forgedock 1.29.0 → 1.29.1

package/bin/lean/testmap.test.mjs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { parseTestMap, readTestMap, selectCommands, factsPath, TEST_MAP_FILE, REPO_FACTS_FILE } from "./testmap.mjs";
+import { parseTestMap, readTestMap, selectCommands, mergeChecks, factsPath, TEST_MAP_FILE, REPO_FACTS_FILE } from "./testmap.mjs";
 
 const MAP = {
   version: 1,
@@ -56,3 +56,18 @@ describe("test map (#4272)", () => {
     assert.equal(await factsPath(["/wt"], async () => { throw new Error("EACCES"); }), null);
   });
 });
+
+describe("mergeChecks (#4315): the map can only add checks", () => {
+  it("a partial map keeps every learned command and adds the ones it selects that learned lacks", () => {
+    assert.deepEqual(mergeChecks(["npm test", "cd pkg && npm test"], ["make lint", "npm test"]),
+      { commands: ["make lint", "npm test", "cd pkg && npm test"], added: 1, source: "test-map+learned" });
+  });
+  it("duplicates, whitespace variants included, appear once", () => {
+    assert.deepEqual(mergeChecks(["npm  run   lint", " npm run lint", "npm test"], ["npm run lint ", "npm run lint"]).commands, ["npm run lint", "npm test"]);
+  });
+  it("an empty selection keeps the learned commands; no learned commands keep the map's selection", () => {
+    assert.deepEqual(mergeChecks([], ["make lint"]), { commands: ["make lint"], added: 0, source: "learned" });
+    assert.deepEqual(mergeChecks(["npm test"], []), { commands: ["npm test"], added: 1, source: "test-map" });
+    assert.deepEqual(mergeChecks(undefined, undefined), { commands: [], added: 0, source: "learned" });
+  });
+});

package/commands/deploy-pr.md

@@ -357,8 +357,9 @@ else
   # Check current CI status
   # Fail closed: valid fields only (`status`/`conclusion` do not exist on gh pr checks --json; the
   # old query errored and defaulted to 0 = "no failures"). An unreadable result counts as failing.
+  # forgedock/verify (the lean engine's report-only gate summary) is not a code failure: ignored, as wait-ci-green.sh does.
   CURRENT_CI_STATUS=$(gh pr checks "$PR_NUMBER" $GH_FLAG --json name,bucket \
-    --jq '[.[] | select(.bucket == "fail" or .bucket == "cancel")] | length' 2>/dev/null || echo "1")
+    --jq '[.[] | select(.name != "forgedock/verify") | select(.bucket == "fail" or .bucket == "cancel")] | length' 2>/dev/null || echo "1")
 
   if [ "$CURRENT_CI_STATUS" -eq 0 ]; then
     echo "CI gate: PASSED (no failing checks)"
@@ -378,9 +379,9 @@ else
 
       CI_FIXES=$((CI_FIXES + 1))
 
-      # Re-check CI status after fix attempt
-      FAILING_AFTER=$(gh pr checks "$PR_NUMBER" $GH_FLAG --json name,status,conclusion \
-        --jq '[.[] | select(.conclusion == "failure")] | length' 2>/dev/null || echo "0")
+      # Re-check CI status after fix attempt (same fail-closed query as above)
+      FAILING_AFTER=$(gh pr checks "$PR_NUMBER" $GH_FLAG --json name,bucket \
+        --jq '[.[] | select(.name != "forgedock/verify") | select(.bucket == "fail" or .bucket == "cancel")] | length' 2>/dev/null || echo "1")
 
       if [ "$FAILING_AFTER" -eq 0 ]; then
         echo "CI gate: PASSED after $CI_ITER iteration(s)"

package/commands/orchestrate.md

@@ -38,7 +38,8 @@ Do this yourself from issue text and the code. Spawn no sub-agents here.
 
    It closes, with the evidence on the issue and no lane, every issue that a merged PR already fixed (one
    short read-only validation on a small model) or an auto-filed CI failure whose workflow is green again
-   (the green run link). It checks K issues at a time. Its last line is `lanes: #A #B ...`: continue with only
+   (the green run link), unless it is flaky (wording or `flaky` label), was reopened after a pre-filter close, or
+   the workflow failed and passed at the same SHA. It checks K issues at a time. Its last line is `lanes: #A #B ...`: continue with only
    those issues. This is the only pre-filter in this command: lanes run `forgedock run-issue`, which does not
    pre-filter again. Keep its
    `pre-filter:` line for the report.
@@ -144,12 +145,12 @@ When a lane finishes (agent lanes; the batch runner applies the same rules itsel
   These are mechanical. **Do not ask for confirmation on them.** The batch runner recovers each one itself
   (`orchestration.recovery.max_attempts`, default 1 per issue). It launches one recovery lane under the same lease, lane
   and admission rules as any lane, with `run-issue --recover <code> [--recover-attempt n]` (core path only:
-  `--path full` rejects `--recover`). That lane:
+  `--path full` rejects `--recover`; recovery is off when `engine.path: full`). That lane:
   - removes `needs-human`;
   - resumes the open PR: merges the base, fixes the failed required checks from their logs, and pushes new commits only;
   - re-queues the issue, keeping its dependents queued in the same batch.
 
-  Report what was recovered afterwards. A failed recovery stays `needs-human` with its evidence, exactly once (failed = `needs-human`, `ci-pending`, or a final `engine-error`/`deferred`; `invalid`, `decomposed` and `dependency-*` are not failures and never re-label), and there
+  Report what was recovered afterwards. A failed recovery stays `needs-human` with its evidence, re-labelled exactly once per issue, by the final attempt only (failed = `needs-human`, `ci-pending`, or a final `engine-error`/`deferred`; `invalid`, `decomposed` and `dependency-*` are not failures and never re-label). With `max_attempts > 1` a non-final attempt adds no label or comment: the runner either launches the next attempt or, when none follows, re-labels it once itself, so the label does not flap between attempts. There
   is no second attempt beyond `max_attempts`.
 - `needs-human` with a **human code** (`builder.blocked`: product-decision, spend, credentials, promotion, customer): an
   external action agents cannot take, or a product decision too critical for agents. It is never auto-recovered. Read

package/commands/review-pr-staging.md

@@ -660,8 +660,13 @@ git diff origin/$DEFAULT_BRANCH...origin/$STAGING_BRANCH | grep -iE "(api[_-]?ke
 type forge_resolve >/dev/null 2>&1 || { setopt nonomatch 2>/dev/null || true; FORGE_SOURCED_ROOT='${CLAUDE_PLUGIN_ROOT}'; for _r in "$(cygpath -u "${FORGEDOCK_HOME:-}" 2>/dev/null || printf %s "${FORGEDOCK_HOME:-}")" '${CLAUDE_PLUGIN_ROOT}' "${FORGE_ROOT:-}" "${FORGE_HOME:-}" "$(readlink -f "$HOME/.claude/commands/work-on.md" 2>/dev/null | sed 's|/commands/work-on\.md$||')" "$(head -n 1 "${CODEX_HOME:-$HOME/.codex}/forge-home" 2>/dev/null)" "$HOME/.claude/plugins/marketplaces/forgedock" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}"/plugins/cache/forgedock/forgedock/* "$HOME/.claude"/plugins/cache/forgedock/forgedock/*; do case "$_r" in /*) [ -f "$_r/scripts/lib/forge-resolve.sh" ] && { . "$_r/scripts/lib/forge-resolve.sh"; break; };; esac; done; type forge_resolve >/dev/null 2>&1 || forge_resolve() { :; }; }
 . "$(forge_resolve lib/fence-bootstrap.sh)" || { echo "BLOCKED: ForgeDock helper lib/fence-bootstrap.sh not resolvable"; exit 1; }   # FENCE_BOOTSTRAP
 gh pr checks "$PR_NUMBER" -R "$GH_REPO" 2>&1
+# forgedock/verify (the lean engine's report-only gate summary) is not a code failure: ignored, as wait-ci-green.sh does.
+# Fail closed: an unreadable result counts as failing.
+CI_FAILING=$(gh pr checks "$PR_NUMBER" -R "$GH_REPO" --json name,bucket \
+  --jq '[.[] | select(.name != "forgedock/verify") | select(.bucket == "fail" or .bucket == "cancel")] | length' 2>/dev/null || echo "1")
+echo "CI_FAILING: $CI_FAILING"
 ```
-Any CI failure → BLOCK DEPLOY (unless autofixed in Phase 1F).
+`CI_FAILING` > 0 → BLOCK DEPLOY (unless autofixed in Phase 1F). A red `forgedock/verify` alone does not block.
 
 ### Phase 1F: CI Autofix
 

package/docs/OUTCOME-CODES.md

@@ -97,7 +97,7 @@ An absent or unknown code is recorded as `unclassified`, with the raw reason kep
   - `contract.invalid` when the issue was edited mid-run (`issueEdited`);
   - `ci-pending` on a conflicting PR, recovered as `base.conflict`.
 
-  The runner relaunches the issue once per `orchestration.recovery.max_attempts` (default 1) as a recovery lane (`run-issue --recover <code>`), under the normal admission rules. That lane removes the `needs-human` label, posts `FORGE:DECISION`, and resumes the open PR: base-sync, then CI fix rounds from the failed-check logs. Dependents stay queued. A merged recovery is reported as `recovered`. A failed one is final, keeps the recovery evidence on the row, and skips its dependents. A failed recovery stays `needs-human`: the lane re-adds the label (with a `FORGE:NEEDS_HUMAN` comment carrying the evidence) only for a final `needs-human` or `ci-pending`; the batch runner re-adds it, once, for a final `engine-error` or `deferred` after the recovery pass (those may be requeued, so the lane cannot know). `invalid`, `decomposed`, `dependency-*` and `merged` never re-label.
+  The runner relaunches the issue once per `orchestration.recovery.max_attempts` (default 1) as a recovery lane (`run-issue --recover <code>`), under the normal admission rules. That lane removes the `needs-human` label, posts `FORGE:DECISION`, and resumes the open PR: base-sync, then CI fix rounds from the failed-check logs. Dependents stay queued. A merged recovery is reported as `recovered`. A failed one is final, keeps the recovery evidence on the row, and skips its dependents. A failed recovery stays `needs-human`: the lane re-adds the label (with a `FORGE:NEEDS_HUMAN` comment carrying the evidence) only for a final `needs-human` or `ci-pending`, and only when it is the last attempt (`attempt == max_attempts`); a non-final attempt that ends `needs-human` or `ci-pending` without another attempt following is re-labelled once by the batch runner; the batch runner re-adds it, once, for a final `engine-error` or `deferred` after the recovery pass (those may be requeued, so the lane cannot know). `invalid`, `decomposed`, `dependency-*` and `merged` never re-label.
 - **human**: `builder.blocked`, which is only reached by a typed human block: credentials, spend, promotion, customer or product-decision. It is never recovered, it skips dependents, and it is the only class in the report's escalation list.
 - **terminal**: every other code. No recovery runs, dependents are skipped, and the row is reported as `unrecovered`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.29.0",
+  "version": "1.29.1",
   "description": "Autonomous development pipeline for coding agents. GitHub as institutional memory, with native Claude Code and OpenCode entrypoints.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/code-index.sh

@@ -24,7 +24,7 @@
 #   Import graph: language-specific grep patterns (Python, JS/TS, Go, Rust, shell)
 #
 # Cache key: HEAD SHA — cache is a hit on unchanged HEAD, miss on new commit.
-# Works on Windows (Git Bash / WSL) and Linux. No bash-only hot-path tooling.
+# Works on Windows (Git Bash / WSL), Linux and macOS. Bash 3.2 portable: no associative arrays, mapfile, grep -P.
 #
 # SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
 # SPDX-License-Identifier: AGPL-3.0-or-later
@@ -181,7 +181,7 @@ src_files() {
 # Step 1: Symbol extraction
 # ---------------------------------------------------------------------------
 SYMBOLS_FILE="${CACHE_DIR}/symbols.tsv"
-> "$SYMBOLS_FILE"
+: > "$SYMBOLS_FILE"
 
 echo "INFO: Extracting symbols..."
 
@@ -239,7 +239,7 @@ if [[ ! -s "$SYMBOLS_FILE" ]] || ! command -v ctags >/dev/null 2>&1; then
         name=""
       fi
       kind=$(echo "$content" | grep -q "^def \|    def " && echo "function" || echo "class")
-      rel_path="${f#$REPO_PATH/}"
+      rel_path="${f#"$REPO_PATH"/}"
       [[ -n "$name" ]] && echo -e "${name}\t${rel_path}\t${lnum}\t${kind}"
     done || true
   done >> "$SYMBOLS_FILE" 2>/dev/null || true
@@ -257,7 +257,7 @@ if [[ ! -s "$SYMBOLS_FILE" ]] || ! command -v ctags >/dev/null 2>&1; then
       else
         name=""
       fi
-      rel_path="${f#$REPO_PATH/}"
+      rel_path="${f#"$REPO_PATH"/}"
       [[ -n "$name" ]] && echo -e "${name}\t${rel_path}\t${lnum}\tfunction"
     done || true
   done >> "$SYMBOLS_FILE" 2>/dev/null || true
@@ -267,13 +267,13 @@ fi
 # Step 2: Import graph extraction
 # ---------------------------------------------------------------------------
 IMPORTS_FILE="${CACHE_DIR}/imports.tsv"
-> "$IMPORTS_FILE"
+: > "$IMPORTS_FILE"
 
 echo "INFO: Building import graph..."
 
 # Python imports
 src_files py | while read -r f; do
-  rel_path="${f#$REPO_PATH/}"
+  rel_path="${f#"$REPO_PATH"/}"
   grep -n "^import \|^from " "$f" 2>/dev/null | while IFS=: read -r lnum content; do
     # Portable (non-PCRE) extraction — grep -oP is not supported by Git Bash's
     # grep build on Windows, so use a bash regex instead of lookbehind.
@@ -293,7 +293,7 @@ done >> "$IMPORTS_FILE" 2>/dev/null || true
 
 # JavaScript/TypeScript imports
 src_files js ts tsx jsx | while read -r f; do
-  rel_path="${f#$REPO_PATH/}"
+  rel_path="${f#"$REPO_PATH"/}"
   grep -n "^import \|^} from \|require(" "$f" 2>/dev/null | while IFS=: read -r lnum content; do
     # Portable (non-PCRE) extraction — grep -oP is not supported by Git Bash's
     # grep build on Windows, so use a bash regex instead of lookbehind/lookahead.
@@ -310,7 +310,7 @@ done >> "$IMPORTS_FILE" 2>/dev/null || true
 
 # Go imports
 src_files go | while read -r f; do
-  rel_path="${f#$REPO_PATH/}"
+  rel_path="${f#"$REPO_PATH"/}"
   grep -n '"[^"]*"' "$f" 2>/dev/null | grep -v "//\|fmt.Print\|errors.New" | while IFS=: read -r lnum content; do
     # Portable (non-PCRE) extraction — grep -oP is not supported by Git Bash's
     # grep build on Windows, so use a bash regex instead of lookbehind/lookahead.
@@ -327,7 +327,7 @@ done >> "$IMPORTS_FILE" 2>/dev/null || true
 # Step 3: Caller graph (callee → callers mapping)
 # ---------------------------------------------------------------------------
 CALLERS_FILE="${CACHE_DIR}/callers.tsv"
-> "$CALLERS_FILE"
+: > "$CALLERS_FILE"
 
 echo "INFO: Building caller graph..."
 
@@ -363,50 +363,50 @@ fi
 # Step 4: File-to-domain mapping
 # ---------------------------------------------------------------------------
 DOMAIN_FILE="${CACHE_DIR}/file_domain.tsv"
-> "$DOMAIN_FILE"
+: > "$DOMAIN_FILE"
 
 echo "INFO: Building file-domain map..."
 
 # Read forge.yaml domain hints if available
 FORGE_YAML="${REPO_PATH}/forge.yaml"
-declare -A DOMAIN_PATTERNS
-DOMAIN_PATTERNS=(
-  ["commands"]="pipeline-commands"
-  ["scripts"]="pipeline-scripts"
-  ["services/api"]="api"
-  ["services/worker"]="worker"
-  ["web/src/app/billing"]="billing"
-  ["web/src/app/auth"]="auth"
-  ["services/api/auth"]="auth"
-  ["services/api/billing"]="billing"
-  ["services/api/db"]="database"
-  ["migrations"]="database"
-  [".github/workflows"]="ci-cd"
-  ["infra"]="infrastructure"
-  ["web/src"]="frontend"
+# Ordered prefix -> domain table, most specific first; the first matching prefix wins (forge#4235).
+# Parallel indexed arrays, not an associative array: bash 3.2 (stock macOS) has no `declare -A`,
+# and hash iteration order made services/api vs services/api/auth unspecified.
+DOMAIN_PREFIXES=(
+  "web/src/app/billing" "web/src/app/auth" "services/api/auth" "services/api/billing" "services/api/db"
+  "services/api" "services/worker" "migrations" ".github/workflows" "infra" "web/src" "commands" "scripts"
+)
+DOMAIN_LABELS=(
+  "billing" "auth" "auth" "billing" "database"
+  "api" "worker" "database" "ci-cd" "infrastructure" "frontend" "pipeline-commands" "pipeline-scripts"
 )
 
-# Read key_paths from forge.yaml if present (override defaults)
+# Read key_paths from forge.yaml if present: prepended so they override the defaults
 if [[ -f "$FORGE_YAML" ]]; then
   # Simple key_paths extraction — reads "domain: [patterns]" blocks under review.key_paths
   while IFS=: read -r key val; do
     key=$(echo "$key" | tr -d ' ')
     val=$(echo "$val" | tr -d ' "')
     if [[ -n "$key" && -n "$val" ]]; then
-      DOMAIN_PATTERNS["$val"]="$key"
+      DOMAIN_PREFIXES=("$val" "${DOMAIN_PREFIXES[@]}")
+      DOMAIN_LABELS=("$key" "${DOMAIN_LABELS[@]}")
     fi
   done < <(grep -A2 'key_paths:' "$FORGE_YAML" 2>/dev/null | grep '^\s*\w\+:' | head -20 || true)
 fi
+DOMAIN_COUNT=${#DOMAIN_PREFIXES[@]}
 
 # Map each file to its domain
 while IFS= read -r rel_path; do
   case "$rel_path" in .forge/*|*/node_modules/*|node_modules/*|*/__pycache__/*) continue ;; esac
   domain="unclassified"
-  for pattern in "${!DOMAIN_PATTERNS[@]}"; do
+  i=0
+  while [[ "$i" -lt "$DOMAIN_COUNT" ]]; do
+    pattern="${DOMAIN_PREFIXES[$i]}"
     if [[ "$rel_path" == $pattern* ]]; then
-      domain="${DOMAIN_PATTERNS[$pattern]}"
+      domain="${DOMAIN_LABELS[$i]}"
       break
     fi
+    i=$((i + 1))
   done
   echo -e "${rel_path}\t${domain}"
 done < "$FILE_LIST" >> "$DOMAIN_FILE" 2>/dev/null || true
@@ -415,10 +415,10 @@ done < "$FILE_LIST" >> "$DOMAIN_FILE" 2>/dev/null || true
 # Step 5: Write index manifest
 # ---------------------------------------------------------------------------
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || date +"%Y-%m-%dT%H:%M:%SZ")
-SYMBOL_COUNT=$(wc -l < "$SYMBOLS_FILE" 2>/dev/null || echo 0)
-IMPORT_COUNT=$(wc -l < "$IMPORTS_FILE" 2>/dev/null || echo 0)
-CALLER_COUNT=$(wc -l < "$CALLERS_FILE" 2>/dev/null || echo 0)
-FILE_COUNT=$(wc -l < "$DOMAIN_FILE" 2>/dev/null || echo 0)
+SYMBOL_COUNT=$( (wc -l < "$SYMBOLS_FILE" 2>/dev/null || echo 0) | tr -d " ")
+IMPORT_COUNT=$( (wc -l < "$IMPORTS_FILE" 2>/dev/null || echo 0) | tr -d " ")
+CALLER_COUNT=$( (wc -l < "$CALLERS_FILE" 2>/dev/null || echo 0) | tr -d " ")
+FILE_COUNT=$( (wc -l < "$DOMAIN_FILE" 2>/dev/null || echo 0) | tr -d " ")
 
 # Sanity check: if source files that should have produced symbols/imports were
 # found, but extraction came back empty, a loop was truncated somewhere above

package/scripts/code-index.test.sh

@@ -38,7 +38,7 @@ mkdir -p "$REPO/.venv/lib"; printf 'def venv_only_fn():\n    helper_fn()\n' > "$
 OUT="$WORK/out"
 bash "$SCRIPT" --repo-path "$REPO" --output "$OUT" > "$WORK/log" 2>&1; rc=$?
 if [ "$rc" -eq 0 ]; then ok; else bad "build exit $rc: $(head -c 400 "$WORK/log")"; fi
-C=$(ls -d "$OUT"/*/ 2>/dev/null | head -n 1)
+C=$(find "$OUT" -mindepth 1 -maxdepth 1 -type d | head -n 1)
 for f in symbols imports callers file_domain; do
   if [ -s "$C/$f.tsv" ]; then ok; else bad "$f.tsv is empty"; fi
   if grep -qE '\.claude/|\.forge/|\.venv/|worktree_only_fn|forge_wt_only_fn|venv_only_fn' "$C/$f.tsv" 2>/dev/null; then
@@ -65,9 +65,28 @@ printf 'def venv_only_fn():\n    pass\n' > "$PLAIN/.venv/lib/site.py"
 printf 'def worktree_only_fn():\n    pass\n' > "$PLAIN/.claude/worktrees/x/src/w.py"
 bash "$SCRIPT" --repo-path "$PLAIN" --output "$WORK/out2" > "$WORK/log3" 2>&1; rc=$?
 if [ "$rc" -eq 0 ]; then ok; else bad "non-git build exit $rc"; fi
-C2=$(ls -d "$WORK"/out2/*/ 2>/dev/null | head -n 1)
+C2=$(find "$WORK/out2" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | head -n 1)
 if grep -q '^helper_fn	src/app.py	' "$C2/symbols.tsv" 2>/dev/null; then ok; else bad "non-git build missed helper_fn"; fi
 if grep -qE 'venv_only_fn|worktree_only_fn' "$C2/symbols.tsv" 2>/dev/null; then bad "non-git build walked .venv/.claude"; else ok; fi
 
+# --- 5. bash 3.2 portable (forge#4235): stock macOS bash has no associative arrays or mapfile ---
+if grep -vE '^[[:space:]]*#' "$SCRIPT" | grep -qE '(declare|local|typeset) -[a-zA-Z]*A|mapfile|readarray|grep -[a-zA-Z]*P'; then
+  bad "code-index.sh stays bash 3.2 portable (no associative arrays / mapfile): $(grep -nE '(declare|local|typeset) -[a-zA-Z]*A|mapfile|readarray' "$SCRIPT" | head -n 3 | tr '\n' ' ')"
+else ok; fi
+
+# --- 6. file-domain map: the most specific prefix wins, deterministically ---
+DOM="$WORK/dom"; mkdir -p "$DOM/services/api/auth" "$DOM/web/src/app/billing" "$DOM/scripts"
+printf 'x = 1\n' > "$DOM/services/api/auth/login.py"; printf 'y = 1\n' > "$DOM/services/api/routes.py"
+printf 'export const p = 1\n' > "$DOM/web/src/app/billing/page.tsx"; printf 'echo hi\n' > "$DOM/scripts/x.sh"
+git -C "$DOM" init -q -b main; git -C "$DOM" add -A; git -C "$DOM" commit -qm init
+bash "$SCRIPT" --repo-path "$DOM" --output "$WORK/out3" > "$WORK/log4" 2>&1; rc=$?
+if [ "$rc" -eq 0 ]; then ok; else bad "domain fixture build exit $rc: $(head -c 400 "$WORK/log4")"; fi
+C3=$(find "$WORK/out3" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | head -n 1)
+for want in "services/api/auth/login.py	auth" "services/api/routes.py	api" "web/src/app/billing/page.tsx	billing" "scripts/x.sh	pipeline-scripts"; do
+  if grep -qxF "$want" "$C3/file_domain.tsv" 2>/dev/null; then ok; else bad "file_domain.tsv missing '$want': $(tr '\n' ' ' < "$C3/file_domain.tsv" 2>/dev/null)"; fi
+done
+q=$(bash "$SCRIPT" query --domain auth --repo-path "$DOM" --output "$WORK/out3" 2>/dev/null)
+if [ "$q" = "services/api/auth/login.py	auth" ]; then ok; else bad "query --domain auth returned '$q'"; fi
+
 echo "code-index tests: $pass passed, $fail failed"
 [ "$fail" -eq 0 ]

package/scripts/fixtures/test-map/go/.github/workflows/ci.yml

@@ -21,3 +21,5 @@ jobs:
           go test ./...
       - name: docs
         run: ./scripts/check-docs
+      - name: vet
+        run: make vet

package/scripts/repo-facts.test.sh

@@ -12,7 +12,7 @@ eq() { if [ "$2" = "$3" ]; then ok; else bad "$1 (got: $2 want: $3)"; fi }
 q() { printf '%s' "$OUT" | jq -c "$1"; }
 
 new_repo() {
-  rm -rf "$TMP/$1"; mkdir -p "$TMP/$1"; cd "$TMP/$1" || exit 1
+  rm -rf "${TMP:?}/$1"; mkdir -p "$TMP/$1"; cd "$TMP/$1" || exit 1
   git init -q -b main; git config user.email t@example.com; git config user.name t; git config commit.gpgsign false
 }
 commit() { git add -A; git commit -qm "$1"; }
@@ -44,12 +44,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - run: make lint-all
+      - run: pytest tests/slow
   quick:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - run: make fmt
+      - run: ruff check .
 EOF
 lines src/big.ts 2100; commit c1
 echo x >> src/big.ts; lines src/small.ts 10; commit c2
@@ -62,8 +62,8 @@ eq "packages" "$(q '.layer_rules.packages')" '[{"name":"@x/a","dir":"packages/a"
 eq "edge" "$(q '.layer_rules.edges')" '[{"from":"@x/a","to":"@x/b","kind":"dependencies","manifest":"packages/a/package.json"}]'
 eq "boundary configs" "$(q '.layer_rules.boundary_configs')" '[".eslintrc.js"]'
 eq "services job" "$(q '[.slow_suites[] | select(.command == "pnpm run test") | .why]')" '["CI job .github/workflows/ci.yml#jobs.db uses services"]'
-eq "timeout job" "$(q '[.slow_suites[] | select(.command == "make lint-all") | .why]')" '["CI job .github/workflows/ci.yml#jobs.long sets timeout-minutes 45"]'
-eq "quick job not slow" "$(q '[.slow_suites[] | select(.command == "make fmt")] | length')" 0
+eq "timeout job" "$(q '[.slow_suites[] | select(.command == "pytest tests/slow") | .why]')" '["CI job .github/workflows/ci.yml#jobs.long sets timeout-minutes 45"]'
+eq "quick job not slow" "$(q '[.slow_suites[] | select(.command == "ruff check .")] | length')" 0
 eq "hotspot" "$(q '.hotspots')" '[{"path":"src/big.ts","lines":2101,"commits_90d":2,"hotspot":4202}]'
 
 # ---- 2. a cached test map is read: its e2e command is a slow suite ----

package/scripts/review-prepare.sh

@@ -87,15 +87,23 @@ case "$MERGE_ISSUE" in *[!0-9]*) MERGE_ISSUE="" ;; esac
 [ "$THOROUGH" = "true" ] || THOROUGH="false"
 
 # --- trusted helper resolution (install roots only; never cwd) ---
+# shellcheck source=/dev/null  # the resolver lib is found at runtime in the trusted install root
 type forge_resolve >/dev/null 2>&1 || { setopt nonomatch 2>/dev/null || true; _SELF_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd -P)"; for _r in "$(cygpath -u "${FORGEDOCK_HOME:-}" 2>/dev/null || printf %s "${FORGEDOCK_HOME:-}")" "${CLAUDE_PLUGIN_ROOT:-}" "${FORGE_ROOT:-}" "${FORGE_HOME:-}" "$(readlink -f "$HOME/.claude/commands/work-on.md" 2>/dev/null | sed 's|/commands/work-on\.md$||')" "$(head -n 1 "${CODEX_HOME:-$HOME/.codex}/forge-home" 2>/dev/null)" "$HOME/.claude/plugins/marketplaces/forgedock" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}"/plugins/cache/forgedock/forgedock/* "$HOME/.claude"/plugins/cache/forgedock/forgedock/* "$_SELF_ROOT"; do case "$_r" in /*) [ -f "$_r/scripts/lib/forge-resolve.sh" ] && { . "$_r/scripts/lib/forge-resolve.sh"; break; };; esac; done; type forge_resolve >/dev/null 2>&1 || forge_resolve() { :; }; }
 
 ROSTER_SCRIPT=$(forge_resolve review-roster.sh)
 TRUSTED_SCRIPT=$(forge_resolve trusted-comments.sh)
+# shellcheck disable=SC2034  # read by lib/review-delta-mode.sh (sourced below)
 REVIEW_DELTA_SCRIPT=$(forge_resolve review-delta.sh)
 CODE_INDEX_SCRIPT=$(forge_resolve code-index.sh)
-_l=$(forge_resolve lib/pr-issue-number.sh); if [ -n "$_l" ]; then . "$_l"; else pr_issue_number() { return 0; }; fi
-_l=$(forge_resolve lib/review-template-resolve.sh); if [ -n "$_l" ]; then . "$_l"; else review_template_resolve() { TEMPLATE_BASE=""; TEMPLATE_SOURCE="none"; MONOLITHIC_CATALOG=""; }; fi
-_l=$(forge_resolve lib/review-delta-mode.sh); if [ -n "$_l" ]; then . "$_l"; else review_delta_mode() { echo "FULL - 0"; }; carry_verified_from() { :; }; fi
+_l=$(forge_resolve lib/pr-issue-number.sh)
+# shellcheck source=/dev/null  # resolved at runtime from the trusted install root
+if [ -n "$_l" ]; then . "$_l"; else pr_issue_number() { return 0; }; fi
+_l=$(forge_resolve lib/review-template-resolve.sh)
+# shellcheck source=/dev/null  # resolved at runtime from the trusted install root
+if [ -n "$_l" ]; then . "$_l"; else review_template_resolve() { TEMPLATE_BASE=""; TEMPLATE_SOURCE="none"; MONOLITHIC_CATALOG=""; }; fi
+_l=$(forge_resolve lib/review-delta-mode.sh)
+# shellcheck source=/dev/null disable=SC2329  # resolved at runtime; the fallback stubs mirror the lib's API
+if [ -n "$_l" ]; then . "$_l"; else review_delta_mode() { echo "FULL - 0"; }; carry_verified_from() { :; }; fi
 
 # --- state, scratch and the ref-restore guard ---
 BLOCKERS=""
@@ -105,12 +113,14 @@ mkdir -p "$OUT_DIR" 2>/dev/null || { echo "review-prepare: cannot create $OUT_DI
 TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/review-prepare.XXXXXX") || exit 2
 ORIG_REF=""; CHECKED_OUT=""
 # restore_ref: put the checkout back exactly where it was. -f so a dirty review checkout can never wedge the restore.
+# shellcheck disable=SC2329  # called from cleanup (EXIT trap) and the checkout paths
 restore_ref() {
     if [ -n "$CHECKED_OUT" ] && [ -n "$ORIG_REF" ]; then
         git checkout -f "$ORIG_REF" >/dev/null 2>&1 || echo "review-prepare: WARNING could not restore $ORIG_REF" >&2
     fi
     CHECKED_OUT=""
 }
+# shellcheck disable=SC2329  # invoked by the EXIT trap
 cleanup() { restore_ref; rm -rf "$TMP_DIR"; }
 trap cleanup EXIT
 
@@ -144,6 +154,7 @@ if [ -z "$BLOCKERS" ]; then
         # Pinned (forge#3935): same-repo PRs only (a fork's branch name resolves to origin's own branch), and the fetched tip must equal REVIEW_SHA; the diff is taken against REVIEW_SHA, never the branch name.
         if { [ "$NO_DELTA" = "true" ] || [ "$IS_MILESTONE_TO_STAGING" = "true" ]; } && [ -n "$BASE" ] && [ -n "$HEAD" ] && [ "$(printf '%s' "$PR_INFO" | jq -r .isCrossRepository 2>/dev/null)" = "false" ] && printf '%s' "$REVIEW_SHA" | grep -qE '^[0-9a-f]{40}$' \
            && git fetch -q origin "$BASE" "$HEAD" 2>/dev/null && [ "$(git rev-parse -q --verify "refs/remotes/origin/${HEAD}^{commit}" 2>/dev/null)" = "$REVIEW_SHA" ]; then
+            # shellcheck disable=SC2015  # either assignment failing resets both, by design
             FILES=$(git diff --name-only "origin/${BASE}...${REVIEW_SHA}" 2>/dev/null) && DIFF=$(git diff "origin/${BASE}...${REVIEW_SHA}" 2>/dev/null) || { FILES=""; DIFF=""; }
         fi
         [ -n "$FILES" ] || block "gh pr diff failed"
@@ -420,7 +431,9 @@ canonical_roster() { local out="" a d; for a in $1; do d=$(agent_domain "$a"); c
 SELECTED_AGENTS=$(canonical_roster "$SELECTED_AGENTS")
 
 # --- Phase 3C: review mode (FULL | DELTA | BASE_SYNC_ONLY) ---
+# shellcheck disable=SC2034  # both read by lib/review-delta-mode.sh
 BASE_BRANCH="$BASE"
+# shellcheck disable=SC2034
 COMMENTS_JSON=$(gh api --paginate "repos/${REPO}/issues/${PR_NUMBER}/comments" 2>/dev/null || echo "")
 delta_roster() {
     local rounds="${1}" full="${2}" files="${3}" out="security" root
@@ -473,11 +486,20 @@ if [ "$REVIEW_MODE" != "BASE_SYNC_ONLY" ]; then
         _ito="${REVIEW_PREPARE_INDEX_TIMEOUT:-120}"; case "$_ito" in ''|*[!0-9]*|0) _ito=120 ;; esac
         _tbin=$(command -v timeout || command -v gtimeout || true)
         echo "review-prepare: building code index (limit ${_ito}s)" >&2
-        if [ -n "$_tbin" ]; then "$_tbin" "$_ito" bash "$CODE_INDEX_SCRIPT" --repo-path "$REPO_PATH" >/dev/null 2>&1; _irc=$?
-        else bash "$CODE_INDEX_SCRIPT" --repo-path "$REPO_PATH" >/dev/null 2>&1; _irc=$?; fi
+        # forge#4235: keep the build's stderr so a failure is diagnosable (its tail is echoed below); stdout stays discarded.
+        _ierr=$(mktemp "$OUT_DIR/.code-index-err-XXXXXX" 2>/dev/null) || _ierr=/dev/null
+        if [ -n "$_tbin" ]; then "$_tbin" "$_ito" bash "$CODE_INDEX_SCRIPT" --repo-path "$REPO_PATH" >/dev/null 2>"$_ierr"; _irc=$?
+        else bash "$CODE_INDEX_SCRIPT" --repo-path "$REPO_PATH" >/dev/null 2>"$_ierr"; _irc=$?; fi
         if [ "$_irc" -eq 0 ]; then INDEX_OK=1
         elif [ "$_irc" -eq 124 ]; then echo "review-prepare: code index timed out after ${_ito}s — skipping index slices (agents grep instead)" >&2
-        else echo "review-prepare: code index failed (exit $_irc) — skipping index slices (agents grep instead)" >&2; fi
+        else
+            echo "review-prepare: code index failed (exit $_irc) — skipping index slices (agents grep instead)" >&2
+            # forge#4316: the tail can name repo files; show the repo root as <repo>, strip control chars, cap each line
+            [ -s "$_ierr" ] && tail -n 20 "$_ierr" | tr -d '\000-\010\013-\037\177' \
+                | awk -v r="$REPO_PATH" '{ l = $0; if (r != "") { o = ""; while ((i = index(l, r)) > 0) { o = o substr(l, 1, i - 1) "<repo>"; l = substr(l, i + length(r)) } l = o l } print substr(l, 1, 200) }' \
+                | sed 's/^/review-prepare: code-index: /' >&2
+        fi
+        [ "$_ierr" = /dev/null ] || rm -f "$_ierr"
     fi
     build_index_slice() {
         local domain="${1}" files

package/scripts/review-prepare.test.sh

@@ -109,7 +109,9 @@ setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'CONFLICTING|DIRTY\n' > "
 prep "$ROOT"; eq "conflicting" .merge_health.mergeable CONFLICTING; eq "conflicting state" .merge_health.state DIRTY; eq "no retry on CONFLICTING" .merge_health.retries 0
 setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'UNKNOWN|UNKNOWN\n' > "$FIX/merge.seq"
 prep "$ROOT"; eq "unknown stays unknown after 3 retries" .merge_health.retries 3; eq "still UNKNOWN" .merge_health.mergeable UNKNOWN
-setup feat/x staging "README.md" "$DIFF_PLAIN"; printf 'garbage|$(rm -rf)\n' > "$FIX/merge.seq"
+setup feat/x staging "README.md" "$DIFF_PLAIN"
+# shellcheck disable=SC2016  # the literal $(rm -rf) is the hostile payload under test
+printf 'garbage|$(rm -rf)\n' > "$FIX/merge.seq"
 prep "$ROOT"; eq "garbage state normalized" .merge_health.state UNKNOWN
 setup feat/x staging "README.md" "$DIFF_PLAIN"; echo 0 > "$FIX/prior"
 prep "$ROOT"; eq "first-time contributor" .pr.first_time_contributor true
@@ -234,6 +236,7 @@ CFG_OVERRIDE="$WORK/emptyroot.yaml" prep "$WORK/root-notpl"
 rc_is "no template source" 3; eq "templates none" .templates.source none
 
 # --- 8. issue number extraction and trusted contract ---
+# shellcheck source=/dev/null
 . "$ROOT/scripts/lib/pr-issue-number.sh"
 chk() { local got; got=$(pr_issue_number_of "$2"); if [ "$got" = "$3" ]; then ok; else bad "$1: got '$got', want '$3'"; fi; }
 chk "Closes" "Closes #12" 12
@@ -271,6 +274,7 @@ setup feat/x staging "README.md" "$DIFF_PLAIN" "00000000000000000000000000000000
 prep "$ROOT" --checkout-pr
 rc_is "unknown sha cannot be checked out" 3
 if [ "$(git -C "$REPO_DIR" symbolic-ref --short HEAD 2>/dev/null)" = "main" ]; then ok; else bad "failed checkout moved HEAD"; fi
+# shellcheck disable=SC2016  # matches the literal $ORIG_REF in the script source
 if grep -q 'checkout -f "\$ORIG_REF"' "$ROOT/scripts/review-prepare.sh"; then ok; else bad "restore_ref must use git checkout -f"; fi
 
 # --- 10. fail closed on gh and bad arguments ---
@@ -317,8 +321,24 @@ eq "a hostile cwd roster script is never used" '.roster.agents | index("evil") !
 # --- code index build is bounded and visible (forge#4126) ---
 setup feat/x staging "services/api/auth.py" "$DIFF_AUTH_BILL"
 prep "$ROOT"
-eq "real index fills the auth slice" '.index_slices.auth | startswith("Domain files (auth):")' true
+_f0=$fail; eq "real index fills the auth slice" '.index_slices.auth | startswith("Domain files (auth):")' true
+# forge#4235: on failure show review-prepare's stderr (it carries the index build's exit code and stderr tail)
+[ "$fail" -eq "$_f0" ] || sed 's/^/  stderr: /' "$WORK/stderr"
 if grep -q "review-prepare: building code index" "$WORK/stderr"; then ok; else bad "index build must print a progress line on stderr"; fi
+# a failing build reports its exit code and stderr tail, and the slices fall back to grep
+mkroot "$WORK/root-failindex" "" "" templates
+# forge#4316: a line naming a repo file, carrying an ESC and over 200 chars is echoed sanitised and capped
+# shellcheck disable=SC2016 # $2 is the fake index script's own argument
+printf '#!/usr/bin/env bash\necho "index-boom-marker" >&2\nprintf "parse error in %%s/secret/file.py \\033[31m%%0300d\\n" "$2" 0 >&2\nexit 3\n' > "$WORK/root-failindex/scripts/code-index.sh"
+prep "$WORK/root-failindex"
+rc_is "failing index build" 0
+if grep -q "code index failed (exit 3)" "$WORK/stderr"; then ok; else bad "index failure must report the build's exit code on stderr"; fi
+if grep -q "review-prepare: code-index: index-boom-marker" "$WORK/stderr"; then ok; else bad "index failure must echo the build's stderr tail: $(head -c 300 "$WORK/stderr")"; fi
+_ix=$(grep "review-prepare: code-index: parse error" "$WORK/stderr")
+case "$_ix" in "review-prepare: code-index: parse error in <repo>/secret/file.py [31m0"*) ok ;; *) bad "index stderr must show the repo root as <repo> without control chars: $(printf '%s' "$_ix" | head -c 120 | od -c | head -3)" ;; esac
+if [ "${#_ix}" -le $((28 + 200)) ]; then ok; else bad "index stderr line must be capped at 200 chars, got ${#_ix}"; fi
+eq "failed index falls back to grep slices" .index_slices.auth "Code index not available — agent will use grep exploration"
+if ls "$WORK/out"/.code-index-err-* >/dev/null 2>&1; then bad "index stderr temp file must be removed"; else ok; fi
 if command -v timeout >/dev/null 2>&1 || command -v gtimeout >/dev/null 2>&1; then
     mkroot "$WORK/root-slowindex" "" "" templates
     printf '#!/usr/bin/env bash\nsleep 30\n' > "$WORK/root-slowindex/scripts/code-index.sh"