@mmerterden/multi-agent-pipeline 20.29.0 → 20.33.0

package/pipeline/scripts/work-items.mjs

@@ -0,0 +1,473 @@
+#!/usr/bin/env node
+/**
+ * @file work-items.mjs  -  the work list and the PR list a client shows next
+ * to the run list, built on what the pipeline already uses:
+ *
+ *   maturity <key>   lib/issue-fetcher.sh <key>, the fetch and maturity score
+ *                    /multi-agent:jira, /multi-agent:issue and Phase 0 run;
+ *                    title, type, status, score, blockers, warnings, summary
+ *                    and a description excerpt, scrubbed
+ *   prs              open pull requests on GitHub where you are asked to
+ *                    review or are the author (`gh search prs`, the queries
+ *                    /multi-agent:review lists). Bitbucket is reported as a
+ *                    source that is not implemented, never as an empty list
+ *   verdict <task>   the review verdict of a finished /multi-agent:review run
+ *                    whose every finding was triaged (accepted, rejected or
+ *                    deferred); a running review or one with a pending
+ *                    finding is refused. The preview carries findingsDigest,
+ *                    a hash of the findings the decision was made from, so a
+ *                    confirmation can be refused when they changed since:
+ *                    `preview` computes it the way lib/post-pr-review.sh does
+ *                    (approve when no accepted blocking or important finding,
+ *                    else needs-work) without posting; `post` runs
+ *                    post-pr-review.sh itself, which posts the inline comments
+ *                    and the verdict with the user's own gh or Bitbucket
+ *                    credential
+ *
+ * The scripts run as child processes without blocking the caller's event
+ * loop.
+ *
+ * The list of assigned issues is issues.mjs (`GET /v1/issues`); nothing here
+ * fetches it a second time. Credentials are only ever read by the scripts
+ * above through credential-store.sh; no value reaches this process's output.
+ *
+ * Usage:
+ *   work-items.mjs maturity <key>
+ *   work-items.mjs prs
+ *   work-items.mjs verdict <task-id> [--post]
+ *
+ * MA_GH_BIN stands in for gh, MA_ISSUE_FETCHER and MA_POST_PR_REVIEW for the
+ * two scripts (tests).
+ *
+ * Exit: 0 printed, 1 refused, 2 usage, 3 no such run or issue.
+ *
+ * @module pipeline/scripts/work-items
+ */
+
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { scrub } from "./_redact.mjs";
+import { selectRuns } from "./runs-index.mjs";
+import { createRedactor } from "./transcript-index.mjs";
+import { spawnAsync } from "./_spawn-async.mjs";
+import { readRegularJson } from "../lib/regular-file.mjs";
+import { runMain } from "../lib/fatal.mjs";
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+import { resolveTokenAsync } from "../lib/credential-resolve.mjs";
+import { homedir } from "node:os";
+
+export const CONTRACT_VERSION = "1.1.0";
+const HERE = dirname(fileURLToPath(import.meta.url));
+/** A Jira key, `owner/repo#N` or `#N`: the structured inputs launch accepts too. */
+export const ISSUE_KEY =
+  /^(?:[A-Z][A-Z0-9_]{0,15}-[0-9]{1,9}|[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}#[0-9]{1,9}|#[0-9]{1,9})$/;
+const TIMEOUT_MS = 60_000;
+
+export class WorkError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+
+const libScript = (env, name, override) =>
+  env[override] ||
+  [join(HERE, "..", "lib", name), join(HERE, "..", "..", "lib", name)].find((p) => existsSync(p));
+
+/**
+ * The maturity check for one issue, from issue-fetcher.sh.
+ *
+ * @returns {{contractVersion, key, title, type, status, kind, maturity, description}}
+ */
+export async function issueMaturity(key, env = process.env) {
+  if (typeof key !== "string" || !ISSUE_KEY.test(key)) {
+    throw new WorkError("bad-key", "the key is not a Jira key, owner/repo#N or #N");
+  }
+  const script = libScript(env, "issue-fetcher.sh", "MA_ISSUE_FETCHER");
+  if (!script) throw new WorkError("not-installed", "issue-fetcher.sh is not installed");
+  const r = await spawnAsync("bash", [script, key], { env, timeoutMs: TIMEOUT_MS });
+  let d;
+  try {
+    d = JSON.parse(r.stdout);
+  } catch {
+    throw new WorkError("fetch-failed", "the issue could not be fetched");
+  }
+  if (!d || typeof d !== "object")
+    throw new WorkError("fetch-failed", "the issue could not be fetched");
+  const R = createRedactor();
+  const m = d.maturity && typeof d.maturity === "object" ? d.maturity : {};
+  const codes = (v) => (Array.isArray(v) ? v.map((x) => String(x?.code ?? x)).slice(0, 20) : []);
+  return {
+    contractVersion: CONTRACT_VERSION,
+    key,
+    kind: ["jira", "github", "freetext"].includes(d.kind) ? d.kind : "freetext",
+    title: R.excerpt(d.title ?? "", 200),
+    type: d.type ? String(d.type) : null,
+    status: d.status ? String(d.status) : null,
+    maturity: {
+      score: Number.isFinite(m.score) ? m.score : null,
+      blockers: codes(m.blockers),
+      warnings: codes(m.warnings),
+      summary: m.summary ? R.excerpt(m.summary, 400) : null,
+    },
+    description: d.description ? R.excerpt(d.description, 2000) : null,
+  };
+}
+
+/**
+ * The GitHub accounts `gh` is logged in to, as host and login: a personal and
+ * a corporate account are asked one by one, each with its own token, so a
+ * review request on either shows. Empty when `gh auth status` says nothing
+ * readable; the caller then asks with gh's active account alone.
+ */
+async function ghAccounts(env) {
+  const gh = env.MA_GH_BIN || "gh";
+  const r = await spawnAsync(gh, ["auth", "status"], {
+    env,
+    timeoutMs: TIMEOUT_MS,
+    withStderr: true,
+  });
+  const text = r.stdout || "";
+  const out = [];
+  for (const m of text.matchAll(/Logged in to (\S+) account ([A-Za-z0-9_.-]+)/g))
+    if (!out.some((a) => a.host === m[1] && a.login === m[2]))
+      out.push({ host: m[1], login: m[2] });
+  return out;
+}
+
+/**
+ * gh's token for one account, carried in the environment only (GH_TOKEN, and
+ * GH_ENTERPRISE_TOKEN for an Enterprise Server host), never on a command line.
+ */
+async function accountEnv(env, account) {
+  const gh = env.MA_GH_BIN || "gh";
+  const r = await spawnAsync(
+    gh,
+    ["auth", "token", "--hostname", account.host, "--user", account.login],
+    { env, timeoutMs: TIMEOUT_MS },
+  );
+  const token = (r.stdout || "").trim();
+  if (r.status !== 0 || !token) return null;
+  // gh reads GH_TOKEN for github.com and GH_ENTERPRISE_TOKEN for a GitHub
+  // Enterprise Server host, so an enterprise account gets both.
+  const enterprise = !/^(github\.com|[a-z0-9-]+\.ghe\.com)$/i.test(account.host);
+  return {
+    ...env,
+    GH_TOKEN: token,
+    GH_HOST: account.host,
+    ...(enterprise ? { GH_ENTERPRISE_TOKEN: token } : {}),
+  };
+}
+
+/**
+ * Open pull requests on the configured Bitbucket Server where this user is a
+ * reviewer or the author, from its dashboard API. The token comes from the
+ * credential store and travels in the request header only.
+ */
+async function bitbucketPrs(env) {
+  let host = env.MA_BITBUCKET_HOST || null;
+  if (!host) {
+    try {
+      const prefs = readRegularJson(
+        env.MULTI_AGENT_PREFS ||
+          join(env.HOME || homedir(), ".claude", "multi-agent-preferences.json"),
+        null,
+      );
+      host = prefs?.global?.hosts?.bitbucket ?? null;
+    } catch {
+      host = null;
+    }
+  }
+  if (typeof host !== "string" || !host) return { ok: false, items: [], reason: "not configured" };
+  // The token travels in a header, so only over TLS: a host written with
+  // http:// is refused unless it is this machine's own loopback.
+  const loopback = /^http:\/\/(127\.0\.0\.1|localhost)(:\d+)?(\/|$)/i.test(host);
+  if (/^http:\/\//i.test(host) && !loopback)
+    return { ok: false, items: [], reason: "https required" };
+  const base = /^https?:\/\//i.test(host) ? host.replace(/\/+$/, "") : `https://${host}`;
+  const token =
+    env.MA_BITBUCKET_TOKEN ||
+    (await resolveTokenAsync("bitbucket_token", "BITBUCKET_TOKEN", { env }));
+  if (!token) return { ok: false, items: [], reason: "no token in the credential store" };
+  // The same rule as credential-inventory.sh: Basic with the stored user (an
+  // app password), else the token as a bearer.
+  const user =
+    env.MA_BITBUCKET_USER || (await resolveTokenAsync("bitbucket_user", "BITBUCKET_USER", { env }));
+  const authorization = user
+    ? "Basic " + Buffer.from(`${user}:${token}`).toString("base64")
+    : `Bearer ${token}`;
+  const items = [];
+  try {
+    for (const role of ["REVIEWER", "AUTHOR"]) {
+      const res = await fetch(
+        `${base}/rest/api/1.0/dashboard/pull-requests?state=OPEN&role=${role}&limit=50`,
+        {
+          headers: { Authorization: authorization, Accept: "application/json" },
+          redirect: "error",
+          signal: AbortSignal.timeout(TIMEOUT_MS),
+        },
+      );
+      if (res.status === 401 || res.status === 403)
+        return { ok: false, items: [], reason: "the token was refused" };
+      if (!res.ok) return { ok: false, items: [], reason: `Bitbucket answered ${res.status}` };
+      const doc = await res.json();
+      for (const p of Array.isArray(doc?.values) ? doc.values : []) {
+        const repo = p?.toRef?.repository;
+        items.push({
+          source: "bitbucket",
+          account: null,
+          repo: String(repo ? `${repo.project?.key ?? ""}/${repo.slug ?? ""}` : ""),
+          number: Number(p?.id) || 0,
+          title: scrub(String(p?.title ?? "")),
+          url: typeof p?.links?.self?.[0]?.href === "string" ? p.links.self[0].href : null,
+          author: p?.author?.user?.name ? String(p.author.user.name) : null,
+          updatedAt: Number.isFinite(p?.updatedDate) ? new Date(p.updatedDate).toISOString() : null,
+          role: role === "REVIEWER" ? "reviewer" : "author",
+        });
+      }
+    }
+  } catch (e) {
+    const why = String(e?.cause?.message ?? e?.message ?? "");
+    return {
+      ok: false,
+      items: [],
+      reason: /redirect/i.test(why) ? "redirect refused" : "unreachable (VPN?)",
+    };
+  }
+  return { ok: true, items };
+}
+
+async function ghSearch(env, role, account = null) {
+  const gh = env.MA_GH_BIN || "gh";
+  const flag = role === "reviewer" ? "--review-requested=@me" : "--author=@me";
+  const r = await spawnAsync(
+    gh,
+    [
+      "search",
+      "prs",
+      "--state",
+      "open",
+      flag,
+      "--json",
+      "number,title,url,repository,author,updatedAt",
+      "--limit",
+      "50",
+    ],
+    { env, timeoutMs: TIMEOUT_MS },
+  );
+  if (r.error || r.status !== 0) return { ok: false, items: [] };
+  try {
+    const rows = JSON.parse(r.stdout);
+    return {
+      ok: true,
+      items: (Array.isArray(rows) ? rows : []).map((p) => ({
+        source: "github",
+        account,
+        repo: String(p?.repository?.nameWithOwner ?? p?.repository?.name ?? ""),
+        number: Number(p?.number) || 0,
+        title: scrub(String(p?.title ?? "")),
+        url: typeof p?.url === "string" ? p.url : null,
+        author: p?.author?.login ? String(p.author.login) : null,
+        updatedAt: typeof p?.updatedAt === "string" ? p.updatedAt : null,
+        role,
+      })),
+    };
+  } catch {
+    return { ok: false, items: [] };
+  }
+}
+
+/**
+ * Open pull requests on every host the pipeline can list, one list: every
+ * GitHub account gh is logged in to (personal and corporate alike) and the
+ * configured Bitbucket Server.
+ */
+export async function pullRequests({ env = process.env, redact = false } = {}) {
+  const accounts = await ghAccounts(env);
+  // gh before `auth token --user` hands out no token per account; then the
+  // active account answers alone, as a plain `gh search` does.
+  const envs = await Promise.all(accounts.map((a) => accountEnv(env, a)));
+  const perAccount = envs.some(Boolean);
+  const github = [];
+  if (accounts.length && perAccount) {
+    for (const [i, a] of accounts.entries()) {
+      const aEnv = envs[i];
+      if (!aEnv) {
+        github.push({
+          source: `github:${a.login}`,
+          ok: false,
+          items: [],
+          reason: "gh has no token for it",
+        });
+        continue;
+      }
+      const [rv, au] = await Promise.all([
+        ghSearch(aEnv, "reviewer", a.login),
+        ghSearch(aEnv, "author", a.login),
+      ]);
+      github.push({
+        source: `github:${a.login}`,
+        ok: rv.ok || au.ok,
+        items: [...rv.items, ...au.items],
+        reason: rv.ok || au.ok ? undefined : "gh could not list pull requests",
+      });
+    }
+  } else {
+    const [rv, au] = await Promise.all([ghSearch(env, "reviewer"), ghSearch(env, "author")]);
+    github.push({
+      source: "github",
+      ok: rv.ok || au.ok,
+      items: [...rv.items, ...au.items],
+      reason: rv.ok || au.ok ? undefined : "gh could not list pull requests",
+    });
+  }
+  const bitbucket = { source: "bitbucket", ...(await bitbucketPrs(env)) };
+  const seen = new Set();
+  const items = [];
+  const sources = [];
+  // A redacted answer (the phone's) names no login: accounts become numbers.
+  let accountNo = 0;
+  for (const src of [...github, bitbucket]) {
+    const label = redact && src.source.startsWith("github:") ? `github:${++accountNo}` : src.source;
+    let count = 0;
+    for (const p of src.items) {
+      const k = `${p.source}:${p.repo}#${p.number}`;
+      if (seen.has(k)) continue;
+      seen.add(k);
+      count++;
+      items.push(redact ? { ...p, url: null, account: null, author: null } : p);
+    }
+    sources.push(
+      src.ok
+        ? { source: label, ok: true, count }
+        : { source: label, ok: false, count: 0, reason: src.reason || "unreadable" },
+    );
+  }
+  items.sort((a, b) => ((a.updatedAt ?? "") < (b.updatedAt ?? "") ? 1 : -1));
+  return { contractVersion: CONTRACT_VERSION, items, sources };
+}
+
+function stateOf(taskId) {
+  const { found, records } = selectRuns({ taskId });
+  if (!found || !records.length) throw new WorkError("no-run", "no such run");
+  const dir = records[0].dir;
+  for (const p of [join(dir, "agent-state.json"), join(dir, "artifacts", "agent-state.json")]) {
+    if (existsSync(p)) return { taskId: records[0].taskId, state: readRegularJson(p, null) ?? {} };
+  }
+  throw new WorkError("no-review", "the run has no review to publish");
+}
+
+const FINISHED = new Set(["complete", "completed", "done"]);
+const TRIAGED = new Set(["accepted", "rejected", "deferred"]);
+
+/** A hash of the findings a decision is made from, in their recorded order. */
+export function findingsDigest(findings) {
+  const rows = findings.map((f) => [
+    f?.status ?? null,
+    f?.severity ?? null,
+    f?.file ?? null,
+    Number.isInteger(f?.line) ? f.line : null,
+    f?.issue ?? f?.title ?? null,
+  ]);
+  return createHash("sha256").update(JSON.stringify(rows)).digest("hex");
+}
+
+/**
+ * The verdict post-pr-review.sh would post for a review run, without posting.
+ * Refused when the run has no review input, its findings were never written,
+ * the run has not finished, or any finding is still untriaged.
+ */
+export function reviewVerdictPreview(taskId) {
+  const { taskId: id, state } = stateOf(taskId);
+  const review = state.review;
+  if (!review || typeof review !== "object" || !review.input) {
+    throw new WorkError("no-review", "the run has no review to publish");
+  }
+  if (!Array.isArray(review.findings)) {
+    throw new WorkError("no-findings", "the review has not recorded its findings yet");
+  }
+  if (!FINISHED.has(state.status)) {
+    throw new WorkError("review-incomplete", "the review run has not finished");
+  }
+  const untriaged = review.findings.filter((f) => !TRIAGED.has(f?.status)).length;
+  if (untriaged) {
+    throw new WorkError(
+      "review-incomplete",
+      `${untriaged} finding(s) are not triaged yet (accepted, rejected or deferred)`,
+    );
+  }
+  const accepted = review.findings.filter((f) => f?.status === "accepted");
+  const blocking = accepted.filter((f) => f?.severity === "blocking").length;
+  const important = accepted.filter((f) => f?.severity === "important").length;
+  return {
+    contractVersion: CONTRACT_VERSION,
+    taskId: id,
+    provider: ["github", "bitbucket-server"].includes(review.input.provider)
+      ? review.input.provider
+      : null,
+    prNumber: Number.isInteger(review.input.prNumber) ? review.input.prNumber : null,
+    decision: blocking === 0 && important === 0 ? "approve" : "needs-work",
+    acceptedBlocking: blocking,
+    acceptedImportant: important,
+    findings: review.findings.length,
+    findingsDigest: findingsDigest(review.findings),
+  };
+}
+
+/**
+ * Post the review and its verdict through post-pr-review.sh, as
+ * /multi-agent:review does. With `expected` ({decision, findingsDigest} from
+ * the preview a person confirmed), refused with `changed` when either differs
+ * now.
+ */
+export async function postReviewVerdict(taskId, env = process.env, expected = null) {
+  const preview = reviewVerdictPreview(taskId);
+  if (
+    expected &&
+    (expected.decision !== preview.decision || expected.findingsDigest !== preview.findingsDigest)
+  ) {
+    throw new WorkError("changed", "the findings or the decision changed since the preview");
+  }
+  const script = libScript(env, "post-pr-review.sh", "MA_POST_PR_REVIEW");
+  if (!script) throw new WorkError("not-installed", "post-pr-review.sh is not installed");
+  const r = await spawnAsync("bash", [script, preview.taskId], {
+    env,
+    timeoutMs: 5 * TIMEOUT_MS,
+    maxBytes: 1024 * 1024,
+  });
+  if (r.status !== 0) {
+    throw new WorkError("post-failed", `post-pr-review.sh exited ${r.status ?? "on a signal"}`);
+  }
+  return { ...preview, posted: true };
+}
+
+async function main(argv) {
+  const [cmd, arg, flag] = argv;
+  try {
+    let out;
+    if (cmd === "maturity" && arg) out = await issueMaturity(arg);
+    else if (cmd === "prs" && !arg) out = await pullRequests();
+    else if (cmd === "verdict" && arg && (flag === undefined || flag === "--post")) {
+      out = flag ? await postReviewVerdict(arg) : reviewVerdictPreview(arg);
+    } else {
+      process.stderr.write(
+        "usage: work-items.mjs maturity <key> | prs | verdict <task-id> [--post]\n",
+      );
+      return 2;
+    }
+    process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+    return 0;
+  } catch (err) {
+    if (!(err instanceof WorkError)) throw err;
+    process.stderr.write(`work-items: ${err.message}\n`);
+    return err.code === "no-run" ? 3 : 1;
+  }
+}
+
+if (invokedDirectly(import.meta.url)) {
+  runMain("work-items", async () => {
+    process.exitCode = await main(process.argv.slice(2));
+  });
+}

package/pipeline/skills/.skill-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-10-24T14:34:39Z",
-  "skillCount": 234,
+  "generatedAt": "2026-10-25T17:09:06Z",
+  "skillCount": 237,
   "entries": [
     {
       "path": "shared/core/apple-archive-compliance/SKILL.md",
@@ -29,7 +29,7 @@
     },
     {
       "path": "shared/core/multi-agent-autopilot-on/SKILL.md",
-      "sha256": "d4f23f6f7bb493a4efa2cfa252fab50b22b6506aeaf31985db4498b5f010c8c8"
+      "sha256": "7e4fbc84ed2bac8ba5fae1b9384ffbd6a40421a3df7bc1a63ef8f0f7fe6a3e55"
     },
     {
       "path": "shared/core/multi-agent-autopilot-status/SKILL.md",
@@ -127,13 +127,25 @@
       "path": "shared/core/multi-agent-model/SKILL.md",
       "sha256": "57ba710657d74176b0f19d4a97d3183df1f7b0c056eb1eef2792308914be836c"
     },
+    {
+      "path": "shared/core/multi-agent-office-off/SKILL.md",
+      "sha256": "316c7f1cd910e76096301330cac7e02f1a2b28e66cda88e9f8bb966a14553e9e"
+    },
+    {
+      "path": "shared/core/multi-agent-office-on/SKILL.md",
+      "sha256": "b46a2f79beeee65ae7ad6cbfc58b4631c5146a7761e91a99b8a056d6f49c690d"
+    },
+    {
+      "path": "shared/core/multi-agent-office-status/SKILL.md",
+      "sha256": "fba0513f8941c026172ea0ce76cbc76d88a5e813fd713d68a1377eb5a4204c86"
+    },
     {
       "path": "shared/core/multi-agent-postmortem/SKILL.md",
       "sha256": "41edd907cbaae1523eab1cd716390c9e9cd889574141cb88c33966e221b0987d"
     },
     {
       "path": "shared/core/multi-agent-prune-logs/SKILL.md",
-      "sha256": "9e0745c2aac474b401126218a7e0d81a72942cd331ac0e591da72407d523fda9"
+      "sha256": "649622e6f18887f986e0acd8b743df0a345a3adf89ccab58d6c4b191b770c1ac"
     },
     {
       "path": "shared/core/multi-agent-prune-prompts/SKILL.md",
@@ -169,7 +181,7 @@
     },
     {
       "path": "shared/core/multi-agent-review/SKILL.md",
-      "sha256": "e3a673e13b9b7a227334afe79e20e2be837c0900e16e88003b4692a1d74dea41"
+      "sha256": "4a110e0cc6c36185d76e1a99d7a397a937460377c6bc426714a236a5371a26b0"
     },
     {
       "path": "shared/core/multi-agent-route-off/SKILL.md",
@@ -201,7 +213,7 @@
     },
     {
       "path": "shared/core/multi-agent-scenario-audit/SKILL.md",
-      "sha256": "b31921106fa02f3ac48d3409b866a0d58a84dd98ec8888a4da37964ebbce48ef"
+      "sha256": "b8bc2de0e889007ae64d615e291ea6d369c96dbed0b62fed47cf19c372af4f1b"
     },
     {
       "path": "shared/core/multi-agent-search/SKILL.md",
@@ -213,7 +225,7 @@
     },
     {
       "path": "shared/core/multi-agent-serve/SKILL.md",
-      "sha256": "90e4dd7225e10e670118ed05d0c8a9e346112c4bbbdb24a7fe7c5c334a83e848"
+      "sha256": "82ba766a7b23285f1b2b3eba2bcbd671ade82b28cc094093832075970504f732"
     },
     {
       "path": "shared/core/multi-agent-setup/SKILL.md",
@@ -221,7 +233,7 @@
     },
     {
       "path": "shared/core/multi-agent-stack/SKILL.md",
-      "sha256": "ac964cd00dd6ed06512530489d867efbc51d7d7614265f9aa022679325d5defe"
+      "sha256": "0e32b95c62324bb592d10b4c2c515509998e7260f6c4aae94271683ede9ba763"
     },
     {
       "path": "shared/core/multi-agent-status/SKILL.md",
@@ -229,7 +241,7 @@
     },
     {
       "path": "shared/core/multi-agent-steer/SKILL.md",
-      "sha256": "20f332bd2fe2745da5341f8d8187211fc47c06b4b5f5031e217affee0282ddb5"
+      "sha256": "9ac0c48c3cbafd98022a04b24ef4f16723dda6a852202002231f43bbb7dd453b"
     },
     {
       "path": "shared/core/multi-agent-store-ready/SKILL.md",
@@ -237,7 +249,7 @@
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",
-      "sha256": "e96afa9b89a2ab6e2fe13a01158f98272c6828e5cef03c8909240766aaefd44b"
+      "sha256": "17f734fa2b84d9a4c757f9745be8ff40d3097f5de89caf55124b48439a737093"
     },
     {
       "path": "shared/core/multi-agent-test-accessibility/SKILL.md",
@@ -253,7 +265,7 @@
     },
     {
       "path": "shared/core/multi-agent-test-gen/SKILL.md",
-      "sha256": "0da450ed0c74ab610d3c8f0cf1b0facd2a4ae179afc832440939c3367de7e762"
+      "sha256": "a66d1171455d95df92a367095eeec11f50033d86c53a7d0032597cebd40d6f21"
     },
     {
       "path": "shared/core/multi-agent-test-screenshots/SKILL.md",

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "skillCount": 234,
+  "skillCount": 237,
   "entries": [
     {
       "name": "accessibility-compliance-accessibility-audit",
@@ -1355,6 +1355,39 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-model/SKILL.md"
     },
+    {
+      "name": "multi-agent-office-off",
+      "description": "Close the office panel and stop its local server. Use when done with the panel.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-office-off",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-office-off/SKILL.md"
+    },
+    {
+      "name": "multi-agent-office-on",
+      "description": "Open the office: a local browser page that shows runs and agents live and drives the ecosystem (new runs, jobs, PRs, keys, memory, system, cleanup). Use when you want to watch or drive runs from a browser.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-office-on",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-office-on/SKILL.md"
+    },
+    {
+      "name": "multi-agent-office-status",
+      "description": "Whether the office panel is running, its URL (never the token) and its last actions. Use when unsure if the panel is open.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-office-status",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-office-status/SKILL.md"
+    },
     {
       "name": "multi-agent-postmortem",
       "description": "Post-mortem of a run from its session transcripts: loops, stalls, root-cause hypotheses on file:line, fixes. Read-only, redacted. Use when a run went wrong or ran far too long.",

package/pipeline/skills/shared/README.md

@@ -2,11 +2,11 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 234 skills (69 core + 165 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 237 skills (72 core + 165 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
-- **`core/`**  -  69 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
+- **`core/`**  -  72 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
 - **`external/`**  -  165 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
@@ -14,7 +14,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 
 ## Categories
 
-- [Pipeline Orchestration](#pipeline-orchestration)  -  69
+- [Pipeline Orchestration](#pipeline-orchestration)  -  72
 - [iOS / Apple Ecosystem](#ios-apple-ecosystem)  -  94
 - [Android / Kotlin](#android-kotlin)  -  16
 - [Web](#web)  -  10
@@ -57,6 +57,9 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-log`](./core/multi-agent-log/) | `core` | Show the agent-log.md for the given task. With no ID, shows the most recent task. Use when asked what a task did, or to read its log. |
 | [`multi-agent-manual-test`](./core/multi-agent-manual-test/) | `core` | Switch to the active task's branch and prepare it for manual testing in Xcode. Phase 3 user-test step, standalone (the UI Bug Hunter lives a |
 | [`multi-agent-model`](./core/multi-agent-model/) | `core` | Turn the top model rung on or off and keep the cost ledger's pricing in step with it. Use when asked to enable or disable Fable, or which mo |
+| [`multi-agent-office-off`](./core/multi-agent-office-off/) | `core` | Close the office panel and stop its local server. Use when done with the panel. |
+| [`multi-agent-office-on`](./core/multi-agent-office-on/) | `core` | Open the office: a local browser page that shows runs and agents live and drives the ecosystem (new runs, jobs, PRs, keys, memory, system, c |
+| [`multi-agent-office-status`](./core/multi-agent-office-status/) | `core` | Whether the office panel is running, its URL (never the token) and its last actions. Use when unsure if the panel is open. |
 | [`multi-agent-postmortem`](./core/multi-agent-postmortem/) | `core` | Post-mortem of a run from its session transcripts: loops, stalls, root-cause hypotheses on file:line, fixes. Read-only, redacted. Use when a |
 | [`multi-agent-prune-logs`](./core/multi-agent-prune-logs/) | `core` | Delete per-task project logs under ~/.claude/logs/multi-agent (filter by age/project/task). Audit trail + metrics are preserved. Dry-run fir |
 | [`multi-agent-prune-prompts`](./core/multi-agent-prune-prompts/) | `core` | Zero-base prompt review: measure the always-on instruction footprint, classify every rule block, propose keep/trial-removal/delete; applies  |