bmad-plus 0.9.0 → 0.9.2

package/tools/cli/lib/ide-config.js

@@ -0,0 +1,259 @@
+/**
+ * BMAD+ IDE Configuration Generator
+ * Extracted from install.js for modularity.
+ * Generates CLAUDE.md, GEMINI.md, AGENTS.md content with pack-aware agent filtering.
+ *
+ * Author: Laurent Rochetta
+ */
+
+// ── IDE Configurations ──
+
+const IDE_CONFIGS = {
+  'claude-code': {
+    name: 'Claude Code',
+    detect: ['.claude'],
+    configFile: 'CLAUDE.md',
+  },
+  'gemini-cli': {
+    name: 'Gemini CLI',
+    detect: ['.gemini'],
+    configFile: 'GEMINI.md',
+  },
+  'codex-cli': {
+    name: 'Codex CLI / OpenCode',
+    detect: ['.codex', '.opencode'],
+    configFile: 'AGENTS.md',
+  },
+  'antigravity': {
+    name: 'Antigravity',
+    detect: ['.gemini/antigravity'],
+    configFile: 'GEMINI.md',
+  },
+};
+
+// All 14 BMAD+ agents — always included in templates
+const AGENT_LIST = [
+  '- **Atlas** (Strategist) — Business analysis + Product management',
+  '- **Forge** (Architect-Dev) — Architecture + Development + Documentation',
+  '- **Sentinel** (Quality) — QA + UX review',
+  '- **Nexus** (Orchestrator) — Sprint management + Autopilot + Parallel execution',
+  '- **Shadow** (OSINT) — Investigation + Scraping + Psychoprofiling',
+  '- **Shield** (GRC) — 38 compliance agents (GDPR, ISO 27001, SOC 2, HIPAA, EU AI Act, DORA, NIS2...)',
+  '- **Miriam** (מרים) — Business Analyst — Strategic analysis, research, product briefs',
+  '- **Huldah** (חולדה) — Technical Writer — Documentation, diagrams, editorial review',
+  '- **Yosef** (יוסף) — Product Manager — PRD, requirements, feature prioritization',
+  '- **Rachel** (רחל) — UX Designer — User experience, wireframes, empathy mapping',
+  '- **Bezalel** (בצלאל) — System Architect — Architecture, ADRs, epics & stories',
+  '- **Oholiab** (אהליאב) — Senior Engineer — TDD, sprint, code review, implementation',
+  '- **Zecher** (זכר) — Memory Archivist — Consolidation, project scanning, context recall',
+  '- **Maker** (Creator) — Custom agent builder — Create new agents from description',
+];
+
+/**
+ * Filter agents based on installed packs.
+ * Core agents are always included; others depend on pack selection.
+ *
+ * @param {string[]} packs - List of installed pack IDs
+ * @returns {string[]} Agent description lines
+ */
+function getAgentsByPacks(packs) {
+  const agents = [
+    '- **Atlas** (Strategist) — Business analysis + Product management',
+    '- **Forge** (Architect-Dev) — Architecture + Development + Documentation',
+    '- **Sentinel** (Quality) — QA + UX review',
+    '- **Nexus** (Orchestrator) — Sprint management + Autopilot + Parallel execution',
+  ];
+
+  if (packs.includes('osint')) {
+    agents.push('- **Shadow** (OSINT) — Investigation + Scraping + Psychoprofiling');
+  }
+
+  if (packs.includes('shield')) {
+    agents.push('- **Shield** (GRC) — 38 compliance agents (GDPR, ISO 27001, SOC 2, HIPAA, EU AI Act, DORA, NIS2...)');
+  }
+
+  if (packs.includes('maker')) {
+    agents.push('- **Maker** (Creator) — Custom agent builder — Create new agents from description');
+  }
+
+  if (packs.includes('dev-studio')) {
+    agents.push('- **Miriam** (מרים) — Business Analyst — Strategic analysis, research, product briefs');
+    agents.push('- **Huldah** (חולדה) — Technical Writer — Documentation, diagrams, editorial review');
+    agents.push('- **Yosef** (יוסף) — Product Manager — PRD, requirements, feature prioritization');
+    agents.push('- **Rachel** (רחל) — UX Designer — User experience, wireframes, empathy mapping');
+    agents.push('- **Bezalel** (בצלאל) — System Architecture — Architecture, ADRs, epics & stories');
+    agents.push('- **Oholiab** (אהליאב) — Senior Engineer — TDD, sprint, code review, implementation');
+  }
+
+  if (packs.includes('memory')) {
+    agents.push('- **Zecher** (זכר) — Memory Archivist — Consolidation, project scanning, context recall');
+  }
+
+  return agents;
+}
+
+/**
+ * Build the Memory Protocol section if the memory pack is installed.
+ *
+ * @param {string[]} packs - List of installed pack IDs
+ * @returns {string} Memory section markdown (empty string if no memory pack)
+ */
+function getMemorySection(packs) {
+  if (!packs.includes('memory')) return '';
+  return [
+    '',
+    '## Memory Protocol (Karpathy Guardrails)',
+    '',
+    'Agents MUST follow these behavioral principles:',
+    '',
+    '### G1 — Think Before Coding',
+    '- State assumptions explicitly. If uncertain, ask.',
+    '- Check `.agents/memory/decisions.md` for prior decisions before re-deciding.',
+    '',
+    '### G2 — Simplicity First',
+    '- Minimum code that solves the problem. Nothing speculative.',
+    '- Check `.agents/memory/patterns.md` for existing solutions.',
+    '',
+    '### G3 — Surgical Changes',
+    '- Touch only what you must. Match existing style.',
+    '- Log surprises in `.agents/memory/lessons.md`.',
+    '',
+    '### G4 — Goal-Driven Execution',
+    '- Define success criteria before implementing.',
+    '- Log non-obvious decisions in `.agents/memory/decisions.md`.',
+    '',
+    '### Memory Files',
+    '- `.agents/memory/decisions.md` — Read at session start, write when making decisions',
+    '- `.agents/memory/lessons.md` — Write when something unexpected happens',
+    '- `.agents/memory/patterns.md` — Write when a reusable pattern is validated',
+    '- `.agents/memory/context.md` — Update at session end with project state',
+  ].join('\n');
+}
+
+/**
+ * Generate IDE config content with pack-aware agent filtering.
+ *
+ * @param {string} userName - The user's display name
+ * @param {string} language - User-facing communication language
+ * @param {string[]} packs - List of installed pack IDs
+ * @returns {string} Complete Markdown template
+ */
+function generateIDEConfig(userName, language, packs) {
+  const agents = getAgentsByPacks(packs);
+  const memorySection = getMemorySection(packs);
+
+  return `# BMAD+ — AI Agent Configuration
+
+## Project Context
+This project uses BMAD+, an augmented AI-driven development framework.
+Based on BMAD-METHOD v6.6.0 with multi-role agents, autopilot mode, and parallel execution.
+
+## Agents
+To activate an agent, say its name or persona:
+${agents.join('\n')}
+
+## Skills
+- Load skills from \`.agents/skills/\`
+- Each agent has a SKILL.md with capabilities, activation protocol, and role-switching rules
+- Auto-activation triggers: \`.agents/data/role-triggers.yaml\`
+
+## Key Commands
+- \`bmad-help\` — Show all available agents and skills
+- \`autopilot\` — Launch Nexus in full pipeline mode
+- \`parallel\` — Enable parallel multi-agent execution
+
+## Communication
+- User name: ${userName}
+- Default language: ${language} for user-facing content, English for code and technical docs.
+${memorySection}`;
+}
+
+/**
+ * Generate a complete CLAUDE.md / GEMINI.md / AGENTS.md config file
+ * (all agents, no filtering — backward compatible)
+ *
+ * @param {string} userName - The user's display name
+ * @param {string} language - User-facing communication language
+ * @returns {string} Complete Markdown template
+ */
+function generateBaseConfig(userName, language) {
+  return `# BMAD+ — AI Agent Configuration
+
+## Project Context
+This project uses BMAD+, an augmented AI-driven development framework.
+Based on BMAD-METHOD v6.6.0 with multi-role agents, autopilot mode, and parallel execution.
+
+## Agents
+To activate an agent, say its name or persona:
+${AGENT_LIST.join('\n')}
+
+## Skills
+- Load skills from \`.agents/skills/\`
+- Each agent has a SKILL.md with capabilities, activation protocol, and role-switching rules
+- Auto-activation triggers: \`.agents/data/role-triggers.yaml\`
+
+## Key Commands
+- \`bmad-help\` — Show all available agents and skills
+- \`autopilot\` — Launch Nexus in full pipeline mode
+- \`parallel\` — Enable parallel multi-agent execution
+
+## Communication
+- User name: ${userName}
+- Default language: ${language} for user-facing content, English for code and technical docs.
+
+## Memory Protocol (Karpathy Guardrails)
+
+Agents MUST follow these behavioral principles:
+
+### G1 — Think Before Coding
+- State assumptions explicitly. If uncertain, ask.
+- Check \`.agents/memory/decisions.md\` for prior decisions before re-deciding.
+
+### G2 — Simplicity First
+- Minimum code that solves the problem. Nothing speculative.
+- Check \`.agents/memory/patterns.md\` for existing solutions.
+
+### G3 — Surgical Changes
+- Touch only what you must. Match existing style.
+- Log surprises in \`.agents/memory/lessons.md\`.
+
+### G4 — Goal-Driven Execution
+- Define success criteria before implementing.
+- Log non-obvious decisions in \`.agents/memory/decisions.md\`.
+
+### Memory Files
+- \`.agents/memory/decisions.md\` — Read at session start, write when making decisions
+- \`.agents/memory/lessons.md\` — Write when something unexpected happens
+- \`.agents/memory/patterns.md\` — Write when a reusable pattern is validated
+- \`.agents/memory/context.md\` — Update at session end with project state`;
+}
+
+module.exports = {
+  IDE_CONFIGS,
+  generateIDEConfig,
+  getAgentsByPacks,
+
+  /**
+   * Generate CLAUDE.md config for Claude Code
+   * @param {string} userName
+   * @param {string} language
+   * @returns {string}
+   */
+  generateClaudeMD: generateBaseConfig,
+
+  /**
+   * Generate GEMINI.md config for Gemini CLI / Antigravity
+   * @param {string} userName
+   * @param {string} language
+   * @returns {string}
+   */
+  generateGeminiMD: generateBaseConfig,
+
+  /**
+   * Generate AGENTS.md config for Codex CLI / OpenCode
+   * @param {string} userName
+   * @param {string} language
+   * @returns {string}
+   */
+  generateAgentsMD: generateBaseConfig,
+};

package/tools/cli/lib/memory-init.js

@@ -10,7 +10,6 @@ const fs = require('node:fs');
 const os = require('node:os');
 const fsExtra = require('fs-extra');
 const clack = require('@clack/prompts');
-const pc = require('picocolors');
 
 /**
  * Initialize the memory pack: create project memory files, detect or create global brain.

package/tools/cli/lib/pack-copy.js

@@ -1,84 +1,84 @@
-/**
- * BMAD+ Shared Pack-Copy Module
- * Extracted duplicate file-copy loops from install.js and update.js.
- *
- * Author: Laurent Rochetta
- */
-
-const path = require('node:path');
-const fs = require('node:fs');
-const fsExtra = require('fs-extra');
-
-/**
- * Copy files for a single pack definition into the target directories.
- *
- * @param {object} opts
- * @param {string} opts.bmadSrc      - Path to src/bmad-plus/
- * @param {string} opts.targetAgentsDir - Destination for agents / skills
- * @param {string} opts.targetDataDir   - Destination for data files
- * @param {string} opts.projectRoot    - Project root (for external package resolution)
- * @param {object} opts.pack           - Pack definition from PACKS
- * @returns {{ copiedAgents: number, copiedSkills: number, copiedFiles: number }}
- */
-function copyPackFiles({ bmadSrc, targetAgentsDir, targetDataDir, projectRoot, pack }) {
-  let copiedAgents = 0;
-  let copiedSkills = 0;
-  let copiedFiles = 0;
-
-  if (!pack) return { copiedAgents, copiedSkills, copiedFiles };
-
-  // Copy agents
-  for (const agent of (pack.agents || [])) {
-    const src = path.join(bmadSrc, 'agents', agent);
-    const dest = path.join(targetAgentsDir, agent);
-    if (fs.existsSync(src)) {
-      fsExtra.copySync(src, dest, { overwrite: true });
-      copiedAgents++;
-    }
-  }
-
-  // Copy skills
-  for (const skill of (pack.skills || [])) {
-    const src = path.join(bmadSrc, 'skills', skill);
-    const dest = path.join(targetAgentsDir, skill);
-    if (fs.existsSync(src)) {
-      fsExtra.copySync(src, dest, { overwrite: true });
-      copiedSkills++;
-    }
-  }
-
-  // Copy data files
-  for (const dataFile of (pack.data || [])) {
-    const src = path.join(bmadSrc, 'data', dataFile);
-    const dest = path.join(targetDataDir, dataFile);
-    if (fs.existsSync(src)) {
-      fsExtra.copySync(src, dest, { overwrite: true });
-      copiedFiles++;
-    }
-  }
-
-  // Copy external package (e.g. OSINT)
-  if (pack.externalPackage) {
-    const extSrc = path.join(projectRoot, pack.externalPackage, 'skills');
-    if (fs.existsSync(extSrc)) {
-      fsExtra.copySync(extSrc, targetAgentsDir, { overwrite: true });
-      copiedSkills++;
-    }
-  }
-
-  // Copy pack directory (SEO, Backup, Animated, Shield, etc.)
-  if (pack.packDir) {
-    const srcParent = pack.packSrcDir || 'agents';
-    const packSrc = path.join(bmadSrc, srcParent, pack.packDir);
-    const packDest = path.join(targetAgentsDir, pack.packDir);
-    if (fs.existsSync(packSrc)) {
-      fsExtra.copySync(packSrc, packDest, { overwrite: true });
-      copiedAgents++;
-      copiedFiles++;
-    }
-  }
-
-  return { copiedAgents, copiedSkills, copiedFiles };
-}
-
-module.exports = { copyPackFiles };
+/**
+ * BMAD+ Shared Pack-Copy Module
+ * Extracted duplicate file-copy loops from install.js and update.js.
+ *
+ * Author: Laurent Rochetta
+ */
+
+const path = require('node:path');
+const fs = require('node:fs');
+const fsExtra = require('fs-extra');
+
+/**
+ * Copy files for a single pack definition into the target directories.
+ *
+ * @param {object} opts
+ * @param {string} opts.bmadSrc      - Path to src/bmad-plus/
+ * @param {string} opts.targetAgentsDir - Destination for agents / skills
+ * @param {string} opts.targetDataDir   - Destination for data files
+ * @param {string} opts.projectRoot    - Project root (for external package resolution)
+ * @param {object} opts.pack           - Pack definition from PACKS
+ * @returns {{ copiedAgents: number, copiedSkills: number, copiedFiles: number }}
+ */
+function copyPackFiles({ bmadSrc, targetAgentsDir, targetDataDir, projectRoot, pack }) {
+  let copiedAgents = 0;
+  let copiedSkills = 0;
+  let copiedFiles = 0;
+
+  if (!pack) return { copiedAgents, copiedSkills, copiedFiles };
+
+  // Copy agents
+  for (const agent of (pack.agents || [])) {
+    const src = path.join(bmadSrc, 'agents', agent);
+    const dest = path.join(targetAgentsDir, agent);
+    if (fs.existsSync(src)) {
+      fsExtra.copySync(src, dest, { overwrite: true });
+      copiedAgents++;
+    }
+  }
+
+  // Copy skills
+  for (const skill of (pack.skills || [])) {
+    const src = path.join(bmadSrc, 'skills', skill);
+    const dest = path.join(targetAgentsDir, skill);
+    if (fs.existsSync(src)) {
+      fsExtra.copySync(src, dest, { overwrite: true });
+      copiedSkills++;
+    }
+  }
+
+  // Copy data files
+  for (const dataFile of (pack.data || [])) {
+    const src = path.join(bmadSrc, 'data', dataFile);
+    const dest = path.join(targetDataDir, dataFile);
+    if (fs.existsSync(src)) {
+      fsExtra.copySync(src, dest, { overwrite: true });
+      copiedFiles++;
+    }
+  }
+
+  // Copy external package (e.g. OSINT)
+  if (pack.externalPackage) {
+    const extSrc = path.join(projectRoot, pack.externalPackage, 'skills');
+    if (fs.existsSync(extSrc)) {
+      fsExtra.copySync(extSrc, targetAgentsDir, { overwrite: true });
+      copiedSkills++;
+    }
+  }
+
+  // Copy pack directory (SEO, Backup, Animated, Shield, etc.)
+  if (pack.packDir) {
+    const srcParent = pack.packSrcDir || 'agents';
+    const packSrc = path.join(bmadSrc, srcParent, pack.packDir);
+    const packDest = path.join(targetAgentsDir, pack.packDir);
+    if (fs.existsSync(packSrc)) {
+      fsExtra.copySync(packSrc, packDest, { overwrite: true });
+      copiedAgents++;
+      copiedFiles++;
+    }
+  }
+
+  return { copiedAgents, copiedSkills, copiedFiles };
+}
+
+module.exports = { copyPackFiles };

package/tools/cli/lib/packs.js

@@ -96,19 +96,27 @@ const PACKS = {
 const PACK_ORDER = ['core', 'osint', 'maker', 'shield', 'seo', 'memory', 'dev-studio', 'backup', 'animated'];
 
 /**
- * Maps each pack to the list of directory names expected under .agents/skills/
- * after installation. Each entry contains agent directory names AND/OR pack directory names.
+ * Maps each pack to what `bmad-plus doctor` should expect under .agents/skills/
+ * after installation.
+ *
+ * - `agents`    — loose agent DIRECTORIES copied straight into .agents/skills/
+ *                 (only core/osint/maker ship their agents this way).
+ * - `packDir`   — the pack DIRECTORY copied into .agents/skills/ (null when none).
+ * - `packAgents`— agent FILES that live INSIDE `packDir` (shield/seo/memory/
+ *                 dev-studio/backup/animated bundle their agents this way, so they
+ *                 must not be checked as loose directories — doing so produced
+ *                 false "Missing agent" warnings on every healthy install).
  */
 const EXPECTED_AGENTS = {
   core:       { agents: ['agent-strategist', 'agent-architect-dev', 'agent-quality', 'agent-orchestrator'], packDir: null },
   osint:      { agents: ['agent-shadow'],                                                                    packDir: null },
   maker:      { agents: ['agent-maker'],                                                                     packDir: null },
-  shield:     { agents: ['shield-orchestrator'],                                                             packDir: 'pack-shield' },
-  seo:        { agents: ['seo-scout', 'seo-chief', 'seo-judge'],                                             packDir: 'pack-seo' },
-  memory:     { agents: ['zecher'],                                                                          packDir: 'pack-memory' },
-  'dev-studio':  { agents: ['dev-studio-orchestrator'],                                                       packDir: 'pack-dev-studio' },
-  backup:     { agents: ['backup-agent'],                                                                    packDir: 'pack-backup' },
-  animated:   { agents: ['animated-website-agent'],                                                          packDir: 'pack-animated' },
+  shield:     { agents: [], packDir: 'pack-shield',     packAgents: ['shield-orchestrator.md'] },
+  seo:        { agents: [], packDir: 'pack-seo',        packAgents: ['seo-scout.md', 'seo-chief.md', 'seo-judge.md'] },
+  memory:     { agents: [], packDir: 'pack-memory',     packAgents: ['zecher-agent.md', 'memory-orchestrator.md'] },
+  'dev-studio': { agents: [], packDir: 'pack-dev-studio', packAgents: ['dev-studio-orchestrator.md'] },
+  backup:     { agents: [], packDir: 'pack-backup',     packAgents: ['backup-agent.md'] },
+  animated:   { agents: [], packDir: 'pack-animated',   packAgents: ['animated-website-agent.md'] },
 };
 
 module.exports = { PACKS, PACK_ORDER, EXPECTED_AGENTS };

package/tools/cli/lib/stack-detect.js

@@ -0,0 +1,102 @@
+/**
+ * BMAD+ Stack Detection — Shared Module
+ * Unified project stack detection for autoconfig and scan commands.
+ * Merges patterns from both original implementations.
+ */
+
+const path = require('node:path');
+const fs = require('node:fs');
+
+// ── Project Detection Markers (for scan.js) ──
+
+const PROJECT_MARKERS = [
+  { file: 'package.json', stack: 'Node.js', detect: (dir) => {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+      const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+      if (deps['next']) return 'Next.js';
+      if (deps['nuxt']) return 'Nuxt';
+      if (deps['react']) return 'React';
+      if (deps['vue']) return 'Vue.js';
+      if (deps['svelte']) return 'Svelte';
+      if (deps['express']) return 'Express';
+      if (deps['fastify']) return 'Fastify';
+      if (deps['electron']) return 'Electron';
+      if (deps['tauri']) return 'Tauri';
+      return 'Node.js';
+    } catch {
+      return 'Node.js';
+    }
+  }},
+  { file: 'Cargo.toml', stack: 'Rust' },
+  { file: 'pyproject.toml', stack: 'Python' },
+  { file: 'requirements.txt', stack: 'Python' },
+  { file: 'go.mod', stack: 'Go' },
+  { file: 'composer.json', stack: 'PHP' },
+  { file: 'Gemfile', stack: 'Ruby' },
+  { file: 'pom.xml', stack: 'Java' },
+  { file: 'build.gradle', stack: 'Java/Kotlin' },
+];
+
+// ── Full Stack Detection (for autoconfig.js) ──
+
+function detectStack(dir) {
+  const result = {
+    language: null,
+    framework: null,
+    runtime: null,
+    packageManager: null,
+    hasTypeScript: false,
+  };
+
+  // Package.json analysis
+  const pkgPath = path.join(dir, 'package.json');
+  if (fs.existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+      result.runtime = 'Node.js';
+      result.language = deps['typescript'] || fs.existsSync(path.join(dir, 'tsconfig.json')) ? 'TypeScript' : 'JavaScript';
+      result.hasTypeScript = result.language === 'TypeScript';
+
+      // Framework detection
+      if (deps['next']) result.framework = 'Next.js';
+      else if (deps['nuxt']) result.framework = 'Nuxt';
+      else if (deps['@angular/core']) result.framework = 'Angular';
+      else if (deps['react']) result.framework = 'React';
+      else if (deps['vue']) result.framework = 'Vue.js';
+      else if (deps['svelte']) result.framework = 'Svelte';
+      else if (deps['express']) result.framework = 'Express';
+      else if (deps['fastify']) result.framework = 'Fastify';
+      else if (deps['hono']) result.framework = 'Hono';
+      else if (deps['electron']) result.framework = 'Electron';
+      else if (deps['tauri']) result.framework = 'Tauri';
+      else if (deps['react-native']) result.framework = 'React Native';
+
+      // Package manager
+      if (fs.existsSync(path.join(dir, 'pnpm-lock.yaml'))) result.packageManager = 'pnpm';
+      else if (fs.existsSync(path.join(dir, 'yarn.lock'))) result.packageManager = 'yarn';
+      else if (fs.existsSync(path.join(dir, 'bun.lockb'))) result.packageManager = 'bun';
+      else result.packageManager = 'npm';
+    } catch (e) {
+      console.warn('stack-detect: Failed to parse package.json in detectStack', e.message);
+    }
+  }
+
+  // Other languages
+  if (!result.runtime) {
+    if (fs.existsSync(path.join(dir, 'Cargo.toml'))) { result.language = 'Rust'; result.runtime = 'Rust'; }
+    else if (fs.existsSync(path.join(dir, 'pyproject.toml')) || fs.existsSync(path.join(dir, 'requirements.txt'))) { result.language = 'Python'; result.runtime = 'Python'; }
+    else if (fs.existsSync(path.join(dir, 'go.mod'))) { result.language = 'Go'; result.runtime = 'Go'; }
+    else if (fs.existsSync(path.join(dir, 'composer.json'))) { result.language = 'PHP'; result.runtime = 'PHP'; }
+    else if (fs.existsSync(path.join(dir, 'Gemfile'))) { result.language = 'Ruby'; result.runtime = 'Ruby'; }
+    else if (fs.existsSync(path.join(dir, 'pom.xml')) || fs.existsSync(path.join(dir, 'build.gradle'))) { result.language = 'Java'; result.runtime = 'JVM'; }
+  }
+
+  return result;
+}
+
+module.exports = {
+  detectStack,
+  PROJECT_MARKERS,
+};

package/tools/cli/lib/validate.js

@@ -0,0 +1,50 @@
+/**
+ * BMAD+ User Input Validation Utilities
+ * Extracted from install.js for modularity and reuse.
+ */
+
+// Shell/quote metacharacters that are dangerous in user-provided names.
+// Includes single/double quotes so a name cannot break out of a quoted context.
+const SHELL_META = /[;&|`$(){}[\]!#~<>*?\\'"\n\r]/;
+// Global variant used to strip EVERY occurrence during sanitization.
+// (A non-global regex in String.replace only removes the first match.)
+const SHELL_META_GLOBAL = /[;&|`$(){}[\]!#~<>*?\\'"\n\r]/g;
+
+/**
+ * Validate and sanitize a user name.
+ * Rules:
+ *  - Must not be empty
+ *  - Must not exceed 100 characters
+ *  - Must not contain shell metacharacters
+ *
+ * @param {string} rawName - Raw user-provided name
+ * @param {string} fallback - Fallback name if validation fails
+ * @returns {{ name: string, warnings: string[] }} Sanitized name and any warnings
+ */
+function validateUserName(rawName, fallback) {
+  const warnings = [];
+
+  if (!rawName || rawName.trim().length === 0) {
+    warnings.push('Name cannot be empty. Using default.');
+    return { name: fallback, warnings };
+  }
+
+  if (rawName.length > 100) {
+    warnings.push('Name too long (>100 chars). Truncating.');
+    return { name: rawName.slice(0, 100), warnings };
+  }
+
+  if (SHELL_META.test(rawName)) {
+    const sanitized = rawName.replace(SHELL_META_GLOBAL, '').trim() || 'Developer';
+    warnings.push('Name contains shell metacharacters. Using sanitized version.');
+    return { name: sanitized, warnings };
+  }
+
+  return { name: rawName, warnings };
+}
+
+module.exports = {
+  validateUserName,
+  SHELL_META,
+  SHELL_META_GLOBAL,
+};