Removes the security-risky _module-installer pattern (code execution at
install time) in favor of a declarative `directories` key in module.yaml.
The main installer now handles directory creation centrally based on this
config, eliminating per-module installer.js scripts and their CJS/ESM issues.
Changes:
- Delete src/bmm/_module-installer/installer.js
- Delete src/core/_module-installer/installer.js
- Add `directories` key to src/bmm/module.yaml
- Rename runModuleInstaller() -> createModuleDirectories()
- Remove _module-installer from ESLint overrides
- Remove _module-installer from file-ref validator skip dirs
* fix: remove redundant "None" skip option from module selection
The "None - Skip module installation" option was unnecessary since
core is always locked/selected, satisfying the required constraint.
Users can simply press Enter with only core selected to skip modules.
Also removes dead code: selectModules(), getExternalModuleChoices(),
and selectExternalModules() methods that were never called.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: support ESM and .cjs module installers in ModuleManager
Module installer loading now handles three cases:
- .cjs files loaded via require() (always CommonJS regardless of package type)
- .js files loaded via dynamic import() (works for both CJS and ESM)
- CJS default export unwrapped automatically for consistent API
This fixes errors when external modules set "type":"module" in their
package.json. Those modules must still rename installer.js to
installer.cjs if it uses require() internally.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address code review findings from PR #1590
- Filter 'core' from CLI --modules in update path for consistency
- Update selectAllModules() JSDoc to reflect core exclusion
- Fix ESM default-export unwrap to handle function/class exports
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: clarify module post-install script errors as non-fatal warnings
Change error display from log.error to log.warn and explain that the
module was installed successfully — only the optional post-install
script could not run. Prevents users from thinking the module
installation itself failed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: suppress non-fatal module post-install script errors
Post-install scripts fail due to CJS/ESM incompatibility but module
files are already copied successfully. Silently catch the error instead
of showing a warning that alarms users into thinking installation failed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove redundant modules and tools lines from install summary
The checkmark list already shows each installed module and IDE tool.
Keep only the install path and file-warning lines in the summary footer.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Brian <bmadcode@gmail.com>
* fix(docs): comprehensive documentation site review fixes
Rehype plugins:
- Rewrite rehype-markdown-links for correct relative .md resolution
- Handle raw HTML base paths and bare .md links in rehype-base-paths
- Guard protocol-relative URLs (//...) in all link processors
- Use file.path instead of file.history[0] for vfile compatibility
- Fail build when content directory cannot be detected
- Export helpers for testability; add 107 unit tests
Build & CI:
- Revert cancel-in-progress to false to avoid mid-deploy cancellation
- Remove redundant link-validation CI step (build validates internally)
- Remove unnecessary fetch-depth:0 from docs deploy workflow
- Refuse docs build on Windows (platform guard)
- Remove dead build scripts and stale references
Tooling:
- Add DOCS_ROOT boundary check in validate-doc-links.js
- Handle directory paths and prefix stripping in link validator
- Remove dead regex and add // guard in fix-doc-links.js
Accessibility & CSS:
- Darken caution/danger aside title colors for WCAG AA 4.5:1 contrast
- Fix 100vw scrollbar overflow (banner width:100%, html overflow-x:clip)
- Add :focus-visible ring to banner link for keyboard navigation
- Remove dead CSS declaration and add missing code block lang
Documentation content:
- Convert /docs/ absolute links to relative paths and fix llms.txt URLs
- Correct command file paths and naming in commands reference
- Update stale shard-doc command to current /bmad-shard-doc format
- Fix incomplete sentence in install-bmad.md
- Add Quick Flow next steps and fix 404 link path
- Expand thin content pages with substantive detail
- Add sidebar ordering frontmatter to all content pages
- Remove BMGD docs (moved to dedicated repo)
- Remove unused assets and misleading diagram caption
- Add non-iframe fallback link to workflow map diagram
- Remove dead noscript block from workflow-map
- Standardize BMAD to BMad, fix spelling/grammar, normalize headings
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(docs): add non-interactive installation to sidebar, rewrite and reorder how-to guides
- Move non-interactive-installation.md into how-to/ directory so it appears
in the sidebar navigation (was orphaned at docs root)
- Rewrite the page based on editorial review: consolidate redundant sections,
add missing how-to structure (prerequisites, "What You Get"), condense
installation modes from 5 subsections to a table, cut speculative examples
- Reorder how-to sidebar: Install (1), Non-Interactive (2), Upgrade to v6 (3),
then the rest following user journey order
- Fix README link to point to docs site instead of repo-internal markdown path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(docs): address documentation review findings
Fix broken directory tree, grammar errors, inconsistent naming,
missing admonition/headings, enable lastUpdated timestamps in CI,
and remove footer CSS that misapplied to the content footer.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(docs): move bleeding-edge install command out of Verify Installation
The alternative npx command for installing from main was misplaced
inside the "Verify Installation" section. Move it to a tip admonition
under Step 1 where users look for install options.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: extend validate-file-refs.js to scan CSV workflow-file references
Add CSV file reference extraction to the Layer 1 validation pipeline,
preventing broken _bmad/ workflow-file paths in module-help.csv files.
Closes the gap identified after PR #1529 where CSV references were
unvalidated despite being a source of repeat community issues.
Refs: #1519
* fix: include test:refs in aggregate test script
Add CSV file-ref extraction tests to the aggregate `npm test` pipeline,
matching the existing pattern for test:schemas and test:install.
Thanks to CodeRabbit for catching the omission.
* fix: address review feedback on CSV validator extension
- Surface CSV parse errors visibly instead of silently swallowing
(no Layer 2c schema validator exists yet to catch these)
- Add explanatory comments for the !VERBOSE logging pattern
(non-verbose prints file headers only when issues found)
- Add verbose-mode diagnostics for extensionless path handling
([SKIP] when nothing exists, [OK-DIR] for valid directories)
* refactor: collect-then-print to eliminate confusing !VERBOSE pattern
Replace the split header-printing logic (print early in verbose mode,
print late in non-verbose mode with a !VERBOSE guard) with a simpler
collect-then-print approach. Refs are now classified into ok[] and
broken[] arrays first, then printed in a single location with one
straightforward if/else if decision.
Addresses alexeyv's review feedback about the counterintuitive
"if not verbose, log" pattern.
* feat: promote extensionless unresolved paths from silent skip to [UNRESOLVED]
Paths without file extensions that don't exist as files or directories
are now flagged as [UNRESOLVED] — a distinct tag from [BROKEN] (which
means a file with a known extension wasn't found). Both count toward
the broken reference total and appear in CI annotations.
This catches real bugs like wrong directory names in installed_path
metadata and dead invoke-workflow references to removed workflows.
Extensionless paths that DO exist as directories are still [OK-DIR].
---------
Co-authored-by: Alex Verkhovsky <alexey.verkhovsky@gmail.com>
Co-authored-by: Brian <bmadcode@gmail.com>
* feat(cli): complete @clack/prompts migration
Full migration of BMAD CLI installer from legacy terminal libraries
(chalk, ora, boxen, figlet, wrap-ansi, cli-table3, readline) to unified
@clack/prompts v1.0.0 visual system.
Foundation (prompts.js + cli-utils.js):
- Extended prompts.js wrapper with box, spinner, progress, taskLog,
path, autocomplete, selectKey, stream, color re-export
- Refactored cli-utils.js: displayLogo uses box(), sections use note(),
steps use log.step(), removed boxen/figlet/wrap-ansi/cli-table3
UI orchestration (ui.js):
- Replaced ~100 console.log+chalk calls with log.*, note(), box()
- Replaced ora spinner with @clack spinner
- Module selection: autocompleteMultiselect with locked core module,
bulleted post-selection display, maxItems for no-scroll
Spinner migration (installer.js):
- Replaced 40+ ora spinner calls with @clack spinner
- All spinner.stop() calls include meaningful messages
- Failure paths use spinner.error() (red cross) instead of stop()
Readline migration (agent/installer.js + config-collector.js):
- Migrated readline prompts to @clack text/confirm/select
- Fixed chalk.dim bug (chalk was never imported)
- Removed chalk from config-collector.js
IDE handlers + modules (7 files):
- Replaced chalk+ora across all IDE handlers and module manager
- Fixed options.installer undefined bug in manager.js update()
Cleanup:
- Removed ora, boxen, figlet, wrap-ansi, cli-table3 from dependencies
- chalk stays (used outside tools/cli/ scope)
- Replaced hand-drawn Unicode update box in bmad-cli.js with box()
- Added process.stdin.setMaxListeners(25) for sequential prompts
Spinner wrapper adds isSpinning state tracking (not native to @clack).
Removed dead groupMultiselect and sortKey sort calls.
Ref: tech-spec-installer-clack-migration-ui-enhancement.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(cli): consolidate installer output to single spinner + summary
Replace ~40 lines of output from 15+ spinner start/stop cycles with a
single animated spinner during installation and a final note() summary
block showing checkmarks per step.
Key changes:
- Add results collector pattern in install() method
- Replace spinner.stop/start pairs with addResult + spinner.message
- Add renderInstallSummary() using prompts.note() with colored output
- Propagate silent flag through IDE handlers and module manager
- Add spinner race condition guards (start while spinning, stop while stopped)
- Add no-op spinner pattern for silent external module cloning
- Fix stdin listener limit to be defensive with Math.max
- Add GIT_TERMINAL_PROMPT=0 for non-interactive git operations
- Merge locked values into initialValue for autocomplete prompts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(cli): resolve code review findings from @clack/prompts migration
Address 31 issues across 14 CLI files found during PR #1586 review
(Augment Code + CodeRabbit):
- Fix bmadDir ReferenceError by hoisting declaration before try block
- Wrap console.log monkey-patch in try/finally for safe restoration
- Fix transformWorkflowPath dead code and undefined return path
- Fix broken symlink crash in _config-driven.js and codex.js cleanup
- Pass installer instance through update() for agent recompilation
- Fix @clack/prompts API: defaultValue→default, initialValue→default
- Use nullish coalescing (??) instead of logical OR for falsy values
- Forward options in recursive promptToolSelection calls
- Remove no-op replaceAll('_bmad','_bmad') in manager and generator
- Remove unused confirm prompt in config-collector hasNoConfig branch
- Guard spinner.message() when spinner is not running
- Add missing methods to silent spinner stub (cancel, clear, isSpinning)
- Wrap install.js error handler with inner try/catch + console fallback
- Gate codex per-entry error log with silent flag
- Add return statements to all stream wrapper methods
- Remove dead variables (availableNames, hasCustomContentItems)
- Filter core module from update flow selection
- Replace borderColor ternary chain with object map
- Fix Kilo "agents" label to "modes" in IDE manager
- Normalize error return shape for unsupported IDEs
- Fix spinner message timing before dependency resolution
- Guard undefined moduleDir in dependency-resolver
- Fix workflowsInstalled counter inflation in custom handler
- Migrate console.warn calls to prompts.log.warn
- Replace console.log() with prompts.log.message('')
- Fix legacyBmadPath hardcoded to .bmad instead of entry.name
- Fix focusedValue never assigned breaking SPACE toggle and hints
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The workflow was failing with 403 "Resource not accessible by integration"
on fork PRs because pull_request events get read-only GITHUB_TOKEN
permissions for cross-repository PRs. Switching to pull_request_target
runs the workflow in the base repo context, granting write permissions
needed to post the @coderabbitai review comment.
This is safe because the workflow only posts a comment and does not
check out or execute any code from the PR branch.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add Augment Code Review (audit mode) and CodeRabbit (adversarial mode):
Augment (.augment/code_review_guidelines.yaml):
- Workflow structure and step validation rules
- Agent definition validation
- Path placeholder enforcement
- JIT loading and HALT requirements
CodeRabbit (.coderabbit.yaml):
- Raven-style adversarial reviewer persona
- Finds logical contradictions and missing implementations
- No rule anchoring - reasons freely
Supporting changes:
- .gitignore: exclude .augment/ from ignore
- eslint.config.mjs: ignore .augment/ directory
fix: clarify .augment gitignore pattern and eslint comment
Add documentation comment to .gitignore explaining the .augment/*
exception pattern, and replace misleading eslint comment about
"underscores per their spec" with accurate description of vendor
config directory exclusion.
Addresses CodeRabbit findings F10 and F11 from PR #1511 review.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fix: remove redundant eslint ignore patterns
The broader glob patterns (dir/**) already match all files recursively,
making the more specific sub-patterns (dir/**/*.js, dir/**/*.md, etc.)
completely redundant. Similarly, _bmad*/** already covers _bmad/**.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fix: synchronize ignore baselines across CodeRabbit and Augment configs
Expand path exclusions in both PR review tools to a shared baseline:
- Mutual config exclusions (each tool ignores its own and others configs)
- Build output, vendored/generated files, package metadata, binary/media
- Test fixtures, non-project dirs, AI assistant dirs, build temp
- Generated reports
CodeRabbit goes from 1 exclusion to 32; Augment from 12 to 32.
ESLint already had comprehensive ignores and is unchanged.
Addresses CodeRabbit findings F2 and F4 from PR #1511 review.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fix: correct project name in Augment review guidelines
fix: remove instruction that explicitly encourages false positives
The downloads page offered bmad-sources.zip and bmad-prompts.zip, both
redundant: GitHub provides source archives for every tag natively, and
npx bmad-method install is the supported path for compiled prompts.
Remove the downloads page, all bundle generation code, the archiver
dependency, and nav links. The llms.txt and llms-full.txt files (the
genuinely useful artifacts) continue to be generated as before.
The manual-release.yaml workflow has been broken since the v6 alpha
rewrite — it calls `npm run validate` which no longer exists. Releases
are now handled via the /draft-changelog and release skills instead.
- Delete .github/workflows/manual-release.yaml
- Delete tools/docs/BUNDLE_DISTRIBUTION_SETUP.md (references deleted workflow)
- Remove release:major/minor/patch/watch npm scripts (triggered deleted workflow)
Can be restored from git history if a CI-based release workflow is needed again.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Update all references to the help task file from the old path
`_bmad/core/tasks/bmad-help.md` to the new path `_bmad/core/tasks/help.md`.
Affected files:
- 7 workflow step files across multiple workflows
- 1 IDE tool command generator (updated comments)
Remove the forbidden `workflow_path` frontmatter variable from 16 step files
across 3 workflows (quick-dev, quick-spec, check-implementation-readiness).
Per BMAD workflow standards, step files should use relative paths or
{project-root} references instead.
Changes:
- quick-dev (6 files): removed workflow_path and unused thisStepFile
- quick-spec (4 files): removed workflow_path, updated templateFile to use relative path
- check-implementation-readiness (6 files): removed workflow_path, updated all references to use relative paths
Also fixes incorrect path in check-implementation-readiness that referenced
non-existent 'implementation-readiness' folder instead of 'check-implementation-readiness'.
Fixes#1546
Fixes#1547
- step-05 now correctly routes to step-06-research-synthesis.md instead of presenting itself as the final step
- Fixed step-04 stepsCompleted: [1,2,3] → [1,2,3,4]
- Fixed step-05 stepsCompleted: [1,2,3,4] → [1,2,3,4,5]
- Fixed step-06 stepsCompleted: [1,2,3,4,5] → [1,2,3,4,5,6]
- Fixed step-05 title from "Step 4" to "Step 5"
- Fixed step-06 title from "Step 5" to "Step 6"
- Updated success/failure metrics and NEXT STEP sections
This mirrors the fix applied to market research in Beta.5, ensuring the technical research workflow properly completes through all 6 steps.
After Party Mode completes within a parent workflow, the LLM fails to
re-present the parent workflow's completion menu due to lost-in-the-middle
effect at 50-100K tokens. The parent workflow instructions get pushed into
mid-context where they are no longer proactively recalled.
Add a Return Protocol section to step-03-graceful-exit.md that instructs
the LLM to:
1. Identify the parent workflow that invoked party-mode
2. Re-read that file to restore context
3. Resume from the invocation point
4. Present required menus/options
This is platform-independent prompt engineering that forces proactive
re-reading rather than relying on mid-context recall.
Fixes#1319
Co-authored-by: Brian <bmadcode@gmail.com>
- Replace "invoke the review task" with "load and follow the review task"
- Replace "run this step/task" with "load this step/task"
- Aligns with canonical phrasing from PR #1387Closes#1378
CodeRabbit doesn't reliably handle the ready_for_review webhook
event, so draft PRs that are marked ready never get auto-reviewed.
This workflow posts @coderabbitai review when a PR transitions
from draft to ready, working around the limitation.
* docs: add pull request template
Adds PR template matching the format documented in CONTRIBUTING.md.
Completes one of two remaining GitHub Community Standards items.
Fixes#1553
* Update .github/PULL_REQUEST_TEMPLATE.md
- Override _isActionKey to treat SPACE as an action key instead of search input,
and add key handler to toggle selections when not navigating
- update IDE selection prompt message from "Select tools:" to "Integrate with:".
* docs: add official external modules reference page
* chore: remove obsolete docs and basement files
* fix: update robots.txt URLs to docs.bmad-method.org
* fix: generate robots.txt dynamically from site base URL
Replace static robots.txt with an Astro endpoint that uses the
configured site URL, so sitemap references are correct on both
fork deployments and production.
* fix: unify site URL resolution in build-docs.js
build-docs.js had its own hardcoded fallback URL
(bmad-code-org.github.io) instead of using the shared
getSiteUrl() function, causing URL mismatches between
robots.txt, llms.txt, and sitemaps. Now all components
resolve the site URL through the same function. Renamed
site-url.js to .mjs to avoid Node ESM detection warnings.
* fix: correct module names and relocate prompt file
- CIS: "Creative Innovation Suite" → "Creative Intelligence Suite"
- GDS: "Game Dev Suite" → "Game Dev Studio"
- Move _prompt-external-modules-page.md from docs/ to tools/docs/
* refactor: convert build-docs to ESM, eliminate mutable globals
- Convert build-docs.js to build-docs.mjs (CJS → ESM)
- Import getSiteUrl directly, remove async import workaround
- Kill mutable SITE_URL global, call getSiteUrl() where needed
- Clean up Banner.astro variable naming
- Update package.json and CI workflow for .mjs extension
* feat: add non-interactive installation support
Add command-line flags to support non-interactive installation for CI/CD
pipelines and automated deployments:
- --directory: Installation directory
- --modules: Comma-separated module IDs
- --tools: Tool/IDE IDs (use "none" to skip)
- --custom-content: Custom module paths
- --action: Action type for existing installations
- --user-name, --communication-language, --document-output-language, --output-folder: Core config
- -y, --yes: Accept all defaults
When flags are provided, prompts are skipped. Missing values gracefully
fall back to interactive prompts.
* fix: complete non-interactive installation support
- Fix validation checks using truthy instead of !== true
- Add skipPrompts flag to skip module config prompts with --yes
- Add getDefaultModules() for automatic module selection with --yes
- Fix IDE selection to use array check instead of length check
Co-Authored-By: AiderDesk <https://github.com/hotovo/aider-desk>
---------
Co-authored-by: Brian <bmadcode@gmail.com>
The --prefer-offline flag causes npm to use cached package metadata,
which can be stale and fail to resolve recently published versions.
Also updates deprecated --production flag to --omit=dev.
Fixes#1438
* fix: bmad-help agent reads project docs and respects communication_language
The help task fabricated tech stack information instead of reading actual
project documentation (#1460) and ignored communication_language config
(#1457). Three changes:
1. Step 2 now also extracts communication_language and project_knowledge
from the active module's config.yaml
2. New step 3 scans project_knowledge path for documentation and uses
discovered facts as grounding context, with anti-hallucination guard
3. Step 7 enforces {communication_language} in all output
Chose inline config resolution over workflow.yaml conversion to match
existing core task patterns (index-docs, shard-doc).
Fixes#1460
Relates to #1457
* fix: clarify config extraction wording in help task
Remove "active module" reference from step 2 — config extraction
happens during the all-modules scan, before module detection in
step 4. Changed to "each scanned module's config" to match the
existing iteration pattern.
Addresses CodeRabbit review feedback on PR #1535.
---------
Co-authored-by: Brian <bmadcode@gmail.com>
* fix: trim activation header to avoid YAML formatting issues in kilo installer
* refactor: convert kilo installer to use YAML object serialization and add workflow support
- Replace string concatenation with yaml.parse/stringify for proper YAML handling
- Add workflow command generation and export to .kilocode/workflows/
- Implement clearBmadWorkflows to remove old BMAD workflow files
- Convert createModeEntry to createModeObject returning structured objects
- Update cleanup to use YAML parsing for proper mode filtering
- Update installCustomAgentLauncher to use object-based config
* fix: add task and tool command generation to kilo installer
---------
Co-authored-by: Brian <bmadcode@gmail.com>
* docs: rename brownfield to established projects
Flatten how-to/brownfield/ subdirectory and replace jargon term
"brownfield" with more accessible "established projects" throughout.
- brownfield/index.md → established-projects.md
- brownfield/quick-fix-in-brownfield.md → quick-fixes.md
- brownfield-faq.md → established-projects-faq.md
- Update all internal links and references
* docs: remove redundant phrase from quick-fixes description
* docs: restore natural language in established-projects body
* fix: support CRLF line endings and add task/tool templates for all IDEs
* fix: preserve file extensions in IDE task/tool paths and update BMAD branding
* fix: double extension issue in wrapper filename generation
* fix: correct path handling and variable reference in task/tool command generator
* fix: change default BMAD folder name from 'bmad' to '_bmad' across all IDE components
* refactor: centralize BMAD_FOLDER_NAME constant in path-utils
* fix: Replace the rest of BMAD_FOLDER magic values
* fix: add safety checks for setBmadFolderName method calls in IdeManager
* fix: convert absolute paths to relative in task-tool-command-generator
* fix: support .xml task files in bmad-artifacts task discovery
* fix: skip internal tasks in manifest generation and IDE command discovery
* fix: skip empty artifact_types targets and remove unused vscode_settings target
* fix: skip internal tools in manifest generation and improve Windows path handling in command generator
* fix: use csv-parse library for proper CSV handling in manifest generation
* refactor: extract CSV text cleaning to reusable method in manifest generator
* fix: normalize path separators to forward slashes in agent file copying for cross-platform compatibility
---------
Co-authored-by: Alex Verkhovsky <alexey.verkhovsky@gmail.com>
Co-authored-by: Brian <bmadcode@gmail.com>
Adds two operational technology domains to domain-complexity.csv
in both PRD and architecture workflows. Addresses the gap in OT
domain coverage for physical process control and building systems.
process_control: industrial automation, SCADA, PLC, DCS, I&C,
P&ID — covers power/utilities, water treatment, oil & gas,
manufacturing, chemical, pharmaceutical, food & beverage, mining,
and other sectors where software controls physical processes.
Key concerns include functional safety, process safety and hazard
analysis, environmental compliance, OT cybersecurity, and plant
reliability/maintainability. Requires engineering_authority PRD
section for PE/EOR credential requirements.
building_automation: BAS/BMS, HVAC, fire alarm, fire protection,
life safety, elevators, lighting, access control, commissioning —
covers commercial and institutional building systems. Key concerns
include life safety codes, multi-trade coordination, commissioning,
and indoor environmental quality.
Both domains are high complexity, include engineering_authority
as a required PRD section, and follow established entry patterns.
Fixes#1240
Co-authored-by: Brian <bmadcode@gmail.com>
* feat: add cross-file reference validator for CI
Add tools/validate-file-refs.js that validates cross-file references
in BMAD source files (agents, workflows, tasks, steps). Catches broken
file paths, missing referenced files, wrong extensions, and absolute
path leaks before they reach users.
Addresses broken-file-ref and path-handling bug classes which account
for 25% of all historical bugs (59 closed issues, 129+ comments).
- Scans src/ for YAML, markdown, and XML files
- Validates {project-root}/_bmad/ references against source tree
- Checks relative path references, exec attributes, invoke-task tags
- Detects absolute path leaks (/Users/, /home/, C:\)
- Adds validate:refs npm script and CI step in quality.yaml
* feat: strip JSON example blocks to reduce false-positive broken refs
Add stripJsonExampleBlocks() to the markdown reference extractor so
bare JSON example/template blocks (braces on their own lines) are
removed before pattern matching. This prevents paths inside example
data from being flagged as broken references.
* feat: add line numbers, fix utility/ path mapping, improve verbose output
- Add utility/ to direct path mapping (was incorrectly falling through
to src/modules/utility/)
- Show line numbers for broken references in markdown files
- Show YAML key path for broken references in YAML files
- Print file headers in verbose mode for all files with refs
* fix: correct verbose [OK]/[BROKEN] overlap and line number drift
Broken refs no longer print [OK] before [BROKEN] in --verbose mode.
Code block stripping now preserves newlines so offsetToLine() reports
accurate line numbers when code blocks precede broken references.
* fix: address review feedback, add CI annotations and step summary
Address alexeyv's review findings on PR #1494:
- Fix exec-attr prefix handling for {_bmad}/ and bare _bmad/ paths
- Fix mapInstalledToSource fallback (remove phantom src/modules/ mapping)
- Switch extractYamlRefs to parseDocument() for YAML line numbers
Add CI integration (stories 2-1, 2-2):
- Emit ::warning annotations for broken refs and abs-path leaks
- Write markdown table to $GITHUB_STEP_SUMMARY
- Guard both behind environment variable checks
Harden CI output:
- escapeAnnotation() encodes %, \r, \n per GitHub Actions spec
- escapeTableCell() escapes pipe chars in step summary table
---------
Co-authored-by: Alex Verkhovsky <alexey.verkhovsky@gmail.com>
Co-authored-by: Brian <bmadcode@gmail.com>
Brian Madison
Davor Racic
Alex Verkhovsky
Michael Pursifull
Vladimir Hrusovsky
Drickon
Adam Biggs
PinkyD
murat
Murat K Ozcan