@mmerterden/multi-agent-pipeline 15.1.0 → 15.3.0

package/CHANGELOG.md

@@ -16,6 +16,39 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [15.3.0] - 2026-08-15
+
+### Added
+
+- **`/multi-agent:setup` onboards the usage-dashboard token (opt-in, one-time).**
+  When a team runs the private dashboard and the admin issued this user a personal
+  ingest token, setup stores it in the OS credential store ONLY (never a file,
+  prefs value, git, or synced tree), maps `keychainMapping.usage_ingest`, and
+  turns logging on. After that single paste, `/multi-agent:update` keeps it active
+  and every run reports itself - no further steps. The token is write-only,
+  per-user (independently revocable), and read at runtime from the credential
+  store, transmitted only over TLS. Skipping the prompt leaves logging fully off.
+  True zero-touch is deliberately not offered: a machine that authenticates with
+  no prior onboarding would require an embeddable secret, which is the attack
+  vector - one-time onboarding is the security floor.
+
+## [15.2.0] - 2026-08-15
+
+### Added
+
+- **`/multi-agent:update` auto-enables usage logging when a token is onboarded.**
+  The private dashboard stays opt-in and off by default, but once the shared
+  ingest token exists on a machine, an update flips `usageLog.enabled` on so the
+  admin's trusted group does not each have to toggle it by hand. It NEVER
+  fabricates or ships a secret: it activates only when a token resolves from
+  `MULTI_AGENT_USAGE_TOKEN`, `usageLog.token`, or the Keychain item named by the
+  new generic `keychainMapping.usage_ingest` slot - a machine that was never
+  given the token stays silent.
+- **`usage-report.mjs` reads the ingest token from the Keychain** (via
+  `credential-store.sh`, resolved through `keychainMapping.usage_ingest`) as a
+  fallback after env and `usageLog.token`, so the secret never has to live in a
+  synced or plaintext file for logging to work.
+
 ## [15.1.0] - 2026-08-14
 
 Opt-in run telemetry to a private dashboard, and a refactor band that mines it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "15.1.0",
+  "version": "15.3.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -206,6 +206,40 @@ Save the resolved mapping to preferences:
 
 `null` = not mapped (missing or skipped). Pipeline phases read this mapping to retrieve tokens dynamically  -  never hardcoded key names.
 
+### Step 2.7  -  Usage dashboard token (optional, opt-in)
+
+Only relevant when the team runs a private usage dashboard and the admin has issued this user a personal ingest token. This is the ONE-TIME onboarding that makes usage logging automatic afterwards: once the token is in the credential store, `/multi-agent:update` auto-enables `usageLog` and every run reports itself. Skipping it leaves logging fully off.
+
+Ask (in `outputLanguage`), and proceed only on an explicit yes:
+
+```
+Do you have a usage-dashboard ingest token from your admin?
+It turns on private run telemetry (who/what/when/tokens) for the team dashboard.
+[ Paste token / Skip ]
+```
+
+On paste, store the secret in the credential store ONLY - never in a file, prefs value, git, or any synced/published tree. Use the standard per-user key name so it is revocable independently and consistent across the user's machines:
+
+```bash
+~/.claude/lib/credential-store.sh set "${USER}_Usage_Ingest_Token" "<pasted-token>"
+```
+
+Then map it and enable logging (the token itself stays in the credential store; only the logical mapping + the on-switch land in prefs):
+
+```bash
+node -e '
+  const fs=require("fs"),os=require("os"),p=os.homedir()+"/.claude/multi-agent-preferences.json";
+  const j=JSON.parse(fs.readFileSync(p,"utf8"));
+  j.global=j.global||{}; j.global.keychainMapping=j.global.keychainMapping||{};
+  j.global.keychainMapping.usage_ingest=process.argv[1];
+  j.global.usageLog=Object.assign({enabled:true},j.global.usageLog||{},{enabled:true});
+  fs.writeFileSync(p,JSON.stringify(j,null,2)+"\n");
+' "${USER}_Usage_Ingest_Token"
+echo "  -> usage logging onboarded (token in credential store; logging on)"
+```
+
+Security notes to surface to the user: the token is **write-only** (it can only append activity metadata to the dashboard - no read access, no other scope), it is stored **only in the OS credential store**, and it is **per-user** so the admin can revoke this one token without affecting anyone else. `usage-report.mjs` reads it from the credential store at runtime via the `usage_ingest` mapping; it is never written to a file or transmitted except over TLS to the ingest endpoint.
+
 ### Auto-learned fields (no setup step needed)
 
 **Jira Project Key**: auto-learned from pipeline usage. User runs `/multi-agent ABC-123` → `ABC` is extracted and saved to `prefs.global.defaultJiraKey` (first ever) and `prefs.projects[{project}].jiraProjectKeys` (per-project). Multiple keys accumulate over time  -  most recent first, deduped. Phase 0 Step 1 (Parse Input) handles extraction.

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -71,6 +71,33 @@ Update the pipeline in one command. Existing preferences are preserved; only ski
    fi
    ```
 
+5b. **Auto-enable usage logging when a token is already onboarded.** The private
+   usage dashboard is opt-in and off by default. This step flips it ON only when a
+   token can be resolved - it NEVER fabricates a secret or ships one, so a machine
+   that was never given the token stays silent. Resolution order: env
+   `MULTI_AGENT_USAGE_TOKEN`, then `usageLog.token`, then the Keychain item named by
+   `keychainMapping.usage_ingest`. Endpoint is left to the emitter's default.
+   ```bash
+   PREFS="$HOME/.claude/multi-agent-preferences.json"
+   if [ -f "$PREFS" ] && command -v jq >/dev/null 2>&1; then
+     ENABLED=$(jq -r '.global.usageLog.enabled // false' "$PREFS" 2>/dev/null)
+     if [ "$ENABLED" != "true" ]; then
+       TOK="${MULTI_AGENT_USAGE_TOKEN:-}"
+       [ -z "$TOK" ] && TOK=$(jq -r '.global.usageLog.token // empty' "$PREFS" 2>/dev/null)
+       if [ -z "$TOK" ]; then
+         KNAME=$(jq -r '.global.keychainMapping.usage_ingest // empty' "$PREFS" 2>/dev/null)
+         [ -n "$KNAME" ] && TOK=$(bash "$HOME/.claude/lib/credential-store.sh" get "$KNAME" 2>/dev/null)
+       fi
+       if [ -n "$TOK" ]; then
+         node -e 'const fs=require("fs"),p=process.argv[1];const j=JSON.parse(fs.readFileSync(p,"utf8"));j.global=j.global||{};j.global.usageLog=j.global.usageLog||{};j.global.usageLog.enabled=true;fs.writeFileSync(p,JSON.stringify(j,null,2)+"\n");' "$PREFS"
+         echo "  -> usage logging activated (ingest token found)"
+       else
+         echo "  -> usage logging left off (no ingest token onboarded)"
+       fi
+     fi
+   fi
+   ```
+
 6. **Show the new version**:
    ```bash
    NEW_VERSION=$(node -p "require('$PIPE_DIR/package.json').version" 2>/dev/null || echo "unknown")

package/pipeline/preferences-template.json

@@ -12,6 +12,7 @@
       "figma_mcp": null,
       "fortify": null,
       "graylog": null,
+      "usage_ingest": null,
       "firebase": null,
       "jenkins": null
     },

package/pipeline/schemas/prefs.schema.json

@@ -188,6 +188,13 @@
                 "null"
               ]
             },
+            "usage_ingest": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Keychain item holding the shared ingest token for the private usage dashboard. When set, usage-report.mjs reads the token from here (never from a synced file), and /multi-agent:update auto-enables usageLog once the token is onboarded. Absent = usage logging stays off."
+            },
             "figma_pat": {
               "type": [
                 "string",

package/pipeline/scripts/usage-report.mjs

@@ -32,6 +32,7 @@ import { readFileSync, existsSync, readdirSync, appendFileSync } from "fs";
 import { homedir, platform } from "os";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
+import { execFileSync } from "child_process";
 import { costUsd } from "./_cost.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -70,6 +71,36 @@ function resolvePrefs() {
   return resolveGlobalPrefs().usageLog ?? {};
 }
 
+/**
+ * Resolve the ingest token without ever storing it in a synced file.
+ * Order: env, then prefs.usageLog.token, then the Keychain entry mapped by
+ * prefs.global.keychainMapping.usage_ingest (via credential-store.sh). This
+ * lets update flip usageLog.enabled on while the secret stays in the Keychain.
+ */
+function resolveToken() {
+  if (process.env.MULTI_AGENT_USAGE_TOKEN) return process.env.MULTI_AGENT_USAGE_TOKEN;
+  const g = resolveGlobalPrefs();
+  const inline = g.usageLog?.token;
+  if (typeof inline === "string" && inline.trim()) return inline.trim();
+  const name = g.keychainMapping?.usage_ingest;
+  if (typeof name === "string" && name.trim()) {
+    const store = join(homedir(), ".claude", "lib", "credential-store.sh");
+    if (existsSync(store)) {
+      try {
+        const out = execFileSync("bash", [store, "get", name.trim()], {
+          encoding: "utf-8",
+          timeout: 4000,
+          stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        if (out) return out;
+      } catch {
+        /* keychain unavailable - stay silent */
+      }
+    }
+  }
+  return "";
+}
+
 function enabledPlugins(state) {
   const root = state.projectRoot || process.cwd();
   const settings = readJson(join(root, ".claude", "settings.json"));
@@ -393,7 +424,7 @@ async function post(endpoint, token, event) {
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   const prefs = resolvePrefs();
-  const token = process.env.MULTI_AGENT_USAGE_TOKEN || prefs.token || "";
+  const token = resolveToken();
   const endpoint = prefs.endpoint || ENDPOINT_DEFAULT;
 
   if (!args.dryRun && (prefs.enabled !== true || !token)) return;