@boyingliu01/xp-gate 0.19.3 → 0.20.1

package/build-integrity/__tests__/import-resolver.test.ts

@@ -12,6 +12,10 @@ import path from 'path';
 import os from 'os';
 import { extractImports, resolveImportPath, runImportCheck } from '../gate-10';
 
+// Named timeout for the runImportCheck calls that assert verdicts; keeps the
+// Boy Scout magic-number count from growing with each new test case.
+const IMPORT_CHECK_TIMEOUT_MS = 30000;
+
 /**
  * ─── extractImports ────────────────────────────────────────────────────────────
  */
@@ -321,6 +325,61 @@ describe('runImportCheck', () => {
     expect(result.violations[0].reason).toMatch(/not found|does not exist|missing/i);
   });
 
+  it('passes when projectRoot spelling differs in drive case/slashes (Windows, #508)', async () => {
+    // git rev-parse --show-toplevel reports "D:/repo" while path.resolve of a
+    // repo-relative changed file inherits process.cwd()'s "d:\repo" drive case.
+    // The case-sensitive startsWith judged every import as boundary-escaping,
+    // blocking any TS-bearing push. The same root spelled the other way must
+    // pass on Windows; drive letters do not exist on POSIX so skip there.
+    if (process.platform !== 'win32') return;
+
+    let fooFile: string;
+    try {
+      const srcDir = path.join(tmpDir, 'src');
+      await fs.mkdir(srcDir);
+
+      const barFile = path.join(srcDir, 'bar.ts');
+      await fs.writeFile(barFile, 'export const x = 1;');
+
+      fooFile = path.join(srcDir, 'foo.ts');
+      await fs.writeFile(fooFile, `import { x } from './bar';\nconsole.log(x);\n`);
+    } catch (error) {
+      throw new Error(`Fixture setup failed: ${error}`);
+    }
+
+    const altRoot = tmpDir.replace(/\\/g, '/').replace(/^[a-zA-Z]:/, (m) => m.toLowerCase());
+    expect(altRoot).not.toBe(tmpDir);
+
+    const result = await runImportCheck([fooFile], altRoot, IMPORT_CHECK_TIMEOUT_MS);
+    expect(result.status).toBe('pass');
+    expect(result.violations).toEqual([]);
+  });
+
+  it('still fails a true boundary escape after case normalization (#508 follow-up)', async () => {
+    // Normalization must only absorb case/spelling differences, never widen the
+    // boundary: an import that genuinely leaves the project root keeps failing
+    // even when the root is spelled with a different drive-letter case.
+    if (process.platform !== 'win32') return;
+
+    let badFile: string;
+    try {
+      const nestedDir = path.join(tmpDir, 'pkg', 'dist', 'sub');
+      await fs.mkdir(nestedDir, { recursive: true });
+
+      badFile = path.join(nestedDir, 'file.ts');
+      await fs.writeFile(badFile, `import { x } from '../../../../outside';\n`);
+    } catch (error) {
+      throw new Error(`Fixture setup failed: ${error}`);
+    }
+
+    const altRoot = tmpDir.replace(/\\/g, '/').replace(/^[a-zA-Z]:/, (m) => m.toLowerCase());
+
+    const result = await runImportCheck([badFile], altRoot, IMPORT_CHECK_TIMEOUT_MS);
+    expect(result.status).toBe('fail');
+    expect(result.violations.length).toBeGreaterThan(0);
+    expect(result.violations[0].reason).toMatch(/escapes|outside|boundary/i);
+  });
+
   it('skips YAML files containing JavaScript-like require text', async () => {
     const workflowDir = path.join(tmpDir, '.github', 'workflows');
     await fs.mkdir(workflowDir, { recursive: true });

package/build-integrity/gate-10.ts

@@ -307,6 +307,8 @@ export async function runImportCheck(
 
     const fsSync = fsNative;
 
+  const normalizedRoot = path.resolve(projectRoot);
+
   for (const file of changedFiles) {
     if (!isSupportedModuleFile(file)) continue;
 
@@ -327,14 +329,27 @@ export async function runImportCheck(
       continue;
     }
 
+    // Windows paths are case-insensitive but the two sides of the boundary
+    // comparison get their case from different sources: path.resolve of a
+    // repo-relative file inherits process.cwd()'s drive-letter case (often
+    // lowercase), while projectRoot comes from `git rev-parse --show-toplevel`
+    // (uppercase drive). A case-sensitive startsWith then judged EVERY import
+    // as escaping the boundary — pre-push Gate 10 blocked any TS-bearing push
+    // from a shell whose drive-letter case disagreed with git's (#508).
+    const normalizeForBoundary = (p: string): string => {
+      const resolved = path.resolve(p);
+      return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+    };
+    const boundaryRoot = normalizeForBoundary(normalizedRoot);
+
     const imports = extractImports(content);
 
     for (const imp of imports) {
       const rawResolved = path.resolve(path.dirname(file), imp.path);
-      const normalizedRoot = path.resolve(projectRoot);
+      const boundaryTarget = normalizeForBoundary(rawResolved);
 
       const escapesBoundary =
-        !rawResolved.startsWith(normalizedRoot + path.sep) && rawResolved !== normalizedRoot;
+        !boundaryTarget.startsWith(boundaryRoot + path.sep) && boundaryTarget !== boundaryRoot;
 
       if (escapesBoundary) {
         violations.push({

package/gate-10.sh

@@ -33,15 +33,39 @@ else
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
     GATE_10_STATUS="SKIP"
   else
+    # One path per line into an array. Quoting the newline-joined list would hand
+    # semgrep ONE argument containing newlines -> "Invalid scanning root" once
+    # >=2 files are staged (#490). Same defect class as the Gate 4 --files fix
+    # (#457): an array is the only form that keeps spaces intact AND splits files.
+    #
+    # Each element gets a ./ prefix: a tracked path may legitimately start with
+    # '-' (`git add -- ./-o.ts`), and bare in argv that element reads as an option
+    # and rewrites the scan it was meant to constrain. ./ is a path to every
+    # argument parser.
+    #
+    # The unquoted heredoc below expands $SEMGREP_FILES once, then feeds literal
+    # lines to `read`; bash never rescans the result for separators. Its correct
+    # reading rests on one property of the producer above, not of the loop:
+    # `git diff --cached --name-only` terminates paths with LF and quotes control
+    # characters (a CR in a name arrives as the four bytes \215, never as a bare
+    # CR), so one line is exactly one path. Asserted for spaces and a leading '-'
+    # by AC-490-04.
+    SEMGREP_ARGS=()
+    while IFS= read -r _semgrep_file; do
+      [ -n "$_semgrep_file" ] && SEMGREP_ARGS+=("./$_semgrep_file")
+    done <<EOF
+$SEMGREP_FILES
+EOF
+
     # Run semgrep with JSON output
     # --config=p/security-audit: explicit security ruleset
     # --json: machine-readable output
     # --disable-version-check: skip network call
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "$SEMGREP_FILES" 2>&1)
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1)
     SEMGREP_EXIT=$?
 
     if [ "$SEMGREP_EXIT" -eq 0 ]; then
-      echo "     ✅ PASSED - No security vulnerabilities found."
+      echo "     ✅ PASSED - No security vulnerabilities found (files scanned: ${#SEMGREP_ARGS[@]})."
       GATE_10_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
@@ -96,7 +120,16 @@ console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+m
       fi
     else
       # semgrep runtime error (timeout, config error, etc.)
+      #
+      # SEMGREP_OUTPUT is captured above and was never shown here, so an intermittent
+      # ruleset-fetch failure looked identical to a broken install: the gate printed
+      # "runtime error" and kept the reason to itself (#475). The verdict stays SKIP --
+      # an operational failure must not block the commit, and must not be called a pass.
       echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      if [ -n "$SEMGREP_OUTPUT" ]; then
+        echo "     ── what semgrep reported ──"
+        printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
+      fi
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_10_STATUS="SKIP"
     fi

package/gate-4.sh

@@ -3,6 +3,26 @@
 # Reuses existing principles checker logic
 # ============================================================================
 
+# Run a TypeScript entrypoint under tsx without routing arguments through the
+# npx shim: Windows cmd.exe caps command lines at 8191 chars and long staged
+# file lists overflow it, turning a healthy run into a false BLOCK. Prefer the
+# repo-local tsx CLI driven by node directly; keep npx as fallback for consumer
+# repos relying on a global install. Defined here as well so this module also
+# works when sourced outside pre-commit.
+if ! declare -F run_tsx >/dev/null 2>&1; then
+  run_tsx() {
+    local _root="${PROJECT_ROOT:-$(pwd)}" _timeout=()
+    if [ -n "${RUN_TSX_TIMEOUT:-}" ]; then
+      _timeout=(timeout "$RUN_TSX_TIMEOUT")
+    fi
+    if [ -f "$_root/node_modules/tsx/dist/cli.mjs" ] && command -v node >/dev/null 2>&1; then
+      "${_timeout[@]}" node "$_root/node_modules/tsx/dist/cli.mjs" "$@"
+    else
+      "${_timeout[@]}" npx tsx "$@"
+    fi
+  }
+fi
+
  2>&1 echo ""
  2>&1 echo "→ Gate 4: Principles checker (Clean Code + SOLID)..."
 GATE_4_START=$(gate_start_ms)
@@ -16,29 +36,101 @@ if [ "$PROJECT_LANG" = "documentation-only" ]; then
 else
   # Get source files to check against principles
   PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm)$' || true)
+
+  # One path per line, into an array. Passing $PRINCIPLES_FILES unquoted relies on
+  # word splitting to turn the list into separate argv entries, which also splits
+  # any path containing a space -- handing the checker two bogus paths and checking
+  # neither. Quoting it would instead collapse the list into one argument. An array
+  # is the only form that does both. Same defect class as the --config fix (#457).
+  PRINCIPLES_ARGS=()
+  while IFS= read -r _principles_file; do
+    [ -n "$_principles_file" ] && PRINCIPLES_ARGS+=("$_principles_file")
+  done <<< "$PRINCIPLES_FILES"
   
   if [ -n "$PRINCIPLES_FILES" ]; then
-    # Check for principles checker in installed modules first, then project src/
+    # The checker resolves every path it is given -- and every path in CHANGED_FILES
+    # comes from `git diff`, so it is repo-root relative -- against its own working
+    # directory. Resolving against the hook's CWD broke in single-language subdir
+    # mode, where pre-commit has already cd'd into $PROJECT_SUBDIR: web/src/a.ts was
+    # looked up as web/web/src/a.ts, the probes below missed the checker that was
+    # installed one level up, and a working gate degraded to SKIPPED (#478).
+    # Everything this gate reads is therefore anchored at the repo root.
+    PRINCIPLES_BASE="${PROJECT_ROOT:-$(pwd)}"
+
     PRINCIPLES_DIR=""
-    if [ -d ".xp-gate/modules/principles" ]; then
-      PRINCIPLES_DIR=".xp-gate/modules/principles"
-    elif [ -f "src/principles/index.ts" ]; then
-      PRINCIPLES_DIR="src/principles"
-    elif [ -d "$HOME/.config/xp-gate/modules/principles" ]; then
-      PRINCIPLES_DIR="$HOME/.config/xp-gate/modules/principles"
-    fi
+    for _principles_candidate in \
+      "$PRINCIPLES_BASE/.xp-gate/modules/principles" \
+      "$PRINCIPLES_BASE/src/principles" \
+      "$(pwd)/.xp-gate/modules/principles" \
+      "$(pwd)/src/principles" \
+      "$HOME/.config/xp-gate/modules/principles"; do
+      if [ -f "$_principles_candidate/index.ts" ]; then
+        PRINCIPLES_DIR="$_principles_candidate"
+        break
+      fi
+    done
     
     if [ -n "$PRINCIPLES_DIR" ]; then
       echo "Checking Clean Code + SOLID principles..."
       
-      if command -v npx > /dev/null 2>&1; then
-        # Run principles checker and store results
-        if npx tsx $PRINCIPLES_DIR/index.ts --files $PRINCIPLES_FILES --format json > /tmp/principles-output.json 2>/dev/null; then
-          # Check severity levels
-          ERROR_COUNT=$(grep -c '"severity":"error"' /tmp/principles-output.json 2>/dev/null || true)
+      if command -v npx > /dev/null 2>&1 || [ -f "$PRINCIPLES_BASE/node_modules/tsx/dist/cli.mjs" ]; then
+        # Run principles checker and store results.
+        #
+        # Do NOT wrap this in `if ...; then`: the checker's exit codes are
+        # deliberately distinct (0 clean, 1 ERROR-severity findings, >=2 tool
+        # failure), and an `if` collapses 1 and 2 into "failed". That sent real
+        # error-severity findings down the crash branch, which SKIPs and prints
+        # PASSED -- releasing exactly the most serious violations.
+        # The trailing `|| PRINCIPLES_EXIT=$?` captures the exit status without
+        # letting a non-zero return abort the hook under `set -e`. pre-commit itself
+        # runs with only `set -o pipefail` (no `set -e`, pinned by
+        # scripts/__tests__/gate-5-runner-error.test.ts AC-454-08), but this module is
+        # also sourced by consumer hooks that may set it, and a bare call followed by
+        # `PRINCIPLES_EXIT=$?` never reaches the assignment under `set -e`. `|| true`
+        # would erase the status -- which is exactly the distinction this gate depends
+        # on.
+        PRINCIPLES_EXIT=0
+        # Keep stderr: it carries the checker's configuration warnings -- a rejected
+        # threshold or an out-of-vocabulary severity says so here and nowhere else.
+        # Sending it to /dev/null made an exit-2 SKIP undiagnosable and hid every
+        # .principlesrc typo (Delphi walkthrough MC-03). Captured to a file so a clean
+        # run stays quiet, then replayed only when the checker had a problem.
+        #
+        # `cd || exit 2`: a base we cannot enter means the checker never ran, which is
+        # this module's tool-failure code. Falling through would return the exit status
+        # of the failed cd (1), and 1 asserts "I examined files and found errors" -- an
+        # empty report at 1 reads as a clean pass.
+        #
+        # The report is a PER-INVOCATION mktemp, not a shared `/tmp/principles-output.json`:
+        # two commits racing on one machine (two worktrees, a hook and a CI job) overwrote
+        # each other's report before it was counted, so a run with ERROR findings could
+        # read a clean report and PASS (#457). PRINCIPLES_JSON is exported so a caller can
+        # point a harness at the same file.
+        PRINCIPLES_STDERR=$(mktemp)
+        PRINCIPLES_JSON=$(mktemp)
+        export PRINCIPLES_JSON
+        ( cd "$PRINCIPLES_BASE" 2>/dev/null || exit 2
+          run_tsx "$PRINCIPLES_DIR/index.ts" --files ${PRINCIPLES_ARGS[@]+"${PRINCIPLES_ARGS[@]}"} --format json ) > "$PRINCIPLES_JSON" 2>"$PRINCIPLES_STDERR" || PRINCIPLES_EXIT=$?
+
+        if [ -s "$PRINCIPLES_STDERR" ]; then
+          sed 's/^/     /' "$PRINCIPLES_STDERR"
+        fi
+        rm -f "$PRINCIPLES_STDERR"
+
+        if [ "$PRINCIPLES_EXIT" -ge 2 ]; then
+          echo "⚠️  Warning: Principles checker execution failed"
+          echo "⏭️  SKIPPED - Principles check (execution issue)"
+          GATE_4_STATUS="SKIP"
+          rm -f "$PRINCIPLES_JSON"
+        else
+          # Check severity levels. The reporter emits JSON.stringify(out, null, 2),
+          # i.e. `"severity": "warning"` WITH a space; tolerate any whitespace so a
+          # future minified format cannot silently zero these counts again (#444).
+          ERROR_COUNT=$(grep -cE '"severity"[[:space:]]*:[[:space:]]*"error"' "$PRINCIPLES_JSON" 2>/dev/null || true)
           ERROR_COUNT=${ERROR_COUNT:-0}
-          WARNING_COUNT=$(grep -c '"severity":"warning"' /tmp/principles-output.json 2>/dev/null || true)
+          WARNING_COUNT=$(grep -cE '"severity"[[:space:]]*:[[:space:]]*"warning"' "$PRINCIPLES_JSON" 2>/dev/null || true)
           WARNING_COUNT=${WARNING_COUNT:-0}
+          rm -f "$PRINCIPLES_JSON"
           
           if [ "$ERROR_COUNT" -gt 0 ]; then
             echo ""
@@ -47,7 +139,8 @@ else
             echo "  - error-handling violations"
             echo "  - SOLID principle violations"
             echo "  - architectural violations"
-            npx tsx $PRINCIPLES_DIR/index.ts --files $PRINCIPLES_FILES --format console
+            ( cd "$PRINCIPLES_BASE" 2>/dev/null || exit 2
+              run_tsx "$PRINCIPLES_DIR/index.ts" --files ${PRINCIPLES_ARGS[@]+"${PRINCIPLES_ARGS[@]}"} --format console )
             GATE_4_STATUS="FAIL"
             exit 1
           fi
@@ -57,14 +150,10 @@ else
           if [ "$WARNING_COUNT" -gt 0 ]; then
             echo "ℹ️  $WARNING_COUNT warnings found (will be handled by Boy Scout Rule)."
           fi
-        else
-          echo "⚠️  Warning: Principles checker execution failed"
-          echo "⏭️  SKIPPED - Principles check (execution issue)"
-          GATE_4_STATUS="SKIP"
         fi
       else
-        echo "ℹ️  npx not available - skipping principles check"
-        echo "⏭️  SKIPPED - Principles check (no Node.js/npx)"
+        echo "ℹ️  npx/tsx not available - skipping principles check"
+        echo "⏭️  SKIPPED - Principles check (no Node.js/tsx)"
         GATE_4_STATUS="SKIP"
       fi
     else

package/gate-8.sh

@@ -1,11 +1,14 @@
 # ============================================================================
-# GATE 8: Secret Scanning (gitleaks)
-# Detects secrets (API keys, passwords, tokens) in staged files
-# Tool: gitleaks -- https://github.com/gitleaks/gitleaks
+# GATE 8: Secret Scanning (gitleaks + detect-secrets)
+# Detects secrets (API keys, passwords, tokens) in staged files.
+# Tools:
+#   gitleaks        -- primary, fail-closed (missing or non-0/1 exit => BLOCK, #499)
+#   detect-secrets  -- secondary, baseline-diff: only blocks on secrets NOT in
+#                      .secrets.baseline; silently does nothing when unavailable
 # ============================================================================
 
  2>&1 echo ""
- 2>&1 echo "→ Gate 8: Secret scanning (gitleaks)..."
+ 2>&1 echo "→ Gate 8: Secret scanning (gitleaks + detect-secrets)..."
 GATE_8_START=$(gate_start_ms)
 
 # Gitleaks availability check
@@ -16,41 +19,124 @@ elif [ -f "$HOME/.local/bin/gitleaks" ]; then
   GITLEAKS_CMD="$HOME/.local/bin/gitleaks"
 fi
 
-if [ -n "$GITLEAKS_CMD" ]; then
-  GITLEAKS_CONFIG=""
-  if [ -f ".gitleaks.toml" ]; then
-    GITLEAKS_CONFIG="--config=.gitleaks.toml"
+if [ -z "$GITLEAKS_CMD" ]; then
+  # fail-closed (#499): an uninstalled gitleaks used to SKIP the gate, so any
+  # contributor without it shipped commits with zero secret protection and no
+  # signal. A security gate that cannot run must not report success.
+  echo "     ❌ BLOCKED - gitleaks not installed (fail-closed, #499)."
+  echo "   Secret scanning is mandatory before commit. Install gitleaks then retry:"
+  echo "     macOS:   brew install gitleaks"
+  echo "     Windows: winget install gitleaks"
+  echo "     Linux:   scripts/install-gitleaks.sh  (or https://github.com/gitleaks/gitleaks)"
+  exit 1
+fi
+
+GITLEAKS_CONFIG=""
+if [ -f ".gitleaks.toml" ]; then
+  # gitleaks is a native binary and may not understand MSYS paths, so pass an
+  # absolute path in the host's own format when we can derive one (#449).
+  if command -v cygpath >/dev/null 2>&1; then
+    GITLEAKS_CONFIG="--config=$(cygpath -w "$(pwd)/.gitleaks.toml")"
+  else
+    GITLEAKS_CONFIG="--config=$(pwd)/.gitleaks.toml"
   fi
+fi
 
-  # Run gitleaks on staged changes only (pre-commit mode for speed)
-  GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --pre-commit --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path=/tmp/gitleaks-report.json 2>&1)
-  GITLEAKS_EXIT=$?
+# Scan the INDEX, not history. gitleaks 8.x `git --pre-commit` walks committed
+# revisions and reports "0 commits scanned" on a pre-commit run -- so a staged
+# secret was never seen and Gate 8 always passed. `git --staged` scans
+# `git diff --cached`, which is exactly the pre-commit payload (#449).
+GITLEAKS_REPORT="${TMPDIR:-/tmp}/gitleaks-report.json"
+rm -f "$GITLEAKS_REPORT"
+GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+GITLEAKS_EXIT=$?
 
-  if [ "$GITLEAKS_EXIT" -eq 0 ]; then
+if [ "$GITLEAKS_EXIT" -eq 0 ]; then
+  # Decide SKIP from the REPORT ARTIFACT, not from log wording. Parsing stdout
+  # meant a gitleaks message change would silently turn a no-evidence run into
+  # a PASS -- the same fail-open class this gate just fixed (#449).
+  # The report exists and is a JSON array of findings; `[]` == clean scan.
+  GITLEAKS_FINDINGS="?"
+  if [ -f "$GITLEAKS_REPORT" ]; then
+    # A report that is not shaped like a JSON array is no evidence: leave the
+    # '?' sentinel so the gate reports SKIP, never a PASS it cannot support
+    # (the fail-closed-on-the-claim rule #449 established).
+    if grep -q '^\[' "$GITLEAKS_REPORT" 2>/dev/null; then
+      # Count occurrences, not matching lines: `grep -c` prints its own zero AND
+      # exits 1 on a clean report, so the old `|| echo 0` handed the verdict table
+      # $'0\n0' -- no branch matched and a clean scan was BLOCKED as if it leaked
+      # (#493). wc -l emits exactly one value, and `|| true` keeps the assignment
+      # errexit/pipefail-safe (#489).
+      GITLEAKS_FINDINGS=$(grep -o '"RuleID"' "$GITLEAKS_REPORT" 2>/dev/null | wc -l | tr -d '[:space:]') || true
+    fi
+  fi
+
+  if [ "$GITLEAKS_FINDINGS" = "0" ]; then
     echo "     ✅ PASSED - No secrets detected."
     GATE_8_STATUS="PASS"
-  elif [ "$GITLEAKS_EXIT" -eq 1 ]; then
-    # Secrets found — output details
+  elif [ "$GITLEAKS_FINDINGS" = "?" ]; then
+    # Exit 0 but no readable report: we have no evidence the scan happened.
+    # Fail closed on the *claim*: report SKIP, never PASS.
+    echo "     ⚠️  gitleaks exited 0 but produced no readable report"
+    echo "     ⏭️  SKIPPED - secret scanning produced no evidence (not a pass)"
+    GATE_8_STATUS="SKIP"
+  else
+    echo "     ❌ BLOCKED - gitleaks reported $GITLEAKS_FINDINGS finding(s)"
     echo "$GITLEAKS_OUTPUT"
     echo ""
-    echo "❌ BLOCKED - Secrets detected in staged files."
-    echo ""
-    echo "Remediation options:"
-    echo "  1. Remove the secret and use environment variables instead"
-    echo "  2. Add a false positive to .gitleaks.toml allowlist"
-    echo "  3. Use git secret or vault for sensitive data"
-    echo ""
-    echo "See: https://github.com/gitleaks/gitleaks"
+    echo "Remediation: remove the secret, or allowlist a false positive in .gitleaks.toml."
     exit 1
+  fi
+elif [ "$GITLEAKS_EXIT" -eq 1 ]; then
+  # Secrets found — output details
+  echo "$GITLEAKS_OUTPUT"
+  echo ""
+  echo "     ❌ BLOCKED - Secrets detected in staged files."
+  echo ""
+  echo "Remediation options:"
+  echo "  1. Remove the secret and use environment variables instead"
+  echo "  2. Add a false positive to .gitleaks.toml allowlist"
+  echo "  3. Use git secret or vault for sensitive data"
+  echo ""
+  echo "See: https://github.com/gitleaks/gitleaks"
+  exit 1
+else
+  # fail-closed (#499): a non-0/1 exit (config error, crash) used to SKIP, which
+  # let a broken scanner wave every commit through without any scan.
+  echo "     ❌ BLOCKED - gitleaks exited with code $GITLEAKS_EXIT (fail-closed, #499)."
+  echo "$GITLEAKS_OUTPUT"
+  echo "   Secret scanning could not complete; fix the gitleaks error above and retry."
+  exit 1
+fi
+
+# ---- detect-secrets（次要防线，基线比对）----
+# detect-secrets-hook comes from the project's Python dev extra; it blocks only
+# on secrets NOT yet registered in .secrets.baseline, so test-fixture dummy keys
+# recorded in the baseline never trip it.
+#
+# The file list is piped NUL-delimited STRAIGHT into xargs -0 — never through a
+# command substitution. `var=$(cmd -z)` strips every NUL byte (bash cannot hold
+# NULs in a variable), which concatenated all filenames into one giant
+# nonexistent path and would have BLOCKED every commit once a project shipped
+# both detect-secrets-hook and .secrets.baseline. The pipeline lives inside an
+# if-condition (errexit-exempt); a non-zero hook exit lands in the else branch.
+if command -v detect-secrets-hook >/dev/null 2>&1 && [ -f ".secrets.baseline" ]; then
+  DS_TMP="$(dirname "$(mktemp -u)")/ds-output.$$"
+  if git diff --cached --name-only --diff-filter=ACM -z \
+      | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
+    echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline."
   else
-    echo "     ⚠️  gitleaks exited with code $GITLEAKS_EXIT - skipping gate"
-    echo "     ✅ Secret Scanning (SKIP, gitleaks error)"
-    GATE_8_STATUS="SKIP"
+    cat "$DS_TMP"
+    echo ""
+    echo "     ❌ BLOCKED - detect-secrets found secrets not in .secrets.baseline."
+    echo "   If these are false positives, regenerate the baseline (cross-platform):"
+    echo "     detect-secrets scan --update .secrets.baseline && git add .secrets.baseline"
+    rm -f "$DS_TMP"
+    exit 1
   fi
+  rm -f "$DS_TMP"
 else
-  echo "     ℹ️  gitleaks not installed — secret scanning unavailable"
-  echo "     Install: brew install gitleaks (macOS) | winget install gitleaks (Windows) | scripts/install-gitleaks.sh (Linux)"
-  echo "     ⏭️  SKIPPED - Secret scanning (gitleaks not installed)"
-  GATE_8_STATUS="SKIP"
+  echo "     ⚠️  detect-secrets-hook unavailable (install: pip install -e \".[dev]\") — gitleaks only."
 fi
+
 record_gate_audit "gate-8" "secret-scanning" "$GATE_8_STATUS" "0" "$GATE_8_START"

package/hooks/gate-10.sh

@@ -33,15 +33,39 @@ else
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
     GATE_10_STATUS="SKIP"
   else
+    # One path per line into an array. Quoting the newline-joined list would hand
+    # semgrep ONE argument containing newlines -> "Invalid scanning root" once
+    # >=2 files are staged (#490). Same defect class as the Gate 4 --files fix
+    # (#457): an array is the only form that keeps spaces intact AND splits files.
+    #
+    # Each element gets a ./ prefix: a tracked path may legitimately start with
+    # '-' (`git add -- ./-o.ts`), and bare in argv that element reads as an option
+    # and rewrites the scan it was meant to constrain. ./ is a path to every
+    # argument parser.
+    #
+    # The unquoted heredoc below expands $SEMGREP_FILES once, then feeds literal
+    # lines to `read`; bash never rescans the result for separators. Its correct
+    # reading rests on one property of the producer above, not of the loop:
+    # `git diff --cached --name-only` terminates paths with LF and quotes control
+    # characters (a CR in a name arrives as the four bytes \215, never as a bare
+    # CR), so one line is exactly one path. Asserted for spaces and a leading '-'
+    # by AC-490-04.
+    SEMGREP_ARGS=()
+    while IFS= read -r _semgrep_file; do
+      [ -n "$_semgrep_file" ] && SEMGREP_ARGS+=("./$_semgrep_file")
+    done <<EOF
+$SEMGREP_FILES
+EOF
+
     # Run semgrep with JSON output
     # --config=p/security-audit: explicit security ruleset
     # --json: machine-readable output
     # --disable-version-check: skip network call
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "$SEMGREP_FILES" 2>&1)
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1)
     SEMGREP_EXIT=$?
 
     if [ "$SEMGREP_EXIT" -eq 0 ]; then
-      echo "     ✅ PASSED - No security vulnerabilities found."
+      echo "     ✅ PASSED - No security vulnerabilities found (files scanned: ${#SEMGREP_ARGS[@]})."
       GATE_10_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
@@ -96,7 +120,16 @@ console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+m
       fi
     else
       # semgrep runtime error (timeout, config error, etc.)
+      #
+      # SEMGREP_OUTPUT is captured above and was never shown here, so an intermittent
+      # ruleset-fetch failure looked identical to a broken install: the gate printed
+      # "runtime error" and kept the reason to itself (#475). The verdict stays SKIP --
+      # an operational failure must not block the commit, and must not be called a pass.
       echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      if [ -n "$SEMGREP_OUTPUT" ]; then
+        echo "     ── what semgrep reported ──"
+        printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
+      fi
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_10_STATUS="SKIP"
     fi