@mmerterden/multi-agent-pipeline 14.1.1 → 14.2.2

package/pipeline/scripts/phase-tracker.sh

@@ -259,9 +259,9 @@ emit_otel_span() {
       startTimeUnixNano: $ts,
       endTimeUnixNano: $ts,
       attributes: ({
-        "multi_agent.task_id": $task,
-        "multi_agent.phase_id": $phase,
-        "multi_agent.subject": $subj,
+        "task_id": $task,
+        "phase_id": $phase,
+        "subject": $subj,
         "service.name": "multi-agent-pipeline"
       } + $extra)
     }' >> "$spans_file" 2>/dev/null || true
@@ -728,7 +728,7 @@ case "$ACTION" in
     ')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.update" "$PID" "$STATUS" "{\"multi_agent.status\": \"$STATUS\"}"
+    emit_otel_span "phase.update" "$PID" "$STATUS" "{\"status\": \"$STATUS\"}"
     render
     ;;
 
@@ -757,7 +757,7 @@ case "$ACTION" in
       )')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.sub" "$PID" "$SNAME" "{\"multi_agent.sub_id\": \"$SID\", \"multi_agent.status\": \"$SSTATUS\"}"
+    emit_otel_span "phase.sub" "$PID" "$SNAME" "{\"sub_id\": \"$SID\", \"status\": \"$SSTATUS\"}"
     render
     ;;
 
@@ -783,7 +783,20 @@ case "$ACTION" in
     ')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.tokens" "$PID" "" "{\"multi_agent.tokens_in_delta\": $T_IN, \"multi_agent.tokens_out_delta\": $T_OUT, \"multi_agent.tokens_cached_delta\": $T_CACHED}"
+    # Carry the phase's current model/name onto the span too: the cost
+    # renderers' OTel-fallback path groups phase.tokens spans by phase_id and
+    # reads model/phase_name off the first span in each group, so without
+    # these the fallback always renders the default model/"?" name even
+    # though the tracker JSON already knows both.
+    PHASE_MODEL_ATTR=$(printf '%s' "$new" | jq -r --arg id "$PID" '(.phases[] | select(.id == $id) | .model) // ""')
+    PHASE_NAME_ATTR=$(printf '%s' "$new" | jq -r --arg id "$PID" '(.phases[] | select(.id == $id) | .name) // ""')
+    TOKENS_EXTRA=$(jq -nc \
+      --argjson ti "$T_IN" --argjson to "$T_OUT" --argjson tc "$T_CACHED" \
+      --arg model "$PHASE_MODEL_ATTR" --arg name "$PHASE_NAME_ATTR" \
+      '{tokens_in_delta: $ti, tokens_out_delta: $to, tokens_cached_delta: $tc}
+       + (if $model != "" then {model: $model} else {} end)
+       + (if $name != "" then {phase_name: $name} else {} end)')
+    emit_otel_span "phase.tokens" "$PID" "" "$TOKENS_EXTRA"
     # Re-render so live token count is visible on the active phase. Callers
     # that want silent accumulation (e.g. tight loops) can suppress with
     # TRACKER_QUIET=1 to skip the re-render but still write state.
@@ -806,7 +819,7 @@ case "$ACTION" in
       )')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.meta" "$PID" "$KEY" "{\"multi_agent.meta_key\": \"$KEY\", \"multi_agent.meta_value\": \"$VALUE\"}"
+    emit_otel_span "phase.meta" "$PID" "$KEY" "{\"meta_key\": \"$KEY\", \"meta_value\": \"$VALUE\"}"
     if [ "${TRACKER_QUIET:-0}" != "1" ]; then
       render
     fi
@@ -824,7 +837,7 @@ case "$ACTION" in
       )')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.model" "$PID" "" "{\"multi_agent.model\": \"$MODEL\"}"
+    emit_otel_span "phase.model" "$PID" "" "{\"model\": \"$MODEL\"}"
     if [ "${TRACKER_QUIET:-0}" != "1" ]; then
       render
     fi

package/pipeline/scripts/pre-commit-check.sh

@@ -12,6 +12,7 @@ set -uo pipefail
 # Direct invocations (empty/non-JSON stdin, e.g. smoke tests or manual runs)
 # fall through to the full scan. Extraction failure also falls through - the
 # only cost is an unnecessary scan, never a skipped one on a real commit.
+SCAN_UNSTAGED=0
 if [ ! -t 0 ]; then
   HOOK_INPUT="$(cat 2>/dev/null || true)"
   if [ -n "$HOOK_INPUT" ]; then
@@ -40,42 +41,53 @@ process.stdin.on("end", () => {
         | grep -qE '(^|[^[:alnum:]_./-])git[[:space:]]+([^|&;]*[[:space:]])?commit([^[:alnum:]_-]|$)'; then
         exit 0
       fi
+      # PreToolUse fires BEFORE the tool runs, so a compound command like
+      # `git add -A && git commit -m ...` reaches this point with NOTHING
+      # staged yet from either half - `git diff --cached` alone sees an
+      # empty index and this scan silently no-ops right before the commit
+      # it exists to gate. When the same command also runs `git add`, widen
+      # the scan to the working tree (tracked-unstaged + untracked), not
+      # just the index, so that case is still caught.
+      if printf '%s\n' "$HOOK_COMMAND" \
+        | grep -qE '(^|[^[:alnum:]_./-])git[[:space:]]+add([^[:alnum:]_-]|$)'; then
+        SCAN_UNSTAGED=1
+      fi
     fi
   fi
 fi
 
-if [ -z "$(git diff --cached --name-only 2>/dev/null)" ]; then
-  exit 0
-fi
-
 FOUND=0
 
-# NUL-delimited so filenames with spaces are scanned (a space-split loop would
-# silently skip them - a secret false-negative). Process substitution keeps the
-# loop in the current shell so FOUND survives.
-while IFS= read -r -d '' file; do
-  [ -z "$file" ] && continue
-  [ ! -f "$file" ] && continue
-  file "$file" 2>/dev/null | grep -q "binary" && continue
+# `file "$f" | grep -q "binary"` never matches real `file` output (it names a
+# concrete type - "ELF 64-bit", "Mach-O", "PNG image data" - not the word
+# "binary"), so every binary was scanned as text. --mime's charset=binary is
+# the actual signal libmagic gives for non-text content.
+is_binary() {
+  file --mime "$1" 2>/dev/null | grep -q 'charset=binary'
+}
 
-  # Only check added/modified lines
-  content=$(git diff --cached -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
-  [ -z "$content" ] && continue
+# All BLOCKED checks for one file, given the content to scan (added lines for
+# a diff, or the whole file for something not yet tracked at all - every line
+# of a brand-new file is an addition).
+scan_file() {
+  local file="$1" content="$2"
 
   # .env files
   if echo "$file" | grep -qE '\.env($|\.)'; then
     echo "BLOCKED: .env file staged: $file"
     FOUND=1
-    continue
+    return 0
   fi
 
   # Credentials files
   if echo "$file" | grep -qiE '(credentials|secrets|tokens)\.(json|yaml|yml|plist)$'; then
     echo "BLOCKED: Credentials file staged: $file"
     FOUND=1
-    continue
+    return 0
   fi
 
+  [ -z "$content" ] && return 0
+
   # API keys / tokens (key = "long_string" pattern)
   if echo "$content" | grep -qiE '(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[:=]\s*["'"'"'][A-Za-z0-9+/=_-]{20,}'; then
     echo "BLOCKED: Possible API key/token in $file"
@@ -119,12 +131,12 @@ while IFS= read -r -d '' file; do
   # `smoke-pre-commit.sh` is this gate's OWN test suite: it must contain
   # secret-shaped fixtures (a fake `ghp_` token, a fake JWT, a random 44-char
   # string) in order to prove the detector fires on them. Only ADDED lines are
-  # scanned (see the `git diff --cached | grep "^+"` above), so existing fixtures
-  # are invisible  -  but ADDING a new detector test blocks the commit that adds
-  # it, which makes the detector untestable. Entropy only: the provider-prefix,
-  # AWS, private-key, JWT and service-account checks above still apply to this
-  # file, so a real token pasted here is still caught. Scoped to this one path on
-  # purpose  -  widen the list and the gate stops meaning anything.
+  # scanned, so existing fixtures are invisible  -  but ADDING a new detector
+  # test blocks the commit that adds it, which makes the detector untestable.
+  # Entropy only: the provider-prefix, AWS, private-key, JWT and
+  # service-account checks above still apply to this file, so a real token
+  # pasted here is still caught. Scoped to this one path on purpose  -  widen
+  # the list and the gate stops meaning anything.
   # The generic high-entropy exemptions stay case-insensitive (lockfile names
   # vary). The gate's own suite is matched separately and CASE-SENSITIVELY on its
   # exact repo-relative path: `(^|/)smoke-pre-commit\.sh$` under `grep -i` would
@@ -184,8 +196,43 @@ while IFS= read -r -d '' file; do
       fi
     fi
   fi
+}
+
+# NUL-delimited so filenames with spaces are scanned (a space-split loop would
+# silently skip them - a secret false-negative).
+
+# Already-staged content - the common case, and the only source when nothing
+# in the triggering command itself runs `git add`.
+while IFS= read -r -d '' file; do
+  [ -z "$file" ] && continue
+  [ ! -f "$file" ] && continue
+  is_binary "$file" && continue
+  content=$(git diff --cached -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
+  scan_file "$file" "$content"
 done < <(git diff --cached --name-only -z 2>/dev/null)
 
+if [ "$SCAN_UNSTAGED" = "1" ]; then
+  # Tracked and modified, but not staged yet (the `git add` half of the
+  # compound command hasn't run at this point - see SCAN_UNSTAGED above).
+  while IFS= read -r -d '' file; do
+    [ -z "$file" ] && continue
+    [ ! -f "$file" ] && continue
+    is_binary "$file" && continue
+    content=$(git diff HEAD -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
+    scan_file "$file" "$content"
+  done < <(git diff HEAD --name-only -z 2>/dev/null)
+
+  # Untracked (brand-new) files - there is no diff to take yet, so every line
+  # of the file is "added" content for scanning purposes.
+  while IFS= read -r -d '' file; do
+    [ -z "$file" ] && continue
+    [ ! -f "$file" ] && continue
+    is_binary "$file" && continue
+    content=$(sed 's/^/+/' "$file" 2>/dev/null || true)
+    scan_file "$file" "$content"
+  done < <(git ls-files --others --exclude-standard -z 2>/dev/null)
+fi
+
 if [ $FOUND -eq 1 ]; then
   echo ""
   echo "Secret check failed. Remove secrets from staged files before committing."

package/pipeline/scripts/render-agent-log-cost.sh

@@ -30,9 +30,14 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-COST_TABLE="$ROOT/pipeline/scripts/cost-table.json"
-COST_LIB="$ROOT/pipeline/scripts/cost-lib.sh"
+# cost-table.json/cost-lib.sh ship as siblings of this script both in the
+# repo (pipeline/scripts/) and once installed (~/.claude/scripts/) - a
+# repo-root-relative path (../../pipeline/scripts/...) only resolves in the
+# repo checkout and silently misses in the installed layout. Match
+# phase-tracker.sh's own resolution instead of re-deriving a repo root.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+COST_TABLE="$SCRIPT_DIR/cost-table.json"
+COST_LIB="$SCRIPT_DIR/cost-lib.sh"
 if [ -f "$COST_LIB" ]; then . "$COST_LIB"; else COST_JQ_DEFS=""; fi
 
 command -v jq >/dev/null 2>&1 || { echo "render-agent-log-cost: jq required" >&2; exit 2; }

package/pipeline/scripts/render-cost-summary.sh

@@ -24,23 +24,32 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-COST_TABLE="$ROOT/pipeline/scripts/cost-table.json"
-COST_LIB="$ROOT/pipeline/scripts/cost-lib.sh"
+# cost-table.json/cost-lib.sh ship as siblings of this script both in the
+# repo (pipeline/scripts/) and once installed (~/.claude/scripts/) - a
+# repo-root-relative path (../../pipeline/scripts/...) only resolves in the
+# repo checkout and silently misses in the installed layout. Match
+# phase-tracker.sh's own resolution instead of re-deriving a repo root.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+COST_TABLE="$SCRIPT_DIR/cost-table.json"
+COST_LIB="$SCRIPT_DIR/cost-lib.sh"
 if [ -f "$COST_LIB" ]; then . "$COST_LIB"; else COST_JQ_DEFS=""; fi
 
 command -v jq >/dev/null 2>&1 || { echo "render-cost-summary: jq required" >&2; exit 2; }
 
-# Tracker JSON location convention: .worktrees/<TASK>/phase-tracker.json
-# Accept both the full key (e.g. "{JIRA_KEY}-1234") and the numeric-only
-# variant  -  the Jira-prefix is project-specific, so strip anything before
-# the first dash when trying the fallback.
+# Tracker JSON candidates, worktree convention first, then the location
+# phase-tracker.sh actually writes ($HOME/.claude/logs/multi-agent/<task>/
+# tracker-state.json). The list must stay in lockstep with
+# render-agent-log-cost.sh - before the logs/ candidates were added here,
+# every standard run exited 2 and the channels Cost Summary silently never
+# rendered, because only the worktree paths were tried.
 tracker_file=""
 task_id_bare="${TASK_ID##*-}"
 for candidate in \
   "$PWD/.worktrees/$TASK_ID/phase-tracker.json" \
   "$PWD/.worktrees/$task_id_bare/phase-tracker.json" \
-  "$PWD/.worktrees/task-$task_id_bare/phase-tracker.json"
+  "$PWD/.worktrees/task-$task_id_bare/phase-tracker.json" \
+  "$HOME/.claude/logs/multi-agent/$TASK_ID/tracker-state.json" \
+  "$HOME/.claude/logs/multi-agent/$task_id_bare/tracker-state.json"
 do
   [ -f "$candidate" ] && { tracker_file="$candidate"; break; }
 done
@@ -52,17 +61,27 @@ fi
 # Build rows  -  prefer tracker JSON, fall back to spans aggregation
 rows_json="[]"
 if [ -n "$tracker_file" ]; then
-  rows_json=$(jq '[
-    (.phases // {} | to_entries[]) |
-    select(.value.tokens_in // 0 > 0 or .value.tokens_out // 0 > 0) |
-    {
-      phase: .key,
-      phase_name: (.value.name // .key),
-      model: (.value.model // "opus"),
-      tokens_in: (.value.tokens_in // 0),
-      tokens_out: (.value.tokens_out // 0)
-    }
-  ]' "$tracker_file")
+  # Tracker JSON ships in two shapes (same contract as render-agent-log-cost.sh):
+  #   array shape   -  phase-tracker.sh writes phases:[{id, name, model, tokens_in, ...}]
+  #   object shape  -  older fixture / hand-built variant phases:{ "1": {...}, ... }
+  rows_json=$(jq '
+    (if (.phases | type) == "array" then
+      [.phases[] | {key: (.id | tostring), value: .}]
+    else
+      (.phases // {} | to_entries)
+    end)
+    | [ .[] |
+        select(.value.tokens_in // 0 > 0 or .value.tokens_out // 0 > 0) |
+        {
+          phase: .key,
+          phase_name: (.value.name // .key),
+          model: (.value.model // " - "),
+          tokens_in: (.value.tokens_in // 0),
+          tokens_out: (.value.tokens_out // 0),
+          tokens_cached: (.value.tokens_cached // 0)
+        }
+      ]
+    | sort_by(.phase | tonumber? // 999)' "$tracker_file")
 fi
 
 if [ "$rows_json" = "[]" ] && [ -n "$SPANS_FILE" ] && [ -f "$SPANS_FILE" ]; then
@@ -72,9 +91,10 @@ if [ "$rows_json" = "[]" ] && [ -n "$SPANS_FILE" ] && [ -f "$SPANS_FILE" ]; then
     map({
       phase: (.[0].attributes.phase_id // .[0].attributes.phase // "?"),
       phase_name: (.[0].attributes.phase_name // (.[0].attributes.phase_id // "?")),
-      model: (.[0].attributes.model // "opus"),
+      model: (.[0].attributes.model // " - "),
       tokens_in: ([.[].attributes.tokens_in_delta // 0] | add),
-      tokens_out: ([.[].attributes.tokens_out_delta // 0] | add)
+      tokens_out: ([.[].attributes.tokens_out_delta // 0] | add),
+      tokens_cached: ([.[].attributes.tokens_cached_delta // 0] | add)
     })
   ' "$SPANS_FILE")
 fi
@@ -85,7 +105,7 @@ joined=$(jq -n --argjson rows "$rows_json" --slurpfile prices "$COST_TABLE" "$CO
     . as $r |
     ($prices[0].prices[$r.model] // null) as $p |
     . + {
-      usd: cost_usd_of($p; $r.tokens_in; $r.tokens_out; 0)
+      usd: cost_usd_of($p; $r.tokens_in; $r.tokens_out; ($r.tokens_cached // 0))
     }
   )
 ')

package/pipeline/scripts/render-work-summary.sh

@@ -69,9 +69,11 @@ fi
 
 STATE_FILE=""
 TRACKER_FILE=""
+TRIAGE_FILE=""
 if [ -n "$WORKTREE" ]; then
-  [ -f "$WORKTREE/agent-state.json" ]   && STATE_FILE="$WORKTREE/agent-state.json"
-  [ -f "$WORKTREE/phase-tracker.json" ] && TRACKER_FILE="$WORKTREE/phase-tracker.json"
+  [ -f "$WORKTREE/agent-state.json" ]    && STATE_FILE="$WORKTREE/agent-state.json"
+  [ -f "$WORKTREE/phase-tracker.json" ]  && TRACKER_FILE="$WORKTREE/phase-tracker.json"
+  [ -f "$WORKTREE/triage-output.json" ]  && TRIAGE_FILE="$WORKTREE/triage-output.json"
 fi
 
 # Fall back to the salvaged artefacts when the worktree is gone. Phase 6 removes it
@@ -88,8 +90,22 @@ if [ -z "$STATE_FILE" ] || [ -z "$TRACKER_FILE" ]; then
     "$HOME"/.claude/logs/multi-agent/*/"$task_bare"/artifacts
   do
     [ -d "$base" ] || continue
-    [ -z "$STATE_FILE" ]   && [ -f "$base/agent-state.json" ]   && STATE_FILE="$base/agent-state.json"
-    [ -z "$TRACKER_FILE" ] && [ -f "$base/phase-tracker.json" ] && TRACKER_FILE="$base/phase-tracker.json"
+    [ -z "$STATE_FILE" ]   && [ -f "$base/agent-state.json" ]    && STATE_FILE="$base/agent-state.json"
+    [ -z "$TRACKER_FILE" ] && [ -f "$base/phase-tracker.json" ]  && TRACKER_FILE="$base/phase-tracker.json"
+    [ -z "$TRIAGE_FILE" ]  && [ -f "$base/triage-output.json" ]  && TRIAGE_FILE="$base/triage-output.json"
+  done
+fi
+
+# Last resort for the tracker: the file phase-tracker.sh actually writes on
+# every run. The worktree/artifacts copies above exist only when something
+# mirrored them there; the logs/ state file always exists for a tracked task.
+if [ -z "$TRACKER_FILE" ]; then
+  task_bare="${TASK_ID##*-}"
+  for f in \
+    "$HOME/.claude/logs/multi-agent/$TASK_ID/tracker-state.json" \
+    "$HOME/.claude/logs/multi-agent/$task_bare/tracker-state.json"
+  do
+    [ -f "$f" ] && { TRACKER_FILE="$f"; break; }
   done
 fi
 
@@ -126,9 +142,15 @@ if [ -n "$STATE_FILE" ]; then
   state_jira=$(jq -r '.taskId // ""' "$STATE_FILE")
   state_branch=$(jq -r '.branch // (.projects // [] | .[0].branch // "")' "$STATE_FILE")
   state_base=$(jq -r '.baseBranch // (.projects // [] | .[0].baseBranch // "")' "$STATE_FILE")
-  state_pr=$(jq -r '.prNumber // .prUrl // ""' "$STATE_FILE")
-  state_tasks=$(jq -c '(.planTodos // []) + (.phases["2"].tasks // [])' "$STATE_FILE" 2>/dev/null || echo "[]")
-  state_triage=$(jq -c '.reviewConsensus // .phases["4"].triage // {}' "$STATE_FILE" 2>/dev/null || echo "{}")
+  # agent-state.schema.json has no .prNumber/.prUrl/.planTodos/.reviewConsensus/
+  # .phases["2"].tasks/.phases["4"].triage - PR data lives at .pr.{number,url},
+  # the plan at .plan.todos[], and review triage in the separate
+  # triage-output.json (read via TRIAGE_FILE below, not out of agent-state).
+  state_pr=$(jq -r '.pr.number // .pr.url // ""' "$STATE_FILE")
+  state_tasks=$(jq -c '.plan.todos // []' "$STATE_FILE" 2>/dev/null || echo "[]")
+fi
+if [ -n "$TRIAGE_FILE" ]; then
+  state_triage=$(jq -c '.' "$TRIAGE_FILE" 2>/dev/null || echo "{}")
 fi
 
 # Flag overrides
@@ -141,13 +163,19 @@ fi
 phase_ticks=""
 if [ -n "$TRACKER_FILE" ]; then
   phase_ticks=$(jq -r '
-    . as $root |
+    # Normalize both tracker shapes: phase-tracker.sh writes phases as an
+    # array of {id,...}; older fixtures keyed an object by phase id. The
+    # string-index below errors on an array and 2>/dev/null would swallow
+    # it, silently dropping the whole tick strip.
+    (if (.phases | type) == "array"
+     then (.phases | map({key: (.id | tostring), value: .}) | from_entries)
+     else (.phases // {}) end) as $ph |
     ["0 Init","1 Analysis","2 Planning","3 Dev","4 Review","5 Test","6 Commit","7 Report"] as $labels |
     [range(0;8) | tostring] as $ids |
     $ids
     | map(. as $i |
         ($labels[$i | tonumber]) as $label |
-        (($root.phases // {})[$i] // {}) as $p |
+        ($ph[$i] // {}) as $p |
         (if   $p.status == "completed"   then "✅"
          elif $p.status == "in_progress" then "▶"
          elif $p.status == "failed"      then "❌"
@@ -195,16 +223,19 @@ if [ -n "$DIFF_IN" ]; then
   fi
 fi
 
-# Task list with ✅ / ⏳ marks  -  derived from triage if available
+# Task list with ✅ / ⏳ marks. plan-todos.schema.json's todo items carry
+# `.task` (not `.title`/`.subject`) and a status enum of
+# pending|in_progress|completed|skipped|failed (not "done"/"deferred") -
+# the old check here never matched real data, so every todo rendered ⏳.
 tasks_block=""
 if [ "$(jq 'length' <<< "$state_tasks")" != "0" ]; then
   tasks_block=$(jq -r '
     .[] |
     "- " +
-    (if (.status // "done") == "done" then "✅ " else "⏳ " end) +
+    (if (.status // "pending") == "completed" then "✅ " else "⏳ " end) +
     (.id // "") +
     (if (.id // "") != "" then " " else "" end) +
-    (.title // .subject // "(untitled)")
+    (.task // "(untitled)")
   ' <<< "$state_tasks")
 fi
 
@@ -221,7 +252,10 @@ header="**Task**: \`$state_jira\`"
 [ -n "$state_branch" ] && header="$header  |  **Branch**: \`$state_branch\`"
 [ -n "$state_base" ]   && header="$header  |  **Base**: \`$state_base\`"
 if [ -n "$state_pr" ] && [ "$state_pr" != "null" ]; then
-  header="$header  |  **PR**: $state_pr"
+  case "$state_pr" in
+    *[!0-9]*) header="$header  |  **PR**: $state_pr" ;;
+    *)        header="$header  |  **PR**: #$state_pr" ;;
+  esac
 fi
 printf '%s\n\n' "$header"
 

package/pipeline/scripts/review-scope.mjs

@@ -81,7 +81,7 @@ function main() {
   const blockers = [];
   for (const f of files) {
     for (const s of f.signals || []) {
-      if (HIGH_STAKES.has(s.name)) blockers.push({ file: f.file, signal: s.name });
+      if (HIGH_STAKES.has(s.name)) blockers.push({ file: f.path, signal: s.name });
     }
   }
 

package/pipeline/scripts/run-aggregator.mjs

@@ -82,14 +82,27 @@ function die(msg) {
   process.exit(1);
 }
 
-function resolveTaskDir() {
-  if (flags["task-dir"]) return flags["task-dir"];
-  if (flags["task-id"] && flags.project) {
+// phase-tracker.sh writes tracker-state.json (never phase-tracker.json) at
+// $HOME/.claude/logs/multi-agent/<task-id>/ (no <project> segment) - the
+// same drift render-cost-summary.sh/render-agent-log-cost.sh already guard
+// against with a candidate list. Mirror that list here instead of assuming
+// one fixed filename/path.
+function resolveTrackerCandidates() {
+  const candidates = [];
+  if (flags["task-dir"]) {
+    candidates.push(join(flags["task-dir"], "tracker-state.json"));
+  }
+  if (flags["task-id"]) {
     const HOME = process.env.HOME || process.env.USERPROFILE;
     if (!HOME) die("neither HOME nor USERPROFILE is set  -  pass --task-dir");
-    return join(HOME, ".claude", "logs", "multi-agent", flags.project, String(flags["task-id"]));
+    const taskId = String(flags["task-id"]);
+    if (flags.project) {
+      candidates.push(join(HOME, ".claude", "logs", "multi-agent", flags.project, taskId, "tracker-state.json"));
+    }
+    candidates.push(join(HOME, ".claude", "logs", "multi-agent", taskId, "tracker-state.json"));
   }
-  die("either --task-dir or --task-id with --project is required");
+  if (!candidates.length) die("either --task-dir or --task-id is required");
+  return candidates;
 }
 
 function loadJson(path) {
@@ -161,11 +174,14 @@ function tsCompare(a, b) {
 }
 
 // ─────────────────────────────────────────────────────────────────────────
-const taskDir = resolveTaskDir();
-if (!existsSync(taskDir)) die(`task dir not found: ${taskDir}`);
-
-const tracker = loadJson(join(taskDir, "phase-tracker.json"));
-if (!tracker) die(`phase-tracker.json not found in ${taskDir}`);
+const trackerCandidates = resolveTrackerCandidates();
+const trackerPath = trackerCandidates.find((p) => existsSync(p));
+if (!trackerPath) {
+  die(`tracker state not found, tried:\n${trackerCandidates.map((p) => `  ${p}`).join("\n")}`);
+}
+const taskDir = dirname(trackerPath);
+const tracker = loadJson(trackerPath);
+if (!tracker) die(`failed to parse tracker state at ${trackerPath}`);
 
 const otelSpans = loadJsonl(join(taskDir, "otel-spans.jsonl"));
 const costTable = loadCostTable();
@@ -187,7 +203,15 @@ let totalOut = 0;
 let totalCost = 0;
 let unknownModelHits = 0;
 
-for (const phase of tracker.phases || []) {
+// tracker.phases ships in two shapes (same contract render-cost-summary.sh
+// normalizes): an array (phase-tracker.sh's real output) or an object keyed
+// by phase id (older fixtures / hand-built variants). Normalize once so the
+// rest of this file can treat it as a plain array.
+const phaseList = Array.isArray(tracker.phases)
+  ? tracker.phases
+  : Object.entries(tracker.phases || {}).map(([key, value]) => ({ ...value, id: value?.id ?? key }));
+
+for (const phase of phaseList) {
   const tIn = phase.tokens_in || 0;
   const tOut = phase.tokens_out || 0;
   const model = phase.model || inferModelForPhase(phase.id);
@@ -279,9 +303,9 @@ const summary = {
   kind: "summary",
   ts: lastTs,
   task_id: taskId,
-  phases_total: tracker.phases?.length ?? 0,
-  phases_completed: (tracker.phases || []).filter((p) => p.status === "completed").length,
-  phases_failed: (tracker.phases || []).filter((p) => p.status === "failed").length,
+  phases_total: phaseList.length,
+  phases_completed: phaseList.filter((p) => p.status === "completed").length,
+  phases_failed: phaseList.filter((p) => p.status === "failed").length,
   tokens_in: totalIn,
   tokens_out: totalOut,
   total_cost_usd: Number(totalCost.toFixed(6)),

package/pipeline/scripts/smoke-schema-validation.sh

@@ -91,10 +91,14 @@ echo "→ 4. prefs.schema.json  -  keychainMapping covers every resolved service
 # A floor, not a pin: new credentials get added over time, and pinning the count
 # made every addition a false failure. What matters is that the keys shipped
 # flows resolve are all declared.
+# process.stdout.write of a String, not console.log of a Number: console.log
+# inspects non-string arguments, so with FORCE_COLOR set in the environment the
+# count comes back wrapped in ANSI codes and the -ge comparison below silently
+# fails on a value that is actually in range.
 KM_COUNT=$(node -e "
   const s = JSON.parse(require('fs').readFileSync('$PREFS_SCHEMA', 'utf8'));
   const km = s.properties.global.properties.keychainMapping.properties;
-  console.log(Object.keys(km).length);
+  process.stdout.write(String(Object.keys(km).length));
 " 2>/dev/null)
 if [ "${KM_COUNT:-0}" -ge 12 ] 2>/dev/null; then
   pass "keychainMapping declares $KM_COUNT services (≥12 expected)"

package/pipeline/scripts/test-gap-scan.mjs

@@ -141,6 +141,45 @@ function isExcluded(path) {
   return false;
 }
 
+// git quotes a `diff --git` path (core.quotePath, on by default) whenever it
+// has a non-ASCII byte or other unusual character - e.g. a Turkish filename
+// renders as `diff --git "a/\303\226deme.swift" "b/\303\226deme.swift"`, not
+// the bare a/...b/... form. The plain regex this replaced never matched that
+// line at all, so every non-ASCII-named file's added lines were silently
+// dropped from the test-gap scan.
+const DIFF_GIT_QUOTED_RE = /^diff --git "a\/((?:[^"\\]|\\.)*)" "b\/((?:[^"\\]|\\.)*)"$/;
+const DIFF_GIT_UNQUOTED_RE = /^diff --git a\/(.+?) b\/(.+)$/;
+
+function unquoteGitPath(s) {
+  const bytes = [];
+  for (let i = 0; i < s.length; i++) {
+    if (s[i] === "\\") {
+      const octal = s.slice(i + 1, i + 4);
+      if (/^[0-7]{3}$/.test(octal)) {
+        bytes.push(parseInt(octal, 8));
+        i += 3;
+        continue;
+      }
+      const simple = { "\\": 92, '"': 34, t: 9, n: 10, r: 13 };
+      const next = s[i + 1];
+      if (next in simple) {
+        bytes.push(simple[next]);
+        i += 1;
+        continue;
+      }
+    }
+    bytes.push(s.charCodeAt(i));
+  }
+  return Buffer.from(bytes).toString("utf-8");
+}
+
+function matchDiffGitHeader(line) {
+  const q = line.match(DIFF_GIT_QUOTED_RE);
+  if (q) return unquoteGitPath(q[2]);
+  const u = line.match(DIFF_GIT_UNQUOTED_RE);
+  return u ? u[2] : null;
+}
+
 function isTestPath(path) {
   if (Array.isArray(rules.testPathSuffixes) && rules.testPathSuffixes.some((s) => path.endsWith(s)))
     return true;
@@ -190,9 +229,9 @@ function parseDiffAddedLines(diffText) {
   const perFile = new Map();
   let cur = null;
   for (const line of diffText.split("\n")) {
-    const m = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
-    if (m) {
-      cur = m[2];
+    const p = matchDiffGitHeader(line);
+    if (p !== null) {
+      cur = p;
       if (!perFile.has(cur)) perFile.set(cur, { lines: [], isNew: false });
       continue;
     }
@@ -300,9 +339,9 @@ function symbolMentionedInTest(diffText, symbol) {
   const lines = diffText.split("\n");
   let inTestFile = false;
   for (const line of lines) {
-    const fm = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
-    if (fm) {
-      inTestFile = isTestPath(fm[2]);
+    const fm = matchDiffGitHeader(line);
+    if (fm !== null) {
+      inTestFile = isTestPath(fm);
       continue;
     }
     if (!inTestFile) continue;