@mmerterden/multi-agent-pipeline 20.20.0 → 20.22.0

package/pipeline/scripts/product-context.mjs

@@ -0,0 +1,539 @@
+#!/usr/bin/env node
+/**
+ * product-context.mjs  -  which other repositories a run reads, and what it
+ * learned from them.
+ *
+ * A product is made of several repositories (iOS app, Android app, web client,
+ * backend services, a shared resources repo). A run develops in some of them;
+ * planning reads all the others, read-only, at their latest integration branch,
+ * through the toolkit's repo_* tools. This script owns the deterministic half:
+ *
+ *   refs     the reference set: product repos minus the repos this run develops.
+ *            Symmetric by construction - whichever stack is primary, the rest
+ *            are references. Exit 2 when nothing is mapped.
+ *   suggest  candidate repos for a product that is not mapped yet, by name core
+ *            from a repo-cache listing. Never guesses a stack.
+ *   needs-mapping  whether the project has never answered the mapping question.
+ *   learn    write a confirmed product map into the preferences file.
+ *   decline  remember that the project is not part of a product.
+ *   record   normalise a repo_find_keys result into state.productContext and
+ *            append each finding to the related repo's own knowledge directory,
+ *            keyed by the sha it was read at.
+ *   recall   findings already recorded for a repo at a given sha.
+ *
+ * Knowledge lands in $HOME/.claude/knowledge/<repo-name>/product-context.jsonl,
+ * the same directory that repo's own runs read, so what an iOS run learns about
+ * Android is there for the next Android run, and the other way round. A finding
+ * is reused only while the sha matches: a newer commit on the branch makes
+ * every older finding invisible rather than wrong.
+ *
+ * Usage:
+ *   product-context.mjs refs    --project <key> [--developed <remote>]... [--prefs <file>]
+ *   product-context.mjs suggest --primary <repo-name> --repos <repo-cache.json>
+ *   product-context.mjs needs-mapping --project <key> [--developed <remote>]... [--prefs <file>]   exit 0 ask, 3 already answered
+ *   product-context.mjs learn   --project <key> --product <name> --repos <repos.json> [--prefs <file>]
+ *   product-context.mjs decline --project <key> [--prefs <file>]
+ *   product-context.mjs record  --in <find-keys.json> [--refs <refs.json>] [--task <id>] [--knowledge <dir>]
+ *   product-context.mjs recall  --remote <url> --sha <sha> --keys <k1,k2> [--knowledge <dir>]
+ *
+ * Exit codes: 0 ok, 1 bad input, 2 nothing mapped (refs), 3 already answered (needs-mapping).
+ */
+
+import { execFileSync } from "node:child_process";
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const STACKS = ["ios", "android", "web", "backend", "resources"];
+const AUTH_SCHEMES = ["basic", "bearer"];
+const KNOWLEDGE_FILE = "product-context.jsonl";
+
+export function canonicalRemote(remote) {
+  let host;
+  let path = String(remote ?? "").trim();
+  const scp = /^[^@/]+@([^:/]+):(.+)$/.exec(path);
+  if (scp) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    try {
+      const u = new URL(path);
+      host = u.hostname;
+      path = u.pathname;
+    } catch {
+      return path.toLowerCase().replace(/\.git\/?$/, "");
+    }
+  }
+  const segments = path
+    .toLowerCase()
+    .replace(/\.git\/?$/, "")
+    .split("/")
+    .filter(Boolean);
+  if (segments[0] === "scm") segments.shift();
+  return [host.toLowerCase(), ...segments].join("/");
+}
+
+/**
+ * The knowledge directory name for a remote: its repository name as the remote
+ * spells it. It can differ from a local checkout's folder name; recall uses the
+ * same function, so writer and reader always agree. Never `.` or `..`.
+ */
+export function repoSlug(remote) {
+  const parts = canonicalRemote(remote).split("/");
+  const slug = parts[parts.length - 1].replace(/[^a-z0-9._-]/g, "_");
+  return /^\.*$/.test(slug) ? `_${slug.length}` : slug;
+}
+
+export function validRemote(remote) {
+  const r = String(remote ?? "");
+  if (!r || r.startsWith("-") || /\s/.test(r) || r.includes("::")) return false;
+  if (/^https:\/\//i.test(r)) {
+    if (/\\|%5c/i.test(r)) return false;
+    try {
+      const u = new URL(r);
+      return !u.username && !u.password;
+    } catch {
+      return false;
+    }
+  }
+  if (/^file:\/\//i.test(r)) return process.env.MCP_TOOLKIT_REPO_ALLOW_FILE === "1";
+  return /^ssh:\/\//i.test(r) || /^[A-Za-z0-9._-]+@[A-Za-z0-9.-]+:[^/].*/.test(r);
+}
+
+function reference(repo, source) {
+  const out = { stack: repo.stack || "unknown", remote: repo.remote };
+  if (repo.branch) out.branch = repo.branch;
+  if (repo.credential) out.credential = repo.credential;
+  if (repo.authScheme) out.auth_scheme = repo.authScheme;
+  if (repo.username) out.username = repo.username;
+  if (source) out.source = source;
+  const { stack: _stack, source: _source, ...spec } = out;
+  out.spec = spec;
+  return out;
+}
+
+function defaultOriginOf(path) {
+  try {
+    return (
+      execFileSync("git", ["-C", path, "remote", "get-url", "origin"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      }).trim() || null
+    );
+  } catch {
+    return null;
+  }
+}
+
+function productFor(prefs, projectKey, developed) {
+  const products = prefs?.global?.products || {};
+  const named = prefs?.projects?.[projectKey]?.product;
+  if (named && products[named]) return named;
+  for (const [name, p] of Object.entries(products)) {
+    const remotes = new Set((p.repos || []).map((r) => canonicalRemote(r.remote)));
+    if (developed.some((d) => remotes.has(d))) return name;
+  }
+  return null;
+}
+
+/**
+ * Product repos minus the developed ones. Without a product, the legacy
+ * per-project keys are read so an existing setup keeps a reference set: each
+ * counterpartRoots path through its origin remote, each webRepos entry only
+ * when it is already a remote URL. Anything that cannot become a remote is
+ * returned in unresolved[] rather than dropped.
+ */
+export function referenceSet(
+  prefs,
+  projectKey,
+  developedRemotes = [],
+  { originOf = defaultOriginOf } = {},
+) {
+  const developed = developedRemotes.map(canonicalRemote);
+  const isDeveloped = (remote) => developed.includes(canonicalRemote(remote));
+  const product = productFor(prefs, projectKey, developed);
+  if (product) {
+    const repos = prefs.global.products[product].repos || [];
+    return {
+      product,
+      references: repos.filter((r) => !isDeveloped(r.remote)).map((r) => reference(r)),
+      unresolved: [],
+    };
+  }
+  const project = prefs?.projects?.[projectKey] || {};
+  const references = [];
+  const unresolved = [];
+  for (const path of project.counterpartRoots || []) {
+    const remote = originOf(path);
+    if (remote && validRemote(remote)) {
+      if (!isDeveloped(remote))
+        references.push(reference({ stack: "unknown", remote }, "counterpartRoots"));
+    } else unresolved.push(`counterpartRoots:${path}`);
+  }
+  for (const entry of project.webRepos || project.frontendRepos || []) {
+    if (validRemote(entry)) {
+      if (!isDeveloped(entry))
+        references.push(reference({ stack: "web", remote: entry }, "webRepos"));
+    } else unresolved.push(`webRepos:${entry}`);
+  }
+  return { product: null, references, unresolved };
+}
+
+const NON_CORE = new Set([
+  "ios",
+  "android",
+  "web",
+  "backend",
+  "api",
+  "app",
+  "apps",
+  "mobile",
+  "new",
+  "next",
+  "legacy",
+  "v2",
+  "v3",
+]);
+
+const nameCore = (name) =>
+  String(name)
+    .toLowerCase()
+    .split(/[-_.]+/)
+    .filter((t) => t && !NON_CORE.has(t));
+
+/**
+ * Repos whose name core starts with the primary repo's name core. The core is
+ * the name without platform and version words, so `acme-shop-ios-new` and
+ * `acme-shop-android` share `acme-shop`, while a repo that merely has Android
+ * markers shares nothing. A primary whose name is only such words matches
+ * nothing rather than everything.
+ */
+export function suggestCandidates(primaryName, repos) {
+  const core = nameCore(primaryName);
+  if (!core.length) return [];
+  return (repos || [])
+    .filter((r) => {
+      const name = String(r.name || r.fullName || "")
+        .split("/")
+        .pop();
+      if (name.toLowerCase() === String(primaryName).toLowerCase()) return false;
+      const t = nameCore(name);
+      return core.every((s, i) => t[i] === s);
+    })
+    .map((r) => ({
+      fullName: r.fullName || r.name,
+      remote: r.cloneUrl || r.remote || null,
+      provider: r.provider || null,
+      stack: "unknown",
+    }));
+}
+
+function httpsHost(remote) {
+  if (!/^https:\/\//i.test(String(remote))) return null;
+  try {
+    return new URL(remote).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Write a confirmed product. A repository may name a credential only when that
+ * key is already bound to the repository's https host in
+ * `prefs.global.credentialHosts`, which `/multi-agent:setup` writes with the
+ * person present. The product map never creates a binding: the repo list is
+ * assembled from picker output and model-written files, and a binding made
+ * there would let any text that reached the planner send a token anywhere.
+ */
+const MAX_PRODUCT_REPOS = 20;
+const CREDENTIAL_FIELDS = ["credential", "authScheme", "username"];
+
+/**
+ * Why a repo entry may not carry its credential, or null when it may: the
+ * remote must be https and its host bound to the key in
+ * `prefs.global.credentialHosts`, which only setup writes. Checked on every
+ * entry a merge produces, so a credential kept from an earlier spelling never
+ * lands on a remote it was not bound for.
+ */
+function credentialProblem(prefs, r) {
+  if (!r.credential) return null;
+  const host = httpsHost(r.remote);
+  const hosts = (prefs?.global?.credentialHosts?.[r.credential] || []).map((h) =>
+    String(h).toLowerCase(),
+  );
+  if (host && hosts.includes(host)) return null;
+  return `credential ${JSON.stringify(r.credential)} is not bound to ${host || r.remote}; bind it in prefs.global.credentialHosts with /multi-agent:setup hosts first`;
+}
+
+export function learnProduct(prefs, projectKey, productName, repos) {
+  if (!productName || !/^[A-Za-z0-9._-]{1,64}$/.test(productName))
+    throw new Error("product name must be 1-64 letters, digits, . _ -");
+  const clean = (repos || []).map((r) => {
+    if (!STACKS.includes(r.stack))
+      throw new Error(`stack ${JSON.stringify(r.stack)} is not one of ${STACKS.join(", ")}`);
+    if (!validRemote(r.remote))
+      throw new Error(
+        `remote ${JSON.stringify(r.remote)} must be https://, ssh:// or user@host:path, without credentials (file:// only with MCP_TOOLKIT_REPO_ALLOW_FILE=1)`,
+      );
+    if (r.authScheme && !AUTH_SCHEMES.includes(r.authScheme))
+      throw new Error(`authScheme must be one of ${AUTH_SCHEMES.join(", ")}`);
+    const problem = credentialProblem(prefs, r);
+    if (problem) throw new Error(problem);
+    const out = { stack: r.stack, remote: r.remote };
+    for (const k of ["branch", "credential", "authScheme", "username"]) if (r[k]) out[k] = r[k];
+    return out;
+  });
+  if (!clean.length) throw new Error("a product needs at least one repo");
+  const next = structuredClone(prefs || {});
+  next.global = next.global || {};
+  const merged = new Map(
+    (next.global.products?.[productName]?.repos || []).map((r) => [canonicalRemote(r.remote), r]),
+  );
+  for (const r of clean) {
+    const key = canonicalRemote(r.remote);
+    const entry = { ...(merged.get(key) || {}), ...r };
+    if (credentialProblem(prefs, entry)) for (const k of CREDENTIAL_FIELDS) delete entry[k];
+    merged.set(key, entry);
+  }
+  if (merged.size > MAX_PRODUCT_REPOS)
+    throw new Error(
+      `a product holds at most ${MAX_PRODUCT_REPOS} repos (one repo_find_keys call reads them all); ${productName} would have ${merged.size}`,
+    );
+  next.global.products = {
+    ...(next.global.products || {}),
+    [productName]: { repos: [...merged.values()] },
+  };
+  next.projects = next.projects || {};
+  next.projects[projectKey] = { ...(next.projects[projectKey] || {}), product: productName };
+  return next;
+}
+
+/** A project is asked once: until it names a product or declines, it needs mapping. */
+export function needsMapping(prefs, projectKey, developedRemotes = []) {
+  const named = prefs?.projects?.[projectKey]?.product;
+  if (named === "") return false;
+  if (typeof named === "string" && prefs?.global?.products?.[named]) return false;
+  return productFor(prefs, projectKey, developedRemotes.map(canonicalRemote)) === null;
+}
+
+/** Remember that a project is not part of a product, so the offer is not repeated. */
+export function declineProduct(prefs, projectKey) {
+  const next = structuredClone(prefs || {});
+  next.projects = next.projects || {};
+  next.projects[projectKey] = { ...(next.projects[projectKey] || {}), product: "" };
+  return next;
+}
+
+const STATUS = {
+  implemented: "implemented",
+  not_found_at_sha: "not-yet-implemented",
+  diverges: "diverges",
+  error: "error",
+};
+
+export function recordFindings(
+  findKeys,
+  {
+    taskId = null,
+    knowledgeRoot = defaultKnowledgeRoot(),
+    now = new Date().toISOString(),
+    refs = [],
+  } = {},
+) {
+  const stackOf = new Map(refs.map((r) => [canonicalRemote(r.remote), r.stack]));
+  const productContext = [];
+  for (const repo of findKeys?.repos || []) {
+    const slug = repoSlug(repo.remote);
+    const stack = stackOf.get(canonicalRemote(repo.remote));
+    const base = { remote: repo.remote, slug, ...(stack ? { stack } : {}) };
+    if (repo.error) {
+      productContext.push({ ...base, error: repo.error });
+      continue;
+    }
+    const keys = (repo.keys || []).map((k) => ({
+      key: k.key,
+      status: STATUS[k.status] || "error",
+      ...(k.note ? { note: String(k.note) } : {}),
+      hits: (k.hits || []).map((h) => ({ path: h.path, line: h.line })),
+    }));
+    productContext.push({
+      ...base,
+      branch: repo.branch,
+      sha: repo.sha,
+      stale: Boolean(repo.stale),
+      keys,
+    });
+    if (repo.stale || !repo.sha) continue;
+    const dir = join(knowledgeRoot, slug);
+    mkdirSync(dir, { recursive: true });
+    const lines = keys
+      .filter((k) => k.status !== "error")
+      .map((k) =>
+        JSON.stringify({
+          remote: canonicalRemote(repo.remote),
+          branch: repo.branch,
+          sha: repo.sha,
+          key: k.key,
+          status: k.status === "diverges" ? "implemented" : k.status,
+          ...(k.note ? { note: k.note } : {}),
+          hits: k.hits,
+          task: taskId,
+          capturedAt: now,
+        }),
+      );
+    if (lines.length) appendFileSync(join(dir, KNOWLEDGE_FILE), `${lines.join("\n")}\n`);
+  }
+  return { productContext };
+}
+
+export function recall({ knowledgeRoot = defaultKnowledgeRoot(), remote, sha, keys = [] }) {
+  const file = join(knowledgeRoot, repoSlug(remote), KNOWLEDGE_FILE);
+  const want = canonicalRemote(remote);
+  const latest = new Map();
+  if (existsSync(file)) {
+    for (const line of readFileSync(file, "utf8").split("\n")) {
+      if (!line) continue;
+      let row;
+      try {
+        row = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (row.remote === want && row.sha === sha && keys.includes(row.key))
+        latest.set(row.key, row);
+    }
+  }
+  return {
+    found: keys.filter((k) => latest.has(k)).map((k) => latest.get(k)),
+    missing: keys.filter((k) => !latest.has(k)),
+  };
+}
+
+function defaultKnowledgeRoot() {
+  return process.env.MULTI_AGENT_KNOWLEDGE_ROOT || join(homedir(), ".claude", "knowledge");
+}
+
+function defaultPrefsPath() {
+  return (
+    process.env.MULTI_AGENT_PREFS || join(homedir(), ".claude", "multi-agent-preferences.json")
+  );
+}
+
+function writePrefsAtomic(file, prefs) {
+  mkdirSync(dirname(file), { recursive: true });
+  const tmp = `${file}.tmp.${process.pid}`;
+  const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
+  writeFileSync(tmp, `${JSON.stringify(prefs, null, 2)}\n`, { mode });
+  chmodSync(tmp, mode);
+  renameSync(tmp, file);
+}
+
+function readJson(file) {
+  return JSON.parse(readFileSync(file, "utf8"));
+}
+
+function parseArgs(argv) {
+  const out = { developed: [] };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith("--")) continue;
+    const key = a.slice(2);
+    const value = argv[i + 1];
+    if (value === undefined || value === "" || value.startsWith("--")) {
+      process.stderr.write(`product-context: --${key} needs a value\n`);
+      process.exit(1);
+    }
+    i += 1;
+    if (key === "developed") out.developed.push(value);
+    else out[key] = value;
+  }
+  return out;
+}
+
+function fail(message) {
+  process.stderr.write(`product-context: ${message}\n`);
+  process.exit(1);
+}
+
+function main() {
+  const [command, ...rest] = process.argv.slice(2);
+  const args = parseArgs(rest);
+  const prefsFile = args.prefs || defaultPrefsPath();
+  const loadPrefs = () =>
+    existsSync(prefsFile) ? readJson(prefsFile) : { global: {}, projects: {} };
+  switch (command) {
+    case "refs": {
+      if (!args.project) fail("refs needs --project");
+      const r = referenceSet(loadPrefs(), args.project, args.developed);
+      process.stdout.write(`${JSON.stringify(r)}\n`);
+      process.exitCode = r.references.length ? 0 : 2;
+      break;
+    }
+    case "suggest": {
+      if (!args.primary || !args.repos) fail("suggest needs --primary and --repos");
+      process.stdout.write(
+        `${JSON.stringify(suggestCandidates(args.primary, readJson(args.repos)))}\n`,
+      );
+      break;
+    }
+    case "learn": {
+      if (!args.project || !args.product || !args.repos)
+        fail("learn needs --project, --product and --repos");
+      let next;
+      try {
+        next = learnProduct(loadPrefs(), args.project, args.product, readJson(args.repos));
+      } catch (e) {
+        fail(e.message);
+      }
+      writePrefsAtomic(prefsFile, next);
+      process.stdout.write(
+        `${JSON.stringify({ product: args.product, repos: next.global.products[args.product].repos.length })}\n`,
+      );
+      break;
+    }
+    case "needs-mapping": {
+      if (!args.project) fail("needs-mapping needs --project");
+      const needed = needsMapping(loadPrefs(), args.project, args.developed);
+      process.stdout.write(`${JSON.stringify({ needsMapping: needed })}\n`);
+      process.exitCode = needed ? 0 : 3;
+      break;
+    }
+    case "decline": {
+      if (!args.project) fail("decline needs --project");
+      writePrefsAtomic(prefsFile, declineProduct(loadPrefs(), args.project));
+      process.stdout.write(`${JSON.stringify({ project: args.project, product: "" })}\n`);
+      break;
+    }
+    case "record": {
+      if (!args.in) fail("record needs --in");
+      const r = recordFindings(readJson(args.in), {
+        taskId: args.task || null,
+        knowledgeRoot: args.knowledge || defaultKnowledgeRoot(),
+        refs: args.refs ? readJson(args.refs).references || [] : [],
+      });
+      process.stdout.write(`${JSON.stringify(r)}\n`);
+      break;
+    }
+    case "recall": {
+      if (!args.remote || !args.sha || !args.keys) fail("recall needs --remote, --sha and --keys");
+      process.stdout.write(
+        `${JSON.stringify(recall({ knowledgeRoot: args.knowledge || defaultKnowledgeRoot(), remote: args.remote, sha: args.sha, keys: args.keys.split(",").filter(Boolean) }))}\n`,
+      );
+      break;
+    }
+    default:
+      fail("usage: product-context.mjs refs|suggest|needs-mapping|learn|decline|record|recall ...");
+  }
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) main();

package/pipeline/scripts/smoke-cross-cli-behavior.sh

@@ -10,6 +10,7 @@
 #   3. No personal-data leaks (hardcoded personal keychain keys, etc.)
 #   4. Canonical placeholders present where required (sanity)
 #   5. Canonical project-name vocabulary in user-facing docs
+#   8. Product context installed on Claude Code, Copilot CLI and Codex CLI
 #
 # Must pass before any `sync` run that touches shared commands.
 #
@@ -34,7 +35,7 @@ if [ -z "${CROSS_CLI_HOME:-}" ] && [ -e "$CHECKOUT/.git" ] && [ -f "$CHECKOUT/in
   INSTALL_HOME=$(mktemp -d "${TMPDIR:-/tmp}/cross-cli-home.XXXXXX")
   trap 'rm -rf "$INSTALL_HOME"' EXIT
   if HOME="$INSTALL_HOME" MULTI_AGENT_SKIP_MCP_REGISTER=1 \
-       node "$CHECKOUT/install.js" --claude --copilot >"$INSTALL_HOME/install.log" 2>&1; then
+       node "$CHECKOUT/install.js" --claude --copilot --codex >"$INSTALL_HOME/install.log" 2>&1; then
     pass "installed this checkout into a temporary home"
   else
     fail "install of this checkout failed: $(tail -3 "$INSTALL_HOME/install.log" | tr '\n' ' ')"
@@ -276,6 +277,43 @@ else
   fail "triage consensus.reviewerCount does not document the 3-reviewer set"
 fi
 
+echo ""
+echo "→ 8. Product context reaches every host"
+# Planning reads the product's other repositories through the toolkit's repo_*
+# tools on every host, so the deterministic half (product-context.mjs) and the
+# Phase 1 step that calls it must be installed wherever the pipeline runs.
+# Copilot installs no multi-agent-refs tree by design; it reads the refs from
+# ~/.claude or GitHub, and its own copy of the review skill carries the step.
+for host in .claude .copilot .codex; do
+  [ -d "$H/$host" ] || { echo "  ↷ SKIP: $host not installed in this home"; continue; }
+  if [ -f "$H/$host/scripts/product-context.mjs" ]; then
+    pass "$host/scripts/product-context.mjs installed"
+  else
+    fail "$host/scripts/product-context.mjs missing"
+  fi
+done
+for host in .claude .codex; do
+  [ -d "$H/$host" ] || continue
+  P1="$H/$host/multi-agent-refs/phases/phase-1-plan.md"
+  if [ -f "$P1" ] && grep -q "Step 1.6  -  Product context" "$P1" && grep -q "product-context.mjs refs" "$P1"; then
+    pass "$host Phase 1 carries the product-context step"
+  else
+    fail "$host Phase 1 lacks the product-context step"
+  fi
+done
+if [ -d "$H/.copilot" ]; then
+  if grep -q "product-context.mjs refs" "$H/.copilot/skills/multi-agent-review/SKILL.md" 2>/dev/null; then
+    pass "Copilot review skill resolves product counterparts"
+  else
+    fail "Copilot review skill does not resolve product counterparts"
+  fi
+fi
+if grep -q '`repo_find_keys`' "$H/.claude/multi-agent-refs/cross-cli-contract.md" 2>/dev/null; then
+  pass "cross-cli contract pins the repo_* toolkit minimum"
+else
+  fail "cross-cli contract does not name the repo_* tools"
+fi
+
 echo ""
 echo "══ cross-cli-behavior smoke: $PASS passed, $FAIL failed ══"
 [ "$FAIL" -eq 0 ]

package/pipeline/scripts/unattended_policy.py

@@ -2644,6 +2644,24 @@ def _toolkit_path_refusal(name, ti, policy, env, cwd):
     return None
 
 
+def _free_routing_on(env):
+    """modelRouting.enabled and modelRouting.free.enabled in the preferences
+    file. The user's own switch, read at call time: off, unreadable or absent
+    all mean off."""
+    env = env if env is not None else os.environ
+    home = env.get("HOME") or os.path.expanduser("~")
+    for path in (env.get("MULTI_AGENT_PREFS"), os.path.join(home, ".claude", "multi-agent-preferences.json")):
+        if not path or not os.path.isfile(path):
+            continue
+        try:
+            with open(path, encoding="utf-8") as fh:
+                routing = (json.load(fh).get("global") or {}).get("modelRouting") or {}
+        except (OSError, ValueError, AttributeError):
+            return False
+        return routing.get("enabled") is True and (routing.get("free") or {}).get("enabled") is True
+    return False
+
+
 def check_toolkit(name, ti, policy, env, depth=0, cwd=None):
     """A multi-agent-toolkit tool call, by its short name (web_goto,
     ios_open_url, agent_run_steps). agent_run_steps dispatches other toolkit
@@ -2653,6 +2671,8 @@ def check_toolkit(name, ti, policy, env, depth=0, cwd=None):
         return f"{name} arguments are not an object the guard can read"
     if name.startswith("research_"):
         return f"{name} sends the query to an outside service"
+    if name == "llm_delegate" and not _free_routing_on(env):
+        return "llm_delegate sends text to a free-model provider; unattended runs allow it only after route-on --free"
     if name == "web_eval":
         return "web_eval runs arbitrary JavaScript that can reach any host; refused unattended"
     if name == "agent_run_steps":

package/pipeline/scripts/validate-code-graph.mjs

@@ -137,7 +137,8 @@ export function validate(obj) {
   if (typeof obj !== "object" || obj === null || Array.isArray(obj))
     return ["root must be an object"];
 
-  if (obj.schemaVersion !== "1.0.0") errors.push(`schemaVersion must be "1.0.0"`);
+  if (!["1.0.0", "1.1.0"].includes(obj.schemaVersion))
+    errors.push(`schemaVersion must be "1.0.0" or "1.1.0"`);
   if (!ALLOWED_STACK.has(obj.stack))
     errors.push(`stack must be one of ${[...ALLOWED_STACK].join(",")}`);
   if (typeof obj.root !== "string" || obj.root.length === 0)

package/pipeline/scripts/validate-diff-risk.mjs

@@ -24,6 +24,7 @@ const ALLOWED_SIGNALS = new Set([
   "ui_critical",
   "migration",
   "test_lines_removed",
+  "dependents_reached",
 ]);
 
 function readInput() {