feat(cli): wrap config, completion, and feedback

[replygirl]

Why

openspec-1-11-parity closed every everyday OpenSpec surface except three, and
named them in its own Non-Goals: config, completion, and feedback. Until
they are wrapped, the standing rule — never call bare openspec — is
unenforceable in practice: a user who wants to inspect the machine-global
config, install shell completion, or file a bug has no cospec command to reach
for.

The gap is not only cosmetic. cospec's WRAPPED_ENV forces
OPENSPEC_TELEMETRY=0 and OPENSPEC_NO_COMPLETIONS=1 on every wrapped call,
and cospec generates its harness files from cospec canon rather than from
OpenSpec's profile/workflows/delivery keys — so several global config keys
are genuinely misleading when read through a cospec repo, and nothing told the
user so. defaultStore is a key cospec already reads during root resolution
but offered no way to set.

Each surface got its own decision rather than one blanket treatment, because
each one fails differently.

config — a disciplined passthrough that deliberately skips the shared helper

cospec config <path|list|get|set|unset|reset|edit|profile> wraps
openspec config, and it is the one passthrough command that does not route
through core/passthrough-command.ts. Every one of that helper's three
unconditional appends is wrong here:

• --store is not a config option at all — upstream declares a parent-level
  --scope, and OpenSpec config is machine-global, so resolveRoot and
  root.storeArgs never apply. cospec config --store <id> is refused with
  exit 1 and a named message rather than absorbed and ignored.
• --json exists on list alone.
• A trailing --no-color turned out to be accepted (commander resolves the
  program-level flag from a leaf), so it is merely redundant — cospec's spawn
  already prefixes one, so config never appends a second.

Adding three opt-outs to a helper that serves eight happy callers would make it
harder to reason about, so commands/config.ts gets a local, pure argv builder,
the way commands/workset.ts already does. --scope is hoisted to sit between
config and the subcommand, where upstream expects it.

The surface splits into two call classes:

• Class A (path, list, get, set, unset, reset --all -y,
  profile <preset>) is a piped passthroughOpenspec call with
  expect.exitCodes = [0, 1], because upstream uses exit 1 for ordinary
  negative results (a missing key) that are results to relay, not wrapped-call
  violations.
• Class B (edit, bare profile, reset --all without -y) is a terminal
  handover — inherited stdio, shell: false, verbatim child exit code including
  130 on cancellation. Upstream spawns $EDITOR and runs @inquirer menus,
  which cannot survive cospec's piped stdin: 'ignore' spawn. This turns
  workset open's one-off into a named class with a fixed contract, documented
  in docs/architecture.md and specified in openspec-read-passthroughs.

The one-JSON-document invariant holds on every subcommand, not just the one
upstream supports. list --json is a verbatim relay; path/get/set/
unset/reset get cospec-owned version: 1 envelopes built from the text run;
--json against a Class B subcommand is refused with an envelope and exit 1
rather than faked. The version: 1 stamp is what makes switching to a relayed
upstream document later a version bump instead of a silent shape change.

Config precedence vs cospec's forced env keys

Where cospec's own behaviour outranks the key just written, cospec says so — on
stderr, so --json stdout stays exactly one document:

• config set telemetry.enabled … → a note that cospec forces
  OPENSPEC_TELEMETRY=0 in WRAPPED_ENV on every wrapped call, so the setting
  affects bare openspec runs only. WRAPPED_ENV is unchanged by this PR; the
  note is the disclosure, not a new escape hatch.
• config profile <preset> and config set profile|workflows|delivery → a note
  that cospec's harness files come from cospec canon via cospec update, not
  openspec update (which is exactly what upstream's own success line tells you
  to run).

defaultStore gets no note, because cospec genuinely honours it — as a
fallback strictly below local-root resolution. Verified end to end in the
ledger: with defaultStore set, a bare directory resolves against the named
store; a directory with a local openspec/ still wins; unset falls back to the
local cwd; a stale defaultStore fails loudly rather than silently falling
through. Every other key is annotated for nothing.

completion — native, not passed through

cospec completion [bash|zsh|fish] is generated from cospec's own exported
COMMANDS table and GLOBAL_OPTIONS, printed to stdout, with no filesystem
writes and no rc-file mutation. Shell is auto-detected from $SHELL when
omitted.

Passing upstream's generator through was rejected on principle: its installer
writes a completion function for the openspec binary into the user's shell
rc, whose dynamic completions shell out to bare openspec — a permanent
instruction in a dotfile to do the one thing this repo forbids, which no printed
warning undoes. cospec already owns a complete static command table, so
generating from it is both cheaper and more accurate.

A hidden cospec __complete <changes|specs|types> serves the dynamic slots,
emitting tab-separated id/description lines and exiting 1 silently on both
streams on any failure — a Tab press that prints an error into the middle of a
command line is worse than one that completes nothing. types is served from
COSPEC_TYPES with no wrapped spawn at all.

The fragile part is extracting per-command flags from each entry's
pre-formatted help string, so that extraction is a pure function with a snapshot
test over the real table: a new command or flag the extractor cannot see turns
red in CI instead of quietly vanishing from completion.

feedback — files on aligned-team/cospec, --upstream relays

cospec feedback "<message>" [--body <text>] files at aligned-team/cospec via
gh issue create with array argv, shell: false, and no --label. Defaulting
to Fission-AI/OpenSpec would route cospec bug reports to a project that cannot
fix them and did not ask for them; excluding the surface would leave an
openspec command unanswered.

The native path follows upstream's shape — grapheme-aware 72-char title
truncation, gh presence and gh auth status gates, a manual-submission
fallback that prints the formatted issue plus a prefilled URL and exits 0 —
minus --label, whose only purpose upstream is to be retried when the repo
doesn't define the label. Dropping the flag deletes the whole failure mode. The
provenance footer names the cospec version plus the resolved wrapped-OpenSpec
source and version.

cospec feedback --upstream relays the wrapped openspec feedback verbatim
with the destination named on stderr. It uses a raw version-asserted spawn
rather than passthroughOpenspec, because upstream exits with gh's own
arbitrary status, which no expect.exitCodes allow-list can enumerate honestly
— that exception is stated in the spec rather than hidden.

Review outcome

e981e3d corrected a claim this change had been carrying as folklore. The
proposal originally asserted that upstream rejects a trailing --no-color on
every leaf but show, and used that as the reason config skips the shared
helper. Probed against the real pinned binary, it is accepted everywhere —
config's subcommands, schemas, and templates all take it. So the reason
was rewritten to what is true (it is redundant, not fatal — --store and
--json are the fatal ones), contract rows were added as the regression guard
should upstream ever change, and no follow-up fix change was proposed for a
hazard that does not exist. The same commit strengthened two tests that would
have passed without proving their claim.

The ledger pass made three further corrections rather than checking off text
that did not match what shipped: upstream prints nothing at all on a config get miss (not a message); the standalone bundling probe is feedback --json,
not feedback --help (cli.ts answers --help from the static table before it
consults COMMAND_MODULES, so --help would pass even with the module
dropped); and openspec schemas does emit --json, so omitting a schemas
completion source rests on there being no cospec slot to fill — cospec schema's
first positional is a verb — rather than on parsing fragility.

Tests

• Unit — config-args (35: --scope hoisting, no --store/--no-color
  across all eight subcommands with a signature proof that the builder takes no
  root at all, --json only on list, the Class A/B split, the note selector),
  feedback-format (19: grapheme-aware truncation, array argv, the two
  hardcoded destinations), completions (18: flag extraction plus a snapshot
  over the real COMMANDS table), complete-types (spawn-free).
• Contract, against the real pinned 1.11.0 binary with XDG_CONFIG_HOME
  and HOME sandboxed into a temp dir — config-surface.test.ts (15) pins
  the trailing---no-color acceptance (with a control row proving it isn't
  special-cased), the --json-on-list-only shape, the --store rejection,
  --scope global vs upstream's own not-implemented error, and both handover
  cases.
• Integration — config (19), completion (16), feedback (10). Every
  gh row stubs gh on PATH; no test touches the network.
• Packaging — pack-standalone.test.ts runs config path,
  completion zsh, and feedback --json from the compiled binary with no
  node_modules, guarding the literal-import() bundling trap that silently
  drops a command module.
• Docs and harness — docs:build, generate:check, agents:check all
  green; .codex/rules/cospec.rules gains the five read-only prefixes
  (config get|list|path, completion, __complete) and none of the mutating
  ones, for the same reason archive is already omitted.

Ledger: 29/33 rows verified, 4 deferred, 0 unresolved. Deferrals are 2.4 and
4.4 (need a real TTY and a human at the keyboard), 6.5 (would file a real public
issue), and 7.3 (@eval, advisory-only, no DEEPSEEK_API_KEY). Row 4.2 records
that its fish --no-execute leg did not run — fish is installed neither
locally nor in CI — while bash -n and zsh -n both pass.

Non-goals

• init/update stay cospec-native. Passing them through would write the
  opsx files cospec's own leftover scan flags.
• completion install/uninstall. Rc-file mutation with backups, idempotency,
  and a matching uninstaller is the bulk of upstream's completion code; docs
  ship copy-paste one-liners instead.
• PowerShell completion.
• Project-local config scope — upstream exits 1 with "not yet implemented";
  cospec relays that verbatim and adds nothing.
• Re-implementing upstream's config key validation, value coercion, or its
  prototype-pollution guard. cospec never reads or writes
  ~/.config/openspec/config.json itself and grows no config file of its own.
• Changing WRAPPED_ENV, or changing core/passthrough-command.ts's trailing
  --no-color append.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.