@planu/cli 4.14.1 → 5.1.1

package/dist/engine/readiness-checker.js

@@ -1,6 +1,6 @@
 // engine/readiness-checker.ts — Spec readiness evaluation for implementation gate (SPEC-039)
 import { readFile } from 'node:fs/promises';
-import { readSpecTechnicalSection } from './spec-format/read-technical-section.js';
+import { extractSectionBody, readSpecTechnicalSection, } from './spec-format/read-technical-section.js';
 import { stripFrontmatter } from './frontmatter-parser.js';
 import { loadReadinessConfig } from './readiness-config-loader.js';
 import { runEarsGate } from './ears-gate.js';
@@ -233,7 +233,7 @@ export function detectTechnicalPlaceholder(body) {
 /**
  * SPEC-784: Returns true when the ## Technical body is too shallow:
  * fewer than TECHNICAL_MIN_CHARS characters AND contains zero file
- * paths under src/ or tests/.
+ * safe repository-relative file paths.
  */
 export function detectTechnicalTooShallow(body) {
     const section = extractTechnicalSection(body);
@@ -244,9 +244,7 @@ export function detectTechnicalTooShallow(body) {
     if (section.length >= TECHNICAL_MIN_CHARS) {
         return false;
     }
-    // Has at least one file path under src/ or tests/ → not too shallow
-    const hasFilePaths = /\b(?:src|tests)\/[a-zA-Z0-9/_.-]+\.[a-z]+\b/.test(section);
-    return !hasFilePaths;
+    return extractFilePaths(section).size === 0;
 }
 // ── SPEC-629 / SPEC-777: Specificity gate helpers ────────────────────────────
 /**
@@ -260,18 +258,27 @@ export function detectTechnicalTooShallow(body) {
  */
 export function extractFilePaths(text) {
     const found = new Set();
-    // Match paths that look like <dir>/<rest>.<ext> where dir is a valid identifier
-    // Works inside backticks, after commas/spaces, after FILES: markers
-    const RE = /(?:[`\s,]|^|FILES:\s*)([a-zA-Z][a-zA-Z0-9_-]*(?:\/[a-zA-Z0-9_.-]+)+\.[a-zA-Z]{1,6})(?=[`\s,\n)]|$)/g;
+    const RE = /(?<![a-zA-Z0-9_./\\-])([a-zA-Z0-9_.-]+(?:\/[a-zA-Z0-9_.-]+)*\.[a-zA-Z][a-zA-Z0-9]*)(?=[`"'\s,):;.!?]|$)/g;
     let m;
     while ((m = RE.exec(text)) !== null) {
         const p = m[1];
-        if (p !== undefined) {
+        if (p !== undefined && isSafeRepositoryFilePath(p)) {
             found.add(p);
         }
     }
     return found;
 }
+function isSafeRepositoryFilePath(path) {
+    const segments = path.split('/');
+    const filename = segments.at(-1) ?? '';
+    const extensionIndex = filename.lastIndexOf('.');
+    return (path.length > 0 &&
+        !path.startsWith('/') &&
+        !/^[a-zA-Z]:/u.test(path) &&
+        segments.every((segment) => segment.length > 0 && segment !== '.' && segment !== '..') &&
+        extensionIndex > 0 &&
+        extensionIndex < filename.length - 1);
+}
 /**
  * Extract function/method names from text.
  * Recognises:
@@ -294,27 +301,21 @@ export function extractFunctionNames(text) {
 // ── SPEC-629: Specificity gate (difficulty >= 3) ────────────────────────────
 /**
  * For specs with difficulty >= 3, enforces that criteria contain:
- * - 3+ concrete file paths (src/ or tests/)
+ * - 3+ concrete repository-relative file paths
  * - 1+ criterion with exact function/type name
  * - 1+ anticipated test break (file + line number)
  * Returns blocker strings; empty array = gate passed.
  */
-function checkSpecificityGate(spec, criteriaLines, fichaContent) {
+function checkSpecificityGate(spec, criteriaLines, fichaContent, anticipatedTestBreaksContent) {
     if (spec.difficulty < 3) {
         return [];
     }
     const allText = [...criteriaLines, fichaContent].join('\n');
     const blockers = [];
-    // Count distinct file paths in src/ or tests/ — use enhanced extractor (SPEC-777)
     const uniquePaths = extractFilePaths(allText);
-    // Also keep the legacy word-boundary regex for backward compat with bare paths not in backticks
-    const legacyMatches = allText.match(/\b(?:src|tests)\/[a-zA-Z0-9/_.-]+\.[a-z]+\b/g) ?? [];
-    for (const p of legacyMatches) {
-        uniquePaths.add(p);
-    }
     if (uniquePaths.size < 3) {
-        blockers.push(`Difficulty ${String(spec.difficulty)} spec requires 3+ concrete file paths in criteria (src/ or tests/) — found ${String(uniquePaths.size)}. ` +
-            `Add exact paths like 'src/engine/foo/bar.ts'.`);
+        blockers.push(`Difficulty ${String(spec.difficulty)} spec requires 3+ concrete repository-relative file paths in criteria — found ${String(uniquePaths.size)}. ` +
+            `Add exact paths like 'scripts/check-contract.mjs'.`);
     }
     // Detect function calls via enhanced extractor + legacy regex (SPEC-777)
     const functionNames = extractFunctionNames(allText);
@@ -325,7 +326,8 @@ function checkSpecificityGate(spec, criteriaLines, fichaContent) {
     }
     // Detect anticipated test breaks: a test file path + "line N" (with optional ~) or "change ... from ... to"
     const hasTestBreak = /\btests?\/[a-zA-Z0-9/_.-]+\.test\.[a-z]+.*\bline\s+~?\d+/i.test(allText) ||
-        /\bchange\b.*\bfrom\b.*\bto\b/i.test(allText);
+        /\bchange\b.*\bfrom\b.*\bto\b/i.test(allText) ||
+        /\btests\/[a-zA-Z0-9/_.-]+\.test\.[a-z0-9]+(?![a-zA-Z0-9_.\\/-])[^\n]*\bline\s+~?\d+/i.test(anticipatedTestBreaksContent);
     if (!hasTestBreak) {
         blockers.push(`Difficulty ${String(spec.difficulty)} spec requires at least 1 anticipated test break ` +
             `(e.g. 'tests/api/foo.test.ts line 47: change count from 477 to 478').`);
@@ -333,76 +335,12 @@ function checkSpecificityGate(spec, criteriaLines, fichaContent) {
     return blockers;
 }
 // ── Public API ───────────────────────────────────────────────────────────────
-/**
- * SPEC-769: Pure in-memory readiness check — no file I/O.
- * Accepts the raw spec.md content (including frontmatter) and returns a quick
- * score + warnings without loading technical.md or any additional file.
- *
- * Scoring (max 100):
- *  - Base (title/metadata present): 20
- *  - Criteria: 0 | 20 | 35 | 50  (0 / 1-2 / 3-4 / 5+)
- *  - Technical files (src/*.ts paths found in body): 30
- */
-export function checkReadinessInternal(body) {
-    const bodyContent = stripFrontmatter(body);
-    const normalizedCriteria = extractNormalizedAcceptanceCriteria(body);
-    const criteriaLines = normalizedCriteria.map((criterion) => criterion.text);
-    const scenarioCount = criteriaLines.length === 0 ? countFrontmatterScenarios(body) : 0;
-    const criteriaCount = criteriaLines.length > 0 ? criteriaLines.length : scenarioCount;
-    const config = loadReadinessConfig();
-    const vagueWords = config.vagueWords.map((v) => v.word);
-    const warnings = [];
-    // Score based on criteria count
-    let criteriaScore;
-    if (criteriaCount === 0) {
-        criteriaScore = 0;
-        warnings.push('No acceptance criteria found — add at least 3 testable criteria');
-    }
-    else if (criteriaCount >= 5) {
-        criteriaScore = 50;
-    }
-    else if (criteriaCount >= 3) {
-        criteriaScore = 35;
-    }
-    else {
-        criteriaScore = 20;
-        warnings.push('Add more acceptance criteria (need at least 3 for adequate readiness)');
-    }
-    // Vague criteria detection (re-uses existing logic)
-    const criteriaResult = scoreCriteria(criteriaLines.length > 0 ? criteriaLines : [], vagueWords);
-    warnings.push(...criteriaResult.warnings);
-    // Technical files presence (proxy for inline ## Technical — check src/ paths in body)
-    const hasTechnicalFiles = /\bsrc\/[^\s]+\.[jt]s\b/.test(bodyContent);
-    const technicalScore = hasTechnicalFiles ? 30 : 0;
-    if (!hasTechnicalFiles && criteriaCount > 0) {
-        warnings.push('No source file paths (e.g. src/engine/foo.ts) found — add file entries in ## Technical section');
-    }
-    // SPEC-784: Technical section quality gates
-    // Run both detectors against the raw body (includes ## Technical heading)
-    if (detectTechnicalPlaceholder(bodyContent)) {
-        warnings.push('TECHNICAL_PLACEHOLDER_DETECTED: ## Technical section contains a placeholder pointer ' +
-            '(e.g. "See technical.md") — inline the content instead of deferring to another file');
-    }
-    if (detectTechnicalTooShallow(bodyContent)) {
-        warnings.push('TECHNICAL_TOO_SHALLOW: ## Technical section is too short (< 500 chars) and has no ' +
-            'src/ or tests/ file paths — add concrete file paths and implementation details');
-    }
-    // Base points (title present, valid structure)
-    const baseScore = 20;
-    // When any SPEC-784 technical blocker is present, cap the score at 0 so the
-    // approval gate hard-blocks (score < 70 with no-forceApprove path).
-    const technicalBlockerCount = warnings.filter((w) => w.startsWith('TECHNICAL_PLACEHOLDER_DETECTED') || w.startsWith('TECHNICAL_TOO_SHALLOW')).length;
-    if (technicalBlockerCount > 0) {
-        return { score: 0, warnings, criteriaCount };
-    }
-    const score = Math.min(100, baseScore + criteriaScore + technicalScore);
-    return { score, warnings, criteriaCount };
-}
 export async function checkSpecReadiness(spec, mode, projectHash) {
     const config = loadReadinessConfig(projectHash);
     const vagueWords = config.vagueWords.map((v) => v.word);
     const huRaw = await readHuRaw(spec);
     const huContent = stripFrontmatter(huRaw);
+    const anticipatedTestBreaksContent = extractSectionBody(huRaw, 'Anticipated Test Breaks');
     const fichaContent = await readFichaContent(spec);
     const normalizedCriteria = extractNormalizedAcceptanceCriteria(huRaw);
     const canonicalCriteriaLines = normalizedCriteria.map((criterion) => criterion.text);
@@ -414,6 +352,7 @@ export async function checkSpecReadiness(spec, mode, projectHash) {
     // evidence model so specificity gates still see exact test paths and line refs.
     const scenarioCriteria = usesFrontmatterAsCanonical ? frontmatterScenarioCriteria(huRaw) : [];
     const effectiveCriteriaLines = scenarioCriteria.length > 0 ? scenarioCriteria : canonicalCriteriaLines;
+    const specificityEvidenceLines = [...scenarioCriteria, ...extractCriteriaLines(huContent)];
     const hu = scoreHuCompleteness(spec);
     const criteria = scoreCriteria(effectiveCriteriaLines, vagueWords);
     const files = scoreFilesIdentified(spec, fichaContent);
@@ -450,11 +389,11 @@ export async function checkSpecReadiness(spec, mode, projectHash) {
     }
     if (detectTechnicalTooShallow(huContent)) {
         allBlockers.push('TECHNICAL_TOO_SHALLOW: ## Technical section is too short (< 500 chars) and has no ' +
-            'src/ or tests/ file paths — add concrete file paths and implementation details');
+            'repository-relative file paths — add concrete file paths and implementation details');
     }
     // SPEC-629: Specificity gate caps score at 60 for difficulty >= 3 specs that lack
     // concrete file paths, function names, or anticipated test breaks.
-    const specificityBlockers = checkSpecificityGate(spec, effectiveCriteriaLines, fichaContent);
+    const specificityBlockers = checkSpecificityGate(spec, specificityEvidenceLines, fichaContent, anticipatedTestBreaksContent);
     allBlockers.push(...specificityBlockers);
     const effectiveScore = specificityBlockers.length > 0 && spec.difficulty >= 3 ? Math.min(totalScore, 60) : totalScore;
     const breakdown = {
@@ -481,7 +420,7 @@ export async function checkSpecReadiness(spec, mode, projectHash) {
     const isReady = effectiveScore >= cautionThreshold && allBlockers.length === 0;
     const recommendations = buildRecommendations(effectiveScore, hu.points, criteria.points, files.points, deps.points);
     if (specificityBlockers.length > 0) {
-        recommendations.push('Add exact file paths (src/ or tests/), function names (e.g. createFoo()), and anticipated test breaks to unlock implementation for this difficulty spec.');
+        recommendations.push('Add exact repository-relative file paths, function names (e.g. createFoo()), and anticipated test breaks to unlock implementation for this difficulty spec.');
     }
     return {
         specId: spec.id,

package/dist/engine/reverse-engineer/api-detector.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const ROUTE_PATTERNS = [
     // Express/Koa/Hono: app.get('/path', handler) or router.post(...)
     {
@@ -69,18 +70,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.kt',
     '.rb',
 ]);
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 function collectSourceFiles(dir) {
     const results = [];
     const queue = [dir];
@@ -97,7 +86,7 @@ function collectSourceFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/complexity-analyzer.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const SOURCE_EXTENSIONS = new Set([
     '.ts',
     '.tsx',
@@ -14,18 +15,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.rs',
     '.rb',
 ]);
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 // Patterns that increase cyclomatic complexity
 const BRANCH_PATTERNS = [
     /\bif\s*\(/g,
@@ -73,7 +62,7 @@ function collectSourceFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/config-analyzer.js

@@ -1,6 +1,7 @@
 import { technologyValue } from '../technology-registry.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const ENV_VAR_PATTERNS = [
     // JS/TS: process.env.VAR_NAME
     /process\.env\.([A-Z_][A-Z0-9_]*)/g,
@@ -55,18 +56,6 @@ const INFRA_INDICATORS = {
     'azure-pipelines.yml': 'Azure Pipelines',
     'cloudbuild.yaml': 'Google Cloud Build',
 };
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 const SOURCE_EXTENSIONS = new Set([
     '.ts',
     '.tsx',
@@ -97,7 +86,7 @@ function collectAllFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/dependency-graph.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const IMPORT_PATTERNS = [
     // ES import: import ... from './foo'
     /(?:import\s+(?:[\s\S]*?)\s+from\s+['"]([^'"]+)['"])/g,
@@ -22,18 +23,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.rs',
     '.rb',
 ]);
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 const HUB_THRESHOLD = 10;
 function collectSourceFiles(dir) {
     const results = [];
@@ -51,7 +40,7 @@ function collectSourceFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/test-analyzer.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { shouldIgnoreDir } from './walk-ignore.js';
 const TEST_PATTERNS = [
     /\.test\.\w+$/,
     /\.spec\.\w+$/,
@@ -25,18 +26,6 @@ const SOURCE_EXTENSIONS = new Set([
     '.c',
     '.swift',
 ]);
-const IGNORE_DIRS = new Set([
-    'node_modules',
-    '.git',
-    'dist',
-    'build',
-    'out',
-    '.next',
-    '.nuxt',
-    'coverage',
-    'vendor',
-    '__pycache__',
-]);
 export function isTestFile(filePath) {
     const basename = path.basename(filePath);
     if (TEST_PATTERNS.some((p) => p.test(basename))) {
@@ -61,7 +50,7 @@ function collectFiles(dir) {
             continue;
         }
         for (const entry of entries) {
-            if (IGNORE_DIRS.has(entry.name)) {
+            if (shouldIgnoreDir(entry.name)) {
                 continue;
             }
             const full = path.join(current, entry.name);

package/dist/engine/reverse-engineer/walk-ignore.d.ts

@@ -0,0 +1,3 @@
+export declare const WALK_IGNORE_DIRS: ReadonlySet<string>;
+export declare function shouldIgnoreDir(name: string): boolean;
+//# sourceMappingURL=walk-ignore.d.ts.map

package/dist/engine/reverse-engineer/walk-ignore.js

@@ -0,0 +1,26 @@
+// engine/reverse-engineer/walk-ignore.ts — shared directory-walk ignore list
+// Consumed by all reverse-engineer analyzers (dependency-graph, test-analyzer,
+// api-detector, config-analyzer, complexity-analyzer) so the ignore rules stay
+// in one place instead of five duplicated copies.
+export const WALK_IGNORE_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    'out',
+    '.next',
+    '.nuxt',
+    'coverage',
+    'vendor',
+    '__pycache__',
+    '.worktrees',
+    '.claude',
+    'planu',
+    'website',
+    'data',
+    'benchmarks',
+]);
+export function shouldIgnoreDir(name) {
+    return WALK_IGNORE_DIRS.has(name);
+}
+//# sourceMappingURL=walk-ignore.js.map

package/dist/engine/runtime-policy.d.ts

@@ -1,4 +1,6 @@
 import type { BoundedDurationPolicy, RuntimePolicy } from '../types/runtime-policy.js';
+/** Validate an in-memory policy fixture without mutating the process cache. */
+export declare function parseRuntimePolicyForTests(raw: unknown): RuntimePolicy;
 /** Load the validated bundled runtime authority once per process. */
 export declare function getRuntimePolicy(): RuntimePolicy;
 /** Resolve a numeric environment override without duplicating policy bounds. */

package/dist/engine/runtime-policy.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { createRequire } from 'node:module';
+import { PROCESS_TERMINATION_GRACE_MS } from './abortable-process-runner.js';
 const boundedDurationSchema = z
     .object({
     defaultTimeoutMs: z.number().int().positive(),
@@ -45,11 +46,22 @@ const runtimePolicySchema = z
     validation: z
         .object({
         defaultDeadlineMs: z.number().int().positive(),
+        durableLintTimeoutMs: z.number().int().positive(),
+        complianceCommandTimeoutMs: z.number().int().positive(),
+        noProgressTimeoutMs: z.number().int().positive(),
         submissionLockWaitMs: z.number().int().positive(),
         submissionLockPollMs: z.number().int().positive(),
         workerLeaseMs: z.number().int().positive(),
         workerHeartbeatMs: z.number().int().positive(),
         workerConcurrency: z.number().int().positive(),
+        heartbeatStartupTimeoutMs: z.number().int().positive(),
+        heartbeatShutdownTimeoutMs: z.number().int().positive(),
+        heartbeatDatabaseBusyTimeoutMs: z.number().int().positive(),
+        freshnessLeaseTtlMs: z.number().int().positive(),
+        freshnessInvalidationCoalesceMs: z.number().int().positive(),
+        receiptPublicationDeadlineMs: z.number().int().positive(),
+        receiptCheckpointLogMaxBytes: z.number().int().positive(),
+        receiptCheckpointResultMaxBytes: z.number().int().positive(),
     })
         .strict()
         .refine((value) => value.submissionLockPollMs < value.submissionLockWaitMs, {
@@ -57,6 +69,27 @@ const runtimePolicySchema = z
     })
         .refine((value) => value.workerHeartbeatMs < value.workerLeaseMs, {
         message: 'workerHeartbeatMs must be below workerLeaseMs',
+    })
+        .refine((value) => value.durableLintTimeoutMs < value.complianceCommandTimeoutMs, {
+        message: 'durableLintTimeoutMs must be below complianceCommandTimeoutMs',
+    })
+        .refine((value) => value.complianceCommandTimeoutMs + PROCESS_TERMINATION_GRACE_MS <
+        value.noProgressTimeoutMs, {
+        message: 'complianceCommandTimeoutMs plus termination grace must be below noProgressTimeoutMs',
+    })
+        .refine((value) => value.complianceCommandTimeoutMs < value.defaultDeadlineMs, {
+        message: 'complianceCommandTimeoutMs must be below defaultDeadlineMs',
+    })
+        .refine((value) => value.noProgressTimeoutMs < value.defaultDeadlineMs, {
+        message: 'noProgressTimeoutMs must be below defaultDeadlineMs',
+    })
+        .refine((value) => value.heartbeatDatabaseBusyTimeoutMs < value.workerLeaseMs - value.workerHeartbeatMs, { message: 'heartbeatDatabaseBusyTimeoutMs must fit within the worker lease' })
+        .refine((value) => value.freshnessInvalidationCoalesceMs < value.freshnessLeaseTtlMs, {
+        message: 'freshnessInvalidationCoalesceMs must be below freshnessLeaseTtlMs',
+    })
+        .refine((value) => value.receiptPublicationDeadlineMs <= value.workerLeaseMs - value.workerHeartbeatMs, { message: 'receiptPublicationDeadlineMs must fit within the worker lease' })
+        .refine((value) => value.receiptCheckpointLogMaxBytes <= value.receiptCheckpointResultMaxBytes, {
+        message: 'receiptCheckpointLogMaxBytes must not exceed receiptCheckpointResultMaxBytes',
     }),
     postCommit: z
         .object({
@@ -71,15 +104,19 @@ const runtimePolicySchema = z
     .strict();
 const require = createRequire(import.meta.url);
 let cachedPolicy;
+/** Validate an in-memory policy fixture without mutating the process cache. */
+export function parseRuntimePolicyForTests(raw) {
+    const parsed = runtimePolicySchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new Error(`Invalid bundled runtime-policy config: ${parsed.error.message}`);
+    }
+    return parsed.data;
+}
 /** Load the validated bundled runtime authority once per process. */
 export function getRuntimePolicy() {
     if (cachedPolicy === undefined) {
         const raw = require('../config/runtime-policy.json');
-        const parsed = runtimePolicySchema.safeParse(raw);
-        if (!parsed.success) {
-            throw new Error(`Invalid bundled runtime-policy config: ${parsed.error.message}`);
-        }
-        cachedPolicy = parsed.data;
+        cachedPolicy = parseRuntimePolicyForTests(raw);
     }
     return cachedPolicy;
 }

package/dist/engine/runtime-security/rate-limiter.js

@@ -10,7 +10,6 @@ const READ_TOOLS = new Set([
     'estimate',
     'semantic_search',
     'list_groups',
-    'license_status',
     'usage_stats',
     'usage_report',
     'spec_history',

package/dist/engine/safety/contained-project-file.d.ts

@@ -0,0 +1,3 @@
+/** Resolve a currently existing regular file whose physical path is contained by a project root. */
+export declare function resolveContainedProjectFile(projectPath: string, candidatePath: string): Promise<string>;
+//# sourceMappingURL=contained-project-file.d.ts.map

package/dist/engine/safety/contained-project-file.js

@@ -0,0 +1,23 @@
+import { lstat, realpath } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+function isOutside(root, candidate) {
+    const pathFromRoot = relative(root, candidate);
+    return pathFromRoot === '..' || pathFromRoot.startsWith(`..${sep}`) || isAbsolute(pathFromRoot);
+}
+/** Resolve a currently existing regular file whose physical path is contained by a project root. */
+export async function resolveContainedProjectFile(projectPath, candidatePath) {
+    const lexicalRoot = resolve(projectPath);
+    const lexicalCandidate = resolve(candidatePath);
+    const [projectRealPath, candidateRealPath, candidateStatus] = await Promise.all([
+        realpath(lexicalRoot),
+        realpath(lexicalCandidate),
+        lstat(lexicalCandidate),
+    ]);
+    if (candidateStatus.isSymbolicLink() ||
+        !candidateStatus.isFile() ||
+        isOutside(projectRealPath, candidateRealPath)) {
+        throw new Error('CONTAINED_PROJECT_FILE_REJECTED: candidate is not a contained regular file');
+    }
+    return candidateRealPath;
+}
+//# sourceMappingURL=contained-project-file.js.map

package/dist/engine/scope-boundaries/contradiction-checker.js

@@ -43,6 +43,58 @@ function keywords(phrase) {
         .split(' ')
         .filter((w) => w.length > 3 && !STOP_WORDS.has(w));
 }
+/** Return true only for explicit language that preserves an existing boundary. */
+function preservesBoundary(text) {
+    const normalized = normalize(text);
+    return [
+        /\bremains? unchanged\b/,
+        /\bkeeps?\b.{0,80}\bunchanged\b/,
+        /\bpreserves?\b.{0,80}\b(?:behavior|contract|boundary|semantics|state)\b/,
+        /\bwithout (?:any )?(?:changing|modifying|altering|adding|introducing)\b/,
+        /\b(?:does|do|must|will|should) not (?:change|modify|alter|add|introduce|implement|enable)\b/,
+        /\bno changes? to\b/,
+    ].some((pattern) => pattern.test(normalized));
+}
+function splitClauses(text) {
+    return text
+        .split(/\b(?:but|while|although|however)\b|[,;.]/i)
+        .map((clause) => clause.trim())
+        .filter(Boolean);
+}
+function hasAffirmativeDrift(text, outOfScopeItem) {
+    const action = /\b(?:changes?|modif(?:y|ies)|alters?|adds?|introduces?|implements?|enables?)\b/g;
+    const actionSegments = text.split(/\band\b/i).map(normalize);
+    for (const [index, segment] of actionSegments.entries()) {
+        const inheritsRelevantSubject = index > 0 &&
+            /^(?:changes?|modif(?:y|ies)|alters?|adds?|introduces?|implements?|enables?)\b/.test(segment) &&
+            clauseMatchesScope(actionSegments[index - 1] ?? '', outOfScopeItem);
+        for (const match of segment.matchAll(action)) {
+            const before = segment.slice(Math.max(0, match.index - 24), match.index);
+            const after = segment.slice(match.index + match[0].length);
+            if (/\b(?:not|without|no)\s*$/.test(before)) {
+                continue;
+            }
+            if (/^\s+remains? unchanged\b/.test(after)) {
+                continue;
+            }
+            if (inheritsRelevantSubject || clauseMatchesScope(segment, outOfScopeItem)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function clauseMatchesScope(clause, outOfScopeItem) {
+    const normalizedClause = normalize(clause);
+    const normalizedScope = normalize(outOfScopeItem);
+    if (normalizedClause.includes(normalizedScope) || normalizedScope.includes(normalizedClause)) {
+        return true;
+    }
+    const scopeKeywords = keywords(outOfScopeItem);
+    const matchCount = scopeKeywords.filter((keyword) => normalizedClause.includes(keyword)).length;
+    const threshold = scopeKeywords.length <= 2 ? scopeKeywords.length : 2;
+    return scopeKeywords.length > 0 && matchCount >= threshold;
+}
 /**
  * Determine whether a criterion text contradicts an out-of-scope item.
  * Uses substring match first, then keyword overlap as fuzzy fallback.
@@ -50,6 +102,13 @@ function keywords(phrase) {
 function contradicts(criterionText, outOfScopeItem) {
     const normCriterion = normalize(criterionText);
     const normScope = normalize(outOfScopeItem);
+    const relevantClauses = splitClauses(criterionText).filter((clause) => clauseMatchesScope(clause, outOfScopeItem));
+    const hasConditionalException = /\b(?:unless|except)\b/i.test(criterionText);
+    if (!hasConditionalException &&
+        relevantClauses.length > 0 &&
+        relevantClauses.every((clause) => preservesBoundary(clause) && !hasAffirmativeDrift(clause, outOfScopeItem))) {
+        return false;
+    }
     // 1. Direct substring match
     if (normCriterion.includes(normScope)) {
         return true;
@@ -74,9 +133,12 @@ function contradicts(criterionText, outOfScopeItem) {
  */
 export function checkContradictions(outOfScope, criteria) {
     const contradictions = [];
+    const seenPairs = new Set();
     for (const criterion of criteria) {
         for (const scopeItem of outOfScope) {
-            if (contradicts(criterion, scopeItem)) {
+            const pairKey = `${normalize(criterion)}\u0000${normalize(scopeItem)}`;
+            if (!seenPairs.has(pairKey) && contradicts(criterion, scopeItem)) {
+                seenPairs.add(pairKey);
                 contradictions.push({ criterion, contradicts: scopeItem });
             }
         }