0.3.4 - Comet

What’s Changed [0.3.4] - 2026-05-29

Command execution security: Refactored all command execution in OpenSpec and Superpowers install paths from spawn with shell interpretation to execFileSync, eliminating shell injection surface and improving cross-platform reliability (#88bf487)

OpenSpec global install path for OpenCode: comet init --scope global now migrates OpenSpec skills from the hardcoded ~/.opencode/ directory to ~/.config/opencode/ where OpenCode actually reads them, with a self-deletion guard when source and destination paths coincide (#46, @gleami)
Windows command execution: Added shell option to execFileSync calls on Windows so command shims (.cmd) resolve correctly
Doctor .comet.yaml validation: comet doctor now validates top-level keys instead of silently accepting unknown keys, and readDir errors other than ENOENT are no longer swallowed (@felamin)
CI JSON parsing: CI workflow parses command output by finding the first { character, preventing non-JSON prefix lines from breaking JSON extraction (@yicochen)
CI warning output: CI now only counts and prints warnings when a step actually fails, reducing noise in successful runs (@yicochen)
Spawn stdio noise: Changed inherit to ignore for non-interactive spawn stdio so OpenSpec/Superpowers installers don’t print unrelated progress to the console (@yicochen)

Added coverage for OpenCode global OpenSpec path migration, self-deletion guard, and homedir mocking
Added doctor tests for .comet.yaml top-level key validation and non-ENOENT readDir error propagation
Fixed timeout for git-based test “uses plan base-ref to scale verification”

Improved README setup guidance with clearer installation instructions and collapsible reference panels (both English and Chinese) (@hepeng)
Added contributors wall to both README and README-zh (@Joechan11)