@boyingliu01/xp-gate 0.18.5 → 0.19.0

package/hooks/gate-10.sh

@@ -0,0 +1,105 @@
+# shellcheck shell=bash
+# ============================================================================
+# GATE 10: Semgrep SAST Security Scan
+# Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
+# Tool: semgrep -- https://semgrep.dev
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 10: Semgrep SAST Security Scan..."
+GATE_10_START=$(gate_start_ms)
+
+GATE_10_STATUS=""
+
+# Semgrep availability check
+SEMGREP_CMD=""
+if command -v semgrep >/dev/null 2>&1; then
+  SEMGREP_CMD="semgrep"
+elif [ -f "$HOME/.local/bin/semgrep" ]; then
+  SEMGREP_CMD="$HOME/.local/bin/semgrep"
+fi
+
+if [ -z "$SEMGREP_CMD" ]; then
+  echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
+  echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
+  echo "     Pre-cache rules: semgrep --config=p/security-audit"
+  echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
+  GATE_10_STATUS="WARN"
+else
+  # Get staged files filtered to Semgrep-supported languages
+  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+
+  if [ -z "$SEMGREP_FILES" ]; then
+    echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
+    GATE_10_STATUS="SKIP"
+  else
+    # Run semgrep with JSON output
+    # --config=p/security-audit: explicit security ruleset
+    # --json: machine-readable output
+    # --disable-version-check: skip network call
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "$SEMGREP_FILES" 2>&1)
+    SEMGREP_EXIT=$?
+
+    if [ "$SEMGREP_EXIT" -eq 0 ]; then
+      echo "     ✅ PASSED - No security vulnerabilities found."
+      GATE_10_STATUS="PASS"
+    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
+      # Findings detected - parse JSON to categorize
+      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
+
+      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
+console.log(count);}catch(e){console.log('0');}
+});" 2>/dev/null || echo "0")
+
+      # Extract top finding details
+      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
+let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
+try{const data=JSON.parse(d);const results=data.results||[];
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};
+const severity=(extra.severity||'UNKNOWN').toUpperCase();
+const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
+const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
+console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
+}catch(e){console.log('  (Failed to parse semgrep output)');}
+});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+
+      if [ "$CRITICAL_HIGH" -gt 0 ]; then
+        echo ""
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "   GATE 10: Semgrep Security Gate"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
+        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  ❌ BLOCKED — Critical/High vulnerability found"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "$FINDING_DETAILS"
+        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+        GATE_10_STATUS="FAIL"
+        exit 1
+      else
+        echo ""
+        echo "     ✅ PASSED - No critical/high vulnerabilities"
+        if [ "$MEDIUM_LOW" -gt 0 ]; then
+          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
+          echo "$FINDING_DETAILS"
+        fi
+        GATE_10_STATUS="PASS"
+      fi
+    else
+      # semgrep runtime error (timeout, config error, etc.)
+      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
+      GATE_10_STATUS="SKIP"
+    fi
+  fi
+fi
+record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"

package/hooks/lib/validate-code-walkthrough.cjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+
+const REQUIRED_ROLES = ['architecture', 'technical', 'feasibility'];
+const VALIDITY_MS = 60 * 60 * 1000;
+
+function fail(message) {
+  console.error(`Invalid code walkthrough evidence: ${message}`);
+  process.exit(1);
+}
+
+function isPlainObject(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function parseTimestamp(value, field) {
+  const match = typeof value === 'string'
+    ? value.match(/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?Z$/)
+    : null;
+  if (!match) fail(`${field} must be a canonical UTC ISO-8601 timestamp.`);
+
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, fractionText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const milliseconds = Number((fractionText || '').padEnd(3, '0') || 0);
+  const date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  date.setUTCHours(hour, minute, second, milliseconds);
+
+  if (date.getUTCFullYear() !== year
+      || date.getUTCMonth() !== month - 1
+      || date.getUTCDate() !== day
+      || date.getUTCHours() !== hour
+      || date.getUTCMinutes() !== minute
+      || date.getUTCSeconds() !== second
+      || date.getUTCMilliseconds() !== milliseconds) {
+    fail(`${field} must contain a valid UTC calendar date and time.`);
+  }
+  return date.getTime();
+}
+
+function validateExpert(expert, index, roles, models) {
+  if (!isPlainObject(expert)) fail(`experts[${index}] must be a plain object.`);
+  if (!REQUIRED_ROLES.includes(expert.role)) fail(`experts[${index}].role is invalid.`);
+  if (roles.has(expert.role)) fail(`expert role ${expert.role} is duplicated.`);
+  roles.add(expert.role);
+
+  if (expert.verdict !== 'APPROVED') fail(`expert ${expert.role} must be APPROVED.`);
+  if (expert.result_type !== 'delphi_expert_result') {
+    fail(`expert ${expert.role} must be a successful Delphi expert result.`);
+  }
+  if (expert.error !== undefined || expert.fallback !== undefined) {
+    fail(`expert ${expert.role} contains an error or fallback marker.`);
+  }
+
+  if (typeof expert.requested_model !== 'string' || expert.requested_model.trim() === '') {
+    fail(`expert ${expert.role} requested_model must be non-empty.`);
+  }
+  const model = expert.requested_model.trim();
+  if (models.has(model)) fail(`requested_model ${model} is duplicated.`);
+  models.add(model);
+
+  if (expert.resolved_model !== null
+      && (typeof expert.resolved_model !== 'string' || expert.resolved_model.trim() === '')) {
+    fail(`expert ${expert.role} resolved_model must be non-empty or null.`);
+  }
+}
+
+function validateEvidence(evidence, expectedCommit, expectedBranch, now) {
+  if (!isPlainObject(evidence)) fail('top level must be a plain object.');
+  if (evidence.commit !== expectedCommit) fail('commit does not match HEAD.');
+  if (evidence.branch !== expectedBranch) fail('branch does not match the current branch.');
+  if (evidence.verdict !== 'APPROVED') fail('top-level verdict must be APPROVED.');
+
+  const timestamp = parseTimestamp(evidence.timestamp, 'timestamp');
+  const expires = parseTimestamp(evidence.expires, 'expires');
+  if (timestamp > now) fail('timestamp is in the future.');
+  if (expires <= now) fail('evidence has expired.');
+  if (expires - timestamp !== VALIDITY_MS) {
+    fail('expires must be exactly one hour after timestamp.');
+  }
+
+  if (typeof evidence.consensus_ratio !== 'number'
+      || !Number.isFinite(evidence.consensus_ratio)
+      || evidence.consensus_ratio < 0.90
+      || evidence.consensus_ratio > 1) {
+    fail('consensus_ratio must be a finite number from 0.90 through 1.');
+  }
+
+  if (!Array.isArray(evidence.experts) || evidence.experts.length !== 3) {
+    fail('experts must contain exactly three records.');
+  }
+  const roles = new Set();
+  const models = new Set();
+  evidence.experts.forEach((expert, index) => {
+    validateExpert(expert, index, roles, models);
+  });
+  if (roles.size !== REQUIRED_ROLES.length) fail('all required expert roles must be present.');
+}
+
+function main() {
+  const [file, expectedCommit, expectedBranch, nowValue] = process.argv.slice(2);
+  if (!file || !expectedCommit || !expectedBranch) {
+    fail('usage: validate-code-walkthrough.cjs <file> <commit> <branch> [now].');
+  }
+
+  let evidence;
+  try {
+    evidence = JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    fail('file must exist and contain valid JSON.');
+  }
+  const now = nowValue === undefined ? Date.now() : parseTimestamp(nowValue, 'current time');
+  validateEvidence(evidence, expectedCommit, expectedBranch, now);
+}
+
+main();

package/hooks/pre-commit

@@ -14,7 +14,21 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ADAPTER_DIR=""
 GLOBAL_ADAPTER_DIR="$HOME/.config/xp-gate/adapters"
-PROJECT_GITHOOKS="$(git rev-parse --show-toplevel 2>/dev/null)/githooks"
+
+# BEGIN GIT CONTEXT FALLBACK
+if ! declare -F run_without_git_context >/dev/null 2>&1; then
+  run_without_git_context() (
+    unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_CONFIG GIT_CONFIG_PARAMETERS
+    unset GIT_CONFIG_COUNT GIT_OBJECT_DIRECTORY GIT_DIR GIT_WORK_TREE
+    unset GIT_IMPLICIT_WORK_TREE GIT_GRAFT_FILE GIT_INDEX_FILE
+    unset GIT_NO_REPLACE_OBJECTS GIT_REPLACE_REF_BASE GIT_PREFIX
+    unset GIT_SHALLOW_FILE GIT_COMMON_DIR
+    "$@"
+  )
+fi
+# END GIT CONTEXT FALLBACK
+
+PROJECT_GITHOOKS="$(run_without_git_context git rev-parse --show-toplevel 2>/dev/null)/githooks"
 GATES_DIR="$SCRIPT_DIR/gates"
 
 if [ -f "$GLOBAL_ADAPTER_DIR/adapter-common.sh" ]; then
@@ -89,7 +103,7 @@ _quality_report_on_exit() {
 }
 trap '_quality_report_on_exit' EXIT
 
-PROJECT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo "$(cd "$SCRIPT_DIR/../.." 2>/dev/null || echo "$SCRIPT_DIR/..")" )"
+PROJECT_ROOT="$(run_without_git_context git rev-parse --show-toplevel 2>/dev/null || echo "$(cd "$SCRIPT_DIR/../.." 2>/dev/null || echo "$SCRIPT_DIR/..")" )"
 if [[ -d "$PROJECT_ROOT/node_modules/.bin" ]]; then
   export PATH="$PROJECT_ROOT/node_modules/.bin:$PATH"
 fi
@@ -415,6 +429,17 @@ if [ -z "$CHANGED_FILES" ]; then
   exit 0
 fi
 
+any_changed_files_match() {
+  local pattern
+
+  for pattern in "$@"; do
+    if printf '%s\n' "$CHANGED_FILES" | grep -qE -- "$pattern"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
 # ============================================================================
 # Multi-language detection (v0.15.0+): detect all languages from changed file
 # extensions, with fallback to manifest-based detection.
@@ -1387,6 +1412,14 @@ else
   # --- BLOCK path: New .ts/.tsx files without corresponding tests ---
   NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v 'node_modules/' | grep -v '\.next/' | grep -v '\.nuxt/' | grep -v 'dist/' | grep -v 'build/' | grep -v '.turbo/' | grep -v '.cache/' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
 
+  # Strip PROJECT_SUBDIR prefix from new-TS-file paths when running in a subdirectory.
+  # git diff returns repo-root relative paths, but after cd "$PROJECT_SUBDIR"
+  # the test-pairing [ -f ] checks below need subdirectory-relative paths.
+  # (Mirrors the v0.14.31+ Gate 5b fix at lines 1603-1608; Gate 5a was missing it.)
+  if [ -n "$PROJECT_SUBDIR" ] && [ "$PROJECT_SUBDIR" != "." ] && [ -n "$NEW_TS_FILES" ]; then
+    NEW_TS_FILES=$(echo "$NEW_TS_FILES" | sed "s|^${PROJECT_SUBDIR}/||")
+  fi
+
   if [ -n "$NEW_TS_FILES" ]; then
     BLOCKED_TS_FILES=0
     for src_file in $NEW_TS_FILES; do
@@ -1749,8 +1782,8 @@ else
     if [ "${CURRENT_LANG}" != "unknown" ] && [ -n "$ADAPTER_FILE" ]; then
     if source "$ADAPTER_FILE" 2>/dev/null; then
       # TypeScript: vitest with smart test selection
-      if [ "$CURRENT_LANG" = "typescript" ] && [ -f "package.json" ]; then
-        if npx vitest --version >/dev/null 2>&1; then
+      if [ "$CURRENT_LANG" = "typescript" ] && { [ -f "package.json" ] || [ -f "$PROJECT_ROOT/package.json" ]; }; then
+        if run_without_git_context npx vitest --version >/dev/null 2>&1; then
           # Count changed test files to decide strategy
           CHANGED_TEST_FILE_COUNT=$(echo "$CHANGED_TEST_FILES" | grep -c '.' || echo "0")
           
@@ -1766,7 +1799,7 @@ else
           if [ "$CHANGED_TEST_FILE_COUNT" -gt 20 ] 2>/dev/null; then
             # Too many test files changed → full run
             echo "Too many test files changed ($CHANGED_TEST_FILE_COUNT), running full test suite..."
-            TESTS_OUTPUT=$(npx vitest run --coverage 2>&1)
+            TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage 2>&1)
             TESTS_EXIT_CODE=$?
             echo "$TESTS_OUTPUT" | head -60
             if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1781,7 +1814,7 @@ else
             SMART_TARGETS=$(echo "$CHANGED_TEST_FILES" | tr '\n' ' ')
             echo "Running ${CHANGED_TEST_FILE_COUNT} changed test file(s) with coverage..."
             echo "   Target(s): $(echo "$CHANGED_TEST_FILES" | tr '\n' ' ')"
-            TESTS_OUTPUT=$(npx vitest run --coverage $SMART_TARGETS 2>&1)
+            TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage $SMART_TARGETS 2>&1)
             TESTS_EXIT_CODE=$?
             echo "$TESTS_OUTPUT" | head -60
             if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1825,7 +1858,7 @@ else
             if [ -n "$RELATED_TESTS" ]; then
               echo "   Found related test(s): $(echo "$RELATED_TESTS" | tr '\n' ' ')"
               PARTIAL_TEST_RUN=true  # Mark as partial run for coverage check
-              TESTS_OUTPUT=$(npx vitest run --coverage $RELATED_TESTS 2>&1)
+              TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage $RELATED_TESTS 2>&1)
               TESTS_EXIT_CODE=$?
               echo "$TESTS_OUTPUT" | head -60
               if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1838,7 +1871,7 @@ else
             else
               # No related tests found → full run is safest
               echo "   No related test files found, running full test suite..."
-              TESTS_OUTPUT=$(npx vitest run --coverage 2>&1)
+              TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage 2>&1)
               TESTS_EXIT_CODE=$?
               echo "$TESTS_OUTPUT" | head -60
               if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1857,7 +1890,7 @@ else
           fi
         else
           # Fallback: run_tests without coverage
-          TESTS_OUTPUT=$(run_tests 2>&1)
+          TESTS_OUTPUT=$(run_without_git_context run_tests 2>&1)
           TESTS_EXIT_CODE=$?
           echo "$TESTS_OUTPUT" | head -50
           if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1868,15 +1901,21 @@ else
         fi
       else
         # Non-TypeScript: standard adapter test flow
-        TESTS_OUTPUT=$(run_tests 2>&1)
-        TESTS_EXIT_CODE=$?
-        echo "$TESTS_OUTPUT" | head -50
-        if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
-          echo ""
-          echo "❌ BLOCKED - Tests FAILED"
-          exit 1
-      else
-        echo "✅ PASSED - Unit tests passed."
+        # Skip for Python — tests already run with coverage in the coverage section below.
+        # Running them here first without coverage doubles pre-commit time for no benefit.
+        if [ "$CURRENT_LANG" = "python" ]; then
+          echo "ℹ️  Python tests deferred to coverage section (single pass)."
+        else
+          TESTS_OUTPUT=$(run_without_git_context run_tests 2>&1)
+          TESTS_EXIT_CODE=$?
+          echo "$TESTS_OUTPUT" | head -50
+          if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
+            echo ""
+            echo "❌ BLOCKED - Tests FAILED"
+            exit 1
+          else
+            echo "✅ PASSED - Unit tests passed."
+          fi
         fi
       fi
     else
@@ -2056,6 +2095,45 @@ else
         echo "⚠️  coverage/lcov.info not found. Ensure dart test --coverage was run."
       fi
       ;;
+    "powershell")
+      COVERAGE_ENFORCED=true
+      if [ -f "coverage.xml" ]; then
+        COVERAGE_RESULT=$(node -e "
+          try {
+            const fs = require('fs');
+            const xml = fs.readFileSync('coverage.xml', 'utf8');
+            const counters = [...xml.matchAll(/<counter\b([^>]*)\/?\s*>/gi)]
+              .map((match) => Object.fromEntries(
+                [...match[1].matchAll(/([\w:-]+)\s*=\s*(['\"])(.*?)\2/g)]
+                  .map((attribute) => [attribute[1].toUpperCase(), attribute[3]])
+              ))
+              .filter((counter) => counter.TYPE === 'LINE');
+            const reportCounter = counters.at(-1);
+            const missed = Number(reportCounter?.MISSED);
+            const covered = Number(reportCounter?.COVERED);
+            const total = missed + covered;
+            if (!Number.isFinite(missed) || !Number.isFinite(covered) || missed < 0 || covered < 0 || total <= 0) {
+              throw new Error('invalid LINE counter');
+            }
+            const percentage = (covered / total) * 100;
+            console.log((percentage < 80 ? 'below' : 'pass') + '|' + Math.round(percentage));
+          } catch (error) { console.log('parse_error'); }
+        " 2>/dev/null) || COVERAGE_RESULT="parse_error"
+        if [ "$COVERAGE_RESULT" != "parse_error" ] && [ -n "$COVERAGE_RESULT" ]; then
+          COVERAGE_STATUS=${COVERAGE_RESULT%%|*}
+          COVERAGE_PERCENT=${COVERAGE_RESULT#*|}
+          if [ "$COVERAGE_STATUS" = "below" ]; then
+            echo "❌ BLOCKED - PowerShell coverage ${COVERAGE_PERCENT}% below 80% threshold"
+            exit 1
+          fi
+          echo "PowerShell coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
+        else
+          echo "⚠️  Could not parse PowerShell coverage from coverage.xml"
+        fi
+      else
+        echo "⚠️  coverage.xml not found. Ensure Pester coverage was run."
+      fi
+      ;;
     *)
       # Default: attempt to parse coverage from common formats regardless of language
       COVERAGE_ENFORCED=true
@@ -2165,6 +2243,15 @@ elif has_project_lang "powershell" 2>/dev/null || [ "$PROJECT_LANG" = "powershel
      echo "     ⏭️  SKIPPED - Architecture validation (no tool for PowerShell)"
 
 else
+  run_archlint() (
+    cd "$PROJECT_ROOT" || exit 1
+    if [ "$ARCHLINT_KIND" = "npx" ]; then
+      npx @archlinter/cli "$@"
+    else
+      "$ARCHLINT_BIN" "$@"
+    fi
+  )
+
   # Check if architecture config exists (use $PROJECT_ROOT — hook may have cd'd to a subdir via ARCH-03)
   if [ -f "$PROJECT_ROOT/architecture.yaml" ] || [ -f "$PROJECT_ROOT/.architecturerc" ] || [ -f "$PROJECT_ROOT/.archlint.yaml" ]; then
     # Different architecture tools per language
@@ -2172,12 +2259,14 @@ else
     case "$CURRENT_LANG" in
       "typescript")
         # Try local npx install first (devDependencies), fall back to global
-        if npx --no-install @archlinter/cli --version >/dev/null 2>&1; then
-          ARCHLINT_CMD="npx --no-install @archlinter/cli"
+        if [ -x "$PROJECT_ROOT/node_modules/.bin/archlint" ]; then
+          ARCHLINT_KIND="binary"
+          ARCHLINT_BIN="$PROJECT_ROOT/node_modules/.bin/archlint"
         elif command -v archlint >/dev/null 2>&1; then
-          ARCHLINT_CMD="archlint"
-        elif npx @archlinter/cli --version >/dev/null 2>&1; then
-          ARCHLINT_CMD="npx @archlinter/cli"
+          ARCHLINT_KIND="binary"
+          ARCHLINT_BIN="$(command -v archlint)"
+        elif (cd "$PROJECT_ROOT" && npx @archlinter/cli --version) >/dev/null 2>&1; then
+          ARCHLINT_KIND="npx"
         else
           echo "     ❌ BLOCKED - archlint not installed"
           echo "     Install with: npm install --save-dev @archlinter/cli"
@@ -2186,17 +2275,17 @@ else
          echo "     Running archlint for TypeScript..."
           # Use diff mode with baseline for ratchet (block only new violations)
           # Fall back to raw scan if no baseline exists (new project, zero-tolerance)
-          if [ -f ".architecture-baseline.json" ]; then
-            ARCHLINT_OUTPUT=$($ARCHLINT_CMD diff .architecture-baseline.json --fail-on high 2>&1)
+          if [ -f "$PROJECT_ROOT/.architecture-baseline.json" ]; then
+            ARCHLINT_OUTPUT=$(run_archlint diff .architecture-baseline.json --fail-on high 2>&1)
           else
-            ARCHLINT_OUTPUT=$($ARCHLINT_CMD scan . -f table --quiet 2>&1)
+            ARCHLINT_OUTPUT=$(run_archlint scan . -f table --quiet 2>&1)
           fi
          ARCHLINT_EXIT=$?
          echo "$ARCHLINT_OUTPUT" | tail -30
          if [ "$ARCHLINT_EXIT" -ne 0 ]; then
            echo ""
            echo "❌ BLOCKED - Architecture violations detected"
-           if [ -f ".architecture-baseline.json" ]; then
+             if [ -f "$PROJECT_ROOT/.architecture-baseline.json" ]; then
              echo "New architecture violations found (baseline ratchet mode)."
              echo "Fix the new violations above, or update the baseline with: npx @archlinter/cli snapshot -o .architecture-baseline.json"
            else
@@ -2205,7 +2294,7 @@ else
            fi
            exit 1
          fi
-         if [ -f ".architecture-baseline.json" ]; then
+           if [ -f "$PROJECT_ROOT/.architecture-baseline.json" ]; then
            echo "     ✅ TypeScript architecture validation completed (baseline ratchet mode)."
          else
            echo "     ✅ TypeScript architecture validation completed (zero-tolerance mode). no baseline found."
@@ -2276,7 +2365,7 @@ else
       echo "   Required configuration file (.archlint.yaml / architecture.yaml) is NOT found."
       echo "   Architecture Quality Gate requires explicit architecture constraints."
       echo ""
-      echo "   Create .archlint.yaml with: npx archlint init --no-interactive"
+  echo "   Quick fix: create .archlint.yaml with: npx archlint init --no-interactive"
       echo "   Or architecture.yaml for custom Clean Architecture layer definitions:"
       echo "     layers:"
       echo "       - name: api"
@@ -2451,13 +2540,20 @@ echo ""
 
 # ============================================================================
 # GATE 10: Semgrep SAST Security Scan
-# Extracted to gate-10.sh for maintainability (sourced as gate-9.sh)
+# Extracted to gate-10.sh for maintainability
 # v0.14.3+ (Issue #312): Skip if no code files changed
+# v0.18.5 (Issue #397): Fix gate status variable collision — SAST now sets GATE_10_STATUS
 # ============================================================================
 if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh)$"; then
-source "$GATE_DIR/gate-9.sh"
+  if [ -f "$GATE_DIR/gate-10.sh" ]; then
+    source "$GATE_DIR/gate-10.sh"
+  else
+    echo "⏭️  SKIPPED - SAST (gate-10.sh not found)"
+    GATE_10_STATUS="SKIP"
+  fi
 else
   echo "✅ PASSED - No code files changed, skipping SAST scan."
+  GATE_10_STATUS="PASS"
 fi
 # ============================================================================
 
@@ -2561,7 +2657,7 @@ generate_quality_report() {
   # ── Branch-level quality status file ─────────────────────────────────────────────
   local STATUS_DIR=".xp-gate/quality-status"
   local REPORT_FILE="${STATUS_DIR}/${BRANCH}.json"
-  mkdir -p "$STATUS_DIR"
+  mkdir -p "$(dirname "$REPORT_FILE")"
 
   cat > "$REPORT_FILE" << ENDJSON
 {
@@ -2714,5 +2810,6 @@ if [ -n "$_wp_marker" ] && [ "$_wp_marker" != "/xp-gate-precommit-marker" ]; the
 fi
 
 generate_quality_report
+_QUALITY_REPORT_DONE=1
 
-exit 0
+exit 0