mdan-cli 2.5.0 → 2.5.2

package/.claude/skills/bmad-os-review-pr/prompts/instructions.md

@@ -0,0 +1,231 @@
+# Raven's Verdict - Deep PR Review Tool
+
+A cynical adversarial review, transformed into cold engineering professionalism.
+
+## CRITICAL: Sandboxed Execution Rules
+
+Before proceeding, you MUST verify:
+
+- [ ] PR number or URL was EXPLICITLY provided in the user's message
+- [ ] You are NOT inferring the PR from conversation history
+- [ ] You are NOT looking at git branches, recent commits, or local state
+- [ ] You are NOT guessing or assuming any PR numbers
+
+**If no explicit PR number/URL was provided, STOP immediately and ask:**
+"What PR number or URL should I review?"
+
+## Preflight Checks
+
+### 0.1 Parse PR Input
+
+Extract PR number from user input. Examples of valid formats:
+
+- `123` (just the number)
+- `#123` (with hash)
+- `https://github.com/owner/repo/pull/123` (full URL)
+
+If a URL specifies a different repository than the current one:
+
+```bash
+# Check current repo
+gh repo view --json nameWithOwner -q '.nameWithOwner'
+```
+
+If mismatch detected, ask user:
+
+> "This PR is from `{detected_repo}` but we're in `{current_repo}`. Proceed with reviewing `{detected_repo}#123`? (y/n)"
+
+If user confirms, store `{REPO}` for use in all subsequent `gh` commands.
+
+### 0.2 Ensure Clean Checkout
+
+Verify the working tree is clean and check out the PR branch.
+
+```bash
+# Check for uncommitted changes
+git status --porcelain
+```
+
+If output is non-empty, STOP and tell user:
+
+> "You have uncommitted changes. Please commit or stash them before running a PR review."
+
+If clean, fetch and checkout the PR branch:
+
+```bash
+# Fetch and checkout PR branch
+# For cross-repo PRs, include --repo {REPO}
+gh pr checkout {PR_NUMBER} [--repo {REPO}]
+```
+
+If checkout fails, STOP and report the error.
+
+Now you're on the PR branch with full access to all files as they exist in the PR.
+
+### 0.3 Check PR Size
+
+```bash
+# For cross-repo PRs, include --repo {REPO}
+gh pr view {PR_NUMBER} [--repo {REPO}] --json additions,deletions,changedFiles -q '{"additions": .additions, "deletions": .deletions, "files": .changedFiles}'
+```
+
+**Size thresholds:**
+
+| Metric        | Warning Threshold |
+| ------------- | ----------------- |
+| Files changed | > 50              |
+| Lines changed | > 5000            |
+
+If thresholds exceeded, ask user:
+
+> "This PR has {X} files and {Y} line changes. That's large.
+>
+> **[f] Focus** - Pick specific files or directories to review
+> **[p] Proceed** - Review everything (may be slow/expensive)
+> **[a] Abort** - Stop here"
+
+### 0.4 Note Binary Files
+
+```bash
+# For cross-repo PRs, include --repo {REPO}
+gh pr diff {PR_NUMBER} [--repo {REPO}] --name-only | grep -E '\.(png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|pdf|zip|tar|gz|bin|exe|dll|so|dylib)$' || echo "No binary files detected"
+```
+
+Store list of binary files to skip. Note them in final output.
+
+## Adversarial Review
+
+### 1.1 Run Cynical Review
+
+**INTERNAL PERSONA - Never post this directly:**
+
+Task: You are a cynical, jaded code reviewer with zero patience for sloppy work. This PR was submitted by a clueless weasel and you expect to find problems. Find at least five issues to fix or improve in it. Number them. Be skeptical of everything. Ultrathink.
+
+Output format:
+
+```markdown
+### [NUMBER]. [FINDING TITLE] [likely]
+
+**Severity:** [EMOJI] [LEVEL]
+
+[DESCRIPTION - be specific, include file:line references]
+```
+
+Severity scale:
+
+| Level    | Emoji | Meaning                                                 |
+| -------- | ----- | ------------------------------------------------------- |
+| Critical | 🔴    | Security issue, data loss risk, or broken functionality |
+| Moderate | 🟡    | Bug, performance issue, or significant code smell       |
+| Minor    | 🟢    | Style, naming, minor improvement opportunity            |
+
+Likely tag:
+
+- Add `[likely]` to findings with high confidence, e.g. with direct evidence
+- Sort findings by severity (Critical → Moderate → Minor), not by confidence
+
+## Tone Transformation
+
+**Transform the cynical output into cold engineering professionalism.**
+
+**Transformation rules:**
+
+1. Remove all inflammatory language, insults, assumptions about the author
+2. Keep all technical substance, file references, severity ratings and likely tag
+3. Replace accusatory phrasing with neutral observations:
+   - ❌ "The author clearly didn't think about..."
+   - ✅ "This implementation may not account for..."
+4. Preserve skepticism as healthy engineering caution:
+   - ❌ "This will definitely break in production"
+   - ✅ "This pattern has historically caused issues in production environments"
+5. Add the suggested fixes.
+6. Keep suggestions actionable and specific
+
+Output format after transformation:
+
+```markdown
+## PR Review: #{PR_NUMBER}
+
+**Title:** {PR_TITLE}
+**Author:** @{AUTHOR}
+**Branch:** {HEAD} → {BASE}
+
+---
+
+### Findings
+
+[TRANSFORMED FINDINGS HERE]
+
+---
+
+### Summary
+
+**Critical:** {COUNT} | **Moderate:** {COUNT} | **Minor:** {COUNT}
+
+[BINARY_FILES_NOTE if any]
+
+---
+
+_Review generated by Raven's Verdict. LLM-produced analysis - findings may be incorrect or lack context. Verify before acting._
+```
+
+## Post Review
+
+### 3.1 Preview
+
+Display the complete transformed review to the user.
+
+```
+══════════════════════════════════════════════════════
+PREVIEW - This will be posted to PR #{PR_NUMBER}
+══════════════════════════════════════════════════════
+
+[FULL REVIEW CONTENT]
+
+══════════════════════════════════════════════════════
+```
+
+### 3.2 Confirm
+
+Ask user for explicit confirmation:
+
+> **Ready to post this review to PR #{PR_NUMBER}?**
+>
+> **[y] Yes** - Post as comment
+> **[n] No** - Abort, do not post
+> **[e] Edit** - Let me modify before posting
+> **[s] Save only** - Save locally, don't post
+
+### 3.3 Post or Save
+
+**Write review to a temp file, then post:**
+
+1. Write the review content to a temp file with a unique name (include PR number to avoid collisions)
+2. Post using `gh pr comment {PR_NUMBER} [--repo {REPO}] --body-file {path}`
+3. Delete the temp file after successful post
+
+Do NOT use heredocs or `echo` - Markdown code blocks will break shell parsing. Use your file writing tool instead.
+
+**If auth fails or post fails:**
+
+1. Display error prominently:
+
+   ```
+   ⚠️  FAILED TO POST REVIEW
+   Error: {ERROR_MESSAGE}
+   ```
+
+2. Keep the temp file and tell the user where it is, so they can post manually with:
+   `gh pr comment {PR_NUMBER} [--repo {REPO}] --body-file {path}`
+
+**If save only (s):**
+
+Keep the temp file and inform user of location.
+
+## Notes
+
+- The "cynical asshole" phase is internal only - never posted
+- Tone transform MUST happen before any external output
+- When in doubt, ask the user - never assume
+- If you're unsure about severity, err toward higher severity
+- If you're unsure about confidence, be honest and use Medium or Low

package/.claude/skills/bmad-os-root-cause-analysis/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: bmad-os-root-cause-analysis
+description: Analyzes a bug-fix commit or PR and produces a structured Root Cause Analysis report covering what went wrong, why, and what guardrails failed.
+license: MIT
+disable-model-invocation: true
+metadata:
+  author: bmad-code-org
+  version: "1.0.0"
+compatibility: Requires gh CLI and git repository
+---
+
+Read `prompts/instructions.md` and execute.

package/.claude/skills/bmad-os-root-cause-analysis/prompts/instructions.md

@@ -0,0 +1,74 @@
+# Bug-Fix Root Cause Analysis
+
+Analyze a bug-fix commit or PR and produce a structured Root Cause Analysis report.
+
+## Principles
+
+- **Direct attribution.** This report names the individual who introduced the defect. Industry convention advocates blameless postmortems. This skill deliberately deviates: naming the individual and trusting them to own it is more respectful than diffusing accountability into systemic abstraction. Direct, factual, not accusatory. If authorship can't be determined confidently, say so.
+- **Pyramid communication.** The executive summary must convey the full picture. A reader who stops after the first paragraph gets the gist. Everything else is supporting evidence.
+
+## Preflight
+
+Verify `gh auth status` and that you're in a git repository. Stop with a clear message if either fails.
+
+## Execution
+
+1. **Identify the fix.** Accept whatever the user provides — commit SHA, PR, issue, description. Resolve to the specific fix commit/PR using `gh` and `git`. If ambiguous, ask. Confirm the change is actually a bug fix before proceeding.
+2. **Gather evidence.** Read the fix diff, PR/issue discussion, and use blame/log to identify the commit that introduced the bug. Collect timeline data.
+3. **Analyze.** Apply 5 Whys. Classify the root cause. Identify contributing factors.
+4. **Evaluate guardrails.** Inspect the actual repo configuration (CI workflows, linter configs, test setup) — don't assume. For each applicable guardrail, explain specifically why it missed this bug.
+5. **Write the report** to `_bmad-output/rca-reports/rca-{YYYY-MM-DD}-{slug}.md`. Present the executive summary in chat.
+
+## Report Structure
+
+```markdown
+# Root Cause Analysis: {Bug Title}
+
+**Date:** {today}
+**Fix:** {PR link or commit SHA}
+**Severity:** {Critical | High | Medium | Low}
+**Root Cause Category:** {Requirements | Design | Code Logic | Test Gap | Process | Environment/Config}
+
+## Executive Summary
+
+{One paragraph. What the bug was, root cause, who introduced it and when, detection
+latency (introduced → detected), severity, and the key preventive recommendation.}
+
+## What Was the Problem?
+
+## When Did It Happen?
+
+| Event | Date | Reference |
+|-------|------|-----------|
+| Introduced | | |
+| Detected | | |
+| Fixed | | |
+| **Detection Latency** | **{introduced → detected}** | |
+
+## Who Caused It?
+
+{Author, commit/PR that introduced the defect, and the context — what were they
+trying to do?}
+
+## How Did It Happen?
+
+## Why Did It Happen?
+
+{5 Whys analysis. Root cause category. Contributing factors.}
+
+## Failed Guardrails Analysis
+
+| Guardrail | In Place? | Why It Failed |
+|-----------|-----------|---------------|
+| | | |
+
+**Most Critical Failure:** {Which one mattered most and why.}
+
+## Resolution
+
+## Corrective & Preventive Actions
+
+| # | Action | Type | Priority |
+|---|--------|------|----------|
+| | | {Prevent/Detect/Mitigate} | |
+```

package/.coderabbit.yaml

@@ -0,0 +1,85 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+
+language: "en-US"
+early_access: true
+reviews:
+  profile: chill
+  high_level_summary: false # don't post summary until explicitly invoked
+  request_changes_workflow: false
+  review_status: false
+  commit_status: false
+  walkthrough: false
+  poem: false
+  auto_review:
+    enabled: true
+    drafts: false # Don't review drafts automatically
+    auto_incremental_review: false # always review the whole PR, not just new commits
+    base_branches:
+      - main
+  path_filters:
+    # --- Shared baseline: tool configs ---
+    - "!.coderabbit.yaml"
+    - "!.augment/**"
+    - "!eslint.config.mjs"
+    # --- Shared baseline: build output ---
+    - "!dist/**"
+    - "!build/**"
+    - "!coverage/**"
+    # --- Shared baseline: vendored/generated ---
+    - "!**/node_modules/**"
+    - "!**/*.min.js"
+    - "!**/*.generated.*"
+    - "!**/*.bundle.md"
+    # --- Shared baseline: package metadata ---
+    - "!package-lock.json"
+    # --- Shared baseline: binary/media ---
+    - "!*.png"
+    - "!*.jpg"
+    - "!*.svg"
+    # --- Shared baseline: test fixtures ---
+    - "!test/fixtures/**"
+    - "!test/template-test-generator/**"
+    - "!tools/template-test-generator/test-scenarios/**"
+    # --- Shared baseline: non-project dirs ---
+    - "!_bmad*/**"
+    - "!website/**"
+    - "!z*/**"
+    - "!sample-project/**"
+    - "!test-project-install/**"
+    # --- Shared baseline: AI assistant dirs ---
+    - "!.claude/**"
+    - "!.codex/**"
+    - "!.agent/**"
+    - "!.agentvibes/**"
+    - "!.kiro/**"
+    - "!.roo/**"
+    - "!.github/chatmodes/**"
+    # --- Shared baseline: build temp ---
+    - "!.bundler-temp/**"
+    # --- Shared baseline: generated reports ---
+    - "!**/validation-report-*.md"
+    - "!CHANGELOG.md"
+  path_instructions:
+    - path: "**/*"
+      instructions: |
+        You are a cynical, jaded reviewer with zero patience for sloppy work.
+        This PR was submitted by a clueless weasel and you expect to find problems.
+        Be skeptical of everything.
+        Look for what's missing, not just what's wrong.
+        Use a precise, professional tone — no profanity or personal attacks.
+
+        Review with extreme skepticism — assume problems exist.
+        Find at least 10 issues to fix or improve.
+
+        Do NOT:
+        - Comment on formatting, linting, or style
+        - Give "looks good" passes
+        - Anchor on any specific ruleset — reason freely
+
+        If you find zero issues, re-analyze — this is suspicious.
+chat:
+  auto_reply: true # Response to mentions in comments, a la @coderabbit review
+issue_enrichment:
+  auto_enrich:
+    enabled: false # don't auto-comment on issues
+

package/.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+the official BMAD Discord server (<https://discord.com/invite/gk8jAdXWmj>) - DM a moderator or flag a post.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+<https://www.contributor-covenant.org/version/2/0/code_of_conduct.html>.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+<https://www.contributor-covenant.org/faq>. Translations are available at
+<https://www.contributor-covenant.org/translations>.

package/.github/FUNDING.yaml

@@ -0,0 +1,15 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project_name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project_name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: bmad
+thanks_dev: # Replace with a single thanks.dev username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

package/.github/ISSUE_TEMPLATE/bug-report.yaml

@@ -0,0 +1,124 @@
+name: Bug Report
+description: File a bug report to help us improve BMad Method
+title: "[BUG] "
+labels: bug
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for filing a bug report! Please fill out the information below to help us reproduce and fix the issue.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Clear and concise description of what the bug is
+      placeholder: e.g., When I run /dev-story, it crashes on step 3
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Step-by-step instructions to reproduce the behavior
+      placeholder: |
+        1. Run 'npx bmad-method install'
+        2. Select option X
+        3. Run workflow Y
+        4. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What you expected to happen
+      placeholder: The workflow should complete successfully
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What actually happened
+      placeholder: The workflow crashed with error "..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: Add screenshots if applicable (paste images directly)
+      placeholder: Paste any relevant screenshots here
+
+  - type: dropdown
+    id: module
+    attributes:
+      label: Which module is this for?
+      description: Select the BMad module this issue relates to
+      options:
+        - BMad Method (BMM) - Core Framework
+        - BMad Builder (BMB) - Agent Builder Tool
+        - Test Architect (TEA) - Test Strategy Module
+        - Game Dev Studio (BMGD) - Game Development Module
+        - Creative Intelligence Suite (CIS) - Innovation Module
+        - Not sure / Other
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: BMad Version
+      description: "Check with: npx bmad-method --version or check package.json"
+      placeholder: e.g., 6.0.0-Beta.4
+    validations:
+      required: true
+
+  - type: dropdown
+    id: ide
+    attributes:
+      label: Which AI IDE are you using?
+      options:
+        - Claude Code
+        - Cursor
+        - Windsurf
+        - Copilot CLI / GitHub Copilot
+        - Kilo Code
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Operating System
+      options:
+        - macOS
+        - Windows
+        - Linux
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: Copy and paste any relevant log output
+      render: shell
+
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Confirm
+      options:
+        - label: I've searched for existing issues
+          required: true
+        - label: I'm using the latest version
+          required: false

package/.github/ISSUE_TEMPLATE/config.yaml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 📚 Documentation
+    url: https://docs.bmad-method.org
+    about: Check the docs first — tutorials, guides, and reference
+  - name: 💬 Discord Community
+    url: https://discord.gg/gk8jAdXWmj
+    about: Join for questions, discussion, and help before opening an issue