Add specstory kit

[jakelevirne]

What this adds

A new specstory mixin that installs the SpecStory CLI — a wrapper for terminal coding agents (Claude Code, Cursor CLI, Codex CLI, Gemini CLI) that saves conversations as local markdown. Agent-agnostic; pair with any supported agent.

I maintain SpecStory, so this kit wraps our own CLI — happy to field any questions about the install flow or the watch daemon behavior.

How it works

Install: Downloads a pinned SpecStory release tarball from the public release repo (github.com/specstoryai/getspecstory), verifies its SHA256 against a digest captured in spec.yaml, and extracts the single specstory binary into /usr/local/bin/. Pinned to v2.3.0; per-arch digests sourced from the release's SpecStoryCLI_2.3.0_checksums.txt. Bumping is a one-line version edit + a digest update.

Auto-save at runtime: The kit starts specstory watch --no-version-check --no-usage-analytics as a background startup command, so conversations are auto-saved to .specstory/history/ on the host workspace as they happen — no manual specstory sync step after the agent exits.

Two sbx behaviors make this work without user action:

• sbx run launches the agent with cwd set to the host workspace mount path (e.g. /Users/you/my-project), not the container's default /home/agent/workspace.
• Startup commands run with cwd /home/agent/workspace, but sbx sets WORKSPACE_DIR to the host mount path. The kit's startup command cds to $WORKSPACE_DIR before exec'ing specstory watch, so the daemon's cwd matches the agent's cwd and its ./.specstory/history/ output lands on the host via the virtiofs mount.

--no-version-check and --no-usage-analytics keep the daemon local-only — no outbound network calls at runtime, so no extra allowedDomains entries are needed beyond the two install-time domains (github.com, release-assets.githubusercontent.com).

Validation

All four local checks from CONTRIBUTING.md pass:

• sbx kit validate ./specstory/ — VALID
• scripts/test-kit.sh specstory — TCK PASS (including real install_execution against a shell-docker container; SHA256 verified against the published artifact)
• scripts/test-kit-e2e.sh specstory — e2e PASS under deny-all (network contract complete)
• Manual smoke: created a sandbox with the kit, ran claude -p "say exactly: ok", confirmed .specstory/history/*.md appeared on the host automatically via the watch daemon (no manual specstory sync). Verified the daemon is persistent across multiple consecutive sessions.

Scope

Thin install-and-watch layer. Does not configure SpecStory Cloud auth, pick a custom output directory, or launch the agent through specstory run for you — those decisions belong in the user's project or shell setup. Authored in v1 schema for compatibility with the current released sbx; can migrate to v2 with scripts/migrate-v1-to-v2.go once a v2-capable sbx stable ships.

[dvdksn]

Hey @jakelevirne 👋 nice to see you here!

This looks like a great kit for sbx. Looks like the commit is missing DCO sign-off: git commit --amend --no-edit -s. Otherwise LGTM!

[jakelevirne]

thanks, @dvdksn ... good to be here! sbx has been very helpful for testing new skills in clean environments.

I've added DCO sign-off

[dvdksn]

LGTM!