@mmerterden/multi-agent-pipeline 20.2.1 → 20.3.0

package/pipeline/scripts/keychain-save.sh

@@ -19,14 +19,115 @@ set -uo pipefail
 # miras kalır ve bazı sistemlerde `ps e` ile görünür; borudan okumak onu
 # yalnız bu sürecin belleğinde tutar. Aynı sebeple argv'ye de hiç değmez.
 
+# Every line a person reads resolves through the table below, so this script
+# answers to the same language preference the rest of the pipeline answers to.
+#
+# The resolver is located the same way the credential store is located further
+# down - the file is checked for before it is sourced, because a `.` of a path
+# that is not there takes the shell with it and the later candidates are never
+# reached.
+for _ma_uf in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/user-facing.sh" \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../lib" 2>/dev/null && pwd)/user-facing.sh" \
+  "$HOME/.claude/lib/user-facing.sh" \
+  "$HOME/.copilot/lib/user-facing.sh" \
+  "$HOME/.codex/lib/user-facing.sh"; do
+  [ -f "$_ma_uf" ] || continue
+  # shellcheck source=/dev/null
+  . "$_ma_uf" 2>/dev/null || true
+  if command -v ma_output_lang >/dev/null 2>&1; then break; fi
+done
+unset _ma_uf
+if ! command -v ma_output_lang >/dev/null 2>&1; then
+  echo "Error: user-facing.sh not found. Install: npx @mmerterden/multi-agent-pipeline install" >&2
+  exit 1
+fi
+OUT_LANG=$(ma_output_lang)
+
+# One table, both languages on the same line, so a wording change cannot land
+# on one of them. English is the default and the fallback.
+msg() { # $1 = key, $2.. = printf arguments
+    local key="$1" en tr fmt
+    shift
+    case "$key" in
+        usage)
+            en='Usage: %s <service-name>                (interactive)\n       %s <service-name> --stdin        (token from a pipe)\n       %s <service-name> --json <path>  (token from a JSON file)'
+            tr='Kullanım: %s <service-adı>                  (interaktif)\n          %s <service-adı> --stdin          (token borudan)\n          %s <service-adı> --json <yol>     (JSON dosyadan)' ;;
+        no-mode-unattended)
+            en='Error: MULTI_AGENT_UNATTENDED=1 and no mode was given.'
+            tr='Hata: MULTI_AGENT_UNATTENDED=1 ve mod verilmedi.' ;;
+        no-mode-headless)
+            en='Error: there is no terminal and no mode was given.'
+            tr='Hata: terminal yok ve mod verilmedi.' ;;
+        file-missing)
+            en='Error: file not found: %s'
+            tr='Hata: Dosya bulunamadı: %s' ;;
+        stdin-empty)
+            en='Error: stdin is empty.'
+            tr='Hata: stdin boş.' ;;
+        json-needs-path)
+            en='Error: --json wants a file path.'
+            tr='Hata: --json bir dosya yolu ister.' ;;
+        file-unreadable)
+            en='Error: the file could not be read.'
+            tr='Hata: Dosya okunamadı.' ;;
+        kind-question)
+            en='What kind of secret are you saving?'
+            tr='Ne tür bir secret kaydedeceksin?' ;;
+        kind-token)
+            en='  1) Personal Access Token / API Key'
+            tr='  1) Personal Access Token / API Key' ;;
+        kind-json)
+            en='  2) JSON file (service account and the like)'
+            tr='  2) JSON dosyası (service account vb.)' ;;
+        ask-kind)
+            en='Choice (1/2): '
+            tr='Seçim (1/2): ' ;;
+        ask-token)
+            en='Paste the token (it is typed hidden): '
+            tr="Token'ı yapıştır (gizli yazılır): " ;;
+        token-empty)
+            en='Error: the token cannot be empty.'
+            tr='Hata: Token boş olamaz.' ;;
+        ask-json-path)
+            en='Enter the JSON file path: '
+            tr='JSON dosya yolunu gir: ' ;;
+        json-stored-verbatim)
+            en='The JSON will be stored as it is.'
+            tr='JSON olduğu gibi saklanacak.' ;;
+        invalid-choice)
+            en='Invalid choice.'
+            tr='Geçersiz seçim.' ;;
+        unknown-mode)
+            en='Error: unknown mode: %s'
+            tr='Hata: bilinmeyen mod: %s' ;;
+        no-credential-store)
+            en='Error: credential-store not found. Install: npx @mmerterden/multi-agent-pipeline install'
+            tr='Hata: credential-store bulunamadi. Kurulum: npx @mmerterden/multi-agent-pipeline install' ;;
+        saved)
+            en='Saved: %s (platform: %s)'
+            tr='Kaydedildi: %s (platform: %s)' ;;
+        read-it-back)
+            en='To read it back:'
+            tr='Okumak icin:' ;;
+        save-failed)
+            en='Error: could not save.'
+            tr='Hata: Kaydedilemedi.' ;;
+        *)
+            printf 'keychain-save: no message for %s\n' "$key" >&2
+            return 1 ;;
+    esac
+    [ "$OUT_LANG" = tr ] && fmt="$tr" || fmt="$en"
+    # shellcheck disable=SC2059
+    printf "$fmt\n" "$@"
+}
+
 SERVICE_NAME="${1:-}"
 MODE="${2:-}"
 MODE_ARG="${3:-}"
 
 usage() {
-    echo "Kullanım: $0 <service-adı>                  (interaktif)"
-    echo "          $0 <service-adı> --stdin          (token borudan)"
-    echo "          $0 <service-adı> --json <yol>     (JSON dosyadan)"
+    msg usage "$0" "$0" "$0"
 }
 
 if [ -z "$SERVICE_NAME" ]; then
@@ -40,9 +141,9 @@ if [ -z "$MODE" ] && { [ ! -t 0 ] || [ "${MULTI_AGENT_UNATTENDED:-}" = "1" ]; };
     # Sebebi doğru söyle. "terminal yok" derken terminalin VAR olması,
     # okuyanı kendi kurulumunu yanlış yerde aramaya gönderir.
     if [ "${MULTI_AGENT_UNATTENDED:-}" = "1" ]; then
-        echo "Hata: MULTI_AGENT_UNATTENDED=1 ve mod verilmedi." >&2
+        msg no-mode-unattended >&2
     else
-        echo "Hata: terminal yok ve mod verilmedi." >&2
+        msg no-mode-headless >&2
     fi
     usage >&2
     exit 1
@@ -56,7 +157,7 @@ read_json_file() {
     # Tilde (~) expand
     path="${path/#\~/$HOME}"
     if [ ! -f "$path" ]; then
-        echo "Hata: Dosya bulunamadı: $path" >&2
+        msg file-missing "$path" >&2
         return 1
     fi
     # JSON olduğu gibi saklanır. Kimlik deposu çok satırlı değeri
@@ -71,56 +172,56 @@ case "$MODE" in
         # JSON'unun geri kalanını sessizce atar.
         SECRET=$(cat)
         if [ -z "$SECRET" ]; then
-            echo "Hata: stdin boş." >&2
+            msg stdin-empty >&2
             exit 1
         fi
         ;;
     --json)
         if [ -z "$MODE_ARG" ]; then
-            echo "Hata: --json bir dosya yolu ister." >&2
+            msg json-needs-path >&2
             usage >&2
             exit 1
         fi
         SECRET=$(read_json_file "$MODE_ARG") || exit 1
         if [ -z "$SECRET" ]; then
-            echo "Hata: Dosya okunamadı." >&2
+            msg file-unreadable >&2
             exit 1
         fi
         ;;
     "")
-        echo "Ne tür bir secret kaydedeceksin?"
-        echo "  1) Personal Access Token / API Key"
-        echo "  2) JSON dosyası (service account vb.)"
+        msg kind-question
+        msg kind-token
+        msg kind-json
         # EOF (Ctrl-D) bir cevaptır: korumasız `read` onu boş bir seçime
         # çevirip aşağıdaki "Geçersiz seçim"e düşürür, ki doğru sonuç.
-        read -rp "Seçim (1/2): " CHOICE || CHOICE=""
+        read -rp "$(msg ask-kind)" CHOICE || CHOICE=""
 
         case "$CHOICE" in
             1)
-                read -rsp "Token'ı yapıştır (gizli yazılır): " SECRET || SECRET=""
+                read -rsp "$(msg ask-token)" SECRET || SECRET=""
                 echo ""
                 if [ -z "$SECRET" ]; then
-                    echo "Hata: Token boş olamaz."
+                    msg token-empty
                     exit 1
                 fi
                 ;;
             2)
-                read -rp "JSON dosya yolunu gir: " JSON_PATH || JSON_PATH=""
+                read -rp "$(msg ask-json-path)" JSON_PATH || JSON_PATH=""
                 SECRET=$(read_json_file "$JSON_PATH") || exit 1
                 if [ -z "$SECRET" ]; then
-                    echo "Hata: Dosya okunamadı."
+                    msg file-unreadable
                     exit 1
                 fi
-                echo "JSON olduğu gibi saklanacak."
+                msg json-stored-verbatim
                 ;;
             *)
-                echo "Geçersiz seçim."
+                msg invalid-choice
                 exit 1
                 ;;
         esac
         ;;
     *)
-        echo "Hata: bilinmeyen mod: $MODE" >&2
+        msg unknown-mode "$MODE" >&2
         usage >&2
         exit 1
         ;;
@@ -150,7 +251,7 @@ for _cred_resolver in \
 done
 unset _cred_resolver
 if [ -z "${CRED_STORE:-}" ]; then
-  echo "Hata: credential-store bulunamadi. Kurulum: npx @mmerterden/multi-agent-pipeline install"
+  msg no-credential-store
   exit 1
 fi
 CRED="$CRED_STORE"
@@ -158,11 +259,11 @@ CRED="$CRED_STORE"
 "$CRED" delete "$SERVICE_NAME" >/dev/null 2>&1 || true
 # Secret goes through stdin ("set <key> -") so it never appears on argv.
 if printf '%s' "$SECRET" | "$CRED" set "$SERVICE_NAME" -; then
-    echo "Kaydedildi: $SERVICE_NAME (platform: $("$CRED" platform))"
+    msg saved "$SERVICE_NAME" "$("$CRED" platform)"
     echo ""
-    echo "Okumak icin:"
+    msg read-it-back
     echo "  $CRED get \"$SERVICE_NAME\""
 else
-    echo "Hata: Kaydedilemedi."
+    msg save-failed
     exit 1
 fi

package/pipeline/scripts/keychain.py

@@ -5,7 +5,7 @@ keychain.py  -  deterministic Keychain helper, Python counterpart to credential-
 Purpose
 -------
 The pipeline reads Keychain tokens from many places (Phase 0 setup, Phase 1
-Jira fetch, Phase 6 push retry, channels, ...). Shell `security` calls work
+Jira fetch, Phase 4 push retry, channels, ...). Shell `security` calls work
 fine but make error handling and structured output painful. This module is
 the single deterministic Python entry point for those operations.
 
@@ -26,7 +26,7 @@ list_labels(filter_substring=None) -> list[str]
 
 doctor() -> dict
     Probe backend availability. Returns
-    {"platform": "macos|linux|unknown", "backend_ok": bool, "remediation": str|None}
+    {"platform": "macos|unknown", "backend_ok": bool, "remediation": str|None}
 
 CLI
 ---
@@ -40,18 +40,17 @@ Exit codes
 ----------
 0  success
 1  item missing (get) / does not exist (delete)
-2  backend unavailable (no `security` on macOS, no `secret-tool` on Linux)
+2  backend unavailable (no `security`, or not macOS)
 3  usage error
 4  unexpected backend error (stderr captured to stdout for diagnostics)
 
 Behaviour
 ---------
-- macOS: shells out to /usr/bin/security, parsing structured output.
-- Linux: shells out to secret-tool (libsecret).
-- Windows / unknown platforms: backend unavailable; `doctor` prints remediation.
+- Shells out to /usr/bin/security, parsing structured output. macOS only
+  (ADR-0012): on any other host the backend is unavailable and `doctor` says so.
 - Never logs the secret value. `set` accepts the value via argv (CLI) or via
   stdin when the value is exactly `-` (preferred for scripts to avoid shell
-  history leak). On macOS the write goes through `security -i` with the
+  history leak). The write goes through `security -i` with the
   command on stdin, so the value never appears on a child process argv.
 - get returns the raw value to stdout with no trailing newline manipulation
   beyond stripping the OS-level final \\n that `security -w` appends.
@@ -75,8 +74,6 @@ def _platform() -> str:
     s = platform.system()
     if s == "Darwin":
         return "macos"
-    if s == "Linux":
-        return "linux"
     return "unknown"
 
 
@@ -84,6 +81,14 @@ def _account_default(explicit: Optional[str] = None) -> str:
     return explicit or os.environ.get("USER") or os.environ.get("LOGNAME") or "user"
 
 
+def _keychain() -> list[str]:
+    """The keychain file every call is scoped to, when CREDENTIAL_STORE_KEYCHAIN
+    names one; otherwise the user's search list. Tests point it at a throwaway
+    keychain so they never write to the login keychain."""
+    path = os.environ.get("CREDENTIAL_STORE_KEYCHAIN", "")
+    return [path] if path else []
+
+
 def _run(argv: list[str], input_value: Optional[bytes] = None) -> tuple[int, bytes, bytes]:
     """Run a subprocess; return (rc, stdout_bytes, stderr_bytes). Never raises on non-zero."""
     proc = subprocess.run(
@@ -105,17 +110,10 @@ def doctor() -> dict:
             "backend_ok": ok,
             "remediation": None if ok else "macOS Keychain CLI missing  -  /usr/bin/security should ship with macOS; reinstall Command Line Tools.",
         }
-    if pf == "linux":
-        ok = shutil.which("secret-tool") is not None
-        return {
-            "platform": pf,
-            "backend_ok": ok,
-            "remediation": None if ok else "Install libsecret-tools: `sudo apt install libsecret-tools` or `sudo dnf install libsecret`.",
-        }
     return {
         "platform": pf,
         "backend_ok": False,
-        "remediation": "Unsupported platform; the pipeline only ships Keychain support for macOS and libsecret for Linux. Use environment variables on Windows.",
+        "remediation": "macOS only, see ADR-0012.",
     }
 
 
@@ -180,7 +178,7 @@ def _macos_find(args: list[str]) -> Optional[str]:
     A value whose trailing newline is meaningful is not something this store has
     ever been able to return.
     """
-    rc, _, err = _run(["/usr/bin/security", "find-generic-password", *args, "-g"])
+    rc, _, err = _run(["/usr/bin/security", "find-generic-password", *args, "-g", *_keychain()])
     if rc != 0:
         return None
     value = _decode_security_password(err)
@@ -192,63 +190,45 @@ def get(label: str, account: Optional[str] = None) -> Optional[str]:
     - User's manually-added tokens (e.g. ${USER}_Vercel_Access_Token) use -l (label).
     - credential-store.sh-managed items use -s (service).
     The helper finds either."""
-    pf = _ensure_backend()
+    _ensure_backend()
     acct = _account_default(account)
-    if pf == "macos":
-        for args in (
-            ["-a", acct, "-l", label],
-            ["-a", acct, "-s", label],
-            # account-agnostic last resort  -  some entries were written without -a
-            ["-l", label],
-            ["-s", label],
-        ):
-            value = _macos_find(args)
-            if value is not None:
-                return value
-        return None
-    # linux / secret-tool  -  store under both `label` and `service` schema attrs
-    rc, out, _ = _run(["secret-tool", "lookup", "label", label, "account", acct])
-    if rc == 0:
-        return out.decode("utf-8", errors="replace").rstrip("\n")
-    rc, out, _ = _run(["secret-tool", "lookup", "service", label])
-    if rc == 0:
-        return out.decode("utf-8", errors="replace").rstrip("\n")
+    for args in (
+        ["-a", acct, "-l", label],
+        ["-a", acct, "-s", label],
+        # account-agnostic last resort  -  some entries were written without -a
+        ["-l", label],
+        ["-s", label],
+    ):
+        value = _macos_find(args)
+        if value is not None:
+            return value
     return None
 
 
 def set_(label: str, value: str, account: Optional[str] = None) -> None:
     """Write the entry with both -l (label) and -s (service) set to the same id, so
     both lookup conventions succeed. -U overwrites if the item already exists."""
-    pf = _ensure_backend()
+    _ensure_backend()
     acct = _account_default(account)
-    if pf == "macos":
-        # `security -i` reads the add command from stdin, so the secret never
-        # lands on the security argv (visible to ps). Backslashes and double
-        # quotes are escaped for security's interactive tokenizer.
-        def quote(text: str) -> str:
-            return text.replace("\\", "\\\\").replace('"', '\\"')
-
-        # The secret goes in as `-X <hex>`, not `-w "<text>"`. `security -i`
-        # tokenizes ONE command per line, so a newline inside the value ends the
-        # command and the remainder is read as further commands - which is how a
-        # service-account JSON turned into "security: unknown command" instead of
-        # a stored credential. Hex is single-line by construction and byte-exact,
-        # and it stays on stdin, so the argv exposure this branch exists to avoid
-        # is still avoided.
-        command = (
-            f'add-generic-password -U -a "{quote(acct)}" -l "{quote(label)}" '
-            f'-s "{quote(label)}" -X {value.encode("utf-8").hex()}\n'
-        )
-        rc, _, err = _run(["/usr/bin/security", "-i"], input_value=command.encode("utf-8"))
-        if rc != 0:
-            sys.stderr.write(err.decode("utf-8", errors="replace"))
-            sys.exit(4)
-        return
-    # linux / secret-tool  -  store reads the secret from stdin; tag both schema attrs
-    rc, _, err = _run(
-        ["secret-tool", "store", "--label", label, "label", label, "service", label, "account", acct],
-        input_value=value.encode("utf-8"),
+    # `security -i` reads the add command from stdin, so the secret never
+    # lands on the security argv (visible to ps). Backslashes and double
+    # quotes are escaped for security's interactive tokenizer.
+    def quote(text: str) -> str:
+        return text.replace("\\", "\\\\").replace('"', '\\"')
+
+    # The secret goes in as `-X <hex>`, not `-w "<text>"`. `security -i`
+    # tokenizes ONE command per line, so a newline inside the value ends the
+    # command and the remainder is read as further commands - which is how a
+    # service-account JSON turned into "security: unknown command" instead of
+    # a stored credential. Hex is single-line by construction and byte-exact,
+    # and it stays on stdin, so the argv exposure this branch exists to avoid
+    # is still avoided.
+    target = "".join(f' "{quote(k)}"' for k in _keychain())
+    command = (
+        f'add-generic-password -U -a "{quote(acct)}" -l "{quote(label)}" '
+        f'-s "{quote(label)}" -X {value.encode("utf-8").hex()}{target}\n'
     )
+    rc, _, err = _run(["/usr/bin/security", "-i"], input_value=command.encode("utf-8"))
     if rc != 0:
         sys.stderr.write(err.decode("utf-8", errors="replace"))
         sys.exit(4)
@@ -256,40 +236,30 @@ def set_(label: str, value: str, account: Optional[str] = None) -> None:
 
 def delete(label: str, account: Optional[str] = None) -> bool:
     """Delete by either convention. Returns True if any matching item was removed."""
-    pf = _ensure_backend()
+    _ensure_backend()
     acct = _account_default(account)
-    if pf == "macos":
-        deleted = False
-        for flag in ("-l", "-s"):
-            while True:
-                rc, _, _ = _run(["/usr/bin/security", "delete-generic-password", "-a", acct, flag, label])
-                if rc != 0:
-                    break
-                deleted = True
-        for flag in ("-l", "-s"):
-            while True:
-                rc, _, _ = _run(["/usr/bin/security", "delete-generic-password", flag, label])
-                if rc != 0:
-                    break
-                deleted = True
-        return deleted
     deleted = False
-    rc, _, _ = _run(["secret-tool", "clear", "label", label, "account", acct])
-    if rc == 0:
-        deleted = True
-    rc, _, _ = _run(["secret-tool", "clear", "service", label])
-    if rc == 0:
-        deleted = True
+    for flag in ("-l", "-s"):
+        while True:
+            rc, _, _ = _run(
+                ["/usr/bin/security", "delete-generic-password", "-a", acct, flag, label, *_keychain()]
+            )
+            if rc != 0:
+                break
+            deleted = True
+    for flag in ("-l", "-s"):
+        while True:
+            rc, _, _ = _run(["/usr/bin/security", "delete-generic-password", flag, label, *_keychain()])
+            if rc != 0:
+                break
+            deleted = True
     return deleted
 
 
 def list_labels(filter_substring: Optional[str] = None) -> list[str]:
-    pf = _ensure_backend()
-    if pf != "macos":
-        # secret-tool has no native list; we can't enumerate all entries portably.
-        return []
+    _ensure_backend()
     # `security dump-keychain` prints every item; we extract the 0x00000007 (label) attr.
-    rc, out, _ = _run(["/usr/bin/security", "dump-keychain"])
+    rc, out, _ = _run(["/usr/bin/security", "dump-keychain", *_keychain()])
     if rc != 0:
         return []
     labels: list[str] = []