@mmerterden/multi-agent-pipeline 11.4.0 → 12.0.0

package/pipeline/scripts/scan-skills.sh

@@ -85,12 +85,24 @@ add_finding() {
   FINDINGS+=("$sev|$file|$line|$pattern|$message")
 }
 
-# --- Pattern scanning ---------------------------------------------------
+# --- Pattern scanning (single-pass tree-wide) ----------------------------
+#
+# Each pattern family runs as ONE grep over the whole file list instead of
+# one grep per file (the per-file design spawned thousands of processes and
+# dominated install time). Findings are tagged with (fileIdx, familyIdx,
+# seq) sort keys and re-ordered afterwards so the output is byte-identical
+# to the historical per-file scan order:
+#   per file: critical(1 shell-pipe, 2 base64-pipe, 3 eval-net, 4 bidi)
+#             high(5 js-eval / 6 py-exec, 7 credential, 8 pastebin, 9 chmod)
+#             medium(10 long-base64)  low(11 unknown-endpoint, 12 SKILL.md)
 
 # Files to consider: *.md, *.sh, *.py, *.mjs, *.js, *.ts (skill content)
 # Exclude: binary, images, large fixtures, hidden
-SCAN_LIST=$(mktemp)
-trap 'rm -f "$SCAN_LIST"' EXIT
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+SCAN_LIST="$WORK/files"
+RAW="$WORK/raw"
+: > "$RAW"
 
 find "$ROOT" -type f \
   \( -name "*.md" -o -name "*.sh" -o -name "*.py" -o -name "*.mjs" -o -name "*.js" -o -name "*.ts" \) \
@@ -98,156 +110,230 @@ find "$ROOT" -type f \
   -not -path "*/.git/*" \
   2>/dev/null > "$SCAN_LIST"
 
-scan_critical() {
-  local f="$1"
-  # curl|wget piping to shell
-  while IFS= read -r hit; do
-    [ -z "$hit" ] && continue
-    local ln="${hit%%:*}"
-    add_finding critical "$f" "$ln" "shell-pipe-exec" "curl/wget piped to shell interpreter"
-  done < <(grep -nE '(curl|wget)[^|]*\|[[:space:]]*(sh|bash|zsh|ksh|ash|dash)([[:space:]]|$)' "$f" 2>/dev/null)
+FILE_COUNT=$(wc -l < "$SCAN_LIST" | tr -d '[:space:]')
 
-  # base64 -d | shell
-  while IFS= read -r hit; do
-    [ -z "$hit" ] && continue
-    local ln="${hit%%:*}"
-    add_finding critical "$f" "$ln" "base64-pipe-exec" "base64 decoded output piped to shell"
-  done < <(grep -nE '(base64|openssl[[:space:]]+base64)[^|]*-d[^|]*\|[[:space:]]*(sh|bash|zsh|eval|sudo)' "$f" 2>/dev/null)
+# One grep invocation for a whole pattern family. xargs preserves argument
+# order, so hits come out grouped per file in SCAN_LIST order.
+tree_grep() {
+  tr '\n' '\0' < "$SCAN_LIST" | xargs -0 grep -nHE -- "$1" 2>/dev/null
+  return 0
+}
 
-  # eval $(curl|wget ...) or eval `curl ...`
-  while IFS= read -r hit; do
-    [ -z "$hit" ] && continue
-    local ln="${hit%%:*}"
-    add_finding critical "$f" "$ln" "eval-of-network" "eval of network-fetched content"
-  done < <(grep -nE 'eval[[:space:]]+(\$\([[:space:]]*(curl|wget|fetch)|`[[:space:]]*(curl|wget|fetch))' "$f" 2>/dev/null)
+# stdin: "path:line:content" grep hits -> stdout: "fileIdx|path|line|content"
+index_hits() {
+  awk -v listfile="$SCAN_LIST" '
+    BEGIN {
+      i = 0
+      while ((getline l < listfile) > 0) { i++; idx[l] = i }
+      close(listfile)
+    }
+    {
+      p = index($0, ":"); f = substr($0, 1, p - 1)
+      rest = substr($0, p + 1)
+      q = index(rest, ":"); ln = substr(rest, 1, q - 1)
+      printf "%d|%s|%s|%s\n", (f in idx ? idx[f] : 999999), f, ln, substr(rest, q + 1)
+    }'
+}
 
-  # Unicode bidi override characters  -  invisible injection attack
-  if LC_ALL=C grep -l $'\xe2\x80\xad\|\xe2\x80\xae\|\xe2\x81\xa6\|\xe2\x81\xa7\|\xe2\x81\xa8\|\xe2\x81\xa9' "$f" 2>/dev/null >/dev/null; then
-    add_finding critical "$f" "0" "unicode-bidi" "bidirectional control chars (U+202D-202E, U+2066-2069)  -  trojan source risk"
-  fi
+# stdin: bare file paths -> stdout: "fileIdx|path"
+index_files() {
+  awk -v listfile="$SCAN_LIST" '
+    BEGIN {
+      i = 0
+      while ((getline l < listfile) > 0) { i++; idx[l] = i }
+      close(listfile)
+    }
+    { printf "%d|%s\n", ($0 in idx ? idx[$0] : 999999), $0 }'
 }
 
-scan_high() {
-  local f="$1"
-  local ext="${f##*.}"
+emit_raw() {
+  # $1 fileIdx  $2 familyIdx  $3 seq  $4 sev  $5 file  $6 line  $7 pattern  $8 message
+  printf '%s|%s|%s|%s|%s|%s|%s|%s\n' "$1" "$2" "$3" "$4" "$5" "$6" "$7" "$8" >> "$RAW"
+}
+
+# Split an indexed hit "fileIdx|path|line|content" into HIT_IDX/HIT_FILE/
+# HIT_LINE/HIT_CONTENT (content may itself contain pipes  -  it is the rest).
+parse_hit() {
+  HIT_IDX="${1%%|*}"; local rest="${1#*|}"
+  HIT_FILE="${rest%%|*}"; rest="${rest#*|}"
+  HIT_LINE="${rest%%|*}"
+  HIT_CONTENT="${rest#*|}"
+}
 
+# --- critical families (rank 0  -  always at/above threshold) ------------
+
+seq=0
+while IFS= read -r hit; do
+  [ -z "$hit" ] && continue
+  parse_hit "$hit"
+  seq=$((seq+1))
+  emit_raw "$HIT_IDX" 1 "$seq" critical "$HIT_FILE" "$HIT_LINE" "shell-pipe-exec" "curl/wget piped to shell interpreter"
+done < <(tree_grep '(curl|wget)[^|]*\|[[:space:]]*(sh|bash|zsh|ksh|ash|dash)([[:space:]]|$)' | index_hits)
+
+seq=0
+while IFS= read -r hit; do
+  [ -z "$hit" ] && continue
+  parse_hit "$hit"
+  seq=$((seq+1))
+  emit_raw "$HIT_IDX" 2 "$seq" critical "$HIT_FILE" "$HIT_LINE" "base64-pipe-exec" "base64 decoded output piped to shell"
+done < <(tree_grep '(base64|openssl[[:space:]]+base64)[^|]*-d[^|]*\|[[:space:]]*(sh|bash|zsh|eval|sudo)' | index_hits)
+
+seq=0
+while IFS= read -r hit; do
+  [ -z "$hit" ] && continue
+  parse_hit "$hit"
+  seq=$((seq+1))
+  emit_raw "$HIT_IDX" 3 "$seq" critical "$HIT_FILE" "$HIT_LINE" "eval-of-network" "eval of network-fetched content"
+done < <(tree_grep 'eval[[:space:]]+(\$\([[:space:]]*(curl|wget|fetch)|`[[:space:]]*(curl|wget|fetch))' | index_hits)
+
+# Unicode bidi override characters  -  invisible injection attack
+seq=0
+while IFS= read -r row; do
+  [ -z "$row" ] && continue
+  seq=$((seq+1))
+  emit_raw "${row%%|*}" 4 "$seq" critical "${row#*|}" "0" "unicode-bidi" "bidirectional control chars (U+202D-202E, U+2066-2069)  -  trojan source risk"
+done < <(tr '\n' '\0' < "$SCAN_LIST" \
+  | LC_ALL=C xargs -0 grep -l $'\xe2\x80\xad\|\xe2\x80\xae\|\xe2\x81\xa6\|\xe2\x81\xa7\|\xe2\x81\xa8\|\xe2\x81\xa9' 2>/dev/null \
+  | index_files; true)
+
+# --- high families (rank 1) ----------------------------------------------
+
+if [ "$THRESHOLD_RANK" -ge 1 ]; then
   # JavaScript/TypeScript: eval(, new Function(, Function(
-  if [ "$ext" = "js" ] || [ "$ext" = "mjs" ] || [ "$ext" = "ts" ]; then
-    while IFS= read -r hit; do
-      [ -z "$hit" ] && continue
-      local ln="${hit%%:*}"
-      add_finding high "$f" "$ln" "js-dynamic-eval" "JavaScript dynamic code execution"
-    done < <(grep -nE '\b(eval|new[[:space:]]+Function|Function)\s*\(' "$f" 2>/dev/null)
-  fi
+  seq=0
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    parse_hit "$hit"
+    case "$HIT_FILE" in *.js|*.mjs|*.ts) ;; *) continue ;; esac
+    seq=$((seq+1))
+    emit_raw "$HIT_IDX" 5 "$seq" high "$HIT_FILE" "$HIT_LINE" "js-dynamic-eval" "JavaScript dynamic code execution"
+  done < <(tree_grep '\b(eval|new[[:space:]]+Function|Function)\s*\(' | index_hits)
 
   # Python: exec(, eval( on non-literal  -  exclude re.compile (regex) and subprocess
-  if [ "$ext" = "py" ]; then
-    while IFS= read -r hit; do
-      [ -z "$hit" ] && continue
-      local ln="${hit%%:*}"
-      local content="${hit#*:}"
-      # Skip re.compile (standard regex) and subprocess.* (legitimate process invocation)
-      echo "$content" | grep -qE '(\bre\.compile|\bre2\.compile|subprocess\.|typing\.)' && continue
-      add_finding high "$f" "$ln" "py-dynamic-exec" "Python dynamic code execution"
-    done < <(grep -nE '(^|[^a-zA-Z0-9_.])(exec|eval)[[:space:]]*\(' "$f" 2>/dev/null)
-  fi
+  seq=0
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    parse_hit "$hit"
+    case "$HIT_FILE" in *.py) ;; *) continue ;; esac
+    # Skip re.compile (standard regex) and subprocess.* (legitimate process invocation)
+    echo "$HIT_CONTENT" | grep -qE '(\bre\.compile|\bre2\.compile|subprocess\.|typing\.)' && continue
+    seq=$((seq+1))
+    emit_raw "$HIT_IDX" 6 "$seq" high "$HIT_FILE" "$HIT_LINE" "py-dynamic-exec" "Python dynamic code execution"
+  done < <(tree_grep '(^|[^a-zA-Z0-9_.])(exec|eval)[[:space:]]*\(' | index_hits)
 
   # Hardcoded API keys  -  AWS, OpenAI, GitHub, generic sk-* with length
   # Skip lines in FORBIDDEN/NEVER/example blocks (false positives from docs)
+  seq=0
   while IFS= read -r hit; do
     [ -z "$hit" ] && continue
-    local ln="${hit%%:*}"
-    # Check ±3 lines around match for documentation context markers
-    local ctx_start=$((ln - 3))
+    parse_hit "$hit"
+    # Check +/-3 lines around match for documentation context markers
+    ctx_start=$((HIT_LINE - 3))
     [ "$ctx_start" -lt 1 ] && ctx_start=1
-    local ctx_end=$((ln + 3))
-    local ctx
-    ctx=$(sed -n "${ctx_start},${ctx_end}p" "$f" 2>/dev/null)
+    ctx_end=$((HIT_LINE + 3))
+    ctx=$(sed -n "${ctx_start},${ctx_end}p" "$HIT_FILE" 2>/dev/null)
     if echo "$ctx" | grep -qiE '(FORBIDDEN|NEVER do|don.t do|example:|placeholder|sample credential|DO NOT|✗|XXX|YYY|dummy|fake.?key)'; then
       continue
     fi
-    add_finding high "$f" "$ln" "hardcoded-credential" "possible hardcoded API credential"
-  done < <(grep -nE '(AKIA[0-9A-Z]{16}|sk-(live|test|proj|ant|or)-[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{82}|gho_[A-Za-z0-9]{36}|xox[bp]-[A-Za-z0-9-]{10,})' "$f" 2>/dev/null)
+    seq=$((seq+1))
+    emit_raw "$HIT_IDX" 7 "$seq" high "$HIT_FILE" "$HIT_LINE" "hardcoded-credential" "possible hardcoded API credential"
+  done < <(tree_grep '(AKIA[0-9A-Z]{16}|sk-(live|test|proj|ant|or)-[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{82}|gho_[A-Za-z0-9]{36}|xox[bp]-[A-Za-z0-9-]{10,})' | index_hits)
 
   # Pastebin / URL shortener raw content fetching
+  seq=0
   while IFS= read -r hit; do
     [ -z "$hit" ] && continue
-    local ln="${hit%%:*}"
-    add_finding high "$f" "$ln" "pastebin-fetch" "fetch from ephemeral/obscured content host"
-  done < <(grep -nE 'https?://(pastebin\.com/raw|paste\.ee|ghostbin|hastebin|bit\.ly|tinyurl\.com|goo\.gl|t\.co|is\.gd|ow\.ly|rebrand\.ly|gist\.github\.com/[^/]+/[a-f0-9]+/raw)' "$f" 2>/dev/null)
+    parse_hit "$hit"
+    seq=$((seq+1))
+    emit_raw "$HIT_IDX" 8 "$seq" high "$HIT_FILE" "$HIT_LINE" "pastebin-fetch" "fetch from ephemeral/obscured content host"
+  done < <(tree_grep 'https?://(pastebin\.com/raw|paste\.ee|ghostbin|hastebin|bit\.ly|tinyurl\.com|goo\.gl|t\.co|is\.gd|ow\.ly|rebrand\.ly|gist\.github\.com/[^/]+/[a-f0-9]+/raw)' | index_hits)
 
   # chmod +x followed by execution on same file in same block
+  seq=0
   while IFS= read -r hit; do
     [ -z "$hit" ] && continue
-    local ln="${hit%%:*}"
-    add_finding high "$f" "$ln" "chmod-then-exec" "script made executable and immediately invoked"
-  done < <(grep -nE 'chmod[[:space:]]+\+x[[:space:]]+[^&;]+[[:space:]]*(&&|;)[[:space:]]*\./' "$f" 2>/dev/null)
-}
+    parse_hit "$hit"
+    seq=$((seq+1))
+    emit_raw "$HIT_IDX" 9 "$seq" high "$HIT_FILE" "$HIT_LINE" "chmod-then-exec" "script made executable and immediately invoked"
+  done < <(tree_grep 'chmod[[:space:]]+\+x[[:space:]]+[^&;]+[[:space:]]*(&&|;)[[:space:]]*\./' | index_hits)
+fi
 
-scan_medium() {
-  local f="$1"
+# --- medium families (rank 2) ---------------------------------------------
 
+if [ "$THRESHOLD_RANK" -ge 2 ]; then
   # Long base64 blobs  -  obfuscation indicator.
   # Skip .md files (documentation often shows example b64)  -  only scan executable content types.
-  case "$f" in
-    *.md) ;;
-    *)
-      while IFS= read -r hit; do
-        [ -z "$hit" ] && continue
-        local ln="${hit%%:*}"
-        add_finding medium "$f" "$ln" "long-base64" "base64-looking blob >200 chars (possible obfuscation)"
-      done < <(grep -nE '[A-Za-z0-9+/]{200,}={0,2}' "$f" 2>/dev/null)
-      ;;
-  esac
-}
+  seq=0
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    parse_hit "$hit"
+    case "$HIT_FILE" in *.md) continue ;; esac
+    seq=$((seq+1))
+    emit_raw "$HIT_IDX" 10 "$seq" medium "$HIT_FILE" "$HIT_LINE" "long-base64" "base64-looking blob >200 chars (possible obfuscation)"
+  done < <(tree_grep '[A-Za-z0-9+/]{200,}={0,2}' | index_hits)
+fi
 
-scan_info() {
-  local f="$1"
+# --- low families (rank 3) -------------------------------------------------
 
+if [ "$THRESHOLD_RANK" -ge 3 ]; then
   # Unknown network endpoints  -  LOW severity (informational). URLs in skills
   # are usually doc references, not exfil channels. Only the critical
   # shell-pipe-exec patterns detect active network abuse.
+  # Historical behavior: at most the first 20 URL-bearing lines per file.
+  url_re='https?://[a-zA-Z0-9._-]+'
+  allow_re="^${ALLOW_DOMAINS}\$"
+  seq=0
+  prev_file=""
+  url_lines=0
   while IFS= read -r hit; do
     [ -z "$hit" ] && continue
-    local ln="${hit%%:*}"
-    local url_line="${hit#*:}"
-    local url
-    url=$(echo "$url_line" | grep -oE 'https?://[a-zA-Z0-9._-]+' | head -1)
-    [ -z "$url" ] && continue
-    local host="${url#*://}"
+    parse_hit "$hit"
+    if [ "$HIT_FILE" != "$prev_file" ]; then
+      prev_file="$HIT_FILE"
+      url_lines=0
+    fi
+    url_lines=$((url_lines+1))
+    [ "$url_lines" -gt 20 ] && continue
+    [[ "$HIT_CONTENT" =~ $url_re ]] || continue
+    url="${BASH_REMATCH[0]}"
+    host="${url#*://}"
     host="${host%%/*}"
-    if ! echo "$host" | grep -qE "^${ALLOW_DOMAINS}$" 2>/dev/null; then
-      add_finding low "$f" "$ln" "unknown-endpoint" "network endpoint not in allow-list: $host"
+    if ! [[ "$host" =~ $allow_re ]]; then
+      seq=$((seq+1))
+      emit_raw "$HIT_IDX" 11 "$seq" low "$HIT_FILE" "$HIT_LINE" "unknown-endpoint" "network endpoint not in allow-list: $host"
     fi
-  done < <(grep -nE 'https?://[a-zA-Z0-9._-]+' "$f" 2>/dev/null | head -20)
-}
+  done < <(tree_grep 'https?://[a-zA-Z0-9._-]+' | index_hits)
 
-scan_low() {
-  local f="$1"
   # Missing SKILL.md frontmatter (only check files named SKILL.md)
-  case "$f" in
-    */SKILL.md)
-      if ! head -1 "$f" | grep -Fxq -- "---"; then
-        add_finding low "$f" "1" "missing-frontmatter" "SKILL.md without YAML frontmatter"
-      elif ! grep -qE '^description:' "$f"; then
-        add_finding low "$f" "0" "missing-description" "SKILL.md frontmatter missing 'description'"
-      fi
-      ;;
-  esac
-}
-
-# --- Run scan -----------------------------------------------------------
+  seq=0
+  file_idx=0
+  while IFS= read -r file; do
+    file_idx=$((file_idx+1))
+    [ -z "$file" ] && continue
+    case "$file" in
+      */SKILL.md)
+        if ! head -1 "$file" | grep -Fxq -- "---"; then
+          seq=$((seq+1))
+          emit_raw "$file_idx" 12 "$seq" low "$file" "1" "missing-frontmatter" "SKILL.md without YAML frontmatter"
+        elif ! grep -qE '^description:' "$file"; then
+          seq=$((seq+1))
+          emit_raw "$file_idx" 12 "$seq" low "$file" "0" "missing-description" "SKILL.md frontmatter missing 'description'"
+        fi
+        ;;
+    esac
+  done < "$SCAN_LIST"
+fi
 
-FILE_COUNT=0
-while IFS= read -r file; do
-  [ -z "$file" ] && continue
-  FILE_COUNT=$((FILE_COUNT+1))
-  scan_critical "$file"
-  scan_high "$file"
-  scan_medium "$file"
-  scan_info "$file"
-  scan_low "$file"
-done < "$SCAN_LIST"
+# Re-order into the historical per-file scan order and load into FINDINGS.
+while IFS= read -r row; do
+  [ -z "$row" ] && continue
+  rest="${row#*|}"; rest="${rest#*|}"; rest="${rest#*|}"  # drop idx|fam|seq|
+  sev="${rest%%|*}"; rest="${rest#*|}"
+  file="${rest%%|*}"; rest="${rest#*|}"
+  line="${rest%%|*}"; rest="${rest#*|}"
+  pat="${rest%%|*}"; msg="${rest#*|}"
+  add_finding "$sev" "$file" "$line" "$pat" "$msg"
+done < <(sort -t'|' -k1,1n -k2,2n -k3,3n "$RAW")
 
 # --- Report -------------------------------------------------------------
 
@@ -261,20 +347,24 @@ if [ "$JSON" -eq 1 ]; then
   printf '  "findings": [\n'
   local_i=0
   total=${#FINDINGS[@]}
-  for f in "${FINDINGS[@]:-}"; do
-    local_i=$((local_i+1))
-    sev="${f%%|*}"; rest="${f#*|}"
-    file="${rest%%|*}"; rest="${rest#*|}"
-    line="${rest%%|*}"; rest="${rest#*|}"
-    pat="${rest%%|*}"; msg="${rest#*|}"
-    # json-escape file/msg minimally
-    jf=$(printf '%s' "$file" | sed 's/"/\\"/g')
-    jm=$(printf '%s' "$msg" | sed 's/"/\\"/g')
-    printf '    { "severity": "%s", "file": "%s", "line": "%s", "pattern": "%s", "message": "%s" }' \
-      "$sev" "$jf" "$line" "$pat" "$jm"
-    [ "$local_i" -lt "$total" ] && printf ','
-    printf '\n'
-  done
+  # Guard the expansion: on an empty array "${FINDINGS[@]:-}" yields one empty
+  # word, which used to emit a spurious all-empty findings element.
+  if [ "$total" -gt 0 ]; then
+    for f in "${FINDINGS[@]}"; do
+      local_i=$((local_i+1))
+      sev="${f%%|*}"; rest="${f#*|}"
+      file="${rest%%|*}"; rest="${rest#*|}"
+      line="${rest%%|*}"; rest="${rest#*|}"
+      pat="${rest%%|*}"; msg="${rest#*|}"
+      # json-escape file/msg minimally
+      jf=$(printf '%s' "$file" | sed 's/"/\\"/g')
+      jm=$(printf '%s' "$msg" | sed 's/"/\\"/g')
+      printf '    { "severity": "%s", "file": "%s", "line": "%s", "pattern": "%s", "message": "%s" }' \
+        "$sev" "$jf" "$line" "$pat" "$jm"
+      [ "$local_i" -lt "$total" ] && printf ','
+      printf '\n'
+    done
+  fi
   printf '  ]\n}\n'
 else
   # Colored text report
@@ -295,7 +385,7 @@ else
     printf '  ✓ clean (0 findings)\n'
   else
     printf '  %sfound %d%s: critical=%d high=%d medium=%d low=%d\n\n' "$C_BLD" "$total" "$C_RST" "$CRIT" "$HIGH" "$MED" "$LOW"
-    for f in "${FINDINGS[@]:-}"; do
+    for f in "${FINDINGS[@]}"; do
       sev="${f%%|*}"; rest="${f#*|}"
       file="${rest%%|*}"; rest="${rest#*|}"
       line="${rest%%|*}"; rest="${rest#*|}"
@@ -307,7 +397,7 @@ else
         low)      ico="· "; col="$C_DIM" ;;
         *)        ico="? "; col="" ;;
       esac
-      rel="${file#$REPO_ROOT/}"
+      rel="${file#"$REPO_ROOT"/}"
       printf '  %s%s%s %-8s %s:%s  [%s]\n' "$col" "$ico" "$C_RST" "$sev" "$rel" "$line" "$pat"
       printf '     %s%s%s\n' "$C_DIM" "$msg" "$C_RST"
     done

package/pipeline/scripts/smoke-bitbucket-contract.sh

@@ -66,11 +66,20 @@ cat > "$TMP/fixture.json" <<'EOF'
 EOF
 
 # Stub curl that captures invocation and returns the fixture. PATH-shadows the
-# real curl for this smoke only.
+# real curl for this smoke only. Auth travels via `-K <config-file>` (so the
+# token never hits argv); the stub dumps the config file so the smoke can
+# assert its contents.
 cat > "$TMP/curl" <<EOF
 #!/usr/bin/env bash
-# Capture every invocation so we can assert the URL + auth header shape.
+# Capture every invocation so we can assert the URL + auth config shape.
 echo "INVOCATION:" "\$@" >> "$TMP/curl-calls.log"
+prev=""
+for arg in "\$@"; do
+  if [ "\$prev" = "-K" ]; then
+    echo "AUTH-CONFIG: \$(cat "\$arg" 2>/dev/null)" >> "$TMP/curl-calls.log"
+  fi
+  prev="\$arg"
+done
 # Echo the fixture body (BB Server response) to stdout  -  same as real curl -sf.
 cat "$TMP/fixture.json"
 exit 0
@@ -153,10 +162,17 @@ else
   fail "limit param missing"
 fi
 
-if grep -q "test-bb-user:test-bb-token" "$TMP/curl-calls.log"; then
-  ok "Basic auth uses {user}:{token} from credential store"
+if grep -q 'AUTH-CONFIG: user = "test-bb-user:test-bb-token"' "$TMP/curl-calls.log"; then
+  ok "Basic auth uses {user}:{token} via curl -K config (not argv)"
 else
-  fail "auth header wrong; expected user:token, got: $(grep -o '\-u [^ ]*' "$TMP/curl-calls.log" || echo none)"
+  fail "auth config wrong; captured: $(grep 'AUTH-CONFIG' "$TMP/curl-calls.log" || echo none)"
+fi
+
+# The raw token must never appear on curl argv (visible to ps).
+if grep "^INVOCATION:" "$TMP/curl-calls.log" | grep -q "test-bb-token"; then
+  fail "token leaked onto curl argv"
+else
+  ok "token absent from curl argv"
 fi
 
 # --- Assert: shape conversion produced canonical schema ---------------------

package/pipeline/scripts/smoke-description-tr.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# smoke-description-tr.sh  -  localized picker-description contract.
+#
+# Verifies: every shipped command SKILL.md carries a description-tr line
+# (coverage), repo description: lines stay English with no description-en
+# sidecars committed (hygiene), and localize-commands.mjs apply/restore is
+# an idempotent, byte-identical round trip (mechanics).
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+CMD_DIR="$REPO_ROOT/pipeline/commands/multi-agent"
+LOCALIZER="$REPO_ROOT/pipeline/scripts/localize-commands.mjs"
+
+PASS=0
+FAIL=0
+record_pass() { PASS=$((PASS + 1)); printf '  \342\234\223 %s\n' "$1"; }
+record_fail() { FAIL=$((FAIL + 1)); printf '  \342\234\227 %s\n' "$1"; }
+
+printf '\342\206\222 smoke-description-tr: localized picker-description contract\n'
+
+# 1. Coverage: every command SKILL.md (incl. the dispatcher) has description-tr
+missing=""
+count=0
+for f in "$CMD_DIR/SKILL.md" "$CMD_DIR"/*/SKILL.md; do
+  [ -f "$f" ] || continue
+  count=$((count + 1))
+  grep -q '^description-tr:' "$f" || missing="$missing ${f#"$CMD_DIR/"}"
+done
+if [ -z "$missing" ]; then
+  record_pass "all $count command SKILL.md files carry description-tr"
+else
+  record_fail "missing description-tr in:$missing"
+fi
+
+# 2. Hygiene: repo descriptions stay English, no sidecars committed
+if grep -rn '^description:.*[çğıöşüÇĞİÖŞÜ]' "$CMD_DIR" >/dev/null 2>&1; then
+  record_fail "repo description: lines must stay English (Turkish characters found)"
+else
+  record_pass "repo description: lines are English"
+fi
+if grep -rln '^description-en:' "$CMD_DIR" >/dev/null 2>&1; then
+  record_fail "description-en sidecar committed to the repo (installed-tree artifact)"
+else
+  record_pass "no description-en sidecar in the repo"
+fi
+
+# 3. Translation length within the agent-skills description budget
+long=$(awk '/^description-tr:/ && length($0) > 1044 { print FILENAME }' "$CMD_DIR"/*/SKILL.md "$CMD_DIR/SKILL.md" 2>/dev/null | head -1)
+if [ -z "$long" ]; then
+  record_pass "every description-tr is within the 1024-char budget"
+else
+  record_fail "description-tr exceeds budget in $long"
+fi
+
+# 4. Round trip: apply is idempotent, restore is byte-identical
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+cp -R "$CMD_DIR" "$tmpdir/cmds"
+node "$LOCALIZER" apply --dir "$tmpdir/cmds" >/dev/null 2>&1
+if grep -q '^description:.*[çğıöşüÇĞİÖŞÜ]' "$tmpdir/cmds/dev/SKILL.md" \
+  && grep -q '^description-en:' "$tmpdir/cmds/dev/SKILL.md"; then
+  record_pass "apply swaps description and writes the description-en sidecar"
+else
+  record_fail "apply did not localize the sample file"
+fi
+second=$(node "$LOCALIZER" apply --dir "$tmpdir/cmds" 2>/dev/null)
+if printf '%s' "$second" | grep -q ' 0 file(s) changed'; then
+  record_pass "second apply is a no-op (idempotent)"
+else
+  record_fail "second apply changed files again: $second"
+fi
+node "$LOCALIZER" restore --dir "$tmpdir/cmds" >/dev/null 2>&1
+if diff -r "$CMD_DIR" "$tmpdir/cmds" >/dev/null 2>&1; then
+  record_pass "restore returns a byte-identical tree"
+else
+  record_fail "restore left differences vs the original tree"
+fi
+
+printf '\n\342\225\220\342\225\220 smoke-description-tr: %d passed, %d failed \342\225\220\342\225\220\n' "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ]