Summary. openspec init generates agent skills that invoke a bare openspec … and declare allowed-tools: Bash(openspec:). Projects that pin the CLI locally (devDependencies + npx openspec) rather than installing it globally get skills whose commands cannot run. There is no supported way to change the invocation.
▎
▎ Evidence (v1.8.0). OPENSPEC_CLI_ALLOWED_TOOLS = 'Bash(openspec:)' is a hardcoded constant in dist/core/shared/allowed-tools.js. OpenSpecConfig exposes only aiTools; the global config surface is featureFlags, profile, delivery, telemetry, workflows, defaultStore — nothing addresses the CLI command. The string npx openspec appears nowhere in the generator. The README documents only npm install -g.
▎
▎ Why it matters. A repo-local pin is what makes a toolchain reproducible and reviewable: the exact version lives in package-lock.json, and CI installs nothing globally. Today that model forces either hand-patching generated files — lost on the next init — or a global install that becomes a second, undeclared source of the version.
▎
▎ Request. Either (a) a configurable CLI invocation — e.g. a cliCommand config key or openspec init --cli-command "npx --no-install openspec" — or (b) emit a local-runner invocation (npx --no-install openspec …) when the package resolves in the project's node_modules, with allowed-tools matched accordingly.
Summary. openspec init generates agent skills that invoke a bare openspec … and declare allowed-tools: Bash(openspec:). Projects that pin the CLI locally (devDependencies + npx openspec) rather than installing it globally get skills whose commands cannot run. There is no supported way to change the invocation.
▎
▎ Evidence (v1.8.0). OPENSPEC_CLI_ALLOWED_TOOLS = 'Bash(openspec:)' is a hardcoded constant in dist/core/shared/allowed-tools.js. OpenSpecConfig exposes only aiTools; the global config surface is featureFlags, profile, delivery, telemetry, workflows, defaultStore — nothing addresses the CLI command. The string npx openspec appears nowhere in the generator. The README documents only npm install -g.
▎
▎ Why it matters. A repo-local pin is what makes a toolchain reproducible and reviewable: the exact version lives in package-lock.json, and CI installs nothing globally. Today that model forces either hand-patching generated files — lost on the next init — or a global install that becomes a second, undeclared source of the version.
▎
▎ Request. Either (a) a configurable CLI invocation — e.g. a cliCommand config key or openspec init --cli-command "npx --no-install openspec" — or (b) emit a local-runner invocation (npx --no-install openspec …) when the package resolves in the project's node_modules, with allowed-tools matched accordingly.