build(deps): update deps:infra-non-major

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
JamesIves/github-pages-deploy-action (changelog)	action	digest	d92aa23 → fa24774
SonarSource/sonarqube-scan-action (changelog)	action	digest	59db25f → 2291811
actions/checkout (changelog)	action	digest	9c091bb → 3d3c42e
coverallsapp/github-action (changelog)	action	digest	5cbfd81 → 8d6379e
gh		minor	2.96.0 → 2.97.0
openspec		minor	1.4.1 → 1.8.0

❗ Important

Release Notes retrieval for this PR were skipped because no github.com credentials were available.
If you are self-hosted, please see this instruction.

---

Release Notes

Fission-AI/OpenSpec (openspec)

v1.8.0

Minor Changes

• #​1303 1aa0f2a Thanks @​solanab! - Add the vendor-neutral agents target: openspec init --tools agents installs the workflow skills to .agents/skills/openspec-*/SKILL.md, the shared location AGENTS.md-compatible assistants read. It is skills-only, so no slash commands are generated. Because agents is now a real target, --tools all includes it and creates .agents/skills/ where it previously did not.

• #​1274 7a4a745 Thanks @​NicoAvanzDev! - Generate GitHub Copilot coding agent setup and custom agent files during openspec init and keep them synchronized during openspec update.

• #​1214 161f945 Thanks @​showms! - Add MiniMax Code as a global skills-only tool target.

• #​1518 568e56c Thanks @​clay-good! - ### New Features

  • Atlassian Rovo Dev CLI — openspec init --tools rovodev installs the OpenSpec workflow skills for Atlassian's Rovo Dev CLI. It is skills-only (no slash commands), written to .rovodev.

Bug Fixes

• Codex skills now live in the shared .agents directory — openspec init and openspec update install Codex skills under .agents/skills/ (the canonical location assistants read) and migrate an existing .codex skills directory in place. Files you customized are preserved, not overwritten.

• openspec status separates planning from implementation — status now reports isPlanningComplete (every non-skipped planning artifact exists; skipped artifacts count as satisfied without being written) distinctly from overall progress, and its messages no longer imply a change is finished before it has been implemented. isComplete is kept as a compatibility alias, so existing scripts keep working.

• #​1517 73207a6 Thanks @​clay-good! - Make GitHub Copilot cloud coding-agent files opt-in. Selecting the github-copilot tool no longer silently writes a GitHub Actions workflow into .github/; openspec init now asks first (default No) and remembers the choice in openspec/config.yaml (githubCopilot.cloudAgent). Use --copilot-cloud / --no-copilot-cloud to decide non-interactively.

  • openspec update never prompts — it only refreshes cloud files for projects that opted in (or that already have generated cloud files, so existing setups keep working).
  • Opting out (--no-copilot-cloud or cloudAgent: false) removes OpenSpec-managed cloud files; a user-customized file is always preserved, never overwritten or deleted.
  • init and update now report whether cloud files were written, skipped, or left untouched — and if you already have your own copilot-setup-steps.yml, they say it was preserved and that you need to add the OpenSpec install step by hand.

• #​1484 521ee33 Thanks @​clay-good! - Retire a capability when a change removes its last requirement. A change that declares retire_capabilities: true in its .openspec.yaml (alongside the schema: that file requires) may now be archived even when its REMOVED entries take a capability's last requirement: openspec archive deletes that capability's main spec instead of aborting with "Spec must have at least one requirement". Without the marker nothing changes — the archive aborts exactly as before, except the message now names the marker as the way out. Retirement happens only when the emptied spec could not have been written at all, every one is named in the archive output, a pasteable git checkout is included when the spec lived in the caller's checkout, and --no-validate never retires. Archive now also rejects a main spec with duplicate canonical requirement names instead of letting delta reconciliation collapse one of the duplicate blocks. One thing to know before retiring: a capability's spec is the base another change's MODIFIED block is checked against, so an in-flight change that modifies the capability you just retired will keep validating clean and then refuse to archive ("target spec does not exist; only ADDED requirements are allowed for new specs") — close or rework that change alongside the retirement.

Patch Changes

• #​1502 ece8660 Thanks @​clay-good! - openspec validate now treats the English SHALL/MUST convention as guidance in normal mode, so requirements written in other languages can validate. Strict mode continues to enforce the convention.

• #​1483 2b3d368 Thanks @​clay-good! - Tell the caller which flag to pass when openspec archive cannot ask its confirmation questions. An AI agent (or any script) runs the CLI with stdin closed, so every prompt rejects with @inquirer's User force closed the prompt with 0 null — the archive aborted with an error that named neither the question nor the flag, and agents burned a turn guessing (#​1479). Each confirmation now reports what it needed and a pasteable rerun that carries the flags you already passed: openspec archive <name> --skip-specs --yes stays a --skip-specs run, so following the suggestion cannot merge specs you opted out of merging, and a change name that needs quoting gets double quotes, the one form bash, zsh, PowerShell and cmd.exe all read the same way (a name no shell reads literally even quoted — one containing $, a backtick, or the %/! that cmd.exe still expands inside quotes — is left as a <change-name> placeholder rather than a command that would target something else). openspec archive with no change name used to swallow the same failure, print No change selected. Aborting. and exit 0 — success for a run that archived nothing; it now exits 1 asking for a change name, matching how openspec show and openspec validate already behave without a terminal. The check is reactive — it inspects a prompt that already failed — so answers piped into the command, --yes, --json, and Ctrl-C all behave exactly as before, and a run that OpenSpec already considers non-interactive (CI, OPEN_SPEC_INTERACTIVE=0, --no-interactive) gets the guidance even when the runner allocated a pty. The onboarding walkthrough, the only generated guidance that tells an agent to run openspec archive, now shows --yes.

• #​1486 427abf4 Thanks @​clay-good! - Task progress now counts indented sub-tasks. A tasks.md whose sub-tasks were unfinished reported ✓ Complete in openspec list and openspec view, was missing those tasks from the openspec instructions apply list, and archived with no incomplete-task warning, because both checkbox parsers only matched checkboxes at column 0.

  Progress counting and the apply task list now share one parser, so list, view, archive and apply agree about which lines of a tasks file are tasks. A checkbox with no text after it is left out of the apply list, which has nothing to act on, but still counts toward every progress number; a file of nothing but such checkboxes now asks to be rewritten rather than reporting itself done. The shared pattern matches every line the two it replaced matched, and more, so task counts can rise but never fall: no change starts reporting less work than before, and archive's incomplete-task warning can only become stricter. Checkboxes are still counted wherever they appear, including inside a code fence, an HTML comment or an indented block, so a tasks.md that shows a checklist as a format example can now count that example as work — remove it from the file, or pass --yes to archive.

• #​1500 26bd1d4 Thanks @​clay-good! - Keep generated workflows on the selected store, handle optional workflow fallbacks safely, and validate synced specs before reporting success.

• #​1490 45cca5d Thanks @​clay-good! - Say before confirmation when archiving a change will delete a note written next to a requirement. A requirement absorbs anything below it that OpenSpec doesn't recognize as a new heading — a note indented by the one to three spaces Markdown allows, for example — so removing or modifying that requirement took the note with it, silently. openspec archive now names content the rebuilt spec would actually drop and where to move it to keep it. The merge itself is unchanged: nothing is relocated, because a # line inside a scenario looks identical to a note and moving one of those would rewrite the spec wrongly.

• #​1492 690a27e Thanks @​mc856! - openspec init and openspec update no longer delete the CoStrict and Junie command files they just generated. Legacy cleanup removes artifacts older OpenSpec versions left behind, and two of its patterns named paths the current adapters still write to. CoStrict's was a whole-directory removal of .cospec/openspec/commands/, the folder the adapter writes opsx-<id>.md into, so every run wiped the directory — including any file the user kept there — while the banner above it read No user content to preserve. Junie's .junie/commands/opsx-*.md listed its own current output. Cleanup runs before the config migration, so on a config that has no profile key yet the missing command files make delivery detection read the project as skills-only and persist that to the global config: the files are not regenerated, and the preference changes for every other project too.

  CoStrict is now a file pattern, .cospec/openspec/commands/openspec-*.md, matching the three commands the pre-opsx CoStrict integration wrote there (openspec-proposal.md, openspec-apply.md, openspec-archive.md) and the same shape every other file-based tool already uses. Junie's entry is removed outright: Junie support arrived after the slash configurators that wrote openspec-* files were deleted, so no OpenSpec version ever created those files there. Genuinely legacy files are still detected and removed, and no other tool's patterns change — they never overlapped their adapter's current output.

• #​1501 0b20ae3 Thanks @​clay-good! - Keep the propose workflow focused on planning, clarify material ambiguities before creating a change, and hand implementation off to the apply workflow.

• #​1503 8a3850d Thanks @​clay-good! - When exploration turns into a new change, generated explore guidance now instructs agents to run openspec new change before writing requested artifacts. This preserves the required .openspec.yaml metadata instead of letting an agent create an incomplete change directory by hand. After the user accepts a capture, explore also creates the requested artifacts without requiring another workflow command.

• #​1513 622c509 Thanks @​FasterPHP! - Honor telemetry.enabled in global config. false disables anonymous telemetry and openspec update version checks; unset keeps telemetry enabled, and env/CI opt-outs still take precedence.

• #​1499 9cd845f Thanks @​clay-good! - Keep generated files, specs, archive moves, and local state inside their intended security boundaries without breaking linked monorepo workflows.

• #​1482 84ebc57 Thanks @​clay-good! - openspec validate <change> now reports a MODIFIED requirement that omits a scenario the main spec still has — the same loss archive already refuses to apply — so the change fails at authoring time instead of at archive time. A change carrying a stale MODIFIED block will start failing validation; it was already unarchivable, and the message names the scenarios to copy back in.

v1.7.0

Minor Changes

• #​1475 17af60c Thanks @​clay-good! - Add CodeArts Agent skills support: openspec init --tools codeartsagent installs the workflow skills.

• #​1475 17af60c Thanks @​clay-good! - Add Hermes Agent as a supported AI tool: openspec init --tools hermes installs the workflow skills (Hermes is skills-only and invokes them directly).

• #​1475 17af60c Thanks @​clay-good! - Add ZCode as a supported AI tool: openspec init --tools zcode generates its skills and /opsx:* commands.

• #​1475 17af60c Thanks @​clay-good! - Codex is now skills-only: workflows install as $openspec-* skills and previously managed custom prompts are retired (existing ones are cleaned up on update).

• #​1062 eac2973 Thanks @​showms! - Add current project context and per-operation guidance to apply and archive workflows. Projects can configure operations.apply.guidance and operations.archive.guidance; openspec instructions apply returns apply inputs, and the new read-only openspec instructions archive surface returns archive inputs for the selected root.

  Archive, bulk archive, and sync skills now load current archive inputs and specs artifact rules at execution time, fail before writes or moves when required instruction lookups fail, and reuse specs-rule snapshots during inline sync.

• #​1475 17af60c Thanks @​clay-good! - Publish the workflow skills as static skills/<name>/SKILL.md files so npx skills add Fission-AI/OpenSpec works.

• #​1399 27b22ab Thanks @​clay-good! - Add skip_specs: true change metadata for work with no spec-level behavior change (pure refactors, tooling, docs). openspec validate accepts a zero-delta change that declares the marker (honored only when the metadata parses under the shared change-metadata schema and names a schema that loads) and errors when the marker and delta specs are both present, the artifact graph no longer blocks tasks on spec files for such changes, openspec status renders the specs stage as explicitly skipped, and the propose/specs guidance points to the marker instead of contradicting the validator.

• #​1475 17af60c Thanks @​clay-good! - Resolve symlinked schema directories so schemas shared via symlink (e.g. from a dotfiles repo) are discovered.

• #​1470 6295515 Thanks @​clay-good! - openspec update now offers to upgrade the CLI when yours is behind the published one. Instruction files are generated by the installed CLI, so a stale install reported ✓ All 1 tool(s) up to date (v1.6.0) while the workflows added in newer releases were never written:

  A newer OpenSpec CLI is available (v1.6.0 → v1.7.0).
    Running from: /usr/local/lib/node_modules/@fission-ai/openspec
  ? Upgrade to v1.7.0 now? (Y/n)
  

  Say yes and it upgrades, confirms the new version is the one that answers, then re-runs the update so the new workflows arrive in the same command. Say no and it prints the command matching how you installed OpenSpec, and updates with what you have. Nothing happens to your machine that you did not agree to: the offer appears only in an interactive terminal and only where npm install -g would help, and the check is skipped in CI or when OPENSPEC_NO_UPDATE_CHECK, DO_NOT_TRACK=1, or OPENSPEC_TELEMETRY=0 is set.

  See CLI reference → openspec update for the per-install-method behavior and every opt-out.

Patch Changes

• #​1404 a84ae70 Thanks @​clay-good! - Generated skills for tools without a command adapter (Kimi Code, Mistral Vibe, Hermes, ForgeCode, CodeArts) no longer reference /opsx:* commands that were never generated: skill cross-references, the init getting-started hint, and the profile-migration message now use each tool's documented skill invocation (Kimi Code: /skill:openspec-*; others: /openspec-*), and Codex — skills-invocable with no slash surface — gets a syntax-neutral hint that names the skill. Selections that mix invocation syntaxes print one labeled hint per distinct form, so every advertised instruction is usable by the tool it names. When delivery: commands would generate nothing for a selected tool, init prints a configuration correction naming that tool, even when other tools did get commands or skills. The committed skills.sh distribution is regenerated with skill references (default /openspec-* form, as that channel installs skills only).

• #​1363 5199f41 Thanks @​clay-good! - ### Features

  • One default store for every repo on your machine — openspec config set defaultStore <id> sets a machine-level fallback root: any command run outside a planning root, with no --store flag and no project store: pointer, resolves to that store. It sits at the bottom of the precedence list, so --store, a local root, and a project pointer all still win. The root banner and JSON root block report the distinct provenance source: "global_default", so users and tooling can tell a machine-wide default from a repo's own pointer. A stale id degrades to the underlying store error with a fix that names openspec config unset defaultStore.

• #​1435 6a5171e Thanks @​clay-good! - openspec new change now accepts numeric-prefixed names like 100-add-feature or 00001-add-auth, useful for ordering or tiering changes. Change names now use the same kebab-case grammar as store ids and change metadata (a leading digit is allowed); archive already treated date-prefixed names as a supported convention. Uppercase, spaces, underscores, and leading/trailing or consecutive hyphens are still rejected, and every previously valid name stays valid.

• #​1425 040a869 Thanks @​clay-good! - Compare config key guards literally instead of through a helper.

  setNestedValue and deleteNestedValue rejected prototype-reaching key segments through a helper that did a Set lookup. That is correct, but static analysis could not follow it, so CodeQL kept reporting prototype-pollution on the very assignments the guard protects. The segments are now compared literally in the same function, still checked across the whole path before anything is written. Behavior is unchanged for every input, verified against the previous implementation across 400,000 generated cases.

• #​1431 6a4f0d7 Thanks @​clay-good! - A delta spec that introduces a brand-new capability can now open with a ## Purpose, and openspec archive uses it as the Purpose of the main spec it creates instead of writing the TBD - created by archiving change <name>. Update Purpose after archive. placeholder over it. The specs artifact instruction, its example, the delta template and the openspec-sync-specs skill all tell authors and agents to write one, so the CLI and agent-driven sync paths produce the same main spec.

  Archive keeps the placeholder when the delta has no usable ## Purpose:

  • no ## Purpose header outside a code fence or HTML comment, or a body that is only a code fence or only a comment
  • a body that would leave a spec its own parser cannot read — a heading or requirement header that truncates a section, an unterminated fence, or any HTML comment
  • in the second case archive also says why, and still completes rather than aborting

  A carried Purpose under 50 characters is kept but warned about, since openspec validate --strict reports it as too brief. The Purpose of an existing main spec is never touched; archive warns when it ignores a delta's Purpose there.

• #​1437 19d4171 Thanks @​clay-good! - openspec archive no longer aborts when a REMOVED delta's requirement is already gone from the main spec (the early-sync pattern the sync skill teaches): it warns, treats the removal as already applied, and reports applied-only totals. In --json mode those warnings are carried in a new optional warnings array on the archive result. When every operation for a spec was already synced, archive skips rewriting that file instead of churning normalization differences into it. A delta that both RENAMEs and REMOVEs the same requirement is now rejected explicitly, by both validate and archive — the two spellings are compared case- and whitespace-insensitively — and a REMOVED header that differs only in case or whitespace from an existing requirement still aborts (that is a typo, not an early sync). Also fixed: the archive delta gate matches section headers case-insensitively like the parser; symlinked specs/<capability>/spec.md files are discovered instead of silently dropped; openspec show <change> no longer prints a spurious "scenarios" flag warning; files generated for qwen and bob reference commands by their real hyphenated names (/opsx-<id>), and init's getting-started hint follows suit; apply/update/onboard guidance names the CLI fallback for profiles that don't install /opsx:continue or /opsx:new.

• #​1411 c439a4e Thanks @​clay-good! - Fix phantom requirements parsed from delta specs, which made openspec archive warn about problems openspec validate never reported.

  A header inside a delta section that is not a ### Requirement: header — a divider such as ### Documentation Requirements — was read as a requirement with no scenario. openspec archive warned that it was missing a scenario, and openspec show <change> --json and openspec change list counted it as an extra delta. The change parser now ignores those headers, matching the delta reader, so the phantom is gone from the warnings and from the JSON. Main spec parsing is unchanged.

  openspec archive also no longer repeats requirement-level issues from the delta specs in its non-blocking "Proposal warnings in proposal.md" block. Each defect was printed twice there, and a ## REMOVED Requirements entry — names-only by design — was reported as missing a scenario on every correct removal. Delta spec validation still reports and blocks on genuine defects, and proposal-level warnings are unchanged.

• #​1394 b474f81 Thanks @​clay-good! - ### Bug Fixes

  • Archive no longer races the spec sync, or reports a sync that never landed — the generated openspec-archive-change skill (and the matching opsx:archive command) handed the spec sync to a background task and then moved the change folder immediately. The archive could move the delta specs out from under the running sync: the change ended up archived, openspec/specs/ was never updated, and the summary still reported Specs: ✓ Synced. The sync now runs inline, and the archive only proceeds once every capability with a delta spec has been checked against it — ADDED present, MODIFIED changes applied, REMOVED gone, RENAMED under the new name and not the old. If the sync fails or a capability doesn't match, the archive stops and reports what differs instead of claiming success; nothing has moved, so you can fix it and retry.

• #​1475 17af60c Thanks @​clay-good! - Apply profile changes with the installed CLI instead of shelling out to npx, which could run a different version.

• #​1475 17af60c Thanks @​clay-good! - Delta and main-spec parsers strip a UTF-8 BOM, so files saved by Windows editors or PowerShell redirects no longer fail with "No delta sections found".

• #​1398 97d441a Thanks @​clay-good! - ### Bug Fixes

  • Bulk archive now stops when you pick "Cancel" — the generated openspec-bulk-archive-change skill (and the matching opsx:bulk-archive command) offered a "Cancel" option at the confirmation prompt but never told the agent what to do with it, so the next step archived every selected change anyway. The prompt now routes each answer by intent: "Cancel" stops without archiving anything, the archive options proceed (the ready-only option archives just the changes the status table marks Ready or Ready*), and any other answer re-asks instead of archiving. The single-change archive skill already routes Cancel this way; this brings the bulk variant in line.

• #​1375 52a8bce Thanks @​clay-good! - --change now accepts any change name that exists on disk (e.g. date-prefixed names like 2026-07-04-voice-copilot-v1), matching what list, validate, and archive already resolve. Lookup still rejects unsafe names (path separators, .., hidden entries); the kebab-case naming rule still applies when creating a change.

• #​1475 17af60c Thanks @​clay-good! - openspec new change rejects names over 200 characters with a validation message instead of surfacing a raw ENAMETOOLONG filesystem error.

• #​1447 fb19699 Thanks @​hsusul! - Generated tool command files now carry valid YAML frontmatter for every supported tool. Command names ship as OPSX: Explore, and the unquoted name: OPSX: Explore that adapters emitted is not parseable YAML — strict parsers rejected the whole file, so the command failed to load. Several adapters also re-implemented their own escaping, and a few interpolated descriptions in raw.

  Escaping now lives in one place (escapeYamlValue / formatTagsArray) and every adapter uses it. String frontmatter values are always double-quoted, which also keeps values like true, null and 123 from round-tripping as booleans, nulls and numbers. Non-string fields such as allowed-tools and invokable are unchanged. Expect the first openspec update after upgrading to rewrite the frontmatter lines of your generated command files.

  Archive workflow guidance also gets two corrections: bulk archive now carries its per-delta include/exclude decisions into execution, so a delta whose implementation was not found is reported as sync skipped instead of being synced anyway, and both archive workflows verify the main specs before moving the change directory.

• #​1471 9a937cb Thanks @​clay-good! - Reference slash commands by the name each tool actually registers. Command bodies, generated SKILL.md cross-references, and the init/update/migration hints all advertised /opsx:<id>, but only 7 of the 28 tools with a command adapter register that name — the ones whose files sit in an opsx/ directory. The other 21 write .../opsx-<id>.md, where the filename is the command, so tools such as Cursor, GitHub Copilot, Windsurf and Kilo Code were told to type a command their palette never had; a single generated Cursor file named itself /opsx-apply in frontmatter and then told the reader to run /opsx:apply. The command name is now derived from the command file each adapter writes rather than a hand-maintained tool list, so a newly added adapter cannot drift, and the wrapper around it is adapter metadata: Amazon Q loads its files into a prompt library invoked with @, so it now gets @opsx-<id> in command bodies, skills, and the onboarding hint instead of a slash command it never registers. Codex, which generates no command files at all, now gets $openspec-<skill> — the syntax its CLI actually accepts — everywhere it previously advertised /opsx:*, superseding the syntax-neutral hint described in the pending adapterless-skill-references note. Command filenames and paths are unchanged, and Claude Code output is byte-identical.

• #​1364 f58b445 Thanks @​clay-good! - Fix openspec completion install detecting the wrong shell for fish (and other)
  users whose interactive shell differs from their login shell. Detection now
  consults the parent process before falling back to $SHELL, so running the
  command from fish installs fish completions instead of defaulting to bash.

• #​1377 285dfd7 Thanks @​clay-good! - ### Bug Fixes

  • Config rules: keys are no longer reported as Unknown artifact ID when they belong to a different schema. The global rules map is now validated against the union of artifact IDs across every available schema, so multi-schema projects stop seeing spurious warnings on every command (#​1322).

• #​1401 b33b15d Thanks @​clay-good! - Stop design.md from restating the proposal. In the default spec-driven schema, the design instruction asked for "Background, current state, constraints, stakeholders" and "What this design achieves and excludes" without saying that motivation and scope already live in proposal.md, so agents restated the proposal's Why and What Changes instead of adding the design's own value - approach, alternatives, and trade-offs. The instruction and the design template now state the boundary explicitly (the proposal covers why and what, design covers how) and tell the agent to reference those documents rather than repeat them (#​1382).

• #​1167 1637856 Thanks @​mehdishahdoost! - Windsurf is now Devin Desktop. Windsurf was rebranded on June 2, 2026 and its config directory moved: .devin/ is the preferred read + write location, .windsurf/ a legacy read-only fallback that the Devin Local agent does not read at all. OpenSpec follows the rename rather than carrying two ids for one product — the tool id is devin, writing .devin/workflows/opsx-<id>.md and .devin/skills/openspec-*/SKILL.md, and it is detected from either directory.

  • --tools windsurf still resolves, so existing setup scripts keep working; it now configures .devin/.
  • If your OpenSpec files are still in .windsurf/, openspec update explains the rebrand and offers to move them. --force and non-interactive runs take the move; declining leaves every file exactly where it is. Only the files OpenSpec generates move — each skill's SKILL.md and commands named opsx-*. A hand-written Cascade workflow, a reference file you keep beside a SKILL.md, a command file you edited, and .devin/rules/ all stay exactly where they are.
  • Devin skills and the getting-started hint reference /openspec-* skills rather than /opsx-* workflows, because only Devin Desktop reads workflows; the /openspec-* form works on both agents. Workflow bodies still use /opsx-<id>, the name Devin registers for a workflow file.

• #​1475 17af60c Thanks @​clay-good! - openspec doctor now notes when a store checkout is behind its upstream ref.

• #​1475 17af60c Thanks @​clay-good! - Make the archive scenario-drift check multiplicity-aware: a MODIFIED block that keeps only one of two same-named scenarios no longer silently drops the other.

• #​1408 378d468 Thanks @​clay-good! - Explore now reads the project's context and rules from openspec/config.yaml (or config.yml) at the start of a session, so it reasons with the same tech stack and conventions the artifact-creating workflows already receive.

• #​1475 17af60c Thanks @​clay-good! - openspec feedback shows the formatted text and a pre-filled submission URL on any gh failure (issues disabled, network, rate limit), not only when gh is missing or unauthenticated.

• #​1396 60f720c Thanks @​clay-good! - Fix openspec feedback failing when the repository does not define the feedback label. The command now retries without the label and notes that it was not applied, instead of exiting with an error and discarding the feedback.

• #​1151 18cbf5d Thanks @​javigomez! - ### Fixed

  • Ignore Markdown structure (requirement headers, delta sections, scenarios, REMOVED/RENAMED entries) that appears inside fenced code blocks when parsing delta specs. Previously a fenced ### Requirement: example was parsed as a real (phantom) requirement, producing spurious validate errors and risking incorrect archive output. Fenced-code detection is now shared across the Markdown parsers so validate and archive behave consistently.

• #​1475 17af60c Thanks @​clay-good! - The archive scenario-drift check now ignores #### Scenario: lines inside fenced code blocks, matching validate: a fenced example no longer false-aborts an archive, and a fenced name no longer masks a genuinely dropped scenario.

• #​1316 9b70481 Thanks @​mc856! - ### Bug Fixes

  • archive no longer stacks a second date prefix — archiving a change whose name already starts with a YYYY-MM-DD- prefix (a common authoring convention) keeps the name as-is instead of prepending today's date. Previously openspec archive 2026-07-04-voice-copilot-v1 --yes produced 2026-07-06-2026-07-04-voice-copilot-v1, and when run on a later day the folder sorted under a day on which the change did not happen. Names without a full date prefix (including partial dates like 2026-07-feature) are dated as before, and the naming is now idempotent.

• #​1374 da3907b Thanks @​clay-good! - fix(completion): make the PowerShell completion script parse and load again

  The generated OpenSpecCompletion.ps1 contained 18 empty switch ($positionalIndex) { } blocks — emitted for commands whose positionals are all path-typed (PowerShell completes paths natively, so those cases produce no clauses). A switch with no clauses is a PowerShell parse error ("Missing condition in switch statement clause"), and PowerShell parses the whole file before running it, so the script never loaded and completions never registered. The generator now skips the positional-index block entirely when no positional produces completions, so the script parses clean (18 → 0 errors) and tab completion works.

• #​1388 9b5d2cd Thanks @​mc856! - ### Bug Fixes

  • Archive workflow templates no longer teach agents to stack a second date prefix — the openspec-archive-change and openspec-bulk-archive-change skill/command templates (and the onboarding walkthrough's archived-path example) now mirror the openspec archive rule: a change whose name already starts with a YYYY-MM-DD- prefix is archived under its own name, while other names get the current date prepended as before. Previously an agent following the workflow instructions on a change named 2026-07-04-voice-copilot-v1 produced archive/2026-07-07-2026-07-04-voice-copilot-v1, whatever the CLI did.

• #​1475 17af60c Thanks @​clay-good! - Gemini command files escape TOML-active characters (quotes, backslashes, control characters) in the description and prompt, so a template value containing them can no longer produce an invalid .toml file.

• #​1464 5bcf057 Thanks @​clay-good! - Workflow skills and commands no longer tell agents to use the Claude Code-only AskUserQuestion tool. The same templates are generated for every supported tool, and agents without that tool (OpenCode, Factory Droid, Codex, and others) errored or stalled on the instruction. The guidance is now runtime-neutral: agents are simply told to ask the user.

• #​1403 2d6c447 Thanks @​clay-good! - ### Bug Fixes

  • Propose and fast-forward skills no longer name the Claude-only TodoWrite tool — the generated openspec-propose and openspec-ff-change skills (and their /opsx:propose / /opsx:ff commands) told every agent to "Use the TodoWrite tool", which only exists in Claude Code. Codex, Cursor, Gemini, Copilot, and the other supported tools have no such tool, so agents either errored or stalled looking for it. The instruction is now runtime-neutral ("Use a todo list to track progress"), which works everywhere — including Claude Code.

• #​1415 e2f748c Thanks @​clay-good! - Reject config key paths that reach the prototype chain, and update the bundled yaml dependency.

  openspec config set --allow-unknown __proto__.polluted <value> reported success and assigned onto Object.prototype for the rest of the process. --allow-unknown was meant to relax the known-key check only, but it skipped every key check, so __proto__, constructor, and prototype segments reached the nested-write helper. Those segments are now rejected in config set whether or not --allow-unknown is passed, and setNestedValue / deleteNestedValue refuse them regardless of caller. Ordinary keys such as featureFlags.myFlag behave exactly as before.

  The yaml runtime dependency moves from 2.8.2 to 2.9.0, picking up the fix for a stack overflow on deeply nested input (GHSA / advisory patched in 2.8.3).

• #​1376 7958924 Thanks @​clay-good! - ### Bug Fixes

  • Archive after early sync — openspec archive no longer fails with ADDED failed … already exists when a change's specs were already synced to the main specs before archiving (the early-sync pattern from the sync workflow). If an ADDED requirement already exists in the target spec with identical content, applying it is treated as a no-op; a same-named requirement with different content still aborts the archive as a genuine conflict (#​1332).

• #​1386 b419e96 Thanks @​mc856! - ### Bug Fixes

  • Archive after early sync (RENAMED) — openspec archive no longer fails with RENAMED failed … source not found when a change's renames were already synced to the main specs before archiving (the early-sync pattern from the sync workflow). If a RENAMED requirement's source header is gone but the target header exists in the spec, applying the rename is treated as a no-op; a rename whose source and target are both missing still aborts the archive as a genuine error, and reported counts reflect only renames actually applied.

• #​1462 ebf66c7 Thanks @​clay-good! - Respect reduced-motion preferences in openspec init: the welcome animation is skipped when the OS reduced-motion setting is on (macOS Reduce Motion, GNOME animations disabled), when OPENSPEC_NO_ANIMATION is set, or when the new --no-animation flag is passed. The static welcome screen is shown instead.

• #​1405 5dfef4b Thanks @​clay-good! - ### Bug Fixes

  • Custom schema instructions are no longer overridden by hard-coded spec-driven patterns — the openspec-continue-change skill/command embedded one-line "common artifact patterns" for proposal.md, specs, design.md, and tasks.md, so agents followed those shortcuts instead of the schema's instruction field whenever a custom schema reused familiar artifact names. The templates now state that the instruction field is the authoritative guidance, and the propose, continue, and ff workflows direct the agent — both in the artifact-creation step and in the guidelines — to invoke a skill when the instruction delegates artifact creation to one, verifying the artifact exists afterward (fixes #​777).

• #​1475 17af60c Thanks @​clay-good! - Follow the Kimi CLI rename to Kimi Code: new install paths with automatic migration of existing .kimi setups.

• #​1415 e2f748c Thanks @​clay-good! - Parse spec headings in linear time when the title is padded with whitespace.

  Building the reference index read the first Purpose line with a regex that backtracked quadratically on a heading full of spaces: 10,000 characters of padding took 60ms, and 100,000 would have taken roughly six seconds. The heading scan is now hand-rolled and linear. Behavior is unchanged — the replacement was checked against the old implementation across 303,000 generated inputs, including CommonMark closing sequences (## Purpose ##), seven-hash lines, and headings with no space after the hashes.

• #​1475 17af60c Thanks @​clay-good! - Use local dates for CLI date-only values (archive names, timestamps) instead of UTC, so late-evening archives no longer get tomorrow's date.

• #​1475 17af60c Thanks @​clay-good! - openspec update warns when a custom profile is missing core workflows instead of silently generating a partial install.

• #​1428 81d5109 Thanks @​taltas! - Update current Roo Code product references to its community successor, Zoo Code.

• #​1475 17af60c Thanks @​clay-good! - Archive treats a MODIFIED delta whose content already matches the main spec as a no-op: a fully early-synced change now reports "Specs already in sync" instead of rewriting the file and claiming modifications.

• #​1475 17af60c Thanks @​clay-good! - Render multi-select prompts with [x]/[ ] checkbox markers instead of radio-button icons.

• #​1475 17af60c Thanks @​clay-good! - Discover nested spec paths like specs/<area>/<capability>/spec.md recursively and consistently across parse, apply, and archive.

• #​1410 b3b05e1 Thanks @​clay-good! - Only advertise onboarding commands that will actually exist. The openspec init welcome screen and th

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud