aidevops 3.34.8 → 3.34.10

package/README.md

@@ -25,7 +25,7 @@ token efficiency, and quality control built in.**
 [![Maintainability](https://qlty.sh/gh/marcusquinn/projects/aidevops/maintainability.svg)](https://qlty.sh/gh/marcusquinn/projects/aidevops)
 [![Codacy Badge](https://app.codacy.com/project/badge/Grade/2b1adbd66c454dae92234341e801b984)](https://app.codacy.com/gh/marcusquinn/aidevops/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/Version-3.34.8-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.34.10-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 

package/VERSION

@@ -1 +1 @@
-3.34.8
+3.34.10

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.34.8
+# Version: 3.34.10
 
 set -euo pipefail
 
@@ -310,7 +310,17 @@ _run_update_source_access_reconciliation() {
 		return 0
 	fi
 
-	print_warning "AIDEVOPS_DEFERRED_ACTION action=source-access-reconcile command='aidevops setup --scope source-access'"
+	if [[ -t 0 && -t 1 ]]; then
+		print_info "Reconciling the protected source-access broker..."
+		if AIDEVOPS_SOURCE_ACCESS_INTERACTIVE=true bash "$INSTALL_DIR/setup.sh" --stage source-access; then
+			print_success "Protected source-access broker reconciled"
+			return 0
+		fi
+		print_warning "Source-access broker maintenance was blocked; it will retry during the next interactive update"
+		return 0
+	fi
+
+	print_warning "Source-access broker maintenance requires an attached terminal for privilege confirmation; the next interactive update will retry automatically"
 	return 0
 }
 
@@ -347,19 +357,10 @@ cmd_update_help() {
 }
 
 cmd_update() {
-	# Update is operational, not compositional. Do not let any reachable Git,
-	# package-manager, migration, or setup subprocess inherit an editor or pager.
-	# Local declarations restore the caller's environment when this function exits.
-	local EDITOR=/usr/bin/false
-	local VISUAL=/usr/bin/false
-	local GIT_EDITOR=/usr/bin/false
-	local GIT_SEQUENCE_EDITOR=/usr/bin/false
-	local GIT_PAGER=cat
-	local PAGER=cat
-	local GIT_TERMINAL_PROMPT=0
+	local EDITOR=/usr/bin/false VISUAL=/usr/bin/false GIT_EDITOR=/usr/bin/false
+	local GIT_SEQUENCE_EDITOR=/usr/bin/false GIT_PAGER="cat" PAGER="cat" GIT_TERMINAL_PROMPT=0
 	export EDITOR VISUAL GIT_EDITOR GIT_SEQUENCE_EDITOR GIT_PAGER PAGER GIT_TERMINAL_PROMPT
 	local skip_project_sync=false
-	local reconcile_repo_verify=false
 	local update_output_mode="${AIDEVOPS_OUTPUT_MODE:-auto}"
 	local arg
 	for arg in "$@"; do
@@ -375,122 +376,128 @@ cmd_update() {
 	current_version=$(get_version)
 	print_info "Current version: $current_version"
 	print_info "Fetching latest version..."
+	_AIDEVOPS_UPDATE_RECONCILE_REPO_VERIFY=false
+	_update_install_framework "$current_version" "$update_output_mode" || return 1
+	_update_finish "$skip_project_sync"
+	return 0
+}
 
+_update_install_framework() {
+	local current_version="$1" update_output_mode="$2"
 	if check_dir "$INSTALL_DIR/.git"; then
-		cd "$INSTALL_DIR" || exit 1
-		if ! git diff --quiet 2>/dev/null || ! git diff --cached --quiet 2>/dev/null; then
-			print_error "Refusing to update: tracked local changes exist in $INSTALL_DIR"
-			git status --short
-			print_info "Commit or stash these changes, then rerun aidevops update."
-			return 1
-		fi
-		local current_branch
-		current_branch=$(git branch --show-current 2>/dev/null || echo "")
-		if [[ "$current_branch" != "main" ]]; then
-			print_info "Switching to main branch..."
-			if ! git checkout main --quiet 2>/dev/null && ! git checkout -b main origin/main --quiet 2>/dev/null; then
-				print_error "Failed to switch to main; refusing to update the active '$current_branch' branch."
-				return 1
-			fi
-		fi
-		local local_hash
-		local_hash=$(git rev-parse HEAD) || return 1
-		if ! _update_fetch_main main; then
-			print_error "Failed to fetch origin/main; no update was applied."
-			return 1
-		fi
-		local remote_hash
-		remote_hash=$(git rev-parse origin/main) || return 1
-		if [[ "$local_hash" != "$remote_hash" ]] && git merge-base --is-ancestor "$remote_hash" "$local_hash" 2>/dev/null; then
-			print_error "Refusing to update: local commits exist on main."
-			print_info "Preserve or reconcile the local history in $INSTALL_DIR, then rerun aidevops update."
+		_update_existing_install "$current_version" "$update_output_mode" || return 1
+	else
+		_update_fresh_install || return 1
+	fi
+	return 0
+}
+
+_update_existing_install() {
+	local current_version="$1" update_output_mode="$2"
+	cd "$INSTALL_DIR" || exit 1
+	if ! git diff --quiet 2>/dev/null || ! git diff --cached --quiet 2>/dev/null; then
+		print_error "Refusing to update: tracked local changes exist in $INSTALL_DIR"
+		git status --short
+		print_info "Commit or stash these changes, then rerun aidevops update."
+		return 1
+	fi
+	local current_branch
+	current_branch=$(git branch --show-current 2>/dev/null || echo "")
+	if [[ "$current_branch" != "main" ]]; then
+		print_info "Switching to main branch..."
+		if ! git checkout main --quiet 2>/dev/null && ! git checkout -b main origin/main --quiet 2>/dev/null; then
+			print_error "Failed to switch to main; refusing to update the active '$current_branch' branch."
 			return 1
 		fi
-		if [[ "$local_hash" == "$remote_hash" ]]; then
-			print_success "Framework already up to date!"
-			local repo_version deployed_version
-			repo_version=$(cat "$INSTALL_DIR/VERSION" 2>/dev/null || echo "unknown")
-			deployed_version=$(cat "$HOME/.aidevops/agents/VERSION" 2>/dev/null || echo "none")
-			if [[ "$repo_version" != "$deployed_version" ]]; then
-				print_warning "Deployed agents ($deployed_version) don't match repo ($repo_version)"
-				print_info "Re-running incremental setup to sync agents..."
-				_run_update_setup_transaction "$update_output_mode" "$local_hash" || return 1
-			else
-				# t2706: VERSION matches but .deployed-sha may lag HEAD when
-				# fixes land between releases. Detect and redeploy on framework
-				# code drift (inline so bootstrap doesn't depend on the deployed
-				# aidevops-update-check.sh already carrying the same check).
-				# Docs-only drift is intentionally skipped — no runtime impact.
-				local stamp_file="$HOME/.aidevops/.deployed-sha"
-				if [[ -f "$stamp_file" ]]; then
-					local deployed_sha has_code_drift=0
-					deployed_sha=$(tr -d '[:space:]' <"$stamp_file" 2>/dev/null) || deployed_sha=""
-					if [[ -n "$deployed_sha" && "$deployed_sha" != "$local_hash" ]]; then
-						if _update_repo_verify_files_changed "$deployed_sha" "$local_hash"; then reconcile_repo_verify=true; fi
-						# Per Gemini code-review on PR #20342: use git's path filter +
-						# `grep -q .` to detect drift across the full set of deploy-affecting
-						# paths (not just .agents/ subdirs — also setup.sh, .agents/scripts/setup/modules/,
-						# and aidevops.sh itself, which are deployed/sourced by setup).
-						if git -C "$INSTALL_DIR" diff --name-only "$deployed_sha" "$local_hash" -- \
-							.agents/scripts/ .agents/agents/ .agents/workflows/ .agents/prompts/ .agents/hooks/ \
-							setup.sh .agents/scripts/setup/modules/ aidevops.sh 2>/dev/null | grep -q .; then
-							has_code_drift=1
-						fi
-						if [[ "$has_code_drift" -eq 1 ]]; then
-							print_warning "Deployed scripts drifted (${deployed_sha:0:7}→${local_hash:0:7})"
-							print_info "Re-running incremental setup to deploy latest scripts..."
-							_run_update_setup_transaction "$update_output_mode" "$local_hash" || return 1
-						fi
-						# GH#21735: workflow templates can change between
-						# releases without triggering has_code_drift (templates
-						# live outside the deploy-affecting paths). Check the
-						# template subset separately and surface drift.
-						_update_check_workflow_drift "$deployed_sha" "$local_hash"
-					fi
-				fi
-			fi
-		else
-			print_info "Applying latest changes..."
-			local old_hash
-			old_hash="$local_hash"
-			if [[ "${_AIDEVOPS_UPDATE_CANONICAL_FAST_FORWARDED:-false}" == "true" ]]; then
-				:
-			elif git merge --ff-only "$remote_hash" --quiet; then
-				:
-			else
-				print_error "Fast-forward update failed; preserving local history."
-				print_info "Review $INSTALL_DIR, resolve the divergence, then rerun aidevops update."
-				return 1
-			fi
-			local new_version new_hash
-			new_version=$(get_version)
-			new_hash=$(git rev-parse HEAD)
-			if [[ "$new_hash" != "$remote_hash" ]]; then
-				print_error "Updated HEAD does not match the fetched origin/main commit; refusing to run setup."
-				return 1
-			fi
-			if [[ "$old_hash" != "$new_hash" ]]; then
-				if _update_repo_verify_files_changed "$old_hash" "$new_hash"; then reconcile_repo_verify=true; fi
-				_update_render_changelog "$old_hash" "$new_hash" "$current_version"
-				# GH#21735: surface workflow template drift so the
-				# operator can resync downstream callers before CI bites.
-				_update_check_workflow_drift "$old_hash" "$new_hash"
-			fi
-			echo ""
-			# Verify supply chain integrity before applying changes
-			_update_verify_signature
-			echo ""
-			print_info "Running incremental setup to apply changes (falls back to full setup if needed)..."
-			_run_update_setup_transaction "$update_output_mode" "$new_hash" || return 1
-			print_success "Updated to version $new_version (agents deployed)"
-		fi
+	fi
+	local local_hash remote_hash
+	local_hash=$(git rev-parse HEAD) || return 1
+	if ! _update_fetch_main main; then
+		print_error "Failed to fetch origin/main; no update was applied."
+		return 1
+	fi
+	remote_hash=$(git rev-parse origin/main) || return 1
+	if [[ "$local_hash" != "$remote_hash" ]] && git merge-base --is-ancestor "$remote_hash" "$local_hash" 2>/dev/null; then
+		print_error "Refusing to update: local commits exist on main."
+		print_info "Preserve or reconcile the local history in $INSTALL_DIR, then rerun aidevops update."
+		return 1
+	fi
+	if [[ "$local_hash" == "$remote_hash" ]]; then
+		_update_already_current "$local_hash" "$update_output_mode"
 	else
-		_update_fresh_install || return 1
+		_update_apply_remote "$local_hash" "$remote_hash" "$current_version" "$update_output_mode"
 	fi
+	return 0
+}
+
+_update_already_current() {
+	local local_hash="$1" update_output_mode="$2"
+	print_success "Framework already up to date!"
+	local repo_version deployed_version
+	repo_version=$(cat "$INSTALL_DIR/VERSION" 2>/dev/null || echo "unknown")
+	deployed_version=$(cat "$HOME/.aidevops/agents/VERSION" 2>/dev/null || echo "none")
+	if [[ "$repo_version" != "$deployed_version" ]]; then
+		print_warning "Deployed agents ($deployed_version) don't match repo ($repo_version)"
+		print_info "Re-running incremental setup to sync agents..."
+		_run_update_setup_transaction "$update_output_mode" "$local_hash"
+		return $?
+	fi
+	local stamp_file="$HOME/.aidevops/.deployed-sha" deployed_sha=""
+	[[ -f "$stamp_file" ]] || return 0
+	deployed_sha=$(tr -d '[:space:]' <"$stamp_file" 2>/dev/null) || deployed_sha=""
+	[[ -n "$deployed_sha" && "$deployed_sha" != "$local_hash" ]] || return 0
+	if _update_repo_verify_files_changed "$deployed_sha" "$local_hash"; then _AIDEVOPS_UPDATE_RECONCILE_REPO_VERIFY=true; fi
+	if git -C "$INSTALL_DIR" diff --name-only "$deployed_sha" "$local_hash" -- .agents/scripts/ .agents/agents/ .agents/workflows/ .agents/prompts/ .agents/hooks/ setup.sh .agents/scripts/setup/modules/ aidevops.sh 2>/dev/null | grep -q .; then
+		print_warning "Deployed scripts drifted (${deployed_sha:0:7}→${local_hash:0:7})"
+		print_info "Re-running incremental setup to deploy latest scripts..."
+		_run_update_setup_transaction "$update_output_mode" "$local_hash" || return 1
+	fi
+	_update_check_workflow_drift "$deployed_sha" "$local_hash"
+	return 0
+}
+
+_update_apply_remote() {
+	local old_hash="$1" remote_hash="$2" current_version="$3" update_output_mode="$4"
+	print_info "Applying latest changes..."
+	if [[ "${_AIDEVOPS_UPDATE_CANONICAL_FAST_FORWARDED:-false}" != "true" ]] && ! git merge --ff-only "$remote_hash" --quiet; then
+		print_error "Fast-forward update failed; preserving local history."
+		print_info "Review $INSTALL_DIR, resolve the divergence, then rerun aidevops update."
+		return 1
+	fi
+	local new_version new_hash
+	new_version=$(get_version)
+	new_hash=$(git rev-parse HEAD)
+	if [[ "$new_hash" != "$remote_hash" ]]; then
+		print_error "Updated HEAD does not match the fetched origin/main commit; refusing to run setup."
+		return 1
+	fi
+	if [[ "$old_hash" != "$new_hash" ]]; then
+		if _update_repo_verify_files_changed "$old_hash" "$new_hash"; then _AIDEVOPS_UPDATE_RECONCILE_REPO_VERIFY=true; fi
+		_update_render_changelog "$old_hash" "$new_hash" "$current_version"
+		_update_check_workflow_drift "$old_hash" "$new_hash"
+	fi
+	echo ""
+	_update_verify_signature
+	echo ""
+	print_info "Running incremental setup to apply changes (falls back to full setup if needed)..."
+	_run_update_setup_transaction "$update_output_mode" "$new_hash" || return 1
+	print_success "Updated to version $new_version (agents deployed)"
+	return 0
+}
+
+_update_start_pulse() {
+	[[ "${AIDEVOPS_SKIP_PULSE_RESTART:-0}" != "1" ]] || return 0
+	local pulse_helper="${AGENTS_DIR}/scripts/pulse-lifecycle-helper.sh"
+	[[ -x "$pulse_helper" ]] && "$pulse_helper" start >/dev/null 2>&1 || print_warning "Pulse start failed (non-fatal)"
+	return 0
+}
+
+_update_finish() {
+	local skip_project_sync="$1"
 
 	_run_update_source_access_reconciliation
 	_update_sync_projects "$skip_project_sync" "$(get_version)"
-	if [[ "$skip_project_sync" != "$_AIDEVOPS_UPDATE_TRUE" && "$reconcile_repo_verify" == "$_AIDEVOPS_UPDATE_TRUE" ]]; then
+	if [[ "$skip_project_sync" != "$_AIDEVOPS_UPDATE_TRUE" && "${_AIDEVOPS_UPDATE_RECONCILE_REPO_VERIFY:-false}" == "$_AIDEVOPS_UPDATE_TRUE" ]]; then
 		_update_reconcile_repo_verify
 	fi
 	_update_check_homebrew
@@ -532,13 +539,7 @@ cmd_update() {
 	# 'start' subcommand does not check it directly — only 'restart' and
 	# 'restart-if-running' do). Non-fatal: a pulse start failure should
 	# not fail the update.
-	if [[ "${AIDEVOPS_SKIP_PULSE_RESTART:-0}" != "1" ]]; then
-		local _pulse_helper="${AGENTS_DIR}/scripts/pulse-lifecycle-helper.sh"
-		if [[ -x "$_pulse_helper" ]]; then
-			"$_pulse_helper" start >/dev/null 2>&1 || print_warning "Pulse start failed (non-fatal)"
-		fi
-	fi
-
+	_update_start_pulse
 	return 0
 }
 
@@ -1180,7 +1181,7 @@ _help_commands() {
 	return 0
 }
 
-_help_detailed_sections() {
+_help_security_sections() {
 	echo "Security:"
 	echo "  aidevops security            # Run ALL checks (posture + hygiene + supply chain)"
 	echo "  aidevops security posture    # Interactive security posture setup (gopass, gh, SSH)"
@@ -1241,6 +1242,11 @@ _help_detailed_sections() {
 	echo "    aidevops client-format extract      # 1. Re-extract constants"
 	echo "    aidevops client-format canary       # 2. Verify against real CLI"
 	echo ""
+	return 0
+}
+
+_help_detailed_sections_content() {
+	_help_security_sections
 	echo "Secrets:"
 	echo "  aidevops secret set NAME     # Store a secret (hidden input)"
 	echo "  aidevops secret list         # List secret names (never values)"
@@ -1249,26 +1255,7 @@ _help_detailed_sections() {
 	echo "  aidevops secret import       # Import from credentials.sh to gopass"
 	echo "  aidevops secret status       # Show backend status"
 	echo ""
-	echo "Vault:"
-	echo "  aidevops vault init          # Create local encrypted Vault metadata"
-	echo "  aidevops vault status        # Show uninitialized/locked/unlocked/corrupted"
-	echo "  aidevops vault unlock        # Unlock into an in-memory local broker"
-	echo "  aidevops vault lock          # Stop broker and forget in-memory keys"
-	echo "  aidevops vault read NAME     # Read protected data through broker"
-	echo "  aidevops vault update NAME   # Encrypt stdin value through broker"
-	echo ""
-	echo "GitHub App Auth:"
-	echo "  aidevops github-app-auth status --json       # Show active auth mode and budgets"
-	echo "  aidevops github-app-auth route issue-list    # Explain route decision"
-	echo "  aidevops github-app-auth rate-limit --json   # Show cached per-pool budgets"
-	echo ""
-	echo "Feature Toggles:"
-	echo "  aidevops config list         # List all toggles with current values"
-	echo "  aidevops config get <key>    # Get a toggle value"
-	echo "  aidevops config set <k> <v>  # Set a toggle (true/false)"
-	echo "  aidevops config reset [key]  # Reset toggle(s) to defaults"
-	echo "  aidevops config path         # Show config file path"
-	echo ""
+	_help_vault_and_config_sections
 	echo "Knowledge Plane:"
 	echo "  aidevops knowledge init repo           # Provision _knowledge/ in current repo"
 	echo "  aidevops knowledge init personal       # Provision at ~/.aidevops/.agent-workspace/knowledge/"
@@ -1343,6 +1330,11 @@ _help_detailed_sections() {
 	return 0
 }
 
+_help_detailed_sections() {
+	_help_detailed_sections_content
+	return 0
+}
+
 _help_management_sections() {
 	echo "Auto-Update:"
 	echo "  aidevops auto-update enable  # Poll for updates every 10 min"
@@ -1830,48 +1822,81 @@ _cmd_client_format() {
 }
 
 # Main entry point
+_main_badges() {
+	local subcommand="${1:-}"
+	local sync_helper="badges-sync-helper.sh"
+	case "$subcommand" in
+	render)
+		shift
+		local helper="$HOME/.aidevops/agents/scripts/readme-badges-helper.sh"
+		[[ -f "$helper" ]] || helper="$AGENTS_DIR/scripts/readme-badges-helper.sh"
+		if [[ -f "$helper" ]]; then bash "$helper" render "$@"; else print_error "readme-badges-helper.sh not found. Run: aidevops update"; return 1; fi
+		;;
+	check) shift; _dispatch_helper "badges-check-helper.sh" "badges-check-helper.sh" "$@" ;;
+	sync) shift; _dispatch_helper "$sync_helper" "$sync_helper" "$@" ;;
+	install) shift; _dispatch_helper "$sync_helper" "$sync_helper" --workflow-only "$@" ;;
+	help | --help | -h | "")
+		echo ""
+		echo "aidevops badges — README badge block and repo metrics workflow management (t2975)"
+		echo ""
+		echo "Subcommands:"
+		echo "  render  <slug>                 Print canonical badge block for a repo"
+		echo "  check   [--repo SLUG] [--json]  Detect badge drift across managed repos"
+		echo "  sync    [--repo SLUG] [--apply] Inject badge block + generate metrics + install workflow"
+		echo "  install [--repo SLUG] [--apply] Install repo metrics refresh workflow only"
+		echo ""
+		echo "Options (check/sync/install):"
+		echo "  --repo SLUG    Limit to a single repo"
+		echo "  --apply        Actually perform the sync (default: dry-run)"
+		echo "  --json         Machine-readable output"
+		echo "  --verbose      Show diff summaries (check only)"
+		echo ""
+		echo "Examples:"
+		echo "  aidevops badges check                       # scan all repos for badge drift"
+		echo "  aidevops badges check --json | jq '.[]'    # machine-readable output"
+		echo "  aidevops badges render owner/repo           # print badge block"
+		echo "  aidevops badges sync                        # dry-run sync across all repos"
+		echo "  aidevops badges sync --repo owner/r --apply # apply to a single repo"
+		echo "  aidevops metrics generate [PATH]            # generate local docs/metrics artifacts"
+		echo ""
+		;;
+	*) print_error "Unknown badges subcommand: $subcommand (try render|check|sync|install|help)"; return 1 ;;
+	esac
+	return 0
+}
+
 main() {
 	local command="${1:-help}"
 	local check_workflows_helper="check-workflows-helper.sh"
+	local update_help="help"
 	shift || true
-
-	# Help for inventory commands must bypass repository auto-detection and
-	# version checks. Those startup checks may read the repository registry,
-	# while help must remain bounded and side-effect-free.
-	if [[ "$command" == "check-workflows" || "$command" == "workflows" ]]; then
-		local arg
-		for arg in "$@"; do
-			case "$arg" in
-			-h | --help)
-				_dispatch_helper "$check_workflows_helper" "$check_workflows_helper" "$@"
-				return $?
-				;;
-			esac
-		done
-	fi
-
-	# Update help must return before startup checks or cmd_update(), which can
-	# inspect repositories, fetch remotes, deploy agents, and synchronize projects.
 	if [[ "$command" == "update" || "$command" == "upgrade" || "$command" == "u" ]]; then
 		local arg
 		for arg in "$@"; do
-			case "$arg" in
-			help | -h | --help)
-				cmd_update_help
-				return $?
-				;;
-			esac
+			if [[ "$arg" == "$update_help" || "$arg" == "-h" || "$arg" == "--help" ]]; then cmd_update_help; return $?; fi
 		done
+		_main_check_unregistered "$command"
+		cmd_update "$@"
+		return $?
 	fi
-
-	# Auto-detect unregistered repo on any command (silent check)
+	_main_early_help "$command" "$check_workflows_helper" "$@" && return 0
 	_main_check_unregistered "$command"
+	_main_check_version
+	_main_dispatch "$command" "$check_workflows_helper" "$@"
+}
 
-	# Check if agents need updating (skip for update command itself)
-	if [[ "$command" != "update" && "$command" != "upgrade" && "$command" != "u" ]]; then
-		_main_check_version
-	fi
+_main_early_help() {
+	local command="$1" check_workflows_helper="$2" arg
+	shift 2
+	for arg in "$@"; do
+		if [[ "$command" == "check-workflows" || "$command" == "workflows" ]] && [[ "$arg" == "-h" || "$arg" == "--help" ]]; then _dispatch_helper "$check_workflows_helper" "$check_workflows_helper" "$@"; return $?; fi
+	done
+	return 1
+}
 
+_main_dispatch() {
+	local command="$1" check_workflows_helper="$2"
+	shift 2
 	case "$command" in
 	init | i) cmd_init "$@" ;;
 	setup) cmd_setup "$@" ;;
@@ -1897,76 +1922,7 @@ main() {
 	check-workflows | workflows) _dispatch_helper "$check_workflows_helper" "$check_workflows_helper" "$@" ;;
 	sync-workflows) _dispatch_helper "sync-workflows-helper.sh" "sync-workflows-helper.sh" "$@" ;;
 	metrics) _dispatch_helper "repo-metrics-helper.sh" "repo-metrics-helper.sh" "$@" ;;
-	badges)
-		# Badge management: render | check | sync | install (t2975)
-		# Bare 'aidevops badges' with no subcommand shows a usage summary.
-		# Subcommands:
-		#   render <slug>               — render canonical badge block for a repo
-		#   check  [--repo SLUG] [--json] [--verbose]  — cross-repo drift check
-		#   sync   [--repo SLUG] [--apply]              — inject badge block + generate metrics + install workflow
-		#   install [--repo SLUG] [--apply]             — install repo metrics refresh workflow only
-		local _badges_sub="${1:-help}"
-		local _badges_check_h="badges-check-helper.sh"
-		local _badges_sync_h="badges-sync-helper.sh"
-		case "$_badges_sub" in
-		render)
-			shift
-			local _render_helper
-			_render_helper=$(bash -c '
-				d="$HOME/.aidevops/agents/scripts/readme-badges-helper.sh"
-				l="'"$AGENTS_DIR"'/scripts/readme-badges-helper.sh"
-				[[ -f "$d" ]] && echo "$d" || echo "$l"
-			')
-			if [[ -f "$_render_helper" ]]; then
-				bash "$_render_helper" render "$@"
-			else
-				print_error "readme-badges-helper.sh not found. Run: aidevops update"
-				exit 1
-			fi
-			;;
-		check)
-			shift
-			_dispatch_helper "$_badges_check_h" "$_badges_check_h" "$@"
-			;;
-		sync)
-			shift
-			_dispatch_helper "$_badges_sync_h" "$_badges_sync_h" "$@"
-			;;
-		install)
-			shift
-			_dispatch_helper "$_badges_sync_h" "$_badges_sync_h" --workflow-only "$@"
-			;;
-		help | --help | -h | "")
-			echo ""
-			echo "aidevops badges — README badge block and repo metrics workflow management (t2975)"
-			echo ""
-			echo "Subcommands:"
-			echo "  render  <slug>                 Print canonical badge block for a repo"
-			echo "  check   [--repo SLUG] [--json]  Detect badge drift across managed repos"
-			echo "  sync    [--repo SLUG] [--apply] Inject badge block + generate metrics + install workflow"
-			echo "  install [--repo SLUG] [--apply] Install repo metrics refresh workflow only"
-			echo ""
-			echo "Options (check/sync/install):"
-			echo "  --repo SLUG    Limit to a single repo"
-			echo "  --apply        Actually perform the sync (default: dry-run)"
-			echo "  --json         Machine-readable output"
-			echo "  --verbose      Show diff summaries (check only)"
-			echo ""
-			echo "Examples:"
-			echo "  aidevops badges check                       # scan all repos for badge drift"
-			echo "  aidevops badges check --json | jq '.[]'    # machine-readable output"
-			echo "  aidevops badges render owner/repo           # print badge block"
-			echo "  aidevops badges sync                        # dry-run sync across all repos"
-			echo "  aidevops badges sync --repo owner/r --apply # apply to a single repo"
-			echo "  aidevops metrics generate [PATH]            # generate local docs/metrics artifacts"
-			echo ""
-			;;
-		*)
-			print_error "Unknown badges subcommand: $_badges_sub (try render|check|sync|install|help)"
-			exit 1
-			;;
-		esac
-		;;
+	badges) _main_badges "$@" ;;
 	security) _cmd_security "$@" ;;
 	doctor | doc) _dispatch_helper "doctor-helper.sh" "doctor-helper.sh" "$@" ;;
 	detect | scan) cmd_detect ;;
@@ -1974,32 +1930,7 @@ main() {
 	model-accounts-pool | map) _dispatch_helper "oauth-pool-helper.sh" "oauth-pool-helper.sh" "$@" ;;
 	gpt56-context | gpt56_context) _dispatch_helper "gpt56-context-helper.sh" "gpt56-context-helper.sh" "$@" ;;
 	astra-context | astra_context) _dispatch_helper "astra-context-helper.sh" "astra-context-helper.sh" "$@" ;;
-	cleanup)
-		local _cleanup_sub="${1:-help}"
-		case "$_cleanup_sub" in
-		branches | remote-branches)
-			shift || true
-			_dispatch_helper "remote-branch-cleanup-helper.sh" "remote-branch-cleanup-helper.sh" "$_cleanup_sub" "$@"
-			;;
-		help | --help | -h | "")
-			echo "Usage: aidevops cleanup <branches|remote-branches> [options]"
-			echo ""
-			echo "Cleanup commands:"
-			echo "  branches          Audit stale remote branches (dry-run default)"
-			echo "  remote-branches   Alias for branches"
-			echo ""
-			echo "Options:"
-			echo "  --repo PATH       Repository path (default: current directory)"
-			echo "  --remote NAME     Remote to audit (default: origin)"
-			echo "  --apply           Delete safe candidates"
-			echo ""
-			;;
-		*)
-			print_error "Unknown cleanup subcommand: $_cleanup_sub (try branches|remote-branches|help)"
-			exit 1
-			;;
-		esac
-		;;
+	cleanup) _main_dispatch_cleanup "$@" ;;
 	client-format) _cmd_client_format "$@" ;;
 	github-app-auth | github-app | gh-auth) _dispatch_helper "github-app-auth-helper.sh" "github-app-auth-helper.sh" "$@" ;;
 	opencode-db | oc-db) _dispatch_helper "opencode-db-maintenance-helper.sh" "opencode-db-maintenance-helper.sh" "$@" ;;
@@ -2021,12 +1952,7 @@ main() {
 	worktree | wt) _dispatch_helper "worktree-helper.sh" "worktree-helper.sh" "$@" ;;
 	issue) _dispatch_helper "interactive-session-helper.sh" "interactive-session-helper.sh" "$@" ;;
 	signing) _dispatch_helper "signing-setup.sh" "signing-setup.sh" "$@" ;;
-	contributions | contrib)
-		# Bare `aidevops contributions` defaults to status (most common use).
-		# Other subcommands (seed, scan, stop, restart, install, uninstall) forward verbatim.
-		[[ $# -eq 0 ]] && set -- status
-		_dispatch_helper "contribution-watch-helper.sh" "contribution-watch-helper.sh" "$@"
-		;;
+	contributions | contrib) _main_dispatch_contributions "$@" ;;
 	inbox)
 		# Bare `aidevops inbox` defaults to status (most common use).
 		[[ $# -eq 0 ]] && set -- status
@@ -2050,44 +1976,7 @@ main() {
 	init-routines) _dispatch_helper "init-routines-helper.sh" "init-routines-helper.sh" "$@" ;;
 	parent-status | ps) _dispatch_helper "parent-status-helper.sh" "parent-status-helper.sh" "$@" ;;
 	knowledge) _dispatch_helper "knowledge-helper.sh" "knowledge-helper.sh" "$@" ;;
-	campaign | campaigns)
-		# P1 provisioning: init/provision/status/ls → campaigns-provision-helper.sh
-		# P4 asset binary: asset → campaign-asset-helper.sh
-		# P2+P6: all other subcommands → campaign-helper.sh
-		local _camp_cmd="${1:-help}"
-		local _camp_helper="campaign-helper.sh"
-		local _camp_provision_helper="campaigns-provision-helper.sh"
-		case "$_camp_cmd" in
-		init | provision | ls)
-			_dispatch_helper "$_camp_provision_helper" "$_camp_provision_helper" "$@"
-			;;
-		status)
-			if [[ $# -le 1 || -d "${2:-}" || "${2:-}" == .* || "${2:-}" == /* || "${2:-}" == ~* ]]; then
-				_dispatch_helper "$_camp_provision_helper" "$_camp_provision_helper" "$@"
-			else
-				_dispatch_helper "$_camp_helper" "$_camp_helper" "$@"
-			fi
-			;;
-		asset | assets)
-			shift
-			_dispatch_helper "campaign-asset-helper.sh" "campaign-asset-helper.sh" "$@"
-			;;
-		grow | growth)
-			shift
-			local _growth_helper="${AIDEVOPS_CLI_MODULES_DIR%/aidevops-cli}/campaign-growth-helper.py"
-			[[ ! -f "$_growth_helper" ]] && _growth_helper="$AGENTS_DIR/scripts/campaign-growth-helper.py"
-			if [[ -f "$_growth_helper" ]]; then
-				python3 "$_growth_helper" "$@"
-			else
-				print_error "campaign-growth-helper.py not found. Run: aidevops update"
-				return 1
-			fi
-			;;
-		*)
-			_dispatch_helper "$_camp_helper" "$_camp_helper" "$@"
-			;;
-		esac
-		;;
+	campaign | campaigns) _main_dispatch_campaign "$@" ;;
 	performance) _dispatch_helper "performance-helper.sh" "performance-helper.sh" "$@" ;;
 	reach) _dispatch_helper "reach-helper.sh" "reach-helper.sh" "$@" ;;
 	config | configure) _dispatch_config "$@" ;;
@@ -2103,4 +1992,84 @@ main() {
 	esac
 }
 
+_main_dispatch_cleanup() {
+	local cleanup_subcommand="${1:-help}"
+	case "$cleanup_subcommand" in
+	branches | remote-branches)
+		shift || true
+		_dispatch_helper "remote-branch-cleanup-helper.sh" "remote-branch-cleanup-helper.sh" "$cleanup_subcommand" "$@"
+		;;
+	help | --help | -h | "")
+		echo "Usage: aidevops cleanup <branches|remote-branches> [options]"
+		echo ""
+		echo "Cleanup commands:"
+		echo "  branches          Audit stale remote branches (dry-run default)"
+		echo "  remote-branches   Alias for branches"
+		echo ""
+		echo "Options:"
+		echo "  --repo PATH       Repository path (default: current directory)"
+		echo "  --remote NAME     Remote to audit (default: origin)"
+		echo "  --apply           Delete safe candidates"
+		echo ""
+		;;
+	*) print_error "Unknown cleanup subcommand: $cleanup_subcommand (try branches|remote-branches|help)"; return 1 ;;
+	esac
+	return 0
+}
+
+_help_vault_and_config_sections() {
+	echo "Vault:"
+	echo "  aidevops vault init          # Create local encrypted Vault metadata"
+	echo "  aidevops vault status        # Show uninitialized/locked/unlocked/corrupted"
+	echo "  aidevops vault unlock        # Unlock into an in-memory local broker"
+	echo "  aidevops vault lock          # Stop broker and forget in-memory keys"
+	echo "  aidevops vault read NAME     # Read protected data through broker"
+	echo "  aidevops vault update NAME   # Encrypt stdin value through broker"
+	echo ""
+	echo "GitHub App Auth:"
+	echo "  aidevops github-app-auth status --json       # Show active auth mode and budgets"
+	echo "  aidevops github-app-auth route issue-list    # Explain route decision"
+	echo "  aidevops github-app-auth rate-limit --json   # Show cached per-pool budgets"
+	echo ""
+	echo "Feature Toggles:"
+	echo "  aidevops config list         # List all toggles with current values"
+	echo "  aidevops config get <key>    # Get a toggle value"
+	echo "  aidevops config set <k> <v>  # Set a toggle (true/false)"
+	echo "  aidevops config reset [key]  # Reset toggle(s) to defaults"
+	echo "  aidevops config path         # Show config file path"
+	echo ""
+	return 0
+}
+
+_main_dispatch_contributions() {
+	[[ $# -eq 0 ]] && set -- status
+	_dispatch_helper "contribution-watch-helper.sh" "contribution-watch-helper.sh" "$@"
+	return $?
+}
+
+_main_dispatch_campaign() {
+	local campaign_command="${1:-help}" campaign_helper="campaign-helper.sh"
+	local provision_helper="campaigns-provision-helper.sh"
+	case "$campaign_command" in
+	init | provision | ls) _dispatch_helper "$provision_helper" "$provision_helper" "$@" ;;
+	status)
+		if [[ $# -le 1 || -d "${2:-}" || "${2:-}" == .* || "${2:-}" == /* || "${2:-}" == ~* ]]; then
+			_dispatch_helper "$provision_helper" "$provision_helper" "$@"
+		else
+			_dispatch_helper "$campaign_helper" "$campaign_helper" "$@"
+		fi
+		;;
+	asset | assets) shift; _dispatch_helper "campaign-asset-helper.sh" "campaign-asset-helper.sh" "$@" ;;
+	grow | growth)
+		shift
+		local growth_helper="${AIDEVOPS_CLI_MODULES_DIR%/aidevops-cli}/campaign-growth-helper.py"
+		[[ ! -f "$growth_helper" ]] && growth_helper="$AGENTS_DIR/scripts/campaign-growth-helper.py"
+		[[ -f "$growth_helper" ]] || { print_error "campaign-growth-helper.py not found. Run: aidevops update"; return 1; }
+		python3 "$growth_helper" "$@"
+		;;
+	*) _dispatch_helper "$campaign_helper" "$campaign_helper" "$@" ;;
+	esac
+	return 0
+}
+
 main "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.34.8",
+  "version": "3.34.10",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "packageManager": "bun@1.3.11",

package/setup.sh

@@ -17,7 +17,7 @@ fi
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.34.8
+# Version: 3.34.10
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)
@@ -1116,16 +1116,34 @@ _setup_redact_secret_like_command_values() {
 	return 0
 }
 
+_setup_claim_noninteractive_setup_lock() {
+	local lock_dir="$1"
+	shift
+	local lane_rc=0
+
+	SETUP_NONINTERACTIVE_LOCK_DIR="$lock_dir"
+	SETUP_NONINTERACTIVE_LOCK_HELD=true
+	printf '%s\n' "$$" >"$lock_dir/owner.pid" 2>/dev/null || true
+	printf '%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$lock_dir/started_at" 2>/dev/null || true
+	printf '%s\n' "$(date +%s 2>/dev/null || printf '0')" >"$lock_dir/started_at_epoch" 2>/dev/null || true
+	printf '%s\n' "$0 $*" >"$lock_dir/command" 2>/dev/null || true
+	_setup_guard_active_release_lane || lane_rc=$?
+	if [[ "$lane_rc" -ne 0 ]]; then
+		_setup_release_noninteractive_setup_lock
+		return "$lane_rc"
+	fi
+	trap '_setup_cleanup_noninteractive_children; _setup_release_noninteractive_setup_lock' EXIT
+	trap '_setup_noninteractive_signal_exit TERM' TERM
+	trap '_setup_noninteractive_signal_exit INT' INT
+	return 0
+}
+
 _setup_acquire_noninteractive_setup_lock() {
 	local lock_dir="${AIDEVOPS_SETUP_LOCK_DIR:-$HOME/.aidevops/locks/setup-noninteractive.lock.d}"
-	# Max seconds to wait for a live, non-stale owner before timing out.
 	local wait_ceiling="${AIDEVOPS_SETUP_WAIT_TIMEOUT_S:-900}"
-	# Max seconds a live owner may hold the lock before it is treated as
-	# stale and reclaimed (0 disables stale-live reclaim).
 	local stale_ceiling="${AIDEVOPS_SETUP_STALE_TIMEOUT_S:-1800}"
 	local owner_pid="" owner_cmd="" owner_age=0
 	local reclaim_attempts=0 waited=0
-	local lane_rc=0
 	local _diag_stl="$HOME/.aidevops/logs/setup-stage-timings.log"
 	local _diag_interval_s="${AIDEVOPS_SETUP_LOCK_DIAG_INTERVAL_S:-60}"
 	_setup_guard_active_release_lane || return $?
@@ -1133,24 +1151,10 @@ _setup_acquire_noninteractive_setup_lock() {
 	mkdir -p "$(dirname "$lock_dir")" 2>/dev/null || true
 	while true; do
 		if mkdir "$lock_dir" 2>/dev/null; then
-			SETUP_NONINTERACTIVE_LOCK_DIR="$lock_dir"
-			SETUP_NONINTERACTIVE_LOCK_HELD=true
-			printf '%s\n' "$$" >"$lock_dir/owner.pid" 2>/dev/null || true
-			printf '%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$lock_dir/started_at" 2>/dev/null || true
-			printf '%s\n' "$(date +%s 2>/dev/null || printf '0')" >"$lock_dir/started_at_epoch" 2>/dev/null || true
-			printf '%s\n' "$0 $*" >"$lock_dir/command" 2>/dev/null || true
-			_setup_guard_active_release_lane || lane_rc=$?
-			if [[ "$lane_rc" -ne 0 ]]; then
-				_setup_release_noninteractive_setup_lock
-				return "$lane_rc"
-			fi
-			trap '_setup_cleanup_noninteractive_children; _setup_release_noninteractive_setup_lock' EXIT
-			trap '_setup_noninteractive_signal_exit TERM' TERM
-			trap '_setup_noninteractive_signal_exit INT' INT
-			return 0
+			_setup_claim_noninteractive_setup_lock "$lock_dir" "$@"
+			return $?
 		fi
 
-		# Lock exists — inspect owner.
 		owner_pid=""
 		if [[ -r "$lock_dir/owner.pid" ]]; then
 			owner_pid=$(tr -d '[:space:]' <"$lock_dir/owner.pid" 2>/dev/null || true)
@@ -1174,7 +1178,6 @@ _setup_acquire_noninteractive_setup_lock() {
 		fi
 
 		if ! _setup_lock_pid_alive "$owner_pid"; then
-			# Dead owner — reclaim the stale lock.
 			if [[ "$reclaim_attempts" -ge 2 ]]; then
 				print_error "Unable to acquire setup.sh --non-interactive lock at ${lock_dir} after ${reclaim_attempts} stale-lock removals"
 				return 75
@@ -1198,7 +1201,6 @@ _setup_acquire_noninteractive_setup_lock() {
 			continue
 		fi
 
-		# Owner is alive — compute age and read current setup stage.
 		owner_age=$(_setup_lock_owner_age "$lock_dir" "$owner_pid")
 		owner_cmd=""
 		[[ -r "$lock_dir/command" ]] && owner_cmd=$(tr '\n' ' ' <"$lock_dir/command" 2>/dev/null || true)
@@ -1210,7 +1212,6 @@ _setup_acquire_noninteractive_setup_lock() {
 			[[ -n "$_diag_cur_stage" ]] && _diag_stage=", stage: ${_diag_cur_stage}"
 		fi
 
-		# Stale-live reclaim: owner alive but running far too long.
 		if [[ "$stale_ceiling" -gt 0 && "$owner_age" -ge "$stale_ceiling" ]]; then
 			if [[ "$reclaim_attempts" -ge 2 ]]; then
 				print_error "Unable to acquire setup.sh --non-interactive lock: owner (pid ${owner_pid}, age ${owner_age}s) exceeds stale ceiling but reclaim limit reached. Diagnose: ${_diag_stl}"
@@ -1222,13 +1223,11 @@ _setup_acquire_noninteractive_setup_lock() {
 			continue
 		fi
 
-		# Live non-stale owner — check wait ceiling before sleeping.
 		if [[ "$waited" -ge "$wait_ceiling" ]]; then
 			print_error "Timed out waiting ${waited}s for setup.sh --non-interactive lock (owner pid ${owner_pid}, age ${owner_age}s${_diag_stage}${owner_cmd:+, command: ${owner_cmd}}). Increase AIDEVOPS_SETUP_WAIT_TIMEOUT_S (current: ${wait_ceiling}s) or kill pid ${owner_pid} to unblock. Diagnose: ${_diag_stl}"
 			return 75
 		fi
 
-		# Emit diagnostics on first block and every diagnostic interval thereafter.
 		if [[ "$waited" -eq 0 ]]; then
 			print_info "Another setup.sh --non-interactive is running (pid ${owner_pid}, age ${owner_age}s${_diag_stage}${owner_cmd:+, command: ${owner_cmd}}). Waiting up to ${wait_ceiling}s (AIDEVOPS_SETUP_WAIT_TIMEOUT_S). Diagnose: ${_diag_stl}"
 		elif [[ $((waited % _diag_interval_s)) -eq 0 ]]; then
@@ -1543,22 +1542,7 @@ reconcile_buzz_desktop_compatibility() {
 	esac
 }
 
-_setup_run_non_interactive() {
-	print_info "Non-interactive mode: deploying agents and running safe migrations only"
-
-	_setup_init_stage_timing_log
-
-	_time_step "protect_current_setup_worktree" protect_current_setup_worktree
-	_time_step "verify_location" verify_location
-	_time_step "check_requirements" check_requirements
-	# Run quality tool detection in non-interactive mode too (warn-only path).
-	_time_step "check_quality_tools" check_quality_tools
-	# Check setsid availability; auto-install util-linux on macOS if missing
-	# (GH#21102 / t2926: missing setsid kills workers on every pulse restart).
-	_time_step "setup_setsid_advisory" setup_setsid_advisory
-	_time_step "check_python_upgrade_available" check_python_upgrade_available
-	_time_step "setup_vault_python_env" setup_vault_python_env || print_warning "Vault crypto runtime setup encountered issues; Vault status remains metadata-only"
-	_time_step "set_permissions" set_permissions
+_setup_run_noninteractive_migrations() {
 	_time_step "migrate_old_backups" migrate_old_backups
 	_time_step "migrate_loop_state_directories" migrate_loop_state_directories
 	_time_step "migrate_agent_to_agents_folder" migrate_agent_to_agents_folder
@@ -1576,12 +1560,23 @@ _setup_run_non_interactive() {
 	_time_step "cleanup_worktree_entries_in_repos_json" cleanup_worktree_entries_in_repos_json
 	_time_step "_cleanup_legacy_model_config" _cleanup_legacy_model_config
 	_time_step "cleanup_legacy_dashboard_launchagent" cleanup_legacy_dashboard_launchagent
-	# t2888: install/heal opencode-ai. Companion to t2887's runtime canary
-	# fail-fast -- t2887 detects when $OPENCODE_BIN_DEFAULT is wrong, this
-	# one fixes it by reinstalling opencode-ai@latest (overwriting any bin
-	# collision with @anthropic-ai/claude-code or similar). Skipping this
-	# in non-interactive mode is the bug PR #20189 introduced and what
-	# alex-solovyev's runner spam stemmed from.
+	return 0
+}
+
+_setup_run_non_interactive() {
+	print_info "Non-interactive mode: deploying agents and running safe migrations only"
+
+	_setup_init_stage_timing_log
+
+	_time_step "protect_current_setup_worktree" protect_current_setup_worktree
+	_time_step "verify_location" verify_location
+	_time_step "check_requirements" check_requirements
+	_time_step "check_quality_tools" check_quality_tools
+	_time_step "setup_setsid_advisory" setup_setsid_advisory
+	_time_step "check_python_upgrade_available" check_python_upgrade_available
+	_time_step "setup_vault_python_env" setup_vault_python_env || print_warning "Vault crypto runtime setup encountered issues; Vault status remains metadata-only"
+	_time_step "set_permissions" set_permissions
+	_setup_run_noninteractive_migrations
 	_time_step "$SETUP_STAGE_OPENCODE" setup_opencode_runtimes
 	_time_step "validate_opencode_config" validate_opencode_config
 	_time_step "$SETUP_STAGE_AGENTS" deploy_aidevops_agents
@@ -1599,9 +1594,6 @@ _setup_run_non_interactive() {
 	fi
 	_time_step "init_settings_json" init_settings_json
 
-	# Parallelise independent skill operations (t1356: ~84s serial -> ~18s parallel)
-	# generate_agent_skills must complete before create_skill_symlinks (symlinks
-	# depend on generated SKILL.md files). scan_imported_skills is independent.
 	local _pid_symlinks=""
 	if _time_step "generate_agent_skills" generate_agent_skills; then
 		_time_step "create_skill_symlinks" create_skill_symlinks &