@mmerterden/multi-agent-pipeline 8.6.0 → 8.6.2

package/pipeline/commands/multi-agent/refs/phases/phase-3-dev.md

@@ -10,47 +10,9 @@
 
 Phase 3 consumes the Phase 2 output object conforming to `pipeline/schemas/planning-output.schema.json` — the task graph (`tasks[]` with `id`, `subject`, `targetFiles`, `complexity`, `blockedBy`) plus the architecture review notes. Tasks execute in dependency order; the schema's `blockedBy` field drives the ready-task picker. In `--dev` mode (no Phase 2), Sonnet/Opus generates the equivalent task list inline before entering the loop below.
 
-**Plan Todo iteration (opt-in)**: when `prefs.global.planTodos.enabled` is true and Phase 2 Step 4.5 emitted a `plan.todos[]` (conforming to `pipeline/schemas/plan-todos.schema.json`), Phase 3 iterates with the helper instead of walking `tasks[]` directly:
+**Plan Todo iteration (opt-in)**: gated by `prefs.global.planTodos.enabled` (default: `false`). When enabled and Phase 2 Step 4.5 emitted a `plan.todos[]`, Phase 3 iterates via `pipeline/lib/plan-todos.sh next/start/complete/fail` instead of walking `tasks[]` directly. When disabled, the loop walks `tasks[]` from `planning-output` — TDD contract is unchanged. Full helper loop + state semantics: `refs/features/plan-todos.md`.
 
-```bash
-while next=$(bash "$HOME/.claude/lib/plan-todos.sh" next "$TASK_ID"); [ -n "$next" ]; do
-  id=$(printf '%s' "$next" | cut -f1)
-  task=$(printf '%s' "$next" | cut -f2)
-  bash "$HOME/.claude/lib/plan-todos.sh" start "$TASK_ID" "$id"
-  # ... TDD cycle for "$task" ...
-  if build_passed; then
-    bash "$HOME/.claude/lib/plan-todos.sh" complete "$TASK_ID" "$id" "${COMMIT_HASH} · tests:${TEST_COUNT}"
-  else
-    bash "$HOME/.claude/lib/plan-todos.sh" fail "$TASK_ID" "$id" "build failed after 3 retries"
-    break
-  fi
-done
-```
-
-When disabled, the loop still walks `tasks[]` from `planning-output` — `plan-todos.sh` adds visibility (status, notes, deps-respecting `next`) but the underlying TDD contract is unchanged.
-
-**Shadow-Git checkpoints (opt-in)**: when `prefs.global.shadowGit.enabled` is true, the orchestrator snapshots the worktree via `pipeline/lib/shadow-git.sh` so sub-phase rollback is possible without polluting the project's real `.git` history. Pattern source: Cline checkpoints (<https://docs.cline.bot/features/checkpoints>).
-
-```bash
-# Phase 0 (one-time per task): initialize shadow repo + baseline snapshot.
-bash "$HOME/.claude/lib/shadow-git.sh" init "$TASK_ID" "$WORKTREE"
-
-# Per-step (mode: per-todo-step — default): snapshot AFTER each plan-todos
-# step completes successfully, so restore lands on a known-good state.
-bash "$HOME/.claude/lib/plan-todos.sh" complete "$TASK_ID" "$id" "$notes"
-bash "$HOME/.claude/lib/shadow-git.sh" snapshot "$TASK_ID" "$WORKTREE" "step $id: $task"
-
-# Per-mutation (mode: per-tool-call): the orchestrator hooks into every Edit/
-# Write/MultiEdit/Bash-mutation tool call. Higher fidelity, ~50ms × tool-call
-# overhead — recommended only for security-critical paths or experimental
-# refactors where the user values fine-grained rollback over speed.
-
-# Rollback on demand (interactive helper):
-bash "$HOME/.claude/lib/shadow-git.sh" list "$TASK_ID"
-bash "$HOME/.claude/lib/shadow-git.sh" restore "$TASK_ID" "$WORKTREE" <sha> --files
-```
-
-Shadow repo location: `~/.claude/state/shadow-git/<task-id>/.git/`. Storage cap: `prefs.shadowGit.pruneAfterDays` (default 14). `/multi-agent:purge` honors this prune; manual cleanup via `shadow-git.sh prune <task-id>`.
+**Shadow-Git checkpoints (opt-in)**: gated by `prefs.global.shadowGit.enabled` (default: `false`). When enabled, the orchestrator snapshots the worktree via `pipeline/lib/shadow-git.sh` so sub-phase rollback is possible without touching the project's real `.git` history. Cline-style. Lifecycle: `shadow-git.sh init` (Phase 0 baseline), `shadow-git.sh snapshot` (per step after `plan-todos complete`), `shadow-git.sh restore <sha> --files` (rollback). Modes: `per-todo-step` (default) or `per-tool-call`. Full wiring + storage cap: `refs/features/shadow-git.md`.
 
 #### Component tasks — delegated dispatch (taskType === "component")
 
@@ -239,40 +201,7 @@ release_build_lock() { rm -rf "$BUILD_LOCK"; }
 
 #### Step 3.5 — Dev Critic (Evaluator-Optimizer, opt-in)
 
-**Pattern**: Anthropic's evaluator-optimizer from "Building Effective Agents" (Dec 2024). Generator (Phase 3 Dev) and critic (`agents/dev-critic.md`) loop on deterministic criteria already written in `rules/*.md` before any Phase 4 reviewer call.
-
-**Gated by `prefs.global.devCritic.enabled`** (default: `false`). When enabled, after the generator's last edit and BEFORE Phase 4:
-
-1. Dispatch `dev-critic` sub-agent (Sonnet by default, tools: `Read, Grep, Glob, Bash`).
-2. Critic runs 4 mandatory deterministic gates (build / lint / test / secrets) — failure of any → `pass: false` with `blocking` finding.
-3. If gates green, critic walks the platform checklist (iOS 13-item / Android Kotlin / Backend generic — selected by Phase 1 `detectedStack`).
-4. Returns schema-validated JSON (`pipeline/schemas/dev-critic-output.schema.json`): `{pass, iteration, gates, findings[], escalate}`.
-
-**Loop cap (STRICT)**: max **2** iterations.
-
-| Round | Behavior |
-|---|---|
-| 1 | Full critic pass — all gates + full checklist |
-| 2 | Re-check only round-1 failures. No new findings allowed (scope creep prevention) |
-| 3+ | NOT ALLOWED. Critic returns `escalate: true`; orchestrator pauses (interactive) or proceeds to Phase 4 with logged failure (autopilot) |
-
-**Action by severity:**
-
-- `blocking` → generator MUST fix; another Dev iteration before re-critic
-- `important` → generator SHOULD fix; if skipped, pass through to Phase 4 (legitimate reviewer ground)
-- `suggestion` → generator's judgement; never blocks round 2
-
-**Telemetry**: each critic call emits `dev_critic.call` with `iteration`, `pass`, `gates_failed`, `blocking`, `important`, `duration_ms`, `tokens_in/out`. Phase 7 cost rollup lists these as `phase 3.5` line items so the net saving (Phase 4 reviewer/triage calls avoided) is measurable.
-
-**Off by default reason**: introduces ~1× Sonnet call per Dev iteration. On simple bug fixes the cost outweighs the benefit (Phase 4 would have caught the same thing for similar cost). Recommended on:
-
-- Feature work (≥200 LOC diff)
-- Security-touching paths (auth, keychain, network)
-- Multi-file refactors where rule violations compound
-
-**Reference**: see `pipeline/agents/dev-critic.md` for the full agent specification (mandatory gates, checklist enumeration, output schema, severity semantics).
-
-**Why this fits orchestrator-workers + evaluator-optimizer hybrid**: Phase 4 is parallelization-with-voting — good for *adversarial* perspectives (security, architecture). Phase 3.5 is evaluator-optimizer — good for *deterministic* criteria (build, tests, checklists). Sending failing builds into Phase 4 wastes 2–3 reviewer calls + Opus triage; Phase 3.5 absorbs that cost at one Sonnet call.
+Gated by `prefs.global.devCritic.enabled` (default: `false`). When enabled, after the generator's last edit and BEFORE Phase 4: dispatch `dev-critic` sub-agent (Sonnet), run 4 deterministic gates (build / lint / test / secrets), then platform checklist. STRICT loop cap — **max 2 iterations** (round 2 re-checks round-1 failures only); round 3+ returns `escalate: true`. Severity routing: `blocking` → generator must fix; `important` → SHOULD fix or pass through to Phase 4; `suggestion` → generator's judgement. Full agent contract, schema, telemetry, when-to-enable: `refs/features/dev-critic.md` + `pipeline/agents/dev-critic.md`.
 
 ---
 
@@ -302,7 +231,7 @@ When `agent-state.json.onlyDevelop === true`, Phase 3 runs self-contained with *
 
 ---
 
-#### Multi-Repo Mode
+#### v2.1.0+ Multi-Repo Mode
 
 Active when `state.projects[].length > 1` (set by Phase 0 multi-select). Single-repo flow above is preserved verbatim — this section adds the deltas.
 

package/pipeline/commands/multi-agent/refs/phases/phase-6-commit.md

@@ -216,7 +216,7 @@ Before creating PR, ask: "DRAFT or READY? [1/2], default 1" — DRAFT blocks mer
 
 ---
 
-#### Multi-Repo Mode
+#### v2.1.0+ Multi-Repo Mode
 
 Active when `state.projects[].length > 1`. The single-repo flow above is preserved verbatim — multi-repo is an extension, not a replacement.
 

package/pipeline/commands/multi-agent/setup.md

@@ -259,19 +259,23 @@ pbcopy < /dev/null
 
 (The shell driver auto-delegates to `~/.claude/scripts/keychain.py` on macOS / Linux, which writes both `-l` (label) and `-s` (service) attributes so callers using either convention find the same entry.)
 
-For JSON file (Firebase):
+For JSON file (Firebase) — same clipboard flow, JSON content never lands in argv or shell history:
 ```
-  Download the JSON file, then press Enter.
-  (File will be base64-encoded and saved to Keychain automatically)
+  Open the Service Account JSON, copy its FULL contents to your clipboard,
+  then press Enter.
+  (Contents will be base64-encoded and saved to Keychain automatically)
 
-  Path to JSON file [~/Downloads/firebase-sa.json]: ___
+  Press Enter when ready...
 ```
 
 Pipeline runs silently:
 ```bash
-~/.claude/lib/credential-store.sh set "<KEY_NAME>" "$(base64 < <PATH>)"
+pbpaste | base64 | ~/.claude/lib/credential-store.sh set "<KEY_NAME>" "$(cat)"
+pbcopy < /dev/null   # clear clipboard
 ```
 
+Linux substitutes: `xclip -selection clipboard -o` or `wl-paste` for `pbpaste`; matching clear command for `pbcopy < /dev/null`. The shell driver detects platform and routes accordingly (see `~/.claude/lib/credential-store.sh`).
+
 For GitHub (special case):
 ```
   ! gh auth login
@@ -699,7 +703,11 @@ pbcopy < /dev/null  # clear clipboard
 # Plain text (direct value)
 ~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" "<VALUE>"
 
-# JSON file (base64 encode)
+# JSON file from clipboard (preferred — no file path leaks into history)
+pbpaste | base64 | ~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" "$(cat)"
+pbcopy < /dev/null
+
+# JSON file from disk (fallback when clipboard backend unavailable)
 ~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" "$(base64 < /path/to/file.json)"
 
 # Read

package/pipeline/commands/multi-agent/sync.md

@@ -61,7 +61,9 @@ Adim 0: FIGMA_SYNC  SKIP (deprecated — feedback_figma_source_deprecated)
 Adim 1: PLATFORM    Detect macOS / Linux / Windows (Git Bash / WSL); export PLATFORM env
 Adim 1.5: DETECT    Timestamp karsilastir, stale hedefleri bul
 Adim 2: COPILOT     Claude Code -> Copilot CLI (instructions + 26 sub-command skills)
-Adim 2b: ADAPTERS   (opt-in --adapters) Cursor / Windsurf / Cline per-project rule files refresh
+Adim 2b: ADAPTERS   Cursor / Windsurf / Cline per-project rule files refresh
+                    — `--adapters` flag tüm projectsTouched[] hedeflerini çalıştırır
+                    — bayrak yoksa SADECE cwd pipeline repo ise auto-fire (maintainer flow)
 Adim 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Adim 4: WEBSITE     Versiyon + faz/model sayilari -> {website-host} (i18n + projects.ts)
 Adim 5: REMOTE      Pipeline referanslari -> remote-control README
@@ -138,33 +140,32 @@ Cursor, Windsurf, ve Cline'in Claude Code (`~/.claude/`) veya Copilot CLI (`~/.c
 
 ### Akis
 
-1. `prefs.global.projectsTouched[]` listesini oku (LRU, max 20 entry). Her entry `{ path, adapters: [...] }` formatinda: hangi adapterlar bu projede kurulu olduguna dair iz.
+Adapter sync orchestration `pipeline/scripts/sync-adapters.mjs` üzerinden gider — bu betik orphan adapter modüllerini (`pipeline/adapters/cursor.mjs`, `copilot-chat.mjs`) discovery + dispatch ile bağlar.
 
-2. Her proje icin paralel:
+1. `prefs.global.projectsTouched[]` listesini oku (LRU, max 20 entry). Her entry `{ path, adapters: [...] }` formatinda: hangi adapter'lar bu projede kurulu olduguna dair iz.
+
+2. Tek komut, tüm projeler:
+   ```bash
+   node pipeline/scripts/sync-adapters.mjs --all
+   ```
+
+   Script her hedef için:
+   - `.cursor/` veya `.cursorrules` marker'ı varsa **cursor** adapter'ını çalıştırır → `pipeline/adapters/cursor.mjs install()` 174+ `.cursor/rules/multi-agent-*.mdc` dosyası + bir legacy `.cursorrules` digest emit eder.
+   - `.copilot/` veya `.github/copilot-instructions.md` marker'ı varsa **copilot-chat** adapter'ını çalıştırır.
+   - Pipeline repo'nun kendisi (`pipeline/` + `.git/` varsa) hep cursor sync'i alır — maintainer canonical cursor consumer'ı.
+   - Marker yoksa atlar (`[skip]`).
+
+3. Dry-run görünümü:
+   ```bash
+   node pipeline/scripts/sync-adapters.mjs --doctor
+   ```
+
+4. Tek proje refresh (bu repo veya başka bir target):
    ```bash
-   for entry in $(jq -c '.global.projectsTouched[]' "$PREFS"); do
-     PROJ=$(jq -r '.path' <<< "$entry")
-     [ ! -d "$PROJ" ] && continue   # silinmis proje — entry'yi sonra LRU prune eder
-
-     for adapter in $(jq -r '.adapters[]' <<< "$entry"); do
-       template="$HOME/.claude/commands/multi-agent/adapters/${adapter}.template"
-       case "$adapter" in
-         cursor)   target="$PROJ/.cursor/rules/multi-agent.mdc" ;;
-         windsurf) target="$PROJ/.windsurfrules" ;;
-         cline)    target="$PROJ/.clinerules" ;;
-       esac
-       [ ! -f "$target" ] && continue   # setup --<adapter> bu projede kosturulmamis
-
-       if ! diff -q "$template" "$target" > /dev/null 2>&1; then
-         cp "$template" "$target"
-         echo "  adapter sync: $adapter -> $(basename "$PROJ") (drift refreshed)"
-         (cd "$PROJ" && git add "$target")
-       fi
-     done
-   done
+   node pipeline/scripts/sync-adapters.mjs --target=/path/to/repo --platform=ios
    ```
 
-3. Her proje icin commit ayri olarak yapilir (cross-project commit yok):
+5. Her proje icin commit ayri olarak yapilir (cross-project commit yok):
    ```bash
    cd "$PROJ"
    if ! git diff --cached --quiet; then
@@ -311,7 +312,7 @@ refactor, resume, review, scan, search, setup, stack, status, sync, test, update
 | Islem | Token Kaynagi |
 |-------|---------------|
 | `gh` CLI (personal) | `{owner}` gh auth (Keychain) |
-| `gh` CLI (work) | `M-ERDEN3_tkgithub` gh auth (Keychain) |
+| `gh` CLI (work) | `{user}_<work-label>` gh auth (Keychain) — see `prefs.global.accounts[]` |
 | npm publish | `NODE_AUTH_TOKEN` — CI'da `GITHUB_TOKEN`, local'de Keychain PAT |
 
 ```bash

package/pipeline/schemas/prefs.schema.json

@@ -977,7 +977,7 @@
             "properties": {
               "id": {
                 "type": "string",
-                "description": "Short id from account-resolver, e.g. m-erden3"
+                "description": "Short id from account-resolver, e.g. my-account"
               },
               "prefix": {
                 "type": "string",
@@ -997,7 +997,7 @@
         },
         "accounts": {
           "type": "array",
-          "description": "v7.4.0+. Per-account overrides \u2014 host, label, default platform. Resolved by account-resolver.sh by matching `id` (e.g. m-erden3). When unset, hosts fall back to global.hosts.{jira,bitbucket}.",
+          "description": "v7.4.0+. Per-account overrides \u2014 host, label, default platform. Resolved by account-resolver.sh by matching `id` (e.g. my-account). When unset, hosts fall back to global.hosts.{jira,bitbucket}.",
           "items": {
             "type": "object",
             "additionalProperties": false,

package/pipeline/scripts/fixtures/install-layout.tsv

@@ -1,16 +1,16 @@
 .claude/CLAUDE.md	1
-.claude/agents	6
-.claude/commands	70
-.claude/lib	9
+.claude/agents	8
+.claude/commands	78
+.claude/lib	18
 .claude/multi-agent-preferences.json	1
 .claude/rules	12
-.claude/schemas	17
-.claude/scripts	127
+.claude/schemas	20
+.claude/scripts	143
 .claude/settings.json	1
-.claude/skills	412
-.copilot/agents	6
+.claude/skills	414
+.copilot/agents	8
 .copilot/copilot-instructions.md	1
-.copilot/lib	9
-.copilot/schemas	17
-.copilot/scripts	127
-.copilot/skills	442
+.copilot/lib	18
+.copilot/schemas	20
+.copilot/scripts	143
+.copilot/skills	444

package/pipeline/scripts/smoke-issue-comment-template.sh

@@ -35,7 +35,7 @@ declare -a REQUIRED_ANCHORS=(
   "Pull Requests / Branches"
   "Acceptance Criteria"
   "Build & Test"
-  "Sonraki adımlar"
+  "Sonraki Adımlar"
   "Ref: #"
 )
 

package/pipeline/scripts/smoke-personal-data.sh

@@ -40,8 +40,11 @@ FORBIDDEN=(
   'mmerterden\.dev'
   'mmerterden/remote-control'
   'mmerterden/mmerterden\.dev'
-  # Author's macOS username in keychain lookups
-  'M_ERDEN3_'
+  # Author's macOS username — both forms: M_ERDEN3 (underscore) appears in
+  # Keychain labels, M-ERDEN3 (dash) appears in gh auth usernames + paths
+  # encoded by the Claude projects convention (/ → -).
+  '\bM_ERDEN3\b'
+  '\bM-ERDEN3\b'
 )
 
 PASS=0
@@ -56,7 +59,6 @@ for pattern in "${FORBIDDEN[@]}"; do
     --exclude="smoke-personal-data.sh" \
     --exclude="smoke-install-leak-gate.sh" \
     --exclude="figma-placeholder-map.json" \
-    --exclude=".last-figma-sync-plan.json" \
     --exclude="REVIEW_CHECKLIST.md" \
     "$pattern" "$PIPELINE_DIR" 2>/dev/null || true)
   if [ -n "$matches" ]; then

package/pipeline/scripts/smoke-plan-todos.sh

@@ -95,8 +95,11 @@ else
 fi
 
 # 5-8. Lifecycle test against a temp state dir
+# Use a temp directory derived from $HOME so the path stays cross-user.
 TEST_TASK="SMOKE-PT-$$"
-TEST_DIR="$HOME/.claude/projects/-Users-M-ERDEN3-test-plan-todos-smoke/state/$TEST_TASK"
+TEST_PROJECT_KEY=$(printf '%s' "$HOME/test-plan-todos-smoke" | tr '/' '-')
+TEST_PROJECT_ROOT="$HOME/.claude/projects/$TEST_PROJECT_KEY"
+TEST_DIR="$TEST_PROJECT_ROOT/state/$TEST_TASK"
 mkdir -p "$TEST_DIR"
 echo '{"task":{"id":"'"$TEST_TASK"'"}}' > "$TEST_DIR/agent-state.json"
 PLAN='{"title":"Smoke","todos":[
@@ -157,7 +160,7 @@ else
 fi
 
 # Cleanup the test state
-rm -rf "$HOME/.claude/projects/-Users-M-ERDEN3-test-plan-todos-smoke"
+rm -rf "$TEST_PROJECT_ROOT"
 
 # 9. Prefs schema toggle
 if jq -e '.properties.global.properties.planTodos.properties.enabled

package/pipeline/scripts/smoke-sync-adapters.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# smoke-sync-adapters.sh
+#
+# Verifies the per-project adapter sync runner:
+#   1. pipeline/scripts/sync-adapters.mjs exists and is executable
+#   2. node sync-adapters.mjs --help exits 0
+#   3. --doctor on empty prefs reports a clean no-op
+#   4. --target=<empty-dir> reports [skip] (no adapter markers)
+#   5. --target=. on the pipeline repo itself triggers cursor adapter
+#      (pipeline + .git makes cwd the canonical cursor consumer)
+#   6. After running on pipeline repo, .cursor/rules/ exists and has
+#      >100 .mdc files
+#   7. .cursorrules legacy digest exists
+#   8. Unknown arg exits non-zero
+#   9. sync.md references sync-adapters.mjs (so the docs and the runtime agree)
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+RUNNER="$ROOT/pipeline/scripts/sync-adapters.mjs"
+SYNC_MD="$ROOT/pipeline/commands/multi-agent/sync.md"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-sync-adapters: per-project adapter sync runner contract\n'
+
+# 1. Runner exists + executable
+if [ ! -f "$RUNNER" ]; then
+  record_fail "pipeline/scripts/sync-adapters.mjs missing"
+elif [ ! -x "$RUNNER" ]; then
+  record_fail "sync-adapters.mjs not executable"
+else
+  record_pass "sync-adapters.mjs exists and is executable"
+fi
+
+# 2. --help exits 0
+if node "$RUNNER" --help >/dev/null 2>&1; then
+  record_pass "--help exits 0"
+else
+  record_fail "--help should exit 0"
+fi
+
+# 3. --doctor on empty env runs without error
+if node "$RUNNER" --doctor 2>&1 | grep -qE "projectsTouched is empty|sync-adapters: 0 ok"; then
+  record_pass "--doctor reports clean state when projectsTouched is empty"
+else
+  record_pass "--doctor exits cleanly"  # doctor on a populated env is also fine
+fi
+
+# 4. --target=<empty-dir>
+EMPTY=$(mktemp -d)
+out=$(node "$RUNNER" --target="$EMPTY" 2>&1)
+if echo "$out" | grep -q "\[skip\]"; then
+  record_pass "empty target reports [skip]"
+else
+  record_fail "empty target should report [skip] (got: $out)"
+fi
+rm -rf "$EMPTY"
+
+# 5. Pipeline repo cursor sync — must produce output mentioning cursor
+out=$(node "$RUNNER" --target="$ROOT" 2>&1)
+if echo "$out" | grep -qE "\[cursor\]"; then
+  record_pass "pipeline repo target triggers cursor adapter"
+else
+  record_fail "pipeline repo target did NOT trigger cursor adapter (got: $out)"
+fi
+
+# 6. .cursor/rules/ exists with >100 mdc
+if [ -d "$ROOT/.cursor/rules" ]; then
+  count=$(ls "$ROOT/.cursor/rules"/*.mdc 2>/dev/null | wc -l | tr -d ' ')
+  if [ "$count" -gt 100 ]; then
+    record_pass ".cursor/rules contains $count .mdc files (>100 expected)"
+  else
+    record_fail ".cursor/rules has only $count files (expected >100)"
+  fi
+else
+  record_fail ".cursor/rules dir missing"
+fi
+
+# 7. Legacy .cursorrules
+if [ -f "$ROOT/.cursorrules" ]; then
+  record_pass ".cursorrules legacy digest exists"
+else
+  record_fail ".cursorrules legacy digest missing"
+fi
+
+# 8. Unknown arg
+if node "$RUNNER" --garbage >/dev/null 2>&1; then
+  record_fail "unknown arg should exit non-zero"
+else
+  record_pass "unknown arg rejected"
+fi
+
+# 9. sync.md references the runner
+if grep -qF "sync-adapters.mjs" "$SYNC_MD"; then
+  record_pass "sync.md references sync-adapters.mjs"
+else
+  record_fail "sync.md missing sync-adapters.mjs reference"
+fi
+
+printf '\n══ sync-adapters smoke: %d passed, %d failed ══\n' "$pass" "$fail"
+if [ "$fail" -gt 0 ]; then
+  printf '\nFailures:\n'
+  for msg in "${failures[@]}"; do printf '  - %s\n' "$msg"; done
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-sync-delegation.sh

@@ -62,7 +62,7 @@ echo ""
 echo "→ 6. sync.md puts FIGMA_SYNC BEFORE Adim 1 (DETECT)"
 # Regex: FIGMA_SYNC line must appear before DETECT line
 FIGMA_LINE=$(grep -n "FIGMA_SYNC" "$SYNC_DOC" | head -1 | cut -d: -f1)
-DETECT_LINE=$(grep -n "Adim 1: DETECT" "$SYNC_DOC" | head -1 | cut -d: -f1)
+DETECT_LINE=$(grep -nE "Adim 1(\.[0-9]+)?: DETECT" "$SYNC_DOC" | head -1 | cut -d: -f1)
 if [ -n "$FIGMA_LINE" ] && [ -n "$DETECT_LINE" ] && [ "$FIGMA_LINE" -lt "$DETECT_LINE" ]; then
   pass "FIGMA_SYNC precedes DETECT in step order"
 else

package/pipeline/scripts/smoke-url-enrichment.sh

@@ -41,7 +41,7 @@ check "Phase 2 inject mention for fortify"       "grep -Fq 'Known Security Findi
 
 echo
 echo "→ 3. Progress contract line documented"
-check "URL context log line shape"               "grep -Fq 'URL context: crashlytics=' '$PHASE0'"
+check "URL context log line shape"               "grep -Fq 'URL deep fetch: crashlytics=' '$PHASE0'"
 
 echo
 echo "→ 4. prefs.schema.json has hosts.fortify"

package/pipeline/scripts/sync-adapters.mjs

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+/**
+ * sync-adapters.mjs — wire the orphaned per-project adapter installers
+ * (cursor / copilot-chat / future windsurf / cline) into the sync flow.
+ *
+ * Three call shapes:
+ *
+ *   1. Single target (this repo, or any project root):
+ *      node sync-adapters.mjs --target=. [--platform=ios|android|all]
+ *
+ *   2. All projects registered in prefs.global.projectsTouched[]:
+ *      node sync-adapters.mjs --all
+ *
+ *   3. Doctor — show what would happen, no writes:
+ *      node sync-adapters.mjs --doctor
+ *
+ * Discovery contract:
+ *   - --target=. is the cwd; --target=<path> overrides.
+ *   - --all reads prefs.global.projectsTouched[] (LRU). Skips entries
+ *     whose path no longer exists.
+ *   - For each target, the script inspects the per-project marker files
+ *     (.cursor/, .cursorrules, .copilot/, .windsurfrules, .clinerules)
+ *     and only runs the matching adapter if the marker is present —
+ *     a project that never set up Cursor won't get .cursor/rules/ filled
+ *     in by sync. This mirrors Step 2b's "setup-then-sync" contract.
+ *
+ * Source layout: this script is the bridge between sync.md Step 2b
+ * (which used to reference a non-existent template path) and the
+ * adapters under pipeline/adapters/{cursor,copilot-chat}.mjs.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PIPELINE_ROOT = resolve(__dirname, "..");
+
+// --- arg parser ------------------------------------------------------------
+
+const argv = process.argv.slice(2);
+const args = { target: null, all: false, doctor: false, platform: "all" };
+for (const a of argv) {
+  if (a === "--all") args.all = true;
+  else if (a === "--doctor") args.doctor = true;
+  else if (a.startsWith("--target=")) args.target = a.slice("--target=".length);
+  else if (a.startsWith("--platform=")) args.platform = a.slice("--platform=".length);
+  else if (a === "--help" || a === "-h") {
+    console.log(
+      "usage: sync-adapters.mjs --target=<path>   single project\n" +
+        "       sync-adapters.mjs --all            every project in projectsTouched\n" +
+        "       sync-adapters.mjs --doctor         dry-run summary",
+    );
+    process.exit(0);
+  } else {
+    console.error(`sync-adapters: unknown arg ${a}`);
+    process.exit(2);
+  }
+}
+
+if (!args.target && !args.all && !args.doctor) {
+  // Default to current dir — most common case (sync running from the
+  // pipeline repo itself).
+  args.target = ".";
+}
+
+// --- helpers ---------------------------------------------------------------
+
+function loadPrefs() {
+  const p = join(process.env.HOME, ".claude", "multi-agent-preferences.json");
+  if (!existsSync(p)) return { global: { projectsTouched: [] } };
+  try {
+    return JSON.parse(readFileSync(p, "utf-8"));
+  } catch {
+    return { global: { projectsTouched: [] } };
+  }
+}
+
+function detectAdapters(target) {
+  const out = [];
+  if (existsSync(join(target, ".cursor")) || existsSync(join(target, ".cursorrules"))) out.push("cursor");
+  if (existsSync(join(target, ".copilot")) || existsSync(join(target, ".github/copilot-instructions.md"))) out.push("copilot-chat");
+  return out;
+}
+
+async function runAdapter(name, target) {
+  const adapterPath = join(PIPELINE_ROOT, "adapters", `${name}.mjs`);
+  if (!existsSync(adapterPath)) {
+    console.error(`sync-adapters: adapter not found at ${adapterPath}`);
+    return false;
+  }
+  const mod = await import(adapterPath);
+  if (typeof mod.install !== "function") {
+    console.error(`sync-adapters: adapter ${name} has no install() export`);
+    return false;
+  }
+  mod.install({ pipelineSrc: PIPELINE_ROOT, target, platformFilter: args.platform });
+  return true;
+}
+
+async function syncTarget(target) {
+  const absTarget = resolve(target);
+  if (!existsSync(absTarget)) {
+    console.error(`sync-adapters: target ${absTarget} does not exist`);
+    return false;
+  }
+  // Always-on first-time install signal: if the target is the pipeline
+  // repo itself (has pipeline/ + .git/), we ALWAYS install Cursor since
+  // the maintainer is the canonical cursor consumer.
+  const isPipelineRepo =
+    existsSync(join(absTarget, "pipeline")) && existsSync(join(absTarget, ".git"));
+  let adapters = detectAdapters(absTarget);
+  if (isPipelineRepo && !adapters.includes("cursor")) adapters.push("cursor");
+  if (adapters.length === 0) {
+    console.log(`  [skip] ${absTarget} — no adapter markers (.cursor/.cursorrules/.copilot)`);
+    return true;
+  }
+  console.log(`→ ${absTarget}`);
+  for (const a of adapters) {
+    if (args.doctor) {
+      console.log(`  [doctor] would run ${a} adapter`);
+    } else {
+      try {
+        await runAdapter(a, absTarget);
+      } catch (e) {
+        console.error(`  [error] ${a}: ${e.message}`);
+      }
+    }
+  }
+  return true;
+}
+
+// --- main ------------------------------------------------------------------
+
+const targets = [];
+if (args.all || args.doctor) {
+  const prefs = loadPrefs();
+  for (const entry of prefs.global?.projectsTouched ?? []) {
+    if (entry && entry.path) targets.push(entry.path);
+  }
+  if (targets.length === 0) {
+    console.log(
+      "sync-adapters: prefs.global.projectsTouched is empty — run multi-agent:setup in a project first",
+    );
+  }
+}
+if (args.target) targets.push(args.target);
+
+let ok = 0;
+let failed = 0;
+for (const t of targets) {
+  if (await syncTarget(t)) ok++;
+  else failed++;
+}
+console.log(`sync-adapters: ${ok} ok · ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/pipeline/skills/figma-common/figma-component-confluence-sync/SKILL.md

@@ -35,7 +35,7 @@ STATUS_SCRIPT   = .instructions/figma/figma-to-swiftui/scripts/confluence-compon
 
 Confluence token from macOS Keychain:
 ```bash
-CONFLUENCE_TOKEN=$(security find-generic-password -a "$USER" -s "CONFLUENCE_TOKEN" -w 2>/dev/null)
+CONFLUENCE_TOKEN=$("$HOME/.claude/lib/credential-store.sh" get \1 2>/dev/null)
 ```
 
 ---