@esneiderbravo/speclaw 2.0.11 → 2.0.12

package/README.md

@@ -310,6 +310,10 @@ speclaw laws accept AGENTS.md   # interactive TTY only — never via MCP
 speclaw laws lock --force       # list drifted files, confirm, re-baseline — interactive TTY only
 ```
 
+`speclaw laws scan` (text or `--json`) exits 1 when `speclaw.lock` cannot be
+read or a finding has severity `error`. On an unreadable lock it names the lock
+error (`lockError` in the JSON) and still reports every injection finding.
+
 A lock refresh (`init`, `update`, `laws compile`, `laws lock`) never launders an
 edit: a strict file (`CLAUDE.md`, `AGENTS.md`, compiled rules) that drifted from
 the lock outside speclaw **keeps its locked digest**, and the command warns

package/dist/cli/commands/cortex.js

@@ -1,6 +1,6 @@
 import { handleHarness, readHarness } from "../../modules/cortex/harness.js";
 import { briefForStage } from "../../modules/cortex/brief.js";
-import { list } from "../lib/args.js";
+import { repeated } from "../lib/args.js";
 import { ui } from "../lib/ui.js";
 const OPS = ["status", "start", "advance", "rework", "brief"];
 /**
@@ -36,7 +36,8 @@ export async function runCortex(flags) {
             change: changeName,
             harnessOp: op,
             verdict: verdict ?? null,
-            openQuestions: list(flags.question),
+            // Covers: req~harness-state~1
+            openQuestions: repeated(flags.question),
             pauseForQuestions: Boolean(flags["pause-questions"]),
             note: typeof flags.note === "string" ? flags.note : undefined,
         });

package/dist/cli/commands/lawbook.js

@@ -5,7 +5,7 @@ import { scaffoldFeature } from "../../modules/lawbook/scaffold-change.js";
 import { investigate, formatInvestigateResult } from "../../modules/lawbook/investigate.js";
 import { handleHarness } from "../../modules/cortex/harness.js";
 import { printHarnessWarnings } from "./cortex.js";
-import { list } from "../lib/args.js";
+import { list, repeated } from "../lib/args.js";
 import { ui } from "../lib/ui.js";
 function today() {
     // The MCP path passes the date in; the CLL runs on a real machine, so read it here.
@@ -181,7 +181,8 @@ export async function runSpec(flags) {
                     change: changeName,
                     harnessOp: op,
                     verdict: verdict ?? null,
-                    openQuestions: list(flags.question),
+                    // Covers: req~harness-state~1
+                    openQuestions: repeated(flags.question),
                     pauseForQuestions: Boolean(flags["pause-questions"]),
                     note: typeof flags.note === "string" ? flags.note : undefined,
                 });

package/dist/cli/commands/laws.js

@@ -73,13 +73,21 @@ export async function runLaws(flags) {
         return;
     }
     if (sub === "scan") {
+        // Text and --json share one exit rule: 1 on an unreadable lock or any
+        // error-severity finding, else 0.
+        // Covers: req~injection-scan~1, req~laws-integrity-cli~1
         const report = verifyIntegrity({ projectPath: process.cwd(), checks: "scan" });
+        const failed = report.lockError !== undefined || report.findings.some((f) => f.severity === "error");
         if (flags.json) {
             console.log(JSON.stringify(report, null, 2));
+            if (failed)
+                process.exit(1);
             return;
         }
         ui.heading("speclaw laws scan");
-        if (report.findings.length === 0) {
+        if (report.lockError !== undefined)
+            ui.err(report.lockError);
+        if (report.findings.length === 0 && report.lockError === undefined) {
             ui.ok("No injection findings.");
             return;
         }
@@ -91,7 +99,7 @@ export async function runLaws(flags) {
             else
                 ui.warn(msg);
         }
-        if (report.findings.some((f) => f.severity === "error"))
+        if (failed)
             process.exit(1);
         return;
     }

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { parseFlags } from "./lib/args.js";
+import { parseFlags, REPEATABLE_FLAGS } from "./lib/args.js";
 import { ui, header } from "./lib/ui.js";
 import { maybeNotifyUpdate } from "./lib/update-check.js";
 import { GLOBAL_HELP as HELP, helpFor, knownCommands, wantsHelp } from "./lib/help.js";
@@ -166,7 +166,7 @@ async function main() {
         process.exitCode = 0;
         return;
     }
-    const flags = parseFlags(rest);
+    const flags = parseFlags(rest, REPEATABLE_FLAGS);
     maybeHeader(cmd, flags);
     await dispatch(cmd, flags);
     // The SessionStart and edit hooks must stay silent: no update notice either.

package/dist/cli/lib/args.js

@@ -1,23 +1,37 @@
 /**
- * Minimal flag parser: `--key value`, `--key=value`, `--bool`, `-x`.
+ * Minimal flag parser: `--key value`, `--key=value`, `--bool`, `-x`. A repeated
+ * key keeps its last value unless it is listed in `repeatable`.
  *
  * @param argv - Raw argument tokens (already stripped of the command name).
+ * @param repeatable - Keys whose every value is kept: such a key always yields a
+ *   `string[]` in argv order, and its values are never split at commas.
  * @returns Flags with named options set and non-flag tokens collected in `_`.
  */
-export function parseFlags(argv) {
+export function parseFlags(argv, repeatable = []) {
     const flags = { _: [] };
+    const set = (key, value) => {
+        const prev = flags[key];
+        if (repeatable.includes(key) && (typeof value === "string" || Array.isArray(prev))) {
+            // A bare repeatable flag after real values adds nothing and drops nothing.
+            if (typeof value === "string")
+                flags[key] = Array.isArray(prev) ? [...prev, value] : [value];
+        }
+        else {
+            flags[key] = value;
+        }
+    };
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         if (arg.startsWith("--")) {
             const [key, inlineVal] = arg.slice(2).split("=", 2);
             if (inlineVal !== undefined) {
-                flags[key] = inlineVal;
+                set(key, inlineVal);
             }
             else if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) {
-                flags[key] = argv[++i];
+                set(key, argv[++i]);
             }
             else {
-                flags[key] = true;
+                set(key, true);
             }
         }
         else if (arg.startsWith("-")) {
@@ -29,6 +43,22 @@ export function parseFlags(argv) {
     }
     return flags;
 }
+/** Flags that may be passed more than once; each occurrence is one value. */
+export const REPEATABLE_FLAGS = ["question"];
+/**
+ * The values of a repeatable flag parsed with {@link REPEATABLE_FLAGS}, as-is:
+ * in argv order and never split at commas.
+ *
+ * @param value - The parsed flag value.
+ * @returns The string values; empty when the flag is absent or a bare boolean.
+ */
+export function repeated(value) {
+    if (Array.isArray(value))
+        return value;
+    if (typeof value === "string")
+        return [value];
+    return [];
+}
 /**
  * Normalize a flag value into a list, splitting comma-separated strings.
  *

package/dist/cli/lib/help.js

@@ -331,7 +331,7 @@ Options
   --change <name>      The change (or pass it as the second argument)
   --verdict <v>        PASS or FAIL (advance from reviewing/testing)
   --note <text>        A history note
-  --question <text>    An open question (repeatable)
+  --question <text>    One open question, commas included; repeat for more
   --pause-questions    Pause the loop for open questions
   --json               Print the result as JSON
 `,

package/dist/modules/foundation/doctor.js

@@ -563,7 +563,7 @@ function specsOrphansCheck(projectPath) {
  * accepting any pending drift — so that is offered only as a last resort.
  */
 export const UNREADABLE_LOCK_REMEDY = "resolve the merge conflict in speclaw.lock or restore it from git " +
-    "(git checkout -- speclaw.lock); upgrade speclaw if the lockfileVersion is newer. " +
+    "(git checkout HEAD -- speclaw.lock); upgrade speclaw if the lockfileVersion is newer. " +
     "Last resort: delete it and run speclaw laws lock — this re-baselines every " +
     "pinned file and accepts any pending drift";
 function integrityChecks(projectPath) {

package/dist/modules/foundation/integrity.js

@@ -23,23 +23,31 @@ export function verifyIntegrity(opts) {
         lock = readLockfile(projectPath);
     }
     catch (err) {
+        // An unreadable lock only blocks the digest/symlink comparison; the scan
+        // never needs the lock, so its findings must still be reported.
+        // Covers: req~injection-scan~1
+        const lockError = err.message;
+        const scanned = doScan ? scanAll(projectPath) : [];
         return {
             ok: false,
             lockPresent: fs.existsSync(lockfilePath(projectPath)),
             rootMatches: false,
-            guidance: err.message,
+            guidance: lockError,
             files: [],
             symlinks: [],
-            findings: [],
+            findings: scanned,
             verifyFindings: [
                 {
                     lawId: "integrity~lockfile~1",
                     severity: "error",
                     engine: "integrity",
                     file: "speclaw.lock",
-                    message: err.message,
+                    message: lockError,
                 },
+                ...scanned.filter((f) => f.severity === "error").map(scanToFinding),
+                ...scanned.filter((f) => f.severity === "warn").map(scanToFinding),
             ],
+            lockError,
         };
     }
     if (!lock && doIntegrity) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@esneiderbravo/speclaw",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "publishConfig": {
     "access": "public"
   },