@boyingliu01/xp-gate 0.33.0 → 0.33.2

package/gates/python-health.ts

@@ -0,0 +1,266 @@
+/**
+ * Python Environment Health Check
+ * Provides comprehensive Python environment diagnostics.
+ * Layer 2 of #356: full diagnostics via CLI/doctor (not pre-commit hot path).
+ *
+ * Reuses common.ts infrastructure (isToolAvailable, runTool).
+ */
+import {
+  isToolAvailable, runTool,
+} from './common';
+
+// ── Types ──
+
+export interface PythonHealthResult {
+  healthy: boolean;
+  python: { available: boolean; version: string; exe: string };
+  pip: { available: boolean; version: string };
+  environment: { type: 'system' | 'venv' | 'conda' | 'pyenv' | 'uv'; path: string | null };
+  tools: Array<{ name: string; available: boolean; version: string; required: boolean }>;
+  issues: string[];
+}
+
+// ── Python Tool Registry (sync with language-tools.js LANGUAGE_REGISTRY.python) ──
+
+const PYTHON_REQUIRED_TOOLS = ['mypy', 'pytest'];
+const PYTHON_OPTIONAL_TOOLS = ['ruff', 'flake8', 'black'];
+
+// ── Python Detection ──
+
+/**
+ * Detect Python executable, filtering Windows Store stubs.
+ * Order: python3 → python → py (Windows)
+ */
+export function detectPython(): { available: boolean; exe: string; version: string } {
+  const candidates = process.platform === 'win32'
+    ? ['python3', 'python', 'py']
+    : ['python3', 'python'];
+
+  for (const exe of candidates) {
+    // Check if executable exists
+    const whichCheck = isToolAvailable(exe);
+    if (!whichCheck.available) continue;
+
+    const exePath = whichCheck.path;
+
+    // Filter Windows Store stubs (heuristic: path contains WindowsApps)
+    if (exePath.toLowerCase().includes('windowsapps')) continue;
+
+    // Verify it's a real Python (not a stub that opens Store)
+    const verResult = runTool(exePath, ['--version'], { timeoutMs: 3000 });
+    if (verResult.exitCode !== 0 || verResult.timedOut) continue;
+
+    const output = (verResult.stdout + verResult.stderr).trim();
+    const versionMatch = output.match(/^Python\s+(\d+\.\d+\.\d+)/);
+    if (!versionMatch) continue;
+
+    return { available: true, exe: exePath, version: versionMatch[1] };
+  }
+
+  return { available: false, exe: '', version: '' };
+}
+
+/**
+ * Check if Python version meets minimum requirement.
+ */
+export function checkPythonVersion(version: string, minVersion = '3.8.0'): boolean {
+  const parts = version.split('.').map(Number);
+  const minParts = minVersion.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    const v = parts[i] || 0;
+    const m = minParts[i] || 0;
+    if (v > m) return true;
+    if (v < m) return false;
+  }
+  return true; // equal
+}
+
+// ── pip Detection ──
+
+/**
+ * Check pip availability via <python-exe> -m pip (ensures consistency).
+ */
+export function detectPip(pythonExe: string): { available: boolean; version: string } {
+  if (!pythonExe) return { available: false, version: '' };
+
+  const result = runTool(pythonExe, ['-m', 'pip', '--version'], { timeoutMs: 5000 });
+  if (result.exitCode !== 0) return { available: false, version: '' };
+
+  const output = result.stdout.trim();
+  const versionMatch = output.match(/pip\s+(\d+\.\d+(?:\.\d+)?)/);
+  return {
+    available: true,
+    version: versionMatch ? versionMatch[1] : 'unknown',
+  };
+}
+
+// ── Environment Detection ──
+
+/**
+ * Detect Python environment type.
+ */
+export function detectEnvironment(cwd?: string): { type: PythonHealthResult['environment']['type']; path: string | null } {
+  const env = process.env;
+
+  // conda
+  if (env.CONDA_PREFIX) return { type: 'conda', path: env.CONDA_PREFIX };
+  if (env.CONDA_DEFAULT_ENV) return { type: 'conda', path: env.CONDA_DEFAULT_ENV };
+
+  // venv / virtualenv
+  if (env.VIRTUAL_ENV) return { type: 'venv', path: env.VIRTUAL_ENV };
+
+  // uv
+  const dir = cwd || process.cwd();
+  try {
+    const fs = require('fs');
+    const path = require('path');
+    if (fs.existsSync(path.join(dir, 'uv.lock'))) return { type: 'uv', path: dir };
+    if (fs.existsSync(path.join(dir, '.python-version'))) return { type: 'pyenv', path: dir };
+    if (fs.existsSync(path.join(dir, '.venv'))) return { type: 'venv', path: path.join(dir, '.venv') };
+  } catch { /* ignore */ }
+
+  return { type: 'system', path: null };
+}
+
+// ── Tool Checking ──
+
+/**
+ * Check availability of Python tools using common.ts infrastructure.
+ */
+export function checkTools(pythonExe: string, cwd?: string): PythonHealthResult['tools'] {
+  const tools: PythonHealthResult['tools'] = [];
+
+  for (const name of PYTHON_REQUIRED_TOOLS) {
+    const tool = checkPythonTool(name, pythonExe, cwd);
+    tools.push({ ...tool, required: true });
+  }
+
+  for (const name of PYTHON_OPTIONAL_TOOLS) {
+    const tool = checkPythonTool(name, pythonExe, cwd);
+    tools.push({ ...tool, required: false });
+  }
+
+  return tools;
+}
+
+function checkPythonTool(
+  name: string,
+  pythonExe: string,
+  cwd?: string
+): { name: string; available: boolean; version: string } {
+  // Try via <python-exe> -m <tool> --version first (ensures correct env)
+  if (pythonExe) {
+    const result = runTool(pythonExe, ['-m', name, '--version'], { timeoutMs: 5000, cwd });
+    if (result.exitCode === 0) {
+      const output = (result.stdout + result.stderr).trim();
+      const versionMatch = output.match(/(\d+\.\d+(?:\.\d+)?)/);
+      return { name, available: true, version: versionMatch ? versionMatch[1] : 'unknown' };
+    }
+  }
+
+  // Fallback: direct tool detection via common.ts
+  const tool = isToolAvailable(name, cwd);
+  if (tool.available) {
+    const verResult = runTool(tool.path === `npx ${name}` ? 'npx' : tool.path,
+      tool.path === `npx ${name}` ? ['-y', name, '--version'] : ['--version'],
+      { timeoutMs: 5000, cwd });
+    const output = (verResult.stdout + verResult.stderr).trim();
+    const versionMatch = output.match(/(\d+\.\d+(?:\.\d+)?)/);
+    return { name, available: true, version: versionMatch ? versionMatch[1] : 'unknown' };
+  }
+
+  return { name, available: false, version: '' };
+}
+
+// ── Main Health Check ──
+
+/**
+ * Run comprehensive Python environment health check.
+ */
+export function checkPythonHealth(cwd?: string): PythonHealthResult {
+  const issues: string[] = [];
+
+  // 1. Detect Python
+  const python = detectPython();
+  if (!python.available) {
+    issues.push('Python 3 not found. Install from https://python.org/downloads');
+    return {
+      healthy: false,
+      python,
+      pip: { available: false, version: '' },
+      environment: { type: 'system', path: null },
+      tools: [],
+      issues,
+    };
+  }
+
+  // 2. Check version
+  if (!checkPythonVersion(python.version)) {
+    issues.push(`Python ${python.version} < 3.8.0 minimum. Upgrade recommended.`);
+  }
+
+  // 3. Detect pip
+  const pip = detectPip(python.exe);
+  if (!pip.available) {
+    issues.push(`pip not available. Install: ${python.exe} -m ensurepip`);
+  }
+
+  // 4. Detect environment
+  const environment = detectEnvironment(cwd);
+  if (environment.type === 'system') {
+    issues.push('No virtual environment detected. Consider using venv/conda/uv.');
+  }
+
+  // 5. Check tools
+  const tools = checkTools(python.exe, cwd);
+  const missingRequired = tools.filter(t => t.required && !t.available);
+  if (missingRequired.length > 0) {
+    const names = missingRequired.map(t => t.name).join(', ');
+    issues.push(`Required tools missing: ${names}. Install: ${python.exe} -m pip install ${names}`);
+  }
+
+  const healthy = issues.filter(i => i.includes('not found') || i.includes('minimum')).length === 0
+    && missingRequired.length === 0;
+
+  return { healthy, python, pip, environment, tools, issues };
+}
+
+// ── CLI Entry Point ──
+
+if (process.argv.includes('--run')) {
+  const cwdIdx = process.argv.indexOf('--cwd');
+  const cwd = cwdIdx >= 0 ? process.argv[cwdIdx + 1] : process.cwd();
+  const result = checkPythonHealth(cwd);
+
+  console.log('');
+  console.log('━━━ Python Environment Health Check ━━━');
+  console.log('');
+  console.log(`  Python:    ${result.python.available ? `✅ ${result.python.exe} (${result.python.version})` : '❌ Not found'}`);
+  console.log(`  pip:       ${result.pip.available ? `✅ ${result.pip.version}` : '❌ Not available'}`);
+  console.log(`  Env:       ${result.environment.type}${result.environment.path ? ` (${result.environment.path})` : ''}`);
+  console.log('');
+
+  if (result.tools.length > 0) {
+    console.log('  Tools:');
+    for (const t of result.tools) {
+      const icon = t.available ? '✅' : (t.required ? '❌' : '⚠️');
+      const req = t.required ? '(required)' : '(optional)';
+      console.log(`    ${icon} ${t.name} ${t.available ? t.version : 'not installed'} ${req}`);
+    }
+    console.log('');
+  }
+
+  if (result.issues.length > 0) {
+    console.log('  Issues:');
+    result.issues.forEach(i => console.log(`    ⚠️  ${i}`));
+    console.log('');
+  }
+
+  if (result.healthy) {
+    console.log('  ✅ Python environment is healthy.');
+  } else {
+    console.log('  ❌ Python environment has issues.');
+  }
+
+  process.exit(result.healthy ? 0 : 1);
+}

package/gates/test-layers.ts

@@ -0,0 +1,312 @@
+/**
+ * Test Layer Analytics — reports test distribution across unit/integration/e2e layers.
+ * Implements #359: layered test protection network (analytics/report mode).
+ *
+ * Does NOT block commits/pushes. Provides visibility into test coverage distribution.
+ */
+import fs from 'fs';
+import path from 'path';
+
+// ── Types ──
+
+export interface TestLayerReport {
+  summary: {
+    totalSources: number;
+    totalTests: number;
+    unitTests: number;
+    integrationTests: number;
+    e2eTests: number;
+  };
+  layer1: {
+    pairedSources: number;
+    unpairedSources: string[];
+    pairRate: number;
+  };
+  layer2: {
+    integrationFiles: number;
+  };
+  layer3: {
+    e2eFiles: number;
+  };
+  verdict: 'INFO';
+  messages: string[];
+}
+
+// ── File Classification ──
+
+/** Files excluded from source counting (not implementation files). */
+const EXCLUDED_PATTERNS = [
+  /\.d\.ts$/,
+  /\.test\.ts$/,
+  /\.spec\.ts$/,
+  /\.e2e\.test\.ts$/,
+  /\.integration\.test\.ts$/,
+  /\/__tests__\//,
+  /\/__mocks__\//,
+  /\/node_modules\//,
+];
+
+/** Source files that don't need tests (pure declarations, configs, types). */
+const EXEMPT_FILENAMES = [
+  'types.ts', 'interfaces.ts', 'constants.ts', 'config.ts',
+  'index.ts', 'main.ts', 'app.ts',
+];
+
+function isExcluded(filePath: string): boolean {
+  const normalized = filePath.replace(/\\/g, '/');
+  return EXCLUDED_PATTERNS.some(p => p.test(normalized));
+}
+
+function isExempt(filename: string): boolean {
+  return EXEMPT_FILENAMES.includes(filename);
+}
+
+function isTestFile(filePath: string): boolean {
+  const normalized = filePath.replace(/\\/g, '/');
+  return /\.test\.(ts|js)$/.test(normalized) || /\.spec\.(ts|js)$/.test(normalized);
+}
+
+function classifyTestLayer(filePath: string): 'unit' | 'integration' | 'e2e' | 'unknown' {
+  const normalized = filePath.replace(/\\/g, '/');
+  if (/\.e2e\.test\./.test(normalized) || /\/e2e\//.test(normalized)) return 'e2e';
+  if (/\.integration\.test\./.test(normalized) || /\/integration\//.test(normalized)) return 'integration';
+  if (isTestFile(filePath)) return 'unit';
+  return 'unknown';
+}
+
+/**
+ * Find the expected test file for a source file.
+ * Convention: src/foo/bar.ts → src/__tests__/bar.test.ts or src/foo/bar.test.ts
+ */
+function findExpectedTest(sourcePath: string, allFiles: string[]): string | null {
+  const basename = path.basename(sourcePath, '.ts');
+  const dir = path.dirname(sourcePath);
+
+  // Check adjacent test file: src/foo/bar.ts → src/foo/bar.test.ts
+  const adjacentTest = path.join(dir, `${basename}.test.ts`);
+  if (allFiles.includes(adjacentTest)) return adjacentTest;
+
+  // Check __tests__ directory: src/foo/bar.ts → src/foo/__tests__/bar.test.ts
+  const testsDirTest = path.join(dir, '__tests__', `${basename}.test.ts`);
+  if (allFiles.includes(testsDirTest)) return testsDirTest;
+
+  // Check parent __tests__: src/foo/bar.ts → src/__tests__/bar.test.ts
+  const parentDir = path.dirname(dir);
+  const parentTestsTest = path.join(parentDir, '__tests__', `${basename}.test.ts`);
+  if (allFiles.includes(parentTestsTest)) return parentTestsTest;
+
+  return null;
+}
+
+// ── Directory Scanner ──
+
+/**
+ * Directories that never hold hand-written source, so scanning them inflates
+ * the source count and fabricates "unpaired" entries (#636 follow-up).
+ *
+ * `coverage` matters most: `src/npm-package/coverage/` is a gitignored istanbul
+ * output directory (`.gitignore:99`), so it is untracked yet full of `.js`
+ * files. Counting `block-navigation.js` / `prettify.js` / `sorter.js` as sources
+ * understated the pairing rate and pushed three phantom files into the unpaired
+ * list — the metric was measuring a build artifact.
+ *
+ * Kept as a Set for O(1) lookup; names are matched exactly, not by substring,
+ * so a real source directory called e.g. `coverage-rules/` stays scanned.
+ */
+const SKIPPED_DIRECTORIES = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'coverage',
+  '__pycache__',
+  '.next',
+  '.turbo',
+  'build',
+  'out',
+]);
+
+/**
+ * Read a directory, tolerating the ways it can be unreadable.
+ *
+ * An unreadable directory (EACCES, ENOENT from a racing delete, a broken
+ * symlink) must not abort the whole scan: this runs inside gate reporting, where
+ * a partial answer beats a crash. Returning an empty list skips the subtree
+ * instead of throwing.
+ */
+function readDirectoryEntries(dir: string): fs.Dirent[] {
+  try {
+    return fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+
+function scanDirectory(dir: string, basePath?: string): string[] {
+  const results: string[] = [];
+  const base = basePath || dir;
+
+  if (!fs.existsSync(dir)) return results;
+
+  for (const entry of readDirectoryEntries(dir)) {
+    const fullPath = path.join(dir, entry.name);
+    const relativePath = path.relative(base, fullPath).replace(/\\/g, '/');
+
+    if (entry.isDirectory()) {
+      if (SKIPPED_DIRECTORIES.has(entry.name)) continue;
+      results.push(...scanDirectory(fullPath, base));
+    } else if (entry.name.endsWith('.ts') || entry.name.endsWith('.js')) {
+      results.push(relativePath);
+    }
+  }
+
+  return results;
+}
+
+// ── Main Analysis ──
+
+/** How many unpaired sources are listed individually before summarising. */
+const UNPAIRED_DISPLAY_LIMIT = 10;
+
+/** The per-layer counts one scan produces, before formatting. */
+interface LayerCounts {
+  sourceFiles: string[];
+  testFiles: string[];
+  unitTests: string[];
+  integrationTests: string[];
+  e2eTests: string[];
+  unpairedSources: string[];
+  pairedCount: number;
+}
+
+/**
+ * Append the Layer 1 block: pairing rate plus the unpaired list, truncated once
+ * it gets long enough that printing every path would bury the summary (#620).
+ */
+function appendPairingLines(messages: string[], counts: LayerCounts, totalNeedingTests: number): void {
+  const pairRate = totalNeedingTests > 0
+    ? Math.round((counts.pairedCount / totalNeedingTests) * 100)
+    : 100;
+  messages.push('  Layer 1 (Unit Pairing):');
+  messages.push(`    Paired:    ${counts.pairedCount}/${totalNeedingTests} (${pairRate}%)`);
+
+  const unpaired = counts.unpairedSources;
+  if (unpaired.length === 0 || unpaired.length > UNPAIRED_DISPLAY_LIMIT) {
+    if (unpaired.length > 0) {
+      messages.push(`    Unpaired:  ${unpaired.length} files (showing first 10)`);
+      unpaired.slice(0, UNPAIRED_DISPLAY_LIMIT).forEach(f => messages.push(`      - ${f}`));
+    }
+    return;
+  }
+  messages.push(`    Unpaired:  ${unpaired.join(', ')}`);
+}
+
+/** Format the console block for one analysis. */
+function buildLayerMessages(counts: LayerCounts, totalNeedingTests: number): string[] {
+  const messages: string[] = [
+    '',
+    '━━━ Test Layer Analytics ━━━',
+    '',
+    `  Sources:     ${counts.sourceFiles.length} files`,
+    `  Tests:       ${counts.testFiles.length} total`,
+    `    Unit:      ${counts.unitTests.length}`,
+    `    Integra:   ${counts.integrationTests.length}`,
+    `    E2E:       ${counts.e2eTests.length}`,
+    '',
+  ];
+
+  appendPairingLines(messages, counts, totalNeedingTests);
+
+  // Layers 2 and 3 only earn a section when they have content.
+  if (counts.integrationTests.length > 0) {
+    messages.push('', `  Layer 2 (Integration): ${counts.integrationTests.length} files`);
+  }
+  if (counts.e2eTests.length > 0) {
+    messages.push('', `  Layer 3 (E2E): ${counts.e2eTests.length} files`);
+  }
+  messages.push('');
+
+  return messages;
+}
+
+/**
+ * Layer 1 pairing: split sources into paired and unpaired against the sibling
+ * test that should cover each one. Works on src-relative paths because
+ * findExpectedTest resolves a source path against that root.
+ */
+function computePairing(
+  sourceFiles: string[],
+  allFiles: string[],
+): { unpairedSources: string[]; pairedCount: number } {
+  const allSourceRelative = allFiles.map(f => path.join('src', f));
+  const unpairedSources: string[] = [];
+  let pairedCount = 0;
+
+  for (const source of sourceFiles) {
+    if (isExempt(path.basename(source))) continue;
+    if (findExpectedTest(path.join('src', source), allSourceRelative)) {
+      pairedCount++;
+    } else {
+      unpairedSources.push(source);
+    }
+  }
+
+  return { unpairedSources, pairedCount };
+}
+
+/**
+ * Analyze test layer distribution for a project.
+ */
+export function analyzeTestLayers(cwd?: string): TestLayerReport {
+  const dir = cwd || process.cwd();
+  const allFiles = scanDirectory(path.join(dir, 'src'));
+
+  const sourceFiles = allFiles.filter(f => !isExcluded(f) && !isTestFile(f));
+  const testFiles = allFiles.filter(f => isTestFile(f));
+  const byLayer = (layer: string): string[] => testFiles.filter(f => classifyTestLayer(f) === layer);
+
+  const { unpairedSources, pairedCount } = computePairing(sourceFiles, allFiles);
+
+  const counts: LayerCounts = {
+    sourceFiles,
+    testFiles,
+    unitTests: byLayer('unit'),
+    integrationTests: byLayer('integration'),
+    e2eTests: byLayer('e2e'),
+    unpairedSources,
+    pairedCount,
+  };
+  const totalNeedingTests = sourceFiles.filter(f => !isExempt(path.basename(f))).length;
+
+  return {
+    summary: {
+      totalSources: sourceFiles.length,
+      totalTests: testFiles.length,
+      unitTests: counts.unitTests.length,
+      integrationTests: counts.integrationTests.length,
+      e2eTests: counts.e2eTests.length,
+    },
+    layer1: {
+      pairedSources: pairedCount,
+      unpairedSources,
+      pairRate: totalNeedingTests > 0 ? Math.round((pairedCount / totalNeedingTests) * 100) : 100,
+    },
+    layer2: {
+      integrationFiles: counts.integrationTests.length,
+    },
+    layer3: {
+      e2eFiles: counts.e2eTests.length,
+    },
+    verdict: 'INFO',
+    messages: buildLayerMessages(counts, totalNeedingTests),
+  };
+}
+
+// ── CLI Entry Point ──
+
+if (process.argv.includes('--run')) {
+  const cwdIdx = process.argv.indexOf('--cwd');
+  const cwd = cwdIdx >= 0 ? process.argv[cwdIdx + 1] : process.cwd();
+  const report = analyzeTestLayers(cwd);
+  report.messages.forEach(m => console.log(m));
+  process.exit(0);
+}

package/hooks/gate-3.sh

@@ -172,8 +172,19 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                   const entries = baseline.functions || baseline.entries || baseline;
                   if (Array.isArray(entries)) {
                     for (const e of entries) {
-                      if (!e || !e.file || !e.name) continue;
-                      known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
+                      // #632: accept the key the baseline WRITER actually emits.
+                      // tools/Update-ComplexityBaseline.ps1 (the tool this gate
+                      // points at in its own fix-it message) writes "function",
+                      // while this reader only knew "name" -- so every entry was
+                      // dropped, "known" stayed empty, and every function above
+                      // the threshold became a brand-new function. The ratchet
+                      // could never pass. Both spellings are read: this is a
+                      // reader, and the writer vocabulary is not ours to
+                      // redefine from here.
+                      if (!e || !e.file) continue;
+                      const fnName = e.name || e.function;
+                      if (!fnName) continue;
+                      known.set(norm(e.file) + "::" + fnName, Number(e.ccn) || 0);
                     }
                   }
                   // The measurement emits ABSOLUTE paths (pwsh resolved them), while
@@ -529,13 +540,43 @@ else
       # this, a crashing or mis-invoked lizard yields 0 warnings and the gate
       # reports PASSED on zero analysed functions -- the same silent-success
       # failure this issue is about.
+      #
+      # #666: "no rows" has TWO causes and they must not share a verdict. A
+      # module of pure constants legitimately has zero functions, and lizard
+      # emits no row for it at all (measured: `lizard pure_data.py --csv` prints
+      # nothing and exits 0). That was reported as `lizard_output_unparsable`
+      # /WARN, which is the message for a BROKEN lizard -- so a healthy run on a
+      # data-only diff was indistinguishable from a tooling fault. The two are
+      # separated by a POSITIVE probe: ask lizard to describe a fixture known to
+      # contain a function. If it produces rows, lizard works and the input
+      # simply had no functions (SKIP, `no_functions_in_input`); if it does not,
+      # the tool really is broken (WARN, `lizard_output_unparsable`).
       if ! printf '%s\n' "$CC_CSV_FLAT" | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { found = 1; exit }
                                                  END { exit(found ? 0 : 1) }'; then
-        echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
-        GATE_3_STATUS="WARN"
-        # Consumed by the sourcing parent (pre-commit report JSON), not here.
-        # shellcheck disable=SC2034
-        GATE_3_REASON="lizard_output_unparsable"
+        _lizard_probe_dir=$(mktemp -d 2>/dev/null || echo "${TMPDIR:-/tmp}")
+        _lizard_probe_file="$_lizard_probe_dir/xp-gate-lizard-probe.py"
+        printf 'def _xp_gate_probe(x):\n    if x:\n        return 1\n    return 0\n' > "$_lizard_probe_file" 2>/dev/null
+        _lizard_probe_rows=0
+        if [ -f "$_lizard_probe_file" ]; then
+          _lizard_probe_rows=$(printf '%s\n' "$_lizard_probe_file" \
+            | lizard_batches --csv 2>/dev/null \
+            | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { c++ } END { print c + 0 }')
+        fi
+        rm -rf "$_lizard_probe_dir" 2>/dev/null || true
+        if [ "${_lizard_probe_rows:-0}" -gt 0 ]; then
+          echo "⏭️  SKIPPED - Complexity: the changed source files define no functions (pure data module)."
+          echo "   Verified: lizard parsed a probe fixture normally, so this is an empty result set, not a broken tool."
+          GATE_3_STATUS="SKIP"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="no_functions_in_input"
+        else
+          echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
+          GATE_3_STATUS="WARN"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="lizard_output_unparsable"
+        fi
       elif [ "$CC_WARNINGS" -gt 0 ]; then
         echo "$CC_OUTPUT"
         echo ""