Copilot
69ee7a836e
feat(presets): Pluggable preset system with catalog, resolver, and skills propagation ( #1787 )
...
* Initial plan
* feat(templates): add pluggable template system with packs, catalog, resolver, and CLI commands
Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com >
* test(templates): add comprehensive unit tests for template pack system
Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com >
* feat(presets): pluggable preset system with template/command overrides, catalog, and resolver
- Rename 'template packs' to 'presets' to avoid naming collision with core templates
- PresetManifest, PresetRegistry, PresetManager, PresetCatalog, PresetResolver in presets.py
- Extract CommandRegistrar to agents.py as shared infrastructure
- CLI: specify preset list/add/remove/search/resolve/info
- CLI: specify preset catalog list/add/remove
- --preset option on specify init
- Priority-based preset stacking (--priority, lower = higher precedence)
- Command overrides registered into all detected agent directories (17+ agents)
- Extension command safety: skip registration if target extension not installed
- Multi-catalog support: env var, project config, user config, built-in defaults
- resolve_template() / Resolve-Template in bash/PowerShell scripts
- Self-test preset: overrides all 6 core templates + 1 command
- Scaffold with 4 examples: core/extension template and command overrides
- Preset catalog (catalog.json, catalog.community.json)
- Documentation: README.md, ARCHITECTURE.md, PUBLISHING.md
- 110 preset tests, 253 total tests passing
* feat(presets): propagate command overrides to skills via init-options
- Add save_init_options() / load_init_options() helpers that persist
CLI flags from 'specify init' to .specify/init-options.json
- PresetManager._register_skills() overwrites SKILL.md files when
--ai-skills was used during init and corresponding skill dirs exist
- PresetManager._unregister_skills() restores core template content
on preset removal
- registered_skills stored in preset registry metadata
- 8 new tests covering skill override, skip conditions, and restore
* fix: address PR check failures (ruff F541, CodeQL URL substring)
- Remove extraneous f-prefix from two f-strings without placeholders
- Replace substring URL check in test with startswith/endswith assertions
to satisfy CodeQL incomplete URL substring sanitization rule
* fix: address Copilot PR review comments
- Move save_init_options() before preset install so skills propagation
works during 'specify init --preset --ai-skills'
- Clean up downloaded ZIP after successful preset install during init
- Validate --from URL scheme (require HTTPS, HTTP only for localhost)
- Expose unregister_commands() on extensions.py CommandRegistrar wrapper
instead of reaching into private _registrar field
- Use _get_merged_packs() for search() and get_pack_info() so all
active catalogs are searched, not just the highest-priority one
- Fix fetch_catalog() cache to verify cached URL matches current URL
- Fix PresetResolver: script resolution uses .sh extension, consistent
file extensions throughout resolve(), and resolve_with_source()
delegates to resolve() to honor template_type parameter
- Fix bash common.sh: fall through to directory scan when python3
returns empty preset list
- Fix PowerShell Resolve-Template: filter out dot-folders and sort
extensions deterministically
* fix: narrow empty except blocks and add explanatory comments
* fix: address Copilot PR review comments (round 2)
- Fix init --preset error masking: distinguish "not found" from real errors
- Fix bash resolve_template: skip hidden dirs in extensions (match Python/PS)
- Fix temp dir leaks in tests: use temp_dir fixture instead of mkdtemp
- Fix self-test catalog entry: add note that it's local-only (no download_url)
- Fix Windows path issue in resolve_with_source: use Path.relative_to()
- Fix skill restore path: use project's .specify/templates/commands/ not source tree
- Add encoding="utf-8" to all file read/write in agents.py
- Update test to set up core command templates for skill restoration
* fix: remove self-test from catalog.json (local-only preset)
* fix: address Copilot PR review comments (round 3)
- Fix PS Resolve-Template fallback to skip dot-prefixed dirs (.cache)
- Rename _catalog to _catalog_name for consistency with extension system
- Enforce install_allowed policy in CLI preset add and download_pack()
- Fix shell injection: pass registry path via env var instead of string interpolation
* fix: correct PresetError docstring from template to preset
* Removed CHANGELOG requirement
* Applying review recommendations
* Applying review recommendations
* Applying review recommendations
* Applying review recommendations
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com >
2026-03-13 15:09:14 -05:00
Pierluigi Lenoci
46bc65b1ce
fix: harden bash scripts against shell injection and improve robustness ( #1809 )
...
- Replace eval of unquoted get_feature_paths output with safe pattern:
capture into variable, check return code, then eval quoted result
- Use printf '%q' in get_feature_paths to safely emit shell assignments,
preventing injection via paths containing quotes or metacharacters
- Add json_escape() helper for printf JSON fallback paths, handling
backslash, double-quote, and control characters when jq is unavailable
- Use jq -cn for safe JSON construction with proper escaping when
available, with printf + json_escape() fallback
- Replace declare -A (bash 4+) with indexed array for bash 3.2
compatibility (macOS default)
- Use inline command -v jq check in create-new-feature.sh since it
does not source common.sh
- Guard trap cleanup against re-entrant invocation by disarming traps
at entry
- Use printf '%q' for shell-escaped branch names in user-facing output
- Return failure instead of silently returning wrong path on ambiguous
spec directory matches
- Deduplicate agent file updates via realpath to prevent multiple writes
to the same file (e.g. AGENTS.md aliased by multiple variables)
2026-03-13 10:47:17 -05:00
