@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/build-skills-index.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+// build-skills-index.mjs — v7.0.I
+//
+// Walks all SKILL.md files and emits a lightweight index so the pipeline can
+// dynamically inject only the skills relevant to a task — instead of relying
+// on Claude Code's eager-load of all 192 skills on every session.
+//
+// Outputs (both written to pipeline/skills/):
+//   .skills-index.json — machine-readable, consumed by match-skills.mjs
+//   skills-index.md    — human-readable, can be browsed in-repo
+//
+// For each SKILL.md we extract:
+//   name          — frontmatter `name:` (fallback: directory name)
+//   description   — frontmatter `description:` (first 300 chars)
+//   platform      — frontmatter `platform:` if set (ios / android / generic)
+//   group         — derived from path: core / figma-ios / figma-android /
+//                    figma-common / external
+//   triggerKeywords — frontmatter `trigger-keywords:` (comma-separated
+//                    values lowercased) — authors can add these to tighten
+//                    match score. Missing → empty list.
+//   triggerPaths  — frontmatter `trigger-paths:` (glob patterns) — missing
+//                    → empty list.
+//   relativePath  — path relative to pipeline/skills/
+//
+// Usage: build-skills-index.mjs [--root <dir>]   # default: ./pipeline/skills
+
+import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(here, "..", "..");
+
+const args = process.argv.slice(2);
+let root = join(repoRoot, "pipeline", "skills");
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--root") root = resolve(args[++i]);
+}
+
+function* walkSkills(dir) {
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    let st;
+    try { st = statSync(full); } catch { continue; }
+    if (st.isDirectory()) yield* walkSkills(full);
+    else if (entry === "SKILL.md") yield full;
+  }
+}
+
+function parseFrontmatter(raw) {
+  if (!raw.startsWith("---")) return {};
+  const end = raw.indexOf("\n---", 3);
+  if (end < 0) return {};
+  const body = raw.slice(3, end).trim();
+  const out = {};
+  for (const line of body.split("\n")) {
+    const m = line.match(/^([\w-]+):\s*(.*)$/);
+    if (!m) continue;
+    let value = m[2].trim();
+    if (value.startsWith("\"") && value.endsWith("\"")) value = value.slice(1, -1);
+    out[m[1]] = value;
+  }
+  return out;
+}
+
+function groupFromPath(rel) {
+  if (rel.startsWith("shared/core/")) return "core";
+  if (rel.startsWith("shared/external/")) return "external";
+  if (rel.startsWith("figma-ios/")) return "figma-ios";
+  if (rel.startsWith("figma-android/")) return "figma-android";
+  if (rel.startsWith("figma-common/")) return "figma-common";
+  return "other";
+}
+
+const entries = [];
+for (const full of walkSkills(root)) {
+  const rel = relative(root, full);
+  const raw = readFileSync(full, "utf-8");
+  const fm = parseFrontmatter(raw);
+
+  const name = fm.name || rel.split("/").slice(-2, -1)[0];
+  const description = (fm.description || "").slice(0, 300);
+  const platform = fm.platform || null;
+  const group = groupFromPath(rel);
+
+  const kws = (fm["trigger-keywords"] || "")
+    .split(",")
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+  const paths = (fm["trigger-paths"] || "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  entries.push({
+    name,
+    description,
+    platform,
+    group,
+    triggerKeywords: kws,
+    triggerPaths: paths,
+    relativePath: rel,
+  });
+}
+
+entries.sort((a, b) => a.name.localeCompare(b.name));
+
+const json = {
+  schemaVersion: "1.0.0",
+  generatedAt: new Date().toISOString(),
+  skillCount: entries.length,
+  entries,
+};
+
+const jsonPath = join(root, ".skills-index.json");
+writeFileSync(jsonPath, JSON.stringify(json, null, 2) + "\n");
+
+// Human-readable index
+const mdLines = [
+  "# Skills index",
+  "",
+  `> Auto-generated by \`pipeline/scripts/build-skills-index.mjs\` — do not hand-edit.`,
+  `> Regenerate with \`node pipeline/scripts/build-skills-index.mjs\`.`,
+  "",
+  `**${entries.length} skills** across ${new Set(entries.map((e) => e.group)).size} groups.`,
+  "",
+  "| Group | Name | Platform | Description |",
+  "|-------|------|----------|-------------|",
+];
+for (const e of entries) {
+  const desc = e.description.replace(/\|/g, "\\|").slice(0, 140);
+  mdLines.push(`| ${e.group} | \`${e.name}\` | ${e.platform || "—"} | ${desc} |`);
+}
+mdLines.push("");
+const mdPath = join(root, "skills-index.md");
+writeFileSync(mdPath, mdLines.join("\n"));
+
+console.log(`build-skills-index: wrote ${entries.length} entries → ${jsonPath}`);
+console.log(`build-skills-index: wrote ${entries.length} entries → ${mdPath}`);

package/pipeline/scripts/classify-plan-safety.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+// classify-plan-safety.mjs — v7.0.G
+//
+// Heuristic safety classifier for a Phase 2 plan. Autopilot's "zero user
+// interaction" contract is fine for small, predictable tasks but dangerous
+// when a plan touches the security path, deletes files without paired
+// tests, or sprawls across many files. This script inspects the plan and
+// returns a JSON verdict — the orchestrator reads it and decides whether
+// to inject a one-time pause even in autopilot mode.
+//
+// Usage:
+//   classify-plan-safety.mjs <plan.json>
+//   cat plan.json | classify-plan-safety.mjs -
+//
+// Output (stdout, always exit 0 unless input is malformed):
+//   {
+//     "score": 0-100,
+//     "recommendPause": true|false,
+//     "reasons": [ {rule, weight, detail} ],
+//     "summary": "…"
+//   }
+//
+// Rules + weights (v1, tune via telemetry later):
+//   - file-count-high       30   — plan.tasks[].files[] total > 15
+//   - file-count-medium     10   — total 8..15
+//   - destructive-verb      25   — task title or approach mentions
+//                                    delete|drop|remove|migrate|rename|purge|truncate
+//   - security-path         35   — any planned file matches
+//                                    auth, keychain, credentials, secret, security, token,
+//                                    cert, encrypt, signing, privacy
+//   - delete-without-test   30   — refactor/code task that deletes files
+//                                    AND no sibling `type: test` task touches the same area
+//   - schema-migration      25   — plan touches schemas/ OR migrations/ OR *.sql
+//   - infrastructure        20   — touches Dockerfile, CI yaml, Gradle wrapper,
+//                                    package.json resolutions / engines, install.js
+//
+// recommendPause = true when score >= 50 (tuned: any two medium signals or
+// any one heavy signal flips it).
+//
+// Exit codes: 0 = verdict produced, 1 = malformed input, 2 = usage error.
+
+import { readFileSync } from "node:fs";
+
+const args = process.argv.slice(2);
+if (args.length !== 1) {
+  console.error("Usage: classify-plan-safety.mjs <plan.json|->");
+  process.exit(2);
+}
+
+let raw;
+try {
+  raw = args[0] === "-" ? readFileSync(0, "utf-8") : readFileSync(args[0], "utf-8");
+} catch (e) {
+  console.error(`classify-plan-safety: cannot read input: ${e.message}`);
+  process.exit(1);
+}
+
+let plan;
+try {
+  plan = JSON.parse(raw);
+} catch (e) {
+  console.error(`classify-plan-safety: invalid JSON: ${e.message}`);
+  process.exit(1);
+}
+
+const tasks = Array.isArray(plan.tasks) ? plan.tasks : [];
+const allFiles = new Set();
+for (const t of tasks) for (const f of t.files || []) allFiles.add(f);
+
+const reasons = [];
+
+// --- file-count ---
+const fileCount = allFiles.size;
+if (fileCount > 15) {
+  reasons.push({ rule: "file-count-high", weight: 30, detail: `plan touches ${fileCount} files (threshold 15)` });
+} else if (fileCount >= 8) {
+  reasons.push({ rule: "file-count-medium", weight: 10, detail: `plan touches ${fileCount} files` });
+}
+
+// --- destructive verb ---
+const destructiveRe = /\b(delete|drop|remove|migrate|rename|purge|truncate|wipe|destroy)\b/i;
+const destructiveHits = [];
+for (const t of tasks) {
+  const blob = `${t.title || ""} ${(t.acceptanceCriteria || []).join(" ")}`;
+  if (destructiveRe.test(blob)) destructiveHits.push(t.id || t.title);
+}
+if (plan.approach && destructiveRe.test(plan.approach)) destructiveHits.push("approach");
+if (destructiveHits.length > 0) {
+  reasons.push({
+    rule: "destructive-verb",
+    weight: 25,
+    detail: `destructive verbs in: ${destructiveHits.join(", ")}`,
+  });
+}
+
+// --- security path ---
+const securityRe = /(\/|^)(auth|keychain|credentials?|secret|security|tokens?|cert|encrypt|signing|privacy)(\/|$|\.)/i;
+const securityHits = [];
+for (const f of allFiles) if (securityRe.test(f)) securityHits.push(f);
+if (securityHits.length > 0) {
+  reasons.push({
+    rule: "security-path",
+    weight: 35,
+    detail: `${securityHits.length} security-path file(s): ${securityHits.slice(0, 3).join(", ")}${securityHits.length > 3 ? "…" : ""}`,
+  });
+}
+
+// --- delete-without-test ---
+// Heuristic: a task whose type is "code" or "refactor" and title includes a
+// destructive verb — but no sibling task (any type=test) touches the same dir.
+const testFileDirs = new Set();
+for (const t of tasks) {
+  if (t.type === "test") {
+    for (const f of t.files || []) {
+      testFileDirs.add(f.split("/").slice(0, -1).join("/"));
+    }
+  }
+}
+const deleteWithoutTest = [];
+for (const t of tasks) {
+  if (!["code", "refactor"].includes(t.type)) continue;
+  if (!destructiveRe.test(t.title || "")) continue;
+  const taskDirs = new Set((t.files || []).map((f) => f.split("/").slice(0, -1).join("/")));
+  let covered = false;
+  for (const d of taskDirs) if (testFileDirs.has(d)) { covered = true; break; }
+  if (!covered) deleteWithoutTest.push(t.id || t.title);
+}
+if (deleteWithoutTest.length > 0) {
+  reasons.push({
+    rule: "delete-without-test",
+    weight: 30,
+    detail: `destructive task(s) without paired test coverage: ${deleteWithoutTest.join(", ")}`,
+  });
+}
+
+// --- schema migration ---
+const schemaHits = [];
+for (const f of allFiles) {
+  if (/(^|\/)(schemas?|migrations?)\//i.test(f) || /\.sql$/i.test(f)) {
+    schemaHits.push(f);
+  }
+}
+if (schemaHits.length > 0) {
+  reasons.push({
+    rule: "schema-migration",
+    weight: 25,
+    detail: `${schemaHits.length} schema/migration file(s): ${schemaHits.slice(0, 3).join(", ")}${schemaHits.length > 3 ? "…" : ""}`,
+  });
+}
+
+// --- infrastructure ---
+const infraRe = /(^|\/)(Dockerfile|install\.js|package\.json|build\.gradle|settings\.gradle|Gemfile|pyproject\.toml|\.github\/workflows\/.*\.ya?ml|vercel\.(json|ts))$/i;
+const infraHits = [];
+for (const f of allFiles) if (infraRe.test(f)) infraHits.push(f);
+if (infraHits.length > 0) {
+  reasons.push({
+    rule: "infrastructure",
+    weight: 20,
+    detail: `${infraHits.length} infra file(s): ${infraHits.slice(0, 3).join(", ")}${infraHits.length > 3 ? "…" : ""}`,
+  });
+}
+
+// --- aggregate ---
+const score = reasons.reduce((s, r) => s + r.weight, 0);
+const recommendPause = score >= 50;
+
+let summary;
+if (recommendPause) {
+  summary = `High-risk plan (score ${score}) — recommend manual approval even in autopilot`;
+} else if (score > 0) {
+  summary = `Moderate plan (score ${score}) — autopilot safe`;
+} else {
+  summary = `Low-risk plan — autopilot safe`;
+}
+
+process.stdout.write(JSON.stringify({ score, recommendPause, reasons, summary }, null, 2) + "\n");
+process.exit(0);

package/pipeline/scripts/cost-table.json

@@ -0,0 +1,27 @@
+{
+  "_readme": "Per-model unit prices in USD per million tokens. Source: Anthropic public pricing (verified 2026-04-21). Update when Anthropic publishes new tiers. Unknown models render USD as '—' and emit a footnote — never block PR-body generation.",
+  "schemaVersion": "1.0.0",
+  "prices": {
+    "opus": {
+      "inPerMtok": 15.00,
+      "outPerMtok": 75.00,
+      "modelId": "claude-opus-4-7"
+    },
+    "sonnet": {
+      "inPerMtok": 3.00,
+      "outPerMtok": 15.00,
+      "modelId": "claude-sonnet-4-6"
+    },
+    "haiku": {
+      "inPerMtok": 1.00,
+      "outPerMtok": 5.00,
+      "modelId": "claude-haiku-4-5-20251001"
+    },
+    "gpt-5.4": {
+      "inPerMtok": 10.00,
+      "outPerMtok": 30.00,
+      "modelId": "gpt-5.4",
+      "note": "Copilot CLI Reviewer 2 — approximate; verify against OpenAI pricing page before relying on totals."
+    }
+  }
+}

package/pipeline/scripts/diff-explain.mjs

@@ -0,0 +1,276 @@
+#!/usr/bin/env node
+
+/**
+ * @file diff-explain.mjs — v7.8.0 Paket B
+ *
+ * Bridges Phase 4 triage output to the actual git diff. For each accepted /
+ * deferred / rejected finding, locates the corresponding hunk in the branch's
+ * diff against base and renders an annotated markdown report.
+ *
+ * Read-only — never modifies state. Safe to run after the fact.
+ *
+ * Inputs (any one):
+ *   --triage <path>     Path to triage-output.json
+ *   --task-id <#N|JIRA> Resolve via $HOME/.claude/logs/multi-agent/<project>/<id>/
+ *   --state <path>      Path to agent-state.json with embedded triage
+ *
+ * Diff source:
+ *   --branch <name>     Defaults to current branch
+ *   --base   <name>     Defaults to origin/main, falls back to main
+ *   --diff   <path>     Pre-computed diff file (skip git invocation)
+ *
+ * Output:
+ *   stdout (markdown). Use `>` to capture.
+ *
+ * Examples:
+ *   node diff-explain.mjs --triage ./triage-output.json
+ *   node diff-explain.mjs --task-id 3 --branch feature/PROJ-1
+ *   node diff-explain.mjs --triage ./triage-output.json --diff cached.diff
+ *
+ * @module pipeline/scripts/diff-explain
+ */
+
+import { readFileSync, existsSync } from "fs";
+import { execSync } from "child_process";
+
+const argv = process.argv.slice(2);
+const flags = {};
+for (let i = 0; i < argv.length; i++) {
+  const a = argv[i];
+  if (a.startsWith("--")) {
+    const key = a.slice(2);
+    const next = argv[i + 1];
+    if (next && !next.startsWith("--")) {
+      flags[key] = next;
+      i++;
+    } else {
+      flags[key] = true;
+    }
+  }
+}
+
+if (flags.help || flags.h) {
+  console.log(`Usage: diff-explain.mjs [options]
+
+Inputs (one required):
+  --triage <path>     Path to triage-output.json
+  --state  <path>     agent-state.json with embedded triage
+  --task-id <id>      Look up by task ID
+
+Diff source:
+  --branch <name>     Branch to diff (default: current)
+  --base   <name>     Base branch (default: origin/main → main)
+  --diff   <path>     Pre-computed diff (skip git)
+
+Output:
+  stdout (markdown)
+`);
+  process.exit(0);
+}
+
+function loadTriage() {
+  if (flags.triage) {
+    if (!existsSync(flags.triage)) die(`triage file not found: ${flags.triage}`);
+    return JSON.parse(readFileSync(flags.triage, "utf-8"));
+  }
+  if (flags.state) {
+    if (!existsSync(flags.state)) die(`state file not found: ${flags.state}`);
+    const state = JSON.parse(readFileSync(flags.state, "utf-8"));
+    const triage = state?.phases?.["4"]?.triage ?? state?.triage;
+    if (!triage) die(`no triage block found in ${flags.state}`);
+    return triage;
+  }
+  if (flags["task-id"]) {
+    die(
+      "--task-id resolution not implemented in this script — use --triage or --state directly. " +
+      "The slash command resolves task IDs via the orchestrator and passes --state to this script.",
+    );
+  }
+  die("one of --triage, --state, or --task-id is required");
+}
+
+function getDiff(filesFilter) {
+  if (flags.diff) {
+    if (!existsSync(flags.diff)) die(`diff file not found: ${flags.diff}`);
+    return readFileSync(flags.diff, "utf-8");
+  }
+  const base = flags.base || resolveBase();
+  const branch = flags.branch || "HEAD";
+  const filterArgs = filesFilter.length ? ["--", ...filesFilter] : [];
+  const cmd = ["git", "diff", "--unified=3", `${base}...${branch}`, ...filterArgs];
+  try {
+    return execSync(cmd.join(" "), { encoding: "utf-8", maxBuffer: 50 * 1024 * 1024 });
+  } catch (e) {
+    die(`git diff failed: ${e.message}`);
+  }
+}
+
+function resolveBase() {
+  for (const ref of ["origin/main", "main", "origin/master", "master"]) {
+    try {
+      execSync(`git rev-parse --verify ${ref}`, { stdio: "ignore" });
+      return ref;
+    } catch {
+      /* try next */
+    }
+  }
+  die("no base ref found (tried origin/main, main, origin/master, master) — pass --base");
+}
+
+/**
+ * Parse unified diff into a map of {path: [{ oldStart, newStart, lines: [...] }]}
+ * Each hunk's `lines` retains the leading +/- /space prefix.
+ */
+function parseDiff(raw) {
+  const files = {};
+  let currentPath;
+  let currentHunks = null;
+  let currentHunk = null;
+  for (const line of raw.split("\n")) {
+    const fileMatch = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
+    if (fileMatch) {
+      currentPath = fileMatch[2];
+      currentHunks = [];
+      files[currentPath] = currentHunks;
+      currentHunk = null;
+      continue;
+    }
+    const hunkMatch = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(line);
+    if (hunkMatch) {
+      currentHunk = {
+        oldStart: parseInt(hunkMatch[1], 10),
+        oldCount: parseInt(hunkMatch[2] || "1", 10),
+        newStart: parseInt(hunkMatch[3], 10),
+        newCount: parseInt(hunkMatch[4] || "1", 10),
+        header: line,
+        lines: [],
+      };
+      currentHunks?.push(currentHunk);
+      continue;
+    }
+    if (currentHunk && (line.startsWith("+") || line.startsWith("-") || line.startsWith(" "))) {
+      currentHunk.lines.push(line);
+    }
+  }
+  return files;
+}
+
+/**
+ * Find the hunk in `hunks` covering the new-file line `lineNo` (1-indexed).
+ * Returns null if no hunk contains the line.
+ */
+function hunkAtLine(hunks, lineNo) {
+  if (!Array.isArray(hunks)) return null;
+  for (const h of hunks) {
+    if (lineNo >= h.newStart && lineNo < h.newStart + h.newCount) return h;
+  }
+  return null;
+}
+
+function severityIcon(s) {
+  return s === "blocking" ? "🚫" : s === "important" ? "⚠️" : s === "suggestion" ? "💡" : "·";
+}
+
+function severityLabel(s) {
+  return s.toUpperCase();
+}
+
+function renderHunk(hunk) {
+  if (!hunk) return "_(line not in diff — finding may reference unchanged code)_";
+  const lines = ["```diff", hunk.header, ...hunk.lines, "```"];
+  return lines.join("\n");
+}
+
+function flattenFindings(triage) {
+  const out = [];
+  for (const f of triage.accepted ?? []) {
+    out.push({ ...f, _bucket: "accepted" });
+  }
+  for (const d of triage.deferred ?? []) {
+    out.push({ ...d.finding, _bucket: "deferred", _reason: d.reason });
+  }
+  for (const r of triage.rejected ?? []) {
+    out.push({ ...r.finding, _bucket: "rejected", _reason: r.reason });
+  }
+  return out;
+}
+
+function bucketIcon(b) {
+  return b === "accepted" ? "✅" : b === "deferred" ? "⏭️" : b === "rejected" ? "❌" : "·";
+}
+
+function die(msg) {
+  process.stderr.write(`diff-explain: ${msg}\n`);
+  process.exit(1);
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+const triage = loadTriage();
+const findings = flattenFindings(triage);
+const filesFromFindings = [...new Set(findings.map((f) => f.file).filter(Boolean))];
+
+if (findings.length === 0) {
+  console.log("# Phase 4 Triage Diff Bridge\n\n_(no findings to map — clean review.)_");
+  process.exit(0);
+}
+
+const diffRaw = getDiff(filesFromFindings);
+const diffFiles = parseDiff(diffRaw);
+
+// Group findings by file for stable per-file output
+const byFile = new Map();
+for (const f of findings) {
+  const key = f.file || "_unknown_";
+  if (!byFile.has(key)) byFile.set(key, []);
+  byFile.get(key).push(f);
+}
+
+const counts = {
+  accepted: triage.accepted?.length ?? 0,
+  deferred: triage.deferred?.length ?? 0,
+  rejected: triage.rejected?.length ?? 0,
+  blocking: (triage.accepted ?? []).filter((f) => f.severity === "blocking").length,
+  important: (triage.accepted ?? []).filter((f) => f.severity === "important").length,
+  suggestion: (triage.accepted ?? []).filter((f) => f.severity === "suggestion").length,
+};
+
+const lines = [];
+lines.push("# Phase 4 Triage Diff Bridge");
+lines.push("");
+lines.push("## Summary");
+lines.push("");
+lines.push(`- **Accepted:** ${counts.accepted} (🚫 ${counts.blocking} blocking · ⚠️ ${counts.important} important · 💡 ${counts.suggestion} suggestion)`);
+lines.push(`- **Deferred:** ${counts.deferred} · **Rejected:** ${counts.rejected}`);
+lines.push(`- **Approved:** ${triage.approved === true ? "✅ yes" : "❌ no"}`);
+lines.push("");
+
+for (const [file, items] of byFile) {
+  lines.push(`## ${file}`);
+  lines.push("");
+  const fileHunks = diffFiles[file];
+  for (const item of items) {
+    const icon = severityIcon(item.severity);
+    const bucketTag = bucketIcon(item._bucket);
+    const reviewer = item.reviewer ? ` _(${item.reviewer})_` : "";
+    lines.push(`### ${bucketTag} ${icon} ${severityLabel(item.severity)} — line ${item.line ?? "?"}${reviewer}`);
+    lines.push("");
+    if (item._reason) lines.push(`> _${item._bucket}: ${item._reason}_`);
+    lines.push(`> ${item.issue}`);
+    lines.push("");
+    if (item.fix) {
+      lines.push(`**Fix:** ${item.fix}`);
+      lines.push("");
+    }
+    if (item.line) {
+      if (fileHunks) {
+        const hunk = hunkAtLine(fileHunks, item.line);
+        lines.push(renderHunk(hunk));
+      } else {
+        lines.push("_(file not in diff — finding references unchanged or non-staged code)_");
+      }
+      lines.push("");
+    }
+  }
+}
+
+console.log(lines.join("\n"));