@mmerterden/multi-agent-pipeline 11.4.0 → 11.5.0

package/pipeline/scripts/smoke-bitbucket-contract.sh

@@ -66,11 +66,20 @@ cat > "$TMP/fixture.json" <<'EOF'
 EOF
 
 # Stub curl that captures invocation and returns the fixture. PATH-shadows the
-# real curl for this smoke only.
+# real curl for this smoke only. Auth travels via `-K <config-file>` (so the
+# token never hits argv); the stub dumps the config file so the smoke can
+# assert its contents.
 cat > "$TMP/curl" <<EOF
 #!/usr/bin/env bash
-# Capture every invocation so we can assert the URL + auth header shape.
+# Capture every invocation so we can assert the URL + auth config shape.
 echo "INVOCATION:" "\$@" >> "$TMP/curl-calls.log"
+prev=""
+for arg in "\$@"; do
+  if [ "\$prev" = "-K" ]; then
+    echo "AUTH-CONFIG: \$(cat "\$arg" 2>/dev/null)" >> "$TMP/curl-calls.log"
+  fi
+  prev="\$arg"
+done
 # Echo the fixture body (BB Server response) to stdout  -  same as real curl -sf.
 cat "$TMP/fixture.json"
 exit 0
@@ -153,10 +162,17 @@ else
   fail "limit param missing"
 fi
 
-if grep -q "test-bb-user:test-bb-token" "$TMP/curl-calls.log"; then
-  ok "Basic auth uses {user}:{token} from credential store"
+if grep -q 'AUTH-CONFIG: user = "test-bb-user:test-bb-token"' "$TMP/curl-calls.log"; then
+  ok "Basic auth uses {user}:{token} via curl -K config (not argv)"
 else
-  fail "auth header wrong; expected user:token, got: $(grep -o '\-u [^ ]*' "$TMP/curl-calls.log" || echo none)"
+  fail "auth config wrong; captured: $(grep 'AUTH-CONFIG' "$TMP/curl-calls.log" || echo none)"
+fi
+
+# The raw token must never appear on curl argv (visible to ps).
+if grep "^INVOCATION:" "$TMP/curl-calls.log" | grep -q "test-bb-token"; then
+  fail "token leaked onto curl argv"
+else
+  ok "token absent from curl argv"
 fi
 
 # --- Assert: shape conversion produced canonical schema ---------------------

package/pipeline/scripts/smoke-fetchers-offline.sh

@@ -0,0 +1,382 @@
+#!/usr/bin/env bash
+#
+# smoke-fetchers-offline.sh  -  offline invocation tests for the pipeline/lib
+# fetchers. No network, no real tokens.
+#
+# Asserts, per fetcher:
+#   1. usage / arg-validation paths exit with the documented code
+#   2. URL/host parsing succeeds for a representative URL. This is the
+#      permanent regression guard for the env-prefix bug where
+#      `VAR=x PARSED=$(python3 ...)` never exported VAR to the child, so
+#      fetch-confluence always failed with "could not determine Confluence
+#      host" before reaching the credential stage.
+#   3. with stub credentials (fake credential-store in a temp HOME, fake curl
+#      on PATH) the failure moves past parsing to the documented
+#      credential/network exit code
+#   4. static source checks: no bash-4-only constructs (macOS /bin/bash is
+#      3.2) and no secret-bearing argv patterns (curl -H auth headers,
+#      --data-urlencode secrets, security add-generic-password -w on argv)
+#
+# Fetchers run under /bin/bash when available so bash-4-isms fail loudly on
+# macOS instead of passing under a newer Homebrew bash.
+#
+# Exit codes: 0=pass, 1=failure
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+LIB="$REPO_ROOT/pipeline/lib"
+SCRIPTS="$REPO_ROOT/pipeline/scripts"
+
+# Prefer the system bash (3.2 on macOS) so bash-4-isms regress loudly here.
+SH="/bin/bash"
+[ -x "$SH" ] || SH="$(command -v bash)"
+
+PASS=0
+FAIL=0
+note() { echo "  -> $*"; }
+pass() { echo "    ok $*"; PASS=$((PASS + 1)); }
+fail() { echo "    FAIL $*"; FAIL=$((FAIL + 1)); }
+
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/smoke-fetchers.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+
+OUT="$WORK/out.log"
+ERR="$WORK/err.log"
+
+# expect_rc <expected-rc> <label> <cmd...>
+# Runs cmd, captures stdout/stderr to $OUT/$ERR, asserts the exit code.
+expect_rc() {
+  local expected="$1" label="$2"
+  shift 2
+  local rc=0
+  "$@" >"$OUT" 2>"$ERR" || rc=$?
+  if [ "$rc" -eq "$expected" ]; then
+    pass "$label (rc=$rc)"
+  else
+    fail "$label (rc=$rc, expected $expected)"
+    tail -5 "$ERR" | sed 's/^/      /'
+  fi
+}
+
+assert_in_file() {
+  local needle="$1" file="$2" label="$3"
+  if grep -q -e "$needle" "$file" 2>/dev/null; then
+    pass "$label"
+  else
+    fail "$label (pattern '$needle' not found)"
+  fi
+}
+
+assert_not_in_file() {
+  local needle="$1" file="$2" label="$3"
+  if grep -q -e "$needle" "$file" 2>/dev/null; then
+    fail "$label (pattern '$needle' present)"
+  else
+    pass "$label"
+  fi
+}
+
+# -----------------------------------------------------------------------------
+note "0. fixtures: temp HOME with resolver + fake credential store, fake curls"
+# -----------------------------------------------------------------------------
+FAKE_HOME="$WORK/home"
+mkdir -p "$FAKE_HOME/.claude/lib"
+cp "$LIB/credential-store-resolver.sh" "$FAKE_HOME/.claude/lib/credential-store-resolver.sh"
+
+# Fake credential store: empty by default, returns FAKE_CRED_VALUE when set.
+cat > "$FAKE_HOME/.claude/lib/credential-store.sh" <<'FAKE'
+#!/bin/bash
+case "${1:-}" in
+  get)
+    if [ -n "${FAKE_CRED_VALUE:-}" ]; then printf '%s' "$FAKE_CRED_VALUE"; exit 0; fi
+    exit 1 ;;
+  platform) echo "fake" ;;
+  *) exit 3 ;;
+esac
+FAKE
+chmod +x "$FAKE_HOME/.claude/lib/credential-store.sh"
+
+# Fake curl variants, each in its own PATH-prepend dir.
+BIN_CURL_FAIL="$WORK/bin-curl-fail"
+mkdir -p "$BIN_CURL_FAIL"
+cat > "$BIN_CURL_FAIL/curl" <<'FAKE'
+#!/bin/bash
+echo "curl: (7) offline stub - connection refused" >&2
+exit 7
+FAKE
+chmod +x "$BIN_CURL_FAIL/curl"
+
+# Swagger meta stub: honours --output, emits the --write-out triple with a
+# content type that matches neither json nor yaml, forcing the URL-suffix
+# lowercase path (the former bash-4 ${URL,,} site).
+BIN_CURL_META="$WORK/bin-curl-meta"
+mkdir -p "$BIN_CURL_META"
+cat > "$BIN_CURL_META/curl" <<'FAKE'
+#!/bin/bash
+out=""
+prev=""
+for a in "$@"; do
+  if [ "$prev" = "--output" ]; then out="$a"; fi
+  prev="$a"
+done
+if [ -n "$out" ]; then printf '{}' > "$out"; fi
+printf '200\napplication/octet-stream\n2\n'
+exit 0
+FAKE
+chmod +x "$BIN_CURL_META/curl"
+
+# 401 stub: honours -o, prints the HTTP code the way curl -w '%{http_code}' does.
+BIN_CURL_401="$WORK/bin-curl-401"
+mkdir -p "$BIN_CURL_401"
+cat > "$BIN_CURL_401/curl" <<'FAKE'
+#!/bin/bash
+out=""
+prev=""
+for a in "$@"; do
+  if [ "$prev" = "-o" ] || [ "$prev" = "--output" ]; then out="$a"; fi
+  prev="$a"
+done
+if [ -n "$out" ]; then printf '{}' > "$out"; fi
+printf '401'
+exit 0
+FAKE
+chmod +x "$BIN_CURL_401/curl"
+
+# Fake security + uname (forces the macOS branch of credential-store.sh) so
+# the no-secret-on-argv property of `security -i` writes can be asserted on
+# any platform without touching a real keychain.
+BIN_DARWIN="$WORK/bin-darwin"
+mkdir -p "$BIN_DARWIN"
+cat > "$BIN_DARWIN/uname" <<'FAKE'
+#!/bin/bash
+echo "Darwin"
+FAKE
+cat > "$BIN_DARWIN/security" <<'FAKE'
+#!/bin/bash
+printf '%s\n' "$*" >> "$SMOKE_CAPTURE_DIR/security-argv.log"
+if [ "${1:-}" = "-i" ]; then
+  cat >> "$SMOKE_CAPTURE_DIR/security-stdin.log"
+fi
+exit 0
+FAKE
+chmod +x "$BIN_DARWIN/uname" "$BIN_DARWIN/security"
+
+# -----------------------------------------------------------------------------
+note "1. fetch-confluence.sh"
+# -----------------------------------------------------------------------------
+expect_rc 4 "no args exits 4 (usage)" \
+  "$SH" "$LIB/fetch-confluence.sh"
+expect_rc 4 "--help exits 4 (usage)" \
+  "$SH" "$LIB/fetch-confluence.sh" --help
+
+# Regression guard for the env-prefix parse bug: a plain page URL must get
+# past host/pageId resolution and fail at the credential stage (exit 2),
+# never with the parse error.
+expect_rc 2 "URL parse reaches credential stage (viewpage.action?pageId)" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-confluence.sh" \
+  "https://confluence.example.com/pages/viewpage.action?pageId=12345"
+assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
+assert_not_in_file "could not determine Confluence host" "$ERR" \
+  "no host-parse error (env-prefix regression)"
+
+expect_rc 2 "URL parse reaches credential stage (cloud /wiki/spaces form)" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-confluence.sh" \
+  "https://tenant.atlassian.net/wiki/spaces/ENG/pages/99887/Some+Page"
+assert_in_file "missing-token" "$ERR" "cloud form also blocked on token only"
+
+# With a stub token and a failing curl, the failure must be the documented
+# network error (3), proving parsing and auth wiring are past.
+expect_rc 3 "stub token + offline curl exits 3 (network stage)" \
+  env HOME="$FAKE_HOME" USER=smoke FAKE_CRED_VALUE=fake-token \
+      PATH="$BIN_CURL_FAIL:$PATH" \
+  "$SH" "$LIB/fetch-confluence.sh" \
+  "https://confluence.example.com/pages/viewpage.action?pageId=12345"
+assert_in_file "Confluence GET failed" "$ERR" "network-stage error message"
+
+# -----------------------------------------------------------------------------
+note "2. fetch-crashlytics.sh"
+# -----------------------------------------------------------------------------
+expect_rc 4 "no args exits 4 (usage)" \
+  "$SH" "$LIB/fetch-crashlytics.sh"
+expect_rc 4 "--help exits 4 (usage)" \
+  "$SH" "$LIB/fetch-crashlytics.sh" --help
+
+CRASH_URL="https://console.firebase.google.com/project/my-proj/crashlytics/app/ios:com.example.app/issues/abc123"
+expect_rc 2 "URL parse reaches credential stage" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-crashlytics.sh" "$CRASH_URL"
+assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
+
+# Stub SA JSON whose project_id mismatches the URL: proves parse + credential
+# read + base64 decode + JSON validation all pass, fully offline (exit 5).
+MISMATCH_SA_B64=$(printf '{"project_id":"other-proj"}' | base64 | tr -d '\n')
+expect_rc 5 "stub SA JSON reaches project-mismatch check (exit 5)" \
+  env HOME="$FAKE_HOME" USER=smoke FAKE_CRED_VALUE="$MISMATCH_SA_B64" \
+  "$SH" "$LIB/fetch-crashlytics.sh" "$CRASH_URL"
+assert_in_file "project_id" "$ERR" "mismatch error mentions project_id"
+
+# The decoded SA JSON must never touch a predictable /tmp path.
+assert_not_in_file "/tmp/.fc-sa" "$LIB/fetch-crashlytics.sh" \
+  "predictable /tmp SA path removed from source"
+
+# -----------------------------------------------------------------------------
+note "3. fetch-swagger.sh"
+# -----------------------------------------------------------------------------
+expect_rc 4 "no args exits 4 (usage)" \
+  "$SH" "$LIB/fetch-swagger.sh"
+
+expect_rc 2 "offline curl exits 2 (network stage)" \
+  env PATH="$BIN_CURL_FAIL:$PATH" \
+  "$SH" "$LIB/fetch-swagger.sh" "https://spec.example.com/openapi.json"
+
+# Uppercase .YAML suffix with a non-matching content type exercises the
+# lowercase-URL branch (formerly bash-4 ${URL,,}, dies on /bin/bash 3.2).
+expect_rc 0 "uppercase .YAML suffix detected via lowercase branch" \
+  env PATH="$BIN_CURL_META:$PATH" \
+  "$SH" "$LIB/fetch-swagger.sh" "https://spec.example.com/openapi.YAML"
+assert_in_file '"format": "yaml"' "$OUT" "output reports yaml format"
+
+# -----------------------------------------------------------------------------
+note "4. fetch-fortify.sh"
+# -----------------------------------------------------------------------------
+expect_rc 6 "no host configured exits 6" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-fortify.sh" --version-id 123
+expect_rc 4 "host override + no version id exits 4 (usage)" \
+  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
+  "$SH" "$LIB/fetch-fortify.sh"
+
+FORTIFY_URL="https://ssc.example.com/ssc/html/ssc/version/123/fix/ABCD-1"
+expect_rc 2 "URL parse reaches credential stage" \
+  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
+  "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
+assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
+
+expect_rc 0 "stub token + offline curl degrades to empty result (exit 0)" \
+  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
+      FAKE_CRED_VALUE=fake-token PATH="$BIN_CURL_FAIL:$PATH" \
+  "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
+assert_in_file '"gateOutcome"' "$OUT" "normalized JSON still emitted"
+
+# -----------------------------------------------------------------------------
+note "5. figma-screenshot.sh"
+# -----------------------------------------------------------------------------
+expect_rc 1 "no args exits 1 (usage)" \
+  "$SH" "$LIB/figma-screenshot.sh"
+expect_rc 0 "--help exits 0" \
+  "$SH" "$LIB/figma-screenshot.sh" --help
+
+expect_rc 3 "no PAT resolvable exits 3 (Tier 3 required)" \
+  env -u FIGMA_PAT HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/figma-screenshot.sh" --file-key abc123 --node-id 1-2 \
+  --output-dir "$WORK/shots-no-pat"
+
+expect_rc 2 "stub PAT + 401 curl exits 2 (auth stage, past parsing)" \
+  env HOME="$FAKE_HOME" USER=smoke FIGMA_PAT=fake-pat \
+      PATH="$BIN_CURL_401:$PATH" \
+  "$SH" "$LIB/figma-screenshot.sh" --file-key abc123 --node-id 1-2 \
+  --output-dir "$WORK/shots-401"
+
+# -----------------------------------------------------------------------------
+note "6. figma-mcp-refresh.sh"
+# -----------------------------------------------------------------------------
+expect_rc 2 "missing prefs exits 2" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/figma-mcp-refresh.sh"
+
+if command -v jq >/dev/null 2>&1; then
+  PREFS_HOME="$WORK/home-prefs"
+  mkdir -p "$PREFS_HOME/.claude"
+  printf '{"global":{"keychainMapping":{"figma_mcp":"Smoke_Figma_MCP"}}}\n' \
+    > "$PREFS_HOME/.claude/multi-agent-preferences.json"
+  export SMOKE_CAPTURE_DIR="$WORK"
+  expect_rc 2 "mapped key + empty keychain exits 2 (no refresh token)" \
+    env HOME="$PREFS_HOME" USER=smoke SMOKE_CAPTURE_DIR="$WORK" \
+        PATH="$BIN_DARWIN:$PATH" \
+    "$SH" "$LIB/figma-mcp-refresh.sh"
+else
+  note "   (jq not installed - skipping mapped-key case)"
+fi
+
+# -----------------------------------------------------------------------------
+note "7. credential-store.sh + keychain-save.sh"
+# -----------------------------------------------------------------------------
+expect_rc 0 "platform subcommand works" \
+  "$SH" "$LIB/credential-store.sh" platform
+expect_rc 3 "get without key exits 3 (usage)" \
+  "$SH" "$LIB/credential-store.sh" get
+expect_rc 1 "keychain-save without service name exits 1 (usage)" \
+  "$SH" "$SCRIPTS/keychain-save.sh"
+
+# set <key> - : the secret must travel via stdin to `security -i`, never on
+# the security argv. Fake uname forces the macOS branch; fake security logs
+# argv and stdin separately.
+rm -f "$WORK/security-argv.log" "$WORK/security-stdin.log"
+SECRET_VALUE="topsecret-smoke-value-123"
+rc=0
+printf '%s' "$SECRET_VALUE" \
+  | env PATH="$BIN_DARWIN:$PATH" KEYCHAIN_DELEGATE=0 SMOKE_CAPTURE_DIR="$WORK" \
+    "$SH" "$LIB/credential-store.sh" set smoke-test-key - >"$OUT" 2>"$ERR" || rc=$?
+if [ "$rc" -eq 0 ]; then
+  pass "set <key> - via stdin succeeds (rc=0)"
+else
+  fail "set <key> - via stdin failed (rc=$rc)"
+  tail -5 "$ERR" | sed 's/^/      /'
+fi
+assert_in_file "^-i" "$WORK/security-argv.log" "security invoked in -i stdin mode"
+assert_not_in_file "$SECRET_VALUE" "$WORK/security-argv.log" "secret absent from security argv"
+assert_in_file "$SECRET_VALUE" "$WORK/security-stdin.log" "secret delivered via stdin"
+
+# -----------------------------------------------------------------------------
+note "8. static source checks (bash-3.2 compat + no secrets on argv)"
+# -----------------------------------------------------------------------------
+OWNED_FILES=(
+  "$LIB/fetch-confluence.sh"
+  "$LIB/fetch-crashlytics.sh"
+  "$LIB/fetch-swagger.sh"
+  "$LIB/fetch-fortify.sh"
+  "$LIB/figma-mcp-refresh.sh"
+  "$LIB/figma-screenshot.sh"
+  "$LIB/credential-store.sh"
+  "$SCRIPTS/keychain-save.sh"
+)
+
+if grep -nE '\$\{[A-Za-z_0-9]+(,,|\^\^)|mapfile |readarray |declare -A' "${OWNED_FILES[@]}"; then
+  fail "bash-4-only construct found (must run on /bin/bash 3.2)"
+else
+  pass "no bash-4-only constructs"
+fi
+
+if grep -nE -- '-H "(Authorization|X-Figma-Token)' "${OWNED_FILES[@]}"; then
+  fail "auth header passed to curl via argv (-H)"
+else
+  pass "no auth headers on curl argv"
+fi
+
+if grep -nE -- '--data-urlencode "(refresh_token|client_secret)' "${OWNED_FILES[@]}"; then
+  fail "OAuth secret passed to curl via argv (--data-urlencode)"
+else
+  pass "no OAuth secrets on curl argv"
+fi
+
+if grep -nE 'add-generic-password[^|]*-w "\$' "${OWNED_FILES[@]}"; then
+  fail "keychain secret passed to security via argv (-w)"
+else
+  pass "no keychain secrets on security argv"
+fi
+
+# shellcheck disable=SC2016  # literal $HOME is the pattern being hunted
+if grep -nE '\$HOME/\.claude/lib/credential-store\.sh|~/\.claude/lib/credential-store\.sh' "${OWNED_FILES[@]}"; then
+  fail "hardcoded credential-store path (must go through the resolver)"
+else
+  pass "credential-store access routed through the resolver"
+fi
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "smoke-fetchers-offline: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] || exit 1
+exit 0

package/pipeline/scripts/smoke-install-layout.sh

@@ -110,11 +110,19 @@ assert_file "$TMP_CLAUDE/.claude/CLAUDE.md" "~/.claude/CLAUDE.md"
 assert_file "$TMP_CLAUDE/.claude/multi-agent-preferences.json" "~/.claude/multi-agent-preferences.json"
 assert_file "$TMP_CLAUDE/.claude/settings.json" "~/.claude/settings.json"
 
-# settings.json must have the secret-detection hook
+# settings.json must have the secret-detection hook. v11.4.1 changed the
+# matcher from the dead "Bash(git commit:*)" (tool-name matchers never matched
+# it) to "Bash"; command-level filtering happens inside pre-commit-check.sh.
+if grep -q '"matcher": "Bash"' "$TMP_CLAUDE/.claude/settings.json" \
+  && grep -q "pre-commit-check.sh" "$TMP_CLAUDE/.claude/settings.json"; then
+  pass "settings.json registers PreToolUse secret-scan hook (matcher Bash)"
+else
+  fail "settings.json missing PreToolUse secret-scan hook with matcher Bash"
+fi
 if grep -q "Bash(git commit:\*)" "$TMP_CLAUDE/.claude/settings.json"; then
-  pass "settings.json registers PreToolUse git-commit hook"
+  fail "settings.json still contains the dead Bash(git commit:*) matcher"
 else
-  fail "settings.json missing PreToolUse git-commit hook"
+  pass "settings.json has no dead Bash(git commit:*) matcher"
 fi
 if grep -q "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE" "$TMP_CLAUDE/.claude/settings.json"; then
   pass "settings.json sets CLAUDE_AUTOCOMPACT_PCT_OVERRIDE"

package/pipeline/scripts/smoke-lib-scripts.sh

@@ -136,6 +136,18 @@ else
   else
     fail "jira-id path output unexpected"
   fi
+
+  # Bare "#316" and "316" must land in the gh-num branch (needsRepoPicker
+  # descriptor when no default owner/repo), NOT gh-short with an empty repo
+  # prefix that builds https://github.com/<owner>//issues/316.
+  for bare in "#316" "316"; do
+    out=$(ACCOUNT_DEFAULT_OWNER="" ACCOUNT_DEFAULT_REPO="" "$FETCHER" "$bare" 2>/dev/null || echo "")
+    if printf '%s' "$out" | python3 -c 'import json,sys; d=json.loads(sys.stdin.read()); assert d["kind"]=="github", d["kind"]; assert d["key"]=="316", d["key"]; assert d.get("needsRepoPicker") is True, d' 2>/dev/null; then
+      ok "bare '$bare' classified as gh-num (key=316, needsRepoPicker)"
+    else
+      fail "bare '$bare' misclassified: $(printf '%s' "$out" | head -c 200)"
+    fi
+  done
 fi
 
 # --- multi-repo-pipeline.sh: bridge --------------------------------------
@@ -294,6 +306,20 @@ assert d["projects"][1]["project"] == "repo-b"
     fail "bridge output missing projects[] entries"
   fi
 
+  # teardown guard: a worktreeRoot of "." (the current project root) must be
+  # refused loudly, never rm -rf'd.
+  UNSAFE_STATE="$FIXTURE_ROOT/unsafe-state.json"
+  sed 's|"worktreeRoot":"[^"]*"|"worktreeRoot":"."|' "$FIXTURE_ROOT/state.json" > "$UNSAFE_STATE"
+  GUARD_DIR=$(mktemp -d)
+  ( cd "$GUARD_DIR" && "$MRP" teardown "$UNSAFE_STATE" ) >/dev/null 2>&1
+  guard_rc=$?
+  if [ "$guard_rc" -ne 0 ] && [ -d "$GUARD_DIR" ]; then
+    ok "teardown refuses worktreeRoot='.' (exit=$guard_rc, dir intact)"
+  else
+    fail "teardown did not refuse unsafe worktreeRoot='.' (exit=$guard_rc)"
+  fi
+  rm -rf "$GUARD_DIR"
+
   # teardown
   "$MRP" teardown "$FIXTURE_ROOT/state.json" >/dev/null 2>&1
   if [ ! -d "$WORKTREE_ROOT" ]; then
@@ -357,13 +383,40 @@ EOF
 
   # render-jira: bulleted PR list at top
   rendered=$("$CMR" render-jira "$TMP/multi.json" "$TMP/body.md" 2>/dev/null)
-  bullet_count=$(printf '%s' "$rendered" | grep -c '^\* PR:' || echo 0)
+  bullet_count=$(printf '%s' "$rendered" | grep -c '^\* PR:' || true)
   if [ "$bullet_count" = "2" ]; then
     ok "render-jira prepends bulleted PR list (2 entries)"
   else
     fail "render-jira bullet count $bullet_count != 2"
   fi
 
+  # render-jira/-conf with ZERO PR urls: must pass the body through unchanged
+  # (the old `grep -c || echo 0` idiom emitted "0\n0" here and prepended
+  # bogus "* PR:" bullets to the posted body).
+  cat > "$TMP/noprs.json" <<'EOF'
+{
+  "schemaVersion":"2.1.0","taskId":"Z","shortId":1,"project":"my-app",
+  "branch":"feature/Z","baseBranch":"develop","currentPhase":6,"status":"in_progress",
+  "startedAt":"2026-04-27T12:00:00Z","phases":{},"identity":{"name":"T","email":"t@e.com"},
+  "projects":[
+    {"project":"my-app","projectRoot":"/tmp/a","branch":"feature/Z","baseBranch":"develop","identity":{"name":"T","email":"t@e.com"},"pr":null},
+    {"project":"common","projectRoot":"/tmp/b","branch":"feature/Z","baseBranch":"develop","identity":{"name":"T","email":"t@e.com"},"pr":null}
+  ]
+}
+EOF
+  rendered=$("$CMR" render-jira "$TMP/noprs.json" "$TMP/body.md" 2>/dev/null)
+  if [ "$rendered" = "body content" ]; then
+    ok "render-jira with zero PR urls passes body through unchanged"
+  else
+    fail "render-jira with zero PR urls mutated body: $rendered"
+  fi
+  rendered=$("$CMR" render-conf "$TMP/noprs.json" "$TMP/body.md" 2>/dev/null)
+  if [ "$rendered" = "body content" ]; then
+    ok "render-conf with zero PR urls passes body through unchanged"
+  else
+    fail "render-conf with zero PR urls mutated body: $rendered"
+  fi
+
   # render-conf: ## Related PRs heading
   rendered=$("$CMR" render-conf "$TMP/multi.json" "$TMP/body.md" 2>/dev/null)
   if printf '%s' "$rendered" | grep -q "## Related PRs"; then

package/pipeline/scripts/smoke-pack-contents.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+#
+# smoke-pack-contents.sh  -  guard what `npm publish` would actually ship.
+#
+#   1. Deny patterns: package.json files[] carries negations (`!...`) for
+#      dev-only / personal-data files. The published tarball must contain
+#      no file matching any of them. Patterns are read from package.json at
+#      runtime (via node), so the smoke never goes stale when the deny list
+#      changes.
+#   2. File-count band: the total packed file count is compared against the
+#      committed fixture pipeline/scripts/fixtures/pack-expected-count.txt.
+#      Drift beyond +-15 percent fails - that magnitude means the files[]
+#      globs picked up (or dropped) a whole subtree, which deserves a human
+#      look. Refresh the fixture after reviewing:
+#        npm pack --dry-run --json 2>/dev/null \
+#          | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>console.log(JSON.parse(s)[0].files.length))' \
+#          > pipeline/scripts/fixtures/pack-expected-count.txt
+#   3. publint (optional): linted via `npx --no-install` so it only runs
+#      when the package is already installed - never a network fetch.
+#
+# Exit codes: 0=pass, 1=violation, 2=environment broken
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+FIXTURE="$REPO_ROOT/pipeline/scripts/fixtures/pack-expected-count.txt"
+
+command -v npm >/dev/null 2>&1 || { echo "FAIL: npm not on PATH"; exit 2; }
+command -v node >/dev/null 2>&1 || { echo "FAIL: node not on PATH"; exit 2; }
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
+
+cleanup() { [ -n "${TMP:-}" ] && rm -rf "$TMP"; }
+trap cleanup EXIT
+TMP=$(mktemp -d)
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 1. npm pack --dry-run --json"
+if ! (cd "$REPO_ROOT" && npm pack --dry-run --json 2>/dev/null > "$TMP/pack.json"); then
+  echo "FAIL: npm pack --dry-run failed"
+  exit 2
+fi
+
+# Deny check runs in node so the patterns come straight from package.json
+# files[] negations - never hardcoded here.
+cat > "$TMP/check.mjs" <<'MJS'
+import { readFileSync } from "node:fs";
+
+const [packJsonPath, pkgJsonPath] = process.argv.slice(2);
+const packed = JSON.parse(readFileSync(packJsonPath, "utf-8"))[0].files.map((f) => f.path);
+const files = JSON.parse(readFileSync(pkgJsonPath, "utf-8")).files || [];
+const denies = files.filter((p) => p.startsWith("!")).map((p) => p.slice(1));
+
+// Minimal glob -> regex: '**' spans path separators, '*' does not.
+const toRegex = (glob) => {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const body = escaped
+    .split("**")
+    .map((part) => part.replace(/\*/g, "[^/]*"))
+    .join(".*");
+  return new RegExp("^" + body + "$");
+};
+
+const regexes = denies.map((d) => [d, toRegex(d)]);
+let bad = 0;
+for (const path of packed) {
+  for (const [glob, re] of regexes) {
+    if (re.test(path)) {
+      console.log(`DENY ${path} (matches !${glob})`);
+      bad++;
+    }
+  }
+}
+console.log(`DENYCOUNT ${bad}`);
+console.log(`PATTERNS ${denies.length}`);
+console.log(`COUNT ${packed.length}`);
+MJS
+
+CHECK=$(node "$TMP/check.mjs" "$TMP/pack.json" "$REPO_ROOT/package.json")
+COUNT=$(echo "$CHECK" | awk '/^COUNT /{print $2}')
+DENYCOUNT=$(echo "$CHECK" | awk '/^DENYCOUNT /{print $2}')
+PATTERNS=$(echo "$CHECK" | awk '/^PATTERNS /{print $2}')
+
+if [ -z "$COUNT" ] || [ -z "$DENYCOUNT" ]; then
+  echo "FAIL: deny-pattern checker produced no result (node error?)"
+  exit 2
+fi
+
+pass "pack dry-run produced $COUNT files ($PATTERNS deny patterns loaded from package.json)"
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 2. deny patterns (files[] negations must not ship)"
+if [ "$DENYCOUNT" -eq 0 ]; then
+  pass "no packed file matches a files[] negation"
+else
+  fail "$DENYCOUNT packed file(s) match dev-only/personal-data exclusions:"
+  echo "$CHECK" | grep '^DENY ' | sed 's/^/    /'
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 3. file-count band vs fixture (+-15 percent)"
+if [ ! -f "$FIXTURE" ]; then
+  fail "fixture missing: $FIXTURE - create it from the refresh command in this script's header"
+else
+  EXPECTED=$(tr -cd '0-9' < "$FIXTURE")
+  if [ -z "$EXPECTED" ] || [ "$EXPECTED" -eq 0 ]; then
+    fail "fixture unreadable or zero: $FIXTURE"
+  else
+    DIFF=$((COUNT - EXPECTED))
+    [ "$DIFF" -lt 0 ] && DIFF=$((-DIFF))
+    LIMIT=$((EXPECTED * 15 / 100))
+    if [ "$DIFF" -le "$LIMIT" ]; then
+      pass "count $COUNT within +-15 percent of expected $EXPECTED (drift $DIFF, limit $LIMIT)"
+    else
+      fail "count $COUNT drifted beyond +-15 percent of expected $EXPECTED (drift $DIFF, limit $LIMIT)"
+      echo "    Review what the files[] globs now include, then refresh the fixture"
+      echo "    (refresh command is in this script's header comment)."
+    fi
+  fi
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 4. publint (optional, npx --no-install only)"
+if (cd "$REPO_ROOT" && npx --no-install publint --help >/dev/null 2>&1); then
+  if OUT=$(cd "$REPO_ROOT" && npx --no-install publint 2>&1); then
+    pass "publint: no errors"
+  else
+    fail "publint reported errors"
+    echo "$OUT" | sed 's/^/    /'
+  fi
+else
+  echo "  ↷ SKIP: publint not installed (npx --no-install found no local package)"
+fi
+
+echo ""
+echo "══ smoke-pack-contents: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -gt 0 ] && exit 1 || exit 0