@mmerterden/multi-agent-pipeline 20.29.0 → 20.33.0

package/CHANGELOG.md

@@ -16,6 +16,92 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.33.0] - 2026-10-25
+
+### Added
+
+- Office: pipelines run step by step. Agents wait at the open office and walk over to take their seat in a run's room. The table sign counts phases from 1 over the run's own phases, fills the current phase as its tasks finish and names the task in progress; the run window shows each phase's checklist and a seat shows its own tasks and recent MCP calls. A finished run stays two minutes.
+- `task-mirror.sh`, a PostToolUse hook on `TaskCreate` / `TaskUpdate`: the native task list of the session driving a run lands in that run's tracker under the phase in progress, so the office and the terminal show the same list. Phase tiles are skipped, nothing is written outside a run bound to the session, and the hook never prints.
+- The analysis mode has its own phase names in `schemas/phases.json` (Intake, Evidence, Synthesis, Review, Publish, Report); `/multi-agent:test-gen` and a standalone `/multi-agent:review` register tracker runs with their own steps, on Claude Code and Copilot CLI alike.
+- Office rooms per repository are typed: Development rooms (`/multi-agent`) and Analysis rooms (`/multi-agent:analysis`), each floor keeping a free Analysis room; a run that touches more repositories opens an annex desk on theirs. Labels go through one layout pass and never overlap; a thought cloud over a working agent says what it is doing and opens its detail.
+- Office reception has two new-run desks (development and analysis) that list Jira and GitHub issues and take free text.
+- Office mail room: pull requests on every GitHub account `gh` is logged in to, each asked with its own token, and on the configured Bitbucket Server.
+- Office server room: the key cabinet (`GET /v1/credentials`, names and probe verdicts from `credential-inventory.sh`, never a value, local-only) and the system panel (`GET /v1/system`: CPU, memory, disk and the pipeline's own processes, numbers only). The library holds per-repository memory (`GET /v1/memory`: code graph age, learnings, findings and session notes, redacted). The restroom previews and prunes old run logs through `prune-logs.sh` (`POST /v1/prune-logs`, two steps, 7, 30 or 90 days, local-only).
+- Office orientation room: a trainer next to reception opens a guide built from the floor that is drawn, listing every room with the windows it opens, how both pipelines run, what is a job, a window or terminal-only, the security model and the signs. Each visit points at it in the feed; the page keeps nothing in browser storage.
+- Five read-only office jobs: doctor, route status, scan, scenario audit and analysis review (19 jobs in all). Commands that stay in the terminal say why instead of offering a copy button.
+- Office tables seat a run's whole crew from the start, one seat per role each phase uses (planner and plan critic, developer and dev critic, three reviewers, committer, reporter; an analysis run its own): whoever's phase runs works, later ones wait for their turn, finished ones stay seated.
+- The table sign names where the work came from (the Jira key, the GitHub issue as `repo#N`, both when an issue got a Jira, or free text), what a waiting run waits for (a local test, the report channels, an answer here, or a question in the terminal) and, once finished, the pull request it opened. `runs-index` carries `source`, `prNumber`, `mode`, `channels` and the local-only `channelUrls` (runs surface 1.3.0). The client contract is 1.6.0: the six new routes, and the activity and pull-request surfaces at 1.1.0. A run with no tracker still lists every phase of its mode.
+- A question a session asks in its own terminal counts as waiting for you: the table glows, the HUD counts it, the feed says so and the tab title shows the number; the drawer says to answer it in the terminal. The HUD reads agents working, runs and sessions.
+- Office settings screen in the manager's office (`GET/POST /v1/settings`, local-only, two steps, one change at a time): output language, the fable rung and model routing, each through the script its terminal command runs (`office-settings.mjs`). Route on keeps the saved strategy and scope; rules, free providers and prompt language stay in the terminal.
+- Phase 5 records each report channel's outcome in `state.channelResults`; the run window lists where the report went, with the addresses (https only) from the run record, which drops them from a redacted answer.
+- The memory shelf offers a code graph build or refresh for each repository, through the graph job.
+- Office characters come in twelve looks: six sheets and a recoloured second set, so every role at a run's table looks different. The team window shows every character with its portrait, the office staff and the agent pool apart, and the chat drawer shows the character actually at the seat.
+- README and README.tr gain an office section with screenshots; README.tr gains the hooks-per-host table README has.
+- Office rooms carry more of a real office: pictures, a clock and hanging plants on free wall, and a plant in each free corner, never behind a tall piece, under a room's sign or in anyone's way.
+- The autopilot window is one switch that says the state and flips it, the three numbers that matter, and the repository selection; stop buttons appear only while it runs, and with no repository it says how one is added.
+
+### Changed
+
+- Office roles on the floor and in the feed are translated, and phase events count from 1 like the table sign.
+- `/multi-agent:office-on` describes the panel as it is; the help catalog says the server runs until `office-off`.
+- `prune-logs.sh` spares a run that can still be resumed (an `agent-state.json` status that is not finished, abandoned or cancelled) unless `--task` names it; `--only-from=FILE` limits a prune to a confirmed list. The office prunes only the folders its preview listed, passing them through `--only-from`, and refuses with `changed` when the set moved.
+- `phase-tracker.sh task <N> <id> deleted` takes a mirrored task off the list, as a native `TaskUpdate` with status `deleted` does. A task id used again in a later phase updates that phase's task.
+- Text cut to fit a field (`transcript-index` excerpts) counts its ` ...` ending toward the limit.
+- An MCP call a turn left without a result is closed as failed, so no desk stands at the server rack forever. A task created between two phases is mirrored under the phase about to start.
+- The key cabinet shows every verdict `credential-inventory.sh --probe` gives (malformed, no credential, probe error, server error, tier ready, needs a grant) and calls one it does not know unknown instead of not checked.
+- The Bitbucket pull request list authenticates the way the credential inventory does: Basic with a stored `bitbucket_user`, else the token as a bearer. On a `gh` without `auth token --user`, the active account answers alone.
+- The system panel counts only a node, npx or npm process as the toolkit server, and on macOS reports used memory from `vm_stat` (reclaimable pages count as free).
+- A memory store line that is not a JSON object is skipped, a shelf that cannot be read is left out instead of failing the answer, and a graph dated in the future reads as zero days old.
+- The room sign names only commands that exist; an autopilot job reads `/multi-agent autopilot` as its run does. Prunes run one at a time. A language change the preferences file could not take, or whose command descriptions were not switched, is reported as failed.
+- The office translates numbered roles in the run window and chat drawer, the HUD counts sessions apart from solo jobs, the job form names the scenario audit's CSV field, and a run's head and crew stay at the table until it leaves.
+- A run that just finished keeps only the session that ran it, so a session that starts the next run within two minutes sits at the new table.
+- Office wall-station labels sit inside their room instead of above the top wall, and `smoke-office-runtime.sh` checks that no two labels overlap at any zoom step. A floor station's label sits above its tallest piece, hotbar labels fit under their icons, and room signs never cover a picture or board; the runtime smoke checks all three.
+- `schemas/phases.schema.json` allows a mode's own phase `names`.
+
+### Security
+
+- `GET /v1/system` measures with child processes off the event loop; requests that arrive while one measures share its answer, and the log folder size is reused for a minute. `GET /v1/memory` reads its stores asynchronously, parses only their last megabyte, and skips a store that is a FIFO, a symlink or anything but a regular file.
+- Turning routing on from the office names, in its confirmation, the saved free provider chain it brings back and whether that chain allows training.
+- `/multi-agent:scenario-audit` writes its verdicts in a folder of the run's own instead of a fixed name under `/tmp`.
+- The Bitbucket token is read from the credential store with a deadline and sent only over https (a loopback host excepted); redirects are not followed. A redacted pull request list carries no URL or login.
+- `resolveToken` gives the credential store a deadline. A GitHub Enterprise Server account's token reaches `gh` as `GH_ENTERPRISE_TOKEN` as well.
+- Office threat model rows T19 to T24 cover the new routes, the PR listing, the task mirror hook, the settings screen and report links.
+
+## [20.32.0] - 2026-10-25
+
+### Added
+
+- Office: a repository can be added from any window that picks one. Checkouts earlier runs worked in are suggested, a path can be typed, and a registered entry whose folder is gone can be taken off the list; each is a two-step write (`POST /v1/repos`, `DELETE /v1/repos/{id}`), and only a git checkout is accepted. `GET /v1/repos?all=1` (`launch-request.mjs repos --all`) lists the suggested and the missing entries by id, never by path to a page.
+- Office keeps itself current: the open page shows a reload banner when a newer page is installed and reloads onto it through a fresh one-time code (`GET /office/version`, `POST /office/reload`); `office-on` replaces a running server whose code changed on disk. A server that has stopped is said so on the page.
+- The office ships the toolkit version the release was checked against (`office/toolkit.json`, written by `office-build.mjs` from `docs/facts.json` and held by `--check`), so the Tools window starts an exact version with no manual step and every pipeline update moves it forward. `MA_TOOLKIT_VERSION` and `prefs.global.office.toolkitVersion` still override it. The Tools window shows the version; nothing writes the preferences file.
+- Office: hand a job to someone. Clicking a person or a station opens the jobs that role does (`schemas/office-jobs.json`: 14 jobs, each parameter typed by kind, no free text); the confirmation names the exact prompt, the repository and what the job writes outside this machine, and the second step starts `claude --bg` with the unattended profile and no shell (`GET/POST /v1/jobs`, two steps). A team job meets in its repository's room and is refused while another run is live there (`room-busy`); a solo job sits at a desk under its role. Every start is recorded under `logs/multi-agent/office/jobs/` (0600). The autopilot runner and the office start sessions through one launcher, `pipeline/lib/bg-launch.mjs`.
+- Office is a company building: a hall with the lobby, the open office and the kitchen on top, then the manager's office, library, server room, test lab, analysis room, archive, mail room and restroom, with each repository's meeting rooms below. Thirteen staff work in their rooms; the hotbar moves the camera to a room, and each room's window holds its commands (the cleanup in the restroom previews `/v1/gc` before it runs). Copy buttons are gone: the New run flow, PR review and the command cards start real jobs.
+- Office furniture drawn for this project: 16 sprites kept as pixel grids in `pipeline/office-art` and rendered into PNGs by `office-build.mjs` with a dependency-free encoder; `--check` holds the PNGs to their sources.
+- `smoke-office-ui.sh`: the signed-in panel driven by Playwright (adding a repository, the refusal of a folder that is not a checkout, command cards, the reload banner, a stopped server).
+
+### Security
+
+- The unattended profile denies reading `~/.claude/logs/multi-agent/contract-server/` (a `Read` deny, a sandbox `denyRead`, and in `MCP_TOOLKIT_INDEX_DENY` together with the office state directory), where the local server keeps its bearer token, so a session the office or the autopilot starts cannot pick it up. Every install adds the deny rules and index-deny directories a newer release ships to an existing `multi-agent-unattended.settings.json` without changing what it allows (`tightenUnattendedProfile`), so the autopilot's profile check keeps passing after an update.
+- `POST /v1/jobs` starts nothing unless agent-guard.sh is registered for every tool (`guard-missing`), re-checks at the confirmation that the repository is still allowed, and keeps claude's own error output off the page.
+
+### Changed
+
+- Office: the panel's server runs until `/multi-agent:office-off`; it no longer stops after an idle time or after 8 hours. `contract-server.mjs` takes `--idle-minutes 0` and `--max-hours 0` for that, and keeps its 15 minute and 8 hour defaults when started on its own. The open page checks in once a minute, also in a background tab, and says so when the server has stopped.
+- Office: command cards keep their button on the title row; long names are cut with the full name on hover.
+- `/multi-agent:sync` checks the office instead of copying it: the committed page matches its sources, the installed copies match the page, and the recorded toolkit version is reported (Step 3e).
+
+## [20.31.0] - 2026-10-25
+
+### Changed
+
+- Office: every run meets in its own walled room inside its repository's room. The orchestrator sits at the head of a long table with a computer, the agents face each other along it, and the table grows with the team from two to six chairs a side. Agent labels sit above the near row and below the far one; on a narrow floor the chairs are packed and labels show on hover. Free meeting rooms finish the row, a hall on the left leads in, and the floor reaches the bottom of the stage. The corridor label of a run over several repositories now sits beside the room name.
+
+## [20.30.0] - 2026-10-25
+
+### Added
+
+- `/multi-agent:office-on`, `office-off`, `office-status`: a local browser panel over the contract server (127.0.0.1 only). The office is a pixel floor: a lobby whose furniture opens each feature (new run, quest board, PR desk, ledger, autopilot desk with its bot, routines, skills, toolkit, services, commands), one room per repository with one table per run, agents walking in to their chairs, typing or reading by the tool they use, a phase bar over every table, the paper handed on at each phase change, a lamp and a bubble when a run waits for you, finished agents moving to the lounge, and dashed corridors for runs over several repositories. A text list shows the same office. A demo office plays a scripted run when nothing is at work and never sends a write. Text follows `outputLanguage` (English or Turkish). Sprites come from pixel-agents (MIT) with MetroCity characters (CC0), installed in `office/assets/` and served at `/office/assets/` under a fixed file-name pattern; the page is built by `office-build.mjs` from `pipeline/office-src`; attribution in `office/NOTICE.md`. It shows their chats, a cost ledger with the source of every amount, run results, autopilot, routines, stacks, read-only toolkit tools and service reads, and starts runs through the existing launch route. The page installs to `~/.claude/office/` (and the Copilot and Codex trees); `GET /office` serves it, with `MA_OFFICE_PAGE` or `prefs.global.office.page` as overrides. The token reaches the page through a one-time 10 second code, never a URL; the server exits after its idle time and after 8 hours in any case. Remote access is not part of the pipeline; `office-status` reports "not available in this installation" unless a separately installed remote layer is present. Threat model: `multi-agent-refs/features/office-threat-model.md`. The description-surface ceiling rises from 94500 to 95000 bytes for the three commands and their core skills, after their descriptions were trimmed to 812 bytes for all six.
+
 ## [20.29.0] - 2026-10-24
 
 ### Added

package/README.md

@@ -158,7 +158,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 
 ## Commands
 
-`/multi-agent` plus 66 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
+`/multi-agent` plus 69 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
 
 ### Pipeline entries
 
@@ -353,6 +353,50 @@ Continuous mode therefore needs the `claude` binary on `PATH` everywhere. The
 queue and the repo selection live in `~/.claude/autopilot/` on every host, on
 purpose - two CLIs on one machine must read one queue, not two.
 
+## The office
+
+A local web page that shows the pipeline as a pixel office and lets you drive
+it. `/multi-agent:office-on` starts the contract server on 127.0.0.1 and opens
+the page with a one-time code; the server runs until `/multi-agent:office-off`.
+
+![The company floor: reception, orientation, the open office, kitchen, accounting and the restroom](.github/office/floor.png)
+
+- **Runs come alive.** Agents wait at their desks in the open office and walk
+  to a run's room when the run calls their role. Each repository has its own
+  floor of Development rooms (`/multi-agent`) and Analysis rooms
+  (`/multi-agent:analysis`); a run that touches more repositories opens an
+  annex desk on theirs.
+- **The native task widget, on the table.** The table sign shows the phase
+  (`Phase 3/6 Dev`), a bar that fills as that phase's tasks finish and the
+  task in progress. A PostToolUse hook copies `TaskCreate` / `TaskUpdate` into
+  the run's tracker, so the office and the terminal show the same list. A
+  thought cloud over a working agent says what it is doing.
+- **The rest of the ecosystem has a room.** Reception starts a run from a Jira
+  or GitHub issue or free text. The mail room lists pull requests on every
+  GitHub account `gh` is logged in to and on Bitbucket Server. The server room
+  holds the toolkit MCP tools, the services, the key cabinet (names and probe
+  verdicts, never a value) and the machine's CPU, memory and disk. The library
+  holds stacks, commands and what the pipeline learned per repository. The
+  restroom clears worktrees, abandoned runs and old run logs after a preview.
+  Accounting shows tokens and cost, the manager's office holds autopilot,
+  routines and the settings (output language, the fable rung, model routing),
+  and the orientation room explains the building.
+- **People take jobs.** Click one, pick a job, confirm. Writes that change the
+  machine are local-only and take two requests. Work that is interactive or
+  changes the installation stays in the terminal, and the commands window says
+  why for each command.
+
+![Repository floors with Development and Analysis rooms, a live analysis and an annex desk](.github/office/rooms.png)
+
+| Command                      | What it does                                                    |
+| ---------------------------- | --------------------------------------------------------------- |
+| `/multi-agent:office-on`     | Start or reuse the server and open the page                     |
+| `/multi-agent:office-status` | Whether it runs, its URL (never the token) and its last actions |
+| `/multi-agent:office-off`    | Stop the server; it runs until you do                           |
+
+Security model: [office threat model](pipeline/multi-agent-refs/features/office-threat-model.md).
+Phone access is not part of this installation.
+
 ## Which model answers
 
 The ladder is `fable -> opus -> sonnet -> haiku`, and a run walks it on failure.
@@ -408,17 +452,17 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 66 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 69 commands.
 
 | Tool        | Flag                 | What it installs                                                                                       |
 | ----------- | -------------------- | ------------------------------------------------------------------------------------------------------ |
 | Claude Code | `--claude` (default) | slash commands + skills + agents + the enforcement hooks (secret scan, agent-guard, read-size gate, run-scope guard, run-stop guard) |
-| Copilot CLI | `--copilot`          | instructions + 66 sub-command skills + scripts                                                         |
-| Codex CLI   | `--codex`            | one router skill + 66 specs as refs + 11 agent TOML + `AGENTS.md` block + `codex mcp add`               |
+| Copilot CLI | `--copilot`          | instructions + 69 sub-command skills + scripts                                                         |
+| Codex CLI   | `--codex`            | one router skill + 69 specs as refs + 11 agent TOML + `AGENTS.md` block + `codex mcp add`               |
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 
-**Why Codex gets one skill and not 66.** Codex assembles every discovered skill's name
+**Why Codex gets one skill and not 69.** Codex assembles every discovered skill's name
 and description into a single prompt block and drops entries when it overflows, with no
 error. Measured on 0.145: installing one plugin that declares 142 skills surfaced only
 75 of them and evicted an unrelated user skill. So on Codex the pipeline ships a single
@@ -458,6 +502,7 @@ The **secret scan** runs as a `PreToolUse` hook on Claude Code (hard-blocks a co
 | `agent-guard.sh` (attribution, force-push, skipped git hooks, argv secrets, closure confirmations, read-only repos, unattended policy) | PreToolUse `Bash`, file edits, fetch and toolkit tools | none | none |
 | `run-scope-guard.sh` (Figma phase rule, worktree boundary warning) | PreToolUse Figma tools, file edits | none: the phase records its own MCP calls | none |
 | `run-stop-guard.sh` (no silent stop mid-run) | Stop | none: halts stay the phase's own write | none |
+| `task-mirror.sh` (native task list into the run tracker, so the office shows it) | PostToolUse `TaskCreate`/`TaskUpdate` | none: the phase calls `phase-tracker.sh task` itself | none: the phase calls `phase-tracker.sh task` itself |
 | `edit-syntax-gate.sh` | PostToolUse file edits | PostToolUse `apply_patch` | none: Copilot discards postToolUse output |
 | `check-read-size.sh`, capture hooks | registered | none | none |
 

package/README.tr.md

@@ -157,7 +157,7 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 
 ## Komutlar
 
-`/multi-agent` ve 66 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
+`/multi-agent` ve 69 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
 
 ### Pipeline girişleri
 
@@ -352,6 +352,51 @@ Dolayısıyla sürekli mod her hostta `claude` binary'sinin `PATH`'te olmasını
 istiyor. Kuyruk ve repo seçimi her hostta `~/.claude/autopilot/` altında durur;
 bu bilinçli - bir makinedeki iki CLI tek kuyruk okumalı, iki değil.
 
+## Ofis
+
+Pipeline'ı piksel bir ofis olarak gösteren ve oradan yönetmeni sağlayan yerel
+bir web sayfası. `/multi-agent:office-on` sözleşme sunucusunu 127.0.0.1'de
+başlatır ve sayfayı tek kullanımlık bir kodla açar; sunucu
+`/multi-agent:office-off` ile durdurulana kadar çalışır.
+
+![Şirket katı: resepsiyon, oryantasyon, açık ofis, mutfak, muhasebe ve tuvalet](.github/office/floor-tr.png)
+
+- **Koşular canlanır.** Ajanlar açık ofiste masalarında bekler. Bir koşu
+  rollerini çağırınca koşunun odasına yürürler. Her reponun kendi katı var:
+  Geliştirme odaları (`/multi-agent`) ve Analiz odaları
+  (`/multi-agent:analysis`). Birden fazla repoya dokunan koşu, diğer repoların
+  katında şube masası açar.
+- **Terminaldeki görev listesi masada.** Masa tabelası fazı (`Faz 3/6 Dev`),
+  fazın görevleri bittikçe dolan çubuğu ve sürmekte olan görevi gösterir. Bir
+  PostToolUse hook'u `TaskCreate` / `TaskUpdate` çağrılarını koşunun
+  takipçisine yazar; ofis ile terminal aynı listeyi gösterir. Çalışan ajanın
+  üstündeki bulut ne yaptığını söyler.
+- **Ekosistemin geri kalanının da odası var.** Resepsiyon, Jira ya da GitHub
+  issue'sundan veya serbest metinden koşu başlatır. Posta odası, `gh`'nin
+  oturum açtığı tüm GitHub hesaplarındaki ve Bitbucket Server'daki PR'ları
+  listeler. Sunucu odasında toolkit MCP araçları, servisler, anahtar dolabı
+  (ad ve canlı kontrol sonucu, asla değer) ve makinenin CPU, bellek ve disk durumu
+  var. Kütüphane stack'leri, komutları ve pipeline'ın repo başına öğrendiklerini
+  tutar. Tuvalet, önizleme gösterdikten sonra worktree'leri, yarım kalan
+  koşuları ve eski koşu loglarını temizler. Muhasebe token ve maliyeti
+  gösterir. Yönetici odasında otopilot, rutinler ve ayarlar (çıktı dili,
+  Fable basamağı, model yönlendirmesi) var. Oryantasyon odası binayı anlatır.
+- **Kişiler iş alır.** Birine tıkla, iş seç, onayla. Makineyi değiştiren
+  yazmalar yalnızca yereldir ve iki istek ister. Etkileşimli ya da kurulumu
+  değiştiren işler terminalde kalır; komutlar penceresi her komut için sebebini
+  yazar.
+
+![Geliştirme ve Analiz odalarıyla repo katları, süren bir analiz ve bir şube masası](.github/office/rooms-tr.png)
+
+| Komut                        | Ne yapar                                                 |
+| ---------------------------- | -------------------------------------------------------- |
+| `/multi-agent:office-on`     | Sunucuyu başlatır ya da var olanı kullanır, sayfayı açar |
+| `/multi-agent:office-status` | Çalışıyor mu, adresi (token asla) ve son işlemleri       |
+| `/multi-agent:office-off`    | Sunucuyu durdurur; sen durdurana kadar çalışır           |
+
+Güvenlik modeli: [ofis tehdit modeli](pipeline/multi-agent-refs/features/office-threat-model.md).
+Telefondan erişim bu kurulumun parçası değil.
+
 ## Hangi model cevaplıyor
 
 Merdiven `fable -> opus -> sonnet -> haiku`; koşu başarısızlıkta merdiveni iner.
@@ -407,17 +452,17 @@ Bu, ilgili plugin'i (+ ortak `ai-common` plugin'ini) repo'nun `.claude/settings.
 
 ## Araç desteği
 
-Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 66 komutu alır.
+Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 69 komutu alır.
 
 | Araç        | Bayrak                  | Ne kurar                                                                                                         |
 | ----------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
 | Claude Code | `--claude` (varsayılan) | slash komutları + skill'ler + agent'lar + üç `PreToolUse` hook'u (secret scan, agent-guard, okuma-boyutu geçidi) |
-| Copilot CLI | `--copilot`             | talimatlar + 66 alt-komut skill'i + script'ler                                                                   |
-| Codex CLI   | `--codex`               | bir router skill + ref olarak 66 spec + 11 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
+| Copilot CLI | `--copilot`             | talimatlar + 69 alt-komut skill'i + script'ler                                                                   |
+| Codex CLI   | `--codex`               | bir router skill + ref olarak 69 spec + 11 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
 
 Skill'leri stack'e göre filtrele: `--platform=ios\|android\|all`.
 
-**Codex neden 66 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
+**Codex neden 69 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
 ve açıklamasını tek bir prompt bloğuna toplar ve blok taştığında girdileri hatasızca
 düşürür. 0.145 üzerinde ölçüldü: 142 skill deklare eden bir plugin kurulduğunda sadece
 75'i yüzeye çıktı ve alakasız bir kullanıcı skill'i tahliye edildi. Bu yüzden Codex'te
@@ -450,6 +495,20 @@ triage notu bunu belirtir.
 
 **Secret scan**, Claude Code'da bir `PreToolUse` hook'u olarak (bulgu halinde commit'i sert-engeller) ve diğer yerlerde bir pre-push kontrolü olarak çalışır.
 
+**Host başına hook'lar.** Zorlayan hook'lar Claude Code'a ait; `install` bunları kaydeder, `/multi-agent:doctor` (`hook-reachability`) ayarlarında hangisinin eksik olduğunu söyler.
+
+| Hook | Claude Code | Codex CLI | Copilot CLI |
+| --- | --- | --- | --- |
+| `pre-commit-check.sh` (secret taraması, sahipli yollar, attended build/test kanıtı, unattended defteri) | PreToolUse `Bash` | yok: pre-push kontrolü | yok: pre-push kontrolü |
+| `agent-guard.sh` (atıf, force-push, atlanan git hook'ları, argv'de secret, kapanış onayları, salt okunur repolar, unattended politikası) | PreToolUse `Bash`, dosya düzenlemeleri, fetch ve toolkit araçları | yok | yok |
+| `run-scope-guard.sh` (Figma faz kuralı, worktree sınırı uyarısı) | PreToolUse Figma araçları, dosya düzenlemeleri | yok: faz kendi MCP çağrılarını kaydeder | yok |
+| `run-stop-guard.sh` (koşu ortasında sessizce durmaz) | Stop | yok: duraklama fazın kendi yazımı olarak kalır | yok |
+| `task-mirror.sh` (terminaldeki görev listesini koşunun takipçisine yazar, ofis de onu gösterir) | PostToolUse `TaskCreate`/`TaskUpdate` | yok: faz `phase-tracker.sh task`'ı kendisi çağırır | yok: faz `phase-tracker.sh task`'ı kendisi çağırır |
+| `edit-syntax-gate.sh` | PostToolUse dosya düzenlemeleri | PostToolUse `apply_patch` | yok: Copilot postToolUse çıktısını atar |
+| `check-read-size.sh`, capture hook'ları | kayıtlı | yok | yok |
+
+Bir host'ta eşdeğer hook yoksa kural yine faz dokümanlarında durur; orada zorlama değil, bir istektir.
+
 ## Pipeline koşusu dışında
 
 Pipeline'ı kurmak yalnız onu çalıştırdığında işe yaramıyor. Sıradan bir oturum açtığında aynı üç şey elinin altında; her sohbette yüklenen `rules/outside-the-pipeline.md` bunları duyuruyor:

package/docs/architecture.md

@@ -113,7 +113,7 @@ graph TB
     end
 
     subgraph "Pipeline Specs"
-        CMD[commands/<br/>66 command files]
+        CMD[commands/<br/>69 command files]
         AGT[agents/<br/>11 agent personas]
         RUL[rules/<br/>13 domain rules]
         PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
@@ -204,8 +204,8 @@ repo and the website, plus the two independently shipped repos
 ```mermaid
 graph TD
     CC["Claude Code<br/>(source of truth)"]
-    COP["Copilot CLI<br/>(instructions + 66 sub-command skills)"]
-    COD["Codex CLI<br/>(1 router skill + 66 refs)"]
+    COP["Copilot CLI<br/>(instructions + 69 sub-command skills)"]
+    COD["Codex CLI<br/>(1 router skill + 69 refs)"]
     REPO["Pipeline Repo<br/>(npm package)"]
     WEB["Website"]
     PLUGREPO["multi-agent-plugins<br/>(6 plugins, own repo)"]

package/docs/ecosystem.md

@@ -5,7 +5,7 @@ separately, wired together at install time and at run time:
 
 | Repo | What it owns | Ships as |
 |---|---|---|
-| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 66 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
+| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 69 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
 | **`multi-agent-plugins`** | Stack knowledge: per-platform component/lifecycle skills (iOS, Android, Frontend, Backend) + shared knowledge | Claude Code marketplace, 6 independently-versioned plugins |
 | **`multi-agent-toolkit-mcp`** | The pipeline's hands on devices and browsers: 197 MCP tools across 21 categories (simulator/emulator control, end-to-end locators and assertions, memory, crash diagnostics, accessibility audit, store compliance, web automation and scraping, Figma-vs-mock design audit, code intelligence, wallet passes, an agent-DSL batch runner, a full-text context index with text-to-image rendering, provider-backed research, verified hand-off of simple text tasks to free models, video key frames, offline security scoring, read-only access to related repositories at their latest branch, travel document fixtures, a voice channel, App Store Connect and Play Console APIs, virtual iPhones) | npm package, registered as a standard stdio MCP server on every host |
 
@@ -18,7 +18,7 @@ Either can be swapped or removed without touching the other two's source.
 graph LR
     subgraph PIPE ["multi-agent-pipeline (orchestrator)"]
         direction TB
-        PHASES["6 phases · 66 commands"]
+        PHASES["6 phases · 69 commands"]
         GATES["deterministic gates + review triage"]
     end
 
@@ -68,8 +68,8 @@ only those:
 graph TD
     CC["Claude Code<br/>~/.claude/commands/multi-agent/<br/>(source of truth)"]
 
-    CC -->|"Step 2: copy + reformat<br/>66 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
-    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 66 refs<br/>+ 11 agent TOML"]
+    CC -->|"Step 2: copy + reformat<br/>69 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
+    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 69 refs<br/>+ 11 agent TOML"]
     CC -->|"Step 3: genericize<br/>(strip personal data)"| REPO["multi-agent-pipeline repo<br/>pipeline/"]
     CC -->|"Step 4: version + feature sync"| WEB["Website<br/>projects.ts / i18n.tsx"]
 
@@ -161,7 +161,7 @@ measurements behind this table):
 
 | | Claude Code | Copilot CLI | Codex CLI |
 |---|---|---|---|
-| **Pipeline commands** | 66 slash-command skills, native | 66 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 66 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
+| **Pipeline commands** | 69 slash-command skills, native | 69 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 69 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
 | **Stack plugins** | Marketplace plugin, loaded natively, resolved by `.claude/settings.json` enabled-list | Enabled plugin's authored skills copied flat into `~/.copilot/skills/`; `knowledge/` **not** re-copied (already delivered via `shared/external`) | Copied as reference files under `~/.codex/multi-agent-refs/skills/`, plugin-prefixed on name clash (e.g. `architecture` → `ai-ios-toolkit-architecture`) |
 | **Component dispatch (Phase 3)** | Marketplace plugin's `create-component`/`create-screen` skill via the Skill tool | No plugin loader - the enabled stack plugin's authored skills (incl. `create-component`) are copied flat into `~/.copilot/skills/` at install time (the old frozen `figma-*` copies are pruned, they were never a fallback) | Not part of the enforced parity axis; classification + state-shape must match, skill *inventory* does not |
 | **multi-agent-toolkit-mcp** | `claude mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `copilot mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `codex mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` (skipped with a warning if `codex` isn't on `PATH`) |

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-10-24",
-  "version": "20.29.0",
+  "generatedAt": "2026-10-25",
+  "version": "20.33.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -33,24 +33,25 @@
   "modes": {
     "full": [0, 1, 2, 3, 4, 5],
     "autopilot": [0, 1, 2, 3, 4, 5],
-    "analysis": [0, 1, 3, 4, 5]
+    "analysis": [0, 1, 2, 3, 4, 5]
   },
-  "commandCount": 66,
+  "commandCount": 69,
   "skillCount": 165,
-  "skillCountAll": 234,
+  "skillCountAll": 237,
   "agentCount": 11,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
-  "toolCount": 204,
+  "toolCount": 208,
   "toolCategories": {
     "ios": 42,
     "web": 38,
-    "android": 33,
+    "android": 34,
     "store": 30,
     "vphone": 10,
     "code": 8,
     "design": 7,
     "repo": 6,
     "voice": 6,
+    "ui": 5,
     "context": 4,
     "pass": 4,
     "document": 3,
@@ -58,11 +59,10 @@
     "llm": 2,
     "research": 2,
     "security": 2,
-    "ui": 2,
     "coverage": 1,
     "media": 1,
     "test": 1
   },
   "pluginSkillCount": 261,
-  "toolkitVersion": "3.25.0"
+  "toolkitVersion": "3.26.0"
 }

package/install/_unattended-profile.mjs

@@ -316,6 +316,67 @@ export function buildUnattendedProfile(current = {}, opts = {}) {
   return next;
 }
 
+/**
+ * Bring an existing profile up to the shipped deny rules without touching
+ * anything else: only permissions.deny and the sandbox's denyRead and
+ * denyWrite grow, so a release that adds a deny reaches every installed
+ * profile on the next install, and nothing it allows changes. No profile file,
+ * or one that does not parse, is left alone.
+ *
+ * @param {{home:string, dryRun?:boolean}} opts
+ * @returns {{path:string, added:string[], written:boolean}}
+ */
+export function tightenUnattendedProfile({ home, dryRun = false }) {
+  const path = unattendedSettingsPath(home);
+  if (!existsSync(path)) return { path, added: [], written: false };
+  let current;
+  try {
+    current = JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return { path, added: [], written: false };
+  }
+  if (!current || typeof current !== "object" || Array.isArray(current))
+    return { path, added: [], written: false };
+  const added = [];
+  const perms = { ...(current.permissions || {}) };
+  const deny = Array.isArray(perms.deny) ? [...perms.deny] : [];
+  for (const [rule] of PROFILE.deny) {
+    if (hasRule(deny, rule)) continue;
+    deny.push(rule);
+    added.push(`deny:${rule}`);
+  }
+  const next = { ...current, permissions: { ...perms, deny } };
+  // Directories the toolkit's index refuses: a list, so it only grows too.
+  for (const [key, value] of PROFILE.env) {
+    if (key !== "MCP_TOOLKIT_INDEX_DENY") continue;
+    const env = current.env && typeof current.env === "object" ? current.env : {};
+    const have = String(env[key] ?? "")
+      .split(",")
+      .map((x) => x.trim())
+      .filter(Boolean);
+    const missing = value.split(",").filter((x) => !have.includes(x));
+    if (!missing.length) continue;
+    next.env = { ...env, [key]: [...have, ...missing].join(",") };
+    added.push(...missing.map((x) => `env.${key}:${x}`));
+  }
+  const sb = current.sandbox;
+  if (sb && typeof sb === "object" && !Array.isArray(sb)) {
+    const fs = sb.filesystem && typeof sb.filesystem === "object" ? sb.filesystem : {};
+    const nextFs = { ...fs };
+    for (const key of ["denyRead", "denyWrite"]) {
+      const have = Array.isArray(fs[key]) ? fs[key].map(String) : [];
+      const missing = PROFILE.sandbox.filesystem[key].filter((p) => !have.includes(p));
+      if (!missing.length) continue;
+      nextFs[key] = [...have, ...missing];
+      added.push(...missing.map((p) => `sandbox.${key}:${p}`));
+    }
+    next.sandbox = { ...sb, filesystem: nextFs };
+  }
+  if (!added.length || dryRun) return { path, added, written: false };
+  writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+  return { path, added, written: true };
+}
+
 /**
  * Write the profile into its own settings file. Idempotent: running it twice
  * changes nothing the second time.