@planu/cli 5.3.45 → 5.3.47

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## [5.3.47] - 2026-08-24
+
+### Bug Fixes
+- fix(spec-1599): make handoff ownership and spec-review approval errors self-serviceable
+
+### Chores
+- chore(planu): record SPEC-1599 done and file SPEC-1600 dogfood spec
+
+
+## [5.3.46] - 2026-08-24
+
+### Bug Fixes
+- fix(spec-1285): meta filter sees backticked tool token; harden AC1 coverage
+- fix(spec-1285): stop local privacy specs activating auth/meta challenge families
+
+### Chores
+- chore(planu): record SPEC-1285 done and SPEC-1598 discarded (merged into SPEC-1285)
+
+
 ## [5.3.45] - 2026-08-24
 
 ### Bug Fixes

package/dist/engine/handoff-packager.js

@@ -239,7 +239,7 @@ function isSafeOwnershipResidual(value) {
             remaining = remaining.slice(connector.length);
             continue;
         }
-        if (',;&'.includes(remaining[0] ?? '')) {
+        if (',;&.'.includes(remaining[0] ?? '')) {
             remaining = remaining.slice(1);
             continue;
         }
@@ -259,8 +259,30 @@ function isSafeOwnershipResidual(value) {
     }
     return true;
 }
-function ownershipBlocker(path, classifications) {
-    return `handoff_ownership_invalid path=${path} classifications=${classifications.join(',')}`;
+const OWNERSHIP_LINE_SHAPE_HINT = 'Use exactly one backticked full path: - Create|Modify: `exact/canonical/path` (pending) — plain description. No path in prose, no extra backticked tokens.';
+const OWNERSHIP_DUPLICATE_HINT = 'Path is declared twice under the same section; list it once.';
+const OWNERSHIP_CONFLICT_HINT = 'Path is declared under both ### Create and ### Modify; keep it in only one.';
+function ownershipMissingSectionHint(classification) {
+    return `Add a ### ${classification} subsection under ## Files with a - \`path\` bullet, or - None. if there are none.`;
+}
+function ownershipMalformedSectionHint(classification) {
+    return `The ### ${classification} subsection has no list items; add a - \`path\` bullet or - None.`;
+}
+function ownershipNoneConflictHint(classification) {
+    return `The ### ${classification} subsection mixes - None. with real paths; use one or the other.`;
+}
+function ownershipAgreementHint(canonicalClass, workPlanClass, path) {
+    if (canonicalClass === 'Absent') {
+        return `Declared as ${workPlanClass} in ### File-Level Work Plan with no matching entry in ## Files; add "- ${workPlanClass}: \`${path}\`" under ### ${workPlanClass} in ## Files, or remove the work-plan line.`;
+    }
+    if (workPlanClass === 'Absent') {
+        return `Declared under ### ${canonicalClass} in ## Files; add the line "- ${canonicalClass}: \`${path}\` (pending) — <description>" to ### File-Level Work Plan.`;
+    }
+    return `Declared under ### ${canonicalClass} in ## Files but as ${workPlanClass} in ### File-Level Work Plan; align the verb in one of the two sections.`;
+}
+function ownershipBlocker(path, classifications, hint) {
+    const base = `handoff_ownership_invalid path=${path} classifications=${classifications.join(',')}`;
+    return hint ? `${base} hint=${JSON.stringify(hint)}` : base;
 }
 function stripInertOwnershipMarkup(content) {
     let fence = null;
@@ -312,7 +334,7 @@ function collectStrictOwnershipEntry(rawValue, classification, state) {
     const residualIsSafe = isSafeOwnershipResidual(residual);
     if (backtickedPaths.some((path) => path === null) ||
         (backtickedValues.length > 0 && !residualIsSafe)) {
-        state.blockers.push(ownershipBlocker('<redacted>', [classification, 'InvalidPath']));
+        state.blockers.push(ownershipBlocker('<redacted>', [classification, 'InvalidPath'], OWNERSHIP_LINE_SHAPE_HINT));
         return;
     }
     const directPath = normalizeStrictOwnedPath(rawPath);
@@ -323,7 +345,7 @@ function collectStrictOwnershipEntry(rawValue, classification, state) {
             : [directPath];
     if (paths.length === 0) {
         const diagnosticPath = /^`[^`]+`$/u.test(rawPath) ? '<redacted>' : rawPath || '<empty>';
-        state.blockers.push(ownershipBlocker(diagnosticPath, [classification, 'InvalidPath']));
+        state.blockers.push(ownershipBlocker(diagnosticPath, [classification, 'InvalidPath'], OWNERSHIP_LINE_SHAPE_HINT));
         return;
     }
     for (const path of paths) {
@@ -334,11 +356,11 @@ function collectStrictOwnershipPath(path, classification, state) {
     const own = classification === 'Create' ? state.create : state.modify;
     const other = classification === 'Create' ? state.modify : state.create;
     if (own.has(path)) {
-        state.blockers.push(ownershipBlocker(path, [classification, classification]));
+        state.blockers.push(ownershipBlocker(path, [classification, classification], OWNERSHIP_DUPLICATE_HINT));
         return;
     }
     if (other.has(path)) {
-        state.blockers.push(ownershipBlocker(path, ['Create', 'Modify']));
+        state.blockers.push(ownershipBlocker(path, ['Create', 'Modify'], OWNERSHIP_CONFLICT_HINT));
         own.delete(path);
         other.delete(path);
         return;
@@ -354,7 +376,7 @@ function extractStrictCanonicalOwnership(content) {
     const parseSection = (classification) => {
         const subsection = sectionContentAtLevel(filesSection, classification, 3);
         if (subsection === null) {
-            state.blockers.push(ownershipBlocker('<missing>', [classification, 'MissingSection']));
+            state.blockers.push(ownershipBlocker('<missing>', [classification, 'MissingSection'], ownershipMissingSectionHint(classification)));
             return;
         }
         const items = subsection
@@ -362,14 +384,14 @@ function extractStrictCanonicalOwnership(content) {
             .map((line) => /^\s*[-*]\s+(.+)$/u.exec(line)?.[1]?.trim())
             .filter((item) => Boolean(item));
         if (items.length === 0) {
-            state.blockers.push(ownershipBlocker('<empty>', [classification, 'Malformed']));
+            state.blockers.push(ownershipBlocker('<empty>', [classification, 'Malformed'], ownershipMalformedSectionHint(classification)));
             return;
         }
         let explicitNone = false;
         for (const item of items) {
             if (/^none\.?$/iu.test(item.trim())) {
                 if (explicitNone) {
-                    state.blockers.push(ownershipBlocker('<none>', [classification, classification]));
+                    state.blockers.push(ownershipBlocker('<none>', [classification, classification], ownershipNoneConflictHint(classification)));
                 }
                 explicitNone = true;
                 continue;
@@ -378,7 +400,7 @@ function extractStrictCanonicalOwnership(content) {
         }
         const own = classification === 'Create' ? state.create : state.modify;
         if (explicitNone && own.size > 0) {
-            state.blockers.push(ownershipBlocker('<none>', [classification, classification]));
+            state.blockers.push(ownershipBlocker('<none>', [classification, classification], ownershipNoneConflictHint(classification)));
         }
     };
     parseSection('Create');
@@ -432,7 +454,9 @@ function validateOwnershipAgreement(canonical, workPlan, testDeclaredPaths) {
         const workPlanClass = classification(workPlan, path);
         return canonicalClass === workPlanClass
             ? []
-            : [ownershipBlocker(path, [`Canonical:${canonicalClass}`, `WorkPlan:${workPlanClass}`])];
+            : [
+                ownershipBlocker(path, [`Canonical:${canonicalClass}`, `WorkPlan:${workPlanClass}`], ownershipAgreementHint(canonicalClass, workPlanClass, path)),
+            ];
     });
 }
 function extractBacktickedFiles(content) {

package/dist/engine/text-signal-boundaries.js

@@ -25,6 +25,7 @@ const EXPECTED_META_ANALYSIS_RE = /^\s*expected\s*:(?=[^.!?。！？]{0,240}\b(?
 const QUALIFIED_EVIDENCE_SUBJECT_RE = /^\s*(?:[-*+>]\s+|\d+[.)]\s+)?(?:(?:given|when|then|and)\s+)?(?=[^.!?。！？]{0,240}\b(?:positive|negative|affirmative|meta-analysis(?:-only)?|regression|table-driven)\b)(?=[^.!?。！？]{0,240}\b(?:fixtures?|controls?|tests?|examples?|assertions?|findings?)\b)[^.!?。！？]{1,240}$/iu;
 const CONTRACT_ANALYSIS_SUBJECT_RE = /^\s*(?:[-*+>]\s+|\d+[.)]\s+)?(?:(?:given|when|then|and)\s+)?(?:(?:the|this|that|a|an|any|each|our|existing|current)\s+)?(?:[\p{L}\p{N}_-]+\s+){0,2}contract\s+(?:evidence|inference|requirements?)\b/iu;
 const CONTRACT_ANALYSIS_PREDICATE_RE = /\b(?:(?:is|are)\s+(?:inferred|expected|selected|classified|matched|detected|discussed|reported|recorded)|expects?|records?|describes?)\b|\b(?:detector|classifier|matcher)\s+evidence\b|\b(?:positive[ -]?control|expected\s+absence|meta-analysis(?:-only)?)\b/iu;
+const META_ANALYSIS_TOOL_OUTPUT_RE = /\b(?:challenge[_\s]spec|challenge\s+tool)\b[^.!?\n]{0,120}?\bcall\b[^.!?\n]{0,120}?\b(?:emitted|returned|produced|reported|surfaced)\b[^.!?\n]{0,120}?\bscenarios?\b/iu;
 function stripExcludedMarkdownSections(text) {
     const lines = text.split('\n');
     const kept = [];
@@ -71,7 +72,8 @@ export function stripMetaAnalysisText(text) {
         !META_ANALYSIS_EVIDENCE_RE.test(clause) &&
         !EXPECTED_META_ANALYSIS_RE.test(clause) &&
         !QUALIFIED_EVIDENCE_SUBJECT_RE.test(clause) &&
-        !(CONTRACT_ANALYSIS_SUBJECT_RE.test(clause) && CONTRACT_ANALYSIS_PREDICATE_RE.test(clause)))
+        !(CONTRACT_ANALYSIS_SUBJECT_RE.test(clause) && CONTRACT_ANALYSIS_PREDICATE_RE.test(clause)) &&
+        !META_ANALYSIS_TOOL_OUTPUT_RE.test(clause))
         .join('\n');
 }
 function clauseBefore(text, index) {

package/dist/tools/challenge-spec/scenarios-utils.js

@@ -16,7 +16,7 @@ const CAPABILITY_SIGNALS = {
     ],
     authentication: [/\b(?:login|sign[ -]?in|password|jwt|oauth2?|session\s+auth)\b/i],
     authorization: [
-        /\b(?:authori[sz]ation|permission|rbac|role-based|access\s+control|resource\s+ownership|tenant)\b/i,
+        /\b(?:authori[sz]ation|permission\s+(?:check|model|grant|denied|scope|boundary|set|policy)|access\s+permission|role\s+permission|rbac|role-based|access\s+control|resource\s+ownership|tenant)\b/i,
     ],
     userInput: [
         /\b(?:user|client)\s+input\b/i,
@@ -133,7 +133,7 @@ export function contentMentions(content, keywords) {
 export function detectChallengeCapabilities(spec, specContent) {
     const contractSource = stripReaderPrefix(spec, specContent);
     const source = contractSource.trim().length > 0 ? contractSource : spec.title;
-    const contract = stripMetaAnalysisText(stripNonContractText(source));
+    const contract = stripNonContractText(stripMetaAnalysisText(source));
     const capabilities = Object.fromEntries(Object.entries(CAPABILITY_SIGNALS).map(([capability, patterns]) => [
         capability,
         hasAnyAffirmedMatch(contract, patterns),

package/dist/tools/update-status/dod-gates.js

@@ -581,7 +581,7 @@ export async function checkSpecReviewGate(specId, projectId, _forceApprove) {
                 error: 'spec_review_stub',
                 message: 'Spec review feedback is a lifecycle-generated stub, not evidence from a real reviewer.',
                 blockers: [],
-                fixHint: 'Replace the stub with genuine planu-spec-reviewer evidence in the handoff store, then retry approval.',
+                fixHint: `Write handoffs/${specId}/review_feedback.md as a substantive ReviewFeedbackV1 JSON: schema_version 1.0.0, verdict, reviewer.kind spec-review-agent, reviewer.agent planu-spec-reviewer, and a body covering scope reviewed, findings, and verdict rationale (not the lifecycle stub body). It must be written by an independent reviewer that is not the spec author.`,
             });
         }
         if (review.verdict !== 'approved' || review.reviewer.verdict !== 'approved') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.45",
+  "version": "5.3.47",
   "description": "Planu — MCP Server for Spec Driven Development. Cross-platform (Linux/macOS/Windows, x64/arm64).",
   "type": "module",
   "main": "dist/index.js",

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.45",
+  "version": "5.3.47",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",