@boyingliu01/xp-gate 0.35.17 → 0.35.19

package/adapters/gate-3.sh

@@ -172,8 +172,19 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                   const entries = baseline.functions || baseline.entries || baseline;
                   if (Array.isArray(entries)) {
                     for (const e of entries) {
-                      if (!e || !e.file || !e.name) continue;
-                      known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
+                      // #632: accept the key the baseline WRITER actually emits.
+                      // tools/Update-ComplexityBaseline.ps1 (the tool this gate
+                      // points at in its own fix-it message) writes "function",
+                      // while this reader only knew "name" -- so every entry was
+                      // dropped, "known" stayed empty, and every function above
+                      // the threshold became a brand-new function. The ratchet
+                      // could never pass. Both spellings are read: this is a
+                      // reader, and the writer vocabulary is not ours to
+                      // redefine from here.
+                      if (!e || !e.file) continue;
+                      const fnName = e.name || e.function;
+                      if (!fnName) continue;
+                      known.set(norm(e.file) + "::" + fnName, Number(e.ccn) || 0);
                     }
                   }
                   // The measurement emits ABSOLUTE paths (pwsh resolved them), while
@@ -450,6 +461,52 @@ else
           GATE_3_DETAIL="mode=ratchet verifier=MISSING"
           exit 1
         fi
+        RATCHET_LIB="$GATE_DIR/lib/ccn-ratchet.sh"
+        [ -f "$RATCHET_LIB" ] || RATCHET_LIB="$(git rev-parse --show-toplevel 2>/dev/null)/githooks/lib/ccn-ratchet.sh"
+        # #617: grade exactly the population the baseline was written from.
+        #
+        # The comment below has always said so, but only as a comment: a repo whose
+        # baseline came from a narrower scan (a Java-only ccn-report, say) had its
+        # vendored minified JS graded anyway, and --csv-verified then disagreed with
+        # lizard on single-line code and fail-closed with "could not be
+        # span-verified". That BLOCK has no repair: the file has no baseline entry
+        # to ratchet, so there is nothing the user could add to clear it.
+        #
+        # The population filter runs BEFORE verification on purpose. Domain
+        # restriction is decidable from the path alone, so asking the expensive
+        # span re-derivation about a file that will not be graded anyway only
+        # manufactures failures for code the ratchet never claims to cover.
+        if [ -f "$RATCHET_LIB" ]; then
+          # shellcheck source=/dev/null
+          . "$RATCHET_LIB" 2>/dev/null || true
+          if declare -F ccn_file_in_population >/dev/null 2>&1; then
+            _cc_pop_kept=""
+            _cc_pop_skipped=""
+            while IFS= read -r _cc_row; do
+              [ -n "$_cc_row" ] || continue
+              _cc_row_path=$(printf '%s' "$_cc_row" | awk -F, '{print $1}')
+              if ccn_file_in_population ".ccn-baseline.json" "$_cc_row_path"; then
+                _cc_pop_kept="${_cc_pop_kept}${_cc_row}
+"
+              else
+                _cc_pop_skipped="${_cc_pop_skipped}${_cc_row_path}
+"
+              fi
+            done <<CC_POP_EOF
+$CC_CSV
+CC_POP_EOF
+            CC_CSV=$(printf '%s' "$_cc_pop_kept")
+            if [ -n "$_cc_pop_skipped" ]; then
+              _cc_pop_skip_n=$(printf '%s' "$_cc_pop_skipped" | grep -c . || true)
+              echo "ℹ️  Gate 3: ${_cc_pop_skip_n:-0} file(s) outside the baseline population — not graded, not ratcheted:"
+              printf '%s' "$_cc_pop_skipped" | sed 's/^/     /' | sed -n '1,5p'
+              if [ "${_cc_pop_skip_n:-0}" -gt 5 ]; then
+                echo "     ... and $((_cc_pop_skip_n - 5)) more"
+              fi
+              echo "     (declare or widen the population in .ccn-baseline.json to grade them)"
+            fi
+          fi
+        fi
         if [ -f "$CC_REPORT" ] && command -v node >/dev/null 2>&1; then
           _cc_verify_failed=0
           CC_CSV_VERIFIED=$(printf '%s\n' "$CC_CSV" | node "$CC_REPORT" --csv-verified batch --root "$(git rev-parse --show-toplevel 2>/dev/null)") || _cc_verify_failed=1
@@ -460,8 +517,6 @@ else
           fi
           CC_CSV="$CC_CSV_VERIFIED"
         fi
-        RATCHET_LIB="$GATE_DIR/lib/ccn-ratchet.sh"
-        [ -f "$RATCHET_LIB" ] || RATCHET_LIB="$(git rev-parse --show-toplevel 2>/dev/null)/githooks/lib/ccn-ratchet.sh"
         # Fail closed when the ratchet library is missing. Sourcing a nonexistent
         # file only prints "No such file or directory" and leaves
         # evaluate_ccn_ratchet undefined; the verdict then came back empty, every
@@ -529,13 +584,43 @@ else
       # this, a crashing or mis-invoked lizard yields 0 warnings and the gate
       # reports PASSED on zero analysed functions -- the same silent-success
       # failure this issue is about.
+      #
+      # #666: "no rows" has TWO causes and they must not share a verdict. A
+      # module of pure constants legitimately has zero functions, and lizard
+      # emits no row for it at all (measured: `lizard pure_data.py --csv` prints
+      # nothing and exits 0). That was reported as `lizard_output_unparsable`
+      # /WARN, which is the message for a BROKEN lizard -- so a healthy run on a
+      # data-only diff was indistinguishable from a tooling fault. The two are
+      # separated by a POSITIVE probe: ask lizard to describe a fixture known to
+      # contain a function. If it produces rows, lizard works and the input
+      # simply had no functions (SKIP, `no_functions_in_input`); if it does not,
+      # the tool really is broken (WARN, `lizard_output_unparsable`).
       if ! printf '%s\n' "$CC_CSV_FLAT" | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { found = 1; exit }
                                                  END { exit(found ? 0 : 1) }'; then
-        echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
-        GATE_3_STATUS="WARN"
-        # Consumed by the sourcing parent (pre-commit report JSON), not here.
-        # shellcheck disable=SC2034
-        GATE_3_REASON="lizard_output_unparsable"
+        _lizard_probe_dir=$(mktemp -d 2>/dev/null || echo "${TMPDIR:-/tmp}")
+        _lizard_probe_file="$_lizard_probe_dir/xp-gate-lizard-probe.py"
+        printf 'def _xp_gate_probe(x):\n    if x:\n        return 1\n    return 0\n' > "$_lizard_probe_file" 2>/dev/null
+        _lizard_probe_rows=0
+        if [ -f "$_lizard_probe_file" ]; then
+          _lizard_probe_rows=$(printf '%s\n' "$_lizard_probe_file" \
+            | lizard_batches --csv 2>/dev/null \
+            | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { c++ } END { print c + 0 }')
+        fi
+        rm -rf "$_lizard_probe_dir" 2>/dev/null || true
+        if [ "${_lizard_probe_rows:-0}" -gt 0 ]; then
+          echo "⏭️  SKIPPED - Complexity: the changed source files define no functions (pure data module)."
+          echo "   Verified: lizard parsed a probe fixture normally, so this is an empty result set, not a broken tool."
+          GATE_3_STATUS="SKIP"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="no_functions_in_input"
+        else
+          echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
+          GATE_3_STATUS="WARN"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="lizard_output_unparsable"
+        fi
       elif [ "$CC_WARNINGS" -gt 0 ]; then
         echo "$CC_OUTPUT"
         echo ""

package/adapters/gate-4.sh

@@ -46,7 +46,14 @@ java_coverage_note() {
     esac
   done
   [ -n "$_has_java" ] || return 0
-  echo "ℹ️  Java rule coverage: $JAVA_COVERAGE_EFFECTIVE/$JAVA_COVERAGE_TOTAL rules effective (inert on Java: $JAVA_COVERAGE_INERT -- see docs/java-principles-coverage.md)"
+  # #628: `docs/` is not in the npm package's `files` list, so pointing a user at
+  # `docs/java-principles-coverage.md` was a dead path in every installed project --
+  # the note told them to read a file that does not exist on their machine. Cite the
+  # upstream URL instead, and keep the local path only when the doc is actually
+  # present (i.e. when running inside this repo).
+  local _where="https://github.com/boyingliu01/xp-gate/blob/main/docs/java-principles-coverage.md"
+  [ -f "docs/java-principles-coverage.md" ] && _where="docs/java-principles-coverage.md"
+  echo "ℹ️  Java rule coverage: $JAVA_COVERAGE_EFFECTIVE/$JAVA_COVERAGE_TOTAL rules effective (inert on Java: $JAVA_COVERAGE_INERT -- see $_where)"
 }
 
  2>&1 echo ""
@@ -165,42 +172,30 @@ else
         rm -f "$PRINCIPLES_STDERR"
 
         if [ "$PRINCIPLES_EXIT" -ge 2 ]; then
-          # Fail-closed (#661), same rule as Gate 8 (#499): a gate that cannot run
-          # must not report success.
+          # #661: exit>=2 means the checker did not RUN (crash, module not found,
+          # bad invocation). This used to record SKIP, and pre-commit treats SKIP
+          # as non-blocking, so a tool failure was absorbed into the green light --
+          # the reproduction printed a module-not-found stack trace and then
+          # "✅ PASSED - Principles checker (no errors found)".
           #
-          # This branch used to settle on SKIP, which the caller reads as
-          # non-blocking -- so a checker that crashed on startup
-          # (`Cannot find module 'C:\c\Users\...'`, the POSIX-path-to-native-node
-          # bug) still printed "PASSED - Principles checker (no errors found)".
-          # The path conversion fixed that one cause; any other way of breaking
-          # the launch (missing tsx, corrupt module, OOM) lands here too, and all
-          # of them would have been absorbed into a green light.
+          # The distinction the gate must keep:
+          #   - tool NOT INSTALLED  -> SKIP is honest; nothing is being claimed.
+          #   - tool PRESENT, CRASH -> WARN. Not a pass (nothing was checked) and
+          #     not a silent skip (the user must know their code went unaudited).
           #
-          # SKIP stays reserved for "language not applicable / tool not
-          # installed", which is not what this is: the checker exists and failed.
-          echo ""
-          echo "❌ BLOCKED - Principles checker failed to execute (exit $PRINCIPLES_EXIT)"
-          echo "This is a tool fault, NOT a clean result. A gate that cannot run must not pass."
-          echo "  Fix the checker, or set PRINCIPLES_SKIP_TOOL_FAULT=1 to downgrade to a warning."
-          echo "  (downgrade is audit-logged and never allowed on main/master)"
-          GATE_4_STATUS="FAIL"
+          # WARN rather than FAIL on purpose: the commit itself is not necessarily
+          # bad, the TOOL is broken, and blocking every commit until node/tsx is
+          # repaired would blame the change for an environment fault. What must
+          # never happen is the green light.
+          echo "⚠️  Principles checker did not run (exit ${PRINCIPLES_EXIT}) — this code is NOT verified."
+          echo "     Gate 4 cannot claim a pass for a check that never executed."
+          echo "     Fix the checker invocation above (or run 'npx xp-gate check principles .')."
+          echo "⏭️  WARN - Principles check (checker execution error)"
+          GATE_4_STATUS="WARN"
+          # Consumed by the sourcing parent, not here (see #548).
           # shellcheck disable=SC2034
           GATE_4_REASON="checker_execution_error"
           rm -f "$PRINCIPLES_JSON"
-          if [ "${PRINCIPLES_SKIP_TOOL_FAULT:-0}" = "1" ]; then
-            echo "⚠️  ESCAPE VALVE: PRINCIPLES_SKIP_TOOL_FAULT=1 — downgrading to SKIP"
-            # Same asymmetry as Gate 5a: a downgrade is tolerable on a feature
-            # branch, never on main/master, where it would green-light the trunk.
-            _g4_branch="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)"
-            if [ "$_g4_branch" = "main" ] || [ "$_g4_branch" = "master" ]; then
-              echo "❌ ESCAPE VALVE BLOCKED: PRINCIPLES_SKIP_TOOL_FAULT not allowed on $_g4_branch"
-              GATE_4_STATUS="FAIL"
-              exit 1
-            fi
-            GATE_4_STATUS="SKIP"
-          else
-            exit 1
-          fi
         else
           # Check severity levels. The reporter emits JSON.stringify(out, null, 2),
           # i.e. `"severity": "warning"` WITH a space; tolerate any whitespace so a

package/adapters/gate-8.sh

@@ -59,10 +59,24 @@ fi
 # revisions and reports "0 commits scanned" on a pre-commit run -- so a staged
 # secret was never seen and Gate 8 always passed. `git --staged` scans
 # `git diff --cached`, which is exactly the pre-commit payload (#449).
+#
+# #616: `--all` is a different question, and the index is the wrong place to ask
+# it. Under `xp-gate check . --all` the user asked "is the whole tree clean", the
+# index is usually empty, `git --staged` legitimately found nothing, and that
+# nothing was counted as PASSED -- a secret sitting in a tracked file was
+# invisible to the one command meant to find it. The runner already exports
+# GATE_SCOPE (#589); this fragment just has to read it. `dir --no-git` scans the
+# filesystem so tracked-but-unmodified files are covered.
 GITLEAKS_REPORT="${TMPDIR:-/tmp}/gitleaks-report.json"
 rm -f "$GITLEAKS_REPORT"
-GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
-GITLEAKS_EXIT=$?
+if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+  echo "     Scope: --all (scanning the working tree, not the index)"
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD dir --no-git --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+  GITLEAKS_EXIT=$?
+else
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+  GITLEAKS_EXIT=$?
+fi
 
 if [ "$GITLEAKS_EXIT" -eq 0 ]; then
   # Decide SKIP from the REPORT ARTIFACT, not from log wording. Parsing stdout
@@ -183,7 +197,22 @@ fi
 # if-condition (errexit-exempt); a non-zero hook exit lands in the else branch.
 if command -v detect-secrets-hook >/dev/null 2>&1 && [ -f ".secrets.baseline" ]; then
   DS_TMP="$(dirname "$(mktemp -u)")/ds-output.$$"
-  if git diff --cached --name-only --diff-filter=ACM -z \
+  # #616: same scope split as the gitleaks call above. Under `--all` the index is
+  # usually empty, so piping `git diff --cached -z` into xargs fed the hook zero
+  # files and it reported success without reading anything.
+  if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+    if git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
+      echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline (scope: --all)."
+    else
+      cat "$DS_TMP"
+      echo ""
+      echo "     ❌ BLOCKED - detect-secrets found secrets not in .secrets.baseline."
+      echo "   If these are false positives, regenerate the baseline (cross-platform):"
+      echo "     detect-secrets scan --update .secrets.baseline && git add .secrets.baseline"
+      rm -f "$DS_TMP"
+      exit 1
+    fi
+  elif git diff --cached --name-only --diff-filter=ACM -z \
       | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
     echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline."
   else

package/adapters/gate-9.sh

@@ -32,8 +32,20 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
   GATE_9_STATUS="WARN"
 else
-  # Get staged files filtered to Semgrep-supported languages
-  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  # Get staged files filtered to Semgrep-supported languages.
+  #
+  # #616: under `--all` the index is usually empty, so the staged diff yielded no
+  # files and the gate reported SKIPPED -- "no supported language files changed"
+  # -- for a run whose whole purpose was to scan the tree. Same fail-open shape
+  # #589 fixed in Gate 3, one layer down: the CLI says the tree was checked and
+  # the fragment checks a diff that does not exist. The runner exports GATE_SCOPE;
+  # read it and enumerate tracked files instead.
+  if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+    echo "     Scope: --all (scanning tracked files, not the index)"
+    SEMGREP_FILES=$(git ls-files 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  else
+    SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  fi
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"

package/gate-12-file-hygiene.sh

@@ -36,13 +36,35 @@ fi
 HYGIENE_ISSUES=0
 HYGIENE_FILES=""
 
+# Is this staged file binary (so line-based checks do not apply)?
+#
+# This replaces `grep -q $'\x00'`, which was a no-op guard: bash strips NUL from
+# `$'\x00'`, so the pattern was the EMPTY string and `grep -q ""` matches any
+# non-empty input. Every staged file was therefore judged binary and `continue`d,
+# silently disabling Check 1 (trailing whitespace), Check 2 (missing EOF newline)
+# and -- worst -- Check 3 (merge conflict markers, a BLOCK-level check). Checks 4
+# and 5 lacked the guard, which is why the gate looked half-working.
+#
+# Ask git instead of guessing: `--numstat` reports a binary entry as `-\t-\t<path>`
+# because git already made that determination. A byte-level NUL test cannot be
+# written with a shell pattern at all (variables and command substitution both drop
+# NUL), and `grep -I` only suppresses output on a binary input -- it does not make
+# `grep -q` fail, which is why that shortcut still reported text.
+is_binary_staged_file() {
+  local _file="$1"
+  case "$(git diff --cached --numstat -- "$_file" 2>/dev/null)" in
+    -[[:space:]]-*) return 0 ;;   # binary: git could not count lines
+    *) return 1 ;;                # text (or empty -- nothing for the line checks)
+  esac
+}
+
 # --- Check 1: Trailing whitespace ---
 TRAILING_WS_FILES=""
 if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
-  # Skip binary files by checking if file contains null bytes
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  # Skip binary files : they have no lines to check
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check staged content for trailing whitespace (spaces/tabs at end of lines)
@@ -69,7 +91,7 @@ if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check if file content ends with newline
@@ -108,7 +130,7 @@ else
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
-  if git diff --cached --no-color -- "$file" 2>/dev/null | grep -q $'\x00'; then
+  if is_binary_staged_file "$file"; then
     continue
   fi
   # Check for conflict markers in staged content

package/gate-13-compiler-strictness.sh

@@ -527,6 +527,18 @@ gate13_count_lint_findings() {
   [ -n "$src" ] || src=$(cat)
   printf '%s\n' "$src" | awk '
     BEGIN { n = 0 }
+    # (#673) Maven 3.9.7+ reactor summary appends the packaging type per module:
+    #     [INFO] whaleaudit-core  [jar]
+    # `[pom]`/`[jar]` match the open-category rule below, so a 3-module reactor
+    # reported 4 javac findings on code with ZERO warnings -- and got worse with
+    # every module added. The marker set is closed (packaging types are an enum in
+    # Maven itself), so excluding it does not reopen the #659 fail-open hole that
+    # the open-category rule was introduced to close.
+    #
+    # Scoped to `[INFO]` lines: a javac diagnostic is never prefixed with the
+    # Maven [INFO] banner, so this cannot mask a real finding even when a category
+    # name collides with a packaging type.
+    /^\[INFO\].*\[(pom|jar|war|ear|rar|ejb|maven-plugin|par|test-jar|java-source|javadoc|zip|tar\.gz|tar\.bz2)\][[:space:]]*$/ { next }
     # Any bracketed lowercase category: covers the whole javac -Xlint enum and any
     # later addition to it. Restricted to lowercase/digit/hyphen so a Maven
     # `[WARNING]` with no category, or a `[INFO]` banner, is not counted.

package/gates/gate-3.ts

@@ -53,29 +53,85 @@ export function runGate3(input: GateInput): GateOutput {
 
   messages.push('Checking complexity for source files...');
 
-  // Run lizard with CCN threshold
-  const result = runTool(lizardCmd, [...lizardArgs, '-C', String(CCN_THRESHOLD), ...ccFiles], {
-    cwd: input.cwd,
-  });
-
-  const combinedOutput = result.stdout + result.stderr;
-
-  // Parse warning count from summary table: "Warning cnt   8"
-  const warningMatch = combinedOutput.match(/^Warning cnt\s+(\d+)/m);
-  const warnings = warningMatch ? parseInt(warningMatch[1], 10) : 0;
-
-  if (warnings > 0) {
-    messages.push(combinedOutput);
-    messages.push('');
-    messages.push(`❌ BLOCKED - ${warnings} functions with CCN > ${CCN_THRESHOLD} found.`);
-    messages.push(`Refactor high-complexity functions to keep below ${CCN_THRESHOLD} complexity.`);
-    recordAudit('gate-3', 'complexity', 'FAIL', warnings, startMs);
-    return { status: 'FAIL', messages, exitCode: 1 };
+  // CSV mode: the verdict comes from the numbers lizard uses, not its table
+  // formatting (#674). See countCcnWarnings() for why the old parser never matched.
+  const rawOutput = runLizardCsv(lizardCmd, lizardArgs, ccFiles, input.cwd);
+  const verdict = buildComplexityVerdict(countCcnWarnings(rawOutput), rawOutput);
+  messages.push(...verdict.messages);
+  recordAudit('gate-3', 'complexity', verdict.status, verdict.warnings, startMs);
+  return { status: verdict.status, messages, exitCode: verdict.exitCode };
+}
+
+/** Run lizard in CSV mode and return its raw output (stdout + stderr). */
+function runLizardCsv(cmd: string, baseArgs: string[], files: string[], cwd: string | undefined): string {
+  const result = runTool(cmd, [...baseArgs, '--csv', '-C', String(CCN_THRESHOLD), ...files], { cwd });
+  return result.stdout + result.stderr;
+}
+
+/**
+ * Turn a CCN count into the gate's verdict and messages.
+ *
+ * Split from runGate3 so the three-way outcome (WARN on unparsable output, FAIL
+ * on violations, PASS) is visible in one place and testable without driving
+ * lizard. Notably `!analysed` must NOT fall through to PASS: a lizard that
+ * produced no parsable row would otherwise report success on zero analysed
+ * functions -- the same silent-success failure as #674.
+ */
+export function buildComplexityVerdict(
+  counts: { warnings: number; analysed: boolean },
+  rawOutput: string
+): { status: 'PASS' | 'FAIL' | 'WARN'; messages: string[]; exitCode: number; warnings: number } {
+  if (!counts.analysed) {
+    return {
+      status: 'WARN',
+      messages: ['⚠️  WARN - lizard produced no parsable results; complexity not verified'],
+      exitCode: 0,
+      warnings: 0,
+    };
+  }
+  if (counts.warnings > 0) {
+    return {
+      status: 'FAIL',
+      messages: [
+        rawOutput,
+        '',
+        `❌ BLOCKED - ${counts.warnings} functions with CCN > ${CCN_THRESHOLD} found.`,
+        `Refactor high-complexity functions to keep below ${CCN_THRESHOLD} complexity.`,
+      ],
+      exitCode: 1,
+      warnings: counts.warnings,
+    };
   }
+  return {
+    status: 'PASS',
+    messages: [`✅ PASSED - All functions within complexity threshold (${CCN_THRESHOLD}).`],
+    exitCode: 0,
+    warnings: 0,
+  };
+}
 
-  messages.push(`✅ PASSED - All functions within complexity threshold (${CCN_THRESHOLD}).`);
-  recordAudit('gate-3', 'complexity', 'PASS', 0, startMs);
-  return { status: 'PASS', messages, exitCode: 0 };
+/**
+ * Count functions whose CCN exceeds the threshold from lizard's --csv output.
+ *
+ * Split out so the parse can be tested against literal lizard output instead of
+ * by driving the tool: a parser bug here is invisible in exactly the same way
+ * (#674) -- it returns "clean" and the gate reports PASS.
+ *
+ * `analysed` distinguishes "lizard found nothing over the threshold" from
+ * "lizard produced nothing at all". Only the first is a pass.
+ */
+export function countCcnWarnings(csv: string): { warnings: number; analysed: boolean } {
+  let warnings = 0;
+  let analysed = false;
+  for (const line of csv.split('\n')) {
+    const columns = line.split(',');
+    if (columns.length < 2) continue;
+    // Location column carries ":name" style text, so only trust numeric CCN.
+    if (!/^\s*\d+\s*$/.test(columns[1])) continue;
+    analysed = true;
+    if (parseInt(columns[1], 10) > CCN_THRESHOLD) warnings++;
+  }
+  return { warnings, analysed };
 }
 
 // ── CLI Entry Point ──

package/gates/gate-8.ts

@@ -2,6 +2,13 @@
  * Gate 8: Secret Scanning (gitleaks)
  * Detects secrets (API keys, passwords, tokens) in staged files.
  * TypeScript rewrite of githooks/adapters/gate-8.sh for cross-platform Node.js CLI.
+ *
+ * Scans the INDEX (`git --staged`), not committed history (#675, mirroring the
+ * adapter fix in #449). gitleaks `git --pre-commit` walks committed revisions; on a
+ * pre-commit run it reports "0 commits scanned" and exits 0. A staged secret
+ * therefore passed the CLI while the hook blocked it -- and the CLI is the path CI
+ * and the plugins use. `--staged` scans `git diff --cached`, exactly the
+ * pre-commit payload. Same tool, same payload, one word different, opposite verdict.
  */
 import path from 'path';
 import fs from 'fs';
@@ -29,20 +36,7 @@ export function runGate8(input: GateInput): GateOutput {
   }
 
   const gitleaksCmd = tool.via === 'npx' ? 'npx' : tool.path;
-  const gitleaksArgs = tool.via === 'npx' ? ['-y', 'gitleaks'] : [];
-
-  // Config detection
-  const configPath = findGitleaksConfig(cwd);
-  if (configPath) {
-    gitleaksArgs.push(`--config=${configPath}`);
-  }
-
-  // Cross-platform temp path (fixes /tmp issue on Windows)
-  const reportPath = path.join(getTempDir(), 'gitleaks-report.json');
-
-  // Run gitleaks on staged changes
-  gitleaksArgs.push('git', '--pre-commit', '--redact', '--no-banner',
-    '--report-format=json', `--report-path=${reportPath}`);
+  const gitleaksArgs = buildGitleaksArgs(tool.via === 'npx', findGitleaksConfig(cwd));
 
   const result = runTool(gitleaksCmd, gitleaksArgs, { cwd });
 
@@ -53,33 +47,52 @@ export function runGate8(input: GateInput): GateOutput {
   }
 
   if (result.exitCode === 1) {
-    // Secrets found
-    messages.push(result.stdout);
-    messages.push('');
-    messages.push('❌ BLOCKED - Secrets detected in staged files.');
-    messages.push('');
-    messages.push('Remediation options:');
-    messages.push('  1. Remove the secret and use environment variables instead');
-    messages.push('  2. Add a false positive to .gitleaks.toml allowlist');
-    messages.push('  3. Use git secret or vault for sensitive data');
-    messages.push('');
-    messages.push('See: https://github.com/gitleaks/gitleaks');
+    messages.push(...secretsFoundMessages(result.stdout));
     recordAudit('gate-8', 'secret-scanning', 'FAIL', 1, startMs);
     return { status: 'FAIL', messages, exitCode: 1 };
   }
 
-  // Runtime error
   messages.push(`     ⚠️  gitleaks exited with code ${result.exitCode} - skipping gate`);
   messages.push('     ✅ Secret Scanning (SKIP, gitleaks error)');
   recordAudit('gate-8', 'secret-scanning', 'SKIP', result.exitCode, startMs);
   return { status: 'SKIP', messages, exitCode: 0 };
 }
 
+/** The report + remediation shown when gitleaks finds secrets (exit code 1). */
+function secretsFoundMessages(stdout: string): string[] {
+  return [
+    stdout,
+    '',
+    '❌ BLOCKED - Secrets detected in staged files.',
+    '',
+    'Remediation options:',
+    '  1. Remove the secret and use environment variables instead',
+    '  2. Add a false positive to .gitleaks.toml allowlist',
+    '  3. Use git secret or vault for sensitive data',
+    '',
+    'See: https://github.com/gitleaks/gitleaks',
+  ];
+}
+
 function findGitleaksConfig(cwd: string): string | null {
   const configPath = path.join(cwd, '.gitleaks.toml');
   return fs.existsSync(configPath) ? configPath : null;
 }
 
+/**
+ * Assemble the gitleaks argument vector.
+ *
+ * Report goes to a cross-platform temp path (the old hardcoded `/tmp` broke on
+ * Windows), and the scan reads the INDEX -- see the file header for why (#675).
+ */
+function buildGitleaksArgs(viaNpx: boolean, configPath: string | null): string[] {
+  const args = viaNpx ? ['-y', 'gitleaks'] : [];
+  if (configPath) args.push(`--config=${configPath}`);
+  args.push('git', '--staged', '--redact', '--no-banner',
+    '--report-format=json', `--report-path=${path.join(getTempDir(), 'gitleaks-report.json')}`);
+  return args;
+}
+
 // ── CLI Entry Point ──
 if (process.argv.includes('--run')) {
   const cwdIdx = process.argv.indexOf('--cwd');

package/gates/gate-9.ts

@@ -1,5 +1,5 @@
 /**
- * Gate 9: Semgrep SAST Security Scan
+ * Gate 10: Semgrep SAST Security Scan (file name predates the #677 renumber)
  * Detects security vulnerabilities in staged files.
  * For PowerShell projects: uses PSScriptAnalyzer security rules as alternative.
  * TypeScript rewrite of githooks/adapters/gate-9.sh for cross-platform Node.js CLI.
@@ -36,7 +36,7 @@ export function runGate9(input: GateInput): GateOutput {
   const messages: string[] = [];
 
   messages.push('');
-  messages.push('→ Gate 9: Semgrep SAST Security Scan...');
+  messages.push('→ Gate 10: Semgrep SAST Security Scan...');
 
   // PowerShell project: use PSScriptAnalyzer security rules
   if (isPowerShellProject(input.projectLang)) {
@@ -49,7 +49,7 @@ export function runGate9(input: GateInput): GateOutput {
     messages.push('     ⚠️  WARN - semgrep not installed — SAST scanning unavailable');
     messages.push('     Install: brew install semgrep (macOS) | pip install semgrep (Linux/Windows)');
     messages.push('     Pre-cache rules: semgrep --config=' + SEMGREP_RULESET);
-    messages.push('     Gate 9: SAST Security (WARN, semgrep not installed)');
+    messages.push('     Gate 10: SAST Security (WARN, semgrep not installed)');
     recordAudit('gate-9', 'sast-security', 'WARN', 0, startMs);
     return { status: 'WARN', messages, exitCode: 0 };
   }
@@ -242,7 +242,7 @@ function runPowerShellSAST(
   const ps = detectPowerShell();
   if (!ps.available) {
     messages.push('     ⚠️  WARN - PowerShell not available — SAST scanning unavailable');
-    messages.push('     Gate 9: SAST Security (WARN, PowerShell not installed)');
+    messages.push('     Gate 10: SAST Security (WARN, PowerShell not installed)');
     recordAudit('gate-9', 'sast-security', 'WARN', 0, startMs);
     return { status: 'WARN', messages, exitCode: 0 };
   }