@fission-ai/openspec 1.6.0 → 1.7.0

package/dist/core/command-surface.js

@@ -0,0 +1,33 @@
+import { CommandAdapterRegistry } from './command-generation/index.js';
+import { getInvocationForAdapter } from './command-generation/invocation.js';
+/**
+ * How the tool spells its OpenSpec commands: the name from the command files
+ * its adapter writes, the prefix the adapter declares. Returns undefined for
+ * tools with no command adapter, which have no command names to spell.
+ */
+export function resolveCommandInvocation(toolId) {
+    const adapter = CommandAdapterRegistry.get(toolId);
+    return adapter ? getInvocationForAdapter(adapter) : undefined;
+}
+export function resolveCommandSurfaceCapability(toolId) {
+    if (CommandAdapterRegistry.has(toolId)) {
+        return 'adapter-backed';
+    }
+    if (toolId === 'codex') {
+        return 'skills-invocable';
+    }
+    return 'none';
+}
+export function shouldGenerateSkillsForTool(toolId, delivery) {
+    return delivery !== 'commands' || resolveCommandSurfaceCapability(toolId) === 'skills-invocable';
+}
+export function shouldRemoveSkillsForTool(toolId, delivery) {
+    return delivery === 'commands' && resolveCommandSurfaceCapability(toolId) !== 'skills-invocable';
+}
+export function shouldGenerateCommandsForTool(toolId, delivery) {
+    return delivery !== 'skills' && resolveCommandSurfaceCapability(toolId) === 'adapter-backed';
+}
+export function shouldReconcileCommandFilesForTool(toolId, delivery) {
+    return delivery === 'skills' && resolveCommandSurfaceCapability(toolId) === 'adapter-backed';
+}
+//# sourceMappingURL=command-surface.js.map

package/dist/core/completions/command-registry.js

@@ -22,6 +22,10 @@ export const COMMAND_REGISTRY = [
                 takesValue: true,
                 values: ['core', 'custom'],
             },
+            {
+                name: 'no-animation',
+                description: 'Show a static welcome screen instead of the animated one',
+            },
         ],
     },
     {
@@ -62,7 +66,9 @@ export const COMMAND_REGISTRY = [
     {
         name: 'view',
         description: 'Display an interactive dashboard of specs and changes',
-        flags: [],
+        flags: [
+            COMMON_FLAGS.store,
+        ],
     },
     {
         name: 'validate',
@@ -177,7 +183,7 @@ export const COMMAND_REGISTRY = [
     },
     {
         name: 'instructions',
-        description: 'Output enriched instructions for creating an artifact or applying tasks',
+        description: 'Output enriched instructions for artifacts, apply, or archive',
         acceptsPositional: true,
         positionals: [{ name: 'artifact', optional: true }],
         flags: [

package/dist/core/completions/generators/powershell-generator.js

@@ -164,6 +164,20 @@ Register-ArgumentCompleter -CommandName openspec -ScriptBlock $openspecCompleter
         return lines;
     }
     generateIndexedPositionalCompletion(positionals, flags, firstPositionalTokenIndex, indent) {
+        const caseLines = [];
+        for (const [index, positional] of positionals.entries()) {
+            const completion = this.generatePositionalCompletion(positional.type, indent + '    ');
+            if (completion.length === 0)
+                continue;
+            caseLines.push(`${indent}    ${index} {`);
+            caseLines.push(...completion);
+            caseLines.push(`${indent}    }`);
+        }
+        // A switch with no clauses is a PowerShell parse error, so when no
+        // positional produces completions skip the whole block (it would only
+        // feed the empty switch anyway).
+        if (caseLines.length === 0)
+            return [];
         const lines = [];
         const valueFlags = this.generateValueFlags(flags);
         if (valueFlags.length > 0) {
@@ -192,14 +206,7 @@ Register-ArgumentCompleter -CommandName openspec -ScriptBlock $openspecCompleter
         lines.push(`${indent}}`);
         lines.push('');
         lines.push(`${indent}switch ($positionalIndex) {`);
-        for (const [index, positional] of positionals.entries()) {
-            const completion = this.generatePositionalCompletion(positional.type, indent + '    ');
-            if (completion.length === 0)
-                continue;
-            lines.push(`${indent}    ${index} {`);
-            lines.push(...completion);
-            lines.push(`${indent}    }`);
-        }
+        lines.push(...caseLines);
         lines.push(`${indent}}`);
         return lines;
     }

package/dist/core/completions/installers/zsh-installer.d.ts

@@ -16,6 +16,15 @@ export declare class ZshInstaller {
      * @returns true if Oh My Zsh is detected via $ZSH env var or directory exists
      */
     isOhMyZshInstalled(): Promise<boolean>;
+    /**
+     * Oh My Zsh exports its root as $ZSH; honor a custom location, or the
+     * completion lands in a ~/.oh-my-zsh tree that nothing ever loads.
+     */
+    private ohMyZshRoot;
+    /**
+     * The custom dir is separately relocatable via $ZSH_CUSTOM.
+     */
+    private ohMyZshCustomDir;
     /**
      * Get the appropriate installation path for the completion script
      *

package/dist/core/completions/installers/zsh-installer.js

@@ -29,15 +29,27 @@ export class ZshInstaller {
             return true;
         }
         // Fall back to checking for ~/.oh-my-zsh directory
-        const ohMyZshPath = path.join(this.homeDir, '.oh-my-zsh');
         try {
-            const stat = await fs.stat(ohMyZshPath);
+            const stat = await fs.stat(this.ohMyZshRoot());
             return stat.isDirectory();
         }
         catch {
             return false;
         }
     }
+    /**
+     * Oh My Zsh exports its root as $ZSH; honor a custom location, or the
+     * completion lands in a ~/.oh-my-zsh tree that nothing ever loads.
+     */
+    ohMyZshRoot() {
+        return process.env.ZSH || path.join(this.homeDir, '.oh-my-zsh');
+    }
+    /**
+     * The custom dir is separately relocatable via $ZSH_CUSTOM.
+     */
+    ohMyZshCustomDir() {
+        return process.env.ZSH_CUSTOM || path.join(this.ohMyZshRoot(), 'custom');
+    }
     /**
      * Get the appropriate installation path for the completion script
      *
@@ -48,7 +60,7 @@ export class ZshInstaller {
         if (isOhMyZsh) {
             // Oh My Zsh custom completions directory
             return {
-                path: path.join(this.homeDir, '.oh-my-zsh', 'custom', 'completions', '_openspec'),
+                path: path.join(this.ohMyZshCustomDir(), 'completions', '_openspec'),
                 isOhMyZsh: true,
             };
         }
@@ -292,10 +304,14 @@ export class ZshInstaller {
      * @returns Array of guidance strings, or undefined if not needed
      */
     generateOhMyZshFpathGuidance(completionsDir) {
+        // One fpath entry per line, matched as a literal: a relocated $ZSH_CUSTOM
+        // need not contain "custom/completions", and the path may hold characters
+        // grep would otherwise read as a pattern. Single-quoted for the shell.
+        const quotedDir = `'${completionsDir.replace(/'/g, `'\\''`)}'`;
         return [
             'Note: Oh My Zsh typically auto-loads completions from custom/completions.',
             `Verify that ${completionsDir} is in your fpath by running:`,
-            '  echo $fpath | grep "custom/completions"',
+            `  printf '%s\\n' $fpath | grep -F ${quotedDir}`,
             '',
             'If not found, completions may not work. Restart your shell to ensure changes take effect.',
         ];

package/dist/core/config-prompts.d.ts

@@ -2,7 +2,7 @@ import type { ProjectConfig } from './project-config.js';
 /**
  * Serialize config to YAML string with helpful comments.
  *
- * @param config - Partial config object (schema required, context/rules optional)
+ * @param config - Partial config object (schema required, other fields optional)
  * @returns YAML string ready to write to file
  */
 export declare function serializeConfig(config: Partial<ProjectConfig>): string;

package/dist/core/config-prompts.js

@@ -1,7 +1,7 @@
 /**
  * Serialize config to YAML string with helpful comments.
  *
- * @param config - Partial config object (schema required, context/rules optional)
+ * @param config - Partial config object (schema required, other fields optional)
  * @returns YAML string ready to write to file
  */
 export function serializeConfig(config) {
@@ -29,6 +29,19 @@ export function serializeConfig(config) {
     lines.push('#       - Always include a "Non-goals" section');
     lines.push('#     tasks:');
     lines.push('#       - Break tasks into chunks of max 2 hours');
+    lines.push('');
+    // Operation guidance section with comments
+    lines.push('# Per-operation guidance (optional)');
+    lines.push('# Add advisory guidance for how apply and archive work should be conducted.');
+    lines.push('# This is separate from artifact rules above.');
+    lines.push('# Example:');
+    lines.push('#   operations:');
+    lines.push('#     apply:');
+    lines.push('#       guidance:');
+    lines.push('#         - Keep test summaries concise');
+    lines.push('#     archive:');
+    lines.push('#       guidance:');
+    lines.push('#         - Summarize the archive outcome before finishing');
     return lines.join('\n') + '\n';
 }
 //# sourceMappingURL=config-prompts.js.map

package/dist/core/config-schema.d.ts

@@ -11,16 +11,22 @@ export declare const GlobalConfigSchema: z.ZodObject<{
     }>>>;
     delivery: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
         commands: "commands";
-        skills: "skills";
         both: "both";
+        skills: "skills";
     }>>>;
     workflows: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    defaultStore: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export type GlobalConfigType = z.infer<typeof GlobalConfigSchema>;
 /**
  * Default configuration values.
  */
 export declare const DEFAULT_CONFIG: GlobalConfigType;
+/**
+ * True when a dot-notation key path contains a prototype-reaching segment.
+ * Callers that bypass key validation (e.g. --allow-unknown) still must not bypass this.
+ */
+export declare function hasUnsafeKeySegment(path: string): boolean;
 /**
  * Validate a config key path for CLI set operations.
  * Unknown top-level keys are rejected unless explicitly allowed by the caller.

package/dist/core/config-schema.js

@@ -20,6 +20,10 @@ export const GlobalConfigSchema = z
     workflows: z
         .array(z.string())
         .optional(),
+    defaultStore: z
+        .string()
+        .optional()
+        .describe('Store id used as fallback root when no explicit --store, local root, or project-level store: pointer resolves'),
 })
     .passthrough();
 /**
@@ -30,7 +34,22 @@ export const DEFAULT_CONFIG = {
     profile: 'core',
     delivery: 'both',
 };
-const KNOWN_TOP_LEVEL_KEYS = new Set([...Object.keys(DEFAULT_CONFIG), 'workflows']);
+const KNOWN_TOP_LEVEL_KEYS = new Set([...Object.keys(DEFAULT_CONFIG), 'workflows', 'defaultStore']);
+/**
+ * Key segments that would reach the prototype chain instead of the config object.
+ * Never valid as configuration keys, so rejecting them costs nothing.
+ */
+const UNSAFE_KEY_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+function hasUnsafeSegment(keys) {
+    return keys.some((key) => UNSAFE_KEY_SEGMENTS.has(key));
+}
+/**
+ * True when a dot-notation key path contains a prototype-reaching segment.
+ * Callers that bypass key validation (e.g. --allow-unknown) still must not bypass this.
+ */
+export function hasUnsafeKeySegment(path) {
+    return hasUnsafeSegment(path.split('.'));
+}
 /**
  * Validate a config key path for CLI set operations.
  * Unknown top-level keys are rejected unless explicitly allowed by the caller.
@@ -40,6 +59,10 @@ export function validateConfigKeyPath(path) {
     if (rawKeys.length === 0 || rawKeys.some((key) => key.trim() === '')) {
         return { valid: false, reason: 'Key path must not be empty' };
     }
+    const unsafeKey = rawKeys.find((key) => UNSAFE_KEY_SEGMENTS.has(key));
+    if (unsafeKey) {
+        return { valid: false, reason: `Key segment "${unsafeKey}" is not allowed` };
+    }
     const rootKey = rawKeys[0];
     if (!KNOWN_TOP_LEVEL_KEYS.has(rootKey)) {
         return { valid: false, reason: `Unknown top-level key "${rootKey}"` };
@@ -64,6 +87,9 @@ export function validateConfigKeyPath(path) {
  */
 export function getNestedValue(obj, path) {
     const keys = path.split('.');
+    if (hasUnsafeSegment(keys)) {
+        return undefined;
+    }
     let current = obj;
     for (const key of keys) {
         if (current === null || current === undefined) {
@@ -86,6 +112,14 @@ export function getNestedValue(obj, path) {
  */
 export function setNestedValue(obj, path, value) {
     const keys = path.split('.');
+    // Compared literally rather than through a helper, so the guard is plain to a
+    // reader and to static analysis. Checked for the whole path before anything is
+    // written, so a rejected key never leaves half-created objects behind.
+    for (const key of keys) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            return;
+        }
+    }
     let current = obj;
     for (let i = 0; i < keys.length - 1; i++) {
         const key = keys[i];
@@ -106,6 +140,11 @@ export function setNestedValue(obj, path, value) {
  */
 export function deleteNestedValue(obj, path) {
     const keys = path.split('.');
+    for (const key of keys) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            return false;
+        }
+    }
     let current = obj;
     for (let i = 0; i < keys.length - 1; i++) {
         const key = keys[i];

package/dist/core/config.d.ts

@@ -13,6 +13,18 @@ export interface AIToolOption {
     successLabel?: string;
     skillsDir?: string;
     detectionPaths?: string[];
+    setupNote?: string;
 }
 export declare const AI_TOOLS: AIToolOption[];
+/**
+ * Retired tool ids that still resolve, so a rebrand does not break scripted
+ * `--tools` invocations. Windsurf was rebranded to Devin Desktop on
+ * 2026-06-02 and its config directory moved from `.windsurf/` to `.devin/`;
+ * `--tools windsurf` therefore configures `devin`.
+ */
+export declare const TOOL_ID_ALIASES: Record<string, string>;
+/**
+ * Resolves a tool id through TOOL_ID_ALIASES, leaving current ids untouched.
+ */
+export declare function resolveToolIdAlias(toolId: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/core/config.js

@@ -10,7 +10,9 @@ export const AI_TOOLS = [
     { name: 'Bob Shell', value: 'bob', available: true, successLabel: 'Bob Shell', skillsDir: '.bob' },
     { name: 'Claude Code', value: 'claude', available: true, successLabel: 'Claude Code', skillsDir: '.claude' },
     { name: 'Cline', value: 'cline', available: true, successLabel: 'Cline', skillsDir: '.cline' },
+    { name: 'CodeArts', value: 'codeartsagent', available: true, successLabel: 'CodeArts', skillsDir: '.codeartsdoer' },
     { name: 'Codex', value: 'codex', available: true, successLabel: 'Codex', skillsDir: '.codex' },
+    { name: 'Devin Desktop (formerly Windsurf)', value: 'devin', available: true, successLabel: 'Devin Desktop', skillsDir: '.devin', detectionPaths: ['.devin', '.windsurf'] },
     { name: 'ForgeCode', value: 'forgecode', available: true, successLabel: 'ForgeCode', skillsDir: '.forge' },
     { name: 'CodeBuddy Code (CLI)', value: 'codebuddy', available: true, successLabel: 'CodeBuddy Code', skillsDir: '.codebuddy' },
     { name: 'Continue', value: 'continue', available: true, successLabel: 'Continue (VS Code / JetBrains / Cli)', skillsDir: '.continue' },
@@ -20,10 +22,11 @@ export const AI_TOOLS = [
     { name: 'Factory Droid', value: 'factory', available: true, successLabel: 'Factory Droid', skillsDir: '.factory' },
     { name: 'Gemini CLI', value: 'gemini', available: true, successLabel: 'Gemini CLI', skillsDir: '.gemini' },
     { name: 'GitHub Copilot', value: 'github-copilot', available: true, successLabel: 'GitHub Copilot', skillsDir: '.github', detectionPaths: ['.github/copilot-instructions.md', '.github/instructions', '.github/workflows/copilot-setup-steps.yml', '.github/prompts', '.github/agents', '.github/skills', '.github/.mcp.json'] },
+    { name: 'Hermes Agent', value: 'hermes', available: true, successLabel: 'Hermes Agent', skillsDir: '.hermes', detectionPaths: ['.hermes', 'HERMES.md', '.hermes.md'], setupNote: "Hermes only loads skills from ~/.hermes/skills by default. Add this project's .hermes/skills directory to skills.external_dirs in ~/.hermes/config.yaml so Hermes picks up the generated OpenSpec skills." },
     { name: 'iFlow', value: 'iflow', available: true, successLabel: 'iFlow', skillsDir: '.iflow' },
     { name: 'Junie', value: 'junie', available: true, successLabel: 'Junie', skillsDir: '.junie' },
     { name: 'Kilo Code', value: 'kilocode', available: true, successLabel: 'Kilo Code', skillsDir: '.kilocode' },
-    { name: 'Kimi CLI', value: 'kimi', available: true, successLabel: 'Kimi CLI', skillsDir: '.kimi' },
+    { name: 'Kimi Code', value: 'kimi', available: true, successLabel: 'Kimi Code', skillsDir: '.kimi-code', detectionPaths: ['.kimi-code', '.kimi'] },
     { name: 'Kiro', value: 'kiro', available: true, successLabel: 'Kiro', skillsDir: '.kiro' },
     { name: 'Lingma', value: 'lingma', available: true, successLabel: 'Lingma', skillsDir: '.lingma' },
     { name: 'Mistral Vibe', value: 'vibe', available: true, successLabel: 'Mistral Vibe', skillsDir: '.vibe' },
@@ -32,9 +35,24 @@ export const AI_TOOLS = [
     { name: 'Pi', value: 'pi', available: true, successLabel: 'Pi', skillsDir: '.pi' },
     { name: 'Qoder', value: 'qoder', available: true, successLabel: 'Qoder', skillsDir: '.qoder' },
     { name: 'Qwen Code', value: 'qwen', available: true, successLabel: 'Qwen Code', skillsDir: '.qwen' },
-    { name: 'RooCode', value: 'roocode', available: true, successLabel: 'RooCode', skillsDir: '.roo' },
+    { name: 'Zoo Code', value: 'roocode', available: true, successLabel: 'Zoo Code', skillsDir: '.roo' },
     { name: 'Trae', value: 'trae', available: true, successLabel: 'Trae', skillsDir: '.trae' },
-    { name: 'Windsurf', value: 'windsurf', available: true, successLabel: 'Windsurf', skillsDir: '.windsurf' },
+    { name: 'ZCode', value: 'zcode', available: true, successLabel: 'ZCode', skillsDir: '.zcode' },
     { name: 'AGENTS.md (works with Amp, VS Code, …)', value: 'agents', available: false, successLabel: 'your AGENTS.md-compatible assistant' }
 ];
+/**
+ * Retired tool ids that still resolve, so a rebrand does not break scripted
+ * `--tools` invocations. Windsurf was rebranded to Devin Desktop on
+ * 2026-06-02 and its config directory moved from `.windsurf/` to `.devin/`;
+ * `--tools windsurf` therefore configures `devin`.
+ */
+export const TOOL_ID_ALIASES = {
+    windsurf: 'devin',
+};
+/**
+ * Resolves a tool id through TOOL_ID_ALIASES, leaving current ids untouched.
+ */
+export function resolveToolIdAlias(toolId) {
+    return TOOL_ID_ALIASES[toolId] ?? toolId;
+}
 //# sourceMappingURL=config.js.map

package/dist/core/global-config.d.ts

@@ -8,6 +8,11 @@ export interface GlobalConfig {
     profile?: Profile;
     delivery?: Delivery;
     workflows?: string[];
+    /**
+     * Machine-level fallback store id, consulted during root resolution only
+     * when no --store flag, local root, or project-level store: pointer resolves.
+     */
+    defaultStore?: string;
     /** Workset opener rows (slice 7.1); hand-edited, validated on use. */
     openers?: unknown;
 }

package/dist/core/init.d.ts

@@ -9,23 +9,58 @@ type InitCommandOptions = {
     force?: boolean;
     interactive?: boolean;
     profile?: string;
+    /** Commander's --no-animation flag: false disables the welcome animation. */
+    animation?: boolean;
 };
 export declare class InitCommand {
     private readonly toolsArg?;
     private readonly force;
     private readonly interactiveOption?;
     private readonly profileOverride?;
+    private readonly animation;
     constructor(options?: InitCommandOptions);
     execute(targetPath: string): Promise<void>;
     private validate;
     private canPromptInteractively;
     private resolveProfileOverride;
+    /**
+     * Resolves the workflows the effective profile installs, so onboarding output
+     * only mentions commands that will actually exist.
+     */
+    private getActiveWorkflows;
+    /**
+     * Cleans repo-local legacy artifacts immediately and defers global Codex prompt
+     * cleanup until replacement skills have been installed.
+     */
     private handleLegacyCleanup;
+    /**
+     * Applies the safe subset of legacy cleanup that does not depend on newly
+     * generated Codex skills.
+     */
+    private performImmediateLegacyCleanup;
+    /**
+     * Removes only the legacy global Codex prompts whose workflows now have
+     * replacement skills in the project.
+     */
+    private finalizeDeferredLegacyCleanup;
+    /**
+     * Reads the currently installed workflow IDs for a single tool from the
+     * generated skill layout on disk.
+     */
+    private getInstalledWorkflowsForTool;
     private performLegacyCleanup;
     private getSelectedTools;
     private resolveToolsArg;
     private validateTools;
     private createDirectoryStructure;
+    /**
+     * Generates skill files and slash commands for each selected tool,
+     * honoring the configured delivery mode (skills, commands, or both).
+     *
+     * @param projectPath - Absolute path to the project root
+     * @param tools - Selected tools with their skill directory metadata
+     * @returns Created, refreshed, and failed tools plus removed artifact counts
+     */
     private generateSkillsAndCommands;
     private createConfig;
     private displaySuccessMessage;