@mmerterden/multi-agent-pipeline 11.4.0 → 12.0.0

package/pipeline/commands/multi-agent/review/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Run parallel review on a branch's diff or a Pull Request: 2 models on Claude Code (Fable + Sonnet), 3 models on Copilot CLI (GPT + Opus + Sonnet). On PR input, posts per-finding inline comments and sets approve/needs-work review state."
+description-tr: "Bir branch diff'i veya Pull Request üzerinde paralel review koşar: Claude Code'da 2 model (Fable + Sonnet), Copilot CLI'da 3 model (GPT + Opus + Sonnet). PR girdisinde bulgu başına inline yorum atar ve approve/needs-work durumunu işaretler."
 argument-hint: "[#N | repo#N | PR-URL | branch]  -  optional: PR by number/URL, repo+number, or local branch. Supports GitHub and Bitbucket Server URLs. If omitted (interactive), open GitHub + Bitbucket PRs are listed for multi-select; autopilot falls back to the current branch."
 ---
 

package/pipeline/commands/multi-agent/review-issue/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Assess whether a GitHub issue is ready for multi-agent development: fetch it, grade scope / acceptance criteria / repro / design / API / stack readiness, then (after confirm) post the gaps as an issue comment. Read-only on code."
+description-tr: "Bir GitHub issue'sunun multi-agent geliştirmeye hazır olup olmadığını değerlendirir: getirir; kapsam / kabul kriterleri / repro / tasarım / API / stack hazırlığını puanlar, sonra (onay sonrası) eksikleri issue yorumu olarak gönderir. Kodda salt-okunur."
 argument-hint: "[#N | repo#N | GitHub issue URL]  -  optional; with no argument, pick from open issues"
 ---
 

package/pipeline/commands/multi-agent/review-jira/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Assess whether a Jira issue is ready for multi-agent development: fetch it, grade scope / acceptance criteria / repro / design / API / stack readiness, then (after confirm) post the gaps as a Jira comment. Read-only on code."
+description-tr: "Bir Jira issue'sunun multi-agent geliştirmeye hazır olup olmadığını değerlendirir: getirir; kapsam / kabul kriterleri / repro / tasarım / API / stack hazırlığını puanlar, sonra (onay sonrası) eksikleri Jira yorumu olarak gönderir. Kodda salt-okunur."
 argument-hint: "[JIRA-KEY | Jira URL]  -  optional; with no argument, pick from your open Jira issues"
 ---
 

package/pipeline/commands/multi-agent/scan/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Skill security scan: walks local skill directories against a tiered pattern catalog."
+description-tr: "Skill güvenlik taraması: yerel skill dizinlerini kademeli desen kataloğuna göre tarar."
 allowed-tools: Bash, Read
 argument-hint: "[--strict] [--threshold critical|high|medium|low] [--json] [--root PATH]"
 ---

package/pipeline/commands/multi-agent/search/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Log search across every agent-log.md with smart ranking and filters. Optional --semantic flag queries the per-repo triage corpus."
+description-tr: "Tüm agent-log.md dosyalarında akıllı sıralama ve filtrelerle log araması. İsteğe bağlı --semantic bayrağı repo bazlı triyaj korpusunu sorgular."
 allowed-tools: Bash, Read
 argument-hint: "\"query\" [--project NAME] [--since 7d] [--phase N] [--semantic] [--json|--tsv]"
 ---

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "First-run setup wizard: keychain token discovery, Git Identity onboarding, and pipeline preparation."
+description-tr: "İlk kurulum sihirbazı: keychain token keşfi, Git Identity kaydı ve pipeline hazırlığı."
 allowed-tools: Bash, Read, Write, AskUserQuestion, WebFetch
 ---
 

package/pipeline/commands/multi-agent/stack/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Select the active stack for this repo by enabling the matching marketplace plugin(s) in .claude/settings.json (ios/android/mobile/backend/frontend/fullstack/all)."
+description-tr: "Bu repo için aktif stack'i seçer: eşleşen marketplace plugin'lerini .claude/settings.json'da etkinleştirir (ios/android/mobile/backend/frontend/fullstack/all)."
 allowed-tools: Bash, Read, Edit, Write
 ---
 

package/pipeline/commands/multi-agent/status/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Show every multi-agent task's ID, phase, branch, and status."
+description-tr: "Tüm multi-agent görevlerinin ID, faz, branch ve durumunu gösterir."
 ---
 
 # multi-agent status  -  Task Status Dashboard

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "One-shot sync of the entire multi-agent ecosystem: Claude Code, Copilot CLI, pipeline repo, and website."
+description-tr: "Tüm multi-agent ekosisteminin tek atımlık senkronu: Claude Code, Copilot CLI, pipeline repo ve website."
 argument-hint: "[release] [--platform=<macos|linux|windows>]"
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, WebFetch
 ---
@@ -130,6 +131,23 @@ If nothing is stale → report "All targets up to date" and stop.
        ~/multi-agent-pipeline/pipeline/commands/ 2>/dev/null \
        && { echo "ABORT: corporate reference leaked into pipeline/commands"; exit 1; } || true
      ```
+   - **Localized picker descriptions are an installed-tree artifact.** When
+     `outputLanguage=tr`, the installed `description:` values are Turkish and a
+     `description-en:` sidecar holds the English original (see
+     `localize-commands.mjs`). The repo must ALWAYS receive the English form:
+     after copying commands into `pipeline/commands/`, normalize the copy and
+     verify no sidecar or Turkish description leaked:
+     ```bash
+     # normalize: restore English descriptions, strip description-en sidecars
+     node ~/multi-agent-pipeline/pipeline/scripts/localize-commands.mjs restore \
+       --dir ~/multi-agent-pipeline/pipeline/commands/multi-agent
+     # backstop: no sidecar may survive into the repo
+     grep -rl "^description-en:" ~/multi-agent-pipeline/pipeline/commands/ 2>/dev/null \
+       && { echo "ABORT: description-en sidecar leaked into pipeline/commands"; exit 1; } || true
+     # backstop: repo description lines must be English (Turkish-diacritics proxy)
+     grep -rn '^description:.*[çğıöşüÇĞİÖŞÜ]' ~/multi-agent-pipeline/pipeline/commands/ 2>/dev/null \
+       && { echo "ABORT: localized description leaked into pipeline/commands"; exit 1; } || true
+     ```
 
 6. **Cross-platform smoke gate** (final step of the REPO sync, before push):
    ```bash
@@ -242,11 +260,11 @@ This runs on the Claude <-> Copilot axis — the two CLIs the pipeline supports
 **38 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
-analysis, analysis-resolve, autopilot, build-optimize, channels, create-jira, delete, dev,
+analysis, analysis-resolve, autopilot, build-optimize, channels, create-jira, dev,
 dev-autopilot, dev-local, dev-local-autopilot, diff-explain, finish, garbage-collect,
 help, issue, jira, kill, language, local,
 local-autopilot, log, manual-test, prune-logs, purge, refactor, resume, review, review-issue, review-jira,
-scan, search, setup, stack, status, sync, test, update
+scan, search, setup, stack, status, sync, test, uninstall, update
 ```
 
 **NOT synced**: `$HOME/.claude/multi-agent-refs/*`  -  lazy-load references, Claude Code specific

package/pipeline/commands/multi-agent/test/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "UI Bug Hunter  -  iOS Simulator (simctl) + Android Emulator (adb). Auto-detects platform. Screenshot + tap + analyze on the booted device. The Phase 5 Manual Test flow lives at /multi-agent:manual-test."
+description-tr: "UI Bug Hunter - iOS Simulator (simctl) + Android Emulator (adb). Platformu otomatik algılar. Açık cihazda screenshot + tap + analiz. Faz 5 Manuel Test akışı /multi-agent:manual-test'te."
 argument-hint: '[scenario]  -  e.g. "dark mode" | "accessibility" | "dynamic type" | "screenshot tr" | "store-ready" | (empty = full sweep)'
 ---
 

package/pipeline/commands/multi-agent/uninstall/SKILL.md

@@ -0,0 +1,87 @@
+---
+description: "Uninstall the pipeline from Claude Code + Copilot CLI. Keychain access tokens are always left untouched; --all-data also clears pipeline settings and logs. Asks for double confirmation."
+description-tr: "Pipeline'ı Claude Code + Copilot CLI'dan kaldırır. Keychain erişim token'larına asla dokunulmaz; --all-data ayrıca pipeline ayarlarını ve loglarını da siler. Çift onay ister."
+argument-hint: "[--dry-run] [--all-data] [--claude] [--copilot] [--target=<path>]"
+---
+
+# multi-agent uninstall  -  Token-Preserving Uninstall
+
+Uninstalls the pipeline itself from the system. **This is different from `:purge`:**
+
+| Command | What it removes |
+|---|---|
+| `:purge` | Active tasks' worktrees / branches / logs / state (development data) |
+| `:uninstall` | The pipeline itself: skills, commands, agents, scripts  -  from every CLI |
+
+## Two modes
+
+| Mode | Flag | Removes | Keeps |
+|---|---|---|---|
+| **Standard** (default) | (none) | distributed files: commands, skills, agents, scripts, refs, schemas, lib | tokens, `CLAUDE.md`, `rules/`, `multi-agent-preferences.json`, all logs |
+| **Full cleanup** | `--all-data` | standard PLUS `multi-agent-preferences.json` + `~/.claude/logs/multi-agent/` (task logs, state, metrics, audit) | tokens, `CLAUDE.md`, `rules/` (user-owned) |
+
+Tokens in the OS credential store are NEVER removed by either mode.
+
+## Never deleted (either mode)
+
+- **Keychain / Credential Manager / libsecret** personal access tokens (GitHub, Jira, Bitbucket, Confluence, Telegram, Vercel, Firebase, etc.)
+- `~/.claude/CLAUDE.md` (user customisations)
+- `~/.claude/rules/` (user-owned; installed write-if-missing, never overwritten)
+- User content OUTSIDE the `<!-- multi-agent-pipeline:begin/end -->` markers (`copilot-instructions.md`)
+
+Settings (`multi-agent-preferences.json`) and the log root (`~/.claude/logs/multi-agent/`) are kept by default and removed only when the user picks full cleanup (`--all-data`).
+
+## Steps
+
+1. **Determine scope**  -  parse `$ARGUMENTS`:
+   - No target flag: every installed target (default)
+   - `--claude / --copilot`: selective
+   - `--all-data`: full cleanup (also removes settings + logs)
+   - `--target=<path>`: adapter target (default: cwd)
+   - `--dry-run`: report only, delete nothing
+
+2. **Ask the cleanup depth** (skip if the user already passed `--all-data` or `--dry-run`)  -  native `AskUserQuestion` picker in `outputLanguage`:
+   - `question`: "How much should uninstall remove? Tokens are preserved either way."
+   - `header`: "Scope" · `options`:
+     `{ label: "Standard", description: "Remove pipeline files; keep settings + logs" }`,
+     `{ label: "Full cleanup", description: "Also remove settings + all task logs/state/metrics" }`
+   - **Full cleanup** adds `--all-data` to the flag set below.
+
+3. **Show a preview** (run the script with `--dry-run`, carrying the chosen flags):
+   ```bash
+   node "$HOME/.claude/scripts/uninstall.mjs" --dry-run --yes <flags>
+   ```
+   Show the output raw to the user. In full-cleanup mode the preview lists the extra settings + log removals.
+
+4. **First confirmation**  -  native `AskUserQuestion` picker (no typed y/N):
+   - `question`: "Remove the pipeline from the listed targets? Tokens are NOT touched." (`outputLanguage`)
+   - `header`: "Uninstall" · `options`: `{ label: "Continue", description: "Proceed to the final confirmation" }`, `{ label: "Cancel", description: "Keep everything installed" }`
+   - **Cancel** → exit.
+
+5. **Second confirmation** (paranoia gate, same pattern as `:purge`)  -  a second `AskUserQuestion` picker:
+   - `question`: full cleanup -> "This also erases settings + all logs and is irreversible. Proceed?"; standard -> "This is irreversible. Permanently remove the pipeline files now?" (`outputLanguage`)
+   - `header`: "Confirm" · `options`: `{ label: "Remove permanently", description: "Run the uninstall; tokens are preserved" }`, `{ label: "Cancel", description: "Abort, change nothing" }`
+   - Anything other than **Remove permanently** → cancel.
+
+6. **Remove**  -  run the real script with `--yes` (and `--all-data` if full cleanup was chosen):
+   ```bash
+   node "$HOME/.claude/scripts/uninstall.mjs" --yes <flags>
+   ```
+
+7. **Confirm**:
+   ```
+   ✓ multi-agent-pipeline removed.
+   ℹ Personal access tokens preserved in Keychain.
+   ```
+   Remind the user how to inspect the tokens (cross-platform  -  same command on every backend):
+   - `~/.claude/lib/credential-store.sh get "<service>"`
+
+8. **Reinstall** (if the user wants to):
+   ```bash
+   npx @mmerterden/multi-agent-pipeline install
+   ```
+
+## Notes
+
+- This command does NOT remove the *installed copy* of the npm package. It only removes the distributed files. `npm uninstall -g @mmerterden/multi-agent-pipeline` is a separate step.
+- `--dry-run` is always safe  -  zero side effects.

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Update the pipeline to the latest version: git pull, install, migrate."
+description-tr: "Pipeline'ı son sürüme günceller: git pull, install, migrate."
 allowed-tools: Bash, Read, Write, AskUserQuestion
 ---
 

package/pipeline/lib/account-resolver.sh

@@ -63,10 +63,23 @@ except Exception:
 
 # 1. Pull every credential entry that looks like one of our token services.
 #    Includes token entries AND username entries (BB needs the user keychain key).
-#    Uses cross-platform credential-store wrapper (macOS/Windows/Linux backends).
-services=$("$HOME/.claude/lib/credential-store.sh" list 2>/dev/null \
-  | grep -E '_(Github|Jira|Bitbucket|Confluence)_[A-Za-z]+_(Token|Json|Username)$|_Github_Auth_Token$|_Github_Access_Token$|_Jira_Access_Token$|_Bitbucket_Access_Token$|_Bitbucket_Username$|_Confluence_Access_Token$' \
-  || true)
+#    Uses cross-platform credential-store wrapper (macOS/Windows/Linux backends),
+#    located via the shared resolver (repo checkout or either install tree)  -
+#    never a hardcoded path. A missing helper degrades to an empty inventory.
+# A pre-set CRED_STORE (tests, custom installs) is honored as-is.
+if [ -z "${CRED_STORE:-}" ]; then
+  # shellcheck disable=SC1090,SC1091
+  . "$(cd "$(dirname "$0")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
+    || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+    || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+    || true
+fi
+services=""
+if [ -n "${CRED_STORE:-}" ]; then
+  services=$("$CRED_STORE" list 2>/dev/null \
+    | grep -E '_(Github|Jira|Bitbucket|Confluence)_[A-Za-z]+_(Token|Json|Username)$|_Github_Auth_Token$|_Github_Access_Token$|_Jira_Access_Token$|_Bitbucket_Access_Token$|_Bitbucket_Username$|_Confluence_Access_Token$' \
+    || true)
+fi
 
 # 2. Compute unique prefixes (everything before the provider segment).
 prefixes=$(printf '%s\n' "$services" \
@@ -114,14 +127,6 @@ emit_accounts() {
       [ $match -eq 0 ] && continue
     fi
 
-    # Provider list
-    local prov_json=""
-    [ -n "$gh_token" ]   && prov_json="${prov_json}\"github\","
-    [ -n "$jira_token" ] && prov_json="${prov_json}\"jira\","
-    [ -n "$bb_token" ]   && prov_json="${prov_json}\"bitbucket\","
-    [ -n "$conf_token" ] && prov_json="${prov_json}\"confluence\","
-    prov_json="${prov_json%,}"
-
     # Work-account heuristic: bitbucket+jira together indicates corporate.
     local is_work="false"
     if [ -n "$bb_token" ] && [ -n "$jira_token" ]; then
@@ -134,18 +139,18 @@ emit_accounts() {
 
     # Hosts: per-account override (prefs.global.accounts[].jiraHost) wins; falls
     # back to global.hosts.{jira,bitbucket}; otherwise null. No hardcoded values.
-    local jira_host="null" bb_host="null"
+    local jira_host="" bb_host=""
     local per_jira per_bb
     per_jira=$(account_host_override "$short_id" "jiraHost")
     per_bb=$(account_host_override "$short_id" "bitbucketHost")
     if [ -n "$jira_token" ]; then
-      if   [ -n "$per_jira" ];        then jira_host="\"$per_jira\""
-      elif [ -n "$prefs_jira_host" ]; then jira_host="\"$prefs_jira_host\""
+      if   [ -n "$per_jira" ];        then jira_host="$per_jira"
+      elif [ -n "$prefs_jira_host" ]; then jira_host="$prefs_jira_host"
       fi
     fi
     if [ -n "$bb_token" ]; then
-      if   [ -n "$per_bb" ];        then bb_host="\"$per_bb\""
-      elif [ -n "$prefs_bb_host" ]; then bb_host="\"$prefs_bb_host\""
+      if   [ -n "$per_bb" ];        then bb_host="$per_bb"
+      elif [ -n "$prefs_bb_host" ]; then bb_host="$prefs_bb_host"
       fi
     fi
 
@@ -185,12 +190,45 @@ emit_accounts() {
     [ $first -eq 0 ] && printf ','
     first=0
 
-    printf '{"id":"%s","label":"%s","prefix":"%s","providers":[%s],"tokens":{"github":"%s","jira":"%s","bitbucket":"%s","confluence":"%s"},"userKeys":{"bitbucket":"%s"},"users":{"github":"%s"},"jiraHost":%s,"bitbucketHost":%s,"isWork":%s}' \
-      "$short_id" "$label" "$prefix" "$prov_json" \
-      "$gh_token" "$jira_token" "$bb_token" "$conf_token" \
-      "$bb_user_key" \
-      "$gh_user" \
-      "$jira_host" "$bb_host" "$is_work"
+    # Build the entry with python3 from env vars  -  printf-interpolated JSON
+    # has zero escaping, so a quote or backslash in a keychain service name
+    # would corrupt the whole array. Values cross into python via the
+    # environment, never via string interpolation.
+    ACC_ID="$short_id" ACC_LABEL="$label" ACC_PREFIX="$prefix" \
+    ACC_GH_TOKEN="$gh_token" ACC_JIRA_TOKEN="$jira_token" \
+    ACC_BB_TOKEN="$bb_token" ACC_CONF_TOKEN="$conf_token" \
+    ACC_BB_USER_KEY="$bb_user_key" ACC_GH_USER="$gh_user" \
+    ACC_JIRA_HOST="$jira_host" ACC_BB_HOST="$bb_host" ACC_IS_WORK="$is_work" \
+    python3 - <<'PY'
+import json, os
+
+def env(name):
+    return os.environ.get(name, "")
+
+providers = []
+if env("ACC_GH_TOKEN"):   providers.append("github")
+if env("ACC_JIRA_TOKEN"): providers.append("jira")
+if env("ACC_BB_TOKEN"):   providers.append("bitbucket")
+if env("ACC_CONF_TOKEN"): providers.append("confluence")
+
+print(json.dumps({
+    "id":        env("ACC_ID"),
+    "label":     env("ACC_LABEL"),
+    "prefix":    env("ACC_PREFIX"),
+    "providers": providers,
+    "tokens": {
+        "github":     env("ACC_GH_TOKEN"),
+        "jira":       env("ACC_JIRA_TOKEN"),
+        "bitbucket":  env("ACC_BB_TOKEN"),
+        "confluence": env("ACC_CONF_TOKEN"),
+    },
+    "userKeys": {"bitbucket": env("ACC_BB_USER_KEY")},
+    "users":    {"github": env("ACC_GH_USER")},
+    "jiraHost":      env("ACC_JIRA_HOST") or None,
+    "bitbucketHost": env("ACC_BB_HOST") or None,
+    "isWork":        env("ACC_IS_WORK") == "true",
+}, ensure_ascii=False), end="")
+PY
   done <<< "$prefixes"
   printf ']'
 }

package/pipeline/lib/channels-multi-repo.sh

@@ -26,6 +26,11 @@ STATE="${2:-}"
 }
 [ ! -f "$STATE" ] && { echo "ERR: state file not found: $STATE" >&2; exit 2; }
 
+# count_matches: single-line numeric grep -c (the bare `grep -c || echo 0`
+# idiom emits "0" twice on zero matches and breaks the -le comparisons below).
+# shellcheck source=count-lib.sh disable=SC1091
+. "$(cd "$(dirname "$0")" && pwd)/count-lib.sh"
+
 # --- Helpers ----------------------------------------------------------------
 # Extract the targets array from agent-state.json. Output: TSV with columns
 # repoName, prUrl, isPrimary (1/0). One target per row.
@@ -156,7 +161,7 @@ do_render_jira() {
   local urls
   urls=$(all_pr_urls | tr ' ' '\n' | grep -v '^$' || true)
   local count
-  count=$(printf '%s\n' "$urls" | grep -c . || echo 0)
+  count=$(printf '%s\n' "$urls" | count_matches .)
 
   if [ "$count" -le 1 ]; then
     cat "$body_file"
@@ -179,7 +184,7 @@ do_render_conf() {
   local urls
   urls=$(all_pr_urls | tr ' ' '\n' | grep -v '^$' || true)
   local count
-  count=$(printf '%s\n' "$urls" | grep -c . || echo 0)
+  count=$(printf '%s\n' "$urls" | count_matches .)
 
   if [ "$count" -le 1 ]; then
     cat "$body_file"

package/pipeline/lib/count-lib.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# count-lib.sh  -  shared counting helper for pipeline shell scripts.
+#
+# Why: `grep -c` prints "0" AND exits 1 when nothing matches, so the common
+# idiom `$(grep -c pattern file || echo 0)` emits TWO lines ("0" plus the
+# fallback "0"). That breaks arithmetic (`$((x + 0\n0))` is a syntax error)
+# and numeric comparisons (`[ "0\n0" -le 1 ]` silently evaluates false).
+#
+# count_matches guarantees single-line numeric output in every case:
+#   - match count when grep succeeds
+#   - "0" when nothing matches or grep itself errors (missing file, ...)
+#
+# Usage (same arguments as grep -c, file or stdin):
+#   n=$(count_matches -E 'pattern' "$file")
+#   n=$(printf '%s\n' "$blob" | count_matches .)
+#
+# Source from a sibling script:
+#   . "$(cd "$(dirname "$0")" && pwd)/count-lib.sh"
+
+count_matches() {
+  local n
+  n=$(grep -c "$@" 2>/dev/null) || true
+  case "$n" in
+    '' | *[!0-9]*) n=0 ;;
+  esac
+  printf '%s\n' "$n"
+}

package/pipeline/lib/credential-store.sh

@@ -8,6 +8,9 @@
 # Subcommands:
 #   get <key>            Read secret value to stdout (empty + exit 1 if missing)
 #   set <key> <value>    Store secret (overwrites if exists)
+#   set <key> -          Same, but read the secret from stdin. Preferred:
+#                        keeps the secret off this script's argv (visible to
+#                        ps). A literal "-" value cannot be stored this way.
 #   delete <key>         Remove secret
 #   list                 List all keys (one per line)
 #   platform             Print detected platform: macos | windows | linux | unknown
@@ -124,7 +127,11 @@ if (\$c) { \$c.GetNetworkCredential().Password }
 
 do_set() {
   local key="${1:-}" val="${2:-}"
-  [ -z "$key" ] && { echo "usage: $0 set <key> <value>" >&2; exit 3; }
+  [ -z "$key" ] && { echo "usage: $0 set <key> <value|->" >&2; exit 3; }
+  # "-" means: read the secret from stdin (keeps it off argv).
+  if [ "$val" = "-" ]; then
+    val=$(cat)
+  fi
   if delegate_to_python; then
     # Pass the value via stdin to keep it out of process listings / shell history.
     printf '%s' "$val" | python3 "$KEYCHAIN_PY" set "$key" -
@@ -132,7 +139,15 @@ do_set() {
   fi
   case "$PLATFORM" in
     macos)
-      security add-generic-password -s "$key" -a "${USER:-claude}" -w "$val" -U >/dev/null 2>&1
+      # `security -i` reads the add command from stdin, so the secret never
+      # lands on the `security` argv (visible to ps). printf is a bash
+      # builtin, so no argv exposure there either. Double quotes/backslashes
+      # are escaped for security's interactive tokenizer.
+      local key_sec val_sec
+      key_sec=${key//\\/\\\\}; key_sec=${key_sec//\"/\\\"}
+      val_sec=${val//\\/\\\\}; val_sec=${val_sec//\"/\\\"}
+      printf 'add-generic-password -U -s "%s" -a "%s" -w "%s"\n' \
+        "$key_sec" "${USER:-claude}" "$val_sec" | security -i >/dev/null 2>&1
       ;;
     linux)
       require_cmd secret-tool "Install libsecret-tools (see doctor)."
@@ -140,11 +155,13 @@ do_set() {
       ;;
     windows)
       # Escape single quotes for PowerShell single-quoted strings ('' = literal ').
-      local key_esc="${key//\'/\'\'}" val_esc="${val//\'/\'\'}"
-      # CredentialManager module: New-StoredCredential
-      ps_run "
+      local key_esc="${key//\'/\'\'}"
+      # The secret is piped via stdin ([Console]::In) so it never appears on
+      # the PowerShell argv (visible to process listings).
+      printf '%s' "$val" | ps_run "
 \$ErrorActionPreference='Stop'
-\$pwd = ConvertTo-SecureString '$val_esc' -AsPlainText -Force
+\$raw = [Console]::In.ReadToEnd()
+\$pwd = ConvertTo-SecureString \$raw -AsPlainText -Force
 New-StoredCredential -Target '$key_esc' -UserName '${USER:-${USERNAME:-claude}}' -SecurePassword \$pwd -Persist LocalMachine | Out-Null
 " >/dev/null
       ;;

package/pipeline/lib/extract-conventions.sh

@@ -40,6 +40,12 @@ if ! command -v jq >/dev/null 2>&1; then
   exit 1
 fi
 
+# count_matches: single-line numeric grep -c. The bare `grep -c || echo 0`
+# idiom emits "0" twice on zero matches, which turns the $((...)) counter
+# arithmetic below into a silent syntax error that zeroes the bucket.
+# shellcheck source=count-lib.sh disable=SC1091
+. "$(cd "$(dirname "$0")" && pwd)/count-lib.sh"
+
 # ---- global timing budget -----------------------------------------------------
 SCRIPT_START_EPOCH=$(date +%s)
 GLOBAL_BUDGET_SEC=180
@@ -672,16 +678,16 @@ bucket_test_method_naming() {
     [ -z "$f" ] && continue
     case "$PLATFORM" in
       ios|android)
-        underscore_count=$((underscore_count + $(grep -cE 'func +test[A-Za-z0-9]+_[A-Za-z0-9_]+' "$f" 2>/dev/null || echo 0)))
-        underscore_count=$((underscore_count + $(grep -cE 'fun +[A-Za-z0-9]+_[A-Za-z0-9_]+_[A-Za-z0-9_]+ *\(' "$f" 2>/dev/null || echo 0)))
-        camel_count=$((camel_count + $(grep -cE 'func +test[A-Z][A-Za-z0-9]+ *\(' "$f" 2>/dev/null || echo 0)))
-        backtick_count=$((backtick_count + $(grep -cE '`[^`]*`\s*\(' "$f" 2>/dev/null || echo 0)))
+        underscore_count=$((underscore_count + $(count_matches -E 'func +test[A-Za-z0-9]+_[A-Za-z0-9_]+' "$f")))
+        underscore_count=$((underscore_count + $(count_matches -E 'fun +[A-Za-z0-9]+_[A-Za-z0-9_]+_[A-Za-z0-9_]+ *\(' "$f")))
+        camel_count=$((camel_count + $(count_matches -E 'func +test[A-Z][A-Za-z0-9]+ *\(' "$f")))
+        backtick_count=$((backtick_count + $(count_matches -E '`[^`]*`\s*\(' "$f")))
         ;;
       backend)
-        underscore_count=$((underscore_count + $(grep -cE '^def +test_[a-z0-9_]+' "$f" 2>/dev/null || echo 0)))
+        underscore_count=$((underscore_count + $(count_matches -E '^def +test_[a-z0-9_]+' "$f")))
         ;;
       frontend)
-        it_count=$((it_count + $(grep -cE "(it|test)\\(['\"\`]" "$f" 2>/dev/null || echo 0)))
+        it_count=$((it_count + $(count_matches -E "(it|test)\\(['\"\`]" "$f")))
         ;;
     esac
   done <<< "$test_files"
@@ -745,9 +751,9 @@ bucket_accessibility_identifier() {
       if [ -z "$sample_ids" ]; then empty_bucket; return; fi
 
       local dot_count snake_count camel_count
-      dot_count=$(printf '%s\n' "$sample_ids" | grep -cE '"[a-z]+(\.[a-zA-Z]+)+' 2>/dev/null || echo 0)
-      snake_count=$(printf '%s\n' "$sample_ids" | grep -cE '"[a-z]+_[a-z_]+' 2>/dev/null || echo 0)
-      camel_count=$(printf '%s\n' "$sample_ids" | grep -cE '"[a-z]+[A-Z][a-zA-Z]+' 2>/dev/null || echo 0)
+      dot_count=$(printf '%s\n' "$sample_ids" | count_matches -E '"[a-z]+(\.[a-zA-Z]+)+')
+      snake_count=$(printf '%s\n' "$sample_ids" | count_matches -E '"[a-z]+_[a-z_]+')
+      camel_count=$(printf '%s\n' "$sample_ids" | count_matches -E '"[a-z]+[A-Z][a-zA-Z]+')
       dot_count=${dot_count:-0}; snake_count=${snake_count:-0}; camel_count=${camel_count:-0}
 
       local evidence_json
@@ -772,9 +778,9 @@ bucket_accessibility_identifier() {
       done | head -30 || true)
       if [ -z "$ids" ]; then empty_bucket; return; fi
       local snake_count kebab_count camel_count
-      snake_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+_[a-z_]+' || echo 0)
-      kebab_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+-[a-z\-]+' || echo 0)
-      camel_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+[A-Z][a-zA-Z]+' || echo 0)
+      snake_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+_[a-z_]+')
+      kebab_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+-[a-z\-]+')
+      camel_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+[A-Z][a-zA-Z]+')
       snake_count=${snake_count:-0}; kebab_count=${kebab_count:-0}; camel_count=${camel_count:-0}
       if [ "$snake_count" -ge "$kebab_count" ] && [ "$snake_count" -ge "$camel_count" ] && [ "$snake_count" -gt 0 ]; then
         emit_bucket "snake_case testTag" "checkin_continue_button" "$(confidence_for "$snake_count")" "[]" '["kebab","camelCase"]'
@@ -797,8 +803,8 @@ bucket_accessibility_identifier() {
       done | head -50 || true)
       if [ -z "$op_ids" ]; then empty_bucket; return; fi
       local camel_count snake_count
-      camel_count=$(printf '%s\n' "$op_ids" | grep -cE '[a-z]+[A-Z][A-Za-z]+' || echo 0)
-      snake_count=$(printf '%s\n' "$op_ids" | grep -cE '[a-z]+_[a-z_]+' || echo 0)
+      camel_count=$(printf '%s\n' "$op_ids" | count_matches -E '[a-z]+[A-Z][A-Za-z]+')
+      snake_count=$(printf '%s\n' "$op_ids" | count_matches -E '[a-z]+_[a-z_]+')
       camel_count=${camel_count:-0}; snake_count=${snake_count:-0}
       if [ "$camel_count" -ge "$snake_count" ] && [ "$camel_count" -gt 0 ]; then
         emit_bucket "camelCase operationId" "createFoo" "$(confidence_for "$camel_count")" "[]" '["snake_case"]'
@@ -817,9 +823,9 @@ bucket_accessibility_identifier() {
       done | head -30 || true)
       if [ -z "$ids" ]; then empty_bucket; return; fi
       local kebab_count camel_count snake_count
-      kebab_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+-[a-z\-]+' || echo 0)
-      camel_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+[A-Z][a-zA-Z]+' || echo 0)
-      snake_count=$(printf '%s\n' "$ids" | grep -cE '"[a-z]+_[a-z_]+' || echo 0)
+      kebab_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+-[a-z\-]+')
+      camel_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+[A-Z][a-zA-Z]+')
+      snake_count=$(printf '%s\n' "$ids" | count_matches -E '"[a-z]+_[a-z_]+')
       kebab_count=${kebab_count:-0}; camel_count=${camel_count:-0}; snake_count=${snake_count:-0}
       if [ "$kebab_count" -ge "$camel_count" ] && [ "$kebab_count" -ge "$snake_count" ] && [ "$kebab_count" -gt 0 ]; then
         emit_bucket "kebab-case data-testid" 'data-testid="checkin-continue-button"' "$(confidence_for "$kebab_count")" "[]" '["camelCase","snake"]'
@@ -879,9 +885,9 @@ bucket_localization_key() {
   if [ -z "$keys" ]; then empty_bucket; return; fi
 
   local dot_count snake_count camel_count
-  dot_count=$(printf '%s\n' "$keys" | grep -cE '^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)+' || echo 0)
-  snake_count=$(printf '%s\n' "$keys" | grep -cE '^[a-z][a-z0-9]*(_[a-z0-9]+)+' || echo 0)
-  camel_count=$(printf '%s\n' "$keys" | grep -cE '^[a-z][a-zA-Z0-9]*[A-Z][a-zA-Z0-9]*' || echo 0)
+  dot_count=$(printf '%s\n' "$keys" | count_matches -E '^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)+')
+  snake_count=$(printf '%s\n' "$keys" | count_matches -E '^[a-z][a-z0-9]*(_[a-z0-9]+)+')
+  camel_count=$(printf '%s\n' "$keys" | count_matches -E '^[a-z][a-zA-Z0-9]*[A-Z][a-zA-Z0-9]*')
   dot_count=${dot_count:-0}; snake_count=${snake_count:-0}; camel_count=${camel_count:-0}
 
   if [ "$dot_count" -ge "$snake_count" ] && [ "$dot_count" -ge "$camel_count" ] && [ "$dot_count" -gt 0 ]; then
@@ -907,7 +913,7 @@ bucket_di_registration() {
       local resolver_count factory_count manual_count swinject_count
       manual_count=0; resolver_count=0; factory_count=0; swinject_count=0
       if [ -n "$configurators" ]; then
-        manual_count=$(printf '%s\n' "$configurators" | grep -c 'DependencyConfigurator' || echo 0)
+        manual_count=$(printf '%s\n' "$configurators" | count_matches 'DependencyConfigurator')
       fi
       files=$(run_find -type f -name '*.swift' 2>/dev/null || true)
       if [ -n "$files" ]; then