SpecBridge v0.7.0: reusable spec templates and template scaffolding#8
Merged
Conversation
SpecBridge v0.7.0: secure, deterministic, offline-first templates for
Kiro-compatible specs.
- Versioned template manifest (specbridge-template.json, schema 1.0.0)
with strict validation and stable error codes SBT001-SBT025
- Restricted one-pass {{variable}} renderer: no code execution, no
expressions, no environment access, no network, no recursion
- Ten built-in templates embedded at build time; project-local packs
under .specbridge/templates with atomic script-free local install
- template list/search/show/validate/preview/apply/install/uninstall/
scaffold CLI, spec new --template, append-only template records
- MCP template_list/search/show/preview plus candidate-hash-bound
template_apply; /specbridge:templates plugin skill (10 skills total)
- Generated template gallery and embedded-pack module with CI drift
checks; template documentation set and threat model
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
SpecBridge v0.7.0: a secure, deterministic, offline-first template system for Kiro-compatible specs — reusable spec templates without executable generators or platform lock-in.
@specbridge/templates: versioned manifest (specbridge-template.json, schema 1.0.0, strict — unknown fields rejected), restricted one-pass{{variable}}renderer (values inserted verbatim, never re-scanned), typed variables (string/boolean/integer/enum with constraints and a restricted safe-regex subset), pack security (symlink/traversal/UTF-8/binary rejection, bounded sizes), catalog with explicit ambiguity (SBT002) instead of silent source shadowing, deterministic tiered search, append-only operation records (variable names and hashes, never values), and stable error codes SBT001-SBT025 with remediation in every message.rest-api,cli-tool,database-migration,authentication,background-job,event-driven-service,bugfix-regression,performance-optimization,security-hardening,refactoring) as contributor-editable packs underpackages/templates/builtins/, embedded at build time into a committed generated module so every bundle (CLI, MCP standalone, Claude Code plugin) ships the catalog. Each applies end to end and passes the deterministic spec analyzers.template list/search/show/validate/preview/apply/install/uninstall/scaffoldplusspec new --template <ref> --var k=vdelegating to the same application service (non-templatespec newunchanged). Preview andapply --dry-runshare the exact rendering path with apply and write nothing.template_list/search/show/preview(read-only) andtemplate_apply(re-renders, compares the previewedcandidateHash, requires the literalapply-reviewed-templateacknowledgement). Install/uninstall/scaffold stay deliberately CLI-only. Tool count 25 -> 30./specbridge:templates(preview-first, hash-bound apply, explicit confirmation; never installs, never edits.kiro/.specbridge). Isolated-bundle verification extended to 11 checks including template list and read-only preview outside the monorepo.docs/templates.md) with CI drift checks (check:template-gallery,check:builtin-templates), README/CHANGELOG/roadmap/security/parity updates.Why
Optimized for individual developers, GitHub discoverability, community contributions, and low-friction adoption in existing Kiro projects. Templates are data, not code: no scripts, no shell, no environment access, no network, no remote registry. Applying a template goes through the existing atomic spec-creation path; generated stages start unapproved, existing specs are never overwritten, and no template metadata ever enters
.kiro.Reviewer notes
spec new --template, and both MCP tools (planTemplateApplicationinpackages/templates/src/apply-service.ts).packages/workflow/src/create-spec.ts(planSpecCreationFromFiles—planSpecCreationnow delegates to it), one newSpecBridgeErrorcode (TEMPLATE_ERROR), and its SBMCP002 mapping in the MCP error envelope.pnpm generate:builtin-templatesrefreshes the embedded module andtests/templates/builtin-packs.test.tsgates every pack from disk (manifest, render-check, e2e apply + analyzers, no vendor lock-in). Contributing a built-in requires no TypeScript.Verification
pnpm lint,pnpm typecheck,pnpm build,pnpm build:plugin,pnpm validate:plugin(10 skills, versions 0.7.0),pnpm verify:plugin-bundle(all 11 checks),pnpm check:builtin-templates,pnpm check:template-gallery,node scripts/smoke.mjs(34 checks) — all green on Windows.