specify-cli 1.0.3__tar.gz → 1.0.4__tar.gz

{specify_cli-1.0.3 → specify_cli-1.0.4}/.github/ISSUE_TEMPLATE/agent_request.yml

@@ -8,7 +8,7 @@ body:
       value: |
         Thanks for requesting a new agent! Before submitting, please check if the agent is already supported.
 
-        **Currently supported agents**: Alquimia AI, Amp, Antigravity, Auggie CLI, Claude Code, Cline, CodeBuddy, Codex CLI, Command Code, Cursor, Devin for Terminal, Docker Agent, Factory Droid, Firebender, Forge, Gemini CLI, GitHub Copilot, Goose, Grok Build, Hermes Agent, IBM Bob, Junie, Kilo Code, Kimi Code, Kiro CLI, Lingma, Mistral Vibe, Oh My Pi, opencode, Pi Coding Agent, Qoder CLI, Qwen Code, RovoDev ACLI, SHAI, Tabnine CLI, Trae, ZCode, Zed
+        **Currently supported agents**: Alquimia AI, Amp, Antigravity, Auggie CLI, Claude Code, Cline, CodeBuddy, Codex CLI, Command Code, Cursor, Devin for Terminal, Docker Agent, Factory Droid, DeepSeek Harness, Firebender, Forge, Gemini CLI, GitHub Copilot, Goose, Grok Build, Hermes Agent, IBM Bob, Junie, Kilo Code, Kimi Code, Kiro CLI, Lingma, Mistral Vibe, Oh My Pi, opencode, Pi Coding Agent, Qoder CLI, Qwen Code, RovoDev ACLI, SHAI, Tabnine CLI, Trae, ZCode, Zed
 
   - type: input
     id: agent-name

{specify_cli-1.0.3 → specify_cli-1.0.4}/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -75,6 +75,7 @@ body:
         - Devin for Terminal
         - Docker Agent
         - Factory Droid
+        - DeepSeek Harness
         - Firebender
         - Forge
         - Gemini CLI

{specify_cli-1.0.3 → specify_cli-1.0.4}/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -69,6 +69,7 @@ body:
         - Devin for Terminal
         - Docker Agent
         - Factory Droid
+        - DeepSeek Harness
         - Firebender
         - Forge
         - Gemini CLI

{specify_cli-1.0.3 → specify_cli-1.0.4}/AGENTS.md

@@ -506,7 +506,7 @@ Disclosure is **continuous**, not a one-time event. A single AI-disclosure parag
 ### Opening pull requests
 
 - Before opening a pull request, check whether the account that will file it already has three open pull requests in this repository.
-- If so, alert the user that additional submissions may receive lower review priority and ask for explicit permission to proceed. Do not assume consent.
+- If so, alert the user that additional submissions may receive lower review priority and ask for explicit permission to proceed. Do not assume consent. If the user is unavailable to provide that permission, including during autonomous or non-interactive operation, do not open the pull request. Preserve the work on a branch and report that confirmation is required.
 
 ### Commits
 

{specify_cli-1.0.3 → specify_cli-1.0.4}/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 <!-- insert new changelog below this comment -->
 
+## [1.0.4] - 2026-09-02
+
+### Changed
+
+- fix(scripts): stop wrap composition looping on a token in core content (#4396)
+- [extension] Update Charter extension to v0.6.1 (#4409)
+- fix(workflows): keep non-ASCII text readable in written overlay files (#4148)
+- fix(workflows): report overlay operation keys in declaration order (#4146)
+- fix: skip corrupted state.json in list_runs() instead of aborting (#3904)
+- fix(rovodev): guard non-string prompt names when merging prompts.yml (#4145)
+- fix: narrow bare except Exception in preset command reconciliation (#3842)
+- fix(workflows): refuse a filter mixed with a comparison operator instead of silently mis-binding it (#3894)
+- fix: escape Rich markup in workflow error output (#3837)
+- fix: add JSON error handling to auth config loader (#3836)
+- fix: use missing_ok=True in extension ZIP cleanup (#3870)
+- feat(presets): let a preset declare a required extension (#4250)
+- fix(bundler): reject unsupported catalog payload versions (#4090)
+- fix(extensions): install bundled extension updates from the local package (#4351)
+- docs: clarify autonomous PR handling (#4392)
+- fix(workflows): reject malformed step config on add (#4087)
+- fix(powershell): stop create-new-feature crashing on a non-Latin description (#4138)
+- fix(bundler): treat an explicit-null records field as missing, not "None" (#4136)
+- Add DeepSeek Harness (DSH) integration (#4336)
+- chore: release 1.0.3, begin 1.0.4.dev0 development (#4391)
+
 ## [1.0.3] - 2026-09-01
 
 ### Changed

{specify_cli-1.0.3 → specify_cli-1.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: specify-cli
-Version: 1.0.3
+Version: 1.0.4
 Summary: Specify CLI, part of GitHub Spec Kit. A tool to bootstrap your projects for Spec-Driven Development (SDD).
 License-File: LICENSE
 Requires-Python: >=3.11

{specify_cli-1.0.3 → specify_cli-1.0.4}/docs/community/extensions.md

@@ -52,7 +52,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | Bugfix Workflow | Structured bugfix workflow — capture bugs, trace to spec artifacts, and patch specs surgically | `process` | Read+Write | [spec-kit-bugfix](https://github.com/Quratulain-bilal/spec-kit-bugfix) |
 | Canon | Adds canon-driven (baseline-driven) workflows: spec-first, code-first, spec-drift. Requires Canon Core preset installation. | `process` | Read+Write | [spec-kit-canon](https://github.com/maximiliamus/spec-kit-canon/tree/master/extension) |
 | Catalog CI | Automated validation for spec-kit community catalog entries — structure, URLs, diffs, and linting | `process` | Read-only | [spec-kit-catalog-ci](https://github.com/Quratulain-bilal/spec-kit-catalog-ci) |
-| Charter | Compose modular project constitutions from shared fragment registries. Centralize governance rules, select per-project fragments, track upstream changes, and keep multi-project setups consistent. | `process` | Read+Write | [spec-kit-charter](https://github.com/Fyloss/spec-kit-charter) |
+| Charter | Compose project constitutions from shared fragment registries | `process` | Read+Write | [spec-kit-charter](https://github.com/Fyloss/spec-kit-charter) |
 | CI Guard | Spec compliance gates for CI/CD — verify specs exist, check drift, and block merges on gaps | `process` | Read-only | [spec-kit-ci-guard](https://github.com/Quratulain-bilal/spec-kit-ci-guard) |
 | Checkpoint Extension | Commit the changes made during the middle of the implementation, so you don't end up with just one very large commit at the end | `code` | Read+Write | [spec-kit-checkpoint](https://github.com/aaronrsun/spec-kit-checkpoint) |
 | Cleanup Extension | Post-implementation quality gate that reviews changes, fixes small issues (scout rule), creates tasks for medium issues, and generates analysis for large issues | `code` | Read+Write | [spec-kit-cleanup](https://github.com/dsrednicki/spec-kit-cleanup) |

{specify_cli-1.0.3 → specify_cli-1.0.4}/docs/reference/extensions.md

@@ -75,6 +75,8 @@ specify extension update [<name>]
 
 Updates a specific extension, or all installed extensions if no name is given.
 
+Bundled extensions (such as `agent-context` and `git`) have no download URL; their updates install from the copy shipped with the running spec-kit release. When the catalog advertises a newer version than your spec-kit release ships, the update is reported as requiring a spec-kit upgrade first.
+
 ## Enable / Disable an Extension
 
 ```bash

{specify_cli-1.0.3 → specify_cli-1.0.4}/docs/reference/integrations.md

@@ -16,6 +16,7 @@ The Specify CLI supports a wide range of AI coding agents. When you run `specify
 | [Codex CLI](https://github.com/openai/codex)                                         | `codex`          | Skills-based integration; installs skills into `.agents/skills` and invokes them as `$speckit-<command>` |
 | [Command Code](https://commandcode.ai/docs)                                          | `command-code`   | Skills-based integration; installs skills into `.commandcode/skills/` and invokes them as `$speckit-<command>` |
 | [Cursor](https://cursor.sh/)                                                         | `cursor-agent`   |                                                                                                                                           |
+| [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)                  | `dsh`            | Skills-based integration; installs skills into `.dsh/skills` and invokes them as `/speckit-<command>` |
 | [Devin for Terminal](https://cli.devin.ai/docs)                                      | `devin`          | Skills-based integration; installs skills into `.devin/skills/` and invokes them as `/speckit-<command>` |
 | [Docker Agent](https://docs.docker.com/ai/docker-agent/)                              | `docker-agent`   | Skills-based integration; installs skills into `.agents/skills/` (the same directory used by Codex and Zed). In the selected agent YAML, enable local skills with `skills: true` and provide filesystem read access. Detects either the standalone `docker-agent` binary or the Docker CLI plugin (`docker agent`). Configure workflow dispatch with `SPECKIT_INTEGRATION_DOCKER_AGENT_EXTRA_ARGS=./agent.yaml`; the Spec Kit prompt is appended after these arguments. Not multi-install safe by default because the skills directory is shared. |
 | [Factory Droid](https://docs.factory.ai/cli/getting-started/overview)               | `droid`          | Skills-based integration; installs skills into `.factory/skills/` and invokes them as `/speckit-<command>`                               |

{specify_cli-1.0.3 → specify_cli-1.0.4}/extensions/catalog.community.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1.0",
-  "updated_at": "2026-09-01T00:00:00Z",
+  "updated_at": "2026-09-02T00:00:00Z",
   "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/extensions/catalog.community.json",
   "extensions": {
     "adrkit": {
@@ -1039,13 +1039,13 @@
     "charter": {
       "name": "Charter",
       "id": "charter",
-      "description": "Compose modular project constitutions from shared fragment registries. Centralize governance rules, select per-project fragments, track upstream changes, and keep multi-project setups consistent.",
+      "description": "Compose project constitutions from shared fragment registries",
       "author": "Fyloss",
-      "version": "0.5.1",
-      "download_url": "https://github.com/Fyloss/spec-kit-charter/archive/refs/tags/v0.5.1.zip",
+      "version": "0.6.1",
+      "download_url": "https://github.com/Fyloss/spec-kit-charter/archive/refs/tags/v0.6.1.zip",
       "repository": "https://github.com/Fyloss/spec-kit-charter",
       "homepage": "https://github.com/Fyloss/spec-kit-charter",
-      "documentation": "https://github.com/Fyloss/spec-kit-charter/tree/master/docs",
+      "documentation": "https://github.com/Fyloss/spec-kit-charter/blob/master/README.md",
       "changelog": "https://github.com/Fyloss/spec-kit-charter/blob/master/CHANGELOG.md",
       "license": "MIT",
       "category": "process",
@@ -1066,15 +1066,15 @@
       "tags": [
         "constitution",
         "governance",
-        "modular",
-        "fragments",
-        "registry"
+        "multi-repo",
+        "composition",
+        "fragments"
       ],
       "verified": false,
       "downloads": 0,
       "stars": 0,
       "created_at": "2026-07-06T00:00:00Z",
-      "updated_at": "2026-08-04T00:00:00Z"
+      "updated_at": "2026-09-02T00:00:00Z"
     },
     "ci-guard": {
       "name": "CI Guard",

{specify_cli-1.0.3 → specify_cli-1.0.4}/integrations/catalog.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1.0",
-  "updated_at": "2026-08-26T00:00:00Z",
+  "updated_at": "2026-08-31T00:00:00Z",
   "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/integrations/catalog.json",
   "integrations": {
     "alquimia": {
@@ -66,6 +66,15 @@
       "repository": "https://github.com/github/spec-kit",
       "tags": ["cli", "skills", "factory"]
     },
+    "dsh": {
+      "id": "dsh",
+      "name": "DeepSeek Harness",
+      "version": "1.0.0",
+      "description": "DeepSeek Harness (DSH) CLI skills-based integration",
+      "author": "spec-kit-core",
+      "repository": "https://github.com/github/spec-kit",
+      "tags": ["cli", "skills"]
+    },
     "amp": {
       "id": "amp",
       "name": "Amp",

{specify_cli-1.0.3 → specify_cli-1.0.4}/presets/PUBLISHING.md

@@ -68,6 +68,8 @@ preset:
 
 requires:
   speckit_version: ">=0.1.0"      # Required spec-kit version
+  extensions:                      # Optional: extensions this preset needs
+    - "companion-extension"
 
 provides:
   templates:
@@ -93,6 +95,41 @@ tags:                              # 2-5 relevant tags
 - ✅ Command names use dot notation (e.g. `speckit.specify`)
 - ✅ Tags are lowercase and descriptive
 
+#### Declaring extension dependencies
+
+If your preset overrides commands that call into an extension, declare it in
+`requires.extensions`. Without the extension the preset still installs and the
+overrides fall through to the core workflow, so nothing errors — the feature
+just silently does less than the user expects. Declaring the dependency makes
+`specify preset add` say so, and spell out how to resolve it.
+
+Use a bare id, or a mapping when you need a version constraint or an optional
+dependency:
+
+```yaml
+requires:
+  speckit_version: ">=0.9.0"
+  extensions:
+    - "companion-extension"              # required, any version
+    - id: "other-extension"
+      version: ">=1.2.0,<2"              # optional PEP 440 specifier
+      required: false                    # optional, defaults to true
+```
+
+`version` accepts any PEP 440 specifier, not just a lower bound — upper bounds
+(`<2`), exact pins (`==1.2.0`), and exclusions (`!=1.3.0`) all work.
+
+Notes:
+
+- The field is optional. A preset that declares nothing behaves exactly as before.
+- A dependency that is missing, stale, disabled, or version-unsatisfied produces a **warning, not a failure** — the install still succeeds.
+- A disabled extension counts as unmet, and so does one whose registry entry survives after its files were removed. Resolution skips both, so the preset is just as inert as if the extension were absent.
+- The warning names an exact command for the missing, stale, and disabled cases. For a version mismatch it states the constraint to satisfy rather than naming a command, because `specify extension update` only moves forward to the catalog release and cannot satisfy an upper bound, a pin, or a downgrade.
+- A recorded version that cannot be parsed is treated as uncomparable rather than as a mismatch, so an extension whose registry version reads `unknown` is not reported as failing a constraint it was never evaluated against.
+- An extension present on disk but absent from the registry counts as satisfied. Resolution admits unregistered directories, so the preset works and warning about it would be a false alarm — though with no recorded version, a `version` constraint cannot be checked against it.
+- `required: false` documents an enhancing-but-optional extension and is never warned about.
+- Declare it in `preset.yml`, not only in your catalog entry. The catalog is not consulted for `--dev` and `--from <url>` installs, so the manifest is the only copy present on every install path.
+
 ### 3. Test Locally
 
 ```bash

{specify_cli-1.0.3 → specify_cli-1.0.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "specify-cli"
-version = "1.0.3"
+version = "1.0.4"
 description = "Specify CLI, part of GitHub Spec Kit. A tool to bootstrap your projects for Spec-Driven Development (SDD)."
 readme = "README.md"
 requires-python = ">=3.11"

{specify_cli-1.0.3 → specify_cli-1.0.4}/scripts/bash/common.sh

@@ -902,12 +902,20 @@ except Exception as exc:
                     *'{CORE_TEMPLATE}'*) ;;
                     *) echo "Error: wrap strategy missing {CORE_TEMPLATE} placeholder" >&2; return 2 ;;
                 esac
-                while [[ "$layer_content" == *'{CORE_TEMPLATE}'* ]]; do
-                    local before="${layer_content%%\{CORE_TEMPLATE\}*}"
-                    local after="${layer_content#*\{CORE_TEMPLATE\}}"
-                    layer_content="${before}${content}${after}"
+                # Consume the wrapper left to right instead of rewriting it in
+                # place. Rewriting re-scanned the string just modified, so base
+                # content holding a literal {CORE_TEMPLATE} reintroduced the
+                # token every pass and the loop never terminated. Advancing over
+                # ``rest`` bounds the work by the tokens in the original wrapper
+                # and leaves inserted content untouched, matching the single-pass
+                # semantics of .Replace()/.replace() in the PowerShell and Python
+                # ports.
+                local wrapped="" rest="$layer_content"
+                while [[ "$rest" == *'{CORE_TEMPLATE}'* ]]; do
+                    wrapped="${wrapped}${rest%%\{CORE_TEMPLATE\}*}${content}"
+                    rest="${rest#*\{CORE_TEMPLATE\}}"
                 done
-                content="$layer_content"
+                content="${wrapped}${rest}"
                 ;;
             *) echo "Error: unknown strategy '$strat'" >&2; return 2 ;;
         esac

{specify_cli-1.0.3 → specify_cli-1.0.4}/scripts/powershell/create-new-feature.ps1

@@ -162,7 +162,14 @@ function Get-BranchName {
     } else {
         # Fallback to original logic if no meaningful words found
         $result = ConvertTo-CleanBranchName -Name $Description
-        $fallbackWords = ($result -split '-') | Where-Object { $_ } | Select-Object -First 3
+        # @() keeps this an array. ConvertTo-CleanBranchName blanks every
+        # non-[a-z0-9] character, so a description written in a non-Latin script
+        # (or made only of punctuation) leaves nothing for the pipeline to
+        # emit -- it yields $null, and [string]::Join on $null throws
+        # ArgumentNullException. With $ErrorActionPreference = 'Stop' that is
+        # terminating, so the script died with a .NET stack trace and exit 1
+        # where the bash and Python twins both return an empty suffix.
+        $fallbackWords = @(($result -split '-') | Where-Object { $_ } | Select-Object -First 3)
         return [string]::Join('-', $fallbackWords)
     }
 }

{specify_cli-1.0.3 → specify_cli-1.0.4}/src/specify_cli/_invocation_style.py

@@ -13,7 +13,7 @@ DOLLAR_SKILLS_AGENTS: frozenset[str] = frozenset({"codex", "zcode", "command-cod
 
 # Agents that always render /speckit-<name>, regardless of ai_skills.
 ALWAYS_SLASH_AGENTS: frozenset[str] = frozenset(
-    {"devin", "droid", "grok", "qodercli", "trae", "zed"}
+    {"devin", "droid", "dsh", "grok", "qodercli", "trae", "zed"}
 )
 
 # Agents that render /speckit-<name> only when ai_skills is enabled.

{specify_cli-1.0.3 → specify_cli-1.0.4}/src/specify_cli/authentication/config.py

@@ -112,7 +112,10 @@ def load_auth_config(
         except OSError:
             pass  # stat failed — skip permission check
 
-    raw = json.loads(config_path.read_text(encoding="utf-8"))
+    try:
+        raw = json.loads(config_path.read_text(encoding="utf-8"))
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"{config_path} contains invalid JSON: {exc}") from exc
 
     if not isinstance(raw, dict):
         raise ValueError(f"auth.json must be a JSON object, got {type(raw).__name__}")

{specify_cli-1.0.3 → specify_cli-1.0.4}/src/specify_cli/bundler/models/catalog.py

@@ -20,6 +20,7 @@ CONFIG_FILENAME = "bundle-catalogs.yml"
 # reject an unsupported major version so a file written by a newer/incompatible
 # Spec Kit fails fast instead of being parsed under the wrong assumptions.
 CONFIG_SCHEMA_VERSION = "1.0"
+CATALOG_SCHEMA_VERSION = "1.0"
 
 
 class InstallPolicy(str, Enum):
@@ -220,6 +221,16 @@ def load_catalog_payload(data: Any) -> dict[str, CatalogEntry]:
     """Parse a catalog JSON payload into ``{bundle_id: CatalogEntry}``."""
     if not isinstance(data, dict):
         raise BundlerError("Catalog payload must be a JSON object.")
+    schema_version = data.get("schema_version")
+    if schema_version is not None and (
+        str(schema_version).strip().split(".")[0]
+        != CATALOG_SCHEMA_VERSION.split(".")[0]
+    ):
+        raise BundlerError(
+            f"Unsupported catalog schema version "
+            f"'{str(schema_version).strip()}'; this Spec Kit understands "
+            f"version {CATALOG_SCHEMA_VERSION}."
+        )
     bundles_raw = data.get("bundles")
     if not isinstance(bundles_raw, dict):
         raise BundlerError("Catalog payload is missing a 'bundles' object.")

{specify_cli-1.0.3 → specify_cli-1.0.4}/src/specify_cli/bundler/models/records.py

@@ -13,7 +13,7 @@ from typing import Any
 
 from .. import BundlerError
 from ..lib.yamlio import dump_json, ensure_within, load_json
-from .manifest import COMPONENT_KINDS, ComponentRef
+from .manifest import COMPONENT_KINDS, ComponentRef, _text
 
 RECORDS_FILENAME = "bundle-records.json"
 RECORDS_SCHEMA_VERSION = "1.0"
@@ -65,8 +65,14 @@ class InstalledBundleRecord:
             raise BundlerError(
                 "Corrupt record: 'contributed_components' must be a list."
             )
-        bundle_id = str(data.get("bundle_id", "")).strip()
-        version = str(data.get("version", "")).strip()
+        # ``.get(key, "")`` defaults only a *missing* key. A key that is
+        # present but null -- how a hand-edited or corrupt record spells an
+        # empty field -- yields ``None``, and ``str(None)`` is the non-empty
+        # literal ``"None"``, which sails past the required-field checks
+        # below. Reuse the manifest's ``_text`` so records and bundle.yml
+        # agree on what an explicit null means.
+        bundle_id = _text(data.get("bundle_id"))
+        version = _text(data.get("version"))
         if not bundle_id:
             raise BundlerError(
                 "Corrupt records file: an installed-bundle record is missing "
@@ -80,7 +86,7 @@ class InstalledBundleRecord:
         return cls(
             bundle_id=bundle_id,
             version=version,
-            installed_at=str(data.get("installed_at", "")).strip(),
+            installed_at=_text(data.get("installed_at")),
             contributed_components=tuple(
                 _component_from_dict(c) for c in components_raw
             ),
@@ -201,8 +207,8 @@ def _component_to_dict(ref: ComponentRef) -> dict[str, Any]:
 def _component_from_dict(data: Any) -> ComponentRef:
     if not isinstance(data, dict):
         raise BundlerError("Each contributed component must be a mapping.")
-    kind = str(data.get("kind", "")).strip()
-    cid = str(data.get("id", "")).strip()
+    kind = _text(data.get("kind"))
+    cid = _text(data.get("id"))
     if kind not in COMPONENT_KINDS:
         raise BundlerError(
             f"Corrupt records file: component 'kind' must be one of "

{specify_cli-1.0.3 → specify_cli-1.0.4}/src/specify_cli/commands/init.py

@@ -1013,6 +1013,7 @@ def register(app: typer.Typer) -> None:
         devin_skill_mode = selected_ai == "devin"
         zed_skill_mode = selected_ai == "zed" and _is_skills_integration
         grok_skill_mode = selected_ai == "grok" and _is_skills_integration
+        dsh_skill_mode = selected_ai == "dsh" and _is_skills_integration
         cline_skill_mode = selected_ai == "cline"
         forge_skill_mode = selected_ai == "forge"
         bob_skill_mode = selected_ai == "bob" and _is_skills_integration
@@ -1028,6 +1029,7 @@ def register(app: typer.Typer) -> None:
             or devin_skill_mode
             or zed_skill_mode
             or grok_skill_mode
+            or dsh_skill_mode
             or bob_skill_mode
         )
 
@@ -1066,6 +1068,11 @@ def register(app: typer.Typer) -> None:
                 f"{step_num}. Start Grok Build in this project directory; spec-kit skills were installed to [cyan].grok/skills[/cyan]"
             )
             step_num += 1
+        if dsh_skill_mode:
+            steps_lines.append(
+                f"{step_num}. Start DSH ([cyan]dsh web[/cyan]) in this project directory; spec-kit skills were installed to [cyan].dsh/skills[/cyan]"
+            )
+            step_num += 1
         if bob_skill_mode:
             steps_lines.append(
                 f"{step_num}. Start Bob in this project directory; spec-kit skills were installed to [cyan].bob/skills[/cyan]"

{specify_cli-1.0.3 → specify_cli-1.0.4}/src/specify_cli/extensions/_commands.py

@@ -15,9 +15,12 @@ import shutil
 import stat
 import tempfile
 from pathlib import Path
-from typing import Optional
+from typing import Optional, TYPE_CHECKING
 from uuid import uuid4
 
+if TYPE_CHECKING:
+    from packaging.version import Version
+
 import typer
 import yaml
 from rich.markup import escape as _escape_markup
@@ -106,6 +109,58 @@ def _command_safe_id(raw_id: object, placeholder: str = "<extension-id>") -> str
     return placeholder
 
 
+def _bundled_update_source(ext_id: str) -> tuple[Path, Version] | tuple[None, None]:
+    """Locate the local bundled copy of *ext_id* and its parsed version.
+
+    Bundled extensions have no download URL, so an update can only come
+    from the copy shipped with the running spec-kit release — which may
+    lag the version the catalog on main advertises. Returns
+    ``(path, Version)`` when a valid local copy exists, ``(None, None)``
+    otherwise.
+    """
+    from . import ExtensionManifest, ValidationError
+    from packaging import version as pkg_version
+
+    bundled_dir = _locate_bundled_extension(ext_id)
+    if bundled_dir is None:
+        return None, None
+    try:
+        manifest = ExtensionManifest(bundled_dir / "extension.yml")
+        return bundled_dir, pkg_version.Version(manifest.version)
+    except (ValidationError, pkg_version.InvalidVersion, OSError):
+        return None, None
+
+
+def _archive_extension_directory(source_dir: Path) -> Path:
+    """Package an extension directory as a ZIP archive for the update flow.
+
+    The update pipeline validates and installs archives (bounded
+    extraction, manifest preflight, ID/version checks, backup/rollback),
+    so a locally bundled extension is fed through that identical hardened
+    path rather than growing a second install code path. The caller
+    deletes the archive after the update, the same as a downloaded one.
+    """
+    import zipfile
+
+    fd, tmp_name = tempfile.mkstemp(prefix="speckit-bundled-update-", suffix=".zip")
+    try:
+        with os.fdopen(fd, "wb") as archive_file:
+            with zipfile.ZipFile(archive_file, "w", zipfile.ZIP_DEFLATED) as zf:
+                for path in sorted(source_dir.rglob("*")):
+                    # Never follow symlinks: is_file() follows the target
+                    # and ZipFile.write() reads its bytes, which would turn
+                    # an out-of-tree target into a regular archive member
+                    # before the hardened extractor ever sees it.
+                    if path.is_symlink():
+                        continue
+                    if path.is_file():
+                        zf.write(path, path.relative_to(source_dir).as_posix())
+    except BaseException:
+        Path(tmp_name).unlink(missing_ok=True)
+        raise
+    return Path(tmp_name)
+
+
 def _refresh_events_and_warn(project_root: Path) -> None:
     """Refresh native event config and surface failures (R3).
 
@@ -1089,8 +1144,7 @@ def extension_add(
                                 force=force,
                             )
                         finally:
-                            if archive_path.exists():
-                                archive_path.unlink()
+                            archive_path.unlink(missing_ok=True)
 
         console.print("\n[green]✓[/green] Extension installed successfully!")
         console.print(f"\n[bold]{_escape_markup(str(manifest.name))}[/bold] (v{_escape_markup(str(manifest.version))})")
@@ -1622,6 +1676,7 @@ def extension_update(
         console.print("🔄 Checking for updates...\n")
 
         updates_available = []
+        blocked_updates = []
 
         for ext_id in extensions_to_update:
             safe_ext_id = _escape_markup(str(ext_id))
@@ -1658,20 +1713,55 @@ def extension_update(
                 continue
 
             if catalog_version > installed_version:
+                download_url = ext_info.get("download_url")
+                bundled_dir = None
+                available_version = catalog_version
+                if ext_info.get("bundled") and not download_url:
+                    # Bundled extensions cannot be downloaded; the update has
+                    # to come from the copy shipped with the running spec-kit
+                    # release, which may lag the catalog on main (#4345).
+                    bundled_dir, bundled_version = _bundled_update_source(ext_id)
+                    # Block whenever the local copy lags the catalog, not
+                    # just when it lags the installation: installing an
+                    # intermediate version would leave the project behind
+                    # the catalog while reporting success, contrary to the
+                    # documented "upgrade spec-kit first" behavior.
+                    if bundled_dir is None or bundled_version < catalog_version:
+                        local_desc = (
+                            f"only ships v{bundled_version}"
+                            if bundled_dir is not None
+                            else "does not ship a local copy"
+                        )
+                        console.print(
+                            f"⚠  {safe_ext_id}: v{catalog_version} is available, but this "
+                            f"spec-kit release {local_desc} — upgrade spec-kit, then rerun "
+                            f"'specify extension update'"
+                        )
+                        blocked_updates.append(ext_id)
+                        continue
+                    available_version = bundled_version
                 updates_available.append(
                     {
                         "id": ext_id,
                         "name": ext_info.get("name", ext_id),  # Display name for status messages
                         "installed": str(installed_version),
-                        "available": str(catalog_version),
-                        "download_url": ext_info.get("download_url"),
+                        "available": str(available_version),
+                        "download_url": download_url,
+                        "bundled_dir": bundled_dir,
                     }
                 )
             else:
                 console.print(f"✓ {safe_ext_id}: Up to date (v{installed_version})")
 
         if not updates_available:
-            console.print("\n[green]All extensions are up to date![/green]")
+            if blocked_updates:
+                console.print(
+                    "\n[yellow]Update(s) exist but require a newer spec-kit "
+                    "release — upgrade spec-kit, then rerun "
+                    "'specify extension update'.[/yellow]"
+                )
+            else:
+                console.print("\n[green]All extensions are up to date![/green]")
             raise typer.Exit(0)
 
         # Show available updates
@@ -1968,8 +2058,15 @@ def extension_update(
                         if ext_hooks:
                             backup_hooks[hook_name] = ext_hooks
 
-                # 5. Download new version
-                archive_path = catalog.download_extension(extension_id)
+                # 5. Acquire the new version. Bundled extensions install from
+                # the copy shipped with the running spec-kit release (they
+                # have no download URL); everything else downloads. Both are
+                # packaged as archives so the identical validation,
+                # backup/rollback, and install pipeline below applies.
+                if update.get("bundled_dir") is not None:
+                    archive_path = _archive_extension_directory(update["bundled_dir"])
+                else:
+                    archive_path = catalog.download_extension(extension_id)
                 try:
                     # 6. Validate the archive and extension ID before modifying
                     # the existing installation. The shared extractor applies
@@ -2312,11 +2409,10 @@ def extension_update(
                     # Archive cleanup is housekeeping: never replace an install
                     # error or roll back an already committed update because a
                     # scanner temporarily locks the download on Windows.
-                    if archive_path.exists():
-                        try:
-                            archive_path.unlink()
-                        except OSError as error:
-                            zip_cleanup_error = error
+                    try:
+                        archive_path.unlink(missing_ok=True)
+                    except OSError as error:
+                        zip_cleanup_error = error
 
                 # 10. Clean up backup on success. The update has committed at
                 # this point, so a locked backup file must not trigger rollback

{specify_cli-1.0.3 → specify_cli-1.0.4}/src/specify_cli/integrations/__init__.py

@@ -62,6 +62,7 @@ def _register_builtins() -> None:
     from .devin import DevinIntegration
     from .docker_agent import DockerAgentIntegration
     from .droid import DroidIntegration
+    from .dsh import DshIntegration
     from .firebender import FirebenderIntegration
     from .forge import ForgeIntegration
     from .gemini import GeminiIntegration
@@ -103,6 +104,7 @@ def _register_builtins() -> None:
     _register(DevinIntegration())
     _register(DockerAgentIntegration())
     _register(DroidIntegration())
+    _register(DshIntegration())
     _register(FirebenderIntegration())
     _register(ForgeIntegration())
     _register(GeminiIntegration())