fix(archive): make the scenario-drift check fence-aware, plus release-audit follow-ups

.changeset/add-codearts-tool.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": minor
+---
+
+Add CodeArts Agent skills support: `openspec init --tools codeartsagent` installs the workflow skills.

.changeset/add-hermes-tool.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": minor
+---
+
+Add Hermes Agent as a supported AI tool: `openspec init --tools hermes` installs the workflow skills (Hermes is skills-only and invokes them directly).

.changeset/add-zcode-tool.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": minor
+---
+
+Add ZCode as a supported AI tool: `openspec init --tools zcode` generates its skills and `/opsx:*` commands.

.changeset/avoid-npx-profile-changes.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Apply profile changes with the installed CLI instead of shelling out to `npx`, which could run a different version.

.changeset/bom-delta-parsing.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Delta and main-spec parsers strip a UTF-8 BOM, so files saved by Windows editors or PowerShell redirects no longer fail with "No delta sections found".

.changeset/change-name-length.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+`openspec new change` rejects names over 200 characters with a validation message instead of surfacing a raw ENAMETOOLONG filesystem error.

.changeset/codex-skills-only.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": minor
+---
+
+Codex is now skills-only: workflows install as `$openspec-*` skills and previously managed custom prompts are retired (existing ones are cleaned up on update).

.changeset/doctor-store-drift.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+`openspec doctor` now notes when a store checkout is behind its upstream ref.

.changeset/drift-check-multiplicity.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Make the archive scenario-drift check multiplicity-aware: a MODIFIED block that keeps only one of two same-named scenarios no longer silently drops the other.

.changeset/feedback-manual-fallback.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+`openspec feedback` shows the formatted text and a pre-filled submission URL on any gh failure (issues disabled, network, rate limit), not only when gh is missing or unauthenticated.

.changeset/fence-aware-drift-check.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+The archive scenario-drift check now ignores `#### Scenario:` lines inside fenced code blocks, matching validate: a fenced example no longer false-aborts an archive, and a fenced name no longer masks a genuinely dropped scenario.

.changeset/gemini-toml-escaping.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Gemini command files escape TOML-active characters (quotes, backslashes, control characters) in the description and prompt, so a template value containing them can no longer produce an invalid `.toml` file.

.changeset/kimi-cli-to-kimi-code.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Follow the Kimi CLI rename to Kimi Code: new install paths with automatic migration of existing `.kimi` setups.

.changeset/local-dates-cli.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Use local dates for CLI date-only values (archive names, timestamps) instead of UTC, so late-evening archives no longer get tomorrow's date.

.changeset/missing-core-workflows-warning.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+`openspec update` warns when a custom profile is missing core workflows instead of silently generating a partial install.

.changeset/modified-noop-counting.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Archive treats a MODIFIED delta whose content already matches the main spec as a no-op: a fully early-synced change now reports "Specs already in sync" instead of rewriting the file and claiming modifications.

.changeset/multiselect-checkbox-markers.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Render multi-select prompts with `[x]`/`[ ]` checkbox markers instead of radio-button icons.

.changeset/nested-spec-discovery.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Discover nested spec paths like `specs/<area>/<capability>/spec.md` recursively and consistently across parse, apply, and archive.

.changeset/renamed-near-miss-guard.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+An already-synced RENAMED delta aborts when a case/whitespace variant of the source requirement still exists — the same typo guard REMOVED deltas have.

.changeset/resolve-open-questions.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Proposal guidance now resolves blocking open questions with the user instead of deferring them to design.md.

.changeset/skills-sh-distribution.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": minor
+---
+
+Publish the workflow skills as static `skills/<name>/SKILL.md` files so `npx skills add Fission-AI/OpenSpec` works.

.changeset/spec-content-guidance.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Specs instructions include the spec content guidance from the concepts docs, so generated specs follow the requirement/scenario format.

.changeset/static-welcome-waits.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+The static welcome screen (reduced motion, `--no-animation`, narrow terminals) now waits for the Enter it asks for instead of letting the keystroke submit the tool picker unseen.

.changeset/store-aware-main-specs.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Sync and archive workflows resolve main specs through the store-aware root instead of assuming `openspec/specs` in the repo.

.changeset/symlinked-schema-dirs.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": minor
+---
+
+Resolve symlinked schema directories so schemas shared via symlink (e.g. from a dotfiles repo) are discovered.

.changeset/update-check-detection-hardening.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+The stale-CLI check hardens its install detection: a directory merely named `volta` no longer changes the upgrade hint, the Windows npm-ownership check corroborates against the `openspec.cmd` shim npm actually writes, and a registry redirect from https to plain http is no longer followed.

.changeset/update-check-redirect-teardown.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+The stale-CLI check tears down a redirected registry connection when its time budget expires instead of leaving the socket open.

.changeset/update-zero-artifact-notice.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+`openspec update` with `delivery: commands` prints the same configuration correction as init when it removes the skills of a tool that supports only skills, instead of deleting them silently.

.changeset/validator-unreadable-specs.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+`openspec validate` reports an unreadable specs/ directory as the error it is instead of misdiagnosing it as "no deltas found".

.changeset/windows-welcome-input.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+Preserve keyboard input on Windows after the welcome screen instead of dropping the first keystrokes.

.changeset/zsh-completions-custom-omz.md

@@ -0,0 +1,5 @@
+---
+"@fission-ai/openspec": patch
+---
+
+zsh completion install honors `$ZSH` and `$ZSH_CUSTOM`, so Oh My Zsh setups at custom locations get the completion where their shell actually loads it.

src/commands/feedback.ts

@@ -131,16 +131,26 @@ function isMissingLabelError(error: any): boolean {
 }
 
 /**
- * Report a gh CLI failure and exit, preserving gh's exit code
+ * Report a gh CLI failure and exit, preserving gh's exit code.
+ *
+ * gh failed after the user already typed their feedback (issues disabled,
+ * network, rate limit, ...), so show the same manual-submission path the
+ * missing-gh and unauthenticated flows get instead of discarding the text.
  */
-function reportGhFailure(error: any): void {
+function reportGhFailure(error: any, title: string, body: string): void {
   // Display the error output from gh CLI
   if (error.stderr) {
     console.error(error.stderr.toString());
   } else if (error.message) {
     console.error(error.message);
   }
 
+  displayFormattedFeedback(title, body);
+
+  const manualUrl = generateManualSubmissionUrl(title, body);
+  console.log('Please submit your feedback manually:');
+  console.log(manualUrl);
+
   // Exit with the same code as gh CLI
   process.exit(error.status ?? 1);
 }
@@ -181,7 +191,7 @@ function submitViaGhCli(title: string, body: string): void {
     issueUrl = createIssue(title, body, ['feedback']);
   } catch (error: any) {
     if (!isMissingLabelError(error)) {
-      reportGhFailure(error);
+      reportGhFailure(error, title, body);
       return;
     }
 
@@ -191,7 +201,7 @@ function submitViaGhCli(title: string, body: string): void {
       issueUrl = createIssue(title, body, []);
       labelApplied = false;
     } catch (retryError: any) {
-      reportGhFailure(retryError);
+      reportGhFailure(retryError, title, body);
       return;
     }
   }

src/core/command-generation/adapters/gemini.ts

@@ -7,6 +7,41 @@
 import path from 'path';
 import type { CommandContent, ToolCommandAdapter } from '../types.js';
 
+/**
+ * Control characters (C0 except tab/newline/carriage return, plus DEL) are
+ * invalid inside TOML strings and must be written as escapes.
+ */
+const TOML_CONTROL_CHARS = new RegExp('[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f]', 'g');
+
+/**
+ * TOML basic strings are escape-active: a backslash or double quote in the
+ * value breaks the file if written raw. Newlines cannot appear in a
+ * single-line basic string at all, so they are escaped too.
+ */
+function escapeTomlBasicString(value: string): string {
+  return value
+    .replace(/\\/g, '\\\\')
+    .replace(/"/g, '\\"')
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replace(/\t/g, '\\t')
+    .replace(TOML_CONTROL_CHARS, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+
+/**
+ * Multiline basic strings keep raw newlines and tabs, but backslashes are
+ * still escape-active, any run of three quotes would end the string, and the
+ * same control characters are invalid as in single-line basic strings.
+ * Control chars are escaped last so their introduced backslashes are not
+ * re-doubled.
+ */
+function escapeTomlMultilineBasicString(value: string): string {
+  return value
+    .replace(/\\/g, '\\\\')
+    .replace(/"""/g, '""\\"')
+    .replace(TOML_CONTROL_CHARS, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+
 /**
  * Gemini adapter for command generation.
  * File path: .gemini/commands/opsx/<id>.toml
@@ -20,10 +55,10 @@ export const geminiAdapter: ToolCommandAdapter = {
   },
 
   formatFile(content: CommandContent): string {
-    return `description = "${content.description}"
+    return `description = "${escapeTomlBasicString(content.description)}"
 
 prompt = """
-${content.body}
+${escapeTomlMultilineBasicString(content.body)}
 """
 `;
   },

src/core/command-generation/adapters/index.ts

@@ -31,3 +31,4 @@ export { lingmaAdapter } from './lingma.js';
 export { qwenAdapter } from './qwen.js';
 export { roocodeAdapter } from './roocode.js';
 export { traeAdapter } from './trae.js';
+export { zcodeAdapter } from './zcode.js';

src/core/completions/command-registry.ts

@@ -184,7 +184,7 @@ export const COMMAND_REGISTRY: CommandDefinition[] = [
   },
   {
     name: 'instructions',
-    description: 'Output enriched instructions for creating an artifact or applying tasks',
+    description: 'Output enriched instructions for artifacts, apply, or archive',
     acceptsPositional: true,
     positionals: [{ name: 'artifact', optional: true }],
     flags: [

src/core/completions/installers/zsh-installer.ts

@@ -35,16 +35,29 @@ export class ZshInstaller {
     }
 
     // Fall back to checking for ~/.oh-my-zsh directory
-    const ohMyZshPath = path.join(this.homeDir, '.oh-my-zsh');
-
     try {
-      const stat = await fs.stat(ohMyZshPath);
+      const stat = await fs.stat(this.ohMyZshRoot());
       return stat.isDirectory();
     } catch {
       return false;
     }
   }
 
+  /**
+   * Oh My Zsh exports its root as $ZSH; honor a custom location, or the
+   * completion lands in a ~/.oh-my-zsh tree that nothing ever loads.
+   */
+  private ohMyZshRoot(): string {
+    return process.env.ZSH || path.join(this.homeDir, '.oh-my-zsh');
+  }
+
+  /**
+   * The custom dir is separately relocatable via $ZSH_CUSTOM.
+   */
+  private ohMyZshCustomDir(): string {
+    return process.env.ZSH_CUSTOM || path.join(this.ohMyZshRoot(), 'custom');
+  }
+
   /**
    * Get the appropriate installation path for the completion script
    *
@@ -56,7 +69,7 @@ export class ZshInstaller {
     if (isOhMyZsh) {
       // Oh My Zsh custom completions directory
       return {
-        path: path.join(this.homeDir, '.oh-my-zsh', 'custom', 'completions', '_openspec'),
+        path: path.join(this.ohMyZshCustomDir(), 'completions', '_openspec'),
         isOhMyZsh: true,
       };
     } else {
@@ -327,10 +340,14 @@ export class ZshInstaller {
    * @returns Array of guidance strings, or undefined if not needed
    */
   private generateOhMyZshFpathGuidance(completionsDir: string): string[] | undefined {
+    // One fpath entry per line, matched as a literal: a relocated $ZSH_CUSTOM
+    // need not contain "custom/completions", and the path may hold characters
+    // grep would otherwise read as a pattern. Single-quoted for the shell.
+    const quotedDir = `'${completionsDir.replace(/'/g, `'\\''`)}'`;
     return [
       'Note: Oh My Zsh typically auto-loads completions from custom/completions.',
       `Verify that ${completionsDir} is in your fpath by running:`,
-      '  echo $fpath | grep "custom/completions"',
+      `  printf '%s\\n' $fpath | grep -F ${quotedDir}`,
       '',
       'If not found, completions may not work. Restart your shell to ensure changes take effect.',
     ];

src/core/parsers/markdown-parser.ts

@@ -21,7 +21,8 @@ export class MarkdownParser {
   }
 
   protected static normalizeContent(content: string): string {
-    return content.replace(/\r\n?/g, '\n');
+    // Strip a UTF-8 BOM so a header on the first line still matches.
+    return content.replace(/^/, '').replace(/\r\n?/g, '\n');
   }
 
   parseSpec(name: string): Spec {

src/core/parsers/requirement-blocks.ts

@@ -141,7 +141,9 @@ export interface DeltaPlan {
 }
 
 function normalizeLineEndings(content: string): string {
-  return content.replace(/\r\n?/g, '\n');
+  // Strip a UTF-8 BOM: Windows editors and PowerShell redirects prepend one,
+  // and it would keep the first line's `## ADDED Requirements` from matching.
+  return content.replace(/^/, '').replace(/\r\n?/g, '\n');
 }
 
 /**