@planu/cli 5.3.41 → 5.3.43

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [5.3.43] - 2026-08-24
+
+### Bug Fixes
+- fix(spec-1293): gate minimality install-command patterns by provenance/negation context
+- fix(spec-1277): match PII vocabulary by identifier segments and exact equality
+- fix(spec-1225): make formatSuccess idempotent to prevent double-wrapped success titles
+- fix(spec-1299): scan only comment tokens for debt markers, ignore string literals
+- fix(spec-1298): exclude generic test/path tokens from scope-boundary matching
+
+
+## [5.3.42] - 2026-08-23
+
+### Bug Fixes
+- fix(spec-1310): resolve relative --project-path at CLI boundary before lifecycle delegation
+
+
 ## [5.3.41] - 2026-08-23
 
 ### Bug Fixes

package/dist/cli/commands/status.js

@@ -1,5 +1,6 @@
 // cli/commands/status.ts — planu status <specId> [--set implementing] (SPEC-124)
 import { parseArgs } from 'node:util';
+import { resolve } from 'node:path';
 import { handleUpdateStatus } from '../../tools/update-status.js';
 import { handleUpdateStatusBatch } from '../../tools/update-status/batch.js';
 import { handlePlanStatus } from '../../tools/status-handler.js';
@@ -59,7 +60,11 @@ function parseStatusArgs(args) {
         strict: false,
         allowPositionals: true,
     });
-    return { values: parsed.values, positionals: parsed.positionals };
+    const values = parsed.values;
+    if (values['project-path']) {
+        values['project-path'] = resolve(values['project-path']);
+    }
+    return { values, positionals: parsed.positionals };
 }
 async function runProjectStatus(values, flags) {
     const result = await handlePlanStatus({

package/dist/config/minimal-implementation-gate.json

@@ -114,5 +114,36 @@
   "excludedPathPatterns": ["dist/**", "coverage/**", "node_modules/**", "pnpm-lock.yaml", "*.snap"],
   "debtEvidence": {
     "requiredFields": ["specId", "files", "ceiling", "upgradeTrigger", "reviewRationale"]
+  },
+  "provenance": {
+    "nonProposingSectionKeywords": [
+      "problem",
+      "reproducer",
+      "observed",
+      "expected",
+      "goal",
+      "user outcome",
+      "out of scope",
+      "non-goal",
+      "forbidden",
+      "anticipated test break",
+      "edge case",
+      "failure mode",
+      "challenge resolution"
+    ],
+    "negationCues": [
+      "do not",
+      "don't",
+      "must not",
+      "no new",
+      "add no",
+      "without adding",
+      "prohibit",
+      "no dependency",
+      "not add",
+      "never add",
+      "avoid adding",
+      "reuse "
+    ]
   }
 }

package/dist/engine/minimality/analyzer.js

@@ -24,6 +24,33 @@ function trimEvidence(value, maxChars) {
 function lineForMatch(content, index) {
     return content.slice(0, index).split('\n').length;
 }
+function lineTextAt(content, index) {
+    const start = content.lastIndexOf('\n', index - 1) + 1;
+    const stop = content.indexOf('\n', index);
+    return content.slice(start, stop < 0 ? content.length : stop);
+}
+function sectionHeadingForIndex(content, index) {
+    const linesBefore = content.slice(0, index).split('\n');
+    for (let i = linesBefore.length - 1; i >= 0; i -= 1) {
+        const line = linesBefore[i] ?? '';
+        if (/^#{1,6}\s/.test(line)) {
+            return line
+                .replace(/^#{1,6}\s+/, '')
+                .trim()
+                .toLowerCase();
+        }
+    }
+    return null;
+}
+function isNonProposingContext(content, index, provenance) {
+    const heading = sectionHeadingForIndex(content, index);
+    if (heading !== null &&
+        provenance.nonProposingSectionKeywords.some((keyword) => heading.includes(keyword.toLowerCase()))) {
+        return true;
+    }
+    const line = lineTextAt(content, index).toLowerCase();
+    return provenance.negationCues.some((cue) => line.includes(cue.toLowerCase()));
+}
 function ruleBlocksDone(rule, specRisk) {
     if (rule.severity !== 'blocker') {
         return false;
@@ -36,9 +63,24 @@ function ruleBlocksDone(rule, specRisk) {
 function makeEvidence(input, rule) {
     return [...(input.evidence ?? []), { source: 'policy', key: rule.id }];
 }
+function findProposingMatchIndex(content, pattern, provenance) {
+    const lowerContent = content.toLowerCase();
+    const lowerPattern = pattern.toLowerCase();
+    let searchFrom = 0;
+    for (;;) {
+        const index = lowerContent.indexOf(lowerPattern, searchFrom);
+        if (index < 0) {
+            return -1;
+        }
+        if (provenance === undefined || !isNonProposingContext(content, index, provenance)) {
+            return index;
+        }
+        searchFrom = index + 1;
+    }
+}
 function scanText(args) {
     for (const pattern of args.rule.patterns) {
-        const index = args.content.toLowerCase().indexOf(pattern.toLowerCase());
+        const index = findProposingMatchIndex(args.content, pattern, args.policy.provenance);
         if (index < 0) {
             continue;
         }

package/dist/engine/pii-detector/core.js

@@ -13,13 +13,31 @@ function normalizeField(name) {
     return name.toLowerCase().replace(/[_\-\s.]/g, '');
 }
 /**
- * Determines if a field name matches any PII vocabulary term.
- * Returns the matched category or null.
+ * Splits an identifier into its snake/kebab/dotted/camelCase segments,
+ * lowercased and deduplicated, preserving the original boundaries.
  */
-function matchVocabulary(normalizedField) {
+function splitIdentifierSegments(value) {
+    const withCamelBoundaries = value.replace(/([a-z0-9])([A-Z])/g, '$1 $2');
+    const segments = new Set();
+    for (const part of withCamelBoundaries.split(/[_\-\s.]+/)) {
+        const lower = part.toLowerCase();
+        if (lower.length > 0) {
+            segments.add(lower);
+        }
+    }
+    return Array.from(segments);
+}
+/**
+ * Determines if a candidate identifier matches any PII vocabulary term.
+ * A term matches only the full normalized identifier or one of its
+ * segments, by equality — never by containment.
+ */
+function matchVocabulary(candidate) {
+    const full = normalizeField(candidate);
+    const segments = splitIdentifierSegments(candidate);
     for (const [category, terms] of Object.entries(patterns.vocabulary)) {
         for (const term of terms) {
-            if (normalizedField === term || normalizedField.includes(term)) {
+            if (term === full || segments.includes(term)) {
                 return category;
             }
         }
@@ -97,7 +115,7 @@ function extractCandidates(text) {
         if (word.length < 3) {
             continue;
         }
-        if (matchVocabulary(normalizeField(word)) === null) {
+        if (matchVocabulary(word) === null) {
             continue;
         }
         const wordIndex = lower.indexOf(word.toLowerCase());
@@ -127,7 +145,7 @@ export function detectPIIInSpec(specTitle, specDescription, criteria) {
     const seen = new Set();
     for (const { field, context } of candidates) {
         const normalized = normalizeField(field);
-        const category = matchVocabulary(normalized);
+        const category = matchVocabulary(field);
         if (!category) {
             continue;
         }

package/dist/engine/scope-boundaries/scope-validator.js

@@ -32,6 +32,8 @@ const GENERIC_SEMANTIC_TOKENS = new Set([
     'semantic',
     'schema',
     'receipt',
+    'test',
+    'path',
 ]);
 function inflectionCandidates(token) {
     const candidates = [token];

package/dist/engine/validator/analyzer.js

@@ -300,6 +300,66 @@ export function classifyDriftSeverity(criterion) {
     }
     return 'low';
 }
+function commentSyntaxFor(ext) {
+    if (ext === '.py' || ext === '.rb') {
+        return { lineTokens: ['#'], block: false };
+    }
+    if (ext === '.php') {
+        return { lineTokens: ['//', '#'], block: true };
+    }
+    return { lineTokens: ['//'], block: true };
+}
+function extractCommentSegments(lines, syntax) {
+    const segments = [];
+    let inBlock = false;
+    for (const line of lines) {
+        let comment = '';
+        let inString = null;
+        let j = 0;
+        while (j < line.length) {
+            const ch = line.charAt(j);
+            if (inBlock) {
+                if (ch === '*' && line.charAt(j + 1) === '/') {
+                    inBlock = false;
+                    j += 2;
+                    continue;
+                }
+                comment += ch;
+                j++;
+                continue;
+            }
+            if (inString !== null) {
+                if (ch === '\\') {
+                    j += 2;
+                    continue;
+                }
+                if (ch === inString) {
+                    inString = null;
+                }
+                j++;
+                continue;
+            }
+            const lineTok = syntax.lineTokens.find((t) => line.startsWith(t, j));
+            if (lineTok !== undefined) {
+                comment += line.slice(j + lineTok.length);
+                break;
+            }
+            if (syntax.block && ch === '/' && line.charAt(j + 1) === '*') {
+                inBlock = true;
+                j += 2;
+                continue;
+            }
+            if (ch === '"' || ch === "'" || ch === '`') {
+                inString = ch;
+                j++;
+                continue;
+            }
+            j++;
+        }
+        segments.push(comment);
+    }
+    return segments;
+}
 /**
  * Run lightweight quality checks on a single file and return any findings.
  */
@@ -337,9 +397,10 @@ export async function quickQualityCheck(file, projectPath) {
             });
         }
         // Check for TODO/FIXME/HACK
+        const commentSegments = extractCommentSegments(lines, commentSyntaxFor(ext));
         for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
-            if (line !== undefined && /\b(TODO|FIXME|HACK|XXX)\b/.exec(line)) {
+            const segment = commentSegments[i];
+            if (segment !== undefined && /\b(TODO|FIXME|HACK|XXX)\b/.exec(segment)) {
                 findings.push({
                     file,
                     line: i + 1,

package/dist/tools/response-helpers.js

@@ -2,12 +2,31 @@
 import { t, ti } from '../i18n/index.js';
 import { compactJson } from './output-formatter.js';
 import { getDirectiveText, getHumanSummaryPrefix } from '../engine/host-rules-templates/index.js';
+function stripSuccessDecoration(title) {
+    let current = title.trim();
+    let changed = true;
+    while (changed) {
+        changed = false;
+        if (current.startsWith('✅')) {
+            current = current.slice(1).trimStart();
+            changed = true;
+        }
+        if (current.startsWith('**') && current.endsWith('**') && current.length >= 4) {
+            const inner = current.slice(2, -2);
+            if (!inner.includes('**')) {
+                current = inner.trim();
+                changed = true;
+            }
+        }
+    }
+    return current;
+}
 /**
  * Format a success response with optional next steps.
  * Output: ✅ **{title}**\n\n{body}\n\n🚀 **Next Steps**\n1. ...\n2. ...
  */
 export function formatSuccess(title, body, nextSteps) {
-    const header = `✅ **${title}**`;
+    const header = `✅ **${stripSuccessDecoration(title)}**`;
     const parts = [header, '', body];
     if (nextSteps && nextSteps.length > 0) {
         parts.push('', t('tools.response.nextSteps'));

package/dist/types/minimal-implementation-gate.d.ts

@@ -19,6 +19,10 @@ export interface MinimalImplementationRule {
     replacementGuidance: string;
     blockWhenRiskAtLeast?: 'low' | 'medium' | 'high' | 'max';
 }
+export interface MinimalImplementationProvenance {
+    nonProposingSectionKeywords: string[];
+    negationCues: string[];
+}
 export interface MinimalImplementationPolicy {
     version: 1;
     enabled: boolean;
@@ -36,6 +40,7 @@ export interface MinimalImplementationPolicy {
     debtEvidence: {
         requiredFields: string[];
     };
+    provenance?: MinimalImplementationProvenance;
 }
 export interface LoadedMinimalImplementationPolicy {
     policy: MinimalImplementationPolicy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.41",
+  "version": "5.3.43",
   "description": "Planu — MCP Server for Spec Driven Development. Cross-platform (Linux/macOS/Windows, x64/arm64).",
   "type": "module",
   "main": "dist/index.js",

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.41",
+  "version": "5.3.43",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",