fix: address review — containment check, deterministic prompts, manifest accuracy

- CopilotIntegration.setup() adds dest containment check (relative_to)
- Companion prompts generated from templates list, not directory glob
- _install_shared_infra() only records files actually copied (not pre-existing)
- VS Code settings tests made unconditional (assert template exists)
- Inventory tests use .as_posix() for cross-platform paths

Author: mnriem

src/specify_cli/__init__.py

@@ -1241,10 +1241,8 @@ def _install_shared_infra(
                     else:
                         dst_path.parent.mkdir(parents=True, exist_ok=True)
                         shutil.copy2(src_path, dst_path)
-            for f in dest_variant.rglob("*"):
-                if f.is_file():
-                    rel = f.relative_to(project_path).as_posix()
-                    manifest.record_existing(rel)
+                        rel = dst_path.relative_to(project_path).as_posix()
+                        manifest.record_existing(rel)
 
     # Page templates (not command templates, not vscode-settings.json)
     if core and (core / "templates").is_dir():
@@ -1263,8 +1261,8 @@ def _install_shared_infra(
                     skipped_files.append(str(dst.relative_to(project_path)))
                 else:
                     shutil.copy2(f, dst)
-                rel = dst.relative_to(project_path).as_posix()
-                manifest.record_existing(rel)
+                    rel = dst.relative_to(project_path).as_posix()
+                    manifest.record_existing(rel)
 
     if skipped_files:
         import logging

src/specify_cli/integrations/copilot/__init__.py

@@ -66,6 +66,14 @@ def setup(
             return []
 
         dest = self.commands_dest(project_root)
+        dest_resolved = dest.resolve()
+        try:
+            dest_resolved.relative_to(project_root_resolved)
+        except ValueError as exc:
+            raise ValueError(
+                f"Integration destination {dest_resolved} escapes "
+                f"project root {project_root_resolved}"
+            ) from exc
         dest.mkdir(parents=True, exist_ok=True)
         created: list[Path] = []
 
@@ -82,10 +90,10 @@ def setup(
             )
             created.append(dst_file)
 
-        # 2. Generate companion .prompt.md files
+        # 2. Generate companion .prompt.md files from the templates we just wrote
         prompts_dir = project_root / ".github" / "prompts"
-        for agent_file in sorted(dest.glob("speckit.*.agent.md")):
-            cmd_name = agent_file.name.removesuffix(".agent.md")
+        for src_file in templates:
+            cmd_name = f"speckit.{src_file.stem}"
             prompt_content = f"---\nagent: {cmd_name}\n---\n"
             prompt_file = self.write_file_and_record(
                 prompt_content,

tests/integrations/test_copilot.py

@@ -57,13 +57,13 @@ def test_agent_and_prompt_counts_match(self, tmp_path):
     def test_setup_creates_vscode_settings_new(self, tmp_path):
         from specify_cli.integrations.copilot import CopilotIntegration
         copilot = CopilotIntegration()
+        assert copilot._vscode_settings_path() is not None
         m = IntegrationManifest("copilot", tmp_path)
         created = copilot.setup(tmp_path, m)
         settings = tmp_path / ".vscode" / "settings.json"
-        if copilot._vscode_settings_path():
-            assert settings.exists()
-            assert settings in created
-            assert any("settings.json" in k for k in m.files)
+        assert settings.exists()
+        assert settings in created
+        assert any("settings.json" in k for k in m.files)
 
     def test_setup_merges_existing_vscode_settings(self, tmp_path):
         from specify_cli.integrations.copilot import CopilotIntegration
@@ -75,12 +75,11 @@ def test_setup_merges_existing_vscode_settings(self, tmp_path):
         m = IntegrationManifest("copilot", tmp_path)
         created = copilot.setup(tmp_path, m)
         settings = tmp_path / ".vscode" / "settings.json"
-        if copilot._vscode_settings_path():
-            data = json.loads(settings.read_text(encoding="utf-8"))
-            assert data["editor.fontSize"] == 14
-            assert data["custom.setting"] is True
-            assert settings not in created
-            assert not any("settings.json" in k for k in m.files)
+        data = json.loads(settings.read_text(encoding="utf-8"))
+        assert data["editor.fontSize"] == 14
+        assert data["custom.setting"] is True
+        assert settings not in created
+        assert not any("settings.json" in k for k in m.files)
 
     def test_all_created_files_tracked_in_manifest(self, tmp_path):
         from specify_cli.integrations.copilot import CopilotIntegration
@@ -161,7 +160,7 @@ def test_complete_file_inventory_sh(self, tmp_path):
         finally:
             os.chdir(old_cwd)
         assert result.exit_code == 0
-        actual = sorted(str(p.relative_to(project)) for p in project.rglob("*") if p.is_file())
+        actual = sorted(p.relative_to(project).as_posix() for p in project.rglob("*") if p.is_file())
         expected = sorted([
             ".github/agents/speckit.analyze.agent.md",
             ".github/agents/speckit.checklist.agent.md",
@@ -221,7 +220,7 @@ def test_complete_file_inventory_ps(self, tmp_path):
         finally:
             os.chdir(old_cwd)
         assert result.exit_code == 0
-        actual = sorted(str(p.relative_to(project)) for p in project.rglob("*") if p.is_file())
+        actual = sorted(p.relative_to(project).as_posix() for p in project.rglob("*") if p.is_file())
         expected = sorted([
             ".github/agents/speckit.analyze.agent.md",
             ".github/agents/speckit.checklist.agent.md",