Integrate upstream github/spec-kit v0.15.0 (#98) - #99
Merged
Conversation
* chore: bump version to 0.12.17 * chore: begin 0.12.18.dev0 development --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Update docguard extension submitted by @raccioly: - extensions/catalog.community.json (version, download_url, description, updated_at) - docs/community/extensions.md community extensions table Closes github#3556 Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add Dotdog extension to community catalog Add dotdog extension submitted by @logohere to: - extensions/catalog.community.json (alphabetical order) - docs/community/extensions.md community extensions table Closes github#3555 Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(catalog): alphabetize dotdog entry and correct tool requirement Assisted-by: GitHub Copilot (model: claude-opus-4.8, autonomous) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* docs: refresh landing page ecosystem stats Update stale numbers in docs/index.md to match current catalogs on upstream/main and live GitHub data: extensions 105->138, presets 22->25, integrations 30+->35, contributors 200+->240+, friends 4->6, GitHub stars 106K+->121K+, extension authors 60+->70+, and the last-updated date. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e5f34221-4e6c-42e8-9fa3-5cfbc26104d1 * docs: align community extension stats on overview page Update docs/community/overview.md from "Over 90 ... 50+ authors" to "Over 130 ... 70+ authors" so it matches the refreshed landing-page numbers in docs/index.md (137 community extensions, 77 unique authors). Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 134166d9-e599-44fa-a88d-daf84ab6aca6 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* docs: document extesnion.yml hook confriguration * docs: address hook confriguration review feedback * clarify auto execute hooks behavior * docs: clarify hook priority and condition behavior
…lkthroughs (github#3565) * docs: reframe SDD positioning, modernize install, and de-duplicate walkthroughs Reframe the landing page so Spec Kit reads as a toolkit for Spec-Driven Development *or your own process* with any AI coding agent, and correct stale claims: context files and git are now opt-in extensions, and the install path uses PyPI (specify-cli). Generalize the landing cards to cover bundles and catalog hosting across all primitives. Restructure the Quick Start into a lean, guided Taskify walkthrough with one command per step (install as a prerequisite, Steps 1-9 aligned with the Full path), and extract the deep per-command detail into two new reference pages: reference/agentic-sdd.md (the /speckit.* SDD process) and reference/agentic-bugfix.md (the bug extension). Retitle the reference overview to "Reference" and group these agentic processes in their own section, distinct from CLI-managed primitives. Remove the duplicated "Detailed Process" walkthrough from README.md (and its TOC entry), repointing readers to the docs-site Quick Start while keeping the concise "Get Started" section as the front door. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9d9232f8-ece4-4aa6-a9bd-ff8d74ca1c89 * docs: address review feedback on accuracy and scope - quickstart: correct the git/feature note — resolution reads .specify/feature.json / SPECIFY_FEATURE, not the checked-out branch, so switching branches alone does not switch the active feature. - quickstart + agentic-sdd: add an invocation-style note ($speckit-* for Codex/ZCode, /skill:speckit-* for Kimi) so the agent-neutral commands are executable everywhere. - agentic-sdd: fix the tasks phase structure to match the generator (Setup, Foundational, one phase per user story, final Polish; tests optional within user-story phases). - index: soften the catalog claim (catalogs curate discovery, not an install allow-list) and relabel the "CLI reference" link to "Reference" to match the retitled, broader page. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9d9232f8-ece4-4aa6-a9bd-ff8d74ca1c89 * docs: correct feature-resolution override and add bug-command invocation note - quickstart: the previous fix named the wrong override. The active feature *directory* resolves from SPECIFY_FEATURE_DIRECTORY then .specify/feature.json; SPECIFY_FEATURE only supplies the identifier after a directory is resolved. Rewrite the note to point users at .specify/feature.json / SPECIFY_FEATURE_DIRECTORY, and clarify the git extension's branches don't by themselves change the active feature. - agentic-bugfix: add the same invocation-style caveat as the SDD reference ($speckit-bug-* for Codex/ZCode, /skill:speckit-bug-* for Kimi). Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9d9232f8-ece4-4aa6-a9bd-ff8d74ca1c89 * docs: tighten bug-command contracts and drop numbered-phase examples - agentic-bugfix: don't overstate overwrite protection — an interactive run can overwrite an existing assessment after confirmation; only automated mode refuses and picks a new slug. Correct the verify verdict to the schema's verified/partial/failed (not-run is a per-check status); an unexercised reproduction downgrades the result to partial. - agentic-sdd: the implement examples labeled scoping "Phase 1/2", but the tasks contract reserves Phase 1 for Setup and Phase 2 for Foundational (user stories start at Phase 3). Scope by phase name and user-story content instead to avoid mis-scoping execution. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9d9232f8-ece4-4aa6-a9bd-ff8d74ca1c89 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Reframe the docs landing hero and "Make it your own" pillar to inject the "harness" and "SDLC" framing while keeping SDD front and center: - Hero: describe Spec Kit as an extensible, intent-driven harness that pushes any coding agent beyond code, across the SDLC or any business process; tagline now contrasts step-by-step vs automated-workflow runs. - "Make it your own": explain the process lives in swappable building blocks (not locked to SDD or even software) and add a real non-software preset (Fiction Book Writing) to back the broadened scope. - Community blurb: drop "development" so "entirely new processes" matches the wider positioning. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Copilot-Session: 1cf71797-ac0d-4a5e-8266-784906933b54 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/stale](https://github.com/actions/stale) from 10.3.0 to 10.4.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@eb5cf3a...1e223db) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.4.0 to 6.0.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@26b0ec1...a98b568) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore: bump version to 0.12.18 * chore: begin 0.12.19.dev0 development --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…ub#3581) Match the README hero tagline to the docs landing hero and rewrite the subtitle to reflect the four-pillar positioning (ready-to-use spec-driven process or bring your own, extensible, community-driven, org-ready) rather than framing everything around SDD. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Copilot-Session: da32794c-5044-406c-9338-12b3ffab49f4 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…thub#3571) * chore(deps): bump github/codeql-action/init from 4.36.2 to 4.37.1 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.2 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...7188fc3) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action/analyze to 4.37.1 Bump the analyze step to match the init step (both now 7188fc3 / v4.37.1). Dependabot bumped only init, leaving analyze on 4.36.2, which caused CodeQL to fail with "Loaded a configuration file for version '4.37.1', but running version '4.36.2'". Both steps must reference the same release. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mnriem <mnriem@users.noreply.github.com>
…formed catalog URL (github#3576) `PresetCatalog._validate_catalog_url` called `urlparse(url).hostname` without guarding it. For a malformed authority such as an unterminated IPv6 bracket (`https://[::1`), `urlparse(...).hostname` raises `ValueError: Invalid IPv6 URL`, which escapes the method. Its docstring promises `PresetValidationError`, and its callers (`preset catalog add`, `preset catalog list` reading the `SPECKIT_PRESET_CATALOG_URL` env var / `.specify/preset-catalogs.yml`) only catch `PresetValidationError` -- so a malformed URL crashes the CLI with a traceback instead of a clean error message. The shared `CatalogStackBase` (github#3435), `workflows` (github#3484), `bundler` (github#3433) and `IntegrationCatalog` copies already wrap this in `try/except ValueError`; the preset validator was the remaining un-updated twin. Mirror the shared implementation: wrap `urlparse` + `.hostname`, re-raise as `PresetValidationError("Catalog URL is malformed: ...")`, and read the local `hostname` in the host check. Add a regression test mirroring `IntegrationCatalog`'s `test_malformed_url_rejected_cleanly`; it is red before the fix (raw `ValueError`) and green after. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: root <kinsonnee@gmail.com>
Update autonomous-run-governance preset submitted by @hindermath to: - presets/catalog.community.json (version, download_url, documentation, provides, tags, updated_at) - docs/community/presets.md community presets table Closes github#3569 Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…thub#3585) Add okf extension submitted by @alexcpn to: - extensions/catalog.community.json (alphabetical order) - docs/community/extensions.md community extensions table Closes github#3580 Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…oad URL (github#3586) `_download_manifest` and its `_require_https` helper parsed the catalog entry's `download_url` with an unguarded `urlparse(url)`. A malformed authority — e.g. an unclosed IPv6 bracket like `https://[::1` — makes `urlparse` (or `.hostname` on older Pythons) raise a raw `ValueError`. The three `bundle` CLI commands (`info`, `install`, `update`) only catch `BundlerError`, so that `ValueError` escaped as an uncaught traceback. Wrap both parse sites in the same `try/except ValueError -> BundlerError` guard already used by the sibling `_validate_remote_url` (and established by the merged catalog-URL fix github#3576), so a bad `download_url` reports a clean, actionable error in every mode. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ub#3568) * feat(extensions): add assess idea assessment pipeline extension Add a role-neutral, opt-in "Idea Assessment Pipeline" extension (id: assess) covering the discovery work that happens BEFORE spec-driven development. It provides a five-stage funnel: intake, research, define, shape, decide, each writing one artifact under .specify/assessments/<slug>/. A go verdict hands off to /speckit.specify; killing an idea is a first-class success outcome. Registration: - extensions/catalog.json: bundled core opt-in entry (before bug) - pyproject.toml: force-include maps into core_pack so it ships in the installed wheel (verified via wheel build) Also normalizes a Rich-wrapped substring assertion in test_workflows.py so the suite passes at CI's 80-column non-TTY width. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * fix(extensions): address PR review on assess extension Resolve review feedback on github#3568: - catalog.json: bump top-level updated_at to this revision (2026-07-17) - extension.yml + catalog.json: shorten the assess description to under the documented 200-char manifest limit (kept aligned across both) - extension.yml: make the before_specify hook prompt condition-neutral (it fires on every /speckit.specify, so it must not claim "no assessment found") - intake.md: fix slug normalization to explicitly allow lowercase letters a-z (the old rule permitted only digits and '-', contradicting the offline-mode example) - intake.md + research.md: require a sanitized source URL (strip userinfo and credential/signature query params) instead of persisting a verbatim URL that could leak secrets into project artifacts - decide.md: remove the "trivially small" exception so a go always requires a shaped concept, making verdict behavior deterministic and consistent with the guardrails and README Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * refactor(extensions): remove before_specify hook from assess Assess is a separate business process from spec-driven development, so it should not inject itself into the /speckit.specify lifecycle. The hook fired on every /speckit.specify invocation (it had no condition), nagging even when an assessment already existed and the user was deliberately proceeding. Unlike git's before_specify (a mechanical prerequisite: create a feature branch) or agent-context's after_* hooks (reacting to spec output), assess is an upstream, optional, human-judgment process. The coupling that belongs here already runs forward and by choice: a `go` verdict from /speckit.assess.decide hands off to /speckit.specify. The backward hook was the redundant, intrusive direction. - extension.yml: drop the hooks block (commands-only manifest) - README.md: replace the Hooks section with a Handoff section - test: replace the hook assertion with test_declares_no_hooks to lock in the standalone-pipeline design Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * fix(extensions): harden assess slug handling and clarify verdict logic Address the second review round on github#3568: - Slug path traversal: intake and all four downstream commands (research, define, shape, decide) now normalize an explicit or user-supplied slug to the [a-z0-9-] alphabet (dropping '.', '/', '\\') and reject an empty normalized result before constructing ASSESS_DIR. This guarantees a slug like `../..` cannot escape .specify/assessments/. - Metadata accuracy: the extension.yml and catalog.json descriptions no longer imply a "build/kill" call is handed to /speckit.specify — only a `go` hands off; a `kill` closes the assessment. - Verdict determinism (decide): a `go` now explicitly requires evidence strength `adequate`+ (never weak/unknown), resolving the conflict with the thin-evidence guardrail. - Risk polarity (decide): renamed the "Risk" criterion to "Risk posture" with positive polarity (strong = risks understood and mitigated) so it composes with the other scores that feed the verdict. - README: aligned the go-threshold guardrail with the evidence rule and documented the slug-normalization safety property. The PR description was also updated to drop the stale before_specify hook claim (the hook was removed in the previous commit). Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * fix(extensions): add symlink/realpath containment and pin research host allowlist Address the third review round on github#3568: - Path safety (intake, research, define, shape, decide): slug normalization blocks lexical `..` but not symlinked path components. Each command now, before any mkdir/read/write, resolves the real path of .specify/assessments/<slug>/ and every artifact, refuses to follow a symlinked .specify / assessments / slug dir / artifact, and verifies the resolved path stays inside the project root. This blocks a cloned or crafted project from redirecting reads/writes outside the repository. Each stage enforces this independently since research/define/decide can run without intake. - research URL policy: replaced the open-ended "and comparable well-known hosts" no-prompt branch with intake's exact enumerated allowlist, so an agent cannot classify an attacker-controlled host as "comparable" and fetch it without confirmation. - README: guardrail now documents symlink/realpath containment. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * fix(extensions): redact secrets in captured idea and stop on explicit-slug collision Address the fourth review round on github#3568 (intake): - Secret leak in the captured idea: quoting the original "verbatim" contradicted the URL sanitization rule when the idea itself contained a credential-bearing URL. Capture now redacts secrets (sanitize URLs; strip tokens, passwords, keys, cookies) inside the quoted text as well as the Source field, and the section heading is "Idea (as captured)" rather than "verbatim". - Explicit-slug collision: in automated mode an existing intake.md caused a silent switch to a new slug, contradicting the no-suffix guarantee for user-provided slugs. Now: user-provided slug collision -> stop and report; only a self-generated slug (already disambiguated at resolution) is re-slugged. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * fix(extensions): reject IPv6 private ranges and DNS-rebinding in URL policy Address the remaining open comment from review 4722852090 on github#3568 (the other six comments in that round were already resolved by the slug-validation and host-allowlist fixes in 9cd07fb and c032a2e). The URL Trust Policy refused only textual IPv4 loopback/RFC1918/metadata hosts, so an approved hostname resolving to an internal IPv6 or IPv4-mapped address could still reach internal services. The refuse- outright list now covers IPv6 link-local (fe80::/10), unique-local (fc00::/7), IPv4-mapped forms, and the IPv6 metadata address, and adds a resolution-time check: even an allowlisted or user-confirmed host is refused when it resolves to any non-public address, defeating DNS rebinding. Mirrored the summary in research's inherited-policy note. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * fix(extensions): pin connection vs DNS rebinding and gate slug-only direct entry Address the fifth review round on github#3568: - DNS rebinding (intake + research): a standalone DNS lookup does not defeat rebinding because the fetch client can re-resolve or pick a private address from a mixed answer. The policy now requires the fetch to pin the connection to a validated public address (or verify the connected peer) and re-apply the refusal ranges to the address actually connected to; if the fetch mechanism cannot pin or expose the peer, the fetch is refused rather than trusted by hostname. - Slug-only direct entry (research + define): when intake/research artifacts are absent and $ARGUMENTS carries only a slug, the commands no longer infer an idea/problem from the slug. They now require substantive idea/problem text and otherwise prompt (interactive) or stop (automated). - Cleaned up a leftover duplicate ASSESS_DIR assignment line in research. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * fix(extensions): allow read-only source inspection in intake guardrail Address the sixth review round on github#3568. The intake guardrail said the command "only reads and writes inside .specify/assessments/<slug>/", which contradicts its documented inputs: intake must read a codebase pointer (repository inspection) and fetch an allowed URL to capture the idea. The guardrail now limits only *writes* to the assessment directory and explicitly permits read-only inspection of the supplied sources (repo + allowlisted URL fetch under the URL Trust Policy). The other four commands already phrased this correctly ("read only, and write inside ...") and are unchanged. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * Harden assess commands: ancestor path safety, untrusted-artifact reads, research dir creation Addresses review 4723905370 on PR github#3568 across three themes: - Ancestor path safety: verify `.specify` and `.specify/assessments` are real directories (not symlinks) resolving inside the project root before any filesystem-based slug resolution, in all five commands. - Untrusted artifact reads: treat the contents of persisted assessment artifacts (intake/research/problem/concept) as untrusted data, not instructions — ignore embedded directives, mirroring the URL Trust Policy. - research now ensures the validated ASSESS_DIR exists before writing, since it may be the first assessment command run. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * Allow absent assessment dir in ancestor path-safety check Addresses review 4723955260 on PR github#3568. The ancestor path-safety clause required `.specify/assessments` to already be a real directory, which blocked the first-run commands (intake, research, define) from ever reaching the step that creates it. Reword the clause in all five commands so a not-yet-created directory is permitted, while still refusing when `.specify` or `.specify/assessments` exists as a symlink or escapes the project root. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * Fix README diagram: needs-clarification revisits the named earlier stage Addresses review 4724027270 on PR github#3568. The overview flowchart routed every needs-clarification verdict back to research, but decide.md's Revisit stage can send an idea back to intake, research, define, or shape. Reroute the arrow as a generic loop back to the earlier stages so the diagram no longer misstates the pipeline. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a * Make decide handoff integration-neutral (no hard-coded dot-style) Addresses review 4724080304 on PR github#3568: - decide.md frontmatter description hard-coded `/speckit.specify`. Frontmatter is parsed before command-reference resolution, so it now uses agent-neutral wording ("hand survivors off into Spec-Driven Development") instead of a dot-style literal that would be wrong for non-dot integrations. - The `## If go — Handoff to …` heading inside the decision.md output template hard-coded `/speckit.specify`, which would be written verbatim into decision.md. It now uses the `__SPECKIT_COMMAND_SPECIFY__` placeholder, like the rest of the command, so the active integration's invocation style is rendered. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1f25cf9d-b7eb-4b2b-b811-3e91d8db8f6a --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…codable output (github#3527) _acquire_via_az_cli runs 'az account get-access-token' with text=True, so subprocess.run decodes stdout with the locale encoding and raises UnicodeDecodeError (a ValueError sibling, NOT a JSONDecodeError) when the output can't be decoded. That escaped the except (OSError, TimeoutExpired, JSONDecodeError, KeyError) tuple and crashed a helper whose contract is to return str | None. Add UnicodeDecodeError to the tuple. Test patches subprocess.run to raise UnicodeDecodeError and asserts resolve_token returns None (fails before: the error propagated). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: bump version to 0.13.0 * chore: begin 0.13.1.dev0 development --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…ions (github#3529) Forge installs its slash-commands with hyphenated names (speckit-foo-bar, via format_forge_command_name and the injected frontmatter name), but ForgeIntegration inherited MarkdownIntegration.build_command_invocation, which builds the dotted /speckit.<cmd>. So 'workflow'/command dispatch invoked /speckit.plan while the registered command is /speckit-plan — a name Forge never registered. Override build_command_invocation to reuse format_forge_command_name, producing /speckit-<name> (with '.'-to-'-' for extension commands), mirroring the skills agents' hyphenated invocation. Tests assert Forge core + extension invocations are hyphenated, incl. args (fail before: dotted /speckit.plan / /speckit.git.commit). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ub#3520) * fix(workflows): route 'workflow status --json' errors to stderr The workflow_status run_id error paths (FileNotFoundError -> 'Run not found', ValueError -> invalid run) used the stdout console and fired before the json_output branch, so 'specify workflow status <bad-id> --json' wrote a Rich-rendered error to stdout and corrupted the JSON stream a consumer would json.loads(). Route both through _error_console(json_output) so they go to stderr under --json, matching the sibling 'workflow run'/'workflow resume' commands (which use the identical RunState.load try/except) and the documented stdout-purity contract. Test asserts the not-found error appears on stderr and stdout stays empty under --json (fails before: the error was on stdout). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(workflows): cover the ValueError handler in workflow status --json purity The stderr-routing fix reroutes both the FileNotFoundError and ValueError run_id handlers, but the test only exercised FileNotFoundError — a regression of the ValueError path back to stdout would have gone uncaught. Add a ValueError case (RunState.load raising) asserting the same stderr-only / empty-stdout behavior. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ithub#3582) `PromptStep.execute` str()-coerces `config['prompt']` and dispatches the result to the integration CLI as the model's instructions. But its `validate` only checked that `prompt` was *present*, not that it was a string — the exact parity gap the sibling `ShellStep` closes for `run`. So a YAML authoring slip like `prompt: [review, this]` or `prompt:` (null) passed validation, then `execute` sent the Python repr (`"['review', 'this']"`, `"None"`) to the LLM verbatim — silently wrong instructions with no error and a COMPLETED status. The engine does not auto-validate step config (`load_workflow` explicitly defers validation), so validation is the only place this surfaces before dispatch. Extend `validate` to reject any non-string `prompt` with the shell-step's phrasing ("'prompt' must be a string, got <type>"), mirroring the shell `run` and command `input`/`options` type checks. A `{{ ... }}` expression is still a str, so it stays valid. Adds regression coverage for non-string prompts (null/list/int/dict) and confirms an expression prompt still validates. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…late (github#3537) * fix(workflows): fail fan-out loudly on a truthy non-mapping step template A fan-out step whose `step:` is a truthy scalar or list (an authoring mistake) passed execute and reached the engine, which calls template.get("id", ...) in _run_fan_out — raising AttributeError and taking down the whole run. validate already rejects a non-mapping step, but the engine does not auto-validate, so an unvalidated run crashed. Guard execute to FAIL the step (with a clear error and normalized empty output) instead, mirroring the existing non-list items guard and the switch non-dict cases guard. Add the matching test_execute_non_dict_step_fails_loudly covering the execute-path guard (validate was already covered). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(workflows): reject explicit fan-out `step: null` in validate() The runtime guard in execute() rejects a truthy non-mapping step, but `config.get("step", {})` only substitutes the `{}` default for an *absent* key — an explicit `step: null` reaches the guard as None and FAILS the step. validate() previously exempted None (`step is not None and ...`), so such a workflow passed validation and then failed during execution. Align validate() with the runtime guard: a present-but-non-mapping `step` (including `None`) is an authoring mistake and is now rejected up front. Extend the validate and execute regression cases to cover None. Addresses Copilot review feedback on github#3537. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…thub#3579) `FanInStep.execute` already guards a non-list `wait_for` (github#3482), and the engine's load-time validation rejects non-string entries. But the engine does not auto-validate step config, so on an unvalidated run `execute` iterated the list's *elements* raw: - An unhashable entry (a list/dict from a YAML indentation slip like `wait_for: [[a, b]]`) crashed the whole run at `context.steps.get(entry, ...)` with a raw `TypeError: cannot use 'list' as a dict key`. - A hashable-but-non-string entry (`wait_for: [123]`) silently joined an empty `{}` and still reported COMPLETED — the exact "silent empty result + COMPLETED" wiring bug the whole-list guard and the engine's fan-in validation both exist to prevent. Extend the execute() guard to reject any non-string entry with the engine's "entries must be step-id strings" phrasing, mirroring the sibling non-list guard right above it. Adds regression coverage for unhashable and hashable-non-string entries. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ithub#3530) * docs(integrations): document the 'integration list --catalog' flag 'specify integration list' accepts a --catalog flag (integrations/_query_commands.py: typer.Option(False, "--catalog", ...)) that browses the full built-in + community catalog, but the Integrations reference documented no options for the list command. Add an option table for it, matching the style used by the sibling 'integration search' and 'integration catalog add' sections. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(integrations): clarify that default 'integration list' shows only built-ins The --catalog row implied the default list already includes the full installed set; in fact 'integration list' iterates INTEGRATION_REGISTRY (built-ins) and marks installed status, so a community integration that is not built in only appears with --catalog. Reword the option and the intro sentence to say the default shows the built-in integrations and --catalog adds community ones. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ad of crashing (github#3525) * fix(catalogs): priority: .inf yields a clean validation error, not OverflowError _load_catalog_config coerces a catalog entry's priority with int() inside except (TypeError, ValueError). int(float('inf')) raises OverflowError, which is not in that tuple, so a YAML 'priority: .inf' escaped as an uncaught traceback instead of the intended 'expected integer' validation error (the bool-is-int case is already guarded just above). Add OverflowError to the except tuple. Test mirrors the existing rejects_boolean_priority test with priority: .inf (fails before: OverflowError; passes after: ValidationError naming the config). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(presets): priority: .inf in a preset catalog config yields a clean error The PresetCatalog._load_catalog_config priority parser has its own loader (separate from CatalogStackBase) that caught only TypeError/ValueError, so a YAML 'priority: .inf' escaped as an uncaught OverflowError from int(float('inf')). Add OverflowError to the except tuple (the bool-is-int case is already guarded just above), matching catalogs.py. Test mirrors rejects_boolean_priority with priority: .inf (fails before: OverflowError; passes after: PresetValidationError). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…p catalog loaders (github#3526) * fix(workflows): reject bool/.inf catalog priority in workflow & step catalog loaders The WorkflowRegistry and StepRegistry catalog-config loaders coerced priority with int() inside except (TypeError, ValueError), missing two guards the base CatalogStackBase loader already has: - bool is an int subclass, so 'priority: true' was silently coerced to 1; - int(float('inf')) raises OverflowError (not caught), so 'priority: .inf' crashed with an uncaught traceback. Add the explicit bool check and OverflowError to both loaders, and add OverflowError to the two _coerce_priority helpers used by 'catalog add' (they return 0 on an uncoercible existing priority instead of crashing). Parametrized tests on both TestWorkflowCatalog and TestStepCatalog reject priority true/false/.inf (fail before: bool coerced to 1 / inf OverflowError). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(workflows): cover add_catalog() OverflowError fallback for existing priority: .inf The workflow/step catalog priority guards added OverflowError to _coerce_priority (the 'catalog add' fallback), but the tests only exercised get_active_catalogs(). Add tests that prewrite an existing 'priority: .inf' entry and call add_catalog() for both WorkflowCatalog and StepCatalog, asserting the command succeeds and the new entry gets a valid priority (inf coerced to 0, +1). Fails before: int(inf) OverflowError crashed add_catalog. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…emove (github#3589) IntegrationCatalog.add_catalog and remove_catalog re-validate the existing catalog entries' priorities inline, separately from the base loader. Both did `int(raw_priority)` under `except (TypeError, ValueError)`, so a `priority: .inf` (float('inf')) raised OverflowError: add_catalog leaked a raw traceback instead of IntegrationValidationError, and remove_catalog crashed while building the display order. Add OverflowError to both handlers, matching the base loader (github#3525) and the workflow/step loaders (github#3526). add_catalog now raises IntegrationValidationError; remove_catalog falls back to positional order like the other non-integer priorities. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…he text "None" (github#3798) BundleManifest.from_dict read every required scalar as `str(raw.get(key, "")).strip()`. The `""` default only covers a MISSING key. A key present but null -- exactly how YAML spells an empty field (`author:` with nothing after it) -- yields None, and `str(None)` is the literal string "None". That value is non-empty, so it sailed past the `if not value` required-field checks in structural_errors(). Reproduced on main: bundle.yml with description:/author:/license: left empty -> description='None' author='None' license='None' -> structural_errors() == [] -> specify bundle validate: exit 0, "demo is well-formed and valid." So an empty required field was silently accepted and the bundle shipped the literal text "None" as its author/license/description -- which is what `bundle info` and a catalog entry then display. A null `provides.<kind>[].id` likewise became a component literally named "None". Add a `_text()` helper beside the existing `_parse_str_list` (the file's established "one coercion helper applied at every site" shape) mapping an explicit null to "", and route the required scalars through it. Same silent-acceptance class as the already-merged guards in this function: github#3629 (non-mapping `integration:`) and github#3661 (falsy non-mapping requires/provides). Non-null values are still `str()`-coerced and stripped, and an absent key already produced "" -- so valid manifests are byte-for-byte unaffected. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…sage (github#3800) Both places a user learns the `specify self upgrade --tag` syntax silently drop the `[suffix]` token, because Rich parses the literal square brackets as a markup tag and discards them: rejected tag -> "Invalid --tag: expected vMAJOR.MINOR.PATCH" (constant is "Invalid --tag: expected vMAJOR.MINOR.PATCH[suffix]") --help -> "Pin the target version (vX.Y.Z). Without --tag, ..." So the CLI implies a bare vX.Y.Z is the ONLY accepted form, when v1.0.0-rc1, v0.8.0.dev0 and v0.8.0+build.42 are all valid -- and the shipped docs advertise the suffix in four places (docs/upgrade.md x3, README.md x2). Escape the rejection message at the PRINT site rather than baking `\[` into _INVALID_TAG_MESSAGE: the same constant is raised through typer.BadParameter, which Click renders without Rich, so it must stay plain text. Escape the literal bracket in the option help, which Typer renders through Rich. Same literal-bracket class as the existing precedents in workflows/_commands.py (`\[disabled]`, `\[<type>]`). Static CLI text only -- no validation semantics change and `_validate_tag` is untouched. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…#3832) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github#3799) CommandRegistrar.render_toml_command passes the raw frontmatter `description` straight into `_render_basic_toml_string`, which iterates the value and calls ord() on each character. Frontmatter comes from yaml.safe_load, so description can be any YAML type: description='ok string' -> description = "ok string" description=None -> TypeError: 'NoneType' object is not iterable description=42 -> TypeError: 'int' object is not iterable description=True -> TypeError: 'bool' object is not iterable description=['a','b'] -> description = "ab" <- silently WRONG value This is a format-branch asymmetry: it is the only renderer reached from register_commands' format branches that does not normalise description. render_yaml_command (same class, ~70 lines below) already does exactly `if not isinstance(description, str): description = str(description) if description is not None else ""`, render_markdown_command goes through yaml.dump which handles any type, and TomlIntegration._extract_description returns "" for a non-str. So only extension/preset commands rendered for the two TOML agents were affected. Apply the same coercion the sibling uses. After: None -> "", 42 -> "42", True -> "True", ['a','b'] -> "['a', 'b']", each still valid parseable TOML. String descriptions are untouched. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ithub#3859) The extensions `events` feature changed the "nothing provided" validation error from "Extension must provide at least one command or hook" to "Extension must provide at least one command, hook, or event", but test_empty_provides_and_no_hooks_keeps_its_own_message still asserted the old wording, so it failed on main. Update the regex and also pop `events` from the fixture so the test truly exercises the empty-provides path. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 189d67d7-2028-4319-a459-b22919d43a3e
…eleted (github#3805) `IntegrationManifest.uninstall()` guards every tracked-file `path.unlink()` with `except OSError: skipped.append(path)`, but the manifest's own `manifest.unlink()` is bare. The manifest is deleted *last*, so an undeletable manifest (read-only file, a directory left at the path, a Windows lock) raises after the tracked files are already gone. The caller loses the `(removed, skipped)` result and never runs its post-uninstall bookkeeping — reassigning the default integration, rewriting/removing `integration.json`, clearing init options — leaving a removed integration still recorded as installed. Report it in `skipped` like any other file we could not remove, mirroring the `path.unlink()` guard above and the same `except OSError: skipped.append(...)` pattern in kimi's legacy-directory cleanup. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…xtension skill re-registration after upgrade (github#3853) * Fix upgrade-overwrites-copilot-skills: pass force=True to extension skill re-registration after upgrade Apply the remediation from the bug assessment on issue github#3849. _register_extension_skills() had a skip guard that refused to overwrite existing SKILL.md files (protecting user customizations). In the upgrade path, setup() regenerates all core-template SKILL.md files first, then calls register_enabled_extensions_for_agent(). The guard then sees those freshly-written core files as 'existing' and skips every extension, leaving only core template content on disk. Fix: add force: bool = False to _register_extension_skills() and thread it through register_enabled_extensions_for_agent() and _register_extensions_for_agent(). In integration_upgrade(), pass force=True so extension content layers on top of the just-regenerated core files. The force flag is off-by-default so plain extension add still protects user-modified skill files. Refs github#3849 Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding 'Unused local variable' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * test: add end-to-end regression guard for upgrade-overwrites-copilot-skills (github#3849) The existing regression tests in TestRegisterExtensionSkillsForceFlag exercise the new force parameter at the helper level, so without the fix they fail only with a TypeError (unknown kwarg) rather than on the user-facing behaviour. Add a command-level test that runs 'specify integration upgrade copilot --skills --force' end-to-end and asserts the installed git extension's SKILL.md is restored (with its extension content, not a bare core-template stub) when the skill directory already exists — the exact skill_dir_preexists path the bug depends on. The test fails on pre-fix source (the skill is never recreated) and passes with the fix, so it is a genuine behavioural regression guard rather than an API-surface check. Refs github#3849 Assisted-by: GitHub Copilot (model: claude-opus-4.8, autonomous) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Manfred Riem <15701806+mnriem@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
…put (github#3806) `preset catalog add` and `preset catalog remove` interpolate the raw `--name` and URL into `console.print()`, so Rich parses them as markup. Two failure modes: * Silent misreporting — a name like `[bold red]pwned[/]` is printed as `pwned`, so the confirmed name is not the persisted name and a later `remove` with the reported name fails. * Unhandled MarkupError — an unbalanced closing tag raises, and because the crash happens *after* preset-catalogs.yml is written, the user gets a traceback for a catalog that was in fact added. This file already imports `_escape_markup` and escapes name/description/ url in `preset catalog list` (whose invariant `test_catalog_list_escapes_ rich_markup` already pins); `add`/`remove` were the remaining gaps. Only rendering changes: the raw values are still what get persisted and what the duplicate-name comparison uses. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…dary (github#3808) `test_validate_rejects_non_string_condition` contradicts its sibling `test_validate_accepts_string_or_bool_condition` in the same class: a bool *is* a non-string, so the two names disagree about the contract the validator actually implements. Rename to `test_validate_rejects_non_string_non_bool_condition` in all three step classes, matching the validator's own message: "'condition' must be a string or boolean, got <type>". Test names only — no behaviour change, and the parametrized values are untouched. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ithub#3847) * fix(workflows): validate prompt step 'timeout' like the shell step PR github#3768 added a `timeout` to the prompt step and passed it straight into `subprocess.run(timeout=...)`. Neither `validate()` nor `execute()` checks it, so a bad value from a user-authored `workflow.yml` escapes as a raw exception: steps: - id: first type: shell run: echo side-effect - id: ask type: prompt prompt: do it timeout: abc $ specify workflow run wf.yml > [first] shell ... Workflow failed: unsupported operand type(s) for +: 'float' and 'str' The engine re-raises anything a step throws, so this takes down the whole run — after `first` has already run its side effect — with a message that names neither the step nor the field. `timeout: .nan` raises `ValueError: cannot convert float NaN to integer` the same way, and a non-positive `timeout` (`0`, `-5`) makes `subprocess.run` report an immediate TimeoutExpired for a command that never got the time to run. `timeout: true` silently becomes a 1-second limit, since bool is an int subclass. The sibling shell step already rejects exactly these values via a `_timeout_error()` helper shared by `execute()` and `validate()`, so the same workflow failed validation cleanly as a shell step and crashed as a prompt one. Mirrored that helper onto PromptStep: `validate()` reports the contract error, and `execute()` re-checks it so an unvalidated run fails just that step instead of aborting. Now: Workflow validation failed: - Prompt step 'ask': 'timeout' must be a positive number of seconds, got 'abc'. caught before the first step runs. Positive int/float timeouts and an absent `timeout` are unaffected. Regression tests in `TestPromptStep` mirror the shell step's: validate rejects "30"/True/inf/nan/0/-5/list/None, validate accepts 300/5/0.5 and an absent field, and execute fails cleanly with `subprocess.run` patched to assert it is never reached. With the source fix reverted, all 9 rejection tests fail. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code (model: claude-opus-5, under direct human supervision) * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * test(workflows): cover the huge-int timeout OverflowError guard The autofix commit wrapped the prompt step's `_timeout_error()` check in `try/except OverflowError` but added no test, so nothing pins the behaviour it introduced. `math.isfinite(10**400)` raises `OverflowError: int too large to convert to float` — the value is an `int`, is `> 0`, and is not a `bool`, so it clears every other clause of the guard and reaches `isfinite()`. Without the `except`, validating ```yaml - id: ask type: prompt prompt: do it timeout: 1000...0 # 400 digits ``` raises that `OverflowError` out of `validate()`/`execute()` — exactly the uncaught-crash failure mode this guard was added to prevent. The same value raises `OverflowError` from `subprocess.run(timeout=...)`. Add `10**400` to both parametrized rejection lists (`validate()` and the `execute()` fails-cleanly loop). Test-the-test: reverting the `try/except` fails both new cases with `OverflowError` and leaves the rest passing. Assisted-by: Claude Opus 5 (model: claude-opus-5, autonomous) --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Add `intent` extension submitted by @SuhaibAslam to: - extensions/catalog.community.json (inserted alphabetically between intake and issue) - docs/community/extensions.md community extensions table This revision limits the catalog change to the intent addition and the top-level updated_at bump only, reverting the unrelated re-serialization (entry reordering, \u2014 Unicode escaping, tool-array reformatting) that a reviewer flagged. Closes github#3854 cc @SuhaibAslam Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Manfred Riem <15701806+mnriem@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…Error (github#3865) PR github#3847 hardened the prompt step's `timeout` guard against a huge-int value, but its twin in the shell step — the step the prompt one was mirrored from — still has the hole. `math.isfinite(10**400)` raises `OverflowError: int too large to convert to float`. A 400-digit YAML scalar is an `int` and is not a `bool`, so it clears every clause before `isfinite()` and raises there, escaping `_timeout_error()` as exactly the uncaught crash that helper exists to prevent: steps: - id: qa type: shell run: echo hi timeout: 1000...0 # 400 digits $ specify workflow run wf.yml Traceback (most recent call last): ... File "src/specify_cli/workflows/engine.py", line 361, in _validate_steps step_errors = step_impl.validate(step_config) File "src/specify_cli/workflows/steps/shell/__init__.py", line 127 or not math.isfinite(timeout) OverflowError: int too large to convert to float `workflow_run` calls `engine.validate()` before executing any step, so the OverflowError propagates out of `validate_workflow` and kills the command with a bare traceback that names neither the step nor the field, instead of the "Workflow validation failed" report. `execute()` shares the same helper, so an unvalidated run raises there too — and the engine re-raises anything a step throws, aborting the whole workflow after earlier steps have already run their side effects. The value is genuinely invalid rather than merely unrepresentable in the check: `subprocess.run(timeout=10**400)` raises the same OverflowError. Unlike the prompt step, the shell step checks `isfinite()` *before* `timeout <= 0`, so a negative huge int (`-(10**400)`) crashes as well rather than being caught by the sign check. Wrapped the condition in `try/except OverflowError` and treated the value as invalid, mirroring the prompt step's guard so both steps reject the same values with the same message. Now: Workflow validation failed: - Shell step 'qa': 'timeout' must be a positive number of seconds, got 1000...0. Valid int/float timeouts, non-finite floats, bools, strings and non-positive values are unaffected — the existing clauses are unchanged. Regression tests in `TestShellStep`: `validate()` rejects both signs of the huge int, `validate_workflow()` reports it end to end (pinning the path the CLI actually takes, not just the helper), and `execute()` fails only that step with `subprocess.run` patched to assert it is never reached. Test-the-test: reverting the source change fails all three with `OverflowError` and leaves the rest of `TestShellStep` passing. Assisted-by: Claude Code (model: claude-opus-5, under direct human supervision) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Add yolo to community workflow catalog - Workflow ID: yolo - Version: 0.1.0 - Author: clintcparker - Description: Runs specify → plan → tasks → implement without review gates * Update speckit_version requirement to 0.8.12
Release v0.15.0 # Conflicts: # .github/workflows/codeql.yml # AGENTS.md # CHANGELOG.md # docs/community/extensions.md # docs/community/presets.md # docs/quickstart.md # docs/reference/extensions.md # extensions/assess/README.md # extensions/assess/commands/speckit.assess.intake.md # extensions/catalog.community.json # presets/catalog.community.json # pyproject.toml # src/specify_cli/authentication/azure_devops.py # src/specify_cli/commands/bundle/__init__.py # src/specify_cli/workflows/_commands.py # tests/test_authentication.py # tests/unit/test_bundle_download_url.py
…eam v0.15.0) Upstream v0.15.0 changed bob to skills-based layout by default (commit 74662cf). The parity test expected .bob/commands/ but the default output is now .bob/skills/. Detect is_skills_mode and check the correct directory. Assisted-by: opencode z-ai/glm-5.2 (autonomous)
This was referenced Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrate upstream
github/spec-kitv0.15.0into the satwareAG fork. This brings in 199 commits spanning v0.14.1 through v0.15.0. Closes #98.Upstream Highlights (v0.14.1 - v0.15.0)
shutil.whichresolution (github#3709); empty--commands-dirrejected (github#3714)Merge Strategy
Merge commit (not squash) to preserve all 199 upstream commits in history, matching the fork's established sync pattern (PRs #83, #87).
Conflicts Resolved (17 files)
AGENTS.mdpyproject.toml0.15.0)CHANGELOG.md.github/workflows/codeql.ymldocs/community/extensions.mddocs/community/presets.mddocs/quickstart.mddocs/reference/extensions.mdextensions/assess/README.mdextensions/assess/commands/speckit.assess.intake.mdextensions/catalog.community.jsonpresets/catalog.community.jsonsrc/specify_cli/authentication/azure_devops.pysrc/specify_cli/commands/bundle/__init__.pysrc/specify_cli/workflows/_commands.pytests/test_authentication.pytests/unit/test_bundle_download_url.pyPolicy: Keep upstream intact. All upstream files taken verbatim (
--theirs). OnlyAGENTS.mdrequired manual resolution to preserve fork-specific sections alongside upstream additions.Post-Merge Fixes (1 commit on top of merge)
tests/integrations/test_fork_agent_parity.py: Bob's integration changed to skills-based layout by default in upstream (feat: update Bob integration to skills-based layout for Bob 2.0 github/spec-kit#3415). The parity test expected.bob/commands/but the default output is now.bob/skills/. Addedis_skills_modedetection to check the correct directory.scripts/bash/pre-pr.sh: Pinned ruff toruff@0.15.0(matching CI) instead ofruff>=0.14(latest, which has stricter rules upstream code doesn't pass yet). Also addedtests/to the lint scope to match CI.Test Results
uv run pytest tests/integrations/ -x -q: 2428 passed, 4 skipped (0 failures)ruff@0.15.0 check src/ tests/: All checks passedcheck-privacy-leaks.sh: No violations (550 tracked files scanned)check-upstream-sync.sh: OK: Up to date with upstream v0.15.0check-speckit-cli.sh: OK (satware-v0.13.0+1; will bump to satware-v0.15.0+1 after merge)Post-Merge Actions
After this PR merges:
satware-v0.15.0+1on the merge commitspecifyCLI:uv tool install --from "git+https://github.com/satwareAG/spec-kit.git@satware-v0.15.0+1" specify-clibash $SATWARE_HARNESS/scripts/check-speckit-cli.sh🤖 Assisted-by: opencode z-ai/glm-5.2 (autonomous)