@planu/cli 5.3.45 → 5.3.46

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [5.3.46] - 2026-08-24
+
+### Bug Fixes
+- fix(spec-1285): meta filter sees backticked tool token; harden AC1 coverage
+- fix(spec-1285): stop local privacy specs activating auth/meta challenge families
+
+### Chores
+- chore(planu): record SPEC-1285 done and SPEC-1598 discarded (merged into SPEC-1285)
+
+
 ## [5.3.45] - 2026-08-24
 
 ### Bug Fixes

package/dist/engine/text-signal-boundaries.js

@@ -25,6 +25,7 @@ const EXPECTED_META_ANALYSIS_RE = /^\s*expected\s*:(?=[^.!?。！？]{0,240}\b(?
 const QUALIFIED_EVIDENCE_SUBJECT_RE = /^\s*(?:[-*+>]\s+|\d+[.)]\s+)?(?:(?:given|when|then|and)\s+)?(?=[^.!?。！？]{0,240}\b(?:positive|negative|affirmative|meta-analysis(?:-only)?|regression|table-driven)\b)(?=[^.!?。！？]{0,240}\b(?:fixtures?|controls?|tests?|examples?|assertions?|findings?)\b)[^.!?。！？]{1,240}$/iu;
 const CONTRACT_ANALYSIS_SUBJECT_RE = /^\s*(?:[-*+>]\s+|\d+[.)]\s+)?(?:(?:given|when|then|and)\s+)?(?:(?:the|this|that|a|an|any|each|our|existing|current)\s+)?(?:[\p{L}\p{N}_-]+\s+){0,2}contract\s+(?:evidence|inference|requirements?)\b/iu;
 const CONTRACT_ANALYSIS_PREDICATE_RE = /\b(?:(?:is|are)\s+(?:inferred|expected|selected|classified|matched|detected|discussed|reported|recorded)|expects?|records?|describes?)\b|\b(?:detector|classifier|matcher)\s+evidence\b|\b(?:positive[ -]?control|expected\s+absence|meta-analysis(?:-only)?)\b/iu;
+const META_ANALYSIS_TOOL_OUTPUT_RE = /\b(?:challenge[_\s]spec|challenge\s+tool)\b[^.!?\n]{0,120}?\bcall\b[^.!?\n]{0,120}?\b(?:emitted|returned|produced|reported|surfaced)\b[^.!?\n]{0,120}?\bscenarios?\b/iu;
 function stripExcludedMarkdownSections(text) {
     const lines = text.split('\n');
     const kept = [];
@@ -71,7 +72,8 @@ export function stripMetaAnalysisText(text) {
         !META_ANALYSIS_EVIDENCE_RE.test(clause) &&
         !EXPECTED_META_ANALYSIS_RE.test(clause) &&
         !QUALIFIED_EVIDENCE_SUBJECT_RE.test(clause) &&
-        !(CONTRACT_ANALYSIS_SUBJECT_RE.test(clause) && CONTRACT_ANALYSIS_PREDICATE_RE.test(clause)))
+        !(CONTRACT_ANALYSIS_SUBJECT_RE.test(clause) && CONTRACT_ANALYSIS_PREDICATE_RE.test(clause)) &&
+        !META_ANALYSIS_TOOL_OUTPUT_RE.test(clause))
         .join('\n');
 }
 function clauseBefore(text, index) {

package/dist/tools/challenge-spec/scenarios-utils.js

@@ -16,7 +16,7 @@ const CAPABILITY_SIGNALS = {
     ],
     authentication: [/\b(?:login|sign[ -]?in|password|jwt|oauth2?|session\s+auth)\b/i],
     authorization: [
-        /\b(?:authori[sz]ation|permission|rbac|role-based|access\s+control|resource\s+ownership|tenant)\b/i,
+        /\b(?:authori[sz]ation|permission\s+(?:check|model|grant|denied|scope|boundary|set|policy)|access\s+permission|role\s+permission|rbac|role-based|access\s+control|resource\s+ownership|tenant)\b/i,
     ],
     userInput: [
         /\b(?:user|client)\s+input\b/i,
@@ -133,7 +133,7 @@ export function contentMentions(content, keywords) {
 export function detectChallengeCapabilities(spec, specContent) {
     const contractSource = stripReaderPrefix(spec, specContent);
     const source = contractSource.trim().length > 0 ? contractSource : spec.title;
-    const contract = stripMetaAnalysisText(stripNonContractText(source));
+    const contract = stripNonContractText(stripMetaAnalysisText(source));
     const capabilities = Object.fromEntries(Object.entries(CAPABILITY_SIGNALS).map(([capability, patterns]) => [
         capability,
         hasAnyAffirmedMatch(contract, patterns),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.45",
+  "version": "5.3.46",
   "description": "Planu — MCP Server for Spec Driven Development. Cross-platform (Linux/macOS/Windows, x64/arm64).",
   "type": "module",
   "main": "dist/index.js",

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.45",
+  "version": "5.3.46",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",