@fission-ai/openspec 1.14.2 → 1.14.3

package/dist/commands/change.js

@@ -10,6 +10,7 @@ import { getActiveChangeIds } from '../utils/item-discovery.js';
 import { describeNestedChange, findNestedChangesIn, } from '../utils/nested-change.js';
 import { getTaskProgressForChange } from '../utils/task-progress.js';
 import { FileSystemUtils } from '../utils/file-system.js';
+import { assertDiscoveredSpecFile } from '../utils/spec-path-containment.js';
 import { discoverSpecFiles } from '../utils/spec-discovery.js';
 import { foldRequirementName, parseDeltaSpec, } from '../core/parsers/requirement-blocks.js';
 import { extractRequirementBlock, diffRequirementBlock, buildRenameMap, } from '../utils/requirement-diff.js';
@@ -168,7 +169,7 @@ export class ChangeCommand {
             const mainSpecPath = path.join(mainSpecsDir, ...capability.split('/'), 'spec.md');
             let mainContent = null;
             try {
-                FileSystemUtils.assertPathWithin(mainSpecsDir, mainSpecPath);
+                assertDiscoveredSpecFile(mainSpecsDir, mainSpecPath);
                 mainContent = await fs.readFile(mainSpecPath, 'utf-8');
             }
             catch (error) {

package/dist/commands/spec.js

@@ -5,7 +5,7 @@ import { Validator } from '../core/validation/validator.js';
 import { isInteractive } from '../utils/interactive.js';
 import { getSpecIds } from '../utils/item-discovery.js';
 import { discoverSpecFiles } from '../utils/spec-discovery.js';
-import { FileSystemUtils } from '../utils/file-system.js';
+import { assertDiscoveredSpecFile } from '../utils/spec-path-containment.js';
 const SPECS_DIR = 'openspec/specs';
 function assertSpecPath(specsDir, specPath) {
     const relativePath = path.relative(path.resolve(specsDir), path.resolve(specPath));
@@ -14,15 +14,7 @@ function assertSpecPath(specsDir, specPath) {
         path.isAbsolute(relativePath)) {
         throw new Error(`Path is outside the allowed directory: ${specPath}`);
     }
-    try {
-        // Preserve confined spec.md links, including links to a sibling capability.
-        FileSystemUtils.assertPathWithin(specsDir, specPath);
-    }
-    catch {
-        // A capability directory may intentionally be a monorepo symlink. Treat it
-        // as the trust root while still rejecting a link outside that capability.
-        FileSystemUtils.assertPathWithin(path.dirname(specPath), specPath);
-    }
+    assertDiscoveredSpecFile(specsDir, specPath);
 }
 function parseSpecFromFile(specsDir, specPath, specId) {
     assertSpecPath(specsDir, specPath);

package/dist/commands/validate.js

@@ -4,7 +4,7 @@ import { describeNestedChange, findNestedChangesIn, NESTED_CHANGE_ISSUE_MARKER,
 import { Validator } from '../core/validation/validator.js';
 import { VALIDATION_MESSAGES } from '../core/validation/constants.js';
 import { resolveRootForCommand, toRootOutput, withStoreFlag, isStoreSelectedRoot, } from '../core/root-selection.js';
-import { isInteractive, resolveNoInteractive } from '../utils/interactive.js';
+import { canRenderSpinner, isInteractive, resolveNoInteractive } from '../utils/interactive.js';
 import { getSpecIds } from '../utils/item-discovery.js';
 import { getAvailableChanges } from './workflow/shared.js';
 import { nearestMatches } from '../utils/match.js';
@@ -356,7 +356,7 @@ export class ValidateCommand {
         }
     }
     async runBulkValidation(root, scope, opts) {
-        const spinner = !opts.json && !opts.noInteractive ? ora('Validating...').start() : undefined;
+        const spinner = !opts.json && isInteractive(opts) && canRenderSpinner() ? ora('Validating...').start() : undefined;
         const [changeIds, specIds] = await Promise.all([
             scope.changes ? this.listChangeIds(root) : Promise.resolve([]),
             scope.specs ? getSpecIds(root.path) : Promise.resolve([]),
@@ -527,7 +527,7 @@ export class ValidateCommand {
         // List first (may throw on a real archive-read failure), then start the
         // spinner so a thrown error never leaves a spinner spinning.
         const ids = await this.listArchivedChangeIds(root);
-        const spinner = !opts.json && !opts.noInteractive ? ora('Validating archived changes...').start() : undefined;
+        const spinner = !opts.json && isInteractive(opts) && canRenderSpinner() ? ora('Validating archived changes...').start() : undefined;
         // The archive is append-only and can hold thousands of changes; a single
         // run resolves them all under one constant projectRoot (root.path), so
         // memoize the schema→glob lookup to avoid re-parsing the same schema.yaml

package/dist/core/artifact-graph/outputs.js

@@ -1,12 +1,29 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import fg from 'fast-glob';
+import { expand } from 'brace-expansion';
+import picomatch from 'picomatch';
+import * as globby from 'tinyglobby';
 import { FileSystemUtils } from '../../utils/file-system.js';
 const EXTGLOB_RE = /[!*+?@]\([^(]*\)/u;
 const BRACE_EXPANSION_SEPARATORS_RE = /,|\.\./u;
-// braces <=3.0.3 (fast-glob > micromatch) has no depth guard (GHSA-vfj7-8cjw-p6xm),
-// so reject nesting no real artifact pattern needs before it reaches the parser.
+const DUPLICATE_SLASH_RE = /(?!^)\/{2,}/gu;
+// Deeply nested braces can overflow a recursive expander. Reject nesting no real
+// artifact pattern needs before brace-expansion or tinyglobby see the pattern.
 const MAX_BRACE_NESTING = 16;
+// Nesting depth alone does not bound the work: `{a,b}` repeated 20 times is
+// only one level deep and expands to 1,048,576 patterns, which exhausts the
+// heap. fast-glob never expanded that far because micromatch compiled the
+// braces to a regex. No real artifact pattern needs more than a few hundred.
+const MAX_BRACE_EXPANSIONS = 1024;
+const ARTIFACT_GLOB_OPTIONS = {
+    absolute: true,
+    // Braces are expanded first so `{draft}` left behind stays a literal name.
+    braceExpansion: false,
+    // fast-glob migration: directory patterns must not grow a trailing `/**`.
+    expandDirectories: false,
+    followSymbolicLinks: true,
+    onlyFiles: true,
+};
 function assertBraceNesting(pattern) {
     // Mirror the braces parser: `[...]` and quoted runs are literal, `(` nests like
     // `{`, and a closer only closes the innermost group of its own kind.
@@ -39,6 +56,166 @@ function assertBraceNesting(pattern) {
         }
     }
 }
+function isDynamicSegment(segment) {
+    return segment.includes('*') || segment.includes('?') || segment.includes('[')
+        || EXTGLOB_RE.test(segment);
+}
+/**
+ * Static directory prefix of an expanded pattern, equivalent to the `base`
+ * fast-glob's generateTasks used to reject `../` before walking.
+ */
+function globBase(pattern) {
+    const segments = pattern.split('/');
+    if (segments.length <= 1)
+        return '.';
+    const base = [];
+    for (const segment of segments.slice(0, -1)) {
+        if (segment === '')
+            continue;
+        if (isDynamicSegment(segment))
+            break;
+        base.push(segment);
+    }
+    // An absolute pattern must stay absolute, or `path.resolve(changeDir, base)`
+    // rebases `/etc/*` inside the change directory and the containment check
+    // passes for a pattern that globs the filesystem root.
+    if (pattern.startsWith('/'))
+        return `/${base.join('/')}`;
+    return base.length > 0 ? base.join('/') : '.';
+}
+// brace-expansion 5 leaves the rest of a pattern literal when a non-expanding
+// group such as `{draft}` comes before a range. Expand one real group at a time.
+// NUL-prefixed so no `generates` value can forge them: `resolveArtifactOutputPath`
+// runs `path.join` first, which rejects a NUL byte. A single-character sentinel
+// such as U+0001 is a legal filename character, and a pattern containing one
+// would come back out of the expander as a brace.
+const LITERAL_BRACE_OPEN = '\u0000<';
+const LITERAL_BRACE_CLOSE = '\u0000>';
+function hasTopLevelExpansion(body) {
+    let depth = 0;
+    for (let index = 0; index < body.length; index += 1) {
+        const char = body[index];
+        if (char === '{')
+            depth += 1;
+        else if (char === '}')
+            depth = Math.max(0, depth - 1);
+        else if (depth === 0) {
+            if (char === ',')
+                return true;
+            if (char === '.' && body[index + 1] === '.')
+                return true;
+        }
+    }
+    return false;
+}
+function findTopLevelExpansion(pattern) {
+    const stack = [];
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index];
+        if (char === '{') {
+            stack.push(index);
+        }
+        else if (char === '}' && stack.length > 0) {
+            const open = stack.pop();
+            if (open === undefined)
+                continue;
+            // Only the outermost group that actually expands. brace-expansion expands
+            // its nested groups in one linear pass. Peeling the innermost `{a,b}` first
+            // turns `{a,{a,{a,b}}}` into a binary tree, so a 16-deep pattern does not
+            // finish before the test timeout.
+            if (stack.length > 0)
+                continue;
+            const body = pattern.slice(open + 1, index);
+            if (!hasTopLevelExpansion(body)) {
+                // `{prefix{a,b}}` has no separator of its own, so the outer braces stay
+                // literal. Keep scanning inside them; a nested group may still expand.
+                const nested = findTopLevelExpansion(body);
+                if (!nested)
+                    continue;
+                return {
+                    pre: `${pattern.slice(0, open + 1)}${nested.pre}`,
+                    body: nested.body,
+                    post: `${nested.post}${pattern.slice(index)}`,
+                };
+            }
+            return { pre: pattern.slice(0, open), body, post: pattern.slice(index + 1) };
+        }
+    }
+    return null;
+}
+function assertExpansionBudget(pattern, count) {
+    if (count <= MAX_BRACE_EXPANSIONS)
+        return;
+    // A pattern this wide can run to thousands of characters; quote only its start.
+    const shown = pattern.length > 80 ? `${pattern.slice(0, 80)}...` : pattern;
+    throw new Error(`Artifact output pattern expands to more than ${MAX_BRACE_EXPANSIONS} patterns: ${shown}`);
+}
+function expandArtifactBraces(pattern) {
+    if (pattern.includes('\u0000')) {
+        throw new Error('Artifact output pattern contains a NUL byte');
+    }
+    const pending = [pattern];
+    const finished = [];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current === undefined)
+            break;
+        const group = findTopLevelExpansion(current);
+        if (!group) {
+            finished.push(current.replaceAll(LITERAL_BRACE_OPEN, '{').replaceAll(LITERAL_BRACE_CLOSE, '}'));
+            continue;
+        }
+        const wrapped = `{${group.body}}`;
+        // `max` makes this budget the binding one. Without it `{1..1000000000}`
+        // allocates brace-expansion's own 100,000-result default before the check
+        // below rejects it. `max` truncates silently, so ask for one result more
+        // than the budget allows: a result that long means the pattern is over
+        // budget rather than fully expanded. A truncated group never looks literal,
+        // because its first alternative is not the group itself.
+        const remaining = Math.max(MAX_BRACE_EXPANSIONS - (pending.length + finished.length), 0);
+        const alternatives = expand(wrapped, { max: remaining + 1 });
+        if (alternatives.length === 1 && alternatives[0] === wrapped) {
+            pending.push(`${group.pre}${LITERAL_BRACE_OPEN}${group.body}${LITERAL_BRACE_CLOSE}${group.post}`);
+            continue;
+        }
+        // Checked before the push so the budget bounds memory, not just the result.
+        assertExpansionBudget(pattern, pending.length + finished.length + alternatives.length);
+        for (const alternative of alternatives) {
+            pending.push(`${group.pre}${alternative}${group.post}`);
+        }
+    }
+    const normalized = finished
+        .map((value) => value.replace(DUPLICATE_SLASH_RE, '/'))
+        .filter((value) => value.length > 0);
+    return normalized.length > 0 ? normalized : [pattern];
+}
+/**
+ * One directory level. picomatch matches the segment; readdir keeps symlink
+ * entries tinyglobby would drop when followSymbolicLinks is false.
+ */
+function listDirectoryMatches(directory, segment) {
+    let entries;
+    try {
+        entries = fs.readdirSync(directory, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    const isMatch = picomatch(segment, {
+        dot: false,
+        nobrace: true,
+        noglobstar: true,
+        posix: true,
+    });
+    const names = [];
+    for (const entry of entries) {
+        if (isMatch(entry.name))
+            names.push(entry.name);
+    }
+    return names;
+}
 function hasBraceExpansion(pattern) {
     const openings = [];
     for (let index = 0; index < pattern.length; index += 1) {
@@ -94,12 +271,16 @@ function assertGlobDirectoryTraversal(changeDir, currentDir, directorySegments,
             // `**` may consume no directory at all.
             assertGlobDirectoryTraversal(changeDir, canonicalDir, directorySegments, segmentIndex + 1, visited, canonicalChangeDir, ancestors);
         }
-        const matches = fg.sync(segment === '**' ? '*' : segment, {
-            cwd: canonicalDir,
-            onlyFiles: false,
-            followSymbolicLinks: false,
-            deep: 1,
-        });
+        // `.` and `..` are not directory entries. Resolve them directly so a
+        // `**/../` pattern is confined before any glob runs.
+        if (segment === '' || segment === '.' || segment === '..') {
+            const candidate = path.resolve(canonicalDir, segment === '' ? '.' : segment);
+            const canonicalCandidate = FileSystemUtils.canonicalizeExistingPath(candidate);
+            FileSystemUtils.assertPathWithin(canonicalChangeDir, canonicalCandidate);
+            assertGlobDirectoryTraversal(changeDir, canonicalCandidate, directorySegments, segmentIndex + 1, visited, canonicalChangeDir, ancestors);
+            return;
+        }
+        const matches = listDirectoryMatches(canonicalDir, segment === '**' ? '*' : segment);
         for (const match of matches) {
             const candidate = path.join(canonicalDir, match);
             try {
@@ -139,27 +320,21 @@ export function resolveArtifactOutputs(changeDir, generates) {
             return [];
         }
     }
-    const normalizedPattern = FileSystemUtils.toPosixPath(generates);
-    const globOptions = {
+    const normalizedPattern = FileSystemUtils.toPosixPath(generates).replace(DUPLICATE_SLASH_RE, '/');
+    // Expand braces before any filesystem access. tinyglobby has no generateTasks,
+    // and a `../` alternative is invisible until the braces are expanded.
+    const patterns = expandArtifactBraces(normalizedPattern);
+    for (const pattern of patterns) {
+        FileSystemUtils.assertPathWithin(changeDir, path.resolve(changeDir, globBase(pattern)));
+    }
+    for (const pattern of patterns) {
+        assertGlobDirectoryTraversal(changeDir, changeDir, pattern.split('/').slice(0, -1));
+    }
+    const matches = globby
+        .globSync(patterns, {
         cwd: changeDir,
-        onlyFiles: true,
-        absolute: true,
-        // Preserve linked artifact directories; confine traversal and concrete matches.
-        followSymbolicLinks: true,
-    };
-    // Task generation expands braces without accessing the filesystem. Validate
-    // every task base before globbing, including paths introduced by expansion.
-    const tasks = fg.generateTasks(normalizedPattern, globOptions);
-    for (const task of tasks) {
-        FileSystemUtils.assertPathWithin(changeDir, path.resolve(changeDir, task.base));
-    }
-    for (const task of tasks) {
-        for (const positivePattern of task.positive) {
-            assertGlobDirectoryTraversal(changeDir, changeDir, positivePattern.split('/').slice(0, -1));
-        }
-    }
-    const matches = fg
-        .sync(normalizedPattern, globOptions)
+        ...ARTIFACT_GLOB_OPTIONS,
+    })
         .map((match) => {
         const normalizedMatch = path.normalize(match);
         FileSystemUtils.assertPathWithin(changeDir, normalizedMatch);

package/dist/core/completions/completion-provider.js

@@ -75,7 +75,7 @@ export class CompletionProvider {
         }
         // Fetch fresh data. The resolver (and the yaml and zod it parses schemas
         // with) loads only here: completing changes or specs never needs it, and
-        // the artifact-graph barrel would also pull in fast-glob.
+        // the artifact-graph barrel would also pull in tinyglobby.
         const { listSchemas } = await import('../artifact-graph/resolver.js');
         const schemaNames = listSchemas(this.projectRoot);
         // Update cache

package/dist/core/specs-apply.js

@@ -15,6 +15,7 @@ import { MarkdownParser } from './parsers/markdown-parser.js';
 import { MIN_PURPOSE_LENGTH, PURPOSE_PLACEHOLDER_PREFIX, PURPOSE_PLACEHOLDER_SUFFIX, } from './validation/constants.js';
 import { discoverSpecFiles } from '../utils/spec-discovery.js';
 import { FileSystemUtils } from '../utils/file-system.js';
+import { assertSpecFileWithin } from '../utils/spec-path-containment.js';
 import { matchLineEnding } from '../utils/line-endings.js';
 function isLexicallyWithin(allowedDirectory, targetPath) {
     const relative = path.relative(path.resolve(allowedDirectory), path.resolve(targetPath));
@@ -29,7 +30,7 @@ function resolveTrustedSpecPath(specsRoot, specPath, projectRoot) {
     }
     try {
         // Preserve spec.md links that remain inside the overall specs tree.
-        FileSystemUtils.assertPathWithin(specsRoot, specPath);
+        assertSpecFileWithin(specsRoot, specPath);
         const root = FileSystemUtils.canonicalizeExistingPath(specsRoot);
         return {
             root,
@@ -52,7 +53,7 @@ function resolveTrustedSpecPath(specsRoot, specPath, projectRoot) {
             process.emitWarning(`Capability '${path.basename(path.dirname(specPath))}' links outside the project; writing to ${root}`, 'OpenSpecExternalSpecWrite');
         }
         const file = path.join(root, path.basename(specPath));
-        FileSystemUtils.assertPathWithin(root, file);
+        assertSpecFileWithin(root, file);
         return { root, file };
     }
 }
@@ -60,7 +61,7 @@ function assertTrustedSpecPath(root, specPath) {
     if (FileSystemUtils.canonicalizeExistingPath(root) !== path.resolve(root)) {
         throw new Error(`Path is outside the allowed directory: ${specPath}`);
     }
-    FileSystemUtils.assertPathWithin(root, specPath);
+    assertSpecFileWithin(root, specPath);
 }
 // -----------------------------------------------------------------------------
 // Public API
@@ -1042,6 +1043,14 @@ export async function pruneEmptyDirs(startDir, boundaryDir) {
  */
 export async function writeUpdatedSpec(update, rebuilt, counts, options = {}) {
     assertTrustedSpecPath(update.targetRoot, update.target);
+    // Pin what the assertion just checked. A capability's spec.md may be a link
+    // to the file the project keeps elsewhere, so the write follows a link by
+    // design - and resolving it once, here, is what keeps that from becoming a
+    // redirect: a link repointed after this line, including from inside
+    // `beforeMutate`, cannot send the write to a file nothing verified. The
+    // bytes still land in the same place a path-based write would have put them,
+    // which keeps the in-place semantics below intact.
+    const verifiedTarget = FileSystemUtils.canonicalizeExistingPath(update.target);
     // Create target directory if needed
     const targetDir = path.dirname(update.target);
     await fs.mkdir(targetDir, { recursive: true });
@@ -1051,17 +1060,26 @@ export async function writeUpdatedSpec(update, rebuilt, counts, options = {}) {
     // requirement moved. A spec that does not exist yet stays LF.
     // Only a missing file means "no convention to match". Swallowing every error
     // would read an existing but unreadable spec as absent and rewrite it as LF.
-    const previous = await fs.readFile(update.target, 'utf-8').catch((error) => {
+    const previous = await fs.readFile(verifiedTarget, 'utf-8').catch((error) => {
         if (error.code === 'ENOENT')
             return undefined;
         throw error;
     });
     const toWrite = previous === undefined ? rebuilt : matchLineEnding(rebuilt, previous);
     await options.beforeMutate?.();
+    // `beforeMutate` awaits arbitrary work, so it is the widest gap between the
+    // check above and the write below. Re-check there, and refuse unless the
+    // target still resolves to the very file that was verified: pinning a
+    // pathname is not enough on its own, because the pinned path can itself be
+    // replaced by a link to somewhere else.
+    assertTrustedSpecPath(update.targetRoot, update.target);
+    if (FileSystemUtils.canonicalizeExistingPath(update.target) !== verifiedTarget) {
+        throw new Error(`Spec target for '${update.id}' changed before it could be written: ${update.target}`);
+    }
     // Preserve the established in-place write semantics: symlink referents,
     // hard-linked specs, ACLs, extended attributes, and filesystems without hard
     // links must continue to behave as they did before capability retirement.
-    await fs.writeFile(update.target, toWrite);
+    await fs.writeFile(verifiedTarget, toWrite);
     if (options.silent)
         return;
     const specName = update.id;

package/dist/core/templates/workflows/continue-change.js

@@ -14,8 +14,8 @@ const PLANNING_COMPLETE_HANDOFF = optionalWorkflow('apply', 'You can now impleme
  */
 const PARTIAL_ARTIFACT_CHECK = `**Before anything else, finish a partly written artifact**:
    - An artifact whose output is a glob pattern (e.g. \`specs/**/*.md\`) reads \`done\` as soon as one matching file exists, so a run interrupted while writing its files leaves it \`done\` with some still missing
-   - For each such \`done\` artifact, first get its instructions and read any completed dependencies needed to determine the expected files. Then compare those files with \`artifactPaths.<id>.existingOutputPaths\`. For spec-driven's \`specs\`, read the proposal and check for one \`specs/<capability-path>/spec.md\` per capability it lists; resolve each expected path against \`changeRoot\` before comparing path identity
-   - If any are missing, write only the missing files, and STOP - that counts as this invocation's ONE artifact. If you cannot tell whether a file was left out on purpose, ask the user`;
+   - For each such \`done\` artifact, first get its instructions and read any completed dependencies needed to determine the expected files. Then compare those files with \`artifactPaths.<id>.existingOutputPaths\`. For spec-driven's \`specs\`, read the proposal and check for one \`specs/<capability-path>/spec.md\` per capability it lists; resolve each expected path against \`changeRoot\` before comparing path identity, and verify each one remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists
+   - Never write an expected path that fails that check; stop and tell the user. If any are missing, write only the missing files, each at its checked path - when the \`instruction\` field delegates creation to a skill or command, invoke it only if it can write each file to its checked path; otherwise stop and tell the user - and STOP - that counts as this invocation's ONE artifact. If you cannot tell whether a file was left out on purpose, ask the user`;
 export function getContinueChangeSkillTemplate() {
     return {
         name: 'openspec-continue-change',
@@ -88,10 +88,13 @@ ${PROJECT_ROOT_GUARD}
      - \`skipped\`/\`warning\`: present when the change declares skip_specs and this artifact must NOT be created - pick another artifact
    - **Create the artifact file**:
      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
-     - If the \`instruction\` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at \`resolvedOutputPath\`
-     - Otherwise use \`template\` as the structure - fill in its sections
-     - Apply \`context\` and \`rules\` as constraints when writing - but do NOT copy them into the file
-     - Write to the \`resolvedOutputPath\` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
+     - Choose the output path before creating anything. If the \`resolvedOutputPath\` specified in instructions is a glob pattern, choose a concrete path inside \`changeRoot\` using the schema instruction and the change's context, and verify it remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists; if it does not, stop and tell the user. Otherwise the output path is \`resolvedOutputPath\`
+     - If the \`instruction\` field delegates creation to a specific skill or command, invoke it only if it can write the artifact to that output path; otherwise stop and tell the user
+     - Otherwise, write it yourself:
+       - Use \`template\` as the structure - fill in its sections
+       - Apply \`context\` and \`rules\` as constraints when writing - but do NOT copy them into the file
+       - Write the file to that output path
+     - Either way, verify the artifact file exists at that output path
    - Show what was created and what's now unlocked
    - STOP after creating ONE artifact
 
@@ -119,7 +122,7 @@ After each invocation, show:
 
 The artifact types and their purpose depend on the schema. The \`instruction\` field from the instructions output is the authoritative guidance for each artifact - follow it even when the artifact has a familiar name (proposal.md, tasks.md, etc.), since custom schemas may define different content or a different process for the same file names.
 
-If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly.
+If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly - but only once you have chosen and checked the output path, and only if it can write there.
 
 **Guardrails**
 - Create ONE artifact per invocation
@@ -210,10 +213,13 @@ ${PROJECT_ROOT_GUARD}
      - \`skipped\`/\`warning\`: present when the change declares skip_specs and this artifact must NOT be created - pick another artifact
    - **Create the artifact file**:
      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
-     - If the \`instruction\` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at \`resolvedOutputPath\`
-     - Otherwise use \`template\` as the structure - fill in its sections
-     - Apply \`context\` and \`rules\` as constraints when writing - but do NOT copy them into the file
-     - Write to the \`resolvedOutputPath\` specified in instructions. If it is a glob pattern, choose the concrete file path using the schema instruction and the change's context
+     - Choose the output path before creating anything. If the \`resolvedOutputPath\` specified in instructions is a glob pattern, choose a concrete path inside \`changeRoot\` using the schema instruction and the change's context, and verify it remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists; if it does not, stop and tell the user. Otherwise the output path is \`resolvedOutputPath\`
+     - If the \`instruction\` field delegates creation to a specific skill or command, invoke it only if it can write the artifact to that output path; otherwise stop and tell the user
+     - Otherwise, write it yourself:
+       - Use \`template\` as the structure - fill in its sections
+       - Apply \`context\` and \`rules\` as constraints when writing - but do NOT copy them into the file
+       - Write the file to that output path
+     - Either way, verify the artifact file exists at that output path
    - Show what was created and what's now unlocked
    - STOP after creating ONE artifact
 
@@ -241,7 +247,7 @@ After each invocation, show:
 
 The artifact types and their purpose depend on the schema. The \`instruction\` field from the instructions output is the authoritative guidance for each artifact - follow it even when the artifact has a familiar name (proposal.md, tasks.md, etc.), since custom schemas may define different content or a different process for the same file names.
 
-If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly.
+If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly - but only once you have chosen and checked the output path, and only if it can write there.
 
 **Guardrails**
 - Create ONE artifact per invocation

package/dist/core/templates/workflows/explore.js

@@ -156,7 +156,7 @@ If the user asks you to capture the exploration as a new change, that request is
 
 1. Run \`openspec new change "<name>"\` (with \`--store <id>\` when applicable) before creating any artifacts. Never create a new change directory under \`openspec/changes/\` by hand; the CLI scaffold creates required metadata such as \`.openspec.yaml\`. Keep the selected \`--store <id>\` on every applicable follow-up \`status\` and \`instructions\` command.
 2. Run \`openspec status --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is \`ready\`, run \`openspec instructions "<artifact-id>" --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own \`instruction\` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run \`openspec instructions "<prerequisite-id>" --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store) for that prerequisite whether it is \`ready\` or \`blocked\`. If its own \`instruction\` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
-3. Follow the returned \`template\` and \`instruction\` fields. Read completed dependency files listed in \`dependencies\`, and apply \`context\` and \`rules\` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to \`resolvedOutputPath\`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
+3. Follow the returned \`template\` and \`instruction\` fields. Read completed dependency files listed in \`dependencies\`, and apply \`context\` and \`rules\` as constraints without copying them into the artifact. Choose the output path before creating anything: when \`resolvedOutputPath\` is a glob, use the instruction to choose a concrete path inside \`changeRoot\` and verify it remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists; if it does not, stop and tell the user. Otherwise the output path is \`resolvedOutputPath\`. If the instruction delegates creation to a specific skill or command, invoke it only if it can write the artifact to that output path; otherwise stop and tell the user. Otherwise write the artifact to that output path. Verify that the selected concrete output exists at that output path.
 4. After creating each artifact, re-run \`openspec status --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store) and continue until every requested artifact is \`done\`, \`skipped\`, or was deliberately skipped because its own \`instruction\` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still \`blocked\` only because you deliberately skipped a conditional prerequisite, run \`openspec instructions "<artifact-id>" --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
 
 Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status. When the requested capture is done, stop there and name where the work continues: ${CAPTURE_PLANNING_HANDOFF}, and ${CAPTURE_APPLY_HANDOFF}. Capturing artifacts never starts implementing them.
@@ -491,7 +491,7 @@ If the user asks you to capture the exploration as a new change, that request is
 
 1. Run \`openspec new change "<name>"\` (with \`--store <id>\` when applicable) before creating any artifacts. Never create a new change directory under \`openspec/changes/\` by hand; the CLI scaffold creates required metadata such as \`.openspec.yaml\`. Keep the selected \`--store <id>\` on every applicable follow-up \`status\` and \`instructions\` command.
 2. Run \`openspec status --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is \`ready\`, run \`openspec instructions "<artifact-id>" --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own \`instruction\` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run \`openspec instructions "<prerequisite-id>" --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store) for that prerequisite whether it is \`ready\` or \`blocked\`. If its own \`instruction\` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
-3. Follow the returned \`template\` and \`instruction\` fields. Read completed dependency files listed in \`dependencies\`, and apply \`context\` and \`rules\` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to \`resolvedOutputPath\`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
+3. Follow the returned \`template\` and \`instruction\` fields. Read completed dependency files listed in \`dependencies\`, and apply \`context\` and \`rules\` as constraints without copying them into the artifact. Choose the output path before creating anything: when \`resolvedOutputPath\` is a glob, use the instruction to choose a concrete path inside \`changeRoot\` and verify it remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists; if it does not, stop and tell the user. Otherwise the output path is \`resolvedOutputPath\`. If the instruction delegates creation to a specific skill or command, invoke it only if it can write the artifact to that output path; otherwise stop and tell the user. Otherwise write the artifact to that output path. Verify that the selected concrete output exists at that output path.
 4. After creating each artifact, re-run \`openspec status --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store) and continue until every requested artifact is \`done\`, \`skipped\`, or was deliberately skipped because its own \`instruction\` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still \`blocked\` only because you deliberately skipped a conditional prerequisite, run \`openspec instructions "<artifact-id>" --change "<name>" --json\` (append the confirmed \`--store "<id>"\` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
 
 Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status. When the requested capture is done, stop there and name where the work continues: ${CAPTURE_PLANNING_HANDOFF}, and ${CAPTURE_APPLY_HANDOFF}. Capturing artifacts never starts implementing them.

package/dist/core/templates/workflows/ff-change.js

@@ -73,8 +73,9 @@ ${PROJECT_ROOT_GUARD}
         - Identify the target project from the request and project context; the planning home may be separate from the code. If the target is unclear, ask. For greenfield or non-code changes, inspect the available structure and relevant documents. If source is unavailable, state the limitation and ask when it materially affects the plan.
         - Ground scope, approach, and tasks in what you find. Distinguish observed behavior from assumptions and proposed additions; surface conflicts with existing specs instead of silently deciding which is correct.
         - Do this discovery now, rather than leaving generic "explore the codebase" or "make a plan" tasks for implementation. Keep any necessary follow-up investigation specific to an unresolved question.
-      - If the \`instruction\` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at \`resolvedOutputPath\`
-      - Otherwise create the artifact file using \`template\` as the structure and write it to \`resolvedOutputPath\`. If \`resolvedOutputPath\` is a glob, follow \`instruction\` to choose the concrete file path
+      - Choose the output path before creating anything. If \`resolvedOutputPath\` is a glob, follow \`instruction\` to choose a concrete path inside \`changeRoot\` that matches the glob, and verify it remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists; if it does not, stop and tell the user. Otherwise the output path is \`resolvedOutputPath\`
+      - If the \`instruction\` field delegates creation to a specific skill or command, invoke it only if it can write the artifact to that output path; otherwise stop and tell the user. Then verify the artifact file exists at that output path
+      - Otherwise create the artifact file using \`template\` as the structure and write it to that output path
       - Apply \`context\` and \`rules\` as constraints - but do NOT copy them into the file
       - Show brief progress: "✓ Created <artifact-id>"
 
@@ -108,7 +109,7 @@ After completing all artifacts, summarize:
 **Artifact Creation Guidelines**
 
 - Follow the \`instruction\` field from \`openspec instructions\` for each artifact type - it is the authoritative guidance, even for familiar artifact names
-- If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
+- If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly - but only once you have chosen and checked the output path, and only if it can write there
 - The schema defines what each artifact should contain - follow it
 - Read dependency artifacts for context before creating new ones
 - Use \`template\` as the structure for your output file - fill in its sections
@@ -191,8 +192,9 @@ ${PROJECT_ROOT_GUARD}
         - Identify the target project from the request and project context; the planning home may be separate from the code. If the target is unclear, ask. For greenfield or non-code changes, inspect the available structure and relevant documents. If source is unavailable, state the limitation and ask when it materially affects the plan.
         - Ground scope, approach, and tasks in what you find. Distinguish observed behavior from assumptions and proposed additions; surface conflicts with existing specs instead of silently deciding which is correct.
         - Do this discovery now, rather than leaving generic "explore the codebase" or "make a plan" tasks for implementation. Keep any necessary follow-up investigation specific to an unresolved question.
-      - If the \`instruction\` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at \`resolvedOutputPath\`
-      - Otherwise create the artifact file using \`template\` as the structure and write it to \`resolvedOutputPath\`. If \`resolvedOutputPath\` is a glob, follow \`instruction\` to choose the concrete file path
+      - Choose the output path before creating anything. If \`resolvedOutputPath\` is a glob, follow \`instruction\` to choose a concrete path inside \`changeRoot\` that matches the glob, and verify it remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists; if it does not, stop and tell the user. Otherwise the output path is \`resolvedOutputPath\`
+      - If the \`instruction\` field delegates creation to a specific skill or command, invoke it only if it can write the artifact to that output path; otherwise stop and tell the user. Then verify the artifact file exists at that output path
+      - Otherwise create the artifact file using \`template\` as the structure and write it to that output path
       - Apply \`context\` and \`rules\` as constraints - but do NOT copy them into the file
       - Show brief progress: "✓ Created <artifact-id>"
 
@@ -226,7 +228,7 @@ After completing all artifacts, summarize:
 **Artifact Creation Guidelines**
 
 - Follow the \`instruction\` field from \`openspec instructions\` for each artifact type - it is the authoritative guidance, even for familiar artifact names
-- If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
+- If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly - but only once you have chosen and checked the output path, and only if it can write there
 - The schema defines what each artifact should contain - follow it
 - Read dependency artifacts for context before creating new ones
 - Use \`template\` as the structure for your output file - fill in its sections

package/dist/core/templates/workflows/propose.js

@@ -119,8 +119,9 @@ ${PROJECT_ROOT_GUARD}
         - Identify the target project from the request and project context; the planning home may be separate from the code. If the target is unclear, ask. For greenfield or non-code changes, inspect the available structure and relevant documents. If source is unavailable, state the limitation and ask when it materially affects the plan.
         - Ground scope, approach, and tasks in what you find. Distinguish observed behavior from assumptions and proposed additions; surface conflicts with existing specs instead of silently deciding which is correct.
         - Do this discovery now, rather than leaving generic "explore the codebase" or "make a plan" tasks for implementation. Keep any necessary follow-up investigation specific to an unresolved question.
-      - If the \`instruction\` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at \`resolvedOutputPath\`
-      - Otherwise create the artifact file using \`template\` as the structure and write it to \`resolvedOutputPath\`. If \`resolvedOutputPath\` is a glob, follow \`instruction\` to choose the concrete file path
+      - Choose the output path before creating anything. If \`resolvedOutputPath\` is a glob, follow \`instruction\` to choose a concrete path inside \`changeRoot\` that matches the glob, and verify it remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists; if it does not, stop and tell the user. Otherwise the output path is \`resolvedOutputPath\`
+      - If the \`instruction\` field delegates creation to a specific skill or command, invoke it only if it can write the artifact to that output path; otherwise stop and tell the user. Then verify the artifact file exists at that output path
+      - Otherwise create the artifact file using \`template\` as the structure and write it to that output path
       - Apply \`context\` and \`rules\` as constraints - but do NOT copy them into the file
       - Show brief progress: "Created <artifact-id>"
 
@@ -154,7 +155,7 @@ After completing all artifacts, summarize:
 **Artifact Creation Guidelines**
 
 - Follow the \`instruction\` field from \`openspec instructions\` for each artifact type - it is the authoritative guidance, even for familiar artifact names
-- If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
+- If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly - but only once you have chosen and checked the output path, and only if it can write there
 - The schema defines what each artifact should contain - follow it
 - Read dependency artifacts for context before creating new ones
 - Use \`template\` as the structure for your output file - fill in its sections
@@ -283,8 +284,9 @@ ${PROJECT_ROOT_GUARD}
         - Identify the target project from the request and project context; the planning home may be separate from the code. If the target is unclear, ask. For greenfield or non-code changes, inspect the available structure and relevant documents. If source is unavailable, state the limitation and ask when it materially affects the plan.
         - Ground scope, approach, and tasks in what you find. Distinguish observed behavior from assumptions and proposed additions; surface conflicts with existing specs instead of silently deciding which is correct.
         - Do this discovery now, rather than leaving generic "explore the codebase" or "make a plan" tasks for implementation. Keep any necessary follow-up investigation specific to an unresolved question.
-      - If the \`instruction\` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at \`resolvedOutputPath\`
-      - Otherwise create the artifact file using \`template\` as the structure and write it to \`resolvedOutputPath\`. If \`resolvedOutputPath\` is a glob, follow \`instruction\` to choose the concrete file path
+      - Choose the output path before creating anything. If \`resolvedOutputPath\` is a glob, follow \`instruction\` to choose a concrete path inside \`changeRoot\` that matches the glob, and verify it remains inside \`changeRoot\` after resolving symlinks, both in its parent directories and in the file itself if it already exists; if it does not, stop and tell the user. Otherwise the output path is \`resolvedOutputPath\`
+      - If the \`instruction\` field delegates creation to a specific skill or command, invoke it only if it can write the artifact to that output path; otherwise stop and tell the user. Then verify the artifact file exists at that output path
+      - Otherwise create the artifact file using \`template\` as the structure and write it to that output path
       - Apply \`context\` and \`rules\` as constraints - but do NOT copy them into the file
       - Show brief progress: "Created <artifact-id>"
 
@@ -318,7 +320,7 @@ After completing all artifacts, summarize:
 **Artifact Creation Guidelines**
 
 - Follow the \`instruction\` field from \`openspec instructions\` for each artifact type - it is the authoritative guidance, even for familiar artifact names
-- If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
+- If the \`instruction\` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly - but only once you have chosen and checked the output path, and only if it can write there
 - The schema defines what each artifact should contain - follow it
 - Read dependency artifacts for context before creating new ones
 - Use \`template\` as the structure for your output file - fill in its sections

package/dist/core/validation/validator.js

@@ -9,6 +9,7 @@ import { parseDeltaSpec, foldRequirementName, normalizeRequirementName, extractR
 import { extractRequirementBody as extractRequirementBodyShared, containsShallOrMust as containsShallOrMustShared, countScenarios as countScenariosShared, countEmptyScenarios, } from '../parsers/requirement-text.js';
 import { findMainSpecStructureIssues } from '../parsers/spec-structure.js';
 import { FileSystemUtils } from '../../utils/file-system.js';
+import { assertDiscoveredSpecFile } from '../../utils/spec-path-containment.js';
 import { discoverSpecFiles, findUnreadDeltaFiles, hasAnyFileUnder } from '../../utils/spec-discovery.js';
 import { METADATA_FILENAME, formatUnknownChangeMetadataKeysMessage, readSkipSpecsMarker, readUnknownChangeMetadataKeys, resolveSchemaForChange, } from '../../utils/change-metadata.js';
 import { resolveTaskFilesForChange } from '../../utils/task-progress.js';
@@ -314,8 +315,7 @@ export class Validator {
                 // authoring time instead of days later at archive time (#1477).
                 if (options.mainSpecsDir && plan.modified.length > 0) {
                     const mainSpecFile = path.join(options.mainSpecsDir, ...specId.split('/'), 'spec.md');
-                    FileSystemUtils.assertPathWithin(path.dirname(mainSpecFile), mainSpecFile);
-                    issues.push(...(await this.findScenarioLossIssues(plan.modified, plan.renamed, mainSpecFile, entryPath, path.dirname(mainSpecFile))));
+                    issues.push(...(await this.findScenarioLossIssues(plan.modified, plan.renamed, mainSpecFile, entryPath, options.mainSpecsDir)));
                 }
                 // Validate REMOVED (names only)
                 for (const name of plan.removed) {
@@ -606,7 +606,7 @@ export class Validator {
      */
     async findScenarioLossIssues(modified, renamed, mainSpecFile, entryPath, mainSpecRoot) {
         let mainContent;
-        FileSystemUtils.assertPathWithin(mainSpecRoot, mainSpecFile);
+        assertDiscoveredSpecFile(mainSpecRoot, mainSpecFile);
         try {
             mainContent = await fs.readFile(mainSpecFile, 'utf-8');
         }

package/dist/utils/file-system.d.ts

@@ -1,7 +1,7 @@
 export declare class FileSystemUtils {
     /**
      * Converts a path to use forward slashes (POSIX style).
-     * Essential for cross-platform compatibility with glob libraries like fast-glob.
+     * Essential for cross-platform compatibility with glob libraries like tinyglobby.
      */
     static toPosixPath(p: string): string;
     /**

package/dist/utils/file-system.js

@@ -65,7 +65,7 @@ function findMarkerIndex(content, marker, fromIndex = 0) {
 export class FileSystemUtils {
     /**
      * Converts a path to use forward slashes (POSIX style).
-     * Essential for cross-platform compatibility with glob libraries like fast-glob.
+     * Essential for cross-platform compatibility with glob libraries like tinyglobby.
      */
     static toPosixPath(p) {
         return p.replace(/\\/g, '/');

package/dist/utils/interactive.d.ts

@@ -67,4 +67,19 @@ export declare function confirmPrompt(prompt: ConfirmPrompt, io?: {
     input?: Readable;
     output?: Writable;
 }): Promise<boolean>;
+/**
+ * Whether a spinner can safely render to `stream`.
+ *
+ * ora decides how many lines to erase with `ceil(width / stream.columns)`, so a
+ * TTY that reports zero columns makes that count `Infinity` and `clear()` never
+ * ends: the spinner emits cursor-up/clear-line escapes as fast as it can and the
+ * command never finishes (#2106). Zero-width TTYs are real — a pty inherited
+ * from a pre-commit runner such as lefthook, or `script -qec` — and nothing can
+ * be drawn in zero columns anyway, so refuse the spinner and let the caller fall
+ * back to its plain output.
+ */
+export declare function canRenderSpinner(stream?: {
+    isTTY?: boolean;
+    columns?: number;
+}): boolean;
 //# sourceMappingURL=interactive.d.ts.map

package/dist/utils/interactive.js

@@ -153,4 +153,22 @@ function readYesNo(prompt, input, output) {
         });
     });
 }
+/**
+ * Whether a spinner can safely render to `stream`.
+ *
+ * ora decides how many lines to erase with `ceil(width / stream.columns)`, so a
+ * TTY that reports zero columns makes that count `Infinity` and `clear()` never
+ * ends: the spinner emits cursor-up/clear-line escapes as fast as it can and the
+ * command never finishes (#2106). Zero-width TTYs are real — a pty inherited
+ * from a pre-commit runner such as lefthook, or `script -qec` — and nothing can
+ * be drawn in zero columns anyway, so refuse the spinner and let the caller fall
+ * back to its plain output.
+ */
+export function canRenderSpinner(stream = process.stderr) {
+    // A non-TTY stream never enters the clear loop: ora disables itself and
+    // prints one plain line instead.
+    if (!stream.isTTY)
+        return true;
+    return (stream.columns ?? 0) > 0;
+}
 //# sourceMappingURL=interactive.js.map

package/dist/utils/spec-discovery.d.ts

@@ -10,10 +10,10 @@ export interface DiscoveredSpec {
  * are found (#1353). A `spec.md` sitting directly in the root is ignored,
  * matching the historical requirement that specs live in a capability folder.
  * Dot-directories are skipped and symlinked directories are not followed.
- * An in-capability symlinked `spec.md` IS resolved: `hasAnyFileUnder` and the
- * artifact graph's globs both count it as content, so dropping it here would
- * silently lose the delta on archive. A link outside its capability is
- * rejected and a dangling link is skipped. Results are sorted by id.
+ * A symlinked `spec.md` IS resolved: `hasAnyFileUnder` and the artifact
+ * graph's globs both count it as content, so dropping it here would silently
+ * lose the delta on archive. `assertSpecFilePathAllowed` decides how far such
+ * a link may point; a dangling link is skipped. Results are sorted by id.
  *
  * A missing root (ENOENT) yields an empty list, but any other read failure
  * (EACCES, EIO, ...) is thrown rather than swallowed: since this feeds the

package/dist/utils/spec-discovery.js

@@ -1,27 +1,17 @@
 import { promises as fs } from 'fs';
 import path from 'path';
-import { FileSystemUtils } from './file-system.js';
+import { assertDiscoveredSpecFile } from './spec-path-containment.js';
 import { parseDeltaSpec } from '../core/parsers/requirement-blocks.js';
-function assertDiscoveredSpecPath(specsRoot, capabilityDir, specFile) {
-    try {
-        FileSystemUtils.assertPathWithin(specsRoot, specFile);
-    }
-    catch {
-        // Direct capability directories may intentionally be external monorepo
-        // links. In that case, confine the file to the capability itself.
-        FileSystemUtils.assertPathWithin(capabilityDir, specFile);
-    }
-}
 /**
  * Recursively discover every `spec.md` under a specs root, so both the flat
  * `specs/<id>/spec.md` layout and nested `specs/<area>/<id>/spec.md` layouts
  * are found (#1353). A `spec.md` sitting directly in the root is ignored,
  * matching the historical requirement that specs live in a capability folder.
  * Dot-directories are skipped and symlinked directories are not followed.
- * An in-capability symlinked `spec.md` IS resolved: `hasAnyFileUnder` and the
- * artifact graph's globs both count it as content, so dropping it here would
- * silently lose the delta on archive. A link outside its capability is
- * rejected and a dangling link is skipped. Results are sorted by id.
+ * A symlinked `spec.md` IS resolved: `hasAnyFileUnder` and the artifact
+ * graph's globs both count it as content, so dropping it here would silently
+ * lose the delta on archive. `assertSpecFilePathAllowed` decides how far such
+ * a link may point; a dangling link is skipped. Results are sorted by id.
  *
  * A missing root (ENOENT) yields an empty list, but any other read failure
  * (EACCES, EIO, ...) is thrown rather than swallowed: since this feeds the
@@ -49,13 +39,13 @@ export async function discoverSpecFiles(specsRoot) {
             else if (entry.name === 'spec.md' && segments.length > 0) {
                 const specFile = path.join(dir, entry.name);
                 if (entry.isFile()) {
-                    assertDiscoveredSpecPath(specsRoot, dir, specFile);
+                    assertDiscoveredSpecFile(specsRoot, specFile);
                     results.push({ id: segments.join('/'), specFile });
                 }
                 else if (entry.isSymbolicLink()) {
                     try {
                         if ((await fs.stat(specFile)).isFile()) {
-                            assertDiscoveredSpecPath(specsRoot, dir, specFile);
+                            assertDiscoveredSpecFile(specsRoot, specFile);
                             results.push({ id: segments.join('/'), specFile });
                         }
                     }

package/dist/utils/spec-path-containment.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Containment for a `spec.md` under a trust root already established for it:
+ * inside the root, or a link out of the root that stays inside the project.
+ *
+ * Deliberately does not re-derive a trust root from the file's own capability
+ * directory. Callers use this to recheck a path immediately before reading or
+ * writing it, and a capability directory swapped for a link since the path was
+ * resolved has to be refused rather than trusted afresh.
+ */
+export declare function assertSpecFileWithin(root: string, specFile: string): void;
+/**
+ * Containment for a `spec.md` as it is discovered, where the capability
+ * directory itself may deliberately be a link into another repository and is
+ * then the file's own trust root.
+ */
+export declare function assertDiscoveredSpecFile(specsRoot: string, specFile: string): void;
+//# sourceMappingURL=spec-path-containment.d.ts.map

package/dist/utils/spec-path-containment.js

@@ -0,0 +1,122 @@
+import * as nodeFs from 'fs';
+import path from 'path';
+import { OPENSPEC_DIR_NAME } from '../core/config.js';
+import { FileSystemUtils } from './file-system.js';
+/**
+ * The project a specs root belongs to, or null when it cannot be named.
+ *
+ * Every specs root OpenSpec reads is addressed through the project's
+ * `openspec` directory - `<project>/openspec/specs` for main specs and
+ * `<project>/openspec/changes/<change>/specs` (or `.../changes/archive/...`)
+ * for a change's deltas - so the project is the parent of that `openspec`
+ * directory.
+ *
+ * The directory below the match has to be `specs` or `changes`, which is what
+ * makes this a planning root rather than a directory that merely shares the
+ * name: a store kept at `~/openspec/my-store` would otherwise hand out `~` as
+ * its boundary. A specs root reached some other way (a store given by path)
+ * has no project to name, and containment stays at the specs root.
+ */
+function findProjectRoot(specsRoot) {
+    let current = path.resolve(specsRoot);
+    let below = null;
+    while (true) {
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        if (path.basename(current) === OPENSPEC_DIR_NAME &&
+            (below === 'specs' || below === 'changes')) {
+            return parent;
+        }
+        below = path.basename(current);
+        current = parent;
+    }
+}
+/** Path-segment containment on the paths as written, without resolving links. */
+function isLexicallyWithin(allowedDirectory, targetPath) {
+    const relative = path.relative(path.resolve(allowedDirectory), path.resolve(targetPath));
+    return (relative === '' ||
+        (relative !== '..' &&
+            !relative.startsWith(`..${path.sep}`) &&
+            !path.isAbsolute(relative)));
+}
+/**
+ * A project may keep a capability's spec file elsewhere - beside the product
+ * documentation it belongs to - and leave a relative symlink at
+ * `openspec/specs/<capability>/spec.md`, so OpenSpec and the docs read and
+ * write the same bytes. Accept such a link, and refuse one that leaves the
+ * project, so a link swapped underneath a repo cannot turn a spec read or an
+ * archive write into an arbitrary file access.
+ *
+ * `outsideError` is rethrown when the file is not a link at all, so a path
+ * that simply escapes its root keeps reporting that.
+ */
+function assertLinkedSpecFileInProject(root, specFile, outsideError) {
+    const projectRoot = findProjectRoot(root);
+    if (projectRoot === null) {
+        throw outsideError;
+    }
+    const resolvedFile = path.resolve(specFile);
+    let isLink = false;
+    try {
+        isLink = nodeFs.lstatSync(resolvedFile).isSymbolicLink();
+    }
+    catch {
+        isLink = false;
+    }
+    if (!isLink) {
+        throw outsideError;
+    }
+    // Only where the link points is the project's choice. The directory holding
+    // it must still be reached from inside the root.
+    FileSystemUtils.assertPathWithin(root, path.dirname(resolvedFile));
+    // Canonicalizes through the link, so a target outside the project is refused
+    // and a dangling link - which cannot be proven contained - fails loudly.
+    FileSystemUtils.assertPathWithin(projectRoot, resolvedFile);
+}
+/**
+ * Containment for a `spec.md` under a trust root already established for it:
+ * inside the root, or a link out of the root that stays inside the project.
+ *
+ * Deliberately does not re-derive a trust root from the file's own capability
+ * directory. Callers use this to recheck a path immediately before reading or
+ * writing it, and a capability directory swapped for a link since the path was
+ * resolved has to be refused rather than trusted afresh.
+ */
+export function assertSpecFileWithin(root, specFile) {
+    try {
+        FileSystemUtils.assertPathWithin(root, specFile);
+    }
+    catch (error) {
+        assertLinkedSpecFileInProject(root, specFile, error);
+    }
+}
+/**
+ * Containment for a `spec.md` as it is discovered, where the capability
+ * directory itself may deliberately be a link into another repository and is
+ * then the file's own trust root.
+ */
+export function assertDiscoveredSpecFile(specsRoot, specFile) {
+    const capabilityDir = path.dirname(path.resolve(specFile));
+    try {
+        FileSystemUtils.assertPathWithin(specsRoot, specFile);
+        return;
+    }
+    catch (error) {
+        // The capability directory is the file's own trust root only while it is
+        // addressed from inside the specs root: the link it may be is deliberate,
+        // a `..` out of the root is not.
+        if (isLexicallyWithin(specsRoot, capabilityDir)) {
+            try {
+                FileSystemUtils.assertPathWithin(capabilityDir, specFile);
+                return;
+            }
+            catch {
+                // Not a file of its own capability either; the link rule decides.
+            }
+        }
+        assertLinkedSpecFileInProject(specsRoot, specFile, error);
+    }
+}
+//# sourceMappingURL=spec-path-containment.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fission-ai/openspec",
-  "version": "1.14.2",
+  "version": "1.14.3",
   "description": "AI-native system for spec-driven development",
   "keywords": [
     "openspec",
@@ -44,6 +44,7 @@
     "@changesets/changelog-github": "^1.0.0",
     "@changesets/cli": "^3.0.1",
     "@types/node": "^20.19.43",
+    "@types/picomatch": "^4.0.3",
     "@vitest/ui": "^4.1.11",
     "eslint": "^10.5.0",
     "smol-toml": "^1.7.1",
@@ -54,12 +55,14 @@
   "dependencies": {
     "@inquirer/core": "^12.0.0",
     "@inquirer/prompts": "^8.5.2",
+    "brace-expansion": "^5.0.12",
     "chalk": "^5.6.2",
     "commander": "^14.0.0",
     "cross-spawn": "7.0.6",
     "diff": "^9.0.0",
-    "fast-glob": "^3.3.3",
     "ora": "^9.4.1",
+    "picomatch": "^4.0.4",
+    "tinyglobby": "^0.2.17",
     "yaml": "^2.8.3",
     "zod": "^4.4.3"
   },