@mmerterden/multi-agent-pipeline 20.3.0 → 20.4.0

package/pipeline/skills/shared/core/multi-agent/SKILL.md

@@ -525,7 +525,7 @@ Lets the user test the code before the PR. The prompt MUST say that yes **remove
 6. **Issue body update** (if GitHub Issue exists):
    - Fill PR links in issue body: `- **common:** {PR URL}`, `- **uicomponents:** {PR URL}`
    - Update Progress flags: `Implementation 🟢`, `Testing 🟢`, `Code Connect 🟢`
-   - Use `gh issue edit {issueNo} --body "{updated body}"`  -  preserve all existing sections
+   - Write the updated body to a temp file and use `gh issue edit {issueNo} --body-file <file>`  -  preserve all existing sections
 7. Log: `📦 Phase 4: Commit {sha}  -  PR #{number}`
 
 ### Phase 5 Report Step 2: WIKI + Figma Screenshots (for component tasks with GitHub Issue)
@@ -541,8 +541,8 @@ Skip this sub-step if the task is NOT a component implementation (e.g., bug fix,
 3. **Fetch Figma screenshot** via REST API:
    ```bash
    FIGMA_TOKEN=$(~/.copilot/lib/credential-store.sh get "Figma_Access_Token")
-   curl -s "https://api.figma.com/v1/images/{fileKey}?ids={nodeId}&format=png&scale=2" \
-     -H "X-Figma-Token: $FIGMA_TOKEN"
+   printf 'X-Figma-Token: %s\n' "$FIGMA_TOKEN" | curl -s -H @- \
+     "https://api.figma.com/v1/images/{fileKey}?ids={nodeId}&format=png&scale=2"
    # Download the image URL to {wikiComponentPath}/assets/screenshot.png
    ```
 4. **Generate main wiki page** (`{ComponentName}.md`):
@@ -557,7 +557,9 @@ Skip this sub-step if the task is NOT a component implementation (e.g., bug fix,
    ```bash
    cd {wikiRoot}
    git add {wikiCategory}/{ComponentName}/
-   git commit -m "docs({scope}): add {ComponentName} wiki pages [PROJ-{id}]"
+   git commit -F - <<'MA_MSG'
+   docs({scope}): add {ComponentName} wiki pages [PROJ-{id}]
+   MA_MSG
    git fetch origin && git rebase origin/master
    git push origin HEAD:master
    ```

package/pipeline/skills/shared/core/multi-agent-channels/SKILL.md

@@ -79,7 +79,7 @@ Rendered in English (`promptLanguage` is locked to `en`).
 ### PR description (Bitbucket reviewer-preserving PUT)
 
 ```bash
-PR_JSON=$(curl -s -u "$BB_USER:$BB_TOKEN" "$PR_URL")
+PR_JSON=$(curl -s --config <(printf 'user = "%s:%s"\n' "$BB_USER" "$BB_TOKEN") "$PR_URL")
 REVIEWERS=$(jq '[.reviewers[] | {user: {name: .user.name}, approved, status}]' <<< "$PR_JSON")
 VERSION=$(jq -r '.version' <<< "$PR_JSON")
 TITLE=$(jq -r '.title' <<< "$PR_JSON")
@@ -96,7 +96,7 @@ jq -n --rawfile body /tmp/channels-$TASK_ID-pr.md \
         reviewers: $reviewers, fromRef: $fromRef, toRef: $toRef, draft: $draft}' \
   > /tmp/channels-$TASK_ID-pr-payload.json
 
-curl -s -X PUT -u "$BB_USER:$BB_TOKEN" -H "Content-Type: application/json" \
+curl -s -X PUT --config <(printf 'user = "%s:%s"\n' "$BB_USER" "$BB_TOKEN") -H "Content-Type: application/json" \
      --data-binary @/tmp/channels-$TASK_ID-pr-payload.json "$PR_URL"
 ```
 

package/pipeline/skills/shared/core/multi-agent-jira/SKILL.md

@@ -23,8 +23,8 @@ Interactively list the user's open Jira issues, let the user pick one, and send
 
 2. **Fetch the open issues**  -  via the Jira REST API:
    ```bash
-   curl -s "https://$JIRA_HOST/rest/api/2/search?jql=assignee=currentUser()+AND+status+not+in+(Done,Closed)&fields=key,summary,status" \
-     -H "Authorization: Bearer $JIRA_TOKEN"
+   printf 'Authorization: Bearer %s\n' "$JIRA_TOKEN" | curl -s -H @- \
+     "https://$JIRA_HOST/rest/api/2/search?jql=assignee=currentUser()+AND+status+not+in+(Done,Closed)&fields=key,summary,status"
    ```
 
 3. **Let the user pick**  -  present the issues as options

package/pipeline/skills/shared/core/multi-agent-refactor/SKILL.md

@@ -86,7 +86,7 @@ The upstream mapping is **configuration, never hardcoded** (it can reference pri
 }
 ```
 
-**The plugin cache is a mirror, not the authority.** `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/` only holds whatever the last `claude marketplace update` fetched. Reading it as the current upstream version is how this step reported "up to date" while the derivation was four releases behind: the cache sat at 0.2.1 and upstream was at 0.4.1. Resolve in the order below and never let the cache alone produce an "up to date" verdict.
+**The plugin cache is a mirror, not the authority.** `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/` only holds whatever the last `claude plugin marketplace update` fetched. Reading it as the current upstream version is how this step reported "up to date" while the derivation was four releases behind: the cache sat at 0.2.1 and upstream was at 0.4.1. Resolve in the order below and never let the cache alone produce an "up to date" verdict.
 
 **Which manifest carries the version** is `upstreamVersionSource`, default `marketplace.json`. That is what a marketplace consumer actually resolves, and some upstreams keep per-plugin `plugin.json` versions deliberately unused - reading those records a version nobody ships. An entry here was recorded at 0.7.0 from `plugin.json` while the upstream marketplace said 0.6.0 and its CHANGELOG stated in as many words that `plugin.json` is not used.
 

package/pipeline/skills/shared/core/multi-agent-stack/SKILL.md

@@ -66,10 +66,8 @@ REPO_SETTINGS=".claude/settings.json"
 MP="multi-agent-plugins"
 
 # --- ensure the marketplace is known (idempotent) -------------------------
-if ! claude marketplace list 2>/dev/null | grep -q "$MP"; then
-  claude marketplace add {owner}/multi-agent-plugins 2>/dev/null \
-    || echo "note: add the marketplace once with: claude marketplace add {owner}/multi-agent-plugins"
-fi
+bash "$HOME/.claude/scripts/plugin-refresh.sh" {owner} --add-only \
+  || echo "note: add the marketplace once with: claude plugin marketplace add {owner}/$MP"
 
 COMMON="ai-common-toolkit@${MP}"
 ANALYST="ai-analyst-toolkit@${MP}"

package/pipeline/skills/shared/core/multi-agent-update/SKILL.md

@@ -36,7 +36,7 @@ Update the pipeline with a single command. Preferences are preserved; only skill
 3. `git pull origin main`
 4. `node install.js --all` (Claude + Copilot)
 4b. Refresh the stack-plugin marketplace so the latest plugin versions are picked up:
-   `claude marketplace update multi-agent-plugins` (or `claude marketplace add {owner}/multi-agent-plugins` if not yet added)
+   `bash "$HOME/.claude/scripts/plugin-refresh.sh" {owner}` (adds the marketplace if needed, refreshes it, then runs `claude plugin update` for every installed plugin)
 5. `node migrate-prefs.mjs` (if there is a schema upgrade)
 5b. `node "$HOME/.claude/scripts/usage-register.mjs"` - operational reporting.
    It requests a per-machine **write-only** token when none resolves, stores it in

package/pipeline/skills/shared/external/localization-reuse-map/scripts/build-artifact.py

@@ -770,7 +770,7 @@ def upload_curl(slug, m):
         "# Equivalent by hand (curl, Server/DC Bearer PAT  -  NOT Cloud user:token).\n"
         "# $CONFLUENCE_BASE_URL / $CONFLUENCE_SPACE / $CONFLUENCE_PARENT are your wiki's target:\n"
         '#   TOKEN=$(security find-generic-password -s CONFLUENCE_API_TOKEN -w)\n'
-        '#   curl -sS -H "Authorization: Bearer $TOKEN" -X POST '
+        '#   printf \'Authorization: Bearer %s\\n\' "$TOKEN" | curl -sS -H @- -X POST '
         '"$CONFLUENCE_BASE_URL/rest/api/content" \\\n'
         '#     -H "Content-Type: application/json" -d @- <<JSON\n'
         f'#   {{"type":"page","title":{json.dumps(PAGE_TITLE_PREFIX + "-" + screen)},'