@mmerterden/multi-agent-pipeline 12.7.0 → 12.9.0

package/pipeline/scripts/smoke-fetchers-offline.sh

@@ -1,448 +0,0 @@
-#!/usr/bin/env bash
-#
-# smoke-fetchers-offline.sh  -  offline invocation tests for the pipeline/lib
-# fetchers. No network, no real tokens.
-#
-# Asserts, per fetcher:
-#   1. usage / arg-validation paths exit with the documented code
-#   2. URL/host parsing succeeds for a representative URL. This is the
-#      permanent regression guard for the env-prefix bug where
-#      `VAR=x PARSED=$(python3 ...)` never exported VAR to the child, so
-#      fetch-confluence always failed with "could not determine Confluence
-#      host" before reaching the credential stage.
-#   3. with stub credentials (fake credential-store in a temp HOME, fake curl
-#      on PATH) the failure moves past parsing to the documented
-#      credential/network exit code
-#   4. static source checks: no bash-4-only constructs (macOS /bin/bash is
-#      3.2) and no secret-bearing argv patterns (curl -H auth headers,
-#      --data-urlencode secrets, security add-generic-password -w on argv)
-#
-# Fetchers run under /bin/bash when available so bash-4-isms fail loudly on
-# macOS instead of passing under a newer Homebrew bash.
-#
-# Exit codes: 0=pass, 1=failure
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-LIB="$REPO_ROOT/pipeline/lib"
-SCRIPTS="$REPO_ROOT/pipeline/scripts"
-
-# Prefer the system bash (3.2 on macOS) so bash-4-isms regress loudly here.
-SH="/bin/bash"
-[ -x "$SH" ] || SH="$(command -v bash)"
-
-PASS=0
-FAIL=0
-note() { echo "  -> $*"; }
-pass() { echo "    ok $*"; PASS=$((PASS + 1)); }
-fail() { echo "    FAIL $*"; FAIL=$((FAIL + 1)); }
-
-WORK=$(mktemp -d "${TMPDIR:-/tmp}/smoke-fetchers.XXXXXX")
-trap 'rm -rf "$WORK"' EXIT
-
-OUT="$WORK/out.log"
-ERR="$WORK/err.log"
-
-# expect_rc <expected-rc> <label> <cmd...>
-# Runs cmd, captures stdout/stderr to $OUT/$ERR, asserts the exit code.
-expect_rc() {
-  local expected="$1" label="$2"
-  shift 2
-  local rc=0
-  "$@" >"$OUT" 2>"$ERR" || rc=$?
-  if [ "$rc" -eq "$expected" ]; then
-    pass "$label (rc=$rc)"
-  else
-    fail "$label (rc=$rc, expected $expected)"
-    tail -5 "$ERR" | sed 's/^/      /'
-  fi
-}
-
-assert_in_file() {
-  local needle="$1" file="$2" label="$3"
-  if grep -q -e "$needle" "$file" 2>/dev/null; then
-    pass "$label"
-  else
-    fail "$label (pattern '$needle' not found)"
-  fi
-}
-
-assert_not_in_file() {
-  local needle="$1" file="$2" label="$3"
-  if grep -q -e "$needle" "$file" 2>/dev/null; then
-    fail "$label (pattern '$needle' present)"
-  else
-    pass "$label"
-  fi
-}
-
-# -----------------------------------------------------------------------------
-note "0. fixtures: temp HOME with resolver + fake credential store, fake curls"
-# -----------------------------------------------------------------------------
-FAKE_HOME="$WORK/home"
-mkdir -p "$FAKE_HOME/.claude/lib"
-cp "$LIB/credential-store-resolver.sh" "$FAKE_HOME/.claude/lib/credential-store-resolver.sh"
-
-# Fake credential store: empty by default, returns FAKE_CRED_VALUE when set.
-cat > "$FAKE_HOME/.claude/lib/credential-store.sh" <<'FAKE'
-#!/bin/bash
-case "${1:-}" in
-  get)
-    if [ -n "${FAKE_CRED_VALUE:-}" ]; then printf '%s' "$FAKE_CRED_VALUE"; exit 0; fi
-    exit 1 ;;
-  platform) echo "fake" ;;
-  *) exit 3 ;;
-esac
-FAKE
-chmod +x "$FAKE_HOME/.claude/lib/credential-store.sh"
-
-# Fake curl variants, each in its own PATH-prepend dir.
-BIN_CURL_FAIL="$WORK/bin-curl-fail"
-mkdir -p "$BIN_CURL_FAIL"
-cat > "$BIN_CURL_FAIL/curl" <<'FAKE'
-#!/bin/bash
-echo "curl: (7) offline stub - connection refused" >&2
-exit 7
-FAKE
-chmod +x "$BIN_CURL_FAIL/curl"
-
-# Swagger meta stub: honours --output, emits the --write-out triple with a
-# content type that matches neither json nor yaml, forcing the URL-suffix
-# lowercase path (the former bash-4 ${URL,,} site).
-BIN_CURL_META="$WORK/bin-curl-meta"
-mkdir -p "$BIN_CURL_META"
-cat > "$BIN_CURL_META/curl" <<'FAKE'
-#!/bin/bash
-out=""
-prev=""
-for a in "$@"; do
-  if [ "$prev" = "--output" ]; then out="$a"; fi
-  prev="$a"
-done
-if [ -n "$out" ]; then printf '{}' > "$out"; fi
-printf '200\napplication/octet-stream\n2\n'
-exit 0
-FAKE
-chmod +x "$BIN_CURL_META/curl"
-
-# 401 stub: honours -o, prints the HTTP code the way curl -w '%{http_code}' does.
-BIN_CURL_401="$WORK/bin-curl-401"
-mkdir -p "$BIN_CURL_401"
-cat > "$BIN_CURL_401/curl" <<'FAKE'
-#!/bin/bash
-out=""
-prev=""
-for a in "$@"; do
-  if [ "$prev" = "-o" ] || [ "$prev" = "--output" ]; then out="$a"; fi
-  prev="$a"
-done
-if [ -n "$out" ]; then printf '{}' > "$out"; fi
-printf '401'
-exit 0
-FAKE
-chmod +x "$BIN_CURL_401/curl"
-
-# Fake security + uname (forces the macOS branch of credential-store.sh) so
-# the no-secret-on-argv property of `security -i` writes can be asserted on
-# any platform without touching a real keychain.
-BIN_DARWIN="$WORK/bin-darwin"
-mkdir -p "$BIN_DARWIN"
-cat > "$BIN_DARWIN/uname" <<'FAKE'
-#!/bin/bash
-echo "Darwin"
-FAKE
-cat > "$BIN_DARWIN/security" <<'FAKE'
-#!/bin/bash
-printf '%s\n' "$*" >> "$SMOKE_CAPTURE_DIR/security-argv.log"
-if [ "${1:-}" = "-i" ]; then
-  cat >> "$SMOKE_CAPTURE_DIR/security-stdin.log"
-fi
-exit 0
-FAKE
-chmod +x "$BIN_DARWIN/uname" "$BIN_DARWIN/security"
-
-# -----------------------------------------------------------------------------
-note "1. fetch-confluence.sh"
-# -----------------------------------------------------------------------------
-expect_rc 4 "no args exits 4 (usage)" \
-  "$SH" "$LIB/fetch-confluence.sh"
-expect_rc 4 "--help exits 4 (usage)" \
-  "$SH" "$LIB/fetch-confluence.sh" --help
-
-# Regression guard for the env-prefix parse bug: a plain page URL must get
-# past host/pageId resolution and fail at the credential stage (exit 2),
-# never with the parse error.
-expect_rc 2 "URL parse reaches credential stage (viewpage.action?pageId)" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-confluence.sh" \
-  "https://confluence.example.com/pages/viewpage.action?pageId=12345"
-assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
-assert_not_in_file "could not determine Confluence host" "$ERR" \
-  "no host-parse error (env-prefix regression)"
-
-expect_rc 2 "URL parse reaches credential stage (cloud /wiki/spaces form)" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-confluence.sh" \
-  "https://tenant.atlassian.net/wiki/spaces/ENG/pages/99887/Some+Page"
-assert_in_file "missing-token" "$ERR" "cloud form also blocked on token only"
-
-# With a stub token and a failing curl, the failure must be the documented
-# network error (3), proving parsing and auth wiring are past.
-expect_rc 3 "stub token + offline curl exits 3 (network stage)" \
-  env HOME="$FAKE_HOME" USER=smoke FAKE_CRED_VALUE=fake-token \
-      PATH="$BIN_CURL_FAIL:$PATH" \
-  "$SH" "$LIB/fetch-confluence.sh" \
-  "https://confluence.example.com/pages/viewpage.action?pageId=12345"
-assert_in_file "Confluence GET failed" "$ERR" "network-stage error message"
-
-# -----------------------------------------------------------------------------
-note "2. fetch-crashlytics.sh"
-# -----------------------------------------------------------------------------
-expect_rc 4 "no args exits 4 (usage)" \
-  "$SH" "$LIB/fetch-crashlytics.sh"
-expect_rc 4 "--help exits 4 (usage)" \
-  "$SH" "$LIB/fetch-crashlytics.sh" --help
-
-CRASH_URL="https://console.firebase.google.com/project/my-proj/crashlytics/app/ios:com.example.app/issues/abc123"
-expect_rc 2 "URL parse reaches credential stage" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-crashlytics.sh" "$CRASH_URL"
-assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
-
-# Stub SA JSON whose project_id mismatches the URL: proves parse + credential
-# read + base64 decode + JSON validation all pass, fully offline (exit 5).
-MISMATCH_SA_B64=$(printf '{"project_id":"other-proj"}' | base64 | tr -d '\n')
-expect_rc 5 "stub SA JSON reaches project-mismatch check (exit 5)" \
-  env HOME="$FAKE_HOME" USER=smoke FAKE_CRED_VALUE="$MISMATCH_SA_B64" \
-  "$SH" "$LIB/fetch-crashlytics.sh" "$CRASH_URL"
-assert_in_file "project_id" "$ERR" "mismatch error mentions project_id"
-
-# The decoded SA JSON must never touch a predictable /tmp path.
-assert_not_in_file "/tmp/.fc-sa" "$LIB/fetch-crashlytics.sh" \
-  "predictable /tmp SA path removed from source"
-
-# -----------------------------------------------------------------------------
-note "3. fetch-swagger.sh"
-# -----------------------------------------------------------------------------
-expect_rc 4 "no args exits 4 (usage)" \
-  "$SH" "$LIB/fetch-swagger.sh"
-
-expect_rc 2 "offline curl exits 2 (network stage)" \
-  env PATH="$BIN_CURL_FAIL:$PATH" \
-  "$SH" "$LIB/fetch-swagger.sh" "https://spec.example.com/openapi.json"
-
-# Uppercase .YAML suffix with a non-matching content type exercises the
-# lowercase-URL branch (formerly bash-4 ${URL,,}, dies on /bin/bash 3.2).
-expect_rc 0 "uppercase .YAML suffix detected via lowercase branch" \
-  env PATH="$BIN_CURL_META:$PATH" \
-  "$SH" "$LIB/fetch-swagger.sh" "https://spec.example.com/openapi.YAML"
-assert_in_file '"format": "yaml"' "$OUT" "output reports yaml format"
-
-# -----------------------------------------------------------------------------
-note "4. fetch-fortify.sh"
-# -----------------------------------------------------------------------------
-expect_rc 6 "no host configured exits 6" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-fortify.sh" --version-id 123
-expect_rc 4 "host override + no version id exits 4 (usage)" \
-  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
-  "$SH" "$LIB/fetch-fortify.sh"
-
-FORTIFY_URL="https://ssc.example.com/ssc/html/ssc/version/123/fix/ABCD-1"
-expect_rc 2 "URL parse reaches credential stage" \
-  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
-  "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
-assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
-
-expect_rc 0 "stub token + offline curl degrades to empty result (exit 0)" \
-  env HOME="$FAKE_HOME" USER=smoke FORTIFY_HOST_OVERRIDE=ssc.example.com \
-      FAKE_CRED_VALUE=fake-token PATH="$BIN_CURL_FAIL:$PATH" \
-  "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
-assert_in_file '"gateOutcome"' "$OUT" "normalized JSON still emitted"
-
-# -----------------------------------------------------------------------------
-note "4b. fetch-graylog.sh"
-# -----------------------------------------------------------------------------
-expect_rc 6 "no host configured exits 6" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-graylog.sh" --trx T123
-expect_rc 4 "host override + no ids exits 4 (usage)" \
-  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
-  "$SH" "$LIB/fetch-graylog.sh"
-
-expect_rc 2 "host override + id reaches credential stage" \
-  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
-  "$SH" "$LIB/fetch-graylog.sh" --trx T123 --conv C456
-assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
-
-# Non-blocking contract: with a stub token and a failing curl, the fetch must
-# degrade to an empty normalized result (messages present) and exit 0 so a log
-# fetch never blocks a run.
-expect_rc 0 "stub token + offline curl degrades to empty result (exit 0)" \
-  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
-      FAKE_CRED_VALUE=fake-token PATH="$BIN_CURL_FAIL:$PATH" \
-  "$SH" "$LIB/fetch-graylog.sh" --trx T123
-assert_in_file '"messages"' "$OUT" "normalized JSON still emitted"
-
-# -----------------------------------------------------------------------------
-note "5. figma-screenshot.sh"
-# -----------------------------------------------------------------------------
-expect_rc 1 "no args exits 1 (usage)" \
-  "$SH" "$LIB/figma-screenshot.sh"
-expect_rc 0 "--help exits 0" \
-  "$SH" "$LIB/figma-screenshot.sh" --help
-
-expect_rc 3 "no PAT resolvable exits 3 (Tier 3 required)" \
-  env -u FIGMA_PAT HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/figma-screenshot.sh" --file-key abc123 --node-id 1-2 \
-  --output-dir "$WORK/shots-no-pat"
-
-expect_rc 2 "stub PAT + 401 curl exits 2 (auth stage, past parsing)" \
-  env HOME="$FAKE_HOME" USER=smoke FIGMA_PAT=fake-pat \
-      PATH="$BIN_CURL_401:$PATH" \
-  "$SH" "$LIB/figma-screenshot.sh" --file-key abc123 --node-id 1-2 \
-  --output-dir "$WORK/shots-401"
-
-# -----------------------------------------------------------------------------
-note "6. figma-mcp-refresh.sh"
-# -----------------------------------------------------------------------------
-expect_rc 2 "missing prefs exits 2" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/figma-mcp-refresh.sh"
-
-if command -v jq >/dev/null 2>&1; then
-  PREFS_HOME="$WORK/home-prefs"
-  mkdir -p "$PREFS_HOME/.claude"
-  printf '{"global":{"keychainMapping":{"figma_mcp":"Smoke_Figma_MCP"}}}\n' \
-    > "$PREFS_HOME/.claude/multi-agent-preferences.json"
-  export SMOKE_CAPTURE_DIR="$WORK"
-  expect_rc 2 "mapped key + empty keychain exits 2 (no refresh token)" \
-    env HOME="$PREFS_HOME" USER=smoke SMOKE_CAPTURE_DIR="$WORK" \
-        PATH="$BIN_DARWIN:$PATH" \
-    "$SH" "$LIB/figma-mcp-refresh.sh"
-else
-  note "   (jq not installed - skipping mapped-key case)"
-fi
-
-# -----------------------------------------------------------------------------
-note "7. credential-store.sh + keychain-save.sh"
-# -----------------------------------------------------------------------------
-expect_rc 0 "platform subcommand works" \
-  "$SH" "$LIB/credential-store.sh" platform
-expect_rc 3 "get without key exits 3 (usage)" \
-  "$SH" "$LIB/credential-store.sh" get
-expect_rc 1 "keychain-save without service name exits 1 (usage)" \
-  "$SH" "$SCRIPTS/keychain-save.sh"
-
-# set <key> - : the secret must travel via stdin to `security -i`, never on
-# the security argv. Fake uname forces the macOS branch; fake security logs
-# argv and stdin separately.
-rm -f "$WORK/security-argv.log" "$WORK/security-stdin.log"
-SECRET_VALUE="topsecret-smoke-value-123"
-rc=0
-printf '%s' "$SECRET_VALUE" \
-  | env PATH="$BIN_DARWIN:$PATH" KEYCHAIN_DELEGATE=0 SMOKE_CAPTURE_DIR="$WORK" \
-    "$SH" "$LIB/credential-store.sh" set smoke-test-key - >"$OUT" 2>"$ERR" || rc=$?
-if [ "$rc" -eq 0 ]; then
-  pass "set <key> - via stdin succeeds (rc=0)"
-else
-  fail "set <key> - via stdin failed (rc=$rc)"
-  tail -5 "$ERR" | sed 's/^/      /'
-fi
-assert_in_file "^-i" "$WORK/security-argv.log" "security invoked in -i stdin mode"
-assert_not_in_file "$SECRET_VALUE" "$WORK/security-argv.log" "secret absent from security argv"
-assert_in_file "$SECRET_VALUE" "$WORK/security-stdin.log" "secret delivered via stdin"
-
-# -----------------------------------------------------------------------------
-note "7b. fetch-figma-annotations.sh (Tier-2 annotation ingestion)"
-# -----------------------------------------------------------------------------
-expect_rc 1 "no args exits 1 (usage)" \
-  "$SH" "$LIB/fetch-figma-annotations.sh"
-
-# Missing token -> blocked JSON + exit 2 (no network).
-expect_rc 2 "missing token exits 2 with blocked JSON" \
-  env HOME="$FAKE_HOME" USER=smoke \
-  "$SH" "$LIB/fetch-figma-annotations.sh" --file-key ABC --node-id "1:23"
-assert_in_file "missing-token" "$OUT" "blocked JSON names missing-token"
-
-# Fake curl returns a /nodes doc carrying a TR:/EN: annotation; with a stub
-# token the parser must reach + parse it (regression guard for the parser).
-BIN_CURL_ANNOT="$WORK/bin-curl-annot"
-mkdir -p "$BIN_CURL_ANNOT"
-cat > "$BIN_CURL_ANNOT/curl" <<'FAKE'
-#!/bin/bash
-out=""; prev=""
-for a in "$@"; do
-  [ "$prev" = "-o" ] && out="$a"
-  prev="$a"
-done
-if [ -n "$out" ]; then
-  cat > "$out" <<'JSON'
-{"nodes":{"1:23":{"document":{"id":"1:23","name":"Title","type":"TEXT","characters":"Giriniz","annotations":[{"label":"TR: Ucusunuzu secin\nEN: Select your flight"}]}}}}
-JSON
-fi
-printf '200'
-exit 0
-FAKE
-chmod +x "$BIN_CURL_ANNOT/curl"
-
-expect_rc 0 "stub token + annotation doc parses (exit 0)" \
-  env HOME="$FAKE_HOME" USER=smoke FIGMA_PAT=fake-token \
-      PATH="$BIN_CURL_ANNOT:$PATH" \
-  "$SH" "$LIB/fetch-figma-annotations.sh" --file-key ABC --node-id "1:23" --lang-prefixes TR,EN
-assert_in_file "\"mode\": \"prefixed\"" "$OUT" "annotation parsed as prefixed"
-assert_in_file "Select your flight" "$OUT" "EN copy extracted from annotation"
-
-# -----------------------------------------------------------------------------
-note "8. static source checks (bash-3.2 compat + no secrets on argv)"
-# -----------------------------------------------------------------------------
-OWNED_FILES=(
-  "$LIB/fetch-confluence.sh"
-  "$LIB/fetch-crashlytics.sh"
-  "$LIB/fetch-swagger.sh"
-  "$LIB/fetch-fortify.sh"
-  "$LIB/fetch-graylog.sh"
-  "$LIB/fetch-figma-annotations.sh"
-  "$LIB/figma-mcp-refresh.sh"
-  "$LIB/figma-screenshot.sh"
-  "$LIB/credential-store.sh"
-  "$SCRIPTS/keychain-save.sh"
-)
-
-if grep -nE '\$\{[A-Za-z_0-9]+(,,|\^\^)|mapfile |readarray |declare -A' "${OWNED_FILES[@]}"; then
-  fail "bash-4-only construct found (must run on /bin/bash 3.2)"
-else
-  pass "no bash-4-only constructs"
-fi
-
-if grep -nE -- '-H "(Authorization|X-Figma-Token)' "${OWNED_FILES[@]}"; then
-  fail "auth header passed to curl via argv (-H)"
-else
-  pass "no auth headers on curl argv"
-fi
-
-if grep -nE -- '--data-urlencode "(refresh_token|client_secret)' "${OWNED_FILES[@]}"; then
-  fail "OAuth secret passed to curl via argv (--data-urlencode)"
-else
-  pass "no OAuth secrets on curl argv"
-fi
-
-if grep -nE 'add-generic-password[^|]*-w "\$' "${OWNED_FILES[@]}"; then
-  fail "keychain secret passed to security via argv (-w)"
-else
-  pass "no keychain secrets on security argv"
-fi
-
-# shellcheck disable=SC2016  # literal $HOME is the pattern being hunted
-if grep -nE '\$HOME/\.claude/lib/credential-store\.sh|~/\.claude/lib/credential-store\.sh' "${OWNED_FILES[@]}"; then
-  fail "hardcoded credential-store path (must go through the resolver)"
-else
-  pass "credential-store access routed through the resolver"
-fi
-
-# -----------------------------------------------------------------------------
-echo ""
-echo "smoke-fetchers-offline: $PASS passed, $FAIL failed"
-[ "$FAIL" -eq 0 ] || exit 1
-exit 0

package/pipeline/scripts/smoke-figma-dispatch.sh

@@ -1,112 +0,0 @@
-#!/usr/bin/env bash
-# smoke-figma-dispatch.sh  -  Phase 3 component dispatch contract (plugin-based).
-#
-# Verifies that multi-agent Phase 3 dispatches component tasks to the
-# ai-<platform>-engineering-toolkit MARKETPLACE PLUGIN (create-component,
-# fallback create-ui-component) instead of a bundled figma-to-component skill.
-#
-# Runs offline  -  scans docs only, no skill invocation.
-
-set -euo pipefail
-
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-PHASE0="$ROOT/pipeline/multi-agent-refs/phases/phase-0-init.md"
-PHASE3="$ROOT/pipeline/multi-agent-refs/phases/phase-3-dev.md"
-DISPATCH="$ROOT/pipeline/multi-agent-refs/component-dispatch.md"
-
-PASS=0
-FAIL=0
-pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
-
-[ -f "$PHASE0" ] || { echo "error: $PHASE0 missing" >&2; exit 1; }
-[ -f "$PHASE3" ] || { echo "error: $PHASE3 missing" >&2; exit 1; }
-[ -f "$DISPATCH" ] || { echo "error: $DISPATCH missing" >&2; exit 1; }
-
-echo "→ 1. no bundled figma orchestrator remains in the tree"
-if [ -e "$ROOT/pipeline/skills/figma-ios" ] || [ -e "$ROOT/pipeline/skills/figma-android" ] || [ -e "$ROOT/pipeline/skills/figma-common" ]; then
-  fail "bundled pipeline/skills/figma-* tree still present (should be plugin-only)"
-else
-  pass "no pipeline/skills/figma-* tree (component skills live in the plugin)"
-fi
-
-echo ""
-echo "→ 2. Phase 0 routes component tasks to the plugin component skill"
-if grep -Fq "create-component" "$PHASE0"; then
-  pass "Phase 0 references the plugin create-component skill"
-else
-  fail "Phase 0 does NOT reference create-component"
-fi
-if grep -Fq "figma-to-swiftui" "$PHASE0" || grep -Fq "skills/figma-ios/figma-to-component" "$PHASE0"; then
-  fail "Phase 0 still references a legacy/bundled figma orchestrator path"
-else
-  pass "Phase 0 has no legacy/bundled figma orchestrator reference"
-fi
-
-echo ""
-echo "→ 3. dispatch guards taskType and resolves the plugin (dual-name)"
-if grep -Fq 'taskType === "component"' "$DISPATCH"; then
-  pass "dispatch mentions taskType guard"
-else
-  fail "dispatch missing taskType guard"
-fi
-if grep -Fq "create-component" "$DISPATCH" && grep -Fq "create-ui-component" "$DISPATCH"; then
-  pass "dispatch documents dual-name resolution (create-component / create-ui-component)"
-else
-  fail "dispatch missing dual-name plugin resolution"
-fi
-
-echo ""
-echo "→ 4. dispatch layer owns subphase state + phase-tracker"
-if grep -Fq 'subphases[]' "$DISPATCH" && grep -Fq "phase-tracker" "$DISPATCH"; then
-  pass "dispatch documents state.phases[3].subphases[] + phase-tracker"
-else
-  fail "dispatch missing subphases[]/phase-tracker documentation"
-fi
-
-echo ""
-echo "→ 5. phase docs carry the progress-contract adoption marker"
-if grep -Fq "<!-- progress-contract: applied -->" "$PHASE3"; then
-  pass "Phase 3 carries the adoption marker"
-else
-  fail "Phase 3 missing the adoption marker"
-fi
-if grep -Fq "<!-- progress-contract: applied -->" "$PHASE0"; then
-  pass "Phase 0 carries the adoption marker"
-else
-  fail "Phase 0 missing the adoption marker"
-fi
-
-echo ""
-echo "→ 6. Phase 3 emits the plugin dispatch progress line"
-if grep -qE '→ dispatching create-component' "$PHASE3"; then
-  pass "Phase 3 documents '→ dispatching create-component <name>' emission"
-else
-  fail "Phase 3 missing dispatch progress line"
-fi
-
-echo ""
-echo "→ 7. dispatch has failure + retry semantics"
-if grep -Fq "retryCount" "$DISPATCH"; then
-  pass "dispatch documents retryCount"
-else
-  fail "dispatch missing retryCount documentation"
-fi
-
-echo ""
-echo "→ 8. dispatch covers multi-repo + intentional cross-CLI divergence"
-if grep -Fq 'state.projects[]' "$DISPATCH"; then
-  pass "dispatch documents multi-repo report"
-else
-  fail "dispatch missing multi-repo report paragraph"
-fi
-if grep -Fiq "Copilot" "$DISPATCH"; then
-  pass "dispatch documents the Copilot cross-CLI divergence"
-else
-  fail "dispatch missing cross-CLI divergence note"
-fi
-
-echo ""
-echo "══ figma-dispatch smoke: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-gate-hooks.sh

@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-# smoke-gate-hooks.sh  -  the recommended Claude Code hooks template must be
-# valid JSON, wire the secret scan as a PreToolUse hook on git commit, and point
-# at the installed pre-commit-check.sh. This is the one gate that is OS-enforced
-# (a non-zero exit blocks the commit); the template is what makes it real for
-# end users instead of only the maintainer's local settings.
-#
-# Exit 0 = all pass, 1 = any failure.
-
-set -uo pipefail
-
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-TMPL="$ROOT/install/templates/claude-hooks.json"
-PASS=0; FAIL=0
-pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
-command -v node >/dev/null 2>&1 || { echo "error: node required" >&2; exit 127; }
-
-[ -f "$TMPL" ] || { echo "FAIL: hooks template missing at $TMPL" >&2; exit 1; }
-
-# 1. valid JSON
-if node -e 'JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"))' "$TMPL" 2>/dev/null; then
-  pass "hooks template is valid JSON"
-else
-  fail "hooks template is not valid JSON"
-fi
-
-# 2. wires a PreToolUse hook on git commit -> pre-commit-check.sh
-node -e '
-  const t = JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
-  const pre = t.hooks && t.hooks.PreToolUse;
-  if (!Array.isArray(pre) || pre.length === 0) { console.error("no PreToolUse"); process.exit(1); }
-  const onCommit = pre.find(h => /git commit/.test(h.matcher || ""));
-  if (!onCommit) { console.error("no git-commit matcher"); process.exit(1); }
-  const cmds = (onCommit.hooks || []).map(h => h.command || "").join(" ");
-  if (!/pre-commit-check\.sh/.test(cmds)) { console.error("does not call pre-commit-check.sh"); process.exit(1); }
-' "$TMPL" 2>/dev/null && pass "template wires secret scan as PreToolUse on git commit" || fail "template does not wire the secret-scan hook"
-
-# 3. the referenced script exists in the source tree
-if [ -f "$ROOT/pipeline/scripts/pre-commit-check.sh" ]; then
-  pass "pre-commit-check.sh exists to back the hook"
-else
-  fail "pre-commit-check.sh missing"
-fi
-
-# 3b. template also wires agent-guard.sh on git commit AND git push
-node -e '
-  const t = JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
-  const pre = (t.hooks && t.hooks.PreToolUse) || [];
-  const commit = pre.find(h => /git commit/.test(h.matcher || ""));
-  const push = pre.find(h => /git push/.test(h.matcher || ""));
-  const cmds = e => (e && e.hooks || []).map(h => h.command || "").join(" ");
-  if (!/agent-guard\.sh/.test(cmds(commit))) { console.error("guard not on git commit"); process.exit(1); }
-  if (!/agent-guard\.sh/.test(cmds(push))) { console.error("guard not on git push"); process.exit(1); }
-' "$TMPL" 2>/dev/null && pass "template wires agent-guard on git commit + git push" || fail "template does not wire agent-guard on both matchers"
-
-# 3c. the guard scripts exist in the source tree
-if [ -f "$ROOT/pipeline/scripts/agent-guard.sh" ] && [ -f "$ROOT/pipeline/scripts/agent-guard.py" ]; then
-  pass "agent-guard.sh + agent-guard.py exist to back the hook"
-else
-  fail "agent-guard scripts missing"
-fi
-
-# 4. picker-contract documents the hook template + the phase-enforced caveat
-PC="$ROOT/pipeline/multi-agent-refs/picker-contract.md"
-if grep -q "claude-hooks.json" "$PC" && grep -q "phase-enforced" "$PC"; then
-  pass "picker-contract references the template + the phase-enforced gates caveat"
-else
-  fail "picker-contract does not document the hooks template honestly"
-fi
-
-echo ""
-echo "══ gate-hooks smoke: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -eq 0 ]