Skip to content

feat: distribute CIS through the npx skills mechanism - #43

Draft
alexeyv wants to merge 9 commits into
mainfrom
feat/npx-skills-distribution
Draft

feat: distribute CIS through the npx skills mechanism#43
alexeyv wants to merge 9 commits into
mainfrom
feat/npx-skills-distribution

Conversation

@alexeyv

@alexeyv alexeyv commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

What

Moves the ten CIS skills to a repo-root skills/ tree and gives each a module-manifest.toml, so CIS installs and updates through npx skills as its own module.

Why

skills.sh has no path selector — it installs from {default branch root}/skills or not at all. The manifests make cis a module whose version and update source are independent of BMM, so the two need not share a release cadence.

How

  • git mv src/skills/* skills/; repoint the ten entries in .claude-plugin/marketplace.json. src/ keeps module.yaml and module-help.csv; the classic installer is untouched.
  • Add a byte-identical four-key manifest per skill. knowledge is the published llms.txt index rather than an in-repo routing doc: every entry in module-help.csv is phase=anytime with no predecessor or successor, so there is no order to narrate.

Testing

npm test clean. Rehearsed in a scratch project against real bmad scripts: bmad update reports cis, method, and toolbox as separate modules on separate versions, and a source-only bump flips cis alone to newer-available. bmad setup writes [modules.cis] leaving BMM answers intact.

Depends on

bmad-code-org/BMAD-METHOD@74f8698setup.py otherwise accepts only its own help doc as knowledge, and rejecting one manifest aborts the whole report.

Not yet here

CIS release stamper; migrating the ten skills off _bmad/cis/config.yaml.

The npx skills installer (skills.sh) has no path selector — it installs
from `{default branch root}/skills` or not at all. Move the ten CIS skill
folders to the repo root so the tree is distributable, and repoint the ten
`./src/skills/...` entries in the Claude plugin marketplace manifest.

`src/` keeps module.yaml and module-help.csv; classic-installer support is
unchanged.
Declares CIS as module `cis`, versioned and sourced independently of BMM.
Membership in a module is this file's `module` key on disk, so all ten copies
are byte-identical; setup.py rejects a module whose copies disagree.

`knowledge` is CIS's published llms.txt index rather than an in-repo document.
CIS has no process to describe — every entry in module-help.csv is
`phase=anytime` with no predecessor or successor — so a routing narrative like
the bmad skill's help.md would have nothing to sequence. The URL already chains
to llms-full.txt for complete docs.

Requires the companion change in BMAD-METHOD relaxing setup.py's
MANIFEST_KNOWLEDGE equality check to a non-empty string; the current constant
admits only the bmad skill's own help document.
@coderabbitai

coderabbitai Bot commented Aug 22, 2026

Copy link
Copy Markdown

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 662b794a-57b5-4815-8af0-ce2c0bc5a5cf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Ports tools/stamp_release.py and tools/release.md from BMAD-METHOD,
re-pointed at CIS: module "cis", update_source
github:bmad-code-org/cis-skills/skills, and CIS's own knowledge pointer.

The schema check stays strict - exactly four manifest keys, one known
module, one known update source and knowledge value - now that setup.py
is permissive. Version lines are rewritten textually so all ten
manifests stay byte-identical.

Build metadata is rejected: setup.py drops it when ordering, so
0.3.1+hotfix compares equal to 0.3.1 and a release stamped that way is
invisible to installed copies. BMAD-METHOD's stamper carries the same
rule, so the two do not drift.
The Load Config activation step in all ten CIS skills read
{project-root}/_bmad/cis/config.yaml, a module-era file the npx skills
install never creates. Replace it with the resolver BMAD skills use --
resolve_config.py --key core -- so user_name, communication_language,
document_output_language and output_folder come from the merged central
config layers.

Add the missing-script fallback from bmad-build: if the resolver is not
found the installation is not set up, so read the installed bmad skill's
SKILL.md and follow its setup flow before retrying. Any other failure, or
a value the config does not carry, falls back to neutral defaults rather
than blocking.
Both resolvers live in _bmad/scripts/, so a missing resolve_config.py
means resolve_customization.py was already missing three steps earlier.
Step 1 treated that as an ordinary failure and hand-merged the TOML
layers itself, so a skill ran persona adoption and prepend hooks against
a broken install before Step 4 announced the install was never set up.

Move the setup branch to Step 1, where it is first reachable, and demote
the manual merge to other failures. Step 4 keeps only the case that can
actually reach it -- a resolver that runs but yields nothing, i.e. a
missing or malformed config.toml.
Mirrors BMAD-METHOD 8afd1c32. The model already knows who it is talking
to and what language fits the conversation; answers frozen at install
time only mislead. BMad core stopped writing user_name,
communication_language, and document_output_language -- setup.py never
emits them and the setup tests assert they stay out of [core] -- so the
CIS skills were resolving three keys that no longer exist anywhere.

Greetings now read "Greet the user warmly as Sophia", matching the
post-refactor BMAD agents. Load Config stays in all ten skills, byte
identical, resolving output_folder alone. Templates keep {{user_name}}:
there it is an ordinary fill-in field the session already knows, not a
config lookup.
The classic module installer is gone under npx distribution. Nothing in
the repo reads this file: its one CIS-specific question, visual_tools,
was referenced by no prompt, and the core variables it documented
(user_name, communication_language, document_output_language,
output_folder) are either resolved from central config or dropped.
src/module-help.csv fed the classic installer's bmad-help catalog merge;
nothing reads it under npx, and it still advertised bmad-brainstorming as
a CIS skill, which this repo does not ship. Its deletion empties src/.

.claude-plugin/marketplace.json described the parallel Claude Code plugin
distribution: a second manifest hardcoding all ten skill paths and a
version that had already drifted from module-manifest.toml. No workflow
reads it. Skills now ship through the npx route alone.
Both were copied wholesale from BMAD-METHOD in 30da305 when CIS was
extracted into its own repo, and described a monorepo this repo has never
been. The ignore list named eleven paths with no counterpart here --
src/modules/*/sub-modules, test-project-install, sample-project,
tools/template-test-generator, test/fixtures, .bundler-temp among them --
and now covers only what .gitignore actually produces.

Sixteen devDependencies had no importer in tools/, website/, or either
lint config: the classic installer's CLI surface (figlet, ora,
wrap-ansi), its packaging and manifest readers (archiver, xml2js,
csv-parse, js-yaml, semver, glob, ignore), and jest plus c8 against a
repo whose npm test is lint and format only. The lockfile loses ~13k
lines.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant