@mmerterden/multi-agent-pipeline 20.24.0 → 20.25.1

package/pipeline/scripts/uninstall.mjs

@@ -60,6 +60,7 @@ import {
   XCODE_SKILLS_MANIFEST,
 } from "../lib/xcode-plugin.mjs";
 import { createInterface } from "readline";
+import { removeHooks, templateCommands } from "./host-hooks.mjs";
 
 const HOME = process.env.HOME;
 
@@ -104,6 +105,7 @@ export const PIPELINE_RETIRED_SKILL_DIRS = ["valven-rules"];
  */
 export const PIPELINE_TEMPLATE_FILES = [
   "claude-hooks.json",
+  "codex-hooks.json",
   "codex-instructions.md",
   "copilot-instructions.md",
   "multi-agent-autopilot-awake.plist.template",
@@ -781,11 +783,14 @@ function stripManagedBlock(filePath, { hostFile = false } = {}) {
 }
 
 /**
- * Remove the pipeline-added hooks + env from settings.json. Other hooks the
- * user added stay intact.
+ * Remove the pipeline-added hooks + env from settings.json: the gates
+ * install/claude.mjs registers, and every handler whose full command is one
+ * claude-hooks.json registers (setup Step 8 merges those). Other hooks the
+ * user added stay intact, including one inside a group the pipeline uses.
  * @param {string} settingsPath
+ * @param {Set<string>|null} templateCmds  claude-hooks.json's commands
  */
-function cleanClaudeSettings(settingsPath) {
+function cleanClaudeSettings(settingsPath, templateCmds) {
   if (!existsSync(settingsPath)) return;
   let settings;
   try {
@@ -831,6 +836,20 @@ function cleanClaudeSettings(settingsPath) {
     if (settings.hooks && Object.keys(settings.hooks).length === 0) delete settings.hooks;
   }
 
+  if (templateCmds && settings.hooks) {
+    try {
+      const { doc, removed } = removeHooks(settings, templateCmds);
+      if (removed) {
+        settings = doc;
+        touched = true;
+      }
+    } catch {
+      console.log(
+        `    skipped the hook template pass (hooks not in the expected shape): ${settingsPath}`,
+      );
+    }
+  }
+
   if (touched) {
     if (dryRun) {
       report("would update", settingsPath);
@@ -841,6 +860,63 @@ function cleanClaudeSettings(settingsPath) {
   }
 }
 
+/**
+ * The commands a shipped hook template registers, read from the first copy
+ * found: the host's installed templates, the package this script runs from,
+ * or the templates directory beside an installed scripts/. Null when none is
+ * readable.
+ * @param {string} name   template file name
+ * @param {string[]} dirs host template directories, searched first
+ */
+export function shippedHookCommands(name, dirs = []) {
+  const here = import.meta.dirname;
+  const candidates = [
+    ...dirs.map((d) => join(d, name)),
+    join(here, "..", "..", "install", "templates", name),
+    join(here, "..", "templates", name),
+  ];
+  for (const path of candidates) {
+    if (!existsSync(path)) continue;
+    try {
+      const commands = templateCommands(JSON.parse(readFileSync(path, "utf-8")), HOME);
+      if (commands.size) return commands;
+    } catch {
+      // An unreadable copy: try the next one.
+    }
+  }
+  return null;
+}
+
+/**
+ * Take the pipeline's hook handlers out of Codex's hooks.json (host-hooks.mjs
+ * merged them in), matched by the template's full commands; the user's own
+ * hooks stay. Without a template the file is left as it is.
+ * @param {string} hooksPath
+ * @param {Set<string>|null} commands
+ */
+function cleanCodexHooks(hooksPath, commands) {
+  if (!existsSync(hooksPath)) return;
+  if (!commands) {
+    console.log(`    skipped (no codex-hooks.json template to match against): ${hooksPath}`);
+    return;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(readFileSync(hooksPath, "utf-8"));
+  } catch {
+    console.log(`    skipped (unparseable): ${hooksPath}`);
+    return;
+  }
+  const { doc: cleaned, removed } = removeHooks(doc, commands);
+  if (!removed) return;
+  if (dryRun) {
+    report("would update", hooksPath);
+    return;
+  }
+  atomicWrite(hooksPath, JSON.stringify(cleaned, null, 2) + "\n");
+  console.log(`    removed ${removed} pipeline hook(s) from: ${hooksPath}`);
+}
+
 async function confirm(question) {
   if (skipPrompt || dryRun) return true;
   return new Promise((resolve) => {
@@ -910,6 +986,9 @@ export async function main() {
     console.log("  [Claude Code] Removing...");
     deregisterClaudeMcpServer();
     const CLAUDE = join(HOME, ".claude");
+    const claudeHookCommands = shippedHookCommands("claude-hooks.json", [
+      join(CLAUDE, "templates"),
+    ]);
     unlinkClaudeXcodePlugin(HOME);
     rmCommandsPreservingLocalOnly(join(CLAUDE, "commands", "multi-agent"));
     rmIfExists(join(CLAUDE, "scripts"));
@@ -961,7 +1040,7 @@ export async function main() {
     // Agent definitions are FILES; remove only the pipeline-shipped names so
     // user-authored agents survive.
     rmMatchingFiles(join(CLAUDE, "agents"), (name) => PIPELINE_AGENT_FILES.includes(name));
-    cleanClaudeSettings(join(CLAUDE, "settings.json"));
+    cleanClaudeSettings(join(CLAUDE, "settings.json"), claudeHookCommands);
   }
 
   if (forCopilot && HOME) {
@@ -1071,6 +1150,13 @@ export async function main() {
     console.log("  [Codex CLI] Removing from ~/.codex...");
     const CODEX = join(HOME, ".codex");
 
+    // Codex reads hooks from $CODEX_HOME when set, so host-hooks.mjs may have
+    // registered there as well as in ~/.codex.
+    const codexHooks = shippedHookCommands("codex-hooks.json", [join(CODEX, "templates")]);
+    const hooksFiles = new Set([join(CODEX, "hooks.json")]);
+    if (process.env.CODEX_HOME) hooksFiles.add(join(process.env.CODEX_HOME, "hooks.json"));
+    for (const hooksFile of hooksFiles) cleanCodexHooks(hooksFile, codexHooks);
+
     // Wholly pipeline-owned trees.
     rmIfExists(join(CODEX, "multi-agent-refs"));
     rmIfExists(join(CODEX, "scripts"));

package/pipeline/scripts/update-issue-progress.sh

@@ -135,12 +135,10 @@ if [ "$TASK_ID" = "--rewrite" ]; then
 fi
 
 # Resolve agent-state.json. multi-repo-pipeline.sh writes it under a
-# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/)
-# - not the ~/.claude/projects/*/state/ path this used to glob, which no
-# writer in the pipeline ever populates.
-# This globbed ONLY the nested layout. phase-tracker.sh and most Phase 0 paths
-# write flat, so on a real machine the majority of runs resolved to nothing and
-# this script reported "no agent-state.json" for a run whose state existed.
+# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/),
+# while phase-tracker.sh and most Phase 0 paths write it flat; no writer uses
+# ~/.claude/projects/*/state/. ma_resolve_run_file checks both layouts, so a
+# run whose state exists is always found.
 AGENT_STATE="$(ma_resolve_run_file "$TASK_ID" agent-state.json 2>/dev/null || true)"
 
 if [ -z "$AGENT_STATE" ]; then

package/pipeline/scripts/usage-report.mjs

@@ -235,8 +235,8 @@ function invokedCalls(state, { publicPlugins, manifestPath } = {}) {
 }
 
 // The package declares `os: ["darwin"]` and every entry point refuses a
-// non-darwin host, so the branches this used to carry were unreachable. The
-// function and the field stay: the panel groups by `os` and a row with the key
+// non-darwin host, so no other platform gets a branch of its own. The
+// function and the field exist because the panel groups by `os` and a row with the key
 // missing reads as "unknown host" rather than "macOS".
 function detectOs() {
   return platform() === "darwin" ? "macos" : platform();

package/pipeline/skills/.skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-10-13T23:27:37Z",
+  "generatedAt": "2026-10-14T13:33:28Z",
   "skillCount": 229,
   "entries": [
     {
@@ -125,11 +125,11 @@
     },
     {
       "path": "shared/core/multi-agent-model/SKILL.md",
-      "sha256": "88fe1d5676606058d505bee3273bd20a5027a874122ef5e4de21df9d27ac3c6a"
+      "sha256": "57ba710657d74176b0f19d4a97d3183df1f7b0c056eb1eef2792308914be836c"
     },
     {
       "path": "shared/core/multi-agent-postmortem/SKILL.md",
-      "sha256": "5de52f7cca65656061029427232f95a2de4539564d666a4b8c2e129a92cb7bf8"
+      "sha256": "41edd907cbaae1523eab1cd716390c9e9cd889574141cb88c33966e221b0987d"
     },
     {
       "path": "shared/core/multi-agent-prune-logs/SKILL.md",
@@ -169,7 +169,7 @@
     },
     {
       "path": "shared/core/multi-agent-review/SKILL.md",
-      "sha256": "1a22618e6d3d9d07b267bd61fc591bb33726e1d7ef8567285401f61bc7be0ad5"
+      "sha256": "e3a673e13b9b7a227334afe79e20e2be837c0900e16e88003b4692a1d74dea41"
     },
     {
       "path": "shared/core/multi-agent-route-off/SKILL.md",
@@ -177,7 +177,7 @@
     },
     {
       "path": "shared/core/multi-agent-route-on/SKILL.md",
-      "sha256": "97c76d711454e6bc9edfd47344bbeab7f73cf72c116cca92cffacdcda7fe96b1"
+      "sha256": "0435bb53d8c55d20cfdb1bd5ddbd0544bace68041ab45929904d1a38d2f608c6"
     },
     {
       "path": "shared/core/multi-agent-route-status/SKILL.md",
@@ -217,7 +217,7 @@
     },
     {
       "path": "shared/core/multi-agent-setup/SKILL.md",
-      "sha256": "7fa0771c2da6aae2579fe16f170a2af8c2e8dbd4702e11ac02583ce71bbb63c1"
+      "sha256": "28e80bacb521b3c41aac18859ca3921735970b0bf27f064bfc2b496db9f85016"
     },
     {
       "path": "shared/core/multi-agent-stack/SKILL.md",
@@ -261,7 +261,7 @@
     },
     {
       "path": "shared/core/multi-agent-testflight-validation/SKILL.md",
-      "sha256": "6bfd1569117bfbacb485d831c0b7f262ebb3a2f9471f6177a646f5ce32c06a25"
+      "sha256": "b6c360c330ef0094cd7e7d9624e89624446b048951e43a180766bbe67d1b725c"
     },
     {
       "path": "shared/core/multi-agent-uninstall/SKILL.md",
@@ -273,7 +273,7 @@
     },
     {
       "path": "shared/core/multi-agent/SKILL.md",
-      "sha256": "a39f712426638e7955db9171c950be720f11c861621884e628c81a0b6a49de5d"
+      "sha256": "b2435de3df518efb8ddf9ac89b3089449e46bf55f29220e07a3aa95dfc8cd083"
     },
     {
       "path": "shared/external/accessibility-compliance-accessibility-audit/SKILL.md",

package/pipeline/skills/shared/core/multi-agent/SKILL.md

@@ -206,12 +206,12 @@ Per-project input parsing (my-ios-app / my-figma-app / generic), worktree creati
 ### Phase 1: Plan
 Two halves, one phase, one approval gate.
 
-**1a  -  Analysis** (claude-sonnet-5, `explorer` persona)
+**1a  -  Analysis** (claude-sonnet-5-5, `explorer` persona)
 1. Launch **explore agents** (parallel) to scan the codebase: related files, existing patterns and conventions, potential impact areas
 2. Summarize findings
 3. Log: `📊 Phase 1: Plan (analysis)  -  {N} files identified, {summary}`
 
-**1b  -  Planning** (claude-fable-5)
+**1b  -  Planning** (claude-fable-5-1)
 1. Create task breakdown → todos with dependencies
 2. Launch **ios-architect** agent for architecture review (if structural changes)
 3. Determine development approach per todo (new file, modify, refactor)
@@ -221,7 +221,7 @@ Two halves, one phase, one approval gate.
    - **5b  -  Approval loop**: render plan → user: `onayla`/`iptal`/free-text. A free-text edit request → the planning model (Fable) revises the plan → show it again. No iteration cap; user controls exit via `onayla` or `iptal`.
    - Persist `clarificationRounds`, `clarificationQuestions`, `clarificationAnswers`, `planIterations`, `planApprovedAt`, `planEditRequests` to `state.phases["1"]`.
 
-### Phase 2: Dev (claude-sonnet-5)
+### Phase 2: Dev (claude-sonnet-5-5)
 For each todo (respecting dependency order):
 1. Update todo status: `in_progress`
 2. **TDD cycle**: write failing test → verify RED; write minimal code → verify GREEN; refactor if needed
@@ -233,9 +233,9 @@ For each todo (respecting dependency order):
 ### Phase 3: Review (parallel + triage)
 0. **Diff Risk Scoring (advisory)**  -  before reviewer dispatch run `node $HOME/.claude/scripts/diff-risk-score.mjs --base "$BASE_BRANCH" --top 5` and inject the top-N risk-ranked files as a `${PRIORITY_FILES}` block into each reviewer's prompt. Heuristic, deterministic, sub-second, never gates the pipeline. Disabled when `prefs.global.diffRiskAdvisory = false`. Signals: security paths (×3), schema migrations (×4), public API surfaces (×2), no-test-change (×2.5), complexity delta (×1.5), UI-critical paths (×1.5), loc changed (×1).
 1. Launch **code-reviewer** agents in parallel. Reviewer set depends on which CLI is hosting the pipeline:
-   - **Claude Code** (3 reviewers): `claude-fable-5` (deep security + architecture) + `claude-opus-5` (edge cases, different perspective) + `claude-sonnet-5` (quality + correctness)
-   - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-5` + `claude-sonnet-5` (Fable 5 is not offered on Copilot CLI)
-   - Triage: single top-tier pass over merged findings (`claude-fable-5` on Claude Code, `claude-opus-5` on Copilot CLI)
+   - **Claude Code** (3 reviewers): `claude-fable-5-1` (deep security + architecture) + `claude-opus-5-5` (edge cases, different perspective) + `claude-sonnet-5-5` (quality + correctness)
+   - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-4.7` + `claude-sonnet-4.6` (Fable is not offered on Copilot CLI)
+   - Triage: single top-tier pass over merged findings (`claude-fable-5-1` on Claude Code, `claude-opus-4.7` on Copilot CLI)
 2. Collect findings, classify:
    - 🔴 **Blocking** → must fix → back to Phase 2 (max 3 iterations)
    - 🟡 **Important** → fix and re-review

package/pipeline/skills/shared/core/multi-agent-model/SKILL.md

@@ -44,8 +44,8 @@ because it does not mean the same thing on all three:
 
 | Host | What `off` does | Why |
 |---|---|---|
-| Claude Code | every `preferredModel: fable` persona (architects, reviewer 1, triage) starts on `opus` | the only host where the rung is Fable 5 |
-| Copilot CLI | nothing | Fable 5 is not offered there; its personas never sat on this rung |
+| Claude Code | every `preferredModel: fable` persona (architects, reviewer 1, triage) starts on `opus` | the only host where the rung is Fable 5.1 |
+| Copilot CLI | nothing | Fable is not offered there; its personas never sat on this rung |
 | Codex CLI | nothing, deliberately | the `fable` rung there means `gpt-5.6 @ xhigh`, a different model on a different account - switching it from a knob named after an Anthropic model would surprise a Codex user |
 
 So on two of the three hosts this command is a **status report**, not a switch,

package/pipeline/skills/shared/core/multi-agent-postmortem/SKILL.md

@@ -18,23 +18,26 @@ deterministic indexer; the model only interprets it.
 **Read-only.** Nothing is sent anywhere: no issue comment, no PR, no channel.
 The one write is the report itself, saved under the run's log directory.
 
-The indexer reads Claude Code session files (`~/.claude/projects/<dir>/<session>.jsonl`).
-On a host that writes none, a run id finds nothing (exit 3); say so and ask for
-a transcript path rather than reporting an empty run.
+The indexer reads Claude Code session files (`~/.claude/projects/<dir>/<session>.jsonl`),
+Copilot CLI session logs (`~/.copilot/session-state/<session>/events.jsonl`) and
+Codex rollouts (`~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl`), detecting the
+format per file. Copilot CLI reports tokens per session, so its totals come from
+the shutdown record. When a run id finds nothing (exit 3), say so and ask for a
+transcript path rather than reporting an empty run.
 
 ## Steps
 
 1. **Resolve the target.**
-   - A path ending in `.jsonl`: index that file (subagent files beside it are
-     included). There is no run directory, so nothing is saved unless the user
+   - A path ending in `.jsonl` (any of the three hosts): index that file
+     (Claude Code subagent files beside it are included). There is no run directory, so nothing is saved unless the user
      names one.
    - A task id or `#N`: locate the run and its transcripts:
      ```bash
      node "$HOME/.claude/scripts/transcript-index.mjs" --run "<id>" --locate
      ```
      `matchedBy: "session"` means the run recorded its session id and the match
-     is exact. `"time-window"` means it did not, so the files are the sessions
-     that ran in the run's worktree or checkout while it was active; say that
+     is exact. `"time-window"` means it did not, so the files are the sessions,
+     on any host, that ran in the run's worktree or checkout while it was active; say that
      this match is a heuristic. Exit 3 with a `reason`: report the reason, and
      offer to take a transcript path instead.
    - No argument: take the most recent run from

package/pipeline/skills/shared/core/multi-agent-review/SKILL.md

@@ -43,14 +43,14 @@ Skip Phase 0-3 and review a diff only. Input shapes: a PR (`#N`, `repo#N`, GitHu
 
    **Claude Code (3 in parallel while the fable rung is on, 2 while it is off).** Resolve the fable slots first; this command has no Phase 0:
    `REVIEW_RUNG=$(bash "$HOME/.claude/lib/model-dispatch.sh" subagent --persona reviewer --default fable)` and the same with `--persona triage` for `TRIAGE_RUNG`. Anything but `fable` drops Agent 1 and runs triage on `TRIAGE_RUNG`.
-   - Agent 1: `claude-fable-5` → security + architecture (only when `REVIEW_RUNG` is `fable`)
-   - Agent 2: `claude-opus-5` → edge cases, different perspective
-   - Agent 3: `claude-sonnet-5` → general quality
+   - Agent 1: `claude-fable-5-1` → security + architecture (only when `REVIEW_RUNG` is `fable`)
+   - Agent 2: `claude-opus-5-5` → edge cases, different perspective
+   - Agent 3: `claude-sonnet-5-5` → general quality
 
    **Copilot CLI (3 in parallel):**
-   - Agent 1: `claude-opus-5` → security + architecture (Fable 5 is not offered on Copilot CLI)
+   - Agent 1: `claude-opus-4.7` → security + architecture (Fable is not offered on Copilot CLI)
    - Agent 2: `gpt-5.4` → edge cases, different perspective
-   - Agent 3: `claude-sonnet-5` → general quality
+   - Agent 3: `claude-sonnet-4.6` → general quality
 
    **Codex CLI (3 in parallel, single vendor):**
    - Agent 1: `gpt-5.6` @ `xhigh` → security + architecture

package/pipeline/skills/shared/core/multi-agent-route-on/SKILL.md

@@ -29,7 +29,7 @@ honoured only at `bulk-read` and `delegate` and only while `--free` is on.
 
 **Rung names are the contract; model ids are not.** `opus` is a rung here and a
 model id in `cost-table.json`, and the second can change without anyone editing
-a rule. Writing `claude-opus-5` into a rule pins a decision to a string that will
+a rule. Writing `claude-opus-5-5` into a rule pins a decision to a string that will
 go stale.
 
 Set rules with:

package/pipeline/skills/shared/core/multi-agent-setup/SKILL.md

@@ -322,14 +322,16 @@ On a new machine: (1) `npx @{npm-scope}/multi-agent-pipeline install`; (2) `/mul
 
 All tokens are optional in the sense that every service can be answered with Skip  -  but the ASKING is not optional: the Step 3 sequential loop still walks every missing service one by one (token → author → host). Phase 0 re-asks at runtime only for tokens the user skipped here.
 
-### Step 8  -  Enforcement hooks (optional, Claude Code)
+### Step 8  -  Enforcement hooks (optional)
 
-Offer to merge `$HOME/.claude/templates/claude-hooks.json`: three `PreToolUse` gates that block on a non-zero exit (secret scan, agent-guard, read-size) plus four hooks that block nothing (`PreCompact`, `SessionEnd`, `SessionStart`, `PostToolUse`). What each does: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
+On Claude Code, offer to merge `$HOME/.claude/templates/claude-hooks.json`: three blocking `PreToolUse` gates (secret scan, agent-guard, read-size) plus four non-blocking hooks (`PreCompact`, `SessionEnd`, `SessionStart`, `PostToolUse`). What each does: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
 
 - Ask (picker): "Install the pipeline's hooks into `~/.claude/settings.json`?" Default Yes.
-- On Yes, deep-merge EVERY event in the template's `hooks` object, not `PreToolUse` alone - merging one event silently drops the capture hooks. Preserve existing hooks; never duplicate a matcher already calling the same script.
-- Say what the merge does NOT cover: only the three gates need no run-specific arguments, so only they are hookable; the rest are phase-enforced.
-- Say what it does not turn on: the read-size gate is inert until `prefs.global.bulkRead.mode` is set. Recommend `observe` first. Why, and the Phase 3 exemption: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
+- On Yes, deep-merge EVERY event in the template's `hooks` object (merging `PreToolUse` alone drops the capture hooks); keep existing hooks, never duplicate a matcher calling the same script.
+- Say only the three gates are hookable (no run-specific arguments); the rest are phase-enforced.
+- Say the read-size gate stays inert until `prefs.global.bulkRead.mode` is set; recommend `observe` first (why, and the Phase 3 exemption: `picker-contract.md`).
+
+Codex: offer only the syntax gate, then run `node "$HOME/.codex/scripts/host-hooks.mjs" install --host codex`. Copilot CLI: offer no hook (it discards `postToolUse` output as of 1.0.45).
 
 ### Step 9  -  Default stack plugin enablement
 

package/pipeline/skills/shared/core/multi-agent-testflight-validation/SKILL.md

@@ -9,10 +9,9 @@ metadata:
 
 # multi-agent-testflight-validation  -  iOS alias for store-ready
 
-This skill is an alias. The implementation it used to carry was merged into
+This skill is an alias. The implementation lives in
 `multi-agent-store-ready`, which runs the same three gates on iOS and adds the
-Android side, so there is one flow to maintain instead of two that had already
-started to drift.
+Android side, so there is one flow to maintain instead of two that drift.
 
 The name is kept because it is the one people reach for when the target is
 TestFlight, and removing a surface is a breaking change.

package/pipeline/skills/shared/external/ios-coding-standard/references/rules.yml

@@ -704,7 +704,7 @@ rules:
     enforcement: judgement
     rationale: testability
     check: >
-      Two things used to be one rule here, and conflating them pushed modules toward the wrong fix
+      Two concerns meet in this rule, and conflating them pushes modules toward the wrong fix
       in both directions. Separate them:
       **The failure vocabulary is module-scoped.** The set of ways a call can fail  -  offline,
       timeout, unauthorised, not-found, conflict, server, unknown  -  is one type the whole module
@@ -925,7 +925,7 @@ rules:
     check: >
       When the app ships a wrapper for a platform affordance  -  a sheet, a date picker, a toast -
       a feature module calls the wrapper, never the OS API underneath. The wrapper exists
-      because the OS changed the affordance once already and will again: iOS 26 forced a
+      because the OS changes the affordance between releases: iOS 26 forced a
       Liquid-Glass inset onto partial-detent sheets with no opt-out, which put a gap down the
       side and bottom of every raw `.sheet` and swallowed a pushed picker's selection.
       The tell that this rule was skipped: one module's sheets look different from the rest of