@fission-ai/openspec 1.7.0 → 1.9.0

package/dist/core/config.js

@@ -1,44 +1,67 @@
 export const OPENSPEC_DIR_NAME = 'openspec';
+export const OPENSPEC_SKILL_NAMES = [
+    'openspec-explore',
+    'openspec-new-change',
+    'openspec-continue-change',
+    'openspec-apply-change',
+    'openspec-update-change',
+    'openspec-ff-change',
+    'openspec-sync-specs',
+    'openspec-archive-change',
+    'openspec-bulk-archive-change',
+    'openspec-verify-change',
+    'openspec-onboard',
+    'openspec-propose',
+];
 export const OPENSPEC_MARKERS = {
     start: '<!-- OPENSPEC:START -->',
     end: '<!-- OPENSPEC:END -->'
 };
 export const AI_TOOLS = [
-    { name: 'Amazon Q Developer', value: 'amazon-q', available: true, successLabel: 'Amazon Q Developer', skillsDir: '.amazonq' },
-    { name: 'Antigravity', value: 'antigravity', available: true, successLabel: 'Antigravity', skillsDir: '.agent' },
+    { name: 'Amazon Q Developer', value: 'amazon-q', available: true, successLabel: 'Amazon Q Developer', skillsDir: '.amazonq', requiresIdeRestart: true },
+    { name: 'Antigravity', value: 'antigravity', available: true, successLabel: 'Antigravity', skillsDir: '.agent', requiresIdeRestart: true },
     { name: 'Auggie (Augment CLI)', value: 'auggie', available: true, successLabel: 'Auggie', skillsDir: '.augment' },
     { name: 'Bob Shell', value: 'bob', available: true, successLabel: 'Bob Shell', skillsDir: '.bob' },
     { name: 'Claude Code', value: 'claude', available: true, successLabel: 'Claude Code', skillsDir: '.claude' },
-    { name: 'Cline', value: 'cline', available: true, successLabel: 'Cline', skillsDir: '.cline' },
+    { name: 'Cline', value: 'cline', available: true, successLabel: 'Cline', skillsDir: '.cline', requiresIdeRestart: true },
+    { name: 'Command Code', value: 'command-code', available: true, successLabel: 'Command Code', skillsDir: '.commandcode' },
     { name: 'CodeArts', value: 'codeartsagent', available: true, successLabel: 'CodeArts', skillsDir: '.codeartsdoer' },
-    { name: 'Codex', value: 'codex', available: true, successLabel: 'Codex', skillsDir: '.codex' },
-    { name: 'Devin Desktop (formerly Windsurf)', value: 'devin', available: true, successLabel: 'Devin Desktop', skillsDir: '.devin', detectionPaths: ['.devin', '.windsurf'] },
+    { name: 'Codex', value: 'codex', available: true, successLabel: 'Codex', skillsDir: '.agents', legacySkillsDirs: ['.codex'], detectionPaths: ['.agents/skills', '.codex/skills'] },
+    { name: 'Devin Desktop (formerly Windsurf)', value: 'devin', available: true, successLabel: 'Devin Desktop', skillsDir: '.devin', detectionPaths: ['.devin', '.windsurf'], requiresIdeRestart: true },
     { name: 'ForgeCode', value: 'forgecode', available: true, successLabel: 'ForgeCode', skillsDir: '.forge' },
     { name: 'CodeBuddy Code (CLI)', value: 'codebuddy', available: true, successLabel: 'CodeBuddy Code', skillsDir: '.codebuddy' },
-    { name: 'Continue', value: 'continue', available: true, successLabel: 'Continue (VS Code / JetBrains / Cli)', skillsDir: '.continue' },
-    { name: 'CoStrict', value: 'costrict', available: true, successLabel: 'CoStrict', skillsDir: '.cospec' },
+    { name: 'Continue', value: 'continue', available: true, successLabel: 'Continue (VS Code / JetBrains / Cli)', skillsDir: '.continue', requiresIdeRestart: true },
+    { name: 'CoStrict', value: 'costrict', available: true, successLabel: 'CoStrict', skillsDir: '.cospec', requiresIdeRestart: true },
     { name: 'Crush', value: 'crush', available: true, successLabel: 'Crush', skillsDir: '.crush' },
-    { name: 'Cursor', value: 'cursor', available: true, successLabel: 'Cursor', skillsDir: '.cursor' },
+    { name: 'Cursor', value: 'cursor', available: true, successLabel: 'Cursor', skillsDir: '.cursor', requiresIdeRestart: true },
     { name: 'Factory Droid', value: 'factory', available: true, successLabel: 'Factory Droid', skillsDir: '.factory' },
     { name: 'Gemini CLI', value: 'gemini', available: true, successLabel: 'Gemini CLI', skillsDir: '.gemini' },
-    { name: 'GitHub Copilot', value: 'github-copilot', available: true, successLabel: 'GitHub Copilot', skillsDir: '.github', detectionPaths: ['.github/copilot-instructions.md', '.github/instructions', '.github/workflows/copilot-setup-steps.yml', '.github/prompts', '.github/agents', '.github/skills', '.github/.mcp.json'] },
+    { name: 'GitHub Copilot', value: 'github-copilot', available: true, successLabel: 'GitHub Copilot', skillsDir: '.github', detectionPaths: ['.github/copilot-instructions.md', '.github/instructions', '.github/workflows/copilot-setup-steps.yml', '.github/prompts', '.github/agents', '.github/skills', '.github/.mcp.json'], requiresIdeRestart: true },
     { name: 'Hermes Agent', value: 'hermes', available: true, successLabel: 'Hermes Agent', skillsDir: '.hermes', detectionPaths: ['.hermes', 'HERMES.md', '.hermes.md'], setupNote: "Hermes only loads skills from ~/.hermes/skills by default. Add this project's .hermes/skills directory to skills.external_dirs in ~/.hermes/config.yaml so Hermes picks up the generated OpenSpec skills." },
     { name: 'iFlow', value: 'iflow', available: true, successLabel: 'iFlow', skillsDir: '.iflow' },
-    { name: 'Junie', value: 'junie', available: true, successLabel: 'Junie', skillsDir: '.junie' },
-    { name: 'Kilo Code', value: 'kilocode', available: true, successLabel: 'Kilo Code', skillsDir: '.kilocode' },
+    { name: 'Junie', value: 'junie', available: true, successLabel: 'Junie', skillsDir: '.junie', requiresIdeRestart: true },
+    { name: 'Kilo Code', value: 'kilocode', available: true, successLabel: 'Kilo Code', skillsDir: '.kilocode', requiresIdeRestart: true },
     { name: 'Kimi Code', value: 'kimi', available: true, successLabel: 'Kimi Code', skillsDir: '.kimi-code', detectionPaths: ['.kimi-code', '.kimi'] },
-    { name: 'Kiro', value: 'kiro', available: true, successLabel: 'Kiro', skillsDir: '.kiro' },
-    { name: 'Lingma', value: 'lingma', available: true, successLabel: 'Lingma', skillsDir: '.lingma' },
+    { name: 'Kiro', value: 'kiro', available: true, successLabel: 'Kiro', skillsDir: '.kiro', requiresIdeRestart: true },
+    { name: 'Lingma', value: 'lingma', available: true, successLabel: 'Lingma', skillsDir: '.lingma', requiresIdeRestart: true },
+    { name: 'MiniMax Code', value: 'minimax-code', available: true, successLabel: 'MiniMax Code', globalSkillsDir: '.minimax' },
     { name: 'Mistral Vibe', value: 'vibe', available: true, successLabel: 'Mistral Vibe', skillsDir: '.vibe' },
     { name: 'Oh My Pi', value: 'oh-my-pi', available: true, successLabel: 'Oh My Pi', skillsDir: '.omp' },
     { name: 'OpenCode', value: 'opencode', available: true, successLabel: 'OpenCode', skillsDir: '.opencode' },
     { name: 'Pi', value: 'pi', available: true, successLabel: 'Pi', skillsDir: '.pi' },
-    { name: 'Qoder', value: 'qoder', available: true, successLabel: 'Qoder', skillsDir: '.qoder' },
+    { name: 'Qoder', value: 'qoder', available: true, successLabel: 'Qoder', skillsDir: '.qoder', requiresIdeRestart: true },
     { name: 'Qwen Code', value: 'qwen', available: true, successLabel: 'Qwen Code', skillsDir: '.qwen' },
-    { name: 'Zoo Code', value: 'roocode', available: true, successLabel: 'Zoo Code', skillsDir: '.roo' },
-    { name: 'Trae', value: 'trae', available: true, successLabel: 'Trae', skillsDir: '.trae' },
+    { name: 'Rovo Dev CLI', value: 'rovodev', available: true, successLabel: 'Rovo Dev CLI', skillsDir: '.rovodev', detectionPaths: ['.rovodev/skills', '.rovodev'] },
+    { name: 'Zoo Code', value: 'roocode', available: true, successLabel: 'Zoo Code', skillsDir: '.roo', requiresIdeRestart: true },
+    { name: 'Trae', value: 'trae', available: true, successLabel: 'Trae', skillsDir: '.trae', requiresIdeRestart: true },
     { name: 'ZCode', value: 'zcode', available: true, successLabel: 'ZCode', skillsDir: '.zcode' },
-    { name: 'AGENTS.md (works with Amp, VS Code, …)', value: 'agents', available: false, successLabel: 'your AGENTS.md-compatible assistant' }
+    // Vendor-neutral target for assistants that read the shared `.agents` root.
+    // Detection keys off `.agents/skills` rather than the bare root: frameworks use
+    // `.agents/` for more than skills, so the root alone says nothing about skills.
+    // A project that does keep skills there is a project this target fits, the same
+    // way `.claude/` selects Claude Code — the signal is the user's setup, not
+    // OpenSpec's own files.
+    { name: 'Shared .agents skills', value: 'agents', available: true, successLabel: 'shared .agents skills', skillsDir: '.agents', detectionPaths: ['.agents/skills'] }
 ];
 /**
  * Retired tool ids that still resolve, so a rebrand does not break scripted

package/dist/core/file-state.js

@@ -1,5 +1,6 @@
 import * as nodeFs from 'node:fs';
 import * as path from 'node:path';
+import { randomUUID } from 'node:crypto';
 import { FileSystemUtils } from '../utils/file-system.js';
 import { StoreError } from './store/errors.js';
 const fs = nodeFs.promises;
@@ -19,9 +20,15 @@ export function makeLockErrorFactory(data) {
         });
     };
 }
-const STALE_LOCK_THRESHOLD_MS = 30_000;
 const LOCK_DEADLINE_MS = 5000;
 const LOCK_POLL_MS = 25;
+const PRIVATE_FILE_MODE = 0o600;
+const lockOwnership = new WeakMap();
+function isUnsupportedSyncError(error) {
+    return (isNodeErrorCode(error, 'EINVAL') ||
+        isNodeErrorCode(error, 'ENOTSUP') ||
+        isNodeErrorCode(error, 'ENOSYS'));
+}
 export function isNodeErrorCode(error, code) {
     return (typeof error === 'object' &&
         error !== null &&
@@ -56,7 +63,10 @@ export async function writeFileAtomically(filePath, content) {
     await FileSystemUtils.createDirectory(dirPath);
     const tempPath = path.join(dirPath, `.${path.basename(filePath)}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`);
     try {
-        await fs.writeFile(tempPath, content, 'utf-8');
+        await fs.writeFile(tempPath, content, {
+            encoding: 'utf-8',
+            mode: PRIVATE_FILE_MODE,
+        });
         await fs.rename(tempPath, filePath);
     }
     catch (error) {
@@ -74,39 +84,61 @@ export async function acquireFileLock(options) {
     const deadline = Date.now() + LOCK_DEADLINE_MS;
     while (true) {
         try {
-            return await fs.open(lockPath, 'wx');
+            const lock = await fs.open(lockPath, 'wx', PRIVATE_FILE_MODE);
+            const ownershipToken = `${process.pid}:${randomUUID()}`;
+            try {
+                await lock.writeFile(ownershipToken, 'utf-8');
+                try {
+                    await lock.sync();
+                }
+                catch (error) {
+                    // Some FUSE and network filesystems support exclusive lock files but
+                    // explicitly do not implement fsync. The token is still visible to
+                    // cooperating processes, so do not make those projects unusable.
+                    if (!isUnsupportedSyncError(error)) {
+                        throw error;
+                    }
+                }
+            }
+            catch (error) {
+                await lock.close().catch(() => undefined);
+                await fs.rm(lockPath, { force: true }).catch(() => undefined);
+                throw error;
+            }
+            lockOwnership.set(lock, ownershipToken);
+            return lock;
         }
         catch (error) {
             if (!isNodeErrorCode(error, 'EEXIST')) {
                 // A permission or filesystem problem, not contention - say so.
                 throw errorFor('create-failed', { lockPath, cause: error });
             }
-            // A crashed process leaves the lock behind forever; state-file
-            // writes are sub-second, so an old lock is an orphan - steal it.
-            let staleStolen = false;
-            try {
-                const lockStat = await fs.stat(lockPath);
-                if (Date.now() - lockStat.mtimeMs > STALE_LOCK_THRESHOLD_MS) {
-                    await fs.rm(lockPath, { force: true });
-                    staleStolen = true;
-                }
-            }
-            catch {
-                // The holder released between open and stat - retry, but stay
-                // bounded: a persistently failing stat (EPERM, delete-pending)
-                // must hit the deadline instead of spinning forever.
-            }
-            if (!staleStolen) {
-                if (Date.now() >= deadline) {
-                    throw errorFor('timeout', { lockPath });
-                }
-                await sleep(LOCK_POLL_MS);
+            // Never steal by age: unlinking a supposedly stale path can race with
+            // its replacement and erase a live owner's lock. The timeout diagnostic
+            // gives the user an explicit recovery path for genuinely orphaned locks.
+            if (Date.now() >= deadline) {
+                throw errorFor('timeout', { lockPath });
             }
+            await sleep(LOCK_POLL_MS);
         }
     }
 }
 export async function releaseFileLock(lock, lockPath) {
+    const ownershipToken = lockOwnership.get(lock);
+    lockOwnership.delete(lock);
     await lock.close().catch(() => undefined);
-    await fs.rm(lockPath, { force: true }).catch(() => undefined);
+    if (ownershipToken === undefined) {
+        return;
+    }
+    try {
+        const currentToken = await fs.readFile(lockPath, 'utf-8');
+        if (currentToken === ownershipToken) {
+            await fs.rm(lockPath, { force: true });
+        }
+    }
+    catch {
+        // The lock was already removed or replaced with an unreadable path.
+        // In either case, this owner must not remove anything else.
+    }
 }
 //# sourceMappingURL=file-state.js.map

package/dist/core/github-copilot/cloud-agent.d.ts

@@ -0,0 +1,95 @@
+/**
+ * GitHub Copilot Cloud Agent Support
+ *
+ * Generates copilot-setup-steps.yml and .github/agents/openspec.agent.md
+ * when the github-copilot tool is selected during init/update.
+ * These files enable the GitHub Copilot coding agent (cloud) to use the
+ * OpenSpec CLI in its ephemeral dev environment.
+ */
+/**
+ * Check if a tool list includes github-copilot.
+ */
+export declare function includesGitHubCopilot(toolIds: string[]): boolean;
+/**
+ * Generate the copilot-setup-steps.yml workflow file content.
+ * This workflow pre-installs the OpenSpec CLI in the Copilot coding agent's
+ * ephemeral GitHub Actions environment.
+ */
+export declare function generateCopilotSetupSteps(): string;
+/**
+ * Generate the .github/agents/openspec.agent.md custom agent file content.
+ * This tells the GitHub Copilot coding agent how to use the OpenSpec CLI.
+ */
+export declare function generateCopilotAgentFile(): string;
+/**
+ * File paths (relative to project root) for the generated files.
+ */
+export declare const COPILOT_CLOUD_FILES: {
+    readonly setupSteps: string;
+    readonly agent: string;
+};
+/**
+ * Reconcile Copilot cloud agent files in the project directory.
+ * Creates missing files and refreshes recognized legacy generated files while
+ * preserving current generated content and user customizations.
+ *
+ * @returns Object indicating which files were written.
+ */
+export declare function writeCopilotCloudFiles(projectPath: string): Promise<{
+    setupStepsWritten: boolean;
+    agentWritten: boolean;
+}>;
+/**
+ * Remove copilot cloud agent files from the project directory.
+ * Used when github-copilot is deselected.
+ *
+ * @returns Number of files removed.
+ */
+export declare function removeCopilotCloudFiles(projectPath: string): Promise<number>;
+/**
+ * Read the persisted opt-in for Copilot cloud-file generation.
+ *
+ * Tri-state: `true` (opted in), `false` (explicitly opted out), or `undefined`
+ * (never decided). A malformed value is treated as undecided rather than an
+ * error, matching how {@link readProjectConfig} degrades on bad fields.
+ */
+export declare function readCopilotCloudOptIn(projectPath: string): boolean | undefined;
+/**
+ * True when a managed Copilot cloud file (the current generation or a
+ * recognized legacy one) already exists. Projects created before the opt-in
+ * prompt existed are treated as implicitly opted in, so `openspec update`
+ * keeps their files current instead of silently abandoning them.
+ */
+export declare function hasExistingManagedCloudFiles(projectPath: string): Promise<boolean>;
+/**
+ * Effective decision on whether to generate/refresh Copilot cloud files.
+ * An explicit opt-in or opt-out always wins; when undecided, fall back to
+ * whether managed files already exist (the migration path above).
+ */
+export declare function isCopilotCloudEnabled(projectPath: string): Promise<boolean>;
+/**
+ * Persist the Copilot cloud opt-in into openspec/config.yaml.
+ *
+ * Uses the YAML document model rather than a re-serialize so the user's
+ * existing comments, ordering, and formatting survive untouched — the config
+ * file is hand-authored and heavily commented, so a lossy round-trip would be
+ * its own source of toil. No-op when no config file exists yet (init creates it
+ * before this is called); the caller treats persistence failures as non-fatal.
+ */
+export declare function persistCopilotCloudOptIn(projectPath: string, value: boolean): Promise<void>;
+/**
+ * Return the managed cloud-file paths (relative to the project root) that
+ * currently hold user-owned, non-managed content — i.e. files OpenSpec will
+ * deliberately leave untouched. Used to tell an opted-in user that we preserved
+ * their existing file rather than silently doing nothing, which is the honest
+ * answer to "will this affect my existing Copilot cloud setup?".
+ */
+export declare function findUnmanagedCloudFiles(projectPath: string): Promise<string[]>;
+/**
+ * Return the managed cloud-file paths (relative to the project root) that
+ * currently exist and hold OpenSpec-generated content. Callers report this
+ * rather than the intended paths, so output never claims a file that a write
+ * skipped (user already owns it) or that reconciliation removed.
+ */
+export declare function listManagedCloudFiles(projectPath: string): Promise<string[]>;
+//# sourceMappingURL=cloud-agent.d.ts.map