Files
OpenSpec/openspec/changes/add-skill-cli-auto-approval/tasks.md
T
Clay GoodandClaude Opus 4.8 a5bfedafc8 feat(skills): auto-approve the openspec CLI in generated skills and commands (#1300)
* feat(skills): auto-approve the openspec CLI in generated skills

Emit `allowed-tools: Bash(openspec:*)` in every generated SKILL.md so
agents that honor the Agent Skills standard run `openspec` commands
without prompting on each call. Scope is limited to the CLI; per the
standard `allowed-tools` pre-approves rather than restricts, so every
other tool a skill uses stays available under the user's normal
permission settings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(commands): auto-approve the openspec CLI in Claude slash commands

Extend the allowed-tools pre-approval to the second surface: Claude Code
/opsx:* slash commands share the skill frontmatter contract, so the
Claude command adapter now emits `allowed-tools: Bash(openspec:*)` too.
The value is single-sourced in `src/core/shared/allowed-tools.ts` (a
leaf module both surfaces import). Other command adapters are unchanged
— no other tool's slash-command format defines a per-command
pre-approval field; on the skills side every tool already gets the
standard field via generateSkillContent and non-implementing tools
ignore the unknown key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-07 16:31:00 +00:00

1.0 KiB

1. Implementation

  • 1.1 Add the shared OPENSPEC_CLI_ALLOWED_TOOLS = 'Bash(openspec:*)' constant (src/core/shared/allowed-tools.ts) and emit allowed-tools in the frontmatter built by generateSkillContent
  • 1.2 Emit the same allowed-tools field in the Claude command adapter's frontmatter (src/core/command-generation/adapters/claude.ts); other adapters unchanged — no other tool defines a per-command pre-approval field

2. Tests

  • 2.1 Regenerate the golden generated-content hashes in skill-templates-parity.test.ts
  • 2.2 Add a test asserting every deployed skill's generated content contains allowed-tools: Bash(openspec:*) (iterates the registry so new skills are covered)
  • 2.3 Assert the Claude adapter output contains the field (adapters.test.ts)
  • 2.4 Verify end-to-end: openspec init --tools claude emits the field in both SKILL.md and .claude/commands/opsx/*.md, and it parses as the YAML string Bash(openspec:*)

3. Release

  • 3.1 Add a changeset describing the auto-approval