bmad-plus 0.12.2 → 0.14.0

package/CHANGELOG.md

@@ -7,6 +7,53 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.0] - 2026-09-09
+
+### Added
+- `studio list` and `studio prepare` resolve installed Dev Studio routes, real instruction contents, input hashes and YAML configuration without executing an agent or writing deliverables.
+- Dev Studio supplies original, self-contained procedures for all 38 workflows and six existing personas, with working entry points, declared resources and compatibility guides for earlier step paths.
+- Installation diagnostics share one human/JSON report with registry-declared resources, ownership evidence, runtime limits and explicit host-managed execution capabilities.
+- Optional `doctor --verify-python` checks a real provisioned environment, supported Python version and required imports within a bounded subprocess. Default diagnostics remain inspection-only.
+- English-first public guides with French, Spanish and German translations cover installation, role activation, examples, updates and reviewed release history.
+- Release tooling generates the npm README from shared public content, validates every translated candidate guide before publication, and verifies official npm metadata before synchronizing and deploying the website. Landing-only recovery uses the original source revision without republishing npm.
+
+### Fixed
+- Memory declares its shipped Node/file-based features; separately deployed MCP/RAG dependencies are no longer provisioned from an absent npm path.
+- SEO entry points explain prompts-only operation and mark missing measurements unverified. Incomplete audits omit unsupported scores and use a report format that preserves missing evidence.
+- Orchestrator, autopilot and upstream-sync notifications require a configured, authorized channel; ordinary installations report checkpoints in the session.
+- The distributed npm README now includes the current reviewed release history and the official `bmad-plus.rochetta.fr` documentation links.
+
+### Quality
+- Python runtime paths are checked against package boundaries and the actual npm archive; shipped and tested SEO toolkit copies must match in file inventory and bytes.
+- Regression coverage includes missing delivery resources, ownership changes, Python probe failures, unpublished release candidates and stale public content.
+- Dev Studio resource graphs, aliases, input requirements, configuration, relocation and customized-file update/restore are checked against real consumer installations. Missing inputs remain explicit; the coding assistant executes the prepared instructions.
+- The BMAD-METHOD 6.12 review informs selective original adaptations. The declared upstream baseline remains 6.6; no full 6.12 compatibility or standalone agent runtime is claimed.
+
+## [0.13.0] - 2026-09-08
+
+### Added
+- Registry-derived installation now delivers the common agent spine and all seven tool adapters from one renderer, with consistent pack facts and persistent execution settings.
+- Published-release discovery with `update-check` (JSON, refresh and offline modes), a 24-hour cache, and explicit project update policies. Notification is the default; automatic updates require an authorized semver range.
+- `update --latest` dispatches an exact validated package through npm, rechecks policy and ownership, refuses downgrades and wrong-version children, and requests instruction reload. All generated tool adapters include one check per session.
+- Managed-file hash inventories cover agents, skills, pack data and module files. Customized files are preserved; automatic updates refuse conflicts or incomplete legacy ownership. Updates are locked, backed up and recoverable with `update --restore <receipt-id> --yes`.
+
+### Security
+- Patch runtime `js-yaml` from 5.2.1 to 5.2.2 for [GHSA-pm4m-ph32-ghv5](https://github.com/advisories/GHSA-pm4m-ph32-ghv5). Production npm audit reports zero vulnerabilities for the validated lockfile.
+- Update and install destinations reject redirected paths; restore validates every backup before changing files and preserves subsequent local edits.
+
+### Fixed
+- Uninstall preserves project memory, settings, modified pack files, custom IDE instructions and nonempty output. Only identifiable BMAD+ files are removed after checking for symlinks/junctions; legacy installs may retain files whose ownership cannot be established.
+- Doctor and uninstall report invalid manifests with failure exit codes. Installation/removal without a terminal requires `--yes`; the npx launcher propagates child launch failures and signals.
+- MCP audit entry points validate identifiers and confine filesystem operations before deletion, cloning or metadata writes. Git URL validation is shared across audit and Git tools.
+- GitHub requests have connection/read timeouts. RAG ingestion uses the server interpreter and working directory without an undrained stderr pipe.
+
+### Quality
+- Distribution security audit explicitly checks production dependencies, matching its production-only install and the CI gate.
+- CI now blocks on pinned Ruff correctness checks and MCP tool, evaluation-backend and memory-bridge tests. SEO DNS/HTTP tests use offline fixtures.
+- JavaScript regression suite expanded to 709 tests in 31 suites, with all coverage thresholds passing. Python correctness-lint findings removed; mutable argument defaults replaced.
+- Source/npm contract verifies 64 installations, 168 generated adapters, complete managed-file hashes and offline update checks. npm execution with Windows path metacharacters is covered by a real offline process test.
+- Backlog projection completed with CLI safety, MCP hardening and Python-quality epics. Dependency modernization retains its existing decision gate.
+
 ## [0.12.2] - 2026-07-16
 
 ### Added — capabilities now actually delivered