@mmerterden/multi-agent-pipeline 20.22.0 → 20.23.0

package/pipeline/scripts/analysis-story-body.mjs

@@ -16,6 +16,11 @@ import { escapeJiraWiki, wikiLink } from "./jira-wiki-escape.mjs";
 import { redesignSections } from "../lib/analysis-sections.mjs";
 
 const MAX_CRITERIA = 8;
+
+// Panel border colours of a story section, the ones testers read stories in:
+// the user story, the acceptance criteria, and every other section.
+const PANEL = { story: "#d4d39e", criteria: "#d4a19e", info: "#9eb6d4" };
+const panel = (colour, lines) => [`{panel:borderColor=${colour}}`, ...lines, "{panel}", ""];
 const MAX_DESIGN_LINKS = 5;
 
 // A criterion that describes a refusal, an error or an alternative path. One is
@@ -152,19 +157,30 @@ function linksOf(story, lines, ctx) {
 
 function render({ userStory, acceptance, currentVsTarget, links }, sourceIds) {
   const out = [];
-  if (userStory) out.push("h3. User story", escapeJiraWiki(userStory), "");
+  if (userStory) out.push(...panel(PANEL.story, ["h3. User story", escapeJiraWiki(userStory)]));
   if (acceptance.length) {
-    out.push("h3. Acceptance criteria", ...acceptance.map((a) => `# ${escapeJiraWiki(a)}`), "");
+    out.push(
+      ...panel(PANEL.criteria, [
+        "h3. Acceptance criteria",
+        ...acceptance.map((a) => `# ${escapeJiraWiki(a)}`),
+      ]),
+    );
   }
   if (currentVsTarget.length) {
-    out.push("h3. Current vs target", "||Id||Status||Where||");
-    for (const r of currentVsTarget) {
-      out.push(`|${escapeJiraWiki(r.id)}|${escapeJiraWiki(r.status)}|${escapeJiraWiki(r.where)}|`);
-    }
-    out.push("");
+    out.push(
+      ...panel(PANEL.info, [
+        "h3. Current vs target",
+        "||Id||Status||Where||",
+        ...currentVsTarget.map(
+          (r) => `|${escapeJiraWiki(r.id)}|${escapeJiraWiki(r.status)}|${escapeJiraWiki(r.where)}|`,
+        ),
+      ]),
+    );
   }
   if (links.length) {
-    out.push("h3. Links", ...links.map((l) => `* ${wikiLink(l.label, l.url)}`), "");
+    out.push(
+      ...panel(PANEL.info, ["h3. Links", ...links.map((l) => `* ${wikiLink(l.label, l.url)}`)]),
+    );
   }
   out.push(
     `Sources: ${escapeJiraWiki(sourceIds.length ? sourceIds.join(", ") : "derived from the section heading")}`,

package/pipeline/scripts/capture-flush.sh

@@ -66,7 +66,10 @@ LOGS="${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}"
 SCRIPTS="$HOME/.claude/scripts"
 [ -d "$SCRIPTS" ] || SCRIPTS="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
 
-say() { [ "$QUIET" -eq 1 ] && return 0; printf '%s\n' "$1"; }
+say() {
+  [ "$QUIET" -eq 1 ] && return 0
+  if [ "$JSON" -eq 1 ]; then printf '%s\n' "$1" >&2; else printf '%s\n' "$1"; fi
+}
 
 # Resolve the run to flush.
 #

package/pipeline/scripts/code-graph-rules/android.json

@@ -51,6 +51,7 @@
     }
   ],
   "referenceKinds": ["class", "interface", "object", "enum", "record", "typealias"],
+  "supertypes": { "syntax": "colon", "kinds": ["class", "interface", "object", "enum"] },
   "referenceKindsNote": "fun is deliberately absent, for the reason Swift's rules record for func: a bare lowercase name matched across files is almost never a call to that exact declaration, and on a large app the generic ones (invoke, build, create, get) take the top god-node slots purely because each happened to be declared once. Composables are the tempting exception - they are capitalised and behave like types - but they are declared with fun, so including them means including every other fun with them.",
   "ignoredIdentifiers": [
     "this",

package/pipeline/scripts/code-graph-rules/ios.json

@@ -51,6 +51,11 @@
     }
   ],
   "referenceKinds": ["class", "struct", "enum", "protocol", "actor", "typealias"],
+  "supertypes": {
+    "syntax": "colon",
+    "kinds": ["class", "struct", "enum", "protocol", "actor"],
+    "extensionPattern": "\\bextension\\s+([A-Z][A-Za-z0-9_.]*)"
+  },
   "referenceKindsNote": "func is deliberately absent. A bare lowercase method name matched across files is almost never a call to that exact declaration: on a large Swift app `with`, `size`, `name`, `image` and `model` took the top god-node slots purely because each happened to be declared in exactly one file. Functions still reach the graph through their `defines` edge, so they stay findable by name.",
   "ignoredIdentifiers": [
     "self",

package/pipeline/scripts/code-graph-rules/node.json

@@ -46,6 +46,7 @@
     }
   ],
   "referenceKinds": ["class", "interface", "type", "enum", "const"],
+  "supertypes": { "syntax": "extends", "kinds": ["class", "interface"] },
   "referenceKindsNote": "function is deliberately absent, for the reason Swift's rules record for func: a bare name matched across files is almost never a call to that exact declaration, and the generic ones (run, main, get, parse, handler) would take the top god-node slots purely because each happened to be declared once. Functions still reach the graph through their defines edge, so they stay findable by name. const is present but narrowed to an uppercase-initial declaration at column 0, which is what a component, a singleton or an exported table looks like; a lowercase const is a local and is not a declaration anyone references across files. Measured on this repo (126 sources): including function put `ok` at degree 52, `f` at 38, `tokens` at 15 and `arg` at 12 - local helper names that happen to be declared exactly once, so the ambiguity rule does not catch them either. Excluding it leaves a thin symbol layer, and that is the honest shape of this stack: a JavaScript module's exported unit is usually a function, so the useful graph here is the import graph between files. `graph-affected \"<file>.mjs\"` answers who imports a module, which is the question this stack actually gets asked.",
   "ignoredIdentifiers": [
     "this",

package/pipeline/scripts/code-graph-rules/python.json

@@ -30,6 +30,7 @@
     }
   ],
   "referenceKinds": ["class"],
+  "supertypes": { "syntax": "parens", "kinds": ["class"] },
   "referenceKindsNote": "def is deliberately absent, for the reason Swift's rules record for func and the node rules record with measurements: a bare lowercase name matched across files is almost never a call to that exact declaration, and Python's convention of short module-level helpers (main, run, load, parse, setup) makes it worse than most. Functions still reach the graph through their defines edge, so they stay findable by name.",
   "ignoredIdentifiers": [
     "self",

package/pipeline/scripts/git-path.mjs

@@ -61,3 +61,24 @@ export function unquotePathIfNeeded(s) {
   }
   return s;
 }
+
+/**
+ * The path a `---` or `+++` diff header names (the text after that marker): a
+ * quoted path ends at its closing quote, which git may follow with a tab, and
+ * an unquoted one ends at a tab.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+export function diffHeaderPath(text) {
+  if (text.startsWith('"')) {
+    for (let i = 1; i < text.length; i++) {
+      if (text[i] === "\\") {
+        i++;
+        continue;
+      }
+      if (text[i] === '"') return unquoteGitPath(text.slice(1, i));
+    }
+  }
+  return text.replace(/\t.*$/, "");
+}

package/pipeline/scripts/graph-affected.mjs

@@ -171,7 +171,8 @@ function runDiff(flags, graph, depth, kinds) {
     text = diffFor(root, flags.diff);
   }
   const freshness = graphFreshness(graph, { root });
-  const side = graphSide(graph, { root });
+  const range = flags["diff-file"] && flags["diff-file"] !== true ? undefined : flags.diff;
+  const side = graphSide(graph, { root, range });
   const mapped = changedSymbols(graph, parseHunkRanges(text, side));
   const hits = affected({ graph, seeds: mapped.seeds, depth, kinds });
   const result = {

package/pipeline/scripts/graph-confirm.mjs

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+
+/**
+ * @file graph-confirm.mjs  -  a name-based blast radius, checked by a language server.
+ *
+ * The code graph joins files to declarations by name, so a dependent it lists
+ * may only share a name with the changed type, and a dependent behind an
+ * ambiguous name is missing. The toolkit's `code_references` answers the same
+ * question semantically when the project has an index. This merges the two
+ * without trusting either blindly:
+ *
+ *   confirmed  a direct dependent the server also found
+ *   name-only  a direct dependent a ready semantic index did not find
+ *   unchecked  a deeper ring the server did not name (it depends on an
+ *              intermediate declaration), or no answer could check it
+ *
+ * A deeper ring the server names directly is confirmed too.
+ *
+ * `lspOnly` lists files the server found that the graph did not. Only a result
+ * with `semantic: true` and `indexReady: true` confirms or demotes anything; a
+ * fallback answer or an index still building leaves every file unchecked,
+ * because "not found" from an unready index is not evidence.
+ *
+ * Inputs:
+ *   --affected <path>    graph-affected --json output
+ *   --references <path>  JSON array of code_references results, one per changed type
+ *   --root <path>        repository root the server's absolute paths are under
+ *
+ * Exit codes: 0 answered, 64 usage error.
+ *
+ * Zero runtime dependencies (ADR-0004).
+ *
+ * @module pipeline/scripts/graph-confirm
+ */
+
+import { readFileSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+
+/**
+ * @param {{affected: Array<{path: string|null, dist: number}>}} affectedDoc
+ * @param {Array<{semantic?: boolean, indexReady?: boolean, results?: Array<{file: string}>}>} references
+ * @param {{root: string}} opts
+ */
+export function confirmImpact(affectedDoc, references, { root }) {
+  const usable = (references || []).filter(
+    (r) => r && r.semantic === true && r.indexReady === true,
+  );
+  const checked = usable.length > 0 && usable.length === (references || []).length;
+  const real = (p) => {
+    const abs = resolve(p);
+    try {
+      return realpathSync(abs);
+    } catch {
+      const parent = dirname(abs);
+      return parent === abs ? abs : join(real(parent), basename(abs));
+    }
+  };
+  const repo = real(root);
+  // A server answers with paths relative to its own workspace root (the
+  // nearest package), absolute ones through whatever spelling of a symlinked
+  // directory it was given, and files outside the repository (SDKs).
+  const rel = (file, serverRoot) => {
+    const abs = isAbsolute(file) ? file : resolve(serverRoot || root, file);
+    const r = relative(repo, real(abs));
+    return r && !r.startsWith("..") && !isAbsolute(r) ? r : null;
+  };
+  const found = new Set();
+  for (const r of usable)
+    for (const loc of r.results || []) {
+      const f = loc?.file ? rel(loc.file, r.root) : null;
+      if (f) found.add(f);
+    }
+
+  const seedPaths = new Set((affectedDoc.changedSymbols || []).map((c) => c.path).filter(Boolean));
+  for (const id of affectedDoc.seeds || []) {
+    const s = String(id);
+    if (s.startsWith("sym:")) seedPaths.add(s.slice(4, s.lastIndexOf("#")));
+    else if (s.startsWith("file:")) seedPaths.add(s.slice(5));
+  }
+  const graphPaths = new Set();
+  const affected = (affectedDoc.affected || []).map((row) => {
+    if (row.path) graphPaths.add(row.path);
+    let confirmation = "unchecked";
+    if (checked && row.path && found.has(row.path)) confirmation = "confirmed";
+    else if (checked && row.dist === 1 && row.path) confirmation = "name-only";
+    return { ...row, confirmation };
+  });
+
+  const lspOnly = checked
+    ? [...found].filter((f) => !graphPaths.has(f) && !seedPaths.has(f)).sort()
+    : [];
+  const byPath = new Map();
+  for (const a of affected) if (a.path && !byPath.has(a.path)) byPath.set(a.path, a.confirmation);
+  const count = (c) => [...byPath.values()].filter((v) => v === c).length;
+  return {
+    affected,
+    lspOnly,
+    summary: {
+      confirmed: count("confirmed"),
+      nameOnly: count("name-only"),
+      unchecked: count("unchecked"),
+      lspOnly: lspOnly.length,
+      checked,
+    },
+  };
+}
+
+function flag(argv, name) {
+  const i = argv.indexOf(name);
+  const v = i >= 0 ? argv[i + 1] : undefined;
+  return v && !v.startsWith("--") ? v : null;
+}
+
+function main(argv) {
+  const affectedPath = flag(argv, "--affected");
+  const referencesPath = flag(argv, "--references");
+  const root = flag(argv, "--root");
+  if (!affectedPath || !referencesPath || !root) {
+    process.stderr.write(
+      "usage: graph-confirm.mjs --affected <json> --references <json> --root <path>\n",
+    );
+    process.exitCode = 64;
+    return;
+  }
+  let affectedDoc;
+  let references;
+  try {
+    affectedDoc = JSON.parse(readFileSync(affectedPath, "utf8"));
+    references = JSON.parse(readFileSync(referencesPath, "utf8"));
+  } catch (e) {
+    process.stderr.write(`graph-confirm: ${e.message}\n`);
+    process.exitCode = 64;
+    return;
+  }
+  if (!Array.isArray(references)) references = [references];
+  process.stdout.write(`${JSON.stringify(confirmImpact(affectedDoc, references, { root }))}\n`);
+}
+
+if (invokedDirectly(import.meta.url)) main(process.argv.slice(2));

package/pipeline/scripts/learnings-ledger.mjs

@@ -41,7 +41,8 @@
  *                 Distill the triage's rejected[] findings into rejected-preference
  *                 entries so reviewers stop re-raising them. SAFETY: blocking-
  *                 severity rejections are NOT distilled - a wrong rejection of a
- *                 blocking issue must never permanently suppress that class.
+ *                 blocking issue must never permanently suppress that class. Exit 2
+ *                 when nothing new was distilled (a repeat of the same triage).
  *   forget     [--statement "..."] [--kind <kind>] [--repo-slug <slug>]
  *                 Remove ledger entries matching the statement substring and/or
  *                 kind (rewrites the file). Use to clear a bad/stale learning.
@@ -311,7 +312,7 @@ function cmdFromTriage() {
     }
   }
   process.stdout.write(JSON.stringify({ ok: true, slug, added: written, skippedBlocking }) + "\n");
-  process.exitCode = 0;
+  process.exitCode = written ? 0 : 2;
   return;
 }
 

package/pipeline/scripts/product-context.mjs

@@ -40,19 +40,11 @@
  */
 
 import { execFileSync } from "node:child_process";
-import {
-  appendFileSync,
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  statSync,
-  writeFileSync,
-} from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { lockTimeoutFrom, withFileLockSync, writeJsonAtomicSync } from "../lib/json-file-lock.mjs";
 
 export const STACKS = ["ios", "android", "web", "backend", "resources"];
 const AUTH_SCHEMES = ["basic", "bearer"];
@@ -429,13 +421,26 @@ function defaultPrefsPath() {
   );
 }
 
-function writePrefsAtomic(file, prefs) {
+/**
+ * Read, change and replace the preferences file under the lock write-state and
+ * migrate-prefs take, so a setup or a second run writing at the same moment is
+ * never overwritten. A file that cannot be parsed stops the write instead of
+ * being replaced; a symlinked file is written through to its target, at its
+ * own mode.
+ */
+function updatePrefs(file, mutate) {
   mkdirSync(dirname(file), { recursive: true });
-  const tmp = `${file}.tmp.${process.pid}`;
-  const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
-  writeFileSync(tmp, `${JSON.stringify(prefs, null, 2)}\n`, { mode });
-  chmodSync(tmp, mode);
-  renameSync(tmp, file);
+  return withFileLockSync(
+    file,
+    () => {
+      const current = existsSync(file) ? readJson(file) : { global: {}, projects: {} };
+      const next = mutate(current);
+      const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
+      writeJsonAtomicSync(file, next, { mode, followSymlink: true });
+      return next;
+    },
+    { timeoutMs: lockTimeoutFrom(process.env) },
+  );
 }
 
 function readJson(file) {
@@ -491,11 +496,13 @@ function main() {
         fail("learn needs --project, --product and --repos");
       let next;
       try {
-        next = learnProduct(loadPrefs(), args.project, args.product, readJson(args.repos));
+        const repos = readJson(args.repos);
+        next = updatePrefs(prefsFile, (prefs) =>
+          learnProduct(prefs, args.project, args.product, repos),
+        );
       } catch (e) {
         fail(e.message);
       }
-      writePrefsAtomic(prefsFile, next);
       process.stdout.write(
         `${JSON.stringify({ product: args.product, repos: next.global.products[args.product].repos.length })}\n`,
       );
@@ -510,7 +517,11 @@ function main() {
     }
     case "decline": {
       if (!args.project) fail("decline needs --project");
-      writePrefsAtomic(prefsFile, declineProduct(loadPrefs(), args.project));
+      try {
+        updatePrefs(prefsFile, (prefs) => declineProduct(prefs, args.project));
+      } catch (e) {
+        fail(e.message);
+      }
       process.stdout.write(`${JSON.stringify({ project: args.project, product: "" })}\n`);
       break;
     }

package/pipeline/scripts/symbol-existence-gate.mjs

@@ -46,6 +46,7 @@ import { invokedDirectly } from "../lib/invoked-directly.mjs";
 import { attendedVerdict } from "../lib/unattended.mjs";
 import { getAdapter, resolveStack, AdapterError } from "./_stack-adapter.mjs";
 import { globToRegExp } from "./glob-match.mjs";
+import { diffHeaderPath } from "./git-path.mjs";
 import { gateContext, recordQuietly } from "./gate-ledger.mjs";
 
 const GATE = "symbol-existence";
@@ -208,13 +209,13 @@ function keyExists(ref, { keys, idents }) {
 
 function listFiles(dir, head) {
   if (head) {
-    const r = git(dir, ["ls-tree", "-r", "--name-only", head]);
+    const r = git(dir, ["ls-tree", "-r", "-z", "--name-only", head]);
     if (!r.ok) throw new UsageError(`cannot list ${head}: ${r.err}`);
-    return r.out.split("\n").filter(Boolean);
+    return r.out.split("\0").filter(Boolean);
   }
-  const tracked = git(dir, ["ls-files", "--cached"]);
-  const untracked = git(dir, ["ls-files", "--others", "--exclude-standard"]);
-  return [...new Set([...tracked.out.split("\n"), ...untracked.out.split("\n")].filter(Boolean))];
+  const tracked = git(dir, ["ls-files", "-z", "--cached"]);
+  const untracked = git(dir, ["ls-files", "-z", "--others", "--exclude-standard"]);
+  return [...new Set([...tracked.out.split("\0"), ...untracked.out.split("\0")].filter(Boolean))];
 }
 
 function readAt(dir, head, file) {
@@ -236,14 +237,25 @@ function readAt(dir, head, file) {
  */
 export function addedLines(dir, base, head) {
   const range = head ? [base, head] : [base];
-  const d = git(dir, ["diff", "-U0", "--no-color", "--no-ext-diff", "--diff-filter=AMR", ...range]);
+  const d = git(dir, [
+    "diff",
+    "-U0",
+    "--no-color",
+    "--no-ext-diff",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    "--diff-filter=AMR",
+    "--end-of-options",
+    ...range,
+  ]);
   if (!d.ok) throw new UsageError(`git diff failed: ${d.err}`);
   const out = [];
   let file = null;
   let line = 0;
   for (const raw of d.out.split("\n")) {
     if (raw.startsWith("+++ ")) {
-      file = raw === "+++ /dev/null" ? null : raw.slice(4).replace(/^b\//, "");
+      const path = diffHeaderPath(raw.slice(4));
+      file = path === "/dev/null" ? null : path.replace(/^b\//, "");
       continue;
     }
     const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
@@ -258,8 +270,8 @@ export function addedLines(dir, base, head) {
     }
   }
   if (!head) {
-    const untracked = git(dir, ["ls-files", "--others", "--exclude-standard"]);
-    for (const f of untracked.out.split("\n").filter(Boolean)) {
+    const untracked = git(dir, ["ls-files", "-z", "--others", "--exclude-standard"]);
+    for (const f of untracked.out.split("\0").filter(Boolean)) {
       const text = readAt(dir, null, f);
       if (text === null || text.includes("\u0000")) continue;
       text.split("\n").forEach((t, i) => out.push({ file: f, line: i + 1, text: t }));

package/pipeline/scripts/test-gap-scan.mjs

@@ -207,7 +207,10 @@ function isTestPath(path) {
     rules.testPathPrefixes.some((p) => basename(path).startsWith(p))
   )
     return true;
-  if (Array.isArray(rules.testPathContains) && rules.testPathContains.some((c) => path.includes(c)))
+  if (
+    Array.isArray(rules.testPathContains) &&
+    rules.testPathContains.some((c) => `/${path}`.includes(c))
+  )
     return true;
   return false;
 }

package/pipeline/scripts/test-strength.mjs

@@ -236,15 +236,14 @@ function prepare(opts) {
 }
 
 function changedFiles(root, base, head) {
-  const r = git(root, ["diff", "--no-renames", "--name-status", base, head]);
+  const r = git(root, ["diff", "--no-renames", "--name-status", "-z", base, head]);
   if (!r.ok) throw new UsageError(`git diff failed: ${r.err}`);
-  return r.out
-    .split("\n")
-    .filter(Boolean)
-    .map((line) => {
-      const [status, ...rest] = line.split("\t");
-      return { status: status[0], path: rest.join("\t") };
-    });
+  const fields = r.out.split("\0");
+  const out = [];
+  for (let i = 0; i + 1 < fields.length; i += 2) {
+    if (fields[i]) out.push({ status: fields[i][0], path: fields[i + 1] });
+  }
+  return out;
 }
 
 function testCommandFor(opts, adapter, worktree, file) {

package/pipeline/scripts/usage-identity.mjs

@@ -67,7 +67,7 @@ const HOST = "github.com";
 const API_DEFAULT = "https://api.github.com";
 const DEFAULT_KEYS = ["id_ed25519", "id_ecdsa", "id_rsa"];
 export const LOGIN_METHODS = ["gh", "credential", "ssh"];
-const LOGIN_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,38}$/;
+export const LOGIN_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,38}$/;
 const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 
 export function defaultPrefsPath(env = process.env) {