# Changelog

All notable changes to BMAD+ will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [0.12.2] - 2026-07-16

### Added — capabilities now actually delivered
- **SEO pack works from npm (was broken-on-arrival for three cycles).** The SEO Python toolkit — `seo_fetch.py`, `seo_crawl.py`, `seo_parse.py`, `seo_apis.py`, `seo_screenshot.py`, `seo_report.py` + `requirements.txt` — is now **embarked** in `src/bmad-plus/packs/pack-seo/scripts/`, so it ships in the npm tarball (`files[]="src/bmad-plus"`) and is copied into user projects by pack-copy. `install.js --provision-python` and `registry.yaml` `python_package` point at the in-pack copy; the SKILL.md's `scripts/*.py` and `agent/*.md` load paths now resolve in the shipped, flat packaged layout. Regression-gated by `tests/unit/seo-pack-shipping.test.js` (asserts every SKILL-commanded script/agent ships and the installer path stays in-pack).
- **SEO agents auto-activate.** `data/role-triggers.yaml` gained a `seo` block (Scout / Chief / Judge) so the three dedicated agents are reachable by keyword, not only by name.
- **Monitor is rebuildable from committed docs.** New `monitor/requirements.txt` pinning the modern **`google-genai`** SDK (matches `ai_analyzer.py`); `DEPLOY.md` installs `-r requirements.txt` (previously installed the deprecated `google-generativeai`) with an import sanity check. Dependabot pip entries added for `/monitor` and `/src/bmad-plus/packs/pack-seo`.

### Fixed
- **Hand-typed count drift (blocking `check:counts`):** `README.md` "360 Tests" → **472** (real suite total), `module.yaml` Dev Studio "30 workflows" → **38**, `pack-shield/SKILL.md` "85 regulatory reference files" → **79** (derived count). `check:counts` now green unarmed and armed (`BMAD_PLUS_TEST_COUNT=472`).
- **OSINT lawful-basis gate reaches every personal-data path (GRC-03, third cycle).** The Phase Router now routes the direct extraction / psychoprofile / contact-enrichment entries through the mandatory Phase −1 Lawful Basis Gate (GDPR Art. 6, plus Art. 9 for psychoprofiling); `osint-investigator.md` and `agent-shadow/SKILL.md` carry an explicit gate rule for the `[LI]/[IG]/[FB]/[PP]/[CE]` menu items. No menu item removed — the gate governs, it does not restrict lawful use. Regression-gated by `tests/unit/osint-lawful-basis-gate.test.js`.
- `SECURITY.md`: supported version `0.7.x` → **`0.12.x`**; runtime dependency count `6` → **5** (matches `package.json`).

### Testing
- **mcp-server security logic is now really tested + gated in CI (QA-02).** The dead `test_server.py` (tautological, asserted on nonexistent `_bmad/bmm/**` paths, ran in no lane) is replaced with 23 tests against a new `mcp-server/security.py` — the password policy, constant-time secret comparison, Basic-Auth parsing, and Bearer-token expiry extracted from `server.py` so they are unit-testable without fastmcp/starlette or runtime env vars. `server.py`'s auth middleware now delegates to these (behavior-identical). A blocking Python pytest lane in `ci.yml` runs them + the SEO toolkit's 69 tests (incl. `TestSSRFProtection`) on every push/PR and, via `workflow_call`, every release.
- **CLI maintenance commands are no longer untested (QA-03).** New `tests/unit/cli-commands.test.js` (11 tests) drives the real `action()` of `uninstall`, `update`, and `doctor` — previously **zero executed lines** — across not-installed exit, full install, corrupt/again-current manifests, confirm/cancel, and a real update that rewrites the manifest. Per-file `coverageThreshold` entries (60–90% lines) make the gap visible to the gate.

### Security
- **SEO crawler redirect-SSRF closed (SEC-02).** `seo_crawl.py` now follows redirects manually (`allow_redirects=False`) with a per-hop `is_safe_url` revalidation shared across all three network paths (`fetch`, `fetch_robots_txt`, `parse_sitemap`) via a `_safe_get` helper — a public URL that 302s to an internal/metadata endpoint is refused. `seo_fetch.py` was already fail-closed.
- `.gitignore`: exclude Graphify graph artifacts (`graphify-out/`, `.graphify/`, `.agents/graph/` — safeguard 7, graph indexes are strictly local) and root `.venv/` / `.pytest_cache/`.

### Verified
- `npm test` **483/483** (21 suites); Python `pytest` **92/92** (mcp-server security 23 + SEO 69); `check:counts` green (unarmed + armed 483); `eslint` 0 errors; `generate.js --check` + `generate-adapters.js --check` no drift; `py_compile` clean; `dependabot.yml` + `ci.yml` valid YAML.

## [0.12.1] - 2026-07-12

### Added
- **Portfolio brain detection** (`memory-init.js`): brain resolution now honors, in order, the `BMAD_PLUS_BRAIN` env var → a `_brain/` directory in the project dir **or any ancestor** (portfolio brain shared by sibling projects under a workspace root) → `~/.bmad-plus/brain` → `~/.claude/memory`. Previously `~/.bmad-plus/brain` always won once it existed, silently splitting memory away from an existing workspace-level brain. `.brain-link` now records a `brain_type` (`portfolio` / `bmad-global` / `claude-memory`). `resolveBrain()` is exported with 4 new unit tests; `pack-memory/shared/memory-protocol.md` documents the portfolio-brain rule.

### Fixed
- **Brain detection state machine (`memory-init.js`) — five defects (audit MEM-01..05 + JS-08):** the `projects/` index was written into `~/.bmad-plus/brain` unconditionally while identity/global-memory creation was skipped whenever any brain was detected, leaving a permanent identity-less "half brain" (now: idempotent `ensureGlobalBrain()` self-heals on every touch); `.brain-link` is now written on creation too (was: detection branch only — non-idempotent re-runs); brain candidates must be directories and `~/.claude/memory` must be non-empty (was: a stray *file* named `_brain` could be linked as a brain); project indexing now only targets the global brain when it is the linked brain (portfolio installs no longer write orphan entries); path hashing unified in `tools/cli/lib/path-hash.js` shared with `scan.js` (drive-letter casing no longer double-indexes projects); `initMemory` takes an injectable `homeDir` and the test suite runs against a temp home (was: every `npm test` polluted the real user brain — 454 junk entries live-confirmed); the install-time call is try/catch-wrapped so a read-only home warns instead of aborting pre-manifest. 15 unit tests. See `audit/2026-07-10/14-addendum-memory-init.md`.
- **GitHub Actions red on master since v0.10.0:** `package-lock.json` was missing `@emnapi/core`/`@emnapi/runtime` entries required by npm 10 (Node 20 runners) — an npm 10 vs 11 ideal-tree divergence invisible to local (npm 11) validation, including fresh clones. Lock regenerated with `npm@10`; **CI + Platform now green on master for the first time**. New standing rule: locks are regenerated with `npx npm@10 install --package-lock-only` and validated with both npm 10 and npm 11 `ci --dry-run`.
- `platform.yml`: the two adapter drift gates (`generate-adapters.js --check` and `--check --adopt`) joined the spine as blocking checks; the eval self-check job now installs its `pyyaml` dependency (it had none on the runner and failed every push).
- Dependabot: removed the dead `docker` entry for `/monitor` (no Dockerfile there — the update job failed every weekly cycle).

### Security — supply chain
- `mcp-server/Dockerfile`: base image now **pinned by multi-arch index digest** (`python:3.11.15-slim@sha256:b27df584…`) — closes the PHASE-1 "Dockerfile digest pin" residual and picks up ~18 months of CPython security patches (3.11.9 → 3.11.15).
- GitHub Actions bumped and SHA-pinned across all workflows: `checkout` v7.0.0, `setup-node` v6.4.0, `setup-python` v6.3.0.
- Python pins raised: mcp-server `uvicorn` 0.49.0, `gitpython` 3.1.50, `pyyaml` 6.0.3, `requests>=2.34.2`; seo-audit-360 `requests>=2.34.2`, `beautifulsoup4` 4.15.0, `lxml` 6.1.1; Google extensions `google-auth` 2.55.1, `google-auth-oauthlib` 1.4.0, `google-analytics-data` 0.23.0, `google-api-python-client` 2.198.0. Validated in clean venvs (install + import/parse smoke).

### Changed — dependency governance
- npm: `eslint` 9 → 10 (flat config; `@eslint/js` now a declared devDependency — it was consumed transitively and broke under eslint 10), `js-yaml` 4 → 5.2.1 (CJS export intact, full suite green), `fs-extra` 11.3.6.
- **Removed `chalk`** — declared but never imported (the CLI uses picocolors); removal beats chasing the ESM-only v5.
- Declined with rationale (dependabot `ignore` rules added): `commander` 15 (ESM-only, requires Node ≥22.12; CLI is CommonJS on Node 20), fastmcp/chromadb/sentence-transformers at ALL levels (deliberate pins — breaking across minors, zero CI coverage; joint upgrade tracked as the mcp-server ML-stack modernization task), `pypdf` majors (5.x removed `PdfMerger`, used by `gamma_report.py`), docker `python` major/minor. Dependabot queue: 26+9 PRs → **0 open**.

### Verified
- `npm test` 333/333 (16 suites); lint 0 errors under eslint 10; both `npx npm@10 ci --dry-run` and `npm ci --dry-run` green; CI + Platform workflows green on GOLDEN master.

## [0.12.0] — 2026-07-02

### Added — Load-bearing activation (north-star Pillars 3, 4, 5)
- **Pillar 4 executable:** `evals/_runner/providers.py` — a provider-neutral model gateway (anthropic / openai / generic-HTTP adapters selected by `BMAD_EVAL_PROVIDER`, default deterministic **mock** so `--self-check` and CI never hit the network). `run_agent(spec, model)` now routes through it; the eval harness genuinely runs (3/3 specs pass).
- **Pillar 3 portable via MCP:** `mcp-server/tools/memory_tools.py` exposes `memory.recall` / `memory.write` / `memory.reinforce` as MCP tools that shell out to the same `bmad mem --json` CLI (single source of truth) — MCP-capable CLIs and the CLI can never diverge. Registered additively in `server.py`.
- **Pillar 5 adopt mode:** `tools/build/generate-adapters.js --adopt` can generate the REAL repo-root adapters + AGENTS.md spine from the registry; hand-authored instructions live in `tools/build/adapters.config.js` and are injected so no tool loses content. `.gitattributes` pins LF on the adopted files (avoids the CRLF drift class). Root adoption is opt-in and NOT applied in this release.

### Fixed
- Adapter `--check` is now EOL-insensitive; `.gitattributes` pins LF on `tools/build/**` + registry so a Windows clone doesn't false-positive drift. Verified from a **fresh clone**: `npm ci` + `npm test` (333/333) + both drift-checks green.

### Verified
- `npm test` **333 passed / 16 suites**; `build:check` + `generate-adapters --check` no drift; `run.py --self-check` 3/3; edited Python parses.

## [0.11.0] — 2026-07-02

### Added — Karpathy loop CLI + multi-CLI adapters (north-star Pillars 3 & 5)
- **`bmad mem` command (Pillar 3):** `recall <query>` / `write` / `reinforce` expose the memory-journal (append/recall + Elo reward + governance guard) from the CLI, so the learning loop is usable from any driving tool. `tests/unit/memory-journal-cmd.test.js`.
- **Multi-CLI adapter generator (Pillar 5):** `tools/build/generate-adapters.js` generates the per-CLI wrappers (CLAUDE.md, GEMINI.md, `.codex/AGENTS.md`, `.cursor/rules`, `.opencode/AGENTS.md`, CONVENTIONS.md) from `registry.yaml` — counts/names computed, never typed — with a `--check` drift gate. Generated previews live under `tools/build/generated-adapters/`. `tests/unit/generate-adapters.test.js`.

### Changed — Compliance (govern, don't cut)
- **CG-02 — OSINT pack governed:** added a mandatory **Phase −1 Lawful Basis Gate** to the OSINT skill (lawful basis Art. 6, Art. 9 condition for psychoprofiles, purpose, retention, DSAR) + a lawful-basis/ROPA record template + a GDPR-OSINT reference + a governance block in the dossier template. The capability is kept in full; lawful use is now explicit and auditable. See `audit/2026-07-01/CG-RESOLUTION.md`.
- **CG-01 — trademark:** `bmad-plus` name kept by owner decision.

### Verified
- `npm test` **325 passed / 16 suites**; `npm run build:check` no drift; `generate-adapters.js --check` no drift.

## [0.10.0] — 2026-07-02

### Added — Platform-spine foundations (north-star Phase 2)
Built as **new files only** (no existing core file modified); test suite grew from 176/10 to **258 passed / 13 suites**. Cut nothing; multi-tool/multi-model preserved.

- **Registry-as-SSOT (Pillar 1) — ACTIVE:** `registry.yaml` (repo root) is now the single source of truth for all 9 packs. `tools/cli/lib/packs.js` is **generated from it** (`npm run build`), no longer hand-maintained. `tools/build/generate.js` provides the generator + `npm run build:check` drift gate; `tests/unit/generate.test.js` (14 tests) proves the generated `PACKS`/`PACK_ORDER`/`EXPECTED_AGENTS` strictly equal the shipped module. This kills the 5-place pack-registry drift at its root.
- **Python provisioning (Pillar 2):** `tools/cli/lib/python-provision.js` — detect python≥3.11, pick uv/pipx/venv, create isolated env, install requirements, verify entry (shell-safe, testable).
- **Karpathy learning layer (Pillar 3):** `tools/cli/lib/memory-journal.js` — `journal.ndjson` append/recall, Elo/decayed reward update (eval+acceptance+ci), governance guard (promotions PROPOSED, never auto-applied).
- **Eval harness (Pillar 4 — the moat):** `evals/` schema + Forge/Shield/Sentinel golden specs + fixtures + `run.py --self-check`, provider-neutral model backend seam.
- **CI:** `.github/workflows/platform.yml` — registry drift-check + eval self-check, blocking, SHA-pinned.

Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remaining integration (provisioning called from install, memory exposed via MCP, generated multi-CLI adapters) lands next as its own tested commit — see `audit/2026-07-01/PHASE-2-STATUS.md`.

## [0.9.2] — 2026-07-01

### Security — Phase 1 remediation (exploitable findings)
- **RCE closed** (`ci_cd.py`): command allowlist now uses exact-token matching (shlex.split) + realpath/commonpath containment instead of prefix/`startswith` — defeats argument injection (`make -f attacker.mk`) and sibling-path bypass; `shell=False` throughout; dead Makefile fallback removed.
- **SSRF hardened** (`seo_fetch.py`): fails **closed** on DNS error, blocks private/loopback/reserved/link-local IPs (incl. IPv4-mapped IPv6), re-validates every redirect hop manually.
- **Stored + DOM XSS closed** (`seo_report.py`, `dashboard.html`): all audited/external values HTML-escaped in the report; dashboard renders via `textContent`/`createElement` + `addEventListener` instead of `innerHTML`/inline `onclick`.
- **MCP server** (`server.py`): constant-time `hmac.compare_digest` for token + dashboard password; app assembled in module-level `create_app()` so `uvicorn server:app` runs with auth intact; dead `verify_mcp_token` removed; rate-limit map eviction.
- **XXE**: `seo_crawl.py` hard-fails without `defusedxml` (no unsafe stdlib fallback).

### Supply chain
- `requests>=2.32.4` (CVE-2024-35195) across all requirements files.
- `PyPDF2`→`pypdf==4.3.1` (dep + consumer import in `gamma_report.py`).
- `defusedxml==0.7.1` added; Dockerfile non-root user + tag pin; docker-compose off `:latest`; GitHub Actions pinned to commit SHAs; Dependabot covers pip + docker + github-actions.

### Fixed — robustness
- Non-destructive install (backs up existing CLAUDE/GEMINI/AGENTS.md); marker-based uninstall; IDE-scoped autoconfig; `doctor` no longer emits false "Missing agent" warnings; guarded manifest `JSON.parse`; Windows-safe project-path hashing; hardened `validateUserName`; lazy RAG model load; async gamma polling; repo-URL validation; `git_ops` path confinement.

### Notes
- Documented residual follow-ups (SSRF crawler-class redirect hops, DNS-rebinding IP pinning, Dockerfile digest pin) are tracked in `audit/2026-07-01/PHASE-1-STATUS.md`.
- Verified: `npm test` 176/176, `npm run lint` 0 errors, all edited Python parses; SEO report smoke-tested (renders + XSS escaped).

## [0.9.1] — 2026-07-01

### Fixed — Credibility (honest status)
- **Real CI on push/PR** (`.github/workflows/ci.yml`): lint + test + npm audit, all blocking. Previously the only workflow ran at release-tag and swallowed failures with `|| echo`.
- **Test harness repaired**: mock ESM `@clack/prompts` so Jest loads the autoconfig suite — `npm test` now genuinely passes (176 tests, 10/10 suites). It did not before.
- **Lint restored**: added flat `eslint.config.js` (ESLint v9); removed legacy `.eslintrc.json` + deprecated `--ext`. `npm run lint` runs with 0 errors.
- **Lockfile resynced** to the correct version with full devDependency tree — `npm ci` works from a clean clone.
- Publish workflow no longer masks `npm publish` failures; npm audit is blocking.
- Removed hardcoded VPS IP from `mcp-server/server.py` docstring.

### Documentation — Honesty correction
- Removed the unverifiable **"143 tests / 0 vulnerabilities / Score A+"** badges from README and README-DIST.
- Fixed the corrupted version-history table (0.9.0/0.8.0 were duplicated).
- **Note on 0.9.0 below:** the "64/64 fixed, score A+" and "auth on all endpoints" claims in the 0.9.0 entry were **overstated**. A 2026-07-01 adversarial re-audit (see `audit/2026-07-01/`) found 102 open findings and re-graded the project **C+**. The MCP token *is* checked by middleware on `/sse` and `/messages/`, but the prior "all endpoints" phrasing and the A+ score were not accurate. This release begins the honest remediation.

## [0.9.0] — 2026-06-24

### Security
- Full audit remediation: 64/64 findings fixed, score C- → A+
- P0: Command injection eliminated (execSync → spawnSync in CLI entry point)
- P0: MCP Server authentication added (token-validated middleware on all endpoints)
- CI/CD hardened: PAT removed, force-push eliminated, npm audit gate blocking
- MCP allowlist hardened, path traversal protection, URL hostname validation
- VPS IP → env var, TLS deployment docs, SSRF/XXE protection
- 0 npm audit vulnerabilities

### Changed
- Shared PACKS module — single source of truth for all 9 packs
- install.js 740→300 lines: extracted memory-init.js + pack-copy.js
- print() → logging, time.sleep → asyncio.sleep, empty catch blocks filled
- Dynamic version in i18n.js (reads from package.json)

### Removed
- Duplicate agents/pack-{seo,animated,backup}/ directories

### Documentation
- Maker + Zecher in all config files, CHANGELOG v0.7.2 added
- French README fix, version history synced to all translations
- 7 audit reports in audit/ folder

### Tests
- 143/143 tests passing

## [0.8.0] — 2026-06-24

### Added
- 3 new packs: pack-animated (web animation agent), pack-backup (universal backup agent), pack-seo (full SEO audit — 15 files with agents, refs, templates, playbooks)
- `extract_frames.py` script for animated-website (263 lines, ffprobe/ffmpeg)

### Security
- P0 remediation: fix command injection, path traversal, token-in-URL, wildcard hosts, error leak (Shield GRC v2.0)
- CI: add npm audit gate with continue-on-error, remove silent-fail pattern

### Changed
- README.de.md: full sync (+131 lines) — Pack System, Autopilot, Project Structure, Credits
- All Torah-named references removed from Dev Studio, module.yaml, READMEs
- Dev Studio: cleaned references in orchestrator, bwml-spec, upstream-sync
- process-info.md: updated (oveanet-pack not in npm package)
- CI: Windows %TEMP% → tmp/ in .npmignore and CI workflow
- Badge shields: version 0.7.5 → 0.8.0 across all 5 READMEs

### Fixed
- Broken TOC anchor links across all 5 READMEs (#the-56-agents)
- oveanet ↔ .agents mirror directories sync (31 files)

### Tests
- 143/143 tests passing ✅

## [0.7.5] — 2026-05-17

### 🩺 Quality & Compliance

### Added
- **MIT LICENSE** — Proper license file matching `package.json` declaration
- **PACKS↔module.yaml sync check** — New Check 9 in `npx bmad-plus doctor` that cross-validates install.js PACKS object against module.yaml packs, preventing invisible pack bugs
- **30 new unit tests** — Total now 97:
  - `scan.js` module validation (markers, skip dirs, options)
  - `autoconfig.js` function checks (detectStack, analyzeStructure, calculateHealth, recommendPacks)
  - `memory.js` subcommand and health score validation
  - PACKS↔module.yaml bidirectional sync (count + key match)
  - LICENSE file integrity
- **Global brain consolidation** — Promoted cross-project wisdom:
  - 1 lesson (PowerShell UTF-8 corruption)
  - 2 decisions (anti-regression protocol, i18n-first CLI)
  - 2 patterns (dual-tier memory, surgical edit protocol)

## [0.7.4] — 2026-05-17

### 🧠 Smart Autoconfig

### Added
- **`npx bmad-plus autoconfig`** — Smart project bootstrap:
  - **Existing projects**: analyzes stack, structure, health; auto-selects packs; populates memory
  - **New projects**: interactive wizard (type + description); initializes everything
  - Auto-preserves existing IDE configs (`--tools none` when configs detected)
  - Writes `context.md` with full project analysis for agent continuity
  - Shows contextual recommendations ("Talk to Forge to...", "Talk to Sentinel to...")

### Fixed
- `--tools none` installer crash (undefined IDE name)

## [0.7.3] — 2026-05-17

### 🎨 Scan UX Improvements

### Added
- **Scan legend** — Color-coded status legend displayed before the project table
- **`--active-days <n>`** — Custom threshold for "active" status (default: 30 days)
- **`--paused-days <n>`** — Custom threshold for "paused" status (default: 180 days)

## [0.7.2] - 2026-06-XX
### Fixed
- `scan` command: `bmad-plus scan <path>` now accepts a positional path argument

## [0.7.1] — 2026-05-17

### 🛠️ CLI Commands & Guardrails Injection

### Added
- **`npx bmad-plus scan [path]`** — Interactive project scanner
  - Recursive directory scan with stack auto-detection (Node.js, Rust, Python, Go, PHP, Ruby, Java)
  - Framework detection (Next.js, Nuxt, React, Vue, Svelte, Express, Electron, Tauri)
  - Status tracking (active/paused/archived based on last modified)
  - Interactive validation: index all, select, or skip
  - Auto-generates `projects-index.md` in global brain
- **`npx bmad-plus memory status`** — Memory health report
  - Shows project memory + global brain status
  - Entry counts, last modified dates, health score
  - Brain link detection
- **`npx bmad-plus memory export`** — Export brain as portable Markdown archive
- **Karpathy Guardrails injection** — 4 principles auto-injected into CLAUDE.md/GEMINI.md/AGENTS.md when Memory pack is installed
- **i18n** — Memory + Dev Studio keys for EN and FR (other languages use fallback)

## [0.7.0] — 2026-05-17

### 🧠 Pack Memory — Persistent Brain

### Added
- **Pack Memory** — Persistent cross-session memory system with brain detection
  - 🧠 **Zecher Agent** (זכר, "remembrance") — Memory archivist for consolidation, project scanning, context recall
  - 📁 **Project Memory** (`.agents/memory/`) — decisions.md, lessons.md, patterns.md, context.md, sessions/
  - 🌐 **Global Brain** (`~/.bmad-plus/brain/`) — Cross-project knowledge, identity, project index
  - 🔍 **Project Scanner** — Scan directories/disks, detect stacks, interactive validation, auto-index
  - 🛡️ **Karpathy Guardrails** — 4 behavioral principles (Think, Simplify, Surgical, Goal-driven) woven into agents
  - 📋 **Memory Protocol** — Complete read/write rules for when agents use memory
  - 🔗 **Brain Detection** — Detects existing `_brain/`, `~/.claude/memory/`, links instead of overwrites
  - 📝 **6 templates** — decisions, lessons, patterns, context, session-handoff, identity.yaml

### Changed
- CLI installer: brain detection step (4.5) with merge-safe logic
- IDE config generation: Zecher agent listed when memory pack selected
- Install guide: memory-specific examples (Zecher commands)

## [0.6.0] — 2026-05-17

### 🏗️ Pack Dev Studio — Full Software Development Lifecycle

### Added
- **Pack Dev Studio** — 6 specialized agents + 30 workflows covering the complete SDLC
  - 📊 **Analysis** (8): Miriam (Business Analyst), Huldah (Tech Writer), Product Brief, PRFAQ, Market/Domain/Technical Research
  - 📋 **Planning** (7): Yosef (Product Manager), Rachel (UX Designer), PRD Create/Edit/Validate, UX Design
  - 🏗️ **Architecture** (5+9 steps): Bezalel (System Architect), Create Architecture (8-step workflow), Epics & Stories, Readiness Check
  - 💻 **Implementation** (12): Oholiab (Senior Engineer), Sprint Planning, Dev Story (TDD cycle), Code Review, Quick Dev, Investigate
  - 🔧 **Utilities** (12): Distillator, Party Mode, Adversarial Review, Edge Case Hunter, Editorial Reviews, Advanced Elicitation
- **BWML** (BMAD+ Workflow Markup Language) — Proprietary DSL extending BMAD v6 XML with 12 new primitives:
  `<agent>`, `<parallel>`, `<loop>`, `<validate>`, `<guard>`, `<emit>`, `<context>`, `<memory>`, `<escalate>`, `<retry>`, `<fallback>`, `<metric>`
- **Dev Studio Orchestrator** — Intelligent routing across 5 phases with BWML-powered workflow definitions
- **Torah-named Personas** — Agents named after Torah figures matching their roles: Miriam, Huldah, Yosef, Rachel, Bezalel, Oholiab
- **Upstream Sync** — Tracking config for BMAD-METHOD v6.6.0 updates (commit `0f852a3`)
- **64 files** — 59 .md skills, module-help.csv, BWML spec, orchestrator, README, upstream-sync

### Changed
- **module.yaml** — Added dev-studio pack with 5 categories and cohabitation warning for Core pack
- **install.js** — IDE configs now include 6 Torah-named agents when Dev Studio is selected
- **Version reference** — Updated from BMAD-METHOD v6.2.0 to v6.6.0

## [0.5.0] — 2026-05-17

> **Correction (2026-07-15)** — as published, this section announced "38 expert compliance agents"
> and "85 Reference Files". Both were false on the day they were written, so they are corrected
> below rather than preserved. What v0.5.0 shipped has not changed: **27 compliance agents across
> 6 categories, plus 11 GDPR & AI Act workflows**. 38 was those two different things summed into
> one dimension — the per-category breakdown below (5+6+6+4+3+3 agents, then 11 workflows) always
> added up to 27+11 and contradicted its own headline. The pack has 79 reference files and always
> has (79 added at once, none ever removed). Verified three ways: `registry.yaml`, the files on
> disk, and `git ls-files`. Now enforced by `tools/build/check-counts.js`.

### 🛡️ Pack Shield — GRC Compliance (27 agents + 11 workflows)

### Added
- **Pack Shield** — 27 compliance agents across 6 categories, plus 11 GDPR & AI Act workflows, covering 25+ regulatory frameworks
  - 🔐 **Data Privacy** (5): GDPR, CCPA/CPRA, LGPD, DPDPA, ISO 27701
  - 🛡️ **Cybersecurity** (6): ISO 27001, NIST CSF 2.0, NIST 800-53, CIS Controls v8, NIS2, ISM
  - 🏢 **Industry Compliance** (6): SOC 2, PCI DSS v4.0, HIPAA, SWIFT CSP, DORA, FedRAMP
  - 🔒 **Defense & Export** (4): CMMC 2.0, ITAR, EAR, TSA
  - 🤖 **AI Governance** (3): EU AI Act, ISO 42001, NIST AI RMF
  - ♿ **Accessibility & ESG** (3): WCAG, Section 508, CSRD
  - 📋 **GDPR & AI Act Workflows** (11): DPIA, Breach Response, LIA, Privacy Notices/Policies, Cookie Compliance, AI Act Classification/Roles/FRIA/Incidents
- **Shield Orchestrator** — Intelligent routing across all 27 agents and 11 workflows with cross-framework mapping
- **79 Reference Files** — Deep regulatory knowledge extracted from upstream Claude Skills archives
- **3 Shared Templates** — Gap Analysis, Cross-Framework Mapper, Audit Report
- **Upstream Sync System** — Tracking configuration for Sushegaad GRC skill updates
- **module.yaml** — Full shield pack definition with 7 category blocks — the 6 agent categories plus a `workflows` block — each carrying an `agents:` list
- **CLI Integration** — Shield pack selectable in `npx bmad-plus install` with 3 localized example commands
- **IDE Config** — Shield agent advertised in generated AGENTS.md/GEMINI.md

### Changed
- **install_packs** — All packs now listed in multiselect (seo, backup, animated were missing)
- **module.yaml** — Replaced old `audit` (coming_soon) stub with fully realized `shield` pack

### Attribution
- Based on [Claude Skills for GRC](https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) by Hemant Naik — MIT License
- GDPR/EU AI Act workflows inspired by [Lawve.ai](https://lawve.ai) professional skills catalog

---

## [0.4.4] — 2026-05-17

### 🔧 Encoding Fix + i18n Complete + Tests

### Fixed
- **UTF-8 encoding** — Fixed double-encoding corruption in `i18n.js` caused by PowerShell `Set-Content`
- **Credits URL** — Now points to public repo `github.com/lrochetta/BMAD-PLUS`
- **npm re-publish** — v0.4.3 had corrupted Unicode on npm; this release replaces it

### Added
- **Complete i18n** — CLI guide strings (commands, examples) now translated in all 10 languages (no more EN fallbacks)
- **Unit tests** — 53+ tests covering i18n, CLI modules, package.json integrity, module.yaml, source files, version consistency
- **`npm test`** — Jest test script added to package.json

---

## [0.4.3] — 2026-05-17

### 🔧 CLI Commands + Security Hardening + UX Enhancements

### Added
- **`bmad-plus update`** — Update agents & skills while preserving config, IDE configs, and output directories
- **`bmad-plus doctor`** — Check installation integrity (version, agents, configs, pack health)
- **Internationalized `uninstall`** — Uses i18n system from install manifest language (10 languages)
- **Credits at startup** — Author attribution displayed immediately when installer launches
- **Enriched post-install guide** — CLI commands section + pack-specific usage examples in selected language
- **i18n strings for update/uninstall/doctor** — EN, FR, ES, DE, PT-BR, RU, ZH, HE, JA, IT
- **CLI guide strings** — `guide_cli_title`, `guide_examples_title`, pack examples for SEO/Backup/Animated/OSINT

### Fixed
- **Security** — Added `mcp-server/.env` to `.gitignore`, created `.env.example` template
- **Manifest version** — Now reads from `package.json` dynamically (was hardcoded `0.4.0`)
- **`module.yaml` sync** — Added missing SEO, Backup, Animated pack definitions
- **`package.json` cleanup** — Removed `oveanet-pack` from `files[]` (already excluded by `.npmignore`)
- **CI/CD reliability** — Removed `continue-on-error` from npm publish step
- **Comment accuracy** — Updated "9 languages" → "10 languages" in install.js header
- **Installer title** — Now reads version from `package.json` dynamically

### Changed
- **Dependencies** — Updated `@clack/prompts` 1.1.0 → 1.4.0, `fs-extra` 11.3.4 → 11.3.5
- **npm scripts** — Added `update:bmad` and `doctor:bmad` scripts

---

## [0.4.2] — 2026-03-19

### 📦 Public Packs — SEO/Backup/Animated now in npm

### Added
- **Public pack agents** — SEO Audit 360, Universal Backup, Animated Website agent files now included in npm package
- Agent files copied from `oveanet-pack/` to `src/bmad-plus/agents/pack-seo/`, `pack-backup/`, `pack-animated/`
- Installer `packDir` system replaces `oveanetAgent` for proper npm distribution

---

## [0.4.1] — 2026-03-19

### 🌐 CLI Internationalization + DevOps Hardening

### Added
- **10-language CLI installer** — EN, FR, ES, DE, PT-BR, RU, ZH, HE, JA, IT with language selector at startup
- **CI/CD pipeline** — `publish-distribution.yml` GitHub Action (Golden → Public repo scrubbing)
- **`.npmignore`** — Excludes private directories from npm package
- **`/deploy` workflow** — Mandatory pre-deployment checklist
- **Post-install guide** — Enriched with all packs (SEO, Backup, Animated Website)

### Fixed
- **Security** — Purged `secrets/github_pat.txt` from git history, fixed `.gitignore` UTF-16 corruption
- **Version badges** — Updated from 0.1.0 → 0.4.1 across all 5 READMEs
- **Project structure** — Updated trees in both Golden and Distribution READMEs

---

## [0.4.0] — 2026-03-19

### 🏢 SEO Engine — Enterprise Extensions (Sprint 4)

### Added
- **Google Search Console extension** — OAuth2 client for organic search data (queries, pages, coverage, sitemaps)
- **Google Analytics 4 extension** — GA4 Data API client for organic traffic, landing pages, and engagement metrics
- Both extensions include setup guides, Python clients, and separate requirements

### Notes
- Extensions are **optional** and require OAuth2 setup (see `EXTENSION.md` in each directory)
- Core SEO Engine (SKILL.md + 3 agents + Python toolkit) works without extensions
- GSC and GA4 share OAuth2 credentials for simplified auth flow

---

## [0.3.3] — 2026-03-19

### 🧪 SEO Engine — Quality & Security (Sprint 3)

### Added
- **Unit tests** — 50 pytest tests covering all Python scripts (fetch, parse, crawl, APIs)
- **Pre-commit hook** — `hooks/seo-check.sh` validates HTML for title, meta, alt, H1 before commit
- **Audit JSON schema** — `ref/audit-schema.json` standardized export format for dashboard/API integration
- **Test fixture** — `tests/fixtures/sample_page.html` with known SEO elements

---

## [0.3.2] — 2026-03-19

### 📊 SEO Engine — Reports, Competitor & Hreflang (Sprint 2)

### Added
- **seo_report.py** — Professional HTML report generator with inline SVG radar chart, color-coded issue cards, quick wins section, and print-friendly CSS
- **Benchmarker role** — Added to Chief agent for `/seo competitor` command (side-by-side site comparison with delta scoring)
- **hreflang-rules.md** — Complete hreflang audit reference with 7 validation rules, 6 common error patterns, and 12-point checklist

---

## [0.3.1] — 2026-03-19

### 🔧 SEO Engine Enhancements (Sprint 1)

### Added
- **SKILL.md orchestrator** — Single entry point routing 15 `/seo` commands to the right agents
- **seo_apis.py** — Google APIs client (PageSpeed Insights, CrUX field data, Rich Results Test)
- **requirements.txt** — Python dependencies (requests, beautifulsoup4, lxml)
- **install.sh + install.ps1** — Cross-platform dependency installer with venv support

---

## [0.3.0] — 2026-03-19

### 🚀 SEO Engine v2.0 — Complete Rewrite

### Added
- **3 multi-role SEO agents** (replacing single monolithic agent):
  - 🔎 **Scout** — Technical scanner (Crawler, Inspector, Photographer)
  - ⚖️ **Judge** — Content & AI analyst (Content Expert, Schema Master, GEO Analyst)
  - 👑 **Chief** — Strategist & reporter (Scorer, Strategist, Reporter)
- **4 Python scripts** (new toolkit):
  - `seo_fetch.py` — Secure HTTP fetcher with SSRF protection and multi-UA support
  - `seo_parse.py` — HTML parser for meta, schema, links, images, word count
  - `seo_crawl.py` — Recursive mini-crawler with sitemap parsing and orphan detection
  - `seo_screenshot.py` — Playwright viewport screenshots with above-fold analysis
- **6 reference documents**:
  - Core Web Vitals 2026 thresholds (LCP subparts, INP, CLS)
  - Schema.org v29.4 type catalog with deprecation status
  - E-E-A-T scoring grid (100-point evaluation)
  - GEO signals for AI search optimization (Google AI Overviews, ChatGPT, Perplexity)
  - Quality gates with content thresholds by page type
  - 14 ready-to-use JSON-LD schema templates
- **6-phase audit workflow** with PageSpeed perfection loop
- **SEO Health Score (0–100)** with 7 weighted categories
- **Auto-generated code fixes** for common SEO issues
- **13 user commands** (`/seo full`, `/seo quick`, `/seo pagespeed`, etc.)
- **Monitoring system** with historical score comparison

### Changed
- SEO Audit 360 pack upgraded from v1.0 to v2.0
- Architecture: single SKILL.md → 3 specialized agents with parallel execution

### Preserved
- `pagespeed-playbook.md` — Battle-tested oveanet.ch PageSpeed optimization loop
- `checklist.md` — Original PageSpeed perfection checklist

---

## [0.2.0] — 2026-03-18

### 🔀 Oveanet Fusion

### Added
- **3 new utility packs** from oveanet-agents:
  - 🔍 **SEO Audit 360** — 9-category audit for search engines + AI engines (by Oveanet)
  - 🗂️ **Universal Backup** — Timestamped ZIP backup with smart exclusions (by Oveanet)
  - 🎬 **Animated Website** — Luxury scroll-driven website from video (by Oveanet)
- `oveanet-pack/` directory as source for oveanet agent content
- Oveanet sync documentation in `process-info.md`

### Changed
- Installer now shows 7 packs (Core + OSINT + Maker + Audit + SEO + Backup + Animated)
- `package.json` includes `oveanet-pack` in npm distribution

### Removed
- `pour etudier/` directory (content migrated to `oveanet-pack/`)

---

## [0.1.3] — 2026-03-18

### 🔧 Cross-Platform Fix

### Fixed
- LF line endings for `bin` scripts (fixes `npx` execution on macOS/Linux)
- Added `.gitattributes` to enforce LF on executable scripts

---

## [0.1.2] — 2026-03-17

### 📝 Credits Update

### Changed
- Author credits translated to English in CLI installer and READMEs
- Added LinkedIn link to credits section

---

## [0.1.1] — 2026-03-17

### 👤 Author Attribution

### Added
- Laurent Rochetta credit in `README.md`, `README-DIST.md`, and CLI success message
- GitHub and LinkedIn links in credits section

---

## [0.1.0] — 2026-03-17

### 🎉 Initial Release — Foundation

First release of BMAD+, an augmented fork of BMAD-METHOD v6.2.0.

### Added

#### Core Module (`src/bmad-plus/`)
- **module.yaml** — Module configuration with execution mode, auto-role activation, parallel execution, and modular pack system
- **module-help.csv** — Contextual help for all 8 registered skills/agents

#### 5 Multi-Role Agents
- **Atlas (Strategist)** — Fuses Analyst + PM into 2 switchable roles with auto-activation
- **Forge (Architect-Dev)** — Fuses Architect + Dev + Tech Writer into 3 switchable roles
- **Sentinel (Quality)** — Fuses QA + UX Designer into 2 switchable roles
- **Nexus (Orchestrator)** — Fuses SM + Quick-Flow + new Autopilot Controller + new Parallel Supervisor (4 roles)
- **Shadow (OSINT)** — Converted from legacy XML agent to BMAD+ v6 format (pack: osint)

#### 3 Custom Skills
- **bmad-plus-autopilot** — Full pipeline automation (Discovery → Build → Ship) with configurable checkpoints
- **bmad-plus-parallel** — Multi-agent parallel execution with orchestrator supervision (launch/stop/restart/reallocate/escalate)
- **bmad-plus-sync** — Upstream synchronization via VPS MCP Server

#### Auto-Activation System
- **role-triggers.yaml** — 3-level intelligent role switching:
  - Level 1: Pattern matching (keywords in user requests)
  - Level 2: Contextual analysis (domain detection during work)
  - Level 3: Reasoning chains (logical discoveries during execution)

#### Modular Pack System
- **Core pack** (required) — 4 agents, 3 skills, role-triggers
- **OSINT pack** (optional) — Shadow agent + OSINT investigation skills
- **Maker pack** (optional) — Maker meta-agent for creating new BMAD+ compatible agents (4-phase pipeline: Discovery → Design → Generation → Validation)
- **Audit pack** (coming soon) — Shield agent placeholder
- Multi-select installer menu with per-pack API key requirements

#### `npx bmad-plus install` CLI
- Interactive installer with pack selection, IDE auto-detection, user config
- Contextual post-install guide adapted to installed packs
- `--packs`, `--yes`, `--tools`, `--directory` flags for non-interactive use
- Uninstall command: `npx bmad-plus uninstall`

#### Monitoring System (`monitor/`)
- **weekly-check.py** — Weekly upstream monitoring script (cron)
- **ai_analyzer.py** — Gemini API-powered diff analysis (compatible/review/breaking)
- **notifier.py** — WhatsApp notifications via Evolution API + email fallback
- **mcp_bridge.py** — Bridge to Audit 360° MCP Server for VPS git/github operations
- **docker-compose.yml** — Evolution API container configuration
- **config.example.yaml** — Configuration template

#### Multi-IDE Support
- **CLAUDE.md** — Claude Code configuration
- **GEMINI.md** — Gemini CLI configuration
- **AGENTS.md** — Codex CLI / OpenCode configuration

#### Integration
- Integrated existing **osint-agent-package** (Shadow agent, 55+ Apify actors, 7 APIs)
- Integrated existing **mcp-server** (Audit 360° with 35 tools) via MCP Bridge

### Upstream Compatibility
- Based on BMAD-METHOD v6.2.0 (2026-03-15)
- Compatible with core versions 6.0.0 — 7.0.0
- Replaces `bmm` module while keeping core skills

---

*For earlier history, see the upstream [BMAD-METHOD CHANGELOG](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/CHANGELOG.md).*