bmad-plus 0.12.0 → 0.12.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "BMAD+ — Augmented AI-Driven Development Framework with multi-role agents, autopilot, and parallel execution",
   "keywords": [
     "bmad",
@@ -45,10 +45,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.4.0",
-    "chalk": "^4.1.2",
     "commander": "^14.0.0",
-    "fs-extra": "^11.3.5",
-    "js-yaml": "^4.1.0",
+    "fs-extra": "^11.3.6",
+    "js-yaml": "^5.2.1",
     "picocolors": "^1.1.1"
   },
   "engines": {
@@ -83,7 +82,8 @@
     "testEnvironment": "node"
   },
   "devDependencies": {
-    "eslint": "^9.0.0",
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.6.0",
     "husky": "^9.0.0",
     "jest": "^30.4.2",
     "prettier": "^3.4.0"

package/readme-international/README.de.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Erweitertes Multi-Agent KI-Framework
 
-[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.12.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,7 +8,7 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | <a href="README.es.md">Español</a> | 🌐 <b>Deutsch</b>
 </div>
 
-> **56+ Multirole-Agenten · 9 modulare Packs · Autopilot-Modus · Parallele Ausführung · 143 Tests**
+> **56+ Multirole-Agenten · 9 modulare Packs · Autopilot-Modus · Parallele Ausführung · 333 Tests**
 > Intelligenter Fork von [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Selbstaktivierende Agenten mit 3-Stufen-Kontexterkennung, GRC-Compliance (Shield), vollständige SDLC-Pipeline (Dev Studio), OSINT-Intelligence, SEO-Audit, persistentes Cross-Session-Gedächtnis und 10-Sprachen CLI-Installer.
 
 ---
@@ -556,8 +556,13 @@ BMAD+/
 | **0.4.4** | 2026-05-17 | 🔧 UTF-8-Kodierungsfix, vollständige i18n 10 Sprachen, 62 Unit-Tests |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 GRC-Compliance-Agenten, 7 Kategorien, 25+ Frameworks (DSGVO, ISO 27001, SOC 2, EU AI Act...) |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 SDLC-Agenten (Miriam, Yosef, Bezalel...) + 30 SDLC-Workflows, BWML DSL |
-| **0.9.0** | 2026-06-24 | 🚀 **Erweitert & Sicher** — 3 neue Packs (animated, backup, seo), P0 Sicherheitsbehebung, 143/143 Tests |
-| **0.8.0** | 2026-06-24 | 🚀 **Erweitert & Sicher** — 3 neue Packs (animated, backup, seo), P0 Sicherheitsbehebung, 143/143 Tests |
+| **0.8.0** | 2026-06-24 | 🚀 **Erweitert** — 3 neue Packs (animated, backup, seo), Sicherheits-Remediation, i18n-Sync |
+| **0.9.0** | 2026-06-24 | 🔒 **Sicher** — Audit-Remediation-Zyklus, npm audit sauber, gemeinsames Pack-Registry (`lib/packs.js`) |
+| **0.9.1** | 2026-07-01 | ✅ **Glaubwürdigkeit** — echte CI bei Push/PR, Jest-ESM-Harness repariert, ESLint-Flat-Config, falsche Badges entfernt |
+| **0.9.2** | 2026-07-01 | 🔐 **Sicherheit** — RCE (ci_cd-Allowlist), SSRF, Stored/DOM-XSS, XXE, Python-CVE-Bumps (~30 Findings) |
+| **0.10.0** | 2026-07-02 | 🧭 **Plattform-Rückgrat** — SSOT `registry.yaml` (generiertes `packs.js` + CI-Drift-Gate), Python-Provisioning, Eval- + Memory-Fundament |
+| **0.11.0** | 2026-07-02 | 🧠 **Karpathy-Schleife** — `bmad mem` recall/write/reinforce, Multi-CLI-Adapter-Generator, OSINT-Rechtsgrundlagen-Gate (CG-02) |
+| **0.12.0** | 2026-07-02 | 🏛️ **Load-bearing** — Root-Adapter aus dem Registry adoptiert, Memory über MCP, provider-neutrales Eval-Gateway; 333 Tests |
 
 Siehe [CHANGELOG.md](../CHANGELOG.md) für vollständige Details.
 

package/readme-international/README.es.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Framework Multi-Agente IA Aumentado
 
-[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.12.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,7 +8,7 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | 🌐 <b>Español</b> | <a href="README.de.md">Deutsch</a>
 </div>
 
-> **56+ agentes multirrol · 9 packs modulares · Modo Autopilot · Ejecución paralela · 143 tests**
+> **56+ agentes multirrol · 9 packs modulares · Modo Autopilot · Ejecución paralela · 333 tests**
 > Fork inteligente de [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Agentes auto-activables con detección contextual en 3 niveles, cumplimiento GRC (Shield), pipeline SDLC completo (Dev Studio), inteligencia OSINT, auditoría SEO, memoria persistente cross-session e instalador CLI en 10 idiomas.
 
 ---
@@ -571,8 +571,13 @@ BMAD+/
 | **0.4.4** | 2026-05-17 | 🔧 Corrección codificación UTF-8, i18n completa 10 idiomas, 62 tests unitarios |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 agentes de cumplimiento GRC, 7 categorías, 25+ frameworks (GDPR, ISO 27001, SOC 2, EU AI Act...) |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 agentes SDLC (Miriam, Yosef, Bezalel...) + 30 flujos de trabajo SDLC, BWML DSL |
-| **0.9.0** | 2026-06-24 | 🚀 **Aumentado & Seguro** — 3 nuevos packs (animated, backup, seo), corrección P0 seguridad, 143/143 tests |
-| **0.8.0** | 2026-06-24 | 🚀 **Aumentado & Seguro** — 3 nuevos packs (animated, backup, seo), corrección P0 seguridad, 143/143 tests |
+| **0.8.0** | 2026-06-24 | 🚀 **Aumentado** — 3 nuevos packs (animated, backup, seo), pase de remediación de seguridad, sync i18n |
+| **0.9.0** | 2026-06-24 | 🔒 **Seguro** — ciclo de remediación de auditoría, npm audit limpio, registro de packs compartido (`lib/packs.js`) |
+| **0.9.1** | 2026-07-01 | ✅ **Credibilidad** — CI real en push/PR, arnés Jest ESM reparado, config ESLint flat, badges falsos retirados |
+| **0.9.2** | 2026-07-01 | 🔐 **Seguridad** — RCE (allowlist ci_cd), SSRF, XSS almacenado/DOM, XXE, bumps CVE Python (~30 hallazgos) |
+| **0.10.0** | 2026-07-02 | 🧭 **Columna vertebral de plataforma** — SSOT `registry.yaml` (`packs.js` generado + gate anti-drift en CI), provisioning Python, fundaciones eval + memoria |
+| **0.11.0** | 2026-07-02 | 🧠 **Bucle Karpathy** — `bmad mem` recall/write/reinforce, generador de adapters multi-CLI, gate de base legal OSINT (CG-02) |
+| **0.12.0** | 2026-07-02 | 🏛️ **Load-bearing** — adapters raíz adoptados desde el registry, memoria vía MCP, gateway eval multi-proveedor; 333 tests |
 
 Más descripciones a fondo en el archivo: [CHANGELOG.md](../CHANGELOG.md).
 

package/readme-international/README.fr.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Framework Multi-Agent IA Augmenté
 
-[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.12.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,7 +8,7 @@
   <a href="../README.md">English</a> | 🌐 <b>Français</b> | <a href="README.es.md">Español</a> | <a href="README.de.md">Deutsch</a>
 </div>
 
-> **56+ agents multi-rôles · 9 packs modulaires · Mode Autopilot · Exécution parallèle · 143 tests**
+> **56+ agents multi-rôles · 9 packs modulaires · Mode Autopilot · Exécution parallèle · 333 tests**
 > Fork intelligent de [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Agents auto-activables avec détection contextuelle 3 niveaux, conformité GRC (Shield), pipeline SDLC complet (Dev Studio), intelligence OSINT, audit SEO, mémoire persistante cross-session, et installeur CLI 10 langues.
 
 ---
@@ -571,8 +571,13 @@ BMAD+/
 | **0.4.4** | 2026-05-17 | 🔧 Correction encodage UTF-8, i18n complète 10 langues, 62 tests unitaires |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 agents de conformité GRC, 7 catégories, 25+ frameworks (RGPD, ISO 27001, SOC 2, EU AI Act...) |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 agents SDLC (Miriam, Yosef, Bezalel...) + 30 workflows SDLC, BWML DSL |
-| **0.9.0** | 2026-06-24 | 🚀 **Augmenté & Sécurisé** — 3 nouveaux packs (animated, backup, seo), correction P0 sécurité, 143/143 tests |
-| **0.8.0** | 2026-06-24 | 🚀 **Augmenté & Sécurisé** — 3 nouveaux packs (animated, backup, seo), correction P0 sécurité, 143/143 tests |
+| **0.8.0** | 2026-06-24 | 🚀 **Augmenté** — 3 nouveaux packs (animated, backup, seo), passe de remédiation sécurité, sync i18n |
+| **0.9.0** | 2026-06-24 | 🔒 **Sécurisé** — cycle de remédiation d'audit, npm audit propre, registre de packs partagé (`lib/packs.js`) |
+| **0.9.1** | 2026-07-01 | ✅ **Crédibilité** — vraie CI sur push/PR, harnais Jest ESM réparé, config ESLint flat, faux badges retirés |
+| **0.9.2** | 2026-07-01 | 🔐 **Sécurité** — RCE (allowlist ci_cd), SSRF, XSS stocké/DOM, XXE, bumps CVE Python (~30 findings) |
+| **0.10.0** | 2026-07-02 | 🧭 **Épine dorsale plateforme** — SSOT `registry.yaml` (`packs.js` généré + gate anti-drift CI), provisioning Python, fondations eval + mémoire |
+| **0.11.0** | 2026-07-02 | 🧠 **Boucle Karpathy** — `bmad mem` recall/write/reinforce, générateur d'adapters multi-CLI, gate base légale OSINT (CG-02) |
+| **0.12.0** | 2026-07-02 | 🏛️ **Load-bearing** — adapters racine adoptés depuis le registry, mémoire via MCP, gateway eval multi-provider ; 333 tests |
 
 Voir [CHANGELOG.md](../CHANGELOG.md) pour le détail complet.
 

package/src/bmad-plus/packs/pack-memory/shared/memory-protocol.md

@@ -29,6 +29,20 @@
     └── <hash>.yaml     ← Per-project metadata
 ```
 
+### Portfolio Brain (workspace-level, takes precedence)
+
+If a `_brain/` directory exists in the project directory or any ancestor (e.g. `D:\workspace\_brain\` above `D:\workspace\clients\my-project\`), install links the project to it instead of `~/.bmad-plus/brain`. The `BMAD_PLUS_BRAIN` env var overrides all auto-detection.
+
+The kind of brain that was linked is recorded in `.brain-link`:
+
+```json
+{ "linked_brain": "D:\\workspace\\_brain", "brain_type": "portfolio", "linked_at": "…" }
+```
+
+`brain_type` values: `portfolio` (workspace `_brain/` or env var) · `bmad-global` (`~/.bmad-plus/brain`) · `claude-memory` (`~/.claude/memory`).
+
+**Rule for agents**: a portfolio brain has its **own** conventions and layout — read its entry point (`README.md` / `AGENTS.md` / `HOT.md`) first and follow them. Do NOT assume the BMAD+ global layout above; in particular do not create `identity.yaml` or `projects/` inside a portfolio brain uninvited.
+
 ---
 
 ## Protocol: Session Start (READ)

package/tools/build/generated-adapters/.codex/AGENTS.md

@@ -100,7 +100,7 @@ Agents MUST follow these behavioral principles:
 
 ## Registry facts (computed from registry.yaml — never hand-typed)
 
-- Product: BMAD+ v0.12.0 (derived from BMAD-METHOD v6.6.0)
+- Product: BMAD+ v0.12.1 (derived from BMAD-METHOD v6.6.0)
 - Models supported: claude, gpt, gemini, local (model-agnostic by contract)
 - Packs (9): Core, OSINT, Maker, Shield, SEO, Memory, Dev Studio, Backup, Animated
 - Installer agents (14 across all packs):

package/tools/build/generated-adapters/.cursor/rules/bmad-plus.mdc

@@ -105,7 +105,7 @@ Agents MUST follow these behavioral principles:
 
 ## Registry facts (computed from registry.yaml — never hand-typed)
 
-- Product: BMAD+ v0.12.0 (derived from BMAD-METHOD v6.6.0)
+- Product: BMAD+ v0.12.1 (derived from BMAD-METHOD v6.6.0)
 - Models supported: claude, gpt, gemini, local (model-agnostic by contract)
 - Packs (9): Core, OSINT, Maker, Shield, SEO, Memory, Dev Studio, Backup, Animated
 - Installer agents (14 across all packs):

package/tools/build/generated-adapters/.opencode/AGENTS.md

@@ -100,7 +100,7 @@ Agents MUST follow these behavioral principles:
 
 ## Registry facts (computed from registry.yaml — never hand-typed)
 
-- Product: BMAD+ v0.12.0 (derived from BMAD-METHOD v6.6.0)
+- Product: BMAD+ v0.12.1 (derived from BMAD-METHOD v6.6.0)
 - Models supported: claude, gpt, gemini, local (model-agnostic by contract)
 - Packs (9): Core, OSINT, Maker, Shield, SEO, Memory, Dev Studio, Backup, Animated
 - Installer agents (14 across all packs):

package/tools/build/generated-adapters/AGENTS.md

@@ -98,7 +98,7 @@ Agents MUST follow these behavioral principles:
 
 ## Registry facts (computed from registry.yaml — never hand-typed)
 
-- Product: BMAD+ v0.12.0 (derived from BMAD-METHOD v6.6.0)
+- Product: BMAD+ v0.12.1 (derived from BMAD-METHOD v6.6.0)
 - Models supported: claude, gpt, gemini, local (model-agnostic by contract)
 - Packs (9): Core, OSINT, Maker, Shield, SEO, Memory, Dev Studio, Backup, Animated
 - Installer agents (14 across all packs):

package/tools/build/generated-adapters/CLAUDE.md

@@ -101,7 +101,7 @@ Agents MUST follow these behavioral principles:
 
 ## Registry facts (computed from registry.yaml — never hand-typed)
 
-- Product: BMAD+ v0.12.0 (derived from BMAD-METHOD v6.6.0)
+- Product: BMAD+ v0.12.1 (derived from BMAD-METHOD v6.6.0)
 - Models supported: claude, gpt, gemini, local (model-agnostic by contract)
 - Packs (9): Core, OSINT, Maker, Shield, SEO, Memory, Dev Studio, Backup, Animated
 - Installer agents (14 across all packs):

package/tools/build/generated-adapters/CONVENTIONS.md

@@ -100,7 +100,7 @@ Agents MUST follow these behavioral principles:
 
 ## Registry facts (computed from registry.yaml — never hand-typed)
 
-- Product: BMAD+ v0.12.0 (derived from BMAD-METHOD v6.6.0)
+- Product: BMAD+ v0.12.1 (derived from BMAD-METHOD v6.6.0)
 - Models supported: claude, gpt, gemini, local (model-agnostic by contract)
 - Packs (9): Core, OSINT, Maker, Shield, SEO, Memory, Dev Studio, Backup, Animated
 - Installer agents (14 across all packs):

package/tools/build/generated-adapters/GEMINI.md

@@ -105,7 +105,7 @@ Agents MUST follow these behavioral principles:
 
 ## Registry facts (computed from registry.yaml — never hand-typed)
 
-- Product: BMAD+ v0.12.0 (derived from BMAD-METHOD v6.6.0)
+- Product: BMAD+ v0.12.1 (derived from BMAD-METHOD v6.6.0)
 - Models supported: claude, gpt, gemini, local (model-agnostic by contract)
 - Packs (9): Core, OSINT, Maker, Shield, SEO, Memory, Dev Studio, Backup, Animated
 - Installer agents (14 across all packs):

package/tools/cli/commands/autoconfig.js

@@ -264,8 +264,7 @@ module.exports = {
       clack.log.info('');
 
       // Confirm
-      let confirmed = options.yes;
-      if (!confirmed) {
+      if (!options.yes) {
         const answer = await clack.confirm({
           message: `Install ${packs.length} recommended packs?`,
           initialValue: true,
@@ -274,7 +273,6 @@ module.exports = {
           clack.cancel('Autoconfig cancelled.');
           return;
         }
-        confirmed = true;
       }
 
       // Run install

package/tools/cli/commands/install.js

@@ -235,9 +235,15 @@ module.exports = {
       copiedSkills += result.copiedSkills;
       copiedFiles += result.copiedFiles;
 
-      // Memory pack: initialize brain with existing brain detection
+      // Memory pack: initialize brain with existing brain detection.
+      // Non-fatal: a read-only or missing home dir (containers, CI) must not
+      // abort the install mid-flight and leave a manifest-less partial tree.
       if (packId === 'memory' && pack.packDir) {
-        initMemory({ projectDir, bmadSrc, userName, commLang, selectedPacks });
+        try {
+          initMemory({ projectDir, bmadSrc, userName, commLang, selectedPacks });
+        } catch (err) {
+          clack.log.warn(`Memory/brain initialization failed (non-fatal, install continues): ${err.message}`);
+        }
       }
     }
 

package/tools/cli/commands/scan.js

@@ -9,10 +9,10 @@
 const path = require('node:path');
 const fs = require('node:fs');
 const os = require('node:os');
-const crypto = require('node:crypto');
 const clack = require('@clack/prompts');
 const pc = require('picocolors');
 const { PROJECT_MARKERS } = require('../lib/stack-detect');
+const { normalizePathForHash, projectHash } = require('../lib/path-hash');
 
 // Directories to skip during scanning
 const SKIP_DIRS = new Set([
@@ -118,22 +118,6 @@ function scanDirectory(rootDir, maxDepth = 4, currentDepth = 0, activeDays = 30,
   return projects;
 }
 
-/**
- * Normalize a filesystem path for stable hashing.
- * On Windows the same project can be referenced as `D:\proj` or `d:\proj`
- * (case-insensitive drive) with mixed separators. Resolving + lowercasing the
- * drive letter ensures the same project produces the same index key and is not
- * double-indexed.
- * @param {string} p - Raw filesystem path
- * @returns {string} Normalized path suitable for hashing
- */
-function normalizePathForHash(p) {
-  let resolved = path.resolve(p);
-  // Lowercase a leading Windows drive letter (e.g. "D:" → "d:").
-  resolved = resolved.replace(/^([A-Za-z]):/, (_m, drive) => drive.toLowerCase() + ':');
-  return resolved;
-}
-
 /**
  * Index a single project in the global brain by writing its metadata YAML file.
  * @param {object} project - Project metadata object
@@ -141,7 +125,7 @@ function normalizePathForHash(p) {
  * @returns {void}
  */
 function indexProject(project, globalBrainDir) {
-  const hash = crypto.createHash('sha256').update(normalizePathForHash(project.path)).digest('hex').slice(0, 8);
+  const hash = projectHash(project.path);
   const meta = {
     path: project.path,
     name: project.name,

package/tools/cli/lib/memory-init.js

@@ -1,113 +1,204 @@
-/**
- * BMAD+ Memory Initialization Module
- * Extracted from install.js — initializes brain with existing brain detection.
- *
- * Author: Laurent Rochetta
- */
-
-const path = require('node:path');
-const fs = require('node:fs');
-const os = require('node:os');
-const fsExtra = require('fs-extra');
-const clack = require('@clack/prompts');
-
-/**
- * Initialize the memory pack: create project memory files, detect or create global brain.
- *
- * @param {object} opts
- * @param {string} opts.projectDir     - Target project directory
- * @param {string} opts.bmadSrc        - Path to src/bmad-plus/
- * @param {string} opts.userName       - User display name
- * @param {string} opts.commLang       - Communication language
- * @param {string[]} opts.selectedPacks - Array of pack IDs being installed
- * @param {object} opts.i              - i18n translations object
- * @returns {void}
- */
-function initMemory({ projectDir, bmadSrc, userName, commLang, selectedPacks }) {
-  const memoryDir = path.join(projectDir, '.agents', 'memory');
-  const sessionsDir = path.join(memoryDir, 'sessions');
-  const globalBrainDir = path.join(os.homedir(), '.bmad-plus', 'brain', 'projects');
-  const templateDir = path.join(bmadSrc, 'packs', 'pack-memory', 'templates');
-
-  // Create project memory (never overwrite existing)
-  fsExtra.ensureDirSync(sessionsDir);
-  const memoryFiles = ['decisions.md', 'lessons.md', 'patterns.md', 'context.md'];
-  for (const mf of memoryFiles) {
-    const dest = path.join(memoryDir, mf);
-    if (!fs.existsSync(dest)) {
-      const src = path.join(templateDir, mf);
-      if (fs.existsSync(src)) {
-        let content = fs.readFileSync(src, 'utf8');
-        content = content.replace(/\{\{date\}\}/g, new Date().toISOString().slice(0, 10));
-        content = content.replace(/\{\{project_name\}\}/g, path.basename(projectDir));
-        content = content.replace(/\{\{project_path\}\}/g, projectDir);
-        fs.writeFileSync(dest, content, 'utf8');
-      }
-    }
-  }
-
-  // Detect existing brain directories
-  const brainCandidates = [
-    path.join(os.homedir(), '.bmad-plus', 'brain'),
-    path.join(projectDir, '_brain'),
-    path.join(os.homedir(), '.claude', 'memory'),
-  ];
-  const existingBrain = brainCandidates.find(p => fs.existsSync(p));
-
-  if (existingBrain) {
-    clack.log.info(`🧠 Existing brain detected: ${existingBrain}`);
-    // Write brain link pointer
-    fs.writeFileSync(
-      path.join(memoryDir, '.brain-link'),
-      JSON.stringify({ linked_brain: existingBrain, linked_at: new Date().toISOString() }, null, 2),
-      'utf8'
-    );
-  } else {
-    // Create fresh global brain
-    fsExtra.ensureDirSync(globalBrainDir);
-    const identitySrc = path.join(templateDir, 'identity.yaml');
-    const identityDest = path.join(os.homedir(), '.bmad-plus', 'brain', 'identity.yaml');
-    if (fs.existsSync(identitySrc) && !fs.existsSync(identityDest)) {
-      let content = fs.readFileSync(identitySrc, 'utf8');
-      content = content.replace(/\{\{user_name\}\}/g, userName);
-      content = content.replace(/\{\{language\}\}/g, commLang);
-      content = content.replace(/\{\{date\}\}/g, new Date().toISOString().slice(0, 10));
-      fs.writeFileSync(identityDest, content, 'utf8');
-    }
-    // Copy global memory templates
-    for (const gf of ['decisions.md', 'lessons.md', 'patterns.md']) {
-      const dest = path.join(os.homedir(), '.bmad-plus', 'brain', gf);
-      if (!fs.existsSync(dest)) {
-        const src = path.join(templateDir, gf);
-        if (fs.existsSync(src)) {
-          let content = fs.readFileSync(src, 'utf8');
-          content = content.replace(/\{\{date\}\}/g, new Date().toISOString().slice(0, 10));
-          content = content.replace(/\{\{project_name\}\}/g, 'Global Brain');
-          fs.writeFileSync(dest, content, 'utf8');
-        }
-      }
-    }
-    clack.log.info(`🧠 Global brain created: ${path.join(os.homedir(), '.bmad-plus', 'brain')}`);
-  }
-
-  // Index this project in global brain
-  const crypto = require('node:crypto');
-  const projHash = crypto.createHash('sha256').update(projectDir).digest('hex').slice(0, 8);
-  const projMeta = {
-    path: projectDir,
-    name: path.basename(projectDir),
-    hash: projHash,
-    status: 'active',
-    bmad_installed: true,
-    packs_installed: selectedPacks,
-    last_scanned: new Date().toISOString().slice(0, 10),
-  };
-  fsExtra.ensureDirSync(globalBrainDir);
-  fs.writeFileSync(
-    path.join(globalBrainDir, `${projHash}.yaml`),
-    Object.entries(projMeta).map(([k, v]) => `${k}: ${JSON.stringify(v)}`).join('\n'),
-    'utf8'
-  );
-}
-
-module.exports = { initMemory };
+/**
+ * BMAD+ Memory Initialization Module
+ * Extracted from install.js — initializes brain with existing brain detection.
+ *
+ * Author: Laurent Rochetta
+ */
+
+const path = require('node:path');
+const fs = require('node:fs');
+const os = require('node:os');
+const fsExtra = require('fs-extra');
+const clack = require('@clack/prompts');
+const { projectHash } = require('./path-hash');
+
+/**
+ * True when `p` exists AND is a directory. A stray *file* named `_brain` (or a
+ * file-valued BMAD_PLUS_BRAIN) must never be linked as a brain.
+ * @param {string} p
+ * @returns {boolean}
+ */
+function isBrainCandidateDir(p) {
+  try {
+    return fs.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resolve the brain directory a project should link to.
+ *
+ * Priority order:
+ *  1. `BMAD_PLUS_BRAIN` env var — explicit override, wins everywhere
+ *  2. A `_brain/` directory in the project dir or any ancestor (portfolio brain
+ *     shared by sibling projects under a common workspace root)
+ *  3. `<home>/.bmad-plus/brain` — BMAD+ global brain
+ *  4. `<home>/.claude/memory` — Claude Code persistent memory, only when it is
+ *     a non-empty directory (an empty shell is not evidence of a real memory)
+ *
+ * @param {string} projectDir - Absolute path of the target project
+ * @param {string} [homeDir]  - Home directory (injectable for tests; defaults to os.homedir())
+ * @returns {{dir: string, type: 'portfolio'|'bmad-global'|'claude-memory'}|null}
+ */
+function resolveBrain(projectDir, homeDir = os.homedir()) {
+  const envBrain = process.env.BMAD_PLUS_BRAIN;
+  if (envBrain) {
+    if (isBrainCandidateDir(envBrain)) return { dir: envBrain, type: 'portfolio' };
+    clack.log.warn(`BMAD_PLUS_BRAIN is set but is not a directory: ${envBrain} — falling back to auto-detection`);
+  }
+
+  let dir = path.resolve(projectDir);
+  for (;;) {
+    const candidate = path.join(dir, '_brain');
+    if (isBrainCandidateDir(candidate)) return { dir: candidate, type: 'portfolio' };
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+
+  const globalBrain = path.join(homeDir, '.bmad-plus', 'brain');
+  if (isBrainCandidateDir(globalBrain)) return { dir: globalBrain, type: 'bmad-global' };
+
+  const claudeMemory = path.join(homeDir, '.claude', 'memory');
+  if (isBrainCandidateDir(claudeMemory)) {
+    let entries;
+    try {
+      entries = fs.readdirSync(claudeMemory);
+    } catch {
+      entries = [];
+    }
+    if (entries.length > 0) return { dir: claudeMemory, type: 'claude-memory' };
+  }
+
+  return null;
+}
+
+/**
+ * Idempotently ensure the global brain is COMPLETE: identity.yaml, the global
+ * memory files, and projects/. Creates only what is missing, never overwrites.
+ *
+ * This must run before ANY write into the global brain: older versions wrote
+ * the projects/ index unconditionally while identity creation lived in a
+ * branch that was skipped whenever any brain was detected — leaving a
+ * permanent "half brain" (projects/ but no identity.yaml) that resolveBrain
+ * then detected as a valid global brain forever.
+ *
+ * @param {string} brainRoot   - Path to <home>/.bmad-plus/brain
+ * @param {string} templateDir - Path to pack-memory templates
+ * @param {string} userName    - User display name (identity.yaml)
+ * @param {string} commLang    - Communication language (identity.yaml)
+ * @returns {void}
+ */
+function ensureGlobalBrain(brainRoot, templateDir, userName, commLang) {
+  fsExtra.ensureDirSync(path.join(brainRoot, 'projects'));
+
+  const identitySrc = path.join(templateDir, 'identity.yaml');
+  const identityDest = path.join(brainRoot, 'identity.yaml');
+  if (fs.existsSync(identitySrc) && !fs.existsSync(identityDest)) {
+    let content = fs.readFileSync(identitySrc, 'utf8');
+    content = content.replace(/\{\{user_name\}\}/g, userName);
+    content = content.replace(/\{\{language\}\}/g, commLang);
+    content = content.replace(/\{\{date\}\}/g, new Date().toISOString().slice(0, 10));
+    fs.writeFileSync(identityDest, content, 'utf8');
+  }
+
+  for (const gf of ['decisions.md', 'lessons.md', 'patterns.md']) {
+    const dest = path.join(brainRoot, gf);
+    if (!fs.existsSync(dest)) {
+      const src = path.join(templateDir, gf);
+      if (fs.existsSync(src)) {
+        let content = fs.readFileSync(src, 'utf8');
+        content = content.replace(/\{\{date\}\}/g, new Date().toISOString().slice(0, 10));
+        content = content.replace(/\{\{project_name\}\}/g, 'Global Brain');
+        fs.writeFileSync(dest, content, 'utf8');
+      }
+    }
+  }
+}
+
+/**
+ * Initialize the memory pack: create project memory files, detect or create global brain.
+ *
+ * @param {object} opts
+ * @param {string} opts.projectDir     - Target project directory
+ * @param {string} opts.bmadSrc        - Path to src/bmad-plus/
+ * @param {string} opts.userName       - User display name
+ * @param {string} opts.commLang       - Communication language
+ * @param {string[]} opts.selectedPacks - Array of pack IDs being installed
+ * @param {string} [opts.homeDir]      - Home directory (injectable for tests; defaults to os.homedir())
+ * @returns {void}
+ */
+function initMemory({ projectDir, bmadSrc, userName, commLang, selectedPacks, homeDir = os.homedir() }) {
+  const memoryDir = path.join(projectDir, '.agents', 'memory');
+  const sessionsDir = path.join(memoryDir, 'sessions');
+  const globalBrainRoot = path.join(homeDir, '.bmad-plus', 'brain');
+  const templateDir = path.join(bmadSrc, 'packs', 'pack-memory', 'templates');
+
+  // Create project memory (never overwrite existing)
+  fsExtra.ensureDirSync(sessionsDir);
+  const memoryFiles = ['decisions.md', 'lessons.md', 'patterns.md', 'context.md'];
+  for (const mf of memoryFiles) {
+    const dest = path.join(memoryDir, mf);
+    if (!fs.existsSync(dest)) {
+      const src = path.join(templateDir, mf);
+      if (fs.existsSync(src)) {
+        let content = fs.readFileSync(src, 'utf8');
+        content = content.replace(/\{\{date\}\}/g, new Date().toISOString().slice(0, 10));
+        content = content.replace(/\{\{project_name\}\}/g, path.basename(projectDir));
+        content = content.replace(/\{\{project_path\}\}/g, projectDir);
+        fs.writeFileSync(dest, content, 'utf8');
+      }
+    }
+  }
+
+  // Detect existing brain (env var > portfolio _brain walk-up > global > claude)
+  const detected = resolveBrain(projectDir, homeDir);
+
+  let linkedBrain;
+  if (detected) {
+    clack.log.info(`🧠 Existing brain detected (${detected.type}): ${detected.dir}`);
+    linkedBrain = detected;
+  } else {
+    ensureGlobalBrain(globalBrainRoot, templateDir, userName, commLang);
+    clack.log.info(`🧠 Global brain created: ${globalBrainRoot}`);
+    linkedBrain = { dir: globalBrainRoot, type: 'bmad-global' };
+  }
+
+  // Write the brain link pointer in EVERY case — including first-ever creation,
+  // so a fresh machine's first install is linked exactly like the second one.
+  fs.writeFileSync(
+    path.join(memoryDir, '.brain-link'),
+    JSON.stringify(
+      { linked_brain: linkedBrain.dir, brain_type: linkedBrain.type, linked_at: new Date().toISOString() },
+      null,
+      2
+    ),
+    'utf8'
+  );
+
+  // Index this project in the global brain — only when the global brain IS the
+  // linked brain. Portfolio and claude-memory brains keep their own registries
+  // (see pack-memory/shared/memory-protocol.md); writing into ~/.bmad-plus from
+  // those installs is what used to create orphaned "half brains".
+  if (linkedBrain.type === 'bmad-global') {
+    ensureGlobalBrain(globalBrainRoot, templateDir, userName, commLang);
+    const projHash = projectHash(projectDir);
+    const projMeta = {
+      path: projectDir,
+      name: path.basename(projectDir),
+      hash: projHash,
+      status: 'active',
+      bmad_installed: true,
+      packs_installed: selectedPacks,
+      last_scanned: new Date().toISOString().slice(0, 10),
+    };
+    fs.writeFileSync(
+      path.join(globalBrainRoot, 'projects', `${projHash}.yaml`),
+      Object.entries(projMeta).map(([k, v]) => `${k}: ${JSON.stringify(v)}`).join('\n'),
+      'utf8'
+    );
+  }
+}
+
+module.exports = { initMemory, resolveBrain, ensureGlobalBrain };