@mmerterden/multi-agent-pipeline 8.6.1 → 10.0.6

package/pipeline/scripts/smoke-figma-skill-import.sh

@@ -1,174 +0,0 @@
-#!/usr/bin/env bash
-# smoke-figma-skill-import.sh — consistency checks on pipeline/skills/figma-ios/.
-#
-# Runs offline — does NOT require the upstream source or re-run the import.
-# Verifies the imported skill tree is well-formed and transforms hit the file.
-
-set -euo pipefail
-
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-IOS_DIR="$ROOT/pipeline/skills/figma-ios"
-COMMON_DIR="$ROOT/pipeline/skills/figma-common"
-# SKILLS_DIR retained for back-compat but queries below cover both trees.
-SKILLS_DIR="$IOS_DIR"
-MAP="$ROOT/pipeline/scripts/figma-placeholder-map.json"
-
-PASS=0
-FAIL=0
-pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
-
-need() { command -v "$1" >/dev/null 2>&1 || { echo "error: $1 required" >&2; exit 127; }; }
-need jq
-
-[ -d "$SKILLS_DIR" ] || { echo "error: $SKILLS_DIR not present (run import first)" >&2; exit 1; }
-[ -f "$MAP" ] || { echo "error: placeholder map not found at $MAP" >&2; exit 1; }
-
-echo "→ 1. tree not empty"
-SKILL_COUNT=$(find "$SKILLS_DIR" -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' ')
-MD_COUNT=$(find "$SKILLS_DIR" -type f -name '*.md' | wc -l | tr -d ' ')
-[ "$SKILL_COUNT" -gt 0 ] && pass "imported $SKILL_COUNT skills" || fail "no skills found"
-[ "$MD_COUNT" -gt 0 ] && pass "imported $MD_COUNT markdown files" || fail "no markdown files found"
-
-echo ""
-echo "→ 2. every skill has a SKILL.md"
-MISSING=0
-for skill in "$SKILLS_DIR"/*/; do
-  [ -d "$skill" ] || continue
-  if [ ! -f "$skill/SKILL.md" ]; then
-    fail "missing SKILL.md in $(basename "$skill")"
-    MISSING=$((MISSING+1))
-  fi
-done
-[ "$MISSING" -eq 0 ] && pass "every skill has SKILL.md"
-
-echo ""
-echo "→ 3. SKILL.md frontmatter presence inventory"
-WITH_FM=0
-WITHOUT_FM=()
-for f in "$SKILLS_DIR"/*/SKILL.md; do
-  [ -f "$f" ] || continue
-  if head -n 1 "$f" | grep -Fxq -- "---"; then
-    WITH_FM=$((WITH_FM+1))
-  else
-    WITHOUT_FM+=("$(dirname "$f" | xargs basename)")
-  fi
-done
-pass "$WITH_FM skills carry YAML frontmatter"
-if [ "${#WITHOUT_FM[@]}" -gt 0 ]; then
-  echo "     (${#WITHOUT_FM[@]} documentation-only skills lack frontmatter: ${WITHOUT_FM[*]})"
-fi
-
-echo ""
-echo "→ 4. every frontmatter-bearing SKILL.md is stamped with status: wip-v5"
-UNSTAMPED=0
-for f in "$SKILLS_DIR"/*/SKILL.md; do
-  [ -f "$f" ] || continue
-  head -n 1 "$f" | grep -Fxq -- "---" || continue
-  if ! grep -q "^status: wip-v5" "$f"; then
-    fail "missing 'status: wip-v5' in $(dirname "$f" | xargs basename)/SKILL.md"
-    UNSTAMPED=$((UNSTAMPED+1))
-  fi
-done
-[ "$UNSTAMPED" -eq 0 ] && pass "every frontmatter skill stamped as WIP for v5"
-
-echo ""
-echo "→ 5. every frontmatter-bearing SKILL.md carries sourced-from provenance"
-NOPROV=0
-for f in "$SKILLS_DIR"/*/SKILL.md; do
-  [ -f "$f" ] || continue
-  head -n 1 "$f" | grep -Fxq -- "---" || continue
-  if ! grep -q "^sourced-from: upstream/" "$f"; then
-    fail "missing 'sourced-from' in $(dirname "$f" | xargs basename)/SKILL.md"
-    NOPROV=$((NOPROV+1))
-  fi
-done
-[ "$NOPROV" -eq 0 ] && pass "every frontmatter skill has upstream provenance"
-
-echo ""
-echo "→ 6. placeholder substitutions landed"
-# Probe for our canonical placeholders across the tree. At least one of these
-# must be present per-skill on average (evidence that sed ran).
-TOTAL_PLACEHOLDERS=$(grep -rE '\{(github|jira|repos|build|confluence|project|user)\.[a-zA-Z0-9_\.-]+\}' \
-  "$SKILLS_DIR" 2>/dev/null | wc -l | tr -d ' ')
-if [ "$TOTAL_PLACEHOLDERS" -ge "$SKILL_COUNT" ]; then
-  pass "placeholder occurrences: $TOTAL_PLACEHOLDERS (≥ one per skill on average)"
-else
-  fail "placeholder occurrences: $TOTAL_PLACEHOLDERS (expected ≥ $SKILL_COUNT)"
-fi
-
-echo ""
-echo "→ 7. renames respected (old names absent from skill folder list)"
-OLD_NAMES=(
-  "figma-to-swift-ui-code-connect"
-  "figma-to-swift-ui-confluence-sync"
-  "figma-to-swift-ui-implement"
-  "figma-to-swift-ui-start"
-  "figma-to-swift-ui-status-update"
-  "figma-to-swift-ui-test"
-  "figma-to-swift-ui-wiki"
-  "figma-to-swiftui"
-)
-LEAK=0
-for old in "${OLD_NAMES[@]}"; do
-  if [ -d "$SKILLS_DIR/$old" ]; then
-    fail "old name still present as directory: $old"
-    LEAK=$((LEAK+1))
-  fi
-done
-[ "$LEAK" -eq 0 ] && pass "all renamed directories use new names"
-
-echo ""
-echo "→ 8. new canonical names present (across figma-ios + figma-common)"
-NEW_NAMES=(
-  "figma-component-code-connect"
-  "figma-component-confluence-sync"
-  "figma-component-implement"
-  "figma-component-start"
-  "figma-component-status-update"
-  "figma-component-test"
-  "figma-component-wiki"
-  "figma-to-component"
-)
-for new in "${NEW_NAMES[@]}"; do
-  if [ -d "$IOS_DIR/$new" ] || [ -d "$COMMON_DIR/$new" ]; then
-    pass "new name present: $new"
-  else
-    fail "new name missing: $new"
-  fi
-done
-
-echo ""
-echo "→ 9. review checklist exists"
-[ -f "$SKILLS_DIR/REVIEW_CHECKLIST.md" ] && pass "REVIEW_CHECKLIST.md present" || fail "REVIEW_CHECKLIST.md missing"
-
-echo ""
-echo "→ 10. WS-2b — scripts landed (Python/shell files from upstream)"
-SCRIPT_COUNT=$(find "$IOS_DIR" "$COMMON_DIR" -type f \( -name '*.py' -o -name '*.sh' \) 2>/dev/null | wc -l | tr -d ' ')
-if [ "$SCRIPT_COUNT" -ge 30 ]; then
-  pass "imported $SCRIPT_COUNT python/shell scripts"
-else
-  fail "only $SCRIPT_COUNT scripts (expected ≥ 30 from upstream)"
-fi
-
-echo ""
-echo "→ 11. Imported scripts have executable bits on .sh + .py entrypoints"
-NONEXEC=0
-while IFS= read -r -d '' f; do
-  # Shebangs indicate entry points — they should be executable.
-  if head -n 1 "$f" 2>/dev/null | grep -q "^#!"; then
-    if [ ! -x "$f" ]; then
-      NONEXEC=$((NONEXEC+1))
-    fi
-  fi
-done < <(find "$IOS_DIR" "$COMMON_DIR" -type f \( -name '*.py' -o -name '*.sh' \) -print0 2>/dev/null)
-if [ "$NONEXEC" -eq 0 ]; then
-  pass "every shebanged script is executable"
-else
-  fail "$NONEXEC shebanged scripts lack +x"
-fi
-
-echo ""
-echo "══ figma-skill-import smoke: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-install-leak-gate.sh

@@ -1,125 +0,0 @@
-#!/usr/bin/env bash
-# smoke-install-leak-gate.sh — runs the actual install.js into a temp HOME,
-# then sweeps the installed tree for personal-data references that must never
-# reach end-user machines.
-#
-# Why this exists: install.js excludes 7 maintainer-only files from the copied
-# scripts/ directory (figma-placeholder-map.json, sync-figma-source.sh,
-# import-figma-skills.sh, smoke-figma-skill-import.sh, smoke-figma-config-schema.sh,
-# smoke-personal-data.sh, README-figma-smokes.md). If anyone accidentally
-# removes that exclude block — or adds a new dev-only file without listing it —
-# the maintainer's private upstream references would ship to end users. This
-# smoke is the regression lock.
-
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-PASS=0; FAIL=0
-ok()   { echo "  ✓ $1"; PASS=$((PASS+1)); }
-fail() { echo "  ✗ $1" >&2; FAIL=$((FAIL+1)); }
-
-INSTALL_JS="$REPO_ROOT/install.js"
-[ -f "$INSTALL_JS" ] || { fail "install.js missing"; exit 2; }
-
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-mkdir -p "$TMP/.claude" "$TMP/.copilot"
-
-echo "→ 1. install.js --all completes without error"
-if HOME="$TMP" node "$INSTALL_JS" --all >/dev/null 2>&1; then
-  ok "install completes (exit 0)"
-else
-  fail "install exited non-zero"
-  echo "══ aborted — install crashed ══"; exit 1
-fi
-
-echo "→ 2. Excluded dev-only files MUST NOT appear in installed scripts dir"
-EXCLUDED=(
-  "figma-placeholder-map.json"
-  "sync-figma-source.sh"
-  "import-figma-skills.sh"
-  "smoke-figma-skill-import.sh"
-  "smoke-figma-config-schema.sh"
-  "smoke-personal-data.sh"
-  "README-figma-smokes.md"
-)
-leaked=()
-for f in "${EXCLUDED[@]}"; do
-  if [ -e "$TMP/.claude/scripts/$f" ] || [ -e "$TMP/.copilot/scripts/$f" ]; then
-    leaked+=("$f")
-  fi
-done
-if [ ${#leaked[@]} -eq 0 ]; then
-  ok "all 7 dev-only files excluded from both Claude + Copilot trees"
-else
-  fail "leaked files: ${leaked[*]}"
-fi
-
-echo "→ 3. Installed tree is free of personal/corporate identifiers"
-# Patterns mirror smoke-personal-data.sh but applied to the INSTALLED output —
-# the surface end users see after running install.js.
-PATTERNS=(
-  '\bDIJITAL\b'
-  '\bM_ERDEN3_'
-  '\bjira\.thy\.com\b'
-  '\bbitbucket\.thy\.com\b'
-  '\bconfluence\.thy\.com\b'
-  '@thy\.com'
-  'mustafaerden@'
-  '\bDIJITAL-KANAL-COZUMLERI-DR-IOS\b'
-  '\bturkish-airlines'
-)
-hits=0
-for p in "${PATTERNS[@]}"; do
-  match=$(grep -rIE "$p" "$TMP/.claude/" "$TMP/.copilot/" 2>/dev/null | head -3 || true)
-  if [ -n "$match" ]; then
-    hits=$((hits+1))
-    echo "      ✗ pattern '$p' leaked:"
-    echo "$match" | sed 's/^/        /'
-  fi
-done
-if [ $hits -eq 0 ]; then
-  ok "${#PATTERNS[@]} sensitive patterns clean across the installed tree"
-else
-  fail "$hits / ${#PATTERNS[@]} patterns leaked into installed tree"
-fi
-
-echo "→ 4. Smoke files in install ARE invocable (don't break end-user testing)"
-# At minimum, smoke-schema-validation.sh and smoke-lib-scripts.sh should
-# install — they're the contract end users can run locally to verify their
-# own setup.
-ESSENTIAL=(
-  "smoke-schema-validation.sh"
-  "smoke-lib-scripts.sh"
-  "smoke-pref-migration.sh"
-)
-for s in "${ESSENTIAL[@]}"; do
-  if [ -x "$TMP/.claude/scripts/$s" ]; then
-    ok "$s installed + executable"
-  else
-    fail "$s missing or not executable in installed tree"
-  fi
-done
-
-echo "→ 5. End-user smokes run cleanly off the installed tree"
-# Pick a network-free smoke and run it pointing at the installed pipeline.
-# This catches regressions where install copies but breaks paths.
-HOME="$TMP" cd "$TMP" && bash "$TMP/.claude/scripts/smoke-schema-validation.sh" >/dev/null 2>&1
-if [ $? -eq 0 ]; then
-  ok "smoke-schema-validation passes against installed schemas"
-else
-  fail "smoke-schema-validation failed against installed tree"
-fi
-
-# --- Summary ----------------------------------------------------------------
-echo ""
-TOTAL=$((PASS+FAIL))
-if [ $FAIL -eq 0 ]; then
-  echo "══ install-leak-gate smoke: $PASS passed, 0 failed ══"
-  exit 0
-else
-  echo "══ install-leak-gate smoke: $PASS passed, $FAIL failed (of $TOTAL) ══" >&2
-  exit 1
-fi

package/pipeline/scripts/smoke-personal-data.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-# smoke-personal-data.sh — guard against personal/project-specific data leaking
-# into the published pipeline. Scans pipeline/ for forbidden patterns that
-# historically slipped in from the author's private projects.
-#
-# Run by CI and `npm test`. Fails with non-zero exit if any forbidden pattern
-# is found in the pipeline/ directory (excluding this script itself).
-
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-PIPELINE_DIR="$REPO_ROOT/pipeline"
-
-if [ ! -d "$PIPELINE_DIR" ]; then
-  echo "FAIL: pipeline/ not found at $PIPELINE_DIR" >&2
-  exit 1
-fi
-
-# Forbidden patterns — strings that must never appear in the generic pipeline
-# because they identify a specific user, org, or private project.
-#
-# Use ERE syntax (grep -E). Word-boundary `\b` is required for short keys
-# like "DIJITAL" so we don't false-positive on words like "DIGITAL".
-FORBIDDEN=(
-  # Private Jira project keys from author's day job
-  '\bDIJITAL\b'
-  # Private project directory names
-  '\bsmart-mobile(-ios)?\b'
-  '\bturkish-airlines(-ios)?-(figma|uicomponents|wiki|implementation-artifacts|mobile-common)\b'
-  '\bTurkish Airlines\b'
-  # Private GitHub org
-  'DIJITAL-KANAL-COZUMLERI-DR-IOS'
-  # Employer hostnames that leak through as defaults or examples
-  '\bjira\.thy\.com\b'
-  '\bconfluence\.thy\.com\b'
-  '\bbitbucket\.thy\.com\b'
-  '[a-zA-Z0-9._%+-]+@thy\.com'
-  # Author's personal websites / repos that wouldn't exist for downstream users
-  'mmerterden\.dev'
-  'mmerterden/remote-control'
-  'mmerterden/mmerterden\.dev'
-  # Author's macOS username in keychain lookups
-  'M_ERDEN3_'
-)
-
-PASS=0
-FAIL=0
-
-echo "→ Scanning $PIPELINE_DIR for personal-data leaks..."
-
-for pattern in "${FORBIDDEN[@]}"; do
-  # Exclude this script itself and the figma placeholder map (both legitimately
-  # enumerate the forbidden patterns as the rule catalog, not as leaks).
-  matches=$(grep -rEni \
-    --exclude="smoke-personal-data.sh" \
-    --exclude="smoke-install-leak-gate.sh" \
-    --exclude="figma-placeholder-map.json" \
-    --exclude=".last-figma-sync-plan.json" \
-    --exclude="REVIEW_CHECKLIST.md" \
-    "$pattern" "$PIPELINE_DIR" 2>/dev/null || true)
-  if [ -n "$matches" ]; then
-    echo "  ✗ Forbidden pattern found: $pattern"
-    echo "$matches" | sed 's/^/      /' | head -5
-    FAIL=$((FAIL+1))
-  else
-    PASS=$((PASS+1))
-  fi
-done
-
-echo ""
-echo "→ Result: $PASS patterns clean, $FAIL patterns leaking"
-
-if [ "$FAIL" -gt 0 ]; then
-  echo ""
-  echo "FAIL: personal-data patterns leaked into pipeline/" >&2
-  echo "Genericize to placeholders (e.g. {JIRA_KEY}, my-ios-app, {owner}) before committing." >&2
-  exit 1
-fi
-
-echo "PASS: no personal-data leaks in pipeline/"
-exit 0

package/pipeline/scripts/sync-figma-source.sh

@@ -1,228 +0,0 @@
-#!/usr/bin/env bash
-# sync-figma-source.sh — incremental sync from the upstream figma-to-component
-# source repo into pipeline/skills/figma-ios/. Wraps import-figma-skills.sh
-# but runs it ONLY for files touched since the recorded lastCommit, preserving
-# local review progress (REVIEW_CHECKLIST.md is never overwritten).
-#
-# Trigger flow:
-#   1. Read prefs.global.figmaSource.path + .branch + .lastCommit
-#   2. `git -C <path> fetch` + check out branch
-#   3. Compute changed files since lastCommit under .instructions/figma/ and .claude/skills/
-#   4. For each changed source skill, re-run the import with --only <name>
-#   5. Append a sync note to CHANGELOG.md
-#   6. Update prefs.global.figmaSource.lastCommit + lastSyncedAt (atomic)
-#
-# Safe to re-run — placeholder transforms are idempotent. REVIEW_CHECKLIST.md
-# is preserved (never in the import output set).
-#
-# Usage:
-#   ./sync-figma-source.sh [--plan] [--dry-run] [--force-full]
-#
-#   --plan         Emit a structured JSON sync plan + human-readable summary.
-#                  Writes nothing. Use this before approving an upstream sync
-#                  so the v5 structure (local overlays, renames, figma-common
-#                  extraction) is inspected before it's touched.
-#   --dry-run      Same as --plan but just logs, no JSON artifact.
-#   --force-full   Re-import every skill (same as running import-figma-skills.sh).
-
-set -euo pipefail
-
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-PREFS_FILE="${MULTI_AGENT_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
-IMPORT="$HERE/import-figma-skills.sh"
-TARGET="$ROOT/pipeline/skills/figma-ios"
-
-DRY_RUN="false"
-FORCE_FULL="false"
-PLAN="false"
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --plan)       PLAN="true"; DRY_RUN="true"; shift ;;
-    --dry-run)    DRY_RUN="true"; shift ;;
-    --force-full) FORCE_FULL="true"; shift ;;
-    *) echo "error: unknown arg '$1'" >&2; exit 1 ;;
-  esac
-done
-
-need() { command -v "$1" >/dev/null 2>&1 || { echo "error: $1 required" >&2; exit 127; }; }
-need jq
-need git
-
-if [ ! -f "$PREFS_FILE" ]; then
-  echo "error: prefs file not found at $PREFS_FILE (run /multi-agent:setup first)" >&2
-  exit 1
-fi
-
-SRC_PATH=$(jq -r '.global.figmaSource.path // empty' "$PREFS_FILE")
-SRC_BRANCH=$(jq -r '.global.figmaSource.branch // "develop"' "$PREFS_FILE")
-LAST_COMMIT=$(jq -r '.global.figmaSource.lastCommit // empty' "$PREFS_FILE")
-
-if [ -z "$SRC_PATH" ]; then
-  echo "→ figmaSource not configured in prefs — skipping sync."
-  echo "  To enable: set prefs.global.figmaSource.path to the upstream repo."
-  exit 0
-fi
-if [ ! -d "$SRC_PATH" ]; then
-  echo "error: figmaSource.path does not exist: $SRC_PATH" >&2
-  exit 1
-fi
-
-echo "→ syncing from $SRC_PATH (branch $SRC_BRANCH)"
-
-# Fetch + checkout quietly
-git -C "$SRC_PATH" fetch --quiet origin "$SRC_BRANCH" 2>/dev/null || {
-  echo "  ⚠ fetch failed, proceeding with local state"
-}
-git -C "$SRC_PATH" checkout --quiet "$SRC_BRANCH" 2>/dev/null || true
-
-NEW_COMMIT=$(git -C "$SRC_PATH" rev-parse HEAD)
-echo "  new commit: $NEW_COMMIT"
-if [ -n "$LAST_COMMIT" ]; then
-  echo "  last commit: $LAST_COMMIT"
-  if [ "$LAST_COMMIT" = "$NEW_COMMIT" ] && [ "$FORCE_FULL" != "true" ]; then
-    echo "→ already at tip — nothing to sync."
-    exit 0
-  fi
-fi
-
-# Determine which skills changed
-CHANGED_SKILLS=()
-if [ "$FORCE_FULL" = "true" ] || [ -z "$LAST_COMMIT" ]; then
-  echo "  mode: FULL (no previous lastCommit or --force-full)"
-  # Enumerate all skills under .instructions/figma/
-  while IFS= read -r d; do
-    CHANGED_SKILLS+=("$(basename "$d")")
-  done < <(find "$SRC_PATH/.instructions/figma" -maxdepth 1 -mindepth 1 -type d | sort)
-else
-  echo "  mode: INCREMENTAL (diff $LAST_COMMIT..$NEW_COMMIT)"
-  # Extract skill names from changed paths under .instructions/figma/{skill}/...
-  while IFS= read -r f; do
-    # f looks like ".instructions/figma/figma-to-swiftui/phases/phase-0-init.md"
-    name=$(echo "$f" | awk -F/ '{print $3}')
-    [ -n "$name" ] && CHANGED_SKILLS+=("$name")
-  done < <(git -C "$SRC_PATH" diff --name-only "$LAST_COMMIT..$NEW_COMMIT" -- ".instructions/figma/" 2>/dev/null || true)
-  # dedupe
-  if [ "${#CHANGED_SKILLS[@]}" -gt 0 ]; then
-    CHANGED_SKILLS=($(printf '%s\n' "${CHANGED_SKILLS[@]}" | sort -u))
-  fi
-fi
-
-if [ "${#CHANGED_SKILLS[@]}" -eq 0 ]; then
-  echo "→ no skill changes since lastCommit — updating watermark only."
-else
-  echo "  skills to sync: ${#CHANGED_SKILLS[@]}"
-  printf '    - %s\n' "${CHANGED_SKILLS[@]}"
-fi
-
-if [ "$PLAN" = "true" ]; then
-  # Emit a structured JSON plan so a reviewer (human or LLM) can inspect
-  # what will change before we touch anything. Key invariants the v5
-  # structure must preserve:
-  #   - figma-ios/ holds only 5 platform-specific skills
-  #   - figma-common/ holds everything else
-  #   - skills with `local-overlay: true` are SKIPPED on apply
-  #   - figma-android/ is untouched (no upstream source today)
-  IOS_ONLY_SET=(figma-to-component figma-component-implement figma-component-test figma-component-code-connect figma-component-wiki)
-  is_ios_only() {
-    local name="$1"
-    for o in "${IOS_ONLY_SET[@]}"; do [ "$name" = "$o" ] && return 0; done
-    return 1
-  }
-
-  PLAN_OUT="$ROOT/pipeline/scripts/.last-figma-sync-plan.json"
-  {
-    echo "{"
-    echo "  \"source\": { \"path\": \"$SRC_PATH\", \"branch\": \"$SRC_BRANCH\", \"commit\": \"$NEW_COMMIT\", \"lastCommit\": \"$LAST_COMMIT\" },"
-    echo "  \"summary\": { \"changedSkills\": ${#CHANGED_SKILLS[@]} },"
-    echo "  \"changes\": ["
-    first=1
-    for skill in "${CHANGED_SKILLS[@]}"; do
-      # Rename lookup
-      new_name=$(jq -r --arg s "$skill" '.renames[] | select(.from == $s) | .to' "$HERE/figma-placeholder-map.json")
-      [ -z "$new_name" ] && new_name="$skill"
-      # Destination tree
-      dest=$(is_ios_only "$new_name" && echo "figma-ios" || echo "figma-common")
-      # Overlay detection — if skill has local-overlay: true, it's SKIPPED on apply
-      overlay_skip="false"
-      if [ -f "$ROOT/pipeline/skills/$dest/$new_name/SKILL.md" ] && grep -q "^local-overlay: true" "$ROOT/pipeline/skills/$dest/$new_name/SKILL.md" 2>/dev/null; then
-        overlay_skip="true"
-      fi
-      [ "$first" -eq 1 ] && first=0 || echo ","
-      printf '    { "upstream": "%s", "local": "%s", "tree": "%s", "renamed": %s, "overlaySkip": %s }' \
-        "$skill" "$new_name" "$dest" "$([ "$skill" != "$new_name" ] && echo true || echo false)" "$overlay_skip"
-    done
-    echo ""
-    echo "  ],"
-    echo "  \"postActions\": ["
-    echo "    \"run \`npm run test:smoke\` — all 28 suites must stay green\","
-    echo "    \"review figma-ios/REVIEW_CHECKLIST.md for skills still WIP\","
-    echo "    \"commit with \\\"chore(sync): upstream @ $NEW_COMMIT\\\"\""
-    echo "  ]"
-    echo "}"
-  } > "$PLAN_OUT"
-
-  echo ""
-  echo "→ Plan written to: $PLAN_OUT"
-  echo "→ Summary:"
-  jq -r '
-    "  " + (.summary.changedSkills | tostring) + " skill changes since " + (.source.lastCommit // "first-sync"),
-    "",
-    "  Changes:",
-    (.changes[] | "    - " + .upstream + (if .renamed then " → " + .local else "" end) + " → " + .tree + (if .overlaySkip then "  (OVERLAY — skip on apply)" else "" end))
-  ' "$PLAN_OUT"
-  echo ""
-  echo "→ To apply: re-run without --plan:"
-  echo "    bash $0"
-  exit 0
-fi
-
-if [ "$DRY_RUN" = "true" ]; then
-  echo "→ DRY RUN — no changes written."
-  exit 0
-fi
-
-# Delegate to the importer. Current importer re-runs against all skills,
-# which is safe (idempotent transforms). When --only is added to the
-# importer (follow-up), this invocation switches to per-skill.
-if [ "${#CHANGED_SKILLS[@]}" -gt 0 ]; then
-  FIGMA_SOURCE="$SRC_PATH" bash "$IMPORT" >/dev/null
-  echo "  ✓ imported ${#CHANGED_SKILLS[@]} skills"
-fi
-
-# CHANGELOG append
-CHANGELOG="$ROOT/CHANGELOG.md"
-if [ -f "$CHANGELOG" ]; then
-  TS=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-  {
-    echo ""
-    echo "### Sync $(date -u +"%Y-%m-%d") (@ $NEW_COMMIT) — figma source"
-    echo ""
-    if [ "${#CHANGED_SKILLS[@]}" -eq 0 ]; then
-      echo "- no skill changes"
-    else
-      for s in "${CHANGED_SKILLS[@]}"; do
-        echo "- updated \`$s\`"
-      done
-    fi
-  } > /tmp/sync-figma-note.md
-  # Insert after "## [Unreleased]" line
-  awk -v note_file="/tmp/sync-figma-note.md" '
-    BEGIN { while ((getline line < note_file) > 0) note = note "\n" line }
-    /^## \[Unreleased\]/ && !done { print; print note; done=1; next }
-    { print }
-  ' "$CHANGELOG" > "$CHANGELOG.tmp"
-  mv "$CHANGELOG.tmp" "$CHANGELOG"
-  rm -f /tmp/sync-figma-note.md
-  echo "  ✓ CHANGELOG updated"
-fi
-
-# Update watermark (atomic rename)
-TMP=$(mktemp)
-jq --arg c "$NEW_COMMIT" --arg t "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-  '.global.figmaSource.lastCommit = $c | .global.figmaSource.lastSyncedAt = $t' \
-  "$PREFS_FILE" > "$TMP"
-mv "$TMP" "$PREFS_FILE"
-echo "  ✓ watermark updated (lastCommit=$NEW_COMMIT)"
-
-echo "→ sync complete."