fix(offline): address third round of review comments

- Add 120s timeout to subprocess.run in scaffold_from_core_pack to prevent
  indefinite hangs during offline scaffolding
- Add test_pyproject_force_include_covers_all_templates to catch missing
  template files in wheel bundling
- Tighten kiro alias test to assert specific scaffold path (download vs offline)

Author: mnriem

src/specify_cli/__init__.py

@@ -1158,10 +1158,19 @@ def scaffold_from_core_pack(
                 env["AGENTS"] = ai_assistant
                 env["SCRIPTS"] = script_type
 
-            result = subprocess.run(
-                cmd, cwd=str(tmp), env=env,
-                capture_output=True, text=True,
-            )
+            try:
+                result = subprocess.run(
+                    cmd, cwd=str(tmp), env=env,
+                    capture_output=True, text=True,
+                    timeout=120,
+                )
+            except subprocess.TimeoutExpired:
+                msg = "release script timed out after 120 seconds"
+                if tracker:
+                    tracker.error("scaffold", msg)
+                else:
+                    console.print(f"[red]Error:[/red] {msg}")
+                return False
 
             if result.returncode != 0:
                 msg = result.stderr.strip() or result.stdout.strip() or "unknown error"

tests/test_ai_skills.py

@@ -795,14 +795,14 @@ def test_kiro_alias_normalized_to_kiro_cli(self, tmp_path):
             )
 
         assert result.exit_code == 0
-        # Alias normalisation should have happened regardless of scaffold path used.
-        # Either scaffold_from_core_pack or download_and_extract_template may be called
-        # depending on whether bundled assets are present; check the one that was called.
-        if mock_scaffold.called:
-            assert mock_scaffold.call_args.args[1] == "kiro-cli"
-        else:
-            assert mock_download.called
-            assert mock_download.call_args.args[1] == "kiro-cli"
+        # Without --offline, the download path should be taken.
+        assert mock_download.called, (
+            "Expected download_and_extract_template to be called (default non-offline path)"
+        )
+        assert mock_download.call_args.args[1] == "kiro-cli"
+        assert not mock_scaffold.called, (
+            "scaffold_from_core_pack should not be called without --offline"
+        )
 
     def test_q_removed_from_agent_config(self):
         """Amazon Q legacy key should not remain in AGENT_CONFIG."""

tests/test_core_pack_scaffold.py

@@ -526,3 +526,36 @@ def test_parity_bundled_vs_release_script(tmp_path, agent):
             f"Agent '{agent}': file '{name}' content differs between "
             f"bundled output and release script ZIP"
         )
+
+
+# ---------------------------------------------------------------------------
+# Section 10 – pyproject.toml force-include covers all template files
+# ---------------------------------------------------------------------------
+
+def test_pyproject_force_include_covers_all_templates():
+    """Every file in templates/ (excluding commands/) must be listed in
+    pyproject.toml's [tool.hatch.build.targets.wheel.force-include] section.
+
+    This prevents new template files from being silently omitted from the
+    wheel, which would break ``specify init --offline``.
+    """
+    templates_dir = _REPO_ROOT / "templates"
+    # Collect all files directly in templates/ (not in subdirectories like commands/)
+    repo_template_files = sorted(
+        f.name for f in templates_dir.iterdir()
+        if f.is_file()
+    )
+    assert repo_template_files, "Expected at least one template file in templates/"
+
+    pyproject_path = _REPO_ROOT / "pyproject.toml"
+    pyproject_text = pyproject_path.read_text()
+
+    missing = [
+        name for name in repo_template_files
+        if f"templates/{name}" not in pyproject_text
+    ]
+    assert not missing, (
+        f"Template files not listed in pyproject.toml force-include "
+        f"(offline scaffolding will miss them):\n  "
+        + "\n  ".join(missing)
+    )