bms-speckit-plugin 6.9.0 → 6.10.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bms-speckit",
-  "version": "6.9.0",
+  "version": "6.10.1",
   "description": "Chain-orchestrated development pipeline with 12-step autonomous workflow (brainstorm → research → constitution → specify → plan → tasks → analyze → implement with rolling QC → final quality gate → merge) and 9-dimension QC agent (code errors, security incl. SQL parameterization, deps, UX/UI, accessibility, deployment artifacts, cross-DB compatibility, real-DB integration testing, HOSxP business logic validation, brand/layout polish). Runs autonomously — never prompts for clarification.",
   "author": {
     "name": "manoirx"

package/blueprints/bms-speckit-pipeline.yaml

@@ -250,17 +250,7 @@ chain_sequence:
 
   # ── Phase 2: Implementation (main context) ────────────────────────────────
 
-  - step_id: step_9_compact
-    skill_id: internal.compact
-    action: execute
-    phase: 2
-    description: Free context window before implementation
-    timeout_seconds: 30
-    error_handling:
-      on_failure: continue
-      max_retries: 0
-
-  - step_id: step_10_implement_with_rolling_qc
+  - step_id: step_9_implement_with_rolling_qc
     skill_id: speckit.implement
     action: execute_loop
     phase: 2
@@ -320,7 +310,7 @@ chain_sequence:
         validation pass. Apply improvements, re-run all tests, confirm zero
         regression. Only output FINISHED after everything is validated.
 
-  - step_id: step_11_final_quality_gate
+  - step_id: step_10_final_quality_gate
     agent_id: bms-speckit:quality-control
     action: dispatch_agent
     phase: 2
@@ -355,7 +345,7 @@ chain_sequence:
         Proceed to merge unless unfixed build errors, test failures, or
         critical security vulnerabilities remain.
 
-  - step_id: step_12_merge
+  - step_id: step_11_merge
     skill_id: internal.git_merge_to_main
     action: execute
     phase: 2
@@ -396,6 +386,6 @@ metadata:
       reason: Preserve main context window for implementation
     phase_2:
       name: Implementation & Verification & Merge
-      steps: [step_9 through step_12]
+      steps: [step_9 through step_11]
       execution: main_context
       reason: Implementation needs full tool access and ralph-loop

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bms-speckit-plugin",
-  "version": "6.9.0",
+  "version": "6.10.1",
   "description": "Chain-orchestrated development pipeline: /bms-speckit takes requirements and runs brainstorm → constitution → specify → plan → tasks → analyze → implement → verify with per-step error handling",
   "files": [
     ".claude-plugin/",

package/skills/bms-speckit-auto/SKILL.md

@@ -48,10 +48,9 @@ TaskCreate: "Step 5: Specify — feature specification"
 TaskCreate: "Step 6: Plan — implementation plan"
 TaskCreate: "Step 7: Tasks — task list"
 TaskCreate: "Step 8: Analyze — consistency check"
-TaskCreate: "Step 9: Compact context"
-TaskCreate: "Step 10: Implement with rolling QC"
-TaskCreate: "Step 11: Final quality gate"
-TaskCreate: "Step 12: Merge to main"
+TaskCreate: "Step 9: Implement with rolling QC"
+TaskCreate: "Step 10: Final quality gate"
+TaskCreate: "Step 11: Merge to main"
 ```
 
 Then output a message to the user:
@@ -74,14 +73,14 @@ You are running the BMS Speckit specification and planning chain. Execute each s
 
 **IMPORTANT — Progress reporting:** Before starting each step, output a progress message to the user in this format:
 
-`[Step N/12] step_name — description...`
+`[Step N/11] step_name — description...`
 
 After completing each step, output:
 
-`[Step N/12] DONE — brief result summary`
+`[Step N/11] DONE — brief result summary`
 
 ### Step 1 — Brainstorm `[on_failure: STOP]`
-- **Progress:** Output `[Step 1/12] Brainstorm — exploring requirements and design...`
+- **Progress:** Output `[Step 1/11] Brainstorm — exploring requirements and design...`
 - **Skill:** `superpowers.brainstorm`
 - **Input:** "$ARGUMENTS"
 - **Purpose:** Explore intent, requirements, design alternatives, and edge cases
@@ -89,10 +88,10 @@ After completing each step, output:
 - **Output:** Detailed specification document
 - **Timeout:** 300s
 - **Post-action:** Commit all files and push. Message: `feat(speckit): brainstorm — explore requirements and design`
-- **Done:** Output `[Step 1/12] DONE — brainstorm complete`
+- **Done:** Output `[Step 1/11] DONE — brainstorm complete`
 
 ### Step 2 — Research `[on_failure: CONTINUE]`
-- **Progress:** Output `[Step 2/12] Research — surveying best practices and technologies...`
+- **Progress:** Output `[Step 2/11] Research — surveying best practices and technologies...`
 - **Purpose:** Research external best practices, proven patterns, recommended libraries/frameworks, and informative reference material relevant to the user's requirement. This grounds the pipeline in current industry knowledge before specification begins.
 - **Tools:** Use `WebSearch` and `mcp__plugin_context7_context7__resolve-library-id` + `mcp__plugin_context7_context7__query-docs` for library documentation
 - **Timeout:** 300s
@@ -111,25 +110,25 @@ After completing each step, output:
   - **Security/compliance notes** — standards to adhere to (if applicable)
   - **Prior art** — reference implementations or architectures found
 - **Post-action:** Commit all files and push. Message: `feat(speckit): research — best practices and technology survey`
-- **Done:** Output `[Step 2/12] DONE — research brief created (N topics researched)`
+- **Done:** Output `[Step 2/11] DONE — research brief created (N topics researched)`
 
 ### Step 3 — Constitution `[on_failure: STOP]`
-- **Progress:** Output `[Step 3/12] Constitution — establishing engineering principles...`
+- **Progress:** Output `[Step 3/11] Constitution — establishing engineering principles...`
 - **Skill:** `speckit.constitution`
 - **Input:** "Establish and enforce a comprehensive set of engineering principles that prioritize high code quality, strict adherence to Test-Driven Development (TDD) practices, and well-defined testing standards across unit, component, integration, and API levels to ensure system reliability and maintainability, maintain a consistent, user-friendly, and professional user interface aligned with strong user experience (UX) guidelines, optimize application performance through efficient architecture and resource management; enforce disciplined version control practices with frequent, atomic commits to minimize risk and improve traceability, promote the development and reuse of modular components and functions while centralizing business logic to avoid duplication and ensure consistency, provide clear, informative user feedback and progress reporting throughout system interactions, and leverage all available tools, frameworks, and domain-specific expertise to support developers in delivering robust, scalable, and high-quality applications."
 - **Output:** `specs/constitution.md`
 - **Timeout:** 300s
-- **Done:** Output `[Step 3/12] DONE — constitution created`
+- **Done:** Output `[Step 3/11] DONE — constitution created`
 
 ### Step 4 — CLAUDE.md Sync `[on_failure: CONTINUE]`
-- **Progress:** Output `[Step 4/12] CLAUDE.md Sync — verifying compliance...`
+- **Progress:** Output `[Step 4/11] CLAUDE.md Sync — verifying compliance...`
 - **Action:** Read CLAUDE.md and verify it complies with the constitution in `specs/constitution.md`. Update CLAUDE.md if it conflicts with or is missing constitution rules.
 - **Timeout:** 120s
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add constitution and sync CLAUDE.md`
-- **Done:** Output `[Step 4/12] DONE — CLAUDE.md synced`
+- **Done:** Output `[Step 4/11] DONE — CLAUDE.md synced`
 
 ### Step 5 — Specify `[on_failure: STOP]`
-- **Progress:** Output `[Step 5/12] Specify — creating feature specification...`
+- **Progress:** Output `[Step 5/11] Specify — creating feature specification...`
 - **Skill:** `speckit.specify`
 - **Input:** Use the detailed specification output from Step 1 (brainstorm) **enriched with the research findings from Step 2**. Include recommended libraries, best practices, and compliance requirements from the research brief in the specification input.
 - **Knowledge lookup:** Use `mcp__bms-knowledge-mcp__search_knowledge` to search the `hosxp` collection for exact table names, field names, data types, and relationships needed by this feature. Reference actual HOSxP data structures in the spec.
@@ -139,35 +138,35 @@ After completing each step, output:
 - **Timeout:** 300s
 - **Retry:** up to 2 attempts
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add feature specification`
-- **Done:** Output `[Step 5/12] DONE — specification created`
+- **Done:** Output `[Step 5/11] DONE — specification created`
 
 ### Step 6 — Plan `[on_failure: STOP]`
-- **Progress:** Output `[Step 6/12] Plan — generating implementation plan...`
+- **Progress:** Output `[Step 6/11] Plan — generating implementation plan...`
 - **Skill:** `speckit.plan`
 - **Input:** reads from step 5 artifacts
 - **Output:** `specs/*/plan.md`
 - **Timeout:** 300s
 - **Retry:** up to 2 attempts
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add implementation plan`
-- **Done:** Output `[Step 6/12] DONE — plan created`
+- **Done:** Output `[Step 6/11] DONE — plan created`
 
 ### Step 7 — Tasks `[on_failure: STOP]`
-- **Progress:** Output `[Step 7/12] Tasks — generating task list...`
+- **Progress:** Output `[Step 7/11] Tasks — generating task list...`
 - **Skill:** `speckit.tasks`
 - **Input:** reads from step 6 artifacts
 - **Output:** `specs/*/tasks.md`
 - **Timeout:** 300s
 - **Retry:** up to 2 attempts
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add task list`
-- **Done:** Output `[Step 7/12] DONE — N tasks created`
+- **Done:** Output `[Step 7/11] DONE — N tasks created`
 
 ### Step 8 — Analyze `[on_failure: CONTINUE]`
-- **Progress:** Output `[Step 8/12] Analyze — cross-artifact consistency check...`
+- **Progress:** Output `[Step 8/11] Analyze — cross-artifact consistency check...`
 - **Skill:** `speckit.analyze`
 - **Purpose:** Cross-artifact consistency check (spec ↔ plan ↔ tasks ↔ research). Non-destructive — report only.
 - **Timeout:** 300s
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add cross-artifact analysis report`
-- **Done:** Output `[Step 8/12] DONE — analysis complete`
+- **Done:** Output `[Step 8/11] DONE — analysis complete`
 
 ### Completion Contract — DO NOT RETURN UNTIL THIS IS SATISFIED
 
@@ -267,13 +266,8 @@ Only after the Verification Gate passes (`GATE=OK`), update tasks 1–8 as compl
 
 > **Execution context:** Runs in main context after subagent completes.
 
-### Step 9 — Compact `[on_failure: CONTINUE]`
-- **Progress:** Output `[Step 9/12] Compact — freeing context window...`
-- **Action:** Run `/compact` to free context window before implementation.
-- **Done:** Update task 9 as completed.
-
-### Step 10 — Implement with Rolling QC `[on_failure: CONTINUE | max_retries: 3]`
-- **Progress:** Output `[Step 10/12] Implement — starting rolling QC loop (N tasks)...`
+### Step 9 — Implement with Rolling QC `[on_failure: CONTINUE | max_retries: 3]`
+- **Progress:** Output `[Step 9/11] Implement — starting rolling QC loop (N tasks)...`
 - **Engine:** ralph-loop
 - **Input:** Use the **tasks.md path returned by the Phase 1 subagent** (e.g. `specs/my-feature/tasks.md`). Replace `{TASKS_PATH}` below with the actual path.
 - **Completion promise:** `FINISHED`
@@ -300,14 +294,20 @@ Only after the Verification Gate passes (`GATE=OK`), update tasks 1–8 as compl
   4. **FIX** — fix every issue found in steps 2 and 3, re-run checks
   5. **COMMIT** — only commit when build + lint + unit tests + integration tests all pass with zero errors
   6. **NEXT** — move to next task
+- **CRITICAL — ralph-loop prompt sanitation:** The `/ralph-loop:ralph-loop` slash command currently does not quote `$ARGUMENTS` when handing the prompt to bash (a known upstream bug in `ralph-loop/commands/ralph-loop.md`). This means **any shell metacharacter in your prompt is interpreted before the ralph-loop script runs**, causing the loop to fail before it starts. When constructing the prompt below:
+  - **Never include backticks (`` ` ``) anywhere in the prompt.** Do not use markdown code spans for command names. Write `npm run build` as `'npm run build'` (single quotes) or as the words `the build command`.
+  - **Never include `$(...)` or `` `...` `` (command substitution).**
+  - **Never include unescaped double quotes** inside the prompt — they close the outer quoting. If you must mention a quoted string, use single quotes.
+  - **Avoid stray `&`, `|`, `;`, `<`, `>`, `\` in prose.** These are shell separators/redirections.
+  - **Pre-flight scrub:** before issuing the slash command, scan your constructed prompt and replace every backtick with a single quote, every `$(...)` with `the output of ...`, every internal `"` with `'`. If unsure, use only ASCII letters, digits, spaces, hyphens, em-dashes, parentheses, periods, commas, colons, and forward slashes.
 - **Action:** Run:
 
 `/ralph-loop:ralph-loop "systematically execute speckit.implement via the Skill tool to complete every task defined in {TASKS_PATH} with strict adherence to specification requirements. IMPORTANT: apply rolling QC after EACH task — after implementing a task run build and fix build errors, run linter and fix lint errors, run ALL tests (not just new ones) and fix failures, check for hardcoded secrets and injection vulnerabilities in code you just wrote, verify UI code has actionable error messages and loading states. RUNTIME SAFETY: always add explicit return type annotations on data transformation functions, never spread or iterate a function return value without verifying it returns the expected collection type, use strict equality and null guards for external data, write tests that execute data transformers and verify output type and shape. SQL VALIDATION: before writing any SQL statement verify exact table and column names exist via bms-session-mcp-server list_tables/describe_table or bms-knowledge-mcp search_knowledge with hosxp collection, never guess column names, after writing test each query with EXPLAIN or LIMIT 0 via the query tool to confirm it executes without error. INTEGRATION TESTING: for every task that touches database or data-dependent logic run an integration test using the real bms-session-mcp-server query tool to execute the feature's SQL against the real HOSxP database (not mocks), flow the result through the actual code path, assert on concrete properties (row count, columns populated, types match, masked fields handled), use small LIMIT to avoid large result sets. If integration test fails investigate the real cause and fix it — do not relax the assertion. BUSINESS LOGIC: before writing any SQL state the business question it answers then consult bms-knowledge-mcp search_knowledge on hosxp collection to verify canonical table selection, soft-delete filters, correct date columns, join keys (hn/vn/an); use graph_search for multi-table relationships; for reporting queries also check moph or nhso collections for regulatory rules; cite the HOSxP convention in a code comment next to the query. Only commit when build plus lint plus tests all pass with zero errors then proceed to next task. Report progress to the user after each task: output [Task N/total] DONE — task_name. Do NOT batch QC at the end. Maintain atomic commits after each successful task with clear traceability, avoid requesting confirmation and proceed autonomously, once all tasks are implemented invoke speckit.analyze via the Skill tool to perform a full validation pass, automatically apply all recommended improvements or corrections, re-run all tests to confirm stability and zero regression, and only output <promise>FINISHED</promise> after every task is fully completed, validated, and aligned with production-grade quality standards" --completion-promise "FINISHED" --max-iterations 10`
 
-- **Done:** Update task 10 as completed. Output `[Step 10/12] DONE — all tasks implemented and verified`
+- **Done:** Update task 9 as completed. Output `[Step 9/11] DONE — all tasks implemented and verified`
 
-### Step 11 — Final Quality Gate `[on_failure: STOP | max_retries: 3]`
-- **Progress:** Output `[Step 11/12] Final QC — running comprehensive quality audit...`
+### Step 10 — Final Quality Gate `[on_failure: STOP | max_retries: 3]`
+- **Progress:** Output `[Step 10/11] Final QC — running comprehensive quality audit...`
 - **Agent:** Dispatch `bms-speckit:quality-control` agent
 - **Purpose:** Final comprehensive sweep. Since inline QC already caught per-task issues, this focuses on **cross-cutting concerns** that can only be detected across the full codebase.
 - **Timeout:** 900s
@@ -324,15 +324,15 @@ Only after the Verification Gate passes (`GATE=OK`), update tasks 1–8 as compl
   - **H. Integration testing (real database, end-to-end)** — run actual integration tests against the real HOSxP database via `bms-session-mcp-server`. For every DB-touching feature verify there's an integration test that: executes the feature's real SQL via the `query` tool, flows real data through the actual code path (transformers, filters, UI components), asserts on concrete properties (row count range, column presence, type correctness, masked field handling, Thai encoding). Create missing integration tests. Never fix failures by mocking responses, skipping tests, or loosening assertions. Flag slow queries for user review. (skipped if bms-session-mcp-server is not available)
   - **I. Business logic semantic validation** — verify every SQL statement actually retrieves the correct data per the user's intent and HOSxP conventions, not just that it runs without error. For each SQL: state the business question it should answer, cross-reference `mcp__bms-knowledge-mcp__search_knowledge` on `hosxp` collection for canonical table selection, soft-delete/status filters, correct date columns, join keys (hn/vn/an), code system usage (ICD-10/LOINC/TMT). Use `graph_search` for multi-table relationship questions. Check regulatory compliance via `moph` and `nhso` collections (43 files reporting, reimbursement rules). Verify Thai conventions (Buddhist calendar, CID validation, pre-masked fields). Fix semantic mismatches with code comments citing the HOSxP convention. Flag ambiguous intent for user review. (skipped if bms-knowledge-mcp is not available)
 - The agent fixes everything it can. Major dependency updates are flagged for user review.
-- **Completion rule:** When the QC agent returns its report, proceed to Step 12 **unless** the report contains unfixed build errors, unfixed test failures, or unfixed critical security vulnerabilities. Informational findings, flagged-for-review items, and already-fixed issues do NOT block progression. If uncertain, proceed — the QC agent already fixed what it could.
+- **Completion rule:** When the QC agent returns its report, proceed to Step 11 **unless** the report contains unfixed build errors, unfixed test failures, or unfixed critical security vulnerabilities. Informational findings, flagged-for-review items, and already-fixed issues do NOT block progression. If uncertain, proceed — the QC agent already fixed what it could.
 - **Post-action:** Commit all fixes and push. Message: `fix(speckit): final QC — security, deps, UX consistency, accessibility`
-- **Done:** Update task 11 as completed. Output `[Step 11/12] DONE — quality gate passed`
+- **Done:** Update task 10 as completed. Output `[Step 10/11] DONE — quality gate passed`
 
-### Step 12 — Merge to Main `[on_failure: STOP]`
-- **Progress:** Output `[Step 12/12] Merge — merging to main branch...`
+### Step 11 — Merge to Main `[on_failure: STOP]`
+- **Progress:** Output `[Step 11/11] Merge — merging to main branch...`
 - **Action:** Switch to main branch, merge the feature branch (fast-forward if possible), push main to remote, then clean up the feature branch.
 - **Timeout:** 120s
-- **Done:** Update task 12 as completed. Output:
+- **Done:** Update task 11 as completed. Output:
 
 > Pipeline complete! Feature merged to main.
 
@@ -343,15 +343,15 @@ Only after the Verification Gate passes (`GATE=OK`), update tasks 1–8 as compl
 ```
 Phase 1 (subagent)                          Phase 2 (main context)
 ──────────────────────────────              ──────────────────────────────
-Step 1: brainstorm ──STOP── commit          Step 9:  compact
-        + knowledge search (hosxp)          Step 10: implement + rolling QC
-Step 2: research ────────── commit                   ┌─ implement task ─┐
-        + WebSearch + context7                       │  inline QC       │
-Step 3: constitution ─STOP─┐                         │  fix → commit    │
-Step 4: CLAUDE.md sync ───┘ commit                   └─ next task ──────┘
-Step 5: specify ──────STOP── commit         Step 11: final QC agent ── commit
-        + knowledge search (hosxp)                   (security/deps/UX/a11y/deploy)
-Step 6: plan ─────────STOP── commit         Step 12: merge to main + push
+Step 1: brainstorm ──STOP── commit          Step 9:  implement + rolling QC
+        + knowledge search (hosxp)                   ┌─ implement task ─┐
+Step 2: research ────────── commit                   │  inline QC       │
+        + WebSearch + context7                       │  fix → commit    │
+Step 3: constitution ─STOP─┐                         └─ next task ──────┘
+Step 4: CLAUDE.md sync ───┘ commit          Step 10: final QC agent ── commit
+Step 5: specify ──────STOP── commit                  (security/deps/UX/a11y/deploy)
+        + knowledge search (hosxp)          Step 11: merge to main + push
+Step 6: plan ─────────STOP── commit
 Step 7: tasks ────────STOP── commit
 Step 8: analyze ──────────── commit
 ```