$ show github/spec-kit
This repository is the source of specify-cli, the flagship Python CLI of Spec Kit. In production it is a Typer-based developer tool that bootstraps projects for Spec-Driven Development: `specify init` scaffolds a `.specify/` structure, installs shared bash/PowerShell/Python helper scripts, and generates agent command/skill files into 37+ AI coding-tool directories (Claude, Copilot, Codex, Gemini, Cursor, Grok, Qwen, Tabnine, Goose, and more). Beyond scaffolding, the tool manages a layered ecosystem of extensions, presets, bundles, and YAML-defined workflows, plus a self-upgrade path that detects uv/pipx/uvx installations and pulls releases from the GitHub API.
The LLM identified 6 files worth highlighting for reuse:
Standalone stdlib module for bounded, HTTPS-enforced HTTP reads and preflight-validated ZIP/TAR extraction. It rejects path traversal, symlink escapes, ZIP64, unsupported compression, oversized archives, and excessive entry counts before the archive object is even constructed. This is a directly extractable, security-critical utility for any Python tool that ingests remote archives.
Sandboxed Jinja2-like expression evaluator supporting custom filters (default, join, map, contains, from_json), quote-aware tokenization, and numeric coercion without executing arbitrary Python. It solves the recurring problem of safely evaluating user-defined conditions in config-driven automation and can be lifted into any project needing a constrained expression DSL instead of eval().
Layered YAML overlay merge engine that composes edit sets (insert_after, replace, remove, priority) over a base document with attribution tracking and ancestor/descendant conflict detection. The non-obvious conflict-resolution and id-collision logic is a reusable pattern for any system that needs user customizations layered on top of shipped config files.
IntegrationManifest records installed files by SHA-256 hash, enabling idempotent installation, modified-file detection, stale cleanup, recovery detection, and safe uninstall with rollback. This is an extractable pattern for any tool that installs templates or scripts into user workspaces and must upgrade or remove them without clobbering user edits.
Path-confined YAML/JSON loading and dumping with symlink checks, atomic staged writes that preserve file mode/ownership, and all errors normalized into a single domain exception. The containment-plus-atomic-write combination is a robust, reusable I/O layer for CLIs that read untrusted YAML/JSON from disk or project overlays.
Config-driven open_url/build_request helpers that resolve bearer/PAT tokens from a JSON auth store, enforce HTTPS, and strip credentials on cross-origin redirects. The redirect-aware credential stripping is a subtle, reusable secure-HTTP-client pattern for tools that talk to multiple hosts with per-host credentials.