@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/scan-skills.sh

@@ -0,0 +1,332 @@
+#!/usr/bin/env bash
+# scan-skills.sh — skill security scanner (v5.1.0)
+#
+# Scans skill directories (pipeline/skills/ OR ~/.claude/skills/ OR ~/.copilot/skills/)
+# for known-bad patterns. Multi-tier severity:
+#   critical: shell-pipe exec, eval with curl, unicode bidi override, known malicious hosts
+#   high:     eval/new Function/exec on dynamic content, hardcoded API credentials,
+#             pastebin/gist raw URLs, chmod+exec sequences
+#   medium:   long base64 blobs (>200 chars), unknown network endpoints
+#   low:      missing frontmatter, skills without description
+#
+# Defaults to WARN-ONLY (always exits 0 so install.js never halts from a scan).
+# Use --strict to let severity drive exit code (for CI).
+#
+# Usage:
+#   scan-skills.sh [--root PATH] [--strict] [--json] [--threshold SEV] [--help]
+#
+# Flags:
+#   --root PATH       Root to scan. Default: pipeline/skills/ inside the pipeline repo.
+#   --strict          Non-zero exit on findings at/above threshold (default: warn-only, always exit 0).
+#   --json            Emit JSON instead of text report.
+#   --threshold SEV   Minimum severity to report: critical|high|medium|low. Default: medium.
+#   --help            Show this help.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+ROOT="$REPO_ROOT/pipeline/skills"
+STRICT=0
+JSON=0
+THRESHOLD="medium"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --root) ROOT="$2"; shift 2 ;;
+    --strict) STRICT=1; shift ;;
+    --json) JSON=1; shift ;;
+    --threshold) THRESHOLD="$2"; shift 2 ;;
+    --help|-h)
+      sed -n '1,30p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *) echo "unknown flag: $1" >&2; exit 64 ;;
+  esac
+done
+
+if [ ! -d "$ROOT" ]; then
+  echo "scan-skills: root not found: $ROOT" >&2
+  exit 64
+fi
+
+# Severity rank — lower = more severe. Used for threshold comparison.
+sev_rank() {
+  case "$1" in
+    critical) echo 0 ;;
+    high)     echo 1 ;;
+    medium)   echo 2 ;;
+    low)      echo 3 ;;
+    *)        echo 9 ;;
+  esac
+}
+THRESHOLD_RANK=$(sev_rank "$THRESHOLD")
+
+# Network endpoint allow-list — domains we expect to see in skills.
+# Anything else flagged as medium (unknown endpoint).
+ALLOW_DOMAINS='(github\.com|raw\.githubusercontent\.com|api\.github\.com|codeload\.github\.com|githubusercontent\.com|anthropic\.com|claude\.ai|api\.anthropic\.com|api\.figma\.com|figma\.com|jira\.example\.com|confluence\.example\.com|bitbucket\.example\.com|example\.com|mmerterden\.vercel\.app|localhost|127\.0\.0\.1|npmjs\.org|npmjs\.com|registry\.npmjs\.org|vercel\.com|api\.vercel\.com|pkg\.github\.com|googleapis\.com|firebase\.google\.com|apple\.com|developer\.apple\.com|google\.com|atlassian\.com|atlassian\.net|openai\.com|api\.openai\.com)'
+
+FINDINGS=()
+CRIT=0; HIGH=0; MED=0; LOW=0
+
+add_finding() {
+  local sev="$1" file="$2" line="$3" pattern="$4" message="$5"
+  local rank
+  rank=$(sev_rank "$sev")
+  [ "$rank" -gt "$THRESHOLD_RANK" ] && return 0
+  case "$sev" in
+    critical) CRIT=$((CRIT+1)) ;;
+    high)     HIGH=$((HIGH+1)) ;;
+    medium)   MED=$((MED+1)) ;;
+    low)      LOW=$((LOW+1)) ;;
+  esac
+  # pipe-delimit for compact transport between shell and reporters
+  FINDINGS+=("$sev|$file|$line|$pattern|$message")
+}
+
+# --- Pattern scanning ---------------------------------------------------
+
+# Files to consider: *.md, *.sh, *.py, *.mjs, *.js, *.ts (skill content)
+# Exclude: binary, images, large fixtures, hidden
+SCAN_LIST=$(mktemp)
+trap 'rm -f "$SCAN_LIST"' EXIT
+
+find "$ROOT" -type f \
+  \( -name "*.md" -o -name "*.sh" -o -name "*.py" -o -name "*.mjs" -o -name "*.js" -o -name "*.ts" \) \
+  -not -path "*/node_modules/*" \
+  -not -path "*/.git/*" \
+  2>/dev/null > "$SCAN_LIST"
+
+scan_critical() {
+  local f="$1"
+  # curl|wget piping to shell
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    local ln="${hit%%:*}"
+    add_finding critical "$f" "$ln" "shell-pipe-exec" "curl/wget piped to shell interpreter"
+  done < <(grep -nE '(curl|wget)[^|]*\|[[:space:]]*(sh|bash|zsh|ksh|ash|dash)([[:space:]]|$)' "$f" 2>/dev/null)
+
+  # base64 -d | shell
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    local ln="${hit%%:*}"
+    add_finding critical "$f" "$ln" "base64-pipe-exec" "base64 decoded output piped to shell"
+  done < <(grep -nE '(base64|openssl[[:space:]]+base64)[^|]*-d[^|]*\|[[:space:]]*(sh|bash|zsh|eval|sudo)' "$f" 2>/dev/null)
+
+  # eval $(curl|wget ...) or eval `curl ...`
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    local ln="${hit%%:*}"
+    add_finding critical "$f" "$ln" "eval-of-network" "eval of network-fetched content"
+  done < <(grep -nE 'eval[[:space:]]+(\$\([[:space:]]*(curl|wget|fetch)|`[[:space:]]*(curl|wget|fetch))' "$f" 2>/dev/null)
+
+  # Unicode bidi override characters — invisible injection attack
+  if LC_ALL=C grep -l $'\xe2\x80\xad\|\xe2\x80\xae\|\xe2\x81\xa6\|\xe2\x81\xa7\|\xe2\x81\xa8\|\xe2\x81\xa9' "$f" 2>/dev/null >/dev/null; then
+    add_finding critical "$f" "0" "unicode-bidi" "bidirectional control chars (U+202D-202E, U+2066-2069) — trojan source risk"
+  fi
+}
+
+scan_high() {
+  local f="$1"
+  local ext="${f##*.}"
+
+  # JavaScript/TypeScript: eval(, new Function(, Function(
+  if [ "$ext" = "js" ] || [ "$ext" = "mjs" ] || [ "$ext" = "ts" ]; then
+    while IFS= read -r hit; do
+      [ -z "$hit" ] && continue
+      local ln="${hit%%:*}"
+      add_finding high "$f" "$ln" "js-dynamic-eval" "JavaScript dynamic code execution"
+    done < <(grep -nE '\b(eval|new[[:space:]]+Function|Function)\s*\(' "$f" 2>/dev/null)
+  fi
+
+  # Python: exec(, eval( on non-literal — exclude re.compile (regex) and subprocess
+  if [ "$ext" = "py" ]; then
+    while IFS= read -r hit; do
+      [ -z "$hit" ] && continue
+      local ln="${hit%%:*}"
+      local content="${hit#*:}"
+      # Skip re.compile (standard regex) and subprocess.* (legitimate process invocation)
+      echo "$content" | grep -qE '(\bre\.compile|\bre2\.compile|subprocess\.|typing\.)' && continue
+      add_finding high "$f" "$ln" "py-dynamic-exec" "Python dynamic code execution"
+    done < <(grep -nE '(^|[^a-zA-Z0-9_.])(exec|eval)[[:space:]]*\(' "$f" 2>/dev/null)
+  fi
+
+  # Hardcoded API keys — AWS, OpenAI, GitHub, generic sk-* with length
+  # Skip lines in FORBIDDEN/NEVER/example blocks (false positives from docs)
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    local ln="${hit%%:*}"
+    # Check ±3 lines around match for documentation context markers
+    local ctx_start=$((ln - 3))
+    [ "$ctx_start" -lt 1 ] && ctx_start=1
+    local ctx_end=$((ln + 3))
+    local ctx
+    ctx=$(sed -n "${ctx_start},${ctx_end}p" "$f" 2>/dev/null)
+    if echo "$ctx" | grep -qiE '(FORBIDDEN|NEVER do|don.t do|example:|placeholder|sample credential|DO NOT|✗|XXX|YYY|dummy|fake.?key)'; then
+      continue
+    fi
+    add_finding high "$f" "$ln" "hardcoded-credential" "possible hardcoded API credential"
+  done < <(grep -nE '(AKIA[0-9A-Z]{16}|sk-(live|test|proj|ant|or)-[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{82}|gho_[A-Za-z0-9]{36}|xox[bp]-[A-Za-z0-9-]{10,})' "$f" 2>/dev/null)
+
+  # Pastebin / URL shortener raw content fetching
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    local ln="${hit%%:*}"
+    add_finding high "$f" "$ln" "pastebin-fetch" "fetch from ephemeral/obscured content host"
+  done < <(grep -nE 'https?://(pastebin\.com/raw|paste\.ee|ghostbin|hastebin|bit\.ly|tinyurl\.com|goo\.gl|t\.co|is\.gd|ow\.ly|rebrand\.ly|gist\.github\.com/[^/]+/[a-f0-9]+/raw)' "$f" 2>/dev/null)
+
+  # chmod +x followed by execution on same file in same block
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    local ln="${hit%%:*}"
+    add_finding high "$f" "$ln" "chmod-then-exec" "script made executable and immediately invoked"
+  done < <(grep -nE 'chmod[[:space:]]+\+x[[:space:]]+[^&;]+[[:space:]]*(&&|;)[[:space:]]*\./' "$f" 2>/dev/null)
+}
+
+scan_medium() {
+  local f="$1"
+
+  # Long base64 blobs — obfuscation indicator.
+  # Skip .md files (documentation often shows example b64) — only scan executable content types.
+  case "$f" in
+    *.md) ;;
+    *)
+      while IFS= read -r hit; do
+        [ -z "$hit" ] && continue
+        local ln="${hit%%:*}"
+        add_finding medium "$f" "$ln" "long-base64" "base64-looking blob >200 chars (possible obfuscation)"
+      done < <(grep -nE '[A-Za-z0-9+/]{200,}={0,2}' "$f" 2>/dev/null)
+      ;;
+  esac
+}
+
+scan_info() {
+  local f="$1"
+
+  # Unknown network endpoints — LOW severity (informational). URLs in skills
+  # are usually doc references, not exfil channels. Only the critical
+  # shell-pipe-exec patterns detect active network abuse.
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    local ln="${hit%%:*}"
+    local url_line="${hit#*:}"
+    local url
+    url=$(echo "$url_line" | grep -oE 'https?://[a-zA-Z0-9._-]+' | head -1)
+    [ -z "$url" ] && continue
+    local host="${url#*://}"
+    host="${host%%/*}"
+    if ! echo "$host" | grep -qE "^${ALLOW_DOMAINS}$" 2>/dev/null; then
+      add_finding low "$f" "$ln" "unknown-endpoint" "network endpoint not in allow-list: $host"
+    fi
+  done < <(grep -nE 'https?://[a-zA-Z0-9._-]+' "$f" 2>/dev/null | head -20)
+}
+
+scan_low() {
+  local f="$1"
+  # Missing SKILL.md frontmatter (only check files named SKILL.md)
+  case "$f" in
+    */SKILL.md)
+      if ! head -1 "$f" | grep -Fxq -- "---"; then
+        add_finding low "$f" "1" "missing-frontmatter" "SKILL.md without YAML frontmatter"
+      elif ! grep -qE '^description:' "$f"; then
+        add_finding low "$f" "0" "missing-description" "SKILL.md frontmatter missing 'description'"
+      fi
+      ;;
+  esac
+}
+
+# --- Run scan -----------------------------------------------------------
+
+FILE_COUNT=0
+while IFS= read -r file; do
+  [ -z "$file" ] && continue
+  FILE_COUNT=$((FILE_COUNT+1))
+  scan_critical "$file"
+  scan_high "$file"
+  scan_medium "$file"
+  scan_info "$file"
+  scan_low "$file"
+done < "$SCAN_LIST"
+
+# --- Report -------------------------------------------------------------
+
+if [ "$JSON" -eq 1 ]; then
+  printf '{\n'
+  printf '  "root": %s,\n' "$(printf '%s' "$ROOT" | sed 's/"/\\"/g; s/.*/"&"/')"
+  printf '  "scanned_files": %d,\n' "$FILE_COUNT"
+  printf '  "threshold": "%s",\n' "$THRESHOLD"
+  printf '  "strict": %s,\n' "$( [ "$STRICT" -eq 1 ] && echo true || echo false )"
+  printf '  "counts": { "critical": %d, "high": %d, "medium": %d, "low": %d },\n' "$CRIT" "$HIGH" "$MED" "$LOW"
+  printf '  "findings": [\n'
+  local_i=0
+  total=${#FINDINGS[@]}
+  for f in "${FINDINGS[@]:-}"; do
+    local_i=$((local_i+1))
+    sev="${f%%|*}"; rest="${f#*|}"
+    file="${rest%%|*}"; rest="${rest#*|}"
+    line="${rest%%|*}"; rest="${rest#*|}"
+    pat="${rest%%|*}"; msg="${rest#*|}"
+    # json-escape file/msg minimally
+    jf=$(printf '%s' "$file" | sed 's/"/\\"/g')
+    jm=$(printf '%s' "$msg" | sed 's/"/\\"/g')
+    printf '    { "severity": "%s", "file": "%s", "line": "%s", "pattern": "%s", "message": "%s" }' \
+      "$sev" "$jf" "$line" "$pat" "$jm"
+    [ "$local_i" -lt "$total" ] && printf ','
+    printf '\n'
+  done
+  printf '  ]\n}\n'
+else
+  # Colored text report
+  if [ -t 1 ] && command -v tput >/dev/null 2>&1; then
+    C_RED=$(tput setaf 1)
+    C_YEL=$(tput setaf 3)
+    C_CYN=$(tput setaf 6)
+    C_DIM=$(tput dim)
+    C_RST=$(tput sgr0)
+    C_BLD=$(tput bold)
+  else
+    C_RED=""; C_YEL=""; C_CYN=""; C_DIM=""; C_RST=""; C_BLD=""
+  fi
+
+  total=${#FINDINGS[@]}
+  printf '%sscan-skills%s · %d files · threshold=%s%s%s\n' "$C_BLD" "$C_RST" "$FILE_COUNT" "$C_CYN" "$THRESHOLD" "$C_RST"
+  if [ "$total" -eq 0 ]; then
+    printf '  ✓ clean (0 findings)\n'
+  else
+    printf '  %sfound %d%s: critical=%d high=%d medium=%d low=%d\n\n' "$C_BLD" "$total" "$C_RST" "$CRIT" "$HIGH" "$MED" "$LOW"
+    for f in "${FINDINGS[@]:-}"; do
+      sev="${f%%|*}"; rest="${f#*|}"
+      file="${rest%%|*}"; rest="${rest#*|}"
+      line="${rest%%|*}"; rest="${rest#*|}"
+      pat="${rest%%|*}"; msg="${rest#*|}"
+      case "$sev" in
+        critical) ico="🚨"; col="$C_RED" ;;
+        high)     ico="⚠ "; col="$C_RED" ;;
+        medium)   ico="ⓘ "; col="$C_YEL" ;;
+        low)      ico="· "; col="$C_DIM" ;;
+        *)        ico="? "; col="" ;;
+      esac
+      rel="${file#$REPO_ROOT/}"
+      printf '  %s%s%s %-8s %s:%s  [%s]\n' "$col" "$ico" "$C_RST" "$sev" "$rel" "$line" "$pat"
+      printf '     %s%s%s\n' "$C_DIM" "$msg" "$C_RST"
+    done
+  fi
+
+  if [ "$STRICT" -eq 0 ]; then
+    printf '\n  %s(warn-only mode — exit 0 regardless of findings; use --strict to halt on findings)%s\n' "$C_DIM" "$C_RST"
+  fi
+fi
+
+# --- Exit code ----------------------------------------------------------
+
+if [ "$STRICT" -eq 0 ]; then
+  exit 0
+fi
+
+# Strict: exit code maps to highest severity found at/above threshold
+[ "$CRIT" -gt 0 ] && exit 1
+[ "$HIGH" -gt 0 ] && exit 2
+[ "$MED"  -gt 0 ] && exit 3
+[ "$LOW"  -gt 0 ] && exit 4
+exit 0

package/pipeline/scripts/search-logs.sh

@@ -0,0 +1,291 @@
+#!/usr/bin/env bash
+# search-logs.sh — cross-project search across multi-agent agent-log.md files.
+#
+# Greps ~/.claude/logs/multi-agent/**/agent-log.md (or --root PATH) for a query,
+# groups results by task, and ranks by (match_count × recency_weight).
+#
+# Prefers ripgrep (rg) for speed + sane defaults; falls back to GNU grep -rE.
+#
+# Usage:
+#   search-logs.sh "query" [flags]
+#
+# Flags:
+#   --root PATH           Override log root. Default: $HOME/.claude/logs/multi-agent
+#   --project NAME        Filter to tasks under this project dir
+#   --since SPEC          7d | 30d | 2026-04-01 — drop tasks older than this
+#   --phase N             Only match inside "## Phase N" sections
+#   --semantic            v8.3+: query the per-repo triage corpus instead of
+#                         agent-log.md grep. Returns past triage findings
+#                         ranked by token overlap (token-based recall, no LLM).
+#                         Honors --project as the repo-slug; --since/--phase ignored.
+#   --json                JSON output (for automation)
+#   --tsv                 Tab-separated output (for pipelines)
+#   --limit N             Max tasks to return (default 20)
+#   --help                Show this help
+#
+# Exit codes:
+#   0   at least one match
+#   1   no matches
+#   64  bad arguments
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+ROOT="$HOME/.claude/logs/multi-agent"
+PROJECT=""
+SINCE=""
+PHASE=""
+JSON=0
+TSV=0
+LIMIT=20
+QUERY=""
+SEMANTIC=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --root)    ROOT="$2"; shift 2 ;;
+    --project) PROJECT="$2"; shift 2 ;;
+    --since)   SINCE="$2"; shift 2 ;;
+    --phase)   PHASE="$2"; shift 2 ;;
+    --json)    JSON=1; shift ;;
+    --tsv)     TSV=1; shift ;;
+    --semantic) SEMANTIC=1; shift ;;
+    --limit)   LIMIT="$2"; shift 2 ;;
+    --help|-h)
+      awk 'NR==1{next} /^[^#]/{exit} {sub(/^# ?/,""); print}' "$0"
+      exit 0
+      ;;
+    --*) echo "unknown flag: $1" >&2; exit 64 ;;
+    *)
+      if [ -z "$QUERY" ]; then
+        QUERY="$1"
+      else
+        QUERY="$QUERY $1"
+      fi
+      shift
+      ;;
+  esac
+done
+
+if [ -z "$QUERY" ]; then
+  echo "usage: search-logs.sh \"query\" [flags]" >&2
+  exit 64
+fi
+
+# v8.3+ — semantic mode: dispatch to triage-memory.mjs corpus query and exit.
+# Honors --project as the repo-slug, --json (default off → human table),
+# --limit (passed as --top N). --since/--phase have no meaning here.
+if [ "$SEMANTIC" -eq 1 ]; then
+  TM_SCRIPT="$SCRIPT_DIR/triage-memory.mjs"
+  if [ ! -x "$TM_SCRIPT" ] && ! command -v node >/dev/null 2>&1; then
+    echo "search-logs: --semantic requires node + triage-memory.mjs" >&2
+    exit 1
+  fi
+  TM_ARGS=(query --issue "$QUERY" --top "$LIMIT")
+  if [ -n "$PROJECT" ]; then TM_ARGS+=(--repo-slug "$PROJECT"); fi
+  RESPONSE=$(node "$TM_SCRIPT" "${TM_ARGS[@]}" 2>/dev/null)
+  RC=$?
+  if [ "$JSON" -eq 1 ]; then
+    printf '%s\n' "$RESPONSE"
+    exit "$RC"
+  fi
+  # Human render
+  hits=$(echo "$RESPONSE" | jq -r '.hits | length' 2>/dev/null || echo 0)
+  if [ "$hits" = "0" ] || [ "$hits" = "" ]; then
+    echo "no semantic hits"
+    exit 1
+  fi
+  printf '%-12s %-10s %-10s %-40s %-6s\n' "TASK" "VERDICT" "SEV" "FILE" "SCORE"
+  printf '%-12s %-10s %-10s %-40s %-6s\n' "----" "-------" "---" "----" "-----"
+  echo "$RESPONSE" | jq -r '.hits[] | [.taskId, .classification, .severity, .file, .score] | @tsv' | \
+    awk -F'\t' '{ printf "%-12s %-10s %-10s %-40s %-6s\n", $1, $2, $3, substr($4,1,40), $5 }'
+  exit 0
+fi
+
+if [ ! -d "$ROOT" ]; then
+  if [ "$JSON" -eq 1 ]; then
+    printf '{ "query": "%s", "root": "%s", "matches": 0, "tasks": [] }\n' "$QUERY" "$ROOT"
+    exit 1
+  fi
+  echo "search-logs: log root not found: $ROOT" >&2
+  exit 1
+fi
+
+# --- Time filter resolution ----------------------------------------------
+
+since_epoch=0
+if [ -n "$SINCE" ]; then
+  case "$SINCE" in
+    *d)
+      days="${SINCE%d}"
+      since_epoch=$(date -v-"${days}"d +%s 2>/dev/null || date -d "-${days} days" +%s 2>/dev/null || echo 0)
+      ;;
+    *-*-*)
+      since_epoch=$(date -j -f "%Y-%m-%d" "$SINCE" +%s 2>/dev/null || date -d "$SINCE" +%s 2>/dev/null || echo 0)
+      ;;
+    *)
+      echo "search-logs: --since accepts '7d', '30d', or 'YYYY-MM-DD'" >&2
+      exit 64
+      ;;
+  esac
+fi
+
+# --- Candidate file discovery --------------------------------------------
+
+CANDIDATES=$(mktemp)
+trap 'rm -f "$CANDIDATES" "$FILTERED" "$RESULTS"' EXIT
+
+find "$ROOT" -type f -name "agent-log.md" 2>/dev/null > "$CANDIDATES"
+
+FILTERED=$(mktemp)
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  # Project filter: path must contain /$PROJECT/
+  if [ -n "$PROJECT" ] && ! echo "$f" | grep -qF "/$PROJECT/"; then
+    continue
+  fi
+  # Since filter: drop files with mtime older than since_epoch
+  if [ "$since_epoch" -gt 0 ]; then
+    m=$(stat -f %m "$f" 2>/dev/null || stat -c %Y "$f" 2>/dev/null || echo 0)
+    [ "$m" -lt "$since_epoch" ] && continue
+  fi
+  echo "$f" >> "$FILTERED"
+done < "$CANDIDATES"
+
+# --- Search executor -----------------------------------------------------
+
+has_rg=0
+command -v rg >/dev/null 2>&1 && has_rg=1
+
+RESULTS=$(mktemp)
+NOW=$(date +%s)
+
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+
+  # If --phase N is set, extract only the "## Phase N" section and grep inside
+  if [ -n "$PHASE" ]; then
+    section=$(awk -v n="$PHASE" '
+      BEGIN { inside = 0 }
+      /^##[[:space:]]+Phase[[:space:]]+/ {
+        if ($0 ~ "Phase[[:space:]]+" n "[^0-9]") { inside = 1 } else { inside = 0 }
+      }
+      inside { print }
+    ' "$f")
+    if [ -z "$section" ]; then continue; fi
+    count=$(printf '%s\n' "$section" | grep -ciE "$QUERY" 2>/dev/null)
+    first_match=$(printf '%s\n' "$section" | grep -iE "$QUERY" 2>/dev/null | head -1)
+  else
+    if [ "$has_rg" -eq 1 ]; then
+      count=$(rg -c -i "$QUERY" "$f" 2>/dev/null)
+      first_match=$(rg -i -m1 "$QUERY" "$f" 2>/dev/null | head -1)
+    else
+      count=$(grep -ciE "$QUERY" "$f" 2>/dev/null)
+      first_match=$(grep -iE "$QUERY" "$f" 2>/dev/null | head -1)
+    fi
+  fi
+
+  # Normalise count: empty (rg no-match) or non-numeric → 0
+  [ -z "$count" ] && count=0
+  case "$count" in
+    ''|*[!0-9]*) count=0 ;;
+  esac
+
+  [ "$count" -eq 0 ] && continue
+
+  # Task metadata
+  task_id=$(basename "$(dirname "$f")")
+  project=$(basename "$(dirname "$(dirname "$f")")")
+  title=$(head -1 "$f" | sed 's/^# *//' | cut -c1-80)
+  branch=$(grep -m1 -iE '^\*\*Branch\*\*' "$f" 2>/dev/null | sed -E 's/.*Branch\*\*: *([^ |]+).*/\1/' | head -c60)
+  [ -z "$branch" ] && branch="(unknown)"
+  mtime=$(stat -f %m "$f" 2>/dev/null || stat -c %Y "$f" 2>/dev/null || echo "$NOW")
+
+  # Recency weight: 1.0 for last 7d, 0.5 for 7-30d, 0.2 older
+  age_days=$(( (NOW - mtime) / 86400 ))
+  if [ "$age_days" -le 7 ]; then
+    weight=100
+  elif [ "$age_days" -le 30 ]; then
+    weight=50
+  else
+    weight=20
+  fi
+  score=$(( count * weight ))
+
+  # Pack into single tab-delimited line: score task_id project branch mtime count title snippet
+  printf '%d\t%s\t%s\t%s\t%d\t%d\t%s\t%s\n' \
+    "$score" "$task_id" "$project" "$branch" "$mtime" "$count" "$title" "$first_match" >> "$RESULTS"
+
+done < "$FILTERED"
+
+# Sort by score desc, limit
+sort -t$'\t' -k1,1nr "$RESULTS" | head -n "$LIMIT" > "${RESULTS}.sorted"
+mv "${RESULTS}.sorted" "$RESULTS"
+
+TOTAL_TASKS=$(wc -l < "$RESULTS" | tr -d ' ')
+
+# --- Report ---------------------------------------------------------------
+
+if [ "$JSON" -eq 1 ]; then
+  printf '{\n  "query": %s,\n' "$(printf '%s' "$QUERY" | sed 's/\\/\\\\/g; s/"/\\"/g; s/.*/"&"/')"
+  printf '  "root": "%s",\n' "$ROOT"
+  [ -n "$PROJECT" ] && printf '  "project": "%s",\n' "$PROJECT"
+  [ -n "$SINCE" ] && printf '  "since": "%s",\n' "$SINCE"
+  [ -n "$PHASE" ] && printf '  "phase": "%s",\n' "$PHASE"
+  printf '  "ripgrep": %s,\n' "$( [ "$has_rg" -eq 1 ] && echo true || echo false )"
+  printf '  "matched_tasks": %d,\n' "$TOTAL_TASKS"
+  printf '  "tasks": [\n'
+  i=0
+  while IFS=$'\t' read -r score task_id project branch mtime count title snippet; do
+    i=$((i+1))
+    jt=$(printf '%s' "$title" | sed 's/\\/\\\\/g; s/"/\\"/g')
+    js=$(printf '%s' "$snippet" | sed 's/\\/\\\\/g; s/"/\\"/g')
+    date=$(date -r "$mtime" "+%Y-%m-%d" 2>/dev/null || echo "")
+    printf '    { "task_id": "%s", "project": "%s", "branch": "%s", "date": "%s", "matches": %d, "score": %d, "title": "%s", "snippet": "%s" }' \
+      "$task_id" "$project" "$branch" "$date" "$count" "$score" "$jt" "$js"
+    [ "$i" -lt "$TOTAL_TASKS" ] && printf ','
+    printf '\n'
+  done < "$RESULTS"
+  printf '  ]\n}\n'
+elif [ "$TSV" -eq 1 ]; then
+  printf 'score\ttask_id\tproject\tbranch\tdate\tmatches\ttitle\tsnippet\n'
+  while IFS=$'\t' read -r score task_id project branch mtime count title snippet; do
+    date=$(date -r "$mtime" "+%Y-%m-%d" 2>/dev/null || echo "")
+    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "$score" "$task_id" "$project" "$branch" "$date" "$count" "$title" "$snippet"
+  done < "$RESULTS"
+else
+  # Colored text report
+  if [ -t 1 ] && command -v tput >/dev/null 2>&1; then
+    C_BLD=$(tput bold); C_DIM=$(tput dim); C_CYN=$(tput setaf 6); C_YEL=$(tput setaf 3); C_GRN=$(tput setaf 2); C_RST=$(tput sgr0)
+  else
+    C_BLD=""; C_DIM=""; C_CYN=""; C_YEL=""; C_GRN=""; C_RST=""
+  fi
+
+  if [ "$TOTAL_TASKS" -eq 0 ]; then
+    printf '%ssearch-logs%s · query=%s\n' "$C_BLD" "$C_RST" "$QUERY"
+    [ -n "$PROJECT" ] && printf '  project=%s' "$PROJECT"
+    [ -n "$SINCE" ]   && printf '  since=%s'   "$SINCE"
+    [ -n "$PHASE" ]   && printf '  phase=%s'   "$PHASE"
+    printf '\n  ⓘ no matches\n'
+    exit 1
+  fi
+
+  printf '%ssearch-logs%s · %d task%s · query=%s%s%s\n' \
+    "$C_BLD" "$C_RST" "$TOTAL_TASKS" "$([ "$TOTAL_TASKS" -eq 1 ] || echo s)" "$C_CYN" "$QUERY" "$C_RST"
+  [ -n "$PROJECT" ] && printf '  %sproject=%s%s\n' "$C_DIM" "$PROJECT" "$C_RST"
+  [ -n "$SINCE" ]   && printf '  %ssince=%s%s\n'   "$C_DIM" "$SINCE" "$C_RST"
+  [ -n "$PHASE" ]   && printf '  %sphase=%s%s\n'   "$C_DIM" "$PHASE" "$C_RST"
+  [ "$has_rg" -eq 0 ] && printf '  %s(ripgrep not found, using grep)%s\n' "$C_DIM" "$C_RST"
+  printf '\n'
+
+  while IFS=$'\t' read -r score task_id project branch mtime count title snippet; do
+    date=$(date -r "$mtime" "+%Y-%m-%d" 2>/dev/null || echo "")
+    printf '%s%s%s · %s%s%s · %s%s%s · %s%d match%s%s\n' \
+      "$C_YEL" "$task_id" "$C_RST" "$C_DIM" "$project" "$C_RST" "$C_DIM" "$branch" "$C_RST" "$C_GRN" "$count" "$([ "$count" -eq 1 ] || echo es)" "$C_RST"
+    [ -n "$title" ] && printf '  %s%s%s\n' "$C_BLD" "$title" "$C_RST"
+    printf '  %s%s  ·  %s%s\n\n' "$C_DIM" "$date" "$(echo "$snippet" | head -c 140)" "$C_RST"
+  done < "$RESULTS"
+fi
+
+[ "$TOTAL_TASKS" -gt 0 ] && exit 0 || exit 1