@fission-ai/openspec 1.13.0 → 1.13.1

package/dist/core/validation/validator.js

@@ -6,13 +6,14 @@ import { ChangeParser } from '../parsers/change-parser.js';
 import { findSpecUpdates, buildUpdatedSpec } from '../specs-apply.js';
 import { MIN_PURPOSE_LENGTH, MAX_REQUIREMENT_TEXT_LENGTH, VALIDATION_MESSAGES } from './constants.js';
 import { parseDeltaSpec, foldRequirementName, normalizeRequirementName, extractRequirementsSection, findMissingCurrentScenarios, } from '../parsers/requirement-blocks.js';
-import { extractRequirementBody as extractRequirementBodyShared, containsShallOrMust as containsShallOrMustShared, countScenarios as countScenariosShared, } from '../parsers/requirement-text.js';
+import { extractRequirementBody as extractRequirementBodyShared, containsShallOrMust as containsShallOrMustShared, countScenarios as countScenariosShared, countEmptyScenarios, } from '../parsers/requirement-text.js';
 import { findMainSpecStructureIssues } from '../parsers/spec-structure.js';
 import { FileSystemUtils } from '../../utils/file-system.js';
-import { discoverSpecFiles, hasAnyFileUnder } from '../../utils/spec-discovery.js';
+import { discoverSpecFiles, findUnreadDeltaFiles, hasAnyFileUnder } from '../../utils/spec-discovery.js';
 import { METADATA_FILENAME, readSkipSpecsMarker, resolveSchemaForChange, } from '../../utils/change-metadata.js';
 import { resolveTaskFilesForChange } from '../../utils/task-progress.js';
 import { findTaskNumberingIssues } from './task-numbering.js';
+import { findMissingTaskCheckboxIssues } from './task-checkboxes.js';
 import { findPurposePlaceholderIssue } from './purpose-placeholder.js';
 import { getPackageSchemasDir, getSchemaDir } from '../artifact-graph/index.js';
 export class Validator {
@@ -174,6 +175,34 @@ export class Validator {
                             : `Header "### ${stray.header}" in ${stray.section} is not a "### Requirement:" header and is ignored by validation. Use "### Requirement: ${stray.header}" if it should be validated as a requirement.`,
                     });
                 }
+                // A FROM:/TO: line that never formed a pair. Reported here so the author
+                // learns at authoring time, rather than having archive either skip the
+                // rename or apply it to a requirement they never named.
+                for (const unpaired of plan.unpairedRenames) {
+                    const missing = unpaired.side === 'FROM' ? 'TO' : 'FROM';
+                    issues.push({
+                        level: 'ERROR',
+                        path: entryPath,
+                        line: unpaired.line,
+                        message: `RENAMED ${unpaired.side}: "${unpaired.name}" has no matching ${missing}: line. Write each rename as a FROM: line followed immediately by its TO: line.`,
+                    });
+                }
+                // A well-formed requirement written outside every delta section. The
+                // reader only looks inside the four delta sections, so this block is
+                // ignored - reported as a WARNING rather than an ERROR because a
+                // handful of pre-format archived changes still carry this shape, and
+                // the fix is to move the block, not to reject the change outright.
+                for (const orphan of plan.orphanedRequirements) {
+                    const where = orphan.section
+                        ? `under "## ${orphan.section}"`
+                        : 'above the first "## " section';
+                    issues.push({
+                        level: 'WARNING',
+                        path: entryPath,
+                        line: orphan.line,
+                        message: `Requirement "${orphan.name}" is ${where}, which is not a delta section, so it is ignored. Move it under "## ADDED Requirements", "## MODIFIED Requirements", "## REMOVED Requirements", or "## RENAMED Requirements".`,
+                    });
+                }
                 const sectionNames = [];
                 if (plan.sectionPresence.added)
                     sectionNames.push('## ADDED Requirements');
@@ -225,7 +254,7 @@ export class Validator {
                     }
                     const scenarioCount = this.countScenarios(block.raw);
                     if (scenarioCount < 1) {
-                        issues.push({ level: 'ERROR', path: entryPath, message: `ADDED "${block.name}" must include at least one scenario` });
+                        issues.push({ level: 'ERROR', path: entryPath, message: `ADDED "${block.name}" must include at least one scenario${this.emptyScenarioHint(block.raw)}` });
                     }
                 }
                 // Validate MODIFIED
@@ -257,7 +286,7 @@ export class Validator {
                     }
                     const scenarioCount = this.countScenarios(block.raw);
                     if (scenarioCount < 1) {
-                        issues.push({ level: 'ERROR', path: entryPath, message: `MODIFIED "${block.name}" must include at least one scenario` });
+                        issues.push({ level: 'ERROR', path: entryPath, message: `MODIFIED "${block.name}" must include at least one scenario${this.emptyScenarioHint(block.raw)}` });
                     }
                 }
                 // Run archive's scenario-loss check here too, so the change fails at
@@ -358,6 +387,17 @@ export class Validator {
                 throw error;
             }
         }
+        // The same drop happens to delta sections in any other file the merge
+        // path does not read (specs/<capability>.md, a note beside spec.md),
+        // while the artifact graph's specs/**/*.md glob counts it as written.
+        const unreadDeltaFiles = await findUnreadDeltaFiles(specsDir);
+        for (const file of unreadDeltaFiles) {
+            issues.push({
+                level: 'ERROR',
+                path: file.path,
+                message: `Delta spec found at specs/${file.path}. Delta specs must be a spec.md inside a capability folder — this file is ignored when the change is applied or archived. Move its requirements into specs/${file.expected}.`,
+            });
+        }
         for (const { path: specPath, sections } of emptySectionSpecs) {
             issues.push({
                 level: 'ERROR',
@@ -397,10 +437,10 @@ export class Validator {
         if (skipSpecs && specsDirHasFiles) {
             issues.push({ level: 'ERROR', path: 'file', message: VALIDATION_MESSAGES.CHANGE_SKIP_SPECS_CONFLICT });
         }
-        // The root-level error already names the file and the fix; adding "No
-        // deltas found" on top would contradict it, since the deltas are sitting in
-        // the file just reported.
-        if (totalDeltas === 0 && !hasRootLevelSpec) {
+        // The root-level and unread-file errors already name the file and the fix;
+        // adding "No deltas found" on top would contradict them, since the deltas
+        // are sitting in the files just reported.
+        if (totalDeltas === 0 && !hasRootLevelSpec && unreadDeltaFiles.length === 0) {
             if (skipSpecs && !specsDirHasFiles) {
                 issues.push({ level: 'INFO', path: 'file', message: VALIDATION_MESSAGES.CHANGE_SKIP_SPECS_ACCEPTED });
             }
@@ -409,56 +449,120 @@ export class Validator {
             }
         }
         if (options.projectRoot) {
-            issues.push(...await this.collectTaskNumberingIssues(changeDir, options.projectRoot));
+            issues.push(...await this.collectTaskFileIssues(changeDir, options.projectRoot));
         }
         return this.createReport(issues);
     }
-    async collectTaskNumberingIssues(changeDir, projectRoot) {
+    /**
+     * Lints the change's task files.
+     *
+     * Two checks with deliberately different reach. Checkbox formatting is read
+     * from whatever the change's own schema declares as its tracked task output,
+     * because every schema's progress, apply and archive behavior is computed by
+     * counting checkboxes in exactly those files. Numbering stays scoped to the
+     * built-in `spec-driven` schema, whose template is the one that numbers tasks
+     * in the first place.
+     *
+     * The checkbox check never falls back to a bare top-level `tasks.md`: a file
+     * no artifact declares is not a tracked task list, and warning about its
+     * formatting would be a guess about a file the tool does not read.
+     */
+    async collectTaskFileIssues(changeDir, projectRoot) {
+        let trackedFiles;
         try {
-            const schemaName = resolveSchemaForChange(changeDir, undefined, projectRoot).replace(/\.ya?ml$/, '');
-            const schemaDir = getSchemaDir(schemaName, projectRoot);
-            const builtInSchemaDir = path.join(getPackageSchemasDir(), 'spec-driven');
-            if (schemaName !== 'spec-driven' ||
-                schemaDir === null ||
-                FileSystemUtils.canonicalizeExistingPath(schemaDir) !==
-                    FileSystemUtils.canonicalizeExistingPath(builtInSchemaDir)) {
-                return [];
-            }
+            trackedFiles = resolveTaskFilesForChange(changeDir, projectRoot);
         }
         catch {
             return [];
         }
-        let taskFiles;
-        try {
-            taskFiles = resolveTaskFilesForChange(changeDir, projectRoot);
-        }
-        catch {
-            return [];
+        const files = trackedFiles.length > 0 ? trackedFiles : [path.join(changeDir, 'tasks.md')];
+        const { documents, unreadable } = await this.readTaskDocuments(changeDir, files);
+        const toWarning = (issue) => ({
+            level: 'WARNING',
+            path: issue.path,
+            line: issue.line,
+            message: issue.message,
+        });
+        const issues = [];
+        // "No file here holds a checkbox" is a claim about the whole tracked set, so
+        // a file that exists but could not be read withdraws it: the checkboxes may
+        // be in exactly that file. `validate --archived` is the surface that reports
+        // an unreadable task file loudly (#205); this one must not guess from it.
+        if (trackedFiles.length > 0 && unreadable === 0) {
+            issues.push(...findMissingTaskCheckboxIssues(documents).map(toWarning));
         }
-        if (taskFiles.length === 0) {
-            taskFiles = [path.join(changeDir, 'tasks.md')];
+        if (this.usesBuiltInSpecDrivenSchema(changeDir, projectRoot)) {
+            issues.push(...findTaskNumberingIssues(documents).map(toWarning));
         }
+        return issues;
+    }
+    /**
+     * Reads task files into change-relative documents, counting the ones that
+     * exist but could not be read. A file that is simply absent is not counted:
+     * the resolver only returns files it found, so the remaining read failures
+     * are permissions and I/O, and a check that reasons over the whole set needs
+     * to know its evidence was incomplete.
+     */
+    async readTaskDocuments(changeDir, files) {
         const documents = [];
-        for (const taskFile of taskFiles) {
+        let unreadable = 0;
+        for (const file of files) {
             let content;
             try {
-                content = await fs.readFile(taskFile, 'utf-8');
+                content = await fs.readFile(file, 'utf-8');
             }
-            catch {
+            catch (error) {
+                if (error?.code !== 'ENOENT')
+                    unreadable++;
                 continue;
             }
-            documents.push({
-                path: FileSystemUtils.toPosixPath(path.relative(changeDir, taskFile)),
-                content,
-            });
+            documents.push({ path: this.taskDocumentPath(changeDir, file), content });
         }
         documents.sort((left, right) => left.path.localeCompare(right.path));
-        return findTaskNumberingIssues(documents).map((issue) => ({
-            level: 'WARNING',
-            path: issue.path,
-            line: issue.line,
-            message: issue.message,
-        }));
+        return { documents, unreadable };
+    }
+    /**
+     * Names a task file relative to its change, POSIX-separated.
+     *
+     * Both sides are canonicalized first. `resolveArtifactOutputs` hands back real
+     * paths, while `changeDir` carries whatever spelling the caller resolved, and
+     * the two can differ without being apart: on Windows a short 8.3 alias
+     * (`RUNNER~1`) against its expanded form turned `tasks.md` into a
+     * `../../../..`-prefixed absolute path in the report, and a symlinked project
+     * directory does the same elsewhere. Canonicalizing recovers the real
+     * relationship. The Windows CI job is the regression guard — the mismatch
+     * cannot be staged on POSIX, where the spawned CLI's `process.cwd()` is
+     * already physical.
+     *
+     * A path that still escapes would be a resolver bug rather than a spelling
+     * difference, but the report must never leak an absolute filesystem path, so
+     * the file name stands in.
+     */
+    taskDocumentPath(changeDir, file) {
+        const relative = path.relative(FileSystemUtils.canonicalizeExistingPath(changeDir), FileSystemUtils.canonicalizeExistingPath(file));
+        const escapes = relative === '' || relative.startsWith('..') || path.isAbsolute(relative);
+        return escapes ? path.basename(file) : FileSystemUtils.toPosixPath(relative);
+    }
+    /**
+     * True when the change resolves to the package's own `spec-driven` schema. A
+     * project schema that merely reuses the name is not it, so checks written
+     * against the built-in template never fire on someone else's task format.
+     */
+    usesBuiltInSpecDrivenSchema(changeDir, projectRoot) {
+        try {
+            const schemaName = resolveSchemaForChange(changeDir, undefined, projectRoot).replace(/\.ya?ml$/, '');
+            if (schemaName !== 'spec-driven')
+                return false;
+            const schemaDir = getSchemaDir(schemaName, projectRoot);
+            if (schemaDir === null)
+                return false;
+            const builtInSchemaDir = path.join(getPackageSchemasDir(), 'spec-driven');
+            return (FileSystemUtils.canonicalizeExistingPath(schemaDir) ===
+                FileSystemUtils.canonicalizeExistingPath(builtInSchemaDir));
+        }
+        catch {
+            return false;
+        }
     }
     /**
      * Report MODIFIED requirements whose block omits a scenario the main spec
@@ -797,6 +901,16 @@ export class Validator {
         // example is not a real scenario. Drop the header line (index 0).
         return countScenariosShared(blockRaw.split('\n').slice(1));
     }
+    /**
+     * Why a requirement with a visible scenario header still has no scenario:
+     * the header has no body, and the spec path archive validates against does
+     * not count it. Empty when the block has no bare scenario header.
+     */
+    emptyScenarioHint(blockRaw) {
+        if (countEmptyScenarios(blockRaw.split('\n').slice(1)) === 0)
+            return '';
+        return ' (a scenario header with no body under it does not count; add its steps, e.g. "- **WHEN** ..." and "- **THEN** ...")';
+    }
     formatSectionList(sections) {
         if (sections.length === 0)
             return '';

package/dist/core/version-check.d.ts

@@ -1,12 +1,14 @@
 /**
- * The registry to ask: only the environment variable npm exports (under
- * `npm run`, or an explicit export). Deliberately not a `registry=` line from
- * any .npmrc — letting file contents choose the destination of an outbound
- * request is a flow worth avoiding for a convenience this small, and a project
- * file would travel with a cloned repository. Anyone on a private mirror can
- * export `npm_config_registry`, or turn the check off entirely.
+ * The registry to ask. A configured registry is honored only over TLS: a
+ * cleartext hop would aim the request at a link-local or internal address and
+ * let anyone on the path choose the "newer version" answer.
+ *
+ * A rejected registry disables the check rather than falling back to public
+ * npm. Falling back would send a request an organization on an internal mirror
+ * deliberately avoided, and would then report a version resolved against a
+ * registry the eventual `npm install -g` does not use.
  */
-export declare function registryUrl(): string;
+export declare function registryUrl(): string | null;
 /**
  * Compares two semver-ish versions. Returns 1 when a > b, -1 when a < b, 0
  * otherwise. Prereleases sort below their release (1.7.0-beta.1 < 1.7.0).
@@ -92,6 +94,11 @@ export declare function buildUpgradeCommandLines(installDir: string | null, proj
  * that may not be the one on PATH, a project dependency belongs to that
  * project's package manager, an npx/dlx cache has nothing to upgrade, and a
  * source checkout is not an install at all.
+ *
+ * A non-default registry is also disqualifying. `npm install -g` resolves
+ * against whatever `npm_config_registry` says, which npm may have read from a
+ * cloned repository's .npmrc — so such a registry may still inform the check,
+ * but must never be the thing that offers to install a global package.
  */
 export declare function canSelfUpgrade(installDir: string | null, projectPath: string): boolean;
 /**

package/dist/core/version-check.js

@@ -5,7 +5,8 @@ import path from 'path';
 import { createRequire } from 'module';
 import chalk from 'chalk';
 import { isCiEnvironment } from '../utils/ci.js';
-import { getGlobalConfig } from './global-config.js';
+import { isTelemetryOptedOutByEnv } from '../telemetry/opt-out.js';
+import { getGlobalConfig, isGlobalConfigUnreadable } from './global-config.js';
 const require = createRequire(import.meta.url);
 const { name: PACKAGE_NAME, version: OPENSPEC_VERSION } = require('../../package.json');
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
@@ -29,9 +30,7 @@ const SAFE_VERSION = /^\d{1,10}\.\d{1,10}\.\d{1,10}(?:-[0-9A-Za-z.-]{1,64})?(?:\
 function isCheckEnabled() {
     if (process.env.OPENSPEC_NO_UPDATE_CHECK !== undefined)
         return false;
-    if (process.env.DO_NOT_TRACK === '1')
-        return false;
-    if (process.env.OPENSPEC_TELEMETRY === '0')
+    if (isTelemetryOptedOutByEnv())
         return false;
     if (isCiEnvironment())
         return false;
@@ -40,21 +39,53 @@ function isCheckEnabled() {
     // Same config opt-out as telemetry (env remains the hard override above).
     if (getGlobalConfig().telemetry?.enabled === false)
         return false;
+    // A config that cannot be parsed may be hiding that opt-out.
+    if (isGlobalConfigUnreadable())
+        return false;
     return true;
 }
 /**
- * The registry to ask: only the environment variable npm exports (under
- * `npm run`, or an explicit export). Deliberately not a `registry=` line from
- * any .npmrc — letting file contents choose the destination of an outbound
- * request is a flow worth avoiding for a convenience this small, and a project
- * file would travel with a cloned repository. Anyone on a private mirror can
- * export `npm_config_registry`, or turn the check off entirely.
+ * The configured registry, if npm exported one. Not trustworthy: npm exports
+ * every config source it read, including a `registry=` line in a
+ * repository-local .npmrc that travels with a clone.
  */
-export function registryUrl() {
+function configuredRegistry() {
     const configured = process.env.npm_config_registry?.trim();
-    const base = configured && /^https?:\/\//i.test(configured) ? configured : DEFAULT_REGISTRY;
+    return configured ? configured : undefined;
+}
+/**
+ * The registry to ask. A configured registry is honored only over TLS: a
+ * cleartext hop would aim the request at a link-local or internal address and
+ * let anyone on the path choose the "newer version" answer.
+ *
+ * A rejected registry disables the check rather than falling back to public
+ * npm. Falling back would send a request an organization on an internal mirror
+ * deliberately avoided, and would then report a version resolved against a
+ * registry the eventual `npm install -g` does not use.
+ */
+export function registryUrl() {
+    const configured = configuredRegistry();
+    if (configured && !/^https:\/\//i.test(configured))
+        return null;
+    const base = configured ?? DEFAULT_REGISTRY;
     return `${base.replace(/\/+$/, '')}/${PACKAGE_NAME}/latest`;
 }
+/**
+ * True when the check is talking to the public npm registry. Read from the raw
+ * env var, not from registryUrl(), so a registry that was rejected above still
+ * disqualifies a self-upgrade instead of looking like the default.
+ */
+function isDefaultRegistry() {
+    const configured = configuredRegistry();
+    if (!configured)
+        return true;
+    try {
+        return new URL(configured).origin === new URL(DEFAULT_REGISTRY).origin;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Compares two prerelease tags per SemVer: dot-separated identifiers compared
  * one by one, numeric identifiers numerically (so beta.10 > beta.2), numeric
@@ -141,7 +172,12 @@ function fetchLatestVersion() {
         };
         let url;
         try {
-            url = new URL(registryUrl());
+            const resolved = registryUrl();
+            if (resolved === null) {
+                resolve(null);
+                return;
+            }
+            url = new URL(resolved);
         }
         catch {
             resolve(null);
@@ -169,10 +205,13 @@ function fetchLatestVersion() {
                     redirectsLeft -= 1;
                     try {
                         const next = new URL(location, target);
-                        // Never follow a downgrade to plain http: a MITM on the reply
-                        // would control the "newer version" answer.
-                        const downgrade = target.protocol === 'https:' && next.protocol === 'http:';
-                        if (!downgrade && (next.protocol === 'http:' || next.protocol === 'https:')) {
+                        // Cross-host is allowed - that is the whole point of following a
+                        // redirect for a mirror or corporate front-end - but never off
+                        // TLS: a MITM on a cleartext hop would control the "newer
+                        // version" answer, and the reply cannot install anything on its
+                        // own (canSelfUpgrade refuses a non-default registry, and the
+                        // version is re-validated against a strict pattern).
+                        if (next.protocol === 'https:') {
                             send(next);
                             return;
                         }
@@ -492,10 +531,17 @@ function loadSpawn() {
  * that may not be the one on PATH, a project dependency belongs to that
  * project's package manager, an npx/dlx cache has nothing to upgrade, and a
  * source checkout is not an install at all.
+ *
+ * A non-default registry is also disqualifying. `npm install -g` resolves
+ * against whatever `npm_config_registry` says, which npm may have read from a
+ * cloned repository's .npmrc — so such a registry may still inform the check,
+ * but must never be the thing that offers to install a global package.
  */
 export function canSelfUpgrade(installDir, projectPath) {
     if (!installDir)
         return false;
+    if (!isDefaultRegistry())
+        return false;
     if (isEphemeralRunnerInstall(installDir))
         return false;
     // Both anchors matter: `openspec update ../other` from a project that owns

package/dist/core/worksets.js

@@ -175,7 +175,7 @@ export function worksetNotFoundError(name, state) {
     });
 }
 export function withWorkset(state, workset) {
-    if (state.worksets[workset.name] !== undefined) {
+    if (Object.prototype.hasOwnProperty.call(state.worksets, workset.name)) {
         throw new StoreError(`Workset '${workset.name}' already exists.`, 'workset_exists', {
             target: 'workset.name',
             fix: `Choose another name, or remove it first: openspec workset remove ${workset.name}`,
@@ -193,7 +193,7 @@ export function withWorkset(state, workset) {
     };
 }
 export function withoutWorkset(state, name) {
-    if (state.worksets[name] === undefined) {
+    if (!Object.prototype.hasOwnProperty.call(state.worksets, name)) {
         throw worksetNotFoundError(name, state);
     }
     const remaining = { ...state.worksets };
@@ -226,8 +226,10 @@ export function listWorksets(state) {
         .sort((a, b) => a.name.localeCompare(b.name));
 }
 export function getWorkset(state, name) {
-    const entry = state.worksets[name];
-    return entry === undefined ? null : toWorkset(name, entry);
+    if (!Object.prototype.hasOwnProperty.call(state.worksets, name)) {
+        return null;
+    }
+    return toWorkset(name, state.worksets[name]);
 }
 /**
  * The generated .code-workspace content: members in saved order with

package/dist/prompts/searchable-multi-select.d.ts

@@ -1,6 +1,11 @@
 interface Choice {
     name: string;
     value: string;
+    /**
+     * Extra terms the search box matches, for choices users look for by a word
+     * the name does not spell (see #653). Never rendered.
+     */
+    searchAliases?: string[];
     description?: string;
     configured?: boolean;
     detected?: boolean;
@@ -12,6 +17,8 @@ interface Config {
     choices: Choice[];
     pageSize?: number;
     validate?: (selected: string[]) => boolean | string;
+    /** Shown when a search matches nothing, so the list is not a dead end. */
+    emptyHint?: string;
 }
 /**
  * A searchable multi-select prompt with visible search box,

package/dist/prompts/searchable-multi-select.js

@@ -1,4 +1,11 @@
 import chalk from 'chalk';
+/**
+ * True when every character is printable, so the text can go in the search box.
+ * `\u007f` is DEL, which sorts above the printable range.
+ */
+function isPrintable(text) {
+    return text.length > 0 && [...text].every((char) => char >= ' ' && char !== '\u007f');
+}
 /**
  * Create the searchable multi-select prompt.
  * Uses dynamic import to prevent pre-commit hook hangs (see #367).
@@ -6,7 +13,7 @@ import chalk from 'chalk';
 async function createSearchableMultiSelect() {
     const { createPrompt, useState, useKeypress, useMemo, usePrefix, isEnterKey, isBackspaceKey, isUpKey, isDownKey, } = await import('@inquirer/core');
     return createPrompt((config, done) => {
-        const { message, choices, pageSize = 15, validate } = config;
+        const { message, choices, pageSize = 15, validate, emptyHint } = config;
         const [searchText, setSearchText] = useState('');
         const [selectedValues, setSelectedValues] = useState(() => choices.filter(c => c.preSelected).map(c => c.value));
         const [cursor, setCursor] = useState(0);
@@ -17,9 +24,10 @@ async function createSearchableMultiSelect() {
         const filteredChoices = useMemo(() => {
             if (!searchText.trim())
                 return choices;
-            const term = searchText.toLowerCase();
+            const term = searchText.trim().toLowerCase();
             return choices.filter((c) => c.name.toLowerCase().includes(term) ||
-                c.value.toLowerCase().includes(term));
+                c.value.toLowerCase().includes(term) ||
+                (c.searchAliases ?? []).some((alias) => alias.toLowerCase().includes(term)));
         }, [searchText, choices]);
         const selectedSet = useMemo(() => new Set(selectedValues), [selectedValues]);
         const choiceMap = useMemo(() => new Map(choices.map((c) => [c.value, c])), [choices]);
@@ -72,9 +80,28 @@ async function createSearchableMultiSelect() {
                 setCursor(Math.min(filteredChoices.length - 1, cursor + 1));
                 return;
             }
-            // Character input - handle printable characters
-            if (key.name && key.name.length === 1 && !key.ctrl) {
-                setSearchText(searchText + key.name);
+            // Character input - handle printable characters.
+            // readline reports punctuation (`.`, `-`, `/`) only in `sequence`, leaving
+            // `name` undefined, so keying off `name` alone silently dropped every
+            // non-alphanumeric character the user typed.
+            // `@inquirer/core` types only `name` and `ctrl`; readline emits more.
+            const event = key;
+            if (event.ctrl || event.meta)
+                return;
+            // Requiring every character to be printable drops escape sequences
+            // (arrows, function keys), tab, escape and delete. readline splits a
+            // paste into one key per character, so a pasted space still toggles.
+            const typed = typeof event.sequence === 'string' && isPrintable(event.sequence)
+                ? event.sequence
+                : // Only the sequence may be multi-character: readline `name`s such as
+                    // 'tab' and 'escape' are printable strings but not typed input.
+                    typeof event.name === 'string' &&
+                        event.name.length === 1 &&
+                        isPrintable(event.name)
+                        ? event.name
+                        : undefined;
+            if (typed) {
+                setSearchText(searchText + typed);
                 setCursor(0);
             }
         });
@@ -102,6 +129,8 @@ async function createSearchableMultiSelect() {
         // List
         if (filteredChoices.length === 0) {
             lines.push(chalk.yellow('  No matches'));
+            if (emptyHint)
+                lines.push(chalk.dim(`  ${emptyHint}`));
         }
         else {
             // Calculate pagination

package/dist/telemetry/config.js

@@ -5,7 +5,7 @@
 import { promises as fs } from 'fs';
 import path from 'path';
 import os from 'os';
-import { GLOBAL_CONFIG_DIR_NAME, GLOBAL_CONFIG_FILE_NAME, getGlobalConfigDir, } from '../core/global-config.js';
+import { GLOBAL_CONFIG_DIR_NAME, GLOBAL_CONFIG_FILE_NAME, getGlobalConfigDir, isConfigRootObject, unreadableGlobalConfigMessage, } from '../core/global-config.js';
 // Constants
 export const CONFIG_DIR_NAME = GLOBAL_CONFIG_DIR_NAME;
 export const CONFIG_FILE_NAME = GLOBAL_CONFIG_FILE_NAME;
@@ -18,7 +18,14 @@ function getLegacyConfigPath() {
 async function readConfigFile(configPath) {
     try {
         const content = await fs.readFile(configPath, 'utf-8');
-        return { status: 'ok', config: JSON.parse(content) };
+        const parsed = JSON.parse(content);
+        // Valid JSON that is not an object carries no settings to merge into, and
+        // spreading it would replace the file (a string even spreads to numeric
+        // character keys). Same predicate the rest of the CLI refuses to save over.
+        if (!isConfigRootObject(parsed)) {
+            return { status: 'invalid', config: {} };
+        }
+        return { status: 'ok', config: parsed };
     }
     catch (error) {
         if (error.code === 'ENOENT') {
@@ -108,6 +115,11 @@ export async function readConfig() {
  */
 export async function writeConfig(updates) {
     const configPath = getConfigPath();
+    // Never write over a file that did not parse: the merge below would start
+    // from an empty object and replace every setting in it with these updates.
+    if ((await readConfigFile(configPath)).status === 'invalid') {
+        throw new Error(unreadableGlobalConfigMessage(configPath));
+    }
     // Read existing config and merge
     const existing = await readConfig();
     const merged = { ...existing, ...updates };

package/dist/telemetry/index.d.ts

@@ -2,11 +2,12 @@
  * Check if telemetry is enabled.
  *
  * Precedence (first match wins):
- * 1. OPENSPEC_TELEMETRY=0 → disabled
- * 2. DO_NOT_TRACK=1 → disabled
+ * 1. OPENSPEC_TELEMETRY set to anything but an on-value (1/true/yes/on) → disabled
+ * 2. DO_NOT_TRACK set to anything but an off-value (0/false/no/off) → disabled
  * 3. CI set to a truthy/on value → disabled (same rule as version-check)
  * 4. global config telemetry.enabled === false → disabled
- * 5. otherwise enabled (unset config means on; opt-out model)
+ * 5. global config file exists but cannot be parsed → disabled
+ * 6. otherwise enabled (unset config means on; opt-out model)
  *
  * Kept synchronous so call sites need not become async. Reads config via
  * sync getGlobalConfig() rather than async getTelemetryConfig().