fix: enhance monorepo support with robust path resolution, input sanitization, and documentation fixes

src/bmm/workflows/1-analysis/research/workflow-market-research.md

@@ -21,7 +21,7 @@ main_config: '{project-root}/_bmad/bmm/config.yaml'
 Load and read full config from {main_config} and resolve basic variables.
 
 **Monorepo Context Check:**
-1. Check if `_bmad/.current_project exists`.
+1. Check if `{project-root}/_bmad/.current_project` exists.
 2. If it exists, read its content as `{project_suffix}` and override output folder:
    - `output_folder`: `{project-root}/_bmad-output/{project_suffix}`
 

src/bmm/workflows/2-plan-workflows/create-ux-design/workflow.md

@@ -27,7 +27,7 @@ This uses **micro-file architecture** for disciplined execution:
 Load and read full config from {main_config} and resolve basic variables.
 
 **Monorepo Context Check:**
-1. Check if `_bmad/.current_project exists`.
+1. Check if `{project-root}/_bmad/.current_project` exists.
 2. If it exists, read its content as `{project_suffix}` and override output folder:
    - `output_folder`: `{project-root}/_bmad-output/{project_suffix}`
 

src/bmm/workflows/3-solutioning/check-implementation-readiness/workflow.md

@@ -47,7 +47,7 @@ description: 'Critical validation workflow that assesses PRD, Architecture, and
 Load and read full config from {main_config} and resolve basic variables.
 
 **Monorepo Context Check:**
-1. Check if `_bmad/.current_project exists`.
+1. Check if `{project-root}/_bmad/.current_project` exists.
 2. If it exists, read its content as `{project_suffix}` and override output folder:
    - `output_folder`: `{project-root}/_bmad-output/{project_suffix}`
 

src/bmm/workflows/4-implementation/code-review/instructions.xml

@@ -18,6 +18,16 @@
   <step n="1" goal="Load story and discover changes">
     <check if="{project-root}/_bmad/.current_project exists">
       <action>Read content as project_suffix</action>
+      <!-- Sanitization and Validation -->
+      <action>Trim whitespace and newlines from project_suffix</action>
+      <check if="project_suffix contains '..' or starts with '/' or starts with '\'">
+         <output>🚫 Security Error: Invalid project context path detected.</output>
+         <action>HALT</action>
+      </check>
+      <check if="project_suffix matches regex '[^a-zA-Z0-9._-]|^\s*$'">
+         <output>🚫 Error: Project context must only contain alphanumeric characters, dots, dashes, or underscores.</output>
+         <action>HALT</action>
+      </check>
       <action>Override output_folder to {project-root}/_bmad-output/{project_suffix}</action>
     </check>
 

src/bmm/workflows/4-implementation/correct-course/instructions.md

@@ -45,7 +45,7 @@
 Load and read full config from {main_config} and resolve basic variables.
 
 **Monorepo Context Check:**
-1. Check if `_bmad/.current_project exists`.
+1. Check if `{project-root}/_bmad/.current_project` exists.
 2. If it exists, read its content as `{project_suffix}` and override output folder:
    - `output_folder`: `{project-root}/_bmad-output/{project_suffix}`
   <action>Maintain running notes of findings and impacts discovered</action>

src/bmm/workflows/4-implementation/create-story/instructions.xml

@@ -18,9 +18,21 @@
   <critical>🎯 ZERO USER INTERVENTION: Process should be fully automated except for initial epic/story selection or missing documents</critical>
 
   <step n="1" goal="Determine target story">
-    <check if="_bmad/.current_project exists">
+    <check if="{project-root}/_bmad/.current_project exists">
       <action>Read content as project_suffix</action>
+      <!-- Sanitization and Validation -->
+      <action>Trim whitespace and newlines from project_suffix</action>
+      <check if="project_suffix contains '..' or starts with '/' or starts with '\'">
+         <output>🚫 Security Error: Invalid project context path detected.</output>
+         <action>HALT</action>
+      </check>
+      <check if="project_suffix matches regex '[^a-zA-Z0-9._-]|^\s*$'">
+         <output>🚫 Error: Project context must only contain alphanumeric characters, dots, dashes, or underscores.</output>
+         <action>HALT</action>
+      </check>
       <action>Override output_folder to {project-root}/_bmad-output/{project_suffix}</action>
+      <action>Set {default_output_file} = {output_folder}/{story_key}.md</action>
+      <action>Output "Monorepo context detected. Output redirected to: {default_output_file}"</action>
     </check>
 
     <check if="{{story_path}} is provided by user or user provided the epic and story number such as 2-4 or 1.6 or epic 1 story 5">

src/bmm/workflows/4-implementation/dev-story/instructions.xml

@@ -13,8 +13,18 @@
   <critical>User skill level ({user_skill_level}) affects conversation style ONLY, not code updates.</critical>
 
   <step n="1" goal="Find next ready story and load it" tag="sprint-status">
-    <check if="_bmad/.current_project exists">
+    <check if="{project-root}/_bmad/.current_project exists">
       <action>Read content as project_suffix</action>
+      <!-- Sanitization and Validation -->
+      <action>Trim whitespace and newlines from project_suffix</action>
+      <check if="project_suffix contains '..' or starts with '/' or starts with '\'">
+         <output>🚫 Security Error: Invalid project context path detected.</output>
+         <action>HALT</action>
+      </check>
+      <check if="project_suffix matches regex '[^a-zA-Z0-9._-]|^\s*$'">
+         <output>🚫 Error: Project context must only contain alphanumeric characters, dots, dashes, or underscores.</output>
+         <action>HALT</action>
+      </check>
       <action>Override output_folder to {project-root}/_bmad-output/{project_suffix}</action>
     </check>
 

src/bmm/workflows/bmad-quick-flow/quick-dev/workflow.md

@@ -28,7 +28,7 @@ This uses **step-file architecture** for focused execution:
 Load and read full config from {main_config} and resolve basic variables.
 
 **Monorepo Context Check:**
-1. Check if `_bmad/.current_project exists`.
+1. Check if `{project-root}/_bmad/.current_project` exists.
 2. If it exists, read its content as `{project_suffix}` and override output folder:
    - `output_folder`: `{project-root}/_bmad-output/{project_suffix}`
 

src/bmm/workflows/bmad-quick-flow/quick-spec/workflow.md

@@ -69,7 +69,7 @@ This uses **step-file architecture** for disciplined execution:
 Load and read full config from {main_config} and resolve basic variables.
 
 **Monorepo Context Check:**
-1. Check if `_bmad/.current_project exists`.
+1. Check if `{project-root}/_bmad/.current_project` exists.
 2. If it exists, read its content as `{project_suffix}` and override output folder:
    - `output_folder`: `{project-root}/_bmad-output/{project_suffix}`
 

src/bmm/workflows/document-project/workflows/deep-dive-instructions.md

@@ -11,6 +11,23 @@
 <action>Load existing project structure from index.md and project-parts.json (if exists)</action>
 <action>Load source tree analysis to understand available areas</action>
 
+<check if="{project-root}/_bmad/.current_project exists">
+  <action>Read content as project_suffix</action>
+  <!-- Sanitization and Validation -->
+  <action>Trim whitespace and newlines from project_suffix</action>
+  <check if="project_suffix contains '..' or starts with '/' or starts with '\'">
+      <output>🚫 Security Error: Invalid project context path detected.</output>
+      <action>HALT</action>
+  </check>
+  <check if="project_suffix matches regex '[^a-zA-Z0-9._-]|^\s*$'">
+      <output>🚫 Error: Project context must only contain alphanumeric characters, dots, dashes, or underscores.</output>
+      <action>HALT</action>
+  </check>
+  <action>Override output_folder to {project-root}/_bmad-output/{project_suffix}</action>
+  <action>Override project_knowledge to {project-root}/_bmad-output/{project_suffix}</action>
+  <action>Output "Monorepo context detected. Writing deep-dive artifacts to: {project_knowledge}"</action>
+</check>
+
 <step n="13a" goal="Identify area for deep-dive">
   <action>Analyze existing documentation to suggest deep-dive options</action>
 
@@ -254,10 +271,7 @@ Detailed exhaustive analysis of specific areas:
 
 Load and read full config from {main_config} and resolve basic variables.
 
-**Monorepo Context Check:**
+
-1. Check if `{project-root}/_bmad/.current_project` exists.
-2. If it exists, read its content as `{project_suffix}` and override output folder:
-   - `output_folder`: `{project-root}/_bmad-output/{project_suffix}`
 - Related code and reuse opportunities
 - Implementation guidance
 

src/core/workflows/advanced-elicitation/workflow.xml

@@ -20,8 +20,18 @@
 
   <flow>
     <step n="1" title="Method Registry Loading">
-      <check if="_bmad/.current_project exists">
+      <check if="{project-root}/_bmad/.current_project exists">
         <action>Read content as project_suffix</action>
+        <!-- Sanitization and Validation -->
+        <action>Trim whitespace and newlines from project_suffix</action>
+        <check if="project_suffix contains '..' or starts with '/' or starts with '\'">
+           <output>🚫 Security Error: Invalid project context path detected.</output>
+           <action>HALT</action>
+        </check>
+        <check if="project_suffix matches regex '[^a-zA-Z0-9._-]|^\s*$'">
+           <output>🚫 Error: Project context must only contain alphanumeric characters, dots, dashes, or underscores.</output>
+           <action>HALT</action>
+        </check>
         <action>Override output_folder to {project-root}/_bmad-output/{project_suffix}</action>
       </check>