@mmerterden/multi-agent-pipeline 15.6.1 → 15.7.0

package/CHANGELOG.md

@@ -16,6 +16,20 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [15.7.0] - 2026-08-19
+
+### Added
+- **Setup walks missing credentials one by one**: Step 3 gained a strict sequential onboarding loop - fixed service order, one Token Save Flow prompt per service (token -> author -> host), per-service skips that never abort the loop, and `figma` / `figma_mcp` as distinct passes. The discovery summary can no longer end setup.
+- **Per-repo Jira project keys in setup**: the Jira pass closes with an optional multi-select mapping (repo -> project key) written to `prefs.projects[{slug}].jiraProjectKeys`; per-repo keys resolve before `global.defaultJiraKey` everywhere a key is needed. Re-open with `/multi-agent:setup jira-keys`.
+- **Figma MCP mode question**: the `figma_mcp` pass opens with Remote / Local. Remote generates the `figu_` OAuth token for the current user (Dynamic Client Registration + PKCE; `prefs.global.figmaMcp.remoteGeneratorScript` drives the flow when set); Local wires the PAT-based `@anthropic-ai/figma-mcp` server (`localGeneratorScript` supported). Prefs schema: new `global.figmaMcp` block plus `supabase_access` / `supabase_service_role` keychainMapping keys.
+
+### Changed
+- **Help spells out the --dev pipeline**: the Pipeline section now carries the dev chain (Phases 1-2 skipped, Review never skipped, Opus dev). Stale notes claiming Test or Review are skipped in --dev were corrected in both languages.
+- **Setup Step 5 (Repo Discovery) split to a reference**: the full contract moved to `multi-agent-refs/setup/repo-discovery.md`; the SKILL keeps the opt-in prompt and a summary.
+
+### Fixed
+- **build-stack-plugins.mjs dead import**: unused `APPLE_ONLY` import removed (superseded by the `STACK_ONLY` routing table).
+
 ## [15.6.1] - 2026-08-19
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "15.6.1",
+  "version": "15.7.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/help/SKILL.md

@@ -68,6 +68,10 @@ Pipeline (after Phase 0)  -  shown as visual cards in terminal:
 
   Autopilot always pauses at the Phase 7 channels menu (30-min timeout → session ends cleanly).
 
+  --dev pipeline (Phases 1-2 skipped; Review is NEVER skipped):
+  Init (same 8 steps), Dev with Opus, Review (same gates + triage),
+  Test (skipped in autopilot / --local), Commit + Report (menu still pauses).
+
   Every step is logged. Error in any phase -> pause -> resume to continue.
 
 ------------------------------------------------------------
@@ -80,7 +84,7 @@ Modes:
   autopilot            Skip all confirmations INCLUDING plan gate, auto commit/PR
                        (EXCEPT Phase 7 channels menu  -  always pauses)
   --dev autopilot      Fastest path
-  --local --dev        Local + fast (no worktree, no analysis/review, no plan gate)
+  --local --dev        Local + fast (no worktree, no analysis/plan gate  -  review still runs)
 
 Dedicated commands (same as flags above):
 
@@ -213,8 +217,7 @@ Design Check (mock-mode vs Figma, local-only  -  powered by dev-toolkit-mcp desi
   # "Requires a scenario / prefix / launch-arg" is not a reason; reaching those states is the run's job.
   # When a live screen has no confident Figma match, it SHOWS you the screenshot and asks for the node-id.
 
-  dev-toolkit-mcp design_* tools it drives: design_mock_detect, design_scenario_inventory, design_mock_launch,
-  design_ui_geometry, design_visual_compare, design_report (+ ios_* / android_* device control).
+  Drives the dev-toolkit-mcp design_* tool suite (+ ios_* / android_* device control).
 
 ------------------------------------------------------------
 
@@ -330,13 +333,18 @@ Pipeline (Phase 0'dan sonra)  -  terminalde görsel kart olarak görünür:
   Phase 3:   Dev        -> TDD: test -> kod -> build (Sonnet) + build queue
   Phase 4:   Review     -> Deterministik kapılar + paralel AI review + Fable triage
                           (Claude Code: Fable + Sonnet · Copilot CLI: GPT-5.4 + Opus + Sonnet)
-  Phase 5:   Test       -> Opsiyonel: branch'e geç, Xcode'da test (--dev / autopilot'ta skip)
+  Phase 5:   Test       -> Opsiyonel: branch'e geç, Xcode'da test
+                          (dev + full'de koşar; her autopilot ve local varyantında skip)
   Phase 6:   Commit     -> Commit -> push -> PR + issue body güncelleme (hiç auto-close yok)
   Phase 7:   Report     -> Channels dispatcher (PR · Jira · Confluence · Wiki, multi-select)
                           + internal capture (agent-log · knowledge · memory)
 
   Autopilot Phase 7'deki channels menüsünde HER ZAMAN durur (30 dk timeout → session temiz biter).
 
+  --dev pipeline'ı (Faz 1-2 atlanır; Review ASLA atlanmaz):
+  Init (aynı 8 adım), Dev Opus ile, Review (aynı kapılar + triage),
+  Test (autopilot / --local'de atlanır), Commit + Report (menü yine durur).
+
   Her adım loglanır. Herhangi bir fazdaki hata -> pause -> resume ile devam et.
 
 ------------------------------------------------------------
@@ -349,7 +357,7 @@ Modlar:
   autopilot            Plan gate dahil tüm onayları atla, otomatik commit/PR
                        (İSTİSNA: Phase 7 channels menüsü  -  her zaman durur)
   --dev autopilot      En hızlı yol
-  --local --dev        Local + hızlı (worktree yok, analiz/review yok, plan gate yok)
+  --local --dev        Local + hızlı (worktree yok, analiz/plan gate yok  -  review yine koşar)
 
 Dedicated komutlar (yukarıdaki flag'lerin eşdeğeri):
 
@@ -483,8 +491,7 @@ Design Check (mock-mod vs Figma, yalnızca lokal  -  dev-toolkit-mcp design_* to
   # "Senaryo / prefix / launch-arg gerektirir" gerekçe değildir; o state'lere ulaşmak koşunun işidir.
   # Canlı ekranın Figma karşılığı kesin bulunamazsa SANA screenshot'ı gösterip node-id sorar.
 
-  Sürdüğü dev-toolkit-mcp design_* tool'ları: design_mock_detect, design_scenario_inventory, design_mock_launch,
-  design_ui_geometry, design_visual_compare, design_report (+ ios_* / android_* cihaz kontrolü).
+  dev-toolkit-mcp design_* tool takımını sürer (+ ios_* / android_* cihaz kontrolü).
 
 ------------------------------------------------------------
 

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -247,7 +247,7 @@ Security notes to surface to the user: the token is **write-only** (append-only
 
 ### Step 3  -  Interactive token onboarding (for missing tokens)
 
-Git identities are NOT asked as a separate step. They are learned when tokens are added in Step 4 (Token Save Flow). Each token save triggers an identity prompt:
+Git identities are NOT asked as a separate step. They are learned when tokens are added via the Token Save Flow below. Each token save triggers an identity prompt:
 
 ```
 Token saved. Which git identity uses this token?
@@ -269,6 +269,30 @@ Token saved. Which git identity uses this token?
 
 For each MISSING service, run the **Token Save Flow** below. When creating new tokens, use the **standard key name** from Step 1b table.
 
+#### Sequential onboarding loop (strict)
+
+The Step 2 discovery summary is never the end of setup. Immediately after showing it, walk the missing services ONE BY ONE in this fixed order and run the Token Save Flow for each:
+
+1. `jira`
+2. `bitbucket_token` (then `bitbucket_user` right after, if missing)
+3. `github`
+4. `confluence`
+5. `figma`  -  Figma Personal Access Token (Tier 2, REST)
+6. `figma_mcp`  -  Figma MCP auth (Tier 1); its own prompt, never folded into the PAT prompt
+7. `fortify`
+8. `graylog`
+9. `firebase`
+10. `jenkins`
+11. App Store Connect block (Step 3b; only when the target repo is iOS)
+
+Loop rules:
+
+- **One prompt per service.** Never collapse the list into a single "add missing tokens now?" yes/no, and never offer one multi-select covering all services: each service has its own source URL, key name, identity binding and host prompt, so each gets its own Token Save Flow pass.
+- **Each service pass asks, in order: token → author → host.** Step A/B collect the secret, Step C binds the git identity (author)  -  Bitbucket and GitHub included; every saved token gets an author  -  and Step 3.5 asks the host domain inline for hosted services (jira, confluence, bitbucket, fortify, graylog). GitHub and Figma skip the host question (fixed domains); `bitbucket_user` skips author binding (username, not a PAT). Never end a service pass with the token saved but the author or a required host unasked.
+- **Skip is per-service.** A Skip answer leaves that service's `keychainMapping` at `null` and the loop continues with the next service. Skips never abort the loop.
+- **`figma` and `figma_mcp` are distinct credentials for distinct tiers  -  ask both.** Skipping the PAT does not imply skipping MCP, and vice versa. The `figma_mcp` pass opens with a Remote / Local mode question instead of a clipboard paste (see "Figma MCP Setup" below): Remote generates a `figu_` OAuth token for the current user, Local wires the PAT-based local server.
+- The loop ends only when every missing service has been asked exactly once; then continue to Step 4 (Verify all).
+
 ---
 
 ### Token Save Flow (reusable)
@@ -424,6 +448,23 @@ Default Jira project key (e.g. PROJ): ___
 
 Save to `prefs.global.defaultJiraKey`. From Jira host, derive `corpDomain` (e.g. `jira.example.com` → `example.com`) and pre-fill it so the Confluence / Bitbucket prompts only need the subdomain.
 
+`defaultJiraKey` stays a single global fallback, but one Jira host usually serves several repos with DIFFERENT project keys, so the Jira pass continues with a per-repo key mapping (multi-select, optional):
+
+```
+Per-repo Jira keys (optional)  -  repos whose project key differs from {defaultJiraKey}:
+
+  [ ] 1. my-ios-app        (current: PROJA)
+  [ ] 2. my-other-app      (current:  - )
+  ...
+
+  Toggle repos, then enter the project key for each selected repo. Enter to skip.
+```
+
+- The repo list comes from `prefs.projects` + `recentProjects` (when Step 5 already ran); a free-text repo path is accepted for repos not discovered yet.
+- Each answer is PREPENDED to `prefs.projects[{slug}].jiraProjectKeys` (deduped, max 10 per schema). Example: `my-ios-app` → `PROJA`, `my-other-app` → `PROJB`  -  two repos on the same Jira host, two different project keys.
+- Resolution order everywhere a Jira key is needed (placeholder replacement, branch names, new-issue creation): `prefs.projects[{slug}].jiraProjectKeys[0]` first, `global.defaultJiraKey` as fallback.
+- **Re-run / update**: `/multi-agent:setup jira-keys` re-opens only this mapping without touching tokens or hosts.
+
 Resulting shape:
 
 ```json
@@ -512,11 +553,8 @@ If still missing, show which ones and let user skip (pipeline will re-ask for an
 
 ### Step 5  -  Repo Discovery (optional)
 
-Pre-populates the Phase 0 project picker. Without this, every task types the repo path by hand; with this, the picker shows a curated list of repos the user has been active in.
-
-Three sources merge into one flat list. Each source is independent  -  any one failing does NOT block the others.
+Pre-populates the Phase 0 project picker with repos the user is active in. Three independent sources merge into one flat list: local `$HOME` scan (depth 3, repo markers), Bitbucket (last 90 days, token-gated), GitHub (owner + collaborator, push in last 90 days, token-gated). Any source failing skips that source only, is reported (never swallowed), and discovery is never destructive and idempotent.
 
-**Prompt:**
 ```
 Step 5  -  Repo Discovery (optional)
 Scan for recent repos now to pre-populate the Phase 0 picker?
@@ -526,103 +564,7 @@ Scan for recent repos now to pre-populate the Phase 0 picker?
   n  -  skip (Phase 0 will prompt for repo path manually)
 ```
 
-**7a. Local scan**  -  `$HOME` depth-3, repo markers
-
-```bash
-find "$HOME" -maxdepth 3 -type d -name ".git" 2>/dev/null | while read gitdir; do
-  repo_dir="$(dirname "$gitdir")"
-  origin="$(git -C "$repo_dir" config --get remote.origin.url 2>/dev/null)"
-  last="$(git -C "$repo_dir" log -1 --format=%cI 2>/dev/null)"
-  printf '%s\t%s\t%s\n' "$repo_dir" "$origin" "$last"
-done
-```
-
-Auxiliary markers (recorded but not required): `*.xcworkspace`, `*.xcodeproj`, `Podfile`, `Package.swift`, `package.json`, `pom.xml`, `build.gradle`. Their presence tags the repo as iOS/macOS, Cocoapods, SPM, Node, Maven, Gradle in the picker.
-
-**7b. Bitbucket scan**  -  last 90 days active
-
-Runs only if `keychainMapping.bitbucket_token` is non-null AND `serviceStatus.bitbucket.ok === true` (or cache older than `settings.serviceStatusCacheSeconds`, re-ping first).
-
-Bitbucket Data Center (self-hosted)  -  the host comes from `prefs.global.bitbucketHost` (or prompts once if unset; NEVER hardcoded):
-```bash
-BB_HOST="$(jq -r '.global.bitbucketHost // empty' "$PREFS_FILE")"
-BB_USER="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_user' "$PREFS_FILE")" 2>/dev/null)"
-BB_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_token' "$PREFS_FILE")" 2>/dev/null)"
-CUTOFF_MS=$(( ( $(date +%s) - 7776000 ) * 1000 ))   # 90 days
-curl -sfS -u "$BB_USER:$BB_TOK" \
-  "https://${BB_HOST}/rest/api/1.0/repos?permission=REPO_WRITE&limit=200" \
-  | jq -r --argjson cutoff "$CUTOFF_MS" '
-      .values[] | select((.updatedDate // 0) >= $cutoff) |
-      { slug: "\(.project.key)/\(.slug)", clone: (.links.clone[] | select(.name=="http") | .href) }'
-```
-
-Bitbucket Cloud  -  swap to `https://api.bitbucket.org/2.0/repositories/{workspace}?role=member&sort=-updated_on`.
-
-**7c. GitHub scan**  -  owner + collaborator, push in last 90 days
-
-Runs only if `keychainMapping.github` is non-null AND `serviceStatus.github.ok === true`.
-
-```bash
-GH_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.github' "$PREFS_FILE")" 2>/dev/null)"
-CUTOFF_ISO="$(date -u -v-90d +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%SZ)"
-# gh CLI path (preferred when available)
-gh api --paginate 'user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100' \
-  -q ".[] | select(.pushed_at > \"$CUTOFF_ISO\") | {full: .full_name, clone: .clone_url}"
-# Fallback without gh:
-curl -sfS -H "Authorization: Bearer $GH_TOK" \
-  'https://api.github.com/user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100'
-```
-
-**7d. Merge by origin URL**
-
-Normalize clone URLs (strip `git@`, `https://`, trailing `.git`) to a canonical `host/owner/repo` key. Deduplicate:
-- Local + remote match on canonical key → single entry with `path = <local>`, `platform = <remote source>`.
-- Remote-only match → entry with `path: null` (user clones on first use from Phase 0).
-- Local-only (no remote clone URL matches) → kept as-is, `platform: "local"`.
-
-**7e. Multi-select picker**
-
-```
-Discovered 24 active repos (local + remote ≤ 90 days):
-
-  [ ]  1. Booking               ~/dev/Booking              bitbucket   iOS · SPM
-  [ ]  2. UIComponents          ~/dev/UIComponents         bitbucket   iOS · SPM
-  [ ]  3. multi-agent-pipeline  ~/multi-agent-pipeline     github      Node
-  [ ]  4. dotfiles              (not cloned)               github       - 
-  [ ]  5. backend-services      ~/work/backend-services    bitbucket   Maven
-  ...
-
-  Toggle with numbers (e.g. "1 3 4"), 'all', 'none', or Enter to skip.
-  Selected repos become defaults in the Phase 0 project picker.
-```
-
-**7f. Save to preferences**
-
-```json
-{
-  "global": {
-    "recentProjects": [
-      {"path": "~/dev/Booking",            "label": "Booking",            "lastUsed": "2026-04-15T21:08:00Z"},
-      {"path": "~/dev/UIComponents",       "label": "UIComponents",       "lastUsed": "2026-04-15T21:08:00Z"},
-      {"path": "~/multi-agent-pipeline",   "label": "multi-agent-pipeline","lastUsed": "2026-04-15T21:08:00Z"}
-    ],
-    "serviceStatus": {
-      "bitbucket": {"ok": true, "checkedAt": "2026-04-15T21:08:00Z"},
-      "github":    {"ok": true, "checkedAt": "2026-04-15T21:08:00Z"}
-    }
-  }
-}
-```
-
-Entries are objects (not bare strings). The schema `recentProjects.items` is a `oneOf`  -  both shapes validate, but v2.1.0 writes objects so `lastUsed` + `label` are first-class.
-
-**7g. Skip / degrade rules**
-
-- Source failure (network, VPN, 401, rate-limit) skips that source; the others still run. Failure is recorded in `serviceStatus.{service} = { ok: false, checkedAt: <now>, reason: <short> }` so Phase 0 can also read that cache.
-- **Report the skip, do not swallow it.** Setup is where the user is actively configuring things, so a source that could not be reached is exactly what they need to hear about, and the reason decides their next move: a 401 means refresh that token, no response at all on a corporate host means connect the VPN, and a missing `global.hosts.<service>` means the token has nowhere to point. Print one line per skipped source with its classification (see `refs/keychain.md` Rule 2) before moving on. A discovery pass that quietly returned three repos out of forty reads as "you only have three repos".
-- If all three sources yield zero hits, Step 5 is a no-op  -  the picker in Phase 0 falls back to manual path entry.
-- Discovery is **never destructive**: it never modifies git state, never writes outside `PREFS_FILE`.
-- Step 5 is idempotent. Re-running it refreshes `recentProjects` and `serviceStatus` but preserves user-curated entries unless explicitly deselected.
+The scan commands, merge-by-origin dedup, the multi-select picker, the `recentProjects` / `serviceStatus` prefs shapes and the skip / degrade rules live in `$HOME/.claude/multi-agent-refs/setup/repo-discovery.md`  -  read that file when the user opts in.
 
 ### Step 6  -  Remember as Multi-Repo Group (optional)
 
@@ -801,23 +743,33 @@ For maximum stdin hygiene (the secret never lands on argv / shell history), use
 pbpaste | ~/.claude/scripts/keychain.py set "<SERVICE_NAME>" -
 ```
 
-### Figma MCP Setup (optional)
+### Figma MCP Setup (Remote / Local question)
+
+The `figma_mcp` pass of the Step 3 loop opens with a mode question BEFORE any token is collected:
 
-Figma MCP works in two modes:
+```
+Figma MCP mode?
 
-**Remote MCP** (Claude Code built-in):
-- Automatic  -  comes as `claude_ai_Figma` in Claude Code settings.json
-- If token renewal needed: re-auth from within Claude Code
+  [1] Remote  -  mcp.figma.com, OAuth token (figu_)  (recommended)
+  [2] Local   -  @anthropic-ai/figma-mcp via npx, uses the Figma PAT
+```
 
-**Local MCP** (@anthropic-ai/figma-mcp package, with PAT):
+**Remote** (`figu_` OAuth token  -  generate it FOR the current user, never just point at docs):
+- No OAuth app and no client_id/secret needed: Dynamic Client Registration against `api.figma.com/v1/oauth/mcp/register` + PKCE, the browser opens, the user clicks Allow, and the resulting access + refresh token pair is saved to the credential store under a name the user confirms. Map that entry to `keychainMapping.figma_mcp` (Token Save Flow Step D applies as usual).
+- If `prefs.global.figmaMcp.remoteGeneratorScript` is set, run that script  -  it drives the whole flow end to end (registration, browser, keychain save) for the current user. Otherwise guide the flow inline.
+- Renewal is silent afterwards via `$HOME/.claude/lib/figma-mcp-refresh.sh` (refresh token). Never echo token values.
+
+**Local** (PAT-based):
+- Validates the Figma PAT against the REST API, saves it to the credential store (reusing the `figma` mapping when present), and writes the `@anthropic-ai/figma-mcp` server block into Claude Code `settings.json` `mcpServers`:
 ```bash
-# 1. Save PAT to keychain (stdin sentinel keeps the value out of shell history)
+# stdin sentinel keeps the value out of shell history
 pbpaste | ~/.claude/scripts/keychain.py set "${USER}_Figma_Access_Token" -
 pbcopy < /dev/null
-
-# 2. Add MCP to Claude Code settings.json
-# ~/.claude/settings.json -> mcpServers -> figma
+# then: ~/.claude/settings.json -> mcpServers -> figma
 ```
+- If `prefs.global.figmaMcp.localGeneratorScript` is set, run that script instead.
+
+Choosing Remote does NOT skip the `figma` PAT pass (Tier 2 still uses the PAT); choosing Local leaves `keychainMapping.figma_mcp` null and Tier 1 unavailable until Remote is onboarded.
 
 ### Security Rules
 
@@ -850,7 +802,7 @@ To set up multi-agent on a new machine:
    /multi-agent "bug description"
 ```
 
-All tokens are optional  -  pipeline will ask for any needed token at Phase 0. Setup only does pre-preparation.
+All tokens are optional in the sense that every service can be answered with Skip  -  but the ASKING is not optional: the Step 3 sequential loop still walks every missing service one by one (token → author → host). Phase 0 re-asks at runtime only for tokens the user skipped here.
 
 ### Step 8  -  Enforcement hook (optional, Claude Code)
 

package/pipeline/multi-agent-refs/setup/repo-discovery.md

@@ -0,0 +1,116 @@
+# Setup Step 5  -  Repo Discovery (full contract)
+
+> Split out of `setup/SKILL.md` (token budget). The SKILL keeps the opt-in prompt and a summary; this file carries the scan commands, merge rules, picker, prefs shapes and skip / degrade rules. Read it when the user opts into repo discovery.
+
+Pre-populates the Phase 0 project picker. Without this, every task types the repo path by hand; with this, the picker shows a curated list of repos the user has been active in.
+
+Three sources merge into one flat list. Each source is independent  -  any one failing does NOT block the others.
+
+**Prompt:**
+```
+Step 5  -  Repo Discovery (optional)
+Scan for recent repos now to pre-populate the Phase 0 picker?
+
+  y  -  all three (local + Bitbucket + GitHub, ~10-30s)
+  l  -  local scan only (fastest, no network)
+  n  -  skip (Phase 0 will prompt for repo path manually)
+```
+
+**7a. Local scan**  -  `$HOME` depth-3, repo markers
+
+```bash
+find "$HOME" -maxdepth 3 -type d -name ".git" 2>/dev/null | while read gitdir; do
+  repo_dir="$(dirname "$gitdir")"
+  origin="$(git -C "$repo_dir" config --get remote.origin.url 2>/dev/null)"
+  last="$(git -C "$repo_dir" log -1 --format=%cI 2>/dev/null)"
+  printf '%s\t%s\t%s\n' "$repo_dir" "$origin" "$last"
+done
+```
+
+Auxiliary markers (recorded but not required): `*.xcworkspace`, `*.xcodeproj`, `Podfile`, `Package.swift`, `package.json`, `pom.xml`, `build.gradle`. Their presence tags the repo as iOS/macOS, Cocoapods, SPM, Node, Maven, Gradle in the picker.
+
+**7b. Bitbucket scan**  -  last 90 days active
+
+Runs only if `keychainMapping.bitbucket_token` is non-null AND `serviceStatus.bitbucket.ok === true` (or cache older than `settings.serviceStatusCacheSeconds`, re-ping first).
+
+Bitbucket Data Center (self-hosted)  -  the host comes from `prefs.global.bitbucketHost` (or prompts once if unset; NEVER hardcoded):
+```bash
+BB_HOST="$(jq -r '.global.bitbucketHost // empty' "$PREFS_FILE")"
+BB_USER="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_user' "$PREFS_FILE")" 2>/dev/null)"
+BB_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_token' "$PREFS_FILE")" 2>/dev/null)"
+CUTOFF_MS=$(( ( $(date +%s) - 7776000 ) * 1000 ))   # 90 days
+curl -sfS -u "$BB_USER:$BB_TOK" \
+  "https://${BB_HOST}/rest/api/1.0/repos?permission=REPO_WRITE&limit=200" \
+  | jq -r --argjson cutoff "$CUTOFF_MS" '
+      .values[] | select((.updatedDate // 0) >= $cutoff) |
+      { slug: "\(.project.key)/\(.slug)", clone: (.links.clone[] | select(.name=="http") | .href) }'
+```
+
+Bitbucket Cloud  -  swap to `https://api.bitbucket.org/2.0/repositories/{workspace}?role=member&sort=-updated_on`.
+
+**7c. GitHub scan**  -  owner + collaborator, push in last 90 days
+
+Runs only if `keychainMapping.github` is non-null AND `serviceStatus.github.ok === true`.
+
+```bash
+GH_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.github' "$PREFS_FILE")" 2>/dev/null)"
+CUTOFF_ISO="$(date -u -v-90d +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%SZ)"
+# gh CLI path (preferred when available)
+gh api --paginate 'user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100' \
+  -q ".[] | select(.pushed_at > \"$CUTOFF_ISO\") | {full: .full_name, clone: .clone_url}"
+# Fallback without gh:
+curl -sfS -H "Authorization: Bearer $GH_TOK" \
+  'https://api.github.com/user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100'
+```
+
+**7d. Merge by origin URL**
+
+Normalize clone URLs (strip `git@`, `https://`, trailing `.git`) to a canonical `host/owner/repo` key. Deduplicate:
+- Local + remote match on canonical key → single entry with `path = <local>`, `platform = <remote source>`.
+- Remote-only match → entry with `path: null` (user clones on first use from Phase 0).
+- Local-only (no remote clone URL matches) → kept as-is, `platform: "local"`.
+
+**7e. Multi-select picker**
+
+```
+Discovered 24 active repos (local + remote ≤ 90 days):
+
+  [ ]  1. Booking               ~/dev/Booking              bitbucket   iOS · SPM
+  [ ]  2. UIComponents          ~/dev/UIComponents         bitbucket   iOS · SPM
+  [ ]  3. multi-agent-pipeline  ~/multi-agent-pipeline     github      Node
+  [ ]  4. dotfiles              (not cloned)               github       - 
+  [ ]  5. backend-services      ~/work/backend-services    bitbucket   Maven
+  ...
+
+  Toggle with numbers (e.g. "1 3 4"), 'all', 'none', or Enter to skip.
+  Selected repos become defaults in the Phase 0 project picker.
+```
+
+**7f. Save to preferences**
+
+```json
+{
+  "global": {
+    "recentProjects": [
+      {"path": "~/dev/Booking",            "label": "Booking",            "lastUsed": "2026-04-15T21:08:00Z"},
+      {"path": "~/dev/UIComponents",       "label": "UIComponents",       "lastUsed": "2026-04-15T21:08:00Z"},
+      {"path": "~/multi-agent-pipeline",   "label": "multi-agent-pipeline","lastUsed": "2026-04-15T21:08:00Z"}
+    ],
+    "serviceStatus": {
+      "bitbucket": {"ok": true, "checkedAt": "2026-04-15T21:08:00Z"},
+      "github":    {"ok": true, "checkedAt": "2026-04-15T21:08:00Z"}
+    }
+  }
+}
+```
+
+Entries are objects (not bare strings). The schema `recentProjects.items` is a `oneOf`  -  both shapes validate, but v2.1.0 writes objects so `lastUsed` + `label` are first-class.
+
+**7g. Skip / degrade rules**
+
+- Source failure (network, VPN, 401, rate-limit) skips that source; the others still run. Failure is recorded in `serviceStatus.{service} = { ok: false, checkedAt: <now>, reason: <short> }` so Phase 0 can also read that cache.
+- **Report the skip, do not swallow it.** Setup is where the user is actively configuring things, so a source that could not be reached is exactly what they need to hear about, and the reason decides their next move: a 401 means refresh that token, no response at all on a corporate host means connect the VPN, and a missing `global.hosts.<service>` means the token has nowhere to point. Print one line per skipped source with its classification (see `refs/keychain.md` Rule 2) before moving on. A discovery pass that quietly returned three repos out of forty reads as "you only have three repos".
+- If all three sources yield zero hits, Step 5 is a no-op  -  the picker in Phase 0 falls back to manual path entry.
+- Discovery is **never destructive**: it never modifies git state, never writes outside `PREFS_FILE`.
+- Step 5 is idempotent. Re-running it refreshes `recentProjects` and `serviceStatus` but preserves user-curated entries unless explicitly deselected.
+

package/pipeline/schemas/prefs.schema.json

@@ -123,7 +123,7 @@
         "keychainMapping": {
           "type": "object",
           "additionalProperties": false,
-          "description": "Maps logical token names to actual Keychain item names. Pipeline looks up tokens via `security find-generic-password -s <mapped-name>` (or `pipeline/lib/credential-store.sh get` cross-platform). Covered keys: jira, bitbucket, bitbucket_token, bitbucket_user, github, confluence, figma, figma_mcp, fortify, graylog, firebase, jenkins, npm, claude_oauth_token, claude_oauth_token_fallback. Deprecated and accepted only for backward compatibility: figma_pat (superseded by figma), figma_user (unused).",
+          "description": "Maps logical token names to actual Keychain item names. Pipeline looks up tokens via `security find-generic-password -s <mapped-name>` (or `pipeline/lib/credential-store.sh get` cross-platform). Covered keys: jira, bitbucket, bitbucket_token, bitbucket_user, github, confluence, figma, figma_mcp, fortify, graylog, firebase, jenkins, npm, claude_oauth_token, claude_oauth_token_fallback, supabase_access, supabase_service_role. Deprecated and accepted only for backward compatibility: figma_pat (superseded by figma), figma_user (unused).",
           "properties": {
             "jira": {
               "type": [
@@ -188,6 +188,20 @@
                 "null"
               ]
             },
+            "supabase_access": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Supabase personal access token (Management API). Used by personal-site tooling; not consumed by pipeline phases."
+            },
+            "supabase_service_role": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Supabase service_role key for the personal-site project. Server-side only; never shipped to a client."
+            },
             "usage_ingest": {
               "type": [
                 "string",
@@ -621,6 +635,27 @@
           ],
           "description": "Default Jira project key used for placeholder replacement. null until /multi-agent:setup onboards a Jira project."
         },
+        "figmaMcp": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "remoteGeneratorScript": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Local-only path to a script that generates the remote MCP OAuth token (figu_) via Dynamic Client Registration + PKCE and saves it to the credential store. Run by the setup figma_mcp pass when the user picks Remote. Personal paths stay in prefs; never embedded in synced files."
+            },
+            "localGeneratorScript": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Local-only path to a script that validates the Figma PAT and wires the PAT-based local MCP server (@anthropic-ai/figma-mcp) into Claude Code settings.json. Run by the setup figma_mcp pass when the user picks Local."
+            }
+          },
+          "description": "Figma MCP onboarding helpers for /multi-agent:setup. Both fields optional; when unset the setup flow guides the token generation inline."
+        },
         "modelFallback": {
           "type": "object",
           "additionalProperties": false,

package/pipeline/scripts/build-stack-plugins.mjs

@@ -55,7 +55,6 @@ const DRY = args.includes("--dry-run");
 import {
   COMMON_PLUGIN,
   COMMON_SKILLS,
-  APPLE_ONLY,
   STACK_ONLY,
   STACK_PATTERNS,
 } from "./_stack-routing.mjs";