@mmerterden/multi-agent-pipeline 17.6.0 → 18.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "17.6.0",
+  "version": "18.0.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",
@@ -14,7 +14,7 @@
   },
   "scripts": {
     "start": "node index.js",
-    "test": "npm run format:check && node --test test/*.test.mjs && node pipeline/scripts/run-smokes.mjs && node pipeline/scripts/lint-skills.mjs && node pipeline/scripts/lint-personas.mjs && node pipeline/scripts/lint-mcp-refs.mjs && node pipeline/scripts/eval-triage.mjs && node pipeline/scripts/eval-golden-tasks.mjs && node pipeline/scripts/eval-intent.mjs && node pipeline/scripts/eval-recall.mjs && node pipeline/scripts/validate-schemas.mjs && node pipeline/scripts/validate-prefs.mjs && node pipeline/scripts/scorecard.mjs",
+    "test": "npm run format:check && npm run lint && node --test test/*.test.mjs && node pipeline/scripts/run-smokes.mjs && node pipeline/scripts/lint-skills.mjs && node pipeline/scripts/lint-personas.mjs && node pipeline/scripts/lint-mcp-refs.mjs && node pipeline/scripts/eval-triage.mjs && node pipeline/scripts/eval-golden-tasks.mjs && node pipeline/scripts/eval-intent.mjs && node pipeline/scripts/eval-recall.mjs && node pipeline/scripts/validate-schemas.mjs && node pipeline/scripts/validate-prefs.mjs && node pipeline/scripts/scorecard.mjs",
     "test:unit": "node --test test/*.test.mjs",
     "test:smoke": "node pipeline/scripts/run-smokes.mjs",
     "lint:skills": "node pipeline/scripts/lint-skills.mjs",
@@ -25,6 +25,7 @@
     "format": "prettier --write \"**/*.{js,mjs,json,yml}\" --ignore-path .gitignore --ignore-path .prettierignore",
     "format:check": "prettier --check \"**/*.{js,mjs,json,yml}\" --ignore-path .gitignore --ignore-path .prettierignore",
     "scorecard": "node pipeline/scripts/scorecard.mjs",
+    "prepack": "node pipeline/scripts/make-manifest.mjs",
     "gate": "bash pipeline/scripts/pre-push-check.sh --run"
   },
   "keywords": [
@@ -69,6 +70,8 @@
   ],
   "files": [
     "index.js",
+    "manifest.json",
+    "manifest.sig",
     "install.js",
     "install/**/*",
     "pipeline/**/*",

package/pipeline/commands/multi-agent/status/SKILL.md

@@ -9,36 +9,49 @@ Show every active and completed task as a table.
 
 ## Steps
 
-1. **Detect the project**  -  find the repo root from cwd (otherwise scan every known repo):
-   - `~/my-ios-app/.worktrees/`
-   - `~/my-figma-app/.worktrees/`
-   - `~/my-ui-components/.worktrees/`
+1. **Ask the producer, do not go looking.** One command answers the whole
+   question:
 
-2. **Scan worktrees**  -  read `agent-state.json` in each worktree dir. **Also scan the log dir**, because a task whose PR is open has no worktree any more (Phase 6 removes it and salvages its state): `find $HOME/.claude/logs/multi-agent -maxdepth 4 -name agent-state.json -path '*/artifacts/*'`. (`-maxdepth 4`, not 3: Phase 6 always passes `--project`, so the salvaged copy lands at `<project>/<task-id>/artifacts/agent-state.json`, which a depth-3 scan can never reach.) Merge both sets by `taskId`, preferring the worktree copy when both exist, and render a finalized task with its `worktreeRemovedAt` rather than omitting it  -  a task that shipped should not vanish from status.
    ```bash
-   find {repo}/.worktrees/ -name "agent-state.json" -maxdepth 2
+   node "$HOME/.claude/scripts/runs-index.mjs"          # grouped table
+   node "$HOME/.claude/scripts/runs-index.mjs" --json   # the same records
    ```
 
-3. **Parse state**  -  for each task:
-   - `taskId`, `branch`, `currentPhase`, `status`, `startedAt`, `autopilot`
-
-3b. **Sort into three groups, and label them.** `in_progress` alone cannot tell
-   a run that is waiting for you from one that died, and on this machine that
-   difference covered 20 runs: 3 were holding at Phase 6/7 with their PR already
-   open, 11 were left at a Phase 0 question with nothing built, 6 stopped
-   mid-development. One "in progress" label for all three is what made a
-   finished job and a crashed one share a row.
+   `runs-index.mjs` resolves through `lib/run-paths.sh` / `scripts/_run-paths.mjs`,
+   so it sees both directory layouts (`<project>/<id>/` and the flat `<id>/`),
+   the salvaged `artifacts/` copy Phase 6 leaves behind, and every spelling of a
+   task id - and it counts a run that exists in both layouts once. Do NOT
+   re-scan the tree by hand: the earlier instruction here listed three
+   hard-coded `.worktrees/` paths and a single `find` depth, and on a real
+   install that combination missed a quarter of the runs and double-counted
+   others. It also scanned worktrees for `agent-state.json`, which Phase 0 has
+   never written there ("never inside the worktree", `phases/phase-0-init.md`).
+
+   The JSON and the table are rendered from the same records, so a dashboard and
+   this command cannot disagree.
+
+2. **Fields per run** (already in the output): `taskId`, `project`, `branch`,
+   `currentPhase`, `status`, `startedAt`, `worktreePath`, `prUrl`, `autopilot`,
+   `phases[]`, `tokens`, `estUsd`, `group`, plus `duplicateOf` when the run also
+   exists in the other layout and `salvaged` when its state is the Phase 6 copy.
+
+3. **Groups are computed, not judged.** `runs-index.mjs` assigns `group` by the
+   table below; report what it returns rather than re-deriving it. `in_progress`
+   alone cannot tell a run that is waiting for you from one that died, and on
+   this machine that difference covered 21 runs.
 
    | Group | Test | Action offered |
    |---|---|---|
-   | Waiting on you | `status == "awaiting_input"`, or a `pr.url`, or phase 6/7 | `resume #N` - the work landed, it needs your answer |
-   | Stopped mid-development | anything else past phase 0 | `resume #N` or `kill #N` |
-   | Left at a question | phase 0 | `garbage-collect --abandoned` - nothing was built |
+   | `waiting` - Waiting on you | `status == "awaiting_input"`, or a `pr.url`, or phase >= 6 | `resume #N` - the work landed, it needs your answer |
+   | `stopped` - Stopped mid-development | anything else past phase 0 | `resume #N` or `kill #N` |
+   | `question` - Left at a question | phase 0 | `garbage-collect --abandoned` - nothing was built |
+   | `unknown` - Status not recorded | no `status` field | say so; offer nothing |
 
-   A run with no `status` is **not** placed in any group. Unknown is not a
-   finding, and calling it dead is the same false claim in the other direction.
+   A run with no `status` is **not** placed in an actionable group. Unknown is
+   not a finding, and calling it dead is the same false claim in the other
+   direction.
 
-4. **Render as a table**, grouped per 3b, with the group as a section heading:
+4. **Render as a table**, grouped per step 3, with the group as a section heading:
    ```
    🤖 Multi-Agent Tasks
 
@@ -59,6 +72,24 @@ Show every active and completed task as a table.
 
    Report `N lesson(s) minable from transcripts  -  /multi-agent:refactor to review` and `N open pipeline observation(s)` when either count is above zero, and print nothing when both are zero. Neither runs a model and neither writes anything: the miner is dry-run by default. Zero candidates alongside a non-zero `toolResultsExamined` means there is nothing to find; zero of both means the read is broken, and that is worth saying rather than reporting a clean queue.
 
+7. **What the spend is doing** (one line, and only when there is something to
+   say). `cost-budget-check.mjs` watches ONE run against ONE ceiling, which is
+   blind to the two ways a budget actually empties: a drift no single run trips,
+   and one pathological session that burns a week in an hour while every run
+   stays under its cap.
+
+   ```bash
+   node "$HOME/.claude/scripts/cost-analyze.mjs" burn --json 2>/dev/null
+   node "$HOME/.claude/scripts/cost-analyze.mjs" anomaly --days 30 --json 2>/dev/null
+   ```
+
+   Report a line only when either exits 10 - an accelerating day, or a day out
+   of family - and say nothing otherwise. The figures are estimates priced from
+   `cost-table.json` at LIST price, so on a subscription they are the right
+   number for comparing days to each other and the wrong number to call a bill;
+   say which when quoting one. `UNMEASURED` means the transcripts could not be
+   read, and it is reported as that rather than as zero.
+
 5. **Quick command hints**  -  based on state:
    - Paused task → suggest `resume #N`
    - Done task → suggest `log #N`

package/pipeline/lib/_jira-auth.sh

@@ -40,6 +40,14 @@ JIRA_AUTH_PREFS="${JIRA_AUTH_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
 
 _jira_auth_pref() {  # _jira_auth_pref <jq path> -> value or empty
   [ -f "$JIRA_AUTH_PREFS" ] || { printf ''; return 0; }
+  # Without jq this printed empty and returned 0, so "no jq" and "key not set"
+  # were the same answer and the caller went on to authenticate with nothing -
+  # surfacing much later as a 401 that blames the credential.
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "jq not found - cannot read $JIRA_AUTH_PREFS (install: brew install jq)" >&2
+    printf ''
+    return 3
+  fi
   jq -r "$1 // empty" "$JIRA_AUTH_PREFS" 2>/dev/null || printf ''
 }
 

package/pipeline/lib/analysis-jira-write.sh

@@ -125,6 +125,30 @@ fi
 # back in CREATED_KEY. Returning the key on stdout too meant a caller using
 # command substitution swallowed the report - the first dry run printed a header
 # and nothing else, and the tree looked empty.
+# Same gate, same five candidate paths, same refusal as jira-publish.sh and
+# post-pr-review.sh. This file is the only ISSUE-CREATION path in the tree, and
+# a summary plus a description is outbound text like any other - it was the one
+# writer the gate did not cover.
+ma_outbound_gate_text() {
+  local text="$1" og="" tmp rc
+  for c in "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/outbound-gate.mjs" \
+           "$HOME/.claude/lib/outbound-gate.mjs" \
+           "$HOME/.copilot/lib/outbound-gate.mjs" \
+           "$HOME/.codex/lib/outbound-gate.mjs"; do
+    [ -f "$c" ] && { og="$c"; break; }
+  done
+  if [ -z "$og" ]; then
+    echo "outbound-gate.mjs not found - refusing to create unchecked issues." >&2
+    return 7
+  fi
+  tmp="$(mktemp)"
+  printf '%s' "$text" > "$tmp"
+  node "$og" --file "$tmp"
+  rc=$?
+  rm -f "$tmp"
+  return $rc
+}
+
 CREATED_KEY=""
 create_issue() {  # create_issue <label> <summary> <issuetype> <parentKey|""> <description>
   local label="$1" summary="$2" itype="$3" parent="$4" desc="$5" body key existing
@@ -146,6 +170,14 @@ create_issue() {  # create_issue <label> <summary> <issuetype> <parentKey|""> <d
     echo "  create  $itype  $summary   [$label]"
     return 0
   fi
+  # After the dry-run branch, because a dry run publishes nothing, and before
+  # the ledger line, because an intent recorded for a POST that never happens
+  # is a false entry in the only record of what was attempted.
+  if ! ma_outbound_gate_text "$summary
+$desc"; then
+    echo "ERR: outbound gate refused '$summary'; nothing was created" >&2
+    return 1
+  fi
   ledger intent "$label"
   local resp
   resp="$(printf '%s' "$body" | jira_api POST "/rest/api/2/issue" --data @- || echo "")"

package/pipeline/lib/ask-choice.sh

@@ -14,6 +14,9 @@
 #
 # Non-interactive / autopilot / CI:
 #   - ASK_CHOICE_DEFAULT=<label-or-1based-index>  picks without prompting.
+#   - MULTI_AGENT_UNATTENDED=1 means nobody is watching even if a terminal is
+#     attached (screen, tmux, a login shell on a server). Same resolution as
+#     the no-TTY case.
 #   - If stdin is not a TTY and no default is set, the FIRST option is chosen
 #     and a notice is written to stderr (never blocks an automated run).
 #
@@ -64,8 +67,16 @@ if [ -n "${ASK_CHOICE_DEFAULT:-}" ]; then
 fi
 
 # Non-interactive with no usable default: pick the first option, don't block.
-if [ ! -t 0 ]; then
-  echo "ask-choice: no TTY and no ASK_CHOICE_DEFAULT - selecting first option '${OPTIONS[0]}'" >&2
+#
+# "No TTY" is the usual shape of that, but it is not the only one. A server run
+# under screen, tmux or a login shell HAS a terminal and still has nobody in
+# front of it, and there the TTY test says "ask" and the process waits forever.
+# MULTI_AGENT_UNATTENDED=1 is the operator saying so out loud; see
+# refs/unattended-contract.md. Unset, nothing below changes.
+if [ ! -t 0 ] || [ "${MULTI_AGENT_UNATTENDED:-}" = "1" ]; then
+  why="no TTY"
+  [ "${MULTI_AGENT_UNATTENDED:-}" = "1" ] && why="MULTI_AGENT_UNATTENDED=1"
+  echo "ask-choice: $why and no ASK_CHOICE_DEFAULT - selecting first option '${OPTIONS[0]}'" >&2
   printf '%s\n' "${OPTIONS[0]}"
   exit 0
 fi

package/pipeline/lib/autopilot-state.sh

@@ -133,6 +133,14 @@ ma_ap_read() { # $1 = filename; empty and exit 1 when absent
 # jq with a default, so a caller never has to distinguish "key absent" from
 # "file absent" from "file unparseable" - all three mean "use the default".
 ma_ap_cfg() { # $1 = jq path, $2 = default
+  # An unreadable queue must not read as an EMPTY queue. Without this, a
+  # machine with no jq made the runner conclude there was no work and go
+  # quiet - the worst failure this mode can have, because it looks like
+  # success.
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "jq not found - cannot read the autopilot config (install: brew install jq)" >&2
+    return 3
+  fi
   local v
   v=$(ma_ap_read config.json 2>/dev/null | jq -r "$1 // empty" 2>/dev/null)
   [ -n "$v" ] && printf '%s\n' "$v" || printf '%s\n' "$2"

package/pipeline/lib/fatal.mjs

@@ -0,0 +1,129 @@
+/**
+ * fatal.mjs  -  one line instead of a stack dump, and whatever was held gets
+ * released.
+ *
+ * Node's default for an uncaught throw or a rejected promise nobody awaited is
+ * a stack trace on stderr and exit 1. That is the right default for a library
+ * and the wrong one here for two reasons.
+ *
+ * The first is legibility. Every script in this tree reports its own failures
+ * as `name: what went wrong`, one line, and a caller - a shell gate, a phase
+ * step, a person reading a run log - is written against that shape. A stack
+ * dump in the middle of it reads as a crash of the pipeline rather than as a
+ * failure of one step, and the actual message sits four frames down.
+ *
+ * The second is state, and it is the one that costs something. A script that
+ * dies between acquiring an advisory lock and releasing it leaves the lock on
+ * disk. The next writer then waits out the full acquire window before deciding
+ * the holder is stale - and if it judges wrong it takes a lock a LIVE writer
+ * holds. `cleanup` exists for exactly that: the handler releases before it
+ * exits, so the abnormal path leaves the same state behind as the normal one.
+ *
+ * What this does NOT do is swallow anything. Every path still exits non-zero,
+ * and the message still names the error; only the stack goes, and only when
+ * the error carries a message worth reading on its own.
+ *
+ * Usage:
+ *   import { runMain } from "../lib/fatal.mjs";
+ *   runMain("write-state", main, { cleanup: releaseLock });
+ *
+ * @module pipeline/lib/fatal
+ */
+
+/** Guards against a cleanup that runs twice when a throw follows a rejection. */
+let cleanedUp = false;
+
+/**
+ * Run `cleanup` at most once, and never let it become the failure it is
+ * cleaning up after: a cleanup that throws inside a fatal handler replaces the
+ * original error with its own, which is how a lock bug ends up reported as a
+ * permissions bug.
+ *
+ * @param {(() => void)|undefined} cleanup
+ */
+function runCleanup(cleanup) {
+  if (cleanedUp || typeof cleanup !== "function") return;
+  cleanedUp = true;
+  try {
+    cleanup();
+  } catch {
+    // Deliberately silent. The caller is already exiting with the real error.
+  }
+}
+
+/**
+ * The message a human should see. An Error with a message prints the message;
+ * anything else (a thrown string, a rejected non-Error) prints its own
+ * stringification, because dropping it would leave the line with nothing in it.
+ *
+ * @param {unknown} err
+ * @returns {string}
+ */
+function describe(err) {
+  if (err instanceof Error && err.message) return err.message;
+  if (typeof err === "string" && err) return err;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return String(err);
+  }
+}
+
+/**
+ * Catch what escapes: a rejected promise nobody awaited, and a throw from a
+ * callback that no try/catch surrounds. Both are invisible to a try/catch
+ * around main(), which is why wrapping main() alone is not enough.
+ *
+ * MULTI_AGENT_FATAL_STACK=1 restores the stack for debugging. It is off by
+ * default because the line is for the person running the pipeline, not for the
+ * person maintaining it.
+ *
+ * @param {{name:string, cleanup?:()=>void, code?:number}} opts
+ */
+export function installFatalHandlers({ name, cleanup, code = 1 }) {
+  const report = (kind, err) => {
+    runCleanup(cleanup);
+    // `runs-index.mjs --json | head` is not a failure: head closes the pipe and
+    // the next write raises EPIPE. Reporting it as a fatal would turn the most
+    // ordinary way of looking at a large output into a red line and a non-zero
+    // exit, and the reader that went away is not listening to the complaint
+    // anyway. Quiet, zero, the way every other CLI treats it.
+    if (err && err.code === "EPIPE") process.exit(0);
+    process.stderr.write(`${name}: ${kind}  -  ${describe(err)}\n`);
+    if (process.env.MULTI_AGENT_FATAL_STACK === "1" && err instanceof Error && err.stack) {
+      process.stderr.write(`${err.stack}\n`);
+    }
+    // exit(), not exitCode: the event loop may hold a listener that would keep
+    // the process alive after the failure, and a script that has already
+    // reported a fatal must not go on to do more work.
+    process.exit(code);
+  };
+  process.on("unhandledRejection", (err) => report("unhandled rejection", err));
+  process.on("uncaughtException", (err) => report("uncaught exception", err));
+}
+
+/**
+ * Install the handlers and run main, sync or async, with the same contract for
+ * both. A successful run is untouched: no exit call, so `process.exitCode` set
+ * inside main survives, and stdout drains the way it would have.
+ *
+ * @param {string} name        script name as it should appear in the message
+ * @param {() => unknown} main
+ * @param {{cleanup?:()=>void, code?:number}} [opts]
+ * @returns {Promise<void>}
+ */
+export async function runMain(name, main, opts = {}) {
+  const { cleanup, code = 1 } = opts;
+  installFatalHandlers({ name, cleanup, code });
+  try {
+    await main();
+  } catch (err) {
+    runCleanup(cleanup);
+    if (err && err.code === "EPIPE") process.exit(0);
+    process.stderr.write(`${name}: ${describe(err)}\n`);
+    if (process.env.MULTI_AGENT_FATAL_STACK === "1" && err instanceof Error && err.stack) {
+      process.stderr.write(`${err.stack}\n`);
+    }
+    process.exit(code);
+  }
+}

package/pipeline/lib/figma-mcp-refresh.sh

@@ -18,6 +18,24 @@
 
 set -euo pipefail
 
+# jq is not optional on this path. Without the guard below a missing binary
+# renders as EMPTY DATA and the work continues on it; see lib/require-jq.sh.
+for _rq in "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/require-jq.sh" \
+           "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/require-jq.sh" \
+           "$HOME/.claude/lib/require-jq.sh" \
+           "$HOME/.copilot/lib/require-jq.sh" \
+           "$HOME/.codex/lib/require-jq.sh"; do
+  [ -f "$_rq" ] || continue
+  # shellcheck source=/dev/null
+  . "$_rq" && break
+done
+unset _rq
+if ! command -v ma_require_jq >/dev/null 2>&1; then
+  # The helper itself is missing, which is an install problem, not a jq one.
+  ma_require_jq() { command -v jq >/dev/null 2>&1 || { echo "jq not found - cannot ${1:-continue}." >&2; return 1; }; }
+fi
+ma_require_jq "refresh the Figma MCP token" || exit 3
+
 PREFS_FILE="${PREFS_FILE:-$HOME/.claude/multi-agent-preferences.json}"
 TOKEN_ENDPOINT="https://api.figma.com/v1/oauth/token"
 

package/pipeline/lib/figma-screenshot.sh

@@ -39,6 +39,24 @@
 
 set -euo pipefail
 
+# jq is not optional on this path. Without the guard below a missing binary
+# renders as EMPTY DATA and the work continues on it; see lib/require-jq.sh.
+for _rq in "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/require-jq.sh" \
+           "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/require-jq.sh" \
+           "$HOME/.claude/lib/require-jq.sh" \
+           "$HOME/.copilot/lib/require-jq.sh" \
+           "$HOME/.codex/lib/require-jq.sh"; do
+  [ -f "$_rq" ] || continue
+  # shellcheck source=/dev/null
+  . "$_rq" && break
+done
+unset _rq
+if ! command -v ma_require_jq >/dev/null 2>&1; then
+  # The helper itself is missing, which is an install problem, not a jq one.
+  ma_require_jq() { command -v jq >/dev/null 2>&1 || { echo "jq not found - cannot ${1:-continue}." >&2; return 1; }; }
+fi
+ma_require_jq "fetch a Figma screenshot" || exit 3
+
 # --- Globals ----------------------------------------------------------------
 
 # Locate the resolver with an existence check, not a `.`-chain: sourcing a missing file

package/pipeline/lib/invoked-directly.mjs

@@ -0,0 +1,43 @@
+/**
+ * invoked-directly.mjs  -  "was this file run, or imported", answered correctly.
+ *
+ * The idiom this replaces was in nine files:
+ *
+ *     if (import.meta.url === `file://${process.argv[1]}`) main();
+ *
+ * It compares a RESOLVED, percent-encoded URL against a raw path, and it is
+ * false in three situations that are not exotic:
+ *
+ *   - a symlink. `install --link` symlinks whole directories into ~/.claude, so
+ *     every script a linked install runs is reached through one;
+ *   - a path that resolves elsewhere. On macOS /var is a symlink to /private/var,
+ *     which is where mktemp puts everything;
+ *   - a path containing a space, or any character a URL escapes.
+ *
+ * In all three the guard is false and the script does nothing, silently, exit 0.
+ * On `outbound-gate.mjs` that was a security hole rather than an inconvenience:
+ * the callers read exit 0 as "this text is clean", so a body carrying a token
+ * would have been published unscanned by any install that used --link.
+ *
+ * @module pipeline/lib/invoked-directly
+ */
+
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+/**
+ * True when `metaUrl` names the file Node was asked to run.
+ *
+ * @param {string} metaUrl the caller's own `import.meta.url`
+ * @returns {boolean}
+ */
+export function invokedDirectly(metaUrl) {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return metaUrl === pathToFileURL(realpathSync(entry)).href;
+  } catch {
+    // An argv[1] that cannot be resolved is not this file.
+    return false;
+  }
+}

package/pipeline/lib/jira-publish.sh

@@ -40,6 +40,47 @@
 
 set -euo pipefail
 
+# jq is not optional on this path. Without the guard below a missing binary
+# renders as EMPTY DATA and the work continues on it; see lib/require-jq.sh.
+for _rq in "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/require-jq.sh" \
+           "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/require-jq.sh" \
+           "$HOME/.claude/lib/require-jq.sh" \
+           "$HOME/.copilot/lib/require-jq.sh" \
+           "$HOME/.codex/lib/require-jq.sh"; do
+  [ -f "$_rq" ] || continue
+  # shellcheck source=/dev/null
+  . "$_rq" && break
+done
+unset _rq
+if ! command -v ma_require_jq >/dev/null 2>&1; then
+  # The helper itself is missing, which is an install problem, not a jq one.
+  ma_require_jq() { command -v jq >/dev/null 2>&1 || { echo "jq not found - cannot ${1:-continue}." >&2; return 1; }; }
+fi
+ma_require_jq "build the Jira comment" || exit 3
+
+# Outbound leak gate. Every byte below is composed at runtime out of command
+# output, error text and file excerpts, any of which can carry a token that was
+# on this machine a second earlier - and once it is in a comment it is in
+# someone else's database. The repo's own leak scanner looks at FILES IN THE
+# REPO and never sees this text. See lib/outbound-gate.mjs.
+ma_outbound_gate() {
+  local body_file="$1" og=""
+  for c in "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/outbound-gate.mjs" \
+           "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/outbound-gate.mjs" \
+           "$HOME/.claude/lib/outbound-gate.mjs" \
+           "$HOME/.copilot/lib/outbound-gate.mjs" \
+           "$HOME/.codex/lib/outbound-gate.mjs"; do
+    [ -f "$c" ] && { og="$c"; break; }
+  done
+  # Missing gate is NOT an open door: refusing to publish beats publishing
+  # unchecked, and the only way this file is absent is a broken install.
+  if [ -z "$og" ]; then
+    echo "outbound-gate.mjs not found - refusing to publish unchecked text." >&2
+    return 7
+  fi
+  node "$og" --file "$body_file"
+}
+
 SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
 PREFS="${MULTI_AGENT_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
 CURL="${JIRA_PUBLISH_CURL:-curl}"
@@ -73,6 +114,7 @@ done
 [ -n "$ISSUE" ] || die "usage: jira-publish.sh --issue KEY --body-file FILE [--target comment|description]"
 [ -n "$BODY_FILE" ] || die "usage: jira-publish.sh --issue KEY --body-file FILE [--target comment|description]"
 [ -f "$BODY_FILE" ] || die "body file not found: $BODY_FILE"
+ma_outbound_gate "$BODY_FILE" || die "outbound gate refused this comment; nothing was posted"
 case "$TARGET" in comment|description) ;; *) die "--target must be comment or description, got: $TARGET" ;; esac
 case "$MODE" in append|replace) ;; *) die "--mode must be append or replace, got: $MODE" ;; esac
 

package/pipeline/lib/md2confluence-v3.py

@@ -35,6 +35,7 @@ import argparse
 import html
 import io
 import json
+import tempfile
 import mimetypes
 import os
 import re
@@ -962,6 +963,10 @@ def cmd_create(args: argparse.Namespace) -> int:
         sys.stderr.write(json.dumps(envelope, indent=2, ensure_ascii=False) + "\n")
         return 0
 
+    # Every byte below this line leaves the machine. The dry-run branch above
+    # returns before it, which is why the gate sits here and not at the top.
+    outbound_gate(md_text)
+
     auth = resolve_auth()
     warnings = list(result.warnings)
 
@@ -1194,6 +1199,48 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+def outbound_gate(text: str) -> None:
+    """Refuse to publish text the leak gate has not cleared.
+
+    This is the choke point for the Confluence half of the pipeline's outbound
+    surface: a page is created or updated only from here, and everything above
+    is rendering. The gate itself is the same one the Jira and PR paths use -
+    one set of patterns, one verdict, rather than a second copy that drifts.
+
+    A missing gate file REFUSES. The only way it is absent is a broken install,
+    and publishing unchecked because the check could not be loaded is the single
+    failure this exists to prevent.
+    """
+    candidates = [
+        Path(__file__).resolve().parent / "outbound-gate.mjs",
+        Path.home() / ".claude" / "lib" / "outbound-gate.mjs",
+        Path.home() / ".copilot" / "lib" / "outbound-gate.mjs",
+        Path.home() / ".codex" / "lib" / "outbound-gate.mjs",
+    ]
+    gate = next((c for c in candidates if c.is_file()), None)
+    if gate is None:
+        sys.stderr.write("outbound-gate.mjs not found - refusing to publish unchecked text.\n")
+        raise SystemExit(2)
+
+    with tempfile.NamedTemporaryFile("w", suffix=".md", delete=False, encoding="utf-8") as fh:
+        fh.write(text)
+        tmp = fh.name
+    try:
+        proc = subprocess.run(
+            ["node", str(gate), "--file", tmp],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    finally:
+        os.unlink(tmp)
+    if proc.returncode != 0:
+        sys.stderr.write(proc.stdout)
+        sys.stderr.write(proc.stderr)
+        sys.stderr.write("outbound gate refused this page; nothing was published.\n")
+        raise SystemExit(2)
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = build_parser()
     args = parser.parse_args(argv)