@zeyue0329/xiaoma-cli 1.6.4 → 1.7.0

package/tools/cli/lib/ui.js

@@ -51,7 +51,7 @@ class UI {
       confirmedDirectory = await this.getConfirmedDirectory();
     }
 
-    // Preflight: Check for legacy XiaoMa v4 footprints immediately after getting directory
+    // Preflight: Check for legacy BMAD v4 footprints immediately after getting directory
     const { Detector } = require('../installers/lib/core/detector');
     const { Installer } = require('../installers/lib/core/installer');
     const detector = new Detector();
@@ -63,9 +63,9 @@ class UI {
 
     // Check for legacy folders and prompt for rename before showing any menus
     let hasLegacyCfg = false;
-    let hasLegacyXiaoMaFolder = false;
+    let hasLegacyBmadFolder = false;
     let xiaomaDir = null;
-    let legacyXiaoMaPath = null;
+    let legacyBmadPath = null;
 
     // First check for legacy .xiaoma folder (instead of _xiaoma)
     // Only check if directory exists
@@ -73,12 +73,12 @@ class UI {
       const entries = await fs.readdir(confirmedDirectory, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory() && (entry.name === '.xiaoma' || entry.name === 'xiaoma')) {
-          hasLegacyXiaoMaFolder = true;
-          legacyXiaoMaPath = path.join(confirmedDirectory, entry.name);
-          xiaomaDir = legacyXiaoMaPath;
+          hasLegacyBmadFolder = true;
+          legacyBmadPath = path.join(confirmedDirectory, entry.name);
+          xiaomaDir = legacyBmadPath;
 
           // Check if it has _cfg folder
-          const cfgPath = path.join(legacyXiaoMaPath, '_cfg');
+          const cfgPath = path.join(legacyBmadPath, '_cfg');
           if (await fs.pathExists(cfgPath)) {
             hasLegacyCfg = true;
           }
@@ -88,7 +88,7 @@ class UI {
     }
 
     // If no .xiaoma or xiaoma found, check for current installations _xiaoma
-    if (!hasLegacyXiaoMaFolder) {
+    if (!hasLegacyBmadFolder) {
       const xiaomaResult = await installer.findXiaomaDir(confirmedDirectory);
       xiaomaDir = xiaomaResult.xiaomaDir;
       hasLegacyCfg = xiaomaResult.hasLegacyCfg;
@@ -96,7 +96,7 @@ class UI {
 
     // Handle legacy .xiaoma or _cfg folder - these are very old (v4 or alpha)
     // Show version warning instead of offering conversion
-    if (hasLegacyXiaoMaFolder || hasLegacyCfg) {
+    if (hasLegacyBmadFolder || hasLegacyCfg) {
       await prompts.log.warn('LEGACY INSTALLATION DETECTED');
       await prompts.note(
         'Found a ".xiaoma"/"xiaoma" folder, or a legacy "_cfg" folder under the xiaoma folder -\n' +
@@ -150,11 +150,11 @@ class UI {
       s.start('Updating folder structure...');
       try {
         // Handle .xiaoma folder
-        if (hasLegacyXiaoMaFolder) {
-          const newXiaoMaPath = path.join(confirmedDirectory, '_xiaoma');
-          await fs.move(legacyXiaoMaPath, newXiaoMaPath);
-          xiaomaDir = newXiaoMaPath;
-          s.stop(`Renamed "${path.basename(legacyXiaoMaPath)}" to "_xiaoma"`);
+        if (hasLegacyBmadFolder) {
+          const newXiaomaPath = path.join(confirmedDirectory, '_xiaoma');
+          await fs.move(legacyBmadPath, newXiaomaPath);
+          xiaomaDir = newXiaomaPath;
+          s.stop(`Renamed "${path.basename(legacyBmadPath)}" to "_xiaoma"`);
         }
 
         // Handle _cfg folder (either from .xiaoma or standalone)
@@ -220,7 +220,7 @@ class UI {
       }
 
       // Common actions
-      choices.push({ name: 'Modify XiaoMa Installation', value: 'update' });
+      choices.push({ name: 'Modify BMAD Installation', value: 'update' });
 
       // Check if action is provided via command-line
       if (options.action) {
@@ -426,9 +426,9 @@ class UI {
             // Preserve existing custom modules if user doesn't want to modify them
             const { Installer } = require('../installers/lib/core/installer');
             const installer = new Installer();
-            const { xiaomaDir } = await installer.findXiaomaDir(confirmedDirectory);
+            const { xiaomaDir: discoveredXiaomaDir } = await installer.findXiaomaDir(confirmedDirectory);
 
-            const cacheDir = path.join(xiaomaDir, '_config', 'custom');
+            const cacheDir = path.join(discoveredXiaomaDir, '_config', 'custom');
             if (await fs.pathExists(cacheDir)) {
               const entries = await fs.readdir(cacheDir, { withFileTypes: true });
               for (const entry of entries) {
@@ -837,8 +837,8 @@ class UI {
     const { Installer } = require('../installers/lib/core/installer');
     const detector = new Detector();
     const installer = new Installer();
-    const xiaomaDirResult = await installer.findXiaomaDir(directory);
-    const xiaomaDir = xiaomaDirResult.xiaomaDir;
+    const xiaomaResult = await installer.findXiaomaDir(directory);
+    const xiaomaDir = xiaomaResult.xiaomaDir;
     const existingInstall = await detector.detect(xiaomaDir);
     const installedModuleIds = new Set(existingInstall.modules.map((mod) => mod.id));
 
@@ -888,6 +888,26 @@ class UI {
         (!options.userName || !options.communicationLanguage || !options.documentOutputLanguage || !options.outputFolder)
       ) {
         await configCollector.collectModuleConfig('core', directory, false, true);
+      } else if (options.yes) {
+        // Fill in defaults for any missing core config keys when --yes is set
+        let safeUsername;
+        try {
+          safeUsername = os.userInfo().username;
+        } catch {
+          safeUsername = process.env.USER || process.env.USERNAME || 'User';
+        }
+        const defaultUsername = safeUsername.charAt(0).toUpperCase() + safeUsername.slice(1);
+        const defaults = {
+          user_name: defaultUsername,
+          communication_language: 'English',
+          document_output_language: 'English',
+          output_folder: '_xiaoma-output',
+        };
+        for (const [key, defaultVal] of Object.entries(defaults)) {
+          if (!configCollector.collectedConfig.core[key]) {
+            configCollector.collectedConfig.core[key] = defaultVal;
+          }
+        }
       }
     } else if (options.yes) {
       // Use all defaults when --yes flag is set
@@ -1028,7 +1048,7 @@ class UI {
     const lockedValues = ['core'];
 
     // Core module is always installed — show it locked at the top
-    allOptions.push({ label: 'XiaoMa Core Module', value: 'core', hint: 'Core configuration and shared resources' });
+    allOptions.push({ label: 'BMad Core Module', value: 'core', hint: 'Core configuration and shared resources' });
     initialValues.push('core');
 
     // Helper to build module entry with proper sorting and selection
@@ -1174,11 +1194,11 @@ class UI {
           const { Installer } = require('../installers/lib/core/installer');
           const installer = new Installer();
           const xiaomaResult = await installer.findXiaomaDir(directory);
-          const hasXiaoMaInstall =
+          const hasXiaomaInstall =
             (await fs.pathExists(xiaomaResult.xiaomaDir)) &&
             (await fs.pathExists(path.join(xiaomaResult.xiaomaDir, '_config', 'manifest.yaml')));
 
-          const xiaomaNote = hasXiaoMaInstall ? ` including existing XiaoMa installation (${path.basename(xiaomaResult.xiaomaDir)})` : '';
+          const xiaomaNote = hasXiaomaInstall ? ` including existing XiaoMa installation (${path.basename(xiaomaResult.xiaomaDir)})` : '';
           await prompts.log.message(`Directory exists and contains ${files.length} item(s)${xiaomaNote}`);
         } else {
           await prompts.log.message('Directory exists and is empty');
@@ -1747,17 +1767,17 @@ class UI {
    * Show warning for legacy version (v4 or alpha) and ask if user wants to proceed
    * @param {string} installedVersion - The installed version
    * @param {string} currentVersion - The current version
-   * @param {string} xiaomaFolderName - Name of the XiaoMa folder
+   * @param {string} bmadFolderName - Name of the xiaoma folder
    * @returns {Promise<boolean>} True if user wants to proceed, false if they cancel
    */
-  async showLegacyVersionWarning(installedVersion, currentVersion, xiaomaFolderName, options = {}) {
+  async showLegacyVersionWarning(installedVersion, currentVersion, bmadFolderName, options = {}) {
     if (!this.isLegacyVersion(installedVersion)) {
       return true; // Not legacy, proceed
     }
 
     let warningContent;
     if (installedVersion === 'unknown') {
-      warningContent = 'Unable to detect your installed XiaoMa version.\n' + 'This appears to be a legacy or unsupported installation.';
+      warningContent = 'Unable to detect your installed BMAD version.\n' + 'This appears to be a legacy or unsupported installation.';
     } else {
       warningContent =
         `You are updating from ${installedVersion} to ${currentVersion}.\n` + 'You have a legacy version installed (v4 or alpha).';
@@ -1765,8 +1785,8 @@ class UI {
 
     warningContent +=
       '\n\nFor the best experience, we recommend:\n' +
-      '  1. Delete your current XiaoMa installation folder\n' +
-      `     (the "${xiaomaFolderName}/" folder in your project)\n` +
+      '  1. Delete your current BMAD installation folder\n' +
+      `     (the "${bmadFolderName}/" folder in your project)\n` +
       '  2. Run a fresh installation\n\n' +
       'Benefits of a fresh install:\n' +
       '  \u2022 Cleaner configuration without legacy artifacts\n' +
@@ -1798,7 +1818,7 @@ class UI {
 
     if (proceed === 'cancel') {
       await prompts.note(
-        `1. Delete the "${xiaomaFolderName}/" folder in your project\n` + "2. Run 'xiaoma install' again",
+        `1. Delete the "${bmadFolderName}/" folder in your project\n` + "2. Run 'xiaoma install' again",
         'To do a fresh install',
       );
     }
@@ -1903,7 +1923,7 @@ class UI {
       `Last Updated:  ${installation.lastUpdated ? new Date(installation.lastUpdated).toLocaleDateString() : 'unknown'}`,
     ];
 
-    await prompts.note(infoLines.join('\n'), 'XiaoMa Status');
+    await prompts.note(infoLines.join('\n'), 'BMAD Status');
 
     // Module versions
     await this.displayModuleVersions(modules, availableUpdates);

package/tools/cli/lib/xml-handler.js

@@ -5,7 +5,7 @@ const { getProjectRoot, getSourcePath } = require('./project-root');
 const { YamlXmlBuilder } = require('./yaml-xml-builder');
 
 /**
- * XML utility functions for XiaoMa installer
+ * XML utility functions for BMAD installer
  * Now supports both legacy XML agents and new YAML-based agents
  */
 class XmlHandler {

package/tools/cli/lib/yaml-format.js

@@ -14,7 +14,7 @@ async function initializeModules() {
 }
 
 /**
- * YAML Formatter and Linter for XiaoMa-Method
+ * YAML Formatter and Linter for BMad-Method
  * Formats and validates YAML files and YAML embedded in Markdown
  */
 

package/tools/cli/lib/yaml-xml-builder.js

@@ -170,7 +170,7 @@ class YamlXmlBuilder {
 
     if (buildMetadata.forWebBundle) {
       // Web bundle: keep existing format
-      xml += '<!-- Powered by XiaoMa-CORE™ -->\n\n';
+      xml += '<!-- Powered by BMAD-CORE™ -->\n\n';
       xml += `# ${metadata.title || 'Agent'}\n\n`;
     } else {
       // Installation: use YAML frontmatter + instruction
@@ -182,7 +182,7 @@ class YamlXmlBuilder {
 
       xml += '---\n';
       xml += `name: "${nameFromFile}"\n`;
-      xml += `description: "${metadata.title || 'XiaoMa Agent'}"\n`;
+      xml += `description: "${metadata.title || 'BMAD Agent'}"\n`;
       xml += '---\n\n';
       xml +=
         "You must fully embody this agent's persona and follow all activation instructions exactly as specified. NEVER break character until given an exit command.\n\n";

package/tools/cli/xiaoma-cli.js

@@ -14,7 +14,7 @@ if (process.stdin?.setMaxListeners) {
 
 // Check for updates - do this asynchronously so it doesn't block startup
 const packageJson = require('../../package.json');
-const packageName = 'xiaoma-cli';
+const packageName = '@zeyue0329/xiaoma-cli';
 checkForUpdate().catch(() => {
   // Silently ignore errors - version check is best-effort
 });
@@ -41,7 +41,7 @@ async function checkForUpdate() {
         `You are using version ${packageJson.version} but ${result} is available.`,
         '',
         'To update, exit and first run:',
-        `  npm cache clean --force && npx xiaoma-cli@${tag} install`,
+        `  npm cache clean --force && npx @zeyue0329/xiaoma-cli@${tag} install`,
       ].join('\n');
       await prompts.box(updateMsg, 'Update Available', {
         rounded: true,
@@ -82,7 +82,7 @@ for (const file of commandFiles) {
 }
 
 // Set up main program
-program.version(packageJson.version).description('XiaoMa Core CLI - Universal AI agent framework');
+program.version(packageJson.version).description('BMAD Core CLI - Universal AI agent framework');
 
 // Register all commands
 for (const [name, cmd] of Object.entries(commands)) {

package/tools/format-workflow-md.js

@@ -1,5 +1,5 @@
 /**
- * XiaoMa Workflow Markdown Formatter
+ * BMAD Workflow Markdown Formatter
  *
  * Formats mixed markdown + XML workflow instruction files with:
  * - 2-space XML indentation
@@ -195,7 +195,7 @@ function main() {
 
   if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
     console.log(`
-XiaoMa Workflow Markdown Formatter
+BMAD Workflow Markdown Formatter
 
 Usage:
   node format-workflow-md.js <file-pattern> [options]

package/tools/platform-codes.yaml

@@ -1,5 +1,5 @@
-# XiaoMa Platform Codes Configuration
-# Central configuration for all platform/IDE codes used in the XiaoMa system
+# BMAD Platform Codes Configuration
+# Central configuration for all platform/IDE codes used in the BMAD system
 #
 # This file defines the standardized platform codes that are used throughout
 # the installation system to identify different platforms (IDEs, tools, etc.)

package/tools/schema/agent.js

@@ -327,7 +327,7 @@ function buildMenuItemSchema() {
                   });
                 }
               }),
-            // Format 2a: Object with array format (like xiaoma-builder.agent.yaml)
+            // Format 2a: Object with array format (like bmad-builder.agent.yaml)
             z
               .object({})
               .passthrough()

package/tools/skill-validator.md

@@ -0,0 +1,322 @@
+# Skill Validator — Inference-Based
+
+An LLM-readable validation prompt for skills following the Agent Skills open standard.
+
+## How to Use
+
+1. You are given a **skill directory path** to validate.
+2. Read every file in the skill directory recursively.
+3. Apply every rule in the catalog below to every applicable file.
+4. Produce a findings report using the report template at the end.
+
+If no findings are generated, the skill passes validation.
+
+---
+
+## Definitions
+
+- **Skill directory**: the folder containing `SKILL.md` and all supporting files.
+- **Internal reference**: a file path from one file in the skill to another file in the same skill.
+- **External reference**: a file path from a skill file to a file outside the skill directory.
+- **Originating file**: the file that contains the reference (path resolution is relative to this file's location).
+- **Config variable**: a name-value pair whose value comes from the project config file (e.g., `planning_artifacts`, `implementation_artifacts`, `communication_language`).
+- **Runtime variable**: a name-value pair whose value is set during workflow execution (e.g., `spec_file`, `date`, `status`).
+- **Intra-skill path variable**: a frontmatter variable whose value is a path to another file within the same skill — this is an anti-pattern.
+
+---
+
+## Rule Catalog
+
+### SKILL-01 — SKILL.md Must Exist
+
+- **Severity:** CRITICAL
+- **Applies to:** skill directory
+- **Rule:** The skill directory must contain a file named `SKILL.md` (exact case).
+- **Detection:** Check for the file's existence.
+- **Fix:** Create `SKILL.md` as the skill entrypoint.
+
+### SKILL-02 — SKILL.md Must Have `name` in Frontmatter
+
+- **Severity:** CRITICAL
+- **Applies to:** `SKILL.md`
+- **Rule:** The YAML frontmatter must contain a `name` field.
+- **Detection:** Parse the `---` delimited frontmatter block and check for `name:`.
+- **Fix:** Add `name: <skill-name>` to the frontmatter.
+
+### SKILL-03 — SKILL.md Must Have `description` in Frontmatter
+
+- **Severity:** CRITICAL
+- **Applies to:** `SKILL.md`
+- **Rule:** The YAML frontmatter must contain a `description` field.
+- **Detection:** Parse the `---` delimited frontmatter block and check for `description:`.
+- **Fix:** Add `description: '<what it does and when to use it>'` to the frontmatter.
+
+### SKILL-04 — `name` Format
+
+- **Severity:** HIGH
+- **Applies to:** `SKILL.md`
+- **Rule:** The `name` value must use only lowercase letters, numbers, and hyphens. Max 64 characters. Must not contain "anthropic" or "claude".
+- **Detection:** Regex test: `^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$`. String search for forbidden substrings.
+- **Fix:** Rename to comply with the format.
+
+### SKILL-05 — `name` Must Match Directory Name
+
+- **Severity:** HIGH
+- **Applies to:** `SKILL.md`
+- **Rule:** The `name` value in SKILL.md frontmatter must exactly match the skill directory name. The directory name is the canonical identifier used by installers, manifests, and `skill:` references throughout the project.
+- **Detection:** Compare the `name:` frontmatter value against the basename of the skill directory (i.e., the immediate parent directory of `SKILL.md`).
+- **Fix:** Change the `name:` value to match the directory name, or rename the directory to match — prefer changing `name:` unless other references depend on the current value.
+
+### SKILL-06 — `description` Quality
+
+- **Severity:** MEDIUM
+- **Applies to:** `SKILL.md`
+- **Rule:** The `description` must state both what the skill does AND when to use it. Max 1024 characters.
+- **Detection:** Check length. Look for trigger phrases like "Use when" or "Use if" — their absence suggests the description only says _what_ but not _when_.
+- **Fix:** Append a "Use when..." clause to the description.
+
+---
+
+### WF-01 — workflow.md Must NOT Have `name` in Frontmatter
+
+- **Severity:** HIGH
+- **Applies to:** `workflow.md` (if it exists)
+- **Rule:** The `name` field belongs only in `SKILL.md`. If `workflow.md` has YAML frontmatter, it must not contain `name:`.
+- **Detection:** Parse frontmatter and check for `name:` key.
+- **Fix:** Remove the `name:` line from workflow.md frontmatter.
+
+### WF-02 — workflow.md Must NOT Have `description` in Frontmatter
+
+- **Severity:** HIGH
+- **Applies to:** `workflow.md` (if it exists)
+- **Rule:** The `description` field belongs only in `SKILL.md`. If `workflow.md` has YAML frontmatter, it must not contain `description:`.
+- **Detection:** Parse frontmatter and check for `description:` key.
+- **Fix:** Remove the `description:` line from workflow.md frontmatter.
+
+### WF-03 — workflow.md Frontmatter Variables Must Be Config or Runtime Only
+
+- **Severity:** HIGH
+- **Applies to:** `workflow.md` frontmatter
+- **Rule:** Every variable defined in workflow.md frontmatter must be either:
+  - A config variable (value references `{project-root}` or a config-derived variable like `{planning_artifacts}`)
+  - A runtime variable (value is empty, a placeholder, or set during execution)
+  - A legitimate external path expression (must not violate PATH-05 — no paths into another skill's directory)
+
+  It must NOT be a path to a file within the skill directory (see PATH-04), nor a path into another skill's directory (see PATH-05).
+- **Detection:** For each frontmatter variable, check if its value resolves to a file inside the skill (e.g., starts with `./`, `{installed_path}`, or is a bare relative path to a sibling file). If so, it is an intra-skill path variable. Also check if the value is a path into another skill's directory — if so, it violates PATH-05 and is not a legitimate external path.
+- **Fix:** Remove the variable. Use a hardcoded relative path inline where the file is referenced.
+
+---
+
+### PATH-01 — Internal References Must Be Relative From Originating File
+
+- **Severity:** CRITICAL
+- **Applies to:** all files in the skill
+- **Rule:** Any reference from one file in the skill to another file in the same skill must be a relative path resolved from the directory of the originating file. Use `./` prefix for siblings or children, `../` for parent traversal. Bare relative filenames in markdown links (e.g., `[text](sibling.md)`) are also acceptable.
+- **Detection:** Scan for file path references (in markdown links, frontmatter values, inline backtick paths, and prose instructions like "Read fully and follow"). Verify each internal reference uses relative notation (`./`, `../`, or bare filename). Always resolve the path from the originating file's directory — a reference to `./steps/step-01.md` from a file already inside `steps/` would resolve to `steps/steps/step-01.md`, which is wrong.
+- **Examples:**
+  - CORRECT: `./steps/step-01-init.md` (from workflow.md at skill root to a step)
+  - CORRECT: `./template.md` (from workflow.md to a sibling)
+  - CORRECT: `../template.md` (from steps/step-01.md to a skill-root file)
+  - CORRECT: `[workflow.md](workflow.md)` (markdown link to sibling — bare relative)
+  - CORRECT: `./step-02-plan.md` (from steps/step-01.md to a sibling step)
+  - WRONG: `./steps/step-02-plan.md` (from a file already inside steps/ — resolves to steps/steps/)
+  - WRONG: `{installed_path}/template.md`
+  - WRONG: `{project-root}/.claude/skills/my-skill/template.md`
+  - WRONG: `/Users/someone/.claude/skills/my-skill/steps/step-01.md`
+  - WRONG: `~/.claude/skills/my-skill/file.md`
+
+### PATH-02 — No `installed_path` Variable
+
+- **Severity:** HIGH
+- **Applies to:** all files in the skill
+- **Rule:** The `installed_path` variable is an anti-pattern from the pre-skill workflow era. It must not be defined in any frontmatter, and `{installed_path}` must not appear anywhere in any file.
+- **Detection:** Search all files for:
+  - Frontmatter key `installed_path:`
+  - String `{installed_path}` anywhere in content
+  - Markdown/prose assigning `installed_path` (e.g., `` `installed_path` = `.` ``)
+- **Fix:** Remove all `installed_path` definitions. Replace every `{installed_path}/path` with `./path` (relative from the file that contains the reference). If the reference is in a step file and points to a skill-root file, use `../path` instead.
+
+### PATH-03 — External References Must Use `{project-root}` or Config Variables
+
+- **Severity:** HIGH
+- **Applies to:** all files in the skill
+- **Rule:** References to files outside the skill directory must use `{project-root}/...` or a config-derived variable path (e.g., `{planning_artifacts}/...`, `{implementation_artifacts}/...`).
+- **Detection:** Identify file references that point outside the skill. Verify they start with `{project-root}` or a known config variable. Flag absolute paths, home-relative paths (`~/`), or bare paths that resolve outside the skill.
+- **Fix:** Replace with `{project-root}/...` or the appropriate config variable.
+
+### PATH-05 — No File Path References Into Another Skill
+
+- **Severity:** HIGH
+- **Applies to:** all files in the skill
+- **Rule:** A skill must never reference any file inside another skill's directory by file path. Skill directories are encapsulated — their internal files (steps, templates, checklists, data files, workflow.md) are private implementation details. The only valid way to reference another skill is via `skill:skill-name` syntax, which invokes the skill as a unit. Reaching into another skill to cherry-pick an internal file (e.g., a template, a step, or even its workflow.md) breaks encapsulation and creates fragile coupling that breaks when the target skill is moved or reorganized.
+- **Detection:** For each external file reference (frontmatter values, markdown links, inline paths), check whether the resolved path points into a directory that is or contains a skill (has a `SKILL.md`). Patterns to flag:
+  - `{project-root}/_bmad/.../other-skill/anything.md`
+  - `{project-root}/_bmad/.../other-skill/steps/...`
+  - `{project-root}/_bmad/.../other-skill/templates/...`
+  - References to old pre-conversion locations that were skill directories (e.g., `core/workflows/skill-name/` when the skill has since moved to `core/skills/skill-name/`)
+- **Fix:**
+  - If the intent is to invoke the other skill: replace with `skill:skill-name`.
+  - If the intent is to use a shared resource (template, data file): the resource should be extracted to a shared location outside both skills (e.g., `core/data/`, `bmm/data/`, or a config-referenced path) — not reached into from across skill boundaries.
+
+### PATH-04 — No Intra-Skill Path Variables
+
+- **Severity:** MEDIUM
+- **Applies to:** all files (frontmatter AND body content)
+- **Rule:** Variables must not store paths to files within the same skill. These paths should be hardcoded as relative paths inline where used. This applies to YAML frontmatter variables AND markdown body variable assignments (e.g., `` `template` = `./template.md` `` under a `### Paths` section).
+- **Detection:** For each variable with a path-like value — whether defined in frontmatter or in body text — determine if the target is inside the skill directory. Indicators: value starts with `./`, `../`, `{installed_path}`, or is a bare filename of a file that exists in the skill. Exclude variables whose values are prefixed with a config variable like `{planning_artifacts}`, `{implementation_artifacts}`, `{project-root}`, or other config-derived paths — these are external references and are legitimate.
+- **Fix:** Remove the variable. Replace each `{variable_name}` usage with the direct relative path.
+- **Exception:** If a path variable is used in 4+ locations across multiple files and the path is non-trivial, a variable MAY be acceptable. Flag it as LOW instead and note the exception.
+
+---
+
+### STEP-01 — Step File Naming
+
+- **Severity:** MEDIUM
+- **Applies to:** files in `steps/` directory
+- **Rule:** Step files must be named `step-NN-description.md` where NN is a zero-padded two-digit number. An optional single-letter variant suffix is allowed for branching steps (e.g., `step-01b-continue.md`).
+- **Detection:** Regex: `^step-\d{2}[a-z]?-[a-z0-9-]+\.md$`
+- **Fix:** Rename to match the pattern.
+
+### STEP-02 — Step Must Have a Goal Section
+
+- **Severity:** HIGH
+- **Applies to:** step files
+- **Rule:** Each step must clearly state its goal. Look for a heading like `## YOUR TASK`, `## STEP GOAL`, `## INSTRUCTIONS`, `## INITIALIZATION`, `## EXECUTION`, `# Step N:`, or a frontmatter `goal:` field.
+- **Detection:** Scan for goal-indicating headings (including `# Step N: Title` as a top-level heading that names the step's purpose) or frontmatter.
+- **Fix:** Add a clear goal section.
+
+### STEP-03 — Step Must Reference Next Step
+
+- **Severity:** MEDIUM
+- **Applies to:** step files (except the final step)
+- **Rule:** Each non-terminal step must contain a reference to the next step file for sequential execution.
+- **Detection:** Look for `## NEXT` section or inline reference to a next step file. Remember to resolve the reference from the originating file's directory (PATH-01 applies here too).
+- **Fix:** Add a `## NEXT` section with the relative path to the next step.
+- **Note:** A terminal step is one that has no next-step reference and either contains completion/finalization language or is the highest-numbered step. If a workflow branches, there may be multiple terminal steps.
+
+### STEP-04 — Halt Before Menu
+
+- **Severity:** HIGH
+- **Applies to:** step files
+- **Rule:** Any step that presents a user menu (e.g., `[C] Continue`, `[A] Approve`, `[S] Split`) must explicitly HALT and wait for user response before proceeding.
+- **Detection:** Find menu patterns (bracketed letter options). Check that text within the same section (under the same heading) includes "HALT", "wait", "stop", "FORBIDDEN to proceed", or equivalent.
+- **Fix:** Add an explicit HALT instruction before or after the menu.
+
+### STEP-05 — No Forward Loading
+
+- **Severity:** HIGH
+- **Applies to:** step files
+- **Rule:** A step must not load or read future step files until the current step is complete. Just-in-time loading only.
+- **Detection:** Look for instructions to read multiple step files simultaneously, or unconditional references to step files with higher numbers than the current step. Exempt locations: `## NEXT` sections, navigation/dispatch sections that list valid resumption targets, and conditional routing branches.
+- **Fix:** Remove premature step loading. Ensure only the current step is active.
+
+### STEP-06 — Step File Frontmatter: No `name` or `description`
+
+- **Severity:** MEDIUM
+- **Applies to:** step files
+- **Rule:** Step files should not have `name:` or `description:` in their YAML frontmatter. These are metadata noise — the step's purpose is conveyed by its goal section and filename.
+- **Detection:** Parse step file frontmatter for `name:` or `description:` keys.
+- **Fix:** Remove `name:` and `description:` from step file frontmatter.
+
+### STEP-07 — Step Count
+
+- **Severity:** LOW
+- **Applies to:** workflow as a whole
+- **Rule:** A sharded workflow should have between 2 and 10 step files. More than 10 risks LLM context degradation.
+- **Detection:** Count files matching `step-*.md` in the `steps/` directory.
+- **Fix:** Consider consolidating steps if over 10.
+
+---
+
+### SEQ-01 — No Skip Instructions
+
+- **Severity:** HIGH
+- **Applies to:** all files
+- **Rule:** No file should instruct the agent to skip steps or optimize step order. Sequential execution is mandatory.
+- **Detection:** Scan for phrases like "skip to step", "jump to step", "skip ahead", "optimize the order", "you may skip". Exclude negation context (e.g., "do NOT skip steps", "NEVER skip") — these are enforcement instructions, not skip instructions.
+- **Exception:** Conditional routing (e.g., "if X, go to step N; otherwise step M") is valid workflow branching, not skipping.
+
+### SEQ-02 — No Time Estimates
+
+- **Severity:** LOW
+- **Applies to:** all files
+- **Rule:** Workflow files should not include time estimates. AI execution speed varies too much for estimates to be meaningful.
+- **Detection:** Scan for patterns like "takes X minutes", "~N min", "estimated time", "ETA".
+- **Fix:** Remove time estimates.
+
+---
+
+### REF-01 — Variable References Must Be Defined
+
+- **Severity:** HIGH
+- **Applies to:** all files
+- **Rule:** Every `{variable_name}` reference in any file (body text, frontmatter values, inline instructions) must resolve to a defined source. Valid sources are:
+  1. A frontmatter variable in the same file
+  2. A frontmatter variable in the skill's `workflow.md` (workflow-level variables are available to all steps)
+  3. A known config variable from the project config (e.g., `project-root`, `planning_artifacts`, `implementation_artifacts`, `communication_language`)
+  4. A known runtime variable set during execution (e.g., `date`, `status`, `project_name`, user-provided input variables)
+- **Detection:** Collect all `{...}` tokens in the file. For each, check whether it is defined in the file's own frontmatter, in `workflow.md` frontmatter, or is a recognized config/runtime variable. Flag any token that cannot be traced to a source. Use the config variable list from the project's `config.yaml` as the reference for recognized config variables. Runtime variables are those explicitly described as user-provided or set during execution in the workflow instructions.
+- **Exceptions:**
+  - Double-curly `{{variable}}` — these are template placeholders intended to survive into generated output (e.g., `{{project_name}}` in a template file). Do not flag these.
+  - Variables inside fenced code blocks that are clearly illustrative examples.
+- **Fix:** Either define the variable in the appropriate frontmatter, or replace the reference with a literal value. If the variable is a config variable that was misspelled, correct the spelling.
+
+### REF-02 — File References Must Resolve
+
+- **Severity:** HIGH
+- **Applies to:** all files
+- **Rule:** All file path references within the skill (markdown links, backtick paths, frontmatter values) should point to files that plausibly exist.
+- **Detection:** For internal references, verify the target file exists in the skill directory. For external references using config variables, verify the path structure is plausible (you cannot resolve config variables, but you can check that the path after the variable looks reasonable — e.g., `{planning_artifacts}/*.md` is plausible, `{planning_artifacts}/../../etc/passwd` is not).
+- **Fix:** Correct the path or remove the dead reference.
+
+### REF-03 — Skill Invocation Must Use "Invoke" Language
+
+- **Severity:** HIGH
+- **Applies to:** all files
+- **Rule:** When a skill references another skill via `skill:skill-name`, the surrounding instruction must use the word "invoke" (e.g., `Invoke skill:bmad-party-mode`). Phrases like "Read fully and follow", "Execute", "Run", "Load", "Open", or "Follow" are invalid — they imply file-level operations on a document, not skill invocation. A skill is a unit that is invoked, not a file that is read.
+- **Detection:** Find all `skill:` references in body text and frontmatter. Check the surrounding instruction text (same sentence or directive) for file-oriented verbs: "read", "follow", "load", "execute", "run", "open". Flag any that do not use "invoke" (or a close synonym like "activate" or "launch").
+- **Fix:** Replace the instruction with `Invoke skill:skill-name` or `Invoke the \`skill-name\` skill`. Remove any "read fully and follow" or similar file-oriented phrasing.
+
+---
+
+## Report Template
+
+When reporting findings, use this format:
+
+```markdown
+# Skill Validation Report: {skill-name}
+
+**Directory:** {path}
+**Date:** {date}
+**Files scanned:** {count}
+
+## Summary
+
+| Severity | Count |
+|----------|-------|
+| CRITICAL | N |
+| HIGH     | N |
+| MEDIUM   | N |
+| LOW      | N |
+
+## Findings
+
+### {RULE-ID} — {Rule Title}
+
+- **Severity:** {severity}
+- **File:** `{relative-path-within-skill}`
+- **Line:** {line number or range, if identifiable}
+- **Detail:** {what was found}
+- **Fix:** {specific fix for this instance}
+
+---
+
+(repeat for each finding, grouped by rule ID)
+
+## Passed Rules
+
+(list rule IDs that produced no findings)
+```
+
+If zero findings: report "All {N} rules passed. No findings." and list all passed rule IDs.

package/tools/xiaoma-npx-wrapper.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * XiaoMa Method CLI - Direct execution wrapper for npx
+ * XiaoMa CLI - Direct execution wrapper for npx
  * This file ensures proper execution when run via npx from GitHub or npm registry
  */