ma-agents 3.4.9 → 3.5.0

package/_bmad-output/implementation-artifacts/5-6-fix-space-in-path-bug.md

@@ -0,0 +1,186 @@
+# Story 5.6: Fix Space-in-Path Bug
+
+Status: review
+
+<!-- Note: Validation is optional. Run validate-create-story for quality check before dev-story. -->
+<!-- Epic: 5 — Bundled BMAD Installation (Phase 2) -->
+<!-- Sprint Phase: Phase A — Installation Fixes (next release) -->
+<!-- Dependencies: Story 5.5 (buildBmadArgs) must be implemented first — this story verifies and hardens its path quoting. -->
+
+## Story
+
+As an **engineer**,
+I want ma-agents installation to work in directories containing spaces,
+so that I can install in any project location without path-related failures.
+
+## Acceptance Criteria
+
+1. **Given** the project is located at a path with spaces (e.g., `d:\My Projects\agents`)
+   **When** `npx ma-agents install` is run
+   **Then** the installation completes without errors
+   **And** all file paths are properly quoted in `execSync` calls
+
+2. **Given** any `execSync` call in `bmad.js` that constructs shell commands with paths
+   **When** the path contains spaces, parentheses, or other shell-special characters
+   **Then** the path is enclosed in double quotes in the command string
+
+3. **Given** `require.resolve()` returns a path with spaces
+   **When** the resolved path is used in an `execSync` call
+   **Then** the path is quoted: `execSync('node "${resolvedPath}" install ...')`
+
+## Tasks / Subtasks
+
+- [x] Task 1: Audit all `execSync` calls in `lib/bmad.js` (AC: #1, #2, #3)
+  - [x] 1.1 Verify `buildBmadArgs()` (from Story 5.5) quotes `--directory` path — line 47: `"${ctx.projectRoot}"`
+  - [x] 1.2 Verify `buildBmadArgs()` quotes the `bmadPath` from `require.resolve()` — line 13 in `getBmadCommand()`: `"${wrapperPath}"`
+  - [x] 1.3 Verify `buildBmadArgs()` quotes `--custom-content` extension path — line 69: `"${extensionPath}"`
+  - [x] 1.4 Verify `buildBmadArgs()` quotes `--user-name` (may contain spaces) — line 54: `"${ctx.userName}"`
+  - [x] 1.5 Verify `restoreGitDir()` line 464 quotes `localUrl` — confirmed: `"${localUrl}"`
+  - [x] 1.6 Confirm NO other `execSync` calls exist outside `bmad.js` in ma-agents source — verified: `bin/cli.js` has none, `scripts/build-bmad-cache.js` uses `execFileSync` (array-based, immune)
+- [x] Task 2: Verify `cwd` option handling (AC: #1)
+  - [x] 2.1 Confirm all `execSync` calls pass `cwd` as a Node.js option (not embedded in command string) — all 4 calls (lines 95, 120, 196, 465) use `{ cwd: ... }` option
+  - [x] 2.2 Node.js `cwd` option handles spaces natively — no quoting needed
+- [x] Task 3: Smoke test with space-in-path directory (AC: #1, #2, #3)
+  - [x] 3.1 Created test directory: `d:\tmp\My Test Project\`
+  - [x] 3.2 Ran `npm init -y && npm install d:\Code\agents` — success
+  - [x] 3.3 Ran `npx ma-agents install --yes` — completed without path-related errors
+  - [x] 3.4 Verified `_bmad/` output: `_config`, `_memory`, `bmb`, `bmm`, `core`, `custom`, `extensions`, `skills` all present
+  - [x] 3.5 Ran update path: triggered `updateBmad()` with `--action update` — path handling correct (bmad-method module source issue is upstream, not path-related)
+- [x] Task 4: Edge case verification (AC: #2)
+  - [x] 4.1 Tested path with parentheses: `d:\tmp\Project (v2)\` — `buildBmadArgs()` correctly produces `--directory "D:\tmp\Project (v2)"` from real `process.cwd()`
+  - [x] 4.2 Ampersand in path: `buildBmadArgs()` correctly quotes — double quotes protect `&` from shell interpretation on Windows
+  - [x] 4.3 No unsupported characters found. All tested special chars (spaces, parentheses, ampersand) are correctly handled by double-quoting
+
+## Dev Notes
+
+### Relationship to Story 5.5
+
+The epics file explicitly states: "This is a bug fix — can be combined with Story 5.5 implementation since both touch the same code." Story 5.5's `buildBmadArgs()` function is the PRIMARY fix — it centralizes all path quoting in one place. Story 5.6 exists to:
+
+1. **Audit completeness** — verify `buildBmadArgs()` didn't miss any path arguments
+2. **Test with real space-in-path directories** — prove the fix works end-to-end
+3. **Cover edge cases** — parentheses, ampersands, unicode in paths
+
+If Story 5.5 is implemented correctly, Story 5.6 should mostly be a verification pass with minimal (or zero) additional code changes.
+
+### Complete `execSync` Audit of `lib/bmad.js`
+
+Only 4 `execSync` calls exist in the entire ma-agents codebase (all in `lib/bmad.js`):
+
+| Line | Function | Call | Path safety |
+|---|---|---|---|
+| 42 | `installBmad()` | `execSync(command, { cwd: projectRoot, ... })` | Command built by `buildBmadArgs()` (after 5.5). `cwd` is Node option — safe. |
+| 68 | `updateBmad()` | `execSync(command, { cwd: projectRoot, ... })` | Same as line 42. |
+| 143 | `applyCustomizations()` | `execSync(command, { cwd: projectRoot, ... })` | Same as line 42. |
+| 411 | `restoreGitDir()` | `execSync(\`git remote set-url origin "${localUrl}"\`, { cwd: moduleDir, ... })` | `localUrl` already quoted. `cwd` is Node option — safe. |
+
+**Other files:** No `execSync` calls in `bin/cli.js`, `lib/installer.js`, or `lib/agents.js`. The `scripts/build-bmad-cache.js` uses `execFileSync` (array-based args, immune to space issues).
+
+### Paths That Must Be Quoted in `buildBmadArgs()`
+
+After Story 5.5, `buildBmadArgs()` constructs the command string. These paths MUST be double-quoted:
+
+| Path | Source | Example with spaces |
+|---|---|---|
+| `bmadPath` | `require.resolve('bmad-method/...')` | `C:\Users\John Smith\node_modules\bmad-method\tools\bmad-npx-wrapper.js` |
+| `--directory` value | `installContext.projectRoot` | `d:\My Projects\agents` |
+| `--custom-content` value | `path.join(__dirname, 'bmad-extension')` | `C:\Users\John Smith\node_modules\ma-agents\lib\bmad-extension` |
+| `--user-name` value | `installContext.userName` | `John Smith` |
+| `--output-folder` value | `installContext.outputFolder` | Unlikely to have spaces, but quote defensively |
+
+Non-path values that do NOT need quoting: `--modules`, `--tools`, `--communication-language`, `--document-output-language`, `--action`, `--yes`.
+
+### `restoreGitDir()` — Already Safe
+
+Line 411: `execSync(\`git remote set-url origin "${localUrl}"\`)` — the `localUrl` is already wrapped in double quotes. The `cwd: moduleDir` is a Node.js option, not interpolated into the command string. No changes needed here.
+
+### Windows-Specific Considerations
+
+- Windows paths use backslashes (`\`), which are NOT shell-special in `cmd.exe` or PowerShell
+- Double quotes in `execSync` on Windows are handled correctly by Node.js
+- `require.resolve()` returns native path separators (backslash on Windows)
+- The `cwd` option in `execSync` works with both forward and backslashes on Windows
+
+### Previous Story Intelligence (5.5)
+
+Story 5.5 creates `buildBmadArgs(installContext)` which centralizes command construction. Its reference implementation quotes all path arguments with template literals: `\`"${path}"\``. The key things to verify:
+
+- `bmadPath` is quoted: `\`"${bmadPath}"\``
+- `projectRoot` is quoted: `'--directory', \`"${installContext.projectRoot}"\``
+- `extensionPath` is quoted: `'--custom-content', \`"${extensionPath}"\``
+- `userName` is quoted: `'--user-name', \`"${installContext.userName}"\``
+
+If any of these are missing in the actual 5.5 implementation, add the quotes in this story.
+
+### Previous Story Intelligence (5.4)
+
+Story 5.4 discovered the `--directory` bug — the parameter was missing entirely. After adding it, the format was `--directory "${projectRoot}"` which correctly handles spaces. However, 5.4 only fixed the 3 `getBmadCommand()` callsites — it didn't audit the wrapper path or extension path for space safety.
+
+### Project Structure Notes
+
+- **Primary file**: `lib/bmad.js` — audit and fix if needed (changes from 5.5 should cover this)
+- **No new files created**
+- **No new dependencies**
+- This story is primarily verification/testing with code fixes only if gaps are found
+
+### References
+
+- [Source: epics.md, Story 5.6 lines 578-603] — Acceptance criteria and technical notes
+- [Source: epics.md, Story 5.5 lines 571-572] — "All path arguments must be quoted" technical note
+- [Source: architecture.md, Decision P2-6] — "all path arguments are quoted" design decision
+- [Source: lib/bmad.js lines 10-18] — `getBmadCommand()` with quoted wrapperPath
+- [Source: lib/bmad.js lines 398-418] — `restoreGitDir()` with quoted localUrl
+- [Source: 5-5-explicit-parameter-passing.md] — buildBmadArgs() reference implementation with quoting
+- [Source: 5-4-validate-bundled-installation.md] — --directory bug fix discovery
+
+## Previous Story Intelligence (5.5)
+
+Story 5.5 introduces `buildBmadArgs(installContext)` that replaces all 3 ad-hoc command construction sites. The function centralizes path quoting. Key design decisions from 5.5:
+
+- All path arguments use `\`"${value}"\`` template literal quoting
+- `getBmadCommand()` may be subsumed or called internally by `buildBmadArgs()`
+- `--custom-content` flag added for extension module deployment
+- Optional params (`userName`, etc.) only included if provided
+
+**Key learning from 5.4**: bmad-method silently succeeds when params are missing or malformed — always verify `_bmad/` output after install to catch silent failures.
+
+## Git Intelligence
+
+Recent commits (descending):
+```
+998fa13 docs(planning): add F9 migration, F10 multi-repo, F6 explicit params, Epic 17 sprint rework
+8e88686 chore(release): bump version to 2.21.0
+63610de feat(epic-13): auto-generate project-context.md at install time
+```
+
+Current version: **2.21.0**. No code changes to `lib/bmad.js` since Story 5.4.
+
+## Dev Agent Record
+
+### Agent Model Used
+
+Claude Opus 4.6 (1M context)
+
+### Debug Log References
+
+- Smoke test in `d:\tmp\My Test Project\`: full install completed, `_bmad/` has 8 expected subdirectories
+- Update path test: command correctly included `--action update` with all quoted paths; bmad-method "module source not available" error is upstream (custom module update behavior), not path-related
+- Parentheses test in `d:\tmp\Project (v2)\`: `buildBmadArgs()` correctly produces `--directory "D:\tmp\Project (v2)"` from real `process.cwd()`
+
+### Completion Notes List
+
+- Story 5.6 is a verification/audit pass — Story 5.5's `buildBmadArgs()` already correctly quotes ALL path arguments
+- Zero code changes required: the `buildBmadArgs()` function from Story 5.5 handles all space-in-path scenarios correctly
+- Audit confirmed: only 4 `execSync` calls in entire ma-agents codebase, all in `lib/bmad.js`, all with proper path quoting and `cwd` as Node.js options
+- End-to-end smoke test confirmed: full install + update path work in `d:\tmp\My Test Project\` (directory with spaces)
+- Edge cases verified: parentheses in path `Project (v2)` and ampersand `R&D` both handled by double quoting
+- No unsupported characters identified
+
+### File List
+
+- `_bmad-output/implementation-artifacts/5-6-fix-space-in-path-bug.md` — Story file updates (tasks, status, dev record)
+- `_bmad-output/implementation-artifacts/sprint-status.yaml` — Status: ready-for-dev → review
+
+## Change Log
+
+- 2026-03-26: Completed Story 5.6 — verification/audit pass confirming Story 5.5's `buildBmadArgs()` correctly handles all space-in-path scenarios. Smoke-tested in `d:\tmp\My Test Project\` (spaces) and `d:\tmp\Project (v2)\` (parentheses). Zero code changes needed — all path quoting was already correct from Story 5.5.

package/_bmad-output/implementation-artifacts/7-1-test-infrastructure-setup.md

@@ -0,0 +1,144 @@
+# Story 7.1: Set Up Test Framework and First Tests for agents.js
+
+Status: ready-for-dev
+
+<!-- Note: Validation is optional. Run validate-create-story for quality check before dev-story. -->
+
+## Story
+
+As a **developer**,
+I want a test framework configured with initial tests for the agent registry module,
+So that agent configuration changes are verified automatically.
+
+## Acceptance Criteria
+
+1. **Given** Node.js built-in test runner is configured in `package.json`
+   **When** `npm test` is executed
+   **Then** tests run and report results (exit 0 on pass, non-zero on failure)
+
+2. **Given** tests exist for `agents.js`
+   **When** the test suite runs
+   **Then** it verifies:
+   - All 11 agents are registered with required fields (`id`, `name`, `version`, `category`, `description`, `getProjectPath`, `getGlobalPath`, `fileExtension`, `template`, `instructionFiles`)
+   - `getProjectPath()` returns a string containing the agent's expected directory name
+   - `getGlobalPath()` returns a valid path for the current OS
+   - `resourceMap` is defined for agents that need it (currently only `cline`)
+   - No duplicate agent `id` values exist in the registry
+   - `getAgent(id)` returns the correct agent object
+   - `getAllAgents()` returns all 11 agents
+   - `getAgentsByCategory('ide')` returns 7 agents, `getAgentsByCategory('bmad')` returns 4 agents
+
+## Tasks / Subtasks
+
+- [ ] Task 1: Configure Node.js built-in test runner (AC: #1)
+  - [ ] 1.1: Replace the current placeholder test script in `package.json:11` with `node --test tests/`
+  - [ ] 1.2: Verify `node --test` works with the project's minimum Node.js version (`>=16.0.0` per `package.json:33`) — Note: `node --test` requires Node 18+. If minimum version must stay at 16, consider `node --test tests/*.test.js` with a version check
+  - [ ] 1.3: Create `tests/` directory at project root
+  - [ ] 1.4: Run `npm test` — verify it discovers and runs test files (even if empty initially)
+- [ ] Task 2: Write agents.js tests (AC: #2)
+  - [ ] 2.1: Create `tests/agents.test.js`
+  - [ ] 2.2: Test: `getAllAgents()` returns exactly 11 agents
+  - [ ] 2.3: Test: every agent has all required fields (`id`, `name`, `version`, `category`, `description`, `getProjectPath`, `getGlobalPath`, `fileExtension`, `template`, `instructionFiles`)
+  - [ ] 2.4: Test: `getProjectPath()` returns a string for each agent
+  - [ ] 2.5: Test: `getGlobalPath()` returns a string for each agent
+  - [ ] 2.6: Test: no duplicate `id` values across agents
+  - [ ] 2.7: Test: `getAgent('claude-code')` returns agent with `name: 'Claude Code'`
+  - [ ] 2.8: Test: `getAgent('nonexistent')` returns `undefined`
+  - [ ] 2.9: Test: `getAgentsByCategory('ide')` returns 7 agents
+  - [ ] 2.10: Test: `getAgentsByCategory('bmad')` returns 4 agents
+  - [ ] 2.11: Test: `cline` agent has `resourceMap` with `references` and `assets` keys
+  - [ ] 2.12: Test: agents without `resourceMap` don't have the property (or it's undefined)
+  - [ ] 2.13: Test: all `instructionFiles` entries are non-empty strings
+
+## Dev Notes
+
+### Architecture Compliance
+
+- **Test location:** `tests/` directory at project root, mirroring source structure. Co-located tests are not used. [Source: architecture.md#Structure-Patterns]
+- **No new runtime dependencies:** The test runner is built into Node.js. No Jest, Mocha, or Vitest needed. [Source: architecture.md#Anti-Patterns]
+- **Test framework decision:** Architecture recommends Node.js built-in test runner (no dependencies, aligns with minimal approach). [Source: architecture.md#Infrastructure-Deployment]
+
+### Node.js Built-in Test Runner
+
+Use `node:test` module (available since Node 18.x, stable in Node 20+):
+
+```javascript
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const { getAgent, getAllAgents, getAgentsByCategory } = require('../lib/agents');
+
+describe('agents registry', () => {
+  it('should have 11 agents', () => {
+    assert.strictEqual(getAllAgents().length, 11);
+  });
+});
+```
+
+Run with: `node --test tests/`
+
+### Node.js Version Consideration
+
+Current `package.json` specifies `"node": ">=16.0.0"`. The built-in test runner requires Node 18+. Options:
+1. **Recommended:** Bump minimum to `>=18.0.0` (Node 16 EOL was September 2023 — well past)
+2. **Alternative:** Keep >=16 but note tests require 18+ (add check in test script)
+
+### Current Test Script
+
+The existing `package.json` test script is a placeholder:
+```json
+"test": "node -e \"const {listSkills,listAgents}=require('./lib/installer'); console.log('Skills:',listSkills().length,'Agents:',listAgents().length)\""
+```
+This should be replaced with the proper test runner command.
+
+### Exported Functions from agents.js
+
+From [agents.js:256-272](lib/agents.js#L256-L272):
+- `getAgent(agentId)` — returns single agent by id
+- `getAllAgents()` — returns full array (11 agents)
+- `getAgentsByCategory(category)` — filtered by 'ide' or 'bmad'
+
+### Agent Registry Schema (from actual code)
+
+Every agent object has these fields (verified from [agents.js:17-253](lib/agents.js#L17-L253)):
+- `id` (string) — unique identifier (e.g., 'claude-code', 'copilot')
+- `name` (string) — display name (e.g., 'Claude Code', 'GitHub Copilot')
+- `version` (string) — semver (e.g., '1.0.0')
+- `category` (string) — 'ide' or 'bmad'
+- `description` (string) — brief description
+- `getProjectPath` (function) — returns project-level skills directory path
+- `getGlobalPath` (function) — returns global/user-level skills directory path
+- `fileExtension` (string) — '.md' for all current agents
+- `template` (string) — 'claude-code', 'cline', or 'generic'
+- `instructionFiles` (array of strings) — instruction file paths
+
+Optional:
+- `resourceMap` (object) — only on `cline` agent (maps 'references' → 'docs', 'assets' → 'templates')
+
+### Critical Guardrails
+
+- **No new npm dependencies** — use Node.js built-in `node:test` and `node:assert` only
+- **Tests must not modify the file system** — agents.js is pure data + functions, no side effects
+- **Do not modify `lib/agents.js`** — tests should validate existing behavior, not change it
+
+### Project Structure Notes
+
+- Files to create: `tests/agents.test.js`
+- Files to modify: `package.json` (update test script, optionally bump engine version)
+- No changes to `lib/` source files
+
+### References
+
+- [Source: _bmad-output/planning-artifacts/epics.md#Epic-7] — Story 7.1 definition
+- [Source: _bmad-output/planning-artifacts/architecture.md#Structure-Patterns] — Tests directory location
+- [Source: _bmad-output/planning-artifacts/architecture.md#Infrastructure-Deployment] — Test framework recommendation
+- [Source: lib/agents.js] — Agent registry (11 agents, 272 lines, 3 exported functions)
+
+## Dev Agent Record
+
+### Agent Model Used
+
+### Debug Log References
+
+### Completion Notes List
+
+### File List

package/_bmad-output/implementation-artifacts/7-2-installer-pipeline-tests.md

@@ -0,0 +1,132 @@
+# Story 7.2: Add Tests for installer.js Core Operations
+
+Status: ready-for-dev
+
+<!-- Note: Validation is optional. Run validate-create-story for quality check before dev-story. -->
+<!-- Dependency: Story 7-1 must be completed first (test framework setup) -->
+
+## Story
+
+As a **developer**,
+I want tests covering the installer engine's core operations,
+So that skill installation, manifest management, and MANIFEST.yaml generation are protected against regressions.
+
+## Acceptance Criteria
+
+1. **Given** tests exist for `installer.js`
+   **When** the test suite runs
+   **Then** it verifies:
+   - Skill discovery scans the `skills/` directory and finds all valid skills
+   - Template resolution follows priority chain (agent-specific → generic → SKILL.md)
+   - Manifest read/write operations are atomic (no partial states)
+   - MANIFEST.yaml generation produces valid YAML from installed skills
+   - Additive-only installation does not remove existing agent configurations (NFR5)
+
+2. **Given** a test skill directory is set up in a temp directory
+   **When** install operations are tested
+   **Then** files are written to the temp directory, not actual agent config directories
+
+## Tasks / Subtasks
+
+- [ ] Task 1: Create test fixtures (AC: #2)
+  - [ ] 1.1: Create `tests/fixtures/` directory for test skill data
+  - [ ] 1.2: Create a minimal test skill: `tests/fixtures/test-skill/skill.json` + `SKILL.md`
+  - [ ] 1.3: Create a test skill with templates: `tests/fixtures/test-skill-with-templates/` including `templates/claude-code.md` and `templates/generic.md`
+  - [ ] 1.4: Create a test skill with resources: `tests/fixtures/test-skill-with-resources/` including `references/` and `assets/` directories
+- [ ] Task 2: Test skill discovery functions (AC: #1)
+  - [ ] 2.1: Create `tests/installer.test.js`
+  - [ ] 2.2: Test: `listSkills()` returns an array of skill objects (currently 28 skills)
+  - [ ] 2.3: Test: each skill object has required fields from `skill.json` (name, version, description, category)
+  - [ ] 2.4: Test: `listAgents()` returns the same as `getAllAgents()` from agents.js
+  - [ ] 2.5: Test: `getInstalledSkillInfo()` returns null/undefined for non-installed skills
+- [ ] Task 3: Test manifest operations (AC: #1)
+  - [ ] 3.1: Test: `readManifest()` returns empty manifest for non-existent path
+  - [ ] 3.2: Test: `writeManifest()` creates valid JSON file
+  - [ ] 3.3: Test: `ensureManifest()` creates manifest entry for agent+scope
+  - [ ] 3.4: Test: `getManifestAgents()` returns agent IDs from manifest
+  - [ ] 3.5: Test: manifest write → read roundtrip preserves data
+  - [ ] 3.6: All manifest tests use `os.tmpdir()` temp directory, cleaned up after
+- [ ] Task 4: Test MANIFEST.yaml generation (AC: #1)
+  - [ ] 4.1: Test: `generateSkillsManifest()` produces a file ending in `.yaml`
+  - [ ] 4.2: Test: generated MANIFEST.yaml content includes skill names and metadata
+  - [ ] 4.3: Use temp directory for generation output
+- [ ] Task 5: Test semver comparison (AC: #1)
+  - [ ] 5.1: Test: `compareSemver('1.0.0', '1.0.0')` returns 0
+  - [ ] 5.2: Test: `compareSemver('1.0.0', '2.0.0')` returns -1
+  - [ ] 5.3: Test: `compareSemver('2.0.0', '1.0.0')` returns 1
+  - [ ] 5.4: Test: `compareSemver('1.0.1', '1.0.0')` returns 1
+
+## Dev Notes
+
+### Architecture Compliance
+
+- **Test location:** `tests/installer.test.js` in the tests directory [Source: architecture.md#Structure-Patterns]
+- **Temp directory isolation:** All file-writing tests must use `os.tmpdir()` or `fs.mkdtempSync()`. Never write to actual agent config directories or the project's `skills/` directory during tests. [Source: AC #2]
+- **No mocking the database:** Tests should use real file system operations in temp directories, not mocked fs. [Source: architecture.md — integration test philosophy]
+
+### installer.js Exported Functions
+
+From [installer.js:10-591](lib/installer.js) — 16 functions, key ones for testing:
+
+**Pure/stateless (easy to test):**
+- `listSkills()` (line 178) — scans `skills/` directory, returns array of skill metadata
+- `listAgents()` (line 204) — delegates to agents.js `getAllAgents()`
+- `compareSemver(a, b)` (line 166) — pure comparison function
+- `getPackageVersion()` (line 10) — reads package.json version
+
+**Manifest operations (need temp dir):**
+- `readManifest(installPath)` (line 17) — reads `.ma-agents.json`
+- `writeManifest(installPath, manifest)` (line 29) — writes `.ma-agents.json`
+- `ensureManifest(installPath, agentId, scope)` (line 34) — creates manifest structure
+- `getManifestAgents(manifest)` (line 59) — extracts agent IDs from manifest
+- `getInstalledSkillInfo(installPath, skillId)` (line 67) — reads installed skill version
+
+**File-writing operations (need temp dir + careful isolation):**
+- `generateSkillsManifest(installPath)` (line 75) — generates MANIFEST.yaml
+- `performInstall(skillId, skill, agent, installPath)` (line 210) — copies skill files
+- `installSkill(skillId, agentIds, ...)` (line 278) — full install orchestration
+
+**Note:** `performInstall` and `installSkill` involve complex file operations and agent path resolution. Consider testing these in Story 7.2 only at the unit level (manifest + discovery), deferring full integration install tests if they require too much setup.
+
+### Test Fixture Skill Schema
+
+Minimal `skill.json` for test fixtures:
+```json
+{
+  "name": "test-skill",
+  "version": "1.0.0",
+  "description": "Test skill for automated testing",
+  "category": "testing",
+  "tags": ["test"],
+  "always_load": false
+}
+```
+
+### Critical Guardrails
+
+- **Never write to real agent directories** — all file operations in temp dirs only
+- **Clean up temp dirs after each test** — use `t.after()` or `after()` hooks
+- **No new npm dependencies** — use `node:test`, `node:assert`, `node:fs`, `node:os`, `node:path`
+- **Do not modify `lib/installer.js`** — tests validate existing behavior
+
+### Project Structure Notes
+
+- Files to create: `tests/installer.test.js`, `tests/fixtures/test-skill/` (skill.json + SKILL.md), `tests/fixtures/test-skill-with-templates/`
+- No changes to `lib/` source files
+
+### References
+
+- [Source: _bmad-output/planning-artifacts/epics.md#Epic-7] — Story 7.2 definition
+- [Source: _bmad-output/planning-artifacts/architecture.md#Structure-Patterns] — Test directory structure
+- [Source: lib/installer.js] — Installer module (591 lines, 16 functions)
+- [Source: _bmad-output/implementation-artifacts/7-1-test-infrastructure-setup.md] — Prerequisite story
+
+## Dev Agent Record
+
+### Agent Model Used
+
+### Debug Log References
+
+### Completion Notes List
+
+### File List

package/_bmad-output/implementation-artifacts/7-3-bmad-pipeline-tests.md

@@ -0,0 +1,119 @@
+# Story 7.3: Add Tests for bmad.js Pipeline Ordering
+
+Status: ready-for-dev
+
+<!-- Note: Validation is optional. Run validate-create-story for quality check before dev-story. -->
+<!-- Dependency: Story 7-1 must be completed first (test framework setup) -->
+
+## Story
+
+As a **developer**,
+I want tests verifying the BMAD pipeline executes stages in strict order,
+So that customization ordering bugs are caught before release.
+
+## Acceptance Criteria
+
+1. **Given** tests exist for `bmad.js`
+   **When** the test suite runs
+   **Then** it verifies:
+   - The 6-stage BMAD pipeline executes in correct order
+   - YAML configs are applied before recompile
+   - Workflows, templates, and agents are applied after recompile
+   - Pipeline failure at any stage prevents subsequent stages from executing
+
+## Tasks / Subtasks
+
+- [ ] Task 1: Analyze bmad.js for testable functions (AC: #1)
+  - [ ] 1.1: Map the 6-stage BMAD pipeline stages in `applyCustomizations()` (line 59)
+  - [ ] 1.2: Identify which functions are exported vs internal
+  - [ ] 1.3: Determine testability — `bmad.js` calls `npx bmad-method install` as a subprocess; tests must NOT trigger real BMAD installs
+  - [ ] 1.4: Decide approach: test internal logic without triggering `child_process.exec` calls, or mock the exec calls
+- [ ] Task 2: Create bmad.js tests (AC: #1)
+  - [ ] 2.1: Create `tests/bmad.test.js`
+  - [ ] 2.2: Test: `isBmadInstalled()` returns false for empty directory (use temp dir)
+  - [ ] 2.3: Test: `isBmadInstalled()` returns true for directory containing `_bmad/` folder
+  - [ ] 2.4: Test: exported functions exist (`installBmad`, `updateBmad`, `applyCustomizations`, `isBmadInstalled`, `registerMilWorkflows`)
+  - [ ] 2.5: Test: `applyCustomizations()` processes config files in correct order (YAML configs before workflows/templates/agents)
+  - [ ] 2.6: Test: customization file discovery — verify `fs.readdirSync` on `lib/bmad-customizations/` returns expected files
+  - [ ] 2.7: Test: `lib/bmad-workflows/` directory exists and contains expected workflow content
+  - [ ] 2.8: Test: `lib/mil498-templates/` directory exists and contains template files
+- [ ] Task 3: Test pipeline ordering logic (AC: #1)
+  - [ ] 3.1: Verify the `applyCustomizations()` function processes in this order:
+    1. YAML config files (`.customize.yaml`)
+    2. Recompile trigger
+    3. Workflow customizations
+    4. Template customizations
+    5. Agent customizations
+  - [ ] 3.2: Create a spy/tracker to verify execution order without triggering real file copies
+  - [ ] 3.3: Test that the function signature matches expected parameters: `(projectRoot, modules, tools, selectedAgentIds)`
+
+## Dev Notes
+
+### Architecture Compliance
+
+- **Test location:** `tests/bmad.test.js` [Source: architecture.md#Structure-Patterns]
+- **Pipeline ordering is critical:** The 6-stage BMAD pipeline (NFR8) has strict ordering requirements. YAML configs MUST be applied before recompile, and workflows/templates/agents MUST be applied after. [Source: architecture.md#Pipeline-Architecture]
+- **No real BMAD installs:** Tests must NOT call `npx bmad-method install` — this would modify the actual project's `_bmad/` directory. [Source: test isolation principle]
+
+### bmad.js Module Structure
+
+From [bmad.js:1-250](lib/bmad.js) — 250 lines, 5 exported functions:
+
+```
+isBmadInstalled(projectRoot)           — line 9  — checks for _bmad/ directory
+installBmad(modules, tools, projectRoot) — line 13 — runs npx bmad-method install
+updateBmad(modules, tools, projectRoot)  — line 36 — runs npx bmad-method update
+applyCustomizations(projectRoot, ...)    — line 59 — 6-stage pipeline
+registerMilWorkflows(projectRoot)        — line 170 — MIL-498 workflow registration
+```
+
+### Testing Challenge: Subprocess Calls
+
+`installBmad()` and `updateBmad()` spawn child processes via `exec('npx bmad-method install ...')`. These functions are **not suitable for unit testing** without mocking `child_process`.
+
+**Approach options:**
+1. **Test only pure logic:** Focus on `isBmadInstalled()`, file discovery in `applyCustomizations()`, and function signatures. Skip subprocess-dependent functions.
+2. **Mock child_process:** Intercept `exec` calls to verify command construction without executing. More complex but validates the pipeline.
+3. **Hybrid:** Test what we can without mocking, defer subprocess testing to integration tests.
+
+**Recommended:** Option 1 (pure logic) for this story. Focus on `isBmadInstalled()`, customization file discovery, and pipeline stage ordering verification.
+
+### Pipeline Stage Ordering in applyCustomizations()
+
+The function at line 59 applies customizations in this order:
+1. Config YAML files → `lib/bmad-customizations/` configs
+2. Recompile step → triggers BMAD recompile
+3. Workflows → `lib/bmad-workflows/` content
+4. Templates → `lib/mil498-templates/` content
+5. Agent files → agent customize.yaml files
+
+Verify ordering by checking the function's code flow, not by executing it.
+
+### Critical Guardrails
+
+- **Never trigger real BMAD installs** during tests — no `npx bmad-method` execution
+- **Use temp directories** for `isBmadInstalled()` tests
+- **No new npm dependencies** — use `node:test` and `node:assert` only
+- **Do not modify `lib/bmad.js`** — tests validate existing behavior
+
+### Project Structure Notes
+
+- Files to create: `tests/bmad.test.js`
+- No changes to `lib/` source files
+
+### References
+
+- [Source: _bmad-output/planning-artifacts/epics.md#Epic-7] — Story 7.3 definition
+- [Source: _bmad-output/planning-artifacts/architecture.md#Pipeline-Architecture] — BMAD 6-stage pipeline, NFR8
+- [Source: lib/bmad.js] — BMAD module (250 lines, 5 exported functions)
+- [Source: _bmad-output/implementation-artifacts/7-1-test-infrastructure-setup.md] — Prerequisite story
+
+## Dev Agent Record
+
+### Agent Model Used
+
+### Debug Log References
+
+### Completion Notes List
+
+### File List