@mmerterden/multi-agent-pipeline 16.18.0 → 16.20.0

package/pipeline/scripts/pre-commit-check.sh

@@ -1,7 +1,9 @@
 #!/bin/bash
 # Pre-commit secret detection for multi-agent pipeline
 # Scans staged git changes for accidentally committed secrets
-# Exit 0 = clean, Exit 1 = secrets found (blocks commit)
+# Exit 0 = clean, Exit 2 = secrets found. The PreToolUse hook contract
+# (install/templates/claude-hooks.json, agent-guard.sh) blocks the tool call
+# only on exit 2, with the reason on stderr.
 
 set -uo pipefail
 
@@ -56,6 +58,14 @@ process.stdin.on("end", () => {
   fi
 fi
 
+# Staged paths from `git diff --cached --name-only` are repo-root-relative, so
+# the `-f` tests below only see them from the repo root. Hooks fire with the
+# caller's cwd, which is often a subdirectory.
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+if [ -n "$REPO_ROOT" ]; then
+  cd "$REPO_ROOT" || exit 0
+fi
+
 FOUND=0
 
 # `file "$f" | grep -q "binary"` never matches real `file` output (it names a
@@ -74,14 +84,14 @@ scan_file() {
 
   # .env files
   if echo "$file" | grep -qE '\.env($|\.)'; then
-    echo "BLOCKED: .env file staged: $file"
+    echo "BLOCKED: .env file staged: $file" >&2
     FOUND=1
     return 0
   fi
 
   # Credentials files
   if echo "$file" | grep -qiE '(credentials|secrets|tokens)\.(json|yaml|yml|plist)$'; then
-    echo "BLOCKED: Credentials file staged: $file"
+    echo "BLOCKED: Credentials file staged: $file" >&2
     FOUND=1
     return 0
   fi
@@ -90,37 +100,37 @@ scan_file() {
 
   # API keys / tokens (key = "long_string" pattern)
   if echo "$content" | grep -qiE '(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[:=]\s*["'"'"'][A-Za-z0-9+/=_-]{20,}'; then
-    echo "BLOCKED: Possible API key/token in $file"
+    echo "BLOCKED: Possible API key/token in $file" >&2
     FOUND=1
   fi
 
   # AWS access keys
   if echo "$content" | grep -qE 'AKIA[0-9A-Z]{16}'; then
-    echo "BLOCKED: AWS access key in $file"
+    echo "BLOCKED: AWS access key in $file" >&2
     FOUND=1
   fi
 
   # Private keys
   if echo "$content" | grep -qE 'BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY'; then
-    echo "BLOCKED: Private key in $file"
+    echo "BLOCKED: Private key in $file" >&2
     FOUND=1
   fi
 
   # Firebase/GCP service account JSON
   if echo "$content" | grep -qE '"type"\s*:\s*"service_account"'; then
-    echo "BLOCKED: Service account JSON in $file"
+    echo "BLOCKED: Service account JSON in $file" >&2
     FOUND=1
   fi
 
   # High-signal provider token prefixes (low false-positive rate)
   if echo "$content" | grep -qE '(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,}|xox[baprs]-[A-Za-z0-9-]{12,}|sk_live_[A-Za-z0-9]{20,}|rk_live_[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|npm_[A-Za-z0-9]{36}|glpat-[A-Za-z0-9_-]{20,}'; then
-    echo "BLOCKED: Provider access token in $file"
+    echo "BLOCKED: Provider access token in $file" >&2
     FOUND=1
   fi
 
   # JWT (three base64url segments  -  header.payload.signature)
   if echo "$content" | grep -qE 'eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'; then
-    echo "BLOCKED: JWT in $file"
+    echo "BLOCKED: JWT in $file" >&2
     FOUND=1
   fi
 
@@ -191,7 +201,7 @@ scan_file() {
           if (H >= 4.2) { print s; exit }
         }')
       if [ -n "$entropy_hit" ]; then
-        echo "BLOCKED: High-entropy string (possible secret) in $file"
+        echo "BLOCKED: High-entropy string (possible secret) in $file" >&2
         FOUND=1
       fi
     fi
@@ -234,9 +244,9 @@ if [ "$SCAN_UNSTAGED" = "1" ]; then
 fi
 
 if [ $FOUND -eq 1 ]; then
-  echo ""
-  echo "Secret check failed. Remove secrets from staged files before committing."
-  exit 1
+  echo "" >&2
+  echo "Secret check failed. Remove secrets from staged files before committing." >&2
+  exit 2
 fi
 
 exit 0

package/pipeline/scripts/prune-logs.sh

@@ -151,7 +151,7 @@ while IFS= read -r -d '' d; do
   # so a concurrent run keeps a resumable log dir. --task is an explicit,
   # deliberate target and bypasses the grace.
   if [ "$GRACE_MIN" -gt 0 ] && [ -z "$TASK" ] &&
-    find "$d" -mmin "-$GRACE_MIN" -print 2>/dev/null | head -1 | grep -q .; then
+    [ -n "$(find "$d" -mmin "-$GRACE_MIN" -print -quit 2>/dev/null)" ]; then
     skipped_active=$((skipped_active + 1))
     continue
   fi

package/pipeline/scripts/render-agent-log-cost.sh

@@ -25,7 +25,9 @@ shift || true
 SPANS_FILE=""
 while [ $# -gt 0 ]; do
   case "$1" in
-    --otel-spans) SPANS_FILE="${2:-}"; shift 2 ;;
+    --otel-spans)
+      [ $# -ge 2 ] || { echo "render-agent-log-cost: --otel-spans needs a path" >&2; exit 1; }
+      SPANS_FILE="$2"; shift 2 ;;
     *) shift ;;
   esac
 done

package/pipeline/scripts/render-cost-summary.sh

@@ -19,7 +19,9 @@ shift || true
 SPANS_FILE=""
 while [ $# -gt 0 ]; do
   case "$1" in
-    --otel-spans) SPANS_FILE="${2:-}"; shift 2 ;;
+    --otel-spans)
+      [ $# -ge 2 ] || { echo "render-cost-summary: --otel-spans needs a path" >&2; exit 1; }
+      SPANS_FILE="$2"; shift 2 ;;
     *) shift ;;
   esac
 done
@@ -71,7 +73,7 @@ if [ -n "$tracker_file" ]; then
       (.phases // {} | to_entries)
     end)
     | [ .[] |
-        select(.value.tokens_in // 0 > 0 or .value.tokens_out // 0 > 0) |
+        select(((.value.tokens_in // 0) > 0) or ((.value.tokens_out // 0) > 0)) |
         {
           phase: .key,
           phase_name: (.value.name // .key),

package/pipeline/scripts/render-work-summary.sh

@@ -44,11 +44,13 @@ TASK_ID="${1:?usage: render-work-summary.sh <task-id>}"
 shift || true
 
 WORKTREE=""; BRANCH=""; BASE=""
+need_value() { [ $# -ge 2 ] || { echo "render-work-summary: $1 needs a value" >&2; exit 1; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --worktree)    WORKTREE="$2"; shift 2 ;;
-    --branch)      BRANCH="$2"; shift 2 ;;
-    --base-branch) BASE="$2"; shift 2 ;;
+    --worktree)    need_value "$@"; WORKTREE="$2"; shift 2 ;;
+    --branch)      need_value "$@"; BRANCH="$2"; shift 2 ;;
+    --base-branch) need_value "$@"; BASE="$2"; shift 2 ;;
     *) shift ;;
   esac
 done

package/pipeline/scripts/repo-map.mjs

@@ -30,6 +30,7 @@ import { promises as fs } from "node:fs";
 import { existsSync, statSync } from "node:fs";
 import path from "node:path";
 import process from "node:process";
+import { matchesGlob } from "./_path-match.mjs";
 
 // ---- CLI args --------------------------------------------------------------
 
@@ -142,8 +143,8 @@ async function walk(root, args) {
           continue;
         }
         const rel = path.relative(root, full);
-        if (args.include && !args.include.some((g) => rel.includes(g))) continue;
-        if (args.exclude && args.exclude.some((g) => rel.includes(g))) continue;
+        if (args.include && !args.include.some((g) => matchesGlob(rel, g))) continue;
+        if (args.exclude && args.exclude.some((g) => matchesGlob(rel, g))) continue;
         out.push({ path: rel, lang: LANG_EXT[ext], abs: full });
       }
     }

package/pipeline/scripts/review-delta.mjs

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+/**
+ * review-delta.mjs  -  classify one Phase 4 round against the round before it.
+ *
+ * Reviewers re-read the whole diff every round and return findings with no
+ * memory of the previous round. This script gives the loop that memory: it
+ * fingerprints both rounds (see _fingerprint.mjs) and reports which accepted
+ * findings are still present after the fix, which were resolved, which triage
+ * downgraded, and which are new. A finding that survives `--trip-cycles`
+ * consecutive rework cycles is the autopilot circuit-breaker's trigger 2.
+ *
+ * Usage:
+ *   review-delta.mjs --rounds-dir <dir> --iteration N [options]
+ *   review-delta.mjs --previous <round-N-1.json> --current <round-N.json> [--prior <round-N-2.json> ...] [options]
+ *
+ * Options:
+ *   --kind triage|reviewer|dev-critic   document shape (default triage)
+ *   --trip-cycles N                     recurrence that trips (default 2)
+ *   --severities a,b                    accepted severities that count as the
+ *                                       rework mandate (default blocking,important)
+ *
+ * Output (stdout, JSON): {iteration, previousIteration, counts, new[], stillPresent[],
+ *   resolved[], downgraded[], stillPresentBlocking[], recurrence{}, tripped, plateau}
+ *   Each list entry is {fingerprint, severity, file, issue} so a log line reads
+ *   without a lookup. With no previous round: {"skipped":"no-previous-round"}.
+ *
+ * Exit codes:
+ *   0   progress, or nothing to compare (fail-open like evidence-gate)
+ *   1   unparseable input or wrong shape
+ *   3   trigger-2 signal: a mandate finding recurred >= --trip-cycles times
+ *   64  usage
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { annotate, collectFingerprints, KINDS } from "./_fingerprint.mjs";
+
+const USAGE = `usage:
+  review-delta.mjs --rounds-dir <dir> --iteration N [--kind ${KINDS.join("|")}] [--trip-cycles N] [--severities a,b]
+  review-delta.mjs --previous <json> --current <json> [--prior <json> ...] [same options]`;
+
+const ROUND_FILE = (n) => `triage-round-${n}.json`;
+
+function parseArgs(argv) {
+  const opts = { prior: [], kind: "triage", tripCycles: 2, severities: ["blocking", "important"] };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => argv[++i];
+    if (a === "--rounds-dir") opts.roundsDir = next();
+    else if (a === "--iteration") opts.iteration = Number(next());
+    else if (a === "--previous") opts.previous = next();
+    else if (a === "--current") opts.current = next();
+    else if (a === "--prior") opts.prior.push(next());
+    else if (a === "--kind") opts.kind = next();
+    else if (a === "--trip-cycles") opts.tripCycles = Number(next());
+    else if (a === "--severities")
+      opts.severities = next()
+        .split(",")
+        .map((s) => s.trim());
+    else return null;
+  }
+  return opts;
+}
+
+function loadDoc(path, kind) {
+  const doc = JSON.parse(readFileSync(path, "utf-8"));
+  return annotate(doc, kind).doc;
+}
+
+/**
+ * Resolve the ordered list of round files, newest first: [current, previous, prior...].
+ * Returns null when there is no previous round to compare against.
+ */
+function resolveRounds(opts) {
+  if (opts.roundsDir) {
+    if (!Number.isInteger(opts.iteration) || opts.iteration < 1) {
+      throw new Error("--iteration must be a positive integer");
+    }
+    const current = join(opts.roundsDir, ROUND_FILE(opts.iteration));
+    if (!existsSync(current)) throw new Error(`current round file missing: ${current}`);
+    const chain = [current];
+    for (let n = opts.iteration - 1; n >= 1; n--) {
+      const p = join(opts.roundsDir, ROUND_FILE(n));
+      if (!existsSync(p)) break;
+      chain.push(p);
+    }
+    return { chain, iteration: opts.iteration };
+  }
+  if (!opts.current) throw new Error("--current is required without --rounds-dir");
+  const chain = [opts.current];
+  if (opts.previous) chain.push(opts.previous, ...opts.prior);
+  return { chain, iteration: chain.length };
+}
+
+function entry(fp, finding) {
+  return {
+    fingerprint: fp,
+    severity: finding.severity ?? null,
+    file: finding.file ?? null,
+    issue: finding.issue ?? null,
+  };
+}
+
+function buckets(kind) {
+  return kind === "triage"
+    ? { accepted: ["accepted"], elsewhere: ["deferred", "rejected"] }
+    : { accepted: ["findings"], elsewhere: [] };
+}
+
+function mandate(doc, kind, severities) {
+  return collectFingerprints(doc, { kind, buckets: buckets(kind).accepted, severities });
+}
+
+function setEqual(a, b) {
+  if (a.size !== b.size) return false;
+  for (const x of a) if (!b.has(x)) return false;
+  return true;
+}
+
+export function computeDelta(docs, { kind, severities, tripCycles }) {
+  const [current, previous, ...priors] = docs;
+  const b = buckets(kind);
+  const prevMandate = mandate(previous, kind, severities);
+  const prevAll = collectFingerprints(previous, { kind, buckets: b.accepted });
+  const curAccepted = collectFingerprints(current, { kind, buckets: b.accepted });
+  const curElsewhere = collectFingerprints(current, { kind, buckets: b.elsewhere });
+
+  const stillPresent = [];
+  const resolved = [];
+  const downgraded = [];
+  for (const [fp, f] of prevMandate) {
+    if (curAccepted.has(fp)) stillPresent.push(entry(fp, curAccepted.get(fp)));
+    else if (curElsewhere.has(fp)) downgraded.push(entry(fp, f));
+    else resolved.push(entry(fp, f));
+  }
+  const fresh = [];
+  for (const [fp, f] of curAccepted) if (!prevAll.has(fp)) fresh.push(entry(fp, f));
+
+  const priorMandates = priors.map((d) => mandate(d, kind, severities));
+  const recurrence = {};
+  for (const { fingerprint } of stillPresent) {
+    let n = 1;
+    for (const m of priorMandates) {
+      if (!m.has(fingerprint)) break;
+      n += 1;
+    }
+    recurrence[fingerprint] = n;
+  }
+
+  let plateau = false;
+  if (priors.length > 0 && stillPresent.length > 0) {
+    const prevStill = new Set();
+    for (const fp of priorMandates[0].keys()) if (prevMandate.has(fp)) prevStill.add(fp);
+    plateau = setEqual(prevStill, new Set(stillPresent.map((e) => e.fingerprint)));
+  }
+
+  const tripped = stillPresent.some((e) => recurrence[e.fingerprint] >= tripCycles);
+  return {
+    counts: {
+      new: fresh.length,
+      stillPresent: stillPresent.length,
+      resolved: resolved.length,
+      downgraded: downgraded.length,
+    },
+    new: fresh,
+    stillPresent,
+    resolved,
+    downgraded,
+    stillPresentBlocking: stillPresent.filter((e) => e.severity === "blocking"),
+    recurrence,
+    tripped,
+    plateau,
+  };
+}
+
+function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  if (!opts || !KINDS.includes(opts.kind) || !(opts.tripCycles >= 1)) {
+    console.error(USAGE);
+    return 64;
+  }
+
+  let rounds;
+  try {
+    rounds = resolveRounds(opts);
+  } catch (err) {
+    console.error(`error: ${err.message}`);
+    return opts.roundsDir && /missing/.test(err.message) ? 1 : 64;
+  }
+
+  if (rounds.chain.length < 2) {
+    process.stdout.write(JSON.stringify({ skipped: "no-previous-round" }) + "\n");
+    return 0;
+  }
+
+  let docs;
+  try {
+    docs = rounds.chain.map((p) => loadDoc(p, opts.kind));
+  } catch (err) {
+    console.error(`error: ${err.message}`);
+    return 1;
+  }
+
+  const delta = computeDelta(docs, opts);
+  const out = {
+    iteration: rounds.iteration,
+    previousIteration: rounds.iteration - 1,
+    ...delta,
+  };
+  process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+  return delta.tripped ? 3 : 0;
+}
+
+if (process.argv[1] && /review-delta\.mjs$/.test(process.argv[1])) {
+  process.exit(main());
+}

package/pipeline/scripts/run-metrics.mjs

@@ -23,6 +23,11 @@
  *                                           attribution reports "unavailable".
  *   consensusVerdict                      - unanimous-* / split / unverified
  *   buildPassed                           - per-repo build outcome
+ *   diff.filesTouched / locAdded /        - size of the change, from state.diffRisk
+ *   locRemoved / maxScore                   (Phase 4 Step 1.75); null when the
+ *                                           run predates the persisted totals
+ *   reviewDelta.stillPresentFinal /       - cross-round classification of the
+ *   resolvedTotal / tripped                 last iteration (state.reviewIterations[].delta)
  *
  * Usage:
  *   node pipeline/scripts/run-metrics.mjs --state path/to/agent-state.json
@@ -147,6 +152,10 @@ if (projects.length) {
   buildPassed = typeof b === "string" ? b === "passed" : b && b.ok === true;
 }
 
+const diffRisk = state.diffRisk && typeof state.diffRisk === "object" ? state.diffRisk : {};
+const deltas = iterations.map((it) => it.delta).filter((d) => d && typeof d === "object");
+const lastDelta = deltas.length ? deltas[deltas.length - 1] : null;
+
 const metrics = {
   taskId: state.taskId ?? null,
   status: state.status ?? null,
@@ -193,6 +202,17 @@ const metrics = {
   },
   consensusVerdict: lastTriage.consensus ? lastTriage.consensus.verdict : null,
   buildPassed,
+  diff: {
+    filesTouched: Number.isInteger(diffRisk.files) ? diffRisk.files : null,
+    locAdded: Number.isInteger(diffRisk.loc_added) ? diffRisk.loc_added : null,
+    locRemoved: Number.isInteger(diffRisk.loc_removed) ? diffRisk.loc_removed : null,
+    maxScore: typeof diffRisk.max_score === "number" ? diffRisk.max_score : null,
+  },
+  reviewDelta: {
+    stillPresentFinal: lastDelta ? (lastDelta.stillPresent || []).length : null,
+    resolvedTotal: deltas.length ? deltas.reduce((n, d) => n + (d.resolved || []).length, 0) : null,
+    tripped: deltas.some((d) => d.tripped === true),
+  },
 };
 
 console.log(JSON.stringify(metrics, null, 2));

package/pipeline/scripts/scan-skills.sh

@@ -34,10 +34,14 @@ THRESHOLD="medium"
 
 while [ $# -gt 0 ]; do
   case "$1" in
-    --root) ROOT="$2"; shift 2 ;;
+    --root)
+      [ $# -ge 2 ] || { echo "scan-skills: --root needs a value" >&2; exit 64; }
+      ROOT="$2"; shift 2 ;;
     --strict) STRICT=1; shift ;;
     --json) JSON=1; shift ;;
-    --threshold) THRESHOLD="$2"; shift 2 ;;
+    --threshold)
+      [ $# -ge 2 ] || { echo "scan-skills: --threshold needs a value" >&2; exit 64; }
+      THRESHOLD="$2"; shift 2 ;;
     --help|-h)
       sed -n '1,30p' "$0" | sed 's/^# \{0,1\}//'
       exit 0

package/pipeline/scripts/scope-check-gate.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/**
+ * scope-check-gate.mjs  -  every file in the diff needs a stated reason.
+ *
+ * Phase 3 writes `.pipeline/scope-check.json` before the handoff: one reason
+ * per touched file, the things it deliberately did not do, and the simplifier
+ * rationales that used to be discarded. This gate compares that record with
+ * the real diff so an unjustified file cannot ride into review unnoticed.
+ *
+ * Usage:
+ *   git diff --name-only <base>...HEAD | node scope-check-gate.mjs --check .pipeline/scope-check.json --diff-files -
+ *   node scope-check-gate.mjs --check scope-check.json --diff-files files.txt [--advisory]
+ *
+ * Output (stdout, JSON): {ok, justified, unjustified[], unlisted[], notDone}
+ *   unjustified = in the diff, missing from files[] (or with an empty reason)
+ *   unlisted    = in files[], not in the diff (stale entry; reported, never fatal)
+ *
+ * Exit codes: 0 every diff file justified (or --advisory), 1 otherwise or on
+ * unreadable input, 64 usage.
+ */
+
+import { readFileSync } from "node:fs";
+
+import { normalizeFile } from "./_fingerprint.mjs";
+
+const USAGE =
+  "usage: scope-check-gate.mjs --check <scope-check.json> --diff-files <path|-> [--advisory]";
+
+function parseArgs(argv) {
+  const opts = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--check") opts.check = argv[++i];
+    else if (a === "--diff-files") opts.diffFiles = argv[++i];
+    else if (a === "--advisory") opts.advisory = true;
+    else return null;
+  }
+  return opts.check && opts.diffFiles ? opts : null;
+}
+
+function readText(path) {
+  return path === "-" ? readFileSync(0, "utf-8") : readFileSync(path, "utf-8");
+}
+
+export function evaluate(check, diffFiles) {
+  const files = Array.isArray(check?.files) ? check.files : [];
+  const reasons = new Map();
+  for (const f of files) {
+    if (!f || typeof f.path !== "string") continue;
+    const reason = typeof f.reason === "string" ? f.reason.trim() : "";
+    reasons.set(normalizeFile(f.path), reason);
+  }
+  const diff = [...new Set(diffFiles.map(normalizeFile).filter(Boolean))];
+  const unjustified = diff.filter((p) => !(reasons.get(p) ?? "").length);
+  const diffSet = new Set(diff);
+  const unlisted = [...reasons.keys()].filter((p) => !diffSet.has(p));
+  return {
+    ok: unjustified.length === 0,
+    justified: diff.length - unjustified.length,
+    unjustified,
+    unlisted,
+    notDone: Array.isArray(check?.notDone) ? check.notDone.length : 0,
+  };
+}
+
+function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  if (!opts) {
+    console.error(USAGE);
+    return 64;
+  }
+  const fail = opts.advisory ? 0 : 1;
+  let check;
+  let diffFiles;
+  try {
+    check = JSON.parse(readText(opts.check));
+    diffFiles = readText(opts.diffFiles).split("\n");
+  } catch (err) {
+    console.error(`scope-check-gate: ${err.message}`);
+    process.stdout.write(JSON.stringify({ ok: false, error: err.message }) + "\n");
+    return fail;
+  }
+  const result = evaluate(check, diffFiles);
+  process.stdout.write(JSON.stringify(result) + "\n");
+  return result.ok ? 0 : fail;
+}
+
+if (process.argv[1] && /scope-check-gate\.mjs$/.test(process.argv[1])) {
+  process.exit(main());
+}

package/pipeline/scripts/search-logs.sh

@@ -42,16 +42,18 @@ LIMIT=20
 QUERY=""
 SEMANTIC=0
 
+need_value() { [ $# -ge 2 ] || { echo "search-logs: $1 needs a value" >&2; exit 64; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --root)    ROOT="$2"; shift 2 ;;
-    --project) PROJECT="$2"; shift 2 ;;
-    --since)   SINCE="$2"; shift 2 ;;
-    --phase)   PHASE="$2"; shift 2 ;;
+    --root)    need_value "$@"; ROOT="$2"; shift 2 ;;
+    --project) need_value "$@"; PROJECT="$2"; shift 2 ;;
+    --since)   need_value "$@"; SINCE="$2"; shift 2 ;;
+    --phase)   need_value "$@"; PHASE="$2"; shift 2 ;;
     --json)    JSON=1; shift ;;
     --tsv)     TSV=1; shift ;;
     --semantic) SEMANTIC=1; shift ;;
-    --limit)   LIMIT="$2"; shift 2 ;;
+    --limit)   need_value "$@"; LIMIT="$2"; shift 2 ;;
     --help|-h)
       awk 'NR==1{next} /^[^#]/{exit} {sub(/^# ?/,""); print}' "$0"
       exit 0
@@ -78,7 +80,7 @@ fi
 # --limit (passed as --top N). --since/--phase have no meaning here.
 if [ "$SEMANTIC" -eq 1 ]; then
   TM_SCRIPT="$SCRIPT_DIR/triage-memory.mjs"
-  if [ ! -x "$TM_SCRIPT" ] && ! command -v node >/dev/null 2>&1; then
+  if [ ! -f "$TM_SCRIPT" ] || ! command -v node >/dev/null 2>&1; then
     echo "search-logs: --semantic requires node + triage-memory.mjs" >&2
     exit 1
   fi

package/pipeline/scripts/sign-skills.sh

@@ -18,7 +18,9 @@ set -euo pipefail
 ROOT_OVERRIDE=""
 while [ $# -gt 0 ]; do
   case "$1" in
-    --root) ROOT_OVERRIDE="$2"; shift 2 ;;
+    --root)
+      [ $# -ge 2 ] || { echo "sign-skills: --root needs a value" >&2; exit 1; }
+      ROOT_OVERRIDE="$2"; shift 2 ;;
     *) shift ;;
   esac
 done

package/pipeline/scripts/smoke-cross-cli-behavior.sh

@@ -95,7 +95,7 @@ echo ""
 echo "→ 3. No personal-data hardcodes in generic docs"
 # These are patterns that must be placeholders, never literals
 PERSONAL_HARDCODES=(
-  "${USER}_tkgithub"
+  "${USER:-$(id -un)}_tkgithub"
 )
 for p in "${PERSONAL_HARDCODES[@]}"; do
   FOUND=$(find "$CLAUDE_CMDS" -name SKILL.md -exec grep -l -F -- "$p" {} + 2>/dev/null || true)
@@ -159,15 +159,22 @@ echo "→ 7. Agent personas deployed to both CLIs"
 
 CLAUDE_AGENTS="$HOME/.claude/agents"
 COPILOT_AGENTS="$HOME/.copilot/agents"
-AGENT_FILES=(code-reviewer.md explorer.md ios-architect.md android-architect.md backend-architect.md security-auditor.md)
+AGENT_FILES=()
+if [ -d "$CLAUDE_AGENTS" ]; then
+  for f in "$CLAUDE_AGENTS"/*.md; do
+    [ -f "$f" ] && AGENT_FILES+=("$(basename "$f")")
+  done
+fi
 
 if [ -d "$CLAUDE_AGENTS" ] && [ -d "$COPILOT_AGENTS" ]; then
   missing_on_copilot=0
-  for a in "${AGENT_FILES[@]}"; do
+  for a in ${AGENT_FILES[@]+"${AGENT_FILES[@]}"}; do
     [ -f "$COPILOT_AGENTS/$a" ] || missing_on_copilot=$((missing_on_copilot+1))
   done
-  if [ "$missing_on_copilot" -eq 0 ]; then
-    pass "all 6 reviewer/explorer personas present on both CLIs"
+  if [ "$missing_on_copilot" -eq 0 ] && [ "${#AGENT_FILES[@]}" -gt 0 ]; then
+    pass "all ${#AGENT_FILES[@]} personas present on both CLIs"
+  elif [ "${#AGENT_FILES[@]}" -eq 0 ]; then
+    fail "no persona files under $CLAUDE_AGENTS"
   else
     fail "$missing_on_copilot persona file(s) missing from Copilot side"
   fi