bmad-plus 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -5,7 +5,49 @@ All notable changes to BMAD+ will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.18.0] - 2026-09-25
+
+### Added
+
+- **The acceptance page names what it guarantees, and the build refuses a template that lost one.** `uat build --json` lists sixteen page guarantees (`hidden-before-start`, `verified-local-write`, `honest-save-status`, `save-on-every-change`, `restore-before-capabilities`, `revision-guard`, `other-tab-notice`, `unreadable-draft-kept`, `progress-accessible`, `storage-explained`, `finished-is-not-accepted`, …); a template missing one is not built. A jsdom suite replays every scenario of the FormaPro incident of 2026-09-25 — start, tick, note without blur, immediate reload, storage refused, unreadable draft, amended recipe, two tabs, artifact database precedence, local server — and `tools/qa/uat-page-browser-check.js` walks the essential pass in Chromium, because the original defect lived in the stylesheet.
+- The page offers a run that answered another revision of the recipe instead of pouring it in: identical lines keep their answers, changed lines are asked again, the earlier run stays untouched and exportable, and the new run records `carriedFrom`. Another run can be started while the previous one stays saved; the resume list shows the newest copy of each run first, with its progress.
+- Finishing with unanswered lines is questioned on the page itself and confirmed by a second click, never through a dialog a host may swallow. A change after finishing is kept, dated, and said on screen. A blocked line asks "What stopped you?"; a note already written stays in view whatever the answer became.
+- `uat serve` refuses an older copy of a run (409), any host name but its own (403), and prints the port it actually bound. A tester whose name has no Latin letter signs the run with a stable hash instead of "anonymous".
+- The skill carries the contract: an agent builds the page with the command, never writes it by hand, plays the essential pass in a real browser before handing the page over, tells the tester where the answers live, and says in the delivery which checks ran.
+
+### Fixed
+
+- **The acceptance page could say "saved" without a verified write.** A refused write to the browser (quota, private window, blocked storage) was swallowed and the status still read saved. A write now counts only once it reads back — the run and the pointer that finds it — and a failed save shows a persistent warning, questions leaving the page, and keeps the export available. A failed remote copy is reported as such, with the local copy kept.
+- The browser's copy of a run is restored synchronously on reload, before the local-server probe and the artifact database answer or hang; an older remote copy no longer overwrites a newer local one, and a newer remote one is adopted and written back to the browser.
+- A stored run that cannot be read is reported and exportable, never deleted in silence. Two tabs on the same run converge on the latest change, and the page says so.
+- The progress bar exposes the share of lines answered as an accessible `progressbar` — answered, not passed — next to the seen / not seen / blocked counts, and the page explains where answers live and what can make them disappear. Finishing says it is not an acceptance. The diacritics range in run ids is written as escapes so a charset hop cannot corrupt it.
+- `update`, `update --latest` and `update-check` run outside an installed project now say which folder they looked in and how to run them from the project folder (or with `--directory`), instead of a raw `ENOENT` error or an unexplained `invalid-installation` status. `update-check --json` keeps its JSON on stdout and writes the guidance to stderr.
+- The release workflow's npm verification now reports the integrity npm actually served, so a registry availability delay can no longer read as a different archive.
+
+## [0.17.1] - 2026-09-24
+
+### Changed
+- **`install` no longer overwrites a different installed version.** A downgrade is refused; an upgrade stops and points to `bmad-plus update`, which keeps backups and restorable receipts. Re-installing the same version only adds what is missing. Scripts that re-ran `install` to change versions must call `update` instead.
+- **`--packs` and `--tools` add to the previous installation** instead of replacing it. An unknown pack or tool ID now fails before anything is written, and the error lists the valid IDs.
+- **Unattended installs default to English.** Without a terminal, the communication language comes from `--lang`, then from the system locale, then English. `--yes` with no detected AI tool writes no adapter files.
+- `update` deletes files that a new version no longer ships when you have not changed them; each deletion is backed up in the update receipt and `--restore` brings it back. Files you edited are kept and reported as `modified-orphaned-file`.
+- The npm package no longer ships the maintainers' release and maintenance scripts, only the launcher, the CLI and the build modules it needs at runtime. The archive is smaller; installed projects are unaffected.
+- The OSINT pack opens with a legal and ethics notice (GDPR lawful basis, platform terms, no private profiling), and Shadow's reports start with an AI-generated, not-legal-advice disclaimer. Shadow is described as governed public-source research; its lawful-basis gate is unchanged.
+- The Shield pack and its audit report template carry a shared not-legal-advice notice, an AI-generated banner and a qualified-reviewer sign-off field.
+
+### Fixed
+- Re-installing keeps your `_bmad/config.yaml`: existing settings win, missing defaults are added, and an unparsable file is left untouched. The manifest and configuration are written atomically, so an interrupted install cannot leave them half-written.
+- A `.bmad/update.lock` left by a crashed process no longer blocks the project: when its owner is provably dead on this machine, the lock is moved aside and taken over. Other stale locks are reported by `doctor`, and the error states the manual remedy.
+- `uninstall` accepts `-d`/`--directory` like the other maintenance commands. Help names the program `bmad-plus`, and a subcommand's `--lang` is no longer swallowed by a global option.
+- The installer shows each pack with its emoji icon.
+- Release automation now waits for npm's publish-time scanning before verifying public archive integrity. Polling is bounded to thirty attempts with thirty-second intervals and a twenty-minute step limit. An unavailable version still blocks the landing, and recovery instructions explicitly forbid uploading the same version again.
+
+### Security
+- The development-only `js-yaml` copy used by the coverage tooling is pinned to the patched 4.3.2. The production dependency audit remains clean.
+
+### Documentation
+- The French, Spanish and German READMEs mirror the public README section by section. The README states that BMAD+ is not affiliated with BMad Code, LLC, and replaces the BMAD-METHOD comparison with a factual list of what BMAD+ ships.
+- The website shows the install command with a copy control in its hero, supports a dark color scheme, folds navigation on small screens and names the supported tools.
 
 ## [0.17.0] - 2026-09-22
 
@@ -177,7 +219,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` 333/333 (16 suites); lint 0 errors under eslint 10; both `npx npm@10 ci --dry-run` and `npm ci --dry-run` green; CI + Platform workflows green on GOLDEN master.
 
-## [0.12.0] — 2026-07-02
+## [0.12.0] - 2026-07-02
 
 ### Added — Load-bearing activation (north-star Pillars 3, 4, 5)
 - **Pillar 4 executable:** `evals/_runner/providers.py` — a provider-neutral model gateway (anthropic / openai / generic-HTTP adapters selected by `BMAD_EVAL_PROVIDER`, default deterministic **mock** so `--self-check` and CI never hit the network). `run_agent(spec, model)` now routes through it; the eval harness genuinely runs (3/3 specs pass).
@@ -190,7 +232,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` **333 passed / 16 suites**; `build:check` + `generate-adapters --check` no drift; `run.py --self-check` 3/3; edited Python parses.
 
-## [0.11.0] — 2026-07-02
+## [0.11.0] - 2026-07-02
 
 ### Added — Karpathy loop CLI + multi-CLI adapters (north-star Pillars 3 & 5)
 - **`bmad mem` command (Pillar 3):** `recall <query>` / `write` / `reinforce` expose the memory-journal (append/recall + Elo reward + governance guard) from the CLI, so the learning loop is usable from any driving tool. `tests/unit/memory-journal-cmd.test.js`.
@@ -203,7 +245,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` **325 passed / 16 suites**; `npm run build:check` no drift; `generate-adapters.js --check` no drift.
 
-## [0.10.0] — 2026-07-02
+## [0.10.0] - 2026-07-02
 
 ### Added — Platform-spine foundations (north-star Phase 2)
 Built as **new files only** (no existing core file modified); test suite grew from 176/10 to **258 passed / 13 suites**. Cut nothing; multi-tool/multi-model preserved.
@@ -216,7 +258,7 @@ Built as **new files only** (no existing core file modified); test suite grew fr
 
 Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remaining integration (provisioning called from install, memory exposed via MCP, generated multi-CLI adapters) lands next as its own tested commit — see `audit/2026-07-01/PHASE-2-STATUS.md`.
 
-## [0.9.2] — 2026-07-01
+## [0.9.2] - 2026-07-01
 
 ### Security — Phase 1 remediation (exploitable findings)
 - **RCE closed** (`ci_cd.py`): command allowlist now uses exact-token matching (shlex.split) + realpath/commonpath containment instead of prefix/`startswith` — defeats argument injection (`make -f attacker.mk`) and sibling-path bypass; `shell=False` throughout; dead Makefile fallback removed.
@@ -237,7 +279,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - Documented residual follow-ups (SSRF crawler-class redirect hops, DNS-rebinding IP pinning, Dockerfile digest pin) are tracked in `audit/2026-07-01/PHASE-1-STATUS.md`.
 - Verified: `npm test` 176/176, `npm run lint` 0 errors, all edited Python parses; SEO report smoke-tested (renders + XSS escaped).
 
-## [0.9.1] — 2026-07-01
+## [0.9.1] - 2026-07-01
 
 ### Fixed — Credibility (honest status)
 - **Real CI on push/PR** (`.github/workflows/ci.yml`): lint + test + npm audit, all blocking. Previously the only workflow ran at release-tag and swallowed failures with `|| echo`.
@@ -252,7 +294,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - Fixed the corrupted version-history table (0.9.0/0.8.0 were duplicated).
 - **Note on 0.9.0 below:** the "64/64 fixed, score A+" and "auth on all endpoints" claims in the 0.9.0 entry were **overstated**. A 2026-07-01 adversarial re-audit (see `audit/2026-07-01/`) found 102 open findings and re-graded the project **C+**. The MCP token *is* checked by middleware on `/sse` and `/messages/`, but the prior "all endpoints" phrasing and the A+ score were not accurate. This release begins the honest remediation.
 
-## [0.9.0] — 2026-06-24
+## [0.9.0] - 2026-06-24
 
 ### Security
 - Full audit remediation: 64/64 findings fixed, score C- → A+
@@ -280,7 +322,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Tests
 - 143/143 tests passing
 
-## [0.8.0] — 2026-06-24
+## [0.8.0] - 2026-06-24
 
 ### Added
 - 3 new packs: pack-animated (web animation agent), pack-backup (universal backup agent), pack-seo (full SEO audit — 15 files with agents, refs, templates, playbooks)
@@ -305,7 +347,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Tests
 - 143/143 tests passing ✅
 
-## [0.7.5] — 2026-05-17
+## [0.7.5] - 2026-05-17
 
 ### 🩺 Quality & Compliance
 
@@ -323,7 +365,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
   - 2 decisions (anti-regression protocol, i18n-first CLI)
   - 2 patterns (dual-tier memory, surgical edit protocol)
 
-## [0.7.4] — 2026-05-17
+## [0.7.4] - 2026-05-17
 
 ### 🧠 Smart Autoconfig
 
@@ -338,7 +380,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Fixed
 - `--tools none` installer crash (undefined IDE name)
 
-## [0.7.3] — 2026-05-17
+## [0.7.3] - 2026-05-17
 
 ### 🎨 Scan UX Improvements
 
@@ -347,11 +389,11 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **`--active-days <n>`** — Custom threshold for "active" status (default: 30 days)
 - **`--paused-days <n>`** — Custom threshold for "paused" status (default: 180 days)
 
-## [0.7.2] - 2026-06-XX
+## [0.7.2] - 2026-05-17
 ### Fixed
 - `scan` command: `bmad-plus scan <path>` now accepts a positional path argument
 
-## [0.7.1] — 2026-05-17
+## [0.7.1] - 2026-05-17
 
 ### 🛠️ CLI Commands & Guardrails Injection
 
@@ -370,7 +412,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **Karpathy Guardrails injection** — 4 principles auto-injected into CLAUDE.md/GEMINI.md/AGENTS.md when Memory pack is installed
 - **i18n** — Memory + Dev Studio keys for EN and FR (other languages use fallback)
 
-## [0.7.0] — 2026-05-17
+## [0.7.0] - 2026-05-17
 
 ### 🧠 Pack Memory — Persistent Brain
 
@@ -390,7 +432,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - IDE config generation: Zecher agent listed when memory pack selected
 - Install guide: memory-specific examples (Zecher commands)
 
-## [0.6.0] — 2026-05-17
+## [0.6.0] - 2026-05-17
 
 ### 🏗️ Pack Dev Studio — Full Software Development Lifecycle
 
@@ -413,7 +455,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **install.js** — IDE configs now include 6 Torah-named agents when Dev Studio is selected
 - **Version reference** — Updated from BMAD-METHOD v6.2.0 to v6.6.0
 
-## [0.5.0] — 2026-05-17
+## [0.5.0] - 2026-05-17
 
 > **Correction (2026-07-15)** — as published, this section announced "38 expert compliance agents"
 > and "85 Reference Files". Both were false on the day they were written, so they are corrected
@@ -453,7 +495,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.4] — 2026-05-17
+## [0.4.4] - 2026-05-17
 
 ### 🔧 Encoding Fix + i18n Complete + Tests
 
@@ -469,7 +511,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.3] — 2026-05-17
+## [0.4.3] - 2026-05-17
 
 ### 🔧 CLI Commands + Security Hardening + UX Enhancements
 
@@ -497,7 +539,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.2] — 2026-03-19
+## [0.4.2] - 2026-03-19
 
 ### 📦 Public Packs — SEO/Backup/Animated now in npm
 
@@ -508,7 +550,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.1] — 2026-03-19
+## [0.4.1] - 2026-03-19
 
 ### 🌐 CLI Internationalization + DevOps Hardening
 
@@ -526,7 +568,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.0] — 2026-03-19
+## [0.4.0] - 2026-03-19
 
 ### 🏢 SEO Engine — Enterprise Extensions (Sprint 4)
 
@@ -542,7 +584,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.3] — 2026-03-19
+## [0.3.3] - 2026-03-19
 
 ### 🧪 SEO Engine — Quality & Security (Sprint 3)
 
@@ -554,7 +596,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.2] — 2026-03-19
+## [0.3.2] - 2026-03-19
 
 ### 📊 SEO Engine — Reports, Competitor & Hreflang (Sprint 2)
 
@@ -565,7 +607,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.1] — 2026-03-19
+## [0.3.1] - 2026-03-19
 
 ### 🔧 SEO Engine Enhancements (Sprint 1)
 
@@ -577,7 +619,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.0] — 2026-03-19
+## [0.3.0] - 2026-03-19
 
 ### 🚀 SEO Engine v2.0 — Complete Rewrite
 
@@ -614,7 +656,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.2.0] — 2026-03-18
+## [0.2.0] - 2026-03-18
 
 ### 🔀 Oveanet Fusion
 
@@ -635,7 +677,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.3] — 2026-03-18
+## [0.1.3] - 2026-03-18
 
 ### 🔧 Cross-Platform Fix
 
@@ -645,7 +687,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.2] — 2026-03-17
+## [0.1.2] - 2026-03-17
 
 ### 📝 Credits Update
 
@@ -655,7 +697,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.1] — 2026-03-17
+## [0.1.1] - 2026-03-17
 
 ### 👤 Author Attribution
 
@@ -665,7 +707,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.0] — 2026-03-17
+## [0.1.0] - 2026-03-17
 
 ### 🎉 Initial Release — Foundation
 
@@ -733,3 +775,39 @@ First release of BMAD+, an augmented fork of BMAD-METHOD v6.2.0.
 ---
 
 *For earlier history, see the upstream [BMAD-METHOD CHANGELOG](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/CHANGELOG.md).*
+
+<!-- Version links point to the npm release page. The public repository is a single snapshot, so per-version compare links are not available. Not published on npm: 0.15.0, 0.11.0, 0.10.0, 0.1.2. -->
+
+[0.17.1]: https://www.npmjs.com/package/bmad-plus/v/0.17.1
+[0.17.0]: https://www.npmjs.com/package/bmad-plus/v/0.17.0
+[0.16.0]: https://www.npmjs.com/package/bmad-plus/v/0.16.0
+[0.14.0]: https://www.npmjs.com/package/bmad-plus/v/0.14.0
+[0.13.0]: https://www.npmjs.com/package/bmad-plus/v/0.13.0
+[0.12.2]: https://www.npmjs.com/package/bmad-plus/v/0.12.2
+[0.12.1]: https://www.npmjs.com/package/bmad-plus/v/0.12.1
+[0.12.0]: https://www.npmjs.com/package/bmad-plus/v/0.12.0
+[0.9.2]: https://www.npmjs.com/package/bmad-plus/v/0.9.2
+[0.9.1]: https://www.npmjs.com/package/bmad-plus/v/0.9.1
+[0.9.0]: https://www.npmjs.com/package/bmad-plus/v/0.9.0
+[0.8.0]: https://www.npmjs.com/package/bmad-plus/v/0.8.0
+[0.7.5]: https://www.npmjs.com/package/bmad-plus/v/0.7.5
+[0.7.4]: https://www.npmjs.com/package/bmad-plus/v/0.7.4
+[0.7.3]: https://www.npmjs.com/package/bmad-plus/v/0.7.3
+[0.7.2]: https://www.npmjs.com/package/bmad-plus/v/0.7.2
+[0.7.1]: https://www.npmjs.com/package/bmad-plus/v/0.7.1
+[0.7.0]: https://www.npmjs.com/package/bmad-plus/v/0.7.0
+[0.6.0]: https://www.npmjs.com/package/bmad-plus/v/0.6.0
+[0.5.0]: https://www.npmjs.com/package/bmad-plus/v/0.5.0
+[0.4.4]: https://www.npmjs.com/package/bmad-plus/v/0.4.4
+[0.4.3]: https://www.npmjs.com/package/bmad-plus/v/0.4.3
+[0.4.2]: https://www.npmjs.com/package/bmad-plus/v/0.4.2
+[0.4.1]: https://www.npmjs.com/package/bmad-plus/v/0.4.1
+[0.4.0]: https://www.npmjs.com/package/bmad-plus/v/0.4.0
+[0.3.3]: https://www.npmjs.com/package/bmad-plus/v/0.3.3
+[0.3.2]: https://www.npmjs.com/package/bmad-plus/v/0.3.2
+[0.3.1]: https://www.npmjs.com/package/bmad-plus/v/0.3.1
+[0.3.0]: https://www.npmjs.com/package/bmad-plus/v/0.3.0
+[0.2.0]: https://www.npmjs.com/package/bmad-plus/v/0.2.0
+[0.1.3]: https://www.npmjs.com/package/bmad-plus/v/0.1.3
+[0.1.1]: https://www.npmjs.com/package/bmad-plus/v/0.1.1
+[0.1.0]: https://www.npmjs.com/package/bmad-plus/v/0.1.0

package/README.md

@@ -1,8 +1,8 @@
 # BMAD+
 
-[![Version](https://img.shields.io/badge/version-0.17.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.18.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.17.0** · Node.js `>=20.0.0` · MIT
+**Version 0.18.0** · Node.js `>=20.0.0` · MIT
 
 Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters
 
@@ -35,7 +35,7 @@ Run the installer. Select the adapters for the AI tools you use and the packs yo
 **In your project terminal:**
 
 ```sh
-npx bmad-plus@0.17.0 install
+npx bmad-plus@0.18.0 install
 ```
 
 The installer creates the agent instructions, shared project spine and selected tool adapters. Optional packs may need additional runtimes or API access.
@@ -136,7 +136,7 @@ Expected result: bounded assignments, explicit dependencies and one integrated r
 Use when a version reaches your test environment and someone must check it on screen.
 
 ```text
-Sentinel, write the acceptance recipe for this delivery on our test environment. One step per gesture, one verifiable fact per line, on-screen labels quoted from the code, and mark the steps that write for real. Build the page, then tell me the link, how long it takes and what I must not skip. Use disposable test data when possible, name the exact folder and files each command changes, and keep automated evidence separate from the person’s answers.
+Sentinel, write the acceptance recipe for this delivery on our test environment. One step per gesture, one verifiable fact per line, on-screen labels quoted from the code, and mark the steps that write for real. Build the page, then tell me the link, how long it takes and what I must not skip. Use disposable test data when possible, name the exact folder and files each command changes, and keep automated evidence separate from the person’s answers. Before handing the page over, build it with uat build, check the guarantees it lists, play the essential pass yourself in a real browser — start, tick, type a remark, reload, everything back — and tell me which checks ran.
 ```
 
 Expected result: a page a non-technical person can play, and a run the agent reads back to classify every failure before anything is fixed.
@@ -171,20 +171,20 @@ Read AGENTS.md and the available project memory. Summarize the last verified sta
 
 Expected result: a short, evidence-based restart. Project notes are useful context and still need to be checked against the current work.
 
-## What’s new in 0.17.0
+## What’s new in 0.18.0
 
-Reliable acceptance pages and clearer release checks
+Acceptance pages that keep every answer
 
-Acceptance pages now prevent silent answer loss and empty exports, recipes build by their own identifier, and project release checks work directly with Node on Windows. Guides add practical prompts for reading results and preserving project context.
+The acceptance page now verifies every save, restores your answers on reload before anything else, keeps runs from other revisions and other tabs apart, and names sixteen guarantees the build refuses to lose. Nothing changes in how you install or update; rebuild your recipe pages to get the new page.
 
-- Pages served locally or opened as files keep their steps hidden until a run starts. Recording, finishing or exporting before that point produces a visible message instead of losing answers or downloading null.json.
-- uat build resolves the specification by its id even when the filename differs. The shipped example-uat-spec.json can be built with uat build example-1.0.0.
-- The progress bar shows each step’s state, the tester and the finish date. Its segments jump to the corresponding step, and commands in action lines copy on click.
-- The skill includes a recipe-presence check and a release gate, plus a complete example with witnesses, a writing step and read-only confirmation. Wire the checks into your own project; the installer does not add lifecycle hooks to user projects.
-- A blocked expectation needs a replay or an explicit accept-risk decision naming its owner. Classifying an unobserved check does not establish success, and a passed writing step still needs independent evidence.
-- The release gate calls the CLI through Node instead of spawning an npx.cmd shim. A missing CLI or a gate that could not run produces an error, never a passing verdict.
-- The skill uses uat.mode consistently. An updated project with no uat block remains advisory, and the installer’s test-environment question is translated into all ten installer languages.
-- English, French, Spanish and German guides share the reviewed release notes and seven examples, including Zecher memory handoffs and acceptance-result review. The official public GitHub source is linked from the site; distribution checks exclude maintainer-only adapters.
+- A write to the browser counts only once it reads back. A refused save (quota, private window, blocked storage) is named on the page, questions leaving, and the export stays available — the page never says saved on its own word.
+- Your answers come back on reload before the local server or the artifact database answer, and the newer copy always wins: an older remote copy never overwrites what you just ticked.
+- A run that answered another revision of the recipe is offered, not poured in: unchanged lines keep their answers, changed lines are asked again, the earlier run stays untouched and exportable, and the new run records where its answers came from.
+- Two tabs or two devices on the same run converge on the latest change and say so. A saved run that cannot be read is reported and exportable, never deleted.
+- The progress bar exposes the share of lines answered — answered, not passed — with the seen, not seen and blocked counts; the page says where answers live and what can make them disappear.
+- Finishing with unanswered lines is questioned on the page itself and confirmed with a second click; a finished run says it is not an acceptance, and a change made after finishing is dated and shown.
+- uat build lists the sixteen guarantees the page carries and refuses a template that lost one; uat serve refuses an older copy of a run and any host name but its own. A name with no Latin letters signs its run with a stable hash.
+- The acceptance skill tells the agent to build the page with the command, never write it by hand, play the essential pass in a real browser before handing it over, and say which checks ran. The page strings gain twenty-two sentences in ten languages.
 
 ## Version History
 
@@ -192,21 +192,25 @@ These dates identify reviewed CHANGELOG notes, not npm publication dates. The we
 
 | Version | Release-notes date | Reviewed summary |
 | --- | --- | --- |
+| 0.18.0 | 2026-09-25 | The acceptance page now verifies every save, restores your answers on reload before anything else, keeps runs from other revisions and other tabs apart, and names sixteen guarantees the build refuses to lose. Nothing changes in how you install or update; rebuild your recipe pages to get the new page. |
+| 0.17.1 | 2026-09-24 | Installing over a different version now stops and points to update, re-installs keep your settings, and updates remove files a version no longer ships while keeping a restorable backup. Some install behaviors changed; review your scripts before rerunning them. |
 | 0.17.0 | 2026-09-22 | Acceptance pages now prevent silent answer loss and empty exports, recipes build by their own identifier, and project release checks work directly with Node on Windows. Guides add practical prompts for reading results and preserving project context. |
-| 0.16.0 | 2026-09-16 | A delivery now produces a step-by-step page a person plays, and their run comes back as evidence the agents read, classify and gate on. This release also carries what 0.15.0 had prepared and never shipped: durable Nexus execution, evidence-ranked memory and scored checks for every pack. |
-| 0.14.0 | 2026-09-09 | Dev Studio gains complete instructions and verifiable context loading; release documentation follows the published package. |
 
 [Release history and update guide](https://bmad-plus.rochetta.fr/docs/#changelog) · [All published npm versions](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 
 ---
 
-## 📄 License
+## License
 
 MIT — Based on [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) (MIT)
 
-BMAD+ is an independent derivative, not an official BMad Code, LLC release or endorsement.
+BMAD+ is an independent community project derived from BMAD-METHOD (MIT) by BMad Code, LLC. It is not affiliated with, endorsed by or certified by BMad Code, LLC. BMad™ and BMad Method™ are trademarks of BMad Code, LLC; see the [BMad trademark guidelines](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/TRADEMARK.md).
 Bundled source attributions and terms: [Third-party notices](THIRD-PARTY-LICENSES.md).
 
+The OSINT pack is governed: researching a named person requires a recorded purpose and legal basis. See the [OSINT legal notice](osint-agent-package/skills/bmad-osint-investigate/osint/references/gdpr-osint.md).
+
+Translations: [Français](readme-international/README.fr.md) · [Español](readme-international/README.es.md) · [Deutsch](readme-international/README.de.md)
+
 ### Credits
 
 **Creator**
@@ -223,7 +227,3 @@ Bundled source attributions and terms: [Third-party notices](THIRD-PARTY-LICENSE
 - **OSINT Pipeline** based on [smixs/osint-skill](https://github.com/smixs/osint-skill) (MIT)
 - **Apify integration** — OSINT helper and inspiration from [Apify agent skills](https://github.com/apify/agent-skills) (upstream declares Apache-2.0; see notices)
 - **Karpathy Guardrails** — Memory Pack adaptation of [community guidelines by forrestchang](https://github.com/multica-ai/andrej-karpathy-skills), inspired by Andrej Karpathy (MIT declared upstream)
-
-**Tools & Infrastructure**
-- [Evolution API](https://github.com/EvolutionAPI/evolution-api) — WhatsApp notifications for upstream monitoring
-- [Gemini API](https://ai.google.dev/) — AI analysis for upstream change classification

package/SECURITY.md

@@ -14,7 +14,15 @@ and in the [release history](https://bmad-plus.rochetta.fr/docs/#releases).
 
 If you discover a security vulnerability in BMAD+, please report it responsibly:
 
-### 📧 Contact
+### 🔒 Preferred: GitHub private vulnerability reporting
+
+Use **[Report a vulnerability](https://github.com/lrochetta/BMAD-PLUS/security/advisories/new)**
+(repository *Security* tab → *Report a vulnerability*). The report stays private
+between you and the maintainer, and the fix and advisory are coordinated there.
+
+### 📧 Fallback: email
+
+If you cannot use GitHub private reporting:
 
 **Email:** [l.rochetta@gmail.com](mailto:l.rochetta@gmail.com)
 

package/osint-agent-package/README.md

@@ -1,5 +1,18 @@
 # 🔍 OSINT Agent Package — BMAD Compatible
 
+> [!WARNING]
+> **Avis juridique et éthique — à lire avant toute utilisation / Legal & ethics notice**
+>
+> - **Base légale obligatoire (RGPD art. 6).** Toute collecte ou analyse de données sur une personne identifiable est un traitement de données personnelles : il faut une base légale documentée (intérêt légitime mis en balance, obligation légale, mission d'intérêt public…) *avant* de lancer une investigation. La consigner dans [`lawful-basis-record.md`](skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md).
+> - **Données sensibles (RGPD art. 9).** Opinions politiques, religion, santé, orientation sexuelle, données biométriques, etc. sont interdites de traitement sauf exception de l'art. 9(2). Le psychoprofilage peut *inférer* ce type de données : ne pas le faire sans base légale explicite.
+> - **Pas de profilage de particuliers sans base légale.** Aucun ciblage, surveillance ou profilage de personnes privées (ex-conjoint, voisin, salarié, candidat…) par curiosité ou pour harceler. Les personnalités publiques ne sont couvertes que pour leur rôle public.
+> - **Conditions d'utilisation des plateformes.** Le scraping (Apify, LinkedIn, Instagram, Facebook, TikTok…) peut violer les CGU des plateformes et le droit local ; vérifier avant usage.
+> - **Responsabilité de l'utilisateur.** Vous êtes le responsable de traitement : BMAD+ fournit un outil, pas une autorisation. Le résultat est généré par IA, peut être faux et doit être vérifié par un humain avant toute décision.
+>
+> Cadre de référence : [`gdpr-osint.md`](skills/bmad-osint-investigate/osint/references/gdpr-osint.md). La porte de conformité intégrée à l'agent (« Phase −1 — Lawful Basis Gate » du `SKILL.md`, qui refuse toute investigation nominative sans base légale) reste active et ne doit pas être contournée.
+>
+> *EN — You need a documented GDPR Art. 6 lawful basis (and an Art. 9(2) exception for special-category data) before investigating anyone; respect platform ToS; never profile private individuals without a legal basis; you, the user, are the data controller and bear full responsibility.*
+
 Agent d'intelligence OSINT pour les installations BMAD. De un nom ou pseudo à un dossier complet avec psychoprofil, parcours professionnel et grades de confiance.
 
 ## Features

package/osint-agent-package/SETUP_KEYS.md

@@ -1,5 +1,18 @@
 # 🔑 Configuration des Clés API
 
+> [!WARNING]
+> **Avis juridique et éthique — à lire avant toute utilisation / Legal & ethics notice**
+>
+> - **Base légale obligatoire (RGPD art. 6).** Toute collecte ou analyse de données sur une personne identifiable est un traitement de données personnelles : il faut une base légale documentée (intérêt légitime mis en balance, obligation légale, mission d'intérêt public…) *avant* de lancer une investigation. La consigner dans [`lawful-basis-record.md`](skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md).
+> - **Données sensibles (RGPD art. 9).** Opinions politiques, religion, santé, orientation sexuelle, données biométriques, etc. sont interdites de traitement sauf exception de l'art. 9(2). Le psychoprofilage peut *inférer* ce type de données : ne pas le faire sans base légale explicite.
+> - **Pas de profilage de particuliers sans base légale.** Aucun ciblage, surveillance ou profilage de personnes privées (ex-conjoint, voisin, salarié, candidat…) par curiosité ou pour harceler. Les personnalités publiques ne sont couvertes que pour leur rôle public.
+> - **Conditions d'utilisation des plateformes.** Le scraping (Apify, LinkedIn, Instagram, Facebook, TikTok…) peut violer les CGU des plateformes et le droit local ; vérifier avant usage.
+> - **Responsabilité de l'utilisateur.** Vous êtes le responsable de traitement : BMAD+ fournit un outil, pas une autorisation. Le résultat est généré par IA, peut être faux et doit être vérifié par un humain avant toute décision.
+>
+> Cadre de référence : [`gdpr-osint.md`](skills/bmad-osint-investigate/osint/references/gdpr-osint.md). La porte de conformité intégrée à l'agent (« Phase −1 — Lawful Basis Gate » du `SKILL.md`, qui refuse toute investigation nominative sans base légale) reste active et ne doit pas être contournée.
+>
+> *EN — You need a documented GDPR Art. 6 lawful basis (and an Art. 9(2) exception for special-category data) before investigating anyone; respect platform ToS; never profile private individuals without a legal basis; you, the user, are the data controller and bear full responsibility.*
+
 Ce guide explique comment configurer les clés API pour l'agent OSINT.  
 **Tu n'as besoin que d'UNE SEULE clé pour démarrer.** Plus tu en configures, plus l'agent est puissant.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters",
   "homepage": "https://bmad-plus.rochetta.fr",
   "keywords": [
@@ -25,7 +25,13 @@
     "bmad-plus": "tools/bmad-plus-npx.js"
   },
   "files": [
-    "tools",
+    "tools/bmad-plus-npx.js",
+    "tools/cli",
+    "tools/build/adapters.config.js",
+    "tools/build/generate-adapters.js",
+    "tools/build/generate.js",
+    "tools/build/module.template.yaml",
+    "tools/build/pack-delivery.js",
     "src/bmad-plus",
     "osint-agent-package",
     "readme-international",
@@ -43,14 +49,18 @@
     "build": "node tools/build/generate.js --out tools/cli/lib/packs.js --module-out src/bmad-plus/module.yaml",
     "build:check": "node tools/build/generate.js --check",
     "check:counts": "node tools/build/check-counts.js",
+    "check:counts:full": "jest --coverage=false --silent --json --outputFile=coverage/jest-report.json && node tools/build/check-counts.js --jest-report coverage/jest-report.json",
     "uat:spec": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-spec-present.mjs --dir recettes",
     "uat:gate": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-release-gate.mjs --dir recettes --cli tools/cli/bmad-plus-cli.js",
+    "qa:uat-browser": "node tools/qa/uat-page-browser-check.js",
     "lint": "eslint tools/ tests/",
     "format": "prettier --write \"tools/**/*.js\" \"tests/**/*.js\"",
     "format:check": "prettier --check \"tools/**/*.js\" \"tests/**/*.js\"",
     "test": "jest --coverage",
+    "test:parallel": "jest --coverage=false --testPathIgnorePatterns \"(nexus(-cli|-process)?|memory-outcomes|upstream-candidate|npm-runner)\\.test\\.js$\"",
+    "test:serial": "jest --coverage=false --runInBand --testPathPatterns \"(nexus(-cli|-process)?|memory-outcomes|upstream-candidate|npm-runner)\\.test\\.js$\"",
     "test:install-contract": "node tools/build/check-install-contract.js",
-    "prepare": "husky || true",
+    "prepare": "node -e \"try{require('node:child_process').execSync('husky',{stdio:'inherit'})}catch{console.warn('WARNING: husky did not install the git hooks, so the pre-push release gate is inactive in this checkout. Run npx husky to retry.')}\"",
     "uninstall:bmad": "node tools/cli/bmad-plus-cli.js uninstall"
   },
   "dependencies": {
@@ -66,29 +76,42 @@
   },
   "overrides": {
     "@istanbuljs/load-nyc-config": {
-      "js-yaml": "4.2.0"
+      "js-yaml": "4.3.2"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "jest": {
+    "roots": [
+      "<rootDir>/tests",
+      "<rootDir>/tools"
+    ],
     "testPathIgnorePatterns": [
       "/node_modules/",
       "/website/",
       "/evals/"
     ],
     "collectCoverage": true,
+    "collectCoverageFrom": [
+      "tools/**/*.js",
+      "!tools/build/generated-adapters/**"
+    ],
     "coverageDirectory": "coverage",
     "moduleNameMapper": {
       "^@clack/prompts$": "<rootDir>/tests/__mocks__/clack-prompts.js"
     },
     "coverageThreshold": {
       "global": {
-        "branches": 35,
-        "functions": 40,
-        "lines": 40,
-        "statements": 40
+        "branches": 65,
+        "functions": 70,
+        "lines": 70,
+        "statements": 70
+      },
+      "./tools/cli/commands/install.js": {
+        "lines": 65,
+        "statements": 65,
+        "functions": 45
       },
       "./tools/cli/commands/doctor.js": {
         "lines": 60,
@@ -114,6 +137,7 @@
     "eslint": "^10.6.0",
     "husky": "^9.0.0",
     "jest": "^30.4.2",
+    "jsdom": "^26.1.0",
     "prettier": "^3.4.0"
   }
 }