Add validation in validateChangeExists() to ensure --change parameter
is a valid kebab-case ID before constructing file paths. This prevents
path traversal attacks like --change "../foo" or --change "/etc/passwd".
- Reuses existing validateChangeName() from change-utils.ts
- Adds 3 tests for path traversal, absolute paths, and slashes
The schema used specs/*.md but specs are stored as specs/<capability>/spec.md.
Updated to specs/**/*.md so openspec status/next correctly detect spec completion.
* fix(cli): respect --no-interactive flag in validate command
The validate command's spinner was starting regardless of the
--no-interactive flag, causing hangs in pre-commit hooks.
Changes:
- Pass noInteractive option to runBulkValidation
- Handle Commander.js --no-* flag syntax (sets interactive=false)
- Only start ora spinner when in interactive mode
- Add CI environment variable check to isInteractive() for industry
standard compliance
* test: add unit tests for interactive utilities and CLI flag
- Export resolveNoInteractive() helper for reuse
- Add InteractiveOptions type export for testing
- Refactor validate.ts to use resolveNoInteractive()
- Add 17 unit tests for isInteractive() and resolveNoInteractive()
- Add CLI integration test for --no-interactive flag
This prevents future regressions where Commander.js --no-* flag
parsing is not properly handled.
* feat(cli): add openspec config command for global configuration management
Implements the `openspec config` command with subcommands:
- `path`: Show config file location
- `list [--json]`: Show all current settings
- `get <key>`: Get a specific value (raw output for scripting)
- `set <key> <value> [--string]`: Set a value with auto type coercion
- `unset <key>`: Remove a key (revert to default)
- `reset --all [-y]`: Reset configuration to defaults
- `edit`: Open config in $EDITOR/$VISUAL
Key features:
- Dot notation for nested key access (e.g., featureFlags.someFlag)
- Auto type coercion (true/false → boolean, numbers → number)
- --string flag to force string storage
- Zod schema validation with unknown field passthrough
- Reserved --scope flag for future project-local config
- Windows-compatible editor spawning with proper path quoting
- Shell completion registry integration
* test(config): add additional unit tests for validation and coercion
- Add tests for unknown fields with various types
- Add test to verify error message path for featureFlags
- Add test for number values rejection in featureFlags
- Add config set simulation tests to verify full coerce → set → validate flow
* fix(config): avoid shell parsing in config edit to handle paths with spaces
Use spawn with shell: false and pass configPath as an argument instead
of building a shell command string. This correctly handles spaces in
both the EDITOR path and config file path on all platforms.
* chore(openspec): archive add-config-command and create cli-config spec
Move completed change to archive and apply spec deltas to create
the cli-config specification documenting the config command interface.
* Validate config keys on set
* shell completions for zsh
* after code review changes
* expose only postinstall.js script
* Replace _openspec "$@" with compdef in zsh-generator.ts to prevent execution during load
* Update test/commands/completion.test.ts
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* - Fix dispatcher to use $words instead of $line for subcommand routing
- Add __complete endpoint with tab-separated output for safe parsing
- Replace brittle awk parsing with __complete in completion helpers
- Add uninstall confirmation prompt with --yes flag to skip
- Prefer $ZSH env var for Oh My Zsh detection before dir check
- Add fpath verification guidance for OMZ installations
- Update cli-completion spec to document generate subcommand
* improve shell detection and installation handling
- Return structured result from detectShell() with shell and detected name
- Detect already-installed completions and skip reinstall
- Add update detection with automatic backup of previous version
- Add debug logging to silent catch blocks for diagnostics
- Quote fpath directories to handle paths with spaces
- Verify Oh My Zsh fpath configuration and add to .zshrc if needed
- Show helpful error for detected but unsupported shells
- Update all tests for new detection API
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Tabish Bidiwale <30385142+TabishB@users.noreply.github.com>
* feat: implement Phase 1 E2E testing with cross-platform CI matrix
- Add shared runCLI helper in test/helpers/run-cli.ts for spawn testing
- Create test/cli-e2e/basic.test.ts covering help, version, validate flows
- Migrate existing CLI exec tests to use runCLI helper
- Extend CI matrix to bash (Linux/macOS) and pwsh (Windows)
- Update Phase 1 tasks and proposal with implementation status
* fix: correct YAML syntax in CI workflow diagnostics command
* fix: use multiline YAML for diagnostics command
* fix ci
* fix: ci
* fix: update core validation and json converter
* chore(ci): split pr and main workflows
* refactor: simplify CI workflow with unified matrix strategy
- Consolidate test_pr and test_matrix into single test job
- Add proper shell configuration with defaults
- Add timeout protection (15 minutes)
- Simplify required-checks to single job
- Maintain cross-platform testing (bash on Linux/macOS, pwsh on Windows)
* fix: restore lean PR workflow with async main branch matrix
- PRs run only essential tests on ubuntu-latest (fast feedback)
- Main branch runs full cross-platform matrix asynchronously
- Separate required-checks for each workflow type
- Different timeouts: 10min for PR, 15min for matrix
Fixes validation errors on Windows by normalizing CRLF/CR line endings
to LF before parsing sections. Adds comprehensive test coverage for
CRLF handling in both unit and integration tests.
Implements new `openspec spec` command with three subcommands:
- `spec show`: Display specs with JSON output and filtering options
- `spec list`: List all available specifications
- `spec validate`: Validate spec structure with detailed reporting
Key features:
- JSON output for CI/CD integration (--json flag)
- Content filtering (--requirements, --no-scenarios, -r)
- Strict validation mode (--strict)
- Support for both Overview/Purpose and Requirements/Behavior sections
This enables programmatic access to OpenSpec specifications for external
tools and automated pipelines as specified in the add-spec-commands change.
Tabish Bidiwale