bmad-plus 0.20.0 → 0.22.0

package/tools/cli/lib/uat.js

@@ -5,6 +5,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { redactFields } = require('./redact');
+const { foreignAddresses } = require('./page-origins');
 
 const SPEC_SCHEMA = 'bmad-plus/uat-spec/2';
 const RESULTS_SCHEMA = 'bmad-plus/uat-results/2';
@@ -176,6 +177,9 @@ function checkMarkup(value, where, errors) {
     rest = rest.replace(match[0], '');
   }
   if (rest.includes('<')) errors.push(`${where}: a "<" is left outside any allowed tag`);
+  // The page renders this text as markup: it is read as the template is, so the page loads
+  // nothing from another origin whatever the allowed tags come to be.
+  for (const found of foreignAddresses(value)) errors.push(`${where}: ${found}`);
 }
 
 function eachMarkup(spec, visit) {
@@ -575,22 +579,34 @@ const PAGE_GUARANTEES = [
     what: 'the exported JSON is the run as answered, and nothing is exported before a run exists',
     markers: ['download(runId + ".json", JSON.stringify(run, null, 2))'],
   },
+  {
+    id: 'no-third-party-requests',
+    what: 'opening and using the page asks nothing of any origin but its own: no remote font, stylesheet, script, image or frame',
+    markers: [],
+    // An absence has no marker: the template is read as a browser reads it, and every address
+    // it would reach on another origin, in markup, style or script, is refused by name.
+    refuses: foreignAddresses,
+  },
 ];
 
 /**
  * Which guarantees a template carries: every marker present, in the required order where one
- * is set. Checked on the TEMPLATE, never on the built page: a recipe's own text must not be
- * able to satisfy or defeat a marker.
+ * is set, and nothing it refuses. Checked on the TEMPLATE, never on the built page: a recipe's
+ * own text must not be able to satisfy or defeat a marker.
  */
 function pageGuarantees(template) {
   const missing = [];
   for (const guarantee of PAGE_GUARANTEES) {
-    const lost = guarantee.markers.filter((marker) => !template.includes(marker));
+    const lost = guarantee.markers
+      .filter((marker) => !template.includes(marker))
+      .map((marker) => `missing ${marker}`);
     if (!lost.length && guarantee.order) {
       const positions = guarantee.order.map((marker) => template.indexOf(marker));
       if (positions.some((at) => at < 0) || positions.some((at, i) => i && at < positions[i - 1]))
-        lost.push(`order ${guarantee.order.join(' → ')}`);
+        lost.push(`missing order ${guarantee.order.join(' → ')}`);
     }
+    if (guarantee.refuses)
+      for (const found of guarantee.refuses(template)) lost.push(`carries ${found}`);
     if (lost.length) missing.push({ id: guarantee.id, what: guarantee.what, lost });
   }
   const carried = PAGE_GUARANTEES.map((g) => g.id).filter(
@@ -607,7 +623,7 @@ function buildPage(spec, options = {}) {
   if (!guarantees.ok) {
     throw new Error(
       `the page template (${options.template ? 'the template given' : TEMPLATE}) lost a guarantee — not built: ${guarantees.missing
-        .map((entry) => `${entry.id}: ${entry.what} — missing ${entry.lost.join(', ')}`)
+        .map((entry) => `${entry.id}: ${entry.what} — ${entry.lost.join(', ')}`)
         .join('; ')}`
     );
   }
@@ -1013,6 +1029,7 @@ module.exports = {
   TRIAGE_SCHEMA,
   DEFAULT_DIR,
   DEFAULT_BUDGET,
+  ALLOWED_TAGS,
   STATES,
   TRIAGE_CLASSES,
   TRIAGE_DECISIONS,

package/tools/cli/review-rules/index.yaml

@@ -1,36 +1,45 @@
 # Built-in review checklists, applied by path. Every matching rule applies to a file.
 # A project adds, replaces (same id) or disables rules in _bmad/review-rules.yaml.
+# A group is a rule family: parallel reviewers can split one unit by group.
 schema: bmad-plus/review-rules/1
 rules:
   - id: general
     title: Every change
+    group: code
     globs: ['**']
     doc: general.md
   - id: javascript-typescript
     title: JavaScript and TypeScript
+    group: code
     globs: ['**/*.{js,cjs,mjs,jsx,ts,cts,mts,tsx}', '**/*.{vue,svelte}']
     doc: javascript-typescript.md
   - id: python
     title: Python
+    group: code
     globs: ['**/*.{py,pyi}']
     doc: python.md
   - id: sql-and-migrations
     title: SQL, queries and migrations
+    group: data
     globs: ['**/*.sql', '**/{migrations,migrate,db/migrate}/**', '**/*.prisma', '**/schema.rb']
     doc: sql-and-migrations.md
   - id: shell
     title: Shell and PowerShell scripts
+    group: code
     globs: ['**/*.{sh,bash,zsh,ps1,psm1}', '**/{Makefile,makefile}']
     doc: shell.md
   - id: ci-workflows
     title: CI workflows
+    group: delivery
     globs: ['.github/workflows/**/*.{yml,yaml}', '**/.gitlab-ci.yml', '**/{bitbucket-pipelines.yml,azure-pipelines.yml}']
     doc: ci-workflows.md
   - id: containers
     title: Containers and deployment manifests
+    group: delivery
     globs: ['**/{Dockerfile,Containerfile}', '**/*.dockerfile', '**/{docker-,}compose*.{yml,yaml}', '**/{k8s,kubernetes,helm,charts}/**/*.{yml,yaml}']
     doc: containers.md
   - id: configuration
     title: Configuration and dependency manifests
+    group: delivery
     globs: ['**/*.{json,yml,yaml,toml,ini,properties}', '**/.env.example', '**/{package.json,pyproject.toml,requirements*.txt,go.mod,Cargo.toml,composer.json}']
     doc: configuration.md