@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/import-figma-skills.sh

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+# import-figma-skills.sh — import markdown content from an upstream figma
+# skill repository into pipeline/skills/figma-ios/ with placeholder transform
+# and directory rename.
+#
+# Markdown-only pass: SKILL.md, phases/*.md, reference/*.md. Scripts
+# (Python/shell) are intentionally skipped on this pass — they require
+# manual review for hardcoded paths beyond the placeholder map and land
+# in a follow-up (WS-2b).
+#
+# Idempotent: subsequent runs overwrite pipeline/skills/figma-ios/ cleanly.
+# The smoke `smoke-figma-skill-import.sh` + `smoke-personal-data.sh`
+# are the only gates on output quality.
+#
+# Usage:
+#   FIGMA_SOURCE=/path/to/source ./import-figma-skills.sh [--dry-run]
+#   ./import-figma-skills.sh --source /path/to/source [--dry-run]
+#
+#   --source PATH   Source project root (or env FIGMA_SOURCE). Required.
+#   --dry-run       Print planned operations, make no changes
+#   --target PATH   Import target (default: pipeline/skills/figma-ios)
+#   --verbose       Also print every file copy
+#
+# The source must expose .instructions/figma/ and .claude/skills/ — a
+# source repo in the figma-to-component family. Point it at whichever
+# upstream clone lives on disk; no default is baked in so this script
+# ships without any personal path.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+
+SOURCE="${FIGMA_SOURCE:-}"
+TARGET_IOS="$ROOT/pipeline/skills/figma-ios"
+TARGET_COMMON="$ROOT/pipeline/skills/figma-common"
+# Back-compat alias — some callers still pass --target. If set, overrides the
+# dual-target routing below; everything lands under that path.
+TARGET=""
+DRY_RUN="false"
+VERBOSE="false"
+MAP_FILE="$ROOT/pipeline/scripts/figma-placeholder-map.json"
+
+# Skills that are platform-specific (stay in figma-ios/). Anything NOT in this
+# list is platform-agnostic and routes to figma-common/.
+IOS_ONLY=(
+  figma-to-component
+  figma-component-implement
+  figma-component-test
+  figma-component-code-connect
+  figma-component-wiki
+)
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --source) SOURCE="$2"; shift 2 ;;
+    --target) TARGET="$2"; shift 2 ;;
+    --dry-run) DRY_RUN="true"; shift ;;
+    --verbose) VERBOSE="true"; shift ;;
+    *) echo "error: unknown arg '$1'" >&2; exit 1 ;;
+  esac
+done
+
+need() { command -v "$1" >/dev/null 2>&1 || { echo "error: $1 required" >&2; exit 127; }; }
+need jq
+need sed
+
+if [ -z "$SOURCE" ]; then
+  echo "error: no source supplied. Pass --source PATH or set FIGMA_SOURCE env var." >&2
+  exit 1
+fi
+[ -d "$SOURCE" ] || { echo "error: source not found: $SOURCE" >&2; exit 1; }
+[ -f "$MAP_FILE" ] || { echo "error: placeholder map not found: $MAP_FILE" >&2; exit 1; }
+
+INSTR_DIR="$SOURCE/.instructions/figma"
+STUB_DIR="$SOURCE/.claude/skills"
+[ -d "$INSTR_DIR" ] || { echo "error: source missing .instructions/figma: $INSTR_DIR" >&2; exit 1; }
+[ -d "$STUB_DIR" ] || { echo "error: source missing .claude/skills: $STUB_DIR" >&2; exit 1; }
+
+log() { echo "$@"; }
+vlog() { [ "$VERBOSE" = "true" ] && echo "     $*"; return 0; }
+
+# Build sed script from placeholder map. Sort rules by FROM length desc so
+# longest match wins (prevents half-substitution).
+SED_SCRIPT="$(mktemp -t figma-sed-XXXX.sed)"
+trap 'rm -f "$SED_SCRIPT"' EXIT
+
+jq -r '.rules | sort_by(.from | length) | reverse | .[] | "s|" + (.from | gsub("\\|"; "\\|")) + "|" + (.to | gsub("\\|"; "\\|")) + "|g"' \
+  "$MAP_FILE" > "$SED_SCRIPT"
+
+RULE_COUNT=$(wc -l < "$SED_SCRIPT" | tr -d ' ')
+log "→ loaded $RULE_COUNT substitution rules"
+
+# Apply directory renames from the rename table. Each upstream skill dir is
+# mapped (or kept as-is if absent). Returns the new dirname on stdout.
+rename_dir() {
+  local orig="$1"
+  local renamed
+  renamed=$(jq -r --arg o "$orig" '.renames[] | select(.from == $o) | .to' "$MAP_FILE")
+  if [ -n "$renamed" ]; then
+    echo "$renamed"
+  else
+    echo "$orig"
+  fi
+}
+
+plan_count=0
+copy_count=0
+
+if [ "$DRY_RUN" = "false" ]; then
+  mkdir -p "$TARGET_IOS" "$TARGET_COMMON"
+  [ -n "$TARGET" ] && mkdir -p "$TARGET"
+fi
+
+log "→ scanning source: $INSTR_DIR"
+
+for src_skill in "$INSTR_DIR"/*/; do
+  [ -d "$src_skill" ] || continue
+  orig_name=$(basename "$src_skill")
+
+  # Skip the README (it's not a skill) and tools dir
+  case "$orig_name" in
+    README.md|tools) continue ;;
+  esac
+
+  new_name=$(rename_dir "$orig_name")
+
+  # Decide destination tree based on IOS_ONLY list (unless --target override).
+  if [ -n "$TARGET" ]; then
+    dest_tree="$TARGET"
+  else
+    dest_tree="$TARGET_COMMON"
+    for ios in "${IOS_ONLY[@]}"; do
+      if [ "$new_name" = "$ios" ]; then
+        dest_tree="$TARGET_IOS"
+        break
+      fi
+    done
+  fi
+  dest_skill="$dest_tree/$new_name"
+
+  plan_count=$((plan_count+1))
+  if [ "$orig_name" != "$new_name" ]; then
+    log "  $orig_name → $new_name"
+  else
+    log "  $orig_name"
+  fi
+
+  if [ "$DRY_RUN" = "true" ]; then
+    continue
+  fi
+
+  # Skip if destination SKILL.md carries `local-overlay: true` in frontmatter.
+  # This protects v5.x locally-enhanced skills (e.g. figma-component-wiki's
+  # 4-adapter contract) from being flattened on every re-import.
+  if [ -f "$dest_skill/SKILL.md" ] && grep -q "^local-overlay: true" "$dest_skill/SKILL.md" 2>/dev/null; then
+    log "     (local-overlay — skipping)"
+    continue
+  fi
+
+  rm -rf "$dest_skill"
+  mkdir -p "$dest_skill"
+
+  # 1) Copy SKILL.md from .instructions (the real content). Prefer the
+  # instructions version; fall back to stub only if instructions missing.
+  if [ -f "$src_skill/SKILL.md" ]; then
+    sed -f "$SED_SCRIPT" "$src_skill/SKILL.md" > "$dest_skill/SKILL.md"
+    copy_count=$((copy_count+1))
+    vlog "copied SKILL.md"
+  elif [ -f "$STUB_DIR/$orig_name/SKILL.md" ]; then
+    # Stub-only skill; transform the stub body.
+    sed -f "$SED_SCRIPT" "$STUB_DIR/$orig_name/SKILL.md" > "$dest_skill/SKILL.md"
+    copy_count=$((copy_count+1))
+    vlog "copied stub SKILL.md (no .instructions entry)"
+  else
+    log "     ⚠ no SKILL.md for $orig_name, skipping"
+    continue
+  fi
+
+  # 2) Copy markdown files from phases/, reference/ subdirs — recursively.
+  for sub in phases reference; do
+    if [ -d "$src_skill/$sub" ]; then
+      mkdir -p "$dest_skill/$sub"
+      while IFS= read -r -d '' mdfile; do
+        rel="${mdfile#$src_skill/}"
+        mkdir -p "$dest_skill/$(dirname "$rel")"
+        sed -f "$SED_SCRIPT" "$mdfile" > "$dest_skill/$rel"
+        copy_count=$((copy_count+1))
+        vlog "copied $rel"
+      done < <(find "$src_skill/$sub" -type f -name '*.md' -print0)
+    fi
+  done
+
+  # 2b) Copy Python + shell scripts from scripts/ subdir — recursively (WS-2b).
+  # Placeholder transform still applies. Shebangs and executable bits preserved.
+  if [ -d "$src_skill/scripts" ]; then
+    mkdir -p "$dest_skill/scripts"
+    while IFS= read -r -d '' sfile; do
+      rel="${sfile#$src_skill/}"
+      mkdir -p "$dest_skill/$(dirname "$rel")"
+      sed -f "$SED_SCRIPT" "$sfile" > "$dest_skill/$rel"
+      # preserve executable bit on shell + python entry scripts
+      case "$sfile" in
+        *.sh|*.py) chmod +x "$dest_skill/$rel" 2>/dev/null || true ;;
+      esac
+      copy_count=$((copy_count+1))
+      vlog "copied $rel"
+    done < <(find "$src_skill/scripts" -type f -print0)
+  fi
+
+  # 3) Also copy any top-level .md files beside SKILL.md (halt-return-protocol.md etc.)
+  while IFS= read -r -d '' mdfile; do
+    base=$(basename "$mdfile")
+    [ "$base" = "SKILL.md" ] && continue
+    sed -f "$SED_SCRIPT" "$mdfile" > "$dest_skill/$base"
+    copy_count=$((copy_count+1))
+    vlog "copied $base"
+  done < <(find "$src_skill" -maxdepth 1 -type f -name '*.md' -print0)
+
+  # 4) Stamp frontmatter with v5-wip flag + source provenance.
+  # If SKILL.md has frontmatter, insert `status: wip-v5` and `sourced-from: <name>`.
+  if head -n 1 "$dest_skill/SKILL.md" | grep -Fxq -- "---"; then
+    python3 - "$dest_skill/SKILL.md" "$orig_name" <<'PY'
+import sys, re
+path, orig = sys.argv[1], sys.argv[2]
+src = open(path).read()
+m = re.match(r'^(---\n)([\s\S]*?)(\n---\n)', src)
+if not m:
+    sys.exit(0)
+pre, body, post = m.groups()
+if 'status:' not in body:
+    body += "\nstatus: wip-v5"
+if 'sourced-from:' not in body:
+    body += f"\nsourced-from: upstream/{orig}"
+new = pre + body + post + src[m.end():]
+open(path, 'w').write(new)
+PY
+    vlog "stamped frontmatter (status: wip-v5)"
+  fi
+done
+
+log "→ planned:  $plan_count skills"
+if [ "$DRY_RUN" = "true" ]; then
+  log "→ DRY RUN — no files written"
+  exit 0
+fi
+log "→ copied:   $copy_count files (markdown + scripts)"
+if [ -n "$TARGET" ]; then
+  log "→ target:   $TARGET (override)"
+else
+  log "→ iOS:      $TARGET_IOS (5 platform-specific)"
+  log "→ common:   $TARGET_COMMON (27 platform-agnostic)"
+fi

package/pipeline/scripts/keychain-save.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+
+set -uo pipefail
+
+# Kullanım: ./keychain-save.sh <service-adı>
+# Örnek:    ./keychain-save.sh github-pat
+#           ./keychain-save.sh firebase-sa
+
+SERVICE_NAME="$1"
+
+if [ -z "$SERVICE_NAME" ]; then
+    echo "Kullanım: $0 <service-adı>"
+    echo "Örnek:    $0 github-pat"
+    exit 1
+fi
+
+echo "Ne tür bir secret kaydedeceksin?"
+echo "  1) Personal Access Token / API Key"
+echo "  2) JSON dosyası (service account vb.)"
+read -p "Seçim (1/2): " CHOICE
+
+case "$CHOICE" in
+    1)
+        read -sp "Token'ı yapıştır (gizli yazılır): " SECRET
+        echo ""
+        if [ -z "$SECRET" ]; then
+            echo "Hata: Token boş olamaz."
+            exit 1
+        fi
+        ;;
+    2)
+        read -p "JSON dosya yolunu gir: " JSON_PATH
+        # Kullanıcının girdiği tırnak işaretlerini temizle
+        JSON_PATH="${JSON_PATH//\'/}"
+        JSON_PATH="${JSON_PATH//\"/}"
+        # Tilde (~) expand
+        JSON_PATH="${JSON_PATH/#\~/$HOME}"
+        if [ ! -f "$JSON_PATH" ]; then
+            echo "Hata: Dosya bulunamadı: $JSON_PATH"
+            exit 1
+        fi
+        # JSON'ı tek satıra sıkıştırıp base64'le
+        SECRET=$(base64 < "$JSON_PATH")
+        if [ -z "$SECRET" ]; then
+            echo "Hata: Dosya okunamadı."
+            exit 1
+        fi
+        echo "JSON base64 olarak encode edildi."
+        ;;
+    *)
+        echo "Geçersiz seçim."
+        exit 1
+        ;;
+esac
+
+CRED="$HOME/.claude/lib/credential-store.sh"
+
+"$CRED" delete "$SERVICE_NAME" >/dev/null 2>&1 || true
+"$CRED" set "$SERVICE_NAME" "$SECRET"
+
+if [ $? -eq 0 ]; then
+    echo "Kaydedildi: $SERVICE_NAME (platform: $("$CRED" platform))"
+    echo ""
+    echo "Okumak icin:"
+    echo "  ~/.claude/lib/credential-store.sh get \"$SERVICE_NAME\""
+    if [ "$CHOICE" = "2" ]; then
+        echo ""
+        echo "JSON'a geri cevirmek icin:"
+        echo "  ~/.claude/lib/credential-store.sh get \"$SERVICE_NAME\" | base64 -d"
+    fi
+else
+    echo "Hata: Kaydedilemedi."
+    exit 1
+fi

package/pipeline/scripts/keychain.py

@@ -0,0 +1,294 @@
+#!/usr/bin/env python3
+"""
+keychain.py — deterministic Keychain helper, Python counterpart to credential-store.sh.
+
+Purpose
+-------
+The pipeline reads Keychain tokens from many places (Phase 0 setup, Phase 1
+Jira fetch, Phase 6 push retry, channels, ...). Shell `security` calls work
+fine but make error handling and structured output painful. This module is
+the single deterministic Python entry point for those operations.
+
+API
+---
+get(label, account=None) -> str | None
+    Read a generic-password item by label. Returns None if missing.
+
+set(label, value, account=None) -> None
+    Store / overwrite a generic-password item.
+
+delete(label, account=None) -> bool
+    Remove the item. Returns True if deleted, False if it did not exist.
+
+list_labels(filter_substring=None) -> list[str]
+    Return Keychain item labels matching the optional substring filter.
+    Used by setup discovery.
+
+doctor() -> dict
+    Probe backend availability. Returns
+    {"platform": "macos|linux|unknown", "backend_ok": bool, "remediation": str|None}
+
+CLI
+---
+    python3 keychain.py get <label> [--account USER]
+    python3 keychain.py set <label> <value> [--account USER]
+    python3 keychain.py delete <label> [--account USER]
+    python3 keychain.py list [--match SUBSTRING]
+    python3 keychain.py doctor
+
+Exit codes
+----------
+0  success
+1  item missing (get) / does not exist (delete)
+2  backend unavailable (no `security` on macOS, no `secret-tool` on Linux)
+3  usage error
+4  unexpected backend error (stderr captured to stdout for diagnostics)
+
+Behaviour
+---------
+- macOS: shells out to /usr/bin/security, parsing structured output.
+- Linux: shells out to secret-tool (libsecret).
+- Windows / unknown platforms: backend unavailable; `doctor` prints remediation.
+- Never logs the secret value. `set` accepts the value via argv (CLI) or via
+  stdin when the value is exactly `-` (preferred for scripts to avoid shell
+  history leak).
+- get returns the raw value to stdout with no trailing newline manipulation
+  beyond stripping the OS-level final \\n that `security -w` appends.
+
+This file has no external dependencies. Python 3.10+ stdlib only.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import platform
+import shutil
+import subprocess
+import sys
+from typing import Optional
+
+
+def _platform() -> str:
+    s = platform.system()
+    if s == "Darwin":
+        return "macos"
+    if s == "Linux":
+        return "linux"
+    return "unknown"
+
+
+def _account_default(explicit: Optional[str] = None) -> str:
+    return explicit or os.environ.get("USER") or os.environ.get("LOGNAME") or "user"
+
+
+def _run(argv: list[str], input_value: Optional[bytes] = None) -> tuple[int, bytes, bytes]:
+    """Run a subprocess; return (rc, stdout_bytes, stderr_bytes). Never raises on non-zero."""
+    proc = subprocess.run(
+        argv,
+        input=input_value,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=False,
+    )
+    return proc.returncode, proc.stdout, proc.stderr
+
+
+def doctor() -> dict:
+    pf = _platform()
+    if pf == "macos":
+        ok = shutil.which("security") is not None
+        return {
+            "platform": pf,
+            "backend_ok": ok,
+            "remediation": None if ok else "macOS Keychain CLI missing — /usr/bin/security should ship with macOS; reinstall Command Line Tools.",
+        }
+    if pf == "linux":
+        ok = shutil.which("secret-tool") is not None
+        return {
+            "platform": pf,
+            "backend_ok": ok,
+            "remediation": None if ok else "Install libsecret-tools: `sudo apt install libsecret-tools` or `sudo dnf install libsecret`.",
+        }
+    return {
+        "platform": pf,
+        "backend_ok": False,
+        "remediation": "Unsupported platform; the pipeline only ships Keychain support for macOS and libsecret for Linux. Use environment variables on Windows.",
+    }
+
+
+def _ensure_backend() -> str:
+    info = doctor()
+    if not info["backend_ok"]:
+        sys.stderr.write(f"keychain: backend unavailable on {info['platform']}\n")
+        if info["remediation"]:
+            sys.stderr.write(f"keychain: {info['remediation']}\n")
+        sys.exit(2)
+    return info["platform"]
+
+
+def get(label: str, account: Optional[str] = None) -> Optional[str]:
+    """Lookup by label first, then by service name. Two coexisting conventions:
+    - User's manually-added tokens (e.g. mmerterden_Vercel_Access_Token) use -l (label).
+    - credential-store.sh-managed items use -s (service).
+    The helper finds either."""
+    pf = _ensure_backend()
+    acct = _account_default(account)
+    if pf == "macos":
+        rc, out, _ = _run(["/usr/bin/security", "find-generic-password", "-a", acct, "-l", label, "-w"])
+        if rc == 0:
+            return out.decode("utf-8", errors="replace").rstrip("\n")
+        rc, out, _ = _run(["/usr/bin/security", "find-generic-password", "-a", acct, "-s", label, "-w"])
+        if rc == 0:
+            return out.decode("utf-8", errors="replace").rstrip("\n")
+        # account-agnostic last resort — some entries were written without -a
+        rc, out, _ = _run(["/usr/bin/security", "find-generic-password", "-l", label, "-w"])
+        if rc == 0:
+            return out.decode("utf-8", errors="replace").rstrip("\n")
+        rc, out, _ = _run(["/usr/bin/security", "find-generic-password", "-s", label, "-w"])
+        if rc == 0:
+            return out.decode("utf-8", errors="replace").rstrip("\n")
+        return None
+    # linux / secret-tool — store under both `label` and `service` schema attrs
+    rc, out, _ = _run(["secret-tool", "lookup", "label", label, "account", acct])
+    if rc == 0:
+        return out.decode("utf-8", errors="replace").rstrip("\n")
+    rc, out, _ = _run(["secret-tool", "lookup", "service", label])
+    if rc == 0:
+        return out.decode("utf-8", errors="replace").rstrip("\n")
+    return None
+
+
+def set_(label: str, value: str, account: Optional[str] = None) -> None:
+    """Write the entry with both -l (label) and -s (service) set to the same id, so
+    both lookup conventions succeed. -U overwrites if the item already exists."""
+    pf = _ensure_backend()
+    acct = _account_default(account)
+    if pf == "macos":
+        rc, _, err = _run(
+            [
+                "/usr/bin/security",
+                "add-generic-password",
+                "-a", acct,
+                "-l", label,
+                "-s", label,
+                "-w", value,
+                "-U",
+            ]
+        )
+        if rc != 0:
+            sys.stderr.write(err.decode("utf-8", errors="replace"))
+            sys.exit(4)
+        return
+    # linux / secret-tool — store reads the secret from stdin; tag both schema attrs
+    rc, _, err = _run(
+        ["secret-tool", "store", "--label", label, "label", label, "service", label, "account", acct],
+        input_value=value.encode("utf-8"),
+    )
+    if rc != 0:
+        sys.stderr.write(err.decode("utf-8", errors="replace"))
+        sys.exit(4)
+
+
+def delete(label: str, account: Optional[str] = None) -> bool:
+    """Delete by either convention. Returns True if any matching item was removed."""
+    pf = _ensure_backend()
+    acct = _account_default(account)
+    if pf == "macos":
+        deleted = False
+        for flag in ("-l", "-s"):
+            while True:
+                rc, _, _ = _run(["/usr/bin/security", "delete-generic-password", "-a", acct, flag, label])
+                if rc != 0:
+                    break
+                deleted = True
+        for flag in ("-l", "-s"):
+            while True:
+                rc, _, _ = _run(["/usr/bin/security", "delete-generic-password", flag, label])
+                if rc != 0:
+                    break
+                deleted = True
+        return deleted
+    deleted = False
+    rc, _, _ = _run(["secret-tool", "clear", "label", label, "account", acct])
+    if rc == 0:
+        deleted = True
+    rc, _, _ = _run(["secret-tool", "clear", "service", label])
+    if rc == 0:
+        deleted = True
+    return deleted
+
+
+def list_labels(filter_substring: Optional[str] = None) -> list[str]:
+    pf = _ensure_backend()
+    if pf != "macos":
+        # secret-tool has no native list; we can't enumerate all entries portably.
+        return []
+    # `security dump-keychain` prints every item; we extract the 0x00000007 (label) attr.
+    rc, out, _ = _run(["/usr/bin/security", "dump-keychain"])
+    if rc != 0:
+        return []
+    labels: list[str] = []
+    for raw in out.decode("utf-8", errors="replace").splitlines():
+        line = raw.strip()
+        # The label appears as: 0x00000007 <blob>="some label here"
+        if "0x00000007" in line and '="' in line:
+            value = line.split('="', 1)[1].rstrip('"')
+            labels.append(value)
+    if filter_substring:
+        needle = filter_substring.lower()
+        labels = [l for l in labels if needle in l.lower()]
+    # Stable, dedupe, alphabetical.
+    return sorted(set(labels))
+
+
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(prog="keychain.py", description=__doc__.split("\n", 1)[0])
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    g = sub.add_parser("get")
+    g.add_argument("label")
+    g.add_argument("--account")
+
+    s = sub.add_parser("set")
+    s.add_argument("label")
+    s.add_argument("value", help="Use '-' to read from stdin (preferred — keeps secrets out of shell history).")
+    s.add_argument("--account")
+
+    d = sub.add_parser("delete")
+    d.add_argument("label")
+    d.add_argument("--account")
+
+    l = sub.add_parser("list")
+    l.add_argument("--match")
+
+    sub.add_parser("doctor")
+
+    ns = parser.parse_args(argv)
+
+    if ns.cmd == "get":
+        v = get(ns.label, ns.account)
+        if v is None:
+            return 1
+        sys.stdout.write(v)
+        return 0
+    if ns.cmd == "set":
+        value = sys.stdin.read() if ns.value == "-" else ns.value
+        set_(ns.label, value, ns.account)
+        return 0
+    if ns.cmd == "delete":
+        return 0 if delete(ns.label, ns.account) else 1
+    if ns.cmd == "list":
+        for label in list_labels(ns.match):
+            print(label)
+        return 0
+    if ns.cmd == "doctor":
+        info = doctor()
+        print(json.dumps(info, indent=2))
+        return 0 if info["backend_ok"] else 2
+    return 3
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))