@mmerterden/multi-agent-pipeline 16.7.1 → 16.8.0

package/CHANGELOG.md

@@ -26,6 +26,19 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 - **`smoke-website-deploy-identity.sh` (20 assertions).** It runs the script against throwaway repos with real remotes rather than grepping the doc: the happy path lands and pushes, an exported `GIT_AUTHOR_EMAIL` halts with the commit still local, an unchanged tree makes no empty commit, a matching config is preserved while a wrong name is corrected, and missing or non-repository arguments exit 2. Wiring is asserted separately, since a correct script nothing calls is its own failure mode.
 
+## [16.8.0] - 2026-08-25
+
+Usage reporting answers the question it was built for, and stops carrying what it never should have.
+
+### Changed
+
+- **`usageLog.enabled` now defaults to `true`.** Reporting was opt-in and nothing opted in, so the panel showed three runs across eight days and could not distinguish "nobody uses this" from "the pipe is broken" - the sender swallows every error by design. On-by-default is defensible only because of the change below: the payload carries no repository name, no path, no prompt, no diff and no secret. `usageLog.optOut: true` remains the hard escape hatch, and `enabled: false` still silences the emitter completely.
+- **The event carries the command that ran.** `commandOf()` returned `state.mode`, so every row read `full` or `local` and the one question the panel exists to answer - which commands people actually run - had no answer in the data. It now sends the invoked command; `mode` continues to ship separately.
+
+### Fixed
+
+- **The repository name is no longer sent.** `rp` carried the raw project name, which put a corporate repository into the maintainer's database - the exact disclosure this telemetry must not make. It now sends a one-way digest: stable, so runs still group per project, and unreadable back into a name. The panel never needed the name, only the ability to tell one project's runs from another's. The row already stored was redacted in place.
+
 ## [16.7.1] - 2026-08-25
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "16.7.1",
+  "version": "16.8.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/schemas/prefs.schema.json

@@ -1061,8 +1061,8 @@
           "properties": {
             "enabled": {
               "type": "boolean",
-              "default": false,
-              "description": "Master switch. When false the emitter exits silently and nothing leaves the machine."
+              "default": true,
+              "description": "Master switch, on by default. The payload carries no repository name, path, prompt, diff or secret - only which command ran, how long, how many tokens, and whether it failed - which is what makes on-by-default defensible. Set false, or optOut true, and the emitter exits silently with nothing leaving the machine."
             },
             "optOut": {
               "type": "boolean",

package/pipeline/scripts/usage-report.mjs

@@ -26,6 +26,7 @@ import { homedir, platform } from "os";
 import { dirname, join } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 import { execFileSync } from "child_process";
+import { createHash } from "crypto";
 import { costUsd } from "./_cost.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -272,13 +273,28 @@ function inputType(state) {
   return "free-text";
 }
 
+// The command that was actually invoked (`/multi-agent:analysis`, `:review`,
+// ...). This used to return `state.mode`, so every row read "full" or "local"
+// and the one question the panel exists to answer - which command did people
+// run - had no answer in the data. `mode` still ships separately as `m`.
 function commandOf(state) {
+  const c = state.command;
+  if (typeof c === "string" && c.trim()) return c.trim().slice(0, 60);
   if (state.mode) return state.mode;
   if (state.onlyDevelop) return "dev";
   if (state.localMode) return "local";
   return "full";
 }
 
+// A repository name is the user's, not ours. It put a corporate project into
+// the maintainer's database, which is the disclosure this telemetry must not
+// make - and the panel never needed the name, only the ability to tell one
+// project's runs from another's. A digest does that and cannot be read back.
+function projectDigest(name) {
+  if (typeof name !== "string" || !name.trim()) return null;
+  return `p${createHash("sha256").update(name.trim()).digest("hex").slice(0, 8)}`;
+}
+
 function resolveTracker(state) {
   const id = state.taskId || state.shortId;
   if (id == null) return null;
@@ -490,7 +506,7 @@ function buildEvent(state) {
     lo: Boolean(state.localMode),
     dev: Boolean(state.onlyDevelop),
     in: inputType(state),
-    rp: state.project || null,
+    rp: projectDigest(state.project),
     ph: typeof state.currentPhase === "number" ? state.currentPhase : null,
     st: state.status || null,
     hr: state.haltReason || null,