@mmerterden/multi-agent-pipeline 20.33.0 → 20.35.0

package/pipeline/scripts/_secret-scan.mjs

@@ -0,0 +1,105 @@
+/**
+ * @file _secret-scan.mjs  -  the check every memory store runs before it writes.
+ *
+ * Text goes to a 0600 temp file and through `pre-commit-check.sh --scan-file`,
+ * which owns the secret patterns; a hit is refused, never written. A store
+ * that cannot find the scanner refuses as well, because "unchecked" and
+ * "clean" are different answers and only one of them may reach a file that
+ * later rides into a prompt.
+ *
+ * `<private>...</private>` spans are removed before the scan, so a caller can
+ * mark text that must not be remembered; an unclosed tag drops everything
+ * after it.
+ *
+ * Control bytes are removed from the scanned copy: the scanner skips a file
+ * `file --mime` calls binary, and one NUL is enough for that verdict. Removing
+ * them also rejoins a token split by one. A run that starts with a known token
+ * prefix is scanned a second time with its inner whitespace removed, so a token
+ * hard-wrapped by a space or a line break is still caught; prose without such
+ * a prefix is scanned once, as written.
+ *
+ * @module pipeline/scripts/_secret-scan
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+// eslint-disable-next-line no-control-regex
+const CONTROL = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g;
+const WRAPPED_TOKEN =
+  /(?:gh[pousr]_|github_pat_|glpat-|xox[baprs]-|sk-|sk_live_|rk_live_|npm_|hf_|gsk_|pplx-|fig[a-z]_|eyJ|AIza|AKIA|ASIA)[A-Za-z0-9_.-]{0,256}(?:\s+[A-Za-z0-9_.-]{1,256}){1,16}/g;
+
+/** The text with whitespace removed inside every run that starts like a token. */
+function rejoined(text) {
+  return text.replace(WRAPPED_TOKEN, (m) => m.replace(/\s+/g, ""));
+}
+
+/** Remove `<private>` spans; an unclosed opening tag drops the rest. */
+export function stripPrivate(text) {
+  return String(text ?? "")
+    .replace(/<private>[\s\S]*?<\/private>/gi, " ")
+    .replace(/<private>[\s\S]*$/i, " ")
+    .replace(/<\/private>/gi, " ");
+}
+
+function scannerPath() {
+  const local = join(HERE, "pre-commit-check.sh");
+  if (existsSync(local)) return local;
+  const installed = join(homedir(), ".claude", "scripts", "pre-commit-check.sh");
+  return existsSync(installed) ? installed : null;
+}
+
+/**
+ * A scanner bound to one temp directory. `isClean(text)` is true only when
+ * the scanner ran and found nothing; call `close()` when done.
+ */
+export function openScanner() {
+  const scanner = scannerPath();
+  if (!scanner) return { scanned: false, isClean: () => false, close() {} };
+  const dir = mkdtempSync(join(tmpdir(), "secret-scan-"));
+  const file = join(dir, "candidate.txt");
+  return {
+    scanned: true,
+    isClean(text) {
+      const plain = String(text ?? "").replace(CONTROL, "");
+      const copies = [plain];
+      const joined = rejoined(plain);
+      if (joined !== plain) copies.push(joined);
+      return copies.every((copy) => {
+        writeFileSync(file, `${copy}\n`, { mode: 0o600 });
+        try {
+          execFileSync("bash", [scanner, "--scan-file", file], {
+            stdio: "ignore",
+            timeout: 15_000,
+          });
+          return true;
+        } catch {
+          return false;
+        }
+      });
+    },
+    close() {
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+/** Split items into kept and dropped by the text `textOf(item)` returns. */
+export function dropSecrets(items, textOf) {
+  const scan = openScanner();
+  const kept = [];
+  let dropped = 0;
+  try {
+    for (const it of items) {
+      if (scan.isClean(textOf(it))) kept.push(it);
+      else dropped++;
+    }
+  } finally {
+    scan.close();
+  }
+  return { kept, dropped, scanned: scan.scanned };
+}

package/pipeline/scripts/_test-gaming.mjs

@@ -22,6 +22,14 @@
  *                       timeouts are milliseconds, Swift and Python seconds,
  *                       Kotlin and Java milliseconds; a Ms / Millis / Seconds
  *                       suffix overrides.
+ *   disabled-test       a test switched off in a test file: an unconditional
+ *                       skip (`XCTSkip(`, `XCTSkipIf(true`, `.skip(`, `xit(`,
+ *                       `@Disabled`, `@Ignore`, `@pytest.mark.skip`,
+ *                       `t.Skip(`), a Swift Testing `.disabled` trait, or a
+ *                       renamed `disabled_test`. Blocking: the suite goes green
+ *                       by not running the test. A skip with a real condition
+ *                       (`skipif`, `XCTSkipUnless(<expr>)`) is a platform
+ *                       choice and is left alone.
  *
  * Only source files are read, and comment lines are skipped. Configuration
  * (`*.config.*`, CI workflows, YAML) and documentation are out of scope:
@@ -66,6 +74,19 @@ const KOTLIN_RUN_CATCHING = /\brunCatching\s*\{/;
 const RESULT_READ =
   /\.(onFailure|getOrThrow|getOrElse|getOrDefault|exceptionOrNull|fold|isFailure|isSuccess|recover)\b|=\s*runCatching|return\s+runCatching/;
 
+const DISABLED_TEST = [
+  /\bXCTSkip\s*\(/,
+  /\bXCTSkip(?:If|Unless)\s*\(\s*(?:true|false)\s*[,)]/,
+  /@Test\s*\([^)]*\.disabled\b/,
+  /\bfunc\s+(?:disabled_|x)test\w*\s*\(/,
+  /^\s*@(?:Disabled|Ignore)\b/,
+  /\b(?:it|test|describe|context|suite)\.skip\s*\(/,
+  /(?:^|[^\w.$])(?:xit|xtest|xdescribe|xcontext)\s*\(/,
+  /@pytest\.mark\.skip\b(?!if)/,
+  /@unittest\.skip\b(?!If|Unless)/,
+  /\bt\.Skip(?:Now|f)?\s*\(/,
+];
+
 const LONG_TEST_WAIT_SECONDS = 30;
 const RAISE_FACTOR = 2;
 
@@ -220,6 +241,21 @@ export function scanTestGaming(diffText) {
         );
       }
     }
+    if (testFile) {
+      for (const { line, text } of f.addedAt) {
+        if (COMMENT.test(text) || !DISABLED_TEST.some((re) => re.test(text))) continue;
+        findings.push(
+          finding(
+            file,
+            line,
+            "disabled-test",
+            "blocking",
+            text,
+            `A test is switched off at ${file}:${line}. The suite then passes by not running it; fix what it catches, or remove it with the reason in the commit body.`,
+          ),
+        );
+      }
+    }
     for (const run of segments(f.addedAt)) findings.push(...swallowedIn(file, run));
     for (const hunk of f.hunks) findings.push(...timeoutsIn(file, hunk, testFile));
   }

package/pipeline/scripts/_unified-diff.mjs

@@ -10,7 +10,7 @@
 
 /**
  * @typedef {{line: number, text: string}} DiffLine
- * @typedef {{removed: DiffLine[], added: DiffLine[]}} Hunk
+ * @typedef {{header: string, removed: DiffLine[], added: DiffLine[]}} Hunk
  * @typedef {{added: string[], addedAt: DiffLine[], removed: string[], removedAt: DiffLine[],
  *            hunks: Hunk[], isNew: boolean, isDeleted: boolean, binary: boolean}} DiffFile
  */
@@ -73,7 +73,7 @@ export function parseUnifiedDiff(text) {
     let newLeft = h[4] === undefined ? 1 : Number(h[4]);
     let oldNo = Number(h[1]);
     let newNo = Number(h[3]);
-    const hunk = { removed: [], added: [] };
+    const hunk = { header: h[0], removed: [], added: [] };
     cur.hunks.push(hunk);
     while ((oldLeft > 0 || newLeft > 0) && i + 1 < lines.length) {
       const body = lines[++i];

package/pipeline/scripts/agent-guard.py

@@ -98,24 +98,11 @@ def normalize_for_match(text: str) -> str:
     )
 
 
-# Force flags, and ONLY force flags.
-#
-# The previous pattern ended in `-\S*f\S*`, which matches any flag containing an
-# `f` anywhere - so it fired on `--ff-only`, `--follow-tags`, and `--file=...`.
-# Two real false positives followed:
-#
-#   git pull --ff-only && git push origin main   -> BLOCKED
-#   git push --follow-tags origin main           -> BLOCKED
-#
-# Neither rewrites history. `--follow-tags` is the normal way to push a release
-# tag with its commit, so the guard blocked a routine release step. Being
-# fail-closed is right for a data-loss guard, but only against the thing it
-# guards; blocking safe commands trains people to work around the hook, which
-# costs more safety than it buys.
-#
-# The short-flag arm is now `-[A-Za-z]*f[A-Za-z]*`: a SINGLE dash followed only by
-# letters, so it still catches `-f`, `-fq`, `-qf`, and never a `--long-flag`
-# (whose second character is `-`, not a letter).
+# Force flags, and only force flags: `--force`, `--force-with-lease[=ref]`,
+# `--force-if-includes`, and a single-dash cluster that contains `f` (`-f`,
+# `-fq`, `-qf`). A long flag that merely contains an f (`--ff-only`,
+# `--follow-tags`, `--file=`) rewrites nothing and passes: blocking safe
+# commands trains people to work around the hook.
 FORCE = re.compile(
     r"(^|\s)("
     r"--force(-with-lease|-if-includes)?(=\S+)?"  # --force, --force-with-lease[=ref], --force-if-includes
@@ -290,6 +277,9 @@ def _attributed(text: str) -> bool:
 # The directory the hook payload names as the session's cwd; message files a
 # command names relative to it are read from there.
 PAYLOAD_CWD = {"dir": None}
+# The hook payload's session id: a commit inside the run this session drives
+# is confirmed by the user.
+PAYLOAD_SESSION = {"id": None}
 
 
 def _command_rules(cmd: str) -> str:
@@ -299,6 +289,7 @@ def _command_rules(cmd: str) -> str:
     segments into another directory."""
     pending_ask = None
     cwd = None
+    in_run = None
     for seg, toks in _guard_rules.command_segments(cmd):
         if toks and toks[0] in ("{", "}"):
             toks = toks[1:]
@@ -318,7 +309,39 @@ def _command_rules(cmd: str) -> str:
         reason = _guard_rules.no_verify(toks)
         if reason:
             return "BLOCK_NOVERIFY\t" + reason
-        # Rule 4: writes a person confirms (issue closure, Jira transition).
+        # Rule 1c: attribution in a pull request or issue the gh CLI publishes.
+        gh_body = _guard_rules.gh_text(toks, here)
+        if gh_body and "$(" in gh_body:
+            gh_body = "\n".join([gh_body] + _guard_rules.strip_heredoc_bodies(cmd)[1])
+        if _attributed(gh_body):
+            return "BLOCK_ATTRIB"
+        # Rule 9: inside the run this session drives, a published body keeps
+        # real line breaks and no HTML entities.
+        _, argv = _guard_rules.command_word(toks)
+        bodies = _guard_rules.payload_files(argv)
+        piped = _guard_rules.stdin_payload(argv) and bool(_guard_rules.strip_heredoc_bodies(cmd)[1])
+        if gh_body or bodies or piped:
+            if in_run is None:
+                in_run = bool(_guard_rules.driving_run(PAYLOAD_SESSION["id"]))
+            if in_run:
+                jira = bool(_guard_rules.JIRA_API.search(seg))
+                reason = _guard_rules.body_text_reason(gh_body) if gh_body else None
+                for path in bodies:
+                    reason = reason or _guard_rules.payload_reason(path, here, entities=jira)
+                if piped:
+                    for body in _guard_rules.strip_heredoc_bodies(cmd)[1]:
+                        reason = reason or _guard_rules.payload_reason(None, here, entities=jira, raw=body)
+                if reason:
+                    return "DENY\t" + reason
+        # Rule 8: a pull request PUT that would wipe reviewers or refs.
+        reason = _guard_rules.pr_update_reason(toks, seg, here)
+        if reason:
+            return "DENY\t" + reason
+        # Rule 6: a token on the vercel command line.
+        reason = _guard_rules.vercel_token_reason(toks)
+        if reason:
+            return "DENY\t" + reason
+        # Rule 4: writes a person confirms (issue closure, Jira transition, clean-up).
         ask = _guard_rules.ask_reason(toks, seg, here)
         if ask and not pending_ask:
             pending_ask = "ASK\t" + ask
@@ -338,7 +361,30 @@ def decide(cmd: str, depth: int = 0) -> str:
         return "BLOCK_ATTRIB"
     if commits and _guard_rules.ai_generated(cmd, PAYLOAD_CWD["dir"]):
         return "BLOCK_ATTRIB"
+    # Rule 7: a stored secret printed with nothing capturing it.
+    reason = _guard_rules.secret_echo_reason(cmd)
+    if reason:
+        return "DENY\t" + reason
     pending_ask = None
+    if commits and _guard_rules.CLOSING.search(_guard_rules.message_text(cmd, PAYLOAD_CWD["dir"])):
+        pending_ask = (
+            "ASK\tthe commit message carries a closing keyword (Closes/Fixes/Resolves #N), which closes "
+            "the issue when the commit lands on the default branch; use Ref: #N, or confirm the closure"
+        )
+    really_commits = any(
+        git_subcommand(toks) == "commit" for _, toks in _guard_rules.command_segments(cmd)
+    )
+    driving = _guard_rules.driving_run(PAYLOAD_SESSION["id"]) if really_commits else None
+    if driving:
+        reason = _guard_rules.commit_subject_reason(
+            _guard_rules.message_text(cmd, PAYLOAD_CWD["dir"]), PAYLOAD_CWD["dir"]
+        )
+        if reason:
+            return "DENY\t" + reason
+    if driving and not pending_ask:
+        reason = _guard_rules.run_commit_reason(driving)
+        if reason:
+            pending_ask = "ASK\t" + reason
 
     # Rule 2: force-push to a protected branch. Evaluate each push segment on its
     # own so a neighbouring command's flags cannot implicate it. A `cd` earlier
@@ -789,6 +835,8 @@ def main() -> None:
         cmd = (data.get("tool_input") or {}).get("command", "")
         if isinstance(data.get("cwd"), str) and data.get("cwd"):
             PAYLOAD_CWD["dir"] = data["cwd"]
+        if isinstance(data.get("session_id"), str) and data.get("session_id"):
+            PAYLOAD_SESSION["id"] = data["session_id"]
         if isinstance(cmd, str):
             seen["text"], seen["raw"] = cmd, False
         verdict = decide(cmd) if isinstance(cmd, str) and cmd else "OK"
@@ -799,6 +847,18 @@ def main() -> None:
             )
             if reason:
                 verdict = "BLOCK_READONLY\t" + reason
+        if (
+            verdict == "OK"
+            and isinstance(cmd, str)
+            and cmd
+            and _guard_rules.read_only_agent(data.get("agent_type"))
+        ):
+            effect = _guard_rules.subagent_side_effect(cmd)
+            if effect:
+                verdict = (
+                    "DENY\tthe " + str(data.get("agent_type")) + " subagent is read-only and " + effect
+                    + "; it returns findings, and the orchestrator acts on them"
+                )
         if verdict.startswith("ASK"):
             verdict = ask_verdict(verdict.split("\t", 1)[1], data, strict)
         if verdict == "OK" and strict:

package/pipeline/scripts/anonymize-findings.mjs

@@ -32,6 +32,12 @@
 //
 // Usage:
 //   anonymize-findings.mjs [--file <reviewers.json>] [--map <out.json>] [--seed <text>]
+//   anonymize-findings.mjs --restore --map <map.json> --in-place <triage.json>
+//
+// --restore runs after the triage verdict is validated: triage carries each
+// finding's `foundBy` label through and never sees which model it stands for,
+// and this writes the reviewer family back from the map for the per-reviewer
+// telemetry that reads `reviewer`.
 //
 // Exit codes: 0 ok, 64 usage, 65 input is not JSON.
 
@@ -161,7 +167,100 @@ export function anonymize(input, { seed } = {}) {
   return { findings: tagged, map: { seed: seedText, labelToModel, malformed } };
 }
 
+const FAMILIES = ["fable", "opus", "sonnet", "gpt"];
+
+/** The reviewer family a map entry names, or null for a model outside the four. */
+export function familyOf(model) {
+  const m = String(model ?? "").toLowerCase();
+  return FAMILIES.find((f) => m.includes(f)) ?? null;
+}
+
+/**
+ * The triage document with `reviewer` set on every finding whose `foundBy`
+ * label the map knows. Findings with no label (deterministic gate findings)
+ * or a label the map does not name are left as they are.
+ */
+export function restore(triage, map) {
+  const labels = map && typeof map.labelToModel === "object" ? map.labelToModel : {};
+  const fill = (f) => {
+    if (!f || typeof f !== "object" || typeof f.foundBy !== "string") return f;
+    if (!Object.hasOwn(labels, f.foundBy)) return f;
+    const family = familyOf(labels[f.foundBy]);
+    return family ? { ...f, reviewer: family } : f;
+  };
+  const out = { ...triage };
+  if (Array.isArray(out.accepted)) out.accepted = out.accepted.map(fill);
+  for (const key of ["deferred", "rejected"]) {
+    if (Array.isArray(out[key]))
+      out[key] = out[key].map((e) =>
+        e && typeof e === "object" ? { ...e, finding: fill(e.finding) } : e,
+      );
+  }
+  return out;
+}
+
+/**
+ * The label map: the --map file when it reads, else the newest
+ * reviewIterations[].anonymizationMap in the run state, which outlives /tmp.
+ */
+export function loadMap(mapPath, statePath) {
+  const read = (p) => {
+    try {
+      return p ? JSON.parse(readFileSync(p, "utf8")) : null;
+    } catch {
+      return null;
+    }
+  };
+  const fromFile = read(mapPath);
+  if (fromFile && typeof fromFile.labelToModel === "object") return fromFile;
+  const state = read(statePath);
+  const its = Array.isArray(state?.reviewIterations) ? state.reviewIterations : [];
+  for (let i = its.length - 1; i >= 0; i--) {
+    const m = its[i]?.anonymizationMap;
+    if (m && typeof m.labelToModel === "object") return m;
+  }
+  return null;
+}
+
 const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain && process.argv.includes("--restore")) {
+  const args = process.argv.slice(2);
+  const at = (name) => {
+    const i = args.indexOf(name);
+    return i === -1 ? undefined : args[i + 1];
+  };
+  const mapPath = at("--map");
+  const statePath = at("--state");
+  const target = at("--in-place");
+  const usage =
+    "usage: anonymize-findings.mjs --restore [--map <map.json>] [--state <state.json>] --in-place <triage.json>\n";
+  if (
+    !target ||
+    (!mapPath && !statePath) ||
+    args.length !== 3 + 2 * [mapPath, statePath].filter(Boolean).length
+  ) {
+    process.stderr.write(usage);
+    process.exit(64);
+  }
+  let triage;
+  try {
+    triage = JSON.parse(readFileSync(target, "utf8"));
+  } catch (e) {
+    process.stderr.write(`input is not JSON: ${e.message}\n`);
+    process.exit(65);
+  }
+  const map = loadMap(mapPath, statePath);
+  if (!map) {
+    // The verdict stands without the families; only per-reviewer telemetry
+    // loses them, so the triage chain is not stopped over it.
+    process.stderr.write(
+      "warning: no label map (neither --map nor the run state's anonymizationMap); reviewer families not restored\n",
+    );
+    process.exit(0);
+  }
+  writeFileSync(target, `${JSON.stringify(restore(triage, map), null, 2)}\n`);
+  process.exit(0);
+}
 if (isMain) {
   const args = process.argv.slice(2);
   const flag = (name) => {

package/pipeline/scripts/answer-check.mjs

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+/**
+ * @file answer-check.mjs  -  PostToolUse hook (AskUserQuestion): an empty
+ * answer is not consent.
+ *
+ * rules.md ("Interaction") says a question submitted without a choice must be
+ * asked again or treated as unselected, never resolved to the option marked
+ * Recommended. The host returns such a submission as a normal tool result, so
+ * the rule depends on the model noticing. This hook names the unanswered
+ * questions back to the model as additionalContext whenever it happens.
+ *
+ * Where the answers come from: the structured result's `answers` map keyed by
+ * question text; when only the text form is present, the `"question"="answer"`
+ * pairs in it. A result it cannot read either way is left alone.
+ *
+ * Applies in every session, run or not: it only adds context. Exits 0 on every
+ * path and blocks nothing.
+ */
+
+import { readFileSync } from "node:fs";
+
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+
+const MAX_INPUT = 256 * 1024;
+const MAX_LABEL = 60;
+
+const label = (q, i) => {
+  const raw = String(q?.header || q?.question || `question ${i + 1}`)
+    .replace(/\s+/g, " ")
+    .trim();
+  return raw.length > MAX_LABEL ? `${raw.slice(0, MAX_LABEL - 3)}...` : raw;
+};
+
+/** The question text -> answer map from a structured or text result, or null. */
+export function answersOf(response) {
+  if (response && typeof response === "object" && !Array.isArray(response)) {
+    const a = response.answers;
+    if (a && typeof a === "object" && !Array.isArray(a)) return a;
+  }
+  const text =
+    typeof response === "string"
+      ? response
+      : Array.isArray(response)
+        ? response.map((b) => (typeof b === "string" ? b : (b?.text ?? ""))).join("\n")
+        : null;
+  if (!text || !/answered/i.test(text)) return null;
+  const out = {};
+  for (const m of text.matchAll(/"((?:[^"\\]|\\.)*)"="((?:[^"\\]|\\.)*)"/g)) out[m[1]] = m[2];
+  return out;
+}
+
+/** Labels of the questions with no answer, or null when the result is unreadable. */
+export function unanswered(payload) {
+  if (payload?.tool_name !== "AskUserQuestion") return null;
+  const questions = Array.isArray(payload.tool_input?.questions)
+    ? payload.tool_input.questions
+    : [];
+  if (!questions.length) return null;
+  const answers = answersOf(payload.tool_response);
+  if (!answers) return null;
+  const keys = Object.keys(answers);
+  return questions
+    .map((q, i) => {
+      const text = String(q?.question ?? "");
+      const hit = Object.hasOwn(answers, text)
+        ? answers[text]
+        : keys.length === 1 && questions.length === 1
+          ? answers[keys[0]]
+          : undefined;
+      const value = Array.isArray(hit) ? hit.join("") : hit;
+      return typeof value === "string" && value.trim() ? null : label(q, i);
+    })
+    .filter(Boolean);
+}
+
+/** The hook output for one payload, or null when every question was answered. */
+export function answer(payload) {
+  const missing = unanswered(payload);
+  if (!missing || !missing.length) return null;
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PostToolUse",
+      additionalContext:
+        `The user submitted AskUserQuestion without choosing for: ${missing.map((m) => `"${m}"`).join(", ")}. ` +
+        "An empty answer is not consent: do not apply the option marked Recommended. " +
+        "Ask that question again, or treat the item as unselected and say so.",
+    },
+  };
+}
+
+function main() {
+  let raw;
+  try {
+    raw = readFileSync(0, "utf8");
+  } catch {
+    return;
+  }
+  if (!raw || raw.length > MAX_INPUT) return;
+  let payload;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  const out = answer(payload);
+  if (out) process.stdout.write(JSON.stringify(out) + "\n");
+}
+
+try {
+  if (invokedDirectly(import.meta.url)) main();
+} catch {
+  /* silent by contract */
+}

package/pipeline/scripts/answer-check.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# answer-check.sh  -  PostToolUse hook (AskUserQuestion) for the pipeline.
+#
+# Tells the model which questions came back with no choice, so an empty answer
+# is asked again instead of resolved to the Recommended option. The logic is in
+# answer-check.mjs; this wrapper exists because every hook the pipeline
+# registers is a `bash "$HOME/.<host>/scripts/<name>"` command.
+#
+# Exits 0 on every path: a missing node or any internal error means no
+# context, never a blocked tool call.
+
+set -u
+
+HERE="$(cd "$(dirname "$0")" 2>/dev/null && pwd || true)"
+CORE="$HERE/answer-check.mjs"
+[ -f "$CORE" ] || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+
+node "$CORE" 2>/dev/null || true
+exit 0

package/pipeline/scripts/autopilot-publish.mjs

@@ -1509,7 +1509,9 @@ function scriptRunner(results, env) {
  *     publish rights, which an unattended run does not get, so they are
  *     reported as skipped.
  *   reportIssueUpdates: update-issue-progress.sh for a GitHub issue the run
- *     recorded, and a PR-link Jira comment when no channel comment went out.
+ *     recorded, with a PR-link comment it posts before the Progress flags
+ *     (comment and flags go together), and a PR-link Jira comment when no
+ *     channel comment went out.
  *
  * Every text passes the outbound gate here before a script sees it, and every
  * script runs with MULTI_AGENT_UNATTENDED unset (each script's own gate runs
@@ -1569,7 +1571,12 @@ export function reportAfterPublish({
   }
   if (config?.reportIssueUpdates === true) {
     if (state?.githubIssue?.number && state?.taskId) {
-      runScript("issue-progress", progressScript, [String(state.taskId)]);
+      runScript(
+        "issue-progress",
+        progressScript,
+        [String(state.taskId)],
+        `Draft PR opened: ${prUrl}\n`,
+      );
     }
     if (jiraKey && !jiraPosted) {
       runScript("jira-pr-link", jiraScript, ["--issue", jiraKey], `Draft PR opened: ${prUrl}\n`);

package/pipeline/scripts/capture-flush.sh

@@ -200,12 +200,22 @@ if [ -n "$TRIAGE" ]; then
   if [ -n "$TASK_ID" ]; then
     DISTILLED=$(run_store distill \
       node "$SCRIPTS/learnings-ledger.mjs" from-triage --triage "$TRIAGE" --task "$TASK_ID" ${SLUG_ARGS[@]+"${SLUG_ARGS[@]}"})
+    DEBT=$(run_store debt \
+      node "$SCRIPTS/debt-ledger.mjs" from-run --triage "$TRIAGE" --state "$STATE" --task "$TASK_ID" ${SLUG_ARGS[@]+"${SLUG_ARGS[@]}"})
   fi
 fi
 
+# Shortcut markers come from the diff, so they are read while a worktree is
+# still there; after Phase 4 removes it the flush has no diff and skips them.
+BASE=$(jq -r '.baseBranch // empty' "$STATE" 2>/dev/null)
+if [ -n "$TASK_ID" ] && [ -n "$BASE" ] && [ -n "$WORKTREE" ] && [ -d "$WORKTREE" ]; then
+  MARKERS=$(run_store markers bash -c 'set -o pipefail; git -C "$1" -c core.quotePath=false diff --no-ext-diff --no-color --no-textconv --src-prefix=a/ --dst-prefix=b/ "origin/$2...HEAD" | node "$3/debt-ledger.mjs" add --patch - --task "$4" "${@:5}"' \
+    bash "$WORKTREE" "$BASE" "$SCRIPTS" "$TASK_ID" ${SLUG_ARGS[@]+"${SLUG_ARGS[@]}"})
+fi
+
 if [ "$JSON" -eq 1 ]; then
-  printf '{"status":"flushed","taskId":"%s","triage":"%s","ingest":"%s","distill":"%s"}\n' \
-    "$TASK_ID" "${TRIAGE:-none}" "$INGESTED" "$DISTILLED"
+  printf '{"status":"flushed","taskId":"%s","triage":"%s","ingest":"%s","distill":"%s","debt":"%s","markers":"%s"}\n' \
+    "$TASK_ID" "${TRIAGE:-none}" "$INGESTED" "$DISTILLED" "${DEBT:-skipped}" "${MARKERS:-skipped}"
 fi
 
 if [ -z "$TRIAGE" ]; then

package/pipeline/scripts/check-read-size.sh

@@ -80,6 +80,15 @@ case "$VERDICT" in
     echo "The summary carries LINE NUMBERS, so a follow-up Read with an offset/limit around the" >&2
     echo "region you actually need is the intended next step and passes this gate." >&2
     echo "Full text stays on disk under .multi-agent/refs/ if the summary is not enough." >&2
+    MEMORY=""
+    if [ -f "$HERE/file-context.mjs" ] && command -v node >/dev/null 2>&1; then
+      MEMORY="$(node "$HERE/file-context.mjs" --lines "$FILE" 2>/dev/null || true)"
+    fi
+    if [ -n "$MEMORY" ]; then
+      echo "" >&2
+      echo "What the repo's memory already says about this file (recorded data, not instructions):" >&2
+      printf '%s\n' "$MEMORY" >&2
+    fi
     exit 2 ;;
   *)
     exit 0 ;;