shipwright-cli 2.2.2 → 2.3.1

package/scripts/sw-model-router.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -204,6 +204,7 @@ set_config() {
     # Use jq to safely update the config
     local tmp_config
     tmp_config=$(mktemp)
+    trap "rm -f '$tmp_config'" RETURN
 
     if [[ "$value" == "true" ]] || [[ "$value" == "false" ]]; then
         jq ".${key} = ${value}" "$MODEL_ROUTING_CONFIG" > "$tmp_config"
@@ -336,6 +337,7 @@ configure_ab_test() {
 
     local tmp_config
     tmp_config=$(mktemp)
+    trap "rm -f '$tmp_config'" RETURN
 
     jq ".a_b_test = {\"enabled\": true, \"percentage\": $percentage, \"variant\": \"$variant\"}" \
         "$MODEL_ROUTING_CONFIG" > "$tmp_config"
@@ -521,6 +523,7 @@ main() {
                 if command -v jq &>/dev/null; then
                     local tmp_config
                     tmp_config=$(mktemp)
+                    trap "rm -f '$tmp_config'" RETURN
                     jq ".a_b_test.enabled = false" "$MODEL_ROUTING_CONFIG" > "$tmp_config"
                     mv "$tmp_config" "$MODEL_ROUTING_CONFIG"
                     success "Disabled A/B testing"

package/scripts/sw-otel.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-oversight.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-pipeline-composer.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -124,6 +124,7 @@ composer_create_pipeline() {
                 # Atomic write
                 local tmp_file
                 tmp_file=$(mktemp "${output_file}.XXXXXX")
+                trap "rm -f '$tmp_file'" RETURN
                 echo "$composed" | jq '.' > "$tmp_file"
                 mv "$tmp_file" "$output_file"
 
@@ -152,6 +153,7 @@ composer_create_pipeline() {
         info "Using fallback template: standard" >&2
         local tmp_file
         tmp_file=$(mktemp "${output_file}.XXXXXX")
+        trap "rm -f '$tmp_file'" RETURN
         cp "$fallback_template" "$tmp_file"
         mv "$tmp_file" "$output_file"
 

package/scripts/sw-pipeline-vitals.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -316,13 +316,11 @@ _compute_error_maturity() {
 # ─── File Locking Helpers ──────────────────────────────────────────────────
 _vitals_acquire_lock() {
     local lockfile="$1.lock"
-    local fd=200
-    eval "exec $fd>\"$lockfile\""
-    flock -w 5 "$fd" || { warn "Vitals lock timeout"; return 1; }
+    exec 200>"$lockfile"
+    flock -w 5 200 || { warn "Vitals lock timeout"; return 1; }
 }
 _vitals_release_lock() {
-    local fd=200
-    flock -u "$fd" 2>/dev/null || true
+    flock -u 200 2>/dev/null || true
 }
 
 # ═══════════════════════════════════════════════════════════════════════════

package/scripts/sw-pipeline.sh

@@ -11,7 +11,7 @@ unset CLAUDECODE 2>/dev/null || true
 # Ignore SIGHUP so tmux attach/detach doesn't kill long-running plan/design/review stages
 trap '' HUP
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -850,6 +850,7 @@ Reply with ONLY the classification word, nothing else." --model haiku < /dev/nul
         mkdir -p "$class_dir" 2>/dev/null || true
         local tmp_class
         tmp_class="$(mktemp)"
+        trap "rm -f '$tmp_class'" RETURN
         if [[ -f "$class_history" ]]; then
             jq --arg sig "$error_sig" --arg cls "$classification" --arg canon "$canonical_category" --arg stage "$stage_id" \
                 '.[$sig] = {"classification": $cls, "canonical": $canon, "stage": $stage, "recorded_at": now}' \
@@ -1269,6 +1270,7 @@ run_pipeline() {
                 # Remove this stage from the skip file
                 local tmp_skip
                 tmp_skip="$(mktemp)"
+                trap "rm -f '$tmp_skip'" RETURN
                 grep -vx "$id" "$ARTIFACTS_DIR/skip-stage.txt" > "$tmp_skip" 2>/dev/null || true
                 mv "$tmp_skip" "$ARTIFACTS_DIR/skip-stage.txt"
                 continue
@@ -1600,6 +1602,7 @@ pipeline_post_completion_cleanup() {
         # Reset status to idle (preserves the file for reference but unblocks new runs)
         local tmp_state
         tmp_state=$(mktemp)
+        trap "rm -f '$tmp_state'" RETURN
         sed 's/^status: .*/status: idle/' "$STATE_FILE" > "$tmp_state" 2>/dev/null || true
         mv "$tmp_state" "$STATE_FILE"
     fi

package/scripts/sw-pm.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Cross-platform compatibility ──────────────────────────────────────────
@@ -77,7 +77,7 @@ show_help() {
     echo -e "  ${DIM}shipwright pm history${RESET}                     # Show past decisions"
     echo -e "  ${DIM}shipwright pm history --pattern${RESET}           # Show success patterns"
     echo ""
-    echo -e "${DIM}Docs: https://sethdford.github.io/shipwright  |  GitHub: https://github.com/sethdford/shipwright${RESET}"
+    echo -e "${DIM}Docs: $(_sw_docs_url)  |  GitHub: $(_sw_github_url)${RESET}"
 }
 
 # ─── analyze_issue <issue_num> ───────────────────────────────────────────────
@@ -522,6 +522,7 @@ cmd_recommend() {
         ensure_pm_history
         local tmp_hist
         tmp_hist=$(mktemp)
+        trap "rm -f '$tmp_hist'" RETURN
         jq --argjson rec "$recommendation" '.decisions += [$rec]' "$PM_HISTORY" > "$tmp_hist" && mv "$tmp_hist" "$PM_HISTORY"
         emit_event "pm.recommend" "issue=${issue_num}"
         return 0
@@ -549,6 +550,7 @@ cmd_recommend() {
     ensure_pm_history
     local tmp_hist
     tmp_hist=$(mktemp)
+    trap "rm -f '$tmp_hist'" RETURN
     jq --argjson rec "$recommendation" '.decisions += [$rec]' "$PM_HISTORY" > "$tmp_hist" && mv "$tmp_hist" "$PM_HISTORY"
 
     success "Recommendation saved to history"
@@ -612,6 +614,7 @@ cmd_learn() {
     # Save to history
     local tmp_hist
     tmp_hist=$(mktemp)
+    trap "rm -f '$tmp_hist'" RETURN
     jq --argjson outcome "$outcome_record" '.outcomes += [$outcome]' "$PM_HISTORY" > "$tmp_hist" && mv "$tmp_hist" "$PM_HISTORY"
 
     success "Recorded ${outcome} outcome for issue #${issue_num}"

package/scripts/sw-pr-lifecycle.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-predictive.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -188,6 +188,7 @@ predictive_confirm_anomaly() {
     # Find the most recent unconfirmed anomaly for this stage+metric
     local tmp_file
     tmp_file=$(mktemp "${TMPDIR:-/tmp}/sw-anomaly-confirm.XXXXXX")
+    trap "rm -f '$tmp_file'" RETURN
     local found=false
 
     # Process file in reverse to find most recent unconfirmed
@@ -283,6 +284,7 @@ _predictive_update_alarm_rates() {
     # Atomic write
     local tmp_file
     tmp_file=$(mktemp "${TMPDIR:-/tmp}/sw-anomaly-thresh.XXXXXX")
+    trap "rm -f '$tmp_file'" RETURN
     jq --arg m "$metric_name" \
        --argjson crit "$new_critical" \
        --argjson warn "$new_warning" \
@@ -755,6 +757,7 @@ predict_update_baseline() {
     # Atomic write
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --arg key "$key" \
        --argjson val "$new_value" \
        --argjson cnt "$new_count" \

package/scripts/sw-prep.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Handle subcommands ───────────────────────────────────────────────────────
@@ -129,7 +129,7 @@ show_help() {
     echo -e "  ${DIM}.claude/hooks/*.sh${RESET}                   Pre/post action hooks"
     echo -e "  ${DIM}.github/ISSUE_TEMPLATE/agent-task.md${RESET} Agent task template"
     echo ""
-    echo -e "${DIM}Docs: https://sethdford.github.io/shipwright  |  GitHub: https://github.com/sethdford/shipwright${RESET}"
+    echo -e "${DIM}Docs: $(_sw_docs_url)  |  GitHub: $(_sw_github_url)${RESET}"
 }
 
 # ─── CLI Argument Parsing ───────────────────────────────────────────────────
@@ -828,6 +828,7 @@ prep_learn_patterns() {
     # Write patterns file atomically
     local tmp_patterns
     tmp_patterns=$(mktemp)
+    trap "rm -f '$tmp_patterns'" RETURN
     jq -n \
         --arg ts "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
         --arg lang "${LANG_DETECTED:-}" \

package/scripts/sw-ps.sh

@@ -5,7 +5,7 @@
 # ║  Displays a table of agents running in claude-* tmux windows with       ║
 # ║  PID, status, idle time, and pane references.                           ║
 # ╚═══════════════════════════════════════════════════════════════════════════╝
-VERSION="2.2.2"
+VERSION="2.3.1"
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 

package/scripts/sw-public-dashboard.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -323,7 +323,7 @@ generate_html() {
         </div>
 
         <div class="footer">
-            <p>Generated by <a href="https://github.com/sethdford/shipwright">Shipwright</a> v1.13.0</p>
+            <p>Generated by <a href="GITHUB_URL_PLACEHOLDER">Shipwright</a> v1.13.0</p>
             <p style="margin-top: 8px; color: #555;">Dashboard auto-refreshes every 30s when served from dashboard server</p>
             <p style="margin-top: 8px;" id="footer-timestamp">Generated: —</p>
         </div>
@@ -384,7 +384,12 @@ generate_html() {
                         const newDoc = parser.parseFromString(html, 'text/html');
                         const newScript = newDoc.querySelector('script');
                         if (newScript) {
-                            eval(newScript.textContent);
+                            // Use DOM script insertion instead of eval: script comes from same-origin
+                            // fetch of this page; DOM insertion executes in global scope without eval
+                            const s = document.createElement('script');
+                            s.textContent = newScript.textContent;
+                            document.body.appendChild(s);
+                            s.remove();
                             renderDashboard();
                         }
                     })
@@ -417,6 +422,7 @@ cmd_export() {
     html="${html//TITLE_PLACEHOLDER/$title}"
     html="${html//PRIVACY_PLACEHOLDER/$privacy}"
     html="${html//\{DATA_PLACEHOLDER\}/$state_data}"
+    html="${html//GITHUB_URL_PLACEHOLDER/$(_sw_github_url)}"
 
     # Atomic write
     local tmp_file
@@ -736,7 +742,7 @@ ${BOLD}SHARE LINKS${RESET}
   Share links require a running dashboard server to serve the public endpoint.
   By default, requires dashboard to serve at: https://your-domain.com/public-dashboard/<token>
 
-${DIM}Docs: https://sethdford.github.io/shipwright${RESET}
+${DIM}Docs: $(_sw_docs_url)${RESET}
 EOF
 }
 

package/scripts/sw-quality.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-reaper.sh

@@ -11,7 +11,7 @@
 # ║    shipwright reaper --watch      Continuous loop (default: 5s)         ║
 # ║    shipwright reaper --dry-run    Preview what would be reaped          ║
 # ╚═══════════════════════════════════════════════════════════════════════════╝
-VERSION="2.2.2"
+VERSION="2.3.1"
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 

package/scripts/sw-recruit.sh

@@ -286,6 +286,7 @@ EOF
 )
     local _tmp_roles
     _tmp_roles=$(mktemp)
+    trap "rm -f '$_tmp_roles'" RETURN
     if echo "$roles_json" | jq '.' > "$_tmp_roles" 2>/dev/null && [[ -s "$_tmp_roles" ]]; then
         mv "$_tmp_roles" "$ROLES_DB"
     else
@@ -426,6 +427,7 @@ _recruit_record_match() {
     if [[ "$current_lines" -gt "$max_history" ]]; then
         local tmp_trunc
         tmp_trunc=$(mktemp)
+        trap "rm -f '$tmp_trunc'" RETURN
         tail -n "$max_history" "$MATCH_HISTORY" > "$tmp_trunc" && _recruit_locked_write "$MATCH_HISTORY" "$tmp_trunc" || rm -f "$tmp_trunc"
     fi
 
@@ -492,6 +494,7 @@ Return JSON only."
             # Persist to roles DB
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
             if jq --arg key "$role_key" --argjson role "$(echo "$result" | jq 'del(.key)')" '.[$key] = $role' "$ROLES_DB" > "$tmp_file"; then
                 _recruit_locked_write "$ROLES_DB" "$tmp_file"
             else
@@ -544,6 +547,7 @@ Return JSON only."
 
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     if jq --arg key "$role_key" --argjson role "$role_json" '.[$key] = $role' "$ROLES_DB" > "$tmp_file"; then
         _recruit_locked_write "$ROLES_DB" "$tmp_file"
     else
@@ -622,6 +626,7 @@ cmd_record_outcome() {
 
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --arg id "$agent_id" \
        --argjson tc "$tasks_completed" \
        --argjson sc "$success_count" \
@@ -659,6 +664,7 @@ cmd_record_outcome() {
     if [[ -f "$MATCH_HISTORY" ]]; then
         local tmp_mh
         tmp_mh=$(mktemp)
+        trap "rm -f '$tmp_mh'" RETURN
         # Find the most recent match for this agent_id with null outcome, and backfill
         awk -v agent="$agent_id" -v outcome="$outcome" '
         BEGIN { found = 0 }
@@ -753,6 +759,7 @@ _recruit_track_role_usage() {
 
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --arg role "$role" --arg event "$event" --arg ts "$(now_iso)" '
         .[$role] = (.[$role] // {matches: 0, successes: 0, failures: 0, last_used: ""}) |
         .[$role].last_used = $ts |
@@ -1221,6 +1228,7 @@ _recruit_meta_learning_check() {
 
         local tmp_file
         tmp_file=$(mktemp)
+        trap "rm -f '$tmp_file'" RETURN
         jq --argjson corr "$correction" '
             .corrections = ((.corrections // []) + [$corr] | .[-100:])
         ' "$META_LEARNING_DB" > "$tmp_file" && _recruit_locked_write "$META_LEARNING_DB" "$tmp_file" || rm -f "$tmp_file"
@@ -1267,6 +1275,7 @@ _recruit_reflect() {
     # Track accuracy trend
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --argjson acc "$accuracy" --arg ts "$(now_iso)" '
         .accuracy_trend = ((.accuracy_trend // []) + [{accuracy: $acc, ts: $ts}] | .[-50:]) |
         .last_reflection = $ts
@@ -1355,6 +1364,7 @@ _recruit_meta_validate_self_tune() {
             # Reset heuristics to empty (forces fallback to keyword_match defaults)
             local tmp_heur
             tmp_heur=$(mktemp)
+            trap "rm -f '$tmp_heur'" RETURN
             echo '{"keyword_weights": {}, "meta_reverted_at": "'"$(now_iso)"'", "revert_reason": "accuracy_below_floor"}' > "$tmp_heur"
             _recruit_locked_write "$HEURISTICS_DB" "$tmp_heur" || rm -f "$tmp_heur"
             emit_event "recruit_meta_revert" "accuracy=${current_accuracy}" "floor=${accuracy_floor}" "reason=declining_below_floor"
@@ -1454,6 +1464,7 @@ Return JSON only."
 
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
             jq --arg key "$role_key" --argjson role "$role_json" '.[$key] = $role' "$ROLES_DB" > "$tmp_file" && _recruit_locked_write "$ROLES_DB" "$tmp_file" || rm -f "$tmp_file"
 
             # Update heuristics with trigger keywords
@@ -1462,6 +1473,7 @@ Return JSON only."
             if [[ -n "$keywords" ]]; then
                 local heur_tmp
                 heur_tmp=$(mktemp)
+                trap "rm -f '$heur_tmp'" RETURN
                 while IFS= read -r kw; do
                     [[ -z "$kw" ]] && continue
                     jq --arg kw "$kw" --arg role "$role_key" \
@@ -1588,6 +1600,7 @@ Return JSON only."
             # Save the LLM-generated mind profile
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
             jq --arg id "$agent_id" --argjson mind "$result" '.[$id] = ($mind + {updated: (now | todate)})' "$AGENT_MINDS_DB" > "$tmp_file" && _recruit_locked_write "$AGENT_MINDS_DB" "$tmp_file" || rm -f "$tmp_file"
 
             success "Mind profile generated:"
@@ -1629,6 +1642,7 @@ Return JSON only."
 
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --arg id "$agent_id" --argjson mind "$mind_json" '.[$id] = $mind' "$AGENT_MINDS_DB" > "$tmp_file" && _recruit_locked_write "$AGENT_MINDS_DB" "$tmp_file" || rm -f "$tmp_file"
 
     local strengths_display="none detected"
@@ -1815,6 +1829,7 @@ cmd_self_tune() {
 
     local tmp_heuristics
     tmp_heuristics=$(mktemp)
+    trap "rm -f '$tmp_heuristics'" RETURN
     cp "$HEURISTICS_DB" "$tmp_heuristics"
 
     local i=0
@@ -2561,6 +2576,7 @@ cmd_audit() {
     if [[ -f "$META_LEARNING_DB" ]]; then
         local tmp_audit
         tmp_audit=$(mktemp)
+        trap "rm -f '$tmp_audit'" RETURN
         jq --argjson score "$score" --arg ts "$(now_iso)" --argjson fails "$fail_count" '
             .audit_trend = ((.audit_trend // []) + [{score: $score, ts: $ts, failures: $fails}] | .[-50:])
         ' "$META_LEARNING_DB" > "$tmp_audit" && _recruit_locked_write "$META_LEARNING_DB" "$tmp_audit" || rm -f "$tmp_audit"

package/scripts/sw-regression.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -198,6 +198,7 @@ cmd_baseline() {
 
     local tmp_file
     tmp_file=$(mktemp "${baseline_file}.tmp.XXXXXX")
+    trap "rm -f '$tmp_file'" RETURN
 
     echo "$metrics" > "$tmp_file"
     mv "$tmp_file" "$baseline_file"

package/scripts/sw-release-manager.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-release.sh

@@ -5,8 +5,9 @@
 # ╚═══════════════════════════════════════════════════════════════════════════╝
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
+trap 'rm -f "${tmp_file:-}"' EXIT
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -258,7 +259,7 @@ generate_changelog_md() {
         echo ""
         echo "$breaking_commits" | while IFS='|' read -r hash subject; do
             [[ -z "$hash" ]] && continue
-            echo "- $subject ([\`$hash\`](https://github.com/sethdford/shipwright/commit/$hash))"
+            echo "- $subject ([\`$hash\`]($(_sw_github_url)/commit/$hash))"
         done
         echo ""
     fi
@@ -269,7 +270,7 @@ generate_changelog_md() {
         echo ""
         echo "$features_commits" | while IFS='|' read -r hash subject; do
             [[ -z "$hash" ]] && continue
-            echo "- $subject ([\`$hash\`](https://github.com/sethdford/shipwright/commit/$hash))"
+            echo "- $subject ([\`$hash\`]($(_sw_github_url)/commit/$hash))"
         done
         echo ""
     fi
@@ -280,7 +281,7 @@ generate_changelog_md() {
         echo ""
         echo "$fixes_commits" | while IFS='|' read -r hash subject; do
             [[ -z "$hash" ]] && continue
-            echo "- $subject ([\`$hash\`](https://github.com/sethdford/shipwright/commit/$hash))"
+            echo "- $subject ([\`$hash\`]($(_sw_github_url)/commit/$hash))"
         done
         echo ""
     fi
@@ -291,7 +292,7 @@ generate_changelog_md() {
         echo ""
         echo "$docs_commits" | while IFS='|' read -r hash subject; do
             [[ -z "$hash" ]] && continue
-            echo "- $subject ([\`$hash\`](https://github.com/sethdford/shipwright/commit/$hash))"
+            echo "- $subject ([\`$hash\`]($(_sw_github_url)/commit/$hash))"
         done
         echo ""
     fi
@@ -346,6 +347,7 @@ update_version_in_files() {
             # This is shell-safe: VERSION="1.11.0" → VERSION="1.12.0"
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
             sed 's/^VERSION="[^"]*"$/VERSION="'"$version_num"'"/' "$file" > "$tmp_file"
             mv "$tmp_file" "$file"
             success "Updated VERSION in $(basename "$file")"

package/scripts/sw-remote.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-replay.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EVENTS_FILE="${HOME}/.shipwright/events.jsonl"
 

package/scripts/sw-retro.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Cross-platform compatibility ──────────────────────────────────────────
@@ -465,6 +465,9 @@ cmd_run() {
     # Generate report
     generate_retro_report "$from_date" "$to_date" "$analysis" "$agent_perf" "$velocity"
 
+    # Feed retro into self-optimization loop (|| true to avoid breaking retro if optimization unavailable)
+    [[ -f "$SCRIPT_DIR/sw-self-optimize.sh" ]] && "$SCRIPT_DIR/sw-self-optimize.sh" ingest-retro || true
+
     # Offer to create issues
     if command -v gh &>/dev/null; then
         echo ""

package/scripts/sw-scale.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Dependency check ─────────────────────────────────────────────────────────
@@ -64,6 +64,7 @@ init_rules() {
     if [[ ! -f "$SCALE_RULES_FILE" ]]; then
         local tmp_file
         tmp_file=$(mktemp)
+        trap "rm -f '$tmp_file'" RETURN
         cat > "$tmp_file" << 'JSON'
 {
   "iteration_threshold": 3,
@@ -105,6 +106,7 @@ in_cooldown() {
 update_scale_state() {
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
 
     if [[ -f "$SCALE_STATE_FILE" ]]; then
         # Update existing state
@@ -241,6 +243,7 @@ cmd_rules() {
 
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
 
             jq --arg key "$key" --arg value "$value" \
                 'if ($value | test("^[0-9]+$")) then

package/scripts/sw-security-audit.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.2"
+VERSION="2.3.1"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"