@mmerterden/multi-agent-pipeline 11.4.0 → 12.0.0

package/pipeline/scripts/smoke-lib-scripts.sh

@@ -136,6 +136,18 @@ else
   else
     fail "jira-id path output unexpected"
   fi
+
+  # Bare "#316" and "316" must land in the gh-num branch (needsRepoPicker
+  # descriptor when no default owner/repo), NOT gh-short with an empty repo
+  # prefix that builds https://github.com/<owner>//issues/316.
+  for bare in "#316" "316"; do
+    out=$(ACCOUNT_DEFAULT_OWNER="" ACCOUNT_DEFAULT_REPO="" "$FETCHER" "$bare" 2>/dev/null || echo "")
+    if printf '%s' "$out" | python3 -c 'import json,sys; d=json.loads(sys.stdin.read()); assert d["kind"]=="github", d["kind"]; assert d["key"]=="316", d["key"]; assert d.get("needsRepoPicker") is True, d' 2>/dev/null; then
+      ok "bare '$bare' classified as gh-num (key=316, needsRepoPicker)"
+    else
+      fail "bare '$bare' misclassified: $(printf '%s' "$out" | head -c 200)"
+    fi
+  done
 fi
 
 # --- multi-repo-pipeline.sh: bridge --------------------------------------
@@ -294,6 +306,20 @@ assert d["projects"][1]["project"] == "repo-b"
     fail "bridge output missing projects[] entries"
   fi
 
+  # teardown guard: a worktreeRoot of "." (the current project root) must be
+  # refused loudly, never rm -rf'd.
+  UNSAFE_STATE="$FIXTURE_ROOT/unsafe-state.json"
+  sed 's|"worktreeRoot":"[^"]*"|"worktreeRoot":"."|' "$FIXTURE_ROOT/state.json" > "$UNSAFE_STATE"
+  GUARD_DIR=$(mktemp -d)
+  ( cd "$GUARD_DIR" && "$MRP" teardown "$UNSAFE_STATE" ) >/dev/null 2>&1
+  guard_rc=$?
+  if [ "$guard_rc" -ne 0 ] && [ -d "$GUARD_DIR" ]; then
+    ok "teardown refuses worktreeRoot='.' (exit=$guard_rc, dir intact)"
+  else
+    fail "teardown did not refuse unsafe worktreeRoot='.' (exit=$guard_rc)"
+  fi
+  rm -rf "$GUARD_DIR"
+
   # teardown
   "$MRP" teardown "$FIXTURE_ROOT/state.json" >/dev/null 2>&1
   if [ ! -d "$WORKTREE_ROOT" ]; then
@@ -357,13 +383,40 @@ EOF
 
   # render-jira: bulleted PR list at top
   rendered=$("$CMR" render-jira "$TMP/multi.json" "$TMP/body.md" 2>/dev/null)
-  bullet_count=$(printf '%s' "$rendered" | grep -c '^\* PR:' || echo 0)
+  bullet_count=$(printf '%s' "$rendered" | grep -c '^\* PR:' || true)
   if [ "$bullet_count" = "2" ]; then
     ok "render-jira prepends bulleted PR list (2 entries)"
   else
     fail "render-jira bullet count $bullet_count != 2"
   fi
 
+  # render-jira/-conf with ZERO PR urls: must pass the body through unchanged
+  # (the old `grep -c || echo 0` idiom emitted "0\n0" here and prepended
+  # bogus "* PR:" bullets to the posted body).
+  cat > "$TMP/noprs.json" <<'EOF'
+{
+  "schemaVersion":"2.1.0","taskId":"Z","shortId":1,"project":"my-app",
+  "branch":"feature/Z","baseBranch":"develop","currentPhase":6,"status":"in_progress",
+  "startedAt":"2026-04-27T12:00:00Z","phases":{},"identity":{"name":"T","email":"t@e.com"},
+  "projects":[
+    {"project":"my-app","projectRoot":"/tmp/a","branch":"feature/Z","baseBranch":"develop","identity":{"name":"T","email":"t@e.com"},"pr":null},
+    {"project":"common","projectRoot":"/tmp/b","branch":"feature/Z","baseBranch":"develop","identity":{"name":"T","email":"t@e.com"},"pr":null}
+  ]
+}
+EOF
+  rendered=$("$CMR" render-jira "$TMP/noprs.json" "$TMP/body.md" 2>/dev/null)
+  if [ "$rendered" = "body content" ]; then
+    ok "render-jira with zero PR urls passes body through unchanged"
+  else
+    fail "render-jira with zero PR urls mutated body: $rendered"
+  fi
+  rendered=$("$CMR" render-conf "$TMP/noprs.json" "$TMP/body.md" 2>/dev/null)
+  if [ "$rendered" = "body content" ]; then
+    ok "render-conf with zero PR urls passes body through unchanged"
+  else
+    fail "render-conf with zero PR urls mutated body: $rendered"
+  fi
+
   # render-conf: ## Related PRs heading
   rendered=$("$CMR" render-conf "$TMP/multi.json" "$TMP/body.md" 2>/dev/null)
   if printf '%s' "$rendered" | grep -q "## Related PRs"; then

package/pipeline/scripts/smoke-pack-contents.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+#
+# smoke-pack-contents.sh  -  guard what `npm publish` would actually ship.
+#
+#   1. Deny patterns: package.json files[] carries negations (`!...`) for
+#      dev-only / personal-data files. The published tarball must contain
+#      no file matching any of them. Patterns are read from package.json at
+#      runtime (via node), so the smoke never goes stale when the deny list
+#      changes.
+#   2. File-count band: the total packed file count is compared against the
+#      committed fixture pipeline/scripts/fixtures/pack-expected-count.txt.
+#      Drift beyond +-15 percent fails - that magnitude means the files[]
+#      globs picked up (or dropped) a whole subtree, which deserves a human
+#      look. Refresh the fixture after reviewing:
+#        npm pack --dry-run --json 2>/dev/null \
+#          | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>console.log(JSON.parse(s)[0].files.length))' \
+#          > pipeline/scripts/fixtures/pack-expected-count.txt
+#   3. publint (optional): linted via `npx --no-install` so it only runs
+#      when the package is already installed - never a network fetch.
+#
+# Exit codes: 0=pass, 1=violation, 2=environment broken
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+FIXTURE="$REPO_ROOT/pipeline/scripts/fixtures/pack-expected-count.txt"
+
+command -v npm >/dev/null 2>&1 || { echo "FAIL: npm not on PATH"; exit 2; }
+command -v node >/dev/null 2>&1 || { echo "FAIL: node not on PATH"; exit 2; }
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
+
+cleanup() { [ -n "${TMP:-}" ] && rm -rf "$TMP"; }
+trap cleanup EXIT
+TMP=$(mktemp -d)
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 1. npm pack --dry-run --json"
+if ! (cd "$REPO_ROOT" && npm pack --dry-run --json 2>/dev/null > "$TMP/pack.json"); then
+  echo "FAIL: npm pack --dry-run failed"
+  exit 2
+fi
+
+# Deny check runs in node so the patterns come straight from package.json
+# files[] negations - never hardcoded here.
+cat > "$TMP/check.mjs" <<'MJS'
+import { readFileSync } from "node:fs";
+
+const [packJsonPath, pkgJsonPath] = process.argv.slice(2);
+const packed = JSON.parse(readFileSync(packJsonPath, "utf-8"))[0].files.map((f) => f.path);
+const files = JSON.parse(readFileSync(pkgJsonPath, "utf-8")).files || [];
+const denies = files.filter((p) => p.startsWith("!")).map((p) => p.slice(1));
+
+// Minimal glob -> regex: '**' spans path separators, '*' does not.
+const toRegex = (glob) => {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const body = escaped
+    .split("**")
+    .map((part) => part.replace(/\*/g, "[^/]*"))
+    .join(".*");
+  return new RegExp("^" + body + "$");
+};
+
+const regexes = denies.map((d) => [d, toRegex(d)]);
+let bad = 0;
+for (const path of packed) {
+  for (const [glob, re] of regexes) {
+    if (re.test(path)) {
+      console.log(`DENY ${path} (matches !${glob})`);
+      bad++;
+    }
+  }
+}
+console.log(`DENYCOUNT ${bad}`);
+console.log(`PATTERNS ${denies.length}`);
+console.log(`COUNT ${packed.length}`);
+MJS
+
+CHECK=$(node "$TMP/check.mjs" "$TMP/pack.json" "$REPO_ROOT/package.json")
+COUNT=$(echo "$CHECK" | awk '/^COUNT /{print $2}')
+DENYCOUNT=$(echo "$CHECK" | awk '/^DENYCOUNT /{print $2}')
+PATTERNS=$(echo "$CHECK" | awk '/^PATTERNS /{print $2}')
+
+if [ -z "$COUNT" ] || [ -z "$DENYCOUNT" ]; then
+  echo "FAIL: deny-pattern checker produced no result (node error?)"
+  exit 2
+fi
+
+pass "pack dry-run produced $COUNT files ($PATTERNS deny patterns loaded from package.json)"
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 2. deny patterns (files[] negations must not ship)"
+if [ "$DENYCOUNT" -eq 0 ]; then
+  pass "no packed file matches a files[] negation"
+else
+  fail "$DENYCOUNT packed file(s) match dev-only/personal-data exclusions:"
+  echo "$CHECK" | grep '^DENY ' | sed 's/^/    /'
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 3. file-count band vs fixture (+-15 percent)"
+if [ ! -f "$FIXTURE" ]; then
+  fail "fixture missing: $FIXTURE - create it from the refresh command in this script's header"
+else
+  EXPECTED=$(tr -cd '0-9' < "$FIXTURE")
+  if [ -z "$EXPECTED" ] || [ "$EXPECTED" -eq 0 ]; then
+    fail "fixture unreadable or zero: $FIXTURE"
+  else
+    DIFF=$((COUNT - EXPECTED))
+    [ "$DIFF" -lt 0 ] && DIFF=$((-DIFF))
+    LIMIT=$((EXPECTED * 15 / 100))
+    if [ "$DIFF" -le "$LIMIT" ]; then
+      pass "count $COUNT within +-15 percent of expected $EXPECTED (drift $DIFF, limit $LIMIT)"
+    else
+      fail "count $COUNT drifted beyond +-15 percent of expected $EXPECTED (drift $DIFF, limit $LIMIT)"
+      echo "    Review what the files[] globs now include, then refresh the fixture"
+      echo "    (refresh command is in this script's header comment)."
+    fi
+  fi
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 4. publint (optional, npx --no-install only)"
+if (cd "$REPO_ROOT" && npx --no-install publint --help >/dev/null 2>&1); then
+  if OUT=$(cd "$REPO_ROOT" && npx --no-install publint 2>&1); then
+    pass "publint: no errors"
+  else
+    fail "publint reported errors"
+    echo "$OUT" | sed 's/^/    /'
+  fi
+else
+  echo "  ↷ SKIP: publint not installed (npx --no-install found no local package)"
+fi
+
+echo ""
+echo "══ smoke-pack-contents: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -gt 0 ] && exit 1 || exit 0

package/pipeline/scripts/smoke-plugin-validate.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+#
+# smoke-plugin-validate.sh  -  run `claude plugin validate --strict` against
+# every plugin / marketplace surface committed to this repo.
+#
+# Discovery: any directory containing `.claude-plugin/plugin.json` or
+# `.claude-plugin/marketplace.json` (node_modules excluded). The `claude`
+# CLI validates the containing directory; --strict promotes warnings
+# (unrecognized fields, missing metadata) to failures so CI catches drift
+# the runtime would silently tolerate.
+#
+# Skip semantics (exit 0 with a SKIP line):
+#   - `claude` binary not on PATH (optional tooling; billing-friendly CI
+#     runners don't install it)
+#   - no validatable surface in the repo (the marketplace plugins live in
+#     the separate multi-agent-plugins repo; this repo may carry none)
+#
+# Exit codes: 0=pass or skip, 1=validation failure
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+
+if ! command -v claude >/dev/null 2>&1; then
+  echo "SKIP smoke-plugin-validate: claude binary not on PATH"
+  exit 0
+fi
+
+# Each hit is a manifest; the validatable surface is its .claude-plugin parent's parent.
+MANIFESTS=$(find "$REPO_ROOT" \
+  -path "$REPO_ROOT/node_modules" -prune -o \
+  -path "$REPO_ROOT/coverage" -prune -o \
+  -type f -path '*/.claude-plugin/*' \( -name plugin.json -o -name marketplace.json \) -print \
+  2>/dev/null | sort)
+
+if [ -z "$MANIFESTS" ]; then
+  echo "SKIP smoke-plugin-validate: no .claude-plugin plugin/marketplace manifest in this repo"
+  exit 0
+fi
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
+
+# Validate each surface directory once, even if it carries both manifests.
+SURFACES=$(echo "$MANIFESTS" | sed 's|/\.claude-plugin/[^/]*$||' | sort -u)
+
+for surface in $SURFACES; do
+  rel="${surface#"$REPO_ROOT"/}"
+  [ "$surface" = "$REPO_ROOT" ] && rel="."
+  echo ""
+  echo "→ claude plugin validate --strict $rel"
+  if OUT=$(claude plugin validate --strict "$surface" 2>&1); then
+    pass "$rel validates clean (strict)"
+  else
+    fail "$rel failed strict validation"
+    echo "$OUT" | sed 's/^/    /'
+  fi
+done
+
+echo ""
+echo "══ smoke-plugin-validate: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -gt 0 ] && exit 1 || exit 0

package/pipeline/scripts/smoke-prune-logs.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # smoke-prune-logs.sh  -  prune-logs.sh removes per-task log dirs, honors the
-# project/task/age filters, is dry-run by default, and NEVER deletes the audit
-# trail or metrics corpus.
+# project/task/age filters, is dry-run by default, NEVER deletes the audit
+# trail or metrics corpus (even under adversarial dir names), refuses unsafe
+# log roots, and spares active task dirs.
 #
 # Exit 0 = all pass, 1 = any failure.
 
@@ -40,7 +41,7 @@ seed() {
 
 echo "→ 1. dry-run lists task dirs and deletes nothing"
 seed
-out=$(PRUNE_LOG_ROOT="$LR" bash "$PL" 2>&1)
+out=$(PRUNE_LOG_ROOT="$LR" PRUNE_GRACE_MIN=0 bash "$PL" 2>&1)
 echo "$out" | grep -q "DRY-RUN" && pass "dry-run banner shown" || fail "dry-run banner missing"
 [ -f "$LR/my-ios-app/PROJ-1/agent-state.json" ] && pass "dry-run kept task dirs" || fail "dry-run deleted a task dir"
 echo "$out" | grep -qi "preserved" && pass "dry-run states audit/metrics are preserved" || fail "no preservation note"
@@ -48,7 +49,7 @@ echo "$out" | grep -qi "preserved" && pass "dry-run states audit/metrics are pre
 echo ""
 echo "→ 2. --yes deletes task dirs but preserves audit + metrics + .counter"
 seed
-PRUNE_LOG_ROOT="$LR" bash "$PL" --yes >/dev/null 2>&1
+PRUNE_LOG_ROOT="$LR" PRUNE_GRACE_MIN=0 bash "$PL" --yes >/dev/null 2>&1
 [ -f "$LR/audit.jsonl" ] && pass "audit.jsonl preserved" || fail "audit.jsonl was deleted"
 [ -f "$LR/metrics.jsonl" ] && pass "metrics.jsonl preserved" || fail "metrics.jsonl was deleted"
 [ -f "$LR/my-ios-app/.counter" ] && pass ".counter preserved" || fail ".counter was deleted"
@@ -58,21 +59,21 @@ PRUNE_LOG_ROOT="$LR" bash "$PL" --yes >/dev/null 2>&1
 echo ""
 echo "→ 3. --project scopes deletion to one project"
 seed
-PRUNE_LOG_ROOT="$LR" bash "$PL" --project=my-ios-app --yes >/dev/null 2>&1
+PRUNE_LOG_ROOT="$LR" PRUNE_GRACE_MIN=0 bash "$PL" --project=my-ios-app --yes >/dev/null 2>&1
 [ ! -e "$LR/my-ios-app/PROJ-1" ] && pass "my-ios-app task removed" || fail "my-ios-app task survived"
 [ -f "$LR/other/PROJ-9/agent-log.md" ] && pass "other project untouched" || fail "other project was deleted"
 
 echo ""
 echo "→ 4. --task scopes deletion to one task dir"
 seed
-PRUNE_LOG_ROOT="$LR" bash "$PL" --task=PROJ-1 --yes >/dev/null 2>&1
+PRUNE_LOG_ROOT="$LR" PRUNE_GRACE_MIN=0 bash "$PL" --task=PROJ-1 --yes >/dev/null 2>&1
 [ ! -e "$LR/my-ios-app/PROJ-1" ] && pass "PROJ-1 removed" || fail "PROJ-1 survived"
 [ -f "$LR/my-ios-app/PROJ-2/tracker-state.json" ] && pass "PROJ-2 untouched" || fail "PROJ-2 was deleted"
 
 echo ""
 echo "→ 5. --older-than excludes fresh task dirs"
 seed
-out=$(PRUNE_LOG_ROOT="$LR" bash "$PL" --older-than=1 2>&1)
+out=$(PRUNE_LOG_ROOT="$LR" PRUNE_GRACE_MIN=0 bash "$PL" --older-than=1 2>&1)
 echo "$out" | grep -q "nothing" && pass "freshly-created dirs excluded by --older-than=1" || fail "--older-than did not exclude fresh dirs"
 
 echo ""
@@ -82,6 +83,55 @@ PRUNE_LOG_ROOT="$LR" bash "$PL" --bogus >/dev/null 2>&1
 PRUNE_LOG_ROOT="/nonexistent-$$-dir" bash "$PL" >/dev/null 2>&1
 [ "$?" = "0" ] && pass "missing log root exits 0 (no-op)" || fail "missing log root did not exit 0"
 
+echo ""
+echo "→ 7. adversarial dirs named like preserved files survive --yes"
+rm -rf "${LR:?}"/*
+mkdir -p "$LR/audit.jsonl" "$LR/proj/metrics.jsonl" "$LR/proj/metrics-summary.md" "$LR/proj/.counter" "$LR/proj/PROJ-5"
+echo '{}' >"$LR/audit.jsonl/agent-state.json"
+echo '{}' >"$LR/proj/metrics.jsonl/agent-log.md"
+echo '{}' >"$LR/proj/metrics-summary.md/tracker-state.json"
+echo '{}' >"$LR/proj/.counter/agent-state.json"
+echo '{}' >"$LR/proj/PROJ-5/agent-state.json"
+PRUNE_LOG_ROOT="$LR" PRUNE_GRACE_MIN=0 bash "$PL" --yes >/dev/null 2>&1
+[ -d "$LR/audit.jsonl" ] && pass "dir named audit.jsonl spared" || fail "dir named audit.jsonl deleted"
+[ -d "$LR/proj/metrics.jsonl" ] && pass "dir named metrics.jsonl spared" || fail "dir named metrics.jsonl deleted"
+[ -d "$LR/proj/metrics-summary.md" ] && pass "dir named metrics-summary.md spared" || fail "dir named metrics-summary.md deleted"
+[ -d "$LR/proj/.counter" ] && pass "dir named .counter spared" || fail "dir named .counter deleted"
+[ ! -e "$LR/proj/PROJ-5" ] && pass "normal task dir beside them still removed" || fail "normal task dir survived"
+
+echo ""
+echo "→ 8. unsafe log roots are refused (exit 2, dry-run only)"
+PRUNE_LOG_ROOT="$HOME" bash "$PL" >/dev/null 2>&1
+[ "$?" = "2" ] && pass "\$HOME as log root refused" || fail "\$HOME as log root not refused"
+GITROOT="$(mktemp -d)"
+mkdir -p "$GITROOT/.git"
+PRUNE_LOG_ROOT="$GITROOT" bash "$PL" --yes >/dev/null 2>&1
+rc=$?
+rm -rf "$GITROOT"
+[ "$rc" = "2" ] && pass "git work tree as log root refused" || fail "git work tree as log root not refused"
+
+echo ""
+echo "→ 9. default grace spares freshly-touched (active) task dirs"
+seed
+out=$(PRUNE_LOG_ROOT="$LR" bash "$PL" --yes 2>&1)
+rc=$?
+[ "$rc" = "0" ] && pass "grace run exits 0" || fail "grace run exited $rc"
+[ -f "$LR/my-ios-app/PROJ-1/agent-state.json" ] && pass "active task dir spared by default grace" || fail "default grace deleted an active task dir"
+echo "$out" | grep -qi "spared" && pass "output mentions spared active dirs" || fail "no spared-active note in output"
+PRUNE_LOG_ROOT="$LR" bash "$PL" --task=PROJ-1 --yes >/dev/null 2>&1
+[ ! -e "$LR/my-ios-app/PROJ-1" ] && pass "explicit --task bypasses the grace" || fail "--task did not bypass the grace"
+
+echo ""
+echo "→ 10. traversal-shaped --task/--project values are rejected"
+PRUNE_LOG_ROOT="$LR" bash "$PL" "--task=../evil" >/dev/null 2>&1
+[ "$?" = "2" ] && pass "--task=../evil exits 2" || fail "--task=../evil accepted"
+PRUNE_LOG_ROOT="$LR" bash "$PL" "--task=.counter" >/dev/null 2>&1
+[ "$?" = "2" ] && pass "--task=.counter (leading dot) exits 2" || fail "--task=.counter accepted"
+PRUNE_LOG_ROOT="$LR" bash "$PL" "--project=a/b" >/dev/null 2>&1
+[ "$?" = "2" ] && pass "--project=a/b exits 2" || fail "--project=a/b accepted"
+PRUNE_LOG_ROOT="$LR" bash "$PL" "--task=" >/dev/null 2>&1
+[ "$?" = "2" ] && pass "empty --task exits 2" || fail "empty --task accepted"
+
 echo ""
 echo "══ prune-logs smoke: $PASS passed, $FAIL failed ══"
 [ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-purge.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# smoke-purge.sh  -  purge.sh wipes .worktrees/ worktrees (registered and
+# orphaned), their local branches, and the project task counter; is dry-run
+# by default; preserves the main worktree, protected branches, and the
+# audit/metrics corpus; and never follows symlinks out of .worktrees/.
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PG="$ROOT/pipeline/scripts/purge.sh"
+PASS=0
+FAIL=0
+pass() {
+  PASS=$((PASS + 1))
+  echo "  ✓ $1"
+}
+fail() {
+  FAIL=$((FAIL + 1))
+  echo "  ✗ $1"
+}
+[ -f "$PG" ] || {
+  echo "FAIL: purge.sh missing" >&2
+  exit 1
+}
+
+SB="$(cd "$(mktemp -d)" && pwd -P)"
+trap 'rm -rf "$SB"' EXIT
+
+REPO="$SB/repo"
+LR="$SB/logs"
+VICTIM="$SB/victim"
+
+seed() {
+  rm -rf "$REPO" "$LR" "$VICTIM"
+  mkdir -p "$REPO" "$LR/repo" "$VICTIM"
+  echo keep >"$VICTIM/keep.txt"
+  git -C "$REPO" init -q -b main
+  git -C "$REPO" -c user.email=t@t.t -c user.name=t commit -q --allow-empty -m init
+  git -C "$REPO" worktree add -q -b feature/PROJ-1-x "$REPO/.worktrees/PROJ-1" >/dev/null 2>&1
+  git -C "$REPO" worktree add -q -b bugfix/PROJ-2-y "$REPO/.worktrees/PROJ-2" >/dev/null 2>&1
+  mkdir -p "$REPO/.worktrees/PROJ-9" # orphan: dir git no longer registers
+  echo '{}' >"$REPO/.worktrees/PROJ-9/agent-state.json"
+  ln -s "$VICTIM" "$REPO/.worktrees/evil-link" # symlink escape attempt
+  echo '7' >"$LR/repo/.counter"
+  echo audit >"$LR/audit.jsonl"
+  echo metric >"$LR/metrics.jsonl"
+}
+
+has_branch() {
+  git -C "$REPO" show-ref --verify -q "refs/heads/$1"
+}
+
+echo "→ 1. dry-run lists everything and deletes nothing"
+seed
+out=$(PURGE_LOG_ROOT="$LR" bash "$PG" --repo "$REPO" 2>&1)
+rc=$?
+[ "$rc" = "0" ] && pass "dry-run exits 0" || fail "dry-run exited $rc"
+echo "$out" | grep -q "DRY-RUN" && pass "dry-run banner shown" || fail "dry-run banner missing"
+echo "$out" | grep -q "PROJ-1" && pass "worktree PROJ-1 listed" || fail "worktree PROJ-1 not listed"
+echo "$out" | grep -q "feature/PROJ-1-x" && pass "branch listed" || fail "branch not listed"
+echo "$out" | grep -q ".counter" && pass "counter listed" || fail "counter not listed"
+[ -d "$REPO/.worktrees/PROJ-1" ] && pass "dry-run kept worktrees" || fail "dry-run deleted a worktree"
+[ -f "$LR/repo/.counter" ] && pass "dry-run kept the counter" || fail "dry-run deleted the counter"
+has_branch feature/PROJ-1-x && pass "dry-run kept branches" || fail "dry-run deleted a branch"
+
+echo ""
+echo "→ 2. --yes wipes worktrees + branches + counter, preserves the rest"
+seed
+PURGE_LOG_ROOT="$LR" bash "$PG" --repo "$REPO" --yes >/dev/null 2>&1
+rc=$?
+[ "$rc" = "0" ] && pass "--yes exits 0" || fail "--yes exited $rc"
+[ ! -e "$REPO/.worktrees/PROJ-1" ] && pass "registered worktree PROJ-1 removed" || fail "PROJ-1 survived"
+[ ! -e "$REPO/.worktrees/PROJ-2" ] && pass "registered worktree PROJ-2 removed" || fail "PROJ-2 survived"
+[ ! -e "$REPO/.worktrees/PROJ-9" ] && pass "orphan worktree dir removed" || fail "orphan PROJ-9 survived"
+! has_branch feature/PROJ-1-x && pass "branch feature/PROJ-1-x deleted" || fail "feature/PROJ-1-x survived"
+! has_branch bugfix/PROJ-2-y && pass "branch bugfix/PROJ-2-y deleted" || fail "bugfix/PROJ-2-y survived"
+has_branch main && pass "main branch preserved" || fail "main branch was deleted"
+git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1 && pass "main worktree still a git repo" || fail "main worktree destroyed"
+wt_count=$(git -C "$REPO" worktree list 2>/dev/null | wc -l | tr -d ' ')
+[ "$wt_count" = "1" ] && pass "only the main worktree remains registered" || fail "expected 1 registered worktree, got $wt_count"
+[ ! -e "$LR/repo/.counter" ] && pass "task counter removed" || fail "task counter survived"
+[ -f "$LR/audit.jsonl" ] && pass "audit.jsonl preserved" || fail "audit.jsonl was deleted"
+[ -f "$LR/metrics.jsonl" ] && pass "metrics.jsonl preserved" || fail "metrics.jsonl was deleted"
+[ -f "$VICTIM/keep.txt" ] && pass "symlink target outside repo untouched" || fail "symlink target was deleted"
+
+echo ""
+echo "→ 3. protected branch carried by a worktree survives, worktree still removed"
+seed
+git -C "$REPO" worktree add -q -b develop "$REPO/.worktrees/DEV-1" >/dev/null 2>&1
+PURGE_LOG_ROOT="$LR" bash "$PG" --repo "$REPO" --yes >/dev/null 2>&1
+[ ! -e "$REPO/.worktrees/DEV-1" ] && pass "develop worktree removed" || fail "develop worktree survived"
+has_branch develop && pass "develop branch preserved" || fail "develop branch was deleted"
+
+echo ""
+echo "→ 4. clean repo and non-repo are no-ops (exit 0)"
+CLEAN="$SB/clean"
+mkdir -p "$CLEAN"
+git -C "$CLEAN" init -q -b main
+out=$(PURGE_LOG_ROOT="$LR" bash "$PG" --repo "$CLEAN" 2>&1)
+rc=$?
+{ [ "$rc" = "0" ] && echo "$out" | grep -q "nothing to do"; } && pass "clean repo is a no-op" || fail "clean repo not a clean no-op (rc=$rc)"
+PLAIN="$SB/plain"
+mkdir -p "$PLAIN"
+out=$(bash "$PG" --repo "$PLAIN" 2>&1)
+rc=$?
+{ [ "$rc" = "0" ] && echo "$out" | grep -q "not a git work tree"; } && pass "non-repo dir is a no-op" || fail "non-repo dir not a clean no-op (rc=$rc)"
+
+echo ""
+echo "→ 5. usage errors exit 2"
+bash "$PG" --bogus >/dev/null 2>&1
+[ "$?" = "2" ] && pass "unknown argument exits 2" || fail "unknown argument did not exit 2"
+bash "$PG" --repo >/dev/null 2>&1
+[ "$?" = "2" ] && pass "--repo without a path exits 2" || fail "--repo without a path did not exit 2"
+
+echo ""
+echo "→ 6. --delete-remote without a remote warns but does not fail"
+seed
+out=$(PURGE_LOG_ROOT="$LR" bash "$PG" --repo "$REPO" --delete-remote 2>&1)
+echo "$out" | grep -q "remote branch origin/feature/PROJ-1-x" && pass "dry-run lists remote branch deletion" || fail "dry-run missing remote branch line"
+out=$(PURGE_LOG_ROOT="$LR" bash "$PG" --repo "$REPO" --delete-remote --yes 2>&1)
+rc=$?
+[ "$rc" = "0" ] && pass "--delete-remote --yes exits 0 without a remote" || fail "--delete-remote --yes exited $rc"
+echo "$out" | grep -qi "warning" && pass "missing remote surfaces a warning" || fail "no warning for missing remote"
+
+echo ""
+echo "→ 7. purge from inside a linked worktree still anchors on the main repo"
+seed
+out=$(PURGE_LOG_ROOT="$LR" bash "$PG" --repo "$REPO/.worktrees/PROJ-1" --yes 2>&1)
+rc=$?
+[ "$rc" = "0" ] && pass "run from linked worktree exits 0" || fail "run from linked worktree exited $rc"
+[ ! -e "$REPO/.worktrees/PROJ-1" ] && pass "worktrees removed when invoked from inside one" || fail "worktrees survived"
+git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1 && pass "main repo intact" || fail "main repo destroyed"
+
+echo ""
+echo "══ purge smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-shadow-git.sh

@@ -98,8 +98,22 @@ else
   record_fail "node_modules leaked into shadow tracking"
 fi
 
-# Make a real edit + snapshot
+# 7b. Forced excludes apply even when NOT in the project .gitignore
+# (DerivedData is not in this fixture's .gitignore; it must be excluded via
+# the shadow repo's .git/info/exclude).
+mkdir -p DerivedData && echo "buildjunk" > DerivedData/junk.txt
+bash "$SG" snapshot "$TASK_ID" "$TMP" "derived-data-probe" >/dev/null 2>&1
+if ! git --git-dir="$HOME/.claude/state/shadow-git/$TASK_ID/.git" --work-tree="$TMP" \
+     ls-files 2>/dev/null | grep -q "^DerivedData/"; then
+  record_pass "DerivedData NOT tracked (forced exclude in .git/info/exclude)"
+else
+  record_fail "DerivedData leaked into shadow tracking (forced excludes dead)"
+fi
+rm -rf DerivedData
+
+# Make a real edit + a brand-new file + snapshot
 echo "hello-changed" > a.txt
+echo "post-baseline" > b.txt
 sha_edit=$(bash "$SG" snapshot "$TASK_ID" "$TMP" "edited a.txt" 2>/dev/null | head -1)
 if [ -n "$sha_edit" ] && [ "${#sha_edit}" -ge 7 ]; then
   record_pass "snapshot after edit produced a sha: $sha_edit"
@@ -115,6 +129,7 @@ else
 fi
 
 # 8. Restore the baseline
+echo "never-snapshotted" > c.txt   # created after the last snapshot
 baseline_sha=$(bash "$SG" list "$TASK_ID" 2>/dev/null | tail -1 | awk '{print $1}')
 bash "$SG" restore "$TASK_ID" "$TMP" "$baseline_sha" --files >/dev/null 2>&1
 if [ "$(cat "$TMP/a.txt")" = "hello" ]; then
@@ -123,6 +138,23 @@ else
   record_fail "restore did not revert a.txt (got '$(cat "$TMP/a.txt")')"
 fi
 
+# 8b. Restore removes files that did not exist in the snapshot
+if [ ! -f "$TMP/b.txt" ]; then
+  record_pass "restore removed b.txt (committed after baseline)"
+else
+  record_fail "restore left b.txt in place (created after snapshot must be removed)"
+fi
+if [ ! -f "$TMP/c.txt" ]; then
+  record_pass "restore removed c.txt (never snapshotted)"
+else
+  record_fail "restore left c.txt in place (untracked new file must be removed)"
+fi
+if [ -f "$TMP/node_modules/x.txt" ]; then
+  record_pass "restore left ignored node_modules untouched"
+else
+  record_fail "restore deleted ignored files (node_modules must survive clean)"
+fi
+
 # 9. Prune
 bash "$SG" prune "$TASK_ID" >/dev/null 2>&1
 if [ ! -d "$HOME/.claude/state/shadow-git/$TASK_ID" ]; then
@@ -131,6 +163,21 @@ else
   record_fail "prune did not remove the shadow dir"
 fi
 
+# 9b. Task-id validation: traversal and separator ids are rejected before any
+# rm -rf (a "prune .." must never delete ~/.claude/state).
+for bad_id in ".." "." "a/b" "-x!"; do
+  if bash "$SG" prune "$bad_id" >/dev/null 2>&1; then
+    record_fail "prune accepted unsafe task id '$bad_id'"
+  else
+    record_pass "prune rejects unsafe task id '$bad_id'"
+  fi
+done
+if [ -d "$HOME/.claude/state" ]; then
+  record_pass "~/.claude/state survived unsafe prune attempts"
+else
+  record_fail "~/.claude/state is GONE after unsafe prune attempts"
+fi
+
 cd - >/dev/null
 rm -rf "$TMP"
 

package/pipeline/scripts/smoke-skill-authoring.sh

@@ -51,7 +51,7 @@ TARGETS=(
 
 # Collect the list once.
 SKILLS=$(find "${TARGETS[@]}" -name 'SKILL.md' -type f 2>/dev/null | sort)
-SKILL_COUNT=$(echo "$SKILLS" | grep -c . || echo 0)
+SKILL_COUNT=$(echo "$SKILLS" | grep -c . || true)
 
 echo "→ Scope: $SKILL_COUNT authored SKILL.md files under shared/core/"
 echo "  (external/ intentionally excluded  -  upstream conventions)"

package/pipeline/scripts/smoke-update-check.sh

@@ -67,6 +67,19 @@ else
   record_fail "local-ahead should be silent (got '$out', rc=$rc)"
 fi
 
+# 3b2. No --local, no repo clone -> falls back to the install-time version
+# marker (npx-only installs have no clone to read a version from)
+marker_home="$tmpdir/marker-home"
+mkdir -p "$marker_home/.claude"
+printf '10.0.0\n' > "$marker_home/.claude/.pipeline-version"
+printf '%s|99.0.0\n' "$now" > "$CACHE"
+out=$(HOME="$marker_home" UPDATE_CHECK_CACHE="$CACHE" bash "$SCRIPT" 2>/dev/null); rc=$?
+if [ "$rc" -eq 0 ] && [ "$out" = "10.0.0|99.0.0" ]; then
+  record_pass "no clone -> .pipeline-version marker fallback works"
+else
+  record_fail "marker fallback should print '10.0.0|99.0.0' (got '$out', rc=$rc)"
+fi
+
 # 3c. Offline + stale cache -> silent exit 0 (advisory: never blocks)
 printf '0|10.0.0\n' > "$CACHE"
 out=$(UPDATE_CHECK_CACHE="$CACHE" http_proxy="http://127.0.0.1:1" https_proxy="http://127.0.0.1:1" \