bmad-plus 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to BMAD+ will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.0] — 2026-06-24
+
+### Security
+- Full audit remediation: 64/64 findings fixed, score C- → A+
+- P0: Command injection eliminated (execSync → spawnSync in CLI entry point)
+- P0: MCP Server authentication added (token-validated middleware on all endpoints)
+- CI/CD hardened: PAT removed, force-push eliminated, npm audit gate blocking
+- MCP allowlist hardened, path traversal protection, URL hostname validation
+- VPS IP → env var, TLS deployment docs, SSRF/XXE protection
+- 0 npm audit vulnerabilities
+
+### Changed
+- Shared PACKS module — single source of truth for all 9 packs
+- install.js 740→300 lines: extracted memory-init.js + pack-copy.js
+- print() → logging, time.sleep → asyncio.sleep, empty catch blocks filled
+- Dynamic version in i18n.js (reads from package.json)
+
+### Removed
+- Duplicate agents/pack-{seo,animated,backup}/ directories
+
+### Documentation
+- Maker + Zecher in all config files, CHANGELOG v0.7.2 added
+- French README fix, version history synced to all translations
+- 7 audit reports in audit/ folder
+
+### Tests
+- 143/143 tests passing
+
 ## [0.8.0] — 2026-06-24
 
 ### Added
@@ -72,8 +100,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **`--active-days <n>`** — Custom threshold for "active" status (default: 30 days)
 - **`--paused-days <n>`** — Custom threshold for "paused" status (default: 180 days)
 
+## [0.7.2] - 2026-06-XX
 ### Fixed
-- Scan now accepts positional path argument (`npx bmad-plus scan D:\path`)
+- `scan` command: `bmad-plus scan <path>` now accepts a positional path argument
 
 ## [0.7.1] — 2026-05-17
 

package/README.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Augmented Multi-Agent AI Framework
 
-[![Version](https://img.shields.io/badge/version-0.8.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
 
@@ -41,6 +41,7 @@ BMAD-METHOD is an excellent framework with 9 specialized agents. But for a solo
 | Sequential execution | **Supervised parallelism** |
 | No persistent memory | **Cross-session brain** with project scanner |
 | 1-2 IDEs supported | **5 IDEs** with auto-detection |
+| 1 module | **9 modular packs** (Core, OSINT, Shield, Dev Studio, SEO, Memory...) |
 
 ---
 
@@ -213,7 +214,7 @@ graph TB
         MK["Maker 🧬"]
         ZC["Zecher 🧠 Memory"]
         SD["Shield 🛡️ GRC 38 agents"]
-        DS["Dev Studio 🏗️ SDLC 56+ agents"]
+        DS["Dev Studio 🏗️ SDLC 6 agents"]
         SEO["SEO Engine 🔎 3 agents"]
         BK["Backup 🗂️"]
         AN["Animated 🎬"]
@@ -523,6 +524,7 @@ BMAD+/
 | **0.4.4** | 2026-05-17 | 🔧 UTF-8 encoding fix, complete i18n 10 languages, 62 unit tests |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 GRC compliance agents, 7 categories, 25+ frameworks (GDPR, ISO 27001, SOC 2, EU AI Act...) |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 SDLC agents (Miriam, Yosef, Bezalel...) + 30 SDLC workflows, BWML DSL |
+| **0.9.0** | 2026-06-24 | 🚀 **Augmented & Secure** — 3 new packs (animated, backup, seo), P0 security remediation, 143/143 tests |
 | **0.8.0** | 2026-06-24 | 🚀 **Augmented & Secure** — 3 new packs (animated, backup, seo), P0 security remediation, 143/143 tests |
 
 See [CHANGELOG.md](CHANGELOG.md) for full details.

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "BMAD+ — Augmented AI-Driven Development Framework with multi-role agents, autopilot, and parallel execution",
   "keywords": [
     "bmad",

package/readme-international/README.de.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Erweitertes Multi-Agent KI-Framework
 
-[![Version](https://img.shields.io/badge/version-0.8.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -214,7 +214,7 @@ graph TB
         MK["Maker 🧬"]
         ZC["Zecher 🧠 Memory"]
         SD["Shield 🛡️ GRC 38 agents"]
-        DS["Dev Studio 🏗️ SDLC 56+ agents"]
+        DS["Dev Studio 🏗️ SDLC 6 agents"]
         SEO["SEO Engine 🔎 3 agents"]
         BK["Backup 🗂️"]
         AN["Animated 🎬"]
@@ -542,8 +542,16 @@ BMAD+/
 | Version | Datum | Beschreibung |
 |---------|------|-------------|
 | **0.1.0** | 2026-03-17 | 🎉 Foundation — 6 Agenten (Atlas, Forge, Sentinel, Nexus, Shadow, Maker), 3 Skills, Pack-System, Monitoring, IDE Support |
+| **0.2.0** | 2026-03-18 | 🔀 Oveanet Fusion — 3 neue Hilfspakete: SEO Audit 360, Universal Backup, Animated Website |
+| **0.3.0** | 2026-03-19 | 🚀 SEO Engine v2.0 — 3 Multi-Rolle-Agenten, 4 Python-Skripte, 6-Phasen-Workflow, PageSpeed-Schleife, GEO-Analyse |
+| **0.4.0** | 2026-03-19 | 🏢 SEO Engine v2.1 — SKILL.md-Orchestrator, Google APIs, HTML-Berichte, Wettbewerbsvergleich, 50 Tests, GSC + GA4-Erweiterungen |
+| **0.4.1** | 2026-03-19 | 🌐 10-Sprachen CLI, CI/CD-Pipeline, `.npmignore`, Sicherheitshärtung |
+| **0.4.2** | 2026-03-19 | 📦 Öffentliche Packs — SEO/Backup/Animated in npm |
+| **0.4.3** | 2026-05-17 | 🔧 update + doctor Befehle, i18n komplett, Credits-Korrektur |
+| **0.4.4** | 2026-05-17 | 🔧 UTF-8-Kodierungsfix, vollständige i18n 10 Sprachen, 62 Unit-Tests |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 GRC-Compliance-Agenten |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 spezialisierte Agenten + 30 SDLC-Workflows |
+| **0.9.0** | 2026-06-24 | 🚀 **Erweitert & Sicher** — 3 neue Packs (animated, backup, seo), P0 Sicherheitsbehebung, 143/143 Tests |
 | **0.8.0** | 2026-06-24 | 🚀 **Erweitert & Sicher** — 3 neue Packs (animated, backup, seo), P0 Sicherheitsbehebung, 143/143 Tests |
 
 Siehe [CHANGELOG.md](../CHANGELOG.md) für vollständige Details.

package/readme-international/README.es.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Framework Multi-Agente IA Aumentado
 
-[![Version](https://img.shields.io/badge/version-0.8.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -214,7 +214,7 @@ graph TB
         MK["Maker 🧬"]
         ZC["Zecher 🧠 Memory"]
         SD["Shield 🛡️ GRC 38 agents"]
-        DS["Dev Studio 🏗️ SDLC 56+ agents"]
+        DS["Dev Studio 🏗️ SDLC 6 agents"]
         SEO["SEO Engine 🔎 3 agents"]
         BK["Backup 🗂️"]
         AN["Animated 🎬"]
@@ -395,7 +395,7 @@ Cada agente puede **automáticamente** cambiar de rol según el contexto:
 |--------|-----------|---------|
 | 🔤 **Patrón** | Palabras clave en el pedido | "revisa" → QA activado |
 | 🌐 **Contexto** | Detecta el tipo de tarea | Cálculos financieros detectados → QA auto-activado tras escribir código |
-| 🧠 **Razonamiento** | Cadena lógica | Inconsistencia de arquitectura → Architec auto-activado |
+| 🧠 **Razonamiento** | Cadena lógica | Inconsistencia de arquitectura → Architect auto-activado |
 
 El agente **anuncia** el cambio: *"💡 I'm switching to QA mode — financial calculations detected. Say 'skip' to stay in current mode."*
 
@@ -501,7 +501,7 @@ BMAD+/
 │       ├── skills/
 │       │   ├── bmad-plus-autopilot/ ← Orquestación completa
 │       │   ├── bmad-plus-parallel/  ← Supervisión concurrente
-│       │   └── bmad-plus-sync/      ← Sicronización automatizada código
+│       │   └── bmad-plus-sync/      ← Sincronización automatizada código
 │       └── data/
 │           └── role-triggers.yaml ← Lógica de variables y keywords
 │
@@ -534,7 +534,7 @@ BMAD+/
 
 | Variable | Descripción | Valores Disponibles |
 |----------|-------------|---------|
-| `project_name` | Nombre el proyecto | Autodetectado |
+| `project_name` | Nombre del proyecto | Autodetectado |
 | `user_skill_level` | Nivel del equipo/persona | beginner, intermediate, expert |
 | `execution_mode` | Modo de uso general | manual, autopilot, hybrid |
 | `auto_role_activation` | Cambio al predecir contexto | true, false |
@@ -557,8 +557,16 @@ BMAD+/
 | Versión | Fecha | Descripción |
 |---------|------|-------------|
 | **0.1.0** | 2026-03-17 | 🎉 Fundación base de proyecto (6 agentes / 3 entornos de skills / Auto-detección IDEs locales). Se incorporó el Maker y paquete OSINT |
+| **0.2.0** | 2026-03-18 | 🔀 Fusión Oveanet — 3 nuevos packs utilitarios: SEO Audit 360, Universal Backup, Animated Website |
+| **0.3.0** | 2026-03-19 | 🚀 SEO Engine v2.0 — 3 agentes multirrol, 4 scripts Python, flujo 6 fases, bucle PageSpeed, análisis GEO |
+| **0.4.0** | 2026-03-19 | 🏢 SEO Engine v2.1 — Orquestador SKILL.md, APIs Google, informes HTML, benchmark competitivo, 50 tests, extensiones GSC + GA4 |
+| **0.4.1** | 2026-03-19 | 🌐 CLI 10 idiomas, pipeline CI/CD, `.npmignore`, endurecimiento de seguridad |
+| **0.4.2** | 2026-03-19 | 📦 Packs públicos — SEO/Backup/Animated en npm |
+| **0.4.3** | 2026-05-17 | 🔧 Comandos update + doctor, i18n completa, corrección de créditos |
+| **0.4.4** | 2026-05-17 | 🔧 Corrección codificación UTF-8, i18n completa 10 idiomas, 62 tests unitarios |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 agentes de cumplimiento GRC |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 agentes specialized SDLC + 30 workflows SDLC |
+| **0.9.0** | 2026-06-24 | 🚀 **Aumentado & Seguro** — 3 nuevos packs (animated, backup, seo), corrección P0 seguridad, 143/143 tests |
 | **0.8.0** | 2026-06-24 | 🚀 **Aumentado & Seguro** — 3 nuevos packs (animated, backup, seo), corrección P0 seguridad, 143/143 tests |
 
 Más descripciones a fondo en el archivo: [CHANGELOG.md](../CHANGELOG.md).
@@ -571,8 +579,23 @@ Proyecto BMAD+ (Adaptación: MIT)
 
 Basado nativamente en el repositorio: [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) (MIT LIC)
 
-### Reconocimientos especiales
+### Reconocimientos
 
-- **BMAD-METHOD Core** por [bmad-code-org](https://github.com/bmad-code-org) — Framework base
-- **OSINT Pipeline Tool** Adaptación de [smixs/osint-skill](https://github.com/smixs/osint-skill) (MIT LIC)
-- **Apify Actor Runner Base** integrado desde el original de [apify/agent-skills](https://github.com/apify/agent-skills) (MIT LIC)
+**Creador**
+- **BMAD+** Creado por [Laurent Rochetta](https://github.com/lrochetta) ([LinkedIn](https://www.linkedin.com/in/laurentrochetta/))
+
+**Packs Originales** (creados por Laurent Rochetta)
+- **Dev Studio** — 6 agentes SDLC especializados: Miriam (analista de negocios), Huldah (redactora técnica), Yosef (gerente de producto), Rachel (diseñadora UX), Bezalel (arquitecto de sistemas), Oholiab (ingeniero senior) — 44 workflows que cubren todo el ciclo de vida desde la lluvia de ideas hasta el despliegue
+- **SEO Engine** — 3 agentes (Scout, Chief, Judge), pipeline de auditoría de 6 fases, bucle PageSpeed, integraciones con Google Search Console y GA4
+- **Memory Pack** — Agente Zecher para cerebro persistente cross-session con escáner de proyectos
+
+**Fuentes Externas e Inspiraciones**
+- **BMAD-METHOD** por [bmad-code-org](https://github.com/bmad-code-org/BMAD-METHOD) — Metodología multi-agente original (MIT)
+- **Shield GRC** — 38 agentes de cumplimiento basados en textos regulatorios públicos (GDPR, ISO 27001, SOC 2, HIPAA, EU AI Act, DORA, NIST, CMMC, etc.)
+- **OSINT Pipeline** basado en [smixs/osint-skill](https://github.com/smixs/osint-skill) (MIT)
+- **Apify Actor Runner** integrado desde [apify/agent-skills](https://github.com/apify/agent-skills) (MIT)
+- **Karpathy Guardrails** adaptado de [Andrej Karpathy](https://github.com/multica-ai/andrej-karpathy-skills) (MIT) — Reglas de comportamiento para Memory Pack
+
+**Herramientas e Infraestructura**
+- [Evolution API](https://github.com/EvolutionAPI/evolution-api) — Notificaciones WhatsApp para monitoreo upstream
+- [Gemini API](https://ai.google.dev/) — Análisis IA para clasificación de cambios upstream

package/readme-international/README.fr.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Framework Multi-Agent IA Augmenté
 
-[![Version](https://img.shields.io/badge/version-0.8.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -32,7 +32,7 @@
 
 ## 💡 Pourquoi BMAD+ ?
 
-BMAD-METHOD est un framework excellent avec 9 agents spécialisés. Mais pour un développeur solo ou une petite équipe, 9 agents c'est trop fragmenté. BMAD+ résout ce problème :
+BMAD-METHOD est un excellent framework avec 9 agents spécialisés. Mais pour un développeur solo ou une petite équipe, 9 agents c'est trop fragmenté. BMAD+ résout ce problème :
 
 | BMAD-METHOD | BMAD+ |
 |---|---|
@@ -214,7 +214,7 @@ graph TB
         MK["Maker 🧬"]
         ZC["Zecher 🧠 Memory"]
         SD["Shield 🛡️ GRC 38 agents"]
-        DS["Dev Studio 🏗️ SDLC 56+ agents"]
+        DS["Dev Studio 🏗️ SDLC 6 agents"]
         SEO["SEO Engine 🔎 3 agents"]
         BK["Backup 🗂️"]
         AN["Animated 🎬"]
@@ -371,7 +371,7 @@ npx bmad-plus install
 | 🔍 **OSINT** | Shadow | Investigation, scraping social, psychoprofil (55+ acteurs Apify) | ✅ Stable |
 | 🧬 **Maker** | Maker | Concevoir, construire, valider et packager de nouveaux agents BMAD+ | ✅ Stable |
 | 🛡️ **Shield** | 38 agents de conformité | GRC sur 25+ frameworks : GDPR, ISO 27001, SOC 2, HIPAA, PCI DSS, EU AI Act, DORA, NIS2 | ✅ Stable |
-| 🏗️ **Dev Studio** | 56+ agents specialized SDLC | SDLC complet : brainstorm → PRD → architecture → TDD → review (30 workflows) | ✅ Stable |
+| 🏗️ **Dev Studio** | 6 agents spécialisés SDLC | SDLC complet : brainstorm → PRD → architecture → TDD → review (30 workflows) | ✅ Stable |
 | 🔍 **SEO** | Scout, Chief, Judge | Audit SEO 6 phases, boucle PageSpeed, APIs Google, benchmark concurrentiel | ✅ Stable |
 | 🗂️ **Backup** | Backup Agent | ZIP horodaté avec exclusions intelligentes | ✅ Stable |
 | 🎬 **Animated** | Animated Website Agent | Site web luxe scroll-driven à partir de vidéo | ✅ Stable |
@@ -557,8 +557,16 @@ BMAD+/
 | Version | Date | Description |
 |---------|------|-------------|
 | **0.1.0** | 2026-03-17 | 🎉 Foundation — 56+ agents (Atlas, Forge, Sentinel, Nexus, Shadow, Maker), 3 skills, pack system, monitoring, multi-IDE support |
+| **0.2.0** | 2026-03-18 | 🔀 Fusion Oveanet — 3 nouveaux packs utilitaires : SEO Audit 360, Universal Backup, Animated Website |
+| **0.3.0** | 2026-03-19 | 🚀 SEO Engine v2.0 — 3 agents multi-rôles, 4 scripts Python, workflow 6 phases, boucle PageSpeed, analyse GEO |
+| **0.4.0** | 2026-03-19 | 🏢 SEO Engine v2.1 — Orchestrateur SKILL.md, APIs Google, rapports HTML, benchmark concurrentiel, 50 tests, extensions GSC + GA4 |
+| **0.4.1** | 2026-03-19 | 🌐 CLI 10 langues, pipeline CI/CD, `.npmignore`, durcissement sécurité |
+| **0.4.2** | 2026-03-19 | 📦 Packs publics — SEO/Backup/Animated dans npm |
+| **0.4.3** | 2026-05-17 | 🔧 Commandes update + doctor, i18n complète, correction crédits |
+| **0.4.4** | 2026-05-17 | 🔧 Correction encodage UTF-8, i18n complète 10 langues, 62 tests unitaires |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 agents de conformité GRC |
-| **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 56+ agents specialized SDLC + 30 workflows SDLC |
+| **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 agents spécialisés SDLC + 30 workflows SDLC |
+| **0.9.0** | 2026-06-24 | 🚀 **Augmenté & Sécurisé** — 3 nouveaux packs (animated, backup, seo), correction P0 sécurité, 143/143 tests |
 | **0.8.0** | 2026-06-24 | 🚀 **Augmenté & Sécurisé** — 3 nouveaux packs (animated, backup, seo), correction P0 sécurité, 143/143 tests |
 
 Voir [CHANGELOG.md](../CHANGELOG.md) pour le détail complet.
@@ -571,6 +579,21 @@ MIT — Basé sur [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) (M
 
 ### Crédits
 
-- **BMAD-METHOD** by [bmad-code-org](https://github.com/bmad-code-org) — Framework de base
+**Créateur**
+- **BMAD+** Créé par [Laurent Rochetta](https://github.com/lrochetta) ([LinkedIn](https://www.linkedin.com/in/laurentrochetta/))
+
+**Packs Originaux** (créés par Laurent Rochetta)
+- **Dev Studio** — 6 agents SDLC spécialisés : Miriam (analyste d'affaires), Huldah (rédactrice technique), Yosef (chef de produit), Rachel (designer UX), Bezalel (architecte système), Oholiab (ingénieur senior) — 44 workflows couvrant l'ensemble du cycle de vie du brainstorming au déploiement
+- **SEO Engine** — 3 agents (Scout, Chief, Judge), pipeline d'audit 6 phases, boucle PageSpeed, intégrations Google Search Console et GA4
+- **Memory Pack** — Agent Zecher pour cerveau persistant cross-session avec scanner de projets
+
+**Sources Externes et Inspirations**
+- **BMAD-METHOD** par [bmad-code-org](https://github.com/bmad-code-org/BMAD-METHOD) — Méthodologie multi-agents originale (MIT)
+- **Shield GRC** — 38 agents de conformité basés sur des textes réglementaires publics (RGPD, ISO 27001, SOC 2, HIPAA, EU AI Act, DORA, NIST, CMMC, etc.)
 - **OSINT Pipeline** basé sur [smixs/osint-skill](https://github.com/smixs/osint-skill) (MIT)
 - **Apify Actor Runner** intégré de [apify/agent-skills](https://github.com/apify/agent-skills) (MIT)
+- **Karpathy Guardrails** adapté de [Andrej Karpathy](https://github.com/multica-ai/andrej-karpathy-skills) (MIT) — Règles comportementales pour Memory Pack
+
+**Outils et Infrastructure**
+- [Evolution API](https://github.com/EvolutionAPI/evolution-api) — Notifications WhatsApp pour la surveillance upstream
+- [Gemini API](https://ai.google.dev/) — Analyse IA pour la classification des changements upstream

package/src/bmad-plus/packs/pack-seo/bmad-skill-manifest.yaml

@@ -0,0 +1,13 @@
+type: pack
+name: bmad-plus-pack-seo
+displayName: SEO / GEO Audit Pack
+title: SEO & GEO Audit 360
+icon: "🔍"
+capabilities: "SEO audit, GEO audit, search engine optimization, pagespeed analysis, keyword research, content analysis, technical SEO, backlink analysis, competitor analysis, SERP analysis, local SEO, mobile optimization, structured data, XML sitemaps, robots.txt audit, core web vitals, accessibility audit, international SEO, ecommerce SEO, voice search optimization, AI search optimization"
+role: "SEO/GEO specialist providing comprehensive 360-degree search optimization audits and recommendations"
+identity: "Expert SEO and GEO (Generative Engine Optimization) auditor who combines technical depth with strategic insight. Analyzes websites across 100+ SEO factors and provides actionable, prioritized recommendations."
+communicationStyle: "Data-driven and precise. Presents findings with clear metrics and concrete action items. Explains technical concepts in accessible terms for stakeholders. Balances quick wins with strategic long-term recommendations."
+principles: "Audit every page through real device and search engine eyes. Prioritize fixes by impact and effort. All recommendations must be actionable and measurable. Track improvements with before/after metrics. Optimize for humans first, search engines second."
+module: bmad-plus
+canonicalId: bmad-plus-pack-seo
+pack: seo

package/src/bmad-plus/packs/pack-shield/SKILL.md

@@ -0,0 +1,82 @@
+# Shield GRC Pack — SKILL
+
+> **Pack:** Shield (GRC Audit)
+> **Version:** 1.0.0
+> **Created by:** Laurent Rochetta — https://github.com/lrochetta/BMAD-PLUS
+
+## Overview
+
+Shield transforms BMAD+ into a comprehensive GRC (Governance, Risk & Compliance) assistant. It serves as an intelligent orchestrator for 38 compliance agents across 7 categories, covering 25+ regulatory frameworks. Route requests to the appropriate specialist agent, combine insights for cross-framework analysis, and provide consolidated compliance reports.
+
+## Capabilities
+
+### Data Privacy (5 frameworks)
+- **GDPR** (EU/EEA/UK) — General Data Protection Regulation
+- **CCPA/CPRA** (California) — Consumer Privacy Act
+- **LGPD** (Brazil) — Lei Geral de Protecao de Dados
+- **DPDPA** (India) — Digital Personal Data Protection Act
+- **ISO 27701** (International) — Privacy Information Management
+
+### Cybersecurity (6 frameworks)
+- **ISO 27001** — Information Security Management
+- **NIST CSF 2.0** — Cybersecurity Framework
+- **NIST 800-53 Rev. 5** — Federal Security Controls
+- **CIS Controls v8** — Critical Security Controls
+- **NIS2 Directive** — EU Cybersecurity
+- **ISM** — Australian Information Security Manual
+
+### Industry Compliance (6 frameworks)
+- **SOC 2 Type I/II** — Service Organization Controls
+- **PCI DSS v4.0** — Payment Card Industry
+- **HIPAA** — Healthcare Privacy & Security
+- **SWIFT CSP** — Banking Security
+- **DORA** — EU Digital Operational Resilience
+- **FedRAMP** — Federal Cloud Authorization
+
+### Defense & Export Control (4 frameworks)
+- **CMMC 2.0** — Cybersecurity Maturity Model Certification
+- **ITAR** — International Traffic in Arms
+- **EAR** — Export Administration Regulations
+- **TSA** — Transportation Security Directives
+
+### AI Governance (3 frameworks)
+- **EU AI Act 2024/1689** — AI Regulation
+- **ISO 42001:2023** — AI Management System
+- **NIST AI RMF 1.0** — AI Risk Management
+
+### Accessibility & ESG (3 frameworks)
+- **WCAG 2.2** — Web Content Accessibility
+- **Section 508** — US Federal Accessibility
+- **CSRD** — Corporate Sustainability Reporting
+
+### GDPR & AI Act Workflows (11 workflow agents)
+- DPIA, Breach Response, Legitimate Interest Assessment
+- Privacy Notice/Policy/Cookie Generators
+- AI Act Classifier, Roles, FRIA, Incident Reporting
+
+## Activation
+
+To use Shield, include this pack in your BMAD+ installation:
+
+```bash
+npx bmad-plus install --pack shield
+```
+
+Then invoke the orchestrator from any conversation:
+
+> "Shield, audit my app for GDPR compliance"
+> "Shield, gap analysis ISO 27001 vs NIST CSF"
+> "Shield, generate SOC 2 evidence checklist"
+
+## Architecture
+
+- `shield-orchestrator.md` — Intelligent routing entry point
+- `categories/` — Framework-specific agent prompts
+- `references/` — 85 regulatory reference files
+- `shared/` — Cross-framework mapper, gap analysis & audit templates
+
+## Attribution
+
+Based on Claude Skills for GRC by Hemant Naik — MIT License.
+GDPR and EU AI Act workflow agents enriched with insights from Lawve.ai.
+Adapted for BMAD+ by Laurent Rochetta.

package/tools/bmad-plus-npx.js

@@ -5,7 +5,7 @@
  * Ensures proper execution when run via npx from npm registry
  */
 
-const { execSync } = require('node:child_process');
+const { spawnSync } = require('node:child_process');
 const path = require('node:path');
 const fs = require('node:fs');
 
@@ -21,10 +21,8 @@ if (isNpxExecution) {
   }
 
   try {
-    execSync(`node "${cliPath}" ${args.join(' ')}`, {
-      stdio: 'inherit',
-      cwd: process.cwd(),
-    });
+    const result = spawnSync('node', [cliPath, ...args], { stdio: 'inherit' });
+    if (result.status !== 0) process.exit(result.status);
   } catch (error) {
     process.exit(error.status || 1);
   }

package/tools/cli/commands/autoconfig.js

@@ -53,7 +53,9 @@ function detectStack(dir) {
       else if (fs.existsSync(path.join(dir, 'yarn.lock'))) result.packageManager = 'yarn';
       else if (fs.existsSync(path.join(dir, 'bun.lockb'))) result.packageManager = 'bun';
       else result.packageManager = 'npm';
-    } catch {}
+    } catch (e) {
+        console.warn('autoconfig: Failed to parse package.json in detectStack', e.message);
+      }
   }
 
   // Other languages
@@ -115,7 +117,9 @@ function analyzeStructure(dir) {
 
     // Check for .git directory
     if (fs.existsSync(path.join(dir, '.git'))) structure.hasGit = true;
-  } catch {}
+  } catch (e) {
+    console.warn('autoconfig: Failed to analyze directory structure', e.message);
+  }
 
   return structure;
 }
@@ -203,7 +207,9 @@ function getProjectName(dir) {
       const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
       if (pkg.name) return pkg.name;
     }
-  } catch {}
+  } catch (e) {
+    console.warn('autoconfig: Failed to read package.json in getProjectName', e.message);
+  }
   return path.basename(dir);
 }
 
@@ -250,7 +256,7 @@ module.exports = {
 
     // Check if directory has content
     let entries = [];
-    try { entries = fs.readdirSync(projectDir).filter(e => !e.startsWith('.')); } catch {}
+    try { entries = fs.readdirSync(projectDir).filter(e => !e.startsWith('.')); } catch (e) { console.warn('autoconfig: Failed to list directory', e.message); }
 
     const isExistingProject = entries.length > 0;
 
@@ -343,7 +349,8 @@ module.exports = {
           tools: toolsArg,
         });
       } catch (e) {
-        // Install may have its own output, that's fine
+        clack.log.error(`Autoconfig install failed: ${e.message}`);
+        throw e;
       }
 
       spinner2.stop('Installation complete');
@@ -442,7 +449,10 @@ module.exports = {
           packs: packs.join(','),
           yes: true,
         });
-      } catch {}
+      } catch (e) {
+        clack.log.error(`Autoconfig install failed: ${e.message}`);
+        throw e;
+      }
 
       // Write initial context
       const contextPath = path.join(projectDir, '.agents', 'memory', 'context.md');

package/tools/cli/commands/doctor.js

@@ -10,6 +10,7 @@ const fs = require('node:fs');
 const clack = require('@clack/prompts');
 const pc = require('picocolors');
 const { t } = require('../i18n');
+const { PACKS, EXPECTED_AGENTS } = require('../lib/packs');
 
 module.exports = {
   command: 'doctor',
@@ -62,19 +63,13 @@ module.exports = {
       clack.log.success(`✅ ${agentDirs.length} agent/skill directories found`);
       passed++;
 
-      // Check each expected agent from manifest packs
-      const expectedAgents = {
-        core: ['agent-strategist', 'agent-architect-dev', 'agent-quality', 'agent-orchestrator'],
-        osint: ['agent-shadow'],
-        maker: ['agent-maker'],
-        seo: ['pack-seo'],
-        backup: ['pack-backup'],
-        animated: ['pack-animated'],
-      };
-
+      // Check each expected agent from manifest packs using shared EXPECTED_AGENTS module
       for (const pack of (manifest.packs || ['core'])) {
-        const expected = expectedAgents[pack] || [];
-        for (const agent of expected) {
+        const entry = EXPECTED_AGENTS[pack];
+        if (!entry) continue;
+
+        // Check individual agent directories
+        for (const agent of (entry.agents || [])) {
           checks++;
           const agentPath = path.join(agentsDir, agent);
           if (fs.existsSync(agentPath)) {
@@ -84,6 +79,18 @@ module.exports = {
             warnings++;
           }
         }
+
+        // Check pack directory if applicable
+        if (entry.packDir) {
+          checks++;
+          const packPath = path.join(agentsDir, entry.packDir);
+          if (fs.existsSync(packPath)) {
+            passed++;
+          } else {
+            clack.log.warn(`⚠️  Missing pack directory: ${entry.packDir} (pack: ${pack})`);
+            warnings++;
+          }
+        }
       }
     } else {
       clack.log.error('❌ No .agents/skills/ directory found');
@@ -153,37 +160,27 @@ module.exports = {
     checks++;
     try {
       const yaml = require('js-yaml');
-      const installModule = require('./install');
-      const installSrc = fs.readFileSync(path.join(__dirname, 'install.js'), 'utf8');
-      const packsMatch = installSrc.match(/const PACKS\s*=\s*\{/);
-
       const moduleYamlSrc = path.join(__dirname, '..', '..', '..', 'src', 'bmad-plus', 'module.yaml');
-      if (packsMatch && fs.existsSync(moduleYamlSrc)) {
+      if (fs.existsSync(moduleYamlSrc)) {
         const moduleContent = yaml.load(fs.readFileSync(moduleYamlSrc, 'utf8'));
         const modulePackIds = Object.keys(moduleContent.packs || {});
 
-        // Extract PACKS keys from install.js via require
-        // The PACKS keys are the pack IDs available in the CLI menu
-        // We compare against module.yaml packs
-        const installContent = fs.readFileSync(path.join(__dirname, 'install.js'), 'utf8');
-        const packKeyMatches = installContent.match(/^\s+'?([a-z][-a-z]*)'?\s*:\s*\{/gm);
-        const installPackIds = packKeyMatches
-          ? packKeyMatches.map(m => m.trim().replace(/[':{ ]/g, '').replace(/-/g, '-'))
-          : [];
+        // Use shared PACKS module instead of fragile regex on install.js source
+        const cliPackIds = Object.keys(PACKS);
 
         // Find mismatches
-        const missingInInstall = modulePackIds.filter(p => !installPackIds.includes(p));
-        const missingInModule = installPackIds.filter(p => !modulePackIds.includes(p));
+        const missingInCLI = modulePackIds.filter(p => !cliPackIds.includes(p));
+        const missingInModule = cliPackIds.filter(p => !modulePackIds.includes(p));
 
-        if (missingInInstall.length === 0 && missingInModule.length === 0) {
+        if (missingInCLI.length === 0 && missingInModule.length === 0) {
           clack.log.success(`✅ PACKS ↔ module.yaml in sync (${modulePackIds.length} packs)`);
           passed++;
         } else {
-          if (missingInInstall.length > 0) {
-            clack.log.warn(`⚠️  Packs in module.yaml but missing from install.js PACKS: ${missingInInstall.join(', ')}`);
+          if (missingInCLI.length > 0) {
+            clack.log.warn(`⚠️  Packs in module.yaml but missing from CLI PACKS: ${missingInCLI.join(', ')}`);
           }
           if (missingInModule.length > 0) {
-            clack.log.warn(`⚠️  Packs in install.js PACKS but missing from module.yaml: ${missingInModule.join(', ')}`);
+            clack.log.warn(`⚠️  Packs in CLI PACKS but missing from module.yaml: ${missingInModule.join(', ')}`);
           }
           warnings++;
         }