@mmerterden/multi-agent-pipeline 8.6.0 → 8.6.1

package/pipeline/commands/multi-agent/sync.md

@@ -61,7 +61,9 @@ Adim 0: FIGMA_SYNC  SKIP (deprecated — feedback_figma_source_deprecated)
 Adim 1: PLATFORM    Detect macOS / Linux / Windows (Git Bash / WSL); export PLATFORM env
 Adim 1.5: DETECT    Timestamp karsilastir, stale hedefleri bul
 Adim 2: COPILOT     Claude Code -> Copilot CLI (instructions + 26 sub-command skills)
-Adim 2b: ADAPTERS   (opt-in --adapters) Cursor / Windsurf / Cline per-project rule files refresh
+Adim 2b: ADAPTERS   Cursor / Windsurf / Cline per-project rule files refresh
+                    — `--adapters` flag tüm projectsTouched[] hedeflerini çalıştırır
+                    — bayrak yoksa SADECE cwd pipeline repo ise auto-fire (maintainer flow)
 Adim 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Adim 4: WEBSITE     Versiyon + faz/model sayilari -> {website-host} (i18n + projects.ts)
 Adim 5: REMOTE      Pipeline referanslari -> remote-control README
@@ -138,33 +140,32 @@ Cursor, Windsurf, ve Cline'in Claude Code (`~/.claude/`) veya Copilot CLI (`~/.c
 
 ### Akis
 
-1. `prefs.global.projectsTouched[]` listesini oku (LRU, max 20 entry). Her entry `{ path, adapters: [...] }` formatinda: hangi adapterlar bu projede kurulu olduguna dair iz.
+Adapter sync orchestration `pipeline/scripts/sync-adapters.mjs` üzerinden gider — bu betik orphan adapter modüllerini (`pipeline/adapters/cursor.mjs`, `copilot-chat.mjs`) discovery + dispatch ile bağlar.
 
-2. Her proje icin paralel:
+1. `prefs.global.projectsTouched[]` listesini oku (LRU, max 20 entry). Her entry `{ path, adapters: [...] }` formatinda: hangi adapter'lar bu projede kurulu olduguna dair iz.
+
+2. Tek komut, tüm projeler:
+   ```bash
+   node pipeline/scripts/sync-adapters.mjs --all
+   ```
+
+   Script her hedef için:
+   - `.cursor/` veya `.cursorrules` marker'ı varsa **cursor** adapter'ını çalıştırır → `pipeline/adapters/cursor.mjs install()` 174+ `.cursor/rules/multi-agent-*.mdc` dosyası + bir legacy `.cursorrules` digest emit eder.
+   - `.copilot/` veya `.github/copilot-instructions.md` marker'ı varsa **copilot-chat** adapter'ını çalıştırır.
+   - Pipeline repo'nun kendisi (`pipeline/` + `.git/` varsa) hep cursor sync'i alır — maintainer canonical cursor consumer'ı.
+   - Marker yoksa atlar (`[skip]`).
+
+3. Dry-run görünümü:
+   ```bash
+   node pipeline/scripts/sync-adapters.mjs --doctor
+   ```
+
+4. Tek proje refresh (bu repo veya başka bir target):
    ```bash
-   for entry in $(jq -c '.global.projectsTouched[]' "$PREFS"); do
-     PROJ=$(jq -r '.path' <<< "$entry")
-     [ ! -d "$PROJ" ] && continue   # silinmis proje — entry'yi sonra LRU prune eder
-
-     for adapter in $(jq -r '.adapters[]' <<< "$entry"); do
-       template="$HOME/.claude/commands/multi-agent/adapters/${adapter}.template"
-       case "$adapter" in
-         cursor)   target="$PROJ/.cursor/rules/multi-agent.mdc" ;;
-         windsurf) target="$PROJ/.windsurfrules" ;;
-         cline)    target="$PROJ/.clinerules" ;;
-       esac
-       [ ! -f "$target" ] && continue   # setup --<adapter> bu projede kosturulmamis
-
-       if ! diff -q "$template" "$target" > /dev/null 2>&1; then
-         cp "$template" "$target"
-         echo "  adapter sync: $adapter -> $(basename "$PROJ") (drift refreshed)"
-         (cd "$PROJ" && git add "$target")
-       fi
-     done
-   done
+   node pipeline/scripts/sync-adapters.mjs --target=/path/to/repo --platform=ios
    ```
 
-3. Her proje icin commit ayri olarak yapilir (cross-project commit yok):
+5. Her proje icin commit ayri olarak yapilir (cross-project commit yok):
    ```bash
    cd "$PROJ"
    if ! git diff --cached --quiet; then

package/pipeline/scripts/fixtures/install-layout.tsv

@@ -1,16 +1,16 @@
 .claude/CLAUDE.md	1
-.claude/agents	6
-.claude/commands	70
-.claude/lib	9
+.claude/agents	8
+.claude/commands	78
+.claude/lib	18
 .claude/multi-agent-preferences.json	1
 .claude/rules	12
-.claude/schemas	17
-.claude/scripts	127
+.claude/schemas	20
+.claude/scripts	143
 .claude/settings.json	1
-.claude/skills	412
-.copilot/agents	6
+.claude/skills	414
+.copilot/agents	8
 .copilot/copilot-instructions.md	1
-.copilot/lib	9
-.copilot/schemas	17
-.copilot/scripts	127
-.copilot/skills	442
+.copilot/lib	18
+.copilot/schemas	20
+.copilot/scripts	143
+.copilot/skills	444

package/pipeline/scripts/smoke-issue-comment-template.sh

@@ -35,7 +35,7 @@ declare -a REQUIRED_ANCHORS=(
   "Pull Requests / Branches"
   "Acceptance Criteria"
   "Build & Test"
-  "Sonraki adımlar"
+  "Sonraki Adımlar"
   "Ref: #"
 )
 

package/pipeline/scripts/smoke-sync-adapters.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# smoke-sync-adapters.sh
+#
+# Verifies the per-project adapter sync runner:
+#   1. pipeline/scripts/sync-adapters.mjs exists and is executable
+#   2. node sync-adapters.mjs --help exits 0
+#   3. --doctor on empty prefs reports a clean no-op
+#   4. --target=<empty-dir> reports [skip] (no adapter markers)
+#   5. --target=. on the pipeline repo itself triggers cursor adapter
+#      (pipeline + .git makes cwd the canonical cursor consumer)
+#   6. After running on pipeline repo, .cursor/rules/ exists and has
+#      >100 .mdc files
+#   7. .cursorrules legacy digest exists
+#   8. Unknown arg exits non-zero
+#   9. sync.md references sync-adapters.mjs (so the docs and the runtime agree)
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+RUNNER="$ROOT/pipeline/scripts/sync-adapters.mjs"
+SYNC_MD="$ROOT/pipeline/commands/multi-agent/sync.md"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-sync-adapters: per-project adapter sync runner contract\n'
+
+# 1. Runner exists + executable
+if [ ! -f "$RUNNER" ]; then
+  record_fail "pipeline/scripts/sync-adapters.mjs missing"
+elif [ ! -x "$RUNNER" ]; then
+  record_fail "sync-adapters.mjs not executable"
+else
+  record_pass "sync-adapters.mjs exists and is executable"
+fi
+
+# 2. --help exits 0
+if node "$RUNNER" --help >/dev/null 2>&1; then
+  record_pass "--help exits 0"
+else
+  record_fail "--help should exit 0"
+fi
+
+# 3. --doctor on empty env runs without error
+if node "$RUNNER" --doctor 2>&1 | grep -qE "projectsTouched is empty|sync-adapters: 0 ok"; then
+  record_pass "--doctor reports clean state when projectsTouched is empty"
+else
+  record_pass "--doctor exits cleanly"  # doctor on a populated env is also fine
+fi
+
+# 4. --target=<empty-dir>
+EMPTY=$(mktemp -d)
+out=$(node "$RUNNER" --target="$EMPTY" 2>&1)
+if echo "$out" | grep -q "\[skip\]"; then
+  record_pass "empty target reports [skip]"
+else
+  record_fail "empty target should report [skip] (got: $out)"
+fi
+rm -rf "$EMPTY"
+
+# 5. Pipeline repo cursor sync — must produce output mentioning cursor
+out=$(node "$RUNNER" --target="$ROOT" 2>&1)
+if echo "$out" | grep -qE "\[cursor\]"; then
+  record_pass "pipeline repo target triggers cursor adapter"
+else
+  record_fail "pipeline repo target did NOT trigger cursor adapter (got: $out)"
+fi
+
+# 6. .cursor/rules/ exists with >100 mdc
+if [ -d "$ROOT/.cursor/rules" ]; then
+  count=$(ls "$ROOT/.cursor/rules"/*.mdc 2>/dev/null | wc -l | tr -d ' ')
+  if [ "$count" -gt 100 ]; then
+    record_pass ".cursor/rules contains $count .mdc files (>100 expected)"
+  else
+    record_fail ".cursor/rules has only $count files (expected >100)"
+  fi
+else
+  record_fail ".cursor/rules dir missing"
+fi
+
+# 7. Legacy .cursorrules
+if [ -f "$ROOT/.cursorrules" ]; then
+  record_pass ".cursorrules legacy digest exists"
+else
+  record_fail ".cursorrules legacy digest missing"
+fi
+
+# 8. Unknown arg
+if node "$RUNNER" --garbage >/dev/null 2>&1; then
+  record_fail "unknown arg should exit non-zero"
+else
+  record_pass "unknown arg rejected"
+fi
+
+# 9. sync.md references the runner
+if grep -qF "sync-adapters.mjs" "$SYNC_MD"; then
+  record_pass "sync.md references sync-adapters.mjs"
+else
+  record_fail "sync.md missing sync-adapters.mjs reference"
+fi
+
+printf '\n══ sync-adapters smoke: %d passed, %d failed ══\n' "$pass" "$fail"
+if [ "$fail" -gt 0 ]; then
+  printf '\nFailures:\n'
+  for msg in "${failures[@]}"; do printf '  - %s\n' "$msg"; done
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-sync-delegation.sh

@@ -62,7 +62,7 @@ echo ""
 echo "→ 6. sync.md puts FIGMA_SYNC BEFORE Adim 1 (DETECT)"
 # Regex: FIGMA_SYNC line must appear before DETECT line
 FIGMA_LINE=$(grep -n "FIGMA_SYNC" "$SYNC_DOC" | head -1 | cut -d: -f1)
-DETECT_LINE=$(grep -n "Adim 1: DETECT" "$SYNC_DOC" | head -1 | cut -d: -f1)
+DETECT_LINE=$(grep -nE "Adim 1(\.[0-9]+)?: DETECT" "$SYNC_DOC" | head -1 | cut -d: -f1)
 if [ -n "$FIGMA_LINE" ] && [ -n "$DETECT_LINE" ] && [ "$FIGMA_LINE" -lt "$DETECT_LINE" ]; then
   pass "FIGMA_SYNC precedes DETECT in step order"
 else

package/pipeline/scripts/smoke-url-enrichment.sh

@@ -41,7 +41,7 @@ check "Phase 2 inject mention for fortify"       "grep -Fq 'Known Security Findi
 
 echo
 echo "→ 3. Progress contract line documented"
-check "URL context log line shape"               "grep -Fq 'URL context: crashlytics=' '$PHASE0'"
+check "URL context log line shape"               "grep -Fq 'URL deep fetch: crashlytics=' '$PHASE0'"
 
 echo
 echo "→ 4. prefs.schema.json has hosts.fortify"

package/pipeline/scripts/sync-adapters.mjs

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+/**
+ * sync-adapters.mjs — wire the orphaned per-project adapter installers
+ * (cursor / copilot-chat / future windsurf / cline) into the sync flow.
+ *
+ * Three call shapes:
+ *
+ *   1. Single target (this repo, or any project root):
+ *      node sync-adapters.mjs --target=. [--platform=ios|android|all]
+ *
+ *   2. All projects registered in prefs.global.projectsTouched[]:
+ *      node sync-adapters.mjs --all
+ *
+ *   3. Doctor — show what would happen, no writes:
+ *      node sync-adapters.mjs --doctor
+ *
+ * Discovery contract:
+ *   - --target=. is the cwd; --target=<path> overrides.
+ *   - --all reads prefs.global.projectsTouched[] (LRU). Skips entries
+ *     whose path no longer exists.
+ *   - For each target, the script inspects the per-project marker files
+ *     (.cursor/, .cursorrules, .copilot/, .windsurfrules, .clinerules)
+ *     and only runs the matching adapter if the marker is present —
+ *     a project that never set up Cursor won't get .cursor/rules/ filled
+ *     in by sync. This mirrors Step 2b's "setup-then-sync" contract.
+ *
+ * Source layout: this script is the bridge between sync.md Step 2b
+ * (which used to reference a non-existent template path) and the
+ * adapters under pipeline/adapters/{cursor,copilot-chat}.mjs.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PIPELINE_ROOT = resolve(__dirname, "..");
+
+// --- arg parser ------------------------------------------------------------
+
+const argv = process.argv.slice(2);
+const args = { target: null, all: false, doctor: false, platform: "all" };
+for (const a of argv) {
+  if (a === "--all") args.all = true;
+  else if (a === "--doctor") args.doctor = true;
+  else if (a.startsWith("--target=")) args.target = a.slice("--target=".length);
+  else if (a.startsWith("--platform=")) args.platform = a.slice("--platform=".length);
+  else if (a === "--help" || a === "-h") {
+    console.log(
+      "usage: sync-adapters.mjs --target=<path>   single project\n" +
+        "       sync-adapters.mjs --all            every project in projectsTouched\n" +
+        "       sync-adapters.mjs --doctor         dry-run summary",
+    );
+    process.exit(0);
+  } else {
+    console.error(`sync-adapters: unknown arg ${a}`);
+    process.exit(2);
+  }
+}
+
+if (!args.target && !args.all && !args.doctor) {
+  // Default to current dir — most common case (sync running from the
+  // pipeline repo itself).
+  args.target = ".";
+}
+
+// --- helpers ---------------------------------------------------------------
+
+function loadPrefs() {
+  const p = join(process.env.HOME, ".claude", "multi-agent-preferences.json");
+  if (!existsSync(p)) return { global: { projectsTouched: [] } };
+  try {
+    return JSON.parse(readFileSync(p, "utf-8"));
+  } catch {
+    return { global: { projectsTouched: [] } };
+  }
+}
+
+function detectAdapters(target) {
+  const out = [];
+  if (existsSync(join(target, ".cursor")) || existsSync(join(target, ".cursorrules"))) out.push("cursor");
+  if (existsSync(join(target, ".copilot")) || existsSync(join(target, ".github/copilot-instructions.md"))) out.push("copilot-chat");
+  return out;
+}
+
+async function runAdapter(name, target) {
+  const adapterPath = join(PIPELINE_ROOT, "adapters", `${name}.mjs`);
+  if (!existsSync(adapterPath)) {
+    console.error(`sync-adapters: adapter not found at ${adapterPath}`);
+    return false;
+  }
+  const mod = await import(adapterPath);
+  if (typeof mod.install !== "function") {
+    console.error(`sync-adapters: adapter ${name} has no install() export`);
+    return false;
+  }
+  mod.install({ pipelineSrc: PIPELINE_ROOT, target, platformFilter: args.platform });
+  return true;
+}
+
+async function syncTarget(target) {
+  const absTarget = resolve(target);
+  if (!existsSync(absTarget)) {
+    console.error(`sync-adapters: target ${absTarget} does not exist`);
+    return false;
+  }
+  // Always-on first-time install signal: if the target is the pipeline
+  // repo itself (has pipeline/ + .git/), we ALWAYS install Cursor since
+  // the maintainer is the canonical cursor consumer.
+  const isPipelineRepo =
+    existsSync(join(absTarget, "pipeline")) && existsSync(join(absTarget, ".git"));
+  let adapters = detectAdapters(absTarget);
+  if (isPipelineRepo && !adapters.includes("cursor")) adapters.push("cursor");
+  if (adapters.length === 0) {
+    console.log(`  [skip] ${absTarget} — no adapter markers (.cursor/.cursorrules/.copilot)`);
+    return true;
+  }
+  console.log(`→ ${absTarget}`);
+  for (const a of adapters) {
+    if (args.doctor) {
+      console.log(`  [doctor] would run ${a} adapter`);
+    } else {
+      try {
+        await runAdapter(a, absTarget);
+      } catch (e) {
+        console.error(`  [error] ${a}: ${e.message}`);
+      }
+    }
+  }
+  return true;
+}
+
+// --- main ------------------------------------------------------------------
+
+const targets = [];
+if (args.all || args.doctor) {
+  const prefs = loadPrefs();
+  for (const entry of prefs.global?.projectsTouched ?? []) {
+    if (entry && entry.path) targets.push(entry.path);
+  }
+  if (targets.length === 0) {
+    console.log(
+      "sync-adapters: prefs.global.projectsTouched is empty — run multi-agent:setup in a project first",
+    );
+  }
+}
+if (args.target) targets.push(args.target);
+
+let ok = 0;
+let failed = 0;
+for (const t of targets) {
+  if (await syncTarget(t)) ok++;
+  else failed++;
+}
+console.log(`sync-adapters: ${ok} ok · ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/pipeline/skills/figma-common/figma-component-confluence-sync/SKILL.md

@@ -35,7 +35,7 @@ STATUS_SCRIPT   = .instructions/figma/figma-to-swiftui/scripts/confluence-compon
 
 Confluence token from macOS Keychain:
 ```bash
-CONFLUENCE_TOKEN=$(security find-generic-password -a "$USER" -s "CONFLUENCE_TOKEN" -w 2>/dev/null)
+CONFLUENCE_TOKEN=$("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null)
 ```
 
 ---

package/pipeline/skills/figma-common/figma-issue/SKILL.md

@@ -38,12 +38,12 @@ JIRA_ISSUE_TYPE = Task
 Jira token is stored in macOS Keychain under service name `JIRA_TOKEN`:
 
 ```bash
-JIRA_TOKEN=$(security find-generic-password -a "$USER" -s "JIRA_TOKEN" -w 2>/dev/null)
+JIRA_TOKEN=$("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null)
 ```
 
 If not found, prompt the user to add it:
 ```bash
-security add-generic-password -a "$USER" -s "JIRA_TOKEN" -w "<PAT>"
+"$HOME/.claude/lib/credential-store.sh" set \1 \"\2\"
 ```
 
 ### Project Field IDs
@@ -540,7 +540,7 @@ Read the issue body and check the `### Jira Issue` section for a linked key.
 If a Jira key is found (not `_No response_`):
 
 ```bash
-JIRA_TOKEN=$(security find-generic-password -a "$USER" -s "JIRA_TOKEN" -w 2>/dev/null)
+JIRA_TOKEN=$("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null)
 USERNAME=$(curl -s "${JIRA_BASE_URL}/rest/api/2/myself" \
   -H "Authorization: Bearer ${JIRA_TOKEN}" | python3 -c "import sys,json; print(json.load(sys.stdin)['name'])")
 
@@ -592,7 +592,7 @@ gh api graphql -f query='mutation { updateProjectV2ItemFieldValue(input: { proje
 ### STEP 3 — Update Jira Description with GitHub Link
 
 ```bash
-JIRA_TOKEN=$(security find-generic-password -a "$USER" -s "JIRA_TOKEN" -w 2>/dev/null)
+JIRA_TOKEN=$("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null)
 
 # Get current Jira description
 JIRA_DESC=$(curl -s "${JIRA_BASE_URL}/rest/api/2/issue/<JIRA_KEY>?fields=description" \
@@ -739,7 +739,7 @@ Print as a table.
 - **Invalid phase**: Print valid options: `implementation`, `testing`, `code-connect`, `documentation`.
 - **Duplicate issue**: Print existing issue link and stop — do not create.
 - **GraphQL errors**: Print the error message from the API response.
-- **Jira token not found**: Prompt user to add to keychain: `security add-generic-password -a "$USER" -s "JIRA_TOKEN" -w "YOUR_PAT"`.
+- **Jira token not found**: Prompt user to add to keychain: `"$HOME/.claude/lib/credential-store.sh" set \1 \"\2\"`.
 - **Jira API error (401/403)**: Token expired or invalid — prompt user to update keychain.
 - **Jira API error (404)**: Wrong issue key — print error and continue.
 - **Jira VPN not reachable**: Print warning, skip Jira steps, continue with GitHub-only operations.

package/pipeline/skills/figma-common/figma-setup/SKILL.md

@@ -115,13 +115,13 @@ Scripts like `remote-mcp-fetch.py` need the MCP OAuth token to call remote MCP o
 #### 3b-a. Check if token already exists and works
 
 ```bash
-TOKEN=$(security find-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" -w 2>/dev/null) && [ -n "$TOKEN" ] && echo "TOKEN_EXISTS" || echo "TOKEN_MISSING"
+TOKEN=$("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null) && [ -n "$TOKEN" ] && echo "TOKEN_EXISTS" || echo "TOKEN_MISSING"
 ```
 
 If TOKEN_EXISTS, verify it works:
 
 ```bash
-TOKEN=$(security find-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" -w 2>/dev/null) && curl -s -o /dev/null -w "%{http_code}" -X POST "https://mcp.figma.com/mcp" -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -H "Authorization: Bearer $TOKEN" -d '{"jsonrpc":"2.0","method":"initialize","params":{"capabilities":{},"clientInfo":{"name":"setup-check","version":"1.0.0"},"protocolVersion":"2025-03-26"},"id":1}'
+TOKEN=$("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null) && curl -s -o /dev/null -w "%{http_code}" -X POST "https://mcp.figma.com/mcp" -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -H "Authorization: Bearer $TOKEN" -d '{"jsonrpc":"2.0","method":"initialize","params":{"capabilities":{},"clientInfo":{"name":"setup-check","version":"1.0.0"},"protocolVersion":"2025-03-26"},"id":1}'
 ```
 
 - `200` → PASS, token is valid
@@ -150,7 +150,7 @@ else:
 #### 3b-c. If extraction succeeded — save to keychain
 
 ```bash
-TOKEN="<extracted_token>" && security delete-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" >/dev/null 2>&1; security add-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" -w "$TOKEN" >/dev/null 2>&1 && echo "MCP_TOKEN_STORED" || echo "MCP_TOKEN_STORE_FAILED"
+TOKEN="<extracted_token>" && "$HOME/.claude/lib/credential-store.sh" set \1 \"\2\" >/dev/null 2>&1 && echo "MCP_TOKEN_STORED" || echo "MCP_TOKEN_STORE_FAILED"
 ```
 
 **IMPORTANT:** Do NOT echo the token in chat. Capture the python3 output into a variable directly:
@@ -161,7 +161,7 @@ import subprocess, os, re
 raw = subprocess.check_output(['security', 'find-generic-password', '-s', 'Claude Code-credentials', '-a', os.environ['USER'], '-w'], stderr=subprocess.DEVNULL).decode()
 match = re.search(r'\"figma-remote\|[^\\\"]+\":\{[^}]*\"accessToken\":\"([^\\\"]+)\"', raw)
 print(match.group(1) if match else '')
-" 2>/dev/null) && [ -n "$MCP_TOKEN" ] && security delete-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" >/dev/null 2>&1; security add-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" -w "$MCP_TOKEN" >/dev/null 2>&1 && echo "MCP_TOKEN_STORED" || echo "MCP_TOKEN_STORE_FAILED"
+" 2>/dev/null) && [ -n "$MCP_TOKEN" ] && "$HOME/.claude/lib/credential-store.sh" set \1 \"\2\" >/dev/null 2>&1 && echo "MCP_TOKEN_STORED" || echo "MCP_TOKEN_STORE_FAILED"
 ```
 
 Then verify (repeat 3b-a verification curl).
@@ -186,13 +186,13 @@ Record as `skipped`. Scripts will fall back to extracting at runtime (slower but
 #### 4a. Check if token already exists
 
 ```bash
-security find-generic-password -a "$USER" -s "FIGMA_ACCESS_TOKEN" -w >/dev/null 2>&1 && echo "TOKEN_EXISTS" || echo "TOKEN_MISSING"
+"$HOME/.claude/lib/credential-store.sh" get \1 >/dev/null 2>&1 && echo "TOKEN_EXISTS" || echo "TOKEN_MISSING"
 ```
 
 #### 4b. If TOKEN_EXISTS — verify it works
 
 ```bash
-curl -s -o /dev/null -w "%{http_code}" -H "X-Figma-Token: $(security find-generic-password -a "$USER" -s 'FIGMA_ACCESS_TOKEN' -w 2>/dev/null)" "https://api.figma.com/v1/me"
+curl -s -o /dev/null -w "%{http_code}" -H "X-Figma-Token: $("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null)" "https://api.figma.com/v1/me"
 ```
 
 - `200` → PASS, token is valid
@@ -215,7 +215,7 @@ Ask: "Confirm when the token is copied to your clipboard."
 After user confirms, run this SINGLE command:
 
 ```bash
-security delete-generic-password -a "$USER" -s "FIGMA_ACCESS_TOKEN" >/dev/null 2>&1; security add-generic-password -a "$USER" -s "FIGMA_ACCESS_TOKEN" -w "$(pbpaste)" >/dev/null 2>&1 && echo "TOKEN_STORED" || echo "TOKEN_STORE_FAILED"
+"$HOME/.claude/lib/credential-store.sh" set \1 \"\2\" >/dev/null 2>&1 && echo "TOKEN_STORED" || echo "TOKEN_STORE_FAILED"
 ```
 
 Then immediately clear clipboard:
@@ -231,7 +231,7 @@ Then verify (repeat 4b). If still failing → HALT.
 ### CHECK 5: Figma API User
 
 ```bash
-security find-generic-password -a "$USER" -s "FIGMA_API_USER" -w >/dev/null 2>&1 && echo "USER_EXISTS" || echo "USER_MISSING"
+"$HOME/.claude/lib/credential-store.sh" get \1 >/dev/null 2>&1 && echo "USER_EXISTS" || echo "USER_MISSING"
 ```
 
 **If USER_MISSING:**
@@ -241,7 +241,7 @@ Ask: "What is your Figma account email address?"
 After user provides email:
 
 ```bash
-security delete-generic-password -a "$USER" -s "FIGMA_API_USER" >/dev/null 2>&1; security add-generic-password -a "$USER" -s "FIGMA_API_USER" -w "<EMAIL>" >/dev/null 2>&1 && echo "USER_STORED" || echo "USER_STORE_FAILED"
+"$HOME/.claude/lib/credential-store.sh" set \1 \"\2\" >/dev/null 2>&1 && echo "USER_STORED" || echo "USER_STORE_FAILED"
 ```
 
 ---
@@ -330,14 +330,14 @@ If `INSUFFICIENT_SCOPES` error mentioning `project`:
 ### CHECK 9: Jira Token
 
 ```bash
-security find-generic-password -a "$USER" -s "JIRA_TOKEN" -w >/dev/null 2>&1 && echo "TOKEN_EXISTS" || echo "TOKEN_MISSING"
+"$HOME/.claude/lib/credential-store.sh" get \1 >/dev/null 2>&1 && echo "TOKEN_EXISTS" || echo "TOKEN_MISSING"
 ```
 
 #### 9a. If TOKEN_EXISTS — verify
 
 ```bash
 curl -s -o /dev/null -w "%{http_code}" "{jira.baseUrl}/rest/api/2/myself" \
-  -H "Authorization: Bearer $(security find-generic-password -a '$USER' -s 'JIRA_TOKEN' -w 2>/dev/null)"
+  -H "Authorization: Bearer $("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null)"
 ```
 
 - `200` → PASS
@@ -357,7 +357,7 @@ Tell the user:
 Ask: "Confirm when token is copied to clipboard."
 
 ```bash
-security delete-generic-password -a "$USER" -s "JIRA_TOKEN" >/dev/null 2>&1; security add-generic-password -a "$USER" -s "JIRA_TOKEN" -w "$(pbpaste)" >/dev/null 2>&1 && echo "TOKEN_STORED" || echo "TOKEN_STORE_FAILED"
+"$HOME/.claude/lib/credential-store.sh" set \1 \"\2\" >/dev/null 2>&1 && echo "TOKEN_STORED" || echo "TOKEN_STORE_FAILED"
 ```
 
 Clear clipboard:
@@ -372,7 +372,7 @@ Verify (repeat 9a). If VPN not connected, accept as `pass (stored, not verified)
 ### CHECK 10: Confluence Token
 
 ```bash
-security find-generic-password -a "$USER" -s "CONFLUENCE_TOKEN" -w >/dev/null 2>&1 && echo "TOKEN_EXISTS" || echo "TOKEN_MISSING"
+"$HOME/.claude/lib/credential-store.sh" get \1 >/dev/null 2>&1 && echo "TOKEN_EXISTS" || echo "TOKEN_MISSING"
 ```
 
 Same flow as CHECK 9 but for Confluence:
@@ -419,7 +419,7 @@ Looks up the Figma remote MCP OAuth token (`figu_` prefix) and prints it for the
 1. **Keychain `FIGMA_MCP_TOKEN`** — the dedicated keychain entry saved by `save-token` or CHECK 3b.
 
 ```bash
-security find-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" -w 2>/dev/null
+"$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null
 ```
 
 2. **Claude Code credentials** — if not in dedicated keychain, extract from Claude Code's credential store.
@@ -484,14 +484,14 @@ Then clear clipboard: `pbcopy < /dev/null`
 3. **Save to keychain:**
 
 ```bash
-security delete-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" >/dev/null 2>&1
-security add-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" -w "$MCP_TOKEN" >/dev/null 2>&1 && echo "TOKEN_SAVED" || echo "TOKEN_SAVE_FAILED"
+"$HOME/.claude/lib/credential-store.sh" delete \1 >/dev/null 2>&1
+"$HOME/.claude/lib/credential-store.sh" set \1 \"\2\" >/dev/null 2>&1 && echo "TOKEN_SAVED" || echo "TOKEN_SAVE_FAILED"
 ```
 
 4. **Verify** the saved token works:
 
 ```bash
-TOKEN=$(security find-generic-password -a "$USER" -s "FIGMA_MCP_TOKEN" -w 2>/dev/null) && curl -s -o /dev/null -w "%{http_code}" -X POST "https://mcp.figma.com/mcp" -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -H "Authorization: Bearer $TOKEN" -d '{"jsonrpc":"2.0","method":"initialize","params":{"capabilities":{},"clientInfo":{"name":"setup-check","version":"1.0.0"},"protocolVersion":"2025-03-26"},"id":1}'
+TOKEN=$("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null) && curl -s -o /dev/null -w "%{http_code}" -X POST "https://mcp.figma.com/mcp" -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -H "Authorization: Bearer $TOKEN" -d '{"jsonrpc":"2.0","method":"initialize","params":{"capabilities":{},"clientInfo":{"name":"setup-check","version":"1.0.0"},"protocolVersion":"2025-03-26"},"id":1}'
 ```
 
 - `200` → print "Token saved and verified."

package/pipeline/skills/figma-common/figma-validate/SKILL.md

@@ -557,7 +557,7 @@ These are logged but do NOT affect the VALID/INVALID verdict:
 | Registry file not found | Show command: `cd ${COMMON_PATH} && swift build --product FigmaRegistryUtility && .build/debug/FigmaRegistryUtility update` |
 | FigmaRegistryUtility not built | Show: `cd ${COMMON_PATH} && swift build --product FigmaRegistryUtility` |
 | Invalid URL format | Ask user for correct URL via AskUserQuestion |
-| Figma token not found | Show: `security add-generic-password -s "FIGMA_ACCESS_TOKEN" -w "<YOUR_TOKEN>"` |
+| Figma token not found | Show: `"$HOME/.claude/lib/credential-store.sh" set FIGMA_ACCESS_TOKEN "<YOUR_TOKEN>"` |
 
 ---
 

package/pipeline/skills/figma-ios/figma-to-component/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: figma
+name: figma-to-component
 description: Figma-to-SwiftUI component implementation workflow. Takes a Figma URL and produces a production-ready SwiftUI component through 8 phases — data gathering, analysis, code generation, testing, Code Connect, and documentation.
 user-invocable: true
 argument-hint: <figma-url> | phase-<N> | status