@boyingliu01/xp-gate 0.35.16 → 0.35.18

package/gate-12-file-hygiene.sh

@@ -36,13 +36,35 @@ fi
 HYGIENE_ISSUES=0
 HYGIENE_FILES=""
 
+# Is this staged file binary (so line-based checks do not apply)?
+#
+# This replaces `grep -q $'\x00'`, which was a no-op guard: bash strips NUL from
+# `$'\x00'`, so the pattern was the EMPTY string and `grep -q ""` matches any
+# non-empty input. Every staged file was therefore judged binary and `continue`d,
+# silently disabling Check 1 (trailing whitespace), Check 2 (missing EOF newline)
+# and -- worst -- Check 3 (merge conflict markers, a BLOCK-level check). Checks 4
+# and 5 lacked the guard, which is why the gate looked half-working.
+#
+# Ask git instead of guessing: `--numstat` reports a binary entry as `-\t-\t<path>`
+# because git already made that determination. A byte-level NUL test cannot be
+# written with a shell pattern at all (variables and command substitution both drop
+# NUL), and `grep -I` only suppresses output on a binary input -- it does not make
+# `grep -q` fail, which is why that shortcut still reported text.
+is_binary_staged_file() {
+  local _file="$1"
+  case "$(git diff --cached --numstat -- "$_file" 2>/dev/null)" in
+    -[[:space:]]-*) return 0 ;;   # binary: git could not count lines
+    *) return 1 ;;                # text (or empty -- nothing for the line checks)
+  esac
+}
+
 # --- Check 1: Trailing whitespace ---
 TRAILING_WS_FILES=""
 if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
-  # Skip binary files by checking if file contains null bytes
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  # Skip binary files : they have no lines to check
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check staged content for trailing whitespace (spaces/tabs at end of lines)
@@ -69,7 +91,7 @@ if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check if file content ends with newline
@@ -108,7 +130,7 @@ else
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check for conflict markers in staged content

package/gate-13-compiler-strictness.sh

@@ -527,6 +527,18 @@ gate13_count_lint_findings() {
   [ -n "$src" ] || src=$(cat)
   printf '%s\n' "$src" | awk '
     BEGIN { n = 0 }
+    # (#673) Maven 3.9.7+ reactor summary appends the packaging type per module:
+    #     [INFO] whaleaudit-core  [jar]
+    # `[pom]`/`[jar]` match the open-category rule below, so a 3-module reactor
+    # reported 4 javac findings on code with ZERO warnings -- and got worse with
+    # every module added. The marker set is closed (packaging types are an enum in
+    # Maven itself), so excluding it does not reopen the #659 fail-open hole that
+    # the open-category rule was introduced to close.
+    #
+    # Scoped to `[INFO]` lines: a javac diagnostic is never prefixed with the
+    # Maven [INFO] banner, so this cannot mask a real finding even when a category
+    # name collides with a packaging type.
+    /^\[INFO\].*\[(pom|jar|war|ear|rar|ejb|maven-plugin|par|test-jar|java-source|javadoc|zip|tar\.gz|tar\.bz2)\][[:space:]]*$/ { next }
     # Any bracketed lowercase category: covers the whole javac -Xlint enum and any
     # later addition to it. Restricted to lowercase/digit/hyphen so a Maven
     # `[WARNING]` with no category, or a `[INFO]` banner, is not counted.

package/gates/gate-3.ts

@@ -53,29 +53,85 @@ export function runGate3(input: GateInput): GateOutput {
 
   messages.push('Checking complexity for source files...');
 
-  // Run lizard with CCN threshold
-  const result = runTool(lizardCmd, [...lizardArgs, '-C', String(CCN_THRESHOLD), ...ccFiles], {
-    cwd: input.cwd,
-  });
-
-  const combinedOutput = result.stdout + result.stderr;
-
-  // Parse warning count from summary table: "Warning cnt   8"
-  const warningMatch = combinedOutput.match(/^Warning cnt\s+(\d+)/m);
-  const warnings = warningMatch ? parseInt(warningMatch[1], 10) : 0;
-
-  if (warnings > 0) {
-    messages.push(combinedOutput);
-    messages.push('');
-    messages.push(`❌ BLOCKED - ${warnings} functions with CCN > ${CCN_THRESHOLD} found.`);
-    messages.push(`Refactor high-complexity functions to keep below ${CCN_THRESHOLD} complexity.`);
-    recordAudit('gate-3', 'complexity', 'FAIL', warnings, startMs);
-    return { status: 'FAIL', messages, exitCode: 1 };
+  // CSV mode: the verdict comes from the numbers lizard uses, not its table
+  // formatting (#674). See countCcnWarnings() for why the old parser never matched.
+  const rawOutput = runLizardCsv(lizardCmd, lizardArgs, ccFiles, input.cwd);
+  const verdict = buildComplexityVerdict(countCcnWarnings(rawOutput), rawOutput);
+  messages.push(...verdict.messages);
+  recordAudit('gate-3', 'complexity', verdict.status, verdict.warnings, startMs);
+  return { status: verdict.status, messages, exitCode: verdict.exitCode };
+}
+
+/** Run lizard in CSV mode and return its raw output (stdout + stderr). */
+function runLizardCsv(cmd: string, baseArgs: string[], files: string[], cwd: string | undefined): string {
+  const result = runTool(cmd, [...baseArgs, '--csv', '-C', String(CCN_THRESHOLD), ...files], { cwd });
+  return result.stdout + result.stderr;
+}
+
+/**
+ * Turn a CCN count into the gate's verdict and messages.
+ *
+ * Split from runGate3 so the three-way outcome (WARN on unparsable output, FAIL
+ * on violations, PASS) is visible in one place and testable without driving
+ * lizard. Notably `!analysed` must NOT fall through to PASS: a lizard that
+ * produced no parsable row would otherwise report success on zero analysed
+ * functions -- the same silent-success failure as #674.
+ */
+export function buildComplexityVerdict(
+  counts: { warnings: number; analysed: boolean },
+  rawOutput: string
+): { status: 'PASS' | 'FAIL' | 'WARN'; messages: string[]; exitCode: number; warnings: number } {
+  if (!counts.analysed) {
+    return {
+      status: 'WARN',
+      messages: ['⚠️  WARN - lizard produced no parsable results; complexity not verified'],
+      exitCode: 0,
+      warnings: 0,
+    };
+  }
+  if (counts.warnings > 0) {
+    return {
+      status: 'FAIL',
+      messages: [
+        rawOutput,
+        '',
+        `❌ BLOCKED - ${counts.warnings} functions with CCN > ${CCN_THRESHOLD} found.`,
+        `Refactor high-complexity functions to keep below ${CCN_THRESHOLD} complexity.`,
+      ],
+      exitCode: 1,
+      warnings: counts.warnings,
+    };
   }
+  return {
+    status: 'PASS',
+    messages: [`✅ PASSED - All functions within complexity threshold (${CCN_THRESHOLD}).`],
+    exitCode: 0,
+    warnings: 0,
+  };
+}
 
-  messages.push(`✅ PASSED - All functions within complexity threshold (${CCN_THRESHOLD}).`);
-  recordAudit('gate-3', 'complexity', 'PASS', 0, startMs);
-  return { status: 'PASS', messages, exitCode: 0 };
+/**
+ * Count functions whose CCN exceeds the threshold from lizard's --csv output.
+ *
+ * Split out so the parse can be tested against literal lizard output instead of
+ * by driving the tool: a parser bug here is invisible in exactly the same way
+ * (#674) -- it returns "clean" and the gate reports PASS.
+ *
+ * `analysed` distinguishes "lizard found nothing over the threshold" from
+ * "lizard produced nothing at all". Only the first is a pass.
+ */
+export function countCcnWarnings(csv: string): { warnings: number; analysed: boolean } {
+  let warnings = 0;
+  let analysed = false;
+  for (const line of csv.split('\n')) {
+    const columns = line.split(',');
+    if (columns.length < 2) continue;
+    // Location column carries ":name" style text, so only trust numeric CCN.
+    if (!/^\s*\d+\s*$/.test(columns[1])) continue;
+    analysed = true;
+    if (parseInt(columns[1], 10) > CCN_THRESHOLD) warnings++;
+  }
+  return { warnings, analysed };
 }
 
 // ── CLI Entry Point ──

package/gates/gate-8.ts

@@ -2,6 +2,13 @@
  * Gate 8: Secret Scanning (gitleaks)
  * Detects secrets (API keys, passwords, tokens) in staged files.
  * TypeScript rewrite of githooks/adapters/gate-8.sh for cross-platform Node.js CLI.
+ *
+ * Scans the INDEX (`git --staged`), not committed history (#675, mirroring the
+ * adapter fix in #449). gitleaks `git --pre-commit` walks committed revisions; on a
+ * pre-commit run it reports "0 commits scanned" and exits 0. A staged secret
+ * therefore passed the CLI while the hook blocked it -- and the CLI is the path CI
+ * and the plugins use. `--staged` scans `git diff --cached`, exactly the
+ * pre-commit payload. Same tool, same payload, one word different, opposite verdict.
  */
 import path from 'path';
 import fs from 'fs';
@@ -29,20 +36,7 @@ export function runGate8(input: GateInput): GateOutput {
   }
 
   const gitleaksCmd = tool.via === 'npx' ? 'npx' : tool.path;
-  const gitleaksArgs = tool.via === 'npx' ? ['-y', 'gitleaks'] : [];
-
-  // Config detection
-  const configPath = findGitleaksConfig(cwd);
-  if (configPath) {
-    gitleaksArgs.push(`--config=${configPath}`);
-  }
-
-  // Cross-platform temp path (fixes /tmp issue on Windows)
-  const reportPath = path.join(getTempDir(), 'gitleaks-report.json');
-
-  // Run gitleaks on staged changes
-  gitleaksArgs.push('git', '--pre-commit', '--redact', '--no-banner',
-    '--report-format=json', `--report-path=${reportPath}`);
+  const gitleaksArgs = buildGitleaksArgs(tool.via === 'npx', findGitleaksConfig(cwd));
 
   const result = runTool(gitleaksCmd, gitleaksArgs, { cwd });
 
@@ -53,33 +47,52 @@ export function runGate8(input: GateInput): GateOutput {
   }
 
   if (result.exitCode === 1) {
-    // Secrets found
-    messages.push(result.stdout);
-    messages.push('');
-    messages.push('❌ BLOCKED - Secrets detected in staged files.');
-    messages.push('');
-    messages.push('Remediation options:');
-    messages.push('  1. Remove the secret and use environment variables instead');
-    messages.push('  2. Add a false positive to .gitleaks.toml allowlist');
-    messages.push('  3. Use git secret or vault for sensitive data');
-    messages.push('');
-    messages.push('See: https://github.com/gitleaks/gitleaks');
+    messages.push(...secretsFoundMessages(result.stdout));
     recordAudit('gate-8', 'secret-scanning', 'FAIL', 1, startMs);
     return { status: 'FAIL', messages, exitCode: 1 };
   }
 
-  // Runtime error
   messages.push(`     ⚠️  gitleaks exited with code ${result.exitCode} - skipping gate`);
   messages.push('     ✅ Secret Scanning (SKIP, gitleaks error)');
   recordAudit('gate-8', 'secret-scanning', 'SKIP', result.exitCode, startMs);
   return { status: 'SKIP', messages, exitCode: 0 };
 }
 
+/** The report + remediation shown when gitleaks finds secrets (exit code 1). */
+function secretsFoundMessages(stdout: string): string[] {
+  return [
+    stdout,
+    '',
+    '❌ BLOCKED - Secrets detected in staged files.',
+    '',
+    'Remediation options:',
+    '  1. Remove the secret and use environment variables instead',
+    '  2. Add a false positive to .gitleaks.toml allowlist',
+    '  3. Use git secret or vault for sensitive data',
+    '',
+    'See: https://github.com/gitleaks/gitleaks',
+  ];
+}
+
 function findGitleaksConfig(cwd: string): string | null {
   const configPath = path.join(cwd, '.gitleaks.toml');
   return fs.existsSync(configPath) ? configPath : null;
 }
 
+/**
+ * Assemble the gitleaks argument vector.
+ *
+ * Report goes to a cross-platform temp path (the old hardcoded `/tmp` broke on
+ * Windows), and the scan reads the INDEX -- see the file header for why (#675).
+ */
+function buildGitleaksArgs(viaNpx: boolean, configPath: string | null): string[] {
+  const args = viaNpx ? ['-y', 'gitleaks'] : [];
+  if (configPath) args.push(`--config=${configPath}`);
+  args.push('git', '--staged', '--redact', '--no-banner',
+    '--report-format=json', `--report-path=${path.join(getTempDir(), 'gitleaks-report.json')}`);
+  return args;
+}
+
 // ── CLI Entry Point ──
 if (process.argv.includes('--run')) {
   const cwdIdx = process.argv.indexOf('--cwd');

package/gates/gate-9.ts

@@ -1,5 +1,5 @@
 /**
- * Gate 9: Semgrep SAST Security Scan
+ * Gate 10: Semgrep SAST Security Scan (file name predates the #677 renumber)
  * Detects security vulnerabilities in staged files.
  * For PowerShell projects: uses PSScriptAnalyzer security rules as alternative.
  * TypeScript rewrite of githooks/adapters/gate-9.sh for cross-platform Node.js CLI.
@@ -36,7 +36,7 @@ export function runGate9(input: GateInput): GateOutput {
   const messages: string[] = [];
 
   messages.push('');
-  messages.push('→ Gate 9: Semgrep SAST Security Scan...');
+  messages.push('→ Gate 10: Semgrep SAST Security Scan...');
 
   // PowerShell project: use PSScriptAnalyzer security rules
   if (isPowerShellProject(input.projectLang)) {
@@ -49,7 +49,7 @@ export function runGate9(input: GateInput): GateOutput {
     messages.push('     ⚠️  WARN - semgrep not installed — SAST scanning unavailable');
     messages.push('     Install: brew install semgrep (macOS) | pip install semgrep (Linux/Windows)');
     messages.push('     Pre-cache rules: semgrep --config=' + SEMGREP_RULESET);
-    messages.push('     Gate 9: SAST Security (WARN, semgrep not installed)');
+    messages.push('     Gate 10: SAST Security (WARN, semgrep not installed)');
     recordAudit('gate-9', 'sast-security', 'WARN', 0, startMs);
     return { status: 'WARN', messages, exitCode: 0 };
   }
@@ -242,7 +242,7 @@ function runPowerShellSAST(
   const ps = detectPowerShell();
   if (!ps.available) {
     messages.push('     ⚠️  WARN - PowerShell not available — SAST scanning unavailable');
-    messages.push('     Gate 9: SAST Security (WARN, PowerShell not installed)');
+    messages.push('     Gate 10: SAST Security (WARN, PowerShell not installed)');
     recordAudit('gate-9', 'sast-security', 'WARN', 0, startMs);
     return { status: 'WARN', messages, exitCode: 0 };
   }

package/hooks/gate-12-file-hygiene.sh

@@ -36,13 +36,35 @@ fi
 HYGIENE_ISSUES=0
 HYGIENE_FILES=""
 
+# Is this staged file binary (so line-based checks do not apply)?
+#
+# This replaces `grep -q $'\x00'`, which was a no-op guard: bash strips NUL from
+# `$'\x00'`, so the pattern was the EMPTY string and `grep -q ""` matches any
+# non-empty input. Every staged file was therefore judged binary and `continue`d,
+# silently disabling Check 1 (trailing whitespace), Check 2 (missing EOF newline)
+# and -- worst -- Check 3 (merge conflict markers, a BLOCK-level check). Checks 4
+# and 5 lacked the guard, which is why the gate looked half-working.
+#
+# Ask git instead of guessing: `--numstat` reports a binary entry as `-\t-\t<path>`
+# because git already made that determination. A byte-level NUL test cannot be
+# written with a shell pattern at all (variables and command substitution both drop
+# NUL), and `grep -I` only suppresses output on a binary input -- it does not make
+# `grep -q` fail, which is why that shortcut still reported text.
+is_binary_staged_file() {
+  local _file="$1"
+  case "$(git diff --cached --numstat -- "$_file" 2>/dev/null)" in
+    -[[:space:]]-*) return 0 ;;   # binary: git could not count lines
+    *) return 1 ;;                # text (or empty -- nothing for the line checks)
+  esac
+}
+
 # --- Check 1: Trailing whitespace ---
 TRAILING_WS_FILES=""
 if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
-  # Skip binary files by checking if file contains null bytes
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  # Skip binary files : they have no lines to check
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check staged content for trailing whitespace (spaces/tabs at end of lines)
@@ -69,7 +91,7 @@ if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check if file content ends with newline
@@ -108,7 +130,7 @@ else
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check for conflict markers in staged content

package/hooks/gate-13-compiler-strictness.sh

@@ -527,6 +527,18 @@ gate13_count_lint_findings() {
   [ -n "$src" ] || src=$(cat)
   printf '%s\n' "$src" | awk '
     BEGIN { n = 0 }
+    # (#673) Maven 3.9.7+ reactor summary appends the packaging type per module:
+    #     [INFO] whaleaudit-core  [jar]
+    # `[pom]`/`[jar]` match the open-category rule below, so a 3-module reactor
+    # reported 4 javac findings on code with ZERO warnings -- and got worse with
+    # every module added. The marker set is closed (packaging types are an enum in
+    # Maven itself), so excluding it does not reopen the #659 fail-open hole that
+    # the open-category rule was introduced to close.
+    #
+    # Scoped to `[INFO]` lines: a javac diagnostic is never prefixed with the
+    # Maven [INFO] banner, so this cannot mask a real finding even when a category
+    # name collides with a packaging type.
+    /^\[INFO\].*\[(pom|jar|war|ear|rar|ejb|maven-plugin|par|test-jar|java-source|javadoc|zip|tar\.gz|tar\.bz2)\][[:space:]]*$/ { next }
     # Any bracketed lowercase category: covers the whole javac -Xlint enum and any
     # later addition to it. Restricted to lowercase/digit/hyphen so a Maven
     # `[WARNING]` with no category, or a `[INFO]` banner, is not counted.

package/hooks/pre-commit

@@ -319,6 +319,32 @@ if ! declare -F run_tsx >/dev/null 2>&1; then
   }
 fi
 
+# Run a repo-local Node CLI (eslint, vitest, biome, ...) without npx when the
+# binary is already in this repo's node_modules.
+#
+# `npx <tool>` costs ~1.4-1.5 s more than the tool itself on this machine
+# (measured: eslint --version 1654 ms via npx vs 348 ms direct; vitest 1799 ms vs
+# 250 ms). That is npm resolving the package before it ever runs: on a cold
+# cache it may reach the network, which a quality gate must never depend on.
+# pre-commit invokes these tools a handful of times per commit, so the wrapper
+# was paying several seconds to start processes that were already installed.
+#
+# `run_node_bin <tool> <node-entry> [args...]`. Falls back to npx when the local
+# entry is absent (a globally-installed toolchain is still a valid setup).
+if ! declare -F run_node_bin >/dev/null 2>&1; then
+  run_node_bin() {
+    local _tool="$1" _entry="$2"
+    shift 2
+    local _root="${PROJECT_ROOT:-$(pwd)}"
+    local _local="$_root/node_modules/$_entry"
+    if [ -f "$_local" ] && command -v node >/dev/null 2>&1; then
+      node "$_local" "$@"
+    else
+      npx "$_tool" "$@"
+    fi
+  }
+fi
+
 # Gate 5's vitest exit-code judgement (is_runner_infrastructure_error,
 # is_partial_threshold_only_exit, handle_test_failure) is sourced from
 # lib/test-failure.sh below, next to the other hook libraries.
@@ -1677,9 +1703,9 @@ else
         # each linted file (found in the subdirectory automatically); flat
         # configs are discovered from the CWD, so point at them explicitly.
         if [ "$TS_PROJECT_DIR" != "." ] && [ -f "$TS_PROJECT_DIR/eslint.config.js" ]; then
-          ESLINT_OUTPUT=$(npx eslint --config "$TS_PROJECT_DIR/eslint.config.js" $ESLINT_FILES -f json --no-warn-ignored 2>&1)
+          ESLINT_OUTPUT=$(run_node_bin eslint eslint/bin/eslint.js --config "$TS_PROJECT_DIR/eslint.config.js" $ESLINT_FILES -f json --no-warn-ignored 2>&1)
         else
-          ESLINT_OUTPUT=$(npx eslint $ESLINT_FILES -f json --no-warn-ignored 2>&1)
+          ESLINT_OUTPUT=$(run_node_bin eslint eslint/bin/eslint.js $ESLINT_FILES -f json --no-warn-ignored 2>&1)
         fi
         ESLINT_EXIT=$?
         if [ "$ESLINT_EXIT" -ne 0 ]; then
@@ -2659,7 +2685,13 @@ else
   # Exclusions come from filter_project_paths (#649). The hand-maintained list
   # this replaced omitted vendor/target/coverage/out, so a staged vendor/x.ts
   # was reported as new source with no test.
-  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
+  #
+  # Byte-identical mirrors under src/npm-package/ are excluded the same way
+  # lint (#494) and Boy Scout (#649) already exclude them. A mirror cannot
+  # carry its own test: the next resync overwrites the directory, so the
+  # requirement is structurally unsatisfiable and blocked every commit that
+  # added a file to a mirrored module. The canonical source keeps its test.
+  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -Ev "$MIRROR_PATH_FILTER" | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
 
   # Strip PROJECT_SUBDIR prefix from new-TS-file paths ONLY when the hook
   # actually cd'd into the subdirectory (IN_PROJECT_SUBDIR=1; single-language
@@ -3002,7 +3034,7 @@ else
     if source "$ADAPTER_FILE" 2>/dev/null; then
       # TypeScript: vitest with smart test selection
       if [ "$CURRENT_LANG" = "typescript" ] && { [ -f "package.json" ] || [ -f "$PROJECT_ROOT/package.json" ]; }; then
-        if run_without_git_context npx vitest --version >/dev/null 2>&1; then
+        if run_without_git_context run_node_bin vitest vitest/vitest.mjs --version >/dev/null 2>&1; then
           # Count changed test files to decide strategy. `grep -c '.'` prints its
           # own zero AND exits 1 on an empty list, so `|| echo "0"` used to yield
           # $'0\n0' -- the same two-value bug that false-blocked Gate 8 (#493).
@@ -3049,7 +3081,7 @@ else
           if [ "$CHANGED_TEST_FILE_COUNT" -gt 20 ] 2>/dev/null; then
             # Too many test files changed → full run
             echo "Too many test files changed ($CHANGED_TEST_FILE_COUNT), running full test suite..."
-            TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage 2>&1)
+            TESTS_OUTPUT=$(run_without_git_context run_node_bin vitest vitest/vitest.mjs run --coverage 2>&1)
             TESTS_EXIT_CODE=$?
             echo "$TESTS_OUTPUT" | head -60
             if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -3063,7 +3095,7 @@ else
             SMART_TARGETS=$(echo "$SELECTED_TEST_FILES" | tr '\n' ' ')
             echo "Running ${CHANGED_TEST_FILE_COUNT} changed test file(s) with coverage..."
             echo "   Target(s): $(echo "$SELECTED_TEST_FILES" | tr '\n' ' ')"
-            TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage $SMART_TARGETS 2>&1)
+            TESTS_OUTPUT=$(run_without_git_context run_node_bin vitest vitest/vitest.mjs run --coverage $SMART_TARGETS 2>&1)
             TESTS_EXIT_CODE=$?
             echo "$TESTS_OUTPUT" | head -60
             if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -3108,7 +3140,7 @@ else
             if [ -n "$RELATED_TESTS" ]; then
               echo "   Found related test(s): $(echo "$RELATED_TESTS" | tr '\n' ' ')"
               PARTIAL_TEST_RUN=true  # Mark as partial run for coverage check
-              TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage $RELATED_TESTS 2>&1)
+              TESTS_OUTPUT=$(run_without_git_context run_node_bin vitest vitest/vitest.mjs run --coverage $RELATED_TESTS 2>&1)
               TESTS_EXIT_CODE=$?
               echo "$TESTS_OUTPUT" | head -60
               if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -3119,7 +3151,7 @@ else
             else
               # No related tests found → full run is safest
               echo "   No related test files found, running full test suite..."
-              TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage 2>&1)
+              TESTS_OUTPUT=$(run_without_git_context run_node_bin vitest vitest/vitest.mjs run --coverage 2>&1)
               TESTS_EXIT_CODE=$?
               echo "$TESTS_OUTPUT" | head -60
               if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -3976,6 +4008,8 @@ else
     cd "$PROJECT_ROOT" || exit 1
     if [ "$ARCHLINT_KIND" = "npx" ]; then
       npx @archlinter/cli "$@"
+    elif [ "${ARCHLINT_NODE:-0}" = "1" ]; then
+      node "$ARCHLINT_BIN" "$@"
     else
       "$ARCHLINT_BIN" "$@"
     fi
@@ -3996,8 +4030,17 @@ else
     for CURRENT_LANG in $PROJECT_LANGS; do
     case "$CURRENT_LANG" in
       "typescript")
-        # Try local npx install first (devDependencies), fall back to global
-        if [ -x "$PROJECT_ROOT/node_modules/.bin/archlint" ]; then
+        # Prefer node on the package's own entry over the .bin shim: the shim's
+        # exec bit and extension vary by platform and package manager (npm writes
+        # archlint, archlint.cmd and archlint.ps1 on Windows), so `-x .bin/...`
+        # is true here while the no-extension shim is what Git Bash would run.
+        # `node <entry>` sidesteps all of that and also avoids npx's ~1.6 s
+        # package resolution (measured: 1909 ms via npx vs 319 ms direct).
+        if [ -f "$PROJECT_ROOT/node_modules/@archlinter/cli/bin/archlint.js" ] && command -v node >/dev/null 2>&1; then
+          ARCHLINT_KIND="binary"
+          ARCHLINT_BIN="$PROJECT_ROOT/node_modules/@archlinter/cli/bin/archlint.js"
+          ARCHLINT_NODE=1
+        elif [ -x "$PROJECT_ROOT/node_modules/.bin/archlint" ]; then
           ARCHLINT_KIND="binary"
           ARCHLINT_BIN="$PROJECT_ROOT/node_modules/.bin/archlint"
         elif command -v archlint >/dev/null 2>&1; then
@@ -4758,7 +4801,12 @@ if [ -n "$MIRROR_STAGED" ] && printf '%s\n' "$MIRROR_STAGED" | grep -qE '^(githo
     MIRROR_FAIL=0
     while IFS= read -r _mf; do
       [ -n "$_mf" ] || continue
+      # `__tests__/` has no mirror BY DESIGN: sync-package-content.js lists it in
+      # SKIP_DIRS so test suites never ship to consumers. Demanding a mirror for
+      # them makes every new BATS file un-committable -- the two rules contradicted
+      # each other, and the only way past was to edit a generated file by hand.
       case "$_mf" in
+        */__tests__/*) continue ;;
         githooks/*) _mm="src/npm-package/hooks/${_mf#githooks/}" ;;
         plugins/*/src/*) _mm=$(printf '%s' "$_mf" | sed 's|^plugins/\([^/]*\)/src/|src/npm-package/plugins/\1/src/|') ;;
         *) continue ;;
@@ -4874,7 +4922,22 @@ generate_quality_report() {
   local TIMESTAMP
   local BRANCH
   local PASSED_COUNT=0
-  local TOTAL_GATES=12
+  # #680: the gate list is the single source of truth. TOTAL_GATES, the scoring
+  # loop, the console table and the JSON `overall` block all derive from it.
+  #
+  # Gate 13 was added in v0.35.x with only its execution and JSON write -- these
+  # three sites kept saying "12". A machine with no C/C++ compiler therefore saw
+  # `10.0/10 effective`, `gatesWarned: 0` and a table that stopped at Gate 12,
+  # while the JSON `gates` object held 13 keys. "Compiler strictness was never
+  # checked" and "compiler reported zero warnings" rendered identically, which is
+  # the same silent-success pattern as #561/#570/#585.
+  #
+  # Adding a gate now means editing ALL_GATE_NUMBERS + ONE table row. Nothing
+  # else carries a count.
+  local ALL_GATE_NUMBERS="1 2 3 4 5 6 7 8 9 10 11 12 13"
+  local TOTAL_GATES=0
+  local _g
+  for _g in $ALL_GATE_NUMBERS; do TOTAL_GATES=$((TOTAL_GATES + 1)); done
   local SKIP_COUNT=0
   local WARN_COUNT=0
   local NONPASS_COUNT=0
@@ -4902,7 +4965,7 @@ generate_quality_report() {
   local DEGRADED_JSON=""
   local FAIL_COUNT=0
   local FAILED_JSON=""
-  for gate in 1 2 3 4 5 6 7 8 9 10 11 12; do
+  for gate in $ALL_GATE_NUMBERS; do
     local status_var="GATE_${gate}_STATUS"
     # Default mirrors the JSON report rendering below EXACTLY (gates 1-11
     # PASS, gate 12 WARN): a gate that never assigned a status is "not
@@ -4912,6 +4975,10 @@ generate_quality_report() {
     # Default direction is "did not run", never "passed": an unassigned status
     # is a gate that never reached a verdict, and scoring it PASS both claims a
     # success that did not happen and hides the gap in the effective rate.
+    #
+    # Gate 13 defaults to SKIP like the rest: it is only WARN when the toolchain
+    # is missing and the gate explicitly says so, and Gate 12 is the one gate
+    # whose "no verdict" is still a warning rather than "not applicable".
     if [ "$gate" -eq 12 ]; then gate_default="WARN"; else gate_default="SKIP"; fi
     gate_status="${!status_var:-$gate_default}"
     case "$gate_status" in
@@ -5258,6 +5325,9 @@ ENDJSON
   printf "  %-45s %s\n" "Gate 10: SAST Security" "${GATE_10_STATUS:-SKIP}"
   printf "  %-45s %s\n" "Gate 11: Sprint Flow" "${GATE_11_STATUS:-SKIP}"
   printf "  %-45s %s\n" "Gate 12: File Hygiene" "${GATE_12_STATUS:-WARN}"
+  # #680: Gate 13 ran and could block, but had no row here -- the table is what a
+  # human reads, so a gate missing from it reads as a gate that does not exist.
+  printf "  %-45s %s\n" "Gate 13: Compiler Strictness" "${GATE_13_STATUS:-SKIP}"
   echo ""
   # #564: both views in one line. The effective score answers "of the gates that
   # could run, how many passed"; the all-gates score counts a skip against the

package/hooks/pre-push

@@ -426,7 +426,16 @@ SPRINT_GATE_SCRIPT=""
 # ~/.config/xp-gate/hooks -- a correctly installed machine was told the file was
 # missing here too. Nothing is sourced for this: pre-push resolves its libraries
 # further down (ADAPTER_COMMON), and this gate must decide before that.
-for _sprint_gate_dir in "$PROJECT_ROOT/githooks" "$(dirname "$0")" "$HOME/.config/xp-gate/hooks"; do
+#
+# `$HOME/.config/xp-gate/adapters` is the tier #678 found missing: `xp-gate
+# setup-global` runs copyAdapters(), which ships every `gate-*.sh` AND
+# `sprint-gate.sh` into the ADAPTERS directory -- never into hooks/. So a globally
+# installed machine had sprint-gate.sh present under adapters/ while this loop
+# searched only hooks/, and Gate MS skipped on every push without complaint. Both
+# tiers are searched now: which directory `init` chose is an install detail this
+# gate should not depend on.
+for _sprint_gate_dir in "$PROJECT_ROOT/githooks" "$(dirname "$0")" \
+                        "$HOME/.config/xp-gate/hooks" "$HOME/.config/xp-gate/adapters"; do
   if [ -n "$_sprint_gate_dir" ] && [ -f "$_sprint_gate_dir/sprint-gate.sh" ]; then
     SPRINT_GATE_SCRIPT="$_sprint_gate_dir/sprint-gate.sh"
     break
@@ -440,7 +449,7 @@ if [ -n "$SPRINT_GATE_SCRIPT" ]; then
     exit 1
   fi
 else
-  echo "⏭️  SKIPPED - Gate MS: Sprint Flow (sprint-gate.sh not found; searched: $PROJECT_ROOT/githooks, $(dirname "$0"), $HOME/.config/xp-gate/hooks)"
+  echo "⏭️  SKIPPED - Gate MS: Sprint Flow (sprint-gate.sh not found; searched: $PROJECT_ROOT/githooks, $(dirname "$0"), $HOME/.config/xp-gate/hooks, $HOME/.config/xp-gate/adapters)"
   GATE_S_STATUS="SKIP"
 fi
 echo ""

package/lib/__tests__/doctor.test.js

@@ -13,7 +13,16 @@ const util = require('util');
 // tests run in parallel across worker threads.
 const DESCRIBE_ID = String(Math.random().toString(36).slice(2, 8));
 
+// Budget for every case in this file. `doctor --fix` walks the whole install
+// surface (hooks, adapters, config, version cache) and the default 5 s budget is
+// a measurement of an idle machine, not of one running a full suite: under
+// concurrent load the same passing case times out, which reads as a doctor
+// defect. 30 s keeps real hangs bounded while leaving the CPU contention room.
+const DOCTOR_TIMEOUT_MS = 30000;
+
 describe('doctor', () => {
+  // Applies to every `it` below (the per-test arg is only needed when overriding).
+  vi.setConfig({ testTimeout: DOCTOR_TIMEOUT_MS });
   let tmpHome;
   let tmpProject;
   let originalHome;