@mmerterden/multi-agent-pipeline 19.0.0 → 19.1.1

package/pipeline/scripts/cost-table.json

@@ -1,5 +1,5 @@
 {
-  "_readme": "Per-model unit prices in USD per million tokens. Source: Anthropic public pricing (Claude-family rows verified 2026-07-28 against the current model table; the gpt-* rows remain approximate). Update when Anthropic publishes new tiers. Rung names (fable / opus / sonnet / haiku) are the pipeline's stable identifiers and `modelId` is the wire value they currently resolve to - dispatch reads the rung, so a generation move is a `modelId` edit here plus the phase specs, never a rename of the rungs. Unknown models render USD as ' - ' and emit a footnote  -  never block PR-body generation. cacheReadPerMtok is the discounted rate for prompt-cache hits (~10% of inPerMtok); the renderer prices a phase's tokens_cached at this rate when the tracker records it, so resume/cache reuse is visible in the ledger.",
+  "_readme": "Per-model unit prices in USD per million tokens. Source: Anthropic public pricing (Claude-family rows verified 2026-07-28 against the current model table; the gpt-* rows remain approximate). Update when Anthropic publishes new tiers. Rung names (fable / opus / sonnet / haiku) are the pipeline's stable identifiers and `modelId` is the wire value they currently resolve to - dispatch reads the rung, so a generation move is a `modelId` edit here plus the phase specs, never a rename of the rungs. `provider` says which layer a rung belongs to: an `anthropic` rung is reachable from every call site, a non-anthropic one only from the call sites the pipeline makes itself (bulk-read, research), which is what model-dispatch.sh enforces. Unknown models render USD as ' - ' and emit a footnote  -  never block PR-body generation. cacheReadPerMtok is the discounted rate for prompt-cache hits (~10% of inPerMtok); the renderer prices a phase's tokens_cached at this rate when the tracker records it, so resume/cache reuse is visible in the ledger.",
   "schemaVersion": "1.1.0",
   "prices": {
     "fable": {
@@ -7,6 +7,7 @@
       "outPerMtok": 50.0,
       "cacheReadPerMtok": 1.0,
       "modelId": "claude-fable-5",
+      "provider": "anthropic",
       "note": "Top tier (restored v10.6.0)  -  architects, Reviewer 1, triage. Verified against Anthropic pricing 2026-07-02."
     },
     "opus": {
@@ -14,6 +15,7 @@
       "outPerMtok": 25.0,
       "cacheReadPerMtok": 0.5,
       "modelId": "claude-opus-5",
+      "provider": "anthropic",
       "note": "Second tier - dev phase on a Short run, Reviewer 1 and triage on Copilot CLI, and the opus rung of the fable -> opus -> sonnet fallback ladder. Same rate as the Opus 4.8 it replaces, so the ledger needed no reprice on the generation move. Claude Opus 5 draws on a rate-limit pool SEPARATE from the combined Opus 4.x pool - moving traffic here neither frees headroom on the old bucket nor inherits it."
     },
     "sonnet": {
@@ -21,6 +23,7 @@
       "outPerMtok": 15.0,
       "cacheReadPerMtok": 0.3,
       "modelId": "claude-sonnet-5",
+      "provider": "anthropic",
       "note": "Floor tier for Claude-family dispatch - Reviewer 3 on both hosts, and the terminal rung of the fallback ladder. Priced at the standard 3/15 rather than the 2/10 introductory rate that runs through 2026-08-31: over-reporting during the intro window is the safe direction for a cost ledger, and it needs no dated edit when the intro ends."
     },
     "haiku": {
@@ -28,6 +31,7 @@
       "outPerMtok": 5.0,
       "cacheReadPerMtok": 0.1,
       "modelId": "claude-haiku-4-5",
+      "provider": "anthropic",
       "note": "Speed tier - task-clarifier and other latency-sensitive dispatches, plus the terminal rung of the fallback ladder. Named by its alias like every other rung here rather than by a dated snapshot, so the four rungs stay comparable at a glance."
     },
     "gpt-5.4": {
@@ -35,6 +39,7 @@
       "outPerMtok": 30.0,
       "cacheReadPerMtok": 1.0,
       "modelId": "gpt-5.4",
+      "provider": "openai",
       "note": "Copilot CLI Reviewer 2 and Codex CLI Reviewer 2  -  approximate; verify against OpenAI pricing page before relying on totals."
     },
     "gpt-5.6": {
@@ -42,6 +47,7 @@
       "outPerMtok": 30.0,
       "cacheReadPerMtok": 1.0,
       "modelId": "gpt-5.6",
+      "provider": "openai",
       "note": "Codex CLI top tier  -  Reviewer 1 at xhigh effort, Reviewer 3 at medium, triage at max, and the fable/opus rungs of the Codex persona tier map. Reasoning effort changes output volume, not the per-token rate, so one entry covers every effort level. Approximate; verify against OpenAI pricing before relying on totals."
     },
     "gpt-5.6-terra": {
@@ -49,6 +55,7 @@
       "outPerMtok": 5.0,
       "cacheReadPerMtok": 0.1,
       "modelId": "gpt-5.6-terra",
+      "provider": "openai",
       "note": "Codex CLI floor tier  -  speed-optimised, maps the haiku rung of the Codex persona tier map (task-clarifier). Approximate; verify against OpenAI pricing before relying on totals."
     }
   }

package/pipeline/scripts/doctor.mjs

@@ -658,7 +658,7 @@ function checkMcpRegistration() {
 // checkMcpRegistration answers "is OURS registered". This answers the question the
 // user never gets asked: every registered server's tool list is sent with every
 // turn, they are added one at a time, and nobody sees the running total - our own
-// toolkit is 99 tools by itself. This check only ever REPORTS. It never disables
+// toolkit is 115 tools by itself. This check only ever REPORTS. It never disables
 // anything, and it never blocks or warns, because how many servers are worth their
 // context is the user's call and not a health failure.
 //

package/pipeline/scripts/gen-facts.mjs

@@ -2,17 +2,21 @@
 /**
  * @file gen-facts.mjs  -  the numbers the website is allowed to state, derived.
  *
- * The site carried its own copies: `ArchitectureContent.tsx` said "6 faz + 51
- * komut" while the repo had six phases and sixty commands. Nobody noticed,
- * because a number written into a React component is guarded by nothing. This
- * is the same defect `smoke-phase-contract.sh` fixes inside the pipeline, and
- * the fix is the same shape: one producer, everything else reads it.
+ * A consumer that keeps its own copy of these numbers has nothing guarding it:
+ * a count typed into a page or a README is right on the day it is typed and
+ * silent afterwards. `smoke-phase-contract.sh` enforces the same shape inside
+ * the pipeline - one producer, everything else reads it.
  *
  * Source of truth per field:
  *   phases        pipeline/schemas/phases.json  -  the phase contract itself
  *   commandCount  a count of pipeline/commands/multi-agent/<name>/SKILL.md
  *   skillCount    a count of pipeline/skills/shared/external/<name>/SKILL.md
+ *   skillCountAll every SKILL.md under pipeline/skills, at any depth
+ *   agentCount    a count of pipeline/agents/*.md
+ *   hosts         the CLIs install/ has an adapter for
  *   toolCount     the toolkit's own tools/list response, when reachable
+ *   toolCategories that same response, grouped by the prefix in each tool name
+ *   pluginSkillCount every SKILL.md in the plugin marketplace, when checked out
  *   version       package.json
  *
  * Counts come from the filesystem at the moment of writing, never from a README
@@ -43,6 +47,24 @@ function die(msg) {
   process.exit(2);
 }
 
+// Every SKILL.md under a tree, at any depth. `countSkillDirs` only sees the
+// immediate children of one directory, which is the right shape for the
+// external set and the wrong one for the whole tree: the shared/core and
+// per-host mirrors sit a level deeper and were invisible to it.
+function countSkillsDeep(rel) {
+  const dir = join(ROOT, rel);
+  if (!existsSync(dir)) die(`missing directory: ${rel}`);
+  let n = 0;
+  const walk = (d) => {
+    for (const e of readdirSync(d, { withFileTypes: true })) {
+      if (e.isDirectory()) walk(join(d, e.name));
+      else if (e.name === "SKILL.md") n += 1;
+    }
+  };
+  walk(dir);
+  return n;
+}
+
 function countSkillDirs(rel) {
   const dir = join(ROOT, rel);
   if (!existsSync(dir)) die(`missing directory: ${rel}`);
@@ -70,6 +92,7 @@ try {
 // tool count is the problem this file exists to remove, and a made-up one is
 // worse than none.
 let toolCount = null;
+let toolCategories = null;
 let toolkitVersion = null;
 const toolkitDir = join(ROOT, "..", "multi-agent-toolkit-mcp");
 if (existsSync(join(toolkitDir, "package.json"))) {
@@ -113,10 +136,48 @@ if (existsSync(join(toolkitDir, "package.json"))) {
       } catch {
         continue;
       }
-      if (msg.id === 2 && Array.isArray(msg.result?.tools)) toolCount = msg.result.tools.length;
+      if (msg.id === 2 && Array.isArray(msg.result?.tools)) {
+        toolCount = msg.result.tools.length;
+        // Grouped by the prefix every tool name carries, from the same
+        // response the count comes from. Counting families out of the source
+        // gives a different and wrong answer for the reason above, and the
+        // site shows the per-family breakdown next to the total, so the two
+        // have to come from one place or they will disagree.
+        const byFamily = {};
+        for (const t of msg.result.tools) {
+          const family = String(t.name || "").split("_")[0];
+          if (family) byFamily[family] = (byFamily[family] || 0) + 1;
+        }
+        toolCategories = Object.fromEntries(
+          Object.entries(byFamily).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])),
+        );
+      }
     }
   } catch {
     toolCount = null;
+    toolCategories = null;
+  }
+}
+
+// The plugin marketplace is a third repo, probed the same way and reported as
+// null when it is not checked out beside this one. The site states this number
+// next to the pipeline's own skill counts, and three different skill
+// populations on one page is exactly the shape that drifts.
+let pluginSkillCount = null;
+const pluginsDir = join(ROOT, "..", "multi-agent-plugins", "plugins");
+if (existsSync(pluginsDir)) {
+  let n = 0;
+  const walk = (d) => {
+    for (const e of readdirSync(d, { withFileTypes: true })) {
+      if (e.isDirectory()) walk(join(d, e.name));
+      else if (e.name === "SKILL.md") n += 1;
+    }
+  };
+  try {
+    walk(pluginsDir);
+    pluginSkillCount = n;
+  } catch {
+    pluginSkillCount = null;
   }
 }
 
@@ -130,12 +191,56 @@ const facts = {
   phaseCount: contract.phases.length,
   modes: Object.fromEntries(Object.entries(contract.modes).map(([k, v]) => [k, v.phases])),
   commandCount: countSkillDirs("pipeline/commands/multi-agent"),
+  // Two populations, and conflating them is how the site came to show a stale
+  // "212 Skills" chip next to a correct "216 skills" sentence. `skillCount` is
+  // the external set a user installs; `skillCountAll` is every SKILL.md the
+  // repo ships, mirrors included. Both are stated on the site, so both are
+  // generated here rather than counted by hand at the other end.
   skillCount: countSkillDirs("pipeline/skills/shared/external"),
+  skillCountAll: countSkillsDeep("pipeline/skills"),
+  // The site shows both of these as headline figures and had typed both by
+  // hand: a "9 Sub-agents" that happened to be right and a host list that had
+  // gone stale, naming Claude Code and Copilot CLI while install/codex.mjs had
+  // been shipping a third target for releases.
+  agentCount: readdirSync(join(ROOT, "pipeline", "agents")).filter((f) => f.endsWith(".md")).length,
+  hosts: readdirSync(join(ROOT, "install"))
+    .filter((f) => f.endsWith(".mjs") && !f.startsWith("_") && f !== "index.mjs")
+    .map(
+      (f) =>
+        ({ claude: "Claude Code", copilot: "Copilot CLI", codex: "Codex CLI" })[
+          f.replace(".mjs", "")
+        ],
+    )
+    .filter(Boolean)
+    .sort(),
   toolCount,
+  toolCategories,
+  pluginSkillCount,
   toolkitVersion,
 };
 
-const body = `${JSON.stringify(facts, null, 2)}\n`;
+// JSON.stringify and prettier disagree about short arrays: stringify puts each
+// phase id on its own line, prettier collapses a run that fits. That left this
+// file failing `format:check` after every regeneration, held together only by
+// someone remembering to run prettier by hand - and a generated file that needs
+// a manual step to pass the gate is a generated file that will fail the gate.
+//
+// Importing prettier here is not the fix: this script ships in the published
+// package, where a devDependency is not installed (`n/no-unpublished-import`
+// says so). Collapsing the number runs directly costs nothing and leaves the
+// script dependency-free.
+const collapseShortArrays = (json) =>
+  json.replace(
+    /\[\n\s+((?:-?\d+|"[^"\n]*")(?:,\n\s+(?:-?\d+|"[^"\n]*"))*)\n\s+\]/g,
+    (whole, inner) => {
+      const one = `[${inner.split(/,\n\s*/).join(", ")}]`;
+      // Prettier only collapses what fits the print width; leave the rest alone
+      // rather than guess, so the two can never disagree in the other direction.
+      return one.length <= 72 ? one : whole;
+    },
+  );
+
+const body = collapseShortArrays(`${JSON.stringify(facts, null, 2)}\n`);
 
 if (process.argv.includes("--stdout")) {
   process.stdout.write(body);

package/pipeline/scripts/phase-tracker.sh

@@ -613,7 +613,7 @@ tracker_next_hint() {
     # default only up to Opus 4.7 / Sonnet 4.6, a default that landed in
     # v2.1.268. Naming the fallback on the same line is what keeps a newer model
     # from advancing six phases in silence.
-    # `subjects` now carries Phase 2's plan steps as indented rows, and
+    # `subjects` now carries Phase 1's plan steps as indented rows, and
     # update_plan takes the whole list anyway, so re-reading it is what puts
     # those steps on the Codex plan without a second mechanism. Codex has no
     # dependency concept; the "(bekliyor: ...)" suffix inside the step text is
@@ -776,9 +776,9 @@ subjects() {
     # Sub-phases ride out on the SAME list, indented in the subject string.
     #
     # The card has drawn these since sub-phases existed; the widget never has,
-    # and the widget is the surface the user actually looks at. Phase 2's plan
+    # and the widget is the surface the user actually looks at. Phase 1's plan
     # is the case that made the gap matter: the tasks, their order and their
-    # dependencies are computed, stored and used to drive Phase 3's picker, and
+    # dependencies are computed, stored and used to drive Phase 2's picker, and
     # none of it was visible anywhere the user was looking.
     #
     # Indentation is two spaces INSIDE the subject because the widget takes
@@ -1214,7 +1214,7 @@ GATE
     ;;
 
   plan)
-    # Phase 2's plan, turned into sub-phases of the phase that will execute it.
+    # Phase 1's plan, turned into sub-phases of the phase that will execute it.
     #
     # The parsing lives here rather than in the phase document for one reason:
     # sub-phases are this file's structure, and a jq blob in a phase doc is a
@@ -1222,7 +1222,7 @@ GATE
     # keeps the doc to one line, which the aggregate phase-doc budget cares about.
     #
     # Reads planning-output.schema.json on stdin: tasks[] with id, title and an
-    # optional dependsOn[]. Status is `pending` for all of them - Phase 3 moves
+    # optional dependsOn[]. Status is `pending` for all of them - Phase 2 moves
     # them with `sub`, and pre-marking work as started is the lie the tracker
     # exists to avoid.
     need_jq

package/pipeline/scripts/pre-commit-check.sh

@@ -148,12 +148,41 @@ scan_file() {
     FOUND=1
   fi
 
-  # High-signal provider token prefixes (low false-positive rate)
+  # High-signal provider token prefixes (low false-positive rate).
+  #
+  # This set and the one in lib/outbound-gate.mjs cover the same providers, and
+  # smoke-secret-parity.sh holds them to it by running a fake token of each
+  # shape through BOTH.
   if echo "$content" | grep -qE '(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,}|xox[baprs]-[A-Za-z0-9-]{12,}|sk_live_[A-Za-z0-9]{20,}|rk_live_[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|npm_[A-Za-z0-9]{36}|glpat-[A-Za-z0-9_-]{20,}'; then
     echo "BLOCKED: Provider access token in $file" >&2
     FOUND=1
   fi
 
+  # Model-provider and ML-hub keys. `sk-ant-` and `sk-proj-` are checked before
+  # the bare `sk-` form so the message names the provider a reader can revoke.
+  if echo "$content" | grep -qE 'sk-ant-[A-Za-z0-9_-]{32,}|sk-proj-[A-Za-z0-9_-]{32,}|pplx-[A-Za-z0-9]{32,}|hf_[A-Za-z0-9]{30,}'; then
+    echo "BLOCKED: Model-provider API key in $file" >&2
+    FOUND=1
+  fi
+
+  # Figma personal access token (figd_) and the MCP OAuth token (figu_). Same
+  # shape, same blast radius: both read every file the account can reach.
+  if echo "$content" | grep -qE 'fig[a-z]_[A-Za-z0-9_-]{20,}'; then
+    echo "BLOCKED: Figma token in $file" >&2
+    FOUND=1
+  fi
+
+  # A URL carrying its own credentials, which is how a `git remote -v` paste
+  # leaks, and an Authorization header copied out of a curl trace.
+  if echo "$content" | grep -qE '[a-z][a-z0-9+.-]*://[^[:space:]/:@]+:[^[:space:]/@]+@'; then
+    echo "BLOCKED: URL with embedded credentials in $file" >&2
+    FOUND=1
+  fi
+  if echo "$content" | grep -qiE 'Authorization:[[:space:]]*(Bearer|Basic)[[:space:]]+[A-Za-z0-9._~+/=-]{16,}'; then
+    echo "BLOCKED: Authorization header with a token in $file" >&2
+    FOUND=1
+  fi
+
   # JWT (three base64url segments  -  header.payload.signature)
   if echo "$content" | grep -qE 'eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'; then
     echo "BLOCKED: JWT in $file" >&2

package/pipeline/scripts/scan-skills.sh

@@ -123,6 +123,14 @@ tree_grep() {
   return 0
 }
 
+# Case-insensitive variant. Prose written to steer a model is written by hand,
+# so its capitalisation is whatever the author felt like, and a case-sensitive
+# pattern would miss "Ignore all previous instructions" by one letter.
+tree_grep_i() {
+  tr '\n' '\0' < "$SCAN_LIST" | xargs -0 grep -nHEi -- "$1" 2>/dev/null
+  return 0
+}
+
 # stdin: "path:line:content" grep hits -> stdout: "fileIdx|path|line|content"
 index_hits() {
   awk -v listfile="$SCAN_LIST" '
@@ -260,6 +268,24 @@ if [ "$THRESHOLD_RANK" -ge 1 ]; then
     seq=$((seq+1))
     emit_raw "$HIT_IDX" 9 "$seq" high "$HIT_FILE" "$HIT_LINE" "chmod-then-exec" "script made executable and immediately invoked"
   done < <(tree_grep 'chmod[[:space:]]+\+x[[:space:]]+[^&;]+[[:space:]]*(&&|;)[[:space:]]*\./' | index_hits)
+
+  # Prompt injection (OWASP LLM01). The other families ask what a skill makes
+  # the MACHINE do; this one asks what it makes the MODEL do. A skill is
+  # instructions loaded straight into the context that decides everything after
+  # it, so text telling the model to drop its instructions, recite its prompt,
+  # or act behind the user's back is an attack delivered as prose - and no
+  # pattern above can see it, because nothing is executed.
+  #
+  # `high`, not `critical`: these phrasings can appear in a skill that DESCRIBES
+  # the attack, this scanner's own documentation being the obvious case, so a
+  # hit is a line a human reads rather than a verdict.
+  seq=0
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    parse_hit "$hit"
+    seq=$((seq+1))
+    emit_raw "$HIT_IDX" 13 "$seq" high "$HIT_FILE" "$HIT_LINE" "prompt-injection" "text instructing the model to override, disclose or hide - OWASP LLM01"
+  done < <(tree_grep_i 'ignore (all )?(the )?(previous|prior|above|earlier) (instructions|prompts?|rules?)|disregard (your|the|any) (system prompt|previous instructions|instructions)|(reveal|print|output|repeat|show) (your|the) (system prompt|full instructions)|(do not|don'"'"'t|never) (tell|inform) the (user|operator)|without (telling|informing|asking) the (user|operator)|(always|automatically) (approve|confirm) [^.]{0,30}(without|regardless)|you are now (a|an|the) ' | index_hits)
 fi
 
 # --- medium families (rank 2) ---------------------------------------------