@mmerterden/multi-agent-pipeline 17.6.0 → 19.0.0

package/pipeline/scripts/gen-facts.mjs

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+/**
+ * @file gen-facts.mjs  -  the numbers the website is allowed to state, derived.
+ *
+ * The site carried its own copies: `ArchitectureContent.tsx` said "6 faz + 51
+ * komut" while the repo had six phases and sixty commands. Nobody noticed,
+ * because a number written into a React component is guarded by nothing. This
+ * is the same defect `smoke-phase-contract.sh` fixes inside the pipeline, and
+ * the fix is the same shape: one producer, everything else reads it.
+ *
+ * Source of truth per field:
+ *   phases        pipeline/schemas/phases.json  -  the phase contract itself
+ *   commandCount  a count of pipeline/commands/multi-agent/<name>/SKILL.md
+ *   skillCount    a count of pipeline/skills/shared/external/<name>/SKILL.md
+ *   toolCount     the toolkit's own tools/list response, when reachable
+ *   version       package.json
+ *
+ * Counts come from the filesystem at the moment of writing, never from a README
+ * or a previous version of this file.
+ *
+ * Usage:
+ *   node gen-facts.mjs                 write docs/facts.json
+ *   node gen-facts.mjs --check         exit 1 if the file on disk is stale
+ *   node gen-facts.mjs --stdout        print, write nothing
+ *
+ * Exit codes:
+ *   0  -  written, or up to date
+ *   1  -  --check found drift
+ *   2  -  a source could not be read (nothing is written)
+ */
+
+import { readFileSync, writeFileSync, readdirSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = join(HERE, "..", "..");
+const OUT = join(ROOT, "docs", "facts.json");
+
+function die(msg) {
+  console.error(`gen-facts: ${msg}`);
+  process.exit(2);
+}
+
+function countSkillDirs(rel) {
+  const dir = join(ROOT, rel);
+  if (!existsSync(dir)) die(`missing directory: ${rel}`);
+  return readdirSync(dir, { withFileTypes: true }).filter(
+    (e) => e.isDirectory() && existsSync(join(dir, e.name, "SKILL.md")),
+  ).length;
+}
+
+let contract;
+try {
+  contract = JSON.parse(readFileSync(join(ROOT, "pipeline", "schemas", "phases.json"), "utf8"));
+} catch (err) {
+  die(`cannot read the phase contract  -  ${err.message}`);
+}
+
+let pkg;
+try {
+  pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
+} catch (err) {
+  die(`cannot read package.json  -  ${err.message}`);
+}
+
+// The toolkit is a separate repo and may not be checked out beside this one.
+// Absent is reported as null rather than as a guess: a site that prints a stale
+// tool count is the problem this file exists to remove, and a made-up one is
+// worse than none.
+let toolCount = null;
+let toolkitVersion = null;
+const toolkitDir = join(ROOT, "..", "multi-agent-toolkit-mcp");
+if (existsSync(join(toolkitDir, "package.json"))) {
+  try {
+    toolkitVersion =
+      JSON.parse(readFileSync(join(toolkitDir, "package.json"), "utf8")).version ?? null;
+  } catch {
+    toolkitVersion = null;
+  }
+  // Asked of the server, not counted out of its source. Three tool families
+  // are defined in modules the main file only spreads in, so a regex over
+  // index.js returns a number that looks plausible and is wrong - the first
+  // version of this script said 2 when the answer was 99. tools/list is what
+  // a client actually receives, which is the number the site should print.
+  try {
+    const req =
+      [
+        JSON.stringify({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "initialize",
+          params: {
+            protocolVersion: "2024-11-05",
+            capabilities: {},
+            clientInfo: { name: "gen-facts", version: "1" },
+          },
+        }),
+        JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+        JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} }),
+      ].join("\n") + "\n";
+    const res = spawnSync(process.execPath, [join(toolkitDir, "index.js")], {
+      input: req,
+      encoding: "utf8",
+      timeout: 30000,
+    });
+    for (const line of (res.stdout || "").split("\n")) {
+      if (!line.trim()) continue;
+      let msg;
+      try {
+        msg = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (msg.id === 2 && Array.isArray(msg.result?.tools)) toolCount = msg.result.tools.length;
+    }
+  } catch {
+    toolCount = null;
+  }
+}
+
+const facts = {
+  $comment:
+    "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
+  generatedAt: new Date().toISOString().slice(0, 10),
+  version: pkg.version,
+  phaseSchema: contract.phaseSchema,
+  phases: contract.phases.map((p) => ({ id: p.id, name: p.name })),
+  phaseCount: contract.phases.length,
+  modes: Object.fromEntries(Object.entries(contract.modes).map(([k, v]) => [k, v.phases])),
+  commandCount: countSkillDirs("pipeline/commands/multi-agent"),
+  skillCount: countSkillDirs("pipeline/skills/shared/external"),
+  toolCount,
+  toolkitVersion,
+};
+
+const body = `${JSON.stringify(facts, null, 2)}\n`;
+
+if (process.argv.includes("--stdout")) {
+  process.stdout.write(body);
+  process.exit(0);
+}
+
+if (process.argv.includes("--check")) {
+  if (!existsSync(OUT)) {
+    console.error("gen-facts: docs/facts.json does not exist  -  run without --check");
+    process.exit(1);
+  }
+  const onDisk = JSON.parse(readFileSync(OUT, "utf8"));
+  const fresh = JSON.parse(body);
+  // generatedAt is a timestamp, not a fact: comparing it would fail every day.
+  delete onDisk.generatedAt;
+  delete fresh.generatedAt;
+  if (JSON.stringify(onDisk) !== JSON.stringify(fresh)) {
+    console.error(
+      "gen-facts: docs/facts.json is stale  -  run: node pipeline/scripts/gen-facts.mjs",
+    );
+    for (const k of Object.keys(fresh)) {
+      if (JSON.stringify(onDisk[k]) !== JSON.stringify(fresh[k])) {
+        console.error(
+          `  ${k}: on disk ${JSON.stringify(onDisk[k])}, derived ${JSON.stringify(fresh[k])}`,
+        );
+      }
+    }
+    process.exit(1);
+  }
+  console.log("gen-facts: docs/facts.json is current");
+  process.exit(0);
+}
+
+writeFileSync(OUT, body);
+console.log(
+  `gen-facts: wrote docs/facts.json (${facts.phaseCount} phases, ${facts.commandCount} commands, ${facts.skillCount} skills, ${facts.toolCount ?? "?"} tools)`,
+);

package/pipeline/scripts/gen-mode-dispatch.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { readFileSync } from "node:fs";
 /**
  * gen-mode-dispatch.mjs  -  emit the canonical Phase Tracker Contract block
  * for a given mode dispatch file (full / local / autopilot / analysis).
@@ -10,10 +11,10 @@
  * call, anti-pattern warning, and ref link are identical.
  *
  * Usage:
- *   node pipeline/scripts/gen-mode-dispatch.mjs --mode=full         # 0..7
- *   node pipeline/scripts/gen-mode-dispatch.mjs --mode=local        # 0/1/2/3/4/6/7 + local-mode caveat
- *   node pipeline/scripts/gen-mode-dispatch.mjs --mode=autopilot    # 0/1/2/3/4/6/7
- *   node pipeline/scripts/gen-mode-dispatch.mjs --mode=analysis     # 0/1/2/4/6/7 (no Dev, no Test)
+ *   node pipeline/scripts/gen-mode-dispatch.mjs --mode=full         # 0..5
+ *   node pipeline/scripts/gen-mode-dispatch.mjs --mode=local        # 0..5 + local-mode caveat
+ *   node pipeline/scripts/gen-mode-dispatch.mjs --mode=autopilot    # 0..5
+ *   node pipeline/scripts/gen-mode-dispatch.mjs --mode=analysis     # 0/1/3/4/5 (no Dev)
  *
  * v16.0.0 removed the four dev-* modes. Depth is no longer a command name: the
  * Phase 0 Step 7.5 picker asks Full or Short and sets `state.onlyDevelop`. That
@@ -35,22 +36,20 @@ const args = Object.fromEntries(
 
 const MODE = args.mode;
 
-const PHASE_NAMES = [
-  "0:Init",
-  "1:Analysis",
-  "2:Planning",
-  "3:Dev",
-  "4:Review",
-  "5:Test",
-  "6:Commit",
-  "7:Report",
-];
-
-// Phase 5 (User Test) checks out the change from the git worktree and hands it
-// to the user interactively. It therefore only runs when the mode is BOTH
-// interactive (not autopilot) AND worktree-backed (not local), which since
-// v16.0.0 leaves exactly one command: `/multi-agent` itself.
-const PHASE_NAMES_NO_TEST = PHASE_NAMES.filter((p) => p !== "5:Test");
+// The phase list has one owner: schemas/phases.json. This file used to restate
+// it, which is how eight independent copies came to exist. smoke-phase-contract.sh
+// holds every remaining copy to the same file.
+const CONTRACT = JSON.parse(
+  readFileSync(new URL("../schemas/phases.json", import.meta.url), "utf8"),
+);
+const PHASES = CONTRACT.phases;
+const modePhases = (name) =>
+  CONTRACT.modes[name].phases.map((id) => {
+    const p = PHASES.find((x) => x.id === id);
+    return `${p.id}:${p.name}`;
+  });
+
+const PHASE_NAMES = PHASES.map((p) => `${p.id}:${p.name}`);
 
 /**
  * Mode → phases + flag descriptor. The descriptor controls the autopilot /
@@ -59,21 +58,17 @@ const PHASE_NAMES_NO_TEST = PHASE_NAMES.filter((p) => p !== "5:Test");
  * `smoke-mode-dispatch-drift.sh` can byte-equal-diff each on-disk section
  * against its generator output.
  */
-const MODES = {
-  autopilot: { phases: PHASE_NAMES_NO_TEST, local: false, autopilot: true },
-  full: { phases: PHASE_NAMES, local: false, autopilot: false, depth: true },
-  local: { phases: PHASE_NAMES_NO_TEST, local: true, autopilot: false, depth: true },
-  "local-autopilot": { phases: PHASE_NAMES_NO_TEST, local: true, autopilot: true },
-  "full-local": { phases: PHASE_NAMES_NO_TEST, local: true, autopilot: false, depth: true },
-  // Analysis produces a document, not code: no Dev, no Test, and Phase 6
-  // publishes instead of committing. Same 8-phase contract, four of them
-  // reinterpreted.
-  analysis: {
-    phases: ["0:Init", "1:Analysis", "2:Planning", "4:Review", "6:Commit", "7:Report"],
-    local: false,
-    autopilot: false,
-  },
-};
+const MODES = Object.fromEntries(
+  Object.entries(CONTRACT.modes).map(([name, m]) => [
+    name,
+    {
+      phases: modePhases(name),
+      local: m.local,
+      autopilot: m.autopilot,
+      ...(m.depth ? { depth: true } : {}),
+    },
+  ]),
+);
 
 const spec = MODE ? MODES[MODE] : null;
 if (!spec) {
@@ -101,7 +96,7 @@ const modeLabel = MODE_LABELS[MODE] ?? `\`${MODE}\``;
 const skipNote =
   skippedIds.length > 0
     ? `${modeLabel} mode does NOT TaskCreate phases ${skippedIds.join("/")}  -  those are not part of the ${modeLabel} phase set (\`${spec.phases.join(" ")}\`). Only register tiles for the active set.`
-    : `${modeLabel} mode TaskCreates all 8 phases (no phase is skipped).`;
+    : `${modeLabel} mode TaskCreates all ${PHASES.length} phases (no phase is skipped).`;
 
 const orderingNote = `**All TaskCreate calls in a batch fire in strict phase-number order BEFORE any TaskUpdate is applied.** For ${modeLabel} that means: ${spec.depth ? `Phase 0 at Step -1, then the rest in ascending order at Step 7.5 (${phaseSequence} minus whatever the depth answer drops)` : phaseSequence}. The native widget renders by creation order, not by phase number  -  out-of-order calls produce visually scrambled tile stacks. Full ordering contract in \`$HOME/.claude/multi-agent-refs/tracker-contract.md\` section "TaskCreate ordering (strict)".`;
 
@@ -119,7 +114,7 @@ const banner = spec.autopilot
 // tiles beside the question that decides whether two of them run is the failure this
 // split exists to remove.
 const fullSet = spec.phases.filter((p) => p !== "0:Init");
-const shortSet = fullSet.filter((p) => Number(p.split(":")[0]) >= 3);
+const shortSet = fullSet.filter((p) => Number(p.split(":")[0]) >= 2);
 const loopFor = (list) =>
   `for p in ${list.map((x) => `"${x}"`).join(" ")}; do\n  bash $HOME/.claude/scripts/phase-tracker.sh add "\${p%%:*}" "\${p#*:}"\ndone`;
 

package/pipeline/scripts/gen-ref-toc.mjs

@@ -13,7 +13,7 @@
 //
 // Section level is DERIVED, not assumed. These files are not consistent: some
 // open at `##` and section at `###` (keychain.md), others open at `###` and
-// section at `##` (phases/phase-3-dev.md). The rule is the shallowest heading
+// section at `##` (phases/phase-2-dev.md). The rule is the shallowest heading
 // depth that occurs more than once - a depth used exactly once is a title, not
 // a section level.
 //

package/pipeline/scripts/github-ssh-setup.sh

@@ -1,16 +1,60 @@
 #!/bin/bash
 # GitHub SSH Key Oluşturma ve Kurulum Scripti
+#
+# HEADLESS: her soru bir env değişkeniyle önceden cevaplanabilir ve terminal
+# yoksa script SORMAZ. Üç `read -p` koruma olmadan duruyordu; bir launchd
+# ajanının ya da uzak bir kabuğun altında ilki sonsuza kadar bekler ve dışarı
+# hiçbir şey yazmaz, yani kurulum "asılı kaldı" diye görünür. Bir sunucuda
+# çalışması hedeflenen bir aracın sessizce beklemesi, açıkça reddetmesinden
+# kötüdür.
+#
+#   MULTI_AGENT_UNATTENDED=1  terminal olsa bile soru sorulmaz
+#   SSH_SETUP_EMAIL     anahtarın yorum alanına yazılacak e-posta (zorunlu)
+#   SSH_SETUP_OVERWRITE e|h  - var olan anahtarın üzerine yazılsın mı (varsayılan h)
+#   SSH_SETUP_TEST      e|h  - sonunda github.com'a bağlantı denensin mi (varsayılan h)
 
 set -euo pipefail
 
+# Soruyu sor, ama yalnız soracak birisi varsa. Terminal yoksa env'deki cevabı
+# kullan; o da yoksa boş dön ve kararı çağırana bırak.
+ask() {
+    local prompt="$1" preset="$2" __var="$3" reply=""
+    if [ -n "$preset" ]; then
+        printf '%s%s [env]\n' "$prompt" "$preset"
+        printf -v "$__var" '%s' "$preset"
+        return 0
+    fi
+    # "Terminal yok" başsızlığın olağan biçimi, tek biçimi değil: screen,
+    # tmux ya da bir sunucudaki login kabuğunun terminali VARDIR ve önünde
+    # kimse yoktur. MULTI_AGENT_UNATTENDED=1 operatörün bunu açıkça söylemesi;
+    # refs/unattended-contract.md. Tanımsızken hiçbir şey değişmez.
+    if [ ! -t 0 ] || [ "${MULTI_AGENT_UNATTENDED:-}" = "1" ]; then
+        printf -v "$__var" '%s' ""
+        return 0
+    fi
+    # EOF (Ctrl-D) is an answer, not a crash: without `|| true` `set -e`
+    # turns a user pressing Ctrl-D into an exit with no message at all.
+    read -r -p "$prompt" reply || true
+    printf -v "$__var" '%s' "$reply"
+}
+
 echo "=== GitHub SSH Key Kurulumu ==="
 echo ""
 
 # E-posta adresi al
-read -p "GitHub e-posta adresinizi girin: " EMAIL
+ask "GitHub e-posta adresinizi girin: " "${SSH_SETUP_EMAIL:-}" EMAIL
 
 if [ -z "$EMAIL" ]; then
-    echo "Hata: E-posta adresi boş olamaz."
+    if [ -t 0 ] && [ "${MULTI_AGENT_UNATTENDED:-}" != "1" ]; then
+        echo "Hata: E-posta adresi boş olamaz."
+    else
+        if [ "${MULTI_AGENT_UNATTENDED:-}" = "1" ]; then
+            echo "Hata: MULTI_AGENT_UNATTENDED=1 ve SSH_SETUP_EMAIL tanımlı değil." >&2
+        else
+            echo "Hata: terminal yok ve SSH_SETUP_EMAIL tanımlı değil." >&2
+        fi
+        echo "      Başsız çalıştırmak için: SSH_SETUP_EMAIL=you@example.com $0" >&2
+    fi
     exit 1
 fi
 
@@ -26,7 +70,9 @@ chmod 700 "$HOME/.ssh"
 if [ -f "$KEY_PATH" ]; then
     echo ""
     echo "Uyari: $KEY_PATH zaten mevcut."
-    read -p "Üzerine yazmak istiyor musunuz? (e/h): " OVERWRITE
+    # Varsayılan HAYIR. Başsız bir koşuda cevapsız kalan bir "üzerine yazayım
+    # mı" sorusunun güvenli tarafı, var olan anahtarı korumaktır.
+    ask "Üzerine yazmak istiyor musunuz? (e/h): " "${SSH_SETUP_OVERWRITE:-}" OVERWRITE
     if [ "$OVERWRITE" != "e" ]; then
         echo "İşlem iptal edildi."
         exit 0
@@ -36,7 +82,11 @@ fi
 # SSH key oluştur (Ed25519 - modern ve güvenli)
 echo ""
 echo "SSH key oluşturuluyor..."
-ssh-keygen -t ed25519 -C "$EMAIL" -f "$KEY_PATH" -N ""
+# ssh-keygen var olan bir dosyayı görünce KENDİ "Overwrite (y/n)?" sorusunu
+# sorar - yani yukarıdaki onayı geçtikten sonra başsız koşu ikinci bir
+# soruda asılır. Onay zaten alındı; dosyayı önce kaldır.
+rm -f "$KEY_PATH" "${KEY_PATH}.pub"
+ssh-keygen -t ed25519 -C "$EMAIL" -f "$KEY_PATH" -N "" -q
 
 echo ""
 echo "SSH key başarıyla oluşturuldu!"
@@ -66,7 +116,12 @@ EOF
 fi
 
 # Key'i agent'a ekle (macOS Keychain ile)
-ssh-add --apple-use-keychain "$KEY_PATH" 2>/dev/null || ssh-add "$KEY_PATH"
+# Agent yoksa ekleme başarısız olur; anahtar yazıldıktan sonra bunun için
+# çıkmak, kurulumu yarıda bırakıp kullanıcıya hiçbir sonraki adımı
+# göstermemek demek.
+ssh-add --apple-use-keychain "$KEY_PATH" 2>/dev/null \
+  || ssh-add "$KEY_PATH" 2>/dev/null \
+  || echo "[Uyari: anahtar ssh-agent'a eklenemedi  -  elle: ssh-add $KEY_PATH]"
 
 # Public key'i göster ve kopyala
 echo ""
@@ -97,11 +152,13 @@ echo "4. 'Add SSH key' butonuna tıklayın"
 echo ""
 
 # GitHub'a key eklendikten sonra test
-read -p "Key'i GitHub'a ekledikten sonra test etmek ister misiniz? (e/h): " TEST
+ask "Key'i GitHub'a ekledikten sonra test etmek ister misiniz? (e/h): " "${SSH_SETUP_TEST:-}" TEST
 if [ "$TEST" = "e" ]; then
     echo ""
     echo "GitHub bağlantısı test ediliyor..."
-    ssh -T git@github.com 2>&1 || true
+    # Bilinmeyen host anahtarı üçüncü bir interaktif soru demek; başsız
+    # koşuda orada asılırdı.
+    ssh -o StrictHostKeyChecking=accept-new -T git@github.com 2>&1 || true
 fi
 
 echo ""

package/pipeline/scripts/graph-mermaid.mjs

@@ -41,6 +41,8 @@ import { resolve } from "node:path";
 import { parseFlags } from "./graph-build.mjs";
 import { loadGraph, defaultGraphPath } from "./graph-query.mjs";
 import { findByName, affected } from "./graph-affected.mjs";
+import { runMain } from "../lib/fatal.mjs";
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
 
 const DEFAULT_MAX_NODES = 25;
 
@@ -246,6 +248,6 @@ function main() {
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
-  main();
+if (invokedDirectly(import.meta.url)) {
+  runMain("graph-mermaid", main);
 }

package/pipeline/scripts/graph-report.mjs

@@ -3,7 +3,7 @@
 /**
  * @file graph-report.mjs  -  GRAPH_REPORT.md, the human-and-model readable summary.
  *
- * Phase 1 reads this before deciding how wide to explore, and Phase 7 ships it
+ * Phase 1 reads this before deciding how wide to explore, and Phase 5 ships it
  * next to the knowledge base. Sections are ordered by how much they narrow a
  * search: hubs first (the types everything touches), then the module map, then
  * the long tail that is usually safe to ignore.

package/pipeline/scripts/jira-attach.sh

@@ -5,7 +5,7 @@
 #
 # Two callers need this and they used to carry their own curl: the issue
 # generator (`generate-issue.md` step 12) and visual evidence (Phase 3 / Phase 5
-# captures rendered into the Phase 7 Jira comment). Two copies of an upload is
+# captures rendered into the Phase 5 Jira comment). Two copies of an upload is
 # two places for the `X-Atlassian-Token: no-check` header to go missing, which
 # fails as a 403 that reads like an auth problem.
 #

package/pipeline/scripts/keychain-save.sh

@@ -2,55 +2,126 @@
 
 set -uo pipefail
 
-# Kullanım: ./keychain-save.sh <service-adı>
-# Örnek:    ./keychain-save.sh github-pat
-#           ./keychain-save.sh firebase-sa
+# Kullanım (interaktif):  ./keychain-save.sh <service-adı>
+# Örnek:                  ./keychain-save.sh github-pat
+#                         ./keychain-save.sh firebase-sa
+#
+# HEADLESS: terminal yokken script SORMAZ. Üç `read` koruma olmadan duruyordu
+# ve bir launchd ajanının altında ilki sonsuza kadar bekler; kurulum "asılı
+# kaldı" diye görünür.
+#
+#   MULTI_AGENT_UNATTENDED=1               terminal olsa bile sorulmaz
+#   ./keychain-save.sh <ad> --stdin        token stdin'den okunur (satır değil,
+#                                          tüm gövde - JSON çok satırlıdır)
+#   ./keychain-save.sh <ad> --json <yol>   JSON dosyadan okunur
+#
+# Secret İÇİN env değişkeni bilerek YOK. Bir env değeri çocuk süreçlere
+# miras kalır ve bazı sistemlerde `ps e` ile görünür; borudan okumak onu
+# yalnız bu sürecin belleğinde tutar. Aynı sebeple argv'ye de hiç değmez.
 
 SERVICE_NAME="${1:-}"
+MODE="${2:-}"
+MODE_ARG="${3:-}"
+
+usage() {
+    echo "Kullanım: $0 <service-adı>                  (interaktif)"
+    echo "          $0 <service-adı> --stdin          (token borudan)"
+    echo "          $0 <service-adı> --json <yol>     (JSON dosyadan)"
+}
 
 if [ -z "$SERVICE_NAME" ]; then
-    echo "Kullanım: $0 <service-adı>"
-    echo "Örnek:    $0 github-pat"
+    usage
     exit 1
 fi
 
-echo "Ne tür bir secret kaydedeceksin?"
-echo "  1) Personal Access Token / API Key"
-echo "  2) JSON dosyası (service account vb.)"
-read -rp "Seçim (1/2): " CHOICE
+# Başsızken mod verilmediyse, soruyu sormak yerine reddet. Sessizce beklemek
+# en kötü seçenek: dışarı hiçbir şey yazmaz ve kimse neyi beklediğini bilmez.
+if [ -z "$MODE" ] && { [ ! -t 0 ] || [ "${MULTI_AGENT_UNATTENDED:-}" = "1" ]; }; then
+    # Sebebi doğru söyle. "terminal yok" derken terminalin VAR olması,
+    # okuyanı kendi kurulumunu yanlış yerde aramaya gönderir.
+    if [ "${MULTI_AGENT_UNATTENDED:-}" = "1" ]; then
+        echo "Hata: MULTI_AGENT_UNATTENDED=1 ve mod verilmedi." >&2
+    else
+        echo "Hata: terminal yok ve mod verilmedi." >&2
+    fi
+    usage >&2
+    exit 1
+fi
+
+read_json_file() {
+    local path="$1"
+    # Kullanıcının girdiği tırnak işaretlerini temizle
+    path="${path//\'/}"
+    path="${path//\"/}"
+    # Tilde (~) expand
+    path="${path/#\~/$HOME}"
+    if [ ! -f "$path" ]; then
+        echo "Hata: Dosya bulunamadı: $path" >&2
+        return 1
+    fi
+    # JSON olduğu gibi saklanır. Kimlik deposu çok satırlı değeri
+    # bayt bayt geri verir; base64 sarmalı okuma tarafında çözülmeyen
+    # bir katman ekliyordu.
+    cat "$path"
+}
 
-case "$CHOICE" in
-    1)
-        read -rsp "Token'ı yapıştır (gizli yazılır): " SECRET
-        echo ""
+case "$MODE" in
+    --stdin)
+        # `read` DEĞİL `cat`: `read` ilk satırda durur ve bir service-account
+        # JSON'unun geri kalanını sessizce atar.
+        SECRET=$(cat)
         if [ -z "$SECRET" ]; then
-            echo "Hata: Token boş olamaz."
+            echo "Hata: stdin boş." >&2
             exit 1
         fi
         ;;
-    2)
-        read -rp "JSON dosya yolunu gir: " JSON_PATH
-        # Kullanıcının girdiği tırnak işaretlerini temizle
-        JSON_PATH="${JSON_PATH//\'/}"
-        JSON_PATH="${JSON_PATH//\"/}"
-        # Tilde (~) expand
-        JSON_PATH="${JSON_PATH/#\~/$HOME}"
-        if [ ! -f "$JSON_PATH" ]; then
-            echo "Hata: Dosya bulunamadı: $JSON_PATH"
+    --json)
+        if [ -z "$MODE_ARG" ]; then
+            echo "Hata: --json bir dosya yolu ister." >&2
+            usage >&2
             exit 1
         fi
-        # JSON olduğu gibi saklanır. Kimlik deposu çok satırlı değeri
-        # bayt bayt geri verir; base64 sarmalı okuma tarafında çözülmeyen
-        # bir katman ekliyordu.
-        SECRET=$(cat "$JSON_PATH")
+        SECRET=$(read_json_file "$MODE_ARG") || exit 1
         if [ -z "$SECRET" ]; then
-            echo "Hata: Dosya okunamadı."
+            echo "Hata: Dosya okunamadı." >&2
             exit 1
         fi
-        echo "JSON olduğu gibi saklanacak."
+        ;;
+    "")
+        echo "Ne tür bir secret kaydedeceksin?"
+        echo "  1) Personal Access Token / API Key"
+        echo "  2) JSON dosyası (service account vb.)"
+        # EOF (Ctrl-D) bir cevaptır: korumasız `read` onu boş bir seçime
+        # çevirip aşağıdaki "Geçersiz seçim"e düşürür, ki doğru sonuç.
+        read -rp "Seçim (1/2): " CHOICE || CHOICE=""
+
+        case "$CHOICE" in
+            1)
+                read -rsp "Token'ı yapıştır (gizli yazılır): " SECRET || SECRET=""
+                echo ""
+                if [ -z "$SECRET" ]; then
+                    echo "Hata: Token boş olamaz."
+                    exit 1
+                fi
+                ;;
+            2)
+                read -rp "JSON dosya yolunu gir: " JSON_PATH || JSON_PATH=""
+                SECRET=$(read_json_file "$JSON_PATH") || exit 1
+                if [ -z "$SECRET" ]; then
+                    echo "Hata: Dosya okunamadı."
+                    exit 1
+                fi
+                echo "JSON olduğu gibi saklanacak."
+                ;;
+            *)
+                echo "Geçersiz seçim."
+                exit 1
+                ;;
+        esac
         ;;
     *)
-        echo "Geçersiz seçim."
+        echo "Hata: bilinmeyen mod: $MODE" >&2
+        usage >&2
         exit 1
         ;;
 esac

package/pipeline/scripts/learn-from-transcripts.mjs

@@ -4,7 +4,7 @@
  *
  * WHY THIS EXISTS
  *
- * Phase 7 asks a subagent to read the run log and propose a few memory entries.
+ * Phase 5 asks a subagent to read the run log and propose a few memory entries.
  * That works for what the model noticed, and it is structurally blind to what it
  * did not: the same wrong path tried in three sessions, the command that fails
  * every time until its `--flag` variant is used, the directory that never has
@@ -66,6 +66,7 @@ import { execFileSync } from "node:child_process";
 import { basename, dirname, join } from "node:path";
 import { homedir, tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { runMain } from "../lib/fatal.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const argv = process.argv.slice(2);
@@ -622,4 +623,4 @@ function main() {
   }
 }
 
-main();
+runMain("learn-from-transcripts", main);