@boyingliu01/xp-gate 0.32.0 → 0.32.2

package/adapters/powershell.sh

@@ -268,6 +268,19 @@ run_static_analysis() {
         return 3
       fi
     fi
+    # Downstream hardening (ported): a scope file narrows the gate to product
+    # code, but it must be analysed under a DECLARED rule set. With no
+    # PSScriptAnalyzerSettings.psd1 the -Settings binding falls back to defaults,
+    # so a repo that declared its scope silently swapped rule sets. Refuse the
+    # run rather than grade against an unknown rule set.
+    #
+    # Mirrors the missing-module semantics (return 3 = fail closed upstream).
+    if [ "${#analysis_targets[@]}" -gt 0 ] && [ ! -f "PSScriptAnalyzerSettings.psd1" ]; then
+      echo "XP_G1_REASON: analysis-settings-missing:PSScriptAnalyzerSettings.psd1"
+      echo "  ⚠️  $scope_file is in use but PSScriptAnalyzerSettings.psd1 is absent - refusing to analyse with an unknown rule set"
+      return 3
+    fi
+
 
     if [ "${#analysis_targets[@]}" -gt 0 ]; then
       # Scoped per-path run. -Path binds ONE string only (an array argument
@@ -430,14 +443,27 @@ run_lint() {
 # A hanging Pester test (e.g. a test that dot-sources a script whose body performs
 # WMI/registry/scheduled-task scans) would otherwise block `git commit` forever.
 # Default 300s, override via XP_GATE_POWERSHELL_TEST_TIMEOUT_S.
+# #599: ONE helper, TWO budgets. The instrumented coverage run enables
+# CodeCoverage, so instrumentation alone costs more than a plain run: a shared
+# 300s budget is not the same headroom for both. The caller passes its default
+# explicitly and the timeout message names the variable that actually governs it,
+# otherwise a budget shortfall gets reported as "a test is hanging" and the
+# reader is sent to the wrong place.
 _pester_timeout() {
-  local default_s="${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}"
+  local budget_var="$1"
+  local default_s="${2:-300}"
+  local effective_s
+  if [ "$budget_var" = "XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S" ]; then
+    effective_s="${XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S:-$default_s}"
+  else
+    effective_s="${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-$default_s}"
+  fi
   # Prefer GNU timeout (Git Bash / Linux). On Windows where `timeout` resolves to
   # the native timeout.exe, fall back to running without a hard timeout.
   if command -v timeout >/dev/null 2>&1 && timeout --version 2>/dev/null | grep -qi "coreutils"; then
-    timeout "${default_s}s" "$@"
+    timeout "${effective_s}s" "${@:3}"
   else
-    "$@"
+    "${@:3}"
   fi
 }
 
@@ -465,7 +491,7 @@ run_tests() {
   if [ "${#test_files[@]}" -gt 0 ]; then
     test_paths=$(_powershell_path_array "${test_files[@]}")
     echo "Running Pester tests..."
-    _pester_timeout "$PWSH" "${POWERSHELL_ARGS[@]}" "
+_pester_timeout "XP_GATE_POWERSHELL_TEST_TIMEOUT_S" "${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}" "$PWSH" "${POWERSHELL_ARGS[@]}" "
       \$results = Invoke-Pester -Path $test_paths -PassThru
       if (\$results.FailedCount -gt 0) {
         Write-Host \"FAILED: \$(\$results.FailedCount) test(s)\"
@@ -476,7 +502,7 @@ run_tests() {
     "
     local run_exit=$?
     if [ "$run_exit" = "124" ]; then
-      echo "⚠️  Pester tests TIMED OUT after ${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}s (may be hanging)."
+  echo "⚠️  Pester tests TIMED OUT after ${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}s (XP_GATE_POWERSHELL_TEST_TIMEOUT_S; may be hanging)."
       echo "    A test may be blocking on a system call (WMI/registry/scheduled-task)."
       echo "    Fix the hanging test, or set XP_GATE_POWERSHELL_TEST_TIMEOUT_S to a higher value."
       return 1
@@ -572,7 +598,7 @@ run_coverage() {
     # is the deprecated Pester 4 parameter set and fails outright on Pester 5.x
     # ("cannot resolve parameter set"). Using it silently produced no coverage.xml,
     # which the pre-commit hook then reported as an unparseable/zero result.
-    _pester_timeout "$PWSH" "${POWERSHELL_ARGS[@]}" "
+_pester_timeout "XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S" "${XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S:-900}" "$PWSH" "${POWERSHELL_ARGS[@]}" "
       \$cfg = New-PesterConfiguration
       \$cfg.Run.Path = $test_paths
       \$cfg.CodeCoverage.Enabled = \$true
@@ -587,7 +613,7 @@ run_coverage() {
     " 2>&1
     local cov_exit=$?
     if [ "$cov_exit" = "124" ]; then
-      echo "⚠️  Pester coverage TIMED OUT after ${XP_GATE_POWERSHELL_TEST_TIMEOUT_S:-300}s (may be hanging)."
+  echo "⚠️  Pester coverage TIMED OUT after ${XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S:-900}s (XP_GATE_POWERSHELL_COVERAGE_TIMEOUT_S; instrumentation costs more than a plain run - raise this rather than suspecting a hang)."
       return 1
     fi
     return $cov_exit

package/gate-3.sh

@@ -176,7 +176,42 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                       known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
                     }
                   }
-                  function norm(p) { return String(p).replace(/\\\\/g, "/").replace(/^\.\//, ""); }
+                  // The measurement emits ABSOLUTE paths (pwsh resolved them), while
+                  // a baseline recorded by a repo-side generator holds paths relative
+                  // to the repo root. Normalising alone cannot bridge that, so a key
+                  // miss falls back to a suffix match on the file path: exactly one
+                  // known entry whose normalised path ends with "<sep>measured" is the
+                  // same file. Without this every existing function looked brand new,
+                  // and a real regression was reported as "new function" -- the right
+                  // verdict for the wrong reason.
+                  //
+                  // Backslashes are normalised with split/join, NOT -replace: this JS
+                  // is embedded in a double-quoted bash command, where a regex escape
+                  // loses a level and silently matches the wrong number of
+                  // backslashes. Measured: /\\\\/g arrived as /\\/g, matched only
+                  // doubled separators, and every Windows path kept its backslashes.
+                  function norm(p) {
+                    return String(p)
+                      .split("\\").join("/")
+                      .replace(/^[A-Za-z]:\//, "")
+                      .replace(/^\.\//, "")
+                      .replace(/^\//, "");
+                  }
+                  function lookup(path, name) {
+                    const key = norm(path) + "::" + name;
+                    if (known.has(key)) return known.get(key);
+                    const target = norm(path);
+                    let hit = null;
+                    for (const [k, v] of known) {
+                      const [kp, kn] = k.split("::");
+                      if (kn !== name) continue;
+                      if (target.endsWith("/" + kp) || kp.endsWith("/" + target) || kp === target) {
+                        if (hit !== null && hit !== v) return null;  // ambiguous: treat as new
+                        hit = v;
+                      }
+                    }
+                    return hit;
+                  }
                   const seen = new Set();
                   const regressions = [];
                   const improved = [];
@@ -186,7 +221,7 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                     const key = norm(m[1]) + "::" + m[3];
                     const now = Number(m[4]);
                     seen.add(key);
-                    const was = known.has(key) ? known.get(key) : null;
+                    const was = lookup(m[1], m[3]);
                     if (was === null) {
                       if (now > threshold) {
                         regressions.push(m[1] + ":" + m[2] + "  " + m[3] + "  new function at ccn=" + now);
@@ -329,12 +364,26 @@ else
     #              is reverted at the next publish, so grading it cannot be acted
     #              on (doctorDelphi CCN=106 blocked every src/npm-package commit,
     #              on HEAD too — no baseline entry could ever exist for it).
-    #   test       __tests__/, *.test.*, *_test.{py,go}, *Test(s).java — recorded
-    #              in the report's test bucket, never in the baseline.
+    #   test       test dirs (tests/, test/, __tests__/), *.test.*, test_*.py,
+    #              *_test.{py,go}, *Test(s).java — recorded in the report's test
+    #              bucket, never in the baseline.
     # Both prefixes and the test pattern mirror ccn-report.cjs so the gate and
     # the writer cannot drift apart again (pinned by __tests__/gate-3-*.bats).
+    #
+    # #634: pytest's default is `python_files = test_*.py` under a `tests/`
+    # root. The previous pattern only knew the SUFFIX form `_test.{py,go}` and
+    # `*.test.*`, so a pytest-laid-out project had every test module graded as
+    # production source: test-helper complexity was reported as source debt and
+    # the ratchet could block on files the baseline deliberately never records
+    # (bucket === 'test').
+    #   `(^|/)(tests?)/`   — a tests/ or test/ directory anywhere in the tree
+    #   `(^|/)test_[^/]*\.py$` — pytest default filenames at any depth
+    # Both are anchored with (^|/) so `latest/`, `contest/`, `attest/` and
+    # `my_test_dir/` are NOT caught (a leading `_?test_.*\.py$` would have
+    # swallowed `src/my_test_dir/bar.py`).
+    # Must stay equivalent to TEST_PATH in scripts/ccn-report.cjs.
     CC_FILES=$(echo "$CC_FILES" | grep -vE \
-      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests__?/|\.test\.[cm]?[jt]sx?$|_test\.(py|go)$|Test(s)?\.java$' || true)
+      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests?__/|(^|/)(tests?)/|\.test\.[cm]?[jt]sx?$|(^|/)test_[^/]*\.py$|_test\.(py|go)$|Test(s)?\.java$' || true)
 
     if [ -n "$CC_FILES" ]; then
       echo "Checking complexity for source files..."

package/hooks/gate-3.sh

@@ -176,7 +176,42 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                       known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
                     }
                   }
-                  function norm(p) { return String(p).replace(/\\\\/g, "/").replace(/^\.\//, ""); }
+                  // The measurement emits ABSOLUTE paths (pwsh resolved them), while
+                  // a baseline recorded by a repo-side generator holds paths relative
+                  // to the repo root. Normalising alone cannot bridge that, so a key
+                  // miss falls back to a suffix match on the file path: exactly one
+                  // known entry whose normalised path ends with "<sep>measured" is the
+                  // same file. Without this every existing function looked brand new,
+                  // and a real regression was reported as "new function" -- the right
+                  // verdict for the wrong reason.
+                  //
+                  // Backslashes are normalised with split/join, NOT -replace: this JS
+                  // is embedded in a double-quoted bash command, where a regex escape
+                  // loses a level and silently matches the wrong number of
+                  // backslashes. Measured: /\\\\/g arrived as /\\/g, matched only
+                  // doubled separators, and every Windows path kept its backslashes.
+                  function norm(p) {
+                    return String(p)
+                      .split("\\").join("/")
+                      .replace(/^[A-Za-z]:\//, "")
+                      .replace(/^\.\//, "")
+                      .replace(/^\//, "");
+                  }
+                  function lookup(path, name) {
+                    const key = norm(path) + "::" + name;
+                    if (known.has(key)) return known.get(key);
+                    const target = norm(path);
+                    let hit = null;
+                    for (const [k, v] of known) {
+                      const [kp, kn] = k.split("::");
+                      if (kn !== name) continue;
+                      if (target.endsWith("/" + kp) || kp.endsWith("/" + target) || kp === target) {
+                        if (hit !== null && hit !== v) return null;  // ambiguous: treat as new
+                        hit = v;
+                      }
+                    }
+                    return hit;
+                  }
                   const seen = new Set();
                   const regressions = [];
                   const improved = [];
@@ -186,7 +221,7 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                     const key = norm(m[1]) + "::" + m[3];
                     const now = Number(m[4]);
                     seen.add(key);
-                    const was = known.has(key) ? known.get(key) : null;
+                    const was = lookup(m[1], m[3]);
                     if (was === null) {
                       if (now > threshold) {
                         regressions.push(m[1] + ":" + m[2] + "  " + m[3] + "  new function at ccn=" + now);
@@ -329,12 +364,26 @@ else
     #              is reverted at the next publish, so grading it cannot be acted
     #              on (doctorDelphi CCN=106 blocked every src/npm-package commit,
     #              on HEAD too — no baseline entry could ever exist for it).
-    #   test       __tests__/, *.test.*, *_test.{py,go}, *Test(s).java — recorded
-    #              in the report's test bucket, never in the baseline.
+    #   test       test dirs (tests/, test/, __tests__/), *.test.*, test_*.py,
+    #              *_test.{py,go}, *Test(s).java — recorded in the report's test
+    #              bucket, never in the baseline.
     # Both prefixes and the test pattern mirror ccn-report.cjs so the gate and
     # the writer cannot drift apart again (pinned by __tests__/gate-3-*.bats).
+    #
+    # #634: pytest's default is `python_files = test_*.py` under a `tests/`
+    # root. The previous pattern only knew the SUFFIX form `_test.{py,go}` and
+    # `*.test.*`, so a pytest-laid-out project had every test module graded as
+    # production source: test-helper complexity was reported as source debt and
+    # the ratchet could block on files the baseline deliberately never records
+    # (bucket === 'test').
+    #   `(^|/)(tests?)/`   — a tests/ or test/ directory anywhere in the tree
+    #   `(^|/)test_[^/]*\.py$` — pytest default filenames at any depth
+    # Both are anchored with (^|/) so `latest/`, `contest/`, `attest/` and
+    # `my_test_dir/` are NOT caught (a leading `_?test_.*\.py$` would have
+    # swallowed `src/my_test_dir/bar.py`).
+    # Must stay equivalent to TEST_PATH in scripts/ccn-report.cjs.
     CC_FILES=$(echo "$CC_FILES" | grep -vE \
-      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests__?/|\.test\.[cm]?[jt]sx?$|_test\.(py|go)$|Test(s)?\.java$' || true)
+      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests?__/|(^|/)(tests?)/|\.test\.[cm]?[jt]sx?$|(^|/)test_[^/]*\.py$|_test\.(py|go)$|Test(s)?\.java$' || true)
 
     if [ -n "$CC_FILES" ]; then
       echo "Checking complexity for source files..."

package/hooks/lib/jscpd-run.sh

@@ -26,6 +26,55 @@
 # than before the fix.
 JSCPD_DEFAULT_IGNORE_PATTERNS='(^|/)(node_modules|dist|build|target|coverage|out|\.next|\.nuxt|vendor)/|\.log$|\.txt$|\.(ya?ml)$|golden|baseline\.json$|evidence'
 
+# The BUILD-OUTPUT half of the set above, alone (#649).
+#
+# The combined set answers "is this worth comparing for duplication", which is a
+# question only Gate 2 asks. Filtering file list inputs with the whole set also
+# drops *.yaml, *.yml, *.txt and *.log -- and those are perfectly real project
+# files everywhere else. Doing that broke a live test on the first attempt:
+# `YAML staged files activate lint and IaC but skip SAST` expects a staged
+# infra/deployment.yaml to count as a code change, and whole-set filtering made
+# the hook announce "No code files changed, skipping lint" for a commit that
+# added a deployment manifest.
+#
+# So the two notions are separated here rather than shared:
+#
+#   BUILD OUTPUT (this)  - a directory tree that is generated or vendored:
+#                          not our code for ANY gate. Used to filter file lists.
+#   NON-REFACTORABLE (the combined set) - files whose duplication is data shape:
+#                          still project files, just not duplication candidates.
+#                          Gate 2 only.
+#
+# Same directory names, one definition; a directory added to the build-output
+# list reaches every gate at once, which is the point of #649.
+# Directory names that are generated or vendored in any mainstream toolchain.
+#
+# The second group (caches, virtualenvs, Python bytecode) is here because the
+# first version of this list did not have it and the same class of bug was one
+# `git add -A` away: __pycache__ is written by CPython itself and .pytest_cache
+# by pytest, so a Python project that commits its workspace stages .pyc-adjacent
+# artefacts and every scanner would read them as source. None of these can hold
+# hand-written project code.
+#
+# NOT included on purpose: bin/ and obj/ (real source trees in plenty of
+# projects -- e.g. cmd/bin layout, C# projects where obj/ IS output but bin/ is
+# often committed scripts) and .venv/venv (genuinely ambiguous: some projects
+# keep a small committed venv for reproducibility). Adding a name here removes
+# it from EVERY gate at once, so the list stays the names that are unambiguous.
+JSCPD_BUILD_OUTPUT_PATTERNS='(^|/)(node_modules|dist|build|target|coverage|out|\.next|\.nuxt|vendor|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|\.turbo|\.cache)/'
+
+# Is this path inside a dependency tree or a build-output directory?
+#
+# XP_GATE_JSCPD_DEFAULT_IGNORE=0 still disables it, so the escape hatch keeps
+# covering "some project really does want its vendor/ tree linted".
+jscpd_is_build_output() {
+  local _path="$1"
+  if [ "${XP_GATE_JSCPD_DEFAULT_IGNORE:-1}" = "0" ]; then
+    return 1
+  fi
+  printf '%s\n' "$_path" | grep -qE "$JSCPD_BUILD_OUTPUT_PATTERNS"
+}
+
 # Human-readable form, printed by the gate so the baseline is auditable (#591
 # point 3). Silence about the default is the same defect as silence about a
 # skipped gate: the user cannot answer "what did it scan".
@@ -55,6 +104,49 @@ jscpd_is_default_ignored() {
   printf '%s\n' "$_path" | grep -qE "$JSCPD_DEFAULT_IGNORE_PATTERNS"
 }
 
+# Drop dependency and build-output paths from a newline-separated file list on
+# stdin, echoing what remains (#649).
+#
+# Every scanner that builds its own list from `git diff --cached` used to
+# re-derive the exclusions by hand, and they drifted. The test-pairing check
+# excluded node_modules/.next/.nuxt/dist/build/.turbo/.cache but not vendor,
+# target, coverage or out -- so a staged `vendor/x.ts` was reported as a new
+# source file with no test. Six more sites had no exclusions at all. The one
+# place that got a shared ignore set (Gate 2) is the one that stopped having
+# this bug.
+#
+# This is the shared answer: callers pipe their staged list through it and stop
+# maintaining their own list. It reads stdin and writes stdout so it composes
+# with whatever selection the caller already did:
+#
+#     NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A \
+#       | filter_project_paths | grep -E '\.(ts|tsx)$' || true)
+#
+# Deliberately a filter, not a generator: a caller that needs a different git
+# query (only-added, only-modified) keeps it, and only the exclusion rule is
+# shared. Fail-open on empty input so `|| true` pipelines stay quiet.
+#
+# ON THE COUPLING (Delphi round 1, MC-01/FC-01): yes, this makes Gate 2's
+# ignore set load-bearing for every gate. Widening it now widens what every
+# scanner skips. That risk is accepted deliberately, and the alternative is
+# worse: the bug this fixes WAS a set of per-scanner definitions that drifted
+# apart, so N independent sets would reproduce it N times. The guard against
+# silent widening is that every change to the set lands in one reviewable
+# place, and #649's tests pin the boundary cases (vendor/target/coverage/out
+# ignored; src/lib/docs kept). If a gate ever needs a genuinely different
+# notion of "our code", introduce a second named set HERE rather than letting a
+# caller edit this one.
+filter_project_paths() {
+  local _fp
+  while IFS= read -r _fp || [ -n "$_fp" ]; do
+    [ -n "$_fp" ] || continue
+    if ! jscpd_is_build_output "$_fp"; then
+      printf '%s\n' "$_fp"
+    fi
+  done
+  return 0
+}
+
 # Echo the jscpd config the gate should pass, or nothing when the project has
 # none.
 #

package/hooks/pre-commit

@@ -710,48 +710,37 @@ if [ "$is_protected" = "true" ]; then
       esac
     done
 
-    # Doc-only changes: no source code files
+    # Doc-only / build-tooling-only changes need no VERSION bump.
+    #
+    # #624 defect 2: the split used to test ONLY `has_source`, which is true for
+    # any .py/.ts/... path INCLUDING `scripts/*`. So a commit that touched
+    # nothing but build tooling still fell into the version-check branch and was
+    # blocked. `has_real_source` is exactly "production source that needs a bump"
+    # — it was computed a few lines up but never consulted here. It must decide.
     if [ "$has_source" = "false" ]; then
       echo "✅ PASSED - Gate 0: Version Consistency Check (doc-only changes)"
+    elif [ "$has_real_source" = "false" ]; then
+      echo "✅ PASSED - Gate 0: Version Consistency Check (build-tooling-only changes)"
     else
-      # Check for bypass: commit message prefix (read from COMMIT_EDITMSG during pre-commit hook)
-      COMMIT_MSG=$(cat "$(git rev-parse --git-dir)/COMMIT_EDITMSG" 2>/dev/null | head -1 || echo "")
-      if echo "$COMMIT_MSG" | grep -qE '^\[skip-version-check\]'; then
-        if echo "$COMMIT_MSG" | grep -qE '^\[skip-version-check\].*(chore:|docs:|release:)'; then
-          if [ "$has_real_source" = "false" ]; then
-            echo "✅ PASSED - Gate 0: Version Consistency Check (bypass: chore/docs/release)"
-          else
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  VERSION CONSISTENCY CHECK (Gate 0)
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-Branch: $CURRENT_BRANCH
-ERROR: [skip-version-check] bypass used but production source files detected.
-
-Bypass only allows build-tooling changes (adapters/, scripts/, hooks/).
-Production source files require VERSION/CHANGELOG update.
-
-Files: $(echo "$STAGED_FILES" | tr '\n' ', ' | sed 's/,$//')
-"
-            exit 1
-          fi
-        else
-          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  VERSION CONSISTENCY CHECK (Gate 0)
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-Branch: $CURRENT_BRANCH
-ERROR: [skip-version-check] bypass prefix invalid.
-
-Allowed prefixes: chore:, docs:, release:
-Example: [skip-version-check] chore: update dependencies
-"
-          exit 1
-        fi
-      else
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+      # Production source on a protected branch without VERSION/CHANGELOG.
+      #
+      # #624 defect 1: this branch used to offer a `[skip-version-check]` message
+      # prefix as a bypass, read from `.git/COMMIT_EDITMSG`. That cannot work:
+      # git runs pre-commit BEFORE it builds the message, so the file does not
+      # exist yet (`-m`, `-F` and the interactive editor path all measured on
+      # git 2.54), and the hook gets no arguments. What the old code read was the
+      # PREVIOUS commit's message, so the prefix never matched — the documented
+      # recipe silently could not clear the gate, and --no-verify was the only
+      # way through. Rather than keep a bypass whose input this hook structurally
+      # cannot see, the escape hatch is the one that actually works and is
+      # already documented in CHANGELOG: the SKIP_VERSION_CHECK=1 environment
+      # variable (handled earlier in this Gate 0 block).
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
   VERSION CONSISTENCY CHECK (Gate 0)
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Branch: $CURRENT_BRANCH
-ERROR: Committing to a protected branch without VERSION/CHANGELOG update.
+ERROR: Committing production source to a protected branch without a
+VERSION/CHANGELOG update.
 
 This bypasses the ship workflow and causes version drift.
 Before committing:
@@ -759,18 +748,19 @@ Before committing:
   2. Add entry to CHANGELOG.md
   3. Run: node scripts/sync-version.cjs
 
-Or use the bypass prefix — the commit message FIRST LINE must START with:
-  [skip-version-check] chore: <description>
-Allowed types: chore: docs: release:. The bypass only permits build
-tooling changes (adapters/, scripts/, hooks/); production source files
-still require a VERSION/CHANGELOG update.
+Build-tooling-only changes (adapters/, scripts/, hooks/) need NO version bump
+and pass this gate automatically — no marker required.
+
+If you genuinely must land production source without a version bump, the
+supported escape hatch is the env var (a message prefix cannot work here
+because pre-commit runs before git builds the message):
+  SKIP_VERSION_CHECK=1 git commit ...
 
 Staged files: $(echo "$STAGED_FILES" | tr '\n' ', ' | sed 's/,$//')
 "
-        GATE_0_STATUS="BLOCK"
-        record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "1" "$GATE_0_START"
-        exit 1
-      fi
+      GATE_0_STATUS="BLOCK"
+      record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "1" "$GATE_0_START"
+      exit 1
     fi
   fi
   fi  # closes SKIP_VERSION_CHECK if/else
@@ -809,7 +799,44 @@ echo ""
 MIRROR_PATH_FILTER='^src/npm-package/'
 DASHBOARD_PATH_FILTER='^dashboard/'
 RAW_CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-CHANGED_FILES=$(printf '%s\n' "$RAW_CHANGED_FILES" | grep -v "$MIRROR_PATH_FILTER" | grep -v "$DASHBOARD_PATH_FILTER" || true)
+
+# Dependencies and build output are not project code (#649).
+#
+# `git diff --cached` knows nothing about .gitignore: anything that reaches the
+# index is listed. A project that vendors its dependencies, a CI fixture that
+# commits after `npm install`, an accidental `git add -A`, or a monorepo's
+# nested `packages/*/node_modules` therefore hands every downstream scanner a
+# list containing third-party source, and each scanner judges it as the
+# project's own.
+#
+# This has already cost two outages, one language branch at a time: #595 (Gate 1
+# PowerShell arm blocked every commit once Playwright's node_modules was
+# scanned for Write-Host) and #648 (Gate 1 JS/TS arm blocked on the bare
+# `debugger;` in node_modules/typescript/dist/internal/utils.js). Both were
+# fixed at the single site that happened to fail, so the next branch re-broke
+# the same way. The filter belongs HERE, at the one place the list is built, so
+# a scanner added tomorrow is safe by default instead of by memory.
+#
+# The exclusion itself is the shared build-output list from jscpd-run.sh
+# (jscpd_is_build_output), so the directory names have one definition across the
+# gates. Deliberately NOT the full Gate 2 ignore set: that one also drops
+# *.yaml/*.yml/*.txt/*.log because repetition there is data shape rather than a
+# refactoring target, and using it here would make a commit that only adds
+# infra/deployment.yaml look like "No code files changed" -- skipping the IaC
+# and lint gates that exist to scan exactly that file. The XP_GATE_JSCPD_DEFAULT_IGNORE=0
+# escape hatch still applies.
+#
+# RAW_CHANGED_FILES stays unfiltered on purpose: it is the only truthful answer
+# to "did the user stage anything at all", and a future "you accidentally
+# committed dependencies" warning needs to see what this filter removed.
+CHANGED_FILES=$(printf '%s\n' "$RAW_CHANGED_FILES" \
+  | grep -v "$MIRROR_PATH_FILTER" | grep -v "$DASHBOARD_PATH_FILTER" \
+  | {
+      while IFS= read -r _cf; do
+        [ -n "$_cf" ] || continue
+        jscpd_is_build_output "$_cf" || printf '%s\n' "$_cf"
+      done
+    } || true)
 
 # REQ-F2: one commit-level docs-only verdict, computed once and reused by the
 # heavy gates (2/5/9/12). Light gates never consult it — a secret in a README
@@ -844,7 +871,22 @@ any_changed_files_match() {
   local pattern
 
   for pattern in "$@"; do
-    if printf '%s\n' "$CHANGED_FILES" | grep -qE -- "$pattern"; then
+    # Here-string, not `printf | grep -q`. Under the `set -o pipefail` above,
+    # `grep -q` exits the moment it matches, the writer takes SIGPIPE, and the
+    # pipeline reports 141 -- so the `if` reads "no match" even though grep DID
+    # match. Whether that happens depends on whether the list fits in the pipe
+    # buffer, which is why it showed up as a size-dependent, flaky SKIP.
+    #
+    # It was not theoretical: in the Cross-Platform CI first-commit fixture the
+    # staged list is long enough to trip it, and Gate 1 announced "No code files
+    # changed, skipping lint" for a commit that had staged 19 shell scripts --
+    # while Gate 2, reading the same variable, happily scanned them and reported
+    # duplicates. The hook log carried the fingerprint the whole time:
+    # `line 847: printf: Broken pipe`.
+    #
+    # A here-string has no writer process to be killed, so the match cannot be
+    # lost. Same reason `run_tsx` and the coverage probes avoid `| head`.
+    if grep -qE -- "$pattern" <<< "$CHANGED_FILES"; then
       return 0
     fi
   done
@@ -1524,7 +1566,7 @@ else
     TS_DEBUG_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx)$' | {
       while IFS= read -r _df; do
         [ -n "$_df" ] || continue
-        if ! jscpd_is_default_ignored "$_df"; then
+        if ! jscpd_is_build_output "$_df"; then
           printf '%s\n' "$_df"
         fi
       done
@@ -2212,7 +2254,10 @@ else
   fi
 
   # --- BLOCK path: New .ts/.tsx files without corresponding tests ---
-  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v 'node_modules/' | grep -v '\.next/' | grep -v '\.nuxt/' | grep -v 'dist/' | grep -v 'build/' | grep -v '.turbo/' | grep -v '.cache/' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
+  # Exclusions come from filter_project_paths (#649). The hand-maintained list
+  # this replaced omitted vendor/target/coverage/out, so a staged vendor/x.ts
+  # was reported as new source with no test.
+  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
 
   # Strip PROJECT_SUBDIR prefix from new-TS-file paths ONLY when the hook
   # actually cd'd into the subdirectory (IN_PROJECT_SUBDIR=1; single-language
@@ -2297,10 +2342,12 @@ else
   fi
 
   # --- WARNING path: Modified files (any lang) + New non-TS files ---
+  # filter_project_paths strips dependencies and build output (#649); without
+  # it a staged vendor/ or target/ module is reported as source needing a test.
   WARNING_SOURCE_FILES=$(
     {
-      git diff --cached --name-only --diff-filter=M | grep -E '\.(ts|tsx|py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
-      git diff --cached --name-only --diff-filter=A | grep -E '\.(py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
+      git diff --cached --name-only --diff-filter=M | filter_project_paths | grep -E '\.(ts|tsx|py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
+      git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
     } | sort -u || true
   )
 
@@ -2423,7 +2470,7 @@ else
   # Gate 5b: Mock Density ADVISORY Scan (pure bash — no npx tsx overhead)
   # 30% = ADVISORY, 50% = suggests @mock-justified. Does NOT block commit.
   # ========================================================================
-  CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(test|spec)\.(ts|tsx|js|jsx|cjs|mjs|py|go)$' || true)
+  CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM | filter_project_paths | grep -E '\.(test|spec)\.(ts|tsx|js|jsx|cjs|mjs|py|go)$' || true)
 
   # Nested plugin sub-projects (plugins/<name>/) own their own vitest config and
   # are excluded from the root suite (`vitest.config.ts` excludes `plugins/**`,
@@ -2571,7 +2618,7 @@ else
           CHANGED_TEST_FILE_COUNT=$(echo "$SELECTED_TEST_FILES" | grep -c '.' || true)
           
           # Also get changed source files (non-test) for related-test lookup
-          CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|tsx|js|jsx)$' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__tests__' | grep -v '\.d\.ts$' | grep -v '__snapshots__' || true)
+          CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM | filter_project_paths | grep -E '\.(ts|tsx|js|jsx)$' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__tests__' | grep -v '\.d\.ts$' | grep -v '__snapshots__' || true)
           # Nested plugin sub-projects are excluded from the root suite; their
           # sources must not drive root-vitest related-test lookup either (it
           # would resolve to plugin-local paths vitest cannot collect).
@@ -2807,9 +2854,14 @@ else
             #   full -> unchanged behavior: whole suite + real threshold.
             #   skip -> nothing test-relevant changed; no pytest at all.
             PY_CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null \
+              | filter_project_paths \
               | grep -E '(^|/)test_[^/]*\.py$|_test\.py$' || true)
             PY_CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null \
+              | filter_project_paths \
               | grep -E '\.py$' | grep -vE '(^|/)test_[^/]*\.py$|_test\.py$' || true)
+            # NOT filtered on purpose: this list answers "did a requirements
+            # file change", which is a property of the whole commit including
+            # paths under a vendor/ tree that filter_project_paths removes.
             PY_CHANGED_ALL=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)
             # `grep -c '.'` prints its own zero AND exits 1 on an empty list
             # (#493), so the count is derived with `|| true` + wc -l instead.
@@ -3363,7 +3415,7 @@ else
   # New files must have ≥80% coverage individually.
   # ============================================================================
   if has_project_lang "typescript" && [ -f "coverage/coverage-summary.json" ]; then
-    NEW_SOURCE_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v '\.d\.ts$' || true)
+    NEW_SOURCE_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(ts|tsx)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v '\.d\.ts$' || true)
     if [ -n "$NEW_SOURCE_FILES" ]; then
       echo ""
       echo "   └─ Per-file coverage check for new files:"
@@ -3764,8 +3816,11 @@ else
     # governed by Mirror Parity in CI, which compares content rather than
     # re-linting it. (See the same exclusion in adapters/powershell.sh.)
     MIRROR_EXCLUDE="$MIRROR_PATH_FILTER"
-    NEW_FILES=$(git diff --cached --name-only --diff-filter=A | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
-    MODIFIED_FILES=$(git diff --cached --name-only --diff-filter=M | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
+    # filter_project_paths also removes dependencies and build output (#649):
+    # a staged node_modules/ or dist/ file is not budgetable project code, and
+    # entering it in the Boy Scout baseline would budget a path nobody edits.
+    NEW_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
+    MODIFIED_FILES=$(git diff --cached --name-only --diff-filter=M | filter_project_paths | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
     
     if [ -z "$NEW_FILES" ] && [ -z "$MODIFIED_FILES" ]; then
       echo "     ✅ No new or modified files to check."

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-28T17:43:58.740Z",
+  "checked_at": "2026-10-30T08:22:09.989Z",
   "source": "network"
 }