@mmerterden/multi-agent-pipeline 11.4.0 → 11.5.0

package/install/copilot.mjs

@@ -22,7 +22,9 @@ import {
   copyFile,
   countFiles,
   ensureDir,
+  ensureRealDir,
   isDryRun,
+  removePipelineAgentFiles,
   wipeDir,
   writeFile,
 } from "./_common.mjs";
@@ -61,17 +63,55 @@ export function installCopilot(ctx) {
   installSkills({ pipelineSrc, dest: COPILOT_SKILLS, indexOnly, useSymlinks, platformFlag });
 }
 
+/** Start of the pipeline-managed span in copilot-instructions.md. */
+export const INSTRUCTIONS_START_MARKER = "# Multi-Agent Development Pipeline";
+
+/**
+ * Explicit end marker written after the pipeline section (v11.4.1+). Updates
+ * replace only the start..end span, so anything the user appends AFTER the
+ * pipeline section survives. Pre-marker files fall back to
+ * `legacyTrailingContent` bounding.
+ */
+export const INSTRUCTIONS_END_MARKER =
+  "<!-- multi-agent-pipeline:copilot-instructions:end -->";
+
+/**
+ * Legacy files (written before the end marker existed) have no explicit
+ * terminator. Bound the pipeline span at the next top-level "# " heading
+ * after the start marker when one exists OUTSIDE fenced code blocks (the
+ * pipeline body carries bash comments like "# Bootstrap once ..." inside
+ * fences that must not be mistaken for headings); otherwise the span runs
+ * to EOF, which matches the pre-marker behavior.
+ *
+ * @param {string} section - file content from the start marker onward
+ * @returns {string} user content trailing the pipeline span ("" if none)
+ */
+export function legacyTrailingContent(section) {
+  const lines = section.split("\n");
+  let inFence = false;
+  for (let i = 1; i < lines.length; i++) {
+    if (/^\s*(```|~~~)/.test(lines[i])) {
+      inFence = !inFence;
+      continue;
+    }
+    if (!inFence && /^# /.test(lines[i])) return lines.slice(i).join("\n");
+  }
+  return "";
+}
+
 function writeInstructionsFile(path) {
   const pipelineSection = generateCopilotInstructions();
+  const managedBlock =
+    pipelineSection.trimEnd() + "\n\n" + INSTRUCTIONS_END_MARKER + "\n";
 
   if (!existsSync(path)) {
-    writeFile(path, pipelineSection + "\n");
+    writeFile(path, managedBlock);
     console.log("    -> Created copilot-instructions.md with pipeline");
     return;
   }
 
   let existing = readFileSync(path, "utf-8");
-  const marker = "# Multi-Agent Development Pipeline";
+  const marker = INSTRUCTIONS_START_MARKER;
 
   // Drift cleanup (v5.6.2): detect pre-v5.0 pipeline sections that predate
   // the stable marker and strip them. These blocks ("## Multi-Agent Task
@@ -103,12 +143,26 @@ function writeInstructionsFile(path) {
   }
 
   if (existing.includes(marker)) {
-    const before = existing.split(marker)[0].trimEnd();
-    writeFile(path, before + "\n\n" + pipelineSection + "\n");
+    const startIdx = existing.indexOf(marker);
+    const before = existing.slice(0, startIdx).trimEnd();
+    const fromStart = existing.slice(startIdx);
+    // Replace only the start..end span. User content appended AFTER the
+    // pipeline section (below the end marker, or below the next top-level
+    // heading in legacy files) is preserved.
+    const endIdx = fromStart.indexOf(INSTRUCTIONS_END_MARKER);
+    const trailing =
+      endIdx >= 0
+        ? fromStart.slice(endIdx + INSTRUCTIONS_END_MARKER.length)
+        : legacyTrailingContent(fromStart);
+    let out = before.length > 0 ? before + "\n\n" : "";
+    out += managedBlock;
+    const trailingClean = trailing.replace(/^[\r\n]+/, "").trimEnd();
+    if (trailingClean.length > 0) out += "\n" + trailingClean + "\n";
+    writeFile(path, out);
     const suffix = cleaned ? " (also scrubbed pre-v5.0 drift section)" : "";
     console.log(`    -> Updated existing pipeline section in copilot-instructions.md${suffix}`);
   } else {
-    writeFile(path, existing.trimEnd() + "\n\n" + pipelineSection + "\n");
+    writeFile(path, existing.trimEnd() + "\n\n" + managedBlock);
     console.log("    -> Appended pipeline section to copilot-instructions.md");
   }
 }
@@ -117,6 +171,9 @@ function installScripts(pipelineSrc, dest, useSymlinks) {
   console.log("  [Copilot CLI] Installing scripts...");
   const scriptsSrc = join(pipelineSrc, "scripts");
   if (!existsSync(scriptsSrc)) return;
+  // Replace a --link-era symlink with a real dir before wiping/copying so the
+  // install can never land inside the developer's repo checkout.
+  if (!useSymlinks) ensureRealDir(dest);
   wipeDir(dest);
   copyDir(scriptsSrc, dest, { exclude: DEV_ONLY_SCRIPTS, useSymlinks });
   // Count files actually excluded, not the array length: DEV_ONLY_SCRIPTS mixes
@@ -133,7 +190,13 @@ function installAgents(pipelineSrc, dest, useSymlinks) {
   console.log("  [Copilot CLI] Installing agent definitions...");
   const agentsSrc = join(pipelineSrc, "agents");
   if (!existsSync(agentsSrc)) return;
-  wipeDir(dest);
+  // ~/.copilot/agents also holds user-authored agent files. Never wipe the
+  // whole dir; remove only the pipeline-shipped agent files (name set derived
+  // from the source tree so it cannot go stale), then copy the fresh set in.
+  if (!useSymlinks) {
+    ensureRealDir(dest);
+    removePipelineAgentFiles(dest, agentsSrc);
+  }
   copyDir(agentsSrc, dest, { useSymlinks });
   console.log(`    -> ${countFiles(agentsSrc)} files copied to ${dest}`);
 }
@@ -142,6 +205,7 @@ function installSchemas(pipelineSrc, dest, useSymlinks) {
   console.log("  [Copilot CLI] Installing JSON schemas...");
   const schemasSrc = join(pipelineSrc, "schemas");
   if (!existsSync(schemasSrc)) return;
+  if (!useSymlinks) ensureRealDir(dest);
   wipeDir(dest);
   copyDir(schemasSrc, dest, { useSymlinks });
   console.log(`    -> ${countFiles(schemasSrc)} files copied to ${dest}`);
@@ -151,6 +215,7 @@ function installLib(pipelineSrc, dest, useSymlinks) {
   console.log("  [Copilot CLI] Installing shell libraries...");
   const libSrc = join(pipelineSrc, "lib");
   if (!existsSync(libSrc)) return;
+  if (!useSymlinks) ensureRealDir(dest);
   wipeDir(dest);
   copyDir(libSrc, dest, { useSymlinks });
   console.log(`    -> ${countFiles(libSrc)} files copied to ${dest}`);
@@ -160,6 +225,10 @@ function installSkills(opts) {
   const { pipelineSrc, dest, indexOnly, useSymlinks, platformFlag } = opts;
   console.log("  [Copilot CLI] Installing skills...");
 
+  // Same symlink guard as the other owned trees: never prune or copy through
+  // a --link-era symlink into the repo checkout.
+  if (!useSymlinks) ensureRealDir(dest);
+
   if (indexOnly) {
     try {
       mkdirSync(dest, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "11.4.0",
+  "version": "11.5.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code and Copilot CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",
@@ -18,7 +18,8 @@
     "test:unit": "node --test test/*.test.mjs",
     "test:smoke": "node pipeline/scripts/run-smokes.mjs",
     "lint:skills": "node pipeline/scripts/lint-skills.mjs",
-    "test:coverage": "c8 --reporter=text --reporter=lcov node --test test/*.test.mjs && c8 report",
+    "test:quick": "node --test test/*.test.mjs && node pipeline/scripts/lint-skills.mjs",
+    "test:coverage": "c8 --check-coverage --reporter=text --reporter=lcov node --test test/*.test.mjs && c8 report",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "format": "prettier --write \"**/*.{js,mjs,json,md,yml}\" --ignore-path .gitignore",
@@ -69,17 +70,10 @@
     "README.md",
     "CHANGELOG.md",
     "LICENSE",
-    "!pipeline/scripts/figma-placeholder-map.json",
-    "!pipeline/scripts/sync-figma-source.sh",
-    "!pipeline/scripts/import-figma-skills.sh",
-    "!pipeline/scripts/smoke-figma-skill-import.sh",
     "!pipeline/scripts/smoke-figma-config-schema.sh",
     "!pipeline/scripts/smoke-personal-data.sh",
     "!pipeline/scripts/smoke-install-leak-gate.sh",
-    "!pipeline/scripts/README-figma-smokes.md",
-    "!pipeline/scripts/.last-figma-sync-plan.json",
-    "!docs/GENERICITY-REVIEW.md",
-    "!docs/STABILITY-FIX-PLAN.md"
+    "!docs/internal/**"
   ],
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/pipeline/commands/multi-agent/dev-local/SKILL.md

@@ -20,7 +20,7 @@ Phase 7: Report     → Jira / Wiki + log + knowledge/memory
 
 `--dev local` skips Phase 1 (Analysis), Phase 2 (Planning + Approval Gate), Phase 4 (Review), and Phase 5 (User Test  -  local/autopilot variants skip the interactive test gate). It differs from `--dev` on two axes: no git worktree is created (development happens directly on the current branch in `$PROJECT_ROOT`), and the interactive User Test phase is skipped.
 
-> **Want the quality tail afterwards?** Since this mode skips Review + Test, run [`/multi-agent:finish`](./finish.md) on the same branch when you're done to add parallel review, a build+test success gate, PR, and a Jira technical-analysis + test-scenario comment  -  without re-developing.
+> **Want the quality tail afterwards?** Since this mode skips Review + Test, run [`/multi-agent:finish`](../finish/SKILL.md) on the same branch when you're done to add parallel review, a build+test success gate, PR, and a Jira technical-analysis + test-scenario comment  -  without re-developing.
 
 ## When to use it
 

package/pipeline/lib/account-resolver.sh

@@ -63,10 +63,23 @@ except Exception:
 
 # 1. Pull every credential entry that looks like one of our token services.
 #    Includes token entries AND username entries (BB needs the user keychain key).
-#    Uses cross-platform credential-store wrapper (macOS/Windows/Linux backends).
-services=$("$HOME/.claude/lib/credential-store.sh" list 2>/dev/null \
-  | grep -E '_(Github|Jira|Bitbucket|Confluence)_[A-Za-z]+_(Token|Json|Username)$|_Github_Auth_Token$|_Github_Access_Token$|_Jira_Access_Token$|_Bitbucket_Access_Token$|_Bitbucket_Username$|_Confluence_Access_Token$' \
-  || true)
+#    Uses cross-platform credential-store wrapper (macOS/Windows/Linux backends),
+#    located via the shared resolver (repo checkout or either install tree)  -
+#    never a hardcoded path. A missing helper degrades to an empty inventory.
+# A pre-set CRED_STORE (tests, custom installs) is honored as-is.
+if [ -z "${CRED_STORE:-}" ]; then
+  # shellcheck disable=SC1090,SC1091
+  . "$(cd "$(dirname "$0")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
+    || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+    || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+    || true
+fi
+services=""
+if [ -n "${CRED_STORE:-}" ]; then
+  services=$("$CRED_STORE" list 2>/dev/null \
+    | grep -E '_(Github|Jira|Bitbucket|Confluence)_[A-Za-z]+_(Token|Json|Username)$|_Github_Auth_Token$|_Github_Access_Token$|_Jira_Access_Token$|_Bitbucket_Access_Token$|_Bitbucket_Username$|_Confluence_Access_Token$' \
+    || true)
+fi
 
 # 2. Compute unique prefixes (everything before the provider segment).
 prefixes=$(printf '%s\n' "$services" \
@@ -114,14 +127,6 @@ emit_accounts() {
       [ $match -eq 0 ] && continue
     fi
 
-    # Provider list
-    local prov_json=""
-    [ -n "$gh_token" ]   && prov_json="${prov_json}\"github\","
-    [ -n "$jira_token" ] && prov_json="${prov_json}\"jira\","
-    [ -n "$bb_token" ]   && prov_json="${prov_json}\"bitbucket\","
-    [ -n "$conf_token" ] && prov_json="${prov_json}\"confluence\","
-    prov_json="${prov_json%,}"
-
     # Work-account heuristic: bitbucket+jira together indicates corporate.
     local is_work="false"
     if [ -n "$bb_token" ] && [ -n "$jira_token" ]; then
@@ -134,18 +139,18 @@ emit_accounts() {
 
     # Hosts: per-account override (prefs.global.accounts[].jiraHost) wins; falls
     # back to global.hosts.{jira,bitbucket}; otherwise null. No hardcoded values.
-    local jira_host="null" bb_host="null"
+    local jira_host="" bb_host=""
     local per_jira per_bb
     per_jira=$(account_host_override "$short_id" "jiraHost")
     per_bb=$(account_host_override "$short_id" "bitbucketHost")
     if [ -n "$jira_token" ]; then
-      if   [ -n "$per_jira" ];        then jira_host="\"$per_jira\""
-      elif [ -n "$prefs_jira_host" ]; then jira_host="\"$prefs_jira_host\""
+      if   [ -n "$per_jira" ];        then jira_host="$per_jira"
+      elif [ -n "$prefs_jira_host" ]; then jira_host="$prefs_jira_host"
       fi
     fi
     if [ -n "$bb_token" ]; then
-      if   [ -n "$per_bb" ];        then bb_host="\"$per_bb\""
-      elif [ -n "$prefs_bb_host" ]; then bb_host="\"$prefs_bb_host\""
+      if   [ -n "$per_bb" ];        then bb_host="$per_bb"
+      elif [ -n "$prefs_bb_host" ]; then bb_host="$prefs_bb_host"
       fi
     fi
 
@@ -185,12 +190,45 @@ emit_accounts() {
     [ $first -eq 0 ] && printf ','
     first=0
 
-    printf '{"id":"%s","label":"%s","prefix":"%s","providers":[%s],"tokens":{"github":"%s","jira":"%s","bitbucket":"%s","confluence":"%s"},"userKeys":{"bitbucket":"%s"},"users":{"github":"%s"},"jiraHost":%s,"bitbucketHost":%s,"isWork":%s}' \
-      "$short_id" "$label" "$prefix" "$prov_json" \
-      "$gh_token" "$jira_token" "$bb_token" "$conf_token" \
-      "$bb_user_key" \
-      "$gh_user" \
-      "$jira_host" "$bb_host" "$is_work"
+    # Build the entry with python3 from env vars  -  printf-interpolated JSON
+    # has zero escaping, so a quote or backslash in a keychain service name
+    # would corrupt the whole array. Values cross into python via the
+    # environment, never via string interpolation.
+    ACC_ID="$short_id" ACC_LABEL="$label" ACC_PREFIX="$prefix" \
+    ACC_GH_TOKEN="$gh_token" ACC_JIRA_TOKEN="$jira_token" \
+    ACC_BB_TOKEN="$bb_token" ACC_CONF_TOKEN="$conf_token" \
+    ACC_BB_USER_KEY="$bb_user_key" ACC_GH_USER="$gh_user" \
+    ACC_JIRA_HOST="$jira_host" ACC_BB_HOST="$bb_host" ACC_IS_WORK="$is_work" \
+    python3 - <<'PY'
+import json, os
+
+def env(name):
+    return os.environ.get(name, "")
+
+providers = []
+if env("ACC_GH_TOKEN"):   providers.append("github")
+if env("ACC_JIRA_TOKEN"): providers.append("jira")
+if env("ACC_BB_TOKEN"):   providers.append("bitbucket")
+if env("ACC_CONF_TOKEN"): providers.append("confluence")
+
+print(json.dumps({
+    "id":        env("ACC_ID"),
+    "label":     env("ACC_LABEL"),
+    "prefix":    env("ACC_PREFIX"),
+    "providers": providers,
+    "tokens": {
+        "github":     env("ACC_GH_TOKEN"),
+        "jira":       env("ACC_JIRA_TOKEN"),
+        "bitbucket":  env("ACC_BB_TOKEN"),
+        "confluence": env("ACC_CONF_TOKEN"),
+    },
+    "userKeys": {"bitbucket": env("ACC_BB_USER_KEY")},
+    "users":    {"github": env("ACC_GH_USER")},
+    "jiraHost":      env("ACC_JIRA_HOST") or None,
+    "bitbucketHost": env("ACC_BB_HOST") or None,
+    "isWork":        env("ACC_IS_WORK") == "true",
+}, ensure_ascii=False), end="")
+PY
   done <<< "$prefixes"
   printf ']'
 }

package/pipeline/lib/channels-multi-repo.sh

@@ -26,6 +26,11 @@ STATE="${2:-}"
 }
 [ ! -f "$STATE" ] && { echo "ERR: state file not found: $STATE" >&2; exit 2; }
 
+# count_matches: single-line numeric grep -c (the bare `grep -c || echo 0`
+# idiom emits "0" twice on zero matches and breaks the -le comparisons below).
+# shellcheck source=count-lib.sh disable=SC1091
+. "$(cd "$(dirname "$0")" && pwd)/count-lib.sh"
+
 # --- Helpers ----------------------------------------------------------------
 # Extract the targets array from agent-state.json. Output: TSV with columns
 # repoName, prUrl, isPrimary (1/0). One target per row.
@@ -156,7 +161,7 @@ do_render_jira() {
   local urls
   urls=$(all_pr_urls | tr ' ' '\n' | grep -v '^$' || true)
   local count
-  count=$(printf '%s\n' "$urls" | grep -c . || echo 0)
+  count=$(printf '%s\n' "$urls" | count_matches .)
 
   if [ "$count" -le 1 ]; then
     cat "$body_file"
@@ -179,7 +184,7 @@ do_render_conf() {
   local urls
   urls=$(all_pr_urls | tr ' ' '\n' | grep -v '^$' || true)
   local count
-  count=$(printf '%s\n' "$urls" | grep -c . || echo 0)
+  count=$(printf '%s\n' "$urls" | count_matches .)
 
   if [ "$count" -le 1 ]; then
     cat "$body_file"

package/pipeline/lib/count-lib.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# count-lib.sh  -  shared counting helper for pipeline shell scripts.
+#
+# Why: `grep -c` prints "0" AND exits 1 when nothing matches, so the common
+# idiom `$(grep -c pattern file || echo 0)` emits TWO lines ("0" plus the
+# fallback "0"). That breaks arithmetic (`$((x + 0\n0))` is a syntax error)
+# and numeric comparisons (`[ "0\n0" -le 1 ]` silently evaluates false).
+#
+# count_matches guarantees single-line numeric output in every case:
+#   - match count when grep succeeds
+#   - "0" when nothing matches or grep itself errors (missing file, ...)
+#
+# Usage (same arguments as grep -c, file or stdin):
+#   n=$(count_matches -E 'pattern' "$file")
+#   n=$(printf '%s\n' "$blob" | count_matches .)
+#
+# Source from a sibling script:
+#   . "$(cd "$(dirname "$0")" && pwd)/count-lib.sh"
+
+count_matches() {
+  local n
+  n=$(grep -c "$@" 2>/dev/null) || true
+  case "$n" in
+    '' | *[!0-9]*) n=0 ;;
+  esac
+  printf '%s\n' "$n"
+}

package/pipeline/lib/credential-store.sh

@@ -8,6 +8,9 @@
 # Subcommands:
 #   get <key>            Read secret value to stdout (empty + exit 1 if missing)
 #   set <key> <value>    Store secret (overwrites if exists)
+#   set <key> -          Same, but read the secret from stdin. Preferred:
+#                        keeps the secret off this script's argv (visible to
+#                        ps). A literal "-" value cannot be stored this way.
 #   delete <key>         Remove secret
 #   list                 List all keys (one per line)
 #   platform             Print detected platform: macos | windows | linux | unknown
@@ -124,7 +127,11 @@ if (\$c) { \$c.GetNetworkCredential().Password }
 
 do_set() {
   local key="${1:-}" val="${2:-}"
-  [ -z "$key" ] && { echo "usage: $0 set <key> <value>" >&2; exit 3; }
+  [ -z "$key" ] && { echo "usage: $0 set <key> <value|->" >&2; exit 3; }
+  # "-" means: read the secret from stdin (keeps it off argv).
+  if [ "$val" = "-" ]; then
+    val=$(cat)
+  fi
   if delegate_to_python; then
     # Pass the value via stdin to keep it out of process listings / shell history.
     printf '%s' "$val" | python3 "$KEYCHAIN_PY" set "$key" -
@@ -132,7 +139,15 @@ do_set() {
   fi
   case "$PLATFORM" in
     macos)
-      security add-generic-password -s "$key" -a "${USER:-claude}" -w "$val" -U >/dev/null 2>&1
+      # `security -i` reads the add command from stdin, so the secret never
+      # lands on the `security` argv (visible to ps). printf is a bash
+      # builtin, so no argv exposure there either. Double quotes/backslashes
+      # are escaped for security's interactive tokenizer.
+      local key_sec val_sec
+      key_sec=${key//\\/\\\\}; key_sec=${key_sec//\"/\\\"}
+      val_sec=${val//\\/\\\\}; val_sec=${val_sec//\"/\\\"}
+      printf 'add-generic-password -U -s "%s" -a "%s" -w "%s"\n' \
+        "$key_sec" "${USER:-claude}" "$val_sec" | security -i >/dev/null 2>&1
       ;;
     linux)
       require_cmd secret-tool "Install libsecret-tools (see doctor)."
@@ -140,11 +155,13 @@ do_set() {
       ;;
     windows)
       # Escape single quotes for PowerShell single-quoted strings ('' = literal ').
-      local key_esc="${key//\'/\'\'}" val_esc="${val//\'/\'\'}"
-      # CredentialManager module: New-StoredCredential
-      ps_run "
+      local key_esc="${key//\'/\'\'}"
+      # The secret is piped via stdin ([Console]::In) so it never appears on
+      # the PowerShell argv (visible to process listings).
+      printf '%s' "$val" | ps_run "
 \$ErrorActionPreference='Stop'
-\$pwd = ConvertTo-SecureString '$val_esc' -AsPlainText -Force
+\$raw = [Console]::In.ReadToEnd()
+\$pwd = ConvertTo-SecureString \$raw -AsPlainText -Force
 New-StoredCredential -Target '$key_esc' -UserName '${USER:-${USERNAME:-claude}}' -SecurePassword \$pwd -Persist LocalMachine | Out-Null
 " >/dev/null
       ;;

package/pipeline/lib/extract-conventions.sh

@@ -40,6 +40,12 @@ if ! command -v jq >/dev/null 2>&1; then
   exit 1
 fi
 
+# count_matches: single-line numeric grep -c. The bare `grep -c || echo 0`
+# idiom emits "0" twice on zero matches, which turns the $((...)) counter
+# arithmetic below into a silent syntax error that zeroes the bucket.
+# shellcheck source=count-lib.sh disable=SC1091
+. "$(cd "$(dirname "$0")" && pwd)/count-lib.sh"
+
 # ---- global timing budget -----------------------------------------------------
 SCRIPT_START_EPOCH=$(date +%s)
 GLOBAL_BUDGET_SEC=180
@@ -672,16 +678,16 @@ bucket_test_method_naming() {
     [ -z "$f" ] && continue
     case "$PLATFORM" in
       ios|android)
-        underscore_count=$((underscore_count + $(grep -cE 'func +test[A-Za-z0-9]+_[A-Za-z0-9_]+' "$f" 2>/dev/null || echo 0)))
-        underscore_count=$((underscore_count + $(grep -cE 'fun +[A-Za-z0-9]+_[A-Za-z0-9_]+_[A-Za-z0-9_]+ *\(' "$f" 2>/dev/null || echo 0)))
-        camel_count=$((camel_count + $(grep -cE 'func +test[A-Z][A-Za-z0-9]+ *\(' "$f" 2>/dev/null || echo 0)))
-        backtick_count=$((backtick_count + $(grep -cE '`[^`]*`\s*\(' "$f" 2>/dev/null || echo 0)))
+        underscore_count=$((underscore_count + $(count_matches -E 'func +test[A-Za-z0-9]+_[A-Za-z0-9_]+' "$f")))
+        underscore_count=$((underscore_count + $(count_matches -E 'fun +[A-Za-z0-9]+_[A-Za-z0-9_]+_[A-Za-z0-9_]+ *\(' "$f")))
+        camel_count=$((camel_count + $(count_matches -E 'func +test[A-Z][A-Za-z0-9]+ *\(' "$f")))
+        backtick_count=$((backtick_count + $(count_matches -E '`[^`]*`\s*\(' "$f")))
         ;;
       backend)
-        underscore_count=$((underscore_count + $(grep -cE '^def +test_[a-z0-9_]+' "$f" 2>/dev/null || echo 0)))
+        underscore_count=$((underscore_count + $(count_matches -E '^def +test_[a-z0-9_]+' "$f")))
         ;;
       frontend)
-        it_count=$((it_count + $(grep -cE "(it|test)\\(['\"\`]" "$f" 2>/dev/null || echo 0)))
+        it_count=$((it_count + $(count_matches -E "(it|test)\\(['\"\`]" "$f")))
         ;;
     esac
   done <<< "$test_files"
@@ -745,9 +751,9 @@ bucket_accessibility_identifier() {
       if [ -z "$sample_ids" ]; then empty_bucket; return; fi
 
       local dot_count snake_count camel_count
-      dot_count=$(printf '%s\n' "$sample_ids" | grep -cE '"[a-z]+(\.[a-zA-Z]+)+' 2>/dev/null || echo 0)
-      snake_count=$(printf '%s\n' "$sample_ids" | grep -cE '"[a-z]+_[a-z_]+' 2>/dev/null || echo 0)
-      camel_count=$(printf '%s\n' "$sample_ids" | grep -cE '"[a-z]+[A-Z][a-zA-Z]+' 2>/dev/null || echo 0)
+      dot_count=$(printf '%s\n' "$sample_ids" | count_matches -E '"[a-z]+(\.[a-zA-Z]+)+')
+      snake_count=$(printf '%s\n' "$sample_ids" | count_matches -E '"[a-z]+_[a-z_]+')
+      camel_count=$(printf '%s\n' "$sample_ids" | count_matches -E '"[a-z]+[A-Z][a-zA-Z]+')
       dot_count=${dot_count:-0}; snake_count=${snake_count:-0}; camel_count=${camel_count:-0}
 
       local evidence_json
@@ -772,9 +778,9 @@ bucket_accessibility_identifier() {
       done | head -30 || true)
       if [ -z "$ids" ]; then empty_bucket; return; fi
       local snake_count kebab_count camel_count
-      snake_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+_[a-z_]+' || echo 0)
-      kebab_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+-[a-z\-]+' || echo 0)
-      camel_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+[A-Z][a-zA-Z]+' || echo 0)
+      snake_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+_[a-z_]+')
+      kebab_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+-[a-z\-]+')
+      camel_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+[A-Z][a-zA-Z]+')
       snake_count=${snake_count:-0}; kebab_count=${kebab_count:-0}; camel_count=${camel_count:-0}
       if [ "$snake_count" -ge "$kebab_count" ] && [ "$snake_count" -ge "$camel_count" ] && [ "$snake_count" -gt 0 ]; then
         emit_bucket "snake_case testTag" "checkin_continue_button" "$(confidence_for "$snake_count")" "[]" '["kebab","camelCase"]'
@@ -797,8 +803,8 @@ bucket_accessibility_identifier() {
       done | head -50 || true)
       if [ -z "$op_ids" ]; then empty_bucket; return; fi
       local camel_count snake_count
-      camel_count=$(printf '%s\n' "$op_ids" | grep -cE '[a-z]+[A-Z][A-Za-z]+' || echo 0)
-      snake_count=$(printf '%s\n' "$op_ids" | grep -cE '[a-z]+_[a-z_]+' || echo 0)
+      camel_count=$(printf '%s\n' "$op_ids" | count_matches -E '[a-z]+[A-Z][A-Za-z]+')
+      snake_count=$(printf '%s\n' "$op_ids" | count_matches -E '[a-z]+_[a-z_]+')
       camel_count=${camel_count:-0}; snake_count=${snake_count:-0}
       if [ "$camel_count" -ge "$snake_count" ] && [ "$camel_count" -gt 0 ]; then
         emit_bucket "camelCase operationId" "createFoo" "$(confidence_for "$camel_count")" "[]" '["snake_case"]'
@@ -817,9 +823,9 @@ bucket_accessibility_identifier() {
       done | head -30 || true)
       if [ -z "$ids" ]; then empty_bucket; return; fi
       local kebab_count camel_count snake_count
-      kebab_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+-[a-z\-]+' || echo 0)
-      camel_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+[A-Z][a-zA-Z]+' || echo 0)
-      snake_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+_[a-z_]+' || echo 0)
+      kebab_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+-[a-z\-]+')
+      camel_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+[A-Z][a-zA-Z]+')
+      snake_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+_[a-z_]+')
       kebab_count=${kebab_count:-0}; camel_count=${camel_count:-0}; snake_count=${snake_count:-0}
       if [ "$kebab_count" -ge "$camel_count" ] && [ "$kebab_count" -ge "$snake_count" ] && [ "$kebab_count" -gt 0 ]; then
         emit_bucket "kebab-case data-testid" 'data-testid="checkin-continue-button"' "$(confidence_for "$kebab_count")" "[]" '["camelCase","snake"]'
@@ -879,9 +885,9 @@ bucket_localization_key() {
   if [ -z "$keys" ]; then empty_bucket; return; fi
 
   local dot_count snake_count camel_count
-  dot_count=$(printf '%s\n' "$keys" | grep -cE '^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)+' || echo 0)
-  snake_count=$(printf '%s\n' "$keys" | grep -cE '^[a-z][a-z0-9]*(_[a-z0-9]+)+' || echo 0)
-  camel_count=$(printf '%s\n' "$keys" | grep -cE '^[a-z][a-zA-Z0-9]*[A-Z][a-zA-Z0-9]*' || echo 0)
+  dot_count=$(printf '%s\n' "$keys" | count_matches -E '^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)+')
+  snake_count=$(printf '%s\n' "$keys" | count_matches -E '^[a-z][a-z0-9]*(_[a-z0-9]+)+')
+  camel_count=$(printf '%s\n' "$keys" | count_matches -E '^[a-z][a-zA-Z0-9]*[A-Z][a-zA-Z0-9]*')
   dot_count=${dot_count:-0}; snake_count=${snake_count:-0}; camel_count=${camel_count:-0}
 
   if [ "$dot_count" -ge "$snake_count" ] && [ "$dot_count" -ge "$camel_count" ] && [ "$dot_count" -gt 0 ]; then
@@ -907,7 +913,7 @@ bucket_di_registration() {
       local resolver_count factory_count manual_count swinject_count
       manual_count=0; resolver_count=0; factory_count=0; swinject_count=0
       if [ -n "$configurators" ]; then
-        manual_count=$(printf '%s\n' "$configurators" | grep -c 'DependencyConfigurator' || echo 0)
+        manual_count=$(printf '%s\n' "$configurators" | count_matches 'DependencyConfigurator')
       fi
       files=$(run_find -type f -name '*.swift' 2>/dev/null || true)
       if [ -n "$files" ]; then

package/pipeline/lib/fetch-confluence.sh

@@ -67,15 +67,17 @@ if [ -z "$URL" ] && [ -z "$PAGE_ID" ]; then
   exit 4
 fi
 
-# Resolve host + pageId from URL when not given explicitly.
-URL_PARSE_INPUT="$URL" URL_HOST_OVERRIDE="$HOST_OVERRIDE" URL_PAGE_ID="$PAGE_ID" \
-PARSED=$(python3 - <<'PY'
-import os, sys, re
+# Resolve host + pageId from URL when not given explicitly. Inputs are passed
+# as argv: an env prefix on a plain assignment (VAR=x PARSED=$(...)) never
+# reaches the child process, so os.environ would always come back empty.
+PARSED=$(python3 - "$URL" "$HOST_OVERRIDE" "$PAGE_ID" <<'PY'
+import sys, re
 import urllib.parse as up
 
-url = os.environ.get("URL_PARSE_INPUT", "")
-host_override = os.environ.get("URL_HOST_OVERRIDE", "")
-explicit_id = os.environ.get("URL_PAGE_ID", "")
+argv = sys.argv[1:] + ["", "", ""]
+url = argv[0]
+host_override = argv[1]
+explicit_id = argv[2]
 
 host = host_override
 page_id = explicit_id
@@ -124,12 +126,22 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Confluence_Access_Token"
 
-TOKEN=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+# Locate the credential helper via the resolver so Copilot-only installs work.
+# shellcheck disable=SC1090,SC1091
+. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"confluence","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+
+TOKEN=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$TOKEN" ]; then
   printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"confluence","expected_key":"'"$TOKEN_KEY"'"}' >&2
   exit 2
 fi
 
+# Bearer auth via a curl config fed through process substitution so the token
+# never appears in argv (argv is visible to ps).
+confluence_auth_cfg() { printf 'header = "Authorization: Bearer %s"\n' "$TOKEN"; }
+
 # Endpoint resolution: Confluence Cloud (<tenant>.atlassian.net/wiki/rest/api)
 # vs Server/Data Center (<host>/rest/api). The same paths exist on both.
 case "$HOST" in
@@ -141,14 +153,14 @@ esac
 if [ -z "$PAGE_ID_RESOLVED" ] && [ -n "$SPACE_KEY" ] && [ -n "$URL" ]; then
   TITLE_RAW=$(python3 -c "
 import urllib.parse as up
-import os, re
-p = up.urlparse(os.environ['URL_PARSE_INPUT'])
+import sys, re
+p = up.urlparse(sys.argv[1])
 m = re.match(r'/display/[^/]+/(.+)', p.path)
 print(up.unquote(m.group(1)) if m else '')
-" URL_PARSE_INPUT="$URL")
+" "$URL")
   if [ -n "$TITLE_RAW" ]; then
     LOOKUP=$(curl -sS --fail --max-time "$TIMEOUT" --connect-timeout 5 \
-      -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" \
+      -K <(confluence_auth_cfg) -H "Accept: application/json" \
       --data-urlencode "spaceKey=$SPACE_KEY" \
       --data-urlencode "title=$TITLE_RAW" \
       --data-urlencode "expand=" \
@@ -172,7 +184,7 @@ fi
 
 # Fetch the page body in storage format.
 PAGE_JSON=$(curl -sS --fail --max-time "$TIMEOUT" --connect-timeout 5 \
-  -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" \
+  -K <(confluence_auth_cfg) -H "Accept: application/json" \
   "$API_BASE/content/$PAGE_ID_RESOLVED?expand=body.storage,space" 2>/dev/null || true)
 
 if [ -z "$PAGE_JSON" ]; then