@mmerterden/multi-agent-pipeline 13.5.0 → 14.0.0

package/pipeline/scripts/phase-tracker.sh

@@ -405,8 +405,19 @@ state_lock_stale() {
     kill -0 "$pid" 2>/dev/null && return 1
     return 0
   fi
-  mtime=$(stat -f %m "$TRACKER_LOCK_DIR" 2>/dev/null || stat -c %Y "$TRACKER_LOCK_DIR" 2>/dev/null || echo "")
-  [ -z "$mtime" ] && return 1
+  # GNU form first, and not because of style. On GNU coreutils `stat -f` is a valid
+  # flag meaning --file-system, where `%m` prints the MOUNT POINT - so a BSD-first
+  # chain succeeds on Linux, returns something like `/`, never reaches the `||`, and
+  # then the arithmetic below fails on a path. The effect was that a stale lock with
+  # no pid file was never reclaimed on Linux: every tracker call spun the full ~5s
+  # bound and fell open with a warning. macOS `stat -c` is simply invalid, so it
+  # errors and falls through cleanly - which is why this order works on both.
+  mtime=$(stat -c %Y "$TRACKER_LOCK_DIR" 2>/dev/null || stat -f %m "$TRACKER_LOCK_DIR" 2>/dev/null || echo "")
+  # Guard the arithmetic anyway: a non-numeric value here must not abort the caller
+  # under `set -u`, and treating it as "not stale" is the conservative branch.
+  case "$mtime" in
+    '' | *[!0-9]*) return 1 ;;
+  esac
   now=$(date +%s)
   age=$((now - mtime))
   [ "$age" -gt 30 ]
@@ -682,7 +693,7 @@ case "$ACTION" in
     state=$(load_state)
     # Idempotent: a phase id that already exists is a no-op (name, status, and
     # token history are preserved). This is what lets continuation commands
-    # (/multi-agent:finish, resume) re-declare their phase set against a
+    # (/multi-agent:ship, resume) re-declare their phase set against a
     # pre-existing tracker without duplicating or resetting tiles.
     new=$(echo "$state" | jq --arg id "$PID" --arg name "$PNAME" '
       if any(.phases[]?; .id == $id) then .

package/pipeline/scripts/pre-commit-check.sh

@@ -115,12 +115,59 @@ while IFS= read -r -d '' file; do
   # High-entropy string scan  -  catches custom/unknown secrets the prefix
   # patterns miss. Skips lockfiles, integrity hashes, source maps, and snapshot
   # fixtures, which legitimately carry high-entropy non-secret content.
-  if ! echo "$file" | grep -qiE '(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|Podfile\.lock|Cartfile\.resolved|Package\.resolved|\.lock$|\.map$|__snapshots__|\.snap$|\.min\.(js|css)$)'; then
+  #
+  # `smoke-pre-commit.sh` is this gate's OWN test suite: it must contain
+  # secret-shaped fixtures (a fake `ghp_` token, a fake JWT, a random 44-char
+  # string) in order to prove the detector fires on them. Only ADDED lines are
+  # scanned (see the `git diff --cached | grep "^+"` above), so existing fixtures
+  # are invisible  -  but ADDING a new detector test blocks the commit that adds
+  # it, which makes the detector untestable. Entropy only: the provider-prefix,
+  # AWS, private-key, JWT and service-account checks above still apply to this
+  # file, so a real token pasted here is still caught. Scoped to this one path on
+  # purpose  -  widen the list and the gate stops meaning anything.
+  # The generic high-entropy exemptions stay case-insensitive (lockfile names
+  # vary). The gate's own suite is matched separately and CASE-SENSITIVELY on its
+  # exact repo-relative path: `(^|/)smoke-pre-commit\.sh$` under `grep -i` would
+  # have exempted any file with that basename in any directory and in any case,
+  # so staging `docs/SMOKE-PRE-COMMIT.SH` with a live credential in it would have
+  # passed. Staged names come from `git diff --cached --name-only`, which is
+  # repo-root-relative, so the full path can be anchored.
+  if ! echo "$file" | grep -qiE '(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|Podfile\.lock|Cartfile\.resolved|Package\.resolved|\.lock$|\.map$|__snapshots__|\.snap$|\.min\.(js|css)$)' \
+     && ! echo "$file" | grep -qE '^pipeline/scripts/smoke-pre-commit\.sh$'; then
     candidates=$(echo "$content" | grep -oE '[A-Za-z0-9+/=_-]{40,}' || true)
     if [ -n "$candidates" ]; then
       entropy_hit=$(printf '%s\n' "$candidates" | awk '
         {
-          s=$0; n=length(s);
+          s=$0;
+          # Scoring the joined string measures the variety of a whole SENTENCE
+          # rather than of any token in it, so an ordinary doc path like
+          # "claude/commands/multi-agent/review-jira/SKILL" scores 4.35 and was
+          # blocked as a possible credential. 47 of the 400 committed markdown
+          # files in this repo carried such a path, so each was un-editable  -  and
+          # the gate only fired once such a file was staged, which is why it
+          # stayed invisible.
+          #
+          # The reduction is applied ONLY to path-shaped candidates. An earlier
+          # version of this fix scored the longest slash-free segment for every
+          # candidate containing a slash, which structurally exempted any secret
+          # with a slash in it: the canonical 40-char AWS documentation-example
+          # secret access key (two slashes, full-match H=4.663, blocked before)
+          # reduced to an 18-char segment and sailed through, and roughly half
+          # of `openssl rand -base64 32` outputs contain a "/". It is not
+          # reproduced here on purpose  -  this gate flags credential-shaped
+          # strings in comments too, and it is right to.
+          # No other check here catches that key: the key-name regex above does
+          # not match "secret_access_key", and the AKIA pattern only covers the
+          # key ID, not the secret.
+          #
+          # Path-shaped means 3+ separators AND no segment long enough to be a
+          # token on its own. A 2-slash base64 blob therefore still gets scored
+          # whole, which is what keeps the AWS-key case blocked.
+          nseg = split(s, seg, "/");
+          longest = "";
+          for (j = 1; j <= nseg; j++) if (length(seg[j]) > length(longest)) longest = seg[j];
+          if (nseg >= 4 && length(longest) < 40) s = longest;
+          n = length(s);
           if (n < 40) next;
           if (s ~ /^[0-9]+$/) next;        # pure digits
           if (s ~ /^[0-9a-f]+$/) next;     # lowercase hex (git sha / md5 / sha-*)