@mmerterden/multi-agent-pipeline 20.2.0 → 20.3.0

package/pipeline/scripts/uninstall.mjs

@@ -3,8 +3,7 @@
 /**
  * @file Token-preserving uninstaller  -  removes the multi-agent-pipeline
  * footprint from Claude Code and Copilot CLI without touching personal access
- * tokens stored in the OS credential store (macOS Keychain / Windows
- * Credential Manager / Linux libsecret). The legacy adapter flags
+ * tokens stored in the macOS Keychain. The legacy adapter flags
  * (--cursor / --copilot-chat / --antigravity / --codex) clean up files left
  * behind by pre-v10.7.0 adapter installs; the adapters themselves are gone.
  *
@@ -55,7 +54,7 @@ import { homedir } from "os";
 import { pathToFileURL } from "url";
 import { createInterface } from "readline";
 
-const HOME = process.env.HOME || process.env.USERPROFILE;
+const HOME = process.env.HOME;
 
 /**
  * Agent definition files the pipeline ships (pipeline/agents/). This runs
@@ -72,6 +71,7 @@ export const PIPELINE_AGENT_FILES = [
   "dev-critic.md",
   "explorer.md",
   "ios-architect.md",
+  "plan-critic.md",
   "security-auditor.md",
   "task-clarifier.md",
 ];
@@ -666,7 +666,11 @@ function cleanClaudeSettings(settingsPath) {
     settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter(
       (h) =>
         !(
-          (h.matcher === "Bash" || h.matcher === "Bash(git commit:*)") &&
+          (h.matcher === "Bash" ||
+            h.matcher === "Bash(git commit:*)" ||
+            h.matcher === "Edit|Write|NotebookEdit" ||
+            h.matcher === "WebFetch|mcp__multi-agent-toolkit__.*" ||
+            h.matcher === "WebFetch|mcp__multi-agent-toolkit__web_.*") &&
           h.hooks?.some(
             (sub) =>
               sub.command?.includes("pre-commit-check.sh") ||
@@ -740,9 +744,7 @@ export async function main() {
     console.log("");
   }
   console.log("  PRESERVED (never touched):");
-  console.log(
-    "    - Personal access tokens in OS credential store (Keychain / Credential Manager / libsecret)",
-  );
+  console.log("    - Personal access tokens in the macOS Keychain");
   console.log("    - ~/.claude/CLAUDE.md (your customizations)");
   console.log("    - ~/.claude/rules/ (user-owned; installed write-if-missing, never overwritten)");
   console.log("    - Local-only alias wrappers under commands/multi-agent/ (user-authored)");
@@ -947,9 +949,7 @@ export async function main() {
   }
   console.log("");
   console.log("  Personal access tokens were NOT touched. Inspect with:");
-  console.log('    macOS:   security find-generic-password -s "<service>" -w');
-  console.log("    Windows: cmdkey /list:<target>");
-  console.log("    Linux:   secret-tool search service <service>");
+  console.log('    security find-generic-password -s "<service>" -w');
   console.log("");
   if (dryRun) console.log("  [DRY-RUN] No changes applied. Re-run without --dry-run to execute.");
   console.log("");

package/pipeline/scripts/update-issue-progress.sh

@@ -74,7 +74,7 @@ ma_outbound_gate() {
 # (nested <root>/<project>/<id>/ and flat <root>/<id>/) and every id spelling.
 _MA_RP_HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=/dev/null
-. "$_MA_RP_HERE/../lib/run-paths.sh" 2>/dev/null || . "$HOME/.claude/lib/run-paths.sh"
+if [ -f "$_MA_RP_HERE/../lib/run-paths.sh" ]; then . "$_MA_RP_HERE/../lib/run-paths.sh"; else . "$HOME/.claude/lib/run-paths.sh"; fi
 
 
 # Rewrite the `### Progress` block of the body file ($2) with $1 and print the

package/pipeline/scripts/usage-identity.mjs

@@ -0,0 +1,288 @@
+#!/usr/bin/env node
+/**
+ * usage-identity.mjs  -  the GitHub account this machine reports usage under.
+ *
+ * The reporting identity is the logged-in GitHub account that can read the
+ * pipeline repository (`usageLog.accessRepo`, default
+ * mmerterden/multi-agent-pipeline). Access to that repository is what grants
+ * use of the pipeline, so it is also what decides whose name a run carries.
+ * The account `gh` happens to have active is not used as such: a machine with
+ * a work account and a personal account logged in reports under whichever of
+ * the two actually holds access.
+ *
+ * Resolution: every github.com account `gh auth status` lists is checked once,
+ * in order `usageLog.reportAs` (when it is one of them), the active account,
+ * then the rest. Each check runs `gh api repos/<accessRepo>` with that
+ * account's token in the child's environment (GH_TOKEN), never on argv and
+ * never written anywhere. The first account that can read the repository wins.
+ *
+ * The result is cached in prefs as `usageLog.login` + `usageLog.loginCheckedAt`
+ * (and `usageLog.loginRepo`; `usageLog.loginReason` says why none qualified), re-checked after LOGIN_TTL_MS, or after
+ * NO_LOGIN_TTL_MS when no account had access, or on `--refresh`.
+ *
+ * Usage:
+ *   node usage-identity.mjs [--refresh] [--prefs <path>] [--json]
+ *
+ * Exit: always 0. One line on stdout says which account was chosen, or why none.
+ *
+ * @module pipeline/scripts/usage-identity
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { execFileSync, spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { lockTimeoutFrom, updateJsonFileSync } from "../lib/json-file-lock.mjs";
+
+export const ACCESS_REPO_DEFAULT = "mmerterden/multi-agent-pipeline";
+export const LOGIN_TTL_MS = 7 * 24 * 3_600_000;
+export const NO_LOGIN_TTL_MS = 24 * 3_600_000;
+const GH_TIMEOUT_MS = 6000;
+const HOST = "github.com";
+const LOGIN_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,38}$/;
+const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export function defaultPrefsPath(env = process.env) {
+  return env.MULTI_AGENT_PREFS || join(homedir(), ".claude", "multi-agent-preferences.json");
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function ghBin(env) {
+  return env.MA_GH_BIN || "gh";
+}
+
+export function accessRepoOf(prefs) {
+  const r = prefs?.global?.usageLog?.accessRepo;
+  return typeof r === "string" && REPO_RE.test(r.trim()) ? r.trim() : ACCESS_REPO_DEFAULT;
+}
+
+function parseStatusJson(out) {
+  try {
+    const hosts = JSON.parse(out)?.hosts?.[HOST];
+    if (!Array.isArray(hosts)) return null;
+    return hosts
+      .filter((h) => h && (h.state === undefined || h.state === "success"))
+      .map((h) => ({ login: String(h.login || ""), active: h.active === true }))
+      .filter((a) => LOGIN_RE.test(a.login));
+  } catch {
+    return null;
+  }
+}
+
+function parseStatusText(out) {
+  const accounts = [];
+  let last = null;
+  for (const line of out.split("\n")) {
+    const m = line.match(/Logged in to \S+ account (\S+)/);
+    if (m && LOGIN_RE.test(m[1])) {
+      last = { login: m[1], active: false };
+      accounts.push(last);
+    } else if (last && /Active account:\s*true/.test(line)) {
+      last.active = true;
+    }
+  }
+  return accounts;
+}
+
+/** Every github.com account gh holds a working login for. */
+export function listAccounts({ env = process.env } = {}) {
+  const gh = ghBin(env);
+  const json = spawnSync(gh, ["auth", "status", "--json", "hosts", "--hostname", HOST], {
+    encoding: "utf8",
+    timeout: GH_TIMEOUT_MS,
+    env,
+  });
+  if (json.status === 0) {
+    const parsed = parseStatusJson(json.stdout || "");
+    if (parsed) return parsed;
+  }
+  const text = spawnSync(gh, ["auth", "status", "--hostname", HOST], {
+    encoding: "utf8",
+    timeout: GH_TIMEOUT_MS,
+    env,
+  });
+  if (text.error) return [];
+  return parseStatusText(`${text.stdout || ""}\n${text.stderr || ""}`);
+}
+
+/**
+ * The gh token for one logged-in account, read from gh's stdout. The token
+ * never appears on an argv: gh reads it from its own store. Empty string when
+ * gh has none for that login.
+ */
+export function ghTokenFor(login, env = process.env) {
+  return tokenFor(login, env);
+}
+
+function tokenFor(login, env) {
+  try {
+    return execFileSync(ghBin(env), ["auth", "token", "--hostname", HOST, "--user", login], {
+      encoding: "utf8",
+      timeout: GH_TIMEOUT_MS,
+      stdio: ["ignore", "pipe", "ignore"],
+      env,
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+
+function canRead(repo, token, env) {
+  const r = spawnSync(ghBin(env), ["api", `repos/${repo}`, "--silent"], {
+    encoding: "utf8",
+    timeout: GH_TIMEOUT_MS,
+    stdio: ["ignore", "ignore", "ignore"],
+    env: { ...env, GH_TOKEN: token, GH_HOST: HOST, GITHUB_TOKEN: "" },
+  });
+  return r.status === 0;
+}
+
+function orderCandidates(accounts, preferred) {
+  const out = [];
+  const add = (a) => {
+    if (a && !out.some((x) => x.login === a.login)) out.push(a);
+  };
+  if (preferred) add(accounts.find((a) => a.login.toLowerCase() === preferred.toLowerCase()));
+  add(accounts.find((a) => a.active));
+  for (const a of accounts) add(a);
+  return out;
+}
+
+/**
+ * Check each logged-in account against the access repository, live.
+ * Returns { login, reason } where login is null when no account has access.
+ */
+export function checkAccess({
+  repo = ACCESS_REPO_DEFAULT,
+  preferred = null,
+  env = process.env,
+} = {}) {
+  const accounts = listAccounts({ env });
+  if (accounts.length === 0) {
+    return {
+      login: null,
+      reason: `no GitHub account is logged in to gh, so ${repo} cannot be checked`,
+    };
+  }
+  for (const a of orderCandidates(accounts, preferred)) {
+    const token = tokenFor(a.login, env);
+    if (token && canRead(repo, token, env)) return { login: a.login, reason: `can read ${repo}` };
+  }
+  return {
+    login: null,
+    reason: `none of the logged-in GitHub accounts (${accounts.map((a) => a.login).join(", ")}) can read ${repo}`,
+  };
+}
+
+function cacheFresh(u, repo, now) {
+  const at = Date.parse(u?.loginCheckedAt || "");
+  if (Number.isNaN(at)) return false;
+  if ((u.loginRepo || ACCESS_REPO_DEFAULT) !== repo) return false;
+  const ttl = u.login ? LOGIN_TTL_MS : NO_LOGIN_TTL_MS;
+  return now - at < ttl && now >= at;
+}
+
+function persist(prefsPath, patch, env) {
+  try {
+    const written = updateJsonFileSync(
+      prefsPath,
+      (j) => {
+        if (!j || typeof j !== "object" || Array.isArray(j)) return undefined;
+        j.global = j.global || {};
+        j.global.usageLog = { ...(j.global.usageLog || {}), ...patch };
+        return j;
+      },
+      { mode: 0o600, timeoutMs: lockTimeoutFrom(env) },
+    );
+    return written !== undefined;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The login to report under, from the prefs cache when it is fresh, otherwise
+ * checked live and written back. Never throws.
+ */
+export function resolveReportingLogin({
+  prefsPath = defaultPrefsPath(),
+  env = process.env,
+  refresh = false,
+  now = Date.now(),
+  write = true,
+} = {}) {
+  const prefs = existsSync(prefsPath) ? readJson(prefsPath) : null;
+  const u = prefs?.global?.usageLog || {};
+  const repo = accessRepoOf(prefs);
+  if (!refresh && cacheFresh(u, repo, now)) {
+    if (typeof u.login === "string" && LOGIN_RE.test(u.login)) {
+      return { login: u.login, reason: `cached: can read ${repo}`, cached: true };
+    }
+    return {
+      login: null,
+      reason: u.loginReason || `cached: no logged-in GitHub account can read ${repo}`,
+      cached: true,
+    };
+  }
+  const preferred = typeof u.reportAs === "string" && u.reportAs.trim() ? u.reportAs.trim() : null;
+  const result = checkAccess({ repo, preferred, env });
+  if (write && prefs) {
+    persist(
+      prefsPath,
+      {
+        login: result.login,
+        loginRepo: repo,
+        loginCheckedAt: new Date(now).toISOString(),
+        loginReason: result.login ? null : result.reason,
+      },
+      env,
+    );
+  }
+  return { ...result, cached: false };
+}
+
+function main(argv) {
+  const opts = { refresh: false, json: false, prefs: null };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === "--refresh") opts.refresh = true;
+    else if (a === "--json") opts.json = true;
+    else if (a === "--prefs") opts.prefs = argv[++i];
+  }
+  const r = resolveReportingLogin({
+    prefsPath: opts.prefs || defaultPrefsPath(),
+    refresh: opts.refresh,
+  });
+  if (opts.json) {
+    process.stdout.write(
+      `${JSON.stringify({ login: r.login, reason: r.reason, cached: r.cached })}\n`,
+    );
+  } else if (r.login) {
+    process.stdout.write(`usage identity: ${r.login} (${r.reason})\n`);
+  } else {
+    process.stdout.write(`usage identity: none - ${r.reason}; nothing will be reported\n`);
+  }
+  return 0;
+}
+
+function isEntrypoint() {
+  const arg = process.argv[1];
+  if (!arg) return false;
+  try {
+    return import.meta.url === pathToFileURL(arg).href;
+  } catch {
+    return false;
+  }
+}
+
+if (isEntrypoint()) {
+  process.exitCode = main(process.argv.slice(2));
+}