@boyingliu01/xp-gate 0.35.23 → 0.36.0

package/adapter-common.sh

@@ -38,8 +38,46 @@ run_without_git_context() (
   "$@"
 )
 
+# ---------------------------------------------------------------------------
+# C# / .NET manifests (#717)
+#
+# A .NET tree can declare itself three ways: a project file (*.csproj), a
+# solution (*.sln), or a Directory.Build.props that carries the real settings
+# for a whole directory subtree with no project file of its own. All three are
+# checked, because a repo may carry only the latter two.
+# ---------------------------------------------------------------------------
+
+# Succeeds when the current directory holds a .NET manifest at depth 1.
+has_dotnet_manifest() {
+  [ -f "global.json" ] && return 0
+  [ -f "Directory.Build.props" ] && return 0
+  [ -f "Directory.Build.targets" ] && return 0
+  # `find -maxdepth 1` rather than a glob loop: a repo with thousands of files
+  # in one directory would expand a `*.csproj` glob into an unusable argv.
+  # -not -path "./.*" keeps a stray file under .git/.vscode from declaring the
+  # project language.
+  [ -n "$(find . -maxdepth 1 -type f \( -name '*.csproj' -o -name '*.sln' \) 2>/dev/null | sed -n '1p; 1q')" ]
+}
+
+# Succeeds when a .cs source exists below the current directory.
+has_csharp_sources() {
+  [ -n "$(find . -name "*.cs" -type f -not -path "./.git/*" -not -path "*/node_modules/*" -not -path "*/bin/*" -not -path "*/obj/*" 2>/dev/null | sed -n '1p; 1q')" ]
+}
+
 detect_project_lang() {
-  if [ -f "tsconfig.json" ]; then
+  # #717: the C# arms come FIRST, before tsconfig.json / package.json /
+  # .sh sniffing. Detection below is an exclusive first-match chain, and a .NET
+  # repo routinely carries a JS or shell half (the dsh-aot-runner shape in the
+  # issue is 2031 lines of C# plus ~900 lines of JS). Ordered after the
+  # TypeScript arm, that repo reported "typescript" and every C# file was
+  # invisible to language-routed gates -- the silent skip #717 is about.
+  #
+  # Placing C# first cannot steal an existing project: none of the languages
+  # matched afterwards ever ship a .csproj/.sln/Directory.Build.props, so the
+  # pre-existing arms are reached unchanged whenever those files are absent.
+  if has_dotnet_manifest; then
+    echo "csharp"
+  elif [ -f "tsconfig.json" ]; then
     echo "typescript"
   elif [ -f "pyproject.toml" ] || [ -f "requirements.txt" ] || [ -f "setup.py" ]; then
     echo "python"
@@ -88,6 +126,8 @@ detect_project_lang() {
       else
         echo "dart"
       fi
+    elif [ -n "$(find . -name "*.cs" -type f -not -path "./.git/*" -not -path "*/bin/*" -not -path "*/obj/*" | sed -n '1p; 1q')" ]; then
+      echo "csharp"
     elif [ -n "$(find . -name "*.swift" -type f | sed -n '1p; 1q')" ]; then
       echo "swift"
     elif [ -n "$(find . -name "*.cpp" -o -name "*.cc" -o -name "*.c" -o -name "*.h" -type f | sed -n '1p; 1q')" ]; then
@@ -104,41 +144,42 @@ detect_project_lang() {
   fi
 }
 
-route_to_adapter() {
-  local action="$1"
-  local lang
-  lang=$(detect_project_lang)
-  
-  local adapter_file=""
-
-  # 3-tier resolution matching pre-commit ADAPTER_DIR logic
-  # Tier 1: Global flat layout (~/.config/xp-gate/adapters/lang.sh)
-  if [ -f "$HOME/.config/xp-gate/adapters/${lang}.sh" ]; then
-    adapter_file="$HOME/.config/xp-gate/adapters/${lang}.sh"
-  # Tier 2: Project nested layout (githooks/adapters/lang.sh)
-  elif [ -f "githooks/adapters/${lang}.sh" ]; then
-    adapter_file="githooks/adapters/${lang}.sh"
-  elif [ -f "./githooks/adapters/${lang}.sh" ]; then
-    adapter_file="./githooks/adapters/${lang}.sh"
-  fi
+# ---------------------------------------------------------------------------
+# NOTE (#717): a `detect_project_langs()` collector was added here and then
+# REMOVED before this change landed. It had zero production callers -- only its
+# own tests -- which is exactly the dead-dispatch shape #688 deleted from this
+# same file (see below). The gates do NOT route through it: pre-commit collects
+# languages with its own `_detect_ext_lang` into `PROJECT_LANGS`, and that is
+# what actually decides which adapters run (AC-717-13/13b pin the dual-language
+# case). Keeping a second, unconsumed collector beside it would have meant two
+# language-detection paths drifting apart, with the untested one looking
+# authoritative. If multi-language routing is ever reworked, the change belongs
+# in pre-commit's collector, not in a parallel helper here.
 
-  if [ -n "$adapter_file" ]; then
-    # shellcheck source=./githooks/adapters/lang.sh
-    source "$adapter_file"
-    
-    # Execute the requested action
-    case "$action" in
-      "static_analysis") run_static_analysis ;;
-      "lint") run_lint ;;
-      "tests") run_tests ;;
-      "coverage") run_coverage ;;
-      *) return 1 ;;
-    esac
-  else
-    echo "No adapter found for language: $lang (searched: ~/.config/xp-gate/adapters/, githooks/adapters/)"
-    return 1
-  fi
-}
+# ---------------------------------------------------------------------------
+# REMOVED in #688: route_to_adapter()
+#
+# It was a dispatcher with zero production callers. pre-commit sources an
+# adapter and calls `run_static_analysis` / `run_lint` / `run_tests` /
+# `run_coverage` directly; nothing ever went through this function, so its
+# `case "$action"` enumeration was dead too -- including the "add an
+# `architecture` arm and it'll work" assumption in #688, which would have been
+# a no-op.
+#
+# Its two never-invoked dependants are gone with it: `run_architecture()` in
+# adapters/python.sh and adapters/go.sh. Gate 6 already implements both checks
+# INLINE in pre-commit, and does it better than the adapter versions did:
+#   * Python: detects 4 config carriers (.import-linter.yml /
+#     import_linter_config.yml / .importlinter / pyproject [tool.importlinter]),
+#     where the adapter checked 2, and BLOCKs when lint-imports is missing
+#     instead of `require_tool ... || return 0` silently passing.
+#   * Go: reads the checker's own exit status via PIPESTATUS[0] (#630), where a
+#     `arch-go check | head` pipeline would have reported head's status.
+# Wiring the adapter version back in would therefore have been a regression,
+# so the dead code was deleted instead of connected.
+#
+# tests: githooks/__tests__/issue-688-dead-dispatcher-removed.test.bats
+# ---------------------------------------------------------------------------
 
 check_if_tool_available() {
   local tool_name="$1"
@@ -221,7 +262,8 @@ detect_iac_project() {
   
   # Check for Kubernetes manifests (YAML with apiVersion/kind)
   if [ -n "$(find . -maxdepth 2 \( -name "*.yaml" -o -name "*.yml" \) -not -path "./.git/*" 2>/dev/null | sed -n '1p; 1q')" ]; then
-    local yaml_file=$(find . -maxdepth 2 \( -name "*.yaml" -o -name "*.yml" \) -not -path "./.git/*" 2>/dev/null | sed -n '1p; 1q')
+    local yaml_file
+    yaml_file=$(find . -maxdepth 2 \( -name "*.yaml" -o -name "*.yml" \) -not -path "./.git/*" 2>/dev/null | sed -n '1p; 1q')
     if grep -qE "^(apiVersion|kind):" "$yaml_file" 2>/dev/null; then
       has_iac=true
     fi

package/adapters/csharp.sh

@@ -0,0 +1,245 @@
+#!/usr/bin/env bash
+# C# / .NET adapter (#717)
+#
+# Contract: pre-commit sources this file and calls run_static_analysis /
+# run_lint / run_tests / run_coverage directly (#688 — no dispatcher sits in
+# between). Every function must therefore exist and must return a status the
+# caller can turn into a verdict.
+#
+# Two lessons from the sibling adapters are load-bearing here:
+#
+#   1. #706 (kotlin.sh): a failed BUILD must not swallow an analyzer that works
+#      on its own. `dotnet format` reads .cs sources and needs no successful
+#      build, so it runs regardless of what the build said. The build failure is
+#      recorded and reported, never hidden.
+#
+#   2. #703/#708 (java.sh): "tool not installed" and "tool ran and failed" need
+#      different fixes, so they get different messages. A missing dotnet is a
+#      SKIP with an install hint, not a BLOCK -- the project may not be a .NET
+#      one after all.
+#
+# Windows note (#717): on this machine `dotnet test` aborts before running a
+# single case with `Win32Exception (5) Access is denied` from the VSTest
+# testhost -- an environment fault, reproducible under both git-bash and
+# PowerShell. run_tests() below therefore reports "test host did not start"
+# separately from "tests failed", because a gate that reads the former as the
+# latter would block every commit in a working repo.
+
+# ---------------------------------------------------------------------------
+# Project discovery
+# ---------------------------------------------------------------------------
+
+# Print the directory that owns the build, or nothing.
+#
+# A .sln at the root is the usual shape; a bare .csproj is the single-project
+# shape; Directory.Build.props can declare a tree with neither. All three are
+# accepted because `dotnet` itself accepts all three.
+_detect_dotnet_root() {
+  local found
+  found=$(find . -maxdepth 2 -name "*.sln" -type f -not -path "./.git/*" 2>/dev/null | sed -n '1p; 1q')
+  if [ -n "$found" ]; then
+    dirname "$found"
+    return 0
+  fi
+  found=$(find . -maxdepth 2 -name "*.csproj" -type f -not -path "./.git/*" 2>/dev/null | sed -n '1p; 1q')
+  if [ -n "$found" ]; then
+    dirname "$found"
+    return 0
+  fi
+  if [ -f "Directory.Build.props" ]; then
+    echo "."
+    return 0
+  fi
+  return 1
+}
+
+# Echo the dotnet entry point, or nothing when the SDK is absent.
+#
+# Deliberately does NOT bundle the bare `dotnet` invocation into a single
+# string: the .exe suffix matters on Windows and callers need the tokens.
+_detect_dotnet() {
+  if command -v dotnet >/dev/null 2>&1; then
+    echo "dotnet"
+    return 0
+  fi
+  if command -v dotnet.exe >/dev/null 2>&1; then
+    echo "dotnet.exe"
+    return 0
+  fi
+  return 1
+}
+
+# Print the first staged/changed .cs file, or nothing. Used only for messages.
+_csharp_changed_hint() {
+  printf '%s\n' "${CHANGED_FILES:-}" | grep -E '\.cs$' | sed -n '1p'
+}
+
+# ---------------------------------------------------------------------------
+# Code quality (Gate 1)
+# ---------------------------------------------------------------------------
+
+run_static_analysis() {
+  local dotnet_root dotnet ver build_out build_rc format_out format_rc
+  dotnet_root=$(_detect_dotnet_root) || {
+    echo "No .NET project marker found (.sln / *.csproj / Directory.Build.props)"
+    return 0
+  }
+
+  dotnet=$(_detect_dotnet) || {
+    # SKIP, not BLOCK: no SDK means nothing was measured, and the caller maps a
+    # non-zero return to "tools unavailable" which it reports honestly.
+    echo "dotnet SDK not found"
+    echo "   Install: winget install Microsoft.DotNet.SDK.8 | brew install --cask dotnet-sdk | apt-get install dotnet-sdk-8.0"
+    return 2
+  }
+
+  ver=$("$dotnet" --version 2>/dev/null | sed -n '1p')
+  echo "dotnet SDK ${ver:-unknown} (project: ${dotnet_root})"
+
+  # --- build (recorded, not authoritative) -------------------------------
+  # `--nologo` keeps the banner out; `-warnaserror` is Gate 13's job, not Gate
+  # 1's, so the build here only needs to answer "does this compile".
+  build_out=$("$dotnet" build "$dotnet_root" --nologo -v quiet 2>&1)
+  build_rc=$?
+  if [ "$build_rc" -ne 0 ]; then
+    echo "BUILD FAILED (dotnet build exited $build_rc):"
+    printf '%s\n' "$build_out" | grep -iE "error|fail" | sed -n '1,10p'
+    echo "   Analysis still runs below: dotnet format reads sources directly"
+    echo "   and its verdict does not depend on the build."
+  fi
+
+  # --- analyzer (authoritative) -----------------------------------------
+  # `dotnet format --verify-no-changes` is the closest C# equivalent of
+  # `eslint --max-warnings 0`: formatting + the configured analyzers, exit 0
+  # only when everything is clean.
+  format_out=$("$dotnet" format "$dotnet_root" --verify-no-changes --verbosity quiet 2>&1)
+  format_rc=$?
+
+  # (#717) A command that could not RUN is not a command that found problems.
+  # 127 = not found, 126 = not executable. Without this arm a broken or shadowed
+  # `dotnet` made `dotnet format` exit 127, which the code below turned into
+  # "127 change(s) required or analyzer finding(s)" and returned 1 -- reported to
+  # the user as a code-quality FAILURE of their sources. Measured before the fix:
+  # a stub `dotnet` exiting 127 produced exactly that message.
+  case "$format_rc" in
+    126|127)
+      echo "dotnet format could not execute (exit ${format_rc}) — NOT a source verdict"
+      echo "   The 'dotnet' on PATH is missing or not executable."
+      return 2
+      ;;
+  esac
+
+  if [ "$format_rc" -eq 0 ]; then
+    echo "FORMAT OK - dotnet format reports no changes required"
+  else
+    printf '%s\n' "$format_out" | sed -n '1,20p'
+    echo "dotnet format: ${format_rc} change(s) required or analyzer finding(s)"
+  fi
+
+  # A real finding wins over a build failure: the build failure is already
+  # printed above, and returning 1 here makes the caller report the stronger
+  # statement. Returning the build's status when analysis is clean would hide
+  # which of the two actually happened.
+  if [ "$format_rc" -ne 0 ]; then
+    return 1
+  fi
+  # Same reasoning for the build: 126/127 means the build never ran, so there is
+  # no "compiles / does not compile" answer to report.
+  case "$build_rc" in
+    126|127) echo "dotnet build could not execute (exit ${build_rc}) — NOT a build verdict"; return 2 ;;
+  esac
+  return "$build_rc"
+}
+
+run_lint() {
+  run_static_analysis
+}
+
+# ---------------------------------------------------------------------------
+# Tests (Gate 5)
+# ---------------------------------------------------------------------------
+
+# Succeeds when any project in the tree declares a test dependency.
+#
+# Without this probe `dotnet test` on a solution with no test project exits 0
+# and prints nothing, which reads as "all tests passed" for a project that has
+# no tests at all -- the same silent-success shape #717 is about.
+_has_test_project() {
+  local root="${1:-.}"
+  find "$root" -maxdepth 3 -name "*.csproj" -type f -not -path "./.git/*" 2>/dev/null | while IFS= read -r proj; do
+    if grep -qiE 'Microsoft\.NET\.Test\.Sdk|Microsoft\.TestPlatform<xunit|NUnit|MSTest\.TestFramework' "$proj" 2>/dev/null; then
+      printf '%s\n' "$proj"
+      break
+    fi
+  done | sed -n '1p'
+}
+
+run_tests() {
+  local dotnet_root dotnet out rc
+  dotnet_root=$(_detect_dotnet_root) || { echo "No .NET project marker found"; return 0; }
+  dotnet=$(_detect_dotnet) || { echo "dotnet SDK not found"; return 2; }
+
+  local test_proj
+  test_proj=$(_has_test_project "$dotnet_root")
+  if [ -z "$test_proj" ]; then
+    echo "No test project found in ${dotnet_root}"
+    echo "   A .csproj must reference Microsoft.NET.Test.Sdk / xunit / NUnit / MSTest to run under dotnet test"
+    return 2
+  fi
+  echo "Test project: ${test_proj}"
+
+  out=$("$dotnet" test "$test_proj" --nologo 2>&1)
+  rc=$?
+  printf '%s\n' "$out" | sed -n '1,25p'
+
+  if [ "$rc" -ne 0 ] && printf '%s\n' "$out" | grep -qiE 'Win32Exception|Access is denied|拒绝访问|test host 进程已退出|Testhost.*exited'; then
+    # The testhost never started, so nothing was verified. Reporting this as a
+    # test FAILURE would block every commit in a repo whose tests are fine;
+    # reporting it as PASS would be a lie. 2 is the "could not execute" channel
+    # the adapters already use (java.sh's G1 contract).
+    echo "dotnet test could not start the test host (environment fault, not a test verdict)"
+    echo "   Known on this host: VSTest testhost aborts with Win32Exception (5) even when invoked outside git-bash"
+    return 2
+  fi
+  return "$rc"
+}
+
+# ---------------------------------------------------------------------------
+# Coverage (Gate 5)
+# ---------------------------------------------------------------------------
+#
+# Silently returning 0 here would let Gate 5 read "no coverage file" as "no
+# coverage requirement". The output just tells the caller which artifact the
+# gate is looking for; the threshold verdict stays with the caller.
+run_coverage() {
+  local dotnet_root dotnet
+  dotnet_root=$(_detect_dotnet_root) || { echo "No .NET project marker found"; return 0; }
+  dotnet=$(_detect_dotnet) || { echo "dotnet SDK not found"; return 2; }
+
+  local test_proj
+  test_proj=$(_has_test_project "$dotnet_root")
+  if [ -z "$test_proj" ]; then
+    echo "No test project found in ${dotnet_root} — coverage not measurable"
+    return 2
+  fi
+
+  echo "Collecting coverage: dotnet test --collect:\"XPlat Code Coverage\""
+  local out rc
+  out=$("$dotnet" test "$test_proj" --nologo --collect:"XPlat Code Coverage" 2>&1)
+  rc=$?
+  printf '%s\n' "$out" | sed -n '1,15p'
+
+  local report
+  report=$(find "$dotnet_root" -name "coverage.cobertura.xml" -type f -newermt "-10 minutes" 2>/dev/null | sed -n '1p; 1q')
+  if [ -z "$report" ]; then
+    report=$(find "$dotnet_root" -name "coverage.cobertura.xml" -type f 2>/dev/null | sed -n '1p; 1q')
+  fi
+
+  if [ -z "$report" ]; then
+    echo "coverage.cobertura.xml not produced — coverage NOT measured"
+    echo "   Requires coverlet.collector in the test project"
+    return 2
+  fi
+  echo "Coverage report: ${report}"
+  return "$rc"
+}

package/adapters/gate-3.sh

@@ -363,7 +363,7 @@ else
     LIZARD_PATH=$(eval echo "$LIZARD_CMD")
     
     # Get changed source files for complexity check (includes test files)
-    CC_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt)$' || true)
+    CC_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt|cs)$' || true)
 
     # Grade exactly the population the baseline was written from. The two must
     # match or the ratchet reports pre-existing code as "new", which is a false

package/adapters/gate-4.sh

@@ -76,7 +76,7 @@ if [ "$PROJECT_LANG" = "documentation-only" ]; then
   
 else
   # Get source files to check against principles
-  PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm)$' || true)
+  PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm|cs)$' || true)
 
   # One path per line, into an array. Passing $PRINCIPLES_FILES unquoted relies on
   # word splitting to turn the list into separate argv entries, which also splits

package/adapters/gate-9.sh

@@ -1,3 +1,22 @@
+#!/usr/bin/env bash
+# ============================================================================
+# ⚠️  DEAD CODE — NOT EXECUTED. Read this before changing anything here.       
+# ============================================================================
+# This file is NOT sourced by githooks/pre-commit or githooks/pre-push (both
+# source count = 0; verify with: grep -c "gate-9.sh" githooks/pre-commit).
+# It is shipped by githooks/install.sh but never runs.
+#
+# The gate that actually runs semgrep SAST is githooks/gate-10.sh, and it
+# reports as `gate10_sast`. Gate 9 in the report is `gate9_build_integrity`
+# (Build Integrity), a different gate entirely.
+#
+# This mislabelling is not cosmetic: in #717 a C# SAST fix was first written
+# into THIS file, where it changed nothing, while .cs stayed ungoverned. The
+# C# ruleset loading that works lives in gate-10.sh. Do not relocate it here.
+#
+# Kept rather than deleted because githooks/install.sh:GATE_SCRIPTS ships it;
+# removing it is a separate change. See issue #717 walkthrough MC-03.
+# ============================================================================
 # ============================================================================
 # GATE 9: Semgrep SAST Security Scan
 # Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
@@ -112,8 +131,22 @@ EOF
     # code is demoted to "did the tool itself run". --error stays OFF: it would
     # add nothing the JSON does not already provide, and keeping it off leaves
     # failure exit codes unambiguous for the #475 diagnostics path.
+    # #717: p/security-audit carries NO C# rules. Measured: a .cs file with a
+    # textbook SQL injection (string-concatenated SqlCommand) and a
+    # Process.Start command injection produced 0 findings under
+    # p/security-audit and 1 ERROR under p/csharp. Since gate-9.sh:45 lists
+    # `cs` in the file filter, .cs was accepted and then scanned by a ruleset
+    # that cannot see C# -- the identical "filter looks like coverage" defect
+    # this issue removed from Gate 4. p/csharp is loaded IN ADDITION to
+    # p/security-audit (not instead of: the security-audit rules still apply
+    # to the other languages in a mixed commit).
+    SEMGREP_RULES=(--config=p/security-audit)
+    if printf "%s
+" "$SEMGREP_FILES" | grep -qE ".cs$"; then
+      SEMGREP_RULES+=(--config=p/csharp)
+    fi
     SEMGREP_STDOUT_FILE=$(mktemp)
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan "${SEMGREP_RULES[@]}" --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
     SEMGREP_EXIT=$?
 
     # One node pass over the JSON: first line = verdict counts, remaining lines =
@@ -191,7 +224,9 @@ console.log("");});
       echo "  ❌ BLOCKED — blocking-severity vulnerability found"
       echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
       echo "$FINDING_DETAILS"
-      echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+      # #717: name BOTH rulesets. A C# finding comes from p/csharp, so
+      # pointing the author at p/security-audit alone reproduces zero hits.
+      echo "  Run 'semgrep scan --config=p/security-audit --config=p/csharp' to review all findings."
       GATE_9_STATUS="FAIL"
       exit 1
     else

package/adapters/go.sh

@@ -43,17 +43,12 @@ run_lint() {
   return $?
 }
 
-run_architecture() {
-  if ! require_tool arch-go "arch-go (Go architecture checker)" 2>/dev/null; then
-    echo "⚠ arch-go not available, installing..."
-    go install github.com/arch-go/arch-go@latest 2>/dev/null
-    require_tool arch-go "arch-go" || return 0
-  fi
-
-  echo "Running Go architecture checks (arch-go)..."
-  arch-go check
-  return $?
-}
+# REMOVED in #688: run_architecture()
+# Never invoked -- its only would-be caller, route_to_adapter(), had no callers
+# either. Gate 6 implements arch-go in pre-commit (grep "arch-go"), and reads
+# the checker's own exit status via PIPESTATUS[0] (#630) instead of letting a
+# `| head` pipeline report head's. See githooks/adapter-common.sh for the full
+# rationale.
 
 run_tests() {
   require_tool go "Go SDK" || return 1

package/adapters/iac.sh

@@ -78,7 +78,47 @@ run_static_analysis() {
   local exit_code=0
   
   # Try checkov first (recommended - supports multiple platforms)
-  if command -v checkov >/dev/null 2>&1; then
+  # Resolve to an executable that actually RUNS, not merely one that exists. On
+  # MSYS2/Git Bash pip leaves an extensionless `checkov` shim whose shebang
+  # hands a MSYS path to the Windows interpreter, which fails every time:
+  #   can't open file 'D:\\c\\Users\\...\\Scripts\\checkov'
+  # `command -v checkov` still succeeds, so a presence-only probe picks the
+  # broken shim and the gate reports "the scanner crashed" on IaC commits that
+  # are perfectly fine. Probing the version is the only way to tell the two
+  # apart; checkov.cmd is the form that works here.
+  #
+  # A timeout wraps the probe because the failure mode being screened for is a
+  # shim that does not answer. Observed breakage exits 2 at once, but a hung
+  # wrapper must not block the commit forever. `timeout` is absent on stock
+  # macOS, so it is used only when available; the probe is a local version
+  # print either way.
+  local checkov_bin=""
+  local _checkov_candidate
+  local _checkov_seen_nonexec=0
+  local _checkov_probe
+  for _checkov_candidate in checkov checkov.exe checkov.cmd; do
+    command -v "$_checkov_candidate" >/dev/null 2>&1 || continue
+    if command -v timeout >/dev/null 2>&1; then
+      _checkov_probe="timeout 20 $_checkov_candidate --version"
+    else
+      _checkov_probe="$_checkov_candidate --version"
+    fi
+    if $_checkov_probe >/dev/null 2>&1; then
+      checkov_bin=$(command -v "$_checkov_candidate")
+      break
+    fi
+    _checkov_seen_nonexec=1
+  done
+  # "Not installed" and "installed but unusable" both end up without a scanner,
+  # and the fallbacks below keep the gate useful -- but they are not the same
+  # situation, and silently treating a broken install as absent hides a lost
+  # scanner. Say which one it is.
+  if [ -z "$checkov_bin" ] && [ "$_checkov_seen_nonexec" -eq 1 ]; then
+    echo "     ⚠️  checkov is on PATH but none of its forms could be executed;"
+    echo "         treating it as unusable and falling back to other scanners."
+    echo "         Reinstall with: pip install -U checkov"
+  fi
+  if [ -n "$checkov_bin" ]; then
     echo "Running checkov IaC security scan..."
 
     # checkov 3.x exits 0 on "found failures" (we parse the output for those),
@@ -114,7 +154,7 @@ run_static_analysis() {
       echo "Scanning Terraform files..."
       for file in $tf_files; do
         if [ -f "$file" ]; then
-          checkov --file "$file" $checkov_args >> "$checkov_log" 2>&1
+          "$checkov_bin" --file "$file" $checkov_args >> "$checkov_log" 2>&1
           record_checkov_run $? "$file"
         fi
       done
@@ -135,7 +175,7 @@ run_static_analysis() {
         echo "Scanning Kubernetes manifests..."
         for file in $k8s_only; do
           if [ -f "$file" ]; then
-            checkov --file "$file" $checkov_args --framework kubernetes >> "$checkov_log" 2>&1
+            "$checkov_bin" --file "$file" $checkov_args --framework kubernetes >> "$checkov_log" 2>&1
           record_checkov_run $? "$file"
           fi
         done
@@ -145,7 +185,7 @@ run_static_analysis() {
         echo "Scanning GitHub Actions workflows..."
         for file in $gh_files; do
           if [ -f "$file" ]; then
-            checkov --file "$file" $checkov_args --framework github_actions >> "$checkov_log" 2>&1
+            "$checkov_bin" --file "$file" $checkov_args --framework github_actions >> "$checkov_log" 2>&1
             record_checkov_run $? "$file"
           fi
         done
@@ -156,7 +196,7 @@ run_static_analysis() {
       echo "Scanning Dockerfiles..."
       for file in $docker_files; do
         if [ -f "$file" ]; then
-          checkov --file "$file" $checkov_args >> "$checkov_log" 2>&1
+          "$checkov_bin" --file "$file" $checkov_args >> "$checkov_log" 2>&1
           record_checkov_run $? "$file"
         fi
       done

package/adapters/python.sh

@@ -180,17 +180,12 @@ run_lint() {
   fi
 }
 
-run_architecture() {
-  if [ ! -f ".import-linter.yml" ] && [ ! -f "import_linter_config.yml" ]; then
-    return 0
-  fi
-
-  require_tool lint-imports "import-linter" || return 0
-
-  echo "Running Python architecture checks (import-linter)..."
-  lint-imports
-  return $?
-}
+# REMOVED in #688: run_architecture()
+# Never invoked -- its only would-be caller, route_to_adapter(), had no callers
+# either. Gate 6 implements import-linter in pre-commit (grep "import-linter"),
+# and more thoroughly: it detects 4 config carriers instead of the 2 checked
+# here, and BLOCKs on a missing lint-imports rather than `|| return 0` passing.
+# See githooks/adapter-common.sh for the full rationale.
 
 run_tests() {
   require_tool pytest "pytest" || return 1

package/bin/xp-gate.js

@@ -228,18 +228,25 @@ const COMMANDS = {
   'update-skill': {
     description: 'Update installed skill(s)',
     run: subargs => {
-      // Detect --all flag BEFORE extracting name (fix #347)
-      const allFlagIndex = subargs.indexOf('--all');
-      let name, options;
-      if (allFlagIndex !== -1) {
-        // Remove --all from args before parsing, name is undefined
-        options = parseOptions([...subargs.slice(0, allFlagIndex), ...subargs.slice(allFlagIndex + 1)], 'update-skill');
-        options.all = true;
-        name = undefined;  // explicit: no single name when --all is used
-      } else {
-        name = subargs[0];
-        options = parseOptions(subargs.slice(1), 'update-skill');
+      // Extract the valueless flags BEFORE taking subargs[0] as the name.
+      //
+      // #347 fixed this for --all only, so `xp-gate update-skill --check` still
+      // took `--check` as a skill name and failed with "--check is not
+      // installed" (#725). Splitting the flags out once keeps the two cases from
+      // drifting apart again.
+      // Read the flag list from SKILL_FLAGS_BY_COMMAND so a flag added there is
+      // never mistaken for a skill name here -- that drift is what broke #347 and
+      // then #725 in the same place.
+      const flags = SKILL_FLAGS_BY_COMMAND['update-skill'] || [];
+      const present = flags.filter((f) => subargs.includes(f));
+      const rest = subargs.filter((s) => !flags.includes(s));
+
+      const options = parseOptions(rest.slice(1), 'update-skill');
+      for (const flag of present) {
+        options[flag.replace(/^--/, '')] = true;
       }
+      // An explicit name wins for the single-skill path; --all/--check ignore it.
+      const name = present.length > 0 ? undefined : rest[0];
       updateSkill(name, options).then(code => process.exit(code));
     },
     usage: 'xp-gate update-skill [<name>] [--all] [--check]'