@mmerterden/multi-agent-pipeline 20.3.1 → 20.5.0

package/pipeline/agents/plan-critic.md

@@ -4,6 +4,7 @@ description: "Phase 1 adversarial plan critic  -  runs once after the plan valid
 model: fable
 preferredModel: fable
 modelRationale: "Finding the failure a planner did not see is judgement over the whole plan, analysis and codebase, so it takes the top rung. Resolved through model-dispatch.sh with a fable default: opus while the fable rung is off, the same resolution review uses. On opus the critic is the planner's own model, which weakens the independence the role exists for; plan-critique-gate.mjs, not the critic, decides the gate either way."
+disallowedTools: Write, Edit, NotebookEdit
 ---
 
 # Plan Critic Agent  -  Phase 1, one round

package/pipeline/agents/security-auditor.md

@@ -4,6 +4,7 @@ description: Security specialist  -  static application security review across m
 model: opus
 preferredModel: opus
 modelRationale: "Security reasoning + compliance catalog cross-reference (OWASP Web/API Top 10, OWASP Mobile Top 10, Apple ITMS, Google Play policy) plus honest confidence calibration on subtle vulnerabilities (auth-flow gaps, injection sinks, SSRF, cert-pinning bypass, sensitive-data leaks). False negatives are expensive and a wrong severity is worse than silence; opus (top available tier) keeps the miss rate and the miscalibration rate low."
+disallowedTools: Write, Edit, NotebookEdit
 ---
 
 You are a static application security auditor. You read code, configuration and dependency manifests and report vulnerabilities. You do NOT run the application, fire payloads, or reach a live target: this is a defensive, read-only review. Everything you claim is grounded in something you can point to in the source.

package/pipeline/agents/task-clarifier.md

@@ -4,6 +4,7 @@ description: "Phase 0 Step 9 task ambiguity scorer  -  reads task description, e
 model: haiku
 preferredModel: haiku
 modelRationale: "Ambiguity scoring is a low-stakes classification + targeted question generation. Haiku hits this well  -  short context (issue body + Jira description), structured JSON output, no reasoning chain needed. Sonnet override is available via PHASE_MODEL_OVERRIDE for repos where ambiguity nuance matters (legal, regulated domains)."
+disallowedTools: Write, Edit, NotebookEdit
 ---
 
 # Task Clarifier Agent  -  Phase 0 Step 9

package/pipeline/commands/figma-to-swiftui.md

@@ -191,8 +191,8 @@ WIKI_BRANCH=$(git -C "$WIKI_REL_ABS" symbolic-ref refs/remotes/origin/HEAD 2>/de
 
 2. **Fetch design-source screenshot** (Figma by default; other sources swap the fetch call):
    ```bash
-   RESPONSE=$(curl -s "https://api.figma.com/v1/images/{fileKey}?ids={nodeId}&format=png&scale=2" \
-     -H "X-Figma-Token: $DESIGN_TOKEN")
+   RESPONSE=$(printf 'X-Figma-Token: %s\n' "$DESIGN_TOKEN" | curl -s -H @- \
+     "https://api.figma.com/v1/images/{fileKey}?ids={nodeId}&format=png&scale=2")
    IMAGE_URL=$(echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['images']['{nodeId}'])")
    curl -s -o "$WIKI_REL_ABS/{wikiCategory}/{ComponentName}/assets/screenshot.png" "$IMAGE_URL"
    ```
@@ -209,7 +209,9 @@ WIKI_BRANCH=$(git -C "$WIKI_REL_ABS" symbolic-ref refs/remotes/origin/HEAD 2>/de
    cd "$WIKI_REL_ABS"
    git add "{wikiCategory}/{ComponentName}/"
    git -c user.name="{identity.name}" -c user.email="{identity.email}" \
-     commit -m "docs({scope}): add {ComponentName} wiki pages [{jiraId}]"
+     commit -F - <<'MA_MSG'
+   docs({scope}): add {ComponentName} wiki pages [{jiraId}]
+   MA_MSG
    git fetch origin && git rebase "origin/$WIKI_BRANCH"
    git push origin "HEAD:$WIKI_BRANCH"
    ```
@@ -250,7 +252,7 @@ If a GitHub Issue tracks this component, update its body after commit + PR:
 - Fill the `### Pull Requests` section with PR URL(s), one row per submodule touched
 - Flip Implementation / Testing / Code Connect flags from Pending to Done using whatever marker the template uses (match in place, don't introduce new markers)
 - Flip the Wiki flag to Done (SubPhase 4F already pushed the wiki pages)
-- Apply with `gh issue edit {issueNo} --body "{updated body}"`  -  preserve every other section unchanged
+- Write the updated body to a temp file and apply it with `gh issue edit {issueNo} --body-file <file>`  -  preserve every other section unchanged
 - NEVER use `Closes:` / `Fixes:` / `Resolves:` keywords  -  use `Ref:` or `Related:` instead
 
 Skip this phase if the task has no GitHub Issue (Jira-only or free-text runs).

package/pipeline/commands/multi-agent/autopilot-on/SKILL.md

@@ -76,7 +76,7 @@ The same name works on both sides and both mechanisms already exist:
 
 | Source | Query | Extra condition |
 |---|---|---|
-| GitHub | `gh issue list --repo <r> --label <label> --state open` | none - the label is the whole gate |
+| GitHub | `gh issue list --repo <r> --label <label> --assignee @me --state open` | **assigned to you** (`githubAssignee`, `"*"` for any), so a label an issue form applies is not enough |
 | Jira | `assignee = currentUser() AND labels = "<label>" AND resolution = EMPTY AND status not in (Done, Closed, Cancelled)` | **assigned to you**, so a label somebody else adds is not enough |
 
 Two Jira caveats worth saying out loud when Jira is selected: labels are one

package/pipeline/commands/multi-agent/jira/SKILL.md

@@ -31,7 +31,7 @@ ACCOUNTS=$(~/.claude/lib/account-resolver.sh --providers jira)
 Fetch projects:
 ```bash
 TOKEN=$(~/.claude/lib/credential-store.sh get "$ACCOUNT_JIRA_TOKEN_KEY")
-curl -s -H "Authorization: Bearer $TOKEN" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s -H @- \
   "https://$ACCOUNT_JIRA_HOST/rest/api/2/project" \
   | python3 -c 'import json,sys; [print(p["key"]+"\t"+p["name"]) for p in json.load(sys.stdin)]'
 ```
@@ -45,7 +45,7 @@ The same list, already merged, sorted and scrubbed of hosts and URLs, is `node "
 Combine open issues across selected projects, sort by priority + status:
 ```bash
 JQL="assignee=currentUser() AND project in (${JIRA_PROJECT_KEYS}) AND resolution = EMPTY AND status not in (Done,Closed,Cancelled)"
-curl -s -H "Authorization: Bearer $TOKEN" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s -H @- \
   "https://$ACCOUNT_JIRA_HOST/rest/api/2/search?jql=$(printf '%s' "$JQL" | python3 -c 'import sys,urllib.parse; print(urllib.parse.quote(sys.stdin.read()))')&fields=key,summary,status,issuetype,priority,resolution,fixVersions&maxResults=50"
 ```
 

package/pipeline/commands/multi-agent/refactor/SKILL.md

@@ -88,7 +88,7 @@ The upstream mapping is **configuration, never hardcoded** (it can reference pri
 }
 ```
 
-**The plugin cache is a mirror, not the authority.** `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/` only holds whatever the last `claude marketplace update` fetched. Reading it as the current upstream version is how this step reported "up to date" while the derivation was four releases behind: the cache sat at 0.2.1 and upstream was at 0.4.1. Resolve in the order below and never let the cache alone produce an "up to date" verdict.
+**The plugin cache is a mirror, not the authority.** `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/` only holds whatever the last `claude plugin marketplace update` fetched. Reading it as the current upstream version is how this step reported "up to date" while the derivation was four releases behind: the cache sat at 0.2.1 and upstream was at 0.4.1. Resolve in the order below and never let the cache alone produce an "up to date" verdict.
 
 **Which manifest carries the version** is `upstreamVersionSource`, default `marketplace.json`. That is what a marketplace consumer actually resolves, and some upstreams keep per-plugin `plugin.json` versions deliberately unused - reading those records a version nobody ships. An entry here was recorded at 0.7.0 from `plugin.json` while the upstream marketplace said 0.6.0 and its CHANGELOG stated in as many words that `plugin.json` is not used.
 

package/pipeline/commands/multi-agent/review/SKILL.md

@@ -131,7 +131,7 @@ BB_USER=$("$CRED_STORE" get "$USER_KEY")
 BB_TOKEN=$("$CRED_STORE" get "$TOKEN_KEY")
 
 DIFF_FILE="/tmp/multi-agent-review-${TASK_ID}-diff.patch"
-http=$(curl -sS -m 60 -u "$BB_USER:$BB_TOKEN" -H "Accept: text/plain" \
+http=$(curl -sS -m 60 --config <(printf 'user = "%s:%s"\n' "$BB_USER" "$BB_TOKEN") -H "Accept: text/plain" \
   "https://$bb_server_host/rest/api/1.0/projects/$bb_project_key/repos/$bb_repo_slug/pull-requests/$pr_number/diff?contextLines=10" \
   -o "$DIFF_FILE" -w '%{http_code}')
 if [ "$http" != "200" ]; then

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -446,7 +446,7 @@ Save to `prefs.global.hosts.{service}`. For Fortify, also ask `Fortify project v
 For Jira, **discover the project keys instead of asking the user to recall them.** The token is already saved and the host is already known, so ask Jira which projects this person actually works in - a corporate instance has thousands of projects, and a typed key is a typo waiting to route branches and new issues at the wrong board:
 
 ```bash
-curl -s -H "Authorization: Bearer $TOKEN" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s -H @- \
   "https://{JIRA_HOST}/rest/api/2/search?jql=assignee%3DcurrentUser()%20OR%20reporter%3DcurrentUser()%20ORDER%20BY%20updated%20DESC&fields=project&maxResults=100" \
   | jq -r '[.issues[].fields.project | "\(.key)\t\(.name)"] | unique | .[]'
 ```
@@ -804,7 +804,7 @@ Stack skills ship as versioned plugins in the `{owner}/multi-agent-plugins` mark
 
 1. Ensure the marketplace is known (idempotent):
    ```bash
-   claude marketplace add {owner}/multi-agent-plugins 2>/dev/null || true
+   bash "$HOME/.claude/scripts/plugin-refresh.sh" {owner} --add-only
    ```
 2. Ask the detector, then derive. No marker list here: a second list is a second
    answer, and this one defaulted to `ai-ios-toolkit` when nothing matched - how

package/pipeline/commands/multi-agent/stack/SKILL.md

@@ -80,10 +80,8 @@ REPO_SETTINGS=".claude/settings.json"
 MP="multi-agent-plugins"
 
 # --- ensure the marketplace is known (idempotent) -------------------------
-if ! claude marketplace list 2>/dev/null | grep -q "$MP"; then
-  claude marketplace add {owner}/multi-agent-plugins 2>/dev/null \
-    || echo "note: add the marketplace once with: claude marketplace add {owner}/multi-agent-plugins"
-fi
+bash "$HOME/.claude/scripts/plugin-refresh.sh" {owner} --add-only \
+  || echo "note: add the marketplace once with: claude plugin marketplace add {owner}/$MP"
 
 # Enable-mode only: with zero args the write rules below would set every stack
 # toolkit to false (nothing but the always-on pair is in $ON), silently wiping the repo's

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -234,7 +234,7 @@ node "$HOME/multi-agent-pipeline/pipeline/scripts/build-stack-plugins.mjs" --dry
 node "$HOME/multi-agent-pipeline/pipeline/scripts/build-stack-plugins.mjs"
 ```
 
-**Version-based management:** the generator bumps a plugin's `version` (patch) only when its skill set actually changed. Idempotent - a no-op run bumps nothing. Consumers pick up new versions via `/multi-agent:update` (which runs `claude marketplace update multi-agent-plugins`).
+**Version-based management:** the generator bumps a plugin's `version` (patch) only when its skill set actually changed. Idempotent - a no-op run bumps nothing. Consumers pick up new versions via `/multi-agent:update` (which refreshes the catalog with `claude plugin marketplace update multi-agent-plugins`, then runs `claude plugin update` for each installed plugin).
 
 **Help + README freshness (mandatory when the generator reported any change):**
 
@@ -329,7 +329,7 @@ for d in tools/*/; do printf '%s' "$PACK" | grep -q "$d" || echo "ABORT: $d miss
 ```bash
 gh auth switch --user {owner}
 git add -A
-git commit -m "{type}(v$NEW): {what changed}"    # that repo's own commit convention
+git commit -F "/tmp/release-msg-$NEW.txt"   # "{type}(v$NEW): {what changed}", written with the file tool
 git tag "v$NEW" && git push origin main --tags
 ```
 

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -52,7 +52,9 @@ A git clone of the pipeline repo is a maintainer workspace, kept in sync by `/mu
    line above is where the floor is reported, so the user sees why a run halted;
    `$REQUIRED` does not survive into the later shell blocks.
 
-2. **Stop early when already current** (still refresh the marketplace, step 4b):
+2. **Stop early when already current.** When the line below prints, skip
+   step 3 (no download, no reinstall) and continue at step 4b, so the stack
+   plugins are still refreshed:
    ```bash
    [ "$CUR" = "$LATEST" ] && echo "✓ Already up to date: v$LATEST"
    ```
@@ -83,18 +85,11 @@ A git clone of the pipeline repo is a maintainer workspace, kept in sync by `/mu
 
    The installer refreshes every configured CLI target (Claude Code, Copilot CLI, Codex CLI) and writes the new version to `$HOME/.claude/.pipeline-version`.
 
-4b. **Update the stack-plugin marketplace** (pulls the latest plugin versions):
+4b. **Update the stack plugins** (catalog refresh, then every installed plugin in its own scope):
    ```bash
-   # Stack skills ship as versioned plugins in {owner}/multi-agent-plugins.
-   # Refresh the marketplace so newly published plugin versions are picked up.
-   if claude marketplace list 2>/dev/null | grep -q "multi-agent-plugins"; then
-     claude marketplace update multi-agent-plugins 2>/dev/null \
-       || claude marketplace add {owner}/multi-agent-plugins 2>/dev/null
-     echo "  -> marketplace multi-agent-plugins refreshed"
-   else
-     echo "  -> marketplace not added yet; add with: claude marketplace add {owner}/multi-agent-plugins"
-   fi
+   bash "$HOME/.claude/scripts/plugin-refresh.sh" {owner}
    ```
+   A non-zero exit means a step failed and the CLI's own error is already on screen. Report it to the user; do not retry silently.
 
 4c. **Prune retired adapter files** (Cursor / Antigravity / Copilot Chat were removed in v10.7.0 - the pipeline targets Claude Code, Copilot CLI and Codex CLI):
    ```bash

package/pipeline/lib/redact.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+/**
+ * redact.mjs  -  replace every credential in a text with a visible marker.
+ *
+ * Uses the certain rules of outbound-gate.mjs, so the log writers, the commit
+ * hook and the outbound gate recognise one provider set. A match becomes
+ * `[redacted:<rule>]`; the text around it is kept, because a log line is read
+ * to debug a failure and the message is what makes it useful.
+ *
+ * As a CLI it reads stdin and writes the redacted text to stdout. It never
+ * fails its caller: on an internal error it writes the input unchanged.
+ *
+ * @module pipeline/lib/redact
+ */
+
+import { RULES } from "./outbound-gate.mjs";
+import { invokedDirectly } from "./invoked-directly.mjs";
+
+const CERTAIN = RULES.filter((r) => r.certain);
+
+/** @param {string} text */
+export function redact(text) {
+  if (typeof text !== "string" || !text) return text;
+  let out = text;
+  for (const rule of CERTAIN) {
+    const re = new RegExp(
+      rule.re.source,
+      rule.re.flags.includes("g") ? rule.re.flags : `${rule.re.flags}g`,
+    );
+    out = out.replace(re, () =>
+      rule.name === "url-with-credentials" ? `[redacted:${rule.name}]@` : `[redacted:${rule.name}]`,
+    );
+  }
+  return out;
+}
+
+if (invokedDirectly(import.meta.url)) {
+  let input = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (d) => (input += d));
+  process.stdin.on("end", () => {
+    let out;
+    try {
+      out = redact(input);
+    } catch {
+      out = input;
+    }
+    process.stdout.write(out);
+  });
+}

package/pipeline/multi-agent-refs/channels/pr.md

@@ -251,7 +251,7 @@ The two adapters run in the same phase over the same source markdown, so the fai
 ## Reviewer-preserving Bitbucket payload (required)
 
 ```bash
-PR_JSON=$(curl -s -u "$BB_USER:$BB_TOKEN" "$PR_URL")
+PR_JSON=$(curl -s --config <(printf 'user = "%s:%s"\n' "$BB_USER" "$BB_TOKEN") "$PR_URL")
 REVIEWERS=$(jq '[.reviewers[] | {user: {name: .user.name}, approved, status}]' <<< "$PR_JSON")
 VERSION=$(jq -r '.version' <<< "$PR_JSON")
 TITLE=$(jq -r '.title' <<< "$PR_JSON")
@@ -268,7 +268,7 @@ jq -n --rawfile body /tmp/channels-$TASK_ID-pr.md \
         reviewers: $reviewers, fromRef: $fromRef, toRef: $toRef, draft: $draft}' \
   > /tmp/channels-$TASK_ID-pr-payload.json
 
-curl -s -X PUT -u "$BB_USER:$BB_TOKEN" -H "Content-Type: application/json" \
+curl -s -X PUT --config <(printf 'user = "%s:%s"\n' "$BB_USER" "$BB_TOKEN") -H "Content-Type: application/json" \
      --data-binary @/tmp/channels-$TASK_ID-pr-payload.json "$PR_URL"
 ```
 

package/pipeline/multi-agent-refs/features/doctor.md

@@ -167,7 +167,8 @@ reaches Phase 4 and stops there.
 ### hook-coverage
 
 The blocking `PreToolUse` gates from `templates/claude-hooks.json` are present in
-`settings.json`. WARN. SKIP when the template is not installed - which was the
+`settings.json`, and none of them is registered twice on the same matcher
+(Claude Code runs a duplicate on every matching call). WARN. SKIP when the template is not installed - which was the
 permanent state until the installer began copying `templates/`, and is exactly
 the case this severity exists to make visible.
 

package/pipeline/multi-agent-refs/features/prior-fix-detection.md

@@ -19,7 +19,7 @@ Before any analysis, check if this issue was already fixed by someone else.
 3. **Jira comments/status**  -  fetch latest comments to see if someone reported a fix:
 
    ```bash
-   curl -s -H "Authorization: Bearer $JIRA_TOKEN" \
+   printf 'Authorization: Bearer %s\n' "$JIRA_TOKEN" | curl -s -H @- \
      "$JIRA_BASE/issue/{jiraId}?fields=status,comment&expand=changelog" \
      | jq '.fields.status.name, .fields.comment.comments[-3:][]?.body'
    ```

package/pipeline/multi-agent-refs/features/unattended-security.md

@@ -589,6 +589,11 @@ hashes `~/.claude/{scripts,lib}`, the settings files, the profile and
 `~/Library/LaunchAgents` before and after publish verification (`hostFingerprint`
 in `autopilot-publish.mjs`) and refuses to push if any changed.
 
+It also refuses to launch (`blocked-version-floor`) while the installed version
+is below the published `required` floor (`require-supported-version.sh` exits
+3): the child's Phase 0 would halt on the same check, and the update it needs is
+refused unattended. Like every `blocked-*` outcome it is not an attempt.
+
 The profile's `env` reaches the session and the commands it runs. The Claude
 Code docs pass environment to a stdio MCP server through the server entry, so
 pin the two toolkit variables there as well: `claude mcp add --env

package/pipeline/multi-agent-refs/generate-issue.md

@@ -79,7 +79,7 @@ Fallback chain (same as `$HOME/.claude/multi-agent-refs/issue-jira-triad.md` Cre
 2. `prefs.global.defaultJiraKey`
 3. Fetch and ask:
 ```bash
-curl -s -H "Authorization: Bearer $TOKEN" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s -H @- \
   "https://$ACCOUNT_JIRA_HOST/rest/api/2/project" \
   | python3 -c 'import json,sys; [print(p["key"]+"\t"+p["name"]) for p in json.load(sys.stdin)]'
 ```
@@ -108,7 +108,7 @@ Three GET groups. Run them before drafting anything.
 **5a. Sample recent same-type issues:**
 ```bash
 JQL="project = ${PROJECT_KEY} AND issuetype = ${ISSUE_TYPE} ORDER BY created DESC"
-curl -s -H "Authorization: Bearer $TOKEN" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s -H @- \
   "https://$ACCOUNT_JIRA_HOST/rest/api/2/search?jql=$(printf '%s' "$JQL" | python3 -c 'import sys,urllib.parse; print(urllib.parse.quote(sys.stdin.read()))')&fields=summary,description,labels,components,priority,fixVersions,issuelinks&maxResults=30"
 ```
 Extract from the sample (thresholds are guidance, not hard gates):
@@ -123,7 +123,7 @@ Extract from the sample (thresholds are guidance, not hard gates):
 
 **5b. Field discovery (createmeta):**
 ```bash
-curl -s -H "Authorization: Bearer $TOKEN" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s -H @- \
   "https://$ACCOUNT_JIRA_HOST/rest/api/2/issue/createmeta?projectKeys=${PROJECT_KEY}&issuetypeNames=${ISSUE_TYPE}&expand=projects.issuetypes.fields"
 ```
 - 404 or empty `projects[]` (newer Jira DC deprecates the classic form) → fall back to the paged endpoint: `GET /rest/api/2/issue/createmeta/{PROJECT_KEY}/issuetypes` then `GET /rest/api/2/issue/createmeta/{PROJECT_KEY}/issuetypes/{issuetypeId}`.
@@ -136,9 +136,9 @@ curl -s -H "Authorization: Bearer $TOKEN" \
 
 **5c. Board + active sprint (Agile REST):**
 ```bash
-curl -s -H "Authorization: Bearer $TOKEN" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s -H @- \
   "https://$ACCOUNT_JIRA_HOST/rest/agile/1.0/board?projectKeyOrId=${PROJECT_KEY}"
-curl -s -H "Authorization: Bearer $TOKEN" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -s -H @- \
   "https://$ACCOUNT_JIRA_HOST/rest/agile/1.0/board/${BOARD_ID}/sprint?state=active"
 ```
 - Multiple boards → AskUserQuestion (board name + type). One board → silent. Zero boards or Agile API 404 → the sprint option is silently omitted; the preview notes "backlog only (no board found)".
@@ -217,7 +217,7 @@ jq -n --rawfile desc /tmp/generate-issue-$$-escaped.txt \
   '{fields: {project: {key: $key}, issuetype: {name: $type}, summary: $summary, description: $desc}}' \
   > /tmp/generate-issue-$$-payload.json
 # merge approved optional fields (priority / labels / components / epic / assignee / required customs) into .fields with jq before POST
-curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -sS -X POST -H @- -H "Content-Type: application/json" \
   --data-binary @/tmp/generate-issue-$$-payload.json \
   "https://$ACCOUNT_JIRA_HOST/rest/api/2/issue"
 ```
@@ -231,20 +231,20 @@ Each step is failure-isolated: on error, warn + continue  -  the issue already e
 1. **Sprint** (when chosen in step 8/9):
 ```bash
 jq -n --arg key "$NEW_KEY" '{issues: [$key]}' > /tmp/generate-issue-$$-sprint.json
-curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -sS -X POST -H @- -H "Content-Type: application/json" \
   --data-binary @/tmp/generate-issue-$$-sprint.json \
   "https://$ACCOUNT_JIRA_HOST/rest/agile/1.0/sprint/${SPRINT_ID}/issue"
 ```
    Post-create move instead of a Sprint custom field in the create payload: field-id-agnostic, works on every Jira Software instance.
 2. **Figma remote link** (when `FIGMA_URL` set):
 ```bash
-curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -sS -X POST -H @- -H "Content-Type: application/json" \
   -d '{"object":{"url":"'"$FIGMA_URL"'","title":"Figma design"}}' \
   "https://$ACCOUNT_JIRA_HOST/rest/api/2/issue/${NEW_KEY}/remotelink"
 ```
 3. **Swagger remote link** (when `SWAGGER_URL` set):
 ```bash
-curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -sS -X POST -H @- -H "Content-Type: application/json" \
   -d '{"object":{"url":"'"$SWAGGER_URL"'","title":"API contract"}}' \
   "https://$ACCOUNT_JIRA_HOST/rest/api/2/issue/${NEW_KEY}/remotelink"
 ```

package/pipeline/multi-agent-refs/outside-the-pipeline.md

@@ -24,10 +24,10 @@ mapping would have given you.
 
 ## Keeping the value out of everything
 
-`curl` config on stdin, so the token never reaches argv (where `ps` can read it):
+The header goes to `curl` on stdin, so the token never reaches argv (where `ps` can read it):
 
 ```bash
-curl --config <(printf 'header = "Authorization: Bearer %s"\n' "$TOKEN") \
+printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -H @- \
      "https://$(jq -r '.global.hosts.jira' "$PREFS")/rest/api/3/issue/PROJ-1"
 ```
 

package/pipeline/multi-agent-refs/phases/phase-0-init.md

@@ -234,7 +234,7 @@ Classify and fetch external data:
    [ -z "$JIRA_KEY" ] && JIRA_KEY="${USER}_Jira_Access_Token"
    # unattended: skipped - a run reads no credential itself (features/unattended-security.md)
    JIRA_TOKEN=$(~/.claude/lib/credential-store.sh get "$JIRA_KEY" 2>/dev/null)
-   curl -s -H "Authorization: Bearer $JIRA_TOKEN" \
+   printf 'Authorization: Bearer %s\n' "$JIRA_TOKEN" | curl -s -H @- \
      "https://{JIRA_HOST}/rest/api/2/issue/{jiraId}?fields=summary,issuetype,status"
    ```
 2. Extract: summary, issueType (Bug/Story/Task/Feature)

package/pipeline/multi-agent-refs/phases/phase-2-dev.md

@@ -177,8 +177,9 @@ For each task (respecting dependency order):
 6. **Intermediate commit** (after each completed task in the plan):
    ```bash
    git -C "{worktreePath}" add -A
-   git -C "{worktreePath}" commit -m "wip({scope}): {task summary} [{jiraId}]"
+   git -C "{worktreePath}" commit -F "/tmp/wip-message-$TASK_ID.txt"
    ```
+   Write `wip({scope}): {task summary} [{jiraId}]` to `/tmp/wip-message-$TASK_ID.txt` with the file tool first. The summary comes from the issue, and inside a double-quoted `-m` the shell would run any `$(...)` in it.
    WIP commits are squashed in Phase 4 before PR. This prevents work loss if a later task fails or the session crashes.
 7. Update task status: `completed` (apply the same verify rule  -  re-read the Status field and retry once on mismatch)
 8. Log: "Phase 2: {task}  -  Test + Build passed"

package/pipeline/multi-agent-refs/phases/phase-4-commit.md

@@ -127,7 +127,7 @@ Branch **deterministically**, no implicit fallback. Read `agent-state.json` and
 
    The script salvages before removing, keeps the branch, and does **not** check it out  -  the user's HEAD and uncommitted work stay put. On success it stamps `worktreeRemovedAt`, `artifactsPath` and `worktreePath: null` into the **salvaged** `agent-state.json` itself. Do NOT write those via `write-state.mjs "$STATE_FILE"`: in single-repo mode that path went away with the worktree, so the write fails, the fields land nowhere, and Phase 5 reads a dead path and silently skips the triage ingest. After a removal re-point `STATE_FILE` at `$(jq -r .artifactsPath <<< "$FIN")/agent-state.json`. Exit 3 is a safe skip (uncommitted changes, unpushed or detached HEAD, `--local`, cwd inside the tree, preference off): report and continue. Never `--force`. Contract: [`features/worktree-finalize.md`]($HOME/.claude/multi-agent-refs/features/worktree-finalize.md).
 
-10. **Issue body update** (GitHub Issue only): if the issue body has a `### Pull Requests` section and/or a `### Progress` table, fill in the PR URL(s) (one row per submodule  -  e.g. `- **common:** {url}`, `- **uicomponents:** {url}`) and flip the Implementation / Testing / Code Connect flags from Pending to Done using whatever marker the template uses (match in place, do NOT introduce new markers). Apply with `gh issue edit {issueNo} --body "{updated body}"` and preserve every other section unchanged.
+10. **Issue body update** (GitHub Issue only): if the issue body has a `### Pull Requests` section and/or a `### Progress` table, fill in the PR URL(s) (one row per submodule  -  e.g. `- **common:** {url}`, `- **uicomponents:** {url}`) and flip the Implementation / Testing / Code Connect flags from Pending to Done using whatever marker the template uses (match in place, do NOT introduce new markers). Apply it with `gh issue edit {issueNo} --body-file <file>`, preserving every other section unchanged.
 11. **NEVER close or resolve the issue**  -  neither GitHub Issue nor Jira. Issues require team review (4 approvals) before closing. Only post a comment with commit/PR URLs.
 12. Log: "Phase 4: Commit {sha}  -  PR #{number}, worktree {removed|kept: <reason>}"
 
@@ -174,13 +174,13 @@ Inputs are read from state and the worktree before writing, not recalled from th
 
 **Default Reviewers**: use `prefs.projects[{project}].defaultReviewers` when set; otherwise ask once ("Default reviewers for this project? comma-separated, or skip") and persist the answer there. Per-remote resolution rules are in "Default reviewers (required on every PR)" below  -  this is the prefs half only.
 
-**Standard PR (bug fix, feature, refactor)**  -  invocation shape; body comes from a file so newlines survive:
+**Standard PR (bug fix, feature, refactor)**  -  invocation shape. Title (`{type}({scope}): {summary} [{jiraId}]`) and body go to files first, so issue text never sits in a quoted argument:
 
 ```bash
-REVIEWERS=$(jq -r '.projects["'$PROJECT'"].defaultReviewers // [] | map("--reviewer " + .) | join(" ")' "$PREFS_FILE")
+REVIEWERS=$(jq -r --arg p "$PROJECT" '.projects[$p].defaultReviewers // [] | map("--reviewer " + .) | join(" ")' "$PREFS_FILE")
 # unattended: skipped - pr-request.mjs replaces the PR (features/unattended-security.md)
 gh pr create --base {baseBranch} --head {branch} $REVIEWERS \
-  --title "{type}({scope}): {summary} [{jiraId}]" \
+  --title "$(cat /tmp/pr-title-$TASK_ID.txt)" \
   --body-file /tmp/pr-body-$TASK_ID.md
 ```
 

package/pipeline/multi-agent-refs/setup/repo-discovery.md

@@ -39,7 +39,7 @@ BB_HOST="$(jq -r '.global.bitbucketHost // empty' "$PREFS_FILE")"
 BB_USER="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_user' "$PREFS_FILE")" 2>/dev/null)"
 BB_TOK="$(~/.claude/lib/credential-store.sh get "$(jq -r '.global.keychainMapping.bitbucket_token' "$PREFS_FILE")" 2>/dev/null)"
 CUTOFF_MS=$(( ( $(date +%s) - 7776000 ) * 1000 ))   # 90 days
-curl -sfS -u "$BB_USER:$BB_TOK" \
+curl -sfS --config <(printf 'user = "%s:%s"\n' "$BB_USER" "$BB_TOK") \
   "https://${BB_HOST}/rest/api/1.0/repos?permission=REPO_WRITE&limit=200" \
   | jq -r --argjson cutoff "$CUTOFF_MS" '
       .values[] | select((.updatedDate // 0) >= $cutoff) |
@@ -59,7 +59,7 @@ CUTOFF_ISO="$(date -u -v-90d +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d '90 d
 gh api --paginate 'user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100' \
   -q ".[] | select(.pushed_at > \"$CUTOFF_ISO\") | {full: .full_name, clone: .clone_url}"
 # Fallback without gh:
-curl -sfS -H "Authorization: Bearer $GH_TOK" \
+printf 'Authorization: Bearer %s\n' "$GH_TOK" | curl -sfS -H @- \
   'https://api.github.com/user/repos?affiliation=owner,collaborator&sort=pushed&per_page=100'
 ```
 

package/pipeline/schemas/autopilot-config.schema.json

@@ -50,6 +50,11 @@
             "default": "agent-queue",
             "description": "Only issues carrying this label are picked up. `gh issue list --label` does the filtering server-side."
           },
+          "githubAssignee": {
+            "type": "string",
+            "default": "@me",
+            "description": "Only issues assigned to this login are picked up (`gh issue list --assignee`), matching the Jira search's assignee = currentUser(). An issue form can apply the queue label for anyone who opens an issue, and an unattended run acts on the issue's text. \"*\" picks up every labelled issue."
+          },
           "jiraJql": {
             "type": "string",
             "description": "Full JQL, so an instance that cannot use labels is a config change rather than a redesign. The label form is sugar for: assignee = currentUser() AND labels = \"<label>\" AND resolution = EMPTY AND status not in (Done, Closed, Cancelled) ORDER BY priority DESC, created ASC. Jira labels are a single global namespace anyone can write to, so on a shared instance prefer a qualified name, and note that the Labels field must be on the edit screen for the issue types in play. An issue that more than one repo's search returns is queued once, for the first repo in config order, so repos sharing a Jira instance should each carry a jiraJql that matches only their own issues."

package/pipeline/schemas/prefs.schema.json

@@ -1820,7 +1820,7 @@
               },
               "upstreamLocalClone": {
                 "type": "string",
-                "description": "Working copy of the upstream repository, checked before the plugin cache. The cache under ~/.claude/plugins/cache is only as fresh as the last `claude marketplace update`, so it is a mirror and never the authority. A private upstream may also be unreachable over the API from the active account, in which case this clone is the only source."
+                "description": "Working copy of the upstream repository, checked before the plugin cache. The cache under ~/.claude/plugins/cache is only as fresh as the last `claude plugin marketplace update`, so it is a mirror and never the authority. A private upstream may also be unreachable over the API from the active account, in which case this clone is the only source."
               },
               "upstreamRepoUrl": {
                 "type": "string",

package/pipeline/scripts/_autopilot-outcomes.mjs

@@ -41,6 +41,7 @@ export const OUTCOME = Object.freeze({
   BLOCKED_NO_PATH: "blocked-no-path",
   BLOCKED_GUARD_MISSING: "blocked-guard-missing",
   BLOCKED_SANDBOX_UNAVAILABLE: "blocked-sandbox-unavailable",
+  BLOCKED_VERSION_FLOOR: "blocked-version-floor",
 });
 
 /**
@@ -107,6 +108,7 @@ export const BLOCKED = new Set([
   OUTCOME.BLOCKED_NO_PATH,
   OUTCOME.BLOCKED_GUARD_MISSING,
   OUTCOME.BLOCKED_SANDBOX_UNAVAILABLE,
+  OUTCOME.BLOCKED_VERSION_FLOOR,
 ]);
 
 /** Prefix families. `stopped-<status>` is a run that ended mid-way. */

package/pipeline/scripts/audit-log-rotate.sh

@@ -89,6 +89,9 @@ if [ -s "$AUDIT_FILE" ]; then
   # of the content it archived. gzip -f removes the plain file on success, so
   # only touch whichever of the two actually exists.
   [ -f "$ROTATED.gz" ] && touch "$ROTATED.gz"
+  # An archive holds the same events as the live file, so it gets the same mode.
+  [ -f "$ROTATED.gz" ] && chmod 600 "$ROTATED.gz" 2>/dev/null
+  [ -f "$ROTATED" ] && chmod 600 "$ROTATED" 2>/dev/null
   [ -f "$ROTATED" ] && touch "$ROTATED"
 fi
 

package/pipeline/scripts/audit-log.sh

@@ -39,9 +39,10 @@ esac
 AUDIT_FILE="${AUDIT_FILE:-${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}/audit.jsonl}"
 mkdir -p "$(dirname "$AUDIT_FILE")" 2>/dev/null || exit 0
 
-# Escape a string for embedding inside a JSON double-quoted value.
+# Escape a string for embedding inside a JSON double-quoted value. Newlines,
+# carriage returns and tabs are escaped too: a raw one splits the JSONL line.
 json_escape() {
-  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
+  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g; s/\r/\\r/g' | awk 'NR > 1 { printf "\\n" } { printf "%s", $0 }'
 }
 
 # SHA-256 hash the repo URL (never log plaintext per section18.2.2)
@@ -85,6 +86,13 @@ LINE="{\"ts\":\"${TS}\",\"event\":\"$(json_escape "$EVENT")\",\"service\":\"$(js
 [ -n "$EXTRAS" ] && LINE="${LINE},${EXTRAS}"
 LINE="${LINE}}"
 
+# Caller-supplied values can carry a credential copied out of an error.
+# redact.mjs replaces it with a marker; without node the line is written as is.
+REDACT="$(dirname "${BASH_SOURCE[0]:-$0}")/../lib/redact.mjs"
+[ -f "$REDACT" ] && LINE=$(printf '%s' "$LINE" | node "$REDACT" 2>/dev/null || printf '%s' "$LINE")
+
+[ -f "$AUDIT_FILE" ] || (umask 077 && : > "$AUDIT_FILE") 2>/dev/null || true
+chmod 600 "$AUDIT_FILE" 2>/dev/null || true
 echo "$LINE" >> "$AUDIT_FILE" 2>/dev/null || true
 
 # Opportunistic rotation. audit-log-rotate.sh documents a launchd/cron install,

package/pipeline/scripts/autopilot-intake.mjs

@@ -245,22 +245,24 @@ function sh(cmd, args, opts = {}) {
   }
 }
 
-function fetchGitHub(repo) {
+/**
+ * The `gh issue list` arguments for one repo. Only issues assigned to the
+ * operator are listed by default, as the Jira search does with
+ * `assignee = currentUser()`: an issue form can apply the queue label for
+ * anyone who opens an issue, and an unattended run acts on the issue's text.
+ * `githubAssignee: "*"` lists every labelled issue.
+ */
+export function githubListArgs(repo) {
   const label = repo.githubLabel || "agent-queue";
-  const out = sh("gh", [
-    "issue",
-    "list",
-    "--repo",
-    repo.nameWithOwner,
-    "--label",
-    label,
-    "--state",
-    "open",
-    "--json",
-    "number,title,labels,url,createdAt",
-    "--limit",
-    "100",
-  ]);
+  const assignee = repo.githubAssignee || "@me";
+  const args = ["issue", "list", "--repo", repo.nameWithOwner, "--label", label];
+  if (assignee !== "*") args.push("--assignee", assignee);
+  args.push("--state", "open", "--json", "number,title,labels,url,createdAt", "--limit", "100");
+  return args;
+}
+
+function fetchGitHub(repo) {
+  const out = sh("gh", githubListArgs(repo));
   let rows;
   try {
     rows = JSON.parse(out || "[]");