@mmerterden/multi-agent-pipeline 16.1.2 → 16.1.3

package/CHANGELOG.md

@@ -16,6 +16,21 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [16.1.3] - 2026-08-23
+
+A dead-code and stale-name sweep. No dead symbols: every function and constant added this week is called from somewhere. Five stale names and one lie.
+
+### Fixed
+
+- **The uninstall preview described the wrong MCP entry, and claimed to remove one it now keeps.** The dry-run text named `dev-toolkit` - the pre-v15.12.0 name - and listed it as removed, while a current install registers `multi-agent-toolkit` and 16.1.0 made that one survive. The preview is the last thing a user reads before confirming a destructive action, so being wrong there is worse than being wrong in a comment. Both host lines now say which entry goes and which is kept, and that `lib/` keeps the credential reader.
+- `refactor`'s research ref was still `dev-toolkit-research.md`, two releases after the server was renamed. Renamed to `toolkit-research.md` with both SKILL trees updated. The file was never dangling - just carrying a name that stopped being true.
+- `docs/architecture.md` listed `dev-toolkit-mcp` as a sync target; the repo is `multi-agent-toolkit-mcp`. The plugins repo README and two site comments named the old server too.
+- The MCP registration header still said "80 tools"; it serves 83.
+
+### Added
+
+- **Both READMEs and `docs/features.md` describe what 16.1.0 actually shipped.** They had been checked for stale `--dev` references and found clean, which is not the same as being current: the release's headline capability - the install being usable in an ordinary session - appeared in none of them. Now it does, in English and Turkish, including the part that constrains it: reads are ordinary work, writes route through the pipeline commands that carry the rules making them safe.
+
 ## [16.1.2] - 2026-08-23
 
 The rule reached all three hosts in 16.1.1. It only WORKED on one.

package/README.md

@@ -133,6 +133,16 @@ says so.
 
 The **secret scan** runs as a `PreToolUse` hook on Claude Code (hard-blocks a commit on a hit) and as a pre-push check elsewhere.
 
+## Outside a pipeline run
+
+Installing the pipeline is not only useful when you run it. Open an ordinary session and the same three things are available, announced by `rules/outside-the-pipeline.md` which loads with every conversation:
+
+- **Services you already onboarded.** The token `setup` mapped is readable now - resolve the logical name through `credential-store.sh` and fetch the issue, the page, the log. **Reads are ordinary work; writes are not.** Posting a Jira comment, editing an issue or opening a PR goes through the pipeline commands, because the rules that make those safe (never auto-close, `Ref:` not `Closes:`, humanizer on outward prose) live there.
+- **The stack skills `/multi-agent:stack` enabled for the repo.** Each toolkit's own `index` skill routes; the pipeline keeps no copy of that table.
+- **The `multi-agent-toolkit` MCP.** 83 tools for a running app - screen state, crash logs, design comparison, store pre-submission.
+
+Uninstall preserves this layer: the tokens, the reader that opens them, the mapping that names them, and the MCP registration. Removing the pipeline should not cost you the credentials you onboarded through it.
+
 ## Platform support
 
 Runs on **macOS**, **Linux**, and **Windows** (Git Bash / WSL). Shell and credential access go through a platform-agnostic layer - the keychain resolves automatically to **macOS Keychain**, **Linux libsecret** (`secret-tool`), or **Windows Credential Manager**, and scripts fall back between BSD and GNU tool variants. Node.js 20.11+ (tested on 20 and 22).

package/README.tr.md

@@ -133,6 +133,16 @@ triage notu bunu belirtir.
 
 **Secret scan**, Claude Code'da bir `PreToolUse` hook'u olarak (bulgu halinde commit'i sert-engeller) ve diğer yerlerde bir pre-push kontrolü olarak çalışır.
 
+## Pipeline koşusu dışında
+
+Pipeline'ı kurmak yalnız onu çalıştırdığında işe yaramıyor. Sıradan bir oturum açtığında aynı üç şey elinin altında; her sohbette yüklenen `rules/outside-the-pipeline.md` bunları duyuruyor:
+
+- **Zaten onboard ettiğin servisler.** `setup`'ın eşlediği token okunabilir durumda - mantıksal adı `credential-store.sh` ile çöz, issue'yu, sayfayı, logu getir. **Okuma sıradan iş, yazma değil.** Jira yorumu, issue düzenleme ve PR açma pipeline komutlarından geçer, çünkü onları güvenli kılan kurallar (issue asla otomatik kapanmaz, `Closes:` değil `Ref:`, dışa dönük metinde humanizer) orada yaşıyor.
+- **`/multi-agent:stack`'in bu repo için açtığı stack skilleri.** Yönlendirmeyi her toolkit'in kendi `index` skill'i yapar; pipeline o tablonun kopyasını tutmaz.
+- **`multi-agent-toolkit` MCP.** Çalışan uygulama için 83 araç - ekran durumu, crash logu, tasarım karşılaştırma, store ön-kontrolü.
+
+Uninstall bu katmanı korur: token'lar, onları açan okuyucu, adlarını tutan eşleme ve MCP kaydı. Pipeline'ı kaldırmak, onun üzerinden onboard ettiğin credential'ları kaybetmek anlamına gelmemeli.
+
 ## Platform desteği
 
 **macOS**, **Linux** ve **Windows** (Git Bash / WSL) üzerinde çalışır. Shell ve credential erişimi platform-agnostik bir katmandan geçer - keychain otomatik olarak **macOS Keychain**, **Linux libsecret** (`secret-tool`) veya **Windows Credential Manager**'a çözülür, ve script'ler BSD ile GNU araç varyantları arasında fallback yapar. Node.js 20.11+ (20 ve 22'de test edildi).

package/docs/architecture.md

@@ -164,7 +164,7 @@ User Input → Phase 0 (Init)
 
 `/multi-agent:sync` actually walks **five** targets, not the three shown in earlier
 revisions of this diagram - Codex CLI and the two independently-shipped repos
-(`multi-agent-plugins`, `dev-toolkit-mcp`) are real sync targets too:
+(`multi-agent-plugins`, `multi-agent-toolkit-mcp`) are real sync targets too:
 
 ```mermaid
 graph TD

package/docs/features.md

@@ -30,6 +30,16 @@ Each phase reads its own spec file under `pipeline/multi-agent-refs/phases/phase
 
 Depth is not a flag. `/multi-agent` and `/multi-agent:local` ask Full or Short at Phase 0 Step 7.5, recommending from the detected `taskType`; Short strips to Init → Dev(Opus self-contained) → Review → Test → Commit → Report. Autopilot never asks and always runs Full - "fast plus unattended" was removed in v16.0.0, because something has to choose when nobody is asked and unattended is the worst place to drop analysis and planning.
 
+### Outside a Pipeline Run
+
+The install is not only useful while `/multi-agent` is running. `rules/outside-the-pipeline.md` loads with every session and announces three things a plain conversation would otherwise not know it had:
+
+- **Onboarded service credentials.** Resolve the logical name through `credential-store.sh` and read the issue, page or log. Writes route through the pipeline commands, which carry the rules that make them safe - issues are never auto-closed, PR bodies use `Ref:`, outward prose goes through the humanizer.
+- **The stack skills enabled for this repo.** Each toolkit's own `index` skill routes. The pipeline reads the effective `enabledPlugins` rather than keeping a stack table, so a seventh toolkit needs no code change.
+- **The `multi-agent-toolkit` MCP.** 83 tools for a running app.
+
+Uninstall preserves the whole layer - tokens, the reader that opens them, the mapping that names them, the MCP registration. It is 1.5 kB of always-loaded text; the detail lives in a ref that loads on demand, and a gate keeps both under a ceiling because every byte there is paid by every session.
+
 ### Stack Auto-Detection
 
 | Platform       | Detection                                    | Guide Loaded             |

package/install/_mcp-register.mjs

@@ -5,7 +5,7 @@
  *
  * Codex got MCP registration when its installer was written; Copilot never did, and
  * neither did Claude Code. The result was a host that carried the full pipeline skill
- * set and could not call a single one of the 80 dev-toolkit tools those skills depend
+ * set and could not call a single one of the 83 toolkit tools those skills depend
  * on - `design-check`, every `ios_*` / `android_*` simulator call, the archive audits.
  * Nothing failed at install time, and the skills only fail when a run actually reaches
  * for a tool.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "16.1.2",
+  "version": "16.1.3",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/refactor/SKILL.md

@@ -112,7 +112,7 @@ Procedure:
 
 The pipeline's hands on devices and browsers are MCP tools served by a companion repo (`multi-agent-toolkit-mcp`): Phase 5 test, `manual-test`, `design-check` and `apple-archive-compliance` all call them, and several pipeline skills declare a minimum toolkit version (see `cross-cli-contract.md`). That repo therefore has to track the MCP field, not just its own README. This step researches what current practice is and audits the toolkit against it.
 
-Full procedure  -  resolution (configuration first, never a hardcoded path; skip when nothing resolves or `enabled` is false), the 5 research axes, the audit command block, and the band-E output table + rules  -  lives in `$HOME/.claude/multi-agent-refs/refactor/dev-toolkit-research.md`. Read it before running this step.
+Full procedure  -  resolution (configuration first, never a hardcoded path; skip when nothing resolves or `enabled` is false), the 5 research axes, the audit command block, and the band-E output table + rules  -  lives in `$HOME/.claude/multi-agent-refs/refactor/toolkit-research.md`. Read it before running this step.
 
 ## Step 0d: RUN-ERRORS  -  what the pipeline actually failed on
 

package/pipeline/scripts/uninstall.mjs

@@ -277,7 +277,8 @@ function removeGeneratedCodexAgents(agentsDir) {
 }
 
 /**
- * Hand the dev-toolkit MCP registration back to the host CLI that owns it.
+ * Hand the RETIRED MCP registration back to the host CLI that owns it. The
+ * current one (multi-agent-toolkit) is preserved - see MCP_PRESERVED below.
  *
  * Best-effort: a missing binary or an already-absent entry is not an uninstall
  * failure. Never edits the host's config file directly - Codex keeps marketplace
@@ -699,7 +700,7 @@ export async function main() {
   console.log("  Targets:");
   if (forClaude)
     console.log(
-      "    - Claude Code (~/.claude/{commands/multi-agent, scripts, multi-agent-refs, schemas, lib} + pipeline skills + pipeline agent files + user-scope dev-toolkit MCP entry)",
+      "    - Claude Code (~/.claude/{commands/multi-agent, scripts, multi-agent-refs, schemas, lib except the credential reader} + pipeline skills + pipeline agent files + the retired dev-toolkit MCP entry; the multi-agent-toolkit entry is KEPT)",
     );
   if (forCopilot)
     console.log(
@@ -717,7 +718,7 @@ export async function main() {
     );
   if (forCodex)
     console.log(
-      "    - Codex CLI (~/.codex: skills/multi-agent, multi-agent-refs, agents/*.toml, prompts/multi-agent.md, scripts, lib, schemas, rules, AGENTS.md block, dev-toolkit MCP entry)",
+      "    - Codex CLI (~/.codex: skills/multi-agent, multi-agent-refs, agents/*.toml, prompts/multi-agent.md, scripts, lib except the credential reader, schemas, rules, AGENTS.md block, the retired dev-toolkit MCP entry; multi-agent-toolkit is KEPT)",
     );
   console.log("");
   if (allData) {

package/pipeline/skills/shared/core/multi-agent-refactor/SKILL.md

@@ -114,7 +114,7 @@ Procedure:
 
 The pipeline's hands on devices and browsers are MCP tools served by a companion repo (`multi-agent-toolkit-mcp`): Phase 5 test, `manual-test`, `design-check` and `apple-archive-compliance` all call them, and several pipeline skills declare a minimum toolkit version (see `cross-cli-contract.md`). That repo therefore has to track the MCP field, not just its own README. This step researches what current practice is and audits the toolkit against it.
 
-Full procedure  -  resolution (configuration first, never a hardcoded path; skip when nothing resolves or `enabled` is false), the 5 research axes, the audit command block, and the band-E output table + rules  -  lives in `$HOME/.claude/multi-agent-refs/refactor/dev-toolkit-research.md`. Read it before running this step.
+Full procedure  -  resolution (configuration first, never a hardcoded path; skip when nothing resolves or `enabled` is false), the 5 research axes, the audit command block, and the band-E output table + rules  -  lives in `$HOME/.claude/multi-agent-refs/refactor/toolkit-research.md`. Read it before running this step.
 
 ## Step 0d: RUN-ERRORS  -  what the pipeline actually failed on