@planu/cli 5.3.43 → 5.3.44

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## [5.3.44] - 2026-08-24
+
+### Bug Fixes
+- fix(spec-1596): align check-readiness validator test double with getSpecFresh
+- fix(spec-1594): gate example-only PII identifiers behind boundary-aware collection cue
+- fix(spec-1593): gate suppress-family verbs so no-op consequence criteria are not misflagged
+- fix(spec-1595): make strict readiness report reflect edited spec body content
+
+
 ## [5.3.43] - 2026-08-24
 
 ### Bug Fixes

package/dist/config/pii-patterns.json

@@ -170,6 +170,37 @@
     "Tenant",
     "Visitor"
   ],
+  "collectionCueVerbs": [
+    "collect",
+    "store",
+    "process",
+    "persist",
+    "save",
+    "record",
+    "provide",
+    "must have",
+    "includ",
+    "contain",
+    "track",
+    "log",
+    "updat",
+    "requir",
+    "verif",
+    "authenticat",
+    "scan"
+  ],
+  "provenance": {
+    "nonAffirmingSectionKeywords": [
+      "example",
+      "examples",
+      "reproducer",
+      "test fixture",
+      "test fixtures",
+      "vocabulary",
+      "out of scope",
+      "out-of-scope"
+    ]
+  },
   "frameworks": {
     "GDPR": {
       "defaultRetentionDays": 730,

package/dist/engine/pii-detector/core.js

@@ -59,8 +59,49 @@ function isWhitelistedContext(modelContext) {
 function hasFieldCue(contextWindow) {
     return /\b(field|fields|column|columns|property|properties|attribute|schema|model|entity|table|class|interface)\b/i.test(contextWindow);
 }
+const COLLECTION_CUE_SUFFIXES = '(?:e|es|ed|ing|ion|ies|ied|ying|y|s)?';
+function escapeRegexLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function toCollectionCueBase(verb) {
+    return verb.endsWith('e') ? verb.slice(0, -1) : verb;
+}
+function buildCollectionCueRegex(verbs) {
+    const alternatives = verbs.flatMap((verb) => {
+        if (verb.includes(' ')) {
+            return [escapeRegexLiteral(verb)];
+        }
+        const base = toCollectionCueBase(verb);
+        const alts = [escapeRegexLiteral(base) + COLLECTION_CUE_SUFFIXES];
+        if (base === verb) {
+            const lastChar = base.slice(-1);
+            alts.push(escapeRegexLiteral(base + lastChar) + '(?:ed|ing)');
+        }
+        return alts;
+    });
+    return new RegExp(`\\b(?:${alternatives.join('|')})\\b`, 'i');
+}
+const collectionCueRegex = buildCollectionCueRegex(patterns.collectionCueVerbs);
 function hasCollectionCue(contextWindow) {
-    return /\b(collect|store|process|persist|save|record|provide|must have|includes?|contains?)\b/i.test(contextWindow);
+    return collectionCueRegex.test(contextWindow);
+}
+const HEADING_LINE_RE = /^#{1,6}\s+.+$/gm;
+function isNonAffirmingSection(text, index) {
+    const keywords = patterns.provenance?.nonAffirmingSectionKeywords ?? [];
+    if (keywords.length === 0) {
+        return false;
+    }
+    HEADING_LINE_RE.lastIndex = 0;
+    let lastHeading = '';
+    let match;
+    while ((match = HEADING_LINE_RE.exec(text)) !== null) {
+        if (match.index > index) {
+            break;
+        }
+        lastHeading = match[0];
+    }
+    const lowerHeading = lastHeading.toLowerCase();
+    return keywords.some((keyword) => lowerHeading.includes(keyword.toLowerCase()));
 }
 /**
  * Determines if a detected PII field is a GDPR Art. 9 special category.
@@ -121,9 +162,11 @@ function extractCandidates(text) {
         const wordIndex = lower.indexOf(word.toLowerCase());
         const contextWindow = cleaned.substring(Math.max(0, wordIndex - 100), wordIndex + 100);
         const context = inferModelContext(contextWindow);
-        if (isWhitelistedContext(context) ||
-            (hasFieldCue(contextWindow) && !isBlacklistedContext(contextWindow)) ||
-            (hasCollectionCue(contextWindow) && isWhitelistedContext(contextWindow))) {
+        const isBoundToCollection = hasCollectionCue(contextWindow) && !isNonAffirmingSection(cleaned, wordIndex);
+        if (isBoundToCollection &&
+            (isWhitelistedContext(context) ||
+                (hasFieldCue(contextWindow) && !isBlacklistedContext(contextWindow)) ||
+                (hasCollectionCue(contextWindow) && isWhitelistedContext(contextWindow)))) {
             candidates.push({ field: word, context });
         }
     }

package/dist/engine/readiness-checker.js

@@ -86,12 +86,24 @@ export function extractCriteriaLines(huContent) {
     const lines = huContent.split('\n');
     const criteria = [];
     let inCriteriaSection = false;
+    let criteriaHeadingLevel = 0;
     for (const raw of lines) {
         const line = raw.trim();
-        // Detect entering / leaving an Acceptance Criteria section
-        if (/^#{1,6}\s+/.test(line)) {
-            inCriteriaSection =
-                /^#{1,6}\s+(acceptance\s+criteria|criteria|criterios\s+de\s+aceptaci[oó]n|criterios)\b/i.test(line);
+        // Detect entering / leaving an Acceptance Criteria section. A heading
+        // deeper than the criteria heading (e.g. `### Scenario` nested under
+        // `## Acceptance Criteria`) stays inside the section — only a heading
+        // at the same or shallower level closes it.
+        const headingMatch = /^(#{1,6})\s+/.exec(line);
+        if (headingMatch?.[1] !== undefined) {
+            const level = headingMatch[1].length;
+            const isCriteriaHeading = /^#{1,6}\s+(acceptance\s+criteria|criteria|criterios\s+de\s+aceptaci[oó]n|criterios)\b/i.test(line);
+            if (isCriteriaHeading) {
+                inCriteriaSection = true;
+                criteriaHeadingLevel = level;
+            }
+            else if (level <= criteriaHeadingLevel) {
+                inCriteriaSection = false;
+            }
             continue;
         }
         // Form 1 — checkbox (always counts, regardless of section)
@@ -349,10 +361,12 @@ function checkSpecificityGate(spec, criteriaLines, fichaContent, anticipatedTest
     if (!hasFunctionName && !hasTypeName) {
         blockers.push(`Difficulty ${String(spec.difficulty)} spec requires at least 1 criterion with an exact function name (e.g. createFoo()) or type name (e.g. FooBar).`);
     }
-    // Detect anticipated test breaks: a test file path + "line N" (with optional ~) or "change ... from ... to"
+    const anticipatedTestBreaksHasTestPathWithNumber = /\d/.test(anticipatedTestBreaksContent) &&
+        [...extractFilePaths(anticipatedTestBreaksContent)].some((path) => /\.test\.[a-z0-9]+$/i.test(path));
     const hasTestBreak = /\btests?\/[a-zA-Z0-9/_.-]+\.test\.[a-z]+.*\bline\s+~?\d+/i.test(allText) ||
-        /\bchange\b.*\bfrom\b.*\bto\b/i.test(allText) ||
-        /\btests\/[a-zA-Z0-9/_.-]+\.test\.[a-z0-9]+(?![a-zA-Z0-9_.\\/-])[^\n]*\bline\s+~?\d+/i.test(anticipatedTestBreaksContent);
+        /\bchanges?\b.*\bfrom\b.*\bto\b/i.test(allText) ||
+        /\btests\/[a-zA-Z0-9/_.-]+\.test\.[a-z0-9]+(?![a-zA-Z0-9_.\\/-])[^\n]*\bline\s+~?\d+/i.test(anticipatedTestBreaksContent) ||
+        anticipatedTestBreaksHasTestPathWithNumber;
     if (!hasTestBreak) {
         blockers.push(`Difficulty ${String(spec.difficulty)} spec requires at least 1 anticipated test break ` +
             `(e.g. 'tests/api/foo.test.ts line 47: change count from 477 to 478').`);

package/dist/engine/scope-boundaries/contradiction-checker.js

@@ -100,7 +100,7 @@ function splitClauses(text) {
         .map((clause) => clause.trim())
         .filter(Boolean);
 }
-const AFFIRMATIVE_ACTION_VERBS = /\b(?:build(?:s|ing)?|chang(?:e|es|ing)|modif(?:y|ies|ying)|alter(?:s|ing)?|add(?:s|ing)?|introduc(?:e|es|ing)|implement(?:s|ing)?|enabl(?:e|es|ing)|expos(?:e|es|ing|ed)|mutat(?:e|es|ing)|rewrit(?:e|es|ing|ten)|remov(?:e|es|ing|ed)|relax(?:es|ing|ed)?|forc(?:e|es|ing))\b/;
+const AFFIRMATIVE_ACTION_VERBS = /\b(?:build(?:s|ing)?|chang(?:e|es|ing)|modif(?:y|ies|ying)|alter(?:s|ing)?|add(?:s|ing)?|introduc(?:e|es|ing)|implement(?:s|ing)?|enabl(?:e|es|ing)|expos(?:e|es|ing|ed)|mutat(?:e|es|ing)|rewrit(?:e|es|ing|ten)|remov(?:e|es|ing|ed)|relax(?:es|ing|ed)?|forc(?:e|es|ing)|suppress(?:es|ing|ed)?)\b/;
 function assertsForbiddenAction(text) {
     return AFFIRMATIVE_ACTION_VERBS.test(normalize(text));
 }

package/dist/engine/spec-quality-scorer.js

@@ -1,6 +1,6 @@
 // engine/spec-quality-scorer.ts — Spec quality scoring logic (SPEC-314)
 import { readFile } from 'node:fs/promises';
-import { readSpecTechnicalSection } from './spec-format/read-technical-section.js';
+import { extractSectionBody, readSpecTechnicalSection, } from './spec-format/read-technical-section.js';
 import { extractAcceptanceCriteriaTexts } from './spec-format/acceptance-criteria.js';
 import { stripFrontmatter } from './frontmatter-parser.js';
 // ── Constants ────────────────────────────────────────────────────────────────
@@ -327,7 +327,7 @@ function scoreAmbiguity(content, criteriaLines) {
         recommendations,
     };
 }
-function scoreRisk(spec, technicalContent) {
+function scoreRisk(spec, technicalContent, specBody) {
     const issues = [];
     const recommendations = [];
     let score = MAX_DIMENSION_SCORE;
@@ -364,8 +364,11 @@ function scoreRisk(spec, technicalContent) {
             'throughput',
             'sla',
             'nfr',
+            'non-functional',
         ];
-        const hasNfrs = nfrKeywords.some((k) => lowerTech.includes(k));
+        const hasNfrKeyword = nfrKeywords.some((k) => lowerTech.includes(k));
+        const hasNfrSubsection = extractSectionBody(specBody, 'Non-Functional Requirements').trim().length > 0;
+        const hasNfrs = hasNfrKeyword || hasNfrSubsection;
         if (!hasNfrs) {
             score -= 5;
             issues.push('No non-functional requirements found in technical spec');
@@ -401,7 +404,7 @@ export async function scoreSpecQuality(spec) {
     const completenessDetail = scoreCompleteness(spec, specContent);
     const testabilityDetail = scoreTestability(criteriaLines);
     const ambiguityDetail = scoreAmbiguity(specContent, criteriaLines);
-    const riskDetail = scoreRisk(spec, technicalContent);
+    const riskDetail = scoreRisk(spec, technicalContent, specContent);
     const total = completenessDetail.score + testabilityDetail.score + ambiguityDetail.score + riskDetail.score;
     const qualityScore = {
         total,

package/dist/tools/check-readiness.js

@@ -1,8 +1,36 @@
 // tools/check-readiness.ts — Completeness checkpoint tool (SPEC-039, SPEC-314, SPEC-716)
+import { readFile } from 'node:fs/promises';
 import { specStore } from '../storage/index.js';
 import { buildCheckReadinessSummary } from '../engine/human-summary.js';
 import { validateSpecFormat } from '../core/spec-validator.js';
+import { parseFrontmatter } from '../engine/frontmatter-parser.js';
 import { resolveProjectId } from './resolve-project-id.js';
+const VALID_DIFFICULTIES = [1, 2, 3, 4, 5];
+const VALID_SCOPES = ['trivial', 'feature', 'cross-module', 'architectural'];
+function asDifficulty(value) {
+    return VALID_DIFFICULTIES.find((candidate) => candidate === value);
+}
+function asSpecScope(value) {
+    return VALID_SCOPES.find((candidate) => candidate === value);
+}
+/**
+ * Re-derive difficulty/scope from the freshly-read spec.md frontmatter so the
+ * readiness gate honors on-disk edits instead of the specs.json snapshot that
+ * `specStore` caches in memory.
+ */
+async function readFreshDifficultyAndScope(specPath) {
+    try {
+        const raw = await readFile(specPath, 'utf-8');
+        const { metadata } = parseFrontmatter(raw);
+        return {
+            difficulty: asDifficulty(metadata.difficulty),
+            scope: asSpecScope(metadata.scope),
+        };
+    }
+    catch {
+        return {};
+    }
+}
 // ── Formatting helpers ───────────────────────────────────────────────────────
 const MAX_VISIBLE_BLOCKERS = 8;
 const MAX_VISIBLE_WARNINGS = 8;
@@ -120,7 +148,7 @@ export async function handleCheckReadiness(args) {
         };
     }
     const { specId, mode = 'strict' } = args;
-    const spec = await specStore.getSpec(projectId, specId);
+    const spec = await specStore.getSpecFresh(projectId, specId);
     if (!spec) {
         return {
             content: [
@@ -132,9 +160,15 @@ export async function handleCheckReadiness(args) {
             isError: true,
         };
     }
+    const fresh = spec.specPath ? await readFreshDifficultyAndScope(spec.specPath) : {};
+    const effectiveSpec = {
+        ...spec,
+        difficulty: fresh.difficulty ?? spec.difficulty,
+        scope: fresh.scope ?? spec.scope,
+    };
     // validateSpecFormat owns the readiness and quality evaluation so the response
     // cannot combine separately computed evidence from different reads of spec.md.
-    const validationResult = await validateSpecFormat(spec, { readinessMode: mode });
+    const validationResult = await validateSpecFormat(effectiveSpec, { readinessMode: mode });
     // SPEC-716: Ground ready flag in unified SpecValidationResult.
     // Only non-file-access errors from validateSpecFormat are surfaced in the
     // report — MISSING_FRONTMATTER due to file-not-found is best-effort since

package/dist/types/privacy.d.ts

@@ -119,6 +119,13 @@ export interface PiiFrameworkConfig {
     dataPortability: boolean;
     regions: string[];
 }
+/**
+ * Provenance guards that keep PII detection anchored to affirmative,
+ * data-collecting spec content rather than example enumerations.
+ */
+export interface PiiProvenanceConfig {
+    nonAffirmingSectionKeywords: string[];
+}
 /**
  * Full structure of pii-patterns.json.
  */
@@ -126,8 +133,10 @@ export interface PiiPatterns {
     vocabulary: Record<string, string[]>;
     modelContextBlacklist: string[];
     modelContextWhitelist: string[];
+    collectionCueVerbs: string[];
     frameworks: Record<string, PiiFrameworkConfig>;
     thirdPartySignatures: Record<string, string[]>;
+    provenance?: PiiProvenanceConfig;
 }
 /**
  * Input for the data_governance MCP tool.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.43",
+  "version": "5.3.44",
   "description": "Planu — MCP Server for Spec Driven Development. Cross-platform (Linux/macOS/Windows, x64/arm64).",
   "type": "module",
   "main": "dist/index.js",

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.43",
+  "version": "5.3.44",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",