@cxi-lmai/ci-agent-platform 3.0.0 → 3.1.0

package/payload/ci-templates/scripts/codebase-audit.sh

@@ -0,0 +1,252 @@
+#!/bin/bash
+# Runner for the opt-in `codebase-audit` job (periodic convention-drift scan).
+# Fetches merged MRs/PRs since the last audit, runs the `/codebase-audit` skill
+# in `audit` mode (delegates to the codebase-auditor agent), files the findings
+# as an issue, and — when a push-capable identity is configured and the report
+# suggests documentation updates — runs the skill again in `apply-docs` mode
+# (delegates to the coder agent), then pushes the branch and opens the MR/PR.
+# All reasoning is in the skill; this script does token, API and git work.
+#
+# Generalized from a single-project original: the last-audited-MR lookup, the
+# MR/PR summary, and the doc-suggestion extraction moved into the skill/runner
+# split, platform calls go through lib/platform.sh and lib/issue-loop.sh, and
+# the codebase-auditor/coder agents run via pipe_run_agent.
+set -e
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=lib/pipeline-common.sh
+source "$SCRIPT_DIR/lib/pipeline-common.sh"
+# shellcheck source=lib/issue-loop.sh
+source "$SCRIPT_DIR/lib/issue-loop.sh"
+pipe_defaults
+
+CONTEXT_FILE="$PIPE_CONTEXT_DIR/audit-context.md"
+REPORT_FILE="$PIPE_CONTEXT_DIR/audit-report.md"
+SUGGESTIONS_FILE="$PIPE_CONTEXT_DIR/audit-doc-suggestions.md"
+AUDIT_ENV="$PIPE_CONTEXT_DIR/audit.env"
+
+# --- 1. Last-audited MR/PR IID, parsed from the most recent audit issue -----
+# The most recent codebase-audit-labeled issue regardless of state: a closed
+# one still marks how far the previous audit got. A genuine fetch failure
+# must not be mistaken for "no prior audit issue" (which legitimately yields
+# an empty array and keeps LAST_AUDITED_IID at 0): capture the helper's own
+# exit status explicitly instead of piping it straight into jq.
+LAST_AUDITED_IID=0
+LAST_AUDIT_ISSUES=$(issues_by_label_created "$PIPE_LABEL_AUDIT" all 1) || {
+  pipe_log "ERROR: failed to fetch the most recent $PIPE_LABEL_AUDIT-labeled issue"
+  exit 1
+}
+LAST_AUDIT_DESC=$(jq -r '.[0].description // ""' <<< "$LAST_AUDIT_ISSUES" 2>/dev/null || echo "")
+if [ -n "$LAST_AUDIT_DESC" ]; then
+  PARSED_IID=$(printf '%s' "$LAST_AUDIT_DESC" | grep -oE 'audited-up-to-mr-iid: [0-9]+' | grep -oE '[0-9]+$' || echo "")
+  [ -n "$PARSED_IID" ] && LAST_AUDITED_IID="$PARSED_IID"
+fi
+pipe_log "Last audited MR/PR IID: $LAST_AUDITED_IID"
+
+# --- 2. Merged MRs/PRs since then, with a changed-file summary --------------
+MRS=$(platform_merged_mrs "$PIPE_TARGET_BRANCH" "$LAST_AUDITED_IID" 50) || {
+  pipe_log "ERROR: failed to fetch merged MRs/PRs"
+  exit 1
+}
+MR_COUNT=$(echo "$MRS" | jq 'length' 2>/dev/null || echo "")
+if ! [[ "$MR_COUNT" =~ ^[0-9]+$ ]]; then
+  pipe_log "ERROR: unexpected API response while counting merged MRs/PRs"
+  exit 1
+fi
+pipe_log "Analyzing $MR_COUNT recently merged MR/PR(s) (since IID $LAST_AUDITED_IID)"
+[ "$MR_COUNT" = "0" ] && { pipe_log "No new MRs/PRs since last audit — skipping"; exit 0; }
+MAX_AUDITED_IID=$(echo "$MRS" | jq '[.[].iid] | max // 0' 2>/dev/null || echo "")
+if ! [[ "$MAX_AUDITED_IID" =~ ^[0-9]+$ ]]; then
+  pipe_log "ERROR: could not determine the max merged MR/PR IID from the API response"
+  exit 1
+fi
+
+MR_SUMMARY=""
+while IFS= read -r IID; do
+  TITLE=$(echo "$MRS" | jq -r --argjson i "$IID" '.[] | select(.iid == $i) | .title')
+  # A single MR's changed-file fetch failing is an acceptable degradation (an
+  # empty file list in its summary line), not grounds to abort the whole audit.
+  FILES=$(platform_mr_changes "$IID" 10 | paste -sd, -) || true
+  MR_SUMMARY="${MR_SUMMARY}MR/PR !${IID} ${TITLE} -- Files ${FILES}; "
+done < <(echo "$MRS" | jq -r '.[].iid')
+
+# --- 3. Open audit issues, as dedup context for the auditor ------------------
+OPEN_AUDIT_CONTEXT=""
+# Dedup context only tells the auditor which findings are already filed; a
+# transient fetch failure here must not abort the whole scheduled audit
+# (unlike step 1's watermark read, which is load-bearing). Degrade to an
+# empty result and continue, analogous to a single MR's changes-fetch
+# degradation in step 2.
+OPEN_AUDITS=$(issues_by_label_created "$PIPE_LABEL_AUDIT" opened 5) || {
+  pipe_log "WARNING: failed to fetch open $PIPE_LABEL_AUDIT-labeled issues for dedup context — continuing without it"
+  OPEN_AUDITS="[]"
+}
+OPEN_COUNT=$(echo "$OPEN_AUDITS" | jq 'length' 2>/dev/null || echo 0)
+if [ "$OPEN_COUNT" != "0" ] && [ "$OPEN_COUNT" != "null" ]; then
+  OPEN_AUDIT_CONTEXT=$(echo "$OPEN_AUDITS" | jq -r '.[] | "Issue #\(.iid) (\(.created_at[0:10])): \(.title)\n\(.description[0:800])\n---"' 2>/dev/null | head -c 8000 || echo "")
+fi
+
+# --- 4. Run the /codebase-audit skill in audit mode --------------------------
+# Write the context file the skill and the codebase-auditor agent read.
+# Unbounded text stays out of argv/env; this content is already bounded above.
+rm -f "$AUDIT_ENV" "$REPORT_FILE" "$SUGGESTIONS_FILE"
+{
+  echo "# Codebase audit context"
+  echo
+  echo "Mode: audit"
+  echo
+  echo "## Recently merged MRs/PRs"
+  echo
+  printf '%s\n' "$MR_SUMMARY"
+  if [ -n "$OPEN_AUDIT_CONTEXT" ]; then
+    echo
+    echo "## Already-open ${PIPE_LABEL_AUDIT}-labeled issues (skip findings already covered here)"
+    echo
+    printf '%s\n' "$OPEN_AUDIT_CONTEXT"
+  fi
+} > "$CONTEXT_FILE"
+
+pipe_run_agent codebase-audit "/codebase-audit" "Agent,Read,Write,Edit,Glob,Grep,Bash" "$PIPE_MODEL_TRIAGE" < /dev/null
+
+AUDIT_STATUS=$(pipe_get_env "$AUDIT_ENV" AUDIT_STATUS)
+AUDIT_FINDINGS_TOTAL=$(pipe_get_env "$AUDIT_ENV" AUDIT_FINDINGS_TOTAL); AUDIT_FINDINGS_TOTAL=${AUDIT_FINDINGS_TOTAL:-0}
+# pipe_get_env does no shell expansion: a marker that copies the sample line
+# literally (e.g. `AUDIT_REPORT_PATH=$PIPE_CONTEXT_DIR/audit-report.md`
+# unexpanded) or otherwise points at a path that doesn't exist must not
+# discard a perfectly good report at the runner's own default path (review
+# round 2 finding).
+AUDIT_REPORT_PATH=$(pipe_get_env "$AUDIT_ENV" AUDIT_REPORT_PATH)
+if [ ! -s "$AUDIT_REPORT_PATH" ] && [ -s "$REPORT_FILE" ]; then
+  AUDIT_REPORT_PATH="$REPORT_FILE"
+fi
+AUDIT_REPORT_PATH=${AUDIT_REPORT_PATH:-$REPORT_FILE}
+
+# --- 5. Empty output, or a missing/empty report file: log-only notice -------
+# (no issue exists yet to post to). A model-authored marker claiming ok/
+# no_findings with no actual report on disk is a reachable contract failure,
+# not just a literal no_output status; guard the file the same way
+# docs-sync.sh guards its own agent output before touching it.
+if [ -z "$AUDIT_STATUS" ] || [ "$AUDIT_STATUS" = "no_output" ] || [ ! -s "$AUDIT_REPORT_PATH" ]; then
+  pipe_failure_log_notice_files "the periodic codebase audit" \
+    "audit recent MRs/PRs by hand for convention violations, or re-run this job after topping up" \
+    "$PIPE_AGENT_STDERR" "$AUDIT_REPORT_PATH" | while IFS= read -r line; do pipe_log "$line"; done
+  exit 0
+fi
+
+# --- 6. No findings above threshold: nothing to file --------------------------
+if [ "$AUDIT_STATUS" = "no_findings" ]; then
+  pipe_log "No findings above threshold in either section — skipping issue creation"
+  exit 0
+fi
+
+# --- 7. File the findings as an issue -----------------------------------------
+issue_ensure_label "$PIPE_LABEL_AUDIT" "#6F42C1" "Periodic convention-drift audit findings"
+ISSUE_BODY_FILE="$PIPE_CONTEXT_DIR/audit-issue-body.md"
+{
+  printf '<!-- audited-up-to-mr-iid: %s -->\n' "$MAX_AUDITED_IID"
+  head -c 20000 "$AUDIT_REPORT_PATH"
+} > "$ISSUE_BODY_FILE"
+ISSUE_IID=$(issue_create_file "Codebase Audit — $(date +%Y-%m-%d)" "$ISSUE_BODY_FILE" "$PIPE_LABEL_AUDIT")
+if [ -z "$ISSUE_IID" ]; then
+  pipe_log "ERROR: failed to create the audit findings issue"
+  exit 0
+fi
+pipe_log "Filed audit findings as #$ISSUE_IID"
+# The runner is the one that knows the IID: append it now so the marker
+# artifact is complete when the job finishes (see the skill's own contract).
+printf 'AUDIT_ISSUE_IID=%s\n' "$ISSUE_IID" >> "$AUDIT_ENV"
+
+pipe_metric_event codebase-audit audit_filed \
+  "$(jq -n --argjson i "$ISSUE_IID" --argjson f "$AUDIT_FINDINGS_TOTAL" '{issue_iid: $i, findings_total: $f}')"
+
+# --- 8. No push-capable identity: audit-only run, stop here -----------------
+PUSH_TOKEN=""
+case "$PIPE_PLATFORM" in
+  gitlab) PUSH_TOKEN="${PIPE_TOKEN:-}" ;;
+  github) PUSH_TOKEN="${GH_TOKEN:-${GITHUB_TOKEN:-}}" ;;
+esac
+if [ -z "$PUSH_TOKEN" ]; then
+  pipe_log "No push-capable identity configured — skipping auto-fix phase"
+  exit 0
+fi
+
+# --- 9. No doc-update suggestions: nothing for the coder to apply -----------
+if [ ! -s "$SUGGESTIONS_FILE" ]; then
+  pipe_log "No documentation update suggestions — skipping auto-fix phase"
+  exit 0
+fi
+pipe_log "Doc suggestions found — spawning the coder agent"
+
+# --- 10. Branch, then run the skill again in apply-docs mode -----------------
+pipe_git_identity
+git fetch origin "$PIPE_TARGET_BRANCH"
+BRANCH="audit-$(date +%Y-%m-%d)"
+# A same-day retry (transient failure, manual re-trigger) can find this
+# branch already on the remote from an earlier attempt. Fetch it so the
+# --force-with-lease push below has a known expected state instead of
+# refusing for lack of a remote-tracking ref.
+git fetch origin "$BRANCH" 2>/dev/null || true
+git checkout -B "$BRANCH" "origin/$PIPE_TARGET_BRANCH"
+
+APPLY_ENV="$PIPE_CONTEXT_DIR/audit-apply.env"
+rm -f "$APPLY_ENV"
+{
+  echo "# Codebase audit apply-docs context"
+  echo
+  echo "Mode: apply-docs"
+  echo
+  echo "Issue: #$ISSUE_IID"
+  echo "Documentation roots: $PIPE_DOCS_ROOTS"
+  echo "Commit subject: $PIPE_COMMIT_AUDIT"
+  echo "Doc suggestions file: $SUGGESTIONS_FILE"
+  echo "Full audit report: $AUDIT_REPORT_PATH"
+} > "$CONTEXT_FILE"
+
+pipe_run_agent codebase-audit-apply "/codebase-audit" "Agent,Read,Write,Edit,Glob,Grep,Bash" "$PIPE_MODEL_CODE" < /dev/null
+
+# --- 11. Authoritative commit count (the runner owns the push decision) ------
+AHEAD=$(git rev-list "origin/$PIPE_TARGET_BRANCH..HEAD" --count 2>/dev/null || echo 0)
+if [ "${AHEAD:-0}" = "0" ]; then
+  pipe_log "Coder made no commits — skipping MR/PR"
+  # "No commits" reads as "nothing needed fixing", but a credit outage produces
+  # the same silence. Issue #$ISSUE_IID already holds the findings, so on a
+  # credit outage tell its readers the apply step never ran rather than
+  # leaving them to assume it found nothing.
+  pipe_failure_log_notice_files "the audit apply step" \
+    "apply the findings in this issue by hand" \
+    "$PIPE_AGENT_STDERR" "$APPLY_ENV" | while IFS= read -r line; do pipe_log "$line"; done
+  if pipe_is_credit_exhaustion_files "$PIPE_AGENT_STDERR" "$APPLY_ENV"; then
+    NOTICE_FILE="$PIPE_CONTEXT_DIR/audit-apply-credit-notice.md"
+    pipe_failure_notice_files "application of these audit findings" \
+      "apply the findings above by hand, or re-run the audit job after topping up" \
+      "$PIPE_AGENT_STDERR" "$APPLY_ENV" > "$NOTICE_FILE"
+    issue_comment_file "$ISSUE_IID" "$NOTICE_FILE"
+    pipe_log "Posted credit-exhaustion notice to issue #$ISSUE_IID"
+  fi
+  git checkout "$PIPE_TARGET_BRANCH" 2>/dev/null || true
+  git branch -D "$BRANCH" 2>/dev/null || true
+  exit 0
+fi
+
+pipe_metric_event codebase-audit audit_apply_committed \
+  "$(jq -n --argjson i "$ISSUE_IID" --argjson c "$AHEAD" '{issue_iid: $i, commits: $c}')"
+
+# --- 12. Push and open the MR/PR ---------------------------------------------
+# --force-with-lease: this is a dedicated bot branch reset fresh from the
+# target branch every run, so a same-day retry intentionally replaces
+# whatever an earlier attempt left on the remote. --force-with-lease (rather
+# than a bare --force) still refuses if the branch changed unexpectedly
+# between the fetch above and now.
+git push --force-with-lease -u origin "$BRANCH"
+
+MR_DESC_FILE="$PIPE_CONTEXT_DIR/audit-mr-description.md"
+{
+  printf 'Automated documentation updates from the periodic convention audit.\n\nCloses #%s\n\n---\n\n' "$ISSUE_IID"
+  head -c 10000 "$AUDIT_REPORT_PATH"
+} > "$MR_DESC_FILE"
+
+MR_URL=$(mr_create_file "$BRANCH" "$PIPE_TARGET_BRANCH" "docs: codebase audit updates ($(date +%Y-%m-%d))" "$MR_DESC_FILE" "$PIPE_LABEL_AUDIT")
+if [ -n "$MR_URL" ]; then
+  pipe_log "Opened MR/PR: $MR_URL"
+else
+  pipe_log "WARNING: MR/PR creation returned no URL (it may already exist for this branch)"
+fi

package/payload/ci-templates/scripts/coverage-ratchet.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Opt-in coverage gate. Reads the configured coverage report, compares it with
+# the target branch's latest successful pipeline, and sends coverage drops on
+# wip merge requests into the existing test-fix loop.
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=lib/pipeline-common.sh
+source "$SCRIPT_DIR/lib/pipeline-common.sh"
+pipe_defaults
+
+coverage_from_jacoco() {
+  local covered missed
+  if ! covered=$(xmllint --xpath 'string(//report/counter[@type="INSTRUCTION"]/@covered)' \
+    "$PIPE_COVERAGE_REPORT" 2>/dev/null) ||
+    ! missed=$(xmllint --xpath 'string(//report/counter[@type="INSTRUCTION"]/@missed)' \
+    "$PIPE_COVERAGE_REPORT" 2>/dev/null); then
+    echo "ERROR: unable to parse JaCoCo instruction coverage from: $PIPE_COVERAGE_REPORT" >&2
+    return 1
+  fi
+
+  if [[ "$covered" =~ ^[0-9]+$ ]] && [[ "$missed" =~ ^[0-9]+$ ]] && \
+    [ "$((covered + missed))" -gt 0 ]; then
+    printf '%s\n' "$((covered * 100 / (covered + missed)))"
+  else
+    echo "ERROR: unable to parse JaCoCo instruction coverage from: $PIPE_COVERAGE_REPORT" >&2
+    return 1
+  fi
+}
+
+case "$PIPE_COVERAGE_REPORT_KIND" in
+  jacoco) ;;
+  *) echo "ERROR: unsupported coverage report kind: $PIPE_COVERAGE_REPORT_KIND" >&2; exit 1 ;;
+esac
+
+[ -z "${PIPE_MR_IID:-}" ] && exit 0
+
+if [ -z "$PIPE_COVERAGE_REPORT" ] || [ ! -f "$PIPE_COVERAGE_REPORT" ]; then
+  echo "Coverage ratchet inactive: coverage report is not available: ${PIPE_COVERAGE_REPORT:-<unset>}"
+  exit 0
+fi
+
+command -v xmllint >/dev/null 2>&1 || {
+  echo "ERROR: xmllint is required to parse PIPE_COVERAGE_REPORT" >&2
+  exit 1
+}
+
+CURRENT_COV=$(coverage_from_jacoco)
+
+if [ "$PIPE_COVERAGE_RATCHET" = "1" ] && [ -z "$PIPE_COVERAGE_SIGNAL" ]; then
+  echo "ERROR: PIPE_COVERAGE_SIGNAL must be set when PIPE_COVERAGE_RATCHET=1" >&2
+  exit 1
+fi
+
+BASELINE=$(platform_latest_success_coverage "$PIPE_TARGET_BRANCH" 2>/dev/null || true)
+BASELINE=${BASELINE%%.*}
+[[ "$BASELINE" =~ ^[0-9]+$ ]] || BASELINE=0
+
+echo "Total coverage: ${CURRENT_COV}%"
+echo "Coverage: current=${CURRENT_COV}% baseline=${BASELINE}%"
+
+if [ "$CURRENT_COV" -lt "$BASELINE" ]; then
+  echo "WARNING: Coverage dropped from ${BASELINE}% to ${CURRENT_COV}%"
+  COMMENT_FILE="$PIPE_CONTEXT_DIR/coverage-ratchet.md"
+  printf '**Coverage dropped** from %s%% to %s%%. Please check whether new code is missing tests.\n' \
+    "$BASELINE" "$CURRENT_COV" > "$COMMENT_FILE"
+  platform_post_comment_file "$COMMENT_FILE" || true
+
+  LABELS=$(platform_mr_labels)
+  case ",$LABELS," in
+    *",$PIPE_LABEL_WIP,"*)
+      printf 'COVERAGE_DROP:%s:%s\n' "$BASELINE" "$CURRENT_COV" > "$PIPE_COVERAGE_SIGNAL"
+      echo "Coverage dropped on $PIPE_LABEL_WIP MR/PR — exiting 1 to trigger test-fix"
+      exit 1
+      ;;
+  esac
+fi

package/payload/ci-templates/scripts/cve-fix.sh

@@ -0,0 +1,246 @@
+#!/bin/bash
+# Runner for the opt-in CVE remediation job. A project-local scanner supplies
+# HIGH/CRITICAL identifiers in PIPE_CVE_LIST; this runner scopes the coder,
+# verifies its commit and compile result, and alone owns rebase/push/comments.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=lib/pipeline-common.sh
+source "$SCRIPT_DIR/lib/pipeline-common.sh"
+pipe_defaults
+
+CONTEXT_FILE="$PIPE_CONTEXT_DIR/cve-fix-context.md"
+CVE_LIST_FILE="$PIPE_CONTEXT_DIR/cve-fix-list.txt"
+MANIFEST_FILE="$PIPE_CONTEXT_DIR/cve-fix-manifest.txt"
+CVE_ENV="$PIPE_CONTEXT_DIR/cve-fix.env"
+COMMENT_FILE="$PIPE_CONTEXT_DIR/cve-fix-comment.md"
+
+# The scanner controls both selection and severity filtering. Bound its output
+# before it reaches a context or comment, and never forward it in argv/env.
+head -c 8000 <<< "${PIPE_CVE_LIST:-}" > "$CVE_LIST_FILE"
+# A cap can cut the final list entry mid-line. Add only a record terminator
+# before filtering/counting; the caller-provided content remains bounded.
+printf '\n' >> "$CVE_LIST_FILE"
+sed -i '/^[[:space:]]*$/d' "$CVE_LIST_FILE"
+CVE_COUNT=$(awk 'NF { count++ } END { print count + 0 }' "$CVE_LIST_FILE")
+
+write_marker() {
+  # Marker values are canonical runner output. Never source model-written data.
+  printf 'CVE_FIX_APPLIED=%s\nCVE_COMPILED=%s\nCVE_COUNT=%s\nCVE_MANUAL_REQUIRED=%s\n' \
+    "$1" "$2" "$CVE_COUNT" "$3" > "$CVE_ENV"
+}
+
+post_comment() {
+  # Posts the complete, bounded body already written to $COMMENT_FILE.
+  platform_post_comment_file "$COMMENT_FILE" || pipe_log "Could not post CVE remediation comment"
+}
+
+post_manual_comment() {
+  # $1 is the short manual-action explanation. The list is bounded above.
+  {
+    printf '**Automated CVE remediation requires manual action.**\n\n%s\n' "$1"
+    if [ -s "$CVE_LIST_FILE" ]; then
+      printf '\nAffected HIGH/CRITICAL vulnerability identifiers:\n'
+      sed 's/^/- /' "$CVE_LIST_FILE"
+    fi
+  } > "$COMMENT_FILE"
+  post_comment
+}
+
+count_matching_commits() {
+  local count=0 subject
+  while IFS= read -r subject; do
+    [ "$subject" = "$PIPE_COMMIT_CVEFIX" ] && count=$((count + 1))
+  done < <(git log "origin/$PIPE_TARGET_BRANCH..HEAD" --format='%s' 2>/dev/null)
+  printf '%s\n' "$count"
+}
+
+marker_is_valid() {
+  local line applied=0 compiled=0 count=0 manual=0
+  [ -f "$CVE_ENV" ] || return 1
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      CVE_FIX_APPLIED=0|CVE_FIX_APPLIED=1) applied=$((applied + 1)) ;;
+      CVE_COMPILED=0|CVE_COMPILED=1) compiled=$((compiled + 1)) ;;
+      CVE_MANUAL_REQUIRED=0|CVE_MANUAL_REQUIRED=1) manual=$((manual + 1)) ;;
+      CVE_COUNT=*)
+        [[ "$line" =~ ^CVE_COUNT=[0-9]+$ ]] || return 1
+        count=$((count + 1))
+        ;;
+      *) return 1 ;;
+    esac
+  done < "$CVE_ENV"
+  [ "$applied" -eq 1 ] && [ "$compiled" -eq 1 ] && [ "$count" -eq 1 ] && [ "$manual" -eq 1 ]
+}
+
+marker_value() {
+  # marker_is_valid has already limited this to a literal 0, 1, or decimal.
+  pipe_get_env "$CVE_ENV" "$1"
+}
+
+# This job has no purpose outside a merge/pull-request pipeline. Do not attempt
+# a forge lookup that can accidentally turn a branch pipeline into a comment.
+if [ -z "${PIPE_MR_IID:-}" ]; then
+  pipe_log "No merge request/pull request context; CVE remediation is inactive"
+  exit 0
+fi
+
+# Empty scanner output is normal and must remain silent. Check it before any
+# metadata/WIP gate so enabling the optional job does not spam ordinary MRs.
+if [ "$CVE_COUNT" = "0" ]; then
+  pipe_log "No vulnerability identifiers supplied; CVE remediation is inactive"
+  write_marker 0 0 1
+  exit 0
+fi
+
+# The list was supplied by the caller and can be arbitrarily large. The only
+# bounded copy is the context file above; do not let the dispatcher inherit it.
+unset PIPE_CVE_LIST
+
+META=$(platform_mr_meta 2>/dev/null || true)
+MR_LABELS=$(jq -r '.labels // ""' <<< "$META" 2>/dev/null || true)
+META_SOURCE_BRANCH=$(jq -r '.source_branch // ""' <<< "$META" 2>/dev/null || true)
+if [ -n "$META_SOURCE_BRANCH" ]; then
+  PIPE_SOURCE_BRANCH="$META_SOURCE_BRANCH"
+  export PIPE_SOURCE_BRANCH
+fi
+if [ -z "${PIPE_SOURCE_BRANCH:-}" ]; then
+  pipe_log "MR/PR metadata has no source branch"
+  post_manual_comment "The source branch metadata is unavailable; update the dependencies manually."
+  write_marker 0 0 1
+  exit 0
+fi
+
+if ! grep -qF "$PIPE_LABEL_WIP" <<< "$MR_LABELS"; then
+  pipe_log "MR/PR is not labeled $PIPE_LABEL_WIP; requesting a manual dependency update"
+  post_manual_comment "This MR/PR is not marked for autonomous changes; update the dependencies manually."
+  write_marker 0 0 1
+  exit 0
+fi
+
+# A dependency manifest is project-relative by contract. Reject paths that
+# could point outside this checkout before using them in git or file commands.
+case "$PIPE_DEPENDENCY_MANIFEST" in
+  ''|/*|..|../*|*/..|*/../*)
+    pipe_log "Invalid project-relative dependency manifest path: $PIPE_DEPENDENCY_MANIFEST"
+    post_manual_comment "The configured dependency manifest path is invalid; update the dependencies manually."
+    write_marker 0 0 1
+    exit 0
+    ;;
+esac
+
+pipe_git_identity
+pipe_checkout_source
+if ! git rev-parse --verify "origin/$PIPE_SOURCE_BRANCH" >/dev/null 2>&1 \
+  || [ "$(git rev-parse --abbrev-ref HEAD 2>/dev/null || true)" != "$PIPE_SOURCE_BRANCH" ]; then
+  pipe_log "Unable to check out source branch safely: $PIPE_SOURCE_BRANCH"
+  post_manual_comment "The source branch could not be checked out safely; update the dependencies manually."
+  write_marker 0 0 1
+  exit 0
+fi
+
+EXISTING_FIXES=$(count_matching_commits)
+if [ "$EXISTING_FIXES" -ge "$PIPE_FIX_LOOP_CAP" ]; then
+  pipe_log "CVE remediation reached its commit budget ($EXISTING_FIXES/$PIPE_FIX_LOOP_CAP)"
+  post_manual_comment "The CVE remediation commit budget is exhausted; update the dependencies manually."
+  write_marker 0 0 1
+  exit 0
+fi
+
+if [ ! -f "$PIPE_DEPENDENCY_MANIFEST" ]; then
+  pipe_log "Dependency manifest is missing: $PIPE_DEPENDENCY_MANIFEST"
+  post_manual_comment "Dependency manifest is missing: \`$PIPE_DEPENDENCY_MANIFEST\`. Update the dependencies manually."
+  write_marker 0 0 1
+  exit 0
+fi
+head -c 8000 "$PIPE_DEPENDENCY_MANIFEST" > "$MANIFEST_FILE"
+REMAINING_BUDGET=$((PIPE_FIX_LOOP_CAP - EXISTING_FIXES))
+rm -f "$CVE_ENV"
+{
+  printf '# CVE remediation context\n\n'
+  printf 'Mode: apply\n'
+  printf 'Vulnerability List File: %s\n' "$CVE_LIST_FILE"
+  printf 'Dependency Manifest Path: %s\n' "$PIPE_DEPENDENCY_MANIFEST"
+  printf 'Dependency Manifest Content File: %s\n' "$MANIFEST_FILE"
+  printf 'Compile Command: %s\n' "$PIPE_COMPILE_CMD"
+  printf 'Commit Subject: %s\n' "$PIPE_COMMIT_CVEFIX"
+  printf 'Source Branch: %s\n' "$PIPE_SOURCE_BRANCH"
+  printf 'Target Branch: %s\n' "$PIPE_TARGET_BRANCH"
+  printf 'Suppression Path: %s\n' "$PIPE_CVE_SUPPRESSIONS"
+  printf 'Remaining Commit Budget: %s\n' "$REMAINING_BUDGET"
+  printf 'Marker File: %s\n' "$CVE_ENV"
+} > "$CONTEXT_FILE"
+
+# The skill decides dependency versions. This is the same code-writing policy
+# as other runners; it receives no shell-built remediation prompt.
+PRE_AGENT_SHA=$(git rev-parse HEAD)
+pipe_run_agent cve-fix "/cve-fix" "Agent,Read,Write,Edit,Glob,Grep,Bash" "$PIPE_MODEL_CODE" < /dev/null
+POST_AGENT_SHA=$(git rev-parse HEAD)
+NEW_FIXES=$(count_matching_commits)
+RANGE_COMMITS=$(git rev-list --count "$PRE_AGENT_SHA..$POST_AGENT_SHA" 2>/dev/null || echo 0)
+RANGE_HAS_DIFF=false
+if ! git diff --quiet "$PRE_AGENT_SHA..$POST_AGENT_SHA" 2>/dev/null; then
+  RANGE_HAS_DIFF=true
+fi
+RANGE_MANIFEST_ONLY=true
+while IFS= read -r path; do
+  [ "$path" = "$PIPE_DEPENDENCY_MANIFEST" ] || { RANGE_MANIFEST_ONLY=false; break; }
+done < <(git diff --name-only "$PRE_AGENT_SHA..$POST_AGENT_SHA" 2>/dev/null)
+
+if ! marker_is_valid || [ "$(marker_value CVE_FIX_APPLIED)" != "1" ] \
+  || [ "$(marker_value CVE_COMPILED)" != "1" ] || [ "$(marker_value CVE_MANUAL_REQUIRED)" != "0" ] \
+  || [ "$NEW_FIXES" -ne $((EXISTING_FIXES + 1)) ] || [ "$RANGE_COMMITS" != "1" ] \
+  || [ "$(git log -1 --format='%s' 2>/dev/null)" != "$PIPE_COMMIT_CVEFIX" ] \
+  || [ "$RANGE_HAS_DIFF" != true ] || [ "$RANGE_MANIFEST_ONLY" != true ]; then
+  # This range and its dirty tracked files belong to the agent. Restore the
+  # checked-out remote tip; do not carry unverified work into a later rebase.
+  git reset --hard "$PRE_AGENT_SHA" >/dev/null 2>&1 || git checkout -- . || true
+  pipe_failure_log_notice_files "CVE remediation" "update the listed dependencies manually" "$PIPE_AGENT_STDERR" >&2
+  {
+    pipe_failure_notice_files "CVE remediation" "update the listed dependencies manually" "$PIPE_AGENT_STDERR"
+    printf '\n'
+    if [ -s "$CVE_LIST_FILE" ]; then
+      printf 'Affected HIGH/CRITICAL vulnerability identifiers:\n'
+      sed 's/^/- /' "$CVE_LIST_FILE"
+    fi
+    printf '\nThe coder made no verified remediation commit, so manual dependency update is required.\n'
+  } > "$COMMENT_FILE"
+  post_comment
+  write_marker 0 0 1
+  exit 0
+fi
+
+# The accepted commit is authoritative. Reset index and worktree to it so
+# compile/rebase see exactly what the runner will push; context artifacts stay
+# untracked and are therefore preserved.
+git reset --hard HEAD
+
+if [ -z "$PIPE_COMPILE_CMD" ]; then
+  pipe_log "Configured compile command is empty; refusing to push an unverified CVE remediation"
+  post_manual_comment "The configured compile command is empty, so the automated dependency update cannot be verified."
+  write_marker 1 0 1
+  exit 1
+fi
+if ! bash -c "$PIPE_COMPILE_CMD"; then
+  pipe_log "CVE remediation compile command failed; refusing to push"
+  post_manual_comment "The automated dependency update was committed locally but the compile command failed; manual review is required."
+  write_marker 1 0 1
+  exit 1
+fi
+
+if ! pipe_rebase_and_push; then
+  pipe_log "CVE remediation rebase/push failed; human work was not overwritten"
+  post_manual_comment "The automated dependency update could not be rebased and pushed safely; resolve the branch changes manually."
+  write_marker 1 1 1
+  exit 1
+fi
+
+{
+  printf '**Automated CVE remediation succeeded.**\n\n'
+  printf 'The configured dependency manifest was updated, compiled, rebased, and pushed.\n\n'
+  printf 'Remediated HIGH/CRITICAL vulnerability identifiers:\n'
+  sed 's/^/- /' "$CVE_LIST_FILE"
+} > "$COMMENT_FILE"
+post_comment
+write_marker 1 1 0
+pipe_log "Pushed verified CVE remediation commit"