@mmerterden/multi-agent-pipeline 20.2.1 → 20.3.0

package/pipeline/lib/autopilot-state.sh

@@ -27,9 +27,20 @@
 #   ma_ap_is_on                # exit 0 when configured, 1 otherwise. NO side effects
 #   ma_ap_write <file> <-      # atomic write from stdin, 0600
 #   ma_ap_asset <rel>          # resolve a script/lib/template across the 3 host roots
+#   ma_ap_command <sub>        # the subcommand, spelled the way this host spells it
 
 set -uo pipefail
 
+# The spelling of a command, and the language a sentence renders in, are one
+# table for the whole pipeline. Sourcing it here is what keeps this file from
+# carrying a second copy of either.
+# shellcheck source=pipeline/lib/user-facing.sh
+if [ -f "$(dirname "${BASH_SOURCE[0]}")/user-facing.sh" ]; then
+  . "$(dirname "${BASH_SOURCE[0]}")/user-facing.sh"
+elif [ -f "$HOME/.claude/lib/user-facing.sh" ]; then
+  . "$HOME/.claude/lib/user-facing.sh"
+fi
+
 MA_AP_ROOT="${MA_AUTOPILOT_ROOT:-$HOME/.claude/autopilot}"
 
 ma_ap_root() { printf '%s\n' "$MA_AP_ROOT"; }
@@ -67,6 +78,14 @@ ma_ap_asset() { # $1 = path relative to a host root, e.g. scripts/autopilot-runn
   return 1
 }
 
+# The three CLIs spell the same command three ways, and the tree this file was
+# sourced from is the one in front of the user. A status line that names a
+# command names the one this machine can actually type. The table itself is
+# `ma_command` in user-facing.sh - one place, so a fourth host is one edit.
+ma_ap_command() { # $1 = subcommand, e.g. autopilot-off
+  ma_command "$1" "$MA_AP_HOST_ROOT"
+}
+
 MA_AP_LABEL="${MA_AUTOPILOT_LABEL:-com.multi-agent.autopilot}"
 MA_AP_PLIST="${MA_AUTOPILOT_PLIST:-$HOME/Library/LaunchAgents/$MA_AP_LABEL.plist}"
 

package/pipeline/lib/context-link-extractor.sh

@@ -34,7 +34,7 @@
 #   [
 #     { "type": "confluence", "url": "...", "metadata": { "host": "...", "pageId": "...|null", "spaceKey": "...|null" } },
 #     { "type": "swagger",    "url": "...", "metadata": { "format": "json|yaml|unknown" } },
-#     { "type": "crashlytics","url": "...", "metadata": { "projectId": "...", "platform": "ios|android", "issueId": "...", "sessionId": "...|null" } },
+#     { "type": "crashlytics","url": "...", "metadata": { "projectId": "...", "platform": "ios|android", "bundle": "...", "issueId": "...", "sessionId": "...|null" } },
 #     { "type": "fortify",    "url": "...|null", "metadata": { "host": "...|null", "versionId": "...|null", "instanceId": "...|null", "source": "url|label" } },
 #     { "type": "document",   "url": "...|null", "metadata": { "path": "...", "format": "docx|pdf|md|txt", "source": "path|url" } },
 #     { "type": "graylog",    "url": null,  "metadata": { "idType": "trx|conversation", "id": "...", "label": "..." } },
@@ -71,6 +71,13 @@ for m in URL_RE.finditer(text):
         RAW_URLS.append(u)
 
 
+def on_domain(netloc: str, *domains: str) -> bool:
+    """True when the URL's host is one of `domains` or a subdomain of one.
+    A bare suffix test would also accept look-alikes such as evil-figma.com."""
+    host = netloc.rsplit("@", 1)[-1].split(":", 1)[0]
+    return any(host == d or host.endswith("." + d) for d in domains)
+
+
 def classify(url: str):
     """Return (type, metadata) when the URL matches a known channel; else None."""
     parsed = up.urlparse(url)
@@ -80,7 +87,7 @@ def classify(url: str):
 
     # --- Figma --------------------------------------------------------------
     # figma.com/{design|make|board|slides|file}/<fileKey>/...
-    if host.endswith("figma.com"):
+    if on_domain(host, "figma.com"):
         parts = [p for p in path.split("/") if p]
         kind = parts[0] if parts else "design"
         # Normalise legacy /file/ to /design/
@@ -185,7 +192,7 @@ def classify(url: str):
     # advisory context  -  extractor flags them so the orchestrator can decide
     # whether to fetch (Block B work).
     if (
-        host.endswith(("notion.so", "notion.site"))
+        on_domain(host, "notion.so", "notion.site")
         or host == "docs.google.com"
         or host == "drive.google.com"
         or host == "gist.github.com"
@@ -221,14 +228,14 @@ for url in RAW_URLS:
 # alternation so "trxid" is not shadowed by "trx". The id is alphanumeric plus
 # ._- and long enough (>= 6 chars) to avoid catching stray words.
 GRAYLOG_RE = re.compile(
-    r"(?P<label>"
+    r"\b(?P<label>"
     r"x[\s_-]*conversation[\s_-]*id"
     r"|conversation[\s_-]*id"
     r"|conv[\s_-]*id"
     r"|transaction[\s_-]*id"
     r"|trx[\s_-]*id"
     r"|trx"
-    r")"
+    r")(?![A-Za-z0-9])"
     r"\s*[:=#]?\s*"
     r"[\"']?(?P<id>[A-Za-z0-9][A-Za-z0-9._-]{5,})",
     re.IGNORECASE,

package/pipeline/lib/credential-inventory.sh

@@ -53,6 +53,10 @@ set -uo pipefail
 
 PREFS="${MULTI_AGENT_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
 
+_MA_CI_HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+if [ -f "$_MA_CI_HERE/user-facing.sh" ]; then . "$_MA_CI_HERE/user-facing.sh"; else . "$HOME/.claude/lib/user-facing.sh"; fi
+
 STORE=""
 for c in "$HOME/.claude/lib/credential-store.sh" "$HOME/.copilot/lib/credential-store.sh" \
          "$HOME/.codex/lib/credential-store.sh" "$(dirname "$0")/credential-store.sh"; do
@@ -354,7 +358,7 @@ capability_of() {
     fortify)           echo "pull a static-analysis finding and its remediation guidance" ;;
     graylog)           echo "pull request logs by transaction or conversation id (advisory)" ;;
     graylog_test)      echo "pull the same logs from the test environment (falls back to the graylog token when unset)" ;;
-    usage_ingest)      echo "report pipeline usage counters and send /multi-agent:feedback" ;;
+    usage_ingest)      echo "report pipeline usage counters and send $(ma_command feedback)" ;;
     figma|figma_mcp)   echo "fetch design context, screenshots and Code Connect mappings" ;;
     jenkins)           echo "read build results" ;;
     npm)               echo "publish to the npm registry" ;;
@@ -408,7 +412,7 @@ if [ -n "$QUERY" ]; then
       fi
       exit 0 ;;
     2) echo "$QUERY: no credential helper on this host  -  run the pipeline installer (credential-store.sh missing)" >&2; exit 2 ;;
-    *) echo "$QUERY: NOT AVAILABLE  -  onboard it via /multi-agent:setup before relying on it" >&2; exit 1 ;;
+    *) echo "$QUERY: NOT AVAILABLE  -  onboard it via $(ma_command setup) before relying on it" >&2; exit 1 ;;
   esac
 fi
 
@@ -417,7 +421,7 @@ fi
 # tokens that are sitting in the store.
 if [ -z "$STORE" ]; then
   if [ "$MODE" = "json" ]; then
-    echo '{"status":"no-backend","reason":"credential-store.sh not found on this host","credentials":[]}'
+    echo '{"status":"no-backend","probed":false,"reason":"credential-store.sh not found on this host","credentials":[]}'
   else
     echo "no credential helper on this host  -  run the pipeline installer (credential-store.sh missing)" >&2
   fi
@@ -443,10 +447,13 @@ while IFS=$'\t' read -r key mapped; do
 done < <(mapping_keys)
 
 if [ -z "$ROWS" ]; then
+  # status, probed and credentials are in every --json envelope, the short ones
+  # included: a decoder that requires them (pipeline/contract/frozen/toolbox.json)
+  # would otherwise fail on exactly the machine that has nothing mapped yet.
   if [ "$MODE" = "json" ]; then
-    echo '{"status":"empty","reason":"no keychainMapping in preferences","credentials":[]}'
+    echo '{"status":"empty","probed":false,"reason":"no keychainMapping in preferences","credentials":[]}'
   else
-    echo "no keychainMapping found in $PREFS  -  run /multi-agent:setup" >&2
+    echo "no keychainMapping found in $PREFS  -  run $(ma_command setup)" >&2
   fi
   exit 0
 fi

package/pipeline/lib/credential-store.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 #
 # credential-store.sh
-# Cross-platform secret storage wrapper. Used by every script that previously
-# called `security find-generic-password` directly so tokens can live in the
-# native credential store on macOS, Windows, and Linux.
+# Secret storage wrapper over the macOS Keychain. Every script reads and writes
+# tokens through here rather than calling `security` itself, so key mapping,
+# argv hygiene and the audit trail live in one place.
 #
 # Subcommands:
 #   get <key>            Read secret value to stdout (empty + exit 1 if missing)
@@ -12,40 +12,51 @@
 #                        keeps the secret off this script's argv (visible to
 #                        ps). A literal "-" value cannot be stored this way.
 #   delete <key>         Remove secret
+#   probe <key>          Is the secret readable right now, without a prompt?
+#                        Prints one word - readable | missing | locked - and
+#                        never the value: the backend's stdout goes to
+#                        /dev/null and only its exit status and error text
+#                        are read. Exit 0 readable, 1 missing, 5 locked.
 #   list                 List all keys (one per line)
-#   platform             Print detected platform: macos | windows | linux | unknown
+#   platform             Print detected platform: macos | unknown
 #   doctor               Check backend availability, print remediation if missing
 #
-# Backends:
-#   macOS    -> Keychain via `security`
-#   Windows  -> Credential Manager via PowerShell `CredentialManager` module
-#              (Install-Module CredentialManager -Scope CurrentUser)
-#   Linux    -> libsecret via `secret-tool`
+# Backend: the macOS Keychain via `security`. The pipeline is macOS only
+# (ADR-0012); on any other host every subcommand except `platform` exits 2.
 #
-# Returns 0 on success, 1 on missing/empty value, 2 on backend missing,
-# 3 on usage error.
+# Returns 0 on success, 1 on missing/empty value, 2 on backend missing or a
+# non-macOS host, 3 on usage error, 5 when `probe` finds the store locked.
 
 set -euo pipefail
 
 detect_platform() {
   case "$(uname -s 2>/dev/null)" in
     Darwin) echo "macos" ;;
-    Linux)  echo "linux" ;;
-    MINGW*|MSYS*|CYGWIN*) echo "windows" ;;
-    *) [ -n "${WINDIR:-}${OS:-}" ] && echo "windows" || echo "unknown" ;;
+    *) echo "unknown" ;;
   esac
 }
 
-PLATFORM=$(detect_platform)
+PLATFORM="${CREDENTIAL_STORE_PLATFORM:-$(detect_platform)}"
 CMD="${1:-}"
 shift || true
 
+if [ "$PLATFORM" != "macos" ] && [ "$CMD" != "platform" ]; then
+  echo "ERR: macOS only, see ADR-0012 (detected: $PLATFORM)" >&2
+  exit 2
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
+
+# CREDENTIAL_STORE_KEYCHAIN scopes every backend call to one keychain file
+# instead of the user's search list. Tests point it at a throwaway keychain so
+# they never write to the login keychain. keychain.py reads the same variable.
+KEYCHAIN_FILE=()
+if [ -n "${CREDENTIAL_STORE_KEYCHAIN:-}" ]; then KEYCHAIN_FILE=("$CREDENTIAL_STORE_KEYCHAIN"); fi
 KEYCHAIN_PY="$SCRIPT_DIR/../scripts/keychain.py"
 
 # --- Python delegate --------------------------------------------------------
-# On macOS / Linux, prefer the Python helper for deterministic behaviour:
-#   - It writes BOTH -l (label) and -s (service) attributes on macOS, so items
+# Prefer the Python helper for deterministic behaviour:
+#   - It writes BOTH -l (label) and -s (service) attributes, so items
 #     are findable by either convention (personal tokens use -l, this script
 #     historically used -s).
 #   - It returns clean exit codes (0 ok / 1 missing / 2 backend / 4 error).
@@ -54,39 +65,12 @@ delegate_to_python() {
   [ "${KEYCHAIN_DELEGATE:-1}" != "0" ] || return 1
   command -v python3 >/dev/null 2>&1 || return 1
   [ -f "$KEYCHAIN_PY" ] || return 1
-  case "$PLATFORM" in
-    macos|linux) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-# --- Helpers ----------------------------------------------------------------
-ps_run() {
-  # Execute a PowerShell command, suppressing profile load. Reads stdin if any.
-  # Windows PowerShell (powershell.exe) is preferred over pwsh: the
-  # CredentialManager binary module is built for .NET Framework and users
-  # install it via `Install-Module CredentialManager` in Windows PowerShell,
-  # so its module path is only guaranteed visible there.
-  if command -v powershell.exe >/dev/null 2>&1; then
-    powershell.exe -NoProfile -NonInteractive -Command "$1"
-  elif command -v pwsh >/dev/null 2>&1; then
-    pwsh -NoProfile -NonInteractive -Command "$1"
-  else
-    return 127
-  fi
-}
-
-require_cmd() {
-  local cmd="$1" hint="$2"
-  if ! command -v "$cmd" >/dev/null 2>&1; then
-    echo "ERR: $cmd not found. $hint" >&2
-    exit 2
-  fi
+  [ "$PLATFORM" = "macos" ]
 }
 
 # --- Logical key -> backend key --------------------------------------------
 # Callers pass a LOGICAL key ("github", "jira", "figma_pat"). The actual
-# Keychain / libsecret / Credential Manager entry is named by
+# Keychain entry is named by
 # prefs.global.keychainMapping, so a lookup that uses the logical key verbatim
 # finds nothing whenever the two differ -  silently, because a missing entry and
 # a missing mapping look identical from here. Resolve the mapping first and fall
@@ -94,13 +78,12 @@ require_cmd() {
 # entries whose name already equals the logical key).
 PREFS_FILE="${MULTI_AGENT_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
 
-# Reader order is python3 then node, and both are here on purpose. python3 is present
-# on macOS and every mainstream Linux; node is guaranteed wherever this pipeline is
-# installed at all, because the installer IS a node program. Windows commonly has node
-# and no python3, and with a python3-only reader the mapping was skipped there in
-# silence: the lookup fell back to the LOGICAL key, searched Credential Manager for a
-# target that does not exist, and reported the token as missing while it sat under its
-# mapped name. A missing interpreter must not look like a missing token.
+# Reader order is python3 then node, and both are here on purpose. python3 is not
+# guaranteed on a mac (it arrives with the Command Line Tools or Homebrew); node is
+# guaranteed wherever this pipeline is installed at all, because the installer IS a
+# node program. With a python3-only reader a host without python3 would skip the
+# mapping in silence, look up the LOGICAL key, and report a token as missing while it
+# sits under its mapped name. A missing interpreter must not look like a missing token.
 resolve_key() {
   local logical="$1" mapped=""
   if [ -f "$PREFS_FILE" ]; then
@@ -171,26 +154,17 @@ do_get() {
     return 1
   fi
   local val=""
-  case "$PLATFORM" in
-    macos)
-      val=$(security find-generic-password -s "$key" -w 2>/dev/null || true)
-      ;;
-    linux)
-      require_cmd secret-tool "Install: sudo apt install libsecret-tools (Debian/Ubuntu) or sudo dnf install libsecret (Fedora)."
-      val=$(secret-tool lookup service "$key" 2>/dev/null || true)
-      ;;
-    windows)
-      # Escape single quotes for PowerShell single-quoted strings ('' = literal ').
-      local key_esc="${key//\'/\'\'}"
-      val=$(ps_run "
-\$ErrorActionPreference='SilentlyContinue'
-\$c = Get-StoredCredential -Target '$key_esc'
-if (\$c) { \$c.GetNetworkCredential().Password }
-" 2>/dev/null | tr -d '\r' || true)
-      ;;
-    *)
-      echo "ERR: unsupported platform" >&2; exit 2 ;;
-  esac
+  # `-w` prints a value it considers non-printable (a newline included) as
+  # bare hex with no marker. `-g` prints `password: 0x<HEX>` in that case,
+  # and the marker is what makes the decoding unambiguous.
+  local attrs hex
+  attrs=$(security find-generic-password -s "$key" -g ${KEYCHAIN_FILE[@]+"${KEYCHAIN_FILE[@]}"} 2>&1 >/dev/null || true)
+  hex=$(printf '%s\n' "$attrs" | sed -n 's/^password: 0x\([0-9A-Fa-f]*\).*/\1/p' | head -n 1)
+  if [ -n "$hex" ]; then
+    val=$(printf '%s' "$hex" | xxd -r -p; printf x); val=${val%x}
+  else
+    val=$(security find-generic-password -s "$key" -w ${KEYCHAIN_FILE[@]+"${KEYCHAIN_FILE[@]}"} 2>/dev/null || true)
+  fi
   if [ -z "$val" ]; then
     audit_lookup "$logical" false
     return 1
@@ -208,44 +182,26 @@ do_set() {
   if [ "$val" = "-" ]; then
     val=$(cat)
   fi
-  # macOS writes go through `security -i` below: the secret travels on stdin
-  # and never lands on any argv, which is the property the delegate cannot
-  # promise from here.
-  if [ "$PLATFORM" != "macos" ] && delegate_to_python; then
+  # The delegate receives the secret on stdin and hands it to `security -i` on
+  # stdin as well, so no argv ever carries it, and it writes both the -l and -s
+  # attributes that lookups by either convention expect.
+  if delegate_to_python; then
     printf '%s' "$val" | python3 "$KEYCHAIN_PY" set "$key" -
     return $?
   fi
-  case "$PLATFORM" in
-    macos)
-      # `security -i` reads the add command from stdin, so the secret never
-      # lands on the `security` argv (visible to ps). printf is a bash
-      # builtin, so no argv exposure there either. Double quotes/backslashes
-      # are escaped for security's interactive tokenizer.
-      local key_sec val_sec
-      key_sec=${key//\\/\\\\}; key_sec=${key_sec//\"/\\\"}
-      val_sec=${val//\\/\\\\}; val_sec=${val_sec//\"/\\\"}
-      printf 'add-generic-password -U -s "%s" -a "%s" -w "%s"\n' \
-        "$key_sec" "${USER:-claude}" "$val_sec" | security -i >/dev/null 2>&1
-      ;;
-    linux)
-      require_cmd secret-tool "Install libsecret-tools (see doctor)."
-      printf '%s' "$val" | secret-tool store --label="$key" service "$key" >/dev/null
-      ;;
-    windows)
-      # Escape single quotes for PowerShell single-quoted strings ('' = literal ').
-      local key_esc="${key//\'/\'\'}"
-      # The secret is piped via stdin ([Console]::In) so it never appears on
-      # the PowerShell argv (visible to process listings).
-      printf '%s' "$val" | ps_run "
-\$ErrorActionPreference='Stop'
-\$raw = [Console]::In.ReadToEnd()
-\$pwd = ConvertTo-SecureString \$raw -AsPlainText -Force
-New-StoredCredential -Target '$key_esc' -UserName '${USER:-${USERNAME:-claude}}' -SecurePassword \$pwd -Persist LocalMachine | Out-Null
-" >/dev/null
-      ;;
-    *)
-      echo "ERR: unsupported platform" >&2; exit 2 ;;
-  esac
+  # `security -i` reads the add command from stdin, so the secret never
+  # lands on the `security` argv (visible to ps). printf is a bash
+  # builtin, so no argv exposure there either. The value goes in as
+  # `-X <hex>`: the interactive tokenizer reads one command per line, so a
+  # newline inside a quoted `-w` value would end the command early.
+  local key_sec val_hex target=""
+  key_sec=${key//\\/\\\\}; key_sec=${key_sec//\"/\\\"}
+  val_hex=$(printf '%s' "$val" | od -An -v -tx1 | tr -d ' \n')
+  if [ -n "${CREDENTIAL_STORE_KEYCHAIN:-}" ]; then
+    target=${CREDENTIAL_STORE_KEYCHAIN//\\/\\\\}; target=" \"${target//\"/\\\"}\""
+  fi
+  printf 'add-generic-password -U -a "%s" -l "%s" -s "%s" -X %s%s\n' \
+    "${USER:-claude}" "$key_sec" "$key_sec" "$val_hex" "$target" | security -i >/dev/null 2>&1
 }
 
 do_delete() {
@@ -256,97 +212,72 @@ do_delete() {
     python3 "$KEYCHAIN_PY" delete "$key" >/dev/null 2>&1 || true
     return 0
   fi
-  case "$PLATFORM" in
-    macos)   security delete-generic-password -s "$key" >/dev/null 2>&1 || true ;;
-    linux)   secret-tool clear service "$key" >/dev/null 2>&1 || true ;;
-    windows) local key_esc="${key//\'/\'\'}"; ps_run "Remove-StoredCredential -Target '$key_esc' -ErrorAction SilentlyContinue" >/dev/null 2>&1 || true ;;
-  esac
+  security delete-generic-password -s "$key" ${KEYCHAIN_FILE[@]+"${KEYCHAIN_FILE[@]}"} >/dev/null 2>&1 || true
+}
+
+# Readable without a prompt, answered without the value ever leaving the backend.
+#
+# The data is really read - an attribute-only lookup would say "present" for an
+# item whose access control still asks before handing the value over, which is
+# exactly the item a background tick cannot use. `-w` prints the value on
+# stdout, and stdout goes to /dev/null; stderr carries only the backend's error
+# text, and that is what separates a locked keychain (errSecInteractionNotAllowed,
+# exit 36) from a missing item (errSecItemNotFound, exit 44). Both conventions are
+# tried, label then service, as keychain.py reads them.
+do_probe() {
+  local key="${1:-}"
+  [ -z "$key" ] && { echo "usage: $0 probe <key>" >&2; exit 3; }
+  key=$(resolve_key "$key")
+  local locked=0 rc err
+  local sec="${CREDENTIAL_STORE_SECURITY_BIN:-security}" attr
+  for attr in -l -s; do
+    rc=0
+    err=$("$sec" find-generic-password "$attr" "$key" -w ${KEYCHAIN_FILE[@]+"${KEYCHAIN_FILE[@]}"} 2>&1 >/dev/null) || rc=$?
+    if [ "$rc" -eq 0 ]; then echo "readable"; return 0; fi
+    case "$rc:$err" in
+      36:* | *"nteraction is not allowed"*) locked=1 ;;
+    esac
+  done
+  if [ "$locked" -eq 1 ]; then echo "locked"; return 5; fi
+  echo "missing"
+  return 1
 }
 
 do_list() {
-  case "$PLATFORM" in
-    macos)
-      # Read `svce` - the SERVICE attribute, which is what `set` writes with -s and
-      # `get` looks up with -s. This used to read `0x00000007`, which is the LABEL:
-      # it happens to match for items written by keychain.py (which stamps both -l and
-      # -s), but it is the wrong key in principle and diverges on any item whose label
-      # was set independently, listing a name `get` cannot resolve.
-      #
-      # `dump-keychain` prints the first few attributes under numeric tags and the rest
-      # under named ones, and `svce` is in the named group - so the tag to match is
-      # `"svce"`, not `0x00000008`.
-      #
-      # Without `-d` this reads attributes only and does not prompt for access; only
-      # the data-dumping form does.
-      #
-      # A trailing `\000` appears when security prints the value in its hex+C-string
-      # form; it is not part of the service name.
-      security dump-keychain 2>/dev/null \
-        | awk -F'"' '/"svce"<blob>=/ && NF >= 5 { v = $4; sub(/\\000$/, "", v); if (v != "") print v }' \
-        | sort -u
-      ;;
-    linux)
-      secret-tool search --all 2>/dev/null \
-        | awk -F'= ' '/^attribute\.service/{print $2}' \
-        | sort -u
-      ;;
-    windows)
-      ps_run "Get-StoredCredential | ForEach-Object { \$_.TargetName }" 2>/dev/null | tr -d '\r'
-      ;;
-  esac
+  # Read `svce` - the SERVICE attribute, which is what `set` writes with -s and
+  # `get` looks up with -s. This used to read `0x00000007`, which is the LABEL:
+  # it happens to match for items written by keychain.py (which stamps both -l and
+  # -s), but it is the wrong key in principle and diverges on any item whose label
+  # was set independently, listing a name `get` cannot resolve.
+  #
+  # `dump-keychain` prints the first few attributes under numeric tags and the rest
+  # under named ones, and `svce` is in the named group - so the tag to match is
+  # `"svce"`, not `0x00000008`.
+  #
+  # Without `-d` this reads attributes only and does not prompt for access; only
+  # the data-dumping form does.
+  #
+  # A trailing `\000` appears when security prints the value in its hex+C-string
+  # form; it is not part of the service name.
+  security dump-keychain ${KEYCHAIN_FILE[@]+"${KEYCHAIN_FILE[@]}"} 2>/dev/null \
+    | awk -F'"' '/"svce"<blob>=/ && NF >= 5 { v = $4; sub(/\\000$/, "", v); if (v != "") print v }' \
+    | sort -u
 }
 
 do_doctor() {
   echo "Platform:        $PLATFORM"
-  case "$PLATFORM" in
-    macos)
-      command -v security >/dev/null 2>&1 \
-        && echo "Backend:         security ✓ (built-in)" \
-        || echo "Backend:         security ✗ MISSING (impossible on macOS)"
-      ;;
-    linux)
-      if command -v secret-tool >/dev/null 2>&1; then
-        echo "Backend:         secret-tool ✓"
-      else
-        echo "Backend:         secret-tool ✗ MISSING"
-        echo "Install:         sudo apt install libsecret-tools  # Debian/Ubuntu"
-        echo "                 sudo dnf install libsecret        # Fedora/RHEL"
-      fi
-      ;;
-    windows)
-      if command -v pwsh >/dev/null 2>&1 || command -v powershell.exe >/dev/null 2>&1; then
-        echo "Backend:         PowerShell ✓"
-        local has_mod
-        has_mod=$(ps_run "if (Get-Module -ListAvailable -Name CredentialManager) {'yes'} else {'no'}" 2>/dev/null | tr -d '\r' || echo "no")
-        if [ "$has_mod" = "yes" ]; then
-          echo "Module:          CredentialManager ✓"
-        else
-          echo "Module:          CredentialManager ✗ MISSING"
-          echo "Install:         Install-Module CredentialManager -Scope CurrentUser -Force"
-        fi
-      else
-        echo "Backend:         PowerShell ✗ MISSING"
-      fi
-      ;;
-    *)
-      # This used to advertise an env-var fallback. There isn't one here: `get` on an
-      # unrecognised platform exits 2. Individual callers have their own env escape
-      # hatches (figma-token.sh honours $FIGMA_PAT, for instance), but this helper
-      # does not, and claiming otherwise sent people looking for a mechanism that
-      # does not exist.
-      echo "Backend:         none  -  unrecognised platform, \`get\` exits 2"
-      echo "Workaround:      set the credential in the caller's own env var where one"
-      echo "                 exists (e.g. FIGMA_PAT), or run on macOS / Linux / Windows"
-      ;;
-  esac
+  command -v security >/dev/null 2>&1 \
+    && echo "Backend:         security ✓ (built-in)" \
+    || echo "Backend:         security ✗ MISSING (impossible on macOS)"
 }
 
 case "$CMD" in
   get)      do_get "$@" ;;
   set)      do_set "$@" ;;
   delete)   do_delete "$@" ;;
+  probe)    do_probe "$@" ;;
   list)     do_list ;;
   platform) echo "$PLATFORM" ;;
   doctor)   do_doctor ;;
-  *) echo "usage: $0 {get|set|delete|list|platform|doctor} [args]" >&2; exit 3 ;;
+  *) echo "usage: $0 {get|set|delete|probe|list|platform|doctor} [args]" >&2; exit 3 ;;
 esac

package/pipeline/lib/fetch-confluence.sh

@@ -16,6 +16,8 @@
 #   CONFLUENCE_AUTH_TOKEN_KEY     default prefs.global.keychainMapping.confluence
 #                                 fallback "${USER}_Confluence_Access_Token"
 #   CONFLUENCE_HOST_OVERRIDE      forces the host (overrides URL host extraction)
+#                                 and is the one host trusted without a match
+#                                 against prefs.global.hosts.confluence
 #
 # Output (stdout, single JSON object):
 #   {
@@ -34,6 +36,10 @@
 #   2  missing token or auth failure (after Save Flow trigger)
 #   3  network / HTTP error
 #   4  bad usage
+#   6  host refused: the page is not on prefs.global.hosts.confluence
+#      (host-not-allowed), or no Confluence host is configured and the page is
+#      not on Atlassian Cloud (host-not-configured). Checked before the token
+#      is read, so the token never travels to a host the user did not name.
 #
 # Notes on auth:
 #   The script reads the Confluence token via credential-store.sh. If the
@@ -44,7 +50,8 @@
 set -euo pipefail
 
 URL=""
-HOST_OVERRIDE="${CONFLUENCE_HOST_OVERRIDE:-}"
+ENV_HOST_OVERRIDE="${CONFLUENCE_HOST_OVERRIDE:-}"
+HOST_OVERRIDE="$ENV_HOST_OVERRIDE"
 PAGE_ID=""
 TIMEOUT="${CONFLUENCE_TIMEOUT_SECONDS:-20}"
 
@@ -87,7 +94,7 @@ space_key = ""
 
 if url:
     p = up.urlparse(url)
-    host = host_override or p.netloc
+    host = host_override or p.netloc.rsplit("@", 1)[-1]
     query = up.parse_qs(p.query)
     if not page_id:
         page_id = (query.get("pageId") or [""])[0]
@@ -113,8 +120,42 @@ if [ -z "$HOST" ]; then
   exit 4
 fi
 
-# Resolve token via keychainMapping with sane fallback.
+# HOST is the exact string curl receives in https://$HOST/..., so it has to be a
+# bare host[:port]. A '/', '#', '?', '@' or '\' would let a value end with the
+# allowed suffix while curl reads the part before it as the host.
+if ! [[ "$HOST" =~ ^[A-Za-z0-9.-]+(:[0-9]{1,5})?$ ]] || { [[ "$HOST" == *:* ]] && [ "${HOST##*:}" -gt 65535 ]; }; then
+  printf '%s\n' '{"status":"blocked","reason":"host-malformed","service":"confluence","expected_pref":"global.hosts.confluence"}' >&2
+  exit 6
+fi
+
+# The link usually comes from ticket text, so its host is attacker-choosable.
+# The token goes only to the configured host (or a subdomain of it); without a
+# configured host, only to Atlassian Cloud, where the host is the tenant.
 PREFS="$HOME/.claude/multi-agent-preferences.json"
+if [ -z "$ENV_HOST_OVERRIDE" ]; then
+  HOST_VERDICT=$(python3 - "$HOST" "$PREFS" <<'PY'
+import json, sys
+host = sys.argv[1].lower().split(":", 1)[0].rstrip(".")
+try:
+    with open(sys.argv[2]) as f:
+        allowed = (json.load(f).get("global", {}).get("hosts", {}).get("confluence") or "")
+except Exception:
+    allowed = ""
+allowed = allowed.lower().strip().rstrip("/").split("://")[-1].split("/")[0].split(":")[0]
+if allowed:
+    ok = host == allowed or host.endswith("." + allowed)
+    print("ok" if ok else "host-not-allowed")
+else:
+    print("ok" if host.endswith(".atlassian.net") else "host-not-configured")
+PY
+)
+  if [ "$HOST_VERDICT" != "ok" ]; then
+    printf '%s\n' '{"status":"blocked","reason":"'"$HOST_VERDICT"'","service":"confluence","expected_pref":"global.hosts.confluence"}' >&2
+    exit 6
+  fi
+fi
+
+# Resolve token via keychainMapping with sane fallback.
 TOKEN_KEY="${CONFLUENCE_AUTH_TOKEN_KEY:-}"
 if [ -z "$TOKEN_KEY" ] && [ -f "$PREFS" ]; then
   TOKEN_KEY=$(python3 -c "

package/pipeline/lib/fetch-document.sh

@@ -39,10 +39,9 @@
 #
 # .docx needs no external tool: the file is a zip and `word/document.xml` is
 # read with the python3 standard library, which the lib layer already depends
-# on. Requiring pandoc or libreoffice would be the wrong dependency for a tool
-# that must work on macOS, Linux and Windows alike. PDF has no stdlib path, so
-# `pdftotext` is used when present and its absence is a soft skip rather than
-# an error - on Windows that absence is the normal case.
+# on. Requiring pandoc or libreoffice would be the wrong dependency for a small
+# reader. PDF has no stdlib path, so `pdftotext` is used when present and its
+# absence is a soft skip rather than an error.
 
 set -uo pipefail