Agent identity (name, title) and the Overview prose are now baked into
each SKILL.md rather than resolved from customize.yaml. This anchors
skill-discovery (description keywords still match), protects brand
identity (Mary is Mary), and leaves the customize.yaml surface for
behavior changes only.
customize.yaml slimming:
- Dropped metadata.title (hardcoded in SKILL.md heading + Overview)
- Dropped metadata.capabilities (dead field; nothing downstream read it)
- Luminary-anchored identity strings (Porter+Minto, Evans+Tufte,
Cagan+Torres+Bezos, Norman+Cooper, Fowler+Vogels, Beck+Pragmatic
Programmer) — higher signal density, ~55% token savings per persona
- Preserved distinctive communication_style voice beats per agent
- Principles trimmed to 3-4 cite-worthy heuristics each
SKILL.md changes (all 6 agents):
- New top-of-body heading: `# Name — Title`
- New `## Overview` section with hardcoded capability prose
- Step 2 (Adopt Persona) rewritten to layer customized persona on top
of the Overview-established identity
- bmad-agent-dev gains an `## Operating Rules` section containing its
8 non-negotiable behavioral invariants (moved from customize.yaml
critical_actions, since they're brand-protected invariants, not
team-customizable startup steps)
customize.yaml now defines per-agent:
- icon (cosmetic)
- persona.{role, identity, communication_style, principles} (customizable)
- critical_actions (empty by default, extensibility hook for teams)
- memories (empty by default, extensibility hook for teams)
- menu (default items, mergeable by code)
manifest-generator.js: dropped `capabilities` column from
agent-manifest.csv header, write, and read paths (field was write-only
noise — no consumer ever read it back).
Docs: customize-bmad.md now notes agent names are fixed by design so
skills can be reliably invoked by role or default name.
Workflow customization:
- bmad-product-brief adopts the customize.yaml pattern with new standard
keys (activation_steps_prepend, activation_steps_append, skill_end)
that apply to any skill type, not just workflows.
- SKILL.md resolves customization as the first activation step, executes
prepend items immediately, retains append for after greeting, and
re-resolves skill_end after Stage 5 (Finalize).
- Added {skill-root} to the Conventions block.
- Normalized all sub-prompt path references to bare-from-skill-root
(../agents/ -> agents/, sibling filenames -> prompts/<file>).
Metadata:
- Added "DO NOT EDIT -- overwritten on every update." header to all 6
agent customize.yaml files.
Resolver:
- find_project_root now walks from skill_dir first, then falls back to
cwd. Nested-workspace setups where an ancestor of cwd has an unrelated
_bmad/ would previously bind the resolver to the wrong project.
Installer:
- Added 'memory' to the nonModuleDirs sets at all three filter sites so
sidecar-generated _bmad/memory/<agent>/ folders aren't treated as
modules and don't receive a generated config.yaml.
- detectCustomFiles now skips the entire _memory/ and memory/ subtrees
generically, replacing the old v6.1-specific -sidecar substring check.
Agent runtime state is never flagged as custom/modified noise on update.
First workflow to adopt the customize.yaml + three-layer merge pattern
that was previously agent-only. Proves the resolver works for workflow
skills and exercises the deep-merge fix from the previous commit.
Standard workflow customization surface:
additional_resources: [] # files for the workflow to reference
inject:
before: "" # prompt injected before workflow begins
after: "" # prompt injected after workflow completes
SKILL.md now:
- Adds a Conventions block defining {skill-root}, {project-root}, {skill-name}
- Resolves customization as step 1 of On Activation and applies
inject.before + notes additional_resources
- Resolves inject.after in a new Post-Workflow Customization section
that fires after Stage 5 (Finalize) completes
Verified end-to-end:
- Defaults resolve cleanly (empty strings, empty array)
- Team override of inject.before preserves inject.after default
(the deep-merge behavior docs promise)
- User layer adds inject.after on top of team's inject.before
- Dotted --key inject.after extraction works for the post-workflow call
Fixes four issues flagged by CodeRabbit on PR #2282:
- SKILL.md conventions now define {skill-root} (used in the resolver
command on line 16 but previously undefined alongside {project-root}
and {skill-name}).
- resolve_customization.py: missing or unparsable customize.yaml now
exits non-zero with an error instead of silently returning {}, so
the SKILL.md fallback path correctly kicks in on bad --skill paths.
- resolve_customization.py: non-agent top-level keys (e.g. workflow:,
config:) now deep-merge per the documented "other tables: deep merge"
rule. Previously override replaced these wholesale, losing unrelated
fields the user didn't touch.
- installer.js _installSharedScripts: wipe _bmad/scripts/ before copy
so files removed or renamed in src/scripts (e.g. the
resolve-customization.js -> resolve_customization.py rename) don't
linger and get tracked as installed. Also fail fast if src/scripts/
is missing.
BMB standard and Anthropic's Agent Skills spec both reference the
PEP 723 + uv pattern: declare dependencies in an inline script
header, invoke via `uv run` so deps auto-install into a cached
isolated environment on first run.
- resolve_customization.py: add PEP 723 header declaring pyyaml>=6.0
and requires-python>=3.10.
- Remove src/scripts/requirements.txt (superseded by inline metadata).
- Update 6 agent SKILL.md files to invoke `uv run` instead of `python3`.
- Update docs/how-to/customize-bmad.md to explain the uv requirement
and the PEP 723 pattern, with a plain-python3 fallback note.
- Refresh the script's ImportError message to point at uv run first.
Anthropic's Agent Skills ecosystem leans Python (official doc skills
use Python; the skills spec excludes node_modules from packaged
distributions). Using Python + PyYAML aligns with where the platform
is going, keeps the dependency declared via requirements.txt (scannable
by pip-audit/Dependabot), and eliminates the need to vendor or bundle
an npm package into the repo.
Changes:
- Rewrite src/scripts/resolve-customization.js as
src/scripts/resolve_customization.py with identical merge semantics.
- Drop vendored yaml@2.8.2 (~135 files, 800KB) from src/scripts/vendor/.
- Declare the dependency via src/scripts/requirements.txt (PyYAML>=6.0).
- Update all 6 agent SKILL.md files to invoke `python3` instead of `node`.
- Update docs/how-to/customize-bmad.md to reflect the Python runtime
and PyYAML install requirement.
- Remove src/scripts/vendor/** from eslint.config.mjs and .prettierignore.
- Refresh the _installSharedScripts comment (no more yaml bundling).
The resolver script needs a YAML parser but Node has no native YAML
support. Rather than requiring every downstream project to add `yaml`
as a dependency or teaching the installer to copy individual npm
packages, we vendor yaml@2.8.2 (zero transitive deps, ~800KB) into
src/scripts/vendor/yaml/ and import it via relative path.
- `_installSharedScripts` is now a dumb recursive copy of src/scripts/
into _bmad/scripts/ — no per-dependency logic.
- Future shared scripts can drop additional vendored modules into
src/scripts/vendor/<name>/ and require('./vendor/<name>') from
their source file.
- Lint/format ignore src/scripts/vendor/** so vendored code isn't
subject to project style rules.
- Declare scriptsDir and customDir in InstallPaths and ensure both exist.
- New _installSharedScripts task copies src/scripts/* -> _bmad/scripts/
and seeds _bmad/custom/.gitignore with *.user.yaml on fresh installs.
- Exclude scripts/ and custom/ from module-directory scans in
generateModuleConfigs, mergeModuleHelpCatalogs, and loadExistingConfig
so neither is treated as a module.
Shorter, cleaner path for user override files. Updates:
- resolver script path lookup + docstring
- all 6 agent SKILL.md fallback paths
- how-to doc examples
- .gitignore (also corrects stale .toml to .yaml)
- validator INSTALL_ONLY_PATHS entry
Extends ESLint CLI-script overrides to cover src/scripts/** and drops an
unused helper from the resolver to satisfy the pre-commit lint gate.
- Replace per-skill TOML defaults with customize.yaml using v6.1-compatible
schema (agent.metadata / agent.persona, snake_case fields)
- Port resolve-customization.py to resolve-customization.js (Node); one
shared copy at src/scripts/, invoked via --skill with three-layer merge
- Restore v6.1 fields: critical_actions, memories, menu; drop start_prompt
- Simplify menu items to {code, description, skill|prompt}; no action field
- Flatten SKILL.md to 8 atomic activation steps, boilerplate below frontmatter
- Tech-writer menu items reference skill-root prompt files via {skill-root}
- Dev agent Critical Actions moved from SKILL.md into customize.yaml
- Add {skill-name} path convention for portable fallback instructions
- Rewrite docs/how-to/customize-bmad.md for the new system
* feat(installer): use GitHub API as primary fetch with raw CDN fallback
Corporate proxies commonly block raw.githubusercontent.com while allowing
api.github.com. Add fetchGitHubFile() to RegistryClient that tries the
GitHub Contents API first, falling back to the raw CDN transparently.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(installer): cap redirect depth and preserve dual-fallback errors
Add maxRedirects parameter to fetch() and _fetchWithHeaders() to prevent
unbounded redirect recursion. Wrap CDN fallback in try/catch and throw
AggregateError with both API and CDN errors for better diagnostics.
Extract marketplace repo coordinates into named constants in
external-manager.
* chore(installer): drop unused fetchJson and fetchGitHubJson
Neither method has any callers. Also drop the corresponding test.
* refactor(test): fold registry tests into test-installation-components
No reason for RegistryClient tests to be a separate runner — the same
file already tests the registry consumers in Suite 33. Drop test:registry
from package.json scripts and quality gate.
* fix(installer): include URL, API message, and rate-limit info in HTTP errors
Non-2xx responses previously yielded bare `HTTP 403`. Now surface the
request URL, GitHub's JSON error message (or body snippet), X-RateLimit-Reset
when quota is exhausted, and Retry-After. Turns a mystery 403 into
'rate limit exhausted; resets at 2026-04-15T18:00:00Z' — the difference
between 'try GITHUB_TOKEN' and a wild goose chase.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add three-layer TOML customization system (defaults, team, user overrides)
for all six agent skills: analyst, tech-writer, PM, UX designer, architect,
and dev. Includes shared resolver script, updated activation flows, and
revised customization documentation.
Skills don't nest. Once the manifest generator finds a valid SKILL.md
in a directory, it should not recurse into that skill's subdirectories
looking for more skills. Template files (like bmb's setup-skill-template)
inside a skill's assets/ would be incorrectly scanned and produce
spurious errors.
Add missing move() with cross-device fallback (rename → copy+rm on
EXDEV), needed by OfficialModules.createModuleDirectories for directory
migrations during upgrades.
Honor overwrite/errorOnExist options in copy() to match fs-extra
behavior for callers that pass these flags.
fs-extra routes all operations through graceful-fs, which globally
monkey-patches node:fs with a deferred retry queue. During multi-module
installs (~500+ file ops), retried unlink operations from one module's
remove phase can fire after the next module's copy phase has written
files, silently deleting them non-deterministically.
Replace fs-extra with a thin fs-native.js wrapper over node:fs/promises
and node:fs. All 21 consumers now use native APIs with no global
monkey-patching, eliminating the retry-queue race condition entirely.
Closes#1779
Bob (Scrum Master) was consolidated into Amelia (Developer) in v6.3.0
(#2186) but still appeared in the workflow map diagrams for
sprint-planning, create-story, and retrospective. Updated both English
and French versions to show Amelia and removed the unused Bob CSS class.
Closes#2249
Core and BMM modules live in this repo (src/core-skills, src/bmm-skills)
but the installer UI sourced them from the remote registry. When the
registry was unreachable (VPN, proxy, firewall), the fallback YAML only
had the 4 external modules, so core and bmm disappeared from the install
list entirely.
Now _selectOfficialModules and getDefaultModules always read built-in
modules from the local source via OfficialModules.listAvailable(), then
append external modules from the registry. Network failures only affect
external modules.
Closes#2239
Translate the remaining untranslated English docs to Chinese:
- explanation/analysis-phase.md
- explanation/checkpoint-preview.md
- how-to/install-custom-modules.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore(installer): remove dead code across installer modules
Delete 3 entirely dead files (agent-command-generator, bmad-artifacts,
module-injections) and remove ~50 unused exports from manifest.js,
cli-utils.js, prompts.js, path-utils.js, official-modules.js,
external-manager.js, custom-module-manager.js, and registry-client.js.
Removes corresponding dead tests.
* fix(installer): restore currentProjectDir writes for placeholder expansion
The previous commit removed the three assignments to
OfficialModules.currentProjectDir as dead code, but buildQuestion()
still reads the property to resolve {directory_name} placeholders in
module config defaults during interactive collection. Without the
writes, any module default containing {directory_name} would surface
the literal placeholder to users.
The legacy agent-command-generator, bmad-artifacts helpers, and all 26
IDE template files (combined/ and split/) are unreachable dead code.
The installer now uses verbatim SKILL.md directory copying -- no template
rendering occurs. The files own TODO comments confirm retirement.
* feat(quick-dev): sync sprint-status.yaml on epic-story implementation
When quick-dev infers the intent is an epic story, resolve the full
sprint-status key during step-01's previous-story-continuity sub-step,
then sync sprint-status.yaml at the two workflow boundaries code-review
already owns the trailing half of:
- step-03 start: flip the story to in-progress and lift the parent
epic out of backlog if needed.
- step-05 end: flip the story to review. Code-review keeps ownership
of review -> done.
Resolution uses exact numeric-segment equality on the {epic}-{story}
prefix (never string-prefix match), so 1-1 no longer collides with
1-10. Both sync blocks are idempotent so step-04 loopbacks do not
clobber human edits or bump last_updated without cause. Skips silently
when sprint-status.yaml is missing or the intent is not an epic story.
* feat(quick-dev): add sprint-status sync to one-shot route
Epic stories do get implemented via one-shot in practice. Add the same
in-progress / review sync pair that step-03 and step-05 already have,
with identical idempotency guards and skip-on-missing behavior.
* refactor(quick-dev): extract sprint-status sync into shared file
Replace inline sync blocks in step-03, step-05, and step-oneshot with
one-line callouts to sync-sprint-status.md. The shared file owns all
edge-case handling (idempotency, epic lift, missing file/key) and is
parameterized by {target_status}. Any future route picks it up with a
single Follow line.
* fix(quick-dev): resolve story_key on early-exit resume paths
Extract story-key resolution into a shared subsection referenced by
all early-exit paths and INSTRUCTIONS, ensuring sprint-status sync
works for resumed epic stories.
* refactor(quick-dev): tighten story-key resolution prompt
Remove mechanical details the LLM can infer; keep only the
collision-prevention constraint.
* docs(cs): groom analysis-phase.md translation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs(cs): fix AI term and ideation phrasing in analysis-phase.md
Replace "UI" with "AI" (DeepL mistranslation of the AI acronym as
user interface) and rephrase "techniky idealizace" to "techniky
generování nápadů" so the meaning matches the English source.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Prevent review subagents from being downgraded to cheaper models.
Rare findings from the Acceptance Auditor tend to be high-severity,
and research shows smaller models have worse recall on rare-event
detection.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The PRFAQ link added in #2238 points to ../explanation/analysis-phase.md
which exists in en, vi-vn, and fr but was missing from the Czech
translation, breaking both CI doc checks.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Analyst (Mary) triggers were listed as BP, RS, CB, WB, DP but the
actual agent source defines BP, MR, DR, TR, CB, WB, DP. Update all
locale agents.md files. Also add PRFAQ Working Backwards hyperlink
to commands.md in en, cs, and vi-vn.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Batch-apply option (added in 9c3e2804) was instructed to "skip
any finding that requires judgment" — but step-03-triage already
guarantees patch findings are unambiguous (the decision-needed
bucket exists precisely to absorb ambiguous ones). The option had
no distinct work to do that option 1 did not already cover, and
its label suggested a meaningful difference that did not exist.
- Delete option 0 and the >3 findings conditional
- Rename "Fix them automatically" -> "Apply every patch", with
explicit scope (patches only; defer/decision-needed untouched)
- Rename "Walk through each" -> "Walk through each patch" for the
same scope clarity
- Unify <Z> placeholder with the existing <P> patch count
- Strip stale (or "0" for batch) notes from HALT lines
* feat(installer): add plugin resolution strategies for custom URL installs
When installing from a custom GitHub URL, the installer now analyzes
marketplace.json plugin structures to determine how to locate module
registration files (module.yaml, module-help.csv). Five strategies
are tried in cascade:
1. Root module files at the common parent of listed skills
2. A -setup skill with registration files in its assets/
3. Single standalone skill with registration files in assets/
4. Multiple standalone skills, each with their own registration files
5. Fallback: synthesize registration from marketplace.json metadata
and SKILL.md frontmatter
Also changes the custom URL flow from confirm-all to multiselect,
letting users pick which plugins to install. Already-installed modules
are pre-checked for update; new modules are unchecked for opt-in.
New file: tools/installer/modules/plugin-resolver.js
Modified: custom-module-manager.js, official-modules.js, ui.js
* fix(installer): address PR review findings for plugin resolver
- Guard against path traversal in plugin-resolver.js: skill paths from
unverified marketplace.json are now constrained to the repo root using
path.resolve() + startsWith check
- Skip npm install during browsing phase: cloneRepo() accepts
skipInstall option, used in ui.js before user confirms selection,
preventing arbitrary lifecycle script execution from untrusted repos
- Add createModuleDirectories() call to installFromResolution() so
modules with declarative directory config are fully set up
- Fix ESLint: use replaceAll instead of replace with global regex
* fix(installer): pass version and repoUrl to manifest for custom plugins
installFromResolution was passing empty strings for version and repoUrl,
which the manifest stores as null. Now threads the repo URL from ui.js
through resolvePlugin into each ResolvedModule, and passes the plugin
version and URL to the manifest correctly.
* fix(installer): manifest-generator overwrites custom module version/repoUrl
ManifestGenerator rebuilds the entire manifest via getModuleVersionInfo
for every module. For custom modules, this returned null for version and
repoUrl because it only checked _readMarketplaceVersion (which searches
for marketplace.json on disk) and hardcoded repoUrl to null. Now checks
the resolution cache first to get the correct version and repo URL.
* fix(installer): resolve custom modules from disk cache on quick update
When the resolution cache is empty (fresh CLI process, e.g. quick
update), findModuleSourceByCode only matched plugin.name against the
module code. This failed for modules like "sam" and "dw" where the
code comes from module.yaml inside a setup/standalone skill, not from
the plugin name in marketplace.json.
Now runs the PluginResolver on cached repos when the direct name match
fails, finding the correct module source and re-populating the cache
for the install pipeline.
* feat(installer): universal source support for custom modules
Replace GitHub-only custom module installation with support for any Git
host (GitHub, GitLab, Bitbucket, self-hosted) and local file paths.
- Add parseSource() universal input parser (local paths, SSH, HTTPS with
deep path/subdir extraction for GitHub, GitLab, Gitea)
- Add resolveSource() coordinator: parse -> clone if URL -> detect
discovery vs direct mode (marketplace.json present or not)
- Clone-first approach eliminates host-specific raw URL fetching
- 3-level cache structure (host/owner/repo) with .bmad-source.json
metadata for URL reconstruction
- Local paths install directly without caching; localPath persisted in
manifest for quick-update source lookup
- Direct mode scans target directory for SKILL.md when no marketplace.json
- Fix version display bug where walk-up found parent repo marketplace.json
and reported wrong version for custom modules
* fix(installer): harden readMarketplaceJsonFromDisk and hoist require
- Add try/catch to readMarketplaceJsonFromDisk so malformed JSON returns
null instead of throwing an unhandled parse error
- Hoist CustomModuleManager require outside the per-module loop in
_installOfficialModules
* fix(installer): restore validateGitHubUrl strictness and fix prettier
- Restore original GitHub-only regex in deprecated validateGitHubUrl
wrapper so existing tests pass (rejects non-GitHub URLs, trailing
slashes)
- Run prettier to fix formatting in custom-module-manager.js
* feat(installer): add --custom-source CLI flag for non-interactive installs
Allows installing custom modules from Git URLs or local paths directly
from the command line without interactive prompts:
npx bmad-method install --custom-source /path/to/module
npx bmad-method install --custom-source https://gitlab.com/org/repo
npx bmad-method install --custom-source /path/one,https://host/org/repo
Works alongside --modules and --yes flags. All discovered modules from
each source are auto-selected.
* docs: add custom and community module installation guide
New how-to page covering community module browsing, custom sources (any
Git host, local paths), discovery vs direct mode, local development
workflow, and the --custom-source CLI flag. Clarifies that
.claude-plugin/ is a cross-tool convention, not Claude-specific.
Also updates non-interactive installation docs with the new flag and
examples, bumps sidebar ordering, and fixes --custom-source to install
only core + custom modules when --modules is not specified.
* feat(quick-dev): add epic context compilation to step-01
Fork step-01 context loading: epic stories get a sub-agent that
compiles planning docs into a cached epic-{N}-context.md, while
freeform intents keep the lightweight directory-listing path.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(quick-dev): tighten epic context loading per PR review
- Validate cached epic-<N>-context.md is non-empty and starts with the
expected header before loading; treat invalid cache as missing.
- Replace inline {N} placeholders with <N> so the skill validator does
not flag them as unresolved workflow variables.
- Replace ambiguous "fall back to path B" with an explicit instruction
to scan/load planning artifacts using path B's procedure, with a note
not to re-evaluate path B's gating clause.
Addresses CodeRabbit and Augment review comments on PR #2218.
* refactor(quick-dev): tighten compile-epic-context prompt
- Restructure with Task/Steps opening and Exact Output Format section.
- Switch Stories template to bullet form for clarity.
- Add "no hallucination" and explicit "omit empty sections except Goal
and Stories" rules.
- Use <N> instead of {N} in the filename for consistency with step-01.
* refactor(quick-dev): restructure epic-story context loading
Reshape path A of step-01 into five explicit numbered steps and add an
inline-compilation fallback for runtimes that cannot spawn sub-agents
(Copilot, Codex, local Ollama, older Claude).
- Pull cache validity, compilation, verification, and continuity into
separate numbered steps instead of nested paragraphs.
- Define "valid cached context" upfront: non-empty and starts with
`# Epic <N> Context:`.
- Add inline-compilation fallback: runtimes without sub-agent support
read compile-epic-context.md and follow it directly.
- Make previous-story continuity run regardless of which context source
succeeded (cache hit, fresh compilation, or path-B raw fallback).
* fix(quick-dev): address review findings on epic context compilation
- Add freshness check to cached epic-N-context.md (invalidate when any
planning artifact is newer)
- Remove the silent fall-back-to-raw-planning-docs path on compile
failure; HALT and report instead
- Add explicit "ambiguous → freeform" tiebreakers for both the path A
header and the epic-number identification step
- Drop "verbatim" from compile-epic-context.md format header to resolve
the verbatim-vs-omit-empty contradiction
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat(bmad-help): add _meta rows and llms.txt support for general questions
Register llms.txt URLs in module-help.csv via _meta rows so bmad-help
can fetch module documentation when users ask questions that don't map
to a specific skill.
* refactor(bmad-help): streamline llms.txt docs into existing skill sections
* feat(quick-dev): improve checkpoint 1 UX with clickable link, external editing note, and change detection
Display spec file path as clickable CWD-relative link alongside the
summary. Inform users they can open the spec in another session with
any tool before approving. On approval, re-read the spec from disk
and acknowledge any external edits before proceeding.
* fix(quick-dev): tighten checkpoint 1 [A] flow wording
- Remove stray 'and options' from the editing-note intro so the note's
position relative to the [A]/[E] menu is unambiguous.
- Restructure the [A] bullet into explicit missing/exists branches so
the missing-file HALT cannot fall through to status updates and
recreate a deleted spec.
Addresses augmentcode review comments on PR #2217.
* docs(quick-dev): rewrite checkpoint 1 editing-note
- Drop boilerplate opener about the spec being a regular file.
- Enumerate concrete options: editor, in-session Q&A, or bmad-advanced-elicitation / bmad-party-mode / bmad-code-review skills.
- Flag that skills should ideally run in another session to avoid context bloat.
- Change "add this note" to "display this note" for precision.
* feat(installer): add community module browser and custom URL support
Three-tier module selection: official, community (category drill-down
with featured/search), and custom GitHub URL.
- Add RegistryClient shared fetch utility
- Add CommunityModuleManager with SHA-pinned cloning (refuses install
if approved SHA cannot be reached; uses HEAD when no SHA set)
- Add CustomModuleManager for arbitrary GitHub repo installation
- Extend findModuleSource chain with community and custom fallthrough
- Extend manifest to detect community and custom source types
- Add Config.customModulesMeta for custom module metadata
* fix: resolve review findings for community/custom module support
- Remove redundant CommunityModuleManager instantiation in UI display
- Remove dead customModulesMeta field from Config (never populated)
- Add 35 unit tests for CustomModuleManager and CommunityModuleManager
pure functions: URL validation, normalization, search, featured, categories
* fix: preserve installed community/custom modules in modify flow
When a user does "Modify Installation" and declines to browse community
modules, previously installed community/custom modules are now auto-kept.
If the user does browse, their selections are trusted (they can deselect).
Also fix stale docs: class doc for SHA pinning, JSDoc return type.
* fix: include community and custom modules in quick update
Quick update now checks community registry and custom cache so installed
community/custom modules are updated instead of skipped.
* fix: use defaults for new config fields during quick update
When quick update encounters new config fields (e.g., from a newly
supported community module), use schema defaults silently instead of
prompting the user. Quick update should be non-interactive.
* test: add unit tests for SHA pinning, category filtering, and URL edge cases
Cover SHA normalization (set vs null/trusted), listByCategory,
getModuleByCode, and URL validation edge cases (HTTP, trailing slash,
SSH without .git). Total: 243 tests.
Brian Madison
Alex Verkhovsky
梁山河
leon
JakubStejskalCZ
Emmanuel Atsé
miendinh
github-actions[bot]