Move wizard composition to specify artifact CLI (blocked by spec-kit#4305)

[nicolehaugen]

Warning

Blocked by github/spec-kit#4305.
Do not merge until #4305 lands and a specify-cli release containing
specify artifact list --json is published to PyPI. Once that ships, bump
the version floor note in skills/speckit-cli-setup/SKILL.md and un-draft.

Summary

Move the wizard's Composition tab off direct filesystem inspection and onto a
single specify artifact list --json call. The CLI returns one row per
artifact carrying the full composition stack: [...], which is everything the
wizard needs to render commands, templates, scripts, and hooks.

Depends on

• feat: add deterministic contribution IDs and specify artifact command spec-kit#4305 — adds specify artifact (list/info) with deterministic
  contribution IDs and per-row stack. This PR does not work at runtime
  without it.

What changes

• composition/artifact-cli.mjs (new sole source of composition): calls
  specify artifact list --json once at boot, maps rows into the wizard's
  artifact / preset / extension shapes, and produces the composition summary.
• project-scanner.mjs: no longer reads .specify/{presets,extensions}.json
  for composition. Starts empty and lets overlayCachedComposition apply the
  CLI-derived data after the scan.
• composition/pipeline-fast-path.mjs: decides between the deterministic
  pipeline (canonical spine + replace-only overrides) and the LLM pipeline
  (prompts/composition.mjs::inferPipeline) needed when an extension adds a
  non-canonical command or uses wrap / prepend / append.
• Boot UX: "Loading catalogs" split into distinct catalog + composition
  tracker steps so the user sees which phase is running.
• Removed: the live-CLI integration test (test/artifact-cli.integration.test.mjs)
  and its fixture — that layer belongs in the spec-kit repo alongside the CLI
  it exercises. Unit tests here inject a fake runner so CI is green regardless
  of which specify-cli version is installed.

Verification

• 207/207 unit tests pass (unit tests inject a fake specify runner).

• Playwright DOM-diff matrix — captured the wizard side panel from a main-branch
  plugin variant vs. this branch across five scenarios:

  1. baseline (0 presets / 0 extensions)
  2. copilot-sub-agents preset
  3. pirate-full-preset
  4. agent-context extension only
  5. all three stacked

  Each scenario snapshots five surfaces (Composition → Commands / Templates /
  Scripts / Hooks, plus top-level Phases). 25/25 pairs are byte-identical
  after normalizing internal [ref=...] handles. No user-visible regressions.

Runtime behavior when the CLI is too old

Right now the wizard will surface an error and empty composition if the
installed specify-cli lacks artifact list --json. That's acceptable while
this PR is draft; when we un-draft, the floor version bump in
speckit-cli-setup guarantees users get a compatible CLI.

[Copilot]

Pull request overview

Moves wizard composition assembly to the forthcoming specify artifact list --json API, pending spec-kit#4305.

Changes:

• Adds CLI-backed artifact mapping, hook enrichment, and pipeline fast-path selection.
• Separates composition boot progress and parallelizes timeout-bounded catalog loading.
• Removes filesystem composition assembly and updates tests/dependencies.

Show a summary per file

File	Description
ui/styles/boot.css	Hides app content during boot.
ui/index.html	Adds initial boot markup.
ui/boot.js	Adds composition status and minimum display time.
test/state-and-scanner.test.mjs	Removes obsolete scanner test.
test/composition.test.mjs	Removes legacy composition tests.
test/boot-progress.test.mjs	Covers the new boot step.
test/artifact-cli.test.mjs	Tests CLI composition mapping.
project-scanner.mjs	Removes filesystem composition scanning.
package.json	Updates js-yaml.
package-lock.json	Locks the dependency update.
extension.mjs	Splits catalog and composition boot phases.
composition/pipeline-fast-path.mjs	Adds deterministic pipeline selection.
composition/hooks.mjs	Extracts hook metadata.
composition/collect.mjs	Removes legacy filesystem collection.
composition/assembler.mjs	Removes legacy composition assembly.
composition/artifact-cli.mjs	Adds the CLI-backed composition adapter.
catalog/sources.mjs	Adds fetch timeouts.
catalog/shared.mjs	Parallelizes hydration and bounds CLI calls.
canvas-runtime/composition-apply.mjs	Uses the new composition pipeline.
canvas-runtime/boot-progress.mjs	Registers composition boot progress.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files not reviewed (1)

• plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/package-lock.json: Generated file

• Files reviewed: 19/20 changed files
• Comments generated: 4
• Review effort level: Balanced

[nicolehaugen]

@copilot The decision was to remove references to "stage2" thorughout code and instead is the 'fastpath' - make the fix accordingly

[Copilot]

Review details

Files not reviewed (1)

• plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/package-lock.json: Generated file

Suppressed comments (7)

Previously missed (4) — in code that hasn't changed since the last review.

plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/catalog/shared.mjs:61

• On timeout, returning partial stdout is unsafe for these line-based list parsers: a truncated prefix can still parse successfully and mark only the first installed presets/extensions active. Treat a timed-out command as failed so callers use their empty/fallback path rather than publishing a plausible but incomplete installed set.

        const timer = setTimeout(() => {
            try { child.kill(); } catch { /* best-effort */ }
            done(stdout || null);
        }, timeoutMs);

plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/test/artifact-cli.test.mjs:6

• The replacement suite covers the new CLI mapper and fast path, but deleting composition.test.mjs also removes all tests for still-live canonical.mjs, effective-phases.mjs, and resolvePipelineEntry behavior. No equivalent tests remain elsewhere, including regression coverage for bare extension IDs and hook filtering. Preserve those unaffected tests in focused test files.

import {
    buildCompositionFromCli,
} from "../composition/artifact-cli.mjs";
import { computePipelineFastPath } from "../composition/pipeline-fast-path.mjs";

plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/project-scanner.mjs:132

• Starting the scan with empty composition breaks the existing phase gate in canvas-runtime/snapshot-builder.mjs:113-116, which checks scan.composition.extensions before snapshot() overlays inst.cachedComposition. Consequently, taskstoissues remains gated even when its provider extension is installed. Apply the cached CLI composition before building the snapshot, or move this gate to a post-overlay source.

    // Composition data comes from `runFastComposition` (CLI-driven, see
    // composition/artifact-cli.mjs) and is applied via `overlayCachedComposition`
    // after this scan runs. Start empty so the overlay step has a clean base.
    const composition = { presets: [], extensions: [] };

plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/composition/artifact-cli.mjs:350

• This filter removes the CLI-derived command row, and the appended synthetic hook row has a newly constructed stack. If a project or preset overrides an extension's hook command, the replacement reports the extension as active and loses the resolver's actual winning/hidden layers. Reclassify the original artifact as a hook while preserving its stack and description instead of replacing it.

    // Strip extension-provided command artifacts whose name matches a
    // declared hook command from the same extension. The hook artifact
    // above replaces them.
    const filtered = artifacts.filter((artifact) => {

plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/composition/artifact-cli.mjs:108

• The upstream artifact contract sets presetId/presetName to null for extension layers and identifies their owner through sourceId. Passing those fields through means extension rows never satisfy the presetId checks later in this module, and UI lookups such as phase-runtime.js:793-796 cannot associate extension commands with their extension. Translate extension sourceId into the wizard's ownership shape (or migrate all consumers to sourceId) before summarizing/rendering.

        layer: layer.layer == null ? "core" : layer.layer,
        presetId: layer.presetId ?? null,
        presetName: layer.presetName ?? null,
        sourceId: layer.sourceId ?? null,

plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/canvas-runtime/composition-apply.mjs:302

• This return shape removed stage2Needed, but the unchanged refresh dispatcher still tests !fast.stage2Needed (canvas-runtime/dispatch.mjs:100). For a novel command or stack directive, the missing field is undefined, so the dispatcher incorrectly treats the run as complete and never invokes LLM pipeline inference. Preserve the existing result contract or update the dispatcher in the same change.

        return { ok: true, reason, pipelineFastPath: fastPath.canSynthesize };

plugins/spec-kit-copilot-wizard/extensions/speckit-wizard-canvas/extension.mjs:212

• runFastComposition catches CLI failures and returns { ok: false }, so this await never enters the catch block. The code then marks composition successful and immediately marks boot ready, hiding the overlay; therefore an old CLI lacking artifact list is not surfaced as described. Inspect the returned result and expose its failure through a persistent boot or composition error state.

    try {
        await runFastComposition(inst, { reason: "boot" });
        await snapshot(inst);
        tracker.ok("composition");

• Files reviewed: 19/20 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[nicolehaugen]

Superseded by #18, which contains the same commits on a branch created directly in this repo off main (instead of coming from a fork).