@mmerterden/multi-agent-pipeline 20.35.0 → 20.36.0

package/CHANGELOG.md

@@ -16,6 +16,20 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.36.0] - 2026-10-31
+
+### Added
+
+- `/multi-agent:office-pair`: one command for pairing a phone with the office. It opens the QR page, waits for the phone, asks the user whether both screens show the same comparison code, and enrols or cancels. `office-pair.mjs start --terminal` draws the QR in a terminal window, only when its output is a terminal, so captured output never holds the one-time secret.
+
+### Fixed
+
+- `office-pair.mjs start` without a relay names the missing setting (`global.office.remote.relayUrl` or `--relay`) instead of reporting that the relay URL is not a URL.
+
+### Security
+
+- Development tooling resolves `minimatch` 11.0.3 and `glob` 14.0.3 through npm `overrides` (GHSA-g3hv-75wg-m249, GHSA-3g3m-2fjr-6pw4). Both are pulled in by eslint and c8 only; nothing in the published package depends on them.
+
 ## [20.35.0] - 2026-10-27
 
 ### Added

package/README.md

@@ -158,7 +158,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 
 ## Commands
 
-`/multi-agent` plus 69 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
+`/multi-agent` plus 70 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
 
 ### Pipeline entries
 
@@ -392,6 +392,7 @@ the page with a one-time code; the server runs until `/multi-agent:office-off`.
 | ---------------------------- | --------------------------------------------------------------- |
 | `/multi-agent:office-on`     | Start or reuse the server and open the page                     |
 | `/multi-agent:office-status` | Whether it runs, its URL (never the token) and its last actions |
+| `/multi-agent:office-pair`   | Pair a phone: QR, wait, compare the code, enrol                 |
 | `/multi-agent:office-off`    | Stop the server; it runs until you do                           |
 
 Security model: [office threat model](pipeline/multi-agent-refs/features/office-threat-model.md).
@@ -452,17 +453,17 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 69 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 70 commands.
 
 | Tool        | Flag                 | What it installs                                                                                       |
 | ----------- | -------------------- | ------------------------------------------------------------------------------------------------------ |
 | Claude Code | `--claude` (default) | slash commands + skills + agents + the enforcement hooks (secret scan, agent-guard, read-size gate, run-scope guard, run-stop guard) |
-| Copilot CLI | `--copilot`          | instructions + 69 sub-command skills + scripts                                                         |
-| Codex CLI   | `--codex`            | one router skill + 69 specs as refs + 11 agent TOML + `AGENTS.md` block + `codex mcp add`               |
+| Copilot CLI | `--copilot`          | instructions + 70 sub-command skills + scripts                                                         |
+| Codex CLI   | `--codex`            | one router skill + 70 specs as refs + 11 agent TOML + `AGENTS.md` block + `codex mcp add`               |
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 
-**Why Codex gets one skill and not 69.** Codex assembles every discovered skill's name
+**Why Codex gets one skill and not 70.** Codex assembles every discovered skill's name
 and description into a single prompt block and drops entries when it overflows, with no
 error. Measured on 0.145: installing one plugin that declares 142 skills surfaced only
 75 of them and evicted an unrelated user skill. So on Codex the pipeline ships a single

package/README.tr.md

@@ -157,7 +157,7 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 
 ## Komutlar
 
-`/multi-agent` ve 69 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
+`/multi-agent` ve 70 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
 
 ### Pipeline girişleri
 
@@ -392,6 +392,7 @@ başlatır ve sayfayı tek kullanımlık bir kodla açar; sunucu
 | ---------------------------- | -------------------------------------------------------- |
 | `/multi-agent:office-on`     | Sunucuyu başlatır ya da var olanı kullanır, sayfayı açar |
 | `/multi-agent:office-status` | Çalışıyor mu, adresi (token asla) ve son işlemleri       |
+| `/multi-agent:office-pair`   | Telefonu eşle: QR, bekle, kodu karşılaştır, kaydet       |
 | `/multi-agent:office-off`    | Sunucuyu durdurur; sen durdurana kadar çalışır           |
 
 Güvenlik modeli: [ofis tehdit modeli](pipeline/multi-agent-refs/features/office-threat-model.md).
@@ -452,17 +453,17 @@ Bu, ilgili plugin'i (+ ortak `ai-common` plugin'ini) repo'nun `.claude/settings.
 
 ## Araç desteği
 
-Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 69 komutu alır.
+Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 70 komutu alır.
 
 | Araç        | Bayrak                  | Ne kurar                                                                                                         |
 | ----------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
 | Claude Code | `--claude` (varsayılan) | slash komutları + skill'ler + agent'lar + üç `PreToolUse` hook'u (secret scan, agent-guard, okuma-boyutu geçidi) |
-| Copilot CLI | `--copilot`             | talimatlar + 69 alt-komut skill'i + script'ler                                                                   |
-| Codex CLI   | `--codex`               | bir router skill + ref olarak 69 spec + 11 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
+| Copilot CLI | `--copilot`             | talimatlar + 70 alt-komut skill'i + script'ler                                                                   |
+| Codex CLI   | `--codex`               | bir router skill + ref olarak 70 spec + 11 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
 
 Skill'leri stack'e göre filtrele: `--platform=ios\|android\|all`.
 
-**Codex neden 69 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
+**Codex neden 70 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
 ve açıklamasını tek bir prompt bloğuna toplar ve blok taştığında girdileri hatasızca
 düşürür. 0.145 üzerinde ölçüldü: 142 skill deklare eden bir plugin kurulduğunda sadece
 75'i yüzeye çıktı ve alakasız bir kullanıcı skill'i tahliye edildi. Bu yüzden Codex'te

package/docs/architecture.md

@@ -113,7 +113,7 @@ graph TB
     end
 
     subgraph "Pipeline Specs"
-        CMD[commands/<br/>69 command files]
+        CMD[commands/<br/>70 command files]
         AGT[agents/<br/>11 agent personas]
         RUL[rules/<br/>13 domain rules]
         PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
@@ -204,8 +204,8 @@ repo and the website, plus the two independently shipped repos
 ```mermaid
 graph TD
     CC["Claude Code<br/>(source of truth)"]
-    COP["Copilot CLI<br/>(instructions + 69 sub-command skills)"]
-    COD["Codex CLI<br/>(1 router skill + 69 refs)"]
+    COP["Copilot CLI<br/>(instructions + 70 sub-command skills)"]
+    COD["Codex CLI<br/>(1 router skill + 70 refs)"]
     REPO["Pipeline Repo<br/>(npm package)"]
     WEB["Website"]
     PLUGREPO["multi-agent-plugins<br/>(6 plugins, own repo)"]

package/docs/ecosystem.md

@@ -5,7 +5,7 @@ separately, wired together at install time and at run time:
 
 | Repo | What it owns | Ships as |
 |---|---|---|
-| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 69 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
+| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 70 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
 | **`multi-agent-plugins`** | Stack knowledge: per-platform component/lifecycle skills (iOS, Android, Frontend, Backend) + shared knowledge | Claude Code marketplace, 6 independently-versioned plugins |
 | **`multi-agent-toolkit-mcp`** | The pipeline's hands on devices and browsers: 197 MCP tools across 21 categories (simulator/emulator control, end-to-end locators and assertions, memory, crash diagnostics, accessibility audit, store compliance, web automation and scraping, Figma-vs-mock design audit, code intelligence, wallet passes, an agent-DSL batch runner, a full-text context index with text-to-image rendering, provider-backed research, verified hand-off of simple text tasks to free models, video key frames, offline security scoring, read-only access to related repositories at their latest branch, travel document fixtures, a voice channel, App Store Connect and Play Console APIs, virtual iPhones) | npm package, registered as a standard stdio MCP server on every host |
 
@@ -18,7 +18,7 @@ Either can be swapped or removed without touching the other two's source.
 graph LR
     subgraph PIPE ["multi-agent-pipeline (orchestrator)"]
         direction TB
-        PHASES["6 phases · 69 commands"]
+        PHASES["6 phases · 70 commands"]
         GATES["deterministic gates + review triage"]
     end
 
@@ -68,8 +68,8 @@ only those:
 graph TD
     CC["Claude Code<br/>~/.claude/commands/multi-agent/<br/>(source of truth)"]
 
-    CC -->|"Step 2: copy + reformat<br/>69 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
-    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 69 refs<br/>+ 11 agent TOML"]
+    CC -->|"Step 2: copy + reformat<br/>70 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
+    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 70 refs<br/>+ 11 agent TOML"]
     CC -->|"Step 3: genericize<br/>(strip personal data)"| REPO["multi-agent-pipeline repo<br/>pipeline/"]
     CC -->|"Step 4: version + feature sync"| WEB["Website<br/>projects.ts / i18n.tsx"]
 
@@ -161,7 +161,7 @@ measurements behind this table):
 
 | | Claude Code | Copilot CLI | Codex CLI |
 |---|---|---|---|
-| **Pipeline commands** | 69 slash-command skills, native | 69 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 69 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
+| **Pipeline commands** | 70 slash-command skills, native | 70 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 70 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
 | **Stack plugins** | Marketplace plugin, loaded natively, resolved by `.claude/settings.json` enabled-list | Enabled plugin's authored skills copied flat into `~/.copilot/skills/`; `knowledge/` **not** re-copied (already delivered via `shared/external`) | Copied as reference files under `~/.codex/multi-agent-refs/skills/`, plugin-prefixed on name clash (e.g. `architecture` → `ai-ios-toolkit-architecture`) |
 | **Component dispatch (Phase 3)** | Marketplace plugin's `create-component`/`create-screen` skill via the Skill tool | No plugin loader - the enabled stack plugin's authored skills (incl. `create-component`) are copied flat into `~/.copilot/skills/` at install time (the old frozen `figma-*` copies are pruned, they were never a fallback) | Not part of the enforced parity axis; classification + state-shape must match, skill *inventory* does not |
 | **multi-agent-toolkit-mcp** | `claude mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `copilot mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `codex mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` (skipped with a warning if `codex` isn't on `PATH`) |

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-10-27",
-  "version": "20.35.0",
+  "generatedAt": "2026-10-31",
+  "version": "20.36.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -35,9 +35,9 @@
     "autopilot": [0, 1, 2, 3, 4, 5],
     "analysis": [0, 1, 2, 3, 4, 5]
   },
-  "commandCount": 69,
+  "commandCount": 70,
   "skillCount": 165,
-  "skillCountAll": 237,
+  "skillCountAll": 238,
   "agentCount": 11,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
   "toolCount": 213,