@planu/cli 4.11.1 → 4.11.3

package/dist/tools/challenge-spec/scenarios-scale.js

@@ -1,34 +1,33 @@
 // tools/challenge-spec/scenarios-scale.ts — Traffic spike and data growth scenarios
-import { contentMentions } from './scenarios-utils.js';
+import { contentMentions, detectChallengeCapabilities } from './scenarios-utils.js';
 export function generateScaleScenarios(spec, content, _knowledge) {
     const scenarios = [];
-    const lower = content.toLowerCase();
+    const capabilities = detectChallengeCapabilities(spec, content);
+    if (!capabilities.scale) {
+        return scenarios;
+    }
     // High traffic
     scenarios.push({
-        scenario: 'Traffic spike: 10x normal load',
+        scenario: 'Traffic spike exceeds the load envelope defined by the spec',
         probability: spec.scope === 'architectural' ? 'medium' : 'low',
         impact: 'high',
-        currentHandling: contentMentions(lower, ['cache', 'cdn', 'queue', 'scale', 'auto-scale'])
+        currentHandling: contentMentions(content, ['cache', 'cdn', 'queue', 'scale', 'auto-scale'])
             ? 'Some scaling strategy mentioned'
             : 'Not addressed',
-        requiredHandling: 'Implement caching (Redis/CDN). Use connection pooling. Consider auto-scaling. Load test before launch.',
-        dataConsistency: 'Ensure cache invalidation strategy. Handle stale reads gracefully.',
-        userExperience: 'Graceful degradation: serve cached content, queue non-critical operations.',
+        requiredHandling: 'Define a measurable load envelope and verify the declared scaling strategy.',
+        dataConsistency: 'Verify consistency behavior at the declared capacity boundary.',
+        userExperience: 'Use the degradation behavior stated in the service contract.',
     });
     // Data growth
-    if (lower.includes('database') ||
-        lower.includes('table') ||
-        lower.includes('query') ||
-        lower.includes('list') ||
-        lower.includes('search')) {
+    if (capabilities.database) {
         scenarios.push({
-            scenario: 'Database grows to millions of rows, queries slow down',
+            scenario: 'Database grows beyond the query-performance envelope',
             probability: 'medium',
             impact: 'medium',
-            currentHandling: contentMentions(lower, ['index', 'pagination', 'cursor', 'partition'])
+            currentHandling: contentMentions(content, ['index', 'pagination', 'cursor', 'partition'])
                 ? 'Some query optimization mentioned'
                 : 'Not addressed',
-            requiredHandling: 'Add database indexes on query columns. Use cursor-based pagination. Consider archiving old data.',
+            requiredHandling: 'Define expected data growth and verify the stated indexing and pagination plan.',
             dataConsistency: 'Indexes must be maintained. Monitor query plans.',
             userExperience: 'Consistent response times through pagination. No full-table scans.',
         });

package/dist/tools/challenge-spec/scenarios-security.d.ts

@@ -1,3 +1,3 @@
 import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.js';
-export declare function generateSecurityScenarios(_spec: Spec, content: string, _knowledge: ProjectKnowledge): FailureScenario[];
+export declare function generateSecurityScenarios(spec: Spec, content: string, _knowledge: ProjectKnowledge): FailureScenario[];
 //# sourceMappingURL=scenarios-security.d.ts.map

package/dist/tools/challenge-spec/scenarios-security.js

@@ -1,5 +1,5 @@
 // tools/challenge-spec/scenarios-security.ts — Authentication, injection, and CSRF scenarios
-import { contentMentions, hasAnyAffirmedMatch } from './scenarios-utils.js';
+import { contentMentions, detectChallengeCapabilities, hasAnyAffirmedMatch, } from './scenarios-utils.js';
 const AUTH_SIGNALS = [
     /\b(auth|authentication|login|session|token|jwt|oauth|permission|role|rbac)\b/i,
 ];
@@ -9,10 +9,11 @@ const INPUT_SIGNALS = [
 const STATE_CHANGING_WEB_SIGNALS = [
     /\b(form submit|post request|put request|delete request|mutation|state-changing|cookie auth)\b/i,
 ];
-export function generateSecurityScenarios(_spec, content, _knowledge) {
+export function generateSecurityScenarios(spec, content, _knowledge) {
     const scenarios = [];
     const lower = content.toLowerCase();
     const text = content;
+    const capabilities = detectChallengeCapabilities(spec, content);
     // Authentication bypass
     if (hasAnyAffirmedMatch(text, AUTH_SIGNALS)) {
         scenarios.push({
@@ -22,23 +23,29 @@ export function generateSecurityScenarios(_spec, content, _knowledge) {
             currentHandling: contentMentions(lower, ['auth', 'jwt', 'session', 'middleware'])
                 ? 'Authentication mentioned'
                 : 'No explicit auth handling',
-            requiredHandling: 'Validate auth tokens on every request. Implement RBAC. Never trust client-side auth state.',
-            dataConsistency: 'Ensure RLS policies are enabled. No data leak through unauthorized queries.',
-            userExperience: 'Redirect to login on 401. Clear error messages without leaking implementation details.',
+            requiredHandling: 'Validate identity at the declared trust boundary and enforce the authorization model named by the contract.',
+            dataConsistency: 'Unauthorized operations must not read or mutate protected state.',
+            userExperience: 'Use the unauthorized-access behavior defined by the client contract.',
         });
     }
     // Injection attacks
     if (hasAnyAffirmedMatch(text, INPUT_SIGNALS)) {
         scenarios.push({
-            scenario: 'SQL injection / XSS / command injection via user input',
+            scenario: capabilities.database
+                ? 'SQL injection / XSS / command injection via user input'
+                : 'XSS / command injection via user input',
             probability: 'high',
             impact: 'critical',
             currentHandling: contentMentions(lower, ['sanitiz', 'escap', 'parameterized', 'prepared'])
                 ? 'Some sanitization mentioned'
                 : 'Not explicitly addressed',
-            requiredHandling: 'Use parameterized queries (never string concatenation). Sanitize HTML output. Use CSP headers.',
-            dataConsistency: 'Injection can corrupt or exfiltrate data. Use least-privilege DB connections.',
-            userExperience: 'Transparent to user. Invalid input is silently sanitized.',
+            requiredHandling: capabilities.database
+                ? 'Use parameterized queries and sanitize output at the declared input boundary.'
+                : 'Sanitize output and constrain command execution at the declared input boundary.',
+            dataConsistency: capabilities.database
+                ? 'Use least-privilege database access for data reached through this input.'
+                : 'Invalid input must not reach state-changing operations.',
+            userExperience: 'Use the invalid-input response defined by the interaction contract.',
         });
     }
     // CSRF / rate limiting only applies when the spec explicitly involves auth or
@@ -52,9 +59,9 @@ export function generateSecurityScenarios(_spec, content, _knowledge) {
             currentHandling: contentMentions(lower, ['csrf', 'rate limit', 'throttle', 'captcha'])
                 ? 'Some protection mentioned'
                 : 'Not addressed',
-            requiredHandling: 'Implement CSRF tokens for state-changing operations. Rate-limit sensitive endpoints. Add CAPTCHA for auth endpoints.',
+            requiredHandling: 'Define request-forgery and abuse controls from the authentication and mutation contracts.',
             dataConsistency: 'Prevent mass data modifications from automated attacks.',
-            userExperience: 'Show rate limit message. Require CAPTCHA after N failed attempts.',
+            userExperience: 'Use the throttling and verification behavior defined by the auth contract.',
         });
     }
     return scenarios;

package/dist/tools/challenge-spec/scenarios-utils.d.ts

@@ -1,7 +1,33 @@
-/**
- * Returns true if any of the keywords appear in lowerContent (case-insensitive match).
- * lowerContent is expected to already be lowercased by the caller.
- */
-export declare function contentMentions(lowerContent: string, keywords: string[]): boolean;
+import type { Spec } from '../../types/index.js';
+export interface ChallengeCapabilities {
+    networkApi: boolean;
+    database: boolean;
+    authentication: boolean;
+    authorization: boolean;
+    userInput: boolean;
+    externalService: boolean;
+    payment: boolean;
+    fileTransfer: boolean;
+    scale: boolean;
+    dataWrite: boolean;
+    cache: boolean;
+    duplicateOperation: boolean;
+    concurrency: boolean;
+    privacy: boolean;
+    events: boolean;
+    implementationContract: boolean;
+    desktopUpdate: boolean;
+    agent: boolean;
+    ddd: boolean;
+    xp: boolean;
+    validation: boolean;
+    rateLimit: boolean;
+    saga: boolean;
+    platform: boolean;
+}
+/** Boundary-aware, affirmative replacement for advisory substring checks. */
+export declare function contentMentions(content: string, keywords: string[]): boolean;
+export declare function detectChallengeCapabilities(spec: Spec, specContent: string): ChallengeCapabilities;
+export declare function hasAnyChallengeCapability(capabilities: ChallengeCapabilities, names: (keyof ChallengeCapabilities)[]): boolean;
 export { hasAffirmedMatch, hasAnyAffirmedMatch, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
 //# sourceMappingURL=scenarios-utils.d.ts.map

package/dist/tools/challenge-spec/scenarios-utils.js

@@ -1,10 +1,106 @@
 // tools/challenge-spec/scenarios-utils.ts — Shared utilities for scenario generators
-/**
- * Returns true if any of the keywords appear in lowerContent (case-insensitive match).
- * lowerContent is expected to already be lowercased by the caller.
- */
-export function contentMentions(lowerContent, keywords) {
-    return keywords.some((kw) => lowerContent.includes(kw.toLowerCase()));
+import { hasAnyAffirmedMatch } from '../../engine/text-signal-boundaries.js';
+const CAPABILITY_SIGNALS = {
+    networkApi: [
+        /(?<!compiler\s)\bapi\b(?!\s+(?:compatibility|surface|package|type))/i,
+        /\b(?:public|external|remote|rest|http)\s+api\b/i,
+        /\bapi\s+(?:endpoint|route|request|response|server|client)\b/i,
+        /\b(?:http|rest)\s+(?:endpoint|route|request|response)\b/i,
+        /\bfetch(?:es|ing)?\s+(?:from\s+)?(?:an?\s+)?(?:endpoint|service|url)\b/i,
+    ],
+    database: [
+        /\b(?:database|postgres(?:ql)?|mysql|sqlite|mongodb|dynamodb|supabase)\b/i,
+        /\b(?:sql|nosql)\s+(?:query|statement|table|database)\b/i,
+        /\b(?:database|persistence)\s+(?:query|schema|table|migration|transaction)\b/i,
+        /\b(?:orm|prisma|drizzle|typeorm|sequelize)\b/i,
+    ],
+    authentication: [
+        /\b(?:auth(?:entication)?|login|sign[ -]?in|password|jwt|oauth2?|session\s+auth)\b/i,
+    ],
+    authorization: [
+        /\b(?:authori[sz]ation|permission|rbac|role-based|access\s+control|resource\s+ownership|tenant)\b/i,
+    ],
+    userInput: [
+        /\b(?:user|client)\s+input\b/i,
+        /\b(?:input\s+form|form\s+(?:input|submission)|request\s+body|query\s+parameter|uploaded\s+payload)\b/i,
+        /\binputs?\s+(?:are\s+)?validat/i,
+    ],
+    externalService: [
+        /\b(?:third-party|external|remote|downstream)\s+(?:service|provider|dependency|system)\b/i,
+        /\bwebhook\s+(?:provider|delivery|endpoint|request)\b/i,
+    ],
+    payment: [/\b(?:payment|billing|checkout|invoice|stripe|paypal)\b/i],
+    fileTransfer: [
+        /\b(?:(?:large|binary|uploaded)\s+)?(?:file|image|media|attachment)\s+(?:upload|download|transfer|stream)\b/i,
+        /\b(?:upload|download|stream)(?:ed|ing|s)?\s+(?:a\s+)?(?:(?:large|binary)\s+)?(?:file|image|media|attachment)\b/i,
+        /\bbatch\s+(?:import|export|processing|operation)\b/i,
+        /\bbatch\s+upload\b/i,
+    ],
+    scale: [
+        /\b(?:traffic|load|throughput|requests?\s+per\s+second|concurrent\s+users?)\b/i,
+        /\b(?:auto[ -]?scal|load\s+test|capacity\s+plan)/i,
+        /\b(?:data\s+growth|growing\s+dataset|query\s+performance\s+at\s+scale)\b/i,
+    ],
+    dataWrite: [
+        /\b(?:database\s+transaction|persist(?:s|ed|ing)?\s+(?:record|entity|data)|write(?:s|ing)?\s+(?:record|entity|database))\b/i,
+        /\b(?:state-changing|data\s+mutation|atomic\s+database\s+write)\b/i,
+        /\b(?:transaction|atomic\s+write|update\s+(?:record|state)|modify\s+(?:record|state))\b/i,
+    ],
+    cache: [/\b(?:cache|caching|cached\s+(?:data|response)|redis)\b/i],
+    duplicateOperation: [
+        /\b(?:double[ -]?click|duplicate\s+(?:request|submission|operation|record)|idempoten)/i,
+    ],
+    concurrency: [
+        /\b(?:concurren|race\s+condition|shared\s+state|parallel\s+write|atomic\s+increment|optimistic\s+lock)/i,
+        /\b(?:counter|increment|balance|stock|quantity|vote|status\s+(?:update|transition))\b/i,
+        /\b(?:file\s+upload|resource\s+manager|search\s+feed|list\s+endpoint|global\s+cache|session\s+state|cart\s+state|draft\s+state)\b/i,
+    ],
+    privacy: [
+        /\b(?:pii|personal\s+data|personal\s+information|privacy|gdpr|hipaa|data\s+subject)\b/i,
+        /\b(?:email\s+address|phone\s+number|social\s+security\s+number)\b/i,
+    ],
+    events: [
+        /\b(?:process|handle|publish|consume)\w*(?:\s+[a-z0-9_-]+){0,3}\s+event\b/i,
+        /\b(?:event\s+(?:schema|contract|producer|consumer|handler|stream)|message\s+(?:broker|queue|consumer|producer))\b/i,
+        /\b(?:kafka|rabbitmq|pubsub|nats|eventbridge|sqs|sns|dead[ -]?letter\s+queue|dlq)\b/i,
+        /\b(?:publish|produce|consume)(?:es|d|r|rs|ing)?\s+(?:an?\s+)?(?:event|message)\b/i,
+    ],
+    implementationContract: [
+        /\bimplementation\s+contract\b/i,
+        /\b(?:file-level\s+work\s+plan|acceptance-to-verification\s+map|behavior\s+contract)\b/i,
+    ],
+    desktopUpdate: [
+        /\b(?:desktop|electron|tauri)\s+(?:app\s+)?(?:auto[ -]?)?update\b/i,
+        /\b(?:auto[ -]?updater|electron-updater)\b/i,
+    ],
+    agent: [/\b(?:ai\s+agent|agent\s+contract|llm\s+agent|tool\s+call|autonomous\s+agent)\b/i],
+    ddd: [/\b(?:domain-driven\s+design|ddd\s+aggregate|aggregate\s+root|bounded\s+context)\b/i],
+    xp: [/\b(?:pair\s+programming|extreme\s+programming|xp\s+pair)\b/i],
+    validation: [/\b(?:input|payload|request|schema)\s+validat/i, /\b(?:zod|joi|json\s+schema)\b/i],
+    rateLimit: [/\b(?:rate[ -]?limit|throttl|request\s+quota)\b/i],
+    saga: [/\b(?:saga|compensating\s+transaction|distributed\s+transaction)\b/i],
+    platform: [
+        /\b(?:smart\s+contract|solidity|discord\s+bot|telegram\s+bot|iot\s+device|firmware|infrastructure\s+as\s+code|terraform|machine\s+learning\s+model)\b/i,
+    ],
+};
+function keywordPattern(keyword) {
+    const escaped = keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\s+/g, '\\s+');
+    const suffix = /^[a-z0-9]+$/i.test(keyword) && keyword.length > 3 ? '[a-z0-9_-]*' : '';
+    return new RegExp(`\\b${escaped}${suffix}\\b`, 'i');
+}
+/** Boundary-aware, affirmative replacement for advisory substring checks. */
+export function contentMentions(content, keywords) {
+    return hasAnyAffirmedMatch(content, keywords.map(keywordPattern));
+}
+export function detectChallengeCapabilities(spec, specContent) {
+    const text = `${spec.title}\n${spec.tags.join(' ')}\n${specContent}`;
+    return Object.fromEntries(Object.entries(CAPABILITY_SIGNALS).map(([capability, patterns]) => [
+        capability,
+        hasAnyAffirmedMatch(text, patterns),
+    ]));
+}
+export function hasAnyChallengeCapability(capabilities, names) {
+    return names.some((name) => capabilities[name]);
 }
 export { hasAffirmedMatch, hasAnyAffirmedMatch, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
 //# sourceMappingURL=scenarios-utils.js.map

package/dist/tools/challenge-spec/security-challenge-scenarios.d.ts

@@ -3,7 +3,7 @@ import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.
  * Generate security challenge scenarios specific to authorization, STRIDE threats,
  * and resource ownership. Used by handleChallengeSpec in the 'security' focus area.
  */
-export declare function generateSecurityChallengeScenarios(spec: Spec, _specContent: string, _knowledge: ProjectKnowledge): FailureScenario[];
+export declare function generateSecurityChallengeScenarios(spec: Spec, specContent: string, _knowledge: ProjectKnowledge): FailureScenario[];
 /**
  * Generate security test case scaffolds for auth/API features.
  * SPEC-029 criterion 12: auto-generate security test scaffolds.

package/dist/tools/challenge-spec/security-challenge-scenarios.js

@@ -1,12 +1,13 @@
 // tools/challenge-spec/security-challenge-scenarios.ts — Security challenges for challenge_spec
 // SPEC-029 criteria 11, 24: authorization challenges and STRIDE-based challenges
 import { detectSecurityProfiles } from '../../engine/security-analyzer.js';
+import { hasAnyAffirmedMatch } from './scenarios-utils.js';
 /**
  * Generate security challenge scenarios specific to authorization, STRIDE threats,
  * and resource ownership. Used by handleChallengeSpec in the 'security' focus area.
  */
-export function generateSecurityChallengeScenarios(spec, _specContent, _knowledge) {
-    const profiles = detectSecurityProfiles(spec.title, '', spec.tags);
+export function generateSecurityChallengeScenarios(spec, specContent, _knowledge) {
+    const profiles = detectSecurityProfiles(spec.title, specContent, spec.tags);
     const scenarios = [];
     // Authorization challenge (criterion 11): resource ownership
     if (profiles.includes('public-api') || profiles.includes('db-access')) {
@@ -16,15 +17,14 @@ export function generateSecurityChallengeScenarios(spec, _specContent, _knowledg
             impact: 'critical',
             currentHandling: 'Authorization check may be missing at the data access layer — only route-level guards present.',
             requiredHandling: 'Implement object-level authorization on every data access operation. ' +
-                'Never trust client-provided resource IDs without verifying ownership. ' +
-                'Use indirect references (UUIDs) instead of sequential IDs.',
-            dataConsistency: 'Unauthorized access should return 403, never 404 that leaks resource existence.',
-            userExperience: 'Return consistent 403 Forbidden for unauthorized access — do not reveal if the resource exists.',
+                'Never trust client-provided resource identifiers without verifying ownership using the declared authorization model.',
+            dataConsistency: 'Unauthorized access must not reveal resource existence.',
+            userExperience: 'Use the authorization failure response defined by the API contract.',
         });
     }
     // JWT-specific challenges
-    const lower = `${spec.title} ${spec.tags.join(' ')}`.toLowerCase();
-    const hasJwt = lower.includes('jwt') || lower.includes('token') || lower.includes('auth');
+    const signalText = `${spec.title}\n${spec.tags.join(' ')}\n${specContent}`;
+    const hasJwt = hasAnyAffirmedMatch(signalText, [/\b(?:jwt|json\s+web\s+token)\b/i]);
     if (hasJwt) {
         scenarios.push({
             scenario: `[${spec.id}] JWT Algorithm Confusion Attack: attacker changes JWT header algorithm to "none" or switches RS256 to HS256. Server accepts forged token if it trusts the header.`,
@@ -34,17 +34,16 @@ export function generateSecurityChallengeScenarios(spec, _specContent, _knowledg
             requiredHandling: 'Explicitly configure the allowed algorithm(s) in JWT verification. ' +
                 'Never use the algorithm from the token header. Reject tokens with "none" algorithm.',
             dataConsistency: 'Invalid tokens must never reach business logic — reject at middleware boundary.',
-            userExperience: 'Return 401 Unauthorized for invalid tokens — do not expose algorithm validation details.',
+            userExperience: 'Use the invalid-token response defined by the authentication contract.',
         });
         scenarios.push({
-            scenario: `[${spec.id}] Expired Token Access: user presents an expired JWT. Does the API return 401 immediately, or does expired token reach business logic?`,
+            scenario: `[${spec.id}] Expired Token Access: user presents an expired JWT. Does the declared authentication failure occur before business logic?`,
             probability: 'medium',
             impact: 'high',
             currentHandling: 'Expiry check may not be the first middleware step — race conditions possible.',
-            requiredHandling: 'Verify token expiry (exp claim) as the first step in auth middleware. ' +
-                'Return 401 with error code "token_expired" so clients can trigger refresh flow.',
+            requiredHandling: 'Verify token expiry before business logic and use the expiration result defined by the authentication contract.',
             dataConsistency: 'Expired tokens must never modify state — check before any write operations.',
-            userExperience: 'Return structured error { "error": "token_expired" } so clients can refresh automatically.',
+            userExperience: 'Use the expiration and refresh behavior defined by the client contract.',
         });
     }
     // SQL injection challenges for DB features
@@ -62,28 +61,24 @@ export function generateSecurityChallengeScenarios(spec, _specContent, _knowledg
         });
     }
     // Role-based access challenges
-    const hasRoles = lower.includes('role') ||
-        lower.includes('admin') ||
-        lower.includes('permission') ||
-        lower.includes('rbac');
+    const hasRoles = hasAnyAffirmedMatch(signalText, [
+        /\b(?:role|admin|permission|rbac|access\s+control)\b/i,
+    ]);
     if (hasRoles) {
         scenarios.push({
             scenario: `[${spec.id}] Privilege Escalation via Role Manipulation: user with role "viewer" calls admin endpoint, or modifies JWT payload claiming role "admin". Role enforcement missing at middleware.`,
             probability: 'medium',
             impact: 'critical',
             currentHandling: 'Role enforcement may be per-handler instead of middleware — inconsistent coverage.',
-            requiredHandling: 'Enforce RBAC in middleware, not per-handler. ' +
-                'Never derive roles from user-supplied data; always load from a trusted store. ' +
-                'Log unauthorized access attempts for monitoring.',
+            requiredHandling: 'Enforce the declared role model consistently before protected behavior, load roles from the trusted identity boundary, and record the audit evidence required by the contract.',
             dataConsistency: 'Admin operations that modify state must verify role before any data mutation.',
-            userExperience: 'Return 403 Forbidden with a user-facing message — log the attempt with user ID for audit.',
+            userExperience: 'Use the forbidden-action response defined by the authorization contract.',
         });
     }
     // STRIDE elevation of privilege challenge for admin/payment
-    const isHighRisk = lower.includes('payment') ||
-        lower.includes('admin') ||
-        lower.includes('billing') ||
-        lower.includes('sensitive');
+    const isHighRisk = hasAnyAffirmedMatch(signalText, [
+        /\b(?:payment|billing|admin\s+operation|sensitive\s+operation)\b/i,
+    ]);
     if (isHighRisk) {
         scenarios.push({
             scenario: `[${spec.id}] STRIDE Elevation of Privilege: regular user performs a sequence of legitimate API calls that results in unintended elevated access (e.g., create → transfer → access with original permissions).`,