@boyingliu01/xp-gate 0.18.5 → 0.19.0

package/adapter-common.sh

@@ -27,6 +27,17 @@ detect_os_env() {
     esac
 }
 
+# Git exports repository-local variables to hooks. Child test processes must
+# not inherit them, or nested git repositories modify the caller's repository.
+run_without_git_context() (
+  unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_CONFIG GIT_CONFIG_PARAMETERS
+  unset GIT_CONFIG_COUNT GIT_OBJECT_DIRECTORY GIT_DIR GIT_WORK_TREE
+  unset GIT_IMPLICIT_WORK_TREE GIT_GRAFT_FILE GIT_INDEX_FILE
+  unset GIT_NO_REPLACE_OBJECTS GIT_REPLACE_REF_BASE GIT_PREFIX
+  unset GIT_SHALLOW_FILE GIT_COMMON_DIR
+  "$@"
+)
+
 detect_project_lang() {
   if [ -f "tsconfig.json" ]; then
     echo "typescript"
@@ -241,6 +252,22 @@ detect_go_mutation_testable() {
   fi
   return 1
 }
+
+# Check if any changed file matches any of the given regex patterns.
+# Usage: any_changed_files_match "\.ts$" "\.py$"
+# Returns 0 (true) if at least one changed file matches any pattern, 1 (false) otherwise.
+any_changed_files_match() {
+  if [ -z "${CHANGED_FILES:-}" ]; then
+    return 1
+  fi
+  for pattern in "$@"; do
+    if echo "$CHANGED_FILES" | grep -qE "$pattern" 2>/dev/null; then
+      return 0
+    fi
+  done
+  return 1
+}
+
 # Detect if a Java/Kotlin project has PITest (pitest-maven or pitest-gradle) configured
 detect_pitest_testable() {
   # Check for Maven + pitest-maven plugin

package/adapters/powershell.sh

@@ -29,14 +29,57 @@ _detect_pwsh() {
   fi
 }
 
+_find_powershell_files() {
+  local name_pattern="$1"
+  find . \
+    \( -type d \( \
+      -name .git -o \
+      -name node_modules -o \
+      -name dist -o \
+      -name coverage -o \
+      -path './plugins/claude-code/skills' -o \
+      -path './plugins/opencode/skills' -o \
+      -path './plugins/qoder/skills' -o \
+      -path './src/npm-package/skills' -o \
+      -path './src/npm-package/plugins' \
+    \) -prune \) -o \
+    \( -type f -name "$name_pattern" -print \) 2>/dev/null
+}
+
+_powershell_invocation() {
+  local executable="$1"
+  POWERSHELL_ARGS=(-NoProfile)
+  case "${executable##*/}" in
+    powershell.exe|powershell)
+      POWERSHELL_ARGS[${#POWERSHELL_ARGS[@]}]=-ExecutionPolicy
+      POWERSHELL_ARGS[${#POWERSHELL_ARGS[@]}]=Bypass
+      ;;
+  esac
+  POWERSHELL_ARGS[${#POWERSHELL_ARGS[@]}]=-Command
+}
+
+_powershell_path_array() {
+  local path
+  local separator=""
+  printf '@('
+  for path in "$@"; do
+    path=${path//\'/\'\'}
+    printf "%s'%s'" "$separator" "$path"
+    separator=","
+  done
+  printf ')'
+}
+
 run_static_analysis() {
   local PWSH
   PWSH=$(_detect_pwsh)
   if [ -n "$PWSH" ]; then
+    local POWERSHELL_ARGS
+    _powershell_invocation "$PWSH"
     echo "Running PSScriptAnalyzer static analysis on PowerShell scripts..."
     # Recursively analyze all .ps1 files from repo root
     # Exit with non-zero if Error or Warning severity issues found
-    "$PWSH" -NoProfile -Command "
+    "$PWSH" "${POWERSHELL_ARGS[@]}" "
       \$results = Invoke-ScriptAnalyzer -Path . -Recurse -Severity Error,Warning
       if (\$results) {
         \$results | Format-Table -AutoSize
@@ -64,30 +107,24 @@ run_tests() {
     return 0
   fi
 
-  # Check if Pester tests exist in common locations
-  local test_paths=""
-  if [ -d "tests" ]; then
-    test_paths="tests/"
-  elif [ -d "test" ]; then
-    test_paths="test/"
-  fi
+  local POWERSHELL_ARGS
+  _powershell_invocation "$PWSH"
 
-  if [ -n "$test_paths" ] && find "$test_paths" -name "*.Tests.ps1" -type f 2>/dev/null | sed -n '1p; 1q' | grep -q "."; then
+  local test_files=()
+  local discovery_file
+  local path
+  local test_paths
+  discovery_file=$(mktemp)
+  _find_powershell_files "*.Tests.ps1" > "$discovery_file"
+  while IFS= read -r path; do
+    test_files[${#test_files[@]}]="$path"
+  done < "$discovery_file"
+  rm -f "$discovery_file"
+  if [ "${#test_files[@]}" -gt 0 ]; then
+    test_paths=$(_powershell_path_array "${test_files[@]}")
     echo "Running Pester tests..."
-    "$PWSH" -NoProfile -Command "
-      \$results = Invoke-Pester -Path '$test_paths' -PassThru
-      if (\$results.FailedCount -gt 0) {
-        Write-Host \"FAILED: \$(\$results.FailedCount) test(s)\"
-        exit 1
-      }
-      Write-Host \"PASSED: \$(\$results.PassedCount) test(s)\"
-      exit 0
-    "
-    return $?
-  elif find . -maxdepth 2 -name "*.Tests.ps1" -type f 2>/dev/null | sed -n '1p; 1q' | grep -q "."; then
-    echo "Running Pester tests in current directory..."
-    "$PWSH" -NoProfile -Command "
-      \$results = Invoke-Pester -CI -PassThru
+    "$PWSH" "${POWERSHELL_ARGS[@]}" "
+      \$results = Invoke-Pester -Path $test_paths -PassThru
       if (\$results.FailedCount -gt 0) {
         Write-Host \"FAILED: \$(\$results.FailedCount) test(s)\"
         exit 1
@@ -110,18 +147,32 @@ run_coverage() {
     return 0
   fi
 
-  local test_paths=""
-  if [ -d "tests" ]; then
-    test_paths="tests/"
-  elif [ -d "test" ]; then
-    test_paths="test/"
-  fi
+  local POWERSHELL_ARGS
+  _powershell_invocation "$PWSH"
 
-  if [ -n "$test_paths" ] || find . -maxdepth 2 -name "*.Tests.ps1" -type f 2>/dev/null | sed -n '1p; 1q' | grep -q "."; then
+  local test_files=()
+  local source_files=()
+  local discovery_file
+  local path
+  local test_paths
+  local coverage_paths
+  discovery_file=$(mktemp)
+  _find_powershell_files "*.Tests.ps1" > "$discovery_file"
+  # Discovery is line-delimited; filenames containing newlines are unsupported.
+  while IFS= read -r path; do
+    test_files[${#test_files[@]}]="$path"
+  done < "$discovery_file"
+  if [ "${#test_files[@]}" -gt 0 ]; then
+    _find_powershell_files "*.ps1" | grep -v '\.Tests\.ps1$' > "$discovery_file"
+    while IFS= read -r path; do
+      source_files[${#source_files[@]}]="$path"
+    done < "$discovery_file"
+    rm -f "$discovery_file"
+    test_paths=$(_powershell_path_array "${test_files[@]}")
+    coverage_paths=$(_powershell_path_array "${source_files[@]}")
     echo "Running Pester with code coverage..."
-    local path_arg="${test_paths:-.}"
-    "$PWSH" -NoProfile -Command "
-      \$results = Invoke-Pester -Path '$path_arg' -CodeCoverage @(Get-ChildItem -Path . -Filter *.ps1 -Recurse -Exclude *.Tests.ps1) -PassThru
+    "$PWSH" "${POWERSHELL_ARGS[@]}" "
+      \$results = Invoke-Pester -Path $test_paths -CodeCoverage $coverage_paths -PassThru
       \$pct = [math]::Round(\$results.CodeCoverage.CoveragePercent, 1)
       Write-Host \"Coverage: \$pct%\"
       if (\$pct -lt 80) {
@@ -132,6 +183,7 @@ run_coverage() {
     " 2>&1
     return $?
   else
+    rm -f "$discovery_file"
     echo "No Pester tests found for coverage measurement"
     return 0
   fi

package/adapters/typescript.sh

@@ -107,10 +107,10 @@ run_lint() {
 run_tests() {
   if command -v npx >/dev/null 2>&1; then
     echo "Running TypeScript tests..."
-    if npx vitest --version >/dev/null 2>&1; then
-      npx vitest run
-    elif npx jest --version >/dev/null 2>&1; then
-      npx jest --passWithNoTests
+    if run_without_git_context npx vitest --version >/dev/null 2>&1; then
+      run_without_git_context npx vitest run
+    elif run_without_git_context npx jest --version >/dev/null 2>&1; then
+      run_without_git_context npx jest --passWithNoTests
     else
       echo "No test runner available (vitest or jest required)"
       return 1
@@ -125,10 +125,10 @@ run_tests() {
 run_coverage() {
   if command -v npx >/dev/null 2>&1; then
     echo "Running TypeScript coverage..."
-    if npx vitest --version >/dev/null 2>&1; then
-      npx vitest run --coverage
-    elif npx jest --version >/dev/null 2>&1; then
-      npx jest --coverage
+    if run_without_git_context npx vitest --version >/dev/null 2>&1; then
+      run_without_git_context npx vitest run --coverage
+    elif run_without_git_context npx jest --version >/dev/null 2>&1; then
+      run_without_git_context npx jest --coverage
     else
       echo "No test runner available for coverage"
       return 1

package/build-integrity/__tests__/import-resolver.test.ts

@@ -321,6 +321,28 @@ describe('runImportCheck', () => {
     expect(result.violations[0].reason).toMatch(/not found|does not exist|missing/i);
   });
 
+  it('skips YAML files containing JavaScript-like require text', async () => {
+    const workflowDir = path.join(tmpDir, '.github', 'workflows');
+    await fs.mkdir(workflowDir, { recursive: true });
+
+    const workflowFile = path.join(workflowDir, 'cross-platform-ci.yml');
+    await fs.writeFile(workflowFile, `run: node -e "require('../test')"\n`);
+
+    const result = await runImportCheck([workflowFile], tmpDir, 30000);
+    expect(result.status).toBe('pass');
+    expect(result.violations).toEqual([]);
+  });
+
+  it('still reports missing relative imports in supported JavaScript modules', async () => {
+    const sourceFile = path.join(tmpDir, 'source.mjs');
+    await fs.writeFile(sourceFile, `import './missing.js';\n`);
+
+    const result = await runImportCheck([sourceFile], tmpDir, 30000);
+    expect(result.status).toBe('fail');
+    expect(result.violations).toHaveLength(1);
+    expect(result.violations[0].importPath).toBe('./missing.js');
+  });
+
   it('returns pass when only bare npm imports are used', async () => {
     const srcDir = path.join(tmpDir, 'src');
     await fs.mkdir(srcDir);

package/build-integrity/__tests__/orchestrator.test.ts

@@ -12,7 +12,7 @@ import os from 'os';
 
 import { runGate10, main } from '../gate-10';
 
-vi.setConfig({ testTimeout: 30000 });
+vi.setConfig({ testTimeout: 90000 });
 
 describe('runGate10', () => {
   let tmpDir: string;
@@ -215,7 +215,6 @@ describe('runGate10', () => {
  */
 describe('main', () => {
   let tmpDir: string;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   let consoleSpy: any;
 
   beforeEach(async () => {

package/build-integrity/gate-10.ts

@@ -38,6 +38,11 @@ import type {
  */
 
 const execFileAsync = promisify(execFile);
+const SUPPORTED_MODULE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+
+function isSupportedModuleFile(file: string): boolean {
+  return SUPPORTED_MODULE_EXTENSIONS.has(path.extname(file));
+}
 
 /**
  * Gate 10: Build Integrity Check — TypeScript compilation verification.
@@ -303,6 +308,8 @@ export async function runImportCheck(
     const fsSync = fsNative;
 
   for (const file of changedFiles) {
+    if (!isSupportedModuleFile(file)) continue;
+
     // Skip test files — they contain intentionally broken imports for unit testing.
     // The published npm package does not include __tests__ directories.
     if (file.includes('__tests__')) continue;

package/gate-12-file-hygiene.sh

@@ -0,0 +1,230 @@
+# ============================================================================
+# GATE 12: File Hygiene Check
+# Detects common file quality issues in staged files:
+# - Trailing whitespace
+# - Missing EOF newline
+# - Merge conflict markers (<<<<<<< , =======, >>>>>>>)
+# - Oversized files (>1MB default, configurable)
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 12: File hygiene check..."
+GATE_12_START=$(gate_start_ms)
+
+# Configuration (can be overridden via environment)
+MAX_FILE_SIZE_BYTES="${XP_GATE_MAX_FILE_SIZE:-1048576}"  # 1MB default
+
+# Get list of staged files (excluding deleted files)
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=d 2>/dev/null)
+
+if [ -z "$STAGED_FILES" ]; then
+  echo "     ℹ️  No staged files — skipping"
+  echo "     ✅ PASSED - File Hygiene (no files to check)"
+  GATE_12_STATUS="SKIP"
+  record_gate_audit "gate-12" "file-hygiene" "$GATE_12_STATUS" "0" "$GATE_12_START"
+  return 0 2>/dev/null || true
+fi
+
+HYGIENE_ISSUES=0
+HYGIENE_FILES=""
+
+# --- Check 1: Trailing whitespace ---
+TRAILING_WS_FILES=""
+while IFS= read -r file; do
+  [ -z "$file" ] && continue
+  # Skip binary files by checking if file contains null bytes
+  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+    continue
+  fi
+  # Check staged content for trailing whitespace (spaces/tabs at end of lines)
+  if git show ":$file" 2>/dev/null | grep -qE '[[:space:]]$'; then
+    TRAILING_WS_FILES="$TRAILING_WS_FILES $file"
+  fi
+done <<EOF
+$STAGED_FILES
+EOF
+
+if [ -n "$TRAILING_WS_FILES" ]; then
+  echo "     ⚠️  Trailing whitespace detected in:"
+  for f in $TRAILING_WS_FILES; do
+    echo "        - $f"
+  done
+  HYGIENE_ISSUES=$((HYGIENE_ISSUES + 1))
+  HYGIENE_FILES="$HYGIENE_FILES trailing-whitespace"
+fi
+
+# --- Check 2: Missing EOF newline ---
+NO_EOF_NEWLINE_FILES=""
+while IFS= read -r file; do
+  [ -z "$file" ] && continue
+  # Skip binary files
+  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+    continue
+  fi
+  # Check if file content ends with newline
+  FILE_CONTENT=$(git show ":$file" 2>/dev/null)
+  if [ -n "$FILE_CONTENT" ]; then
+    LAST_CHAR=$(printf '%s' "$FILE_CONTENT" | tail -c 1)
+    if [ "$LAST_CHAR" != "" ]; then
+      NO_EOF_NEWLINE_FILES="$NO_EOF_NEWLINE_FILES $file"
+    fi
+  fi
+done <<EOF
+$STAGED_FILES
+EOF
+
+if [ -n "$NO_EOF_NEWLINE_FILES" ]; then
+  echo "     ⚠️  Missing EOF newline in:"
+  for f in $NO_EOF_NEWLINE_FILES; do
+    echo "        - $f"
+  done
+  HYGIENE_ISSUES=$((HYGIENE_ISSUES + 1))
+  HYGIENE_FILES="$HYGIENE_FILES no-eof-newline"
+fi
+
+# --- Check 3: Merge conflict markers ---
+CONFLICT_MARKER_FILES=""
+while IFS= read -r file; do
+  [ -z "$file" ] && continue
+  # Skip binary files
+  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+    continue
+  fi
+  # Check for conflict markers in staged content
+  if git show ":$file" 2>/dev/null | grep -qE '^(<<<<<<<|=======|>>>>>>>)'; then
+    CONFLICT_MARKER_FILES="$CONFLICT_MARKER_FILES $file"
+  fi
+done <<EOF
+$STAGED_FILES
+EOF
+
+if [ -n "$CONFLICT_MARKER_FILES" ]; then
+  echo "     ❌ Merge conflict markers detected in:"
+  for f in $CONFLICT_MARKER_FILES; do
+    echo "        - $f"
+  done
+  HYGIENE_ISSUES=$((HYGIENE_ISSUES + 1))
+  HYGIENE_FILES="$HYGIENE_FILES conflict-markers"
+fi
+
+# --- Check 4: Oversized files ---
+OVERSIZED_FILES=""
+while IFS= read -r file; do
+  [ -z "$file" ] && continue
+  [ ! -f "$file" ] && continue
+  FILE_SIZE=$(wc -c < "$file" 2>/dev/null | tr -d ' ')
+  if [ -n "$FILE_SIZE" ] && [ "$FILE_SIZE" -gt "$MAX_FILE_SIZE_BYTES" ]; then
+    SIZE_MB=$((FILE_SIZE / 1048576))
+    OVERSIZED_FILES="$OVERSIZED_FILES $file(${SIZE_MB}MB)"
+  fi
+done <<EOF
+$STAGED_FILES
+EOF
+
+if [ -n "$OVERSIZED_FILES" ]; then
+  echo "     ⚠️  Oversized files (>${MAX_FILE_SIZE_BYTES} bytes):"
+  for f in $OVERSIZED_FILES; do
+    echo "        - $f"
+  done
+  HYGIENE_ISSUES=$((HYGIENE_ISSUES + 1))
+  HYGIENE_FILES="$HYGIENE_FILES oversized-files"
+fi
+
+# --- Check 5: YAML/JSON syntax validation (Issue #351) ---
+# Only check staged YAML/JSON files that have changes
+YAML_JSON_ERRORS=""
+YAML_JSON_CHECK_COUNT=0
+
+# Detect available validators
+YAML_CMD=""
+if command -v python3 >/dev/null 2>&1; then
+  YAML_CMD="python3"
+elif command -v python >/dev/null 2>&1; then
+  YAML_CMD="python"
+fi
+
+JSON_CMD=""
+if command -v node >/dev/null 2>&1; then
+  JSON_CMD="node"
+elif command -v jq >/dev/null 2>&1; then
+  JSON_CMD="jq"
+fi
+
+while IFS= read -r file; do
+  [ -z "$file" ] && continue
+  [ ! -f "$file" ] && continue
+
+  case "$file" in
+    *.yml|*.yaml)
+      if [ -n "$YAML_CMD" ]; then
+        YAML_JSON_CHECK_COUNT=$((YAML_JSON_CHECK_COUNT + 1))
+        # Validate YAML syntax using Python's yaml module
+        YAML_ERROR=$(git show ":$file" 2>/dev/null | $YAML_CMD -c "
+import sys, yaml
+try:
+    yaml.safe_load(sys.stdin.read())
+except yaml.YAMLError as e:
+    print(str(e).split(chr(10))[0])
+    sys.exit(1)
+except Exception:
+    pass
+" 2>&1)
+        if [ $? -ne 0 ] && [ -n "$YAML_ERROR" ]; then
+          YAML_JSON_ERRORS="$YAML_JSON_ERRORS $file(yaml:$YAML_ERROR)"
+        fi
+      fi
+      ;;
+    *.json)
+      YAML_JSON_CHECK_COUNT=$((YAML_JSON_CHECK_COUNT + 1))
+      if [ "$JSON_CMD" = "node" ]; then
+        JSON_ERROR=$(git show ":$file" 2>/dev/null | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{JSON.parse(d)}catch(e){console.log(e.message.split('\\n')[0]);process.exit(1)}})
+" 2>&1)
+        if [ $? -ne 0 ] && [ -n "$JSON_ERROR" ]; then
+          YAML_JSON_ERRORS="$YAML_JSON_ERRORS $file(json:$JSON_ERROR)"
+        fi
+      elif [ "$JSON_CMD" = "jq" ]; then
+        JSON_ERROR=$(git show ":$file" 2>/dev/null | jq empty 2>&1)
+        if [ $? -ne 0 ] && [ -n "$JSON_ERROR" ]; then
+          YAML_JSON_ERRORS="$YAML_JSON_ERRORS $file(json:syntax error)"
+        fi
+      fi
+      ;;
+  esac
+done <<EOF
+$STAGED_FILES
+EOF
+
+if [ -n "$YAML_JSON_ERRORS" ]; then
+  echo "     ❌ YAML/JSON syntax errors:"
+  for f in $YAML_JSON_ERRORS; do
+    echo "        - $f"
+  done
+  HYGIENE_ISSUES=$((HYGIENE_ISSUES + 1))
+  HYGIENE_FILES="$HYGIENE_FILES yaml-json-syntax"
+elif [ "$YAML_JSON_CHECK_COUNT" -gt 0 ]; then
+  echo "     ✅ YAML/JSON syntax OK ($YAML_JSON_CHECK_COUNT file(s) checked)"
+fi
+
+# --- Result ---
+if [ "$HYGIENE_ISSUES" -eq 0 ]; then
+  echo "     ✅ PASSED - No file hygiene issues detected."
+  GATE_12_STATUS="PASS"
+else
+  # Hard blocks: conflict markers + YAML/JSON syntax errors
+  if [ -n "$CONFLICT_MARKER_FILES" ] || [ -n "$YAML_JSON_ERRORS" ]; then
+    echo ""
+    echo "❌ BLOCKED - File hygiene violations must be fixed before commit."
+    GATE_12_STATUS="BLOCK"
+    record_gate_audit "gate-12" "file-hygiene" "$GATE_12_STATUS" "$HYGIENE_ISSUES" "$GATE_12_START"
+    exit 1
+  else
+    echo ""
+    echo "     ⚠️  WARNINGS - $HYGIENE_ISSUES file hygiene issue(s) found."
+    echo "     Fix recommended but not blocking (no conflict markers or syntax errors)."
+    echo "     Issues:$HYGIENE_FILES"
+    GATE_12_STATUS="WARN"
+  fi
+fi
+
+record_gate_audit "gate-12" "file-hygiene" "$GATE_12_STATUS" "$HYGIENE_ISSUES" "$GATE_12_START"

package/hooks/adapter-common.sh

@@ -27,6 +27,17 @@ detect_os_env() {
     esac
 }
 
+# Git exports repository-local variables to hooks. Child test processes must
+# not inherit them, or nested git repositories modify the caller's repository.
+run_without_git_context() (
+  unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_CONFIG GIT_CONFIG_PARAMETERS
+  unset GIT_CONFIG_COUNT GIT_OBJECT_DIRECTORY GIT_DIR GIT_WORK_TREE
+  unset GIT_IMPLICIT_WORK_TREE GIT_GRAFT_FILE GIT_INDEX_FILE
+  unset GIT_NO_REPLACE_OBJECTS GIT_REPLACE_REF_BASE GIT_PREFIX
+  unset GIT_SHALLOW_FILE GIT_COMMON_DIR
+  "$@"
+)
+
 detect_project_lang() {
   if [ -f "tsconfig.json" ]; then
     echo "typescript"
@@ -241,6 +252,22 @@ detect_go_mutation_testable() {
   fi
   return 1
 }
+
+# Check if any changed file matches any of the given regex patterns.
+# Usage: any_changed_files_match "\.ts$" "\.py$"
+# Returns 0 (true) if at least one changed file matches any pattern, 1 (false) otherwise.
+any_changed_files_match() {
+  if [ -z "${CHANGED_FILES:-}" ]; then
+    return 1
+  fi
+  for pattern in "$@"; do
+    if echo "$CHANGED_FILES" | grep -qE "$pattern" 2>/dev/null; then
+      return 0
+    fi
+  done
+  return 1
+}
+
 # Detect if a Java/Kotlin project has PITest (pitest-maven or pitest-gradle) configured
 detect_pitest_testable() {
   # Check for Maven + pitest-maven plugin