@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/lib/fetch-confluence.sh

@@ -0,0 +1,358 @@
+#!/bin/bash
+#
+# fetch-confluence.sh
+# Fetch a Confluence page by URL or pageId and emit a normalized JSON view
+# the Phase 1 (Analysis) prompt can consume. Pulls the page's storage-format
+# body, converts it to lightweight markdown, and extracts code blocks plus a
+# best-effort list of API contracts (HTTP method + path + JSON body) so
+# downstream phases can match the spec to the work.
+#
+# Two input forms accepted:
+#   ./fetch-confluence.sh <page-url>
+#   ./fetch-confluence.sh --host <host> --page-id <id>
+#
+# Optional env:
+#   CONFLUENCE_TIMEOUT_SECONDS    default 20
+#   CONFLUENCE_AUTH_TOKEN_KEY     default prefs.global.keychainMapping.confluence
+#                                 fallback "${USER}_Confluence_Access_Token"
+#   CONFLUENCE_HOST_OVERRIDE      forces the host (overrides URL host extraction)
+#
+# Output (stdout, single JSON object):
+#   {
+#     "fetchedAt": "<ISO8601>",
+#     "source": { "url": "<canonical-url>", "host": "<host>", "pageId": "<id>", "spaceKey": "<key|null>" },
+#     "title": "...",
+#     "bodyMarkdown": "<storage→markdown>",
+#     "codeBlocks": [ { "language": "json|http|...", "content": "..." } ],
+#     "apiContracts": [
+#       { "method": "POST", "path": "/v1/...", "requestExample": <json>, "responseExample": <json>, "source": "<heuristic>" }
+#     ]
+#   }
+#
+# Exit codes:
+#   0  success
+#   2  missing token or auth failure (after Save Flow trigger)
+#   3  network / HTTP error
+#   4  bad usage
+#
+# Notes on auth:
+#   The script reads the Confluence token via credential-store.sh. If the
+#   token is missing, the script prints a structured "blocked" JSON to stderr
+#   and exits 2 — the orchestrator handles the Save Flow + retry. The script
+#   itself never prompts.
+
+set -eu
+
+URL=""
+HOST_OVERRIDE="${CONFLUENCE_HOST_OVERRIDE:-}"
+PAGE_ID=""
+TIMEOUT="${CONFLUENCE_TIMEOUT_SECONDS:-20}"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --host)    HOST_OVERRIDE="$2"; shift 2 ;;
+    --page-id) PAGE_ID="$2"; shift 2 ;;
+    -h|--help)
+      echo "usage: $0 <page-url> | $0 --host <host> --page-id <id>" >&2
+      exit 4 ;;
+    *)
+      if [ -z "$URL" ]; then URL="$1"; shift; else
+        echo "ERR: unexpected arg $1" >&2; exit 4
+      fi ;;
+  esac
+done
+
+if [ -z "$URL" ] && [ -z "$PAGE_ID" ]; then
+  echo "usage: $0 <page-url> | $0 --host <host> --page-id <id>" >&2
+  exit 4
+fi
+
+# Resolve host + pageId from URL when not given explicitly.
+URL_PARSE_INPUT="$URL" URL_HOST_OVERRIDE="$HOST_OVERRIDE" URL_PAGE_ID="$PAGE_ID" \
+PARSED=$(python3 - <<'PY'
+import os, sys, re
+import urllib.parse as up
+
+url = os.environ.get("URL_PARSE_INPUT", "")
+host_override = os.environ.get("URL_HOST_OVERRIDE", "")
+explicit_id = os.environ.get("URL_PAGE_ID", "")
+
+host = host_override
+page_id = explicit_id
+space_key = ""
+
+if url:
+    p = up.urlparse(url)
+    host = host_override or p.netloc
+    query = up.parse_qs(p.query)
+    if not page_id:
+        page_id = (query.get("pageId") or [""])[0]
+    m = re.search(r"/wiki/spaces/(?P<space>[^/]+)/pages/(?P<id>\d+)", p.path)
+    if m:
+        space_key = m.group("space")
+        if not page_id:
+            page_id = m.group("id")
+    if not space_key:
+        m = re.search(r"/display/(?P<space>[^/]+)/", p.path)
+        if m:
+            space_key = m.group("space")
+
+print(f"{host}\t{page_id}\t{space_key}")
+PY
+)
+HOST=$(printf '%s' "$PARSED" | cut -f1)
+PAGE_ID_RESOLVED=$(printf '%s' "$PARSED" | cut -f2)
+SPACE_KEY=$(printf '%s' "$PARSED" | cut -f3)
+
+if [ -z "$HOST" ]; then
+  echo "ERR: could not determine Confluence host" >&2
+  exit 4
+fi
+
+# Resolve token via keychainMapping with sane fallback.
+PREFS="$HOME/.claude/multi-agent-preferences.json"
+TOKEN_KEY="${CONFLUENCE_AUTH_TOKEN_KEY:-}"
+if [ -z "$TOKEN_KEY" ] && [ -f "$PREFS" ]; then
+  TOKEN_KEY=$(python3 -c "
+import json
+try:
+    p = json.load(open('$PREFS'))
+    print(p.get('global', {}).get('keychainMapping', {}).get('confluence') or '')
+except Exception:
+    print('')
+")
+fi
+[ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Confluence_Access_Token"
+
+TOKEN=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+if [ -z "$TOKEN" ]; then
+  printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"confluence","expected_key":"'"$TOKEN_KEY"'"}' >&2
+  exit 2
+fi
+
+# Endpoint resolution: Confluence Cloud (<tenant>.atlassian.net/wiki/rest/api)
+# vs Server/Data Center (<host>/rest/api). The same paths exist on both.
+case "$HOST" in
+  *atlassian.net*) API_BASE="https://$HOST/wiki/rest/api" ;;
+  *)               API_BASE="https://$HOST/rest/api" ;;
+esac
+
+# When we have a page URL but no pageId yet, resolve via title lookup.
+if [ -z "$PAGE_ID_RESOLVED" ] && [ -n "$SPACE_KEY" ] && [ -n "$URL" ]; then
+  TITLE_RAW=$(python3 -c "
+import urllib.parse as up
+import os, re
+p = up.urlparse(os.environ['URL_PARSE_INPUT'])
+m = re.match(r'/display/[^/]+/(.+)', p.path)
+print(up.unquote(m.group(1)) if m else '')
+" URL_PARSE_INPUT="$URL")
+  if [ -n "$TITLE_RAW" ]; then
+    LOOKUP=$(curl -sS --fail --max-time "$TIMEOUT" \
+      -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" \
+      --data-urlencode "spaceKey=$SPACE_KEY" \
+      --data-urlencode "title=$TITLE_RAW" \
+      --data-urlencode "expand=" \
+      -G "$API_BASE/content" 2>/dev/null || true)
+    PAGE_ID_RESOLVED=$(printf '%s' "$LOOKUP" | python3 -c "
+import sys, json
+try:
+    r = json.load(sys.stdin)
+    res = r.get('results') or []
+    print(res[0]['id'] if res else '')
+except Exception:
+    print('')
+")
+  fi
+fi
+
+if [ -z "$PAGE_ID_RESOLVED" ]; then
+  echo "ERR: could not resolve Confluence pageId from $URL" >&2
+  exit 3
+fi
+
+# Fetch the page body in storage format.
+PAGE_JSON=$(curl -sS --fail --max-time "$TIMEOUT" \
+  -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" \
+  "$API_BASE/content/$PAGE_ID_RESOLVED?expand=body.storage,space" 2>/dev/null || true)
+
+if [ -z "$PAGE_JSON" ]; then
+  echo "ERR: Confluence GET failed for pageId=$PAGE_ID_RESOLVED" >&2
+  exit 3
+fi
+
+PAGE_URL="$URL" \
+PAGE_HOST="$HOST" \
+PAGE_ID_FINAL="$PAGE_ID_RESOLVED" \
+SPACE_KEY_FINAL="$SPACE_KEY" \
+PAGE_JSON_RAW="$PAGE_JSON" \
+python3 - <<'PY'
+import json, os, re, datetime, html
+from html.parser import HTMLParser
+
+raw = os.environ["PAGE_JSON_RAW"]
+data = json.loads(raw)
+
+storage = ((data.get("body") or {}).get("storage") or {}).get("value") or ""
+title = data.get("title") or "<untitled>"
+space_key = ((data.get("space") or {}).get("key")) or os.environ.get("SPACE_KEY_FINAL", "") or None
+
+# Very small HTML→markdown for the subset Confluence storage uses. Anything
+# we can't translate cleanly is kept as-is — the goal is to give Phase 1 a
+# readable, scannable prompt input, not perfect formatting.
+
+CODE_BLOCKS = []
+
+class Storage2MD(HTMLParser):
+    def __init__(self):
+        super().__init__(convert_charrefs=True)
+        self.out = []
+        self.stack = []
+        self._code = None
+        self._code_lang = None
+
+    def handle_starttag(self, tag, attrs):
+        a = dict(attrs)
+        if tag in ("h1","h2","h3","h4","h5","h6"):
+            self.out.append("\n" + "#" * int(tag[1]) + " ")
+            self.stack.append(tag)
+        elif tag in ("p", "br"):
+            self.out.append("\n")
+            self.stack.append(tag)
+        elif tag in ("ul","ol"):
+            self.out.append("\n")
+            self.stack.append(tag)
+        elif tag == "li":
+            self.out.append("\n- ")
+            self.stack.append(tag)
+        elif tag in ("strong","b"):
+            self.out.append("**"); self.stack.append(tag)
+        elif tag in ("em","i"):
+            self.out.append("*"); self.stack.append(tag)
+        elif tag == "code":
+            self.out.append("`"); self.stack.append(tag)
+        elif tag == "a":
+            self.out.append("["); self._href = a.get("href",""); self.stack.append(tag)
+        elif tag == "ac:structured-macro":
+            if a.get("ac:name") == "code":
+                self._code = []
+                self._code_lang = None
+                self.stack.append("code-macro")
+            else:
+                self.stack.append(tag)
+        elif tag == "ac:parameter":
+            if "code-macro" in self.stack and a.get("ac:name") == "language":
+                self._param_lang = True
+                self.stack.append("code-param-lang")
+            else:
+                self.stack.append(tag)
+        elif tag == "ac:plain-text-body":
+            self.stack.append(tag)
+            if "code-macro" in self.stack and self._code is not None:
+                self._in_code_body = True
+
+    def handle_endtag(self, tag):
+        if tag in ("h1","h2","h3","h4","h5","h6","p","li","ul","ol","br"):
+            if tag in ("p","li"): self.out.append("\n")
+        elif tag in ("strong","b"): self.out.append("**")
+        elif tag in ("em","i"):     self.out.append("*")
+        elif tag == "code":         self.out.append("`")
+        elif tag == "a":
+            self.out.append(f"]({getattr(self,'_href','')})"); self._href = ""
+        elif tag == "ac:structured-macro" and self.stack and self.stack[-1] == "code-macro":
+            # flush code block
+            body = "".join(self._code or []).strip()
+            CODE_BLOCKS.append({"language": self._code_lang or "", "content": body})
+            self.out.append(f"\n```{self._code_lang or ''}\n{body}\n```\n")
+            self._code = None
+            self._code_lang = None
+        elif tag == "ac:parameter" and self.stack and self.stack[-1] == "code-param-lang":
+            self._param_lang = False
+        elif tag == "ac:plain-text-body":
+            self._in_code_body = False
+        if self.stack and (self.stack[-1] == tag or self.stack[-1] in {"code-macro","code-param-lang"}):
+            self.stack.pop()
+
+    def handle_data(self, data):
+        if getattr(self, "_in_code_body", False) and self._code is not None:
+            self._code.append(data)
+        elif getattr(self, "_param_lang", False):
+            self._code_lang = (data or "").strip() or self._code_lang
+        else:
+            self.out.append(data)
+
+    def unknown_decl(self, data):
+        # Confluence storage wraps code-block contents in <![CDATA[...]]>.
+        # HTMLParser doesn't fire handle_data for those by default, so route
+        # the payload through the same path as regular character data.
+        if data.startswith("CDATA["):
+            payload = data[len("CDATA["):]
+            self.handle_data(payload)
+
+    def get_markdown(self):
+        text = "".join(self.out)
+        text = re.sub(r"\n{3,}", "\n\n", text)
+        return text.strip()
+
+parser = Storage2MD()
+parser.feed(storage)
+md = parser.get_markdown()
+
+# Best-effort API contract extraction.
+# Heuristic: find a code block whose language is "http" or whose first line
+# looks like `<METHOD> <path>`, optionally followed by a JSON code block.
+api_contracts = []
+HTTP_LINE = re.compile(r"^(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)\s+(/\S+)\s*$", re.M)
+for i, blk in enumerate(CODE_BLOCKS):
+    content = blk["content"] or ""
+    lang = (blk["language"] or "").lower()
+    if lang in ("http", "rest"):
+        m = HTTP_LINE.search(content)
+        if not m:
+            continue
+        method, path = m.group(1), m.group(2)
+    elif lang in ("", "text"):
+        m = HTTP_LINE.match(content)
+        if not m:
+            continue
+        method, path = m.group(1), m.group(2)
+    else:
+        continue
+    # Look ahead for a JSON request body in the next block (request) and
+    # the one after (response). Cheap heuristic — covers the most common
+    # "Method/Path → Request JSON → Response JSON" pattern.
+    request_example = None
+    response_example = None
+    for j in (i + 1, i + 2):
+        if j < len(CODE_BLOCKS):
+            try:
+                candidate = json.loads(CODE_BLOCKS[j]["content"])
+                if request_example is None:
+                    request_example = candidate
+                elif response_example is None:
+                    response_example = candidate
+                    break
+            except Exception:
+                pass
+    api_contracts.append({
+        "method": method,
+        "path": path,
+        "requestExample": request_example,
+        "responseExample": response_example,
+        "source": f"codeBlocks[{i}]",
+    })
+
+result = {
+    "fetchedAt": datetime.datetime.utcnow().isoformat() + "Z",
+    "source": {
+        "url": os.environ.get("PAGE_URL") or None,
+        "host": os.environ.get("PAGE_HOST"),
+        "pageId": os.environ.get("PAGE_ID_FINAL"),
+        "spaceKey": space_key,
+    },
+    "title": title,
+    "bodyMarkdown": md,
+    "codeBlocks": CODE_BLOCKS,
+    "apiContracts": api_contracts,
+}
+print(json.dumps(result, ensure_ascii=False))
+PY

package/pipeline/lib/fetch-crashlytics.sh

@@ -0,0 +1,314 @@
+#!/bin/bash
+#
+# fetch-crashlytics.sh
+# Fetch a Firebase Crashlytics issue (and optional session) by URL or by
+# parsed components. Auths with the user's Firebase service-account JSON
+# stored in the keychain (see Phase 0 Step 1b.1 — this script is the
+# implementation backing that step).
+#
+# Usage:
+#   ./fetch-crashlytics.sh <issue-url>
+#   ./fetch-crashlytics.sh --project <id> --platform <ios|android> \
+#                          --bundle <id> --issue-id <id> [--session-id <id>]
+#
+# Optional env:
+#   FIREBASE_TIMEOUT_SECONDS    default 20
+#   FIREBASE_TOKEN_KEY          default prefs.global.keychainMapping.firebase
+#                               fallback "${USER}_Firebase_Access_Json"
+#
+# Output (stdout, single JSON object):
+#   {
+#     "fetchedAt": "<ISO8601>",
+#     "source": { "url": "<url|null>", "projectId": "...", "platform": "ios|android",
+#                 "bundle": "...", "issueId": "...", "sessionId": "<id|null>" },
+#     "issue": { "title": "...", "subtitle": "...", "type": "fatal|nonFatal|ANR",
+#                "occurrences": <n>, "impactedUsers": <n>,
+#                "firstSeen": "<ISO8601>", "lastSeen": "<ISO8601>",
+#                "topStackFrame": { "file": "...", "line": <n>, "symbol": "..." },
+#                "topDevices": [ "<name>", ... ],
+#                "topOS": [ "<version>", ... ],
+#                "affectedAppVersions": [ "<version>", ... ] },
+#     "session": null | { "id": "...", "events": [ { "type": "...", "time": "...", "summary": "..." } ] }
+#   }
+#
+# Exit codes:
+#   0  success
+#   2  missing/expired credential (orchestrator handles the Save Flow)
+#   3  network or auth failure
+#   4  bad usage
+#   5  project mismatch — SA JSON project_id != URL project (configuration bug)
+#
+# Notes:
+#   The Firebase Crashlytics REST surface (`firebasecrashlytics.googleapis.com`)
+#   is currently invitation-only in some regions. When the API returns 404 for
+#   a valid project the script exits 3 with reason "api-not-enabled"; the
+#   orchestrator surfaces this as "fetcher unavailable, advisory only" to
+#   keep the pipeline moving.
+
+set -eu
+
+URL=""
+PROJECT_ID=""
+PLATFORM=""
+BUNDLE=""
+ISSUE_ID=""
+SESSION_ID=""
+TIMEOUT="${FIREBASE_TIMEOUT_SECONDS:-20}"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --project)    PROJECT_ID="$2"; shift 2 ;;
+    --platform)   PLATFORM="$2";   shift 2 ;;
+    --bundle)     BUNDLE="$2";     shift 2 ;;
+    --issue-id)   ISSUE_ID="$2";   shift 2 ;;
+    --session-id) SESSION_ID="$2"; shift 2 ;;
+    -h|--help)
+      echo "usage: $0 <issue-url> | $0 --project ... --platform ... --bundle ... --issue-id ... [--session-id ...]" >&2
+      exit 4 ;;
+    *)
+      if [ -z "$URL" ]; then URL="$1"; shift; else
+        echo "ERR: unexpected arg $1" >&2; exit 4
+      fi ;;
+  esac
+done
+
+# When given a URL, parse it into components using the same regex Phase 0 uses.
+if [ -n "$URL" ] && [ -z "$ISSUE_ID" ]; then
+  PARSED=$(URL_IN="$URL" python3 - <<'PY'
+import os, re, sys, urllib.parse as up
+url = os.environ["URL_IN"]
+p = up.urlparse(url)
+if p.netloc != "console.firebase.google.com":
+    print("\t\t\t\t")
+    sys.exit(0)
+m = re.search(
+    r"/project/(?P<project>[^/]+)/crashlytics/app/(?P<platform>ios|android)(?::|%3A)(?P<bundle>[^/]+)/issues/(?P<issue>[^/?#]+)(?:/sessions/(?P<session>[^/?#]+))?",
+    p.path,
+)
+if not m:
+    print("\t\t\t\t")
+    sys.exit(0)
+print("\t".join([
+    m.group("project") or "",
+    m.group("platform") or "",
+    up.unquote(m.group("bundle") or ""),
+    m.group("issue") or "",
+    m.group("session") or "",
+]))
+PY
+)
+  PROJECT_ID=$(printf '%s' "$PARSED" | cut -f1)
+  PLATFORM=$(printf '%s' "$PARSED" | cut -f2)
+  BUNDLE=$(printf '%s' "$PARSED" | cut -f3)
+  ISSUE_ID=$(printf '%s' "$PARSED" | cut -f4)
+  SESSION_ID=$(printf '%s' "$PARSED" | cut -f5)
+fi
+
+if [ -z "$PROJECT_ID" ] || [ -z "$PLATFORM" ] || [ -z "$BUNDLE" ] || [ -z "$ISSUE_ID" ]; then
+  echo "ERR: missing required components — need project, platform, bundle, issue-id" >&2
+  exit 4
+fi
+
+# Resolve Firebase SA JSON via keychain mapping (matches Phase 0 contract).
+PREFS="$HOME/.claude/multi-agent-preferences.json"
+TOKEN_KEY="${FIREBASE_TOKEN_KEY:-}"
+if [ -z "$TOKEN_KEY" ] && [ -f "$PREFS" ]; then
+  TOKEN_KEY=$(python3 -c "
+import json
+try:
+    p = json.load(open('$PREFS'))
+    print(p.get('global', {}).get('keychainMapping', {}).get('firebase') or '')
+except Exception:
+    print('')
+")
+fi
+[ -z "$TOKEN_KEY" ] && TOKEN_KEY="${USER}_Firebase_Access_Json"
+
+SA_JSON_B64=$("$HOME/.claude/lib/credential-store.sh" get "$TOKEN_KEY" 2>/dev/null || true)
+if [ -z "$SA_JSON_B64" ]; then
+  printf '%s\n' '{"status":"blocked","reason":"missing-token","service":"firebase","expected_key":"'"$TOKEN_KEY"'"}' >&2
+  exit 2
+fi
+
+# The credential store may return raw JSON or base64-encoded JSON (the user's
+# setup convention). Try base64-decode first, fall back to raw.
+SA_JSON=""
+if printf '%s' "$SA_JSON_B64" | base64 -d > /tmp/.fc-sa-$$.json 2>/dev/null \
+   && python3 -c "import json; json.load(open('/tmp/.fc-sa-$$.json'))" 2>/dev/null; then
+  SA_JSON=$(cat /tmp/.fc-sa-$$.json)
+else
+  SA_JSON="$SA_JSON_B64"
+fi
+rm -f /tmp/.fc-sa-$$.json
+
+# Verify project_id from SA JSON matches the URL — protects against pasting a
+# crash URL from another GCP project than the keychain's SA covers.
+SA_PROJECT=$(printf '%s' "$SA_JSON" | python3 -c "
+import sys, json
+try:
+    p = json.load(sys.stdin)
+    print(p.get('project_id') or '')
+except Exception:
+    print('')
+")
+if [ -n "$SA_PROJECT" ] && [ "$SA_PROJECT" != "$PROJECT_ID" ]; then
+  echo "ERR: SA project_id ($SA_PROJECT) != URL project ($PROJECT_ID)" >&2
+  exit 5
+fi
+
+# Exchange the SA JSON for a short-lived access token. JWT exchange:
+#   1. Build header + claim, base64url
+#   2. Sign with the SA private key
+#   3. POST to oauth2.googleapis.com/token
+ACCESS_TOKEN=$(SA_JSON_IN="$SA_JSON" python3 - <<'PY'
+import base64, json, os, sys, time, urllib.parse, urllib.request
+
+sa = json.loads(os.environ["SA_JSON_IN"])
+private_key = sa.get("private_key")
+client_email = sa.get("client_email")
+if not (private_key and client_email):
+    print("", file=sys.stderr)
+    sys.exit(1)
+
+def b64u(b):
+    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
+
+header = {"alg": "RS256", "typ": "JWT"}
+now = int(time.time())
+claim = {
+    "iss": client_email,
+    "scope": "https://www.googleapis.com/auth/firebase https://www.googleapis.com/auth/cloud-platform",
+    "aud": "https://oauth2.googleapis.com/token",
+    "iat": now,
+    "exp": now + 3600,
+}
+
+signing_input = b64u(json.dumps(header, separators=(",",":")).encode()) + "." \
+              + b64u(json.dumps(claim,  separators=(",",":")).encode())
+
+# Sign via cryptography if available, fall back to openssl pipe.
+signature = None
+try:
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import padding
+    key = serialization.load_pem_private_key(private_key.encode(), password=None)
+    sig = key.sign(signing_input.encode(), padding.PKCS1v15(), hashes.SHA256())
+    signature = b64u(sig)
+except ImportError:
+    import subprocess, tempfile
+    with tempfile.NamedTemporaryFile("w", delete=False) as f:
+        f.write(private_key)
+        keyf = f.name
+    try:
+        p = subprocess.run(
+            ["openssl", "dgst", "-sha256", "-sign", keyf],
+            input=signing_input.encode(),
+            capture_output=True, check=True,
+        )
+        signature = b64u(p.stdout)
+    finally:
+        os.unlink(keyf)
+
+jwt = signing_input + "." + signature
+
+body = urllib.parse.urlencode({
+    "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    "assertion": jwt,
+}).encode()
+req = urllib.request.Request(
+    "https://oauth2.googleapis.com/token",
+    data=body,
+    headers={"Content-Type": "application/x-www-form-urlencoded"},
+)
+try:
+    with urllib.request.urlopen(req, timeout=int(os.environ.get("FIREBASE_TIMEOUT_SECONDS", "20"))) as resp:
+        out = json.loads(resp.read().decode())
+        print(out.get("access_token") or "")
+except Exception as e:
+    print("", file=sys.stderr)
+    sys.exit(2)
+PY
+)
+
+if [ -z "$ACCESS_TOKEN" ]; then
+  echo "ERR: Firebase token exchange failed" >&2
+  exit 3
+fi
+
+# Construct the appId in the form Firebase expects:
+#   ios:   ios:<bundleId>   →  api: /projects/<n>/apps/<bundleId> (looked up via list)
+#   android: android:<package>
+# In practice the appId is opaque (1:1234567890:ios:abcdef). We try the
+# Crashlytics v1alpha endpoint with the bundle as a fallback "app" — the API
+# accepts the package/bundle when scoped to the project.
+APP_REF="$PLATFORM:$BUNDLE"
+ISSUE_URL_API="https://firebasecrashlytics.googleapis.com/v1alpha/projects/$PROJECT_ID/apps/$APP_REF/issues/$ISSUE_ID"
+
+ISSUE_JSON=$(curl -sS --fail --max-time "$TIMEOUT" \
+  -H "Authorization: Bearer $ACCESS_TOKEN" -H "Accept: application/json" \
+  "$ISSUE_URL_API" 2>/dev/null || true)
+
+if [ -z "$ISSUE_JSON" ]; then
+  printf '{"status":"failed","reason":"api-not-enabled-or-app-mismatch","appRef":"%s","issueId":"%s"}\n' "$APP_REF" "$ISSUE_ID" >&2
+  exit 3
+fi
+
+SESSION_JSON=""
+if [ -n "$SESSION_ID" ]; then
+  SESSION_URL_API="$ISSUE_URL_API/sessions/$SESSION_ID"
+  SESSION_JSON=$(curl -sS --fail --max-time "$TIMEOUT" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" -H "Accept: application/json" \
+    "$SESSION_URL_API" 2>/dev/null || true)
+fi
+
+SRC_URL="$URL" SRC_PROJECT="$PROJECT_ID" SRC_PLATFORM="$PLATFORM" SRC_BUNDLE="$BUNDLE" \
+SRC_ISSUE="$ISSUE_ID" SRC_SESSION="$SESSION_ID" \
+ISSUE_JSON_IN="$ISSUE_JSON" SESSION_JSON_IN="$SESSION_JSON" \
+python3 - <<'PY'
+import json, os, datetime
+
+issue = json.loads(os.environ["ISSUE_JSON_IN"] or "{}")
+session_raw = os.environ.get("SESSION_JSON_IN") or ""
+session = json.loads(session_raw) if session_raw else None
+
+def first(d, *keys, default=None):
+    for k in keys:
+        if isinstance(d, dict) and k in d:
+            return d[k]
+    return default
+
+top_frame_raw = first(issue, "topFrame", "frame", default={}) or {}
+result = {
+    "fetchedAt": datetime.datetime.utcnow().isoformat() + "Z",
+    "source": {
+        "url": os.environ.get("SRC_URL") or None,
+        "projectId": os.environ["SRC_PROJECT"],
+        "platform": os.environ["SRC_PLATFORM"],
+        "bundle": os.environ["SRC_BUNDLE"],
+        "issueId": os.environ["SRC_ISSUE"],
+        "sessionId": os.environ.get("SRC_SESSION") or None,
+    },
+    "issue": {
+        "title": first(issue, "title", "errorTitle", "subtitle", default=""),
+        "subtitle": first(issue, "subtitle", "errorMessage", default=""),
+        "type": first(issue, "type", "errorType", default="unknown"),
+        "occurrences": first(issue, "occurrences", "eventCount", default=0),
+        "impactedUsers": first(issue, "impactedUsers", "userCount", default=0),
+        "firstSeen": first(issue, "firstSeen", "createTime", default=None),
+        "lastSeen": first(issue, "lastSeen", "updateTime", default=None),
+        "topStackFrame": {
+            "file": first(top_frame_raw, "fileName", "file", default=""),
+            "line": first(top_frame_raw, "lineNumber", "line", default=0),
+            "symbol": first(top_frame_raw, "symbol", "function", default=""),
+        },
+        "topDevices": (issue.get("topDevices") or [])[:5],
+        "topOS": (issue.get("topOperatingSystems") or issue.get("topOS") or [])[:5],
+        "affectedAppVersions": (issue.get("affectedVersions") or issue.get("appVersions") or [])[:5],
+    },
+    "session": ({
+        "id": os.environ.get("SRC_SESSION") or "",
+        "events": (session.get("events") if isinstance(session, dict) else None) or [],
+    } if session else None),
+}
+print(json.dumps(result, ensure_ascii=False))
+PY