shipwright-cli 2.4.0 → 3.0.0

package/scripts/sw-github-checks.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="${SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)}"
 REPO_DIR="${REPO_DIR:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 
@@ -34,16 +34,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 # ─── Artifacts Directory ─────────────────────────────────────────────────────
 ARTIFACTS_DIR="${REPO_DIR}/.claude/pipeline-artifacts"
 

package/scripts/sw-github-deploy.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -34,16 +34,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 # ─── Artifacts Directory ─────────────────────────────────────────────────────
 ARTIFACTS_DIR="${REPO_DIR}/.claude/pipeline-artifacts"
 

package/scripts/sw-github-graphql.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -34,16 +34,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 # ─── Structured Event Log ──────────────────────────────────────────────────
 EVENTS_FILE="${HOME}/.shipwright/events.jsonl"
 
@@ -87,7 +77,7 @@ _gh_cache_get() {
     # Check file age
     local file_epoch now
     if [[ "$(uname)" == "Darwin" ]]; then
-        file_epoch=$(stat -f '%m' "$cache_file" 2>/dev/null || echo "0")
+        file_epoch=$(file_mtime "$cache_file")
     else
         file_epoch=$(stat -c '%Y' "$cache_file" 2>/dev/null || echo "0")
     fi

package/scripts/sw-guild.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Cross-platform compatibility ──────────────────────────────────────────
@@ -33,16 +33,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 # ─── Guild Storage Paths ───────────────────────────────────────────────────
 GUILD_ROOT="${HOME}/.shipwright/guilds"
 GUILD_CONFIG="${GUILD_ROOT}/config.json"

package/scripts/sw-heartbeat.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Cross-platform compatibility ──────────────────────────────────────────
@@ -16,6 +16,10 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # Canonical helpers (colors, output, events)
 # shellcheck source=lib/helpers.sh
 [[ -f "$SCRIPT_DIR/lib/helpers.sh" ]] && source "$SCRIPT_DIR/lib/helpers.sh"
+
+# SQLite persistence (DB as primary read path)
+# shellcheck source=sw-db.sh
+[[ -f "$SCRIPT_DIR/sw-db.sh" ]] && source "$SCRIPT_DIR/sw-db.sh"
 # Fallbacks when helpers not loaded (e.g. test env with overridden SCRIPT_DIR)
 [[ "$(type -t info 2>/dev/null)" == "function" ]]    || info()    { echo -e "\033[38;2;0;212;255m\033[1m▸\033[0m $*"; }
 [[ "$(type -t success 2>/dev/null)" == "function" ]] || success() { echo -e "\033[38;2;74;222;128m\033[1m✓\033[0m $*"; }
@@ -33,16 +37,6 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-
 # ─── Constants ──────────────────────────────────────────────────────────────
 HEARTBEAT_DIR="$HOME/.shipwright/heartbeats"
 
@@ -167,6 +161,11 @@ cmd_write() {
 
     # Atomic write
     mv "$tmp_file" "${HEARTBEAT_DIR}/${job_id}.json"
+
+    # Dual-write to DB when available
+    if type db_record_heartbeat >/dev/null 2>&1 && db_available 2>/dev/null; then
+        db_record_heartbeat "$job_id" "$pid" "${issue:-0}" "$stage" "${iteration:-0}" "$activity" "$memory_mb" 2>/dev/null || true
+    fi
 }
 
 # ─── Check Heartbeat ───────────────────────────────────────────────────────
@@ -190,6 +189,30 @@ cmd_check() {
         esac
     done
 
+    # Try DB first when available
+    if type db_list_heartbeats >/dev/null 2>&1 && db_available 2>/dev/null; then
+        local hb_json
+        hb_json=$(db_list_heartbeats 2>/dev/null | jq -r --arg id "$job_id" '.[] | select(.job_id == $id) | .updated_at' 2>/dev/null || true)
+        if [[ -n "$hb_json" ]]; then
+            local updated_at="$hb_json"
+            local hb_epoch now_epoch age_secs
+            if TZ=UTC date -j -f "%Y-%m-%dT%H:%M:%SZ" "$updated_at" +%s >/dev/null 2>&1; then
+                hb_epoch="$(TZ=UTC date -j -f "%Y-%m-%dT%H:%M:%SZ" "$updated_at" +%s 2>/dev/null)"
+            else
+                hb_epoch="$(date -d "$updated_at" +%s 2>/dev/null || echo 0)"
+            fi
+            now_epoch="$(date +%s)"
+            age_secs=$((now_epoch - hb_epoch))
+            if [[ "$age_secs" -le "$timeout" ]]; then
+                success "Job ${job_id} alive (${age_secs}s ago)"
+                return 0
+            else
+                warn "Job ${job_id} stale (${age_secs}s ago, timeout: ${timeout}s)"
+                return 1
+            fi
+        fi
+    fi
+
     local hb_file="${HEARTBEAT_DIR}/${job_id}.json"
 
     if [[ ! -f "$hb_file" ]]; then
@@ -209,7 +232,7 @@ cmd_check() {
     local hb_epoch now_epoch age_secs
 
     # macOS date -j -f vs GNU date -d (TZ=UTC since timestamps are UTC)
-    if TZ=UTC date -j -f "%Y-%m-%dT%H:%M:%SZ" "$updated_at" +%s &>/dev/null; then
+    if TZ=UTC date -j -f "%Y-%m-%dT%H:%M:%SZ" "$updated_at" +%s >/dev/null 2>&1; then
         hb_epoch="$(TZ=UTC date -j -f "%Y-%m-%dT%H:%M:%SZ" "$updated_at" +%s 2>/dev/null)"
     else
         hb_epoch="$(date -d "$updated_at" +%s 2>/dev/null || echo 0)"
@@ -231,6 +254,16 @@ cmd_check() {
 cmd_list() {
     ensure_dir
 
+    # Try DB first when available
+    if type db_list_heartbeats >/dev/null 2>&1 && db_available 2>/dev/null; then
+        local db_result
+        db_result=$(db_list_heartbeats 2>/dev/null || echo "[]")
+        if [[ -n "$db_result" ]] && echo "$db_result" | jq -e 'length > 0' >/dev/null 2>&1; then
+            echo "$db_result" | jq -c '[.[] | . + {cpu_pct: 0}]' 2>/dev/null || echo "[]"
+            return 0
+        fi
+    fi
+
     local result="["
     local first=true
 
@@ -272,6 +305,10 @@ cmd_clear() {
 
     local hb_file="${HEARTBEAT_DIR}/${job_id}.json"
 
+    if type db_clear_heartbeat >/dev/null 2>&1 && db_available 2>/dev/null; then
+        db_clear_heartbeat "$job_id" 2>/dev/null || true
+    fi
+
     if [[ -f "$hb_file" ]]; then
         rm -f "$hb_file"
         success "Cleared heartbeat for job: ${job_id}"

package/scripts/sw-hygiene.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -17,6 +17,7 @@ REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 [[ -f "$SCRIPT_DIR/lib/policy.sh" ]] && source "$SCRIPT_DIR/lib/policy.sh"
 # Canonical helpers (colors, output, events)
 [[ -f "$SCRIPT_DIR/lib/helpers.sh" ]] && source "$SCRIPT_DIR/lib/helpers.sh"
+[[ -f "$SCRIPT_DIR/lib/config.sh" ]] && source "$SCRIPT_DIR/lib/config.sh"
 # Fallback when helpers.sh not loaded
 [[ "$(type -t info 2>/dev/null)" == "function" ]]    || info()    { echo -e "\033[38;2;0;212;255m\033[1m▸\033[0m $*"; }
 [[ "$(type -t success 2>/dev/null)" == "function" ]] || success() { echo -e "\033[38;2;74;222;128m\033[1m✓\033[0m $*"; }
@@ -31,24 +32,12 @@ if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
 fi
-CYAN="${CYAN:-\033[38;2;0;212;255m}"
-PURPLE="${PURPLE:-\033[38;2;124;58;237m}"
-GREEN="${GREEN:-\033[38;2;74;222;128m}"
-YELLOW="${YELLOW:-\033[38;2;250;204;21m}"
-RED="${RED:-\033[38;2;248;113;113m}"
-DIM="${DIM:-\033[2m}"
-BOLD="${BOLD:-\033[1m}"
-RESET="${RESET:-\033[0m}"
-BLUE="${BLUE:-\033[38;2;0;102;255m}"
 
 # ─── Default Settings (policy overrides when config/policy.json exists) ──────
 SUBCOMMAND="${1:-help}"
 AUTO_FIX=false
 VERBOSE=false
-ARTIFACT_AGE_DAYS=7
-if type policy_get &>/dev/null 2>&1; then
-    ARTIFACT_AGE_DAYS=$(policy_get ".hygiene.artifact_age_days" "7")
-fi
+ARTIFACT_AGE_DAYS=$(_config_get_int "cleanup.artifact_age_days" 7)
 JSON_OUTPUT=false
 
 # ─── Help ───────────────────────────────────────────────────────────────────
@@ -95,15 +84,22 @@ detect_dead_code() {
     local unused_functions=0
     local unused_scripts=0
     local orphaned_tests=0
+    local func_limit func_count=0
+    func_limit=$(_config_get_int "limits.function_scan_limit" 0)
 
     # Find unused bash functions (simplified for Bash 3.2)
     while IFS= read -r func_file; do
+        [[ "$func_limit" -gt 0 && "$func_count" -ge "$func_limit" ]] && break
         # Extract function names
         local funcs
         funcs=$(grep -E '^[a-z_][a-z0-9_]*\(\)' "$func_file" 2>/dev/null | sed 's/()$//' | sed 's/^ *//' || true)
+        if [[ "$func_limit" -gt 0 ]]; then
+            funcs=$(echo "$funcs" | head -"$((func_limit - func_count))")
+        fi
 
         while IFS= read -r func; do
             [[ -z "$func" ]] && continue
+            [[ "$func_limit" -gt 0 && "$func_count" -ge "$func_limit" ]] && break
 
             # Check if function is used in other files (count lines with this function name)
             local usage_count
@@ -112,10 +108,11 @@ detect_dead_code() {
 
             # Function definition counts as 1 usage; if only 1, it's unused
             case "$usage_count" in
-                0|1) [[ $VERBOSE == true ]] && warn "Unused function: $func (in $(basename "$func_file"))"; ((unused_functions++)) ;;
+                0|1) [[ $VERBOSE == true ]] && warn "Unused function: $func (in $(basename "$func_file"))"; unused_functions=$((unused_functions + 1)) ;;
             esac
+            func_count=$((func_count + 1))
         done <<< "$funcs"
-    done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null | head -20)
+    done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null)
 
     # Find scripts referenced nowhere
     local script_count=0
@@ -133,9 +130,9 @@ detect_dead_code() {
         ref_count=$(printf '%s' "$ref_count" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
 
         case "$ref_count" in
-            0|1) [[ $VERBOSE == true ]] && warn "Potentially unused script: $basename_script"; ((unused_scripts++)) ;;
+            0|1) [[ $VERBOSE == true ]] && warn "Potentially unused script: $basename_script"; unused_scripts=$((unused_scripts + 1)) ;;
         esac
-        ((script_count++))
+        script_count=$((script_count + 1))
     done < <(find "$REPO_DIR/scripts" -maxdepth 1 -name "sw-*.sh" -type f 2>/dev/null)
 
     # Find test fixtures without corresponding tests
@@ -145,7 +142,7 @@ detect_dead_code() {
 
         if ! grep -r "$test_name" "$REPO_DIR/scripts" --include="*-test.sh" 2>/dev/null | grep -q .; then
             warn "Orphaned test fixture: $(basename "$fixture")"
-            ((orphaned_tests++))
+            orphaned_tests=$((orphaned_tests + 1))
         fi
     done < <(find "$REPO_DIR" -name "*.fixture" -type f 2>/dev/null)
 
@@ -170,7 +167,7 @@ validate_structure() {
 
         if [[ "$dir" != "$REPO_DIR/scripts" ]]; then
             warn "Script outside scripts/ directory: $script"
-            ((structure_issues++))
+            structure_issues=$((structure_issues + 1))
         fi
     done < <(find "$REPO_DIR" -name "*.sh" -type f ! -path "*/node_modules/*" ! -path "*/.git/*" 2>/dev/null | grep -E '(sw-|shipwright)' || true)
 
@@ -181,19 +178,19 @@ validate_structure() {
 
         if [[ ! "$basename_test" =~ -test\.sh$ ]]; then
             warn "Test file not named *-test.sh: $basename_test"
-            ((structure_issues++))
+            structure_issues=$((structure_issues + 1))
         fi
     done < <(find "$REPO_DIR/scripts" -path "*test*" -name "*.sh" -type f 2>/dev/null)
 
     # Check directory organization
     if [[ ! -d "$REPO_DIR/scripts" ]]; then
         error "scripts/ directory missing"
-        ((structure_issues++))
+        structure_issues=$((structure_issues + 1))
     fi
 
     if [[ ! -d "$REPO_DIR/.claude" ]]; then
         error ".claude/ directory missing"
-        ((structure_issues++))
+        structure_issues=$((structure_issues + 1))
     fi
 
     [[ $VERBOSE == true ]] && {
@@ -210,11 +207,16 @@ audit_dependencies() {
 
     local unused_deps=0
     local circular_deps=0
+    local dep_limit
+    dep_limit=$(_config_get_int "limits.dependency_scan_limit" 0)
 
     # Check for unused npm/yarn dependencies
     if [[ -f "$REPO_DIR/package.json" ]]; then
         local deps
         deps=$(jq -r '.dependencies, .devDependencies | keys[]?' "$REPO_DIR/package.json" 2>/dev/null || true)
+        if [[ "$dep_limit" -gt 0 ]]; then
+            deps=$(echo "$deps" | head -"$dep_limit")
+        fi
 
         while IFS= read -r dep; do
             [[ -z "$dep" ]] && continue
@@ -222,7 +224,7 @@ audit_dependencies() {
             # Simple check: does the dep appear in source files?
             if ! grep -r "$dep" "$REPO_DIR/scripts" --include="*.sh" 2>/dev/null | grep -q .; then
                 [[ $VERBOSE == true ]] && warn "Potentially unused npm dependency: $dep"
-                ((unused_deps++))
+                unused_deps=$((unused_deps + 1))
             fi
         done <<< "$deps"
     fi
@@ -238,10 +240,10 @@ audit_dependencies() {
             # Check if sourced_by also sources the original script
             if grep -q "source.*$(basename "$source_script")" "$script" 2>/dev/null; then
                 warn "Circular dependency: $(basename "$script") ←→ $(basename "$source_script")"
-                ((circular_deps++))
+                circular_deps=$((circular_deps + 1))
             fi
         done <<< "$sourced_by"
-    done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null | head -10)
+    done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null)
 
     [[ $VERBOSE == true ]] && {
         info "Dependency audit: $unused_deps unused, $circular_deps circular"
@@ -264,7 +266,7 @@ check_naming() {
 
         if ! [[ "$basename_script" =~ ^sw-[a-z0-9-]+\.sh$ ]] && ! [[ "$basename_script" == "sw" ]]; then
             [[ $VERBOSE == true ]] && warn "Script not following naming convention: $basename_script"
-            ((naming_issues++))
+            naming_issues=$((naming_issues + 1))
         fi
     done < <(find "$REPO_DIR/scripts" -maxdepth 1 -name "*.sh" -type f 2>/dev/null)
 
@@ -276,9 +278,9 @@ check_naming() {
         while IFS= read -r func; do
             [[ -z "$func" ]] && continue
             [[ $VERBOSE == true ]] && warn "Function not using snake_case: $func (in $(basename "$script"))"
-            ((naming_issues++))
+            naming_issues=$((naming_issues + 1))
         done <<< "$bad_functions"
-    done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null | head -20)
+    done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null)
 
     [[ $VERBOSE == true ]] && {
         info "Naming validation: $naming_issues issues found"
@@ -292,7 +294,7 @@ check_naming() {
 list_stale_branches() {
     info "Scanning for stale branches..."
 
-    if ! git rev-parse --git-dir &>/dev/null; then
+    if ! git rev-parse --git-dir >/dev/null 2>&1; then
         error "Not in a git repository"
         return 1
     fi
@@ -311,7 +313,7 @@ list_stale_branches() {
         while IFS= read -r branch; do
             [[ -z "$branch" ]] && continue
             echo -e "  ${DIM}$branch${RESET}"
-            ((stale_count++))
+            stale_count=$((stale_count + 1))
         done <<< "$merged_branches"
     fi
 
@@ -348,13 +350,13 @@ analyze_size() {
         awk '{print $5, $9}' | \
         sort -h | \
         tail -10 | \
-        while read size file; do
+        while read -r size file; do
             echo -e "  ${DIM}$size${RESET} $(basename "$file")"
         done
 
     # Find bloated directories
     info "Largest directories:"
-    du -sh "$REPO_DIR"/* 2>/dev/null | sort -h | tail -10 | while read size dir; do
+    du -sh "$REPO_DIR"/* 2>/dev/null | sort -h | tail -10 | while read -r size dir; do
         echo -e "  ${DIM}$size${RESET} $(basename "$dir")"
     done
 
@@ -364,7 +366,7 @@ analyze_size() {
     while IFS= read -r file; do
         [[ -z "$file" ]] && continue
         warn "Binary file in repo: $(basename "$file")"
-        ((binary_count++))
+        binary_count=$((binary_count + 1))
     done < <(find "$REPO_DIR" -type f ! -path '*/.git/*' ! -path '*/node_modules/*' ! -path '*/.claude/*' \
         -exec file {} \; 2>/dev/null | grep -i "executable\|binary" | cut -d: -f1 || true)
 
@@ -398,7 +400,7 @@ scan_platform_refactor() {
     local findings_file findings_raw
     findings_file=$(mktemp)
     findings_raw=$(mktemp)
-    grep -rnE "hardcoded|Hardcoded|Fallback:|fallback:|TODO|FIXME|HACK|KLUDGE" "$scripts_dir" --include="*.sh" 2>/dev/null | head -25 > "$findings_raw" || true
+    grep -rnE "hardcoded|Hardcoded|Fallback:|fallback:|TODO|FIXME|HACK|KLUDGE" "$scripts_dir" --include="*.sh" 2>/dev/null > "$findings_raw" || true
     while IFS= read -r line; do
         [[ -z "$line" ]] && continue
         local f="${line%%:*}" rest="${line#*:}" ln="${rest%%:*}"
@@ -464,7 +466,7 @@ auto_fix_issues() {
         if ! [[ -x "$script" ]]; then
             chmod +x "$script"
             success "Made executable: $(basename "$script")"
-            ((fixed_count++))
+            fixed_count=$((fixed_count + 1))
         fi
     done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null)
 
@@ -475,31 +477,31 @@ auto_fix_issues() {
             sed -i.bak 's/[[:space:]]*$//' "$file" 2>/dev/null || sed -i '' 's/[[:space:]]*$//' "$file"
             rm -f "${file}.bak" 2>/dev/null || true
             success "Cleaned whitespace: $(basename "$file")"
-            ((fixed_count++))
+            fixed_count=$((fixed_count + 1))
         fi
-    done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null | head -20)
+    done < <(find "$REPO_DIR/scripts" -name "*.sh" -type f 2>/dev/null)
 
     # Clean up temp files
     info "Removing temporary files..."
-    find "$REPO_DIR" -name "*.tmp" -o -name "*.bak" -o -name "*~" 2>/dev/null | while read tmpfile; do
+    find "$REPO_DIR" -name "*.tmp" -o -name "*.bak" -o -name "*~" 2>/dev/null | while read -r tmpfile; do
         rm -f "$tmpfile"
         success "Removed: $(basename "$tmpfile")"
-        ((fixed_count++))
+        fixed_count=$((fixed_count + 1))
     done
 
     # Remove old build artifacts
     info "Removing old build artifacts (>$ARTIFACT_AGE_DAYS days)..."
     find "$REPO_DIR" -type f \( -name "*.o" -o -name "*.a" -o -name "*.out" \) \
-        -mtime "+$ARTIFACT_AGE_DAYS" 2>/dev/null | while read artifact; do
+        -mtime "+$ARTIFACT_AGE_DAYS" 2>/dev/null | while read -r artifact; do
         rm -f "$artifact"
         success "Removed: $(basename "$artifact")"
-        ((fixed_count++))
+        fixed_count=$((fixed_count + 1))
     done
 
     success "Auto-fixed $fixed_count issues"
 
     # Create a commit if changes were made
-    if [[ $fixed_count -gt 0 ]] && git rev-parse --git-dir &>/dev/null; then
+    if [[ $fixed_count -gt 0 ]] && git rev-parse --git-dir >/dev/null 2>&1; then
         git add -A
         git commit -m "chore: hygiene auto-fix ($fixed_count items)