specify-cli 0.14.4__tar.gz → 0.15.0__tar.gz

{specify_cli-0.14.4 → specify_cli-0.15.0}/.github/scripts/check_security_requirements.py

@@ -29,12 +29,20 @@ def _dependency_diff_refs() -> tuple[str, str]:
 def _dependency_inputs_changed() -> bool:
     base_ref, head_ref = _dependency_diff_refs()
     try:
+        merge_base = subprocess.run(
+            ["git", "merge-base", base_ref, head_ref],
+            check=True,
+            cwd=REPO_ROOT,
+            stderr=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            text=True,
+        ).stdout.strip()
         result = subprocess.run(
             [
                 "git",
                 "diff",
                 "--name-only",
-                base_ref,
+                merge_base,
                 head_ref,
                 "--",
                 *DEPENDENCY_INPUTS,
@@ -77,6 +85,7 @@ def main() -> int:
 
     generated_requirements = Path(generated_requirements_env)
     generated_requirements.parent.mkdir(parents=True, exist_ok=True)
+    generated_requirements.write_bytes(COMMITTED_REQUIREMENTS.read_bytes())
 
     subprocess.run(
         [
@@ -87,7 +96,6 @@ def main() -> int:
             "--extra",
             "test",
             "--universal",
-            "--upgrade",
             "--generate-hashes",
             "--quiet",
             "--no-header",

{specify_cli-0.14.4 → specify_cli-0.15.0}/.github/workflows/security.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Check committed audit requirements are current
         env:
           DEPENDENCY_DIFF_BASE: ${{ github.event.pull_request.base.sha || github.event.before || '' }}
-          DEPENDENCY_DIFF_HEAD: ${{ github.sha }}
+          DEPENDENCY_DIFF_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
           GENERATED_REQUIREMENTS: ${{ runner.temp }}/security-audit-requirements.txt
         run: python .github/scripts/check_security_requirements.py
 

{specify_cli-0.14.4 → specify_cli-0.15.0}/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 <!-- insert new changelog below this comment -->
 
+## [0.15.0] - 2026-07-30
+
+### Changed
+
+- Add yolo to community workflow catalog (#3864)
+- fix(workflows): guard the shell step's timeout check against OverflowError (#3865)
+- Add Intent Reconciliation extension to community catalog (#3858)
+- fix(workflows): validate prompt step 'timeout' like the shell step (#3847)
+- fix: add utf-8 encoding to registry file open calls (#3816)
+- fix: eliminate TOCTOU race in file unlink calls (#3815)
+- test(workflows): name the condition-rejection tests for the real boundary (#3808)
+- fix: eliminate TOCTOU race in file unlink calls (#3811)
+- fix(presets): escape user-supplied catalog name/URL in add/remove output (#3806)
+- fix: add missing utf-8 encoding to registry file open calls (#3810)
+- [bug-fix] Fix upgrade-overwrites-copilot-skills: pass force=True to extension skill re-registration after upgrade (#3853)
+- fix(integrations): don't abort uninstall when the manifest can't be deleted (#3805)
+- test(extensions): update stale manifest validation message assertion (#3859)
+- fix(agents): coerce a non-string description in TOML command rendering (#3799)
+- fix(workflows): make security requirements sync deterministic (#3832)
+- fix(cli): render the literal [suffix] in --tag help and rejection message (#3800)
+- fix(integrations): preserve non-UTF-8 VS Code settings (#3833)
+- fix(bundler): treat an explicit-null manifest field as missing, not the text "None" (#3798)
+- feat: first-class agent-native runtime hooks for integrations (#3704)
+- fix(extensions): guard the required manifest sections so one bad extension cannot break `extension list` (#3797)
+- fix(presets): escape installed preset metadata in Rich output (#3826)
+- fix(workflows): dispatch prompt steps via the resolved executable (#3793)
+- chore: release 0.14.4, begin 0.14.5.dev0 development (#3850)
+
 ## [0.14.4] - 2026-07-29
 
 ### Changed

{specify_cli-0.14.4 → specify_cli-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specify-cli
-Version: 0.14.4
+Version: 0.15.0
 Summary: Specify CLI, part of GitHub Spec Kit. A tool to bootstrap your projects for Spec-Driven Development (SDD).
 License-File: LICENSE
 Requires-Python: >=3.11

{specify_cli-0.14.4 → specify_cli-0.15.0}/docs/community/extensions.md

@@ -66,6 +66,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | Improve Extension | Audits any codebase as a senior advisor and writes prioritized, self-contained spec prompts under specs/ that the spec-kit lifecycle can process | `process` | Read+Write | [spec-kit-improve](https://github.com/d0whc3r/spec-kit-improve) |
 | Intake | Normalize PRD, design, HTML SSOT, and test-case evidence into SDD-ready intake artifacts. | `docs` | Read+Write | [spec-kit-intake](https://github.com/bigsmartben/spec-kit-intake) |
 | Intelligent Agent Orchestrator | Cross-catalog agent discovery and intelligent prompt-to-command routing | `process` | Read+Write | [spec-kit-orchestrator](https://github.com/pragya247/spec-kit-orchestrator) |
+| Intent Reconciliation | Reconcile implementation-discovered decisions against approved feature intent | `process` | Read+Write | [spec-kit-reconcile](https://github.com/SuhaibAslam/spec-kit-reconcile) |
 | Iterate | Iterate on spec documents with a two-phase define-and-apply workflow — refine specs mid-implementation and go straight back to building | `docs` | Read+Write | [spec-kit-iterate](https://github.com/imviancagrace/spec-kit-iterate) |
 | Jira Integration | Create Jira Epics, Stories, and Issues from spec-kit specifications and task breakdowns with configurable hierarchy and custom field support | `integration` | Read+Write | [spec-kit-jira](https://github.com/mbachorik/spec-kit-jira) |
 | Jira Integration (Sync Engine) | Idempotent, drift-aware, fail-closed reconcile engine mirroring spec-kit specs into Jira (Epic per repo, Story per spec, Subtask per phase) | `integration` | Read+Write | [spec-kit-jira-sync](https://github.com/ashbrener/spec-kit-jira-sync) |

{specify_cli-0.14.4 → specify_cli-0.15.0}/extensions/catalog.community.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1.0",
-  "updated_at": "2026-07-28T00:00:00Z",
+  "updated_at": "2026-07-29T00:00:00Z",
   "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/extensions/catalog.community.json",
   "extensions": {
     "aide": {
@@ -1861,6 +1861,40 @@
       "created_at": "2026-06-23T00:00:00Z",
       "updated_at": "2026-06-30T00:00:00Z"
     },
+    "intent": {
+      "name": "Intent Reconciliation",
+      "id": "intent",
+      "description": "Reconcile implementation-discovered decisions against approved feature intent",
+      "author": "SuhaibAslam",
+      "version": "1.0.2",
+      "download_url": "https://github.com/SuhaibAslam/spec-kit-reconcile/archive/refs/tags/v1.0.2.zip",
+      "repository": "https://github.com/SuhaibAslam/spec-kit-reconcile",
+      "homepage": "https://github.com/SuhaibAslam/spec-kit-reconcile",
+      "documentation": "https://github.com/SuhaibAslam/spec-kit-reconcile/blob/main/README.md",
+      "changelog": "https://github.com/SuhaibAslam/spec-kit-reconcile/blob/main/CHANGELOG.md",
+      "license": "MIT",
+      "category": "process",
+      "effect": "read-write",
+      "requires": {
+        "speckit_version": ">=0.12.0"
+      },
+      "provides": {
+        "commands": 3,
+        "hooks": 0
+      },
+      "tags": [
+        "intent",
+        "decisions",
+        "reconciliation",
+        "drift",
+        "workflow"
+      ],
+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-07-29T00:00:00Z",
+      "updated_at": "2026-07-29T00:00:00Z"
+    },
     "issue": {
       "name": "GitHub Issues Integration 2",
       "id": "issue",

{specify_cli-0.14.4 → specify_cli-0.15.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "specify-cli"
-version = "0.14.4"
+version = "0.15.0"
 description = "Specify CLI, part of GitHub Spec Kit. A tool to bootstrap your projects for Spec-Driven Development (SDD)."
 readme = "README.md"
 requires-python = ">=3.11"

{specify_cli-0.14.4 → specify_cli-0.15.0}/src/specify_cli/__init__.py

@@ -514,6 +514,11 @@ _register_extension_cmds(app)
 from .integrations._commands import register as _register_integration_cmds  # noqa: E402
 _register_integration_cmds(app)
 
+
+# ===== Event Commands =====
+from .commands.event import register as _register_event_cmds  # noqa: E402
+_register_event_cmds(app)
+
 # Re-export selected helpers to preserve the public import surface.
 from .integrations._helpers import (  # noqa: E402
     _clear_init_options_for_integration as _clear_init_options_for_integration,

{specify_cli-0.14.4 → specify_cli-0.15.0}/src/specify_cli/_version.py

@@ -27,6 +27,7 @@ from pathlib import Path
 
 import typer
 from packaging.version import InvalidVersion, Version
+from rich.markup import escape as _escape_markup
 
 from ._download_security import MAX_JSON_METADATA_BYTES, read_response_limited
 from ._console import console
@@ -1230,7 +1231,10 @@ def self_upgrade(
     tag: str | None = typer.Option(
         None,
         "--tag",
-        help="Pin the target version (vX.Y.Z[suffix]). Without --tag, the "
+        # Typer renders help through Rich, so escape the literal bracket (\[)
+        # or `[suffix]` is parsed as a style tag and dropped -- `--help` then
+        # advertises only `(vX.Y.Z)`, contradicting docs/upgrade.md and README.
+        help="Pin the target version (vX.Y.Z\\[suffix]). Without --tag, the "
         "latest stable release is resolved via GitHub Releases.",
     ),
 ) -> None:
@@ -1270,7 +1274,14 @@ def self_upgrade(
         try:
             tag = _validate_tag(tag)
         except typer.BadParameter as exc:
-            console.print(str(exc), soft_wrap=True)
+            # Escape at the print site rather than baking `\[` into
+            # _INVALID_TAG_MESSAGE: the message is also raised through
+            # typer.BadParameter, which Click renders without Rich, so the
+            # constant must stay plain text. Unescaped, Rich parses the literal
+            # `[suffix]` as a style tag and drops it, leaving the user with
+            # "expected vMAJOR.MINOR.PATCH" -- implying a bare vX.Y.Z is the only
+            # accepted form when -rc1 / .dev0 / +build.42 are all valid.
+            console.print(_escape_markup(str(exc)), soft_wrap=True)
             raise typer.Exit(1) from exc
 
     plan, failure_reason = _build_upgrade_plan(target_tag_override=tag)

{specify_cli-0.14.4 → specify_cli-0.15.0}/src/specify_cli/agents.py

@@ -302,8 +302,20 @@ class CommandRegistrar:
         toml_lines = []
 
         if "description" in frontmatter:
+            # Frontmatter comes from ``yaml.safe_load``, so ``description`` can
+            # be any YAML type: ``description:`` with no value yields None,
+            # ``description: 2`` an int, an unquoted ``true`` a bool.
+            # ``_render_basic_toml_string`` iterates the value and calls ord()
+            # on each character, so a non-string raises a raw TypeError -- and a
+            # list of single-character items is silently concatenated into a
+            # wrong value (``["a", "b"]`` -> ``"ab"``). Coerce first, matching
+            # ``render_yaml_command`` below and ``TomlIntegration
+            # ._extract_description``, which both normalise it already.
+            description = frontmatter["description"]
+            if not isinstance(description, str):
+                description = str(description) if description is not None else ""
             toml_lines.append(
-                f"description = {self._render_basic_toml_string(frontmatter['description'])}"
+                f"description = {self._render_basic_toml_string(description)}"
             )
             toml_lines.append("")
 

{specify_cli-0.14.4 → specify_cli-0.15.0}/src/specify_cli/bundler/models/manifest.py

@@ -96,19 +96,19 @@ class BundleManifest:
         if not isinstance(data, dict):
             raise BundlerError("Manifest must be a YAML mapping at the top level.")
 
-        schema_version = str(data.get("schema_version", "")).strip()
+        schema_version = _text(data.get("schema_version"))
 
         bundle_raw = data.get("bundle")
         if not isinstance(bundle_raw, dict):
             raise BundlerError("Manifest is missing the required 'bundle' mapping.")
         meta = BundleMeta(
-            id=str(bundle_raw.get("id", "")).strip(),
-            name=str(bundle_raw.get("name", "")).strip(),
-            version=str(bundle_raw.get("version", "")).strip(),
-            role=str(bundle_raw.get("role", "")).strip(),
-            description=str(bundle_raw.get("description", "")).strip(),
-            author=str(bundle_raw.get("author", "")).strip(),
-            license=str(bundle_raw.get("license", "")).strip(),
+            id=_text(bundle_raw.get("id")),
+            name=_text(bundle_raw.get("name")),
+            version=_text(bundle_raw.get("version")),
+            role=_text(bundle_raw.get("role")),
+            description=_text(bundle_raw.get("description")),
+            author=_text(bundle_raw.get("author")),
+            license=_text(bundle_raw.get("license")),
         )
 
         requires_raw = data.get("requires")
@@ -117,7 +117,7 @@ class BundleManifest:
         elif not isinstance(requires_raw, dict):
             raise BundlerError("'requires' must be a mapping when present.")
         requires = Requires(
-            speckit_version=str(requires_raw.get("speckit_version", "")).strip(),
+            speckit_version=_text(requires_raw.get("speckit_version")),
             tools=_parse_str_list(requires_raw.get("tools"), "requires.tools"),
             mcp=_parse_str_list(requires_raw.get("mcp"), "requires.mcp"),
         )
@@ -220,6 +220,22 @@ class BundleManifest:
         return self.integration is None
 
 
+def _text(raw: Any) -> str:
+    """Coerce a manifest scalar into stripped text, mapping an explicit null to ``""``.
+
+    A ``.get(key, "")`` default only covers a *missing* key. A key that is
+    present but null -- how YAML spells an empty field (``author:`` with nothing
+    after it) -- yields ``None``, and ``str(None)`` is the literal ``"None"``.
+    That text is non-empty, so it sailed past the ``if not value`` required-field
+    checks in :meth:`BundleManifest.structural_errors`: an empty required field
+    was silently accepted and the bundle shipped ``"None"`` as its
+    author/license/description.
+    """
+    if raw is None:
+        return ""
+    return str(raw).strip()
+
+
 def _parse_str_list(raw: Any, field_name: str) -> tuple[str, ...]:
     """Coerce a manifest list-of-strings field into a tuple of strings.
 
@@ -247,7 +263,7 @@ def _parse_refs(kind: str, raw: Any) -> list[ComponentRef]:
         refs.append(
             ComponentRef(
                 kind=kind,
-                id=str(item.get("id", "")).strip(),
+                id=_text(item.get("id")),
                 version=(str(item["version"]).strip() if item.get("version") else None),
                 source=(str(item["source"]).strip() if item.get("source") else None),
                 priority=priority,

specify_cli-0.15.0/src/specify_cli/commands/event.py

@@ -0,0 +1,39 @@
+"""specify event * command handlers."""
+
+from __future__ import annotations
+
+from pathlib import Path
+import sys
+import typer
+
+event_app = typer.Typer(
+    name="event",
+    help="Manage and execute event-driven commands",
+    add_completion=False,
+)
+
+
+@event_app.command("run")
+def event_run(
+    command_name: str = typer.Argument(..., help="Name of the command to execute"),
+    event_name: str = typer.Argument(..., help="Canonical event name (e.g., session_start)"),
+    timeout: int = typer.Argument(
+        120, help="Per-handler timeout in seconds (passed through from the native hook config)"
+    ),
+):
+    """Resolve and run an event-driven command script with stdin payload."""
+    from ..events import resolve_and_run_event_command
+
+    # Read payload from stdin if available
+    payload = sys.stdin.read() if not sys.stdin.isatty() else "{}"
+
+    # Run the event command
+    project_root = Path.cwd()  # The agent runs events from project root
+    exit_code = resolve_and_run_event_command(
+        command_name, event_name, payload, project_root, timeout=timeout
+    )
+    raise typer.Exit(code=exit_code)
+
+
+def register(app: typer.Typer) -> None:
+    app.add_typer(event_app, name="event")

{specify_cli-0.14.4 → specify_cli-0.15.0}/src/specify_cli/commands/init.py

@@ -443,12 +443,20 @@ def register(app: typer.Typer) -> None:
                     if extra:
                         integration_parsed_options.update(extra)
 
+                from ..events import resolve_events
+                events_map = resolve_events(
+                    resolved_integration.key,
+                    resolved_integration.config,
+                    project_path,
+                    integration_parsed_options or None,
+                )
                 resolved_integration.setup(
                     project_path,
                     manifest,
                     parsed_options=integration_parsed_options or None,
                     script_type=selected_script,
                     raw_options=integration_options,
+                    events=events_map,
                 )
                 manifest.save()