[mnriem]

Description

Constrain feature paths loaded from .specify/feature.json to the project after resolving symbolic links and parent-directory components. External feature directories remain supported through an explicit SPECIFY_FEATURE_DIRECTORY override on every invocation.

Apply the same policy across Python, Bash, and PowerShell. Plan setup rejects symbolic-link destinations and creates new plans exclusively while preserving existing regular files. Update the shared reference and add cross-port regression coverage.

Testing

• Tested locally with uv run specify --help
• Ran existing tests with uv sync && uv run pytest
• Tested with a sample project (if applicable)

The full suite used this worktree's own interpreter, as recommended by CONTRIBUTING.md, instead of the literal generic uv run pytest command above.

• LC_ALL=en_US.UTF-8 .venv/bin/python -m pytest tests -q -n 4 - passed: 13,712 passed, 167 skipped, 63 warnings.
• uvx [email protected] check src tests - passed.
• uv run specify --help - passed.
• git diff --check - passed.

Sample-project coverage is automated through temporary project fixtures for Python, Bash, and the available PowerShell runtime. Windows PowerShell 5.1 cases are explicitly included but skipped on this macOS host; Windows PowerShell 5.1 runtime verification remains outstanding. No manual agent-driven process test is claimed.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (fill in the disclosure below)

AI disclosure: GitHub Copilot, powered by GPT-6.1 Sol (gpt-6.1-sol), autonomously generated the implementation, tests, documentation, commit, and PR body on behalf of @mnriem, following the user's approved path policy. Work occurred in an interactive session; reasoning effort was not explicitly specified. The initial read-only assessment used a security-review subagent whose model was not reported. Validation was automated; no human line-by-line review or manual testing is claimed.

[Copilot]

🟡 Changes recommended

A Windows parity assertion fails when directory symlink creation succeeds, while FIFO handling and PowerShell link-resolution defects can block execution or misdirect paths.

5 open issues

• Make outside-path symlink test platform-specific · New
• Reject existing FIFO and other non-regular plan destinations · New
• Bound total recursive link traversals · New
• Use case-sensitive path matching on non-Windows systems · New
• Handle non-link reparse directories without failing lookup · New

What changed in this PR

Hardens Spec Kit’s shared feature-path resolution and plan setup across Python, Bash, and PowerShell.

Changes:

• Restricts persisted feature paths to the project after resolving symbolic links and parent components; external paths require an explicit override on each invocation.
• Adds plan-destination link checks and exclusive-create handling while preserving existing regular plans.
• Documents the policy and expands cross-port regression coverage.

File	Description
tests/​test_setup_plan_python_parity.py	Adds containment, symlink, override, and Windows PowerShell cases.
scripts/​python/​setup_plan.py	Rejects plan symlinks and uses exclusive file creation.
scripts/​python/​common.py	Resolves and validates persisted feature-path containment.
scripts/​powershell/​setup-plan.ps1	Checks destination links and creates plans with CreateNew.
scripts/​powershell/​common.ps1	Adds component-wise path resolution and containment checks.
scripts/​bash/​setup-plan.sh	Adds symlink rejection and noclobber-based creation.
scripts/​bash/​common.sh	Resolves persisted paths and checks the project boundary.
docs/​reference/​core.md	Documents containment, external overrides, and plan protection.

_{Review effort: Max (auto)}

[mnriem]

Fixed in 10b557989ca821d0794e87b21e4cec24feaa4938: Bash now publishes completed plans atomically without opening existing destinations; PowerShell shares one 40-traversal budget, uses platform-correct name matching, and permits non-redirecting reparse directories while still validating links. The Windows-specific path assertion is corrected, and Python now propagates strict-resolution errors to fix the additional Windows link-loop failure. Added before-and-after regressions, including FIFO handling, exact traversal limits, and reparse-directory classification. The affected local suites passed (370 passed, 79 skipped), and all upstream checks passed, including all six full-suite matrix jobs and the Windows PowerShell 5.1 cases. On behalf of @mnriem, GitHub Copilot using GPT-6.1 Sol (gpt-6.1-sol) autonomously generated these code, test, documentation, and comment changes in an interactive session; reasoning effort was not explicitly specified. No human line-by-line review or manual testing is claimed.

[Copilot]

🟡 Changes recommended

A critical mixed-separator path handling flaw can bypass PowerShell containment checks, allowing plan setup to write outside the project without an override.

3 open issues

• Normalize mixed path separators before containment checks · New
• Detect case-insensitive plan symlinks before following them · New
• Use case-sensitive path matching on non-Windows systems

2 previously missed issues

In code that hasn't changed since last review

Preserve trailing newlines in resolved paths

scripts/​bash/​common.sh:181

Both readlink here and dirname at line 175 lose trailing newlines through command substitution. A valid path under a directory named feature\n then resolves to feature, causing setup to write the plan in a different directory. Preserve the target bytes when capturing readlink and remove parent components with parameter expansion.

AI-generated review for the requester: GitHub Copilot; model/reasoning settings unavailable; autonomous analysis and suggested fixes.

Allow non-redirecting cloud-backed plan files

scripts/​powershell/​setup-plan.ps1:47

An existing OneDrive/Cloud Files plan.md can have the ReparsePoint attribute without being a symbolic link. This blanket check rejects those regular plans instead of preserving them, even though the new directory resolver explicitly accommodates non-redirecting cloud placeholders. Distinguish redirecting links from cloud-backed files here too, and cover an existing cloud-backed plan in the preservation tests.

AI-generated review for the requester: GitHub Copilot; model/reasoning settings unavailable; autonomous analysis and suggested fixes.

4 resolved since last review

• Make outside-path symlink test platform-specific
• Handle non-link reparse directories without failing lookup
• Bound total recursive link traversals
• Reject existing FIFO and other non-regular plan destinations

_{Review effort: Max (auto)}

[mnriem]

Updated in 29e96d23de9f04445c109467d883e1cd17a1ac9e: PowerShell now resolves both path-separator styles before containment checks and probes the literal plan destination so filesystem aliases are recognized. Case-sensitive fallback matching remains in place for distinct siblings on non-Windows systems. A shared link classifier preserves non-redirecting cloud-backed plans while still rejecting symbolic links. Bash now preserves trailing newlines through feature metadata, symlink targets, and parent-component resolution. The new regressions and affected local suites passed (530 passed, 90 skipped); all upstream checks passed, including all six full-suite matrix jobs and the Windows PowerShell 5.1 cases. On behalf of @mnriem, GitHub Copilot using GPT-6.1 Sol (gpt-6.1-sol) autonomously generated these code, test, and comment changes in an interactive session; reasoning effort was not explicitly specified. No human line-by-line review or manual testing is claimed.

[Copilot]

🔵 Needs a closer look

Bash path validation rejects valid features when the project root is /, while outdated command-template guidance can leave downstream commands unable to locate external features.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Require external feature directory override for downstream commands

docs/​reference/​core.md:86

templates/commands/specify.md:99–106 still tells agents that persisting the selected feature path lets downstream commands locate it. For external directories, the new readers reject that value unless SPECIFY_FEATURE_DIRECTORY is supplied again, so following the template can leave /speckit.plan unable to find the feature. Update the command template to require the override on every downstream invocation for external directories, including paths through symlinks outside the project.

Trim root trailing slash before building physical feature paths

scripts/​bash/​common.sh:255

When the project root is /, $physical_root/ becomes //, so this condition rejects every descendant, such as /specs/001-feature, as outside the project. All Bash consumers of get_feature_paths then fail unless an explicit feature override is supplied. Trim the root's trailing slash before appending the separator, as the PowerShell implementation already does.

3 resolved since last review

• Normalize mixed path separators before containment checks
• Detect case-insensitive plan symlinks before following them
• Use case-sensitive path matching on non-Windows systems

_{Review effort: Max (auto)}