Skip to content

feat: distribute CIS through the npx skills mechanism - #43

Closed
alexeyv wants to merge 9 commits into
mainfrom
feat/npx-skills-distribution
Closed

alexeyv wants to merge 9 commits into
mainfrom
feat/npx-skills-distribution

Conversation

@alexeyv

@alexeyv alexeyv commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

What

Moves the ten CIS skills to a repo-root skills/ tree and gives each a module-manifest.toml, so CIS installs and updates through npx skills as its own module.

Why

skills.sh has no path selector — it installs from {default branch root}/skills or not at all. The manifests make cis a module whose version and update source are independent of BMM, so the two need not share a release cadence.

How

  • git mv src/skills/* skills/; repoint the ten entries in .claude-plugin/marketplace.json. src/ keeps module.yaml and module-help.csv; the classic installer is untouched.
  • Add a byte-identical four-key manifest per skill. knowledge is the published llms.txt index rather than an in-repo routing doc: every entry in module-help.csv is phase=anytime with no predecessor or successor, so there is no order to narrate.

Testing

npm test clean. Rehearsed in a scratch project against real bmad scripts: bmad update reports cis, method, and toolbox as separate modules on separate versions, and a source-only bump flips cis alone to newer-available. bmad setup writes [modules.cis] leaving BMM answers intact.

Depends on

bmad-code-org/BMAD-METHOD@74f8698 — setup.py otherwise accepts only its own help doc as knowledge, and rejecting one manifest aborts the whole report.

Not yet here

CIS release stamper; migrating the ten skills off _bmad/cis/config.yaml.

The npx skills installer (skills.sh) has no path selector — it installs
from `{default branch root}/skills` or not at all. Move the ten CIS skill
folders to the repo root so the tree is distributable, and repoint the ten
`./src/skills/...` entries in the Claude plugin marketplace manifest.

`src/` keeps module.yaml and module-help.csv; classic-installer support is
unchanged.
Declares CIS as module `cis`, versioned and sourced independently of BMM.
Membership in a module is this file's `module` key on disk, so all ten copies
are byte-identical; setup.py rejects a module whose copies disagree.

`knowledge` is CIS's published llms.txt index rather than an in-repo document.
CIS has no process to describe — every entry in module-help.csv is
`phase=anytime` with no predecessor or successor — so a routing narrative like
the bmad skill's help.md would have nothing to sequence. The URL already chains
to llms-full.txt for complete docs.

Requires the companion change in BMAD-METHOD relaxing setup.py's
MANIFEST_KNOWLEDGE equality check to a non-empty string; the current constant
admits only the bmad skill's own help document.
@coderabbitai

coderabbitai Bot commented Aug 22, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 662b794a-57b5-4815-8af0-ce2c0bc5a5cf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Ports tools/stamp_release.py and tools/release.md from BMAD-METHOD,
re-pointed at CIS: module "cis", update_source
github:bmad-code-org/cis-skills/skills, and CIS's own knowledge pointer.

The schema check stays strict - exactly four manifest keys, one known
module, one known update source and knowledge value - now that setup.py
is permissive. Version lines are rewritten textually so all ten
manifests stay byte-identical.

Build metadata is rejected: setup.py drops it when ordering, so
0.3.1+hotfix compares equal to 0.3.1 and a release stamped that way is
invisible to installed copies. BMAD-METHOD's stamper carries the same
rule, so the two do not drift.
The Load Config activation step in all ten CIS skills read
{project-root}/_bmad/cis/config.yaml, a module-era file the npx skills
install never creates. Replace it with the resolver BMAD skills use --
resolve_config.py --key core -- so user_name, communication_language,
document_output_language and output_folder come from the merged central
config layers.

Add the missing-script fallback from bmad-build: if the resolver is not
found the installation is not set up, so read the installed bmad skill's
SKILL.md and follow its setup flow before retrying. Any other failure, or
a value the config does not carry, falls back to neutral defaults rather
than blocking.
Both resolvers live in _bmad/scripts/, so a missing resolve_config.py
means resolve_customization.py was already missing three steps earlier.
Step 1 treated that as an ordinary failure and hand-merged the TOML
layers itself, so a skill ran persona adoption and prepend hooks against
a broken install before Step 4 announced the install was never set up.

Move the setup branch to Step 1, where it is first reachable, and demote
the manual merge to other failures. Step 4 keeps only the case that can
actually reach it -- a resolver that runs but yields nothing, i.e. a
missing or malformed config.toml.
Mirrors BMAD-METHOD 8afd1c32. The model already knows who it is talking
to and what language fits the conversation; answers frozen at install
time only mislead. BMad core stopped writing user_name,
communication_language, and document_output_language -- setup.py never
emits them and the setup tests assert they stay out of [core] -- so the
CIS skills were resolving three keys that no longer exist anywhere.

Greetings now read "Greet the user warmly as Sophia", matching the
post-refactor BMAD agents. Load Config stays in all ten skills, byte
identical, resolving output_folder alone. Templates keep {{user_name}}:
there it is an ordinary fill-in field the session already knows, not a
config lookup.
The classic module installer is gone under npx distribution. Nothing in
the repo reads this file: its one CIS-specific question, visual_tools,
was referenced by no prompt, and the core variables it documented
(user_name, communication_language, document_output_language,
output_folder) are either resolved from central config or dropped.
src/module-help.csv fed the classic installer's bmad-help catalog merge;
nothing reads it under npx, and it still advertised bmad-brainstorming as
a CIS skill, which this repo does not ship. Its deletion empties src/.

.claude-plugin/marketplace.json described the parallel Claude Code plugin
distribution: a second manifest hardcoding all ten skill paths and a
version that had already drifted from module-manifest.toml. No workflow
reads it. Skills now ship through the npx route alone.
Both were copied wholesale from BMAD-METHOD in 30da305 when CIS was
extracted into its own repo, and described a monorepo this repo has never
been. The ignore list named eleven paths with no counterpart here --
src/modules/*/sub-modules, test-project-install, sample-project,
tools/template-test-generator, test/fixtures, .bundler-temp among them --
and now covers only what .gitignore actually produces.

Sixteen devDependencies had no importer in tools/, website/, or either
lint config: the classic installer's CLI surface (figlet, ora,
wrap-ansi), its packaging and manifest readers (archiver, xml2js,
csv-parse, js-yaml, semver, glob, ignore), and jest plus c8 against a
repo whose npm test is lint and format only. The lockfile loses ~13k
lines.
bmadcode added a commit that referenced this pull request Sep 19, 2026
* feat: distribute CIS as plain skills through npx skills

CIS becomes a module that installs and updates through `npx skills`, with no
installer. This includes the work from #43, rebased onto main, plus the
module help, roster, and dependency declarations that followed it.

Layout
- Move the ten skills from src/skills/ to a repo-root skills/ tree, which is
  the only place `npx skills` installs from.
- Delete src/module.yaml, src/module-help.csv and the plugin marketplace
  manifest. Nothing reads them on the new path.
- Prune eslint ignores and sixteen devDependencies inherited from
  BMAD-METHOD that had no counterpart or importer here.

Manifests
- Every skill carries module-manifest.toml: module, version, update_source,
  knowledge, roster, requires and recommends.
- Every skill requires the bmad hub skill 6.13.0 or later.
- Every skill recommends bmad-advanced-elicitation, bmad-customize,
  bmad-forge-idea and bmad-party-mode. Personas also recommend the skill
  behind their menu.

Help and roster live in the skills
- knowledge was a link to the docs site llms.txt, so help had nothing local
  to read. It is now a list of documents each skill carries:
  bmad-meta/cis-help.md in all ten skills, bmad-meta/agents-help.md in the
  six personas. The content replaces what module-help.csv held.
- bmad-meta/cis-roster.toml, named by the new roster key, holds what
  module.yaml's agents list held: the six personas as party members, four
  guest members, and two groups (creative-studio, midnight-salon). It uses
  the fields bmad-party-mode already uses. Party mode does not read it yet.
- These files are edited once in bmad-meta/ at the repo root.
  tools/sync_knowledge.py copies each into the skills whose manifests name
  it, under any key, and removes a shared copy a manifest stops naming.
  npm test fails when the copies drift or a roster group names a member
  nobody defines.

Skills
- Resolve central config through _bmad/scripts/resolve_config.py instead of
  the module-era _bmad/cis/config.yaml.
- When the resolver script is missing, offer the bmad skill's setup,
  installing bmad first when the agent has no such skill. Personas offer to
  install a menu skill that is not present.
- Drop user name and language config from skill prose.

Release tooling
- tools/stamp_release.py writes a version into every manifest and
  tools/release.md is the runbook. The stamper validates knowledge and
  roster files, requires and recommends entries, and accepts manifest keys
  it does not know, since the runtime ignores them. Only the top-level
  version line is rewritten, and the stamp fails if anything else changed.

Still open: update_source points at the cis-skills mirror repository.

Co-authored-by: Alex Verkhovsky <alexey.verkhovsky@gmail.com>

* chore(release): release from this repository with a dev branch

The cis-skills mirror is being removed. update_source now names this
repository in every manifest and in the stamper.

tools/release.md follows the BMAD-METHOD procedure: dev receives PRs, main
is release-only and is what npx skills installs, and a release
fast-forwards main to a stamped commit on dev and tags it.

* chore: remove the npm release workflow and version field

Releases are now a stamped commit promoted from dev to main, so the workflow
that ran npm version and pushed to main can no longer be used, and would
break main staying an ancestor of dev. package.json loses its release
scripts, publishConfig, empty main and bin, and its version: the manifests
are the only version source.

* chore: set the placeholder to 0.4.0-next and check bmad-meta copies in CI

- README installs CIS with npx skills and names the real skills; the old
  installer command and /cis-* commands no longer exist.
- quality.yaml runs tools/sync_knowledge.py, which until now only ran in the
  local hook, so a PR with stale bmad-meta copies can no longer merge.
- 0.3.2 is already released, so the placeholder becomes 0.4.0-next and
  personas recommend their menu skill at 0.4.0.

---------

Co-authored-by: Alex Verkhovsky <alexey.verkhovsky@gmail.com>
@alexeyv alexeyv closed this Sep 19, 2026
bmadcode added a commit that referenced this pull request Sep 21, 2026
* feat: distribute CIS as plain skills through npx skills (#45)

* feat: distribute CIS as plain skills through npx skills

CIS becomes a module that installs and updates through `npx skills`, with no
installer. This includes the work from #43, rebased onto main, plus the
module help, roster, and dependency declarations that followed it.

Layout
- Move the ten skills from src/skills/ to a repo-root skills/ tree, which is
  the only place `npx skills` installs from.
- Delete src/module.yaml, src/module-help.csv and the plugin marketplace
  manifest. Nothing reads them on the new path.
- Prune eslint ignores and sixteen devDependencies inherited from
  BMAD-METHOD that had no counterpart or importer here.

Manifests
- Every skill carries module-manifest.toml: module, version, update_source,
  knowledge, roster, requires and recommends.
- Every skill requires the bmad hub skill 6.13.0 or later.
- Every skill recommends bmad-advanced-elicitation, bmad-customize,
  bmad-forge-idea and bmad-party-mode. Personas also recommend the skill
  behind their menu.

Help and roster live in the skills
- knowledge was a link to the docs site llms.txt, so help had nothing local
  to read. It is now a list of documents each skill carries:
  bmad-meta/cis-help.md in all ten skills, bmad-meta/agents-help.md in the
  six personas. The content replaces what module-help.csv held.
- bmad-meta/cis-roster.toml, named by the new roster key, holds what
  module.yaml's agents list held: the six personas as party members, four
  guest members, and two groups (creative-studio, midnight-salon). It uses
  the fields bmad-party-mode already uses. Party mode does not read it yet.
- These files are edited once in bmad-meta/ at the repo root.
  tools/sync_knowledge.py copies each into the skills whose manifests name
  it, under any key, and removes a shared copy a manifest stops naming.
  npm test fails when the copies drift or a roster group names a member
  nobody defines.

Skills
- Resolve central config through _bmad/scripts/resolve_config.py instead of
  the module-era _bmad/cis/config.yaml.
- When the resolver script is missing, offer the bmad skill's setup,
  installing bmad first when the agent has no such skill. Personas offer to
  install a menu skill that is not present.
- Drop user name and language config from skill prose.

Release tooling
- tools/stamp_release.py writes a version into every manifest and
  tools/release.md is the runbook. The stamper validates knowledge and
  roster files, requires and recommends entries, and accepts manifest keys
  it does not know, since the runtime ignores them. Only the top-level
  version line is rewritten, and the stamp fails if anything else changed.

Still open: update_source points at the cis-skills mirror repository.

Co-authored-by: Alex Verkhovsky <alexey.verkhovsky@gmail.com>

* chore(release): release from this repository with a dev branch

The cis-skills mirror is being removed. update_source now names this
repository in every manifest and in the stamper.

tools/release.md follows the BMAD-METHOD procedure: dev receives PRs, main
is release-only and is what npx skills installs, and a release
fast-forwards main to a stamped commit on dev and tags it.

* chore: remove the npm release workflow and version field

Releases are now a stamped commit promoted from dev to main, so the workflow
that ran npm version and pushed to main can no longer be used, and would
break main staying an ancestor of dev. package.json loses its release
scripts, publishConfig, empty main and bin, and its version: the manifests
are the only version source.

* chore: set the placeholder to 0.4.0-next and check bmad-meta copies in CI

- README installs CIS with npx skills and names the real skills; the old
  installer command and /cis-* commands no longer exist.
- quality.yaml runs tools/sync_knowledge.py, which until now only ran in the
  local hook, so a PR with stale bmad-meta copies can no longer merge.
- 0.3.2 is already released, so the placeholder becomes 0.4.0-next and
  personas recommend their menu skill at 0.4.0.

---------

Co-authored-by: Alex Verkhovsky <alexey.verkhovsky@gmail.com>

* feat!: replace per-skill module metadata with a bmod module record (#47)

* feat!: replace per-skill module metadata with a bmod module record

The module is now one folder, skills/bmod-cis, holding bmod.toml, a stub SKILL.md, help/help.md with three topic files, and roster.toml. Each member skill carries a bmod.toml with a [skill] table. The root bmad-meta folder, its 26 per-skill copies, the ten module-manifest.toml files and tools/sync_knowledge.py are removed.

- help.md leads with the six agents, then the four sessions with what each works through and writes. It no longer points at the documentation site, which is out of date.
- bmad-brainstorming is recommended by the module and is on the menus of Maya, Dr. Quinn and Victor as well as Carson, who no longer requires it.
- Caravaggio's menu drops the Excalidraw wording and goes from seven prompts to four: plan (PL), critique (CR), video explainer (EX), visual (VM).
- Storytelling offers all 25 frameworks in its library instead of a fixed ten, and reads the key_questions column the file actually has.
- Session documents are named <stem>-{topic_slug}-{date}.md and a session never overwrites an earlier one.
- Sessions read a document the user names instead of a "data attribute".
- Agents hand off to the bmad skill instead of bmad-help.
- tools/stamp_release.py stamps the [bmod] version and has a --check mode that npm test runs. CI also runs BMAD-METHOD's validate_manifests.py against this repository.

BREAKING CHANGE: module-manifest.toml and bmad-meta are gone; installs need bmod-cis and bmad 6.13.0. Caravaggio's menu codes SD, PD, CT, IN and CV are removed. Session output file names now include the topic.

* fix: check a stamp before writing, require a source on table dependencies, and handle a missing pause skill

- stamp_release.py compares each stamped file with what it should be before anything is written, so a bad stamp never reaches disk.
- A table-form required or recommended skill must give a source, as the runtime requires. Only a plain name of a skill in this repository goes without one.
- The four sessions say so and offer the install command when the user picks advanced elicitation or party mode and that skill is not installed.
- The help no longer says a persona's name and title can be customized.

---------

Co-authored-by: Alex Verkhovsky <alexey.verkhovsky@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant