@mmerterden/multi-agent-pipeline 8.6.1 → 10.0.6

package/pipeline/lib/multi-repo-pipeline.sh

@@ -25,7 +25,7 @@
 #     "identity":{"name":"...","email":"..."}
 #   }
 #
-# `bridge` writes agent-state.json v2.1.0 with projects[] populated — Phase 0
+# `bridge` writes agent-state.json v2.1.0 with projects[] populated  -  Phase 0
 # consumes this and skips its own picker steps.
 
 set -eu
@@ -38,21 +38,6 @@ STATE="${2:-}"
 }
 [ ! -f "$STATE" ] && { echo "ERR: state file not found: $STATE" >&2; exit 2; }
 
-jq_get() {
-  python3 -c "
-import json,sys
-d=json.load(open('$STATE'))
-keys='''$1'''.split('.')
-for k in keys:
-    if k.endswith(']'):
-        name,idx=k[:-1].split('[')
-        d=d[name][int(idx)]
-    else:
-        d=d[k]
-print(d)
-" 2>/dev/null
-}
-
 list_repos_jq() {
   python3 -c "
 import json,sys
@@ -72,7 +57,11 @@ ISSUE_TITLE=$(python3 -c "import json; d=json.load(open('$STATE')); print(d['iss
 
 cmd_prepare() {
   mkdir -p "$WORKTREE_ROOT"
-  list_repos_jq | while IFS=$'\t' read -r name url provider; do
+  # Process substitution (not a pipe) so the loop runs in THIS shell  -  a piped
+  # `while` runs in a subshell, so the `return 3` below would only exit the
+  # subshell, not cmd_prepare, and a clone failure could not abort the function
+  # with the intended exit code.
+  while IFS=$'\t' read -r name url provider; do
     local target="$WORKTREE_ROOT/$name"
     if [ -d "$target/.git" ]; then
       echo "[$name] worktree already present at $target"
@@ -88,7 +77,7 @@ cmd_prepare() {
       git checkout --quiet -b "$BRANCH"
     fi
     cd - >/dev/null
-  done
+  done < <(list_repos_jq)
 }
 
 cmd_commit() {
@@ -96,7 +85,7 @@ cmd_commit() {
     local target="$WORKTREE_ROOT/$name"
     [ ! -d "$target" ] && continue
     cd "$target"
-    # Use status --porcelain so untracked files count as "changes" too —
+    # Use status --porcelain so untracked files count as "changes" too  - 
     # dev sessions usually add brand-new files alongside edits, and `git diff`
     # alone misses them.
     if [ -z "$(git status --porcelain 2>/dev/null)" ]; then
@@ -130,8 +119,10 @@ cmd_pr() {
   # Open PR for extras first, then primary with cross-links.
   local primary_name primary_owner_repo
   primary_name=$(python3 -c "import json; d=json.load(open('$STATE')); print(d['primary']['name'])")
-  local cross_links=""
-  list_repos_jq | while IFS=$'\t' read -r name url provider; do
+  # Extra-repo PR URLs are passed to the primary PR via the _prs.log file below,
+  # not a shell var  -  the loop runs in a pipe subshell, so any accumulated var
+  # would be lost. The file-based handoff is intentional.
+  while IFS=$'\t' read -r name url provider; do
     if [ "$name" = "$primary_name" ]; then continue; fi
     local target="$WORKTREE_ROOT/$name"
     [ ! -d "$target" ] && continue
@@ -145,7 +136,7 @@ Part of multi-repo task $TASK_ID."
       echo "[$name] PR creation skipped (provider=$provider)"
     fi
     cd - >/dev/null
-  done
+  done < <(list_repos_jq)
   # Now primary
   local target="$WORKTREE_ROOT/$primary_name"
   cd "$target"

package/pipeline/lib/plan-todos.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 #
-# plan-todos.sh — manage the Phase 2 plan as a live Todo list.
+# plan-todos.sh  -  manage the Phase 2 plan as a live Todo list.
 #
 # Pattern source:
-#   - Windsurf Cascade — https://docs.windsurf.com/windsurf/cascade
+#   - Windsurf Cascade  -  https://docs.windsurf.com/windsurf/cascade
 #       "renders a Todo list inside the conversation that updates as it works"
-#   - Cursor Plan Mode — https://cursor.com/docs/agent/planning
+#   - Cursor Plan Mode  -  https://cursor.com/docs/agent/planning
 #       "creates a detailed, reviewable, editable plan before writing any code"
 #
 # State lives in `agent-state.json` under `.plan.todos[]` per
@@ -28,7 +28,7 @@
 # Exit codes:
 #   0  success
 #   1  todo not found / state missing
-#   2  bad transition (deps unsatisfied, double-start, …)
+#   2  bad transition (deps unsatisfied, double-start, ...)
 #   64 usage error
 
 set -euo pipefail
@@ -48,7 +48,7 @@ usage() {
 resolve_state() {
   local task_id="$1"
   local found=""
-  for dir in $HOME/.claude/projects/-Users-*; do
+  for dir in "$HOME"/.claude/projects/*; do
     local candidate="$dir/state/$task_id/agent-state.json"
     if [ -f "$candidate" ]; then
       found="$candidate"
@@ -91,7 +91,7 @@ do_set() {
   if [ -z "$plan_blob" ] || [ "$plan_blob" = "-" ]; then
     plan_blob=$(cat)
   fi
-  # Validate against schema (best-effort — jq syntax check, then required-field probe).
+  # Validate against schema (best-effort  -  jq syntax check, then required-field probe).
   if ! jq -e '.title and (.todos | type == "array")' <<<"$plan_blob" >/dev/null 2>&1; then
     echo "plan-todos: input must be an object with .title (string) and .todos (array)" >&2
     exit 2
@@ -107,7 +107,7 @@ do_set() {
 }
 
 deps_satisfied() {
-  # $1 state JSON, $2 todo_id — exits 0 if all deps for that todo are completed|skipped.
+  # $1 state JSON, $2 todo_id  -  exits 0 if all deps for that todo are completed|skipped.
   local state="$1" todo_id="$2"
   jq -e --arg id "$todo_id" '
     (.plan.todos // []) as $all

package/pipeline/lib/post-pr-review.sh

@@ -18,20 +18,26 @@
 #                                bbProjectKey, bbRepoSlug, bbServerHost }
 #   .review.findings           [{ severity, status, file, line, issue, fix,
 #                                ruleId }]
-#   .review.iterationNumber    int (1-based, used in comment footer)
+#   .review.iterationNumber    int (1-based fallback for the comment footer;
+#                              on needs_work the live value is re-derived from
+#                              the highest "iteration #N" already on the PR + 1)
 #   .review.headCommitSha      string  (GitHub inline anchor needs commit_id)
 #
 # Reads from preferences:
 #   prefs.global.outputLanguage  ("tr" | "en")
 #
 # Exit codes:
-#   0  success — verdict + (any) inline comments posted
+#   0  success  -  verdict + (any) inline comments posted
 #   2  agent-state.json missing or .review absent
 #   3  unknown provider; falls back to chat-only and exits 3
 #   4  API call failed (network / auth / 4xx). Diagnostic line on stderr.
 
 set -euo pipefail
 
+# Basic-auth via a curl config fed through process substitution so the
+# credential never appears in argv (argv is visible to `ps` / process audit).
+bb_auth_cfg() { printf 'user = "%s:%s"\n' "$1" "$2"; }
+
 TASK_ID="${1:-}"
 
 if [ -z "$TASK_ID" ]; then
@@ -41,7 +47,7 @@ fi
 
 # Resolve agent-state.json (matches phase-tracker convention).
 AGENT_STATE=""
-for dir in $HOME/.claude/projects/-Users-*; do
+for dir in "$HOME"/.claude/projects/*; do
   candidate="$dir/state/$TASK_ID/agent-state.json"
   if [ -f "$candidate" ]; then
     AGENT_STATE="$candidate"
@@ -55,7 +61,7 @@ if [ -z "$AGENT_STATE" ]; then
 fi
 
 if ! jq -e '.review' "$AGENT_STATE" >/dev/null; then
-  echo "post-pr-review: agent-state has no .review field — run /multi-agent:review first" >&2
+  echo "post-pr-review: agent-state has no .review field  -  run /multi-agent:review first" >&2
   exit 2
 fi
 
@@ -68,7 +74,7 @@ ITERATION=$(jq -r '.review.iterationNumber // 1' "$AGENT_STATE")
 
 # --- Decision ---------------------------------------------------------------
 
-# Single jq pass — group accepted findings by severity into tab-separated counts.
+# Single jq pass  -  group accepted findings by severity into tab-separated counts.
 read -r ACCEPTED_BLOCKING ACCEPTED_IMPORTANT < <(
   jq -r '
     [.review.findings[] | select(.status == "accepted")] as $a
@@ -90,8 +96,8 @@ echo "post-pr-review: decision=$DECISION (blocking=$ACCEPTED_BLOCKING, important
 
 # --- Per-finding comment body renderer (in $OUT_LANG) -----------------------
 
-# Stable fingerprint for a finding — used by dedupe to recognize re-runs of
-# the same finding without re-posting. Sha256 of "path|line|issue" — note
+# Stable fingerprint for a finding  -  used by dedupe to recognize re-runs of
+# the same finding without re-posting. Sha256 of "path|line|issue"  -  note
 # that fix/ruleId/iterationNumber are excluded so a finding still dedupes
 # when the suggested fix wording changes slightly between iterations.
 finding_fingerprint() {
@@ -123,7 +129,7 @@ render_inline_body() {
     fix_label="Suggestion"
   fi
 
-  printf '%s **%s** — %s\n\n' "$emoji" "$label_word" "$issue"
+  printf '%s **%s**  -  %s\n\n' "$emoji" "$label_word" "$issue"
   if [ -n "$fix" ] && [ "$fix" != "null" ]; then
     printf '**%s:** %s\n\n' "$fix_label" "$fix"
   fi
@@ -131,7 +137,7 @@ render_inline_body() {
     printf '_%s_\n\n' "$rule_id"
   fi
   printf -- '---\n🤖 _Multi-Agent Review · iteration #%s_\n' "$ITERATION"
-  # Dedupe marker — Bugbot-style. Re-runs of /multi-agent:review skip a
+  # Dedupe marker  -  Bugbot-style. Re-runs of /multi-agent:review skip a
   # finding when an existing comment carries the same fingerprint.
   if [ -n "$fingerprint" ]; then
     printf '<!-- multi-agent-finding: %s -->\n' "$fingerprint"
@@ -163,6 +169,26 @@ comment_exists_with_fingerprint() {
   ' <<<"$EXISTING_COMMENTS_CACHE" >/dev/null 2>&1
 }
 
+# Next iteration number = highest "iteration #N" already stamped on the PR + 1.
+# Standalone /multi-agent:review runs use a fresh TASK_ID each time, so the PR
+# comments  -  not agent-state  -  are the only cross-run source of truth. Falls
+# back to 1 when no prior multi-agent comment exists. Requires the comment cache
+# to be loaded first.
+compute_next_iteration() {
+  local max
+  # Only count "iteration #N" stamps inside our own footer ("Multi-Agent
+  # Review · iteration #N"), so a human comment that happens to mention
+  # "iteration #99" cannot inflate the counter.
+  max=$(jq -r '
+    [ .[]? | .body // ""
+      | select(test("Multi-Agent Review"))
+      | scan("iteration #([0-9]+)") | .[0] | tonumber ]
+    | (max // 0) + 1
+  ' <<<"${EXISTING_COMMENTS_CACHE:-[]}" 2>/dev/null || echo "")
+  case "$max" in (*[!0-9]*|"") max=1 ;; esac
+  echo "$max"
+}
+
 # Bitbucket Server activities endpoint returns nested comment trees. Flatten
 # them into the same `[{body: <text>}, ...]` shape that
 # comment_exists_with_fingerprint expects so the dedupe gate is provider-agnostic.
@@ -171,7 +197,7 @@ load_existing_comments_bitbucket() {
   if [ -z "$EXISTING_COMMENTS_CACHE" ]; then
     local base="https://$host/rest/api/1.0/projects/$project/repos/$slug/pull-requests/$pr_num"
     local raw
-    raw=$(curl -sS -m 30 -u "$auth_user:$auth_token" \
+    raw=$(curl -sS -m 30 -K <(bb_auth_cfg "$auth_user" "$auth_token") \
       "$base/activities?fromType=COMMENT&limit=100" 2>/dev/null || echo "{}")
     EXISTING_COMMENTS_CACHE=$(jq '
       def collect_texts(c):
@@ -203,13 +229,16 @@ post_github() {
     rc_body="See inline comments above."
   fi
 
-  # Dedupe gate — read pref, default ON (Bugbot-style). Loads existing
+  # Dedupe gate  -  read pref, default ON (Bugbot-style). Loads existing
   # comments once if needed; per-finding check is in-process.
   local DEDUPE_ENABLED
   DEDUPE_ENABLED=$(jq -r '.global.review.dedupeInlineComments // true' \
     "$HOME/.claude/multi-agent-preferences.json" 2>/dev/null || echo "true")
-  if [ "$DECISION" = "needs_work" ] && [ "$DEDUPE_ENABLED" = "true" ]; then
+  # Load existing comments on any needs_work post: dedupe needs them when
+  # enabled, and the iteration counter is always derived from them.
+  if [ "$DECISION" = "needs_work" ]; then
     load_existing_comments_github "$org_repo" "$PR_NUM"
+    ITERATION=$(compute_next_iteration)
   fi
 
   if [ "$DECISION" = "needs_work" ]; then
@@ -229,7 +258,7 @@ post_github() {
         body=$(render_inline_body "$sev" "$issue" "$fix" "$rule_id" "$fingerprint")
 
         if [ "$DEDUPE_ENABLED" = "true" ] && comment_exists_with_fingerprint "$fingerprint"; then
-          echo "post-pr-review: dedupe skip — finding $fingerprint already commented" >&2
+          echo "post-pr-review: dedupe skip  -  finding $fingerprint already commented" >&2
           continue
         fi
 
@@ -262,7 +291,7 @@ post_bitbucket_server() {
   project=$(jq -r '.review.input.bbProjectKey' "$AGENT_STATE")
   slug=$(jq -r '.review.input.bbRepoSlug' "$AGENT_STATE")
 
-  # Resolve credential keys from prefs.keychainMapping — never hardcode.
+  # Resolve credential keys from prefs.keychainMapping  -  never hardcode.
   prefs="$HOME/.claude/multi-agent-preferences.json"
   user_key=$(jq -r '.keychainMapping.bitbucket_user // empty' "$prefs" 2>/dev/null || true)
   token_key=$(jq -r '.keychainMapping.bitbucket_token // empty' "$prefs" 2>/dev/null || true)
@@ -273,7 +302,7 @@ post_bitbucket_server() {
   fi
 
   # Resolve via the cross-platform credential helper (macOS Keychain / Windows
-  # Credential Manager / Linux libsecret) — sourced lazily so this script keeps
+  # Credential Manager / Linux libsecret)  -  sourced lazily so this script keeps
   # working when run from either ~/.claude/lib or ~/.copilot/lib.
   # shellcheck disable=SC1090
   . "$HOME/.claude/lib/credential-store-resolver.sh" 2>/dev/null \
@@ -292,12 +321,15 @@ post_bitbucket_server() {
 
   local base="https://$host/rest/api/1.0/projects/$project/repos/$slug/pull-requests/$PR_NUM"
 
-  # Dedupe gate — read pref, default ON. Bitbucket uses the activities feed.
+  # Dedupe gate  -  read pref, default ON. Bitbucket uses the activities feed.
   local DEDUPE_ENABLED
   DEDUPE_ENABLED=$(jq -r '.global.review.dedupeInlineComments // true' \
     "$HOME/.claude/multi-agent-preferences.json" 2>/dev/null || echo "true")
-  if [ "$DECISION" = "needs_work" ] && [ "$DEDUPE_ENABLED" = "true" ]; then
+  # Load existing comments on any needs_work post: dedupe needs them when
+  # enabled, and the iteration counter is always derived from them.
+  if [ "$DECISION" = "needs_work" ]; then
     load_existing_comments_bitbucket "$host" "$project" "$slug" "$PR_NUM" "$auth_user" "$auth_token"
+    ITERATION=$(compute_next_iteration)
   fi
 
   if [ "$DECISION" = "needs_work" ]; then
@@ -317,7 +349,7 @@ post_bitbucket_server() {
         body=$(render_inline_body "$sev" "$issue" "$fix" "$rule_id" "$fingerprint")
 
         if [ "$DEDUPE_ENABLED" = "true" ] && comment_exists_with_fingerprint "$fingerprint"; then
-          echo "post-pr-review: dedupe skip — finding $fingerprint already commented (bitbucket)" >&2
+          echo "post-pr-review: dedupe skip  -  finding $fingerprint already commented (bitbucket)" >&2
           continue
         fi
 
@@ -325,7 +357,7 @@ post_bitbucket_server() {
         if [ "$line" -gt 0 ] 2>/dev/null; then
           payload=$(jq -n --arg t "$body" --arg p "$path" --argjson l "$line" \
             '{text: $t, anchor: {path: $p, line: $l, lineType: "ADDED", fileType: "TO"}}')
-          http=$(curl -sS -m 30 -u "$auth_user:$auth_token" -X POST \
+          http=$(curl -sS -m 30 -K <(bb_auth_cfg "$auth_user" "$auth_token") -X POST \
             -H "Content-Type: application/json" "$base/comments" \
             -d "$payload" -o /dev/null -w '%{http_code}' || echo 000)
           if [ "$http" = "200" ] || [ "$http" = "201" ]; then
@@ -337,7 +369,7 @@ post_bitbucket_server() {
 
         if [ "$inline_ok" -eq 0 ]; then
           payload=$(jq -n --arg t "$body" '{text: $t}')
-          curl -sS -m 30 -u "$auth_user:$auth_token" -X POST \
+          curl -sS -m 30 -K <(bb_auth_cfg "$auth_user" "$auth_token") -X POST \
             -H "Content-Type: application/json" "$base/comments" \
             -d "$payload" >/dev/null \
             || echo "post-pr-review: bitbucket top-level comment failed for $path:$line" >&2
@@ -351,7 +383,7 @@ post_bitbucket_server() {
     needs_work) status_payload='{"status":"NEEDS_WORK"}' ;;
   esac
 
-  curl -sS -m 30 -u "$auth_user:$auth_token" -X PUT \
+  curl -sS -m 30 -K <(bb_auth_cfg "$auth_user" "$auth_token") -X PUT \
     -H "Content-Type: application/json" "$base/participants/$user_slug" \
     -d "$status_payload" >/dev/null
 }

package/pipeline/lib/repo-cache.sh

@@ -5,13 +5,13 @@
 #
 # Output JSON schema (per repo):
 #   { "fullName":"<owner>/<name>", "name":"<name>", "owner":"<owner>",
-#     "description":"…", "isFork":false, "updatedAt":"...",
+#     "description":"...", "isFork":false, "updatedAt":"...",
 #     "canPush":true|false, "provider":"github"|"bitbucket" }
 #
 # canPush reflects whether the active account has WRITE+ permission on the
 # repo (github: viewerPermission in {ADMIN, MAINTAIN, WRITE}; bitbucket: write
-# is assumed for the cached project scope). Consumers — notably the
-# submodule detector — use this to decide which related repos may be edited.
+# is assumed for the cached project scope). Consumers  -  notably the
+# submodule detector  -  use this to decide which related repos may be edited.
 #
 # Usage:
 #   ./repo-cache.sh github <owner> [--refresh]
@@ -20,7 +20,7 @@
 # Required env per-provider:
 #   github    -> GH_TOKEN_KEY (keychain service)
 #   bitbucket -> BB_TOKEN_KEY, BB_USER_KEY, BB_HOST (e.g. bitbucket.example.com)
-#   local     -> (none) — scopes are treated as filesystem roots; "scope=$HOME"
+#   local     -> (none)  -  scopes are treated as filesystem roots; "scope=$HOME"
 #                walks $HOME with maxdepth, scope=<path> walks just that path.
 #                LOCAL_SCAN_ROOTS env can override the default root list.
 #                LOCAL_SCAN_MAXDEPTH env (default 4) bounds traversal cost.
@@ -49,7 +49,7 @@ cache_fresh() {
   [ -f "$CACHE_FILE" ] || return 1
   local age now mtime
   now=$(date +%s)
-  mtime=$(stat -f %m "$CACHE_FILE" 2>/dev/null || stat -c %Y "$CACHE_FILE" 2>/dev/null)
+  mtime=$(stat -c %Y "$CACHE_FILE" 2>/dev/null || stat -f %m "$CACHE_FILE" 2>/dev/null)
   age=$((now - mtime))
   [ "$age" -lt "$TTL_SECONDS" ]
 }

package/pipeline/lib/review-watch.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 #
-# review-watch.sh — poll watched GitHub repos for incoming PRs and
+# review-watch.sh  -  poll watched GitHub repos for incoming PRs and
 # dispatch `/multi-agent:review` on each new/updated PR.
 #
 # Pattern source:
-#   - Cursor Bugbot — https://cursor.com/docs/bugbot
+#   - Cursor Bugbot  -  https://cursor.com/docs/bugbot
 #       "Bugbot automatically reviews every PR update; reads existing PR
 #       comments to avoid duplicate feedback."
-#   - Devin Review — https://docs.devin.ai/work-with-devin/devin-review
+#   - Devin Review  -  https://docs.devin.ai/work-with-devin/devin-review
 #       "Auto-Review on PR open / new commit / draft-ready / reviewer-add."
 #
 # What it does:
@@ -21,7 +21,7 @@
 #     the trigger.
 #   - Honors labelFilter (only review PRs carrying the label, default: all).
 #   - Skips PRs the user authored (we don't review our own PRs through this
-#     surface — that's what the in-pipeline Phase 4 / standalone /review is
+#     surface  -  that's what the in-pipeline Phase 4 / standalone /review is
 #     for; this loop is for INCOMING PRs from others).
 #   - One-shot or watch loop (--interval N).
 #
@@ -32,7 +32,7 @@
 #   review-watch.sh --doctor       # show config + last-seen cursors
 #
 # Exit codes:
-#   0  success — reviews dispatched (or no PRs to review)
+#   0  success  -  reviews dispatched (or no PRs to review)
 #   2  config error (no repos to watch, no gh auth)
 #   3  gh CLI / network error
 #
@@ -60,11 +60,11 @@ require_jq() {
 
 require_gh() {
   if ! command -v gh >/dev/null 2>&1; then
-    err "gh CLI not installed — install from https://cli.github.com"
+    err "gh CLI not installed  -  install from https://cli.github.com"
     exit 2
   fi
   if ! gh auth status >/dev/null 2>&1; then
-    err "gh CLI not authenticated — run 'gh auth login'"
+    err "gh CLI not authenticated  -  run 'gh auth login'"
     exit 2
   fi
 }
@@ -121,7 +121,7 @@ doctor() {
     printf '  intervalSeconds: %s\n' "$(read_interval_from_prefs)"
     printf '  labelFilter:     %s\n' "$(read_label_filter)"
   else
-    printf '  (no prefs file — review-watch unconfigured)\n'
+    printf '  (no prefs file  -  review-watch unconfigured)\n'
   fi
   printf '  state dir:       %s\n' "$STATE_DIR"
   for f in "$STATE_DIR"/*.json; do
@@ -168,11 +168,15 @@ review_one_repo() {
   if [ "$count" -eq 0 ]; then
     printf 'review-watch: no new PRs in %s\n' "$repo" >&2
   else
-    printf 'review-watch: %s — %d PR(s) to review\n' "$repo" "$count"
+    printf 'review-watch: %s  -  %d PR(s) to review\n' "$repo" "$count"
   fi
 
   local newest_iso="$last_seen"
-  jq -c '.[]' <<<"$prs_json" | while read -r pr; do
+  # Process substitution (not a pipe) so the loop runs in THIS shell  -  a piped
+  # `while` runs in a subshell and every `state=` / `newest_iso=` mutation below
+  # would be discarded, leaving save_state to persist the pre-loop cursor and
+  # re-dispatching the same PRs on every poll.
+  while read -r pr; do
     local pr_num head_sha updated_at title url
     pr_num=$(jq -r '.number' <<<"$pr")
     head_sha=$(jq -r '.headRefOid' <<<"$pr")
@@ -188,19 +192,19 @@ review_one_repo() {
       continue
     fi
 
-    printf '  dispatch review: %s PR #%s — %s\n' "$repo" "$pr_num" "$title"
+    printf '  dispatch review: %s PR #%s  -  %s\n' "$repo" "$pr_num" "$title"
     printf '    url=%s head=%s\n' "$url" "$head_sha"
 
     # Record that we reviewed this head SHA. The actual dispatch happens
     # via /multi-agent:review on the surface that invoked review-watch
     # (Claude Code session or future webhook handler). review-watch only
-    # produces the dispatch list — it does not run the LLM itself, because
+    # produces the dispatch list  -  it does not run the LLM itself, because
     # token cost decisions stay with the user.
     state=$(jq --arg n "$pr_num" --arg s "$head_sha" --arg t "$updated_at" \
       '.reviewed_prs[$n] = $s | .last_seen_iso = $t' <<<"$state")
 
     if [ "$updated_at" \> "$newest_iso" ]; then newest_iso="$updated_at"; fi
-  done
+  done < <(jq -c '.[]' <<<"$prs_json")
 
   save_state "$repo" "$state"
 }

package/pipeline/lib/shadow-git.sh

@@ -1,15 +1,15 @@
 #!/usr/bin/env bash
 #
-# shadow-git.sh — per-tool-call checkpoints in a separate git repo.
+# shadow-git.sh  -  per-tool-call checkpoints in a separate git repo.
 #
 # Pattern source:
-#   - Cline checkpoints — https://docs.cline.bot/features/checkpoints
+#   - Cline checkpoints  -  https://docs.cline.bot/features/checkpoints
 #       "Cline maintains a shadow Git repository separate from your project's
-#        actual Git history… After each tool use, Cline commits the current
+#        actual Git history... After each tool use, Cline commits the current
 #        state of your files to this shadow repo."
 #
 # Why a SHADOW repo (not the real .git): the real git tree holds the user's
-# semantic commits — clean history, intentional messages. Shadow snapshots
+# semantic commits  -  clean history, intentional messages. Shadow snapshots
 # fire per Edit/Write/MultiEdit/Bash-mutation and would pollute that tree.
 # Shadow repos live under `.shadow-git/<task-id>/.git` and never touch the
 # project's `.git/refs` or `.git/index`.
@@ -20,7 +20,7 @@
 #              state as the baseline.
 #   snapshot   <task-id> <project-root> "<step-label>"
 #              Stage everything (respects .gitignore) + commit with the
-#              step label. Idempotent — empty diffs produce no commit.
+#              step label. Idempotent  -  empty diffs produce no commit.
 #   list       <task-id>
 #              Show all snapshots: <sha>  <iso-date>  <label>
 #   restore    <task-id> <project-root> <sha> [--files|--state|--both]
@@ -101,7 +101,7 @@ __pycache__/
 .venv/
 *.log
 EOF
-  # Initial author setup — keep separate from user's global git identity to
+  # Initial author setup  -  keep separate from user's global git identity to
   # signal "this is the shadow", not real commits.
   sg "$sd" "$project_root" config user.name "shadow-git"
   sg "$sd" "$project_root" config user.email "shadow@multi-agent.local"
@@ -114,7 +114,7 @@ do_snapshot() {
   [ -z "$task_id" ] || [ -z "$project_root" ] || [ -z "$label" ] && {
     err "usage: snapshot <task-id> <project-root> <label>"; exit 1; }
   local sd; sd=$(shadow_dir "$task_id")
-  [ ! -d "$sd/.git" ] && { err "shadow not initialized for $task_id — run 'init' first"; exit 1; }
+  [ ! -d "$sd/.git" ] && { err "shadow not initialized for $task_id  -  run 'init' first"; exit 1; }
   sg "$sd" "$project_root" add -A >/dev/null 2>&1 || true
   # Skip empty diffs (no-op snapshots).
   if sg "$sd" "$project_root" diff --cached --quiet 2>/dev/null; then

package/pipeline/lib/submodule-detector.sh

@@ -11,9 +11,9 @@
 # Optional env (when set, enriches each submodule with a canPush flag by
 # cross-referencing the repo-cache.sh output for the active account, plus the
 # editableRelatedRepos override list under prefs.projects[<key>]):
-#   ACCOUNT_GH_OWNER       — owner scope for the github cache file
-#   ACCOUNT_BB_PROJECT_KEY — project/workspace key for the bitbucket cache
-#   PROJECT_PREF_KEY       — top-level key in prefs.projects (e.g. cwd repo name)
+#   ACCOUNT_GH_OWNER        -  owner scope for the github cache file
+#   ACCOUNT_BB_PROJECT_KEY  -  project/workspace key for the bitbucket cache
+#   PROJECT_PREF_KEY        -  top-level key in prefs.projects (e.g. cwd repo name)
 #
 # Output:
 #   [

package/pipeline/lib/vercel-deploy.sh

@@ -1,15 +1,15 @@
 #!/usr/bin/env bash
 #
-# vercel-deploy.sh — safe wrapper around `vercel` CLI.
+# vercel-deploy.sh  -  safe wrapper around `vercel` CLI.
 #
-# Why this exists (v8.0.0): on 2026-04-27 a `vercel deploy --token=…`
+# Why this exists (v8.0.0): on 2026-04-27 a `vercel deploy --token=...`
 # invocation failed during the v7.9.1 release flow. The CLI's error retry
-# hint printed the failed argv verbatim, including `--token=vcp_…`. That
+# hint printed the failed argv verbatim, including `--token=vcp_...`. That
 # leaked the deploy token into the conversation transcript and forced a
 # token rotation. See `feedback_vercel_cli_token_leak.md`.
 #
 # This wrapper guarantees three properties for every Vercel call:
-#   1. Tokens are passed via VERCEL_TOKEN env var, NEVER via --token=… argv.
+#   1. Tokens are passed via VERCEL_TOKEN env var, NEVER via --token=... argv.
 #      Even if a downstream caller still uses --token=, the redact filter
 #      below scrubs it from stdout/stderr.
 #   2. Every stdout/stderr line is piped through `redact_token` before being
@@ -23,10 +23,10 @@
 #   pipeline/lib/vercel-deploy.sh doctor                       # env + CLI check
 #
 # Environment:
-#   VERCEL_TOKEN          — required for deploy (resolved from prefs keychainMapping if unset)
-#   VERCEL_ORG_ID         — optional, scopes deploys to a team
-#   VERCEL_PROJECT_ID     — optional, links to a specific project
-#   VERCEL_DEPLOY_QUIET   — when set, suppresses progress lines (raw CLI output stays redacted)
+#   VERCEL_TOKEN           -  required for deploy (resolved from prefs keychainMapping if unset)
+#   VERCEL_ORG_ID          -  optional, scopes deploys to a team
+#   VERCEL_PROJECT_ID      -  optional, links to a specific project
+#   VERCEL_DEPLOY_QUIET    -  when set, suppresses progress lines (raw CLI output stays redacted)
 #
 # Exit codes:
 #   0  deploy succeeded
@@ -39,7 +39,7 @@ CMD="${1:-help}"
 shift || true
 
 # ---------------------------------------------------------------------------
-# Token redaction filter — used everywhere user-visible output flows.
+# Token redaction filter  -  used everywhere user-visible output flows.
 #
 # Patterns scrubbed:
 #   --token=<rest>          → --token=***REDACTED***
@@ -68,16 +68,16 @@ cmd_doctor() {
   if command -v vercel >/dev/null 2>&1; then
     echo "vercel: $(vercel --version 2>&1 | redact_filter | head -1)"
   else
-    echo "vercel: NOT INSTALLED — run 'npm i -g vercel'" >&2
+    echo "vercel: NOT INSTALLED  -  run 'npm i -g vercel'" >&2
     rc=1
   fi
 
   if [ -n "${VERCEL_TOKEN:-}" ]; then
     local masked
     masked=$(printf '%s' "$VERCEL_TOKEN" | head -c 4)
-    echo "VERCEL_TOKEN: set (prefix=${masked}…, length=${#VERCEL_TOKEN})"
+    echo "VERCEL_TOKEN: set (prefix=${masked}..., length=${#VERCEL_TOKEN})"
   else
-    echo "VERCEL_TOKEN: unset — set via env or pipeline keychainMapping.vercel"
+    echo "VERCEL_TOKEN: unset  -  set via env or pipeline keychainMapping.vercel"
   fi
 
   if [ -n "${VERCEL_ORG_ID:-}" ]; then
@@ -91,8 +91,21 @@ cmd_doctor() {
 }
 
 cmd_deploy() {
+  # Token-on-argv refusal runs FIRST - the whole point of this wrapper is
+  # never letting --token reach a transcript, so the guard must not depend
+  # on the vercel CLI being installed.
+  local arg
+  for arg in "$@"; do
+    case "$arg" in
+      --token|--token=*)
+        echo "ERROR: refused to deploy with --token argv. Pass the token via VERCEL_TOKEN env var instead." >&2
+        exit 1
+        ;;
+    esac
+  done
+
   if ! command -v vercel >/dev/null 2>&1; then
-    echo "ERROR: vercel CLI not on PATH — run 'npm i -g vercel'" >&2
+    echo "ERROR: vercel CLI not on PATH  -  run 'npm i -g vercel'" >&2
     exit 1
   fi
 
@@ -122,7 +135,7 @@ cmd_deploy() {
   fi
   cmd_args+=("${extra_args[@]}")
 
-  # Refuse to run if the user is trying to pass --token=… via extra args.
+  # Refuse to run if the user is trying to pass --token=... via extra args.
   for a in "${extra_args[@]}"; do
     case "$a" in
       --token=*|--token)
@@ -134,7 +147,7 @@ cmd_deploy() {
   done
 
   # Run the CLI with token via env. Pipe stdout AND stderr through the redact
-  # filter so even if the CLI dumps argv on failure (it does — that was the
+  # filter so even if the CLI dumps argv on failure (it does  -  that was the
   # original v7.9.1 leak), tokens never reach the user's screen or transcript.
   set +e
   ( cd "$cwd" && VERCEL_TOKEN="$VERCEL_TOKEN" vercel "${cmd_args[@]}" 2>&1 ) \