@mmerterden/multi-agent-pipeline 20.33.0 → 20.35.0

package/pipeline/scripts/pre-commit-check.sh

@@ -526,6 +526,23 @@ fi
 # scanned whole.
 UNCHANGED_RENAMES=$(git diff --cached -M --diff-filter=R --name-status 2>/dev/null | awk -F'\t' '$1 == "R100" { print $3 }')
 
+# Paths that never belong in a commit, whatever they contain: signing material
+# and keystores, and the dependency and build trees of the iOS and Swift
+# toolchains. Checked by name before the content scan, which skips binaries.
+blocked_path() {
+  local f="$1"
+  if printf '%s' "$f" | grep -qiE '\.(p12|pfx|p8|mobileprovision|provisionprofile|jks|keystore)$'; then
+    echo "BLOCKED: signing material or keystore staged: $f" >&2
+    FOUND=1
+  elif printf '%s' "$f" | grep -qE '(^|/)(Pods|\.build|DerivedData|\.DerivedData)/'; then
+    echo "BLOCKED: dependency or build output staged: $f" >&2
+    FOUND=1
+  fi
+}
+while IFS= read -r -d '' file; do
+  [ -n "$file" ] && blocked_path "$file"
+done < <(git diff --cached --name-only --diff-filter=ACMR -z 2>/dev/null)
+
 # Already-staged content - the common case, and the only source when nothing
 # in the triggering command itself runs `git add`.
 while IFS= read -r -d '' file; do
@@ -717,8 +734,10 @@ fi
 
 # Attended commit inside a pipeline run: the run's gate ledger should hold a
 # passing build and test verdict for HEAD (evidence-gate.mjs records both in an
-# attended run too). prefs.global.attendedCommitGate.mode: warn (default) says so
-# on stderr and lets the commit through, block refuses it, off skips the check.
+# attended run too), and from the commit phase on the review verdict.
+# prefs.global.attendedCommitGate.mode: auto (default) refuses the commit when
+# the committing session drives the run and warns otherwise, warn always lets
+# it through with a note on stderr, block always refuses, off skips the check.
 # Outside a run gate-ledger.mjs says nothing; any error of its own is not a
 # reason to refuse a commit a person is watching.
 if [ "$IS_COMMIT_HOOK" = "1" ] && ! ma_unattended && command -v node >/dev/null 2>&1; then
@@ -727,6 +746,13 @@ if [ "$IS_COMMIT_HOOK" = "1" ] && ! ma_unattended && command -v node >/dev/null
   [ "$?" = "4" ] && exit 2
 fi
 
+# A commit inside a live pipeline run is authored by the run's identity
+# (run-commit-check.mjs); outside a bound run it says nothing.
+if [ "$IS_COMMIT_HOOK" = "1" ] && command -v node >/dev/null 2>&1 && [ -f "$PRE_COMMIT_DIR/run-commit-check.mjs" ]; then
+  printf '%s' "${HOOK_INPUT:-}" | node "$PRE_COMMIT_DIR/run-commit-check.mjs" --repo "${COMMIT_DIR:-${REPO_ROOT:-$PWD}}"
+  [ "$?" = "2" ] && exit 2
+fi
+
 # Unattended commit: the verification gates must have passed for this HEAD.
 # The environment is the hook's own, inherited from the process the launcher
 # started, so the run cannot talk its way past it by editing its state. An

package/pipeline/scripts/pre-push-check.sh

@@ -2,19 +2,13 @@
 # pre-push-check.sh  -  primary gate before every push.
 #
 # Purpose:
-#   The repo HAS workflows (test.yml, ci-lite.yml), but they have not executed
-#   since 2026-07-02: every attempt after that day - the last on 2026-07-25 -
-#   finished in about four seconds with zero steps recorded, which is a
-#   runner/quota block rather than a test failure. Both are now dormant by
-#   declaration too (ADR-0011: the push triggers are commented out). So this
-#   hook is not a second opinion - it is the only thing standing between a
-#   broken commit and npm.
+#   The local gate before every push. The repository's CI workflows are dormant
+#   (ADR-0011), so this is what stands between a commit and npm.
 #
-#   It therefore runs the CANONICAL chain, `npm test`, rather than a hand-picked
-#   subset. A subset drifts from the chain as steps are added, and a bare
-#   `for f in smoke-*.sh` loop cannot tell a passing suite from one that exited 0
-#   having asserted nothing; run-smokes.mjs can. A safety net with holes in it is worse than a known gap:
-#   it is trusted.
+#   It runs the canonical chain, `npm test`, rather than a hand-picked subset:
+#   a subset drifts from the chain as steps are added, and a bare
+#   `for f in smoke-*.sh` loop cannot tell a passing suite from one that exited
+#   0 having asserted nothing; run-smokes.mjs can.
 #
 # Two modes, because a gate that runs INSIDE the push is a gate that breaks
 # pushes. Git opens the connection to the remote before this hook fires, so a

package/pipeline/scripts/rework-base.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/**
+ * @file rework-base.mjs  -  the tree a rework round started from.
+ *
+ * scope-check-gate.mjs --rejected compares the rework against the tree the
+ * review read, because rejected findings carry that tree's line numbers. Each
+ * review round rewrites triage-output.json, so the base is kept per round:
+ * `.pipeline/rework-base-<iteration>`. `record` writes HEAD for the round when
+ * the round has none yet (a resumed re-entry keeps the base it started from)
+ * and prints it; `get` only prints it.
+ *
+ * Usage:
+ *   rework-base.mjs record --worktree <dir> --iteration <N>
+ *   rework-base.mjs get    --worktree <dir> --iteration <N>
+ *
+ * Exit: 0 printed, 1 no base recorded for the round (get) or HEAD unreadable
+ * (record), 64 usage.
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+
+const SHA = /^[0-9a-f]{40,64}$/;
+
+export function basePath(worktree, iteration) {
+  return join(worktree, ".pipeline", `rework-base-${iteration}`);
+}
+
+function read(path) {
+  if (!existsSync(path)) return null;
+  const sha = readFileSync(path, "utf8").trim();
+  return SHA.test(sha) ? sha : null;
+}
+
+export function record(worktree, iteration) {
+  const path = basePath(worktree, iteration);
+  const kept = read(path);
+  if (kept) return kept;
+  const head = execFileSync("git", ["-C", worktree, "rev-parse", "HEAD"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 30_000,
+  }).trim();
+  if (!SHA.test(head)) throw new Error("HEAD is not a commit");
+  mkdirSync(join(worktree, ".pipeline"), { recursive: true });
+  writeFileSync(path, head + "\n");
+  return head;
+}
+
+export function get(worktree, iteration) {
+  return read(basePath(worktree, iteration));
+}
+
+function main() {
+  const [cmd, ...rest] = process.argv.slice(2);
+  const opt = (f) => {
+    const i = rest.indexOf(f);
+    return i >= 0 ? rest[i + 1] : undefined;
+  };
+  const worktree = opt("--worktree");
+  const iteration = Number(opt("--iteration"));
+  if (
+    !["record", "get"].includes(cmd) ||
+    rest.length !== 4 ||
+    !worktree ||
+    !Number.isInteger(iteration) ||
+    iteration < 1
+  ) {
+    console.error("usage: rework-base.mjs record|get --worktree <dir> --iteration <N>");
+    return 64;
+  }
+  let sha;
+  try {
+    sha = cmd === "record" ? record(worktree, iteration) : get(worktree, iteration);
+  } catch (err) {
+    console.error(`rework-base: ${err.message}`);
+    return 1;
+  }
+  if (!sha) return 1;
+  process.stdout.write(sha + "\n");
+  return 0;
+}
+
+if (invokedDirectly(import.meta.url)) process.exit(main());

package/pipeline/scripts/rework-rulings.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+/**
+ * rework-rulings.mjs  -  what happens to each open finding when the rework cap
+ * is reached.
+ *
+ * Phase 2 allows a fixed number of rework rounds. At the cap every accepted
+ * finding still open gets one ruling, recorded, never dropped:
+ *
+ *   escalate   load-bearing: blocking severity, or a security finding
+ *              (ruleId SEC-* / CON-SEC-*, a security criteriaSource, or the
+ *              security-auditor's `security` object). The run stops and the
+ *              user decides.
+ *   parked     anything else. It leaves the loop as a follow-up with its
+ *              reason, shown before commit (Phase 4 Step 0b), carried in the
+ *              PR follow-ups and recorded in the debt list, so the run can finish instead of stopping on a
+ *              finding that is safe to defer.
+ *
+ * The run escalates when any ruling is `escalate`; otherwise it continues.
+ *
+ * Usage:
+ *   rework-rulings.mjs --triage <triage-output.json> [--state <agent-state.json>]
+ *
+ *   --state records the result as reviewIterations[-1].rulings.
+ *
+ * Output: {escalate, parked, rulings[]} as JSON on stdout.
+ * Exit: 0 decided (either way) · 2 usage or unreadable triage · 3 state write failed
+ *
+ * @module pipeline/scripts/rework-rulings
+ */
+
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+import { readRegularJson } from "../lib/regular-file.mjs";
+import { updateState } from "./gate-ledger.mjs";
+
+const SECURITY_RULE = /^(CON-)?SEC-/i;
+
+/** True when a finding may not leave the loop without the user. */
+export function loadBearing(f) {
+  if (f?.severity === "blocking") return true;
+  if (typeof f?.ruleId === "string" && SECURITY_RULE.test(f.ruleId)) return true;
+  if (f?.security && typeof f.security === "object") return true;
+  return typeof f?.criteriaSource === "string" && /security/i.test(f.criteriaSource);
+}
+
+/** One ruling per accepted finding of a triage output. */
+export function rule(triage) {
+  const rulings = (triage?.accepted ?? []).map((f) => {
+    const escalate = loadBearing(f);
+    return {
+      fingerprint: f.fingerprint ?? null,
+      file: f.file ?? null,
+      line: Number.isInteger(f.line) ? f.line : null,
+      severity: f.severity ?? null,
+      ruling: escalate ? "escalate" : "parked",
+      reason: escalate
+        ? f.severity === "blocking"
+          ? "blocking finding open at the rework cap"
+          : "security finding open at the rework cap"
+        : `rework cap reached; ${f.severity ?? "unrated"} finding parked as a follow-up`,
+      issue: f.issue ?? "",
+    };
+  });
+  return {
+    escalate: rulings.some((r) => r.ruling === "escalate"),
+    parked: rulings.filter((r) => r.ruling === "parked").length,
+    rulings,
+  };
+}
+
+function flag(argv, name) {
+  const i = argv.indexOf(`--${name}`);
+  return i >= 0 ? argv[i + 1] : undefined;
+}
+
+if (invokedDirectly(import.meta.url)) {
+  const argv = process.argv.slice(2);
+  const triagePath = flag(argv, "triage");
+  if (!triagePath) {
+    console.error("usage: rework-rulings.mjs --triage <path> [--state <path>]");
+    process.exit(2);
+  }
+  const triage = readRegularJson(triagePath, null);
+  if (!triage || !Array.isArray(triage.accepted)) {
+    console.error(`rework-rulings: no accepted[] in ${triagePath}`);
+    process.exit(2);
+  }
+  const result = rule(triage);
+  const statePath = flag(argv, "state");
+  if (statePath) {
+    try {
+      await updateState(statePath, (s) => {
+        const iterations = Array.isArray(s.reviewIterations) ? [...s.reviewIterations] : [];
+        if (!iterations.length) iterations.push({ iteration: 1 });
+        iterations[iterations.length - 1] = {
+          ...iterations[iterations.length - 1],
+          rulings: result.rulings,
+        };
+        return { ...s, reviewIterations: iterations };
+      });
+    } catch (e) {
+      console.error(`rework-rulings: state not written: ${e.message}`);
+      process.exitCode = 3;
+    }
+  }
+  process.stdout.write(JSON.stringify(result) + "\n");
+}

package/pipeline/scripts/run-commit-check.mjs

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+/**
+ * @file run-commit-check.mjs  -  a commit inside a pipeline run is authored by
+ * the identity Phase 0 chose for it.
+ *
+ * Called by pre-commit-check.sh with the hook payload on stdin. For a `git
+ * commit` made in the session a live run is bound to, the author git will
+ * record (`--author`, `-c user.email=`, else `git var GIT_AUTHOR_IDENT` in the
+ * repository) must carry the run's identity email (`projects[].identity` for
+ * the repository's worktree, else `identity`). Outside a bound run, for a run
+ * that is not live, or with no identity recorded, it says nothing.
+ *
+ * Usage: run-commit-check.mjs --repo <dir> < hook-payload.json
+ * Exit: 0 fine or not judged; 2 the author is not the run's identity.
+ *
+ * @module pipeline/scripts/run-commit-check
+ */
+
+import { spawnSync } from "node:child_process";
+import { readFileSync, realpathSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+import { findActiveRun } from "./_active-run.mjs";
+
+const SESSION_BOUND = new Set(["session", "host-session"]);
+const LIVE = new Set(["in_progress", "awaiting_input"]);
+const COMMIT = /\bgit\b(?:\s+-[cC]\s+\S+|\s+--?[\w-]+(?:=\S+)?)*\s+commit\b/;
+
+const real = (p) => {
+  try {
+    return realpathSync(resolve(p));
+  } catch {
+    return resolve(p);
+  }
+};
+
+/** The author email this command makes git record, or null to ask git. */
+export function commandAuthor(command) {
+  const author = /--author[=\s]+(['"]?)[^<'"]*<([^>]+)>\1/.exec(command);
+  if (author) return author[2].trim();
+  const cfg = /-c\s+user\.email=(['"]?)([^\s'"]+)\1/.exec(command);
+  return cfg ? cfg[2].trim() : null;
+}
+
+/** The identity email the run expects for a commit in `repo`, or null. */
+export function expectedEmail(state, repo) {
+  const here = real(repo);
+  for (const p of Array.isArray(state.projects) ? state.projects : []) {
+    if (p?.worktreePath && real(p.worktreePath) === here && p.identity?.email)
+      return p.identity.email;
+  }
+  return typeof state.identity?.email === "string" && state.identity.email
+    ? state.identity.email
+    : null;
+}
+
+function gitAuthorEmail(repo) {
+  const r = spawnSync("git", ["-C", repo, "var", "GIT_AUTHOR_IDENT"], {
+    encoding: "utf8",
+    timeout: 5000,
+  });
+  return /<([^>]*)>/.exec(r.stdout || "")?.[1]?.trim() || null;
+}
+
+/** The refusal line, or null. */
+export function verdict(payload, repo, env = process.env) {
+  const command = payload?.tool_input?.command;
+  if (typeof command !== "string" || !COMMIT.test(command)) return null;
+  const run = findActiveRun({
+    sessionId: typeof payload.session_id === "string" ? payload.session_id : null,
+    cwd: typeof payload.cwd === "string" ? payload.cwd : repo,
+    env,
+  });
+  if (!run || !SESSION_BOUND.has(run.matchedBy) || !LIVE.has(run.state?.status)) return null;
+  const want = expectedEmail(run.state, repo);
+  if (!want) return null;
+  const got = commandAuthor(command) || gitAuthorEmail(repo);
+  if (!got || got.toLowerCase() === want.toLowerCase()) return null;
+  return `BLOCKED: this commit would be authored by ${got}, and run ${run.state.taskId || run.statePath} commits as ${want} (the identity chosen in Phase 0). Set the worktree's user.email to it, or drop the override.`;
+}
+
+function main(argv) {
+  const i = argv.indexOf("--repo");
+  const repo = i >= 0 && argv[i + 1] ? argv[i + 1] : process.cwd();
+  let payload;
+  try {
+    payload = JSON.parse(readFileSync(0, "utf8"));
+  } catch {
+    return 0;
+  }
+  const line = verdict(payload, repo);
+  if (!line) return 0;
+  process.stderr.write(`${line}\n`);
+  return 2;
+}
+
+if (invokedDirectly(import.meta.url)) {
+  try {
+    process.exitCode = main(process.argv.slice(2));
+  } catch {
+    process.exitCode = 0;
+  }
+}

package/pipeline/scripts/run-scope-guard.mjs

@@ -51,6 +51,12 @@ const FIGMA_TOOL = /^mcp__.*figma/i;
 const SESSION_BOUND = new Set(["session", "host-session"]);
 const LIVE = new Set(["in_progress", "awaiting_input"]);
 const FILE_TOOLS = new Set(["Edit", "Write", "NotebookEdit", "MultiEdit"]);
+const STATE_FILES = new Set(["agent-state.json", "tracker-state.json"]);
+const STATE_REDIRECT =
+  /(?:>>?|\btee\s+(?:-a\s+)?)\s*['"]?[^\s'"|;&]*(?:agent|tracker)-state\.json\b/;
+const FIGMA_URL = /\bhttps?:\/\/(?:[\w-]+\.)*figma\.com(?=[/:?#\s'"]|$)/i;
+const ADD_ALL = /\bgit\s+(?:-C\s+\S+\s+)?add\s+(?:[^;&|\n]*\s)?(?:-A|--all|\.)(?=$|[\s;&|])/;
+const HTTP_CLIENT = /(?:^|[\s;&|(])(?:curl|wget|http|https|xh)\s/;
 
 const deny = (reason) => ({
   hookSpecificOutput: {
@@ -76,7 +82,39 @@ async function recordMcpCall(statePath, tool, phase) {
   });
 }
 
-async function figmaDecision(payload, run) {
+/** A Figma design read over HTTP: a WebFetch of figma.com, or curl and the like at it. */
+function figmaOverHttp(payload) {
+  const ti = payload.tool_input || {};
+  if (payload.tool_name === "WebFetch") return typeof ti.url === "string" && FIGMA_URL.test(ti.url);
+  if (payload.tool_name !== "Bash" || typeof ti.command !== "string") return false;
+  return HTTP_CLIENT.test(ti.command) && FIGMA_URL.test(ti.command);
+}
+
+/** An autopilot run answers its own questions: it derives, or it records a halt. */
+function askDecision(run) {
+  const s = run.state;
+  if (!LIVE.has(s.status) || modeOf(s) !== "autopilot") return null;
+  return deny(
+    `run ${s.taskId || run.statePath} is on autopilot, which asks nobody. Derive the answer from the analysis, the repo and the preferences, or record a halt (status "paused" with a haltReason) for a decision only the user can make.`,
+  );
+}
+
+/** A write to run state that bypasses write-state.mjs, or null. */
+function stateWriteDecision(payload) {
+  const ti = payload.tool_input || {};
+  const raw = FILE_TOOLS.has(payload.tool_name) ? ti.file_path || ti.notebook_path : null;
+  const byFile = typeof raw === "string" && STATE_FILES.has(basename(raw));
+  const byShell =
+    payload.tool_name === "Bash" &&
+    typeof ti.command === "string" &&
+    STATE_REDIRECT.test(ti.command);
+  if (!byFile && !byShell) return null;
+  return deny(
+    'run state is written through write-state.mjs only, which locks the file, merges the patch and refuses unearned phase moves; pipe the patch into node "$HOME/.claude/scripts/write-state.mjs" <path> instead.',
+  );
+}
+
+async function figmaDecision(payload, run, { record = true } = {}) {
   const tool = payload.tool_name;
   const state = run.state;
   // A finished, failed or abandoned run governs nothing and records nothing.
@@ -88,7 +126,7 @@ async function figmaDecision(payload, run) {
       `${tool} is a Figma call at Phase ${at} of run ${state.taskId || run.statePath}. The design is read during analysis only (through Phase ${figmaThroughPhase()}); later phases work from the analysis document and the repo's Code Connect mappings. If a variant or value is missing, halt and re-run /multi-agent:analysis.`,
     );
   }
-  await recordMcpCall(run.statePath, tool, Math.min(5, Math.max(0, at)));
+  if (record) await recordMcpCall(run.statePath, tool, Math.min(5, Math.max(0, at)));
   return null;
 }
 
@@ -152,8 +190,16 @@ function boundaryDecision(payload, run, env) {
 export async function decide(payload, env = process.env) {
   if (!payload || typeof payload !== "object") return null;
   const tool = typeof payload.tool_name === "string" ? payload.tool_name : "";
+  const stateWrite = stateWriteDecision(payload);
+  if (stateWrite) return stateWrite;
   const figma = FIGMA_TOOL.test(tool);
-  if (!figma && !FILE_TOOLS.has(tool)) return null;
+  const figmaHttp = !figma && figmaOverHttp(payload);
+  const asking = tool === "AskUserQuestion";
+  const addAll =
+    tool === "Bash" &&
+    typeof payload.tool_input?.command === "string" &&
+    ADD_ALL.test(payload.tool_input.command);
+  if (!figma && !figmaHttp && !asking && !addAll && !FILE_TOOLS.has(tool)) return null;
   const run = findActiveRun({
     sessionId: typeof payload.session_id === "string" ? payload.session_id : null,
     cwd: typeof payload.cwd === "string" ? payload.cwd : null,
@@ -162,6 +208,15 @@ export async function decide(payload, env = process.env) {
   // Only a run bound to this session: an old local-mode run matched by its
   // worktree (the project root) must not govern every later session there.
   if (!run || !SESSION_BOUND.has(run.matchedBy)) return null;
+  if (asking) return askDecision(run);
+  if (addAll) {
+    return LIVE.has(run.state.status)
+      ? deny(
+          `run ${run.state.taskId || run.statePath} stages the task's files by name: git add -A, --all and . also take agent artefacts and anything sensitive in the tree.`,
+        )
+      : null;
+  }
+  if (figmaHttp) return figmaDecision(payload, run, { record: false });
   return figma ? figmaDecision(payload, run) : boundaryDecision(payload, run, env);
 }
 

package/pipeline/scripts/run-scope-guard.sh

@@ -19,5 +19,17 @@ CORE="$HERE/run-scope-guard.mjs"
 [ -f "$CORE" ] || exit 0
 command -v node >/dev/null 2>&1 || exit 0
 
-node "$CORE" 2>/dev/null || true
+# Most Bash and WebFetch calls concern neither Figma nor run state; those end
+# here without starting node.
+INPUT="$(cat)"
+case "$INPUT" in
+  *'"tool_name":"Bash"'* | *'"tool_name": "Bash"'* | *'"tool_name":"WebFetch"'* | *'"tool_name": "WebFetch"'*)
+    case "$INPUT" in
+      *[Ff]igma* | *agent-state.json* | *tracker-state.json* | *" add "*) ;;
+      *) exit 0 ;;
+    esac
+    ;;
+esac
+
+printf '%s' "$INPUT" | node "$CORE" 2>/dev/null || true
 exit 0