@mmerterden/multi-agent-pipeline 20.20.0 → 20.22.0

package/pipeline/scripts/diff-risk-score.mjs

@@ -16,11 +16,18 @@
  *   ui_critical       -  *View.swift / *Screen.kt / Configuration   w=1.5
  *   migration         -  DB schema / migration path                 w=4.0
  *   test_lines_removed -  test file shrinks (removed > added)       w=3.0
+ *   dependents_reached -  distinct non-test files that depend on the  w=2.0
+ *                         changed declarations, two rings out, from
+ *                         the code graph; only with --graph, capped
+ *                         at 20 so one hub cannot outweigh a
+ *                         security path
  *
  * Inputs:
  *   --base <ref>     Base ref. Default: origin/main, fallback: main
  *   --head <ref>     Head ref. Default: HEAD
  *   --diff <path>    Pre-computed diff file (skip git invocation)
+ *   --graph <path>   Code graph (graph-build.mjs). Adds dependents_reached;
+ *                    an unreadable graph is reported on stderr and skipped
  *   --root <path>    Repo root for git -C. Default: cwd
  *   --task-id <id>   Tag the output with a task id (no functional effect)
  *   --top <N>        Truncate `files` to top N. Default: keep all,
@@ -40,7 +47,9 @@
 
 import { readFileSync, existsSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { unquoteGitPath, unquotePathIfNeeded } from "./git-path.mjs";
+import { unquoteGitPath } from "./git-path.mjs";
+import { affected } from "./graph-affected.mjs";
+import { parseDiffFiles, changedSymbols, graphSide } from "./_diff-impact.mjs";
 
 const argv = process.argv.slice(2);
 const flags = {};
@@ -65,6 +74,9 @@ const DIFF_FILE = flags.diff || null;
 const TASK_ID = flags["task-id"] || null;
 const TOP = flags.top ? Number(flags.top) : null;
 const PRETTY = flags.json === true;
+const GRAPH_FILE = flags.graph && flags.graph !== true ? flags.graph : null;
+const DEPENDENTS_CAP = 20;
+const DEPENDENTS_DEPTH = 2;
 
 function git(args) {
   return execFileSync("git", ["-C", ROOT, ...args], { encoding: "utf8" }).trim();
@@ -95,7 +107,7 @@ function loadDiff() {
     if (!existsSync(DIFF_FILE)) throw new Error(`diff file not found: ${DIFF_FILE}`);
     return readFileSync(DIFF_FILE, "utf8");
   }
-  return git(["diff", "--unified=0", `${BASE}...${HEAD}`]);
+  return git(["diff", "--unified=0", "--src-prefix=a/", "--dst-prefix=b/", `${BASE}...${HEAD}`]);
 }
 
 function loadNumstat() {
@@ -118,16 +130,30 @@ function loadNumstat() {
     }
     return Array.from(map.entries()).map(([path, v]) => ({ path, ...v }));
   }
-  const out = git(["diff", "--numstat", `${BASE}...${HEAD}`]);
+  // -z: paths are raw (never quoted), and a rename is `A\tR\t\0old\0new\0`,
+  // so the new path is read directly instead of parsed out of `{a => b}`.
+  const out = execFileSync("git", ["-C", ROOT, "diff", "--numstat", "-z", `${BASE}...${HEAD}`], {
+    encoding: "utf8",
+  });
   if (!out) return [];
-  return out.split("\n").map((line) => {
-    const [a, r, ...rest] = line.split("\t");
-    return {
-      path: unquotePathIfNeeded(rest.join("\t")),
+  const fields = out.split("\0");
+  const rows = [];
+  for (let i = 0; i < fields.length; i++) {
+    const head = fields[i];
+    if (!head) continue;
+    const [a, r, path] = head.split("\t");
+    let name = path;
+    if (path === "") {
+      name = fields[i + 2];
+      i += 2;
+    }
+    rows.push({
+      path: name,
       added: a === "-" ? 0 : Number(a) || 0,
       removed: r === "-" ? 0 : Number(r) || 0,
-    };
-  });
+    });
+  }
+  return rows;
 }
 
 const SECURITY_GLOBS = [
@@ -332,6 +358,47 @@ function buildRow(stat, addedLines, allChangedPaths) {
   };
 }
 
+function loadGraphOrNull(path) {
+  try {
+    const graph = JSON.parse(readFileSync(path, "utf8"));
+    if (!Array.isArray(graph.nodes) || !Array.isArray(graph.edges))
+      throw new Error("not a code graph");
+    return graph;
+  } catch (e) {
+    process.stderr.write(
+      `diff-risk-score: graph unreadable at ${path}, dependents_reached skipped: ${e.message}\n`,
+    );
+    return null;
+  }
+}
+
+/**
+ * Add dependents_reached to each row whose changed declarations have
+ * dependents in the graph. Test files are not counted as dependents: a change
+ * that only its own tests use is not wide.
+ */
+function addGraphSignal(rows, graph, diffText, root) {
+  const side = graphSide(graph, { root });
+  const diffFiles = parseDiffFiles(diffText);
+  for (const row of rows) {
+    const f = diffFiles.find((x) => (x.newPath || x.oldPath) === row.path);
+    if (!f) continue;
+    const path = side === "old" ? f.oldPath || f.newPath : f.newPath || f.oldPath;
+    const r = side === "old" ? f.oldRanges : f.newRanges;
+    if (!r.length) continue;
+    const { seeds } = changedSymbols(graph, new Map([[path, r]]));
+    if (!seeds.length) continue;
+    const hits = affected({ graph, seeds, depth: DEPENDENTS_DEPTH });
+    const files = new Set(
+      hits.filter((h) => h.node?.path && !h.node.isTest).map((h) => h.node.path),
+    );
+    if (!files.size) continue;
+    const w = 2.0;
+    row.signals.push({ name: "dependents_reached", weight: w, value: files.size });
+    row.score = Math.round((row.score + Math.min(files.size, DEPENDENTS_CAP) * 2 * w) * 100) / 100;
+  }
+}
+
 function main() {
   // Resolve the base ref ONCE, before any git diff runs. loadNumstat() and
   // loadDiff() both interpolate BASE; resolving it lazily inside loadDiff()
@@ -348,6 +415,10 @@ function main() {
   const rows = numstat.map((stat) =>
     buildRow(stat, perFileAdded.get(stat.path) || [], allChangedPaths),
   );
+  if (GRAPH_FILE) {
+    const graph = loadGraphOrNull(GRAPH_FILE);
+    if (graph) addGraphSignal(rows, graph, diffText, ROOT);
+  }
   rows.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
 
   const totals = {

package/pipeline/scripts/doctor.mjs

@@ -104,6 +104,7 @@ const CHECK_IDS = [
   "disk-space",
   "worktree-residue",
   "usage-report",
+  "free-models",
   "xcode-skills",
 ];
 
@@ -935,6 +936,104 @@ function checkUsageReport() {
   );
 }
 
+// route-on --free promises that simple tasks leave Claude. With no usable
+// provider every one of them silently escalates back, which costs nothing but
+// saves nothing either - the user believes a control is working that is not.
+// --probe sends each configured provider one tiny request, so a dead key or an
+// exhausted quota shows up here instead of as a week of escalations.
+function checkFreeModels() {
+  const prefs = readJson(join(CLAUDE, "multi-agent-preferences.json"));
+  const routing = prefs?.global?.modelRouting;
+  if (routing?.enabled !== true || routing?.free?.enabled !== true) {
+    skip("free-models", "free-model routing is off");
+    return;
+  }
+  const lib = [
+    join(HERE, "..", "lib", "toolkit-llm.sh"),
+    join(CLAUDE, "lib", "toolkit-llm.sh"),
+  ].find((p) => existsSync(p));
+  if (!lib) {
+    report(
+      "free-models",
+      "WARN",
+      "route-on --free is on but lib/toolkit-llm.sh is not installed, so every free task escalates to Claude",
+      `run ${hostCommand("update", HERE)}`,
+    );
+    return;
+  }
+  const train = routing.free.allowTraining === true ? ["--allow-training"] : [];
+  const run = (args) =>
+    JSON.parse(
+      execFileSync("bash", ["-c", '. "$1"; shift; ma_toolkit_llm "$@"', "_", lib, ...args], {
+        encoding: "utf8",
+        timeout: PROBE ? 180000 : 60000,
+        stdio: ["ignore", "pipe", "ignore"],
+      }),
+    );
+  let listing;
+  try {
+    listing = run(["providers", ...train]);
+  } catch {
+    report(
+      "free-models",
+      "WARN",
+      "route-on --free is on but the multi-agent-toolkit CLI could not be run (node and npx are needed), so every free task escalates to Claude",
+      "run npx -y --@mmerterden:registry=https://registry.npmjs.org -p @mmerterden/multi-agent-toolkit-mcp@latest multi-agent-toolkit-llm providers",
+    );
+    return;
+  }
+  const usable = (listing.providers || []).filter((p) => p.configured && p.allowed_by_policy);
+  const detail = (listing.providers || []).map(
+    (p) =>
+      `${p.id}: ${p.configured ? (p.allowed_by_policy ? `ready (${p.key_source})` : `configured, outside the ${listing.data_policy} policy`) : `missing - ${p.setup}`}`,
+  );
+  if (!usable.length) {
+    report(
+      "free-models",
+      "WARN",
+      `route-on --free is on but no free provider is usable under the ${listing.data_policy} data policy, so every free task escalates to Claude`,
+      'run bash "$HOME/.claude/lib/credential-store.sh" set llm-groq - and paste a free key from https://console.groq.com/keys',
+      detail,
+    );
+    return;
+  }
+  if (!PROBE) {
+    report("free-models", "OK", null, null, detail);
+    return;
+  }
+  let probed;
+  try {
+    probed = run(["probe"]);
+  } catch {
+    report(
+      "free-models",
+      "WARN",
+      "the free-provider probe could not run",
+      "re-run with --probe once the network is reachable",
+      detail,
+    );
+    return;
+  }
+  const dead = probed.filter((r) => usable.some((u) => u.id === r.provider) && r.outcome !== "ok");
+  if (dead.length === usable.length) {
+    report(
+      "free-models",
+      "WARN",
+      `every usable free provider failed a probe (${dead.map((r) => `${r.provider}: ${r.outcome}`).join(", ")}), so free tasks escalate to Claude until one recovers`,
+      "set a fresh key for the failing provider with the credential store, or add a second provider",
+      probed.map((r) => `${r.provider}: ${r.outcome}${r.reason ? ` (${r.reason})` : ""}`),
+    );
+    return;
+  }
+  report(
+    "free-models",
+    "OK",
+    null,
+    null,
+    probed.map((r) => `${r.provider}: ${r.outcome}${r.reason ? ` (${r.reason})` : ""}`),
+  );
+}
+
 // Apple's Xcode skills are the reference for iPhone Duo and window resizing,
 // SwiftUI, App Intents and the accessibility audits, and Claude Code reads them
 // from a copy the installer keeps at the installed Xcode build. A newer Xcode
@@ -1263,6 +1362,7 @@ function main() {
   checkDiskSpace();
   checkWorktreeResidue();
   checkUsageReport();
+  checkFreeModels();
   checkXcodeSkills();
   if (PROFILE === "server") checkServerProfile(resolved);
 

package/pipeline/scripts/graph-affected.mjs

@@ -9,7 +9,14 @@
  * radius of a change rather than its neighbourhood.
  *
  * Inputs:
- *   "<symbol>"       Symbol name, exact or case-insensitive. Required.
+ *   "<symbol>"       Symbol name, exact or case-insensitive. Required unless
+ *                    --diff or --diff-file is given.
+ *   --diff <spec>    Seed from a change instead: `<base>` (working tree against
+ *                    base) or `<base>..<head>`. Hunks map onto the innermost
+ *                    declarations they touch, read on the side of the diff
+ *                    the graph was built from (_diff-impact.mjs graphSide).
+ *   --diff-file <p>  The same, from a saved unified diff.
+ *   --root <path>    Repo for --diff. Default: the root recorded in the graph
  *   --graph <path>   Graph file. Default: ~/.claude/knowledge/<cwd name>/code-graph.json
  *   --depth N        Reverse traversal depth. Default: 2
  *   --kind K         Restrict to one edge kind (repeatable via comma)
@@ -24,8 +31,16 @@
  */
 
 import { resolve } from "node:path";
+import { readFileSync } from "node:fs";
 import { parseFlags } from "./graph-build.mjs";
 import { loadGraph, defaultGraphPath } from "./graph-query.mjs";
+import {
+  parseHunkRanges,
+  changedSymbols,
+  graphFreshness,
+  graphSide,
+  diffFor,
+} from "./_diff-impact.mjs";
 
 /**
  * Nodes whose name matches, preferring an exact hit.
@@ -62,37 +77,155 @@ export function incoming(graph, kinds = null) {
 }
 
 /**
- * Walk backwards from each seed.
+ * Walk backwards from each seed, over files.
+ *
+ * Dependents are files: a file depends on a target when it references a
+ * symbol or imports a file. The walk continues through what a dependent file
+ * itself declares, because the next ring depends on those declarations, not on
+ * the file node - references point from files to symbols, so a walk that only
+ * followed a file's own incoming edges would stop after one ring. `defines`
+ * is never a dependency, and the files that define the seeds are never
+ * reported as their own dependents.
  *
  * @param {object} params
+ * @param {object} params.graph
+ * @param {object[]} params.seeds - symbol or file nodes
+ * @param {number} params.depth
+ * @param {Set<string>|null} [params.kinds] - dependency edge kinds to follow
  * @returns {Array<{id: string, dist: number, kind: string, node: object}>}
  */
-export function affected({ graph, seeds, depth, kinds }) {
+export function affected({ graph, seeds, depth, kinds = null }) {
   const byId = new Map(graph.nodes.map((n) => [n.id, n]));
   const adj = incoming(graph, kinds);
-  const seen = new Set(seeds.map((n) => n.id));
+  const declares = new Map();
+  const definer = new Map();
+  for (const e of graph.edges) {
+    if (e.kind !== "defines") continue;
+    if (!declares.has(e.from)) declares.set(e.from, []);
+    declares.get(e.from).push(e.to);
+    definer.set(e.to, e.from);
+  }
+  const expand = (node) =>
+    node.kind === "file"
+      ? [node.id, ...(declares.get(node.id) || [])]
+      : [node.id, ...(definer.has(node.id) ? [definer.get(node.id)] : [])];
+
+  const seedFiles = new Set(
+    seeds.map((n) => (n.kind === "file" ? n.id : definer.get(n.id))).filter(Boolean),
+  );
+  const walked = new Set();
+  let frontier = [];
+  for (const seed of seeds)
+    for (const id of expand(seed)) if (!walked.has(id)) walked.add(id) && frontier.push(id);
+
+  const reported = new Set();
   const out = [];
-  const queue = seeds.map((n) => ({ id: n.id, dist: 0, kind: "seed" }));
-
-  while (queue.length) {
-    const cur = queue.shift();
-    if (cur.dist > 0) out.push({ ...cur, node: byId.get(cur.id) });
-    if (cur.dist >= depth) continue;
-    for (const dep of adj.get(cur.id) || []) {
-      if (seen.has(dep.id)) continue;
-      seen.add(dep.id);
-      queue.push({ id: dep.id, dist: cur.dist + 1, kind: dep.kind });
+  for (let dist = 1; dist <= depth && frontier.length; dist++) {
+    const next = [];
+    for (const target of frontier) {
+      for (const dep of adj.get(target) || []) {
+        if (dep.kind === "defines" || seedFiles.has(dep.id) || reported.has(dep.id)) continue;
+        const node = byId.get(dep.id);
+        if (!node) continue;
+        reported.add(dep.id);
+        out.push({ id: dep.id, dist, kind: dep.kind, node });
+        for (const id of expand(node)) if (!walked.has(id)) walked.add(id) && next.push(id);
+      }
     }
+    frontier = next;
   }
   return out;
 }
 
+function printJson(obj) {
+  process.stdout.write(JSON.stringify(obj, null, 2) + "\n");
+}
+
+function hitRows(hits) {
+  return hits.map((h) => ({
+    id: h.id,
+    dist: h.dist,
+    edgeKind: h.kind,
+    path: h.node?.path || null,
+  }));
+}
+
+function freshnessLine(f) {
+  if (!f.stale) return "graph: current";
+  const parts = [];
+  if (f.commitMoved)
+    parts.push(
+      `built at ${String(f.baseCommit).slice(0, 12)}, HEAD is ${String(f.head).slice(0, 12)}`,
+    );
+  if (f.changedFiles.length) parts.push(`${f.changedFiles.length} file(s) edited since the build`);
+  if (f.removedFiles.length) parts.push(`${f.removedFiles.length} file(s) removed`);
+  return `graph: STALE (${parts.join("; ")}) - rebuild with graph-build.mjs for a current answer`;
+}
+
+function runDiff(flags, graph, depth, kinds) {
+  const root = flags.root && flags.root !== true ? resolve(flags.root) : graph.root;
+  let text;
+  if (flags["diff-file"] && flags["diff-file"] !== true) {
+    text = readFileSync(resolve(flags["diff-file"]), "utf8");
+  } else {
+    text = diffFor(root, flags.diff);
+  }
+  const freshness = graphFreshness(graph, { root });
+  const side = graphSide(graph, { root });
+  const mapped = changedSymbols(graph, parseHunkRanges(text, side));
+  const hits = affected({ graph, seeds: mapped.seeds, depth, kinds });
+  const result = {
+    mode: "diff",
+    diff: flags["diff-file"] && flags["diff-file"] !== true ? flags["diff-file"] : flags.diff,
+    changedSymbols: mapped.changed.map((c) => ({
+      name: c.name,
+      path: c.path,
+      line: c.line,
+      endLine: c.endLine,
+    })),
+    seeds: mapped.seeds.map((s) => s.id),
+    fileLevel: mapped.fileLevel,
+    notIndexed: mapped.notIndexed,
+    affected: hitRows(hits),
+    side,
+    freshness,
+  };
+  if (flags.json === true) return printJson(result);
+
+  process.stdout.write(`# affected by diff ${result.diff}\n\n`);
+  for (const c of result.changedSymbols)
+    process.stdout.write(`* ${c.name} ${c.path}:${c.line}-${c.endLine}\n`);
+  for (const p of result.fileLevel)
+    process.stdout.write(`* ${p} (whole file: graph has no spans, rebuild for symbol level)\n`);
+  const files = new Set();
+  process.stdout.write("\n");
+  for (const hit of hits) {
+    if (hit.node?.path) files.add(hit.node.path);
+    process.stdout.write(
+      `${" ".repeat(hit.dist)}- ${hit.node?.name || hit.id} [${hit.kind}] ${hit.node?.path || "-"}\n`,
+    );
+  }
+  process.stdout.write(`\n${hits.length} dependents across ${files.size} files\n`);
+  if (result.notIndexed.length)
+    process.stdout.write(`not in the graph: ${result.notIndexed.join(", ")}\n`);
+  process.stdout.write(`${freshnessLine(freshness)}\n`);
+}
+
 function main() {
   const { flags, positional } = parseFlags(process.argv.slice(2));
   const name = positional.join(" ").trim();
-  if (!name) {
+  const diffMode = flags.diff !== undefined || flags["diff-file"] !== undefined;
+  if (diffMode) {
+    const spec = flags["diff-file"] !== undefined ? flags["diff-file"] : flags.diff;
+    if (spec === true || String(spec).startsWith("-")) {
+      process.stderr.write(
+        "graph-affected: --diff takes <base> or <base>..<head>; --diff-file takes a path\n",
+      );
+      process.exit(64);
+    }
+  } else if (!name) {
     process.stderr.write(
-      'graph-affected: a symbol name is required, e.g. graph-affected "Flight"\n',
+      'graph-affected: a symbol name is required, e.g. graph-affected "Flight", or --diff <base>\n',
     );
     process.exit(64);
   }
@@ -109,12 +242,20 @@ function main() {
   const depth = Number(flags.depth) > 0 ? Number(flags.depth) : 2;
   const kinds = flags.kind && flags.kind !== true ? new Set(String(flags.kind).split(",")) : null;
 
+  if (diffMode) {
+    try {
+      return runDiff(flags, graph, depth, kinds);
+    } catch (e) {
+      process.stderr.write(`graph-affected: ${e.message}\n`);
+      process.exit(1);
+    }
+  }
+
   const seeds = findByName(graph, name);
+  const freshness = graphFreshness(graph);
   if (seeds.length === 0) {
     if (flags.json === true) {
-      process.stdout.write(
-        JSON.stringify({ symbol: name, seeds: [], affected: [] }, null, 2) + "\n",
-      );
+      printJson({ symbol: name, seeds: [], affected: [], freshness });
     } else {
       process.stdout.write(`no node named '${name}'\n`);
     }
@@ -124,23 +265,12 @@ function main() {
   const hits = affected({ graph, seeds, depth, kinds });
 
   if (flags.json === true) {
-    process.stdout.write(
-      JSON.stringify(
-        {
-          symbol: name,
-          seeds: seeds.map((s) => s.id),
-          affected: hits.map((h) => ({
-            id: h.id,
-            dist: h.dist,
-            edgeKind: h.kind,
-            path: h.node?.path || null,
-          })),
-        },
-        null,
-        2,
-      ) + "\n",
-    );
-    return;
+    return printJson({
+      symbol: name,
+      seeds: seeds.map((s) => s.id),
+      affected: hitRows(hits),
+      freshness,
+    });
   }
 
   process.stdout.write(`# affected by ${name}\n\n`);
@@ -156,6 +286,7 @@ function main() {
     );
   }
   process.stdout.write(`\n${hits.length} dependents across ${files.size} files\n`);
+  process.stdout.write(`${freshnessLine(freshness)}\n`);
 }
 
 if (process.argv[1] && process.argv[1].endsWith("graph-affected.mjs")) main();

package/pipeline/scripts/graph-query.mjs

@@ -99,6 +99,20 @@ function renderNode(node) {
   return `${node.name} (${kind}) ${where}`;
 }
 
+/**
+ * The line main() prints for a hit. The budget is charged for this, not for
+ * the bare node text, so the token count it reports is the one the caller pays.
+ *
+ * @param {number} dist
+ * @param {string} line
+ * @param {string|null} via
+ * @returns {string}
+ */
+export function printedLine(dist, line, via) {
+  const prefix = dist === 0 ? "*" : " ".repeat(dist) + "-";
+  return `${prefix} ${line}${via ? ` [${via}]` : ""}`;
+}
+
 /**
  * Seed, then breadth-first expand until the budget is spent.
  *
@@ -119,7 +133,7 @@ export function traverse({ graph, question, budget, depth, seedCount }) {
   const queue = seeds.map((n) => ({ node: n, dist: 0, via: null }));
   while (queue.length) {
     const { node, dist, via } = queue.shift();
-    const cost = Math.ceil(renderNode(node).length / CHARS_PER_TOKEN);
+    const cost = Math.ceil(printedLine(dist, renderNode(node), via).length / CHARS_PER_TOKEN);
     if (tokens + cost > budget) {
       truncated = true;
       break;
@@ -177,9 +191,7 @@ function main() {
     return;
   }
   for (const hit of result.hits) {
-    const prefix = hit.dist === 0 ? "*" : " ".repeat(hit.dist) + "-";
-    const via = hit.via ? ` [${hit.via}]` : "";
-    process.stdout.write(`${prefix} ${hit.line}${via}\n`);
+    process.stdout.write(`${printedLine(hit.dist, hit.line, hit.via)}\n`);
   }
   process.stdout.write(
     `\n${result.hits.length} nodes, ~${result.tokens} tokens` +

package/pipeline/scripts/pre-commit-check.sh

@@ -227,7 +227,7 @@ $folded"
 
   # Model-provider and ML-hub keys. `sk-ant-` and `sk-proj-` are checked before
   # the bare `sk-` form so the message names the provider a reader can revoke.
-  if echo "$content" | grep -qE 'sk-ant-[A-Za-z0-9_-]{32,}|sk-proj-[A-Za-z0-9_-]{32,}|pplx-[A-Za-z0-9]{32,}|hf_[A-Za-z0-9]{30,}'; then
+  if echo "$content" | grep -qE 'sk-ant-[A-Za-z0-9_-]{32,}|sk-proj-[A-Za-z0-9_-]{32,}|sk-or-v1-[A-Za-z0-9]{40,}|pplx-[A-Za-z0-9]{32,}|hf_[A-Za-z0-9]{30,}|gsk_[A-Za-z0-9]{40,}'; then
     echo "BLOCKED: Model-provider API key in $file" >&2
     FOUND=1
   fi