shipwright-cli 3.2.0 → 3.3.0

package/scripts/sw-daemon.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# shellcheck disable=SC2034  # config vars used by sourced scripts and subshells
 # ╔═══════════════════════════════════════════════════════════════════════════╗
 # ║  shipwright daemon — Autonomous GitHub Issue Watcher                          ║
 # ║  Polls for labeled issues · Spawns pipelines · Manages worktrees      ║
@@ -12,7 +13,7 @@ unset CLAUDECODE 2>/dev/null || true
 trap '' HUP
 trap '' SIGPIPE
 
-VERSION="3.2.0"
+VERSION="3.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -202,6 +203,8 @@ ISSUE_LIMIT=$(_config_get_int "daemon.issue_limit" 100 2>/dev/null || echo 100)
 PIPELINE_TEMPLATE="autonomous"
 SKIP_GATES=true
 MODEL="opus"
+EFFORT_LEVEL=""
+FALLBACK_MODEL="sonnet"
 BASE_BRANCH="main"
 ON_SUCCESS_REMOVE_LABEL="shipwright"
 ON_SUCCESS_ADD_LABEL="pipeline/complete"
@@ -384,6 +387,8 @@ load_config() {
     PIPELINE_TEMPLATE=$(jq -r '.pipeline_template // "autonomous"' "$config_file")
     SKIP_GATES=$(jq -r '.skip_gates // true' "$config_file")
     MODEL=$(jq -r '.model // "opus"' "$config_file")
+    EFFORT_LEVEL=$(jq -r '.effort_level // ""' "$config_file")
+    FALLBACK_MODEL=$(jq -r '.fallback_model // "sonnet"' "$config_file")
     BASE_BRANCH=$(jq -r '.base_branch // "main"' "$config_file")
 
     # on_success settings
@@ -444,6 +449,7 @@ load_config() {
     # intelligence engine settings (default "auto" = enable when Claude CLI available)
     INTELLIGENCE_ENABLED=$(jq -r '.intelligence.enabled // "auto"' "$config_file")
     INTELLIGENCE_CACHE_TTL=$(jq -r '.intelligence.cache_ttl_seconds // 3600' "$config_file")
+    INTELLIGENCE_MODEL=$(jq -r '.intelligence.model // "haiku"' "$config_file")
     COMPOSER_ENABLED=$(jq -r '.intelligence.composer_enabled // "auto"' "$config_file")
 
     # Auto-enable intelligence when Claude is available (unless explicitly disabled)
@@ -474,14 +480,27 @@ load_config() {
             COMPOSER_ENABLED=false
         fi
     fi
-    OPTIMIZATION_ENABLED=$(jq -r '.intelligence.optimization_enabled // false' "$config_file")
-    PREDICTION_ENABLED=$(jq -r '.intelligence.prediction_enabled // false' "$config_file")
+    OPTIMIZATION_ENABLED=$(jq -r '.intelligence.optimization_enabled // "auto"' "$config_file")
+    PREDICTION_ENABLED=$(jq -r '.intelligence.prediction_enabled // "auto"' "$config_file")
     ANOMALY_THRESHOLD=$(jq -r '.intelligence.anomaly_threshold // 3.0' "$config_file")
 
     # adaptive thresholds (intelligence-driven operational tuning)
-    ADAPTIVE_THRESHOLDS_ENABLED=$(jq -r '.intelligence.adaptive_enabled // false' "$config_file")
+    ADAPTIVE_THRESHOLDS_ENABLED=$(jq -r '.intelligence.adaptive_enabled // "auto"' "$config_file")
     PRIORITY_STRATEGY=$(jq -r '.intelligence.priority_strategy // "quick-wins-first"' "$config_file")
 
+    # Auto-resolve "auto" for prediction, optimization, adaptive (same pattern as intelligence/composer)
+    local _flag_val=""
+    for _flag_var in OPTIMIZATION_ENABLED PREDICTION_ENABLED ADAPTIVE_THRESHOLDS_ENABLED; do
+        eval "_flag_val=\"\${${_flag_var}}\""
+        if [[ "$_flag_val" == "auto" ]]; then
+            if command -v claude &>/dev/null; then
+                eval "${_flag_var}=true"
+            else
+                eval "${_flag_var}=false"
+            fi
+        fi
+    done
+
     # gh_retry: enable retry wrapper on critical GitHub API calls
     GH_RETRY_ENABLED=$(jq -r '.gh_retry // true' "$config_file")
 
@@ -547,11 +566,24 @@ setup_dirs() {
     STATE_FILE="$DAEMON_DIR/daemon-state.json"
     LOG_FILE="$DAEMON_DIR/daemon.log"
     LOG_DIR="$DAEMON_DIR/logs"
-    WORKTREE_DIR=".worktrees"
+
+    # ── Worktree Directory (must be absolute for security) ──
+    # Always use repo-level .claude/worktrees (self-healing: create .claude if missing)
+    local _abs_cwd
+    _abs_cwd="$(cd "$(pwd)" && pwd)"
+    WORKTREE_DIR="${_abs_cwd}/.claude/worktrees"
+
     PAUSE_FLAG="${HOME}/.shipwright/daemon-pause.flag"
 
     mkdir -p "$LOG_DIR"
     mkdir -p "$HOME/.shipwright/progress"
+    mkdir -p "$WORKTREE_DIR"
+
+    # Ensure worktrees are gitignored
+    local _gitignore="${_abs_cwd}/.gitignore"
+    if [[ -f "$_gitignore" ]] && ! grep -q '\.claude/worktrees' "$_gitignore" 2>/dev/null; then
+        echo ".claude/worktrees/" >> "$_gitignore"
+    fi
 }
 
 # ─── Adaptive Threshold Helpers ──────────────────────────────────────────────
@@ -559,7 +591,20 @@ setup_dirs() {
 # from historical data instead of using fixed defaults.
 # Every function falls back to the config default when no data exists.
 
-ADAPTIVE_THRESHOLDS_ENABLED="${ADAPTIVE_THRESHOLDS_ENABLED:-false}"
+# Auto-resolve intelligence defaults when no config file is loaded.
+# All three default to "auto" → true when Claude CLI is available.
+_auto_resolve_intelligence() {
+    local val="${1:-auto}"
+    if [[ "$val" == "auto" ]]; then
+        command -v claude &>/dev/null && echo "true" || echo "false"
+    else
+        echo "$val"
+    fi
+}
+INTELLIGENCE_MODEL="${INTELLIGENCE_MODEL:-haiku}"
+OPTIMIZATION_ENABLED=$(_auto_resolve_intelligence "${OPTIMIZATION_ENABLED:-auto}")
+PREDICTION_ENABLED=$(_auto_resolve_intelligence "${PREDICTION_ENABLED:-auto}")
+ADAPTIVE_THRESHOLDS_ENABLED=$(_auto_resolve_intelligence "${ADAPTIVE_THRESHOLDS_ENABLED:-auto}")
 PRIORITY_STRATEGY="${PRIORITY_STRATEGY:-quick-wins-first}"
 EMPTY_QUEUE_CYCLES=0
 
@@ -672,7 +717,8 @@ daemon_start() {
         fi
 
         # Export current PATH so detached session finds claude, gh, etc.
-        local tmux_cmd="export PATH='${PATH}'; ${cmd_args[*]}"
+        # Unset CLAUDECODE so daemon works when started from inside Claude Code
+        local tmux_cmd="unset CLAUDECODE 2>/dev/null; export PATH='${PATH}'; ${cmd_args[*]}"
         tmux new-session -d -s "sw-daemon" "$tmux_cmd" 2>/dev/null || {
             # Session may already exist — try killing and recreating
             tmux kill-session -t "sw-daemon" 2>/dev/null || true
@@ -937,6 +983,11 @@ daemon_init() {
 
     mkdir -p "$config_dir"
 
+    # Set restrictive umask for sensitive files (owner-only: 600)
+    local _old_umask
+    _old_umask=$(umask)
+    umask 0077
+
     cat > "$config_file" << 'CONFIGEOF'
 {
   "watch_label": "shipwright",
@@ -1002,10 +1053,12 @@ daemon_init() {
   "estimated_cost_per_job_usd": 5.0,
   "intelligence": {
     "enabled": "auto",
+    "model": "haiku",
     "cache_ttl_seconds": 3600,
     "composer_enabled": "auto",
-    "optimization_enabled": true,
-    "prediction_enabled": true,
+    "optimization_enabled": "auto",
+    "prediction_enabled": "auto",
+    "adaptive_enabled": "auto",
     "adversarial_enabled": false,
     "simulation_enabled": false,
     "architecture_enabled": false,
@@ -1015,6 +1068,10 @@ daemon_init() {
 }
 CONFIGEOF
 
+    # Restore umask and ensure file has restricted permissions
+    umask "$_old_umask"
+    chmod 600 "$config_file"
+
     success "Generated config: ${config_file}"
     echo ""
     echo -e "${DIM}Edit this file to customize the daemon behavior, then run:${RESET}"

package/scripts/sw-dashboard.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="3.2.0"
+VERSION="3.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Cross-platform compatibility ──────────────────────────────────────────
@@ -29,6 +29,7 @@ fi
 if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
   emit_event() {
     local event_type="$1"; shift; mkdir -p "${HOME}/.shipwright"
+    # shellcheck disable=SC2155
     local payload="{\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"type\":\"$event_type\""
     while [[ $# -gt 0 ]]; do local key="${1%%=*}" val="${1#*=}"; payload="${payload},\"${key}\":\"${val}\""; shift; done
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
@@ -41,6 +42,7 @@ TEAMS_DIR="${HOME}/.shipwright"
 PID_FILE="${TEAMS_DIR}/dashboard.pid"
 LOG_DIR="${TEAMS_DIR}/logs"
 LOG_FILE="${LOG_DIR}/dashboard.log"
+# shellcheck disable=SC2034
 EVENTS_FILE="${TEAMS_DIR}/events.jsonl"
 DEFAULT_PORT=$(_config_get_int "dashboard.port" 8767 2>/dev/null || echo 8767)
 

package/scripts/sw-db.sh

@@ -14,9 +14,11 @@ if [[ -n "${_SW_DB_LOADED:-}" ]] && [[ "${BASH_SOURCE[0]}" != "$0" ]]; then
 fi
 _SW_DB_LOADED=1
 
-VERSION="3.2.0"
+# shellcheck disable=SC2034
+VERSION="3.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+# shellcheck disable=SC2034
+REPO_DIR="${REPO_DIR:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 
 # ─── Cross-platform compatibility ──────────────────────────────────────────
 # shellcheck source=lib/compat.sh
@@ -37,7 +39,8 @@ fi
 if [[ "$(type -t emit_event 2>/dev/null)" != "function" ]]; then
   emit_event() {
     local event_type="$1"; shift; mkdir -p "${HOME}/.shipwright"
-    local payload="{\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"type\":\"$event_type\""
+    local payload
+    payload="{\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"type\":\"$event_type\""
     while [[ $# -gt 0 ]]; do local key="${1%%=*}" val="${1#*=}"; payload="${payload},\"${key}\":\"${val}\""; shift; done
     echo "${payload}}" >> "${HOME}/.shipwright/events.jsonl"
   }
@@ -50,6 +53,7 @@ SCHEMA_VERSION=6
 # JSON fallback paths
 EVENTS_FILE="${DB_DIR}/events.jsonl"
 DAEMON_STATE_FILE="${DB_DIR}/daemon-state.json"
+# shellcheck disable=SC2034
 DEVELOPER_REGISTRY_FILE="${DB_DIR}/developer-registry.json"
 COST_FILE_JSON="${DB_DIR}/costs.json"
 BUDGET_FILE_JSON="${DB_DIR}/budget.json"
@@ -107,12 +111,12 @@ ensure_db_dir() {
 # ─── SQL Execution Helper ──────────────────────────────────────────────────
 # Runs SQL with proper error handling. Silent on success.
 _db_exec() {
-    sqlite3 "$DB_FILE" "$@" 2>/dev/null
+    sqlite3 -cmd ".timeout 5000" "$DB_FILE" "$@" 2>/dev/null
 }
 
 # Runs SQL and returns output. Returns 1 on failure.
 _db_query() {
-    sqlite3 "$DB_FILE" "$@" 2>/dev/null || return 1
+    sqlite3 -cmd ".timeout 5000" "$DB_FILE" "$@" 2>/dev/null || return 1
 }
 
 # ─── Initialize Database Schema ──────────────────────────────────────────────
@@ -700,7 +704,10 @@ db_query_events() {
 
     if [[ -f "$db_file" ]] && command -v sqlite3 &>/dev/null; then
         local where_clause=""
-        [[ -n "$filter" ]] && where_clause="WHERE type = '$filter'"
+        if [[ -n "$filter" ]]; then
+            filter="${filter//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+            where_clause="WHERE type = '$filter'"
+        fi
         local result
         result=$(sqlite3 -json "$db_file" "SELECT ts, ts_epoch, type, job_id, stage, status, duration_secs, metadata FROM events $where_clause ORDER BY ts_epoch DESC LIMIT $limit" 2>/dev/null) || true
         if [[ -n "$result" ]]; then
@@ -728,13 +735,19 @@ db_query_events_since() {
     local since_epoch="$1"
     local event_type="${2:-}"
     local to_epoch="${3:-}"
+    # Validate numeric epoch values
+    [[ ! "$since_epoch" =~ ^[0-9]+$ ]] && { echo "[]"; return 0; }
     local db_file="${DB_FILE:-$HOME/.shipwright/shipwright.db}"
 
     if [[ -f "$db_file" ]] && command -v sqlite3 &>/dev/null; then
         local type_filter=""
-        [[ -n "$event_type" ]] && type_filter="AND type = '$event_type'"
+        if [[ -n "$event_type" ]]; then
+            event_type="${event_type//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+            type_filter="AND type = '$event_type'"
+        fi
         local to_filter=""
-        [[ -n "$to_epoch" ]] && to_filter="AND ts_epoch <= $to_epoch"
+        # Numeric validation for epoch values
+        [[ -n "$to_epoch" && "$to_epoch" =~ ^[0-9]+$ ]] && to_filter="AND ts_epoch <= $to_epoch"
         local result
         result=$(sqlite3 -json "$db_file" "SELECT ts, ts_epoch, type, job_id, stage, status, duration_secs, metadata FROM events WHERE ts_epoch >= $since_epoch $type_filter $to_filter ORDER BY ts_epoch DESC" 2>/dev/null) || true
         if [[ -n "$result" ]]; then
@@ -1182,8 +1195,12 @@ db_save_pattern() {
 db_query_patterns() {
     local repo_hash="$1" pattern_type="${2:-}" limit="${3:-20}"
     if ! db_available; then echo "[]"; return 0; fi
+    repo_hash="${repo_hash//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
     local where="WHERE repo_hash = '$repo_hash'"
-    [[ -n "$pattern_type" ]] && where="$where AND pattern_type = '$pattern_type'"
+    if [[ -n "$pattern_type" ]]; then
+        pattern_type="${pattern_type//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+        where="$where AND pattern_type = '$pattern_type'"
+    fi
     _db_query -json "SELECT * FROM memory_patterns $where ORDER BY frequency DESC, last_seen_at DESC LIMIT $limit;" || echo "[]"
 }
 
@@ -1191,6 +1208,8 @@ db_query_patterns() {
 db_save_decision() {
     local repo_hash="$1" decision_type="$2" context="$3" decision="$4" metadata="${5:-}"
     if ! db_available; then return 1; fi
+    repo_hash="${repo_hash//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+    decision_type="${decision_type//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
     context="${context//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
     decision="${decision//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
     metadata="${metadata//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
@@ -1201,17 +1220,24 @@ db_save_decision() {
 db_update_decision_outcome() {
     local decision_id="$1" outcome="$2" confidence="${3:-}"
     if ! db_available; then return 1; fi
+    # Validate numeric IDs to prevent injection
+    [[ ! "$decision_id" =~ ^[0-9]+$ ]] && return 1
     outcome="${outcome//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
-    local set_clause="outcome = '$outcome', updated_at = '$(now_iso)'"
-    [[ -n "$confidence" ]] && set_clause="$set_clause, confidence = $confidence"
+    local set_clause
+    set_clause="outcome = '$outcome', updated_at = '$(now_iso)'"
+    [[ -n "$confidence" && "$confidence" =~ ^[0-9.]+$ ]] && set_clause="$set_clause, confidence = $confidence"
     _db_exec "UPDATE memory_decisions SET $set_clause WHERE id = $decision_id;"
 }
 
 db_query_decisions() {
     local repo_hash="$1" decision_type="${2:-}" limit="${3:-20}"
     if ! db_available; then echo "[]"; return 0; fi
+    repo_hash="${repo_hash//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
     local where="WHERE repo_hash = '$repo_hash'"
-    [[ -n "$decision_type" ]] && where="$where AND decision_type = '$decision_type'"
+    if [[ -n "$decision_type" ]]; then
+        decision_type="${decision_type//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+        where="$where AND decision_type = '$decision_type'"
+    fi
     _db_query -json "SELECT * FROM memory_decisions $where ORDER BY updated_at DESC LIMIT $limit;" || echo "[]"
 }
 
@@ -1219,7 +1245,10 @@ db_query_decisions() {
 db_save_embedding() {
     local content_hash="$1" source_type="$2" content_text="$3" repo_hash="${4:-}"
     if ! db_available; then return 1; fi
+    content_hash="${content_hash//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+    source_type="${source_type//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
     content_text="${content_text//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+    repo_hash="${repo_hash//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
     _db_exec "INSERT OR IGNORE INTO memory_embeddings (content_hash, source_type, content_text, repo_hash, created_at)
               VALUES ('$content_hash', '$source_type', '$content_text', '$repo_hash', '$(now_iso)');"
 }
@@ -1228,8 +1257,14 @@ db_query_embeddings() {
     local source_type="${1:-}" repo_hash="${2:-}" limit="${3:-50}"
     if ! db_available; then echo "[]"; return 0; fi
     local where="WHERE 1=1"
-    [[ -n "$source_type" ]] && where="$where AND source_type = '$source_type'"
-    [[ -n "$repo_hash" ]] && where="$where AND repo_hash = '$repo_hash'"
+    if [[ -n "$source_type" ]]; then
+        source_type="${source_type//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+        where="$where AND source_type = '$source_type'"
+    fi
+    if [[ -n "$repo_hash" ]]; then
+        repo_hash="${repo_hash//$_SQL_SQ/$_SQL_SQ$_SQL_SQ}"
+        where="$where AND repo_hash = '$repo_hash'"
+    fi
     _db_query -json "SELECT id, content_hash, source_type, content_text, repo_hash, created_at FROM memory_embeddings $where ORDER BY created_at DESC LIMIT $limit;" || echo "[]"
 }
 
@@ -1368,8 +1403,10 @@ db_sync_push() {
     # Push via HTTP
     local response
     local auth_header=""
+    # shellcheck disable=SC2089
     [[ -n "${SYNC_TOKEN:-}" ]] && auth_header="-H 'Authorization: Bearer ${SYNC_TOKEN}'"
 
+    # shellcheck disable=SC2090
     response=$(curl -s --connect-timeout 10 --max-time 30 -w "%{http_code}" -o /dev/null \
         -X POST "${SYNC_URL}/api/sync/push" \
         -H "Content-Type: application/json" \
@@ -1400,9 +1437,11 @@ db_sync_pull() {
     last_sync=$(_db_query "SELECT value FROM _sync_metadata WHERE key = 'last_pull_epoch';" || echo "0")
 
     local auth_header=""
+    # shellcheck disable=SC2089
     [[ -n "${SYNC_TOKEN:-}" ]] && auth_header="-H 'Authorization: Bearer ${SYNC_TOKEN}'"
 
     local response_body
+    # shellcheck disable=SC2090
     response_body=$(curl -s --connect-timeout 10 --max-time 30 \
         "${SYNC_URL}/api/sync/pull?since=${last_sync}" \
         -H "Accept: application/json" \
@@ -1451,6 +1490,7 @@ migrate_json_data() {
         info "Importing events from ${EVENTS_FILE}..."
         local evt_count=0
         local evt_skipped=0
+        # shellcheck disable=SC2106
         while IFS= read -r line; do
             [[ -z "$line" ]] && continue
             local e_ts e_epoch e_type e_job e_stage e_status
@@ -1484,7 +1524,8 @@ migrate_json_data() {
             j_result=$(echo "$job" | jq -r '.result // ""')
             j_dur=$(echo "$job" | jq -r '.duration // ""')
             j_at=$(echo "$job" | jq -r '.completed_at // ""')
-            local j_id="migrated-${j_issue}-$(echo "$j_at" | tr -dc '0-9' | tail -c 10)"
+            local j_id
+            j_id="migrated-${j_issue}-$(echo "$j_at" | tr -dc '0-9' | tail -c 10)"
             _db_exec "INSERT OR IGNORE INTO daemon_state (job_id, issue_number, status, result, duration, completed_at, started_at, updated_at) VALUES ('${j_id}', ${j_issue}, 'completed', '${j_result}', '${j_dur}', '${j_at}', '${j_at}', '$(now_iso)');" 2>/dev/null && job_count=$((job_count + 1))
         done < <(jq -c '.completed[]' "$DAEMON_STATE_FILE" 2>/dev/null)
 
@@ -1583,7 +1624,7 @@ export_db() {
     costs_json=$(_db_query "SELECT json_group_array(json_object('model', model, 'stage', stage, 'cost_usd', cost_usd, 'ts', ts)) FROM (SELECT * FROM cost_entries ORDER BY ts_epoch DESC LIMIT 1000);" || echo "[]")
 
     local tmp_file
-    tmp_file=$(mktemp "${output_file}.tmp.XXXXXX")
+    tmp_file=$(mktemp "${output_file}.tmp.XXXXXX") || { error "mktemp failed for db export"; return 1; }
     jq -n \
         --arg exported_at "$(now_iso)" \
         --argjson events "$events_json" \
@@ -1670,7 +1711,9 @@ show_status() {
     # Sync status
     local device_id last_push last_pull
     device_id=$(_db_query "SELECT value FROM _sync_metadata WHERE key = 'device_id';" || echo "not set")
+    # shellcheck disable=SC2034
     last_push=$(_db_query "SELECT value FROM _sync_metadata WHERE key = 'last_push_epoch';" || echo "never")
+    # shellcheck disable=SC2034
     last_pull=$(_db_query "SELECT value FROM _sync_metadata WHERE key = 'last_pull_epoch';" || echo "never")
     local unsynced_events unsynced_costs
     unsynced_events=$(_db_query "SELECT COUNT(*) FROM events WHERE synced = 0;" || echo "0")

package/scripts/sw-decide.sh

@@ -5,7 +5,8 @@
 # ╚═══════════════════════════════════════════════════════════════════════════╝
 set -euo pipefail
 
-VERSION="3.2.0"
+# shellcheck disable=SC2034
+VERSION="3.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Dependencies ─────────────────────────────────────────────────────────────
@@ -17,8 +18,10 @@ source "$SCRIPT_DIR/lib/decide-scoring.sh"
 source "$SCRIPT_DIR/lib/decide-autonomy.sh"
 
 # ─── Config ───────────────────────────────────────────────────────────────────
+# shellcheck disable=SC2034
 DECISION_ENABLED=$(policy_get ".decision.enabled" "false")
 DEDUP_WINDOW_DAYS=$(policy_get ".decision.dedup_window_days" "7")
+# shellcheck disable=SC2034
 OUTCOME_LEARNING=$(policy_get ".decision.outcome_learning_enabled" "true")
 OUTCOME_MIN_SAMPLES=$(policy_get ".decision.outcome_min_samples" "10")
 
@@ -227,7 +230,9 @@ decide_run() {
     while [[ $# -gt 0 ]]; do
         case "$1" in
             --dry-run) dry_run=true; shift ;;
-            --once)    once=true; shift ;;
+            --once)
+                # shellcheck disable=SC2034
+                once=true; shift ;;
             *)         shift ;;
         esac
     done
@@ -432,6 +437,7 @@ decide_log() {
     local found=false
     for i in $(seq 0 $((days - 1))); do
         local date_str
+        # shellcheck disable=SC2106
         date_str=$(date -u -v-${i}d +%Y-%m-%d 2>/dev/null || date -u -d "${i} days ago" +%Y-%m-%d 2>/dev/null || continue)
         local log_file="${DECISIONS_DIR}/daily-log-${date_str}.jsonl"
         [[ ! -f "$log_file" ]] && continue