@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/lib/plan-todos.sh

@@ -0,0 +1,284 @@
+#!/usr/bin/env bash
+#
+# plan-todos.sh — manage the Phase 2 plan as a live Todo list.
+#
+# Pattern source:
+#   - Windsurf Cascade — https://docs.windsurf.com/windsurf/cascade
+#       "renders a Todo list inside the conversation that updates as it works"
+#   - Cursor Plan Mode — https://cursor.com/docs/agent/planning
+#       "creates a detailed, reviewable, editable plan before writing any code"
+#
+# State lives in `agent-state.json` under `.plan.todos[]` per
+# pipeline/schemas/plan-todos.schema.json. Phase 2 (Planning) emits the
+# initial plan; Phase 3 (Dev) iterates step-by-step; Phase 4 (Review)
+# inspects completion; Phase 7 (Report) renders the rollup.
+#
+# Subcommands:
+#   init      <task-id> [title]            Initialize with empty todos[] (Phase 2 usually pipes the JSON instead)
+#   set       <task-id> <plan-json>        Replace the whole plan from a JSON blob on stdin or arg
+#   start     <task-id> <todo-id>          Mark in_progress, set startedAt; refuses if deps unsatisfied
+#   complete  <task-id> <todo-id> [notes]  Mark completed, set completedAt
+#   fail      <task-id> <todo-id> <reason> Mark failed
+#   skip      <task-id> <todo-id> <reason> Mark skipped (counts as satisfied for dependents)
+#   next      <task-id>                    Print next pending todo (deps-respecting); empty if none
+#   list      <task-id>                    Render Markdown checklist
+#   status    <task-id>                    Print one-line summary: "3/7 done, 1 in progress"
+#   show      <task-id>                    Print the full plan JSON
+#
+# Exit codes:
+#   0  success
+#   1  todo not found / state missing
+#   2  bad transition (deps unsatisfied, double-start, …)
+#   64 usage error
+
+set -euo pipefail
+
+CMD="${1:-}"
+shift || true
+
+usage() {
+  sed -n '2,30p' "$0" >&2
+  exit 64
+}
+
+[ -z "$CMD" ] && usage
+
+# --- agent-state resolver ---------------------------------------------------
+
+resolve_state() {
+  local task_id="$1"
+  local found=""
+  for dir in $HOME/.claude/projects/-Users-*; do
+    local candidate="$dir/state/$task_id/agent-state.json"
+    if [ -f "$candidate" ]; then
+      found="$candidate"
+      break
+    fi
+  done
+  if [ -z "$found" ]; then
+    echo "plan-todos: agent-state.json not found for task=$task_id" >&2
+    exit 1
+  fi
+  printf '%s' "$found"
+}
+
+write_state() {
+  local path="$1" content="$2"
+  local tmp; tmp=$(mktemp)
+  printf '%s\n' "$content" > "$tmp"
+  mv "$tmp" "$path"
+}
+
+iso_now() { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
+
+# --- Subcommands ------------------------------------------------------------
+
+do_init() {
+  local task_id="${1:-}"; local title="${2:-Plan}"
+  [ -z "$task_id" ] && { echo "usage: init <task-id> [title]" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  local now; now=$(iso_now)
+  local new
+  new=$(jq --arg t "$title" --arg c "$now" '
+    .plan = (.plan // {}) | .plan.title = $t | .plan.createdAt = $c | .plan.todos = []
+  ' "$state_path")
+  write_state "$state_path" "$new"
+}
+
+do_set() {
+  local task_id="${1:-}"; local plan_blob="${2:-}"
+  [ -z "$task_id" ] && { echo "usage: set <task-id> <plan-json|-(stdin)>" >&2; exit 64; }
+  if [ -z "$plan_blob" ] || [ "$plan_blob" = "-" ]; then
+    plan_blob=$(cat)
+  fi
+  # Validate against schema (best-effort — jq syntax check, then required-field probe).
+  if ! jq -e '.title and (.todos | type == "array")' <<<"$plan_blob" >/dev/null 2>&1; then
+    echo "plan-todos: input must be an object with .title (string) and .todos (array)" >&2
+    exit 2
+  fi
+  local state_path; state_path=$(resolve_state "$task_id")
+  local now; now=$(iso_now)
+  local new
+  new=$(jq --argjson p "$plan_blob" --arg c "$now" '
+    .plan = ($p | .createdAt = $c)
+    | .plan.todos = ((.plan.todos // []) | map(. + {status: (.status // "pending"), deps: (.deps // [])}))
+  ' "$state_path")
+  write_state "$state_path" "$new"
+}
+
+deps_satisfied() {
+  # $1 state JSON, $2 todo_id — exits 0 if all deps for that todo are completed|skipped.
+  local state="$1" todo_id="$2"
+  jq -e --arg id "$todo_id" '
+    (.plan.todos // []) as $all
+    | ($all | map(select(.id == $id))[0]) as $t
+    | ($t // empty | .deps // [])
+    | all(
+        . as $d
+        | $all | map(select(.id == $d))[0] // null
+        | . != null and (.status == "completed" or .status == "skipped")
+      )
+  ' <<<"$state" >/dev/null 2>&1
+}
+
+do_start() {
+  local task_id="${1:-}"; local todo_id="${2:-}"
+  [ -z "$task_id" ] || [ -z "$todo_id" ] && { echo "usage: start <task-id> <todo-id>" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  local state; state=$(cat "$state_path")
+  # Existence check
+  if ! jq -e --arg id "$todo_id" '(.plan.todos // []) | map(select(.id == $id)) | length > 0' <<<"$state" >/dev/null 2>&1; then
+    echo "plan-todos: todo '$todo_id' not found" >&2
+    exit 1
+  fi
+  # Deps check
+  if ! deps_satisfied "$state" "$todo_id"; then
+    echo "plan-todos: deps for '$todo_id' not satisfied (still pending/in_progress/failed)" >&2
+    exit 2
+  fi
+  local now; now=$(iso_now)
+  local new
+  new=$(jq --arg id "$todo_id" --arg t "$now" '
+    .plan.todos |= map(
+      if .id == $id then .status = "in_progress" | .startedAt = $t else . end
+    )
+  ' <<<"$state")
+  write_state "$state_path" "$new"
+}
+
+do_complete() {
+  local task_id="${1:-}"; local todo_id="${2:-}"; local notes="${3:-}"
+  [ -z "$task_id" ] || [ -z "$todo_id" ] && { echo "usage: complete <task-id> <todo-id> [notes]" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  local now; now=$(iso_now)
+  local new
+  new=$(jq --arg id "$todo_id" --arg t "$now" --arg n "$notes" '
+    .plan.todos |= map(
+      if .id == $id then
+        .status = "completed" | .completedAt = $t
+        | if ($n != "") then .notes = $n else . end
+      else . end
+    )
+  ' "$state_path")
+  write_state "$state_path" "$new"
+}
+
+do_fail() {
+  local task_id="${1:-}"; local todo_id="${2:-}"; local reason="${3:-}"
+  [ -z "$task_id" ] || [ -z "$todo_id" ] || [ -z "$reason" ] && { echo "usage: fail <task-id> <todo-id> <reason>" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  local now; now=$(iso_now)
+  local new
+  new=$(jq --arg id "$todo_id" --arg t "$now" --arg r "$reason" '
+    .plan.todos |= map(
+      if .id == $id then .status = "failed" | .completedAt = $t | .failureReason = $r else . end
+    )
+  ' "$state_path")
+  write_state "$state_path" "$new"
+}
+
+do_skip() {
+  local task_id="${1:-}"; local todo_id="${2:-}"; local reason="${3:-}"
+  [ -z "$task_id" ] || [ -z "$todo_id" ] || [ -z "$reason" ] && { echo "usage: skip <task-id> <todo-id> <reason>" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  local now; now=$(iso_now)
+  local new
+  new=$(jq --arg id "$todo_id" --arg t "$now" --arg r "$reason" '
+    .plan.todos |= map(
+      if .id == $id then .status = "skipped" | .completedAt = $t | .skipReason = $r else . end
+    )
+  ' "$state_path")
+  write_state "$state_path" "$new"
+}
+
+do_next() {
+  local task_id="${1:-}"
+  [ -z "$task_id" ] && { echo "usage: next <task-id>" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  # Pick the first pending todo whose deps are all completed|skipped.
+  jq -r '
+    (.plan.todos // []) as $all
+    | $all
+    | map(select(.status == "pending"))
+    | map(
+        . as $t
+        | select(
+            (.deps // [])
+            | all(
+                . as $d
+                | $all | map(select(.id == $d))[0] // null
+                | . != null and (.status == "completed" or .status == "skipped")
+              )
+          )
+      )
+    | (.[0] // empty)
+    | if . == null or . == "" then "" else .id + "\t" + .task end
+  ' "$state_path"
+}
+
+do_list() {
+  local task_id="${1:-}"
+  [ -z "$task_id" ] && { echo "usage: list <task-id>" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  local title; title=$(jq -r '.plan.title // "Plan"' "$state_path")
+  printf '## %s\n\n' "$title"
+  jq -r '
+    (.plan.todos // [])
+    | map(
+        ({
+          pending:    "- [ ]",
+          in_progress:"- [~]",
+          completed:  "- [x]",
+          skipped:    "- [/]",
+          failed:     "- [!]"
+        } as $marks
+        | ($marks[.status] // "- [ ]") + " **" + .id + "** " + .task
+          + (if (.notes // "") != "" then "  _(" + .notes + ")_" else "" end)
+          + (if (.failureReason // "") != "" then "  _**failed:** " + .failureReason + "_" else "" end)
+          + (if (.skipReason    // "") != "" then "  _**skipped:** "    + .skipReason    + "_" else "" end))
+      )
+    | .[]
+  ' "$state_path"
+}
+
+do_status() {
+  local task_id="${1:-}"
+  [ -z "$task_id" ] && { echo "usage: status <task-id>" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  jq -r '
+    (.plan.todos // []) as $t
+    | ($t | length)                                                as $total
+    | ($t | map(select(.status == "completed")) | length)          as $done
+    | ($t | map(select(.status == "in_progress")) | length)        as $inprog
+    | ($t | map(select(.status == "failed")) | length)             as $failed
+    | ($t | map(select(.status == "skipped")) | length)            as $skipped
+    | "\($done)/\($total) done"
+      + (if $inprog > 0  then ", \($inprog) in progress" else "" end)
+      + (if $failed > 0  then ", \($failed) failed"      else "" end)
+      + (if $skipped > 0 then ", \($skipped) skipped"    else "" end)
+  ' "$state_path"
+}
+
+do_show() {
+  local task_id="${1:-}"
+  [ -z "$task_id" ] && { echo "usage: show <task-id>" >&2; exit 64; }
+  local state_path; state_path=$(resolve_state "$task_id")
+  jq '.plan // {}' "$state_path"
+}
+
+# --- Dispatch ---------------------------------------------------------------
+
+case "$CMD" in
+  init)     do_init     "$@" ;;
+  set)      do_set      "$@" ;;
+  start)    do_start    "$@" ;;
+  complete) do_complete "$@" ;;
+  fail)     do_fail     "$@" ;;
+  skip)     do_skip     "$@" ;;
+  next)     do_next     "$@" ;;
+  list)     do_list     "$@" ;;
+  status)   do_status   "$@" ;;
+  show)     do_show     "$@" ;;
+  --help|-h) usage ;;
+  *) echo "plan-todos: unknown subcommand '$CMD'" >&2; usage ;;
+esac

package/pipeline/lib/post-pr-review.sh

@@ -0,0 +1,374 @@
+#!/usr/bin/env bash
+#
+# post-pr-review.sh
+#
+# Posts the verdict from `agent-state.review` to the target PR using the
+# review-actions contract: per-finding inline comments + an explicit approve
+# / needs-work state. Spec: refs/channels/pr-review-actions.md.
+#
+# Provider switch:
+#   - github           → gh CLI (gh api + gh pr review)
+#   - bitbucket-server → curl + Bitbucket REST API (Basic auth from keychain)
+#
+# Usage:
+#   post-pr-review.sh <task-id>
+#
+# Reads from agent-state.json:
+#   .review.input              { kind, provider, host, orgRepo, prNumber,
+#                                bbProjectKey, bbRepoSlug, bbServerHost }
+#   .review.findings           [{ severity, status, file, line, issue, fix,
+#                                ruleId }]
+#   .review.iterationNumber    int (1-based, used in comment footer)
+#   .review.headCommitSha      string  (GitHub inline anchor needs commit_id)
+#
+# Reads from preferences:
+#   prefs.global.outputLanguage  ("tr" | "en")
+#
+# Exit codes:
+#   0  success — verdict + (any) inline comments posted
+#   2  agent-state.json missing or .review absent
+#   3  unknown provider; falls back to chat-only and exits 3
+#   4  API call failed (network / auth / 4xx). Diagnostic line on stderr.
+
+set -euo pipefail
+
+TASK_ID="${1:-}"
+
+if [ -z "$TASK_ID" ]; then
+  echo "usage: post-pr-review.sh <task-id>" >&2
+  exit 64
+fi
+
+# Resolve agent-state.json (matches phase-tracker convention).
+AGENT_STATE=""
+for dir in $HOME/.claude/projects/-Users-*; do
+  candidate="$dir/state/$TASK_ID/agent-state.json"
+  if [ -f "$candidate" ]; then
+    AGENT_STATE="$candidate"
+    break
+  fi
+done
+
+if [ -z "$AGENT_STATE" ]; then
+  echo "post-pr-review: agent-state.json not found for task=$TASK_ID" >&2
+  exit 2
+fi
+
+if ! jq -e '.review' "$AGENT_STATE" >/dev/null; then
+  echo "post-pr-review: agent-state has no .review field — run /multi-agent:review first" >&2
+  exit 2
+fi
+
+OUT_LANG=$(jq -r '.global.outputLanguage // "en"' "$HOME/.claude/multi-agent-preferences.json" 2>/dev/null || echo "en")
+case "$OUT_LANG" in tr|en) ;; *) OUT_LANG=en ;; esac
+
+PROVIDER=$(jq -r '.review.input.provider // empty' "$AGENT_STATE")
+PR_NUM=$(jq -r '.review.input.prNumber // empty' "$AGENT_STATE")
+ITERATION=$(jq -r '.review.iterationNumber // 1' "$AGENT_STATE")
+
+# --- Decision ---------------------------------------------------------------
+
+# Single jq pass — group accepted findings by severity into tab-separated counts.
+read -r ACCEPTED_BLOCKING ACCEPTED_IMPORTANT < <(
+  jq -r '
+    [.review.findings[] | select(.status == "accepted")] as $a
+    | [($a | map(select(.severity == "blocking")) | length),
+       ($a | map(select(.severity == "important")) | length)]
+    | @tsv
+  ' "$AGENT_STATE"
+)
+ACCEPTED_BLOCKING=${ACCEPTED_BLOCKING:-0}
+ACCEPTED_IMPORTANT=${ACCEPTED_IMPORTANT:-0}
+
+if [ "$ACCEPTED_BLOCKING" -eq 0 ] && [ "$ACCEPTED_IMPORTANT" -eq 0 ]; then
+  DECISION=approve
+else
+  DECISION=needs_work
+fi
+
+echo "post-pr-review: decision=$DECISION (blocking=$ACCEPTED_BLOCKING, important=$ACCEPTED_IMPORTANT)" >&2
+
+# --- Per-finding comment body renderer (in $OUT_LANG) -----------------------
+
+# Stable fingerprint for a finding — used by dedupe to recognize re-runs of
+# the same finding without re-posting. Sha256 of "path|line|issue" — note
+# that fix/ruleId/iterationNumber are excluded so a finding still dedupes
+# when the suggested fix wording changes slightly between iterations.
+finding_fingerprint() {
+  local path="$1" line="$2" issue="$3"
+  printf '%s|%s|%s' "$path" "$line" "$issue" | shasum -a 256 | cut -c1-16
+}
+
+render_inline_body() {
+  local sev="$1" issue="$2" fix="$3" rule_id="$4" fingerprint="${5:-}"
+
+  local emoji label_word fix_label
+  case "$sev" in
+    blocking)  emoji="🔴" ;;
+    important) emoji="🟡" ;;
+    *)         emoji="⚪" ;;  # never reached; suggestions never post
+  esac
+
+  if [ "$OUT_LANG" = "tr" ]; then
+    case "$sev" in
+      blocking)  label_word="Blocker" ;;
+      important) label_word="Önemli" ;;
+    esac
+    fix_label="Öneri"
+  else
+    case "$sev" in
+      blocking)  label_word="Blocker" ;;
+      important) label_word="Important" ;;
+    esac
+    fix_label="Suggestion"
+  fi
+
+  printf '%s **%s** — %s\n\n' "$emoji" "$label_word" "$issue"
+  if [ -n "$fix" ] && [ "$fix" != "null" ]; then
+    printf '**%s:** %s\n\n' "$fix_label" "$fix"
+  fi
+  if [ -n "$rule_id" ] && [ "$rule_id" != "null" ]; then
+    printf '_%s_\n\n' "$rule_id"
+  fi
+  printf -- '---\n🤖 _Multi-Agent Review · iteration #%s_\n' "$ITERATION"
+  # Dedupe marker — Bugbot-style. Re-runs of /multi-agent:review skip a
+  # finding when an existing comment carries the same fingerprint.
+  if [ -n "$fingerprint" ]; then
+    printf '<!-- multi-agent-finding: %s -->\n' "$fingerprint"
+  fi
+}
+
+# Returns 0 if a comment carrying this fingerprint already exists on the PR.
+# Cached: the full comment list is fetched once per run and grepped per finding.
+EXISTING_COMMENTS_CACHE=""
+load_existing_comments_github() {
+  local org_repo="$1" pr_num="$2"
+  if [ -z "$EXISTING_COMMENTS_CACHE" ]; then
+    # Combine review-comments (inline) + issue comments (top-level fallback).
+    # Use --paginate so PRs with >30 comments still dedupe correctly.
+    EXISTING_COMMENTS_CACHE=$(
+      {
+        gh api --paginate "/repos/$org_repo/pulls/$pr_num/comments" 2>/dev/null || echo "[]"
+        gh api --paginate "/repos/$org_repo/issues/$pr_num/comments" 2>/dev/null || echo "[]"
+      } | jq -s 'add // []' 2>/dev/null || echo "[]"
+    )
+  fi
+}
+
+comment_exists_with_fingerprint() {
+  local fingerprint="$1"
+  [ -z "$EXISTING_COMMENTS_CACHE" ] && return 1
+  jq -e --arg fp "$fingerprint" '
+    [.[]?.body // ""] | any(. | contains("multi-agent-finding: " + $fp))
+  ' <<<"$EXISTING_COMMENTS_CACHE" >/dev/null 2>&1
+}
+
+# Bitbucket Server activities endpoint returns nested comment trees. Flatten
+# them into the same `[{body: <text>}, ...]` shape that
+# comment_exists_with_fingerprint expects so the dedupe gate is provider-agnostic.
+load_existing_comments_bitbucket() {
+  local host="$1" project="$2" slug="$3" pr_num="$4" auth_user="$5" auth_token="$6"
+  if [ -z "$EXISTING_COMMENTS_CACHE" ]; then
+    local base="https://$host/rest/api/1.0/projects/$project/repos/$slug/pull-requests/$pr_num"
+    local raw
+    raw=$(curl -sS -m 30 -u "$auth_user:$auth_token" \
+      "$base/activities?fromType=COMMENT&limit=100" 2>/dev/null || echo "{}")
+    EXISTING_COMMENTS_CACHE=$(jq '
+      def collect_texts(c):
+        if c == null then []
+        else [c.text] + ([ (c.comments // [])[] | collect_texts(.) ] | add // [])
+        end;
+      [ .values[]?.comment | collect_texts(.)[] | {body: .} ]
+    ' <<<"$raw" 2>/dev/null || echo "[]")
+  fi
+}
+
+# --- Provider dispatchers ---------------------------------------------------
+
+post_github() {
+  local org_repo head_sha
+  org_repo=$(jq -r '.review.input.orgRepo' "$AGENT_STATE")
+  head_sha=$(jq -r '.review.headCommitSha // empty' "$AGENT_STATE")
+
+  # Fallback: head SHA may have been written to /tmp during diff fetch.
+  if [ -z "$head_sha" ] && [ -n "${TASK_ID:-}" ]; then
+    local sha_file="/tmp/multi-agent-review-${TASK_ID}-head.sha"
+    [ -f "$sha_file" ] && head_sha=$(tr -d '[:space:]' < "$sha_file")
+  fi
+
+  local rc_body
+  if [ "$OUT_LANG" = "tr" ]; then
+    rc_body="Lütfen yukarıdaki inline yorumlara bakın."
+  else
+    rc_body="See inline comments above."
+  fi
+
+  # Dedupe gate — read pref, default ON (Bugbot-style). Loads existing
+  # comments once if needed; per-finding check is in-process.
+  local DEDUPE_ENABLED
+  DEDUPE_ENABLED=$(jq -r '.global.review.dedupeInlineComments // true' \
+    "$HOME/.claude/multi-agent-preferences.json" 2>/dev/null || echo "true")
+  if [ "$DECISION" = "needs_work" ] && [ "$DEDUPE_ENABLED" = "true" ]; then
+    load_existing_comments_github "$org_repo" "$PR_NUM"
+  fi
+
+  if [ "$DECISION" = "needs_work" ]; then
+    jq -c '.review.findings[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
+    | while read -r finding; do
+        local sev path line issue_b64 fix_b64 rule_id_b64 issue fix rule_id body fingerprint
+        IFS=$'\t' read -r sev path line issue_b64 fix_b64 rule_id_b64 < <(
+          jq -r '[.severity, .file, (.line // 0),
+                  (.issue | @base64),
+                  ((.fix // "") | @base64),
+                  ((.ruleId // "") | @base64)] | @tsv' <<<"$finding"
+        )
+        issue=$(printf '%s' "$issue_b64" | base64 --decode 2>/dev/null)
+        fix=$(printf '%s' "$fix_b64" | base64 --decode 2>/dev/null)
+        rule_id=$(printf '%s' "$rule_id_b64" | base64 --decode 2>/dev/null)
+        fingerprint=$(finding_fingerprint "$path" "$line" "$issue")
+        body=$(render_inline_body "$sev" "$issue" "$fix" "$rule_id" "$fingerprint")
+
+        if [ "$DEDUPE_ENABLED" = "true" ] && comment_exists_with_fingerprint "$fingerprint"; then
+          echo "post-pr-review: dedupe skip — finding $fingerprint already commented" >&2
+          continue
+        fi
+
+        local inline_ok=0
+        if [ -n "$head_sha" ] && [ "$line" -gt 0 ] 2>/dev/null; then
+          if gh api -X POST "/repos/$org_repo/pulls/$PR_NUM/comments" \
+              -f "body=$body" -f "commit_id=$head_sha" -f "path=$path" \
+              -F "line=$line" -f "side=RIGHT" >/dev/null 2>&1; then
+            inline_ok=1
+          else
+            echo "post-pr-review: inline anchor failed for $path:$line (out of diff?), falling back to top-level" >&2
+          fi
+        fi
+        if [ "$inline_ok" -eq 0 ]; then
+          gh pr comment "$PR_NUM" --repo "$org_repo" --body "$body" >/dev/null \
+            || echo "post-pr-review: top-level comment failed for $path:$line" >&2
+        fi
+      done
+  fi
+
+  case "$DECISION" in
+    approve)    gh pr review "$PR_NUM" --repo "$org_repo" --approve ;;
+    needs_work) gh pr review "$PR_NUM" --repo "$org_repo" --request-changes --body "$rc_body" ;;
+  esac
+}
+
+post_bitbucket_server() {
+  local host project slug user_slug auth_user auth_token user_key token_key prefs
+  host=$(jq -r '.review.input.bbServerHost' "$AGENT_STATE")
+  project=$(jq -r '.review.input.bbProjectKey' "$AGENT_STATE")
+  slug=$(jq -r '.review.input.bbRepoSlug' "$AGENT_STATE")
+
+  # Resolve credential keys from prefs.keychainMapping — never hardcode.
+  prefs="$HOME/.claude/multi-agent-preferences.json"
+  user_key=$(jq -r '.keychainMapping.bitbucket_user // empty' "$prefs" 2>/dev/null || true)
+  token_key=$(jq -r '.keychainMapping.bitbucket_token // empty' "$prefs" 2>/dev/null || true)
+
+  if [ -z "$user_key" ] || [ -z "$token_key" ]; then
+    echo "post-pr-review: keychainMapping.bitbucket_user / .bitbucket_token unset in $prefs" >&2
+    return 4
+  fi
+
+  # Resolve via the cross-platform credential helper (macOS Keychain / Windows
+  # Credential Manager / Linux libsecret) — sourced lazily so this script keeps
+  # working when run from either ~/.claude/lib or ~/.copilot/lib.
+  # shellcheck disable=SC1090
+  . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
+    || . "$HOME/.copilot/lib/credential-store-resolver.sh" 2>/dev/null \
+    || { echo "post-pr-review: credential helper not found" >&2; return 4; }
+  resolve_credential_store || return 4
+
+  auth_user=$("$CRED_STORE" get "$user_key" 2>/dev/null || true)
+  auth_token=$("$CRED_STORE" get "$token_key" 2>/dev/null || true)
+  user_slug="$auth_user"
+
+  if [ -z "$auth_user" ] || [ -z "$auth_token" ]; then
+    echo "post-pr-review: bitbucket creds not in credential store ($user_key / $token_key)" >&2
+    return 4
+  fi
+
+  local base="https://$host/rest/api/1.0/projects/$project/repos/$slug/pull-requests/$PR_NUM"
+
+  # Dedupe gate — read pref, default ON. Bitbucket uses the activities feed.
+  local DEDUPE_ENABLED
+  DEDUPE_ENABLED=$(jq -r '.global.review.dedupeInlineComments // true' \
+    "$HOME/.claude/multi-agent-preferences.json" 2>/dev/null || echo "true")
+  if [ "$DECISION" = "needs_work" ] && [ "$DEDUPE_ENABLED" = "true" ]; then
+    load_existing_comments_bitbucket "$host" "$project" "$slug" "$PR_NUM" "$auth_user" "$auth_token"
+  fi
+
+  if [ "$DECISION" = "needs_work" ]; then
+    jq -c '.review.findings[] | select(.status == "accepted" and (.severity == "blocking" or .severity == "important"))' "$AGENT_STATE" \
+    | while read -r finding; do
+        local sev path line issue_b64 fix_b64 rule_id_b64 issue fix rule_id body payload http fingerprint
+        IFS=$'\t' read -r sev path line issue_b64 fix_b64 rule_id_b64 < <(
+          jq -r '[.severity, .file, (.line // 0),
+                  (.issue | @base64),
+                  ((.fix // "") | @base64),
+                  ((.ruleId // "") | @base64)] | @tsv' <<<"$finding"
+        )
+        issue=$(printf '%s' "$issue_b64" | base64 --decode 2>/dev/null)
+        fix=$(printf '%s' "$fix_b64" | base64 --decode 2>/dev/null)
+        rule_id=$(printf '%s' "$rule_id_b64" | base64 --decode 2>/dev/null)
+        fingerprint=$(finding_fingerprint "$path" "$line" "$issue")
+        body=$(render_inline_body "$sev" "$issue" "$fix" "$rule_id" "$fingerprint")
+
+        if [ "$DEDUPE_ENABLED" = "true" ] && comment_exists_with_fingerprint "$fingerprint"; then
+          echo "post-pr-review: dedupe skip — finding $fingerprint already commented (bitbucket)" >&2
+          continue
+        fi
+
+        local inline_ok=0
+        if [ "$line" -gt 0 ] 2>/dev/null; then
+          payload=$(jq -n --arg t "$body" --arg p "$path" --argjson l "$line" \
+            '{text: $t, anchor: {path: $p, line: $l, lineType: "ADDED", fileType: "TO"}}')
+          http=$(curl -sS -m 30 -u "$auth_user:$auth_token" -X POST \
+            -H "Content-Type: application/json" "$base/comments" \
+            -d "$payload" -o /dev/null -w '%{http_code}' || echo 000)
+          if [ "$http" = "200" ] || [ "$http" = "201" ]; then
+            inline_ok=1
+          else
+            echo "post-pr-review: bitbucket inline anchor failed ($http) for $path:$line, falling back to top-level" >&2
+          fi
+        fi
+
+        if [ "$inline_ok" -eq 0 ]; then
+          payload=$(jq -n --arg t "$body" '{text: $t}')
+          curl -sS -m 30 -u "$auth_user:$auth_token" -X POST \
+            -H "Content-Type: application/json" "$base/comments" \
+            -d "$payload" >/dev/null \
+            || echo "post-pr-review: bitbucket top-level comment failed for $path:$line" >&2
+        fi
+      done
+  fi
+
+  local status_payload
+  case "$DECISION" in
+    approve)    status_payload='{"status":"APPROVED"}' ;;
+    needs_work) status_payload='{"status":"NEEDS_WORK"}' ;;
+  esac
+
+  curl -sS -m 30 -u "$auth_user:$auth_token" -X PUT \
+    -H "Content-Type: application/json" "$base/participants/$user_slug" \
+    -d "$status_payload" >/dev/null
+}
+
+# --- Main switch ------------------------------------------------------------
+
+case "$PROVIDER" in
+  github)
+    post_github
+    ;;
+  bitbucket-server)
+    post_bitbucket_server
+    ;;
+  *)
+    echo "post-pr-review: unknown provider '$PROVIDER'; chat-only fallback (no PR action)" >&2
+    exit 3
+    ;;
+esac
+
+echo "post-pr-review: $DECISION posted to $PROVIDER PR #$PR_NUM"