ma-agents 3.13.2 → 3.14.1

package/lib/bmad-cache/bmb/skills/bmad-eval-runner/scripts/tests/test_env_isolation.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Guard the clean-room env contract in run_evals.py and run_triggers.py.
+
+The eval result is only honest if nothing from the host shell leaks into the
+subprocess. Both scripts carry their own build_case_env (they are
+deliberately self-contained); this test pins the contract on both copies:
+exactly PATH + fresh HOME + CLAUDE_CONFIG_DIR + auth-var-only-when-set +
+declared passthrough keys, nothing else.
+Run with: python3 -m pytest test_env_isolation.py
+(or plain `python3 test_env_isolation.py` for a lightweight self-check).
+"""
+import sys
+from pathlib import Path
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SCRIPTS_DIR))
+
+import run_evals  # noqa: E402
+import run_triggers  # noqa: E402
+
+BUILDERS = [run_evals.build_case_env, run_triggers.build_case_env]
+
+HOST_ENV = {
+    "PATH": "/usr/bin:/bin",
+    "HOME": "/Users/host",
+    "ANTHROPIC_API_KEY": "sk-test-123",
+    "AWS_SECRET_ACCESS_KEY": "host-secret-must-not-leak",
+    "CLAUDE_CONFIG_DIR": "/Users/host/.claude",
+    "EXTRA_VAR": "extra",
+}
+
+HOME = Path("/tmp/eval-case/.home")
+
+
+def test_minimal_env_keys():
+    adapter = {"auth_env": "ANTHROPIC_API_KEY"}
+    for build in BUILDERS:
+        env = build(adapter, HOME, HOST_ENV)
+        assert set(env) == {"PATH", "HOME", "CLAUDE_CONFIG_DIR",
+                            "ANTHROPIC_API_KEY"}, (build.__module__, env)
+        assert env["PATH"] == HOST_ENV["PATH"]
+        assert env["HOME"] == str(HOME), "HOME must be the fresh case home"
+        assert env["CLAUDE_CONFIG_DIR"] == str(HOME / ".claude")
+        assert env["ANTHROPIC_API_KEY"] == "sk-test-123"
+        assert "AWS_SECRET_ACCESS_KEY" not in env, "host secrets leaked"
+
+
+def test_auth_var_absent_when_unset():
+    # Setting auth to "" breaks the runtime's OAuth fallback — the key must
+    # be absent, never empty.
+    adapter = {"auth_env": "ANTHROPIC_API_KEY"}
+    for host in ({}, {"ANTHROPIC_API_KEY": ""}):
+        for build in BUILDERS:
+            env = build(adapter, HOME, {"PATH": "/bin", **host})
+            assert "ANTHROPIC_API_KEY" not in env, (build.__module__, env)
+
+
+def test_no_adapter_still_minimal():
+    for build in BUILDERS:
+        env = build(None, HOME, HOST_ENV)
+        assert set(env) == {"PATH", "HOME", "CLAUDE_CONFIG_DIR"}, env
+
+
+def test_env_passthrough_only_declared_and_present():
+    adapter = {"auth_env": "ANTHROPIC_API_KEY",
+               "env_passthrough": ["EXTRA_VAR", "NOT_SET_ON_HOST"]}
+    for build in BUILDERS:
+        env = build(adapter, HOME, HOST_ENV)
+        assert env.get("EXTRA_VAR") == "extra"
+        assert "NOT_SET_ON_HOST" not in env
+        assert "AWS_SECRET_ACCESS_KEY" not in env
+
+
+if __name__ == "__main__":
+    test_minimal_env_keys()
+    test_auth_var_absent_when_unset()
+    test_no_adapter_still_minimal()
+    test_env_passthrough_only_declared_and_present()
+    print("ok: build_case_env contract holds in run_evals and run_triggers")

package/lib/bmad-cache/bmb/skills/bmad-eval-runner/scripts/tests/test_trigger_detection.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""Guard trigger detection in run_triggers.py.
+
+The stream-json init event lists every discovered skill by name, so any
+detection that substring-matches the whole transcript reports a 100% trigger
+rate. These tests pin the rule: only tool_use events (a Skill call naming the
+synthetic skill, or a Read inside its directory) count as a load, and
+substring-style load signals are rejected outright.
+Run with: python3 -m pytest test_trigger_detection.py
+(or plain `python3 test_trigger_detection.py` for a lightweight self-check).
+"""
+import json
+import sys
+from pathlib import Path
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SCRIPTS_DIR))
+
+from run_triggers import detect_load, validate_load_signal  # noqa: E402
+
+NAME = "my-skill-trig-abc12345"
+
+
+def line(obj) -> str:
+    return json.dumps(obj)
+
+
+def init_event() -> str:
+    # Claude Code's init event advertises every discovered skill.
+    return line({"type": "system", "subtype": "init",
+                 "tools": ["Skill", "Read", "Bash"],
+                 "slash_commands": [], "skills": [NAME, "other-skill"]})
+
+
+def assistant(content) -> str:
+    return line({"type": "assistant", "message": {"content": content}})
+
+
+def test_init_event_alone_is_not_a_load():
+    transcript = "\n".join([
+        init_event(),
+        assistant([{"type": "text", "text": "I can't help with that."}]),
+        line({"type": "result", "usage": {}}),
+    ])
+    assert detect_load(transcript, {}, NAME) is False
+
+
+def test_text_mention_is_not_a_load():
+    transcript = assistant(
+        [{"type": "text", "text": f"There is a skill called {NAME} available."}])
+    assert detect_load(transcript, {}, NAME) is False
+
+
+def test_skill_tool_call_is_a_load():
+    transcript = "\n".join([
+        init_event(),
+        assistant([{"type": "tool_use", "name": "Skill",
+                    "input": {"skill": NAME}}]),
+    ])
+    assert detect_load(transcript, {}, NAME) is True
+
+
+def test_read_of_synthetic_skill_md_is_a_load():
+    transcript = "\n".join([
+        init_event(),
+        assistant([{"type": "tool_use", "name": "Read",
+                    "input": {"file_path":
+                              f"/tmp/stage/.claude/skills/{NAME}/SKILL.md"}}]),
+    ])
+    assert detect_load(transcript, {}, NAME) is True
+
+
+def test_unrelated_tool_calls_are_not_a_load():
+    transcript = "\n".join([
+        init_event(),
+        assistant([{"type": "tool_use", "name": "Read",
+                    "input": {"file_path": "/tmp/stage/notes.md"}}]),
+        assistant([{"type": "tool_use", "name": "Skill",
+                    "input": {"skill": "other-skill"}}]),
+        assistant([{"type": "tool_use", "name": "Bash",
+                    "input": {"command": f"echo {NAME}"}}]),
+    ])
+    assert detect_load(transcript, {}, NAME) is False
+
+
+def test_custom_tool_names_from_load_signal():
+    sig = {"skill_tool": "InvokeSkill", "read_tool": "OpenFile"}
+    hit = assistant([{"type": "tool_use", "name": "InvokeSkill",
+                      "input": {"name": NAME}}])
+    miss = assistant([{"type": "tool_use", "name": "Skill",
+                       "input": {"skill": NAME}}])
+    assert detect_load(hit, sig, NAME) is True
+    assert detect_load(miss, sig, NAME) is False, \
+        "default tool name must not fire when the adapter renames it"
+
+
+def test_garbage_lines_do_not_crash():
+    transcript = "not json\n\n{\"type\": 42}\n[1,2,3]\n"
+    assert detect_load(transcript, {}, NAME) is False
+
+
+def test_string_load_signal_rejected():
+    for fn, args in ((validate_load_signal, ({"type": "string"},)),
+                     (detect_load, ("", {"type": "string"}, NAME))):
+        try:
+            fn(*args)
+        except ValueError:
+            pass
+        else:
+            raise AssertionError(
+                f"{fn.__name__} accepted a substring load_signal")
+
+
+if __name__ == "__main__":
+    test_init_event_alone_is_not_a_load()
+    test_text_mention_is_not_a_load()
+    test_skill_tool_call_is_a_load()
+    test_read_of_synthetic_skill_md_is_a_load()
+    test_unrelated_tool_calls_are_not_a_load()
+    test_custom_tool_names_from_load_signal()
+    test_garbage_lines_do_not_crash()
+    test_string_load_signal_rejected()
+    print("ok: trigger detection counts tool calls only; substring rejected")

package/lib/bmad-cache/bmb/skills/bmad-module-builder/scripts/tests/test-validate-module.py

@@ -235,8 +235,14 @@ def test_short_row_does_not_crash():
 def create_standalone_module(tmp: Path, skill_name: str = "my-skill",
                              csv_rows: str = "", yaml_content: str = "",
                              include_setup_md: bool = True,
-                             include_merge_scripts: bool = True) -> Path:
-    """Create a minimal standalone module structure for testing."""
+                             include_merge_scripts: bool = True,
+                             merge_script_style: str = "dash") -> Path:
+    """Create a minimal standalone module structure for testing.
+
+    ``merge_script_style`` selects the merge-script naming form: "dash" for the
+    scaffolder default (merge-config.py) or "underscore" for the importable form
+    (merge_config.py). Both are valid.
+    """
     module_dir = tmp / "module"
     module_dir.mkdir()
 
@@ -259,8 +265,12 @@ def create_standalone_module(tmp: Path, skill_name: str = "my-skill",
     if include_merge_scripts:
         scripts = skill / "scripts"
         scripts.mkdir()
-        (scripts / "merge-config.py").write_text("# merge-config\n")
-        (scripts / "merge-help-csv.py").write_text("# merge-help-csv\n")
+        if merge_script_style == "underscore":
+            (scripts / "merge_config.py").write_text("# merge_config\n")
+            (scripts / "merge_help_csv.py").write_text("# merge_help_csv\n")
+        else:
+            (scripts / "merge-config.py").write_text("# merge-config\n")
+            (scripts / "merge-help-csv.py").write_text("# merge-help-csv\n")
 
     return module_dir
 
@@ -319,6 +329,70 @@ def test_standalone_csv_validation():
         assert "DT" in dupes[0]["message"]
 
 
+def test_standalone_underscore_merge_scripts():
+    """Importable underscore-named merge scripts (merge_config.py) should pass."""
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp = Path(tmp)
+        module_dir = create_standalone_module(tmp, merge_script_style="underscore")
+
+        code, data = run_validate(module_dir)
+        assert code == 0, f"Expected pass: {data}"
+        assert data["status"] == "pass"
+        assert data["info"].get("standalone") is True
+        assert data["summary"]["total_findings"] == 0
+
+
+def test_standalone_cross_module_before_after_ref():
+    """Bare (colon-less) preceded-by/followed-by refs are cross-module positional, not flagged."""
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp = Path(tmp)
+        csv_rows = ('Test Module,my-skill,Do Thing,DT,Does thing,,,anytime,'
+                    'bmad-sprint-planning,bmad-retrospective,false,output_folder,artifact\n')
+        module_dir = create_standalone_module(tmp, csv_rows=csv_rows)
+
+        code, data = run_validate(module_dir)
+        assert code == 0, f"Expected pass: {data}"
+        refs = [f for f in data["findings"] if f["category"] == "invalid-ref"]
+        assert refs == [], f"Cross-module bare refs should not be flagged: {refs}"
+
+
+def test_standalone_given_skill_dir_directly():
+    """Passing the standalone skill directory itself (not its parent) should work."""
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp = Path(tmp)
+        module_dir = create_standalone_module(tmp, skill_name="my-skill")
+        skill_dir = module_dir / "my-skill"
+
+        code, data = run_validate(skill_dir)
+        assert code == 0, f"Expected pass: {data}"
+        assert data["status"] == "pass"
+        assert data["info"].get("standalone") is True
+        assert data["info"].get("skill_dir") == "my-skill"
+
+
+def test_standalone_skill_dir_orphan_not_masked_by_sibling():
+    """Validating a skill dir directly must still flag a CSV skill that only
+    exists as an unrelated sibling directory (not part of this standalone module)."""
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp = Path(tmp)
+        csv_rows = (
+            'Test Module,my-skill,Do Thing,DT,Does thing,run,,anytime,,,false,output_folder,artifact\n'
+            'Test Module,other-skill,Other,OT,Other thing,run,,anytime,,,false,output_folder,report\n'
+        )
+        module_dir = create_standalone_module(tmp, skill_name="my-skill", csv_rows=csv_rows)
+        # A sibling skill dir next to the standalone skill (a different module).
+        sibling = module_dir / "other-skill"
+        sibling.mkdir()
+        (sibling / "SKILL.md").write_text("---\nname: other-skill\n---\n# other-skill\n")
+
+        skill_dir = module_dir / "my-skill"
+        code, data = run_validate(skill_dir)
+        assert code == 1, f"Orphan entry should fail validation: {data}"
+        orphans = [f for f in data["findings"] if f["category"] == "orphan-entry"]
+        assert any("other-skill" in f["message"] for f in orphans), \
+            f"Sibling skill must not mask the orphan: {data['findings']}"
+
+
 def test_multi_skill_not_detected_as_standalone():
     """A folder with two skills and no setup skill should fail (not detected as standalone)."""
     with tempfile.TemporaryDirectory() as tmp:
@@ -367,6 +441,10 @@ if __name__ == "__main__":
         test_standalone_missing_module_setup_md,
         test_standalone_missing_merge_scripts,
         test_standalone_csv_validation,
+        test_standalone_underscore_merge_scripts,
+        test_standalone_cross_module_before_after_ref,
+        test_standalone_given_skill_dir_directly,
+        test_standalone_skill_dir_orphan_not_masked_by_sibling,
         test_multi_skill_not_detected_as_standalone,
         test_nonexistent_directory,
     ]

package/lib/bmad-cache/bmb/skills/bmad-module-builder/scripts/validate-module.py

@@ -51,7 +51,16 @@ def find_skill_folders(module_dir: Path, exclude_name: str = "") -> list[str]:
 
 
 def detect_standalone_module(module_dir: Path) -> Path | None:
-    """Detect a standalone module: single skill folder with assets/module.yaml."""
+    """Detect a standalone module: a single skill folder with assets/module.yaml.
+
+    Works whether ``module_dir`` is the parent folder that contains the skill, or
+    the standalone skill directory itself (the path a user is most likely to hand
+    over for a single-skill module).
+    """
+    # Given the skill directory directly.
+    if (module_dir / "SKILL.md").is_file() and (module_dir / "assets" / "module.yaml").is_file():
+        return module_dir
+    # Given the parent folder containing exactly one skill.
     skill_dirs = [
         d for d in module_dir.iterdir()
         if d.is_dir() and (d / "SKILL.md").is_file()
@@ -130,14 +139,32 @@ def validate(module_dir: Path, verbose: bool = False) -> dict:
             "assets/module.yaml": skill_dir / "assets" / "module.yaml",
             "assets/module-help.csv": skill_dir / "assets" / "module-help.csv",
             "assets/module-setup.md": skill_dir / "assets" / "module-setup.md",
-            "scripts/merge-config.py": skill_dir / "scripts" / "merge-config.py",
-            "scripts/merge-help-csv.py": skill_dir / "scripts" / "merge-help-csv.py",
         }
+        # Merge scripts: accept either the dash form the scaffolder emits
+        # (merge-config.py) or the importable underscore form (merge_config.py).
+        # Both are valid — a module may rename them to be importable from
+        # module-setup.md without that being a structural defect.
+        required_any = {
+            "scripts/merge-config.py (or merge_config.py)": [
+                skill_dir / "scripts" / "merge-config.py",
+                skill_dir / "scripts" / "merge_config.py",
+            ],
+            "scripts/merge-help-csv.py (or merge_help_csv.py)": [
+                skill_dir / "scripts" / "merge-help-csv.py",
+                skill_dir / "scripts" / "merge_help_csv.py",
+            ],
+        }
+        ok = True
         for label, path in required_files.items():
             if not path.is_file():
                 finding("critical", "structure", f"Missing required file: {label}")
+                ok = False
+        for label, candidates in required_any.items():
+            if not any(p.is_file() for p in candidates):
+                finding("critical", "structure", f"Missing required file: {label}")
+                ok = False
 
-        if not all(p.is_file() for p in required_files.values()):
+        if not ok:
             return {"status": "fail", "findings": findings, "info": info}
 
         yaml_dir = skill_dir
@@ -202,8 +229,12 @@ def validate(module_dir: Path, verbose: bool = False) -> dict:
 
     # 6. Collect skills from CSV and filesystem
     csv_skills = {row.get("skill", "") for row in rows}
-    exclude_name = setup_dir.name if setup_dir else ""
-    skill_folders = find_skill_folders(module_dir, exclude_name)
+    if standalone_dir:
+        # The only valid skill is the standalone skill itself, whether we were
+        # handed the module's parent folder or the skill directory directly.
+        skill_folders = [standalone_dir.name]
+    else:
+        skill_folders = find_skill_folders(module_dir, setup_dir.name)
     info["skill_folders"] = skill_folders
     info["csv_skills"] = sorted(csv_skills)
 
@@ -215,10 +246,15 @@ def validate(module_dir: Path, verbose: bool = False) -> dict:
     # 8. Orphan CSV entries
     setup_name = setup_dir.name if setup_dir else ""
     for skill in csv_skills:
-        if skill not in skill_folders and skill != setup_name:
-            # Check if it's the setup skill itself (valid)
-            if not (module_dir / skill / "SKILL.md").is_file():
-                finding("high", "orphan-entry", f"CSV references skill '{skill}' which does not exist in the module folder")
+        if skill in skill_folders or skill == setup_name:
+            continue
+        # For a standalone module, skill_folders already enumerates every valid
+        # skill, so any other CSV skill is an orphan — never look at the parent
+        # folder (which may hold unrelated sibling skills when validating a skill
+        # dir directly). For a multi-skill module, re-check the filesystem: the
+        # setup skill lives alongside the others and is excluded from skill_folders.
+        if standalone_dir or not (module_dir / skill / "SKILL.md").is_file():
+            finding("high", "orphan-entry", f"CSV references skill '{skill}' which does not exist in the module folder")
 
     # 9. Unique menu codes
     menu_codes: dict[str, list[str]] = {}
@@ -249,7 +285,15 @@ def validate(module_dir: Path, verbose: bool = False) -> dict:
             # Can be comma-separated
             for ref in value.split(","):
                 ref = ref.strip()
-                if ref and ref not in valid_refs:
+                if not ref:
+                    continue
+                # A colon-less ref is a cross-module positional reference (a bare
+                # sibling-module skill name, e.g. "bmad-sprint-planning"). Other
+                # installed modules aren't visible here, so it can't be resolved
+                # and isn't a defect — only validate intra-module skill:action refs.
+                if ":" not in ref:
+                    continue
+                if ref not in valid_refs:
                     finding("medium", "invalid-ref",
                             f"'{display}' {field} references '{ref}' which is not a valid capability",
                             "Expected format: skill-name:action-name")

package/lib/bmad-cache/bmb/skills/bmad-workflow-builder/assets/customize-template.toml

@@ -31,15 +31,13 @@ activation_steps_append = []
 #   - a file reference prefixed with `file:`, e.g. "file:{project-root}/docs/standards.md"
 #     (glob patterns are supported; the file's contents are loaded and treated as facts).
 
-persistent_facts = [
-  "file:{project-root}/**/project-context.md",
-]
+persistent_facts = []
 
-# Scalar: executed when the workflow reaches its terminal stage, after
+# Items that are executed when the workflow reaches its terminal stage, after
 # the main output has been delivered. Override wins. Leave empty for
 # no custom post-completion behavior.
 
-on_complete = ""
+on_complete = []
 
 # --- Workflow-specific configurables (lifted during Configurability Discovery) ---
 #