Initial plan

* docs: document evolving specs in existing projects

* docs: reframe evolving specs guide around persistence models

* docs: address evolving specs guide feedback

* docs: address evolving specs review feedback

* docs: require explicit integration in evolving specs update command

---------

Co-authored-by: root <kinsonnee@gmail.com>

.github/skills/add-community-extension/SKILL.md

@@ -70,6 +70,8 @@ Use the existing entries as the format template. Required fields:
     "documentation": "<documentation>",
     "changelog": "<changelog>",
     "license": "<license>",
+    "category": "<category>",
+    "effect": "<effect>",
     "requires": {
       "speckit_version": "<speckit_version>"
     },
@@ -87,6 +89,9 @@ Use the existing entries as the format template. Required fields:
 }
 ```
 
+**Category** — free-form string; common values: `docs`, `code`, `process`, `integration`, `visibility`
+**Effect** — one of: `read-only`, `read-write`
+
 If the extension has optional tool dependencies, add a `"tools"` array inside `"requires"`:
 
 ```json
@@ -113,8 +118,8 @@ Determine the category and effect from the extension's behavior:
 | <Name> | <Description> | `<category>` | <Effect> | [<repo-name>](<repository-url>) |
 ```
 
-**Category** — one of: `docs`, `code`, `process`, `integration`, `visibility`
-**Effect** — `Read-only` (produces reports only) or `Read+Write` (modifies project files)
+**Category** — free-form; common values: `docs`, `code`, `process`, `integration`, `visibility`
+**Effect** — write canonical values `read-only` or `read-write` in `extension.yml` and `catalog.community.json`; use `Read-only`/`Read+Write` only for the docs table display
 
 ### 6. Commit, push, and open PR
 

CHANGELOG.md

@@ -2,6 +2,81 @@
 
 <!-- insert new changelog below this comment -->
 
+## [0.11.0] - 2026-06-16
+
+### Changed
+
+- Add workflow step catalog — community-installable step types (#2394)
+- feat(dev): add integration scaffolder (#2685)
+- Add Command Density preset to community catalog (#3006)
+- fix(tests): don't run PowerShell tests via WSL-interop powershell.exe (#2971)
+- Add Zed integration (#2780)
+- Update architecture-governance preset to v0.5.0 (#2929)
+- Update Superpowers Implementation Bridge extension to v1.1.0 (#3011)
+- Update isaqb-architecture-governance preset to v0.2.0 (#2984)
+- Update security-governance preset to v0.6.0 (#2932)
+- chore: update CITATION.cff to v0.10.2 (2026-06-11) (#2966)
+- chore: release 0.10.4, begin 0.10.5.dev0 development (#3010)
+
+## [0.10.4] - 2026-06-16
+
+### Changed
+
+- fix: fail loudly when a fan-out 'items' expression does not resolve to a list (#2957)
+- refactor: move preset command handlers to presets/_commands.py (PR-6/8) (#2826)
+- Update agent-parity-governance preset to v0.3.0 (#2982)
+- Update cross-platform-governance preset to v0.2.0 (#2983)
+- Add Data Model Diagram extension to community catalog (#2922)
+- Add Spec Kit TLDR extension to community catalog (#3007)
+- docs: add guide for handling complex features (#3004)
+- Add Loop Engineering extension to community catalog (#3002)
+- Update MemoryLint extension to v1.5.1 (#3000)
+- chore: release 0.10.3, begin 0.10.4.dev0 development (#2999)
+
+## [0.10.3] - 2026-06-16
+
+### Changed
+
+- Update Superpowers Bridge extension to v1.6.0 (#2998)
+- Add Improve Extension to community catalog (#2997)
+- Update Product Forge extension to v1.7.0 (#2996)
+- Update Linear Integration extension to v0.5.0 (#2995)
+- Update Superpowers Implementation Bridge extension to v1.0.3 (#2993)
+- Update Ralph community extension to v1.1.1 (#2861)
+- Update Linear Integration extension to v0.4.0 (#2942)
+- Update DocGuard — CDD Enforcement to v0.26.0 (#2941)
+- Add SpecKit Companion extension to community catalog (#2937)
+- chore: release 0.10.2, begin 0.10.3.dev0 development (#2936)
+
+## [0.10.2] - 2026-06-11
+
+### Changed
+
+- Add Research Harness extension to community catalog (#2935)
+- Add Coding Standards Drift Control extension to community catalog (#2934)
+- Add Spec Trace extension to community catalog (#2527)
+- fix(extensions): preserve argument-hint in extension Claude SKILL.md (#2916)
+- fix(presets): harden preset URL installs against unsafe redirects (#2911)
+- fix: skip recovered files during refresh_managed overwrite check (#2918) (#2919)
+- Update multi-model-review extension to v0.1.1 (#2900)
+- feat: add category and effect as first-class fields in extension schema (#2899)
+- chore(catalog): add Jira Integration (Sync Engine) extension (#2895)
+- chore: release 0.10.1, begin 0.10.2.dev0 development (#2910)
+
+## [0.10.1] - 2026-06-09
+
+### Changed
+
+- Update DocGuard — CDD Enforcement extension to v0.25.1 (#2909)
+- Update a11y-governance preset to v0.3.0 (#2867)
+- docs: document spec persistence models (#2856)
+- chore(catalog): bump Linear Integration to v0.3.0 (repo renamed to spec-kit-linear-sync) (#2893)
+- chore: update DocGuard extension to v0.25.0 (#2707)
+- chore: remove unused open_github_url/_StripAuthOnRedirect from _github_http.py (#2883)
+- fix(catalogs): validate extension and preset catalog payload shape (#2621)
+- feat(integration): add status reporting (#2674)
+- chore: release 0.10.0, begin 0.10.1.dev0 development (#2904)
+
 ## [0.10.0] - 2026-06-09
 
 ### Changed

CITATION.cff

@@ -20,8 +20,8 @@ authors:
 repository-code: "https://github.com/github/spec-kit"
 url: "https://github.github.io/spec-kit/"
 license: MIT
-version: "0.7.3"
-date-released: "2026-04-17"
+version: "0.10.2"
+date-released: "2026-06-11"
 keywords:
   - spec-driven development
   - ai coding agents

README.md

@@ -254,6 +254,12 @@ Spec-Driven Development is a structured process that emphasizes:
 | **Creative Exploration**                 | Parallel implementations | <ul><li>Explore diverse solutions</li><li>Support multiple technology stacks & architectures</li><li>Experiment with UX patterns</li></ul>                         |
 | **Iterative Enhancement** ("Brownfield") | Brownfield modernization | <ul><li>Add features iteratively</li><li>Modernize legacy systems</li><li>Adapt processes</li></ul>                                                                |
 
+For existing projects, keep Spec Kit tooling updates separate from feature
+artifact evolution: refresh managed project files when upgrading, and update
+`specs/` artifacts when intended behavior changes. The
+[Evolving Specs guide](./docs/guides/evolving-specs.md) describes the
+recommended brownfield loop.
+
 ## 🎯 Experimental Goals
 
 Our research and experimentation focus on:

docs/community/extensions.md

@@ -7,7 +7,7 @@
 
 The following community-contributed extensions are available in [`catalog.community.json`](https://github.com/github/spec-kit/blob/main/extensions/catalog.community.json):
 
-**Categories:**
+**Categories** (common values, but any string is allowed):
 
 - `docs` — reads, validates, or generates spec artifacts
 - `code` — reviews, validates, or modifies source code
@@ -15,10 +15,13 @@ The following community-contributed extensions are available in [`catalog.commun
 - `integration` — syncs with external platforms
 - `visibility` — reports on project health or progress
 
-**Effect:**
+**Effect** (canonical `extension.yml`/catalog values):
 
-- `Read-only` — produces reports without modifying files
-- `Read+Write` — modifies files, creates artifacts, or updates specs
+- `read-only` — produces reports without modifying files (displayed as `Read-only` in the table)
+- `read-write` — modifies files, creates artifacts, or updates specs (displayed as `Read+Write` in the table)
+
+> [!TIP]
+> Extension authors can declare `category` and `effect` in their `extension.yml` under the `extension:` block. These fields are also available in `catalog.community.json` for tooling and the CLI (`specify extension info`).
 
 | Extension | Purpose | Category | Effect | URL |
 |-----------|---------|----------|--------|-----|
@@ -41,9 +44,11 @@ The following community-contributed extensions are available in [`catalog.commun
 | CI Guard | Spec compliance gates for CI/CD — verify specs exist, check drift, and block merges on gaps | `process` | Read-only | [spec-kit-ci-guard](https://github.com/Quratulain-bilal/spec-kit-ci-guard) |
 | Checkpoint Extension | Commit the changes made during the middle of the implementation, so you don't end up with just one very large commit at the end | `code` | Read+Write | [spec-kit-checkpoint](https://github.com/aaronrsun/spec-kit-checkpoint) |
 | Cleanup Extension | Post-implementation quality gate that reviews changes, fixes small issues (scout rule), creates tasks for medium issues, and generates analysis for large issues | `code` | Read+Write | [spec-kit-cleanup](https://github.com/dsrednicki/spec-kit-cleanup) |
+| Coding Standards Drift Control | Generate coding-standards drift reports and remediation tasks for active Spec Kit features | `code` | Read+Write | [spec-kit-coding-standards-drift-control](https://github.com/benizzio/spec-kit-coding-standards-drift-control) |
 | Conduct Extension | Orchestrates spec-kit phases via sub-agent delegation to reduce context pollution. | `process` | Read+Write | [spec-kit-conduct-ext](https://github.com/twbrandon7/spec-kit-conduct-ext) |
 | Confluence Extension | Create a doc in Confluence summarizing the specifications and planning files | `integration` | Read+Write | [spec-kit-confluence](https://github.com/aaronrsun/spec-kit-confluence) |
 | Cost Tracker | Track real LLM dollar cost across SDD workflows — per-feature budgets, per-integration comparison, and finance-ready exports | `visibility` | Read+Write | [spec-kit-cost](https://github.com/Quratulain-bilal/spec-kit-cost) |
+| Data Model Diagram | Generates Mermaid ER diagrams from Spec Kit data models after planning | `docs` | Read+Write | [spec-kit-data-model-diagram](https://github.com/benizzio/spec-kit-data-model-diagram) |
 | DocGuard — CDD Enforcement | Canonical-Driven Development enforcement. Validates, scores, and traces project documentation with automated checks, AI-driven workflows, and spec-kit hooks. One pinned runtime dependency; pure Node.js otherwise. | `docs` | Read+Write | [spec-kit-docguard](https://github.com/raccioly/docguard) |
 | Extensify | Create and validate extensions and extension catalogs | `process` | Read+Write | [extensify](https://github.com/mnriem/spec-kit-extensions/tree/main/extensify) |
 | Fix Findings | Automated analyze-fix-reanalyze loop that resolves spec findings until clean | `code` | Read+Write | [spec-kit-fix-findings](https://github.com/Quratulain-bilal/spec-kit-fix-findings) |
@@ -51,12 +56,15 @@ The following community-contributed extensions are available in [`catalog.commun
 | Fleet Orchestrator | Orchestrate a full feature lifecycle with human-in-the-loop gates across all SpecKit phases | `process` | Read+Write | [spec-kit-fleet](https://github.com/sharathsatish/spec-kit-fleet) |
 | GitHub Issues Integration 1 | Generate spec artifacts from GitHub Issues - import issues, sync updates, and maintain bidirectional traceability | `integration` | Read+Write | [spec-kit-github-issues](https://github.com/Fatima367/spec-kit-github-issues) |
 | GitHub Issues Integration 2 | Creates and syncs local specs from an existing GitHub issue | `integration` | Read+Write | [spec-kit-issue](https://github.com/aaronrsun/spec-kit-issue) |
+| Improve Extension | Audits any codebase as a senior advisor and writes prioritized, self-contained spec prompts under specs/ that the spec-kit lifecycle can process | `process` | Read+Write | [spec-kit-improve](https://github.com/d0whc3r/spec-kit-improve) |
 | Interactive HTML Preview | Generate self-contained interactive HTML prototypes from Spec Kit artifacts | `docs` | Read+Write | [spec-kit-preview](https://github.com/bigsmartben/spec-kit-preview) |
 | Intelligent Agent Orchestrator | Cross-catalog agent discovery and intelligent prompt-to-command routing | `process` | Read+Write | [spec-kit-orchestrator](https://github.com/pragya247/spec-kit-orchestrator) |
 | Iterate | Iterate on spec documents with a two-phase define-and-apply workflow — refine specs mid-implementation and go straight back to building | `docs` | Read+Write | [spec-kit-iterate](https://github.com/imviancagrace/spec-kit-iterate) |
 | Jira Integration | Create Jira Epics, Stories, and Issues from spec-kit specifications and task breakdowns with configurable hierarchy and custom field support | `integration` | Read+Write | [spec-kit-jira](https://github.com/mbachorik/spec-kit-jira) |
+| Jira Integration (Sync Engine) | Idempotent, drift-aware, fail-closed reconcile engine mirroring spec-kit specs into Jira (Epic per repo, Story per spec, Subtask per phase) | `integration` | Read+Write | [spec-kit-jira-sync](https://github.com/ashbrener/spec-kit-jira-sync) |
 | Learning Extension | Generate educational guides from implementations and enhance clarifications with mentoring context | `docs` | Read+Write | [spec-kit-learn](https://github.com/imviancagrace/spec-kit-learn) |
 | Linear Integration | Mirror spec-kit feature directories into Linear (filesystem → Linear, reconcile-based, unidirectional). | `integration` | Read+Write | [spec-kit-linear-sync](https://github.com/ashbrener/spec-kit-linear-sync) |
+| Loop Engineering | Engineer safe autonomous agent loops for spec-driven development: a maker/checker split, externalized loop state, and stay-the-engineer guardrails against comprehension debt and cognitive surrender | `process` | Read+Write | [spec-kit-loop](https://github.com/formin/spec-kit-loop) |
 | MAQA — Multi-Agent & Quality Assurance | Coordinator → feature → QA agent workflow with parallel worktree-based implementation. Language-agnostic. Auto-detects installed board plugins. Optional CI gate. | `process` | Read+Write | [spec-kit-maqa-ext](https://github.com/GenieRobot/spec-kit-maqa-ext) |
 | MAQA Azure DevOps Integration | Azure DevOps Boards integration for MAQA — syncs User Stories and Task children as features progress | `integration` | Read+Write | [spec-kit-maqa-azure-devops](https://github.com/GenieRobot/spec-kit-maqa-azure-devops) |
 | MAQA CI/CD Gate | Auto-detects GitHub Actions, CircleCI, GitLab CI, and Bitbucket Pipelines. Blocks QA handoff until pipeline is green. | `process` | Read+Write | [spec-kit-maqa-ci](https://github.com/GenieRobot/spec-kit-maqa-ci) |
@@ -68,7 +76,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | MDE | Minimal model-driven engineering workflow with setup, next, and status commands | `process` | Read+Write | [spec-kit-mde](https://github.com/AI-MDE/spec-kit-mde) |
 | Memory Loader | Loads .specify/memory/ files before lifecycle commands so LLM agents have project governance context | `docs` | Read-only | [spec-kit-memory-loader](https://github.com/KevinBrown5280/spec-kit-memory-loader) |
 | Memory MD | Spec Kit extension for repository-native Markdown memory that captures durable decisions, bugs, and project context | `docs` | Read+Write | [spec-kit-memory-hub](https://github.com/DyanGalih/spec-kit-memory-hub) |
-| MemoryLint | Agent memory governance tool: Automatically audits and fixes boundary conflicts between AGENTS.md and the constitution. | `process` | Read+Write | [memorylint](https://github.com/RbBtSn0w/spec-kit-extensions/tree/main/memorylint) |
+| MemoryLint | Evidence-driven instruction drift checker: audits agent memory files for boundary, reality, conflict, and redundancy drift. | `process` | Read+Write | [memorylint](https://github.com/RbBtSn0w/spec-kit-extensions/tree/main/memorylint) |
 | Microsoft 365 Integration | Fetch Teams messages, meeting transcripts, and SharePoint/OneDrive files as local Markdown for spec generation | `integration` | Read+Write | [spec-kit-m365](https://github.com/BenBtg/spec-kit-m365) |
 | Multi-Model Review | Cross-model Spec Kit handoffs for spec authoring, implementation routing, and review. | `process` | Read+Write | [multi-model-review](https://github.com/formin/multi-model-review) |
 | Multi-Sites Spec Kit | Multi-site aware specify command with per-site spec folders, auto-increment, and Drupal support | `process` | Read+Write | [spec-kit-multi-sites](https://github.com/teeyo/spec-kit-multi-sites) |
@@ -79,7 +87,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | Plan Review Gate | Require spec.md and plan.md to be merged via MR/PR before allowing task generation | `process` | Read-only | [spec-kit-plan-review-gate](https://github.com/luno/spec-kit-plan-review-gate) |
 | PR Bridge | Auto-generate pull request descriptions, checklists, and summaries from spec artifacts | `process` | Read-only | [spec-kit-pr-bridge-](https://github.com/Quratulain-bilal/spec-kit-pr-bridge-) |
 | Presetify | Create and validate presets and preset catalogs | `process` | Read+Write | [presetify](https://github.com/mnriem/spec-kit-extensions/tree/main/presetify) |
-| Product Forge | Full product lifecycle from research to release — express/lite/standard/v-model tracks, living spec + traceability, structured journeys → E2E, monorepo, and selectable doc-structure strategies | `process` | Read+Write | [speckit-product-forge](https://github.com/VaiYav/speckit-product-forge) |
+| Product Forge | Full product-lifecycle orchestrator for Spec Kit: research → product-spec → plan → tasks → implement → verify → test → release-readiness, across express/lite/standard/v-model modes with human-in-the-loop gates. | `process` | Read+Write | [speckit-product-forge](https://github.com/VaiYav/speckit-product-forge) |
 | Product Spec Extension | Generates PRFAQ, Lean PRD, stakeholder summaries, and technical designs from engineering specs | `docs` | Read+Write | [spec-kit-product](https://github.com/d0whc3r/spec-kit-product) |
 | Project Health Check | Diagnose a Spec Kit project and report health issues across structure, agents, features, scripts, extensions, and git | `visibility` | Read-only | [spec-kit-doctor](https://github.com/KhawarHabibKhan/spec-kit-doctor) |
 | Project Status | Show current SDD workflow progress — active feature, artifact status, task completion, workflow phase, and extensions summary | `visibility` | Read-only | [spec-kit-status](https://github.com/KhawarHabibKhan/spec-kit-status) |
@@ -88,6 +96,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | Ralph Loop | Autonomous implementation loop using AI agent CLI | `code` | Read+Write | [spec-kit-ralph](https://github.com/Rubiss-Projects/spec-kit-ralph) |
 | Reconcile Extension | Reconcile implementation drift by surgically updating feature artifacts. | `docs` | Read+Write | [spec-kit-reconcile](https://github.com/stn1slv/spec-kit-reconcile) |
 | Red Team | Adversarial review of specs before /speckit.plan — parallel lens agents surface risks that clarify/analyze structurally can't (prompt injection, integrity gaps, cross-spec drift, silent failures). Produces a structured findings report; no auto-edits to specs. | `docs` | Read+Write | [spec-kit-red-team](https://github.com/ashbrener/spec-kit-red-team) |
+| Research Harness | State-externalizing research harness: budgeted exploration, evidence curation, and claim verification for spec-driven development | `process` | Read+Write | [spec-kit-harness](https://github.com/formin/spec-kit-harness) |
 | Repository Index | Generate index for existing repo for overview, architecture and module level. | `docs` | Read-only | [spec-kit-repoindex](https://github.com/liuyiyu/spec-kit-repoindex) |
 | Reqnroll BDD | Adds Reqnroll BDD planning, Gherkin generation, traceability, safe task injection, handoff, and verification to Spec Kit | `process` | Read+Write | [spec-kit-reqnroll-bdd](https://github.com/LoogacyStudio/spec-kit-reqnroll-bdd) |
 | Retro Extension | Sprint retrospective analysis with metrics, spec accuracy assessment, and improvement suggestions | `process` | Read+Write | [spec-kit-retro](https://github.com/arunt14/spec-kit-retro) |
@@ -102,18 +111,21 @@ The following community-contributed extensions are available in [`catalog.commun
 | Spec Critique Extension | Dual-lens critical review of spec and plan from product strategy and engineering risk perspectives | `docs` | Read-only | [spec-kit-critique](https://github.com/arunt14/spec-kit-critique) |
 | Spec Diagram | Auto-generate Mermaid diagrams of SDD workflow state, feature progress, and task dependencies | `visibility` | Read-only | [spec-kit-diagram-](https://github.com/Quratulain-bilal/spec-kit-diagram-) |
 | Spec Kit Schedule | Optimal multi-agent task scheduling via CP-SAT — DAG precedence, hallucination-aware caps, file-conflict avoidance, stochastic durations, replanning, and interactive HTML output | `process` | Read+Write | [spec-kit-schedule](https://github.com/jfranc38/spec-kit-schedule) |
+| Spec Kit TLDR | Render a feature's spec.md / plan.md into a review-oriented TLDR (self-contained HTML dashboard + PR-native Markdown) that surfaces risks for faster PR review. | `visibility` | Read+Write | [speckit-tldr](https://github.com/qurore/speckit-tldr) |
 | Spec Orchestrator | Cross-feature orchestration — track state, select tasks, and detect conflicts across parallel specs | `process` | Read-only | [spec-kit-orchestrator](https://github.com/Quratulain-bilal/spec-kit-orchestrator) |
 | Spec Reference Loader | Reads the ## References section from the feature spec and loads only the listed docs into context | `docs` | Read-only | [spec-kit-spec-reference-loader](https://github.com/KevinBrown5280/spec-kit-spec-reference-loader) |
 | Spec Refine | Update specs in-place, propagate changes to plan and tasks, and diff impact across artifacts | `process` | Read+Write | [spec-kit-refine](https://github.com/Quratulain-bilal/spec-kit-refine) |
 | Spec Scope | Effort estimation and scope tracking — estimate work, detect creep, and budget time per phase | `process` | Read-only | [spec-kit-scope-](https://github.com/Quratulain-bilal/spec-kit-scope-) |
 | Spec Sync | Detect and resolve drift between specs and implementation. AI-assisted resolution with human approval | `docs` | Read+Write | [spec-kit-sync](https://github.com/bgervin/spec-kit-sync) |
+| Spec Trace | Build a requirement → test traceability matrix from spec.md and the test suite — surface untested requirements and orphan tests | `code` | Read+Write | [spec-kit-trace](https://github.com/Quratulain-bilal/spec-kit-trace) |
 | Spec Validate | Comprehension validation, review gating, and approval state for spec-kit artifacts — staged quizzes, peer review SLA, and a hard gate before /speckit.implement | `process` | Read+Write | [spec-kit-spec-validate](https://github.com/aeltayeb/spec-kit-spec-validate) |
 | Spec2Cloud | Spec-driven workflow tuned for shipping to Azure | `process` | Read+Write | [spec2cloud](https://github.com/Azure-Samples/Spec2Cloud) |
+| SpecKit Companion | Live spec-driven progress — lifecycle capture, status, resume, and a turbo pipeline profile | `visibility` | Read+Write | [speckit-companion](https://github.com/alfredoperez/speckit-companion) |
 | SpecTest | Auto-generate test scaffolds from spec criteria, map coverage, and find untested requirements | `code` | Read+Write | [spec-kit-spectest](https://github.com/Quratulain-bilal/spec-kit-spectest) |
 | Squad Bridge | Bootstrap and synchronize a Squad agent team from your Speckit spec and tasks. | `process` | Read+Write | [spec-kit-squad](https://github.com/jwill824/spec-kit-squad) |
 | Staff Review Extension | Staff-engineer-level code review that validates implementation against spec, checks security, performance, and test coverage | `code` | Read-only | [spec-kit-staff-review](https://github.com/arunt14/spec-kit-staff-review) |
 | Status Report | Project status, feature progress, and next-action recommendations for spec-driven workflows | `visibility` | Read-only | [Open-Agent-Tools/spec-kit-status](https://github.com/Open-Agent-Tools/spec-kit-status) |
-| Superpowers Bridge | Orchestrates obra/superpowers skills within the spec-kit SDD workflow across the full lifecycle (clarification, TDD, review, verification, critique, debugging, branch completion) | `process` | Read+Write | [superpowers-bridge](https://github.com/RbBtSn0w/spec-kit-extensions/tree/main/superpowers-bridge) |
+| Superpowers Bridge | Bridges selected Superpowers disciplines into Spec Kit as evidence-first trust gates for agent workflows. | `process` | Read+Write | [superpowers-bridge](https://github.com/RbBtSn0w/spec-kit-extensions/tree/main/superpowers-bridge) |
 | Superpowers Implementation Bridge | Thin orchestrator between Spec Kit (design) and Superpowers (implementation). Cross-agent. | `process` | Read+Write | [speckit-superpowers-bridge](https://github.com/lihan3238/speckit-superpowers-bridge) |
 | Superspec | Bridges spec-kit with obra/superpowers (brainstorming, TDD, subagent, code-review) into a unified, resumable workflow with graceful degradation and session progress tracking | `process` | Read+Write | [superspec](https://github.com/WangX0111/superspec) |
 | Team Assign | Assign tasks.md items to human engineers, split into subtasks, and generate a per-engineer workboard | `process` | Read+Write | [spec-kit-team-assign](https://github.com/tarunkumarbhati/spec-kit-team-assign) |

docs/community/presets.md

@@ -7,23 +7,24 @@ The following community-contributed presets customize how Spec Kit behaves — o
 
 | Preset | Purpose | Provides | Requires | URL |
 |--------|---------|----------|----------|-----|
-| A11Y Governance | Adds WCAG 2.2 AA accessibility checks, bilingual DE/EN delivery, CEFR-B2 readability, CLI accessibility, inclusive-content guidance, and didactic inline-code-comment review | 10 templates, 3 commands | — | [spec-kit-preset-a11y-governance](https://github.com/hindermath/spec-kit-preset-a11y-governance) |
-| Agent Parity Governance | Keeps shared AI-agent instructions aligned and adds agent-neutral Spec Kit model-routing guidance across project-defined agent guidance surfaces | 9 templates, 3 commands | — | [spec-kit-preset-agent-parity-governance](https://github.com/hindermath/spec-kit-preset-agent-parity-governance) |
+| A11Y Governance | Adds accessibility (WCAG 2.2 AA), bilingual DE/EN delivery, CEFR-B2 readability, inclusive-content governance, didactic inline-code-comment review, and audit-ready Spec Kit run evidence | 10 templates, 3 commands | — | [spec-kit-preset-a11y-governance](https://github.com/hindermath/spec-kit-preset-a11y-governance) |
+| Agent Parity Governance | Adds shared-guidance parity, audit-ready Spec-Kit run evidence, and agent-neutral model-routing guidance across a project's declared AI-agent instruction surfaces so agent guidance does not drift. | 6 templates, 3 commands | — | [spec-kit-preset-agent-parity-governance](https://github.com/hindermath/spec-kit-preset-agent-parity-governance) |
 | AIDE In-Place Migration | Adapts the AIDE extension workflow for in-place technology migrations (X → Y pattern) — adds migration objectives, verification gates, knowledge documents, and behavioral equivalence criteria | 2 templates, 8 commands | AIDE extension | [spec-kit-presets](https://github.com/mnriem/spec-kit-presets) |
-| Architecture Governance | Adds secure architecture governance: trust boundaries, threat modeling, STRIDE/CAPEC, S-ADRs, Zero Trust applicability, and OWASP SAMM | 11 templates, 3 commands | — | [spec-kit-preset-architecture-governance](https://github.com/hindermath/spec-kit-preset-architecture-governance) |
+| Architecture Governance | Adds secure software architecture, STRIDE+CAPEC threat modeling, arc42 security cross-cutting concepts, S-ADRs, Zero Trust applicability, OWASP SAMM governance, BSI C3A cloud autonomy, BSI C5 cloud compliance assurance, and audit-ready Spec Kit run evidence | 13 templates, 3 commands | — | [spec-kit-preset-architecture-governance](https://github.com/hindermath/spec-kit-preset-architecture-governance) |
 | Canon Core | Adapts original Spec Kit workflow to work together with Canon extension | 2 templates, 8 commands | — | [spec-kit-canon](https://github.com/maximiliamus/spec-kit-canon) |
 | Claude AskUserQuestion | Upgrades `/speckit.clarify` and `/speckit.checklist` on Claude Code from Markdown-table prompts to the native AskUserQuestion picker, with a recommended option and reasoning on every question | 2 commands | — | [spec-kit-preset-claude-ask-questions](https://github.com/0xrafasec/spec-kit-preset-claude-ask-questions) |
-| Cross-Platform Governance | Adds Bash/PowerShell parity, dry-run/WhatIf parity, Unix man-page expectations, PowerShell comment-based help, and Verb-Noun Cmdlet discipline | 8 templates, 3 commands | — | [spec-kit-preset-cross-platform-governance](https://github.com/hindermath/spec-kit-preset-cross-platform-governance) |
+| Command Density | Compacts the nine core Spec Kit command prompts while preserving scripts, handoffs, placeholders, hook output blocks, and rule structure | 9 commands | — | [spec-kit-preset-command-density](https://github.com/Xopoko/spec-kit-preset-command-density) |
+| Cross-Platform Governance | Adds Bash + PowerShell parity, Unix man-pages, bilingual comment-based help, Verb-Noun Cmdlet discipline, and audit-ready Spec Kit run evidence for scripting projects managed with Spec Kit | 8 templates, 3 commands | — | [spec-kit-preset-cross-platform-governance](https://github.com/hindermath/spec-kit-preset-cross-platform-governance) |
 | Explicit Task Dependencies | Adds explicit `(depends on T###)` dependency declarations and an Execution Wave DAG to tasks.md for parallel scheduling | 1 template, 1 command | — | [spec-kit-preset-explicit-task-dependencies](https://github.com/Quratulain-bilal/spec-kit-preset-explicit-task-dependencies) |
 | Fiction Book Writing | It adapts the Spec-Driven Development workflow for storytelling to create books or audiobooks (with annotations) in 12 languages: features become story elements, specs become story briefs, plans become story structures, and tasks become scene-by-scene writing tasks. Supports single and multi-POV, all major plot structure frameworks, and two style modes: an author voice sample or humanized AI prose principles. Supports interactive elements like brainstorming, interview, roleplay, and extras like statistics, cover builder, illustration builder, and bio command. Export with templates for KDP, D2D, etc. | 26 templates, 34 commands, 2 scripts | — | [speckit-preset-fiction-book-writing](https://github.com/adaumann/speckit-preset-fiction-book-writing) |
 | Game Narrative Writing | Spec-Driven Development for interactive game narrative pre-production for video games. Authors write in a portable generic format, Twine/Sugarcube (.twee) or Ink (.ink). Covers choice-IF, visual novels, and branching dialogue. Supports Tier 1 mechanic hooks (flag, counter, inventory, timer, trust, currency, npc_state, ending_condition), multi-ending design, series carry-over variable registry, and NPC-focused character architecture. | 22 templates, 36 commands, 2 scripts | — | [speckit-preset-game-narrative-writing](https://github.com/adaumann/speckit-preset-game-narrative-writing) |
-| iSAQB Architecture Governance | Adds general iSAQB/CPSA-F and arc42 architecture governance: goals, context, building blocks, runtime and deployment views, quality scenarios, ADRs, risks, and technical debt | 13 templates, 3 commands | — | [spec-kit-preset-isaqb-architecture-governance](https://github.com/hindermath/spec-kit-preset-isaqb-architecture-governance) |
+| iSAQB Architecture Governance | Adds general iSAQB/CPSA-F and arc42 software-architecture governance, including audit-ready Spec Kit run evidence for architecture goals, views, quality scenarios, ADRs, risks, and technical debt. | 13 templates, 3 commands | — | [spec-kit-preset-isaqb-architecture-governance](https://github.com/hindermath/spec-kit-preset-isaqb-architecture-governance) |
 | Jira Issue Tracking | Overrides `speckit.taskstoissues` to create Jira epics, stories, and tasks instead of GitHub Issues via Atlassian MCP tools | 1 command | — | [spec-kit-preset-jira](https://github.com/luno/spec-kit-preset-jira) |
 | Model Driven Engineering | Focuses on streamlined commands, app repository support, cross-spec support, and capability-aware project memory for model-driven engineering workflows | 6 templates, 11 commands | MDE extension | [spec-kit-preset-mde](https://github.com/AI-MDE/spec-kit-preset-mde) |
 | Multi-Repo Branching | Coordinates feature branch creation across multiple git repositories (independent repos and submodules) during plan and tasks phases | 2 commands | — | [spec-kit-preset-multi-repo-branching](https://github.com/sakitA/spec-kit-preset-multi-repo-branching) |
 | Pirate Speak (Full) | Transforms all Spec Kit output into pirate speak — specs become "Voyage Manifests", plans become "Battle Plans", tasks become "Crew Assignments" | 6 templates, 9 commands | — | [spec-kit-presets](https://github.com/mnriem/spec-kit-presets) |
 | Screenwriting | Spec-Driven Development for screenwriting/scriptwriting/tutorials: feature films, television (pilot, episode, limited series), and stage plays. Adapts the Spec Kit workflow to screenplay craft — slug lines, action lines, act breaks, beat sheets, and industry-standard pitch documents. Supports three-act, Save the Cat, TV pilot, network episode, cable/streaming episode, and stage-play structural frameworks. Export to Fountain, FTX, PDF | 26 templates, 32 commands, 1 script | — | [speckit-preset-screenwriting](https://github.com/adaumann/speckit-preset-screenwriting) |
-| Security Governance | Adds secure development governance: memory-safe-language preference, language-specific secure-coding profiles, NIST SSDF, CWE Top 25, OWASP ASVS, SBOM/AI-SBOM, VEX/SLSA, OpenSSF Scorecard, G7/BSI AI-SBOM target evidence, and EU CRA applicability | 12 templates, 3 commands | — | [spec-kit-preset-security-governance](https://github.com/hindermath/spec-kit-preset-security-governance) |
+| Security Governance | Adds memory-safe-language preference, language-specific secure coding profiles, audit-ready Spec-Kit run evidence, ASVS verification, SBOM/AI-SBOM supply-chain transparency, CRA awareness, and regulatory applicability screening for NIS2, CRA, EU AI Act, and DORA | 14 templates, 3 commands | — | [spec-kit-preset-security-governance](https://github.com/hindermath/spec-kit-preset-security-governance) |
 | Spec2Cloud | Spec-driven workflow tuned for shipping to Azure: spec → plan → tasks → implement → deploy | 5 templates, 8 commands | — | [spec2cloud](https://github.com/Azure-Samples/Spec2Cloud) |
 | Table of Contents Navigation | Adds a navigable Table of Contents to generated spec.md, plan.md, and tasks.md documents | 3 templates, 3 commands | — | [spec-kit-preset-toc-navigation](https://github.com/Quratulain-bilal/spec-kit-preset-toc-navigation) |
 | VS Code Ask Questions | Enhances the clarify command to use `vscode/askQuestions` for batched interactive questioning. | 1 command | — | [spec-kit-presets](https://github.com/fdcastel/spec-kit-presets) |

docs/concepts/complex-features.md

@@ -0,0 +1,83 @@
+# Handling Complex Features
+
+Large or complex features often run smoothly through `/speckit.specify`,
+`/speckit.plan`, and `/speckit.tasks`, then degrade during implementation. In
+the middle of a long `/speckit.implement` run, agents can start to lose track of
+the plan, ignore tasks, or hallucinate — usually right before or after context
+compaction is triggered.
+
+The underlying cause is context window exhaustion. When a single
+implementation run tries to hold the entire feature in context, the model
+degrades as the window fills. The fix is to scope each run so it stays well
+within context limits.
+
+The `/speckit.implement` command accepts free-form user input that the agent
+must consider before proceeding. This means you can scope each run without any
+tooling changes.
+
+## Option 1: Limit How Many Tasks Run Per Invocation
+
+Instead of letting `/speckit.implement` run through every task at once, tell it
+to stop early:
+
+```text
+/speckit.implement only execute tasks T001-T010, then stop and report progress
+```
+
+or scope by phase:
+
+```text
+/speckit.implement only execute the Setup phase, then stop
+```
+
+Because completed tasks are marked `[X]` in `tasks.md`, the next
+`/speckit.implement` invocation picks up where you left off. This keeps each run
+well within context limits.
+
+## Option 2: Instruct the Agent to Use Sub-Agents
+
+If your coding agent supports sub-agents (for example, GitHub Copilot CLI or the
+GitHub Copilot extension for VS Code), you can instruct `/speckit.implement` to
+delegate individual tasks:
+
+```text
+/speckit.implement delegate each parallel [P] task to a sub-agent
+```
+
+Each sub-agent gets a focused context — one task plus the relevant plan
+excerpts — rather than the full feature context, so compaction never triggers
+in the main session.
+
+## Option 3: Combine Both
+
+For very large features, combine scoping and delegation:
+
+```text
+/speckit.implement execute only the Core phase, delegate [P] tasks to sub-agents
+```
+
+## Option 4: Decompose the Feature Into Smaller Specs
+
+When even a single phase overwhelms the context, break the feature into
+independently specified sub-features. Each sub-feature gets its own
+`spec.md`, `plan.md`, and `tasks.md`, and runs through its own
+specify/plan/tasks/implement cycle.
+
+This is the "spec of specs" approach: the first iteration breaks a massive
+feature into smaller, self-contained specs that can each be implemented without
+overwhelming the model. It adds the most overhead, so reserve it for features
+that are too large to handle any other way.
+
+## Which Approach to Choose
+
+| Approach | Best for |
+| --- | --- |
+| Limit to N tasks or a phase | Any agent; simplest; no sub-agent support needed |
+| Sub-agent delegation | Agents that support sub-agents; maximizes parallelism |
+| Combine scoping + delegation | Large features on sub-agent-capable agents; balances both |
+| Decompose into smaller specs | When even a single phase overwhelms the context |
+
+For most cases, limiting task scope per run is the simplest fix. Reach for
+sub-agent delegation when your agent supports it and you want parallelism, and
+decompose into smaller specs only when a single phase is still too large to
+handle in one run.

docs/concepts/sdd.md

@@ -13,8 +13,9 @@ Spec-Driven Development is a structured process that emphasizes:
 
 Spec Kit does not prescribe how teams preserve or mutate `spec.md`, `plan.md`,
 and `tasks.md` after requirements change. See
-[Spec Persistence Models](spec-persistence.md) for three common ways to manage
-those artifacts over time.
+[Spec Persistence Models](spec-persistence.md) for the concepts and
+[Evolving Specs in Existing Projects](../guides/evolving-specs.md) for the
+existing-project evolution workflows.
 
 ## Development Phases
 

docs/docfx.json

@@ -7,6 +7,7 @@
           "toc.yml",
           "community/*.md",
           "concepts/*.md",
+          "guides/*.md",
           "reference/*.md",
           "install/*.md"
         ]
@@ -78,4 +79,3 @@
     }
   }
 }
-

docs/guides/evolving-specs.md

@@ -0,0 +1,90 @@
+# Evolving Specs in Existing Projects
+
+Existing projects need two separate maintenance loops:
+
+- **Spec Kit project-file updates** refresh managed commands, scripts,
+  templates, and shared memory files.
+- **Feature artifact evolution** keeps repository-specific `specs/` artifacts
+  aligned with the code and product behavior you intend to ship.
+
+Use the [upgrade workflow](../upgrade.md) when you need newer Spec Kit project
+files. Use one of the artifact persistence models below when requirements or
+implementation insights change an existing project.
+
+For the conceptual model definitions, see
+[Spec Persistence Models](../concepts/spec-persistence.md).
+
+## Flow-Forward Spec
+
+Use flow-forward when each feature directory should remain a historical record.
+
+When you add another feature or make a substantial follow-up change, create a
+new feature spec through your installed `/speckit.specify` command and continue
+through the standard flow:
+
+1. Run `/speckit.specify` to create a new feature directory under `specs/`.
+2. Run `/speckit.plan` to define the implementation approach.
+3. Run `/speckit.tasks` to derive the work breakdown.
+4. Run `/speckit.implement` and review the resulting code and artifact diffs.
+
+The previous feature directory remains intact for audit, comparison, or
+explaining how the project reached its current state. Use clear feature names or
+cross-links when a new directory supersedes or extends earlier work.
+
+## Living Spec
+
+Use living spec when `spec.md` is the contract and `plan.md` and `tasks.md` are
+derived from it.
+
+When intended behavior changes, revise the existing `spec.md` first. Then
+regenerate or manually revise downstream artifacts so they match the updated
+spec:
+
+1. Start from a clean working tree or a dedicated branch so every generated
+   change is reviewable.
+2. Update `spec.md` with `/speckit.clarify` or an explicit edit.
+3. Rerun `/speckit.plan` or revise `plan.md` so the technical approach matches
+   the revised spec.
+4. Rerun `/speckit.tasks` or revise `tasks.md` so implementation work matches
+   the revised plan.
+5. Run `/speckit.analyze` before implementation resumes to catch gaps between
+   the spec, plan, and tasks.
+6. Run `/speckit.implement`, then review the code and artifact diffs together.
+
+Preserve important implementation rationale before replacing derived artifacts.
+If a plan or task list contains decisions that still matter, carry them forward
+explicitly.
+
+## Flow-Back Spec
+
+Use flow-back when implementation discoveries are allowed to reshape the
+artifact set.
+
+In this model, the first useful edit can happen wherever the insight lands:
+`spec.md`, `plan.md`, `tasks.md`, or the implementation. After the change, bring
+the artifact set back into alignment:
+
+1. Capture the discovery in the artifact closest to the work.
+2. Decide whether it changes intended behavior, implementation strategy, task
+   breakdown, or only code.
+3. Update any other artifacts that now disagree with the accepted direction.
+4. Run `/speckit.analyze` to check for gaps across `spec.md`, `plan.md`, and
+   `tasks.md`.
+5. Continue implementation only after the artifact set describes the behavior
+   and approach you want future contributors to trust.
+
+Flow-back is flexible, but it requires discipline. Do not leave a lower-level
+change in `tasks.md` or code if `spec.md` still says something different and the
+spec is meant to remain trustworthy.
+
+## Before Updating Spec Kit Project Files
+
+Before refreshing Spec Kit project files with the terminal command
+`specify init --here --force --integration <your-agent>`, protect any
+project-specific material that lives outside `specs/`, especially
+`.specify/memory/constitution.md` and customized files under
+`.specify/templates/` or `.specify/scripts/`. Use `<your-agent>` for the AI
+coding agent integration used by the target project.
+
+Your `specs/` directory is not part of the template package, but shared project
+files can be overwritten by a forced refresh.

docs/index.md

@@ -4,7 +4,7 @@
 
 **Define what to build before building it — with any AI coding agent.**
 
-Spec Kit is a toolkit for [Spec-Driven Development](concepts/sdd.md) (SDD), a methodology that puts specifications at the center of AI-assisted software development. Instead of jumping straight to code, you describe *what* to build, refine it through structured phases, and let your AI coding agent implement it.
+Spec Kit is a toolkit for [Spec-Driven Development](concepts/sdd.md) (SDD), a methodology that puts specifications at the center of AI-assisted software development. Instead of jumping straight to code, you describe _what_ to build, refine it through structured phases, and let your AI coding agent implement it.
 
 <a href="installation.md" class="btn btn-primary btn-lg">Install Spec Kit</a>&nbsp;
 <a href="quickstart.md" class="btn btn-outline-primary btn-lg">Quick Start</a>
@@ -31,7 +31,7 @@ Define what to build before building it. Rich templates, quality checklists, and
 
 ### Use any coding agent
 
-<span class="pillar-stat">30 integrations</span> — Copilot, Gemini, Codex, Windsurf, Claude, Forge, Kiro, and more. Switch freely between agents with a single command. No lock-in.
+<span class="pillar-stat">30+ integrations</span> — Copilot, Gemini, Codex, Windsurf, Zed, Claude, Forge, Kiro, and more. Switch freely between agents with a single command. No lock-in.
 
 Run `specify init` with your agent of choice and Spec Kit sets up the right command files, context rules, and directory structures automatically. If your agent isn't listed, the `generic` integration is an escape hatch for any tool.
 
@@ -90,7 +90,7 @@ Community extensions like CI Guard and Architecture Guard add compliance gates a
     <span class="stat-label">Contributors</span>
   </div>
   <div class="stat-item">
-    <span class="stat-number">30</span>
+    <span class="stat-number">30+</span>
     <span class="stat-label">Integrations</span>
   </div>
   <div class="stat-item">

docs/local-development.md

@@ -98,15 +98,41 @@ ls -l scripts | grep .sh
 
 On Windows you will instead use the `.ps1` scripts (no chmod needed).
 
-## 6. Run Lint / Basic Checks (Add Your Own)
+## 6. Scaffold a Built-In Integration
 
-Currently no enforced lint config is bundled, but you can quickly sanity check importability:
+Use the integration scaffold command to create the initial Python package and
+test skeleton for a new built-in integration:
+
+```bash
+specify integration scaffold my-agent --type markdown
+specify integration scaffold my-agent --type toml
+specify integration scaffold my-agent --type yaml
+specify integration scaffold my-agent --type skills
+```
+
+Hyphenated keys are converted to Python-safe package names, for example
+`my-agent` creates `src/specify_cli/integrations/my_agent/` and
+`tests/integrations/test_integration_my_agent.py`.
+
+The scaffold does not register the integration automatically. Review the
+generated metadata, then add the import and `_register()` call in
+`src/specify_cli/integrations/__init__.py`.
+
+## 7. Run Lint / Basic Checks
+
+CI enforces `ruff check src/` (see `.github/workflows/test.yml`), so run it locally before pushing:
+
+```bash
+uvx ruff check src/
+```
+
+You can also quickly sanity check importability:
 
 ```bash
 python -c "import specify_cli; print('Import OK')"
 ```
 
-## 7. Build a Wheel Locally (Optional)
+## 8. Build a Wheel Locally (Optional)
 
 Validate packaging before publishing:
 
@@ -117,7 +143,7 @@ ls dist/
 
 Install the built artifact into a fresh throwaway environment if needed.
 
-## 8. Using a Temporary Workspace
+## 9. Using a Temporary Workspace
 
 When testing `init --here` in a dirty directory, create a temp workspace:
 
@@ -128,7 +154,7 @@ python -m src.specify_cli init --here --integration claude --ignore-agent-tools
 
 Or copy only the modified CLI portion if you want a lighter sandbox.
 
-## 9. Debug Network / TLS Issues
+## 10. Debug Network / TLS Issues
 
 > **Deprecated:** The `--skip-tls` flag is a no-op and has no effect.
 > It was previously used to bypass TLS validation during local testing.
@@ -137,7 +163,7 @@ Or copy only the modified CLI portion if you want a lighter sandbox.
 >
 > For example, set `SSL_CERT_FILE` or configure `HTTPS_PROXY` / `HTTP_PROXY`.
 
-## 10. Rapid Edit Loop Summary
+## 11. Rapid Edit Loop Summary
 
 | Action | Command |
 |--------|---------|
@@ -148,7 +174,7 @@ Or copy only the modified CLI portion if you want a lighter sandbox.
 | Git branch uvx | `uvx --from git+URL@branch specify ...` |
 | Build wheel | `uv build` |
 
-## 11. Cleaning Up
+## 12. Cleaning Up
 
 Remove build artifacts / virtual env quickly:
 
@@ -156,7 +182,7 @@ Remove build artifacts / virtual env quickly:
 rm -rf .venv dist build *.egg-info
 ```
 
-## 12. Common Issues
+## 13. Common Issues
 
 | Symptom | Fix |
 |---------|-----|
@@ -166,7 +192,7 @@ rm -rf .venv dist build *.egg-info
 | Wrong script type downloaded | Pass `--script sh` or `--script ps` explicitly |
 | TLS errors on corporate network | Configure your environment's certificate store or proxy. The `--skip-tls` flag is deprecated and has no effect. |
 
-## 13. Next Steps
+## 14. Next Steps
 
 - Update docs and run through Quick Start using your modified CLI
 - Open a PR when satisfied

docs/quickstart.md

@@ -127,7 +127,7 @@ Initialize the project's constitution to set ground rules:
 ### Step 2: Define Requirements with `/speckit.specify`
 
 ```text
-Develop Taskify, a team productivity platform. It should allow users to create projects, add team members,
+/speckit.specify Develop Taskify, a team productivity platform. It should allow users to create projects, add team members,
 assign tasks, comment and move tasks between boards in Kanban style. In this initial phase for this feature,
 let's call it "Create Taskify," let's have multiple users but the users will be declared ahead of time, predefined.
 I want five users in two different categories, one product manager and four engineers. Let's create three

docs/reference/integrations.md

@@ -38,6 +38,7 @@ The Specify CLI supports a wide range of AI coding agents. When you run `specify
 | [Tabnine CLI](https://docs.tabnine.com/main/getting-started/tabnine-cli)             | `tabnine`        |                                                                                                                                           |
 | [Trae](https://www.trae.ai/)                                                         | `trae`           | Skills-based integration; skills are installed automatically                                                                               |
 | [Windsurf](https://windsurf.com/)                                                    | `windsurf`       |                                                                                                                                           |
+| [Zed](https://zed.dev/)                                                              | `zed`            | Skills-based integration; installs skills into `.agents/skills` and invokes them as `/speckit-<command>`                                  |
 | Generic                                                                              | `generic`        | Bring your own agent — use `--integration generic --integration-options="--commands-dir <path>"` for AI coding agents not listed above     |
 
 ## List Available Integrations

docs/toc.yml

@@ -43,12 +43,16 @@
       href: concepts/sdd.md
     - name: Spec Persistence Models
       href: concepts/spec-persistence.md
+    - name: Handling Complex Features
+      href: concepts/complex-features.md
 
 # Development workflows
 - name: Development
   items:
     - name: Local Development
       href: local-development.md
+    - name: Evolving Specs
+      href: guides/evolving-specs.md
 
 # Community
 - name: Community

extensions/template/extension.yml

@@ -13,6 +13,14 @@ extension:
   # CUSTOMIZE: Brief description (under 200 characters)
   description: "Brief description of what your extension does"
 
+  # CUSTOMIZE: Extension category — describes what the extension operates on
+  # Common values: docs, code, process, integration, visibility
+  # category: "process"
+
+  # CUSTOMIZE: Extension effect — whether it modifies project files
+  # One of: read-only | read-write
+  # effect: "read-write"
+
   # CUSTOMIZE: Your name or organization name
   author: "Your Name"
 

presets/catalog.community.json

@@ -1,16 +1,16 @@
 {
   "schema_version": "1.0",
-  "updated_at": "2026-06-05T00:00:00Z",
+  "updated_at": "2026-06-16T00:00:00Z",
   "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/presets/catalog.community.json",
   "presets": {
     "a11y-governance": {
       "name": "A11Y Governance",
       "id": "a11y-governance",
-      "version": "0.3.0",
-      "description": "Adds accessibility, bilingual DE/EN delivery, CEFR-B2 readability, inclusive-content governance, and didactic inline-code-comment review to Spec Kit.",
+      "version": "0.4.0",
+      "description": "Adds accessibility (WCAG 2.2 AA), bilingual DE/EN delivery, CEFR-B2 readability, inclusive-content governance, didactic inline-code-comment review, and audit-ready Spec Kit run evidence.",
       "author": "Thorsten Hindermann",
       "repository": "https://github.com/hindermath/spec-kit-preset-a11y-governance",
-      "download_url": "https://github.com/hindermath/spec-kit-preset-a11y-governance/archive/refs/tags/v0.3.0.zip",
+      "download_url": "https://github.com/hindermath/spec-kit-preset-a11y-governance/archive/refs/tags/v0.4.0.zip",
       "homepage": "https://github.com/hindermath/spec-kit-preset-a11y-governance",
       "documentation": "https://github.com/hindermath/spec-kit-preset-a11y-governance/blob/main/README.md",
       "license": "MIT",
@@ -26,19 +26,23 @@
         "accessibility",
         "bilingual",
         "wcag",
-        "inclusion"
+        "wcag-2-2",
+        "cefr-b2",
+        "inclusion",
+        "include-everyone",
+        "didactic-comments"
       ],
       "created_at": "2026-04-27T00:00:00Z",
-      "updated_at": "2026-06-05T00:00:00Z"
+      "updated_at": "2026-06-14T00:00:00Z"
     },
     "agent-parity-governance": {
       "name": "Agent Parity Governance",
       "id": "agent-parity-governance",
-      "version": "0.2.0",
-      "description": "Keeps shared AI-agent guidance aligned and adds agent-neutral Spec Kit model-routing guidance across declared agent instruction surfaces.",
+      "version": "0.3.0",
+      "description": "Adds shared-guidance parity, audit-ready Spec-Kit run evidence, and agent-neutral model-routing guidance across a project's declared AI-agent instruction surfaces so agent guidance does not drift.",
       "author": "Thorsten Hindermann",
       "repository": "https://github.com/hindermath/spec-kit-preset-agent-parity-governance",
-      "download_url": "https://github.com/hindermath/spec-kit-preset-agent-parity-governance/archive/refs/tags/v0.2.0.zip",
+      "download_url": "https://github.com/hindermath/spec-kit-preset-agent-parity-governance/archive/refs/tags/v0.3.0.zip",
       "homepage": "https://github.com/hindermath/spec-kit-preset-agent-parity-governance",
       "documentation": "https://github.com/hindermath/spec-kit-preset-agent-parity-governance/blob/main/README.md",
       "license": "MIT",
@@ -46,7 +50,7 @@
         "speckit_version": ">=0.8.0"
       },
       "provides": {
-        "templates": 9,
+        "templates": 6,
         "commands": 3
       },
       "tags": [
@@ -59,7 +63,7 @@
         "multi-agent"
       ],
       "created_at": "2026-04-27T00:00:00Z",
-      "updated_at": "2026-05-31T00:00:00Z"
+      "updated_at": "2026-06-14T00:00:00Z"
     },
     "aide-in-place": {
       "name": "AIDE In-Place Migration",
@@ -92,11 +96,11 @@
     "architecture-governance": {
       "name": "Architecture Governance",
       "id": "architecture-governance",
-      "version": "0.2.0",
-      "description": "Adds secure architecture governance, threat modeling, STRIDE/CAPEC, Zero Trust, S-ADRs, and OWASP SAMM to Spec Kit.",
+      "version": "0.5.0",
+      "description": "Adds secure software architecture, STRIDE+CAPEC threat modeling, arc42 security cross-cutting concepts, S-ADRs, Zero Trust applicability, OWASP SAMM governance, BSI C3A cloud autonomy, BSI C5 cloud compliance assurance, and audit-ready Spec Kit run evidence.",
       "author": "Thorsten Hindermann",
       "repository": "https://github.com/hindermath/spec-kit-preset-architecture-governance",
-      "download_url": "https://github.com/hindermath/spec-kit-preset-architecture-governance/archive/refs/tags/v0.2.0.zip",
+      "download_url": "https://github.com/hindermath/spec-kit-preset-architecture-governance/archive/refs/tags/v0.5.0.zip",
       "homepage": "https://github.com/hindermath/spec-kit-preset-architecture-governance",
       "documentation": "https://github.com/hindermath/spec-kit-preset-architecture-governance/blob/main/README.md",
       "license": "MIT",
@@ -104,7 +108,7 @@
         "speckit_version": ">=0.8.0"
       },
       "provides": {
-        "templates": 11,
+        "templates": 13,
         "commands": 3
       },
       "tags": [
@@ -112,10 +116,20 @@
         "governance",
         "threat-modeling",
         "stride",
-        "zero-trust"
+        "capec",
+        "arc42",
+        "adr",
+        "zero-trust",
+        "samm",
+        "isaqb",
+        "cloud",
+        "sovereignty",
+        "c3a",
+        "c5",
+        "assurance"
       ],
       "created_at": "2026-04-27T00:00:00Z",
-      "updated_at": "2026-04-27T00:00:00Z"
+      "updated_at": "2026-06-14T00:00:00Z"
     },
     "canon-core": {
       "name": "Canon Core",
@@ -168,14 +182,42 @@
       "created_at": "2026-04-13T00:00:00Z",
       "updated_at": "2026-04-13T00:00:00Z"
     },
+    "command-density": {
+      "name": "Command Density",
+      "id": "command-density",
+      "version": "1.0.0",
+      "description": "Compacts the nine core Spec Kit command prompts while preserving scripts, handoffs, placeholders, hook output blocks, and rule structure.",
+      "author": "Maksim Kudriavtsev",
+      "repository": "https://github.com/Xopoko/spec-kit-preset-command-density",
+      "download_url": "https://github.com/Xopoko/spec-kit-preset-command-density/archive/refs/tags/v1.0.0.zip",
+      "homepage": "https://github.com/Xopoko/spec-kit-preset-command-density",
+      "documentation": "https://github.com/Xopoko/spec-kit-preset-command-density/blob/main/README.md",
+      "license": "MIT",
+      "requires": {
+        "speckit_version": ">=0.10.3"
+      },
+      "provides": {
+        "templates": 0,
+        "commands": 9
+      },
+      "tags": [
+        "commands",
+        "tokens",
+        "compact",
+        "workflow",
+        "prompt-density"
+      ],
+      "created_at": "2026-06-16T00:00:00Z",
+      "updated_at": "2026-06-16T00:00:00Z"
+    },
     "cross-platform-governance": {
       "name": "Cross-Platform Governance",
       "id": "cross-platform-governance",
-      "version": "0.1.0",
-      "description": "Adds Bash and PowerShell parity, dry-run/WhatIf parity, man-page expectations, and Verb-Noun Cmdlet discipline.",
+      "version": "0.2.0",
+      "description": "Adds Bash + PowerShell parity, Unix man-pages, bilingual comment-based help, Verb-Noun Cmdlet discipline, and audit-ready Spec Kit run evidence for scripting projects managed with Spec Kit.",
       "author": "Thorsten Hindermann",
       "repository": "https://github.com/hindermath/spec-kit-preset-cross-platform-governance",
-      "download_url": "https://github.com/hindermath/spec-kit-preset-cross-platform-governance/archive/refs/tags/v0.1.0.zip",
+      "download_url": "https://github.com/hindermath/spec-kit-preset-cross-platform-governance/archive/refs/tags/v0.2.0.zip",
       "homepage": "https://github.com/hindermath/spec-kit-preset-cross-platform-governance",
       "documentation": "https://github.com/hindermath/spec-kit-preset-cross-platform-governance/blob/main/README.md",
       "license": "MIT",
@@ -188,13 +230,18 @@
       },
       "tags": [
         "cross-platform",
+        "governance",
         "bash",
         "powershell",
         "man-page",
-        "cmdlet"
+        "cmdlet",
+        "verb-noun",
+        "windows",
+        "macos",
+        "linux"
       ],
       "created_at": "2026-04-27T00:00:00Z",
-      "updated_at": "2026-04-27T00:00:00Z"
+      "updated_at": "2026-06-14T00:00:00Z"
     },
     "explicit-task-dependencies": {
       "name": "Explicit Task Dependencies",
@@ -298,11 +345,11 @@
     "isaqb-architecture-governance": {
       "name": "iSAQB Architecture Governance",
       "id": "isaqb-architecture-governance",
-      "version": "0.1.0",
-      "description": "Adds general iSAQB/CPSA-F and arc42 architecture governance, including views, quality scenarios, ADRs, risks, and technical debt.",
+      "version": "0.2.0",
+      "description": "Adds general iSAQB/CPSA-F and arc42 software-architecture governance, including audit-ready Spec Kit run evidence for architecture goals, views, quality scenarios, ADRs, risks, and technical debt.",
       "author": "Thorsten Hindermann",
       "repository": "https://github.com/hindermath/spec-kit-preset-isaqb-architecture-governance",
-      "download_url": "https://github.com/hindermath/spec-kit-preset-isaqb-architecture-governance/archive/refs/tags/v0.1.0.zip",
+      "download_url": "https://github.com/hindermath/spec-kit-preset-isaqb-architecture-governance/archive/refs/tags/v0.2.0.zip",
       "homepage": "https://github.com/hindermath/spec-kit-preset-isaqb-architecture-governance",
       "documentation": "https://github.com/hindermath/spec-kit-preset-isaqb-architecture-governance/blob/main/README.md",
       "license": "MIT",
@@ -317,11 +364,15 @@
         "architecture",
         "governance",
         "isaqb",
+        "cpsa-f",
         "arc42",
-        "adr"
+        "adr",
+        "quality-attributes",
+        "architecture-views",
+        "technical-debt"
       ],
       "created_at": "2026-04-27T00:00:00Z",
-      "updated_at": "2026-04-27T00:00:00Z"
+      "updated_at": "2026-06-14T00:00:00Z"
     },
     "jira": {
       "name": "Jira Issue Tracking",
@@ -474,11 +525,11 @@
     "security-governance": {
       "name": "Security Governance",
       "id": "security-governance",
-      "version": "0.4.0",
-      "description": "Adds memory-safe-language preference, language-specific secure coding profiles, ASVS verification, SBOM/AI-SBOM supply-chain transparency, and EU Cyber Resilience Act awareness.",
+      "version": "0.6.0",
+      "description": "Adds memory-safe-language preference, language-specific secure coding profiles, audit-ready Spec-Kit run evidence, ASVS verification, SBOM/AI-SBOM supply-chain transparency, CRA awareness, and regulatory applicability screening for NIS2, CRA, EU AI Act, and DORA to Spec Kit.",
       "author": "Thorsten Hindermann",
       "repository": "https://github.com/hindermath/spec-kit-preset-security-governance",
-      "download_url": "https://github.com/hindermath/spec-kit-preset-security-governance/archive/refs/tags/v0.4.0.zip",
+      "download_url": "https://github.com/hindermath/spec-kit-preset-security-governance/archive/refs/tags/v0.6.0.zip",
       "homepage": "https://github.com/hindermath/spec-kit-preset-security-governance",
       "documentation": "https://github.com/hindermath/spec-kit-preset-security-governance/blob/main/README.md",
       "license": "MIT",
@@ -486,7 +537,7 @@
         "speckit_version": ">=0.8.0"
       },
       "provides": {
-        "templates": 12,
+        "templates": 14,
         "commands": 3
       },
       "tags": [
@@ -511,10 +562,15 @@
         "typescript",
         "g7",
         "bsi",
-        "cra"
+        "cra",
+        "cyber-resilience-act",
+        "nis2",
+        "ai-act",
+        "dora",
+        "regulatory"
       ],
       "created_at": "2026-04-27T00:00:00Z",
-      "updated_at": "2026-05-26T00:00:00Z"
+      "updated_at": "2026-06-14T00:00:00Z"
     },
     "spec2cloud": {
       "name": "Spec2Cloud",

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "specify-cli"
-version = "0.10.1.dev0"
+version = "0.11.1.dev0"
 description = "Specify CLI, part of GitHub Spec Kit. A tool to bootstrap your projects for Spec-Driven Development (SDD)."
 requires-python = ">=3.11"
 dependencies = [

src/specify_cli/_console.py

@@ -7,6 +7,7 @@ layer, not out of it, to avoid circular imports.
 """
 from __future__ import annotations
 
+import sys
 from collections.abc import Callable
 
 import readchar
@@ -192,7 +193,8 @@ def select_with_arrows(
 
     def run_selection_loop():
         nonlocal selected_key, selected_index
-        with Live(create_selection_panel(), console=console, transient=True, auto_refresh=False) as live:
+        _transient = sys.platform != "win32"
+        with Live(create_selection_panel(), console=console, transient=_transient, auto_refresh=False) as live:
             while True:
                 try:
                     key = get_key()

src/specify_cli/_invocation_style.py

@@ -0,0 +1,45 @@
+"""Agent invocation-style constants and helpers.
+
+Agents that scaffold skills (``speckit-<name>/SKILL.md``) use different
+slash-command invocation formats depending on the agent.  This module
+centralises the mapping so that ``HookExecutor._render_hook_invocation``
+and ``specify init``'s next-steps output stay consistent.
+"""
+
+from __future__ import annotations
+
+# Agents that always render /speckit-<name>, regardless of ai_skills.
+ALWAYS_SLASH_AGENTS: frozenset[str] = frozenset({"devin", "trae", "zed"})
+
+# Agents that render /speckit-<name> only when ai_skills is enabled.
+CONDITIONAL_SLASH_AGENTS: frozenset[str] = frozenset(
+    {
+        "agy",
+        "claude",
+        "copilot",
+        "cursor-agent",
+        "hermes",
+        "lingma",
+        "rovodev",
+        "vibe",
+    }
+)
+
+
+def is_slash_skills_agent(selected_ai: str | None, ai_skills_enabled: bool) -> bool:
+    """Return ``True`` if *selected_ai* uses ``/speckit-<name>`` invocations.
+
+    The decision is based on the agent sets defined in this module:
+
+    *   Agents in `ALWAYS_SLASH_AGENTS` always use slash invocations.
+    *   Agents in `CONDITIONAL_SLASH_AGENTS` only use them when
+        *ai_skills_enabled* is ``True``.
+    *   All other agents return ``False``.
+    """
+    if selected_ai is None:
+        return False
+    if not isinstance(selected_ai, str):
+        return False
+    return selected_ai in ALWAYS_SLASH_AGENTS or (
+        selected_ai in CONDITIONAL_SLASH_AGENTS and ai_skills_enabled
+    )

src/specify_cli/_utils.py

@@ -8,6 +8,7 @@ import shutil
 import stat
 import subprocess
 import tempfile
+import yaml
 from pathlib import Path
 from typing import Any
 from ._console import console
@@ -16,6 +17,16 @@ CLAUDE_LOCAL_PATH = Path.home() / ".claude" / "local" / "claude"
 CLAUDE_NPM_LOCAL_PATH = Path.home() / ".claude" / "local" / "node_modules" / ".bin" / "claude"
 
 
+def dump_frontmatter(data: dict[str, Any]) -> str:
+    """Serialize skill/command frontmatter to a YAML string.
+
+    Centralizes the dump options used for SKILL.md frontmatter: ``allow_unicode``
+    preserves Unicode descriptions and ``sort_keys=False`` keeps key order, so no
+    call site can silently drop either.
+    """
+    return yaml.safe_dump(data, sort_keys=False, allow_unicode=True).strip()
+
+
 def run_command(cmd: list[str], check_return: bool = True, capture: bool = False, shell: bool = False) -> str | None:
     """Run a shell command and optionally capture output."""
     try:

src/specify_cli/authentication/http.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 import urllib.error
 import urllib.request
 from fnmatch import fnmatch
+from typing import Callable
 from urllib.parse import urlparse
 
 from . import get_provider
@@ -56,22 +57,36 @@ def _hostname_in_hosts(hostname: str, hosts: tuple[str, ...]) -> bool:
     return any(p == hostname or fnmatch(hostname, p) for p in hosts)
 
 
-class _StripAuthOnRedirect(urllib.request.HTTPRedirectHandler):
-    """Drop ``Authorization`` when a redirect leaves the entry's declared hosts."""
+RedirectValidator = Callable[[str, str], None]
 
-    def __init__(self, hosts: tuple[str, ...]) -> None:
+
+class _StripAuthOnRedirect(urllib.request.HTTPRedirectHandler):
+    """Drop ``Authorization`` when a redirect leaves trusted hosts or downgrades."""
+
+    def __init__(
+        self,
+        hosts: tuple[str, ...],
+        redirect_validator: RedirectValidator | None = None,
+    ) -> None:
         super().__init__()
         self._hosts = hosts
+        self._redirect_validator = redirect_validator
 
     def redirect_request(self, req, fp, code, msg, headers, newurl):
+        if self._redirect_validator is not None:
+            self._redirect_validator(req.full_url, newurl)
+
         original_auth = (
             req.get_header("Authorization")
             or req.unredirected_hdrs.get("Authorization")
         )
         new_req = super().redirect_request(req, fp, code, msg, headers, newurl)
         if new_req is not None:
-            hostname = (urlparse(newurl).hostname or "").lower()
-            if _hostname_in_hosts(hostname, self._hosts):
+            old_scheme = urlparse(req.full_url).scheme
+            new_parsed = urlparse(newurl)
+            hostname = (new_parsed.hostname or "").lower()
+            is_https_downgrade = old_scheme == "https" and new_parsed.scheme != "https"
+            if _hostname_in_hosts(hostname, self._hosts) and not is_https_downgrade:
                 if original_auth:
                     new_req.add_unredirected_header("Authorization", original_auth)
             else:
@@ -103,7 +118,12 @@ def build_request(url: str, extra_headers: dict[str, str] | None = None) -> urll
     return urllib.request.Request(url, headers=headers)
 
 
-def open_url(url: str, timeout: int = 10, extra_headers: dict[str, str] | None = None):
+def open_url(
+    url: str,
+    timeout: int = 10,
+    extra_headers: dict[str, str] | None = None,
+    redirect_validator: RedirectValidator | None = None,
+):
     """Open *url* with config-driven auth, redirect stripping, and fallthrough.
 
     1. Find ``auth.json`` entries whose hosts match the URL.
@@ -113,6 +133,8 @@ def open_url(url: str, timeout: int = 10, extra_headers: dict[str, str] | None =
     5. Non-auth errors (404, 500, network) raise immediately.
 
     *extra_headers* (e.g. ``Accept``) are merged into every attempt.
+    *redirect_validator*, when provided, is called with ``(old_url, new_url)``
+    before following each redirect and may raise to reject the redirect.
     """
     entries = find_entries_for_url(url, _load_config())
 
@@ -135,7 +157,7 @@ def open_url(url: str, timeout: int = 10, extra_headers: dict[str, str] | None =
             continue
 
         req = _make_req(provider.auth_headers(token, entry.auth))
-        opener = urllib.request.build_opener(_StripAuthOnRedirect(entry.hosts))
+        opener = urllib.request.build_opener(_StripAuthOnRedirect(entry.hosts, redirect_validator))
         try:
             return opener.open(req, timeout=timeout)
         except urllib.error.HTTPError as exc:
@@ -146,4 +168,7 @@ def open_url(url: str, timeout: int = 10, extra_headers: dict[str, str] | None =
 
     # No entry worked (or none matched) — unauthenticated fallback
     req = _make_req({})
+    if redirect_validator is not None:
+        opener = urllib.request.build_opener(_StripAuthOnRedirect((), redirect_validator))
+        return opener.open(req, timeout=timeout)
     return urllib.request.urlopen(req, timeout=timeout)  # noqa: S310

src/specify_cli/commands/init.py

@@ -1,4 +1,5 @@
 """specify init command."""
+
 from __future__ import annotations
 
 import os
@@ -35,7 +36,9 @@ def ensure_constitution_from_template(
 ) -> None:
     """Copy constitution template to memory if it doesn't exist."""
     memory_constitution = project_path / ".specify" / "memory" / "constitution.md"
-    template_constitution = project_path / ".specify" / "templates" / "constitution-template.md"
+    template_constitution = (
+        project_path / ".specify" / "templates" / "constitution-template.md"
+    )
 
     if memory_constitution.exists():
         if tracker:
@@ -62,24 +65,75 @@ def ensure_constitution_from_template(
             tracker.add("constitution", "Constitution setup")
             tracker.error("constitution", str(e))
         else:
-            console.print(f"[yellow]Warning: Could not initialize constitution: {e}[/yellow]")
+            console.print(
+                f"[yellow]Warning: Could not initialize constitution: {e}[/yellow]"
+            )
 
 
 def register(app: typer.Typer) -> None:
     @app.command()
     def init(
-        project_name: str = typer.Argument(None, help="Name for your new project directory (optional if using --here, or use '.' for current directory)"),
-        script_type: str = typer.Option(None, "--script", help="Script type to use: sh or ps"),
-        ignore_agent_tools: bool = typer.Option(False, "--ignore-agent-tools", help="Skip checks for coding agent tools like Claude Code"),
-        here: bool = typer.Option(False, "--here", help="Initialize project in the current directory instead of creating a new one"),
-        force: bool = typer.Option(False, "--force", help="Force merge/overwrite when using --here (skip confirmation)"),
-        skip_tls: bool = typer.Option(False, "--skip-tls", help="Deprecated (no-op). Previously: skip SSL/TLS verification.", hidden=True),
-        debug: bool = typer.Option(False, "--debug", help="Deprecated. Previously: show verbose diagnostic output; currently only prints additional diagnostic details on failure.", hidden=True),
-        github_token: str = typer.Option(None, "--github-token", help="Deprecated (no-op). Previously: GitHub token for API requests.", hidden=True),
-        offline: bool = typer.Option(False, "--offline", help="Deprecated (no-op). All scaffolding now uses bundled assets.", hidden=True),
-        preset: str = typer.Option(None, "--preset", help="Install a preset during initialization (by preset ID)"),
-        integration: str = typer.Option(None, "--integration", help="AI coding agent integration to use (e.g. --integration copilot). See 'specify check' for available integrations."),
-        integration_options: str = typer.Option(None, "--integration-options", help='Options for the integration (e.g. --integration-options="--commands-dir .myagent/cmds")'),
+        project_name: str = typer.Argument(
+            None,
+            help="Name for your new project directory (optional if using --here, or use '.' for current directory)",
+        ),
+        script_type: str = typer.Option(
+            None, "--script", help="Script type to use: sh or ps"
+        ),
+        ignore_agent_tools: bool = typer.Option(
+            False,
+            "--ignore-agent-tools",
+            help="Skip checks for coding agent tools like Claude Code",
+        ),
+        here: bool = typer.Option(
+            False,
+            "--here",
+            help="Initialize project in the current directory instead of creating a new one",
+        ),
+        force: bool = typer.Option(
+            False,
+            "--force",
+            help="Force merge/overwrite when using --here (skip confirmation)",
+        ),
+        skip_tls: bool = typer.Option(
+            False,
+            "--skip-tls",
+            help="Deprecated (no-op). Previously: skip SSL/TLS verification.",
+            hidden=True,
+        ),
+        debug: bool = typer.Option(
+            False,
+            "--debug",
+            help="Deprecated. Previously: show verbose diagnostic output; currently only prints additional diagnostic details on failure.",
+            hidden=True,
+        ),
+        github_token: str = typer.Option(
+            None,
+            "--github-token",
+            help="Deprecated (no-op). Previously: GitHub token for API requests.",
+            hidden=True,
+        ),
+        offline: bool = typer.Option(
+            False,
+            "--offline",
+            help="Deprecated (no-op). All scaffolding now uses bundled assets.",
+            hidden=True,
+        ),
+        preset: str = typer.Option(
+            None,
+            "--preset",
+            help="Install a preset during initialization (by preset ID)",
+        ),
+        integration: str = typer.Option(
+            None,
+            "--integration",
+            help="AI coding agent integration to use (e.g. --integration copilot). See 'specify check' for available integrations.",
+        ),
+        integration_options: str = typer.Option(
+            None,
+            "--integration-options",
+            help='Options for the integration (e.g. --integration-options="--commands-dir .myagent/cmds")',
+        ),
     ):
         """
         Initialize a new Specify project.
@@ -121,15 +175,18 @@ def register(app: typer.Typer) -> None:
             ensure_executable_scripts,
             save_init_options,
         )
+        from ..integration_runtime import (
+            with_integration_setting as _with_integration_setting,
+        )
         from ..integrations._commands import (
             _parse_integration_options,
             _write_integration_json,
         )
-        from ..integration_runtime import with_integration_setting as _with_integration_setting
 
         show_banner()
 
         from ..integrations import INTEGRATION_REGISTRY, get_integration
+
         if integration:
             resolved_integration = get_integration(integration)
             if not resolved_integration:
@@ -143,15 +200,17 @@ def register(app: typer.Typer) -> None:
             project_name = None
 
         if here and project_name:
-            console.print("[red]Error:[/red] Cannot specify both project name and --here flag")
+            console.print(
+                "[red]Error:[/red] Cannot specify both project name and --here flag"
+            )
             raise typer.Exit(1)
 
         if not here and not project_name:
-            console.print("[red]Error:[/red] Must specify either a project name, use '.' for current directory, or use --here flag")
+            console.print(
+                "[red]Error:[/red] Must specify either a project name, use '.' for current directory, or use --here flag"
+            )
             raise typer.Exit(1)
 
-
-
         dir_existed_before = False
         if here:
             project_name = Path.cwd().name
@@ -160,10 +219,16 @@ def register(app: typer.Typer) -> None:
 
             existing_items = list(project_path.iterdir())
             if existing_items:
-                console.print(f"[yellow]Warning:[/yellow] Current directory is not empty ({len(existing_items)} items)")
-                console.print("[yellow]Template files will be merged with existing content and may overwrite existing files[/yellow]")
+                console.print(
+                    f"[yellow]Warning:[/yellow] Current directory is not empty ({len(existing_items)} items)"
+                )
+                console.print(
+                    "[yellow]Template files will be merged with existing content and may overwrite existing files[/yellow]"
+                )
                 if force:
-                    console.print("[cyan]--force supplied: skipping confirmation and proceeding with merge[/cyan]")
+                    console.print(
+                        "[cyan]--force supplied: skipping confirmation and proceeding with merge[/cyan]"
+                    )
                 else:
                     response = typer.confirm("Do you want to continue?")
                     if not response:
@@ -174,14 +239,22 @@ def register(app: typer.Typer) -> None:
             dir_existed_before = project_path.exists()
             if project_path.exists():
                 if not project_path.is_dir():
-                    console.print(f"[red]Error:[/red] '{project_name}' exists but is not a directory.")
+                    console.print(
+                        f"[red]Error:[/red] '{project_name}' exists but is not a directory."
+                    )
                     raise typer.Exit(1)
                 existing_items = list(project_path.iterdir())
                 if force:
                     if existing_items:
-                        console.print(f"[yellow]Warning:[/yellow] Directory '{project_name}' is not empty ({len(existing_items)} items)")
-                        console.print("[yellow]Template files will be merged with existing content and may overwrite existing files[/yellow]")
-                    console.print(f"[cyan]--force supplied: merging into existing directory '[cyan]{project_name}[/cyan]'[/cyan]")
+                        console.print(
+                            f"[yellow]Warning:[/yellow] Directory '{project_name}' is not empty ({len(existing_items)} items)"
+                        )
+                        console.print(
+                            "[yellow]Template files will be merged with existing content and may overwrite existing files[/yellow]"
+                        )
+                    console.print(
+                        f"[cyan]--force supplied: merging into existing directory '[cyan]{project_name}[/cyan]'[/cyan]"
+                    )
                 else:
                     error_panel = Panel(
                         f"Directory already exists: '[cyan]{project_name}[/cyan]'\n"
@@ -189,7 +262,7 @@ def register(app: typer.Typer) -> None:
                         "Use [bold]--force[/bold] to merge into the existing directory.",
                         title="[red]Directory Conflict[/red]",
                         border_style="red",
-                        padding=(1, 2)
+                        padding=(1, 2),
                     )
                     console.print()
                     console.print(error_panel)
@@ -197,7 +270,9 @@ def register(app: typer.Typer) -> None:
 
         if integration:
             if integration not in AGENT_CONFIG:
-                console.print(f"[red]Error:[/red] Invalid integration '{integration}'. Choose from: {', '.join(AGENT_CONFIG.keys())}")
+                console.print(
+                    f"[red]Error:[/red] Invalid integration '{integration}'. Choose from: {', '.join(AGENT_CONFIG.keys())}"
+                )
                 raise typer.Exit(1)
             selected_ai = integration
         elif not _stdin_is_interactive():
@@ -221,8 +296,12 @@ def register(app: typer.Typer) -> None:
                 raise typer.Exit(1)
 
         if selected_ai == "generic" and not integration_options:
-            console.print("[red]Error:[/red] --integration generic requires --integration-options with --commands-dir")
-            console.print('[dim]Example: specify init my-project --integration generic --integration-options="--commands-dir .myagent/commands/"[/dim]')
+            console.print(
+                "[red]Error:[/red] --integration generic requires --integration-options with --commands-dir"
+            )
+            console.print(
+                '[dim]Example: specify init my-project --integration generic --integration-options="--commands-dir .myagent/commands/"[/dim]'
+            )
             raise typer.Exit(1)
 
         current_dir = Path.cwd()
@@ -237,7 +316,9 @@ def register(app: typer.Typer) -> None:
         if not here:
             setup_lines.append(f"{'Target Path':<15} [dim]{project_path}[/dim]")
 
-        console.print(Panel("\n".join(setup_lines), border_style="cyan", padding=(1, 2)))
+        console.print(
+            Panel("\n".join(setup_lines), border_style="cyan", padding=(1, 2))
+        )
 
         if not ignore_agent_tools:
             agent_config = AGENT_CONFIG.get(selected_ai)
@@ -251,7 +332,7 @@ def register(app: typer.Typer) -> None:
                         "Tip: Use [cyan]--ignore-agent-tools[/cyan] to skip this check",
                         title="[red]Agent Detection Error[/red]",
                         border_style="red",
-                        padding=(1, 2)
+                        padding=(1, 2),
                     )
                     console.print()
                     console.print(error_panel)
@@ -259,14 +340,20 @@ def register(app: typer.Typer) -> None:
 
         if script_type:
             if script_type not in SCRIPT_TYPE_CHOICES:
-                console.print(f"[red]Error:[/red] Invalid script type '{script_type}'. Choose from: {', '.join(SCRIPT_TYPE_CHOICES.keys())}")
+                console.print(
+                    f"[red]Error:[/red] Invalid script type '{script_type}'. Choose from: {', '.join(SCRIPT_TYPE_CHOICES.keys())}"
+                )
                 raise typer.Exit(1)
             selected_script = script_type
         else:
             default_script = "ps" if os.name == "nt" else "sh"
 
             if _stdin_is_interactive():
-                selected_script = select_with_arrows(SCRIPT_TYPE_CHOICES, "Choose script type (or press Enter)", default_script)
+                selected_script = select_with_arrows(
+                    SCRIPT_TYPE_CHOICES,
+                    "Choose script type (or press Enter)",
+                    default_script,
+                )
             else:
                 selected_script = default_script
 
@@ -294,23 +381,35 @@ def register(app: typer.Typer) -> None:
         ]:
             tracker.add(key, label)
 
-        with Live(tracker.render(), console=console, refresh_per_second=8, transient=True) as live:
+        # Disable transient mode on Windows: PowerShell 5.1's legacy console
+        # hangs when Rich tries to restore cursor state via VT escape sequences.
+        _transient = sys.platform != "win32"
+
+        with Live(
+            tracker.render(), console=console, refresh_per_second=8, transient=_transient
+        ) as live:
             tracker.attach_refresh(lambda: live.update(tracker.render()))
             try:
                 from ..integrations.manifest import IntegrationManifest
+
                 tracker.start("integration")
                 manifest = IntegrationManifest(
-                    resolved_integration.key, project_path, version=get_speckit_version()
+                    resolved_integration.key,
+                    project_path,
+                    version=get_speckit_version(),
                 )
 
                 integration_parsed_options: dict[str, Any] = {}
                 if integration_options:
-                    extra = _parse_integration_options(resolved_integration, integration_options)
+                    extra = _parse_integration_options(
+                        resolved_integration, integration_options
+                    )
                     if extra:
                         integration_parsed_options.update(extra)
 
                 resolved_integration.setup(
-                    project_path, manifest,
+                    project_path,
+                    manifest,
                     parsed_options=integration_parsed_options or None,
                     script_type=selected_script,
                     raw_options=integration_options,
@@ -332,7 +431,10 @@ def register(app: typer.Typer) -> None:
                     integration_settings,
                 )
 
-                tracker.complete("integration", resolved_integration.config.get("name", resolved_integration.key))
+                tracker.complete(
+                    "integration",
+                    resolved_integration.config.get("name", resolved_integration.key),
+                )
 
                 tracker.start("shared-infra")
                 _install_shared_infra_or_exit(
@@ -340,9 +442,13 @@ def register(app: typer.Typer) -> None:
                     selected_script,
                     tracker=tracker,
                     force=force,
-                    invoke_separator=resolved_integration.effective_invoke_separator(integration_parsed_options),
+                    invoke_separator=resolved_integration.effective_invoke_separator(
+                        integration_parsed_options
+                    ),
+                )
+                tracker.complete(
+                    "shared-infra", f"scripts ({selected_script}) + templates"
                 )
-                tracker.complete("shared-infra", f"scripts ({selected_script}) + templates")
 
                 ensure_constitution_from_template(project_path, tracker=tracker)
 
@@ -351,29 +457,38 @@ def register(app: typer.Typer) -> None:
                     if bundled_wf:
                         from ..workflows.catalog import WorkflowRegistry
                         from ..workflows.engine import WorkflowDefinition
+
                         wf_registry = WorkflowRegistry(project_path)
                         if wf_registry.is_installed("speckit"):
                             tracker.complete("workflow", "already installed")
                         else:
                             import shutil as _shutil
-                            dest_wf = project_path / ".specify" / "workflows" / "speckit"
+
+                            dest_wf = (
+                                project_path / ".specify" / "workflows" / "speckit"
+                            )
                             dest_wf.mkdir(parents=True, exist_ok=True)
                             _shutil.copy2(
                                 bundled_wf / "workflow.yml",
                                 dest_wf / "workflow.yml",
                             )
-                            definition = WorkflowDefinition.from_yaml(dest_wf / "workflow.yml")
-                            wf_registry.add("speckit", {
-                                "name": definition.name,
-                                "version": definition.version,
-                                "description": definition.description,
-                                "source": "bundled",
-                            })
+                            definition = WorkflowDefinition.from_yaml(
+                                dest_wf / "workflow.yml"
+                            )
+                            wf_registry.add(
+                                "speckit",
+                                {
+                                    "name": definition.name,
+                                    "version": definition.version,
+                                    "description": definition.description,
+                                    "source": "bundled",
+                                },
+                            )
                             tracker.complete("workflow", "speckit installed")
                     else:
                         tracker.skip("workflow", "bundled workflow not found")
                 except Exception as wf_err:
-                    sanitized_wf = str(wf_err).replace('\n', ' ').strip()
+                    sanitized_wf = str(wf_err).replace("\n", " ").strip()
                     tracker.error("workflow", f"install failed: {sanitized_wf[:120]}")
 
                 init_opts = {
@@ -385,7 +500,10 @@ def register(app: typer.Typer) -> None:
                     "speckit_version": get_speckit_version(),
                 }
                 from ..integrations.base import SkillsIntegration as _SkillsPersist
-                if isinstance(resolved_integration, _SkillsPersist) or getattr(resolved_integration, "_skills_mode", False):
+
+                if isinstance(resolved_integration, _SkillsPersist) or getattr(
+                    resolved_integration, "_skills_mode", False
+                ):
                     init_opts["ai_skills"] = True
                 save_init_options(project_path, init_opts)
 
@@ -394,6 +512,7 @@ def register(app: typer.Typer) -> None:
                 # registration can read ai_skills + integration key.
                 try:
                     from ..extensions import ExtensionManager as _ExtMgr
+
                     bundled_ac = _locate_bundled_extension("agent-context")
                     if bundled_ac:
                         ac_mgr = _ExtMgr(project_path)
@@ -406,13 +525,14 @@ def register(app: typer.Typer) -> None:
                             tracker.complete("agent-context", "extension installed")
                     else:
                         from ..extensions import REINSTALL_COMMAND as _ac_reinstall
+
                         tracker.error(
                             "agent-context",
                             f"bundled extension not found — installation may be "
                             f"incomplete. Run: {_ac_reinstall}",
                         )
                 except Exception as ac_err:
-                    sanitized_ac = str(ac_err).replace('\n', ' ').strip()
+                    sanitized_ac = str(ac_err).replace("\n", " ").strip()
                     tracker.error(
                         "agent-context",
                         f"extension install failed: {sanitized_ac[:120]}",
@@ -432,24 +552,34 @@ def register(app: typer.Typer) -> None:
 
                 if preset:
                     try:
-                        from ..presets import PresetManager, PresetCatalog, PresetError
+                        from ..presets import PresetCatalog, PresetError, PresetManager
+
                         preset_manager = PresetManager(project_path)
                         speckit_ver = get_speckit_version()
 
                         local_path = Path(preset).resolve()
                         if local_path.is_dir() and (local_path / "preset.yml").exists():
-                            preset_manager.install_from_directory(local_path, speckit_ver)
+                            preset_manager.install_from_directory(
+                                local_path, speckit_ver
+                            )
                         else:
                             bundled_path = _locate_bundled_preset(preset)
                             if bundled_path:
-                                preset_manager.install_from_directory(bundled_path, speckit_ver)
+                                preset_manager.install_from_directory(
+                                    bundled_path, speckit_ver
+                                )
                             else:
                                 preset_catalog = PresetCatalog(project_path)
                                 pack_info = preset_catalog.get_pack_info(preset)
                                 if not pack_info:
-                                    console.print(f"[yellow]Warning:[/yellow] Preset '{preset}' not found in catalog. Skipping.")
-                                elif pack_info.get("bundled") and not pack_info.get("download_url"):
+                                    console.print(
+                                        f"[yellow]Warning:[/yellow] Preset '{preset}' not found in catalog. Skipping."
+                                    )
+                                elif pack_info.get("bundled") and not pack_info.get(
+                                    "download_url"
+                                ):
                                     from ..extensions import REINSTALL_COMMAND
+
                                     console.print(
                                         f"[yellow]Warning:[/yellow] Preset '{preset}' is bundled with spec-kit "
                                         f"but could not be found in the installed package."
@@ -457,12 +587,16 @@ def register(app: typer.Typer) -> None:
                                     console.print(
                                         "This usually means the spec-kit installation is incomplete or corrupted."
                                     )
-                                    console.print(f"Try reinstalling: {REINSTALL_COMMAND}")
+                                    console.print(
+                                        f"Try reinstalling: {REINSTALL_COMMAND}"
+                                    )
                                 else:
                                     zip_path = None
                                     try:
                                         zip_path = preset_catalog.download_pack(preset)
-                                        preset_manager.install_from_zip(zip_path, speckit_ver)
+                                        preset_manager.install_from_zip(
+                                            zip_path, speckit_ver
+                                        )
                                     except PresetError as preset_err:
                                         _print_cli_warning(
                                             "install",
@@ -491,7 +625,13 @@ def register(app: typer.Typer) -> None:
                 raise
             except Exception as e:
                 tracker.error("final", str(e))
-                console.print(Panel(f"Initialization failed: {e}", title="Failure", border_style="red"))
+                console.print(
+                    Panel(
+                        f"Initialization failed: {e}",
+                        title="Failure",
+                        border_style="red",
+                    )
+                )
                 if debug:
                     _env_pairs = [
                         ("Python", sys.version.split()[0]),
@@ -499,87 +639,155 @@ def register(app: typer.Typer) -> None:
                         ("CWD", str(Path.cwd())),
                     ]
                     _label_width = max(len(k) for k, _ in _env_pairs)
-                    env_lines = [f"{k.ljust(_label_width)} → [bright_black]{v}[/bright_black]" for k, v in _env_pairs]
-                    console.print(Panel("\n".join(env_lines), title="Debug Environment", border_style="magenta"))
+                    env_lines = [
+                        f"{k.ljust(_label_width)} → [bright_black]{v}[/bright_black]"
+                        for k, v in _env_pairs
+                    ]
+                    console.print(
+                        Panel(
+                            "\n".join(env_lines),
+                            title="Debug Environment",
+                            border_style="magenta",
+                        )
+                    )
                 if not here and project_path.exists() and not dir_existed_before:
                     shutil.rmtree(project_path)
                 raise typer.Exit(1)
             finally:
                 pass
 
-        console.print(tracker.render())
+        if _transient:
+            console.print(tracker.render())
         console.print("\n[bold green]Project ready.[/bold green]")
 
         agent_config = AGENT_CONFIG.get(selected_ai)
         if agent_config:
-            agent_folder = agent_config["folder"] or integration_parsed_options.get("commands_dir")
+            agent_folder = agent_config["folder"] or integration_parsed_options.get(
+                "commands_dir"
+            )
             if agent_folder:
                 security_notice = Panel(
                     f"Some agents may store credentials, auth tokens, or other identifying and private artifacts in the agent folder within your project.\n"
                     f"Consider adding [cyan]{agent_folder}[/cyan] (or parts of it) to [cyan].gitignore[/cyan] to prevent accidental credential leakage.",
                     title="[yellow]Agent Folder Security[/yellow]",
                     border_style="yellow",
-                    padding=(1, 2)
+                    padding=(1, 2),
                 )
                 console.print()
                 console.print(security_notice)
 
         steps_lines = []
         if not here:
-            steps_lines.append(f"1. Go to the project folder: [cyan]cd {project_name}[/cyan]")
+            steps_lines.append(
+                f"1. Go to the project folder: [cyan]cd {project_name}[/cyan]"
+            )
             step_num = 2
         else:
             steps_lines.append("1. You're already in the project directory!")
             step_num = 2
 
         from ..integrations.base import SkillsIntegration as _SkillsInt
-        _is_skills_integration = isinstance(resolved_integration, _SkillsInt) or getattr(resolved_integration, "_skills_mode", False)
+
+        _is_skills_integration = isinstance(
+            resolved_integration, _SkillsInt
+        ) or getattr(resolved_integration, "_skills_mode", False)
 
         codex_skill_mode = selected_ai == "codex" and _is_skills_integration
         claude_skill_mode = selected_ai == "claude" and _is_skills_integration
         kimi_skill_mode = selected_ai == "kimi"
         agy_skill_mode = selected_ai == "agy" and _is_skills_integration
         trae_skill_mode = selected_ai == "trae"
-        cursor_agent_skill_mode = selected_ai == "cursor-agent" and _is_skills_integration
+        cursor_agent_skill_mode = (
+            selected_ai == "cursor-agent" and _is_skills_integration
+        )
         copilot_skill_mode = selected_ai == "copilot" and _is_skills_integration
         devin_skill_mode = selected_ai == "devin"
+        zed_skill_mode = selected_ai == "zed" and _is_skills_integration
         cline_skill_mode = selected_ai == "cline"
-        native_skill_mode = codex_skill_mode or claude_skill_mode or kimi_skill_mode or agy_skill_mode or trae_skill_mode or cursor_agent_skill_mode or copilot_skill_mode or devin_skill_mode
+        native_skill_mode = (
+            codex_skill_mode
+            or claude_skill_mode
+            or kimi_skill_mode
+            or agy_skill_mode
+            or trae_skill_mode
+            or cursor_agent_skill_mode
+            or copilot_skill_mode
+            or devin_skill_mode
+            or zed_skill_mode
+        )
 
         if codex_skill_mode:
-            steps_lines.append(f"{step_num}. Start Codex in this project directory; spec-kit skills were installed to [cyan].agents/skills[/cyan]")
+            steps_lines.append(
+                f"{step_num}. Start Codex in this project directory; spec-kit skills were installed to [cyan].agents/skills[/cyan]"
+            )
             step_num += 1
         if claude_skill_mode:
-            steps_lines.append(f"{step_num}. Start Claude in this project directory; spec-kit skills were installed to [cyan].claude/skills[/cyan]")
+            steps_lines.append(
+                f"{step_num}. Start Claude in this project directory; spec-kit skills were installed to [cyan].claude/skills[/cyan]"
+            )
             step_num += 1
         if cursor_agent_skill_mode:
-            steps_lines.append(f"{step_num}. Start Cursor Agent in this project directory; spec-kit skills were installed to [cyan].cursor/skills[/cyan]")
+            steps_lines.append(
+                f"{step_num}. Start Cursor Agent in this project directory; spec-kit skills were installed to [cyan].cursor/skills[/cyan]"
+            )
             step_num += 1
         if devin_skill_mode:
-            steps_lines.append(f"{step_num}. Start Devin in this project directory; spec-kit skills were installed to [cyan].devin/skills[/cyan]")
+            steps_lines.append(
+                f"{step_num}. Start Devin in this project directory; spec-kit skills were installed to [cyan].devin/skills[/cyan]"
+            )
+            step_num += 1
+        if zed_skill_mode:
+            steps_lines.append(
+                f"{step_num}. Start Zed in this project directory; spec-kit skills were installed to [cyan].agents/skills[/cyan]"
+            )
             step_num += 1
         usage_label = "skills" if native_skill_mode else "slash commands"
 
+        from .._invocation_style import is_slash_skills_agent as _is_slash_skills_agent
+
+        # `_is_skills_integration` means the integration is installed in
+        # skills mode, which is the semantic equivalent of `ai_skills_enabled`
+        # used by `is_slash_skills_agent()`.
+        _ai_skills_enabled = _is_skills_integration
+
         def _display_cmd(name: str) -> str:
-            if codex_skill_mode or agy_skill_mode or trae_skill_mode:
+            if codex_skill_mode:
                 return f"$speckit-{name}"
-            if claude_skill_mode:
-                return f"/speckit-{name}"
             if kimi_skill_mode:
                 return f"/skill:speckit-{name}"
-            if cursor_agent_skill_mode or copilot_skill_mode or devin_skill_mode or cline_skill_mode:
+            if (
+                _is_slash_skills_agent(selected_ai, _ai_skills_enabled)
+                or cline_skill_mode
+            ):
                 return f"/speckit-{name}"
             return f"/speckit.{name}"
 
-        steps_lines.append(f"{step_num}. Start using {usage_label} with your coding agent:")
+        steps_lines.append(
+            f"{step_num}. Start using {usage_label} with your coding agent:"
+        )
 
-        steps_lines.append(f"   {step_num}.1 [cyan]{_display_cmd('constitution')}[/] - Establish project principles")
-        steps_lines.append(f"   {step_num}.2 [cyan]{_display_cmd('specify')}[/] - Create baseline specification")
-        steps_lines.append(f"   {step_num}.3 [cyan]{_display_cmd('plan')}[/] - Create implementation plan")
-        steps_lines.append(f"   {step_num}.4 [cyan]{_display_cmd('tasks')}[/] - Generate actionable tasks")
-        steps_lines.append(f"   {step_num}.5 [cyan]{_display_cmd('implement')}[/] - Execute implementation")
+        steps_lines.append(
+            f"   {step_num}.1 [cyan]{_display_cmd('constitution')}[/] - Establish project principles"
+        )
+        steps_lines.append(
+            f"   {step_num}.2 [cyan]{_display_cmd('specify')}[/] - Create baseline specification"
+        )
+        steps_lines.append(
+            f"   {step_num}.3 [cyan]{_display_cmd('plan')}[/] - Create implementation plan"
+        )
+        steps_lines.append(
+            f"   {step_num}.4 [cyan]{_display_cmd('tasks')}[/] - Generate actionable tasks"
+        )
+        steps_lines.append(
+            f"   {step_num}.5 [cyan]{_display_cmd('implement')}[/] - Execute implementation"
+        )
 
-        steps_panel = Panel("\n".join(steps_lines), title="Next Steps", border_style="cyan", padding=(1, 2))
+        steps_panel = Panel(
+            "\n".join(steps_lines),
+            title="Next Steps",
+            border_style="cyan",
+            padding=(1, 2),
+        )
         console.print()
         console.print(steps_panel)
 
@@ -593,9 +801,16 @@ def register(app: typer.Typer) -> None:
             "",
             f"○ [cyan]{_display_cmd('clarify')}[/] [bright_black](optional)[/bright_black] - Ask structured questions to de-risk ambiguous areas before planning (run before [cyan]{_display_cmd('plan')}[/] if used)",
             f"○ [cyan]{_display_cmd('analyze')}[/] [bright_black](optional)[/bright_black] - Cross-artifact consistency & alignment report (after [cyan]{_display_cmd('tasks')}[/], before [cyan]{_display_cmd('implement')}[/])",
-            f"○ [cyan]{_display_cmd('checklist')}[/] [bright_black](optional)[/bright_black] - Generate quality checklists to validate requirements completeness, clarity, and consistency (after [cyan]{_display_cmd('plan')}[/])"
+            f"○ [cyan]{_display_cmd('checklist')}[/] [bright_black](optional)[/bright_black] - Generate quality checklists to validate requirements completeness, clarity, and consistency (after [cyan]{_display_cmd('plan')}[/])",
         ]
-        enhancements_title = "Enhancement Skills" if native_skill_mode else "Enhancement Commands"
-        enhancements_panel = Panel("\n".join(enhancement_lines), title=enhancements_title, border_style="cyan", padding=(1, 2))
+        enhancements_title = (
+            "Enhancement Skills" if native_skill_mode else "Enhancement Commands"
+        )
+        enhancements_panel = Panel(
+            "\n".join(enhancement_lines),
+            title=enhancements_title,
+            border_style="cyan",
+            padding=(1, 2),
+        )
         console.print()
         console.print(enhancements_panel)

src/specify_cli/integration_scaffold.py

@@ -0,0 +1,287 @@
+"""Developer helpers for scaffolding built-in integrations."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(frozen=True)
+class IntegrationScaffoldResult:
+    """Files and next steps produced by an integration scaffold run."""
+
+    key: str
+    package_name: str
+    class_name: str
+    integration_file: Path
+    test_file: Path
+    next_steps: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class _IntegrationTemplate:
+    base_class: str
+    commands_subdir: str
+    registrar_format: str
+    args: str
+    extension: str
+
+
+_KEY_RE = re.compile(r"^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$")
+_TEMPLATES = {
+    "markdown": _IntegrationTemplate(
+        base_class="MarkdownIntegration",
+        commands_subdir="commands",
+        registrar_format="markdown",
+        args="$ARGUMENTS",
+        extension=".md",
+    ),
+    "toml": _IntegrationTemplate(
+        base_class="TomlIntegration",
+        commands_subdir="commands",
+        registrar_format="toml",
+        args="{{args}}",
+        extension=".toml",
+    ),
+    "yaml": _IntegrationTemplate(
+        base_class="YamlIntegration",
+        commands_subdir="recipes",
+        registrar_format="yaml",
+        args="{{args}}",
+        extension=".yaml",
+    ),
+    "skills": _IntegrationTemplate(
+        base_class="SkillsIntegration",
+        commands_subdir="skills",
+        registrar_format="markdown",
+        args="$ARGUMENTS",
+        extension="/SKILL.md",
+    ),
+}
+
+
+def supported_integration_scaffold_types() -> tuple[str, ...]:
+    """Return supported scaffold template names."""
+    return tuple(sorted(_TEMPLATES))
+
+
+def _clean_key(key: str) -> str:
+    clean = key.strip()
+    if not _KEY_RE.fullmatch(clean):
+        raise ValueError(
+            "Integration key must be lowercase kebab-case, for example 'my-agent'."
+        )
+    return clean
+
+
+def _package_name(key: str) -> str:
+    return key.replace("-", "_")
+
+
+def _class_name(key: str) -> str:
+    return "".join(part.capitalize() for part in key.split("-")) + "Integration"
+
+
+def _display_name(key: str) -> str:
+    return " ".join(part.capitalize() for part in key.split("-"))
+
+
+def _integration_content(
+    *,
+    key: str,
+    class_name: str,
+    integration_type: str,
+) -> str:
+    template = _TEMPLATES[integration_type]
+    display_name = _display_name(key)
+    folder = f".{key}/"
+    commands_dir = f"{folder}{template.commands_subdir}"
+    return f'''"""{display_name} integration."""
+
+from ..base import {template.base_class}
+
+
+class {class_name}({template.base_class}):
+    key = "{key}"
+    config = {{
+        "name": "{display_name}",
+        "folder": "{folder}",
+        "commands_subdir": "{template.commands_subdir}",
+        "install_url": None,
+        "requires_cli": False,
+    }}
+    registrar_config = {{
+        "dir": "{commands_dir}",
+        "format": "{template.registrar_format}",
+        "args": "{template.args}",
+        "extension": "{template.extension}",
+    }}
+    context_file = "AGENTS.md"
+    # Default to False so the generated boilerplate passes the registry
+    # contract out of the box: multi-install-safe integrations must each have a
+    # distinct context_file, and the placeholder above ("AGENTS.md") collides
+    # with the existing codex integration. Opt in once you pick a unique one.
+    multi_install_safe = False
+'''
+
+
+def _test_content(
+    *,
+    key: str,
+    class_name: str,
+    integration_type: str,
+) -> str:
+    template = _TEMPLATES[integration_type]
+    display_name = _display_name(key)
+    package_name = _package_name(key)
+    commands_dir = f".{key}/{template.commands_subdir}"
+    return f'''"""Tests for the {key} integration."""
+
+from specify_cli.integrations.{package_name} import {class_name}
+from specify_cli.integrations.base import {template.base_class}
+
+
+def test_metadata():
+    integration = {class_name}()
+
+    assert isinstance(integration, {template.base_class})
+    assert integration.key == "{key}"
+    assert integration.config["name"] == "{display_name}"
+    assert integration.config["folder"] == ".{key}/"
+    assert integration.config["commands_subdir"] == "{template.commands_subdir}"
+    assert integration.config["requires_cli"] is False
+    assert integration.registrar_config["dir"] == "{commands_dir}"
+    assert integration.registrar_config["format"] == "{template.registrar_format}"
+    assert integration.registrar_config["args"] == "{template.args}"
+    assert integration.registrar_config["extension"] == "{template.extension}"
+    assert integration.context_file == "AGENTS.md"
+    assert integration.multi_install_safe is False
+'''
+
+
+def _is_spec_kit_repo_root(project_root: Path) -> bool:
+    """Return True when `project_root` looks like the Spec Kit repository root."""
+    return all(
+        (
+            (project_root / "pyproject.toml").is_file(),
+            (project_root / "src" / "specify_cli" / "__init__.py").is_file(),
+            (project_root / "src" / "specify_cli" / "integrations").is_dir(),
+            (
+                project_root / "src" / "specify_cli" / "integrations" / "__init__.py"
+            ).is_file(),
+            (project_root / "tests" / "integrations").is_dir(),
+        )
+    )
+
+
+def _assert_safe_scaffold_target(project_root: Path, target: Path) -> None:
+    """Refuse to scaffold through a symlinked path that could escape the repo.
+
+    Walks each component of *target* under *project_root* and rejects any
+    existing symlinked directory (or symlinked target), then confirms the
+    write destination still resolves inside the repository root. Mirrors the
+    symlink-aware guarding used for integration manifests.
+    """
+    try:
+        rel = target.relative_to(project_root)
+    except ValueError:
+        raise ValueError(
+            f"Refusing to scaffold outside the repository root: {target}"
+        ) from None
+
+    current = project_root
+    for part in rel.parts:
+        current = current / part
+        if current.is_symlink():
+            label = current.relative_to(project_root).as_posix()
+            raise ValueError(f"Refusing to scaffold through symlinked path: {label}")
+
+    root_resolved = project_root.resolve()
+    try:
+        target.parent.resolve().relative_to(root_resolved)
+    except (OSError, ValueError):
+        raise ValueError(
+            f"Refusing to scaffold outside the repository root: {target}"
+        ) from None
+
+
+def scaffold_integration(
+    project_root: Path,
+    key: str,
+    integration_type: str,
+) -> IntegrationScaffoldResult:
+    """Create a minimal built-in integration package and test skeleton."""
+    clean_key = _clean_key(key)
+    normalized_type = integration_type.strip().lower()
+    if normalized_type not in _TEMPLATES:
+        supported = ", ".join(supported_integration_scaffold_types())
+        raise ValueError(
+            f"Unsupported integration type '{normalized_type}'. Use one of: {supported}."
+        )
+
+    integrations_root = project_root / "src" / "specify_cli" / "integrations"
+    tests_root = project_root / "tests" / "integrations"
+    if not _is_spec_kit_repo_root(project_root):
+        raise ValueError("Run this command from the Spec Kit repository root.")
+
+    package_name = _package_name(clean_key)
+    class_name = _class_name(clean_key)
+    integration_dir = integrations_root / package_name
+    integration_file = integration_dir / "__init__.py"
+    test_file = tests_root / f"test_integration_{package_name}.py"
+
+    for target in (integration_file, test_file):
+        _assert_safe_scaffold_target(project_root, target)
+
+    existing = [path for path in (integration_file, test_file) if path.exists()]
+    if existing:
+        labels = ", ".join(path.relative_to(project_root).as_posix() for path in existing)
+        raise FileExistsError(f"Refusing to overwrite existing scaffold file(s): {labels}")
+
+    created_integration_dir = not integration_dir.exists()
+    try:
+        integration_dir.mkdir(exist_ok=True)
+        integration_file.write_text(
+            _integration_content(
+                key=clean_key,
+                class_name=class_name,
+                integration_type=normalized_type,
+            ),
+            encoding="utf-8",
+        )
+        test_file.write_text(
+            _test_content(
+                key=clean_key,
+                class_name=class_name,
+                integration_type=normalized_type,
+            ),
+            encoding="utf-8",
+        )
+    except OSError:
+        for path in (test_file, integration_file):
+            try:
+                if path.is_file() or path.is_symlink():
+                    path.unlink()
+            except OSError:
+                pass
+        if created_integration_dir:
+            try:
+                integration_dir.rmdir()
+            except OSError:
+                pass
+        raise
+
+    next_steps = (
+        f"Register {class_name} in src/specify_cli/integrations/__init__.py.",
+        "Review config metadata, install_url, requires_cli, context_file, and multi_install_safe.",
+        f"Run pytest tests/integrations/test_integration_{package_name}.py -v.",
+    )
+    return IntegrationScaffoldResult(
+        key=clean_key,
+        package_name=package_name,
+        class_name=class_name,
+        integration_file=integration_file,
+        test_file=test_file,
+        next_steps=next_steps,
+    )

src/specify_cli/integrations/__init__.py

@@ -80,6 +80,7 @@ def _register_builtins() -> None:
     from .trae import TraeIntegration
     from .vibe import VibeIntegration
     from .windsurf import WindsurfIntegration
+    from .zed import ZedIntegration
 
     # -- Registration (alphabetical) --------------------------------------
     _register(AgyIntegration())
@@ -115,6 +116,7 @@ def _register_builtins() -> None:
     _register(TraeIntegration())
     _register(VibeIntegration())
     _register(WindsurfIntegration())
+    _register(ZedIntegration())
 
 
 _register_builtins()

src/specify_cli/integrations/_commands.py

@@ -31,4 +31,5 @@ def register(app: typer.Typer) -> None:
     from . import _install_commands  # noqa: F401 — registers handlers via decorators
     from . import _migrate_commands  # noqa: F401
     from . import _query_commands    # noqa: F401
+    from . import _scaffold_commands  # noqa: F401
     app.add_typer(integration_app, name="integration")

src/specify_cli/integrations/_scaffold_commands.py

@@ -0,0 +1,52 @@
+"""specify integration scaffold command handler."""
+from __future__ import annotations
+
+from enum import Enum
+from pathlib import Path
+
+import typer
+
+from .._console import console
+from ..integration_scaffold import supported_integration_scaffold_types
+from ._commands import integration_app
+
+
+INTEGRATION_SCAFFOLD_TYPES = supported_integration_scaffold_types()
+_IntegrationScaffoldType = Enum(
+    "_IntegrationScaffoldType",
+    {name: name for name in INTEGRATION_SCAFFOLD_TYPES},
+    type=str,
+)
+
+
+@integration_app.command("scaffold")
+def integration_scaffold(
+    key: str = typer.Argument(help="Integration key in lowercase kebab-case, e.g. my-agent"),
+    integration_type: _IntegrationScaffoldType = typer.Option(
+        _IntegrationScaffoldType.markdown,
+        "--type",
+        case_sensitive=False,
+        help=f"Scaffold type: {', '.join(INTEGRATION_SCAFFOLD_TYPES)}",
+    ),
+):
+    """Create a minimal built-in integration package and test skeleton."""
+    from ..integration_scaffold import scaffold_integration
+
+    project_root = Path.cwd()
+    try:
+        result = scaffold_integration(project_root, key, integration_type.value)
+    except (OSError, ValueError) as exc:
+        # OSError covers filesystem failures during mkdir()/write_text()
+        # (permission denied, read-only checkout, a path component that is a
+        # file, ...) as well as FileExistsError; surface them as a clean CLI
+        # error instead of a traceback.
+        console.print(f"[red]Error:[/red] {exc}")
+        raise typer.Exit(1)
+
+    console.print(f"[green]Created integration scaffold:[/green] {result.key}")
+    console.print(f"  {result.integration_file.relative_to(project_root).as_posix()}")
+    console.print(f"  {result.test_file.relative_to(project_root).as_posix()}")
+    console.print()
+    console.print("[bold]Next steps:[/bold]")
+    for index, step in enumerate(result.next_steps, start=1):
+        console.print(f"{index}. {step}")

src/specify_cli/integrations/claude/__init__.py

@@ -5,10 +5,9 @@ from __future__ import annotations
 from pathlib import Path
 from typing import Any
 
-import yaml
-
 from ..base import SkillsIntegration
 from ..manifest import IntegrationManifest
+from ..._utils import dump_frontmatter
 
 # Mapping of command template stem → argument-hint text shown inline
 # when a user invokes the slash command in Claude Code.
@@ -103,7 +102,7 @@ class ClaudeIntegration(SkillsIntegration):
         skill_frontmatter = self._build_skill_fm(
             skill_name, description, f"templates/commands/{template_name}.md"
         )
-        frontmatter_text = yaml.safe_dump(skill_frontmatter, sort_keys=False).strip()
+        frontmatter_text = dump_frontmatter(skill_frontmatter)
         return f"---\n{frontmatter_text}\n---\n\n{body.strip()}\n"
 
     def _build_skill_fm(self, name: str, description: str, source: str) -> dict:

src/specify_cli/integrations/zed/__init__.py

@@ -0,0 +1,34 @@
+"""Zed editor integration — skills-based agent.
+
+Zed uses the ``.agents/skills/speckit-<name>/SKILL.md`` layout so Spec Kit
+commands are exposed as project-local skills that can be invoked from Zed's
+slash-command menu.
+"""
+
+from __future__ import annotations
+
+from ..base import IntegrationOption, SkillsIntegration
+
+
+class ZedIntegration(SkillsIntegration):
+    """Integration for Zed editor skills."""
+
+    key = "zed"
+    config = {
+        "name": "Zed",
+        "folder": ".agents/",
+        "commands_subdir": "skills",
+        "install_url": None,
+        "requires_cli": False,
+    }
+    registrar_config = {
+        "dir": ".agents/skills",
+        "format": "markdown",
+        "args": "$ARGUMENTS",
+        "extension": "/SKILL.md",
+    }
+    context_file = "AGENTS.md"
+
+    @classmethod
+    def options(cls) -> list[IntegrationOption]:
+        return []

src/specify_cli/presets/__init__.py

@@ -19,7 +19,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Optional, Dict, List, Any
 
 if TYPE_CHECKING:
-    from .agents import CommandRegistrar
+    from ..agents import CommandRegistrar
 from datetime import datetime, timezone
 import re
 
@@ -27,9 +27,10 @@ import yaml
 from packaging import version as pkg_version
 from packaging.specifiers import SpecifierSet, InvalidSpecifier
 
-from .extensions import REINSTALL_COMMAND, ExtensionRegistry, normalize_priority
-from .integrations.base import IntegrationBase
-from ._init_options import is_ai_skills_enabled
+from ..extensions import REINSTALL_COMMAND, ExtensionRegistry, normalize_priority
+from .._init_options import is_ai_skills_enabled
+from ..integrations.base import IntegrationBase
+from .._utils import dump_frontmatter
 
 
 def _substitute_core_template(
@@ -676,7 +677,7 @@ class PresetManager:
                 commands_to_register.append(cmd)
 
         try:
-            from .agents import CommandRegistrar
+            from ..agents import CommandRegistrar
         except ImportError:
             return {}
 
@@ -692,7 +693,7 @@ class PresetManager:
             registered_commands: Dict mapping agent names to command name lists
         """
         try:
-            from .agents import CommandRegistrar
+            from ..agents import CommandRegistrar
         except ImportError:
             return
 
@@ -715,7 +716,7 @@ class PresetManager:
             return
 
         try:
-            from .agents import CommandRegistrar
+            from ..agents import CommandRegistrar
         except ImportError:
             return
 
@@ -767,7 +768,7 @@ class PresetManager:
                         ext_manifest_path = ext_dir / "extension.yml"
                         if ext_manifest_path.exists():
                             try:
-                                from .extensions import ExtensionManifest
+                                from ..extensions import ExtensionManifest
                                 ext_manifest = ExtensionManifest(ext_manifest_path)
                                 # Filter to only the command being reconciled
                                 matching_cmds = [
@@ -891,7 +892,7 @@ class PresetManager:
         # Load aliases from extension manifest when the winning layer is an extension
         if source_id and not source_id.startswith("preset:"):
             try:
-                from .extensions import ExtensionManifest
+                from ..extensions import ExtensionManifest
                 for ext_dir in (self.project_root / ".specify" / "extensions").iterdir():
                     if not ext_dir.is_dir():
                         continue
@@ -1042,8 +1043,8 @@ class PresetManager:
                 skill_subdir.mkdir(parents=True, exist_ok=True)
                 skill_file = skill_subdir / "SKILL.md"
                 try:
-                    from .agents import CommandRegistrar
-                    from . import SKILL_DESCRIPTIONS, load_init_options
+                    from ..agents import CommandRegistrar
+                    from .. import SKILL_DESCRIPTIONS, load_init_options
                     registrar = CommandRegistrar()
                     content = top_layer["path"].read_text(encoding="utf-8")
                     fm, body = registrar.parse_frontmatter(content)
@@ -1068,14 +1069,14 @@ class PresetManager:
                         skill_name, desc,
                         f"override:{cmd_name}",
                     )
-                    fm_text = yaml.safe_dump(fm_data, sort_keys=False).strip()
+                    fm_text = dump_frontmatter(fm_data)
                     skill_title = self._skill_title_from_command(cmd_name)
                     skill_content = (
                         f"---\n{fm_text}\n---\n\n"
                         f"# Speckit {skill_title} Skill\n\n{body}\n"
                     )
                     # Apply integration post-processing (e.g. Claude flags)
-                    from .integrations import get_integration
+                    from ..integrations import get_integration
                     integration = get_integration(selected_ai) if isinstance(selected_ai, str) else None
                     if integration is not None and hasattr(integration, "post_process_skill_content"):
                         skill_content = integration.post_process_skill_content(skill_content)
@@ -1110,7 +1111,7 @@ class PresetManager:
         be created due to symlink, containment, or permission issues so
         that callers can fall back gracefully.
         """
-        from . import resolve_active_skills_dir, _print_cli_warning
+        from .. import resolve_active_skills_dir, _print_cli_warning
         try:
             return resolve_active_skills_dir(self.project_root)
         except (ValueError, OSError) as exc:
@@ -1158,7 +1159,7 @@ class PresetManager:
 
     def _build_extension_skill_restore_index(self) -> Dict[str, Dict[str, Any]]:
         """Index extension-backed skill restore data by skill directory name."""
-        from .extensions import ExtensionManifest, ValidationError
+        from ..extensions import ExtensionManifest, ValidationError
 
         resolver = PresetResolver(self.project_root)
         extensions_dir = self.project_root / ".specify" / "extensions"
@@ -1253,9 +1254,9 @@ class PresetManager:
         if not skills_dir:
             return []
 
-        from . import SKILL_DESCRIPTIONS, load_init_options
-        from .agents import CommandRegistrar
-        from .integrations import get_integration
+        from .. import SKILL_DESCRIPTIONS, load_init_options
+        from ..agents import CommandRegistrar
+        from ..integrations import get_integration
 
         init_opts = load_init_options(self.project_root)
         if not isinstance(init_opts, dict):
@@ -1345,7 +1346,7 @@ class PresetManager:
                     enhanced_desc,
                     f"preset:{manifest.id}",
                 )
-                frontmatter_text = yaml.safe_dump(frontmatter_data, sort_keys=False).strip()
+                frontmatter_text = dump_frontmatter(frontmatter_data)
                 skill_content = (
                     f"---\n"
                     f"{frontmatter_text}\n"
@@ -1382,9 +1383,9 @@ class PresetManager:
         if not skills_dir:
             return
 
-        from . import SKILL_DESCRIPTIONS, load_init_options
-        from .agents import CommandRegistrar
-        from .integrations import get_integration
+        from .. import SKILL_DESCRIPTIONS, load_init_options
+        from ..agents import CommandRegistrar
+        from ..integrations import get_integration
 
         # Locate core command templates from the project's installed templates
         core_templates_dir = self.project_root / ".specify" / "templates" / "commands"
@@ -1441,7 +1442,7 @@ class PresetManager:
                     enhanced_desc,
                     f"templates/commands/{short_name}.md",
                 )
-                frontmatter_text = yaml.safe_dump(frontmatter_data, sort_keys=False).strip()
+                frontmatter_text = dump_frontmatter(frontmatter_data)
                 skill_title = self._skill_title_from_command(short_name)
                 skill_content = (
                     f"---\n"
@@ -1478,7 +1479,7 @@ class PresetManager:
                     frontmatter.get("description", f"Extension command: {command_name}"),
                     extension_restore["source"],
                 )
-                frontmatter_text = yaml.safe_dump(frontmatter_data, sort_keys=False).strip()
+                frontmatter_text = dump_frontmatter(frontmatter_data)
                 skill_content = (
                     f"---\n"
                     f"{frontmatter_text}\n"
@@ -1712,7 +1713,7 @@ class PresetManager:
         if registered_skills:
             self._unregister_skills(registered_skills, pack_dir)
             try:
-                from .agents import CommandRegistrar
+                from ..agents import CommandRegistrar
             except ImportError:
                 CommandRegistrar = None
             if CommandRegistrar is not None:
@@ -2450,7 +2451,7 @@ class PresetCatalog:
 
         # Bundled presets without a download URL must be installed locally
         if pack_info.get("bundled") and not pack_info.get("download_url"):
-            from .extensions import REINSTALL_COMMAND
+            from ..extensions import REINSTALL_COMMAND
             raise PresetError(
                 f"Preset '{pack_id}' is bundled with spec-kit and has no download URL. "
                 f"It should be installed from the local package. "
@@ -2769,7 +2770,7 @@ class PresetResolver:
         if not self.extensions_dir.exists():
             return None
 
-        from .extensions import ExtensionManifest, ValidationError
+        from ..extensions import ExtensionManifest, ValidationError
 
         for _priority, ext_id, _metadata in self._get_all_extensions_by_priority():
             ext_dir = self.extensions_dir / ext_id
@@ -2995,7 +2996,7 @@ class PresetResolver:
                 ext_manifest_path = ext_dir / "extension.yml"
                 if ext_manifest_path.exists():
                     try:
-                        from .extensions import ExtensionManifest, ValidationError as ExtValidationError
+                        from ..extensions import ExtensionManifest, ValidationError as ExtValidationError
                         ext_manifest = ExtensionManifest(ext_manifest_path)
                         for cmd in ext_manifest.commands:
                             if cmd.get("name") == template_name:
@@ -3276,7 +3277,7 @@ class PresetResolver:
             if top_fm:
                 top_frontmatter_text = (
                     "---\n"
-                    + yaml.safe_dump(top_fm, sort_keys=False).strip()
+                    + dump_frontmatter(top_fm)
                     + "\n---"
                 )
             else:

src/specify_cli/presets/_commands.py

@@ -0,0 +1,711 @@
+"""specify preset * command handlers — app objects and register() entry point.
+
+Moved out of __init__.py (PR-6/8). Handlers reference helpers that remain in
+the package root (`_require_specify_project`, `get_speckit_version`,
+`_locate_bundled_preset`, `_display_project_path`) via lazy `from .. import`
+calls inside each function so test monkeypatching of `specify_cli.<helper>`
+keeps working.
+"""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+import typer
+import yaml
+
+from .._console import console
+
+preset_app = typer.Typer(
+    name="preset",
+    help="Manage spec-kit presets",
+    add_completion=False,
+)
+
+preset_catalog_app = typer.Typer(
+    name="catalog",
+    help="Manage preset catalogs",
+    add_completion=False,
+)
+preset_app.add_typer(preset_catalog_app, name="catalog")
+
+
+# ===== Preset Commands =====
+
+
+@preset_app.command("list")
+def preset_list():
+    """List installed presets."""
+    from .. import _require_specify_project
+    from . import PresetManager
+
+    project_root = _require_specify_project()
+    manager = PresetManager(project_root)
+    installed = manager.list_installed()
+
+    if not installed:
+        console.print("[yellow]No presets installed.[/yellow]")
+        console.print("\nInstall a preset with:")
+        console.print("  [cyan]specify preset add <pack-name>[/cyan]")
+        return
+
+    console.print("\n[bold cyan]Installed Presets:[/bold cyan]\n")
+    for pack in installed:
+        status = "[green]enabled[/green]" if pack.get("enabled", True) else "[red]disabled[/red]"
+        pri = pack.get('priority', 10)
+        console.print(f"  [bold]{pack['name']}[/bold] ({pack['id']}) v{pack['version']} — {status} — priority {pri}")
+        console.print(f"    {pack['description']}")
+        if pack.get("tags"):
+            tags_str = ", ".join(pack["tags"])
+            console.print(f"    [dim]Tags: {tags_str}[/dim]")
+        console.print(f"    [dim]Templates: {pack['template_count']}[/dim]")
+        console.print()
+
+
+@preset_app.command("add")
+def preset_add(
+    preset_id: str = typer.Argument(None, help="Preset ID to install from catalog"),
+    from_url: str = typer.Option(None, "--from", help="Install from a URL (ZIP file)"),
+    dev: str = typer.Option(None, "--dev", help="Install from local directory (development mode)"),
+    priority: int = typer.Option(10, "--priority", help="Resolution priority (lower = higher precedence, default 10)"),
+):
+    """Install a preset."""
+    from .. import _locate_bundled_preset, _require_specify_project, get_speckit_version
+    from . import (
+        PresetManager,
+        PresetCatalog,
+        PresetError,
+        PresetValidationError,
+        PresetCompatibilityError,
+    )
+
+    project_root = _require_specify_project()
+    # Validate priority
+    if priority < 1:
+        console.print("[red]Error:[/red] Priority must be a positive integer (1 or higher)")
+        raise typer.Exit(1)
+
+    manager = PresetManager(project_root)
+    speckit_version = get_speckit_version()
+
+    try:
+        if dev:
+            dev_path = Path(dev).resolve()
+            if not dev_path.exists():
+                console.print(f"[red]Error:[/red] Directory not found: {dev}")
+                raise typer.Exit(1)
+
+            console.print(f"Installing preset from [cyan]{dev_path}[/cyan]...")
+            manifest = manager.install_from_directory(dev_path, speckit_version, priority)
+            console.print(f"[green]✓[/green] Preset '{manifest.name}' v{manifest.version} installed (priority {priority})")
+
+        elif from_url:
+            # Validate URL scheme before downloading
+            from ipaddress import ip_address
+            from urllib.parse import urlparse as _urlparse
+
+            _parsed = _urlparse(from_url)
+
+            def _is_allowed_download_url(parsed_url):
+                host = parsed_url.hostname
+                if not host:
+                    return False
+                is_loopback = host == "localhost"
+                if not is_loopback:
+                    try:
+                        is_loopback = ip_address(host).is_loopback
+                    except ValueError:
+                        # Host is not an IP literal (e.g., a regular hostname); treat as non-loopback.
+                        pass
+                return parsed_url.scheme == "https" or (parsed_url.scheme == "http" and is_loopback)
+
+            def _validate_download_redirect(old_url, new_url):
+                if not _is_allowed_download_url(_urlparse(new_url)):
+                    import urllib.error
+
+                    raise urllib.error.URLError(
+                        "redirect target must use HTTPS with a hostname, "
+                        "or HTTP for localhost/loopback"
+                    )
+
+            if not _is_allowed_download_url(_parsed):
+                console.print(
+                    "[red]Error:[/red] URL must use HTTPS with a hostname, "
+                    "or HTTP for localhost/loopback."
+                )
+                raise typer.Exit(1)
+
+            console.print(f"Installing preset from [cyan]{from_url}[/cyan]...")
+            import urllib.error
+            import tempfile
+            import shutil
+
+            with tempfile.TemporaryDirectory() as tmpdir:
+                zip_path = Path(tmpdir) / "preset.zip"
+                try:
+                    from specify_cli.authentication.http import open_url as _open_url
+                    from specify_cli._github_http import resolve_github_release_asset_api_url
+
+                    _preset_extra_headers = None
+                    _resolved_from_url = resolve_github_release_asset_api_url(from_url, _open_url)
+                    if _resolved_from_url:
+                        from_url = _resolved_from_url
+                        _preset_extra_headers = {"Accept": "application/octet-stream"}
+
+                    with _open_url(
+                        from_url,
+                        timeout=60,
+                        extra_headers=_preset_extra_headers,
+                        redirect_validator=_validate_download_redirect,
+                    ) as response:
+                        final_url = response.geturl() if hasattr(response, "geturl") else from_url
+                        if not _is_allowed_download_url(_urlparse(final_url)):
+                            console.print(
+                                "[red]Error:[/red] Preset URL redirected to a disallowed URL: "
+                                f"{final_url}. Redirect targets must use HTTPS with a hostname, "
+                                "or HTTP for localhost/loopback."
+                            )
+                            raise typer.Exit(1)
+                        with zip_path.open("wb") as output:
+                            try:
+                                shutil.copyfileobj(response, output)
+                            except TypeError:
+                                output.write(response.read())
+                except urllib.error.URLError as e:
+                    console.print(f"[red]Error:[/red] Failed to download: {e}")
+                    raise typer.Exit(1)
+
+                manifest = manager.install_from_zip(zip_path, speckit_version, priority)
+
+            console.print(f"[green]✓[/green] Preset '{manifest.name}' v{manifest.version} installed (priority {priority})")
+
+        elif preset_id:
+            # Try bundled preset first, then catalog
+            bundled_path = _locate_bundled_preset(preset_id)
+            if bundled_path:
+                console.print(f"Installing bundled preset [cyan]{preset_id}[/cyan]...")
+                manifest = manager.install_from_directory(bundled_path, speckit_version, priority)
+                console.print(f"[green]✓[/green] Preset '{manifest.name}' v{manifest.version} installed (priority {priority})")
+            else:
+                catalog = PresetCatalog(project_root)
+                pack_info = catalog.get_pack_info(preset_id)
+
+                if not pack_info:
+                    console.print(f"[red]Error:[/red] Preset '{preset_id}' not found in catalog")
+                    raise typer.Exit(1)
+
+                # Bundled presets should have been caught above; if we reach
+                # here the bundled files are missing from the installation.
+                if pack_info.get("bundled") and not pack_info.get("download_url"):
+                    from ..extensions import REINSTALL_COMMAND
+                    console.print(
+                        f"[red]Error:[/red] Preset '{preset_id}' is bundled with spec-kit "
+                        f"but could not be found in the installed package."
+                    )
+                    console.print(
+                        "\nThis usually means the spec-kit installation is incomplete or corrupted."
+                    )
+                    console.print("Try reinstalling spec-kit:")
+                    console.print(f"  {REINSTALL_COMMAND}")
+                    raise typer.Exit(1)
+
+                if not pack_info.get("_install_allowed", True):
+                    catalog_name = pack_info.get("_catalog_name", "unknown")
+                    console.print(f"[red]Error:[/red] Preset '{preset_id}' is from the '{catalog_name}' catalog which is discovery-only (install not allowed).")
+                    console.print("Add the catalog with --install-allowed or install from the preset's repository directly with --from.")
+                    raise typer.Exit(1)
+
+                console.print(f"Installing preset [cyan]{pack_info.get('name', preset_id)}[/cyan]...")
+
+                try:
+                    zip_path = catalog.download_pack(preset_id)
+                    manifest = manager.install_from_zip(zip_path, speckit_version, priority)
+                    console.print(f"[green]✓[/green] Preset '{manifest.name}' v{manifest.version} installed (priority {priority})")
+                finally:
+                    if 'zip_path' in locals() and zip_path.exists():
+                        zip_path.unlink(missing_ok=True)
+        else:
+            console.print("[red]Error:[/red] Specify a preset ID, --from URL, or --dev path")
+            raise typer.Exit(1)
+
+    except PresetCompatibilityError as e:
+        console.print(f"[red]Compatibility Error:[/red] {e}")
+        raise typer.Exit(1)
+    except PresetValidationError as e:
+        console.print(f"[red]Validation Error:[/red] {e}")
+        raise typer.Exit(1)
+    except PresetError as e:
+        console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(1)
+
+
+@preset_app.command("remove")
+def preset_remove(
+    preset_id: str = typer.Argument(..., help="Preset ID to remove"),
+):
+    """Remove an installed preset."""
+    from .. import _require_specify_project
+    from . import PresetManager
+
+    project_root = _require_specify_project()
+    manager = PresetManager(project_root)
+
+    if not manager.registry.is_installed(preset_id):
+        console.print(f"[red]Error:[/red] Preset '{preset_id}' is not installed")
+        raise typer.Exit(1)
+
+    if manager.remove(preset_id):
+        console.print(f"[green]✓[/green] Preset '{preset_id}' removed successfully")
+    else:
+        console.print(f"[red]Error:[/red] Failed to remove preset '{preset_id}'")
+        raise typer.Exit(1)
+
+
+@preset_app.command("search")
+def preset_search(
+    query: str = typer.Argument(None, help="Search query"),
+    tag: str = typer.Option(None, "--tag", help="Filter by tag"),
+    author: str = typer.Option(None, "--author", help="Filter by author"),
+):
+    """Search for presets in the catalog."""
+    from .. import _require_specify_project
+    from . import PresetCatalog, PresetError
+
+    project_root = _require_specify_project()
+    catalog = PresetCatalog(project_root)
+
+    try:
+        results = catalog.search(query=query, tag=tag, author=author)
+    except PresetError as e:
+        console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(1)
+
+    if not results:
+        console.print("[yellow]No presets found matching your criteria.[/yellow]")
+        return
+
+    console.print(f"\n[bold cyan]Presets ({len(results)} found):[/bold cyan]\n")
+    for pack in results:
+        console.print(f"  [bold]{pack.get('name', pack['id'])}[/bold] ({pack['id']}) v{pack.get('version', '?')}")
+        console.print(f"    {pack.get('description', '')}")
+        if pack.get("tags"):
+            tags_str = ", ".join(pack["tags"])
+            console.print(f"    [dim]Tags: {tags_str}[/dim]")
+        console.print()
+
+
+@preset_app.command("resolve")
+def preset_resolve(
+    template_name: str = typer.Argument(..., help="Template name to resolve (e.g., spec-template)"),
+):
+    """Show which template will be resolved for a given name."""
+    from .. import _require_specify_project
+    from . import PresetResolver
+
+    project_root = _require_specify_project()
+    resolver = PresetResolver(project_root)
+    layers = resolver.collect_all_layers(template_name)
+
+    if layers:
+        # Use the highest-priority layer for display because the final output
+        # may be composed and may not map to resolve_with_source()'s single path.
+        display_layer = layers[0]
+        console.print(f"  [bold]{template_name}[/bold]: {display_layer['path']}")
+        console.print(f"    [dim](top layer from: {display_layer['source']})[/dim]")
+
+        has_composition = (
+            layers[0]["strategy"] != "replace"
+            and any(layer["strategy"] != "replace" for layer in layers)
+        )
+        if has_composition:
+            # Verify composition is actually possible
+            try:
+                composed = resolver.resolve_content(template_name)
+            except Exception as exc:
+                composed = None
+                console.print(f"    [yellow]Warning: composition error: {exc}[/yellow]")
+            if composed is None:
+                console.print("    [yellow]Warning: composition cannot produce output (no base layer with 'replace' strategy)[/yellow]")
+            else:
+                console.print("    [dim]Final output is composed from multiple preset layers; the path above is the highest-priority contributing layer.[/dim]")
+            console.print("\n  [bold]Composition chain:[/bold]")
+            # Compute the effective base: first replace layer scanning from
+            # highest priority (matching resolve_content top-down logic).
+            # Only show layers from the base upward (lower layers are ignored).
+            effective_base_idx = None
+            for idx, lyr in enumerate(layers):
+                if lyr["strategy"] == "replace":
+                    effective_base_idx = idx
+                    break
+            # Show only contributing layers (base and above)
+            if effective_base_idx is not None:
+                contributing = layers[:effective_base_idx + 1]
+            else:
+                contributing = layers
+            for i, layer in enumerate(reversed(contributing)):
+                strategy_label = layer["strategy"]
+                if strategy_label == "replace" and i == 0:
+                    strategy_label = "base"
+                console.print(f"    {i + 1}. [{strategy_label}] {layer['source']} → {layer['path']}")
+    else:
+        # No layers found — fall back to resolve_with_source for non-composition cases
+        result = resolver.resolve_with_source(template_name)
+        if result:
+            console.print(f"  [bold]{template_name}[/bold]: {result['path']}")
+            console.print(f"    [dim](from: {result['source']})[/dim]")
+        else:
+            console.print(f"  [yellow]{template_name}[/yellow]: not found")
+            console.print("    [dim]No template with this name exists in the resolution stack[/dim]")
+
+
+@preset_app.command("info")
+def preset_info(
+    preset_id: str = typer.Argument(..., help="Preset ID to get info about"),
+):
+    """Show detailed information about a preset."""
+    from .. import _require_specify_project
+    from ..extensions import normalize_priority
+    from . import PresetCatalog, PresetManager, PresetError
+
+    project_root = _require_specify_project()
+    # Check if installed locally first
+    manager = PresetManager(project_root)
+    local_pack = manager.get_pack(preset_id)
+
+    if local_pack:
+        console.print(f"\n[bold cyan]Preset: {local_pack.name}[/bold cyan]\n")
+        console.print(f"  ID:          {local_pack.id}")
+        console.print(f"  Version:     {local_pack.version}")
+        console.print(f"  Description: {local_pack.description}")
+        if local_pack.author:
+            console.print(f"  Author:      {local_pack.author}")
+        if local_pack.tags:
+            console.print(f"  Tags:        {', '.join(local_pack.tags)}")
+        console.print(f"  Templates:   {len(local_pack.templates)}")
+        for tmpl in local_pack.templates:
+            console.print(f"    - {tmpl['name']} ({tmpl['type']}): {tmpl.get('description', '')}")
+        repo = local_pack.data.get("preset", {}).get("repository")
+        if repo:
+            console.print(f"  Repository:  {repo}")
+        license_val = local_pack.data.get("preset", {}).get("license")
+        if license_val:
+            console.print(f"  License:     {license_val}")
+        console.print("\n  [green]Status: installed[/green]")
+        # Get priority from registry
+        pack_metadata = manager.registry.get(preset_id)
+        priority = normalize_priority(pack_metadata.get("priority") if isinstance(pack_metadata, dict) else None)
+        console.print(f"  [dim]Priority:[/dim] {priority}")
+        console.print()
+        return
+
+    # Fall back to catalog
+    catalog = PresetCatalog(project_root)
+    try:
+        pack_info = catalog.get_pack_info(preset_id)
+    except PresetError:
+        pack_info = None
+
+    if not pack_info:
+        console.print(f"[red]Error:[/red] Preset '{preset_id}' not found (not installed and not in catalog)")
+        raise typer.Exit(1)
+
+    console.print(f"\n[bold cyan]Preset: {pack_info.get('name', preset_id)}[/bold cyan]\n")
+    console.print(f"  ID:          {pack_info['id']}")
+    console.print(f"  Version:     {pack_info.get('version', '?')}")
+    console.print(f"  Description: {pack_info.get('description', '')}")
+    if pack_info.get("author"):
+        console.print(f"  Author:      {pack_info['author']}")
+    if pack_info.get("tags"):
+        console.print(f"  Tags:        {', '.join(pack_info['tags'])}")
+    if pack_info.get("repository"):
+        console.print(f"  Repository:  {pack_info['repository']}")
+    if pack_info.get("license"):
+        console.print(f"  License:     {pack_info['license']}")
+    console.print("\n  [yellow]Status: not installed[/yellow]")
+    console.print(f"  Install with: [cyan]specify preset add {preset_id}[/cyan]")
+    console.print()
+
+
+@preset_app.command("set-priority")
+def preset_set_priority(
+    preset_id: str = typer.Argument(help="Preset ID"),
+    priority: int = typer.Argument(help="New priority (lower = higher precedence)"),
+):
+    """Set the resolution priority of an installed preset."""
+    from .. import _require_specify_project
+    from . import PresetManager
+
+    project_root = _require_specify_project()
+    # Validate priority
+    if priority < 1:
+        console.print("[red]Error:[/red] Priority must be a positive integer (1 or higher)")
+        raise typer.Exit(1)
+
+    manager = PresetManager(project_root)
+
+    # Check if preset is installed
+    if not manager.registry.is_installed(preset_id):
+        console.print(f"[red]Error:[/red] Preset '{preset_id}' is not installed")
+        raise typer.Exit(1)
+
+    # Get current metadata
+    metadata = manager.registry.get(preset_id)
+    if metadata is None or not isinstance(metadata, dict):
+        console.print(f"[red]Error:[/red] Preset '{preset_id}' not found in registry (corrupted state)")
+        raise typer.Exit(1)
+
+    from ..extensions import normalize_priority
+    raw_priority = metadata.get("priority")
+    # Only skip if the stored value is already a valid int equal to requested priority
+    # This ensures corrupted values (e.g., "high") get repaired even when setting to default (10)
+    if isinstance(raw_priority, int) and raw_priority == priority:
+        console.print(f"[yellow]Preset '{preset_id}' already has priority {priority}[/yellow]")
+        raise typer.Exit(0)
+
+    old_priority = normalize_priority(raw_priority)
+
+    # Update priority
+    manager.registry.update(preset_id, {"priority": priority})
+
+    console.print(f"[green]✓[/green] Preset '{preset_id}' priority changed: {old_priority} → {priority}")
+    console.print("\n[dim]Lower priority = higher precedence in template resolution[/dim]")
+
+
+@preset_app.command("enable")
+def preset_enable(
+    preset_id: str = typer.Argument(help="Preset ID to enable"),
+):
+    """Enable a disabled preset."""
+    from .. import _require_specify_project
+    from . import PresetManager
+
+    project_root = _require_specify_project()
+    manager = PresetManager(project_root)
+
+    # Check if preset is installed
+    if not manager.registry.is_installed(preset_id):
+        console.print(f"[red]Error:[/red] Preset '{preset_id}' is not installed")
+        raise typer.Exit(1)
+
+    # Get current metadata
+    metadata = manager.registry.get(preset_id)
+    if metadata is None or not isinstance(metadata, dict):
+        console.print(f"[red]Error:[/red] Preset '{preset_id}' not found in registry (corrupted state)")
+        raise typer.Exit(1)
+
+    if metadata.get("enabled", True):
+        console.print(f"[yellow]Preset '{preset_id}' is already enabled[/yellow]")
+        raise typer.Exit(0)
+
+    # Enable the preset
+    manager.registry.update(preset_id, {"enabled": True})
+
+    console.print(f"[green]✓[/green] Preset '{preset_id}' enabled")
+    console.print("\nTemplates from this preset will now be included in resolution.")
+    console.print("[dim]Note: Previously registered commands/skills remain active.[/dim]")
+
+
+@preset_app.command("disable")
+def preset_disable(
+    preset_id: str = typer.Argument(help="Preset ID to disable"),
+):
+    """Disable a preset without removing it."""
+    from .. import _require_specify_project
+    from . import PresetManager
+
+    project_root = _require_specify_project()
+    manager = PresetManager(project_root)
+
+    # Check if preset is installed
+    if not manager.registry.is_installed(preset_id):
+        console.print(f"[red]Error:[/red] Preset '{preset_id}' is not installed")
+        raise typer.Exit(1)
+
+    # Get current metadata
+    metadata = manager.registry.get(preset_id)
+    if metadata is None or not isinstance(metadata, dict):
+        console.print(f"[red]Error:[/red] Preset '{preset_id}' not found in registry (corrupted state)")
+        raise typer.Exit(1)
+
+    if not metadata.get("enabled", True):
+        console.print(f"[yellow]Preset '{preset_id}' is already disabled[/yellow]")
+        raise typer.Exit(0)
+
+    # Disable the preset
+    manager.registry.update(preset_id, {"enabled": False})
+
+    console.print(f"[green]✓[/green] Preset '{preset_id}' disabled")
+    console.print("\nTemplates from this preset will be skipped during resolution.")
+    console.print("[dim]Note: Previously registered commands/skills remain active until preset removal.[/dim]")
+    console.print(f"To re-enable: specify preset enable {preset_id}")
+
+
+# ===== Preset Catalog Commands =====
+
+
+@preset_catalog_app.command("list")
+def preset_catalog_list():
+    """List all active preset catalogs."""
+    from .. import _display_project_path, _require_specify_project
+    from . import PresetCatalog, PresetValidationError
+
+    project_root = _require_specify_project()
+    catalog = PresetCatalog(project_root)
+
+    try:
+        active_catalogs = catalog.get_active_catalogs()
+    except PresetValidationError as e:
+        console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(1)
+
+    console.print("\n[bold cyan]Active Preset Catalogs:[/bold cyan]\n")
+    for entry in active_catalogs:
+        install_str = (
+            "[green]install allowed[/green]"
+            if entry.install_allowed
+            else "[yellow]discovery only[/yellow]"
+        )
+        console.print(f"  [bold]{entry.name}[/bold] (priority {entry.priority})")
+        if entry.description:
+            console.print(f"     {entry.description}")
+        console.print(f"     URL: {entry.url}")
+        console.print(f"     Install: {install_str}")
+        console.print()
+
+    config_path = project_root / ".specify" / "preset-catalogs.yml"
+    user_config_path = Path.home() / ".specify" / "preset-catalogs.yml"
+    if os.environ.get("SPECKIT_PRESET_CATALOG_URL"):
+        console.print("[dim]Catalog configured via SPECKIT_PRESET_CATALOG_URL environment variable.[/dim]")
+    else:
+        try:
+            proj_loaded = config_path.exists() and catalog._load_catalog_config(config_path) is not None
+        except PresetValidationError:
+            proj_loaded = False
+        if proj_loaded:
+            console.print(f"[dim]Config: {_display_project_path(project_root, config_path)}[/dim]")
+        else:
+            try:
+                user_loaded = user_config_path.exists() and catalog._load_catalog_config(user_config_path) is not None
+            except PresetValidationError:
+                user_loaded = False
+            if user_loaded:
+                console.print("[dim]Config: ~/.specify/preset-catalogs.yml[/dim]")
+            else:
+                console.print("[dim]Using built-in default catalog stack.[/dim]")
+                console.print(
+                    "[dim]Add .specify/preset-catalogs.yml to customize.[/dim]"
+                )
+
+
+@preset_catalog_app.command("add")
+def preset_catalog_add(
+    url: str = typer.Argument(help="Catalog URL (must use HTTPS)"),
+    name: str = typer.Option(..., "--name", help="Catalog name"),
+    priority: int = typer.Option(10, "--priority", help="Priority (lower = higher priority)"),
+    install_allowed: bool = typer.Option(
+        False, "--install-allowed/--no-install-allowed",
+        help="Allow presets from this catalog to be installed",
+    ),
+    description: str = typer.Option("", "--description", help="Description of the catalog"),
+):
+    """Add a catalog to .specify/preset-catalogs.yml."""
+    from .. import _display_project_path, _require_specify_project
+    from . import PresetCatalog, PresetValidationError
+
+    project_root = _require_specify_project()
+    specify_dir = project_root / ".specify"
+
+    # Validate URL
+    tmp_catalog = PresetCatalog(project_root)
+    try:
+        tmp_catalog._validate_catalog_url(url)
+    except PresetValidationError as e:
+        console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(1)
+
+    config_path = specify_dir / "preset-catalogs.yml"
+
+    # Load existing config
+    if config_path.exists():
+        try:
+            config = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+        except Exception as e:
+            config_label = _display_project_path(project_root, config_path)
+            console.print(f"[red]Error:[/red] Failed to read {config_label}: {e}")
+            raise typer.Exit(1)
+    else:
+        config = {}
+
+    catalogs = config.get("catalogs", [])
+    if not isinstance(catalogs, list):
+        console.print("[red]Error:[/red] Invalid catalog config: 'catalogs' must be a list.")
+        raise typer.Exit(1)
+
+    # Check for duplicate name
+    for existing in catalogs:
+        if isinstance(existing, dict) and existing.get("name") == name:
+            console.print(f"[yellow]Warning:[/yellow] A catalog named '{name}' already exists.")
+            console.print("Use 'specify preset catalog remove' first, or choose a different name.")
+            raise typer.Exit(1)
+
+    catalogs.append({
+        "name": name,
+        "url": url,
+        "priority": priority,
+        "install_allowed": install_allowed,
+        "description": description,
+    })
+
+    config["catalogs"] = catalogs
+    config_path.write_text(yaml.safe_dump(config, default_flow_style=False, sort_keys=False, allow_unicode=True), encoding="utf-8")
+
+    install_label = "install allowed" if install_allowed else "discovery only"
+    console.print(f"\n[green]✓[/green] Added catalog '[bold]{name}[/bold]' ({install_label})")
+    console.print(f"  URL: {url}")
+    console.print(f"  Priority: {priority}")
+    console.print(f"\nConfig saved to {_display_project_path(project_root, config_path)}")
+
+
+@preset_catalog_app.command("remove")
+def preset_catalog_remove(
+    name: str = typer.Argument(help="Catalog name to remove"),
+):
+    """Remove a catalog from .specify/preset-catalogs.yml."""
+    from .. import _require_specify_project
+
+    project_root = _require_specify_project()
+    specify_dir = project_root / ".specify"
+
+    config_path = specify_dir / "preset-catalogs.yml"
+    if not config_path.exists():
+        console.print("[red]Error:[/red] No preset catalog config found. Nothing to remove.")
+        raise typer.Exit(1)
+
+    try:
+        config = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+    except Exception:
+        console.print("[red]Error:[/red] Failed to read preset catalog config.")
+        raise typer.Exit(1)
+
+    catalogs = config.get("catalogs", [])
+    if not isinstance(catalogs, list):
+        console.print("[red]Error:[/red] Invalid catalog config: 'catalogs' must be a list.")
+        raise typer.Exit(1)
+    original_count = len(catalogs)
+    catalogs = [c for c in catalogs if isinstance(c, dict) and c.get("name") != name]
+
+    if len(catalogs) == original_count:
+        console.print(f"[red]Error:[/red] Catalog '{name}' not found.")
+        raise typer.Exit(1)
+
+    config["catalogs"] = catalogs
+    config_path.write_text(yaml.safe_dump(config, default_flow_style=False, sort_keys=False, allow_unicode=True), encoding="utf-8")
+
+    console.print(f"[green]✓[/green] Removed catalog '{name}'")
+    if not catalogs:
+        console.print("\n[dim]No catalogs remain in config. Built-in defaults will be used.[/dim]")
+
+
+def register(app: typer.Typer) -> None:
+    """Attach the preset command group to the root Typer app."""
+    app.add_typer(preset_app, name="preset")

src/specify_cli/shared_infra.py

@@ -313,6 +313,8 @@ def install_shared_infra(
         expected = prior_hashes.get(rel)
         if not expected or not dst.is_file() or dst.is_symlink():
             return False
+        if manifest.is_recovered(rel):
+            return False
         try:
             return _sha256(dst) == expected
         except OSError:

src/specify_cli/workflows/__init__.py

@@ -7,10 +7,12 @@ Provides:
 - ``STEP_REGISTRY`` — maps ``type_key`` to ``StepBase`` subclass instances.
 - ``WorkflowEngine`` — orchestrator that loads, validates, and executes
   workflow YAML definitions.
+- ``load_custom_steps`` — loads community-installed step types into STEP_REGISTRY.
 """
 
 from __future__ import annotations
 
+from pathlib import Path
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -66,3 +68,134 @@ def _register_builtin_steps() -> None:
 
 
 _register_builtin_steps()
+
+
+def load_custom_steps(project_root: Path) -> list[str]:
+    """Load community-installed custom step types into STEP_REGISTRY.
+
+    Scans ``.specify/workflows/steps/`` for installed step packages.
+    Each valid package must contain ``step.yml`` (with a ``step.type_key``
+    field) and ``__init__.py`` (a ``StepBase`` subclass).
+
+    Returns a list of type_keys that were successfully loaded.
+    Silently skips packages that fail to import or validate.
+    """
+    import hashlib as _hashlib
+    import importlib.util as _importlib_util
+    import re as _re
+    import sys as _sys
+
+    steps_dir = Path(project_root) / ".specify" / "workflows" / "steps"
+
+    # Defense-in-depth: refuse to execute step code from a symlinked
+    # parent directory under .specify/workflows/steps, which could redirect
+    # the import outside the project root and bypass the install-time
+    # symlink guard.  Check symlinks *before* is_dir() since the latter
+    # follows symlinks and would stat an external target.
+    _current = Path(project_root)
+    for _part in (".specify", "workflows", "steps"):
+        _current = _current / _part
+        if _current.is_symlink():
+            return []
+
+    if not steps_dir.is_dir():
+        return []
+
+    loaded: list[str] = []
+    for step_dir in steps_dir.iterdir():
+        # Check symlinks before is_dir() since the latter follows symlinks
+        # and would stat an external target through a symlinked directory.
+        if step_dir.is_symlink():
+            continue
+        if not step_dir.is_dir():
+            continue
+        step_yml = step_dir / "step.yml"
+        init_py = step_dir / "__init__.py"
+        if step_yml.is_symlink() or init_py.is_symlink():
+            continue
+        if not step_yml.is_file() or not init_py.is_file():
+            continue
+
+        try:
+            import yaml as _yaml
+
+            meta = _yaml.safe_load(step_yml.read_text(encoding="utf-8")) or {}
+            step_meta = meta.get("step", {})
+            type_key = step_meta.get("type_key", "")
+            if not type_key:
+                continue
+
+            # Skip if already registered (e.g. built-in or previously loaded)
+            if type_key in STEP_REGISTRY:
+                continue
+
+            # Sanitize type_key so the synthetic module name is a valid identifier
+            # (e.g. "test-custom" → "_speckit_custom_step_test_custom_<hash>").
+            # The 8-char SHA-256 hash of the original type_key makes the name
+            # collision-resistant when different type_keys produce the same
+            # sanitized form (e.g. "a-b" and "a_b" both sanitize to "a_b" but
+            # have different hashes).
+            safe_key = _re.sub(r"[^A-Za-z0-9_]", "_", type_key)
+            key_hash = _hashlib.sha256(type_key.encode()).hexdigest()[:8]
+            module_name = f"_speckit_custom_step_{safe_key}_{key_hash}"
+
+            # Treat the step directory as a proper package so that relative
+            # imports inside the step (e.g. ``from .helpers import …``) work.
+            spec = _importlib_util.spec_from_file_location(
+                module_name,
+                init_py,
+                submodule_search_locations=[str(step_dir)],
+            )
+            if spec is None or spec.loader is None:
+                continue
+            module = _importlib_util.module_from_spec(spec)
+            module.__package__ = module_name
+            # Register before exec so relative imports resolve correctly.
+            _sys.modules[module_name] = module
+            registered = False
+            try:
+                spec.loader.exec_module(module)  # type: ignore[union-attr]
+
+                # Find the StepBase subclass in the module
+                from .base import StepBase as _StepBase
+
+                step_class = None
+                for attr_name in dir(module):
+                    attr = getattr(module, attr_name)
+                    try:
+                        if (
+                            isinstance(attr, type)
+                            and issubclass(attr, _StepBase)
+                            and attr is not _StepBase
+                            and getattr(attr, "type_key", "") == type_key
+                        ):
+                            step_class = attr
+                            break
+                    except TypeError:
+                        continue
+
+                if step_class is None:
+                    continue
+
+                _register_step(step_class())
+                loaded.append(type_key)
+                registered = True
+            finally:
+                # If the step wasn't successfully registered (failed import,
+                # no matching StepBase subclass, or registration error), remove
+                # the synthetic module — and any submodules loaded via relative
+                # imports (e.g. ``from .helpers import …``) — from sys.modules so
+                # a broken/skipped step package leaves no lingering import state
+                # behind.
+                if not registered:
+                    _sys.modules.pop(module_name, None)
+                    submodule_prefix = module_name + "."
+                    for _mod_key in [
+                        k for k in _sys.modules if k.startswith(submodule_prefix)
+                    ]:
+                        _sys.modules.pop(_mod_key, None)
+        except Exception:  # noqa: BLE001
+            # Silently skip broken step packages at load time
+            continue
+
+    return loaded

src/specify_cli/workflows/catalog.py

@@ -1,9 +1,10 @@
-"""Workflow catalog — discovery, install, and management of workflows.
+"""Workflow catalog — discovery, install, and management of workflows and step types.
 
 Mirrors the existing extension/preset catalog pattern with:
 - Multi-catalog stack (env var → project → user → built-in)
 - SHA256-hashed per-URL caching with 1-hour TTL
 - Workflow registry for installed workflow tracking
+- Step registry for installed custom step type tracking
 - Search across all configured catalog sources
 """
 
@@ -165,7 +166,7 @@ class WorkflowCatalog:
                 f"Catalog URL must use HTTPS (got {parsed.scheme}://). "
                 "HTTP is only allowed for localhost."
             )
-        if not parsed.netloc:
+        if not parsed.hostname:
             raise WorkflowValidationError(
                 "Catalog URL must be a valid URL with a host."
             )
@@ -181,6 +182,11 @@ class WorkflowCatalog:
         except (yaml.YAMLError, OSError, UnicodeError) as exc:
             raise WorkflowValidationError(
                 f"Failed to read catalog config {config_path}: {exc}"
+            ) from exc
+        if not isinstance(data, dict):
+            raise WorkflowValidationError(
+                f"Invalid catalog config: expected a mapping, "
+                f"got {type(data).__name__}"
             )
         catalogs_data = data.get("catalogs", [])
         if not catalogs_data:
@@ -302,9 +308,9 @@ class WorkflowCatalog:
         try:
             with open(meta_file, encoding="utf-8") as f:
                 meta = json.load(f)
-            fetched_at = meta.get("fetched_at", 0)
+            fetched_at = float(meta.get("fetched_at", 0))
             return (time.time() - fetched_at) < self.CACHE_DURATION
-        except (json.JSONDecodeError, OSError):
+        except (json.JSONDecodeError, OSError, TypeError, ValueError):
             return False
 
     def _fetch_single_catalog(
@@ -318,6 +324,7 @@ class WorkflowCatalog:
                 with open(cache_file, encoding="utf-8") as f:
                     return json.load(f)
             except (json.JSONDecodeError, OSError):
+                # Ignore invalid/unreadable cache and fall back to fetching from source.
                 pass
 
         # Fetch from URL — validate scheme before opening and after redirects
@@ -333,6 +340,10 @@ class WorkflowCatalog:
                 raise WorkflowCatalogError(
                     f"Refusing to fetch catalog from non-HTTPS URL: {url}"
                 )
+            if not parsed.hostname:
+                raise WorkflowCatalogError(
+                    f"Refusing to fetch catalog from URL with no hostname: {url}"
+                )
 
         _validate_catalog_url(entry.url)
 
@@ -347,6 +358,7 @@ class WorkflowCatalog:
                     with open(cache_file, encoding="utf-8") as f:
                         return json.load(f)
                 except (json.JSONDecodeError, ValueError, OSError):
+                    # Stale-cache read failed; let the original fetch error propagate.
                     pass
             raise WorkflowCatalogError(
                 f"Failed to fetch catalog from {entry.url}: {exc}"
@@ -358,11 +370,14 @@ class WorkflowCatalog:
             )
 
         # Write cache
-        self.cache_dir.mkdir(parents=True, exist_ok=True)
-        with open(cache_file, "w", encoding="utf-8") as f:
-            json.dump(data, f, indent=2)
-        with open(meta_file, "w", encoding="utf-8") as f:
-            json.dump({"url": entry.url, "fetched_at": time.time()}, f)
+        try:
+            self.cache_dir.mkdir(parents=True, exist_ok=True)
+            with open(cache_file, "w", encoding="utf-8") as f:
+                json.dump(data, f, indent=2)
+            with open(meta_file, "w", encoding="utf-8") as f:
+                json.dump({"url": entry.url, "fetched_at": time.time()}, f)
+        except OSError:
+            pass  # Proceed without caching if disk write fails
 
         return data
 
@@ -468,7 +483,14 @@ class WorkflowCatalog:
 
         data: dict[str, Any] = {"catalogs": []}
         if config_path.exists():
-            raw = yaml.safe_load(config_path.read_text(encoding="utf-8"))
+            try:
+                raw = yaml.safe_load(config_path.read_text(encoding="utf-8"))
+            except (yaml.YAMLError, OSError, UnicodeDecodeError) as exc:
+                raise WorkflowValidationError(
+                    f"Catalog config file is unreadable or malformed: {exc}"
+                ) from exc
+            if raw is None:
+                raw = {"catalogs": []}
             if not isinstance(raw, dict):
                 raise WorkflowValidationError(
                     "Catalog config file is corrupted (expected a mapping)."
@@ -487,9 +509,21 @@ class WorkflowCatalog:
                     f"Catalog URL already configured: {url}"
                 )
 
-        # Derive priority from the highest existing priority + 1
+        # Derive priority from the highest existing priority + 1.
+        # Coerce existing priorities to int with a safe fallback so a user-edited
+        # workflow-catalogs.yml with a non-integer priority (e.g. "1") doesn't blow up.
+        def _coerce_priority(value: Any) -> int:
+            try:
+                return int(value)
+            except (TypeError, ValueError):
+                return 0
+
         max_priority = max(
-            (cat.get("priority", 0) for cat in catalogs if isinstance(cat, dict)),
+            (
+                _coerce_priority(cat.get("priority", 0))
+                for cat in catalogs
+                if isinstance(cat, dict)
+            ),
             default=0,
         )
         catalogs.append(
@@ -503,9 +537,14 @@ class WorkflowCatalog:
         )
         data["catalogs"] = catalogs
 
-        config_path.parent.mkdir(parents=True, exist_ok=True)
-        with open(config_path, "w", encoding="utf-8") as f:
-            yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
+        try:
+            config_path.parent.mkdir(parents=True, exist_ok=True)
+            with open(config_path, "w", encoding="utf-8") as f:
+                yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
+        except OSError as exc:
+            raise WorkflowValidationError(
+                f"Failed to write catalog config {config_path}: {exc}"
+            ) from exc
 
     def remove_catalog(self, index: int) -> str:
         """Remove a catalog source by index (0-based). Returns the removed name."""
@@ -513,7 +552,12 @@ class WorkflowCatalog:
         if not config_path.exists():
             raise WorkflowValidationError("No catalog config file found.")
 
-        data = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+        try:
+            data = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+        except (yaml.YAMLError, OSError, UnicodeDecodeError) as exc:
+            raise WorkflowValidationError(
+                f"Catalog config file is unreadable or malformed: {exc}"
+            ) from exc
         if not isinstance(data, dict):
             raise WorkflowValidationError(
                 "Catalog config file is corrupted (expected a mapping)."
@@ -532,8 +576,623 @@ class WorkflowCatalog:
         removed = catalogs.pop(index)
         data["catalogs"] = catalogs
 
-        with open(config_path, "w", encoding="utf-8") as f:
-            yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
+        try:
+            with open(config_path, "w", encoding="utf-8") as f:
+                yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
+        except OSError as exc:
+            raise WorkflowValidationError(
+                f"Failed to write catalog config {config_path}: {exc}"
+            ) from exc
+
+        if isinstance(removed, dict):
+            return removed.get("name", f"catalog-{index + 1}")
+        return f"catalog-{index + 1}"
+
+
+# ---------------------------------------------------------------------------
+# Step catalog errors
+# ---------------------------------------------------------------------------
+
+
+class StepCatalogError(Exception):
+    """Base error for step catalog operations."""
+
+
+class StepValidationError(StepCatalogError):
+    """Validation error for step catalog config or step data."""
+
+
+# ---------------------------------------------------------------------------
+# StepCatalogEntry
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class StepCatalogEntry:
+    """Represents a single step catalog source in the catalog stack."""
+
+    url: str
+    name: str
+    priority: int
+    install_allowed: bool
+    description: str = ""
+
+
+# ---------------------------------------------------------------------------
+# StepRegistry
+# ---------------------------------------------------------------------------
+
+
+class StepRegistry:
+    """Manages the registry of installed custom step types.
+
+    Tracks installed step types and their metadata in
+    ``.specify/workflows/steps/step-registry.json``.
+    """
+
+    REGISTRY_FILE = "step-registry.json"
+    SCHEMA_VERSION = "1.0"
+
+    def __init__(self, project_root: Path) -> None:
+        self.project_root = project_root
+        self.steps_dir = project_root / ".specify" / "workflows" / "steps"
+        self.registry_path = self.steps_dir / self.REGISTRY_FILE
+        self.data = self._load()
+
+    def _has_symlinked_parent(self) -> bool:
+        """Return True if any directory under .specify/workflows/steps is a symlink."""
+        current = self.project_root
+        for part in (".specify", "workflows", "steps"):
+            current = current / part
+            if current.is_symlink():
+                return True
+        return False
+
+    def _load(self) -> dict[str, Any]:
+        """Load registry from disk or create default."""
+        default_registry: dict[str, Any] = {"schema_version": self.SCHEMA_VERSION, "steps": {}}
+        # Defense-in-depth: refuse to read the registry if any parent directory
+        # under .specify/workflows/steps is a symlink, which could redirect the
+        # read outside the project root.
+        if self._has_symlinked_parent():
+            return default_registry
+        # Defense-in-depth: also refuse to read a symlinked registry file,
+        # which could redirect the read outside the project root.
+        if self.registry_path.is_symlink():
+            return default_registry
+        if self.registry_path.exists():
+            try:
+                with open(self.registry_path, encoding="utf-8") as f:
+                    data = json.load(f)
+                # Validate shape: must be a dict with a dict "steps" field
+                if not isinstance(data, dict):
+                    return default_registry
+                if not isinstance(data.get("steps"), dict):
+                    data["steps"] = {}
+                return data
+            except (json.JSONDecodeError, ValueError, OSError, UnicodeError):
+                return default_registry
+        return default_registry
+
+    def save(self) -> None:
+        """Persist registry to disk.
+
+        Raises ``StepValidationError`` with a clear message on filesystem
+        errors (read-only fs, permission denied, ...) so callers can surface
+        a clean error to the user rather than an unhandled ``OSError``.
+        """
+        if self._has_symlinked_parent() or self.registry_path.is_symlink():
+            raise StepValidationError(
+                "Refusing to write step registry through a symlinked path."
+            )
+        try:
+            self.steps_dir.mkdir(parents=True, exist_ok=True)
+            with open(self.registry_path, "w", encoding="utf-8") as f:
+                json.dump(self.data, f, indent=2)
+        except OSError as exc:
+            raise StepValidationError(
+                f"Failed to write step registry at {self.registry_path}: {exc}"
+            ) from exc
+
+    def add(self, step_id: str, metadata: dict[str, Any]) -> None:
+        """Add or update an installed step entry."""
+        import copy
+        from datetime import datetime, timezone
+
+        existing = self.data["steps"].get(step_id, {})
+        metadata_to_store = copy.deepcopy(metadata)
+        metadata_to_store["installed_at"] = existing.get(
+            "installed_at", datetime.now(timezone.utc).isoformat()
+        )
+        metadata_to_store["updated_at"] = datetime.now(timezone.utc).isoformat()
+        self.data["steps"][step_id] = metadata_to_store
+        self.save()
+
+    def remove(self, step_id: str) -> bool:
+        """Remove an installed step entry. Returns True if found."""
+        if step_id in self.data["steps"]:
+            del self.data["steps"][step_id]
+            self.save()
+            return True
+        return False
+
+    def get(self, step_id: str) -> dict[str, Any] | None:
+        """Get metadata for an installed step."""
+        return self.data["steps"].get(step_id)
+
+    def list(self) -> dict[str, dict[str, Any]]:
+        """Return all installed steps."""
+        return dict(self.data["steps"])
+
+    def is_installed(self, step_id: str) -> bool:
+        """Check if a step is installed."""
+        return step_id in self.data["steps"]
+
+
+# ---------------------------------------------------------------------------
+# StepCatalog
+# ---------------------------------------------------------------------------
+
+
+class StepCatalog:
+    """Manages step catalog fetching, caching, and searching.
+
+    Resolution order for catalog sources:
+    1. ``SPECKIT_STEP_CATALOG_URL`` env var (overrides all)
+    2. Project-level ``.specify/step-catalogs.yml``
+    3. User-level ``~/.specify/step-catalogs.yml``
+    4. Built-in defaults (official + community)
+    """
+
+    DEFAULT_CATALOG_URL = (
+        "https://raw.githubusercontent.com/github/spec-kit/main/"
+        "workflows/step-catalog.json"
+    )
+    COMMUNITY_CATALOG_URL = (
+        "https://raw.githubusercontent.com/github/spec-kit/main/"
+        "workflows/step-catalog.community.json"
+    )
+    CACHE_DURATION = 3600  # 1 hour
+
+    def __init__(self, project_root: Path) -> None:
+        self.project_root = project_root
+        self.steps_dir = project_root / ".specify" / "workflows" / "steps"
+        self.cache_dir = self.steps_dir / ".cache"
+
+    def _is_cache_path_safe(self) -> bool:
+        """Return False if any component of the cache path is a symlink."""
+        current = self.project_root
+        for part in (".specify", "workflows", "steps", ".cache"):
+            current = current / part
+            if current.is_symlink():
+                return False
+        return True
+
+    # -- Catalog resolution -----------------------------------------------
+
+    def _validate_catalog_url(self, url: str) -> None:
+        """Validate that a catalog URL uses HTTPS (localhost HTTP allowed)."""
+        from urllib.parse import urlparse
+
+        parsed = urlparse(url)
+        is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
+        if parsed.scheme != "https" and not (
+            parsed.scheme == "http" and is_localhost
+        ):
+            raise StepValidationError(
+                f"Catalog URL must use HTTPS (got {parsed.scheme}://). "
+                "HTTP is only allowed for localhost."
+            )
+        if not parsed.hostname:
+            raise StepValidationError(
+                "Catalog URL must be a valid URL with a host."
+            )
+
+    def _load_catalog_config(
+        self, config_path: Path
+    ) -> list[StepCatalogEntry] | None:
+        """Load catalog stack configuration from a YAML file."""
+        if not config_path.exists():
+            return None
+        try:
+            data = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+        except (yaml.YAMLError, OSError, UnicodeError) as exc:
+            raise StepValidationError(
+                f"Failed to read catalog config {config_path}: {exc}"
+            ) from exc
+        if not isinstance(data, dict):
+            raise StepValidationError(
+                f"Invalid catalog config: expected a mapping, "
+                f"got {type(data).__name__}"
+            )
+        catalogs_data = data.get("catalogs", [])
+        if not catalogs_data:
+            return None
+        if not isinstance(catalogs_data, list):
+            raise StepValidationError(
+                f"Invalid catalog config: 'catalogs' must be a list, "
+                f"got {type(catalogs_data).__name__}"
+            )
+
+        entries: list[StepCatalogEntry] = []
+        for idx, item in enumerate(catalogs_data):
+            if not isinstance(item, dict):
+                raise StepValidationError(
+                    f"Invalid catalog entry at index {idx}: "
+                    f"expected a mapping, got {type(item).__name__}"
+                )
+            url = str(item.get("url", "")).strip()
+            if not url:
+                continue
+            self._validate_catalog_url(url)
+            try:
+                priority = int(item.get("priority", idx + 1))
+            except (TypeError, ValueError):
+                raise StepValidationError(
+                    f"Invalid priority for catalog "
+                    f"'{item.get('name', idx + 1)}': "
+                    f"expected integer, got {item.get('priority')!r}"
+                )
+            raw_install = item.get("install_allowed", False)
+            if isinstance(raw_install, str):
+                install_allowed = raw_install.strip().lower() in (
+                    "true",
+                    "yes",
+                    "1",
+                )
+            else:
+                install_allowed = bool(raw_install)
+            entries.append(
+                StepCatalogEntry(
+                    url=url,
+                    name=str(item.get("name", f"catalog-{idx + 1}")),
+                    priority=priority,
+                    install_allowed=install_allowed,
+                    description=str(item.get("description", "")),
+                )
+            )
+        entries.sort(key=lambda e: e.priority)
+        if not entries:
+            raise StepValidationError(
+                f"Catalog config {config_path} contains {len(catalogs_data)} "
+                f"entries but none have valid URLs."
+            )
+        return entries
+
+    def get_active_catalogs(self) -> list[StepCatalogEntry]:
+        """Get the ordered list of active step catalogs."""
+        # 1. Environment variable override
+        env_url = os.environ.get("SPECKIT_STEP_CATALOG_URL", "").strip()
+        if env_url:
+            self._validate_catalog_url(env_url)
+            return [
+                StepCatalogEntry(
+                    url=env_url,
+                    name="env-override",
+                    priority=1,
+                    install_allowed=True,
+                    description="From SPECKIT_STEP_CATALOG_URL",
+                )
+            ]
+
+        # 2. Project-level config
+        project_config = self.project_root / ".specify" / "step-catalogs.yml"
+        project_entries = self._load_catalog_config(project_config)
+        if project_entries is not None:
+            return project_entries
+
+        # 3. User-level config
+        home = Path.home()
+        user_config = home / ".specify" / "step-catalogs.yml"
+        user_entries = self._load_catalog_config(user_config)
+        if user_entries is not None:
+            return user_entries
+
+        # 4. Built-in defaults
+        return [
+            StepCatalogEntry(
+                url=self.DEFAULT_CATALOG_URL,
+                name="default",
+                priority=1,
+                install_allowed=True,
+                description="Official step types",
+            ),
+            StepCatalogEntry(
+                url=self.COMMUNITY_CATALOG_URL,
+                name="community",
+                priority=2,
+                install_allowed=False,
+                description="Community-contributed step types (discovery only)",
+            ),
+        ]
+
+    # -- Caching ----------------------------------------------------------
+
+    def _get_cache_paths(self, url: str) -> tuple[Path, Path]:
+        """Get cache file paths for a URL (hash-based)."""
+        url_hash = hashlib.sha256(url.encode()).hexdigest()[:16]
+        cache_file = self.cache_dir / f"step-catalog-{url_hash}.json"
+        meta_file = self.cache_dir / f"step-catalog-{url_hash}-meta.json"
+        return cache_file, meta_file
+
+    def _is_url_cache_valid(self, url: str) -> bool:
+        """Check if cached data for a URL is still fresh."""
+        _, meta_file = self._get_cache_paths(url)
+        if not meta_file.exists():
+            return False
+        try:
+            with open(meta_file, encoding="utf-8") as f:
+                meta = json.load(f)
+            fetched_at = float(meta.get("fetched_at", 0))
+            return (time.time() - fetched_at) < self.CACHE_DURATION
+        except (json.JSONDecodeError, OSError, TypeError, ValueError):
+            return False
+
+    def _fetch_single_catalog(
+        self, entry: StepCatalogEntry, force_refresh: bool = False
+    ) -> dict[str, Any]:
+        """Fetch a single catalog, using cache when possible."""
+        cache_safe = self._is_cache_path_safe()
+        cache_file, meta_file = self._get_cache_paths(entry.url)
+
+        if cache_safe and not force_refresh and self._is_url_cache_valid(entry.url):
+            try:
+                with open(cache_file, encoding="utf-8") as f:
+                    cached = json.load(f)
+                if isinstance(cached, dict):
+                    return cached
+            except (json.JSONDecodeError, OSError):
+                # Ignore invalid/unreadable cache and fall back to fetching from source.
+                pass
+
+        from urllib.parse import urlparse
+        from specify_cli.authentication.http import open_url as _open_url
+
+        def _validate_url(url: str) -> None:
+            parsed = urlparse(url)
+            is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
+            if parsed.scheme != "https" and not (
+                parsed.scheme == "http" and is_localhost
+            ):
+                raise StepCatalogError(
+                    f"Refusing to fetch catalog from non-HTTPS URL: {url}"
+                )
+            if not parsed.hostname:
+                raise StepCatalogError(
+                    f"Refusing to fetch catalog from URL with no hostname: {url}"
+                )
+
+        _validate_url(entry.url)
+
+        try:
+            with _open_url(entry.url, timeout=30) as resp:
+                _validate_url(resp.geturl())
+                data = json.loads(resp.read().decode("utf-8"))
+        except Exception as exc:
+            if cache_safe and cache_file.exists():
+                try:
+                    with open(cache_file, encoding="utf-8") as f:
+                        cached = json.load(f)
+                    if isinstance(cached, dict):
+                        return cached
+                except (json.JSONDecodeError, ValueError, OSError):
+                    # Stale-cache read failed; let the original fetch error propagate.
+                    pass
+            raise StepCatalogError(
+                f"Failed to fetch catalog from {entry.url}: {exc}"
+            ) from exc
+
+        if not isinstance(data, dict):
+            raise StepCatalogError(
+                f"Catalog from {entry.url} is not a valid JSON object."
+            )
+
+        if cache_safe:
+            try:
+                self.cache_dir.mkdir(parents=True, exist_ok=True)
+                with open(cache_file, "w", encoding="utf-8") as f:
+                    json.dump(data, f, indent=2)
+                with open(meta_file, "w", encoding="utf-8") as f:
+                    json.dump({"url": entry.url, "fetched_at": time.time()}, f)
+            except OSError:
+                pass  # Proceed without caching if disk write fails
+
+        return data
+
+    def _get_merged_steps(
+        self, force_refresh: bool = False
+    ) -> dict[str, dict[str, Any]]:
+        """Merge steps from all active catalogs (lower priority number wins)."""
+        catalogs = self.get_active_catalogs()
+        merged: dict[str, dict[str, Any]] = {}
+        fetch_errors = 0
+
+        for entry in reversed(catalogs):
+            try:
+                data = self._fetch_single_catalog(entry, force_refresh)
+            except StepCatalogError:
+                fetch_errors += 1
+                continue
+            steps = data.get("steps", {})
+            if isinstance(steps, dict):
+                for step_id, step_data in steps.items():
+                    if not isinstance(step_data, dict):
+                        continue
+                    step_data["_catalog_name"] = entry.name
+                    step_data["_install_allowed"] = entry.install_allowed
+                    merged[step_id] = step_data
+            elif isinstance(steps, list):
+                for step_data in steps:
+                    if not isinstance(step_data, dict):
+                        continue
+                    raw_step_id = step_data.get("id")
+                    if raw_step_id is None:
+                        continue
+                    step_id = str(raw_step_id).strip()
+                    if step_id:
+                        step_data["id"] = step_id
+                        step_data["_catalog_name"] = entry.name
+                        step_data["_install_allowed"] = entry.install_allowed
+                        merged[step_id] = step_data
+        if fetch_errors == len(catalogs) and catalogs:
+            raise StepCatalogError("All configured step catalogs failed to fetch.")
+        return merged
+
+    # -- Public API -------------------------------------------------------
+
+    def search(
+        self,
+        query: str | None = None,
+    ) -> list[dict[str, Any]]:
+        """Search step types across all configured catalogs."""
+        merged = self._get_merged_steps()
+        results: list[dict[str, Any]] = []
+
+        for step_id, step_data in merged.items():
+            step_data.setdefault("id", step_id)
+            if query:
+                q = query.lower()
+                searchable = " ".join(
+                    [
+                        str(step_data.get("name") or ""),
+                        str(step_data.get("description") or ""),
+                        str(step_data.get("id") or ""),
+                    ]
+                ).lower()
+                if q not in searchable:
+                    continue
+            results.append(step_data)
+        return results
+
+    def get_step_info(self, step_id: str) -> dict[str, Any] | None:
+        """Get details for a specific step from the catalog."""
+        merged = self._get_merged_steps()
+        step = merged.get(step_id)
+        if step:
+            step.setdefault("id", step_id)
+        return step
+
+    def get_catalog_configs(self) -> list[dict[str, Any]]:
+        """Return current catalog configuration as a list of dicts."""
+        entries = self.get_active_catalogs()
+        return [
+            {
+                "name": e.name,
+                "url": e.url,
+                "priority": e.priority,
+                "install_allowed": e.install_allowed,
+                "description": e.description,
+            }
+            for e in entries
+        ]
+
+    def add_catalog(self, url: str, name: str | None = None) -> None:
+        """Add a catalog source to the project-level config."""
+        self._validate_catalog_url(url)
+        config_path = self.project_root / ".specify" / "step-catalogs.yml"
+
+        data: dict[str, Any] = {"catalogs": []}
+        if config_path.exists():
+            try:
+                raw = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+            except (yaml.YAMLError, OSError, UnicodeDecodeError) as exc:
+                raise StepValidationError(
+                    f"Catalog config file is unreadable or malformed: {exc}"
+                ) from exc
+            if not isinstance(raw, dict):
+                raise StepValidationError(
+                    "Catalog config file is corrupted (expected a mapping)."
+                )
+            data = raw
+
+        catalogs = data.get("catalogs", [])
+        if not isinstance(catalogs, list):
+            raise StepValidationError(
+                "Catalog config 'catalogs' must be a list."
+            )
+        for cat in catalogs:
+            if isinstance(cat, dict) and cat.get("url") == url:
+                raise StepValidationError(
+                    f"Catalog URL already configured: {url}"
+                )
+
+        # Coerce existing priorities to int with a safe fallback so a user-edited
+        # step-catalogs.yml with a non-integer priority (e.g. "1") doesn't blow up.
+        def _coerce_priority(value: Any) -> int:
+            try:
+                return int(value)
+            except (TypeError, ValueError):
+                return 0
+
+        max_priority = max(
+            (
+                _coerce_priority(cat.get("priority", 0))
+                for cat in catalogs
+                if isinstance(cat, dict)
+            ),
+            default=0,
+        )
+        catalogs.append(
+            {
+                "name": name or f"catalog-{len(catalogs) + 1}",
+                "url": url,
+                "priority": max_priority + 1,
+                "install_allowed": True,
+                "description": "",
+            }
+        )
+        data["catalogs"] = catalogs
+
+        try:
+            config_path.parent.mkdir(parents=True, exist_ok=True)
+            with open(config_path, "w", encoding="utf-8") as f:
+                yaml.dump(
+                    data, f, default_flow_style=False, sort_keys=False, allow_unicode=True
+                )
+        except OSError as exc:
+            raise StepValidationError(
+                f"Failed to write catalog config {config_path}: {exc}"
+            ) from exc
+
+    def remove_catalog(self, index: int) -> str:
+        """Remove a catalog source by index (0-based). Returns the removed name."""
+        config_path = self.project_root / ".specify" / "step-catalogs.yml"
+        if not config_path.exists():
+            raise StepValidationError("No step catalog config file found.")
+
+        try:
+            data = yaml.safe_load(config_path.read_text(encoding="utf-8")) or {}
+        except (yaml.YAMLError, OSError, UnicodeDecodeError) as exc:
+            raise StepValidationError(
+                f"Catalog config file is unreadable or malformed: {exc}"
+            ) from exc
+        if not isinstance(data, dict):
+            raise StepValidationError(
+                "Catalog config file is corrupted (expected a mapping)."
+            )
+        catalogs = data.get("catalogs", [])
+        if not isinstance(catalogs, list):
+            raise StepValidationError(
+                "Catalog config 'catalogs' must be a list."
+            )
+
+        if index < 0 or index >= len(catalogs):
+            raise StepValidationError(
+                f"Catalog index {index} out of range (0-{len(catalogs) - 1})."
+            )
+
+        removed = catalogs.pop(index)
+        data["catalogs"] = catalogs
+
+        try:
+            with open(config_path, "w", encoding="utf-8") as f:
+                yaml.dump(
+                    data, f, default_flow_style=False, sort_keys=False, allow_unicode=True
+                )
+        except OSError as exc:
+            raise StepValidationError(
+                f"Failed to write catalog config {config_path}: {exc}"
+            ) from exc
 
         if isinstance(removed, dict):
             return removed.get("name", f"catalog-{index + 1}")

src/specify_cli/workflows/steps/fan_out/__init__.py

@@ -22,12 +22,28 @@ class FanOutStep(StepBase):
     def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
         items_expr = config.get("items", "[]")
         items = evaluate_expression(items_expr, context)
-        if not isinstance(items, list):
-            items = []
-
         max_concurrency = config.get("max_concurrency", 1)
         step_template = config.get("step", {})
 
+        if not isinstance(items, list):
+            # A non-list here is a wiring error (the expression did not
+            # resolve to a collection); silently fanning out over zero
+            # items hides it. An explicit empty list remains valid input.
+            return StepResult(
+                status=StepStatus.FAILED,
+                error=(
+                    f"Fan-out step {config.get('id', '?')!r}: 'items' must "
+                    f"resolve to a list, got {type(items).__name__} from "
+                    f"{items_expr!r}."
+                ),
+                output={
+                    "items": [],
+                    "max_concurrency": max_concurrency,
+                    "step_template": step_template,
+                    "item_count": 0,
+                },
+            )
+
         return StepResult(
             status=StepStatus.COMPLETED,
             output={

src/specify_cli/workflows/steps/shell/__init__.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import subprocess
 from typing import Any
 
@@ -49,6 +50,23 @@ class ShellStep(StepBase):
                     error=f"Shell command exited with code {proc.returncode}.",
                     output=output,
                 )
+            if config.get("output_format") == "json":
+                # Opt-in structured output: expose the parsed stdout under
+                # ``output.data`` so later steps can consume typed values
+                # (e.g. a fan-out's ``items:``). A parse failure fails the
+                # step — declaring ``output_format: json`` is a contract.
+                try:
+                    output["data"] = json.loads(proc.stdout)
+                except json.JSONDecodeError as exc:
+                    return StepResult(
+                        status=StepStatus.FAILED,
+                        error=(
+                            f"Shell step {config.get('id', '?')!r} declared "
+                            f"output_format: json but stdout is not valid "
+                            f"JSON: {exc}"
+                        ),
+                        output=output,
+                    )
             return StepResult(
                 status=StepStatus.COMPLETED,
                 output=output,
@@ -72,4 +90,10 @@ class ShellStep(StepBase):
             errors.append(
                 f"Shell step {config.get('id', '?')!r} is missing 'run' field."
             )
+        output_format = config.get("output_format")
+        if output_format is not None and output_format != "json":
+            errors.append(
+                f"Shell step {config.get('id', '?')!r}: 'output_format' must "
+                f"be 'json' when present, got {output_format!r}."
+            )
         return errors

tests/integrations/test_integration_claude.py

@@ -66,6 +66,16 @@ class TestClaudeIntegration:
         assert parsed["disable-model-invocation"] is False
         assert parsed["metadata"]["source"] == "templates/commands/plan.md"
 
+    def test_render_skill_unicode(self):
+        """Test rendering a skill preserves non-ASCII characters."""
+        integration = get_integration("claude")
+        rendered = integration._render_skill(
+            "constitution",
+            {"description": "Prüfe Konformität der Implementierung"},
+            "Body",
+        )
+        assert "Prüfe Konformität" in rendered
+
     def test_setup_upserts_context_section(self, tmp_path):
         integration = get_integration("claude")
         manifest = IntegrationManifest("claude", tmp_path)

tests/integrations/test_integration_scaffold.py

@@ -0,0 +1,238 @@
+"""Tests for integration scaffolding commands."""
+
+from pathlib import Path
+
+import pytest
+from typer.testing import CliRunner
+
+from specify_cli import app
+from specify_cli.integration_scaffold import scaffold_integration
+from tests.conftest import strip_ansi
+
+
+runner = CliRunner()
+
+
+def _repo_root(tmp_path: Path) -> Path:
+    root = tmp_path / "spec-kit"
+    (root / "src" / "specify_cli" / "integrations").mkdir(parents=True)
+    (root / "tests" / "integrations").mkdir(parents=True)
+    (root / "pyproject.toml").write_text("[project]\nname = \"specify-cli\"\n", encoding="utf-8")
+    (root / "src" / "specify_cli" / "__init__.py").write_text("", encoding="utf-8")
+    (root / "src" / "specify_cli" / "integrations" / "__init__.py").write_text(
+        "",
+        encoding="utf-8",
+    )
+    return root
+
+
+def test_integration_scaffold_creates_markdown_files(tmp_path, monkeypatch):
+    root = _repo_root(tmp_path)
+    monkeypatch.chdir(root)
+
+    result = runner.invoke(app, [
+        "integration", "scaffold", "my-agent",
+        "--type", "markdown",
+    ], catch_exceptions=False)
+
+    output = strip_ansi(result.output)
+    integration_file = root / "src" / "specify_cli" / "integrations" / "my_agent" / "__init__.py"
+    test_file = root / "tests" / "integrations" / "test_integration_my_agent.py"
+
+    assert result.exit_code == 0
+    assert integration_file.exists()
+    assert test_file.exists()
+    assert "Created integration scaffold: my-agent" in output
+    assert "Register MyAgentIntegration" in output
+
+    content = integration_file.read_text(encoding="utf-8")
+    assert "class MyAgentIntegration(MarkdownIntegration):" in content
+    assert 'key = "my-agent"' in content
+    assert '"folder": ".my-agent/"' in content
+    assert '"extension": ".md"' in content
+    assert "multi_install_safe = False" in content
+
+    test_content = test_file.read_text(encoding="utf-8")
+    assert "from specify_cli.integrations.my_agent import MyAgentIntegration" in test_content
+    assert 'assert integration.registrar_config["dir"] == ".my-agent/commands"' in test_content
+    assert "assert integration.multi_install_safe is False" in test_content
+
+
+@pytest.mark.parametrize(
+    ("integration_type", "base_class", "commands_subdir", "args", "extension"),
+    [
+        ("markdown", "MarkdownIntegration", "commands", "$ARGUMENTS", ".md"),
+        ("toml", "TomlIntegration", "commands", "{{args}}", ".toml"),
+        ("yaml", "YamlIntegration", "recipes", "{{args}}", ".yaml"),
+        ("skills", "SkillsIntegration", "skills", "$ARGUMENTS", "/SKILL.md"),
+    ],
+)
+def test_scaffold_type_templates(
+    tmp_path,
+    integration_type,
+    base_class,
+    commands_subdir,
+    args,
+    extension,
+):
+    root = _repo_root(tmp_path)
+
+    result = scaffold_integration(root, f"{integration_type}-agent", integration_type)
+
+    content = result.integration_file.read_text(encoding="utf-8")
+    assert f"class {result.class_name}({base_class}):" in content
+    assert f'"commands_subdir": "{commands_subdir}"' in content
+    assert f'"args": "{args}"' in content
+    assert f'"extension": "{extension}"' in content
+    assert "multi_install_safe = False" in content
+
+
+def test_integration_scaffold_rejects_unknown_type_before_scaffolding(tmp_path, monkeypatch):
+    root = _repo_root(tmp_path)
+    monkeypatch.chdir(root)
+
+    result = runner.invoke(app, [
+        "integration", "scaffold", "my-agent",
+        "--type", "xml",
+    ])
+
+    output = strip_ansi(result.output)
+    assert result.exit_code == 2
+    assert "Invalid value for '--type'" in output
+    assert not (root / "src" / "specify_cli" / "integrations" / "my_agent").exists()
+
+
+def test_integration_scaffold_reports_filesystem_errors_cleanly(tmp_path, monkeypatch):
+    root = _repo_root(tmp_path)
+    monkeypatch.chdir(root)
+
+    import specify_cli.integration_scaffold as scaffold_module
+
+    def boom(*args, **kwargs):
+        raise PermissionError("Permission denied: read-only checkout")
+
+    monkeypatch.setattr(scaffold_module, "scaffold_integration", boom)
+
+    result = runner.invoke(app, [
+        "integration", "scaffold", "my-agent",
+        "--type", "markdown",
+    ], catch_exceptions=False)
+
+    output = strip_ansi(result.output)
+    assert result.exit_code == 1
+    assert "Error:" in output
+    assert "Permission denied" in output
+
+
+def test_scaffold_refuses_invalid_key(tmp_path):
+    root = _repo_root(tmp_path)
+
+    with pytest.raises(ValueError, match="lowercase kebab-case"):
+        scaffold_integration(root, "Bad_Key", "markdown")
+
+
+def test_scaffold_refuses_unknown_type(tmp_path):
+    root = _repo_root(tmp_path)
+
+    with pytest.raises(ValueError, match="Unsupported integration type 'xml'"):
+        scaffold_integration(root, "my-agent", " XML ")
+
+
+def test_scaffold_refuses_overwrite(tmp_path):
+    root = _repo_root(tmp_path)
+    scaffold_integration(root, "my-agent", "markdown")
+
+    with pytest.raises(FileExistsError, match="Refusing to overwrite"):
+        scaffold_integration(root, "my-agent", "markdown")
+
+
+def test_scaffold_rolls_back_partial_files_on_write_failure(tmp_path, monkeypatch):
+    root = _repo_root(tmp_path)
+    integration_dir = root / "src" / "specify_cli" / "integrations" / "my_agent"
+    integration_file = integration_dir / "__init__.py"
+    test_file = root / "tests" / "integrations" / "test_integration_my_agent.py"
+    original_write_text = Path.write_text
+
+    def fail_test_write(path, *args, **kwargs):
+        if path == test_file:
+            raise PermissionError("simulated test file write failure")
+        return original_write_text(path, *args, **kwargs)
+
+    monkeypatch.setattr(Path, "write_text", fail_test_write)
+
+    with pytest.raises(PermissionError, match="simulated test file write failure"):
+        scaffold_integration(root, "my-agent", "markdown")
+
+    assert not integration_file.exists()
+    assert not integration_dir.exists()
+    assert not test_file.exists()
+
+
+def test_scaffold_creates_only_leaf_integration_directory(tmp_path, monkeypatch):
+    root = _repo_root(tmp_path)
+    original_mkdir = Path.mkdir
+    mkdir_calls = []
+
+    def record_mkdir(path, *args, **kwargs):
+        mkdir_calls.append((path, args, kwargs))
+        return original_mkdir(path, *args, **kwargs)
+
+    monkeypatch.setattr(Path, "mkdir", record_mkdir)
+
+    scaffold_integration(root, "my-agent", "markdown")
+
+    assert any(
+        path == root / "src" / "specify_cli" / "integrations" / "my_agent"
+        for path, _args, _kwargs in mkdir_calls
+    )
+    assert all(not kwargs.get("parents", False) for _path, _args, kwargs in mkdir_calls)
+
+
+def test_scaffold_requires_repo_root(tmp_path):
+    with pytest.raises(ValueError, match="Spec Kit repository root"):
+        scaffold_integration(tmp_path, "my-agent", "markdown")
+
+
+def test_scaffold_requires_integration_registry_file(tmp_path):
+    root = _repo_root(tmp_path)
+    (root / "src" / "specify_cli" / "integrations" / "__init__.py").unlink()
+
+    with pytest.raises(ValueError, match="Spec Kit repository root"):
+        scaffold_integration(root, "my-agent", "markdown")
+
+
+def test_scaffold_refuses_symlinked_target_directory(tmp_path):
+    root = _repo_root(tmp_path)
+    # `outside` carries its own __init__.py so the repo-root heuristic still
+    # passes through the symlink, isolating the symlink guard under test.
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    (outside / "__init__.py").write_text("", encoding="utf-8")
+    integrations = root / "src" / "specify_cli" / "integrations"
+    (integrations / "__init__.py").unlink()
+    integrations.rmdir()
+    try:
+        integrations.symlink_to(outside, target_is_directory=True)
+    except OSError as exc:
+        pytest.skip(f"symlinks unavailable: {exc}")
+
+    with pytest.raises(ValueError, match="symlinked path"):
+        scaffold_integration(root, "my-agent", "markdown")
+
+    assert not (outside / "my_agent").exists()
+
+
+def test_integration_scaffold_accepts_uppercase_type(tmp_path, monkeypatch):
+    root = _repo_root(tmp_path)
+    monkeypatch.chdir(root)
+
+    result = runner.invoke(app, [
+        "integration", "scaffold", "my-agent",
+        "--type", "YAML",
+    ], catch_exceptions=False)
+
+    assert result.exit_code == 0, strip_ansi(result.output)
+    content = (
+        root / "src" / "specify_cli" / "integrations" / "my_agent" / "__init__.py"
+    ).read_text(encoding="utf-8")
+    assert "class MyAgentIntegration(YamlIntegration):" in content

tests/integrations/test_integration_subcommand.py

@@ -120,6 +120,7 @@ class TestIntegrationList:
         # Should show multiple integrations
         assert "claude" in result.output
         assert "gemini" in result.output
+        assert "zed" in result.output
 
     def test_list_shows_multi_install_safe_status(self, tmp_path):
         project = _init_project(tmp_path, "claude")
@@ -1918,6 +1919,45 @@ class TestIntegrationSwitch:
         assert "/speckit.plan" in updated
         assert "/speckit-plan" not in updated
 
+    def test_switch_preserves_recovered_files(self, tmp_path):
+        """Regression for #2918: files marked recovered in the manifest are not overwritten.
+
+        When a file already exists on disk before init and is recorded with
+        ``recovered=True``, ``integration use``/``switch`` must not treat it as
+        managed even when the on-disk hash matches the manifest hash.
+        """
+        import hashlib
+
+        project = _init_project(tmp_path, "claude")
+        shared_script = project / ".specify" / "scripts" / "bash" / "setup-tasks.sh"
+        assert shared_script.is_file()
+
+        # Simulate a team-customized file that was recorded as recovered:
+        # write custom content, then update the manifest to record its hash
+        # with the recovered flag set.
+        custom_bytes = b"#!/usr/bin/env bash\n# team custom workflow\nexit 0\n"
+        shared_script.write_bytes(custom_bytes)
+
+        manifest_path = project / ".specify" / "integrations" / "speckit.manifest.json"
+        manifest_data = json.loads(manifest_path.read_text(encoding="utf-8"))
+        rel = ".specify/scripts/bash/setup-tasks.sh"
+        manifest_data["files"][rel] = hashlib.sha256(custom_bytes).hexdigest()
+        manifest_data.setdefault("recovered_files", []).append(rel)
+        manifest_path.write_text(json.dumps(manifest_data), encoding="utf-8")
+
+        old_cwd = os.getcwd()
+        try:
+            os.chdir(project)
+            result = runner.invoke(app, [
+                "integration", "switch", "copilot",
+                "--script", "sh",
+            ], catch_exceptions=False)
+        finally:
+            os.chdir(old_cwd)
+        assert result.exit_code == 0
+        # Recovered file must NOT be overwritten — team content preserved.
+        assert shared_script.read_bytes() == custom_bytes
+
     def test_switch_skips_symlinked_parent_directory(self, tmp_path):
         """Regression: if .specify/scripts/bash is a symlink, switch must not write through it.
 

tests/integrations/test_integration_zed.py

@@ -0,0 +1,164 @@
+"""Tests for ZedIntegration."""
+
+import json
+
+import pytest
+
+from specify_cli.integrations import get_integration
+
+from .test_integration_base_skills import SkillsIntegrationTests
+
+
+class TestZedIntegration(SkillsIntegrationTests):
+    KEY = "zed"
+    FOLDER = ".agents/"
+    COMMANDS_SUBDIR = "skills"
+    REGISTRAR_DIR = ".agents/skills"
+    CONTEXT_FILE = "AGENTS.md"
+
+    def test_options_include_skills_flag(self):
+        """Not applicable to Zed — Zed is always skills-based with no --skills flag."""
+        pytest.skip("Zed is always skills-based and does not expose a --skills option")
+
+    def test_options_do_not_include_skills_flag(self):
+        """Zed is always skills-based; no --skills option is exposed."""
+        i = get_integration(self.KEY)
+        assert i is not None
+        opts = i.options()
+        skills_opts = [o for o in opts if o.name == "--skills"]
+        assert len(skills_opts) == 0, (
+            "Zed is always skills-based and should not expose a --skills option"
+        )
+
+    def test_requires_cli_is_false(self):
+        """Zed is IDE-based; requires_cli must remain False."""
+        i = get_integration(self.KEY)
+        assert i is not None
+        assert i.config is not None
+        assert i.config["requires_cli"] is False
+
+
+class TestZedHookInvocations:
+    """Zed hook messages should reference slash-invokable skills."""
+
+    def test_hooks_render_skill_invocation(self, tmp_path):
+        """Zed is always skills-based: renders /speckit-plan even with ai_skills=False."""
+        from specify_cli.extensions import HookExecutor
+
+        project = tmp_path / "zed-hooks"
+        project.mkdir()
+        init_options = project / ".specify" / "init-options.json"
+        init_options.parent.mkdir(parents=True, exist_ok=True)
+        init_options.write_text(json.dumps({"ai": "zed", "ai_skills": False}))
+
+        hook_executor = HookExecutor(project)
+        message = hook_executor.format_hook_message(
+            "before_plan",
+            [
+                {
+                    "extension": "test-ext",
+                    "command": "speckit.plan",
+                    "optional": False,
+                }
+            ],
+        )
+
+        assert "EXECUTE_COMMAND_INVOCATION: /speckit-plan" in message
+
+    def test_init_persists_ai_skills_for_zed(self, tmp_path, monkeypatch):
+        """specify init --integration zed must persist ai_skills: true,
+        so HookExecutor renders slash-skill invocations without manual
+        init-options manipulation."""
+        from typer.testing import CliRunner
+
+        from specify_cli import app
+        from specify_cli.extensions import HookExecutor
+
+        project = tmp_path / "zed-init-test"
+        project.mkdir()
+        monkeypatch.chdir(project)
+        runner = CliRunner()
+        result = runner.invoke(
+            app,
+            [
+                "init",
+                "--here",
+                "--integration",
+                "zed",
+                "--script",
+                "sh",
+                "--ignore-agent-tools",
+            ],
+            catch_exceptions=False,
+        )
+
+        assert result.exit_code == 0, f"init failed: {result.output}"
+
+        opts_path = project / ".specify" / "init-options.json"
+        assert opts_path.exists()
+        opts = json.loads(opts_path.read_text(encoding="utf-8"))
+        assert opts.get("ai") == "zed"
+        assert opts.get("ai_skills") is True, (
+            f"init must persist ai_skills=true for Zed, got: {opts.get('ai_skills')}"
+        )
+
+        hook_executor = HookExecutor(project)
+        message = hook_executor.format_hook_message(
+            "before_plan",
+            [
+                {
+                    "extension": "test-ext",
+                    "command": "speckit.plan",
+                    "optional": False,
+                }
+            ],
+        )
+        assert "Executing: `/speckit-plan`" in message, (
+            "Hook rendering must produce /speckit-plan for Zed without hint injection"
+        )
+        assert "EXECUTE_COMMAND_INVOCATION: /speckit-plan" in message
+
+
+class TestSlashSkillsSets:
+    """Parameterized coverage for ALWAYS_SLASH_AGENTS / CONDITIONAL_SLASH_AGENTS."""
+
+    @staticmethod
+    def _render_invocation(project_path, ai: str, ai_skills: bool) -> str:
+        """Return the rendered invocation for ``speckit.plan`` via HookExecutor."""
+        from specify_cli.extensions import HookExecutor
+
+        init_options = project_path / ".specify" / "init-options.json"
+        init_options.parent.mkdir(parents=True, exist_ok=True)
+        init_options.write_text(json.dumps({"ai": ai, "ai_skills": ai_skills}))
+        hook_executor = HookExecutor(project_path)
+        result = hook_executor.execute_hook(
+            {"extension": "test-ext", "command": "speckit.plan", "optional": False}
+        )
+        return result.get("invocation", "")
+
+    @pytest.mark.parametrize(
+        ("ai", "ai_skills", "expected"),
+        [
+            # ALWAYS_SLASH_AGENTS — unconditional on ai_skills
+            ("devin", True, "/speckit-plan"),
+            ("devin", False, "/speckit-plan"),
+            ("trae", True, "/speckit-plan"),
+            ("trae", False, "/speckit-plan"),
+            ("zed", True, "/speckit-plan"),
+            ("zed", False, "/speckit-plan"),
+            # CONDITIONAL_SLASH_AGENTS — only when ai_skills is enabled
+            ("agy", True, "/speckit-plan"),
+            ("agy", False, "/speckit.plan"),
+            ("claude", True, "/speckit-plan"),
+            ("claude", False, "/speckit.plan"),
+            ("copilot", True, "/speckit-plan"),
+            ("copilot", False, "/speckit.plan"),
+            ("cursor-agent", True, "/speckit-plan"),
+            ("cursor-agent", False, "/speckit.plan"),
+        ],
+    )
+    def test_hook_invocation_format(self, tmp_path, ai, ai_skills, expected):
+        result = self._render_invocation(tmp_path, ai, ai_skills)
+        assert result == expected, (
+            f"{ai} (ai_skills={ai_skills}): expected {expected!r}, got {result!r}"
+        )

tests/integrations/test_registry.py

@@ -27,7 +27,7 @@ ALL_INTEGRATION_KEYS = [
     # Stage 4 — TOML integrations
     "gemini", "tabnine",
     # Stage 5 — skills, generic & option-driven integrations
-    "codex", "kimi", "agy", "generic",
+    "codex", "kimi", "agy", "zed", "generic",
 ]
 
 

tests/test_authentication.py

@@ -793,6 +793,35 @@ class TestRedirectStripping:
         assert new_req.headers.get("Authorization") is None
         assert new_req.unredirected_hdrs.get("Authorization") is None
 
+    def test_https_to_http_same_host_redirect_strips_auth(self):
+        from specify_cli.authentication.http import _StripAuthOnRedirect
+        from urllib.request import Request
+        import io
+        handler = _StripAuthOnRedirect(("github.com",))
+        req = Request("https://github.com/org/repo", headers={"Authorization": "Bearer tok"})
+        new_req = handler.redirect_request(req, io.BytesIO(b""), 302, "Found", {},
+                                           "http://github.com/org/repo")
+        assert new_req is not None
+        assert new_req.headers.get("Authorization") is None
+        assert new_req.unredirected_hdrs.get("Authorization") is None
+
+    def test_redirect_validator_can_reject_before_following_redirect(self):
+        import urllib.error
+        from specify_cli.authentication.http import _StripAuthOnRedirect
+        from urllib.request import Request
+        import io
+
+        def reject_http(old_url, new_url):
+            if new_url.startswith("http://"):
+                raise urllib.error.URLError("scheme downgrade")
+
+        handler = _StripAuthOnRedirect(("github.com",), reject_http)
+        req = Request("https://github.com/org/repo", headers={"Authorization": "Bearer tok"})
+
+        with pytest.raises(urllib.error.URLError, match="scheme downgrade"):
+            handler.redirect_request(req, io.BytesIO(b""), 302, "Found", {},
+                                     "http://github.com/org/repo")
+
     def test_multi_hop_redirect_within_hosts_preserves_auth(self):
         """Auth survives a multi-hop redirect chain within allowed hosts."""
         from specify_cli.authentication.http import _StripAuthOnRedirect

tests/test_check_prerequisites_paths_only.py

@@ -17,7 +17,7 @@ COMMON_PS = PROJECT_ROOT / "scripts" / "powershell" / "common.ps1"
 CHECK_PREREQS_PS = PROJECT_ROOT / "scripts" / "powershell" / "check-prerequisites.ps1"
 
 HAS_PWSH = shutil.which("pwsh") is not None
-_POWERSHELL = shutil.which("powershell.exe") or shutil.which("powershell")
+_WINDOWS_POWERSHELL = (shutil.which("powershell.exe") or shutil.which("powershell")) if os.name == "nt" else None
 
 
 def _install_bash_scripts(repo: Path) -> None:
@@ -160,14 +160,14 @@ def test_normal_mode_still_validates_branch(prereq_repo: Path) -> None:
 # ── PowerShell tests ──────────────────────────────────────────────────────
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_ps_paths_only_succeeds_on_non_spec_branch(prereq_repo: Path) -> None:
     """-PathsOnly must return paths when feature.json pins the feature dir."""
     feat = prereq_repo / "specs" / "001-my-feature"
     feat.mkdir(parents=True, exist_ok=True)
     _write_feature_json(prereq_repo)
     script = prereq_repo / ".specify" / "scripts" / "powershell" / "check-prerequisites.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json", "-PathsOnly"],
         cwd=prereq_repo,
@@ -183,7 +183,7 @@ def test_ps_paths_only_succeeds_on_non_spec_branch(prereq_repo: Path) -> None:
     assert "FEATURE_DIR" in data
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_ps_paths_only_succeeds_on_spec_branch(prereq_repo: Path) -> None:
     """-PathsOnly must also work when feature.json and SPECIFY_FEATURE agree."""
     subprocess.run(
@@ -195,7 +195,7 @@ def test_ps_paths_only_succeeds_on_spec_branch(prereq_repo: Path) -> None:
     feat.mkdir(parents=True, exist_ok=True)
     _write_feature_json(prereq_repo)
     script = prereq_repo / ".specify" / "scripts" / "powershell" / "check-prerequisites.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
     env = _clean_env()
     env["SPECIFY_FEATURE"] = "001-my-feature"
     result = subprocess.run(
@@ -211,11 +211,11 @@ def test_ps_paths_only_succeeds_on_spec_branch(prereq_repo: Path) -> None:
     assert "FEATURE_DIR" in data
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_ps_normal_mode_still_validates_branch(prereq_repo: Path) -> None:
     """Without -PathsOnly, feature directory validation must still fail on main."""
     script = prereq_repo / ".specify" / "scripts" / "powershell" / "check-prerequisites.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],
         cwd=prereq_repo,

tests/test_extension_skills.py

@@ -90,7 +90,7 @@ def _create_extension_dir(temp_dir: Path, ext_id: str = "test-ext") -> Path:
     }
 
     with open(ext_dir / "extension.yml", "w") as f:
-        yaml.dump(manifest_data, f)
+        yaml.safe_dump(manifest_data, f)
 
     commands_dir = ext_dir / "commands"
     commands_dir.mkdir()
@@ -119,6 +119,50 @@ def _create_extension_dir(temp_dir: Path, ext_id: str = "test-ext") -> Path:
     return ext_dir
 
 
+def _create_unicode_extension_dir(temp_dir: Path, ext_id: str = "uni-ext") -> Path:
+    """Create an extension whose command description contains non-ASCII characters."""
+    ext_dir = temp_dir / ext_id
+    ext_dir.mkdir()
+    description = "Prüfe Konformität der Implementierung"
+
+    manifest_data = {
+        "schema_version": "1.0",
+        "extension": {
+            "id": ext_id,
+            "name": "Unicode Extension",
+            "version": "1.0.0",
+            "description": description,
+        },
+        "requires": {"speckit_version": ">=0.1.0"},
+        "provides": {
+            "commands": [
+                {
+                    "name": f"speckit.{ext_id}.hello",
+                    "file": "commands/hello.md",
+                    "description": description,
+                },
+            ]
+        },
+    }
+
+    with open(ext_dir / "extension.yml", "w", encoding="utf-8") as f:
+        yaml.safe_dump(manifest_data, f, allow_unicode=True)
+
+    commands_dir = ext_dir / "commands"
+    commands_dir.mkdir()
+    (commands_dir / "hello.md").write_text(
+        "---\n"
+        f'description: "{description}"\n'
+        "---\n"
+        "\n"
+        "# Hello\n"
+        "\n"
+        "Body.\n",
+        encoding="utf-8",
+    )
+    return ext_dir
+
+
 def _can_create_symlink(temp_dir: Path) -> bool:
     """Return True when the current platform/user can create file symlinks."""
     target = temp_dir / "symlink-target.txt"
@@ -303,6 +347,147 @@ class TestExtensionSkillRegistration:
         assert "description" in parsed
         assert parsed["disable-model-invocation"] is False
 
+    def test_argument_hint_preserved_for_extension_command(
+        self, skills_project, temp_dir
+    ):
+        """argument-hint from an extension command must survive into SKILL.md.
+
+        Regression for #2903: the field was dropped for extension-provided
+        commands while being kept for core template commands. The source
+        description is intentionally long so it folds across multiple lines
+        when serialized, guarding against an in-place string injection that
+        would split the folded scalar and produce invalid YAML.
+        """
+        project_dir, skills_dir = skills_project
+
+        long_description = (
+            "Build and maintain a lean, static context/ knowledge folder so "
+            "coding agents load only what is relevant and save tokens"
+        )
+        arg_hint = "<init | update | list | check> [area] [slug] [-- notes]"
+
+        ext_dir = temp_dir / "hint-ext"
+        ext_dir.mkdir()
+        manifest_data = {
+            "schema_version": "1.0",
+            "extension": {
+                "id": "hint-ext",
+                "name": "Hint Extension",
+                "version": "1.0.0",
+                "description": "Extension exercising argument-hint preservation",
+            },
+            "requires": {"speckit_version": ">=0.1.0"},
+            "provides": {
+                "commands": [
+                    {
+                        "name": "speckit.hint-ext.build-context",
+                        "file": "commands/build-context.md",
+                        "description": long_description,
+                    }
+                ]
+            },
+        }
+        with open(ext_dir / "extension.yml", "w") as f:
+            yaml.dump(manifest_data, f)
+        commands_dir = ext_dir / "commands"
+        commands_dir.mkdir()
+        (commands_dir / "build-context.md").write_text(
+            "---\n"
+            f'description: "{long_description}"\n'
+            f'argument-hint: "{arg_hint}"\n'
+            "---\n"
+            "\n"
+            "# Build Context\n"
+            "\n"
+            "Do the thing.\n"
+            "$ARGUMENTS\n",
+            encoding="utf-8",
+        )
+
+        manager = ExtensionManager(project_dir)
+        manager.install_from_directory(ext_dir, "0.1.0", register_commands=False)
+
+        skill_file = skills_dir / "speckit-hint-ext-build-context" / "SKILL.md"
+        assert skill_file.exists()
+        content = skill_file.read_text(encoding="utf-8")
+
+        # Frontmatter must parse cleanly even though the description folds.
+        parts = content.split("---", 2)
+        assert len(parts) >= 3
+        parsed = yaml.safe_load(parts[1])
+        assert parsed["argument-hint"] == arg_hint
+        assert parsed["description"] == long_description
+
+    def test_argument_hint_not_added_for_non_claude_agent(self, project_dir, temp_dir):
+        """argument-hint must stay Claude-only — other skills agents are untouched.
+
+        The hint is carried only for integrations that support it (currently
+        Claude, the sole integration defining inject_argument_hint). A non-Claude
+        skills agent such as kimi must keep the shared build_skill_frontmatter
+        shape (name/description/compatibility/metadata) with no argument-hint.
+        """
+        _create_init_options(project_dir, ai="kimi", ai_skills=True)
+        skills_dir = _create_skills_dir(project_dir, ai="kimi")
+
+        arg_hint = "<init | update | list | check> [area]"
+        ext_dir = temp_dir / "hint-ext-kimi"
+        ext_dir.mkdir()
+        manifest_data = {
+            "schema_version": "1.0",
+            "extension": {
+                "id": "hint-ext-kimi",
+                "name": "Hint Extension Kimi",
+                "version": "1.0.0",
+                "description": "Extension exercising argument-hint gating",
+            },
+            "requires": {"speckit_version": ">=0.1.0"},
+            "provides": {
+                "commands": [
+                    {
+                        "name": "speckit.hint-ext-kimi.build-context",
+                        "file": "commands/build-context.md",
+                        "description": "Build context",
+                    }
+                ]
+            },
+        }
+        with open(ext_dir / "extension.yml", "w") as f:
+            yaml.dump(manifest_data, f)
+        commands_dir = ext_dir / "commands"
+        commands_dir.mkdir()
+        (commands_dir / "build-context.md").write_text(
+            "---\n"
+            'description: "Build context"\n'
+            f'argument-hint: "{arg_hint}"\n'
+            "---\n"
+            "\n"
+            "# Build Context\n"
+            "\n"
+            "Do the thing.\n"
+            "$ARGUMENTS\n",
+            encoding="utf-8",
+        )
+
+        manager = ExtensionManager(project_dir)
+        manager.install_from_directory(ext_dir, "0.1.0", register_commands=False)
+
+        skill_file = skills_dir / "speckit-hint-ext-kimi-build-context" / "SKILL.md"
+        assert skill_file.exists()
+        parsed = yaml.safe_load(skill_file.read_text(encoding="utf-8").split("---", 2)[1])
+        assert "argument-hint" not in parsed
+
+    def test_skill_md_unicode(self, skills_project, temp_dir):
+        """SKILL.md generation should preserve non-ASCII characters."""
+        project_dir, skills_dir = skills_project
+        ext_dir = _create_unicode_extension_dir(temp_dir)
+        manager = ExtensionManager(project_dir)
+        manager.install_from_directory(ext_dir, "0.1.0", register_commands=False)
+
+        skill_file = skills_dir / "speckit-uni-ext-hello" / "SKILL.md"
+        content = skill_file.read_text(encoding="utf-8")
+
+        assert "Prüfe Konformität" in content
+
     def test_no_skills_when_ai_skills_disabled(self, no_skills_project, extension_dir):
         """No skills should be created when ai_skills is false."""
         manager = ExtensionManager(no_skills_project)
@@ -563,7 +748,7 @@ class TestExtensionSkillRegistration:
             },
         }
         with open(ext_dir / "extension.yml", "w") as f:
-            yaml.dump(manifest_data, f)
+            yaml.safe_dump(manifest_data, f)
 
         (ext_dir / "commands").mkdir()
         (ext_dir / "commands" / "plan.md").write_text(
@@ -618,7 +803,7 @@ class TestExtensionSkillRegistration:
             },
         }
         with open(ext_dir / "extension.yml", "w") as f:
-            yaml.dump(manifest_data, f)
+            yaml.safe_dump(manifest_data, f)
 
         (ext_dir / "commands").mkdir()
         (ext_dir / "commands" / "exists.md").write_text(
@@ -1174,7 +1359,7 @@ class TestExtensionSkillEdgeCases:
             },
         }
         with open(ext_dir / "extension.yml", "w") as f:
-            yaml.dump(manifest_data, f)
+            yaml.safe_dump(manifest_data, f)
 
         (ext_dir / "commands").mkdir()
         (ext_dir / "commands" / "plain.md").write_text(
@@ -1261,7 +1446,7 @@ class TestExtensionSkillEdgeCases:
             },
         }
         with open(ext_dir / "extension.yml", "w") as f:
-            yaml.dump(manifest_data, f)
+            yaml.safe_dump(manifest_data, f)
 
         (ext_dir / "commands").mkdir()
         # Malformed YAML: invalid key-value syntax

tests/test_extensions.py

@@ -24,6 +24,7 @@ from specify_cli.extensions import (
     CatalogEntry,
     CORE_COMMAND_NAMES,
     DEFAULT_HOOK_PRIORITY,
+    VALID_EFFECTS,
     ExtensionManifest,
     ExtensionRegistry,
     ExtensionManager,
@@ -300,6 +301,69 @@ class TestExtensionManifest:
         with pytest.raises(ValidationError, match="Invalid version"):
             ExtensionManifest(manifest_path)
 
+    def test_valid_category(self, temp_dir, valid_manifest_data):
+        """Test manifest with various category values (free-form string)."""
+        import yaml
+
+        for category in ("docs", "code", "process", "integration", "visibility", "custom-category"):
+            valid_manifest_data["extension"]["category"] = category
+            manifest_path = temp_dir / "extension.yml"
+            with open(manifest_path, 'w') as f:
+                yaml.dump(valid_manifest_data, f)
+            manifest = ExtensionManifest(manifest_path)
+            assert manifest.category == category
+
+    def test_valid_effect(self, temp_dir, valid_manifest_data):
+        """Test manifest with valid effect values."""
+        import yaml
+
+        for effect in sorted(VALID_EFFECTS):
+            valid_manifest_data["extension"]["effect"] = effect
+            manifest_path = temp_dir / "extension.yml"
+            with open(manifest_path, 'w') as f:
+                yaml.dump(valid_manifest_data, f)
+            manifest = ExtensionManifest(manifest_path)
+            assert manifest.effect == effect
+
+    def test_invalid_category(self, temp_dir, valid_manifest_data):
+        """Test manifest with empty category raises ValidationError."""
+        import yaml
+
+        valid_manifest_data["extension"]["category"] = ""
+        manifest_path = temp_dir / "extension.yml"
+        with open(manifest_path, 'w') as f:
+            yaml.dump(valid_manifest_data, f)
+
+        with pytest.raises(ValidationError, match="Invalid extension.category"):
+            ExtensionManifest(manifest_path)
+
+    def test_invalid_effect(self, temp_dir, valid_manifest_data):
+        """Test manifest with invalid effect raises ValidationError."""
+        import yaml
+
+        valid_manifest_data["extension"]["effect"] = "write-only"
+        manifest_path = temp_dir / "extension.yml"
+        with open(manifest_path, 'w') as f:
+            yaml.dump(valid_manifest_data, f)
+
+        with pytest.raises(ValidationError, match="Invalid extension.effect"):
+            ExtensionManifest(manifest_path)
+
+    def test_category_and_effect_optional(self, temp_dir, valid_manifest_data):
+        """Test that omitting category and effect still passes validation."""
+        import yaml
+
+        # Ensure no category/effect in data
+        valid_manifest_data["extension"].pop("category", None)
+        valid_manifest_data["extension"].pop("effect", None)
+        manifest_path = temp_dir / "extension.yml"
+        with open(manifest_path, 'w') as f:
+            yaml.dump(valid_manifest_data, f)
+
+        manifest = ExtensionManifest(manifest_path)
+        assert manifest.category is None
+        assert manifest.effect is None
+
     def test_invalid_command_name(self, temp_dir, valid_manifest_data):
         """Test manifest with command name that cannot be auto-corrected raises ValidationError."""
         import yaml
@@ -1054,6 +1118,56 @@ class TestExtensionManager:
         assert manifest.id == "test-ext"
         assert manager.registry.is_installed("test-ext")
 
+    def test_install_from_install_dir_is_rejected_without_data_loss(
+        self, extension_dir, project_dir
+    ):
+        """Installing from an extension's own install dir must fail without
+        deleting it (regression for issue #2990)."""
+        manager = ExtensionManager(project_dir)
+
+        # Install once so the extension lives at its install destination.
+        manager.install_from_directory(extension_dir, "0.1.0", register_commands=False)
+        install_dir = project_dir / ".specify" / "extensions" / "test-ext"
+        assert install_dir.exists()
+
+        # Re-installing from that same directory with --force must be rejected.
+        with pytest.raises(ValidationError, match="install destination"):
+            manager.install_from_directory(
+                install_dir, "0.1.0", register_commands=False, force=True
+            )
+
+        # The directory and its contents must be left intact (no data loss).
+        assert install_dir.exists()
+        assert (install_dir / "extension.yml").exists()
+        assert (install_dir / "commands" / "hello.md").exists()
+
+    def test_install_from_install_dir_is_rejected_when_resolve_fails(
+        self, extension_dir, project_dir, monkeypatch
+    ):
+        """Resolution failures must not bypass the self-install guard."""
+        manager = ExtensionManager(project_dir)
+
+        manager.install_from_directory(extension_dir, "0.1.0", register_commands=False)
+        install_dir = project_dir / ".specify" / "extensions" / "test-ext"
+
+        original_resolve = Path.resolve
+
+        def fail_resolve(self, *args, **kwargs):
+            if self in {install_dir, manager.extensions_dir / "test-ext"}:
+                raise OSError("cannot resolve path")
+            return original_resolve(self, *args, **kwargs)
+
+        monkeypatch.setattr(Path, "resolve", fail_resolve)
+
+        with pytest.raises(ValidationError, match="install destination"):
+            manager.install_from_directory(
+                install_dir, "0.1.0", register_commands=False, force=True
+            )
+
+        assert install_dir.exists()
+        assert (install_dir / "extension.yml").exists()
+        assert (install_dir / "commands" / "hello.md").exists()
+
     def test_install_zip_force_reinstall(self, extension_dir, project_dir):
         """Test force-reinstalling from ZIP when already installed."""
         import zipfile

tests/test_github_http.py

@@ -187,4 +187,4 @@ class TestResolveGitHubReleaseAssetApiUrl:
             capturing_open,
         )
         assert len(captured_urls) == 1
-        assert "releases/tags/v1%23beta" in captured_urls[0]
+        assert "releases/tags/v1%23beta" in captured_urls[0]

tests/test_live_transient_windows.py

@@ -0,0 +1,90 @@
+"""Tests for Rich Live transient=False on Windows (GitHub issue #2927).
+
+PowerShell 5.1's legacy console host does not support VT escape sequences
+reliably.  Rich's ``Live(transient=True)`` attempts cursor restoration on
+exit, which hangs indefinitely on that console.  The fix disables transient
+mode when ``sys.platform == "win32"``.
+
+These tests patch ``sys.platform`` and intercept the ``Live`` constructor
+to verify the correct ``transient`` value reaches Rich.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+
+# ---------------------------------------------------------------------------
+# _console.py — Live in the select_with_arrows helper
+# ---------------------------------------------------------------------------
+
+
+def _invoke_select_with_arrows(platform: str) -> bool:
+    """Patch sys.platform and Live, invoke select_with_arrows, return transient kwarg."""
+    captured = {}
+
+    mock_live_instance = MagicMock()
+    mock_live_instance.__enter__ = MagicMock(return_value=mock_live_instance)
+    mock_live_instance.__exit__ = MagicMock(return_value=False)
+
+    def fake_live(*args, **kwargs):
+        captured.update(kwargs)
+        return mock_live_instance
+
+    # Patch readchar so the loop immediately returns "enter"
+    import readchar
+
+    with (
+        patch("sys.platform", platform),
+        patch("specify_cli._console.Live", side_effect=fake_live),
+        patch("specify_cli._console.readchar.readkey", return_value=readchar.key.ENTER),
+    ):
+        from specify_cli._console import select_with_arrows
+
+        select_with_arrows({"a": "Option A", "b": "Option B"}, "Pick one", "a")
+
+    return captured["transient"]
+
+
+class TestSelectWithArrowsLiveTransient:
+    """Verify that select_with_arrows passes transient=False on Windows."""
+
+    def test_transient_false_on_windows(self):
+        assert _invoke_select_with_arrows("win32") is False
+
+    def test_transient_true_on_linux(self):
+        assert _invoke_select_with_arrows("linux") is True
+
+    def test_transient_true_on_macos(self):
+        assert _invoke_select_with_arrows("darwin") is True
+
+
+# ---------------------------------------------------------------------------
+# init.py — verify source contains the platform guard (regression check)
+# ---------------------------------------------------------------------------
+
+
+class TestSourceContainsPlatformGuard:
+    """Ensure the platform guard feeds into the Live() transient kwarg."""
+
+    # Single DOTALL regex: _transient assigned from win32 check, then used in Live()
+    _GUARD_RE = r"_transient\s*=\s*sys\.platform\s*!=\s*['\"]win32['\"].*Live\(.*transient\s*=\s*_transient"
+
+    def test_init_has_win32_guard(self):
+        """init.py must assign _transient from platform check and pass it to Live."""
+        import re
+
+        init_src = Path(__file__).resolve().parent.parent / "src" / "specify_cli" / "commands" / "init.py"
+        content = init_src.read_text(encoding="utf-8")
+        assert re.search(self._GUARD_RE, content, re.DOTALL)
+
+    def test_console_has_win32_guard(self):
+        """_console.py must assign _transient from platform check and pass it to Live."""
+        import re
+
+        console_src = Path(__file__).resolve().parent.parent / "src" / "specify_cli" / "_console.py"
+        content = console_src.read_text(encoding="utf-8")
+        assert re.search(self._GUARD_RE, content, re.DOTALL)
+        assert re.search(r"transient\s*=\s*_transient", content)
+        assert "transient=_transient" in content

tests/test_presets.py

@@ -11,6 +11,7 @@ Tests cover:
 """
 
 import pytest
+import io
 import json
 import tempfile
 import shutil
@@ -18,6 +19,7 @@ import warnings
 import zipfile
 from pathlib import Path
 from datetime import datetime, timezone
+from types import SimpleNamespace
 
 import yaml
 
@@ -4257,6 +4259,141 @@ class TestBundledPresetLocator:
         assert "Lean Workflow" in result.output
         assert "installed" in result.output.lower()
 
+    def test_preset_add_from_url_rejects_insecure_redirect(self, project_dir, monkeypatch):
+        """URL installs reject redirects from HTTPS to non-loopback HTTP."""
+        import typer
+        from specify_cli.presets._commands import preset_add
+
+        class FakeResponse(io.BytesIO):
+            def __enter__(self):
+                return self
+
+            def __exit__(self, exc_type, exc, tb):
+                return False
+
+            def geturl(self):
+                return "http://example.com/preset.zip"
+
+        monkeypatch.setattr("specify_cli._require_specify_project", lambda: project_dir)
+        monkeypatch.setattr("specify_cli.get_speckit_version", lambda: "0.6.0")
+        def fake_open_url(url, timeout=None, extra_headers=None, redirect_validator=None):
+            assert redirect_validator is not None
+            redirect_validator(url, "http://example.com/preset.zip")
+            return FakeResponse(b"zip")
+
+        monkeypatch.setattr("specify_cli.authentication.http.open_url", fake_open_url)
+
+        installed = False
+
+        def fake_install_from_zip(self, zip_path, speckit_version, priority=10):
+            nonlocal installed
+            installed = True
+
+        monkeypatch.setattr(PresetManager, "install_from_zip", fake_install_from_zip)
+
+        with pytest.raises(typer.Exit) as exc_info:
+            preset_add(preset_id=None, from_url="https://example.com/preset.zip", dev=None, priority=10)
+
+        assert exc_info.value.exit_code == 1
+        assert installed is False
+
+    def test_preset_add_from_url_rejects_hostless_https_url(self, project_dir):
+        """URL installs reject HTTPS URLs without a hostname before downloading."""
+        from typer.testing import CliRunner
+        from unittest.mock import patch
+        from specify_cli import app
+
+        runner = CliRunner()
+        with patch.object(Path, "cwd", return_value=project_dir), \
+             patch("specify_cli.authentication.http.open_url") as open_url:
+            result = runner.invoke(app, ["preset", "add", "--from", "https:///preset.zip"])
+
+        assert result.exit_code == 1
+        output = strip_ansi(result.output)
+        assert "URL must use HTTPS with a hostname" in output
+        assert "got https://" not in output
+        open_url.assert_not_called()
+
+    def test_preset_add_from_url_redirect_error_describes_disallowed_url(self, project_dir, monkeypatch, capsys):
+        """Redirect rejection message covers hostless HTTPS, not only non-HTTPS URLs."""
+        import typer
+        from specify_cli.presets._commands import preset_add
+
+        class FakeResponse(io.BytesIO):
+            def __enter__(self):
+                return self
+
+            def __exit__(self, exc_type, exc, tb):
+                return False
+
+            def geturl(self):
+                return "https:///preset.zip"
+
+        monkeypatch.setattr("specify_cli._require_specify_project", lambda: project_dir)
+        monkeypatch.setattr("specify_cli.get_speckit_version", lambda: "0.6.0")
+        monkeypatch.setattr(
+            "specify_cli.authentication.http.open_url",
+            lambda url, timeout=None, extra_headers=None, redirect_validator=None: FakeResponse(b"zip"),
+        )
+        monkeypatch.setattr(PresetManager, "install_from_zip", lambda *args, **kwargs: None)
+
+        with pytest.raises(typer.Exit) as exc_info:
+            preset_add(preset_id=None, from_url="https://example.com/preset.zip", dev=None, priority=10)
+
+        assert exc_info.value.exit_code == 1
+        output = strip_ansi(capsys.readouterr().out)
+        assert "redirected to a disallowed URL" in output
+        assert "must use HTTPS with a hostname" in output
+
+    def test_preset_add_from_url_streams_download_to_zip(self, project_dir, monkeypatch):
+        """URL installs stream response bytes to disk before installing the ZIP."""
+        from specify_cli.presets._commands import preset_add
+
+        class FakeResponse(io.BytesIO):
+            def __init__(self, data):
+                super().__init__(data)
+                self.read_sizes = []
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, exc_type, exc, tb):
+                return False
+
+            def geturl(self):
+                return "https://example.com/preset.zip"
+
+            def read(self, size=-1):
+                assert size not in (-1, None)
+                self.read_sizes.append(size)
+                return super().read(size)
+
+        response = FakeResponse(b"zip-bytes")
+        installed = {}
+
+        def fake_install_from_zip(self, zip_path, speckit_version, priority=10):
+            installed["zip_bytes"] = Path(zip_path).read_bytes()
+            installed["speckit_version"] = speckit_version
+            installed["priority"] = priority
+            return SimpleNamespace(name="Test Preset", version="1.0.0")
+
+        monkeypatch.setattr("specify_cli._require_specify_project", lambda: project_dir)
+        monkeypatch.setattr("specify_cli.get_speckit_version", lambda: "0.6.0")
+        monkeypatch.setattr(
+            "specify_cli.authentication.http.open_url",
+            lambda url, timeout=None, extra_headers=None, redirect_validator=None: response,
+        )
+        monkeypatch.setattr(PresetManager, "install_from_zip", fake_install_from_zip)
+
+        preset_add(preset_id=None, from_url="https://example.com/preset.zip", dev=None, priority=7)
+
+        assert response.read_sizes
+        assert installed == {
+            "zip_bytes": b"zip-bytes",
+            "speckit_version": "0.6.0",
+            "priority": 7,
+        }
+
     def test_bundled_preset_in_catalog(self):
         """Verify the lean preset is listed in catalog.json with bundled marker."""
         catalog_path = Path(__file__).parent.parent / "presets" / "catalog.json"
@@ -4346,7 +4483,7 @@ class TestPresetAddFromUrlResolution:
             def __exit__(self, *a):
                 return False
 
-        def fake_open_url(url, timeout=None, extra_headers=None):
+        def fake_open_url(url, timeout=None, extra_headers=None, redirect_validator=None):
             captured_urls.append((url, extra_headers))
             if "releases/tags/" in url:
                 return FakeResponse(json.dumps({
@@ -4404,7 +4541,7 @@ class TestPresetAddFromUrlResolution:
             def __exit__(self, *a):
                 return False
 
-        def fake_open_url(url, timeout=None, extra_headers=None):
+        def fake_open_url(url, timeout=None, extra_headers=None, redirect_validator=None):
             captured_urls.append((url, extra_headers))
             return FakeResponse(zip_bytes)
 

tests/test_setup_plan_feature_json.py

@@ -18,7 +18,7 @@ SETUP_PLAN_PS = PROJECT_ROOT / "scripts" / "powershell" / "setup-plan.ps1"
 PLAN_TEMPLATE = PROJECT_ROOT / "templates" / "plan-template.md"
 
 HAS_PWSH = shutil.which("pwsh") is not None
-_POWERSHELL = shutil.which("powershell.exe") or shutil.which("powershell")
+_WINDOWS_POWERSHELL = (shutil.which("powershell.exe") or shutil.which("powershell")) if os.name == "nt" else None
 
 
 def _install_bash_scripts(repo: Path) -> None:
@@ -153,7 +153,7 @@ def test_setup_plan_numbered_branch_works_with_feature_json(
     assert (feat / "plan.md").is_file()
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_setup_plan_ps_passes_custom_branch_when_feature_json_valid(plan_repo: Path) -> None:
     subprocess.run(
         ["git", "checkout", "-q", "-b", "feature/my-feature-branch"],
@@ -165,7 +165,7 @@ def test_setup_plan_ps_passes_custom_branch_when_feature_json_valid(plan_repo: P
     (feat / "spec.md").write_text("# spec\n", encoding="utf-8")
     _write_feature_json(plan_repo, "specs/001-tiny-notes-app")
     script = plan_repo / ".specify" / "scripts" / "powershell" / "setup-plan.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script)],
         cwd=plan_repo,
@@ -178,12 +178,12 @@ def test_setup_plan_ps_passes_custom_branch_when_feature_json_valid(plan_repo: P
     assert (feat / "plan.md").is_file()
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_setup_plan_ps_errors_without_feature_context(
     plan_repo: Path,
 ) -> None:
     script = plan_repo / ".specify" / "scripts" / "powershell" / "setup-plan.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script)],
         cwd=plan_repo,

tests/test_setup_plan_no_overwrite.py

@@ -18,7 +18,7 @@ SETUP_PLAN_PS = PROJECT_ROOT / "scripts" / "powershell" / "setup-plan.ps1"
 PLAN_TEMPLATE = PROJECT_ROOT / "templates" / "plan-template.md"
 
 HAS_PWSH = shutil.which("pwsh") is not None
-_POWERSHELL = shutil.which("powershell.exe") or shutil.which("powershell")
+_WINDOWS_POWERSHELL = (shutil.which("powershell.exe") or shutil.which("powershell")) if os.name == "nt" else None
 
 
 def _install_bash_scripts(repo: Path) -> None:
@@ -178,11 +178,11 @@ def test_setup_plan_json_parseable_on_first_run(plan_repo: Path) -> None:
 # ── PowerShell tests ──────────────────────────────────────────────────────
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_ps_setup_plan_creates_plan_when_missing(plan_repo: Path) -> None:
     """First run must create plan.md from the template."""
     script = plan_repo / ".specify" / "scripts" / "powershell" / "setup-plan.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],
         cwd=plan_repo,
@@ -199,7 +199,7 @@ def test_ps_setup_plan_creates_plan_when_missing(plan_repo: Path) -> None:
     assert len(content) > 0
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_ps_setup_plan_preserves_existing_plan(plan_repo: Path) -> None:
     """Rerun must not overwrite an existing plan.md."""
     feat = plan_repo / "specs" / "001-my-feature"
@@ -208,7 +208,7 @@ def test_ps_setup_plan_preserves_existing_plan(plan_repo: Path) -> None:
     (feat / "plan.md").write_text(existing_content, encoding="utf-8")
 
     script = plan_repo / ".specify" / "scripts" / "powershell" / "setup-plan.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],
         cwd=plan_repo,

tests/test_setup_tasks.py

@@ -20,7 +20,7 @@ CHECK_PREREQ_PS = PROJECT_ROOT / "scripts" / "powershell" / "check-prerequisites
 TASKS_TEMPLATE = PROJECT_ROOT / "templates" / "tasks-template.md"
  
 HAS_PWSH = shutil.which("pwsh") is not None
-_POWERSHELL = shutil.which("powershell.exe") or shutil.which("powershell")
+_WINDOWS_POWERSHELL = (shutil.which("powershell.exe") or shutil.which("powershell")) if os.name == "nt" else None
  
  
 # ---------------------------------------------------------------------------
@@ -118,7 +118,7 @@ def _run_bash_format_command(repo: Path, command_name: str) -> subprocess.Comple
 
 def _run_powershell_format_command(repo: Path, command_name: str) -> subprocess.CompletedProcess:
     script = repo / ".specify" / "scripts" / "powershell" / "common.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
     return subprocess.run(
         [
             exe,
@@ -606,7 +606,7 @@ def test_setup_tasks_bash_errors_without_feature_context(
 # POWERSHELL TESTS
 # ===========================================================================
  
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_setup_tasks_ps_core_template_resolved(tasks_repo: Path) -> None:
     """
     When the core tasks-template.md is present and all prerequisites are met,
@@ -615,7 +615,7 @@ def test_setup_tasks_ps_core_template_resolved(tasks_repo: Path) -> None:
     """
     _minimal_feature(tasks_repo)
     script = tasks_repo / ".specify" / "scripts" / "powershell" / "setup-tasks.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
  
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],
@@ -635,7 +635,7 @@ def test_setup_tasks_ps_core_template_resolved(tasks_repo: Path) -> None:
     assert tasks_tmpl.name == "tasks-template.md"
  
  
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_setup_tasks_ps_override_wins(tasks_repo: Path) -> None:
     """
     When an override exists at .specify/templates/overrides/tasks-template.md,
@@ -649,7 +649,7 @@ def test_setup_tasks_ps_override_wins(tasks_repo: Path) -> None:
     override_file.write_text("# override tasks template\n", encoding="utf-8")
  
     script = tasks_repo / ".specify" / "scripts" / "powershell" / "setup-tasks.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
  
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],
@@ -671,7 +671,7 @@ def test_setup_tasks_ps_override_wins(tasks_repo: Path) -> None:
     )
  
  
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_setup_tasks_ps_missing_template_errors(tasks_repo: Path) -> None:
     """
     When tasks-template.md is absent from all locations, setup-tasks.ps1 must
@@ -683,7 +683,7 @@ def test_setup_tasks_ps_missing_template_errors(tasks_repo: Path) -> None:
     core.unlink()
  
     script = tasks_repo / ".specify" / "scripts" / "powershell" / "setup-tasks.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
  
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],
@@ -698,7 +698,7 @@ def test_setup_tasks_ps_missing_template_errors(tasks_repo: Path) -> None:
     assert "tasks-template" in result.stderr.lower() or "tasks-template" in result.stdout.lower()
  
  
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_powershell_command_hint_normalizes_mixed_separators(
     tasks_repo: Path,
 ) -> None:
@@ -717,7 +717,7 @@ def test_powershell_command_hint_normalizes_mixed_separators(
     assert result.stdout.strip() == "/speckit-git-commit"
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_powershell_command_hint_preserves_hyphens_inside_segments(
     tasks_repo: Path,
 ) -> None:
@@ -729,7 +729,7 @@ def test_powershell_command_hint_preserves_hyphens_inside_segments(
     assert result.stdout.strip() == "/speckit.jira.sync-status"
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_setup_tasks_ps_uses_invoke_separator_in_plan_hint(tasks_repo: Path) -> None:
     _write_integration_state(tasks_repo, "claude", "-")
     feat = tasks_repo / "specs" / "001-my-feature"
@@ -738,7 +738,7 @@ def test_setup_tasks_ps_uses_invoke_separator_in_plan_hint(tasks_repo: Path) ->
     _write_feature_json(tasks_repo)
 
     script = tasks_repo / ".specify" / "scripts" / "powershell" / "setup-tasks.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
 
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],
@@ -755,7 +755,7 @@ def test_setup_tasks_ps_uses_invoke_separator_in_plan_hint(tasks_repo: Path) ->
     assert "/speckit.plan" not in output
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_check_prerequisites_ps_uses_invoke_separator_in_tasks_hint(
     tasks_repo: Path,
 ) -> None:
@@ -763,7 +763,7 @@ def test_check_prerequisites_ps_uses_invoke_separator_in_tasks_hint(
     _minimal_feature(tasks_repo)
 
     script = tasks_repo / ".specify" / "scripts" / "powershell" / "check-prerequisites.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
 
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-RequireTasks"],
@@ -780,7 +780,7 @@ def test_check_prerequisites_ps_uses_invoke_separator_in_tasks_hint(
     assert "/speckit.tasks" not in output
 
 
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_setup_tasks_ps_passes_custom_branch_when_feature_json_valid(
     tasks_repo: Path,
 ) -> None:
@@ -801,7 +801,7 @@ def test_setup_tasks_ps_passes_custom_branch_when_feature_json_valid(
     _write_feature_json(tasks_repo)
  
     script = tasks_repo / ".specify" / "scripts" / "powershell" / "setup-tasks.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
  
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],
@@ -815,7 +815,7 @@ def test_setup_tasks_ps_passes_custom_branch_when_feature_json_valid(
     assert result.returncode == 0, result.stderr + result.stdout
  
  
-@pytest.mark.skipif(not (HAS_PWSH or _POWERSHELL), reason="no PowerShell available")
+@pytest.mark.skipif(not (HAS_PWSH or _WINDOWS_POWERSHELL), reason="no PowerShell available")
 def test_setup_tasks_ps_errors_without_feature_context(
     tasks_repo: Path,
 ) -> None:
@@ -826,7 +826,7 @@ def test_setup_tasks_ps_errors_without_feature_context(
     (main_feat / "plan.md").write_text("# plan\n", encoding="utf-8")
 
     script = tasks_repo / ".specify" / "scripts" / "powershell" / "setup-tasks.ps1"
-    exe = "pwsh" if HAS_PWSH else _POWERSHELL
+    exe = "pwsh" if HAS_PWSH else _WINDOWS_POWERSHELL
 
     result = subprocess.run(
         [exe, "-NoProfile", "-File", str(script), "-Json"],

tests/test_workflow_run_without_project.py

@@ -162,7 +162,9 @@ class TestWorkflowRunWithoutProject:
             ], catch_exceptions=False)
         finally:
             os.chdir(old_cwd)
-        assert result.exit_code == 0, f"workflow run failed unexpectedly: {result.output}"
+        # A failed workflow now maps to a non-zero process exit code so
+        # scripts and CI can rely on $? (the CLI itself still ran fine).
+        assert result.exit_code == 1, f"expected exit 1 on failed run: {result.output}"
         assert "Status: failed" in result.output
 
     def test_workflow_run_yaml_rejects_symlinked_specify_dir(self, tmp_path):

workflows/step-catalog.community.json

@@ -0,0 +1,6 @@
+{
+  "schema_version": "1.0",
+  "updated_at": "2026-04-28T00:00:00Z",
+  "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/workflows/step-catalog.community.json",
+  "steps": {}
+}

workflows/step-catalog.json

@@ -0,0 +1,6 @@
+{
+  "schema_version": "1.0",
+  "updated_at": "2026-04-28T00:00:00Z",
+  "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/workflows/step-catalog.json",
+  "steps": {}
+}