@mmerterden/multi-agent-pipeline 11.4.0 → 12.0.0

package/pipeline/scripts/smoke-fetchers-offline.sh

@@ -0,0 +1,382 @@
+#!/usr/bin/env bash
+#
+# smoke-fetchers-offline.sh  -  offline invocation tests for the pipeline/lib
+# fetchers. No network, no real tokens.
+#
+# Asserts, per fetcher:
+#   1. usage / arg-validation paths exit with the documented code
+#   2. URL/host parsing succeeds for a representative URL. This is the
+#      permanent regression guard for the env-prefix bug where
+#      `VAR=x PARSED=$(python3 ...)` never exported VAR to the child, so
+#      fetch-confluence always failed with "could not determine Confluence
+#      host" before reaching the credential stage.
+#   3. with stub credentials (fake credential-store in a temp HOME, fake curl
+#      on PATH) the failure moves past parsing to the documented
+#      credential/network exit code
+#   4. static source checks: no bash-4-only constructs (macOS /bin/bash is
+#      3.2) and no secret-bearing argv patterns (curl -H auth headers,
+#      --data-urlencode secrets, security add-generic-password -w on argv)
+#
+# Fetchers run under /bin/bash when available so bash-4-isms fail loudly on
+# macOS instead of passing under a newer Homebrew bash.
+#
+# Exit codes: 0=pass, 1=failure
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+LIB="$REPO_ROOT/pipeline/lib"
+SCRIPTS="$REPO_ROOT/pipeline/scripts"
+
+# Prefer the system bash (3.2 on macOS) so bash-4-isms regress loudly here.
+SH="/bin/bash"
+[ -x "$SH" ] || SH="$(command -v bash)"
+
+PASS=0
+FAIL=0
+note() { echo "  -> $*"; }
+pass() { echo "    ok $*"; PASS=$((PASS + 1)); }
+fail() { echo "    FAIL $*"; FAIL=$((FAIL + 1)); }
+
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/smoke-fetchers.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+
+OUT="$WORK/out.log"
+ERR="$WORK/err.log"
+
+# expect_rc <expected-rc> <label> <cmd...>
+# Runs cmd, captures stdout/stderr to $OUT/$ERR, asserts the exit code.
+expect_rc() {
+  local expected="$1" label="$2"
+  shift 2
+  local rc=0
+  "$@" >"$OUT" 2>"$ERR" || rc=$?
+  if [ "$rc" -eq "$expected" ]; then
+    pass "$label (rc=$rc)"
+  else
+    fail "$label (rc=$rc, expected $expected)"
+    tail -5 "$ERR" | sed 's/^/      /'
+  fi
+}
+
+assert_in_file() {
+  local needle="$1" file="$2" label="$3"
+  if grep -q -e "$needle" "$file" 2>/dev/null; then
+    pass "$label"
+  else
+    fail "$label (pattern '$needle' not found)"
+  fi
+}
+
+assert_not_in_file() {
+  local needle="$1" file="$2" label="$3"
+  if grep -q -e "$needle" "$file" 2>/dev/null; then
+    fail "$label (pattern '$needle' present)"
+  else
+    pass "$label"
+  fi
+}
+
+# -----------------------------------------------------------------------------
+note "0. fixtures: temp HOME with resolver + fake credential store, fake curls"
+# -----------------------------------------------------------------------------
+FAKE_HOME="$WORK/home"
+mkdir -p "$FAKE_HOME/.claude/lib"
+cp "$LIB/credential-store-resolver.sh" "$FAKE_HOME/.claude/lib/credential-store-resolver.sh"
+
+# Fake credential store: empty by default, returns FAKE_CRED_VALUE when set.
+cat > "$FAKE_HOME/.claude/lib/credential-store.sh" <<'FAKE'
+#!/bin/bash
+case "${1:-}" in
+  get)
+    if [ -n "${FAKE_CRED_VALUE:-}" ]; then printf '%s' "$FAKE_CRED_VALUE"; exit 0; fi
+    exit 1 ;;
+  platform) echo "fake" ;;
+  *) exit 3 ;;
+esac
+FAKE
+chmod +x "$FAKE_HOME/.claude/lib/credential-store.sh"
+
+# Fake curl variants, each in its own PATH-prepend dir.
+BIN_CURL_FAIL="$WORK/bin-curl-fail"
+mkdir -p "$BIN_CURL_FAIL"
+cat > "$BIN_CURL_FAIL/curl" <<'FAKE'
+#!/bin/bash
+echo "curl: (7) offline stub - connection refused" >&2
+exit 7
+FAKE
+chmod +x "$BIN_CURL_FAIL/curl"
+
+# Swagger meta stub: honours --output, emits the --write-out triple with a
+# content type that matches neither json nor yaml, forcing the URL-suffix
+# lowercase path (the former bash-4 ${URL,,} site).
+BIN_CURL_META="$WORK/bin-curl-meta"
+mkdir -p "$BIN_CURL_META"
+cat > "$BIN_CURL_META/curl" <<'FAKE'
+#!/bin/bash
+out=""
+prev=""
+for a in "$@"; do
+  if [ "$prev" = "--output" ]; then out="$a"; fi
+  prev="$a"
+done
+if [ -n "$out" ]; then printf '{}' > "$out"; fi
+printf '200\napplication/octet-stream\n2\n'
+exit 0
+FAKE
+chmod +x "$BIN_CURL_META/curl"
+
+# 401 stub: honours -o, prints the HTTP code the way curl -w '%{http_code}' does.
+BIN_CURL_401="$WORK/bin-curl-401"
+mkdir -p "$BIN_CURL_401"
+cat > "$BIN_CURL_401/curl" <<'FAKE'
+#!/bin/bash
+out=""
+prev=""
+for a in "$@"; do
+  if [ "$prev" = "-o" ] || [ "$prev" = "--output" ]; then out="$a"; fi
+  prev="$a"
+done
+if [ -n "$out" ]; then printf '{}' > "$out"; fi
+printf '401'
+exit 0
+FAKE
+chmod +x "$BIN_CURL_401/curl"
+
+# Fake security + uname (forces the macOS branch of credential-store.sh) so
+# the no-secret-on-argv property of `security -i` writes can be asserted on
+# any platform without touching a real keychain.
+BIN_DARWIN="$WORK/bin-darwin"
+mkdir -p "$BIN_DARWIN"
+cat > "$BIN_DARWIN/uname" <<'FAKE'
+#!/bin/bash
+echo "Darwin"
+FAKE
+cat > "$BIN_DARWIN/security" <<'FAKE'
+#!/bin/bash
+printf '%s\n' "$*" >> "$SMOKE_CAPTURE_DIR/security-argv.log"
+if [ "${1:-}" = "-i" ]; then
+  cat >> "$SMOKE_CAPTURE_DIR/security-stdin.log"
+fi
+exit 0
+FAKE
+chmod +x "$BIN_DARWIN/uname" "$BIN_DARWIN/security"
+
+# -----------------------------------------------------------------------------
+note "1. fetch-confluence.sh"
+# -----------------------------------------------------------------------------
+expect_rc 4 "no args exits 4 (usage)" \
+  "$SH" "$LIB/fetch-confluence.sh"
+expect_rc 4 "--help exits 4 (usage)" \
+  "$SH" "$LIB/fetch-confluence.sh" --help
+
+# Regression guard for the env-prefix parse bug: a plain page URL must get
+# past host/pageId resolution and fail at the credential stage (exit 2),
+# never with the parse error.
+expect_rc 2 "URL parse reaches credential stage (viewpage.action?pageId)" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-confluence.sh" \
+  "https://confluence.example.com/pages/viewpage.action?pageId=12345"
+assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
+assert_not_in_file "could not determine Confluence host" "$ERR" \
+  "no host-parse error (env-prefix regression)"
+
+expect_rc 2 "URL parse reaches credential stage (cloud /wiki/spaces form)" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-confluence.sh" \
+  "https://tenant.atlassian.net/wiki/spaces/ENG/pages/99887/Some+Page"
+assert_in_file "missing-token" "$ERR" "cloud form also blocked on token only"
+
+# With a stub token and a failing curl, the failure must be the documented
+# network error (3), proving parsing and auth wiring are past.
+expect_rc 3 "stub token + offline curl exits 3 (network stage)" \
+  env HOME="$FAKE_HOME" USER=smoke FAKE_CRED_VALUE=fake-token \
+      PATH="$BIN_CURL_FAIL:$PATH" \
+  "$SH" "$LIB/fetch-confluence.sh" \
+  "https://confluence.example.com/pages/viewpage.action?pageId=12345"
+assert_in_file "Confluence GET failed" "$ERR" "network-stage error message"
+
+# -----------------------------------------------------------------------------
+note "2. fetch-crashlytics.sh"
+# -----------------------------------------------------------------------------
+expect_rc 4 "no args exits 4 (usage)" \
+  "$SH" "$LIB/fetch-crashlytics.sh"
+expect_rc 4 "--help exits 4 (usage)" \
+  "$SH" "$LIB/fetch-crashlytics.sh" --help
+
+CRASH_URL="https://console.firebase.google.com/project/my-proj/crashlytics/app/ios:com.example.app/issues/abc123"
+expect_rc 2 "URL parse reaches credential stage" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-crashlytics.sh" "$CRASH_URL"
+assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
+
+# Stub SA JSON whose project_id mismatches the URL: proves parse + credential
+# read + base64 decode + JSON validation all pass, fully offline (exit 5).
+MISMATCH_SA_B64=$(printf '{"project_id":"other-proj"}' | base64 | tr -d '\n')
+expect_rc 5 "stub SA JSON reaches project-mismatch check (exit 5)" \
+  env HOME="$FAKE_HOME" USER=smoke FAKE_CRED_VALUE="$MISMATCH_SA_B64" \
+  "$SH" "$LIB/fetch-crashlytics.sh" "$CRASH_URL"
+assert_in_file "project_id" "$ERR" "mismatch error mentions project_id"
+
+# The decoded SA JSON must never touch a predictable /tmp path.
+assert_not_in_file "/tmp/.fc-sa" "$LIB/fetch-crashlytics.sh" \
+  "predictable /tmp SA path removed from source"
+
+# -----------------------------------------------------------------------------
+note "3. fetch-swagger.sh"
+# -----------------------------------------------------------------------------
+expect_rc 4 "no args exits 4 (usage)" \
+  "$SH" "$LIB/fetch-swagger.sh"
+
+expect_rc 2 "offline curl exits 2 (network stage)" \
+  env PATH="$BIN_CURL_FAIL:$PATH" \
+  "$SH" "$LIB/fetch-swagger.sh" "https://spec.example.com/openapi.json"
+
+# Uppercase .YAML suffix with a non-matching content type exercises the
+# lowercase-URL branch (formerly bash-4 ${URL,,}, dies on /bin/bash 3.2).
+expect_rc 0 "uppercase .YAML suffix detected via lowercase branch" \
+  env PATH="$BIN_CURL_META:$PATH" \
+  "$SH" "$LIB/fetch-swagger.sh" "https://spec.example.com/openapi.YAML"
+assert_in_file '"format": "yaml"' "$OUT" "output reports yaml format"
+
+# -----------------------------------------------------------------------------
+note "4. fetch-fortify.sh"
+# -----------------------------------------------------------------------------
+expect_rc 6 "no host configured exits 6" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-fortify.sh" --version-id 123
+expect_rc 4 "host override + no version id exits 4 (usage)" \
+  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
+  "$SH" "$LIB/fetch-fortify.sh"
+
+FORTIFY_URL="https://ssc.example.com/ssc/html/ssc/version/123/fix/ABCD-1"
+expect_rc 2 "URL parse reaches credential stage" \
+  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
+  "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
+assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
+
+expect_rc 0 "stub token + offline curl degrades to empty result (exit 0)" \
+  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
+      FAKE_CRED_VALUE=fake-token PATH="$BIN_CURL_FAIL:$PATH" \
+  "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
+assert_in_file '"gateOutcome"' "$OUT" "normalized JSON still emitted"
+
+# -----------------------------------------------------------------------------
+note "5. figma-screenshot.sh"
+# -----------------------------------------------------------------------------
+expect_rc 1 "no args exits 1 (usage)" \
+  "$SH" "$LIB/figma-screenshot.sh"
+expect_rc 0 "--help exits 0" \
+  "$SH" "$LIB/figma-screenshot.sh" --help
+
+expect_rc 3 "no PAT resolvable exits 3 (Tier 3 required)" \
+  env -u FIGMA_PAT HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/figma-screenshot.sh" --file-key abc123 --node-id 1-2 \
+  --output-dir "$WORK/shots-no-pat"
+
+expect_rc 2 "stub PAT + 401 curl exits 2 (auth stage, past parsing)" \
+  env HOME="$FAKE_HOME" USER=smoke FIGMA_PAT=fake-pat \
+      PATH="$BIN_CURL_401:$PATH" \
+  "$SH" "$LIB/figma-screenshot.sh" --file-key abc123 --node-id 1-2 \
+  --output-dir "$WORK/shots-401"
+
+# -----------------------------------------------------------------------------
+note "6. figma-mcp-refresh.sh"
+# -----------------------------------------------------------------------------
+expect_rc 2 "missing prefs exits 2" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/figma-mcp-refresh.sh"
+
+if command -v jq >/dev/null 2>&1; then
+  PREFS_HOME="$WORK/home-prefs"
+  mkdir -p "$PREFS_HOME/.claude"
+  printf '{"global":{"keychainMapping":{"figma_mcp":"Smoke_Figma_MCP"}}}\n' \
+    > "$PREFS_HOME/.claude/multi-agent-preferences.json"
+  export SMOKE_CAPTURE_DIR="$WORK"
+  expect_rc 2 "mapped key + empty keychain exits 2 (no refresh token)" \
+    env HOME="$PREFS_HOME" USER=smoke SMOKE_CAPTURE_DIR="$WORK" \
+        PATH="$BIN_DARWIN:$PATH" \
+    "$SH" "$LIB/figma-mcp-refresh.sh"
+else
+  note "   (jq not installed - skipping mapped-key case)"
+fi
+
+# -----------------------------------------------------------------------------
+note "7. credential-store.sh + keychain-save.sh"
+# -----------------------------------------------------------------------------
+expect_rc 0 "platform subcommand works" \
+  "$SH" "$LIB/credential-store.sh" platform
+expect_rc 3 "get without key exits 3 (usage)" \
+  "$SH" "$LIB/credential-store.sh" get
+expect_rc 1 "keychain-save without service name exits 1 (usage)" \
+  "$SH" "$SCRIPTS/keychain-save.sh"
+
+# set <key> - : the secret must travel via stdin to `security -i`, never on
+# the security argv. Fake uname forces the macOS branch; fake security logs
+# argv and stdin separately.
+rm -f "$WORK/security-argv.log" "$WORK/security-stdin.log"
+SECRET_VALUE="topsecret-smoke-value-123"
+rc=0
+printf '%s' "$SECRET_VALUE" \
+  | env PATH="$BIN_DARWIN:$PATH" KEYCHAIN_DELEGATE=0 SMOKE_CAPTURE_DIR="$WORK" \
+    "$SH" "$LIB/credential-store.sh" set smoke-test-key - >"$OUT" 2>"$ERR" || rc=$?
+if [ "$rc" -eq 0 ]; then
+  pass "set <key> - via stdin succeeds (rc=0)"
+else
+  fail "set <key> - via stdin failed (rc=$rc)"
+  tail -5 "$ERR" | sed 's/^/      /'
+fi
+assert_in_file "^-i" "$WORK/security-argv.log" "security invoked in -i stdin mode"
+assert_not_in_file "$SECRET_VALUE" "$WORK/security-argv.log" "secret absent from security argv"
+assert_in_file "$SECRET_VALUE" "$WORK/security-stdin.log" "secret delivered via stdin"
+
+# -----------------------------------------------------------------------------
+note "8. static source checks (bash-3.2 compat + no secrets on argv)"
+# -----------------------------------------------------------------------------
+OWNED_FILES=(
+  "$LIB/fetch-confluence.sh"
+  "$LIB/fetch-crashlytics.sh"
+  "$LIB/fetch-swagger.sh"
+  "$LIB/fetch-fortify.sh"
+  "$LIB/figma-mcp-refresh.sh"
+  "$LIB/figma-screenshot.sh"
+  "$LIB/credential-store.sh"
+  "$SCRIPTS/keychain-save.sh"
+)
+
+if grep -nE '\$\{[A-Za-z_0-9]+(,,|\^\^)|mapfile |readarray |declare -A' "${OWNED_FILES[@]}"; then
+  fail "bash-4-only construct found (must run on /bin/bash 3.2)"
+else
+  pass "no bash-4-only constructs"
+fi
+
+if grep -nE -- '-H "(Authorization|X-Figma-Token)' "${OWNED_FILES[@]}"; then
+  fail "auth header passed to curl via argv (-H)"
+else
+  pass "no auth headers on curl argv"
+fi
+
+if grep -nE -- '--data-urlencode "(refresh_token|client_secret)' "${OWNED_FILES[@]}"; then
+  fail "OAuth secret passed to curl via argv (--data-urlencode)"
+else
+  pass "no OAuth secrets on curl argv"
+fi
+
+if grep -nE 'add-generic-password[^|]*-w "\$' "${OWNED_FILES[@]}"; then
+  fail "keychain secret passed to security via argv (-w)"
+else
+  pass "no keychain secrets on security argv"
+fi
+
+# shellcheck disable=SC2016  # literal $HOME is the pattern being hunted
+if grep -nE '\$HOME/\.claude/lib/credential-store\.sh|~/\.claude/lib/credential-store\.sh' "${OWNED_FILES[@]}"; then
+  fail "hardcoded credential-store path (must go through the resolver)"
+else
+  pass "credential-store access routed through the resolver"
+fi
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "smoke-fetchers-offline: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] || exit 1
+exit 0

package/pipeline/scripts/smoke-gc-tmp.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # smoke-gc-tmp.sh  -  gc-tmp.sh sweeps only known scratch prefixes, is dry-run
-# by default, and never touches unrelated files.
+# by default, never touches unrelated files, refuses unsafe scratch roots,
+# never deletes the root itself, and spares fresh scratch by default.
 #
 # Exit 0 = all pass, 1 = any failure.
 
@@ -40,7 +41,7 @@ seed() {
 echo "→ 1. dry-run lists matches and deletes nothing"
 seed
 before=$(find "$SB" -mindepth 1 | wc -l | tr -d ' ')
-out=$(GC_TMP_ROOT="$SB" bash "$GC" 2>&1)
+out=$(GC_TMP_ROOT="$SB" GC_TMP_GRACE_MIN=0 bash "$GC" 2>&1)
 after=$(find "$SB" -mindepth 1 | wc -l | tr -d ' ')
 echo "$out" | grep -q "DRY-RUN" && pass "dry-run banner shown" || fail "dry-run banner missing"
 [ "$before" = "$after" ] && pass "dry-run deleted nothing ($after entries intact)" || fail "dry-run changed the tree ($before -> $after)"
@@ -49,7 +50,7 @@ echo "$out" | grep -q "unrelated-file.txt" && fail "dry-run matched an unrelated
 echo ""
 echo "→ 2. --yes removes only matched scratch"
 seed
-GC_TMP_ROOT="$SB" bash "$GC" --yes >/dev/null 2>&1
+GC_TMP_ROOT="$SB" GC_TMP_GRACE_MIN=0 bash "$GC" --yes >/dev/null 2>&1
 [ -f "$SB/unrelated-file.txt" ] && pass "unrelated file preserved" || fail "unrelated file was deleted"
 [ ! -e "$SB/multi-agent-picker-PROJ-1.json" ] && pass "multi-agent-* file removed" || fail "multi-agent-* file survived"
 [ ! -e "$SB/multi-agent-review-PROJ-1-x" ] && pass "scratch dir removed" || fail "scratch dir survived"
@@ -61,7 +62,7 @@ remaining=$(find "$SB" -mindepth 1 | wc -l | tr -d ' ')
 echo ""
 echo "→ 3. --older-than excludes fresh scratch"
 seed
-out=$(GC_TMP_ROOT="$SB" bash "$GC" --older-than=1 2>&1)
+out=$(GC_TMP_ROOT="$SB" GC_TMP_GRACE_MIN=0 bash "$GC" --older-than=1 2>&1)
 echo "$out" | grep -q "nothing to do" && pass "freshly-created scratch excluded by --older-than=1" || fail "--older-than did not exclude fresh files"
 
 echo ""
@@ -79,6 +80,51 @@ rc=$?
 rm -rf "$EMPTY"
 { [ "$rc" = "0" ] && echo "$out" | grep -q "nothing to do"; } && pass "empty root exits 0 with no-op message" || fail "empty root not a clean no-op"
 
+echo ""
+echo "→ 6. unsafe scratch roots are refused (exit 2)"
+GC_TMP_ROOT="$HOME" bash "$GC" >/dev/null 2>&1
+[ "$?" = "2" ] && pass "\$HOME as scratch root refused" || fail "\$HOME as scratch root not refused"
+GC_TMP_ROOT="/" bash "$GC" >/dev/null 2>&1
+[ "$?" = "2" ] && pass "/ as scratch root refused" || fail "/ as scratch root not refused"
+GITROOT="$(mktemp -d)"
+mkdir -p "$GITROOT/.git"
+touch "$GITROOT/multi-agent-bait.json"
+GC_TMP_ROOT="$GITROOT" bash "$GC" --yes >/dev/null 2>&1
+rc=$?
+[ "$rc" = "2" ] && pass "git work tree as scratch root refused" || fail "git work tree as scratch root not refused"
+[ -f "$GITROOT/multi-agent-bait.json" ] && pass "bait file inside refused root untouched" || fail "refused root was still swept"
+rm -rf "$GITROOT"
+
+echo ""
+echo "→ 7. a root itself named like scratch is never deleted"
+SR="$(mktemp -d)"
+mkdir -p "$SR/multi-agent-root"
+touch "$SR/multi-agent-root/multi-agent-inner.json"
+GC_TMP_ROOT="$SR/multi-agent-root" GC_TMP_GRACE_MIN=0 bash "$GC" --yes >/dev/null 2>&1
+[ -d "$SR/multi-agent-root" ] && pass "matching-named root survives --yes" || fail "root dir itself was deleted"
+[ ! -e "$SR/multi-agent-root/multi-agent-inner.json" ] && pass "inner scratch still removed" || fail "inner scratch survived"
+rm -rf "$SR"
+
+echo ""
+echo "→ 8. symlinked scratch is unlinked without following it"
+seed
+VICTIM="$(mktemp -d)"
+echo keep >"$VICTIM/keep.txt"
+ln -s "$VICTIM" "$SB/multi-agent-linked"
+GC_TMP_ROOT="$SB" GC_TMP_GRACE_MIN=0 bash "$GC" --yes >/dev/null 2>&1
+[ ! -e "$SB/multi-agent-linked" ] && pass "symlink itself removed" || fail "symlink survived"
+[ -f "$VICTIM/keep.txt" ] && pass "symlink target untouched" || fail "symlink target was deleted"
+rm -rf "$VICTIM"
+
+echo ""
+echo "→ 9. default grace spares fresh scratch"
+seed
+out=$(GC_TMP_ROOT="$SB" bash "$GC" --yes 2>&1)
+rc=$?
+[ "$rc" = "0" ] && pass "grace run exits 0" || fail "grace run exited $rc"
+[ -f "$SB/multi-agent-picker-PROJ-1.json" ] && pass "fresh scratch spared by default grace" || fail "default grace deleted fresh scratch"
+echo "$out" | grep -qi "spared" && pass "output mentions spared fresh items" || fail "no spared note in output"
+
 echo ""
 echo "══ gc-tmp smoke: $PASS passed, $FAIL failed ══"
 [ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-gc-worktrees.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# smoke-gc-worktrees.sh  -  contract of the worktree residue sweeper.
+#
+# Verifies gc-worktrees.sh: dry-run-by-default, orphan-dir removal only with
+# --yes, registered worktrees untouched, gitlink residue unstaged, exclude
+# guard added idempotently, --older-than sparing, non-repo no-op, and flag
+# validation.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SCRIPT="$SCRIPT_DIR/gc-worktrees.sh"
+
+PASS=0
+FAIL=0
+record_pass() { PASS=$((PASS + 1)); printf '  \342\234\223 %s\n' "$1"; }
+record_fail() { FAIL=$((FAIL + 1)); printf '  \342\234\227 %s\n' "$1"; }
+
+printf '\342\206\222 smoke-gc-worktrees: worktree residue sweep contract\n'
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+# Fixture repo: one registered worktree, one orphan dir, one gitlink residue.
+REPO="$tmpdir/repo"
+mkdir -p "$REPO"
+git -C "$REPO" init -q -b main
+git -C "$REPO" config user.email smoke@test
+git -C "$REPO" config user.name smoke
+echo hi > "$REPO/f.txt"
+git -C "$REPO" add f.txt
+git -C "$REPO" commit -qm init
+git -C "$REPO" worktree add -q "$REPO/.worktrees/REG" -b reg-branch
+mkdir -p "$REPO/.worktrees/ORPHAN"
+echo x > "$REPO/.worktrees/ORPHAN/file"
+git -C "$REPO" update-index --add --cacheinfo "160000,$(git -C "$REPO" rev-parse HEAD),.worktrees/GONE"
+
+# 1. Script parses
+if bash -n "$SCRIPT" 2>/dev/null; then
+  record_pass "gc-worktrees.sh parses (bash -n)"
+else
+  record_fail "gc-worktrees.sh has syntax errors"
+fi
+
+# 2. Dry-run lists all three findings and deletes nothing
+out=$(bash "$SCRIPT" --repo "$REPO" 2>&1); rc=$?
+if [ "$rc" -eq 0 ] \
+  && printf '%s' "$out" | grep -q "would remove orphan worktree dir: .worktrees/ORPHAN" \
+  && printf '%s' "$out" | grep -q "would unstage gitlink residue from the index: .worktrees/GONE" \
+  && printf '%s' "$out" | grep -q "would add .worktrees/ to .git/info/exclude"; then
+  record_pass "dry-run lists orphan dir + gitlink + missing guard"
+else
+  record_fail "dry-run should list all three findings (rc=$rc): $out"
+fi
+if [ -d "$REPO/.worktrees/ORPHAN" ] && git -C "$REPO" ls-files -s -- .worktrees | grep -q 160000; then
+  record_pass "dry-run changed nothing"
+else
+  record_fail "dry-run must not delete or unstage anything"
+fi
+
+# 3. --older-than spares the freshly-touched orphan
+out=$(bash "$SCRIPT" --repo "$REPO" --older-than=60 2>&1)
+if printf '%s' "$out" | grep -q "would remove orphan"; then
+  record_fail "--older-than=60 should spare the fresh orphan dir"
+else
+  record_pass "--older-than spares recently-touched orphan dirs"
+fi
+
+# 4. --yes applies all three
+out=$(bash "$SCRIPT" --repo "$REPO" --yes 2>&1); rc=$?
+if [ "$rc" -eq 0 ] && [ ! -d "$REPO/.worktrees/ORPHAN" ]; then
+  record_pass "--yes removes the orphan dir"
+else
+  record_fail "--yes should remove the orphan dir (rc=$rc): $out"
+fi
+if git -C "$REPO" ls-files -s -- .worktrees | grep -q 160000; then
+  record_fail "--yes should unstage the gitlink residue"
+else
+  record_pass "--yes unstages the gitlink residue"
+fi
+if [ "$(grep -cxF '.worktrees/' "$REPO/.git/info/exclude" 2>/dev/null)" = "1" ]; then
+  record_pass "--yes adds the exclude guard exactly once"
+else
+  record_fail "exclude guard missing or duplicated"
+fi
+
+# 5. Registered worktree untouched
+if [ -d "$REPO/.worktrees/REG" ] && git -C "$REPO" worktree list | grep -q "REG"; then
+  record_pass "registered worktree left untouched"
+else
+  record_fail "registered worktree must never be touched"
+fi
+
+# 6. Re-run -> nothing to do, guard not duplicated
+out=$(bash "$SCRIPT" --repo "$REPO" 2>&1); rc=$?
+if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -q "nothing to do"; then
+  record_pass "clean repo -> nothing to do (exit 0)"
+else
+  record_fail "clean repo should be a no-op (rc=$rc): $out"
+fi
+bash "$SCRIPT" --repo "$REPO" --yes >/dev/null 2>&1
+if [ "$(grep -cxF '.worktrees/' "$REPO/.git/info/exclude")" = "1" ]; then
+  record_pass "exclude guard is idempotent across --yes reruns"
+else
+  record_fail "exclude guard duplicated on rerun"
+fi
+
+# 7. Non-repo -> silent no-op exit 0
+out=$(bash "$SCRIPT" --repo "$tmpdir" 2>&1); rc=$?
+if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -q "not a git work tree"; then
+  record_pass "non-repo -> exit 0 no-op"
+else
+  record_fail "non-repo should exit 0 with a no-op message (rc=$rc)"
+fi
+
+# 8. Unknown flag -> usage error exit 2
+bash "$SCRIPT" --definitely-not-a-flag >/dev/null 2>&1; rc=$?
+if [ "$rc" -eq 2 ]; then
+  record_pass "unknown flag -> exit 2"
+else
+  record_fail "unknown flag should exit 2 (got $rc)"
+fi
+
+printf '\n\342\225\220\342\225\220 smoke-gc-worktrees: %d passed, %d failed \342\225\220\342\225\220\n' "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-install-layout.sh

@@ -110,11 +110,19 @@ assert_file "$TMP_CLAUDE/.claude/CLAUDE.md" "~/.claude/CLAUDE.md"
 assert_file "$TMP_CLAUDE/.claude/multi-agent-preferences.json" "~/.claude/multi-agent-preferences.json"
 assert_file "$TMP_CLAUDE/.claude/settings.json" "~/.claude/settings.json"
 
-# settings.json must have the secret-detection hook
+# settings.json must have the secret-detection hook. v11.4.1 changed the
+# matcher from the dead "Bash(git commit:*)" (tool-name matchers never matched
+# it) to "Bash"; command-level filtering happens inside pre-commit-check.sh.
+if grep -q '"matcher": "Bash"' "$TMP_CLAUDE/.claude/settings.json" \
+  && grep -q "pre-commit-check.sh" "$TMP_CLAUDE/.claude/settings.json"; then
+  pass "settings.json registers PreToolUse secret-scan hook (matcher Bash)"
+else
+  fail "settings.json missing PreToolUse secret-scan hook with matcher Bash"
+fi
 if grep -q "Bash(git commit:\*)" "$TMP_CLAUDE/.claude/settings.json"; then
-  pass "settings.json registers PreToolUse git-commit hook"
+  fail "settings.json still contains the dead Bash(git commit:*) matcher"
 else
-  fail "settings.json missing PreToolUse git-commit hook"
+  pass "settings.json has no dead Bash(git commit:*) matcher"
 fi
 if grep -q "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE" "$TMP_CLAUDE/.claude/settings.json"; then
   pass "settings.json sets CLAUDE_AUTOCOMPACT_PCT_OVERRIDE"