@mmerterden/multi-agent-pipeline 12.6.0 → 12.8.0

package/pipeline/scripts/smoke-extract-conventions.sh

@@ -1,163 +0,0 @@
-#!/usr/bin/env bash
-# smoke-extract-conventions.sh  -  offline sanity checks for extract-conventions.sh.
-# Builds a throwaway iOS-shaped fixture repo, runs the extractor, and asserts the
-# emitted JSON honours pipeline/schemas/conventions-output.schema.json: all 12
-# convention fields present, every bucket carries the 5-field shape, confidence
-# stays inside its enum, and evidenceFiles is capped at 5. Also covers the
-# invalid-platform and missing-args error paths. No network, no credentials.
-
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-EXTRACT="$REPO_ROOT/pipeline/lib/extract-conventions.sh"
-
-PASS=0
-FAIL=0
-
-ok()   { echo "  ✓ $1"; PASS=$((PASS+1)); }
-fail() { echo "  ✗ $1" >&2; FAIL=$((FAIL+1)); }
-
-if ! command -v jq >/dev/null 2>&1; then
-  echo "smoke-extract-conventions: jq not found; skipping (install jq to enable)" >&2
-  exit 0
-fi
-
-if [ ! -x "$EXTRACT" ]; then
-  fail "extract-conventions.sh missing or not executable at $EXTRACT"
-  echo "══ extract-conventions smoke: $PASS passed, $FAIL failed ══" >&2
-  exit 1
-fi
-
-# --- Error paths ---------------------------------------------------------------
-echo "→ error paths"
-
-if "$EXTRACT" >/dev/null 2>&1; then
-  fail "missing args should exit non-zero"
-else
-  ok "missing args exits non-zero"
-fi
-
-if "$EXTRACT" /tmp "bogus-platform" >/dev/null 2>&1; then
-  fail "invalid platform should exit non-zero"
-else
-  ok "invalid platform exits non-zero"
-fi
-
-# --- Fixture repo ----------------------------------------------------------------
-echo "→ ios fixture extraction"
-
-FIXTURE="$(mktemp -d "${TMPDIR:-/tmp}/conv-smoke.XXXXXX")"
-trap 'rm -rf "$FIXTURE"' EXIT
-
-mkdir -p "$FIXTURE/Domains/Sample/Presentation/ViewModel" \
-         "$FIXTURE/Domains/Sample/Presentation/View" \
-         "$FIXTURE/Domains/Sample/Domain/UseCases" \
-         "$FIXTURE/Domains/Sample/Tests"
-
-for n in One Two Three Four Five; do
-  cat > "$FIXTURE/Domains/Sample/Presentation/ViewModel/Sample${n}ViewModel.swift" <<EOF
-import SwiftUI
-
-@MainActor
-final class Sample${n}ViewModel: ObservableObject {
-    @Published private(set) var state: Sample${n}UIState = .loading
-}
-
-enum Sample${n}UIState {
-    case loading
-    case idle
-    case error
-}
-EOF
-  cat > "$FIXTURE/Domains/Sample/Presentation/View/Sample${n}View.swift" <<EOF
-import SwiftUI
-
-struct Sample${n}View: View {
-    var body: some View { Text("sample") }
-}
-EOF
-  cat > "$FIXTURE/Domains/Sample/Domain/UseCases/Fetch${n}UseCase.swift" <<EOF
-protocol Fetch${n}UseCaseProtocol {
-    func execute() async throws
-}
-EOF
-done
-
-OUTPUT="$("$EXTRACT" "$FIXTURE" ios 2>/dev/null)" || OUTPUT=""
-
-if [ -z "$OUTPUT" ]; then
-  fail "extractor produced no output on fixture repo"
-else
-  if printf '%s' "$OUTPUT" | jq -e . >/dev/null 2>&1; then
-    ok "output parses as JSON"
-  else
-    fail "output is not valid JSON"
-  fi
-
-  EXPECTED_KEYS="folderStructure stateHolderNaming viewNaming navigatorNaming useCaseNaming repositoryNaming dtoNaming uiStateModel testMethodNaming accessibilityIdentifier localizationKey diRegistration"
-
-  MISSING=""
-  for key in $EXPECTED_KEYS; do
-    if ! printf '%s' "$OUTPUT" | jq -e --arg k "$key" 'has($k)' >/dev/null 2>&1; then
-      MISSING="$MISSING $key"
-    fi
-  done
-  if [ -z "$MISSING" ]; then
-    ok "all 12 convention fields present"
-  else
-    fail "missing convention fields:$MISSING"
-  fi
-
-  BAD_SHAPE=$(printf '%s' "$OUTPUT" | jq -r '
-    to_entries[]
-    | select(
-        (.value | type) != "object"
-        or ((.value | keys | sort) != ["alternativeCandidates","confidence","evidenceFiles","example","pattern"])
-      )
-    | .key' 2>/dev/null)
-  if [ -z "$BAD_SHAPE" ]; then
-    ok "every bucket carries the 5-field shape"
-  else
-    fail "buckets with wrong shape: $(printf '%s' "$BAD_SHAPE" | tr '\n' ' ')"
-  fi
-
-  BAD_CONF=$(printf '%s' "$OUTPUT" | jq -r '
-    to_entries[]
-    | select(.value.confidence as $c | ["high","medium","low","none"] | index($c) | not)
-    | .key' 2>/dev/null)
-  if [ -z "$BAD_CONF" ]; then
-    ok "confidence values stay inside the enum"
-  else
-    fail "out-of-enum confidence in: $(printf '%s' "$BAD_CONF" | tr '\n' ' ')"
-  fi
-
-  OVER_CAP=$(printf '%s' "$OUTPUT" | jq -r '
-    to_entries[]
-    | select((.value.evidenceFiles | length) > 5)
-    | .key' 2>/dev/null)
-  if [ -z "$OVER_CAP" ]; then
-    ok "evidenceFiles capped at 5"
-  else
-    fail "evidenceFiles over cap in: $(printf '%s' "$OVER_CAP" | tr '\n' ' ')"
-  fi
-
-  VM_CONF=$(printf '%s' "$OUTPUT" | jq -r '.stateHolderNaming.confidence' 2>/dev/null)
-  case "$VM_CONF" in
-    high|medium)
-      ok "fixture ViewModels detected (stateHolderNaming confidence: $VM_CONF)" ;;
-    *)
-      fail "expected stateHolderNaming confidence high|medium on 5-example fixture, got: $VM_CONF" ;;
-  esac
-fi
-
-# --- Summary -----------------------------------------------------------------
-echo ""
-TOTAL=$((PASS+FAIL))
-if [ $FAIL -eq 0 ]; then
-  echo "══ extract-conventions smoke: $PASS passed, 0 failed ══"
-  exit 0
-else
-  echo "══ extract-conventions smoke: $PASS passed, $FAIL failed (of $TOTAL) ══" >&2
-  exit 1
-fi

package/pipeline/scripts/smoke-fetchers-offline.sh

@@ -1,448 +0,0 @@
-#!/usr/bin/env bash
-#
-# smoke-fetchers-offline.sh  -  offline invocation tests for the pipeline/lib
-# fetchers. No network, no real tokens.
-#
-# Asserts, per fetcher:
-#   1. usage / arg-validation paths exit with the documented code
-#   2. URL/host parsing succeeds for a representative URL. This is the
-#      permanent regression guard for the env-prefix bug where
-#      `VAR=x PARSED=$(python3 ...)` never exported VAR to the child, so
-#      fetch-confluence always failed with "could not determine Confluence
-#      host" before reaching the credential stage.
-#   3. with stub credentials (fake credential-store in a temp HOME, fake curl
-#      on PATH) the failure moves past parsing to the documented
-#      credential/network exit code
-#   4. static source checks: no bash-4-only constructs (macOS /bin/bash is
-#      3.2) and no secret-bearing argv patterns (curl -H auth headers,
-#      --data-urlencode secrets, security add-generic-password -w on argv)
-#
-# Fetchers run under /bin/bash when available so bash-4-isms fail loudly on
-# macOS instead of passing under a newer Homebrew bash.
-#
-# Exit codes: 0=pass, 1=failure
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-LIB="$REPO_ROOT/pipeline/lib"
-SCRIPTS="$REPO_ROOT/pipeline/scripts"
-
-# Prefer the system bash (3.2 on macOS) so bash-4-isms regress loudly here.
-SH="/bin/bash"
-[ -x "$SH" ] || SH="$(command -v bash)"
-
-PASS=0
-FAIL=0
-note() { echo "  -> $*"; }
-pass() { echo "    ok $*"; PASS=$((PASS + 1)); }
-fail() { echo "    FAIL $*"; FAIL=$((FAIL + 1)); }
-
-WORK=$(mktemp -d "${TMPDIR:-/tmp}/smoke-fetchers.XXXXXX")
-trap 'rm -rf "$WORK"' EXIT
-
-OUT="$WORK/out.log"
-ERR="$WORK/err.log"
-
-# expect_rc <expected-rc> <label> <cmd...>
-# Runs cmd, captures stdout/stderr to $OUT/$ERR, asserts the exit code.
-expect_rc() {
-  local expected="$1" label="$2"
-  shift 2
-  local rc=0
-  "$@" >"$OUT" 2>"$ERR" || rc=$?
-  if [ "$rc" -eq "$expected" ]; then
-    pass "$label (rc=$rc)"
-  else
-    fail "$label (rc=$rc, expected $expected)"
-    tail -5 "$ERR" | sed 's/^/      /'
-  fi
-}
-
-assert_in_file() {
-  local needle="$1" file="$2" label="$3"
-  if grep -q -e "$needle" "$file" 2>/dev/null; then
-    pass "$label"
-  else
-    fail "$label (pattern '$needle' not found)"
-  fi
-}
-
-assert_not_in_file() {
-  local needle="$1" file="$2" label="$3"
-  if grep -q -e "$needle" "$file" 2>/dev/null; then
-    fail "$label (pattern '$needle' present)"
-  else
-    pass "$label"
-  fi
-}
-
-# -----------------------------------------------------------------------------
-note "0. fixtures: temp HOME with resolver + fake credential store, fake curls"
-# -----------------------------------------------------------------------------
-FAKE_HOME="$WORK/home"
-mkdir -p "$FAKE_HOME/.claude/lib"
-cp "$LIB/credential-store-resolver.sh" "$FAKE_HOME/.claude/lib/credential-store-resolver.sh"
-
-# Fake credential store: empty by default, returns FAKE_CRED_VALUE when set.
-cat > "$FAKE_HOME/.claude/lib/credential-store.sh" <<'FAKE'
-#!/bin/bash
-case "${1:-}" in
-  get)
-    if [ -n "${FAKE_CRED_VALUE:-}" ]; then printf '%s' "$FAKE_CRED_VALUE"; exit 0; fi
-    exit 1 ;;
-  platform) echo "fake" ;;
-  *) exit 3 ;;
-esac
-FAKE
-chmod +x "$FAKE_HOME/.claude/lib/credential-store.sh"
-
-# Fake curl variants, each in its own PATH-prepend dir.
-BIN_CURL_FAIL="$WORK/bin-curl-fail"
-mkdir -p "$BIN_CURL_FAIL"
-cat > "$BIN_CURL_FAIL/curl" <<'FAKE'
-#!/bin/bash
-echo "curl: (7) offline stub - connection refused" >&2
-exit 7
-FAKE
-chmod +x "$BIN_CURL_FAIL/curl"
-
-# Swagger meta stub: honours --output, emits the --write-out triple with a
-# content type that matches neither json nor yaml, forcing the URL-suffix
-# lowercase path (the former bash-4 ${URL,,} site).
-BIN_CURL_META="$WORK/bin-curl-meta"
-mkdir -p "$BIN_CURL_META"
-cat > "$BIN_CURL_META/curl" <<'FAKE'
-#!/bin/bash
-out=""
-prev=""
-for a in "$@"; do
-  if [ "$prev" = "--output" ]; then out="$a"; fi
-  prev="$a"
-done
-if [ -n "$out" ]; then printf '{}' > "$out"; fi
-printf '200\napplication/octet-stream\n2\n'
-exit 0
-FAKE
-chmod +x "$BIN_CURL_META/curl"
-
-# 401 stub: honours -o, prints the HTTP code the way curl -w '%{http_code}' does.
-BIN_CURL_401="$WORK/bin-curl-401"
-mkdir -p "$BIN_CURL_401"
-cat > "$BIN_CURL_401/curl" <<'FAKE'
-#!/bin/bash
-out=""
-prev=""
-for a in "$@"; do
-  if [ "$prev" = "-o" ] || [ "$prev" = "--output" ]; then out="$a"; fi
-  prev="$a"
-done
-if [ -n "$out" ]; then printf '{}' > "$out"; fi
-printf '401'
-exit 0
-FAKE
-chmod +x "$BIN_CURL_401/curl"
-
-# Fake security + uname (forces the macOS branch of credential-store.sh) so
-# the no-secret-on-argv property of `security -i` writes can be asserted on
-# any platform without touching a real keychain.
-BIN_DARWIN="$WORK/bin-darwin"
-mkdir -p "$BIN_DARWIN"
-cat > "$BIN_DARWIN/uname" <<'FAKE'
-#!/bin/bash
-echo "Darwin"
-FAKE
-cat > "$BIN_DARWIN/security" <<'FAKE'
-#!/bin/bash
-printf '%s\n' "$*" >> "$SMOKE_CAPTURE_DIR/security-argv.log"
-if [ "${1:-}" = "-i" ]; then
-  cat >> "$SMOKE_CAPTURE_DIR/security-stdin.log"
-fi
-exit 0
-FAKE
-chmod +x "$BIN_DARWIN/uname" "$BIN_DARWIN/security"
-
-# -----------------------------------------------------------------------------
-note "1. fetch-confluence.sh"
-# -----------------------------------------------------------------------------
-expect_rc 4 "no args exits 4 (usage)" \
-  "$SH" "$LIB/fetch-confluence.sh"
-expect_rc 4 "--help exits 4 (usage)" \
-  "$SH" "$LIB/fetch-confluence.sh" --help
-
-# Regression guard for the env-prefix parse bug: a plain page URL must get
-# past host/pageId resolution and fail at the credential stage (exit 2),
-# never with the parse error.
-expect_rc 2 "URL parse reaches credential stage (viewpage.action?pageId)" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-confluence.sh" \
-  "https://confluence.example.com/pages/viewpage.action?pageId=12345"
-assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
-assert_not_in_file "could not determine Confluence host" "$ERR" \
-  "no host-parse error (env-prefix regression)"
-
-expect_rc 2 "URL parse reaches credential stage (cloud /wiki/spaces form)" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-confluence.sh" \
-  "https://tenant.atlassian.net/wiki/spaces/ENG/pages/99887/Some+Page"
-assert_in_file "missing-token" "$ERR" "cloud form also blocked on token only"
-
-# With a stub token and a failing curl, the failure must be the documented
-# network error (3), proving parsing and auth wiring are past.
-expect_rc 3 "stub token + offline curl exits 3 (network stage)" \
-  env HOME="$FAKE_HOME" USER=smoke FAKE_CRED_VALUE=fake-token \
-      PATH="$BIN_CURL_FAIL:$PATH" \
-  "$SH" "$LIB/fetch-confluence.sh" \
-  "https://confluence.example.com/pages/viewpage.action?pageId=12345"
-assert_in_file "Confluence GET failed" "$ERR" "network-stage error message"
-
-# -----------------------------------------------------------------------------
-note "2. fetch-crashlytics.sh"
-# -----------------------------------------------------------------------------
-expect_rc 4 "no args exits 4 (usage)" \
-  "$SH" "$LIB/fetch-crashlytics.sh"
-expect_rc 4 "--help exits 4 (usage)" \
-  "$SH" "$LIB/fetch-crashlytics.sh" --help
-
-CRASH_URL="https://console.firebase.google.com/project/my-proj/crashlytics/app/ios:com.example.app/issues/abc123"
-expect_rc 2 "URL parse reaches credential stage" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-crashlytics.sh" "$CRASH_URL"
-assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
-
-# Stub SA JSON whose project_id mismatches the URL: proves parse + credential
-# read + base64 decode + JSON validation all pass, fully offline (exit 5).
-MISMATCH_SA_B64=$(printf '{"project_id":"other-proj"}' | base64 | tr -d '\n')
-expect_rc 5 "stub SA JSON reaches project-mismatch check (exit 5)" \
-  env HOME="$FAKE_HOME" USER=smoke FAKE_CRED_VALUE="$MISMATCH_SA_B64" \
-  "$SH" "$LIB/fetch-crashlytics.sh" "$CRASH_URL"
-assert_in_file "project_id" "$ERR" "mismatch error mentions project_id"
-
-# The decoded SA JSON must never touch a predictable /tmp path.
-assert_not_in_file "/tmp/.fc-sa" "$LIB/fetch-crashlytics.sh" \
-  "predictable /tmp SA path removed from source"
-
-# -----------------------------------------------------------------------------
-note "3. fetch-swagger.sh"
-# -----------------------------------------------------------------------------
-expect_rc 4 "no args exits 4 (usage)" \
-  "$SH" "$LIB/fetch-swagger.sh"
-
-expect_rc 2 "offline curl exits 2 (network stage)" \
-  env PATH="$BIN_CURL_FAIL:$PATH" \
-  "$SH" "$LIB/fetch-swagger.sh" "https://spec.example.com/openapi.json"
-
-# Uppercase .YAML suffix with a non-matching content type exercises the
-# lowercase-URL branch (formerly bash-4 ${URL,,}, dies on /bin/bash 3.2).
-expect_rc 0 "uppercase .YAML suffix detected via lowercase branch" \
-  env PATH="$BIN_CURL_META:$PATH" \
-  "$SH" "$LIB/fetch-swagger.sh" "https://spec.example.com/openapi.YAML"
-assert_in_file '"format": "yaml"' "$OUT" "output reports yaml format"
-
-# -----------------------------------------------------------------------------
-note "4. fetch-fortify.sh"
-# -----------------------------------------------------------------------------
-expect_rc 6 "no host configured exits 6" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-fortify.sh" --version-id 123
-expect_rc 4 "host override + no version id exits 4 (usage)" \
-  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
-  "$SH" "$LIB/fetch-fortify.sh"
-
-FORTIFY_URL="https://ssc.example.com/ssc/html/ssc/version/123/fix/ABCD-1"
-expect_rc 2 "URL parse reaches credential stage" \
-  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
-  "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
-assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
-
-expect_rc 0 "stub token + offline curl degrades to empty result (exit 0)" \
-  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
-      FAKE_CRED_VALUE=fake-token PATH="$BIN_CURL_FAIL:$PATH" \
-  "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
-assert_in_file '"gateOutcome"' "$OUT" "normalized JSON still emitted"
-
-# -----------------------------------------------------------------------------
-note "4b. fetch-graylog.sh"
-# -----------------------------------------------------------------------------
-expect_rc 6 "no host configured exits 6" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-graylog.sh" --trx T123
-expect_rc 4 "host override + no ids exits 4 (usage)" \
-  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
-  "$SH" "$LIB/fetch-graylog.sh"
-
-expect_rc 2 "host override + id reaches credential stage" \
-  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
-  "$SH" "$LIB/fetch-graylog.sh" --trx T123 --conv C456
-assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
-
-# Non-blocking contract: with a stub token and a failing curl, the fetch must
-# degrade to an empty normalized result (messages present) and exit 0 so a log
-# fetch never blocks a run.
-expect_rc 0 "stub token + offline curl degrades to empty result (exit 0)" \
-  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
-      FAKE_CRED_VALUE=fake-token PATH="$BIN_CURL_FAIL:$PATH" \
-  "$SH" "$LIB/fetch-graylog.sh" --trx T123
-assert_in_file '"messages"' "$OUT" "normalized JSON still emitted"
-
-# -----------------------------------------------------------------------------
-note "5. figma-screenshot.sh"
-# -----------------------------------------------------------------------------
-expect_rc 1 "no args exits 1 (usage)" \
-  "$SH" "$LIB/figma-screenshot.sh"
-expect_rc 0 "--help exits 0" \
-  "$SH" "$LIB/figma-screenshot.sh" --help
-
-expect_rc 3 "no PAT resolvable exits 3 (Tier 3 required)" \
-  env -u FIGMA_PAT HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/figma-screenshot.sh" --file-key abc123 --node-id 1-2 \
-  --output-dir "$WORK/shots-no-pat"
-
-expect_rc 2 "stub PAT + 401 curl exits 2 (auth stage, past parsing)" \
-  env HOME="$FAKE_HOME" USER=smoke FIGMA_PAT=fake-pat \
-      PATH="$BIN_CURL_401:$PATH" \
-  "$SH" "$LIB/figma-screenshot.sh" --file-key abc123 --node-id 1-2 \
-  --output-dir "$WORK/shots-401"
-
-# -----------------------------------------------------------------------------
-note "6. figma-mcp-refresh.sh"
-# -----------------------------------------------------------------------------
-expect_rc 2 "missing prefs exits 2" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/figma-mcp-refresh.sh"
-
-if command -v jq >/dev/null 2>&1; then
-  PREFS_HOME="$WORK/home-prefs"
-  mkdir -p "$PREFS_HOME/.claude"
-  printf '{"global":{"keychainMapping":{"figma_mcp":"Smoke_Figma_MCP"}}}\n' \
-    > "$PREFS_HOME/.claude/multi-agent-preferences.json"
-  export SMOKE_CAPTURE_DIR="$WORK"
-  expect_rc 2 "mapped key + empty keychain exits 2 (no refresh token)" \
-    env HOME="$PREFS_HOME" USER=smoke SMOKE_CAPTURE_DIR="$WORK" \
-        PATH="$BIN_DARWIN:$PATH" \
-    "$SH" "$LIB/figma-mcp-refresh.sh"
-else
-  note "   (jq not installed - skipping mapped-key case)"
-fi
-
-# -----------------------------------------------------------------------------
-note "7. credential-store.sh + keychain-save.sh"
-# -----------------------------------------------------------------------------
-expect_rc 0 "platform subcommand works" \
-  "$SH" "$LIB/credential-store.sh" platform
-expect_rc 3 "get without key exits 3 (usage)" \
-  "$SH" "$LIB/credential-store.sh" get
-expect_rc 1 "keychain-save without service name exits 1 (usage)" \
-  "$SH" "$SCRIPTS/keychain-save.sh"
-
-# set <key> - : the secret must travel via stdin to `security -i`, never on
-# the security argv. Fake uname forces the macOS branch; fake security logs
-# argv and stdin separately.
-rm -f "$WORK/security-argv.log" "$WORK/security-stdin.log"
-SECRET_VALUE="topsecret-smoke-value-123"
-rc=0
-printf '%s' "$SECRET_VALUE" \
-  | env PATH="$BIN_DARWIN:$PATH" KEYCHAIN_DELEGATE=0 SMOKE_CAPTURE_DIR="$WORK" \
-    "$SH" "$LIB/credential-store.sh" set smoke-test-key - >"$OUT" 2>"$ERR" || rc=$?
-if [ "$rc" -eq 0 ]; then
-  pass "set <key> - via stdin succeeds (rc=0)"
-else
-  fail "set <key> - via stdin failed (rc=$rc)"
-  tail -5 "$ERR" | sed 's/^/      /'
-fi
-assert_in_file "^-i" "$WORK/security-argv.log" "security invoked in -i stdin mode"
-assert_not_in_file "$SECRET_VALUE" "$WORK/security-argv.log" "secret absent from security argv"
-assert_in_file "$SECRET_VALUE" "$WORK/security-stdin.log" "secret delivered via stdin"
-
-# -----------------------------------------------------------------------------
-note "7b. fetch-figma-annotations.sh (Tier-2 annotation ingestion)"
-# -----------------------------------------------------------------------------
-expect_rc 1 "no args exits 1 (usage)" \
-  "$SH" "$LIB/fetch-figma-annotations.sh"
-
-# Missing token -> blocked JSON + exit 2 (no network).
-expect_rc 2 "missing token exits 2 with blocked JSON" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-figma-annotations.sh" --file-key ABC --node-id "1:23"
-assert_in_file "missing-token" "$OUT" "blocked JSON names missing-token"
-
-# Fake curl returns a /nodes doc carrying a TR:/EN: annotation; with a stub
-# token the parser must reach + parse it (regression guard for the parser).
-BIN_CURL_ANNOT="$WORK/bin-curl-annot"
-mkdir -p "$BIN_CURL_ANNOT"
-cat > "$BIN_CURL_ANNOT/curl" <<'FAKE'
-#!/bin/bash
-out=""; prev=""
-for a in "$@"; do
-  [ "$prev" = "-o" ] && out="$a"
-  prev="$a"
-done
-if [ -n "$out" ]; then
-  cat > "$out" <<'JSON'
-{"nodes":{"1:23":{"document":{"id":"1:23","name":"Title","type":"TEXT","characters":"Giriniz","annotations":[{"label":"TR: Ucusunuzu secin\nEN: Select your flight"}]}}}}
-JSON
-fi
-printf '200'
-exit 0
-FAKE
-chmod +x "$BIN_CURL_ANNOT/curl"
-
-expect_rc 0 "stub token + annotation doc parses (exit 0)" \
-  env HOME="$FAKE_HOME" USER=smoke FIGMA_PAT=fake-token \
-      PATH="$BIN_CURL_ANNOT:$PATH" \
-  "$SH" "$LIB/fetch-figma-annotations.sh" --file-key ABC --node-id "1:23" --lang-prefixes TR,EN
-assert_in_file "\"mode\": \"prefixed\"" "$OUT" "annotation parsed as prefixed"
-assert_in_file "Select your flight" "$OUT" "EN copy extracted from annotation"
-
-# -----------------------------------------------------------------------------
-note "8. static source checks (bash-3.2 compat + no secrets on argv)"
-# -----------------------------------------------------------------------------
-OWNED_FILES=(
-  "$LIB/fetch-confluence.sh"
-  "$LIB/fetch-crashlytics.sh"
-  "$LIB/fetch-swagger.sh"
-  "$LIB/fetch-fortify.sh"
-  "$LIB/fetch-graylog.sh"
-  "$LIB/fetch-figma-annotations.sh"
-  "$LIB/figma-mcp-refresh.sh"
-  "$LIB/figma-screenshot.sh"
-  "$LIB/credential-store.sh"
-  "$SCRIPTS/keychain-save.sh"
-)
-
-if grep -nE '\$\{[A-Za-z_0-9]+(,,|\^\^)|mapfile |readarray |declare -A' "${OWNED_FILES[@]}"; then
-  fail "bash-4-only construct found (must run on /bin/bash 3.2)"
-else
-  pass "no bash-4-only constructs"
-fi
-
-if grep -nE -- '-H "(Authorization|X-Figma-Token)' "${OWNED_FILES[@]}"; then
-  fail "auth header passed to curl via argv (-H)"
-else
-  pass "no auth headers on curl argv"
-fi
-
-if grep -nE -- '--data-urlencode "(refresh_token|client_secret)' "${OWNED_FILES[@]}"; then
-  fail "OAuth secret passed to curl via argv (--data-urlencode)"
-else
-  pass "no OAuth secrets on curl argv"
-fi
-
-if grep -nE 'add-generic-password[^|]*-w "\$' "${OWNED_FILES[@]}"; then
-  fail "keychain secret passed to security via argv (-w)"
-else
-  pass "no keychain secrets on security argv"
-fi
-
-# shellcheck disable=SC2016  # literal $HOME is the pattern being hunted
-if grep -nE '\$HOME/\.claude/lib/credential-store\.sh|~/\.claude/lib/credential-store\.sh' "${OWNED_FILES[@]}"; then
-  fail "hardcoded credential-store path (must go through the resolver)"
-else
-  pass "credential-store access routed through the resolver"
-fi
-
-# -----------------------------------------------------------------------------
-echo ""
-echo "smoke-fetchers-offline: $PASS passed, $FAIL failed"
-[ "$FAIL" -eq 0 ] || exit 1
-exit 0