@mmerterden/multi-agent-pipeline 17.6.0 → 18.0.0

package/pipeline/multi-agent-refs/phases/phase-0-init.md

@@ -514,7 +514,7 @@ done
 
 State file in multi-repo mode:
 - Single shared `agent-state.json` lives at `$HOME/.claude/logs/multi-agent/{first-project}/{task-id}/agent-state.json` (anchored on the first repo for back-compat with `multi-agent log`/`status` commands)
-- Every update to it, here and in every later phase, goes through `node $HOME/.claude/scripts/write-state.mjs`  -  the required mechanism in `operations.md` "Writing `agent-state.json`", and the race a per-repo read-modify-write loses `projects[]` entries to.
+- Every write to it, creation included, goes through `node $HOME/.claude/scripts/write-state.mjs`  -  the required mechanism in `operations.md` "Writing `agent-state.json`", and the race a per-repo read-modify-write loses `projects[]` entries to.
 - `state.projects[]` holds per-repo `{name, root, worktreePath, branch, baseBranch, identity, platform, baseFetchStatus, commit, pr, pushAttempts, buildStatus}`  -  see `agent-state.schema.json`
 - Scalar fields (`project`, `projectRoot`, `worktreePath`, `branch`, `baseBranch`, `identity`) mirror `projects[0]` so legacy phases that read scalars keep working
 - Atomicity: if any repo's worktree creation fails (collision aborted, fetch aborted, disk full), roll back already-created worktrees: `git -C $proj worktree remove --force $WT_PATH; git -C $proj branch -D $BRANCH`. Never leave a partial multi-repo state.

package/pipeline/multi-agent-refs/unattended-contract.md

@@ -0,0 +1,129 @@
+# Unattended contract (`MULTI_AGENT_UNATTENDED=1`)
+
+<!-- toc -->
+- [What the variable means](#what-the-variable-means)
+- [The three effects](#the-three-effects)
+- [What it does NOT do](#what-it-does-not-do)
+- [Who honours it](#who-honours-it)
+- [The model side already has a contract](#the-model-side-already-has-a-contract)
+- [Default behaviour is unchanged, and a gate says so](#default-behaviour-is-unchanged-and-a-gate-says-so)
+- [The permission posture](#the-permission-posture)
+<!-- /toc -->
+
+## What the variable means
+
+`MULTI_AGENT_UNATTENDED=1` is the operator stating that **nobody is watching
+this process**, and it is the only way to state it reliably.
+
+The usual test for that is `[ -t 0 ]`: no terminal, no human. It is wrong in
+both directions on a server. A run under `screen`, `tmux`, `ssh -t` or a login
+shell HAS a terminal and still has nobody in front of it, so the test says
+"ask" and the process waits for an answer that will never come - printing
+nothing, exiting never, and looking exactly like slow work. That is the failure
+this contract exists to remove, and it is not hypothetical: two setup scripts
+shipped that way.
+
+The variable is opt-in and defaults to absent. Nothing in this file describes
+behaviour that changes on a machine that does not set it.
+
+## The three effects
+
+**1. No prompt blocks.** Every shell entry point that asks a question either
+resolves it from a documented default or refuses with a reason on stderr and a
+non-zero exit. Waiting is never one of the outcomes. Refusing beats hanging:
+one of them can be read in a log.
+
+**2. Output is greppable.** Colour is off even when stdout is a terminal.
+ANSI escapes in a log file make it unsearchable, and on a server the terminal
+that is attached is not the one anyone reads.
+
+**3. A secret is never a prompt.** Credentials arrive through stdin or a file
+path, never through an interactive read and never through an environment
+variable. An env value is inherited by every child process and is visible to
+`ps e` on some systems; a pipe stays in the one process that needs it.
+
+## What it does NOT do
+
+- It does not grant permissions. An unattended run still needs a permission
+  posture, which is a separate opt-in (`install --unattended`) and a separate
+  doctor check.
+- It does not suppress errors. A run that cannot proceed still fails; it just
+  fails visibly instead of hanging.
+- It does not change any default. With the variable unset, every script below
+  behaves exactly as it did before this contract existed.
+
+## Who honours it
+
+Paths below are install-relative: `lib/` and `scripts/` under the host root,
+which is `~/.claude`, `~/.copilot` or `~/.codex` depending on the install. A
+ref that ships to users must not name a checkout path, because a run happens
+in the user's worktree and the checkout is not there.
+
+| Entry point | Without the variable | With `MULTI_AGENT_UNATTENDED=1` |
+|---|---|---|
+| `lib/ask-choice.sh` | TTY: renders the menu and reads. No TTY: first option, notice on stderr | First option (or `ASK_CHOICE_DEFAULT`), never prompts |
+| `scripts/github-ssh-setup.sh` | TTY: three questions. No TTY: refuses, naming `SSH_SETUP_EMAIL` | Refuses the same way even with a terminal |
+| `scripts/keychain-save.sh` | TTY: menu + secret prompt. No TTY: refuses, naming `--stdin` / `--json` | Refuses the same way even with a terminal |
+| `scripts/phase-banner.sh` | Colour when stdout is a TTY and `TERM != dumb` | Plain text |
+
+Anything not in this table does not read the variable. That is deliberate: a
+list of four that is true beats a claim of coverage that is not.
+
+## The model side already has a contract
+
+The prompt-level question - what an agent does when it would call
+`AskUserQuestion` and no one can answer - is `refs/picker-contract.md`, section
+"Autopilot / non-interactive contract", and it predates this file. It resolves
+from the remembered choice first, then the documented default, and records
+which rule fired so the run stays readable afterwards.
+
+The two are different layers and should not be merged. The picker contract
+governs a model deciding; this file governs a process waiting. A run on a
+server needs both, and only one of them can be enforced by a gate.
+
+## Default behaviour is unchanged, and a gate says so
+
+`smoke-unattended-profile.sh` (a maintainer gate, not shipped) asserts both directions. With the variable set,
+each entry point above resolves or refuses under a hard timeout. With it unset,
+each one produces byte-identical output to the behaviour it had before - the
+assertion that matters most, because the whole point is that a local
+interactive machine is not affected by any of this.
+
+## The permission posture
+
+Everything above concerns a process that would otherwise WAIT. There is a second
+way an unattended run stops, and it does not wait at all.
+
+autopilot spawns its child with `--permission-prompts none`. That stops Claude
+Code from ASKING; it grants nothing. The tools the child then calls still have
+to be allowed, and on a fresh machine they are not - so the run stops at the
+first tool call, with no prompt anywhere for a person to answer. From the
+outside it is indistinguishable from a queue with nothing to do.
+
+`install --unattended` writes the profile that closes it:
+
+```bash
+npx @mmerterden/multi-agent-pipeline install --unattended --dry-run   # show it
+npx @mmerterden/multi-agent-pipeline install --unattended             # write it
+```
+
+Three properties, each one a promise to somebody who did not ask for this:
+
+1. A DEFAULT install writes no permissions at all. Widening a permission set is
+   not something an installer does to a person who wanted files copied.
+2. The profile is printed in full, with a reason per line, BEFORE anything is
+   written. "The installer changed my permissions" must never be a thing
+   discovered afterwards.
+3. It is additive and idempotent. An entry a person added by hand survives, a
+   narrower rule is kept alongside, unrelated settings are untouched, and a
+   second run changes nothing. A `settings.json` that does not parse is refused
+   rather than overwritten.
+
+The entries are broad, and that breadth is what unattended operation costs
+rather than an oversight: a run builds and tests whatever the target repo uses,
+so an allowlist narrow enough to be interesting is one the first unfamiliar repo
+stops at. `doctor --profile=server` reports `unattended-permissions` against the
+same rule the writer applies, so the two cannot disagree.
+
+`smoke-unattended-install-profile.sh` asserts all of it, including that a plain
+install still writes nothing.

package/pipeline/scripts/_run-paths.mjs

@@ -0,0 +1,372 @@
+/**
+ * @file _run-paths.mjs  -  the single resolver for pipeline run-state paths.
+ *
+ * A run's files live under the log root in ONE of two layouts:
+ *
+ *   nested   <root>/<project>/<taskId>/     documented canonical; what
+ *                                           agent-state.json, purge.sh's
+ *                                           per-project .counter and
+ *                                           prune-logs.sh reason about
+ *   flat     <root>/<taskId>/               what phase-tracker.sh has always
+ *                                           written tracker-state.json to
+ *
+ * Both are real and both are populated, so every reader has to accept both.
+ * Before this module three callers hand-rolled their own candidate list -
+ * run-aggregator.mjs, render-cost-summary.sh and render-agent-log-cost.sh -
+ * and the single-level `<root>/*\/` globs elsewhere saw only one layout, so a
+ * run could be counted twice or missed entirely depending on which glob ran.
+ *
+ * This module does NOT change where anything is written. Measured on a real
+ * install, 90 of 103 runs are flat and every tracker-state.json is, so moving
+ * the writers would relocate the majority layout to satisfy a document. READS
+ * accept both, newest wins, and a taskId present in both layouts is ONE run,
+ * not two. Relocation is opt-in and explicit: `migrate-state.mjs --relocate`.
+ *
+ * Zero runtime dependencies (ADR-0004). Shell twin: pipeline/lib/run-paths.sh -
+ * the two must agree, and smoke-run-path-canonical.sh asserts that they do.
+ *
+ * @module pipeline/scripts/_run-paths
+ */
+
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+/**
+ * Files that mark a directory as a run directory rather than a project
+ * directory. A project directory holds run directories; a run directory holds
+ * at least one of these.
+ */
+export const RUN_MARKERS = ["agent-state.json", "tracker-state.json", "agent-log.md"];
+
+/**
+ * Depth-1 names under the log root that are namespaces, not runs and not
+ * projects. They are skipped by listRuns so a namespace never surfaces as a
+ * phantom run with no phase.
+ */
+export const RESERVED_DIRS = new Set([
+  "review-watch",
+  "jira-backups",
+  "shadow-git",
+  "_analysis-jira",
+  "prompts",
+]);
+
+/**
+ * The log root. LOGS_ROOT overrides it, which is what the smokes use so they
+ * never touch a real run.
+ *
+ * @returns {string}
+ */
+export function logsRoot() {
+  return process.env.LOGS_ROOT || join(homedir(), ".claude", "logs", "multi-agent");
+}
+
+/**
+ * The path a NEW run's files should be written to.
+ *
+ * @param {string} taskId
+ * @param {string|null|undefined} project  omitted only when the project is
+ *   genuinely unknown, which yields the flat path rather than inventing a slug
+ * @returns {string}
+ */
+export function canonicalRunDir(taskId, project) {
+  const root = logsRoot();
+  return project ? join(root, project, taskId) : join(root, taskId);
+}
+
+/**
+ * Phase 6 removes the worktree and salvages the run's files into an
+ * `artifacts/` subdirectory of the same run directory. A finished run therefore
+ * keeps its state one level deeper, and a reader that only looks at the top
+ * level reports a shipped task as having no state at all.
+ */
+export const ARTIFACTS_SUBDIR = "artifacts";
+
+function isRunDir(dir) {
+  if (RUN_MARKERS.some((m) => existsSync(join(dir, m)))) return true;
+  return RUN_MARKERS.some((m) => existsSync(join(dir, ARTIFACTS_SUBDIR, m)));
+}
+
+/**
+ * Newest marker mtime in WHOLE SECONDS.
+ *
+ * Seconds, not milliseconds, because the shell twin can only read seconds
+ * (`stat -c %Y` / `stat -f %m`). Comparing at different precisions made the two
+ * implementations pick different winners for a run written to both layouts
+ * within the same second - which is the common case, since both writes happen
+ * in one Phase 0.
+ */
+function newestMarkerMtime(dir) {
+  let newest = 0;
+  for (const base of [dir, join(dir, ARTIFACTS_SUBDIR)]) {
+    for (const m of RUN_MARKERS) {
+      try {
+        const t = Math.floor(statSync(join(base, m)).mtimeMs / 1000);
+        if (t > newest) newest = t;
+      } catch {
+        // Marker absent or unreadable - not every run has all three.
+      }
+    }
+  }
+  return newest;
+}
+
+/**
+ * Total order over candidate directories for one task id. Negative when `a`
+ * should win.
+ *
+ * mtime alone is not an order: two directories written in the same second tie,
+ * and both implementations then fell back to their own traversal order and
+ * disagreed. The tail of this comparator exists so the answer is defined:
+ * richer record first (agent-state.json is what every reader actually wants),
+ * then the documented nested layout, then the path itself.
+ */
+function compareCandidates(a, b) {
+  // A bridge and its target hold the same bytes, so neither is "newer". Prefer
+  // the real directory: a reader that reports a path should report the one the
+  // file actually lives in.
+  const aBridge = isBridgeDir(a) ? 1 : 0;
+  const bBridge = isBridgeDir(b) ? 1 : 0;
+  if (aBridge !== bBridge) return aBridge - bBridge;
+  const byTime = newestMarkerMtime(b) - newestMarkerMtime(a);
+  if (byTime !== 0) return byTime;
+  const aState = existsSync(join(a, "agent-state.json")) ? 1 : 0;
+  const bState = existsSync(join(b, "agent-state.json")) ? 1 : 0;
+  if (aState !== bState) return bState - aState;
+  const aNested = a.split("/").length;
+  const bNested = b.split("/").length;
+  if (aNested !== bNested) return bNested - aNested;
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+/**
+ * Every directory a run with this id could live in, most-specific first.
+ * Existence is NOT checked - this is the candidate list; resolveRunDir picks.
+ *
+ * @param {string} taskId
+ * @param {string|null|undefined} project
+ * @returns {string[]}
+ */
+export function runDirCandidates(taskId, project) {
+  const root = logsRoot();
+  const out = [];
+  if (project) out.push(join(root, project, taskId));
+  out.push(join(root, taskId));
+  if (!project) {
+    // No project given: the run may still be nested under one. Scan depth-1
+    // directories for a child with this id rather than failing the lookup.
+    let entries;
+    try {
+      entries = readdirSync(root, { withFileTypes: true });
+    } catch {
+      return out;
+    }
+    for (const e of entries) {
+      if (!e.isDirectory() || RESERVED_DIRS.has(e.name) || e.name === taskId) continue;
+      const cand = join(root, e.name, taskId);
+      if (isRunDir(cand)) out.push(cand);
+    }
+  }
+  return out;
+}
+
+/**
+ * The directory holding this run's files, or null when the run is unknown.
+ * When a taskId exists in more than one layout the most recently written one
+ * wins, so a resumed run is not read from its stale twin.
+ *
+ * @param {string} taskId
+ * @param {string|null|undefined} [project]
+ * @returns {string|null}
+ */
+export function resolveRunDir(taskId, project) {
+  const present = runDirCandidates(taskId, project).filter(isRunDir);
+  if (!present.length) return null;
+  if (present.length === 1) return present[0];
+  return present.slice().sort(compareCandidates)[0];
+}
+
+/**
+ * The spellings one task id has been written under, in preference order.
+ *
+ * `#316` reaches the pipeline from a GitHub issue reference, `316` from the
+ * bare-number input class, and `task-316` from an older directory convention.
+ * Callers used to inline this list; centralising it is the point of this
+ * module, and dropping any spelling would silently stop resolving old runs.
+ *
+ * @param {string} id
+ * @returns {string[]} unique, order-preserving
+ */
+export function taskIdVariants(id) {
+  const raw = String(id);
+  const bare = raw.replace(/^#/, "");
+  return [...new Set([raw, bare, `task-${bare}`])];
+}
+
+/**
+ * resolveRunDir over every spelling of the id, first hit wins.
+ *
+ * @param {string} taskId
+ * @param {string|null|undefined} [project]
+ * @returns {string|null}
+ */
+export function resolveRunDirAny(taskId, project) {
+  for (const v of taskIdVariants(taskId)) {
+    const dir = resolveRunDir(v, project);
+    if (dir) return dir;
+  }
+  return null;
+}
+
+/**
+ * The full path to one of a run's files, or null when the run is unknown.
+ * Every spelling of the id is tried.
+ *
+ * @param {string} taskId
+ * @param {string} filename  e.g. "agent-state.json"
+ * @param {string|null|undefined} [project]
+ * @returns {string|null}
+ */
+export function resolveRunFile(taskId, filename, project) {
+  for (const v of taskIdVariants(taskId)) {
+    const dir = resolveRunDir(v, project);
+    if (!dir) continue;
+    // Top level first, then the salvaged copy Phase 6 leaves behind.
+    for (const base of [dir, join(dir, ARTIFACTS_SUBDIR)]) {
+      const p = join(base, filename);
+      if (existsSync(p)) return p;
+    }
+  }
+  return null;
+}
+
+/**
+ * True when two candidate directories are two views of ONE record rather than
+ * two copies of it.
+ *
+ * Some nested run directories are symlink bridges into the flat copy - a
+ * previous attempt to reconcile the two layouts. Counting those as duplicates
+ * overstates the drift (21 reported, 18 real on the install this was measured
+ * on) and makes "which one is newer" a question about a link's own mtime.
+ *
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function isSameRecord(a, b) {
+  for (const m of RUN_MARKERS) {
+    try {
+      if (realpathSync(join(a, m)) === realpathSync(join(b, m))) return true;
+    } catch {
+      // Marker missing on one side - try the next one.
+    }
+  }
+  return false;
+}
+
+/**
+ * True when any marker in this directory is itself a symlink.
+ *
+ * lstat on the LEAF, not a realpath comparison: realpath also resolves parent
+ * directories, and on macOS a temp tree under /var is reached through a symlink
+ * to /private/var, so realpath(x) !== x is true for every path there. That made
+ * both sides of a pair look like bridges, the rule collapsed, and the two
+ * implementations picked different winners. The shell twin tests `[ -L ]`, and
+ * this has to mean the same thing.
+ */
+function isBridgeDir(dir) {
+  for (const m of RUN_MARKERS) {
+    try {
+      if (lstatSync(join(dir, m)).isSymbolicLink()) return true;
+    } catch {
+      // Missing marker is not a bridge.
+    }
+  }
+  return false;
+}
+
+function readProjectHint(dir) {
+  // agent-state.json v2.1.0 mirrors projects[0] onto scalars; older revisions
+  // carry `project` as a string or an object with a name. Take whichever is a
+  // non-empty string and do not guess beyond that.
+  const statePath = existsSync(join(dir, "agent-state.json"))
+    ? join(dir, "agent-state.json")
+    : join(dir, ARTIFACTS_SUBDIR, "agent-state.json");
+  try {
+    const s = JSON.parse(readFileSync(statePath, "utf-8"));
+    const cands = [s.projectSlug, s.project?.name, s.project, s.projects?.[0]?.name];
+    for (const c of cands) if (typeof c === "string" && c.trim()) return c.trim();
+  } catch {
+    // No state file, or malformed - the layout still tells us what it can.
+  }
+  return null;
+}
+
+/**
+ * Every run under the log root, both layouts, deduplicated by task id.
+ *
+ * A task id present in both layouts collapses to one entry - chosen by
+ * compareCandidates - with `duplicateOf` naming the other so a caller can
+ * report the drift instead of silently hiding it.
+ *
+ * `project` is derived from the LAYOUT alone, so the shell twin can produce the
+ * same four columns without parsing JSON (it has no jq guarantee). Anything
+ * read out of the state file is `projectHint`, a JS-only enrichment that
+ * runs-index.mjs uses and the cross-implementation contract does not cover.
+ *
+ * Ordering is byte-wise, not locale-aware, for the same reason: `sort` in the
+ * twin is byte-wise, and a collation difference is a diff nobody can act on.
+ *
+ * @returns {{taskId:string,project:string|null,dir:string,layout:"nested"|"flat",duplicateOf:string|null,projectHint:string|null}[]}
+ */
+export function listRuns() {
+  const root = logsRoot();
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+
+  /** @type {Map<string, {taskId:string,project:string|null,dir:string,layout:"nested"|"flat",duplicateOf:string|null}>} */
+  const byId = new Map();
+
+  const offer = (taskId, project, dir, layout) => {
+    const prev = byId.get(taskId);
+    if (!prev) {
+      byId.set(taskId, { taskId, project, dir, layout, duplicateOf: null });
+      return;
+    }
+    const keepNew = compareCandidates(dir, prev.dir) < 0;
+    const winner = keepNew ? { taskId, project, dir, layout } : prev;
+    const loserDir = keepNew ? prev.dir : dir;
+    // A symlink bridge is one record seen twice, not drift worth reporting.
+    const dup = isSameRecord(dir, prev.dir) ? (prev.duplicateOf ?? null) : loserDir;
+    byId.set(taskId, { ...winner, duplicateOf: dup });
+  };
+
+  for (const e of entries) {
+    if (!e.isDirectory() || RESERVED_DIRS.has(e.name)) continue;
+    const dir = join(root, e.name);
+    if (isRunDir(dir)) {
+      offer(e.name, null, dir, "flat");
+      continue;
+    }
+    let kids;
+    try {
+      kids = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const k of kids) {
+      if (!k.isDirectory()) continue;
+      const kd = join(dir, k.name);
+      if (isRunDir(kd)) offer(k.name, e.name, kd, "nested");
+    }
+  }
+
+  return [...byId.values()]
+    .map((r) => ({ ...r, projectHint: r.project ?? readProjectHint(r.dir) }))
+    .sort((a, b) => (a.taskId < b.taskId ? -1 : a.taskId > b.taskId ? 1 : 0));
+}

package/pipeline/scripts/aggregate-metrics.mjs

@@ -221,12 +221,13 @@ const summary = {
   events_by_type: byEvent,
 };
 
+// An if/else chain rather than three blocks each ending in process.exit(0).
+// stdout to a pipe is asynchronous and process.exit() discards what has not
+// drained, so `aggregate-metrics.mjs --json | jq` read a payload cut at a
+// buffer boundary. Choosing the renderer with `else` needs no exit at all.
 if (opts.json) {
   console.log(JSON.stringify(summary, null, 2));
-  process.exit(0);
-}
-
-if (opts.markdown) {
+} else if (opts.markdown) {
   const lines = [];
   lines.push(`# Pipeline Metrics Summary`);
   lines.push(``);
@@ -288,74 +289,73 @@ if (opts.markdown) {
     );
   }
   console.log(lines.join("\n"));
-  process.exit(0);
-}
-
-// Plain-text rendering
-const fmt = (n) => (n === null ? " - " : String(n));
-console.log(`Multi-Agent Pipeline  -  metrics summary`);
-console.log(`source: ${summary.source}`);
-console.log(`events: ${summary.total_events} (${summary.parse_errors} parse errors)`);
-console.log(`unique tasks: ${summary.unique_tasks}`);
-console.log(``);
-console.log(`Reviews:`);
-console.log(`  completed:           ${summary.reviews_completed}`);
-console.log(`  cycles per task avg: ${summary.review_cycles.avg}`);
-console.log(`  cycles per task p95: ${summary.review_cycles.p95}`);
-console.log(``);
-console.log(`Triage classification (sum across all reviews):`);
-console.log(`  raw findings:        ${summary.triage_totals.raw}`);
-console.log(
-  `  accepted:            ${summary.triage_totals.accepted} (rate ${fmt(summary.triage_totals.accept_rate)})`,
-);
-console.log(`  deferred:            ${summary.triage_totals.deferred}`);
-console.log(
-  `  rejected:            ${summary.triage_totals.rejected} (rate ${fmt(summary.triage_totals.reject_rate)})`,
-);
-
-if (Object.keys(summary.edge_cases).length) {
+} else {
+  // Plain-text rendering
+  const fmt = (n) => (n === null ? " - " : String(n));
+  console.log(`Multi-Agent Pipeline  -  metrics summary`);
+  console.log(`source: ${summary.source}`);
+  console.log(`events: ${summary.total_events} (${summary.parse_errors} parse errors)`);
+  console.log(`unique tasks: ${summary.unique_tasks}`);
+  console.log(``);
+  console.log(`Reviews:`);
+  console.log(`  completed:           ${summary.reviews_completed}`);
+  console.log(`  cycles per task avg: ${summary.review_cycles.avg}`);
+  console.log(`  cycles per task p95: ${summary.review_cycles.p95}`);
   console.log(``);
-  console.log(`Triage edge cases:`);
-  for (const [k, v] of Object.entries(summary.edge_cases).sort((a, b) => b[1] - a[1])) {
-    console.log(`  ${k.padEnd(28)} ${v}`);
+  console.log(`Triage classification (sum across all reviews):`);
+  console.log(`  raw findings:        ${summary.triage_totals.raw}`);
+  console.log(
+    `  accepted:            ${summary.triage_totals.accepted} (rate ${fmt(summary.triage_totals.accept_rate)})`,
+  );
+  console.log(`  deferred:            ${summary.triage_totals.deferred}`);
+  console.log(
+    `  rejected:            ${summary.triage_totals.rejected} (rate ${fmt(summary.triage_totals.reject_rate)})`,
+  );
+
+  if (Object.keys(summary.edge_cases).length) {
+    console.log(``);
+    console.log(`Triage edge cases:`);
+    for (const [k, v] of Object.entries(summary.edge_cases).sort((a, b) => b[1] - a[1])) {
+      console.log(`  ${k.padEnd(28)} ${v}`);
+    }
   }
-}
 
-if (Object.keys(summary.rework_iterations).length) {
-  console.log(``);
-  console.log(`Phase 3 rework iterations:`);
-  for (const [it, n] of Object.entries(summary.rework_iterations).sort(
-    (a, b) => Number(a[0]) - Number(b[0]),
-  )) {
-    console.log(`  iteration ${it.padEnd(5)} ${n}`);
+  if (Object.keys(summary.rework_iterations).length) {
+    console.log(``);
+    console.log(`Phase 3 rework iterations:`);
+    for (const [it, n] of Object.entries(summary.rework_iterations).sort(
+      (a, b) => Number(a[0]) - Number(b[0]),
+    )) {
+      console.log(`  iteration ${it.padEnd(5)} ${n}`);
+    }
   }
-}
 
-if (Object.keys(summary.language_preference).length) {
-  console.log(``);
-  console.log(`Language preference (events tagged with lang=):`);
-  for (const [lang, n] of Object.entries(summary.language_preference)) {
-    console.log(`  ${lang.padEnd(8)} ${n}`);
+  if (Object.keys(summary.language_preference).length) {
+    console.log(``);
+    console.log(`Language preference (events tagged with lang=):`);
+    for (const [lang, n] of Object.entries(summary.language_preference)) {
+      console.log(`  ${lang.padEnd(8)} ${n}`);
+    }
   }
-}
 
-if (Object.keys(summary.cost_per_model).length) {
-  console.log(``);
-  console.log(`Cost / token telemetry (per model):`);
-  console.log(
-    `  ${"model".padEnd(20)} ${"calls".padStart(6)} ${"duration_ms".padStart(13)} ${"tokens_in".padStart(11)} ${"tokens_out".padStart(11)} ${"cached".padStart(11)} ${"cache%".padStart(7)}`,
-  );
-  for (const [m, t] of Object.entries(summary.cost_per_model).sort(
-    (a, b) => b[1].calls - a[1].calls,
-  )) {
-    const pct = t.cache_ratio === null ? " - " : `${Math.round(t.cache_ratio * 100)}%`;
+  if (Object.keys(summary.cost_per_model).length) {
+    console.log(``);
+    console.log(`Cost / token telemetry (per model):`);
+    console.log(
+      `  ${"model".padEnd(20)} ${"calls".padStart(6)} ${"duration_ms".padStart(13)} ${"tokens_in".padStart(11)} ${"tokens_out".padStart(11)} ${"cached".padStart(11)} ${"cache%".padStart(7)}`,
+    );
+    for (const [m, t] of Object.entries(summary.cost_per_model).sort(
+      (a, b) => b[1].calls - a[1].calls,
+    )) {
+      const pct = t.cache_ratio === null ? " - " : `${Math.round(t.cache_ratio * 100)}%`;
+      console.log(
+        `  ${m.padEnd(20)} ${String(t.calls).padStart(6)} ${String(t.duration_ms).padStart(13)} ${String(t.tokens_in).padStart(11)} ${String(t.tokens_out).padStart(11)} ${String(t.tokens_cached).padStart(11)} ${pct.padStart(7)}`,
+      );
+    }
+    const oc = summary.cache_reuse;
+    const ocPct = oc.cache_ratio === null ? " - " : `${Math.round(oc.cache_ratio * 100)}%`;
     console.log(
-      `  ${m.padEnd(20)} ${String(t.calls).padStart(6)} ${String(t.duration_ms).padStart(13)} ${String(t.tokens_in).padStart(11)} ${String(t.tokens_out).padStart(11)} ${String(t.tokens_cached).padStart(11)} ${pct.padStart(7)}`,
+      `  overall prompt-cache reuse: ${oc.tokens_cached} / ${oc.tokens_in + oc.tokens_cached} input tokens = ${ocPct}`,
     );
   }
-  const oc = summary.cache_reuse;
-  const ocPct = oc.cache_ratio === null ? " - " : `${Math.round(oc.cache_ratio * 100)}%`;
-  console.log(
-    `  overall prompt-cache reuse: ${oc.tokens_cached} / ${oc.tokens_in + oc.tokens_cached} input tokens = ${ocPct}`,
-  );
 }

package/pipeline/scripts/autopilot-arming.mjs

@@ -32,6 +32,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
 
 const ROOT = process.env.MA_AUTOPILOT_ROOT || join(homedir(), ".claude", "autopilot");
 const PREFS =
@@ -142,6 +143,6 @@ function main(argv) {
   return 0;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (invokedDirectly(import.meta.url)) {
   process.exit(main(process.argv));
 }