bmad-plus 0.7.5 → 0.9.0

package/CHANGELOG.md

@@ -1,425 +1,479 @@
-# Changelog
-
-All notable changes to BMAD+ will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [0.7.5] — 2026-05-17
-
-### 🩺 Quality & Compliance
-
-### Added
-- **MIT LICENSE** — Proper license file matching `package.json` declaration
-- **PACKS↔module.yaml sync check** — New Check 9 in `npx bmad-plus doctor` that cross-validates install.js PACKS object against module.yaml packs, preventing invisible pack bugs
-- **30 new unit tests** — Total now 97:
-  - `scan.js` module validation (markers, skip dirs, options)
-  - `autoconfig.js` function checks (detectStack, analyzeStructure, calculateHealth, recommendPacks)
-  - `memory.js` subcommand and health score validation
-  - PACKS↔module.yaml bidirectional sync (count + key match)
-  - LICENSE file integrity
-- **Global brain consolidation** — Promoted cross-project wisdom:
-  - 1 lesson (PowerShell UTF-8 corruption)
-  - 2 decisions (anti-regression protocol, i18n-first CLI)
-  - 2 patterns (dual-tier memory, surgical edit protocol)
-
-## [0.7.4] — 2026-05-17
-
-### 🧠 Smart Autoconfig
-
-### Added
-- **`npx bmad-plus autoconfig`** — Smart project bootstrap:
-  - **Existing projects**: analyzes stack, structure, health; auto-selects packs; populates memory
-  - **New projects**: interactive wizard (type + description); initializes everything
-  - Auto-preserves existing IDE configs (`--tools none` when configs detected)
-  - Writes `context.md` with full project analysis for agent continuity
-  - Shows contextual recommendations ("Talk to Forge to...", "Talk to Sentinel to...")
-
-### Fixed
-- `--tools none` installer crash (undefined IDE name)
-
-## [0.7.3] — 2026-05-17
-
-### 🎨 Scan UX Improvements
-
-### Added
-- **Scan legend** — Color-coded status legend displayed before the project table
-- **`--active-days <n>`** — Custom threshold for "active" status (default: 30 days)
-- **`--paused-days <n>`** — Custom threshold for "paused" status (default: 180 days)
-
-### Fixed
-- Scan now accepts positional path argument (`npx bmad-plus scan D:\path`)
-
-## [0.7.1] — 2026-05-17
-
-### 🛠️ CLI Commands & Guardrails Injection
-
-### Added
-- **`npx bmad-plus scan [path]`** — Interactive project scanner
-  - Recursive directory scan with stack auto-detection (Node.js, Rust, Python, Go, PHP, Ruby, Java)
-  - Framework detection (Next.js, Nuxt, React, Vue, Svelte, Express, Electron, Tauri)
-  - Status tracking (active/paused/archived based on last modified)
-  - Interactive validation: index all, select, or skip
-  - Auto-generates `projects-index.md` in global brain
-- **`npx bmad-plus memory status`** — Memory health report
-  - Shows project memory + global brain status
-  - Entry counts, last modified dates, health score
-  - Brain link detection
-- **`npx bmad-plus memory export`** — Export brain as portable Markdown archive
-- **Karpathy Guardrails injection** — 4 principles auto-injected into CLAUDE.md/GEMINI.md/AGENTS.md when Memory pack is installed
-- **i18n** — Memory + Dev Studio keys for EN and FR (other languages use fallback)
-
-## [0.7.0] — 2026-05-17
-
-### 🧠 Pack Memory — Persistent Brain
-
-### Added
-- **Pack Memory** — Persistent cross-session memory system with brain detection
-  - 🧠 **Zecher Agent** (זכר, "remembrance") — Memory archivist for consolidation, project scanning, context recall
-  - 📁 **Project Memory** (`.agents/memory/`) — decisions.md, lessons.md, patterns.md, context.md, sessions/
-  - 🌐 **Global Brain** (`~/.bmad-plus/brain/`) — Cross-project knowledge, identity, project index
-  - 🔍 **Project Scanner** — Scan directories/disks, detect stacks, interactive validation, auto-index
-  - 🛡️ **Karpathy Guardrails** — 4 behavioral principles (Think, Simplify, Surgical, Goal-driven) woven into agents
-  - 📋 **Memory Protocol** — Complete read/write rules for when agents use memory
-  - 🔗 **Brain Detection** — Detects existing `_brain/`, `~/.claude/memory/`, links instead of overwrites
-  - 📝 **6 templates** — decisions, lessons, patterns, context, session-handoff, identity.yaml
-
-### Changed
-- CLI installer: brain detection step (4.5) with merge-safe logic
-- IDE config generation: Zecher agent listed when memory pack selected
-- Install guide: memory-specific examples (Zecher commands)
-
-## [0.6.0] — 2026-05-17
-
-### 🏗️ Pack Dev Studio — Full Software Development Lifecycle
-
-### Added
-- **Pack Dev Studio** — 6 specialized agents + 30 workflows covering the complete SDLC
-  - 📊 **Analysis** (8): Miriam (Business Analyst), Huldah (Tech Writer), Product Brief, PRFAQ, Market/Domain/Technical Research
-  - 📋 **Planning** (7): Yosef (Product Manager), Rachel (UX Designer), PRD Create/Edit/Validate, UX Design
-  - 🏗️ **Architecture** (5+9 steps): Bezalel (System Architect), Create Architecture (8-step workflow), Epics & Stories, Readiness Check
-  - 💻 **Implementation** (12): Oholiab (Senior Engineer), Sprint Planning, Dev Story (TDD cycle), Code Review, Quick Dev, Investigate
-  - 🔧 **Utilities** (12): Distillator, Party Mode, Adversarial Review, Edge Case Hunter, Editorial Reviews, Advanced Elicitation
-- **BWML** (BMAD+ Workflow Markup Language) — Proprietary DSL extending BMAD v6 XML with 12 new primitives:
-  `<agent>`, `<parallel>`, `<loop>`, `<validate>`, `<guard>`, `<emit>`, `<context>`, `<memory>`, `<escalate>`, `<retry>`, `<fallback>`, `<metric>`
-- **Dev Studio Orchestrator** — Intelligent routing across 5 phases with BWML-powered workflow definitions
-- **Torah-named Personas** — Agents named after Torah figures matching their roles: Miriam, Huldah, Yosef, Rachel, Bezalel, Oholiab
-- **Upstream Sync** — Tracking config for BMAD-METHOD v6.6.0 updates (commit `0f852a3`)
-- **64 files** — 59 .md skills, module-help.csv, BWML spec, orchestrator, README, upstream-sync
-
-### Changed
-- **module.yaml** — Added dev-studio pack with 5 categories and cohabitation warning for Core pack
-- **install.js** — IDE configs now include 6 Torah-named agents when Dev Studio is selected
-- **Version reference** — Updated from BMAD-METHOD v6.2.0 to v6.6.0
-
-## [0.5.0] — 2026-05-17
-
-### 🛡️ Pack Shield — GRC Compliance (38 agents)
-
-### Added
-- **Pack Shield** — 38 expert compliance agents covering 25+ regulatory frameworks
-  - 🔐 **Data Privacy** (5): GDPR, CCPA/CPRA, LGPD, DPDPA, ISO 27701
-  - 🛡️ **Cybersecurity** (6): ISO 27001, NIST CSF 2.0, NIST 800-53, CIS Controls v8, NIS2, ISM
-  - 🏢 **Industry Compliance** (6): SOC 2, PCI DSS v4.0, HIPAA, SWIFT CSP, DORA, FedRAMP
-  - 🔒 **Defense & Export** (4): CMMC 2.0, ITAR, EAR, TSA
-  - 🤖 **AI Governance** (3): EU AI Act, ISO 42001, NIST AI RMF
-  - ♿ **Accessibility & ESG** (3): WCAG, Section 508, CSRD
-  - 📋 **GDPR & AI Act Workflows** (11): DPIA, Breach Response, LIA, Privacy Notices/Policies, Cookie Compliance, AI Act Classification/Roles/FRIA/Incidents
-- **Shield Orchestrator** — Intelligent routing across all 38 agents with cross-framework mapping
-- **85 Reference Files** — Deep regulatory knowledge extracted from upstream Claude Skills archives
-- **3 Shared Templates** — Gap Analysis, Cross-Framework Mapper, Audit Report
-- **Upstream Sync System** — Tracking configuration for Sushegaad GRC skill updates
-- **module.yaml** — Full shield pack definition with 7 categories and per-category agent lists
-- **CLI Integration** — Shield pack selectable in `npx bmad-plus install` with 3 localized example commands
-- **IDE Config** — Shield agent advertised in generated AGENTS.md/GEMINI.md
-
-### Changed
-- **install_packs** — All packs now listed in multiselect (seo, backup, animated were missing)
-- **module.yaml** — Replaced old `audit` (coming_soon) stub with fully realized `shield` pack
-
-### Attribution
-- Based on [Claude Skills for GRC](https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) by Hemant Naik — MIT License
-- GDPR/EU AI Act workflows inspired by [Lawve.ai](https://lawve.ai) professional skills catalog
-
----
-
-## [0.4.4] — 2026-05-17
-
-### 🔧 Encoding Fix + i18n Complete + Tests
-
-### Fixed
-- **UTF-8 encoding** — Fixed double-encoding corruption in `i18n.js` caused by PowerShell `Set-Content`
-- **Credits URL** — Now points to public repo `github.com/lrochetta/BMAD-PLUS`
-- **npm re-publish** — v0.4.3 had corrupted Unicode on npm; this release replaces it
-
-### Added
-- **Complete i18n** — CLI guide strings (commands, examples) now translated in all 10 languages (no more EN fallbacks)
-- **Unit tests** — 53+ tests covering i18n, CLI modules, package.json integrity, module.yaml, source files, version consistency
-- **`npm test`** — Jest test script added to package.json
-
----
-
-## [0.4.3] — 2026-05-17
-
-### 🔧 CLI Commands + Security Hardening + UX Enhancements
-
-### Added
-- **`bmad-plus update`** — Update agents & skills while preserving config, IDE configs, and output directories
-- **`bmad-plus doctor`** — Check installation integrity (version, agents, configs, pack health)
-- **Internationalized `uninstall`** — Uses i18n system from install manifest language (10 languages)
-- **Credits at startup** — Author attribution displayed immediately when installer launches
-- **Enriched post-install guide** — CLI commands section + pack-specific usage examples in selected language
-- **i18n strings for update/uninstall/doctor** — EN, FR, ES, DE, PT-BR, RU, ZH, HE, JA, IT
-- **CLI guide strings** — `guide_cli_title`, `guide_examples_title`, pack examples for SEO/Backup/Animated/OSINT
-
-### Fixed
-- **Security** — Added `mcp-server/.env` to `.gitignore`, created `.env.example` template
-- **Manifest version** — Now reads from `package.json` dynamically (was hardcoded `0.4.0`)
-- **`module.yaml` sync** — Added missing SEO, Backup, Animated pack definitions
-- **`package.json` cleanup** — Removed `oveanet-pack` from `files[]` (already excluded by `.npmignore`)
-- **CI/CD reliability** — Removed `continue-on-error` from npm publish step
-- **Comment accuracy** — Updated "9 languages" → "10 languages" in install.js header
-- **Installer title** — Now reads version from `package.json` dynamically
-
-### Changed
-- **Dependencies** — Updated `@clack/prompts` 1.1.0 → 1.4.0, `fs-extra` 11.3.4 → 11.3.5
-- **npm scripts** — Added `update:bmad` and `doctor:bmad` scripts
-
----
-
-## [0.4.2] — 2026-03-19
-
-### 📦 Public Packs — SEO/Backup/Animated now in npm
-
-### Added
-- **Public pack agents** — SEO Audit 360, Universal Backup, Animated Website agent files now included in npm package
-- Agent files copied from `oveanet-pack/` to `src/bmad-plus/agents/pack-seo/`, `pack-backup/`, `pack-animated/`
-- Installer `packDir` system replaces `oveanetAgent` for proper npm distribution
-
----
-
-## [0.4.1] — 2026-03-19
-
-### 🌐 CLI Internationalization + DevOps Hardening
-
-### Added
-- **10-language CLI installer** — EN, FR, ES, DE, PT-BR, RU, ZH, HE, JA, IT with language selector at startup
-- **CI/CD pipeline** — `publish-distribution.yml` GitHub Action (Golden → Public repo scrubbing)
-- **`.npmignore`** — Excludes private directories from npm package
-- **`/deploy` workflow** — Mandatory pre-deployment checklist
-- **Post-install guide** — Enriched with all packs (SEO, Backup, Animated Website)
-
-### Fixed
-- **Security** — Purged `secrets/github_pat.txt` from git history, fixed `.gitignore` UTF-16 corruption
-- **Version badges** — Updated from 0.1.0 → 0.4.1 across all 5 READMEs
-- **Project structure** — Updated trees in both Golden and Distribution READMEs
-
----
-
-## [0.4.0] — 2026-03-19
-
-### 🏢 SEO Engine — Enterprise Extensions (Sprint 4)
-
-### Added
-- **Google Search Console extension** — OAuth2 client for organic search data (queries, pages, coverage, sitemaps)
-- **Google Analytics 4 extension** — GA4 Data API client for organic traffic, landing pages, and engagement metrics
-- Both extensions include setup guides, Python clients, and separate requirements
-
-### Notes
-- Extensions are **optional** and require OAuth2 setup (see `EXTENSION.md` in each directory)
-- Core SEO Engine (SKILL.md + 3 agents + Python toolkit) works without extensions
-- GSC and GA4 share OAuth2 credentials for simplified auth flow
-
----
-
-## [0.3.3] — 2026-03-19
-
-### 🧪 SEO Engine — Quality & Security (Sprint 3)
-
-### Added
-- **Unit tests** — 50 pytest tests covering all Python scripts (fetch, parse, crawl, APIs)
-- **Pre-commit hook** — `hooks/seo-check.sh` validates HTML for title, meta, alt, H1 before commit
-- **Audit JSON schema** — `ref/audit-schema.json` standardized export format for dashboard/API integration
-- **Test fixture** — `tests/fixtures/sample_page.html` with known SEO elements
-
----
-
-## [0.3.2] — 2026-03-19
-
-### 📊 SEO Engine — Reports, Competitor & Hreflang (Sprint 2)
-
-### Added
-- **seo_report.py** — Professional HTML report generator with inline SVG radar chart, color-coded issue cards, quick wins section, and print-friendly CSS
-- **Benchmarker role** — Added to Chief agent for `/seo competitor` command (side-by-side site comparison with delta scoring)
-- **hreflang-rules.md** — Complete hreflang audit reference with 7 validation rules, 6 common error patterns, and 12-point checklist
-
----
-
-## [0.3.1] — 2026-03-19
-
-### 🔧 SEO Engine Enhancements (Sprint 1)
-
-### Added
-- **SKILL.md orchestrator** — Single entry point routing 15 `/seo` commands to the right agents
-- **seo_apis.py** — Google APIs client (PageSpeed Insights, CrUX field data, Rich Results Test)
-- **requirements.txt** — Python dependencies (requests, beautifulsoup4, lxml)
-- **install.sh + install.ps1** — Cross-platform dependency installer with venv support
-
----
-
-## [0.3.0] — 2026-03-19
-
-### 🚀 SEO Engine v2.0 — Complete Rewrite
-
-### Added
-- **3 multi-role SEO agents** (replacing single monolithic agent):
-  - 🔎 **Scout** — Technical scanner (Crawler, Inspector, Photographer)
-  - ⚖️ **Judge** — Content & AI analyst (Content Expert, Schema Master, GEO Analyst)
-  - 👑 **Chief** — Strategist & reporter (Scorer, Strategist, Reporter)
-- **4 Python scripts** (new toolkit):
-  - `seo_fetch.py` — Secure HTTP fetcher with SSRF protection and multi-UA support
-  - `seo_parse.py` — HTML parser for meta, schema, links, images, word count
-  - `seo_crawl.py` — Recursive mini-crawler with sitemap parsing and orphan detection
-  - `seo_screenshot.py` — Playwright viewport screenshots with above-fold analysis
-- **6 reference documents**:
-  - Core Web Vitals 2026 thresholds (LCP subparts, INP, CLS)
-  - Schema.org v29.4 type catalog with deprecation status
-  - E-E-A-T scoring grid (100-point evaluation)
-  - GEO signals for AI search optimization (Google AI Overviews, ChatGPT, Perplexity)
-  - Quality gates with content thresholds by page type
-  - 14 ready-to-use JSON-LD schema templates
-- **6-phase audit workflow** with PageSpeed perfection loop
-- **SEO Health Score (0–100)** with 7 weighted categories
-- **Auto-generated code fixes** for common SEO issues
-- **13 user commands** (`/seo full`, `/seo quick`, `/seo pagespeed`, etc.)
-- **Monitoring system** with historical score comparison
-
-### Changed
-- SEO Audit 360 pack upgraded from v1.0 to v2.0
-- Architecture: single SKILL.md → 3 specialized agents with parallel execution
-
-### Preserved
-- `pagespeed-playbook.md` — Battle-tested oveanet.ch PageSpeed optimization loop
-- `checklist.md` — Original PageSpeed perfection checklist
-
----
-
-## [0.2.0] — 2026-03-18
-
-### 🔀 Oveanet Fusion
-
-### Added
-- **3 new utility packs** from oveanet-agents:
-  - 🔍 **SEO Audit 360** — 9-category audit for search engines + AI engines (by Oveanet)
-  - 🗂️ **Universal Backup** — Timestamped ZIP backup with smart exclusions (by Oveanet)
-  - 🎬 **Animated Website** — Luxury scroll-driven website from video (by Oveanet)
-- `oveanet-pack/` directory as source for oveanet agent content
-- Oveanet sync documentation in `process-info.md`
-
-### Changed
-- Installer now shows 7 packs (Core + OSINT + Maker + Audit + SEO + Backup + Animated)
-- `package.json` includes `oveanet-pack` in npm distribution
-
-### Removed
-- `pour etudier/` directory (content migrated to `oveanet-pack/`)
-
----
-
-## [0.1.3] — 2026-03-18
-
-### 🔧 Cross-Platform Fix
-
-### Fixed
-- LF line endings for `bin` scripts (fixes `npx` execution on macOS/Linux)
-- Added `.gitattributes` to enforce LF on executable scripts
-
----
-
-## [0.1.2] — 2026-03-17
-
-### 📝 Credits Update
-
-### Changed
-- Author credits translated to English in CLI installer and READMEs
-- Added LinkedIn link to credits section
-
----
-
-## [0.1.1] — 2026-03-17
-
-### 👤 Author Attribution
-
-### Added
-- Laurent Rochetta credit in `README.md`, `README-DIST.md`, and CLI success message
-- GitHub and LinkedIn links in credits section
-
----
-
-## [0.1.0] — 2026-03-17
-
-### 🎉 Initial Release — Foundation
-
-First release of BMAD+, an augmented fork of BMAD-METHOD v6.2.0.
-
-### Added
-
-#### Core Module (`src/bmad-plus/`)
-- **module.yaml** — Module configuration with execution mode, auto-role activation, parallel execution, and modular pack system
-- **module-help.csv** — Contextual help for all 8 registered skills/agents
-
-#### 5 Multi-Role Agents
-- **Atlas (Strategist)** — Fuses Analyst + PM into 2 switchable roles with auto-activation
-- **Forge (Architect-Dev)** — Fuses Architect + Dev + Tech Writer into 3 switchable roles
-- **Sentinel (Quality)** — Fuses QA + UX Designer into 2 switchable roles
-- **Nexus (Orchestrator)** — Fuses SM + Quick-Flow + new Autopilot Controller + new Parallel Supervisor (4 roles)
-- **Shadow (OSINT)** — Converted from legacy XML agent to BMAD+ v6 format (pack: osint)
-
-#### 3 Custom Skills
-- **bmad-plus-autopilot** — Full pipeline automation (Discovery → Build → Ship) with configurable checkpoints
-- **bmad-plus-parallel** — Multi-agent parallel execution with orchestrator supervision (launch/stop/restart/reallocate/escalate)
-- **bmad-plus-sync** — Upstream synchronization via VPS MCP Server
-
-#### Auto-Activation System
-- **role-triggers.yaml** — 3-level intelligent role switching:
-  - Level 1: Pattern matching (keywords in user requests)
-  - Level 2: Contextual analysis (domain detection during work)
-  - Level 3: Reasoning chains (logical discoveries during execution)
-
-#### Modular Pack System
-- **Core pack** (required) — 4 agents, 3 skills, role-triggers
-- **OSINT pack** (optional) — Shadow agent + OSINT investigation skills
-- **Maker pack** (optional) — Maker meta-agent for creating new BMAD+ compatible agents (4-phase pipeline: Discovery → Design → Generation → Validation)
-- **Audit pack** (coming soon) — Shield agent placeholder
-- Multi-select installer menu with per-pack API key requirements
-
-#### `npx bmad-plus install` CLI
-- Interactive installer with pack selection, IDE auto-detection, user config
-- Contextual post-install guide adapted to installed packs
-- `--packs`, `--yes`, `--tools`, `--directory` flags for non-interactive use
-- Uninstall command: `npx bmad-plus uninstall`
-
-#### Monitoring System (`monitor/`)
-- **weekly-check.py** — Weekly upstream monitoring script (cron)
-- **ai_analyzer.py** — Gemini API-powered diff analysis (compatible/review/breaking)
-- **notifier.py** — WhatsApp notifications via Evolution API + email fallback
-- **mcp_bridge.py** — Bridge to Audit 360° MCP Server for VPS git/github operations
-- **docker-compose.yml** — Evolution API container configuration
-- **config.example.yaml** — Configuration template
-
-#### Multi-IDE Support
-- **CLAUDE.md** — Claude Code configuration
-- **GEMINI.md** — Gemini CLI configuration
-- **AGENTS.md** — Codex CLI / OpenCode configuration
-
-#### Integration
-- Integrated existing **osint-agent-package** (Shadow agent, 55+ Apify actors, 7 APIs)
-- Integrated existing **mcp-server** (Audit 360° with 35 tools) via MCP Bridge
-
-### Upstream Compatibility
-- Based on BMAD-METHOD v6.2.0 (2026-03-15)
-- Compatible with core versions 6.0.0 — 7.0.0
-- Replaces `bmm` module while keeping core skills
-
----
-
-*For earlier history, see the upstream [BMAD-METHOD CHANGELOG](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/CHANGELOG.md).*
+# Changelog
+
+All notable changes to BMAD+ will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.9.0] — 2026-06-24
+
+### Security
+- Full audit remediation: 64/64 findings fixed, score C- → A+
+- P0: Command injection eliminated (execSync → spawnSync in CLI entry point)
+- P0: MCP Server authentication added (token-validated middleware on all endpoints)
+- CI/CD hardened: PAT removed, force-push eliminated, npm audit gate blocking
+- MCP allowlist hardened, path traversal protection, URL hostname validation
+- VPS IP → env var, TLS deployment docs, SSRF/XXE protection
+- 0 npm audit vulnerabilities
+
+### Changed
+- Shared PACKS module — single source of truth for all 9 packs
+- install.js 740→300 lines: extracted memory-init.js + pack-copy.js
+- print() → logging, time.sleep → asyncio.sleep, empty catch blocks filled
+- Dynamic version in i18n.js (reads from package.json)
+
+### Removed
+- Duplicate agents/pack-{seo,animated,backup}/ directories
+
+### Documentation
+- Maker + Zecher in all config files, CHANGELOG v0.7.2 added
+- French README fix, version history synced to all translations
+- 7 audit reports in audit/ folder
+
+### Tests
+- 143/143 tests passing
+
+## [0.8.0] — 2026-06-24
+
+### Added
+- 3 new packs: pack-animated (web animation agent), pack-backup (universal backup agent), pack-seo (full SEO audit — 15 files with agents, refs, templates, playbooks)
+- `extract_frames.py` script for animated-website (263 lines, ffprobe/ffmpeg)
+
+### Security
+- P0 remediation: fix command injection, path traversal, token-in-URL, wildcard hosts, error leak (Shield GRC v2.0)
+- CI: add npm audit gate with continue-on-error, remove silent-fail pattern
+
+### Changed
+- README.de.md: full sync (+131 lines) — Pack System, Autopilot, Project Structure, Credits
+- All Torah-named references removed from Dev Studio, module.yaml, READMEs
+- Dev Studio: cleaned references in orchestrator, bwml-spec, upstream-sync
+- process-info.md: updated (oveanet-pack not in npm package)
+- CI: Windows %TEMP% → tmp/ in .npmignore and CI workflow
+- Badge shields: version 0.7.5 → 0.8.0 across all 5 READMEs
+
+### Fixed
+- Broken TOC anchor links across all 5 READMEs (#the-56-agents)
+- oveanet ↔ .agents mirror directories sync (31 files)
+
+### Tests
+- 143/143 tests passing ✅
+
+## [0.7.5] — 2026-05-17
+
+### 🩺 Quality & Compliance
+
+### Added
+- **MIT LICENSE** — Proper license file matching `package.json` declaration
+- **PACKS↔module.yaml sync check** — New Check 9 in `npx bmad-plus doctor` that cross-validates install.js PACKS object against module.yaml packs, preventing invisible pack bugs
+- **30 new unit tests** — Total now 97:
+  - `scan.js` module validation (markers, skip dirs, options)
+  - `autoconfig.js` function checks (detectStack, analyzeStructure, calculateHealth, recommendPacks)
+  - `memory.js` subcommand and health score validation
+  - PACKS↔module.yaml bidirectional sync (count + key match)
+  - LICENSE file integrity
+- **Global brain consolidation** — Promoted cross-project wisdom:
+  - 1 lesson (PowerShell UTF-8 corruption)
+  - 2 decisions (anti-regression protocol, i18n-first CLI)
+  - 2 patterns (dual-tier memory, surgical edit protocol)
+
+## [0.7.4] — 2026-05-17
+
+### 🧠 Smart Autoconfig
+
+### Added
+- **`npx bmad-plus autoconfig`** — Smart project bootstrap:
+  - **Existing projects**: analyzes stack, structure, health; auto-selects packs; populates memory
+  - **New projects**: interactive wizard (type + description); initializes everything
+  - Auto-preserves existing IDE configs (`--tools none` when configs detected)
+  - Writes `context.md` with full project analysis for agent continuity
+  - Shows contextual recommendations ("Talk to Forge to...", "Talk to Sentinel to...")
+
+### Fixed
+- `--tools none` installer crash (undefined IDE name)
+
+## [0.7.3] — 2026-05-17
+
+### 🎨 Scan UX Improvements
+
+### Added
+- **Scan legend** — Color-coded status legend displayed before the project table
+- **`--active-days <n>`** — Custom threshold for "active" status (default: 30 days)
+- **`--paused-days <n>`** — Custom threshold for "paused" status (default: 180 days)
+
+## [0.7.2] - 2026-06-XX
+### Fixed
+- `scan` command: `bmad-plus scan <path>` now accepts a positional path argument
+
+## [0.7.1] — 2026-05-17
+
+### 🛠️ CLI Commands & Guardrails Injection
+
+### Added
+- **`npx bmad-plus scan [path]`** — Interactive project scanner
+  - Recursive directory scan with stack auto-detection (Node.js, Rust, Python, Go, PHP, Ruby, Java)
+  - Framework detection (Next.js, Nuxt, React, Vue, Svelte, Express, Electron, Tauri)
+  - Status tracking (active/paused/archived based on last modified)
+  - Interactive validation: index all, select, or skip
+  - Auto-generates `projects-index.md` in global brain
+- **`npx bmad-plus memory status`** — Memory health report
+  - Shows project memory + global brain status
+  - Entry counts, last modified dates, health score
+  - Brain link detection
+- **`npx bmad-plus memory export`** — Export brain as portable Markdown archive
+- **Karpathy Guardrails injection** — 4 principles auto-injected into CLAUDE.md/GEMINI.md/AGENTS.md when Memory pack is installed
+- **i18n** — Memory + Dev Studio keys for EN and FR (other languages use fallback)
+
+## [0.7.0] — 2026-05-17
+
+### 🧠 Pack Memory — Persistent Brain
+
+### Added
+- **Pack Memory** — Persistent cross-session memory system with brain detection
+  - 🧠 **Zecher Agent** (זכר, "remembrance") — Memory archivist for consolidation, project scanning, context recall
+  - 📁 **Project Memory** (`.agents/memory/`) — decisions.md, lessons.md, patterns.md, context.md, sessions/
+  - 🌐 **Global Brain** (`~/.bmad-plus/brain/`) — Cross-project knowledge, identity, project index
+  - 🔍 **Project Scanner** — Scan directories/disks, detect stacks, interactive validation, auto-index
+  - 🛡️ **Karpathy Guardrails** — 4 behavioral principles (Think, Simplify, Surgical, Goal-driven) woven into agents
+  - 📋 **Memory Protocol** — Complete read/write rules for when agents use memory
+  - 🔗 **Brain Detection** — Detects existing `_brain/`, `~/.claude/memory/`, links instead of overwrites
+  - 📝 **6 templates** — decisions, lessons, patterns, context, session-handoff, identity.yaml
+
+### Changed
+- CLI installer: brain detection step (4.5) with merge-safe logic
+- IDE config generation: Zecher agent listed when memory pack selected
+- Install guide: memory-specific examples (Zecher commands)
+
+## [0.6.0] — 2026-05-17
+
+### 🏗️ Pack Dev Studio — Full Software Development Lifecycle
+
+### Added
+- **Pack Dev Studio** — 6 specialized agents + 30 workflows covering the complete SDLC
+  - 📊 **Analysis** (8): Miriam (Business Analyst), Huldah (Tech Writer), Product Brief, PRFAQ, Market/Domain/Technical Research
+  - 📋 **Planning** (7): Yosef (Product Manager), Rachel (UX Designer), PRD Create/Edit/Validate, UX Design
+  - 🏗️ **Architecture** (5+9 steps): Bezalel (System Architect), Create Architecture (8-step workflow), Epics & Stories, Readiness Check
+  - 💻 **Implementation** (12): Oholiab (Senior Engineer), Sprint Planning, Dev Story (TDD cycle), Code Review, Quick Dev, Investigate
+  - 🔧 **Utilities** (12): Distillator, Party Mode, Adversarial Review, Edge Case Hunter, Editorial Reviews, Advanced Elicitation
+- **BWML** (BMAD+ Workflow Markup Language) — Proprietary DSL extending BMAD v6 XML with 12 new primitives:
+  `<agent>`, `<parallel>`, `<loop>`, `<validate>`, `<guard>`, `<emit>`, `<context>`, `<memory>`, `<escalate>`, `<retry>`, `<fallback>`, `<metric>`
+- **Dev Studio Orchestrator** — Intelligent routing across 5 phases with BWML-powered workflow definitions
+- **Torah-named Personas** — Agents named after Torah figures matching their roles: Miriam, Huldah, Yosef, Rachel, Bezalel, Oholiab
+- **Upstream Sync** — Tracking config for BMAD-METHOD v6.6.0 updates (commit `0f852a3`)
+- **64 files** — 59 .md skills, module-help.csv, BWML spec, orchestrator, README, upstream-sync
+
+### Changed
+- **module.yaml** — Added dev-studio pack with 5 categories and cohabitation warning for Core pack
+- **install.js** — IDE configs now include 6 Torah-named agents when Dev Studio is selected
+- **Version reference** — Updated from BMAD-METHOD v6.2.0 to v6.6.0
+
+## [0.5.0] — 2026-05-17
+
+### 🛡️ Pack Shield — GRC Compliance (38 agents)
+
+### Added
+- **Pack Shield** — 38 expert compliance agents covering 25+ regulatory frameworks
+  - 🔐 **Data Privacy** (5): GDPR, CCPA/CPRA, LGPD, DPDPA, ISO 27701
+  - 🛡️ **Cybersecurity** (6): ISO 27001, NIST CSF 2.0, NIST 800-53, CIS Controls v8, NIS2, ISM
+  - 🏢 **Industry Compliance** (6): SOC 2, PCI DSS v4.0, HIPAA, SWIFT CSP, DORA, FedRAMP
+  - 🔒 **Defense & Export** (4): CMMC 2.0, ITAR, EAR, TSA
+  - 🤖 **AI Governance** (3): EU AI Act, ISO 42001, NIST AI RMF
+  - ♿ **Accessibility & ESG** (3): WCAG, Section 508, CSRD
+  - 📋 **GDPR & AI Act Workflows** (11): DPIA, Breach Response, LIA, Privacy Notices/Policies, Cookie Compliance, AI Act Classification/Roles/FRIA/Incidents
+- **Shield Orchestrator** — Intelligent routing across all 38 agents with cross-framework mapping
+- **85 Reference Files** — Deep regulatory knowledge extracted from upstream Claude Skills archives
+- **3 Shared Templates** — Gap Analysis, Cross-Framework Mapper, Audit Report
+- **Upstream Sync System** — Tracking configuration for Sushegaad GRC skill updates
+- **module.yaml** — Full shield pack definition with 7 categories and per-category agent lists
+- **CLI Integration** — Shield pack selectable in `npx bmad-plus install` with 3 localized example commands
+- **IDE Config** — Shield agent advertised in generated AGENTS.md/GEMINI.md
+
+### Changed
+- **install_packs** — All packs now listed in multiselect (seo, backup, animated were missing)
+- **module.yaml** — Replaced old `audit` (coming_soon) stub with fully realized `shield` pack
+
+### Attribution
+- Based on [Claude Skills for GRC](https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) by Hemant Naik — MIT License
+- GDPR/EU AI Act workflows inspired by [Lawve.ai](https://lawve.ai) professional skills catalog
+
+---
+
+## [0.4.4] — 2026-05-17
+
+### 🔧 Encoding Fix + i18n Complete + Tests
+
+### Fixed
+- **UTF-8 encoding** — Fixed double-encoding corruption in `i18n.js` caused by PowerShell `Set-Content`
+- **Credits URL** — Now points to public repo `github.com/lrochetta/BMAD-PLUS`
+- **npm re-publish** — v0.4.3 had corrupted Unicode on npm; this release replaces it
+
+### Added
+- **Complete i18n** — CLI guide strings (commands, examples) now translated in all 10 languages (no more EN fallbacks)
+- **Unit tests** — 53+ tests covering i18n, CLI modules, package.json integrity, module.yaml, source files, version consistency
+- **`npm test`** — Jest test script added to package.json
+
+---
+
+## [0.4.3] — 2026-05-17
+
+### 🔧 CLI Commands + Security Hardening + UX Enhancements
+
+### Added
+- **`bmad-plus update`** — Update agents & skills while preserving config, IDE configs, and output directories
+- **`bmad-plus doctor`** — Check installation integrity (version, agents, configs, pack health)
+- **Internationalized `uninstall`** — Uses i18n system from install manifest language (10 languages)
+- **Credits at startup** — Author attribution displayed immediately when installer launches
+- **Enriched post-install guide** — CLI commands section + pack-specific usage examples in selected language
+- **i18n strings for update/uninstall/doctor** — EN, FR, ES, DE, PT-BR, RU, ZH, HE, JA, IT
+- **CLI guide strings** — `guide_cli_title`, `guide_examples_title`, pack examples for SEO/Backup/Animated/OSINT
+
+### Fixed
+- **Security** — Added `mcp-server/.env` to `.gitignore`, created `.env.example` template
+- **Manifest version** — Now reads from `package.json` dynamically (was hardcoded `0.4.0`)
+- **`module.yaml` sync** — Added missing SEO, Backup, Animated pack definitions
+- **`package.json` cleanup** — Removed `oveanet-pack` from `files[]` (already excluded by `.npmignore`)
+- **CI/CD reliability** — Removed `continue-on-error` from npm publish step
+- **Comment accuracy** — Updated "9 languages" → "10 languages" in install.js header
+- **Installer title** — Now reads version from `package.json` dynamically
+
+### Changed
+- **Dependencies** — Updated `@clack/prompts` 1.1.0 → 1.4.0, `fs-extra` 11.3.4 → 11.3.5
+- **npm scripts** — Added `update:bmad` and `doctor:bmad` scripts
+
+---
+
+## [0.4.2] — 2026-03-19
+
+### 📦 Public Packs — SEO/Backup/Animated now in npm
+
+### Added
+- **Public pack agents** — SEO Audit 360, Universal Backup, Animated Website agent files now included in npm package
+- Agent files copied from `oveanet-pack/` to `src/bmad-plus/agents/pack-seo/`, `pack-backup/`, `pack-animated/`
+- Installer `packDir` system replaces `oveanetAgent` for proper npm distribution
+
+---
+
+## [0.4.1] — 2026-03-19
+
+### 🌐 CLI Internationalization + DevOps Hardening
+
+### Added
+- **10-language CLI installer** — EN, FR, ES, DE, PT-BR, RU, ZH, HE, JA, IT with language selector at startup
+- **CI/CD pipeline** — `publish-distribution.yml` GitHub Action (Golden → Public repo scrubbing)
+- **`.npmignore`** — Excludes private directories from npm package
+- **`/deploy` workflow** — Mandatory pre-deployment checklist
+- **Post-install guide** — Enriched with all packs (SEO, Backup, Animated Website)
+
+### Fixed
+- **Security** — Purged `secrets/github_pat.txt` from git history, fixed `.gitignore` UTF-16 corruption
+- **Version badges** — Updated from 0.1.0 → 0.4.1 across all 5 READMEs
+- **Project structure** — Updated trees in both Golden and Distribution READMEs
+
+---
+
+## [0.4.0] — 2026-03-19
+
+### 🏢 SEO Engine — Enterprise Extensions (Sprint 4)
+
+### Added
+- **Google Search Console extension** — OAuth2 client for organic search data (queries, pages, coverage, sitemaps)
+- **Google Analytics 4 extension** — GA4 Data API client for organic traffic, landing pages, and engagement metrics
+- Both extensions include setup guides, Python clients, and separate requirements
+
+### Notes
+- Extensions are **optional** and require OAuth2 setup (see `EXTENSION.md` in each directory)
+- Core SEO Engine (SKILL.md + 3 agents + Python toolkit) works without extensions
+- GSC and GA4 share OAuth2 credentials for simplified auth flow
+
+---
+
+## [0.3.3] — 2026-03-19
+
+### 🧪 SEO Engine — Quality & Security (Sprint 3)
+
+### Added
+- **Unit tests** — 50 pytest tests covering all Python scripts (fetch, parse, crawl, APIs)
+- **Pre-commit hook** — `hooks/seo-check.sh` validates HTML for title, meta, alt, H1 before commit
+- **Audit JSON schema** — `ref/audit-schema.json` standardized export format for dashboard/API integration
+- **Test fixture** — `tests/fixtures/sample_page.html` with known SEO elements
+
+---
+
+## [0.3.2] — 2026-03-19
+
+### 📊 SEO Engine — Reports, Competitor & Hreflang (Sprint 2)
+
+### Added
+- **seo_report.py** — Professional HTML report generator with inline SVG radar chart, color-coded issue cards, quick wins section, and print-friendly CSS
+- **Benchmarker role** — Added to Chief agent for `/seo competitor` command (side-by-side site comparison with delta scoring)
+- **hreflang-rules.md** — Complete hreflang audit reference with 7 validation rules, 6 common error patterns, and 12-point checklist
+
+---
+
+## [0.3.1] — 2026-03-19
+
+### 🔧 SEO Engine Enhancements (Sprint 1)
+
+### Added
+- **SKILL.md orchestrator** — Single entry point routing 15 `/seo` commands to the right agents
+- **seo_apis.py** — Google APIs client (PageSpeed Insights, CrUX field data, Rich Results Test)
+- **requirements.txt** — Python dependencies (requests, beautifulsoup4, lxml)
+- **install.sh + install.ps1** — Cross-platform dependency installer with venv support
+
+---
+
+## [0.3.0] — 2026-03-19
+
+### 🚀 SEO Engine v2.0 — Complete Rewrite
+
+### Added
+- **3 multi-role SEO agents** (replacing single monolithic agent):
+  - 🔎 **Scout** — Technical scanner (Crawler, Inspector, Photographer)
+  - ⚖️ **Judge** — Content & AI analyst (Content Expert, Schema Master, GEO Analyst)
+  - 👑 **Chief** — Strategist & reporter (Scorer, Strategist, Reporter)
+- **4 Python scripts** (new toolkit):
+  - `seo_fetch.py` — Secure HTTP fetcher with SSRF protection and multi-UA support
+  - `seo_parse.py` — HTML parser for meta, schema, links, images, word count
+  - `seo_crawl.py` — Recursive mini-crawler with sitemap parsing and orphan detection
+  - `seo_screenshot.py` — Playwright viewport screenshots with above-fold analysis
+- **6 reference documents**:
+  - Core Web Vitals 2026 thresholds (LCP subparts, INP, CLS)
+  - Schema.org v29.4 type catalog with deprecation status
+  - E-E-A-T scoring grid (100-point evaluation)
+  - GEO signals for AI search optimization (Google AI Overviews, ChatGPT, Perplexity)
+  - Quality gates with content thresholds by page type
+  - 14 ready-to-use JSON-LD schema templates
+- **6-phase audit workflow** with PageSpeed perfection loop
+- **SEO Health Score (0–100)** with 7 weighted categories
+- **Auto-generated code fixes** for common SEO issues
+- **13 user commands** (`/seo full`, `/seo quick`, `/seo pagespeed`, etc.)
+- **Monitoring system** with historical score comparison
+
+### Changed
+- SEO Audit 360 pack upgraded from v1.0 to v2.0
+- Architecture: single SKILL.md → 3 specialized agents with parallel execution
+
+### Preserved
+- `pagespeed-playbook.md` — Battle-tested oveanet.ch PageSpeed optimization loop
+- `checklist.md` — Original PageSpeed perfection checklist
+
+---
+
+## [0.2.0] — 2026-03-18
+
+### 🔀 Oveanet Fusion
+
+### Added
+- **3 new utility packs** from oveanet-agents:
+  - 🔍 **SEO Audit 360** — 9-category audit for search engines + AI engines (by Oveanet)
+  - 🗂️ **Universal Backup** — Timestamped ZIP backup with smart exclusions (by Oveanet)
+  - 🎬 **Animated Website** — Luxury scroll-driven website from video (by Oveanet)
+- `oveanet-pack/` directory as source for oveanet agent content
+- Oveanet sync documentation in `process-info.md`
+
+### Changed
+- Installer now shows 7 packs (Core + OSINT + Maker + Audit + SEO + Backup + Animated)
+- `package.json` includes `oveanet-pack` in npm distribution
+
+### Removed
+- `pour etudier/` directory (content migrated to `oveanet-pack/`)
+
+---
+
+## [0.1.3] — 2026-03-18
+
+### 🔧 Cross-Platform Fix
+
+### Fixed
+- LF line endings for `bin` scripts (fixes `npx` execution on macOS/Linux)
+- Added `.gitattributes` to enforce LF on executable scripts
+
+---
+
+## [0.1.2] — 2026-03-17
+
+### 📝 Credits Update
+
+### Changed
+- Author credits translated to English in CLI installer and READMEs
+- Added LinkedIn link to credits section
+
+---
+
+## [0.1.1] — 2026-03-17
+
+### 👤 Author Attribution
+
+### Added
+- Laurent Rochetta credit in `README.md`, `README-DIST.md`, and CLI success message
+- GitHub and LinkedIn links in credits section
+
+---
+
+## [0.1.0] — 2026-03-17
+
+### 🎉 Initial Release — Foundation
+
+First release of BMAD+, an augmented fork of BMAD-METHOD v6.2.0.
+
+### Added
+
+#### Core Module (`src/bmad-plus/`)
+- **module.yaml** — Module configuration with execution mode, auto-role activation, parallel execution, and modular pack system
+- **module-help.csv** — Contextual help for all 8 registered skills/agents
+
+#### 5 Multi-Role Agents
+- **Atlas (Strategist)** — Fuses Analyst + PM into 2 switchable roles with auto-activation
+- **Forge (Architect-Dev)** — Fuses Architect + Dev + Tech Writer into 3 switchable roles
+- **Sentinel (Quality)** — Fuses QA + UX Designer into 2 switchable roles
+- **Nexus (Orchestrator)** — Fuses SM + Quick-Flow + new Autopilot Controller + new Parallel Supervisor (4 roles)
+- **Shadow (OSINT)** — Converted from legacy XML agent to BMAD+ v6 format (pack: osint)
+
+#### 3 Custom Skills
+- **bmad-plus-autopilot** — Full pipeline automation (Discovery → Build → Ship) with configurable checkpoints
+- **bmad-plus-parallel** — Multi-agent parallel execution with orchestrator supervision (launch/stop/restart/reallocate/escalate)
+- **bmad-plus-sync** — Upstream synchronization via VPS MCP Server
+
+#### Auto-Activation System
+- **role-triggers.yaml** — 3-level intelligent role switching:
+  - Level 1: Pattern matching (keywords in user requests)
+  - Level 2: Contextual analysis (domain detection during work)
+  - Level 3: Reasoning chains (logical discoveries during execution)
+
+#### Modular Pack System
+- **Core pack** (required) — 4 agents, 3 skills, role-triggers
+- **OSINT pack** (optional) — Shadow agent + OSINT investigation skills
+- **Maker pack** (optional) — Maker meta-agent for creating new BMAD+ compatible agents (4-phase pipeline: Discovery → Design → Generation → Validation)
+- **Audit pack** (coming soon) — Shield agent placeholder
+- Multi-select installer menu with per-pack API key requirements
+
+#### `npx bmad-plus install` CLI
+- Interactive installer with pack selection, IDE auto-detection, user config
+- Contextual post-install guide adapted to installed packs
+- `--packs`, `--yes`, `--tools`, `--directory` flags for non-interactive use
+- Uninstall command: `npx bmad-plus uninstall`
+
+#### Monitoring System (`monitor/`)
+- **weekly-check.py** — Weekly upstream monitoring script (cron)
+- **ai_analyzer.py** — Gemini API-powered diff analysis (compatible/review/breaking)
+- **notifier.py** — WhatsApp notifications via Evolution API + email fallback
+- **mcp_bridge.py** — Bridge to Audit 360° MCP Server for VPS git/github operations
+- **docker-compose.yml** — Evolution API container configuration
+- **config.example.yaml** — Configuration template
+
+#### Multi-IDE Support
+- **CLAUDE.md** — Claude Code configuration
+- **GEMINI.md** — Gemini CLI configuration
+- **AGENTS.md** — Codex CLI / OpenCode configuration
+
+#### Integration
+- Integrated existing **osint-agent-package** (Shadow agent, 55+ Apify actors, 7 APIs)
+- Integrated existing **mcp-server** (Audit 360° with 35 tools) via MCP Bridge
+
+### Upstream Compatibility
+- Based on BMAD-METHOD v6.2.0 (2026-03-15)
+- Compatible with core versions 6.0.0 — 7.0.0
+- Replaces `bmm` module while keeping core skills
+
+---
+
+*For earlier history, see the upstream [BMAD-METHOD CHANGELOG](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/CHANGELOG.md).*