chore: merge upstream and bump to v0.5.3

Synced with github/spec-kit (752683d):
- Release 0.7.1 upstream changes
- CI: Windows test matrix support
- Docs cleanup (removed deprecated --skip-tls)

Preserved fork customizations:
- Package name: agentic-sdlc-specify-cli
- Version: 0.5.3
- ACCENT_COLOR and BANNER_COLORS (tikalk orange theming)
- adlc.* command namespace support
- Bundled extensions (levelup, evals, architect, quick, product, tdd)
- Bundled agentic-sdlc preset

Author: kanfil

.github/workflows/test.yml

@@ -27,9 +27,10 @@ jobs:
         run: uvx ruff check src/
 
   pytest:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
+        os: [ubuntu-latest, windows-latest]
         python-version: ["3.11", "3.12", "3.13"]
     steps:
       - name: Checkout
@@ -46,5 +47,9 @@ jobs:
       - name: Install dependencies
         run: uv sync --extra test
 
+      # On windows-latest, bash tests auto-skip unless Git-for-Windows
+      # bash (MSYS2/MINGW) is detected. The WSL launcher is rejected
+      # because it cannot handle native Windows paths in test fixtures.
+      # See tests/conftest.py::_has_working_bash() for details.
       - name: Run tests
         run: uv run pytest

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to the Specify CLI and templates are documented here.
 
 # [Unreleased]
 
+# [0.5.3] - 2026-04-16
+
+### Changed
+
+- **Upstream merge**: Synced with github/spec-kit (752683d)
+  - Release 0.7.1 upstream changes
+  - CI: Windows test matrix support
+  - Docs cleanup (removed deprecated --skip-tls)
+  - Merged cleanly with fork customizations preserved
+
 # [0.5.2] - 2026-04-16
 
 ### Fixed
@@ -1088,6 +1098,20 @@ This release migrates fork-specific customizations to a preset system to reduce
 
 The following entries are from the upstream spec-kit project and are included for reference.
 
+## [0.7.1] - 2026-04-15
+
+### Changed
+
+- ci: add windows-latest to test matrix (#2233)
+- docs: remove deprecated --skip-tls references from local-development guide (#2231)
+- fix: allow Claude to chain skills for hook execution (#2227)
+- docs: merge TESTING.md into CONTRIBUTING.md, remove TESTING.md (#2228)
+- Add agent-assign extension to community catalog (#2030)
+- fix: unofficial PyPI warning (#1982) and legacy extension command name auto-correction (#2017) (#2027)
+- feat: register architect-preview in community catalog (#2214)
+- chore: deprecate --ai flag in favor of --integration on specify init (#2218)
+- chore: release 0.7.0, begin 0.7.1.dev0 development (#2217)
+
 ## [0.7.0] - 2026-04-14
 
 ### Changed

docs/local-development.md

@@ -128,16 +128,14 @@ python -m src.specify_cli init --here --ai claude --ignore-agent-tools --script
 
 Or copy only the modified CLI portion if you want a lighter sandbox.
 
-## 9. Debug Network / TLS Skips
+## 9. Debug Network / TLS Issues
 
-If you need to bypass TLS validation while experimenting:
-
-```bash
-specify check --skip-tls
-specify init demo --skip-tls --ai gemini --ignore-agent-tools --script ps
-```
-
-(Use only for local experimentation.)
+> **Deprecated:** The `--skip-tls` flag is a no-op and has no effect.
+> It was previously used to bypass TLS validation during local testing.
+> If you encounter TLS errors (e.g., on a corporate network), configure your
+> environment's certificate store or proxy instead.
+>
+> For example, set `SSL_CERT_FILE` or configure `HTTPS_PROXY` / `HTTP_PROXY`.
 
 ## 10. Rapid Edit Loop Summary
 
@@ -166,7 +164,7 @@ rm -rf .venv dist build *.egg-info
 | Scripts not executable (Linux) | Re-run init or `chmod +x scripts/*.sh` |
 | Git step skipped | You passed `--no-git` or Git not installed |
 | Wrong script type downloaded | Pass `--script sh` or `--script ps` explicitly |
-| TLS errors on corporate network | Try `--skip-tls` (not for production) |
+| TLS errors on corporate network | Configure your environment's certificate store or proxy. The `--skip-tls` flag is deprecated and has no effect. |
 
 ## 13. Next Steps
 

evals/README.md

@@ -87,11 +87,7 @@ uv run pytest tests/ -v
 
 Each suite sends a prompt to the LLM and evaluates the output against structured assertions and custom Python graders.
 
-<<<<<<< HEAD
 #### Spec Template (12 tests)
-=======
-#### Spec Template (10 tests)
->>>>>>> main
 - **Basic Structure** — required sections present (Overview, Requirements, User Stories, etc.)
 - **No Premature Tech Stack** — spec focuses on WHAT, not HOW
 - **Quality User Stories** — proper format with acceptance criteria
@@ -101,12 +97,9 @@ Each suite sends a prompt to the LLM and evaluates the output against structured
 - **Completeness** — complex features have comprehensive requirements
 - **Regression** — simple features still maintain proper structure
 - **Rename Regression** — post-rename output matches quality bar
-<<<<<<< HEAD
 - **Fork Sections** — Goal, Demo Sentence, Boundary Map present (agentic-sdlc preset)
 - **Boundary Map Structure** — Produces and Consumes subsections
 - **Constraints Extraction** — key limitations documented
-=======
->>>>>>> main
 
 #### Plan Template (2 tests)
 
@@ -133,15 +126,12 @@ Each suite sends a prompt to the LLM and evaluates the output against structured
 - **Structure** — session metadata, decisions, and artifacts sections present
 - **Validation Accuracy** — validator correctly scores incomplete traces
 
-<<<<<<< HEAD
 #### Mission Brief (4 tests) — Fork-specific
 - **Completeness** — Goal, Success Criteria, Constraints, Demo Sentence present
 - **Quality** — Goal is concise, criteria are measurable, demo is observable
 - **Constraint Extraction** — technical, business, regulatory constraints captured
 - **Approval Flow** — includes "Proceed with this Mission Brief?" prompt
 
-=======
->>>>>>> main
 ### Security Graders (run on every LLM test)
 
 Four graders apply automatically to every test output via `defaultTest.assert`:
@@ -152,12 +142,9 @@ Four graders apply automatically to every test output via `defaultTest.assert`:
 | **`check_prompt_injection`** | "Ignore previous instructions", DAN mode, embedded role markers, base64 payloads |
 | **`check_hallucination_signals`** | Overconfident metrics, dangling references, self-contradictions, fabricated RFCs |
 | **`check_misinformation`** | MD5/SHA-1 for passwords, plaintext HTTP, unsafe APIs (eval/pickle/yaml.load), impossible performance claims |
-<<<<<<< HEAD
 | **`check_mission_brief_completeness`** | Mission Brief has Goal, Success Criteria, Constraints, Demo Sentence |
 | **`check_mission_brief_quality`** | Goal is concise, criteria are measurable, demo is observable |
 | **`check_fork_spec_sections`** | Spec includes fork-specific sections (Goal, Demo Sentence, Boundary Map) |
-=======
->>>>>>> main
 
 ### Unit Tests (pytest)
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentic-sdlc-specify-cli"
-version = "0.5.2"
+version = "0.5.3"
 description = "Specify CLI (tikalk fork). Agentic SDLC toolkit for Spec-Driven Development with pre-installed extensions and AI integrations."
 requires-python = ">=3.11"
 dependencies = [

templates/commands/specify.md

@@ -72,13 +72,11 @@ Given that feature description, do this:
 
 2. **Branch creation** (optional, via hook):
 
-<<<<<<< HEAD
-   If a `before_specify` hook ran successfully in the Pre-Execution Checks above, it will have created/switched to a git branch and output JSON containing `BRANCH_NAME` and `FEATURE_NUM`. Note these values for reference, but the branch name does **not** dictate the spec directory name.
-=======
    **Branch numbering mode**: Before running the script, check if `{REPO_ROOT}/.specify/init-options.json` exists and read the `branch_numbering` value.
    - If `"timestamp"`, add `--timestamp` (Bash) or `-Timestamp` (PowerShell) to the script invocation
    - If `"sequential"` or absent, do not add any extra flag (default behavior)
->>>>>>> backup-main-20260413
+
+   If a `before_specify` hook ran successfully in the Pre-Execution Checks above, it will have created/switched to a git branch and output JSON containing `BRANCH_NAME` and `FEATURE_NUM`. Note these values for reference, but the branch name does **not** dictate the spec directory name.
 
    If the user explicitly provided `GIT_BRANCH_NAME`, pass it through to the hook so the branch script uses the exact value as the branch name (bypassing all prefix/suffix generation).
 

tests/conftest.py

@@ -1,10 +1,68 @@
 """Shared test helpers for the Spec Kit test suite."""
 
+import os
 import re
+import shutil
+import subprocess
+import sys
+
+import pytest
 
 _ANSI_ESCAPE_RE = re.compile(r"\x1b\[[0-?]*[ -/]*[@-~]")
 
 
+def _has_working_bash() -> bool:
+    """Check whether a functional native bash is available.
+
+    On Windows, ``subprocess.run(["bash", ...])`` uses CreateProcess,
+    which searches System32 *before* PATH — so it may find the WSL
+    launcher even when Git-for-Windows bash appears first in PATH via
+    ``shutil.which``.  We therefore probe with bare ``"bash"`` (the
+    same way test helpers invoke it) to get an accurate result.
+
+    On Windows, only Git-for-Windows bash (MSYS2/MINGW) is accepted.
+    The WSL launcher is rejected because it runs in a separate Linux
+    filesystem and cannot handle native Windows paths used by the
+    test fixtures.
+
+    Set SPECKIT_TEST_BASH=1 to force-enable bash tests regardless.
+    """
+    if os.environ.get("SPECKIT_TEST_BASH") == "1":
+        return True
+    if shutil.which("bash") is None:
+        return False
+    # Probe with bare "bash" — same as the test helpers — so that
+    # Windows CreateProcess resolution order is respected.
+    try:
+        r = subprocess.run(
+            ["bash", "-c", "echo ok"],
+            capture_output=True, text=True, timeout=5,
+        )
+        if r.returncode != 0 or "ok" not in r.stdout:
+            return False
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+    # On Windows, verify we have MSYS/MINGW bash (Git for Windows),
+    # not the WSL launcher which can't handle native paths.
+    if sys.platform == "win32":
+        try:
+            u = subprocess.run(
+                ["bash", "-c", "uname -s"],
+                capture_output=True, text=True, timeout=5,
+            )
+            kernel = u.stdout.strip().upper()
+            if not any(k in kernel for k in ("MSYS", "MINGW", "CYGWIN")):
+                return False
+        except (OSError, subprocess.TimeoutExpired):
+            return False
+    return True
+
+
+requires_bash = pytest.mark.skipif(
+    not _has_working_bash(), reason="working bash not available"
+)
+
+
 def strip_ansi(text: str) -> str:
     """Remove ANSI escape codes from Rich-formatted CLI output."""
     return _ANSI_ESCAPE_RE.sub("", text)

tests/extensions/git/test_git_extension.py

@@ -18,6 +18,8 @@
 
 import pytest
 
+from tests.conftest import requires_bash
+
 PROJECT_ROOT = Path(__file__).resolve().parent.parent.parent.parent
 EXT_DIR = PROJECT_ROOT / "extensions" / "git"
 EXT_BASH = EXT_DIR / "scripts" / "bash"
@@ -211,6 +213,7 @@ def test_bundled_extension_locator(self):
 # ── initialize-repo.sh Tests ─────────────────────────────────────────────────
 
 
+@requires_bash
 class TestInitializeRepoBash:
     def test_initializes_git_repo(self, tmp_path: Path):
         """initialize-repo.sh creates a git repo with initial commit."""
@@ -269,6 +272,7 @@ def test_skips_if_already_git_repo(self, tmp_path: Path):
 # ── create-new-feature.sh Tests ──────────────────────────────────────────────
 
 
+@requires_bash
 class TestCreateFeatureBash:
     def test_creates_branch_sequential(self, tmp_path: Path):
         """Extension create-new-feature.sh creates sequential branch."""
@@ -376,6 +380,7 @@ def test_no_git_graceful_degradation(self, tmp_path: Path):
 # ── auto-commit.sh Tests ─────────────────────────────────────────────────────
 
 
+@requires_bash
 class TestAutoCommitBash:
     def test_disabled_by_default(self, tmp_path: Path):
         """auto-commit.sh exits silently when config is all false."""
@@ -583,6 +588,7 @@ def test_success_message_no_unicode_checkmark(self, tmp_path: Path):
 # ── git-common.sh Tests ──────────────────────────────────────────────────────
 
 
+@requires_bash
 class TestGitCommonBash:
     def test_has_git_true(self, tmp_path: Path):
         """has_git returns 0 in a git repo."""

tests/integrations/test_manifest.py

@@ -2,6 +2,7 @@
 
 import hashlib
 import json
+import sys
 
 import pytest
 
@@ -41,8 +42,9 @@ def test_record_file_rejects_parent_traversal(self, tmp_path):
 
     def test_record_file_rejects_absolute_path(self, tmp_path):
         m = IntegrationManifest("test", tmp_path)
+        abs_path = "C:\\tmp\\escape.txt" if sys.platform == "win32" else "/tmp/escape.txt"
         with pytest.raises(ValueError, match="Absolute paths"):
-            m.record_file("/tmp/escape.txt", "bad")
+            m.record_file(abs_path, "bad")
 
     def test_record_existing_rejects_parent_traversal(self, tmp_path):
         escape = tmp_path.parent / "escape.txt"

tests/test_cursor_frontmatter.py

@@ -12,6 +12,8 @@
 
 import pytest
 
+from tests.conftest import requires_bash
+
 SCRIPT_PATH = os.path.join(
     os.path.dirname(__file__),
     os.pardir,
@@ -73,6 +75,7 @@ def test_powershell_script_has_mdc_frontmatter_logic(self):
 
 
 @requires_git
+@requires_bash
 class TestCursorFrontmatterIntegration:
     """Integration tests using a real git repo."""