@boyingliu01/xp-gate 0.31.4 → 0.32.1

package/hooks/gate-3.sh

@@ -329,27 +329,62 @@ else
     #              is reverted at the next publish, so grading it cannot be acted
     #              on (doctorDelphi CCN=106 blocked every src/npm-package commit,
     #              on HEAD too — no baseline entry could ever exist for it).
-    #   test       __tests__/, *.test.*, *_test.{py,go}, *Test(s).java — recorded
-    #              in the report's test bucket, never in the baseline.
+    #   test       test dirs (tests/, test/, __tests__/), *.test.*, test_*.py,
+    #              *_test.{py,go}, *Test(s).java — recorded in the report's test
+    #              bucket, never in the baseline.
     # Both prefixes and the test pattern mirror ccn-report.cjs so the gate and
     # the writer cannot drift apart again (pinned by __tests__/gate-3-*.bats).
+    #
+    # #634: pytest's default is `python_files = test_*.py` under a `tests/`
+    # root. The previous pattern only knew the SUFFIX form `_test.{py,go}` and
+    # `*.test.*`, so a pytest-laid-out project had every test module graded as
+    # production source: test-helper complexity was reported as source debt and
+    # the ratchet could block on files the baseline deliberately never records
+    # (bucket === 'test').
+    #   `(^|/)(tests?)/`   — a tests/ or test/ directory anywhere in the tree
+    #   `(^|/)test_[^/]*\.py$` — pytest default filenames at any depth
+    # Both are anchored with (^|/) so `latest/`, `contest/`, `attest/` and
+    # `my_test_dir/` are NOT caught (a leading `_?test_.*\.py$` would have
+    # swallowed `src/my_test_dir/bar.py`).
+    # Must stay equivalent to TEST_PATH in scripts/ccn-report.cjs.
     CC_FILES=$(echo "$CC_FILES" | grep -vE \
-      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests__?/|\.test\.[cm]?[jt]sx?$|_test\.(py|go)$|Test(s)?\.java$' || true)
+      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests?__/|(^|/)(tests?)/|\.test\.[cm]?[jt]sx?$|(^|/)test_[^/]*\.py$|_test\.(py|go)$|Test(s)?\.java$' || true)
 
     if [ -n "$CC_FILES" ]; then
       echo "Checking complexity for source files..."
       
-      # Run lizard with CCN threshold
-      # One path per line, into an array. Unquoted $CC_FILES relied on word
-      # splitting, which also splits any path containing a space -- handing
-      # lizard two bogus paths and checking neither (#457 defect class, same
-      # fix as gate-4's PRINCIPLES_ARGS). Quoting the scalar would instead
-      # collapse the list into one argument. An array does both.
-      CC_FILES_ARGS=()
-      while IFS= read -r _cc_file; do
-        [ -n "$_cc_file" ] && CC_FILES_ARGS+=("$_cc_file")
-      done <<< "$CC_FILES"
-      CC_OUTPUT=$("$LIZARD_PATH" -C "$CCN_THRESHOLD" ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>&1 || true)
+      # Run lizard in chunks. Two reasons, both load-bearing:
+      #  - One path per line, into an array. Unquoted $CC_FILES relied on word
+      #    splitting, which also splits any path containing a space -- handing
+      #    lizard two bogus paths and checking neither (#457 defect class, same
+      #    fix as gate-4's PRINCIPLES_ARGS). Quoting the scalar would instead
+      #    collapse the list into one argument. An array does both.
+      #  - Chunked instead of one argv. Windows caps a single command line at
+      #    32,767 characters, and under `--all` the population is the whole tree
+      #    (1,000+ sources on a mid-sized repo). The oversized argv never reached
+      #    lizard, nothing was printed, and the gate graded an empty CSV as if the
+      #    tree were clean. XP_GATE_LIZARD_ARGV_BUDGET lets a probe force a split
+      #    without needing a huge fixture.
+      LIZARD_ARGV_BUDGET="${XP_GATE_LIZARD_ARGV_BUDGET:-8000}"
+      lizard_batches() {
+        # stdin: one path per line. stdout: lizard output, batches concatenated.
+        local _batch=() _size=0 _path
+        while IFS= read -r _path; do
+          [ -n "$_path" ] || continue
+          if [ "${#_batch[@]}" -gt 0 ] && [ $((_size + ${#_path} + 1)) -gt "$LIZARD_ARGV_BUDGET" ]; then
+            "$LIZARD_PATH" "$@" "${_batch[@]}" 2>/dev/null || true
+            _batch=()
+            _size=0
+          fi
+          _batch+=("$_path")
+          _size=$((_size + ${#_path} + 1))
+        done
+        if [ "${#_batch[@]}" -gt 0 ]; then
+          "$LIZARD_PATH" "$@" "${_batch[@]}" 2>/dev/null || true
+        fi
+        return 0
+      }
+      CC_OUTPUT=$(printf '%s\n' "$CC_FILES" | lizard_batches -C "$CCN_THRESHOLD" 2>&1)
 
       # REQ-D (sprint-20261018-quality): baseline ratchet. When
       # .ccn-baseline.json exists it replaces the flat threshold verdict:
@@ -366,7 +401,7 @@ else
         # Route the CSV through the same verifier; on rows it cannot verify the
         # helper exits non-zero, and this gate fails closed instead of passing
         # an unvalidated number.
-        CC_CSV=$("$LIZARD_PATH" --csv ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>/dev/null || true)
+        CC_CSV=$(printf '%s\n' "$CC_FILES" | lizard_batches --csv)
         CC_REPORT="$(git rev-parse --show-toplevel 2>/dev/null)/scripts/ccn-report.cjs"
         # Fail closed when the verifier is unavailable. Previously this fell
         # through and graded the RAW lizard CSV, while CI hard-fails on the same
@@ -392,6 +427,20 @@ else
         fi
         RATCHET_LIB="$GATE_DIR/lib/ccn-ratchet.sh"
         [ -f "$RATCHET_LIB" ] || RATCHET_LIB="$(git rev-parse --show-toplevel 2>/dev/null)/githooks/lib/ccn-ratchet.sh"
+        # Fail closed when the ratchet library is missing. Sourcing a nonexistent
+        # file only prints "No such file or directory" and leaves
+        # evaluate_ccn_ratchet undefined; the verdict then came back empty, every
+        # counter read 0 and the gate printed "✅ PASSED" — a CCN regression graded
+        # green with nothing compared. The installer never created this path
+        # (copyAdapters skipped hooks/lib), so this was the normal state after a
+        # global install, not an exotic one.
+        if [ ! -f "$RATCHET_LIB" ]; then
+          echo "❌ BLOCKED - complexity ratchet library unavailable (ccn-ratchet.sh)."
+          echo "Expected at \$GATE_DIR/lib/ccn-ratchet.sh or <repo>/githooks/lib/ccn-ratchet.sh."
+          echo "Reinstall with 'xp-gate init --global' (or 'xp-gate update-hooks') to restore it."
+          GATE_3_DETAIL="mode=ratchet ratchet=MISSING"
+          exit 1
+        fi
         # shellcheck source=/dev/null
         . "$RATCHET_LIB"
         # NOTE: the thresholds must be plain assignments BEFORE the pipe. As a
@@ -436,7 +485,7 @@ else
       # file,name,signature,...), so the verdict comes from the same numbers
       # lizard uses, independent of version and table formatting. --csv here is
       # the flat-threshold run; the ratchet branch above builds its own.
-      CC_CSV_FLAT=$("$LIZARD_PATH" --csv -C "$CCN_THRESHOLD" ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>/dev/null || true)
+      CC_CSV_FLAT=$(printf '%s\n' "$CC_FILES" | lizard_batches --csv -C "$CCN_THRESHOLD")
       CC_WARNINGS=$(printf '%s\n' "$CC_CSV_FLAT" | awk -F, -v t="$CCN_THRESHOLD" '
         NF > 1 && $2 + 0 > t + 0 { c++ }
         END { print c + 0 }

package/hooks/lib/coverage-total.sh

@@ -56,9 +56,25 @@ enforce_python_coverage() {
     return 0
   fi
 
+  # #636: this probe is the SAME fail-open #570 closed, only earlier. Returning 0
+  # here means "no coverage.py on PATH" silently disables the Python coverage
+  # floor — and unlike a deleted .coverage file, a missing tool is a steady state,
+  # not an accident: every consumer repo / CI image / colleague machine without
+  # coverage.py had this gate switched off behind a ⚠️ that reads as informational.
+  # The #570 suite could not see it because its setup installs a coverage stub
+  # precisely so this probe succeeds.
+  #
+  # A subset run stays the one exception: nothing was measured because only part
+  # of the suite ran, so there is no total to compare.
   if ! command -v coverage &> /dev/null; then
-    echo "⚠️  coverage.py not available, cannot enforce Python coverage threshold."
-    return 0
+    if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
+      echo "⚠️  coverage.py not available (subset test run) — not blocking."
+      return 0
+    fi
+    echo "❌ BLOCKED - Python coverage could not be measured: coverage.py is not on PATH,"
+    echo "   so the ${COVERAGE_THRESHOLD:-80}% floor cannot be verified."
+    echo "   Install it (pip install coverage) and commit again."
+    return 1
   fi
 
   COVERAGE_PERCENT=""

package/hooks/lib/java-test-selection.sh

@@ -0,0 +1,251 @@
+#!/bin/bash
+# Java smart test selection (#640) — the Java counterpart of the TypeScript
+# selector (#286) and the Python selector (#399).
+#
+# Why: the Java arm of Gate 5 ran the FULL Maven/Gradle suite on every commit.
+# Measured on a 206-file / 1079-test project: `mvn test jacoco:report` takes
+# 77.8s no matter whether one file or a hundred changed. TypeScript and Python
+# have had three-tier selection for a long time; Java had no equivalent — the
+# `PARTIAL_TEST_RUN` capability existed but nothing on the Java path ever set
+# it, so the downgrade channel was dead code for that language.
+#
+# Kept in its own file so the strategy truth table and the related-test lookup
+# are unit-testable without executing the hook
+# (githooks/__tests__/issue-640-java-test-selection.test.bats).
+#
+# Three tiers, matching the TS/Python implementations:
+#   1. changed-tests — only test files changed: run exactly those.
+#   2. related      — source files changed, no test files: run the tests the
+#                     path convention maps to them.
+#   3. full         — >20 test files changed, a build manifest changed, or no
+#                     related tests found: run everything with the real
+#                     coverage threshold.
+# Tier 1/2 run WITHOUT the global coverage threshold (subset coverage is
+# meaningless globally); the caller sets PARTIAL_TEST_RUN so Gate 5 warns
+# instead of blocking.
+
+# Max changed test files before falling back to the full suite. Same value as
+# the TypeScript (#286) and Python (#399) selectors so all three languages
+# behave alike.
+JAVA_MAX_CHANGED_TESTS=20
+
+# Build manifests: a change here can break ANY test (dependency bump, surefire
+# config, compiler level), so the selector always escalates to the full suite.
+JAVA_DEPENDENCY_PATTERNS='(^|/)(pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|gradle\.properties|gradle/wrapper/[^/]+|mvnw|mvnw\.cmd|\.mvn/[^/]+)$'
+
+# Java test CLASS-name conventions (applied to the basename only).
+#
+# Maven surefire's own defaults are `*Test.java`, `Test*.java`, `*Tests.java`,
+# `*TestCase.java`; Gradle users commonly add `*Spec.java` and `*IT.java`.
+#
+# The `Test[A-Z]\w*` form is deliberately narrowed to `Test[A-Z]` followed by
+# something that looks like a test subject rather than a helper: bare
+# `Test[^/]*` would swallow `TestHelper.java`, `TestUtils.java`,
+# `TestFixtures.java` — production/support classes that happen to start with
+# "Test". Misclassifying a SOURCE as a TEST is the dangerous direction: those
+# helpers are real code whose changing should run `related`, and calling them
+# tests would make the selector run them as if they were suites (Surefire
+# would then find no tests in them) and skip the source-driven lookup.
+#
+# A path under a test source root is caught independently by
+# java_is_test_file, so helpers living in src/test/java are still tests.
+JAVA_TEST_FILE_RE='(^|/)(Test[A-Z]\w*(Test|Tests|Case|Spec|IT)|[A-Z]\w*Test|[A-Z]\w*Tests|[A-Z]\w*TestCase|[A-Z]\w*Spec|[A-Z]\w*IT)\.java$'
+
+# Decide the strategy from three counts. Pure function — no filesystem access,
+# so the truth table is exhaustive and cheap to test.
+#
+#   $1 test_count    changed test files
+#   $2 src_count     changed non-test Java source files
+#   $3 deps_changed  1 when a build manifest changed, else 0
+#
+# Echoes exactly one of: full | changed-tests | related | skip
+select_java_test_strategy() {
+  # `${1-0}`, not `${1:-0}`: the `:-` form rewrites an EMPTY argument to "0",
+  # which would make the empty check below unreachable — a caller passing ""
+  # (e.g. an unset count that reached us as an empty string) would silently
+  # mean "0 changed files" and skip the suite. Only a genuinely UNSET argument
+  # defaults to 0.
+  local test_count="${1-0}"
+  local src_count="${2-0}"
+  local deps_changed="${3-0}"
+
+  # Non-numeric OR empty input must not silently become "0" and skip the
+  # suite: a caller bug there would run nothing and report PASS. Escalate.
+  case "$test_count" in
+    ''|*[!0-9]*) printf '%s' "full"; return 0 ;;
+  esac
+  case "$src_count" in
+    ''|*[!0-9]*) printf '%s' "full"; return 0 ;;
+  esac
+
+  # Dependency/build changes can break anything -> always the full suite.
+  if [ "$deps_changed" = "1" ]; then
+    printf '%s' "full"
+    return 0
+  fi
+
+  # Large batch: per-file selection loses its point, and the other two
+  # language arms use the same cutoff.
+  if [ "$test_count" -gt "$JAVA_MAX_CHANGED_TESTS" ]; then
+    printf '%s' "full"
+    return 0
+  fi
+
+  if [ "$test_count" -gt 0 ]; then
+    printf '%s' "changed-tests"
+    return 0
+  fi
+
+  if [ "$src_count" -gt 0 ]; then
+    printf '%s' "related"
+    return 0
+  fi
+
+  printf '%s' "skip"
+}
+
+# True (0) when the path looks like a Java test source.
+#
+#   $1 path, e.g. src/test/java/com/acme/FooTest.java
+java_is_test_file() {
+  local path="$1"
+  [ -n "$path" ] || return 1
+  # A path under a test source root is a test even when the basename does not
+  # end in Test/Tests/Spec — surefire includes are configurable, and a `*IT.java`
+  # integration test living in src/test/java must not be mistaken for source.
+  #
+  # The leading "/" matters: git reports repo-relative paths with no leading
+  # slash ("src/test/java/..."), so a bare "*/src/test/*" pattern would never
+  # match the most common case of all. Prefixing normalises both forms.
+  case "/$path" in
+    */src/test/java/*|*/src/test/*|*/src/androidTest/*) return 0 ;;
+  esac
+  printf '%s' "$path" | grep -qE "$JAVA_TEST_FILE_RE"
+}
+
+# True (0) when any of the given paths is a Java build manifest.
+java_dependency_changed() {
+  local path
+  for path in "$@"; do
+    [ -n "$path" ] || continue
+    if echo "$path" | grep -qE "$JAVA_DEPENDENCY_PATTERNS"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Map a Maven/Gradle source path to the test path(s) the convention implies.
+# Echoes one existing path per line, deduplicated, in discovery order. Echoes
+# nothing when no candidate exists — the caller then falls back to tier 3.
+#
+#   $1 source path, e.g. src/main/java/com/acme/service/Foo.java
+#
+# The mapping mirrors the standard layout: src/main/java/<pkg>/X.java ->
+# src/test/java/<pkg>/XTest.java. Multi-module builds are handled because the
+# module prefix is preserved verbatim (only `main`->`test` inside the path is
+# rewritten).
+java_related_tests() {
+  local src_file="$1"
+  [ -n "$src_file" ] || return 0
+
+  local filename dir base
+  base="${src_file%.java}"
+  filename="${base##*/}"
+  dir="$(dirname "$src_file")"
+
+  local candidates=""
+  # Primary convention: same package, main -> test.
+  # "/$dir" for the same reason as java_is_test_file: git's repo-relative paths
+  # have no leading slash, so a bare "*/src/main/java/*" would never match.
+  case "/$dir" in
+    */src/main/java/*)
+      # Rewrite the source root segment. `#` as the sed delimiter keeps the
+      # pattern readable: / would need escaping in both the pattern AND the
+      # replacement. The leading "/" is prepended BEFORE the substitution and
+      # stripped after: the pattern is anchored on "/src/main/java/", and a
+      # repo-relative dir ("src/main/java/com/acme") does not contain that
+      # leading slash, so a bare substitution would match nothing and every
+      # "related" lookup would return empty — quietly downgrading every commit
+      # to the full suite (correct, but pointless).
+      local test_dir
+      test_dir=$(printf '/%s' "$dir" | sed 's#/src/main/java/#/src/test/java/#')
+      test_dir="${test_dir#/}"
+      candidates="$candidates
+${test_dir}/${filename}Test.java
+${test_dir}/${filename}Tests.java
+${test_dir}/${filename}Spec.java
+${test_dir}/Test${filename}.java"
+      ;;
+  esac
+  # Colocated forms (some projects keep tests beside sources).
+  candidates="$candidates
+${dir}/${filename}Test.java
+${dir}/${filename}Tests.java
+${dir}/${filename}Spec.java
+${dir}/__tests__/${filename}Test.java"
+
+  local seen=""
+  local candidate
+  # IFS-safe iteration over newline-separated candidates.
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    [ -f "$candidate" ] || continue
+    # Dedupe: several patterns resolve to the same file whenever the source
+    # already sits under a test-looking root.
+    case "$seen" in
+      *"|$candidate|"*) continue ;;
+    esac
+    seen="$seen|$candidate|"
+    printf '%s\n' "$candidate"
+  done <<EOF
+$candidates
+EOF
+}
+
+# Turn test file paths into the Maven `-Dtest=` selector list.
+# Echoes one comma-separated argument, or nothing when the input is empty.
+#
+#   $1..$N test file paths
+#
+# Maven matches `-Dtest=` against simple class names (not paths), so the
+# directory part is dropped and the `.java` suffix stripped. Duplicates are
+# removed: `-Dtest=A,A` makes Surefire run A twice.
+java_maven_test_selector() {
+  local seen=" " out=""
+  local path name
+  for path in "$@"; do
+    [ -n "$path" ] || continue
+    name="${path##*/}"
+    name="${name%.java}"
+    [ -n "$name" ] || continue
+    case "$seen" in
+      *" $name "*) continue ;;
+    esac
+    seen="$seen$name "
+    if [ -z "$out" ]; then out="$name"; else out="$out,$name"; fi
+  done
+  [ -n "$out" ] && printf '%s' "$out"
+  return 0
+}
+
+# Turn test file paths into Gradle `--tests` filter arguments.
+# Echoes one argument per line (Gradle wants a repeated flag, not a list).
+#
+#   $1..$N test file paths
+java_gradle_test_filters() {
+  local seen=""
+  local path name
+  for path in "$@"; do
+    [ -n "$path" ] || continue
+    name="${path##*/}"
+    name="${name%.java}"
+    [ -n "$name" ] || continue
+    case "$seen" in
+      *"|$name|"*) continue ;;
+    esac
+    seen="$seen|$name|"
+    printf '%s\n' "$name"
+  done
+  return 0
+}

package/hooks/lib/jscpd-run.sh

@@ -26,6 +26,55 @@
 # than before the fix.
 JSCPD_DEFAULT_IGNORE_PATTERNS='(^|/)(node_modules|dist|build|target|coverage|out|\.next|\.nuxt|vendor)/|\.log$|\.txt$|\.(ya?ml)$|golden|baseline\.json$|evidence'
 
+# The BUILD-OUTPUT half of the set above, alone (#649).
+#
+# The combined set answers "is this worth comparing for duplication", which is a
+# question only Gate 2 asks. Filtering file list inputs with the whole set also
+# drops *.yaml, *.yml, *.txt and *.log -- and those are perfectly real project
+# files everywhere else. Doing that broke a live test on the first attempt:
+# `YAML staged files activate lint and IaC but skip SAST` expects a staged
+# infra/deployment.yaml to count as a code change, and whole-set filtering made
+# the hook announce "No code files changed, skipping lint" for a commit that
+# added a deployment manifest.
+#
+# So the two notions are separated here rather than shared:
+#
+#   BUILD OUTPUT (this)  - a directory tree that is generated or vendored:
+#                          not our code for ANY gate. Used to filter file lists.
+#   NON-REFACTORABLE (the combined set) - files whose duplication is data shape:
+#                          still project files, just not duplication candidates.
+#                          Gate 2 only.
+#
+# Same directory names, one definition; a directory added to the build-output
+# list reaches every gate at once, which is the point of #649.
+# Directory names that are generated or vendored in any mainstream toolchain.
+#
+# The second group (caches, virtualenvs, Python bytecode) is here because the
+# first version of this list did not have it and the same class of bug was one
+# `git add -A` away: __pycache__ is written by CPython itself and .pytest_cache
+# by pytest, so a Python project that commits its workspace stages .pyc-adjacent
+# artefacts and every scanner would read them as source. None of these can hold
+# hand-written project code.
+#
+# NOT included on purpose: bin/ and obj/ (real source trees in plenty of
+# projects -- e.g. cmd/bin layout, C# projects where obj/ IS output but bin/ is
+# often committed scripts) and .venv/venv (genuinely ambiguous: some projects
+# keep a small committed venv for reproducibility). Adding a name here removes
+# it from EVERY gate at once, so the list stays the names that are unambiguous.
+JSCPD_BUILD_OUTPUT_PATTERNS='(^|/)(node_modules|dist|build|target|coverage|out|\.next|\.nuxt|vendor|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|\.turbo|\.cache)/'
+
+# Is this path inside a dependency tree or a build-output directory?
+#
+# XP_GATE_JSCPD_DEFAULT_IGNORE=0 still disables it, so the escape hatch keeps
+# covering "some project really does want its vendor/ tree linted".
+jscpd_is_build_output() {
+  local _path="$1"
+  if [ "${XP_GATE_JSCPD_DEFAULT_IGNORE:-1}" = "0" ]; then
+    return 1
+  fi
+  printf '%s\n' "$_path" | grep -qE "$JSCPD_BUILD_OUTPUT_PATTERNS"
+}
+
 # Human-readable form, printed by the gate so the baseline is auditable (#591
 # point 3). Silence about the default is the same defect as silence about a
 # skipped gate: the user cannot answer "what did it scan".
@@ -38,6 +87,15 @@ jscpd_default_ignore_patterns() {
 # XP_GATE_JSCPD_DEFAULT_IGNORE=0 disables the set entirely: a project that
 # genuinely wants YAML compared must be able to say so, or the default would make
 # some real duplicates unreachable.
+#
+# SCOPE CHANGED IN #648: Gate 1's debugger check now calls this too, so the
+# switch governs "what counts as our code" for BOTH gates — not just jscpd.
+# Setting it to 0 makes Gate 1 scan dependencies and build output for debugger
+# statements as well, which is rarely what someone disabling duplicate detection
+# intends. Kept as one switch deliberately: two gates disagreeing about what a
+# build artifact is would be its own defect, and a project that vendors code
+# wants it treated consistently everywhere. Override per-run rather than
+# permanently if you only meant to widen Gate 2's scan.
 jscpd_is_default_ignored() {
   local _path="$1"
   if [ "${XP_GATE_JSCPD_DEFAULT_IGNORE:-1}" = "0" ]; then
@@ -46,6 +104,49 @@ jscpd_is_default_ignored() {
   printf '%s\n' "$_path" | grep -qE "$JSCPD_DEFAULT_IGNORE_PATTERNS"
 }
 
+# Drop dependency and build-output paths from a newline-separated file list on
+# stdin, echoing what remains (#649).
+#
+# Every scanner that builds its own list from `git diff --cached` used to
+# re-derive the exclusions by hand, and they drifted. The test-pairing check
+# excluded node_modules/.next/.nuxt/dist/build/.turbo/.cache but not vendor,
+# target, coverage or out -- so a staged `vendor/x.ts` was reported as a new
+# source file with no test. Six more sites had no exclusions at all. The one
+# place that got a shared ignore set (Gate 2) is the one that stopped having
+# this bug.
+#
+# This is the shared answer: callers pipe their staged list through it and stop
+# maintaining their own list. It reads stdin and writes stdout so it composes
+# with whatever selection the caller already did:
+#
+#     NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A \
+#       | filter_project_paths | grep -E '\.(ts|tsx)$' || true)
+#
+# Deliberately a filter, not a generator: a caller that needs a different git
+# query (only-added, only-modified) keeps it, and only the exclusion rule is
+# shared. Fail-open on empty input so `|| true` pipelines stay quiet.
+#
+# ON THE COUPLING (Delphi round 1, MC-01/FC-01): yes, this makes Gate 2's
+# ignore set load-bearing for every gate. Widening it now widens what every
+# scanner skips. That risk is accepted deliberately, and the alternative is
+# worse: the bug this fixes WAS a set of per-scanner definitions that drifted
+# apart, so N independent sets would reproduce it N times. The guard against
+# silent widening is that every change to the set lands in one reviewable
+# place, and #649's tests pin the boundary cases (vendor/target/coverage/out
+# ignored; src/lib/docs kept). If a gate ever needs a genuinely different
+# notion of "our code", introduce a second named set HERE rather than letting a
+# caller edit this one.
+filter_project_paths() {
+  local _fp
+  while IFS= read -r _fp || [ -n "$_fp" ]; do
+    [ -n "$_fp" ] || continue
+    if ! jscpd_is_build_output "$_fp"; then
+      printf '%s\n' "$_fp"
+    fi
+  done
+  return 0
+}
+
 # Echo the jscpd config the gate should pass, or nothing when the project has
 # none.
 #