@mmerterden/multi-agent-pipeline 15.6.0 → 15.7.0

package/CHANGELOG.md

@@ -16,6 +16,31 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [15.7.0] - 2026-08-19
+
+### Added
+- **Setup walks missing credentials one by one**: Step 3 gained a strict sequential onboarding loop - fixed service order, one Token Save Flow prompt per service (token -> author -> host), per-service skips that never abort the loop, and `figma` / `figma_mcp` as distinct passes. The discovery summary can no longer end setup.
+- **Per-repo Jira project keys in setup**: the Jira pass closes with an optional multi-select mapping (repo -> project key) written to `prefs.projects[{slug}].jiraProjectKeys`; per-repo keys resolve before `global.defaultJiraKey` everywhere a key is needed. Re-open with `/multi-agent:setup jira-keys`.
+- **Figma MCP mode question**: the `figma_mcp` pass opens with Remote / Local. Remote generates the `figu_` OAuth token for the current user (Dynamic Client Registration + PKCE; `prefs.global.figmaMcp.remoteGeneratorScript` drives the flow when set); Local wires the PAT-based `@anthropic-ai/figma-mcp` server (`localGeneratorScript` supported). Prefs schema: new `global.figmaMcp` block plus `supabase_access` / `supabase_service_role` keychainMapping keys.
+
+### Changed
+- **Help spells out the --dev pipeline**: the Pipeline section now carries the dev chain (Phases 1-2 skipped, Review never skipped, Opus dev). Stale notes claiming Test or Review are skipped in --dev were corrected in both languages.
+- **Setup Step 5 (Repo Discovery) split to a reference**: the full contract moved to `multi-agent-refs/setup/repo-discovery.md`; the SKILL keeps the opt-in prompt and a summary.
+
+### Fixed
+- **build-stack-plugins.mjs dead import**: unused `APPLE_ONLY` import removed (superseded by the `STACK_ONLY` routing table).
+
+## [15.6.1] - 2026-08-19
+
+### Changed
+- **`/multi-agent:update` installs from npm, not from a git clone**: the registry is the single update channel - latest published release resolved with a direct registry read (never `npm view`'s cache), downloaded via `npm pack` with the registry pinned, installed with `install.js --all`, changes rendered from the packaged CHANGELOG, smokes run from the tarball. A pipeline repo clone is now purely a maintainer workspace (synced by `/multi-agent:sync`); consumers need no git access at all, so collaborator grants on the private repo can stay read-only or be dropped.
+
+### Fixed
+- **`node --test` runs stop pinging the live dashboard**: the tracker-entities suite calls `phase-tracker.sh init` outside run-smokes' `MULTI_AGENT_SMOKE` guard, so every test run left a phantom "probe" row on the timeline. The suite now sets the flag itself, and `usage-report.mjs` refuses to emit under it as the last line of defense for any caller.
+- **Usage report reads the tracker as it is actually written**: `tracker-state.json` stores `phases` as an array, but the reporter iterated it with `Object.entries`, so dashboard phase ids were array indexes - every phase after a skipped one was mislabeled (Commit id "6" reported as Faz 5). Failed-phase error tags carried the same wrong ids.
+- **Run duration and terminal timestamp resolve from the tracker**: nothing stamps `state.finishedAt`, so every run reported `du=null` and a terminal emit was stamped with the reporter's wall clock (wrong for backfills). Both now fall back to the tracker's phase span (earliest start to latest completion).
+- **Version and user fields stop reporting null**: the reporter reads the installer's `~/.claude/.pipeline-version` marker (installed trees have no adjacent `package.json`) and falls back to `identity.name` when `identity.username` is absent.
+
 ## [15.6.0] - 2026-08-18
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "15.6.0",
+  "version": "15.7.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/help/SKILL.md

@@ -68,6 +68,10 @@ Pipeline (after Phase 0)  -  shown as visual cards in terminal:
 
   Autopilot always pauses at the Phase 7 channels menu (30-min timeout → session ends cleanly).
 
+  --dev pipeline (Phases 1-2 skipped; Review is NEVER skipped):
+  Init (same 8 steps), Dev with Opus, Review (same gates + triage),
+  Test (skipped in autopilot / --local), Commit + Report (menu still pauses).
+
   Every step is logged. Error in any phase -> pause -> resume to continue.
 
 ------------------------------------------------------------
@@ -80,7 +84,7 @@ Modes:
   autopilot            Skip all confirmations INCLUDING plan gate, auto commit/PR
                        (EXCEPT Phase 7 channels menu  -  always pauses)
   --dev autopilot      Fastest path
-  --local --dev        Local + fast (no worktree, no analysis/review, no plan gate)
+  --local --dev        Local + fast (no worktree, no analysis/plan gate  -  review still runs)
 
 Dedicated commands (same as flags above):
 
@@ -213,8 +217,7 @@ Design Check (mock-mode vs Figma, local-only  -  powered by dev-toolkit-mcp desi
   # "Requires a scenario / prefix / launch-arg" is not a reason; reaching those states is the run's job.
   # When a live screen has no confident Figma match, it SHOWS you the screenshot and asks for the node-id.
 
-  dev-toolkit-mcp design_* tools it drives: design_mock_detect, design_scenario_inventory, design_mock_launch,
-  design_ui_geometry, design_visual_compare, design_report (+ ios_* / android_* device control).
+  Drives the dev-toolkit-mcp design_* tool suite (+ ios_* / android_* device control).
 
 ------------------------------------------------------------
 
@@ -330,13 +333,18 @@ Pipeline (Phase 0'dan sonra)  -  terminalde görsel kart olarak görünür:
   Phase 3:   Dev        -> TDD: test -> kod -> build (Sonnet) + build queue
   Phase 4:   Review     -> Deterministik kapılar + paralel AI review + Fable triage
                           (Claude Code: Fable + Sonnet · Copilot CLI: GPT-5.4 + Opus + Sonnet)
-  Phase 5:   Test       -> Opsiyonel: branch'e geç, Xcode'da test (--dev / autopilot'ta skip)
+  Phase 5:   Test       -> Opsiyonel: branch'e geç, Xcode'da test
+                          (dev + full'de koşar; her autopilot ve local varyantında skip)
   Phase 6:   Commit     -> Commit -> push -> PR + issue body güncelleme (hiç auto-close yok)
   Phase 7:   Report     -> Channels dispatcher (PR · Jira · Confluence · Wiki, multi-select)
                           + internal capture (agent-log · knowledge · memory)
 
   Autopilot Phase 7'deki channels menüsünde HER ZAMAN durur (30 dk timeout → session temiz biter).
 
+  --dev pipeline'ı (Faz 1-2 atlanır; Review ASLA atlanmaz):
+  Init (aynı 8 adım), Dev Opus ile, Review (aynı kapılar + triage),
+  Test (autopilot / --local'de atlanır), Commit + Report (menü yine durur).
+
   Her adım loglanır. Herhangi bir fazdaki hata -> pause -> resume ile devam et.
 
 ------------------------------------------------------------
@@ -349,7 +357,7 @@ Modlar:
   autopilot            Plan gate dahil tüm onayları atla, otomatik commit/PR
                        (İSTİSNA: Phase 7 channels menüsü  -  her zaman durur)
   --dev autopilot      En hızlı yol
-  --local --dev        Local + hızlı (worktree yok, analiz/review yok, plan gate yok)
+  --local --dev        Local + hızlı (worktree yok, analiz/plan gate yok  -  review yine koşar)
 
 Dedicated komutlar (yukarıdaki flag'lerin eşdeğeri):
 
@@ -483,8 +491,7 @@ Design Check (mock-mod vs Figma, yalnızca lokal  -  dev-toolkit-mcp design_* to
   # "Senaryo / prefix / launch-arg gerektirir" gerekçe değildir; o state'lere ulaşmak koşunun işidir.
   # Canlı ekranın Figma karşılığı kesin bulunamazsa SANA screenshot'ı gösterip node-id sorar.
 
-  Sürdüğü dev-toolkit-mcp design_* tool'ları: design_mock_detect, design_scenario_inventory, design_mock_launch,
-  design_ui_geometry, design_visual_compare, design_report (+ ios_* / android_* cihaz kontrolü).
+  dev-toolkit-mcp design_* tool takımını sürer (+ ios_* / android_* cihaz kontrolü).
 
 ------------------------------------------------------------
 

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -247,7 +247,7 @@ Security notes to surface to the user: the token is **write-only** (append-only
 
 ### Step 3  -  Interactive token onboarding (for missing tokens)
 
-Git identities are NOT asked as a separate step. They are learned when tokens are added in Step 4 (Token Save Flow). Each token save triggers an identity prompt:
+Git identities are NOT asked as a separate step. They are learned when tokens are added via the Token Save Flow below. Each token save triggers an identity prompt:
 
 ```
 Token saved. Which git identity uses this token?
@@ -269,6 +269,30 @@ Token saved. Which git identity uses this token?
 
 For each MISSING service, run the **Token Save Flow** below. When creating new tokens, use the **standard key name** from Step 1b table.
 
+#### Sequential onboarding loop (strict)
+
+The Step 2 discovery summary is never the end of setup. Immediately after showing it, walk the missing services ONE BY ONE in this fixed order and run the Token Save Flow for each:
+
+1. `jira`
+2. `bitbucket_token` (then `bitbucket_user` right after, if missing)
+3. `github`
+4. `confluence`
+5. `figma`  -  Figma Personal Access Token (Tier 2, REST)
+6. `figma_mcp`  -  Figma MCP auth (Tier 1); its own prompt, never folded into the PAT prompt
+7. `fortify`
+8. `graylog`
+9. `firebase`
+10. `jenkins`
+11. App Store Connect block (Step 3b; only when the target repo is iOS)
+
+Loop rules:
+
+- **One prompt per service.** Never collapse the list into a single "add missing tokens now?" yes/no, and never offer one multi-select covering all services: each service has its own source URL, key name, identity binding and host prompt, so each gets its own Token Save Flow pass.
+- **Each service pass asks, in order: token → author → host.** Step A/B collect the secret, Step C binds the git identity (author)  -  Bitbucket and GitHub included; every saved token gets an author  -  and Step 3.5 asks the host domain inline for hosted services (jira, confluence, bitbucket, fortify, graylog). GitHub and Figma skip the host question (fixed domains); `bitbucket_user` skips author binding (username, not a PAT). Never end a service pass with the token saved but the author or a required host unasked.
+- **Skip is per-service.** A Skip answer leaves that service's `keychainMapping` at `null` and the loop continues with the next service. Skips never abort the loop.
+- **`figma` and `figma_mcp` are distinct credentials for distinct tiers  -  ask both.** Skipping the PAT does not imply skipping MCP, and vice versa. The `figma_mcp` pass opens with a Remote / Local mode question instead of a clipboard paste (see "Figma MCP Setup" below): Remote generates a `figu_` OAuth token for the current user, Local wires the PAT-based local server.
+- The loop ends only when every missing service has been asked exactly once; then continue to Step 4 (Verify all).
+
 ---
 
 ### Token Save Flow (reusable)
@@ -424,6 +448,23 @@ Default Jira project key (e.g. PROJ): ___
 
 Save to `prefs.global.defaultJiraKey`. From Jira host, derive `corpDomain` (e.g. `jira.example.com` → `example.com`) and pre-fill it so the Confluence / Bitbucket prompts only need the subdomain.
 
+`defaultJiraKey` stays a single global fallback, but one Jira host usually serves several repos with DIFFERENT project keys, so the Jira pass continues with a per-repo key mapping (multi-select, optional):
+
+```
+Per-repo Jira keys (optional)  -  repos whose project key differs from {defaultJiraKey}:
+
+  [ ] 1. my-ios-app        (current: PROJA)
+  [ ] 2. my-other-app      (current:  - )
+  ...
+
+  Toggle repos, then enter the project key for each selected repo. Enter to skip.
+```
+
+- The repo list comes from `prefs.projects` + `recentProjects` (when Step 5 already ran); a free-text repo path is accepted for repos not discovered yet.
+- Each answer is PREPENDED to `prefs.projects[{slug}].jiraProjectKeys` (deduped, max 10 per schema). Example: `my-ios-app` → `PROJA`, `my-other-app` → `PROJB`  -  two repos on the same Jira host, two different project keys.
+- Resolution order everywhere a Jira key is needed (placeholder replacement, branch names, new-issue creation): `prefs.projects[{slug}].jiraProjectKeys[0]` first, `global.defaultJiraKey` as fallback.
+- **Re-run / update**: `/multi-agent:setup jira-keys` re-opens only this mapping without touching tokens or hosts.
+
 Resulting shape:
 
 ```json
@@ -512,11 +553,8 @@ If still missing, show which ones and let user skip (pipeline will re-ask for an
 
 ### Step 5  -  Repo Discovery (optional)
 
-Pre-populates the Phase 0 project picker. Without this, every task types the repo path by hand; with this, the picker shows a curated list of repos the user has been active in.
-
-Three sources merge into one flat list. Each source is independent  -  any one failing does NOT block the others.
+Pre-populates the Phase 0 project picker with repos the user is active in. Three independent sources merge into one flat list: local `$HOME` scan (depth 3, repo markers), Bitbucket (last 90 days, token-gated), GitHub (owner + collaborator, push in last 90 days, token-gated). Any source failing skips that source only, is reported (never swallowed), and discovery is never destructive and idempotent.
 
-**Prompt:**
 ```
 Step 5  -  Repo Discovery (optional)
 Scan for recent repos now to pre-populate the Phase 0 picker?
@@ -526,103 +564,7 @@ Scan for recent repos now to pre-populate the Phase 0 picker?
   n  -  skip (Phase 0 will prompt for repo path manually)
 ```
 
-**7a. Local scan**  -  `$HOME` depth-3, repo markers
-
-```bash
-find "$HOME" -maxdepth 3 -type d -name ".git" 2>/dev/null | while read gitdir; do
-  repo_dir="$(dirname "$gitdir")"
-  origin="$(git -C "$repo_dir" config --get remote.origin.url 2>/dev/null)"
-  last="$(git -C "$repo_dir" log -1 --format=%cI 2>/dev/null)"
-  printf '%s\t%s\t%s\n' "$repo_dir" "$origin" "$last"
-done
-```
-
-Auxiliary markers (recorded but not required): `*.xcworkspace`, `*.xcodeproj`, `Podfile`, `Package.swift`, `package.json`, `pom.xml`, `build.gradle`. Their presence tags the repo as iOS/macOS, Cocoapods, SPM, Node, Maven, Gradle in the picker.
-
-**7b. Bitbucket scan**  -  last 90 days active
-
-Runs only if `keychainMapping.bitbucket_token` is non-null AND `serviceStatus.bitbucket.ok === true` (or cache older than `settings.serviceStatusCacheSeconds`, re-ping first).
-
-Bitbucket Data Center (self-hosted)  -  the host comes from `prefs.global.bitbucketHost` (or prompts once if unset; NEVER hardcoded):
-```bash
-BB_HOST="$(jq -r '.global.bitbucketHost // empty' "$PREFS_FILE")"
-BB_USER="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_user' "$PREFS_FILE")" 2>/dev/null)"
-BB_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_token' "$PREFS_FILE")" 2>/dev/null)"
-CUTOFF_MS=$(( ( $(date +%s) - 7776000 ) * 1000 ))   # 90 days
-curl -sfS -u "$BB_USER:$BB_TOK" \
-  "https://${BB_HOST}/rest/api/1.0/repos?permission=REPO_WRITE&limit=200" \
-  | jq -r --argjson cutoff "$CUTOFF_MS" '
-      .values[] | select((.updatedDate // 0) >= $cutoff) |
-      { slug: "\(.project.key)/\(.slug)", clone: (.links.clone[] | select(.name=="http") | .href) }'
-```
-
-Bitbucket Cloud  -  swap to `https://api.bitbucket.org/2.0/repositories/{workspace}?role=member&sort=-updated_on`.
-
-**7c. GitHub scan**  -  owner + collaborator, push in last 90 days
-
-Runs only if `keychainMapping.github` is non-null AND `serviceStatus.github.ok === true`.
-
-```bash
-GH_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.github' "$PREFS_FILE")" 2>/dev/null)"
-CUTOFF_ISO="$(date -u -v-90d +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%SZ)"
-# gh CLI path (preferred when available)
-gh api --paginate 'user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100' \
-  -q ".[] | select(.pushed_at > \"$CUTOFF_ISO\") | {full: .full_name, clone: .clone_url}"
-# Fallback without gh:
-curl -sfS -H "Authorization: Bearer $GH_TOK" \
-  'https://api.github.com/user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100'
-```
-
-**7d. Merge by origin URL**
-
-Normalize clone URLs (strip `git@`, `https://`, trailing `.git`) to a canonical `host/owner/repo` key. Deduplicate:
-- Local + remote match on canonical key → single entry with `path = <local>`, `platform = <remote source>`.
-- Remote-only match → entry with `path: null` (user clones on first use from Phase 0).
-- Local-only (no remote clone URL matches) → kept as-is, `platform: "local"`.
-
-**7e. Multi-select picker**
-
-```
-Discovered 24 active repos (local + remote ≤ 90 days):
-
-  [ ]  1. Booking               ~/dev/Booking              bitbucket   iOS · SPM
-  [ ]  2. UIComponents          ~/dev/UIComponents         bitbucket   iOS · SPM
-  [ ]  3. multi-agent-pipeline  ~/multi-agent-pipeline     github      Node
-  [ ]  4. dotfiles              (not cloned)               github       - 
-  [ ]  5. backend-services      ~/work/backend-services    bitbucket   Maven
-  ...
-
-  Toggle with numbers (e.g. "1 3 4"), 'all', 'none', or Enter to skip.
-  Selected repos become defaults in the Phase 0 project picker.
-```
-
-**7f. Save to preferences**
-
-```json
-{
-  "global": {
-    "recentProjects": [
-      {"path": "~/dev/Booking",            "label": "Booking",            "lastUsed": "2026-04-15T21:08:00Z"},
-      {"path": "~/dev/UIComponents",       "label": "UIComponents",       "lastUsed": "2026-04-15T21:08:00Z"},
-      {"path": "~/multi-agent-pipeline",   "label": "multi-agent-pipeline","lastUsed": "2026-04-15T21:08:00Z"}
-    ],
-    "serviceStatus": {
-      "bitbucket": {"ok": true, "checkedAt": "2026-04-15T21:08:00Z"},
-      "github":    {"ok": true, "checkedAt": "2026-04-15T21:08:00Z"}
-    }
-  }
-}
-```
-
-Entries are objects (not bare strings). The schema `recentProjects.items` is a `oneOf`  -  both shapes validate, but v2.1.0 writes objects so `lastUsed` + `label` are first-class.
-
-**7g. Skip / degrade rules**
-
-- Source failure (network, VPN, 401, rate-limit) skips that source; the others still run. Failure is recorded in `serviceStatus.{service} = { ok: false, checkedAt: <now>, reason: <short> }` so Phase 0 can also read that cache.
-- **Report the skip, do not swallow it.** Setup is where the user is actively configuring things, so a source that could not be reached is exactly what they need to hear about, and the reason decides their next move: a 401 means refresh that token, no response at all on a corporate host means connect the VPN, and a missing `global.hosts.<service>` means the token has nowhere to point. Print one line per skipped source with its classification (see `refs/keychain.md` Rule 2) before moving on. A discovery pass that quietly returned three repos out of forty reads as "you only have three repos".
-- If all three sources yield zero hits, Step 5 is a no-op  -  the picker in Phase 0 falls back to manual path entry.
-- Discovery is **never destructive**: it never modifies git state, never writes outside `PREFS_FILE`.
-- Step 5 is idempotent. Re-running it refreshes `recentProjects` and `serviceStatus` but preserves user-curated entries unless explicitly deselected.
+The scan commands, merge-by-origin dedup, the multi-select picker, the `recentProjects` / `serviceStatus` prefs shapes and the skip / degrade rules live in `$HOME/.claude/multi-agent-refs/setup/repo-discovery.md`  -  read that file when the user opts in.
 
 ### Step 6  -  Remember as Multi-Repo Group (optional)
 
@@ -801,23 +743,33 @@ For maximum stdin hygiene (the secret never lands on argv / shell history), use
 pbpaste | ~/.claude/scripts/keychain.py set "<SERVICE_NAME>" -
 ```
 
-### Figma MCP Setup (optional)
+### Figma MCP Setup (Remote / Local question)
+
+The `figma_mcp` pass of the Step 3 loop opens with a mode question BEFORE any token is collected:
 
-Figma MCP works in two modes:
+```
+Figma MCP mode?
 
-**Remote MCP** (Claude Code built-in):
-- Automatic  -  comes as `claude_ai_Figma` in Claude Code settings.json
-- If token renewal needed: re-auth from within Claude Code
+  [1] Remote  -  mcp.figma.com, OAuth token (figu_)  (recommended)
+  [2] Local   -  @anthropic-ai/figma-mcp via npx, uses the Figma PAT
+```
 
-**Local MCP** (@anthropic-ai/figma-mcp package, with PAT):
+**Remote** (`figu_` OAuth token  -  generate it FOR the current user, never just point at docs):
+- No OAuth app and no client_id/secret needed: Dynamic Client Registration against `api.figma.com/v1/oauth/mcp/register` + PKCE, the browser opens, the user clicks Allow, and the resulting access + refresh token pair is saved to the credential store under a name the user confirms. Map that entry to `keychainMapping.figma_mcp` (Token Save Flow Step D applies as usual).
+- If `prefs.global.figmaMcp.remoteGeneratorScript` is set, run that script  -  it drives the whole flow end to end (registration, browser, keychain save) for the current user. Otherwise guide the flow inline.
+- Renewal is silent afterwards via `$HOME/.claude/lib/figma-mcp-refresh.sh` (refresh token). Never echo token values.
+
+**Local** (PAT-based):
+- Validates the Figma PAT against the REST API, saves it to the credential store (reusing the `figma` mapping when present), and writes the `@anthropic-ai/figma-mcp` server block into Claude Code `settings.json` `mcpServers`:
 ```bash
-# 1. Save PAT to keychain (stdin sentinel keeps the value out of shell history)
+# stdin sentinel keeps the value out of shell history
 pbpaste | ~/.claude/scripts/keychain.py set "${USER}_Figma_Access_Token" -
 pbcopy < /dev/null
-
-# 2. Add MCP to Claude Code settings.json
-# ~/.claude/settings.json -> mcpServers -> figma
+# then: ~/.claude/settings.json -> mcpServers -> figma
 ```
+- If `prefs.global.figmaMcp.localGeneratorScript` is set, run that script instead.
+
+Choosing Remote does NOT skip the `figma` PAT pass (Tier 2 still uses the PAT); choosing Local leaves `keychainMapping.figma_mcp` null and Tier 1 unavailable until Remote is onboarded.
 
 ### Security Rules
 
@@ -850,7 +802,7 @@ To set up multi-agent on a new machine:
    /multi-agent "bug description"
 ```
 
-All tokens are optional  -  pipeline will ask for any needed token at Phase 0. Setup only does pre-preparation.
+All tokens are optional in the sense that every service can be answered with Skip  -  but the ASKING is not optional: the Step 3 sequential loop still walks every missing service one by one (token → author → host). Phase 0 re-asks at runtime only for tokens the user skipped here.
 
 ### Step 8  -  Enforcement hook (optional, Claude Code)
 

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -1,43 +1,49 @@
 ---
-description: "Update the pipeline to the latest version: git pull, install, migrate. Use when the installed pipeline is behind and should be brought to the latest version."
-description-tr: "Pipeline'ı son sürüme günceller: git pull, install, migrate."
+description: "Update the pipeline to the latest published npm release: registry check, npm pack, install, migrate. Use when the installed pipeline is behind and should be brought to the latest version."
+description-tr: "Pipeline'ı npm'deki son yayına günceller: registry kontrolü, npm pack, install, migrate."
 allowed-tools: Bash, Read, Write, AskUserQuestion
 ---
 
 # multi-agent update
 
-Update the pipeline in one command. Existing preferences are preserved; only skill / script / schema files are refreshed.
+Update the pipeline in one command. The npm registry is the single update channel: the latest published release is downloaded and installed. Existing preferences are preserved; only skill / script / schema files are refreshed.
+
+A git clone of the pipeline repo is a maintainer workspace, kept in sync by `/multi-agent:sync` - it is never consulted here. A fix that only exists on `main` reaches users when a release is published, not before.
 
 ## Steps
 
-1. **Find the pipeline repo**:
+1. **Resolve the package and both versions** (run steps 1-3 in ONE shell block so the variables survive):
    ```bash
-   PIPE_DIR=""
-   for candidate in "$HOME/multi-agent-pipeline" "$HOME/dev/multi-agent-pipeline" "$HOME/projects/multi-agent-pipeline"; do
-     [ -d "$candidate/.git" ] && PIPE_DIR="$candidate" && break
-   done
-   if [ -z "$PIPE_DIR" ]; then
-     echo "Pipeline repo not found. Clone it:"
-     echo "  git clone git@github.com:{owner}/multi-agent-pipeline.git"
+   PKG="@{npm-scope}/multi-agent-pipeline"
+   REG="https://registry.npmjs.org"
+   CUR=$(tr -d '[:space:]' < "$HOME/.claude/.pipeline-version" 2>/dev/null)
+   [ -n "$CUR" ] || CUR="unknown"
+   # Read the registry directly - `npm view` can answer from a stale local cache.
+   LATEST=$(curl -fsS "$REG/$(printf '%s' "$PKG" | sed 's|/|%2F|')/latest" \
+     | node -pe 'JSON.parse(require("fs").readFileSync(0,"utf8")).version' 2>/dev/null)
+   if [ -z "$LATEST" ]; then
+     echo "Registry unreachable ($REG) - check your network and retry."
      exit 1
    fi
+   echo "Current: v$CUR   Latest: v$LATEST"
    ```
 
-2. **Capture the current version**:
+2. **Stop early when already current** (still refresh the marketplace, step 4b):
    ```bash
-   OLD_VERSION=$(node -p "require('$PIPE_DIR/package.json').version" 2>/dev/null || echo "unknown")
-   echo "Current: v$OLD_VERSION"
+   [ "$CUR" = "$LATEST" ] && echo "✓ Already up to date: v$LATEST"
    ```
 
-3. **Pull latest**:
+3. **Download the release and install**:
    ```bash
-   cd "$PIPE_DIR" && git pull origin main
+   UPD_DIR="${TMPDIR:-/tmp}/multi-agent-update"
+   rm -rf "$UPD_DIR" && mkdir -p "$UPD_DIR"
+   # --registry pinned: an ambient .npmrc must not reroute the scope elsewhere.
+   npm pack "$PKG@$LATEST" --registry "$REG" --pack-destination "$UPD_DIR" --silent >/dev/null
+   tar -xzf "$UPD_DIR"/*.tgz -C "$UPD_DIR"
+   node "$UPD_DIR/package/install.js" --all
    ```
 
-4. **Install (copy the files)**:
-   ```bash
-   node "$PIPE_DIR/install.js" --all
-   ```
+   The installer refreshes every configured CLI target (Claude Code, Copilot CLI, Codex CLI) and writes the new version to `$HOME/.claude/.pipeline-version`.
 
 4b. **Update the stack-plugin marketplace** (pulls the latest plugin versions):
    ```bash
@@ -98,44 +104,41 @@ Update the pipeline in one command. Existing preferences are preserved; only ski
    fi
    ```
 
-6. **Show the new version**:
+6. **Show the new version and its changes** (from the packaged CHANGELOG - there is no git history on this channel):
    ```bash
-   NEW_VERSION=$(node -p "require('$PIPE_DIR/package.json').version" 2>/dev/null || echo "unknown")
+   NEW=$(tr -d '[:space:]' < "$HOME/.claude/.pipeline-version" 2>/dev/null)
    echo ""
-   if [ "$OLD_VERSION" = "$NEW_VERSION" ]; then
-     echo "✓ Already up to date: v$NEW_VERSION"
-   else
-     echo "✓ Updated: v$OLD_VERSION → v$NEW_VERSION"
-     echo ""
-     echo "Changes:"
-     cd "$PIPE_DIR" && git log --oneline "v$OLD_VERSION..v$NEW_VERSION" 2>/dev/null | head -15
-   fi
+   echo "✓ Updated: v$CUR → v$NEW"
+   echo ""
+   echo "Changes:"
+   awk -v new="## [$NEW]" -v cur="## [$CUR]" \
+     'index($0,new){on=1} on&&index($0,cur){exit} on' \
+     "$UPD_DIR/package/CHANGELOG.md" | head -40
    ```
 
-7. **Smoke test (optional)**:
+7. **Smoke test (optional)** - the release tarball ships exactly two smokes for this purpose:
    ```bash
    echo ""
    echo "Verification:"
-   # Repo-relative on purpose: these are maintainer smokes, excluded from installs.
-   # Both lines name $PIPE_DIR rather than relying on the cd from the line above,
-   # so neither can be read - or copied - as an installed-tree invocation.
-   bash "$PIPE_DIR/pipeline/scripts/smoke-schema-validation.sh" 2>&1 | tail -1
-   bash "$PIPE_DIR/pipeline/scripts/smoke-cross-cli-behavior.sh" 2>&1 | tail -1
+   bash "$UPD_DIR/package/pipeline/scripts/smoke-schema-validation.sh" 2>&1 | tail -1
+   bash "$UPD_DIR/package/pipeline/scripts/smoke-cross-cli-behavior.sh" 2>&1 | tail -1
+   rm -rf "$UPD_DIR"
    ```
 
 ## Output
 
 ```
-Current: v14.2.2
-  -> git pull origin main
+Current: v15.6.0   Latest: v15.6.1
+  -> npm pack @{npm-scope}/multi-agent-pipeline@15.6.1
   -> node install.js --all (51 commands, 228 scripts, 205 skills)
   -> migrate-prefs.mjs (0 changes  -  already v2.6.0)
 
-✓ Updated: v14.2.2 → v15.0.0
+✓ Updated: v15.6.0 → v15.6.1
 
 Changes:
-  e3f883e fix(dev): Phase 6 must show local test prompt
-  59617aa fix(setup): first-run guard
+  ## [15.6.1] - 2026-08-19
+  ### Fixed
+  - Usage report reads the tracker as it is actually written
   ...
 
 Verification:

package/pipeline/multi-agent-refs/setup/repo-discovery.md

@@ -0,0 +1,116 @@
+# Setup Step 5  -  Repo Discovery (full contract)
+
+> Split out of `setup/SKILL.md` (token budget). The SKILL keeps the opt-in prompt and a summary; this file carries the scan commands, merge rules, picker, prefs shapes and skip / degrade rules. Read it when the user opts into repo discovery.
+
+Pre-populates the Phase 0 project picker. Without this, every task types the repo path by hand; with this, the picker shows a curated list of repos the user has been active in.
+
+Three sources merge into one flat list. Each source is independent  -  any one failing does NOT block the others.
+
+**Prompt:**
+```
+Step 5  -  Repo Discovery (optional)
+Scan for recent repos now to pre-populate the Phase 0 picker?
+
+  y  -  all three (local + Bitbucket + GitHub, ~10-30s)
+  l  -  local scan only (fastest, no network)
+  n  -  skip (Phase 0 will prompt for repo path manually)
+```
+
+**7a. Local scan**  -  `$HOME` depth-3, repo markers
+
+```bash
+find "$HOME" -maxdepth 3 -type d -name ".git" 2>/dev/null | while read gitdir; do
+  repo_dir="$(dirname "$gitdir")"
+  origin="$(git -C "$repo_dir" config --get remote.origin.url 2>/dev/null)"
+  last="$(git -C "$repo_dir" log -1 --format=%cI 2>/dev/null)"
+  printf '%s\t%s\t%s\n' "$repo_dir" "$origin" "$last"
+done
+```
+
+Auxiliary markers (recorded but not required): `*.xcworkspace`, `*.xcodeproj`, `Podfile`, `Package.swift`, `package.json`, `pom.xml`, `build.gradle`. Their presence tags the repo as iOS/macOS, Cocoapods, SPM, Node, Maven, Gradle in the picker.
+
+**7b. Bitbucket scan**  -  last 90 days active
+
+Runs only if `keychainMapping.bitbucket_token` is non-null AND `serviceStatus.bitbucket.ok === true` (or cache older than `settings.serviceStatusCacheSeconds`, re-ping first).
+
+Bitbucket Data Center (self-hosted)  -  the host comes from `prefs.global.bitbucketHost` (or prompts once if unset; NEVER hardcoded):
+```bash
+BB_HOST="$(jq -r '.global.bitbucketHost // empty' "$PREFS_FILE")"
+BB_USER="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_user' "$PREFS_FILE")" 2>/dev/null)"
+BB_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_token' "$PREFS_FILE")" 2>/dev/null)"
+CUTOFF_MS=$(( ( $(date +%s) - 7776000 ) * 1000 ))   # 90 days
+curl -sfS -u "$BB_USER:$BB_TOK" \
+  "https://${BB_HOST}/rest/api/1.0/repos?permission=REPO_WRITE&limit=200" \
+  | jq -r --argjson cutoff "$CUTOFF_MS" '
+      .values[] | select((.updatedDate // 0) >= $cutoff) |
+      { slug: "\(.project.key)/\(.slug)", clone: (.links.clone[] | select(.name=="http") | .href) }'
+```
+
+Bitbucket Cloud  -  swap to `https://api.bitbucket.org/2.0/repositories/{workspace}?role=member&sort=-updated_on`.
+
+**7c. GitHub scan**  -  owner + collaborator, push in last 90 days
+
+Runs only if `keychainMapping.github` is non-null AND `serviceStatus.github.ok === true`.
+
+```bash
+GH_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.github' "$PREFS_FILE")" 2>/dev/null)"
+CUTOFF_ISO="$(date -u -v-90d +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%SZ)"
+# gh CLI path (preferred when available)
+gh api --paginate 'user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100' \
+  -q ".[] | select(.pushed_at > \"$CUTOFF_ISO\") | {full: .full_name, clone: .clone_url}"
+# Fallback without gh:
+curl -sfS -H "Authorization: Bearer $GH_TOK" \
+  'https://api.github.com/user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100'
+```
+
+**7d. Merge by origin URL**
+
+Normalize clone URLs (strip `git@`, `https://`, trailing `.git`) to a canonical `host/owner/repo` key. Deduplicate:
+- Local + remote match on canonical key → single entry with `path = <local>`, `platform = <remote source>`.
+- Remote-only match → entry with `path: null` (user clones on first use from Phase 0).
+- Local-only (no remote clone URL matches) → kept as-is, `platform: "local"`.
+
+**7e. Multi-select picker**
+
+```
+Discovered 24 active repos (local + remote ≤ 90 days):
+
+  [ ]  1. Booking               ~/dev/Booking              bitbucket   iOS · SPM
+  [ ]  2. UIComponents          ~/dev/UIComponents         bitbucket   iOS · SPM
+  [ ]  3. multi-agent-pipeline  ~/multi-agent-pipeline     github      Node
+  [ ]  4. dotfiles              (not cloned)               github       - 
+  [ ]  5. backend-services      ~/work/backend-services    bitbucket   Maven
+  ...
+
+  Toggle with numbers (e.g. "1 3 4"), 'all', 'none', or Enter to skip.
+  Selected repos become defaults in the Phase 0 project picker.
+```
+
+**7f. Save to preferences**
+
+```json
+{
+  "global": {
+    "recentProjects": [
+      {"path": "~/dev/Booking",            "label": "Booking",            "lastUsed": "2026-04-15T21:08:00Z"},
+      {"path": "~/dev/UIComponents",       "label": "UIComponents",       "lastUsed": "2026-04-15T21:08:00Z"},
+      {"path": "~/multi-agent-pipeline",   "label": "multi-agent-pipeline","lastUsed": "2026-04-15T21:08:00Z"}
+    ],
+    "serviceStatus": {
+      "bitbucket": {"ok": true, "checkedAt": "2026-04-15T21:08:00Z"},
+      "github":    {"ok": true, "checkedAt": "2026-04-15T21:08:00Z"}
+    }
+  }
+}
+```
+
+Entries are objects (not bare strings). The schema `recentProjects.items` is a `oneOf`  -  both shapes validate, but v2.1.0 writes objects so `lastUsed` + `label` are first-class.
+
+**7g. Skip / degrade rules**
+
+- Source failure (network, VPN, 401, rate-limit) skips that source; the others still run. Failure is recorded in `serviceStatus.{service} = { ok: false, checkedAt: <now>, reason: <short> }` so Phase 0 can also read that cache.
+- **Report the skip, do not swallow it.** Setup is where the user is actively configuring things, so a source that could not be reached is exactly what they need to hear about, and the reason decides their next move: a 401 means refresh that token, no response at all on a corporate host means connect the VPN, and a missing `global.hosts.<service>` means the token has nowhere to point. Print one line per skipped source with its classification (see `refs/keychain.md` Rule 2) before moving on. A discovery pass that quietly returned three repos out of forty reads as "you only have three repos".
+- If all three sources yield zero hits, Step 5 is a no-op  -  the picker in Phase 0 falls back to manual path entry.
+- Discovery is **never destructive**: it never modifies git state, never writes outside `PREFS_FILE`.
+- Step 5 is idempotent. Re-running it refreshes `recentProjects` and `serviceStatus` but preserves user-curated entries unless explicitly deselected.
+

package/pipeline/schemas/prefs.schema.json

@@ -123,7 +123,7 @@
         "keychainMapping": {
           "type": "object",
           "additionalProperties": false,
-          "description": "Maps logical token names to actual Keychain item names. Pipeline looks up tokens via `security find-generic-password -s <mapped-name>` (or `pipeline/lib/credential-store.sh get` cross-platform). Covered keys: jira, bitbucket, bitbucket_token, bitbucket_user, github, confluence, figma, figma_mcp, fortify, graylog, firebase, jenkins, npm, claude_oauth_token, claude_oauth_token_fallback. Deprecated and accepted only for backward compatibility: figma_pat (superseded by figma), figma_user (unused).",
+          "description": "Maps logical token names to actual Keychain item names. Pipeline looks up tokens via `security find-generic-password -s <mapped-name>` (or `pipeline/lib/credential-store.sh get` cross-platform). Covered keys: jira, bitbucket, bitbucket_token, bitbucket_user, github, confluence, figma, figma_mcp, fortify, graylog, firebase, jenkins, npm, claude_oauth_token, claude_oauth_token_fallback, supabase_access, supabase_service_role. Deprecated and accepted only for backward compatibility: figma_pat (superseded by figma), figma_user (unused).",
           "properties": {
             "jira": {
               "type": [
@@ -188,6 +188,20 @@
                 "null"
               ]
             },
+            "supabase_access": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Supabase personal access token (Management API). Used by personal-site tooling; not consumed by pipeline phases."
+            },
+            "supabase_service_role": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Supabase service_role key for the personal-site project. Server-side only; never shipped to a client."
+            },
             "usage_ingest": {
               "type": [
                 "string",
@@ -621,6 +635,27 @@
           ],
           "description": "Default Jira project key used for placeholder replacement. null until /multi-agent:setup onboards a Jira project."
         },
+        "figmaMcp": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "remoteGeneratorScript": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Local-only path to a script that generates the remote MCP OAuth token (figu_) via Dynamic Client Registration + PKCE and saves it to the credential store. Run by the setup figma_mcp pass when the user picks Remote. Personal paths stay in prefs; never embedded in synced files."
+            },
+            "localGeneratorScript": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Local-only path to a script that validates the Figma PAT and wires the PAT-based local MCP server (@anthropic-ai/figma-mcp) into Claude Code settings.json. Run by the setup figma_mcp pass when the user picks Local."
+            }
+          },
+          "description": "Figma MCP onboarding helpers for /multi-agent:setup. Both fields optional; when unset the setup flow guides the token generation inline."
+        },
         "modelFallback": {
           "type": "object",
           "additionalProperties": false,

package/pipeline/scripts/build-stack-plugins.mjs

@@ -55,7 +55,6 @@ const DRY = args.includes("--dry-run");
 import {
   COMMON_PLUGIN,
   COMMON_SKILLS,
-  APPLE_ONLY,
   STACK_ONLY,
   STACK_PATTERNS,
 } from "./_stack-routing.mjs";

package/pipeline/scripts/usage-report.mjs

@@ -212,6 +212,12 @@ function resolveStatePath({ state, taskId }) {
 }
 
 function packageVersion() {
+  try {
+    const marker = readFileSync(join(homedir(), ".claude", ".pipeline-version"), "utf-8").trim();
+    if (marker) return marker;
+  } catch {
+    /* marker absent */
+  }
   const candidates = [
     join(__dirname, "..", "..", "package.json"),
     join(homedir(), ".claude", "multi-agent-pipeline", "package.json"),
@@ -260,10 +266,25 @@ function phaseDurationSec(p) {
 }
 
 function trackerSummary(state) {
+  const empty = {
+    tk: null,
+    cost: null,
+    phs: null,
+    failed: [],
+    models: [],
+    startedAt: null,
+    endedAt: null,
+  };
   const path = resolveTracker(state);
-  if (!path) return { tk: null, cost: null, phs: null, failed: [], models: [] };
+  if (!path) return empty;
   const tracker = readJson(path);
-  if (!tracker?.phases) return { tk: null, cost: null, phs: null, failed: [], models: [] };
+  const raw = tracker?.phases;
+  const list = Array.isArray(raw)
+    ? raw
+    : raw && typeof raw === "object"
+      ? Object.entries(raw).map(([id, p]) => ({ id, ...(p ?? {}) }))
+      : null;
+  if (!list || list.length === 0) return empty;
 
   let tin = 0;
   let tout = 0;
@@ -271,7 +292,10 @@ function trackerSummary(state) {
   const phs = [];
   const failed = [];
   const models = new Set();
-  for (const [id, p] of Object.entries(tracker.phases)) {
+  let startedAt = typeof tracker?.started_at === "string" && tracker.started_at ? tracker.started_at : null;
+  let endedAt = null;
+  for (const p of list) {
+    const id = p?.id != null && String(p.id) !== "" ? String(p.id) : "?";
     if (p?.status === "failed") failed.push(id);
     if (p?.model) models.add(String(p.model));
     const pin = Number(p?.tokens_in || 0);
@@ -280,6 +304,10 @@ function trackerSummary(state) {
     tin += pin;
     tout += pout;
     tcache += pcache;
+    const ps = p?.started_at || p?.startedAt || null;
+    const pf = p?.completed_at || p?.finished_at || p?.finishedAt || null;
+    if (ps && (!startedAt || ps < startedAt)) startedAt = ps;
+    if (pf && (!endedAt || pf > endedAt)) endedAt = pf;
     phs.push({
       p: Number.isNaN(Number(id)) ? id : Number(id),
       st: p?.status || null,
@@ -300,6 +328,8 @@ function trackerSummary(state) {
     phs: phs.length ? phs : null,
     failed,
     models: Array.from(models).slice(0, 10),
+    startedAt,
+    endedAt,
   };
 }
 
@@ -312,11 +342,18 @@ function deriveErrors(state, failedPhases) {
   return Array.from(errs).slice(0, 20);
 }
 
-function durationSec(state) {
+function durationSec(state, spend) {
   const s = state.startedAt ? Date.parse(state.startedAt) : NaN;
   const f = state.finishedAt ? Date.parse(state.finishedAt) : NaN;
-  if (Number.isNaN(s) || Number.isNaN(f) || f < s) return null;
-  return Math.round((f - s) / 1000);
+  if (!Number.isNaN(s) && !Number.isNaN(f) && f >= s) {
+    return Math.round((f - s) / 1000);
+  }
+  const ts = spend?.startedAt ? Date.parse(spend.startedAt) : NaN;
+  const tf = spend?.endedAt ? Date.parse(spend.endedAt) : NaN;
+  if (!Number.isNaN(ts) && !Number.isNaN(tf) && tf >= ts) {
+    return Math.round((tf - ts) / 1000);
+  }
+  return null;
 }
 
 function runId(state) {
@@ -324,8 +361,10 @@ function runId(state) {
   return base == null ? null : String(base);
 }
 
-function eventTimestamp(state) {
-  return state.finishedAt || state.updatedAt || new Date().toISOString();
+function eventTimestamp(state, spend) {
+  if (state.finishedAt) return state.finishedAt;
+  if (isTerminalStatus(state) && spend?.endedAt) return spend.endedAt;
+  return state.updatedAt || new Date().toISOString();
 }
 
 const TERMINAL_STATUSES = ["complete", "completed", "failed", "paused", "halted", "error"];
@@ -360,8 +399,8 @@ function buildEvent(state) {
   const ctx = deriveContext(state);
   return {
     id: runId(state),
-    t: eventTimestamp(state),
-    u: state.identity?.username || null,
+    t: eventTimestamp(state, spend),
+    u: state.identity?.username || state.identity?.name || null,
     c: commandOf(state),
     m: state.mode || null,
     ap: Boolean(state.autopilot),
@@ -376,7 +415,7 @@ function buildEvent(state) {
       ? state.reviewIterations.length
       : 0,
     pr: Boolean(state.pr && (state.pr.url || state.pr.number)),
-    du: durationSec(state),
+    du: durationSec(state, spend),
     tk: spend.tk,
     cost: spend.cost,
     phs: spend.phs,
@@ -416,6 +455,7 @@ async function post(endpoint, token, event) {
 
 async function main() {
   const args = parseArgs(process.argv.slice(2));
+  if (process.env.MULTI_AGENT_SMOKE && !args.dryRun) return;
   const prefs = resolvePrefs();
   const token = resolveToken();
   const endpoint = prefs.endpoint || ENDPOINT_DEFAULT;