@mmerterden/multi-agent-pipeline 20.11.1 → 20.13.0

package/CHANGELOG.md

@@ -16,6 +16,57 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.13.0] - 2026-10-01
+
+### Added
+
+- Every destructive command (`kill`, `forget`, `garbage-collect`, `prune-logs`, `prune-prompts`, `autopilot-off`, alongside `purge` and `uninstall`) carries `disable-model-invocation: true`, so it runs only when the user types it. Confirm-only commands such as `sync` stay model-invocable. `test/command-contract.test.mjs` holds the rule, and `cross-cli-contract.md` records it with the decision to keep command-only frontmatter keys at the top level.
+- `lint-skills.mjs` requires a routing clause ("use when ...") in every command description, as it already did for skills, and warns when a command on its Gotchas list has no `## Gotchas` section.
+- `## Gotchas` sections near the top of `analysis`, `analysis-jira`, `autopilot`, `doctor`, `review` and `review-analysis`, mirrored into their Copilot skills.
+- `validate-analysis-doc.mjs` warns on vague wording (`fast`, `appropriately`, `etc.`, `gerektiğinde`, `vb.` and similar) in id-bearing requirement rows (`BR-`, `IG-`, `FG-`); `--strict` turns it into a failure. Code spans and summary prose are not read.
+- `smoke-personal-data.sh` also reads a machine-local pattern list (`~/.claude/personal-data-patterns.txt`, or `MA_PERSONAL_DATA_PATTERNS`), so names that must never ship are guarded without being written into the shipped tree.
+- `pipeline/lib/analysis-sections.mjs` holds the section and table-row readers the validator uses, plus the per-profile location of the redesign artefacts.
+- `argument-hint` on the root `/multi-agent` command and on the Copilot `multi-agent-setup` skill.
+- `/multi-agent:analysis-jira` writes a full story description built from the document: the user story, up to 8 acceptance criteria (the G/W/T column or the rule; functional requirements plus alternative and exception flows on the corporate profile), redesign rows for the story's section, and links to the analysis page, the design and the API spec. Missing parts become body warnings and are never filled in. The preview shows every body in full; `--brief` keeps the one-line view.
+- `escapeJiraWiki()` and `wikiLink()` in `jira-wiki-escape.mjs`: document text is escaped before it reaches wiki markup, and links accept http and https only.
+- `--epic KEY` links the stories to an existing epic: `parent` on Cloud, the discovered Epic Link field on Server and Data Center (`issueTree.epicLinkMode`, `issueTree.epicLinkFieldId`). With no field found, the stories are created unlinked and the writer warns.
+- `issueTree.cloneByChannel` creates one linked clone per channel in `channelComponents`, with its own label and component; `cloneLinkType` names the link.
+- `analysis-tickets-writeback.mjs` writes a `## Tickets` table (story, key, sources, channel) into the analysis document between markers, idempotently; updating the Confluence page is a separate approval.
+- `analysis-story-tree.mjs --page-url URL` links the published analysis page from every story.
+- `validate-analysis-doc.mjs` gains six document-quality checks, in `pipeline/lib/analysis-quality.mjs`: `exception-flow` (a corporate use case with a main flow states its exception flow; missing warns on a draft and fails a final document, `Yok: <reason>` is an accepted answer), `scope-overlap` (an item both goal and non-goal fails), `cited-undefined` (a `BR`/`CB`/`IG`/`UC`/`FG` id the text cites but no table row or heading defines fails), `design-frame-unmapped` (a Figma frame outside every corporate use case warns), `business-layer-technical` (a file path or endpoint in global Part A warns; `<details>` blocks and redesign evidence tables are not read) and `missing-inputs` (a final document with a non-empty missing-inputs panel warns).
+- `build-references.mjs --missing-panel` prints the sources the run could not read as the panel at the top of the document; the render places it above Section 1.
+- `confluence-readback.mjs` reads a published page back and reports each document heading missing from the page and each embedded image that is not attached. The analysis render runs it after every publish and reports a mismatch without republishing.
+- Draft pages carry `[TASLAK]` / `[DRAFT]` in their title until the document is final; the corporate `titleFormat` accepts a `{status}` placeholder.
+- The corporate use-case table has an `İstisna Akışı / Exception Flow` row, the traceability matrix gains `Ekran` and `Test` columns, and Section 20 gains `Kategori` and `Karar` columns with one row per question. Multi-service use cases also get a sequence diagram.
+- Synthesis proposes edge-case candidates from the evidence (`state.analysisSpec.edgeCandidates[]`); only accepted ones enter the document. The global API request body shows types instead of sample values and names each field's source, and the document head carries an "at a glance" line of counts.
+- The analysis review verdict ends with `Publish ready`, an ordered `Fix first` list and a `Verified OK` line.
+
+### Fixed
+
+- The corporate profile has a layout for redesign documents: `2.1.1` current behaviour, `2.3.1` difference list and `5.(N+4).1` endpoint mapping, and the validator looks the artefacts up by profile. A corporate document with `redesign: true` previously had no sections the validator would accept.
+- The analysis refs agree with each other: 36 Locked decisions everywhere (the command and `resolve.md` said 35 and 31); section numbers are canonical and keep gaps everywhere (the command and `render.md` said numbering re-flows); the `review.md` verdict example uses the rubric's own class names. `test/analysis-refs-consistency.test.mjs` keeps them aligned.
+- The global Section 20 table carries an `ID` column with `AS-NN` values, which the closure gate pairs on.
+- `feedback` and `review-analysis` descriptions say when to use them.
+- The analysis-jira writer searches for clone labels before creating, so a re-run with `cloneByChannel` no longer creates the clones again. A node found on the site is recorded in the ledger as `exists`.
+- Codex receives stack-plugin skills with their `$HOME/.claude/...` paths retargeted, like the pipeline's own skills.
+- The analysis render resolves `CONFLUENCE_BASE_URL` from `prefs.global.hosts.confluence` before publishing.
+- No analysis file says section numbers re-flow: the global template's omission rule, `synthesis.md`, `analysis-resolve` and the validator all state canonical numbers with gaps, and the consistency test also matches "re-flowed".
+
+## [20.12.0] - 2026-10-01
+
+### Added
+
+- `usage-report.mjs` records the outcome of every send attempt in `~/.claude/logs/multi-agent/usage-last-send.json`: `accepted`, `not-accepted`, `rejected` with the status code, `redirected` with the host it pointed to, `failed`, or `skipped` with its reason. It carries the run id, the event and the endpoint host, never the token. Any outcome other than `accepted` also prints one line on stderr. Previously the response was discarded, so a failed send left no trace on the panel or the machine.
+- `/multi-agent:doctor` gains the `usage-report` check: it reads that record and turns anything but `accepted` into a WARN with the step that fixes it.
+- `lib/agent-model-sync.mjs`: the installed agents whose `preferredModel` is `fable` (code-reviewer, plan-critic, the iOS, Android and backend architects) have their `model:` line written from `modelFallback.fableEnabled`, `fable` when on and `opus` when off. `/multi-agent:model on|off` re-applies it on every flip and the installer on every install, so the one switch covers agents spawned without an explicit model as well as routed dispatches. Sources keep `model: fable`; `/multi-agent:sync` normalizes the repo copy back with `--fable-on`.
+
+### Fixed
+
+- `migrate-prefs.mjs` rewrites a `usageLog.endpoint` on `mmerterden.vercel.app` to `mmerterden.com`. The platform host answers every request with a 308, which the usage clients never follow.
+- The unattended guard resolves a directory's worktree root once per decision instead of up to three times, which cuts a program-provenance check from seven git calls to five.
+- `test/unattended-guard.test.mjs` is now `test/unattended-guard.serial.mjs` and runs after the parallel `test/*.test.mjs` pool. Inside the pool its guard decisions could outlast the guard's 5-second internal deadline, and the guard fails closed when that happens.
+- Lockfile: `brace-expansion` 5.0.12 and `fast-uri` 3.1.8 (transitive), which clears the high and moderate advisories the scorecard gates on.
+
 ## [20.11.1] - 2026-09-29
 
 ### Changed

package/README.md

@@ -17,7 +17,7 @@ Runs natively on Claude Code, Copilot CLI and Codex CLI. macOS only. Zero runtim
 ### Prerequisites
 
 - **Node.js >= 20.11** - required; the pipeline's own tooling runs on it.
-- **`jq`** - required for nine paths, optional for the rest. 89 shell files call it. The nine that publish or decide - the autopilot queue, Jira comments, PR reviews, issue updates, the plan file, both Figma fetchers, log search and Jira auth - refuse with exit 3 rather than run, because a missing `jq` renders as empty DATA and the work carries on with it. Everywhere else it still degrades. The install prints a note when it is missing.
+- **`jq`** - required for nine paths, optional for the rest. 90 shell files call it. The nine that publish or decide - the autopilot queue, Jira comments, PR reviews, issue updates, the plan file, both Figma fetchers, log search and Jira auth - refuse with exit 3 rather than run, because a missing `jq` renders as empty DATA and the work carries on with it. Everywhere else it still degrades. The install prints a note when it is missing.
 - **`gh`** - for GitHub issue and PR work. Its built-in `--jq` is independent of the `jq` binary.
 
 ## Quick Start

package/README.tr.md

@@ -17,7 +17,7 @@ Claude Code, Copilot CLI ve Codex CLI üzerinde native çalışır. Yalnızca ma
 ### Önkoşullar
 
 - **Node.js >= 20.11** - zorunlu; pipeline'ın kendi araçları bunun üzerinde koşuyor.
-- **`jq`** - dokuz yol için zorunlu, geri kalanı için opsiyonel. 89 kabuk dosyası ona başvuruyor. Yayınlayan ya da karar veren dokuzu - autopilot kuyruğu, Jira yorumları, PR review'ları, issue güncellemeleri, plan dosyası, iki Figma fetcher'ı, log araması ve Jira auth - `jq` yokken çalışmak yerine exit 3 ile reddediyor, çünkü eksik bir `jq` boş VERİ olarak görünür ve iş onunla devam eder. Diğer yerlerde `jq` olmadan da çalışıyor, yalnızca daha az şey yapıyor. Kurulum, eksikse bir not basıyor.
+- **`jq`** - dokuz yol için zorunlu, geri kalanı için opsiyonel. 90 kabuk dosyası ona başvuruyor. Yayınlayan ya da karar veren dokuzu - autopilot kuyruğu, Jira yorumları, PR review'ları, issue güncellemeleri, plan dosyası, iki Figma fetcher'ı, log araması ve Jira auth - `jq` yokken çalışmak yerine exit 3 ile reddediyor, çünkü eksik bir `jq` boş VERİ olarak görünür ve iş onunla devam eder. Diğer yerlerde `jq` olmadan da çalışıyor, yalnızca daha az şey yapıyor. Kurulum, eksikse bir not basıyor.
 - **`gh`** - GitHub issue ve PR işleri için. Kendi dahili `--jq`'su, `jq` ikilisinden bağımsız.
 
 ## Hızlı Başlangıç

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-09-29",
-  "version": "20.11.1",
+  "generatedAt": "2026-10-01",
+  "version": "20.13.0",
   "phaseSchema": 2,
   "phases": [
     {

package/install/_common.mjs

@@ -591,7 +591,7 @@ export function removePipelineAgentFiles(destDir, agentsSrc) {
  * @param {string} rel  path relative to the copy root, posix-separated
  * @returns {boolean}
  */
-function isCopyJunk(rel) {
+export function isCopyJunk(rel) {
   return (
     rel === ".DS_Store" ||
     rel.endsWith("/.DS_Store") ||

package/install/_plugin-skills.mjs

@@ -182,10 +182,18 @@ export function pluginsToDeliver(home, platformFlag) {
  * @param {"ios"|"android"|"all"} opts.platformFlag
  * @param {string} opts.label - host label for log lines
  * @param {Set<string>} [opts.skipNames] - PIPELINE-owned skill names; a plugin skill matching one is delivered plugin-prefixed rather than dropped
+ * @param {(from: string, to: string) => void} [opts.copy] - copies one skill directory; a host whose paths differ from Claude Code's passes a rewriting copy
  * @returns {{copied: number, renamed: string[], collided: number, plugins: string[], missing: string[]}}
  */
 export function installAuthoredPluginSkills(opts) {
-  const { home, dest, platformFlag, label, skipNames = new Set() } = opts;
+  const {
+    home,
+    dest,
+    platformFlag,
+    label,
+    skipNames = new Set(),
+    copy = (from, to) => copyDir(from, to, {}),
+  } = opts;
   const { names: wanted, source: selectionSource } = pluginsToDeliver(home, platformFlag);
 
   let copied = 0;
@@ -257,7 +265,7 @@ export function installAuthoredPluginSkills(opts) {
         // Wipe before copy: `copyDir` only adds, so a file the plugin dropped upstream
         // would linger in the installed skill and keep being read as current.
         wipeDir(to);
-        copyDir(from, to, {});
+        copy(from, to);
         copied += countFiles(from);
         perPlugin++;
       }
@@ -315,13 +323,9 @@ export function installAuthoredPluginSkills(opts) {
 /**
  * Skill names the PIPELINE owns, derived from its source tree.
  *
- * This is what `skipNames` should be. Callers used to pass a snapshot of
- * whatever was already installed (a now-deleted `existingSkillNames(dest)`) - which
- * did protect pipeline skills from being shadowed by a plugin, but also meant a
- * plugin skill was copied exactly once and then frozen: on the second install its
- * own name was "already there", so it was skipped, forever. A stale plugin skill
- * then outlives every upstream fix in it, which is how a reference to a path the
- * plugin no longer names survived in an installed tree.
+ * This is what `skipNames` should be. A snapshot of the destination would also
+ * match plugin skills from a previous install, so each would be copied once and
+ * then skipped on every later install, frozen against upstream fixes.
  *
  * Deriving from the source keeps the shadowing protection (a plugin still cannot
  * overwrite a pipeline skill) while letting plugin skills refresh on every install.