bmad-plus 0.17.0 → 0.17.1

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.1] - 2026-09-24
+
+### Changed
+- **`install` no longer overwrites a different installed version.** A downgrade is refused; an upgrade stops and points to `bmad-plus update`, which keeps backups and restorable receipts. Re-installing the same version only adds what is missing. Scripts that re-ran `install` to change versions must call `update` instead.
+- **`--packs` and `--tools` add to the previous installation** instead of replacing it. An unknown pack or tool ID now fails before anything is written, and the error lists the valid IDs.
+- **Unattended installs default to English.** Without a terminal, the communication language comes from `--lang`, then from the system locale, then English. `--yes` with no detected AI tool writes no adapter files.
+- `update` deletes files that a new version no longer ships when you have not changed them; each deletion is backed up in the update receipt and `--restore` brings it back. Files you edited are kept and reported as `modified-orphaned-file`.
+- The npm package no longer ships the maintainers' release and maintenance scripts, only the launcher, the CLI and the build modules it needs at runtime. The archive is smaller; installed projects are unaffected.
+- The OSINT pack opens with a legal and ethics notice (GDPR lawful basis, platform terms, no private profiling), and Shadow's reports start with an AI-generated, not-legal-advice disclaimer. Shadow is described as governed public-source research; its lawful-basis gate is unchanged.
+- The Shield pack and its audit report template carry a shared not-legal-advice notice, an AI-generated banner and a qualified-reviewer sign-off field.
+
+### Fixed
+- Re-installing keeps your `_bmad/config.yaml`: existing settings win, missing defaults are added, and an unparsable file is left untouched. The manifest and configuration are written atomically, so an interrupted install cannot leave them half-written.
+- A `.bmad/update.lock` left by a crashed process no longer blocks the project: when its owner is provably dead on this machine, the lock is moved aside and taken over. Other stale locks are reported by `doctor`, and the error states the manual remedy.
+- `uninstall` accepts `-d`/`--directory` like the other maintenance commands. Help names the program `bmad-plus`, and a subcommand's `--lang` is no longer swallowed by a global option.
+- The installer shows each pack with its emoji icon.
+- Release automation now waits for npm's publish-time scanning before verifying public archive integrity. Polling is bounded to thirty attempts with thirty-second intervals and a twenty-minute step limit. An unavailable version still blocks the landing, and recovery instructions explicitly forbid uploading the same version again.
+
+### Security
+- The development-only `js-yaml` copy used by the coverage tooling is pinned to the patched 4.3.2. The production dependency audit remains clean.
+
+### Documentation
+- The French, Spanish and German READMEs mirror the public README section by section. The README states that BMAD+ is not affiliated with BMad Code, LLC, and replaces the BMAD-METHOD comparison with a factual list of what BMAD+ ships.
+- The website shows the install command with a copy control in its hero, supports a dark color scheme, folds navigation on small screens and names the supported tools.
+
 ## [0.17.0] - 2026-09-22
 
 ### Added
@@ -177,7 +202,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` 333/333 (16 suites); lint 0 errors under eslint 10; both `npx npm@10 ci --dry-run` and `npm ci --dry-run` green; CI + Platform workflows green on GOLDEN master.
 
-## [0.12.0] — 2026-07-02
+## [0.12.0] - 2026-07-02
 
 ### Added — Load-bearing activation (north-star Pillars 3, 4, 5)
 - **Pillar 4 executable:** `evals/_runner/providers.py` — a provider-neutral model gateway (anthropic / openai / generic-HTTP adapters selected by `BMAD_EVAL_PROVIDER`, default deterministic **mock** so `--self-check` and CI never hit the network). `run_agent(spec, model)` now routes through it; the eval harness genuinely runs (3/3 specs pass).
@@ -190,7 +215,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` **333 passed / 16 suites**; `build:check` + `generate-adapters --check` no drift; `run.py --self-check` 3/3; edited Python parses.
 
-## [0.11.0] — 2026-07-02
+## [0.11.0] - 2026-07-02
 
 ### Added — Karpathy loop CLI + multi-CLI adapters (north-star Pillars 3 & 5)
 - **`bmad mem` command (Pillar 3):** `recall <query>` / `write` / `reinforce` expose the memory-journal (append/recall + Elo reward + governance guard) from the CLI, so the learning loop is usable from any driving tool. `tests/unit/memory-journal-cmd.test.js`.
@@ -203,7 +228,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` **325 passed / 16 suites**; `npm run build:check` no drift; `generate-adapters.js --check` no drift.
 
-## [0.10.0] — 2026-07-02
+## [0.10.0] - 2026-07-02
 
 ### Added — Platform-spine foundations (north-star Phase 2)
 Built as **new files only** (no existing core file modified); test suite grew from 176/10 to **258 passed / 13 suites**. Cut nothing; multi-tool/multi-model preserved.
@@ -216,7 +241,7 @@ Built as **new files only** (no existing core file modified); test suite grew fr
 
 Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remaining integration (provisioning called from install, memory exposed via MCP, generated multi-CLI adapters) lands next as its own tested commit — see `audit/2026-07-01/PHASE-2-STATUS.md`.
 
-## [0.9.2] — 2026-07-01
+## [0.9.2] - 2026-07-01
 
 ### Security — Phase 1 remediation (exploitable findings)
 - **RCE closed** (`ci_cd.py`): command allowlist now uses exact-token matching (shlex.split) + realpath/commonpath containment instead of prefix/`startswith` — defeats argument injection (`make -f attacker.mk`) and sibling-path bypass; `shell=False` throughout; dead Makefile fallback removed.
@@ -237,7 +262,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - Documented residual follow-ups (SSRF crawler-class redirect hops, DNS-rebinding IP pinning, Dockerfile digest pin) are tracked in `audit/2026-07-01/PHASE-1-STATUS.md`.
 - Verified: `npm test` 176/176, `npm run lint` 0 errors, all edited Python parses; SEO report smoke-tested (renders + XSS escaped).
 
-## [0.9.1] — 2026-07-01
+## [0.9.1] - 2026-07-01
 
 ### Fixed — Credibility (honest status)
 - **Real CI on push/PR** (`.github/workflows/ci.yml`): lint + test + npm audit, all blocking. Previously the only workflow ran at release-tag and swallowed failures with `|| echo`.
@@ -252,7 +277,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - Fixed the corrupted version-history table (0.9.0/0.8.0 were duplicated).
 - **Note on 0.9.0 below:** the "64/64 fixed, score A+" and "auth on all endpoints" claims in the 0.9.0 entry were **overstated**. A 2026-07-01 adversarial re-audit (see `audit/2026-07-01/`) found 102 open findings and re-graded the project **C+**. The MCP token *is* checked by middleware on `/sse` and `/messages/`, but the prior "all endpoints" phrasing and the A+ score were not accurate. This release begins the honest remediation.
 
-## [0.9.0] — 2026-06-24
+## [0.9.0] - 2026-06-24
 
 ### Security
 - Full audit remediation: 64/64 findings fixed, score C- → A+
@@ -280,7 +305,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Tests
 - 143/143 tests passing
 
-## [0.8.0] — 2026-06-24
+## [0.8.0] - 2026-06-24
 
 ### Added
 - 3 new packs: pack-animated (web animation agent), pack-backup (universal backup agent), pack-seo (full SEO audit — 15 files with agents, refs, templates, playbooks)
@@ -305,7 +330,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Tests
 - 143/143 tests passing ✅
 
-## [0.7.5] — 2026-05-17
+## [0.7.5] - 2026-05-17
 
 ### 🩺 Quality & Compliance
 
@@ -323,7 +348,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
   - 2 decisions (anti-regression protocol, i18n-first CLI)
   - 2 patterns (dual-tier memory, surgical edit protocol)
 
-## [0.7.4] — 2026-05-17
+## [0.7.4] - 2026-05-17
 
 ### 🧠 Smart Autoconfig
 
@@ -338,7 +363,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Fixed
 - `--tools none` installer crash (undefined IDE name)
 
-## [0.7.3] — 2026-05-17
+## [0.7.3] - 2026-05-17
 
 ### 🎨 Scan UX Improvements
 
@@ -347,11 +372,11 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **`--active-days <n>`** — Custom threshold for "active" status (default: 30 days)
 - **`--paused-days <n>`** — Custom threshold for "paused" status (default: 180 days)
 
-## [0.7.2] - 2026-06-XX
+## [0.7.2] - 2026-05-17
 ### Fixed
 - `scan` command: `bmad-plus scan <path>` now accepts a positional path argument
 
-## [0.7.1] — 2026-05-17
+## [0.7.1] - 2026-05-17
 
 ### 🛠️ CLI Commands & Guardrails Injection
 
@@ -370,7 +395,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **Karpathy Guardrails injection** — 4 principles auto-injected into CLAUDE.md/GEMINI.md/AGENTS.md when Memory pack is installed
 - **i18n** — Memory + Dev Studio keys for EN and FR (other languages use fallback)
 
-## [0.7.0] — 2026-05-17
+## [0.7.0] - 2026-05-17
 
 ### 🧠 Pack Memory — Persistent Brain
 
@@ -390,7 +415,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - IDE config generation: Zecher agent listed when memory pack selected
 - Install guide: memory-specific examples (Zecher commands)
 
-## [0.6.0] — 2026-05-17
+## [0.6.0] - 2026-05-17
 
 ### 🏗️ Pack Dev Studio — Full Software Development Lifecycle
 
@@ -413,7 +438,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **install.js** — IDE configs now include 6 Torah-named agents when Dev Studio is selected
 - **Version reference** — Updated from BMAD-METHOD v6.2.0 to v6.6.0
 
-## [0.5.0] — 2026-05-17
+## [0.5.0] - 2026-05-17
 
 > **Correction (2026-07-15)** — as published, this section announced "38 expert compliance agents"
 > and "85 Reference Files". Both were false on the day they were written, so they are corrected
@@ -453,7 +478,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.4] — 2026-05-17
+## [0.4.4] - 2026-05-17
 
 ### 🔧 Encoding Fix + i18n Complete + Tests
 
@@ -469,7 +494,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.3] — 2026-05-17
+## [0.4.3] - 2026-05-17
 
 ### 🔧 CLI Commands + Security Hardening + UX Enhancements
 
@@ -497,7 +522,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.2] — 2026-03-19
+## [0.4.2] - 2026-03-19
 
 ### 📦 Public Packs — SEO/Backup/Animated now in npm
 
@@ -508,7 +533,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.1] — 2026-03-19
+## [0.4.1] - 2026-03-19
 
 ### 🌐 CLI Internationalization + DevOps Hardening
 
@@ -526,7 +551,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.0] — 2026-03-19
+## [0.4.0] - 2026-03-19
 
 ### 🏢 SEO Engine — Enterprise Extensions (Sprint 4)
 
@@ -542,7 +567,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.3] — 2026-03-19
+## [0.3.3] - 2026-03-19
 
 ### 🧪 SEO Engine — Quality & Security (Sprint 3)
 
@@ -554,7 +579,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.2] — 2026-03-19
+## [0.3.2] - 2026-03-19
 
 ### 📊 SEO Engine — Reports, Competitor & Hreflang (Sprint 2)
 
@@ -565,7 +590,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.1] — 2026-03-19
+## [0.3.1] - 2026-03-19
 
 ### 🔧 SEO Engine Enhancements (Sprint 1)
 
@@ -577,7 +602,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.0] — 2026-03-19
+## [0.3.0] - 2026-03-19
 
 ### 🚀 SEO Engine v2.0 — Complete Rewrite
 
@@ -614,7 +639,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.2.0] — 2026-03-18
+## [0.2.0] - 2026-03-18
 
 ### 🔀 Oveanet Fusion
 
@@ -635,7 +660,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.3] — 2026-03-18
+## [0.1.3] - 2026-03-18
 
 ### 🔧 Cross-Platform Fix
 
@@ -645,7 +670,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.2] — 2026-03-17
+## [0.1.2] - 2026-03-17
 
 ### 📝 Credits Update
 
@@ -655,7 +680,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.1] — 2026-03-17
+## [0.1.1] - 2026-03-17
 
 ### 👤 Author Attribution
 
@@ -665,7 +690,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.0] — 2026-03-17
+## [0.1.0] - 2026-03-17
 
 ### 🎉 Initial Release — Foundation
 
@@ -733,3 +758,39 @@ First release of BMAD+, an augmented fork of BMAD-METHOD v6.2.0.
 ---
 
 *For earlier history, see the upstream [BMAD-METHOD CHANGELOG](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/CHANGELOG.md).*
+
+<!-- Version links point to the npm release page. The public repository is a single snapshot, so per-version compare links are not available. Not published on npm: 0.15.0, 0.11.0, 0.10.0, 0.1.2. -->
+
+[0.17.1]: https://www.npmjs.com/package/bmad-plus/v/0.17.1
+[0.17.0]: https://www.npmjs.com/package/bmad-plus/v/0.17.0
+[0.16.0]: https://www.npmjs.com/package/bmad-plus/v/0.16.0
+[0.14.0]: https://www.npmjs.com/package/bmad-plus/v/0.14.0
+[0.13.0]: https://www.npmjs.com/package/bmad-plus/v/0.13.0
+[0.12.2]: https://www.npmjs.com/package/bmad-plus/v/0.12.2
+[0.12.1]: https://www.npmjs.com/package/bmad-plus/v/0.12.1
+[0.12.0]: https://www.npmjs.com/package/bmad-plus/v/0.12.0
+[0.9.2]: https://www.npmjs.com/package/bmad-plus/v/0.9.2
+[0.9.1]: https://www.npmjs.com/package/bmad-plus/v/0.9.1
+[0.9.0]: https://www.npmjs.com/package/bmad-plus/v/0.9.0
+[0.8.0]: https://www.npmjs.com/package/bmad-plus/v/0.8.0
+[0.7.5]: https://www.npmjs.com/package/bmad-plus/v/0.7.5
+[0.7.4]: https://www.npmjs.com/package/bmad-plus/v/0.7.4
+[0.7.3]: https://www.npmjs.com/package/bmad-plus/v/0.7.3
+[0.7.2]: https://www.npmjs.com/package/bmad-plus/v/0.7.2
+[0.7.1]: https://www.npmjs.com/package/bmad-plus/v/0.7.1
+[0.7.0]: https://www.npmjs.com/package/bmad-plus/v/0.7.0
+[0.6.0]: https://www.npmjs.com/package/bmad-plus/v/0.6.0
+[0.5.0]: https://www.npmjs.com/package/bmad-plus/v/0.5.0
+[0.4.4]: https://www.npmjs.com/package/bmad-plus/v/0.4.4
+[0.4.3]: https://www.npmjs.com/package/bmad-plus/v/0.4.3
+[0.4.2]: https://www.npmjs.com/package/bmad-plus/v/0.4.2
+[0.4.1]: https://www.npmjs.com/package/bmad-plus/v/0.4.1
+[0.4.0]: https://www.npmjs.com/package/bmad-plus/v/0.4.0
+[0.3.3]: https://www.npmjs.com/package/bmad-plus/v/0.3.3
+[0.3.2]: https://www.npmjs.com/package/bmad-plus/v/0.3.2
+[0.3.1]: https://www.npmjs.com/package/bmad-plus/v/0.3.1
+[0.3.0]: https://www.npmjs.com/package/bmad-plus/v/0.3.0
+[0.2.0]: https://www.npmjs.com/package/bmad-plus/v/0.2.0
+[0.1.3]: https://www.npmjs.com/package/bmad-plus/v/0.1.3
+[0.1.1]: https://www.npmjs.com/package/bmad-plus/v/0.1.1
+[0.1.0]: https://www.npmjs.com/package/bmad-plus/v/0.1.0

package/README.md

@@ -1,8 +1,8 @@
 # BMAD+
 
-[![Version](https://img.shields.io/badge/version-0.17.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.17.1-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.17.0** · Node.js `>=20.0.0` · MIT
+**Version 0.17.1** · Node.js `>=20.0.0` · MIT
 
 Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters
 
@@ -35,7 +35,7 @@ Run the installer. Select the adapters for the AI tools you use and the packs yo
 **In your project terminal:**
 
 ```sh
-npx bmad-plus@0.17.0 install
+npx bmad-plus@0.17.1 install
 ```
 
 The installer creates the agent instructions, shared project spine and selected tool adapters. Optional packs may need additional runtimes or API access.
@@ -171,20 +171,20 @@ Read AGENTS.md and the available project memory. Summarize the last verified sta
 
 Expected result: a short, evidence-based restart. Project notes are useful context and still need to be checked against the current work.
 
-## What’s new in 0.17.0
+## What’s new in 0.17.1
 
-Reliable acceptance pages and clearer release checks
+Safer installs and cleaner updates
 
-Acceptance pages now prevent silent answer loss and empty exports, recipes build by their own identifier, and project release checks work directly with Node on Windows. Guides add practical prompts for reading results and preserving project context.
+Installing over a different version now stops and points to update, re-installs keep your settings, and updates remove files a version no longer ships while keeping a restorable backup. Some install behaviors changed; review your scripts before rerunning them.
 
-- Pages served locally or opened as files keep their steps hidden until a run starts. Recording, finishing or exporting before that point produces a visible message instead of losing answers or downloading null.json.
-- uat build resolves the specification by its id even when the filename differs. The shipped example-uat-spec.json can be built with uat build example-1.0.0.
-- The progress bar shows each step’s state, the tester and the finish date. Its segments jump to the corresponding step, and commands in action lines copy on click.
-- The skill includes a recipe-presence check and a release gate, plus a complete example with witnesses, a writing step and read-only confirmation. Wire the checks into your own project; the installer does not add lifecycle hooks to user projects.
-- A blocked expectation needs a replay or an explicit accept-risk decision naming its owner. Classifying an unobserved check does not establish success, and a passed writing step still needs independent evidence.
-- The release gate calls the CLI through Node instead of spawning an npx.cmd shim. A missing CLI or a gate that could not run produces an error, never a passing verdict.
-- The skill uses uat.mode consistently. An updated project with no uat block remains advisory, and the installer’s test-environment question is translated into all ten installer languages.
-- English, French, Spanish and German guides share the reviewed release notes and seven examples, including Zecher memory handoffs and acceptance-result review. The official public GitHub source is linked from the site; distribution checks exclude maintainer-only adapters.
+- install refuses to overwrite a different installed version. A downgrade is refused; for an upgrade, run bmad-plus update, which keeps backups and restorable receipts. Re-installing the same version only adds missing files.
+- Re-installing keeps your _bmad/config.yaml settings and adds only missing defaults. The manifest and configuration are written atomically.
+- --packs and --tools add to the previous installation instead of replacing it. An unknown pack or tool ID fails before any write and lists the valid IDs.
+- update deletes unchanged files that the new version no longer ships, backs them up in the update receipt and restores them with --restore. Files you edited are kept and reported.
+- A project lock left by a crashed process is taken over automatically when its owner is provably no longer running on this machine; doctor reports other stale locks with the manual remedy.
+- Without a terminal, installs use --lang, then the system locale, then English. --yes with no detected AI tool writes no adapter files. uninstall accepts -d/--directory.
+- The npm package no longer includes maintainer release scripts. OSINT and Shield carry legal and AI-generated-output notices; Shadow is described as governed public-source research.
+- Translated READMEs mirror the public README, which adds a non-affiliation notice and a factual comparison. The website shows the install command up front and supports a dark color scheme.
 
 ## Version History
 
@@ -192,21 +192,25 @@ These dates identify reviewed CHANGELOG notes, not npm publication dates. The we
 
 | Version | Release-notes date | Reviewed summary |
 | --- | --- | --- |
+| 0.17.1 | 2026-09-24 | Installing over a different version now stops and points to update, re-installs keep your settings, and updates remove files a version no longer ships while keeping a restorable backup. Some install behaviors changed; review your scripts before rerunning them. |
 | 0.17.0 | 2026-09-22 | Acceptance pages now prevent silent answer loss and empty exports, recipes build by their own identifier, and project release checks work directly with Node on Windows. Guides add practical prompts for reading results and preserving project context. |
 | 0.16.0 | 2026-09-16 | A delivery now produces a step-by-step page a person plays, and their run comes back as evidence the agents read, classify and gate on. This release also carries what 0.15.0 had prepared and never shipped: durable Nexus execution, evidence-ranked memory and scored checks for every pack. |
-| 0.14.0 | 2026-09-09 | Dev Studio gains complete instructions and verifiable context loading; release documentation follows the published package. |
 
 [Release history and update guide](https://bmad-plus.rochetta.fr/docs/#changelog) · [All published npm versions](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 
 ---
 
-## 📄 License
+## License
 
 MIT — Based on [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) (MIT)
 
-BMAD+ is an independent derivative, not an official BMad Code, LLC release or endorsement.
+BMAD+ is an independent community project derived from BMAD-METHOD (MIT) by BMad Code, LLC. It is not affiliated with, endorsed by or certified by BMad Code, LLC. BMad™ and BMad Method™ are trademarks of BMad Code, LLC; see the [BMad trademark guidelines](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/TRADEMARK.md).
 Bundled source attributions and terms: [Third-party notices](THIRD-PARTY-LICENSES.md).
 
+The OSINT pack is governed: researching a named person requires a recorded purpose and legal basis. See the [OSINT legal notice](osint-agent-package/skills/bmad-osint-investigate/osint/references/gdpr-osint.md).
+
+Translations: [Français](readme-international/README.fr.md) · [Español](readme-international/README.es.md) · [Deutsch](readme-international/README.de.md)
+
 ### Credits
 
 **Creator**
@@ -223,7 +227,3 @@ Bundled source attributions and terms: [Third-party notices](THIRD-PARTY-LICENSE
 - **OSINT Pipeline** based on [smixs/osint-skill](https://github.com/smixs/osint-skill) (MIT)
 - **Apify integration** — OSINT helper and inspiration from [Apify agent skills](https://github.com/apify/agent-skills) (upstream declares Apache-2.0; see notices)
 - **Karpathy Guardrails** — Memory Pack adaptation of [community guidelines by forrestchang](https://github.com/multica-ai/andrej-karpathy-skills), inspired by Andrej Karpathy (MIT declared upstream)
-
-**Tools & Infrastructure**
-- [Evolution API](https://github.com/EvolutionAPI/evolution-api) — WhatsApp notifications for upstream monitoring
-- [Gemini API](https://ai.google.dev/) — AI analysis for upstream change classification

package/SECURITY.md

@@ -14,7 +14,15 @@ and in the [release history](https://bmad-plus.rochetta.fr/docs/#releases).
 
 If you discover a security vulnerability in BMAD+, please report it responsibly:
 
-### 📧 Contact
+### 🔒 Preferred: GitHub private vulnerability reporting
+
+Use **[Report a vulnerability](https://github.com/lrochetta/BMAD-PLUS/security/advisories/new)**
+(repository *Security* tab → *Report a vulnerability*). The report stays private
+between you and the maintainer, and the fix and advisory are coordinated there.
+
+### 📧 Fallback: email
+
+If you cannot use GitHub private reporting:
 
 **Email:** [l.rochetta@gmail.com](mailto:l.rochetta@gmail.com)
 

package/osint-agent-package/README.md

@@ -1,5 +1,18 @@
 # 🔍 OSINT Agent Package — BMAD Compatible
 
+> [!WARNING]
+> **Avis juridique et éthique — à lire avant toute utilisation / Legal & ethics notice**
+>
+> - **Base légale obligatoire (RGPD art. 6).** Toute collecte ou analyse de données sur une personne identifiable est un traitement de données personnelles : il faut une base légale documentée (intérêt légitime mis en balance, obligation légale, mission d'intérêt public…) *avant* de lancer une investigation. La consigner dans [`lawful-basis-record.md`](skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md).
+> - **Données sensibles (RGPD art. 9).** Opinions politiques, religion, santé, orientation sexuelle, données biométriques, etc. sont interdites de traitement sauf exception de l'art. 9(2). Le psychoprofilage peut *inférer* ce type de données : ne pas le faire sans base légale explicite.
+> - **Pas de profilage de particuliers sans base légale.** Aucun ciblage, surveillance ou profilage de personnes privées (ex-conjoint, voisin, salarié, candidat…) par curiosité ou pour harceler. Les personnalités publiques ne sont couvertes que pour leur rôle public.
+> - **Conditions d'utilisation des plateformes.** Le scraping (Apify, LinkedIn, Instagram, Facebook, TikTok…) peut violer les CGU des plateformes et le droit local ; vérifier avant usage.
+> - **Responsabilité de l'utilisateur.** Vous êtes le responsable de traitement : BMAD+ fournit un outil, pas une autorisation. Le résultat est généré par IA, peut être faux et doit être vérifié par un humain avant toute décision.
+>
+> Cadre de référence : [`gdpr-osint.md`](skills/bmad-osint-investigate/osint/references/gdpr-osint.md). La porte de conformité intégrée à l'agent (« Phase −1 — Lawful Basis Gate » du `SKILL.md`, qui refuse toute investigation nominative sans base légale) reste active et ne doit pas être contournée.
+>
+> *EN — You need a documented GDPR Art. 6 lawful basis (and an Art. 9(2) exception for special-category data) before investigating anyone; respect platform ToS; never profile private individuals without a legal basis; you, the user, are the data controller and bear full responsibility.*
+
 Agent d'intelligence OSINT pour les installations BMAD. De un nom ou pseudo à un dossier complet avec psychoprofil, parcours professionnel et grades de confiance.
 
 ## Features

package/osint-agent-package/SETUP_KEYS.md

@@ -1,5 +1,18 @@
 # 🔑 Configuration des Clés API
 
+> [!WARNING]
+> **Avis juridique et éthique — à lire avant toute utilisation / Legal & ethics notice**
+>
+> - **Base légale obligatoire (RGPD art. 6).** Toute collecte ou analyse de données sur une personne identifiable est un traitement de données personnelles : il faut une base légale documentée (intérêt légitime mis en balance, obligation légale, mission d'intérêt public…) *avant* de lancer une investigation. La consigner dans [`lawful-basis-record.md`](skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md).
+> - **Données sensibles (RGPD art. 9).** Opinions politiques, religion, santé, orientation sexuelle, données biométriques, etc. sont interdites de traitement sauf exception de l'art. 9(2). Le psychoprofilage peut *inférer* ce type de données : ne pas le faire sans base légale explicite.
+> - **Pas de profilage de particuliers sans base légale.** Aucun ciblage, surveillance ou profilage de personnes privées (ex-conjoint, voisin, salarié, candidat…) par curiosité ou pour harceler. Les personnalités publiques ne sont couvertes que pour leur rôle public.
+> - **Conditions d'utilisation des plateformes.** Le scraping (Apify, LinkedIn, Instagram, Facebook, TikTok…) peut violer les CGU des plateformes et le droit local ; vérifier avant usage.
+> - **Responsabilité de l'utilisateur.** Vous êtes le responsable de traitement : BMAD+ fournit un outil, pas une autorisation. Le résultat est généré par IA, peut être faux et doit être vérifié par un humain avant toute décision.
+>
+> Cadre de référence : [`gdpr-osint.md`](skills/bmad-osint-investigate/osint/references/gdpr-osint.md). La porte de conformité intégrée à l'agent (« Phase −1 — Lawful Basis Gate » du `SKILL.md`, qui refuse toute investigation nominative sans base légale) reste active et ne doit pas être contournée.
+>
+> *EN — You need a documented GDPR Art. 6 lawful basis (and an Art. 9(2) exception for special-category data) before investigating anyone; respect platform ToS; never profile private individuals without a legal basis; you, the user, are the data controller and bear full responsibility.*
+
 Ce guide explique comment configurer les clés API pour l'agent OSINT.  
 **Tu n'as besoin que d'UNE SEULE clé pour démarrer.** Plus tu en configures, plus l'agent est puissant.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters",
   "homepage": "https://bmad-plus.rochetta.fr",
   "keywords": [
@@ -25,7 +25,13 @@
     "bmad-plus": "tools/bmad-plus-npx.js"
   },
   "files": [
-    "tools",
+    "tools/bmad-plus-npx.js",
+    "tools/cli",
+    "tools/build/adapters.config.js",
+    "tools/build/generate-adapters.js",
+    "tools/build/generate.js",
+    "tools/build/module.template.yaml",
+    "tools/build/pack-delivery.js",
     "src/bmad-plus",
     "osint-agent-package",
     "readme-international",
@@ -43,14 +49,17 @@
     "build": "node tools/build/generate.js --out tools/cli/lib/packs.js --module-out src/bmad-plus/module.yaml",
     "build:check": "node tools/build/generate.js --check",
     "check:counts": "node tools/build/check-counts.js",
+    "check:counts:full": "jest --coverage=false --silent --json --outputFile=coverage/jest-report.json && node tools/build/check-counts.js --jest-report coverage/jest-report.json",
     "uat:spec": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-spec-present.mjs --dir recettes",
     "uat:gate": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-release-gate.mjs --dir recettes --cli tools/cli/bmad-plus-cli.js",
     "lint": "eslint tools/ tests/",
     "format": "prettier --write \"tools/**/*.js\" \"tests/**/*.js\"",
     "format:check": "prettier --check \"tools/**/*.js\" \"tests/**/*.js\"",
     "test": "jest --coverage",
+    "test:parallel": "jest --coverage=false --testPathIgnorePatterns \"(nexus(-cli|-process)?|memory-outcomes|upstream-candidate|npm-runner)\\.test\\.js$\"",
+    "test:serial": "jest --coverage=false --runInBand --testPathPatterns \"(nexus(-cli|-process)?|memory-outcomes|upstream-candidate|npm-runner)\\.test\\.js$\"",
     "test:install-contract": "node tools/build/check-install-contract.js",
-    "prepare": "husky || true",
+    "prepare": "node -e \"try{require('node:child_process').execSync('husky',{stdio:'inherit'})}catch{console.warn('WARNING: husky did not install the git hooks, so the pre-push release gate is inactive in this checkout. Run npx husky to retry.')}\"",
     "uninstall:bmad": "node tools/cli/bmad-plus-cli.js uninstall"
   },
   "dependencies": {
@@ -66,29 +75,42 @@
   },
   "overrides": {
     "@istanbuljs/load-nyc-config": {
-      "js-yaml": "4.2.0"
+      "js-yaml": "4.3.2"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "jest": {
+    "roots": [
+      "<rootDir>/tests",
+      "<rootDir>/tools"
+    ],
     "testPathIgnorePatterns": [
       "/node_modules/",
       "/website/",
       "/evals/"
     ],
     "collectCoverage": true,
+    "collectCoverageFrom": [
+      "tools/**/*.js",
+      "!tools/build/generated-adapters/**"
+    ],
     "coverageDirectory": "coverage",
     "moduleNameMapper": {
       "^@clack/prompts$": "<rootDir>/tests/__mocks__/clack-prompts.js"
     },
     "coverageThreshold": {
       "global": {
-        "branches": 35,
-        "functions": 40,
-        "lines": 40,
-        "statements": 40
+        "branches": 65,
+        "functions": 70,
+        "lines": 70,
+        "statements": 70
+      },
+      "./tools/cli/commands/install.js": {
+        "lines": 65,
+        "statements": 65,
+        "functions": 45
       },
       "./tools/cli/commands/doctor.js": {
         "lines": 60,