@codewalla_india/openspec 1.3.0 → 1.3.2

package/dist/commands/schema.js

@@ -2,8 +2,9 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import ora from 'ora';
 import { stringify as stringifyYaml } from 'yaml';
-import { getSchemaDir, getProjectSchemasDir, getUserSchemasDir, getPackageSchemasDir, listSchemas, } from '../core/artifact-graph/resolver.js';
+import { getSchemaDir, getProjectSchemasDir, getUserSchemasDir, getPackageSchemasDir, isSchemaDir, listSchemas, } from '../core/artifact-graph/resolver.js';
 import { parseSchema, SchemaValidationError } from '../core/artifact-graph/schema.js';
+import { FileSystemUtils } from '../utils/file-system.js';
 /**
  * Check all three locations for a schema and return which ones exist.
  */
@@ -129,21 +130,30 @@ function validateSchema(schemaDir, verbose = false) {
         }
         return { valid: false, issues };
     }
-    // Check template files exist
-    // Templates can be in schemaDir directly or in a templates/ subdirectory
+    // Check template files exist in the same directory used at runtime.
     if (verbose) {
         console.log('  Checking template files...');
     }
     for (const artifact of schema.artifacts) {
-        // Try templates subdirectory first (standard location), then root
-        const templatePathInTemplates = path.join(schemaDir, 'templates', artifact.template);
-        const templatePathInRoot = path.join(schemaDir, artifact.template);
-        if (!fs.existsSync(templatePathInTemplates) && !fs.existsSync(templatePathInRoot)) {
+        const templatesDir = path.join(schemaDir, 'templates');
+        const existingTemplatePath = path.join(templatesDir, artifact.template);
+        if (!fs.existsSync(existingTemplatePath)) {
             issues.push({
                 level: 'error',
                 path: `artifacts.${artifact.id}.template`,
                 message: `Template file '${artifact.template}' not found for artifact '${artifact.id}'`,
             });
+            continue;
+        }
+        try {
+            FileSystemUtils.assertPathWithin(templatesDir, existingTemplatePath);
+        }
+        catch {
+            issues.push({
+                level: 'error',
+                path: `artifacts.${artifact.id}.template`,
+                message: `Template file '${artifact.template}' points outside the schema templates directory`,
+            });
         }
     }
     // Dependency graph validation is already done by parseSchema
@@ -162,19 +172,73 @@ function isValidSchemaName(name) {
 /**
  * Copy a directory recursively.
  */
-function copyDirRecursive(src, dest) {
+function resolveSchemaCopyPath(allowedRoot, sourcePath) {
+    try {
+        const canonicalRoot = fs.realpathSync(allowedRoot);
+        const canonicalPath = fs.realpathSync(sourcePath);
+        FileSystemUtils.assertPathWithin(canonicalRoot, canonicalPath);
+        return canonicalPath;
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Cannot fork schema with linked or unsupported entry: ${sourcePath}: ${detail}`, { cause: error });
+    }
+}
+function copyDirRecursive(src, dest, allowedRoot = src, ancestors = new Set()) {
+    const canonicalSrc = resolveSchemaCopyPath(allowedRoot, src);
+    if (ancestors.has(canonicalSrc)) {
+        throw new Error(`Cannot fork schema with a linked directory cycle: ${src}`);
+    }
+    ancestors.add(canonicalSrc);
     fs.mkdirSync(dest, { recursive: true });
-    const entries = fs.readdirSync(src, { withFileTypes: true });
-    for (const entry of entries) {
-        const srcPath = path.join(src, entry.name);
-        const destPath = path.join(dest, entry.name);
-        if (entry.isDirectory()) {
-            copyDirRecursive(srcPath, destPath);
+    try {
+        const entries = fs.readdirSync(src, { withFileTypes: true });
+        for (const entry of entries) {
+            const srcPath = path.join(src, entry.name);
+            const destPath = path.join(dest, entry.name);
+            const canonicalEntry = resolveSchemaCopyPath(allowedRoot, srcPath);
+            const stats = fs.statSync(canonicalEntry);
+            if (stats.isDirectory()) {
+                copyDirRecursive(canonicalEntry, destPath, allowedRoot, ancestors);
+            }
+            else if (stats.isFile()) {
+                // Dereference confined links so the fork is an independent schema.
+                fs.copyFileSync(canonicalEntry, destPath);
+            }
+            else {
+                throw new Error(`Cannot fork schema with linked or unsupported entry: ${srcPath}`);
+            }
         }
-        else {
-            fs.copyFileSync(srcPath, destPath);
+    }
+    finally {
+        ancestors.delete(canonicalSrc);
+    }
+}
+/**
+ * Verifies a schema tree before replacing or creating the fork destination.
+ */
+function assertSchemaTreeCanBeCopied(src, allowedRoot = src, ancestors = new Set()) {
+    const canonicalSrc = resolveSchemaCopyPath(allowedRoot, src);
+    if (ancestors.has(canonicalSrc)) {
+        throw new Error(`Cannot fork schema with a linked directory cycle: ${src}`);
+    }
+    ancestors.add(canonicalSrc);
+    try {
+        for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+            const entryPath = path.join(src, entry.name);
+            const canonicalEntry = resolveSchemaCopyPath(allowedRoot, entryPath);
+            const stats = fs.statSync(canonicalEntry);
+            if (stats.isDirectory()) {
+                assertSchemaTreeCanBeCopied(canonicalEntry, allowedRoot, ancestors);
+            }
+            else if (!stats.isFile()) {
+                throw new Error(`Cannot fork schema with linked or unsupported entry: ${entryPath}`);
+            }
         }
     }
+    finally {
+        ancestors.delete(canonicalSrc);
+    }
 }
 /**
  * Default artifacts with descriptions for schema init.
@@ -339,7 +403,7 @@ export function registerSchemaCommand(program) {
                 const schemaResults = [];
                 let anyInvalid = false;
                 for (const entry of entries) {
-                    if (!entry.isDirectory())
+                    if (!isSchemaDir(projectSchemasDir, entry))
                         continue;
                     const schemaDir = path.join(projectSchemasDir, entry.name);
                     const schemaPath = path.join(schemaDir, 'schema.yaml');
@@ -378,9 +442,9 @@ export function registerSchemaCommand(program) {
                             console.log(`    ${issue.level}: ${issue.message}`);
                         }
                     }
-                    if (anyInvalid) {
-                        process.exitCode = 1;
-                    }
+                }
+                if (anyInvalid) {
+                    process.exitCode = 1;
                 }
                 return;
             }
@@ -423,9 +487,11 @@ export function registerSchemaCommand(program) {
                     for (const issue of result.issues) {
                         console.log(`  ${issue.level}: ${issue.message}`);
                     }
-                    process.exitCode = 1;
                 }
             }
+            if (!result.valid) {
+                process.exitCode = 1;
+            }
         }
         catch (error) {
             if (options?.json) {
@@ -487,6 +553,9 @@ export function registerSchemaCommand(program) {
             // Determine source location
             const sourceResolution = getSchemaResolution(source, projectRoot);
             const sourceLocation = sourceResolution?.source || 'package';
+            // Validate the complete source before a forced fork removes anything.
+            const trustedSourceDir = fs.realpathSync(sourceDir);
+            assertSchemaTreeCanBeCopied(trustedSourceDir);
             // Check destination
             const destinationDir = path.join(getProjectSchemasDir(projectRoot), destinationName);
             if (fs.existsSync(destinationDir)) {
@@ -513,7 +582,7 @@ export function registerSchemaCommand(program) {
             // Copy schema
             if (spinner)
                 spinner.start(`Forking '${source}' to '${destinationName}'...`);
-            copyDirRecursive(sourceDir, destinationDir);
+            copyDirRecursive(trustedSourceDir, destinationDir);
             // Update name in schema.yaml
             const destSchemaPath = path.join(destinationDir, 'schema.yaml');
             const schemaContent = fs.readFileSync(destSchemaPath, 'utf-8');
@@ -584,8 +653,9 @@ export function registerSchemaCommand(program) {
                 return;
             }
             const schemaDir = path.join(getProjectSchemasDir(projectRoot), name);
-            // Check if exists
-            if (fs.existsSync(schemaDir)) {
+            // Check overwrite permission without mutating the destination
+            const schemaExists = fs.existsSync(schemaDir);
+            if (schemaExists) {
                 if (!options?.force) {
                     if (options?.json) {
                         console.log(JSON.stringify({
@@ -601,9 +671,6 @@ export function registerSchemaCommand(program) {
                     process.exitCode = 1;
                     return;
                 }
-                if (spinner)
-                    spinner.start(`Removing existing schema '${name}'...`);
-                fs.rmSync(schemaDir, { recursive: true });
             }
             // Determine artifacts and description
             let description;
@@ -625,6 +692,12 @@ export function registerSchemaCommand(program) {
                 }));
                 selectedArtifactIds = await checkbox({
                     message: 'Select artifacts to include:',
+                    theme: {
+                        icon: {
+                            checked: '[x]',
+                            unchecked: '[ ]',
+                        },
+                    },
                     choices: artifactChoices,
                 });
                 if (selectedArtifactIds.length === 0) {
@@ -673,10 +746,6 @@ export function registerSchemaCommand(program) {
                     selectedArtifactIds = DEFAULT_ARTIFACTS.map((a) => a.id);
                 }
             }
-            // Create schema directory
-            if (spinner)
-                spinner.start(`Creating schema '${name}'...`);
-            fs.mkdirSync(schemaDir, { recursive: true });
             // Build artifacts array with proper dependencies
             const selectedArtifacts = selectedArtifactIds.map((id) => {
                 const template = DEFAULT_ARTIFACTS.find((a) => a.id === id);
@@ -718,6 +787,16 @@ export function registerSchemaCommand(program) {
                     tracks: 'tasks.md',
                 };
             }
+            // Replace only after all inputs have been collected and validated
+            if (schemaExists) {
+                if (spinner)
+                    spinner.start(`Removing existing schema '${name}'...`);
+                fs.rmSync(schemaDir, { recursive: true });
+            }
+            // Create schema directory
+            if (spinner)
+                spinner.start(`Creating schema '${name}'...`);
+            fs.mkdirSync(schemaDir, { recursive: true });
             fs.writeFileSync(path.join(schemaDir, 'schema.yaml'), stringifyYaml(schema));
             // Create template files in templates/ subdirectory (standard location)
             const templatesDir = path.join(schemaDir, 'templates');
@@ -795,74 +874,74 @@ export function registerSchemaCommand(program) {
 function createDefaultTemplate(artifactId) {
     switch (artifactId) {
         case 'proposal':
-            return `## Why
-
-<!-- Describe the motivation for this change -->
-
-## What Changes
-
-<!-- Describe what will change -->
-
-## Capabilities
-
-### New Capabilities
-<!-- List new capabilities -->
-
-### Modified Capabilities
-<!-- List modified capabilities -->
-
-## Impact
-
-<!-- Describe the impact on existing functionality -->
+            return `## Why
+
+<!-- Describe the motivation for this change -->
+
+## What Changes
+
+<!-- Describe what will change -->
+
+## Capabilities
+
+### New Capabilities
+<!-- List new capabilities -->
+
+### Modified Capabilities
+<!-- List modified capabilities -->
+
+## Impact
+
+<!-- Describe the impact on existing functionality -->
 `;
         case 'specs':
-            return `## ADDED Requirements
-
-### Requirement: Example requirement
-
-Description of the requirement.
-
-#### Scenario: Example scenario
-- **WHEN** some condition
-- **THEN** some outcome
+            return `## ADDED Requirements
+
+### Requirement: Example requirement
+
+Description of the requirement.
+
+#### Scenario: Example scenario
+- **WHEN** some condition
+- **THEN** some outcome
 `;
         case 'design':
-            return `## Context
-
-<!-- Background and context -->
-
-## Goals / Non-Goals
-
-**Goals:**
-<!-- List goals -->
-
-**Non-Goals:**
-<!-- List non-goals -->
-
-## Decisions
-
-### 1. Decision Name
-
-Description and rationale.
-
-**Alternatives considered:**
-- Alternative 1: Rejected because...
-
-## Risks / Trade-offs
-
-<!-- List risks and trade-offs -->
+            return `## Context
+
+<!-- Background and context -->
+
+## Goals / Non-Goals
+
+**Goals:**
+<!-- List goals -->
+
+**Non-Goals:**
+<!-- List non-goals -->
+
+## Decisions
+
+### 1. Decision Name
+
+Description and rationale.
+
+**Alternatives considered:**
+- Alternative 1: Rejected because...
+
+## Risks / Trade-offs
+
+<!-- List risks and trade-offs -->
 `;
         case 'tasks':
-            return `## Implementation Tasks
-
-- [ ] Task 1
-- [ ] Task 2
-- [ ] Task 3
+            return `## Implementation Tasks
+
+- [ ] Task 1
+- [ ] Task 2
+- [ ] Task 3
 `;
         default:
-            return `## ${artifactId}
-
-<!-- Add content here -->
+            return `## ${artifactId}
+
+<!-- Add content here -->
 `;
     }
 }

package/dist/commands/show.js

@@ -157,14 +157,17 @@ export class ShowCommand {
     }
     warnIrrelevantFlags(type, options) {
         const irrelevant = [];
+        // --no-scenarios makes commander default `scenarios` to true, so its
+        // presence alone does not mean the user passed it — only false does.
+        const isUserProvided = (k) => k === 'scenarios' ? options[k] === false : k in options;
         if (type === 'change') {
             for (const k of SPEC_FLAG_KEYS)
-                if (k in options)
+                if (isUserProvided(k))
                     irrelevant.push(k);
         }
         else {
             for (const k of CHANGE_FLAG_KEYS)
-                if (k in options)
+                if (isUserProvided(k))
                     irrelevant.push(k);
         }
         if (irrelevant.length > 0) {

package/dist/commands/spec.js

@@ -1,11 +1,31 @@
-import { existsSync, readdirSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { existsSync, readFileSync } from 'fs';
+import path, { join } from 'path';
 import { MarkdownParser } from '../core/parsers/markdown-parser.js';
 import { Validator } from '../core/validation/validator.js';
 import { isInteractive } from '../utils/interactive.js';
 import { getSpecIds } from '../utils/item-discovery.js';
+import { discoverSpecFiles } from '../utils/spec-discovery.js';
+import { FileSystemUtils } from '../utils/file-system.js';
 const SPECS_DIR = 'openspec/specs';
-function parseSpecFromFile(specPath, specId) {
+function assertSpecPath(specsDir, specPath) {
+    const relativePath = path.relative(path.resolve(specsDir), path.resolve(specPath));
+    if (relativePath === '..' ||
+        relativePath.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relativePath)) {
+        throw new Error(`Path is outside the allowed directory: ${specPath}`);
+    }
+    try {
+        // Preserve confined spec.md links, including links to a sibling capability.
+        FileSystemUtils.assertPathWithin(specsDir, specPath);
+    }
+    catch {
+        // A capability directory may intentionally be a monorepo symlink. Treat it
+        // as the trust root while still rejecting a link outside that capability.
+        FileSystemUtils.assertPathWithin(path.dirname(specPath), specPath);
+    }
+}
+function parseSpecFromFile(specsDir, specPath, specId) {
+    assertSpecPath(specsDir, specPath);
     const content = readFileSync(specPath, 'utf-8');
     const parser = new MarkdownParser(content);
     return parser.parseSpec(specId);
@@ -40,7 +60,8 @@ function filterSpec(spec, options) {
  * Print the raw markdown content for a spec file without any formatting.
  * Raw-first behavior ensures text mode is a passthrough for deterministic output.
  */
-function printSpecTextRaw(specPath) {
+function printSpecTextRaw(specsDir, specPath) {
+    assertSpecPath(specsDir, specPath);
     const content = readFileSync(specPath, 'utf-8');
     console.log(content);
 }
@@ -69,6 +90,7 @@ export class SpecCommand {
             }
         }
         const specPath = join(this.specsDir, specId, 'spec.md');
+        assertSpecPath(this.specsDir, specPath);
         if (!existsSync(specPath)) {
             // Root-aware callers get the absolute path; the cwd-based noun form
             // keeps its historical forward-slash relative message on all platforms.
@@ -79,7 +101,7 @@ export class SpecCommand {
             if (options.requirements && options.requirement) {
                 throw new Error('Options --requirements and --requirement cannot be used together');
             }
-            const parsed = parseSpecFromFile(specPath, specId);
+            const parsed = parseSpecFromFile(this.specsDir, specPath, specId);
             const filtered = filterSpec(parsed, options);
             const output = {
                 id: specId,
@@ -93,7 +115,7 @@ export class SpecCommand {
             console.log(JSON.stringify(output, null, 2));
             return;
         }
-        printSpecTextRaw(specPath);
+        printSpecTextRaw(this.specsDir, specPath);
     }
 }
 export function registerSpecCommand(rootProgram) {
@@ -127,36 +149,32 @@ export function registerSpecCommand(rootProgram) {
         .description('List all available specifications')
         .option('--json', 'Output as JSON')
         .option('--long', 'Show id and title with counts')
-        .action((options) => {
+        .action(async (options) => {
         try {
             if (!existsSync(SPECS_DIR)) {
                 console.log('No items found');
                 return;
             }
-            const specs = readdirSync(SPECS_DIR, { withFileTypes: true })
-                .filter(dirent => dirent.isDirectory())
-                .map(dirent => {
-                const specPath = join(SPECS_DIR, dirent.name, 'spec.md');
-                if (existsSync(specPath)) {
-                    try {
-                        const spec = parseSpecFromFile(specPath, dirent.name);
-                        return {
-                            id: dirent.name,
-                            title: spec.name,
-                            requirementCount: spec.requirements.length
-                        };
-                    }
-                    catch {
-                        return {
-                            id: dirent.name,
-                            title: dirent.name,
-                            requirementCount: 0
-                        };
-                    }
+            const discovered = await discoverSpecFiles(SPECS_DIR);
+            const specs = discovered
+                .map(({ id, specFile }) => {
+                try {
+                    assertSpecPath(SPECS_DIR, specFile);
+                    const spec = parseSpecFromFile(SPECS_DIR, specFile, id);
+                    return {
+                        id,
+                        title: spec.name,
+                        requirementCount: spec.requirements.length
+                    };
+                }
+                catch {
+                    return {
+                        id,
+                        title: id,
+                        requirementCount: 0
+                    };
                 }
-                return null;
             })
-                .filter((spec) => spec !== null)
                 .sort((a, b) => a.id.localeCompare(b.id));
             if (options.json) {
                 console.log(JSON.stringify(specs, null, 2));
@@ -203,10 +221,12 @@ export function registerSpecCommand(rootProgram) {
                 }
             }
             const specPath = join(SPECS_DIR, specId, 'spec.md');
+            assertSpecPath(SPECS_DIR, specPath);
             if (!existsSync(specPath)) {
                 throw new Error(`Spec '${specId}' not found at openspec/specs/${specId}/spec.md`);
             }
             const validator = new Validator(options.strict);
+            assertSpecPath(SPECS_DIR, specPath);
             const report = await validator.validateSpec(specPath);
             if (options.json) {
                 console.log(JSON.stringify(report, null, 2));

package/dist/commands/store.js

@@ -1,10 +1,10 @@
 import * as os from 'node:os';
 import { asErrorMessage, emitFailure, printJson } from './shared-output.js';
 import * as path from 'node:path';
-import { trackEvent, trackCommandFailed } from '../telemetry/index.js';
 import { COMMAND_REGISTRY } from '../core/completions/command-registry.js';
 import { StoreError, doctorStores, listStores, prepareStoreSetup, prepareStoreCleanup, registerExistingStore, removeStore, resolveSetupGitEnabled, setupPreparedStore, unregisterStore, validateStoreId, } from '../core/store/index.js';
 import { isInteractive } from '../utils/interactive.js';
+import { trackStoreOperation } from '../telemetry/index.js';
 function toStoreOutput(store) {
     return {
         id: store.id,
@@ -327,19 +327,15 @@ class StoreCommand {
             }
             const result = await setupPreparedStore(prepared, { initGit });
             const payload = toMutationOutput(result);
-            trackEvent('store_setup', {
-                git_initialized: result.git.initialized,
-                already_registered: result.registryCommit.alreadyRegistered,
-                has_remote: Boolean(options.remote),
-            });
             if (options.json) {
                 printJson(payload);
                 return;
             }
             printMutationHuman('Store ready', payload, result.remotes);
+            // Track store setup operation
+            await trackStoreOperation('register', result.store?.id);
         }
         catch (error) {
-            await trackCommandFailed('store_setup', error);
             this.handleFailure(options.json, { store: null, registry: null, git: null, created_files: [], status: [] }, error);
         }
     }
@@ -365,18 +361,15 @@ class StoreCommand {
                 });
             }
             const payload = toMutationOutput(result);
-            trackEvent('store_registered', {
-                already_registered: result.registryCommit.alreadyRegistered,
-                git_is_repository: result.git.isRepository,
-            });
             if (options.json) {
                 printJson(payload);
                 return;
             }
             printMutationHuman('Store registered', payload, result.remotes);
+            // Track store register operation
+            await trackStoreOperation('register', result.store?.id);
         }
         catch (error) {
-            await trackCommandFailed('store_register', error);
             this.handleFailure(options.json, { store: null, registry: null, git: null, created_files: [], status: [] }, error);
         }
     }
@@ -388,6 +381,8 @@ class StoreCommand {
                 return;
             }
             printCleanupHuman('Unregistered store', payload);
+            // Track store unregister operation
+            await trackStoreOperation('unregister', id);
         }
         catch (error) {
             this.handleFailure(options.json, { store: null, registry: null, files: null, status: [] }, error);
@@ -397,30 +392,29 @@ class StoreCommand {
         try {
             const target = await prepareStoreCleanup({ id });
             await confirmRemove(target.id, target.root, options);
-            const result = await removeStore(target);
-            const payload = toCleanupOutput(result);
-            trackEvent('store_removed', {
-                files_deleted: result.files.deleted,
-            });
+            const payload = toCleanupOutput(await removeStore(target));
             if (options.json) {
                 printJson(payload);
                 return;
             }
             printCleanupHuman('Removed store', payload);
+            // Track store remove operation
+            await trackStoreOperation('remove', id);
         }
         catch (error) {
-            await trackCommandFailed('store_remove', error);
             this.handleFailure(options.json, { store: null, registry: null, files: null, status: [] }, error);
         }
     }
     async list(options = {}) {
         try {
-            const payload = toListOutput(await listStores());
+            const result = await listStores();
             if (options.json) {
-                printJson(payload);
+                printJson({ stores: result.stores, status: [] });
                 return;
             }
-            printListHuman(payload);
+            printListHuman({ stores: result.stores, status: [] });
+            // Track store list operation
+            await trackStoreOperation('list');
         }
         catch (error) {
             this.handleFailure(options.json, { stores: [], status: [] }, error);

package/dist/commands/validate.d.ts

@@ -14,6 +14,14 @@ interface ExecuteOptions {
 export declare class ValidateCommand {
     execute(itemName: string | undefined, options?: ExecuteOptions): Promise<void>;
     private normalizeType;
+    /**
+     * Resolve change IDs by directory existence within the resolved root — the
+     * same rule `openspec status`/`instructions` use (`getAvailableChanges`) —
+     * rather than requiring `proposal.md`. This lets `validate` resolve a
+     * scaffolded or still-authoring change that the sibling commands already
+     * resolve (#1182). Sorted to preserve the prior `getActiveChangeIds` ordering.
+     */
+    private listChangeIds;
     private runInteractiveSelector;
     private printNonInteractiveHint;
     private validateDirectItem;