@mmerterden/multi-agent-pipeline 20.24.0 → 20.25.0

package/pipeline/scripts/uninstall.mjs

@@ -60,6 +60,7 @@ import {
   XCODE_SKILLS_MANIFEST,
 } from "../lib/xcode-plugin.mjs";
 import { createInterface } from "readline";
+import { removeHooks, templateCommands } from "./host-hooks.mjs";
 
 const HOME = process.env.HOME;
 
@@ -104,6 +105,7 @@ export const PIPELINE_RETIRED_SKILL_DIRS = ["valven-rules"];
  */
 export const PIPELINE_TEMPLATE_FILES = [
   "claude-hooks.json",
+  "codex-hooks.json",
   "codex-instructions.md",
   "copilot-instructions.md",
   "multi-agent-autopilot-awake.plist.template",
@@ -781,11 +783,14 @@ function stripManagedBlock(filePath, { hostFile = false } = {}) {
 }
 
 /**
- * Remove the pipeline-added hooks + env from settings.json. Other hooks the
- * user added stay intact.
+ * Remove the pipeline-added hooks + env from settings.json: the gates
+ * install/claude.mjs registers, and every handler whose full command is one
+ * claude-hooks.json registers (setup Step 8 merges those). Other hooks the
+ * user added stay intact, including one inside a group the pipeline uses.
  * @param {string} settingsPath
+ * @param {Set<string>|null} templateCmds  claude-hooks.json's commands
  */
-function cleanClaudeSettings(settingsPath) {
+function cleanClaudeSettings(settingsPath, templateCmds) {
   if (!existsSync(settingsPath)) return;
   let settings;
   try {
@@ -831,6 +836,20 @@ function cleanClaudeSettings(settingsPath) {
     if (settings.hooks && Object.keys(settings.hooks).length === 0) delete settings.hooks;
   }
 
+  if (templateCmds && settings.hooks) {
+    try {
+      const { doc, removed } = removeHooks(settings, templateCmds);
+      if (removed) {
+        settings = doc;
+        touched = true;
+      }
+    } catch {
+      console.log(
+        `    skipped the hook template pass (hooks not in the expected shape): ${settingsPath}`,
+      );
+    }
+  }
+
   if (touched) {
     if (dryRun) {
       report("would update", settingsPath);
@@ -841,6 +860,63 @@ function cleanClaudeSettings(settingsPath) {
   }
 }
 
+/**
+ * The commands a shipped hook template registers, read from the first copy
+ * found: the host's installed templates, the package this script runs from,
+ * or the templates directory beside an installed scripts/. Null when none is
+ * readable.
+ * @param {string} name   template file name
+ * @param {string[]} dirs host template directories, searched first
+ */
+export function shippedHookCommands(name, dirs = []) {
+  const here = import.meta.dirname;
+  const candidates = [
+    ...dirs.map((d) => join(d, name)),
+    join(here, "..", "..", "install", "templates", name),
+    join(here, "..", "templates", name),
+  ];
+  for (const path of candidates) {
+    if (!existsSync(path)) continue;
+    try {
+      const commands = templateCommands(JSON.parse(readFileSync(path, "utf-8")), HOME);
+      if (commands.size) return commands;
+    } catch {
+      // An unreadable copy: try the next one.
+    }
+  }
+  return null;
+}
+
+/**
+ * Take the pipeline's hook handlers out of Codex's hooks.json (host-hooks.mjs
+ * merged them in), matched by the template's full commands; the user's own
+ * hooks stay. Without a template the file is left as it is.
+ * @param {string} hooksPath
+ * @param {Set<string>|null} commands
+ */
+function cleanCodexHooks(hooksPath, commands) {
+  if (!existsSync(hooksPath)) return;
+  if (!commands) {
+    console.log(`    skipped (no codex-hooks.json template to match against): ${hooksPath}`);
+    return;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(readFileSync(hooksPath, "utf-8"));
+  } catch {
+    console.log(`    skipped (unparseable): ${hooksPath}`);
+    return;
+  }
+  const { doc: cleaned, removed } = removeHooks(doc, commands);
+  if (!removed) return;
+  if (dryRun) {
+    report("would update", hooksPath);
+    return;
+  }
+  atomicWrite(hooksPath, JSON.stringify(cleaned, null, 2) + "\n");
+  console.log(`    removed ${removed} pipeline hook(s) from: ${hooksPath}`);
+}
+
 async function confirm(question) {
   if (skipPrompt || dryRun) return true;
   return new Promise((resolve) => {
@@ -910,6 +986,9 @@ export async function main() {
     console.log("  [Claude Code] Removing...");
     deregisterClaudeMcpServer();
     const CLAUDE = join(HOME, ".claude");
+    const claudeHookCommands = shippedHookCommands("claude-hooks.json", [
+      join(CLAUDE, "templates"),
+    ]);
     unlinkClaudeXcodePlugin(HOME);
     rmCommandsPreservingLocalOnly(join(CLAUDE, "commands", "multi-agent"));
     rmIfExists(join(CLAUDE, "scripts"));
@@ -961,7 +1040,7 @@ export async function main() {
     // Agent definitions are FILES; remove only the pipeline-shipped names so
     // user-authored agents survive.
     rmMatchingFiles(join(CLAUDE, "agents"), (name) => PIPELINE_AGENT_FILES.includes(name));
-    cleanClaudeSettings(join(CLAUDE, "settings.json"));
+    cleanClaudeSettings(join(CLAUDE, "settings.json"), claudeHookCommands);
   }
 
   if (forCopilot && HOME) {
@@ -1071,6 +1150,13 @@ export async function main() {
     console.log("  [Codex CLI] Removing from ~/.codex...");
     const CODEX = join(HOME, ".codex");
 
+    // Codex reads hooks from $CODEX_HOME when set, so host-hooks.mjs may have
+    // registered there as well as in ~/.codex.
+    const codexHooks = shippedHookCommands("codex-hooks.json", [join(CODEX, "templates")]);
+    const hooksFiles = new Set([join(CODEX, "hooks.json")]);
+    if (process.env.CODEX_HOME) hooksFiles.add(join(process.env.CODEX_HOME, "hooks.json"));
+    for (const hooksFile of hooksFiles) cleanCodexHooks(hooksFile, codexHooks);
+
     // Wholly pipeline-owned trees.
     rmIfExists(join(CODEX, "multi-agent-refs"));
     rmIfExists(join(CODEX, "scripts"));

package/pipeline/scripts/update-issue-progress.sh

@@ -135,12 +135,10 @@ if [ "$TASK_ID" = "--rewrite" ]; then
 fi
 
 # Resolve agent-state.json. multi-repo-pipeline.sh writes it under a
-# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/)
-# - not the ~/.claude/projects/*/state/ path this used to glob, which no
-# writer in the pipeline ever populates.
-# This globbed ONLY the nested layout. phase-tracker.sh and most Phase 0 paths
-# write flat, so on a real machine the majority of runs resolved to nothing and
-# this script reported "no agent-state.json" for a run whose state existed.
+# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/),
+# while phase-tracker.sh and most Phase 0 paths write it flat; no writer uses
+# ~/.claude/projects/*/state/. ma_resolve_run_file checks both layouts, so a
+# run whose state exists is always found.
 AGENT_STATE="$(ma_resolve_run_file "$TASK_ID" agent-state.json 2>/dev/null || true)"
 
 if [ -z "$AGENT_STATE" ]; then

package/pipeline/scripts/usage-report.mjs

@@ -235,8 +235,8 @@ function invokedCalls(state, { publicPlugins, manifestPath } = {}) {
 }
 
 // The package declares `os: ["darwin"]` and every entry point refuses a
-// non-darwin host, so the branches this used to carry were unreachable. The
-// function and the field stay: the panel groups by `os` and a row with the key
+// non-darwin host, so no other platform gets a branch of its own. The
+// function and the field exist because the panel groups by `os` and a row with the key
 // missing reads as "unknown host" rather than "macOS".
 function detectOs() {
   return platform() === "darwin" ? "macos" : platform();

package/pipeline/skills/.skill-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-10-13T23:27:37Z",
-  "skillCount": 229,
+  "generatedAt": "2026-10-14T08:53:17Z",
+  "skillCount": 230,
   "entries": [
     {
       "path": "shared/core/apple-archive-compliance/SKILL.md",
@@ -59,6 +59,10 @@
       "path": "shared/core/multi-agent-create-jira/SKILL.md",
       "sha256": "5aad0d841e9e5b7140bb441e07819209ca64c5b6fc209d6ad586b5fbb353e377"
     },
+    {
+      "path": "shared/core/multi-agent-deps/SKILL.md",
+      "sha256": "1c583a47a1c1d66f37a581f0436861e511d1272b5014e1bd15397a4b4d6a8553"
+    },
     {
       "path": "shared/core/multi-agent-design-check/SKILL.md",
       "sha256": "8888744fa52e935f53db9a1068e1b18c636b6c9d55b084dabfc19b9ae68bf6f8"
@@ -125,11 +129,11 @@
     },
     {
       "path": "shared/core/multi-agent-model/SKILL.md",
-      "sha256": "88fe1d5676606058d505bee3273bd20a5027a874122ef5e4de21df9d27ac3c6a"
+      "sha256": "57ba710657d74176b0f19d4a97d3183df1f7b0c056eb1eef2792308914be836c"
     },
     {
       "path": "shared/core/multi-agent-postmortem/SKILL.md",
-      "sha256": "5de52f7cca65656061029427232f95a2de4539564d666a4b8c2e129a92cb7bf8"
+      "sha256": "41edd907cbaae1523eab1cd716390c9e9cd889574141cb88c33966e221b0987d"
     },
     {
       "path": "shared/core/multi-agent-prune-logs/SKILL.md",
@@ -169,7 +173,7 @@
     },
     {
       "path": "shared/core/multi-agent-review/SKILL.md",
-      "sha256": "1a22618e6d3d9d07b267bd61fc591bb33726e1d7ef8567285401f61bc7be0ad5"
+      "sha256": "e3a673e13b9b7a227334afe79e20e2be837c0900e16e88003b4692a1d74dea41"
     },
     {
       "path": "shared/core/multi-agent-route-off/SKILL.md",
@@ -177,7 +181,7 @@
     },
     {
       "path": "shared/core/multi-agent-route-on/SKILL.md",
-      "sha256": "97c76d711454e6bc9edfd47344bbeab7f73cf72c116cca92cffacdcda7fe96b1"
+      "sha256": "0435bb53d8c55d20cfdb1bd5ddbd0544bace68041ab45929904d1a38d2f608c6"
     },
     {
       "path": "shared/core/multi-agent-route-status/SKILL.md",
@@ -217,7 +221,7 @@
     },
     {
       "path": "shared/core/multi-agent-setup/SKILL.md",
-      "sha256": "7fa0771c2da6aae2579fe16f170a2af8c2e8dbd4702e11ac02583ce71bbb63c1"
+      "sha256": "28e80bacb521b3c41aac18859ca3921735970b0bf27f064bfc2b496db9f85016"
     },
     {
       "path": "shared/core/multi-agent-stack/SKILL.md",
@@ -237,7 +241,7 @@
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",
-      "sha256": "1e418fe472a93cc7b4b5bc19ff9e9b8b9d89b545e45d343a643f17a492cb0624"
+      "sha256": "76e713bb107d0fa14db67ca3fc67f420a8e831f3c2db85b21fd59acb327f0017"
     },
     {
       "path": "shared/core/multi-agent-test-accessibility/SKILL.md",
@@ -261,7 +265,7 @@
     },
     {
       "path": "shared/core/multi-agent-testflight-validation/SKILL.md",
-      "sha256": "6bfd1569117bfbacb485d831c0b7f262ebb3a2f9471f6177a646f5ce32c06a25"
+      "sha256": "b6c360c330ef0094cd7e7d9624e89624446b048951e43a180766bbe67d1b725c"
     },
     {
       "path": "shared/core/multi-agent-uninstall/SKILL.md",
@@ -273,7 +277,7 @@
     },
     {
       "path": "shared/core/multi-agent/SKILL.md",
-      "sha256": "a39f712426638e7955db9171c950be720f11c861621884e628c81a0b6a49de5d"
+      "sha256": "b2435de3df518efb8ddf9ac89b3089449e46bf55f29220e07a3aa95dfc8cd083"
     },
     {
       "path": "shared/external/accessibility-compliance-accessibility-audit/SKILL.md",

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "skillCount": 229,
+  "skillCount": 230,
   "entries": [
     {
       "name": "accessibility-compliance-accessibility-audit",
@@ -1146,6 +1146,17 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-create-jira/SKILL.md"
     },
+    {
+      "name": "multi-agent-deps",
+      "description": "Bump one dependency, fix only what the bump broke, review, open a PR; rolls back past the fix round cap. SwiftPM, Gradle, npm, pip. Use when a library needs updating.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-deps",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-deps/SKILL.md"
+    },
     {
       "name": "multi-agent-design-check",
       "description": "Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a countable target set, build Debug in a worktree, launch in mock mode, fetch Figma variants, compare each pixel + px-spacing + typography + color, and export a si",

package/pipeline/skills/shared/README.md

@@ -2,11 +2,11 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 229 skills (68 core + 161 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 230 skills (69 core + 161 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
-- **`core/`**  -  68 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
+- **`core/`**  -  69 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
 - **`external/`**  -  161 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
@@ -14,7 +14,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 
 ## Categories
 
-- [Pipeline Orchestration](#pipeline-orchestration)  -  68
+- [Pipeline Orchestration](#pipeline-orchestration)  -  69
 - [iOS / Apple Ecosystem](#ios-apple-ecosystem)  -  94
 - [Android / Kotlin](#android-kotlin)  -  16
 - [Web](#web)  -  10
@@ -40,6 +40,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-channels`](./core/multi-agent-channels/) | `core` | Multi-channel reporter  -  Jira/Confluence/Wiki/PR description. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbuck |
 | [`multi-agent-complaint-analysis`](./core/multi-agent-complaint-analysis/) | `core` | Customer-complaint triage. Ingests complaints (paste, csv/xlsx/txt/json file, Jira issue, Confluence URL), fetches Graylog evidence per trx/ |
 | [`multi-agent-create-jira`](./core/multi-agent-create-jira/) | `core` | Create a standards-compliant Jira issue (Task / Bug / Story): asks the type, mines project conventions, drafts from a standard template with |
+| [`multi-agent-deps`](./core/multi-agent-deps/) | `core` | Bump one dependency, fix only what the bump broke, review, open a PR; rolls back past the fix round cap. SwiftPM, Gradle, npm, pip. Use when |
 | [`multi-agent-design-check`](./core/multi-agent-design-check/) | `core` | Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a c |
 | [`multi-agent-diff-explain`](./core/multi-agent-diff-explain/) | `core` | Map Phase 3 triage findings to branch diff lines. Read-only post-hoc command, used after review to answer 'which finding lines up with which |
 | [`multi-agent-doctor`](./core/multi-agent-doctor/) | `core` | Health check for the installed pipeline: layout, preferences, credentials, hooks and host capabilities, each with one actionable step. Exit  |

package/pipeline/skills/shared/core/multi-agent/SKILL.md

@@ -206,12 +206,12 @@ Per-project input parsing (my-ios-app / my-figma-app / generic), worktree creati
 ### Phase 1: Plan
 Two halves, one phase, one approval gate.
 
-**1a  -  Analysis** (claude-sonnet-5, `explorer` persona)
+**1a  -  Analysis** (claude-sonnet-5-5, `explorer` persona)
 1. Launch **explore agents** (parallel) to scan the codebase: related files, existing patterns and conventions, potential impact areas
 2. Summarize findings
 3. Log: `📊 Phase 1: Plan (analysis)  -  {N} files identified, {summary}`
 
-**1b  -  Planning** (claude-fable-5)
+**1b  -  Planning** (claude-fable-5-1)
 1. Create task breakdown → todos with dependencies
 2. Launch **ios-architect** agent for architecture review (if structural changes)
 3. Determine development approach per todo (new file, modify, refactor)
@@ -221,7 +221,7 @@ Two halves, one phase, one approval gate.
    - **5b  -  Approval loop**: render plan → user: `onayla`/`iptal`/free-text. A free-text edit request → the planning model (Fable) revises the plan → show it again. No iteration cap; user controls exit via `onayla` or `iptal`.
    - Persist `clarificationRounds`, `clarificationQuestions`, `clarificationAnswers`, `planIterations`, `planApprovedAt`, `planEditRequests` to `state.phases["1"]`.
 
-### Phase 2: Dev (claude-sonnet-5)
+### Phase 2: Dev (claude-sonnet-5-5)
 For each todo (respecting dependency order):
 1. Update todo status: `in_progress`
 2. **TDD cycle**: write failing test → verify RED; write minimal code → verify GREEN; refactor if needed
@@ -233,9 +233,9 @@ For each todo (respecting dependency order):
 ### Phase 3: Review (parallel + triage)
 0. **Diff Risk Scoring (advisory)**  -  before reviewer dispatch run `node $HOME/.claude/scripts/diff-risk-score.mjs --base "$BASE_BRANCH" --top 5` and inject the top-N risk-ranked files as a `${PRIORITY_FILES}` block into each reviewer's prompt. Heuristic, deterministic, sub-second, never gates the pipeline. Disabled when `prefs.global.diffRiskAdvisory = false`. Signals: security paths (×3), schema migrations (×4), public API surfaces (×2), no-test-change (×2.5), complexity delta (×1.5), UI-critical paths (×1.5), loc changed (×1).
 1. Launch **code-reviewer** agents in parallel. Reviewer set depends on which CLI is hosting the pipeline:
-   - **Claude Code** (3 reviewers): `claude-fable-5` (deep security + architecture) + `claude-opus-5` (edge cases, different perspective) + `claude-sonnet-5` (quality + correctness)
-   - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-5` + `claude-sonnet-5` (Fable 5 is not offered on Copilot CLI)
-   - Triage: single top-tier pass over merged findings (`claude-fable-5` on Claude Code, `claude-opus-5` on Copilot CLI)
+   - **Claude Code** (3 reviewers): `claude-fable-5-1` (deep security + architecture) + `claude-opus-5-5` (edge cases, different perspective) + `claude-sonnet-5-5` (quality + correctness)
+   - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-4.7` + `claude-sonnet-4.6` (Fable is not offered on Copilot CLI)
+   - Triage: single top-tier pass over merged findings (`claude-fable-5-1` on Claude Code, `claude-opus-4.7` on Copilot CLI)
 2. Collect findings, classify:
    - 🔴 **Blocking** → must fix → back to Phase 2 (max 3 iterations)
    - 🟡 **Important** → fix and re-review

package/pipeline/skills/shared/core/multi-agent-deps/SKILL.md

@@ -0,0 +1,60 @@
+---
+name: multi-agent-deps
+description: "Bump one dependency, fix only what the bump broke, review, open a PR; rolls back past the fix round cap. SwiftPM, Gradle, npm, pip. Use when a library needs updating."
+user-invocable: true
+argument-hint: "[package[@version]] [--major]  -  no package opens a picker over the outdated candidates; --major allows a breaking bump"
+metadata:
+  language: en
+---
+
+# multi-agent deps  -  bump one dependency and fix what it broke
+
+> **Pickers follow** `$HOME/.claude/multi-agent-refs/picker-contract.md`: never a one-option call, and branch on the option selected, not on its text.
+
+**Input**: $ARGUMENTS
+
+> **Language (read FIRST)**: read `prefs.global.outputLanguage` and render every conversational line in it. `AskUserQuestion` renders `question`, option `label`s and `description`s in `outputLanguage`; only `header` stays English (<=12-char chip). Commit messages and branch names stay English. Full contract: `$HOME/.claude/multi-agent-refs/rules.md` "Language Application".
+
+The normal pipeline with a fixed task. Read `$HOME/.claude/multi-agent-refs/features/dep-bump.md` first: it is the contract for every step below (run shape, scope rule, rollback). `dep-bump.mjs` does every deterministic step; never edit a version string or a lockfile by hand.
+
+## Steps
+
+1. **Repo and settings.** Resolve the repo as `/multi-agent` does for a free-text task (`_account-picker.md`, `_repo-picker.md`). Then:
+   ```bash
+   node "$HOME/.claude/scripts/dep-bump.mjs" config            # depBump.maxFixRounds, depBump.queryRegistry
+   node "$HOME/.claude/scripts/dep-bump.mjs" detect --dir "$REPO"
+   ```
+   No ecosystem detected: say so and stop.
+
+2. **Candidates.**
+   ```bash
+   node "$HOME/.claude/scripts/dep-bump.mjs" list --dir "$REPO" [--registry]   # --registry when queryRegistry is true
+   ```
+   Show `registry.note` and every per-package `note`: an offline listing is reported as offline, never as "nothing outdated".
+   - `package@version` given: use it. `package` alone: its `latestInMajor`, else `latest`. Not in the list: stop with the manifests that were read.
+   - No package: a single-select picker over the candidates with a newer version, non-breaking first, each option `name current -> target (risk)`. Two or more options per the picker contract; one candidate is confirmed with a yes/no, none means report "nothing newer found" with the registry note.
+
+3. **Major gate.** Risk `major` or `unknown`, or a prerelease target (`prerelease: true`), needs `--major` in the input or an explicit confirmation naming the versions (`Bump anyway` / `Take {latestInMajor} instead` when one exists / `Cancel`). An autopilot run without `--major` takes `latestInMajor` or stops.
+
+4. **Run the pipeline** with `state.mode = "deps"`, `state.taskType = "chore"`, the free-text task `chore(deps): bump {name} from {current} to {target}` and the branch `chore/deps-{name}-{target}` (kebab rules from Phase 0 Step 4). Phase 0 intake, worktree and tracker run as in `/multi-agent`. Then:
+   - **Phase 1**: the fixed plan from the feature doc, with the changelog excerpt as evidence:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" notes --dir "$WORKTREE" --ecosystem E --name N --from A --to B
+     ```
+   - **Phase 2**: apply first, then the exit gate as written:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" apply --dir "$WORKTREE" --ecosystem E --name N --to B [--allow-major]
+     ```
+     Exit 1: report `error` and `lock.output` (or `dirty`: the worktree had uncommitted changes), stop with nothing to commit. Persist the output to `state.depBump`. Green: no dev agent, on to Phase 3. Red: fix rounds, at most `depBump.maxFixRounds`, each dispatched with the failing log tail, `surface` output, the changelog excerpt and the scope rule (feature doc section 4); after each round:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" scope --dir "$WORKTREE" --log "$GATE_LOG"   # the round's build/test log
+     ```
+     Only the surface recorded by `apply` is in scope. A file listed in `newImporters` with `cited: null` started importing the dependency without an error line behind it: revert it before the next round.
+   - **Cap reached and still red** (or still out of scope): `dep-bump.mjs rollback --dir "$WORKTREE"` (restores the manifest, lockfile and fix files; anything under `kept` is reported, not discarded), set `state.depBump.rolledBack = true`, and end with the report from feature doc section 5. No commit, no push, no PR.
+   - **Phase 3**: standard review. Each `outOfScope` file without a cited error line, and each `newImporters` entry with `cited: null`, is a blocking finding.
+   - **Phase 4**: commit with `commitMessage` from `apply` (plus ` [{jiraId}]` when present). PR body per the feature doc; `Ref:` or `Related:`, never `Closes`, `Fixes` or `Resolves`, and never close an issue.
+   - **Phase 5**: channels as in every mode.
+
+## Report
+
+In `outputLanguage`, at most 10 lines: the dependency, from and to, risk, lockfile command and result, rounds taken against the cap, files changed (in scope / justified), review verdict, and the PR URL or the rollback reason.

package/pipeline/skills/shared/core/multi-agent-model/SKILL.md

@@ -44,8 +44,8 @@ because it does not mean the same thing on all three:
 
 | Host | What `off` does | Why |
 |---|---|---|
-| Claude Code | every `preferredModel: fable` persona (architects, reviewer 1, triage) starts on `opus` | the only host where the rung is Fable 5 |
-| Copilot CLI | nothing | Fable 5 is not offered there; its personas never sat on this rung |
+| Claude Code | every `preferredModel: fable` persona (architects, reviewer 1, triage) starts on `opus` | the only host where the rung is Fable 5.1 |
+| Copilot CLI | nothing | Fable is not offered there; its personas never sat on this rung |
 | Codex CLI | nothing, deliberately | the `fable` rung there means `gpt-5.6 @ xhigh`, a different model on a different account - switching it from a knob named after an Anthropic model would surprise a Codex user |
 
 So on two of the three hosts this command is a **status report**, not a switch,

package/pipeline/skills/shared/core/multi-agent-postmortem/SKILL.md

@@ -18,23 +18,26 @@ deterministic indexer; the model only interprets it.
 **Read-only.** Nothing is sent anywhere: no issue comment, no PR, no channel.
 The one write is the report itself, saved under the run's log directory.
 
-The indexer reads Claude Code session files (`~/.claude/projects/<dir>/<session>.jsonl`).
-On a host that writes none, a run id finds nothing (exit 3); say so and ask for
-a transcript path rather than reporting an empty run.
+The indexer reads Claude Code session files (`~/.claude/projects/<dir>/<session>.jsonl`),
+Copilot CLI session logs (`~/.copilot/session-state/<session>/events.jsonl`) and
+Codex rollouts (`~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl`), detecting the
+format per file. Copilot CLI reports tokens per session, so its totals come from
+the shutdown record. When a run id finds nothing (exit 3), say so and ask for a
+transcript path rather than reporting an empty run.
 
 ## Steps
 
 1. **Resolve the target.**
-   - A path ending in `.jsonl`: index that file (subagent files beside it are
-     included). There is no run directory, so nothing is saved unless the user
+   - A path ending in `.jsonl` (any of the three hosts): index that file
+     (Claude Code subagent files beside it are included). There is no run directory, so nothing is saved unless the user
      names one.
    - A task id or `#N`: locate the run and its transcripts:
      ```bash
      node "$HOME/.claude/scripts/transcript-index.mjs" --run "<id>" --locate
      ```
      `matchedBy: "session"` means the run recorded its session id and the match
-     is exact. `"time-window"` means it did not, so the files are the sessions
-     that ran in the run's worktree or checkout while it was active; say that
+     is exact. `"time-window"` means it did not, so the files are the sessions,
+     on any host, that ran in the run's worktree or checkout while it was active; say that
      this match is a heuristic. Exit 3 with a `reason`: report the reason, and
      offer to take a transcript path instead.
    - No argument: take the most recent run from

package/pipeline/skills/shared/core/multi-agent-review/SKILL.md

@@ -43,14 +43,14 @@ Skip Phase 0-3 and review a diff only. Input shapes: a PR (`#N`, `repo#N`, GitHu
 
    **Claude Code (3 in parallel while the fable rung is on, 2 while it is off).** Resolve the fable slots first; this command has no Phase 0:
    `REVIEW_RUNG=$(bash "$HOME/.claude/lib/model-dispatch.sh" subagent --persona reviewer --default fable)` and the same with `--persona triage` for `TRIAGE_RUNG`. Anything but `fable` drops Agent 1 and runs triage on `TRIAGE_RUNG`.
-   - Agent 1: `claude-fable-5` → security + architecture (only when `REVIEW_RUNG` is `fable`)
-   - Agent 2: `claude-opus-5` → edge cases, different perspective
-   - Agent 3: `claude-sonnet-5` → general quality
+   - Agent 1: `claude-fable-5-1` → security + architecture (only when `REVIEW_RUNG` is `fable`)
+   - Agent 2: `claude-opus-5-5` → edge cases, different perspective
+   - Agent 3: `claude-sonnet-5-5` → general quality
 
    **Copilot CLI (3 in parallel):**
-   - Agent 1: `claude-opus-5` → security + architecture (Fable 5 is not offered on Copilot CLI)
+   - Agent 1: `claude-opus-4.7` → security + architecture (Fable is not offered on Copilot CLI)
    - Agent 2: `gpt-5.4` → edge cases, different perspective
-   - Agent 3: `claude-sonnet-5` → general quality
+   - Agent 3: `claude-sonnet-4.6` → general quality
 
    **Codex CLI (3 in parallel, single vendor):**
    - Agent 1: `gpt-5.6` @ `xhigh` → security + architecture

package/pipeline/skills/shared/core/multi-agent-route-on/SKILL.md

@@ -29,7 +29,7 @@ honoured only at `bulk-read` and `delegate` and only while `--free` is on.
 
 **Rung names are the contract; model ids are not.** `opus` is a rung here and a
 model id in `cost-table.json`, and the second can change without anyone editing
-a rule. Writing `claude-opus-5` into a rule pins a decision to a string that will
+a rule. Writing `claude-opus-5-5` into a rule pins a decision to a string that will
 go stale.
 
 Set rules with:

package/pipeline/skills/shared/core/multi-agent-setup/SKILL.md

@@ -322,14 +322,16 @@ On a new machine: (1) `npx @{npm-scope}/multi-agent-pipeline install`; (2) `/mul
 
 All tokens are optional in the sense that every service can be answered with Skip  -  but the ASKING is not optional: the Step 3 sequential loop still walks every missing service one by one (token → author → host). Phase 0 re-asks at runtime only for tokens the user skipped here.
 
-### Step 8  -  Enforcement hooks (optional, Claude Code)
+### Step 8  -  Enforcement hooks (optional)
 
-Offer to merge `$HOME/.claude/templates/claude-hooks.json`: three `PreToolUse` gates that block on a non-zero exit (secret scan, agent-guard, read-size) plus four hooks that block nothing (`PreCompact`, `SessionEnd`, `SessionStart`, `PostToolUse`). What each does: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
+On Claude Code, offer to merge `$HOME/.claude/templates/claude-hooks.json`: three blocking `PreToolUse` gates (secret scan, agent-guard, read-size) plus four non-blocking hooks (`PreCompact`, `SessionEnd`, `SessionStart`, `PostToolUse`). What each does: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
 
 - Ask (picker): "Install the pipeline's hooks into `~/.claude/settings.json`?" Default Yes.
-- On Yes, deep-merge EVERY event in the template's `hooks` object, not `PreToolUse` alone - merging one event silently drops the capture hooks. Preserve existing hooks; never duplicate a matcher already calling the same script.
-- Say what the merge does NOT cover: only the three gates need no run-specific arguments, so only they are hookable; the rest are phase-enforced.
-- Say what it does not turn on: the read-size gate is inert until `prefs.global.bulkRead.mode` is set. Recommend `observe` first. Why, and the Phase 3 exemption: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
+- On Yes, deep-merge EVERY event in the template's `hooks` object (merging `PreToolUse` alone drops the capture hooks); keep existing hooks, never duplicate a matcher calling the same script.
+- Say only the three gates are hookable (no run-specific arguments); the rest are phase-enforced.
+- Say the read-size gate stays inert until `prefs.global.bulkRead.mode` is set; recommend `observe` first (why, and the Phase 3 exemption: `picker-contract.md`).
+
+Codex: offer only the syntax gate, then run `node "$HOME/.codex/scripts/host-hooks.mjs" install --host codex`. Copilot CLI: offer no hook (it discards `postToolUse` output as of 1.0.45).
 
 ### Step 9  -  Default stack plugin enablement
 

package/pipeline/skills/shared/core/multi-agent-sync/SKILL.md

@@ -33,7 +33,7 @@ Run all steps automatically:
 ```
 Step 0: DOCTOR      node $HOME/.claude/scripts/doctor.mjs  -  exit 2 or 4 STOPS the sync
 Step 1: DETECT      Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 65 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 66 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + sub-command specs as refs + agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub)
 Step 3d: DEV-TOOLKIT Companion MCP server -> detect movement, ship gates, commit + publish
@@ -229,12 +229,12 @@ When invoked with the `release` argument:
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**65 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**66 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off,
 autopilot-on, autopilot-status, bug-bash, build-optimize, channels, complaint-analysis,
-create-jira, design-check, diff-explain, doctor, estimate, feedback, forget,
+create-jira, deps, design-check, diff-explain, doctor, estimate, feedback, forget,
 garbage-collect, graph, help, ios-coding-standard, issue, jira, kill,
 language, log, manual-test, model, postmortem, prune-logs,
 prune-prompts, purge, refactor, research, resume, review,

package/pipeline/skills/shared/core/multi-agent-testflight-validation/SKILL.md

@@ -9,10 +9,9 @@ metadata:
 
 # multi-agent-testflight-validation  -  iOS alias for store-ready
 
-This skill is an alias. The implementation it used to carry was merged into
+This skill is an alias. The implementation lives in
 `multi-agent-store-ready`, which runs the same three gates on iOS and adds the
-Android side, so there is one flow to maintain instead of two that had already
-started to drift.
+Android side, so there is one flow to maintain instead of two that drift.
 
 The name is kept because it is the one people reach for when the target is
 TestFlight, and removing a surface is a breaking change.

package/pipeline/skills/shared/external/ios-coding-standard/references/rules.yml

@@ -704,7 +704,7 @@ rules:
     enforcement: judgement
     rationale: testability
     check: >
-      Two things used to be one rule here, and conflating them pushed modules toward the wrong fix
+      Two concerns meet in this rule, and conflating them pushes modules toward the wrong fix
       in both directions. Separate them:
       **The failure vocabulary is module-scoped.** The set of ways a call can fail  -  offline,
       timeout, unauthorised, not-found, conflict, server, unknown  -  is one type the whole module
@@ -925,7 +925,7 @@ rules:
     check: >
       When the app ships a wrapper for a platform affordance  -  a sheet, a date picker, a toast -
       a feature module calls the wrapper, never the OS API underneath. The wrapper exists
-      because the OS changed the affordance once already and will again: iOS 26 forced a
+      because the OS changes the affordance between releases: iOS 26 forced a
       Liquid-Glass inset onto partial-detent sheets with no opt-out, which put a gap down the
       side and bottom of every raw `.sheet` and swallowed a pushed picker's selection.
       The tell that this rule was skipped: one module's sheets look different from the rest of

package/pipeline/skills/skills-index.md

@@ -3,7 +3,7 @@
 > Auto-generated by `pipeline/scripts/build-skills-index.mjs`  -  do not hand-edit.
 > Regenerate with `node pipeline/scripts/build-skills-index.mjs`.
 
-**229 skills** across 2 groups.
+**230 skills** across 2 groups.
 
 | Group | Name | Platform | Description |
 |-------|------|----------|-------------|
@@ -111,6 +111,7 @@
 | core | `multi-agent-channels` |  -  | Multi-channel reporter  -  Jira/Confluence/Wiki/PR description. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbuck |
 | core | `multi-agent-complaint-analysis` |  -  | Customer-complaint triage. Ingests complaints (paste, csv/xlsx/txt/json file, Jira issue, Confluence URL), fetches Graylog evidence per trx/ |
 | core | `multi-agent-create-jira` |  -  | Create a standards-compliant Jira issue (Task / Bug / Story): asks the type, mines project conventions, drafts from a standard template with |
+| core | `multi-agent-deps` |  -  | Bump one dependency, fix only what the bump broke, review, open a PR; rolls back past the fix round cap. SwiftPM, Gradle, npm, pip. Use when |
 | core | `multi-agent-design-check` |  -  | Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a c |
 | core | `multi-agent-diff-explain` |  -  | Map Phase 3 triage findings to branch diff lines. Read-only post-hoc command, used after review to answer 'which finding lines up with which |
 | core | `multi-agent-doctor` |  -  | Health check for the installed pipeline: layout, preferences, credentials, hooks and host capabilities, each with one actionable step. Exit  |