ma-agents 3.13.2 → 3.14.0

package/lib/bmad-cache/bmb/skills/bmad-workflow-builder/scripts/tests/test_render_report.py

@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""Tests for scripts/render_report.py — the deterministic report renderer.
+
+Covers: valid island injection, refusal on malformed JSON, refusal on the
+placeholder subject, the --md archival rendering, and that both shipped
+shells carry a parseable placeholder island.
+Run with: python3 -m pytest test_render_report.py
+(or plain `python3 test_render_report.py` for a lightweight self-check).
+"""
+import json
+import re
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+SKILLS_DIR = Path(__file__).resolve().parents[3]
+SCRIPT = SKILLS_DIR / "bmad-workflow-builder" / "scripts" / "render_report.py"
+SHELLS = [
+    SKILLS_DIR / "bmad-workflow-builder" / "assets" / "report-shell.html",
+    SKILLS_DIR / "bmad-agent-builder" / "assets" / "report-shell.html",
+]
+ISLAND_RE = re.compile(
+    r'<script[^>]*\bid="report-data"[^>]*>(.*?)</script>', re.DOTALL
+)
+
+VALID_DATA = {
+    "schema_version": 2,
+    "subject": "skills/example-skill",
+    "generated": "2026-06-10",
+    "verdict": "One ceremony section; otherwise sound.",
+    "grade": "good",
+    "summary": "Solid structure and clean wiring. The main opportunity is one over-scripted reference.",
+    "standards": {
+        "canon": "/abs/skills/bmad-workflow-builder/references/prompt-quality-canon.md",
+        "principles": "/abs/skills/bmad-workflow-builder/references/skill-quality-principles.md",
+        "scripts": "/abs/skills/bmad-workflow-builder/references/script-standards.md",
+    },
+    "themes": [
+        {
+            "title": "Scripted sequences where goals suffice",
+            "root_cause": "Steps are numbered without true ordering dependencies.",
+            "finding_ids": ["leanness-1"],
+            "action": "Replace ordered lists with goal sentences.",
+        }
+    ],
+    "strengths": ["Frontmatter and routing map are exemplary."],
+    "recommendations": [
+        {"rank": 1, "action": "De-script the finalize section.", "resolves": ["leanness-1"]}
+    ],
+    "findings": [
+        {
+            "id": "leanness-1",
+            "lens": "leanness",
+            "severity": "high",
+            "title": "Numbered finalize steps are decoration",
+            "location": "references/build-process.md:finalize",
+            "evidence": "No step depends on a prior step's output.",
+            "recommendation": "Replace with a single goal sentence.",
+        }
+    ],
+}
+
+
+def run_render(args):
+    return subprocess.run(
+        [sys.executable, str(SCRIPT), *[str(a) for a in args]],
+        capture_output=True,
+        text=True,
+    )
+
+
+def test_valid_island_injection():
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp = Path(tmp)
+        findings = tmp / "findings.json"
+        out = tmp / "report.html"
+        findings.write_text(json.dumps(VALID_DATA), encoding="utf-8")
+
+        result = run_render([findings, "--shell", SHELLS[0], "-o", out])
+        assert result.returncode == 0, result.stderr
+        html = out.read_text(encoding="utf-8")
+
+        match = ISLAND_RE.search(html)
+        assert match, "rendered HTML has no report-data island"
+        island = json.loads(match.group(1))
+        assert island["subject"] == "skills/example-skill"
+        assert island["findings"][0]["id"] == "leanness-1"
+        assert island["standards"]["canon"].endswith("prompt-quality-canon.md")
+        assert "__PLACEHOLDER__" not in match.group(1)
+
+        stdout = json.loads(result.stdout)
+        assert stdout["counts"] == {"critical": 0, "high": 1, "medium": 0, "low": 0}
+        assert stdout["grade"] == "good"
+
+
+def test_refuses_bad_json():
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp = Path(tmp)
+        findings = tmp / "findings.json"
+        out = tmp / "report.html"
+        findings.write_text("{ this is not json", encoding="utf-8")
+
+        result = run_render([findings, "--shell", SHELLS[0], "-o", out])
+        assert result.returncode != 0
+        assert "not valid JSON" in result.stderr
+        assert not out.exists(), "refused render must not write output"
+
+
+def test_refuses_placeholder_subject():
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp = Path(tmp)
+        findings = tmp / "findings.json"
+        out = tmp / "report.html"
+        data = dict(VALID_DATA, subject="__PLACEHOLDER__")
+        findings.write_text(json.dumps(data), encoding="utf-8")
+
+        result = run_render([findings, "--shell", SHELLS[0], "-o", out])
+        assert result.returncode != 0
+        assert "placeholder" in result.stderr.lower()
+        assert not out.exists(), "refused render must not write output"
+
+
+def test_md_output():
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp = Path(tmp)
+        findings = tmp / "findings.json"
+        out = tmp / "report.html"
+        md = tmp / "report.md"
+        findings.write_text(json.dumps(VALID_DATA), encoding="utf-8")
+
+        result = run_render([findings, "--shell", SHELLS[0], "-o", out, "--md", md])
+        assert result.returncode == 0, result.stderr
+        text = md.read_text(encoding="utf-8")
+        assert "# Analysis Report: skills/example-skill" in text
+        assert "**Grade: Good**" in text
+        assert "## Themes" in text
+        assert "Scripted sequences where goals suffice" in text
+        assert "## Strengths" in text
+        assert "## Recommendations" in text
+        assert "### High (1)" in text
+        assert "leanness-1" in text
+
+
+def test_shipped_shells_carry_placeholder_island():
+    for shell in SHELLS:
+        match = ISLAND_RE.search(shell.read_text(encoding="utf-8"))
+        assert match, f"{shell} has no report-data island"
+        island = json.loads(match.group(1))
+        assert island["subject"] == "__PLACEHOLDER__", (
+            f"{shell} ships a non-placeholder island; a failed injection "
+            "would show its contents as real findings"
+        )
+        assert island["findings"] == []
+
+
+def test_render_script_copies_identical():
+    other = SKILLS_DIR / "bmad-agent-builder" / "scripts" / "render_report.py"
+    assert SCRIPT.read_bytes() == other.read_bytes(), (
+        "render_report.py copies have drifted between the two builder skills"
+    )
+
+
+if __name__ == "__main__":
+    test_valid_island_injection()
+    test_refuses_bad_json()
+    test_refuses_placeholder_subject()
+    test_md_output()
+    test_shipped_shells_carry_placeholder_island()
+    test_render_script_copies_identical()
+    print("ok: render_report tests passed")

package/lib/bmad-cache/cache-manifest.json

@@ -1,6 +1,6 @@
 {
-  "generated": "2026-06-13T15:11:45.601Z",
-  "bmadMethodVersion": "6.8.0",
+  "generated": "2026-06-27T14:28:18.113Z",
+  "bmadMethodVersion": "6.9.0",
   "registrySchema": "package-root-v68",
   "modules": {
     "tea": {
@@ -12,8 +12,8 @@
     "bmb": {
       "url": "https://github.com/bmad-code-org/bmad-builder",
       "branch": "main",
-      "commitSha": "7cfa7711778f04c5df56f7ae895fabc942fd920c",
-      "clonedAt": "2026-06-13T15:11:41.069Z"
+      "commitSha": "e6935f2776c34ffd9b18f4ef1e334584ef10a50f",
+      "clonedAt": "2026-06-27T14:28:16.693Z"
     },
     "cis": {
       "url": "https://github.com/bmad-code-org/bmad-module-creative-intelligence-suite",

package/lib/bmad-extension/.claude-plugin/marketplace.json.template

@@ -39,7 +39,7 @@
     "roo-code",
     "kilocode"
   ],
-  "bmad_min_version": "6.8.0",
+  "bmad_min_version": "6.9.0",
   "plugins": [
     {
       "name": "ma-skills",

package/lib/bmad-extension-plugin/.claude-plugin/marketplace.json

@@ -31,13 +31,13 @@
     "roo-code",
     "kilocode"
   ],
-  "bmad_min_version": "6.8.0",
+  "bmad_min_version": "6.9.0",
   "plugins": [
     {
       "name": "ma-skills",
       "source": "./",
       "description": "ma-agents extension module providing enterprise SDLC personas and operational workflow skills.",
-      "version": "3.13.2",
+      "version": "3.14.0",
       "author": {
         "name": "Alon Mayaffit"
       },

package/lib/bmad.js

@@ -2127,7 +2127,7 @@ function ensureCanonicalConfigLocation(projectRoot) {
 
 // ── Migration constants ─────────────────────────────────────────────────────
 
-const BMAD_TARGET_VERSION = '6.8.0';
+const BMAD_TARGET_VERSION = '6.9.0';
 const BMAD_MIGRATION_THRESHOLD = '6.2.0'; // versions below this need migration
 const BACKUP_DIR_NAME = '.backup-pre-migration';
 
@@ -3145,6 +3145,11 @@ module.exports = {
     looksLikeEbusyFailure,
     inspectBmadCache,
     classifyRecompileFailure,
+    // Shared subprocess primitive (exported for testing — Story 28.2 / FR212:
+    // the install/update/migration success-or-failure decision rides on whether
+    // this throws on a non-zero exit, NOT on parsing installer stdout, so the
+    // v6.9.0 warn-only `uv` banner cannot affect it).
+    runCommand,
     // Module selection — replaces hardcoded ['bmm'] in the CLI install path
     BMAD_MODULE_DESCRIPTIONS,
     getInstallableBmadModules,

package/lib/templates/instruction-block-git.template.md

@@ -1,25 +1,25 @@
-## Git Workflow (ALL file-changing tasks)
-
-These rules apply to EVERY task that modifies a tracked file. There is no
-"small fix exemption" — a one-line edit follows the same workflow as a feature.
-
-- **Worktree first.** Before changing any file, create a fresh isolated worktree
-  on a new feature branch: `git worktree add ../<project>-<branch> -b <branch>`.
-  The scripted form is `skills/git-workflow-skill/scripts/start-feature.sh`. All
-  file-writing happens inside that worktree — never in the main working tree.
-- **Never commit directly to the trunk.** Do NOT commit to `main`, `dev`,
-  `master`, or whatever the trunk branch is. Commits land only on your feature
-  branch inside the worktree.
-- **Conventional Commits.** Every commit message uses a Conventional Commits
-  prefix. The allowed prefixes are: `feat`, `fix`, `chore`, `docs`, `refactor`,
-  `test`, `ci`.
-- **PR is the only path into the trunk.** Integrate exclusively by opening a pull
-  request with `gh pr create`. Never merge directly and never auto-merge a PR
-  without explicit human approval.
-- **Self-review before opening the PR.** Run the `code-review` skill on your own
-  changes and address its findings before you open the PR.
-- **Clean up after merge.** Once the PR is merged, remove the worktree with
-  `git worktree remove` and delete the feature branch.
-
-Full procedure: see `skills/git-workflow-skill/SKILL.md`, and the helper scripts
-`scripts/start-feature.sh` / `scripts/finish-feature.sh`.
+## Git Workflow (ALL file-changing tasks)
+
+These rules apply to EVERY task that modifies a tracked file. There is no
+"small fix exemption" — a one-line edit follows the same workflow as a feature.
+
+- **Worktree first.** Before changing any file, create a fresh isolated worktree
+  on a new feature branch: `git worktree add ../<project>-<branch> -b <branch>`.
+  The scripted form is `skills/git-workflow-skill/scripts/start-feature.sh`. All
+  file-writing happens inside that worktree — never in the main working tree.
+- **Never commit directly to the trunk.** Do NOT commit to `main`, `dev`,
+  `master`, or whatever the trunk branch is. Commits land only on your feature
+  branch inside the worktree.
+- **Conventional Commits.** Every commit message uses a Conventional Commits
+  prefix. The allowed prefixes are: `feat`, `fix`, `chore`, `docs`, `refactor`,
+  `test`, `ci`.
+- **PR is the only path into the trunk.** Integrate exclusively by opening a pull
+  request with `gh pr create`. Never merge directly and never auto-merge a PR
+  without explicit human approval.
+- **Self-review before opening the PR.** Run the `code-review` skill on your own
+  changes and address its findings before you open the PR.
+- **Clean up after merge.** Once the PR is merged, remove the worktree with
+  `git worktree remove` and delete the feature branch.
+
+Full procedure: see `skills/git-workflow-skill/SKILL.md`, and the helper scripts
+`scripts/start-feature.sh` / `scripts/finish-feature.sh`.

package/lib/templates/instruction-block-onprem.template.md

@@ -1,86 +1,86 @@
-## On-Prem / Local-LLM Guardrails
-
-These rules apply ONLY when this project is installed with `profile: on-prem`.
-They are appended to the universal block by the composer in `lib/installer.js`.
-Local LLMs (Nemotron, Qwen, DeepSeek, Llama-3, etc. served via vLLM, Ollama, or
-TGI) fail in patterns cloud LLMs rarely exhibit — the rules below pin those
-failure modes down explicitly. Keep these rules verbatim in every response
-context where tool use is possible.
-
-### Reasoning mode: `/no_think` on planning-phase prompts
-
-Local reasoning-capable models (Nemotron-variants and similar) default to
-chain-of-thought reasoning that bloats planning-phase prompts with internal
-deliberation the operator does not need to read. Prepend the literal token
-`/no_think` as the first line of any planning-phase system prompt or user turn
-you compose. The token is consumed by the serving layer and suppresses the
-model's reasoning trace on that turn.
-
-- Planning-phase turns (PM, Architect, Tech Lead): begin the turn with
-  `/no_think` on its own line. Reasoning-mode OFF.
-- Implementation-phase turns (Dev): omit `/no_think`. Reasoning-mode ON is
-  desirable for stepwise code synthesis and debugging.
-- Review / QA turns: omit `/no_think` when the review benefits from explicit
-  reasoning (root-cause analysis). Include `/no_think` for mechanical checks
-  (lint, style, formatting).
-
-If the downstream serving layer does not recognize `/no_think`, it is a no-op
-text token — safe to include unconditionally on planning turns.
-
-### No writes to `~/.claude/` or any user home directory
-
-Local LLMs frequently hallucinate paths under `~/.claude/`, `~/.cache/`,
-`~/Library/`, or `%APPDATA%` — imitating patterns learned from Claude Code and
-Cursor training data. These paths are OUTSIDE the project and cross-contaminate
-other projects on the same machine.
-
-- NEVER create, write, or modify files under `~/.claude/`, `~/.cache/`,
-  `~/Library/`, `~/AppData/`, `%APPDATA%`, or any path that resolves outside
-  the current project directory.
-- All project artifacts — code, configuration, logs, scratch notes, and agent
-  state — MUST land under the current working directory (the project root) or
-  an explicitly-named subdirectory thereof.
-- When a tool call appears to target a home-directory path, refuse the write
-  and respond in text explaining the violation. Ask the user for an explicit
-  in-project path before proceeding.
-
-### No `str_replace_editor` or Claude Code-specific tools
-
-Local LLMs hallucinate Anthropic-proprietary tools — most commonly
-`str_replace_editor`, `text_editor_20241022`, and `computer_use_preview` — that
-do NOT exist outside the Anthropic API. Calling them against a local-LLM
-serving layer produces a tool-not-found error or, worse, a silent no-op.
-
-- Do NOT emit tool calls named `str_replace_editor`, `text_editor_*`,
-  `computer_use_*`, or any other tool whose name includes `str_replace_editor`
-  or matches Anthropic-specific tool schemas.
-- Use only tools enumerated in the active tool manifest (`MANIFEST.yaml`) or
-  the IDE's native tool surface (Roo Code, Cline, OpenCode native tools).
-- When you want to edit a file, use the native file-write tool of the active
-  agent — not `str_replace_editor`. If unsure what tool is available, list
-  available tools or ask the user before emitting a tool call.
-
-### Per-phase reasoning and sampling guidance
-
-Local LLMs require tighter sampling control than cloud LLMs. Use these defaults
-unless the serving layer overrides them.
-
-- **Planning phase (PM, Architect, Tech Lead):**
-  - Reasoning: OFF (`/no_think` prepended).
-  - Temperature: low (0.0 – 0.3). Planning artifacts should be deterministic
-    and reproducible.
-  - Top-p: 0.9 or unset. Top-k: unset.
-  - Max tokens: generous (8k+) — planning documents are long.
-- **Implementation phase (Dev):**
-  - Reasoning: ON (omit `/no_think`).
-  - Temperature: moderate (0.3 – 0.6). Code synthesis benefits from controlled
-    exploration but not creative rewriting.
-  - Top-p: 0.95 or unset. Top-k: unset.
-  - Max tokens: generous (8k+) — full-file rewrites are common.
-- **Review / QA phase:**
-  - Reasoning: ON for root-cause analysis; OFF for mechanical checks.
-  - Temperature: low (0.0 – 0.2). Reviews should be deterministic.
-
-If the serving layer applies its own sampler defaults, the per-phase guidance
-above is advisory — but the phase boundary and `/no_think` placement are
-load-bearing and MUST be honored on every turn.
+## On-Prem / Local-LLM Guardrails
+
+These rules apply ONLY when this project is installed with `profile: on-prem`.
+They are appended to the universal block by the composer in `lib/installer.js`.
+Local LLMs (Nemotron, Qwen, DeepSeek, Llama-3, etc. served via vLLM, Ollama, or
+TGI) fail in patterns cloud LLMs rarely exhibit — the rules below pin those
+failure modes down explicitly. Keep these rules verbatim in every response
+context where tool use is possible.
+
+### Reasoning mode: `/no_think` on planning-phase prompts
+
+Local reasoning-capable models (Nemotron-variants and similar) default to
+chain-of-thought reasoning that bloats planning-phase prompts with internal
+deliberation the operator does not need to read. Prepend the literal token
+`/no_think` as the first line of any planning-phase system prompt or user turn
+you compose. The token is consumed by the serving layer and suppresses the
+model's reasoning trace on that turn.
+
+- Planning-phase turns (PM, Architect, Tech Lead): begin the turn with
+  `/no_think` on its own line. Reasoning-mode OFF.
+- Implementation-phase turns (Dev): omit `/no_think`. Reasoning-mode ON is
+  desirable for stepwise code synthesis and debugging.
+- Review / QA turns: omit `/no_think` when the review benefits from explicit
+  reasoning (root-cause analysis). Include `/no_think` for mechanical checks
+  (lint, style, formatting).
+
+If the downstream serving layer does not recognize `/no_think`, it is a no-op
+text token — safe to include unconditionally on planning turns.
+
+### No writes to `~/.claude/` or any user home directory
+
+Local LLMs frequently hallucinate paths under `~/.claude/`, `~/.cache/`,
+`~/Library/`, or `%APPDATA%` — imitating patterns learned from Claude Code and
+Cursor training data. These paths are OUTSIDE the project and cross-contaminate
+other projects on the same machine.
+
+- NEVER create, write, or modify files under `~/.claude/`, `~/.cache/`,
+  `~/Library/`, `~/AppData/`, `%APPDATA%`, or any path that resolves outside
+  the current project directory.
+- All project artifacts — code, configuration, logs, scratch notes, and agent
+  state — MUST land under the current working directory (the project root) or
+  an explicitly-named subdirectory thereof.
+- When a tool call appears to target a home-directory path, refuse the write
+  and respond in text explaining the violation. Ask the user for an explicit
+  in-project path before proceeding.
+
+### No `str_replace_editor` or Claude Code-specific tools
+
+Local LLMs hallucinate Anthropic-proprietary tools — most commonly
+`str_replace_editor`, `text_editor_20241022`, and `computer_use_preview` — that
+do NOT exist outside the Anthropic API. Calling them against a local-LLM
+serving layer produces a tool-not-found error or, worse, a silent no-op.
+
+- Do NOT emit tool calls named `str_replace_editor`, `text_editor_*`,
+  `computer_use_*`, or any other tool whose name includes `str_replace_editor`
+  or matches Anthropic-specific tool schemas.
+- Use only tools enumerated in the active tool manifest (`MANIFEST.yaml`) or
+  the IDE's native tool surface (Roo Code, Cline, OpenCode native tools).
+- When you want to edit a file, use the native file-write tool of the active
+  agent — not `str_replace_editor`. If unsure what tool is available, list
+  available tools or ask the user before emitting a tool call.
+
+### Per-phase reasoning and sampling guidance
+
+Local LLMs require tighter sampling control than cloud LLMs. Use these defaults
+unless the serving layer overrides them.
+
+- **Planning phase (PM, Architect, Tech Lead):**
+  - Reasoning: OFF (`/no_think` prepended).
+  - Temperature: low (0.0 – 0.3). Planning artifacts should be deterministic
+    and reproducible.
+  - Top-p: 0.9 or unset. Top-k: unset.
+  - Max tokens: generous (8k+) — planning documents are long.
+- **Implementation phase (Dev):**
+  - Reasoning: ON (omit `/no_think`).
+  - Temperature: moderate (0.3 – 0.6). Code synthesis benefits from controlled
+    exploration but not creative rewriting.
+  - Top-p: 0.95 or unset. Top-k: unset.
+  - Max tokens: generous (8k+) — full-file rewrites are common.
+- **Review / QA phase:**
+  - Reasoning: ON for root-cause analysis; OFF for mechanical checks.
+  - Temperature: low (0.0 – 0.2). Reviews should be deterministic.
+
+If the serving layer applies its own sampler defaults, the per-phase guidance
+above is advisory — but the phase boundary and `/no_think` placement are
+load-bearing and MUST be honored on every turn.

package/lib/templates/instruction-block-universal.template.md

@@ -1,29 +1,29 @@
-# AI Agent Skills - Planning Instruction
-
-You have access to a library of skills in your skills directory. Before starting any task:
-
-1. Read the skill manifest at {{MANIFEST_PATH}}
-2. Based on the task description, select which skills are relevant
-3. Read only the selected skill files
-4. Then proceed with the task
-
-Always load skills marked with always_load: true.
-Do not load skills that are not relevant to the current task.
-
-## Respond in TEXT vs. create FILES
-
-Choose your response medium deliberately. Defaulting to file creation when the user asked a question is a common failure mode — especially for coding agents running in web UIs.
-
-- **Create or modify FILES when the user's request contains file-action keywords:** `create`, `write`, `generate`, `build`, `implement` (and obvious synonyms such as `add`, `produce`, `refactor`, `fix`, `update <file>`). These signal a concrete artifact is expected.
-- **Respond in TEXT when the request contains text-response keywords:** `what do you think`, `how should we`, `discuss`, `opinion` (and obvious synonyms such as `explain`, `why`, `should I`, `compare`, `recommend`). These signal that a conversation is expected, not a deliverable.
-- **If unsure, respond in TEXT.** A text answer can always be followed by file creation on confirmation; an unwanted file cannot be cleanly undone.
-- **Never create `response.md`, `output.md`, or any similarly named scratch file as a reply.** A reply belongs in the chat transcript, not on disk.
-- **Confirm file paths before writing.** When you are about to create or modify a file whose path the user has not explicitly named, state the intended path in text and wait for confirmation, unless the path is unambiguous from the task context.
-
-## BMAD phase discipline
-
-BMAD-METHOD organizes work into declared phases (analysis, planning, architecture, story-creation, implementation, review). Respect the currently declared phase.
-
-- **Do not skip ahead to implementation during planning.** If the project is in a planning phase — or the user has asked for requirements, architecture, or a story — produce planning artifacts, not code.
-- **Do not retroactively plan after you have already coded.** If implementation has already started, flag the gap instead of fabricating back-dated planning documents.
-- The declared phase is established by the active skill, the story status, or an explicit statement from the user. When none of these is available, ask before assuming.
+# AI Agent Skills - Planning Instruction
+
+You have access to a library of skills in your skills directory. Before starting any task:
+
+1. Read the skill manifest at {{MANIFEST_PATH}}
+2. Based on the task description, select which skills are relevant
+3. Read only the selected skill files
+4. Then proceed with the task
+
+Always load skills marked with always_load: true.
+Do not load skills that are not relevant to the current task.
+
+## Respond in TEXT vs. create FILES
+
+Choose your response medium deliberately. Defaulting to file creation when the user asked a question is a common failure mode — especially for coding agents running in web UIs.
+
+- **Create or modify FILES when the user's request contains file-action keywords:** `create`, `write`, `generate`, `build`, `implement` (and obvious synonyms such as `add`, `produce`, `refactor`, `fix`, `update <file>`). These signal a concrete artifact is expected.
+- **Respond in TEXT when the request contains text-response keywords:** `what do you think`, `how should we`, `discuss`, `opinion` (and obvious synonyms such as `explain`, `why`, `should I`, `compare`, `recommend`). These signal that a conversation is expected, not a deliverable.
+- **If unsure, respond in TEXT.** A text answer can always be followed by file creation on confirmation; an unwanted file cannot be cleanly undone.
+- **Never create `response.md`, `output.md`, or any similarly named scratch file as a reply.** A reply belongs in the chat transcript, not on disk.
+- **Confirm file paths before writing.** When you are about to create or modify a file whose path the user has not explicitly named, state the intended path in text and wait for confirmation, unless the path is unambiguous from the task context.
+
+## BMAD phase discipline
+
+BMAD-METHOD organizes work into declared phases (analysis, planning, architecture, story-creation, implementation, review). Respect the currently declared phase.
+
+- **Do not skip ahead to implementation during planning.** If the project is in a planning phase — or the user has asked for requirements, architecture, or a story — produce planning artifacts, not code.
+- **Do not retroactively plan after you have already coded.** If implementation has already started, flag the gap instead of fabricating back-dated planning documents.
+- The declared phase is established by the active skill, the story status, or an explicit statement from the user. When none of these is available, ask before assuming.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ma-agents",
-  "version": "3.13.2",
+  "version": "3.14.0",
   "description": "NPX tool to install skills for AI coding agents (Claude Code, Gemini, Copilot, Kilocode, Cline, Cursor, Roo Code)",
   "main": "index.js",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "start": "node bin/cli.js",
-    "test": "node test/yes-flag.test.js && node test/skill-authoring.test.js && node test/skill-validation.test.js && node test/skill-mandatory.test.js && node test/skill-customize-agent.test.js && node test/create-agent.test.js && node test/generate-project-context.test.js && node test/build-bmad-args.test.js && node test/build-bmad-cache-reader.test.js && node test/bmad-version-bump.test.js && node test/extension-module-restructure.test.js && node test/convert-agents-to-skills.test.js && node test/migration.test.js && node test/migration-validation.test.js && node test/story-15-5-workflow-skills.test.js && node test/repo-layout.test.js && node test/config-storage.test.js && node test/cross-repo-validation.test.js && node test/config-lost-on-update.test.js && node test/portable-paths.test.js && node test/cicd-remote-mode.test.js && node test/config-layout.test.js && node test/roo-code-agent.test.js && node test/roo-code-injection.test.js && node test/profile.test.js && node test/instruction-block.test.js && node test/instruction-injection.test.js && node test/agents-md.test.js && node test/instruction-block-git.test.js && node test/onprem-injection.test.js && node test/onprem-layer.test.js && node test/copilot-instructions-path.test.js && node test/roomodes.test.js && node test/clinerules.test.js && node test/cline-workflow-reconciliation.test.js && node test/reconfigure.test.js && node test/experimental-warning.test.js && node test/bmad-persona-phase-prefix.test.js && node test/f1a-on-prem-prefix-post-install.test.js && node test/retired-skills-migration.test.js && node test/rename-migration.test.js && node test/uninstall.test.js && node test/offline-recompile.test.js && node test/plugin-manifests.test.js && node test/build-plugin.test.js && node test/config-path-migration.test.js && node test/gitignore-plugin-stage.test.js && node test/customizations-translation.test.js && node test/routing-parity.test.js && node test/bmad-extension.test.js && node test/integration-verification.test.js && node test/agent-scope.test.js && node test/obsolete-tool-dirs.test.js && node test/bmad-empty-tools-guard.test.js && node test/v68-pluginresolver-enumeration-passthrough.test.js && node test/agents.test.js && node test/installer.test.js && node test/bmad.test.js && node test/cli.test.js",
+    "test": "node test/yes-flag.test.js && node test/skill-authoring.test.js && node test/skill-validation.test.js && node test/skill-mandatory.test.js && node test/skill-customize-agent.test.js && node test/create-agent.test.js && node test/generate-project-context.test.js && node test/build-bmad-args.test.js && node test/build-bmad-cache-reader.test.js && node test/bmad-version-bump.test.js && node test/uv-transition-resilience.test.js && node test/passthrough-reconciliation-6-9-0.test.js && node test/extension-module-restructure.test.js && node test/convert-agents-to-skills.test.js && node test/migration.test.js && node test/migration-validation.test.js && node test/story-15-5-workflow-skills.test.js && node test/repo-layout.test.js && node test/config-storage.test.js && node test/cross-repo-validation.test.js && node test/config-lost-on-update.test.js && node test/portable-paths.test.js && node test/cicd-remote-mode.test.js && node test/config-layout.test.js && node test/roo-code-agent.test.js && node test/roo-code-injection.test.js && node test/profile.test.js && node test/instruction-block.test.js && node test/instruction-injection.test.js && node test/agents-md.test.js && node test/instruction-block-git.test.js && node test/onprem-injection.test.js && node test/onprem-layer.test.js && node test/copilot-instructions-path.test.js && node test/roomodes.test.js && node test/clinerules.test.js && node test/cline-workflow-reconciliation.test.js && node test/reconfigure.test.js && node test/experimental-warning.test.js && node test/bmad-persona-phase-prefix.test.js && node test/f1a-on-prem-prefix-post-install.test.js && node test/retired-skills-migration.test.js && node test/rename-migration.test.js && node test/uninstall.test.js && node test/offline-recompile.test.js && node test/plugin-manifests.test.js && node test/build-plugin.test.js && node test/config-path-migration.test.js && node test/gitignore-plugin-stage.test.js && node test/customizations-translation.test.js && node test/routing-parity.test.js && node test/bmad-extension.test.js && node test/integration-verification.test.js && node test/agent-scope.test.js && node test/obsolete-tool-dirs.test.js && node test/bmad-empty-tools-guard.test.js && node test/v68-pluginresolver-enumeration-passthrough.test.js && node test/agents.test.js && node test/installer.test.js && node test/bmad.test.js && node test/cli.test.js",
     "build:bmad-cache": "node scripts/build-bmad-cache.js",
     "build:plugin": "node scripts/build-plugin.js",
     "prepare": "node scripts/build-plugin.js",
@@ -30,7 +30,7 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "bmad-method": "6.8.0",
+    "bmad-method": "6.9.0",
     "chalk": "^4.1.2",
     "fs-extra": "^11.1.1",
     "js-yaml": "^4.1.1",