@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/lib/shadow-git.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+#
+# shadow-git.sh — per-tool-call checkpoints in a separate git repo.
+#
+# Pattern source:
+#   - Cline checkpoints — https://docs.cline.bot/features/checkpoints
+#       "Cline maintains a shadow Git repository separate from your project's
+#        actual Git history… After each tool use, Cline commits the current
+#        state of your files to this shadow repo."
+#
+# Why a SHADOW repo (not the real .git): the real git tree holds the user's
+# semantic commits — clean history, intentional messages. Shadow snapshots
+# fire per Edit/Write/MultiEdit/Bash-mutation and would pollute that tree.
+# Shadow repos live under `.shadow-git/<task-id>/.git` and never touch the
+# project's `.git/refs` or `.git/index`.
+#
+# Subcommands:
+#   init       <task-id> <project-root>
+#              Initialize a shadow repo for the task, snapshot the current
+#              state as the baseline.
+#   snapshot   <task-id> <project-root> "<step-label>"
+#              Stage everything (respects .gitignore) + commit with the
+#              step label. Idempotent — empty diffs produce no commit.
+#   list       <task-id>
+#              Show all snapshots: <sha>  <iso-date>  <label>
+#   restore    <task-id> <project-root> <sha> [--files|--state|--both]
+#              Restore to a prior snapshot. --files reverts the worktree;
+#              --state would revert agent-state (TODO, out of scope for
+#              this commit); --both does both.
+#   prune      <task-id> [--older-than-days N]
+#              Remove the shadow repo (or just snapshots older than N days).
+#   doctor
+#              Diagnostic dump: list known shadow repos + size on disk.
+#
+# Storage:
+#   ~/.claude/state/shadow-git/<task-id>/.git/  (the bare repo's working dir
+#                                                is the project root, but
+#                                                we use --work-tree to keep
+#                                                .git out of the project tree)
+#
+# Exit codes:
+#   0 success
+#   1 task-id / project-root missing
+#   2 unsupported subcommand / bad args
+#   3 git operation failed
+
+set -euo pipefail
+
+CMD="${1:-}"
+shift || true
+
+SHADOW_ROOT="$HOME/.claude/state/shadow-git"
+mkdir -p "$SHADOW_ROOT"
+
+err() { printf 'shadow-git: %s\n' "$1" >&2; }
+
+usage() {
+  sed -n '2,40p' "$0" >&2
+  exit 2
+}
+
+[ -z "$CMD" ] && usage
+
+shadow_dir() { printf '%s/%s' "$SHADOW_ROOT" "$1"; }
+
+# Wrap git so .git lives in $SHADOW_DIR but worktree is the project root.
+sg() {
+  local sd="$1" wt="$2"; shift 2
+  git --git-dir="$sd/.git" --work-tree="$wt" "$@"
+}
+
+iso_now() { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
+
+# --- Subcommands ------------------------------------------------------------
+
+do_init() {
+  local task_id="${1:-}" project_root="${2:-}"
+  [ -z "$task_id" ] || [ -z "$project_root" ] && { err "usage: init <task-id> <project-root>"; exit 1; }
+  [ ! -d "$project_root" ] && { err "project root not a directory: $project_root"; exit 1; }
+  local sd; sd=$(shadow_dir "$task_id")
+  if [ -d "$sd/.git" ]; then
+    err "shadow already initialized for $task_id (use 'prune' to reset)"
+    return 0
+  fi
+  mkdir -p "$sd"
+  # Bare-ish: .git inside $sd, worktree is the project root.
+  git init --quiet "$sd" >/dev/null
+  # Mirror the project's .gitignore so we don't snapshot node_modules / Pods.
+  if [ -f "$project_root/.gitignore" ]; then
+    cp "$project_root/.gitignore" "$sd/.gitignore"
+  fi
+  # Also exclude these from snapshots even if .gitignore omits them.
+  cat >> "$sd/.gitignore" <<EOF
+node_modules/
+Pods/
+.build/
+DerivedData/
+.next/
+.gradle/
+__pycache__/
+.venv/
+*.log
+EOF
+  # Initial author setup — keep separate from user's global git identity to
+  # signal "this is the shadow", not real commits.
+  sg "$sd" "$project_root" config user.name "shadow-git"
+  sg "$sd" "$project_root" config user.email "shadow@multi-agent.local"
+  # Baseline snapshot.
+  do_snapshot "$task_id" "$project_root" "baseline"
+}
+
+do_snapshot() {
+  local task_id="${1:-}" project_root="${2:-}" label="${3:-}"
+  [ -z "$task_id" ] || [ -z "$project_root" ] || [ -z "$label" ] && {
+    err "usage: snapshot <task-id> <project-root> <label>"; exit 1; }
+  local sd; sd=$(shadow_dir "$task_id")
+  [ ! -d "$sd/.git" ] && { err "shadow not initialized for $task_id — run 'init' first"; exit 1; }
+  sg "$sd" "$project_root" add -A >/dev/null 2>&1 || true
+  # Skip empty diffs (no-op snapshots).
+  if sg "$sd" "$project_root" diff --cached --quiet 2>/dev/null; then
+    printf 'shadow-git: no changes to snapshot (%s)\n' "$label" >&2
+    return 0
+  fi
+  local msg="$label"
+  sg "$sd" "$project_root" commit --quiet -m "$msg" -m "iso: $(iso_now)" >/dev/null
+  local sha
+  sha=$(sg "$sd" "$project_root" rev-parse --short HEAD)
+  printf '%s\n' "$sha"
+}
+
+do_list() {
+  local task_id="${1:-}"
+  [ -z "$task_id" ] && { err "usage: list <task-id>"; exit 1; }
+  local sd; sd=$(shadow_dir "$task_id")
+  [ ! -d "$sd/.git" ] && { err "shadow not initialized for $task_id"; exit 1; }
+  # Use the embedded `iso:` line from the commit message body so the listing
+  # carries the snapshot timestamp without relying on committer date (which is
+  # influenced by git env vars).
+  sg "$sd" "$(pwd)" log --pretty=format:'%h  %s' --no-decorate
+}
+
+do_restore() {
+  local task_id="${1:-}" project_root="${2:-}" sha="${3:-}" mode="${4:---files}"
+  [ -z "$task_id" ] || [ -z "$project_root" ] || [ -z "$sha" ] && {
+    err "usage: restore <task-id> <project-root> <sha> [--files|--state|--both]"; exit 1; }
+  local sd; sd=$(shadow_dir "$task_id")
+  [ ! -d "$sd/.git" ] && { err "shadow not initialized for $task_id"; exit 1; }
+  case "$mode" in
+    --files|--both)
+      sg "$sd" "$project_root" checkout --quiet "$sha" -- . \
+        || { err "git checkout failed"; exit 3; }
+      printf 'shadow-git: restored files to %s\n' "$sha" >&2
+      ;;
+    --state)
+      err "--state mode reserved for agent-state.json snapshot (not yet implemented in this surface)"
+      exit 2
+      ;;
+    *) err "unknown mode: $mode"; exit 2 ;;
+  esac
+  # When --both, also restore state would happen here in a future commit.
+}
+
+do_prune() {
+  local task_id="${1:-}"; shift || true
+  [ -z "$task_id" ] && { err "usage: prune <task-id> [--older-than-days N]"; exit 1; }
+  local older=""
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --older-than-days) older="$2"; shift 2 ;;
+      *) err "unknown flag: $1"; exit 2 ;;
+    esac
+  done
+  local sd; sd=$(shadow_dir "$task_id")
+  if [ -z "$older" ]; then
+    rm -rf "$sd"
+    printf 'shadow-git: pruned shadow repo for %s\n' "$task_id" >&2
+  else
+    # Trim history (truncate to last N snapshots within the window). For now,
+    # implement as "rewind to oldest commit within window".
+    [ ! -d "$sd/.git" ] && { err "no shadow for $task_id"; exit 1; }
+    local cutoff_epoch
+    cutoff_epoch=$(($(date +%s) - older * 86400))
+    local keep_sha
+    keep_sha=$(sg "$sd" "$(pwd)" log --pretty='%H %ct' | awk -v c="$cutoff_epoch" '$2 >= c {print $1}' | tail -1)
+    if [ -n "$keep_sha" ]; then
+      printf 'shadow-git: oldest snapshot kept within window: %s\n' "$keep_sha" >&2
+      # Hard-reset history to that snapshot. (Conservative: GC unreachable.)
+      sg "$sd" "$(pwd)" reset --hard --quiet "$keep_sha" || true
+      sg "$sd" "$(pwd)" gc --prune=now --quiet 2>/dev/null || true
+    fi
+  fi
+}
+
+do_doctor() {
+  printf 'shadow-git doctor\n'
+  printf '  storage:  %s\n' "$SHADOW_ROOT"
+  if [ ! -d "$SHADOW_ROOT" ]; then
+    printf '  (empty)\n'
+    return 0
+  fi
+  for d in "$SHADOW_ROOT"/*/; do
+    [ -d "$d" ] || continue
+    local task_id; task_id=$(basename "$d")
+    local size; size=$(du -sh "$d" 2>/dev/null | awk '{print $1}')
+    local count
+    count=$(git --git-dir="$d/.git" log --oneline 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+    printf '    %-20s %s  %s snapshots\n' "$task_id" "$size" "$count"
+  done
+}
+
+# --- Dispatch ---------------------------------------------------------------
+
+case "$CMD" in
+  init)     do_init     "$@" ;;
+  snapshot) do_snapshot "$@" ;;
+  list)     do_list     "$@" ;;
+  restore)  do_restore  "$@" ;;
+  prune)    do_prune    "$@" ;;
+  doctor)   do_doctor   "$@" ;;
+  --help|-h) usage ;;
+  *) err "unknown subcommand '$CMD'"; usage ;;
+esac

package/pipeline/lib/submodule-detector.sh

@@ -0,0 +1,177 @@
+#!/bin/bash
+#
+# submodule-detector.sh
+# Given a git repository (worktree or remote), emit JSON of suggested
+# dev-context repos based on .gitmodules + sibling-checkout heuristic.
+#
+# Usage:
+#   ./submodule-detector.sh <repo-path>                # local checkout
+#   ./submodule-detector.sh --remote <owner>/<repo>    # via gh
+#
+# Optional env (when set, enriches each submodule with a canPush flag by
+# cross-referencing the repo-cache.sh output for the active account, plus the
+# editableRelatedRepos override list under prefs.projects[<key>]):
+#   ACCOUNT_GH_OWNER       — owner scope for the github cache file
+#   ACCOUNT_BB_PROJECT_KEY — project/workspace key for the bitbucket cache
+#   PROJECT_PREF_KEY       — top-level key in prefs.projects (e.g. cwd repo name)
+#
+# Output:
+#   [
+#     {"name":"<submodule-name>","url":"https://...","provider":"github",
+#      "source":"submodule","canPush":true|false,
+#      "reason":"cache|owner-match|prefs-override|unknown"},
+#     ...
+#   ]
+#
+
+set -eu
+
+MODE="local"
+TARGET="${1:-}"
+if [ "$TARGET" = "--remote" ]; then
+  MODE="remote"
+  TARGET="${2:-}"
+fi
+[ -z "$TARGET" ] && { echo "[]"; exit 0; }
+
+emit_json() {
+  GH_CACHE="$HOME/.claude/cache/repos/github-${ACCOUNT_GH_OWNER:-_none_}.json" \
+  BB_CACHE="$HOME/.claude/cache/repos/bitbucket-${ACCOUNT_BB_PROJECT_KEY:-_none_}.json" \
+  PREFS_FILE="$HOME/.claude/multi-agent-preferences.json" \
+  PROJECT_PREF_KEY="${PROJECT_PREF_KEY:-}" \
+  ACCOUNT_GH_OWNER="${ACCOUNT_GH_OWNER:-}" \
+  python3 -c '
+import sys, json, re, os
+
+def load_json(path):
+    try:
+        with open(path) as f:
+            return json.load(f)
+    except Exception:
+        return None
+
+gh_cache = load_json(os.environ.get("GH_CACHE","")) or []
+bb_cache = load_json(os.environ.get("BB_CACHE","")) or []
+prefs = load_json(os.environ.get("PREFS_FILE","")) or {}
+
+def index_cache(entries):
+    idx = {}
+    for r in entries:
+        if not isinstance(r, dict):
+            continue
+        full = (r.get("fullName") or "").lower()
+        if full:
+            idx[full] = r
+        for k in ("cloneUrl", "httpsCloneUrl"):
+            u = (r.get(k) or "")
+            if u:
+                idx[u.lower()] = r
+    return idx
+
+cache_idx = {}
+cache_idx.update(index_cache(gh_cache))
+cache_idx.update(index_cache(bb_cache))
+
+project_key = os.environ.get("PROJECT_PREF_KEY","")
+project_pref = ((prefs.get("projects") or {}).get(project_key) or {}) if project_key else {}
+overrides = project_pref.get("editableRelatedRepos") or []
+override_set = { (o or "").lower() for o in overrides }
+
+account_owner = (os.environ.get("ACCOUNT_GH_OWNER","") or "").lower()
+
+def parse_owner_repo(url):
+    s = url.strip()
+    if s.startswith("git@"):
+        _, _, tail = s.partition(":")
+    else:
+        m = re.match(r"^[a-z]+://[^/]+/(.+)$", s)
+        tail = m.group(1) if m else s
+    tail = tail.rstrip("/")
+    if tail.endswith(".git"):
+        tail = tail[:-4]
+    parts = tail.split("/")
+    if len(parts) >= 2:
+        return parts[-2], parts[-1]
+    return None, parts[-1] if parts else None
+
+def resolve_can_push(item):
+    url = item.get("url","")
+    name = item.get("name","") or ""
+    owner, repo = parse_owner_repo(url)
+    full = f"{owner}/{repo}".lower() if owner and repo else ""
+
+    if full and full in override_set:
+        return True, "prefs-override"
+    if name and name.lower() in override_set:
+        return True, "prefs-override"
+
+    for key in (full, url.lower()):
+        if key and key in cache_idx:
+            hit = cache_idx[key]
+            return bool(hit.get("canPush", False)), "cache"
+
+    if account_owner and owner and owner.lower() == account_owner:
+        return True, "owner-match"
+
+    return False, "unknown"
+
+text = sys.stdin.read()
+items = []
+current = {}
+for line in text.splitlines():
+    line = line.strip()
+    if line.startswith("[submodule"):
+        if current:
+            items.append(current)
+        current = {"source": "submodule"}
+        m = re.match(r"\[submodule \"(.+)\"\]", line)
+        if m:
+            current["name"] = m.group(1)
+    elif "=" in line and current:
+        k, _, v = line.partition("=")
+        k = k.strip(); v = v.strip()
+        if k == "url":
+            current["url"] = v
+            if "github.com" in v:
+                current["provider"] = "github"
+            elif "bitbucket" in v:
+                current["provider"] = "bitbucket"
+            else:
+                current["provider"] = "git"
+            tail = v.rstrip("/").split("/")[-1].replace(".git","")
+            current.setdefault("name", tail)
+        elif k == "path":
+            current["path"] = v
+if current:
+    items.append(current)
+
+for it in items:
+    can, reason = resolve_can_push(it)
+    it["canPush"] = can
+    it["reason"] = reason
+
+print(json.dumps(items))
+'
+}
+
+case "$MODE" in
+  local)
+    if [ ! -f "$TARGET/.gitmodules" ]; then
+      echo "[]"
+      exit 0
+    fi
+    cat "$TARGET/.gitmodules" | emit_json
+    ;;
+
+  remote)
+    if ! command -v gh >/dev/null 2>&1; then
+      echo "[]"
+      exit 0
+    fi
+    gh api "repos/$TARGET/contents/.gitmodules" \
+        --jq '.content' 2>/dev/null \
+      | tr -d '\n' \
+      | base64 --decode 2>/dev/null \
+      | emit_json || echo "[]"
+    ;;
+esac

package/pipeline/lib/vercel-deploy.sh

@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+#
+# vercel-deploy.sh — safe wrapper around `vercel` CLI.
+#
+# Why this exists (v8.0.0): on 2026-04-27 a `vercel deploy --token=…`
+# invocation failed during the v7.9.1 release flow. The CLI's error retry
+# hint printed the failed argv verbatim, including `--token=vcp_…`. That
+# leaked the deploy token into the conversation transcript and forced a
+# token rotation. See `feedback_vercel_cli_token_leak.md`.
+#
+# This wrapper guarantees three properties for every Vercel call:
+#   1. Tokens are passed via VERCEL_TOKEN env var, NEVER via --token=… argv.
+#      Even if a downstream caller still uses --token=, the redact filter
+#      below scrubs it from stdout/stderr.
+#   2. Every stdout/stderr line is piped through `redact_token` before being
+#      written to the user's terminal or any log file.
+#   3. Failed deploys exit with a clear message instead of dumping the CLI's
+#      retry hint that contains the original argv.
+#
+# Usage:
+#   pipeline/lib/vercel-deploy.sh deploy [--prod] [--cwd=<dir>] [-- <extra-vercel-args>...]
+#   pipeline/lib/vercel-deploy.sh redact < input > output     # filter mode
+#   pipeline/lib/vercel-deploy.sh doctor                       # env + CLI check
+#
+# Environment:
+#   VERCEL_TOKEN          — required for deploy (resolved from prefs keychainMapping if unset)
+#   VERCEL_ORG_ID         — optional, scopes deploys to a team
+#   VERCEL_PROJECT_ID     — optional, links to a specific project
+#   VERCEL_DEPLOY_QUIET   — when set, suppresses progress lines (raw CLI output stays redacted)
+#
+# Exit codes:
+#   0  deploy succeeded
+#   1  argument or environment error (no token, missing CLI)
+#   2  vercel CLI exited non-zero (post-redaction tail printed)
+
+set -euo pipefail
+
+CMD="${1:-help}"
+shift || true
+
+# ---------------------------------------------------------------------------
+# Token redaction filter — used everywhere user-visible output flows.
+#
+# Patterns scrubbed:
+#   --token=<rest>          → --token=***REDACTED***
+#   --token <rest>          → --token ***REDACTED***
+#   vcp_<hex/alnum>         → vcp_***REDACTED***
+#   Bearer <jwt-ish>        → Bearer ***REDACTED***
+#   "token":"<val>"         → "token":"***REDACTED***"
+#
+# Sed rather than perl/awk so the wrapper has no extra runtime deps.
+# ---------------------------------------------------------------------------
+redact_filter() {
+  sed -E \
+    -e 's/(--token[ =])[^ "'"'"']+/\1***REDACTED***/g' \
+    -e 's/vcp_[A-Za-z0-9_-]+/vcp_***REDACTED***/g' \
+    -e 's/(Bearer[ =])[A-Za-z0-9._-]+/\1***REDACTED***/g' \
+    -e 's/("token"[[:space:]]*:[[:space:]]*")[^"]+/\1***REDACTED***/g' \
+    -e 's/("VERCEL_TOKEN"[[:space:]]*:[[:space:]]*")[^"]+/\1***REDACTED***/g'
+}
+
+cmd_redact() {
+  redact_filter
+}
+
+cmd_doctor() {
+  local rc=0
+  if command -v vercel >/dev/null 2>&1; then
+    echo "vercel: $(vercel --version 2>&1 | redact_filter | head -1)"
+  else
+    echo "vercel: NOT INSTALLED — run 'npm i -g vercel'" >&2
+    rc=1
+  fi
+
+  if [ -n "${VERCEL_TOKEN:-}" ]; then
+    local masked
+    masked=$(printf '%s' "$VERCEL_TOKEN" | head -c 4)
+    echo "VERCEL_TOKEN: set (prefix=${masked}…, length=${#VERCEL_TOKEN})"
+  else
+    echo "VERCEL_TOKEN: unset — set via env or pipeline keychainMapping.vercel"
+  fi
+
+  if [ -n "${VERCEL_ORG_ID:-}" ]; then
+    echo "VERCEL_ORG_ID: set"
+  fi
+  if [ -n "${VERCEL_PROJECT_ID:-}" ]; then
+    echo "VERCEL_PROJECT_ID: set"
+  fi
+
+  return $rc
+}
+
+cmd_deploy() {
+  if ! command -v vercel >/dev/null 2>&1; then
+    echo "ERROR: vercel CLI not on PATH — run 'npm i -g vercel'" >&2
+    exit 1
+  fi
+
+  if [ -z "${VERCEL_TOKEN:-}" ]; then
+    echo "ERROR: VERCEL_TOKEN not set. Resolve via env or keychain ('~/.claude/lib/credential-store.sh get <vercel-key>')." >&2
+    echo "Hint: vercel CLI accepts the token via env var; do NOT pass --token= on argv (leaks on retry)." >&2
+    exit 1
+  fi
+
+  local cwd="."
+  local prod=false
+  local extra_args=()
+
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --prod|--production) prod=true ;;
+      --cwd=*) cwd="${1#--cwd=}" ;;
+      --) shift; extra_args=("$@"); break ;;
+      *)   extra_args+=("$1") ;;
+    esac
+    shift || true
+  done
+
+  local cmd_args=(deploy)
+  if [ "$prod" = true ]; then
+    cmd_args+=(--prod)
+  fi
+  cmd_args+=("${extra_args[@]}")
+
+  # Refuse to run if the user is trying to pass --token=… via extra args.
+  for a in "${extra_args[@]}"; do
+    case "$a" in
+      --token=*|--token)
+        echo "ERROR: refused to deploy with --token argv. Pass the token via VERCEL_TOKEN env var instead." >&2
+        echo "       Reason: vercel CLI prints failed argv on retry, leaking the token to the terminal." >&2
+        exit 1
+        ;;
+    esac
+  done
+
+  # Run the CLI with token via env. Pipe stdout AND stderr through the redact
+  # filter so even if the CLI dumps argv on failure (it does — that was the
+  # original v7.9.1 leak), tokens never reach the user's screen or transcript.
+  set +e
+  ( cd "$cwd" && VERCEL_TOKEN="$VERCEL_TOKEN" vercel "${cmd_args[@]}" 2>&1 ) \
+    | redact_filter
+  local rc="${PIPESTATUS[0]}"
+  set -e
+
+  if [ "$rc" -ne 0 ]; then
+    echo "" >&2
+    echo "vercel-deploy.sh: deploy failed (exit $rc). Token-leaking output was filtered above." >&2
+    exit 2
+  fi
+}
+
+case "$CMD" in
+  deploy)  cmd_deploy "$@" ;;
+  redact)  cmd_redact ;;
+  doctor)  cmd_doctor ;;
+  -h|--help|help)
+    cat <<'EOF'
+Usage:
+  vercel-deploy.sh deploy [--prod] [--cwd=<dir>] [-- <extra-vercel-args>...]
+  vercel-deploy.sh redact < input > output
+  vercel-deploy.sh doctor
+
+See: pipeline/lib/vercel-deploy.sh source comments for the full leak rationale.
+EOF
+    ;;
+  *)
+    echo "unknown subcommand: $CMD" >&2
+    exit 1
+    ;;
+esac

package/pipeline/preferences-template.json

@@ -0,0 +1,132 @@
+{
+  "schemaVersion": "2.1.0",
+  "global": {
+    "identities": [],
+    "keychainMapping": {
+      "jira": null,
+      "bitbucket_token": null,
+      "bitbucket_user": null,
+      "github": null,
+      "confluence": null,
+      "figma": null,
+      "figma_mcp": null,
+      "fortify": null,
+      "firebase": null,
+      "jenkins": null
+    },
+    "platformIdentityRouting": {},
+    "recentProjects": [],
+    "recentBranches": {},
+    "recentGroups": [],
+    "serviceStatus": {},
+    "settings": {
+      "branchTtlDays": 15,
+      "pushRetryMax": 5,
+      "buildRetryMax": 3,
+      "serviceStatusCacheSeconds": 300,
+      "repoScanDays": 90,
+      "identityRoutingEnabled": false,
+      "multiRepoEnabled": false,
+      "pushMustSucceed": true
+    },
+    "defaultJiraKey": null,
+    "reportChannels": {
+      "pr": true,
+      "jira": true,
+      "confluence": false,
+      "wiki": false
+    },
+    "reportContent": {
+      "normalAnalysis": true,
+      "technicalAnalysis": false,
+      "testScenarios": true,
+      "autoDiff": false,
+      "manualNote": false
+    },
+    "wikiScope": ["main", "ios", "screenshots", "index"],
+    "autopilotReportTimeoutSeconds": 1800,
+    "promptLanguage": "en",
+    "outputLanguage": "en",
+    "triageCrossCheck": {
+      "enabled": false,
+      "samplePct": 10,
+      "model": "sonnet",
+      "blockOnDisagreement": false
+    }
+  },
+  "projects": {},
+  "_figmaConfigTemplate": {
+    "_comment": "Copy this to ~/.claude/projects/{slug}/figma-config.json and fill in values. See pipeline/schemas/figma-project-config.schema.json for full schema.",
+    "schemaVersion": "1.0.0",
+    "project": {
+      "slug": "",
+      "repoOwner": "",
+      "repoName": "",
+      "baseBranch": "develop",
+      "platform": "ios"
+    },
+    "figma": {
+      "fileKey": "",
+      "patKeychainKey": "",
+      "mcpEnabled": false
+    },
+    "submodules": {
+      "common": { "path": "", "branch": "develop" },
+      "uicomponents": { "path": "", "branch": "develop" },
+      "wiki": null
+    },
+    "board": {
+      "enabled": false,
+      "provider": "none",
+      "projectId": null,
+      "columns": {
+        "todo": "Todo",
+        "inDevelop": "In Develop",
+        "inReview": "In Review",
+        "done": "Done",
+        "blocked": "Blocked",
+        "bugfix": "Bugfix"
+      }
+    },
+    "registry": {
+      "enabled": false,
+      "type": "none",
+      "cliName": null,
+      "packagePath": null
+    },
+    "review": {
+      "requiredApprovals": 0,
+      "reviewers": [],
+      "autoAssign": false
+    },
+    "iteration": {
+      "branch": "iteration/develop",
+      "batchSize": 5
+    },
+    "wiki": {
+      "enabled": false,
+      "categoryMapping": "auto"
+    },
+    "confluence": {
+      "enabled": false,
+      "spaceKey": null,
+      "parentPageId": null
+    },
+    "tokens": {
+      "spacing": ".Spacing.spacing{value}",
+      "color": "Color.{semantic}",
+      "typography": ".typographyStyle(.{name})",
+      "radius": ".CornerRadius.radius{value}"
+    },
+    "scripts": {
+      "pythonPath": "python3",
+      "preGather": null,
+      "postCommit": null
+    },
+    "models": {
+      "default": "sonnet",
+      "complex": "opus",
+      "overrides": {}
+    }
+  }
+}