5cb619c93c
Closes #1663. Adds two installer flags so module config options can be set without interactive prompts. Designed for CI scripts, Dockerfiles, and enterprise rollouts where the user wants to bake answers into the install command rather than answer prompts. `--set <module>.<key>=<value>` (repeatable) sets any module config option. `--list-options [module]` lists every key the installer can discover locally — built-in modules (`core`, `bmm`) plus any cached official modules. One flag scales to every module without growing the CLI surface per option. ```bash npx bmad-method install --yes \ --modules bmm --tools claude-code \ --set bmm.project_knowledge=research \ --set bmm.user_skill_level=expert \ --set core.user_name=Brian ``` ## How it works `--set` is a post-install patch. The installer runs its normal flow untouched, then `applySetOverrides` upserts each value into the relevant config files: - `_bmad/config.toml` (team scope, default) - `_bmad/config.user.toml` (user scope, when the key already lives there — so user-scope keys like `core.user_name` and `bmm.user_skill_level` keep their proper file) - `_bmad/<module>/config.yaml` (so declared schema keys carry forward via the existingValue path on the next install) A module without `_bmad/<module>/config.yaml` is skipped silently — no orphan sections in `config.toml` for uninstalled modules. ## Tradeoffs documented in install-bmad.md - **Verbatim values.** `--set bmm.project_knowledge=research` writes `"research"`, not `"{project-root}/research"`. The `result:` template is not applied. Pass it explicitly if you want the rendered form: `--set bmm.project_knowledge='{project-root}/research'`. - **Carry-forward, declared keys.** Free — values land in the per-module `config.yaml`, so the next install reads them as `existingValue` and they become the prompt default (accepted under `--yes`). - **Carry-forward, undeclared keys.** Best-effort. The value lives in `config.toml` for the current install but won't be re-emitted on the next install (the manifest writer's schema-strict partition drops unknown keys). Re-pass `--set` if needed. - **No "key not in schema" validation.** Whatever you assert is written. ## Security Prototype-pollution defense: `--set __proto__.x=1` would otherwise reach `overrides.__proto__[x] = 1` and pollute `Object.prototype`, cascading into every plain-object lookup in the process. Defense-in- depth via parser-level reserved-name rejection (`__proto__`, `prototype`, `constructor`) AND `Object.create(null)` for the override maps. Verified the attack reproduces without the guard and is blocked with it. ## What's intentionally NOT integrated `--set` deliberately does not touch the prompt / template / schema collection flow. No pre-seeding answers, no question filtering, no function-default evaluation, no schema-strict partition exemption. That earlier integration approach was tried and scrapped: it spread state across `Config`, `OfficialModules`, `manifest-generator`, both collection helpers, and required parallel plumbing for quick-update — every bug fix touched a different layer. The post-install patch model covers the actual user need (set a config value from CI) in ~330 lines of `set-overrides.js` without the schema gymnastics. ## Files - `tools/installer/set-overrides.js` (new): parser, prototype-pollution guard, `applySetOverrides` post-install patch, `upsertTomlKey` / `tomlString` / `tomlHasKey` line-based TOML helpers - `tools/installer/list-options.js` (new): module.yaml discovery + formatter for `--list-options` - `tools/installer/commands/install.js`: register `--set` / `--list-options` flags, early validation, `--list-options` exit-code handling (await `stream.write` callback then `process.exitCode` to avoid truncating piped output), thread `setOverrides` through to quick-update - `tools/installer/core/config.js`: carry `setOverrides` field for the post-install patch step - `tools/installer/core/installer.js`: invoke `applySetOverrides` after `writeCentralConfig` (covers regular install + quick-update via the shared install path) - `tools/installer/ui.js`: parse `--set` for early validation, warn about overrides targeting modules not in `--modules`, drop those entries before threading - `docs/how-to/install-bmad.md`, `README.md`: usage, routing rules, carry-forward semantics, tradeoffs ## Test plan Suite 44 (24 cases): parser, prototype-pollution guard, `tomlString` escaping, `upsertTomlKey` across insert/replace/missing-section/ empty-file/preserved-newline cases, `applySetOverrides` happy path + uninstalled-module skip + missing-user-toml-creation + empty-input no-op, `discoverOfficialModuleYamls` / `formatOptionsList` sanity (hermetic via `BMAD_EXTERNAL_MODULES_CACHE` temp dir). 355 total passing. Lint + prettier + markdownlint clean. E2E smoke verified across: - [x] `--set` writes correct files (team toml / user toml / per-module yaml) for declared and undeclared keys - [x] Quick-update without `--set` carries forward declared keys via `existingValue` path - [x] Quick-update WITH `--set` applies cleanly (uniform behavior across action types) - [x] `--set` for unselected module: warned, no orphan section - [x] Prototype pollution: rejected with non-zero exit - [x] `--list-options bmm` exit 0 with full output through pipe; `--list-options nope` exit 1 - [x] Translated docs (`docs/{cs,fr,vi-vn,zh-cn}/`) intentionally not touched — they'll lag behind English until the translation pipeline runs |
||
|---|---|---|
| .augment | ||
| .claude-plugin | ||
| .github | ||
| .husky | ||
| .vscode | ||
| docs | ||
| src | ||
| test | ||
| tools | ||
| website | ||
| .coderabbit.yaml | ||
| .gitignore | ||
| .markdownlint-cli2.yaml | ||
| .npmignore | ||
| .npmrc | ||
| .nvmrc | ||
| .prettierignore | ||
| AGENTS.md | ||
| CHANGELOG.md | ||
| CNAME | ||
| CONTRIBUTING.md | ||
| CONTRIBUTORS.md | ||
| LICENSE | ||
| README.md | ||
| README_CN.md | ||
| README_VN.md | ||
| SECURITY.md | ||
| TRADEMARK.md | ||
| Wordmark.png | ||
| banner-bmad-method.png | ||
| eslint.config.mjs | ||
| package-lock.json | ||
| package.json | ||
| prettier.config.mjs | ||
| removals.txt | ||
README.md
Build More Architect Dreams — An AI-driven agile development module for the BMad Method Module Ecosystem, the best and most comprehensive Agile AI Driven Development framework that has true scale-adaptive intelligence that adjusts from bug fixes to enterprise systems.
100% free and open source. No paywalls. No gated content. No gated Discord. We believe in empowering everyone, not just those who can pay for a gated community or courses.
Why the BMad Method?
Traditional AI tools do the thinking for you, producing average results. BMad agents and facilitated workflows act as expert collaborators who guide you through a structured process to bring out your best thinking in partnership with the AI.
- AI Intelligent Help — Invoke the
bmad-helpskill anytime for guidance on what's next - Scale-Domain-Adaptive — Automatically adjusts planning depth based on project complexity
- Structured Workflows — Grounded in agile best practices across analysis, planning, architecture, and implementation
- Specialized Agents — 12+ domain experts (PM, Architect, Developer, UX, and more)
- Party Mode — Bring multiple agent personas into one session to collaborate and discuss
- Complete Lifecycle — From brainstorming to deployment
Learn more at docs.bmad-method.org
🚀 What's Next for BMad?
V6 is here and we're just getting started! The BMad Method is evolving rapidly with optimizations including Cross Platform Agent Team and Sub Agent inclusion, Skills Architecture, BMad Builder v1, Dev Loop Automation, and so much more in the works.
📍 Check out the complete Roadmap →
Quick Start
Prerequisites: Node.js v20+ · Python 3.10+ · uv
npx bmad-method install
Want the newest prerelease build? Use
npx bmad-method@next install. Expect higher churn than the default install.
Follow the installer prompts, then open your AI IDE (Claude Code, Cursor, etc.) in your project folder.
Non-Interactive Installation (for CI/CD):
npx bmad-method install --directory /path/to/project --modules bmm --tools claude-code --yes
Override any module config option with --set <module>.<key>=<value> (repeatable). Run --list-options [module] to see locally-known official keys (built-in modules plus any external officials cached on this machine):
npx bmad-method install --yes \
--modules bmm --tools claude-code \
--set bmm.project_knowledge=research \
--set bmm.user_skill_level=expert
Not sure what to do? Ask
bmad-help— it tells you exactly what's next and what's optional. You can also ask questions likebmad-help I just finished the architecture, what do I do next?
Modules
BMad Method extends with official modules for specialized domains. Available during installation or anytime after.
| Module | Purpose |
|---|---|
| BMad Method (BMM) | Core framework with 34+ workflows |
| BMad Builder (BMB) | Create custom BMad agents and workflows |
| Test Architect (TEA) | Risk-based test strategy and automation |
| Game Dev Studio (BMGD) | Game development workflows (Unity, Unreal, Godot) |
| Creative Intelligence Suite (CIS) | Innovation, brainstorming, design thinking |
Documentation
BMad Method Docs Site — Tutorials, guides, concepts, and reference
Quick links:
Community
- Discord — Get help, share ideas, collaborate
- YouTube — Tutorials, master class, and more
- X / Twitter
- Website
- GitHub Issues — Bug reports and feature requests
- Discussions — Community conversations
Support BMad
BMad is free for everyone and always will be. Star this repo, buy me a coffee, or email contact@bmadcode.com for corporate sponsorship.
Contributing
We welcome contributions! See CONTRIBUTING.md for guidelines.
License
MIT License — see LICENSE for details.
BMad and BMAD-METHOD are trademarks of BMad Code, LLC. See TRADEMARK.md for details.
See CONTRIBUTORS.md for contributor information.