ma-agents 3.16.0 → 3.17.0-beta.0

package/README.md

@@ -2,6 +2,23 @@
 
 A universal NPX tool to install AI coding agent skills. Write skills once, install them across Claude Code, Gemini, Copilot, Cline, Cursor, Kilocode, and Roo Code.
 
+## What's New in v3.17.0
+
+- **BMAD-METHOD v6.10.0** — bundled bmad-method updated to v6.10.0. The
+  offline bundle stays exactly `{tea, bmb, cis, gds, wds}`; the new upstream
+  `bmad-loop` module is deliberately excluded (never bundled, never installed
+  by default) by a closed-allowlist filter with a two-sided fail-loud guard.
+- **Custom marketplace source (opt-in)** — `--bmad-custom-source
+  <path|url>` (or the install-time Y/N prompt) lets you enumerate and install
+  a hand-picked subset of extensions from your own BMAD marketplace repo —
+  the sanctioned way to add `bmad-loop` or any other excluded module. The
+  source and your selection persist in `.ma-agents.json` and re-enumerate on
+  every `update`. See "Custom Marketplace Source" below.
+- **Demerzel (ML Scientist) deprecated** — `ma-agent-ml` and its 12 `ml-*`
+  skills are no longer installed by default for new projects. Existing
+  installs are completely untouched (non-destructive); a one-time notice
+  explains how to opt back in via a custom marketplace source.
+
 ## What's New in v3.12.0
 
 - **Cline `.clinerules` directory fix** — `.clinerules` is now correctly created as a directory (matching Cline's native structure), not as a file. This prevents ENOTDIR errors during workflow generation and ensures `.clinerules/workflows/` is always generated correctly. Legacy installs that had `.clinerules` as a file are automatically migrated on the next install or update.
@@ -316,7 +333,7 @@ Running `ma-agents` on a project where skills are already installed triggers the
    - **Cleans up stale tool directories** — if a tool's skill path changed between releases (e.g., Copilot migrated from `.github/copilot/skills/` to `.github/skills/`), the old directory is automatically removed when the new one has content.
 
 ### BMAD-METHOD Integration
-`ma-agents` bundles [BMAD-METHOD](https://docs.bmad-method.org/) **v6.5.0** to provide advanced orchestration and specialized personas.
+`ma-agents` bundles [BMAD-METHOD](https://docs.bmad-method.org/) **v6.10.0** to provide advanced orchestration and specialized personas.
 
 #### Core Features
 - **Auto-Detection**: Recognizes existing BMAD installations and prompts for silent updates.
@@ -330,16 +347,70 @@ Running `ma-agents` on a project where skills are already installed triggers the
 `ma-agents` ships with everything needed to install BMAD without any network access at install time:
 
 - **`bmad-method` is a direct npm dependency** — no runtime `npx bmad-method` fetch required. The correct version is pinned and bundled inside `node_modules/` when you `npm install ma-agents`.
-- **External modules pre-bundled** — `lib/bmad-cache/` ships the 4 optional BMAD modules (`bmb`, `cis`, `gds`, `tea`) inside the package itself. They are pre-populated to `~/.bmad/cache/external-modules/` before any install runs, so BMAD never needs to clone them from GitHub.
+- **External modules pre-bundled** — `lib/bmad-cache/` ships exactly 5 optional BMAD modules (`bmb`, `cis`, `gds`, `tea`, `wds`) inside the package itself. They are pre-populated to `~/.bmad/cache/external-modules/` before any install runs, so BMAD never needs to clone them from GitHub. The bundled set is a **closed allowlist** — a build-time guard fails loud if the resolved set is ever smaller (a thin cache) *or* larger (a silent upstream addition) than these five, so a new upstream module can never be force-bundled or installed by default. `bmad-loop` (BMAD's own unattended-dev orchestrator, added upstream at v6.10.0) is deliberately **excluded** from this bundle — see "BMAD-loop and other opt-in modules" below.
 - **Plugin bundle pre-built** — `lib/bmad-extension-plugin/` ships as a deterministic, byte-stable bundle (built from `lib/bmad-extension/` via `scripts/build-plugin.js`). At install time it is staged into `<project>/.ma-agents-plugin-stage/` and consumed by `bmad-method install --custom-source`, so the install never touches the network for plugin assembly.
 - **Deterministic installs** — same `ma-agents` version always produces the same `_bmad/` output, regardless of network conditions (NFR21). Bundle reproducibility is gated by a CI drift check.
 - **Air-gapped friendly** — install from a tarball (`npm install ./ma-agents-x.y.z.tgz`) and run `npx ma-agents install` completely offline. Every PR runs an offline-install gate (`--network none` Docker) to enforce this guarantee (NFR54).
 
 ```
-npm install ma-agents          # bundles bmad-method + 4 external modules
+npm install ma-agents          # bundles bmad-method + 5 external modules
 npx ma-agents install --yes    # fully offline BMAD install — no network needed
 ```
 
+#### Custom Marketplace Source (opt-in)
+
+After module selection, the installer offers to pull in extensions from **one**
+additional BMAD marketplace repository — a local path or an intra-perimeter
+Git URL (e.g. on-prem GitLab) pointing at a repo with a
+`.claude-plugin/marketplace.json`. This is how a team plugs in extensions
+ma-agents deliberately does not ship by default — including **`bmad-loop`**
+(see below) or an internally-published replacement for a deprecated agent.
+
+- **Interactive flow**: `Install additional BMAD extensions from a custom
+  source? (y/N)` → if yes, enter the source → ma-agents **enumerates** the
+  extensions the source declares (reusing bmad-method's own module
+  discovery) → presents them in **ma-agents' own multiselect** (the
+  single-wizard principle is preserved; `bmad-method` itself still runs
+  non-interactively) → installs only the codes you picked.
+- **Non-interactive equivalent**: `--bmad-custom-source <local-path-or-url>`.
+  Under `--yes`, every declared extension is selected automatically (matching
+  how `--bmad-modules`/skill selection behave under `--yes`).
+- **Persistence + reconcile on update**: the marketplace source and your
+  selected extension codes are saved in `.ma-agents.json`. On the next
+  `update`, ma-agents automatically re-resolves the source and re-enumerates
+  it, reporting anything newly published (not auto-installed — re-run the
+  custom-source flow to add it) or no longer available (dropped from the
+  installed selection) — it never silently changes what you already have.
+- **Authentication**: ambient git only — your existing SSH keys or credential
+  helper. ma-agents performs zero token handling and never stores or logs a
+  credential.
+- **On-prem posture**: no public-internet egress is required (an on-prem
+  GitLab over SSH works with no extra configuration), but custom-source
+  content is explicitly **outside** the sealed offline-bundle guarantee above
+  — you are responsible for that source's own offline self-containment. The
+  installer prints a one-line warning before you can select anything from it.
+
+```bash
+npx ma-agents install --yes --bmad-custom-source ./org-marketplace
+npx ma-agents install --bmad-custom-source git@git.intra.example:team/bmad-marketplace.git
+```
+
+#### `bmad-loop` and other opt-in modules
+
+BMAD-METHOD v6.10.0 added `bmad-loop`, an unattended Python/tmux/hooks
+development-orchestrator module that requires a separate `bmad-loop-setup`
+step and vendor-API sessions. It is **air-gap-hostile as a default** and
+functionally overlaps ma-agents' own `bmad-dev-epic` orchestrator, so
+`bmad-loop` is **never bundled and never installed by default** — it is
+excluded by the same closed-allowlist guard described above. `bmad-dev-epic`
+remains ma-agents' default air-gapped epic orchestrator.
+
+`bmad-loop` (or any other module ma-agents excludes) can still be installed
+as a deliberate, explicit opt-in through a **custom marketplace source** (see
+above) — for example a locally-published copy of `bmad-loop` in your org's
+marketplace repo. This is the sanctioned path for teams that want it; nothing
+in the default install pulls it in silently.
+
 #### Specialized BMAD Agents
 1. **SRE Agent (Alex)**:
    - **Focus**: High availability, Kubernetes, Docker, and Podman.
@@ -353,10 +424,20 @@ npx ma-agents install --yes    # fully offline BMAD install — no network neede
    - **Focus**: Cyber immunity, security auditing, and vulnerability management.
    - **Capabilities**: Immunity estimation (scoring), Vault secret management, and PKI automation.
    - **Integration**: Orchestrates ma-agents security skills for deep scans.
-4. **Demerzel (ML Scientist)**:
+4. **Demerzel (ML Scientist)** — **DEPRECATED, no longer installed by default (v3.17.0+)**:
    - **Focus**: Hypothesis-driven machine learning lifecycle with scientific rigor.
    - **Capabilities**: EDA, architecture design, locked TechSpec contracts, experiment execution, failure-cost analysis.
    - **Workflows**: 12-stage ML lifecycle from ideation through retrospective, with mandatory review gates.
+   - **Status**: `ma-agent-ml` and its 12 `ml-*` workflow skills are no longer
+     part of the default bundle for **new** installs. This is **non-destructive**
+     for everyone else — an **existing** install's `ma-agent-ml`/`ml-*` content
+     (and anything you produced with it) is left completely untouched on update;
+     there is no auto-removal and no prompt. You'll see a one-time notice the
+     first time you install or update after upgrading ma-agents, and that's it.
+     There is no in-tool migration path — if your team still needs ML
+     workflows, install a replacement from your organization's own BMAD
+     marketplace via the **custom marketplace source** described above
+     (`--bmad-custom-source`).
 5. **Gadi (SQA & Standards Expert)**:
    - **Focus**: Software quality assurance and defense documentation standards — a unified persona covering SQA auditing and MIL-STD-498 document generation.
    - **SQA Capabilities**: Multi-dimensional project quality audits, IEEE/ISO/IEC 12207:2017 compliance assessments (23 process areas, 4 groups), requirements evaluation against 14 established quality criteria (scope-selectable: PRD FRs, NFRs, epics, stories).

package/bin/cli.js

@@ -34,11 +34,12 @@ const path = require('path');
 const fs = require('fs');
 const { execFileSync } = require('child_process');
 const { installSkill, uninstallSkill, getStatus, listSkills, listAgents, updateProjectContextRepoLayout, migrateRetiredSkills, reconcileAgentsSharedSkills } = require('../lib/installer');
-const { getProfile, setProfile, resolveProfile, getBmadModules, setBmadModules } = require('../lib/profile');
+const { getProfile, setProfile, resolveProfile, getBmadModules, setBmadModules, showDemerzelDeprecationNoticeOnce, getCustomMarketplaceSelection } = require('../lib/profile');
 const { reconfigure: runReconfigure, ReconfigureYesRejectedError, ManifestNotFoundError, RoomodesSlugDivergenceError } = require('../lib/reconfigure');
 const { uninstallProfileArtifacts } = require('../lib/uninstall');
 const bmad = require('../lib/bmad');
 const { getBmadPlatformCode } = require('../lib/agents');
+const { enumerateCustomSource, NFR71_WARNING, CustomMarketplaceError, reconcileCustomMarketplaceSelection } = require('../lib/custom-marketplace');
 const { handleCreateSkill, handleValidateSkill, handleSetMandatory, handleCustomizeAgent, handleCreateAgent } = require('../lib/skill-authoring');
 
 const PKG = require('../package.json');
@@ -119,6 +120,13 @@ ${chalk.bold('Install options:')}
                        With CSV: install exactly those (e.g. tea,bmb)
                        Omitted: install every non-retired module (default)
                        'bmm' is always force-included.
+  ${chalk.cyan('--bmad-custom-source <ref>')} Enumerate extensions from ONE custom
+                       marketplace repo (local path or Git URL containing
+                       .claude-plugin/marketplace.json) and offer them in
+                       ma-agents' own multiselect. Non-interactive equivalent
+                       of the "Install additional BMAD extensions from a
+                       custom source?" prompt. Ambient git credentials only —
+                       no token handling.
   ${chalk.cyan('--log')}              Log all console output to install_<datetime>.log
 
 ${chalk.bold('Reconfigure options:')}
@@ -142,6 +150,8 @@ ${chalk.bold('Examples:')}
   npx ${NAME} install --yes --global
   npx ${NAME} install --yes --bmad-modules bmm,tea,bmb
   npx ${NAME} install --bmad-modules                    # prompt for modules
+  npx ${NAME} install --yes --bmad-custom-source ./org-marketplace
+  npx ${NAME} install --bmad-custom-source git@git.intra.example:team/bmad-marketplace.git
   npx ${NAME} uninstall code-review claude-code
   npx ${NAME} status
   npx ${NAME} status --global
@@ -270,6 +280,23 @@ function parseFlags(args) {
     }
   }
 
+  // --bmad-custom-source <ref> — Story 30.6a. Requires an explicit value (a
+  // path or Git URL); unlike --bmad-modules there is no "bare = prompt" form
+  // because the underlying Y/N wizard prompt already exists for interactive
+  // runs. A missing value is an error, not a silent no-op, to avoid a typo'd
+  // invocation silently skipping the intended custom source.
+  let bmadCustomSourceFlag = '';
+  const bmadCustomSourceIdx = positional.indexOf('--bmad-custom-source');
+  if (bmadCustomSourceIdx !== -1) {
+    const value = positional[bmadCustomSourceIdx + 1];
+    if (!value || value.startsWith('--')) {
+      console.error(chalk.red('Error: --bmad-custom-source requires a path or Git URL'));
+      process.exit(1);
+    }
+    bmadCustomSourceFlag = value;
+    positional.splice(bmadCustomSourceIdx, 2);
+  }
+
   return {
     globalFlag,
     forceFlag,
@@ -278,6 +305,7 @@ function parseFlags(args) {
     customPath,
     bmadModulesFlag,
     bmadModulesPrompt,
+    bmadCustomSourceFlag,
     scope: globalFlag ? 'global' : 'project',
     positional
   };
@@ -918,9 +946,212 @@ async function selectBmadModules({ bmadModulesFlag, bmadModulesPrompt, projectRo
   return persist(installable.map(m => m.id));
 }
 
+// --- Custom marketplace source (Story 30.6a) ---
+
+/**
+ * Story 30.6b AC 6 — single source of truth for whether the base BMAD
+ * install/update step (Step 3.5) left a usable installation for the
+ * custom-marketplace subset install (Step 3.5b) to layer `--custom-source`
+ * onto. Pure function, exported for direct unit testing (no need to drive
+ * the full wizard to exercise this policy):
+ *
+ *   - not attempted (user declined, or --yes short-circuited before any
+ *     call): usable only if BMAD was ALREADY installed from a prior run —
+ *     there is no `_bmad/` tree to layer onto for a declined FRESH install.
+ *   - attempted: usable iff the install/update call itself reported success.
+ *
+ * @param {Object} ctx
+ * @param {boolean} ctx.bmadInstalled - Was BMAD already installed before this step?
+ * @param {boolean} ctx.attempted - Was `installBmad`/`updateBmad` actually invoked?
+ * @param {boolean} [ctx.success] - That call's return value (ignored if `attempted` is false).
+ * @returns {boolean}
+ */
+function resolveBaseBmadOk({ bmadInstalled, attempted, success }) {
+  if (!attempted) return Boolean(bmadInstalled);
+  return Boolean(success);
+}
+
+/**
+ * FR239-FR241 — after BMAD module selection, offer to enumerate ONE custom
+ * marketplace source and let the user pick which of its declared extensions
+ * to install. This function does the Y/N prompt (or its `--bmad-custom-source`
+ * non-interactive equivalent), the enumerate call, the NFR71 warning, and
+ * ma-agents' OWN multiselect (FR240) — and stops there.
+ *
+ * Scope boundary (Story 30.6a vs 30.6b): this returns the user's selection —
+ * `{ source, mode, selectedCodes, plugins, rootDir, sourceUrl }` (the last two
+ * added by 30.6b — additive, existing 30.6a consumers only read the first
+ * four fields) — for Story 30.6b to consume for prune-and-stage. NO pruning,
+ * staging, or `bmad-method` invocation happens here or anywhere in this
+ * function. Returns `null` when the feature is not engaged (no flag, and
+ * either --yes with no flag, or the user answered "N") — this is the
+ * byte-identical-to-baseline "off" path required by NFR70.
+ *
+ * @param {Object} ctx
+ * @param {string} [ctx.bmadCustomSourceFlag] - `--bmad-custom-source <ref>` value
+ * @param {boolean} [ctx.yesFlag] - non-interactive run
+ * @returns {Promise<null|{ source: string, mode: 'discovery'|'direct', selectedCodes: string[],
+ *   plugins: Array<Object>, rootDir: string, sourceUrl: string|null }>}
+ */
+async function promptCustomMarketplace({ bmadCustomSourceFlag = '', yesFlag = false } = {}) {
+  let source = bmadCustomSourceFlag;
+
+  if (!source) {
+    if (yesFlag) {
+      // Non-interactive run with no flag — feature stays off (NFR70: a
+      // no-source install is byte-identical to baseline). There is no
+      // "bare = prompt" fallback for --yes, matching how other install-time
+      // Y/N prompts behave under --yes.
+      return null;
+    }
+    const { wantsCustomSource } = await prompts({
+      type: 'confirm',
+      name: 'wantsCustomSource',
+      message: 'Install additional BMAD extensions from a custom source? (y/N)',
+      initial: false,
+    });
+    if (!wantsCustomSource) return null;
+
+    const { sourceInput } = await prompts({
+      type: 'text',
+      name: 'sourceInput',
+      message: 'Custom marketplace source (local path or Git URL):',
+    });
+    if (!sourceInput || !sourceInput.trim()) {
+      console.log(chalk.yellow('  No source entered — skipping custom marketplace source.'));
+      return null;
+    }
+    source = sourceInput.trim();
+  }
+
+  let enumerated;
+  try {
+    enumerated = await enumerateCustomSource(source);
+  } catch (err) {
+    // Fail clean (spike §3 contract) — a short, human-readable message only.
+    // Never print err.stack here: an unreachable/unauthorized custom source
+    // must not dump a raw upstream stack, and must never touch the base
+    // install (the rest of installWizard proceeds unaffected).
+    const message = err instanceof CustomMarketplaceError ? err.message : `Custom marketplace source error: ${err.message}`;
+    console.log(chalk.red(`\n  ${message}`));
+    console.log(chalk.gray('  Skipping custom marketplace source; the rest of the install is unaffected.'));
+    return null;
+  }
+
+  const { plugins, mode, rootDir, sourceUrl } = enumerated;
+  if (!plugins || plugins.length === 0) {
+    console.log(chalk.yellow(`  Custom marketplace source "${source}" declared no plugins — nothing to select.`));
+    return { source, mode, selectedCodes: [], plugins: [], rootDir, sourceUrl };
+  }
+
+  // NFR71 — shown before the user can select/install anything from the source.
+  console.log(chalk.yellow(`\n  Warning: ${NFR71_WARNING}`));
+
+  if (yesFlag) {
+    // --yes + --bmad-custom-source: select every declared plugin, matching
+    // the "select all" default used elsewhere in --yes mode (bmad modules,
+    // skills). The user asked for this source explicitly via the flag.
+    const selectedCodes = plugins.map((p) => p.code);
+    console.log(chalk.cyan(`  Custom marketplace: selected all ${selectedCodes.length} extension(s) from "${source}".`));
+    return { source, mode, selectedCodes, plugins, rootDir, sourceUrl };
+  }
+
+  const { chosenCodes } = await prompts({
+    type: 'multiselect',
+    name: 'chosenCodes',
+    message: `Select extensions to install from "${source}":`,
+    choices: plugins.map((p) => ({
+      title: chalk.white(p.code) + chalk.gray(p.description ? ` — ${p.description}` : ''),
+      value: p.code,
+      selected: true,
+    })),
+    instructions: chalk.gray('  Use space to toggle, enter to confirm.'),
+  });
+
+  if (chosenCodes === undefined) {
+    console.log(chalk.gray('  Custom marketplace selection cancelled.'));
+    return null;
+  }
+
+  return { source, mode, selectedCodes: chosenCodes, plugins, rootDir, sourceUrl };
+}
+
+/**
+ * Story 30.7 (FR242) — on `update`, re-enumerate a PERSISTED custom
+ * marketplace source instead of asking the plain Y/N prompt again, and
+ * reconcile the fresh plugin list against the persisted `selectedCodes`.
+ * Newly-appeared plugins are reported ONLY — never added to the returned
+ * selection. A code that is no longer declared is dropped and reported.
+ *
+ * Fail-loud contract: if the persisted source cannot be re-enumerated
+ * (unreachable, removed, drifted adapter surface), this prints a clear,
+ * visible error and returns `null` WITHOUT writing anything to
+ * `.ma-agents.json` — the persisted selection is left exactly as it was so a
+ * later successful `update` picks up where the user left off. This function
+ * never calls `setCustomMarketplaceSelection` itself; persistence only ever
+ * happens after a REAL install, in `lib/bmad.js#installCustomMarketplaceSubset`.
+ *
+ * @param {Object} ctx
+ * @param {string} ctx.projectRoot
+ * @returns {Promise<undefined|null|{ source: string, mode: 'discovery'|'direct',
+ *   selectedCodes: string[], plugins: Array<Object>, rootDir: string, sourceUrl: string|null }>}
+ *   `undefined` — nothing persisted; caller should fall back to `promptCustomMarketplace()`.
+ *   `null` — persisted source exists but could not be re-enumerated (fail-loud; skip this run).
+ *   selection object — reconciled; `selectedCodes` is the persisted set minus any `removed`.
+ */
+async function reconcileCustomMarketplaceOnUpdate({ projectRoot }) {
+  const persisted = getCustomMarketplaceSelection(projectRoot);
+  if (!persisted) return undefined;
+
+  let enumerated;
+  try {
+    enumerated = await enumerateCustomSource(persisted.source);
+  } catch (err) {
+    const message = err instanceof CustomMarketplaceError ? err.message : `Custom marketplace source error: ${err.message}`;
+    console.log(chalk.red(`\n  Custom marketplace update FAILED: ${message}`));
+    console.log(
+      chalk.red(
+        `  The persisted selection (${persisted.selectedCodes.join(', ') || '(none)'}) from ` +
+        `"${persisted.source}" is UNCHANGED — it will be retried on the next update.`
+      )
+    );
+    return null;
+  }
+
+  const { plugins, mode, rootDir, sourceUrl } = enumerated;
+  const { added, removed, stillPresent } = reconcileCustomMarketplaceSelection({
+    persistedSelectedCodes: persisted.selectedCodes,
+    enumeratedPlugins: plugins,
+  });
+
+  console.log(chalk.cyan(`\n  Custom marketplace source "${persisted.source}" re-enumerated:`));
+  if (persisted.sha) {
+    // The persisted SHA is the last-installed commit, INFORMATIONAL only.
+    // Updates deliberately float to remote HEAD (FR242/NFR72) to surface
+    // newly-published extensions — we report the last-installed SHA rather
+    // than pin to it, so the float-to-HEAD behavior is explicit, not silent.
+    console.log(chalk.gray(`    (last installed at ${persisted.sha.slice(0, 12)}; update re-enumerates at the source's current HEAD, not this pin)`));
+  }
+  if (added.length > 0) {
+    console.log(chalk.gray(`    + newly available (not auto-installed; re-run the custom-source flow to add): ${added.join(', ')}`));
+  }
+  if (removed.length > 0) {
+    console.log(chalk.yellow(`    - no longer available (dropped from the installed selection): ${removed.join(', ')}`));
+  }
+  if (added.length === 0 && removed.length === 0) {
+    console.log(chalk.gray('    No changes vs. the persisted selection.'));
+  }
+
+  if (stillPresent.length === 0) {
+    console.log(chalk.yellow('  None of the previously-selected extensions are declared by this source anymore — nothing to reinstall from it.'));
+  }
+
+  return { source: persisted.source, mode, selectedCodes: stillPresent, plugins, rootDir, sourceUrl };
+}
+
 // --- Install wizard ---
 
-async function installWizard(preselectedSkill, preselectedAgents, customPath, forceFlag, yesFlag = false, cliScope, bmadModulesFlag = '', bmadModulesPrompt = false) {
+async function installWizard(preselectedSkill, preselectedAgents, customPath, forceFlag, yesFlag = false, cliScope, bmadModulesFlag = '', bmadModulesPrompt = false, bmadCustomSourceFlag = '') {
   const skills = listSkills();
   const agents = listAgents();
 
@@ -1209,10 +1440,16 @@ async function installWizard(preselectedSkill, preselectedAgents, customPath, fo
         projectRoot: process.cwd(),
       });
 
+      // Story 30.6b AC 6 — tracks whether the base BMAD install/update step
+      // left a usable installation for the custom-marketplace subset install
+      // (Step 3.5b) to layer onto. See resolveBaseBmadOk() for the policy.
+      let baseBmadOk = resolveBaseBmadOk({ bmadInstalled, attempted: false });
+
       if (!bmadInstalled) {
         if (yesFlag) {
           console.log(chalk.cyan(`\n Installing BMAD-METHOD (modules: ${bmadModules.join(', ')})...`));
           const success = await bmad.installBmad(bmadModules, bmadTools);
+          baseBmadOk = resolveBaseBmadOk({ bmadInstalled, attempted: true, success });
           if (success) {
             console.log(chalk.green(' BMAD-METHOD installed successfully!'));
           }
@@ -1227,15 +1464,19 @@ async function installWizard(preselectedSkill, preselectedAgents, customPath, fo
           if (installBmad) {
             console.log(chalk.cyan(`\n Installing BMAD-METHOD (modules: ${bmadModules.join(', ')})...`));
             const success = await bmad.installBmad(bmadModules, bmadTools);
+            baseBmadOk = resolveBaseBmadOk({ bmadInstalled, attempted: true, success });
             if (success) {
               console.log(chalk.green(' BMAD-METHOD installed successfully!'));
             }
+          } else {
+            baseBmadOk = resolveBaseBmadOk({ bmadInstalled, attempted: false });
           }
         }
       } else {
         if (yesFlag) {
           console.log(chalk.cyan(`\n Updating BMAD-METHOD (modules: ${bmadModules.join(', ')})...`));
           const success = await bmad.updateBmad(bmadModules, bmadTools);
+          baseBmadOk = resolveBaseBmadOk({ bmadInstalled, attempted: true, success });
           if (success) {
             console.log(chalk.green(' BMAD-METHOD updated successfully!'));
           }
@@ -1250,10 +1491,70 @@ async function installWizard(preselectedSkill, preselectedAgents, customPath, fo
           if (updateBmad) {
             console.log(chalk.cyan(`\n Updating BMAD-METHOD (modules: ${bmadModules.join(', ')})...`));
             const success = await bmad.updateBmad(bmadModules, bmadTools);
+            baseBmadOk = resolveBaseBmadOk({ bmadInstalled, attempted: true, success });
             if (success) {
               console.log(chalk.green(' BMAD-METHOD updated successfully!'));
             }
           }
+          // else: update declined, but BMAD was already installed from a
+          // prior run — resolveBaseBmadOk({attempted:false}) is `bmadInstalled`,
+          // i.e. still true (there IS a usable base).
+        }
+      }
+
+      // Step 3.5b: Custom marketplace source (Story 30.6a enumerate + wizard;
+      // Story 30.6b prune + stage + install-the-subset; Story 30.7 persist +
+      // re-enumerate/reconcile on update, FR240/FR242).
+      let customMarketplaceSelection = null;
+      // Story 30.7 — on a BMAD-METHOD *update* (i.e. `bmadInstalled` was
+      // already true before this run, so bmad.updateBmad() ran above — this
+      // is the FR242 "on update" case, and is DELIBERATELY independent of
+      // `isUpdate`, which only tracks ma-agents' own "Update (add/remove
+      // skills)" wizard choice and stays false under `--yes` reruns) with NO
+      // explicit `--bmad-custom-source` override, prefer re-enumerating a
+      // PERSISTED source over asking the plain Y/N prompt again. An explicit
+      // flag always wins (fresh engagement via the normal prompt path below).
+      // `undefined` means nothing was persisted — fall through unchanged.
+      let usedPersistedReconcile = false;
+      if (bmadInstalled && !bmadCustomSourceFlag) {
+        const reconciled = await reconcileCustomMarketplaceOnUpdate({ projectRoot: process.cwd() });
+        if (reconciled !== undefined) {
+          usedPersistedReconcile = true;
+          customMarketplaceSelection = reconciled; // null (fail-loud skip) or a reconciled selection
+        }
+      }
+      if (!usedPersistedReconcile) {
+        try {
+          customMarketplaceSelection = await promptCustomMarketplace({ bmadCustomSourceFlag, yesFlag });
+        } catch (err) {
+          console.log(chalk.yellow(`\n  Custom marketplace source skipped: ${err.message}`));
+        }
+      }
+      if (customMarketplaceSelection && customMarketplaceSelection.selectedCodes.length > 0) {
+        if (!baseBmadOk) {
+          // AC 6 (30.6b) — never layer --custom-source onto a project with no
+          // (or a broken) base BMAD install. The rest of the install is
+          // otherwise unaffected.
+          console.log(
+            chalk.yellow(
+              '\n  Skipping custom marketplace install — the base BMAD install/update did not ' +
+              'complete successfully, so there is no BMAD installation to add it to.'
+            )
+          );
+        } else {
+          try {
+            const success = await bmad.installCustomMarketplaceSubset({
+              projectRoot: process.cwd(),
+              modules: bmadModules,
+              tools: bmadTools,
+              selection: customMarketplaceSelection,
+            });
+            if (success) {
+              console.log(chalk.green('  Custom marketplace subset installed successfully!'));
+            }
+          } catch (err) {
+            console.log(chalk.red(`\n  Custom marketplace install failed: ${err.message}`));
+          }
         }
       }
     }
@@ -1341,6 +1642,14 @@ async function installWizard(preselectedSkill, preselectedAgents, customPath, fo
     console.log(chalk.yellow(`\n Retired-skill migration skipped: ${err.message}`));
   }
 
+  // Story 30.4 (FR245/FR246) — idempotent one-time Demerzel deprecation
+  // notice. No-op after the first time it has ever printed for this project.
+  try {
+    showDemerzelDeprecationNoticeOnce(process.cwd());
+  } catch (err) {
+    console.log(chalk.yellow(`\n Deprecation notice skipped: ${err.message}`));
+  }
+
   // Install requested skills
   const batchState = {};
   if (yesFlag) {
@@ -1424,7 +1733,7 @@ async function installWizard(preselectedSkill, preselectedAgents, customPath, fo
 // --- Command handlers ---
 
 async function handleInstall(args) {
-  const { globalFlag, forceFlag, yesFlag, agentFlag, customPath, bmadModulesFlag, bmadModulesPrompt, scope, positional } = parseFlags(args);
+  const { globalFlag, forceFlag, yesFlag, agentFlag, customPath, bmadModulesFlag, bmadModulesPrompt, bmadCustomSourceFlag, scope, positional } = parseFlags(args);
 
   // Task 3.2: Validate agentFlag against known agents
   if (agentFlag) {
@@ -1443,13 +1752,13 @@ async function handleInstall(args) {
 
   // No skill → launch wizard (Task 3.3, 3.4)
   if (!skillId) {
-    await installWizard(null, preselectedAgents, customPath, forceFlag, yesFlag, scope, bmadModulesFlag, bmadModulesPrompt);
+    await installWizard(null, preselectedAgents, customPath, forceFlag, yesFlag, scope, bmadModulesFlag, bmadModulesPrompt, bmadCustomSourceFlag);
     return;
   }
 
   // Skill but no agents (and no agentFlag) → wizard with skill preselected
   if (!agentFlag && agentIds.length === 0) {
-    await installWizard(skillId, null, customPath, forceFlag, yesFlag, scope, bmadModulesFlag, bmadModulesPrompt);
+    await installWizard(skillId, null, customPath, forceFlag, yesFlag, scope, bmadModulesFlag, bmadModulesPrompt, bmadCustomSourceFlag);
     return;
   }
 
@@ -1506,6 +1815,14 @@ async function handleInstall(args) {
     console.log(chalk.yellow(`\n Retired-skill migration skipped: ${err.message}`));
   }
 
+  // Story 30.4 (FR245/FR246) — idempotent one-time Demerzel deprecation
+  // notice. No-op after the first time it has ever printed for this project.
+  try {
+    showDemerzelDeprecationNoticeOnce(process.cwd());
+  } catch (err) {
+    console.log(chalk.yellow(`\n Deprecation notice skipped: ${err.message}`));
+  }
+
   try {
     await installSkill(skillId, targetAgents, customPath, scope, { force: forceFlag, yes: yesFlag });
     console.log(chalk.bold.green('\n Installation complete!\n'));
@@ -1772,4 +2089,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { parseFlags, selectBmadModules, collectRepoLayout, readExistingLayout, writeRepoLayoutConfig, writeProjectLayoutYaml, writeConfigField, normalizePath, toPortablePath, resolveStoredPath, ciCloneIfNeeded, showCurrentLayout, handleConfigLayout, yamlEscapeValue };
+module.exports = { parseFlags, selectBmadModules, promptCustomMarketplace, reconcileCustomMarketplaceOnUpdate, resolveBaseBmadOk, collectRepoLayout, readExistingLayout, writeRepoLayoutConfig, writeProjectLayoutYaml, writeConfigField, normalizePath, toPortablePath, resolveStoredPath, ciCloneIfNeeded, showCurrentLayout, handleConfigLayout, yamlEscapeValue };

package/lib/agents.js

@@ -151,7 +151,20 @@ const agents = [
       'assets': 'templates'
     },
     instructionFiles: ['.cline/clinerules.md'],
-    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
+    // Story 30.9 — registry-driven capability flags replace the previous
+    // `agent.id === 'cline'` literal checks in lib/installer.js.
+    // `dualFileDriftCheck` opts this agent into the legacy
+    // `.cline/clinerules.md` vs `.clinerules`-file drift guard (Story 21.5
+    // AC #6). `framingTemplate` names the fresh-file framing template
+    // (relative to lib/templates/) used when creating the instruction file
+    // from scratch (Story 21.5 AC #1/#2). Both are absent (falsy) on every
+    // other agent — installer.js treats that as "skip this behavior".
+    injectionStrategy: {
+      position: 'top',
+      skipPatterns: ['---'],
+      dualFileDriftCheck: true,
+      framingTemplate: 'clinerules.template.md'
+    }
   },
   {
     id: 'roo-code',
@@ -326,20 +339,14 @@ const agents = [
     instructionFiles: ['_bmad/bmm/agents/qa.md'],
     injectionStrategy: { position: 'top', skipPatterns: ['---'] }
   },
-  {
-    id: 'bmm-demerzel',
-    name: 'ML Scientist (Demerzel)',
-    version: '1.0.0',
-    category: 'bmad',
-    description: 'Machine Learning Lifecycle Agent (Demerzel)',
-    skillsDir: '_bmad/skills/demerzel',
-    getProjectPath: () => path.join(process.cwd(), '_bmad', 'skills', 'demerzel'),
-    getGlobalPath: () => null,
-    fileExtension: '.md',
-    template: 'generic',
-    instructionFiles: ['_bmad/bmm/agents/demerzel.md'],
-    injectionStrategy: { position: 'top', skipPatterns: ['---'] }
-  }
+  // Story 30.4 / Decision P5-8, FR244-FR247: the 'bmm-demerzel' (ML Scientist)
+  // agent registration is REMOVED for new installs — Demerzel is deprecated
+  // and its ma-agent-ml + 12 ml-* skills no longer ship in the BMAD-extension
+  // plugin (lib/bmad-extension/skills/). Existing installs that already have
+  // this content deployed are left untouched (NFR49) — see
+  // lib/profile.js#showDemerzelDeprecationNoticeOnce for the one-time notice.
+  // Supersedes FR193 (the deferred Demerzel -> Memory-agent conversion is
+  // cancelled).
   // DEFERRED (Story 28.3 / Decision P5-6(d), FR214): BMAD v6.9.0 adds two new
   // installer platform targets — `hermes` (Hermes Agent) and `codewhale`
   // (CodeWhale). They are intentionally NOT added to this registry. Passthrough

package/lib/bmad-cache/cache-manifest.json

@@ -1,6 +1,6 @@
 {
-  "generated": "2026-06-27T14:28:18.113Z",
-  "bmadMethodVersion": "6.9.0",
+  "generated": "2026-07-12T07:02:48.848Z",
+  "bmadMethodVersion": "6.10.0",
   "registrySchema": "package-root-v68",
   "modules": {
     "tea": {