bmad-plus 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to BMAD+ will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.22.0] - 2026-09-29
+
+### Added
+
+- **Shield security assurance case** (`bmad-plus assurance init|run|verify <case>`). A case states claims, an argument for each, and evidence that can only be a check that ran. `run` executes each declared command without a shell and with a minimal environment, and appends a hash-chained ledger record (exit code, output digest, redacted excerpt, digests of the artifacts it wrote, commit, working-tree state). `verify` finds a claim unsupported when its evidence is missing, failed or stale, and can emit a CI check. `verify --ledger-head` catches removed runs; with `BMAD_PLUS_ASSURANCE_KEY` every record carries an HMAC that no check can read.
+- **Shield AI processing register** (`bmad-plus ai-register init|check`). `_bmad/ai-processing-register.yaml` records each AI tool with its provider, purpose, data categories, legal basis, retention, transfers and processing agreement. `check` compares it with the AI integrations found in the project (BMAD+ adapters, tool folders, MCP server declarations) and warns about any tool not registered; `bmad-plus doctor` reports it when Shield is installed.
+- **Compliance review rules.** A review rule can name the controls it examines (`FRAMEWORK:ID`, validated). An installed Shield adds six path-scoped rules in a `compliance` group (access control, personal data, cryptography, logging, AI integrations, change and supply chain); the checklist opens with the controls a change touches, and a finding may list the controls it breaks.
+
+### Security
+
+- **Data-handling doctrine and egress gate.** `registry.yaml` declares what BMAD+ sends, to whom, when and under which consent basis. `tools/build/verify-egress.js` fails CI when a network, listener or process site of the package or of the maintainer services is undeclared, miscounted or stale, or when a module load cannot be resolved. `SECURITY.md` has a generated "Data handling" section and the generated adapters state the flows of the installed packs. BMAD+ has no telemetry; `update-check` is opt-out.
+- **The UAT recipe page loads nothing from another origin.** Google Fonts is gone; the page uses installed fonts. The build refuses a template that would load or send anything elsewhere (`no-third-party-requests`), reading it as the HTML tokenizer does, with references, escapes and `data:` documents decoded. The jsdom and Chromium checks record every request and socket of a run.
+- **The SEO HTML report opens without asking any server**, and `GOOGLE_API_KEY` is sent in the `x-goog-api-key` header, never in a URL, and redacted from errors.
+- **OSINT provider calls are HTTPS-only**: other schemes, URL credentials and redirects that leave https or the host are refused before connecting.
+- **SEO screenshots are pinned** to the address `seo_fetch.py` validated: Chromium resolves nothing else, other hosts and redirect hops are blocked and reported.
+
+### Fixed
+
+- **MCP server:** SSE client disconnects and graceful shutdowns no longer log `Exception in ASGI application`; an open SSE stream ends cleanly on SIGTERM. The middlewares are pure ASGI. An `MCP_TOKEN_CREATED_AT` with a UTC offset no longer makes every authenticated request answer 500, and non-ASCII secrets are refused with 401 instead of raising.
+
+## [0.21.0] - 2026-09-28
+
+### Added
+
+- **Review run record.** `coverage.json` can carry `run {stop, detail?, passes, attempts[], tokens?, durationMs?}`. Stop reasons are `completed`, `budget`, `time-limit`, `failure-streak` or `interrupted`; any stop other than `completed` needs a detail, and a review that stopped early is always `incomplete`. Usage is recorded only when the host reports it, never estimated. After three consecutive failed attempts a unit is abandoned and a fourth attempt is refused.
+- **`review gate --emit-check <file>`** writes the verdict as `bmad-plus/review-check/1` for CI, atomically and without a timestamp, so the same evidence always gives the same bytes. It lists open findings by severity with their anchored lines and a `github` block shaped for the check-runs API. Exit codes are unchanged. The gate's reasons are redacted once, so the terminal, `--json` and the check carry the same text.
+- **`review continue <id>`** resumes an interrupted review on the same sealed scope and writes `continue.json`: units and files still owed, abandoned files, findings to requote, passes left. It refuses when the head, the rules or a selected file changed, and points to a new scope and `review compare`.
+- **Rule groups.** A rule can name a `group`; units list their groups so parallel reviewers can split a unit by rule family, and a unit is complete as a whole or when every group is done. Built-in groups are `code`, `data` and `delivery`; the group is part of the rule-set hash.
+- **Review bench** (maintainer tool, not in the npm package): seven small repositories in seven languages with 12 planted defects and 8 decoys, a published matching rule (path, category and a located quote that points at one plant; never a line number), and a scorer reporting recall, precision, decoy hits, unlocated quotes and reported usage. Three reference runs are replayed by a blocking CI step. No model call.
+- **CI review recipes** (`docs/recipes/ci-review/`): copy-ready workflows that seal the scope and gate a pull request with a host agent on a self-hosted runner. They are read-only, read no secret, pin every action, trust nothing the agent can rewrite (a step output holds a digest of the sealed scope), and fail fork pull requests instead of letting a required check pass unreviewed.
+- The open-code-review study states how the bench decides whether an optional `ocr` bridge is ever built.
+
+### Security
+
+- **SEO fetcher and crawler: SSRF protection and connection pinning.** Each host is resolved by the scripts, any non-public address is refused, and the connection goes to the exact address that was validated, on the first request and on every redirect hop, which defeats DNS rebinding. The guard sits in the connection pool every `requests` release goes through (verified on 2.34, 2.31 and 2.28). URL credentials, invalid ports, CGNAT and site-local ranges and IPv4-mapped or NAT64 forms of internal addresses are refused; proxies and `~/.netrc` are not used; custom CA bundles are still honoured.
+- **MCP knowledge ingestion is confined to each source checkout.** Paths resolving outside the checkout are refused; symlinks and `.git` are never followed.
+
+### Changed
+
+- **MCP server stack modernized** on Python 3.12: official `mcp` SDK, chromadb 1.5, sentence-transformers 6.1, CPU-only torch. `RAG_EMBEDDING_MODEL` selects the embedding model and Chroma telemetry is off. Existing stores open in place; re-run `ingest.py` once after upgrading. Chunks are keyed by their path in the checkout and stale chunks are pruned after each pass that indexed something. An offline smoke (`mcp-server/ci/smoke.py`) ingests a fixture, lists tools, queries and merges PDFs over an authenticated MCP session.
+
 ## [0.20.0] - 2026-09-28
 
 ### Added

package/README.md

@@ -1,8 +1,8 @@
 # BMAD+
 
-[![Version](https://img.shields.io/badge/version-0.20.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.22.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.20.0** · Node.js `>=20.0.0` · MIT
+**Version 0.22.0** · Node.js `>=20.0.0` · MIT
 
 Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters
 
@@ -35,7 +35,7 @@ Run the installer. Select the adapters for the AI tools you use and the packs yo
 **In your project terminal:**
 
 ```sh
-npx bmad-plus@0.20.0 install
+npx bmad-plus@0.22.0 install
 ```
 
 The installer creates the agent instructions, shared project spine and selected tool adapters. Optional packs may need additional runtimes or API access.
@@ -171,18 +171,18 @@ Read AGENTS.md and the available project memory. Summarize the last verified sta
 
 Expected result: a short, evidence-based restart. Project notes are useful context and still need to be checked against the current work.
 
-## What’s new in 0.20.0
+## What’s new in 0.22.0
 
-Review checklists, comparisons and masked secrets
+What leaves your machine, declared and checked
 
-bmad-plus review now hands the reviewer the rules that apply to the changed files, fixes the depth of a review before it starts, compares a review with an earlier one without calling an unchecked finding fixed, and masks credentials in what it writes. Nothing changes in how you install or update.
+BMAD+ now declares every way it sends data or starts a process, and its CI refuses anything undeclared. The recipe page and the SEO report load nothing from other sites, OSINT calls are HTTPS-only, and Shield gains an evidence-bound assurance case and an AI processing register. Nothing changes in how you install or update.
 
-- bmad-plus review scope writes checklist.md next to the scope: the review rules that apply to the changed files, each once, with the files it covers. Eight rules ship with BMAD+: general, JavaScript and TypeScript, Python, SQL and migrations, shell, CI workflows, containers and configuration.
-- A project adds, replaces or disables rules in _bmad/review-rules.yaml. Rule documents must stay inside _bmad/ and are size-limited, and the rule set is part of the scope hash. bmad-plus review rules followed by a path shows the rules a file gets; a finding that names a rule not applying to its file is refused.
-- --effort low, medium or high sets the number of passes and whether findings are challenged. A large change is surveyed before reading and reviewed in parallel units.
-- bmad-plus review compare with --since and an earlier review id sorts findings into new, persisting, refuted, resolved and not reviewed. Findings are matched by file, category and quoted code, never by line, and renamed files are followed. A finding counts as resolved only when the later review completed its file.
-- Keys, tokens, passwords and credentials in URLs are replaced by a REDACTED marker in anchored review findings and in acceptance-run notes before they are written. References such as process.env.X are kept, and each record counts its replacements.
-- Every command now gives the terminal back when it finishes; before, the prompt only returned after Ctrl+C.
+- The registry states what BMAD+ sends, to whom, when and with which consent; SECURITY.md shows it and the installed agent instructions summarise it. A build check fails when a network call or a started process is not declared. BMAD+ has no telemetry, and the update check can be turned off.
+- The acceptance page no longer loads Google Fonts or anything from another site, so opening it tells no one you did. The build refuses a page that would, and a real browser checks every request of a run. The SEO HTML report opens offline too.
+- The Google API key of the SEO pack travels in a request header, never in a URL, and is hidden from error messages. OSINT provider calls refuse anything but HTTPS and never follow a redirect to another host.
+- SEO screenshots reach only the address that was checked: Chromium resolves nothing else, and redirects or resources pointing elsewhere are blocked and listed.
+- Shield: bmad-plus assurance builds a security case whose evidence can only be a check that actually ran, recorded in a tamper-evident ledger; bmad-plus ai-register keeps a register of the AI tools a project uses and warns about any it has not recorded; six review rules name the compliance controls a change touches.
+- The MCP server closes SSE streams cleanly when a client leaves or the server stops, and accepts token dates with a time-zone offset.
 
 ## Version History
 
@@ -190,9 +190,9 @@ These dates identify reviewed CHANGELOG notes, not npm publication dates. The we
 
 | Version | Release-notes date | Reviewed summary |
 | --- | --- | --- |
+| 0.22.0 | 2026-09-29 | BMAD+ now declares every way it sends data or starts a process, and its CI refuses anything undeclared. The recipe page and the SEO report load nothing from other sites, OSINT calls are HTTPS-only, and Shield gains an evidence-bound assurance case and an AI processing register. Nothing changes in how you install or update. |
+| 0.21.0 | 2026-09-28 | A review now records why it stopped and what it used, writes a check a CI step can read, and resumes on the scope it sealed. The SEO fetcher connects only to addresses it has validated, and the MCP server moves to the official SDK on Python 3.12. Nothing changes in how you install or update. |
 | 0.20.0 | 2026-09-28 | bmad-plus review now hands the reviewer the rules that apply to the changed files, fixes the depth of a review before it starts, compares a review with an earlier one without calling an unchecked finding fixed, and masks credentials in what it writes. Nothing changes in how you install or update. |
-| 0.19.0 | 2026-09-27 | bmad-plus review seals what a review must cover, locates every finding by the code it quotes, and derives the verdict from coverage instead of the number of findings. Review triage now keeps a finding unless a quoted ground refutes it. Nothing changes in how you install or update. |
-| 0.18.0 | 2026-09-25 | The acceptance page now verifies every save, restores your answers on reload before anything else, keeps runs from other revisions and other tabs apart, and names sixteen guarantees the build refuses to lose. Nothing changes in how you install or update; rebuild your recipe pages to get the new page. |
 
 [Release history and update guide](https://bmad-plus.rochetta.fr/docs/#changelog) · [All published npm versions](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 

package/SECURITY.md

@@ -75,5 +75,67 @@ Security researchers who report valid vulnerabilities will be credited in the CH
 - Each release retains its CycloneDX production SBOM, archive and integrity manifest as workflow artifacts; registry integrity must match the checked archive before the landing is deployed
 - Publication uses npm OIDC authentication. npm provenance is not enabled: the private build repository and distribution repository differ. An inventory or hash is not a provenance attestation
 
+## Data handling
+
+BMAD+ has no telemetry and no silent self-update. The first table lists every flow of the
+npm package that can send data off the machine; the second covers the maintainer services
+deployed from this repository (the Audit 360° MCP server and the upstream monitor), which
+users do not install. Both are generated from the `data_handling` doctrine in
+`registry.yaml`. Before each release, CI scans every shipped and service source file and
+fails when a network, listener or process site is missing from the doctrine, or when a
+declared one no longer exists. "Through a started program" means BMAD+ starts a tool (npm,
+uv or pip, git, Codex CLI, Chromium, a command you declared) and that tool does the sending.
+
+<!-- data-handling:begin — generated from registry.yaml by tools/build/verify-egress.js --write -->
+
+| Flow | Component | Leaves the machine | What | To whom | When | Consent |
+|---|---|---|---|---|---|---|
+| `update-check` | cli | through a started program | The package name and channel (`npm view bmad-plus@latest`) with npm's request metadata: IP address, user agent (npm, Node.js and OS versions) and npm session headers. | registry.npmjs.org (the policy accepts no other registry) | `bmad-plus update-check`, which the generated adapters ask the agent to run once per session; the answer is cached in `.bmad/update-check.json`. | **opt-out**: `bmad-plus update-policy --mode off` stops every lookup. |
+| `update-apply` | cli | through a started program | The exact release requested, with npm's request metadata, to download that version's package. | registry.npmjs.org | `bmad-plus update --latest --yes`, or `--auto` when the project policy allows it. | **opt-in**: Each run needs `--yes`, or policy mode `auto` with an explicit range (`bmad-plus update-policy --mode auto --range <range>`). |
+| `python-provision` | cli | through a started program | The names and versions in the pack's requirements.txt, with the installer's request metadata; uv may also download a Python build. | pypi.org and files.pythonhosted.org, or the index configured for pip or uv on the machine, github.com (python-build-standalone releases) when uv downloads Python | `bmad-plus install --provision-python` for a selected Python pack. | **opt-in**: Only with `--provision-python`; without it no environment is created. |
+| `nexus-worker` | cli | through a started program | With `codex-exec`, the task's instruction and input files (at most 1 MiB) go to Codex CLI, which sends them to the model provider of the user's own Codex login. With `command`, whatever that command sends. | the model provider configured in the user's Codex CLI, whoever a declared command contacts | `bmad-plus nexus launch` on a plan with an explicit execution contract. | **invocation**: Nothing starts without a plan the user wrote and an explicit launch; shell, environment and arbitrary Codex flags are refused. |
+| `nexus-verifier` | cli | through a started program | Whatever the declared command sends; it runs with a minimal allow-listed environment. | whoever the declared command contacts | `bmad-plus nexus verify` on a task of a plan the user wrote. | **invocation**: The command and its hash are fixed in the plan; a changed executable is refused. |
+| `uat-page-results` | core | directly | The run: tester name, step verdicts and notes. | the origin serving the page: `bmad-plus uat serve` on 127.0.0.1, or the claude.ai artifact store when the page is published as an artifact | Each recorded verdict, when the page is served; a page opened from a file keeps results in the browser. | **invocation**: The tester chooses how the page is opened; a page opened from a file sends nothing. |
+| `osint-providers` | osint | directly | The investigation query (names, handles, keywords and URLs about the subject) and that provider's API key, over verified HTTPS: the shared helper refuses any other scheme and any redirect off the provider's host. | api.apify.com, api.exa.ai, r.jina.ai, s.jina.ai, deepsearch.jina.ai, api.parallel.ai, api.perplexity.ai, api.tavily.com, the Bright Data MCP URL the user configures | When the Shadow agent, or `volley.py` fanning out to the others, runs a provider script during an investigation. | **credential**: A provider is contacted only once its key (or Bright Data MCP URL) is set; the skill's Phase −1 lawful-basis gate precedes profiling a named person. |
+| `seo-site-fetch` | seo | directly | HTTP requests for the audited site's pages, robots.txt and sitemap, with the user agent the audit selects, from the user's IP address. | the site the user asks to audit (public addresses only) | `seo_fetch.py` and `seo_crawl.py`, run by the SEO agents during an audit. | **invocation**: Only the URL the user gives and its internal links are fetched; private, loopback and link-local addresses are refused. |
+| `seo-google-apis` | seo | directly | The audited URL or origin, and the user's GOOGLE_API_KEY in the x-goog-api-key header, never in the request URL; redirects are not followed. | www.googleapis.com, chromeuxreport.googleapis.com, searchconsole.googleapis.com | `seo_apis.py`, run during an audit's performance phase. | **credential**: Only when GOOGLE_API_KEY is set; without it the script returns an error and sends nothing. |
+| `seo-screenshot` | seo | through a started program | Chromium's requests for the audited page and the resources its own host serves, with a browser user agent, from the user's IP address. Third-party resources are blocked, not fetched. | the site the user asks to audit (public addresses only) | `seo_screenshot.py`, when an audit asks for screenshots. | **invocation**: Only the URL the user gives, with the Playwright and Chromium the user installed; non-public addresses, other hosts and redirects off the host are refused. |
+| `assurance-checks` | cli | through a started program | Whatever a declared check command sends; the CLI itself sends nothing. | whoever a declared check command contacts | `bmad-plus assurance run` on a case the user wrote. | **invocation**: Only the commands listed in the user's own case file run, and only on an explicit `assurance run`; the signing key is never passed to a check. |
+
+Stays on the machine:
+
+- `npx-launcher` (cli): Starts the CLI in the same Node.js executable. When: Every `npx bmad-plus` run.
+- `python-health` (cli): Runs a pack environment's own Python, isolated (-I), to confirm its modules import. When: `bmad-plus doctor` on a project with a provisioned Python pack.
+- `review-git` (cli): Reads the local repository with git (rev-parse, merge-base, diff, ls-files, show) to build a review scope. When: `bmad-plus review` commands.
+- `nexus-git` (cli): Reads the repository root and HEAD commit with `git rev-parse`. When: `bmad-plus nexus` plan and run commands.
+- `uat-serve` (cli): Serves a recipe page and stores its verdicts, listening on 127.0.0.1 only and refusing any other Host header. When: `bmad-plus uat serve`.
+- `uat-release-gate` (core): Runs the project's own bmad-plus CLI with the current Node.js to grade recorded acceptance runs. When: The release-gate script a project copies from the UAT skill, when the project runs it.
+- `osint-install` (osint): Copies the OSINT agent and skills into a BMAD project, then runs the pack's local diagnostic script with the system Python. When: When the user runs the package's install.sh or install.ps1.
+
+Maintainer services, deployed from this repository and not part of the npm package:
+
+- `mcp-server` (`mcp-server/`): The Audit 360° MCP server the maintainer runs on a VPS: git, GitHub, Gamma, CI, RAG and memory tools for the maintainer's agents, behind a bearer token and a password-protected dashboard.
+- `monitor` (`monitor/`): The upstream monitor the maintainer schedules on a VPS: it watches the BMAD-METHOD repository and notifies the maintainer of new changes.
+
+| Flow | Service | Leaves the machine | What | To whom | When | Consent |
+|---|---|---|---|---|---|---|
+| `mcp-listener` | mcp-server | directly | Tool results (repository contents and diffs, command output, audit reports, knowledge-base passages, memory entries) and the dashboard's audit data. | MCP clients presenting the bearer token, dashboard users logged in with the dashboard password | While the service runs: HTTPS on 0.0.0.0:443 when SSL_CERT_FILE and SSL_KEY_FILE are set, plain HTTP on 127.0.0.1:8000 with BMAD_DEV=1, otherwise it refuses to start. | **credential**: Every MCP request needs MCP_AUDIT360_TOKEN and every dashboard request the dashboard password; 30 requests per minute per address. |
+| `mcp-dashboard-cdn` | mcp-server | directly | The dashboard user's IP address, user agent and the dashboard origin as referrer. | cdn.jsdelivr.net | Each time the dashboard page is opened. | **invocation**: Opening the dashboard loads it. |
+| `mcp-knowledge-ingest` | mcp-server | through a started program | Git clone and pull requests for the sources in knowledge/sources.json, and the model download request (model name, library version) on first use. | the Git hosts of the configured knowledge sources, huggingface.co (the embedding model named by RAG_EMBEDDING_MODEL or the default) | At server start when the knowledge base is empty, and on the admin_refresh_knowledge tool. | **invocation**: The maintainer lists the sources; chromadb runs with anonymized_telemetry=False. |
+| `mcp-git-tools` | mcp-server | through a started program | Clone, pull and push traffic for the repositories a client names, with the credentials git holds on the server; pushes carry the commits made through git_commit. | the Git hosts of the repositories the client names (URLs validated before cloning) | git_* tools, audit_scan_repo and orchestrate_full_audit, when an authenticated client calls them. | **credential**: Only through an authenticated MCP call; paths are confined to the server's repository root. |
+| `mcp-github-api` | mcp-server | directly | GITHUB_TOKEN with the repository names, file contents, pull-request texts and collaborator names the client passes; orchestrate_full_audit creates a private delivery repository. | api.github.com | github_* tools and orchestrate_full_audit, when an authenticated client calls them. | **credential**: Only with GITHUB_TOKEN set on the server and an authenticated MCP call. |
+| `mcp-gamma` | mcp-server | directly | The report content (Markdown, title, infographic URLs, instructions) and GAMMA_API_KEY; export downloads carry no content. | public-api.gamma.app, the export host named in Gamma's answer | gamma_* tools, when an authenticated client calls them. | **credential**: Only with GAMMA_API_KEY set on the server and an authenticated MCP call. |
+| `mcp-ci-tools` | mcp-server | through a started program | Whatever those programs send: dependency downloads of npm, pip, cargo or go, Semgrep's registry requests for --config=auto, Trivy's vulnerability-database download, and whatever a repository's deploy script sends. | the package registries of the repository's toolchain, semgrep.dev, Trivy's database mirrors, whoever a repository's deploy script contacts | ci_* tools, when an authenticated client calls them. | **credential**: Only through an authenticated MCP call; commands must equal an allow-listed argv, deploy scripts must lie inside the repository. |
+| `monitor-upstream-git` | monitor | through a started program | Git fetch requests for the configured upstream ref, with the host's IP address. | github.com (bmad-code-org/BMAD-METHOD, or the HTTPS repository the configuration names) | Each scheduled run of weekly-check.py. | **invocation**: The maintainer installs the schedule and chooses the repository and ref. |
+| `monitor-ai-analysis` | monitor | directly | Bounded excerpts of the upstream commit messages, diff statistics and diff, the previous observed version, and the configured API key. | generativelanguage.googleapis.com (Google Gemini API) | weekly-check.py --ai, when a change is observed. | **opt-in**: Only with --ai and an API key and model list in the configuration; --dry-run never calls it. |
+| `monitor-notify` | monitor | directly | The observation report: upstream version and commit summaries, with the advisory analysis when one was requested. | the Evolution API instance the configuration names (loopback unless HTTPS), which relays it to the configured WhatsApp number, the SMTP server of the fallback email configuration (STARTTLS) | weekly-check.py --notify, once per newly observed upstream state. | **opt-in**: Only with --notify and a configured channel; --dry-run never notifies. |
+| `monitor-mcp-bridge` | monitor | directly | Tool names and arguments (repository URLs and paths, pull-request texts) with the MCP bearer token. | the maintainer's MCP server (VPS_HOST or the configured mcp_url) | When code constructs an MCPBridge; weekly-check.py does not. | **credential**: Only with an MCP token and server address supplied by the maintainer. |
+
+Stays on the service host:
+
+- `mcp-memory` (mcp-server): Runs the bmad-plus CLI's `mem` command with the server's Node.js for the memory tools. When: memory_* tools, when an authenticated client calls them.
+
+<!-- data-handling:end -->
+
 BMAD+ is an independent derivative of BMAD-METHOD. It is not an official release
 of BMad Code, LLC and does not imply its endorsement.

package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/_http.py

@@ -1,43 +1,87 @@
-"""Shared HTTP utilities for OSINT scripts — stdlib only, zero dependencies."""
+"""Shared HTTP utilities for OSINT scripts — stdlib only, zero dependencies.
+
+Every request goes over verified HTTPS: the providers receive API keys and
+investigation queries, so a plain-text or unverified hop is never acceptable.
+"""
 
 import http.client
 import json
 import os
 import ssl
 import sys
-from urllib.parse import urlparse, urlencode, quote
+from urllib.parse import urljoin, urlparse
 
+MAX_REDIRECTS = 5
+_REDIRECT_STATUSES = frozenset({301, 302, 303, 307, 308})
 
-def https_request(method, url, headers=None, body=None, timeout=120):
-    """Make an HTTPS request and return (status, headers, body_str).
-    
-    Handles both http and https URLs.
+
+class InsecureURLError(ValueError):
+    """A URL the helper refuses to contact (not HTTPS, credentials, no host)."""
+
+
+def _check_https_url(url):
+    """Return ``(host, port, target)`` for an acceptable URL, or raise InsecureURLError.
+
+    Only ``https://`` with a host is accepted: no plain HTTP, no other scheme
+    and no implicit one. Credentials in the URL are refused, since they would
+    travel outside the headers the caller controls.
     """
     parsed = urlparse(url)
-    scheme = parsed.scheme or "https"
-    host = parsed.hostname
-    port = parsed.port or (443 if scheme == "https" else 80)
-    path = parsed.path or "/"
+    if parsed.scheme.lower() != "https":
+        raise InsecureURLError(f"only https:// URLs are allowed, got {parsed.scheme or '(none)'}://")
+    if parsed.username is not None or parsed.password is not None:
+        raise InsecureURLError("credentials in URL are not allowed")
+    if not parsed.hostname:
+        raise InsecureURLError("URL has no host")
+    try:
+        port = parsed.port or 443
+    except ValueError:
+        raise InsecureURLError("URL has an invalid port") from None
+    target = parsed.path or "/"
     if parsed.query:
-        path += "?" + parsed.query
+        target += "?" + parsed.query
+    return parsed.hostname, port, target
 
-    if scheme == "https":
-        ctx = ssl.create_default_context()
-        conn = http.client.HTTPSConnection(host, port, timeout=timeout, context=ctx)
-    else:
-        conn = http.client.HTTPConnection(host, port, timeout=timeout)
 
+def https_request(method, url, headers=None, body=None, timeout=120):
+    """Make a verified HTTPS request and return (status, headers, body_str).
+
+    Refuses anything but ``https://`` with InsecureURLError, verifies the
+    certificate and host name against the system trust store (TLS 1.2 or
+    later), and follows at most MAX_REDIRECTS redirects that stay on the same
+    host and port: a redirect to plain HTTP, another scheme or another host is
+    refused rather than handing the API key and query to a recipient the
+    caller did not name.
+    """
     hdrs = {"User-Agent": "osint-skill/3.2-python"}
     if headers:
         hdrs.update(headers)
-
-    conn.request(method, path, body=body, headers=hdrs)
-    resp = conn.getresponse()
-    data = resp.read().decode("utf-8", errors="replace")
-    status = resp.status
-    resp_headers = dict(resp.getheaders())
-    conn.close()
-    return status, resp_headers, data
+    context = ssl.create_default_context()
+    context.minimum_version = ssl.TLSVersion.TLSv1_2
+
+    host, port, target = _check_https_url(url)
+    for _ in range(MAX_REDIRECTS + 1):
+        conn = http.client.HTTPSConnection(host, port, timeout=timeout, context=context)
+        try:
+            conn.request(method, target, body=body, headers=hdrs)
+            resp = conn.getresponse()
+            data = resp.read().decode("utf-8", errors="replace")
+        finally:
+            conn.close()
+
+        location = resp.getheader("Location")
+        if resp.status not in _REDIRECT_STATUSES or not location:
+            return resp.status, dict(resp.getheaders()), data
+        url = urljoin(url, location)
+        next_host, next_port, target = _check_https_url(url)
+        if (next_host.lower(), next_port) != (host.lower(), port):
+            raise InsecureURLError(f"redirect leaves {host}:{port} for {next_host}:{next_port}")
+        # As browsers do: 301, 302 and 303 continue a POST as a bodiless GET;
+        # 307 and 308 repeat the request unchanged.
+        if resp.status in (301, 302, 303) and method not in ("GET", "HEAD"):
+            method, body = "GET", None
+            hdrs = {k: v for k, v in hdrs.items() if k.lower() != "content-type"}
+    raise InsecureURLError(f"too many redirects (max {MAX_REDIRECTS})")
 
 
 def api_post(url, payload, headers=None, timeout=120):

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters",
   "homepage": "https://bmad-plus.rochetta.fr",
   "keywords": [

package/readme-international/README.de.md

@@ -4,9 +4,9 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | <a href="README.es.md">Español</a> | 🌐 <b>Deutsch</b>
 </div>
 
-[![Version](https://img.shields.io/badge/version-0.20.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.22.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.20.0** · Node.js `>=20.0.0` · MIT
+**Version 0.22.0** · Node.js `>=20.0.0` · MIT
 
 Projektlokale KI-Entwicklungsworkflows mit klaren Rollen, gemeinsamem Kontext, sicheren Updates und Adaptern für Coding-Tools.
 
@@ -39,7 +39,7 @@ Starte das Installationsprogramm. Wähle die Adapter deiner KI-Werkzeuge und die
 **Im Terminal deines Projekts:**
 
 ```sh
-npx bmad-plus@0.20.0 install
+npx bmad-plus@0.22.0 install
 ```
 
 Die Installation erstellt Agentenanweisungen, die gemeinsame Projektbasis und die gewählten Adapter. Optionale Packs können weitere Laufzeitumgebungen oder API-Zugänge benötigen.
@@ -175,18 +175,18 @@ Lies AGENTS.md und die verfügbare Projekterinnerung. Fasse den letzten geprüft
 
 Erwartetes Ergebnis: ein kurzer, belegter Wiedereinstieg. Projektnotizen liefern Kontext und müssen mit dem aktuellen Stand abgeglichen werden.
 
-## Neu in 0.20.0
+## Neu in 0.22.0
 
-Review-Checklisten, Vergleiche und geschwärzte Geheimnisse
+Was deinen Rechner verlässt, erklärt und geprüft
 
-bmad-plus review gibt der prüfenden Person jetzt die Regeln, die für die geänderten Dateien gelten, legt die Tiefe eines Reviews vor Beginn fest, vergleicht ein Review mit einem früheren, ohne einen ungeprüften Befund für behoben zu erklären, und schwärzt Zugangsdaten in dem, was es schreibt. An Installation und Update ändert sich nichts.
+BMAD+ erklärt jetzt jede Datenübertragung und jeden Prozess, den es startet, und seine CI lehnt alles Unerklärte ab. Die Abnahmeseite und der SEO-Bericht laden nichts mehr von anderen Websites, OSINT-Aufrufe laufen nur über HTTPS, und Shield erhält einen Sicherheitsnachweis aus ausgeführten Prüfungen und ein Verzeichnis der KI-Verarbeitungen. An Installation und Update ändert sich nichts.
 
-- bmad-plus review scope schreibt checklist.md neben den Umfang: die Review-Regeln, die für die geänderten Dateien gelten, jede einmal, mit den Dateien, die sie abdeckt. BMAD+ liefert acht Regeln mit: allgemein, JavaScript und TypeScript, Python, SQL und Migrationen, Shell, CI-Workflows, Container und Konfiguration.
-- Ein Projekt ergänzt, ersetzt oder deaktiviert Regeln in _bmad/review-rules.yaml. Regeldokumente müssen in _bmad/ liegen und sind größenbegrenzt, und der Regelsatz gehört zum Hash des Umfangs. bmad-plus review rules mit einem Pfad zeigt die Regeln einer Datei; ein Befund, der eine Regel nennt, die nicht für seine Datei gilt, wird abgelehnt.
-- --effort low, medium oder high legt die Zahl der Durchgänge fest und ob Befunde angefochten werden. Eine große Änderung wird zuerst im Überblick gesichtet und dann in parallelen Einheiten geprüft.
-- bmad-plus review compare mit --since und der Kennung eines früheren Reviews ordnet Befunde in neu, fortbestehend, widerlegt, behoben und nicht geprüft. Befunde werden über Datei, Kategorie und zitierten Code erkannt, nie über die Zeile, und umbenannte Dateien werden verfolgt. Ein Befund gilt nur als behoben, wenn das spätere Review seine Datei abgeschlossen hat.
-- Schlüssel, Tokens, Passwörter und Zugangsdaten in URLs werden in verankerten Befunden und in Abnahmenotizen vor dem Schreiben durch eine REDACTED-Markierung ersetzt. Verweise wie process.env.X bleiben erhalten, und jeder Datensatz zählt seine Ersetzungen.
-- Jeder Befehl gibt das Terminal jetzt zurück, sobald er fertig ist; zuvor kam die Eingabeaufforderung erst nach Strg+C zurück.
+- Die Registry gibt an, was BMAD+ sendet, an wen, wann und mit welcher Einwilligung; SECURITY.md zeigt es, und die installierten Agentenanweisungen fassen es zusammen. Eine Build-Prüfung schlägt fehl, wenn ein Netzwerkaufruf oder ein gestarteter Prozess nicht erklärt ist. BMAD+ hat keine Telemetrie, und die Update-Prüfung lässt sich abschalten.
+- Die Abnahmeseite lädt weder Google Fonts noch sonst etwas von einer anderen Website: Wer sie öffnet, verrät das niemandem. Der Build lehnt eine Seite ab, die es täte, und ein echter Browser prüft jede Anfrage eines Durchlaufs. Auch der HTML-SEO-Bericht öffnet sich offline.
+- Der Google-API-Schlüssel des SEO-Packs wird in einem Anfrage-Header übertragen, nie in einer URL, und erscheint in keiner Fehlermeldung. OSINT-Anbieteraufrufe lehnen alles außer HTTPS ab und folgen nie einer Weiterleitung zu einem anderen Host.
+- SEO-Screenshots erreichen nur die geprüfte Adresse: Chromium löst nichts anderes auf, und Weiterleitungen oder Ressourcen, die woanders hinzeigen, werden blockiert und aufgelistet.
+- Shield: bmad-plus assurance erstellt einen Sicherheitsnachweis, dessen Belege nur tatsächlich ausgeführte Prüfungen sein können, festgehalten in einem manipulationssicheren Protokoll; bmad-plus ai-register führt das Verzeichnis der KI-Werkzeuge eines Projekts und warnt vor nicht erfassten; sechs Review-Regeln nennen die Compliance-Kontrollen, die eine Änderung berührt.
+- Der MCP-Server schließt SSE-Streams sauber, wenn ein Client geht oder der Server stoppt, und akzeptiert Token-Daten mit Zeitzonenversatz.
 
 ## Versionsverlauf
 
@@ -194,9 +194,9 @@ Diese Daten bezeichnen geprüfte CHANGELOG-Einträge, nicht die Veröffentlichun
 
 | Version | Datum der Notizen | Geprüfte Zusammenfassung |
 | --- | --- | --- |
+| 0.22.0 | 2026-09-29 | BMAD+ erklärt jetzt jede Datenübertragung und jeden Prozess, den es startet, und seine CI lehnt alles Unerklärte ab. Die Abnahmeseite und der SEO-Bericht laden nichts mehr von anderen Websites, OSINT-Aufrufe laufen nur über HTTPS, und Shield erhält einen Sicherheitsnachweis aus ausgeführten Prüfungen und ein Verzeichnis der KI-Verarbeitungen. An Installation und Update ändert sich nichts. |
+| 0.21.0 | 2026-09-28 | Ein Review hält jetzt fest, warum es angehalten hat und was es verbraucht hat, schreibt eine Prüfung, die ein CI-Schritt lesen kann, und wird auf dem versiegelten Umfang fortgesetzt. Der SEO-Abruf verbindet sich nur mit Adressen, die er geprüft hat, und der MCP-Server wechselt zum offiziellen SDK unter Python 3.12. An Installation und Update ändert sich nichts. |
 | 0.20.0 | 2026-09-28 | bmad-plus review gibt der prüfenden Person jetzt die Regeln, die für die geänderten Dateien gelten, legt die Tiefe eines Reviews vor Beginn fest, vergleicht ein Review mit einem früheren, ohne einen ungeprüften Befund für behoben zu erklären, und schwärzt Zugangsdaten in dem, was es schreibt. An Installation und Update ändert sich nichts. |
-| 0.19.0 | 2026-09-27 | bmad-plus review versiegelt, was ein Review abdecken muss, findet jeden Befund über den Code, den er zitiert, und leitet das Urteil aus der Abdeckung ab statt aus der Zahl der Befunde. Die Review-Sichtung behält einen Befund jetzt, solange kein zitierter Grund ihn widerlegt. An Installation und Update ändert sich nichts. |
-| 0.18.0 | 2026-09-25 | Die Abnahmeseite prüft jetzt jedes Speichern, stellt deine Antworten beim Neuladen vor allem anderen wieder her, hält Durchläufe anderer Fassungen und anderer Tabs auseinander und benennt sechzehn Garantien, die der Build nicht verlieren darf. An Installation und Update ändert sich nichts; baue deine Rezeptseiten neu, um die neue Seite zu erhalten. |
 
 [Versionsverlauf und Update-Anleitung](https://bmad-plus.rochetta.fr/de/docs/#changelog) · [Alle veröffentlichten Versionen auf npm](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 

package/readme-international/README.es.md

@@ -4,9 +4,9 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | 🌐 <b>Español</b> | <a href="README.de.md">Deutsch</a>
 </div>
 
-[![Version](https://img.shields.io/badge/version-0.20.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.22.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Versión 0.20.0** · Node.js `>=20.0.0` · MIT
+**Versión 0.22.0** · Node.js `>=20.0.0` · MIT
 
 Flujos de desarrollo con IA propios de cada proyecto, con roles claros, contexto compartido, actualizaciones seguras y adaptadores para herramientas de programación.
 
@@ -39,7 +39,7 @@ Ejecuta el instalador. Selecciona los adaptadores de tus herramientas de IA y lo
 **En la terminal del proyecto:**
 
 ```sh
-npx bmad-plus@0.20.0 install
+npx bmad-plus@0.22.0 install
 ```
 
 El instalador crea las instrucciones de los agentes, la base compartida y los adaptadores seleccionados. Algunos packs opcionales necesitan otros entornos o acceso a API.
@@ -175,18 +175,18 @@ Lee AGENTS.md y la memoria de proyecto disponible. Resume el último estado veri
 
 Resultado esperado: una reanudación breve y fundamentada. Las notas aportan contexto que debe contrastarse con el trabajo actual.
 
-## Novedades de la 0.20.0
+## Novedades de la 0.22.0
 
-Listas de revisión, comparaciones y secretos ocultos
+Lo que sale de tu máquina, declarado y comprobado
 
-bmad-plus review ahora entrega a quien revisa las reglas que se aplican a los archivos modificados, fija la profundidad de una revisión antes de empezar, compara una revisión con otra anterior sin dar por corregido un hallazgo no comprobado y oculta las credenciales en lo que escribe. Nada cambia en la instalación ni en la actualización.
+BMAD+ declara ahora cada envío de datos y cada proceso que inicia, y su CI rechaza todo lo que no esté declarado. La página de aceptación y el informe SEO ya no cargan nada de otros sitios, las llamadas OSINT van solo por HTTPS, y Shield incorpora un caso de seguridad basado en pruebas ejecutadas y un registro de tratamientos de IA. Nada cambia en la instalación ni en la actualización.
 
-- bmad-plus review scope escribe checklist.md junto al alcance: las reglas de revisión que se aplican a los archivos modificados, cada una una sola vez, con los archivos que cubre. BMAD+ incluye ocho reglas: general, JavaScript y TypeScript, Python, SQL y migraciones, shell, flujos de CI, contenedores y configuración.
-- Un proyecto añade, sustituye o desactiva reglas en _bmad/review-rules.yaml. Los documentos de reglas deben estar dentro de _bmad/ con un tamaño limitado, y el conjunto de reglas forma parte del hash del alcance. bmad-plus review rules seguido de una ruta muestra las reglas de un archivo; se rechaza un hallazgo que cite una regla que no se aplica a su archivo.
-- --effort low, medium o high fija el número de pasadas y si los hallazgos se cuestionan. Un cambio grande se examina primero en conjunto y luego se revisa en unidades paralelas.
-- bmad-plus review compare con --since y el identificador de una revisión anterior clasifica los hallazgos en nuevos, persistentes, refutados, resueltos y no revisados. Los hallazgos se reconocen por archivo, categoría y código citado, nunca por línea, y se siguen los archivos renombrados. Un hallazgo solo cuenta como resuelto si la revisión posterior completó su archivo.
-- Las claves, tokens, contraseñas y credenciales en URL se sustituyen por un marcador REDACTED en los hallazgos anclados y en las notas de aceptación antes de escribirlos. Se conservan referencias como process.env.X, y cada registro cuenta sus sustituciones.
-- Cada comando devuelve ahora el control al terminal al terminar; antes, el prompt solo volvía tras Ctrl+C.
+- El registro indica qué envía BMAD+, a quién, cuándo y con qué consentimiento; SECURITY.md lo muestra y las instrucciones instaladas para los agentes lo resumen. Una comprobación de build falla cuando una llamada de red o un proceso iniciado no está declarado. BMAD+ no tiene telemetría, y la comprobación de actualizaciones se puede desactivar.
+- La página de aceptación ya no carga Google Fonts ni nada de otro sitio: abrirla no se lo comunica a nadie. El build rechaza una página que lo hiciera, y un navegador real controla cada petición de una ejecución. El informe HTML de SEO también se abre sin conexión.
+- La clave de API de Google del pack SEO viaja en una cabecera de la petición, nunca en una URL, y no aparece en los mensajes de error. Las llamadas a proveedores OSINT rechazan todo lo que no sea HTTPS y nunca siguen una redirección a otro host.
+- Las capturas de pantalla SEO solo alcanzan la dirección comprobada: Chromium no resuelve nada más, y las redirecciones o recursos que apuntan a otro lugar se bloquean y se enumeran.
+- Shield: bmad-plus assurance construye un caso de seguridad cuyas pruebas solo pueden ser comprobaciones realmente ejecutadas, anotadas en un registro a prueba de manipulaciones; bmad-plus ai-register mantiene el registro de herramientas de IA de un proyecto y avisa de las que no figuran; seis reglas de revisión nombran los controles de cumplimiento que toca un cambio.
+- El servidor MCP cierra limpiamente los flujos SSE cuando un cliente se va o el servidor se detiene, y acepta fechas de token con desfase horario.
 
 ## Historial de versiones
 
@@ -194,9 +194,9 @@ Estas fechas identifican las notas revisadas del CHANGELOG, no las fechas de pub
 
 | Versión | Fecha de las notas | Resumen revisado |
 | --- | --- | --- |
+| 0.22.0 | 2026-09-29 | BMAD+ declara ahora cada envío de datos y cada proceso que inicia, y su CI rechaza todo lo que no esté declarado. La página de aceptación y el informe SEO ya no cargan nada de otros sitios, las llamadas OSINT van solo por HTTPS, y Shield incorpora un caso de seguridad basado en pruebas ejecutadas y un registro de tratamientos de IA. Nada cambia en la instalación ni en la actualización. |
+| 0.21.0 | 2026-09-28 | Una revisión registra ahora por qué se detuvo y qué consumió, escribe un control que un paso de CI puede leer y se reanuda sobre el alcance que selló. El descargador SEO solo se conecta a direcciones que ha validado, y el servidor MCP pasa al SDK oficial con Python 3.12. Nada cambia en la instalación ni en la actualización. |
 | 0.20.0 | 2026-09-28 | bmad-plus review ahora entrega a quien revisa las reglas que se aplican a los archivos modificados, fija la profundidad de una revisión antes de empezar, compara una revisión con otra anterior sin dar por corregido un hallazgo no comprobado y oculta las credenciales en lo que escribe. Nada cambia en la instalación ni en la actualización. |
-| 0.19.0 | 2026-09-27 | bmad-plus review sella lo que una revisión debe cubrir, localiza cada hallazgo por el código que cita y deduce el veredicto de la cobertura en lugar del número de hallazgos. La clasificación de las revisiones conserva ahora un hallazgo mientras ningún motivo citado lo refute. Nada cambia en la instalación ni en la actualización. |
-| 0.18.0 | 2026-09-25 | La página de aceptación ahora verifica cada guardado, restaura tus respuestas al recargar antes que nada, mantiene separadas las pruebas de otras versiones y otras pestañas, y nombra dieciséis garantías que la construcción se niega a perder. Nada cambia en la instalación ni en la actualización; reconstruye tus páginas de receta para obtener la nueva página. |
 
 [Historial de versiones y guía de actualización](https://bmad-plus.rochetta.fr/es/docs/#changelog) · [Todas las versiones publicadas en npm](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 

package/readme-international/README.fr.md

@@ -4,9 +4,9 @@
   <a href="../README.md">English</a> | 🌐 <b>Français</b> | <a href="README.es.md">Español</a> | <a href="README.de.md">Deutsch</a>
 </div>
 
-[![Version](https://img.shields.io/badge/version-0.20.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.22.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.20.0** · Node.js `>=20.0.0` · MIT
+**Version 0.22.0** · Node.js `>=20.0.0` · MIT
 
 Des workflows de développement IA propres à chaque projet, avec des rôles clairs, un contexte partagé, des mises à jour sûres et des adaptateurs pour vos outils de code.
 
@@ -39,7 +39,7 @@ Lancez l’installateur. Sélectionnez les adaptateurs de vos outils IA et les p
 **Dans le terminal du projet :**
 
 ```sh
-npx bmad-plus@0.20.0 install
+npx bmad-plus@0.22.0 install
 ```
 
 L’installateur crée les instructions des agents, le socle partagé et les adaptateurs sélectionnés. Certains packs facultatifs nécessitent d’autres environnements ou des accès API.
@@ -175,18 +175,18 @@ Lis AGENTS.md et la mémoire de projet disponible. Résume le dernier état vér
 
 Résultat attendu : une reprise courte et fondée sur des éléments vérifiés. Les notes apportent du contexte, à confronter au travail actuel.
 
-## Nouveautés de la 0.20.0
+## Nouveautés de la 0.22.0
 
-Checklists de revue, comparaisons et secrets masqués
+Ce qui sort de votre machine, déclaré et vérifié
 
-bmad-plus review donne désormais au relecteur les règles qui s’appliquent aux fichiers modifiés, fixe la profondeur d’une revue avant qu’elle commence, compare une revue avec une précédente sans déclarer corrigée une remarque non vérifiée, et masque les identifiants dans ce qu’il écrit. Rien ne change dans l’installation ou la mise à jour.
+BMAD+ déclare désormais chaque envoi de données et chaque processus qu’il lance, et sa CI refuse tout ce qui n’est pas déclaré. La page de recette et le rapport SEO ne chargent plus rien depuis d’autres sites, les appels OSINT passent uniquement en HTTPS, et Shield gagne un dossier de sécurité fondé sur des preuves exécutées et un registre des traitements IA. Rien ne change dans l’installation ou la mise à jour.
 
-- bmad-plus review scope écrit checklist.md à côté du périmètre : les règles de revue qui s’appliquent aux fichiers modifiés, chacune une fois, avec les fichiers qu’elle couvre. Huit règles sont livrées avec BMAD+ : générale, JavaScript et TypeScript, Python, SQL et migrations, shell, workflows CI, conteneurs et configuration.
-- Un projet ajoute, remplace ou désactive des règles dans _bmad/review-rules.yaml. Les documents de règles restent dans _bmad/ avec une taille limitée, et l’ensemble des règles entre dans l’empreinte du périmètre. bmad-plus review rules suivi d’un chemin montre les règles d’un fichier ; une remarque qui cite une règle ne s’appliquant pas à son fichier est refusée.
-- --effort low, medium ou high fixe le nombre de passes et la contestation des remarques. Un changement important est d’abord survolé, puis relu en unités parallèles.
-- bmad-plus review compare avec --since et l’identifiant d’une revue précédente range les remarques en nouvelles, persistantes, réfutées, résolues et non revues. Les remarques sont reconnues par fichier, catégorie et code cité, jamais par ligne, et les fichiers renommés sont suivis. Une remarque n’est résolue que si la nouvelle revue a terminé son fichier.
-- Clés, jetons, mots de passe et identifiants dans les URL sont remplacés par un marqueur REDACTED dans les remarques ancrées et dans les notes de recette avant leur écriture. Les références comme process.env.X sont conservées, et chaque enregistrement compte ses remplacements.
-- Chaque commande rend désormais la main au terminal quand elle a fini ; auparavant, l’invite ne revenait qu’après Ctrl+C.
+- Le registre indique ce que BMAD+ envoie, à qui, quand et avec quel consentement ; SECURITY.md l’affiche et les instructions installées pour les agents le résument. Une vérification de build échoue quand un appel réseau ou un processus lancé n’est pas déclaré. BMAD+ n’a aucune télémétrie, et la vérification de mise à jour peut être désactivée.
+- La page de recette ne charge plus Google Fonts ni rien d’un autre site : l’ouvrir ne le signale à personne. Le build refuse une page qui le ferait, et un vrai navigateur contrôle chaque requête d’un passage. Le rapport HTML SEO s’ouvre aussi hors ligne.
+- La clé d’API Google du pack SEO voyage dans un en-tête de requête, jamais dans une URL, et n’apparaît pas dans les messages d’erreur. Les appels aux fournisseurs OSINT refusent tout sauf HTTPS et ne suivent jamais une redirection vers un autre hôte.
+- Les captures d’écran SEO n’atteignent que l’adresse vérifiée : Chromium ne résout rien d’autre, et les redirections ou ressources qui pointent ailleurs sont bloquées et listées.
+- Shield : bmad-plus assurance construit un dossier de sécurité dont chaque preuve est une vérification réellement exécutée, consignée dans un journal infalsifiable ; bmad-plus ai-register tient le registre des outils IA d’un projet et signale ceux qui n’y figurent pas ; six règles de revue nomment les contrôles de conformité qu’un changement touche.
+- Le serveur MCP ferme proprement les flux SSE quand un client part ou que le serveur s’arrête, et accepte les dates de jeton avec un décalage horaire.
 
 ## Historique des versions
 
@@ -194,9 +194,9 @@ Ces dates identifient les notes relues du CHANGELOG, pas les dates de publicatio
 
 | Version | Date des notes | Résumé relu |
 | --- | --- | --- |
+| 0.22.0 | 2026-09-29 | BMAD+ déclare désormais chaque envoi de données et chaque processus qu’il lance, et sa CI refuse tout ce qui n’est pas déclaré. La page de recette et le rapport SEO ne chargent plus rien depuis d’autres sites, les appels OSINT passent uniquement en HTTPS, et Shield gagne un dossier de sécurité fondé sur des preuves exécutées et un registre des traitements IA. Rien ne change dans l’installation ou la mise à jour. |
+| 0.21.0 | 2026-09-28 | Une revue enregistre désormais pourquoi elle s’est arrêtée et ce qu’elle a consommé, écrit un contrôle lisible par une étape de CI, et reprend sur le périmètre qu’elle a scellé. Le récupérateur SEO ne se connecte qu’aux adresses qu’il a validées, et le serveur MCP passe au SDK officiel sous Python 3.12. Rien ne change dans l’installation ou la mise à jour. |
 | 0.20.0 | 2026-09-28 | bmad-plus review donne désormais au relecteur les règles qui s’appliquent aux fichiers modifiés, fixe la profondeur d’une revue avant qu’elle commence, compare une revue avec une précédente sans déclarer corrigée une remarque non vérifiée, et masque les identifiants dans ce qu’il écrit. Rien ne change dans l’installation ou la mise à jour. |
-| 0.19.0 | 2026-09-27 | bmad-plus review scelle ce qu’une revue doit couvrir, retrouve chaque remarque par le code qu’elle cite, et déduit le verdict de la couverture plutôt que du nombre de remarques. Le tri des revues garde désormais une remarque tant qu’un motif cité ne la réfute pas. Rien ne change dans l’installation ou la mise à jour. |
-| 0.18.0 | 2026-09-25 | La page de recette vérifie désormais chaque enregistrement, restaure vos réponses au rechargement avant toute autre chose, distingue les passages d’autres révisions et d’autres onglets, et nomme seize garanties que la construction refuse de perdre. Rien ne change dans l’installation ou la mise à jour ; reconstruisez vos pages de recette pour obtenir la nouvelle page. |
 
 [Historique des versions et guide de mise à jour](https://bmad-plus.rochetta.fr/fr/docs/#changelog) · [Toutes les versions publiées sur npm](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 

package/src/bmad-plus/agents/agent-quality/SKILL.md

@@ -62,7 +62,7 @@ When auto-activating a role, **announce it**: "💡 I'm switching to [Role] mode
 3. Verify each suspected issue before grouping findings. Trace its trigger through the actual caller and guards, inspect counterevidence, and reproduce it when practical. A failure in an unreachable state is not an established defect. Check every source, including a reviewer that describes its own findings as pre-verified.
 4. Keep a compact finding record with identity, source, location, claimed consequence, evidence or refutation, disposition, relevant input identity and next action. The default disposition is keep: refute only on a quoted ground — the described construct is absent from the file, the code contradicts the claim (guard, caller or test quoted), or another entry already carries the same cause — and write the analysis before the disposition. A security, data-loss or money finding without such a quote stays unresolved. Use confirmed, refuted or unresolved; rank confirmed defects by impact and likelihood. Preserve previous entries when their disposition changes. Group confirmed findings only when the same cause explains them, retaining each source record. Do not merge away a refutation or impose a finding quota.
 5. Inspect verification at the actual consumer. Read assertions and check how tests are selected before judging their coverage. Search relevant symbols and imports before asserting that coverage is absent. For a verification gap, name the consumer and a concrete regression or missed adoption that the current checks would fail to catch. Skipped tests, mocks that bypass the changed path and helper-only success do not prove that consumer works.
-6. When the BMAD+ CLI is available, back a code review with its evidence: `bmad-plus review scope <id>` before reading (its `checklist.md` holds the review rules that apply to the changed paths, and `--effort` sets the passes), then `findings.json` with every finding quoting its code verbatim and `coverage.json` accounting for every selected file, then `bmad-plus review anchor <id>` and `bmad-plus review gate <id>`. Report the gate's disposition (incomplete, findings or clean) without upgrading it. On a second review of the same work, `bmad-plus review compare <id> --since <earlier-id>`: a finding gone from a file this review did not complete is not reviewed, never fixed.
+6. When the BMAD+ CLI is available, back a code review with its evidence: `bmad-plus review scope <id>` before reading (its `checklist.md` holds the review rules that apply to the changed paths, and `--effort` sets the passes), then `findings.json` with every finding quoting its code verbatim and `coverage.json` accounting for every selected file, then `bmad-plus review anchor <id>` and `bmad-plus review gate <id>`. Record in `coverage.json` how the session ended (`run.stop`), the passes actually run and every unit attempt; stop retrying a unit or rule group after three failures in a row, and never estimate tokens or time. Report the gate's disposition (incomplete, findings or clean) without upgrading it; a stopped review is never clean. To resume an interrupted review, `bmad-plus review continue <id>`: it refuses when the code or the rules moved. On a second review of the same work, `bmad-plus review compare <id> --since <earlier-id>`: a finding gone from a file this review did not complete is not reviewed, never fixed.
 7. Reconcile acceptance using executed commands or direct observations against the current artifact set. Record passed, failed, skipped and unavailable checks separately. A missing required reviewer or untested criterion prevents a completed-acceptance claim, even when the remaining checks pass. A same-author review must not be described as independent verification.
 
 ## Repair and continuation