@mmerterden/multi-agent-pipeline 8.6.2 → 10.2.0

package/pipeline/scripts/migrate-prefs.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// migrate-prefs.mjs — migrates multi-agent-preferences.json v2.0.0 → v2.1.0
+// migrate-prefs.mjs  -  migrates multi-agent-preferences.json v2.0.0 → v2.1.0
 //
 // Usage:
 //   node migrate-prefs.mjs [--dry-run] [--file <path>]
@@ -52,12 +52,12 @@ function defaultKeychainMapping() {
     figma: null,
     figma_mcp: null,
     fortify: null,
-    firebase: null, // unified — project_id is parsed from the decoded SA JSON; no separate firebase_project
+    firebase: null, // unified  -  project_id is parsed from the decoded SA JSON; no separate firebase_project
     jenkins: null,
   };
 }
 
-// v2.1.0 sub-migration — always runs (even on already-v2.1.0 files) to consolidate
+// v2.1.0 sub-migration  -  always runs (even on already-v2.1.0 files) to consolidate
 // early-v2.1.0 drift: firebase_sa+firebase_project → firebase.
 function consolidateFirebase(out, changes) {
   const km = out?.global?.keychainMapping;
@@ -76,7 +76,7 @@ function consolidateFirebase(out, changes) {
     }
     if ("firebase_project" in km) {
       delete km.firebase_project;
-      changes.push("keychainMapping: removed firebase_project (redundant — project_id lives inside the SA JSON)");
+      changes.push("keychainMapping: removed firebase_project (redundant  -  project_id lives inside the SA JSON)");
     }
   }
   if (Array.isArray(out?.global?.identities)) {
@@ -98,7 +98,7 @@ function consolidateFirebase(out, changes) {
   }
 }
 
-// v2.1.0 sub-migration — consolidate figma_pat → figma, remove figma_user.
+// v2.1.0 sub-migration  -  consolidate figma_pat → figma, remove figma_user.
 function consolidateFigma(out, changes) {
   const km = out?.global?.keychainMapping;
   if (km && typeof km === "object") {
@@ -137,14 +137,14 @@ function migrate(prefs) {
   const changes = [];
   const out = JSON.parse(JSON.stringify(prefs)); // deep clone
 
-  // 1. schemaVersion — detect whether a v2.0.0 → 2.1.0 → 2.2.0 → 2.3.0 bump chain is needed.
+  // 1. schemaVersion  -  detect whether a v2.0.0 → 2.1.0 → 2.2.0 → 2.3.0 bump chain is needed.
   // Sub-migrations run regardless (they're idempotent), so early-return is avoided.
-  // v2.3.0 is the v7.4.0 target — adds optional `accounts[]` (per-account host
+  // v2.3.0 is the v7.4.0 target  -  adds optional `accounts[]` (per-account host
   // overrides) and `recentAccounts[]` (LRU for autopilot account picker).
   // Both default to empty arrays; old prefs continue to validate without them.
   const TARGET = "2.3.0";
   if (out.schemaVersion === TARGET) {
-    // already on target — skip version bump, but still run sub-migrations below
+    // already on target  -  skip version bump, but still run sub-migrations below
   } else if (out.schemaVersion === "2.2.0") {
     out.schemaVersion = TARGET;
     changes.push(`schemaVersion: 2.2.0 → ${TARGET}`);
@@ -173,7 +173,7 @@ function migrate(prefs) {
       out.global.identities = out.global.gitIdentities;
       changes.push(`renamed gitIdentities → identities (${out.global.identities.length} entries)`);
     } else {
-      changes.push("gitIdentities present but identities also exists — keeping identities, dropping gitIdentities");
+      changes.push("gitIdentities present but identities also exists  -  keeping identities, dropping gitIdentities");
     }
     delete out.global.gitIdentities;
   } else if (!Array.isArray(out.global.identities)) {
@@ -181,7 +181,7 @@ function migrate(prefs) {
     changes.push("initialized empty identities array");
   }
 
-  // 4. keychainMapping — expand to 12 services
+  // 4. keychainMapping  -  expand to 12 services
   const km = out.global.keychainMapping || {};
   const kmDefaults = defaultKeychainMapping();
   let kmChanged = false;
@@ -212,7 +212,7 @@ function migrate(prefs) {
     changes.push("added empty recentGroups");
   }
   // v7.4.0: account picker LRU + per-account host overrides.
-  // Both optional — installer initializes to empty arrays so the schema
+  // Both optional  -  installer initializes to empty arrays so the schema
   // validator sees them, but downstream code treats undefined as empty too.
   if (!Array.isArray(out.global.recentAccounts)) {
     out.global.recentAccounts = [];
@@ -277,7 +277,7 @@ function migrate(prefs) {
   consolidateFigma(out, changes);
 
   // 12. v5.7+ sub-migration: promote legacy channel defaults to the new reportChannels /
-  // reportContent / wikiScope structure. Idempotent — safe to re-run.
+  // reportContent / wikiScope structure. Idempotent  -  safe to re-run.
   migrateReportChannels(out, changes);
 
   return { out, changes, alreadyMigrated: changes.length === 0 };
@@ -314,7 +314,7 @@ function migrateReportChannels(out, changes) {
     };
     changes.push("added reportContent defaults {normalAnalysis,technicalAnalysis,testScenarios,autoDiff,manualNote}");
   } else if (!("technicalAnalysis" in g.reportContent)) {
-    // v5.7.3+ — backfill technicalAnalysis onto already-initialized reportContent
+    // v5.7.3+  -  backfill technicalAnalysis onto already-initialized reportContent
     g.reportContent.technicalAnalysis = false;
     changes.push("added reportContent.technicalAnalysis: false (v5.7.3 backfill)");
   }
@@ -323,7 +323,7 @@ function migrateReportChannels(out, changes) {
   if (!Array.isArray(g.wikiScope)) {
     if (g.wikiDefault === false) {
       g.wikiScope = [];
-      changes.push("added wikiScope: [] (legacy wikiDefault=false — opt out of all wiki artifacts)");
+      changes.push("added wikiScope: [] (legacy wikiDefault=false  -  opt out of all wiki artifacts)");
     } else {
       g.wikiScope = ["main", "ios", "screenshots", "index"];
       changes.push("added wikiScope: [main,ios,screenshots,index] (legacy wikiDefault=true or unset)");
@@ -333,7 +333,7 @@ function migrateReportChannels(out, changes) {
   // --- autopilotReportTimeoutSeconds ---
   if (typeof g.autopilotReportTimeoutSeconds !== "number") {
     g.autopilotReportTimeoutSeconds = 1800;
-    changes.push("added autopilotReportTimeoutSeconds: 1800 (30 min) — Phase 7 always-pause timeout");
+    changes.push("added autopilotReportTimeoutSeconds: 1800 (30 min)  -  Phase 7 always-pause timeout");
   }
 
   // --- prune deprecated booleans ---
@@ -371,7 +371,7 @@ function main() {
   const { out, changes, alreadyMigrated } = migrate(prefs);
 
   if (alreadyMigrated) {
-    console.log(`✓ already v2.1.0 — no changes: ${args.file}`);
+    console.log(`✓ already v2.1.0  -  no changes: ${args.file}`);
     process.exit(0);
   }
 
@@ -379,7 +379,7 @@ function main() {
   for (const c of changes) console.log(`  • ${c}`);
 
   if (args.dryRun) {
-    console.log("--- DRY RUN — no write ---");
+    console.log("--- DRY RUN  -  no write ---");
     process.exit(0);
   }
 

package/pipeline/scripts/migrate-state.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * migrate-state.mjs — apply forward migrations to agent-state.json or
+ * migrate-state.mjs  -  apply forward migrations to agent-state.json or
  * multi-agent-preferences.json when the on-disk schemaVersion is older
  * than the repo's current schema.
  *
@@ -15,10 +15,10 @@
  *   node migrate-state.mjs --dry-run <path>         # preview, no write
  *
  * Exit codes:
- *   0 — migration applied (or file already current)
- *   1 — invalid input (unreadable file, malformed JSON, missing schemaVersion)
- *   2 — no migration path (gap in the chain)
- *   3 — migration failed (module error, schemaVersion not set in output)
+ *   0  -  migration applied (or file already current)
+ *   1  -  invalid input (unreadable file, malformed JSON, missing schemaVersion)
+ *   2  -  no migration path (gap in the chain)
+ *   3  -  migration failed (module error, schemaVersion not set in output)
  */
 
 import { readFileSync, writeFileSync, readdirSync, existsSync } from "fs";
@@ -47,7 +47,7 @@ function readSchemaVersion(filename) {
     if (!v) throw new Error(`schemaVersion.const or .enum[-1] missing in ${filename}`);
     return v;
   } catch (err) {
-    console.error(`migrate-state: cannot read ${filename} — ${err.message}`);
+    console.error(`migrate-state: cannot read ${filename}  -  ${err.message}`);
     process.exit(1);
   }
 }
@@ -83,7 +83,7 @@ function resolveType(forced, path) {
   if (/agent-state\.json$/.test(path)) return "state";
   if (/preferences\.json$/.test(path)) return "prefs";
   console.error(
-    `migrate-state: cannot infer type from ${path} — pass --type=state or --type=prefs`,
+    `migrate-state: cannot infer type from ${path}  -  pass --type=state or --type=prefs`,
   );
   process.exit(1);
 }
@@ -142,7 +142,7 @@ async function main() {
   const { type: forced, dryRun, path } = parseArgs();
 
   if (!existsSync(path)) {
-    console.error(`migrate-state: file not found — ${path}`);
+    console.error(`migrate-state: file not found  -  ${path}`);
     process.exit(1);
   }
 
@@ -151,7 +151,7 @@ async function main() {
   try {
     doc = JSON.parse(readFileSync(path, "utf-8"));
   } catch (err) {
-    console.error(`migrate-state: invalid JSON in ${path} — ${err.message}`);
+    console.error(`migrate-state: invalid JSON in ${path}  -  ${err.message}`);
     process.exit(1);
   }
 
@@ -165,7 +165,7 @@ async function main() {
   }
 
   if (from === to) {
-    console.log(`${path} already at schemaVersion ${to} — no migration needed`);
+    console.log(`${path} already at schemaVersion ${to}  -  no migration needed`);
     process.exit(0);
   }
 
@@ -193,7 +193,7 @@ async function main() {
         );
       }
     } catch (err) {
-      console.error(`migrate-state: migration failed — ${err.message}`);
+      console.error(`migrate-state: migration failed  -  ${err.message}`);
       process.exit(3);
     }
   }
@@ -210,6 +210,6 @@ async function main() {
 }
 
 main().catch((err) => {
-  console.error(`migrate-state: unhandled — ${err.message}`);
+  console.error(`migrate-state: unhandled  -  ${err.message}`);
   process.exit(3);
 });

package/pipeline/scripts/output-quality-check.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# output-quality-check.sh — runs all output validators against the latest
+# output-quality-check.sh  -  runs all output validators against the latest
 # task's artifacts (commit message, PR body, Jira comment) and reports a
 # pass/fail summary suitable for pre-push gating.
 #
-# Validators (best-effort — skips silently when a target is absent):
-#   1. Commit message format (regex from §15 of REFACTOR_PLAN_v3.7.md)
-#   2. PR body — real newlines, no HTML entities, required sections present
-#   3. Jira comment format — real newlines, no \n literal, no HTML entities
-#   4. Reviewer JSON — runs validate-reviewer.mjs (already exists)
-#   5. Triage JSON   — runs validate-triage.mjs (already exists)
+# Validators (best-effort  -  skips silently when a target is absent):
+#   1. Commit message format (regex from section15 of REFACTOR_PLAN_v3.7.md)
+#   2. PR body  -  real newlines, no HTML entities, required sections present
+#   3. Jira comment format  -  real newlines, no \n literal, no HTML entities
+#   4. Reviewer JSON  -  runs validate-reviewer.mjs (already exists)
+#   5. Triage JSON    -  runs validate-triage.mjs (already exists)
 #
 # Usage:
 #   output-quality-check.sh [--task <task_id>] [--strict]

package/pipeline/scripts/phase-banner.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# phase-banner.sh — print a phase / sub-phase progress banner to the terminal.
+# phase-banner.sh  -  print a phase / sub-phase progress banner to the terminal.
 #
 # Cross-CLI: works identically from Claude Code, Copilot CLI, or a plain shell.
 # Claude Code ALSO uses TaskCreate/TaskUpdate for inline UI cards, but those
-# are Claude-only — Copilot users wouldn't see anything without this script.
+# are Claude-only  -  Copilot users wouldn't see anything without this script.
 #
 # Usage:
 #   phase-banner.sh start <phase>           [name] [detail]
@@ -19,12 +19,12 @@
 # Status values for `end`: done | failed | skipped
 #
 # Localization:
-#   PHASE_LANG=en (default) | tr — when set to tr, canonical labels resolve to
+#   PHASE_LANG=en (default) | tr  -  when set to tr, canonical labels resolve to
 #   Turkish. The `auto` sentinel in place of [name] triggers a table lookup.
 #   Canonical label set mirrors pipeline/commands/multi-agent/refs/phases.md.
 #
 # Output is colored when stdout is a TTY (TERM != dumb). Plain otherwise so
-# logs and CI artifacts stay readable. Always written to stdout — log
+# logs and CI artifacts stay readable. Always written to stdout  -  log
 # capture is the caller's responsibility.
 
 set -uo pipefail
@@ -136,7 +136,7 @@ case "$ACTION" in
         echo "phase-banner: unknown status '$STATUS' (use done|failed|skipped)" >&2
         exit 64 ;;
     esac
-    printf "${C_BOLD}${COLOR}└─ %s %s%s — %s %s${C_RESET}" \
+    printf "${C_BOLD}${COLOR}└─ %s %s%s  -  %s %s${C_RESET}" \
       "$PHASE_WORD" "$PHASE" "${NAME:+: $NAME}" "$GLYPH" "$STATUS"
     [ -n "$DETAIL" ] && printf " ${C_DIM}(%s)${C_RESET}" "$DETAIL"
     printf "  ${C_DIM}%s${C_RESET}\n\n" "$(ts)"

package/pipeline/scripts/phase-tracker.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# phase-tracker.sh — stateful card-stack pipeline tracker, cross-CLI.
+# phase-tracker.sh  -  stateful card-stack pipeline tracker, cross-CLI.
 #
 # Why this exists: Claude Code has TaskCreate/TaskUpdate which renders
 # native UI cards. Copilot CLI has nothing equivalent. This script gives
@@ -31,7 +31,7 @@
 #   Each line is an OTLP-compatible JSON span with trace_id/span_id derived
 #   from the task_id, phase_id, and timestamp. Format intentionally simple
 #   so an OTel Collector's `filelog` receiver can tail + forward without a
-#   protobuf build step. Emission is never fatal — if jq is missing or the
+#   protobuf build step. Emission is never fatal  -  if jq is missing or the
 #   log dir isn't writable, we silently skip. Default OFF so users without
 #   an observability stack see zero behavior change.
 #
@@ -74,6 +74,13 @@ if [ -z "$TRACKER_FILE" ]; then
     TASK_ID_FROM_ENV="$1"
   fi
   if [ -z "$TASK_ID_FROM_ENV" ]; then
+    # Strict mode: refuse the global pointer fallback entirely. Concurrent-safe by
+    # construction  -  the orchestrator must export MULTI_AGENT_TASK_ID. Opt in with
+    # MULTI_AGENT_STRICT_TASK_ID=1 (recommended whenever more than one run can be live).
+    if [ "${MULTI_AGENT_STRICT_TASK_ID:-0}" = "1" ]; then
+      echo "phase-tracker: MULTI_AGENT_STRICT_TASK_ID=1 but no MULTI_AGENT_TASK_ID in scope; refusing global pointer fallback. Export MULTI_AGENT_TASK_ID=<id>." >&2
+      exit 64
+    fi
     # Fallback to the file written by the most recent init.
     # WARNING: this pointer is global and flips when ANY shell on this user account runs
     # `phase-tracker.sh init <other-task>`. In concurrent multi-agent runs (two terminals,
@@ -84,7 +91,7 @@ if [ -z "$TRACKER_FILE" ]; then
       TRACKER_FILE="$(cat "$POINTER")"
       if [ "${MULTI_AGENT_QUIET:-0}" != "1" ]; then
         POINTER_TASK=$(basename "$(dirname "$TRACKER_FILE")")
-        echo "phase-tracker: WARN — using pointer fallback (task=$POINTER_TASK). Pass MULTI_AGENT_TASK_ID=<id> for concurrent-safe resolution." >&2
+        echo "phase-tracker: WARN  -  using pointer fallback (task=$POINTER_TASK). Pass MULTI_AGENT_TASK_ID=<id> for concurrent-safe resolution." >&2
       fi
     else
       echo "phase-tracker: no task in scope; run 'init <task_id>' first or set MULTI_AGENT_TASK_ID" >&2
@@ -103,14 +110,14 @@ need_jq() {
   }
 }
 
-# OTel-compatible span emission — v6.1.0+, opt-in via $MULTI_AGENT_OTEL_SPANS.
+# OTel-compatible span emission  -  v6.1.0+, opt-in via $MULTI_AGENT_OTEL_SPANS.
 # Appends one JSON line to otel-spans.jsonl. Never fatal on failure.
 #
 # Args:
 #   $1 = event_name (e.g. "phase.update", "phase.sub", "phase.tokens")
 #   $2 = phase_id (required)
 #   $3 = status or subject (string, optional)
-#   $4 = attributes (JSON object string, optional — merged into span.attributes)
+#   $4 = attributes (JSON object string, optional  -  merged into span.attributes)
 emit_otel_span() {
   [ "${MULTI_AGENT_OTEL_SPANS:-0}" = "1" ] || return 0
   command -v jq >/dev/null 2>&1 || return 0
@@ -180,7 +187,7 @@ glyph_for() {
   esac
 }
 
-# Current time in epoch seconds (portable — works on both BSD and GNU date).
+# Current time in epoch seconds (portable  -  works on both BSD and GNU date).
 now_epoch() {
   date +%s
 }
@@ -252,11 +259,48 @@ render() {
   state="$(load_state)"
   local task_id
   task_id=$(echo "$state" | jq -r '.task_id') || {
-    echo "phase-tracker: corrupted state file — cannot parse task_id" >&2
+    echo "phase-tracker: corrupted state file  -  cannot parse task_id" >&2
     exit 65
   }
-  local phase_count
-  phase_count=$(echo "$state" | jq '.phases | length')
+
+  # Batched extraction: one jq pass emits all phase fields so the render loop
+  # does not spawn ~16 jq subprocesses per phase. Sub-phases, meta entries,
+  # and the total-tokens footer are batched separately below.
+  #
+  # Separator: U+001F (ASCII Unit Separator), a non-whitespace control char.
+  # Tab cannot be used here because bash `read` with `IFS=$'\t'` collapses
+  # consecutive tabs (tab is in the default whitespace IFS class), which
+  # silently drops empty middle columns and shifts later fields.
+  # Column order:  status, started_at, completed_at, id, name,
+  #                tokens_in, tokens_out, sub_count, meta_keys_csv
+  local phase_data
+  phase_data=$(echo "$state" | jq -r '
+    .phases // [] | .[] | [
+      (.status // ""),
+      (.started_at // ""),
+      (.completed_at // ""),
+      (.id // ""),
+      (.name // ""),
+      ((.tokens_in // 0) | tostring),
+      ((.tokens_out // 0) | tostring),
+      ((.subs // []) | length | tostring),
+      ((.meta // {}) | keys_unsorted | join(","))
+    ] | join("")
+  ')
+
+  local phase_count=0
+  local -a row_status=() row_started=() row_completed=() row_id=() row_name=()
+  local -a row_tin=() row_tout=() row_subcount=() row_metakeys=()
+  if [ -n "$phase_data" ]; then
+    local _s _st _ed _id _nm _ti _to _sc _mk
+    while IFS=$'\x1f' read -r _s _st _ed _id _nm _ti _to _sc _mk; do
+      row_status+=("$_s"); row_started+=("$_st"); row_completed+=("$_ed")
+      row_id+=("$_id");    row_name+=("$_nm")
+      row_tin+=("$_ti");   row_tout+=("$_to")
+      row_subcount+=("$_sc"); row_metakeys+=("$_mk")
+      phase_count=$((phase_count + 1))
+    done <<< "$phase_data"
+  fi
 
   # Elapsed seconds per phase. No bar; just label.
   #   completed/failed/skipped → completed_at - started_at (stamped)
@@ -266,10 +310,10 @@ render() {
   local -a elapsed_arr=()
   local i=0
   while [ "$i" -lt "$phase_count" ]; do
-    local pstatus s_iso e_iso s_ep e_ep el=""
-    pstatus=$(echo "$state" | jq -r ".phases[$i].status")
-    s_iso=$(echo "$state"   | jq -r ".phases[$i].started_at   // \"\"")
-    e_iso=$(echo "$state"   | jq -r ".phases[$i].completed_at // \"\"")
+    local pstatus="${row_status[$i]}"
+    local s_iso="${row_started[$i]}"
+    local e_iso="${row_completed[$i]}"
+    local s_ep e_ep el=""
     s_ep=$(iso_to_epoch "$s_iso")
     e_ep=$(iso_to_epoch "$e_iso")
     if [ -n "$s_ep" ]; then
@@ -299,10 +343,9 @@ render() {
     # Iterate phases.
     i=0
     while [ "$i" -lt "$phase_count" ]; do
-      local pid pname pstatus
-      pid=$(echo "$state"     | jq -r ".phases[$i].id")
-      pname=$(echo "$state"   | jq -r ".phases[$i].name")
-      pstatus=$(echo "$state" | jq -r ".phases[$i].status")
+      local pid="${row_id[$i]}"
+      local pname="${row_name[$i]}"
+      local pstatus="${row_status[$i]}"
       local g
       g=$(glyph_for "$pstatus")
 
@@ -318,10 +361,10 @@ render() {
         skipped)     el_color="${C_YELLOW}" ;;
       esac
 
-      local p_tin p_tout p_ttotal tok_label=""
-      p_tin=$(echo  "$state" | jq -r ".phases[$i].tokens_in  // 0")
-      p_tout=$(echo "$state" | jq -r ".phases[$i].tokens_out // 0")
-      p_ttotal=$((p_tin + p_tout))
+      local p_tin="${row_tin[$i]}"
+      local p_tout="${row_tout[$i]}"
+      local p_ttotal=$((p_tin + p_tout))
+      local tok_label=""
       [ "$p_ttotal" -gt 0 ] && tok_label="$(format_tokens $p_ttotal) tok"
 
       local right_block=""
@@ -338,43 +381,43 @@ render() {
 
       # Meta block: only for active (in_progress) phase. Pretty-print key/value
       # in insertion order so the pipeline's narrative sequence is preserved.
-      if [ "$pstatus" = "in_progress" ]; then
-        local meta_keys
-        meta_keys=$(echo "$state" | jq -r ".phases[$i].meta // {} | keys_unsorted[]" 2>/dev/null)
-        if [ -n "$meta_keys" ]; then
-          local key val
-          while IFS= read -r key; do
-            [ -z "$key" ] && continue
-            val=$(echo "$state" | jq -r ".phases[$i].meta[\"$key\"]")
-            printf "${C_BOLD}${C_BLUE}│${C_RESET}      ${C_DIM}%-10s${C_RESET}  %s\n" "${key}:" "$val"
-          done <<< "$meta_keys"
-        fi
+      # Meta values are fetched in a single jq pass per active phase (rare).
+      # Same Unit Separator rationale as the phase batch above.
+      if [ "$pstatus" = "in_progress" ] && [ -n "${row_metakeys[$i]}" ]; then
+        local meta_data key val
+        meta_data=$(echo "$state" | jq -r --argjson idx "$i" '
+          .phases[$idx].meta // {} | to_entries[] | [.key, (.value | tostring)] | join("")
+        ')
+        while IFS=$'\x1f' read -r key val; do
+          [ -z "$key" ] && continue
+          printf "${C_BOLD}${C_BLUE}│${C_RESET}      ${C_DIM}%-10s${C_RESET}  %s\n" "${key}:" "$val"
+        done <<< "$meta_data"
       fi
 
-      # Sub-phases (if any).
-      local sub_count
-      sub_count=$(echo "$state" | jq ".phases[$i].subs // [] | length")
-      if [ "$sub_count" != "0" ]; then
+      # Sub-phases  -  batched per parent phase via a single jq call. Same
+      # Unit Separator rationale as the phase batch above.
+      local sub_count="${row_subcount[$i]}"
+      if [ "$sub_count" != "0" ] && [ "$sub_count" -gt 0 ] 2>/dev/null; then
+        local sub_data
+        sub_data=$(echo "$state" | jq -r --argjson idx "$i" '
+          .phases[$idx].subs // [] | .[] | [(.id // ""), (.name // ""), (.status // "")] | join("")
+        ')
         local j=0
-        while [ "$j" -lt "$sub_count" ]; do
-          local sid sname sstatus
-          sid=$(echo "$state"     | jq -r ".phases[$i].subs[$j].id")
-          sname=$(echo "$state"   | jq -r ".phases[$i].subs[$j].name")
-          sstatus=$(echo "$state" | jq -r ".phases[$i].subs[$j].status")
-          local sg
+        local sid sname sstatus sg connector
+        while IFS=$'\x1f' read -r sid sname sstatus; do
           sg=$(glyph_for "$sstatus")
-          local connector="├─"
+          connector="├─"
           if [ "$j" = "$((sub_count - 1))" ]; then connector="└─"; fi
           printf "${C_BOLD}${C_BLUE}│${C_RESET}      ${connector} %b  ${C_DIM}%s.%s${C_RESET}  %s\n" \
             "$sg" "$pid" "$sid" "$sname"
           j=$((j+1))
-        done
+        done <<< "$sub_data"
       fi
       i=$((i+1))
     done
   fi
 
-  # Total-tokens footer (v5.5.0) — sum phases[].tokens_in + tokens_out.
+  # Total-tokens footer (v5.5.0)  -  sum phases[].tokens_in + tokens_out.
   local total_tokens
   total_tokens=$(echo "$state" | jq '[.phases[] | ((.tokens_in // 0) + (.tokens_out // 0))] | add // 0')
   if [ "$total_tokens" -gt 0 ]; then
@@ -406,7 +449,7 @@ case "$ACTION" in
     render
     if [ "${MULTI_AGENT_QUIET:-0}" != "1" ]; then
       echo "phase-tracker: tracker initialized for task=$TASK_ID" >&2
-      echo "phase-tracker: TIP — for concurrent-safe resolution, set:" >&2
+      echo "phase-tracker: TIP  -  for concurrent-safe resolution, set:" >&2
       echo "    export MULTI_AGENT_TASK_ID=$TASK_ID" >&2
     fi
     ;;
@@ -477,24 +520,25 @@ case "$ACTION" in
 
   tokens)
     need_jq
-    [ "$#" -ge 3 ] || { echo "tokens needs <phase_id> <in> <out>" >&2; exit 64; }
-    PID="$1"; T_IN="$2"; T_OUT="$3"
-    # Validate integers.
-    case "$T_IN$T_OUT" in
-      *[!0-9]*) echo "tokens: in/out must be non-negative integers" >&2; exit 64 ;;
+    [ "$#" -ge 3 ] || { echo "tokens needs <phase_id> <in> <out> [cached]" >&2; exit 64; }
+    PID="$1"; T_IN="$2"; T_OUT="$3"; T_CACHED="${4:-0}"
+    # Validate integers (cached is optional, defaults to 0 for back-compat).
+    case "$T_IN$T_OUT$T_CACHED" in
+      *[!0-9]*) echo "tokens: in/out/cached must be non-negative integers" >&2; exit 64 ;;
     esac
     state=$(load_state)
     # Additive: add to existing totals so multiple LLM calls accumulate.
-    new=$(echo "$state" | jq --arg id "$PID" --argjson ti "$T_IN" --argjson to "$T_OUT" '
+    new=$(echo "$state" | jq --arg id "$PID" --argjson ti "$T_IN" --argjson to "$T_OUT" --argjson tc "$T_CACHED" '
       .phases |= map(
         if .id == $id then
           .tokens_in  = ((.tokens_in  // 0) + $ti)
           | .tokens_out = ((.tokens_out // 0) + $to)
+          | (if $tc > 0 then .tokens_cached = ((.tokens_cached // 0) + $tc) else . end)
         else . end
       )
     ')
     save_state "$new"
-    emit_otel_span "phase.tokens" "$PID" "" "{\"multi_agent.tokens_in_delta\": $T_IN, \"multi_agent.tokens_out_delta\": $T_OUT}"
+    emit_otel_span "phase.tokens" "$PID" "" "{\"multi_agent.tokens_in_delta\": $T_IN, \"multi_agent.tokens_out_delta\": $T_OUT, \"multi_agent.tokens_cached_delta\": $T_CACHED}"
     # Re-render so live token count is visible on the active phase. Callers
     # that want silent accumulation (e.g. tight loops) can suppress with
     # TRACKER_QUIET=1 to skip the re-render but still write state.

package/pipeline/scripts/pre-commit-check.sh

@@ -5,15 +5,17 @@
 
 set -uo pipefail
 
-STAGED_FILES=$(git diff --cached --name-only 2>/dev/null)
-
-if [ -z "$STAGED_FILES" ]; then
+if [ -z "$(git diff --cached --name-only 2>/dev/null)" ]; then
   exit 0
 fi
 
 FOUND=0
 
-for file in $STAGED_FILES; do
+# NUL-delimited so filenames with spaces are scanned (a space-split loop would
+# silently skip them - a secret false-negative). Process substitution keeps the
+# loop in the current shell so FOUND survives.
+while IFS= read -r -d '' file; do
+  [ -z "$file" ] && continue
   [ ! -f "$file" ] && continue
   file "$file" 2>/dev/null | grep -q "binary" && continue
 
@@ -58,7 +60,45 @@ for file in $STAGED_FILES; do
     echo "BLOCKED: Service account JSON in $file"
     FOUND=1
   fi
-done
+
+  # High-signal provider token prefixes (low false-positive rate)
+  if echo "$content" | grep -qE '(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,}|xox[baprs]-[A-Za-z0-9-]{12,}|sk_live_[A-Za-z0-9]{20,}|rk_live_[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|npm_[A-Za-z0-9]{36}|glpat-[A-Za-z0-9_-]{20,}'; then
+    echo "BLOCKED: Provider access token in $file"
+    FOUND=1
+  fi
+
+  # JWT (three base64url segments  -  header.payload.signature)
+  if echo "$content" | grep -qE 'eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'; then
+    echo "BLOCKED: JWT in $file"
+    FOUND=1
+  fi
+
+  # High-entropy string scan  -  catches custom/unknown secrets the prefix
+  # patterns miss. Skips lockfiles, integrity hashes, source maps, and snapshot
+  # fixtures, which legitimately carry high-entropy non-secret content.
+  if ! echo "$file" | grep -qiE '(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|Podfile\.lock|Cartfile\.resolved|Package\.resolved|\.lock$|\.map$|__snapshots__|\.snap$|\.min\.(js|css)$)'; then
+    candidates=$(echo "$content" | grep -oE '[A-Za-z0-9+/=_-]{40,}' || true)
+    if [ -n "$candidates" ]; then
+      entropy_hit=$(printf '%s\n' "$candidates" | awk '
+        {
+          s=$0; n=length(s);
+          if (n < 40) next;
+          if (s ~ /^[0-9]+$/) next;        # pure digits
+          if (s ~ /^[0-9a-f]+$/) next;     # lowercase hex (git sha / md5 / sha-*)
+          if (s ~ /^[0-9A-F]+$/) next;     # uppercase hex
+          delete freq;
+          for (i = 1; i <= n; i++) { c = substr(s, i, 1); freq[c]++ }
+          H = 0;
+          for (c in freq) { p = freq[c] / n; H -= p * log(p) / log(2) }
+          if (H >= 4.2) { print s; exit }
+        }')
+      if [ -n "$entropy_hit" ]; then
+        echo "BLOCKED: High-entropy string (possible secret) in $file"
+        FOUND=1
+      fi
+    fi
+  fi
+done < <(git diff --cached --name-only -z 2>/dev/null)
 
 if [ $FOUND -eq 1 ]; then
   echo ""

package/pipeline/scripts/pre-push-check.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
-# pre-push-check.sh — primary gate before every push.
+# pre-push-check.sh  -  primary gate before every push.
 #
 # Purpose:
-#   This repo has no GitHub Actions workflow — every push is validated
+#   This repo has no GitHub Actions workflow  -  every push is validated
 #   locally. Unit tests, smoke suites, eval fixtures, schema validation,
 #   and the personal-data leak check all run here before `git push` is
 #   allowed to proceed.
@@ -15,9 +15,9 @@
 #   bash pipeline/scripts/pre-push-check.sh
 #
 # Exit codes:
-#   0 — all gates passed, safe to push
-#   1 — a gate failed (test, lint, schema, or personal-data leak)
-#   2 — environment problem (node missing, npm missing, wrong cwd)
+#   0  -  all gates passed, safe to push
+#   1  -  a gate failed (test, lint, schema, or personal-data leak)
+#   2  -  environment problem (node missing, npm missing, wrong cwd)
 
 set -uo pipefail
 
@@ -33,7 +33,7 @@ if ! command -v npm >/dev/null 2>&1; then
   exit 2
 fi
 
-echo "→ Running local CI gate (primary — no GitHub Actions workflow exists)"
+echo "→ Running local CI gate (primary  -  no GitHub Actions workflow exists)"
 echo ""
 
 FAILED=0
@@ -73,5 +73,5 @@ if [ "$FAILED" -gt 0 ]; then
   exit 1
 fi
 
-echo "✓ All gates passed — safe to push"
+echo "✓ All gates passed  -  safe to push"
 exit 0