audit() {
 
 # Get milliseconds timestamp (used by gates for duration measurement)
 gate_start_ms() {
-  date +%s%3N 2>/dev/null || python3 -c "import time;print(int(time.time()*1000))" 2>/dev/null || echo "0"
+  date +%s%3N 2>/dev/null || node -e "console.log(Date.now())" 2>/dev/null || echo "0"
 }
 
 # Switch to subdirectory if detected (for single-language subdirectory projects).
@@ -825,13 +844,13 @@ else
             # Compare against lint baseline
             BASELINE_WARNINGS=$(echo "$ESLINT_FILES" | tr ' ' '\n' | node -e "
               const fs=require('fs');const b=JSON.parse(fs.readFileSync('.xp-gate/lint-baseline.json','utf8'));
-              const stdin=require('fs').readFileSync('/dev/stdin','utf8').trim();
+              const stdin=require('fs').readFileSync(0,'utf8').trim();
               const files=stdin?stdin.split('\n'):[];
               let total=0;for(const f of files){if(b[f])total+=b[f].totalWarnings||0}
               console.log(total);
             ")
             CURRENT_WARNINGS=$(echo "$ESLINT_OUTPUT" | node -e "
-              const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
+              const d=JSON.parse(require('fs').readFileSync(0,'utf8'));
               console.log(d.reduce((s,f)=>s+(f.warningCount||0)+(f.errorCount||0),0));
             ")
             if [ "$CURRENT_WARNINGS" -gt "$BASELINE_WARNINGS" ]; then
@@ -900,6 +919,20 @@ else
         fi
       fi
     fi
+
+    # Debug statement detection (debugger statement in JS/TS)
+    TS_DEBUG_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx)$' || true)
+    if [ -n "$TS_DEBUG_FILES" ]; then
+      DEBUGGER_HITS=$(grep -n '^\s*debugger\s*;\?\s*$' $TS_DEBUG_FILES 2>/dev/null || true)
+      if [ -n "$DEBUGGER_HITS" ]; then
+        echo ""
+        echo "❌ BLOCKED - 'debugger' statements detected:"
+        echo "$DEBUGGER_HITS" | head -10
+        echo ""
+        echo "Remove debugger statements before committing."
+        exit 1
+      fi
+    fi
   fi
     ;;
     
@@ -920,19 +953,19 @@ else
         if [ -n "$PY_FILES" ]; then
           BASELINE_WARNINGS=$(echo "$PY_FILES" | node -e "
             const fs=require('fs');const b=JSON.parse(fs.readFileSync('.xp-gate/lint-baseline.json','utf8'));
-            const stdin=require('fs').readFileSync('/dev/stdin','utf8').trim();
+            const stdin=require('fs').readFileSync(0,'utf8').trim();
             const files=stdin?stdin.split('\n'):[];
             let total=0;for(const f of files){if(b[f])total+=b[f].totalWarnings||0}
             console.log(total);
           ")
           CURRENT_WARNINGS=$(echo "$RUFF_OUTPUT" | node -e "
-            const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
+            const d=JSON.parse(require('fs').readFileSync(0,'utf8'));
             console.log(d.reduce((s,f)=>s+(f.messages?f.messages.length:0),0));
           ")
           if [ "$CURRENT_WARNINGS" -gt "$BASELINE_WARNINGS" ]; then
             NEW_WARNINGS=$((CURRENT_WARNINGS - BASELINE_WARNINGS))
             echo "$RUFF_OUTPUT" | node -e "
-              const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
+              const d=JSON.parse(require('fs').readFileSync(0,'utf8'));
               for(const f of d){for(const m of f.messages||[]){console.log(m.kind+': '+m.message)}}
             " | head -30
             echo ""
@@ -952,7 +985,7 @@ else
         fi
       else
         echo "$RUFF_OUTPUT" | node -e "
-          const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
+          const d=JSON.parse(require('fs').readFileSync(0,'utf8'));
           for(const f of d){for(const m of f.messages||[]){console.log(m.kind+': '+m.message)}}
         " | head -30
         echo ""
@@ -965,6 +998,37 @@ else
     else
       echo "✅ PASSED - Ruff linting."
     fi
+
+    # Ruff format check (formatting gate)
+    if command -v ruff &> /dev/null; then
+      PY_FMT_FILES=$(echo "$CHANGED_FILES" | grep '\.py$' || true)
+      if [ -n "$PY_FMT_FILES" ]; then
+        RUFF_FMT_OUTPUT=$(ruff format --check $PY_FMT_FILES 2>&1)
+        RUFF_FMT_EXIT=$?
+        if [ "$RUFF_FMT_EXIT" -ne 0 ]; then
+          echo "$RUFF_FMT_OUTPUT" | head -20
+          echo ""
+          echo "❌ BLOCKED - Ruff format check failed"
+          echo "Fix formatting: run 'ruff format .' to auto-format."
+          exit 1
+        fi
+        echo "✅ PASSED - Ruff format check."
+      fi
+    fi
+
+    # Debug statement detection (breakpoint/pdb/ipdb)
+    PY_DEBUG_FILES=$(echo "$CHANGED_FILES" | grep '\.py$' || true)
+    if [ -n "$PY_DEBUG_FILES" ]; then
+      DEBUG_HITS=$(grep -n 'breakpoint()\|pdb\.set_trace()\|ipdb\.set_trace()\|import pdb\|import ipdb' $PY_DEBUG_FILES 2>/dev/null || true)
+      if [ -n "$DEBUG_HITS" ]; then
+        echo ""
+        echo "❌ BLOCKED - Debug statements detected in Python files:"
+        echo "$DEBUG_HITS" | head -10
+        echo ""
+        echo "Remove breakpoint()/pdb.set_trace() before committing."
+        exit 1
+      fi
+    fi
     
     # Optional: Type checking with mypy
     if command -v mypy &> /dev/null; then
@@ -1018,19 +1082,19 @@ else
       if [ -f ".xp-gate/lint-baseline.json" ] && command -v node &> /dev/null; then
         BASELINE_WARNINGS=$(echo "$SHELL_FILES" | node -e "
           const fs=require('fs');const b=JSON.parse(fs.readFileSync('.xp-gate/lint-baseline.json','utf8'));
-          const stdin=require('fs').readFileSync('/dev/stdin','utf8').trim();
+          const stdin=require('fs').readFileSync(0,'utf8').trim();
           const files=stdin?stdin.split('\n'):[];
           let total=0;for(const f of files){if(b[f])total+=b[f].totalWarnings||0}
           console.log(total);
         ")
         CURRENT_WARNINGS=$(echo "$SHELLCHECK_OUTPUT" | node -e "
-          const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
+          const d=JSON.parse(require('fs').readFileSync(0,'utf8'));
           console.log(d.length);
         ")
         if [ "$CURRENT_WARNINGS" -gt "$BASELINE_WARNINGS" ]; then
           NEW_WARNINGS=$((CURRENT_WARNINGS - BASELINE_WARNINGS))
           echo "$SHELLCHECK_OUTPUT" | node -e "
-            const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
+            const d=JSON.parse(require('fs').readFileSync(0,'utf8'));
             for(const i of d){console.log(i.file+':'+i.line+': '+i.level+': '+i.message)}
           " | head -30
           echo ""
@@ -1047,7 +1111,7 @@ else
         fi
       else
         echo "$SHELLCHECK_OUTPUT" | node -e "
-          const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
+          const d=JSON.parse(require('fs').readFileSync(0,'utf8'));
           for(const i of d){console.log(i.file+':'+i.line+': '+i.level+': '+i.message)}
         " | head -30
         echo ""
@@ -1476,6 +1540,13 @@ else
   # ========================================================================
   CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(test|spec)\.(ts|tsx|js|jsx|py|go)$' || true)
 
+  # Strip PROJECT_SUBDIR prefix from test file paths when running in subdirectory.
+  # git diff returns repo-root relative paths, but after cd "$PROJECT_SUBDIR" (line 728)
+  # vitest and [ -f ] checks need subdirectory-relative paths. (v0.14.31+ fix)
+  if [ -n "$PROJECT_SUBDIR" ] && [ "$PROJECT_SUBDIR" != "." ] && [ -n "$CHANGED_TEST_FILES" ]; then
+    CHANGED_TEST_FILES=$(echo "$CHANGED_TEST_FILES" | sed "s|^${PROJECT_SUBDIR}/||")
+  fi
+
   if [ -n "$CHANGED_TEST_FILES" ]; then
     echo "Checking mock density in test files..."
     for test_file in $CHANGED_TEST_FILES; do
@@ -1563,6 +1634,10 @@ else
           
           # Also get changed source files (non-test) for related-test lookup
           CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|tsx|js|jsx)$' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__tests__' | grep -v '\.d\.ts$' | grep -v '__snapshots__' || true)
+          # Strip PROJECT_SUBDIR prefix (same as CHANGED_TEST_FILES fix above)
+          if [ -n "$PROJECT_SUBDIR" ] && [ "$PROJECT_SUBDIR" != "." ] && [ -n "$CHANGED_SRC_FILES" ]; then
+            CHANGED_SRC_FILES=$(echo "$CHANGED_SRC_FILES" | sed "s|^${PROJECT_SUBDIR}/||")
+          fi
           CHANGED_SRC_COUNT=$(echo "$CHANGED_SRC_FILES" | grep -c '.' || echo "0")
           
           # Decide strategy
@@ -2447,24 +2522,7 @@ ENDJSON
   REPORT_TS=$(date -u +"%Y-%m-%d-%H%M%S")
   local PERSISTED_REPORT_FILE="${REPORTS_DIR}/${REPORT_TS}.json"
   mkdir -p "$REPORTS_DIR"
-  python3 - <<PY 2>/dev/null || cp "$REPORT_FILE" "$PERSISTED_REPORT_FILE"
-import json
-from pathlib import Path
-branch_report = json.loads(Path('$REPORT_FILE').read_text())
-changed_files = '''${CHANGED_FILES:-}'''.splitlines()
-report = {
-  'timestamp': '$TIMESTAMP',
-  'trigger': 'pre-commit',
-  'branch': '$BRANCH',
-  'commit': '$COMMIT_HASH',
-  'changed_files': [f for f in changed_files if f],
-  'overall': branch_report.get('overall', {}),
-  'gates': branch_report.get('gates', {}),
-  'warnings': [],
-  'errors': [],
-}
-Path('$PERSISTED_REPORT_FILE').write_text(json.dumps(report, indent=2) + '\n')
-PY
+  _XP_RF="$REPORT_FILE" _XP_PRF="$PERSISTED_REPORT_FILE" _XP_TS="$TIMESTAMP" _XP_BR="$BRANCH" _XP_CH="$COMMIT_HASH" _XP_CF="${CHANGED_FILES:-}" node -e "const fs=require('fs');const e=process.env;const br=JSON.parse(fs.readFileSync(e._XP_RF,'utf8'));const cf=(e._XP_CF||'').split('\n').filter(f=>f);const r={timestamp:e._XP_TS,trigger:'pre-commit',branch:e._XP_BR,commit:e._XP_CH,changed_files:cf,overall:br.overall||{},gates:br.gates||{},warnings:[],errors:[]};fs.writeFileSync(e._XP_PRF,JSON.stringify(r,null,2)+'\n');" 2>/dev/null || cp "$REPORT_FILE" "$PERSISTED_REPORT_FILE"
 
   # ── History append (unchanged — append-only for trend) ────────────────────────────
   local GATES_JSON="{"

package/hooks/pre-push

@@ -27,39 +27,7 @@ write_pre_push_report() {
   commit_hash=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
   verdict=$([ "$exit_code" -eq 0 ] && echo "PASS" || echo "BLOCKED")
   mkdir -p "$reports_dir"
-  python3 - <<PY 2>/dev/null || true
-import json
-from pathlib import Path
-pushed_files = '''${PUSHED_FILES:-}'''.splitlines()
-report = {
-  'timestamp': '$timestamp',
-  'trigger': 'pre-push',
-  'branch': '$CURRENT_BRANCH',
-  'commit': '$commit_hash',
-  'changed_files': [f for f in pushed_files if f],
-  'overall': {
-    'score': '10.0/10' if '$verdict' == 'PASS' else '0.0/10',
-    'gates_passed': 1 if '$verdict' == 'PASS' else 0,
-    'gates_total': 1,
-    'verdict': '$verdict',
-  },
-  'gates': [
-    {'id': '10', 'name': 'Build Integrity', 'status': '${GATE_10_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M', 'name': 'Mutation Testing', 'status': '${GATE_M_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M-Python', 'name': 'Mutation Testing (Python)', 'status': '${GATE_M_PYTHON_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M-Go', 'name': 'Mutation Testing (Go)', 'status': '${GATE_M_GO_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M-Java', 'name': 'Mutation Testing (Java)', 'status': '${GATE_M_JAVA_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M-Kotlin', 'name': 'Mutation Testing (Kotlin)', 'status': '${GATE_M_KOTLIN_STATUS:-SKIP}', 'details': {}},
-    {'id': 'MD', 'name': 'Mock Density', 'status': '${GATE_M2_STATUS:-SKIP}', 'details': {}},
-    {'id': 'ML', 'name': 'Mock Layering', 'status': '${GATE_M3_STATUS:-SKIP}', 'details': {}},
-    {'id': 'UI', 'name': 'UI Sprint Gates', 'status': '${GATE_UI_STATUS:-SKIP}', 'details': {}},
-    {'id': 'MW', 'name': 'Code Walkthrough', 'status': '${GATE_DELPHI_STATUS:-SKIP}', 'details': {'remote': '$REMOTE', 'url': '$URL'}}
-  ],
-  'warnings': [],
-  'errors': [] if '$verdict' == 'PASS' else ['pre-push hook exited with code $exit_code'],
-}
-Path('$report_file').write_text(json.dumps(report, indent=2) + '\n')
-PY
+  _XP_RF="$report_file" _XP_TS="$timestamp" _XP_BR="$CURRENT_BRANCH" _XP_CH="$commit_hash" _XP_PF="${PUSHED_FILES:-}" _XP_VD="$verdict" _XP_EC="$exit_code" _XP_G10="${GATE_10_STATUS:-SKIP}" _XP_GM="${GATE_M_STATUS:-SKIP}" _XP_GMP="${GATE_M_PYTHON_STATUS:-SKIP}" _XP_GMGO="${GATE_M_GO_STATUS:-SKIP}" _XP_GMJA="${GATE_M_JAVA_STATUS:-SKIP}" _XP_GMKO="${GATE_M_KOTLIN_STATUS:-SKIP}" _XP_GMD="${GATE_M2_STATUS:-SKIP}" _XP_GML="${GATE_M3_STATUS:-SKIP}" _XP_GUI="${GATE_UI_STATUS:-SKIP}" _XP_GMW="${GATE_DELPHI_STATUS:-SKIP}" _XP_RM="$REMOTE" _XP_URL="$URL" node -e "const fs=require('fs');const e=process.env;const pf=(e._XP_PF||'').split('\n').filter(f=>f);const r={timestamp:e._XP_TS,trigger:'pre-push',branch:e._XP_BR,commit:e._XP_CH,changed_files:pf,overall:{score:e._XP_VD==='PASS'?'10.0/10':'0.0/10',gates_passed:e._XP_VD==='PASS'?1:0,gates_total:1,verdict:e._XP_VD},gates:[{id:'10',name:'Build Integrity',status:e._XP_G10,details:{}},{id:'M',name:'Mutation Testing',status:e._XP_GM,details:{}},{id:'M-Python',name:'Mutation Testing (Python)',status:e._XP_GMP,details:{}},{id:'M-Go',name:'Mutation Testing (Go)',status:e._XP_GMGO,details:{}},{id:'M-Java',name:'Mutation Testing (Java)',status:e._XP_GMJA,details:{}},{id:'M-Kotlin',name:'Mutation Testing (Kotlin)',status:e._XP_GMKO,details:{}},{id:'MD',name:'Mock Density',status:e._XP_GMD,details:{}},{id:'ML',name:'Mock Layering',status:e._XP_GML,details:{}},{id:'UI',name:'UI Sprint Gates',status:e._XP_GUI,details:{}},{id:'MW',name:'Code Walkthrough',status:e._XP_GMW,details:{remote:e._XP_RM,url:e._XP_URL}}],warnings:[],errors:e._XP_VD==='PASS'?[]:['pre-push hook exited with code '+e._XP_EC]};fs.writeFileSync(e._XP_RF,JSON.stringify(r,null,2)+'\n');" 2>/dev/null || true
 }
 
 _pre_push_report_on_exit() {