@mmerterden/multi-agent-pipeline 14.2.1 → 15.0.0

package/pipeline/scripts/diff-risk-score.mjs

@@ -104,9 +104,9 @@ function loadNumstat() {
     const map = new Map();
     let cur = null;
     for (const line of text.split("\n")) {
-      const m = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
-      if (m) {
-        cur = m[2];
+      const p = matchDiffGitHeader(line);
+      if (p !== null) {
+        cur = p;
         if (!map.has(cur)) map.set(cur, { added: 0, removed: 0 });
         continue;
       }
@@ -122,7 +122,7 @@ function loadNumstat() {
   return out.split("\n").map((line) => {
     const [a, r, ...rest] = line.split("\t");
     return {
-      path: rest.join("\t"),
+      path: unquotePathIfNeeded(rest.join("\t")),
       added: a === "-" ? 0 : Number(a) || 0,
       removed: r === "-" ? 0 : Number(r) || 0,
     };
@@ -162,6 +162,60 @@ const TEST_PATH_GLOBS = [
   /\.spec\.(ts|tsx|js|mjs|py)$/i,
 ];
 
+// git quotes a path in a `diff --git` header (core.quotePath, on by default)
+// whenever it contains a non-ASCII byte or other unusual character -
+// "diff --git \"a/\\303\\226deme.swift\" \"b/\\303\\226deme.swift\"" for a
+// Turkish filename, not the bare `a/`/`b/` form. `/^diff --git a\/(.+?)
+// b\/(.+)$/` doesn't match a line starting with a quote at all, so every
+// non-ASCII-named file was silently dropped from risk scoring.
+const DIFF_GIT_QUOTED_RE = /^diff --git "a\/((?:[^"\\]|\\.)*)" "b\/((?:[^"\\]|\\.)*)"$/;
+const DIFF_GIT_UNQUOTED_RE = /^diff --git a\/(.+?) b\/(.+)$/;
+
+// Reverse git's C-style quoting: octal byte escapes (\NNN, one per raw byte -
+// a multi-byte UTF-8 character is several consecutive \NNN triplets) plus
+// the standard \\ \" \t \n \r escapes.
+function unquoteGitPath(s) {
+  const bytes = [];
+  for (let i = 0; i < s.length; i++) {
+    if (s[i] === "\\") {
+      const octal = s.slice(i + 1, i + 4);
+      if (/^[0-7]{3}$/.test(octal)) {
+        bytes.push(parseInt(octal, 8));
+        i += 3;
+        continue;
+      }
+      const simple = { "\\": 92, '"': 34, t: 9, n: 10, r: 13 };
+      const next = s[i + 1];
+      if (next in simple) {
+        bytes.push(simple[next]);
+        i += 1;
+        continue;
+      }
+    }
+    bytes.push(s.charCodeAt(i));
+  }
+  return Buffer.from(bytes).toString("utf-8");
+}
+
+// `git diff --numstat` quotes a non-ASCII/unusual path the same C-style way
+// as the `diff --git` header line (e.g. `"\303\226deme.swift"`), just
+// without the surrounding "diff --git a/...b/..." context to detect it by.
+function unquotePathIfNeeded(s) {
+  if (s.length >= 2 && s[0] === '"' && s[s.length - 1] === '"') {
+    return unquoteGitPath(s.slice(1, -1));
+  }
+  return s;
+}
+
+// Returns the b/-side path from a `diff --git` header line, or null if the
+// line isn't one. Handles both the quoted and unquoted forms.
+function matchDiffGitHeader(line) {
+  const q = line.match(DIFF_GIT_QUOTED_RE);
+  if (q) return unquoteGitPath(q[2]);
+  const u = line.match(DIFF_GIT_UNQUOTED_RE);
+  return u ? u[2] : null;
+}
+
 function matchesAny(path, regexes) {
   return regexes.some((r) => r.test(path));
 }
@@ -170,6 +224,16 @@ function isTestPath(path) {
   return matchesAny(path, TEST_PATH_GLOBS);
 }
 
+// pairedTestPaths only knows how to derive a test-file name for these
+// extensions; for anything else (README.md, package.json, .yaml configs,
+// lockfiles, ...) it falls back to the untouched filename as `base` with an
+// empty `ext`, producing candidates like "README.mdTests." that can never
+// match a real path. Gating no_test_change on this is what "source touched"
+// in the comment above actually means - without it, the signal fired on
+// every non-test file in a diff, README included, which made HIGH_STAKES in
+// review-scope.mjs unavoidable for almost any real-world diff.
+const PAIRABLE_SOURCE_EXT_RE = /\.(swift|kt|ts|tsx|js|mjs|py)$/;
+
 function pairedTestPaths(srcPath) {
   // Return likely test path candidates for a source file.
   const parts = srcPath.split("/");
@@ -189,9 +253,9 @@ function parseHunks(diffText) {
   const perFile = new Map();
   let cur = null;
   for (const line of diffText.split("\n")) {
-    const m = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
-    if (m) {
-      cur = m[2];
+    const p = matchDiffGitHeader(line);
+    if (p !== null) {
+      cur = p;
       if (!perFile.has(cur)) perFile.set(cur, []);
       continue;
     }
@@ -271,7 +335,7 @@ function buildRow(stat, addedLines, allChangedPaths) {
   }
 
   // No-test-change: source touched + no matching test file in the changed set.
-  if (!isTestPath(path)) {
+  if (!isTestPath(path) && PAIRABLE_SOURCE_EXT_RE.test(path)) {
     const candidates = pairedTestPaths(path).map((c) => c.toLowerCase());
     const anyTest = allChangedPaths.some((p) => {
       if (!isTestPath(p)) return false;

package/pipeline/scripts/gc-worktrees.sh

@@ -125,7 +125,10 @@ done
 
 # 3. Gitlink residue in the index ("Subproject commit" entries under
 #    .worktrees/ from a pre-guard `git add -A`).
-gitlinks=$(git -C "$REPO" ls-files -s -- .worktrees 2>/dev/null | awk '$1 == "160000" { print $4 }')
+# Path is the tab-separated second field ("mode sha stage\tpath"); splitting on
+# whitespace truncated any path containing a space and the follow-up
+# `git rm --ignore-unmatch` exited 0 on the phantom, reporting a false success.
+gitlinks=$(git -C "$REPO" ls-files -s -- .worktrees 2>/dev/null | awk -F'\t' '$1 ~ /^160000 / { print $2 }')
 if [ -n "$gitlinks" ]; then
   while IFS= read -r path; do
     [ -z "$path" ] && continue

package/pipeline/scripts/gen-mode-dispatch.mjs

@@ -145,7 +145,7 @@ bash $HOME/.claude/scripts/phase-tracker.sh update 0 in_progress
 bash $HOME/.claude/scripts/phase-tracker.sh update <N> in_progress|completed|failed|skipped
 
 # After every LLM call (every CLI):
-bash $HOME/.claude/scripts/phase-tracker.sh tokens <N> <in> <out>
+bash $HOME/.claude/scripts/phase-tracker.sh tokens <N> <in> <out> [cached]
 \`\`\`
 
 ### Visual channel  -  Claude Code (native TaskList widget, required)

package/pipeline/scripts/gen-skills-index.mjs

@@ -82,7 +82,7 @@ md += `**Total:** ${total} skills (${breakdown}). Auto-generated by \`scripts/ge
 md += `## Directory layout\n\n`;
 md += `- **\`core/\`**  -  ${counts.core} \`multi-agent*\` orchestration skills that are pipeline-critical. Edits here are core-code changes.\n`;
 md += `- **\`external/\`**  -  ${counts.external} iOS / Android / generic skills imported from the upstream skill library. Mirrors of third-party guidance.\n`;
-md += `- Install destination stays flat: both trees flatten into \`~/.claude/skills/\` and \`~/.copilot/skills/\`. See ADR-0006 for the rationale.\n\n`;
+md += `- Install destinations (ADR-0009): Claude Code gets NO local copy of \`external/\` - it loads those skills from the \`multi-agent-plugins\` marketplace, namespaced (\`ai-<stack>-toolkit:<name>\`); only the two compliance catalogs from \`core/\` land in \`~/.claude/skills/\`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. \`external/\` remains the single authoring source that \`build-stack-plugins.mjs\` publishes from.\n\n`;
 md += `Source layout is logical grouping only  -  skill discovery at runtime is unchanged.\n\n`;
 md += `## Categories\n\n`;
 for (const k of order) {

package/pipeline/scripts/learning-curve.mjs

@@ -78,8 +78,14 @@ for (const e of events) {
   }
   if (e.ts && (!t.firstTs || e.ts < t.firstTs)) t.firstTs = e.ts;
   const d = e.details || {};
-  if (e.event === "review.completed" && d.review_cycles != null)
-    t.reviewCycles = num(d.review_cycles);
+  // phase-4-review.md's actual review.completed emission (raw_count=/
+  // accepted=/deferred=/rejected=/approved=/duration_ms=) carries no
+  // review_cycles field - that name only appears on Phase 7's task.completed
+  // summary event, which this never matched. Phase 4 re-runs (and logs its
+  // own review.completed) once per rework cycle, so the cycle count for a
+  // task is how many review.completed events share its task_id - the same
+  // derivation aggregate-metrics.mjs already uses for this metric.
+  if (e.event === "review.completed") t.reviewCycles = (t.reviewCycles ?? 0) + 1;
   if (e.event === "rework.started") t.rework += 1;
   t.tokensIn += num(d.tokens_in);
   t.tokensOut += num(d.tokens_out);

package/pipeline/scripts/match-skills.mjs

@@ -202,13 +202,19 @@ for (const entry of index.entries) {
 results.sort((a, b) => b.score - a.score || a.name.localeCompare(b.name));
 const top = results.slice(0, opts.limit);
 
+// On Claude Code an external skill resolves only through its marketplace plugin,
+// so surface `invokeAs` (plugin-namespaced) as the primary name. Old indexes
+// without the field fall back to the bare name - same behaviour as before.
 if (opts.json) {
-  process.stdout.write(JSON.stringify({ task: taskText, matches: top }, null, 2) + "\n");
+  const matches = top.map((m) => ({ ...m, invokeAs: m.invokeAs || m.name }));
+  process.stdout.write(JSON.stringify({ task: taskText, matches }, null, 2) + "\n");
 } else {
   for (const m of top) {
     const tag = `[${m.group}${m.platform ? "/" + m.platform : ""}]`;
     const desc = (m.description || "").slice(0, 80);
-    console.log(`${String(m.score).padStart(3)} ${m.name.padEnd(32)} ${tag.padEnd(18)} ${desc}`);
+    console.log(
+      `${String(m.score).padStart(3)} ${(m.invokeAs || m.name).padEnd(46)} ${tag.padEnd(18)} ${desc}`,
+    );
   }
   if (top.length === 0) console.log("(no skills matched)");
 }

package/pipeline/scripts/migrate-prefs.mjs

@@ -13,12 +13,13 @@
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
+import { fileURLToPath } from "node:url";
 
 const DEFAULT_FILE = path.join(os.homedir(), ".claude", "multi-agent-preferences.json");
 
 // Single source of truth for the migration target version. Referenced by the
 // migrate() bump chain AND every user-facing message, so they cannot drift.
-const TARGET_VERSION = "2.5.0";
+const TARGET_VERSION = "2.6.0";
 
 const USAGE = "Usage: migrate-prefs.mjs [--dry-run] [--file <path>]";
 
@@ -75,7 +76,7 @@ function defaultSettings() {
  * @returns {Set<string>}
  */
 function readMigratableVersions(target) {
-  const here = path.dirname(new URL(import.meta.url).pathname);
+  const here = path.dirname(fileURLToPath(import.meta.url));
   const candidates = [
     path.join(here, "..", "schemas", "prefs.schema.json"),
     path.join(here, "..", "..", "pipeline", "schemas", "prefs.schema.json"),
@@ -297,7 +298,9 @@ function migrate(prefs) {
       seeded += 1;
     }
     if (seeded > 0) {
-      changes.push(`seeded ${seeded} recentBranches entr${seeded === 1 ? "y" : "ies"} for ${projectKey} from legacy projects[].branches`);
+      changes.push(
+        `seeded ${seeded} recentBranches entr${seeded === 1 ? "y" : "ies"} for ${projectKey} from legacy projects[].branches`,
+      );
     }
   }
   if (!Array.isArray(out.global.recentGroups)) {
@@ -332,27 +335,32 @@ function migrate(prefs) {
     out.global.skillConformance.blockOnCoverageGap = false;
     changes.push("added skillConformance.blockOnCoverageGap=false (report, do not halt)");
   }
-  // v2.5.0: /multi-agent:finish became /multi-agent:ship, and its autoFix key -
-  // referenced by the command spec since it shipped but never declared in the
-  // schema - is declared here. Carry any value the user had rather than reset it.
-  if (!out.global.ship || typeof out.global.ship !== "object") {
-    out.global.ship = {};
-    changes.push("added ship (v2.5.0  -  /multi-agent:finish renamed to :ship)");
-  }
-  if (typeof out.global.ship.autoFix !== "boolean") {
-    const legacyAutoFix = out.global.finish?.autoFix;
-    out.global.ship.autoFix = typeof legacyAutoFix === "boolean" ? legacyAutoFix : false;
+  // Rename chain for the pipeline-tail command: /multi-agent:finish (pre-v2.5.0)
+  // -> :ship (v2.5.0) -> :resume-local (current). The autoFix value survives every
+  // hop - carry whichever legacy block still holds one rather than reset it.
+  if (!out.global.resumeLocal || typeof out.global.resumeLocal !== "object") {
+    out.global.resumeLocal = {};
+    changes.push("added resumeLocal (/multi-agent:ship renamed to :resume-local)");
+  }
+  if (typeof out.global.resumeLocal.autoFix !== "boolean") {
+    const legacyAutoFix =
+      typeof out.global.ship?.autoFix === "boolean"
+        ? out.global.ship.autoFix
+        : out.global.finish?.autoFix;
+    out.global.resumeLocal.autoFix = typeof legacyAutoFix === "boolean" ? legacyAutoFix : false;
     changes.push(
       typeof legacyAutoFix === "boolean"
-        ? "moved finish.autoFix -> ship.autoFix (value preserved)"
-        : "added ship.autoFix=false",
+        ? "moved ship/finish autoFix -> resumeLocal.autoFix (value preserved)"
+        : "added resumeLocal.autoFix=false",
     );
   }
-  if (out.global.finish && typeof out.global.finish === "object") {
-    delete out.global.finish.autoFix;
-    if (Object.keys(out.global.finish).length === 0) {
-      delete out.global.finish;
-      changes.push("removed obsolete finish block (renamed to ship)");
+  for (const legacy of ["ship", "finish"]) {
+    if (out.global[legacy] && typeof out.global[legacy] === "object") {
+      delete out.global[legacy].autoFix;
+      if (Object.keys(out.global[legacy]).length === 0) {
+        delete out.global[legacy];
+        changes.push(`removed obsolete ${legacy} block (renamed to resumeLocal)`);
+      }
     }
   }
   if (!out.global.serviceStatus) {

package/pipeline/scripts/output-quality-check.sh

@@ -80,11 +80,22 @@ if [ -f "$PR_BODY" ]; then
   else
     ok "PR body free of HTML entities"
   fi
-  for sec in "## Summary" "## How to Test"; do
-    grep -q "$sec" "$PR_BODY" \
-      && ok "PR body has '$sec' section" \
-      || warn "PR body missing '$sec' section"
+  # Canonical section set is channels/pr.md's: summary -> changes ->
+  # architecture (cond.) -> verification -> dependencies (cond.) -> related.
+  # Headings render in outputLanguage, so match the always-required three by
+  # either language rather than pinning English. "## How to Test" was the old
+  # phase-6 template's heading and is not part of the canonical set.
+  for sec in "Summary|Özet" "Changes|Değişiklikler" "Verification|Doğrulama"; do
+    label="${sec%%|*}"
+    grep -qE "^## ($sec)" "$PR_BODY" \
+      && ok "PR body has '$label' section" \
+      || warn "PR body missing '$label' section (canonical set: channels/pr.md)"
   done
+  if grep -qE '^h[1-6]\. |\{\{[A-Za-z_]' "$PR_BODY"; then
+    bad "PR body contains Jira wiki markup (h2./{{code}}) - PR bodies are Markdown"
+  else
+    ok "PR body free of Jira wiki markup"
+  fi
 else
   warn "no .pr-body.md in task dir (skipped PR-body check)"
 fi

package/pipeline/scripts/phase-tracker.sh

@@ -259,9 +259,9 @@ emit_otel_span() {
       startTimeUnixNano: $ts,
       endTimeUnixNano: $ts,
       attributes: ({
-        "multi_agent.task_id": $task,
-        "multi_agent.phase_id": $phase,
-        "multi_agent.subject": $subj,
+        "task_id": $task,
+        "phase_id": $phase,
+        "subject": $subj,
         "service.name": "multi-agent-pipeline"
       } + $extra)
     }' >> "$spans_file" 2>/dev/null || true
@@ -382,6 +382,9 @@ load_state() {
   fi
 }
 save_state() {
+  # Refuse to persist an empty document: every caller pipes jq output in, and
+  # a failed jq yields "" - writing that would destroy the whole tracker state.
+  [ -n "$1" ] || { echo "save_state: refusing to write empty state" >&2; return 65; }
   mkdir -p "$TRACKER_DIR" 2>/dev/null
   printf '%s\n' "$1" > "${TRACKER_FILE}.tmp"
   mv "${TRACKER_FILE}.tmp" "$TRACKER_FILE"
@@ -693,7 +696,7 @@ case "$ACTION" in
     state=$(load_state)
     # Idempotent: a phase id that already exists is a no-op (name, status, and
     # token history are preserved). This is what lets continuation commands
-    # (/multi-agent:ship, resume) re-declare their phase set against a
+    # (/multi-agent:resume-local, resume) re-declare their phase set against a
     # pre-existing tracker without duplicating or resetting tiles.
     new=$(echo "$state" | jq --arg id "$PID" --arg name "$PNAME" '
       if any(.phases[]?; .id == $id) then .
@@ -728,7 +731,7 @@ case "$ACTION" in
     ')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.update" "$PID" "$STATUS" "{\"multi_agent.status\": \"$STATUS\"}"
+    emit_otel_span "phase.update" "$PID" "$STATUS" "{\"status\": \"$STATUS\"}"
     render
     ;;
 
@@ -757,7 +760,7 @@ case "$ACTION" in
       )')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.sub" "$PID" "$SNAME" "{\"multi_agent.sub_id\": \"$SID\", \"multi_agent.status\": \"$SSTATUS\"}"
+    emit_otel_span "phase.sub" "$PID" "$SNAME" "{\"sub_id\": \"$SID\", \"status\": \"$SSTATUS\"}"
     render
     ;;
 
@@ -766,9 +769,13 @@ case "$ACTION" in
     [ "$#" -ge 3 ] || { echo "tokens needs <phase_id> <in> <out> [cached]" >&2; exit 64; }
     PID="$1"; T_IN="$2"; T_OUT="$3"; T_CACHED="${4:-0}"
     # Validate integers (cached is optional, defaults to 0 for back-compat).
-    case "$T_IN$T_OUT$T_CACHED" in
-      *[!0-9]*) echo "tokens: in/out/cached must be non-negative integers" >&2; exit 64 ;;
-    esac
+    # Each field checked separately: concatenation would let an empty field
+    # pass and feed jq --argjson an empty string, nuking the state file.
+    for v in "$T_IN" "$T_OUT" "$T_CACHED"; do
+      case "$v" in
+        ''|*[!0-9]*) echo "tokens: in/out/cached must be non-negative integers" >&2; exit 64 ;;
+      esac
+    done
     acquire_state_lock
     state=$(load_state)
     # Additive: add to existing totals so multiple LLM calls accumulate.
@@ -783,7 +790,20 @@ case "$ACTION" in
     ')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.tokens" "$PID" "" "{\"multi_agent.tokens_in_delta\": $T_IN, \"multi_agent.tokens_out_delta\": $T_OUT, \"multi_agent.tokens_cached_delta\": $T_CACHED}"
+    # Carry the phase's current model/name onto the span too: the cost
+    # renderers' OTel-fallback path groups phase.tokens spans by phase_id and
+    # reads model/phase_name off the first span in each group, so without
+    # these the fallback always renders the default model/"?" name even
+    # though the tracker JSON already knows both.
+    PHASE_MODEL_ATTR=$(printf '%s' "$new" | jq -r --arg id "$PID" '(.phases[] | select(.id == $id) | .model) // ""')
+    PHASE_NAME_ATTR=$(printf '%s' "$new" | jq -r --arg id "$PID" '(.phases[] | select(.id == $id) | .name) // ""')
+    TOKENS_EXTRA=$(jq -nc \
+      --argjson ti "$T_IN" --argjson to "$T_OUT" --argjson tc "$T_CACHED" \
+      --arg model "$PHASE_MODEL_ATTR" --arg name "$PHASE_NAME_ATTR" \
+      '{tokens_in_delta: $ti, tokens_out_delta: $to, tokens_cached_delta: $tc}
+       + (if $model != "" then {model: $model} else {} end)
+       + (if $name != "" then {phase_name: $name} else {} end)')
+    emit_otel_span "phase.tokens" "$PID" "" "$TOKENS_EXTRA"
     # Re-render so live token count is visible on the active phase. Callers
     # that want silent accumulation (e.g. tight loops) can suppress with
     # TRACKER_QUIET=1 to skip the re-render but still write state.
@@ -806,7 +826,8 @@ case "$ACTION" in
       )')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.meta" "$PID" "$KEY" "{\"multi_agent.meta_key\": \"$KEY\", \"multi_agent.meta_value\": \"$VALUE\"}"
+    META_EXTRA=$(jq -nc --arg k "$KEY" --arg v "$VALUE" '{meta_key: $k, meta_value: $v}')
+    emit_otel_span "phase.meta" "$PID" "$KEY" "$META_EXTRA"
     if [ "${TRACKER_QUIET:-0}" != "1" ]; then
       render
     fi
@@ -824,7 +845,7 @@ case "$ACTION" in
       )')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.model" "$PID" "" "{\"multi_agent.model\": \"$MODEL\"}"
+    emit_otel_span "phase.model" "$PID" "" "{\"model\": \"$MODEL\"}"
     if [ "${TRACKER_QUIET:-0}" != "1" ]; then
       render
     fi

package/pipeline/scripts/phase0-exit-gate.mjs

@@ -76,7 +76,8 @@ export function inputTextOf(state) {
   // evidence[].url / figmaFrames[] are where the analysis phase parks references.
   for (const key of ["figmaFrames", "designRefs"]) {
     const v = state[key];
-    if (Array.isArray(v)) parts.push(v.map((x) => (typeof x === "string" ? x : JSON.stringify(x))).join(" "));
+    if (Array.isArray(v))
+      parts.push(v.map((x) => (typeof x === "string" ? x : JSON.stringify(x))).join(" "));
   }
   return parts.join("\n");
 }
@@ -198,7 +199,7 @@ function main(argv) {
   const args = argv.slice(2);
   const taskId = args.find((a) => !a.startsWith("--"));
   if (!taskId) {
-    console.error("usage: phase0-exit-gate.mjs <task_id> [--input \"<text>\"] [--json]");
+    console.error('usage: phase0-exit-gate.mjs <task_id> [--input "<text>"] [--json]');
     return 2;
   }
   const inputIdx = args.indexOf("--input");

package/pipeline/scripts/pre-commit-check.sh

@@ -12,6 +12,7 @@ set -uo pipefail
 # Direct invocations (empty/non-JSON stdin, e.g. smoke tests or manual runs)
 # fall through to the full scan. Extraction failure also falls through - the
 # only cost is an unnecessary scan, never a skipped one on a real commit.
+SCAN_UNSTAGED=0
 if [ ! -t 0 ]; then
   HOOK_INPUT="$(cat 2>/dev/null || true)"
   if [ -n "$HOOK_INPUT" ]; then
@@ -40,42 +41,53 @@ process.stdin.on("end", () => {
         | grep -qE '(^|[^[:alnum:]_./-])git[[:space:]]+([^|&;]*[[:space:]])?commit([^[:alnum:]_-]|$)'; then
         exit 0
       fi
+      # PreToolUse fires BEFORE the tool runs, so a compound command like
+      # `git add -A && git commit -m ...` reaches this point with NOTHING
+      # staged yet from either half - `git diff --cached` alone sees an
+      # empty index and this scan silently no-ops right before the commit
+      # it exists to gate. When the same command also runs `git add`, widen
+      # the scan to the working tree (tracked-unstaged + untracked), not
+      # just the index, so that case is still caught.
+      if printf '%s\n' "$HOOK_COMMAND" \
+        | grep -qE '(^|[^[:alnum:]_./-])git[[:space:]]+add([^[:alnum:]_-]|$)'; then
+        SCAN_UNSTAGED=1
+      fi
     fi
   fi
 fi
 
-if [ -z "$(git diff --cached --name-only 2>/dev/null)" ]; then
-  exit 0
-fi
-
 FOUND=0
 
-# NUL-delimited so filenames with spaces are scanned (a space-split loop would
-# silently skip them - a secret false-negative). Process substitution keeps the
-# loop in the current shell so FOUND survives.
-while IFS= read -r -d '' file; do
-  [ -z "$file" ] && continue
-  [ ! -f "$file" ] && continue
-  file "$file" 2>/dev/null | grep -q "binary" && continue
+# `file "$f" | grep -q "binary"` never matches real `file` output (it names a
+# concrete type - "ELF 64-bit", "Mach-O", "PNG image data" - not the word
+# "binary"), so every binary was scanned as text. --mime's charset=binary is
+# the actual signal libmagic gives for non-text content.
+is_binary() {
+  file --mime "$1" 2>/dev/null | grep -q 'charset=binary'
+}
 
-  # Only check added/modified lines
-  content=$(git diff --cached -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
-  [ -z "$content" ] && continue
+# All BLOCKED checks for one file, given the content to scan (added lines for
+# a diff, or the whole file for something not yet tracked at all - every line
+# of a brand-new file is an addition).
+scan_file() {
+  local file="$1" content="$2"
 
   # .env files
   if echo "$file" | grep -qE '\.env($|\.)'; then
     echo "BLOCKED: .env file staged: $file"
     FOUND=1
-    continue
+    return 0
   fi
 
   # Credentials files
   if echo "$file" | grep -qiE '(credentials|secrets|tokens)\.(json|yaml|yml|plist)$'; then
     echo "BLOCKED: Credentials file staged: $file"
     FOUND=1
-    continue
+    return 0
   fi
 
+  [ -z "$content" ] && return 0
+
   # API keys / tokens (key = "long_string" pattern)
   if echo "$content" | grep -qiE '(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[:=]\s*["'"'"'][A-Za-z0-9+/=_-]{20,}'; then
     echo "BLOCKED: Possible API key/token in $file"
@@ -119,12 +131,12 @@ while IFS= read -r -d '' file; do
   # `smoke-pre-commit.sh` is this gate's OWN test suite: it must contain
   # secret-shaped fixtures (a fake `ghp_` token, a fake JWT, a random 44-char
   # string) in order to prove the detector fires on them. Only ADDED lines are
-  # scanned (see the `git diff --cached | grep "^+"` above), so existing fixtures
-  # are invisible  -  but ADDING a new detector test blocks the commit that adds
-  # it, which makes the detector untestable. Entropy only: the provider-prefix,
-  # AWS, private-key, JWT and service-account checks above still apply to this
-  # file, so a real token pasted here is still caught. Scoped to this one path on
-  # purpose  -  widen the list and the gate stops meaning anything.
+  # scanned, so existing fixtures are invisible  -  but ADDING a new detector
+  # test blocks the commit that adds it, which makes the detector untestable.
+  # Entropy only: the provider-prefix, AWS, private-key, JWT and
+  # service-account checks above still apply to this file, so a real token
+  # pasted here is still caught. Scoped to this one path on purpose  -  widen
+  # the list and the gate stops meaning anything.
   # The generic high-entropy exemptions stay case-insensitive (lockfile names
   # vary). The gate's own suite is matched separately and CASE-SENSITIVELY on its
   # exact repo-relative path: `(^|/)smoke-pre-commit\.sh$` under `grep -i` would
@@ -184,8 +196,43 @@ while IFS= read -r -d '' file; do
       fi
     fi
   fi
+}
+
+# NUL-delimited so filenames with spaces are scanned (a space-split loop would
+# silently skip them - a secret false-negative).
+
+# Already-staged content - the common case, and the only source when nothing
+# in the triggering command itself runs `git add`.
+while IFS= read -r -d '' file; do
+  [ -z "$file" ] && continue
+  [ ! -f "$file" ] && continue
+  is_binary "$file" && continue
+  content=$(git diff --cached -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
+  scan_file "$file" "$content"
 done < <(git diff --cached --name-only -z 2>/dev/null)
 
+if [ "$SCAN_UNSTAGED" = "1" ]; then
+  # Tracked and modified, but not staged yet (the `git add` half of the
+  # compound command hasn't run at this point - see SCAN_UNSTAGED above).
+  while IFS= read -r -d '' file; do
+    [ -z "$file" ] && continue
+    [ ! -f "$file" ] && continue
+    is_binary "$file" && continue
+    content=$(git diff HEAD -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
+    scan_file "$file" "$content"
+  done < <(git diff HEAD --name-only -z 2>/dev/null)
+
+  # Untracked (brand-new) files - there is no diff to take yet, so every line
+  # of the file is "added" content for scanning purposes.
+  while IFS= read -r -d '' file; do
+    [ -z "$file" ] && continue
+    [ ! -f "$file" ] && continue
+    is_binary "$file" && continue
+    content=$(sed 's/^/+/' "$file" 2>/dev/null || true)
+    scan_file "$file" "$content"
+  done < <(git ls-files --others --exclude-standard -z 2>/dev/null)
+fi
+
 if [ $FOUND -eq 1 ]; then
   echo ""
   echo "Secret check failed. Remove secrets from staged files before committing."

package/pipeline/scripts/render-agent-log-cost.sh

@@ -30,9 +30,14 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-COST_TABLE="$ROOT/pipeline/scripts/cost-table.json"
-COST_LIB="$ROOT/pipeline/scripts/cost-lib.sh"
+# cost-table.json/cost-lib.sh ship as siblings of this script both in the
+# repo (pipeline/scripts/) and once installed (~/.claude/scripts/) - a
+# repo-root-relative path (../../pipeline/scripts/...) only resolves in the
+# repo checkout and silently misses in the installed layout. Match
+# phase-tracker.sh's own resolution instead of re-deriving a repo root.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+COST_TABLE="$SCRIPT_DIR/cost-table.json"
+COST_LIB="$SCRIPT_DIR/cost-lib.sh"
 if [ -f "$COST_LIB" ]; then . "$COST_LIB"; else COST_JQ_DEFS=""; fi
 
 command -v jq >/dev/null 2>&1 || { echo "render-agent-log-cost: jq required" >&2; exit 2; }