wizz-method 1.19.0 → 2.1.0

package/tools/installer/ide/platform-codes.yaml

@@ -7,7 +7,6 @@
 #   installer:
 #     target_dir: Directory where skill directories are installed (project/workspace)
 #     global_target_dir: (optional) User-home directory for global install
-#     ancestor_conflict_check: (optional) Refuse install when ancestor dir has WIZZ files
 #     agents_target_dir: (optional) Directory for native WIZZ-authored subagents
 #       (src/modules/wizz/subagents/). Currently declared by claude-code, codex,
 #       opencode, and gemini.
@@ -17,6 +16,29 @@
 #       straight from the subagents/ root (its native format is *.md with a
 #       `model:` frontmatter field).
 #
+# DEFAULTS — most platforms share the same shape, so a top-level `defaults:`
+# block (below) carries what the majority repeat: `preferred: false` and
+# `installer.target_dir` / `installer.global_target_dir` pointing at the
+# `.agents/skills` / `~/.agents/skills` cross-tool standard. Each platform
+# entry only needs to declare what differs from that default:
+#   - `name` is always explicit (never defaulted).
+#   - `preferred` is omitted unless it is `true`.
+#   - `installer.target_dir` / `installer.global_target_dir` are omitted when
+#     they match the default; any other `installer.*` field (agents_*,
+#     commands_*, ...) is always explicit, defaults never touch those.
+#   - A platform that has no `global_target_dir` at all (no global/user-home
+#     install path exists for that tool, e.g. ona, replit, trae) declares
+#     `installer.global_target_dir: null` explicitly. `loadPlatformCodes()`
+#     merges defaults into each entry and then drops any key whose merged
+#     value is `null`, so the resulting shape has no `global_target_dir` key
+#     at all, matching a platform that never had one.
+#   - A platform with nothing left to say beyond its name still declares
+#     `installer: {}` so it is recognized as installable; the merge fills in
+#     both directories from `defaults.installer`.
+#   - A platform with no `installer:` block at all (not installable) is left
+#     untouched by the merge — defaults only ever apply to a declared
+#     `installer:` section.
+#
 # INSTALL SCOPE — LOCAL PER PROJECT IS THE ENFORCED DEFAULT.
 # The installer only ever writes skills to the project-relative `target_dir`
 # (path.join(projectDir, target_dir) in ide/_config-driven.js). `global_target_dir`
@@ -30,45 +52,41 @@
 # read from the shared `.agents/skills/` and `~/.agents/skills/` cross-tool standard.
 # Paths verified against each tool's primary docs as of 2026-04-25.
 
+defaults:
+  preferred: false
+  installer:
+    target_dir: .agents/skills
+    global_target_dir: ~/.agents/skills
+
 platforms:
   adal:
     name: "AdaL"
-    preferred: false
     installer:
       target_dir: .adal/skills
       global_target_dir: ~/.adal/skills
 
   amp:
     name: "Sourcegraph Amp"
-    preferred: false
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.config/agents/skills
 
   antigravity:
     name: "Google Antigravity"
-    preferred: false
     installer:
       target_dir: .agent/skills
       global_target_dir: ~/.gemini/antigravity/skills
 
   antigravity-cli:
     name: "Antigravity CLI (AGY)"
-    preferred: false
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.gemini/antigravity-cli/skills
 
   auggie:
     name: "Auggie"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   bob:
     name: "IBM Bob"
-    preferred: false
     installer:
       target_dir: .bob/skills
       global_target_dir: ~/.bob/skills
@@ -83,7 +101,6 @@ platforms:
 
   cline:
     name: "Cline"
-    preferred: false
     installer:
       target_dir: .cline/skills
       global_target_dir: ~/.cline/skills
@@ -92,73 +109,56 @@ platforms:
     name: "Codex"
     preferred: true
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.codex/skills
       agents_target_dir: .codex/agents
       agents_source_subdir: codex
 
   codewhale:
     name: "CodeWhale"
-    preferred: false
     installer:
       target_dir: .codewhale/skills
       global_target_dir: ~/.codewhale/skills
 
   codebuddy:
     name: "CodeBuddy"
-    preferred: false
     installer:
       target_dir: .codebuddy/skills
       global_target_dir: ~/.codebuddy/skills
 
   command-code:
     name: "Command Code"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   cortex:
     name: "Snowflake Cortex Code"
-    preferred: false
     installer:
       target_dir: .cortex/skills
       global_target_dir: ~/.snowflake/cortex/skills
 
   crush:
     name: "Crush"
-    preferred: false
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.config/agents/skills
 
   cursor:
     name: "Cursor"
     preferred: true
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   droid:
     name: "Factory Droid"
-    preferred: false
     installer:
       target_dir: .factory/skills
       global_target_dir: ~/.factory/skills
 
   firebender:
     name: "Firebender"
-    preferred: false
     installer:
       target_dir: .firebender/skills
-      global_target_dir: ~/.agents/skills
 
   gemini:
     name: "Gemini CLI"
-    preferred: false
     installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
       agents_target_dir: .gemini/agents
       agents_source_subdir: gemini
 
@@ -166,8 +166,6 @@ platforms:
     name: "GitHub Copilot"
     preferred: true
     installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
       commands_target_dir: .github/agents
       commands_extension: .agent.md
       commands_body_template: "LOAD the FULL {project-root}/{target_dir}/{canonicalId}/SKILL.md, READ its entire contents and follow its directions exactly!"
@@ -186,196 +184,143 @@ platforms:
 
   goose:
     name: "Block Goose"
-    preferred: false
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.config/agents/skills
 
   grok:
     name: "Grok"
-    preferred: false
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.grok/skills
 
   hermes:
     name: "Hermes Agent"
-    preferred: false
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.hermes/skills
 
   iflow:
     name: "iFlow"
-    preferred: false
     installer:
       target_dir: .iflow/skills
       global_target_dir: ~/.iflow/skills
 
   junie:
     name: "Junie"
-    preferred: false
     installer:
       target_dir: .junie/skills
       global_target_dir: ~/.junie/skills
 
   kilo:
     name: "KiloCoder"
-    preferred: false
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.kilocode/skills
 
   kimi-code:
     name: "Kimi Code"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   kiro:
     name: "Kiro"
-    preferred: false
     installer:
       target_dir: .kiro/skills
       global_target_dir: ~/.kiro/skills
 
   kode:
     name: "Kode"
-    preferred: false
     installer:
       target_dir: .kode/skills
       global_target_dir: ~/.kode/skills
 
   mistral-vibe:
     name: "Mistral Vibe"
-    preferred: false
     installer:
-      target_dir: .agents/skills
       global_target_dir: ~/.vibe/skills
 
   mux:
     name: "Mux"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   neovate:
     name: "Neovate"
-    preferred: false
     installer:
       target_dir: .neovate/skills
       global_target_dir: ~/.neovate/skills
 
   ona:
     name: "Ona"
-    preferred: false
     installer:
       target_dir: .ona/skills
+      global_target_dir: null
 
   openclaw:
     name: "OpenClaw"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   opencode:
     name: "OpenCode"
-    preferred: false
     installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
       commands_target_dir: .opencode/commands
       agents_target_dir: .opencode/agents
       agents_source_subdir: opencode
 
   openhands:
     name: "OpenHands"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   pi:
     name: "Pi"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   pochi:
     name: "Pochi"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   qoder:
     name: "Qoder"
-    preferred: false
     installer:
       target_dir: .qoder/skills
       global_target_dir: ~/.qoder/skills
 
   qwen:
     name: "QwenCoder"
-    preferred: false
     installer:
       target_dir: .qwen/skills
       global_target_dir: ~/.qwen/skills
 
   replit:
     name: "Replit Agent"
-    preferred: false
     installer:
-      target_dir: .agents/skills
+      global_target_dir: null
 
   roo:
     name: "Roo Code"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   rovo-dev:
     name: "Rovo Dev"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   trae:
     name: "Trae"
-    preferred: false
     installer:
       target_dir: .trae/skills
+      global_target_dir: null
 
   warp:
     name: "Warp"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   windsurf:
     name: "Windsurf"
-    preferred: false
-    installer:
-      target_dir: .agents/skills
-      global_target_dir: ~/.agents/skills
+    installer: {}
 
   zcode:
     name: "ZCode"
-    preferred: false
     installer:
       target_dir: .zcode/skills
       global_target_dir: ~/.zcode/skills
 
   zencoder:
     name: "Zencoder"
-    preferred: false
     installer:
       target_dir: .zencoder/skills
       global_target_dir: ~/.zencoder/skills

package/tools/installer/ide/shared/path-utils.js

@@ -1,219 +1,17 @@
 /**
  * Path transformation utilities for IDE installer standardization
  *
- * Provides utilities to convert hierarchical paths to flat naming conventions.
- *
- * DASH-BASED NAMING (new standard):
- * - Agents: wizz-agent-module-name.md (with wizz-agent- prefix)
- * - Workflows/Tasks/Tools: wizz-module-name.md
- *
- * Example outputs:
- * - cis/agents/storymaster.md → wizz-agent-cis-storymaster.md
- * - bmm/workflows/plan-project.md → wizz-bmm-plan-project.md
- * - bmm/tasks/create-story.md → wizz-bmm-create-story.md
- * - core/agents/brainstorming.md → wizz-agent-brainstorming.md (core agents skip module name)
- * - standalone/agents/fred.md → wizz-agent-standalone-fred.md
+ * The only surviving export is WIZZ_FOLDER_NAME, the centralized constant for
+ * the `_wizz` installation folder name used across all installers. The
+ * dash-naming helpers that used to live here (toDashName, toDashPath,
+ * resolveSkillName, customAgentDashName, isDashFormat, parseDashName,
+ * AGENT_SEGMENT) had zero importers anywhere in the repo and were removed as
+ * dead code (audit 2026-09-11, Fase 2 item 13).
  */
 
-const AGENT_SEGMENT = 'agents';
-
 // WIZZ installation folder name - centralized constant for all installers
 const WIZZ_FOLDER_NAME = '_wizz';
 
-/**
- * Convert hierarchical path to flat dash-separated name (NEW STANDARD)
- * Converts: 'bmm', 'agents', 'pm' → 'wizz-agent-bmm-pm.md'
- * Converts: 'bmm', 'workflows', 'correct-course' → 'wizz-bmm-correct-course.md'
- * Converts: 'core', 'agents', 'brainstorming' → 'wizz-agent-brainstorming.md' (core agents skip module name)
- * Converts: 'standalone', 'agents', 'fred' → 'wizz-agent-standalone-fred.md'
- *
- * @param {string} module - Module name (e.g., 'bmm', 'core', 'standalone')
- * @param {string} type - Artifact type ('agents', 'workflows', 'tasks', 'tools')
- * @param {string} name - Artifact name (e.g., 'pm', 'brainstorming')
- * @returns {string} Flat filename like 'wizz-agent-bmm-pm.md' or 'wizz-bmm-correct-course.md'
- */
-function toDashName(module, type, name) {
-  const isAgent = type === AGENT_SEGMENT;
-
-  // For core module, skip the module name: use 'wizz-agent-name.md' instead of 'wizz-agent-core-name.md'
-  if (module === 'core') {
-    return isAgent ? `wizz-agent-${name}.md` : `wizz-${name}.md`;
-  }
-  // For standalone module, include 'standalone' in the name
-  if (module === 'standalone') {
-    return isAgent ? `wizz-agent-standalone-${name}.md` : `wizz-standalone-${name}.md`;
-  }
-
-  // Module artifacts: wizz-module-name.md or wizz-agent-module-name.md
-  // eslint-disable-next-line unicorn/prefer-string-replace-all -- regex replace is intentional here
-  const dashName = name.replace(/\//g, '-'); // Flatten nested paths
-  return isAgent ? `wizz-agent-${module}-${dashName}.md` : `wizz-${module}-${dashName}.md`;
-}
-
-/**
- * Convert relative path to flat dash-separated name
- * Converts: 'bmm/agents/pm.md' → 'wizz-agent-bmm-pm.md'
- * Converts: 'bmm/agents/tech-writer/tech-writer.md' → 'wizz-agent-bmm-tech-writer.md' (uses folder name)
- * Converts: 'bmm/workflows/correct-course.md' → 'wizz-bmm-correct-course.md'
- * Converts: 'core/agents/brainstorming.md' → 'wizz-agent-brainstorming.md' (core agents skip module name)
- *
- * @param {string} relativePath - Path like 'bmm/agents/pm.md'
- * @returns {string} Flat filename like 'wizz-agent-bmm-pm.md' or 'wizz-brainstorming.md'
- */
-function toDashPath(relativePath) {
-  if (!relativePath || typeof relativePath !== 'string') {
-    // Return a safe default for invalid input
-    return 'wizz-unknown.md';
-  }
-
-  // Strip common file extensions to avoid double extensions in generated filenames
-  // e.g., 'create-story.xml' → 'create-story', 'workflow.md' → 'workflow'
-  const withoutExt = relativePath.replace(/\.(md|yaml|yml|json|xml|toml)$/i, '');
-  const parts = withoutExt.split(/[/\\]/);
-
-  const module = parts[0];
-  const type = parts[1];
-  let name;
-
-  // For agents, if nested in a folder (more than 3 parts), use the folder name only
-  // e.g., 'bmm/agents/tech-writer/tech-writer' → 'tech-writer' (not 'tech-writer-tech-writer')
-  if (type === 'agents' && parts.length > 3) {
-    // Use the folder name (parts[2]) as the name, ignore the file name
-    name = parts[2];
-  } else {
-    // For non-nested or non-agents, join all parts after type
-    name = parts.slice(2).join('-');
-  }
-
-  return toDashName(module, type, name);
-}
-
-/**
- * Create custom agent dash name
- * Creates: 'wizz-custom-agent-fred-commit-poet.md'
- *
- * @param {string} agentName - Custom agent name
- * @returns {string} Flat filename like 'wizz-custom-agent-fred-commit-poet.md'
- */
-function customAgentDashName(agentName) {
-  return `wizz-custom-agent-${agentName}.md`;
-}
-
-/**
- * Check if a filename uses dash format
- * @param {string} filename - Filename to check
- * @returns {boolean} True if filename uses dash format
- */
-function isDashFormat(filename) {
-  return filename.startsWith('wizz-') && filename.includes('-');
-}
-
-/**
- * Extract parts from a dash-formatted filename
- * Parses: 'wizz-agent-bmm-pm.md' → { prefix: 'wizz', module: 'bmm', type: 'agents', name: 'pm' }
- * Parses: 'wizz-bmm-correct-course.md' → { prefix: 'wizz', module: 'bmm', type: 'workflows', name: 'correct-course' }
- * Parses: 'wizz-agent-brainstorming.md' → { prefix: 'wizz', module: 'core', type: 'agents', name: 'brainstorming' } (core agents)
- * Parses: 'wizz-brainstorming.md' → { prefix: 'wizz', module: 'core', type: 'workflows', name: 'brainstorming' } (core workflows)
- * Parses: 'wizz-agent-standalone-fred.md' → { prefix: 'wizz', module: 'standalone', type: 'agents', name: 'fred' }
- * Parses: 'wizz-standalone-foo.md' → { prefix: 'wizz', module: 'standalone', type: 'workflows', name: 'foo' }
- *
- * @param {string} filename - Dash-formatted filename
- * @returns {Object|null} Parsed parts or null if invalid format
- */
-function parseDashName(filename) {
-  const withoutExt = filename.replace('.md', '');
-  const parts = withoutExt.split('-');
-
-  if (parts.length < 2 || parts[0] !== 'wizz') {
-    return null;
-  }
-
-  // Check if this is an agent file (has 'agent' as second part)
-  const isAgent = parts[1] === 'agent';
-
-  if (isAgent) {
-    // This is an agent file
-    // Format: wizz-agent-name (core) or wizz-agent-standalone-name or wizz-agent-module-name
-    if (parts.length >= 4 && parts[2] === 'standalone') {
-      // Standalone agent: wizz-agent-standalone-name
-      return {
-        prefix: parts[0],
-        module: 'standalone',
-        type: 'agents',
-        name: parts.slice(3).join('-'),
-      };
-    }
-    if (parts.length === 3) {
-      // Core agent: wizz-agent-name
-      return {
-        prefix: parts[0],
-        module: 'core',
-        type: 'agents',
-        name: parts[2],
-      };
-    } else {
-      // Module agent: wizz-agent-module-name
-      return {
-        prefix: parts[0],
-        module: parts[2],
-        type: 'agents',
-        name: parts.slice(3).join('-'),
-      };
-    }
-  }
-
-  // Not an agent file - must be a workflow/tool/task
-  // If only 2 parts (wizz-name), it's a core workflow/tool/task
-  if (parts.length === 2) {
-    return {
-      prefix: parts[0],
-      module: 'core',
-      type: 'workflows', // Default to workflows for non-agent core items
-      name: parts[1],
-    };
-  }
-
-  // Check for standalone non-agent: wizz-standalone-name
-  if (parts[1] === 'standalone') {
-    return {
-      prefix: parts[0],
-      module: 'standalone',
-      type: 'workflows', // Default to workflows for non-agent standalone items
-      name: parts.slice(2).join('-'),
-    };
-  }
-
-  // Otherwise, it's a module workflow/tool/task (wizz-module-name)
-  return {
-    prefix: parts[0],
-    module: parts[1],
-    type: 'workflows', // Default to workflows for non-agent module items
-    name: parts.slice(2).join('-'),
-  };
-}
-
-/**
- * Resolve the skill name for an artifact.
- * Prefers canonicalId from a wizz-skill-manifest.yaml sidecar when available,
- * falling back to the path-derived name from toDashPath().
- *
- * @param {Object} artifact - Artifact object (must have relativePath; may have canonicalId)
- * @returns {string} Filename like 'wizz-create-prd.md' or 'wizz-agent-bmm-pm.md'
- */
-function resolveSkillName(artifact) {
-  if (artifact.canonicalId) {
-    return `${artifact.canonicalId}.md`;
-  }
-  return toDashPath(artifact.relativePath);
-}
-
 module.exports = {
-  toDashName,
-  toDashPath,
-  resolveSkillName,
-  customAgentDashName,
-  isDashFormat,
-  parseDashName,
-  AGENT_SEGMENT,
   WIZZ_FOLDER_NAME,
 };

package/tools/installer/install-messages.yaml

@@ -6,21 +6,11 @@
 startMessage: |
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
-  Agile AI-Driven Development, the Wizz way. Built on BMAD Core and a growing module ecosystem.
-  Install official and community modules during setup to customize your experience.
+  Método de agência orientado por IA, em PT-BR. Agentes por área, skills curadas e memória de projeto.
+  Escolha os módulos durante o setup para montar a instalação do seu jeito.
 
-  🌟 100% free. 100% open source. Always.
-     No paywalls. No gated content. Knowledge shared, not sold.
-
-  🌐 CONNECT:
-    Website:   https://method.wizzcomms.com/
-
-  ⭐ SUPPORT THE PROJECT:
-    Star us:   https://github.com/wizzcomms/wizz-method/
-
-  Built on BMAD Core (MIT) by Wizz Code — https://github.com/bmad-code-org/WIZZ-METHOD
-
-  Docs, and latest updates: https://method.wizzcomms.com/
+  📖 Docs:     https://method.wizzcomms.com/
+  ✉️  Suporte:  support@wizzcomms.com
 
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 

package/tools/installer/modules/channel-plan.js

@@ -17,6 +17,11 @@
 
 const VALID_CHANNELS = new Set(['stable', 'next']);
 
+// Item 8b (auditoria 2026-09-11): validate the TAG@SHA pin form at the CLI
+// gate so a malformed pin fails here, before any clone runs. Leaf module —
+// channel-plan is required by external-manager.js, so this cannot pull it back in.
+const { parsePinTagAndSha } = require('./pin-spec');
+
 /**
  * Parse raw commander options into a structured channel options object.
  *
@@ -58,14 +63,22 @@ function parseChannelOptions(options = {}) {
     nextSet.add(trimmed);
   }
 
-  // --pin CODE=TAG (repeatable)
+  // --pin CODE=TAG[@40-hex-sha] (repeatable). A pin that carries an @SHA part
+  // is validated via parsePinTagAndSha (item 8b): tag-only and TAG@SHA pass,
+  // anything else is thrown, not warned-and-skipped — a silent downgrade of
+  // TAG@SHA to TAG would install exactly the commit the SHA was supposed to
+  // guard against. parsePinSpec itself still splits CODE=<value> with the
+  // value opaque; the @SHA split stays the managers' job (see pin-spec.js).
   const pins = new Map();
   for (const spec of options.pin || []) {
     const parsed = parsePinSpec(spec);
     if (!parsed) {
-      warnings.push(`Ignoring malformed --pin value '${spec}'. Expected CODE=TAG.`);
+      warnings.push(`Ignoring malformed --pin value '${spec}'. Expected CODE=TAG or CODE=TAG@40-hex-sha.`);
       continue;
     }
+    // Throws loudly on a malformed TAG@SHA — the caller (ui.js) surfaces the
+    // error and aborts before any module is resolved or cloned.
+    parsePinTagAndSha(parsed.tag);
     if (pins.has(parsed.code)) {
       warnings.push(`--pin specified multiple times for '${parsed.code}'. Using last: ${parsed.tag}.`);
     }

package/tools/installer/modules/cli-config.js

@@ -2,7 +2,7 @@
 //
 // Sibling of modules/mcp-config.js. Where MCPs are *servers* merged into the
 // project's .mcp.json, CLIs are *binaries* the agents call directly (e.g.
-// `agent-browser` for browser verification, `rtk` for token economy). The
+// `wizz-agent-browser` for browser verification, `rtk` for token economy). The
 // skills-registry.yaml is the single source of truth for both: each AREA may
 // declare a `clis:` list, plus a top-level `cli_utility:` for cross-cutting
 // tools. Each entry has: