ma-agents 2.20.1 → 2.20.3

package/README.md

@@ -19,6 +19,12 @@ npx ma-agents install code-review claude-code copilot
 
 # Global installation (user-level)
 npx ma-agents install code-review claude-code --global
+
+# CI/CD: skip all prompts, use defaults
+npx ma-agents install --yes
+
+# Target a specific agent only
+npx ma-agents install --yes --agent claude-code
 ```
 
 ## How It Works
@@ -120,6 +126,8 @@ The installer automatically updates agent-specific instruction files (like `CLAU
 ```bash
 npx ma-agents                              # Launch interactive wizard
 npx ma-agents install                      # Interactive install wizard
+npx ma-agents install --yes                # Non-interactive, use defaults (CI/CD)
+npx ma-agents install --yes --agent <id>   # Non-interactive, target one agent
 npx ma-agents status                       # Show installed skills and paths
 npx ma-agents list                         # List all available skills
 npx ma-agents agents                       # List supported agents
@@ -144,6 +152,20 @@ Running `ma-agents` on a project where skills are already installed triggers the
 - **Customization Engine**: Injects project-specific `.customize.yaml` templates to align agents with your workflow.
 - **Advanced Agent Templates**: Deploys full XML-structured agent definitions directly into the BMAD system.
 
+#### Bundled & Offline Installation (v2.20+)
+
+`ma-agents` ships with everything needed to install BMAD without any network access at install time:
+
+- **`bmad-method` is a direct npm dependency** — no runtime `npx bmad-method` fetch required. The correct version is pinned and bundled inside `node_modules/` when you `npm install ma-agents`.
+- **External modules pre-bundled** — `lib/bmad-cache/` ships the 4 optional BMAD modules (`bmb`, `cis`, `gds`, `tea`) inside the package itself. They are pre-populated to `~/.bmad/cache/external-modules/` before any install runs, so BMAD never needs to clone them from GitHub.
+- **Deterministic installs** — same `ma-agents` version always produces the same `_bmad/` output, regardless of network conditions (NFR21).
+- **Air-gapped friendly** — install from a tarball (`npm install ./ma-agents-x.y.z.tgz`) and run `npx ma-agents install` completely offline.
+
+```
+npm install ma-agents          # bundles bmad-method + 4 external modules
+npx ma-agents install --yes    # fully offline BMAD install — no network needed
+```
+
 #### Specialized BMAD Agents
 1. **SRE Agent (Alex)**:
    - **Focus**: High availability, Kubernetes, Docker, and Podman.
@@ -179,8 +201,27 @@ npx ma-agents install code-review claude-code --global
 
 # Install to a custom directory
 npx ma-agents install code-review claude-code --path ./my-skills
+
+# Skip all prompts, use defaults — ideal for CI/CD pipelines
+npx ma-agents install --yes
+npx ma-agents install --yes --global
+npx ma-agents install --yes --agent claude-code
+
+# Target a specific agent (skips agent selection prompt)
+npx ma-agents install code-review --agent cursor
+
+# Force overwrite without upgrade prompts
+npx ma-agents install code-review claude-code --force
 ```
 
+| Flag | Description |
+|------|-------------|
+| `--yes` | Skip all prompts, use defaults. Selects all detected agents, installs/updates BMAD automatically. |
+| `--agent <name>` | Target a specific agent — skips agent selection. Run `npx ma-agents agents` for valid names. |
+| `--force` | Skip upgrade prompts, always overwrite existing installations. |
+| `--global` | Install to global/user-level paths instead of project-level. |
+| `--path <dir>` | Custom installation directory. |
+
 ## Requirements
 
 ### Global Requirements
@@ -342,11 +383,14 @@ ma-agents/
 │   ├── agents.js               # Agent configurations and paths
 │   ├── installer.js            # Skill discovery and installation logic
 │   ├── bmad.js                 # BMAD-METHOD integration and injection logic
+│   ├── bmad-cache/             # Pre-bundled BMAD external modules (bmb, cis, gds, tea)
 │   ├── bmad-customizations/    # BMAD persona templates (.md) and YAML configs
 │   ├── bmad-workflows/         # Specialized BMAD playbooks (SRE, Cyber, etc.)
 │   └── mil498-templates/       # MIL-STD-498 DID library (SRS, SSS, SSDD, etc.)
+├── scripts/
+│   └── build-bmad-cache.js     # Rebuilds lib/bmad-cache/ from upstream repos
 ├── skills/
-│   ├── code-review/            # 25 bundled skills across 5 domains
+│   ├── code-review/            # 27 bundled skills across 5 domains
 │   ├── commit-message/
 │   ├── create-hardened-docker-skill/
 │   ├── git-workflow-skill/
@@ -355,6 +399,10 @@ ma-agents/
 │   ├── test-generator/
 │   ├── vercel-react-best-practices/
 │   └── verify-hardened-docker-skill/
+├── test/
+│   └── yes-flag.test.js        # Tests for --yes / --agent flag behavior
+├── docs/
+│   └── validation/             # Manual validation reports (e.g., bundled install)
 ├── SKILLS_STRUCTURE.md         # Full skill authoring documentation
 ├── package.json
 └── README.md
@@ -378,6 +426,12 @@ node bin/cli.js list
 
 # Test agents listing
 node bin/cli.js agents
+
+# Run tests
+npm test
+
+# Rebuild the bundled BMAD module cache (lib/bmad-cache/)
+npm run build:bmad-cache
 ```
 
 ## Programmatic API

package/lib/agents.js

@@ -34,7 +34,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'claude-code',
-    instructionFiles: ['.claude/CLAUDE.md']
+    instructionFiles: ['.claude/CLAUDE.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'gemini',
@@ -55,7 +56,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['.gemini/gemini.md']
+    instructionFiles: ['.gemini/gemini.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'copilot',
@@ -76,7 +78,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['.github/copilot/copilot.md']
+    instructionFiles: ['.github/copilot/copilot.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'kilocode',
@@ -97,7 +100,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['.kilocode/kilocode.md']
+    instructionFiles: ['.kilocode/kilocode.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'cline',
@@ -123,7 +127,8 @@ const agents = [
       'references': 'docs',
       'assets': 'templates'
     },
-    instructionFiles: ['.cline/clinerules.md', '.clinerules']
+    instructionFiles: ['.cline/clinerules.md', '.clinerules'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'cursor',
@@ -144,7 +149,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['.cursor/cursor.md']
+    instructionFiles: ['.cursor/cursor.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'bmm-sre',
@@ -165,7 +171,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['_bmad/bmm/agents/sre.md']
+    instructionFiles: ['_bmad/bmm/agents/sre.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'antigravity',
@@ -186,7 +193,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['.antigravity/antigravity.md']
+    instructionFiles: ['.antigravity/antigravity.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'bmm-devops',
@@ -207,7 +215,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['_bmad/bmm/agents/devops.md']
+    instructionFiles: ['_bmad/bmm/agents/devops.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'bmm-cyber',
@@ -228,7 +237,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['_bmad/bmm/agents/cyber.md']
+    instructionFiles: ['_bmad/bmm/agents/cyber.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
   {
     id: 'bmm-mil498',
@@ -249,7 +259,8 @@ const agents = [
     },
     fileExtension: '.md',
     template: 'generic',
-    instructionFiles: ['_bmad/bmm/agents/mil498.md']
+    instructionFiles: ['_bmad/bmm/agents/mil498.md'],
+    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   }
 ];
 

package/lib/bmad-cache/bmb/_git_preserved/HEAD

@@ -0,0 +1 @@
+ref: refs/heads/main

package/lib/bmad-cache/bmb/_git_preserved/config

@@ -0,0 +1,13 @@
+[core]
+	repositoryformatversion = 0
+	filemode = false
+	bare = false
+	logallrefupdates = true
+	symlinks = false
+	ignorecase = true
+[remote "origin"]
+	url = https://github.com/bmad-code-org/bmad-builder
+	fetch = +refs/heads/main:refs/remotes/origin/main
+[branch "main"]
+	remote = origin
+	merge = refs/heads/main

package/lib/bmad-cache/bmb/_git_preserved/description

@@ -0,0 +1 @@
+Unnamed repository; edit this file 'description' to name the repository.

package/lib/bmad-cache/bmb/_git_preserved/hooks/applypatch-msg.sample

@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# An example hook script to check the commit log message taken by
+# applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.  The hook is
+# allowed to edit the commit message file.
+#
+# To enable this hook, rename this file to "applypatch-msg".
+
+. git-sh-setup
+commitmsg="$(git rev-parse --git-path hooks/commit-msg)"
+test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"}
+:

package/lib/bmad-cache/bmb/_git_preserved/hooks/commit-msg.sample

@@ -0,0 +1,24 @@
+#!/bin/sh
+#
+# An example hook script to check the commit log message.
+# Called by "git commit" with one argument, the name of the file
+# that has the commit message.  The hook should exit with non-zero
+# status after issuing an appropriate message if it wants to stop the
+# commit.  The hook is allowed to edit the commit message file.
+#
+# To enable this hook, rename this file to "commit-msg".
+
+# Uncomment the below to add a Signed-off-by line to the message.
+# Doing this in a hook is a bad idea in general, but the prepare-commit-msg
+# hook is more suited to it.
+#
+# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
+# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1"
+
+# This example catches duplicate Signed-off-by lines.
+
+test "" = "$(grep '^Signed-off-by: ' "$1" |
+	 sort | uniq -c | sed -e '/^[ 	]*1[ 	]/d')" || {
+	echo >&2 Duplicate Signed-off-by lines.
+	exit 1
+}

package/lib/bmad-cache/bmb/_git_preserved/hooks/fsmonitor-watchman.sample

@@ -0,0 +1,174 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+use IPC::Open2;
+
+# An example hook script to integrate Watchman
+# (https://facebook.github.io/watchman/) with git to speed up detecting
+# new and modified files.
+#
+# The hook is passed a version (currently 2) and last update token
+# formatted as a string and outputs to stdout a new update token and
+# all files that have been modified since the update token. Paths must
+# be relative to the root of the working tree and separated by a single NUL.
+#
+# To enable this hook, rename this file to "query-watchman" and set
+# 'git config core.fsmonitor .git/hooks/query-watchman'
+#
+my ($version, $last_update_token) = @ARGV;
+
+# Uncomment for debugging
+# print STDERR "$0 $version $last_update_token\n";
+
+# Check the hook interface version
+if ($version ne 2) {
+	die "Unsupported query-fsmonitor hook version '$version'.\n" .
+	    "Falling back to scanning...\n";
+}
+
+my $git_work_tree = get_working_dir();
+
+my $retry = 1;
+
+my $json_pkg;
+eval {
+	require JSON::XS;
+	$json_pkg = "JSON::XS";
+	1;
+} or do {
+	require JSON::PP;
+	$json_pkg = "JSON::PP";
+};
+
+launch_watchman();
+
+sub launch_watchman {
+	my $o = watchman_query();
+	if (is_work_tree_watched($o)) {
+		output_result($o->{clock}, @{$o->{files}});
+	}
+}
+
+sub output_result {
+	my ($clockid, @files) = @_;
+
+	# Uncomment for debugging watchman output
+	# open (my $fh, ">", ".git/watchman-output.out");
+	# binmode $fh, ":utf8";
+	# print $fh "$clockid\n@files\n";
+	# close $fh;
+
+	binmode STDOUT, ":utf8";
+	print $clockid;
+	print "\0";
+	local $, = "\0";
+	print @files;
+}
+
+sub watchman_clock {
+	my $response = qx/watchman clock "$git_work_tree"/;
+	die "Failed to get clock id on '$git_work_tree'.\n" .
+		"Falling back to scanning...\n" if $? != 0;
+
+	return $json_pkg->new->utf8->decode($response);
+}
+
+sub watchman_query {
+	my $pid = open2(\*CHLD_OUT, \*CHLD_IN, 'watchman -j --no-pretty')
+	or die "open2() failed: $!\n" .
+	"Falling back to scanning...\n";
+
+	# In the query expression below we're asking for names of files that
+	# changed since $last_update_token but not from the .git folder.
+	#
+	# To accomplish this, we're using the "since" generator to use the
+	# recency index to select candidate nodes and "fields" to limit the
+	# output to file names only. Then we're using the "expression" term to
+	# further constrain the results.
+	my $last_update_line = "";
+	if (substr($last_update_token, 0, 1) eq "c") {
+		$last_update_token = "\"$last_update_token\"";
+		$last_update_line = qq[\n"since": $last_update_token,];
+	}
+	my $query = <<"	END";
+		["query", "$git_work_tree", {$last_update_line
+			"fields": ["name"],
+			"expression": ["not", ["dirname", ".git"]]
+		}]
+	END
+
+	# Uncomment for debugging the watchman query
+	# open (my $fh, ">", ".git/watchman-query.json");
+	# print $fh $query;
+	# close $fh;
+
+	print CHLD_IN $query;
+	close CHLD_IN;
+	my $response = do {local $/; <CHLD_OUT>};
+
+	# Uncomment for debugging the watch response
+	# open ($fh, ">", ".git/watchman-response.json");
+	# print $fh $response;
+	# close $fh;
+
+	die "Watchman: command returned no output.\n" .
+	"Falling back to scanning...\n" if $response eq "";
+	die "Watchman: command returned invalid output: $response\n" .
+	"Falling back to scanning...\n" unless $response =~ /^\{/;
+
+	return $json_pkg->new->utf8->decode($response);
+}
+
+sub is_work_tree_watched {
+	my ($output) = @_;
+	my $error = $output->{error};
+	if ($retry > 0 and $error and $error =~ m/unable to resolve root .* directory (.*) is not watched/) {
+		$retry--;
+		my $response = qx/watchman watch "$git_work_tree"/;
+		die "Failed to make watchman watch '$git_work_tree'.\n" .
+		    "Falling back to scanning...\n" if $? != 0;
+		$output = $json_pkg->new->utf8->decode($response);
+		$error = $output->{error};
+		die "Watchman: $error.\n" .
+		"Falling back to scanning...\n" if $error;
+
+		# Uncomment for debugging watchman output
+		# open (my $fh, ">", ".git/watchman-output.out");
+		# close $fh;
+
+		# Watchman will always return all files on the first query so
+		# return the fast "everything is dirty" flag to git and do the
+		# Watchman query just to get it over with now so we won't pay
+		# the cost in git to look up each individual file.
+		my $o = watchman_clock();
+		$error = $output->{error};
+
+		die "Watchman: $error.\n" .
+		"Falling back to scanning...\n" if $error;
+
+		output_result($o->{clock}, ("/"));
+		$last_update_token = $o->{clock};
+
+		eval { launch_watchman() };
+		return 0;
+	}
+
+	die "Watchman: $error.\n" .
+	"Falling back to scanning...\n" if $error;
+
+	return 1;
+}
+
+sub get_working_dir {
+	my $working_dir;
+	if ($^O =~ 'msys' || $^O =~ 'cygwin') {
+		$working_dir = Win32::GetCwd();
+		$working_dir =~ tr/\\/\//;
+	} else {
+		require Cwd;
+		$working_dir = Cwd::cwd();
+	}
+
+	return $working_dir;
+}

package/lib/bmad-cache/bmb/_git_preserved/hooks/post-update.sample

@@ -0,0 +1,8 @@
+#!/bin/sh
+#
+# An example hook script to prepare a packed repository for use over
+# dumb transports.
+#
+# To enable this hook, rename this file to "post-update".
+
+exec git update-server-info

package/lib/bmad-cache/bmb/_git_preserved/hooks/pre-applypatch.sample

@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed
+# by applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.
+#
+# To enable this hook, rename this file to "pre-applypatch".
+
+. git-sh-setup
+precommit="$(git rev-parse --git-path hooks/pre-commit)"
+test -x "$precommit" && exec "$precommit" ${1+"$@"}
+:

package/lib/bmad-cache/bmb/_git_preserved/hooks/pre-commit.sample

@@ -0,0 +1,49 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed.
+# Called by "git commit" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message if
+# it wants to stop the commit.
+#
+# To enable this hook, rename this file to "pre-commit".
+
+if git rev-parse --verify HEAD >/dev/null 2>&1
+then
+	against=HEAD
+else
+	# Initial commit: diff against an empty tree object
+	against=$(git hash-object -t tree /dev/null)
+fi
+
+# If you want to allow non-ASCII filenames set this variable to true.
+allownonascii=$(git config --type=bool hooks.allownonascii)
+
+# Redirect output to stderr.
+exec 1>&2
+
+# Cross platform projects tend to avoid non-ASCII filenames; prevent
+# them from being added to the repository. We exploit the fact that the
+# printable range starts at the space character and ends with tilde.
+if [ "$allownonascii" != "true" ] &&
+	# Note that the use of brackets around a tr range is ok here, (it's
+	# even required, for portability to Solaris 10's /usr/bin/tr), since
+	# the square bracket bytes happen to fall in the designated range.
+	test $(git diff-index --cached --name-only --diff-filter=A -z $against |
+	  LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
+then
+	cat <<\EOF
+Error: Attempt to add a non-ASCII file name.
+
+This can cause problems if you want to work with people on other platforms.
+
+To be portable it is advisable to rename the file.
+
+If you know what you are doing you can disable this check using:
+
+  git config hooks.allownonascii true
+EOF
+	exit 1
+fi
+
+# If there are whitespace errors, print the offending file names and fail.
+exec git diff-index --check --cached $against --

package/lib/bmad-cache/bmb/_git_preserved/hooks/pre-merge-commit.sample

@@ -0,0 +1,13 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed.
+# Called by "git merge" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message to
+# stderr if it wants to stop the merge commit.
+#
+# To enable this hook, rename this file to "pre-merge-commit".
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/pre-commit" &&
+        exec "$GIT_DIR/hooks/pre-commit"
+:

package/lib/bmad-cache/bmb/_git_preserved/hooks/pre-push.sample

@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# An example hook script to verify what is about to be pushed.  Called by "git
+# push" after it has checked the remote status, but before anything has been
+# pushed.  If this script exits with a non-zero status nothing will be pushed.
+#
+# This hook is called with the following parameters:
+#
+# $1 -- Name of the remote to which the push is being done
+# $2 -- URL to which the push is being done
+#
+# If pushing without using a named remote those arguments will be equal.
+#
+# Information about the commits which are being pushed is supplied as lines to
+# the standard input in the form:
+#
+#   <local ref> <local oid> <remote ref> <remote oid>
+#
+# This sample shows how to prevent push of commits where the log message starts
+# with "WIP" (work in progress).
+
+remote="$1"
+url="$2"
+
+zero=$(git hash-object --stdin </dev/null | tr '[0-9a-f]' '0')
+
+while read local_ref local_oid remote_ref remote_oid
+do
+	if test "$local_oid" = "$zero"
+	then
+		# Handle delete
+		:
+	else
+		if test "$remote_oid" = "$zero"
+		then
+			# New branch, examine all commits
+			range="$local_oid"
+		else
+			# Update to existing branch, examine new commits
+			range="$remote_oid..$local_oid"
+		fi
+
+		# Check for WIP commit
+		commit=$(git rev-list -n 1 --grep '^WIP' "$range")
+		if test -n "$commit"
+		then
+			echo >&2 "Found WIP commit in $local_ref, not pushing"
+			exit 1
+		fi
+	fi
+done
+
+exit 0