
Company News
Andrew Becherer Joins Socket as Chief Information Security Officer
Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.
spec-first
Advanced tools
AI coding workflow CLI for spec-driven engineering, spec-driven development, and harness engineering on Claude Code and Codex
Spec-driven AI engineering workflows for Claude Code and Codex.
spec-first turns one-off AI coding chats into a reusable engineering loop: requirements, PRDs, plans, task packs, work, debugging, reviews, and learnings stay in the repository instead of disappearing into a session.
Official site: spec-first.cn
This is the README's maintained demo slot. Today it uses the source-controlled workflow SVG above; a future terminal animation or screenshot can replace this position without restructuring the page.
The point is not another prompt snippet or agent team. spec-first organizes engineering artifacts and evidence: requirement briefs, plans, task packs, diffs, reviews, failure analysis, and reusable learnings.
In your current host session:
$spec-brainstorm "Improve onboarding for first-time CLI users"
Claude Code users can run:
/spec:brainstorm "Improve onboarding for first-time CLI users"
The first brainstorm run usually creates one requirements brief:
docs/brainstorms/YYYY-MM-DD-NNN-topic-requirements.md
From there, continue to the current host's plan entrypoint. A longer chain may later add docs/plans/, docs/tasks/, code/test changes, review findings, and docs/solutions/ learnings, but not every workflow writes every artifact.
Detailed walkthrough: Chinese First Workflow Walkthrough. Artifact ownership: Chinese Artifact Catalog.
AI coding breaks down when important decisions live only in chat: the next session lacks context, reviewers cannot see why a plan changed, and teams cannot reuse what worked.
spec-first keeps the software lifecycle legible:
| Question | Agent orchestration tools | spec-first |
|---|---|---|
| Primary unit | Agent, role, team, queue | Requirement, plan, task pack, diff, review, bug, learning |
| Main problem | How should agents coordinate? | How should software decisions stay durable and reusable? |
| State location | Session state, message bus, runtime memory | Repo-local docs, generated runtime assets, and verifiable CLI facts |
| Human role | Minimize intervention where possible | Keep engineers in the loop for scope, tradeoffs, and acceptance |
| Automation boundary | Often pushes toward autonomous chains | Scripts prepare facts; LLMs make semantic decisions |
What this buys you:
/spec:* entries and Codex $spec-* entries without hand-maintaining generated runtime copies.Prerequisites:
>=20.0.0 and npm.PATH; doctor, setup, and workflow checks read repository facts from Git.spec-first. First-time users can try a throwaway/test repo before initializing a real project.Install and run the first health check from the native terminal for your platform.
macOS / Linux:
npm install -g spec-first
spec-first doctor
Windows PowerShell 7+ or Windows PowerShell 5.1:
npm install -g spec-first
spec-first doctor
Windows cmd.exe:
npm install -g spec-first
spec-first doctor
On Win64, prefer native Windows Terminal with PowerShell 7+ or cmd.exe for installation and smoke checks. Windows PowerShell 5.1 is supported, but PowerShell 7+ has better UTF-8 behavior.
Initialize the host runtime you actually use:
spec-first init
spec-first init is interactive: select Claude Code and/or Codex, confirm your developer name and language, preview the writes, then confirm. Use spec-first init --codex or spec-first init --claude to skip only the host selection step. Use spec-first init -y for scripted defaults, or combine -y with explicit host flags, -u <name>, and --lang <zh|en>.
Restart the host or open a new session so it loads the generated runtime assets.
Host-session workflow entries are not shell commands:
# In a Claude Code session
/spec:brainstorm "Improve onboarding"
# In a Codex session
$spec-brainstorm "Improve onboarding"
You are done with the first pass when a requirements brief appears under docs/brainstorms/. If you are not sure which workflow to use, describe the task or ask what to run next in the host session; using-spec-first will recommend one public entrypoint with a reason.
Use this single table as the public entrypoint map. Shared prose should say "current host"; concrete /spec:* and $spec-* mappings belong here and in init/runtime guidance.
| Intent | Claude Code | Codex | Expected result |
|---|---|---|---|
| Setup required harness runtime | /spec:mcp-setup | $spec-mcp-setup | Required MCP/helper runtime facts and setup-owned provider config artifacts |
| Compile graph readiness facts | /spec:graph-bootstrap | $spec-graph-bootstrap | Canonical .spec-first/graph/*, .spec-first/providers/*, and .spec-first/impact/* readiness facts |
| Update spec-first or runtime assets | /spec:update | $spec-update | Version/runtime refresh guidance |
| Search agent session history | /spec:sessions | $spec-sessions | Session history answers and recovery context |
| Research Slack context | /spec:slack-research | $spec-slack-research | Organizational context digest when Slack tools are available |
| Audit source skills | /spec:skill-audit | $spec-skill-audit | Skill governance and quality findings |
| Generate and evaluate ideas | /spec:ideate | $spec-ideate | Ranked ideation artifact under docs/ideation/ |
| Brainstorm requirements | /spec:brainstorm | $spec-brainstorm | Requirements brief under docs/brainstorms/ |
| Write/refine brownfield PRD requirements | /spec:prd | $spec-prd | PRD-grade requirements under docs/brainstorms/ |
| Review docs/plans | /spec:doc-review | $spec-doc-review | Document findings, gaps, and residual risks |
| Write or deepen a plan | /spec:plan | $spec-plan | Implementation plan under docs/plans/ |
| Compile task pack | use installed standalone write-tasks skill | use installed standalone write-tasks skill | Derived task pack under docs/tasks/ |
| Audit App consistency | /spec:app-consistency-audit | $spec-app-consistency-audit | Static App consistency report and run-scoped audit evidence |
| Debug a failure or bug | /spec:debug | $spec-debug | Root cause, fix, and verification evidence |
| Execute work | /spec:work | $spec-work | Scoped source changes, tests, and verification notes |
| Optimize a measurable outcome | /spec:optimize | $spec-optimize | Metric-driven experiment loop and retained improvements |
| Polish browser-visible UI beta | /spec:polish-beta | $spec-polish-beta | Browser-visible UI polish pass |
| Review code | /spec:code-review | $spec-code-review | Structured findings and residual risks |
| Capture learning | /spec:compound | $spec-compound | Reusable learning under docs/solutions/ |
| Refresh stale learnings | /spec:compound-refresh | $spec-compound-refresh | Updated, merged, or retired solution docs |
| Read release notes | /spec:release-notes | $spec-release-notes | Version-specific change summary |
Use ideate when you want options, critiques, or surprising directions before committing to a problem frame. Use brainstorm when you already have a rough problem or feature and need actors, flows, boundaries, and acceptance examples. Use prd for existing-system increments or rough PRDs that need current-state evidence and change delta. Use doc-review when a requirements, plan, or task document already exists and needs gap-finding. Do not make brainstorm the default entrypoint for every unclear request.
spec-first has two durable surfaces: repo-local workflow artifacts and generated host runtime assets.
Repo-relative artifact roots:
docs/
ideation/ ranked idea candidates before requirements shaping
brainstorms/ requirements briefs and PRD-grade requirements
plans/ implementation plans ready for review and execution
tasks/ derived task packs for structured handoff
solutions/ reusable learnings after solving problems
.spec-first/
app-audit/runs/ static App consistency audit facts and reports
Runtime shape:
Source assets
skills/ agents/ templates/ src/cli/
|
| spec-first init
v
Host runtime assets
Claude Code: /spec:* commands
Codex: $spec-* skills
|
v
Workflow artifacts
ideation -> brainstorms -> plans -> tasks -> work/review/debug -> learnings
Source-of-truth assets live in the repository. Generated runtime copies under .claude/, .codex/, and .agents/skills/ are disposable and can be rebuilt with spec-first init. During init, spec-first also untracks already-indexed managed runtime paths once, preserving worktree files while preventing historical generated mirrors from creating noisy diffs.
The development-mode rule is intentionally small: .spec-first facts are authoritative at the selected Git repo root. In a single Git repo with many modules, do not create one .spec-first per module. In a parent workspace with many child Git repos, parent workspace summaries are advisory only; setup, graph, plan, work, review, tests, changelog updates, and commits still need an explicit target repo.
Detailed references:
spec-first does not ask the LLM to simulate deterministic tooling, and it does not replace LLM judgment with a rigid state machine.
The operating rule is simple: Scripts prepare, LLM decides.
skills/, agents/, templates/, src/cli/, and docs. Rebuild runtime copies instead of hand-editing them..spec-first/audits/** and generated mirrors such as .claude/**, .codex/**, and .agents/skills/**.Use spec-first when:
It may not fit when you only need a single prompt snippet, a generic agent marketplace, a no-host standalone app, or a team process that does not want workflow artifacts written into the repo.
Official site and language entrypoints:
Learn the model:
Use workflows:
Develop and contribute:
Release history:
Detailed manuals and implementation docs are currently Chinese-first.
First-run users only need this mental model:
source assets -> spec-first init -> host runtime assets -> workflow artifacts
Use deeper runtime and graph details only when you need setup, provider, or workspace evidence:
spec-first doctor checks CLI/runtime health. It does not prove MCP/helper setup, provider indexes, or fresh graph query evidence.gitnexus_capability_discovery; these are setup-inferred native capability hints from the checked-in baseline, provider pin, and setup projection, not query-ready graph evidence or live MCP proof.query_ready, definitions-only, dirty-advisory, stale, session-local, setup-inferred, and other lifecycle terms are defined in the Capability State Vocabulary. Use that vocabulary instead of inventing synonyms.CLI reference:
spec-first --help
spec-first --version
spec-first doctor [--json] [--claude|--codex]
spec-first init [--claude] [--codex] [-y] [-u <name>] [--lang <zh|en>]
spec-first clean (--claude|--codex) [--dry-run]
spec-first clean --workspace-orphans [--confirm]
spec-first tasks hash <plan-path> [--json]
spec-first tasks validate <task-pack-path> [--json] [--repo=<path>|--repo <path>]
To inspect current runtime delivery details, use spec-first doctor, spec-first init output, spec-first --help, and the Runtime Capability Catalog. The README intentionally avoids hardcoding internal skills/agents/commands counts because those drift across releases.
npm run typecheck
npm run test:mcp-setup
npm run test:graph-bootstrap
npm run test:unit
npm run test:smoke
npm run test:integration
npm run test:ai-dev:gate
npm run test:ai-dev:benchmarks
npm run test:release
npm run test:release:website
npm run build
npm test
npm run build runs npm pack --dry-run and verifies the package payload shape through npm.
When changing source assets, edit skills/, agents/, templates/, or src/cli/, then regenerate runtime copies with spec-first init and choose the target host in a fresh host session.
For contribution and support details, see CONTRIBUTING.md, SECURITY.md, LICENSE, and GitHub Issues.
FAQs
AI coding workflow CLI for spec-driven engineering, spec-driven development, and harness engineering on Claude Code and Codex
The npm package spec-first receives a total of 62 weekly downloads. As such, spec-first popularity was classified as not popular.
We found that spec-first demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.

Company News
Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.