Replace the flat copy-list staging with a manifest-driven copy plan:
- buildCopyPlan maps declared skills/agents/commands and string-typed
Claude-Code surfaces into canonical install slots, copies conventional
top-level metadata, and drops anything not covered (no more leaking of
tools/, website/, .github/, etc.).
- rewriteManifestPaths emits a plugin.json whose paths point at the
canonical post-install locations, keeping the on-disk manifest
self-consistent inside _bmad/<code>/.
- stageCopyPlan stages the plan plus synthesized files (rewritten
plugin.json) into the tmp dir for the atomic swap.
install.mjs and update.mjs switch to the new plan/skillDestDirs flow and
drop the now-unused copy-list helpers.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The skill is copied into _bmad/core/skills/bmad-module/ by the installer,
which strips node_modules, ships no package.json under the skill, and never
runs npm install there. Bare `import 'yaml'`/`import 'semver'` therefore
crashed at module load (ERR_MODULE_NOT_FOUND, exit 1) before any structured
exit code could fire. Every other installed script is zero-third-party-dep.
- Vendor the real yaml@2.8.4 as a deterministic esbuild single-file bundle
(scripts/lib/vendor/yaml.mjs), imported by relative path. Guarantees
byte-identical manifest.yaml round-trips with BMAD core's writer, which uses
the same library + options (tools/installer/core/manifest.js).
- Drop semver for a node:-only semver-lite.mjs (valid/validRange),
parity-tested against the real semver across 469 cases (400 fuzzed).
- Fix a third bare yaml import that the original report missed (frontmatter.mjs).
- Make bmad-module.mjs a zero-import launcher that maps any load failure to a
new documented EXIT.TOOLING (5) with reinstall guidance instead of leaking a
raw ESM stack trace; the verb dispatcher moves to cli.mjs.
- Enforce vendor freshness so a yaml/esbuild bump can't ship a stale bundle:
build-vendor.mjs --check is wired into npm test (pre-commit), npm run quality,
and the quality.yaml CI validate job. Adds vendor:build / vendor:check scripts.
- Ignore the generated vendor/ dir in eslint + prettier; document the rationale
in SKILL.md, README.md, and vendor/README.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
pbean