@fission-ai/openspec 1.12.0 → 1.13.1

package/dist/core/specs-apply.js

@@ -22,7 +22,7 @@ function isLexicallyWithin(allowedDirectory, targetPath) {
             !relative.startsWith(`..${path.sep}`) &&
             !path.isAbsolute(relative)));
 }
-function resolveTrustedSpecPath(specsRoot, specPath) {
+function resolveTrustedSpecPath(specsRoot, specPath, projectRoot) {
     if (!isLexicallyWithin(specsRoot, specPath)) {
         throw new Error(`Path is outside the allowed directory: ${specPath}`);
     }
@@ -42,6 +42,14 @@ function resolveTrustedSpecPath(specsRoot, specPath) {
         // Freeze their canonical location as the trust root so later swaps are
         // rejected while a nested spec.md link still cannot escape.
         const root = FileSystemUtils.canonicalizeExistingPath(path.dirname(specPath));
+        // An external capability link is deliberate and supported (see
+        // assertDiscoveredSpecPath), so it is not refused here. What was wrong is
+        // that the write was silent: the CLI reported the in-project path while
+        // writing somewhere else entirely, so a link swapped underneath a repo
+        // left nothing on screen to notice. Name the real destination instead.
+        if (projectRoot && !isLexicallyWithin(FileSystemUtils.canonicalizeExistingPath(projectRoot), root)) {
+            process.emitWarning(`Capability '${path.basename(path.dirname(specPath))}' links outside the project; writing to ${root}`, 'OpenSpecExternalSpecWrite');
+        }
         const file = path.join(root, path.basename(specPath));
         FileSystemUtils.assertPathWithin(root, file);
         return { root, file };
@@ -69,7 +77,10 @@ export async function findSpecUpdates(changeDir, mainSpecsDir) {
     for (const { id, specFile } of discovered) {
         const targetFile = path.join(mainSpecsDir, ...id.split('/'), 'spec.md');
         const source = resolveTrustedSpecPath(changeSpecsDir, specFile);
-        const target = resolveTrustedSpecPath(mainSpecsDir, targetFile);
+        // Main specs always live at `<project root>/openspec/specs`, so the
+        // project root is the grandparent - a linked capability directory may not
+        // leave it.
+        const target = resolveTrustedSpecPath(mainSpecsDir, targetFile, path.dirname(path.dirname(mainSpecsDir)));
         // Check if target exists
         let exists = false;
         try {
@@ -110,6 +121,29 @@ export async function buildUpdatedSpec(update, changeName, options = {}) {
     // Parse deltas from the change spec file
     const plan = parseDeltaSpec(changeContent);
     const specName = update.id;
+    // A FROM:/TO: line that never formed a pair means the RENAMED section does not
+    // say what the author meant. Refuse rather than apply the pairing the reader
+    // happened to form: with interleaved lines that pairing renames a requirement
+    // the delta never named, under a name written for a different one.
+    if (plan.unpairedRenames.length > 0) {
+        const first = plan.unpairedRenames[0];
+        const missing = first.side === 'FROM' ? 'TO' : 'FROM';
+        throw new Error(`${specName} validation failed - RENAMED entry on line ${first.line} has no matching ${missing}: ` +
+            `for header "### Requirement: ${first.name}". ` +
+            `Write each rename as a FROM: line followed immediately by its TO: line.`);
+    }
+    // A well-formed requirement written outside every delta section is not
+    // applied. Say so here as well as in validate: archive is the last point at
+    // which the author can still notice, and the block reads exactly like one
+    // that would have applied.
+    for (const orphan of plan.orphanedRequirements) {
+        const where = orphan.section
+            ? `under "## ${orphan.section}"`
+            : 'above the first "## " section';
+        warn(`${specName} - requirement "${orphan.name}" (line ${orphan.line}) is ${where}, ` +
+            `which is not a delta section, so it was not applied. ` +
+            `Move it under ADDED/MODIFIED/REMOVED/RENAMED Requirements.`);
+    }
     // Pre-validate duplicates within sections
     const addedNames = new Set();
     for (const add of plan.added) {
@@ -287,6 +321,13 @@ export async function buildUpdatedSpec(update, changeName, options = {}) {
         if (nameToBlock.has(to)) {
             throw new Error(`${specName} RENAMED failed for header "### Requirement: ${r.to}" - target already exists`);
         }
+        // A target that differs from another requirement only in case or interior
+        // whitespace would leave two copies of one requirement. The source itself
+        // is exempt, so a case-only rename of a requirement stays allowed.
+        const targetNearMiss = [...nameToBlock.keys()].find((k) => k !== from && foldRequirementName(k) === foldRequirementName(to));
+        if (targetNearMiss !== undefined) {
+            throw new Error(`${specName} RENAMED failed for header "### Requirement: ${r.to}" - "### Requirement: ${nameToBlock.get(targetNearMiss).name}" already exists and differs only in case or spacing; choose a distinct name`);
+        }
         const block = nameToBlock.get(from);
         const newHeader = `### Requirement: ${to}`;
         const rawLines = block.raw.split('\n');
@@ -369,6 +410,15 @@ export async function buildUpdatedSpec(update, changeName, options = {}) {
             }
             throw new Error(`${specName} ADDED failed for header "### Requirement: ${add.name}" - already exists`);
         }
+        // A name that differs from an existing requirement only in case or
+        // interior whitespace is that requirement written again: adding it would
+        // leave two contradicting copies in the spec. Like the exact check above,
+        // this compares against the spec as it stands after the earlier operations,
+        // so a variant of a requirement this delta removed or renamed away is fine.
+        const nearMiss = [...nameToBlock.keys()].find((k) => foldRequirementName(k) === foldRequirementName(key));
+        if (nearMiss !== undefined) {
+            throw new Error(`${specName} ADDED failed for header "### Requirement: ${add.name}" - "### Requirement: ${nameToBlock.get(nearMiss).name}" already exists and differs only in case or spacing; use MODIFIED with that exact header to change it, or choose a distinct name`);
+        }
         nameToBlock.set(key, add);
         addedApplied++;
     }
@@ -422,11 +472,9 @@ export async function buildUpdatedSpec(update, changeName, options = {}) {
     // glued the heading to the Purpose paragraph and the first requirement, so
     // every archive rewrote a well-formatted spec into that shape. Separate
     // non-empty slices with one blank line instead.
-    const rebuilt = [parts.before.trimEnd(), parts.headerLine, reqBody, parts.after.trim()]
+    const rebuilt = collapseBlankRunsOutsideFences([parts.before.trimEnd(), parts.headerLine, reqBody, parts.after.trim()]
         .filter((s) => s !== '')
-        .join('\n\n')
-        .replace(/\n{3,}/g, '\n\n')
-        .trimEnd() + '\n';
+        .join('\n\n')).trimEnd() + '\n';
     return {
         rebuilt,
         counts: {
@@ -473,6 +521,76 @@ function firstForeignTail(raw) {
     }
     return undefined;
 }
+/**
+ * The column a line's content starts at, tabs expanded to a four-column stop.
+ * `prefix` is the text that precedes the content: a line's indentation, or a
+ * list item's indentation together with its marker.
+ */
+function contentColumn(prefix) {
+    let column = 0;
+    for (const char of prefix)
+        column += char === '\t' ? 4 - (column % 4) : 1;
+    return column;
+}
+/**
+ * A line that opens a block of its own: a blockquote, a thematic break, a list
+ * item, a table row, or raw HTML. CommonMark lets each of these interrupt a
+ * paragraph, so one written flush against a bullet starts something new rather
+ * than continuing it - and the audit has to name it rather than let it be
+ * deleted with the file. Headings interrupt too and are checked separately,
+ * since they are refused however they are indented.
+ */
+const INTERRUPTS_PARAGRAPH = /^ {0,3}(?:>|(?:[-*_][ \t]*){3,}$|(?:[-*+]|\d{1,9}[.)])(?:[ \t]|$)|[<|])/;
+/**
+ * A list item, spelled the way CommonMark spells one, with its marker and the
+ * space after it captured so a caller can measure the item's content column.
+ *
+ * Every marker, and only those. `+` is a list marker like `-` and `*`: a spec
+ * bulleted that way validates like any other, and naming only two of the three
+ * made every one of its scenario bullets unaccounted content, so such a
+ * capability could not be retired at all.
+ *
+ * The nine-digit cap is the other half of "only those": CommonMark stops an
+ * ordered marker at nine digits, so `1234567890.` opens a paragraph, not a
+ * list. It changes no verdict here, because a line this pattern rejects is
+ * weighed by the same rules either way; it is here so the audit and
+ * INTERRUPTS_PARAGRAPH cannot disagree about what a marker is. A line one of
+ * them calls a bullet and the other does not is read as both at once, and that
+ * disagreement is what a shared definition removes.
+ *
+ * Content after the marker is not required, so an empty `- ` still reads as
+ * the bullet it is rather than falling through to the leftovers. The captured
+ * group is the indent plus the marker plus its trailing space, which is the
+ * item's content column.
+ */
+const LIST_ITEM = /^(\s*(?:[-*+]|\d{1,9}[.)])\s+)/;
+/**
+ * Drop up to `columns` visual columns of leading whitespace, so a line inside a
+ * list item is classified by what it is *within* that item. A `## Retention`
+ * indented under `100. Step` is a heading; measured against the file's left
+ * margin instead, it reads as five spaces of nothing and was absorbed as
+ * continuation. A tab straddling the boundary is consumed whole, which can only
+ * make a line look more like a construct - the direction that refuses.
+ */
+function dropIndent(line, columns) {
+    let column = 0;
+    let index = 0;
+    while (index < line.length && column < columns) {
+        const char = line[index];
+        if (char === ' ')
+            column += 1;
+        else if (char === '\t')
+            column += 4 - (column % 4);
+        else
+            break;
+        index++;
+    }
+    return line.slice(index);
+}
+/** A heading in any form a spec can write one, ATX or raw HTML. */
+function isHeadingLine(line) {
+    return /^ {0,3}#{1,6}(?:[ \t]|$)/.test(line) || /^\s*<h[1-6]\b/i.test(line);
+}
 /**
  * The non-blank lines of a spec that are not part of what a retirement is able
  * to name: the title, the `## Purpose` section, the `## Requirements` header,
@@ -560,6 +678,18 @@ function contentTheMergeCannotName(parts) {
         // operational note below the last scenario be deleted unmentioned.
         let inScenarioBullets = false;
         let bulletsSeen = false;
+        // The content column of the list item the previous line opened or
+        // continued, or null when the last line was not part of one. A line
+        // indented to that column continues the item it sits under (#1780) - a
+        // repository that wraps its prose at a column limit writes most scenario
+        // bullets over two lines, and counting the second line as loose content
+        // made every such capability unretirable. Reset by a blank line, so an
+        // indented note written below the scenarios is still the author's own.
+        let listContentIndent = null;
+        // Whether the bullet's paragraph is still open, so a line that does not
+        // indent can still be continuing it. Closed by anything that ends a
+        // paragraph: a blank line, a fence, a heading, or a block of its own.
+        let paragraphOpen = false;
         for (let index = 0; index < lines.length; index++) {
             const line = lines[index];
             if (!line.trim()) {
@@ -567,29 +697,82 @@ function contentTheMergeCannotName(parts) {
                 // between a scenario header and its first bullet is not a boundary.
                 if (bulletsSeen)
                     inScenarioBullets = false;
+                listContentIndent = null;
+                paragraphOpen = false;
                 continue;
             }
             if (index === 0)
                 continue; // the `### Requirement:` header itself
+            const indent = contentColumn(/^[ \t]*/.exec(line)[0]);
+            // Indented to the item's content column: inside the item, whatever it
+            // holds - a nested list, a table, an indented quote.
+            const insideItem = listContentIndent !== null && indent >= listContentIndent;
+            // Every syntax test below reads the line as the item sees it. A wide
+            // marker (`100. `) pushes its content past the three columns Markdown
+            // constructs are allowed, so measuring from the file's left margin missed
+            // headings and block starts written inside such an item.
+            const withinItem = insideItem ? dropIndent(line, listContentIndent) : line;
+            // Not indented at all, but continuing the bullet's own paragraph inside a
+            // scenario's unbroken bullet run - how a hand-wrapped bullet is usually
+            // written. Absorbing it widens nothing: a sibling bullet in that same
+            // position is already read as the scenario's own, and a lazy line is part
+            // of the bullet above it where a sibling is merely next to it. Outside
+            // the run the indent is required, so a note bulleted below the scenarios
+            // and its own wrapped lines stay the author's.
+            const lazilyContinuesBullet = paragraphOpen && inScenarioBullets && !INTERRUPTS_PARAGRAPH.test(withinItem);
+            // A heading is a heading wherever it sits, so neither form absorbs one:
+            // `firstForeignTail` names the ATX spelling and the `before` pass names
+            // the raw HTML, and indenting a section under a bullet must not smuggle
+            // it past the audit.
+            const continuesListItem = (insideItem || lazilyContinuesBullet) && !isHeadingLine(withinItem);
             // Fenced lines render as a code block inside the requirement, so they are
             // its own content however they are spelled - a `### Requirement:` in an
             // example is not a heading to any reader. Flagging them made a spec that
             // merely documents a command unretirable.
-            if (mask[index])
+            if (mask[index]) {
+                // A fence that starts left of the item's content column has ended it,
+                // and a fence ends the paragraph wherever it sits - so what follows is
+                // not a lazy continuation of anything.
+                if (!insideItem)
+                    listContentIndent = null;
+                paragraphOpen = false;
                 continue;
+            }
+            // Checked ahead of the continuation branch: a setext underline turns the
+            // line above it into a heading, and indenting the pair under a bullet
+            // must not absorb them any more than an indented `#` line is absorbed.
             if (index > 1 &&
-                /^ {0,3}(?:=+|-+)\s*$/.test(line) &&
+                /^ {0,3}(?:=+|-+)\s*$/.test(withinItem) &&
                 lines[index - 1].trim()) {
                 leftovers.push(lines[index - 1].trim());
+                listContentIndent = null;
+                paragraphOpen = false;
                 continue;
             }
+            // A continuation of the list item above: indented to its content column
+            // with no blank line between. Whatever the item is, this line is part of
+            // it - accounted for when the item was, and already reported when it was
+            // not, so nothing is deleted unmentioned either way.
+            if (continuesListItem) {
+                // An indented nested list or quote is still inside the item, but it
+                // ended the bullet's paragraph - so a later unindented line is not
+                // continuing that paragraph either.
+                paragraphOpen = !INTERRUPTS_PARAGRAPH.test(withinItem);
+                continue;
+            }
+            // Any other line closes the item; a bullet opens the next one. The
+            // content column is the marker's own indent plus the marker itself, so a
+            // nested list and its own wrapped lines stay inside the item too.
+            const bullet = line.match(LIST_ITEM);
+            listContentIndent = bullet ? contentColumn(bullet[1]) : null;
+            paragraphOpen = bullet !== null;
             if (/^ {0,3}####\s+Scenario:/i.test(line)) {
                 seenScenario = true;
                 inScenarioBullets = true;
                 bulletsSeen = false;
                 continue;
             }
-            if (/^\s*(?:[-*]|\d+[.)])\s/.test(line)) {
+            if (bullet) {
                 if (inScenarioBullets) {
                     bulletsSeen = true;
                     continue;
@@ -609,6 +792,44 @@ function contentTheMergeCannotName(parts) {
     }
     return [...new Set(leftovers)];
 }
+/**
+ * Collapse runs of blank lines to a single blank line - everywhere except
+ * inside a fenced code block.
+ *
+ * The normalisation exists to tidy the seams between the slices this function
+ * rejoins. Applying it to the whole document also rewrote the inside of fenced
+ * code blocks, so a requirement documenting a sample with two consecutive blank
+ * lines had that sample silently edited on every archive. That matters for
+ * whitespace-significant content, and every other structural pass in this
+ * module is already fence-aware via `buildCodeFenceMask`.
+ *
+ * Only a truly empty line counts as blank, exactly as the `/\n{3,}/` it
+ * replaces did: a line of spaces was never collapsed and still is not.
+ */
+function collapseBlankRunsOutsideFences(content) {
+    const lines = content.split('\n');
+    const mask = buildCodeFenceMask(lines);
+    const kept = [];
+    let blankRun = 0;
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index];
+        if (mask[index]) {
+            blankRun = 0;
+            kept.push(line);
+            continue;
+        }
+        if (line === '') {
+            blankRun++;
+            if (blankRun > 1)
+                continue;
+            kept.push(line);
+            continue;
+        }
+        blankRun = 0;
+        kept.push(line);
+    }
+    return kept.join('\n');
+}
 function normalizeBlockRaw(raw) {
     return raw.replace(/\r\n?/g, '\n').trim();
 }
@@ -840,15 +1061,36 @@ export async function writeUpdatedSpec(update, rebuilt, counts, options = {}) {
 /** Blank out `<!-- ... -->` spans, preserving line count so indices stay aligned. */
 function maskHtmlComments(content) {
     const blank = (text) => text.replace(/[^\n]/g, ' ');
-    // `--!>` is a comment terminator as well as `-->`.
-    const masked = content.replace(/<!--[\s\S]*?--!?>/g, blank);
-    // A comment that is never closed runs to end of file, so everything after it
-    // is commented out too. Without this an unterminated `<!--` above a
-    // `## Purpose` left the commented-out header looking real (#1413).
-    const unterminated = masked.indexOf('<!--');
-    if (unterminated === -1)
-        return masked;
-    return masked.slice(0, unterminated) + blank(masked.slice(unterminated));
+    // Linear scan: every character is visited once. A `/<!--[\s\S]*?--!?>/g`
+    // replace re-scans to end of file from every `<!--`, which is quadratic on a
+    // spec dense in comment openers.
+    let out = '';
+    let index = 0;
+    for (;;) {
+        const open = content.indexOf('<!--', index);
+        if (open === -1)
+            return out + content.slice(index);
+        out += content.slice(index, open);
+        // `--!>` is a comment terminator as well as `-->`.
+        let close = -1;
+        for (let i = open + 4; i < content.length; i++) {
+            if (content.startsWith('-->', i)) {
+                close = i + 3;
+                break;
+            }
+            if (content.startsWith('--!>', i)) {
+                close = i + 4;
+                break;
+            }
+        }
+        // A comment that is never closed runs to end of file, so everything after
+        // it is commented out too. Without this an unterminated `<!--` above a
+        // `## Purpose` left the commented-out header looking real (#1413).
+        if (close === -1)
+            return out + blank(content.slice(open));
+        out += blank(content.slice(open, close));
+        index = close;
+    }
 }
 /**
  * Read the body of a `## Purpose` section, ignoring markdown that only appears

package/dist/core/store/git.d.ts

@@ -1,3 +1,29 @@
+/**
+ * Bounds every read-only git probe. Without a timeout a wedged network mount, an
+ * fsmonitor daemon, or a credential/GPG prompt hangs the CLI forever; without a
+ * raised maxBuffer a very large dirty tree makes `git status --porcelain` throw
+ * ENOBUFS, which the probes below would otherwise report as "no git facts".
+ * A probe writes nothing, so a hard kill is safe.
+ */
+export declare const GIT_EXEC_OPTIONS: {
+    readonly encoding: "utf8";
+    readonly timeout: 15000;
+    readonly killSignal: "SIGKILL";
+    readonly maxBuffer: number;
+};
+/**
+ * Writes get their own bounds, and deliberately NOT SIGKILL: git traps SIGTERM
+ * to remove `.git/index.lock` on its way out, and a signal it cannot catch
+ * leaves that lock behind - every later git command in the user's store then
+ * fails with "Another git process seems to be running", including the
+ * best-effort unstage below. The timeout is also far longer, because a signed
+ * commit can legitimately sit waiting on pinentry or a hardware key.
+ */
+export declare const GIT_WRITE_EXEC_OPTIONS: {
+    readonly encoding: "utf8";
+    readonly timeout: 120000;
+    readonly maxBuffer: number;
+};
 export declare function isGitRepositoryAtRoot(storeRoot: string): Promise<boolean>;
 export declare function initGitRepository(storeRoot: string): Promise<boolean>;
 /**
@@ -11,6 +37,13 @@ export declare function assertGitCommitIdentity(probeCwd: string): Promise<void>
  * Pathspecs may be files or directories.
  */
 export declare function commitStoreFiles(storeRoot: string, id: string, pathspecs: string[]): Promise<boolean>;
+/**
+ * A probe that hit a resource limit rather than an ordinary Git answer: the
+ * command was killed by the timeout above, or its output exceeded maxBuffer.
+ * Both produce the same `null` as "not a repository", so without this the CLI
+ * would quietly stop reporting facts it is capable of reporting.
+ */
+export declare function isProbeResourceFailure(error: unknown): boolean;
 export declare function gitHasCommits(storeRoot: string): Promise<boolean | null>;
 export declare function gitHasUncommittedChanges(storeRoot: string): Promise<boolean | null>;
 export declare function gitHasRemote(storeRoot: string): Promise<boolean | null>;

package/dist/core/store/git.js

@@ -4,7 +4,40 @@ import * as path from 'node:path';
 import { promisify } from 'node:util';
 import { StoreError } from './errors.js';
 const fs = nodeFs.promises;
-const execFileAsync = promisify(execFile);
+const rawExecFileAsync = promisify(execFile);
+/**
+ * Bounds every read-only git probe. Without a timeout a wedged network mount, an
+ * fsmonitor daemon, or a credential/GPG prompt hangs the CLI forever; without a
+ * raised maxBuffer a very large dirty tree makes `git status --porcelain` throw
+ * ENOBUFS, which the probes below would otherwise report as "no git facts".
+ * A probe writes nothing, so a hard kill is safe.
+ */
+export const GIT_EXEC_OPTIONS = {
+    encoding: 'utf8',
+    timeout: 15_000,
+    killSignal: 'SIGKILL',
+    maxBuffer: 16 * 1024 * 1024,
+};
+/**
+ * Writes get their own bounds, and deliberately NOT SIGKILL: git traps SIGTERM
+ * to remove `.git/index.lock` on its way out, and a signal it cannot catch
+ * leaves that lock behind - every later git command in the user's store then
+ * fails with "Another git process seems to be running", including the
+ * best-effort unstage below. The timeout is also far longer, because a signed
+ * commit can legitimately sit waiting on pinentry or a hardware key.
+ */
+export const GIT_WRITE_EXEC_OPTIONS = {
+    encoding: 'utf8',
+    timeout: 120_000,
+    maxBuffer: 16 * 1024 * 1024,
+};
+function execFileAsync(file, args, options = {}) {
+    return rawExecFileAsync(file, args, { ...GIT_EXEC_OPTIONS, ...options });
+}
+/** Same as execFileAsync, for commands that modify the user's repository. */
+function execGitWrite(args, options = {}) {
+    return rawExecFileAsync('git', args, { ...GIT_WRITE_EXEC_OPTIONS, ...options });
+}
 /**
  * Git mechanics for stores: repository detection, setup-time init and
  * commit, and the read-only facts doctor reports. Nothing here clones, pulls,
@@ -31,7 +64,7 @@ export async function initGitRepository(storeRoot) {
         return false;
     }
     try {
-        await execFileAsync('git', ['init'], { cwd: storeRoot });
+        await execGitWrite(['init'], { cwd: storeRoot });
     }
     catch (error) {
         throw new StoreError(`Failed to initialize Git repository: ${error instanceof Error ? error.message : String(error)}`, 'store_git_init_failed', {
@@ -74,13 +107,13 @@ export async function commitStoreFiles(storeRoot, id, pathspecs) {
         return false;
     }
     try {
-        await execFileAsync('git', ['add', '--', ...pathspecs], { cwd: storeRoot });
-        await execFileAsync('git', ['commit', '-m', `Initialize OpenSpec store ${id}`, '--', ...pathspecs], { cwd: storeRoot });
+        await execGitWrite(['add', '--', ...pathspecs], { cwd: storeRoot });
+        await execGitWrite(['commit', '-m', `Initialize OpenSpec store ${id}`, '--', ...pathspecs], { cwd: storeRoot });
     }
     catch (error) {
         // Best-effort unstage so a failed commit (gpg signing, hooks) does not
         // leave setup's files in the user's index after rollback deletes them.
-        await execFileAsync('git', ['rm', '--cached', '-r', '-f', '-q', '--', ...pathspecs], {
+        await execGitWrite(['rm', '--cached', '-r', '-f', '-q', '--', ...pathspecs], {
             cwd: storeRoot,
         }).catch(() => undefined);
         throw new StoreError(`Failed to create the initial store commit: ${error instanceof Error ? error.message : String(error)}`, 'store_git_commit_failed', {
@@ -90,12 +123,33 @@ export async function commitStoreFiles(storeRoot, id, pathspecs) {
     }
     return true;
 }
+/**
+ * A probe that hit a resource limit rather than an ordinary Git answer: the
+ * command was killed by the timeout above, or its output exceeded maxBuffer.
+ * Both produce the same `null` as "not a repository", so without this the CLI
+ * would quietly stop reporting facts it is capable of reporting.
+ */
+export function isProbeResourceFailure(error) {
+    if (typeof error !== 'object' || error === null)
+        return false;
+    const { code, killed, signal } = error;
+    return (code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' ||
+        code === 'ETIMEDOUT' ||
+        (killed === true && signal === 'SIGKILL'));
+}
 async function gitProbe(storeRoot, args) {
     try {
         const { stdout } = await execFileAsync('git', ['-C', storeRoot, ...args]);
         return stdout;
     }
-    catch {
+    catch (error) {
+        // "git is absent" and "this is not a repository" are expected answers and
+        // stay silent; a probe that timed out or overflowed its buffer is a
+        // degraded result the user should know about, since callers cannot tell
+        // the two apart from the null alone.
+        if (isProbeResourceFailure(error)) {
+            process.emitWarning(`git ${args.join(' ')} did not complete in ${storeRoot}; store Git facts are unavailable for this run.`, 'OpenSpecGitProbeWarning');
+        }
         return null;
     }
 }

package/dist/core/store/operations.d.ts

@@ -100,7 +100,7 @@ export declare function expandUserPath(inputPath: string): string;
  * no-ops), and always honoring an explicit --init-git/--no-init-git.
  */
 export declare function resolveSetupGitEnabled(prepared: PreparedStoreSetup, initGit?: boolean): boolean;
-export declare function prepareStoreSetup(input: Pick<SetupStoreInput, 'id' | 'path' | 'allowInsideGitRepository' | 'remote'>): Promise<PreparedStoreSetup>;
+export declare function prepareStoreSetup(input: Pick<SetupStoreInput, 'id' | 'path' | 'initGit' | 'allowInsideGitRepository' | 'remote'>): Promise<PreparedStoreSetup>;
 export declare function setupPreparedStore(prepared: PreparedStoreSetup, input?: Pick<SetupStoreInput, 'initGit'>): Promise<StoreMutationResult>;
 export declare function setupStore(input: SetupStoreInput): Promise<StoreMutationResult>;
 export declare function registerExistingStore(input: RegisterExistingStoreInput): Promise<StoreMutationResult>;

package/dist/core/store/operations.js

@@ -8,7 +8,7 @@ import { classifyOpenSpecDir, storePointerProblem, } from '../project-config.js'
 import { ANCHORED_OPENSPEC_DIRS, DIRECTORY_ANCHOR_FILE_NAME, OPENSPEC_ROOT_DIR, ensureOpenSpecRoot, inspectOpenSpecRoot, rollbackCreatedPaths, } from '../openspec-root.js';
 import { STORE_METADATA_DIR_NAME, getStoreMetadataDir, getStoreMetadataPath, getStoreRegistryPath, listStoreRegistryEntries, readStoreRegistryState, readOptionalStoreMetadataState, resolveGitStoreBackendConfig, validateStoreId, writeStoreMetadataState, } from './foundation.js';
 import { StoreError, makeStoreDiagnostic } from './errors.js';
-import { assertGitCommitIdentity, commitStoreFiles, gitDirectoryHasTrackedFiles, gitHasCommits, gitHasRemote, gitHasUncommittedChanges, gitOriginUrl, initGitRepository, isGitRepositoryAtRoot, } from './git.js';
+import { GIT_EXEC_OPTIONS, assertGitCommitIdentity, commitStoreFiles, gitDirectoryHasTrackedFiles, gitHasCommits, gitHasRemote, gitHasUncommittedChanges, gitOriginUrl, initGitRepository, isGitRepositoryAtRoot, } from './git.js';
 import { getStoreRootForBackend, assertNoRegisteredStoreConflict, commitStoreRegistration, getRegisteredStore, listRegisteredStores, unregisterStoreRegistration, } from './registry.js';
 const fs = nodeFs.promises;
 const execFileAsync = promisify(execFile);
@@ -106,12 +106,7 @@ async function findContainingGitRepositoryRoot(storeRoot) {
             : null;
     };
     try {
-        const { stdout } = await execFileAsync('git', [
-            '-C',
-            nearestParent,
-            'rev-parse',
-            '--show-toplevel',
-        ]);
+        const { stdout } = await execFileAsync('git', ['-C', nearestParent, 'rev-parse', '--show-toplevel'], GIT_EXEC_OPTIONS);
         return gitRootContainsStore(stdout.trim());
     }
     catch {
@@ -244,9 +239,10 @@ async function prepareSetupPlan(input) {
         });
     }
     // Stores may be Git-backed, but creating one inside an implementation
-    // repo is almost always an accidental nested-repo setup.
+    // repo is almost always an accidental nested-repo setup. --no-init-git
+    // creates no repository, so there is nothing to nest.
     await assertSetupPathIsNotNestedInGitRepo(storeRoot, {
-        allowInsideGitRepository: input.allowInsideGitRepository,
+        allowInsideGitRepository: input.allowInsideGitRepository || input.initGit === false,
     });
     let metadata = null;
     let backend;
@@ -594,6 +590,29 @@ async function assertSafeToDeleteStoreRoot(storeRoot, id) {
     }
     return { exists: true };
 }
+/**
+ * Deleting a store root takes everything under it, including any other
+ * store registered inside it (a shared store vendored as a submodule, for
+ * example). `store remove <id>` never asked for that store to go.
+ */
+function assertNoRegisteredStoreInside(storeRoot, id, others) {
+    const root = normalizeRegistryPathForComparison(storeRoot);
+    const nested = others.filter((other) => {
+        const relative = path.relative(root, normalizeRegistryPathForComparison(other.storeRoot));
+        return (relative.length > 0 &&
+            relative !== '..' &&
+            !relative.startsWith(`..${path.sep}`) &&
+            !path.isAbsolute(relative));
+    });
+    if (nested.length === 0)
+        return;
+    const listed = nested.map((other) => `'${other.id}' (${other.storeRoot})`).join(', ');
+    const unregister = nested.map((other) => `openspec store unregister ${other.id}`).join(', then ');
+    throw new StoreError(`Store remove refuses to delete ${storeRoot}: it contains ${nested.length === 1 ? 'another registered store' : 'other registered stores'}: ${listed}.`, 'store_remove_contains_registered_store', {
+        target: 'store.root',
+        fix: `Unregister or remove ${nested.length === 1 ? 'that store' : 'those stores'} first (${unregister}), or run "openspec store unregister ${id}" to forget '${id}' without deleting files.`,
+    });
+}
 export async function removeStore(target) {
     const id = validateStoreId(target.id);
     const diagnostics = [];
@@ -606,9 +625,12 @@ export async function removeStore(target) {
         id,
         expectedBackend: target.backend,
         globalDataDir: target.globalDataDir,
-        beforeCommit: async (entry) => {
+        beforeCommit: async (entry, remaining) => {
             const safeTarget = await assertSafeToDeleteStoreRoot(entry.storeRoot, id);
             rootMissing = !safeTarget.exists;
+            if (safeTarget.exists) {
+                assertNoRegisteredStoreInside(entry.storeRoot, id, remaining);
+            }
         },
     });
     if (rootMissing) {

package/dist/core/store/registry.d.ts

@@ -15,7 +15,8 @@ export interface GetRegisteredStoreInput extends ResolveRegisteredStoreInput {
 export interface UnregisterStoreInput extends StorePathOptions {
     id: string;
     expectedBackend?: StoreGitBackendConfig;
-    beforeCommit?: (entry: RegisteredStoreEntry) => Promise<void>;
+    /** Runs under the registry lock, with the registrations that will remain. */
+    beforeCommit?: (entry: RegisteredStoreEntry, remaining: RegisteredStoreEntry[]) => Promise<void>;
 }
 export type ListRegisteredStoresOptions = StorePathOptions;
 export interface RegisteredStoreEntry extends StoreRegistryEntry {

package/dist/core/store/registry.js

@@ -236,7 +236,11 @@ export async function unregisterStoreRegistration(input) {
             ...result.removed,
             storeRoot: getStoreRootForBackend(result.removed.backend),
         };
-        await input.beforeCommit?.(removedEntry);
+        const remaining = listStoreRegistryEntries(result.next).map((entry) => ({
+            ...entry,
+            storeRoot: getStoreRootForBackend(entry.backend),
+        }));
+        await input.beforeCommit?.(removedEntry, remaining);
         removed = result.removed;
         return result.next;
     }, { globalDataDir: input.globalDataDir });