@mmerterden/multi-agent-pipeline 20.3.1 → 20.5.0

package/pipeline/scripts/autopilot-publish.mjs

@@ -112,7 +112,7 @@ import { OUTCOME } from "./_autopilot-outcomes.mjs";
 import { commandFor, getAdapter, loadAdapters, resolveStack } from "./_stack-adapter.mjs";
 import { checkCommit, park, updateState } from "./gate-ledger.mjs";
 import { LOCKFILES } from "./package-manager.mjs";
-import { PROTECTED_BRANCHES, validatePrRequest } from "./pr-request.mjs";
+import { PROTECTED_BRANCHES, hasAutoClose, validatePrRequest } from "./pr-request.mjs";
 import { summarize } from "./test-summary.mjs";
 
 const HERE = import.meta.dirname;
@@ -576,6 +576,20 @@ function checkRemoteBranch(stage, url, branch, headSha, prior) {
 }
 
 /** Gate ledger: the commit hook's requirement, re-checked for every commit in the range. */
+// A closing keyword in a commit message closes the issue when the PR merges,
+// whatever the PR text says, and issues are closed by people, not by a run.
+function checkCommitMessages(stage, commits) {
+  for (const sha of commits) {
+    const message = stage.out(["log", "-1", "--format=%B", sha]) || "";
+    if (hasAutoClose(message)) {
+      throw new Refusal(
+        "auto-close",
+        `commit ${sha.slice(0, 12)} carries an auto-close keyword; use Ref: #N`,
+      );
+    }
+  }
+}
+
 function checkLedger(state, commits, wt, env) {
   for (const c of commits) {
     const parent = gitOut(wt, ["rev-parse", "--verify", `${c}^1`], env);
@@ -1319,6 +1333,7 @@ export async function publish({ sessionId, statePath, item, config, env = proces
     const mergeBase = stage.out(["merge-base", baseSha, headSha]);
     if (!mergeBase) throw new Refusal("branch", `${req.branch} shares no history with ${req.base}`);
 
+    checkCommitMessages(stage, commits);
     checkLedger(state, commits, wt, localEnv);
     checkTestLog(state, wt, statePath);
     checkSecrets(wt, `${mergeBase}..${headSha}`, env);

package/pipeline/scripts/autopilot-runner.mjs

@@ -2086,6 +2086,26 @@ async function main() {
     return 0;
   }
 
+  // ---- 3d. VERSION --------------------------------------------------------
+  // Phase 0 of the child halts below the published floor, and the update it
+  // would need is refused unattended. Checked here so a floor costs no session.
+  const floorGate = join(SCRIPTS, "require-supported-version.sh");
+  if (existsSync(floorGate)) {
+    const floor = spawnSync("bash", [floorGate], { encoding: "utf-8", timeout: 30_000 });
+    if (floor.status === 3) {
+      const [, local, , required] = (floor.stdout || "").trim().split("|");
+      const reason = `installed v${local || "?"} is below the required v${required || "?"}; run the update`;
+      log(`not launching: ${reason}`);
+      if (!DRY) {
+        record({ source: next.source, id: next.id, outcome: OUTCOME.BLOCKED_VERSION_FLOOR });
+        writeState("queue.json", { ...queue, blockedReason: reason });
+        refreshStatus();
+      }
+      tick({ action: "version-floor" });
+      return 0;
+    }
+  }
+
   // ---- 4. TAKE -----------------------------------------------------------
   const sessionId = randomUUID();
   const taskId = `ap-${Date.now()}`;

package/pipeline/scripts/capture-resume.sh

@@ -33,16 +33,9 @@ LOGS="${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}"
 PIPELINE_MEM="$HOME/.claude/memory/multi-agent/_pipeline"
 REVIEW_DAYS=7
 
-# Three buckets, not one line. Measured on the development machine: 22 runs read
-# `in_progress` and every one was over a day old, but they are not one failure.
-# 13 stopped at Phase 0, which is almost entirely questions - those runs never
-# started. 3 had their PR already open and were waiting at Phase 4/7, where the
-# pipeline pauses ON PURPOSE for channel selection. 4 died mid-development.
-#
-# Reporting the newest one of those as "stopped at Phase N" told the truth about
-# one run and hid twenty-one, and it read the same whether the pipeline was
-# waiting for the user or had crashed. A finished job and a dead one should not
-# share a sentence.
+# Unfinished runs are sorted into three buckets because each needs a different
+# action: waiting on the user (an open PR, or a pause for the channel answer),
+# left at a Phase 0 question (nothing built), and stopped mid-development.
 AWAITING_N=0; AWAITING_TASK=""; AWAITING_PHASE=""
 DIED_N=0;     DIED_TASK="";     DIED_PHASE=""
 UNSTARTED_N=0; UNSTARTED_TASK=""
@@ -50,34 +43,35 @@ STALE_TASK=""
 STALE_PHASE=""
 
 if [ -d "$LOGS" ] && command -v jq >/dev/null 2>&1; then
-  # Newest first, so the first hit in each bucket is the one worth naming.
-  # Both layouts are walked: state is written flat as <task-id>/ by
+  # Oldest first, so the first hit in each bucket is the one the banner calls
+  # the oldest. Both layouts are walked: state is written flat as <task-id>/ by
   # phase-tracker.sh and nested as <project>/<task-id>/ by Phase 0, and a
   # reader that knows only one of them under-reports by the size of the other.
+  # artifacts/ holds the copy gc-abandoned takes before it marks a run failed,
+  # so it keeps the status the run had while it was alive.
   while IFS= read -r f; do
     [ -f "$f" ] || continue
     STATUS=$(jq -r '.status // ""' "$f" 2>/dev/null)
-    # Only runs that CLAIM to be running are bucketed. A file with no status is
-    # unknown - eight of them here, six with no currentPhase either - and
-    # reporting unknown as "stopped mid-development" is the same false claim
-    # this change exists to remove, just pointed the other way. If that hides a
-    # real run, the fix is for its writer to record a status.
+    # Only runs that claim to be running are bucketed. A file with no status is
+    # unknown, and reporting unknown as "stopped mid-development" would be a
+    # false claim. The fix for a hidden run is for its writer to record a status.
     # `complete` is the schema spelling and `completed` is in the wild too, so
     # both are excluded; a reader that knows one calls finished runs stale.
     case "$STATUS" in in_progress | paused | awaiting_input) ;; *) continue ;; esac
-    PHASE=$(jq -r '.currentPhase // "?"' "$f" 2>/dev/null)
+    # `phase` is the field name a state written before currentPhase carries.
+    PHASE=$(jq -r '.currentPhase // .phase // "?" | tostring' "$f" 2>/dev/null)
     TASK=$(jq -r '.taskId // .jiraId // ""' "$f" 2>/dev/null)
     [ -n "$TASK" ] || continue
-    # `.pr` is an object in the schema and a bare URL string in three state files
-    # on disk. `jq '.pr.url'` on a string errors, and with stderr suppressed that
-    # reads as "no PR" - so a run whose PR is already open would be classed as dead
-    # and reaped. Read the shape, do not assume it.
+    # `.pr` is an object in the schema and a bare URL string in older state
+    # files. `jq '.pr.url'` on a string errors, and with stderr suppressed that
+    # reads as "no PR", so the shape is read rather than assumed.
     PR=$(jq -r 'if (.pr|type)=="string" then .pr elif (.pr|type)=="object" then (.pr.url // .pr.number // "") else "" end | tostring' "$f" 2>/dev/null)
 
     # Waiting for you, not broken: an open PR means the work landed, and
-    # Phase 5 pauses for channel selection by design (modes.md).
+    # Phase 5 pauses for channel selection by design (modes.md). 6 and 7 are
+    # the same pause in a state written before the six-phase numbering.
     if [ "$STATUS" = "awaiting_input" ] || [ -n "$PR" ] ||
-      [ "$PHASE" = "6" ] || [ "$PHASE" = "7" ]; then
+      [ "$PHASE" = "5" ] || [ "$PHASE" = "6" ] || [ "$PHASE" = "7" ]; then
       AWAITING_N=$((AWAITING_N + 1))
       [ -z "$AWAITING_TASK" ] && { AWAITING_TASK="$TASK"; AWAITING_PHASE="$PHASE"; }
     elif [ "$PHASE" = "0" ]; then
@@ -90,7 +84,7 @@ if [ -d "$LOGS" ] && command -v jq >/dev/null 2>&1; then
       [ -z "$DIED_TASK" ] && { DIED_TASK="$TASK"; DIED_PHASE="$PHASE"; }
     fi
   done <<EOF
-$(find "$LOGS" -name agent-state.json -type f -maxdepth 4 -print0 2>/dev/null | xargs -0 ls -t 2>/dev/null)
+$(find "$LOGS" -maxdepth 4 -name agent-state.json -type f -not -path '*/artifacts/*' -print0 2>/dev/null | xargs -0 ls -tr 2>/dev/null)
 EOF
   # Kept for the JSON consumers that read staleTask/stalePhase.
   if [ -n "$AWAITING_TASK" ]; then
@@ -130,24 +124,44 @@ if [ "$JSON" -eq 1 ]; then
   exit 0
 fi
 
-# One line per bucket, each naming its own next action, because they are
-# different actions. Counts are printed even when they are 1: "1 run" and
-# "13 runs" call for different reactions and the old line could not tell them
-# apart.
+# One line per bucket, each naming its own next action. Counts are printed
+# even when they are 1, because "1 run" and "13 runs" call for different
+# reactions.
+LANG_CODE=$(ma_output_lang 2>/dev/null || echo en)
 if [ "$AWAITING_N" -gt 0 ]; then
-  printf 'multi-agent: %s run(s) waiting on you, oldest %s at Phase %s - `%s` to finish.\n' \
-    "$AWAITING_N" "$AWAITING_TASK" "$AWAITING_PHASE" "$(ma_command resume)"
+  if [ "$LANG_CODE" = "tr" ]; then
+    printf 'multi-agent: %s çalışma seni bekliyor, en eskisi %s (Phase %s). Bitirmek için `%s`.\n' \
+      "$AWAITING_N" "$AWAITING_TASK" "$AWAITING_PHASE" "$(ma_command resume)"
+  else
+    printf 'multi-agent: %s run(s) waiting on you, oldest %s at Phase %s - `%s` to finish.\n' \
+      "$AWAITING_N" "$AWAITING_TASK" "$AWAITING_PHASE" "$(ma_command resume)"
+  fi
 fi
 if [ "$DIED_N" -gt 0 ]; then
-  printf 'multi-agent: %s run(s) stopped mid-development, oldest %s at Phase %s - `%s` or `%s`.\n' \
-    "$DIED_N" "$DIED_TASK" "$DIED_PHASE" "$(ma_command resume)" "$(ma_command kill)"
+  if [ "$LANG_CODE" = "tr" ]; then
+    printf 'multi-agent: %s çalışma geliştirme sırasında durdu, en eskisi %s (Phase %s). Devam için `%s`, silmek için `%s`.\n' \
+      "$DIED_N" "$DIED_TASK" "$DIED_PHASE" "$(ma_command resume)" "$(ma_command kill)"
+  else
+    printf 'multi-agent: %s run(s) stopped mid-development, oldest %s at Phase %s - `%s` or `%s`.\n' \
+      "$DIED_N" "$DIED_TASK" "$DIED_PHASE" "$(ma_command resume)" "$(ma_command kill)"
+  fi
 fi
 if [ "$UNSTARTED_N" -gt 0 ]; then
-  printf 'multi-agent: %s run(s) left at a Phase 0 question, nothing built - `%s --abandoned` to clear.\n' \
-    "$UNSTARTED_N" "$(ma_command garbage-collect)"
+  if [ "$LANG_CODE" = "tr" ]; then
+    printf 'multi-agent: %s çalışma Phase 0 sorusunda kaldı, hiçbir şey üretilmedi. Temizlemek için `%s --abandoned`.\n' \
+      "$UNSTARTED_N" "$(ma_command garbage-collect)"
+  else
+    printf 'multi-agent: %s run(s) left at a Phase 0 question, nothing built - `%s --abandoned` to clear.\n' \
+      "$UNSTARTED_N" "$(ma_command garbage-collect)"
+  fi
 fi
 if [ "$REVIEW_DUE" -eq 1 ]; then
-  printf 'multi-agent: %s open pipeline observation(s), last review %s+ days ago - `%s backlog` when convenient.\n' \
-    "$OPEN_OBS" "$REVIEW_DAYS" "$(ma_command refactor)"
+  if [ "$LANG_CODE" = "tr" ]; then
+    printf 'multi-agent: %s açık pipeline gözlemi var, son inceleme %s+ gün önce. Uygun olduğunda `%s backlog`.\n' \
+      "$OPEN_OBS" "$REVIEW_DAYS" "$(ma_command refactor)"
+  else
+    printf 'multi-agent: %s open pipeline observation(s), last review %s+ days ago - `%s backlog` when convenient.\n' \
+      "$OPEN_OBS" "$REVIEW_DAYS" "$(ma_command refactor)"
+  fi
 fi
 exit 0

package/pipeline/scripts/check-derived-drift.mjs

@@ -5,7 +5,7 @@
 // This exists because the resolution order is the whole correctness question,
 // and prose in a skill file cannot be tested. The step used to read the
 // installed plugin cache and call the answer authoritative. A cache is only as
-// fresh as the last `claude marketplace update`, so it reported "up to date"
+// fresh as the last `claude plugin marketplace update`, so it reported "up to date"
 // for a derivation that was four releases behind, and the version it had been
 // recorded from was the wrong manifest besides.
 //

package/pipeline/scripts/doctor.mjs

@@ -476,6 +476,27 @@ function checkHookCoverage() {
     );
     return;
   }
+  const seen = new Set();
+  const twice = new Set();
+  for (const [event, groups] of Object.entries(have?.hooks || {})) {
+    for (const group of Array.isArray(groups) ? groups : []) {
+      for (const h of group?.hooks || []) {
+        if (typeof h?.command !== "string") continue;
+        const key = `${event} ${group.matcher || ""} ${h.command}`;
+        if (seen.has(key)) twice.add(`${h.command.split("/").pop()} on ${group.matcher || event}`);
+        seen.add(key);
+      }
+    }
+  }
+  if (twice.size) {
+    report(
+      "hook-coverage",
+      "WARN",
+      `registered twice, so it runs twice per call: ${[...twice].join(", ")}`,
+      `run ${hostCommand("update", HERE)}`,
+    );
+    return;
+  }
   ok("hook-coverage");
 }
 

package/pipeline/scripts/log-metric.sh

@@ -81,6 +81,11 @@ PHASE_SCHEMA="$(node -e 'const c=require("'"$(cd "$(dirname "$0")" && pwd)"'/../
 TS="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
 LINE="{\"ts\":\"${TS}\",\"task_id\":\"${TASK_ID}\",\"phase\":\"${PHASE}\",\"event\":\"${EVENT}\",\"details\":${DETAILS},\"phaseSchema\":${PHASE_SCHEMA}}"
 
+# Caller-supplied values can carry a credential copied out of an error.
+# redact.mjs replaces it with a marker; without node the line is written as is.
+REDACT="$(cd "$(dirname "$0")" && pwd)/../lib/redact.mjs"
+[ -f "$REDACT" ] && LINE=$(printf '%s' "$LINE" | node "$REDACT" 2>/dev/null || printf '%s' "$LINE")
+
 # Atomic append (one line, well under PIPE_BUF).
 echo "$LINE" >> "$METRICS_FILE" 2>/dev/null || {
   echo "warn: log-metric: cannot write to $METRICS_FILE  -  telemetry skipped" >&2

package/pipeline/scripts/plugin-refresh.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+#
+# plugin-refresh.sh  -  bring the stack plugins to the latest published version.
+#
+# Two steps, because they are two different things: `claude plugin marketplace
+# update` refreshes the catalog, and each installed plugin then needs its own
+# `claude plugin update` in the scope it was installed in. A project or local
+# install is updated from inside its own project, because that is how the CLI
+# tells two projects' installs apart. The catalog refresh alone leaves every
+# installed plugin where it was.
+#
+# Usage: plugin-refresh.sh <owner> [--add-only]
+#   <owner>      GitHub owner of the multi-agent-plugins repository
+#   --add-only   make sure the marketplace is configured, update nothing
+#
+# The CLI's own error output is passed through, never discarded.
+# Exit codes: 0 = done (or no claude CLI on this machine), 1 = a step failed
+
+set -uo pipefail
+
+OWNER="${1:-}"
+MODE="${2:-}"
+MP="multi-agent-plugins"
+CLAUDE="${CLAUDE_BIN:-claude}"
+
+if [ -z "$OWNER" ]; then
+  echo "usage: plugin-refresh.sh <owner> [--add-only]" >&2
+  exit 1
+fi
+
+if ! command -v "$CLAUDE" >/dev/null 2>&1; then
+  echo "  -> claude CLI not found; stack plugins not refreshed"
+  exit 0
+fi
+
+FAILED=0
+
+if ! "$CLAUDE" plugin marketplace list 2>/dev/null | grep -q "$MP"; then
+  if "$CLAUDE" plugin marketplace add "$OWNER/$MP"; then
+    echo "  -> marketplace $MP added"
+  else
+    echo "  -> could not add marketplace $OWNER/$MP" >&2
+    exit 1
+  fi
+fi
+
+[ "$MODE" = "--add-only" ] && exit 0
+
+if "$CLAUDE" plugin marketplace update "$MP"; then
+  echo "  -> marketplace $MP refreshed"
+else
+  echo "  -> marketplace $MP refresh failed" >&2
+  FAILED=1
+fi
+
+INSTALLED=$("$CLAUDE" plugin list --json 2>/dev/null | node -e '
+let s = "";
+process.stdin.on("data", (d) => (s += d)).on("end", () => {
+  let rows = [];
+  try { rows = JSON.parse(s); } catch { process.exit(0); }
+  const seen = new Set();
+  for (const r of Array.isArray(rows) ? rows : []) {
+    if (typeof r.id !== "string" || !r.id.endsWith("@" + process.argv[1])) continue;
+    const scope = r.scope || "user";
+    const dir = scope === "project" || scope === "local" ? r.projectPath || "" : "";
+    if ((scope === "project" || scope === "local") && !dir) continue;
+    const key = [r.id, scope, dir].join("\t");
+    if (seen.has(key)) continue;
+    seen.add(key);
+    console.log(key);
+  }
+});' "$MP")
+
+while IFS=$'\t' read -r ID SCOPE DIR; do
+  [ -n "$ID" ] || continue
+  WHERE="$SCOPE${DIR:+ $DIR}"
+  if [ -n "$DIR" ] && [ ! -d "$DIR" ]; then
+    echo "  -> $ID ($WHERE) skipped, project directory is gone"
+    continue
+  fi
+  if (cd "${DIR:-$PWD}" && "$CLAUDE" plugin update "$ID" --scope "$SCOPE"); then
+    echo "  -> $ID ($WHERE) updated"
+  else
+    echo "  -> $ID ($WHERE) update failed" >&2
+    FAILED=1
+  fi
+done <<EOF
+$INSTALLED
+EOF
+
+[ "$FAILED" -eq 0 ] || exit 1
+exit 0

package/pipeline/scripts/pr-request.mjs

@@ -46,7 +46,14 @@ export const FIELDS = ["branch", "base", "title", "body", "draft", "repo"];
 export const PROTECTED_BRANCHES = ["main", "master", "develop"];
 const REF = /^[A-Za-z0-9._/-]+$/;
 const REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
-const AUTO_CLOSE = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+(?:[\w.-]+\/[\w.-]+)?#\d+/i;
+// GitHub closes an issue from `#N`, `owner/repo#N` and the issue's full URL.
+const AUTO_CLOSE =
+  /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+(?:(?:[\w.-]+\/[\w.-]+)?#\d+|https?:\/\/[^\s/]+\/[\w.-]+\/[\w.-]+\/issues\/\d+)/i;
+
+/** True when the text would close an issue once the PR or commit merges. */
+export function hasAutoClose(text) {
+  return typeof text === "string" && AUTO_CLOSE.test(text);
+}
 
 /**
  * The request object `write` produces. draft is always true.
@@ -92,8 +99,7 @@ export function validatePrRequest(req) {
   if (typeof req.branch === "string" && req.branch === req.base)
     errors.push("branch and base are the same");
   for (const k of ["title", "body"]) {
-    if (typeof req[k] === "string" && AUTO_CLOSE.test(req[k]))
-      errors.push(`${k} carries an auto-close keyword; use Ref: #N`);
+    if (hasAutoClose(req[k])) errors.push(`${k} carries an auto-close keyword; use Ref: #N`);
   }
   const secrets = [];
   for (const k of ["title", "body"]) {

package/pipeline/scripts/update-check.sh

@@ -26,7 +26,8 @@
 # Usage:
 #   bash pipeline/scripts/update-check.sh                 # auto-detect local version
 #   bash pipeline/scripts/update-check.sh --local 10.8.0  # explicit local version
-#   bash pipeline/scripts/update-check.sh --ttl-hours 24  # cache window (default 24)
+#   bash pipeline/scripts/update-check.sh --ttl-hours 24  # cache window (default: prefs
+#                                                         # updateCheck.ttlHours, else 24)
 #   bash pipeline/scripts/update-check.sh --force         # ignore cache
 #   bash pipeline/scripts/update-check.sh --print-required  # emit the floor only
 #
@@ -41,7 +42,8 @@ set -euo pipefail
 PKG="@mmerterden/multi-agent-pipeline"
 REGISTRY_URL="https://registry.npmjs.org/${PKG/\//%2F}"
 CACHE_FILE="${UPDATE_CHECK_CACHE:-$HOME/.claude/logs/multi-agent/.update-check}"
-TTL_HOURS=24
+TTL_HOURS=""
+FAIL_TTL_SECONDS=3600
 LOCAL_VERSION=""
 FORCE=0
 PRINT_REQUIRED=0
@@ -49,37 +51,65 @@ PRINT_REQUIRED=0
 while [ $# -gt 0 ]; do
   case "$1" in
     --local) LOCAL_VERSION="${2:-}"; shift; [ $# -gt 0 ] && shift ;;
-    --ttl-hours) TTL_HOURS="${2:-24}"; shift; [ $# -gt 0 ] && shift ;;
+    --ttl-hours) TTL_HOURS="${2:-}"; shift; [ $# -gt 0 ] && shift ;;
     --force) FORCE=1; shift ;;
     --print-required) PRINT_REQUIRED=1; shift ;;
     *) shift ;;
   esac
 done
 
-# Local version: explicit arg, else read from the pipeline repo clone.
+# Local version: explicit arg, else the marker the installer stamps. The
+# marker is what is installed and what /multi-agent:update rewrites, so it is
+# read before any repo clone; a clone is only a fallback for a machine that
+# runs the pipeline from source without installing it.
 if [ -z "$LOCAL_VERSION" ]; then
-  for candidate in "$HOME/multi-agent-pipeline" "$HOME/dev/multi-agent-pipeline" "$HOME/projects/multi-agent-pipeline"; do
-    if [ -f "$candidate/package.json" ]; then
-      LOCAL_VERSION=$(node -p "require('$candidate/package.json').version" 2>/dev/null || true)
+  for marker in "$HOME/.claude/.pipeline-version" "$HOME/.copilot/.pipeline-version" \
+                "$HOME/.codex/.pipeline-version"; do
+    if [ -f "$marker" ]; then
+      LOCAL_VERSION=$(head -1 "$marker" 2>/dev/null | tr -d '[:space:]')
       [ -n "$LOCAL_VERSION" ] && break
     fi
   done
 fi
-# npx-only installs have no repo clone; the installer stamps the version here.
 if [ -z "$LOCAL_VERSION" ]; then
-  for marker in "$HOME/.claude/.pipeline-version" "$HOME/.copilot/.pipeline-version" \
-                "$HOME/.codex/.pipeline-version"; do
-    if [ -f "$marker" ]; then
-      LOCAL_VERSION=$(head -1 "$marker" 2>/dev/null | tr -d '[:space:]')
+  for candidate in "$HOME/multi-agent-pipeline" "$HOME/dev/multi-agent-pipeline" "$HOME/projects/multi-agent-pipeline"; do
+    if [ -f "$candidate/package.json" ]; then
+      LOCAL_VERSION=$(node -p "require('$candidate/package.json').version" 2>/dev/null || true)
       [ -n "$LOCAL_VERSION" ] && break
     fi
   done
 fi
 [ -z "$LOCAL_VERSION" ] && exit 0  # cannot determine local version -> silent no-op
 
-# Highest of two dotted versions; ties resolve to the second argument.
-highest_of() {
-  printf '%s\n%s\n' "$1" "$2" | sort -t. -k1,1n -k2,2n -k3,3n | tail -1
+# Cache lifetime: --ttl-hours, else prefs global.updateCheck.ttlHours, else 24.
+# Anything that is not a whole number falls back to 24.
+if [ -z "$TTL_HOURS" ]; then
+  PREFS_FILE="${MULTI_AGENT_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
+  if [ -f "$PREFS_FILE" ] && command -v jq >/dev/null 2>&1; then
+    TTL_HOURS=$(jq -r '.global.updateCheck.ttlHours // empty' "$PREFS_FILE" 2>/dev/null || true)
+  fi
+fi
+case "$TTL_HOURS" in (""|*[!0-9]*) TTL_HOURS=24 ;; esac
+
+# 0 when $1 sorts strictly below $2. Semver order: numeric major.minor.patch,
+# and a prerelease (1.2.3-beta) below its release (1.2.3). A leading v is ignored.
+version_lt() {
+  local a="${1#v}" b="${2#v}" ac ap bc bp i x y
+  ac="${a%%-*}"; bc="${b%%-*}"
+  ap=""; bp=""
+  [ "$ac" != "$a" ] && ap="${a#*-}"
+  [ "$bc" != "$b" ] && bp="${b#*-}"
+  for i in 1 2 3; do
+    x=$(printf '%s' "$ac" | cut -d. -f"$i"); y=$(printf '%s' "$bc" | cut -d. -f"$i")
+    case "$x" in (""|*[!0-9]*) x=0 ;; esac
+    case "$y" in (""|*[!0-9]*) y=0 ;; esac
+    [ "$x" -lt "$y" ] && return 0
+    [ "$x" -gt "$y" ] && return 1
+  done
+  [ -n "$ap" ] && [ -z "$bp" ] && return 0
+  [ -z "$ap" ] && [ -n "$bp" ] && return 1
+  [ -n "$ap" ] && [ "$(printf '%s\n%s\n' "$ap" "$bp" | sort | head -1)" = "$ap" ] && [ "$ap" != "$bp" ] && return 0
+  return 1
 }
 
 now=$(date +%s)
@@ -92,6 +122,8 @@ if [ "$FORCE" -eq 0 ] && [ -f "$CACHE_FILE" ]; then
   cached_latest=$(cut -d'|' -f2 "$CACHE_FILE" 2>/dev/null || echo "")
   cached_required=$(cut -d'|' -f3 "$CACHE_FILE" 2>/dev/null || echo "")
   case "$cached_epoch" in (*[!0-9]*|"") cached_epoch=0 ;; esac
+  # A stamp in the future is a clock or copy mistake, not a fresh answer.
+  [ "$cached_epoch" -gt "$now" ] && cached_epoch=0
   if [ $((now - cached_epoch)) -lt $((TTL_HOURS * 3600)) ] && [ -n "$cached_latest" ]; then
     latest="$cached_latest"
     required="$cached_required"
@@ -100,6 +132,16 @@ fi
 
 # Stale or missing cache -> one bounded registry call (silent on any failure).
 # The abbreviated packument carries dist-tags at a quarter of the full document.
+# A failed read is remembered for FAIL_TTL_SECONDS in "<cache>.fail", so an
+# offline machine does not wait out the timeout on every call.
+if [ -z "$latest" ] && [ "$FORCE" -eq 0 ] && [ -f "$CACHE_FILE.fail" ]; then
+  failed_at=$(head -1 "$CACHE_FILE.fail" 2>/dev/null | tr -d '[:space:]')
+  case "$failed_at" in (*[!0-9]*|"") failed_at=0 ;; esac
+  if [ "$failed_at" -le "$now" ] && [ $((now - failed_at)) -lt "$FAIL_TTL_SECONDS" ]; then
+    exit 0
+  fi
+fi
+
 if [ -z "$latest" ]; then
   tags=$(curl -sm 3 -H 'Accept: application/vnd.npm.install-v1+json' "$REGISTRY_URL" 2>/dev/null \
     | { if command -v jq >/dev/null 2>&1; then
@@ -110,14 +152,25 @@ if [ -z "$latest" ]; then
   latest="${tags%%|*}"
   required="${tags#*|}"
   [ "$required" = "$tags" ] && required=""
-  [ -z "$latest" ] && exit 0
   mkdir -p "$(dirname "$CACHE_FILE")" 2>/dev/null || exit 0
-  printf '%s|%s|%s\n' "$now" "$latest" "$required" > "$CACHE_FILE" 2>/dev/null || true
+  if [ -z "$latest" ]; then
+    printf '%s\n' "$now" > "$CACHE_FILE.fail" 2>/dev/null || true
+    exit 0
+  fi
+  rm -f "$CACHE_FILE.fail" 2>/dev/null || true
+  # Written through a temp file and a rename, so a concurrent reader never
+  # sees a half-written line.
+  tmp_cache=$(mktemp "$CACHE_FILE.XXXXXX" 2>/dev/null) || exit 0
+  if printf '%s|%s|%s\n' "$now" "$latest" "$required" > "$tmp_cache" 2>/dev/null; then
+    mv -f "$tmp_cache" "$CACHE_FILE" 2>/dev/null || rm -f "$tmp_cache"
+  else
+    rm -f "$tmp_cache"
+  fi
 fi
 
 # A floor above latest is a publisher mistake (the `required` tag was moved to a
 # version that `latest` no longer covers). Clamp rather than brick every user.
-if [ -n "$required" ] && [ "$(highest_of "$required" "$latest")" != "$latest" ]; then
+if [ -n "$required" ] && version_lt "$latest" "$required"; then
   required="$latest"
 fi
 
@@ -127,8 +180,7 @@ if [ "$PRINT_REQUIRED" -eq 1 ]; then
 fi
 
 # Forced update: local sorts strictly BELOW the required floor.
-if [ -n "$required" ] && [ "$LOCAL_VERSION" != "$required" ] \
-   && [ "$(highest_of "$LOCAL_VERSION" "$required")" = "$required" ]; then
+if [ -n "$required" ] && version_lt "$LOCAL_VERSION" "$required"; then
   printf '%s|%s|force\n' "$LOCAL_VERSION" "$latest"
   exit 0
 fi
@@ -137,7 +189,7 @@ fi
 
 # Update available only when latest sorts strictly ABOVE local (a dev machine
 # running ahead of the registry must not see an "update" prompt).
-if [ "$(highest_of "$LOCAL_VERSION" "$latest")" = "$latest" ]; then
+if version_lt "$LOCAL_VERSION" "$latest"; then
   printf '%s|%s\n' "$LOCAL_VERSION" "$latest"
 fi
 exit 0

package/pipeline/scripts/usage-report.mjs

@@ -340,10 +340,10 @@ function commandOf(state, mode) {
   return mode;
 }
 
-// A repository name is the user's, not ours. It put a corporate project into
-// the maintainer's database, which is the disclosure this telemetry must not
-// make - and the panel never needed the name, only the ability to tell one
-// project's runs from another's. A digest does that and cannot be read back.
+// A repository name is the user's, not ours, and the panel never needs it:
+// only the ability to tell one project's runs from another's. A digest keeps
+// the name out of the record. It is not secret: anyone who can guess a name
+// can hash it and compare.
 function projectDigest(name) {
   if (typeof name !== "string" || !name.trim()) return null;
   return `p${createHash("sha256").update(name.trim()).digest("hex").slice(0, 8)}`;

package/pipeline/skills/.skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-09-25T08:57:50Z",
+  "generatedAt": "2026-09-25T16:25:54Z",
   "skillCount": 218,
   "entries": [
     {
@@ -29,7 +29,7 @@
     },
     {
       "path": "shared/core/multi-agent-autopilot-on/SKILL.md",
-      "sha256": "ca671ffe46809e3b0c825a6b5c19e8ea00e529874531eb480a0987428366d2f4"
+      "sha256": "d4f23f6f7bb493a4efa2cfa252fab50b22b6506aeaf31985db4498b5f010c8c8"
     },
     {
       "path": "shared/core/multi-agent-autopilot-status/SKILL.md",
@@ -45,7 +45,7 @@
     },
     {
       "path": "shared/core/multi-agent-channels/SKILL.md",
-      "sha256": "e52daada5aba4f772018d4cab508acc87b9b1c2686e1f5a770c4843f76c74208"
+      "sha256": "03f7c648e1938f3d6d7c48d4c1c01f2bd734cdce873ec5203120b5be3ae761db"
     },
     {
       "path": "shared/core/multi-agent-complaint-analysis/SKILL.md",
@@ -97,7 +97,7 @@
     },
     {
       "path": "shared/core/multi-agent-jira/SKILL.md",
-      "sha256": "c3e75df9f353bfeb0eb33632fab409721f03aab9c901102502d328eea93a6092"
+      "sha256": "d7e23fd1565b6640d33c23cce4d025660212d9d3f3ab80a43369ad80ae8be080"
     },
     {
       "path": "shared/core/multi-agent-kill/SKILL.md",
@@ -133,7 +133,7 @@
     },
     {
       "path": "shared/core/multi-agent-refactor/SKILL.md",
-      "sha256": "dedcdb18c961b0ddf87d1f3308e9aba94cc31534cc4263503098fbdd5dd292e1"
+      "sha256": "889c17f800b83d5c5d13d097eff63f28dc8d7869679bfcdb72efecd8b1d66391"
     },
     {
       "path": "shared/core/multi-agent-research/SKILL.md",
@@ -205,7 +205,7 @@
     },
     {
       "path": "shared/core/multi-agent-stack/SKILL.md",
-      "sha256": "827d1582ee536ed65660574f24687b17b8b0a2a76f9b69ab03c9bb184a7712bb"
+      "sha256": "ac964cd00dd6ed06512530489d867efbc51d7d7614265f9aa022679325d5defe"
     },
     {
       "path": "shared/core/multi-agent-status/SKILL.md",
@@ -253,11 +253,11 @@
     },
     {
       "path": "shared/core/multi-agent-update/SKILL.md",
-      "sha256": "b58574eb82a28c1657d30524b528a55a8d1f3e2eadd7b23f85525b2aca243c4b"
+      "sha256": "d96e18b70bab0a601057f75f212dd4fb563db0cb250607c770ce1c7a1df4b1d0"
     },
     {
       "path": "shared/core/multi-agent/SKILL.md",
-      "sha256": "b738b5055f4eb9a37934730ceddec8f02058c9a5e5c3d99158de1b4634e0d2a6"
+      "sha256": "3bfaa4f0743aa1ab8d7f2bec4edb6b3c759f6c7a890535b2f0e1606f2ce7547d"
     },
     {
       "path": "shared/external/accessibility-compliance-accessibility-audit/SKILL.md",