@mmerterden/multi-agent-pipeline 11.4.0 → 12.0.0

package/pipeline/lib/fetch-confluence.sh

@@ -67,15 +67,17 @@ if [ -z "$URL" ] && [ -z "$PAGE_ID" ]; then
   exit 4
 fi
 
-# Resolve host + pageId from URL when not given explicitly.
-URL_PARSE_INPUT="$URL" URL_HOST_OVERRIDE="$HOST_OVERRIDE" URL_PAGE_ID="$PAGE_ID" \
-PARSED=$(python3 - <<'PY'
-import os, sys, re
+# Resolve host + pageId from URL when not given explicitly. Inputs are passed
+# as argv: an env prefix on a plain assignment (VAR=x PARSED=$(...)) never
+# reaches the child process, so os.environ would always come back empty.
+PARSED=$(python3 - "$URL" "$HOST_OVERRIDE" "$PAGE_ID" <<'PY'
+import sys, re
 import urllib.parse as up
 
-url = os.environ.get("URL_PARSE_INPUT", "")
-host_override = os.environ.get("URL_HOST_OVERRIDE", "")
-explicit_id = os.environ.get("URL_PAGE_ID", "")
+argv = sys.argv[1:] + ["", "", ""]
+url = argv[0]
+host_override = argv[1]
+explicit_id = argv[2]
 
 host = host_override
 page_id = explicit_id
@@ -124,12 +126,22 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Confluence_Access_Token"
 
-TOKEN=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+# Locate the credential helper via the resolver so Copilot-only installs work.
+# shellcheck disable=SC1090,SC1091
+. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"confluence","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+
+TOKEN=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$TOKEN" ]; then
   printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"confluence","expected_key":"'"$TOKEN_KEY"'"}' >&2
   exit 2
 fi
 
+# Bearer auth via a curl config fed through process substitution so the token
+# never appears in argv (argv is visible to ps).
+confluence_auth_cfg() { printf 'header = "Authorization: Bearer %s"\n' "$TOKEN"; }
+
 # Endpoint resolution: Confluence Cloud (<tenant>.atlassian.net/wiki/rest/api)
 # vs Server/Data Center (<host>/rest/api). The same paths exist on both.
 case "$HOST" in
@@ -141,14 +153,14 @@ esac
 if [ -z "$PAGE_ID_RESOLVED" ] && [ -n "$SPACE_KEY" ] && [ -n "$URL" ]; then
   TITLE_RAW=$(python3 -c "
 import urllib.parse as up
-import os, re
-p = up.urlparse(os.environ['URL_PARSE_INPUT'])
+import sys, re
+p = up.urlparse(sys.argv[1])
 m = re.match(r'/display/[^/]+/(.+)', p.path)
 print(up.unquote(m.group(1)) if m else '')
-" URL_PARSE_INPUT="$URL")
+" "$URL")
   if [ -n "$TITLE_RAW" ]; then
     LOOKUP=$(curl -sS --fail --max-time "$TIMEOUT" --connect-timeout 5 \
-      -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" \
+      -K <(confluence_auth_cfg) -H "Accept: application/json" \
       --data-urlencode "spaceKey=$SPACE_KEY" \
       --data-urlencode "title=$TITLE_RAW" \
       --data-urlencode "expand=" \
@@ -172,7 +184,7 @@ fi
 
 # Fetch the page body in storage format.
 PAGE_JSON=$(curl -sS --fail --max-time "$TIMEOUT" --connect-timeout 5 \
-  -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" \
+  -K <(confluence_auth_cfg) -H "Accept: application/json" \
   "$API_BASE/content/$PAGE_ID_RESOLVED?expand=body.storage,space" 2>/dev/null || true)
 
 if [ -z "$PAGE_JSON" ]; then

package/pipeline/lib/fetch-crashlytics.sh

@@ -124,22 +124,40 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Firebase_Access_Json"
 
-SA_JSON_B64=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+# Locate the credential helper via the resolver so Copilot-only installs work.
+# shellcheck disable=SC1090,SC1091
+. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"firebase","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+
+SA_JSON_B64=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$SA_JSON_B64" ]; then
   printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"firebase","expected_key":"'"$TOKEN_KEY"'"}' >&2
   exit 2
 fi
 
 # The credential store may return raw JSON or base64-encoded JSON (the user's
-# setup convention). Try base64-decode first, fall back to raw.
+# setup convention). Try base64-decode first, fall back to raw. The decoded
+# payload contains a GCP private key, so it goes into a 0600 mktemp file with
+# cleanup traps registered BEFORE the secret is written.
+SA_TMP=""
+cleanup_sa_tmp() {
+  if [ -n "$SA_TMP" ]; then rm -f "$SA_TMP"; fi
+}
+trap cleanup_sa_tmp EXIT
+trap 'cleanup_sa_tmp; exit 130' INT
+trap 'cleanup_sa_tmp; exit 143' TERM
+SA_TMP=$(umask 077; mktemp "${TMPDIR:-/tmp}/fc-sa.XXXXXX")
+
 SA_JSON=""
-if printf '%s' "$SA_JSON_B64" | base64 -d > /tmp/.fc-sa-$$.json 2>/dev/null \
-   && python3 -c "import json; json.load(open('/tmp/.fc-sa-$$.json'))" 2>/dev/null; then
-  SA_JSON=$(cat /tmp/.fc-sa-$$.json)
+if printf '%s' "$SA_JSON_B64" | base64 -d > "$SA_TMP" 2>/dev/null \
+   && python3 -c "import json, sys; json.load(open(sys.argv[1]))" "$SA_TMP" 2>/dev/null; then
+  SA_JSON=$(cat "$SA_TMP")
 else
   SA_JSON="$SA_JSON_B64"
 fi
-rm -f /tmp/.fc-sa-$$.json
+rm -f "$SA_TMP"
+SA_TMP=""
 
 # Verify project_id from SA JSON matches the URL  -  protects against pasting a
 # crash URL from another GCP project than the keychain's SA covers.
@@ -235,6 +253,10 @@ if [ -z "$ACCESS_TOKEN" ]; then
   exit 3
 fi
 
+# Bearer auth via a curl config fed through process substitution so the token
+# never appears in argv (argv is visible to ps).
+crashlytics_auth_cfg() { printf 'header = "Authorization: Bearer %s"\n' "$ACCESS_TOKEN"; }
+
 # Construct the appId in the form Firebase expects:
 #   ios:   ios:<bundleId>   →  api: /projects/<n>/apps/<bundleId> (looked up via list)
 #   android: android:<package>
@@ -245,7 +267,7 @@ APP_REF="$PLATFORM:$BUNDLE"
 ISSUE_URL_API="https://firebasecrashlytics.googleapis.com/v1alpha/projects/$PROJECT_ID/apps/$APP_REF/issues/$ISSUE_ID"
 
 ISSUE_JSON=$(curl -sS --fail --max-time "$TIMEOUT" --connect-timeout 5 \
-  -H "Authorization: Bearer $ACCESS_TOKEN" -H "Accept: application/json" \
+  -K <(crashlytics_auth_cfg) -H "Accept: application/json" \
   "$ISSUE_URL_API" 2>/dev/null || true)
 
 if [ -z "$ISSUE_JSON" ]; then
@@ -257,7 +279,7 @@ SESSION_JSON=""
 if [ -n "$SESSION_ID" ]; then
   SESSION_URL_API="$ISSUE_URL_API/sessions/$SESSION_ID"
   SESSION_JSON=$(curl -sS --fail --max-time "$TIMEOUT" --connect-timeout 5 \
-    -H "Authorization: Bearer $ACCESS_TOKEN" -H "Accept: application/json" \
+    -K <(crashlytics_auth_cfg) -H "Accept: application/json" \
     "$SESSION_URL_API" 2>/dev/null || true)
 fi
 

package/pipeline/lib/fetch-fortify.sh

@@ -128,7 +128,13 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Fortify_Access_Token"
 
-TOKEN=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+# Locate the credential helper via the resolver so Copilot-only installs work.
+# shellcheck disable=SC1090,SC1091
+. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"fortify","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+
+TOKEN=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$TOKEN" ]; then
   printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"fortify","expected_key":"'"$TOKEN_KEY"'"}' >&2
   exit 2
@@ -153,8 +159,11 @@ fortify_get() {
     else
       hdr="Authorization: FortifyToken $(printf '%s' "$TOKEN" | base64 | tr -d '\n')"
     fi
+    # Auth header goes through a curl config via process substitution so the
+    # token never appears in argv (argv is visible to ps).
     resp=$(curl -sS --max-time "$TIMEOUT" --connect-timeout 5 -w "\n%{http_code}" \
-             -H "$hdr" -H "Accept: application/json" "$url" 2>/dev/null || true)
+             -K <(printf 'header = "%s"\n' "$hdr") \
+             -H "Accept: application/json" "$url" 2>/dev/null || true)
     http=$(printf '%s' "$resp" | tail -n1)
     if [ "$http" = "200" ]; then
       printf '%s' "$resp" | sed '$d'

package/pipeline/lib/fetch-swagger.sh

@@ -57,13 +57,21 @@ trap 'rm -f "$TMP_RAW"' EXIT
 # platform; we let curl run with --output then check the size).
 CURL_ARGS=(-sS --fail --max-time "$TIMEOUT" --connect-timeout 5 --location --output "$TMP_RAW" \
            --write-out "%{http_code}\n%{content_type}\n%{size_download}\n")
-if [ -n "${SWAGGER_AUTH_HEADER:-}" ]; then
-  CURL_ARGS+=(-H "$SWAGGER_AUTH_HEADER")
-fi
 
-if ! META=$(curl "${CURL_ARGS[@]}" "$URL" 2>/dev/null); then
-  echo "ERR: swagger fetch failed for $URL" >&2
-  exit 2
+# The optional auth header may carry a token, so it is fed through a curl
+# config via process substitution instead of argv (argv is visible to ps).
+swagger_auth_cfg() { printf 'header = "%s"\n' "$SWAGGER_AUTH_HEADER"; }
+
+if [ -n "${SWAGGER_AUTH_HEADER:-}" ]; then
+  META=$(curl "${CURL_ARGS[@]}" -K <(swagger_auth_cfg) "$URL" 2>/dev/null) || {
+    echo "ERR: swagger fetch failed for $URL" >&2
+    exit 2
+  }
+else
+  META=$(curl "${CURL_ARGS[@]}" "$URL" 2>/dev/null) || {
+    echo "ERR: swagger fetch failed for $URL" >&2
+    exit 2
+  }
 fi
 
 HTTP_CODE=$(printf '%s\n' "$META" | sed -n '1p')
@@ -88,7 +96,10 @@ case "$LOWER_CT" in
   *yaml*|*yml*) FORMAT="yaml" ;;
   *json*)       FORMAT="json" ;;
   *)
-    case "${URL,,}" in
+    # Lowercase via tr: the bash-4 case-conversion expansion is not
+    # available on macOS /bin/bash 3.2.
+    LOWER_URL=$(printf '%s' "$URL" | tr '[:upper:]' '[:lower:]')
+    case "$LOWER_URL" in
       *.yaml|*.yml) FORMAT="yaml" ;;
       *)            FORMAT="json" ;;
     esac

package/pipeline/lib/figma-mcp-refresh.sh

@@ -44,16 +44,20 @@ CLIENT_ID=$(jq -r '.client_id // empty' "$OAUTH_CONFIG")
 CLIENT_SECRET=$(jq -r '.client_secret // empty' "$OAUTH_CONFIG")
 [ -n "$CLIENT_ID" ] || { say "figma-mcp-refresh: client_id missing in .figma-oauth.json"; exit 2; }
 
-CURL_ARGS=(
-  --data-urlencode "grant_type=refresh_token"
-  --data-urlencode "refresh_token=${REFRESH_TOKEN}"
-  --data-urlencode "client_id=${CLIENT_ID}"
-)
-[ -n "$CLIENT_SECRET" ] && CURL_ARGS+=( --data-urlencode "client_secret=${CLIENT_SECRET}" )
+# Refresh token + client secret go through a curl config fed via process
+# substitution so they never appear in argv (argv is visible to ps).
+refresh_grant_cfg() {
+  printf 'data-urlencode = "grant_type=refresh_token"\n'
+  printf 'data-urlencode = "refresh_token=%s"\n' "$REFRESH_TOKEN"
+  printf 'data-urlencode = "client_id=%s"\n' "$CLIENT_ID"
+  if [ -n "$CLIENT_SECRET" ]; then
+    printf 'data-urlencode = "client_secret=%s"\n' "$CLIENT_SECRET"
+  fi
+}
 
 RESPONSE=$(curl -s --max-time 20 -X POST "$TOKEN_ENDPOINT" \
   -H "Content-Type: application/x-www-form-urlencoded" \
-  "${CURL_ARGS[@]}")
+  -K <(refresh_grant_cfg))
 
 NEW_ACCESS=$(printf '%s' "$RESPONSE" | jq -r '.access_token // empty' 2>/dev/null || true)
 NEW_REFRESH=$(printf '%s' "$RESPONSE" | jq -r '.refresh_token // empty' 2>/dev/null || true)
@@ -65,14 +69,25 @@ if [ -z "$NEW_ACCESS" ]; then
   exit 1
 fi
 
+# Keychain write: the add-generic-password command is fed to `security -i`
+# over stdin instead of the direct `security add-generic-password -w <secret>`
+# argv form, so the secret never shows up in process listings. printf is a
+# bash builtin, so no argv exposure there either. Attributes match the
+# previous direct call (-T "" -U). Figma tokens are URL-safe, so embedding in
+# the quoted command string is safe.
+save_keychain_secret() {
+  local service="$1" secret="$2"
+  security delete-generic-password -s "$service" -a "$ACCOUNT" >/dev/null 2>&1 || true
+  printf 'add-generic-password -U -s "%s" -a "%s" -T "" -w "%s"\n' \
+    "$service" "$ACCOUNT" "$secret" | security -i >/dev/null
+}
+
 # Save new access token first, then the rotated refresh token  -  order matters so a
 # mid-write failure never leaves us with a lost refresh token AND a stale access token.
-security delete-generic-password -s "$KEY_NAME" -a "$ACCOUNT" >/dev/null 2>&1 || true
-security add-generic-password -s "$KEY_NAME" -a "$ACCOUNT" -w "$NEW_ACCESS" -T "" -U
+save_keychain_secret "$KEY_NAME" "$NEW_ACCESS"
 
 if [ -n "$NEW_REFRESH" ]; then
-  security delete-generic-password -s "$REFRESH_KEY" -a "$ACCOUNT" >/dev/null 2>&1 || true
-  security add-generic-password -s "$REFRESH_KEY" -a "$ACCOUNT" -w "$NEW_REFRESH" -T "" -U
+  save_keychain_secret "$REFRESH_KEY" "$NEW_REFRESH"
 fi
 
 say "figma-mcp-refresh: renewed '$KEY_NAME' (expires_in=${EXPIRES_IN}s, refresh $( [ -n "$NEW_REFRESH" ] && echo rotated || echo unchanged ))"

package/pipeline/lib/figma-screenshot.sh

@@ -42,7 +42,14 @@ set -euo pipefail
 # --- Globals ----------------------------------------------------------------
 
 PREFS="$HOME/.claude/multi-agent-preferences.json"
-CRED_STORE="$HOME/.claude/lib/credential-store.sh"
+# Locate the credential helper via the resolver so Copilot-only installs work.
+# The helper is optional here: the FIGMA_PAT env fallback still applies when
+# no helper is installed, so a resolver miss must not abort the script.
+# shellcheck disable=SC1090,SC1091
+. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+  || true
+CRED_STORE="${CRED_STORE:-}"
 FIGMA_API="https://api.figma.com/v1"
 PARALLEL_DL=4
 HTTP_TIMEOUT=60
@@ -170,9 +177,11 @@ curl_figma() {
   local out="$1" url="$2"
   local code attempt sleep_s
   for attempt in 1 2 3; do
+    # Token header goes through a curl config via process substitution so it
+    # never appears in argv (argv is visible to ps).
     code=$(curl -sS -o "$out" -w '%{http_code}' \
               --max-time "$HTTP_TIMEOUT" --connect-timeout 5 \
-              -H "X-Figma-Token: $FIGMA_TOKEN" \
+              -K <(printf 'header = "X-Figma-Token: %s"\n' "$FIGMA_TOKEN") \
               "$url" || echo "000")
     case "$code" in
       2*) printf '%s' "$code"; return 0 ;;

package/pipeline/lib/issue-fetcher.sh

@@ -49,11 +49,21 @@ PROMPT_LANG="${PROMPT_LANG:-tr}"
 detect_kind() {
   local in="$1"
   case "$in" in
-    *atlassian.net/browse/*|*jira*/browse/*|http*://*/browse/*) echo "jira-url" ;;
-    *github.com/*/issues/*) echo "gh-url" ;;
-    [A-Z]*-[0-9]*) echo "jira-id" ;;
+    *atlassian.net/browse/*|*jira*/browse/*|http*://*/browse/*) echo "jira-url"; return ;;
+    *github.com/*/issues/*) echo "gh-url"; return ;;
+    [A-Z]*-[0-9]*) echo "jira-id"; return ;;
+  esac
+  # Bare issue number ("316" or "#316") must resolve BEFORE the repo#N glob:
+  # `*\#[0-9]*` also matches "#316" with an empty repo prefix, which used to
+  # misroute it to gh-short and build https://github.com/<owner>//issues/316.
+  local num="${in#\#}"
+  case "$num" in
+    "") ;;
+    *[!0-9]*) ;;
+    *) echo "gh-num"; return ;;
+  esac
+  case "$in" in
     *\#[0-9]*) echo "gh-short" ;;
-    [0-9]*) echo "gh-num" ;;
     *) echo "freetext" ;;
   esac
 }
@@ -87,19 +97,34 @@ branch_for() {
 }
 
 # --- Provider fetchers (return raw JSON or empty) -----------------------------
+
+# Bearer-auth via a curl config fed through process substitution so the
+# token never appears in argv (argv is visible to `ps` / process audit).
+jira_auth_cfg() { printf 'header = "Authorization: Bearer %s"\n' "$1"; }
+
 fetch_jira() {
   local key="$1"
   if [ -z "$JIRA_HOST" ] || [ -z "$JIRA_TOKEN_KEY" ]; then
     echo "ERR: ACCOUNT_JIRA_HOST and ACCOUNT_JIRA_TOKEN_KEY must be set" >&2
     return 1
   fi
+  # Resolve the credential helper via the shared resolver (works from the
+  # repo checkout and from both install trees)  -  never hardcode the path.
+  # A pre-set CRED_STORE (tests, custom installs) is honored as-is.
+  if [ -z "${CRED_STORE:-}" ]; then
+    # shellcheck disable=SC1090,SC1091
+    . "$(cd "$(dirname "$0")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
+      || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+      || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+      || { echo "ERR: credential helper not found" >&2; return 1; }
+  fi
   local token
-  token=$("$HOME/.claude/lib/credential-store.sh" get "$JIRA_TOKEN_KEY" 2>/dev/null || true)
+  token=$("$CRED_STORE" get "$JIRA_TOKEN_KEY" 2>/dev/null || true)
   if [ -z "$token" ]; then
     echo "ERR: Jira token not found in credential store ($JIRA_TOKEN_KEY)" >&2
     return 1
   fi
-  curl -sf -H "Authorization: Bearer $token" \
+  curl -sf -K <(jira_auth_cfg "$token") \
     "https://$JIRA_HOST/rest/api/2/issue/$key?fields=summary,status,issuetype,description,priority,resolution,fixVersions" \
     || { echo "ERR: Jira fetch failed for $key" >&2; return 1; }
 }

package/pipeline/lib/multi-repo-pipeline.sh

@@ -81,11 +81,15 @@ cmd_prepare() {
 }
 
 cmd_commit() {
-  list_repos_jq | while IFS=$'\t' read -r name url provider; do
+  # Process substitution (not a pipe) so the `failed` counter survives the
+  # loop  -  a piped `while` runs in a subshell and the summary exit would
+  # always be 0 regardless of per-repo failures.
+  local failed=0
+  while IFS=$'\t' read -r name url provider; do
     local target="$WORKTREE_ROOT/$name"
     [ ! -d "$target" ] && continue
     cd "$target"
-    # Use status --porcelain so untracked files count as "changes" too  - 
+    # Use status --porcelain so untracked files count as "changes" too  -
     # dev sessions usually add brand-new files alongside edits, and `git diff`
     # alone misses them.
     if [ -z "$(git status --porcelain 2>/dev/null)" ]; then
@@ -98,30 +102,45 @@ cmd_commit() {
     [ -n "$ISSUE_KEY" ] && subject="$subject [$ISSUE_KEY]"
     # Trim subject to 72 chars
     subject=$(printf '%s' "$subject" | cut -c1-72)
-    git commit --quiet -m "$subject" || true
+    if git commit --quiet -m "$subject"; then
+      echo "[$name] committed: $subject"
+    else
+      echo "ERR: [$name] commit failed" >&2
+      failed=$((failed + 1))
+    fi
     cd - >/dev/null
-    echo "[$name] committed: $subject"
-  done
+  done < <(list_repos_jq)
+  if [ "$failed" -gt 0 ]; then
+    echo "ERR: commit failed in $failed repo(s)" >&2
+    return 3
+  fi
 }
 
 cmd_push() {
-  list_repos_jq | while IFS=$'\t' read -r name url provider; do
+  local failed=0
+  while IFS=$'\t' read -r name url provider; do
     local target="$WORKTREE_ROOT/$name"
     [ ! -d "$target" ] && continue
     cd "$target"
-    git push --quiet -u origin "$BRANCH" || echo "[$name] push failed"
+    if git push --quiet -u origin "$BRANCH"; then
+      echo "[$name] pushed $BRANCH"
+    else
+      echo "ERR: [$name] push failed" >&2
+      failed=$((failed + 1))
+    fi
     cd - >/dev/null
-    echo "[$name] pushed $BRANCH"
-  done
+  done < <(list_repos_jq)
+  if [ "$failed" -gt 0 ]; then
+    echo "ERR: push failed in $failed repo(s)" >&2
+    return 3
+  fi
 }
 
 cmd_pr() {
   # Open PR for extras first, then primary with cross-links.
-  local primary_name primary_owner_repo
+  local primary_name failed=0
   primary_name=$(python3 -c "import json; d=json.load(open('$STATE')); print(d['primary']['name'])")
-  # Extra-repo PR URLs are passed to the primary PR via the _prs.log file below,
-  # not a shell var  -  the loop runs in a pipe subshell, so any accumulated var
-  # would be lost. The file-based handoff is intentional.
+  # Extra-repo PR URLs are passed to the primary PR via the _prs.log file below.
   while IFS=$'\t' read -r name url provider; do
     if [ "$name" = "$primary_name" ]; then continue; fi
     local target="$WORKTREE_ROOT/$name"
@@ -130,8 +149,16 @@ cmd_pr() {
     if [ "$provider" = "github" ] && command -v gh >/dev/null 2>&1; then
       local body="Ref: $ISSUE_KEY
 Part of multi-repo task $TASK_ID."
-      gh pr create --title "$COMMIT_TYPE($name): $ISSUE_TITLE" --body "$body" --fill 2>/dev/null \
-        | tee -a "$WORKTREE_ROOT/_prs.log" || echo "[$name] gh pr create failed"
+      # Capture output first: in `gh ... | tee ... || echo failed` the `||`
+      # binds to tee, so a gh failure was silently reported as success.
+      local pr_out
+      if pr_out=$(gh pr create --title "$COMMIT_TYPE($name): $ISSUE_TITLE" --body "$body" --fill 2>/dev/null); then
+        printf '%s\n' "$pr_out" | tee -a "$WORKTREE_ROOT/_prs.log"
+        echo "[$name] PR created"
+      else
+        echo "ERR: [$name] gh pr create failed" >&2
+        failed=$((failed + 1))
+      fi
     else
       echo "[$name] PR creation skipped (provider=$provider)"
     fi
@@ -147,17 +174,54 @@ Part of multi-repo task $TASK_ID."
   local body="Ref: $ISSUE_KEY
 $extras_links"
   if command -v gh >/dev/null 2>&1; then
-    gh pr create --title "$COMMIT_TYPE($primary_name): $ISSUE_TITLE" --body "$body" --fill 2>/dev/null \
-      || echo "[$primary_name] gh pr create failed"
+    if gh pr create --title "$COMMIT_TYPE($primary_name): $ISSUE_TITLE" --body "$body" --fill 2>/dev/null; then
+      echo "[$primary_name] PR created"
+    else
+      echo "ERR: [$primary_name] gh pr create failed" >&2
+      failed=$((failed + 1))
+    fi
   fi
   cd - >/dev/null
+  if [ "$failed" -gt 0 ]; then
+    echo "ERR: PR creation failed for $failed repo(s)" >&2
+    return 3
+  fi
 }
 
+# Resolve a directory to its physical path ("" when it does not resolve).
+resolve_dir() { (cd "$1" 2>/dev/null && pwd -P); }
+
 cmd_teardown() {
-  if [ -d "$WORKTREE_ROOT" ]; then
-    echo "[teardown] removing $WORKTREE_ROOT (logs preserved at ~/.claude/logs/multi-agent/$TASK_ID/)"
-    rm -rf "$WORKTREE_ROOT"
+  if [ ! -d "$WORKTREE_ROOT" ]; then
+    echo "[teardown] nothing to remove ($WORKTREE_ROOT not a directory)"
+    return 0
+  fi
+  # Guard the rm -rf: worktreeRoot comes from state.json, so a corrupted or
+  # malicious value ("." / ".." / "~") must never delete the project, the
+  # home directory, or the filesystem root. Resolve the physical path and
+  # refuse when it equals or contains the current project root or $HOME.
+  local rp cwd home_rp
+  rp=$(resolve_dir "$WORKTREE_ROOT") || rp=""
+  cwd=$(pwd -P)
+  home_rp=$(resolve_dir "$HOME") || home_rp="$HOME"
+  if [ -z "$rp" ] || [ "$rp" = "/" ] || [ "$rp" = "$home_rp" ] || [ "$rp" = "$cwd" ]; then
+    echo "ERR: refusing teardown  -  unsafe worktreeRoot '$WORKTREE_ROOT' (resolved: '${rp:-unresolvable}')" >&2
+    return 4
   fi
+  case "$cwd/" in
+    "$rp"/*)
+      echo "ERR: refusing teardown  -  '$rp' contains the current project root" >&2
+      return 4
+      ;;
+  esac
+  case "$home_rp/" in
+    "$rp"/*)
+      echo "ERR: refusing teardown  -  '$rp' contains the home directory" >&2
+      return 4
+      ;;
+  esac
+  echo "[teardown] removing $rp (logs preserved at ~/.claude/logs/multi-agent/$TASK_ID/)"
+  rm -rf "$rp"
 }
 
 # Emit agent-state.json v2.1.0 from picker state.json so Phase 0 can consume it directly.

package/pipeline/lib/plan-todos.sh

@@ -61,7 +61,10 @@ resolve_state() {
 
 write_state() {
   local path="$1" content="$2"
-  local tmp; tmp=$(mktemp)
+  # mktemp NEXT TO the target: a $TMPDIR temp file can live on a different
+  # filesystem than $HOME, where mv degrades to copy+unlink and loses the
+  # atomic-rename guarantee.
+  local tmp; tmp=$(mktemp "${path}.XXXXXX")
   printf '%s\n' "$content" > "$tmp"
   mv "$tmp" "$path"
 }
@@ -93,6 +96,12 @@ do_set() {
     echo "plan-todos: input must be an object with .title (string) and .todos (array)" >&2
     exit 2
   fi
+  # Per-item validation: every todo needs a string .id and .task, otherwise
+  # downstream jq like `.id + "\t" + .task` crashes on (null + string).
+  if ! jq -e '.todos | all(type == "object" and (.id | type == "string") and (.task | type == "string"))' <<<"$plan_blob" >/dev/null 2>&1; then
+    echo "plan-todos: every todo must be an object with string .id and .task fields" >&2
+    exit 2
+  fi
   local state_path; state_path=$(resolve_state "$task_id")
   local now; now=$(iso_now)
   local new
@@ -209,7 +218,7 @@ do_next() {
           )
       )
     | (.[0] // empty)
-    | if . == null or . == "" then "" else .id + "\t" + .task end
+    | if . == null or . == "" then "" else (.id // "") + "\t" + (.task // "") end
   ' "$state_path"
 }
 
@@ -229,7 +238,7 @@ do_list() {
           skipped:    "- [/]",
           failed:     "- [!]"
         } as $marks
-        | ($marks[.status] // "- [ ]") + " **" + .id + "** " + .task
+        | ($marks[.status] // "- [ ]") + " **" + (.id // "") + "** " + (.task // "")
           + (if (.notes // "") != "" then "  _(" + .notes + ")_" else "" end)
           + (if (.failureReason // "") != "" then "  _**failed:** " + .failureReason + "_" else "" end)
           + (if (.skipReason    // "") != "" then "  _**skipped:** "    + .skipReason    + "_" else "" end))

package/pipeline/lib/post-pr-review.sh

@@ -75,9 +75,11 @@ ITERATION=$(jq -r '.review.iterationNumber // 1' "$AGENT_STATE")
 # --- Decision ---------------------------------------------------------------
 
 # Single jq pass  -  group accepted findings by severity into tab-separated counts.
+# `.review.findings // []` so a null/absent findings array (clean review)
+# cannot raise "Cannot iterate over null" under set -e.
 read -r ACCEPTED_BLOCKING ACCEPTED_IMPORTANT < <(
   jq -r '
-    [.review.findings[] | select(.status == "accepted")] as $a
+    [(.review.findings // [])[] | select(.status == "accepted")] as $a
     | [($a | map(select(.severity == "blocking")) | length),
        ($a | map(select(.severity == "important")) | length)]
     | @tsv
@@ -242,7 +244,7 @@ post_github() {
   fi
 
   if [ "$DECISION" = "needs_work" ]; then
-    jq -c '.review.findings[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
+    jq -c '(.review.findings // [])[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
     | while read -r finding; do
         local sev path line issue_b64 fix_b64 rule_id_b64 issue fix rule_id body fingerprint
         IFS=$'\t' read -r sev path line issue_b64 fix_b64 rule_id_b64 < <(
@@ -333,7 +335,7 @@ post_bitbucket_server() {
   fi
 
   if [ "$DECISION" = "needs_work" ]; then
-    jq -c '.review.findings[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
+    jq -c '(.review.findings // [])[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
     | while read -r finding; do
         local sev path line issue_b64 fix_b64 rule_id_b64 issue fix rule_id body payload http fingerprint
         IFS=$'\t' read -r sev path line issue_b64 fix_b64 rule_id_b64 < <(