@boyingliu01/xp-gate 0.31.4 → 0.32.1

package/hooks/pre-commit

@@ -710,48 +710,37 @@ if [ "$is_protected" = "true" ]; then
       esac
     done
 
-    # Doc-only changes: no source code files
+    # Doc-only / build-tooling-only changes need no VERSION bump.
+    #
+    # #624 defect 2: the split used to test ONLY `has_source`, which is true for
+    # any .py/.ts/... path INCLUDING `scripts/*`. So a commit that touched
+    # nothing but build tooling still fell into the version-check branch and was
+    # blocked. `has_real_source` is exactly "production source that needs a bump"
+    # — it was computed a few lines up but never consulted here. It must decide.
     if [ "$has_source" = "false" ]; then
       echo "✅ PASSED - Gate 0: Version Consistency Check (doc-only changes)"
+    elif [ "$has_real_source" = "false" ]; then
+      echo "✅ PASSED - Gate 0: Version Consistency Check (build-tooling-only changes)"
     else
-      # Check for bypass: commit message prefix (read from COMMIT_EDITMSG during pre-commit hook)
-      COMMIT_MSG=$(cat "$(git rev-parse --git-dir)/COMMIT_EDITMSG" 2>/dev/null | head -1 || echo "")
-      if echo "$COMMIT_MSG" | grep -qE '^\[skip-version-check\]'; then
-        if echo "$COMMIT_MSG" | grep -qE '^\[skip-version-check\].*(chore:|docs:|release:)'; then
-          if [ "$has_real_source" = "false" ]; then
-            echo "✅ PASSED - Gate 0: Version Consistency Check (bypass: chore/docs/release)"
-          else
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  VERSION CONSISTENCY CHECK (Gate 0)
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-Branch: $CURRENT_BRANCH
-ERROR: [skip-version-check] bypass used but production source files detected.
-
-Bypass only allows build-tooling changes (adapters/, scripts/, hooks/).
-Production source files require VERSION/CHANGELOG update.
-
-Files: $(echo "$STAGED_FILES" | tr '\n' ', ' | sed 's/,$//')
-"
-            exit 1
-          fi
-        else
-          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  VERSION CONSISTENCY CHECK (Gate 0)
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-Branch: $CURRENT_BRANCH
-ERROR: [skip-version-check] bypass prefix invalid.
-
-Allowed prefixes: chore:, docs:, release:
-Example: [skip-version-check] chore: update dependencies
-"
-          exit 1
-        fi
-      else
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+      # Production source on a protected branch without VERSION/CHANGELOG.
+      #
+      # #624 defect 1: this branch used to offer a `[skip-version-check]` message
+      # prefix as a bypass, read from `.git/COMMIT_EDITMSG`. That cannot work:
+      # git runs pre-commit BEFORE it builds the message, so the file does not
+      # exist yet (`-m`, `-F` and the interactive editor path all measured on
+      # git 2.54), and the hook gets no arguments. What the old code read was the
+      # PREVIOUS commit's message, so the prefix never matched — the documented
+      # recipe silently could not clear the gate, and --no-verify was the only
+      # way through. Rather than keep a bypass whose input this hook structurally
+      # cannot see, the escape hatch is the one that actually works and is
+      # already documented in CHANGELOG: the SKIP_VERSION_CHECK=1 environment
+      # variable (handled earlier in this Gate 0 block).
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
   VERSION CONSISTENCY CHECK (Gate 0)
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Branch: $CURRENT_BRANCH
-ERROR: Committing to a protected branch without VERSION/CHANGELOG update.
+ERROR: Committing production source to a protected branch without a
+VERSION/CHANGELOG update.
 
 This bypasses the ship workflow and causes version drift.
 Before committing:
@@ -759,18 +748,19 @@ Before committing:
   2. Add entry to CHANGELOG.md
   3. Run: node scripts/sync-version.cjs
 
-Or use the bypass prefix — the commit message FIRST LINE must START with:
-  [skip-version-check] chore: <description>
-Allowed types: chore: docs: release:. The bypass only permits build
-tooling changes (adapters/, scripts/, hooks/); production source files
-still require a VERSION/CHANGELOG update.
+Build-tooling-only changes (adapters/, scripts/, hooks/) need NO version bump
+and pass this gate automatically — no marker required.
+
+If you genuinely must land production source without a version bump, the
+supported escape hatch is the env var (a message prefix cannot work here
+because pre-commit runs before git builds the message):
+  SKIP_VERSION_CHECK=1 git commit ...
 
 Staged files: $(echo "$STAGED_FILES" | tr '\n' ', ' | sed 's/,$//')
 "
-        GATE_0_STATUS="BLOCK"
-        record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "1" "$GATE_0_START"
-        exit 1
-      fi
+      GATE_0_STATUS="BLOCK"
+      record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "1" "$GATE_0_START"
+      exit 1
     fi
   fi
   fi  # closes SKIP_VERSION_CHECK if/else
@@ -809,7 +799,44 @@ echo ""
 MIRROR_PATH_FILTER='^src/npm-package/'
 DASHBOARD_PATH_FILTER='^dashboard/'
 RAW_CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-CHANGED_FILES=$(printf '%s\n' "$RAW_CHANGED_FILES" | grep -v "$MIRROR_PATH_FILTER" | grep -v "$DASHBOARD_PATH_FILTER" || true)
+
+# Dependencies and build output are not project code (#649).
+#
+# `git diff --cached` knows nothing about .gitignore: anything that reaches the
+# index is listed. A project that vendors its dependencies, a CI fixture that
+# commits after `npm install`, an accidental `git add -A`, or a monorepo's
+# nested `packages/*/node_modules` therefore hands every downstream scanner a
+# list containing third-party source, and each scanner judges it as the
+# project's own.
+#
+# This has already cost two outages, one language branch at a time: #595 (Gate 1
+# PowerShell arm blocked every commit once Playwright's node_modules was
+# scanned for Write-Host) and #648 (Gate 1 JS/TS arm blocked on the bare
+# `debugger;` in node_modules/typescript/dist/internal/utils.js). Both were
+# fixed at the single site that happened to fail, so the next branch re-broke
+# the same way. The filter belongs HERE, at the one place the list is built, so
+# a scanner added tomorrow is safe by default instead of by memory.
+#
+# The exclusion itself is the shared build-output list from jscpd-run.sh
+# (jscpd_is_build_output), so the directory names have one definition across the
+# gates. Deliberately NOT the full Gate 2 ignore set: that one also drops
+# *.yaml/*.yml/*.txt/*.log because repetition there is data shape rather than a
+# refactoring target, and using it here would make a commit that only adds
+# infra/deployment.yaml look like "No code files changed" -- skipping the IaC
+# and lint gates that exist to scan exactly that file. The XP_GATE_JSCPD_DEFAULT_IGNORE=0
+# escape hatch still applies.
+#
+# RAW_CHANGED_FILES stays unfiltered on purpose: it is the only truthful answer
+# to "did the user stage anything at all", and a future "you accidentally
+# committed dependencies" warning needs to see what this filter removed.
+CHANGED_FILES=$(printf '%s\n' "$RAW_CHANGED_FILES" \
+  | grep -v "$MIRROR_PATH_FILTER" | grep -v "$DASHBOARD_PATH_FILTER" \
+  | {
+      while IFS= read -r _cf; do
+        [ -n "$_cf" ] || continue
+        jscpd_is_build_output "$_cf" || printf '%s\n' "$_cf"
+      done
+    } || true)
 
 # REQ-F2: one commit-level docs-only verdict, computed once and reused by the
 # heavy gates (2/5/9/12). Light gates never consult it — a secret in a README
@@ -844,7 +871,22 @@ any_changed_files_match() {
   local pattern
 
   for pattern in "$@"; do
-    if printf '%s\n' "$CHANGED_FILES" | grep -qE -- "$pattern"; then
+    # Here-string, not `printf | grep -q`. Under the `set -o pipefail` above,
+    # `grep -q` exits the moment it matches, the writer takes SIGPIPE, and the
+    # pipeline reports 141 -- so the `if` reads "no match" even though grep DID
+    # match. Whether that happens depends on whether the list fits in the pipe
+    # buffer, which is why it showed up as a size-dependent, flaky SKIP.
+    #
+    # It was not theoretical: in the Cross-Platform CI first-commit fixture the
+    # staged list is long enough to trip it, and Gate 1 announced "No code files
+    # changed, skipping lint" for a commit that had staged 19 shell scripts --
+    # while Gate 2, reading the same variable, happily scanned them and reported
+    # duplicates. The hook log carried the fingerprint the whole time:
+    # `line 847: printf: Broken pipe`.
+    #
+    # A here-string has no writer process to be killed, so the match cannot be
+    # lost. Same reason `run_tsx` and the coverage probes avoid `| head`.
+    if grep -qE -- "$pattern" <<< "$CHANGED_FILES"; then
       return 0
     fi
   done
@@ -1506,9 +1548,32 @@ else
     fi
 
     # Debug statement detection (debugger statement in JS/TS)
-    TS_DEBUG_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx)$' || true)
+    #
+    # Dependencies and build output are filtered out first (#648). The list
+    # comes from `git diff --cached`, so a project (or a CI fixture) that
+    # vendors or commits its dependencies gets the dependency's OWN source
+    # scanned as if it were project code. TypeScript 7.x ships a bare
+    # `debugger;` in dist/internal/utils.js, which blocked commits that changed
+    # nothing of their own:
+    #     ❌ BLOCKED - 'debugger' statements detected:
+    #     node_modules/typescript/dist/internal/utils.js:18:    debugger;
+    # Pinning the dependency's version only postpones that: any package may
+    # carry a debugger statement, and which one lands changes with every
+    # install. The rule the gate actually wants is "no debugger in OUR code",
+    # so the ignore set Gate 2 already uses decides what counts as ours — one
+    # notion of build output across the gates, overridable through the same
+    # XP_GATE_JSCPD_DEFAULT_IGNORE switch.
+    TS_DEBUG_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx)$' | {
+      while IFS= read -r _df; do
+        [ -n "$_df" ] || continue
+        if ! jscpd_is_build_output "$_df"; then
+          printf '%s\n' "$_df"
+        fi
+      done
+    } || true)
     if [ -n "$TS_DEBUG_FILES" ]; then
-      DEBUGGER_HITS=$(grep -n '^\s*debugger\s*;\?\s*$' $TS_DEBUG_FILES 2>/dev/null || true)
+      # NUL-separated so paths with spaces survive; a bare $VAR would word-split.
+      DEBUGGER_HITS=$(printf '%s\n' "$TS_DEBUG_FILES" | tr '\n' '\0' | xargs -0 grep -n '^\s*debugger\s*;\?\s*$' 2>/dev/null || true)
       if [ -n "$DEBUGGER_HITS" ]; then
         echo ""
         echo "❌ BLOCKED - 'debugger' statements detected:"
@@ -2189,7 +2254,10 @@ else
   fi
 
   # --- BLOCK path: New .ts/.tsx files without corresponding tests ---
-  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v 'node_modules/' | grep -v '\.next/' | grep -v '\.nuxt/' | grep -v 'dist/' | grep -v 'build/' | grep -v '.turbo/' | grep -v '.cache/' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
+  # Exclusions come from filter_project_paths (#649). The hand-maintained list
+  # this replaced omitted vendor/target/coverage/out, so a staged vendor/x.ts
+  # was reported as new source with no test.
+  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
 
   # Strip PROJECT_SUBDIR prefix from new-TS-file paths ONLY when the hook
   # actually cd'd into the subdirectory (IN_PROJECT_SUBDIR=1; single-language
@@ -2274,10 +2342,12 @@ else
   fi
 
   # --- WARNING path: Modified files (any lang) + New non-TS files ---
+  # filter_project_paths strips dependencies and build output (#649); without
+  # it a staged vendor/ or target/ module is reported as source needing a test.
   WARNING_SOURCE_FILES=$(
     {
-      git diff --cached --name-only --diff-filter=M | grep -E '\.(ts|tsx|py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
-      git diff --cached --name-only --diff-filter=A | grep -E '\.(py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
+      git diff --cached --name-only --diff-filter=M | filter_project_paths | grep -E '\.(ts|tsx|py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
+      git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
     } | sort -u || true
   )
 
@@ -2400,7 +2470,7 @@ else
   # Gate 5b: Mock Density ADVISORY Scan (pure bash — no npx tsx overhead)
   # 30% = ADVISORY, 50% = suggests @mock-justified. Does NOT block commit.
   # ========================================================================
-  CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(test|spec)\.(ts|tsx|js|jsx|cjs|mjs|py|go)$' || true)
+  CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM | filter_project_paths | grep -E '\.(test|spec)\.(ts|tsx|js|jsx|cjs|mjs|py|go)$' || true)
 
   # Nested plugin sub-projects (plugins/<name>/) own their own vitest config and
   # are excluded from the root suite (`vitest.config.ts` excludes `plugins/**`,
@@ -2548,7 +2618,7 @@ else
           CHANGED_TEST_FILE_COUNT=$(echo "$SELECTED_TEST_FILES" | grep -c '.' || true)
           
           # Also get changed source files (non-test) for related-test lookup
-          CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|tsx|js|jsx)$' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__tests__' | grep -v '\.d\.ts$' | grep -v '__snapshots__' || true)
+          CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM | filter_project_paths | grep -E '\.(ts|tsx|js|jsx)$' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__tests__' | grep -v '\.d\.ts$' | grep -v '__snapshots__' || true)
           # Nested plugin sub-projects are excluded from the root suite; their
           # sources must not drive root-vitest related-test lookup either (it
           # would resolve to plugin-local paths vitest cannot collect).
@@ -2784,9 +2854,14 @@ else
             #   full -> unchanged behavior: whole suite + real threshold.
             #   skip -> nothing test-relevant changed; no pytest at all.
             PY_CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null \
+              | filter_project_paths \
               | grep -E '(^|/)test_[^/]*\.py$|_test\.py$' || true)
             PY_CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null \
+              | filter_project_paths \
               | grep -E '\.py$' | grep -vE '(^|/)test_[^/]*\.py$|_test\.py$' || true)
+            # NOT filtered on purpose: this list answers "did a requirements
+            # file change", which is a property of the whole commit including
+            # paths under a vendor/ tree that filter_project_paths removes.
             PY_CHANGED_ALL=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)
             # `grep -c '.'` prints its own zero AND exits 1 on an empty list
             # (#493), so the count is derived with `|| true` + wc -l instead.
@@ -2885,9 +2960,33 @@ else
           echo "ℹ️  Shell coverage not typically measured"
           ;;
         *)
+          # #640: hand the staged set to the adapter. Java's run_coverage uses it
+          # for three-tier smart selection (changed-tests -> related -> full);
+          # without it the adapter deliberately runs the full suite rather than
+          # guessing, so this export failing closed is safe.
+          # Colon-separated: newlines do not survive every adapter's word
+          # splitting, and paths with spaces stay intact inside the value.
+          GATE_CHANGED_FILES=$(printf '%s' "$CHANGED_FILES" | tr '\n' ':')
+          export GATE_CHANGED_FILES
+          # The adapter runs inside $(...), so it cannot set PARTIAL_TEST_RUN
+          # for us. It writes the chosen strategy to this file and we raise the
+          # flag here, in the shell that later reads it. Without this a Java
+          # subset run under 80% coverage would take the hard-BLOCK branch
+          # instead of the WARN branch, exactly the bug #556 fixed for Python.
+          _java_partial_file=$(mktemp 2>/dev/null || echo "")
+          if [ -n "$_java_partial_file" ]; then
+            export XP_GATE_PARTIAL_RUN_FILE="$_java_partial_file"
+          fi
           default_cov_output=$(run_coverage 2>&1)
           COV_EXIT=$((COV_EXIT || $?))
           echo "$default_cov_output" | head -30
+          unset XP_GATE_PARTIAL_RUN_FILE GATE_CHANGED_FILES
+          if [ -n "$_java_partial_file" ]; then
+            if [ -s "$_java_partial_file" ]; then
+              PARTIAL_TEST_RUN=true
+            fi
+            rm -f "$_java_partial_file" 2>/dev/null || true
+          fi
           ;;
       esac
     else
@@ -3316,7 +3415,7 @@ else
   # New files must have ≥80% coverage individually.
   # ============================================================================
   if has_project_lang "typescript" && [ -f "coverage/coverage-summary.json" ]; then
-    NEW_SOURCE_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v '\.d\.ts$' || true)
+    NEW_SOURCE_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(ts|tsx)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v '\.d\.ts$' || true)
     if [ -n "$NEW_SOURCE_FILES" ]; then
       echo ""
       echo "   └─ Per-file coverage check for new files:"
@@ -3717,8 +3816,11 @@ else
     # governed by Mirror Parity in CI, which compares content rather than
     # re-linting it. (See the same exclusion in adapters/powershell.sh.)
     MIRROR_EXCLUDE="$MIRROR_PATH_FILTER"
-    NEW_FILES=$(git diff --cached --name-only --diff-filter=A | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
-    MODIFIED_FILES=$(git diff --cached --name-only --diff-filter=M | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
+    # filter_project_paths also removes dependencies and build output (#649):
+    # a staged node_modules/ or dist/ file is not budgetable project code, and
+    # entering it in the Boy Scout baseline would budget a path nobody edits.
+    NEW_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
+    MODIFIED_FILES=$(git diff --cached --name-only --diff-filter=M | filter_project_paths | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
     
     if [ -z "$NEW_FILES" ] && [ -z "$MODIFIED_FILES" ]; then
       echo "     ✅ No new or modified files to check."
@@ -4129,6 +4231,90 @@ else
 fi
 # ============================================================================
 
+# ============================================================================
+# GATE 13: Compiler Strictness Check
+# The compiler is the first and cheapest static analyser for a compiled language
+# and XP-Gate never used it as one: cpp.sh only runs clang-tidy/cppcheck over the
+# first 20 files, and Gate 9's build-integrity half is TypeScript-and-Maven only.
+# A measured `g++ -Wall -Wextra` pass reports -Wnon-virtual-dtor, -Wreorder,
+# -Wparentheses and -Wclass-memaccess on an innocuous-looking file; bare `javac`
+# reports NOTHING for a raw type where `-Xlint:all` reports [rawtypes].
+#
+# Verdicts: 0 PASS, 1 FAIL (new findings -> blocked), 2 BLOCK (ran but output
+# untrustworthy), 3 WARN (tool absent / cross-compiling / timeout / warn-only).
+# A missing compiler is a SKIP-class WARN per the project convention, NOT a block.
+#
+# Escape hatches: XP_GATE_DISABLE_13=1 (kill switch),
+# XP_GATE_COMPILER_STRICTNESS=strict|balanced|warn-only,
+# XP_GATE_COMPILER_ANALYZER=1 (gcc -fanalyzer, C only, opt-in).
+# Design: docs/plans/2026-10-26-gate-13-compiler-strictness-design.md
+#
+# NOTE: this block is a TAIL APPEND after Gate 12 and intentionally touches no
+# line of the gates above it.
+# ============================================================================
+GATE_13_STATUS="SKIP"
+if [ "${XP_GATE_DISABLE_13:-}" = "1" ]; then
+  echo "⏭️  SKIPPED - Gate 13: Compiler Strictness (XP_GATE_DISABLE_13=1)"
+  GATE_13_STATUS="SKIP"
+elif [ -f "$GATE_DIR/gate-13-compiler-strictness.sh" ] || [ -f "$(git rev-parse --show-toplevel 2>/dev/null)/githooks/gate-13-compiler-strictness.sh" ]; then
+  echo "⚙️  Gate 13: Compiler Strictness Check..."
+  GATE13_START=$(gate_start_ms)
+  (
+    # Each stage runs inside the subshell so its shell state cannot leak back
+    # into pre-commit. Verdicts are reduced to the WORST code seen:
+    # FAIL/BLOCK (1/2) always win; WARN (3) only beats PASS (0).
+    _g13_script="$GATE_DIR/gate-13-compiler-strictness.sh"
+    [ -f "$_g13_script" ] || _g13_script="$(git rev-parse --show-toplevel)/githooks/gate-13-compiler-strictness.sh"
+    # shellcheck source=/dev/null
+    . "$_g13_script"
+
+    _g13_worst=0
+    _g13_rc=0
+    _g13_note() {
+      case "$1" in
+        1|2) _g13_worst=$1 ;;
+        3) [ "$_g13_worst" -eq 0 ] && _g13_worst=3 ;;
+      esac
+      return 0
+    }
+
+    gate13_run_cpp_analysis;   _g13_rc=$?; _g13_note "$_g13_rc"
+    gate13_run_java_analysis;  _g13_rc=$?; _g13_note "$_g13_rc"
+    gate13_run_analyzer;       _g13_rc=$?; _g13_note "$_g13_rc"
+
+    exit "$_g13_worst"
+  )
+  GATE_13_RC=$?
+  GATE13_END=$(now_ms)
+  GATE_13_DURATION=$(( (GATE13_END - GATE13_START) / 1000 ))
+  case "$GATE_13_RC" in
+    0) GATE_13_STATUS="PASS" ;;
+    1) GATE_13_STATUS="FAIL" ;;
+    2) GATE_13_STATUS="BLOCK" ;;
+    *) GATE_13_STATUS="WARN" ;;
+  esac
+  echo "   Gate 13 ($GATE_13_STATUS) completed in ${GATE_13_DURATION}s"
+  record_gate_audit "gate-13" "compiler-strictness" "$GATE_13_STATUS" "0" "$GATE13_START"
+  # Every other gate blocks by exiting immediately (e.g. Gate 1's
+  # "❌ BLOCKED ... exit 1"); there is no aggregate-then-exit shared with
+  # gates 0-12, so Gate 13 must do the same or its FAIL would only be cosmetic
+  # in the report while the commit sails through.
+  if [ "$GATE_13_STATUS" = "FAIL" ] || [ "$GATE_13_STATUS" = "BLOCK" ]; then
+    echo ""
+    echo "❌ BLOCKED - Gate 13: Compiler Strictness (${GATE_13_STATUS})"
+    echo "   Fix the compiler findings above. To record pre-existing warnings:"
+    echo "     xp-gate compiler-baseline create"
+    echo "   To relax strictness: XP_GATE_COMPILER_STRICTNESS=warn-only"
+    echo "   Emergency only:      XP_GATE_DISABLE_13=1"
+    exit 1
+  fi
+else
+  echo "⏭️  SKIPPED - Gate 13: Compiler Strictness (gate-13-compiler-strictness.sh not found)"
+  GATE_13_STATUS="SKIP"
+fi
+echo ""
+# ============================================================================
+
 generate_quality_report() {
   local HISTORY_FILE=".quality-history.jsonl"
   local COMMIT_HASH
@@ -4425,6 +4611,22 @@ generate_quality_report() {
 }
 ENDJSON
 
+  # ── Gate 13 injection (tail append; no existing line above is modified) ────
+  # The heredoc is closed deliberately before Gate 13 so this sprint ADDS lines
+  # instead of editing gates 0-12's report block, keeping the two branches'
+  # hunks disjoint. Scores are recomputed over 13 gates afterwards.
+  if [ -n "${GATE_13_STATUS:-}" ] && [ -f "$REPORT_FILE" ]; then
+    _XP_G13="$REPORT_FILE" _XP_G13S="$GATE_13_STATUS" node -e "
+      const fs=require('fs'),p=process.env._XP_G13;
+      try{
+        const j=JSON.parse(fs.readFileSync(p,'utf8'));
+        j.gates=j.gates||{};
+        j.gates.gate13_compiler_strictness={name:'Compiler Strictness',status:process.env._XP_G13S,tool:'gate-13-compiler-strictness.sh'};
+        fs.writeFileSync(p,JSON.stringify(j,null,2)+'\n');
+      }catch(e){}
+    " 2>/dev/null || true
+  fi
+
   # ── Persistent per-run report (Issue #101) ────────────────────────────────────────
   local REPORTS_DIR=".xp-gate/reports/pre-commit"
   local REPORT_TS

package/lib/__tests__/detect-deps-dsh-profile.test.js

@@ -0,0 +1,106 @@
+/**
+ * @test REQ-635
+ * @intent `xp-gate init` 会向 ~/.dsh/skills 部署技能、npm 包也带 plugins/dsh，
+ *         但 PLATFORM_PROFILES 里没有 dsh 条目，getSkillsDirs('dsh') 静默回落到
+ *         opencode 的路径，导致 DSH 机器的技能从不被解析（#635）
+ * @covers AC-635-04, AC-635-05
+ */
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+describe('PLATFORM_PROFILES covers dsh (#635)', () => {
+  let tmpHome;
+  let originalHome;
+
+  beforeEach(() => {
+    originalHome = process.env.HOME;
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-dsh-'));
+    process.env.HOME = tmpHome;
+    vi.resetModules();
+    delete require.cache[require.resolve('../detect-deps')];
+    delete require.cache[require.resolve('../shared-paths')];
+  });
+
+  afterEach(() => {
+    process.env.HOME = originalHome;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+  });
+
+  // AC-635-04: asking for dsh skills must return the dsh directory, not a
+  // silent fallback to opencode's.
+  it('getSkillsDirs("dsh") resolves ~/.dsh, not the opencode fallback', () => {
+    const { getSkillsDirs } = require('../detect-deps');
+    const dirs = getSkillsDirs('dsh');
+
+    expect(dirs.length).toBeGreaterThan(0);
+    expect(dirs[0]).toBe(path.join(tmpHome, '.dsh', 'skills'));
+    // The pre-fix behaviour: falls through to PLATFORM_PROFILES.opencode.
+    expect(dirs[0]).not.toContain(path.join('.config', 'opencode'));
+  });
+
+  // AC-635-05: the profile is a real entry, so a caller enumerating platforms
+  // sees dsh alongside the three that were already there.
+  it('dsh is an enumerable platform profile with skillsDirs and requiredDeps', () => {
+    const { PLATFORM_PROFILES, getSkillsDirs } = require('../detect-deps');
+
+    expect(Object.keys(PLATFORM_PROFILES)).toContain('dsh');
+    expect(Object.keys(PLATFORM_PROFILES)).toEqual(
+      expect.arrayContaining(['opencode', 'claude-code', 'qoder', 'dsh'])
+    );
+
+    const profile = PLATFORM_PROFILES.dsh;
+    expect(Array.isArray(profile.skillsDirs)).toBe(true);
+    expect(profile.requiredDeps).toBeDefined();
+    // Profiles store home-relative segments; getSkillsDirs resolves them.
+    expect(profile.skillsDirs[0]).toEqual(['.dsh', 'skills']);
+    expect(getSkillsDirs('dsh')[0]).toBe(path.join(tmpHome, '.dsh', 'skills'));
+  });
+
+  // Every profile must be plain data — no getters mixed in with values, which
+  // would break Object.keys()/JSON round-trips and made the object's contract
+  // depend on which key you touched (Delphi R1 CI-01).
+  it('every profile is plain enumerable data, with no accessor properties', () => {
+    const { PLATFORM_PROFILES } = require('../detect-deps');
+
+    for (const name of Object.keys(PLATFORM_PROFILES)) {
+      const descriptor = Object.getOwnPropertyDescriptor(PLATFORM_PROFILES, name);
+      expect(descriptor.get, `${name} must not be an accessor`).toBeUndefined();
+      // A plain value also survives a JSON round-trip unchanged.
+      expect(JSON.parse(JSON.stringify(PLATFORM_PROFILES[name]))).toEqual(
+        PLATFORM_PROFILES[name]
+      );
+    }
+  });
+
+  // Paths must follow process.env.HOME rather than pinning the home directory
+  // at require() time — the trap doctor.js documents at its top.
+  it('resolved paths follow a HOME change after require', () => {
+    const { getSkillsDirs } = require('../detect-deps');
+    // Loaded above with the first tmpHome; move HOME and resolve again.
+    const secondHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-dsh2-'));
+    try {
+      process.env.HOME = secondHome;
+      expect(getSkillsDirs('dsh')[0]).toBe(path.join(secondHome, '.dsh', 'skills'));
+      // The pre-existing profiles must follow too — they used to be frozen at
+      // require() time from a destructured HOME_DIR.
+      expect(getSkillsDirs('opencode')[0]).toBe(
+        path.join(secondHome, '.config', 'opencode', 'skills')
+      );
+    } finally {
+      fs.rmSync(secondHome, { recursive: true, force: true });
+    }
+  });
+
+  // Anti-vacuity: the three pre-existing profiles must keep their own paths,
+  // proving the getter did not disturb them.
+  it('leaves the pre-existing profiles unchanged', () => {
+    const { getSkillsDirs } = require('../detect-deps');
+
+    expect(getSkillsDirs('opencode')[0]).toBe(
+      path.join(tmpHome, '.config', 'opencode', 'skills')
+    );
+    expect(getSkillsDirs('qoder')[0]).toBe(path.join(tmpHome, '.qoder', 'skills'));
+    expect(getSkillsDirs('claude-code')[0]).toBe(path.join(tmpHome, '.claude', 'skills'));
+  });
+});