@mmerterden/multi-agent-pipeline 16.17.1 → 16.19.0

package/pipeline/commands/multi-agent/review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 description: "Run parallel review on a branch's diff or a Pull Request: 3 models on Claude Code (Fable + Opus + Sonnet), 3 models on Copilot CLI (GPT + Opus + Sonnet). On PR input, posts per-finding inline comments and sets approve/needs-work review state. Use when a branch diff or a pull request needs reviewing before it merges."
 description-tr: "Bir branch diff'i veya Pull Request üzerinde paralel review koşar: Claude Code'da 3 model (Fable + Opus + Sonnet), Copilot CLI'da 3 model (GPT + Opus + Sonnet). PR girdisinde bulgu başına inline yorum atar ve approve/needs-work durumunu işaretler."
-argument-hint: "[#N | repo#N | PR-URL | branch]  -  optional: PR by number/URL, repo+number, or local branch. Supports GitHub and Bitbucket Server URLs. If omitted (interactive), open GitHub + Bitbucket PRs are listed for multi-select; autopilot falls back to the current branch."
+argument-hint: "[#N | repo#N | PR-URL | branch] [--with <path|owner/repo>]  -  optional: PR by number/URL, repo+number, or local branch. Supports GitHub and Bitbucket Server URLs. If omitted (interactive), open GitHub + Bitbucket PRs are listed for multi-select; autopilot falls back to the current branch. --with names the counterpart app repo for the platform-parity cross-check."
 ---
 
 # multi-agent review  -  Review Only Mode
@@ -117,12 +117,12 @@ jq --arg sha "$HEAD_SHA" '.review.headCommitSha = $sha' "$AGENT_STATE" > "$tmp_s
 **pr mode  -  bitbucket-server:**
 
 ```bash
-# Resolve credentials via prefs.keychainMapping (never hardcode key names).
+# Resolve credentials via prefs.global.keychainMapping (never hardcode key names).
 . "$HOME/.claude/lib/credential-store-resolver.sh" \
   || . "$HOME/.copilot/lib/credential-store-resolver.sh"
 resolve_credential_store
-USER_KEY=$(jq -r '.keychainMapping.bitbucket_user' "$HOME/.claude/multi-agent-preferences.json")
-TOKEN_KEY=$(jq -r '.keychainMapping.bitbucket_token' "$HOME/.claude/multi-agent-preferences.json")
+USER_KEY=$(jq -r '.global.keychainMapping.bitbucket_user' "$HOME/.claude/multi-agent-preferences.json")
+TOKEN_KEY=$(jq -r '.global.keychainMapping.bitbucket_token' "$HOME/.claude/multi-agent-preferences.json")
 BB_USER=$("$CRED_STORE" get "$USER_KEY")
 BB_TOKEN=$("$CRED_STORE" get "$TOKEN_KEY")
 
@@ -175,15 +175,25 @@ Scope note: a guide governs only files under its own directory  -  a guide found
 
 ### 3. Launch parallel reviewers  -  host-CLI dependent
 
+Every host runs three reviewers; only the second slot differs, because GPT-5.4 exists on Copilot and Codex but not on Claude Code, where Opus fills it.
+
 **Claude Code (3 in parallel):**
 - Agent 1: `claude-fable-5` → security + architecture
-- Agent 2: `claude-sonnet-5` → general quality
+- Agent 2: `claude-opus-5` → edge cases, alternate perspective
+- Agent 3: `claude-sonnet-5` → general quality
 
 **Copilot CLI (3 in parallel):**
 - Agent 1: `claude-opus-5` → security + architecture (Fable 5 is not offered on Copilot CLI)
 - Agent 2: `gpt-5.4` → edge cases, alternate perspective
 - Agent 3: `claude-sonnet-5` → general quality
 
+**Codex CLI (3 in parallel, single vendor):**
+- Agent 1: `gpt-5.6` @ `xhigh` → security + architecture
+- Agent 2: `gpt-5.4` @ `high` → edge cases, alternate perspective
+- Agent 3: `gpt-5.6` @ `medium` → general quality
+
+With the `fable` rung disabled by prefs the Claude Code panel is two reviewers (Opus + Sonnet); see `$HOME/.claude/multi-agent-refs/features/model-fallback.md`.
+
 Each reviewer receives the diff, the module review guides from Step 2b (when any were found), plus the standard reviewer system prompt (see `$HOME/.claude/multi-agent-refs/phases/phase-4-review.md` for the prompt contract). Output: structured `findings[]` per reviewer.
 
 ### 4. Store-compliance cross-reference
@@ -203,21 +213,24 @@ Catalog-only  -  does NOT invoke binaries. For a full scan, use `/multi-agent:te
 
 ### 4b. Platform parity cross-check (advisory, read-only)
 
-When `state.siblings[]` holds a checked-out repo whose `stack` is the other
-mobile platform and the diff touches a screen, a service, a request model or a
-localization file, compare the change against that repo on four axes: endpoints
-called, parameters sent, business rules around the call, localization keys used.
+When a counterpart repo resolves whose `stack` is the other mobile platform and
+the diff touches a screen, a service, a request model or a localization file,
+compare the change against that repo on four axes: endpoints called, parameters
+sent, business rules around the call, localization keys used.
 
-That array is written by the Phase 0 dev-context picker, so a standalone review
-of a PR URL - no pipeline run, no state file - has no siblings and skips this
-step. The counterpart repo is a human's choice in the picker; guessing one from
-a PR URL would be a cross-repo read nobody authorized.
+The counterpart is resolved automatically, in both directions (ios ↔ android),
+from four sources in this order, first hit wins: `--with <path|owner/repo>` (a
+one-off override, remembered like any other resolution), then a remembered
+`prefs.projects[<slug>].counterpartRoots[]`, then the primary checkout's sibling
+directories, then `state.siblings[]` from the Phase 0 dev-context picker. None of
+them is a precondition for the others. One match is used and remembered, so the
+next review of the same project asks nothing.
 
-The counterpart is located through the code graph, capped at 8 files, and is
-**read only** - never edited, staged, committed, pushed or built. Output is its
-own `Platform parity` section; findings are advisory and never blocking.
+Several candidates → interactive runs ask once; autopilot and non-interactive
+runs skip silently, because an unattended run must not block on a picker. No
+candidate → skip silently, run unaffected. Stack comes from marker files, and
+you never guess a stack from the repo name.
 
-No counterpart repo, or nothing comparable in the diff → skipped silently.
 Contract: `$HOME/.claude/multi-agent-refs/platform-parity.md`.
 
 ### 5. Triage (Fable)
@@ -236,12 +249,13 @@ Triage also marks each finding as `accepted` (real issue), `deferred` (real but
 | Model    | Verdict   | Blocking | Important | Suggestion |
 |----------|-----------|----------|-----------|------------|
 | Fable    | approved  | 0        | 1         | 3          |
+| Opus     | approved  | 0        | 2         | 2          |
 | Sonnet   | rejected  | 1        | 2         | 5          |
 
 Consensus: ⚠ DISAGREEMENT  -  see Fable triage
 ```
 
-This summary ALWAYS prints, regardless of input mode. The chat is the live conversation; on the PR side, the durable artifacts are inline comments + the review state (Step 7).
+One row per reviewer that ran: Fable + Opus + Sonnet on Claude Code, Opus + GPT-5.4 + Sonnet on Copilot CLI, the three GPT rows on Codex CLI. This summary ALWAYS prints, regardless of input mode. The chat is the live conversation; on the PR side, the durable artifacts are inline comments + the review state (Step 7).
 
 ### 7. Post to PR  -  only when input.kind === "pr"
 

package/pipeline/commands/multi-agent/review-analysis/SKILL.md

@@ -23,7 +23,7 @@ Read `$HOME/.claude/multi-agent-refs/analysis/review.md` and execute it:
 
 ## Why it cites Locked decisions
 
-The analysis flow already declares 35 Locked decisions and two deterministic validators. A reviewer that says "I would have written this differently" gives the author nothing to act on; one that says "Locked 34: the Confluence page is in the evidence record but not in Section 21" gives them a fix and a reason. Findings that map to no rule are still allowed, but they are marked as judgement, not dressed up as a violation.
+The analysis flow already declares 36 Locked decisions and two deterministic validators. A reviewer that says "I would have written this differently" gives the author nothing to act on; one that says "Locked 34: the Confluence page is in the evidence record but not in Section 21" gives them a fix and a reason. Findings that map to no rule are still allowed, but they are marked as judgement, not dressed up as a violation.
 
 ## What it never does
 

package/pipeline/commands/multi-agent/store-ready/SKILL.md

@@ -183,7 +183,7 @@ is a guess the user must be able to correct.
 
 ### Mode A  -  build from the branch
 
-1. Worktree at `{projectRoot}/{worktreeBasePath}/{taskId}` on the chosen branch.
+1. Worktree at `{projectRoot}/.worktrees/{taskId}` on the chosen branch (phase-0-init.md Step 6 convention; the `.worktrees` segment is fixed, not a preference).
    **Never under `$HOME`**, never a direct checkout of the main working tree.
 2. Resolve the scheme / module and workspace / project from prefs; ask if ambiguous.
 3. Build:
@@ -329,7 +329,7 @@ Print, and stop:
     declares  -  never run it
 - `/multi-agent:store-ready --resume` to re-run after fixes
 - `/multi-agent:channels` to land the findings in Jira / Confluence / Wiki / PR
-- `/multi-agent:fix-bug` when Gate 3 produced code-level findings
+- the enabled stack plugin's `fix-bug` skill (`ai-ios-toolkit:fix-bug` or the stack equivalent) when Gate 3 produced code-level findings
 
 Never upload, never commit a Play edit, never bump the build number, never commit.
 

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -60,7 +60,7 @@ Run every step automatically:
 Step 1: PLATFORM    Detect macOS / Linux / Windows (Git Bash / WSL); export PLATFORM env
 Step 1.5: DETECT    Compare timestamps, find stale targets
 Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 55 sub-command skills)
-Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 51 specs as refs + 8 agent TOML)
+Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 55 specs as refs + 8 agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
                      bump changed plugins' patch version, commit + push the plugins repo)
@@ -117,7 +117,7 @@ If nothing is stale → report "All targets up to date" and stop.
    - `~/.claude/CLAUDE.md`, `~/.claude/rules/`, `~/.claude/knowledge/`
    - `~/.claude/scripts/`  -  EXCEPT `pre-commit-check.sh`, `agent-guard.sh`, `agent-guard.py`, and `build-stack-plugins.mjs` (generic, synced)
    - `~/.claude/settings.json`
-   - **Any `~/.claude/commands/multi-agent/*.md` whose frontmatter has `local-only: true`** - these are user/repo-specific alias wrappers that delegate to a private marketplace plugin (e.g. corporate `ai-ios-toolkit` skills exposed as `multi-agent:<name>`). Syncing them would leak the private plugin/skill names into the public pipeline. Filter before copy: skip every source file containing `local-only: true`, and after copy assert none reached `pipeline/commands/`.
+   - **Any `~/.claude/commands/multi-agent/*/SKILL.md` whose frontmatter has `local-only: true`** - these are user/repo-specific alias wrappers that delegate to a private marketplace plugin's skills exposed as `multi-agent:<name>`. Syncing them would leak the private plugin/skill names into the public pipeline. Filter before copy: skip every source file containing `local-only: true`, and after copy assert none reached `pipeline/commands/`.
      ```bash
      # backstop: no local-only wrapper may exist in the synced target
      grep -rl "^local-only: true" ~/multi-agent-pipeline/pipeline/commands/ 2>/dev/null \

package/pipeline/commands/sim-test.md

@@ -1,6 +1,6 @@
 ---
 description: "Mobile UI Bug Hunter  -  iOS Simulator (simctl) + Android Emulator (adb)  -  auto-detects platform"
-allowed-tools: Agent, Bash, Read, Write, Edit, TaskCreate, TaskUpdate, TaskList, TaskGet, mcp__multi-agent-toolkit__ios_list_devices, mcp__multi-agent-toolkit__ios_boot_device, mcp__multi-agent-toolkit__ios_screenshot, mcp__multi-agent-toolkit__ios_tap, mcp__multi-agent-toolkit__ios_swipe, mcp__multi-agent-toolkit__ios_type_text, mcp__multi-agent-toolkit__ios_launch_app, mcp__multi-agent-toolkit__ios_terminate_app, mcp__multi-agent-toolkit__ios_list_apps, mcp__multi-agent-toolkit__ios_go_home, mcp__multi-agent-toolkit__ios_set_appearance, mcp__multi-agent-toolkit__ios_set_content_size, mcp__multi-agent-toolkit__ios_set_locale, mcp__multi-agent-toolkit__ios_open_url, mcp__multi-agent-toolkit__ios_status_bar, mcp__multi-agent-toolkit__ios_push_notification, mcp__multi-agent-toolkit__ios_grant_permission, mcp__multi-agent-toolkit__ios_revoke_permission, mcp__multi-agent-toolkit__ios_reset_permissions, mcp__multi-agent-toolkit__ios_set_location, mcp__multi-agent-toolkit__ios_clear_location, mcp__multi-agent-toolkit__ios_set_increase_contrast, mcp__multi-agent-toolkit__ios_record_video, mcp__multi-agent-toolkit__ios_add_media, mcp__multi-agent-toolkit__ios_keychain_reset, mcp__multi-agent-toolkit__ios_get_app_container, mcp__multi-agent-toolkit__ios_erase_device, mcp__multi-agent-toolkit__ios_get_ui_tree, mcp__multi-agent-toolkit__android_list_devices, mcp__multi-agent-toolkit__android_screenshot, mcp__multi-agent-toolkit__android_tap, mcp__multi-agent-toolkit__android_swipe, mcp__multi-agent-toolkit__android_type_text, mcp__multi-agent-toolkit__android_key_event, mcp__multi-agent-toolkit__android_launch_app, mcp__multi-agent-toolkit__android_stop_app, mcp__multi-agent-toolkit__android_list_packages, mcp__multi-agent-toolkit__android_go_home, mcp__multi-agent-toolkit__android_go_back, mcp__multi-agent-toolkit__android_get_ui_tree, mcp__multi-agent-toolkit__android_set_dark_mode, mcp__multi-agent-toolkit__android_set_font_scale, mcp__multi-agent-toolkit__android_set_locale, mcp__multi-agent-toolkit__android_set_location, mcp__multi-agent-toolkit__android_grant_permission, mcp__multi-agent-toolkit__android_revoke_permission, mcp__multi-agent-toolkit__android_record_screen, mcp__multi-agent-toolkit__android_install_apk, mcp__multi-agent-toolkit__android_uninstall_app, mcp__multi-agent-toolkit__android_logcat, mcp__multi-agent-toolkit__android_get_screen_size, mcp__multi-agent-toolkit__android_open_url, mcp__multi-agent-toolkit__android_clear_app_data
+allowed-tools: Agent, Bash, Read, Write, Edit, TaskCreate, TaskUpdate, TaskList, TaskGet, mcp__multi-agent-toolkit__ios_list_devices, mcp__multi-agent-toolkit__ios_boot_device, mcp__multi-agent-toolkit__ios_screenshot, mcp__multi-agent-toolkit__ios_tap, mcp__multi-agent-toolkit__ios_swipe, mcp__multi-agent-toolkit__ios_type_text, mcp__multi-agent-toolkit__ios_launch_app, mcp__multi-agent-toolkit__ios_terminate_app, mcp__multi-agent-toolkit__ios_list_apps, mcp__multi-agent-toolkit__ios_go_home, mcp__multi-agent-toolkit__ios_set_appearance, mcp__multi-agent-toolkit__ios_set_content_size, mcp__multi-agent-toolkit__ios_set_locale, mcp__multi-agent-toolkit__ios_open_url, mcp__multi-agent-toolkit__ios_status_bar, mcp__multi-agent-toolkit__ios_push_notification, mcp__multi-agent-toolkit__ios_grant_permission, mcp__multi-agent-toolkit__ios_revoke_permission, mcp__multi-agent-toolkit__ios_reset_permissions, mcp__multi-agent-toolkit__ios_set_location, mcp__multi-agent-toolkit__ios_clear_location, mcp__multi-agent-toolkit__ios_set_increase_contrast, mcp__multi-agent-toolkit__ios_record_video, mcp__multi-agent-toolkit__ios_add_media, mcp__multi-agent-toolkit__ios_keychain_reset, mcp__multi-agent-toolkit__ios_get_app_container, mcp__multi-agent-toolkit__ios_erase_device, mcp__multi-agent-toolkit__ios_get_ui_tree, mcp__multi-agent-toolkit__ios_accessibility_audit, mcp__multi-agent-toolkit__ios_accessibility_audit_deep, mcp__multi-agent-toolkit__ios_list_crashes, mcp__multi-agent-toolkit__agent_run_steps, mcp__multi-agent-toolkit__android_list_devices, mcp__multi-agent-toolkit__android_screenshot, mcp__multi-agent-toolkit__android_tap, mcp__multi-agent-toolkit__android_swipe, mcp__multi-agent-toolkit__android_type_text, mcp__multi-agent-toolkit__android_key_event, mcp__multi-agent-toolkit__android_launch_app, mcp__multi-agent-toolkit__android_stop_app, mcp__multi-agent-toolkit__android_list_packages, mcp__multi-agent-toolkit__android_go_home, mcp__multi-agent-toolkit__android_go_back, mcp__multi-agent-toolkit__android_get_ui_tree, mcp__multi-agent-toolkit__android_set_dark_mode, mcp__multi-agent-toolkit__android_set_font_scale, mcp__multi-agent-toolkit__android_set_locale, mcp__multi-agent-toolkit__android_set_location, mcp__multi-agent-toolkit__android_grant_permission, mcp__multi-agent-toolkit__android_revoke_permission, mcp__multi-agent-toolkit__android_record_screen, mcp__multi-agent-toolkit__android_install_apk, mcp__multi-agent-toolkit__android_uninstall_app, mcp__multi-agent-toolkit__android_logcat, mcp__multi-agent-toolkit__android_get_screen_size, mcp__multi-agent-toolkit__android_open_url, mcp__multi-agent-toolkit__android_clear_app_data, mcp__multi-agent-toolkit__android_accessibility_audit, mcp__multi-agent-toolkit__android_list_crashes
 ---
 
 # Mobile UI Bug Hunter
@@ -25,7 +25,7 @@ Auto-detects platform: iOS (simctl) or Android (adb). No external apps needed.
 For iOS: use `mcp__multi-agent-toolkit__ios_*` tools
 For Android: use `mcp__multi-agent-toolkit__android_*` tools
 
-**Android extras**: `get_ui_tree` returns XML with bounds/text/resource-id (uiautomator dump), `logcat` for crash detection, `go_back` button.
+**Android extras**: `get_ui_tree` returns XML with bounds/text/resource-id (uiautomator dump), `logcat` for live output, `list_crashes` for the crash buffer, `go_back` button.
 
 ## Activation
 
@@ -90,23 +90,34 @@ Call: ios_status_bar (time: "09:41", battery_level: 100)
 
 ### Step 3  -  Systematic Screen Exploration
 
-For each screen in the app:
+For each screen in the app, read before you look, and batch what you can:
 
 ```
-Call: ios_screenshot
--> Claude analyzes the image for bugs (see Bug Detection below)
+Call: ios_get_ui_tree            (text: labels, frames, traits; ~0.1 s, no image)
+-> pick tap targets from element frames, never by guessing pixels from a picture
+
+Call: agent_run_steps            (one round trip for a scripted sequence)
+  steps: [ {tool: "ios_tap", args: {x, y}}, {wait_ms: 400},
+           {tool: "ios_screenshot", args: {path: "<dir>/<screen>.png"}},
+           {tool: "ios_get_ui_tree", args: {}} ]
 
-Call: ios_tap (on each tab bar item, button, navigation link)
--> After each tap: ios_screenshot -> analyze
--> Navigate back: ios_swipe (left edge swipe) or tap back button coordinates
+Call: ios_screenshot             (inline, only when a visual judgment is needed)
+-> Claude analyzes the image for bugs (see Bug Detection below)
 ```
 
+Every inline `ios_screenshot` / `android_screenshot` is an 800 px JPEG (about 60 KB) by
+default; pass `format: "png"` or a larger `max_width` only when a pixel-level look is the
+point. Bulk captures (dark mode, dynamic type, locale sweeps) always go through `path`,
+so a run of 100 screens does not push 100 images through the model: look at the ones
+whose tree or diff changed. A screen whose tree is unchanged after a tap is the
+"button did not respond" finding without a second image.
+
 **Navigation strategy:**
 
-1. Screenshot initial screen -> identify tab bar (usually bottom ~680-700y area)
-2. Tap each tab position -> screenshot each
-3. On each screen: tap interactive elements -> screenshot results
-4. Scroll: `ios_swipe(200, 600, 200, 200)` to scroll down -> screenshot
+1. Tree of the initial screen -> tab bar items are the elements with a tab-bar trait or the bottom row of buttons; use their frames
+2. Tap each tab (batched via `agent_run_steps`) -> tree + file capture each
+3. On each screen: tap interactive elements from the tree -> tree after; inline screenshot only where the tree cannot tell (layout, contrast, clipping)
+4. Scroll: `ios_swipe(200, 600, 200, 200)` to scroll down -> tree, capture when new content appeared
 5. Type in text fields: `ios_type_text("test input")`
 
 ### Step 4  -  Variant Testing (based on input argument)
@@ -131,9 +142,24 @@ Call: ios_set_content_size("medium")  // reset
 
 **"accessibility":**
 
-- Check each screenshot for: small tap targets, missing labels, poor contrast
-- Verify minimum 44x44pt touch areas
-- Check text readability at default + large sizes
+Two halves per screen, and the report keeps them apart: what the tool measured and what the screenshot suggests.
+
+```
+On each screen, after ios_screenshot:
+Call: ios_accessibility_audit            (Android: android_accessibility_audit)
+-> findings[]: missing labels / contentDescription, controls a screen reader cannot
+   name, tap targets under 44pt (iOS) / 48dp (Android), missing identifiers,
+   reading order that does not follow the layout. Each finding becomes a BUG task
+   with the element identifier from the tree, not a guess from the pixels.
+-> measurable:false (with a reason) means the tree could not be read (on iOS,
+   Simulator.app itself must be running, a booted device is not enough). Record
+   the screen as "not audited: <reason>" in the report. Never read it as clean.
+-> Pass `scope: "<prefix>"` to narrow to one screen's identifiers when the tree is large.
+```
+
+The screenshot pass still runs on every screen for what the tree cannot see: poor contrast, text readability at default + large sizes, and visual crowding. Report those as screenshot findings, separately from the audit findings.
+
+Optional deep pass (iOS only, minutes rather than seconds): when the project has an XCUITest target whose test calls `performAccessibilityAudit()`, run `ios_accessibility_audit_deep` (`scheme`, `project` or `workspace`, optional `test_identifier`) once at the end. It reaches contrast, Dynamic Type, clipped text, traits and hit regions that a tree dump cannot. The result says whether the named test ran; a test that never called the audit reports as "did not run", never as clean. Skip it, and say so in the report, when no such test exists.
 
 **"screenshot <lang>":**
 
@@ -172,6 +198,17 @@ no Gate 3 and no Android parity, so the copy is gone rather than kept in sync.
 - Run light mode -> all screens
 - Run dark mode -> all screens
 - Run large text -> all screens
+- Crash sweep, after the last screen and before the report:
+
+```
+Call: ios_list_crashes (app: <process name>, since_min: <minutes since Step 1 launch>, limit: 20)
+      Android: android_list_crashes (lines: 200)
+-> Every report / stack newer than the launch becomes a BUG task with severity Critical,
+   the crashed process and the top frame in the description.
+-> Empty result -> "Crashes: none during this run" in the report. Only the bounded window
+   counts; older reports on the host are not this run's.
+```
+
 - Compile complete report
 
 ### Step 5  -  Bug Detection (on EVERY screenshot)
@@ -233,6 +270,8 @@ Then output full report:
 - Clean: {N}
 - With bugs: {N}
 - Critical: {N} | Major: {N} | Minor: {N}
+- Accessibility audit (accessibility scenario): {N} audited, {N} not audited (reason per screen), deep pass: {ran / skipped: reason}
+- Crashes (full scenario): {N} during this run
 ```
 
 Save to: `$HOME/.claude/logs/sim-test/{bundle_id}/{timestamp}.md`

package/pipeline/lib/credential-inventory.sh

@@ -46,7 +46,8 @@
 # not to enable, not a problem to report.
 #
 # Exit codes: 0 = inventory produced (or the queried key is present), 1 = queried key
-# absent, 3 = usage error.
+# absent, 2 = no credential helper on this host (nothing could be probed), 3 = usage
+# error.
 
 set -uo pipefail
 
@@ -290,11 +291,23 @@ if [ -n "$QUERY" ]; then
         echo "$QUERY: present  -  can $(capability_of "$QUERY")"
       fi
       exit 0 ;;
-    2) echo "$QUERY: no credential helper on this host" >&2; exit 1 ;;
+    2) echo "$QUERY: no credential helper on this host  -  run the pipeline installer (credential-store.sh missing)" >&2; exit 2 ;;
     *) echo "$QUERY: NOT AVAILABLE  -  onboard it via /multi-agent:setup before relying on it" >&2; exit 1 ;;
   esac
 fi
 
+# Without a helper nothing can be probed: every mapped key would read as
+# "mapped-but-missing" and the inventory would send the user to re-onboard
+# tokens that are sitting in the store.
+if [ -z "$STORE" ]; then
+  if [ "$MODE" = "json" ]; then
+    echo '{"status":"no-backend","reason":"credential-store.sh not found on this host","credentials":[]}'
+  else
+    echo "no credential helper on this host  -  run the pipeline installer (credential-store.sh missing)" >&2
+  fi
+  exit 2
+fi
+
 ROWS=""
 while IFS=$'\t' read -r key mapped; do
   [ -z "$key" ] && continue

package/pipeline/lib/credential-store-resolver.sh

@@ -81,12 +81,22 @@ MSG
   return 1
 }
 
-# When sourced (BASH_SOURCE != $0), auto-resolve into the caller's environment.
-# When run directly (./credential-store-resolver.sh), print the resolved path
-# or a non-zero exit code with the message above.
-if [ "${BASH_SOURCE[0]:-$0}" = "${0}" ]; then
+# When sourced, auto-resolve into the caller's environment. When run directly
+# (./credential-store-resolver.sh), print the resolved path or a non-zero exit
+# code with the message above. zsh sources this too (the pipeline's Bash tool
+# is zsh), where BASH_SOURCE is unset and $0 is the sourced file's own name, so
+# the bash test alone always looked like a direct run there.
+_csr_sourced=0
+if [ -n "${ZSH_VERSION:-}" ]; then
+  case "${ZSH_EVAL_CONTEXT:-}" in *:file|*:file:*) _csr_sourced=1 ;; esac
+elif [ -n "${BASH_SOURCE[0]:-}" ] && [ "${BASH_SOURCE[0]}" != "$0" ]; then
+  _csr_sourced=1
+fi
+if [ "$_csr_sourced" -eq 0 ]; then
+  unset _csr_sourced
   resolve_credential_store && echo "$CRED_STORE"
 else
+  unset _csr_sourced
   # `|| :` matters, and it is not cosmetic.
   #
   # A sourced file runs in the caller's shell, so a bare failing command at this top

package/pipeline/lib/credential-store.sh

@@ -164,6 +164,10 @@ do_get() {
       return 0
     fi
     audit_lookup "$logical" false
+    case "$rc" in
+      2) echo "ERR: credential backend unavailable on $PLATFORM" >&2; return 2 ;;
+      4) echo "ERR: credential backend error while reading '$logical'" >&2; return 4 ;;
+    esac
     return 1
   fi
   local val=""
@@ -204,8 +208,10 @@ do_set() {
   if [ "$val" = "-" ]; then
     val=$(cat)
   fi
-  if delegate_to_python; then
-    # Pass the value via stdin to keep it out of process listings / shell history.
+  # macOS writes go through `security -i` below: the secret travels on stdin
+  # and never lands on any argv, which is the property the delegate cannot
+  # promise from here.
+  if [ "$PLATFORM" != "macos" ] && delegate_to_python; then
     printf '%s' "$val" | python3 "$KEYCHAIN_PY" set "$key" -
     return $?
   fi

package/pipeline/lib/extract-conventions.sh

@@ -2,7 +2,7 @@
 # extract-conventions.sh
 #
 # Phase 1c helper for /multi-agent:analysis.
-# Scans a repo and emits 12 convention buckets as a single JSON object on stdout.
+# Scans a repo and emits 13 convention buckets as a single JSON object on stdout.
 #
 # Usage:
 #   extract-conventions.sh <repo-path> <platform>
@@ -202,19 +202,6 @@ files_to_json() {
   printf '%s\n' "$input" | head -5 | jq -R . | jq -s .
 }
 
-# Top-N suffix frequency from a stream of file basenames.
-# stdin: basenames (one per line)
-# arg1: regex (POSIX ERE) capturing the suffix in group 1
-# stdout: lines "count<TAB>suffix" sorted desc
-suffix_freq() {
-  local re="$1"
-  grep -Eo "$re" 2>/dev/null \
-    | sort \
-    | uniq -c \
-    | sort -rn \
-    | sed -E 's/^ *([0-9]+) +/\1\t/'
-}
-
 # Run a bucket function with a soft timeout. We wrap the function in a subshell
 # and use a watchdog so we stay compatible with macOS bash 3.2.
 run_bucket_with_timeout() {

package/pipeline/lib/fetch-confluence.sh

@@ -48,10 +48,12 @@ HOST_OVERRIDE="${CONFLUENCE_HOST_OVERRIDE:-}"
 PAGE_ID=""
 TIMEOUT="${CONFLUENCE_TIMEOUT_SECONDS:-20}"
 
+need_value() { [ $# -ge 2 ] || { echo "ERR: $1 needs a value" >&2; exit 4; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --host)    HOST_OVERRIDE="$2"; shift 2 ;;
-    --page-id) PAGE_ID="$2"; shift 2 ;;
+    --host)    need_value "$@"; HOST_OVERRIDE="$2"; shift 2 ;;
+    --page-id) need_value "$@"; PAGE_ID="$2"; shift 2 ;;
     -h|--help)
       echo "usage: $0 <page-url> | $0 --host <host> --page-id <id>" >&2
       exit 4 ;;
@@ -220,11 +222,17 @@ PAGE_ID_FINAL="$PAGE_ID_RESOLVED" \
 SPACE_KEY_FINAL="$SPACE_KEY" \
 PAGE_JSON_RAW="$PAGE_JSON" \
 python3 - <<'PY'
-import json, os, re, datetime, html
+import json, os, re, sys, datetime, html
 from html.parser import HTMLParser
 
 raw = os.environ["PAGE_JSON_RAW"]
-data = json.loads(raw)
+try:
+    data = json.loads(raw)
+except ValueError:
+    # A 200 with an HTML body is an SSO login page or a proxy, not the page.
+    sys.stderr.write("ERR: Confluence GET for pageId=%s returned a non-JSON body (login page or proxy?)\n"
+                     % os.environ.get("PAGE_ID_FINAL", ""))
+    sys.exit(3)
 
 storage = ((data.get("body") or {}).get("storage") or {}).get("value") or ""
 title = data.get("title") or "<untitled>"

package/pipeline/lib/fetch-crashlytics.sh

@@ -67,13 +67,15 @@ ISSUE_ID=""
 SESSION_ID=""
 TIMEOUT="${FIREBASE_TIMEOUT_SECONDS:-20}"
 
+need_value() { [ $# -ge 2 ] || { echo "ERR: $1 needs a value" >&2; exit 4; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --project)    PROJECT_ID="$2"; shift 2 ;;
-    --platform)   PLATFORM="$2";   shift 2 ;;
-    --bundle)     BUNDLE="$2";     shift 2 ;;
-    --issue-id)   ISSUE_ID="$2";   shift 2 ;;
-    --session-id) SESSION_ID="$2"; shift 2 ;;
+    --project)    need_value "$@"; PROJECT_ID="$2"; shift 2 ;;
+    --platform)   need_value "$@"; PLATFORM="$2";   shift 2 ;;
+    --bundle)     need_value "$@"; BUNDLE="$2";     shift 2 ;;
+    --issue-id)   need_value "$@"; ISSUE_ID="$2";   shift 2 ;;
+    --session-id) need_value "$@"; SESSION_ID="$2"; shift 2 ;;
     -h|--help)
       echo "usage: $0 <issue-url> | $0 --project ... --platform ... --bundle ... --issue-id ... [--session-id ...]" >&2
       exit 4 ;;
@@ -234,6 +236,7 @@ fi
 #   1. Build header + claim, base64url
 #   2. Sign with the SA private key
 #   3. POST to oauth2.googleapis.com/token
+TOKEN_RC=0
 ACCESS_TOKEN=$(SA_JSON_IN="$SA_JSON" python3 - <<'PY'
 import base64, json, os, sys, time, urllib.parse, urllib.request
 
@@ -302,10 +305,10 @@ except Exception as e:
     print("", file=sys.stderr)
     sys.exit(2)
 PY
-)
+) || TOKEN_RC=$?
 
-if [ -z "$ACCESS_TOKEN" ]; then
-  echo "ERR: Firebase token exchange failed" >&2
+if [ "$TOKEN_RC" -ne 0 ] || [ -z "$ACCESS_TOKEN" ]; then
+  echo "ERR: Firebase token exchange failed (exchange rc=$TOKEN_RC)" >&2
   exit 3
 fi
 

package/pipeline/lib/fetch-document.sh

@@ -31,7 +31,7 @@
 #   }
 #
 # Exit codes:
-#   0  success (may be degraded-empty for a pdf with no converter)
+#   0  success
 #   3  download or read failure
 #   4  bad usage / unsupported extension
 #   6  converter not available (pdf only; the orchestrator treats this as

package/pipeline/lib/fetch-figma-annotations.sh

@@ -89,13 +89,15 @@ BATCH=4
 log() { printf '%s\n' "$*" >&2; }
 die() { local code="$1"; shift; log "fetch-figma-annotations: $*"; exit "$code"; }
 
+need_value() { [ $# -ge 2 ] || die 1 "$1 requires a value"; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --file-key) FILE_KEY="${2:-}"; shift 2 ;;
-    --node-id) NODE_IDS="${2:-}"; shift 2 ;;
-    --url) URL="${2:-}"; shift 2 ;;
-    --lang-prefixes) LANG_PREFIXES="${2:-TR,EN}"; shift 2 ;;
-    --batch) BATCH="${2:-4}"; shift 2 ;;
+    --file-key) need_value "$@"; FILE_KEY="$2"; shift 2 ;;
+    --node-id) need_value "$@"; NODE_IDS="$2"; shift 2 ;;
+    --url) need_value "$@"; URL="$2"; shift 2 ;;
+    --lang-prefixes) need_value "$@"; LANG_PREFIXES="${2:-TR,EN}"; shift 2 ;;
+    --batch) need_value "$@"; BATCH="${2:-4}"; shift 2 ;;
     -h|--help) grep -E '^#( |$)' "$0" | sed -E 's/^# ?//'; exit 0 ;;
     *) die 1 "unknown argument: $1" ;;
   esac

package/pipeline/lib/fetch-fortify.sh

@@ -62,11 +62,13 @@ ISSUE_ID=""
 TIMEOUT="${FORTIFY_TIMEOUT_SECONDS:-25}"
 AUTH_SCHEME="${FORTIFY_AUTH_SCHEME:-auto}"
 
+need_value() { [ $# -ge 2 ] || { echo "ERR: $1 needs a value" >&2; exit 4; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --version-id) VERSION_ID="$2"; shift 2 ;;
-    --issue)      ISSUE_ID="$2";   shift 2 ;;
-    --instance-id) ISSUE_ID="$2";  shift 2 ;;
+    --version-id) need_value "$@"; VERSION_ID="$2"; shift 2 ;;
+    --issue)      need_value "$@"; ISSUE_ID="$2";   shift 2 ;;
+    --instance-id) need_value "$@"; ISSUE_ID="$2";  shift 2 ;;
     -h|--help)
       echo "usage: $0 <ssc-url> | $0 --version-id <id> [--issue <id>] | $0 --instance-id <id>" >&2
       exit 4 ;;

package/pipeline/lib/fetch-graylog.sh

@@ -73,11 +73,13 @@ TIMEOUT="${GRAYLOG_TIMEOUT_SECONDS:-25}"
 RANGE="${GRAYLOG_RANGE_SECONDS:-86400}"
 LIMIT="${GRAYLOG_LIMIT:-200}"
 
+need_value() { [ $# -ge 2 ] || { echo "ERR: $1 needs a value" >&2; exit 4; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --trx)  TRX_ID="$2";  shift 2 ;;
-    --conv) CONV_ID="$2"; shift 2 ;;
-    --env)  ENVIRONMENT="$2"; shift 2 ;;
+    --trx)  need_value "$@"; TRX_ID="$2";  shift 2 ;;
+    --conv) need_value "$@"; CONV_ID="$2"; shift 2 ;;
+    --env)  need_value "$@"; ENVIRONMENT="$2"; shift 2 ;;
     -h|--help)
       echo "usage: $0 --trx <transaction-id> | --conv <conversation-id> [--env auto|prod|test]" >&2
       exit 4 ;;

package/pipeline/lib/figma-mcp-refresh.sh

@@ -85,7 +85,7 @@ refresh_grant_cfg() {
 
 RESPONSE=$(curl -s --max-time 20 -X POST "$TOKEN_ENDPOINT" \
   -H "Content-Type: application/x-www-form-urlencoded" \
-  -K <(refresh_grant_cfg))
+  -K <(refresh_grant_cfg)) || RESPONSE=""
 
 NEW_ACCESS=$(printf '%s' "$RESPONSE" | jq -r '.access_token // empty' 2>/dev/null || true)
 NEW_REFRESH=$(printf '%s' "$RESPONSE" | jq -r '.refresh_token // empty' 2>/dev/null || true)