shipwright-cli 2.4.0 → 3.0.0

package/scripts/sw-evidence.sh

@@ -8,7 +8,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -16,6 +16,7 @@ REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 [[ -f "$SCRIPT_DIR/lib/compat.sh" ]] && source "$SCRIPT_DIR/lib/compat.sh"
 # shellcheck source=lib/helpers.sh
 [[ -f "$SCRIPT_DIR/lib/helpers.sh" ]] && source "$SCRIPT_DIR/lib/helpers.sh"
+[[ -f "$SCRIPT_DIR/lib/config.sh" ]] && source "$SCRIPT_DIR/lib/config.sh"
 [[ "$(type -t info 2>/dev/null)" == "function" ]]    || info()    { echo -e "\033[38;2;0;212;255m\033[1m▸\033[0m $*"; }
 [[ "$(type -t success 2>/dev/null)" == "function" ]] || success() { echo -e "\033[38;2;74;222;128m\033[1m✓\033[0m $*"; }
 [[ "$(type -t warn 2>/dev/null)" == "function" ]]    || warn()    { echo -e "\033[38;2;250;204;21m\033[1m⚠\033[0m $*"; }
@@ -24,21 +25,13 @@ if [[ "$(type -t now_iso 2>/dev/null)" != "function" ]]; then
   now_iso()   { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
   now_epoch() { date +%s; }
 fi
-if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
-  emit_event() {
-    local event_type="$1"; shift; mkdir -p "${HOME}/.shipwright"
-    local payload="{\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"type\":\"$event_type\""
-    while [[ $# -gt 0 ]]; do local key="${1%%=*}" val="${1#*=}"; payload="${payload},\"${key}\":\"${val}\""; shift; done
-    echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
-  }
-fi
 
 # Cross-platform timeout: macOS lacks GNU timeout
 _run_with_timeout() {
     local secs="$1"; shift
-    if command -v gtimeout &>/dev/null; then
+    if command -v gtimeout >/dev/null 2>&1; then
         gtimeout "$secs" "$@"
-    elif command -v timeout &>/dev/null; then
+    elif command -v timeout >/dev/null 2>&1; then
         timeout "$secs" "$@"
     else
         # Fallback: run without timeout
@@ -83,6 +76,61 @@ get_require_fresh() {
     fi
 }
 
+# ═════════════════════════════════════════════════════════════════════════════
+# ASSERTION EVALUATION
+# Checks response body against assertions defined in policy.json.
+# Assertion names map to simple content checks (case-insensitive).
+# Returns the count of failed assertions (0 = all passed).
+# ═════════════════════════════════════════════════════════════════════════════
+
+evaluate_assertions() {
+    local collector_json="$1"
+    local response_body="$2"
+    local failed=0
+
+    local assertions
+    assertions=$(echo "$collector_json" | jq -r '.assertions[]? // empty' 2>/dev/null)
+    [[ -z "$assertions" ]] && { echo "0"; return; }
+
+    while IFS= read -r assertion; do
+        [[ -z "$assertion" ]] && continue
+        local check_passed="false"
+
+        case "$assertion" in
+            # Common assertion patterns — map names to body content checks
+            page-title-visible)
+                echo "$response_body" | grep -qi '<title>' && check_passed="true" ;;
+            websocket-connected|websocket-active)
+                echo "$response_body" | grep -qi 'websocket\|ws://' && check_passed="true" ;;
+            status-ok)
+                echo "$response_body" | grep -qi '"status"' && check_passed="true" ;;
+            response-has-version)
+                echo "$response_body" | grep -qi '"version"' && check_passed="true" ;;
+            valid-json-output|valid-json)
+                echo "$response_body" | jq empty 2>/dev/null && check_passed="true" ;;
+            has-pipeline-state)
+                echo "$response_body" | grep -qi 'pipeline\|status\|stage' && check_passed="true" ;;
+            stage-list-rendered)
+                echo "$response_body" | grep -qi 'stage\|pipeline' && check_passed="true" ;;
+            progress-indicator-visible)
+                echo "$response_body" | grep -qi 'progress\|percent\|stage' && check_passed="true" ;;
+            schema-valid|db-accessible)
+                echo "$response_body" | grep -qi 'schema\|version\|ok\|healthy' && check_passed="true" ;;
+            *)
+                # Generic: check if the assertion name (with hyphens as spaces) appears in body
+                local search_term="${assertion//-/ }"
+                echo "$response_body" | grep -qi "$search_term" && check_passed="true" ;;
+        esac
+
+        if [[ "$check_passed" != "true" ]]; then
+            warn "[assertion] '${assertion}' not satisfied" >&2
+            failed=$((failed + 1))
+        fi
+    done <<< "$assertions"
+
+    echo "$failed"
+}
+
 # ═════════════════════════════════════════════════════════════════════════════
 # TYPE-SPECIFIC COLLECTORS
 # Each returns a JSON evidence record written to EVIDENCE_DIR/<name>.json
@@ -96,7 +144,8 @@ collect_browser() {
 
     local entrypoint base_url url
     entrypoint=$(echo "$collector_json" | jq -r '.entrypoint // "/"')
-    base_url=$(echo "$collector_json" | jq -r '.baseUrl // "http://localhost:3000"')
+    base_url=$(echo "$collector_json" | jq -r '.baseUrl // ""')
+    [[ -z "$base_url" ]] && base_url="http://localhost:$(_config_get_int "dashboard.port" 8767)"
     url="${base_url}${entrypoint}"
 
     info "[browser] ${name}: ${url}"
@@ -105,8 +154,9 @@ collect_browser() {
     local response_size="0"
     local response_body=""
 
-    if command -v curl &>/dev/null; then
-        local tmpfile="/tmp/sw-evidence-${name}.txt"
+    if command -v curl >/dev/null 2>&1; then
+        local tmpfile
+        tmpfile=$(mktemp "${TMPDIR:-/tmp}/sw-evidence-browser.XXXXXX")
         http_status=$(curl -s -o "$tmpfile" -w "%{http_code}" --max-time 30 "$url" 2>/dev/null || echo "0")
         if [[ -f "$tmpfile" ]]; then
             response_size=$(wc -c < "$tmpfile" 2>/dev/null || echo "0")
@@ -118,9 +168,17 @@ collect_browser() {
     local passed="false"
     [[ "$http_status" -ge 200 && "$http_status" -lt 400 ]] && passed="true"
 
+    # Evaluate assertions against response body (if status check passed)
+    local assertion_failures=0
+    if [[ "$passed" == "true" && -n "$response_body" ]]; then
+        assertion_failures=$(evaluate_assertions "$collector_json" "$response_body")
+        [[ "$assertion_failures" -gt 0 ]] && passed="false"
+    fi
+
     write_evidence_record "$name" "browser" "$passed" \
         "$(jq -n --arg url "$url" --argjson status "$http_status" --argjson size "$response_size" \
-        '{url: $url, http_status: $status, response_size: $size}')"
+        --argjson assertion_failures "$assertion_failures" \
+        '{url: $url, http_status: $status, response_size: $size, assertion_failures: $assertion_failures}')"
 }
 
 # ─── API: REST/GraphQL endpoint verification ─────────────────────────────────
@@ -138,7 +196,8 @@ collect_api() {
 
     if [[ -z "$url" ]]; then
         local base_url entrypoint
-        base_url=$(echo "$collector_json" | jq -r '.baseUrl // "http://localhost:3000"')
+        base_url=$(echo "$collector_json" | jq -r '.baseUrl // ""')
+        [[ -z "$base_url" ]] && base_url="http://localhost:$(_config_get_int "dashboard.port" 8767)"
         entrypoint=$(echo "$collector_json" | jq -r '.entrypoint // "/"')
         url="${base_url}${entrypoint}"
     fi
@@ -150,9 +209,10 @@ collect_api() {
     local response_body=""
     local content_type=""
 
-    if command -v curl &>/dev/null; then
-        local tmpfile="/tmp/sw-evidence-${name}.txt"
-        local header_file="/tmp/sw-evidence-${name}-headers.txt"
+    if command -v curl >/dev/null 2>&1; then
+        local tmpfile header_file
+        tmpfile=$(mktemp "${TMPDIR:-/tmp}/sw-evidence-api.XXXXXX")
+        header_file=$(mktemp "${TMPDIR:-/tmp}/sw-evidence-api-headers.XXXXXX")
         local curl_args=(-s -o "$tmpfile" -D "$header_file" -w "%{http_code}" -X "$method" --max-time "$timeout")
 
         # Add custom headers
@@ -181,6 +241,7 @@ collect_api() {
             content_type=$(grep -i "^content-type:" "$header_file" 2>/dev/null | head -1 | sed 's/^[^:]*: *//' | tr -d '\r' || echo "")
             rm -f "$header_file"
         fi
+        rm -f "$tmpfile"
     fi
 
     local passed="false"
@@ -192,12 +253,19 @@ collect_api() {
         valid_json="true"
     fi
 
+    # Evaluate assertions against response body (if status check passed)
+    local assertion_failures=0
+    if [[ "$passed" == "true" && -n "$response_body" ]]; then
+        assertion_failures=$(evaluate_assertions "$collector_json" "$response_body")
+        [[ "$assertion_failures" -gt 0 ]] && passed="false"
+    fi
+
     write_evidence_record "$name" "api" "$passed" \
         "$(jq -n --arg url "$url" --arg method "$method" \
         --argjson status "$http_status" --argjson expected "$expected_status" \
         --argjson size "$response_size" --arg content_type "$content_type" \
-        --arg valid_json "$valid_json" \
-        '{url: $url, method: $method, http_status: $status, expected_status: $expected, response_size: $size, content_type: $content_type, valid_json: ($valid_json == "true")}')"
+        --arg valid_json "$valid_json" --argjson assertion_failures "$assertion_failures" \
+        '{url: $url, method: $method, http_status: $status, expected_status: $expected, response_size: $size, content_type: $content_type, valid_json: ($valid_json == "true"), assertion_failures: $assertion_failures}')"
 }
 
 # ─── CLI: Execute a command and check exit code ──────────────────────────────
@@ -236,6 +304,13 @@ collect_cli() {
         valid_json="true"
     fi
 
+    # Evaluate assertions against command output (if exit code check passed)
+    local assertion_failures=0
+    if [[ "$passed" == "true" && -n "$output" ]]; then
+        assertion_failures=$(evaluate_assertions "$collector_json" "$output")
+        [[ "$assertion_failures" -gt 0 ]] && passed="false"
+    fi
+
     local output_size=${#output}
     # Truncate output for the evidence record (keep first 2000 chars)
     local output_preview="${output:0:2000}"
@@ -274,12 +349,20 @@ collect_database() {
     local passed="false"
     [[ "$exit_code" -eq "$expected_exit" ]] && passed="true"
 
+    # Evaluate assertions against command output (if exit code check passed)
+    local assertion_failures=0
+    if [[ "$passed" == "true" && -n "$output" ]]; then
+        assertion_failures=$(evaluate_assertions "$collector_json" "$output")
+        [[ "$assertion_failures" -gt 0 ]] && passed="false"
+    fi
+
     local output_preview="${output:0:2000}"
 
     write_evidence_record "$name" "database" "$passed" \
         "$(jq -n --arg cmd "$command_str" --argjson exit_code "$exit_code" \
         --argjson expected "$expected_exit" --arg output_preview "$output_preview" \
-        '{command: $cmd, exit_code: $exit_code, expected_exit_code: $expected, output_preview: $output_preview}')"
+        --argjson assertion_failures "$assertion_failures" \
+        '{command: $cmd, exit_code: $exit_code, expected_exit_code: $expected, output_preview: $output_preview, assertion_failures: $assertion_failures}')"
 }
 
 # ─── Webhook: Issue a callback and verify response ───────────────────────────
@@ -306,8 +389,9 @@ collect_webhook() {
     local http_status="0"
     local response_body=""
 
-    if command -v curl &>/dev/null; then
-        local tmpfile="/tmp/sw-evidence-${name}.txt"
+    if command -v curl >/dev/null 2>&1; then
+        local tmpfile
+        tmpfile=$(mktemp "${TMPDIR:-/tmp}/sw-evidence-webhook.XXXXXX")
         http_status=$(curl -s -o "$tmpfile" -w "%{http_code}" -X "$method" \
             -H "Content-Type: application/json" -d "$body" \
             --max-time "$timeout" "$url" 2>/dev/null || echo "0")
@@ -433,7 +517,7 @@ cmd_capture() {
             *)         warn "Unknown collector type: ${ctype} (skipping ${cname})" ; continue ;;
         esac
 
-        ((total++))
+        total=$((total + 1))
 
         local evidence_file="${EVIDENCE_DIR}/${cname}.json"
         local cpassed="false"
@@ -442,9 +526,9 @@ cmd_capture() {
         fi
 
         if [[ "$cpassed" == "true" ]]; then
-            ((passed++))
+            passed=$((passed + 1))
         else
-            ((failed++))
+            failed=$((failed + 1))
         fi
 
         manifest_entries=$(echo "$manifest_entries" | jq \
@@ -506,7 +590,7 @@ cmd_verify() {
     if [[ "$require_fresh" == "true" && "$age_seconds" -gt "$max_age_seconds" ]]; then
         error "Evidence is stale: captured ${age_seconds}s ago (max: ${max_age_seconds}s)"
         all_passed="false"
-        ((failed++))
+        failed=$((failed + 1))
     else
         local age_minutes=$((age_seconds / 60))
         info "Evidence age: ${age_minutes}m (max: ${max_age_minutes}m)"
@@ -521,7 +605,7 @@ cmd_verify() {
 
     while IFS= read -r entry; do
         [[ -z "$entry" ]] && continue
-        ((checked++))
+        checked=$((checked + 1))
 
         local cname ctype cpassed
         cname=$(echo "$entry" | jq -r '.name')
@@ -531,7 +615,7 @@ cmd_verify() {
         if [[ "$cpassed" != "true" ]]; then
             error "Collector '${cname}' (${ctype}) failed"
             all_passed="false"
-            ((failed++))
+            failed=$((failed + 1))
         else
             success "Collector '${cname}' (${ctype}) passed"
         fi

package/scripts/sw-feedback.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -34,16 +34,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 # ─── Storage Paths ──────────────────────────────────────────────────────────
 INCIDENTS_FILE="${HOME}/.shipwright/incidents.jsonl"
 ERROR_THRESHOLD=5          # Create issue if error count >= threshold
@@ -262,7 +252,7 @@ git show $regression_commit
 EOF
     )
 
-    if ! command -v gh &>/dev/null; then
+    if ! command -v gh >/dev/null 2>&1; then
         error "gh CLI not found — cannot create issue"
         return 1
     fi
@@ -275,7 +265,7 @@ EOF
         --body "$issue_body" \
         --label "shipwright" \
         --label "hotfix" \
-        2>&1 | tail -1)
+        2>&1 | tail -1) || true
 
     if [[ -n "$issue_url" ]]; then
         success "Created issue: $issue_url"

package/scripts/sw-fix.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Cross-platform compatibility ──────────────────────────────────────────
@@ -25,24 +25,6 @@ if [[ "$(type -t now_iso 2>/dev/null)" != "function" ]]; then
   now_iso()   { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
   now_epoch() { date +%s; }
 fi
-if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
-  emit_event() {
-    local event_type="$1"; shift; mkdir -p "${HOME}/.shipwright"
-    local payload="{\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"type\":\"$event_type\""
-    while [[ $# -gt 0 ]]; do local key="${1%%=*}" val="${1#*=}"; payload="${payload},\"${key}\":\"${val}\""; shift; done
-    echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
-  }
-fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 format_duration() {
     local secs="$1"
     if [[ "$secs" -ge 3600 ]]; then
@@ -341,7 +323,7 @@ fix_start() {
 
         # Spawn pipeline in subshell
         (
-            cd "$expanded"
+            cd "$expanded" || exit 1
 
             # Determine base branch
             local base

package/scripts/sw-fleet-discover.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -34,16 +34,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 # ─── Help ───────────────────────────────────────────────────────────────────
 
 show_help() {

package/scripts/sw-fleet-viz.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -19,6 +19,8 @@ REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 [[ -f "$SCRIPT_DIR/lib/helpers.sh" ]] && source "$SCRIPT_DIR/lib/helpers.sh"
 # Fallbacks when helpers not loaded (e.g. test env with overridden SCRIPT_DIR)
 [[ "$(type -t info 2>/dev/null)" == "function" ]]    || info()    { echo -e "\033[38;2;0;212;255m\033[1m▸\033[0m $*"; }
+# Color fallbacks when helpers not loaded
+: "${CYAN:=}" "${BOLD:=}" "${RESET:=}" "${DIM:=}" "${GREEN:=}" "${RED:=}" "${YELLOW:=}" "${PURPLE:=}" "${WHITE:=}" "${BLUE:=}"
 [[ "$(type -t success 2>/dev/null)" == "function" ]] || success() { echo -e "\033[38;2;74;222;128m\033[1m✓\033[0m $*"; }
 [[ "$(type -t warn 2>/dev/null)" == "function" ]]    || warn()    { echo -e "\033[38;2;250;204;21m\033[1m⚠\033[0m $*"; }
 [[ "$(type -t error 2>/dev/null)" == "function" ]]   || error()   { echo -e "\033[38;2;248;113;113m\033[1m✗\033[0m $*" >&2; }
@@ -34,16 +36,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 format_duration() {
     local secs="$1"
     if [[ "$secs" -ge 3600 ]]; then
@@ -70,7 +62,7 @@ get_health_status() {
     # degraded (yellow) = some failures but recovering
     # failing (red) = persistent failures
 
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         echo "unknown"
         return
     fi
@@ -98,7 +90,7 @@ color_health() {
 
 # ─── Overview Subcommand ───────────────────────────────────────────────────
 show_overview() {
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         error "jq is required for fleet visualization"
         exit 1
     fi
@@ -144,7 +136,7 @@ show_overview() {
 
 # ─── Workers Subcommand ────────────────────────────────────────────────────
 show_workers() {
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         error "jq is required for fleet visualization"
         exit 1
     fi
@@ -197,7 +189,7 @@ show_workers() {
 
 # ─── Insights Subcommand ───────────────────────────────────────────────────
 show_insights() {
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         error "jq is required for fleet visualization"
         exit 1
     fi
@@ -238,7 +230,7 @@ show_insights() {
 
 # ─── Queue Subcommand ──────────────────────────────────────────────────────
 show_queue() {
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         error "jq is required for fleet visualization"
         exit 1
     fi
@@ -281,7 +273,7 @@ show_queue() {
 
 # ─── Costs Subcommand ──────────────────────────────────────────────────────
 show_costs() {
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         error "jq is required for fleet visualization"
         exit 1
     fi
@@ -323,7 +315,7 @@ show_costs() {
 
 # ─── Export Subcommand ─────────────────────────────────────────────────────
 show_export() {
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         error "jq is required for fleet visualization"
         exit 1
     fi

package/scripts/sw-fleet.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -34,16 +34,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 epoch_to_iso() {
     local epoch="$1"
     date -u -r "$epoch" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || \
@@ -200,7 +190,7 @@ _fleet_repo_priority() {
     local repo_path="$1"
     local priority=50  # default neutral priority
 
-    type _gh_detect_repo &>/dev/null 2>&1 || { echo "$priority"; return 0; }
+    type _gh_detect_repo >/dev/null 2>&1 || { echo "$priority"; return 0; }
 
     # Detect repo from the repo path (run in subshell to avoid cd side-effects)
     local gh_priority
@@ -213,7 +203,7 @@ _fleet_repo_priority() {
         local p=50
 
         # Factor: security alerts (urgent work)
-        if type gh_security_alerts &>/dev/null 2>&1; then
+        if type gh_security_alerts >/dev/null 2>&1; then
             local alerts
             alerts=$(gh_security_alerts "$owner" "$repo" 2>/dev/null | jq 'length' 2>/dev/null || echo "0")
             if [[ "${alerts:-0}" -gt 5 ]]; then
@@ -224,7 +214,7 @@ _fleet_repo_priority() {
         fi
 
         # Factor: contributor count (more contributors = more active = higher priority)
-        if type gh_contributors &>/dev/null 2>&1; then
+        if type gh_contributors >/dev/null 2>&1; then
             local contribs
             contribs=$(gh_contributors "$owner" "$repo" 2>/dev/null | jq 'length' 2>/dev/null || echo "0")
             if [[ "${contribs:-0}" -gt 10 ]]; then
@@ -643,6 +633,12 @@ check_machine_health() {
             emit_event "fleet.machine_offline" "machine=$name" "host=$host"
         fi
     done
+
+    # After health checks: trigger failover to re-queue work from offline machines
+    if [[ -f "$SCRIPT_DIR/lib/fleet-failover.sh" ]]; then
+        source "$SCRIPT_DIR/lib/fleet-failover.sh" 2>/dev/null || true
+        fleet_failover_check 2>/dev/null || true
+    fi
 }
 
 # ─── Cross-Machine Event Aggregation ───────────────────────────────────
@@ -749,12 +745,12 @@ fleet_start() {
     echo -e "${PURPLE}${BOLD}━━━ shipwright fleet v${VERSION} — start ━━━${RESET}"
     echo ""
 
-    if ! command -v tmux &>/dev/null; then
+    if ! command -v tmux >/dev/null 2>&1; then
         error "tmux is required for fleet mode"
         exit 1
     fi
 
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         error "jq is required. Install: brew install jq"
         exit 1
     fi
@@ -1146,7 +1142,7 @@ fleet_metrics() {
         exit 1
     fi
 
-    if ! command -v jq &>/dev/null; then
+    if ! command -v jq >/dev/null 2>&1; then
         error "jq is required. Install: brew install jq"
         exit 1
     fi

package/scripts/sw-github-app.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -34,16 +34,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 # ─── Config File Locations ────────────────────────────────────────────────
 CONFIG_DIR="${HOME}/.shipwright"
 CONFIG_FILE="${CONFIG_DIR}/github-app.json"
@@ -76,16 +66,16 @@ cmd_setup() {
     info "GitHub App Configuration"
     echo ""
 
-    read -p "App ID: " app_id
-    read -p "Private key file path: " key_path
+    read -rp "App ID: " app_id
+    read -rp "Private key file path: " key_path
 
     if [[ ! -f "$key_path" ]]; then
         error "Private key file not found: $key_path"
         return 1
     fi
 
-    read -p "Installation ID: " installation_id
-    read -p "Webhook secret (optional, press Enter to skip): " webhook_secret
+    read -rp "Installation ID: " installation_id
+    read -rp "Webhook secret (optional, press Enter to skip): " webhook_secret
 
     # Create config atomically
     local tmp_config
@@ -171,7 +161,7 @@ _get_installation_token() {
     fi
 
     local response
-    response=$(curl -s -H "Authorization: Bearer $jwt" \
+    response=$(curl -s --connect-timeout 10 --max-time 30 -H "Authorization: Bearer $jwt" \
         -H "Accept: application/vnd.github+json" \
         "https://api.github.com/app/installations/${installation_id}/access_tokens" \
         -d '{}' -X POST 2>/dev/null) || true