@mmerterden/multi-agent-pipeline 15.8.1 → 15.9.1

package/CHANGELOG.md

@@ -16,6 +16,24 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [15.9.1] - 2026-08-20
+
+### Changed
+- **Telemetry logs the GitHub account name, never the git `identity.name`.** The reporter resolved the run's user to `identity.username || identity.name`, and since prefs identities carried no `username`, it fell back to `identity.name` - which can be a full corporate title/brand string, landing verbatim in the usage store. It now resolves to the identity's GitHub username, then the active `gh` account login resolved live, then null; the git `identity.name` is no longer a fallback. Self-registration (`/multi-agent:update` step 5b) resolves the same way.
+
+## [15.9.0] - 2026-08-20
+
+### Fixed
+- **Telemetry emitter and run scripts: 21 verified defects from a refactor bug hunt.** The emitter now reads `usageLog.optOut` as a hard block, refuses non-TLS endpoints so the write-only token never travels in cleartext, resolves the credential store and version marker across all host trees (Copilot/Codex-only installs), prices each phase at its own model rate instead of opus-for-all, keeps hyphenated MCP server names, drops plugins mapped to `false`, and gates before touching the keychain. `phase-tracker.sh` uses a per-process temp file so the fail-open lock cannot publish a torn state, honors `$TRACKER_FILE` on init, and builds OTEL attrs with jq. `build-stack-plugins.mjs` aborts on a flag given without a value and reports content-only changes in `--dry-run`; `localize-commands.mjs` is Windows- and CRLF-safe; `account-resolver.sh`, `channels-multi-repo.sh` and `figma-mcp-refresh.sh` gaps closed. Covered by `test/usage-report.test.mjs`.
+
+### Changed
+- **`purge` and `uninstall` are no longer model-auto-invocable** (`disable-model-invocation: true`): the two irreversible, full-data-loss commands run only on an explicit user request.
+- **`humanizer` skill (v1.1.0):** a self-critique pass re-verifies the rewrite against the original (meaning preserved, nothing invented, patterns actually gone); trailing-participle and connective-padding patterns added.
+- Stale version tables refreshed: `SECURITY.md` supported-versions moves to the 15.x line; `ROADMAP.md` "Current Release" becomes a rolling "Recent Releases".
+
+### Companion
+- **`dev-toolkit-mcp` v2.26.0** (shipped alongside): CallTool boundary now validates arguments against each tool's inputSchema (lenient-but-safe), closing the command-injection class where a string reached a numeric shell interpolation; every caller-derived path is single-quoted; a new gate backstops it. Backward-compatible, 83 tools unchanged.
+
 ## [15.8.1] - 2026-08-19
 
 ### Fixed

package/SECURITY.md

@@ -6,9 +6,9 @@ We provide security fixes for the latest minor of the current major. Older versi
 
 | Version | Supported              |
 | ------- | ---------------------- |
-| 12.x    | ✅ active              |
-| 11.x    | ⚠️ security fixes only |
-| ≤ 10.x  | ❌ end-of-life         |
+| 15.x    | ✅ active              |
+| 14.x    | ⚠️ security fixes only |
+| ≤ 13.x  | ❌ end-of-life         |
 
 ## Reporting a Vulnerability
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "15.8.1",
+  "version": "15.9.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/purge/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "⚠️ Wipes every worktree, branch, log, and state file. Irreversible; asks for double confirmation. Use when every worktree, branch, log and state file should be wiped and the pipeline reset."
+disable-model-invocation: true
 description-tr: "⚠️ Tüm worktree, branch, log ve state dosyalarını siler. Geri alınamaz; çift onay ister."
 ---
 

package/pipeline/commands/multi-agent/uninstall/SKILL.md

@@ -1,5 +1,6 @@
 ---
 description: "Uninstall the pipeline from Claude Code + Copilot CLI. Keychain access tokens are always left untouched; --all-data also clears pipeline settings and logs. Asks for double confirmation. Use when the pipeline should be removed from Claude Code and Copilot CLI."
+disable-model-invocation: true
 description-tr: "Pipeline'ı Claude Code + Copilot CLI'dan kaldırır. Keychain erişim token'larına asla dokunulmaz; --all-data ayrıca pipeline ayarlarını ve loglarını da siler. Çift onay ister."
 argument-hint: "[--dry-run] [--all-data] [--claude] [--copilot] [--target=<path>]"
 ---

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -104,7 +104,11 @@ A git clone of the pipeline repo is a maintainer workspace, kept in sync by `/mu
        if [ -z "$TOK" ]; then
          EP=$(jq -r '.global.usageLog.endpoint // "https://mmerterden.vercel.app/api/usage/ingest"' "$PREFS" 2>/dev/null)
          REG_EP="${EP%/ingest}/register"
-         RUSER=$(jq -r '.global.identities[0].username // .global.identities[0].name // empty' "$PREFS" 2>/dev/null)
+         # Telemetry identity is the GitHub account name, never the git
+         # identity.name (which can carry a corporate title). username -> live
+         # gh login -> OS user.
+         RUSER=$(jq -r '.global.identities[0].username // empty' "$PREFS" 2>/dev/null)
+         [ -z "$RUSER" ] && RUSER=$(gh api user --jq .login 2>/dev/null || echo "")
          [ -z "$RUSER" ] && RUSER="$USER"
          RESP=$(curl -sSL -m 10 -X POST -H "Content-Type: application/json" \
            --data "{\"u\":\"$RUSER\",\"c\":\"$(hostname -s 2>/dev/null || echo unknown)\"}" \

package/pipeline/lib/account-resolver.sh

@@ -25,7 +25,10 @@ FILTER=""
 while [ $# -gt 0 ]; do
   case "$1" in
     --pretty) PRETTY=1; shift ;;
-    --providers) FILTER="${2:-}"; shift 2 ;;
+    # `shift 2` on a trailing `--providers` (no value) fails under `set -e` and
+    # aborts silently. Consume one at a time so a missing value is an empty
+    # filter, not a crash.
+    --providers) FILTER="${2:-}"; shift; [ $# -gt 0 ] && shift ;;
     *) shift ;;
   esac
 done
@@ -97,9 +100,18 @@ prefixes=$(printf '%s\n' "$services" \
   | sed -E 's/_(Github|Jira|Bitbucket|Confluence)_.+$//' \
   | sort -u)
 
+# Escape ERE metacharacters so a prefix/provider is matched literally. Without
+# this a prefix containing `.` matched any character (acme.corp cross-matched
+# acmexcorp, mis-associating one account's keychain with another), and a `[`
+# made grep error out - swallowed by `|| true`, so the provider silently vanished.
+re_escape() {
+  printf '%s' "$1" | sed 's/[][\\.^$*+?(){}|]/\\&/g'
+}
+
 # Helper: given a prefix and provider keyword, find the matching token service (or "").
 find_token_for() {
-  local prefix="$1" provider="$2"
+  local prefix; prefix="$(re_escape "$1")"
+  local provider; provider="$(re_escape "$2")"
   printf '%s\n' "$services" \
     | grep -E "^${prefix}_${provider}_.*(Token|Json|Auth)$" \
     | head -n1 || true
@@ -107,7 +119,8 @@ find_token_for() {
 
 # Helper: given a prefix and provider keyword, find the username service entry (or "").
 find_user_key_for() {
-  local prefix="$1" provider="$2"
+  local prefix; prefix="$(re_escape "$1")"
+  local provider; provider="$(re_escape "$2")"
   printf '%s\n' "$services" \
     | grep -E "^${prefix}_${provider}_Username$" \
     | head -n1 || true

package/pipeline/lib/channels-multi-repo.sh

@@ -88,11 +88,11 @@ all_urls = []
 for p in projects:
     pr = p.get("pr") or {}
     if pr.get("url"):
-        all_urls.append({"repo": p["project"], "url": pr["url"]})
+        all_urls.append({"repo": p.get("project") or "", "url": pr["url"]})
 
 out = []
 for p in projects:
-    name = p["project"]
+    name = p.get("project") or ""
     pr = p.get("pr") or {}
     is_primary = (name == primary_name)
     cross = [u for u in all_urls if u["repo"] != name]
@@ -134,11 +134,11 @@ primary_name = state.get("project") or projects[0].get("project")
 is_primary = (repo == primary_name)
 links = []
 for p in projects:
-    if p["project"] == repo:
+    if (p.get("project") or "") == repo:
         continue
     pr = p.get("pr") or {}
     if pr.get("url"):
-        label = "Part of" if not is_primary and p["project"] == primary_name else "Related"
+        label = "Part of" if not is_primary and (p.get("project") or "") == primary_name else "Related"
         links.append(f"{label}: {pr['url']}")
 
 if not links:
@@ -207,7 +207,7 @@ if len(projects) <= 1:
     print("single-repo task")
     sys.exit(0)
 primary_name = state.get("project") or projects[0].get("project")
-extras = [p for p in projects if p["project"] != primary_name]
+extras = [p for p in projects if (p.get("project") or "") != primary_name]
 extra_urls = [(p.get("pr") or {}).get("url") or f"<no-pr:{p['project']}>" for p in extras]
 print(f"1 primary ({primary_name}) + {len(extras)} extras: {' '.join(extra_urls)}")
 PY

package/pipeline/lib/figma-mcp-refresh.sh

@@ -92,6 +92,14 @@ NEW_REFRESH=$(printf '%s' "$RESPONSE" | jq -r '.refresh_token // empty' 2>/dev/n
 EXPIRES_IN=$(printf '%s' "$RESPONSE" | jq -r '.expires_in // "?"' 2>/dev/null || true)
 
 if [ -z "$NEW_ACCESS" ]; then
+  # Distinguish a transient network failure (empty body) from an actual rejection
+  # (body carries .error): the first is retryable and must NOT tell the user to
+  # regenerate a credential that is still valid. Exit 2 = prerequisite/transient,
+  # exit 1 = the grant was genuinely rejected.
+  if [ -z "$RESPONSE" ]; then
+    say "figma-mcp-refresh: no response from token endpoint (network/timeout)  -  retry; the credential is unchanged"
+    exit 2
+  fi
   ERR=$(printf '%s' "$RESPONSE" | jq -r '.error // .message // "unknown"' 2>/dev/null || echo "unknown")
   say "figma-mcp-refresh: refresh grant rejected ($ERR)  -  regenerate via tokenScripts.figma_mcp"
   exit 1
@@ -106,13 +114,17 @@ save_keychain_secret() {
   printf '%s' "$secret" | "$CRED_STORE" set "$service" - >/dev/null
 }
 
-# Save new access token first, then the rotated refresh token  -  order matters so a
-# mid-write failure never leaves us with a lost refresh token AND a stale access token.
-save_keychain_secret "$KEY_NAME" "$NEW_ACCESS"
-
+# Save the rotated REFRESH token first, then the access token. The grant at the
+# curl above already invalidated the old refresh token server-side, so the
+# rotated one is the only key that can renew again; if the access-token write
+# then failed we would still hold a working refresh token and recover on the
+# next run. The reverse order (access first) risked persisting access while
+# losing the rotated refresh - a permanent dead end needing a full regenerate.
 if [ -n "$NEW_REFRESH" ]; then
   save_keychain_secret "$REFRESH_KEY" "$NEW_REFRESH"
 fi
 
+save_keychain_secret "$KEY_NAME" "$NEW_ACCESS"
+
 say "figma-mcp-refresh: renewed '$KEY_NAME' (expires_in=${EXPIRES_IN}s, refresh $( [ -n "$NEW_REFRESH" ] && echo rotated || echo unchanged ))"
 exit 0

package/pipeline/schemas/prefs.schema.json

@@ -1136,7 +1136,7 @@
             },
             "endpoint": {
               "type": "string",
-              "description": "Ingest URL that receives the run record. The token is sent in the X-Usage-Token header."
+              "description": "Ingest URL that receives the run record. The write-only token rides in the X-Usage-Token header, so the emitter sends ONLY over https (or http on 127.0.0.1/localhost for local dev); any other http endpoint is refused before the token is read."
             },
             "token": {
               "type": "string",

package/pipeline/scripts/build-stack-plugins.mjs

@@ -44,9 +44,25 @@ const getArg = (k, d) => {
   const eq = args.find((a) => a.startsWith(`${k}=`));
   if (eq) return eq.slice(k.length + 1);
   const i = args.indexOf(k);
-  return i >= 0 && args[i + 1] && !args[i + 1].startsWith("--") ? args[i + 1] : d;
+  if (i < 0) return d;
+  // The flag is present. A missing/typo'd value must ABORT, never fall through
+  // to the default: the default is the user's real marketplace and the next
+  // step does a destructive rmSync+cpSync there. The space form used to have the
+  // same silent-retarget bug the `=` form was already fixed for.
+  const v = args[i + 1];
+  if (!v || v.startsWith("--")) {
+    console.error(`ERROR: ${k} was given without a value. Pass ${k}=<path> or ${k} <path>.`);
+    process.exit(2);
+  }
+  return v;
 };
-const HOME = process.env.HOME;
+// HOME is unset on Windows (USERPROFILE is the variable); fall back so join()
+// gets a string instead of throwing a raw TypeError before any diagnostic.
+const HOME = process.env.HOME || process.env.USERPROFILE;
+if (!HOME) {
+  console.error("ERROR: neither HOME nor USERPROFILE is set; cannot resolve default paths.");
+  process.exit(2);
+}
 const PLUGINS_REPO = getArg("--plugins-repo", join(HOME, "multi-agent-plugins"));
 const PIPE_ROOT = getArg("--pipeline", join(HOME, "multi-agent-pipeline"));
 const EXTERNAL = join(PIPE_ROOT, "pipeline/skills/shared/external");
@@ -204,17 +220,24 @@ for (const [plugin, want] of Object.entries(desired)) {
   // REMOVED inside a still-wanted skill survived in every plugin copy forever -
   // and because the overlay kept the orphan on both sides of the fingerprint
   // comparison, the version was not bumped either.
+  // Detect content drift in BOTH modes so --dry-run (the pre-flight for a
+  // destructive run) reports the same "would change" verdict a real run acts on.
+  // Previously contentChanged was computed only inside `if (!DRY)`, so dry-run
+  // was blind to a file edit that did not change set membership - exactly the
+  // case the fingerprint machinery was added to catch.
+  if (!DRY && !existsSync(kdir)) mkdirSync(kdir, { recursive: true });
   let contentChanged = false;
-  if (!DRY) {
-    if (!existsSync(kdir)) mkdirSync(kdir, { recursive: true });
-    for (const s of want) {
-      const from = join(EXTERNAL, s);
-      const to = join(kdir, s);
-      if (treeFingerprint(from) === (existsSync(to) ? treeFingerprint(to) : "")) continue;
+  for (const s of want) {
+    const from = join(EXTERNAL, s);
+    const to = join(kdir, s);
+    if (treeFingerprint(from) === (existsSync(to) ? treeFingerprint(to) : "")) continue;
+    contentChanged = true;
+    if (!DRY) {
       rmSync(to, { recursive: true, force: true });
       cpSync(from, to, { recursive: true });
-      contentChanged = true;
     }
+  }
+  if (!DRY) {
     for (const s of toRemove) rmSync(join(kdir, s), { recursive: true, force: true });
   }
   const changed = setChanged || contentChanged;

package/pipeline/scripts/localize-commands.mjs

@@ -25,6 +25,7 @@
 
 import { readFileSync, writeFileSync, readdirSync, existsSync, statSync } from "fs";
 import { join } from "path";
+import { pathToFileURL } from "url";
 
 const DESC = /^description:[ \t]*(.*)$/;
 const DESC_TR = /^description-tr:[ \t]*(.*)$/;
@@ -38,7 +39,11 @@ const DESC_EN = /^description-en:[ \t]*(.*)$/;
  */
 export function localizeFile(file, mode) {
   const original = readFileSync(file, "utf-8");
-  const lines = original.split("\n");
+  // CRLF-safe: a checkout with \r\n line endings made lines[0] === "---\r", so
+  // every file was skipped and the run reported "0 changed" as success. Split on
+  // either ending and preserve whichever this file uses when writing back.
+  const eol = original.includes("\r\n") ? "\r\n" : "\n";
+  const lines = original.split(/\r?\n/);
   // Only operate inside the first frontmatter block.
   if (lines[0] !== "---") return false;
   const end = lines.indexOf("---", 1);
@@ -70,7 +75,7 @@ export function localizeFile(file, mode) {
     lines[descIdx] = `description: ${enValue}`;
     lines.splice(enIdx, 1);
   }
-  const next = lines.join("\n");
+  const next = lines.join(eol);
   if (next === original) return false;
   writeFileSync(file, next);
   return true;
@@ -107,8 +112,12 @@ export function localizeCommands(dir, mode) {
   return changed;
 }
 
+// Windows-safe entry-point check: compare file URLs. The old
+// `.split("/").pop()` never split a backslash path, so on Windows this was
+// always false - `restore` exited 0 doing nothing and /multi-agent:sync then
+// mirrored localized descriptions into the repo, the one thing it must prevent.
 const invokedDirectly =
-  process.argv[1] && import.meta.url.endsWith(process.argv[1].split("/").pop());
+  process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
 if (invokedDirectly) {
   const args = process.argv.slice(2);
   const mode = args[0];

package/pipeline/scripts/phase-tracker.sh

@@ -73,6 +73,11 @@ ACTION="$1"; shift
 
 # State file location.
 TRACKER_FILE="${TRACKER_FILE:-}"
+# Record whether the caller supplied the path so `init` honors it too (the init
+# branch used to overwrite it unconditionally, so a test setting TRACKER_FILE to
+# a temp path still had init clobber the real ~/.claude pointer and tree).
+TRACKER_FILE_FROM_ENV=0
+[ -n "$TRACKER_FILE" ] && TRACKER_FILE_FROM_ENV=1
 if [ -z "$TRACKER_FILE" ]; then
   TASK_ID_FROM_ENV="${MULTI_AGENT_TASK_ID:-}"
   if [ "$ACTION" = "init" ] && [ "$#" -ge 1 ]; then
@@ -125,9 +130,20 @@ usage_live_ping() {
   # a test gate must not leave phantom "running" rows on the timeline.
   [ -n "${MULTI_AGENT_SMOKE:-}" ] && return 0
   local task="$1" phase="$2"
-  local script="$HOME/.claude/scripts/usage-report.mjs"
+  # The emitter ships into whichever host tree installed it; a Copilot- or
+  # Codex-only install has no ~/.claude/scripts, so resolve across all three
+  # roots instead of hard-coding one (a hard-coded path silently disabled every
+  # live ping on those hosts).
+  local script=""
+  local root
+  for root in "$HOME/.claude" "$HOME/.copilot" "$HOME/.codex"; do
+    if [ -f "$root/scripts/usage-report.mjs" ]; then
+      script="$root/scripts/usage-report.mjs"
+      break
+    fi
+  done
   local prefs="$HOME/.claude/multi-agent-preferences.json"
-  [ -n "$task" ] && [ -f "$script" ] || return 0
+  [ -n "$task" ] && [ -n "$script" ] || return 0
   # Cheap gate: only spawn the emitter when usage logging is actually on, so a
   # user who never enabled it pays nothing per phase boundary. jq is already a
   # hard dependency of this script.
@@ -406,8 +422,14 @@ save_state() {
   # a failed jq yields "" - writing that would destroy the whole tracker state.
   [ -n "$1" ] || { echo "save_state: refusing to write empty state" >&2; return 65; }
   mkdir -p "$TRACKER_DIR" 2>/dev/null
-  printf '%s\n' "$1" > "${TRACKER_FILE}.tmp"
-  mv "${TRACKER_FILE}.tmp" "$TRACKER_FILE"
+  # Per-process temp name: acquire_state_lock fails open after ~5s, so two
+  # writers can legitimately be in the critical section. A fixed .tmp name lets
+  # writer B truncate the file mid-write of A, and the rename then publishes a
+  # corrupt document (render exits 65). $$ keeps each writer's temp private; the
+  # rename is still atomic, so the last full write wins instead of a torn one.
+  local tmp="${TRACKER_FILE}.tmp.$$"
+  printf '%s\n' "$1" > "$tmp"
+  mv "$tmp" "$TRACKER_FILE"
 }
 
 # --- read-modify-write lock ---------------------------------------------------
@@ -687,7 +709,11 @@ case "$ACTION" in
   init)
     [ "$#" -ge 1 ] || { echo "init needs <task_id>" >&2; exit 64; }
     TASK_ID="$1"
-    TRACKER_FILE="$HOME/.claude/logs/multi-agent/${TASK_ID}/tracker-state.json"
+    # Honor an explicit $TRACKER_FILE (tests, isolated runs); only derive the
+    # canonical home path when the caller did not supply one.
+    if [ "$TRACKER_FILE_FROM_ENV" != "1" ]; then
+      TRACKER_FILE="$HOME/.claude/logs/multi-agent/${TASK_ID}/tracker-state.json"
+    fi
     TRACKER_DIR="$(dirname "$TRACKER_FILE")"
     mkdir -p "$TRACKER_DIR" 2>/dev/null
     NOW=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
@@ -699,7 +725,13 @@ case "$ACTION" in
     # NOTE: the pointer is global; for concurrent runs on the same user account,
     # callers should set MULTI_AGENT_TASK_ID in their shell or prefix every
     # subsequent tracker call (the pointer flips on the most recent init).
-    echo "$TRACKER_FILE" > "$HOME/.claude/logs/multi-agent/.tracker-current"
+    # Skipped ONLY when the path was supplied via $TRACKER_FILE: that caller
+    # already named its own file and must not repoint the shared pointer at it.
+    # (Smoke isolation is handled by a sandbox HOME, so it still writes a pointer
+    # inside its own tree - which its later calls depend on.)
+    if [ "$TRACKER_FILE_FROM_ENV" != "1" ]; then
+      echo "$TRACKER_FILE" > "$HOME/.claude/logs/multi-agent/.tracker-current"
+    fi
     render
     usage_live_ping "$TASK_ID" 0
     if [ "${MULTI_AGENT_QUIET:-0}" != "1" ]; then
@@ -782,7 +814,10 @@ case "$ACTION" in
       )')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.sub" "$PID" "$SNAME" "{\"sub_id\": \"$SID\", \"status\": \"$SSTATUS\"}"
+    # Build the attrs with jq so a sub_id containing " or \ can't produce
+    # malformed JSON that --argjson silently drops.
+    emit_otel_span "phase.sub" "$PID" "$SNAME" \
+      "$(jq -nc --arg s "$SID" --arg st "$SSTATUS" '{sub_id:$s,status:$st}')"
     render
     ;;
 
@@ -867,7 +902,7 @@ case "$ACTION" in
       )')
     save_state "$new"
     release_state_lock
-    emit_otel_span "phase.model" "$PID" "" "{\"model\": \"$MODEL\"}"
+    emit_otel_span "phase.model" "$PID" "" "$(jq -nc --arg m "$MODEL" '{model:$m}')"
     if [ "${TRACKER_QUIET:-0}" != "1" ]; then
       render
     fi

package/pipeline/scripts/usage-report.mjs

@@ -24,7 +24,7 @@
 import { readFileSync, existsSync, readdirSync, appendFileSync } from "fs";
 import { homedir, platform } from "os";
 import { dirname, join } from "path";
-import { fileURLToPath } from "url";
+import { fileURLToPath, pathToFileURL } from "url";
 import { execFileSync } from "child_process";
 import { costUsd } from "./_cost.mjs";
 
@@ -32,6 +32,19 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const ENDPOINT_DEFAULT = "https://mmerterden.vercel.app/api/usage/ingest";
 const TIMEOUT_MS = 2500;
 
+// The emitter ships verbatim into ~/.claude, ~/.copilot and ~/.codex, so it must
+// never hard-code one host's tree: a Copilot- or Codex-only install has no
+// ~/.claude/lib. Resolve each helper across every installed host root.
+const HOST_ROOTS = [".claude", ".copilot", ".codex"];
+
+function hostFile(...parts) {
+  for (const root of HOST_ROOTS) {
+    const p = join(homedir(), root, ...parts);
+    if (existsSync(p)) return p;
+  }
+  return null;
+}
+
 function parseArgs(argv) {
   const out = { state: null, taskId: null, phase: null, status: null, dryRun: false };
   for (let i = 0; i < argv.length; i += 1) {
@@ -77,8 +90,8 @@ function resolveToken() {
   if (typeof inline === "string" && inline.trim()) return inline.trim();
   const name = g.keychainMapping?.usage_ingest;
   if (typeof name === "string" && name.trim()) {
-    const store = join(homedir(), ".claude", "lib", "credential-store.sh");
-    if (existsSync(store)) {
+    const store = hostFile("lib", "credential-store.sh");
+    if (store) {
       try {
         const out = execFileSync("bash", [store, "get", name.trim()], {
           encoding: "utf-8",
@@ -94,13 +107,29 @@ function resolveToken() {
   return "";
 }
 
+// A plugin key mapped to `false` is de-selected (e.g. /multi-agent:stack writes
+// the unpicked toolkits as false), so an object form must be filtered by truthy
+// value, never by key presence. Project settings and the user-global
+// ~/.claude/settings.json are merged, matching install/_plugin-skills.mjs.
+function readEnabledPluginNames(settings) {
+  const raw = settings?.enabledPlugins ?? settings?.plugins ?? null;
+  if (!raw) return [];
+  if (Array.isArray(raw)) return raw.filter((p) => typeof p === "string");
+  return Object.entries(raw)
+    .filter(([, v]) => v === true || v === "true")
+    .map(([k]) => k);
+}
+
 function enabledPlugins(state) {
   const root = state.projectRoot || process.cwd();
-  const settings = readJson(join(root, ".claude", "settings.json"));
-  const raw = settings?.enabledPlugins ?? settings?.plugins ?? [];
-  const list = Array.isArray(raw) ? raw : Object.keys(raw || {});
-  return list
-    .map((p) => (typeof p === "string" ? p.split("@")[0] : null))
+  const names = new Set();
+  for (const s of [
+    readJson(join(root, ".claude", "settings.json")),
+    readJson(join(homedir(), ".claude", "settings.json")),
+  ]) {
+    for (const name of readEnabledPluginNames(s)) names.add(name.split("@")[0]);
+  }
+  return Array.from(names)
     .filter(Boolean)
     .slice(0, 20);
 }
@@ -114,7 +143,10 @@ function integrationTags(state) {
   if (state.figmaAccess?.tier) apps.add("figma");
   for (const call of state.telemetry?.mcpCalls ?? []) {
     const tool = String(call?.tool || "");
-    const m = tool.match(/^mcp__([a-z0-9_]+?)__/i) || tool.match(/^mcp__([a-z0-9_]+)/i);
+    // Server segment may contain hyphens (mcp__dev-toolkit__ios_tap), so the
+    // class must accept them or "dev-toolkit" collapses to "dev".
+    const m =
+      tool.match(/^mcp__([a-z0-9_-]+?)__/i) || tool.match(/^mcp__([a-z0-9_-]+)/i);
     if (m) apps.add(m[1].replace(/_/g, "-").toLowerCase());
   }
   return Array.from(apps).slice(0, 20);
@@ -212,11 +244,16 @@ function resolveStatePath({ state, taskId }) {
 }
 
 function packageVersion() {
-  try {
-    const marker = readFileSync(join(homedir(), ".claude", ".pipeline-version"), "utf-8").trim();
-    if (marker) return marker;
-  } catch {
-    /* marker absent */
+  // The installer writes .pipeline-version per target, so read it from whichever
+  // host root exists (Copilot- or Codex-only installs have no ~/.claude).
+  const marker = hostFile(".pipeline-version");
+  if (marker) {
+    try {
+      const v = readFileSync(marker, "utf-8").trim();
+      if (v) return v;
+    } catch {
+      /* marker unreadable */
+    }
   }
   const candidates = [
     join(__dirname, "..", "..", "package.json"),
@@ -318,10 +355,31 @@ function trackerSummary(state) {
   phs.sort((a, b) => Number(a.p) - Number(b.p));
 
   const total = tin + tout + tcache;
-  const table = readJson(join(__dirname, "cost-table.json"));
-  const rate = table?.prices?.opus;
-  const cost =
-    total > 0 && rate ? Number(costUsd(rate, tin, tout, tcache).toFixed(4)) : null;
+  // Price each phase at its OWN model's rate, matching phase-tracker.sh; a run
+  // with fable phases priced entirely at opus under-reports ~2x and never
+  // agrees with the tracker card. Fall back to opus only for a phase whose
+  // model is missing or unknown in the table.
+  const prices = readJson(join(__dirname, "cost-table.json"))?.prices ?? {};
+  let cost = null;
+  if (total > 0) {
+    let acc = 0;
+    let priced = false;
+    for (const p of list) {
+      const rate = prices[p?.model || ""] || prices.opus;
+      if (!rate) continue;
+      const c = costUsd(
+        rate,
+        Number(p?.tokens_in || 0),
+        Number(p?.tokens_out || 0),
+        Number(p?.tokens_cached || 0),
+      );
+      if (c != null) {
+        acc += c;
+        priced = true;
+      }
+    }
+    if (priced) cost = Number(acc.toFixed(4));
+  }
   return {
     tk: total || null,
     cost,
@@ -394,13 +452,38 @@ function appendErrorLedger(event) {
   }
 }
 
+// Telemetry identity is the GitHub ACCOUNT NAME, never the git identity.name
+// (which can carry a full corporate title / brand text). Order: the username
+// stored on the run's identity (the gh login, from prefs identities), then the
+// active gh account's login resolved live, then null. The corporate `name` is
+// deliberately not a fallback.
+function resolveGithubLogin() {
+  try {
+    const out = execFileSync("gh", ["api", "user", "--jq", ".login"], {
+      encoding: "utf-8",
+      timeout: 3000,
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+    if (out) return out;
+  } catch {
+    /* gh absent or not authenticated - stay silent */
+  }
+  return null;
+}
+
+function resolveUser(state) {
+  const fromIdentity = state.identity?.username;
+  if (typeof fromIdentity === "string" && fromIdentity.trim()) return fromIdentity.trim();
+  return resolveGithubLogin();
+}
+
 function buildEvent(state) {
   const spend = trackerSummary(state);
   const ctx = deriveContext(state);
   return {
     id: runId(state),
     t: eventTimestamp(state, spend),
-    u: state.identity?.username || state.identity?.name || null,
+    u: resolveUser(state),
     c: commandOf(state),
     m: state.mode || null,
     ap: Boolean(state.autopilot),
@@ -453,14 +536,39 @@ async function post(endpoint, token, event) {
   }
 }
 
+// The write-only ingest token rides in a header; sending it over http would
+// leak it in cleartext, contradicting the setup contract ("transmitted only
+// over TLS"). Accept https anywhere, and http ONLY for loopback (local dev).
+function endpointAllowed(endpoint) {
+  let u;
+  try {
+    u = new URL(endpoint);
+  } catch {
+    return false;
+  }
+  if (u.protocol === "https:") return true;
+  if (u.protocol === "http:" && (u.hostname === "127.0.0.1" || u.hostname === "localhost")) {
+    return true;
+  }
+  return false;
+}
+
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (process.env.MULTI_AGENT_SMOKE && !args.dryRun) return;
   const prefs = resolvePrefs();
-  const token = resolveToken();
   const endpoint = prefs.endpoint || ENDPOINT_DEFAULT;
 
-  if (!args.dryRun && (prefs.enabled !== true || !token)) return;
+  // Gate BEFORE touching the keychain: optOut is a hard block, and reading the
+  // secret for a disabled feature is both wasteful and can raise a macOS
+  // Keychain prompt. A real send also requires a TLS (or loopback) endpoint.
+  if (!args.dryRun) {
+    if (prefs.optOut === true) return;
+    if (prefs.enabled !== true) return;
+    if (!endpointAllowed(endpoint)) return;
+  }
+  const token = args.dryRun ? "" : resolveToken();
+  if (!args.dryRun && !token) return;
 
   const statePath = resolveStatePath(args);
   let state = statePath ? readJson(statePath) : null;
@@ -487,4 +595,11 @@ async function main() {
   await post(endpoint, token, event);
 }
 
-main().catch(() => process.exit(0));
+// Windows-safe entry-point check: compare file URLs, never string-split a path.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (invokedDirectly) {
+  main().catch(() => process.exit(0));
+}
+
+export { endpointAllowed, integrationTags, enabledPlugins, readEnabledPluginNames, trackerSummary, buildEvent, resolveUser };

package/pipeline/skills/shared/external/humanizer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: humanizer
-version: 1.0.0
+version: 1.1.0
 description: |
   Remove AI-generated writing patterns from text. Makes output sound natural
   and human-written. Detects inflated language, filler phrases, AI vocabulary,
@@ -17,7 +17,11 @@ You are a writing editor. Your job is to rewrite text so it reads like a human w
 1. Scan for the patterns below
 2. Rewrite problematic sections
 3. Keep the meaning  -  change the delivery
-4. Do a final check: "Does this still sound like AI?" If yes, fix it
+4. **Self-critique pass (do not skip).** Put the rewrite next to the original and check three things, in order:
+   - **Meaning preserved.** Every claim, number, name, caveat, and conditional in the original is still present and still says the same thing. De-AI-ing must not quietly drop a "not", flip a hedge into a certainty, or merge two distinct points into one.
+   - **Nothing invented.** You added no fact, source, statistic, or example that was not in the original. Removing inflation is the job; inventing detail to replace it is a worse failure than the inflation was.
+   - **Patterns actually gone.** Re-scan the rewrite against the list below - a first pass often trades one tell for another (drops an em dash, adds "moreover").
+   If any check fails, fix it and repeat step 4. Only stop when all three hold.
 
 ## Patterns to Fix
 
@@ -47,11 +51,11 @@ Keep ONLY functional status/severity marks that a fixed template explicitly defi
 
 These words appear far more in AI output than human writing. Replace or remove them.
 
-**Flag words:** additionally, crucial, delve, enhance, foster, garner, intricate, landscape (abstract),
-pivotal, showcase, tapestry (abstract), testament, underscore, vibrant, leverage, streamline,
-seamless, robust, comprehensive, innovative
+**Flag words:** additionally, moreover, furthermore, consequently, crucial, delve, enhance, foster,
+garner, intricate, landscape (abstract), pivotal, showcase, tapestry (abstract), testament, underscore,
+vibrant, leverage, streamline, seamless, robust, comprehensive, innovative
 
-**Fix:** Use simpler alternatives. "Additionally" → "also". "Utilize" → "use". "Leverage" → "use". "Facilitate" → "help".
+**Fix:** Use simpler alternatives. "Additionally" / "Moreover" / "Furthermore" → "also" or drop it. "Utilize" → "use". "Leverage" → "use". "Facilitate" → "help".
 
 ### Mechanical Structure
 
@@ -63,6 +67,8 @@ seamless, robust, comprehensive, innovative
 | Negative parallelism | "It's not just X; it's Y" | State the point directly |
 | False ranges | "from the Big Bang to dark matter" | List topics directly |
 | Passive voice overuse | "The results are preserved automatically" | Name the actor: "The system preserves results" |
+| Trailing participle clause | "...refactored the parser, ensuring seamless integration and improving readability" | End the sentence at the fact. Split off the tacked-on "-ing" claim or delete it |
+| Connective padding | "Moreover, ... Furthermore, ... Consequently, ..." | Most are removable; if a link is real use "and", "so", "but" |
 
 ### Style Problems
 

package/pipeline/skills/shared/external/ios-coding-standard/references/rules.yml

@@ -1847,16 +1847,88 @@ rules:
       view callback bypasses that replay and is the finding, wherever it compiles.
 
   - id: UNIT-03
-    title: Dependencies are observation-ignored, defaulted parameters
+    title: A view model's dependencies are injected properties; init takes only input and output
     severity: important
     enforcement: lint
-    mechanism: 'custom regex: stored service/use-case/analytics properties in view models'
+    mechanism: 'custom regex: a unit view model init with a parameter beyond input:/output:, or a dependency resolved inline at a call site'
     rationale: flexibility
     check: >
-      Every dependency is an @ObservationIgnored stored property injected as an init parameter
-      whose default resolves from the container. Tests then inject doubles with no container
-      setup, and observation never tracks a service handle. A dependency resolved inline at the
-      call site, or a stored property observation can see, is the finding.
+      A unit view model is constructible from its Input and its output sink ALONE  -  init(input:output:),
+      collapsing to init(output:) when Input is Void. Every OTHER dependency is an @ObservationIgnored
+      property resolved by injection (a keyed inject property wrapper, or the project's equivalent), never an
+      init parameter and never resolved inline at the use site. Tests substitute a double through a
+      task-local overlay or a preview registration  -  there is no init parameter to thread it through  -  and
+      observation never tracks a service handle. The finding is an init carrying a dependency parameter
+      (defaulted or not), or a dependency resolved at its call site. Scenes, coordinators and outside-contract
+      answerers keep their resolving default arms; VIEW MODELS do not.
+
+  - id: UNIT-04
+    title: Two typed send doors, never one untyped funnel
+    severity: important
+    enforcement: scan
+    mechanism: 'custom regex: a public/internal send or handle on a view model taking a single action type that both the view and internal callers reach'
+    rationale: flexibility
+    check: >
+      What the VIEW may send (the view-action type) and what the unit sends ITSELF (its own action type)
+      are separate types, carried under one action envelope (a two-case `.view` / `.viewModel` enum) that the
+      reducer switches on. A view physically cannot construct or send an internal action. The finding is one
+      untyped funnel  -  a single action enum, or a `send`/`handle` entry point, that both the view and the
+      machine's own effects/children reach  -  which lets a view invoke internal machinery. The outbound
+      output stays a third, separate per-screen vocabulary.
+
+  - id: UNIT-05
+    title: An effect returns the unit's own action and never touches state; loading is derived
+    severity: important
+    enforcement: scan
+    mechanism: 'custom regex: a state write or a loading Bool/counter set inside an effect/task body in a view model'
+    rationale: readability
+    check: >
+      Async work is registered by id and its closure RETURNS the unit's own action, which re-enters through
+      the reducer  -  the closure cannot read or write state. Loading is DERIVED from the running-effects
+      registry (the set of in-flight ids), never a hand-set Bool or a hand-balanced count that can drift from
+      the truth; dismissing loading cancels the work rather than orphaning it, and a same-id re-run supersedes
+      the one in flight. The finding is an effect body that assigns state, or a `isLoading`/loading counter set
+      by hand instead of derived.
+
+  - id: UNIT-06
+    title: A view holds the erased face, not the concrete unit
+    severity: important
+    enforcement: scan
+    mechanism: 'custom regex: a SwiftUI view storing a concrete view model type instead of the erased face, or calling emit/run/an internal action from view code'
+    rationale: flexibility
+    check: >
+      A view stores the ERASED face  -  a surface exposing only the projected view state, the view-action
+      door, and bindings  -  not the concrete unit type. The concrete type's emit, effect-run, and own action
+      are not spellable from view code; the fence is the TYPE, not a naming convention. The finding is a view
+      whose stored model is the concrete unit (so it can reach `emit`/`run`/internal actions), or view code
+      that calls one of those.
+
+  - id: UNIT-07
+    title: Chrome on the unit path is one value-typed notice, not per-screen slots
+    severity: important
+    enforcement: scan
+    mechanism: 'custom regex: a unit view model declaring its own alert/toast/modal slot properties instead of raising the shared value-typed notice'
+    rationale: readability
+    check: >
+      On the unit system a failure or a prompt is one VALUE-typed notice (equatable, codable, closure-free  -
+      responses travel back as values through a respond entry point, never a callback stored beside the
+      chrome) that the base escalates up the host chain to whoever renders it. A domain screen does not raise
+      chrome by hand or hold its own alert/toast/modal slot trio (that is the pre-unit shape). The finding is a
+      unit view model carrying per-screen chrome slots or passing a closure through the notice.
+
+  - id: UNIT-08
+    title: View-facing state is projected from machine state, not the same type
+    severity: important
+    enforcement: lint
+    mechanism: 'custom regex: a view reading the durable machine-state type directly instead of the projected view-state'
+    rationale: readability
+    check: >
+      The durable machine state (every field the reducer needs, including bookkeeping the screen never draws)
+      and the view-facing state the view renders are distinct: the view state is a PROJECTION produced by the
+      view model (a typealias to a single machine-state field when that is all the view needs, an earned struct
+      at two). A view reads the view state only, so adding an internal field to the machine state never changes
+      what the view can see or spell. The finding is a view bound directly to the durable machine-state type,
+      or a machine-state field with no reason to exist beyond what the view already renders.
 
   - id: SAFE-03
     title: A field reset that must erase the value writes the value before clear()