@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/lib/context-link-extractor.sh

@@ -0,0 +1,192 @@
+#!/bin/bash
+#
+# context-link-extractor.sh
+# Parse free-form text (Jira description, GitHub Issue body, PR body) and emit
+# a JSON catalogue of typed external links the pipeline cares about. The
+# orchestrator persists this to agent-state.json.contextLinks[] in Phase 0;
+# Phase 1 dispatches each entry to the matching fetcher for analysis context.
+#
+# Recognised types:
+#   - swagger     : OpenAPI / Swagger JSON or YAML spec URLs
+#   - confluence  : Confluence pages (host pattern + display/spaces/pageId)
+#   - crashlytics : Firebase Crashlytics issue/session URLs
+#   - fortify     : Fortify SSC findings URLs
+#   - figma       : Figma design / make / FigJam / slides URLs
+#   - generic-doc : http(s) URLs that didn't match a more specific type but
+#                   look like documentation (Notion, Google Docs, GitHub
+#                   markdown blob/wiki, gist) — passed through as advisory
+#
+# Usage:
+#   echo "<description text>" | ./context-link-extractor.sh
+#   ./context-link-extractor.sh < /path/to/description.txt
+#
+# Output (stdout, single line JSON array):
+#   [
+#     { "type": "confluence", "url": "...", "metadata": { "host": "...", "pageId": "...|null", "spaceKey": "...|null" } },
+#     { "type": "swagger",    "url": "...", "metadata": { "format": "json|yaml|unknown" } },
+#     { "type": "crashlytics","url": "...", "metadata": { "projectId": "...", "platform": "ios|android", "issueId": "...", "sessionId": "...|null" } },
+#     { "type": "fortify",    "url": "...", "metadata": { "host": "...", "projectId": "...|null" } },
+#     { "type": "figma",      "url": "...", "metadata": { "kind": "design|make|board|slides", "fileKey": "...", "nodeId": "...|null" } },
+#     ...
+#   ]
+#
+# Exit codes:
+#   0  always — emits "[]" when no input or no matches; downstream readers
+#               must tolerate an empty array.
+
+set -eu
+
+CONTEXT_LINK_INPUT=$(cat)
+export CONTEXT_LINK_INPUT
+
+python3 - <<'PY'
+import json
+import os
+import re
+import urllib.parse as up
+
+text = os.environ.get("CONTEXT_LINK_INPUT", "")
+
+# Pull every http(s) URL out of the input first; downstream classifiers run
+# against this candidate set. The trailing-punctuation strip avoids capturing
+# a closing paren or comma that lives in the surrounding sentence.
+URL_RE = re.compile(r"https?://[^\s<>\"'`)\]\}]+")
+RAW_URLS = []
+for m in URL_RE.finditer(text):
+    u = m.group(0).rstrip(".,;:!?")
+    # de-dupe while preserving first-seen order
+    if u not in RAW_URLS:
+        RAW_URLS.append(u)
+
+
+def classify(url: str):
+    """Return (type, metadata) when the URL matches a known channel; else None."""
+    parsed = up.urlparse(url)
+    host = parsed.netloc.lower()
+    path = parsed.path
+    query = up.parse_qs(parsed.query)
+
+    # --- Figma --------------------------------------------------------------
+    # figma.com/{design|make|board|slides|file}/<fileKey>/...
+    if host.endswith("figma.com"):
+        parts = [p for p in path.split("/") if p]
+        kind = parts[0] if parts else "design"
+        # Normalise legacy /file/ to /design/
+        if kind == "file":
+            kind = "design"
+        if kind not in {"design", "make", "board", "slides"}:
+            kind = "design"
+        file_key = parts[1] if len(parts) > 1 else None
+        node_id = (query.get("node-id") or [None])[0]
+        if node_id:
+            node_id = node_id.replace("-", ":")
+        if file_key:
+            return ("figma", {"kind": kind, "fileKey": file_key, "nodeId": node_id})
+
+    # --- Firebase Crashlytics ----------------------------------------------
+    # console.firebase.google.com/(u/<N>/)?project/<projectId>/crashlytics/app/(ios|android)(:|%3A)<bundle>/issues/<issueId>(/sessions/<sessionId>)?
+    if host == "console.firebase.google.com":
+        m = re.search(
+            r"/project/(?P<project>[^/]+)/crashlytics/app/(?P<platform>ios|android)(?::|%3A)(?P<bundle>[^/]+)/issues/(?P<issue>[^/?#]+)(?:/sessions/(?P<session>[^/?#]+))?",
+            path,
+        )
+        if m:
+            return (
+                "crashlytics",
+                {
+                    "projectId": m.group("project"),
+                    "platform": m.group("platform"),
+                    "bundle": up.unquote(m.group("bundle")),
+                    "issueId": m.group("issue"),
+                    "sessionId": m.group("session"),
+                },
+            )
+
+    # --- Confluence --------------------------------------------------------
+    # Confluence cloud:   <tenant>.atlassian.net/wiki/spaces/<SPACE>/pages/<id>/<title>
+    # Confluence server:  <host>/display/<SPACE>/<title>  or  ?pageId=<id>
+    looks_like_confluence = (
+        host.endswith(".atlassian.net")
+        or "confluence" in host
+        or "/wiki/spaces/" in path
+        or "/display/" in path
+    )
+    if looks_like_confluence:
+        space_key = None
+        page_id = (query.get("pageId") or [None])[0]
+        m = re.search(r"/wiki/spaces/(?P<space>[^/]+)/pages/(?P<id>\d+)", path)
+        if m:
+            space_key = m.group("space")
+            page_id = m.group("id")
+        if not space_key:
+            m = re.search(r"/display/(?P<space>[^/]+)/", path)
+            if m:
+                space_key = m.group("space")
+        if "/wiki/" in path or "/display/" in path or page_id:
+            return ("confluence", {"host": host, "pageId": page_id, "spaceKey": space_key})
+
+    # --- Swagger / OpenAPI -------------------------------------------------
+    # Heuristic: explicit .json/.yaml/.yml ending on a path that mentions
+    # swagger or openapi, or a host that starts with swagger./api-docs./openapi.
+    lower_url = url.lower()
+    swagger_signals = (
+        "swagger" in lower_url
+        or "openapi" in lower_url
+        or path.endswith(("/swagger.json", "/openapi.json", "/swagger.yaml", "/openapi.yaml", "/openapi.yml"))
+    )
+    if swagger_signals and (path.endswith((".json", ".yaml", ".yml")) or "/swagger" in path or "/openapi" in path):
+        if path.endswith((".yaml", ".yml")):
+            fmt = "yaml"
+        elif path.endswith(".json"):
+            fmt = "json"
+        else:
+            fmt = "unknown"
+        return ("swagger", {"format": fmt})
+
+    # --- Fortify SSC -------------------------------------------------------
+    # Common forms:
+    #   https://<ssc-host>/ssc/html/ssc/...
+    #   https://<ssc-host>/ssc/api/v1/projectVersions/<id>/...
+    if "fortify" in host or "/ssc/" in path or "/api/v1/projectVersions/" in path:
+        project_id = None
+        m = re.search(r"/projectVersions/(?P<id>\d+)", path)
+        if m:
+            project_id = m.group("id")
+        return ("fortify", {"host": host, "projectId": project_id})
+
+    # --- Generic doc fallbacks ---------------------------------------------
+    # Notion, Google Docs, GitHub markdown blob/wiki, gists. Useful as
+    # advisory context — extractor flags them so the orchestrator can decide
+    # whether to fetch (Block B work).
+    if (
+        host.endswith(("notion.so", "notion.site"))
+        or host == "docs.google.com"
+        or host == "drive.google.com"
+        or host == "gist.github.com"
+        or (host == "github.com" and ("/blob/" in path or "/wiki/" in path))
+    ):
+        kind = "notion" if "notion" in host else (
+            "google-docs" if "google" in host else (
+                "gist" if "gist" in host else "github-doc"
+            )
+        )
+        return ("generic-doc", {"host": host, "kind": kind})
+
+    return None
+
+
+out = []
+seen = set()
+for url in RAW_URLS:
+    result = classify(url)
+    if result is None:
+        continue
+    typ, meta = result
+    key = (typ, url)
+    if key in seen:
+        continue
+    seen.add(key)
+    out.append({"type": typ, "url": url, "metadata": meta})
+
+print(json.dumps(out))
+PY

package/pipeline/lib/credential-store-resolver.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# credential-store-resolver.sh — single source of truth for locating the
+# pipeline's credential helper.
+#
+# Skill files (figma-*, multi-agent-*) install into BOTH `~/.claude/skills/`
+# and `~/.copilot/skills/`. The same source ships verbatim. So a bash block
+# inside a skill cannot hard-code `~/.claude/lib/...` — that path won't exist
+# on Copilot-only installs (and vice versa).
+#
+# Sourcing this resolver exports `CRED_STORE` to whichever credential-store.sh
+# is present. If NEITHER install dir has it, the resolver prints a clear
+# remediation message and `return 1` so the caller can halt with a useful
+# error instead of `bash: $CRED_STORE: command not found`.
+#
+# Usage from a skill bash block:
+#   . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+#     || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+#     || { echo "credential helper not found — run npx @mmerterden/multi-agent-pipeline install" >&2; exit 1; }
+#   TOKEN=$("$CRED_STORE" get "<KEY>")
+
+resolve_credential_store() {
+  local cands=(
+    "$HOME/.claude/lib/credential-store.sh"
+    "$HOME/.copilot/lib/credential-store.sh"
+  )
+  for c in "${cands[@]}"; do
+    if [ -x "$c" ]; then
+      CRED_STORE="$c"
+      export CRED_STORE
+      return 0
+    fi
+  done
+  cat >&2 <<'MSG'
+credential helper not found.
+
+The multi-agent pipeline expects one of these to exist:
+  ~/.claude/lib/credential-store.sh    (Claude Code installs)
+  ~/.copilot/lib/credential-store.sh   (Copilot CLI installs)
+
+Install with:
+  npx @mmerterden/multi-agent-pipeline install --claude       # Claude Code
+  npx @mmerterden/multi-agent-pipeline install --copilot      # Copilot CLI
+  npx @mmerterden/multi-agent-pipeline install --all          # both
+
+Or override `CRED_STORE` to point at a custom path before sourcing this resolver.
+MSG
+  return 1
+}
+
+# When sourced (BASH_SOURCE != $0), auto-resolve into the caller's environment.
+# When run directly (./credential-store-resolver.sh), print the resolved path
+# or a non-zero exit code with the message above.
+if [ "${BASH_SOURCE[0]:-$0}" = "${0}" ]; then
+  resolve_credential_store && echo "$CRED_STORE"
+else
+  resolve_credential_store
+fi

package/pipeline/lib/credential-store.sh

@@ -0,0 +1,226 @@
+#!/bin/bash
+#
+# credential-store.sh
+# Cross-platform secret storage wrapper. Used by every script that previously
+# called `security find-generic-password` directly so tokens can live in the
+# native credential store on macOS, Windows, and Linux.
+#
+# Subcommands:
+#   get <key>            Read secret value to stdout (empty + exit 1 if missing)
+#   set <key> <value>    Store secret (overwrites if exists)
+#   delete <key>         Remove secret
+#   list                 List all keys (one per line)
+#   platform             Print detected platform: macos | windows | linux | unknown
+#   doctor               Check backend availability, print remediation if missing
+#
+# Backends:
+#   macOS    -> Keychain via `security`
+#   Windows  -> Credential Manager via PowerShell `CredentialManager` module
+#              (Install-Module CredentialManager -Scope CurrentUser)
+#   Linux    -> libsecret via `secret-tool`
+#
+# Returns 0 on success, 1 on missing/empty value, 2 on backend missing,
+# 3 on usage error.
+
+set -eu
+
+detect_platform() {
+  case "$(uname -s 2>/dev/null)" in
+    Darwin) echo "macos" ;;
+    Linux)  echo "linux" ;;
+    MINGW*|MSYS*|CYGWIN*) echo "windows" ;;
+    *) [ -n "${WINDIR:-}${OS:-}" ] && echo "windows" || echo "unknown" ;;
+  esac
+}
+
+PLATFORM=$(detect_platform)
+CMD="${1:-}"
+shift || true
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
+KEYCHAIN_PY="$SCRIPT_DIR/../scripts/keychain.py"
+
+# --- Python delegate --------------------------------------------------------
+# On macOS / Linux, prefer the Python helper for deterministic behaviour:
+#   - It writes BOTH -l (label) and -s (service) attributes on macOS, so items
+#     are findable by either convention (personal tokens use -l, this script
+#     historically used -s).
+#   - It returns clean exit codes (0 ok / 1 missing / 2 backend / 4 error).
+# Opt out with `KEYCHAIN_DELEGATE=0` if you need raw shell behaviour.
+delegate_to_python() {
+  [ "${KEYCHAIN_DELEGATE:-1}" != "0" ] || return 1
+  command -v python3 >/dev/null 2>&1 || return 1
+  [ -f "$KEYCHAIN_PY" ] || return 1
+  case "$PLATFORM" in
+    macos|linux) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# --- Helpers ----------------------------------------------------------------
+ps_run() {
+  # Execute a PowerShell command, suppressing profile load. Reads stdin if any.
+  if command -v pwsh >/dev/null 2>&1; then
+    pwsh -NoProfile -NonInteractive -Command "$1"
+  elif command -v powershell.exe >/dev/null 2>&1; then
+    powershell.exe -NoProfile -NonInteractive -Command "$1"
+  else
+    return 127
+  fi
+}
+
+require_cmd() {
+  local cmd="$1" hint="$2"
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "ERR: $cmd not found. $hint" >&2
+    exit 2
+  fi
+}
+
+# --- Subcommands ------------------------------------------------------------
+do_get() {
+  local key="${1:-}"
+  [ -z "$key" ] && { echo "usage: $0 get <key>" >&2; exit 3; }
+  if delegate_to_python; then
+    local val rc
+    val=$(python3 "$KEYCHAIN_PY" get "$key" 2>/dev/null) || rc=$?
+    rc=${rc:-0}
+    if [ "$rc" -eq 0 ] && [ -n "$val" ]; then
+      printf '%s' "$val"
+      return 0
+    fi
+    return 1
+  fi
+  local val=""
+  case "$PLATFORM" in
+    macos)
+      val=$(security find-generic-password -s "$key" -w 2>/dev/null || true)
+      ;;
+    linux)
+      require_cmd secret-tool "Install: sudo apt install libsecret-tools (Debian/Ubuntu) or sudo dnf install libsecret (Fedora)."
+      val=$(secret-tool lookup service "$key" 2>/dev/null || true)
+      ;;
+    windows)
+      val=$(ps_run "
+\$ErrorActionPreference='SilentlyContinue'
+\$c = Get-StoredCredential -Target '$key'
+if (\$c) { \$c.GetNetworkCredential().Password }
+" 2>/dev/null | tr -d '\r' || true)
+      ;;
+    *)
+      echo "ERR: unsupported platform" >&2; exit 2 ;;
+  esac
+  if [ -z "$val" ]; then
+    return 1
+  fi
+  printf '%s' "$val"
+}
+
+do_set() {
+  local key="${1:-}" val="${2:-}"
+  [ -z "$key" ] && { echo "usage: $0 set <key> <value>" >&2; exit 3; }
+  if delegate_to_python; then
+    # Pass the value via stdin to keep it out of process listings / shell history.
+    printf '%s' "$val" | python3 "$KEYCHAIN_PY" set "$key" -
+    return $?
+  fi
+  case "$PLATFORM" in
+    macos)
+      security add-generic-password -s "$key" -a "${USER:-claude}" -w "$val" -U >/dev/null 2>&1
+      ;;
+    linux)
+      require_cmd secret-tool "Install libsecret-tools (see doctor)."
+      printf '%s' "$val" | secret-tool store --label="$key" service "$key" >/dev/null
+      ;;
+    windows)
+      # CredentialManager module: New-StoredCredential
+      ps_run "
+\$ErrorActionPreference='Stop'
+\$pwd = ConvertTo-SecureString '$val' -AsPlainText -Force
+New-StoredCredential -Target '$key' -UserName '$USER' -SecurePassword \$pwd -Persist LocalMachine | Out-Null
+" >/dev/null
+      ;;
+    *)
+      echo "ERR: unsupported platform" >&2; exit 2 ;;
+  esac
+}
+
+do_delete() {
+  local key="${1:-}"
+  [ -z "$key" ] && { echo "usage: $0 delete <key>" >&2; exit 3; }
+  if delegate_to_python; then
+    python3 "$KEYCHAIN_PY" delete "$key" >/dev/null 2>&1 || true
+    return 0
+  fi
+  case "$PLATFORM" in
+    macos)   security delete-generic-password -s "$key" >/dev/null 2>&1 || true ;;
+    linux)   secret-tool clear service "$key" >/dev/null 2>&1 || true ;;
+    windows) ps_run "Remove-StoredCredential -Target '$key' -ErrorAction SilentlyContinue" >/dev/null 2>&1 || true ;;
+  esac
+}
+
+do_list() {
+  case "$PLATFORM" in
+    macos)
+      security dump-keychain 2>/dev/null \
+        | awk -F'"' '/0x00000007 <blob>=/{print $2}' \
+        | sort -u
+      ;;
+    linux)
+      secret-tool search --all 2>/dev/null \
+        | awk -F'= ' '/^attribute\.service/{print $2}' \
+        | sort -u
+      ;;
+    windows)
+      ps_run "Get-StoredCredential | ForEach-Object { \$_.TargetName }" 2>/dev/null | tr -d '\r'
+      ;;
+  esac
+}
+
+do_doctor() {
+  echo "Platform:        $PLATFORM"
+  case "$PLATFORM" in
+    macos)
+      command -v security >/dev/null 2>&1 \
+        && echo "Backend:         security ✓ (built-in)" \
+        || echo "Backend:         security ✗ MISSING (impossible on macOS)"
+      ;;
+    linux)
+      if command -v secret-tool >/dev/null 2>&1; then
+        echo "Backend:         secret-tool ✓"
+      else
+        echo "Backend:         secret-tool ✗ MISSING"
+        echo "Install:         sudo apt install libsecret-tools  # Debian/Ubuntu"
+        echo "                 sudo dnf install libsecret        # Fedora/RHEL"
+      fi
+      ;;
+    windows)
+      if command -v pwsh >/dev/null 2>&1 || command -v powershell.exe >/dev/null 2>&1; then
+        echo "Backend:         PowerShell ✓"
+        local has_mod
+        has_mod=$(ps_run "if (Get-Module -ListAvailable -Name CredentialManager) {'yes'} else {'no'}" 2>/dev/null | tr -d '\r' || echo "no")
+        if [ "$has_mod" = "yes" ]; then
+          echo "Module:          CredentialManager ✓"
+        else
+          echo "Module:          CredentialManager ✗ MISSING"
+          echo "Install:         Install-Module CredentialManager -Scope CurrentUser -Force"
+        fi
+      else
+        echo "Backend:         PowerShell ✗ MISSING"
+      fi
+      ;;
+    *)
+      echo "Backend:         (no platform support — falling back to env vars)"
+      ;;
+  esac
+}
+
+case "$CMD" in
+  get)      do_get "$@" ;;
+  set)      do_set "$@" ;;
+  delete)   do_delete "$@" ;;
+  list)     do_list ;;
+  platform) echo "$PLATFORM" ;;
+  doctor)   do_doctor ;;
+  *) echo "usage: $0 {get|set|delete|list|platform|doctor} [args]" >&2; exit 3 ;;
+esac