Merge remote-tracking branch 'origin/main' into add-gates-extension-15a986e3d153da1e

# Conflicts:
#	extensions/catalog.community.json

Author: Copilot

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 <!-- insert new changelog below this comment -->
 
+## [0.12.11] - 2026-07-10
+
+### Changed
+
+- fix(agent-context): discover nested plan.md in scoped layouts (#3024) (#3301)
+- fix(auth): return no matches, not raw ValueError, for a malformed URL (#3437)
+- fix(catalogs): raise catalog error, not raw ValueError, on a malformed URL (#3435)
+- fix(bundler): raise BundlerError, not raw ValueError, on a malformed catalog URL (#3433)
+- chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430)
+- Add EARS Requirements Syntax extension to community catalog (#3407)
+- Add Spec Kit Figma extension to community catalog (#3408)
+- fix(workflows): report validation errors instead of crashing on non-string workflow.yml scalars (#3421)
+- fix(templates): remove self-referencing path in plan-template.md note (#3417)
+- chore: release 0.12.10, begin 0.12.11.dev0 development (#3453)
+
 ## [0.12.10] - 2026-07-10
 
 ### Changed

docs/community/extensions.md

@@ -149,6 +149,7 @@ The following community-contributed extensions are available in [`catalog.commun
 | Token Economy | Token routing, measured savings, and context audit workflows | `process` | Read+Write | [spec-kit-token-economy](https://github.com/formin/spec-kit-token-economy) |
 | V-Model Extension Pack | Enforces V-Model paired generation of development specs and test specs with full traceability | `docs` | Read+Write | [spec-kit-v-model](https://github.com/leocamello/spec-kit-v-model) |
 | Verify Extension | Post-implementation quality gate that validates implemented code against specification artifacts | `code` | Read-only | [spec-kit-verify](https://github.com/ismaelJimenez/spec-kit-verify) |
+| Verify Review Ship | Adds post-implementation verify, review, and ship readiness gates to Spec Kit workflows | `process` | Read-only | [spec-kit-verify-review-ship](https://github.com/cadugevaerd/spec-kit-verify-review-ship) |
 | Verify Tasks Extension | Detect phantom completions: tasks marked [X] in tasks.md with no real implementation | `code` | Read-only | [spec-kit-verify-tasks](https://github.com/datastone-inc/spec-kit-verify-tasks) |
 | Version Guard | Verify tech stack versions against live npm registries before planning and implementation | `process` | Read-only | [spec-kit-version-guard](https://github.com/KevinBrown5280/spec-kit-version-guard) |
 | What-if Analysis | Preview the downstream impact (complexity, effort, tasks, risks) of requirement changes before committing to them | `visibility` | Read-only | [spec-kit-whatif](https://github.com/DevAbdullah90/spec-kit-whatif) |

docs/reference/bundles.md

@@ -51,10 +51,11 @@ If the current directory is not yet a Spec Kit project, `install` initializes on
 specify bundle update [<bundle_id>]
 ```
 
-| Option       | Description                          |
-| ------------ | ------------------------------------ |
-| `--all`      | Update every installed bundle        |
-| `--offline`  | Do not access the network            |
+| Option           | Description                                                                                                            |
+| ---------------- | --------------------------------------------------------------------------------------------------------------------- |
+| `--all`          | Update every installed bundle                                                                                         |
+| `--integration`  | Override the integration used when refreshing components; applied only when the project's active integration can't be determined |
+| `--offline`      | Do not access the network                                                                                             |
 
 Re-resolves a bundle and **refreshes** its components through each primitive's update path, bringing already-installed components up to the bundle's newly pinned versions while preserving primitive-level overrides (such as preset priority). Provide a bundle id, or use `--all` to update everything installed.
 

docs/reference/integrations.md

@@ -18,7 +18,7 @@ The Specify CLI supports a wide range of AI coding agents. When you run `specify
 | [Firebender](https://firebender.com/)                                                | `firebender`     | IDE-based agent for Android Studio / IntelliJ                                                                                             |
 | [Forge](https://forgecode.dev/)                                                      | `forge`          |                                                                                                                                           |
 | [Gemini CLI](https://github.com/google-gemini/gemini-cli)                            | `gemini`         |                                                                                                                                           |
-| [GitHub Copilot](https://code.visualstudio.com/)                                     | `copilot`        |                                                                                                                                           |
+| [GitHub Copilot](https://code.visualstudio.com/)                                     | `copilot`        | Defaults to legacy markdown mode: `.agent.md` command files under `.github/agents/`, companion `.prompt.md` files under `.github/prompts/`, and a `.vscode/settings.json` merge. Pass `--integration-options="--skills"` to scaffold skills as `speckit-<command>/SKILL.md` under `.github/skills/` instead. Legacy markdown mode is deprecated and will stop being the default in a future release. |
 | [Goose](https://goose-docs.ai/)                                                      | `goose`          | Uses YAML recipe format in `.goose/recipes/`                                                                                              |
 | [Hermes](https://github.com/NousResearch/hermes-agent)                               | `hermes`         | Skills-based integration; installs skills globally into `~/.hermes/skills/`                                                                |
 | [IBM Bob](https://www.ibm.com/products/bob)                                          | `bob`            | IDE-based agent                                                                                                                           |
@@ -219,6 +219,7 @@ Some integrations accept additional options via `--integration-options`:
 | ----------- | ------------------- | -------------------------------------------------------------- |
 | `generic`   | `--commands-dir`    | Required. Directory for command files                          |
 | `kimi`      | `--migrate-legacy`  | Migrate legacy `.kimi/skills/` installs to `.kimi-code/skills/` (including dotted→hyphenated skill naming, e.g. `speckit.xxx` → `speckit-xxx`) |
+| `copilot`   | `--skills`          | Scaffold commands as agent skills (`speckit-<command>/SKILL.md` under `.github/skills/`, invoked as `/speckit-<command>`) instead of the default legacy markdown mode (`.github/agents/*.agent.md` plus `.github/prompts/*.prompt.md` and a `.vscode/settings.json` merge). Without this flag, install warns that legacy markdown mode is deprecated. |
 
 Example:
 

extensions/agent-context/commands/speckit.agent-context.update.md

@@ -15,7 +15,7 @@ The script reads the agent-context extension config at
 - `context_files` — optional project-relative paths for multiple coding agent context files. When non-empty, the script updates each listed file and the list takes precedence over `context_file`.
 - `context_markers.start` / `.end` — the delimiters surrounding the managed section. Defaults to `<!-- SPECKIT START -->` and `<!-- SPECKIT END -->` when the field is missing.
 
-It then creates, replaces, or appends the managed block so that the section points at the most recent plan path when one can be discovered (`specs/**/plan.md`, any depth).
+It then creates, replaces, or appends the managed block so that the section points at the most recent plan path when one can be discovered (any `plan.md` under `specs/`, including nested scoped layouts such as `specs/<scope>/<feature>/plan.md`).
 
 If `context_files` and `context_file` are empty, the command reports nothing to do and exits successfully. Context file paths must stay project-relative; absolute paths, Windows drive paths, backslash separators, and `..` path segments are rejected.
 
@@ -24,4 +24,4 @@ If `context_files` and `context_file` are empty, the command reports nothing to
 - **Bash**: `.specify/extensions/agent-context/scripts/bash/update-agent-context.sh [plan_path]`
 - **PowerShell**: `.specify/extensions/agent-context/scripts/powershell/update-agent-context.ps1 [plan_path]`
 
-When `plan_path` is omitted, the script auto-detects the most recently modified `specs/**/plan.md` (any depth, so scoped layouts like `specs/<scope>/<feature>/plan.md` are found).
+When `plan_path` is omitted, the script auto-detects the most recently modified `specs/**/plan.md` (searched recursively, so nested scoped layouts are discovered).

extensions/agent-context/scripts/bash/update-agent-context.sh

@@ -307,16 +307,28 @@ import sys
 from pathlib import Path
 root = Path(sys.argv[1]).resolve()
 specs = root / "specs"
-plan = max(
-    specs.glob("**/plan.md"),
-    key=lambda p: p.stat().st_mtime,
-    default=None,
-)
-if plan:
+
+def _resolved_rel(p):
+    # Resolve symlinks before checking containment: relative_to() is lexical
+    # and would otherwise accept a plan reached through a specs/ symlink that
+    # points outside the project, emitting an in-project-looking path for an
+    # out-of-project file (or picking it as "most recent").
     try:
-        print(plan.relative_to(root).as_posix())
-    except ValueError:
-        print("")
+        return p.resolve().relative_to(root)
+    except (OSError, ValueError):
+        return None
+
+# Recurse (rather than the old one-level specs/*/plan.md glob) so scoped layouts
+# created via SPECIFY_FEATURE_DIRECTORY, e.g. specs/<scope>/<feature>/plan.md,
+# are still discovered when feature.json is absent (#3024).
+candidates = []
+for p in specs.rglob("plan.md"):
+    rel = _resolved_rel(p)
+    if rel:
+        candidates.append((p, rel))
+candidates.sort(key=lambda pr: pr[0].stat().st_mtime, reverse=True)
+if candidates:
+    print(candidates[0][1].as_posix())
 else:
     print("")
 PY

extensions/agent-context/scripts/powershell/update-agent-context.ps1

@@ -426,7 +426,11 @@ if (-not $PlanPath) {
     if (-not $PlanPath) {
         try {
             $specsDir = Join-Path $ProjectRoot 'specs'
-            $candidate = Get-ChildItem -Path $specsDir -Recurse -File -Filter 'plan.md' -ErrorAction SilentlyContinue |
+            # Recurse (rather than the old one-level specs/*/plan.md scan) so scoped
+            # layouts created via SPECIFY_FEATURE_DIRECTORY, e.g.
+            # specs/<scope>/<feature>/plan.md, are still discovered when
+            # feature.json is absent (#3024).
+            $candidate = Get-ChildItem -Path $specsDir -Filter 'plan.md' -File -Recurse -ErrorAction SilentlyContinue |
                 Sort-Object LastWriteTime -Descending |
                 Select-Object -First 1
             if ($candidate) {

extensions/catalog.community.json

@@ -4407,6 +4407,40 @@
       "created_at": "2026-03-03T00:00:00Z",
       "updated_at": "2026-04-09T00:00:00Z"
     },
+    "verify-review-ship": {
+      "name": "Verify Review Ship",
+      "id": "verify-review-ship",
+      "description": "Adds post-implementation verify, review, and ship readiness gates to Spec Kit workflows.",
+      "author": "Carlos Eduardo Gevaerd Araujo",
+      "version": "0.1.0",
+      "download_url": "https://github.com/cadugevaerd/spec-kit-verify-review-ship/archive/refs/tags/v0.1.0.zip",
+      "repository": "https://github.com/cadugevaerd/spec-kit-verify-review-ship",
+      "homepage": "https://github.com/cadugevaerd/spec-kit-verify-review-ship",
+      "documentation": "https://github.com/cadugevaerd/spec-kit-verify-review-ship/blob/main/README.md",
+      "changelog": "https://github.com/cadugevaerd/spec-kit-verify-review-ship/blob/main/CHANGELOG.md",
+      "license": "MIT",
+      "category": "process",
+      "effect": "read-only",
+      "requires": {
+        "speckit_version": ">=0.1.0"
+      },
+      "provides": {
+        "commands": 3,
+        "hooks": 1
+      },
+      "tags": [
+        "quality",
+        "review",
+        "shipping",
+        "workflow",
+        "testing"
+      ],
+      "verified": false,
+      "downloads": 0,
+      "stars": 0,
+      "created_at": "2026-07-10T00:00:00Z",
+      "updated_at": "2026-07-10T00:00:00Z"
+    },
     "verify-tasks": {
       "name": "Verify Tasks Extension",
       "id": "verify-tasks",

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "specify-cli"
-version = "0.12.11.dev0"
+version = "0.12.12.dev0"
 description = "Specify CLI, part of GitHub Spec Kit. A tool to bootstrap your projects for Spec-Driven Development (SDD)."
 readme = "README.md"
 requires-python = ">=3.11"

src/specify_cli/authentication/config.py

@@ -196,7 +196,15 @@ def find_entries_for_url(
     url: str, entries: list[AuthConfigEntry]
 ) -> list[AuthConfigEntry]:
     """Return entries whose ``hosts`` match the hostname of *url*."""
-    hostname = (urlparse(url).hostname or "").lower()
+    # A malformed authority (e.g. an unterminated IPv6 bracket "https://[::1")
+    # makes urlparse/hostname raise ValueError. Treat that the same as a
+    # host-less URL: no entry can match, so return no matches rather than
+    # leaking a raw ValueError out of the shared HTTP client (build_request /
+    # open_url call this before any URL validation).
+    try:
+        hostname = (urlparse(url).hostname or "").lower()
+    except ValueError:
+        return []
     if not hostname:
         return []
     return [