bmad-plus 0.13.0 → 0.16.0

package/tools/cli/lib/pack-copy.js

@@ -7,47 +7,74 @@ const fs = require('node:fs');
 const crypto = require('node:crypto');
 const { safeTarget } = require('../../build/generate-adapters');
 
-const fileHash = content => crypto.createHash('sha256').update(content).digest('hex');
+const fileHash = (content) => crypto.createHash('sha256').update(content).digest('hex');
 
 function listPackFiles({ bmadSrc, targetAgentsDir, targetDataDir, projectRoot, pack }) {
   const result = { copiedAgents: 0, copiedSkills: 0, copiedFiles: 0, files: [] };
   if (!pack) return result;
   function walk(source, target) {
+    // Local Python execution must not turn interpreter caches into owned/shipped
+    // framework files. Keep this aligned with the explicit npm files exclusions.
+    if (path.basename(source) === '__pycache__' || /\.py[co]$/i.test(source)) return false;
     let stat;
-    try { stat = fs.lstatSync(source); } catch (error) {
+    try {
+      stat = fs.lstatSync(source);
+    } catch (error) {
       if (error.code === 'ENOENT') return false;
       throw error;
     }
     if (stat.isSymbolicLink()) throw new Error('Pack source is a symbolic link: ' + source);
     if (stat.isDirectory()) {
-      for (const name of fs.readdirSync(source).sort()) walk(path.join(source, name), path.join(target, name));
+      for (const name of fs.readdirSync(source).sort())
+        walk(path.join(source, name), path.join(target, name));
     } else if (stat.isFile()) {
       result.files.push({ source, target });
     } else throw new Error('Pack source is not a regular file: ' + source);
     return true;
   }
   for (const name of pack.agents || []) {
-    if (walk(path.join(bmadSrc, 'agents', name), path.join(targetAgentsDir, name))) result.copiedAgents++;
+    if (walk(path.join(bmadSrc, 'agents', name), path.join(targetAgentsDir, name)))
+      result.copiedAgents++;
   }
   for (const name of pack.skills || []) {
-    if (walk(path.join(bmadSrc, 'skills', name), path.join(targetAgentsDir, name))) result.copiedSkills++;
+    if (walk(path.join(bmadSrc, 'skills', name), path.join(targetAgentsDir, name)))
+      result.copiedSkills++;
   }
   for (const name of pack.data || []) {
-    if (walk(path.join(bmadSrc, 'data', name), path.join(targetDataDir, name))) result.copiedFiles++;
+    if (walk(path.join(bmadSrc, 'data', name), path.join(targetDataDir, name)))
+      result.copiedFiles++;
   }
-  if (pack.externalPackage && walk(path.join(projectRoot, pack.externalPackage, 'skills'), targetAgentsDir)) result.copiedSkills++;
-  if (pack.packDir && walk(path.join(bmadSrc, pack.packSrcDir || 'agents', pack.packDir), path.join(targetAgentsDir, pack.packDir))) {
+  if (
+    pack.externalPackage &&
+    walk(path.join(projectRoot, pack.externalPackage, 'skills'), targetAgentsDir)
+  )
+    result.copiedSkills++;
+  if (
+    pack.packDir &&
+    walk(
+      path.join(bmadSrc, pack.packSrcDir || 'agents', pack.packDir),
+      path.join(targetAgentsDir, pack.packDir)
+    )
+  ) {
     result.copiedAgents++;
     result.copiedFiles++;
   }
   return result;
 }
 
-function copyManagedFile({ source, target, projectDir, inventory, previousInventory = {}, onConflict = () => {} }) {
+function copyManagedFile({
+  source,
+  target,
+  projectDir,
+  inventory,
+  previousInventory = {},
+  onConflict = () => {},
+}) {
   const file = path.relative(projectDir, target).split(path.sep).join('/');
   safeTarget(projectDir, file);
   const sourceStat = fs.lstatSync(source);
-  if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) throw new Error('Pack source is not a regular file: ' + source);
+  if (!sourceStat.isFile() || sourceStat.isSymbolicLink())
+    throw new Error('Pack source is not a regular file: ' + source);
   const content = fs.readFileSync(source);
   const hash = fileHash(content);
   if (fs.existsSync(target)) {
@@ -72,7 +99,8 @@ function copyManagedFile({ source, target, projectDir, inventory, previousInvent
 function copyPackFiles(options) {
   const { files, ...counts } = listPackFiles(options);
   const projectDir = options.projectDir || path.dirname(options.targetAgentsDir);
-  for (const { target } of files) safeTarget(projectDir, path.relative(projectDir, target).split(path.sep).join('/'));
+  for (const { target } of files)
+    safeTarget(projectDir, path.relative(projectDir, target).split(path.sep).join('/'));
   for (const entry of files) copyManagedFile({ ...options, ...entry, projectDir });
   return counts;
 }

package/tools/cli/lib/packs.js

@@ -19,7 +19,8 @@ const PACKS = {
     "skills": [
       "bmad-plus-autopilot",
       "bmad-plus-parallel",
-      "bmad-plus-sync"
+      "bmad-plus-sync",
+      "bmad-plus-uat"
     ],
     "data": [
       "role-triggers.yaml"
@@ -210,7 +211,7 @@ const DERIVED = {
   "product": {
     "code": "bmad-plus",
     "displayName": "BMAD+",
-    "version": "0.13.0",
+    "version": "0.16.0",
     "derivedFrom": "BMAD-METHOD v6.6.0"
   },
   "packOrder": [
@@ -253,9 +254,23 @@ const DERIVED = {
       "workflowCount": 0,
       "frameworkCount": 0,
       "categoryCount": 0,
-      "skillCount": 3,
+      "skillCount": 4,
       "referenceFiles": 0,
       "categoryAgentCounts": [],
+      "runtimes": [
+        "node"
+      ],
+      "requiredResources": [
+        ".agents/skills/agent-strategist/SKILL.md",
+        ".agents/skills/agent-architect-dev/SKILL.md",
+        ".agents/skills/agent-quality/SKILL.md",
+        ".agents/skills/agent-orchestrator/SKILL.md",
+        ".agents/skills/bmad-plus-autopilot/SKILL.md",
+        ".agents/skills/bmad-plus-parallel/SKILL.md",
+        ".agents/skills/bmad-plus-sync/SKILL.md",
+        ".agents/skills/bmad-plus-uat/SKILL.md",
+        ".agents/data/role-triggers.yaml"
+      ],
       "personas": [
         {
           "id": "agent-strategist",
@@ -302,6 +317,12 @@ const DERIVED = {
       "skillCount": 0,
       "referenceFiles": 0,
       "categoryAgentCounts": [],
+      "runtimes": [
+        "node"
+      ],
+      "requiredResources": [
+        ".agents/skills/agent-shadow/SKILL.md"
+      ],
       "personas": [
         {
           "id": "agent-shadow",
@@ -330,6 +351,12 @@ const DERIVED = {
       "skillCount": 0,
       "referenceFiles": 0,
       "categoryAgentCounts": [],
+      "runtimes": [
+        "node"
+      ],
+      "requiredResources": [
+        ".agents/skills/agent-maker/SKILL.md"
+      ],
       "personas": [
         {
           "id": "agent-maker",
@@ -365,6 +392,13 @@ const DERIVED = {
         3,
         3
       ],
+      "runtimes": [
+        "node"
+      ],
+      "requiredResources": [
+        ".agents/skills/pack-shield/shield-orchestrator.md",
+        ".agents/skills/pack-shield/SKILL.md"
+      ],
       "personas": [
         {
           "id": "shield-orchestrator",
@@ -393,6 +427,17 @@ const DERIVED = {
       "skillCount": 0,
       "referenceFiles": 0,
       "categoryAgentCounts": [],
+      "runtimes": [
+        "node",
+        "python"
+      ],
+      "requiredResources": [
+        ".agents/skills/pack-seo/seo-scout.md",
+        ".agents/skills/pack-seo/seo-chief.md",
+        ".agents/skills/pack-seo/seo-judge.md",
+        ".agents/skills/pack-seo/SKILL.md",
+        ".agents/skills/pack-seo/scripts/seo_fetch.py"
+      ],
       "personas": [
         {
           "id": "seo-scout",
@@ -433,6 +478,13 @@ const DERIVED = {
       "skillCount": 0,
       "referenceFiles": 0,
       "categoryAgentCounts": [],
+      "runtimes": [
+        "node"
+      ],
+      "requiredResources": [
+        ".agents/skills/pack-memory/zecher-agent.md",
+        ".agents/skills/pack-memory/memory-orchestrator.md"
+      ],
       "personas": [
         {
           "id": "zecher",
@@ -468,6 +520,18 @@ const DERIVED = {
         0,
         0
       ],
+      "runtimes": [
+        "node"
+      ],
+      "requiredResources": [
+        ".agents/skills/pack-dev-studio/dev-studio-orchestrator.md",
+        ".agents/skills/dev-studio/SKILL.md",
+        ".agents/skills/pack-dev-studio/SKILL.md",
+        ".agents/skills/pack-dev-studio/shared/catalog.json",
+        ".agents/skills/pack-dev-studio/shared/execution.md",
+        ".agents/skills/pack-dev-studio/categories/planning/create-ux-design.md",
+        ".agents/skills/pack-dev-studio/categories/planning/steps/step-01-init.md"
+      ],
       "personas": [
         {
           "id": "analyst-agent",
@@ -532,6 +596,12 @@ const DERIVED = {
       "skillCount": 0,
       "referenceFiles": 0,
       "categoryAgentCounts": [],
+      "runtimes": [
+        "node"
+      ],
+      "requiredResources": [
+        ".agents/skills/pack-backup/backup-agent.md"
+      ],
       "personas": [
         {
           "id": "backup-agent",
@@ -560,6 +630,12 @@ const DERIVED = {
       "skillCount": 0,
       "referenceFiles": 0,
       "categoryAgentCounts": [],
+      "runtimes": [
+        "node"
+      ],
+      "requiredResources": [
+        ".agents/skills/pack-animated/animated-website-agent.md"
+      ],
       "personas": [
         {
           "id": "animated-website-agent",
@@ -588,15 +664,62 @@ const DERIVED = {
         "defusedxml",
         "lxml"
       ]
-    },
-    "memory": {
-      "requirements": [
-        "mcp-server",
-        "requirements.txt"
+    }
+  },
+  "diagnostics": {
+    "schemaVersion": 1,
+    "processExecution": {
+      "adapters": [
+        "command",
+        "codex-exec"
       ],
-      "verifyModules": [
-        "chromadb"
-      ]
+      "supervisor": "foreground",
+      "launch": "explicit-plan",
+      "collect": "exact-attempt-receipt",
+      "cancellation": "original-owner-direct-child",
+      "verification": "independent-required",
+      "scheduling": "none"
+    },
+    "runtimeMinimums": {
+      "node": "20.0.0",
+      "python": "3.11"
+    },
+    "integrations": {
+      "claude-code": {
+        "instructionFile": "CLAUDE.md",
+        "execution": "host-managed",
+        "lifecycleEvents": "not-integrated"
+      },
+      "gemini-cli": {
+        "instructionFile": "GEMINI.md",
+        "execution": "host-managed",
+        "lifecycleEvents": "not-integrated"
+      },
+      "antigravity": {
+        "instructionFile": "GEMINI.md",
+        "execution": "host-managed",
+        "lifecycleEvents": "not-integrated"
+      },
+      "cursor": {
+        "instructionFile": ".cursor/rules/bmad-plus.mdc",
+        "execution": "host-managed",
+        "lifecycleEvents": "not-integrated"
+      },
+      "codex-cli": {
+        "instructionFile": ".codex/AGENTS.md",
+        "execution": "host-managed",
+        "lifecycleEvents": "not-integrated"
+      },
+      "opencode": {
+        "instructionFile": ".opencode/AGENTS.md",
+        "execution": "host-managed",
+        "lifecycleEvents": "not-integrated"
+      },
+      "aider": {
+        "instructionFile": "CONVENTIONS.md",
+        "execution": "host-managed",
+        "lifecycleEvents": "not-integrated"
+      }
     }
   },
   "targets": {

package/tools/cli/lib/python-health.js

@@ -0,0 +1,233 @@
+/** Opt-in verification of an existing pack environment. Never installs a runtime. */
+const fs = require('node:fs');
+const path = require('node:path');
+const { MIN_PYTHON, venvPython, defaultRunner } = require('./python-provision');
+
+const TIMEOUT_MS = 15_000;
+const MAX_BUFFER = 64 * 1024;
+const MODULE_NAME = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/;
+
+// -I excludes project/PYTHONPATH imports; -B avoids bytecode writes. Importing
+// installed dependencies still executes their code, so callers must opt in.
+const PROBE = [
+  'import contextlib, importlib, json, os, sys',
+  'expected, minimum, names = sys.argv[1], json.loads(sys.argv[2]), json.loads(sys.argv[3])',
+  'normalize = lambda value: os.path.normcase(os.path.realpath(value))',
+  'prefix, base = normalize(sys.prefix), normalize(sys.base_prefix)',
+  'version = list(sys.version_info[:3])',
+  'checks = [{"name": name, "status": "not-verified"} for name in names]',
+  'if prefix == normalize(expected) and prefix != base and version >= minimum:',
+  '    with open(os.devnull, "w", encoding="utf-8") as sink:',
+  '        with contextlib.redirect_stdout(sink), contextlib.redirect_stderr(sink):',
+  '            for check in checks:',
+  '                try:',
+  '                    importlib.import_module(check["name"])',
+  '                    check["status"] = "verified"',
+  '                except BaseException:',
+  '                    check["status"] = "failed"',
+  'print(json.dumps({"schemaVersion": 1, "prefix": prefix, "basePrefix": base, "version": version, "modules": checks}))',
+].join('\n');
+
+function minimumParts(minimum) {
+  if (typeof minimum !== 'string' || !/^\d+\.\d+(?:\.\d+)?$/.test(minimum)) return null;
+  const parts = minimum.split('.').map(Number);
+  if (parts.length === 2) parts.push(0);
+  return parts[0] > 0 && parts.every((part) => Number.isSafeInteger(part) && part >= 0)
+    ? parts
+    : null;
+}
+
+function normalizedPath(value) {
+  const resolved = path.resolve(value);
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
+function environmentPaths(projectDir, packId) {
+  const directory = path.join(projectDir, '.bmad', 'venv', packId);
+  const executable = venvPython(directory);
+  const parent = path.dirname(executable);
+  let cursor = path.parse(parent).root;
+  for (const component of parent.slice(cursor.length).split(path.sep)) {
+    cursor = path.join(cursor, component);
+    const stat = fs.lstatSync(cursor);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) return null;
+  }
+  const config = fs.lstatSync(path.join(directory, 'pyvenv.cfg'));
+  if (config.isSymbolicLink() || !config.isFile()) return null;
+  const binary = fs.lstatSync(executable);
+  if (binary.isSymbolicLink()) {
+    // A Unix venv normally links bin/python to its base interpreter. Keep that
+    // executable path: resolving it before invocation would lose the venv.
+    if (process.platform === 'win32' || !fs.statSync(executable).isFile()) return null;
+  } else if (!binary.isFile()) return null;
+  return { directory, executable };
+}
+
+/**
+ * Verify the actual prefix, version and declared imports in .bmad/venv/<packId>.
+ * One bounded interpreter invocation; no PATH fallback, repair or provisioning.
+ */
+function probePythonRuntime({
+  projectDir,
+  packId,
+  minimum = `${MIN_PYTHON.major}.${MIN_PYTHON.minor}`,
+  verifyModules = [],
+  runner = defaultRunner,
+} = {}) {
+  const started = Date.now();
+  const floor = minimumParts(minimum);
+  const validNames =
+    Array.isArray(verifyModules) &&
+    verifyModules.length <= 64 &&
+    [...verifyModules].every(
+      (name) => typeof name === 'string' && name.length <= 200 && MODULE_NAME.test(name)
+    );
+  const names = validNames ? [...new Set(verifyModules)] : [];
+  const finish = (
+    status,
+    message,
+    version = null,
+    modules = names.map((name) => ({ name, status: 'not-verified' }))
+  ) => ({
+    status,
+    version,
+    imports: modules.some((entry) => entry.status === 'failed')
+      ? 'failed'
+      : modules.length > 0 && modules.every((entry) => entry.status === 'verified')
+        ? 'verified'
+        : 'not-verified',
+    modules,
+    message,
+  });
+  if (
+    typeof projectDir !== 'string' ||
+    !projectDir ||
+    projectDir.includes('\0') ||
+    typeof packId !== 'string' ||
+    !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(packId) ||
+    !floor ||
+    !validNames ||
+    typeof runner !== 'function'
+  ) {
+    return finish('invalid', 'Python verification options are invalid.');
+  }
+
+  projectDir = path.resolve(projectDir);
+  let environment;
+  try {
+    environment = environmentPaths(projectDir, packId);
+  } catch (error) {
+    return finish(
+      error.code === 'ENOENT' ? 'missing' : 'unavailable',
+      error.code === 'ENOENT'
+        ? 'The pack Python environment is missing or incomplete.'
+        : 'The pack Python environment cannot be inspected.'
+    );
+  }
+  if (!environment)
+    return finish(
+      'invalid',
+      'The pack Python environment contains an unsafe path or invalid file.'
+    );
+
+  const timeout = TIMEOUT_MS - (Date.now() - started);
+  if (timeout <= 0) return finish('unavailable', 'Python verification exceeded its time limit.');
+  let result;
+  try {
+    result = runner(
+      environment.executable,
+      [
+        '-I',
+        '-B',
+        '-c',
+        PROBE,
+        environment.directory,
+        JSON.stringify(floor),
+        JSON.stringify(names),
+      ],
+      {
+        cwd: projectDir,
+        encoding: 'utf8',
+        shell: false,
+        windowsHide: true,
+        timeout,
+        killSignal: 'SIGKILL',
+        maxBuffer: MAX_BUFFER,
+      }
+    );
+  } catch {
+    return finish('unavailable', 'The pack Python interpreter could not complete verification.');
+  }
+  if (Date.now() - started >= TIMEOUT_MS || !result || result.error || result.status !== 0) {
+    return finish(
+      'unavailable',
+      'The pack Python interpreter could not complete verification within its limits.'
+    );
+  }
+  let evidence;
+  try {
+    if (typeof result.stdout !== 'string' || Buffer.byteLength(result.stdout, 'utf8') > MAX_BUFFER)
+      throw new Error();
+    evidence = JSON.parse(result.stdout);
+  } catch {
+    return finish('invalid', 'The Python interpreter returned invalid verification evidence.');
+  }
+  if (
+    !evidence ||
+    evidence.schemaVersion !== 1 ||
+    typeof evidence.prefix !== 'string' ||
+    !path.isAbsolute(evidence.prefix) ||
+    typeof evidence.basePrefix !== 'string' ||
+    !path.isAbsolute(evidence.basePrefix) ||
+    !Array.isArray(evidence.version) ||
+    evidence.version.length !== 3 ||
+    evidence.version.some((part) => !Number.isSafeInteger(part) || part < 0) ||
+    evidence.version[0] === 0 ||
+    !Array.isArray(evidence.modules) ||
+    evidence.modules.length !== names.length ||
+    evidence.modules.some(
+      (entry, index) =>
+        !entry ||
+        entry.name !== names[index] ||
+        !['verified', 'failed', 'not-verified'].includes(entry.status)
+    )
+  ) {
+    return finish('invalid', 'The Python interpreter returned invalid verification evidence.');
+  }
+  if (
+    normalizedPath(evidence.prefix) !== normalizedPath(environment.directory) ||
+    normalizedPath(evidence.prefix) === normalizedPath(evidence.basePrefix)
+  ) {
+    return finish(
+      'invalid',
+      'The interpreter is not running from the expected pack virtual environment.'
+    );
+  }
+  const version = evidence.version.join('.');
+  const difference = evidence.version.findIndex((part, index) => part !== floor[index]);
+  if (difference >= 0 && evidence.version[difference] < floor[difference]) {
+    return finish('unsupported', 'The pack Python version is below the required minimum.', version);
+  }
+  if (evidence.modules.some((entry) => entry.status === 'not-verified')) {
+    return finish('invalid', 'The interpreter did not verify every declared module.', version);
+  }
+  const modules = evidence.modules.map(({ name, status }) => ({ name, status }));
+  if (modules.some((entry) => entry.status === 'failed')) {
+    return finish(
+      'unavailable',
+      'One or more declared modules could not be imported in the pack environment.',
+      version,
+      modules
+    );
+  }
+  return finish(
+    'verified',
+    modules.length
+      ? 'The pack Python version and declared imports are verified.'
+      : 'The pack Python version is verified; no import checks were requested.',
+    version,
+    modules
+  );
+}
+
+module.exports = { probePythonRuntime };

package/tools/cli/lib/python-provision.js

@@ -2,7 +2,7 @@
  * BMAD+ Unified Python Provisioning (Pillar 2 — kills split-brain / broken-on-arrival)
  *
  * Provisions the Python runtime a pack declares in the registry
- * (`runtime: [node, python]` → seo, memory). One code path for every pack:
+ * (`runtime: [node, python]`). One code path for every Python pack:
  *   1. detect a Python >= 3.11 interpreter (or a uv that can fetch one)
  *   2. choose a provisioner: uv > pipx > venv+pip
  *   3. create an isolated env under a given dir (e.g. <project>/.bmad/venv)
@@ -386,7 +386,7 @@ function verifyEntry({ envDir, entryPath, entryArgs = ['--help'], runner = defau
 /**
  * Full pipeline: detect → choose provisioner → create env → install → verify.
  * This is the single call site the installer uses for ANY pack whose registry
- * runtime includes "python" (seo, memory, …).
+ * runtime includes "python".
  *
  * Never throws for environmental problems — always returns
  * { ok, tool, messages[] } so the installer can degrade gracefully and print