bmad-loop-setup deletes core BMAD config/manifest (_bmad/core/config.yaml, _bmad/_config/) in multi-module projects

[mswanson]

Summary

In a multi-module BMAD-METHOD project, running /bmad-loop-setup deletes core BMAD's live, manifest-tracked configuration — _bmad/core/config.yaml and the entire _bmad/_config/ manifest directory (manifest.yaml, files-manifest.csv, agent-manifest.csv, skill-manifest.csv, bmad-help.csv). This directly contradicts the README's claim that "Your standard BMAD install is never modified," and it leaves npx bmad-method install unable to compute safe upgrades (the file-hash manifest it depends on is gone).

Environment

• bmad-loop: v0.8.0 (installed via uv tool install)
• BMAD-METHOD core: 6.10.0, with modules core, bmm, tea, cis all installed (i.e. a normal multi-module project, not loop-only)
• IDE: claude-code

Steps to reproduce

1. Have a standard multi-module BMAD 6.10 project (_bmad/_config/manifest.yaml lists core/bmm/tea/cis; each module has its own _bmad/<module>/config.yaml, and _bmad/core/config.yaml is tracked with a content hash in _bmad/_config/files-manifest.csv).
2. Install the bmad-loop module and run /bmad-loop-setup.
3. The skill runs merge-config.py (consolidates per-module config into a central _bmad/config.yaml) and cleanup-legacy.py --module-code bmad-loop --also-remove _config --skills-dir .claude/skills.

Expected

bmad-loop's setup touches only bmad-loop's own artifacts. Core BMAD's _bmad/core/config.yaml and _bmad/_config/ manifest remain intact.

Actual

cleanup-legacy.py reports directories_removed: [bmad-loop, core, _config], and merge-config.py deletes _bmad/core/config.yaml. Core BMAD's manifest is destroyed.

Root cause (confirmed in source)

Both scripts in src/bmad_loop/data/skills/bmad-loop-setup/scripts/ hardcode core as a disposable "legacy installer" directory.

merge-config.py → cleanup_legacy_configs():

def cleanup_legacy_configs(legacy_dir, module_code, verbose=False):
    """Delete legacy config.yaml files for this module and core only."""
    for subdir in (module_code, "core"):        # "core" hardcoded, always deleted
        legacy_path = Path(legacy_dir) / subdir / "config.yaml"
        if legacy_path.exists():
            legacy_path.unlink()

cleanup-legacy.py → main():

dirs_to_remove = [module_code, "core"] + args.also_remove   # "core" hardcoded; SKILL passes --also-remove _config

The safety check verify_skills_installed() only guards directories that contain a SKILL.md; directories without one bypass it entirely and are shutil.rmtree'd unconditionally. SKILL.md documents this bypass as intended: "Directories without skills (like _config/) are removed directly." But _bmad/_config/ is not a stale installer artifact — it is core BMAD-METHOD's live manifest directory (written by tools/installer/core/manifest.js in bmad-code-org/BMAD-METHOD), and _bmad/core/config.yaml is a hashed, tracked file that other installed modules and the core installer rely on.

Note the inconsistency: _bmad/bmm/config.yaml (and tea/cis) survive, but core and --also-remove targets are hardcoded for deletion. The setup treats core as if it were the loop module's own scaffolding.

Impact

• Breaks future npx bmad-method install / upgrades (manifest gone → cannot compute the removal set / verify file hashes).
• Silently corrupts a shared install; the README's "never modified" guarantee is violated.
• We caught it only by inspecting the diff before committing; an unattended run would leave a broken BMAD install.

Suggested fix

1. Never delete _bmad/core/config.yaml or _bmad/_config/ when the project is a multi-module BMAD install — detectable via _bmad/_config/manifest.yaml listing modules other than bmad-loop, or the presence of _bmad/config.toml.
2. Don't hardcode "core" in the delete lists; only clean the module's own code.
3. Extend the cleanup safety check so non-skill directories require an explicit allowlist rather than being deleted by default.

Version / fix status

Confirmed present on main as of v0.8.0 (tagged 2026-07-03); no fix has landed since. No existing open/closed issue covers this (checked #61, #58, #51 and searched _config/manifest/cleanup/core).

[coderabbitai]

🔗 Related PRs

#53 - fix(adapters): complete dev sessions only on Stop or window death [merged]
#56 - chore(release): 0.8.0 [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!