@mmerterden/multi-agent-pipeline 16.18.0 → 16.20.0

package/pipeline/scripts/anonymize-findings.mjs

@@ -12,11 +12,11 @@
 // Pattern source: karpathy/llm-council backend/council.py stage 2, which labels
 // peer answers "Response A/B/C" and keeps label_to_model out of the prompt.
 //
-// A residual worth naming: with only two reviewers on Claude Code the label set
-// is {Source A, Source B} and the triage model is one of them, so it retains a
-// 50% prior on which findings are its own. Anonymization removes the signal, not
-// the guess - llm-council's four-model council has a stronger version of the
-// same property. The value here is that nothing TELLS the judge.
+// A residual worth naming: on both hosts the triage model is one of the three
+// reviewers, so with the label set {Source A, Source B, Source C} it retains a
+// one-in-three prior on which findings are its own. Anonymization removes the
+// signal, not the guess - llm-council's four-model council has the same property
+// at one in four. The value here is that nothing TELLS the judge.
 //
 // What this does NOT do: scrub identity out of free text. A reviewer that writes
 // "as Sonnet would" in `issue`, or whose prose style is recognisable, is not
@@ -36,6 +36,7 @@
 // Exit codes: 0 ok, 64 usage, 65 input is not JSON.
 
 import { readFileSync, writeFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
 
 const IDENTITY_KEYS = [
   "reviewer",
@@ -136,7 +137,7 @@ export function anonymize(input, { seed } = {}) {
   return { findings: tagged, map: { seed: seedText, labelToModel, malformed } };
 }
 
-const isMain = process.argv[1] && import.meta.url === `file://${process.argv[1]}`;
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
 if (isMain) {
   const args = process.argv.slice(2);
   const flag = (name) => {

package/pipeline/scripts/build-skills-index.mjs

@@ -57,11 +57,22 @@ function parseFrontmatter(raw) {
   if (end < 0) return {};
   const body = raw.slice(3, end).trim();
   const out = {};
-  for (const line of body.split("\n")) {
-    const m = line.match(/^([\w-]+):\s*(.*)$/);
+  const lines = body.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^([\w-]+):\s*(.*)$/);
     if (!m) continue;
     let value = m[2].trim();
-    if (value.startsWith('"') && value.endsWith('"')) value = value.slice(1, -1);
+    if (/^[|>][+-]?$/.test(value)) {
+      // YAML block scalar: the text is the indented lines that follow, and the
+      // indicator itself is not a description.
+      const parts = [];
+      while (i + 1 < lines.length && (/^\s/.test(lines[i + 1]) || lines[i + 1].trim() === "")) {
+        parts.push(lines[++i].trim());
+      }
+      value = parts.join(" ").replace(/\s+/g, " ").trim();
+    } else if (value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1);
+    }
     out[m[1]] = value;
   }
   return out;

package/pipeline/scripts/cost-budget-check.mjs

@@ -13,12 +13,14 @@
  * coding tool; this turns "will this burn my tokens?" into a visible number.
  *
  * Inputs (CLI overrides prefs):
- *   --task-id <id>        Locate .worktrees/<id>/phase-tracker.json
+ *   --task-id <id>        Locate $HOME/.claude/logs/multi-agent/<id>/tracker-state.json
+ *                         (also tried: <id> without a leading #, task-<id>)
  *   --tracker  <path>     Explicit tracker JSON (skips lookup)
  *   --prefs    <path>     Preferences JSON; reads .global.costBudget
  *   --max-usd  <n>        Hard ceiling (USD)
  *   --warn-pct <n>        Warn threshold as percent of max-usd (1..99)
- *   --pricing-model <m>   opus | sonnet | haiku  (rate to price tokens at)
+ *   --pricing-model <m>   fable | opus | sonnet | haiku (any key under cost-table.json
+ *                         prices; default fable, the most expensive tier)
  *   --enabled             Force-enable even if prefs say otherwise
  *
  * Output: one human-readable status line on stdout.
@@ -62,7 +64,7 @@ for (let i = 0; i < argv.length; i++) {
 if (flags.help || flags.h) {
   process.stdout.write(
     "Usage: cost-budget-check.mjs [--task-id <id> | --tracker <path>] [--prefs <path>]\n" +
-      "       [--max-usd <n>] [--warn-pct <n>] [--pricing-model opus|sonnet|haiku] [--enabled]\n",
+      "       [--max-usd <n>] [--warn-pct <n>] [--pricing-model fable|opus|sonnet|haiku] [--enabled]\n",
   );
   process.exit(0);
 }

package/pipeline/scripts/cost-lib.sh

@@ -15,9 +15,6 @@
 #        absent). Returns null when $rate is null.
 #   cost_floor_cents($u)
 #     -> floor USD to whole cents; null passes through.
-#
-# cost_usd <rate-json> <tin> <tout> [tcached]  -  scalar convenience wrapper
-# that prints the raw (unrounded) USD via jq. Prints nothing when jq is absent.
 
 COST_JQ_DEFS='
   def cost_usd_of($rate; $tin; $tout; $tcached):
@@ -29,15 +26,3 @@ COST_JQ_DEFS='
   def cost_floor_cents($u):
     if $u == null then null else (($u * 100) | floor) / 100 end;
 '
-
-cost_usd() {
-  local rate="$1" tin="$2" tout="$3" tcached="${4:-0}"
-  command -v jq >/dev/null 2>&1 || return 0
-  jq -n \
-    --argjson rate "$rate" \
-    --argjson tin "$tin" \
-    --argjson tout "$tout" \
-    --argjson tcached "$tcached" \
-    "$COST_JQ_DEFS"'
-    cost_usd_of($rate; $tin; $tout; $tcached)'
-}

package/pipeline/scripts/diff-explain.mjs

@@ -11,7 +11,7 @@
  *
  * Inputs (any one):
  *   --triage <path>     Path to triage-output.json
- *   --task-id <#N|JIRA> Resolve via $HOME/.claude/logs/multi-agent/<project>/<id>/
+ *   --task-id <#N|JIRA> Resolve $HOME/.claude/logs/multi-agent/<id>/agent-state.json
  *   --state <path>      Path to agent-state.json with embedded triage
  *
  * Diff source:
@@ -31,6 +31,8 @@
  */
 
 import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
 import { execFileSync } from "child_process";
 
 const argv = process.argv.slice(2);
@@ -55,7 +57,7 @@ if (flags.help || flags.h) {
 Inputs (one required):
   --triage <path>     Path to triage-output.json
   --state  <path>     agent-state.json with embedded triage
-  --task-id <id>      Look up by task ID
+  --task-id <id>      Look up $HOME/.claude/logs/multi-agent/<id>/agent-state.json
 
 Diff source:
   --branch <name>     Branch to diff (default: current)
@@ -68,24 +70,32 @@ Output:
   process.exit(0);
 }
 
+function resolveStateByTaskId(id) {
+  const bare = String(id).replace(/^#/, "");
+  const logRoot = join(homedir(), ".claude", "logs", "multi-agent");
+  const candidates = [...new Set([String(id), bare, `task-${bare}`])].map((d) =>
+    join(logRoot, d, "agent-state.json"),
+  );
+  const found = candidates.find((p) => existsSync(p));
+  if (!found)
+    die(`no agent-state.json for task ${id} under ${logRoot} (tried ${candidates.join(", ")})`);
+  return found;
+}
+
 function loadTriage() {
   if (flags.triage) {
     if (!existsSync(flags.triage)) die(`triage file not found: ${flags.triage}`);
     return JSON.parse(readFileSync(flags.triage, "utf-8"));
   }
-  if (flags.state) {
-    if (!existsSync(flags.state)) die(`state file not found: ${flags.state}`);
-    const state = JSON.parse(readFileSync(flags.state, "utf-8"));
+  const statePath =
+    flags.state || (flags["task-id"] ? resolveStateByTaskId(flags["task-id"]) : null);
+  if (statePath) {
+    if (!existsSync(statePath)) die(`state file not found: ${statePath}`);
+    const state = JSON.parse(readFileSync(statePath, "utf-8"));
     const triage = state?.phases?.["4"]?.triage ?? state?.triage;
-    if (!triage) die(`no triage block found in ${flags.state}`);
+    if (!triage) die(`no triage block found in ${statePath}`);
     return triage;
   }
-  if (flags["task-id"]) {
-    die(
-      "--task-id resolution not implemented in this script  -  use --triage or --state directly. " +
-        "The slash command resolves task IDs via the orchestrator and passes --state to this script.",
-    );
-  }
   die("one of --triage, --state, or --task-id is required");
 }
 

package/pipeline/scripts/evidence-gate.mjs

@@ -11,13 +11,21 @@
 //   node pipeline/scripts/evidence-gate.mjs --claim build --status passed --evidence build.log
 //   node pipeline/scripts/evidence-gate.mjs --claim test  --status passed --evidence test.log \
 //        --success-pattern 'All tests passed' --failure-pattern 'FAILED'
+//   node pipeline/scripts/evidence-gate.mjs --claim manual --status passed --evidence manual-test.json
 //
 // Flags:
-//   --claim            build | test | review   (selects default success/failure markers)
+//   --claim            build | test | review | manual
+//                      build/test/review select default success/failure markers;
+//                      manual is JSON-based (Phase 5 manual-test.json, see below)
 //   --status           the claimed status (only "passed" is gated; others pass through)
 //   --evidence <path>  the log / artifact that must substantiate a "passed" claim
-//   --success-pattern  override the default success regex for the claim type
-//   --failure-pattern  override the default failure regex for the claim type
+//   --success-pattern  override the default success regex for the claim type (marker claims only)
+//   --failure-pattern  override the default failure regex for the claim type (marker claims only)
+//
+// The manual claim reads a JSON document instead of scanning for markers:
+//   { "criteria": [ { "spec", "observed", "verdict": "pass|fail|not-tested", "reason"?, ... } ], ... }
+//   criteria must be a non-empty array; every item needs spec, observed and a
+//   valid verdict; any "fail" is decisive; "not-tested" needs a non-empty reason.
 //
 // Exit codes:
 //   0  -  status is not "passed" (nothing to prove), OR evidence substantiates the pass
@@ -47,6 +55,10 @@ const DEFAULT_MARKERS = {
   },
 };
 
+const JSON_CLAIMS = new Set(["manual"]);
+const CLAIMS = [...Object.keys(DEFAULT_MARKERS), ...JSON_CLAIMS];
+const MANUAL_VERDICTS = new Set(["pass", "fail", "not-tested"]);
+
 const MAX_PATTERN_LEN = 200;
 
 // Compile a caller-supplied pattern safely: cap length and catch a bad regex so
@@ -101,12 +113,64 @@ function usage(msg) {
   process.exit(2);
 }
 
+function nonEmptyString(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+
+// Manual-test evidence is a structured document, not a log: every acceptance
+// criterion must say what was observed and how it came out. A "fail" anywhere
+// is decisive; an untested criterion is only acceptable when it says why.
+function gateManual(claim, evidence, body) {
+  let doc;
+  try {
+    doc = JSON.parse(body);
+  } catch (err) {
+    fail(`${claim} evidence is not valid JSON: ${evidence} (${err.message}) (default-FAIL)`);
+  }
+  const criteria = doc && typeof doc === "object" ? doc.criteria : undefined;
+  if (!Array.isArray(criteria) || criteria.length === 0) {
+    fail(`${claim} claims passed but evidence has no criteria: ${evidence} (default-FAIL)`);
+  }
+  criteria.forEach((item, i) => {
+    const label = `criteria[${i}]`;
+    if (!item || typeof item !== "object") {
+      fail(`${claim} evidence ${label} is not an object: ${evidence} (default-FAIL)`);
+    }
+    if (!nonEmptyString(item.spec)) {
+      fail(`${claim} evidence ${label} has no spec: ${evidence} (default-FAIL)`);
+    }
+    if (!nonEmptyString(item.observed)) {
+      fail(`${claim} evidence ${label} has no observed value: ${evidence} (default-FAIL)`);
+    }
+    if (!MANUAL_VERDICTS.has(item.verdict)) {
+      fail(
+        `${claim} evidence ${label} verdict must be one of pass|fail|not-tested: ${evidence} (default-FAIL)`,
+      );
+    }
+  });
+  const failed = criteria.find((item) => item.verdict === "fail");
+  if (failed) {
+    fail(
+      `${claim} evidence shows a failed criterion "${failed.spec}"  -  pass claim contradicted by ${evidence}`,
+    );
+  }
+  const untested = criteria.find(
+    (item) => item.verdict === "not-tested" && !nonEmptyString(item.reason),
+  );
+  if (untested) {
+    fail(
+      `${claim} evidence has not-tested criterion "${untested.spec}" without a reason  -  pass claim unverified by ${evidence} (default-FAIL)`,
+    );
+  }
+  ok(`${claim} pass claim substantiated by ${criteria.length} criteria in ${evidence}`);
+}
+
 const args = parseArgs(process.argv.slice(2));
 const claim = args.claim;
 const status = args.status;
 
-if (!claim || !DEFAULT_MARKERS[claim]) {
-  usage(`--claim must be one of: ${Object.keys(DEFAULT_MARKERS).join(", ")}`);
+if (!claim || !CLAIMS.includes(claim)) {
+  usage(`--claim must be one of: ${CLAIMS.join(", ")}`);
 }
 if (typeof status !== "string") {
   usage("--status is required");
@@ -138,6 +202,10 @@ if (body.trim().length === 0) {
   fail(`${claim} claims passed but evidence file is blank: ${evidence} (default-FAIL)`);
 }
 
+if (JSON_CLAIMS.has(claim)) {
+  gateManual(claim, evidence, body);
+}
+
 const successRe = userRegExp(args["success-pattern"], DEFAULT_MARKERS[claim].success, "success");
 const failureRe = userRegExp(args["failure-pattern"], DEFAULT_MARKERS[claim].failure, "failure");
 

package/pipeline/scripts/finding-fingerprint.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+/**
+ * finding-fingerprint.mjs  -  stamp every review finding with its stable id.
+ *
+ * Usage:
+ *   node finding-fingerprint.mjs annotate <path|-> [--kind reviewer|triage|dev-critic|auto] [--in-place]
+ *   node finding-fingerprint.mjs compute --file <path> --issue <text> [--rule-id <id>]
+ *
+ * `annotate` prints the annotated JSON (or rewrites the file with --in-place)
+ * and reports counts on stderr. `compute` prints {"fingerprint":"F:..."}.
+ *
+ * Exit codes: 0 ok, 1 unparseable input or unknown shape, 64 usage.
+ * Zero dependencies. Library half lives in _fingerprint.mjs.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+
+import { annotate, findingFingerprint, KINDS } from "./_fingerprint.mjs";
+
+const USAGE = `usage:
+  finding-fingerprint.mjs annotate <path|-> [--kind ${KINDS.join("|")}|auto] [--in-place]
+  finding-fingerprint.mjs compute --file <path> --issue <text> [--rule-id <id>]`;
+
+function parseArgs(argv) {
+  const opts = { _: [] };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--in-place") opts.inPlace = true;
+    else if (a === "--kind") opts.kind = argv[++i];
+    else if (a === "--file") opts.file = argv[++i];
+    else if (a === "--issue") opts.issue = argv[++i];
+    else if (a === "--rule-id") opts.ruleId = argv[++i];
+    else if (a.startsWith("--")) return null;
+    else opts._.push(a);
+  }
+  return opts;
+}
+
+function readSource(path) {
+  return path === "-" ? readFileSync(0, "utf-8") : readFileSync(path, "utf-8");
+}
+
+function main() {
+  const [command, ...rest] = process.argv.slice(2);
+  const opts = parseArgs(rest);
+  if (!opts) {
+    console.error(USAGE);
+    return 64;
+  }
+
+  if (command === "compute") {
+    if (!opts.file || !opts.issue) {
+      console.error(USAGE);
+      return 64;
+    }
+    const fingerprint = findingFingerprint({
+      file: opts.file,
+      issue: opts.issue,
+      ruleId: opts.ruleId,
+    });
+    process.stdout.write(JSON.stringify({ fingerprint }) + "\n");
+    return 0;
+  }
+
+  if (command !== "annotate" || opts._.length !== 1) {
+    console.error(USAGE);
+    return 64;
+  }
+
+  const path = opts._[0];
+  if (opts.inPlace && path === "-") {
+    console.error("error: --in-place needs a file path, not STDIN");
+    return 64;
+  }
+
+  let doc;
+  try {
+    doc = JSON.parse(readSource(path));
+  } catch (err) {
+    console.error(`error: cannot read ${path}: ${err.message}`);
+    return 1;
+  }
+
+  let result;
+  try {
+    result = annotate(doc, opts.kind ?? "auto");
+  } catch (err) {
+    console.error(`error: ${err.message}`);
+    return 1;
+  }
+
+  const text = JSON.stringify(result.doc, null, 2) + "\n";
+  if (opts.inPlace) writeFileSync(path, text);
+  else process.stdout.write(text);
+  console.error(
+    `finding-fingerprint: ${result.kind}, ${result.computed} computed, ${result.kept} kept`,
+  );
+  return 0;
+}
+
+process.exit(main());

package/pipeline/scripts/gc-refs.sh

@@ -111,8 +111,11 @@ if [ -z "$REFS_DIRS" ]; then
 fi
 
 # Match the node-id shape offload-ref.sh writes (p<phase>-<slug>-<8 hex>.md).
-# Anything else in that directory belongs to someone else.
-NODE_GLOB='p*-*-*.md'
+# Anything else in that directory belongs to someone else. The glob is a cheap
+# pre-filter for find; the regex is the actual shape (a plain `p*-*-*.md`
+# also matched pr-body-final.md).
+NODE_GLOB='p[0-9]*-*-????????.md'
+NODE_RE='^p[0-9][0-9a-z.]*-[a-z0-9-]+-[0-9a-f]{8}\.md$'
 
 MATCHES=""
 while IFS= read -r dir; do
@@ -128,6 +131,7 @@ while IFS= read -r dir; do
   [ -n "$found" ] || continue
   while IFS= read -r f; do
     [ -n "$f" ] || continue
+    printf '%s\n' "$(basename "$f")" | grep -Eq "$NODE_RE" || continue
     # Grace: skip anything touched inside the window.
     if [ "$GRACE_MIN" -gt 0 ] && [ -n "$(find "$f" -mmin -"$GRACE_MIN" 2>/dev/null)" ]; then
       continue

package/pipeline/scripts/gc-tmp.sh

@@ -110,7 +110,7 @@ while IFS= read -r -d '' p; do
   # Fresh-scratch grace: spare items an in-flight run touched recently
   # (checks the item and, for dirs, anything inside it).
   if [ "$GRACE_MIN" -gt 0 ] &&
-    find "$p" -mmin "-$GRACE_MIN" -print 2>/dev/null | head -1 | grep -q .; then
+    [ -n "$(find "$p" -mmin "-$GRACE_MIN" -print -quit 2>/dev/null)" ]; then
     skipped_active=$((skipped_active + 1))
     continue
   fi

package/pipeline/scripts/gc-worktrees.sh

@@ -108,7 +108,7 @@ EOF
     if printf '%s\n' "$registered" | grep -qxF "$dir"; then
       continue  # healthy registered worktree - kill/finish territory
     fi
-    if [ "$OLDER_MIN" -gt 0 ] && find "$dir" -type f -mmin "-$OLDER_MIN" 2>/dev/null | head -1 | grep -q .; then
+    if [ "$OLDER_MIN" -gt 0 ] && [ -n "$(find "$dir" -type f -mmin "-$OLDER_MIN" -print -quit 2>/dev/null)" ]; then
       continue  # recently touched - spare it
     fi
     orphans+=("$dir")

package/pipeline/scripts/gen-mode-dispatch.mjs

@@ -32,7 +32,7 @@ const args = Object.fromEntries(
   }),
 );
 
-const MODE = args.mode ?? "dev";
+const MODE = args.mode;
 
 const PHASE_NAMES = [
   "0:Init",
@@ -74,9 +74,9 @@ const MODES = {
   },
 };
 
-const spec = MODES[MODE];
+const spec = MODE ? MODES[MODE] : null;
 if (!spec) {
-  console.error(`unknown mode: ${MODE}`);
+  console.error(MODE ? `unknown mode: ${MODE}` : "usage: gen-mode-dispatch.mjs --mode=<mode>");
   console.error(`accepted: ${Object.keys(MODES).join(", ")}`);
   process.exit(2);
 }

package/pipeline/scripts/github-ssh-setup.sh

@@ -44,8 +44,13 @@ echo "SSH key başarıyla oluşturuldu!"
 # SSH agent'a ekle
 eval "$(ssh-agent -s)" > /dev/null 2>&1
 
-# macOS Keychain entegrasyonu için SSH config ayarla
+# SSH config ayarla (UseKeychain yalnızca macOS'ta geçerli bir seçenek;
+# Linux'ta ssh bilinmeyen seçenek diye config'i reddeder)
 SSH_CONFIG="$HOME/.ssh/config"
+USE_KEYCHAIN_LINE=""
+if [ "$(uname -s 2>/dev/null)" = "Darwin" ]; then
+    USE_KEYCHAIN_LINE="    UseKeychain yes"
+fi
 if ! grep -q "github.com" "$SSH_CONFIG" 2>/dev/null; then
     cat >> "$SSH_CONFIG" <<EOF
 
@@ -54,7 +59,7 @@ Host github.com
     User git
     IdentityFile $KEY_PATH
     AddKeysToAgent yes
-    UseKeychain yes
+${USE_KEYCHAIN_LINE}
 EOF
     chmod 600 "$SSH_CONFIG"
     echo "SSH config güncellendi."

package/pipeline/scripts/graph-build.mjs

@@ -12,7 +12,7 @@
  *
  * Inputs:
  *   --root <path>    Repo root. Default: cwd
- *   --stack <id>     ios | android | node | python. Required.
+ *   --stack <id>     ios | android | node | python | go. Required.
  *   --out <path>     Graph output. Default: ~/.claude/knowledge/<project>/code-graph.json
  *   --max-nodes N    Refuse to write a graph larger than this. Default: 200000.
  *                    Callers pass prefs.global.codeGraph.maxNodes. A tree that
@@ -88,7 +88,7 @@ function main() {
   const { flags } = parseFlags(process.argv.slice(2));
   const stack = flags.stack;
   if (!stack || stack === true) {
-    process.stderr.write("graph-build: --stack <ios|android|node|python> required\n");
+    process.stderr.write("graph-build: --stack <ios|android|node|python|go> required\n");
     process.exit(64);
   }
 

package/pipeline/scripts/jira-wiki-escape.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { readFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
 
 const SEQUENCES = [
   ":)",
@@ -77,7 +78,7 @@ async function readStdin() {
   return Buffer.concat(chunks).toString("utf8");
 }
 
-const isMain = process.argv[1] && import.meta.url === `file://${process.argv[1]}`;
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
 if (isMain) {
   const args = process.argv.slice(2);
   const check = args.includes("--check");

package/pipeline/scripts/keychain.py

@@ -51,7 +51,8 @@ Behaviour
 - Windows / unknown platforms: backend unavailable; `doctor` prints remediation.
 - Never logs the secret value. `set` accepts the value via argv (CLI) or via
   stdin when the value is exactly `-` (preferred for scripts to avoid shell
-  history leak).
+  history leak). On macOS the write goes through `security -i` with the
+  command on stdin, so the value never appears on a child process argv.
 - get returns the raw value to stdout with no trailing newline manipulation
   beyond stripping the OS-level final \\n that `security -w` appends.
 
@@ -166,17 +167,17 @@ def set_(label: str, value: str, account: Optional[str] = None) -> None:
     pf = _ensure_backend()
     acct = _account_default(account)
     if pf == "macos":
-        rc, _, err = _run(
-            [
-                "/usr/bin/security",
-                "add-generic-password",
-                "-a", acct,
-                "-l", label,
-                "-s", label,
-                "-w", value,
-                "-U",
-            ]
+        # `security -i` reads the add command from stdin, so the secret never
+        # lands on the security argv (visible to ps). Backslashes and double
+        # quotes are escaped for security's interactive tokenizer.
+        def quote(text: str) -> str:
+            return text.replace("\\", "\\\\").replace('"', '\\"')
+
+        command = (
+            f'add-generic-password -U -a "{quote(acct)}" -l "{quote(label)}" '
+            f'-s "{quote(label)}" -w "{quote(value)}"\n'
         )
+        rc, _, err = _run(["/usr/bin/security", "-i"], input_value=command.encode("utf-8"))
         if rc != 0:
             sys.stderr.write(err.decode("utf-8", errors="replace"))
             sys.exit(4)

package/pipeline/scripts/learning-curve.mjs

@@ -141,7 +141,7 @@ const buckets = [...byBucket.keys()].sort().map((start) => {
       : null,
     reworkPerTask: round(list.reduce((s, t) => s + t.rework, 0) / n),
     tokensPerTask: Math.round((totIn + totOut) / n),
-    cacheRatio: totIn ? round(totCached / totIn) : null,
+    cacheRatio: totIn + totCached ? round(totCached / (totIn + totCached)) : null,
     memoryPrecision: totInjected ? round(totUsed / totInjected) : null,
   };
 });

package/pipeline/scripts/migrate-prefs.mjs

@@ -248,7 +248,7 @@ function migrate(prefs) {
     changes.push("initialized empty identities array");
   }
 
-  // 4. keychainMapping  -  expand to 12 services
+  // 4. keychainMapping  -  add every default service the file does not name yet
   const km = out.global.keychainMapping || {};
   const kmDefaults = defaultKeychainMapping();
   let kmChanged = false;

package/pipeline/scripts/output-quality-check.sh

@@ -23,7 +23,9 @@ TASK=""
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --strict) STRICT=true; shift ;;
-    --task)   TASK="$2"; shift 2 ;;
+    --task)
+      [ "$#" -ge 2 ] || { echo "output-quality-check: --task needs a value" >&2; exit 1; }
+      TASK="$2"; shift 2 ;;
     *) shift ;;
   esac
 done

package/pipeline/scripts/phase-tracker.sh

@@ -265,7 +265,7 @@ emit_otel_span() {
   local event="${1:-unknown}"
   local phase_id="${2:-?}"
   local subject="${3:-}"
-  local extra_attrs="${4:-{\}}"
+  local extra_attrs="${4:-"{}"}"
   local task_id
   task_id=$(basename "$TRACKER_DIR")
   local now_ns

package/pipeline/scripts/phase0-exit-gate.mjs

@@ -36,6 +36,7 @@
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
+import { pathToFileURL } from "url";
 
 const FIGMA_URL = /figma\.com\/(design|make|file)\//i;
 
@@ -233,6 +234,6 @@ function main(argv) {
   return result.ok ? 0 : 1;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   process.exit(main(process.argv));
 }

package/pipeline/scripts/plan-coverage-gate.mjs

@@ -31,6 +31,7 @@
 
 import { readFileSync, existsSync } from "node:fs";
 import { join, isAbsolute } from "node:path";
+import { pathToFileURL } from "node:url";
 
 export function auditTodos(todos) {
   const gaps = [];
@@ -89,7 +90,7 @@ function readJson(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 
-const isMain = process.argv[1] && import.meta.url === `file://${process.argv[1]}`;
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
 if (isMain) {
   const args = process.argv.slice(2);
   const flag = (name) => {