@mmerterden/multi-agent-pipeline 14.2.1 → 14.2.2

package/pipeline/lib/extract-conventions.sh

@@ -140,9 +140,31 @@ run_find() {
   if [ "${#roots[@]}" -eq 0 ]; then
     return 0
   fi
+  # No explicit -print anywhere in this expression means find falls back to
+  # its own implicit print on the WHOLE expression - which fires for every
+  # true branch of the -prune OR-chain too, including the pruned directories
+  # themselves (their contents are still correctly skipped; the dir path
+  # itself was not). An explicit -print, implicit-AND'd onto the caller's own
+  # criteria as the OR-chain's last branch, only fires on that branch.
   find "${roots[@]}" \
     "${SKIP_PRUNE_ARGS[@]}" \
-    "$@" 2>/dev/null || true
+    "$@" -print 2>/dev/null || true
+}
+
+# Count how many of the newline-separated paths in $1 contain a line matching
+# grep pattern $2. `xargs grep -l` here used to word-split on whitespace by
+# default, so any path with a space in it was silently mis-scanned as several
+# nonexistent partial paths (a false-negative on real matches, not an error -
+# stderr was already redirected to /dev/null). Reading line-by-line handles
+# that correctly since each line is one whole path regardless of embedded
+# spaces.
+count_grep_hits() {
+  local list="$1" pattern="$2" n=0 f
+  while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    grep -lq "$pattern" "$f" 2>/dev/null && n=$((n + 1))
+  done <<< "$list"
+  printf '%s' "$n"
 }
 
 # ---- confidence classifier ----------------------------------------------------
@@ -849,8 +871,15 @@ bucket_localization_key() {
   case "$PLATFORM" in
     ios)
       local strings_files xcstrings_files
-      strings_files=$(find "$REPO_PATH" -name 'Localizable.strings' "${SKIP_PRUNE_ARGS[@]}" -o -name 'Localizable.strings' -type f -print 2>/dev/null | head -5 || true)
-      xcstrings_files=$(find "$REPO_PATH" -name 'Localizable.xcstrings' -type f 2>/dev/null | head -3 || true)
+      # An earlier version ANDed -name onto the FRONT of the prune chain
+      # (`-name X SKIP_PRUNE_ARGS...`), which requires every -prune branch to
+      # ALSO be named "Localizable.strings" - a directory prune can never
+      # satisfy that, so no prune ever fired and the search walked into
+      # Pods/.build/node_modules looking for vendored copies. Prunes must
+      # stay their own independent OR-chain, ahead of (not ANDed with) the
+      # real search criteria. The xcstrings search had no prune chain at all.
+      strings_files=$(find "$REPO_PATH" "${SKIP_PRUNE_ARGS[@]}" -name 'Localizable.strings' -type f -print 2>/dev/null | head -5 || true)
+      xcstrings_files=$(find "$REPO_PATH" "${SKIP_PRUNE_ARGS[@]}" -name 'Localizable.xcstrings' -type f -print 2>/dev/null | head -3 || true)
       if [ -n "$strings_files" ]; then
         keys=$(printf '%s\n' "$strings_files" | while IFS= read -r f; do
           [ -n "$f" ] && grep -hEo '^"[^"]+"' "$f" 2>/dev/null | tr -d '"'
@@ -918,9 +947,9 @@ bucket_di_registration() {
       fi
       files=$(run_find -type f -name '*.swift' 2>/dev/null || true)
       if [ -n "$files" ]; then
-        resolver_count=$(printf '%s\n' "$files" | xargs grep -l 'Resolver.register' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-        factory_count=$(printf '%s\n' "$files" | xargs grep -l '@Injected\|Container.shared' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-        swinject_count=$(printf '%s\n' "$files" | xargs grep -l 'Swinject\|Container()' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+        resolver_count=$(count_grep_hits "$files" 'Resolver.register')
+        factory_count=$(count_grep_hits "$files" '@Injected\|Container.shared')
+        swinject_count=$(count_grep_hits "$files" 'Swinject\|Container()')
       fi
       manual_count=${manual_count:-0}; resolver_count=${resolver_count:-0}; factory_count=${factory_count:-0}; swinject_count=${swinject_count:-0}
 
@@ -941,9 +970,9 @@ bucket_di_registration() {
       files=$(run_find -type f -name '*.kt' 2>/dev/null || true)
       if [ -z "$files" ]; then empty_bucket; return; fi
       local hilt_count koin_count dagger_count
-      hilt_count=$(printf '%s\n' "$files" | xargs grep -l '@Module\|@InstallIn\|@HiltViewModel' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      koin_count=$(printf '%s\n' "$files" | xargs grep -l 'koinViewModel\|module {' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      dagger_count=$(printf '%s\n' "$files" | xargs grep -l '@Component\|@Subcomponent' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+      hilt_count=$(count_grep_hits "$files" '@Module\|@InstallIn\|@HiltViewModel')
+      koin_count=$(count_grep_hits "$files" 'koinViewModel\|module {')
+      dagger_count=$(count_grep_hits "$files" '@Component\|@Subcomponent')
       hilt_count=${hilt_count:-0}; koin_count=${koin_count:-0}; dagger_count=${dagger_count:-0}
       if [ "$hilt_count" -ge "$koin_count" ] && [ "$hilt_count" -ge "$dagger_count" ] && [ "$hilt_count" -gt 0 ]; then
         emit_bucket "Hilt" "@Module @InstallIn(SingletonComponent::class)" "$(confidence_for "$hilt_count")" "[]" '["Koin","Dagger"]'
@@ -959,9 +988,9 @@ bucket_di_registration() {
       files=$(run_find -type f -name '*.py' 2>/dev/null || true)
       if [ -z "$files" ]; then empty_bucket; return; fi
       local depends_count dishka_count di_count
-      depends_count=$(printf '%s\n' "$files" | xargs grep -l 'Depends(' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      dishka_count=$(printf '%s\n' "$files" | xargs grep -l 'dishka' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      di_count=$(printf '%s\n' "$files" | xargs grep -l 'dependency_injector' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+      depends_count=$(count_grep_hits "$files" 'Depends(')
+      dishka_count=$(count_grep_hits "$files" 'dishka')
+      di_count=$(count_grep_hits "$files" 'dependency_injector')
       depends_count=${depends_count:-0}; dishka_count=${dishka_count:-0}; di_count=${di_count:-0}
       if [ "$depends_count" -ge "$dishka_count" ] && [ "$depends_count" -ge "$di_count" ] && [ "$depends_count" -gt 0 ]; then
         emit_bucket "FastAPI Depends" "def handler(svc: FooService = Depends(get_service))" "$(confidence_for "$depends_count")" "[]" '["dishka","dependency_injector"]'
@@ -977,9 +1006,9 @@ bucket_di_registration() {
       files=$(run_find -type f \( -name '*.tsx' -o -name '*.ts' \) 2>/dev/null || true)
       if [ -z "$files" ]; then empty_bucket; return; fi
       local context_count zustand_count hook_count
-      context_count=$(printf '%s\n' "$files" | xargs grep -l 'createContext\|\.Provider' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      zustand_count=$(printf '%s\n' "$files" | xargs grep -l "from 'zustand'\|from \"zustand\"" 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      hook_count=$(printf '%s\n' "$files" | xargs grep -l 'export function use[A-Z]' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+      context_count=$(count_grep_hits "$files" 'createContext\|\.Provider')
+      zustand_count=$(count_grep_hits "$files" "from 'zustand'\\|from \"zustand\"")
+      hook_count=$(count_grep_hits "$files" 'export function use[A-Z]')
       context_count=${context_count:-0}; zustand_count=${zustand_count:-0}; hook_count=${hook_count:-0}
       if [ "$context_count" -ge "$zustand_count" ] && [ "$context_count" -ge "$hook_count" ] && [ "$context_count" -gt 0 ]; then
         emit_bucket "React Context Provider" "const FooContext = createContext<Foo>(...)" "$(confidence_for "$context_count")" "[]" '["zustand","custom-hook-factory"]'

package/pipeline/lib/fetch-figma-annotations.sh

@@ -124,10 +124,17 @@ trap 'rm -rf "$TMPDIR_A"' EXIT INT TERM
 # curl one /nodes batch (token via -K config so it never lands in argv).
 curl_nodes() {
   local out="$1" ids="$2" code
+  # curl already writes "000" via -w on a total connection failure (and
+  # still exits non-zero for it, which the inner `|| echo "000"` used to
+  # catch too - so `code` became the literal string "000000", never
+  # matching a plain "000" comparison anywhere downstream). `|| true` keeps
+  # a failing curl from tripping any caller's `set -e` without re-printing
+  # into $code; `:-000` only fills in when curl fails before -w ever runs.
   code=$(curl -sS -o "$out" -w '%{http_code}' \
             --max-time "$HTTP_TIMEOUT" --connect-timeout 5 \
             -K <(printf 'header = "X-Figma-Token: %s"\n' "$FIGMA_TOKEN") \
-            "$FIGMA_API/files/$FILE_KEY/nodes?ids=$ids" || echo "000")
+            "$FIGMA_API/files/$FILE_KEY/nodes?ids=$ids") || true
+  code="${code:-000}"
   printf '%s' "$code"
 }
 

package/pipeline/lib/fetch-fortify.sh

@@ -202,18 +202,33 @@ fortify_get() {
   return 1
 }
 
-VERSION_JSON=$(fortify_get "projectVersions/$VERSION_ID" || true)
-case "$VERSION_JSON" in
-  HTTP_AUTH_FAILED|*HTTP_4*)
-    echo "ERR: Fortify auth failed (Bearer + FortifyToken both rejected)" >&2
-    exit 3 ;;
-esac
+# Check fortify_get's actual exit status, not a string pattern over its
+# output - the old `case ... HTTP_AUTH_FAILED|*HTTP_4*)` only recognized
+# auth failures and 4xx. A dropped connection, timeout, or 5xx made
+# fortify_get return "...\nHTTP_000"/"...\nHTTP_5xx", which matched neither
+# arm, so the case fell through, VERSION_JSON stayed unparseable garbage,
+# and the Python block below silently treated that as "0 issues found" -
+# the security gate passing precisely when it couldn't check anything.
+if ! VERSION_JSON=$(fortify_get "projectVersions/$VERSION_ID"); then
+  echo "ERR: Fortify fetch failed for projectVersions/$VERSION_ID: ${VERSION_JSON:-no response}" >&2
+  exit 3
+fi
 
 ISSUES_JSON=""
 if [ -n "$ISSUE_ID" ]; then
-  ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?q=issueInstanceId:\"$ISSUE_ID\"&limit=20" || true)
+  if ! ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?q=issueInstanceId:\"$ISSUE_ID\"&limit=20"); then
+    echo "ERR: Fortify issues fetch failed for issue $ISSUE_ID: ${ISSUES_JSON:-no response}" >&2
+    exit 3
+  fi
 else
-  ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?limit=200&filter=ANALYSIS%3D%3DNotAnIssue,ANALYSIS%3D%3DFalsePositive&filterset=Critical%2CHigh" || true)
+  # filter=ANALYSIS!=NotAnIssue,ANALYSIS!=FalsePositive (%21%3D is `!=`) is
+  # meant to EXCLUDE suppressed findings. It was encoded as %3D%3D (`==`),
+  # which instead selected only suppressed findings - the opposite of the
+  # gate's intent whenever SSC honors the filter.
+  if ! ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?limit=200&filter=ANALYSIS%21%3DNotAnIssue,ANALYSIS%21%3DFalsePositive&filterset=Critical%2CHigh"); then
+    echo "ERR: Fortify issues fetch failed for version $VERSION_ID: ${ISSUES_JSON:-no response}" >&2
+    exit 3
+  fi
 fi
 
 # Issue details are fetched per-issue lazily  -  only for the first 10 to keep

package/pipeline/lib/figma-screenshot.sh

@@ -180,10 +180,20 @@ curl_figma() {
   for attempt in 1 2 3; do
     # Token header goes through a curl config via process substitution so it
     # never appears in argv (argv is visible to ps).
+    # curl already writes "000" via -w on a total connection failure (and
+    # still exits non-zero for it, which the inner `|| echo "000"` used to
+    # catch too - so `code` became the literal string "000000", matching
+    # neither the `000)` retry branch below nor handle_http_code's "000)
+    # network timeout" case, just the generic catch-all). `|| true` on its
+    # own line keeps `set -e` from aborting on curl's exit status without
+    # re-printing anything into $code; the `:-000` fallback only fires for
+    # the rarer case where curl fails before -w ever runs and $code is
+    # genuinely empty.
     code=$(curl -sS -o "$out" -w '%{http_code}' \
               --max-time "$HTTP_TIMEOUT" --connect-timeout 5 \
               -K <(printf 'header = "X-Figma-Token: %s"\n' "$FIGMA_TOKEN") \
-              "$url" || echo "000")
+              "$url") || true
+    code="${code:-000}"
     case "$code" in
       2*) printf '%s' "$code"; return 0 ;;
       401|403) printf '%s' "$code"; return 0 ;;

package/pipeline/lib/issue-fetcher.sh

@@ -12,7 +12,15 @@
 #     "title":      "...",
 #     "type":       "Bug" | "Task" | "Story" | "Issue",
 #     "status":     "...",
-#     "description":"...",                          // raw body (truncated to 4000 chars)
+#     "description":"...",                          // raw body (truncated to 4000 chars); this
+#                                                     // issue's OWN description  -  never auto-substituted
+#     "parentKey":         "PROJ-1" | null,          // jira only; set when own description is empty
+#                                                     // AND a parent link exists (single hop, no chasing
+#                                                     // the parent's parent)
+#     "parentDescription": "..." | null,             // jira only; the parent's description (truncated
+#                                                     // 4000 chars), only when own is empty and parent
+#                                                     // has content  -  a CANDIDATE, not applied automatically;
+#                                                     // the caller must confirm before using it as "description"
 #     "url":        "https://...",
 #     "host":       "jira.example.com" | "github.com",
 #     "owner":      "org" (gh) | null,
@@ -21,11 +29,17 @@
 #     "maturity": {
 #        "score":     0..100,
 #        "blockers":  ["status_closed", "description_empty"],
-#        "warnings":  ["short_description", "no_repro_steps"],
+#        "warnings":  ["short_description", "no_repro_steps", "description_empty_parent_available"],
 #        "summary":   "Description boş  -  pipeline başlatılamaz." (human-readable, tr|en)
 #     }
 #   }
 #
+# "description_empty_parent_available": own description is empty but parentDescription is
+# non-empty. This is a WARNING, not a blocker  -  the caller must ask the user (or, in
+# autopilot, auto-accept per the same "warnings auto-continue" rule) whether to proceed
+# using parentDescription as the working description. See jira/SKILL.md's maturity
+# section for the exact question wording.
+#
 # Required env:
 #   ACCOUNT_JIRA_TOKEN_KEY    keychain service name (optional)
 #   ACCOUNT_JIRA_HOST         e.g. jira.example.com    (optional)
@@ -51,8 +65,16 @@ detect_kind() {
   case "$in" in
     *atlassian.net/browse/*|*jira*/browse/*|http*://*/browse/*) echo "jira-url"; return ;;
     *github.com/*/issues/*) echo "gh-url"; return ;;
-    [A-Z]*-[0-9]*) echo "jira-id"; return ;;
   esac
+  # A bare Jira key is PROJECT-NUMBER, anchored end-to-end. The case glob this
+  # replaced ([A-Z]*-[0-9]*) matches whenever that shape appears ANYWHERE in a
+  # longer string (case patterns match the whole string, but `*` is greedy
+  # enough to swallow surrounding words) - "Add iOS-16 support" contains
+  # "S-16" and satisfied it, silently misrouting a free-text task description
+  # into a Jira lookup instead of the freetext path below.
+  if [[ "$in" =~ ^[A-Z][A-Z0-9]*-[0-9]+$ ]]; then
+    echo "jira-id"; return
+  fi
   # Bare issue number ("316" or "#316") must resolve BEFORE the repo#N glob:
   # `*\#[0-9]*` also matches "#316" with an empty repo prefix, which used to
   # misroute it to gh-short and build https://github.com/<owner>//issues/316.
@@ -140,7 +162,7 @@ fetch_jira() {
     return 1
   fi
   curl -sf -K <(jira_auth_cfg "$token") \
-    "https://$JIRA_HOST/rest/api/2/issue/$key?fields=summary,status,issuetype,description,priority,resolution,fixVersions" \
+    "https://$JIRA_HOST/rest/api/2/issue/$key?fields=summary,status,issuetype,description,priority,resolution,fixVersions,parent" \
     || { echo "ERR: Jira fetch failed for $key" >&2; return 1; }
 }
 
@@ -197,6 +219,8 @@ descriptor = {
     "resolution":  resolution or None,
     "fixVersions": fix_versions,
     "description": desc,
+    "parentKey":   fields.get("parentKey") or None,
+    "parentDescription": fields.get("parentDescription") or None,
     "host":        fields.get("host") or None,
     "url":         fields.get("url") or None,
     "owner":       fields.get("owner") or None,
@@ -213,6 +237,9 @@ title = (descriptor.get("title") or "").strip()
 status = (descriptor.get("status") or "").lower()
 itype = (descriptor.get("type") or "").lower()
 
+parent_desc = (descriptor.get("parentDescription") or "").strip()
+parent_key = descriptor.get("parentKey") or ""
+
 blockers, warnings = [], []
 closed = {"done","closed","cancelled","canceled","resolved"}
 if status in closed:
@@ -221,7 +248,14 @@ if status in closed:
 if resolution:
     blockers.append("already_resolved")
 if not desc.strip():
-    blockers.append("description_empty")
+    # A parent with actual content is a candidate, not an auto-fix  -  surface it
+    # as a warning so the caller asks the user before substituting it in (or,
+    # under autopilot, auto-accepts per the same "warnings auto-continue" rule).
+    # No parent / an equally-empty parent keeps the hard blocker as before.
+    if parent_desc:
+        warnings.append("description_empty_parent_available")
+    else:
+        blockers.append("description_empty")
 elif len(desc.strip()) < 80:
     warnings.append("short_description")
 if len(title) < 10:
@@ -239,6 +273,7 @@ labels_tr = {
     "status_closed":         "Issue kapalı veya iptal edilmiş",
     "already_resolved":      "Issue zaten resolved/merged ({})".format(resolution or " - "),
     "description_empty":     "Açıklama boş",
+    "description_empty_parent_available":"Açıklama boş ama parent'ta ({}) içerik var  -  oradan devam edilsin mi?".format(parent_key or " - "),
     "short_description":     "Açıklama çok kısa (<80 karakter)",
     "short_title":           "Başlık çok kısa (<10 karakter)",
     "no_repro_steps":        "Bug için repro adımları yok",
@@ -248,6 +283,7 @@ labels_en = {
     "status_closed":         "Issue is closed/cancelled",
     "already_resolved":      "Issue already resolved/merged ({})".format(resolution or " - "),
     "description_empty":     "Description is empty",
+    "description_empty_parent_available":"Description is empty but the parent ({}) has content  -  continue from there?".format(parent_key or " - "),
     "short_description":     "Description too short (<80 chars)",
     "short_title":           "Title too short (<10 chars)",
     "no_repro_steps":        "Bug missing reproduction steps",
@@ -309,21 +345,52 @@ description = (f.get("description") or "")
 priority    = _name(f.get("priority"))
 resolution  = _name(f.get("resolution"))
 fixversions = ",".join((v or {}).get("name", "") for v in (f.get("fixVersions") or []))
-parts = [title, itype, status, description, priority, resolution, fixversions]
+parentkey   = (f.get("parent") or {}).get("key", "") or ""
+parts = [title, itype, status, description, priority, resolution, fixversions, parentkey]
 parts = [v.replace("\x1f", " ") for v in parts]
 sys.stdout.write("\x1f".join(parts))
 ')
-      IFS=$'\x1f' read -r -d '' title itype status description priority resolution fixversions <<< "$parsed" || true
+      IFS=$'\x1f' read -r -d '' title itype status description priority resolution fixversions parentkey <<< "$parsed" || true
+      # `<<<` appends a trailing newline to its input; `read -d ''` has no
+      # delimiter to stop on, so that newline folds into whichever field
+      # comes last  -  now parentkey. Strip it, or a genuinely-empty parent
+      # (no fallback needed) or a real key gets a stray \n appended, which
+      # breaks the parent lookup's URL and misreports parentKey in output.
+      parentkey="${parentkey%$'\n'}"
     else
       title="(unfetched)"; itype="Task"; status="Unknown"; description=""
-      priority=""; resolution=""; fixversions=""
+      priority=""; resolution=""; fixversions=""; parentkey=""
+    fi
+    # Development sub-tasks are frequently filed with an empty description while
+    # the real requirements live on the parent (story/epic). Single hop only  -
+    # if the parent is also empty/unreachable, description stays empty and
+    # description_empty blocks below, same as before this existed. This fetcher
+    # only surfaces the parent's description as a CANDIDATE (parentDescription)
+    # - it never substitutes it into "description" itself. Whether to actually
+    # use it is a decision for the caller to put in front of the user (or
+    # auto-accept under autopilot), same as any other maturity warning.
+    parentdesc=""
+    if [ -z "$(printf '%s' "$description" | tr -d '[:space:]')" ] && [ -n "${parentkey:-}" ]; then
+      praw=$(fetch_jira "$parentkey") || praw=""
+      if [ -n "$praw" ]; then
+        pdesc=$(printf '%s' "$praw" | python3 -c '
+import json, sys
+d = json.load(sys.stdin)
+f = d.get("fields", {}) or {}
+sys.stdout.write((f.get("description") or "").replace("\x1f", " "))
+')
+        if [ -n "$(printf '%s' "$pdesc" | tr -d '[:space:]')" ]; then
+          parentdesc="$pdesc"
+        fi
+      fi
     fi
     branch=$(branch_for "$KEY" "$itype" "$title")
     emit_descriptor \
       "kind=jira" "key=$KEY" "title=$title" "type=$itype" "status=$status" \
       "description=$description" "host=$JIRA_HOST" \
       "url=https://$JIRA_HOST/browse/$KEY" "branchHint=$branch" \
-      "priority=$priority" "resolution=$resolution" "fixVersions=$fixversions"
+      "priority=$priority" "resolution=$resolution" "fixVersions=$fixversions" \
+      "parentKey=$parentkey" "parentDescription=$parentdesc"
     ;;
 
   jira-url)

package/pipeline/lib/md2confluence-v3.py

@@ -137,7 +137,7 @@ MERMAID_FENCE_OPEN_RE = re.compile(r"^```mermaid\s*$")
 def mermaid_macro(body: str) -> str:
     return (
         '<ac:structured-macro ac:name="mermaid">'
-        f'<ac:plain-text-body><![CDATA[\n{body}\n]]></ac:plain-text-body>'
+        f'<ac:plain-text-body><![CDATA[\n{cdata_escape(body)}\n]]></ac:plain-text-body>'
         '</ac:structured-macro>'
     )
 
@@ -205,6 +205,20 @@ def esc(s: str) -> str:
     return html.escape(s, quote=False)
 
 
+def cdata_escape(s: str) -> str:
+    """Make `s` safe to embed inside a CDATA section.
+
+    A code fence or Mermaid diagram can legitimately contain the literal
+    three-character sequence "]]>" (a real XML CDATA example, a shell case
+    pattern, ...), which is the CDATA terminator - embedding it unescaped
+    closes the section early and leaves the rest of the storage-format XML
+    unparsed as markup. Splitting it across a close/reopen pair is the
+    standard CDATA-in-CDATA escape: it renders identically, but is no longer
+    a literal terminator to the XML parser.
+    """
+    return s.replace("]]>", "]]]]><![CDATA[>")
+
+
 @dataclass
 class InlineContext:
     attachments_available: set[str]
@@ -388,7 +402,7 @@ def markdown_to_storage(
                 out.append(
                     '<ac:structured-macro ac:name="code">'
                     f'<ac:parameter ac:name="language">{esc(code_lang)}</ac:parameter>'
-                    f'<ac:plain-text-body><![CDATA[{body}]]></ac:plain-text-body>'
+                    f'<ac:plain-text-body><![CDATA[{cdata_escape(body)}]]></ac:plain-text-body>'
                     '</ac:structured-macro>'
                 )
             i += 1

package/pipeline/lib/plan-todos.sh

@@ -45,8 +45,11 @@ usage() {
 resolve_state() {
   local task_id="$1"
   local found=""
-  for dir in "$HOME"/.claude/projects/*; do
-    local candidate="$dir/state/$task_id/agent-state.json"
+  # multi-repo-pipeline.sh writes agent-state.json under a per-project
+  # directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/) - not the
+  # ~/.claude/projects/*/state/ path this used to glob, which no writer in
+  # the pipeline ever populates.
+  for candidate in "$HOME"/.claude/logs/multi-agent/*/"$task_id"/agent-state.json; do
     if [ -f "$candidate" ]; then
       found="$candidate"
       break

package/pipeline/lib/post-pr-review.sh

@@ -45,10 +45,12 @@ if [ -z "$TASK_ID" ]; then
   exit 64
 fi
 
-# Resolve agent-state.json (matches phase-tracker convention).
+# Resolve agent-state.json. multi-repo-pipeline.sh writes it under a
+# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/)
+# - not the ~/.claude/projects/*/state/ path this used to glob, which no
+# writer in the pipeline ever populates.
 AGENT_STATE=""
-for dir in "$HOME"/.claude/projects/*; do
-  candidate="$dir/state/$TASK_ID/agent-state.json"
+for candidate in "$HOME"/.claude/logs/multi-agent/*/"$TASK_ID"/agent-state.json; do
   if [ -f "$candidate" ]; then
     AGENT_STATE="$candidate"
     break
@@ -302,11 +304,11 @@ post_bitbucket_server() {
 
   # Resolve credential keys from prefs.keychainMapping  -  never hardcode.
   prefs="$HOME/.claude/multi-agent-preferences.json"
-  user_key=$(jq -r '.keychainMapping.bitbucket_user // empty' "$prefs" 2>/dev/null || true)
-  token_key=$(jq -r '.keychainMapping.bitbucket_token // empty' "$prefs" 2>/dev/null || true)
+  user_key=$(jq -r '.global.keychainMapping.bitbucket_user // empty' "$prefs" 2>/dev/null || true)
+  token_key=$(jq -r '.global.keychainMapping.bitbucket_token // empty' "$prefs" 2>/dev/null || true)
 
   if [ -z "$user_key" ] || [ -z "$token_key" ]; then
-    echo "post-pr-review: keychainMapping.bitbucket_user / .bitbucket_token unset in $prefs" >&2
+    echo "post-pr-review: global.keychainMapping.bitbucket_user / .bitbucket_token unset in $prefs" >&2
     return 4
   fi
 

package/pipeline/lib/shadow-git.sh

@@ -222,19 +222,60 @@ do_prune() {
     rm -rf "$sd"
     printf 'shadow-git: pruned shadow repo for %s\n' "$task_id" >&2
   else
-    # Trim history (truncate to last N snapshots within the window). For now,
-    # implement as "rewind to oldest commit within window".
     [ ! -d "$sd/.git" ] && { err "no shadow for $task_id"; exit 1; }
+    # Retention never touches a real work-tree: this used to run
+    # `reset --hard` with --work-tree=$(pwd), silently rewriting whatever
+    # directory prune happened to be invoked from, and it kept the OLDEST
+    # commit inside the window while discarding every newer one - backwards
+    # for a "keep the last N days" policy. Every git call below is
+    # git-dir-only plumbing (log/rev-parse/commit-tree/update-ref/gc - no
+    # checkout, no reset, no clean); the one --work-tree `sg` still wants
+    # points at $sd itself, which prune already owns.
+    local branch
+    branch=$(sg "$sd" "$sd" symbolic-ref --short HEAD)
     local cutoff_epoch
     cutoff_epoch=$(($(date +%s) - older * 86400))
-    local keep_sha
-    keep_sha=$(sg "$sd" "$(pwd)" log --pretty='%H %ct' | awk -v c="$cutoff_epoch" '$2 >= c {print $1}' | tail -1)
-    if [ -n "$keep_sha" ]; then
-      printf 'shadow-git: oldest snapshot kept within window: %s\n' "$keep_sha" >&2
-      # Hard-reset history to that snapshot. (Conservative: GC unreachable.)
-      sg "$sd" "$(pwd)" reset --hard --quiet "$keep_sha" || true
-      sg "$sd" "$(pwd)" gc --prune=now --quiet 2>/dev/null || true
+    # Commits strictly within the window, oldest first: what survives.
+    local keep_shas
+    keep_shas=$(sg "$sd" "$sd" log --reverse --pretty='%H %ct' "$branch" \
+      | awk -v c="$cutoff_epoch" '$2 >= c {print $1}')
+    if [ -z "$keep_shas" ]; then
+      printf 'shadow-git: no snapshot for %s is within %s day(s); nothing pruned\n' "$task_id" "$older" >&2
+      return 0
     fi
+    # Replay the surviving commits onto a fresh chain (oldest becomes the new
+    # root) so everything older than the cutoff becomes unreachable and
+    # gc-able, while every kept snapshot's tree/message/author/committer date
+    # is preserved exactly (committer date matters: it's what the NEXT prune
+    # run's cutoff math reads, so it must stay the original snapshot time,
+    # not "now").
+    local prev="" sha tree msg adate cdate aname aemail cname cemail
+    while IFS= read -r sha; do
+      [ -z "$sha" ] && continue
+      tree=$(sg "$sd" "$sd" rev-parse "$sha^{tree}")
+      msg=$(sg "$sd" "$sd" log -1 --format=%B "$sha")
+      adate=$(sg "$sd" "$sd" log -1 --format=%ad --date=raw "$sha")
+      cdate=$(sg "$sd" "$sd" log -1 --format=%cd --date=raw "$sha")
+      aname=$(sg "$sd" "$sd" log -1 --format=%an "$sha")
+      aemail=$(sg "$sd" "$sd" log -1 --format=%ae "$sha")
+      cname=$(sg "$sd" "$sd" log -1 --format=%cn "$sha")
+      cemail=$(sg "$sd" "$sd" log -1 --format=%ce "$sha")
+      if [ -n "$prev" ]; then
+        prev=$(printf '%s' "$msg" \
+          | GIT_AUTHOR_NAME="$aname" GIT_AUTHOR_EMAIL="$aemail" GIT_AUTHOR_DATE="$adate" \
+            GIT_COMMITTER_NAME="$cname" GIT_COMMITTER_EMAIL="$cemail" GIT_COMMITTER_DATE="$cdate" \
+            git --git-dir="$sd/.git" commit-tree "$tree" -p "$prev")
+      else
+        prev=$(printf '%s' "$msg" \
+          | GIT_AUTHOR_NAME="$aname" GIT_AUTHOR_EMAIL="$aemail" GIT_AUTHOR_DATE="$adate" \
+            GIT_COMMITTER_NAME="$cname" GIT_COMMITTER_EMAIL="$cemail" GIT_COMMITTER_DATE="$cdate" \
+            git --git-dir="$sd/.git" commit-tree "$tree")
+      fi
+    done <<<"$keep_shas"
+    git --git-dir="$sd/.git" update-ref "refs/heads/$branch" "$prev"
+    sg "$sd" "$sd" gc --prune=now --quiet 2>/dev/null || true
+    printf 'shadow-git: pruned snapshots older than %s day(s) for %s (kept %s)\n' \
+      "$older" "$task_id" "$(printf '%s\n' "$keep_shas" | wc -l | tr -d ' ')" >&2
   fi
 }
 

package/pipeline/lib/submodule-detector.sh

@@ -168,10 +168,17 @@ case "$MODE" in
       echo "[]"
       exit 0
     fi
+    # emit_json already prints a valid "[]" on empty/unparseable stdin (a
+    # failed `gh api` call, under pipefail, still runs it through the rest of
+    # this pipe with empty input) - the `|| echo "[]"` fallback used to ALSO
+    # fire on the pipeline's own (gh api's) non-zero exit, printing a SECOND
+    # "[]" line and leaving invalid double-JSON on stdout. `|| true` keeps
+    # the local-mode contract (unreachable submodule data -> empty list,
+    # exit 0, never a hard error) without re-printing anything.
     gh api "repos/$TARGET/contents/.gitmodules" \
         --jq '.content' 2>/dev/null \
       | tr -d '\n' \
       | base64 --decode 2>/dev/null \
-      | emit_json || echo "[]"
+      | emit_json || true
     ;;
 esac

package/pipeline/multi-agent-refs/_input-parser.md

@@ -6,7 +6,7 @@ description: "Internal  -  input type detection for multi-agent dispatcher."
 
 The top-level `multi-agent` command classifies user arguments per the rules below.
 
-> **Language**: Schema reference only  -  no user-facing text. Picker `label` + `header` always English (`promptLanguage` is locked to `"en"`); `question` + `description` follow `outputLanguage` per the `rules.md` matrix. Commit/PR/Jira payloads stay English.
+> **Language**: Schema reference only  -  no user-facing text. Picker `label` + `header` always English (`promptLanguage` is locked to `"en"`); `question` + `description` follow `outputLanguage` per the `rules.md` matrix. Commit messages, branch names and PR titles stay English; PR/Jira/Confluence **bodies** follow `outputLanguage`.
 
 ## Type Table
 

package/pipeline/multi-agent-refs/channels/confluence.md

@@ -116,11 +116,14 @@ Auto-suggested as `"{jiraId}  -  {taskTitle}"`  -  user can edit at the prompt.
 | Inline `code` | `<code>code</code>` |
 | Links `[t](u)` | `<a href="u">t</a>` |
 | Lists | `<ul><li>...</li></ul>` / `<ol><li>...</li></ol>` |
+| ` ```mermaid ` fences | `ac:name="mermaid"` macro (`md2confluence-v3.py` implements it, with a numbered-list fallback when the space lacks the plugin)  -  not the generic code macro |
 
 Body is run through humanizer before XML conversion  -  Confluence tone is the most formal of the four channels (target audience: stakeholders, PMs, designers).
 
 ## POST contract
 
+The paths below are relative to the API base, which depends on the Confluence flavor  -  resolve it the way `lib/fetch-confluence.sh` already does: hosts matching `*atlassian.net` (Cloud) use `https://<host>/wiki/rest/api`, everything else (Server / Data Center) uses `https://<host>/rest/api`. On Cloud the un-prefixed form 404s on every call. (Cloud also serves a v2 API at `/wiki/api/v2` with ADF bodies; this adapter stays on v1 + storage format, which both flavors accept.)
+
 ```
 POST /rest/api/content
 {

package/pipeline/multi-agent-refs/channels/issue-comment.md

@@ -43,7 +43,7 @@ The template (this doc) is English because `promptLanguage="en"` is locked. At w
 <one line per repo touched; never collapse multiple repos into one>
 
 ### Acceptance Criteria
-- [<x|·>] <AC text  -  `x` if delivered, `·` if intentionally deferred (with `(deferred: <reason>)` suffix)>
+- [<x| >] <AC text  -  `x` if delivered, space if intentionally deferred (with `(deferred: <reason>)` suffix)>
 <one bullet per AC item from the issue body, or per implicit AC if the issue had none>
 
 ### Build & Test
@@ -65,7 +65,7 @@ Ref: #<issueNumber>
 - **`title`**  -  always wraps the component or task name in backticks. No emoji.
 - **`summary`**  -  1-3 paragraphs, **why** before **what**. No bullet lists in the summary block  -  those belong in `acceptance_criteria`.
 - **`prs_branches`**  -  every repo the run touched gets exactly ONE line. If the PR was deferred, write the branch + commit SHA explicitly so the reader can `gh pr create` from there. Never collapse multiple repos into one line.
-- **`acceptance_criteria`**  -  copy from the issue body verbatim when an `### Acceptance Criteria` section exists. If the section is `_No response_`, the agent enumerates the implicit ACs it satisfied during Phase 1/3. `[x]` only when delivered and verified; `[·]` for deferred (with reason in parens).
+- **`acceptance_criteria`**  -  copy from the issue body verbatim when an `### Acceptance Criteria` section exists. If the section is `_No response_`, the agent enumerates the implicit ACs it satisfied during Phase 1/3. `[x]` only when delivered and verified; `[ ]` for deferred, with the reason in parens  -  GitHub's task-list syntax accepts only `[ ]` and `[x]`, any other marker (a `·` was used here once) renders as literal bracket text instead of a checkbox, and the `(deferred: <reason>)` suffix is what distinguishes deferred from merely unchecked.
 - **`build_and_test`**  -  required. If a build failure was pre-existing, the line includes the baseline SHA where the failure was reproduced (per `feedback_build_baseline_proof.md`).
 - **`figma_extras`**  -  emitted only when `state.taskType == "component"` and the figma sub-pipeline ran.
 - **`next_steps`**  -  empty list is fine; the section header itself stays. Empty signals "fully complete, no follow-ups".

package/pipeline/multi-agent-refs/channels/jira.md

@@ -64,14 +64,25 @@ Body markdown is rewritten to Jira wiki markup before POST:
 
 | Markdown | Jira wiki |
 |---|---|
-| `### Heading` | `*Heading*` |
+| `## Heading` | `h2. Heading` |
+| `### Heading` | `h3. Heading` |
+| `**bold**` | `*bold*` |
+| `1. item` / `2. item` | `# item` (Jira does not render `1.` as an ordered list) |
+| `- item` | `* item` |
 | `- [ ] task` / `- [x] task` | `# task` (numbered list  -  Jira renders TODO checkboxes inconsistently) |
 | `` `code` `` | `{{code}}` |
-| Tables (` | h | h | / | --- | --- |`) | `||h||h||` then `|c|c|` rows |
+| `[text](url)` | `[text\|url]` |
+| Tables (`\| h \| h \|` / `\| --- \| --- \|`) | `\|\|h\|\|h\|\|` then `\|c\|c\|` rows |
 | Code fences ` ```lang ` | `{code:lang} ... {code}` |
 
+The `\|` sequences in the two link/table rows are this table's own escape for a literal pipe  -  the emitted Jira markup carries `|`, never `\|`.
+
 Lines outside these patterns pass through verbatim. Multi-paragraph blocks are joined with one blank line.
 
+Every row above is load-bearing, including the ones that look cosmetic. The table must cover each construct the section templates in this file actually emit  -  `##` for the three required headings, `**Given**` / `**When**` / `**Then**` in the test-scenario skeleton, and `1.`-numbered scenarios. A missing row does not degrade gracefully: the "pass through verbatim" fallback POSTs `## Test Senaryoları` and `**Given**` as literal text, so the comment renders with visible `##` and stray asterisks. Single `*bold*` in Markdown means *italic* in Jira wiki  -  never map `**bold**` to `*bold*` by dropping one asterisk mechanically without checking the source was bold, not italic.
+
+There is no markdown→Jira-wiki converter program in the pipeline (`lib/` ships `md2confluence-v3.py` for Confluence only). This table is applied by the model, by hand, which is exactly why it has to be complete.
+
 ## Cross-link injection
 
 The adapter prepends the linked PR URL on the **first line** so reviewers can jump to the PR with one click:

package/pipeline/multi-agent-refs/channels/pr-review-actions.md

@@ -78,7 +78,7 @@ If a finding's `line` falls outside the diff (review of unchanged code), the anc
 | Provider | Approve | Needs Work / Request Changes |
 |---|---|---|
 | GitHub | `gh pr review <N> --approve` | `gh pr review <N> --request-changes --body "<empty>"` |
-| Bitbucket Server | `PUT /pull-requests/{id}/participants/{userSlug}` body `{"status":"APPROVED"}` | `PUT /pull-requests/{id}/participants/{userSlug}` body `{"status":"NEEDS_WORK"}` |
+| Bitbucket Server | `PUT /rest/api/1.0/projects/{key}/repos/{slug}/pull-requests/{id}/participants/{userSlug}` body `{"status":"APPROVED"}` | same path, body `{"status":"NEEDS_WORK"}` |
 
 The Bitbucket needs-work pattern keeps the user as REVIEWER role; status flip is the visible "Request changes" signal in the UI.