@mmerterden/multi-agent-pipeline 16.18.0 → 16.19.0

package/pipeline/scripts/build-skills-index.mjs

@@ -57,11 +57,22 @@ function parseFrontmatter(raw) {
   if (end < 0) return {};
   const body = raw.slice(3, end).trim();
   const out = {};
-  for (const line of body.split("\n")) {
-    const m = line.match(/^([\w-]+):\s*(.*)$/);
+  const lines = body.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^([\w-]+):\s*(.*)$/);
     if (!m) continue;
     let value = m[2].trim();
-    if (value.startsWith('"') && value.endsWith('"')) value = value.slice(1, -1);
+    if (/^[|>][+-]?$/.test(value)) {
+      // YAML block scalar: the text is the indented lines that follow, and the
+      // indicator itself is not a description.
+      const parts = [];
+      while (i + 1 < lines.length && (/^\s/.test(lines[i + 1]) || lines[i + 1].trim() === "")) {
+        parts.push(lines[++i].trim());
+      }
+      value = parts.join(" ").replace(/\s+/g, " ").trim();
+    } else if (value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1);
+    }
     out[m[1]] = value;
   }
   return out;

package/pipeline/scripts/cost-budget-check.mjs

@@ -13,12 +13,14 @@
  * coding tool; this turns "will this burn my tokens?" into a visible number.
  *
  * Inputs (CLI overrides prefs):
- *   --task-id <id>        Locate .worktrees/<id>/phase-tracker.json
+ *   --task-id <id>        Locate $HOME/.claude/logs/multi-agent/<id>/tracker-state.json
+ *                         (also tried: <id> without a leading #, task-<id>)
  *   --tracker  <path>     Explicit tracker JSON (skips lookup)
  *   --prefs    <path>     Preferences JSON; reads .global.costBudget
  *   --max-usd  <n>        Hard ceiling (USD)
  *   --warn-pct <n>        Warn threshold as percent of max-usd (1..99)
- *   --pricing-model <m>   opus | sonnet | haiku  (rate to price tokens at)
+ *   --pricing-model <m>   fable | opus | sonnet | haiku (any key under cost-table.json
+ *                         prices; default fable, the most expensive tier)
  *   --enabled             Force-enable even if prefs say otherwise
  *
  * Output: one human-readable status line on stdout.
@@ -62,7 +64,7 @@ for (let i = 0; i < argv.length; i++) {
 if (flags.help || flags.h) {
   process.stdout.write(
     "Usage: cost-budget-check.mjs [--task-id <id> | --tracker <path>] [--prefs <path>]\n" +
-      "       [--max-usd <n>] [--warn-pct <n>] [--pricing-model opus|sonnet|haiku] [--enabled]\n",
+      "       [--max-usd <n>] [--warn-pct <n>] [--pricing-model fable|opus|sonnet|haiku] [--enabled]\n",
   );
   process.exit(0);
 }

package/pipeline/scripts/cost-lib.sh

@@ -15,9 +15,6 @@
 #        absent). Returns null when $rate is null.
 #   cost_floor_cents($u)
 #     -> floor USD to whole cents; null passes through.
-#
-# cost_usd <rate-json> <tin> <tout> [tcached]  -  scalar convenience wrapper
-# that prints the raw (unrounded) USD via jq. Prints nothing when jq is absent.
 
 COST_JQ_DEFS='
   def cost_usd_of($rate; $tin; $tout; $tcached):
@@ -29,15 +26,3 @@ COST_JQ_DEFS='
   def cost_floor_cents($u):
     if $u == null then null else (($u * 100) | floor) / 100 end;
 '
-
-cost_usd() {
-  local rate="$1" tin="$2" tout="$3" tcached="${4:-0}"
-  command -v jq >/dev/null 2>&1 || return 0
-  jq -n \
-    --argjson rate "$rate" \
-    --argjson tin "$tin" \
-    --argjson tout "$tout" \
-    --argjson tcached "$tcached" \
-    "$COST_JQ_DEFS"'
-    cost_usd_of($rate; $tin; $tout; $tcached)'
-}

package/pipeline/scripts/diff-explain.mjs

@@ -11,7 +11,7 @@
  *
  * Inputs (any one):
  *   --triage <path>     Path to triage-output.json
- *   --task-id <#N|JIRA> Resolve via $HOME/.claude/logs/multi-agent/<project>/<id>/
+ *   --task-id <#N|JIRA> Resolve $HOME/.claude/logs/multi-agent/<id>/agent-state.json
  *   --state <path>      Path to agent-state.json with embedded triage
  *
  * Diff source:
@@ -31,6 +31,8 @@
  */
 
 import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
 import { execFileSync } from "child_process";
 
 const argv = process.argv.slice(2);
@@ -55,7 +57,7 @@ if (flags.help || flags.h) {
 Inputs (one required):
   --triage <path>     Path to triage-output.json
   --state  <path>     agent-state.json with embedded triage
-  --task-id <id>      Look up by task ID
+  --task-id <id>      Look up $HOME/.claude/logs/multi-agent/<id>/agent-state.json
 
 Diff source:
   --branch <name>     Branch to diff (default: current)
@@ -68,24 +70,32 @@ Output:
   process.exit(0);
 }
 
+function resolveStateByTaskId(id) {
+  const bare = String(id).replace(/^#/, "");
+  const logRoot = join(homedir(), ".claude", "logs", "multi-agent");
+  const candidates = [...new Set([String(id), bare, `task-${bare}`])].map((d) =>
+    join(logRoot, d, "agent-state.json"),
+  );
+  const found = candidates.find((p) => existsSync(p));
+  if (!found)
+    die(`no agent-state.json for task ${id} under ${logRoot} (tried ${candidates.join(", ")})`);
+  return found;
+}
+
 function loadTriage() {
   if (flags.triage) {
     if (!existsSync(flags.triage)) die(`triage file not found: ${flags.triage}`);
     return JSON.parse(readFileSync(flags.triage, "utf-8"));
   }
-  if (flags.state) {
-    if (!existsSync(flags.state)) die(`state file not found: ${flags.state}`);
-    const state = JSON.parse(readFileSync(flags.state, "utf-8"));
+  const statePath =
+    flags.state || (flags["task-id"] ? resolveStateByTaskId(flags["task-id"]) : null);
+  if (statePath) {
+    if (!existsSync(statePath)) die(`state file not found: ${statePath}`);
+    const state = JSON.parse(readFileSync(statePath, "utf-8"));
     const triage = state?.phases?.["4"]?.triage ?? state?.triage;
-    if (!triage) die(`no triage block found in ${flags.state}`);
+    if (!triage) die(`no triage block found in ${statePath}`);
     return triage;
   }
-  if (flags["task-id"]) {
-    die(
-      "--task-id resolution not implemented in this script  -  use --triage or --state directly. " +
-        "The slash command resolves task IDs via the orchestrator and passes --state to this script.",
-    );
-  }
   die("one of --triage, --state, or --task-id is required");
 }
 

package/pipeline/scripts/gc-refs.sh

@@ -111,8 +111,11 @@ if [ -z "$REFS_DIRS" ]; then
 fi
 
 # Match the node-id shape offload-ref.sh writes (p<phase>-<slug>-<8 hex>.md).
-# Anything else in that directory belongs to someone else.
-NODE_GLOB='p*-*-*.md'
+# Anything else in that directory belongs to someone else. The glob is a cheap
+# pre-filter for find; the regex is the actual shape (a plain `p*-*-*.md`
+# also matched pr-body-final.md).
+NODE_GLOB='p[0-9]*-*-????????.md'
+NODE_RE='^p[0-9][0-9a-z.]*-[a-z0-9-]+-[0-9a-f]{8}\.md$'
 
 MATCHES=""
 while IFS= read -r dir; do
@@ -128,6 +131,7 @@ while IFS= read -r dir; do
   [ -n "$found" ] || continue
   while IFS= read -r f; do
     [ -n "$f" ] || continue
+    printf '%s\n' "$(basename "$f")" | grep -Eq "$NODE_RE" || continue
     # Grace: skip anything touched inside the window.
     if [ "$GRACE_MIN" -gt 0 ] && [ -n "$(find "$f" -mmin -"$GRACE_MIN" 2>/dev/null)" ]; then
       continue

package/pipeline/scripts/gc-tmp.sh

@@ -110,7 +110,7 @@ while IFS= read -r -d '' p; do
   # Fresh-scratch grace: spare items an in-flight run touched recently
   # (checks the item and, for dirs, anything inside it).
   if [ "$GRACE_MIN" -gt 0 ] &&
-    find "$p" -mmin "-$GRACE_MIN" -print 2>/dev/null | head -1 | grep -q .; then
+    [ -n "$(find "$p" -mmin "-$GRACE_MIN" -print -quit 2>/dev/null)" ]; then
     skipped_active=$((skipped_active + 1))
     continue
   fi

package/pipeline/scripts/gc-worktrees.sh

@@ -108,7 +108,7 @@ EOF
     if printf '%s\n' "$registered" | grep -qxF "$dir"; then
       continue  # healthy registered worktree - kill/finish territory
     fi
-    if [ "$OLDER_MIN" -gt 0 ] && find "$dir" -type f -mmin "-$OLDER_MIN" 2>/dev/null | head -1 | grep -q .; then
+    if [ "$OLDER_MIN" -gt 0 ] && [ -n "$(find "$dir" -type f -mmin "-$OLDER_MIN" -print -quit 2>/dev/null)" ]; then
       continue  # recently touched - spare it
     fi
     orphans+=("$dir")

package/pipeline/scripts/gen-mode-dispatch.mjs

@@ -32,7 +32,7 @@ const args = Object.fromEntries(
   }),
 );
 
-const MODE = args.mode ?? "dev";
+const MODE = args.mode;
 
 const PHASE_NAMES = [
   "0:Init",
@@ -74,9 +74,9 @@ const MODES = {
   },
 };
 
-const spec = MODES[MODE];
+const spec = MODE ? MODES[MODE] : null;
 if (!spec) {
-  console.error(`unknown mode: ${MODE}`);
+  console.error(MODE ? `unknown mode: ${MODE}` : "usage: gen-mode-dispatch.mjs --mode=<mode>");
   console.error(`accepted: ${Object.keys(MODES).join(", ")}`);
   process.exit(2);
 }

package/pipeline/scripts/github-ssh-setup.sh

@@ -44,8 +44,13 @@ echo "SSH key başarıyla oluşturuldu!"
 # SSH agent'a ekle
 eval "$(ssh-agent -s)" > /dev/null 2>&1
 
-# macOS Keychain entegrasyonu için SSH config ayarla
+# SSH config ayarla (UseKeychain yalnızca macOS'ta geçerli bir seçenek;
+# Linux'ta ssh bilinmeyen seçenek diye config'i reddeder)
 SSH_CONFIG="$HOME/.ssh/config"
+USE_KEYCHAIN_LINE=""
+if [ "$(uname -s 2>/dev/null)" = "Darwin" ]; then
+    USE_KEYCHAIN_LINE="    UseKeychain yes"
+fi
 if ! grep -q "github.com" "$SSH_CONFIG" 2>/dev/null; then
     cat >> "$SSH_CONFIG" <<EOF
 
@@ -54,7 +59,7 @@ Host github.com
     User git
     IdentityFile $KEY_PATH
     AddKeysToAgent yes
-    UseKeychain yes
+${USE_KEYCHAIN_LINE}
 EOF
     chmod 600 "$SSH_CONFIG"
     echo "SSH config güncellendi."

package/pipeline/scripts/graph-build.mjs

@@ -12,7 +12,7 @@
  *
  * Inputs:
  *   --root <path>    Repo root. Default: cwd
- *   --stack <id>     ios | android | node | python. Required.
+ *   --stack <id>     ios | android | node | python | go. Required.
  *   --out <path>     Graph output. Default: ~/.claude/knowledge/<project>/code-graph.json
  *   --max-nodes N    Refuse to write a graph larger than this. Default: 200000.
  *                    Callers pass prefs.global.codeGraph.maxNodes. A tree that
@@ -88,7 +88,7 @@ function main() {
   const { flags } = parseFlags(process.argv.slice(2));
   const stack = flags.stack;
   if (!stack || stack === true) {
-    process.stderr.write("graph-build: --stack <ios|android|node|python> required\n");
+    process.stderr.write("graph-build: --stack <ios|android|node|python|go> required\n");
     process.exit(64);
   }
 

package/pipeline/scripts/jira-wiki-escape.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { readFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
 
 const SEQUENCES = [
   ":)",
@@ -77,7 +78,7 @@ async function readStdin() {
   return Buffer.concat(chunks).toString("utf8");
 }
 
-const isMain = process.argv[1] && import.meta.url === `file://${process.argv[1]}`;
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
 if (isMain) {
   const args = process.argv.slice(2);
   const check = args.includes("--check");

package/pipeline/scripts/keychain.py

@@ -51,7 +51,8 @@ Behaviour
 - Windows / unknown platforms: backend unavailable; `doctor` prints remediation.
 - Never logs the secret value. `set` accepts the value via argv (CLI) or via
   stdin when the value is exactly `-` (preferred for scripts to avoid shell
-  history leak).
+  history leak). On macOS the write goes through `security -i` with the
+  command on stdin, so the value never appears on a child process argv.
 - get returns the raw value to stdout with no trailing newline manipulation
   beyond stripping the OS-level final \\n that `security -w` appends.
 
@@ -166,17 +167,17 @@ def set_(label: str, value: str, account: Optional[str] = None) -> None:
     pf = _ensure_backend()
     acct = _account_default(account)
     if pf == "macos":
-        rc, _, err = _run(
-            [
-                "/usr/bin/security",
-                "add-generic-password",
-                "-a", acct,
-                "-l", label,
-                "-s", label,
-                "-w", value,
-                "-U",
-            ]
+        # `security -i` reads the add command from stdin, so the secret never
+        # lands on the security argv (visible to ps). Backslashes and double
+        # quotes are escaped for security's interactive tokenizer.
+        def quote(text: str) -> str:
+            return text.replace("\\", "\\\\").replace('"', '\\"')
+
+        command = (
+            f'add-generic-password -U -a "{quote(acct)}" -l "{quote(label)}" '
+            f'-s "{quote(label)}" -w "{quote(value)}"\n'
         )
+        rc, _, err = _run(["/usr/bin/security", "-i"], input_value=command.encode("utf-8"))
         if rc != 0:
             sys.stderr.write(err.decode("utf-8", errors="replace"))
             sys.exit(4)

package/pipeline/scripts/learning-curve.mjs

@@ -141,7 +141,7 @@ const buckets = [...byBucket.keys()].sort().map((start) => {
       : null,
     reworkPerTask: round(list.reduce((s, t) => s + t.rework, 0) / n),
     tokensPerTask: Math.round((totIn + totOut) / n),
-    cacheRatio: totIn ? round(totCached / totIn) : null,
+    cacheRatio: totIn + totCached ? round(totCached / (totIn + totCached)) : null,
     memoryPrecision: totInjected ? round(totUsed / totInjected) : null,
   };
 });

package/pipeline/scripts/migrate-prefs.mjs

@@ -248,7 +248,7 @@ function migrate(prefs) {
     changes.push("initialized empty identities array");
   }
 
-  // 4. keychainMapping  -  expand to 12 services
+  // 4. keychainMapping  -  add every default service the file does not name yet
   const km = out.global.keychainMapping || {};
   const kmDefaults = defaultKeychainMapping();
   let kmChanged = false;

package/pipeline/scripts/output-quality-check.sh

@@ -23,7 +23,9 @@ TASK=""
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --strict) STRICT=true; shift ;;
-    --task)   TASK="$2"; shift 2 ;;
+    --task)
+      [ "$#" -ge 2 ] || { echo "output-quality-check: --task needs a value" >&2; exit 1; }
+      TASK="$2"; shift 2 ;;
     *) shift ;;
   esac
 done

package/pipeline/scripts/phase-tracker.sh

@@ -265,7 +265,7 @@ emit_otel_span() {
   local event="${1:-unknown}"
   local phase_id="${2:-?}"
   local subject="${3:-}"
-  local extra_attrs="${4:-{\}}"
+  local extra_attrs="${4:-"{}"}"
   local task_id
   task_id=$(basename "$TRACKER_DIR")
   local now_ns

package/pipeline/scripts/phase0-exit-gate.mjs

@@ -36,6 +36,7 @@
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
+import { pathToFileURL } from "url";
 
 const FIGMA_URL = /figma\.com\/(design|make|file)\//i;
 
@@ -233,6 +234,6 @@ function main(argv) {
   return result.ok ? 0 : 1;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   process.exit(main(process.argv));
 }

package/pipeline/scripts/plan-coverage-gate.mjs

@@ -31,6 +31,7 @@
 
 import { readFileSync, existsSync } from "node:fs";
 import { join, isAbsolute } from "node:path";
+import { pathToFileURL } from "node:url";
 
 export function auditTodos(todos) {
   const gaps = [];
@@ -89,7 +90,7 @@ function readJson(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 
-const isMain = process.argv[1] && import.meta.url === `file://${process.argv[1]}`;
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
 if (isMain) {
   const args = process.argv.slice(2);
   const flag = (name) => {

package/pipeline/scripts/pre-commit-check.sh

@@ -1,7 +1,9 @@
 #!/bin/bash
 # Pre-commit secret detection for multi-agent pipeline
 # Scans staged git changes for accidentally committed secrets
-# Exit 0 = clean, Exit 1 = secrets found (blocks commit)
+# Exit 0 = clean, Exit 2 = secrets found. The PreToolUse hook contract
+# (install/templates/claude-hooks.json, agent-guard.sh) blocks the tool call
+# only on exit 2, with the reason on stderr.
 
 set -uo pipefail
 
@@ -56,6 +58,14 @@ process.stdin.on("end", () => {
   fi
 fi
 
+# Staged paths from `git diff --cached --name-only` are repo-root-relative, so
+# the `-f` tests below only see them from the repo root. Hooks fire with the
+# caller's cwd, which is often a subdirectory.
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [ -n "$REPO_ROOT" ]; then
+  cd "$REPO_ROOT" || exit 0
+fi
+
 FOUND=0
 
 # `file "$f" | grep -q "binary"` never matches real `file` output (it names a
@@ -74,14 +84,14 @@ scan_file() {
 
   # .env files
   if echo "$file" | grep -qE '\.env($|\.)'; then
-    echo "BLOCKED: .env file staged: $file"
+    echo "BLOCKED: .env file staged: $file" >&2
     FOUND=1
     return 0
   fi
 
   # Credentials files
   if echo "$file" | grep -qiE '(credentials|secrets|tokens)\.(json|yaml|yml|plist)$'; then
-    echo "BLOCKED: Credentials file staged: $file"
+    echo "BLOCKED: Credentials file staged: $file" >&2
     FOUND=1
     return 0
   fi
@@ -90,37 +100,37 @@ scan_file() {
 
   # API keys / tokens (key = "long_string" pattern)
   if echo "$content" | grep -qiE '(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[:=]\s*["'"'"'][A-Za-z0-9+/=_-]{20,}'; then
-    echo "BLOCKED: Possible API key/token in $file"
+    echo "BLOCKED: Possible API key/token in $file" >&2
     FOUND=1
   fi
 
   # AWS access keys
   if echo "$content" | grep -qE 'AKIA[0-9A-Z]{16}'; then
-    echo "BLOCKED: AWS access key in $file"
+    echo "BLOCKED: AWS access key in $file" >&2
     FOUND=1
   fi
 
   # Private keys
   if echo "$content" | grep -qE 'BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY'; then
-    echo "BLOCKED: Private key in $file"
+    echo "BLOCKED: Private key in $file" >&2
     FOUND=1
   fi
 
   # Firebase/GCP service account JSON
   if echo "$content" | grep -qE '"type"\s*:\s*"service_account"'; then
-    echo "BLOCKED: Service account JSON in $file"
+    echo "BLOCKED: Service account JSON in $file" >&2
     FOUND=1
   fi
 
   # High-signal provider token prefixes (low false-positive rate)
   if echo "$content" | grep -qE '(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,}|xox[baprs]-[A-Za-z0-9-]{12,}|sk_live_[A-Za-z0-9]{20,}|rk_live_[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|npm_[A-Za-z0-9]{36}|glpat-[A-Za-z0-9_-]{20,}'; then
-    echo "BLOCKED: Provider access token in $file"
+    echo "BLOCKED: Provider access token in $file" >&2
     FOUND=1
   fi
 
   # JWT (three base64url segments  -  header.payload.signature)
   if echo "$content" | grep -qE 'eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'; then
-    echo "BLOCKED: JWT in $file"
+    echo "BLOCKED: JWT in $file" >&2
     FOUND=1
   fi
 
@@ -191,7 +201,7 @@ scan_file() {
           if (H >= 4.2) { print s; exit }
         }')
       if [ -n "$entropy_hit" ]; then
-        echo "BLOCKED: High-entropy string (possible secret) in $file"
+        echo "BLOCKED: High-entropy string (possible secret) in $file" >&2
         FOUND=1
       fi
     fi
@@ -234,9 +244,9 @@ if [ "$SCAN_UNSTAGED" = "1" ]; then
 fi
 
 if [ $FOUND -eq 1 ]; then
-  echo ""
-  echo "Secret check failed. Remove secrets from staged files before committing."
-  exit 1
+  echo "" >&2
+  echo "Secret check failed. Remove secrets from staged files before committing." >&2
+  exit 2
 fi
 
 exit 0

package/pipeline/scripts/prune-logs.sh

@@ -151,7 +151,7 @@ while IFS= read -r -d '' d; do
   # so a concurrent run keeps a resumable log dir. --task is an explicit,
   # deliberate target and bypasses the grace.
   if [ "$GRACE_MIN" -gt 0 ] && [ -z "$TASK" ] &&
-    find "$d" -mmin "-$GRACE_MIN" -print 2>/dev/null | head -1 | grep -q .; then
+    [ -n "$(find "$d" -mmin "-$GRACE_MIN" -print -quit 2>/dev/null)" ]; then
     skipped_active=$((skipped_active + 1))
     continue
   fi

package/pipeline/scripts/render-agent-log-cost.sh

@@ -25,7 +25,9 @@ shift || true
 SPANS_FILE=""
 while [ $# -gt 0 ]; do
   case "$1" in
-    --otel-spans) SPANS_FILE="${2:-}"; shift 2 ;;
+    --otel-spans)
+      [ $# -ge 2 ] || { echo "render-agent-log-cost: --otel-spans needs a path" >&2; exit 1; }
+      SPANS_FILE="$2"; shift 2 ;;
     *) shift ;;
   esac
 done

package/pipeline/scripts/render-cost-summary.sh

@@ -19,7 +19,9 @@ shift || true
 SPANS_FILE=""
 while [ $# -gt 0 ]; do
   case "$1" in
-    --otel-spans) SPANS_FILE="${2:-}"; shift 2 ;;
+    --otel-spans)
+      [ $# -ge 2 ] || { echo "render-cost-summary: --otel-spans needs a path" >&2; exit 1; }
+      SPANS_FILE="$2"; shift 2 ;;
     *) shift ;;
   esac
 done
@@ -71,7 +73,7 @@ if [ -n "$tracker_file" ]; then
       (.phases // {} | to_entries)
     end)
     | [ .[] |
-        select(.value.tokens_in // 0 > 0 or .value.tokens_out // 0 > 0) |
+        select(((.value.tokens_in // 0) > 0) or ((.value.tokens_out // 0) > 0)) |
         {
           phase: .key,
           phase_name: (.value.name // .key),

package/pipeline/scripts/render-work-summary.sh

@@ -44,11 +44,13 @@ TASK_ID="${1:?usage: render-work-summary.sh <task-id>}"
 shift || true
 
 WORKTREE=""; BRANCH=""; BASE=""
+need_value() { [ $# -ge 2 ] || { echo "render-work-summary: $1 needs a value" >&2; exit 1; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --worktree)    WORKTREE="$2"; shift 2 ;;
-    --branch)      BRANCH="$2"; shift 2 ;;
-    --base-branch) BASE="$2"; shift 2 ;;
+    --worktree)    need_value "$@"; WORKTREE="$2"; shift 2 ;;
+    --branch)      need_value "$@"; BRANCH="$2"; shift 2 ;;
+    --base-branch) need_value "$@"; BASE="$2"; shift 2 ;;
     *) shift ;;
   esac
 done

package/pipeline/scripts/repo-map.mjs

@@ -30,6 +30,7 @@ import { promises as fs } from "node:fs";
 import { existsSync, statSync } from "node:fs";
 import path from "node:path";
 import process from "node:process";
+import { matchesGlob } from "./_path-match.mjs";
 
 // ---- CLI args --------------------------------------------------------------
 
@@ -142,8 +143,8 @@ async function walk(root, args) {
           continue;
         }
         const rel = path.relative(root, full);
-        if (args.include && !args.include.some((g) => rel.includes(g))) continue;
-        if (args.exclude && args.exclude.some((g) => rel.includes(g))) continue;
+        if (args.include && !args.include.some((g) => matchesGlob(rel, g))) continue;
+        if (args.exclude && args.exclude.some((g) => matchesGlob(rel, g))) continue;
         out.push({ path: rel, lang: LANG_EXT[ext], abs: full });
       }
     }

package/pipeline/scripts/scan-skills.sh

@@ -34,10 +34,14 @@ THRESHOLD="medium"
 
 while [ $# -gt 0 ]; do
   case "$1" in
-    --root) ROOT="$2"; shift 2 ;;
+    --root)
+      [ $# -ge 2 ] || { echo "scan-skills: --root needs a value" >&2; exit 64; }
+      ROOT="$2"; shift 2 ;;
     --strict) STRICT=1; shift ;;
     --json) JSON=1; shift ;;
-    --threshold) THRESHOLD="$2"; shift 2 ;;
+    --threshold)
+      [ $# -ge 2 ] || { echo "scan-skills: --threshold needs a value" >&2; exit 64; }
+      THRESHOLD="$2"; shift 2 ;;
     --help|-h)
       sed -n '1,30p' "$0" | sed 's/^# \{0,1\}//'
       exit 0

package/pipeline/scripts/search-logs.sh

@@ -42,16 +42,18 @@ LIMIT=20
 QUERY=""
 SEMANTIC=0
 
+need_value() { [ $# -ge 2 ] || { echo "search-logs: $1 needs a value" >&2; exit 64; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --root)    ROOT="$2"; shift 2 ;;
-    --project) PROJECT="$2"; shift 2 ;;
-    --since)   SINCE="$2"; shift 2 ;;
-    --phase)   PHASE="$2"; shift 2 ;;
+    --root)    need_value "$@"; ROOT="$2"; shift 2 ;;
+    --project) need_value "$@"; PROJECT="$2"; shift 2 ;;
+    --since)   need_value "$@"; SINCE="$2"; shift 2 ;;
+    --phase)   need_value "$@"; PHASE="$2"; shift 2 ;;
     --json)    JSON=1; shift ;;
     --tsv)     TSV=1; shift ;;
     --semantic) SEMANTIC=1; shift ;;
-    --limit)   LIMIT="$2"; shift 2 ;;
+    --limit)   need_value "$@"; LIMIT="$2"; shift 2 ;;
     --help|-h)
       awk 'NR==1{next} /^[^#]/{exit} {sub(/^# ?/,""); print}' "$0"
       exit 0
@@ -78,7 +80,7 @@ fi
 # --limit (passed as --top N). --since/--phase have no meaning here.
 if [ "$SEMANTIC" -eq 1 ]; then
   TM_SCRIPT="$SCRIPT_DIR/triage-memory.mjs"
-  if [ ! -x "$TM_SCRIPT" ] && ! command -v node >/dev/null 2>&1; then
+  if [ ! -f "$TM_SCRIPT" ] || ! command -v node >/dev/null 2>&1; then
     echo "search-logs: --semantic requires node + triage-memory.mjs" >&2
     exit 1
   fi

package/pipeline/scripts/sign-skills.sh

@@ -18,7 +18,9 @@ set -euo pipefail
 ROOT_OVERRIDE=""
 while [ $# -gt 0 ]; do
   case "$1" in
-    --root) ROOT_OVERRIDE="$2"; shift 2 ;;
+    --root)
+      [ $# -ge 2 ] || { echo "sign-skills: --root needs a value" >&2; exit 1; }
+      ROOT_OVERRIDE="$2"; shift 2 ;;
     *) shift ;;
   esac
 done

package/pipeline/scripts/smoke-cross-cli-behavior.sh

@@ -95,7 +95,7 @@ echo ""
 echo "→ 3. No personal-data hardcodes in generic docs"
 # These are patterns that must be placeholders, never literals
 PERSONAL_HARDCODES=(
-  "${USER}_tkgithub"
+  "${USER:-$(id -un)}_tkgithub"
 )
 for p in "${PERSONAL_HARDCODES[@]}"; do
   FOUND=$(find "$CLAUDE_CMDS" -name SKILL.md -exec grep -l -F -- "$p" {} + 2>/dev/null || true)