Bump @fission-ai/openspec from 1.5.0 to 1.7.0

[dependabot]

Bumps @fission-ai/openspec from 1.5.0 to 1.7.0.

Release notes

Sourced from @​fission-ai/openspec's releases.

v1.7.0 - New tools, smarter updates

What's New in v1.7.0

Ninety merged PRs from nineteen contributors. New tools, sturdier archives, and a CLI that keeps itself fresh.

New

• openspec update keeps you current - It now checks npm for a newer release and offers to run the upgrade for you. One less thing to remember.
• Five new AI tools - Welcome ZCode, Hermes Agent, CodeArts Agent, and Kimi Code; Codex now runs skills-only. And if skills.sh is your thing, npx skills add Fission-AI/OpenSpec works too.
• One default store for your whole machine - openspec config set defaultStore <id> and every repo without its own config resolves through it.
• Changes without spec changes - Pure refactors and docs work can declare skip_specs: true and move straight through validate and archive.
• Project context in every workflow - Schemas can carry per-operation guidance, and openspec instructions apply|archive serve it to your agent right when it needs it.

Improved

• Slash commands, spelled the way your tool spells them - Generated content now matches each tool's registered command names across all 30+ supported tools.
• Archives flow - Already-synced deltas glide through as no-ops, your authored ## Purpose carries into new specs, and dated names stay tidy on re-archive.
• Multi-select prompts got proper checkboxes - [x] for multi-select, exactly as your fingers expect.
• A welcome screen for everyone - Honors your OS Reduce Motion setting, --no-animation, and waits politely for Enter.
• Nested spec folders everywhere - specs/<area>/<capability>/spec.md is first-class in validate, apply, archive, and view.

Fixed

• Leaner, policy-friendly installs - Telemetry now sends its single event with a plain fetch, so installs are ~160 packages lighter and sail through supply-chain age policies like pnpm's minimumReleaseAge (#1390).
• Completions everywhere you shell - fish gets true fish completions, PowerShell scripts parse cleanly, and Oh My Zsh installs land in your actual $ZSH.
• Windows input flows smoothly - keystrokes register immediately after the welcome screen.
• openspec feedback always delivers - your message reaches an issue or a ready-to-send link, whatever gh is up to.
• Files from every editor parse - UTF-8 BOMs from Windows editors are handled transparently.
• Change names with leading digits - 0001-add-auth is valid everywhere, matching the archive conventions.

Want every detail? All 79 changes are itemized in the CHANGELOG.

Thanks

Every PR in this release, big or small, made it better: @​TabishB, @​showms, @​mc856, @​hsusul, @​xiaoquisme, @​vishnujayvel, @​taltas, @​nmrtn, @​mehdishahdoost, @​jikkujoyce, @​javigomez, @​fyeeme, @​c4patino, @​benjymoses, @​akeyz, @​Lukk17, @​HowardYan888, @​CodeArtsAgent, @​clay-good

New Contributors

• @​javigomez made their first contribution in Fission-AI/OpenSpec#1151
• @​akeyz made their first contribution in Fission-AI/OpenSpec#1208
• @​xiaoquisme made their first contribution in Fission-AI/OpenSpec#1292
• @​fyeeme made their first contribution in Fission-AI/OpenSpec#1209
• @​mc856 made their first contribution in Fission-AI/OpenSpec#1191
• @​CodeArtsAgent made their first contribution in Fission-AI/OpenSpec#1266
• @​showms made their first contribution in Fission-AI/OpenSpec#1283
• @​vishnujayvel made their first contribution in Fission-AI/OpenSpec#1391
• @​benjymoses made their first contribution in Fission-AI/OpenSpec#1299
• @​nmrtn made their first contribution in Fission-AI/OpenSpec#1109
• @​Lukk17 made their first contribution in Fission-AI/OpenSpec#1255

... (truncated)

Changelog

Sourced from @​fission-ai/openspec's changelog.

1.7.0

Minor Changes

• #1475 17af60c Thanks @​clay-good! - Add CodeArts Agent skills support: openspec init --tools codeartsagent installs the workflow skills.

• #1475 17af60c Thanks @​clay-good! - Add Hermes Agent as a supported AI tool: openspec init --tools hermes installs the workflow skills (Hermes is skills-only and invokes them directly).

• #1475 17af60c Thanks @​clay-good! - Add ZCode as a supported AI tool: openspec init --tools zcode generates its skills and /opsx:* commands.

• #1475 17af60c Thanks @​clay-good! - Codex is now skills-only: workflows install as $openspec-* skills and previously managed custom prompts are retired (existing ones are cleaned up on update).

• #1062 eac2973 Thanks @​showms! - Add current project context and per-operation guidance to apply and archive workflows. Projects can configure operations.apply.guidance and operations.archive.guidance; openspec instructions apply returns apply inputs, and the new read-only openspec instructions archive surface returns archive inputs for the selected root.

  Archive, bulk archive, and sync skills now load current archive inputs and specs artifact rules at execution time, fail before writes or moves when required instruction lookups fail, and reuse specs-rule snapshots during inline sync.

• #1475 17af60c Thanks @​clay-good! - Publish the workflow skills as static skills/<name>/SKILL.md files so npx skills add Fission-AI/OpenSpec works.

• #1399 27b22ab Thanks @​clay-good! - Add skip_specs: true change metadata for work with no spec-level behavior change (pure refactors, tooling, docs). openspec validate accepts a zero-delta change that declares the marker (honored only when the metadata parses under the shared change-metadata schema and names a schema that loads) and errors when the marker and delta specs are both present, the artifact graph no longer blocks tasks on spec files for such changes, openspec status renders the specs stage as explicitly skipped, and the propose/specs guidance points to the marker instead of contradicting the validator.

• #1475 17af60c Thanks @​clay-good! - Resolve symlinked schema directories so schemas shared via symlink (e.g. from a dotfiles repo) are discovered.

• #1470 6295515 Thanks @​clay-good! - openspec update now offers to upgrade the CLI when yours is behind the published one. Instruction files are generated by the installed CLI, so a stale install reported ✓ All 1 tool(s) up to date (v1.6.0) while the workflows added in newer releases were never written:

  A newer OpenSpec CLI is available (v1.6.0 → v1.7.0).
    Running from: /usr/local/lib/node_modules/@fission-ai/openspec
  ? Upgrade to v1.7.0 now? (Y/n)
  

  Say yes and it upgrades, confirms the new version is the one that answers, then re-runs the update so the new workflows arrive in the same command. Say no and it prints the command matching how you installed OpenSpec, and updates with what you have. Nothing happens to your machine that you did not agree to: the offer appears only in an interactive terminal and only where npm install -g would help, and the check is skipped in CI or when OPENSPEC_NO_UPDATE_CHECK, DO_NOT_TRACK=1, or OPENSPEC_TELEMETRY=0 is set.

  See CLI reference → openspec update for the per-install-method behavior and every opt-out.

Patch Changes

• #1404 a84ae70 Thanks @​clay-good! - Generated skills for tools without a command adapter (Kimi Code, Mistral Vibe, Hermes, ForgeCode, CodeArts) no longer reference /opsx:* commands that were never generated: skill cross-references, the init getting-started hint, and the profile-migration message now use each tool's documented skill invocation (Kimi Code: /skill:openspec-*; others: /openspec-*), and Codex — skills-invocable with no slash surface — gets a syntax-neutral hint that names the skill. Selections that mix invocation syntaxes print one labeled hint per distinct form, so every advertised instruction is usable by the tool it names. When delivery: commands would generate nothing for a selected tool, init prints a configuration correction naming that tool, even when other tools did get commands or skills. The committed skills.sh distribution is regenerated with skill references (default /openspec-* form, as that channel installs skills only).

• #1363 5199f41 Thanks @​clay-good! - ### Features

  • One default store for every repo on your machine — openspec config set defaultStore <id> sets a machine-level fallback root: any command run outside a planning root, with no --store flag and no project store: pointer, resolves to that store. It sits at the bottom of the precedence list, so --store, a local root, and a project pointer all still win. The root banner and JSON root block report the distinct provenance source: "global_default", so users and tooling can tell a machine-wide default from a repo's own pointer. A stale id degrades to the underlying store error with a fix that names openspec config unset defaultStore.

• #1435 6a5171e Thanks @​clay-good! - openspec new change now accepts numeric-prefixed names like 100-add-feature or 00001-add-auth, useful for ordering or tiering changes. Change names now use the same kebab-case grammar as store ids and change metadata (a leading digit is allowed); archive already treated date-prefixed names as a supported convention. Uppercase, spaces, underscores, and leading/trailing or consecutive hyphens are still rejected, and every previously valid name stays valid.

• #1425 040a869 Thanks @​clay-good! - Compare config key guards literally instead of through a helper.

  setNestedValue and deleteNestedValue rejected prototype-reaching key segments through a helper that did a Set lookup. That is correct, but static analysis could not follow it, so CodeQL kept reporting prototype-pollution on the very assignments the guard protects. The segments are now compared literally in the same function, still checked across the whole path before anything is written. Behavior is unchanged for every input, verified against the previous implementation across 400,000 generated cases.

• #1431 6a4f0d7 Thanks @​clay-good! - A delta spec that introduces a brand-new capability can now open with a ## Purpose, and openspec archive uses it as the Purpose of the main spec it creates instead of writing the TBD - created by archiving change <name>. Update Purpose after archive. placeholder over it. The specs artifact instruction, its example, the delta template and the openspec-sync-specs skill all tell authors and agents to write one, so the CLI and agent-driven sync paths produce the same main spec.

... (truncated)

Commits

• 4e16790 Version Packages (#1380)
• 8731290 fix(telemetry): send the usage event directly instead of via posthog-node (#1...
• 17af60c fix(archive): make the scenario-drift check fence-aware, plus release-audit f...
• 1637856 feat(adapters): follow the Windsurf rename to Devin Desktop (#1167)
• 9a937cb fix(adapters): reference slash commands by the names each tool registers (#1471)
• 10fa39b fix(update): refresh command files for tools configured without skills (#1442)
• 6295515 feat(update): offer to upgrade a stale CLI during openspec update (#1470)
• ec6cbb4 docs: add anvil to Community Schemas table (#1469)
• fc886af fix(templates): auto-select the only active change instead of always promptin...
• fb19699 fix(adapters): escape YAML frontmatter values consistently across all command...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Dev-only dependency and lockfile update with no runtime product code changes; main follow-up is regenerating OpenSpec artifacts if you rely on pinned CLI output.

Overview
Bumps the root devDependency @fission-ai/openspec from 1.5.0 to 1.7.0 in package.json and refreshes bun.lock.

The lockfile shifts mainly because OpenSpec 1.7 drops posthog-node (telemetry uses a direct fetch), which removes a large transitive tree and updates CLI-related packages such as ora, log-symbols, and zod under the OpenSpec dependency graph. No application source in this repo is changed—only how the repo pins the OpenSpec CLI used for openspec/ workflows and bun openspec per AGENTS.md.

After merge, run bun install (or your usual install) and consider bun openspec update if you want generated agent commands/skills refreshed to match 1.7 behavior.

^{Reviewed by Cursor Bugbot for commit 6ef2e3e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6ef2e3e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[greptile-apps]

Greptile Summary

Updates the pinned @fission-ai/openspec development dependency from 1.5.0 to 1.7.0.

• Refreshes the Bun lockfile for OpenSpec’s updated dependency graph.
• Removes OpenSpec’s posthog-node dependency and updates its CLI presentation and validation dependencies.

Confidence Score: 5/5

The PR appears safe to merge because the dependency and lockfile updates do not create a reachable repository failure.

OpenSpec is not invoked by repository automation, and the regenerated lockfile retains compatible or separately nested dependency versions for existing consumers such as Mintlify.

_{Reviews (1): Last reviewed commit: "Bump @fission-ai/openspec from 1.5.0 to ..." | Re-trigger Greptile}