feat(skills): publish workflow skills to skills.sh (#1357)

* feat(skills): publish workflow skills to skills.sh

Commit the 12 OpenSpec workflow skills as static skills/<name>/SKILL.md so
`npx skills add Fission-AI/OpenSpec` can install them (skills.sh reads static
files from the repo; OpenSpec otherwise only generates skills at init time).

Files are generated from the existing templates via `pnpm generate:skills`,
not hand-copied, and skillssh-parity.test.ts fails CI if a template changes
without regenerating. The volatile generatedBy frontmatter line is stripped so
the committed copies stay byte-stable across releases.

Closes #1258

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(skills): force LF on committed skills/ so Windows CI parity holds

The skills.sh distribution files are generated LF-only and compared
byte-for-byte by skillssh-parity.test.ts. Windows autocrlf checked them
out as CRLF, failing the parity assertion. A scoped .gitattributes pins
them to LF on checkout.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(skills): reject symlinks and assert the exact committed skill set

Review feedback (alfred): the parity test only visited expected templates,
so an extra or renamed skills/ directory shipped with green CI, and the
generator would write through a pre-existing symlinked skill directory to
anywhere on disk.

- generator: refuse to run if skills/ contains any symlink (checked before
  any deletion, so a bad tree is left intact), validate dirNames against a
  path-segment allowlist, and lstat the target before writing.
- parity test: assert skills/ holds exactly README.md plus one real
  directory per template, each containing a single real SKILL.md.
- focused tests cover symlink refusal (no partial deletion), traversal
  names, and stale-directory cleanup.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(templates): abort archive on Cancel, honest summary, fence languages

CodeRabbit review on #1357, fixed at the template source and regenerated:

- archive-change: choosing "Cancel" at the sync prompt now stops the flow
  instead of archiving anyway (skill + command templates).
- archive-change skill: the success output no longer hardcodes "All
  artifacts complete. All tasks complete." when archiving incomplete work.
- archive/bulk-archive/sync-specs/verify-change: language identifiers on
  previously plain code fences (MD040), skill and command twins alike.

Golden hashes in skill-templates-parity.test.ts recomputed from dist/;
skills/ regenerated via pnpm generate:skills.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: clay-good

.gitattributes

@@ -0,0 +1,4 @@
+# The skills.sh distribution files are generated LF-only and compared
+# byte-for-byte by test/core/templates/skillssh-parity.test.ts. Force LF on
+# checkout so Windows autocrlf doesn't turn them into CRLF and fail parity.
+skills/** text eol=lf

package.json

@@ -42,6 +42,7 @@
   "scripts": {
     "lint": "eslint src/",
     "build": "node build.js",
+    "generate:skills": "node scripts/generate-skillssh.mjs",
     "dev": "tsc --watch",
     "dev:cli": "pnpm build && node bin/openspec.js",
     "test": "vitest run",

scripts/generate-skillssh.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+
+/**
+ * Generate the static skills.sh distribution of the OpenSpec workflow skills.
+ *
+ * skills.sh installs skills by reading committed `SKILL.md` files straight from
+ * a GitHub repo (`npx skills add Fission-AI/OpenSpec`). OpenSpec normally
+ * *generates* these skills into a user's project via `openspec init`, so this
+ * script mirrors that same output into a committed `skills/<name>/SKILL.md`
+ * tree that skills.sh can discover.
+ *
+ * The committed copies are kept honest by `test/core/templates/skillssh-parity.test.ts`,
+ * which regenerates and diffs against disk. Run this after any skill-template
+ * change: `pnpm build && pnpm generate:skills`.
+ */
+
+import { writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { getSkillTemplates, generateSkillContent } from '../dist/core/shared/skill-generation.js';
+import {
+  cleanSkillSubdirectories,
+  prepareSkillDirectory,
+  stripVolatileFrontmatter,
+  SKILLS_DIR,
+} from './skillssh-shared.mjs';
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+const outDir = join(repoRoot, SKILLS_DIR);
+
+cleanSkillSubdirectories(outDir);
+
+let count = 0;
+for (const { template, dirName } of getSkillTemplates()) {
+  const content = stripVolatileFrontmatter(generateSkillContent(template, 'skills.sh'));
+  const skillDir = prepareSkillDirectory(outDir, dirName);
+  writeFileSync(join(skillDir, 'SKILL.md'), content, 'utf8');
+  count++;
+}
+
+console.log(`Generated ${count} skills into ${SKILLS_DIR}/`);

scripts/skillssh-shared.mjs

@@ -0,0 +1,60 @@
+/**
+ * Shared helpers for the skills.sh distribution generator and its parity test.
+ */
+
+import { lstatSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** Directory (repo-relative) that skills.sh scans for `SKILL.md` files. */
+export const SKILLS_DIR = 'skills';
+
+/**
+ * Drop the per-release `generatedBy` frontmatter line so the committed
+ * skills.sh copies stay byte-stable across OpenSpec version bumps. The line is
+ * meaningful only for skills that `openspec init` writes into a project; in the
+ * standalone distribution it would just churn the files on every release.
+ */
+export function stripVolatileFrontmatter(content) {
+  return content.replace(/^ {2}generatedBy: .*\n/m, '');
+}
+
+/**
+ * Remove existing skill subdirectories (clears any renamed/removed skills)
+ * while preserving top-level files like README.md. Refuses to run if the tree
+ * contains a symlink: deleting one would only unlink it, and a symlinked skill
+ * directory would otherwise let later writes land outside the repo.
+ */
+export function cleanSkillSubdirectories(outDir) {
+  mkdirSync(outDir, { recursive: true });
+  const entries = readdirSync(outDir, { withFileTypes: true });
+  // Reject before deleting anything so a bad tree is left fully intact.
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) {
+      throw new Error(
+        `Refusing to generate: ${join(outDir, entry.name)} is a symlink. Remove it and re-run.`
+      );
+    }
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      rmSync(join(outDir, entry.name), { recursive: true, force: true });
+    }
+  }
+}
+
+/**
+ * Create `<outDir>/<dirName>` and return its path, guaranteeing the write
+ * target is a real directory contained in outDir — never a path-traversing
+ * name and never a symlink that would redirect the write elsewhere.
+ */
+export function prepareSkillDirectory(outDir, dirName) {
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(dirName)) {
+    throw new Error(`Refusing to generate: unsafe skill directory name ${JSON.stringify(dirName)}`);
+  }
+  const skillDir = join(outDir, dirName);
+  mkdirSync(skillDir, { recursive: true });
+  if (!lstatSync(skillDir).isDirectory()) {
+    throw new Error(`Refusing to write through ${skillDir}: not a real directory.`);
+  }
+  return skillDir;
+}

skills/README.md

@@ -0,0 +1,19 @@
+# OpenSpec skills for skills.sh
+
+Install the OpenSpec workflow skills into any [skills.sh](https://skills.sh)-compatible agent:
+
+```bash
+npx skills add Fission-AI/OpenSpec
+```
+
+Each `openspec-*/SKILL.md` here is the same skill `openspec init` writes into a
+project. The skills drive the `openspec` CLI, so for the full setup (CLI +
+`openspec/` project scaffolding + slash commands) run:
+
+```bash
+npx openspec@latest init
+```
+
+> These files are generated from the skill templates — do not edit by hand. Run
+> `pnpm build && pnpm generate:skills` after changing a template;
+> `skillssh-parity.test.ts` fails if they drift.

skills/openspec-apply-change/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly