chore: bump version to 0.12.14

[extension] Add Spec Kit Memory extension to community catalog (#3455 )
* Add Spec Kit Memory extension to community catalog Add memory extension submitted by @zaytsevand to: - extensions/catalog.community.json (alphabetical order) - docs/community/extensions.md community extensions table Closes #3446 Assisted-by: GitHub Copilot (model: claude-sonnet-4.6, autonomous) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: resolve merge conflicts with main branch - extensions/catalog.community.json: keep updated_at 2026-07-10 (more recent) - docs/community/extensions.md: include both Spec Kit Figma (main) and Spec Kit Memory (this PR) in alphabetical order Assisted-by: GitHub Copilot (model: claude-sonnet-4.5, autonomous) * fix: add memsearch optional tool dependency to memory extension catalog entry Assisted-by: GitHub Copilot (model: claude-sonnet-4.5, autonomous) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
2026-08-03 06:26:30 +08:00 · 2026-07-13 22:52:30 +00:00 · 2026-07-13 17:50:58 -05:00 · 2026-07-13 17:43:04 -05:00 · 2026-07-13 17:13:17 -05:00 · 2026-07-13 15:54:59 -05:00
109 changed files with 3134 additions and 463 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -5,4 +5,3 @@
 /extensions/catalog.community.json @mnriem
 /integrations/catalog.community.json @mnriem
 /presets/catalog.community.json @mnriem
-
--- a/.github/ISSUE_TEMPLATE/agent_request.yml
+++ b/.github/ISSUE_TEMPLATE/agent_request.yml
@@ -7,7 +7,7 @@ body:
    attributes:
      value: |
        Thanks for requesting a new agent! Before submitting, please check if the agent is already supported.
-        
+
        **Currently supported agents**: Amp, Antigravity, Auggie CLI, Claude Code, Cline, CodeBuddy, Codex CLI, Cursor, Devin for Terminal, Firebender, Forge, Gemini CLI, GitHub Copilot, Goose, Hermes Agent, IBM Bob, Junie, Kilo Code, Kimi Code, Kiro CLI, Lingma, Mistral Vibe, Oh My Pi, opencode, Pi Coding Agent, Qoder CLI, Qwen Code, RovoDev ACLI, SHAI, Tabnine CLI, Trae, ZCode, Zed

  - type: input
--- a/.github/ISSUE_TEMPLATE/extension_submission.yml
+++ b/.github/ISSUE_TEMPLATE/extension_submission.yml
@@ -7,7 +7,7 @@ body:
    attributes:
      value: |
        Thanks for contributing an extension! This template helps you submit your extension to the community catalog.
-        
+
        **Before submitting:**
        - Review the [Extension Publishing Guide](https://github.com/github/spec-kit/blob/main/extensions/EXTENSION-PUBLISHING-GUIDE.md)
        - Ensure your extension has a valid `extension.yml` manifest
@@ -209,9 +209,9 @@ body:
        **Tested on:**
        - macOS 14.0 with Spec Kit v0.1.0
        - Linux Ubuntu 22.04 with Spec Kit v0.1.0
-        
+
        **Test project:** [Link or description]
-        
+
        **Test scenarios:**
        1. Installed extension
        2. Configured settings
@@ -230,7 +230,7 @@ body:
        ```bash
        # Install extension
        specify extension add <extension-name> --from https://github.com/your-org/spec-kit-your-extension/archive/refs/tags/v1.0.0.zip
-        
+
        # Use a command
        /speckit.your-extension.command-name arg1 arg2
        ```
--- a/.github/ISSUE_TEMPLATE/preset_submission.yml
+++ b/.github/ISSUE_TEMPLATE/preset_submission.yml
@@ -7,7 +7,7 @@ body:
    attributes:
      value: |
        Thanks for contributing a preset! This template helps you submit your preset to the community catalog.
-        
+
        **Before submitting:**
        - Review the [Preset Publishing Guide](https://github.com/github/spec-kit/blob/main/presets/PUBLISHING.md)
        - Ensure your preset has a valid `preset.yml` manifest
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -19,4 +19,3 @@
 - [ ] I **did** use AI assistance (describe below)

 <!-- If you used AI, briefly describe how (e.g., "Code generated by Copilot", "Consulted ChatGPT for approach"): -->
-
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -37,7 +37,7 @@ jobs:
          fi

      - name: Run markdownlint-cli2
-        uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23
+        uses: DavidAnson/markdownlint-cli2-action@8de2aa07cae85fd17c0b35642db70cf5495f1d25 # v24.0.0
        with:
          globs: |
            '**/*.md'
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -32,7 +32,7 @@ jobs:
          ref: refs/tags/${{ inputs.tag }}

      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
@@ -74,7 +74,7 @@ jobs:
          path: dist/

      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2

      - name: Publish to PyPI
        run: uv publish
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -20,24 +20,24 @@ jobs:
          days-before-stale: 150
          # Days of inactivity before a stale issue or PR is closed (after being marked stale)
          days-before-close: 30
-          
+
          # Stale issue settings
          stale-issue-message: 'This issue has been automatically marked as stale because it has not had any activity for 150 days. It will be closed in 30 days if no further activity occurs.'
          close-issue-message: 'This issue has been automatically closed due to inactivity (180 days total). If you believe this issue is still relevant, please reopen it or create a new issue.'
          stale-issue-label: 'stale'
-          
+
          # Stale PR settings
          stale-pr-message: 'This pull request has been automatically marked as stale because it has not had any activity for 150 days. It will be closed in 30 days if no further activity occurs.'
          close-pr-message: 'This pull request has been automatically closed due to inactivity (180 days total). If you believe this PR is still relevant, please reopen it or create a new PR.'
          stale-pr-label: 'stale'
-          
+
          # Exempt issues and PRs with these labels from being marked as stale
          exempt-issue-labels: 'pinned,security'
          exempt-pr-labels: 'pinned,security'
-          
+
          # Only issues or PRs with all of these labels are checked
          # Leave empty to check all issues and PRs
          any-of-labels: ''
-          
+
          # Operations per run (helps avoid rate limits)
          operations-per-run: 250
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,7 +16,7 @@ jobs:
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
@@ -37,7 +37,7 @@ jobs:
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
--- a/.markdownlint-cli2.jsonc
+++ b/.markdownlint-cli2.jsonc
@@ -26,4 +26,4 @@
  "ignores": [
    ".genreleases/"
  ]
-}
+}
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,12 @@
+---
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-executables-have-shebangs
+      - id: check-yaml
+        exclude: \.lock\.yml$
+      - id: end-of-file-fixer
+        exclude: \.lock\.yml$
+      - id: trailing-whitespace
+        exclude: \.lock\.yml$
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,97 @@

 <!-- insert new changelog below this comment -->

+## [0.12.14] - 2026-07-13
+
+### Changed
+
+- [extension] Add Spec Kit Memory extension to community catalog (#3455)
+- Add Test-First Governance preset to community catalog (#3504)
+- Add Autonomous Run Governance preset to community catalog (#3501)
+- fix(workflows): validate command step input/options are mappings (#3262)
+- fix(presets): resolve() honors manifest-declared file: for installed presets (#3351)
+- fix(init): don't block on confirmation for 'init --here' without a TTY (#3236)
+- [extension] Add Quality Gates (Enforcement Layer) extension to community catalog (#3431)
+- fix(integrations): exit cleanly on unbalanced quote in --integration-options (#3457) (#3466)
+- fix(integrations): declare kiro-cli multi-install safe (#3471) (#3485)
+- fix(workflows): fail fan-in step on non-list wait_for instead of crashing (#3482)
+- chore: release 0.12.13, begin 0.12.14.dev0 development (#3498)
+
+## [0.12.13] - 2026-07-13
+
+### Changed
+
+- fix(workflows): fail switch step on non-mapping cases instead of crashing (#3481)
+- Cleanup agent-file-template.md (#2579)
+- fix: mark Kiro integration as multi-install safe (#3472)
+- fix: rewrite extension-relative subdir paths in generated command bodies (#3444)
+- fix(templates): point constitution sync checklist at installed command files (#3418)
+- feat(workflows): make shell step timeout configurable (#3327) (#3328)
+- docs: clarify that release tags keep the leading v prefix (#3463)
+- fix(workflows): don't crash on membership test against a non-iterable (#3448)
+- fix(workflows): if-step validate accepts falsy non-list else (#3264)
+- chore: release 0.12.12, begin 0.12.13.dev0 development (#3490)
+
+## [0.12.12] - 2026-07-13
+
+### Changed
+
+- fix(extensions): set-priority repairs corrupted boolean priority (#3268)
+- fix(presets): set-priority repairs corrupted boolean priority (#3269)
+- fix(workflows): engine loop cap ignores bool max_iterations (#3270)
+- docs(bundles): document --integration on 'bundle update' (#3271)
+- fix(workflows): harden catalog.py against mis-shaped registry & non-string fields (#3375)
+- Add Verify Review Ship extension to community catalog (#3450)
+- fix(bundle): reject file:// / local download_url — catalog URLs are HTTPS-only (#3344)
+- fix(extensions): handle prefix-colliding env vars in _get_env_config (#3350)
+- docs: document copilot skills mode (--skills) and markdown deprecation (#3313)
+- chore: release 0.12.11, begin 0.12.12.dev0 development (#3460)
+
+## [0.12.11] - 2026-07-10
+
+### Changed
+
+- fix(agent-context): discover nested plan.md in scoped layouts (#3024) (#3301)
+- fix(auth): return no matches, not raw ValueError, for a malformed URL (#3437)
+- fix(catalogs): raise catalog error, not raw ValueError, on a malformed URL (#3435)
+- fix(bundler): raise BundlerError, not raw ValueError, on a malformed catalog URL (#3433)
+- chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430)
+- Add EARS Requirements Syntax extension to community catalog (#3407)
+- Add Spec Kit Figma extension to community catalog (#3408)
+- fix(workflows): report validation errors instead of crashing on non-string workflow.yml scalars (#3421)
+- fix(templates): remove self-referencing path in plan-template.md note (#3417)
+- chore: release 0.12.10, begin 0.12.11.dev0 development (#3453)
+
+## [0.12.10] - 2026-07-10
+
+### Changed
+
+- chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#3439)
+- chore(deps): bump DavidAnson/markdownlint-cli2-action (#3438)
+- fix(templates): correct phase numbering in plan.md (#3416)
+- fix(git-ext): honor explicit -Number 0 in PowerShell branch creation (#3412)
+- docs: add 'spectatui' entry to friends.md (#3362)
+- test: pin interpreter probe so py-template render test passes on Windows (#3428)
+- feat(workflows): make shell step timeout configurable (#3404)
+- fix: find plans in nested spec directories (#3405)
+- feat(templates): add py: lines to command templates' scripts frontmatter (#3403)
+- chore: release 0.12.9, begin 0.12.10.dev0 development (#3426)
+
+## [0.12.9] - 2026-07-09
+
+### Changed
+
+- fix(integrations): skip Windows Store python3 alias stub in resolve_python_interpreter (#3385)
+- fix(integrations): escape control characters in SKILL.md frontmatter (#3399)
+- fix(workflows): apply chained expression filters left-to-right (#3339)
+- fix(scripts): resolve invoke_separator by parse success, not python3 availability (#3304) (#3320)
+- fix(shared-infra): refresh_shared_templates preserves recovered user files (#3378)
+- fix(agents): resolve skill placeholders in Goose (yaml) command output (#3374)
+- fix(bundler): enforce version pin on bundled preset/extension installs (#3377)
+- Update Golden Demo extension to v0.3.0 (#3394)
+- test: isolate integration test home (#3144)
+- chore: release 0.12.8, begin 0.12.9.dev0 development (#3410)
+
 ## [0.12.8] - 2026-07-08

 ### Changed
--- a/1
+++ b/1
@@ -19,4 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ Spec-Driven Development **flips the script** on traditional software development

 ### 1. Install Specify CLI

-Requires **[uv](https://docs.astral.sh/uv/)** ([install uv](./docs/install/uv.md)). Replace `vX.Y.Z` with the latest tag from [Releases](https://github.com/github/spec-kit/releases):
+Requires **[uv](https://docs.astral.sh/uv/)** ([install uv](./docs/install/uv.md)). Replace `vX.Y.Z` with the latest release tag from [Releases](https://github.com/github/spec-kit/releases) — keep the leading `v` (for example, `v0.12.11`, not `0.12.11`):

 ```bash
 uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@vX.Y.Z
--- a/docs/.gitignore
+++ b/docs/.gitignore
@@ -6,4 +6,3 @@ obj/
 # Temporary files
 *.tmp
 *.log
-
--- a/docs/community/extensions.md
+++ b/docs/community/extensions.md
@@ -52,6 +52,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | Cost Tracker | Track real LLM dollar cost across SDD workflows — per-feature budgets, per-integration comparison, and finance-ready exports | `visibility` | Read+Write | [spec-kit-cost](https://github.com/Quratulain-bilal/spec-kit-cost) |
 | Data Model Diagram | Generates Mermaid ER diagrams from Spec Kit data models after planning | `docs` | Read+Write | [spec-kit-data-model-diagram](https://github.com/benizzio/spec-kit-data-model-diagram) |
 | DocGuard — CDD Enforcement | The only doc-integrity engine with an MCP server, SARIF output, and a deterministic zero-LLM core. Validates, scores, and traces documentation against code — 24 validators, stable finding codes, GitHub Action with PR annotations, spec-kit hooks. Pure Node.js, one pinned dep. | `docs` | Read+Write | [spec-kit-docguard](https://github.com/raccioly/docguard) |
+| EARS Requirements Syntax | Author, lint, and convert requirements using EARS - the five industry-standard sentence patterns for unambiguous, testable requirements | `docs` | Read+Write | [spec-kit-ears](https://github.com/dhruv-15-03/spec-kit-ears) |
 | Extensify | Create and validate extensions and extension catalogs | `process` | Read+Write | [extensify](https://github.com/mnriem/spec-kit-extensions/tree/main/extensify) |
 | Fix Findings | Automated analyze-fix-reanalyze loop that resolves spec findings until clean | `code` | Read+Write | [spec-kit-fix-findings](https://github.com/Quratulain-bilal/spec-kit-fix-findings) |
 | FixIt Extension | Spec-aware bug fixing — maps bugs to spec artifacts, proposes a plan, applies minimal changes | `code` | Read+Write | [spec-kit-fixit](https://github.com/speckit-community/spec-kit-fixit) |
@@ -97,6 +98,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | Project Health Check | Diagnose a Spec Kit project and report health issues across structure, agents, features, scripts, extensions, and git | `visibility` | Read-only | [spec-kit-doctor](https://github.com/KhawarHabibKhan/spec-kit-doctor) |
 | Project Status | Show current SDD workflow progress — active feature, artifact status, task completion, workflow phase, and extensions summary | `visibility` | Read-only | [spec-kit-status](https://github.com/KhawarHabibKhan/spec-kit-status) |
 | QA Testing Extension | Systematic QA testing with browser-driven or CLI-based validation of acceptance criteria from spec | `code` | Read-only | [spec-kit-qa](https://github.com/arunt14/spec-kit-qa) |
+| Quality Gates (Enforcement Layer) | Deterministic quality enforcement for Spec Kit projects at three boundaries — agent hooks, git pre-commit, CI — with one policy file and provable enforcement (attestations, canaries, verified parity). | `process` | Read+Write | [spec-gates](https://github.com/schwichtgit/spec-gates) |
 | RAG Azure Builder | Spec Kit extension for onboarding and operating an Azure RAG stack with guided workflows. | `process` | Read+Write | [spec-kit-extension-rag-azure-builder](https://github.com/Sertxito/spec-kit-extension-rag-azure-builder) |
 | Ralph Loop | Autonomous implementation loop using AI agent CLI | `code` | Read+Write | [spec-kit-ralph](https://github.com/Rubiss-Projects/spec-kit-ralph) |
 | Reconcile Extension | Reconcile implementation drift by surgically updating feature artifacts. | `docs` | Read+Write | [spec-kit-reconcile](https://github.com/stn1slv/spec-kit-reconcile) |
@@ -117,6 +119,8 @@ The following community-contributed extensions are available in [`catalog.commun
 | Spec Critique Extension | Dual-lens critical review of spec and plan from product strategy and engineering risk perspectives | `docs` | Read-only | [spec-kit-critique](https://github.com/arunt14/spec-kit-critique) |
 | Spec Diagram | Auto-generate Mermaid diagrams of SDD workflow state, feature progress, and task dependencies | `visibility` | Read-only | [spec-kit-diagram-](https://github.com/Quratulain-bilal/spec-kit-diagram-) |
 | Spec Kit Discovery Extension | Run technical discovery commands for feasibility, technology selection, scenario-specific technical decisions, legacy codebase assessment, implementation understanding, and proof-of-concept validation | `process` | Read+Write | [spec-kit-discovery](https://github.com/bigsmartben/spec-kit-discovery) |
+| Spec Kit Figma | Agent-agnostic SpecKit extension that grounds spec, plan & task generation in Figma design context — REST + optional MCP, single/mono/multi-repo, macOS/Linux/Windows. | `integration` | Read+Write | [spec-kit-figma](https://github.com/Fyloss/spec-kit-figma) |
+| Spec Kit Memory | Recalls prior specs and decisions from configurable memory tools (e.g. memsearch) before SDLC stages, so planning and specification start from what the project already knows | `docs` | Read+Write | [spec-kit-memory](https://github.com/zaytsevand/spec-kit-memory) |
 | Spec Kit Preview | Generate evidence-backed low, mid, or high fidelity previews from Spec Kit artifacts as Markdown or self-contained HTML | `docs` | Read+Write | [spec-kit-preview](https://github.com/bigsmartben/spec-kit-preview) |
 | Spec Kit Schedule | Optimal multi-agent task scheduling via CP-SAT — DAG precedence, hallucination-aware caps, file-conflict avoidance, stochastic durations, replanning, and interactive HTML output | `process` | Read+Write | [spec-kit-schedule](https://github.com/jfranc38/spec-kit-schedule) |
 | Spec Kit TLDR | Render a feature's spec.md / plan.md into a review-oriented TLDR (self-contained HTML dashboard + PR-native Markdown) that surfaces risks for faster PR review. | `visibility` | Read+Write | [speckit-tldr](https://github.com/qurore/speckit-tldr) |
@@ -146,6 +150,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | Token Economy | Token routing, measured savings, and context audit workflows | `process` | Read+Write | [spec-kit-token-economy](https://github.com/formin/spec-kit-token-economy) |
 | V-Model Extension Pack | Enforces V-Model paired generation of development specs and test specs with full traceability | `docs` | Read+Write | [spec-kit-v-model](https://github.com/leocamello/spec-kit-v-model) |
 | Verify Extension | Post-implementation quality gate that validates implemented code against specification artifacts | `code` | Read-only | [spec-kit-verify](https://github.com/ismaelJimenez/spec-kit-verify) |
+| Verify Review Ship | Adds post-implementation verify, review, and ship readiness gates to Spec Kit workflows | `process` | Read-only | [spec-kit-verify-review-ship](https://github.com/cadugevaerd/spec-kit-verify-review-ship) |
 | Verify Tasks Extension | Detect phantom completions: tasks marked [X] in tasks.md with no real implementation | `code` | Read-only | [spec-kit-verify-tasks](https://github.com/datastone-inc/spec-kit-verify-tasks) |
 | Version Guard | Verify tech stack versions against live npm registries before planning and implementation | `process` | Read-only | [spec-kit-version-guard](https://github.com/KevinBrown5280/spec-kit-version-guard) |
 | What-if Analysis | Preview the downstream impact (complexity, effort, tasks, risks) of requirement changes before committing to them | `visibility` | Read-only | [spec-kit-whatif](https://github.com/DevAbdullah90/spec-kit-whatif) |
--- a/docs/community/friends.md
+++ b/docs/community/friends.md
@@ -14,3 +14,5 @@ Community projects that extend, visualize, or build on Spec Kit:
 - **[SpecKit Companion](https://marketplace.visualstudio.com/items?itemName=alfredoperez.speckit-companion)** — A VS Code extension that brings a visual GUI to Spec Kit. Browse specs in a rich markdown viewer with clickable file references, create specifications with image attachments, comment and refine each step inline (GitHub-style review), track your progress through the SDD workflow with a visual phase stepper, and manage steering documents like constitutions and templates.

 - **[cc-spec-kit](https://github.com/speckit-community/cc-spec-kit)** — Community-maintained plugin for Claude Code and GitHub Copilot CLI that installs Spec Kit skills via the plugin marketplace.
+
+- **[spectatui](https://github.com/tinesoft/spectatui)** — A terminal UI (TUI) dashboard for Spec Kit that lets you track features, manage specifications, integrations, presets, workflows, and extensions, and monitor AI agent workflows. Attach to existing AI sessions or launch new ones from your terminal. Keyboard and mouse support. Light/dark theme support. Customizable and performance-oriented. Requires the `specify` CLI in your PATH.
--- a/docs/community/presets.md
+++ b/docs/community/presets.md
@@ -11,6 +11,7 @@ The following community-contributed presets customize how Spec Kit behaves — o
 | Agent Parity Governance | Adds shared-guidance parity, audit-ready Spec-Kit run evidence, and agent-neutral model-routing guidance across a project's declared AI-agent instruction surfaces so agent guidance does not drift. | 6 templates, 3 commands | — | [spec-kit-preset-agent-parity-governance](https://github.com/hindermath/spec-kit-preset-agent-parity-governance) |
 | AIDE In-Place Migration | Adapts the AIDE extension workflow for in-place technology migrations (X → Y pattern) — adds migration objectives, verification gates, knowledge documents, and behavioral equivalence criteria | 2 templates, 8 commands | AIDE extension | [spec-kit-presets](https://github.com/mnriem/spec-kit-presets) |
 | Architecture Governance | Adds secure software architecture, STRIDE+CAPEC threat modeling, arc42 security cross-cutting concepts, S-ADRs, Zero Trust applicability, OWASP SAMM governance, BSI C3A cloud autonomy, BSI C5 cloud compliance assurance, and audit-ready Spec Kit run evidence | 13 templates, 3 commands | — | [spec-kit-preset-architecture-governance](https://github.com/hindermath/spec-kit-preset-architecture-governance) |
+| Autonomous Run Governance | Adds permission-bounded, evidence-first governance for autonomous Spec Kit delivery, convergence, resume, closeout, and retrospective learning. | 10 templates, 2 commands | — | [spec-kit-preset-autonomous-run-governance](https://github.com/hindermath/spec-kit-preset-autonomous-run-governance) |
 | Canon Core | Adapts original Spec Kit workflow to work together with Canon extension | 2 templates, 8 commands | — | [spec-kit-canon](https://github.com/maximiliamus/spec-kit-canon) |
 | Claude AskUserQuestion | Upgrades `/speckit.clarify` and `/speckit.checklist` on Claude Code from Markdown-table prompts to the native AskUserQuestion picker, with a recommended option and reasoning on every question | 2 commands | — | [spec-kit-preset-claude-ask-questions](https://github.com/0xrafasec/spec-kit-preset-claude-ask-questions) |
 | Command Density | Compacts the nine core Spec Kit command prompts while preserving scripts, handoffs, placeholders, hook output blocks, and rule structure | 9 commands | — | [spec-kit-preset-command-density](https://github.com/Xopoko/spec-kit-preset-command-density) |
@@ -28,6 +29,7 @@ The following community-contributed presets customize how Spec Kit behaves — o
 | SicarioSpec Core | Baseline secure-by-default Spec Kit governance profile. | 5 templates | — | [sicario-spec](https://github.com/dfirs1car1o/sicario-spec) |
 | Spec2Cloud | Spec-driven workflow tuned for shipping to Azure: spec → plan → tasks → implement → deploy | 5 templates, 8 commands | — | [spec2cloud](https://github.com/Azure-Samples/Spec2Cloud) |
 | Table of Contents Navigation | Adds a navigable Table of Contents to generated spec.md, plan.md, and tasks.md documents | 3 templates, 3 commands | — | [spec-kit-preset-toc-navigation](https://github.com/Quratulain-bilal/spec-kit-preset-toc-navigation) |
+| Test-First Governance | Governs TDD with coverage-complete BDD/ATDD Gherkin scenarios, explicit suite ownership, professional test reports, traceability, and risk-based quality gates. | 10 templates, 8 commands | — | [spec-kit-preset-test-first-governance](https://github.com/ka-zo/spec-kit-preset-test-first-governance) |
 | VS Code Ask Questions | Enhances the clarify command to use `vscode/askQuestions` for batched interactive questioning. | 1 command | — | [spec-kit-presets](https://github.com/fdcastel/spec-kit-presets) |
 | Workflow Preset | Behavior-first specification, design artifacts, and agent-native handoff orchestration — adds requirement-phase behavior drafts, formal BDD/UIF/behavior contracts, optional design artifacts, and scoped implementation handoffs with Core Agent, Vertical Planner Agent, and Worker Agent modes | 22 templates, 8 commands | — | [spec-kit-workflow-preset](https://github.com/bigsmartben/spec-kit-workflow-preset) |

--- a/docs/install/one-time.md
+++ b/docs/install/one-time.md
@@ -11,7 +11,8 @@ If you want to try Spec Kit without installing it permanently, use `uvx` to run
 # Create a new project (latest from main)
 uvx --from git+https://github.com/github/spec-kit.git specify init <PROJECT_NAME>

-# Or target a specific release (replace vX.Y.Z with a tag from Releases)
+# Or target a specific release (replace vX.Y.Z with a tag from Releases;
+# keep the leading v, e.g. v0.12.11 not 0.12.11)
 uvx --from git+https://github.com/github/spec-kit.git@vX.Y.Z specify init <PROJECT_NAME>

 # Initialize in the current directory
--- a/docs/install/pipx.md
+++ b/docs/install/pipx.md
@@ -7,7 +7,8 @@
 Pin a specific release tag for stability (check [Releases](https://github.com/github/spec-kit/releases) for the latest):

 ```bash
-# Install a specific stable release (recommended — replace vX.Y.Z with the latest tag)
+# Install a specific stable release (recommended — replace vX.Y.Z with the
+# latest tag, keeping the leading v, e.g. v0.12.11 not 0.12.11)
 pipx install git+https://github.com/github/spec-kit.git@vX.Y.Z

 # Or install latest from main (may include unreleased changes)
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -15,7 +15,7 @@

 ### Persistent Installation (Recommended)

-Install once and use everywhere. Replace `vX.Y.Z` with a tag from [Releases](https://github.com/github/spec-kit/releases):
+Install once and use everywhere. Replace `vX.Y.Z` with a release tag from [Releases](https://github.com/github/spec-kit/releases) — keep the leading `v` (for example, `v0.12.11`, not `0.12.11`):

 > [!NOTE]
 > The command below requires **[uv](https://docs.astral.sh/uv/)**. If you see `command not found: uv`, [install uv first](./install/uv.md).
--- a/docs/reference/bundles.md
+++ b/docs/reference/bundles.md
@@ -51,10 +51,11 @@ If the current directory is not yet a Spec Kit project, `install` initializes on
 specify bundle update [<bundle_id>]
 ```

-| Option       | Description                          |
-| ------------ | ------------------------------------ |
-| `--all`      | Update every installed bundle        |
-| `--offline`  | Do not access the network            |
+| Option           | Description                                                                                                            |
+| ---------------- | --------------------------------------------------------------------------------------------------------------------- |
+| `--all`          | Update every installed bundle                                                                                         |
+| `--integration`  | Override the integration used when refreshing components; applied only when the project's active integration can't be determined |
+| `--offline`      | Do not access the network                                                                                             |

 Re-resolves a bundle and **refreshes** its components through each primitive's update path, bringing already-installed components up to the bundle's newly pinned versions while preserving primitive-level overrides (such as preset priority). Provide a bundle id, or use `--all` to update everything installed.

--- a/docs/reference/integrations.md
+++ b/docs/reference/integrations.md
@@ -18,7 +18,7 @@ The Specify CLI supports a wide range of AI coding agents. When you run `specify
 | [Firebender](https://firebender.com/)                                                | `firebender`     | IDE-based agent for Android Studio / IntelliJ                                                                                             |
 | [Forge](https://forgecode.dev/)                                                      | `forge`          |                                                                                                                                           |
 | [Gemini CLI](https://github.com/google-gemini/gemini-cli)                            | `gemini`         |                                                                                                                                           |
-| [GitHub Copilot](https://code.visualstudio.com/)                                     | `copilot`        |                                                                                                                                           |
+| [GitHub Copilot](https://code.visualstudio.com/)                                     | `copilot`        | Defaults to legacy markdown mode: `.agent.md` command files under `.github/agents/`, companion `.prompt.md` files under `.github/prompts/`, and a `.vscode/settings.json` merge. Pass `--integration-options="--skills"` to scaffold skills as `speckit-<command>/SKILL.md` under `.github/skills/` instead. Legacy markdown mode is deprecated and will stop being the default in a future release. |
 | [Goose](https://goose-docs.ai/)                                                      | `goose`          | Uses YAML recipe format in `.goose/recipes/`                                                                                              |
 | [Hermes](https://github.com/NousResearch/hermes-agent)                               | `hermes`         | Skills-based integration; installs skills globally into `~/.hermes/skills/`                                                                |
 | [IBM Bob](https://www.ibm.com/products/bob)                                          | `bob`            | IDE-based agent                                                                                                                           |
@@ -219,6 +219,7 @@ Some integrations accept additional options via `--integration-options`:
 | ----------- | ------------------- | -------------------------------------------------------------- |
 | `generic`   | `--commands-dir`    | Required. Directory for command files                          |
 | `kimi`      | `--migrate-legacy`  | Migrate legacy `.kimi/skills/` installs to `.kimi-code/skills/` (including dotted→hyphenated skill naming, e.g. `speckit.xxx` → `speckit-xxx`) |
+| `copilot`   | `--skills`          | Scaffold commands as agent skills (`speckit-<command>/SKILL.md` under `.github/skills/`, invoked as `/speckit-<command>`) instead of the default legacy markdown mode (`.github/agents/*.agent.md` plus `.github/prompts/*.prompt.md` and a `.vscode/settings.json` merge). Without this flag, install warns that legacy markdown mode is deprecated. |

 Example:

--- a/extensions/agent-context/commands/speckit.agent-context.update.md
+++ b/extensions/agent-context/commands/speckit.agent-context.update.md
@@ -15,7 +15,7 @@ The script reads the agent-context extension config at
 - `context_files` — optional project-relative paths for multiple coding agent context files. When non-empty, the script updates each listed file and the list takes precedence over `context_file`.
 - `context_markers.start` / `.end` — the delimiters surrounding the managed section. Defaults to `<!-- SPECKIT START -->` and `<!-- SPECKIT END -->` when the field is missing.

-It then creates, replaces, or appends the managed block so that the section points at the most recent plan path when one can be discovered (`specs/<feature>/plan.md`).
+It then creates, replaces, or appends the managed block so that the section points at the most recent plan path when one can be discovered (any `plan.md` under `specs/`, including nested scoped layouts such as `specs/<scope>/<feature>/plan.md`).

 If `context_files` and `context_file` are empty, the command reports nothing to do and exits successfully. Context file paths must stay project-relative; absolute paths, Windows drive paths, backslash separators, and `..` path segments are rejected.

@@ -24,4 +24,4 @@ If `context_files` and `context_file` are empty, the command reports nothing to
 - **Bash**: `.specify/extensions/agent-context/scripts/bash/update-agent-context.sh [plan_path]`
 - **PowerShell**: `.specify/extensions/agent-context/scripts/powershell/update-agent-context.ps1 [plan_path]`

-When `plan_path` is omitted, the script auto-detects the most recently modified `specs/*/plan.md`.
+When `plan_path` is omitted, the script auto-detects the most recently modified `specs/**/plan.md` (searched recursively, so nested scoped layouts are discovered).
--- a/extensions/agent-context/scripts/bash/update-agent-context.sh
+++ b/extensions/agent-context/scripts/bash/update-agent-context.sh
@@ -12,7 +12,7 @@
 #
 # When `plan_path` is omitted, the script derives it from `.specify/feature.json`
 # (written by /speckit-specify). Falls back to the most recently modified
-# `specs/*/plan.md` only when feature.json is absent or its plan does not exist yet.
+# `specs/**/plan.md` only when feature.json is absent or its plan does not exist yet.

 set -euo pipefail

@@ -307,16 +307,28 @@ import sys
 from pathlib import Path
 root = Path(sys.argv[1]).resolve()
 specs = root / "specs"
-plans = sorted(
-    specs.glob("*/plan.md"),
-    key=lambda p: p.stat().st_mtime,
-    reverse=True,
-)
-if plans:
+
+def _resolved_rel(p):
+    # Resolve symlinks before checking containment: relative_to() is lexical
+    # and would otherwise accept a plan reached through a specs/ symlink that
+    # points outside the project, emitting an in-project-looking path for an
+    # out-of-project file (or picking it as "most recent").
    try:
-        print(plans[0].relative_to(root).as_posix())
-    except ValueError:
-        print("")
+        return p.resolve().relative_to(root)
+    except (OSError, ValueError):
+        return None
+
+# Recurse (rather than the old one-level specs/*/plan.md glob) so scoped layouts
+# created via SPECIFY_FEATURE_DIRECTORY, e.g. specs/<scope>/<feature>/plan.md,
+# are still discovered when feature.json is absent (#3024).
+candidates = []
+for p in specs.rglob("plan.md"):
+    rel = _resolved_rel(p)
+    if rel:
+        candidates.append((p, rel))
+candidates.sort(key=lambda pr: pr[0].stat().st_mtime, reverse=True)
+if candidates:
+    print(candidates[0][1].as_posix())
 else:
    print("")
 PY
--- a/extensions/agent-context/scripts/powershell/update-agent-context.ps1
+++ b/extensions/agent-context/scripts/powershell/update-agent-context.ps1
@@ -12,7 +12,7 @@
 #
 # When `plan_path` is omitted, the script derives it from `.specify/feature.json`
 # (written by /speckit-specify). Falls back to the most recently modified
-# `specs/*/plan.md` only when feature.json is absent or its plan does not exist yet.
+# `specs/**/plan.md` only when feature.json is absent or its plan does not exist yet.

 [CmdletBinding()]
 param(
@@ -426,9 +426,11 @@ if (-not $PlanPath) {
    if (-not $PlanPath) {
        try {
            $specsDir = Join-Path $ProjectRoot 'specs'
-            $candidate = Get-ChildItem -Path $specsDir -Directory -ErrorAction SilentlyContinue |
-                ForEach-Object { Get-Item -LiteralPath (Join-Path $_.FullName 'plan.md') -ErrorAction SilentlyContinue } |
-                Where-Object { $_ } |
+            # Recurse (rather than the old one-level specs/*/plan.md scan) so scoped
+            # layouts created via SPECIFY_FEATURE_DIRECTORY, e.g.
+            # specs/<scope>/<feature>/plan.md, are still discovered when
+            # feature.json is absent (#3024).
+            $candidate = Get-ChildItem -Path $specsDir -Filter 'plan.md' -File -Recurse -ErrorAction SilentlyContinue |
                Sort-Object LastWriteTime -Descending |
                Select-Object -First 1
            if ($candidate) {
--- a/extensions/catalog.community.json
+++ b/extensions/catalog.community.json
@@ -1,6 +1,6 @@
 {
  "schema_version": "1.0",
-  "updated_at": "2026-07-07T00:00:00Z",
+  "updated_at": "2026-07-13T00:00:00Z",
  "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/extensions/catalog.community.json",
  "extensions": {
    "aide": {
@@ -1180,6 +1180,39 @@
      "created_at": "2026-03-13T00:00:00Z",
      "updated_at": "2026-03-13T00:00:00Z"
    },
+    "ears": {
+      "name": "EARS Requirements Syntax",
+      "id": "ears",
+      "description": "Author, lint, and convert requirements using EARS (Easy Approach to Requirements Syntax) - the five industry-standard sentence patterns for unambiguous, testable requirements.",
+      "author": "dhruv-15-03",
+      "version": "1.0.0",
+      "download_url": "https://github.com/dhruv-15-03/spec-kit-ears/archive/refs/tags/v1.0.0.zip",
+      "repository": "https://github.com/dhruv-15-03/spec-kit-ears",
+      "homepage": "https://github.com/dhruv-15-03/spec-kit-ears",
+      "documentation": "https://github.com/dhruv-15-03/spec-kit-ears/blob/main/README.md",
+      "changelog": "https://github.com/dhruv-15-03/spec-kit-ears/blob/main/CHANGELOG.md",
+      "license": "MIT",
+      "category": "docs",
+      "effect": "read-write",
+      "requires": {
+        "speckit_version": ">=0.9.0"
+      },
+      "provides": {
+        "commands": 3,
+        "hooks": 0
+      },
+      "tags": [
+        "ears",
+        "requirements",
+        "specification",
+        "quality"
+      ],
+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-07-08T00:00:00Z",
+      "updated_at": "2026-07-08T00:00:00Z"
+    },
    "extensify": {
      "name": "Extensify",
      "id": "extensify",
@@ -1213,6 +1246,47 @@
      "created_at": "2026-03-18T00:00:00Z",
      "updated_at": "2026-04-23T00:00:00Z"
    },
+    "figma": {
+      "name": "Spec Kit Figma",
+      "id": "figma",
+      "description": "Agent-agnostic SpecKit extension that grounds spec, plan & task generation in Figma design context — REST + optional MCP, single/mono/multi-repo, macOS/Linux/Windows.",
+      "author": "Fyloss",
+      "version": "1.6.0",
+      "download_url": "https://github.com/Fyloss/spec-kit-figma/archive/refs/tags/v1.6.0.zip",
+      "repository": "https://github.com/Fyloss/spec-kit-figma",
+      "homepage": "https://github.com/Fyloss/spec-kit-figma",
+      "documentation": "https://github.com/Fyloss/spec-kit-figma/blob/main/docs/INSTALL.md",
+      "changelog": "https://github.com/Fyloss/spec-kit-figma/blob/main/CHANGELOG.md",
+      "license": "MIT",
+      "category": "integration",
+      "effect": "read-write",
+      "requires": {
+        "speckit_version": ">=0.1.0",
+        "tools": [
+          { "name": "git", "required": true },
+          { "name": "bash", "required": false },
+          { "name": "curl", "required": false },
+          { "name": "jq", "required": false },
+          { "name": "pwsh", "required": false }
+        ]
+      },
+      "provides": {
+        "commands": 5,
+        "hooks": 6
+      },
+      "tags": [
+        "figma",
+        "design",
+        "frontend",
+        "ui",
+        "design-system"
+      ],
+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-07-08T00:00:00Z",
+      "updated_at": "2026-07-08T00:00:00Z"
+    },
    "fix-findings": {
      "name": "Fix Findings",
      "id": "fix-findings",
@@ -1353,6 +1427,57 @@
      "created_at": "2026-05-06T00:00:00Z",
      "updated_at": "2026-05-06T00:00:00Z"
    },
+    "gates": {
+      "name": "Quality Gates (Enforcement Layer)",
+      "id": "gates",
+      "description": "Deterministic quality enforcement for Spec Kit projects at three boundaries — agent hooks, git pre-commit, CI — with one policy file and provable enforcement (attestations, canaries, verified parity).",
+      "author": "schwichtgit",
+      "version": "0.1.0",
+      "download_url": "https://github.com/schwichtgit/spec-gates/releases/download/v0.1.0/gates-0.1.0.zip",
+      "repository": "https://github.com/schwichtgit/spec-gates",
+      "homepage": "https://github.com/schwichtgit/spec-gates",
+      "documentation": "https://github.com/schwichtgit/spec-gates/blob/main/docs/how-it-works.md",
+      "license": "MIT",
+      "category": "process",
+      "effect": "read-write",
+      "requires": {
+        "speckit_version": ">=0.12.0",
+        "tools": [
+          {
+            "name": "jq",
+            "required": true
+          },
+          {
+            "name": "git",
+            "required": true
+          },
+          {
+            "name": "node",
+            "required": false
+          },
+          {
+            "name": "shellcheck",
+            "required": false
+          }
+        ]
+      },
+      "provides": {
+        "commands": 5,
+        "hooks": 1
+      },
+      "tags": [
+        "quality",
+        "enforcement",
+        "hooks",
+        "ci",
+        "governance"
+      ],
+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-07-09T00:00:00Z",
+      "updated_at": "2026-07-13T00:00:00Z"
+    },
    "github-issues": {
      "name": "GitHub Issues Integration 1",
      "id": "github-issues",
@@ -2143,6 +2268,42 @@
      "created_at": "2026-05-08T00:00:00Z",
      "updated_at": "2026-05-08T00:00:00Z"
    },
+    "memory": {
+      "name": "Spec Kit Memory",
+      "id": "memory",
+      "description": "Recalls prior specs and decisions from configurable memory tools (e.g. memsearch) before SDLC stages, so planning and specification start from what the project already knows.",
+      "author": "Andrey Zaytsev",
+      "version": "0.3.0",
+      "download_url": "https://github.com/zaytsevand/spec-kit-memory/archive/refs/tags/v0.3.0.zip",
+      "repository": "https://github.com/zaytsevand/spec-kit-memory",
+      "homepage": "https://github.com/zaytsevand/spec-kit-memory",
+      "documentation": "https://github.com/zaytsevand/spec-kit-memory/blob/main/README.md",
+      "changelog": "",
+      "license": "MIT",
+      "category": "docs",
+      "effect": "read-write",
+      "requires": {
+        "speckit_version": ">=0.2.0",
+        "tools": [
+          { "name": "memsearch", "required": false }
+        ]
+      },
+      "provides": {
+        "commands": 2,
+        "hooks": 3
+      },
+      "tags": [
+        "memory",
+        "recall",
+        "research",
+        "memsearch"
+      ],
+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-07-10T00:00:00Z",
+      "updated_at": "2026-07-10T00:00:00Z"
+    },
    "memory-loader": {
      "name": "Memory Loader",
      "id": "memory-loader",
@@ -4282,6 +4443,40 @@
      "created_at": "2026-03-03T00:00:00Z",
      "updated_at": "2026-04-09T00:00:00Z"
    },
+    "verify-review-ship": {
+      "name": "Verify Review Ship",
+      "id": "verify-review-ship",
+      "description": "Adds post-implementation verify, review, and ship readiness gates to Spec Kit workflows.",
+      "author": "Carlos Eduardo Gevaerd Araujo",
+      "version": "0.1.0",
+      "download_url": "https://github.com/cadugevaerd/spec-kit-verify-review-ship/archive/refs/tags/v0.1.0.zip",
+      "repository": "https://github.com/cadugevaerd/spec-kit-verify-review-ship",
+      "homepage": "https://github.com/cadugevaerd/spec-kit-verify-review-ship",
+      "documentation": "https://github.com/cadugevaerd/spec-kit-verify-review-ship/blob/main/README.md",
+      "changelog": "https://github.com/cadugevaerd/spec-kit-verify-review-ship/blob/main/CHANGELOG.md",
+      "license": "MIT",
+      "category": "process",
+      "effect": "read-only",
+      "requires": {
+        "speckit_version": ">=0.1.0"
+      },
+      "provides": {
+        "commands": 3,
+        "hooks": 1
+      },
+      "tags": [
+        "quality",
+        "review",
+        "shipping",
+        "workflow",
+        "testing"
+      ],
+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-07-10T00:00:00Z",
+      "updated_at": "2026-07-10T00:00:00Z"
+    },
    "verify-tasks": {
      "name": "Verify Tasks Extension",
      "id": "verify-tasks",
--- a/extensions/catalog.json
+++ b/extensions/catalog.json
@@ -48,4 +48,4 @@
      ]
    }
  }
-}
+}
--- a/extensions/git/scripts/powershell/create-new-feature-branch.ps1
+++ b/extensions/git/scripts/powershell/create-new-feature-branch.ps1
@@ -446,7 +446,10 @@ if ($env:GIT_BRANCH_NAME) {
        $branchSuffix = Get-BranchName -Description $featureDesc
    }

-    if ($Timestamp -and $Number -ne 0) {
+    # Warn if -Number and -Timestamp are both specified. Use ContainsKey (not
+    # `-ne 0`) so an explicit `-Number 0` is also detected, matching the bash twin's
+    # `[ -n "$BRANCH_NUMBER" ]` check.
+    if ($Timestamp -and $PSBoundParameters.ContainsKey('Number')) {
        Write-Warning "[specify] Warning: -Number is ignored when -Timestamp is used"
        $Number = 0
    }
@@ -456,7 +459,10 @@ if ($env:GIT_BRANCH_NAME) {
        $branchName = New-BranchName -FeatureNum $featureNum -BranchSuffix $branchSuffix
    } else {
        $branchScopePrefix = Get-BranchScopePrefix -Template $branchTemplate -BranchSuffix $branchSuffix
-        if ($Number -eq 0) {
+        # Auto-detect the next number only when -Number was not supplied; an
+        # explicit value (including 0) is honored, matching the bash twin's
+        # `[ -z "$BRANCH_NUMBER" ]` check.
+        if (-not $PSBoundParameters.ContainsKey('Number')) {
            if ($DryRun -and $hasGit) {
                $Number = Get-NextBranchNumber -SpecsDir $specsDir -SkipFetch -ScopePrefix $branchScopePrefix
            } elseif ($DryRun) {
--- a/extensions/selftest/commands/selftest.md
+++ b/extensions/selftest/commands/selftest.md
@@ -48,7 +48,7 @@ cat .specify/extensions/.registry/$ARGUMENTS.json

 ### Step 4: Verification Report

-Analyze the standard output of the three steps. 
+Analyze the standard output of the three steps.
 Generate a terminal-style test output format detailing the results of discovery, installation, and registration. Return this directly to the user.

 Example output format:
--- a/newsletters/2026-March.md
+++ b/newsletters/2026-March.md
@@ -76,5 +76,3 @@ Areas under discussion or in progress for future development:
 - **Continued agent expansion** -- seven new agents were added in March alone. The agent-agnostic design means support for emerging tools can be added by anyone. [\[byteiota.com\]](https://byteiota.com/spec-driven-development-kills-vibe-coding-march-2026/)
 - **Experience simplification** -- the preset system, custom workflows, and growing walkthrough library lower the learning curve, but extension discoverability will need a more robust solution as the catalog grows. [\[github.com\]](https://github.com/github/spec-kit/releases)
 - **Toward a stable release** -- nine releases in one month reflects pre-1.0 momentum. Reaching 1.0 will require stabilizing the extension and preset APIs and ensuring backward compatibility across the agent and extension surface area. [\[github.com\]](https://github.com/github/spec-kit/blob/main/newsletters/2026-February.md)
-
-
--- a/presets/ARCHITECTURE.md
+++ b/presets/ARCHITECTURE.md
@@ -158,8 +158,7 @@ presets/
        ├── plan-template.md
        ├── tasks-template.md
        ├── checklist-template.md
-        ├── constitution-template.md
-        └── agent-file-template.md
+        └── constitution-template.md
 ```

 ## Module Structure
--- a/presets/catalog.community.json
+++ b/presets/catalog.community.json
@@ -1,6 +1,6 @@
 {
  "schema_version": "1.0",
-  "updated_at": "2026-06-30T00:00:00Z",
+  "updated_at": "2026-07-13T00:00:00Z",
  "catalog_url": "https://raw.githubusercontent.com/github/spec-kit/main/presets/catalog.community.json",
  "presets": {
    "a11y-governance": {
@@ -131,6 +131,34 @@
      "created_at": "2026-04-27T00:00:00Z",
      "updated_at": "2026-06-14T00:00:00Z"
    },
+    "autonomous-run-governance": {
+      "name": "Autonomous Run Governance",
+      "id": "autonomous-run-governance",
+      "version": "0.1.1",
+      "description": "Adds permission-bounded, evidence-first governance for autonomous Spec Kit delivery, convergence, resume, closeout, and retrospective learning.",
+      "author": "Thorsten Hindermann",
+      "repository": "https://github.com/hindermath/spec-kit-preset-autonomous-run-governance",
+      "download_url": "https://github.com/hindermath/spec-kit-preset-autonomous-run-governance/archive/refs/tags/v0.1.1.zip",
+      "homepage": "https://github.com/hindermath/spec-kit-preset-autonomous-run-governance",
+      "documentation": "https://github.com/hindermath/spec-kit-preset-autonomous-run-governance/blob/main/README.md",
+      "license": "MIT",
+      "requires": {
+        "speckit_version": ">=0.8.3"
+      },
+      "provides": {
+        "templates": 10,
+        "commands": 2
+      },
+      "tags": [
+        "autonomous",
+        "governance",
+        "evidence",
+        "permissions",
+        "retrospective"
+      ],
+      "created_at": "2026-07-13T00:00:00Z",
+      "updated_at": "2026-07-13T00:00:00Z"
+    },
    "canon-core": {
      "name": "Canon Core",
      "id": "canon-core",
@@ -618,6 +646,34 @@
      "created_at": "2026-04-30T00:00:00Z",
      "updated_at": "2026-04-30T00:00:00Z"
    },
+    "test-first-governance": {
+      "name": "Test-First Governance",
+      "id": "test-first-governance",
+      "version": "1.3.0",
+      "description": "Governs TDD with coverage-complete BDD/ATDD Gherkin scenarios, explicit suite ownership, professional test reports, traceability, and risk-based quality gates.",
+      "author": "Zoltán Katona, PhD",
+      "repository": "https://github.com/ka-zo/spec-kit-preset-test-first-governance",
+      "download_url": "https://github.com/ka-zo/spec-kit-preset-test-first-governance/archive/refs/tags/1.3.0.zip",
+      "homepage": "https://github.com/ka-zo/spec-kit-preset-test-first-governance",
+      "documentation": "https://github.com/ka-zo/spec-kit-preset-test-first-governance/blob/main/README.md",
+      "license": "MIT",
+      "requires": {
+        "speckit_version": ">=0.12.11"
+      },
+      "provides": {
+        "templates": 10,
+        "commands": 8
+      },
+      "tags": [
+        "tdd",
+        "bdd",
+        "atdd",
+        "quality-gates",
+        "traceability"
+      ],
+      "created_at": "2026-07-13T00:00:00Z",
+      "updated_at": "2026-07-13T00:00:00Z"
+    },
    "toc-navigation": {
      "name": "Table of Contents Navigation",
      "id": "toc-navigation",
--- a/presets/self-test/preset.yml
+++ b/presets/self-test/preset.yml
@@ -44,12 +44,6 @@ provides:
      description: "Self-test constitution template"
      replaces: "constitution-template"

-    - type: "template"
-      name: "agent-file-template"
-      file: "templates/agent-file-template.md"
-      description: "Self-test agent file template"
-      replaces: "agent-file-template"
-
    - type: "command"
      name: "speckit.specify"
      file: "commands/speckit.specify.md"
--- a/presets/self-test/templates/agent-file-template.md
+++ b/presets/self-test/templates/agent-file-template.md
@@ -1,9 +0,0 @@
-# Agent File (Self-Test Preset)
-
-<!-- preset:self-test -->
-
-> This template is provided by the self-test preset.
-
-## Agent Instructions
-
-Follow these guidelines when working on this project.
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "specify-cli"
-version = "0.12.9.dev0"
+version = "0.12.14"
 description = "Specify CLI, part of GitHub Spec Kit. A tool to bootstrap your projects for Spec-Driven Development (SDD)."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -83,4 +83,3 @@ extend-select = [
    "S604",  # call-with-shell-equals-true
    "S605",  # start-process-with-a-shell
 ]
-
--- a/scripts/bash/check-prerequisites.sh
+++ b/scripts/bash/check-prerequisites.sh
@@ -57,13 +57,13 @@ OPTIONS:
 EXAMPLES:
  # Check task prerequisites (plan.md required)
  ./check-prerequisites.sh --json
-  
+
  # Check implementation prerequisites (plan.md + tasks.md required)
  ./check-prerequisites.sh --json --require-tasks --include-tasks
-  
+
  # Get feature paths only (no validation)
  ./check-prerequisites.sh --paths-only
-  
+
 EOF
            exit 0
            ;;
@@ -182,13 +182,13 @@ else
    # Text output
    echo "FEATURE_DIR:$FEATURE_DIR"
    echo "AVAILABLE_DOCS:"
-    
+
    # Show status of each potential document
    check_file "$RESEARCH" "research.md"
    check_file "$DATA_MODEL" "data-model.md"
    check_dir "$CONTRACTS_DIR" "contracts/"
    check_file "$QUICKSTART" "quickstart.md"
-    
+
    if $INCLUDE_TASKS; then
        check_file "$TASKS" "tasks.md"
    fi
--- a/scripts/bash/create-new-feature.sh
+++ b/scripts/bash/create-new-feature.sh
@@ -94,7 +94,7 @@ fi
 get_highest_from_specs() {
    local specs_dir="$1"
    local highest=0
-    
+
    if [ -d "$specs_dir" ]; then
        for dir in "$specs_dir"/*; do
            [ -d "$dir" ] || continue
@@ -109,7 +109,7 @@ get_highest_from_specs() {
            fi
        done
    fi
-    
+
    echo "$highest"
 }

@@ -135,19 +135,19 @@ fi
 # Function to generate branch name with stop word filtering and length filtering
 generate_branch_name() {
    local description="$1"
-    
+
    # Common stop words to filter out
    local stop_words="^(i|a|an|the|to|for|of|in|on|at|by|with|from|is|are|was|were|be|been|being|have|has|had|do|does|did|will|would|should|could|can|may|might|must|shall|this|that|these|those|my|your|our|their|want|need|add|get|set)$"
-    
+
    # Convert to lowercase and split into words
    local clean_name=$(printf '%s' "$description" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/ /g')
-    
+
    # Filter words: remove stop words and words shorter than 3 chars (unless they're uppercase acronyms in original)
    local meaningful_words=()
    for word in $clean_name; do
        # Skip empty words
        [ -z "$word" ] && continue
-        
+
        # Keep words that are NOT stop words AND (length >= 3 OR are potential acronyms)
        if ! echo "$word" | grep -qiE "$stop_words"; then
            if [ ${#word} -ge 3 ]; then
@@ -160,12 +160,12 @@ generate_branch_name() {
            fi
        fi
    done
-    
+
    # If we have meaningful words, use first 3-4 of them
    if [ ${#meaningful_words[@]} -gt 0 ]; then
        local max_words=3
        if [ ${#meaningful_words[@]} -eq 4 ]; then max_words=4; fi
-        
+
        local result=""
        local count=0
        for word in "${meaningful_words[@]}"; do
@@ -221,15 +221,15 @@ if [ ${#BRANCH_NAME} -gt $MAX_BRANCH_LENGTH ]; then
    # Account for prefix length: timestamp (15) + hyphen (1) = 16, or sequential (3) + hyphen (1) = 4
    PREFIX_LENGTH=$(( ${#FEATURE_NUM} + 1 ))
    MAX_SUFFIX_LENGTH=$((MAX_BRANCH_LENGTH - PREFIX_LENGTH))
-    
+
    # Truncate suffix at word boundary if possible
    TRUNCATED_SUFFIX=$(echo "$BRANCH_SUFFIX" | cut -c1-$MAX_SUFFIX_LENGTH)
    # Remove trailing hyphen if truncation created one
    TRUNCATED_SUFFIX=$(echo "$TRUNCATED_SUFFIX" | sed 's/-$//')
-    
+
    ORIGINAL_BRANCH_NAME="$BRANCH_NAME"
    BRANCH_NAME="${FEATURE_NUM}-${TRUNCATED_SUFFIX}"
-    
+
    >&2 echo "[specify] Warning: Branch name exceeded GitHub's 244-byte limit"
    >&2 echo "[specify] Original: $ORIGINAL_BRANCH_NAME (${#ORIGINAL_BRANCH_NAME} bytes)"
    >&2 echo "[specify] Truncated to: $BRANCH_NAME (${#BRANCH_NAME} bytes)"
--- a/scripts/bash/setup-plan.sh
+++ b/scripts/bash/setup-plan.sh
@@ -8,17 +8,17 @@ ARGS=()

 for arg in "$@"; do
    case "$arg" in
-        --json) 
-            JSON_MODE=true 
+        --json)
+            JSON_MODE=true
            ;;
-        --help|-h) 
+        --help|-h)
            echo "Usage: $0 [--json]"
            echo "  --json    Output results in JSON format"
            echo "  --help    Show this help message"
-            exit 0 
+            exit 0
            ;;
-        *) 
-            ARGS+=("$arg") 
+        *)
+            ARGS+=("$arg")
            ;;
    esac
 done
@@ -77,8 +77,7 @@ if $JSON_MODE; then
    fi
 else
    echo "FEATURE_SPEC: $FEATURE_SPEC"
-    echo "IMPL_PLAN: $IMPL_PLAN" 
+    echo "IMPL_PLAN: $IMPL_PLAN"
    echo "SPECS_DIR: $FEATURE_DIR"
    echo "BRANCH: $CURRENT_BRANCH"
 fi
-
--- a/scripts/powershell/check-prerequisites.ps1
+++ b/scripts/powershell/check-prerequisites.ps1
@@ -42,10 +42,10 @@ OPTIONS:
 EXAMPLES:
  # Check task prerequisites (plan.md required)
  .\check-prerequisites.ps1 -Json
-  
+
  # Check implementation prerequisites (plan.md + tasks.md required)
  .\check-prerequisites.ps1 -Json -RequireTasks -IncludeTasks
-  
+
  # Get feature paths only (no validation)
  .\check-prerequisites.ps1 -PathsOnly

@@ -118,35 +118,35 @@ if (Test-Path $paths.RESEARCH) { $docs += 'research.md' }
 if (Test-Path $paths.DATA_MODEL) { $docs += 'data-model.md' }

 # Check contracts directory (only if it exists and has files)
-if ((Test-Path $paths.CONTRACTS_DIR) -and (Get-ChildItem -Path $paths.CONTRACTS_DIR -ErrorAction SilentlyContinue | Select-Object -First 1)) { 
-    $docs += 'contracts/' 
+if ((Test-Path $paths.CONTRACTS_DIR) -and (Get-ChildItem -Path $paths.CONTRACTS_DIR -ErrorAction SilentlyContinue | Select-Object -First 1)) {
+    $docs += 'contracts/'
 }

 if (Test-Path $paths.QUICKSTART) { $docs += 'quickstart.md' }

 # Include tasks.md if requested and it exists
-if ($IncludeTasks -and (Test-Path $paths.TASKS)) { 
-    $docs += 'tasks.md' 
+if ($IncludeTasks -and (Test-Path $paths.TASKS)) {
+    $docs += 'tasks.md'
 }

 # Output results
 if ($Json) {
    # JSON output
-    [PSCustomObject]@{ 
+    [PSCustomObject]@{
        FEATURE_DIR = $paths.FEATURE_DIR
-        AVAILABLE_DOCS = $docs 
+        AVAILABLE_DOCS = $docs
    } | ConvertTo-Json -Compress
 } else {
    # Text output
    Write-Output "FEATURE_DIR:$($paths.FEATURE_DIR)"
    Write-Output "AVAILABLE_DOCS:"
-    
+
    # Show status of each potential document
    Test-FileExists -Path $paths.RESEARCH -Description 'research.md' | Out-Null
    Test-FileExists -Path $paths.DATA_MODEL -Description 'data-model.md' | Out-Null
    Test-DirHasFiles -Path $paths.CONTRACTS_DIR -Description 'contracts/' | Out-Null
    Test-FileExists -Path $paths.QUICKSTART -Description 'quickstart.md' | Out-Null
-    
+
    if ($IncludeTasks) {
        Test-FileExists -Path $paths.TASKS -Description 'tasks.md' | Out-Null
    }
--- a/scripts/powershell/common.ps1
+++ b/scripts/powershell/common.ps1
@@ -191,7 +191,7 @@ function Get-FeaturePathsEnv {
        [Console]::Error.WriteLine("ERROR: Feature directory not found. Set SPECIFY_FEATURE_DIRECTORY or run the specify command to create .specify/feature.json.")
        exit 1
    }
-    
+
    # When no branch context exists (no SPECIFY_FEATURE, feature resolved via
    # SPECIFY_FEATURE_DIRECTORY or feature.json), fall back to the feature
    # directory basename so CURRENT_BRANCH is a usable identifier rather than
--- a/scripts/powershell/setup-plan.ps1
+++ b/scripts/powershell/setup-plan.ps1
@@ -63,7 +63,7 @@ if (Test-Path $paths.IMPL_PLAN -PathType Leaf) {

 # Output results
 if ($Json) {
-    $result = [PSCustomObject]@{ 
+    $result = [PSCustomObject]@{
        FEATURE_SPEC = $paths.FEATURE_SPEC
        IMPL_PLAN = $paths.IMPL_PLAN
        SPECS_DIR = $paths.FEATURE_DIR
--- a/spec-kit.code-workspace
+++ b/spec-kit.code-workspace
@@ -5,4 +5,4 @@
 		}
 	],
 	"settings": {}
-}
+}
--- a/src/specify_cli/init.py
+++ b/src/specify_cli/init.py
@@ -141,8 +141,9 @@ def _install_shared_infra(

    Copies ``.specify/scripts/<variant>/`` and ``.specify/templates/`` from
    the bundled core_pack or source checkout, where ``<variant>`` is
-    ``bash`` when *script_type* is ``"sh"`` and ``powershell`` when it is
-    ``"ps"``.  Tracks all installed files in ``speckit.manifest.json``.
+    ``bash`` when *script_type* is ``"sh"``, ``python`` when it is ``"py"``,
+    and ``powershell`` when it is ``"ps"``.  Tracks all installed files in
+    ``speckit.manifest.json``.

    Shared scripts and page templates are processed to resolve
    ``__SPECKIT_COMMAND_<NAME>__`` placeholders using *invoke_separator*
--- a/src/specify_cli/agents.py
+++ b/src/specify_cli/agents.py
@@ -213,6 +213,52 @@ class CommandRegistrar:
            ".specify.specify/", ".specify/"
        )

+    @staticmethod
+    def rewrite_extension_paths(
+        text: str, extension_id: str, extension_dir: Path
+    ) -> str:
+        """Rewrite extension-relative paths to their installed locations.
+
+        Extension command bodies reference bundled files relative to the
+        extension root (e.g. ``agents/control/commander.md``). After install
+        those files live under ``.specify/extensions/<id>/``, so bare
+        references would resolve against the workspace root and never be
+        found (#2101).
+
+        Only directories that actually exist inside *extension_dir* are
+        rewritten, keeping the behaviour conservative and avoiding false
+        positives on prose. ``commands`` (slash-command sources), ``specs``
+        (user project artifacts) and dot-directories are never rewritten.
+        """
+        if not isinstance(text, str) or not text:
+            return text
+
+        skip = {"commands", ".git", "specs"}
+        try:
+            subdirs = [
+                entry.name
+                for entry in extension_dir.iterdir()
+                if entry.is_dir()
+                and entry.name not in skip
+                and not entry.name.startswith(".")
+            ]
+        except OSError:
+            return text
+
+        for subdir in subdirs:
+            # Only rewrite relative references (subdir/... or ./subdir/...);
+            # absolute paths like /subdir/... keep their meaning. Use a
+            # callable replacement: subdir/extension_id come from the
+            # filesystem and could contain backslashes or "\1"-like
+            # sequences, which would corrupt a string replacement template.
+            replacement = f".specify/extensions/{extension_id}/{subdir}/"
+            text = re.sub(
+                r'(^|[\s`"\'(])(?:\./)?' + re.escape(subdir) + "/",
+                lambda m: m.group(1) + replacement,
+                text,
+            )
+        return text
+
    def render_markdown_command(
        self, frontmatter: dict, body: str, source_id: str, context_note: str = None
    ) -> str:
@@ -639,6 +685,9 @@ class CommandRegistrar:
                        frontmatter[key] = core_frontmatter[key]
                frontmatter.pop("strategy", None)

+            if extension_id:
+                body = self.rewrite_extension_paths(body, extension_id, source_root)
+
            frontmatter = self._adjust_script_paths(
                frontmatter, extension_id=extension_id
            )
--- a/src/specify_cli/authentication/config.py
+++ b/src/specify_cli/authentication/config.py
@@ -196,7 +196,15 @@ def find_entries_for_url(
    url: str, entries: list[AuthConfigEntry]
 ) -> list[AuthConfigEntry]:
    """Return entries whose ``hosts`` match the hostname of *url*."""
-    hostname = (urlparse(url).hostname or "").lower()
+    # A malformed authority (e.g. an unterminated IPv6 bracket "https://[::1")
+    # makes urlparse/hostname raise ValueError. Treat that the same as a
+    # host-less URL: no entry can match, so return no matches rather than
+    # leaking a raw ValueError out of the shared HTTP client (build_request /
+    # open_url call this before any URL validation).
+    try:
+        hostname = (urlparse(url).hostname or "").lower()
+    except ValueError:
+        return []
    if not hostname:
        return []
    return [
--- a/src/specify_cli/bundler/services/adapters.py
+++ b/src/specify_cli/bundler/services/adapters.py
@@ -68,8 +68,18 @@ def _validate_remote_url(source_id: str, url: str) -> None:
    Mirrors ``specify_cli.catalogs`` URL validation to avoid MITM/downgrade
    issues before any network call.
    """
-    parsed = urlparse(url)
-    is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
+    # A malformed authority (e.g. an unclosed IPv6 bracket ``https://[::1``)
+    # makes urlparse / hostname access raise ValueError. This function's
+    # contract is to raise BundlerError for a bad URL, so surface that as a
+    # clean error rather than leaking a raw ValueError to the caller.
+    try:
+        parsed = urlparse(url)
+        hostname = parsed.hostname
+    except ValueError:
+        raise BundlerError(
+            f"Catalog '{source_id}' URL is malformed: {url}"
+        ) from None
+    is_localhost = hostname in ("localhost", "127.0.0.1", "::1")
    if parsed.scheme != "https" and not (parsed.scheme == "http" and is_localhost):
        raise BundlerError(
            f"Catalog '{source_id}' URL must use HTTPS (got {parsed.scheme}://). "
@@ -79,7 +89,7 @@ def _validate_remote_url(source_id: str, url: str) -> None:
    # "https://:8080" or "https://user@...", so requiring netloc would let
    # those through even though they carry no host. hostname is None in those
    # cases. Mirrors the fix in ``specify_cli.catalogs`` (#3210).
-    if not parsed.hostname:
+    if not hostname:
        raise BundlerError(
            f"Catalog '{source_id}' URL must be a valid URL with a host: {url}"
        )
--- a/src/specify_cli/catalogs.py
+++ b/src/specify_cli/catalogs.py
@@ -71,8 +71,12 @@ class CatalogStackBase:
        """Validate that a catalog URL uses HTTPS, except localhost HTTP."""
        from urllib.parse import urlparse

-        parsed = urlparse(url)
-        is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
+        try:
+            parsed = urlparse(url)
+            hostname = parsed.hostname
+        except ValueError:
+            raise cls._error(f"Catalog URL is malformed: {url}") from None
+        is_localhost = hostname in ("localhost", "127.0.0.1", "::1")
        if parsed.scheme != "https" and not (parsed.scheme == "http" and is_localhost):
            raise cls._error(
                f"Catalog URL must use HTTPS (got {parsed.scheme}://). "
@@ -81,7 +85,7 @@ class CatalogStackBase:
        # Check hostname, not netloc: netloc is truthy for host-less URLs like
        # "https://:8080" or "https://user@", so the host guarantee this error
        # promises would not actually hold. hostname is None in those cases (#3209).
-        if not parsed.hostname:
+        if not hostname:
            raise cls._error("Catalog URL must be a valid URL with a host.")

    def _load_catalog_config(self, config_path: Path) -> list[CatalogEntry] | None:
--- a/src/specify_cli/commands/bundle/init.py
+++ b/src/specify_cli/commands/bundle/init.py
@@ -746,11 +746,16 @@ def _resolve_manifest_path(path: Path | None) -> Path:
 def _download_manifest(resolved, *, offline: bool):
    """Resolve a bundle's manifest from its catalog ``download_url``.

-    Local/``file://`` URLs always work offline and may point at a ``.zip``
-    artifact, a bundle directory, or a ``bundle.yml`` (handled by
-    :func:`_local_manifest_source`). Remote ``https://`` URLs are fetched with
-    the shared authenticated, redirect-validated HTTP client, and only when not
-    ``--offline``.
+    Catalog ``download_url``s are HTTPS-only (``http`` allowed for localhost),
+    matching the extensions/presets/workflows catalog systems. Remote URLs are
+    fetched with the shared authenticated, redirect-validated HTTP client, and
+    only when not ``--offline``.
+
+    Local and ``file://`` sources are intentionally not resolved here: to
+    install a bundle from disk, pass the path positionally
+    (``specify bundle install ./path/to/bundle.yml`` — a bundle directory or a
+    ``.zip`` artifact also works), which :func:`_local_manifest_source` handles
+    before catalog resolution and which never touches ``download_url``.
    """
    from urllib.parse import urlparse

@@ -763,26 +768,35 @@ def _download_manifest(resolved, *, offline: bool):
    parsed = urlparse(url)
    scheme = parsed.scheme.lower()

-    # On Windows an absolute path like ``C:\bundle.yml`` parses with a
-    # single-letter ``scheme``; treat it as a local file, not a URL scheme.
+    # ``file://`` URLs and bare filesystem paths (including Windows drive paths
+    # like ``C:\bundle.yml``, which urlparse reads as a single-letter scheme)
+    # are not valid catalog download URLs. Catalog URLs are HTTPS-only across
+    # every catalog system; installing from disk is done by passing the path
+    # positionally, which never reaches URL resolution. Give an actionable
+    # error rather than accepting a scheme the rest of the codebase rejects.
    if scheme in ("", "file") or re.match(r"^[A-Za-z]:[\\/]", url):
-        local = Path(parsed.path if scheme == "file" else url)
-        manifest = _local_manifest_source(str(local))
-        if manifest is None:
-            raise BundlerError(f"Bundle manifest not found: {local}")
-        return manifest
+        raise BundlerError(
+            f"Catalog entry '{resolved.entry.id}' has a non-HTTP(S) download_url "
+            f"({url}); catalog download URLs must be HTTPS (http for localhost) — "
+            "a file:// URL, a local filesystem path, or a scheme-less value "
+            "(e.g. 'example.com/bundle.zip') is not accepted. "
+            "To install a bundle from disk, pass the path directly: "
+            "'specify bundle install <path-to-bundle.yml | bundle-dir | .zip>'."
+        )

-    if scheme in ("http", "https"):
-        if offline:
-            raise BundlerError(
-                f"Network access disabled; cannot download bundle '{resolved.entry.id}' "
-                f"from {url}."
-            )
-        return _download_remote_manifest(resolved.entry.id, url)
+    # Validate the scheme/host *before* the offline gate so an invalid or
+    # non-HTTPS download_url reports the real problem in every mode, rather
+    # than a misleading "Network access disabled" under --offline.
+    # (_download_remote_manifest re-checks this, but only once network access
+    # is permitted.) HTTPS-only, http allowed for localhost.
+    _require_https(f"bundle '{resolved.entry.id}'", url)

-    raise BundlerError(
-        f"Unsupported download_url scheme for bundle '{resolved.entry.id}': {url}"
-    )
+    if offline:
+        raise BundlerError(
+            f"Network access disabled; cannot download bundle '{resolved.entry.id}' "
+            f"from {url}."
+        )
+    return _download_remote_manifest(resolved.entry.id, url)


 def _require_https(label: str, url: str) -> None:
--- a/src/specify_cli/commands/init.py
+++ b/src/specify_cli/commands/init.py
@@ -220,16 +220,45 @@ def register(app: typer.Typer) -> None:
                console.print(
                    f"[yellow]Warning:[/yellow] Current directory is not empty ({len(existing_items)} items)"
                )
-                console.print(
-                    "[yellow]Template files will be merged with existing content and may overwrite existing files[/yellow]"
-                )
                if force:
+                    # Proceeding: the merge/overwrite warning is accurate here.
+                    console.print(
+                        "[yellow]Template files will be merged with existing content and may overwrite existing files[/yellow]"
+                    )
                    console.print(
                        "[cyan]--force supplied: skipping confirmation and proceeding with merge[/cyan]"
                    )
                else:
-                    response = typer.confirm("Do you want to continue?")
-                    if not response:
+                    # Fold the merge risk into the confirmation prompt rather than
+                    # printing it unconditionally first: on the EOF/no-input path
+                    # below the command exits without changing anything, so a
+                    # standalone "will be merged" line would mislead. Interactive
+                    # users still see the risk as part of the question.
+                    #
+                    # Call typer.confirm normally so piped y/n is honored — e.g.
+                    # `echo y | specify init --here` keeps reaching the
+                    # non-destructive preserve-merge path.
+                    try:
+                        proceed = typer.confirm(
+                            "Template files will be merged with existing content "
+                            "and may overwrite existing files. Do you want to continue?"
+                        )
+                    except (typer.Abort, EOFError):
+                        # typer.confirm raises Abort for BOTH an interactive Ctrl+C
+                        # and an EOF on closed/empty stdin. Distinguish them: a real
+                        # TTY cancellation is a normal exit (0, "cancelled"), while a
+                        # missing-input EOF (non-interactive) becomes an actionable
+                        # error pointing at --force.
+                        if _stdin_is_interactive():
+                            console.print("[yellow]Operation cancelled[/yellow]")
+                            raise typer.Exit(0) from None
+                        console.print(
+                            "[red]Error:[/red] Current directory is not empty and no "
+                            "confirmation input is available. Re-run with "
+                            "[bold]--force[/bold] to merge into it."
+                        )
+                        raise typer.Exit(1) from None
+                    if not proceed:
                        console.print("[yellow]Operation cancelled[/yellow]")
                        raise typer.Exit(0)
        else:
--- a/src/specify_cli/extensions/init.py
+++ b/src/specify_cli/extensions/init.py
@@ -1078,6 +1078,11 @@ class ExtensionManager:
            frontmatter = registrar._adjust_script_paths(
                frontmatter, extension_id=manifest.id
            )
+            # Mirror the register_commands() rewrite (#2101): resolve
+            # extension-relative subdir references (agents/, knowledge-base/,
+            # etc.) to their installed .specify/extensions/<id>/ location
+            # before the generic placeholder/path resolution below.
+            body = registrar.rewrite_extension_paths(body, manifest.id, extension_dir)
            body = registrar.resolve_skill_placeholders(
                selected_ai, frontmatter, body, self.project_root, extension_id=manifest.id
            )
@@ -2755,18 +2760,32 @@ class ConfigManager:
            if not key.startswith(prefix):
                continue

-            # Remove prefix and split into parts
-            config_path = key[len(prefix) :].lower().split("_")
+            # Remove prefix and split into parts. Drop empty components from a
+            # malformed name (e.g. ``SPECKIT_<EXT>_`` with no key, or
+            # consecutive underscores ``SPECKIT_X__Y``) so we never create an
+            # entry under an empty key.
+            config_path = [p for p in key[len(prefix) :].lower().split("_") if p]
+            if not config_path:
+                continue

-            # Build nested dict
+            # Build nested dict. Two env vars can collide on a prefix, e.g.
+            # SPECKIT_X_CONNECTION=a and SPECKIT_X_CONNECTION_URL=b. Guard the
+            # walk so a colliding scalar is replaced by a dict (deeper/more
+            # specific vars win) instead of being indexed into — which raised
+            # TypeError ('str' object does not support item assignment) — and
+            # guard the leaf so a scalar processed after the nested var does
+            # not clobber the nested dict. Order-independent: both insertion
+            # orders yield {'connection': {'url': ...}}. Nested-wins mirrors
+            # _merge_configs' dict-preserving semantics.
            current = env_config
            for part in config_path[:-1]:
-                if part not in current:
+                if not isinstance(current.get(part), dict):
                    current[part] = {}
                current = current[part]

-            # Set the final value
-            current[config_path[-1]] = value
+            # Set the final value, unless a nested dict already occupies it.
+            if not isinstance(current.get(config_path[-1]), dict):
+                current[config_path[-1]] = value

        return env_config

--- a/src/specify_cli/extensions/_commands.py
+++ b/src/specify_cli/extensions/_commands.py
@@ -1566,7 +1566,14 @@ def extension_set_priority(
    raw_priority = metadata.get("priority")
    # Only skip if the stored value is already a valid int equal to requested priority
    # This ensures corrupted values (e.g., "high") get repaired even when setting to default (10)
-    if isinstance(raw_priority, int) and raw_priority == priority:
+    # A bool is an int in Python (isinstance(True, int) is True), so exclude it explicitly —
+    # mirroring normalize_priority's bool guard — otherwise a corrupted True/False priority
+    # equals 1/0 here and is never repaired.
+    if (
+        isinstance(raw_priority, int)
+        and not isinstance(raw_priority, bool)
+        and raw_priority == priority
+    ):
        console.print(f"[yellow]Extension '{_escape_markup(str(display_name))}' already has priority {priority}[/yellow]")
        raise typer.Exit(0)

--- a/src/specify_cli/integrations/_helpers.py
+++ b/src/specify_cli/integrations/_helpers.py
@@ -190,7 +190,15 @@ def _parse_integration_options(integration: Any, raw_options: str) -> dict[str,
    """
    import shlex
    parsed: dict[str, Any] = {}
-    tokens = shlex.split(raw_options)
+    try:
+        tokens = shlex.split(raw_options)
+    except ValueError as exc:
+        # An unbalanced quote (e.g. --integration-options='--commands-dir "foo')
+        # makes shlex raise "No closing quotation". Translate it into the same
+        # clean exit-1 UX as every other bad-input path below rather than
+        # letting a raw traceback escape.
+        console.print(f"[red]Error:[/red] Could not parse integration options: {exc}.")
+        raise typer.Exit(1)
    declared_options = list(integration.options())
    declared = {opt.name.lstrip("-"): opt for opt in declared_options}
    allowed = ", ".join(sorted(opt.name for opt in declared_options))
--- a/src/specify_cli/integrations/devin/init.py
+++ b/src/specify_cli/integrations/devin/init.py
@@ -62,4 +62,4 @@ class DevinIntegration(SkillsIntegration):
                default=True,
                help="Install as agent skills (default for Devin)",
            ),
-        ]
+        ]
--- a/src/specify_cli/integrations/forge/init.py
+++ b/src/specify_cli/integrations/forge/init.py
@@ -18,13 +18,13 @@ from ..manifest import IntegrationManifest

 def format_forge_command_name(cmd_name: str) -> str:
    """Convert command name to Forge-compatible hyphenated format.
-    
+
    Forge requires command names to use hyphens instead of dots for
    compatibility with ZSH and other shells. This function converts
    dot-notation command names to hyphenated format.
-    
+
    The function is idempotent: already-formatted names are returned unchanged.
-    
+
    Examples:
        >>> format_forge_command_name("plan")
        'speckit-plan'
@@ -38,26 +38,26 @@ def format_forge_command_name(cmd_name: str) -> str:
        'speckit-my-extension-example'
        >>> format_forge_command_name("speckit.jira.sync-status")
        'speckit-jira-sync-status'
-    
+
    Args:
-        cmd_name: Command name in dot notation (speckit.foo.bar), 
+        cmd_name: Command name in dot notation (speckit.foo.bar),
                  hyphenated format (speckit-foo-bar), or plain name (foo)
-    
+
    Returns:
        Hyphenated command name with 'speckit-' prefix
    """
    # Already in hyphenated format - return as-is (idempotent)
    if cmd_name.startswith("speckit-"):
        return cmd_name
-    
+
    # Strip 'speckit.' prefix if present
    short_name = cmd_name
    if short_name.startswith("speckit."):
        short_name = short_name[len("speckit."):]
-    
+
    # Replace all dots with hyphens
    short_name = short_name.replace(".", "-")
-    
+
    # Return with 'speckit-' prefix
    return f"speckit-{short_name}"

--- a/src/specify_cli/integrations/kiro_cli/init.py
+++ b/src/specify_cli/integrations/kiro_cli/init.py
@@ -13,6 +13,7 @@ _KIRO_ARG_FALLBACK = "(the user will provide the argument in this conversation)"

 class KiroCliIntegration(MarkdownIntegration):
    key = "kiro-cli"
+    multi_install_safe = True
    config = {
        "name": "Kiro CLI",
        "folder": ".kiro/",
@@ -26,3 +27,10 @@ class KiroCliIntegration(MarkdownIntegration):
        "args": _KIRO_ARG_FALLBACK,
        "extension": ".md",
    }
+
+    # Kiro CLI keeps everything under a static, isolated agent root
+    # (``.kiro/`` with commands in ``.kiro/prompts``) that no other
+    # integration writes to, so it is safe to install alongside others
+    # (issue #3471). The registry's multi-install-safe contract tests
+    # enforce that isolation for every integration setting this flag.
+    multi_install_safe = True
--- a/src/specify_cli/presets/init.py
+++ b/src/specify_cli/presets/init.py
@@ -778,6 +778,7 @@ class PresetManager:
                                        matching_cmds, ext_id, ext_dir,
                                        self.project_root,
                                        context_note=f"\n<!-- Extension: {ext_id} -->\n<!-- Config: .specify/extensions/{ext_id}/ -->\n",
+                                        extension_id=ext_id,
                                    )
                                    registered = True
                            except Exception:
@@ -1199,6 +1200,8 @@ class PresetManager:
                    "command_name": cmd_name,
                    "source_file": source_file,
                    "source": f"extension:{manifest.id}",
+                    "extension_id": manifest.id,
+                    "extension_dir": ext_root,
                }
                modern_skill_name, legacy_skill_name = self._skill_names_for_command(cmd_name)
                restore_index.setdefault(modern_skill_name, restore_info)
@@ -1463,6 +1466,17 @@ class PresetManager:
            if extension_restore:
                content = extension_restore["source_file"].read_text(encoding="utf-8")
                frontmatter, body = registrar.parse_frontmatter(content)
+                # Mirror the register-time rewrite (#2101): resolve
+                # extension-relative subdir references (agents/,
+                # knowledge-base/, etc.) to their installed location before
+                # the generic placeholder resolution below, otherwise
+                # restoring after a preset override removal would leave
+                # bare, unresolvable paths in the skill body.
+                body = registrar.rewrite_extension_paths(
+                    body,
+                    extension_restore["extension_id"],
+                    extension_restore["extension_dir"],
+                )
                if isinstance(selected_ai, str):
                    body = registrar.resolve_skill_placeholders(
                        selected_ai, frontmatter, body, self.project_root
@@ -2574,6 +2588,39 @@ class PresetResolver:
                self._manifest_cache[key] = None
        return self._manifest_cache[key]

+    def _manifest_declared_template(
+        self, pack_dir: Path, template_name: str, template_type: str
+    ) -> tuple[dict | None, Path | None]:
+        """Resolve a preset's manifest-declared template entry and usable file.
+
+        Returns ``(entry, candidate)``:
+        - ``entry`` is the matching ``provides.templates`` mapping, or ``None`` if
+          the manifest is absent or does not list this ``(name, type)``.
+        - ``candidate`` is the declared ``file:`` resolved under ``pack_dir`` IFF
+          it is a regular file (``is_file()``); ``None`` otherwise — a missing,
+          empty, or non-file (e.g. directory) declaration yields ``(entry, None)``.
+
+        The manifest is authoritative: when it declares a template (``entry`` is
+        not ``None``) but the file is unusable (``candidate`` is ``None``),
+        callers must NOT fall back to the convention lookup — that would mask a
+        typo or pick up an undeclared file. Shared by ``resolve()`` and
+        ``collect_all_layers()`` so their manifest-first resolution cannot
+        silently diverge again (the divergence this fix addressed).
+        """
+        manifest = self._get_manifest(pack_dir)
+        if not manifest:
+            return None, None
+        for tmpl in manifest.templates:
+            if tmpl.get("name") == template_name and tmpl.get("type") == template_type:
+                file_path = tmpl.get("file")
+                if file_path:
+                    manifest_candidate = pack_dir / file_path
+                    return tmpl, (
+                        manifest_candidate if manifest_candidate.is_file() else None
+                    )
+                return tmpl, None
+        return None, None
+
    def _get_all_extensions_by_priority(self) -> list[tuple[int, str, dict | None]]:
        """Build unified list of registered and unregistered extensions sorted by priority.

@@ -2676,6 +2723,27 @@ class PresetResolver:
            registry = PresetRegistry(self.presets_dir)
            for pack_id, _metadata in registry.list_by_priority():
                pack_dir = self.presets_dir / pack_id
+                # The preset manifest is authoritative: if it declares this
+                # template with an explicit ``file:``, resolve to that path —
+                # and do NOT fall back to convention when it's missing, to
+                # avoid masking typos or picking up an undeclared file. Only
+                # when the manifest is absent or doesn't list this template do
+                # we use the convention-based subdir lookup. Mirrors
+                # collect_all_layers()/resolve_content() so resolve() and
+                # resolve_with_source() agree with them instead of returning
+                # the core template (or a stray convention file).
+                entry, manifest_candidate = self._manifest_declared_template(
+                    pack_dir, template_name, template_type
+                )
+                if manifest_candidate is not None:
+                    return manifest_candidate
+                if entry is not None:
+                    # Manifest declares this template but the file is missing,
+                    # non-file (e.g. a directory), or an empty/falsey ``file``
+                    # value. The manifest is authoritative, so skip this pack's
+                    # convention fallback rather than mask a typo — mirrors
+                    # collect_all_layers().
+                    continue
                for subdir in subdirs:
                    if subdir:
                        candidate = pack_dir / subdir / f"{template_name}{ext}"
@@ -2943,31 +3011,22 @@ class PresetResolver:
                pack_dir = self.presets_dir / pack_id
                # Read strategy and manifest file path from preset manifest
                strategy = "replace"
-                manifest_file_path = None
                manifest_has_strategy = False
-                manifest_found_entry = False
-                manifest = self._get_manifest(pack_dir)
-                if manifest:
-                    for tmpl in manifest.templates:
-                        if (tmpl.get("name") == template_name
-                                and tmpl.get("type") == template_type):
-                            strategy = tmpl.get("strategy", "replace")
-                            manifest_has_strategy = "strategy" in tmpl
-                            manifest_file_path = tmpl.get("file")
-                            manifest_found_entry = True
-                            break
-                # Use manifest file path if specified, otherwise convention-based
-                # lookup — but only when the manifest doesn't exist or doesn't
-                # list this template, so preset.yml stays authoritative.
+                entry, manifest_candidate = self._manifest_declared_template(
+                    pack_dir, template_name, template_type
+                )
+                if entry is not None:
+                    strategy = entry.get("strategy", "replace")
+                    manifest_has_strategy = "strategy" in entry
+                # Use the manifest's declared file when it's a usable regular file;
+                # only fall back to convention-based lookup when the manifest
+                # doesn't list this template at all, so preset.yml stays
+                # authoritative (a declared-but-unusable file skips convention —
+                # parity with resolve()).
                candidate = None
-                if manifest_file_path:
-                    manifest_candidate = pack_dir / manifest_file_path
-                    if manifest_candidate.exists():
-                        candidate = manifest_candidate
-                    # Explicit file path that doesn't exist: skip convention
-                    # fallback to avoid masking typos or picking up unintended files.
-                elif not manifest_found_entry:
-                    # Manifest doesn't list this template — check convention paths
+                if manifest_candidate is not None:
+                    candidate = manifest_candidate
+                elif entry is None:
                    candidate = _find_in_subdirs(pack_dir)
                if candidate:
                    # Legacy fallback: if manifest doesn't explicitly declare a
@@ -3038,6 +3097,8 @@ class PresetResolver:
                    "path": candidate,
                    "source": source,
                    "strategy": "replace",
+                    "extension_id": ext_id,
+                    "extension_dir": ext_dir,
                })

        # Priority 4: Core templates (always "replace")
@@ -3157,10 +3218,32 @@ class PresetResolver:
        if not layers:
            return None

+        def _read_layer_content(layer: Dict[str, Any]) -> str:
+            """Read a layer's raw text, rewriting extension-relative subdir
+            references (agents/, knowledge-base/, etc.) to their installed
+            location when the layer is extension-provided (#2101).
+
+            Extension layers are always inserted with strategy "replace"
+            (see collect_all_layers), so a layer only ever needs this
+            rewrite when it wins outright above or serves as the
+            composition base below — never as a mid-stack composing
+            (append/prepend/wrap) layer.
+            """
+            text = layer["path"].read_text(encoding="utf-8")
+            extension_id = layer.get("extension_id")
+            extension_dir = layer.get("extension_dir")
+            if extension_id and extension_dir:
+                from ..agents import CommandRegistrar
+
+                text = CommandRegistrar.rewrite_extension_paths(
+                    text, extension_id, extension_dir
+                )
+            return text
+
        # If the top (highest-priority) layer is replace, it wins entirely —
        # lower layers are irrelevant regardless of their strategies.
        if layers[0]["strategy"] == "replace":
-            return layers[0]["path"].read_text(encoding="utf-8")
+            return _read_layer_content(layers[0])

        # Composition: build content bottom-up from the effective base.
        # The base is the nearest replace layer scanning from highest priority
@@ -3183,7 +3266,7 @@ class PresetResolver:

        # Convert to reversed_layers index
        base_reversed_idx = len(layers) - 1 - base_layer_idx
-        content = layers[base_layer_idx]["path"].read_text(encoding="utf-8")
+        content = _read_layer_content(layers[base_layer_idx])
        # Compose only the layers above the base (higher priority = lower index in layers,
        # higher index in reversed_layers). Process bottom-up from base+1.
        start_idx = base_reversed_idx + 1
--- a/src/specify_cli/presets/_commands.py
+++ b/src/specify_cli/presets/_commands.py
@@ -469,7 +469,14 @@ def preset_set_priority(
    raw_priority = metadata.get("priority")
    # Only skip if the stored value is already a valid int equal to requested priority
    # This ensures corrupted values (e.g., "high") get repaired even when setting to default (10)
-    if isinstance(raw_priority, int) and raw_priority == priority:
+    # A bool is an int in Python (isinstance(True, int) is True), so exclude it explicitly —
+    # mirroring normalize_priority's bool guard — otherwise a corrupted True/False priority
+    # equals 1/0 here and is never repaired.
+    if (
+        isinstance(raw_priority, int)
+        and not isinstance(raw_priority, bool)
+        and raw_priority == priority
+    ):
        console.print(f"[yellow]Preset '{preset_id}' already has priority {priority}[/yellow]")
        raise typer.Exit(0)

--- a/src/specify_cli/shared_infra.py
+++ b/src/specify_cli/shared_infra.py
@@ -403,7 +403,7 @@ def install_shared_infra(
    # manifest entries the core no longer ships (stale-script cleanup, #3076).
    seen_rels: set[str] = set()
    scripts_scanned = False
-    variant_dir = "bash" if script_type == "sh" else "powershell"
+    variant_dir = {"sh": "bash", "py": "python"}.get(script_type, "powershell")

    def _decide_overwrite(rel: str, dst: Path) -> tuple[bool, str | None]:
        """Return (write, bucket) where bucket is 'skip', 'preserved', or None."""
@@ -465,6 +465,10 @@ def install_shared_infra(
                    for src_path in variant_src.rglob("*"):
                        if not src_path.is_file():
                            continue
+                        # Python bytecode caches are local artifacts, not
+                        # workflow scripts — never install them.
+                        if "__pycache__" in src_path.parts:
+                            continue
                        # Mark scanned only once a real source file is seen. An
                        # empty (or symlink-skipped) variant keeps this False, so
                        # stale-cleanup is skipped — otherwise it would treat every
--- a/src/specify_cli/workflows/_commands.py
+++ b/src/specify_cli/workflows/_commands.py
@@ -601,7 +601,15 @@ def workflow_add(
        except (ValueError, yaml.YAMLError) as exc:
            console.print(f"[red]Error:[/red] Invalid workflow YAML: {exc}")
            raise typer.Exit(1)
-        if not definition.id or not definition.id.strip():
+        # Non-string ids (e.g. unquoted ``id: 123`` or ``id: 0``) fall through
+        # to validate_workflow below, which reports a typed error instead of
+        # crashing on ``.strip()`` here. Only None/empty/whitespace-only ids
+        # are rejected as missing.
+        if (
+            definition.id is None
+            or definition.id == ""
+            or (isinstance(definition.id, str) and not definition.id.strip())
+        ):
            console.print("[red]Error:[/red] Workflow definition has an empty or missing 'id'")
            raise typer.Exit(1)

--- a/src/specify_cli/workflows/catalog.py
+++ b/src/specify_cli/workflows/catalog.py
@@ -76,8 +76,16 @@ class WorkflowRegistry:
        if self.registry_path.exists():
            try:
                with open(self.registry_path, encoding="utf-8") as f:
-                    return json.load(f)
-            except (json.JSONDecodeError, ValueError):
+                    data = json.load(f)
+                # Validate shape: must be a dict with a dict "workflows" field,
+                # otherwise every method that indexes data["workflows"] crashes.
+                # Mirrors StepRegistry._load.
+                if not isinstance(data, dict):
+                    return {"schema_version": self.SCHEMA_VERSION, "workflows": {}}
+                if not isinstance(data.get("workflows"), dict):
+                    data["workflows"] = {}
+                return data
+            except (json.JSONDecodeError, ValueError, OSError, UnicodeError):
                # Corrupted registry file — reset to default
                return {"schema_version": self.SCHEMA_VERSION, "workflows": {}}
        return {"schema_version": self.SCHEMA_VERSION, "workflows": {}}
@@ -438,9 +446,9 @@ class WorkflowCatalog:
                q = query.lower()
                searchable = " ".join(
                    [
-                        wf_data.get("name", ""),
-                        wf_data.get("description", ""),
-                        wf_data.get("id", ""),
+                        str(wf_data.get("name") or ""),
+                        str(wf_data.get("description") or ""),
+                        str(wf_data.get("id") or ""),
                    ]
                ).lower()
                if q not in searchable:
--- a/src/specify_cli/workflows/engine.py
+++ b/src/specify_cli/workflows/engine.py
@@ -129,26 +129,49 @@ def validate_workflow(definition: WorkflowDefinition) -> list[str]:
    errors: list[str] = []

    # -- Schema version ---------------------------------------------------
-    if definition.schema_version not in ("1.0", "1"):
+    # str() so an unquoted ``schema_version: 1.0`` (YAML float) is accepted —
+    # rejecting it would print "Unsupported schema_version 1.0. Expected '1.0'."
+    if str(definition.schema_version) != "1.0":
        errors.append(
            f"Unsupported schema_version {definition.schema_version!r}. "
            f"Expected '1.0'."
        )

    # -- Top-level fields -------------------------------------------------
-    if not definition.id:
+    # YAML parses unquoted scalars like ``id: 123`` or ``version: 1.0`` as
+    # int/float; check types before regex/string operations so authoring
+    # mistakes surface as validation errors instead of tracebacks. Only
+    # ``None``/empty-string count as missing so falsey non-strings
+    # (``id: 0``, ``name: false``) still get the typed error.
+    if definition.id is None or definition.id == "":
        errors.append("Workflow is missing 'workflow.id'.")
+    elif not isinstance(definition.id, str):
+        errors.append(
+            f"'workflow.id' must be a string, got "
+            f"{type(definition.id).__name__} ({definition.id!r})."
+        )
    elif not _ID_PATTERN.match(definition.id):
        errors.append(
            f"Workflow ID {definition.id!r} must be lowercase alphanumeric "
            f"with hyphens."
        )

-    if not definition.name:
+    if definition.name is None or definition.name == "":
        errors.append("Workflow is missing 'workflow.name'.")
+    elif not isinstance(definition.name, str):
+        errors.append(
+            f"'workflow.name' must be a string, got "
+            f"{type(definition.name).__name__} ({definition.name!r})."
+        )

-    if not definition.version:
+    if definition.version is None or definition.version == "":
        errors.append("Workflow is missing 'workflow.version'.")
+    elif not isinstance(definition.version, str):
+        errors.append(
+            f"'workflow.version' must be a string, got "
+            f"{type(definition.version).__name__} ({definition.version!r}) — "
+            f'quote it in YAML (version: "1.0.0").'
+        )
    elif not re.match(r"^\d+\.\d+\.\d+$", definition.version):
        errors.append(
            f"Workflow version {definition.version!r} is not valid "
@@ -256,9 +279,15 @@ def _validate_steps(
            continue

        step_id = step_config.get("id")
-        if not step_id:
+        if step_id is None or step_id == "":
            errors.append("Step is missing 'id' field.")
            continue
+        if not isinstance(step_id, str):
+            errors.append(
+                f"Step ID must be a string, got "
+                f"{type(step_id).__name__} ({step_id!r})."
+            )
+            continue

        if ":" in step_id:
            errors.append(
@@ -953,7 +982,16 @@ class WorkflowEngine:
                    from .expressions import evaluate_condition

                    max_iters = step_config.get("max_iterations")
-                    if not isinstance(max_iters, int) or max_iters < 1:
+                    # A bool is an int in Python (isinstance(True, int) is True
+                    # and True == 1), so a bool max_iterations would slip past
+                    # the int check and cap the loop at range(0)==1 iteration
+                    # instead of the default. Exclude bools, mirroring the
+                    # while/do-while validators and the continue_on_error guard.
+                    if (
+                        isinstance(max_iters, bool)
+                        or not isinstance(max_iters, int)
+                        or max_iters < 1
+                    ):
                        max_iters = 10
                    condition = step_config.get("condition", False)
                    for _loop_iter in range(max_iters - 1):
--- a/src/specify_cli/workflows/expressions.py
+++ b/src/specify_cli/workflows/expressions.py
@@ -464,9 +464,9 @@ def _evaluate_simple_expression(expr: str, namespace: dict[str, Any]) -> Any:
            if op == "<=":
                return _safe_compare(left, right, "<=")
            if op == " in ":
-                return left in right if right is not None else False
+                return _safe_membership(left, right, negate=False)
            if op == " not in ":
-                return left not in right if right is not None else True
+                return _safe_membership(left, right, negate=True)

    # Numeric literal
    try:
@@ -511,6 +511,26 @@ def _coerce_number(value: Any) -> Any:
    return value


+def _safe_membership(left: Any, right: Any, *, negate: bool) -> bool:
+    """Safely evaluate ``left in right`` (or ``not in``) without crashing.
+
+    ``left in right`` raises ``TypeError`` whenever the operands don't support
+    membership testing — most commonly a non-iterable right operand (``None``,
+    an int, a bool), but also cases like an unhashable ``left`` against a set.
+    In every such case the membership relation is undefined, so treat it as
+    ``False`` (``not in`` as ``True``) rather than leaking the error out of the
+    evaluator and crashing the whole workflow. Mirrors the graceful
+    ``TypeError`` handling in ``_safe_compare`` for the ordering operators, and
+    generalizes the previous ``right is not None`` guard to any operand pair
+    that can't be membership-tested.
+    """
+    try:
+        contained = left in right
+    except TypeError:
+        contained = False
+    return not contained if negate else contained
+
+
 def _safe_compare(left: Any, right: Any, op: str) -> bool:
    """Compare two values for ordering, coercing numeric strings when possible.

--- a/src/specify_cli/workflows/steps/command/init.py
+++ b/src/specify_cli/workflows/steps/command/init.py
@@ -31,6 +31,20 @@ class CommandStep(StepBase):
    def execute(self, config: dict[str, Any], context: StepContext) -> StepResult:
        command = config.get("command", "")
        input_data = config.get("input", {})
+        # validate() rejects a non-mapping input, but the engine does not
+        # auto-validate before execute(); a workflow that skipped validation can
+        # still reach here. Fail the step with the same contract error rather
+        # than silently coercing to {} and dispatching with empty args — that
+        # would change the command's meaning, hide the config error, and report
+        # COMPLETED, defeating the per-step FAILED / continue_on_error behavior.
+        if not isinstance(input_data, dict):
+            return StepResult(
+                status=StepStatus.FAILED,
+                error=(
+                    f"Command step {config.get('id', '?')!r}: 'input' must be a "
+                    f"mapping, got {type(input_data).__name__}."
+                ),
+            )

        # Resolve expressions in input
        resolved_input: dict[str, Any] = {}
@@ -50,8 +64,18 @@ class CommandStep(StepBase):
        # Merge options (workflow defaults ← step overrides)
        options = dict(context.default_options)
        step_options = config.get("options", {})
-        if step_options:
-            options.update(step_options)
+        # Same rationale as 'input': a malformed options fails the step rather
+        # than being silently ignored (which would let an invalid step run and
+        # apparently complete).
+        if not isinstance(step_options, dict):
+            return StepResult(
+                status=StepStatus.FAILED,
+                error=(
+                    f"Command step {config.get('id', '?')!r}: 'options' must be a "
+                    f"mapping, got {type(step_options).__name__}."
+                ),
+            )
+        options.update(step_options)

        # Attempt CLI dispatch
        args_str = str(resolved_input.get("args", ""))
@@ -155,4 +179,16 @@ class CommandStep(StepBase):
            errors.append(
                f"Command step {config.get('id', '?')!r} is missing 'command' field."
            )
+        # execute() iterates input.items() and options.update(step_options); a
+        # non-mapping here would raise at run time. Validate the shape like the
+        # sibling steps (switch 'cases', fan-out 'step') so it is reported, not
+        # crashed on.
+        if "input" in config and not isinstance(config["input"], dict):
+            errors.append(
+                f"Command step {config.get('id', '?')!r}: 'input' must be a mapping."
+            )
+        if "options" in config and not isinstance(config["options"], dict):
+            errors.append(
+                f"Command step {config.get('id', '?')!r}: 'options' must be a mapping."
+            )
        return errors
--- a/src/specify_cli/workflows/steps/fan_in/init.py
+++ b/src/specify_cli/workflows/steps/fan_in/init.py
@@ -24,6 +24,24 @@ class FanInStep(StepBase):
        if not isinstance(output_config, dict):
            output_config = {}

+        # The engine does not auto-validate step config, so an unvalidated run
+        # with a non-list ``wait_for`` reaches here raw. Iterating it then
+        # either crashes the whole run (a scalar like an int or None raises
+        # TypeError) or, worse, silently iterates a string's characters and
+        # yields a bogus join of empty results with a COMPLETED status — the
+        # exact "silent empty result + COMPLETED" wiring bug the engine's
+        # fan-in validation guards against. Fail this step loudly instead,
+        # mirroring the fan-out step's non-list ``items`` handling.
+        if not isinstance(wait_for, list):
+            return StepResult(
+                status=StepStatus.FAILED,
+                error=(
+                    f"Fan-in step {config.get('id', '?')!r}: 'wait_for' must be "
+                    f"a list of step IDs, got {type(wait_for).__name__}."
+                ),
+                output={"results": []},
+            )
+
        # Collect results from referenced steps
        results = []
        for step_id in wait_for:
--- a/src/specify_cli/workflows/steps/if_then/init.py
+++ b/src/specify_cli/workflows/steps/if_then/init.py
@@ -47,8 +47,8 @@ class IfThenStep(StepBase):
            errors.append(
                f"If step {config.get('id', '?')!r}: 'then' must be a list of steps."
            )
-        else_branch = config.get("else", [])
-        if else_branch and not isinstance(else_branch, list):
+        else_branch = config.get("else")
+        if else_branch is not None and not isinstance(else_branch, list):
            errors.append(
                f"If step {config.get('id', '?')!r}: 'else' must be a list of steps."
            )
--- a/src/specify_cli/workflows/steps/shell/init.py
+++ b/src/specify_cli/workflows/steps/shell/init.py
@@ -3,6 +3,7 @@
 from __future__ import annotations

 import json
+import math
 import subprocess
 from typing import Any

@@ -25,7 +26,20 @@ class ShellStep(StepBase):
        run_cmd = str(run_cmd)

        cwd = context.project_root or "."
-
+        # Per-step execution timeout in seconds; defaults to 300 for backward
+        # compatibility. The engine does not auto-validate step config, so
+        # validate here as well — a caller that skips WorkflowEngine.validate()
+        # must fail the step cleanly rather than crash subprocess.run() with a
+        # TypeError (or silently coerce ``timeout: true`` to a 1s duration,
+        # since bool is an int subclass).
+        timeout = config.get("timeout", 300)
+        timeout_error = self._timeout_error(config)
+        if timeout_error is not None:
+            return StepResult(
+                status=StepStatus.FAILED,
+                error=timeout_error,
+                output={"exit_code": -1, "stdout": "", "stderr": "invalid timeout"},
+            )
        # NOTE: shell=True is required to support pipes, redirects, and
        # multi-command expressions in workflow YAML.  Workflow authors
        # control commands; catalog-installed workflows should be reviewed
@@ -37,7 +51,7 @@ class ShellStep(StepBase):
                capture_output=True,
                text=True,
                cwd=cwd,
-                timeout=300,
+                timeout=timeout,
            )
            output = {
                "exit_code": proc.returncode,
@@ -74,7 +88,7 @@ class ShellStep(StepBase):
        except subprocess.TimeoutExpired:
            return StepResult(
                status=StepStatus.FAILED,
-                error="Shell command timed out after 300 seconds.",
+                error=f"Shell command timed out after {timeout} seconds.",
                output={"exit_code": -1, "stdout": "", "stderr": "timeout"},
            )
        except OSError as exc:
@@ -84,6 +98,32 @@ class ShellStep(StepBase):
                output={"exit_code": -1, "stdout": "", "stderr": str(exc)},
            )

+    @staticmethod
+    def _timeout_error(config: dict[str, Any]) -> str | None:
+        """Return an error message if ``config['timeout']`` is invalid, else None.
+
+        Shared by execute() and validate() so both paths reject the same
+        values with the same message. An absent ``timeout`` is valid (the
+        default is used). bool is a subclass of int, but ``timeout: true`` is a
+        config error rather than a duration, so it is rejected explicitly.
+        Non-finite floats (YAML ``.inf``/``.nan``) pass a plain ``> 0`` check
+        but would raise in subprocess.run(), so they are rejected too.
+        """
+        if "timeout" not in config:
+            return None
+        timeout = config["timeout"]
+        if (
+            isinstance(timeout, bool)
+            or not isinstance(timeout, (int, float))
+            or not math.isfinite(timeout)
+            or timeout <= 0
+        ):
+            return (
+                f"Shell step {config.get('id', '?')!r}: 'timeout' must be a "
+                f"positive number of seconds, got {timeout!r}."
+            )
+        return None
+
    def validate(self, config: dict[str, Any]) -> list[str]:
        errors = super().validate(config)
        if "run" not in config:
@@ -106,4 +146,7 @@ class ShellStep(StepBase):
                f"Shell step {config.get('id', '?')!r}: 'output_format' must "
                f"be 'json' when present, got {output_format!r}."
            )
+        timeout_error = self._timeout_error(config)
+        if timeout_error is not None:
+            errors.append(timeout_error)
        return errors
--- a/src/specify_cli/workflows/steps/switch/init.py
+++ b/src/specify_cli/workflows/steps/switch/init.py
@@ -26,6 +26,20 @@ class SwitchStep(StepBase):
        str_value = str(value) if value is not None else ""

        cases = config.get("cases", {})
+        if not isinstance(cases, dict):
+            # The engine does not auto-validate step config, so an unvalidated
+            # run with a non-mapping ``cases`` (a list/scalar authoring mistake)
+            # would otherwise raise AttributeError from ``.items()`` below and
+            # crash the whole run. Fail this step loudly instead, mirroring the
+            # fan-out step's non-list ``items`` handling.
+            return StepResult(
+                status=StepStatus.FAILED,
+                error=(
+                    f"Switch step {config.get('id', '?')!r}: 'cases' must be a "
+                    f"mapping, got {type(cases).__name__}."
+                ),
+                output={"matched_case": None, "expression_value": value},
+            )
        for case_key, case_steps in cases.items():
            if str(case_key) == str_value:
                return StepResult(
--- a/templates/checklist-template.md
+++ b/templates/checklist-template.md
@@ -6,16 +6,16 @@

 **Note**: This checklist is generated by the `__SPECKIT_COMMAND_CHECKLIST__` command based on feature context and requirements.

-<!-- 
+<!--
  ============================================================================
  IMPORTANT: The checklist items below are SAMPLE ITEMS for illustration only.
-  
+
  The __SPECKIT_COMMAND_CHECKLIST__ command MUST replace these with actual items based on:
  - User's specific checklist request
  - Feature requirements from spec.md
  - Technical context from plan.md
  - Implementation details from tasks.md
-  
+
  DO NOT keep these sample items in the generated checklist file.
  ============================================================================
 -->
--- a/templates/commands/analyze.md
+++ b/templates/commands/analyze.md
@@ -3,6 +3,7 @@ description: Perform a non-destructive cross-artifact consistency and quality an
 scripts:
  sh: scripts/bash/check-prerequisites.sh --json --require-tasks --include-tasks
  ps: scripts/powershell/check-prerequisites.ps1 -Json -RequireTasks -IncludeTasks
+  py: scripts/python/check_prerequisites.py --json --require-tasks --include-tasks
 ---

 ## User Input
--- a/templates/commands/checklist.md
+++ b/templates/commands/checklist.md
@@ -3,6 +3,7 @@ description: Generate a custom checklist for the current feature based on user r
 scripts:
  sh: scripts/bash/check-prerequisites.sh --json
  ps: scripts/powershell/check-prerequisites.ps1 -Json
+  py: scripts/python/check_prerequisites.py --json
 ---

 ## Checklist Purpose: "Unit Tests for English"
--- a/templates/commands/clarify.md
+++ b/templates/commands/clarify.md
@@ -1,12 +1,13 @@
 ---
 description: Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
-handoffs: 
+handoffs:
  - label: Build Technical Plan
    agent: speckit.plan
    prompt: Create a plan for the spec. I am building with...
 scripts:
   sh: scripts/bash/check-prerequisites.sh --json --paths-only
   ps: scripts/powershell/check-prerequisites.ps1 -Json -PathsOnly
+   py: scripts/python/check_prerequisites.py --json --paths-only
 ---

 ## User Input
--- a/templates/commands/constitution.md
+++ b/templates/commands/constitution.md
@@ -1,6 +1,6 @@
 ---
 description: Create or update the project constitution from interactive or provided principle inputs, ensuring all dependent templates stay in sync.
-handoffs: 
+handoffs:
  - label: Build Specification
    agent: speckit.specify
    prompt: Implement the feature specification based on the updated constitution. I want to build...
@@ -81,7 +81,7 @@ Follow this execution flow:
   - Read `.specify/templates/plan-template.md` and ensure any "Constitution Check" or rules align with updated principles.
   - Read `.specify/templates/spec-template.md` for scope/requirements alignment—update if constitution adds/removes mandatory sections or constraints.
   - Read `.specify/templates/tasks-template.md` and ensure task categorization reflects new or removed principle-driven task types (e.g., observability, versioning, testing discipline).
-   - Read each command file in `.specify/templates/commands/*.md` (including this one) to verify no outdated references (agent-specific names like CLAUDE only) remain when generic guidance is required.
+   - Read each installed Spec Kit command file for your agent (including this one) — named `speckit.*` or `speckit-*` (dot or hyphen depending on the agent), or laid out as `speckit-<name>/SKILL.md` for skills-based integrations, e.g. in `.github/agents/`, `.github/skills/`, `.claude/skills/`, or your agent's equivalent commands directory — to verify no outdated references (CLAUDE-only or other agent-specific names) remain when generic guidance is required.
   - Read any runtime guidance docs (e.g., `README.md`, `docs/quickstart.md`, or agent-specific guidance files if present). Update references to principles changed.

 5. Produce a Sync Impact Report (prepend as an HTML comment at top of the constitution file after update):
--- a/templates/commands/converge.md
+++ b/templates/commands/converge.md
@@ -3,6 +3,7 @@ description: Assess the current codebase against the feature's spec, plan, and t
 scripts:
  sh: scripts/bash/check-prerequisites.sh --json --require-tasks --include-tasks
  ps: scripts/powershell/check-prerequisites.ps1 -Json -RequireTasks -IncludeTasks
+  py: scripts/python/check_prerequisites.py --json --require-tasks --include-tasks
 ---

 ## User Input
--- a/templates/commands/implement.md
+++ b/templates/commands/implement.md
@@ -3,6 +3,7 @@ description: Execute the implementation plan by processing and executing all tas
 scripts:
  sh: scripts/bash/check-prerequisites.sh --json --require-tasks --include-tasks
  ps: scripts/powershell/check-prerequisites.ps1 -Json -RequireTasks -IncludeTasks
+  py: scripts/python/check_prerequisites.py --json --require-tasks --include-tasks
 ---

 ## User Input
@@ -42,7 +43,7 @@ You **MUST** consider the user input before proceeding (if not empty).
    **Automatic Pre-Hook**: {extension}
    Executing: `/{command}`
    EXECUTE_COMMAND: {command}
-    
+
    Wait for the result of the hook command before proceeding to the Outline.
    ```
    After emitting the block above you MUST actually invoke the hook and wait for it to finish before continuing. Run it the same way you would run the command yourself in this agent/session (the invocation may differ from the literal `{command}` id shown above, e.g. a skills-mode agent runs it as `/skill:speckit-...` or `$speckit-...`). Emitting the block alone does not run the hook.
@@ -144,7 +145,7 @@ You **MUST** consider the user input before proceeding (if not empty).

 6. Execute implementation following the task plan:
   - **Phase-by-phase execution**: Complete each phase before moving to the next
-   - **Respect dependencies**: Run sequential tasks in order, parallel tasks [P] can run together  
+   - **Respect dependencies**: Run sequential tasks in order, parallel tasks [P] can run together
   - **Follow TDD approach**: Execute test tasks before their corresponding implementation tasks
   - **File-based coordination**: Tasks affecting the same files must run sequentially
   - **Validation checkpoints**: Verify each phase completion before proceeding
--- a/templates/commands/plan.md
+++ b/templates/commands/plan.md
@@ -1,6 +1,6 @@
 ---
 description: Execute the implementation planning workflow using the plan template to generate design artifacts.
-handoffs: 
+handoffs:
  - label: Create Tasks
    agent: speckit.tasks
    prompt: Break the plan into tasks
@@ -68,7 +68,6 @@ You **MUST** consider the user input before proceeding (if not empty).
   - Evaluate gates (ERROR if violations unjustified)
   - Phase 0: Generate research.md (resolve all NEEDS CLARIFICATION)
   - Phase 1: Generate data-model.md, contracts/, quickstart.md
-   - Phase 1: Update agent context by running the agent script
   - Re-evaluate Constitution Check post-design

 ## Mandatory Post-Execution Hooks
@@ -107,7 +106,7 @@ Check if `.specify/extensions.yml` exists in the project root.

 ## Completion Report

-Command ends after Phase 2 planning. Report branch, IMPL_PLAN path, and generated artifacts.
+Command ends after Phase 1 design. Report branch, IMPL_PLAN path, and generated artifacts.

 ## Phases

--- a/templates/commands/specify.md
+++ b/templates/commands/specify.md
@@ -1,6 +1,6 @@
 ---
 description: Create or update the feature specification from a natural language feature description.
-handoffs: 
+handoffs:
  - label: Build Technical Plan
    agent: speckit.plan
    prompt: Create a plan for the spec. I am building with...
@@ -147,20 +147,20 @@ Given that feature description, do this:

      ```markdown
      # Specification Quality Checklist: [FEATURE NAME]
-      
+
      **Purpose**: Validate specification completeness and quality before proceeding to planning
      **Created**: [DATE]
      **Feature**: [Link to spec.md]
-      
+
      ## Content Quality
-      
+
      - [ ] No implementation details (languages, frameworks, APIs)
      - [ ] Focused on user value and business needs
      - [ ] Written for non-technical stakeholders
      - [ ] All mandatory sections completed
-      
+
      ## Requirement Completeness
-      
+
      - [ ] No [NEEDS CLARIFICATION] markers remain
      - [ ] Requirements are testable and unambiguous
      - [ ] Success criteria are measurable
@@ -169,16 +169,16 @@ Given that feature description, do this:
      - [ ] Edge cases are identified
      - [ ] Scope is clearly bounded
      - [ ] Dependencies and assumptions identified
-      
+
      ## Feature Readiness
-      
+
      - [ ] All functional requirements have clear acceptance criteria
      - [ ] User scenarios cover primary flows
      - [ ] Feature meets measurable outcomes defined in Success Criteria
      - [ ] No implementation details leak into specification
-      
+
      ## Notes
-      
+
      - Items marked incomplete require spec updates before `__SPECKIT_COMMAND_CLARIFY__` or `__SPECKIT_COMMAND_PLAN__`
      ```

@@ -203,20 +203,20 @@ Given that feature description, do this:

           ```markdown
           ## Question [N]: [Topic]
-           
+
           **Context**: [Quote relevant spec section]
-           
+
           **What we need to know**: [Specific question from NEEDS CLARIFICATION marker]
-           
+
           **Suggested Answers**:
-           
+
           | Option | Answer | Implications |
           |--------|--------|--------------|
           | A      | [First suggested answer] | [What this means for the feature] |
           | B      | [Second suggested answer] | [What this means for the feature] |
           | C      | [Third suggested answer] | [What this means for the feature] |
           | Custom | Provide your own answer | [Explain how to provide custom input] |
-           
+
           **Your choice**: _[Wait for user response]_
           ```

--- a/templates/commands/tasks.md
+++ b/templates/commands/tasks.md
@@ -1,6 +1,6 @@
 ---
 description: Generate an actionable, dependency-ordered tasks.md for the feature based on available design artifacts.
-handoffs: 
+handoffs:
  - label: Analyze For Consistency
    agent: speckit.analyze
    prompt: Run a project analysis for consistency
@@ -51,7 +51,7 @@ You **MUST** consider the user input before proceeding (if not empty).
    **Automatic Pre-Hook**: {extension}
    Executing: `/{command}`
    EXECUTE_COMMAND: {command}
-    
+
    Wait for the result of the hook command before proceeding to the Outline.
    ```
    After emitting the block above you MUST actually invoke the hook and wait for it to finish before continuing. Run it the same way you would run the command yourself in this agent/session (the invocation may differ from the literal `{command}` id shown above, e.g. a skills-mode agent runs it as `/skill:speckit-...` or `$speckit-...`). Emitting the block alone does not run the hook.
@@ -161,7 +161,7 @@ Every task MUST strictly follow this format:
 4. **[Story] label**: REQUIRED for user story phase tasks only
   - Format: [US1], [US2], [US3], etc. (maps to user stories from spec.md)
   - Setup phase: NO story label
-   - Foundational phase: NO story label  
+   - Foundational phase: NO story label
   - User Story phases: MUST have story label
   - Polish phase: NO story label
 5. **Description**: Clear action with exact file path
--- a/templates/commands/taskstoissues.md
+++ b/templates/commands/taskstoissues.md
@@ -4,6 +4,7 @@ tools: ['github/github-mcp-server/list_issues', 'github/github-mcp-server/issue_
 scripts:
  sh: scripts/bash/check-prerequisites.sh --json --require-tasks --include-tasks
  ps: scripts/powershell/check-prerequisites.ps1 -Json -RequireTasks -IncludeTasks
+  py: scripts/python/check_prerequisites.py --json --require-tasks --include-tasks
 ---

 ## User Input
--- a/templates/plan-template.md
+++ b/templates/plan-template.md
@@ -4,7 +4,7 @@

 **Input**: Feature specification from `/specs/[###-feature-name]/spec.md`

-**Note**: This template is filled in by the `__SPECKIT_COMMAND_PLAN__` command. See `.specify/templates/plan-template.md` for the execution workflow.
+**Note**: This template is filled in by the `__SPECKIT_COMMAND_PLAN__` command; its definition describes the execution workflow.

 ## Summary

--- a/templates/vscode-settings.json
+++ b/templates/vscode-settings.json
@@ -11,4 +11,3 @@
        ".specify/scripts/powershell/": true
    }
 }
-
--- a/tests/contract/test_bundle_cli.py
+++ b/tests/contract/test_bundle_cli.py
@@ -175,7 +175,23 @@ def test_build_produces_artifact(project: Path):
    assert len(artifacts) == 1


-def test_info_expands_full_component_set(project: Path):
+def _mock_manifest_download(monkeypatch, source_path: Path) -> None:
+    """Mock the HTTPS manifest fetch to return a locally-authored manifest.
+
+    Catalog ``download_url``s are HTTPS-only, so ``info`` tests can no longer
+    point one at a local file. Patch ``_download_manifest`` to return the
+    manifest parsed from *source_path* (a bundle.yml or a .zip artifact),
+    exercising ``info``'s expansion without a network call.
+    """
+    from specify_cli.commands.bundle import _local_manifest_source
+
+    monkeypatch.setattr(
+        "specify_cli.commands.bundle._download_manifest",
+        lambda resolved, *, offline: _local_manifest_source(str(source_path)),
+    )
+
+
+def test_info_expands_full_component_set(project: Path, monkeypatch):
    bundle_dir = project / "src-bundle"
    bundle_dir.mkdir()
    (bundle_dir / "bundle.yml").write_text(
@@ -183,13 +199,14 @@ def test_info_expands_full_component_set(project: Path):
    )
    catalog = project / "local-catalog.json"
    entry = catalog_entry_dict(
-        "demo-bundle", download_url=str(bundle_dir / "bundle.yml")
+        "demo-bundle", download_url="https://example.com/demo-bundle.zip"
    )
    write_catalog_file(catalog, {"demo-bundle": entry})
    added = runner.invoke(
        app, ["bundle", "catalog", "add", str(catalog), "--id", "local"]
    )
    assert added.exit_code == 0, added.output
+    _mock_manifest_download(monkeypatch, bundle_dir / "bundle.yml")

    result = runner.invoke(app, ["bundle", "info", "demo-bundle", "--json", "--offline"])
    assert result.exit_code == 0, result.output
@@ -207,7 +224,7 @@ def test_info_expands_full_component_set(project: Path):
    assert "Trust" in text.output


-def test_info_expands_discovery_only_bundle(project: Path):
+def test_info_expands_discovery_only_bundle(project: Path, monkeypatch):
    # Discovery-only bundles must still be fully inspectable via `info`;
    # only `install` is refused for them.
    bundle_dir = project / "disc-bundle"
@@ -217,7 +234,7 @@ def test_info_expands_discovery_only_bundle(project: Path):
    )
    catalog = project / "disc-catalog.json"
    entry = catalog_entry_dict(
-        "demo-bundle", download_url=str(bundle_dir / "bundle.yml")
+        "demo-bundle", download_url="https://example.com/demo-bundle.zip"
    )
    write_catalog_file(catalog, {"demo-bundle": entry})
    config = {
@@ -230,6 +247,7 @@ def test_info_expands_discovery_only_bundle(project: Path):
    (project / ".specify" / "bundle-catalogs.yml").write_text(
        yaml.safe_dump(config), encoding="utf-8"
    )
+    _mock_manifest_download(monkeypatch, bundle_dir / "bundle.yml")
    result = runner.invoke(app, ["bundle", "info", "demo-bundle", "--json", "--offline"])
    assert result.exit_code == 0, result.output
    payload = json.loads(result.output)
@@ -237,8 +255,9 @@ def test_info_expands_discovery_only_bundle(project: Path):
    assert ("extensions", "ext-a") in components


-def test_info_resolves_local_zip_download_url(project: Path):
-    # A local .zip artifact as download_url is extracted to read bundle.yml.
+def test_info_expands_zip_sourced_bundle(project: Path, monkeypatch):
+    # A .zip artifact is extracted to read bundle.yml; info expands it. (The
+    # download itself is HTTPS-only now and mocked here — see contract note.)
    bundle_dir = project / "zip-src"
    bundle_dir.mkdir()
    (bundle_dir / "bundle.yml").write_text(
@@ -249,12 +268,15 @@ def test_info_resolves_local_zip_download_url(project: Path):
    catalog = project / "zip-catalog.json"
    write_catalog_file(
        catalog,
-        {"demo-bundle": catalog_entry_dict("demo-bundle", download_url=str(artifact))},
+        {"demo-bundle": catalog_entry_dict(
+            "demo-bundle", download_url="https://example.com/demo-bundle.zip"
+        )},
    )
    added = runner.invoke(
        app, ["bundle", "catalog", "add", str(catalog), "--id", "local"]
    )
    assert added.exit_code == 0, added.output
+    _mock_manifest_download(monkeypatch, artifact)
    result = runner.invoke(app, ["bundle", "info", "demo-bundle", "--json", "--offline"])
    assert result.exit_code == 0, result.output
    payload = json.loads(result.output)
--- a/tests/extensions/git/test_git_extension.py
+++ b/tests/extensions/git/test_git_extension.py
@@ -638,6 +638,21 @@ class TestCreateFeatureBash:
        assert result.returncode != 0
        assert "requires updated Spec Kit core scripts" in result.stderr

+    def test_explicit_number_zero_is_honored(self, tmp_path: Path):
+        """An explicit --number 0 is honored (yields 000), not treated as
+        'auto-detect'. Pins the canonical behavior the PowerShell twin must
+        mirror; the empty-string check (`[ -z "$BRANCH_NUMBER" ]`) already
+        distinguishes an unset flag from a supplied 0."""
+        project = _setup_project(tmp_path)
+        result = _run_bash(
+            "create-new-feature-branch.sh", project,
+            "--json", "--dry-run", "--number", "0", "--short-name", "zero", "Zero feature",
+        )
+        assert result.returncode == 0, result.stderr
+        data = json.loads(result.stdout)
+        assert data["BRANCH_NAME"] == "000-zero"
+        assert data["FEATURE_NUM"] == "000"
+

@pytest.mark.skipif(not HAS_PWSH, reason="pwsh not available")
 class TestCreateFeaturePowerShell:
@@ -942,6 +957,23 @@ class TestCreateFeaturePowerShell:
        assert result.returncode != 0
        assert "requires updated Spec Kit core scripts" in result.stderr

+    def test_explicit_number_zero_is_honored(self, tmp_path: Path):
+        """An explicit -Number 0 is honored (yields 000), matching the bash twin's
+        --number 0. Regression guard: -Number defaults to 0, so a bare `-eq 0`
+        check cannot tell an unset flag from a supplied 0 and would silently
+        auto-detect instead. Uses PSBoundParameters.ContainsKey('Number')."""
+        project = _setup_project(tmp_path)
+        result = _run_pwsh(
+            "create-new-feature-branch.ps1", project,
+            "-Json", "-DryRun", "-Number", "0", "-ShortName", "zero", "Zero feature",
+        )
+        assert result.returncode == 0, result.stderr
+        json_line = [ln for ln in result.stdout.splitlines() if ln.strip().startswith("{")]
+        assert json_line, f"No JSON in output: {result.stdout}"
+        data = json.loads(json_line[-1])
+        assert data["BRANCH_NAME"] == "000-zero"
+        assert data["FEATURE_NUM"] == "000"
+

 # ── auto-commit.sh Tests ─────────────────────────────────────────────────────

--- a/tests/extensions/test_extension_agent_context.py
+++ b/tests/extensions/test_extension_agent_context.py
@@ -25,6 +25,14 @@ BASH = shutil.which("bash")
 POWERSHELL = (
    shutil.which("pwsh") or shutil.which("powershell.exe") or shutil.which("powershell")
 )
+# On Windows, prefer the built-in Windows PowerShell 5.1 (.NET Framework) when a
+# test needs to exercise a 5.1-specific code path; fall back to whatever
+# POWERSHELL resolves to elsewhere.
+WINDOWS_POWERSHELL = (
+    (shutil.which("powershell.exe") or shutil.which("powershell") or POWERSHELL)
+    if os.name == "nt"
+    else POWERSHELL
+)


 def _write_ext_config(project_root: Path, **overrides: object) -> None:
@@ -279,12 +287,14 @@ def shlex_quote(value: str) -> str:
    return "'" + value.replace("'", "'\"'\"'") + "'"


-def _run_powershell_agent_context_script(project_root: Path) -> subprocess.CompletedProcess:
+def _run_powershell_agent_context_script(
+    project_root: Path, powershell: str | None = None
+) -> subprocess.CompletedProcess:
    script = EXT_DIR / "scripts" / "powershell" / "update-agent-context.ps1"
    env = _bundled_script_env(project_root)
    return subprocess.run(
        [
-            POWERSHELL,
+            powershell or POWERSHELL,
            "-NoProfile",
            "-ExecutionPolicy",
            "Bypass",
@@ -412,6 +422,29 @@ class TestBundledUpdaterPathValidation:
        assert output.count("agent-context: updated CLAUDE.md") == 1
        assert "agent-context: updated agents.md" not in output

+    @requires_bash
+    def test_bash_script_discovers_nested_plan(self, tmp_path):
+        """Plan discovery recurses into scoped layouts (#3024)."""
+        project = tmp_path / "project"
+        project.mkdir()
+        _install_agent_context_config(
+            project,
+            context_file="AGENTS.md",
+            context_files=[],
+        )
+        plan = project / "specs" / "scope" / "001-feature" / "plan.md"
+        plan.parent.mkdir(parents=True)
+        plan.write_text("# Plan\n", encoding="utf-8")
+
+        result = _run_bash_agent_context_script(project)
+
+        assert result.returncode == 0, result.stderr + result.stdout
+        text = (project / "AGENTS.md").read_text(encoding="utf-8")
+        # The old one-level glob (specs/*/plan.md) would find nothing here, so no
+        # "at" line would be emitted. Normalize separators before matching: on
+        # MSYS bash the emitted path may be absolute with backslashes.
+        assert "specs/scope/001-feature/plan.md" in text.replace("\\", "/")
+
    @requires_bash
    def test_bash_script_falls_back_from_invalid_speckit_python(self, tmp_path):
        project = tmp_path / "project"
@@ -484,6 +517,33 @@ class TestBundledUpdaterPathValidation:
        assert output.count("agent-context: updated CLAUDE.md") == 1
        assert "agent-context: updated agents.md" not in output

+    @pytest.mark.skipif(WINDOWS_POWERSHELL is None, reason="PowerShell not available")
+    def test_powershell_script_discovers_nested_plan(self, tmp_path):
+        """Plan discovery recurses into scoped layouts (#3024).
+
+        The relative-path fix this covers is specific to Windows PowerShell 5.1
+        (.NET Framework), so prefer ``powershell.exe`` over ``pwsh`` here to
+        actually exercise that failure mode on Windows.
+        """
+        project = tmp_path / "project"
+        project.mkdir()
+        _install_agent_context_config(
+            project,
+            context_file="AGENTS.md",
+            context_files=[],
+        )
+        plan = project / "specs" / "scope" / "001-feature" / "plan.md"
+        plan.parent.mkdir(parents=True)
+        plan.write_text("# Plan\n", encoding="utf-8")
+
+        result = _run_powershell_agent_context_script(
+            project, powershell=WINDOWS_POWERSHELL
+        )
+
+        assert result.returncode == 0, result.stderr + result.stdout
+        text = (project / "AGENTS.md").read_text(encoding="utf-8")
+        assert "at specs/scope/001-feature/plan.md" in text
+
    @pytest.mark.skipif(POWERSHELL is None, reason="PowerShell not available")
    def test_powershell_script_falls_back_from_invalid_speckit_python(self, tmp_path):
        project = tmp_path / "project"
@@ -688,6 +748,62 @@ class TestExtensionSelfSeed:
 _MDC_CONTEXT_FILE = ".cursor/rules/specify-rules.mdc"


+class TestPlanDiscovery:
+    """Mtime fallback must find plans in nested spec layouts (#3024).
+
+    Repos using SPECIFY_FEATURE_DIRECTORY place plans at
+    ``specs/<scope>/<feature>/plan.md``; a one-level ``specs/*/plan.md``
+    glob never matches those.
+    """
+
+    @staticmethod
+    def _make_plans(project: Path) -> Path:
+        # Older flat plan plus a newer nested plan: recursive discovery
+        # must pick the nested one by mtime.
+        flat = project / "specs" / "old-feature" / "plan.md"
+        flat.parent.mkdir(parents=True)
+        flat.write_text("flat plan\n", encoding="utf-8")
+        os.utime(flat, (1_000_000_000, 1_000_000_000))
+        nested = project / "specs" / "scope" / "new-feature" / "plan.md"
+        nested.parent.mkdir(parents=True)
+        nested.write_text("nested plan\n", encoding="utf-8")
+        return nested
+
+    @requires_bash
+    def test_bash_script_finds_nested_plan(self, tmp_path):
+        project = tmp_path / "project"
+        project.mkdir()
+        _install_agent_context_config(
+            project,
+            context_file="AGENTS.md",
+            context_files=["AGENTS.md"],
+        )
+        self._make_plans(project)
+
+        result = _run_bash_agent_context_script(project)
+
+        assert result.returncode == 0, result.stderr + result.stdout
+        content = (project / "AGENTS.md").read_text(encoding="utf-8")
+        assert "specs/scope/new-feature/plan.md" in content
+
+    @pytest.mark.skipif(POWERSHELL is None, reason="PowerShell not available")
+    def test_powershell_script_finds_nested_plan(self, tmp_path):
+        project = tmp_path / "project"
+        project.mkdir()
+        _install_agent_context_config(
+            project,
+            context_file="AGENTS.md",
+            context_files=["AGENTS.md"],
+        )
+        self._make_plans(project)
+
+        result = _run_powershell_agent_context_script(project)
+
+        assert result.returncode == 0, result.stderr + result.stdout
+        content = (project / "AGENTS.md").read_text(encoding="utf-8")
+        assert "specs/scope/new-feature/plan.md" in content
+
+
 class TestMdcFrontmatter:
    """Cursor-style ``.mdc`` targets must carry ``alwaysApply: true`` frontmatter
    so the rule file is auto-loaded; non-``.mdc`` targets must not gain any."""
--- a/tests/hooks/.specify/extensions.yml
+++ b/tests/hooks/.specify/extensions.yml
@@ -6,7 +6,7 @@ hooks:
      extension: "test-extension"
      command: "pre_implement_test"
      description: "Test before implement hook execution"
-      
+
  after_implement:
    - id: post_test
      enabled: true
--- a/tests/hooks/TESTING.md
+++ b/tests/hooks/TESTING.md
@@ -7,7 +7,7 @@ This directory contains a mock project to verify that LLM agents correctly ident
 1. Open a chat with an LLM (like GitHub Copilot) in this project.
 2. Ask it to generate tasks for the current directory:
   > "Please follow `/speckit.tasks` for the `./tests/hooks` directory."
-3. **Expected Behavior**: 
+3. **Expected Behavior**:
   - Before doing any generation, the LLM should notice the `AUTOMATIC Pre-Hook` in `.specify/extensions.yml` under `before_tasks`.
   - It should state it is executing `EXECUTE_COMMAND: pre_tasks_test`.
   - It should then proceed to read the `.md` docs and produce a `tasks.md`.
--- a/tests/integration/test_bundler_local_install.py
+++ b/tests/integration/test_bundler_local_install.py
@@ -112,3 +112,62 @@ def test_install_bundled_extension_from_zip_offline(tmp_path: Path):
        assert not ExtensionManager(project).registry.is_installed("agent-context")
    finally:
        os.chdir(previous)
+
+
+def test_download_manifest_rejects_file_url(tmp_path: Path):
+    """A catalog ``file://`` download_url is rejected — catalog URLs are
+    HTTPS-only, matching extensions/presets/workflows. Disk installs go through
+    the positional path (see the local-source tests above), not download_url.
+    """
+    from types import SimpleNamespace
+
+    from specify_cli.commands.bundle import _download_manifest
+
+    manifest_path = write_manifest(tmp_path / "my bundles")
+    resolved = SimpleNamespace(
+        entry=SimpleNamespace(id="demo-bundle", download_url=manifest_path.as_uri())
+    )
+
+    with pytest.raises(BundlerError, match="bundle install"):
+        _download_manifest(resolved, offline=True)
+
+
+def test_download_manifest_rejects_bare_path(tmp_path: Path):
+    """A bare filesystem path download_url is likewise rejected."""
+    from types import SimpleNamespace
+
+    from specify_cli.commands.bundle import _download_manifest
+
+    manifest_path = write_manifest(tmp_path / "plain")
+    resolved = SimpleNamespace(
+        entry=SimpleNamespace(id="demo-bundle", download_url=str(manifest_path))
+    )
+
+    with pytest.raises(BundlerError, match="bundle install"):
+        _download_manifest(resolved, offline=True)
+
+
+def test_local_install_still_resolves_via_positional_path(tmp_path: Path):
+    """The supported local route — a positional path, not a download_url —
+    still resolves the manifest via _local_manifest_source."""
+    manifest_path = write_manifest(tmp_path / "my bundles")
+    manifest = _local_manifest_source(str(manifest_path))
+    assert manifest is not None
+    assert manifest.bundle.id == "demo-bundle"
+
+
+def test_download_manifest_rejects_non_https_url_even_offline(tmp_path: Path):
+    """A non-HTTPS download_url must report the HTTPS problem, not a misleading
+    'Network access disabled', even under --offline (scheme is validated before
+    the offline gate)."""
+    from types import SimpleNamespace
+
+    from specify_cli.commands.bundle import _download_manifest
+
+    resolved = SimpleNamespace(
+        entry=SimpleNamespace(
+            id="demo-bundle", download_url="http://example.com/bundle.zip"
+        )
+    )
+    with pytest.raises(BundlerError, match="HTTPS"):
+        _download_manifest(resolved, offline=True)
--- a/tests/integrations/test_cli.py
+++ b/tests/integrations/test_cli.py
@@ -115,6 +115,63 @@ class TestInitIntegrationFlag:
        data = json.loads((project / ".specify" / "integration.json").read_text(encoding="utf-8"))
        assert data["integration"] == specify_cli.DEFAULT_INIT_INTEGRATION

+    def test_init_here_nonempty_noninteractive_errors_with_force_guidance(self, tmp_path):
+        """`init --here` on a non-empty directory with no confirmation input (empty
+        stdin) must fail fast with guidance to use --force, instead of the bare
+        'Aborted.' from an EOF on typer.confirm. CliRunner with no `input=` provides
+        empty stdin, so typer.confirm raises Abort, which the command converts to the
+        actionable error."""
+        from typer.testing import CliRunner
+        from specify_cli import app
+
+        project = tmp_path / "nonempty-here"
+        project.mkdir()
+        (project / "existing.txt").write_text("keep me", encoding="utf-8")
+        old_cwd = os.getcwd()
+        try:
+            os.chdir(project)
+            result = CliRunner().invoke(app, [
+                "init", "--here", "--integration", "copilot", "--script", "sh", "--ignore-agent-tools",
+            ], catch_exceptions=False)
+        finally:
+            os.chdir(old_cwd)
+
+        assert result.exit_code == 1, result.output
+        assert "--force" in result.output
+        # Aborted before scaffolding: the pre-existing file is untouched.
+        assert (project / "existing.txt").read_text(encoding="utf-8") == "keep me"
+
+    def test_init_here_interactive_cancel_exits_zero(self, tmp_path, monkeypatch):
+        """An interactive Ctrl+C at the merge confirmation (typer.Abort on a TTY)
+        is a normal cancellation — exit 0, "cancelled" — NOT the missing-input
+        --force error, which is reserved for non-interactive EOF. Guards the
+        regression where Abort was caught unconditionally and every cancel became
+        an exit-1 --force error."""
+        from typer.testing import CliRunner
+        from specify_cli import app
+        import specify_cli.commands.init as init_mod
+
+        # Simulate an interactive terminal so the Abort is treated as a cancel.
+        monkeypatch.setattr(init_mod, "_stdin_is_interactive", lambda: True)
+
+        project = tmp_path / "cancel-here"
+        project.mkdir()
+        (project / "existing.txt").write_text("keep me", encoding="utf-8")
+        old_cwd = os.getcwd()
+        try:
+            os.chdir(project)
+            # No input → typer.confirm raises Abort (stands in for Ctrl+C).
+            result = CliRunner().invoke(app, [
+                "init", "--here", "--integration", "copilot", "--script", "sh", "--ignore-agent-tools",
+            ], catch_exceptions=False)
+        finally:
+            os.chdir(old_cwd)
+
+        assert result.exit_code == 0, result.output
+        assert "cancelled" in result.output.lower()
+        assert "--force" not in result.output  # not the missing-input error
+        assert (project / "existing.txt").read_text(encoding="utf-8") == "keep me"
+
    def test_integration_copilot_auto_promotes(self, tmp_path):
        from typer.testing import CliRunner
        from specify_cli import app
@@ -835,7 +892,8 @@ class TestInitIntegrationFlag:
        assert (scripts_dir / "common.sh").read_text(encoding="utf-8") != custom_content

    def test_init_here_without_force_preserves_shared_infra(self, tmp_path):
-        """E2E: specify init --here (no --force) preserves existing shared infra files."""
+        """E2E: confirming the merge with piped "y" (no --force) preserves
+        existing shared infra files (unlike --force, which overwrites them)."""
        from typer.testing import CliRunner
        from specify_cli import app

--- a/tests/integrations/test_integration_catalog.py
+++ b/tests/integrations/test_integration_catalog.py
@@ -84,6 +84,20 @@ class TestCatalogURLValidation:
        with pytest.raises(IntegrationCatalogError, match="valid URL"):
            IntegrationCatalog._validate_catalog_url(url)

+    @pytest.mark.parametrize(
+        "url",
+        [
+            "https://[::1",                 # unclosed ipv6 bracket
+            "https://[not-an-ip]/c.json",   # bracketed non-ip host
+        ],
+    )
+    def test_malformed_url_rejected_cleanly(self, url):
+        # A malformed authority makes urlparse/hostname raise ValueError. The
+        # validator must turn that into its normal catalog error, not leak a
+        # raw ValueError to the caller.
+        with pytest.raises(IntegrationCatalogError, match="malformed"):
+            IntegrationCatalog._validate_catalog_url(url)
+

 # ---------------------------------------------------------------------------
 # IntegrationCatalog — active catalogs
--- a/tests/integrations/test_integration_cursor_agent.py
+++ b/tests/integrations/test_integration_cursor_agent.py
@@ -231,4 +231,3 @@ class TestCursorAgentCliDispatch:

        argv = mock_run.call_args[0][0]
        assert argv[0] == "cursor-agent"
-
--- a/tests/integrations/test_integration_devin.py
+++ b/tests/integrations/test_integration_devin.py
@@ -71,4 +71,4 @@ class TestDevinInitFlow:
        )

        assert result.exit_code == 0, f"init --integration devin failed: {result.output}"
-        assert (target / ".devin" / "skills" / "speckit-plan" / "SKILL.md").exists()
+        assert (target / ".devin" / "skills" / "speckit-plan" / "SKILL.md").exists()
--- a/tests/integrations/test_integration_forge.py
+++ b/tests/integrations/test_integration_forge.py
@@ -288,13 +288,13 @@ class TestForgeCommandRegistrar:
    def test_registrar_formats_extension_command_names_for_forge(self, tmp_path):
        """Verify CommandRegistrar converts dot notation to hyphens for Forge."""
        from specify_cli.agents import CommandRegistrar
-        
+
        # Create a mock extension command file
        ext_dir = tmp_path / "extension"
        ext_dir.mkdir()
        cmd_dir = ext_dir / "commands"
        cmd_dir.mkdir()
-        
+
        # Create a test command with dot notation name
        cmd_file = cmd_dir / "example.md"
        cmd_file.write_text(
@@ -304,7 +304,7 @@ class TestForgeCommandRegistrar:
            "Test content with $ARGUMENTS\n",
            encoding="utf-8"
        )
-        
+
        # Register with Forge
        registrar = CommandRegistrar()
        commands = [
@@ -313,7 +313,7 @@ class TestForgeCommandRegistrar:
                "file": "commands/example.md"
            }
        ]
-        
+
        registered = registrar.register_commands(
            "forge",
            commands,
@@ -321,14 +321,14 @@ class TestForgeCommandRegistrar:
            ext_dir,
            tmp_path
        )
-        
+
        # Verify registration succeeded
        assert "speckit.my-extension.example" in registered
-        
+
        # Check the generated file has hyphenated name in frontmatter
        forge_cmd = tmp_path / ".forge" / "commands" / "speckit-my-extension-example.md"
        assert forge_cmd.exists()
-        
+
        content = forge_cmd.read_text(encoding="utf-8")
        # Parse frontmatter to validate name field precisely
        frontmatter, _ = registrar.parse_frontmatter(content)
@@ -339,13 +339,13 @@ class TestForgeCommandRegistrar:
    def test_registrar_formats_alias_names_for_forge(self, tmp_path):
        """Verify CommandRegistrar converts alias names to hyphens for Forge."""
        from specify_cli.agents import CommandRegistrar
-        
+
        # Create a mock extension command file
        ext_dir = tmp_path / "extension"
        ext_dir.mkdir()
        cmd_dir = ext_dir / "commands"
        cmd_dir.mkdir()
-        
+
        cmd_file = cmd_dir / "example.md"
        cmd_file.write_text(
            "---\n"
@@ -354,7 +354,7 @@ class TestForgeCommandRegistrar:
            "Test content\n",
            encoding="utf-8"
        )
-        
+
        # Register with Forge including an alias
        registrar = CommandRegistrar()
        commands = [
@@ -364,7 +364,7 @@ class TestForgeCommandRegistrar:
                "aliases": ["speckit.my-extension.ex"]
            }
        ]
-        
+
        registrar.register_commands(
            "forge",
            commands,
@@ -372,11 +372,11 @@ class TestForgeCommandRegistrar:
            ext_dir,
            tmp_path
        )
-        
+
        # Check the alias file has hyphenated name in frontmatter
        alias_file = tmp_path / ".forge" / "commands" / "speckit-my-extension-ex.md"
        assert alias_file.exists()
-        
+
        content = alias_file.read_text(encoding="utf-8")
        # Parse frontmatter to validate alias name field precisely
        frontmatter, _ = registrar.parse_frontmatter(content)
@@ -387,13 +387,13 @@ class TestForgeCommandRegistrar:
    def test_registrar_does_not_affect_other_agents(self, tmp_path):
        """Verify format_name callback is Forge-specific and doesn't affect other agents."""
        from specify_cli.agents import CommandRegistrar
-        
+
        # Create a mock extension command file
        ext_dir = tmp_path / "extension"
        ext_dir.mkdir()
        cmd_dir = ext_dir / "commands"
        cmd_dir.mkdir()
-        
+
        cmd_file = cmd_dir / "example.md"
        cmd_file.write_text(
            "---\n"
@@ -402,7 +402,7 @@ class TestForgeCommandRegistrar:
            "Test content with $ARGUMENTS\n",
            encoding="utf-8"
        )
-        
+
        # Register with Kilo Code (standard markdown agent without inject_name)
        registrar = CommandRegistrar()
        commands = [
@@ -411,7 +411,7 @@ class TestForgeCommandRegistrar:
                "file": "commands/example.md"
            }
        ]
-        
+
        registrar.register_commands(
            "kilocode",
            commands,
@@ -419,12 +419,12 @@ class TestForgeCommandRegistrar:
            ext_dir,
            tmp_path
        )
-        
+
        # Kilo Code uses standard markdown format without name injection.
        # The format_name callback should not be invoked for non-Forge agents.
        kilocode_cmd = tmp_path / ".kilocode" / "workflows" / "speckit.my-extension.example.md"
        assert kilocode_cmd.exists()
-        
+
        content = kilocode_cmd.read_text(encoding="utf-8")
        # Kilo Code should NOT have a name field injected
        assert "name:" not in content, (
--- a/tests/integrations/test_integration_kiro_cli.py
+++ b/tests/integrations/test_integration_kiro_cli.py
@@ -42,6 +42,9 @@ class TestKiroCliIntegration(MarkdownIntegrationTests):
    COMMANDS_SUBDIR = "prompts"
    REGISTRAR_DIR = ".kiro/prompts"

+    def test_declares_multi_install_safe(self):
+        assert get_integration(self.KEY).multi_install_safe is True
+
    def test_registrar_config(self):
        """Override base assertion: kiro-cli uses a prose fallback for args
        because Kiro CLI file-based prompts do not natively substitute
--- a/tests/integrations/test_integration_subcommand.py
+++ b/tests/integrations/test_integration_subcommand.py
@@ -2675,6 +2675,27 @@ class TestParseIntegrationOptionsEqualsForm:
        assert result_space["commands_dir"] == "./mydir"
        assert result_equals["commands_dir"] == "./mydir"

+    def test_unbalanced_quote_exits_cleanly(self, capsys):
+        """An unbalanced quote must exit(1) with a message, not a raw ValueError.
+
+        shlex.split() raises ValueError("No closing quotation") on an unbalanced
+        quote; the parser must translate that into the same clean typer.Exit(1)
+        UX as unknown-option / missing-value, rather than letting the traceback
+        escape (issue #3457).
+        """
+        import typer
+
+        from specify_cli.integrations._commands import _parse_integration_options
+        from specify_cli.integrations import get_integration
+
+        integration = get_integration("generic")
+        assert integration is not None
+
+        with pytest.raises(typer.Exit) as excinfo:
+            _parse_integration_options(integration, '--commands-dir "foo')
+        assert excinfo.value.exit_code == 1
+        assert "Error: Could not parse integration options: No closing quotation." in capsys.readouterr().out
+

 class TestUninstallNoManifestClearsInitOptions:
    def test_init_options_cleared_on_no_manifest_uninstall(self, tmp_path):
--- a/tests/integrations/test_integration_vibe.py
+++ b/tests/integrations/test_integration_vibe.py
@@ -34,4 +34,4 @@ class TestVibeUserInvocable:
            parsed = yaml.safe_load(parts[1])
            assert parsed.get("user-invocable") is True, (
                f"{f.parent.name}/SKILL.md is missing user-invocable: true in frontmatter"
-            )
+            )
--- a/tests/integrations/test_registry.py
+++ b/tests/integrations/test_registry.py
@@ -272,6 +272,20 @@ class TestMultiInstallSafeContracts:
                f"these files: {sorted(overlap)}"
            )

+    def test_kiro_cli_is_declared_multi_install_safe(self):
+        """kiro-cli confines itself to an isolated ``.kiro/`` root that no
+        other integration touches, so it must be declared multi-install safe
+        (issue #3471).
+
+        Before the fix, co-installing kiro-cli alongside another integration
+        left ``specify integration status`` permanently in ERROR
+        (``unsafe-multi-install``) with no way to acknowledge it. The
+        parametrized isolation/manifest contracts above already exercise
+        kiro-cli once the flag is set; this pins the declaration itself so a
+        future edit cannot silently drop it and reintroduce the error.
+        """
+        assert INTEGRATION_REGISTRY["kiro-cli"].multi_install_safe is True
+

 class TestCatalogParity:
    """The discovery catalog must list every registered integration."""
--- a/tests/test_authentication.py
+++ b/tests/test_authentication.py
@@ -315,6 +315,20 @@ class TestFindEntriesForUrl:
    def test_empty_url_returns_empty(self):
        assert find_entries_for_url("", [_github_entry()]) == []

+    @pytest.mark.parametrize(
+        "url",
+        [
+            "https://[::1",                 # unterminated ipv6 bracket
+            "https://[not-an-ip]/file",     # bracketed non-ip host
+        ],
+    )
+    def test_malformed_url_returns_empty(self, url):
+        # A malformed authority makes urlparse/hostname raise ValueError.
+        # Since no entry can match such a URL, this must return no matches
+        # (like a host-less URL) rather than leaking a raw ValueError out of
+        # the shared HTTP client.
+        assert find_entries_for_url(url, [_github_entry()]) == []
+
    def test_empty_entries_returns_empty(self):
        assert find_entries_for_url("https://github.com/org/repo", []) == []

--- a/tests/test_command_template_py_scripts.py
+++ b/tests/test_command_template_py_scripts.py
@@ -0,0 +1,107 @@
+"""Command templates with a py: script line must render for --script py.
+
+Covers #3283: ``py:`` lines in the ``scripts:`` frontmatter of
+``templates/commands/*.md`` reference Python scripts that exist in the repo,
+and ``process_template`` turns them into a valid Python invocation
+(interpreter-prefixed, path rewritten to the ``.specify`` tree).
+
+``plan.md`` and ``tasks.md`` gain their ``py:`` lines together with
+``setup_plan.py``/``setup_tasks.py`` in the core-scripts port (#3280); the
+existence check below enforces that ordering.
+"""
+
+import re
+from pathlib import Path
+
+import pytest
+
+from specify_cli.integrations.base import IntegrationBase
+
+REPO_ROOT = Path(__file__).parent.parent
+TEMPLATES_DIR = REPO_ROOT / "templates" / "commands"
+
+_PY_LINE = re.compile(r"^\s*py: (scripts/python/\S+\.py)", re.MULTILINE)
+
+
+def _py_script(name: str) -> str | None:
+    match = _PY_LINE.search((TEMPLATES_DIR / name).read_text(encoding="utf-8"))
+    return match.group(1) if match else None
+
+
+PY_TEMPLATES = sorted(
+    p.name for p in TEMPLATES_DIR.glob("*.md") if _py_script(p.name)
+)
+
+
+@pytest.fixture(autouse=True)
+def _pin_interpreter(monkeypatch):
+    monkeypatch.setattr(
+        "specify_cli.integrations.base.shutil.which",
+        lambda name: "/usr/bin/python3" if name == "python3" else None,
+    )
+    # On Windows, ``resolve_python_interpreter`` guards the ``which`` result
+    # with a real ``_interpreter_runs`` subprocess probe (#3304). The mocked
+    # ``/usr/bin/python3`` path does not exist on a Windows runner, so the
+    # probe would fail and the resolver would fall back to ``sys.executable``
+    # (a ``...python.exe`` path), breaking the ``python3``-anchored assertion.
+    # Pin the probe to True so the interpreter token stays ``python3`` on all
+    # platforms.
+    monkeypatch.setattr(
+        "specify_cli.integrations.base.IntegrationBase._interpreter_runs",
+        staticmethod(lambda path: True),
+    )
+
+
+def test_py_templates_discovered():
+    # Guard: the glob must find the known py-scripted templates, otherwise
+    # the parametrized tests below would silently pass on an empty set.
+    assert "implement.md" in PY_TEMPLATES
+    assert "clarify.md" in PY_TEMPLATES
+
+
+@pytest.mark.parametrize("name", PY_TEMPLATES)
+def test_referenced_python_script_exists(name: str):
+    # A py: line must never point at a script the repo does not ship —
+    # rendering would produce a broken invocation at runtime.
+    script = _py_script(name)
+    assert (REPO_ROOT / script).is_file(), f"{name} references missing {script}"
+
+
+@pytest.mark.parametrize("name", PY_TEMPLATES)
+def test_template_renders_python_invocation(name: str):
+    content = (TEMPLATES_DIR / name).read_text(encoding="utf-8")
+    result = IntegrationBase.process_template(content, "agent", "py")
+    assert "{SCRIPT}" not in result
+    assert re.search(
+        r"python3 \.specify/scripts/python/\w+\.py(?: --[\w-]+)*", result
+    ), f"{name} did not render a Python invocation"
+
+
+@pytest.mark.parametrize("name", PY_TEMPLATES)
+def test_sh_rendering_unchanged(name: str):
+    # Negative: adding py: lines must not leak into sh rendering.
+    content = (TEMPLATES_DIR / name).read_text(encoding="utf-8")
+    result = IntegrationBase.process_template(content, "agent", "sh")
+    assert "{SCRIPT}" not in result
+    assert "scripts/python" not in result
+
+
+def test_install_shared_infra_copies_python_scripts(tmp_path):
+    # --script py must install scripts/python/ into .specify/scripts/python/
+    # so the rendered invocations point at files that exist.
+    from rich.console import Console
+
+    from specify_cli.shared_infra import install_shared_infra
+
+    install_shared_infra(
+        tmp_path,
+        "py",
+        version="0.0.0",
+        core_pack=None,
+        repo_root=REPO_ROOT,
+        console=Console(quiet=True),
+        force=False,
+    )
+    dest = tmp_path / ".specify" / "scripts" / "python"
+    assert (dest / "check_prerequisites.py").is_file()
+    assert not (tmp_path / ".specify" / "scripts" / "powershell").exists()
--- a/tests/test_extension_registration.py
+++ b/tests/test_extension_registration.py
@@ -17,7 +17,7 @@ class TestExtensionRegistration:
        """Standard registration: Adding an extension should add it to the list."""
        executor = HookExecutor(project_dir)
        executor.register_extension("test-ext")
-        
+
        config = executor.get_project_config()
        assert "installed" in config
        assert config["installed"] == ["test-ext"]
@@ -28,7 +28,7 @@ class TestExtensionRegistration:
        executor.register_extension("zebra-ext")
        executor.register_extension("apple-ext")
        executor.register_extension("middle-ext")
-        
+
        config = executor.get_project_config()
        assert config["installed"] == ["apple-ext", "middle-ext", "zebra-ext"]

@@ -37,7 +37,7 @@ class TestExtensionRegistration:
        executor = HookExecutor(project_dir)
        executor.register_extension("test-ext")
        executor.register_extension("test-ext")
-        
+
        config = executor.get_project_config()
        assert config["installed"] == ["test-ext"]
        assert len(config["installed"]) == 1
@@ -47,9 +47,9 @@ class TestExtensionRegistration:
        executor = HookExecutor(project_dir)
        executor.register_extension("ext-1")
        executor.register_extension("ext-2")
-        
+
        executor.unregister_extension("ext-1")
-        
+
        config = executor.get_project_config()
        assert config["installed"] == ["ext-2"]

@@ -57,10 +57,10 @@ class TestExtensionRegistration:
        """Safe Removal: Unregistering a non-existent extension should do nothing."""
        executor = HookExecutor(project_dir)
        executor.register_extension("ext-1")
-        
+
        # Should not raise or change the list
        executor.unregister_extension("ext-nonexistent")
-        
+
        config = executor.get_project_config()
        assert config["installed"] == ["ext-1"]

@@ -87,27 +87,27 @@ class TestExtensionRegistration:
        manifest_path = tmp_path / "extension.yml"
        with open(manifest_path, "w") as f:
            yaml.dump(manifest_data, f)
-        
+
        manifest = ExtensionManifest(manifest_path)
        executor = HookExecutor(project_dir)
-        
+
        # This should call register_extension internally
        executor.register_hooks(manifest)
-        
+
        config = executor.get_project_config()
        assert "hook-ext" in config["installed"]

    def test_missing_installed_key_initialization(self, project_dir):
        """Graceful Initialization: If 'installed' key is missing, it should be created."""
        executor = HookExecutor(project_dir)
-        
+
        # Manually create a config without 'installed'
        config_path = project_dir / ".specify" / "extensions.yml"
        config_path.write_text(yaml.dump({"settings": {"auto_execute_hooks": True}}))
-        
+
        # This should detect the missing key and initialize it
        executor.register_extension("new-ext")
-        
+
        config = executor.get_project_config()
        assert "installed" in config
        assert config["installed"] == ["new-ext"]
@@ -135,20 +135,20 @@ class TestExtensionRegistration:
        manifest_path = tmp_path / "extension.yml"
        with open(manifest_path, "w") as f:
            yaml.dump(manifest_data, f)
-        
+
        manifest = ExtensionManifest(manifest_path)
        executor = HookExecutor(project_dir)
-        
+
        # Register hooks first
        executor.register_hooks(manifest)
-        
+
        config = executor.get_project_config()
        assert "hook-ext" in config["installed"]
        assert "after_tasks" in config["hooks"]
-        
+
        # Now unregister hooks
        executor.unregister_hooks("hook-ext")
-        
+
        config = executor.get_project_config()
        assert "hook-ext" not in config["installed"]
        # unregister_hooks() removes the empty hook array entirely, so the key is absent
@@ -157,16 +157,16 @@ class TestExtensionRegistration:
    def test_unregister_hooks_no_hooks_key(self, project_dir):
        """Resilience: unregister_hooks should work even if config has no 'hooks' key."""
        executor = HookExecutor(project_dir)
-        
+
        # Register extension without hooks
        executor.register_extension("ext-no-hooks")
-        
+
        config = executor.get_project_config()
        assert "ext-no-hooks" in config["installed"]
-        
+
        # Unregister should not crash even if no hooks key exists
        executor.unregister_hooks("ext-no-hooks")
-        
+
        config = executor.get_project_config()
        assert "ext-no-hooks" not in config["installed"]

@@ -175,12 +175,12 @@ class TestExtensionRegistration:
        # Create a corrupted config (root is a list)
        config_path = project_dir / ".specify" / "extensions.yml"
        config_path.write_text(yaml.dump(["corrupted", "list"]))
-        
+
        executor = HookExecutor(project_dir)
-        
+
        # Should not raise even with corrupted config
        executor.unregister_hooks("non-existent")
-        
+
        # Config should remain as-is or be handled gracefully
        config = executor.get_project_config()
        # If it's corrupted, it's returned as-is or handled by defensive logic
@@ -223,30 +223,30 @@ class TestExtensionRegistration:
                "after_tasks": {"command": "speckit.ext-2.run"}
            }
        }
-        
+
        manifest_path_1 = tmp_path / "extension1.yml"
        manifest_path_2 = tmp_path / "extension2.yml"
        with open(manifest_path_1, "w") as f:
            yaml.dump(manifest_data_1, f)
        with open(manifest_path_2, "w") as f:
            yaml.dump(manifest_data_2, f)
-        
+
        manifest1 = ExtensionManifest(manifest_path_1)
        manifest2 = ExtensionManifest(manifest_path_2)
        executor = HookExecutor(project_dir)
-        
+
        # Register both extensions
        executor.register_hooks(manifest1)
        executor.register_hooks(manifest2)
-        
+
        config = executor.get_project_config()
        assert "ext-1" in config["installed"]
        assert "ext-2" in config["installed"]
        assert len(config["hooks"]["after_tasks"]) == 2
-        
+
        # Unregister first extension
        executor.unregister_hooks("ext-1")
-        
+
        config = executor.get_project_config()
        assert "ext-1" not in config["installed"]
        assert "ext-2" in config["installed"]
@@ -346,9 +346,9 @@ class TestExtensionRegistration:
        manifest_path = tmp_path / "extension.yml"
        with open(manifest_path, "w") as f:
            yaml.dump(manifest_data, f)
-        
+
        manifest = ExtensionManifest(manifest_path)
-        
+
        # Should not raise TypeError when trying to append to None
        executor.register_hooks(manifest)

@@ -378,16 +378,16 @@ class TestExtensionRegistration:
        """Review Feedback: register_extension should support and preserve dict entries."""
        executor = HookExecutor(project_dir)
        config_path = project_dir / ".specify" / "extensions.yml"
-        
+
        # Setup config with a pinned extension (dict)
        pinned_ext = {"id": "pinned-ext", "version": "1.0.0"}
        config_path.write_text(yaml.dump({
            "installed": [pinned_ext, "string-ext"]
        }))
-        
+
        # Register a new extension
        executor.register_extension("new-ext")
-        
+
        config = executor.get_project_config()
        # Should contain all three, sorted by id: new-ext, pinned-ext, string-ext
        assert config["installed"] == ["new-ext", pinned_ext, "string-ext"]
@@ -396,15 +396,15 @@ class TestExtensionRegistration:
        """Review Feedback: unregister_extension should support removing matching dict entries."""
        executor = HookExecutor(project_dir)
        config_path = project_dir / ".specify" / "extensions.yml"
-        
+
        pinned_ext = {"id": "to-remove", "version": "1.0.0"}
        config_path.write_text(yaml.dump({
            "installed": [pinned_ext, "other-ext"]
        }))
-        
+
        # Unregister by ID
        executor.unregister_extension("to-remove")
-        
+
        config = executor.get_project_config()
        assert config["installed"] == ["other-ext"]

@@ -412,14 +412,14 @@ class TestExtensionRegistration:
        """Hardening: unregister_extension should handle non-list installed key."""
        executor = HookExecutor(project_dir)
        config_path = project_dir / ".specify" / "extensions.yml"
-        
+
        config_path.write_text(yaml.dump({
            "installed": "not-a-list"
        }))
-        
+
        # Should not crash and should normalize to []
        executor.unregister_extension("any-ext")
-        
+
        config = executor.get_project_config()
        assert config["installed"] == []
    def test_register_hooks_mixed_type_hook_list(self, project_dir, tmp_path):
@@ -458,7 +458,7 @@ class TestExtensionRegistration:

        config = executor.get_project_config()
        hooks = config["hooks"]["after_tasks"]
-        
+
        # Should have 2 valid dict hooks, and 0 non-dict items
        assert len(hooks) == 2
        assert all(isinstance(h, dict) for h in hooks)
@@ -469,12 +469,12 @@ class TestExtensionRegistration:
        """Hardening: unregister_extension should handle scalar root config."""
        executor = HookExecutor(project_dir)
        config_path = project_dir / ".specify" / "extensions.yml"
-        
+
        config_path.write_text(yaml.dump(123))
-        
+
        # Should not crash and should normalize to {}
        executor.unregister_extension("any-ext")
-        
+
        config = executor.get_project_config()
        assert isinstance(config, dict)
        assert config["installed"] == []
@@ -483,15 +483,15 @@ class TestExtensionRegistration:
        """Regression: unregister_hooks() must handle scalar hook event values."""
        executor = HookExecutor(project_dir)
        config_path = project_dir / ".specify" / "extensions.yml"
-        
+
        config_path.write_text(yaml.dump({
            "installed": ["some-ext"],
            "hooks": {"after_tasks": 123}
        }))
-        
+
        # Should not raise TypeError when iterating
        executor.unregister_hooks("some-ext")
-        
+
        config = executor.get_project_config()
        assert "some-ext" not in config["installed"]
        assert "after_tasks" not in config["hooks"]
--- a/tests/test_extension_skills.py
+++ b/tests/test_extension_skills.py
@@ -911,6 +911,65 @@ class TestExtensionSkillRegistration:
        assert ".specify/scripts/bash/resolve-skill.sh" not in content
        assert ".specify/scripts/bash/ensure-skills.sh" not in content

+    def test_skill_registration_rewrites_extension_subdir_paths(self, project_dir, temp_dir):
+        """Auto-registered skills should resolve extension-relative subdir
+        references (agents/, knowledge-base/) to their installed location,
+        matching the rewrite already applied by register_commands() (#2101)."""
+        _create_init_options(project_dir, ai="claude", ai_skills=True)
+        skills_dir = _create_skills_dir(project_dir, ai="claude")
+
+        ext_dir = temp_dir / "path-ext"
+        ext_dir.mkdir()
+        manifest_data = {
+            "schema_version": "1.0",
+            "extension": {
+                "id": "path-ext",
+                "name": "Path Extension",
+                "version": "1.0.0",
+                "description": "Test",
+            },
+            "requires": {"speckit_version": ">=0.1.0"},
+            "provides": {
+                "commands": [
+                    {
+                        "name": "speckit.path-ext.run",
+                        "file": "commands/run.md",
+                        "description": "Run command",
+                    }
+                ]
+            },
+        }
+        with open(ext_dir / "extension.yml", "w") as f:
+            yaml.safe_dump(manifest_data, f)
+
+        (ext_dir / "commands").mkdir()
+        (ext_dir / "agents" / "control").mkdir(parents=True)
+        (ext_dir / "agents" / "control" / "commander.md").write_text("# Commander\n")
+        (ext_dir / "knowledge-base").mkdir()
+        (ext_dir / "knowledge-base" / "agent-scores.yaml").write_text("scores: {}\n")
+        (ext_dir / "templates").mkdir()
+        (ext_dir / "templates" / "kill-report.md").write_text("# Kill Report\n")
+
+        (ext_dir / "commands" / "run.md").write_text(
+            "---\n"
+            "description: Run command\n"
+            "---\n\n"
+            "Read agents/control/commander.md and knowledge-base/agent-scores.yaml.\n"
+            "Use templates/kill-report.md as the report template.\n"
+        )
+
+        manager = ExtensionManager(project_dir)
+        manager.install_from_directory(ext_dir, "0.1.0", register_commands=False)
+
+        content = (skills_dir / "speckit-path-ext-run" / "SKILL.md").read_text()
+        assert ".specify/extensions/path-ext/agents/control/commander.md" in content
+        assert ".specify/extensions/path-ext/knowledge-base/agent-scores.yaml" in content
+        # extension's own templates/ dir must resolve under the extension,
+        # not the project-level .specify/templates/
+        assert ".specify/extensions/path-ext/templates/kill-report.md" in content
+        assert "Read agents/control" not in content
+        assert "and knowledge-base/" not in content
+
    def test_missing_command_file_skipped(self, skills_project, temp_dir):
        """Commands with missing source files should be skipped gracefully."""
        project_dir, skills_dir = skills_project
--- a/Show More
+++ b/Show More