@mmerterden/multi-agent-pipeline 13.4.0 → 13.5.1

package/CHANGELOG.md

@@ -16,6 +16,73 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [13.5.1] - 2026-07-28
+
+### Fixed
+
+- `ios-coding-standard`'s local lint runner defaulted its scratch root to
+  `~/.claude/local/...`. On a Copilot- or Codex-only machine that made the script create
+  a stray `.claude` directory belonging to a host that is not installed, just to hold
+  lint output. It now picks whichever host tree exists and falls back to `$TMPDIR`.
+  Found by the Codex sync verification, which flags any `$HOME/.claude/...` reference
+  that reaches the Codex tree.
+
+## [13.5.0] - 2026-07-28
+
+### Fixed
+
+- **Every fetcher died on a Copilot-only or Codex-only install.** Eleven runtime scripts
+  loaded `credential-store-resolver.sh` as `. "$HOME/.claude/lib/..." || . <next> || {
+  error }`, all of them under `set -e`. Sourcing a file that does not exist aborts the
+  shell outright - `||` included - so on a host without `~/.claude/lib` the chain reached
+  neither its later candidates nor its error branch: bare exit 1, no message. Reordering
+  does not help, because whichever candidate is absent aborts at that point. All eleven
+  now check `[ -f ]` before sourcing and decide on `$CRED_STORE`, and the resolver ends
+  with `resolve_credential_store || :` so sourcing it can never trip a caller's `set -e`.
+- The resolver only knew about `~/.claude` and `~/.copilot`. A Codex-only install could
+  not locate the credential helper at all, while the file sat in `~/.codex/lib`.
+- **Copilot CLI registered no MCP server.** Codex had registration from the day its
+  installer was written; Copilot never did, so it carried all 257 pipeline skills and
+  could not call one of the 80 dev-toolkit tools those skills depend on. Both hosts now
+  go through the shared `install/_mcp-register.mjs`, which also treats Copilot's
+  `already exists` (exit 1, unlike Codex's replace-and-exit-0) as the desired end state
+  rather than reporting a working registration as a failed install. Uninstall deregisters
+  on both.
+- **`figma-mcp-refresh.sh` called macOS `security` directly**, so silent Figma MCP token
+  renewal - the path that keeps every Figma consumer on Tier 1 - never worked on Linux or
+  Windows, and surfaced as an unexplained expired-token prompt. It now goes through
+  `credential-store.sh` with the `set <key> -` stdin form, which keeps the secret off
+  argv on every platform, the property the old `security -i` call was preserving.
+- **`phase-tracker.sh` hashed with a bare `shasum`** - a perl script absent from slim
+  Linux images. Where it was missing, OTel trace and span ids came back empty: valid
+  JSON, useless telemetry, no error. Same for `post-pr-review.sh`, where an empty
+  fingerprint made every finding look new and re-posted the whole review each iteration.
+- `audit-log.sh` fell back to printing `unhashed:<url>` when no hasher was available,
+  writing the plaintext remote - credentials included, if the URL carried any - into the
+  audit log that hashing exists to protect. It emits a marker instead.
+- `smoke-write-state.sh` counted an honest exit-2 lock timeout as data loss, because it
+  read the final state without looking at exit codes. That made it fail once inside a
+  fully loaded suite run while passing 12/12 in isolation - a flake that read as a
+  data-loss bug and would eventually have been "fixed" by lowering the writer count,
+  removing the regression detection the test exists for. It now asserts the real
+  invariant: no writer reports success while losing its update.
+- `smoke-token-preflight.sh` asserted the literal `security add-generic-password`, which
+  pinned the implementation to macOS. It now asserts the portable route and fails if a
+  direct platform keychain call comes back.
+- `multi-agent-refs/rules.md` pointed at `~/.claude/scripts/vercel-deploy.sh`; the
+  wrapper installs to `lib/` with the other shell libraries.
+
+### Added
+
+- **`smoke-shell-portability.sh`** (8 assertions) over every shell file that ships to a
+  user tree: single-platform hashing without a fallback, unguarded BSD/GNU-divergent
+  constructs, hardcoded absolute home paths, direct platform keychain calls, and the
+  `.`-chain-under-`set -e` trap above. It found the `post-pr-review.sh` hasher and the
+  `figma-mcp-refresh.sh` keychain call on its first run.
+- `smoke-install-layout.sh --update-fixture` regenerates the layout fixture from the tree
+  the gate itself installs, probe plugin included. The documented hand-rolled recipe
+  omitted it, so following it baked a three-file shortfall into the fixture.
+
 ## [13.4.0] - 2026-07-28
 
 ### Added

package/install/_mcp-register.mjs

@@ -0,0 +1,125 @@
+/**
+ * Register the companion MCP server with a host CLI.
+ *
+ * WHY THIS IS SHARED
+ *
+ * Codex got MCP registration when its installer was written; Copilot never did. The
+ * result was a host that carried all 257 pipeline skills and could not call a single
+ * one of the 80 dev-toolkit tools those skills depend on - `design-check`, every
+ * `ios_*` / `android_*` simulator call, the archive audits. Nothing failed at install
+ * time, and the skills only fail when a run actually reaches for a tool.
+ *
+ * Both CLIs take the same shape (`<cli> mcp add <name> -- <command> [args...]`) and
+ * both write their own user-level config, so the difference was purely that one
+ * installer called it and the other did not. One implementation, two callers.
+ *
+ * @module install/_mcp-register
+ */
+
+import { execFileSync } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+
+import { isDryRun } from "./_common.mjs";
+
+export const MCP_SERVER_NAME = "dev-toolkit";
+export const MCP_SERVER_PACKAGE = "@mmerterden/dev-toolkit-mcp";
+
+/**
+ * Where each host's CLI might live.
+ *
+ * A bare name is resolved through PATH by execFileSync. The explicit paths matter for
+ * Copilot: `copilot` is frequently a *shell alias* for `gh copilot`, and an alias is
+ * invisible to execFileSync - so a PATH-only lookup reports "not on PATH" on a machine
+ * where the user runs `copilot` every day. `gh` installs the real binary under
+ * ~/.local/share/gh/copilot/.
+ */
+const CLI_CANDIDATES = Object.freeze({
+  codex: ["codex"],
+  copilot: ["copilot", join(homedir(), ".local", "share", "gh", "copilot", "copilot")],
+});
+
+/**
+ * First candidate that exists as a file, or the first bare name to let PATH resolution
+ * try. Returning a bare name rather than null keeps the "not on PATH" diagnosis in one
+ * place: the execFileSync catch.
+ *
+ * @param {"codex"|"copilot"} host
+ * @returns {string}
+ */
+function resolveCli(host) {
+  const candidates = CLI_CANDIDATES[host] || [host];
+  for (const c of candidates) {
+    if (c.includes("/") && existsSync(c)) return c;
+  }
+  return candidates[0];
+}
+
+/**
+ * Register the MCP server. Idempotent from the caller's point of view, though the two
+ * CLIs get there differently:
+ *
+ * - `codex mcp add` replaces an existing entry and exits 0.
+ * - `copilot mcp add` refuses, printing `Server "<name>" already exists` and exiting 1.
+ *
+ * So a non-zero exit is not automatically a failure. An already-registered server is
+ * the desired end state, and reporting it as "skipped MCP registration (Command
+ * failed)" would send the user to fix something that is already correct - which is
+ * exactly what the first version of this did.
+ *
+ * The existing entry is left alone rather than removed and re-added: a user may have
+ * added env vars or switched the command to a local checkout, and an installer has no
+ * business discarding that.
+ *
+ * Never fatal: a missing CLI or a failed write must not fail the install, because the
+ * rest of the tree is still correct and useful. It prints the manual command instead.
+ *
+ * @param {"codex"|"copilot"} host
+ * @param {string} label - host label for log lines
+ * @returns {{registered: boolean, alreadyPresent?: boolean, reason?: string}}
+ */
+export function registerMcpServer(host, label) {
+  const cli = resolveCli(host);
+  const manual = `${host} mcp add ${MCP_SERVER_NAME} -- npx -y ${MCP_SERVER_PACKAGE}`;
+
+  if (isDryRun()) {
+    console.log(`    [dry-run] would run: ${manual}`);
+    return { registered: false, reason: "dry-run" };
+  }
+
+  // Opt-out for hermetic installs. Registration shells out to the host CLI, so its
+  // result depends on whether that binary is present - which makes the install layout
+  // non-deterministic across machines and CI. The layout smoke sets this so its
+  // fingerprint stays stable.
+  if (process.env.MULTI_AGENT_SKIP_MCP_REGISTER === "1") {
+    console.log(`    -> ${label}: skipped MCP registration (MULTI_AGENT_SKIP_MCP_REGISTER=1)`);
+    return { registered: false, reason: "opted out" };
+  }
+
+  try {
+    // Bounded: an installer must never hang on a child process. This is a local config
+    // write and returns in milliseconds.
+    execFileSync(cli, ["mcp", "add", MCP_SERVER_NAME, "--", "npx", "-y", MCP_SERVER_PACKAGE], {
+      stdio: "pipe",
+      timeout: 20_000,
+    });
+    console.log(`    -> ${label}: registered the ${MCP_SERVER_NAME} MCP server`);
+    return { registered: true };
+  } catch (e) {
+    // The CLI writes its diagnosis to stderr, which execFileSync parks on the error
+    // rather than in `message`. Read both, or "already exists" is invisible.
+    const out = `${e?.stderr?.toString() ?? ""}\n${e?.stdout?.toString() ?? ""}\n${e?.message ?? ""}`;
+    if (/already exists/i.test(out)) {
+      console.log(`    -> ${label}: ${MCP_SERVER_NAME} MCP server already registered, left as-is`);
+      return { registered: true, alreadyPresent: true };
+    }
+    const why =
+      e?.code === "ENOENT"
+        ? `${host} not on PATH`
+        : (out.split("\n").find((l) => l.trim()) || "unknown error").trim();
+    console.log(`    -> ${label}: skipped MCP registration (${why})`);
+    console.log(`       run manually: ${manual}`);
+    return { registered: false, reason: why };
+  }
+}

package/install/codex.mjs

@@ -19,7 +19,6 @@
 
 import { existsSync, readFileSync, readdirSync, rmSync } from "fs";
 import { join } from "path";
-import { execFileSync } from "child_process";
 
 import {
   copyDir,
@@ -32,6 +31,7 @@ import {
   writeFile,
 } from "./_common.mjs";
 import { DEV_ONLY_SCRIPTS, countDevOnlyFiles } from "./_dev-only-files.mjs";
+import { registerMcpServer } from "./_mcp-register.mjs";
 import { installCodexAgents } from "./_codex-agents.mjs";
 import { existingSkillNames, installAuthoredPluginSkills } from "./_plugin-skills.mjs";
 import { generateCodexInstructions } from "./_codex-instructions.mjs";
@@ -43,9 +43,8 @@ export const AGENTS_MD_START_MARKER = "# Multi-Agent Development Pipeline";
 /** Explicit end marker written after the pipeline section. */
 export const AGENTS_MD_END_MARKER = "<!-- multi-agent-pipeline:codex-instructions:end -->";
 
-/** MCP server the pipeline's `/multi-agent:test` + design-check flows depend on. */
-export const MCP_SERVER_NAME = "dev-toolkit";
-const MCP_SERVER_PACKAGE = "@mmerterden/dev-toolkit-mcp";
+/** Re-exported for the uninstaller and the Codex install smoke. */
+export { MCP_SERVER_NAME } from "./_mcp-register.mjs";
 
 /**
  * `$HOME/.claude/...` path rewrites applied to every file installed into the
@@ -200,7 +199,7 @@ export function installCodex(ctx) {
   installTree("rules", pipelineSrc, CODEX_RULES, useSymlinks);
   writeAgentsMd(join(CODEX_DIR, "AGENTS.md"));
   ensureSharedPreferences(home, pipelineSrc);
-  registerMcpServer();
+  registerMcpServer("codex", "Codex CLI");
 
   console.log("");
 }
@@ -482,37 +481,4 @@ function ensureSharedPreferences(home, pipelineSrc) {
  * it. Hand-merging TOML here would be the riskiest write in this installer for
  * no benefit.
  */
-function registerMcpServer() {
-  if (isDryRun()) {
-    console.log(
-      `    [dry-run] would run: codex mcp add ${MCP_SERVER_NAME} -- npx -y ${MCP_SERVER_PACKAGE}`,
-    );
-    return;
-  }
-  // Opt-out for hermetic installs. Registration shells out to `codex`, so its
-  // result depends on whether the binary is present - which makes the install
-  // layout non-deterministic across machines and CI. The layout smoke sets this
-  // so its fingerprint stays stable.
-  if (process.env.MULTI_AGENT_SKIP_MCP_REGISTER === "1") {
-    console.log("    -> skipped MCP registration (MULTI_AGENT_SKIP_MCP_REGISTER=1)");
-    return;
-  }
-  try {
-    // Bounded: an installer must never hang on a child process. `codex mcp add`
-    // is a local config write and returns in milliseconds.
-    execFileSync("codex", ["mcp", "add", MCP_SERVER_NAME, "--", "npx", "-y", MCP_SERVER_PACKAGE], {
-      stdio: "pipe",
-      timeout: 20_000,
-    });
-    console.log(`    -> registered the ${MCP_SERVER_NAME} MCP server`);
-  } catch (e) {
-    const why =
-      e?.code === "ENOENT" ? "codex not on PATH" : (e?.message || "unknown error").split("\n")[0];
-    console.log(`    -> skipped MCP registration (${why})`);
-    console.log(
-      `       run manually: codex mcp add ${MCP_SERVER_NAME} -- npx -y ${MCP_SERVER_PACKAGE}`,
-    );
-  }
-}
-
 export { generateCodexInstructions };

package/install/copilot.mjs

@@ -26,6 +26,7 @@ import { DEV_ONLY_SCRIPTS, countDevOnlyFiles } from "./_dev-only-files.mjs";
 import { generateCopilotInstructions } from "./_copilot-instructions.mjs";
 import { legacyTrailingContent, mergeManagedBlock } from "./_managed-block.mjs";
 import { existingSkillNames, installAuthoredPluginSkills } from "./_plugin-skills.mjs";
+import { registerMcpServer } from "./_mcp-register.mjs";
 
 /**
  * @param {{
@@ -56,6 +57,13 @@ export function installCopilot(ctx) {
   installSchemas(pipelineSrc, COPILOT_SCHEMAS, useSymlinks);
   installLib(pipelineSrc, COPILOT_LIB, useSymlinks);
   installSkills({ home, pipelineSrc, dest: COPILOT_SKILLS, indexOnly, useSymlinks, platformFlag });
+
+  // Copilot never registered the companion MCP server, while Codex did from the day its
+  // installer was written. So Copilot carried every pipeline skill and could not call a
+  // single one of the tools those skills depend on: design-check, the ios_* / android_*
+  // simulator calls, the archive audits. Nothing failed at install time - the skills
+  // only fail once a run reaches for a tool that is not there.
+  registerMcpServer("copilot", "Copilot CLI");
 }
 
 /** Start of the pipeline-managed span in copilot-instructions.md. */

package/install/index.mjs

@@ -182,11 +182,16 @@ function printSummary(opts) {
     console.log("");
   }
 
-  console.log("  For UI testing, also install the mobile MCP server:");
+  console.log("  For UI testing, the mobile MCP server:");
   if (forCodex) {
-    console.log("    Codex: registered automatically (codex mcp add dev-toolkit)");
+    console.log("    Codex CLI:   registered automatically (codex mcp add dev-toolkit)");
+  }
+  if (forCopilot) {
+    console.log("    Copilot CLI: registered automatically (copilot mcp add dev-toolkit)");
+  }
+  if (forClaude) {
+    console.log("    Claude Code: add it yourself - claude mcp add dev-toolkit -- npx -y @mmerterden/dev-toolkit-mcp");
   }
-  console.log("    Otherwise add to your MCP config: npx @mmerterden/dev-toolkit-mcp");
   console.log("");
   console.log("  Uninstall everything: npx @mmerterden/multi-agent-pipeline uninstall");
   console.log("  (Personal access tokens in keychain are preserved.)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "13.4.0",
+  "version": "13.5.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/lib/account-resolver.sh

@@ -69,10 +69,21 @@ except Exception:
 # A pre-set CRED_STORE (tests, custom installs) is honored as-is.
 if [ -z "${CRED_STORE:-}" ]; then
   # shellcheck disable=SC1090,SC1091
-  . "$(cd "$(dirname "$0")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
-    || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-    || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-    || true
+  # Existence check before sourcing: `. <missing>` aborts the shell under `set -e`,
+  # `||` included, so a `.`-chain reaches neither its later candidates nor its error
+  # branch. The loop also covers all three hosts - the chain it replaced knew only
+  # .claude and .copilot, so a Codex-only install could not resolve at all.
+  for _cred_resolver in \
+    "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+    "$HOME/.claude/lib/credential-store-resolver.sh" \
+    "$HOME/.copilot/lib/credential-store-resolver.sh" \
+    "$HOME/.codex/lib/credential-store-resolver.sh"; do
+    [ -f "$_cred_resolver" ] || continue
+    # shellcheck source=/dev/null
+    . "$_cred_resolver" 2>/dev/null || true
+    if [ -n "${CRED_STORE:-}" ]; then break; fi
+  done
+  unset _cred_resolver
 fi
 services=""
 if [ -n "${CRED_STORE:-}" ]; then

package/pipeline/lib/credential-inventory.sh

@@ -111,6 +111,14 @@ probe_http() {
 }
 
 # probe_basic <url> <user> <pass> -> prints the HTTP status
+# probe_basic_hdr <url> <user> <pass> <header-name> <header-value> -> HTTP status
+probe_basic_hdr() {
+  local url="$1" u="$2" pw="$3" hname="$4" hval="$5" out
+  out=$(printf 'url = "%s"\nuser = "%s:%s"\nheader = "%s: %s"\nsilent\noutput = "/dev/null"\nwrite-out = "%%{http_code}"\nmax-time = %s\n' \
+    "$url" "$u" "$pw" "$hname" "$hval" "$TIMEOUT" | curl --config - 2>/dev/null)
+  printf '%s' "${out:-000}"
+}
+
 probe_basic() {
   local url="$1" u="$2" p="$3" out
   out=$(printf 'url = "%s"\nuser = "%s:%s"\nsilent\noutput = "/dev/null"\nwrite-out = "%%{http_code}"\nmax-time = %s\n' \
@@ -125,6 +133,10 @@ probe_basic() {
 classify_status() {
   case "$1" in
     2??)      echo "reachable" ;;
+    # A redirect means the host answered. Corporate services commonly bounce an
+    # unauthenticated API call to an SSO login page, which classify as auth-rejected
+    # rather than reachable: the request did not get its data.
+    30?)      echo "auth-rejected" ;;
     401|403)  echo "auth-rejected" ;;
     404)      echo "reachable" ;;   # endpoint answered; the probe path may just not exist
     000|"")   echo "unreachable" ;;
@@ -185,11 +197,22 @@ probe_one() {
     fortify)
       host=$(pref global.hosts.fortify)
       [ -n "$host" ] || { echo "no-host-configured"; return; }
-      status=$(probe_http "https://${host}/api/v1/projects?limit=1" "Authorization" "Bearer $tok") ;;
+      # Shapes copied from fetch-fortify.sh, which already works against SSC: the API
+      # lives under /ssc/, and SSC accepts either a Bearer token or its own
+      # `FortifyToken <base64>` scheme. Probing the wrong base path returned a 302 to
+      # the login page and read as a broken credential.
+      status=$(probe_http "https://${host}/ssc/api/v1/projects?limit=1" "Authorization" "Bearer $tok")
+      if [ "$(classify_status "$status")" != "reachable" ]; then
+        status=$(probe_http "https://${host}/ssc/api/v1/projects?limit=1" \
+          "Authorization" "FortifyToken $(printf '%s' "$tok" | base64 | tr -d '\n')")
+      fi ;;
     graylog)
       host=$(pref global.hosts.graylog)
       [ -n "$host" ] || { echo "no-host-configured"; return; }
-      status=$(probe_http "https://${host}/api/system" "Authorization" "Bearer $tok") ;;
+      # Graylog PATs authenticate as basic auth with the literal password "token", and
+      # the API rejects requests without X-Requested-By. Both per fetch-graylog.sh.
+      status=$(probe_basic_hdr "https://${host}/api/system" "$tok" "token" \
+        "X-Requested-By" "multi-agent-pipeline") ;;
     jenkins)
       host=$(pref global.hosts.jenkins)
       [ -n "$host" ] || { echo "no-host-configured"; return; }

package/pipeline/lib/credential-store-resolver.sh

@@ -13,15 +13,31 @@
 # error instead of `bash: $CRED_STORE: command not found`.
 #
 # Usage from a skill bash block:
-#   . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-#     || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-#     || { echo "credential helper not found  -  run npx @mmerterden/multi-agent-pipeline install" >&2; exit 1; }
+#   for r in "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+#            "$HOME/.claude/lib/credential-store-resolver.sh" \
+#            "$HOME/.copilot/lib/credential-store-resolver.sh" \
+#            "$HOME/.codex/lib/credential-store-resolver.sh"; do
+#     [ -f "$r" ] || continue
+#     . "$r" 2>/dev/null || true
+#     if [ -n "${CRED_STORE:-}" ]; then break; fi
+#   done
+#   [ -n "${CRED_STORE:-}" ] || { echo "credential helper not found  -  run the installer" >&2; exit 1; }
 #   TOKEN=$("$CRED_STORE" get "<KEY>")
+#
+# Two rules, both learned from a silent failure:
+#   1. Check the FILE EXISTS before sourcing it. `. <missing>` aborts the shell under
+#      `set -e`, `||` included, so a `.`-chain never reaches its later candidates.
+#   2. Decide on `$CRED_STORE`, never on the source's exit status. Sourcing this file
+#      always succeeds by design, so the caller stays alive to report a useful error.
 
 resolve_credential_store() {
+  # All three supported hosts. Codex was missing here, so a Codex-only install could
+  # not resolve the credential helper at all - every fetcher on that host reported
+  # "credential helper not found" while the file sat in ~/.codex/lib.
   local cands=(
     "$HOME/.claude/lib/credential-store.sh"
     "$HOME/.copilot/lib/credential-store.sh"
+    "$HOME/.codex/lib/credential-store.sh"
   )
   for c in "${cands[@]}"; do
     if [ -x "$c" ]; then
@@ -36,11 +52,13 @@ credential helper not found.
 The multi-agent pipeline expects one of these to exist:
   ~/.claude/lib/credential-store.sh    (Claude Code installs)
   ~/.copilot/lib/credential-store.sh   (Copilot CLI installs)
+  ~/.codex/lib/credential-store.sh     (Codex CLI installs)
 
 Install with:
   npx @mmerterden/multi-agent-pipeline install --claude       # Claude Code
   npx @mmerterden/multi-agent-pipeline install --copilot      # Copilot CLI
-  npx @mmerterden/multi-agent-pipeline install --all          # both
+  npx @mmerterden/multi-agent-pipeline install --codex        # Codex CLI
+  npx @mmerterden/multi-agent-pipeline install --all          # all three
 
 Or override `CRED_STORE` to point at a custom path before sourcing this resolver.
 MSG
@@ -53,5 +71,16 @@ MSG
 if [ "${BASH_SOURCE[0]:-$0}" = "${0}" ]; then
   resolve_credential_store && echo "$CRED_STORE"
 else
-  resolve_credential_store
+  # `|| :` matters, and it is not cosmetic.
+  #
+  # A sourced file runs in the caller's shell, so a bare failing command at this top
+  # level trips the caller's `set -e` DURING the source - before the caller's own
+  # `. resolver || fallback` can catch anything. Eleven runtime scripts loaded this
+  # resolver that way, all of them with `set -e`, so on any host where the first
+  # credential-store candidate was absent (a Copilot-only or Codex-only install) they
+  # died with a bare exit 1, no message, and their error branches unreachable.
+  #
+  # Sourcing therefore always succeeds. Callers MUST decide on `$CRED_STORE` being
+  # non-empty, never on the source's exit status - see the usage note above.
+  resolve_credential_store || :
 fi

package/pipeline/lib/fetch-confluence.sh

@@ -126,11 +126,33 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Confluence_Access_Token"
 
-# Locate the credential helper via the resolver so Copilot-only installs work.
-# shellcheck disable=SC1090,SC1091
-. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"confluence","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+# Locate the resolver with an existence check, not a `.`-chain.
+#
+# Sourcing a file that does not exist aborts the shell under `set -e` - `||` included -
+# so `. <candidate> || . <candidate> || { error }` reaches neither its later candidates
+# nor its error branch. Every fetcher used that shape starting from `$HOME/.claude/...`,
+# so on a Copilot-only or Codex-only install they all died with a bare exit 1 and no
+# message. Reordering does not help: whichever candidate is absent aborts at that point.
+# Checking for the file before sourcing it is the only safe form.
+for _cred_resolver in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/credential-store-resolver.sh" \
+  "$HOME/.claude/lib/credential-store-resolver.sh" \
+  "$HOME/.copilot/lib/credential-store-resolver.sh" \
+  "$HOME/.codex/lib/credential-store-resolver.sh"; do
+  [ -f "$_cred_resolver" ] || continue
+  # shellcheck source=/dev/null
+  . "$_cred_resolver" 2>/dev/null || true
+  # `if`, not `[ ... ] && break`: the latter is the loop body's last command and returns
+  # 1 when CRED_STORE is still empty, which under `set -e` kills the loop on the first
+  # candidate that does not resolve - the very case the loop exists to survive.
+  if [ -n "${CRED_STORE:-}" ]; then break; fi
+done
+unset _cred_resolver
+if [ -z "${CRED_STORE:-}" ]; then
+  printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"confluence","expected_key":"'"$TOKEN_KEY"'"}' >&2
+  exit 2
+fi
 
 TOKEN=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$TOKEN" ]; then

package/pipeline/lib/fetch-crashlytics.sh

@@ -124,11 +124,33 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Firebase_Access_Json"
 
-# Locate the credential helper via the resolver so Copilot-only installs work.
-# shellcheck disable=SC1090,SC1091
-. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"firebase","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+# Locate the resolver with an existence check, not a `.`-chain.
+#
+# Sourcing a file that does not exist aborts the shell under `set -e` - `||` included -
+# so `. <candidate> || . <candidate> || { error }` reaches neither its later candidates
+# nor its error branch. Every fetcher used that shape starting from `$HOME/.claude/...`,
+# so on a Copilot-only or Codex-only install they all died with a bare exit 1 and no
+# message. Reordering does not help: whichever candidate is absent aborts at that point.
+# Checking for the file before sourcing it is the only safe form.
+for _cred_resolver in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/credential-store-resolver.sh" \
+  "$HOME/.claude/lib/credential-store-resolver.sh" \
+  "$HOME/.copilot/lib/credential-store-resolver.sh" \
+  "$HOME/.codex/lib/credential-store-resolver.sh"; do
+  [ -f "$_cred_resolver" ] || continue
+  # shellcheck source=/dev/null
+  . "$_cred_resolver" 2>/dev/null || true
+  # `if`, not `[ ... ] && break`: the latter is the loop body's last command and returns
+  # 1 when CRED_STORE is still empty, which under `set -e` kills the loop on the first
+  # candidate that does not resolve - the very case the loop exists to survive.
+  if [ -n "${CRED_STORE:-}" ]; then break; fi
+done
+unset _cred_resolver
+if [ -z "${CRED_STORE:-}" ]; then
+  printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"firebase","expected_key":"'"$TOKEN_KEY"'"}' >&2
+  exit 2
+fi
 
 SA_JSON_B64=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$SA_JSON_B64" ]; then

package/pipeline/lib/fetch-figma-annotations.sh

@@ -38,10 +38,24 @@
 set -uo pipefail
 
 PREFS="$HOME/.claude/multi-agent-preferences.json"
-# shellcheck disable=SC1090,SC1091
-. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-  || true
+# Locate the resolver with an existence check, not a `.`-chain: sourcing a missing file
+# aborts the shell under `set -e`, `||` included, so a chain skips both its later
+# candidates and its trailing `|| true`. A missing store is tolerated here - CRED_STORE
+# simply stays empty and the caller falls back to an env-supplied token.
+for _cred_resolver in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+  "$HOME/.claude/lib/credential-store-resolver.sh" \
+  "$HOME/.copilot/lib/credential-store-resolver.sh" \
+  "$HOME/.codex/lib/credential-store-resolver.sh"; do
+  [ -f "$_cred_resolver" ] || continue
+  # shellcheck source=/dev/null
+  . "$_cred_resolver" 2>/dev/null || true
+  # `if`, not `[ ... ] && break`: the latter is the loop body's last command and returns
+  # 1 when CRED_STORE is still empty, which under `set -e` kills the loop on the first
+  # candidate that does not resolve - the very case the loop exists to survive.
+  if [ -n "${CRED_STORE:-}" ]; then break; fi
+done
+unset _cred_resolver
 CRED_STORE="${CRED_STORE:-}"
 FIGMA_API="https://api.figma.com/v1"
 HTTP_TIMEOUT=60

package/pipeline/lib/fetch-fortify.sh

@@ -128,11 +128,33 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Fortify_Access_Token"
 
-# Locate the credential helper via the resolver so Copilot-only installs work.
-# shellcheck disable=SC1090,SC1091
-. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"fortify","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+# Locate the resolver with an existence check, not a `.`-chain.
+#
+# Sourcing a file that does not exist aborts the shell under `set -e` - `||` included -
+# so `. <candidate> || . <candidate> || { error }` reaches neither its later candidates
+# nor its error branch. Every fetcher used that shape starting from `$HOME/.claude/...`,
+# so on a Copilot-only or Codex-only install they all died with a bare exit 1 and no
+# message. Reordering does not help: whichever candidate is absent aborts at that point.
+# Checking for the file before sourcing it is the only safe form.
+for _cred_resolver in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/credential-store-resolver.sh" \
+  "$HOME/.claude/lib/credential-store-resolver.sh" \
+  "$HOME/.copilot/lib/credential-store-resolver.sh" \
+  "$HOME/.codex/lib/credential-store-resolver.sh"; do
+  [ -f "$_cred_resolver" ] || continue
+  # shellcheck source=/dev/null
+  . "$_cred_resolver" 2>/dev/null || true
+  # `if`, not `[ ... ] && break`: the latter is the loop body's last command and returns
+  # 1 when CRED_STORE is still empty, which under `set -e` kills the loop on the first
+  # candidate that does not resolve - the very case the loop exists to survive.
+  if [ -n "${CRED_STORE:-}" ]; then break; fi
+done
+unset _cred_resolver
+if [ -z "${CRED_STORE:-}" ]; then
+  printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"fortify","expected_key":"'"$TOKEN_KEY"'"}' >&2
+  exit 2
+fi
 
 TOKEN=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$TOKEN" ]; then

package/pipeline/lib/fetch-graylog.sh

@@ -118,11 +118,33 @@ except Exception:
 fi
 [ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Graylog_Access_Token"
 
-# Locate the credential helper via the resolver so Copilot-only installs work.
-# shellcheck disable=SC1090,SC1091
-. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-  || { printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"graylog","expected_key":"'"$TOKEN_KEY"'"}' >&2; exit 2; }
+# Locate the resolver with an existence check, not a `.`-chain.
+#
+# Sourcing a file that does not exist aborts the shell under `set -e` - `||` included -
+# so `. <candidate> || . <candidate> || { error }` reaches neither its later candidates
+# nor its error branch. Every fetcher used that shape starting from `$HOME/.claude/...`,
+# so on a Copilot-only or Codex-only install they all died with a bare exit 1 and no
+# message. Reordering does not help: whichever candidate is absent aborts at that point.
+# Checking for the file before sourcing it is the only safe form.
+for _cred_resolver in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/credential-store-resolver.sh" \
+  "$HOME/.claude/lib/credential-store-resolver.sh" \
+  "$HOME/.copilot/lib/credential-store-resolver.sh" \
+  "$HOME/.codex/lib/credential-store-resolver.sh"; do
+  [ -f "$_cred_resolver" ] || continue
+  # shellcheck source=/dev/null
+  . "$_cred_resolver" 2>/dev/null || true
+  # `if`, not `[ ... ] && break`: the latter is the loop body's last command and returns
+  # 1 when CRED_STORE is still empty, which under `set -e` kills the loop on the first
+  # candidate that does not resolve - the very case the loop exists to survive.
+  if [ -n "${CRED_STORE:-}" ]; then break; fi
+done
+unset _cred_resolver
+if [ -z "${CRED_STORE:-}" ]; then
+  printf '%s\n' '{"status":"blocked","reason":"missing-credential-helper","service":"graylog","expected_key":"'"$TOKEN_KEY"'"}' >&2
+  exit 2
+fi
 
 TOKEN=$("$CRED_STORE" get "$TOKEN_KEY" 2>/dev/null || true)
 if [ -z "$TOKEN" ]; then

package/pipeline/lib/figma-mcp-refresh.sh

@@ -20,7 +20,6 @@ set -euo pipefail
 
 PREFS_FILE="${PREFS_FILE:-$HOME/.claude/multi-agent-preferences.json}"
 TOKEN_ENDPOINT="https://api.figma.com/v1/oauth/token"
-ACCOUNT="${USER:-$(whoami)}"
 
 say() { printf '%s\n' "$*"; }
 
@@ -30,7 +29,36 @@ KEY_NAME=$(jq -r '.global.keychainMapping.figma_mcp // empty' "$PREFS_FILE")
 [ -n "$KEY_NAME" ] || { say "figma-mcp-refresh: keychainMapping.figma_mcp not set"; exit 2; }
 
 REFRESH_KEY="${KEY_NAME}_Refresh"
-REFRESH_TOKEN=$(security find-generic-password -s "$REFRESH_KEY" -w 2>/dev/null || true)
+
+# Locate the resolver with an existence check, not a `.`-chain.
+#
+# Sourcing a file that does not exist aborts the shell under `set -e` - `||` included -
+# so `. <candidate> || . <candidate> || { error }` reaches neither its later candidates
+# nor its error branch. Every fetcher used that shape starting from `$HOME/.claude/...`,
+# so on a Copilot-only or Codex-only install they all died with a bare exit 1 and no
+# message. Reordering does not help: whichever candidate is absent aborts at that point.
+# Checking for the file before sourcing it is the only safe form.
+for _cred_resolver in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/credential-store-resolver.sh" \
+  "$HOME/.claude/lib/credential-store-resolver.sh" \
+  "$HOME/.copilot/lib/credential-store-resolver.sh" \
+  "$HOME/.codex/lib/credential-store-resolver.sh"; do
+  [ -f "$_cred_resolver" ] || continue
+  # shellcheck source=/dev/null
+  . "$_cred_resolver" 2>/dev/null || true
+  # `if`, not `[ ... ] && break`: the latter is the loop body's last command and returns
+  # 1 when CRED_STORE is still empty, which under `set -e` kills the loop on the first
+  # candidate that does not resolve - the very case the loop exists to survive.
+  if [ -n "${CRED_STORE:-}" ]; then break; fi
+done
+unset _cred_resolver
+if [ -z "${CRED_STORE:-}" ]; then
+  say "figma-mcp-refresh: credential helper not found  -  run the pipeline installer"
+  exit 2
+fi
+
+REFRESH_TOKEN=$("$CRED_STORE" get "$REFRESH_KEY" 2>/dev/null || true)
 [ -n "$REFRESH_TOKEN" ] || { say "figma-mcp-refresh: no refresh token at '$REFRESH_KEY'"; exit 2; }
 
 SCRIPT_PATH=$(jq -r '.global.tokenScripts.figma_mcp // empty' "$PREFS_FILE")
@@ -69,17 +97,13 @@ if [ -z "$NEW_ACCESS" ]; then
   exit 1
 fi
 
-# Keychain write: the add-generic-password command is fed to `security -i`
-# over stdin instead of the direct `security add-generic-password -w <secret>`
-# argv form, so the secret never shows up in process listings. printf is a
-# bash builtin, so no argv exposure there either. Attributes match the
-# previous direct call (-T "" -U). Figma tokens are URL-safe, so embedding in
-# the quoted command string is safe.
+# Keychain write through credential-store.sh with the `-` form, which reads the secret
+# from stdin: the value never lands on any argv (visible to ps), which is the property
+# the previous `security -i` call was carefully preserving. The store does the same thing
+# per platform, so that property now holds on Linux and Windows as well.
 save_keychain_secret() {
   local service="$1" secret="$2"
-  security delete-generic-password -s "$service" -a "$ACCOUNT" >/dev/null 2>&1 || true
-  printf 'add-generic-password -U -s "%s" -a "%s" -T "" -w "%s"\n' \
-    "$service" "$ACCOUNT" "$secret" | security -i >/dev/null
+  printf '%s' "$secret" | "$CRED_STORE" set "$service" - >/dev/null
 }
 
 # Save new access token first, then the rotated refresh token  -  order matters so a

package/pipeline/lib/figma-screenshot.sh

@@ -42,13 +42,24 @@ set -euo pipefail
 # --- Globals ----------------------------------------------------------------
 
 PREFS="$HOME/.claude/multi-agent-preferences.json"
-# Locate the credential helper via the resolver so Copilot-only installs work.
-# The helper is optional here: the FIGMA_PAT env fallback still applies when
-# no helper is installed, so a resolver miss must not abort the script.
-# shellcheck disable=SC1090,SC1091
-. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-  || true
+# Locate the resolver with an existence check, not a `.`-chain: sourcing a missing file
+# aborts the shell under `set -e`, `||` included, so a chain skips both its later
+# candidates and its trailing `|| true`. A missing store is tolerated here - CRED_STORE
+# simply stays empty and the caller falls back to an env-supplied token.
+for _cred_resolver in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+  "$HOME/.claude/lib/credential-store-resolver.sh" \
+  "$HOME/.copilot/lib/credential-store-resolver.sh" \
+  "$HOME/.codex/lib/credential-store-resolver.sh"; do
+  [ -f "$_cred_resolver" ] || continue
+  # shellcheck source=/dev/null
+  . "$_cred_resolver" 2>/dev/null || true
+  # `if`, not `[ ... ] && break`: the latter is the loop body's last command and returns
+  # 1 when CRED_STORE is still empty, which under `set -e` kills the loop on the first
+  # candidate that does not resolve - the very case the loop exists to survive.
+  if [ -n "${CRED_STORE:-}" ]; then break; fi
+done
+unset _cred_resolver
 CRED_STORE="${CRED_STORE:-}"
 FIGMA_API="https://api.figma.com/v1"
 PARALLEL_DL=4

package/pipeline/lib/issue-fetcher.sh

@@ -113,10 +113,25 @@ fetch_jira() {
   # A pre-set CRED_STORE (tests, custom installs) is honored as-is.
   if [ -z "${CRED_STORE:-}" ]; then
     # shellcheck disable=SC1090,SC1091
-    . "$(cd "$(dirname "$0")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
-      || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-      || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-      || { echo "ERR: credential helper not found" >&2; return 1; }
+    # Existence check before sourcing: `. <missing>` aborts the shell under `set -e`,
+    # `||` included, so a `.`-chain reaches neither its later candidates nor its error
+    # branch. The loop also covers all three hosts - the chain it replaced knew only
+    # .claude and .copilot, so a Codex-only install could not resolve at all.
+    for _cred_resolver in \
+      "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+      "$HOME/.claude/lib/credential-store-resolver.sh" \
+      "$HOME/.copilot/lib/credential-store-resolver.sh" \
+      "$HOME/.codex/lib/credential-store-resolver.sh"; do
+      [ -f "$_cred_resolver" ] || continue
+      # shellcheck source=/dev/null
+      . "$_cred_resolver" 2>/dev/null || true
+      if [ -n "${CRED_STORE:-}" ]; then break; fi
+    done
+    unset _cred_resolver
+    if [ -z "${CRED_STORE:-}" ]; then
+      echo "ERR: credential helper not found" >&2
+      return 1
+    fi
   fi
   local token
   token=$("$CRED_STORE" get "$JIRA_TOKEN_KEY" 2>/dev/null || true)

package/pipeline/lib/post-pr-review.sh

@@ -104,7 +104,14 @@ echo "post-pr-review: decision=$DECISION (blocking=$ACCEPTED_BLOCKING, important
 # when the suggested fix wording changes slightly between iterations.
 finding_fingerprint() {
   local path="$1" line="$2" issue="$3"
-  printf '%s|%s|%s' "$path" "$line" "$issue" | shasum -a 256 | cut -c1-16
+  # sha256sum (coreutils) or shasum (perl), whichever this platform has. A bare
+  # `shasum` produced an empty fingerprint on slim Linux images, which made every
+  # finding look new and re-posted the whole review on each iteration.
+  if command -v sha256sum >/dev/null 2>&1; then
+    printf '%s|%s|%s' "$path" "$line" "$issue" | sha256sum | cut -c1-16
+  else
+    printf '%s|%s|%s' "$path" "$line" "$issue" | shasum -a 256 | cut -c1-16
+  fi
 }
 
 render_inline_body() {
@@ -307,9 +314,25 @@ post_bitbucket_server() {
   # Credential Manager / Linux libsecret)  -  sourced lazily so this script keeps
   # working when run from either ~/.claude/lib or ~/.copilot/lib.
   # shellcheck disable=SC1090
-  . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-    || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-    || { echo "post-pr-review: credential helper not found" >&2; return 4; }
+  # Existence check before sourcing: `. <missing>` aborts the shell under `set -e`,
+  # `||` included, so a `.`-chain reaches neither its later candidates nor its error
+  # branch. The loop also covers all three hosts - the chain it replaced knew only
+  # .claude and .copilot, so a Codex-only install could not resolve at all.
+  for _cred_resolver in \
+    "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+    "$HOME/.claude/lib/credential-store-resolver.sh" \
+    "$HOME/.copilot/lib/credential-store-resolver.sh" \
+    "$HOME/.codex/lib/credential-store-resolver.sh"; do
+    [ -f "$_cred_resolver" ] || continue
+    # shellcheck source=/dev/null
+    . "$_cred_resolver" 2>/dev/null || true
+    if [ -n "${CRED_STORE:-}" ]; then break; fi
+  done
+  unset _cred_resolver
+  if [ -z "${CRED_STORE:-}" ]; then
+    echo "post-pr-review: credential helper not found" >&2
+    return 4
+  fi
   resolve_credential_store || return 4
 
   auth_user=$("$CRED_STORE" get "$user_key" 2>/dev/null || true)

package/pipeline/lib/repo-cache.sh

@@ -142,10 +142,25 @@ print(json.dumps(out))
     # A pre-set CRED_STORE (tests, custom installs) is honored as-is.
     if [ -z "${CRED_STORE:-}" ]; then
       # shellcheck disable=SC1090,SC1091
-      . "$(cd "$(dirname "$0")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
-        || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-        || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-        || { echo "ERR: credential helper not found" >&2; exit 3; }
+      # Existence check before sourcing: `. <missing>` aborts the shell under `set -e`,
+      # `||` included, so a `.`-chain reaches neither its later candidates nor its error
+      # branch. The loop also covers all three hosts - the chain it replaced knew only
+      # .claude and .copilot, so a Codex-only install could not resolve at all.
+      for _cred_resolver in \
+        "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+        "$HOME/.claude/lib/credential-store-resolver.sh" \
+        "$HOME/.copilot/lib/credential-store-resolver.sh" \
+        "$HOME/.codex/lib/credential-store-resolver.sh"; do
+        [ -f "$_cred_resolver" ] || continue
+        # shellcheck source=/dev/null
+        . "$_cred_resolver" 2>/dev/null || true
+        if [ -n "${CRED_STORE:-}" ]; then break; fi
+      done
+      unset _cred_resolver
+      if [ -z "${CRED_STORE:-}" ]; then
+        echo "ERR: credential helper not found" >&2
+        exit 3
+      fi
     fi
     BB_USER="${BB_USER:-${BB_USER_KEY:+$("$CRED_STORE" get "$BB_USER_KEY" 2>/dev/null || true)}}"
     BB_TOKEN=$("$CRED_STORE" get "$BB_TOKEN_KEY" 2>/dev/null || true)

package/pipeline/lib/vercel-deploy.sh

@@ -115,10 +115,21 @@ cmd_deploy() {
     # The resolver ships alongside this wrapper in lib/; fall back to the
     # per-CLI install locations when running from a different cwd layout.
     # shellcheck source=/dev/null
-    . "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/credential-store-resolver.sh" 2>/dev/null \
-      || . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-      || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-      || true
+    # Existence check before sourcing: `. <missing>` aborts the shell under `set -e`,
+    # `||` included, so a `.`-chain reaches neither its later candidates nor its error
+    # branch. The loop also covers all three hosts - the chain it replaced knew only
+    # .claude and .copilot, so a Codex-only install could not resolve at all.
+    for _cred_resolver in \
+      "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+      "$HOME/.claude/lib/credential-store-resolver.sh" \
+      "$HOME/.copilot/lib/credential-store-resolver.sh" \
+      "$HOME/.codex/lib/credential-store-resolver.sh"; do
+      [ -f "$_cred_resolver" ] || continue
+      # shellcheck source=/dev/null
+      . "$_cred_resolver" 2>/dev/null || true
+      if [ -n "${CRED_STORE:-}" ]; then break; fi
+    done
+    unset _cred_resolver
     echo "ERROR: VERCEL_TOKEN not set. Resolve via env or keychain ('${CRED_STORE:-credential-store.sh} get <vercel-key>')." >&2
     echo "Hint: vercel CLI accepts the token via env var; do NOT pass --token= on argv (leaks on retry)." >&2
     exit 1

package/pipeline/multi-agent-refs/features/external-context-injection.md

@@ -78,7 +78,7 @@ Rules that make this actionable rather than decorative:
 Failures remain non-fatal at Phase 1 by default - the agent still runs analysis. What
 changed is that the user learns about it while the choice is still theirs to make.
 
-**Graylog specifics.** `fetch-graylog.sh` degrades to empty on any network/VPN failure: it emits a normalized empty object and exits `0`, so an unreachable host reads as `{status:"skipped", reason:"vpn-unreachable"}` and never blocks. Only a genuine auth rejection on a reachable host exits `3` (marked `failed`, still non-fatal here). `state.graylogContext` is prepended to the analysis prompt inside the **Referenced External Sources** section as diagnostic context that is **advisory only**  -  the agent may use it to orient on a reported error, but code remains ground truth, and there is no Phase 4 review gate for logs.
+**Graylog specifics.** `fetch-graylog.sh` degrades to empty on any network/VPN failure: it emits a normalized empty object and exits `0`, so an unreachable host reads as `{status:"skipped", reason:"vpn-unreachable"}` and never blocks. **Exiting `0` is not permission to stay quiet.** The payload carries `degraded: true` and a `degradeReason`; when it does, log one line naming the host and the reason, and carry it into the Phase 7 report. Logs are advisory, so this never asks a question and never blocks - but "I searched the logs and found nothing" and "I never reached the log server" are different statements, and only one of them is true. Only a genuine auth rejection on a reachable host exits `3` (marked `failed`, still non-fatal here). `state.graylogContext` is prepended to the analysis prompt inside the **Referenced External Sources** section as diagnostic context that is **advisory only**  -  the agent may use it to orient on a reported error, but code remains ground truth, and there is no Phase 4 review gate for logs.
 
 ## Prompt injection shape
 

package/pipeline/scripts/audit-log.sh

@@ -48,12 +48,18 @@ json_escape() {
 hash_url() {
   local url="$1"
   [ -z "$url" ] && { echo ""; return; }
-  if command -v shasum >/dev/null 2>&1; then
-    printf '%s' "$url" | shasum -a 256 | awk '{print $1}'
-  elif command -v sha256sum >/dev/null 2>&1; then
+  # sha256sum first: it is the coreutils tool, present on Linux and in slim containers
+  # where `shasum` (a perl script) is not.
+  if command -v sha256sum >/dev/null 2>&1; then
     printf '%s' "$url" | sha256sum | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$url" | shasum -a 256 | awk '{print $1}'
   else
-    echo "unhashed:$url"  # last-resort fallback (should never happen on macOS/Linux)
+    # The previous fallback printed `unhashed:<url>`, writing the plaintext remote into
+    # the audit log - the exact thing this hashing exists to prevent, and it would have
+    # carried any credentials embedded in the remote URL with it. Losing one field beats
+    # leaking one.
+    echo "unhashable-no-sha256-tool"
   fi
 }
 

package/pipeline/scripts/keychain-save.sh

@@ -53,11 +53,33 @@ case "$CHOICE" in
         ;;
 esac
 
-# Locate the credential helper via the resolver so Copilot-only installs work.
-# shellcheck disable=SC1090,SC1091
-. "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
-  || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
-  || { echo "Hata: credential-store bulunamadi. Kurulum: npx @mmerterden/multi-agent-pipeline install"; exit 1; }
+# Locate the resolver with an existence check, not a `.`-chain.
+#
+# Sourcing a file that does not exist aborts the shell under `set -e` - `||` included -
+# so `. <candidate> || . <candidate> || { error }` reaches neither its later candidates
+# nor its error branch. Every fetcher used that shape starting from `$HOME/.claude/...`,
+# so on a Copilot-only or Codex-only install they all died with a bare exit 1 and no
+# message. Reordering does not help: whichever candidate is absent aborts at that point.
+# Checking for the file before sourcing it is the only safe form.
+for _cred_resolver in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/credential-store-resolver.sh" \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/credential-store-resolver.sh" \
+  "$HOME/.claude/lib/credential-store-resolver.sh" \
+  "$HOME/.copilot/lib/credential-store-resolver.sh" \
+  "$HOME/.codex/lib/credential-store-resolver.sh"; do
+  [ -f "$_cred_resolver" ] || continue
+  # shellcheck source=/dev/null
+  . "$_cred_resolver" 2>/dev/null || true
+  # `if`, not `[ ... ] && break`: the latter is the loop body's last command and returns
+  # 1 when CRED_STORE is still empty, which under `set -e` kills the loop on the first
+  # candidate that does not resolve - the very case the loop exists to survive.
+  if [ -n "${CRED_STORE:-}" ]; then break; fi
+done
+unset _cred_resolver
+if [ -z "${CRED_STORE:-}" ]; then
+  echo "Hata: credential-store bulunamadi. Kurulum: npx @mmerterden/multi-agent-pipeline install"
+  exit 1
+fi
 CRED="$CRED_STORE"
 
 "$CRED" delete "$SERVICE_NAME" >/dev/null 2>&1 || true

package/pipeline/scripts/phase-tracker.sh

@@ -193,6 +193,25 @@ MA_DECODE_JS
   printf '%s' "$out"
 }
 
+# Portable SHA-256 over stdin, printing the same "<hex>  -" shape as either tool.
+#
+# GNU coreutils ships sha256sum; macOS ships shasum (a perl script). Neither is
+# universal - Alpine and slim container images typically have sha256sum but no perl, and
+# some hardened macOS setups have neither on a restricted PATH. Trying both keeps the
+# tracker working on all three supported platforms, and the no-hasher branch emits an
+# obviously-synthetic value rather than an empty string, so a broken environment shows
+# up as a visibly fake id instead of a silently blank field.
+sha256_hex() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256
+  else
+    cat >/dev/null
+    printf '%s  -\n' "0000000000000000000000000000000000000000000000000000000000nohash"
+  fi
+}
+
 # OTel-compatible span emission  -  v6.1.0+, opt-in via $MULTI_AGENT_OTEL_SPANS.
 # Appends one JSON line to otel-spans.jsonl. Never fatal on failure.
 #
@@ -218,9 +237,14 @@ emit_otel_span() {
   local spans_file="${TRACKER_DIR}/otel-spans.jsonl"
 
   # Deterministic 128-bit trace_id from task_id, 64-bit span_id from event+phase+timestamp.
+  #
+  # sha256_hex, not `shasum` directly: this runs on every phase on every host, and
+  # `shasum` is a perl script that is absent from minimal Linux images and many
+  # containers. Without a fallback the ids came back empty and the span was written with
+  # blank trace/span - valid JSON, useless telemetry, and no error to notice.
   local trace_id span_id
-  trace_id=$(printf "%s" "$task_id" | shasum -a 256 | awk '{print substr($1,1,32)}')
-  span_id=$(printf "%s:%s:%s" "$event" "$phase_id" "$now_ns" | shasum -a 256 | awk '{print substr($1,1,16)}')
+  trace_id=$(printf "%s" "$task_id" | sha256_hex | awk '{print substr($1,1,32)}')
+  span_id=$(printf "%s:%s:%s" "$event" "$phase_id" "$now_ns" | sha256_hex | awk '{print substr($1,1,16)}')
 
   jq -nc \
     --arg trace "$trace_id" --arg span "$span_id" \

package/pipeline/scripts/uninstall.mjs

@@ -38,6 +38,7 @@
 import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { execFileSync } from "child_process";
 import { join } from "path";
+import { homedir } from "os";
 import { pathToFileURL } from "url";
 import { createInterface } from "readline";
 
@@ -157,21 +158,38 @@ function removeGeneratedCodexAgents(agentsDir) {
  * uninstall failure. Never edits `config.toml` directly - Codex keeps
  * marketplace and plugin state in the same file.
  */
-function deregisterCodexMcpServer() {
+function deregisterMcpServer(host, cliPath) {
+  const cli = cliPath || host;
   if (dryRun) {
-    report("would run", "codex mcp remove dev-toolkit");
+    report("would run", `${host} mcp remove dev-toolkit`);
     return;
   }
   try {
-    execFileSync("codex", ["mcp", "remove", "dev-toolkit"], { stdio: "pipe", timeout: 20_000 });
-    console.log("    removed: dev-toolkit MCP registration");
+    execFileSync(cli, ["mcp", "remove", "dev-toolkit"], { stdio: "pipe", timeout: 20_000 });
+    console.log(`    removed: dev-toolkit MCP registration (${host})`);
   } catch {
     console.log(
-      "    note: could not run `codex mcp remove dev-toolkit` (codex not on PATH, or not registered)",
+      `    note: could not run \`${host} mcp remove dev-toolkit\` (${host} not on PATH, or not registered)`,
     );
   }
 }
 
+function deregisterCodexMcpServer() {
+  deregisterMcpServer("codex");
+}
+
+/**
+ * Copilot registers the same server, so leaving it behind would keep a stale entry
+ * pointing at a package the user just removed.
+ *
+ * `copilot` is often a shell alias for `gh copilot`, invisible to execFileSync, so the
+ * real binary path is tried when the bare name is not resolvable.
+ */
+function deregisterCopilotMcpServer() {
+  const ghCopilot = join(homedir(), ".local", "share", "gh", "copilot", "copilot");
+  deregisterMcpServer("copilot", existsSync(ghCopilot) ? ghCopilot : undefined);
+}
+
 /**
  * Remove every directory under `parent` whose name matches a predicate.
  * @param {string} parent
@@ -475,6 +493,7 @@ export async function main() {
   if (forCopilot && HOME) {
     console.log("");
     console.log("  [Copilot CLI] Removing...");
+    deregisterCopilotMcpServer();
     const COP = join(HOME, ".copilot");
     rmIfExists(join(COP, "scripts"));
     // Pipeline-managed trees the installer lays down alongside scripts/.

package/pipeline/skills/shared/external/ios-coding-standard/references/lint-local.sh

@@ -16,7 +16,19 @@
 set -euo pipefail
 
 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WORK_ROOT="${IOS_STANDARD_WORK_ROOT:-$HOME/.claude/local/ios-coding-standard}"
+# Scratch root. `~/.claude` is one host's tree: defaulting there made a Copilot- or
+# Codex-only machine create a stray .claude directory just to hold lint output. Prefer
+# whichever host tree already exists, and fall back to a neutral location.
+if [ -n "${IOS_STANDARD_WORK_ROOT:-}" ]; then
+  WORK_ROOT="$IOS_STANDARD_WORK_ROOT"
+else
+  WORK_ROOT=""
+  for _host_dir in "$HOME/.claude" "$HOME/.copilot" "$HOME/.codex"; do
+    [ -d "$_host_dir" ] && { WORK_ROOT="$_host_dir/local/ios-coding-standard"; break; }
+  done
+  unset _host_dir
+  [ -n "$WORK_ROOT" ] || WORK_ROOT="${TMPDIR:-/tmp}/ios-coding-standard"
+fi
 DRAFT_CONFIG="$SKILL_DIR/swiftlint.draft.yml"
 
 MODULE_PATH="${1:-}"