ma-agents 3.18.0-beta.2 → 3.18.0

package/README.md

@@ -569,7 +569,7 @@ Running `ma-agents` on a project where skills are already installed triggers the
 `ma-agents` ships with everything needed to install BMAD without any network access at install time:
 
 - **`bmad-method` is a direct npm dependency** — no runtime `npx bmad-method` fetch required. The correct version is pinned and bundled inside `node_modules/` when you `npm install ma-agents`.
-- **External modules pre-bundled** — `lib/bmad-cache/` ships exactly 5 optional BMAD modules (`bmb`, `cis`, `gds`, `tea`, `wds`) inside the package itself. They are pre-populated to `~/.bmad/cache/external-modules/` before any install runs, so BMAD never needs to clone them from GitHub. The bundled set is a **closed allowlist** — a build-time guard fails loud if the resolved set is ever smaller (a thin cache) *or* larger (a silent upstream addition) than these five, so a new upstream module can never be force-bundled or installed by default. `bmad-loop` (BMAD's own unattended-dev orchestrator, added upstream at v6.10.0) is deliberately **excluded** from this bundle — see "BMAD-loop and other opt-in modules" below.
+- **External modules pre-bundled** — `lib/bmad-cache/` ships exactly 3 optional BMAD modules (`bmb`, `cis`, `tea`) inside the package itself. They are pre-populated to `~/.bmad/cache/external-modules/` before any install runs, so BMAD never needs to clone them from GitHub. The bundled set is a **closed allowlist** — a build-time guard fails loud if the resolved set is ever smaller (a thin cache) *or* larger (a silent upstream addition) than these three, so a new upstream module can never be force-bundled or installed by default. The two design-studio modules `gds` (Game Dev Studio) and `wds` (Whiteport Design Studio) are **not bundled and not installable by ma-agents** — they are not offered by the `--bmad-modules` multiselect, and obtaining either one requires network access to its upstream repository, so on an air-gapped machine neither is available. `bmad-loop` (BMAD's own unattended-dev orchestrator, added upstream at v6.10.0) is deliberately **excluded** from this bundle — see "BMAD-loop and other opt-in modules" below.
 - **Plugin bundle pre-built** — `lib/bmad-extension-plugin/` ships as a deterministic, byte-stable bundle (built from `lib/bmad-extension/` via `scripts/build-plugin.js`). At install time it is staged into `<project>/.ma-agents-plugin-stage/` and consumed by `bmad-method install --custom-source`, so the install never touches the network for plugin assembly.
 - **Deterministic installs** — same `ma-agents` version always produces the same `_bmad/` output, regardless of network conditions (NFR21). Bundle reproducibility is gated by a CI drift check.
 - **Air-gapped friendly** — install from a tarball (`npm install ./ma-agents-x.y.z.tgz`) and run `npx ma-agents install` completely offline. Every PR runs an offline-install gate (`--network none` Docker) to enforce this guarantee (NFR54).
@@ -952,7 +952,7 @@ ma-agents/
 │   │   ├── clinerules.template.md                    # .clinerules expansion for Cline
 │   │   └── project-context.template.md               # project-context.md generation template
 │   ├── bmad-customize/         # Source-of-truth: per-persona phase / on_prem_phase_prefix YAML (consumed by the post-install marker-block injector)
-│   ├── bmad-cache/             # Pre-bundled BMAD external modules (bmb, cis, gds, tea)
+│   ├── bmad-cache/             # Pre-bundled BMAD external modules (bmb, cis, tea)
 │   ├── bmad-customizations/    # BMAD persona templates (.md) and YAML configs
 │   ├── bmad-extension/         # Extension source: sprint management, bug tracking, agent skills (hand-edited)
 │   ├── bmad-extension-plugin/  # Generated plugin bundle (deterministic; built from bmad-extension/ via scripts/build-plugin.js)

package/bin/cli.js

@@ -158,13 +158,13 @@ ${chalk.bold('Install options:')}
   ${chalk.cyan('--agent <name>')}    Target a specific agent (skip agent selection)
   ${chalk.cyan('--bmad-modules [csv]')} Control BMAD module selection.
                        Bare:    open a multiselect prompt (offers every
-                                bundled module, incl. gds and wds)
+                                bundled module: bmm, tea, bmb, cis)
                        With CSV: install exactly those (e.g. tea,bmb)
-                       Omitted: install bmm,tea,bmb,cis (default). The
-                                design-studio modules gds and wds are
-                                bundled but not installed by default —
-                                select them to install them.
-                       'bmm' is always force-included.
+                       Omitted: install bmm,tea,bmb,cis (default)
+                       'bmm' is always force-included. The design-studio
+                       modules gds and wds are not bundled and cannot be
+                       installed by ma-agents; getting either one needs
+                       network access to its upstream repository.
   ${chalk.cyan('--bmad-custom-source <ref>')} Enumerate extensions from ONE custom
                        marketplace repo (local path or Git URL containing
                        .claude-plugin/marketplace.json) and offer them in
@@ -3675,25 +3675,23 @@ async function collectSprintManagementLocation(concern, existingRecord) {
  *
  * Three branches:
  *   1. `--bmad-modules <csv>` → install exactly those (bmm force-prepended,
- *      unknowns rejected with a clear error). An explicit selection always
- *      wins, including one that names `gds` or `wds`.
+ *      unknowns rejected with a clear error). `gds`/`wds` are not bundled
+ *      (FR75), so naming either one is an unknown-module error.
  *   2. `--bmad-modules` bare  → multiselect prompt; EVERY bundled module is
  *      offered, bmm is required and pre-checked, and the remaining initial
  *      check state is the FR123 default set — so a no-op confirmation lands
  *      on exactly the same modules as branch 3.
  *   3. (no flag)              → no prompt. In order: a persisted selection
  *      from a prior run (bug 27.13), else the modules already present under
- *      `_bmad/`, else `bmad.getDefaultBmadModules()` — FR123's amended
- *      default set, bmm + tea + bmb + cis.
+ *      `_bmad/`, else `bmad.getDefaultBmadModules()` — FR123's default set,
+ *      bmm + tea + bmb + cis.
  *
- * WHY BRANCH 3 IS NO LONGER "EVERY NON-RETIRED MODULE" (FR123, amended
- * 2026-08-02): that default is what put a five-folder `design-artifacts/`
- * tree at the root of a Copilot+Cline project that had never asked for UX
- * tooling — `wds` installed unasked and materialised its `directories:`
- * block. `gds` and `wds` are still BUNDLED and still installable offline;
- * they are simply no longer installed without being asked for. Bundling and
- * installing are different decisions made at different times, and only the
- * second one moved.
+ * BRANCH 3 IS A NAMED LITERAL, NOT "EVERY NON-RETIRED MODULE" (FR123).
+ * Deriving the default from the manifest made it grow silently every time a
+ * module was bundled; naming the members means the next bundled module has to
+ * be added on purpose. The bundled set and the default set currently coincide,
+ * so branches 2 and 3 land on the same modules — but they are still two
+ * different decisions and the literal keeps them apart.
  *
  * `bmm` is force-included in every path because the BMad core agents
  * (analyst, PM, dev, architect, ...) live there and downstream skills
@@ -3728,12 +3726,12 @@ async function selectBmadModules({ bmadModulesFlag, bmadModulesPrompt, projectRo
 
   // Branch 2: bare --bmad-modules → multiselect prompt.
   if (bmadModulesPrompt) {
-    // FR123: every bundled module is OFFERED — this prompt is the documented
-    // route by which `gds`/`wds` remain reachable offline — but the initial
-    // check state is the default INSTALL set, so pressing Enter without
-    // touching anything lands on the same modules as the no-flag branch below.
-    // Checking them all here would silently reintroduce the very "installs
-    // everything" default this change removes.
+    // FR123: every bundled module is OFFERED, and the initial check state is
+    // the default INSTALL set, so pressing Enter without touching anything
+    // lands on the same modules as the no-flag branch below. The offered list
+    // is `getInstallableBmadModules()`, i.e. the cache manifest — a module
+    // that is not bundled (`gds`/`wds`, FR75) is not offered here, because
+    // offering something this package cannot install would be a lie.
     const defaultIds = new Set(bmad.getDefaultBmadModules(installable));
     const choices = installable.map(m => {
       const isCore = m.id === 'bmm';
@@ -3780,10 +3778,10 @@ async function selectBmadModules({ bmadModulesFlag, bmadModulesPrompt, projectRo
     }
   }
 
-  // 3b — NON-DESTRUCTIVE MIGRATION. Narrowing the default (FR123, amended
-  // 2026-08-02) is behaviour-visible to projects that already installed under
-  // the old every-module default, and an update run passes this same resolved
-  // list to `bmad.updateBmad`. A project that already has `wds` under `_bmad/`
+  // 3b — NON-DESTRUCTIVE MIGRATION. The narrowed default (FR123) is
+  // behaviour-visible to projects that installed under an older, wider
+  // default, and an update run passes this same resolved list to
+  // `bmad.updateBmad`. A project that already has a module under `_bmad/`
   // must not have it dropped out of its own module list just because the
   // default moved — narrowing applies to NEW installs, not to existing ones.
   //
@@ -4461,10 +4459,9 @@ async function installWizard(preselectedSkill, preselectedAgents, customPath, fo
     // stage the plugin and invoke the installer in one pass.
     // v6.6.0: --tools none is rejected for fresh installs; skip BMAD entirely when no IDE tools selected.
     if (bmadTools.length > 0) {
-      // Resolve module set once per BMAD invocation. Default (FR123, amended
-      // 2026-08-02) is bmm+tea+bmb+cis; the bundled design-studio modules gds
-      // and wds install only when asked for, via --bmad-modules <csv> or the
-      // multiselect that bare --bmad-modules opens.
+      // Resolve module set once per BMAD invocation. Default (FR123) is
+      // bmm+tea+bmb+cis, which is the whole bundled set; `--bmad-modules <csv>`
+      // or the multiselect that bare --bmad-modules opens can narrow it.
       const bmadModules = await selectBmadModules({
         bmadModulesFlag,
         bmadModulesPrompt,

package/docs/architecture.md

@@ -199,7 +199,7 @@ skills/<skill-name>/
 
 **Responsibility**: Pre-vendor BMAD's external modules so installs never touch the network.
 
-ma-agents bundles bmad-method as an npm dependency **and** pre-clones BMAD's external modules (`tea`, `bmb`, `cis`, `gds`) into `lib/bmad-cache/` at build time via `npm run build:bmad-cache` ([scripts/build-bmad-cache.js](../scripts/build-bmad-cache.js)). This is what lets `npx ma-agents install` run fully offline in air-gapped environments (NFR2/NFR50/NFR54) — the npm tarball already contains every module bmad-method would otherwise `git clone` from GitHub at install time.
+ma-agents bundles bmad-method as an npm dependency **and** pre-clones BMAD's external modules (`tea`, `bmb`, `cis`) into `lib/bmad-cache/` at build time via `npm run build:bmad-cache` ([scripts/build-bmad-cache.js](../scripts/build-bmad-cache.js)). This is what lets `npx ma-agents install` run fully offline in air-gapped environments (NFR2/NFR50/NFR54) — the npm tarball already contains every module bmad-method would otherwise `git clone` from GitHub at install time.
 
 **Module discovery**: the builder reads BMAD's bundled module registry to learn which external modules to clone. **The registry source has moved across BMAD versions** and the reader must track it:
 
@@ -209,7 +209,7 @@ ma-agents bundles bmad-method as an npm dependency **and** pre-clones BMAD's ext
 | 6.3.0 – 6.6.x | `tools/installer/modules/registry-fallback.yaml` | YAML |
 | 6.8.0+ | `bmad-modules.yaml` (bmad-method **package root**) | YAML (`modules:` map; the in-package `registry-fallback.yaml` was retired in 6.7.0) |
 
-The registry has stayed **YAML** throughout — only its path has moved. (`tools/installer/modules/official-modules.js` is unchanged loader code that reads this YAML; it does not contain the module list.) Modules are classified by a `type` field: `type: bmad-org` modules are bundled (**tea, bmb, cis, gds, wds**) and `type: experimental` modules are excluded (currently `automator`). `bmm`/`core` are built-in (loaded from bmad-method's local `module.yaml`, absent from the registry) and are never cloned. The reader for the current pin and its fail-loud contract are defined by Architecture Decision **P5-5** (Epic 27) in `_bmad-output/planning-artifacts/architecture.md`. A companion build step, `npm run build:plugin` ([scripts/build-plugin.js](../scripts/build-plugin.js)), assembles the ma-agents extension plugin bundle (`lib/bmad-extension-plugin/`) deterministically; a CI Bundle Drift Guard enforces that the committed bundle matches a fresh build.
+The registry has stayed **YAML** throughout — only its path has moved. (`tools/installer/modules/official-modules.js` is unchanged loader code that reads this YAML; it does not contain the module list.) The bundle is governed by a closed allowlist, `KNOWN_BUNDLED_MODULES` = **tea, bmb, cis** (FR235); every other registry entry is excluded whatever its `type`, including `type: experimental` (currently `automator`), the `marketplace-plugin` module `bmad-loop`, and the two design-studio modules `gds`/`wds`, which FR75 does not bundle. `bmm`/`core` are built-in (loaded from bmad-method's local `module.yaml`, absent from the registry) and are never cloned. The reader for the current pin and its fail-loud contract are defined by Architecture Decision **P5-5** (Epic 27) in `_bmad-output/planning-artifacts/architecture.md`. A companion build step, `npm run build:plugin` ([scripts/build-plugin.js](../scripts/build-plugin.js)), assembles the ma-agents extension plugin bundle (`lib/bmad-extension-plugin/`) deterministically; a CI Bundle Drift Guard enforces that the committed bundle matches a fresh build.
 
 > **Maintenance note:** because the registry path has now moved twice (YAML→YAML→YAML at three locations), the cache builder fails loud — if the resolved `type: bmad-org` set is smaller than the known bundled set, or no module source is found, it exits non-zero rather than producing a thin/empty cache, so a future BMAD registry move surfaces at build time, not as a broken air-gapped install.
 

package/lib/bmad-cache/cache-manifest.json

@@ -20,18 +20,6 @@
       "branch": "main",
       "commitSha": "07a8dd03d196a762f21c241d985293fe5b0f90e7",
       "clonedAt": "2026-06-13T15:11:42.507Z"
-    },
-    "gds": {
-      "url": "https://github.com/bmad-code-org/bmad-module-game-dev-studio.git",
-      "branch": "main",
-      "commitSha": "46c3a6cddf882af1f918187d6e5748c1edfd9c52",
-      "clonedAt": "2026-06-13T15:11:43.930Z"
-    },
-    "wds": {
-      "url": "https://github.com/bmad-code-org/bmad-method-wds-expansion",
-      "branch": "main",
-      "commitSha": "cc16f09fcfab26d35635af1491f36a38a8431c8d",
-      "clonedAt": "2026-06-13T15:11:45.601Z"
     }
   }
 }

package/lib/bmad-extension-plugin/.claude-plugin/marketplace.json

@@ -37,7 +37,7 @@
       "name": "ma-skills",
       "source": "./",
       "description": "ma-agents extension module providing enterprise SDLC personas and operational workflow skills.",
-      "version": "3.18.0-beta.2",
+      "version": "3.18.0",
       "author": {
         "name": "Alon Mayaffit"
       },

package/lib/bmad.js

@@ -522,48 +522,44 @@ const BMAD_MODULE_DESCRIPTIONS = Object.freeze({
     bmm: 'BMad Method core — analyst, PM, architect, dev, UX, tech-writer (required)',
     bmb: 'BMad Builder — agent, module, and workflow builders',
     cis: 'Creative Intelligence Suite — innovation and ideation toolkit',
-    gds: 'Game Dev Studio — game development workflows',
     tea: 'Test Architecture Enterprise — Test Architect (Murat) + 9 testarch workflows',
-    wds: 'Whiteport Design Studio — strategic UX and design-first planning',
 });
 
 /**
- * FR123, as amended 2026-08-02 — the DEFAULT BMAD install set.
+ * FR123 — the DEFAULT BMAD install set.
  *
- *   "the default install set is bmm plus the non-design bundled modules —
- *    tea, bmb, cis — from the bundled cache manifest. The two design-studio
- *    modules gds (Game Design Studio) and wds (Whiteport Design Studio) are
- *    bundled but not installed by default."
+ *   "the default install set is bmm, tea, bmb, cis, drawn from the bundled
+ *    cache manifest."
  *
  * BUNDLING AND INSTALLING ARE DIFFERENT THINGS and this constant only speaks
- * about the second one. `gds` and `wds` stay in `lib/bmad-cache/`, stay in
- * `cache-manifest.json`, stay in `KNOWN_BUNDLED_MODULES`, and stay offered by
- * the `--bmad-modules` multiselect — a `--bmad-modules wds` install still
- * resolves entirely from the bundled cache with no network access (NFR2 /
- * NFR50 / NFR57 are untouched). What changes is only that they no longer
- * arrive uninvited.
- *
- * WHY THESE TWO AND NOT OTHERS: they are the only bundled modules that
- * declare a `directories:` block scaffolding `design-artifacts/` at the
- * project root, which is how a Copilot+Cline user with no interest in UX
- * tooling ended up with an unexplained five-folder `design-artifacts/` tree
- * (bug B2). Upstream itself declares `default_selected: false` on every
- * bundled module and `true` only on `bmm`, so narrowing here moves ma-agents
- * TOWARDS upstream's stated intent rather than away from it.
- *
- * DELIBERATELY A LITERAL, NOT DERIVED FROM THE MANIFEST. The previous
- * behaviour — "every non-retired key of the cache manifest" — is precisely
- * what made the set grow silently every time a module was bundled. Naming the
- * members means the next bundled module has to be added here on purpose.
+ * about the second one. They currently coincide: `bmm` ships inside the
+ * `bmad-method` dependency and `tea`/`bmb`/`cis` are the whole of
+ * `KNOWN_BUNDLED_MODULES`, so every installable module is a default one.
+ *
+ * `gds` and `wds` ARE NOT HERE BECAUSE THEY ARE NOT BUNDLED (FR75). They are
+ * absent from `lib/bmad-cache/`, absent from `cache-manifest.json`, and absent
+ * from `KNOWN_BUNDLED_MODULES`, so `getInstallableBmadModules()` never lists
+ * them: the `--bmad-modules` multiselect does not offer them and
+ * `--bmad-modules wds` is rejected by `resolveBmadModules` as an unknown
+ * module. Obtaining either one requires network access to its upstream GitHub
+ * repository, which is exactly what the bundled cache exists to avoid — on an
+ * air-gapped machine they are not installable at all.
+ *
+ * DELIBERATELY A LITERAL, NOT DERIVED FROM THE MANIFEST. Deriving it — "every
+ * non-retired key of the cache manifest" — is what made the set grow silently
+ * every time a module was bundled. Naming the members means the next bundled
+ * module has to be added here on purpose.
  */
 const DEFAULT_BMAD_MODULE_IDS = Object.freeze(['bmm', 'tea', 'bmb', 'cis']);
 
 /**
- * The counterpart to DEFAULT_BMAD_MODULE_IDS: bundled, fully installable, but
- * only when explicitly asked for. Exported so callers (and tests) can state
- * "bundled but not default" without re-deriving it by subtraction.
+ * The counterpart to DEFAULT_BMAD_MODULE_IDS: modules that are bundled and
+ * installable but NOT installed unless asked for. Empty — the bundled set and
+ * the default set coincide. Exported (and kept, rather than deleted) so
+ * callers and tests can state "nothing is bundled-but-withheld" directly
+ * instead of re-deriving it by subtraction.
  */
-const NON_DEFAULT_BMAD_MODULE_IDS = Object.freeze(['gds', 'wds']);
+const NON_DEFAULT_BMAD_MODULE_IDS = Object.freeze([]);
 
 /**
  * The FR123 default set, intersected with what this bundle can actually
@@ -594,12 +590,15 @@ function getDefaultBmadModules(available) {
  * Return the BMAD modules this ma-agents bundle can install. `bmm` (the
  * BMad core) is always first because it ships inside the `bmad-method`
  * npm dependency itself, not in `lib/bmad-cache/` — the cache only carries
- * the optional external modules (bmb, cis, gds, tea, wds, ...).
+ * the optional external modules (bmb, cis, tea).
+ *
+ * The list is the cache manifest, so it is exactly the bundled set: a module
+ * that is not bundled is not installable by this package at all, and callers
+ * never have to special-case one (FR75).
  *
  * Each entry carries a `retired` flag so the caller can hide modules that
  * have been retired upstream (driven by the manifest's `retiredUpstream`
- * marker; at v6.8.0 the bundled set — tea, bmb, cis, gds, wds — are all
- * active `type: bmad-org` clones, so none are flagged).
+ * marker; tea, bmb and cis are all active clones, so none are flagged).
  *
  * If the cache manifest is missing or unreadable, falls back to a list
  * containing only `bmm` — that's the minimum a successful install needs.
@@ -635,7 +634,7 @@ function getInstallableBmadModules() {
  * projects that predate bug 27.13's persisted selection.
  *
  * DIRECTORIES, not merely entries. `fs.existsSync` answers yes for a regular
- * file, so a stray `_bmad/wds` FILE was enough to make this report wds
+ * file, so a stray `_bmad/cis` FILE was enough to make this report cis
  * installed — and because branch 3b PERSISTS what it finds, that misreading
  * became a durable "explicit user selection" the project could never shed.
  * `prePopulateBmadCache` checks `stat.isDirectory()` in the analogous place

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ma-agents",
-  "version": "3.18.0-beta.2",
+  "version": "3.18.0",
   "description": "NPX tool to install skills for AI coding agents (Claude Code, Gemini, Copilot, Kilocode, Cline, Cursor, Roo Code)",
   "main": "index.js",
   "bin": {

package/scripts/build-bmad-cache.js

@@ -23,8 +23,8 @@ const force = process.argv.includes('--force');
 // carry `code`/`url`/`name`/`type` — the same shape the parser already reads.
 // Crucially the new schema carries no `branch` field (default to `main`) and
 // it expresses the bundle decision via a `type` field rather than the old
-// `built_in` flag: `type: bmad-org` modules (tea, bmb, cis, gds, wds) are
-// cloned; `type: experimental` (automator) is excluded; `bmm`/`core` are
+// `built_in` flag. The bundle itself is governed by the closed allowlist
+// below (KNOWN_BUNDLED_MODULES = tea, bmb, cis), not by `type`; `bmm`/`core` are
 // built into the npm package itself and are absent from the registry entirely.
 //
 // Candidates are tried in order; the first that exists on disk wins. The
@@ -57,7 +57,7 @@ const REGISTRY_CANDIDATES = [
 // FUTURE plain `bmad-org` module) onto air-gapped machines. Closing to this
 // allowlist means new/renamed/re-flagged upstream modules FAIL CLOSED (excluded)
 // rather than fail open.
-const KNOWN_BUNDLED_MODULES = ['tea', 'bmb', 'cis', 'gds', 'wds'];
+const KNOWN_BUNDLED_MODULES = ['tea', 'bmb', 'cis'];
 
 // The registry `type` first-party expansions carry. Retained for diagnostics
 // and for the shape-flip assertion below (an allowlisted module is expected to
@@ -206,7 +206,7 @@ function parseModulesYaml(content) {
  *   { code, url, name, branch }
  *
  * CLOSED-BY-DEFAULT (FR235). The filter is an ALLOWLIST: an entry survives ONLY
- * if its `code` is in KNOWN_BUNDLED_MODULES (tea, bmb, cis, gds, wds). Every
+ * if its `code` is in KNOWN_BUNDLED_MODULES (tea, bmb, cis). Every
  * other registry entry is dropped no matter its `type` — so a NEW upstream
  * module (even a plain `type: bmad-org` one carrying neither disqualifying
  * flag), `bmad-loop` (`marketplace-plugin: true`), the deprecated
@@ -602,11 +602,20 @@ function main() {
     }
   }
 
-  // AC #7 gate: preserve existing cached modules that are no longer in the
-  // upstream registry (e.g. v6.3.0 retired `wds`). We keep the directory and
-  // the manifest entry verbatim so downstream consumers keep working until a
-  // maintainer explicitly confirms deletion. The retirement is documented in
-  // the story's Dev Notes.
+  // AC #7 gate: preserve existing cached modules that the resolved set no
+  // longer contains. We keep the directory and the manifest entry verbatim so
+  // downstream consumers keep working until a maintainer explicitly confirms
+  // deletion.
+  //
+  // THE GATE IS DIRECTORY-TRIGGERED, AND THAT MATTERS FOR A DELIBERATE
+  // UNBUNDLING. "Resolved set no longer contains it" covers two different
+  // causes: retired upstream, and removed from KNOWN_BUNDLED_MODULES on
+  // purpose (`gds`/`wds` per FR75). This loop cannot tell them apart — it only
+  // asks whether `lib/bmad-cache/<code>/` is still on disk. So removing a code
+  // from the allowlist WITHOUT deleting its directory re-adds it to the
+  // manifest flagged `retiredUpstream: true`, and it is back in
+  // `getInstallableBmadModules()`. Deleting the directory is therefore part of
+  // unbundling a module, not a separate tidy-up.
   //
   // `retentionStash` was built up-front (before any --force wipe) so the
   // retention decision does not depend on whether the module directory

package/lib/bmad-cache/gds/.claude-plugin/marketplace.json

@@ -1,56 +0,0 @@
-{
-  "name": "bmad-game-dev-studio",
-  "owner": {
-    "name": "Brian (BMad) Madison"
-  },
-  "license": "MIT",
-  "homepage": "https://github.com/bmad-code-org/bmad-module-game-dev-studio",
-  "repository": "https://github.com/bmad-code-org/bmad-module-game-dev-studio",
-  "keywords": ["bmad", "game-dev", "unity", "unreal", "godot", "game-design", "game-architecture"],
-  "plugins": [
-    {
-      "name": "bmad-game-dev-studio",
-      "source": "./",
-      "description": "A comprehensive game development module with agents and workflows for preproduction, design, architecture, production, and testing across Unity, Unreal, and Godot. Part of the BMad Method ecosystem.",
-      "version": "0.6.0",
-      "author": {
-        "name": "Brian (BMad) Madison"
-      },
-      "skills": [
-        "./src/agents/gds-agent-game-architect",
-        "./src/agents/gds-agent-game-designer",
-        "./src/agents/gds-agent-game-dev",
-        "./src/agents/gds-agent-game-solo-dev",
-        "./src/agents/gds-agent-tech-writer",
-        "./src/workflows/1-preproduction/gds-brainstorm-game",
-        "./src/workflows/1-preproduction/gds-create-game-brief",
-        "./src/workflows/1-preproduction/research/gds-domain-research",
-        "./src/workflows/2-design/gds-create-narrative",
-        "./src/workflows/2-design/gds-create-ux-design",
-        "./src/workflows/2-design/gds-gdd",
-        "./src/workflows/2-design/gds-prd",
-        "./src/workflows/3-technical/gds-check-implementation-readiness",
-        "./src/workflows/3-technical/gds-create-epics-and-stories",
-        "./src/workflows/3-technical/gds-game-architecture",
-        "./src/workflows/3-technical/gds-generate-project-context",
-        "./src/workflows/4-production/gds-code-review",
-        "./src/workflows/4-production/gds-correct-course",
-        "./src/workflows/4-production/gds-create-story",
-        "./src/workflows/4-production/gds-dev-story",
-        "./src/workflows/4-production/gds-investigate",
-        "./src/workflows/4-production/gds-retrospective",
-        "./src/workflows/4-production/gds-sprint-planning",
-        "./src/workflows/4-production/gds-sprint-status",
-        "./src/workflows/gametest/gds-e2e-scaffold",
-        "./src/workflows/gametest/gds-performance-test",
-        "./src/workflows/gametest/gds-playtest-plan",
-        "./src/workflows/gametest/gds-test-automate",
-        "./src/workflows/gametest/gds-test-design",
-        "./src/workflows/gametest/gds-test-framework",
-        "./src/workflows/gametest/gds-test-review",
-        "./src/workflows/gds-document-project",
-        "./src/workflows/gds-quick-flow/gds-quick-dev"
-      ]
-    }
-  ]
-}

package/lib/bmad-cache/gds/.markdownlint-cli2.yaml

@@ -1,35 +0,0 @@
-# markdownlint-cli2 configuration
-# https://github.com/DavidAnson/markdownlint-cli2
-
-ignores:
-  - node_modules/**
-  - test/fixtures/**
-  - CODE_OF_CONDUCT.md
-  - _bmad/**
-  - _bmad*/**
-  - .*/**
-  - z*/**
-
-# Rule configuration
-config:
-  # Disable all rules by default
-  default: false
-
-  # Heading levels should increment by one (h1 -> h2 -> h3, not h1 -> h3)
-  MD001: true
-
-  # Duplicate sibling headings (same heading text at same level under same parent)
-  MD024:
-    siblings_only: true
-
-  # Trailing commas in headings (likely typos)
-  MD026:
-    punctuation: ","
-
-  # Bare URLs - may not render as links in all parsers
-  # Should use <url> or [text](url) format
-  MD034: true
-
-  # Spaces inside emphasis markers - breaks rendering
-  # e.g., "* text *" won't render as emphasis
-  MD037: true

package/lib/bmad-cache/gds/.nvmrc

@@ -1 +0,0 @@
-22

package/lib/bmad-cache/gds/.prettierignore

@@ -1,9 +0,0 @@
-# Test fixtures with intentionally broken/malformed files
-test/fixtures/**
-
-# Contributor Covenant (external standard)
-CODE_OF_CONDUCT.md
-
-# BMAD runtime folders (user-specific, not in repo)
-_bmad/
-_bmad*/

package/lib/bmad-cache/gds/CNAME

@@ -1 +0,0 @@
-game-dev-studio-docs.bmad-method.org

package/lib/bmad-cache/gds/LICENSE

@@ -1,26 +0,0 @@
-MIT License
-
-Copyright (c) 2026 BMad Code, LLC
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-TRADEMARK NOTICE:
-BMad™ , BMAD-CORE™ and BMAD-METHOD™ are trademarks of BMad Code, LLC. The use of these 
-trademarks in this software does not grant any rights to use the trademarks 
-for any other purpose.

package/lib/bmad-cache/gds/README.md

@@ -1,134 +0,0 @@
-# BMad Game Dev Studio
-
-[![Version](https://img.shields.io/npm/v/bmad-game-dev-studio?color=blue&label=version)](https://www.npmjs.com/package/bmad-game-dev-studio)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Python Version](https://img.shields.io/badge/python-%3E%3D3.10-blue?logo=python&logoColor=white)](https://www.python.org)
-[![uv](https://img.shields.io/badge/uv-package%20manager-blueviolet?logo=uv)](https://docs.astral.sh/uv/)
-[![Discord](https://img.shields.io/badge/Discord-Join%20Community-7289da?logo=discord&logoColor=white)](https://discord.gg/gk8jAdXWmj)
-
-**BMGD brings BMad's structured development to game development.** Create working prototypes quickly in Unity, Unreal, Godot, Roblox—or any engine you choose.
-
-![BMGD Logo](docs/bmgd-logo.png)
-
-## About BMGD
-
-BMad Game Dev Studio (BMGD) adapts the BMad Method framework for game development. Developed by game industry veterans, BMGD guides you through product research, technical design, narrative design, and a full epic-driven production cycle.
-
-## Supported Engines
-
-BMGD has first-class support for:
-
-- [Unity](https://unity.com) — C# scripting, industry-standard for many game types
-- [Unreal Engine](https://www.unrealengine.com/) — Blueprint and C++, AAA powerhouse
-- [Godot](https://godotengine.org/) — Open-source, GDScript, rapidly growing
-- [Roblox](https://www.roblox.com/create) — Luau scripting, platform-native game development
-
-But you're not limited to these—BMGD works with any platform, from pure C to custom engines.
-
-## What You Can Create
-
-BMGD supports **21 game types**, including:
-
-| Genre | Examples |
-|-------|----------|
-| Action | Platformers, shooters, hack-and-slash |
-| RPG | Action RPG, tactical RPG, dungeon crawlers |
-| Strategy | Turn-based, RTS, tower defense |
-| Simulation | Life sim, tycoon, management |
-| Adventure | Visual novels, point-and-click, walking simulators |
-| And more... | Survival, horror, puzzle, racing, etc. |
-
-## What BMGD Does
-
-- **Product Research** — Market analysis, competitor research, positioning
-- **Game Design Document** — Comprehensive GDD with mechanics, progression, and balance
-- **Narrative Design** — Story structure, characters, dialogue, world-building
-- **UX Design** — Two peer specs: `DESIGN.md` (visual identity) and `EXPERIENCE.md` (UI/HUD behavior, input schemes, player journeys)
-- **Technical Architecture** — Engine patterns, performance considerations
-- **Production Planning** — Epic-driven sprints, story tracking, retrospectives
-- **Quick Prototyping** — Skip the planning, jump straight into building
-
-## What BMGD Doesn't Do
-
-BMGD works *with* coding agents like Claude Code, Cursor, or GitHub Copilot—but it can't create everything:
-
-- Art assets (models, textures, sprites)
-- Animations
-- Music and sound effects
-- Full game implementation from scratch
-
-Think of BMGD as your senior game dev colleague—not a replacement for your entire team.
-
-## Installation
-
-BMGD is installed as a module during BMad Method setup:
-
-```bash
-npx bmad-method install
-```
-
-Select **Game Dev Studio** from the modules list. 
-
-*Just a heads-up: if you’re only using Game Dev Studio (GDS), you don’t need to install the main BMM module. GDS runs on its own, but BMM gets updated more often, so you might want to use its workflows—they work together nicely!*
-
-## Quick Start
-
-After installing, run from your project root:
-
-```
-/bmad-help          # Get guided help for game development
-/bmgd-quick-dev     # Jump straight into prototyping
-/bmgd-gdd           # Create a Game Design Document
-/bmgd-narrative     # Design your game's story
-```
-
-## Two Ways to Work
-
-| Approach | When to Use | Workflow |
-|----------|-------------|----------|
-| **Quick Flow** | Rapid prototyping, small projects | `/bmgd-quick-dev` |
-| **Full Production** | Full games, teams, long-term | `/bmad-help` for guided path |
-
-## Example: Starting a New Game
-
-```
-You: /bmad-help
-BMGD: What kind of game are you making?
-You: A tactical sci-fi RPG
-BMGD: Great choice! Here's what I recommend...
-    [Guides you through genre-specific planning]
-    [Helps select appropriate workflows]
-```
-
-## Documentation
-
-**[BMad Game Dev Studio Documentation](http://game-dev-studio-docs.bmad-method.org)** — Tutorials, how-to guides, and reference
-
-- [Getting Started](http://game-dev-studio-docs.bmad-method.org/tutorials/)
-- [BMad Method Docs](http://docs.bmad-method.org) — Core framework documentation
-
-## Community
-
-- [Discord](https://discord.gg/gk8jAdXWmj) — Get help from other game devs
-- [YouTube](https://youtube.com/@BMadCode) — Tutorials, master class, and more
-- [X / Twitter](https://x.com/BMadCode)
-- [Website](https://bmadcode.com)
-- [GitHub Issues](https://github.com/bmad-code-org/bmad-module-game-dev-studio/issues) — Report bugs
-
-## Support BMad
-
-BMad is free for everyone and always will be. Star this repo, [buy me a coffee](https://buymeacoffee.com/bmad), or email <contact@bmadcode.com> for corporate sponsorship.
-
-## License
-
-MIT License — see [LICENSE](LICENSE) for details.
-
----
-
-**BMad Game Dev Studio** — Part of the [BMad Method](https://github.com/bmad-code-org/BMAD-METHOD) ecosystem.
-
-[![Contributors](https://contrib.rocks/image?repo=bmad-code-org/bmad-module-game-dev-studio)](https://github.com/bmad-code-org/bmad-module-game-dev-studio/graphs/contributors)
-
-See [CONTRIBUTORS.md](CONTRIBUTORS.md) for contributor information.
-
-*If you can dream it, you can build it.*

package/lib/bmad-cache/gds/_git_preserved/HEAD

@@ -1 +0,0 @@
-ref: refs/heads/main